From 4400372f37ac9cf1ecb70cd3d31f7aa0bc445ad2 Mon Sep 17 00:00:00 2001
From: Viktor Liu <17948409+lixmal@users.noreply.github.com>
Date: Mon, 29 Jun 2026 01:50:17 +0900
Subject: [PATCH 01/36] [client] Forward non-address DNS record types through
 route forwarders (#6455)

---
 client/internal/dns/resutil/resolve.go        | 230 ++++++++++++++-
 client/internal/dns/resutil/resolve_test.go   | 159 +++++++++++
 client/internal/dnsfwd/forwarder.go           |  70 ++++-
 client/internal/dnsfwd/forwarder_test.go      | 267 ++++++++++++++++--
 .../routemanager/dnsinterceptor/handler.go    |  24 +-
 5 files changed, 703 insertions(+), 47 deletions(-)

diff --git a/client/internal/dns/resutil/resolve.go b/client/internal/dns/resutil/resolve.go
index a2599aee7..931938755 100644
--- a/client/internal/dns/resutil/resolve.go
+++ b/client/internal/dns/resutil/resolve.go
@@ -8,6 +8,7 @@ import (
 	"errors"
 	"net"
 	"net/netip"
+	"slices"
 	"strings"
 
 	"github.com/miekg/dns"
@@ -167,7 +168,10 @@ func getRcodeForNotFound(ctx context.Context, r resolver, domain string, origina
 	case dns.TypeA:
 		alternativeNetwork = "ip6"
 	default:
-		return dns.RcodeNameError
+		// Non-address types reach LookupIP only unexpectedly; without an
+		// address pair to probe we cannot prove the name is absent, so answer
+		// NODATA rather than a poisoning NXDOMAIN.
+		return dns.RcodeSuccess
 	}
 
 	if _, err := r.LookupNetIP(ctx, alternativeNetwork, domain); err != nil {
@@ -184,6 +188,230 @@ func getRcodeForNotFound(ctx context.Context, r resolver, domain string, origina
 	return dns.RcodeSuccess
 }
 
+// RecordResolver is the host resolver surface used to forward non-address
+// record queries. net.DefaultResolver satisfies it.
+type RecordResolver interface {
+	LookupMX(ctx context.Context, name string) ([]*net.MX, error)
+	LookupTXT(ctx context.Context, name string) ([]string, error)
+	LookupNS(ctx context.Context, name string) ([]*net.NS, error)
+	LookupSRV(ctx context.Context, service, proto, name string) (string, []*net.SRV, error)
+	LookupCNAME(ctx context.Context, host string) (string, error)
+	LookupAddr(ctx context.Context, addr string) ([]string, error)
+}
+
+// LookupRecords resolves a non-address DNS record type through the host
+// resolver and returns the resource records and the DNS rcode. Types the host
+// resolver cannot answer (anything not covered by the net.Resolver Lookup*
+// methods) yield NODATA so that a routed name is never poisoned with NXDOMAIN
+// for an unsupported type.
+func LookupRecords(ctx context.Context, r RecordResolver, name string, qtype uint16, ttl uint32) ([]dns.RR, int) {
+	fqdn := dns.Fqdn(name)
+
+	switch qtype {
+	case dns.TypeMX:
+		return lookupMX(ctx, r, name, fqdn, ttl)
+	case dns.TypeTXT:
+		return lookupTXT(ctx, r, name, fqdn, ttl)
+	case dns.TypeNS:
+		return lookupNS(ctx, r, name, fqdn, ttl)
+	case dns.TypeSRV:
+		return lookupSRV(ctx, r, name, fqdn, ttl)
+	case dns.TypeCNAME:
+		return lookupCNAME(ctx, r, name, fqdn, ttl)
+	case dns.TypePTR:
+		return lookupPTR(ctx, r, name, fqdn, ttl)
+	default:
+		return nil, dns.RcodeSuccess
+	}
+}
+
+func recordHeader(fqdn string, rrtype uint16, ttl uint32) dns.RR_Header {
+	return dns.RR_Header{Name: fqdn, Rrtype: rrtype, Class: dns.ClassINET, Ttl: ttl}
+}
+
+func lookupMX(ctx context.Context, r RecordResolver, name, fqdn string, ttl uint32) ([]dns.RR, int) {
+	recs, err := r.LookupMX(ctx, name)
+	if err != nil {
+		return nil, rcodeForRecordError(err)
+	}
+	rrs := make([]dns.RR, 0, len(recs))
+	for _, mx := range recs {
+		rrs = append(rrs, &dns.MX{
+			Hdr:        recordHeader(fqdn, dns.TypeMX, ttl),
+			Preference: mx.Pref,
+			Mx:         dns.Fqdn(mx.Host),
+		})
+	}
+	return rrs, dns.RcodeSuccess
+}
+
+func lookupTXT(ctx context.Context, r RecordResolver, name, fqdn string, ttl uint32) ([]dns.RR, int) {
+	recs, err := r.LookupTXT(ctx, name)
+	if err != nil {
+		return nil, rcodeForRecordError(err)
+	}
+	rrs := make([]dns.RR, 0, len(recs))
+	for _, txt := range recs {
+		rrs = append(rrs, &dns.TXT{
+			Hdr: recordHeader(fqdn, dns.TypeTXT, ttl),
+			Txt: chunkTXT(txt),
+		})
+	}
+	return rrs, dns.RcodeSuccess
+}
+
+func lookupNS(ctx context.Context, r RecordResolver, name, fqdn string, ttl uint32) ([]dns.RR, int) {
+	recs, err := r.LookupNS(ctx, name)
+	if err != nil {
+		return nil, rcodeForRecordError(err)
+	}
+	rrs := make([]dns.RR, 0, len(recs))
+	for _, ns := range recs {
+		rrs = append(rrs, &dns.NS{
+			Hdr: recordHeader(fqdn, dns.TypeNS, ttl),
+			Ns:  dns.Fqdn(ns.Host),
+		})
+	}
+	return rrs, dns.RcodeSuccess
+}
+
+func lookupSRV(ctx context.Context, r RecordResolver, name, fqdn string, ttl uint32) ([]dns.RR, int) {
+	_, recs, err := r.LookupSRV(ctx, "", "", name)
+	if err != nil {
+		return nil, rcodeForRecordError(err)
+	}
+	rrs := make([]dns.RR, 0, len(recs))
+	for _, srv := range recs {
+		rrs = append(rrs, &dns.SRV{
+			Hdr:      recordHeader(fqdn, dns.TypeSRV, ttl),
+			Priority: srv.Priority,
+			Weight:   srv.Weight,
+			Port:     srv.Port,
+			Target:   dns.Fqdn(srv.Target),
+		})
+	}
+	return rrs, dns.RcodeSuccess
+}
+
+func lookupCNAME(ctx context.Context, r RecordResolver, name, fqdn string, ttl uint32) ([]dns.RR, int) {
+	cname, err := r.LookupCNAME(ctx, name)
+	if err != nil {
+		return nil, rcodeForRecordError(err)
+	}
+	// LookupCNAME returns the queried name itself when the name resolves but
+	// has no CNAME record; that is a NODATA result, not a CNAME.
+	if strings.EqualFold(dns.Fqdn(cname), fqdn) {
+		return nil, dns.RcodeSuccess
+	}
+	return []dns.RR{&dns.CNAME{
+		Hdr:    recordHeader(fqdn, dns.TypeCNAME, ttl),
+		Target: dns.Fqdn(cname),
+	}}, dns.RcodeSuccess
+}
+
+func lookupPTR(ctx context.Context, r RecordResolver, name, fqdn string, ttl uint32) ([]dns.RR, int) {
+	addr, ok := ptrQueryAddr(name)
+	if !ok {
+		return nil, dns.RcodeSuccess
+	}
+	names, err := r.LookupAddr(ctx, addr)
+	if err != nil {
+		return nil, rcodeForRecordError(err)
+	}
+	rrs := make([]dns.RR, 0, len(names))
+	for _, n := range names {
+		rrs = append(rrs, &dns.PTR{
+			Hdr: recordHeader(fqdn, dns.TypePTR, ttl),
+			Ptr: dns.Fqdn(n),
+		})
+	}
+	return rrs, dns.RcodeSuccess
+}
+
+// ptrQueryAddr converts a reverse-DNS query name (in-addr.arpa or ip6.arpa)
+// into the address string expected by net.Resolver.LookupAddr. It reports false
+// when the name is not a well-formed reverse name.
+func ptrQueryAddr(qname string) (string, bool) {
+	name := strings.TrimSuffix(strings.ToLower(dns.Fqdn(qname)), ".")
+
+	switch {
+	case strings.HasSuffix(name, ".in-addr.arpa"):
+		return parseInAddrArpa(strings.TrimSuffix(name, ".in-addr.arpa"))
+	case strings.HasSuffix(name, ".ip6.arpa"):
+		return parseIP6Arpa(strings.TrimSuffix(name, ".ip6.arpa"))
+	default:
+		return "", false
+	}
+}
+
+// parseInAddrArpa turns the label portion of an in-addr.arpa name into an IPv4
+// address string, reporting false when it is not a well-formed reverse name.
+func parseInAddrArpa(labelPart string) (string, bool) {
+	labels := strings.Split(labelPart, ".")
+	if len(labels) != 4 {
+		return "", false
+	}
+	slices.Reverse(labels)
+	addr, err := netip.ParseAddr(strings.Join(labels, "."))
+	if err != nil || !addr.Is4() {
+		return "", false
+	}
+	return addr.String(), true
+}
+
+// parseIP6Arpa turns the nibble portion of an ip6.arpa name into an IPv6
+// address string, reporting false when it is not a well-formed reverse name.
+func parseIP6Arpa(nibblePart string) (string, bool) {
+	nibbles := strings.Split(nibblePart, ".")
+	if len(nibbles) != 32 {
+		return "", false
+	}
+	slices.Reverse(nibbles)
+	var sb strings.Builder
+	for i, n := range nibbles {
+		if i > 0 && i%4 == 0 {
+			sb.WriteByte(':')
+		}
+		sb.WriteString(n)
+	}
+	addr, err := netip.ParseAddr(sb.String())
+	if err != nil || !addr.Is6() {
+		return "", false
+	}
+	return addr.String(), true
+}
+
+// rcodeForRecordError maps a non-address lookup error to a DNS rcode. A
+// not-found result becomes NODATA rather than NXDOMAIN: net.DNSError.IsNotFound
+// does not distinguish a missing name from a name that exists only with records
+// of other types, so the name cannot be proven absent and must not be poisoned.
+func rcodeForRecordError(err error) int {
+	var dnsErr *net.DNSError
+	if errors.As(err, &dnsErr) && dnsErr.IsNotFound {
+		return dns.RcodeSuccess
+	}
+	return dns.RcodeServerFailure
+}
+
+// chunkTXT splits a TXT string into character-strings no longer than 255 bytes
+// so the record can be packed. The chunks form one TXT resource record.
+func chunkTXT(s string) []string {
+	const maxLen = 255
+	if len(s) <= maxLen {
+		return []string{s}
+	}
+
+	var chunks []string
+	for len(s) > maxLen {
+		chunks = append(chunks, s[:maxLen])
+		s = s[maxLen:]
+	}
+	if len(s) > 0 {
+		chunks = append(chunks, s)
+	}
+	return chunks
+}
+
 // FormatAnswers formats DNS resource records for logging.
 func FormatAnswers(answers []dns.RR) string {
 	if len(answers) == 0 {
diff --git a/client/internal/dns/resutil/resolve_test.go b/client/internal/dns/resutil/resolve_test.go
index e6a8cc6a5..f51092a83 100644
--- a/client/internal/dns/resutil/resolve_test.go
+++ b/client/internal/dns/resutil/resolve_test.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"net"
 	"net/netip"
+	"strings"
 	"testing"
 
 	"github.com/miekg/dns"
@@ -121,6 +122,164 @@ func TestLookupIP_DNSErrorNotIsNotFound(t *testing.T) {
 	assert.Equal(t, dns.RcodeServerFailure, result.Rcode, "upstream failure should map to SERVFAIL")
 }
 
+func TestPtrQueryAddr(t *testing.T) {
+	tests := []struct {
+		name   string
+		qname  string
+		want   string
+		wantOK bool
+	}{
+		{name: "ipv4", qname: "4.3.2.1.in-addr.arpa.", want: "1.2.3.4", wantOK: true},
+		{name: "ipv4 no trailing dot", qname: "1.0.0.127.in-addr.arpa", want: "127.0.0.1", wantOK: true},
+		{
+			name:   "ipv6",
+			qname:  "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.",
+			want:   "2001:db8::1",
+			wantOK: true,
+		},
+		{name: "ipv4 wrong label count", qname: "2.1.in-addr.arpa.", wantOK: false},
+		{name: "ipv6 wrong nibble count", qname: "1.0.ip6.arpa.", wantOK: false},
+		{name: "not a reverse name", qname: "example.com.", wantOK: false},
+		{name: "ipv4 bad octet", qname: "4.3.2.999.in-addr.arpa.", wantOK: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, ok := ptrQueryAddr(tt.qname)
+			assert.Equal(t, tt.wantOK, ok, "parse success mismatch")
+			if tt.wantOK {
+				assert.Equal(t, tt.want, got, "parsed address mismatch")
+			}
+		})
+	}
+}
+
+type mockRecordResolver struct {
+	mx    []*net.MX
+	txt   []string
+	ns    []*net.NS
+	srv   []*net.SRV
+	cname string
+	ptr   []string
+	err   error
+}
+
+func (m *mockRecordResolver) LookupMX(context.Context, string) ([]*net.MX, error) {
+	return m.mx, m.err
+}
+func (m *mockRecordResolver) LookupTXT(context.Context, string) ([]string, error) {
+	return m.txt, m.err
+}
+func (m *mockRecordResolver) LookupNS(context.Context, string) ([]*net.NS, error) {
+	return m.ns, m.err
+}
+func (m *mockRecordResolver) LookupSRV(context.Context, string, string, string) (string, []*net.SRV, error) {
+	return "", m.srv, m.err
+}
+func (m *mockRecordResolver) LookupCNAME(context.Context, string) (string, error) {
+	return m.cname, m.err
+}
+func (m *mockRecordResolver) LookupAddr(context.Context, string) ([]string, error) {
+	return m.ptr, m.err
+}
+
+func TestLookupRecords(t *testing.T) {
+	notFound := &net.DNSError{IsNotFound: true, Name: "example.com."}
+
+	t.Run("MX success", func(t *testing.T) {
+		r := &mockRecordResolver{mx: []*net.MX{{Host: "mail.example.com.", Pref: 10}}}
+		rrs, rcode := LookupRecords(context.Background(), r, "example.com.", dns.TypeMX, 300)
+		assert.Equal(t, dns.RcodeSuccess, rcode)
+		require.Len(t, rrs, 1)
+		assert.Equal(t, "mail.example.com.", rrs[0].(*dns.MX).Mx)
+	})
+
+	t.Run("TXT short string is one character-string", func(t *testing.T) {
+		r := &mockRecordResolver{txt: []string{"v=spf1 -all"}}
+		rrs, rcode := LookupRecords(context.Background(), r, "example.com.", dns.TypeTXT, 300)
+		assert.Equal(t, dns.RcodeSuccess, rcode)
+		require.Len(t, rrs, 1)
+		assert.Equal(t, []string{"v=spf1 -all"}, rrs[0].(*dns.TXT).Txt)
+	})
+
+	t.Run("TXT chunks long strings", func(t *testing.T) {
+		long := strings.Repeat("a", 300)
+		r := &mockRecordResolver{txt: []string{long}}
+		rrs, rcode := LookupRecords(context.Background(), r, "example.com.", dns.TypeTXT, 300)
+		assert.Equal(t, dns.RcodeSuccess, rcode)
+		require.Len(t, rrs, 1)
+		txt := rrs[0].(*dns.TXT).Txt
+		require.Len(t, txt, 2, "300-byte string should split into two character-strings")
+		assert.Equal(t, 255, len(txt[0]))
+		assert.Equal(t, 45, len(txt[1]))
+	})
+
+	t.Run("NS success", func(t *testing.T) {
+		r := &mockRecordResolver{ns: []*net.NS{{Host: "ns1.example.com."}}}
+		rrs, rcode := LookupRecords(context.Background(), r, "example.com.", dns.TypeNS, 300)
+		assert.Equal(t, dns.RcodeSuccess, rcode)
+		require.Len(t, rrs, 1)
+		assert.Equal(t, "ns1.example.com.", rrs[0].(*dns.NS).Ns)
+	})
+
+	t.Run("SRV success", func(t *testing.T) {
+		r := &mockRecordResolver{srv: []*net.SRV{{Target: "sip.example.com.", Port: 5060}}}
+		rrs, rcode := LookupRecords(context.Background(), r, "_sip._tcp.example.com.", dns.TypeSRV, 300)
+		assert.Equal(t, dns.RcodeSuccess, rcode)
+		require.Len(t, rrs, 1)
+		assert.Equal(t, uint16(5060), rrs[0].(*dns.SRV).Port)
+	})
+
+	t.Run("CNAME success", func(t *testing.T) {
+		r := &mockRecordResolver{cname: "target.example.com."}
+		rrs, rcode := LookupRecords(context.Background(), r, "www.example.com.", dns.TypeCNAME, 300)
+		assert.Equal(t, dns.RcodeSuccess, rcode)
+		require.Len(t, rrs, 1)
+		assert.Equal(t, "target.example.com.", rrs[0].(*dns.CNAME).Target)
+	})
+
+	t.Run("CNAME equal to name is NODATA", func(t *testing.T) {
+		r := &mockRecordResolver{cname: "example.com."}
+		rrs, rcode := LookupRecords(context.Background(), r, "example.com.", dns.TypeCNAME, 300)
+		assert.Equal(t, dns.RcodeSuccess, rcode)
+		assert.Empty(t, rrs, "self-referential CNAME is NODATA")
+	})
+
+	t.Run("PTR success", func(t *testing.T) {
+		r := &mockRecordResolver{ptr: []string{"host.example.com."}}
+		rrs, rcode := LookupRecords(context.Background(), r, "4.3.2.1.in-addr.arpa.", dns.TypePTR, 300)
+		assert.Equal(t, dns.RcodeSuccess, rcode)
+		require.Len(t, rrs, 1)
+		assert.Equal(t, "host.example.com.", rrs[0].(*dns.PTR).Ptr)
+	})
+
+	t.Run("PTR malformed name is NODATA", func(t *testing.T) {
+		r := &mockRecordResolver{}
+		rrs, rcode := LookupRecords(context.Background(), r, "example.com.", dns.TypePTR, 300)
+		assert.Equal(t, dns.RcodeSuccess, rcode)
+		assert.Empty(t, rrs)
+	})
+
+	t.Run("not found is NODATA never NXDOMAIN", func(t *testing.T) {
+		r := &mockRecordResolver{err: notFound}
+		_, rcode := LookupRecords(context.Background(), r, "example.com.", dns.TypeMX, 300)
+		assert.Equal(t, dns.RcodeSuccess, rcode, "missing record must not poison the name")
+	})
+
+	t.Run("server failure maps to SERVFAIL", func(t *testing.T) {
+		r := &mockRecordResolver{err: &net.DNSError{Err: "server misbehaving", IsTemporary: true}}
+		_, rcode := LookupRecords(context.Background(), r, "example.com.", dns.TypeMX, 300)
+		assert.Equal(t, dns.RcodeServerFailure, rcode)
+	})
+
+	t.Run("unsupported type is NODATA", func(t *testing.T) {
+		r := &mockRecordResolver{}
+		rrs, rcode := LookupRecords(context.Background(), r, "example.com.", dns.TypeCAA, 300)
+		assert.Equal(t, dns.RcodeSuccess, rcode)
+		assert.Empty(t, rrs)
+	})
+}
+
 func TestStripOPT(t *testing.T) {
 	rm := &dns.Msg{
 		Extra: []dns.RR{
diff --git a/client/internal/dnsfwd/forwarder.go b/client/internal/dnsfwd/forwarder.go
index c15a8520f..b7e5a10e3 100644
--- a/client/internal/dnsfwd/forwarder.go
+++ b/client/internal/dnsfwd/forwarder.go
@@ -37,6 +37,12 @@ const (
 
 type resolver interface {
 	LookupNetIP(ctx context.Context, network, host string) ([]netip.Addr, error)
+	LookupMX(ctx context.Context, name string) ([]*net.MX, error)
+	LookupTXT(ctx context.Context, name string) ([]string, error)
+	LookupNS(ctx context.Context, name string) ([]*net.NS, error)
+	LookupSRV(ctx context.Context, service, proto, name string) (string, []*net.SRV, error)
+	LookupCNAME(ctx context.Context, host string) (string, error)
+	LookupAddr(ctx context.Context, addr string) ([]string, error)
 }
 
 type firewaller interface {
@@ -210,12 +216,6 @@ func (f *DNSForwarder) handleDNSQuery(logger *log.Entry, w dns.ResponseWriter, q
 		qname, dns.TypeToString[question.Qtype], dns.ClassToString[question.Qclass])
 
 	resp := query.SetReply(query)
-	network := resutil.NetworkForQtype(question.Qtype)
-	if network == "" {
-		resp.Rcode = dns.RcodeNotImplemented
-		f.writeResponse(logger, w, resp, qname, startTime)
-		return
-	}
 
 	mostSpecificResId, matchingEntries := f.getMatchingEntries(strings.TrimSuffix(qname, "."))
 	if mostSpecificResId == "" {
@@ -227,9 +227,46 @@ func (f *DNSForwarder) handleDNSQuery(logger *log.Entry, w dns.ResponseWriter, q
 	ctx, cancel := context.WithTimeout(context.Background(), upstreamTimeout)
 	defer cancel()
 
+	reqHasEdns := query.IsEdns0() != nil
+
+	switch question.Qtype {
+	case dns.TypeA, dns.TypeAAAA:
+		f.handleAddressQuery(ctx, logger, w, resp, mostSpecificResId, matchingEntries, reqHasEdns, startTime)
+	case dns.TypeMX, dns.TypeTXT, dns.TypeNS, dns.TypeSRV, dns.TypeCNAME, dns.TypePTR:
+		f.handleRecordQuery(ctx, logger, w, resp, startTime)
+	default:
+		// The domain is routed here, so any other type is answered NODATA
+		// (NOERROR, empty answer) rather than falling back to a resolver that
+		// would poison the name with NXDOMAIN. The Extended DNS Error lets a
+		// client tell this capability-driven NODATA apart from an
+		// authoritative one. The OPT pseudo-record must not appear unless the
+		// query advertised EDNS0.
+		if reqHasEdns {
+			attachEDE(resp, dns.ExtendedErrorCodeNotSupported, "netbird forwarder: unsupported query type")
+		}
+		f.writeResponse(logger, w, resp, qname, startTime)
+	}
+}
+
+// handleAddressQuery resolves A/AAAA queries, programs the firewall sets and
+// resolved-IP state, and caches the answer for resilience on upstream failure.
+func (f *DNSForwarder) handleAddressQuery(
+	ctx context.Context,
+	logger *log.Entry,
+	w dns.ResponseWriter,
+	resp *dns.Msg,
+	mostSpecificResId route.ResID,
+	matchingEntries []*ForwarderEntry,
+	reqHasEdns bool,
+	startTime time.Time,
+) {
+	question := resp.Question[0]
+	qname := strings.ToLower(question.Name)
+
+	network := resutil.NetworkForQtype(question.Qtype)
 	result := resutil.LookupIP(ctx, f.resolver, network, qname, question.Qtype)
 	if result.Err != nil {
-		f.handleDNSError(ctx, logger, w, question, resp, qname, result, query.IsEdns0() != nil, startTime)
+		f.handleDNSError(ctx, logger, w, question, resp, qname, result, reqHasEdns, startTime)
 		return
 	}
 
@@ -240,6 +277,25 @@ func (f *DNSForwarder) handleDNSQuery(logger *log.Entry, w dns.ResponseWriter, q
 	f.writeResponse(logger, w, resp, qname, startTime)
 }
 
+// handleRecordQuery resolves non-address record types (MX, TXT, NS, SRV,
+// CNAME, PTR) through the host resolver. Missing records are answered NODATA so
+// the routed name is never poisoned with NXDOMAIN.
+func (f *DNSForwarder) handleRecordQuery(
+	ctx context.Context,
+	logger *log.Entry,
+	w dns.ResponseWriter,
+	resp *dns.Msg,
+	startTime time.Time,
+) {
+	question := resp.Question[0]
+	qname := strings.ToLower(question.Name)
+
+	records, rcode := resutil.LookupRecords(ctx, f.resolver, qname, question.Qtype, f.ttl)
+	resp.Rcode = rcode
+	resp.Answer = append(resp.Answer, records...)
+	f.writeResponse(logger, w, resp, qname, startTime)
+}
+
 func (f *DNSForwarder) writeResponse(logger *log.Entry, w dns.ResponseWriter, resp *dns.Msg, qname string, startTime time.Time) {
 	if err := w.WriteMsg(resp); err != nil {
 		logger.Errorf("failed to write DNS response: %v", err)
diff --git a/client/internal/dnsfwd/forwarder_test.go b/client/internal/dnsfwd/forwarder_test.go
index 046595473..c69a9166e 100644
--- a/client/internal/dnsfwd/forwarder_test.go
+++ b/client/internal/dnsfwd/forwarder_test.go
@@ -133,6 +133,41 @@ func (m *MockResolver) LookupNetIP(ctx context.Context, network, host string) ([
 	return args.Get(0).([]netip.Addr), args.Error(1)
 }
 
+func (m *MockResolver) LookupMX(ctx context.Context, name string) ([]*net.MX, error) {
+	args := m.Called(ctx, name)
+	recs, _ := args.Get(0).([]*net.MX)
+	return recs, args.Error(1)
+}
+
+func (m *MockResolver) LookupTXT(ctx context.Context, name string) ([]string, error) {
+	args := m.Called(ctx, name)
+	recs, _ := args.Get(0).([]string)
+	return recs, args.Error(1)
+}
+
+func (m *MockResolver) LookupNS(ctx context.Context, name string) ([]*net.NS, error) {
+	args := m.Called(ctx, name)
+	recs, _ := args.Get(0).([]*net.NS)
+	return recs, args.Error(1)
+}
+
+func (m *MockResolver) LookupSRV(ctx context.Context, service, proto, name string) (string, []*net.SRV, error) {
+	args := m.Called(ctx, service, proto, name)
+	recs, _ := args.Get(1).([]*net.SRV)
+	return args.String(0), recs, args.Error(2)
+}
+
+func (m *MockResolver) LookupCNAME(ctx context.Context, host string) (string, error) {
+	args := m.Called(ctx, host)
+	return args.String(0), args.Error(1)
+}
+
+func (m *MockResolver) LookupAddr(ctx context.Context, addr string) ([]string, error) {
+	args := m.Called(ctx, addr)
+	recs, _ := args.Get(0).([]string)
+	return recs, args.Error(1)
+}
+
 func TestDNSForwarder_SubdomainAccessLogic(t *testing.T) {
 	tests := []struct {
 		name             string
@@ -545,12 +580,15 @@ func TestDNSForwarder_MultipleIPsInSingleUpdate(t *testing.T) {
 }
 
 func TestDNSForwarder_ResponseCodes(t *testing.T) {
+	// A type with no net.Resolver Lookup method (CAA) must answer NODATA
+	// (NOERROR, empty) rather than NXDOMAIN/NOTIMP to avoid poisoning the name.
 	tests := []struct {
 		name         string
 		queryType    uint16
 		queryDomain  string
 		configured   string
 		expectedCode int
+		expectEDE    bool
 		description  string
 	}{
 		{
@@ -562,28 +600,13 @@ func TestDNSForwarder_ResponseCodes(t *testing.T) {
 			description:  "RFC compliant REFUSED for unauthorized queries",
 		},
 		{
-			name:         "unsupported query type returns NOTIMP",
-			queryType:    dns.TypeMX,
+			name:         "unsupported query type returns NODATA",
+			queryType:    dns.TypeCAA,
 			queryDomain:  "example.com",
 			configured:   "example.com",
-			expectedCode: dns.RcodeNotImplemented,
-			description:  "RFC compliant NOTIMP for unsupported types",
-		},
-		{
-			name:         "CNAME query returns NOTIMP",
-			queryType:    dns.TypeCNAME,
-			queryDomain:  "example.com",
-			configured:   "example.com",
-			expectedCode: dns.RcodeNotImplemented,
-			description:  "CNAME queries not supported",
-		},
-		{
-			name:         "TXT query returns NOTIMP",
-			queryType:    dns.TypeTXT,
-			queryDomain:  "example.com",
-			configured:   "example.com",
-			expectedCode: dns.RcodeNotImplemented,
-			description:  "TXT queries not supported",
+			expectedCode: dns.RcodeSuccess,
+			expectEDE:    true,
+			description:  "Unsupported types answer NODATA, not NXDOMAIN/NOTIMP",
 		},
 	}
 
@@ -599,6 +622,7 @@ func TestDNSForwarder_ResponseCodes(t *testing.T) {
 
 			query := &dns.Msg{}
 			query.SetQuestion(dns.Fqdn(tt.queryDomain), tt.queryType)
+			query.SetEdns0(dns.DefaultMsgSize, false)
 
 			// Capture the written response
 			var writtenResp *dns.Msg
@@ -614,10 +638,213 @@ func TestDNSForwarder_ResponseCodes(t *testing.T) {
 			// Check the response written to the writer
 			require.NotNil(t, writtenResp, "Expected response to be written")
 			assert.Equal(t, tt.expectedCode, writtenResp.Rcode, tt.description)
+			assert.Empty(t, writtenResp.Answer, "Non-address response should carry no answers")
+
+			if tt.expectEDE {
+				require.NotNil(t, writtenResp.IsEdns0(), "EDNS0 client should get an OPT in the reply")
+				assert.True(t, hasEDE(writtenResp, dns.ExtendedErrorCodeNotSupported),
+					"unsupported type NODATA should carry EDE Not Supported")
+			}
 		})
 	}
 }
 
+func hasEDE(m *dns.Msg, code uint16) bool {
+	opt := m.IsEdns0()
+	if opt == nil {
+		return false
+	}
+	for _, o := range opt.Option {
+		if ede, ok := o.(*dns.EDNS0_EDE); ok && ede.InfoCode == code {
+			return true
+		}
+	}
+	return false
+}
+
+func TestDNSForwarder_RecordQueries(t *testing.T) {
+	notFound := &net.DNSError{IsNotFound: true, Name: "example.com"}
+
+	t.Run("MX records are forwarded", func(t *testing.T) {
+		mockResolver := &MockResolver{}
+		forwarder := newRecordTestForwarder(t, mockResolver, "example.com")
+
+		mockResolver.On("LookupMX", mock.Anything, "example.com.").
+			Return([]*net.MX{{Host: "mail.example.com.", Pref: 10}}, nil).Once()
+
+		resp := runRecordQuery(t, forwarder, "example.com", dns.TypeMX)
+		require.Equal(t, dns.RcodeSuccess, resp.Rcode)
+		require.Len(t, resp.Answer, 1)
+		mx, ok := resp.Answer[0].(*dns.MX)
+		require.True(t, ok, "answer should be an MX record")
+		assert.Equal(t, uint16(10), mx.Preference)
+		assert.Equal(t, "mail.example.com.", mx.Mx)
+		mockResolver.AssertExpectations(t)
+	})
+
+	t.Run("missing MX is NODATA not NXDOMAIN", func(t *testing.T) {
+		mockResolver := &MockResolver{}
+		forwarder := newRecordTestForwarder(t, mockResolver, "example.com")
+
+		// A not-found cannot prove the name is absent (it may exist with only
+		// other record types), so it must answer NODATA, never NXDOMAIN.
+		mockResolver.On("LookupMX", mock.Anything, "example.com.").
+			Return(nil, notFound).Once()
+
+		resp := runRecordQuery(t, forwarder, "example.com", dns.TypeMX)
+		assert.Equal(t, dns.RcodeSuccess, resp.Rcode, "missing record must be NODATA")
+		assert.Empty(t, resp.Answer)
+		mockResolver.AssertExpectations(t)
+	})
+
+	t.Run("NS records are forwarded", func(t *testing.T) {
+		mockResolver := &MockResolver{}
+		forwarder := newRecordTestForwarder(t, mockResolver, "example.com")
+
+		mockResolver.On("LookupNS", mock.Anything, "example.com.").
+			Return([]*net.NS{{Host: "ns1.example.com."}}, nil).Once()
+
+		resp := runRecordQuery(t, forwarder, "example.com", dns.TypeNS)
+		require.Equal(t, dns.RcodeSuccess, resp.Rcode)
+		require.Len(t, resp.Answer, 1)
+		ns, ok := resp.Answer[0].(*dns.NS)
+		require.True(t, ok, "answer should be an NS record")
+		assert.Equal(t, "ns1.example.com.", ns.Ns)
+		mockResolver.AssertExpectations(t)
+	})
+
+	t.Run("missing NS is NODATA", func(t *testing.T) {
+		mockResolver := &MockResolver{}
+		forwarder := newRecordTestForwarder(t, mockResolver, "example.com")
+
+		mockResolver.On("LookupNS", mock.Anything, "example.com.").
+			Return(nil, notFound).Once()
+
+		resp := runRecordQuery(t, forwarder, "example.com", dns.TypeNS)
+		assert.Equal(t, dns.RcodeSuccess, resp.Rcode)
+		assert.Empty(t, resp.Answer)
+		mockResolver.AssertExpectations(t)
+	})
+
+	t.Run("SRV records are forwarded", func(t *testing.T) {
+		mockResolver := &MockResolver{}
+		forwarder := newRecordTestForwarder(t, mockResolver, "_sip._tcp.example.com")
+
+		mockResolver.On("LookupSRV", mock.Anything, "", "", "_sip._tcp.example.com.").
+			Return("", []*net.SRV{{Target: "sip.example.com.", Port: 5060, Priority: 10, Weight: 5}}, nil).Once()
+
+		resp := runRecordQuery(t, forwarder, "_sip._tcp.example.com", dns.TypeSRV)
+		require.Equal(t, dns.RcodeSuccess, resp.Rcode)
+		require.Len(t, resp.Answer, 1)
+		srv, ok := resp.Answer[0].(*dns.SRV)
+		require.True(t, ok, "answer should be an SRV record")
+		assert.Equal(t, "sip.example.com.", srv.Target)
+		assert.Equal(t, uint16(5060), srv.Port)
+		assert.Equal(t, uint16(10), srv.Priority)
+		mockResolver.AssertExpectations(t)
+	})
+
+	t.Run("missing SRV is NODATA", func(t *testing.T) {
+		mockResolver := &MockResolver{}
+		forwarder := newRecordTestForwarder(t, mockResolver, "_sip._tcp.example.com")
+
+		mockResolver.On("LookupSRV", mock.Anything, "", "", "_sip._tcp.example.com.").
+			Return("", nil, notFound).Once()
+
+		resp := runRecordQuery(t, forwarder, "_sip._tcp.example.com", dns.TypeSRV)
+		assert.Equal(t, dns.RcodeSuccess, resp.Rcode)
+		assert.Empty(t, resp.Answer)
+		mockResolver.AssertExpectations(t)
+	})
+
+	t.Run("TXT records are forwarded", func(t *testing.T) {
+		mockResolver := &MockResolver{}
+		forwarder := newRecordTestForwarder(t, mockResolver, "example.com")
+
+		mockResolver.On("LookupTXT", mock.Anything, "example.com.").
+			Return([]string{"v=spf1 -all"}, nil).Once()
+
+		resp := runRecordQuery(t, forwarder, "example.com", dns.TypeTXT)
+		require.Equal(t, dns.RcodeSuccess, resp.Rcode)
+		require.Len(t, resp.Answer, 1)
+		txt, ok := resp.Answer[0].(*dns.TXT)
+		require.True(t, ok, "answer should be a TXT record")
+		assert.Equal(t, []string{"v=spf1 -all"}, txt.Txt)
+		mockResolver.AssertExpectations(t)
+	})
+
+	t.Run("CNAME record is forwarded", func(t *testing.T) {
+		mockResolver := &MockResolver{}
+		forwarder := newRecordTestForwarder(t, mockResolver, "www.example.com")
+
+		mockResolver.On("LookupCNAME", mock.Anything, "www.example.com.").
+			Return("target.example.com.", nil).Once()
+
+		resp := runRecordQuery(t, forwarder, "www.example.com", dns.TypeCNAME)
+		require.Equal(t, dns.RcodeSuccess, resp.Rcode)
+		require.Len(t, resp.Answer, 1)
+		cname, ok := resp.Answer[0].(*dns.CNAME)
+		require.True(t, ok, "answer should be a CNAME record")
+		assert.Equal(t, "target.example.com.", cname.Target)
+		mockResolver.AssertExpectations(t)
+	})
+
+	t.Run("CNAME equal to the name is NODATA", func(t *testing.T) {
+		mockResolver := &MockResolver{}
+		forwarder := newRecordTestForwarder(t, mockResolver, "example.com")
+
+		// No CNAME exists: LookupCNAME echoes the queried name back.
+		mockResolver.On("LookupCNAME", mock.Anything, "example.com.").
+			Return("example.com.", nil).Once()
+
+		resp := runRecordQuery(t, forwarder, "example.com", dns.TypeCNAME)
+		assert.Equal(t, dns.RcodeSuccess, resp.Rcode)
+		assert.Empty(t, resp.Answer, "self-referential CNAME means no CNAME record")
+		mockResolver.AssertExpectations(t)
+	})
+
+	t.Run("PTR record is forwarded", func(t *testing.T) {
+		mockResolver := &MockResolver{}
+		forwarder := newRecordTestForwarder(t, mockResolver, "*.in-addr.arpa")
+
+		// The reverse name is parsed back to the address LookupAddr expects.
+		mockResolver.On("LookupAddr", mock.Anything, "1.2.3.4").
+			Return([]string{"host.example.com."}, nil).Once()
+
+		resp := runRecordQuery(t, forwarder, "4.3.2.1.in-addr.arpa", dns.TypePTR)
+		require.Equal(t, dns.RcodeSuccess, resp.Rcode)
+		require.Len(t, resp.Answer, 1)
+		ptr, ok := resp.Answer[0].(*dns.PTR)
+		require.True(t, ok, "answer should be a PTR record")
+		assert.Equal(t, "host.example.com.", ptr.Ptr)
+		mockResolver.AssertExpectations(t)
+	})
+}
+
+func newRecordTestForwarder(t *testing.T, r resolver, configured string) *DNSForwarder {
+	t.Helper()
+	forwarder := NewDNSForwarder(netip.MustParseAddrPort("127.0.0.1:0"), 300, nil, &peer.Status{}, nil)
+	forwarder.resolver = r
+
+	d, err := domain.FromString(configured)
+	require.NoError(t, err)
+	forwarder.UpdateDomains([]*ForwarderEntry{{Domain: d, ResID: "test-res"}})
+	return forwarder
+}
+
+func runRecordQuery(t *testing.T, forwarder *DNSForwarder, qname string, qtype uint16) *dns.Msg {
+	t.Helper()
+	query := &dns.Msg{}
+	query.SetQuestion(dns.Fqdn(qname), qtype)
+
+	mockWriter := &test.MockResponseWriter{}
+	forwarder.handleDNSQuery(log.NewEntry(log.StandardLogger()), mockWriter, query, time.Now())
+
+	resp := mockWriter.GetLastResponse()
+	require.NotNil(t, resp, "expected response to be written")
+	return resp
+}
+
 func TestDNSForwarder_UpstreamFailureEDE(t *testing.T) {
 	tests := []struct {
 		name        string
diff --git a/client/internal/routemanager/dnsinterceptor/handler.go b/client/internal/routemanager/dnsinterceptor/handler.go
index 22f3355c8..b784cc274 100644
--- a/client/internal/routemanager/dnsinterceptor/handler.go
+++ b/client/internal/routemanager/dnsinterceptor/handler.go
@@ -226,12 +226,11 @@ func (d *DnsInterceptor) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
 		return
 	}
 
-	// pass if non A/AAAA query
-	if r.Question[0].Qtype != dns.TypeA && r.Question[0].Qtype != dns.TypeAAAA {
-		d.continueToNextHandler(w, r, logger, "non A/AAAA query")
-		return
-	}
-
+	// All query types for an intercepted domain are forwarded to the peer's
+	// DNS forwarder, which owns the name. Falling through to the system
+	// resolver would let it answer NXDOMAIN for a name it isn't authoritative
+	// for, poisoning the whole name (including the A/AAAA records the route
+	// does serve). The forwarder answers NODATA for types it cannot resolve.
 	d.mu.RLock()
 	peerKey := d.currentPeerKey
 	d.mu.RUnlock()
@@ -293,19 +292,6 @@ func (d *DnsInterceptor) writeDNSError(w dns.ResponseWriter, r *dns.Msg, logger
 	}
 }
 
-// continueToNextHandler signals the handler chain to try the next handler
-func (d *DnsInterceptor) continueToNextHandler(w dns.ResponseWriter, r *dns.Msg, logger *log.Entry, reason string) {
-	logger.Tracef("continuing to next handler for domain=%s reason=%s", r.Question[0].Name, reason)
-
-	resp := new(dns.Msg)
-	resp.SetRcode(r, dns.RcodeNameError)
-	// Set Zero bit to signal handler chain to continue
-	resp.MsgHdr.Zero = true
-	if err := w.WriteMsg(resp); err != nil {
-		logger.Errorf("failed writing DNS continue response: %v", err)
-	}
-}
-
 func (d *DnsInterceptor) getUpstreamIP(peerKey string) (netip.Addr, error) {
 	peerAllowedIP, exists := d.peerStore.AllowedIP(peerKey)
 	if !exists {

From 1409a1325a805d70f456244fde999bbb09bb06b6 Mon Sep 17 00:00:00 2001
From: Maycon Santos <mlsmaycon@gmail.com>
Date: Mon, 29 Jun 2026 09:19:01 +0200
Subject: [PATCH 02/36] [misc] Update careers page link (#6538)

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index c9a51b6f1..40c6b9ed5 100644
--- a/README.md
+++ b/README.md
@@ -33,7 +33,7 @@
   <br/>
   <br/>
   <strong>
-    🚀 <a href="https://careers.netbird.io">We are hiring! Join us at careers.netbird.io</a>
+    🚀 <a href="https://netbird.io/careers">We are hiring! Join us at https://netbird.io/careers</a>
   </strong>
 </p>
 

From 5711f0e38c69ddbbfb5604a44a5098a6a04d7dcb Mon Sep 17 00:00:00 2001
From: Riccardo Manfrin <3090891+riccardomanfrin@users.noreply.github.com>
Date: Mon, 29 Jun 2026 11:02:02 +0200
Subject: [PATCH 03/36] [client] add per-phase timing metrics for sync
 processing (#6533)

* Adds metrics sync phases time split to monitor costs

* Address review fixes

* Increment README.md with description on usage with debug bundles
---
 client/internal/engine.go                     | 119 +++++---
 client/internal/metrics/influxdb.go           |  24 ++
 client/internal/metrics/infra/README.md       |  69 ++++-
 .../dashboards/json/netbird-sync-phases.json  | 259 ++++++++++++++++++
 client/internal/metrics/infra/ingest/main.go  |  13 +
 client/internal/metrics/metrics.go            |  15 +
 client/internal/metrics/push_test.go          |   3 +
 7 files changed, 468 insertions(+), 34 deletions(-)
 create mode 100644 client/internal/metrics/infra/grafana/provisioning/dashboards/json/netbird-sync-phases.json

diff --git a/client/internal/engine.go b/client/internal/engine.go
index e7f1c0501..f7c7e1862 100644
--- a/client/internal/engine.go
+++ b/client/internal/engine.go
@@ -895,6 +895,16 @@ func (e *Engine) handleAutoUpdateVersion(autoUpdateSettings *mgmProto.AutoUpdate
 	e.updateManager.SetVersion(autoUpdateSettings.Version, autoUpdateSettings.AlwaysUpdate)
 }
 
+// phase times a sync sub-phase: it returns a function that records the elapsed
+// duration when called. Starting the timer at the call site keeps inter-phase
+// glue code out of the measurement.
+func (e *Engine) phase(name string) func() {
+	start := time.Now()
+	return func() {
+		e.clientMetrics.RecordSyncPhase(e.ctx, name, time.Since(start))
+	}
+}
+
 func (e *Engine) handleSync(update *mgmProto.SyncResponse) error {
 	started := time.Now()
 	defer func() {
@@ -914,7 +924,10 @@ func (e *Engine) handleSync(update *mgmProto.SyncResponse) error {
 		e.handleAutoUpdateVersion(update.NetworkMap.PeerConfig.AutoUpdate)
 	}
 
-	if err := e.updateNetbirdConfig(update.GetNetbirdConfig()); err != nil {
+	done := e.phase("netbird_config")
+	err := e.updateNetbirdConfig(update.GetNetbirdConfig())
+	done()
+	if err != nil {
 		return err
 	}
 
@@ -928,11 +941,16 @@ func (e *Engine) handleSync(update *mgmProto.SyncResponse) error {
 		return nil
 	}
 
-	if err := e.updateChecksIfNew(update.Checks); err != nil {
+	done = e.phase("checks")
+	err = e.updateChecksIfNew(update.Checks)
+	done()
+	if err != nil {
 		return err
 	}
 
+	done = e.phase("persist")
 	e.persistSyncResponse(update)
+	done()
 
 	// only apply new changes and ignore old ones
 	if err := e.updateNetworkMap(nm); err != nil {
@@ -1371,13 +1389,16 @@ func (e *Engine) updateNetworkMap(networkMap *mgmProto.NetworkMap) error {
 
 	dnsConfig := toDNSConfig(protoDNSConfig, e.wgInterface.Address())
 
+	done := e.phase("dns_server")
 	if err := e.dnsServer.UpdateDNSServer(serial, dnsConfig); err != nil {
 		log.Errorf("failed to update dns server, err: %v", err)
 	}
+	done()
 
 	e.routeManager.SetDNSForwarderPort(dnsConfig.ForwarderPort)
 
 	// apply routes first, route related actions might depend on routing being enabled
+	done = e.phase("routes_classify")
 	routes := toRoutes(networkMap.GetRoutes())
 	serverRoutes, clientRoutes := e.routeManager.ClassifyRoutes(routes)
 
@@ -1386,29 +1407,60 @@ func (e *Engine) updateNetworkMap(networkMap *mgmProto.NetworkMap) error {
 		e.connMgr.UpdateRouteHAMap(clientRoutes)
 		log.Debugf("updated lazy connection manager with %d HA groups", len(clientRoutes))
 	}
+	done()
 
+	done = e.phase("routes_apply")
 	dnsRouteFeatureFlag := toDNSFeatureFlag(networkMap)
 	if err := e.routeManager.UpdateRoutes(serial, serverRoutes, clientRoutes, dnsRouteFeatureFlag); err != nil {
 		log.Errorf("failed to update routes: %v", err)
 	}
+	done()
 
+	done = e.phase("filtering")
 	if e.acl != nil {
 		e.acl.ApplyFiltering(networkMap, dnsRouteFeatureFlag)
 	}
+	done()
 
+	done = e.phase("dns_forwarder")
 	fwdEntries := toRouteDomains(e.config.WgPrivateKey.PublicKey().String(), routes)
 	e.updateDNSForwarder(dnsRouteFeatureFlag, fwdEntries)
+	done()
 
 	// Ingress forward rules
+	done = e.phase("forward_rules")
 	forwardingRules, err := e.updateForwardRules(networkMap.GetForwardingRules())
 	if err != nil {
 		log.Errorf("failed to update forward rules, err: %v", err)
 	}
+	done()
 
 	log.Debugf("got peers update from Management Service, total peers to connect to = %d", len(networkMap.GetRemotePeers()))
 
+	done = e.phase("offline_peers")
 	e.updateOfflinePeers(networkMap.GetOfflinePeers())
+	done()
 
+	remotePeers, err := e.reconcilePeers(networkMap)
+	if err != nil {
+		return err
+	}
+
+	// must set the exclude list after the peers are added. Without it the manager can not figure out the peers parameters from the store
+	done = e.phase("lazy_exclude")
+	excludedLazyPeers := e.toExcludedLazyPeers(forwardingRules, remotePeers)
+	e.connMgr.SetExcludeList(e.ctx, excludedLazyPeers)
+	done()
+
+	e.networkSerial = serial
+
+	return nil
+}
+
+// reconcilePeers applies the remote peer list from the network map (removing,
+// modifying and adding peers, then updating SSH config) and returns the remote
+// peers with our own peer filtered out, for use by later sync steps.
+func (e *Engine) reconcilePeers(networkMap *mgmProto.NetworkMap) ([]*mgmProto.RemotePeerConfig, error) {
 	// Filter out own peer from the remote peers list
 	localPubKey := e.config.WgPrivateKey.PublicKey().String()
 	remotePeers := make([]*mgmProto.RemotePeerConfig, 0, len(networkMap.GetRemotePeers()))
@@ -1423,42 +1475,43 @@ func (e *Engine) updateNetworkMap(networkMap *mgmProto.NetworkMap) error {
 		err := e.removeAllPeers()
 		e.statusRecorder.FinishPeerListModifications()
 		if err != nil {
-			return err
+			return nil, err
 		}
-	} else {
-		err := e.removePeers(remotePeers)
-		if err != nil {
-			return err
-		}
-
-		err = e.modifyPeers(remotePeers)
-		if err != nil {
-			return err
-		}
-
-		err = e.addNewPeers(remotePeers)
-		if err != nil {
-			return err
-		}
-
-		e.statusRecorder.FinishPeerListModifications()
-
-		e.updatePeerSSHHostKeys(remotePeers)
-
-		if err := e.updateSSHClientConfig(remotePeers); err != nil {
-			log.Warnf("failed to update SSH client config: %v", err)
-		}
-
-		e.updateSSHServerAuth(networkMap.GetSshAuth())
+		return remotePeers, nil
 	}
 
-	// must set the exclude list after the peers are added. Without it the manager can not figure out the peers parameters from the store
-	excludedLazyPeers := e.toExcludedLazyPeers(forwardingRules, remotePeers)
-	e.connMgr.SetExcludeList(e.ctx, excludedLazyPeers)
+	done := e.phase("removed_peers")
+	err := e.removePeers(remotePeers)
+	done()
+	if err != nil {
+		return nil, err
+	}
 
-	e.networkSerial = serial
+	done = e.phase("modified_peers")
+	err = e.modifyPeers(remotePeers)
+	done()
+	if err != nil {
+		return nil, err
+	}
 
-	return nil
+	done = e.phase("added_peers")
+	err = e.addNewPeers(remotePeers)
+	done()
+	if err != nil {
+		return nil, err
+	}
+
+	e.statusRecorder.FinishPeerListModifications()
+
+	e.updatePeerSSHHostKeys(remotePeers)
+
+	if err := e.updateSSHClientConfig(remotePeers); err != nil {
+		log.Warnf("failed to update SSH client config: %v", err)
+	}
+
+	e.updateSSHServerAuth(networkMap.GetSshAuth())
+
+	return remotePeers, nil
 }
 
 func toDNSFeatureFlag(networkMap *mgmProto.NetworkMap) bool {
diff --git a/client/internal/metrics/influxdb.go b/client/internal/metrics/influxdb.go
index 531f6a986..4ba14bf44 100644
--- a/client/internal/metrics/influxdb.go
+++ b/client/internal/metrics/influxdb.go
@@ -120,6 +120,30 @@ func (m *influxDBMetrics) RecordSyncDuration(_ context.Context, agentInfo AgentI
 	m.trimLocked()
 }
 
+func (m *influxDBMetrics) RecordSyncPhase(_ context.Context, agentInfo AgentInfo, phase string, duration time.Duration) {
+	tags := fmt.Sprintf("deployment_type=%s,version=%s,os=%s,arch=%s,peer_id=%s,phase=%s",
+		agentInfo.DeploymentType.String(),
+		agentInfo.Version,
+		agentInfo.OS,
+		agentInfo.Arch,
+		agentInfo.peerID,
+		phase,
+	)
+
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	m.samples = append(m.samples, influxSample{
+		measurement: "netbird_sync_phase",
+		tags:        tags,
+		fields: map[string]float64{
+			"duration_seconds": duration.Seconds(),
+		},
+		timestamp: time.Now(),
+	})
+	m.trimLocked()
+}
+
 func (m *influxDBMetrics) RecordLoginDuration(_ context.Context, agentInfo AgentInfo, duration time.Duration, success bool) {
 	result := "success"
 	if !success {
diff --git a/client/internal/metrics/infra/README.md b/client/internal/metrics/infra/README.md
index 5a93dbd87..7941a30cf 100644
--- a/client/internal/metrics/infra/README.md
+++ b/client/internal/metrics/infra/README.md
@@ -78,6 +78,25 @@ Tags:
 - `os`: Operating system (linux, darwin, windows, android, ios, etc.)
 - `arch`: CPU architecture (amd64, arm64, etc.)
 
+### Sync Phase Timing
+
+Measurement: `netbird_sync_phase`
+
+Breaks down where time goes inside a single sync, so the total `netbird_sync` duration can be attributed to the sub-step that dominates.
+
+| Field | Description |
+|-------|-------------|
+| `duration_seconds` | Time spent in one sub-phase of sync processing |
+
+Tags:
+- `phase`: the sub-phase — `netbird_config`, `checks`, `persist`, `dns_server`, `routes_classify`, `routes_apply`, `filtering`, `dns_forwarder`, `forward_rules`, `offline_peers`, `removed_peers`, `modified_peers`, `added_peers`, `lazy_exclude`
+- `deployment_type`: "cloud" | "selfhosted" | "unknown"
+- `version`: NetBird version string
+- `os`: Operating system (linux, darwin, windows, android, ios, etc.)
+- `arch`: CPU architecture (amd64, arm64, etc.)
+
+**Note:** this is wall-time per phase — it includes both CPU work and time spent waiting on locks. A slow phase points to *where* the time goes, not *why*; pair it with lock-wait metrics to tell contention apart from real work.
+
 ### Login Duration
 
 Measurement: `netbird_login`
@@ -191,4 +210,52 @@ docker compose exec influxdb influx query \
 
 # Check ingest server health
 curl http://localhost:8087/health
-```
\ No newline at end of file
+```
+
+## Analyzing a Debug Bundle
+
+Metrics collection is always on, so every debug bundle ships a `metrics.txt` in InfluxDB line protocol — a timestamped time series of all recorded events (sync durations, sync phases, connection stages, login). You can replay it into the local stack and graph it, without a running client.
+
+The bundle's `metrics.txt` is a rolling window (capped at 5 days / ~20k samples, see [Buffer Limits](#buffer-limits)). For a connection incident the relevant window is short (connection setup is seconds), so a bundle captured during the issue is enough.
+
+### 1. Start the stack
+
+```bash
+# From this directory (client/internal/metrics/infra)
+INFLUXDB_ADMIN_TOKEN=admin123 INFLUXDB_ADMIN_PASSWORD=admin123 GRAFANA_ADMIN_PASSWORD=admin123 \
+  docker compose up -d
+```
+
+(`admin123` are throwaway local credentials — fine for offline analysis.)
+
+### 2. Clear any previous data
+
+So you only see this bundle:
+
+```bash
+docker exec influxdb influx delete --org netbird --bucket metrics --token admin123 \
+  --start 1970-01-01T00:00:00Z --stop 2100-01-01T00:00:00Z
+```
+
+### 3. Import the bundle's metrics.txt
+
+InfluxDB is not exposed on the host, so import inside the container:
+
+```bash
+docker cp /path/to/bundle/metrics.txt influxdb:/tmp/m.txt
+docker exec influxdb influx write --org netbird --bucket metrics --precision ns \
+  --token admin123 --file /tmp/m.txt
+```
+
+Re-importing the same file is idempotent (same measurement+tags+timestamp overwrites).
+
+### 4. View the dashboards
+
+Grafana on http://localhost:3001 (login `admin` / `admin123`), datasource pre-provisioned:
+
+- **Where sync time goes:** http://localhost:3001/d/netbird-sync-phases/netbird-sync-phases-where-time-goes
+- **General client metrics:** http://localhost:3001/d/netbird-influxdb-metrics
+
+**Set the time range** to cover the bundle's timestamps (e.g. "Last 7 days" or an absolute range matching when the bundle was taken) — with the default short range the panels look empty.
+
+Bundles are distinguishable by the `version` tag; add a tag at import time (e.g. `sed 's/^netbird_\([a-z_]*\),/netbird_\1,bundle=mycase,/' metrics.txt`) if you want to compare several side by side.
\ No newline at end of file
diff --git a/client/internal/metrics/infra/grafana/provisioning/dashboards/json/netbird-sync-phases.json b/client/internal/metrics/infra/grafana/provisioning/dashboards/json/netbird-sync-phases.json
new file mode 100644
index 000000000..69dbac0ae
--- /dev/null
+++ b/client/internal/metrics/infra/grafana/provisioning/dashboards/json/netbird-sync-phases.json
@@ -0,0 +1,259 @@
+{
+  "annotations": {
+    "list": []
+  },
+  "editable": true,
+  "fiscalYearStartMonth": 0,
+  "graphTooltip": 1,
+  "links": [],
+  "refresh": "",
+  "schemaVersion": 39,
+  "tags": [
+    "netbird",
+    "sync"
+  ],
+  "templating": {
+    "list": [
+      {
+        "current": {
+          "text": "All",
+          "value": "$__all"
+        },
+        "datasource": {
+          "type": "influxdb",
+          "uid": "influxdb"
+        },
+        "definition": "import \"influxdata/influxdb/schema\"\nschema.tagValues(bucket: \"metrics\", tag: \"version\")",
+        "includeAll": true,
+        "label": "version",
+        "multi": true,
+        "name": "version",
+        "query": "import \"influxdata/influxdb/schema\"\nschema.tagValues(bucket: \"metrics\", tag: \"version\")",
+        "refresh": 2,
+        "type": "query",
+        "allValue": ".*"
+      }
+    ]
+  },
+  "time": {
+    "from": "now-2d",
+    "to": "now"
+  },
+  "timepicker": {},
+  "timezone": "",
+  "title": "NetBird Sync Phases (where time goes)",
+  "uid": "netbird-sync-phases",
+  "version": 1,
+  "panels": [
+    {
+      "id": 1,
+      "title": "Time per phase over time (stacked, ms)",
+      "type": "timeseries",
+      "datasource": {
+        "type": "influxdb",
+        "uid": "influxdb"
+      },
+      "gridPos": {
+        "h": 10,
+        "w": 24,
+        "x": 0,
+        "y": 0
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "ms",
+          "custom": {
+            "drawStyle": "bars",
+            "stacking": {
+              "mode": "normal",
+              "group": "A"
+            },
+            "fillOpacity": 80,
+            "lineWidth": 0
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "legend": {
+          "displayMode": "table",
+          "placement": "right",
+          "calcs": [
+            "max",
+            "mean"
+          ]
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "desc"
+        }
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "datasource": {
+            "type": "influxdb",
+            "uid": "influxdb"
+          },
+          "query": "from(bucket: \"metrics\")\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r._measurement == \"netbird_sync_phase\" and r._field == \"duration_seconds\")\n  |> filter(fn: (r) => r.version =~ /${version:regex}/)\n  |> map(fn: (r) => ({ r with _value: r._value * 1000.0 }))\n  |> keep(columns: [\"_time\", \"_value\", \"phase\"])\n  |> group(columns: [\"phase\"])"
+        }
+      ]
+    },
+    {
+      "id": 2,
+      "title": "p95 per phase (ms)",
+      "type": "bargauge",
+      "datasource": {
+        "type": "influxdb",
+        "uid": "influxdb"
+      },
+      "gridPos": {
+        "h": 11,
+        "w": 12,
+        "x": 0,
+        "y": 10
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "ms",
+          "color": {
+            "mode": "continuous-GrYlRd"
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "displayMode": "gradient",
+        "orientation": "horizontal",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "showUnfilled": true
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "datasource": {
+            "type": "influxdb",
+            "uid": "influxdb"
+          },
+          "query": "from(bucket: \"metrics\")\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r._measurement == \"netbird_sync_phase\" and r._field == \"duration_seconds\")\n  |> filter(fn: (r) => r.version =~ /${version:regex}/)\n  |> map(fn: (r) => ({ r with _value: r._value * 1000.0 }))\n  |> group(columns: [\"phase\"])\n  |> quantile(q: 0.95)\n  |> group()\n  |> sort(columns: [\"_value\"], desc: true)"
+        }
+      ]
+    },
+    {
+      "id": 3,
+      "title": "Per-phase stats (ms): mean / p95 / max",
+      "type": "table",
+      "datasource": {
+        "type": "influxdb",
+        "uid": "influxdb"
+      },
+      "gridPos": {
+        "h": 11,
+        "w": 12,
+        "x": 12,
+        "y": 10
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "ms"
+        },
+        "overrides": []
+      },
+      "options": {
+        "showHeader": true,
+        "sortBy": [
+          {
+            "displayName": "max",
+            "desc": true
+          }
+        ]
+      },
+      "transformations": [
+        {
+          "id": "merge",
+          "options": {}
+        }
+      ],
+      "targets": [
+        {
+          "refId": "mean",
+          "datasource": {
+            "type": "influxdb",
+            "uid": "influxdb"
+          },
+          "query": "from(bucket: \"metrics\")\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r._measurement == \"netbird_sync_phase\" and r._field == \"duration_seconds\")\n  |> filter(fn: (r) => r.version =~ /${version:regex}/)\n  |> map(fn: (r) => ({ r with _value: r._value * 1000.0 }))\n  |> group(columns: [\"phase\"])\n  |> mean()\n  |> group()\n  |> keep(columns: [\"phase\", \"_value\"])\n  |> rename(columns: {_value: \"mean\"})"
+        },
+        {
+          "refId": "p95",
+          "datasource": {
+            "type": "influxdb",
+            "uid": "influxdb"
+          },
+          "query": "from(bucket: \"metrics\")\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r._measurement == \"netbird_sync_phase\" and r._field == \"duration_seconds\")\n  |> filter(fn: (r) => r.version =~ /${version:regex}/)\n  |> map(fn: (r) => ({ r with _value: r._value * 1000.0 }))\n  |> group(columns: [\"phase\"])\n  |> quantile(q: 0.95)\n  |> group()\n  |> keep(columns: [\"phase\", \"_value\"])\n  |> rename(columns: {_value: \"p95\"})"
+        },
+        {
+          "refId": "max",
+          "datasource": {
+            "type": "influxdb",
+            "uid": "influxdb"
+          },
+          "query": "from(bucket: \"metrics\")\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r._measurement == \"netbird_sync_phase\" and r._field == \"duration_seconds\")\n  |> filter(fn: (r) => r.version =~ /${version:regex}/)\n  |> map(fn: (r) => ({ r with _value: r._value * 1000.0 }))\n  |> group(columns: [\"phase\"])\n  |> max()\n  |> group()\n  |> keep(columns: [\"phase\", \"_value\"])\n  |> rename(columns: {_value: \"max\"})"
+        }
+      ]
+    },
+    {
+      "id": 4,
+      "title": "Total sync duration (netbird_sync, ms) \u2014 reference",
+      "type": "timeseries",
+      "datasource": {
+        "type": "influxdb",
+        "uid": "influxdb"
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 24,
+        "x": 0,
+        "y": 21
+      },
+      "fieldConfig": {
+        "defaults": {
+          "unit": "ms",
+          "custom": {
+            "drawStyle": "points",
+            "pointSize": 5
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "legend": {
+          "displayMode": "table",
+          "placement": "right",
+          "calcs": [
+            "max",
+            "mean"
+          ]
+        },
+        "tooltip": {
+          "mode": "single"
+        }
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "datasource": {
+            "type": "influxdb",
+            "uid": "influxdb"
+          },
+          "query": "from(bucket: \"metrics\")\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r._measurement == \"netbird_sync\" and r._field == \"duration_seconds\")\n  |> filter(fn: (r) => r.version =~ /${version:regex}/)\n  |> map(fn: (r) => ({ r with _value: r._value * 1000.0 }))\n  |> keep(columns: [\"_time\", \"_value\", \"version\"])\n  |> group(columns: [\"version\"])"
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/client/internal/metrics/infra/ingest/main.go b/client/internal/metrics/infra/ingest/main.go
index a5031a873..623a17e4d 100644
--- a/client/internal/metrics/infra/ingest/main.go
+++ b/client/internal/metrics/infra/ingest/main.go
@@ -59,6 +59,19 @@ var allowedMeasurements = map[string]measurementSpec{
 			"peer_id":         true,
 		},
 	},
+	"netbird_sync_phase": {
+		allowedFields: map[string]bool{
+			"duration_seconds": true,
+		},
+		allowedTags: map[string]bool{
+			"deployment_type": true,
+			"version":         true,
+			"os":              true,
+			"arch":            true,
+			"peer_id":         true,
+			"phase":           true,
+		},
+	},
 	"netbird_login": {
 		allowedFields: map[string]bool{
 			"duration_seconds": true,
diff --git a/client/internal/metrics/metrics.go b/client/internal/metrics/metrics.go
index 4ebb43496..f18082995 100644
--- a/client/internal/metrics/metrics.go
+++ b/client/internal/metrics/metrics.go
@@ -56,6 +56,9 @@ type metricsImplementation interface {
 	// RecordSyncDuration records how long it took to process a sync message
 	RecordSyncDuration(ctx context.Context, agentInfo AgentInfo, duration time.Duration)
 
+	// RecordSyncPhase records how long a single sub-phase of sync processing took
+	RecordSyncPhase(ctx context.Context, agentInfo AgentInfo, phase string, duration time.Duration)
+
 	// RecordLoginDuration records how long the login to management took
 	RecordLoginDuration(ctx context.Context, agentInfo AgentInfo, duration time.Duration, success bool)
 
@@ -127,6 +130,18 @@ func (c *ClientMetrics) RecordSyncDuration(ctx context.Context, duration time.Du
 	c.impl.RecordSyncDuration(ctx, agentInfo, duration)
 }
 
+// RecordSyncPhase records the duration of a single sub-phase of sync processing
+func (c *ClientMetrics) RecordSyncPhase(ctx context.Context, phase string, duration time.Duration) {
+	if c == nil {
+		return
+	}
+	c.mu.RLock()
+	agentInfo := c.agentInfo
+	c.mu.RUnlock()
+
+	c.impl.RecordSyncPhase(ctx, agentInfo, phase, duration)
+}
+
 // RecordLoginDuration records how long the login to management server took
 func (c *ClientMetrics) RecordLoginDuration(ctx context.Context, duration time.Duration, success bool) {
 	if c == nil {
diff --git a/client/internal/metrics/push_test.go b/client/internal/metrics/push_test.go
index 20a509da1..43c1b2c06 100644
--- a/client/internal/metrics/push_test.go
+++ b/client/internal/metrics/push_test.go
@@ -70,6 +70,9 @@ func (m *mockMetrics) RecordConnectionStages(_ context.Context, _ AgentInfo, _ s
 func (m *mockMetrics) RecordSyncDuration(_ context.Context, _ AgentInfo, _ time.Duration) {
 }
 
+func (m *mockMetrics) RecordSyncPhase(_ context.Context, _ AgentInfo, _ string, _ time.Duration) {
+}
+
 func (m *mockMetrics) RecordLoginDuration(_ context.Context, _ AgentInfo, _ time.Duration, _ bool) {
 }
 

From deff8af59f13222d245abfdfc7e2e700c74dd8c7 Mon Sep 17 00:00:00 2001
From: Zoltan Papp <zoltan.pmail@gmail.com>
Date: Mon, 29 Jun 2026 11:24:25 +0200
Subject: [PATCH 04/36] [client] Wait for signal receive watchdog to stop
 before reconnect (#6574)

* [client] Wait for signal receive watchdog to stop before reconnect

The per-stream watchReceiveStream goroutine was started fire-and-forget
and never joined. On reconnect a lingering watchdog could still flip
shared client state (receiveStalled, the disconnect notifier) on the
freshly established stream, since cancelStream only cancels its own
stream context.

Track the watchdog with a WaitGroup and wait for it to exit (after
cancelling its stream) before the operation returns, so each reconnect
starts with no stale watchdog.

* [client] Bind signal receive probe to the stream context

The watchdog probe reused the generic Send, which derives its per-attempt
timeouts from the long-lived client context, so cancelStream could not
interrupt an in-flight probe. After joining the watchdog on reconnect,
watchdogWg.Wait() could then block for the full send-attempt chain.

Split Send into a context-aware send and pass the stream context down
through sendReceiveProbe, so cancelStream aborts any in-flight probe and
the watchdog exits promptly.
---
 shared/signal/client/grpc.go          | 30 ++++++++++++++++++++-------
 shared/signal/client/watchdog_test.go |  2 +-
 2 files changed, 24 insertions(+), 8 deletions(-)

diff --git a/shared/signal/client/grpc.go b/shared/signal/client/grpc.go
index 611ab0c45..7e8e551b6 100644
--- a/shared/signal/client/grpc.go
+++ b/shared/signal/client/grpc.go
@@ -85,6 +85,7 @@ type GrpcClient struct {
 	// receive backpressure as a dead stream: reconnecting cannot help, since the
 	// new stream feeds the same worker, and only triggers a reconnect storm.
 	receiveHandoffBlocked atomic.Bool
+	watchdogWg            sync.WaitGroup
 }
 
 // NewClient creates a new Signal client
@@ -200,10 +201,18 @@ func (c *GrpcClient) Receive(ctx context.Context, msgHandler func(msg *proto.Mes
 		// Guard the receive direction: the transport can stay healthy while the
 		// server stops delivering messages. The watchdog reconnects via cancelStream.
 		c.markReceived()
-		go c.watchReceiveStream(streamCtx, cancelStream)
+		c.watchdogWg.Add(1)
+		go func() {
+			defer c.watchdogWg.Done()
+			c.watchReceiveStream(streamCtx, cancelStream)
+		}()
 
 		// start receiving messages from the Signal stream (from other peers through signal)
 		err = c.receive(stream)
+
+		cancelStream()
+		c.watchdogWg.Wait()
+
 		if err != nil {
 			// Check the parent context, not streamCtx: a watchdog-triggered
 			// cancelStream must reconnect, only a parent cancel is shutdown.
@@ -400,7 +409,12 @@ func (c *GrpcClient) encryptMessage(msg *proto.Message) (*proto.EncryptedMessage
 
 // Send sends a message to the remote Peer through the Signal Exchange.
 func (c *GrpcClient) Send(msg *proto.Message) error {
+	return c.send(c.ctx, msg)
+}
 
+// send delivers a message deriving per-attempt timeouts from parentCtx, so a
+// caller can abort an in-flight send by cancelling that context.
+func (c *GrpcClient) send(parentCtx context.Context, msg *proto.Message) error {
 	if !c.Ready() {
 		return fmt.Errorf("no connection to signal")
 	}
@@ -416,7 +430,7 @@ func (c *GrpcClient) Send(msg *proto.Message) error {
 		if attempt > 1 {
 			attemptTimeout = time.Duration(attempt) * 5 * time.Second
 		}
-		ctx, cancel := context.WithTimeout(c.ctx, attemptTimeout)
+		ctx, cancel := context.WithTimeout(parentCtx, attemptTimeout)
 
 		_, err = c.realClient.Send(ctx, encryptedMessage)
 
@@ -486,7 +500,7 @@ func (c *GrpcClient) watchReceiveStream(ctx context.Context, cancelStream contex
 			}
 
 			if probeSentAt.IsZero() {
-				if err := c.sendReceiveProbe(); err != nil {
+				if err := c.sendReceiveProbe(ctx); err != nil {
 					log.Debugf("failed to send signal receive probe: %v", err)
 				}
 				probeSentAt = time.Now()
@@ -495,11 +509,13 @@ func (c *GrpcClient) watchReceiveStream(ctx context.Context, cancelStream contex
 	}
 }
 
-// sendReceiveProbe sends a self-addressed heartbeat. The Signal server routes it
-// back to this client, exercising the exact receive path the watchdog guards.
-func (c *GrpcClient) sendReceiveProbe() error {
+// sendReceiveProbe sends a self-addressed heartbeat bound to ctx, so cancelStream
+// aborts an in-flight probe instead of leaving the watchdog blocked on send timeouts.
+// The Signal server routes it back to this client, exercising the exact receive
+// path the watchdog guards.
+func (c *GrpcClient) sendReceiveProbe(ctx context.Context) error {
 	self := c.key.PublicKey().String()
-	return c.Send(&proto.Message{
+	return c.send(ctx, &proto.Message{
 		Key:       self,
 		RemoteKey: self,
 		Body:      &proto.Body{Type: proto.Body_HEARTBEAT},
diff --git a/shared/signal/client/watchdog_test.go b/shared/signal/client/watchdog_test.go
index bc6b5520b..eeb9aec30 100644
--- a/shared/signal/client/watchdog_test.go
+++ b/shared/signal/client/watchdog_test.go
@@ -74,7 +74,7 @@ func TestReceiveProbeRoundTrips(t *testing.T) {
 		t.Fatal("signal stream did not connect within timeout")
 	}
 
-	require.NoError(t, client.sendReceiveProbe())
+	require.NoError(t, client.sendReceiveProbe(ctx))
 
 	select {
 	case <-received:

From 0b594c639a75dc96af7893e85d87729966eec681 Mon Sep 17 00:00:00 2001
From: Zoltan Papp <zoltan.pmail@gmail.com>
Date: Mon, 29 Jun 2026 11:28:58 +0200
Subject: [PATCH 05/36] [client] report management unhealthy while Sync stream
 is failing (#6575)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(mgm): report management unhealthy while Sync stream is failing

The health probe (IsHealthy) only checked the gRPC transport and a
GetServerKey call. GetServerKey succeeds even when the peer cannot sync
(e.g. the server returns "settings not found"), so the probe kept marking
management Connected while the Sync stream failed in a tight retry loop —
pinning the status to "Connected" forever despite no sync ever succeeding.

Track the last Sync stream error and have IsHealthy consult it, so a
healthy transport is no longer enough to report the connection healthy.

* fix(mgm): record disconnected state when sync stream setup fails

The connectToSyncStream failure path in handleSyncStream returned early
without updating syncStreamErr, so the client could still report healthy
even when stream setup failed. Mirror the receiveUpdatesEvents error path
by calling notifyDisconnected and setSyncStreamDisconnected.
---
 shared/management/client/grpc.go | 37 ++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/shared/management/client/grpc.go b/shared/management/client/grpc.go
index 016cde68a..6f5172376 100644
--- a/shared/management/client/grpc.go
+++ b/shared/management/client/grpc.go
@@ -55,6 +55,14 @@ type GrpcClient struct {
 	connStateCallback     ConnStateNotifier
 	connStateCallbackLock sync.RWMutex
 	serverURL             string
+
+	// syncStreamErr holds the last Sync stream error, or nil while the stream
+	// is established and healthy. GetServerKey succeeds even when the peer
+	// cannot sync (e.g. the server returns "settings not found"), so the
+	// health probe must consult this to avoid reporting a healthy management
+	// connection while the Sync stream keeps failing.
+	syncStreamMu  sync.RWMutex
+	syncStreamErr error
 }
 
 type ExposeRequest struct {
@@ -364,6 +372,8 @@ func (c *GrpcClient) handleSyncStream(ctx context.Context, serverPubKey wgtypes.
 	stream, err := c.connectToSyncStream(ctx, serverPubKey, sysInfo)
 	if err != nil {
 		log.Debugf("failed to open Management Service stream: %s", err)
+		c.notifyDisconnected(err)
+		c.setSyncStreamDisconnected(err)
 		if s, ok := gstatus.FromError(err); ok && s.Code() == codes.PermissionDenied {
 			return backoff.Permanent(err) // unrecoverable error, propagate to the upper layer
 		}
@@ -372,11 +382,13 @@ func (c *GrpcClient) handleSyncStream(ctx context.Context, serverPubKey wgtypes.
 
 	log.Infof("connected to the Management Service stream")
 	c.notifyConnected()
+	c.setSyncStreamConnected()
 
 	// blocking until error
 	err = c.receiveUpdatesEvents(stream, serverPubKey, msgHandler)
 	if err != nil {
 		c.notifyDisconnected(err)
+		c.setSyncStreamDisconnected(err)
 		if ctx.Err() != nil {
 			log.Debugf("management connection context has been canceled, this usually indicates shutdown")
 			return nil
@@ -530,6 +542,13 @@ func (c *GrpcClient) IsHealthy() bool {
 		log.Warnf("health check returned: %s", err)
 		return false
 	}
+
+	if syncErr := c.syncStreamError(); syncErr != nil {
+		c.notifyDisconnected(syncErr)
+		log.Warnf("management transport is up but the Sync stream is unhealthy: %s", syncErr)
+		return false
+	}
+
 	c.notifyConnected()
 	return true
 }
@@ -771,6 +790,24 @@ func (c *GrpcClient) SyncMeta(sysInfo *system.Info) error {
 	return err
 }
 
+func (c *GrpcClient) setSyncStreamConnected() {
+	c.syncStreamMu.Lock()
+	defer c.syncStreamMu.Unlock()
+	c.syncStreamErr = nil
+}
+
+func (c *GrpcClient) setSyncStreamDisconnected(err error) {
+	c.syncStreamMu.Lock()
+	defer c.syncStreamMu.Unlock()
+	c.syncStreamErr = err
+}
+
+func (c *GrpcClient) syncStreamError() error {
+	c.syncStreamMu.RLock()
+	defer c.syncStreamMu.RUnlock()
+	return c.syncStreamErr
+}
+
 func (c *GrpcClient) notifyDisconnected(err error) {
 	c.connStateCallbackLock.RLock()
 	defer c.connStateCallbackLock.RUnlock()

From b434cda0627a01538bf977f89b8e4834d95d2fed Mon Sep 17 00:00:00 2001
From: Viktor Liu <17948409+lixmal@users.noreply.github.com>
Date: Mon, 29 Jun 2026 19:16:47 +0900
Subject: [PATCH 06/36] [client] Refresh signal receive liveness when worker
 handoff drains (#6594)

---
 shared/signal/client/grpc.go          |  3 ++
 shared/signal/client/watchdog_test.go | 70 +++++++++++++++++++++++++++
 2 files changed, 73 insertions(+)

diff --git a/shared/signal/client/grpc.go b/shared/signal/client/grpc.go
index 7e8e551b6..a07867263 100644
--- a/shared/signal/client/grpc.go
+++ b/shared/signal/client/grpc.go
@@ -557,6 +557,9 @@ func (c *GrpcClient) receive(stream proto.SignalExchange_ConnectStreamClient) er
 		if err := c.decryptionWorker.AddMsg(c.ctx, msg); err != nil {
 			log.Errorf("failed to add message to decryption worker: %v", err)
 		}
+		// Refresh liveness before clearing the flag so the window between here and
+		// the next Recv does not read a stale timestamp as a dead stream.
+		c.markReceived()
 		c.receiveHandoffBlocked.Store(false)
 	}
 }
diff --git a/shared/signal/client/watchdog_test.go b/shared/signal/client/watchdog_test.go
index eeb9aec30..a8bbafa29 100644
--- a/shared/signal/client/watchdog_test.go
+++ b/shared/signal/client/watchdog_test.go
@@ -2,6 +2,7 @@ package client
 
 import (
 	"context"
+	"io"
 	"net"
 	"testing"
 	"time"
@@ -106,3 +107,72 @@ func TestReceiveAliveTreatsHandoffBlockAsLiveness(t *testing.T) {
 	c.markReceived()
 	require.True(t, c.receiveAlive(), "a freshly received frame must keep the stream alive")
 }
+
+// fakeRecvStream feeds the receive loop frames from a channel and reports EOF
+// once the channel is closed. Only Recv is exercised by the loop.
+type fakeRecvStream struct {
+	sigProto.SignalExchange_ConnectStreamClient
+	frames chan *sigProto.EncryptedMessage
+}
+
+func (s *fakeRecvStream) Recv() (*sigProto.EncryptedMessage, error) {
+	msg, ok := <-s.frames
+	if !ok {
+		return nil, io.EOF
+	}
+	return msg, nil
+}
+
+// TestReceiveLoopRefreshesLivenessAfterBlockedHandoff drives the real receive
+// loop into a handoff that blocks past the inactivity threshold, then checks the
+// window after the handoff drains but before the next Recv. The loop must have
+// refreshed the timestamp on unblocking, otherwise that window reads the stale
+// pre-handoff timestamp as a dead stream and the watchdog tears down a healthy
+// connection.
+func TestReceiveLoopRefreshesLivenessAfterBlockedHandoff(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	c := &GrpcClient{ctx: ctx}
+
+	handling := make(chan struct{}, 8)
+	gate := make(chan struct{})
+	decrypt := func(*sigProto.EncryptedMessage) (*sigProto.Message, error) { return &sigProto.Message{}, nil }
+	handler := func(*sigProto.Message) error {
+		handling <- struct{}{}
+		<-gate
+		return nil
+	}
+	c.decryptionWorker = NewWorker(decrypt, handler)
+	workerCtx, workerCancel := context.WithCancel(context.Background())
+	go c.decryptionWorker.Work(workerCtx)
+	t.Cleanup(workerCancel)
+
+	frames := make(chan *sigProto.EncryptedMessage)
+	t.Cleanup(func() { close(frames) })
+	go func() { _ = c.receive(&fakeRecvStream{frames: frames}) }()
+
+	// First frame: the worker drains it and parks in the blocking handler.
+	frames <- &sigProto.EncryptedMessage{}
+	<-handling
+	// Second frame fills the worker's single-slot pool.
+	frames <- &sigProto.EncryptedMessage{}
+	// Third frame: the pool is full, so the loop parks on the handoff.
+	frames <- &sigProto.EncryptedMessage{}
+
+	require.Eventually(t, c.receiveHandoffBlocked.Load, time.Second, time.Millisecond,
+		"receive loop should park on the worker handoff")
+
+	// Simulate the handoff having blocked past the inactivity threshold.
+	c.lastReceived.Store(time.Now().Add(-2 * receiveInactivityThreshold).UnixNano())
+	require.True(t, c.receiveAlive(), "a loop parked on the handoff must stay alive")
+
+	// Drain the worker so the handoff returns and the loop resumes reading.
+	close(gate)
+
+	// Once the handoff clears, the loop is parked on the next Recv with no frame
+	// pending. The stream must still read as alive in that window.
+	require.Eventually(t, func() bool { return !c.receiveHandoffBlocked.Load() }, time.Second, time.Millisecond,
+		"handoff should drain once the worker is released")
+	require.True(t, c.receiveAlive(),
+		"the loop must refresh liveness when the handoff drains, before the next Recv")
+}

From 3f1fb3b52d010d07247c46bf2a9fbf483563b0a9 Mon Sep 17 00:00:00 2001
From: Zoltan Papp <zoltan.pmail@gmail.com>
Date: Mon, 29 Jun 2026 19:51:25 +0200
Subject: [PATCH 07/36] [ingest] raise duration validation limit to 24 hours
 (#6598)

Peer connection timing fields (signaling_to_connection_seconds) can
legitimately exceed 5 minutes during long reconnections; the previous
300 s cap caused valid data points to be rejected.
---
 client/internal/metrics/infra/ingest/main.go      | 2 +-
 client/internal/metrics/infra/ingest/main_test.go | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/client/internal/metrics/infra/ingest/main.go b/client/internal/metrics/infra/ingest/main.go
index 623a17e4d..91405b85f 100644
--- a/client/internal/metrics/infra/ingest/main.go
+++ b/client/internal/metrics/infra/ingest/main.go
@@ -19,7 +19,7 @@ const (
 	defaultListenAddr  = ":8087"
 	defaultInfluxDBURL = "http://influxdb:8086/api/v2/write?org=netbird&bucket=metrics&precision=ns"
 	maxBodySize        = 50 * 1024 * 1024 // 50 MB max request body
-	maxDurationSeconds = 300.0            // reject any duration field > 5 minutes
+	maxDurationSeconds = 86400.0          // reject any duration field > 24 hours
 	peerIDLength       = 16               // truncated SHA-256: 8 bytes = 16 hex chars
 	maxTagValueLength  = 64               // reject tag values longer than this
 )
diff --git a/client/internal/metrics/infra/ingest/main_test.go b/client/internal/metrics/infra/ingest/main_test.go
index bacaa4588..96287813e 100644
--- a/client/internal/metrics/infra/ingest/main_test.go
+++ b/client/internal/metrics/infra/ingest/main_test.go
@@ -53,14 +53,14 @@ func TestValidateLine_NegativeValue(t *testing.T) {
 }
 
 func TestValidateLine_DurationTooLarge(t *testing.T) {
-	line := `netbird_sync,deployment_type=cloud,version=1.0.0,os=linux,arch=amd64,peer_id=abc duration_seconds=999 1234567890`
+	line := `netbird_sync,deployment_type=cloud,version=1.0.0,os=linux,arch=amd64,peer_id=abc duration_seconds=100000 1234567890`
 	err := validateLine(line)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "too large")
 }
 
 func TestValidateLine_TotalSecondsTooLarge(t *testing.T) {
-	line := `netbird_peer_connection,deployment_type=cloud,connection_type=ice,attempt_type=initial,version=1.0.0,os=linux,arch=amd64,peer_id=abc,connection_pair_id=pair total_seconds=500 1234567890`
+	line := `netbird_peer_connection,deployment_type=cloud,connection_type=ice,attempt_type=initial,version=1.0.0,os=linux,arch=amd64,peer_id=abc,connection_pair_id=pair total_seconds=100000 1234567890`
 	err := validateLine(line)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "too large")

From 04c3d19032dd1f3361168e0d1fc706b1e6cbfb42 Mon Sep 17 00:00:00 2001
From: Zoltan Papp <zoltan.pmail@gmail.com>
Date: Mon, 29 Jun 2026 19:51:50 +0200
Subject: [PATCH 08/36] [client] Skip firewall ruleset rebuild when config is
 unchanged (#6508)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* [client] Skip firewall ruleset rebuild when config is unchanged

ApplyFiltering rebuilt every peer and route ACL and flushed the firewall
on every sync, with no guard for an unchanged configuration. Management
re-sends the same network map far more often than it actually changes
(account-wide updates, peer meta churn), so on busy accounts this is the
dominant client-side cost of redundant syncs — especially with a large
route set and a userspace firewall.

Hash the inputs ApplyFiltering consumes (peer rules, route rules, the
empty flag and the dns-route feature flag) and skip the rebuild + flush
when the hash matches the last successfully applied update. Mirrors the
guard the DNS server already uses (previousConfigHash). The hash is only
recorded after apply and flush both succeed, so a failed update is not
skipped on the next (possibly identical) sync and gets a chance to
reconcile the firewall state.

* [client] Include config hash in ACL skip debug log

* [client] Include RoutesFirewallRulesIsEmpty in firewall config hash

* [client] Add benchmarks for firewall config hash computation
---
 client/internal/acl/manager.go      |  74 ++++++++++++--
 client/internal/acl/manager_test.go | 147 ++++++++++++++++++++++++++++
 2 files changed, 212 insertions(+), 9 deletions(-)

diff --git a/client/internal/acl/manager.go b/client/internal/acl/manager.go
index c54a3e897..d9b179457 100644
--- a/client/internal/acl/manager.go
+++ b/client/internal/acl/manager.go
@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"github.com/hashicorp/go-multierror"
+	"github.com/mitchellh/hashstructure/v2"
 	log "github.com/sirupsen/logrus"
 
 	nberrors "github.com/netbirdio/netbird/client/errors"
@@ -30,11 +31,13 @@ type Manager interface {
 
 // DefaultManager uses firewall manager to handle
 type DefaultManager struct {
-	firewall       firewall.Manager
-	ipsetCounter   int
-	peerRulesPairs map[id.RuleID][]firewall.Rule
-	routeRules     map[id.RuleID]struct{}
-	mutex          sync.Mutex
+	firewall           firewall.Manager
+	ipsetCounter       int
+	peerRulesPairs     map[id.RuleID][]firewall.Rule
+	routeRules         map[id.RuleID]struct{}
+	previousConfigHash uint64
+	hasAppliedConfig   bool
+	mutex              sync.Mutex
 }
 
 func NewDefaultManager(fm firewall.Manager) *DefaultManager {
@@ -57,6 +60,23 @@ func (d *DefaultManager) ApplyFiltering(networkMap *mgmProto.NetworkMap, dnsRout
 		return
 	}
 
+	// Skip the full rebuild + flush when the inputs that drive the firewall
+	// state are byte-for-byte identical to the last successfully applied
+	// update. Management re-sends the same network map far more often than it
+	// actually changes (account-wide updates, peer meta churn), and rebuilding
+	// every peer/route ACL and flushing the firewall on every such sync is the
+	// dominant client-side cost when nothing changed. Mirrors the same guard the
+	// DNS server already uses (previousConfigHash). Only the fields ApplyFiltering
+	// consumes participate in the hash, so an unrelated map change cannot mask a
+	// real ACL change.
+	hash, err := d.firewallConfigHash(networkMap, dnsRouteFeatureFlag)
+	if err != nil {
+		log.Errorf("unable to hash firewall configuration, applying unconditionally: %v", err)
+	} else if d.hasAppliedConfig && d.previousConfigHash == hash {
+		log.Debugf("not applying the firewall configuration update as there is nothing new (hash: %d)", hash)
+		return
+	}
+
 	start := time.Now()
 	defer func() {
 		total := 0
@@ -70,13 +90,49 @@ func (d *DefaultManager) ApplyFiltering(networkMap *mgmProto.NetworkMap, dnsRout
 
 	d.applyPeerACLs(networkMap)
 
-	if err := d.applyRouteACLs(networkMap.RoutesFirewallRules, dnsRouteFeatureFlag); err != nil {
-		log.Errorf("Failed to apply route ACLs: %v", err)
+	routeErr := d.applyRouteACLs(networkMap.RoutesFirewallRules, dnsRouteFeatureFlag)
+	if routeErr != nil {
+		log.Errorf("Failed to apply route ACLs: %v", routeErr)
 	}
 
-	if err := d.firewall.Flush(); err != nil {
-		log.Error("failed to flush firewall rules: ", err)
+	flushErr := d.firewall.Flush()
+	if flushErr != nil {
+		log.Error("failed to flush firewall rules: ", flushErr)
 	}
+
+	// Only remember the hash once the firewall actually reflects this config.
+	// If applying or flushing failed, leave the previous hash untouched so the
+	// next (possibly identical) update is not skipped and gets a chance to
+	// reconcile the firewall state.
+	if err == nil && routeErr == nil && flushErr == nil {
+		d.previousConfigHash = hash
+		d.hasAppliedConfig = true
+	} else {
+		d.hasAppliedConfig = false
+	}
+}
+
+// firewallConfigHash hashes exactly the inputs ApplyFiltering uses to build the
+// firewall state, so an identical hash means an identical resulting ruleset.
+func (d *DefaultManager) firewallConfigHash(networkMap *mgmProto.NetworkMap, dnsRouteFeatureFlag bool) (uint64, error) {
+	return hashstructure.Hash(struct {
+		PeerRules            []*mgmProto.FirewallRule
+		PeerRulesIsEmpty     bool
+		RouteRules           []*mgmProto.RouteFirewallRule
+		RouteRulesIsEmpty    bool
+		DNSRouteFeatureFlag  bool
+	}{
+		PeerRules:           networkMap.GetFirewallRules(),
+		PeerRulesIsEmpty:    networkMap.GetFirewallRulesIsEmpty(),
+		RouteRules:          networkMap.GetRoutesFirewallRules(),
+		RouteRulesIsEmpty:   networkMap.GetRoutesFirewallRulesIsEmpty(),
+		DNSRouteFeatureFlag: dnsRouteFeatureFlag,
+	}, hashstructure.FormatV2, &hashstructure.HashOptions{
+		ZeroNil:         true,
+		IgnoreZeroValue: true,
+		SlicesAsSets:    true,
+		UseStringer:     true,
+	})
 }
 
 func (d *DefaultManager) applyPeerACLs(networkMap *mgmProto.NetworkMap) {
diff --git a/client/internal/acl/manager_test.go b/client/internal/acl/manager_test.go
index 408ed992f..968654ae9 100644
--- a/client/internal/acl/manager_test.go
+++ b/client/internal/acl/manager_test.go
@@ -1,6 +1,7 @@
 package acl
 
 import (
+	"fmt"
 	"net/netip"
 	"testing"
 
@@ -485,3 +486,149 @@ func TestPortInfoEmpty(t *testing.T) {
 		})
 	}
 }
+
+// TestApplyFilteringSkipsUnchangedConfig verifies that an identical network map
+// re-applied is recognized as a no-op (hash unchanged), while a real change to
+// any firewall-relevant input forces a re-apply (hash changes). This is the
+// guard that prevents a full ruleset rebuild + flush on every redundant sync.
+func TestApplyFilteringSkipsUnchangedConfig(t *testing.T) {
+	t.Setenv("NB_WG_KERNEL_DISABLED", "true")
+	t.Setenv(firewall.EnvForceUserspaceFirewall, "true")
+
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	ifaceMock := mocks.NewMockIFaceMapper(ctrl)
+	ifaceMock.EXPECT().IsUserspaceBind().Return(true).AnyTimes()
+	ifaceMock.EXPECT().SetFilter(gomock.Any())
+	network := netip.MustParsePrefix("172.0.0.1/32")
+	ifaceMock.EXPECT().Name().Return("lo").AnyTimes()
+	ifaceMock.EXPECT().Address().Return(wgaddr.Address{
+		IP:      network.Addr(),
+		Network: network,
+	}).AnyTimes()
+	ifaceMock.EXPECT().GetWGDevice().Return(nil).AnyTimes()
+
+	fw, err := firewall.NewFirewall(ifaceMock, nil, flowLogger, false, iface.DefaultMTU)
+	require.NoError(t, err)
+	defer func() {
+		require.NoError(t, fw.Close(nil))
+	}()
+
+	acl := NewDefaultManager(fw)
+
+	networkMap := &mgmProto.NetworkMap{
+		FirewallRules: []*mgmProto.FirewallRule{
+			{
+				PeerIP:    "10.93.0.1",
+				Direction: mgmProto.RuleDirection_IN,
+				Action:    mgmProto.RuleAction_ACCEPT,
+				Protocol:  mgmProto.RuleProtocol_TCP,
+				Port:      "22",
+			},
+		},
+		FirewallRulesIsEmpty: false,
+	}
+
+	acl.ApplyFiltering(networkMap, false)
+	require.True(t, acl.hasAppliedConfig, "config should be marked applied after first apply")
+	firstHash := acl.previousConfigHash
+	require.NotZero(t, firstHash)
+
+	// Re-applying the identical map must not change the recorded hash: the
+	// expensive rebuild path was skipped.
+	acl.ApplyFiltering(networkMap, false)
+	assert.Equal(t, firstHash, acl.previousConfigHash,
+		"identical re-apply must be a no-op (hash unchanged)")
+
+	// A real change must produce a different hash and re-apply.
+	networkMap.FirewallRules[0].Action = mgmProto.RuleAction_DROP
+	acl.ApplyFiltering(networkMap, false)
+	assert.NotEqual(t, firstHash, acl.previousConfigHash,
+		"changing a rule's action must force a re-apply (hash changed)")
+
+	// The dnsRouteFeatureFlag also participates in the hash.
+	changedHash := acl.previousConfigHash
+	acl.ApplyFiltering(networkMap, true)
+	assert.NotEqual(t, changedHash, acl.previousConfigHash,
+		"flipping dnsRouteFeatureFlag must force a re-apply (hash changed)")
+}
+
+func buildNetworkMap(peerRules, routeRules int) *mgmProto.NetworkMap {
+	nm := &mgmProto.NetworkMap{
+		FirewallRulesIsEmpty:      peerRules == 0,
+		RoutesFirewallRulesIsEmpty: routeRules == 0,
+	}
+	for i := range peerRules {
+		nm.FirewallRules = append(nm.FirewallRules, &mgmProto.FirewallRule{
+			PeerIP:    fmt.Sprintf("10.%d.%d.%d", i>>16&0xff, i>>8&0xff, i&0xff),
+			Direction: mgmProto.RuleDirection_IN,
+			Action:    mgmProto.RuleAction_ACCEPT,
+			Protocol:  mgmProto.RuleProtocol_TCP,
+			Port:      fmt.Sprintf("%d", 1024+i%64511),
+		})
+	}
+	for i := range routeRules {
+		nm.RoutesFirewallRules = append(nm.RoutesFirewallRules, &mgmProto.RouteFirewallRule{
+			Destination:  fmt.Sprintf("192.168.%d.0/24", i%256),
+			SourceRanges: []string{fmt.Sprintf("10.0.%d.0/24", i%256)},
+			Action:       mgmProto.RuleAction_ACCEPT,
+			Protocol:     mgmProto.RuleProtocol_ALL,
+		})
+	}
+	return nm
+}
+
+func BenchmarkFirewallConfigHash_Small(b *testing.B) {
+	d := &DefaultManager{}
+	nm := buildNetworkMap(10, 5)
+	b.ResetTimer()
+	for b.Loop() {
+		_, _ = d.firewallConfigHash(nm, false)
+	}
+}
+
+func BenchmarkFirewallConfigHash_Medium(b *testing.B) {
+	d := &DefaultManager{}
+	nm := buildNetworkMap(100, 50)
+	b.ResetTimer()
+	for b.Loop() {
+		_, _ = d.firewallConfigHash(nm, false)
+	}
+}
+
+func BenchmarkFirewallConfigHash_Large(b *testing.B) {
+	d := &DefaultManager{}
+	nm := buildNetworkMap(1000, 200)
+	b.ResetTimer()
+	for b.Loop() {
+		_, _ = d.firewallConfigHash(nm, false)
+	}
+}
+
+// TestFirewallConfigHashDeterministic verifies the hash is stable for equal
+// inputs and order-independent for the rule slices (management does not
+// guarantee rule order).
+func TestFirewallConfigHashDeterministic(t *testing.T) {
+	d := &DefaultManager{}
+
+	nm1 := &mgmProto.NetworkMap{
+		FirewallRules: []*mgmProto.FirewallRule{
+			{PeerIP: "10.0.0.1", Direction: mgmProto.RuleDirection_IN, Action: mgmProto.RuleAction_ACCEPT, Protocol: mgmProto.RuleProtocol_TCP, Port: "22"},
+			{PeerIP: "10.0.0.2", Direction: mgmProto.RuleDirection_IN, Action: mgmProto.RuleAction_DROP, Protocol: mgmProto.RuleProtocol_TCP, Port: "80"},
+		},
+	}
+	// Same rules, reversed order.
+	nm2 := &mgmProto.NetworkMap{
+		FirewallRules: []*mgmProto.FirewallRule{
+			nm1.FirewallRules[1],
+			nm1.FirewallRules[0],
+		},
+	}
+
+	h1, err := d.firewallConfigHash(nm1, false)
+	require.NoError(t, err)
+	h2, err := d.firewallConfigHash(nm2, false)
+	require.NoError(t, err)
+	assert.Equal(t, h1, h2, "hash must be order-independent for rule slices")
+}

From 3de889d529a366441788886cfc46970096fd28fd Mon Sep 17 00:00:00 2001
From: Riccardo Manfrin <3090891+riccardomanfrin@users.noreply.github.com>
Date: Tue, 30 Jun 2026 08:18:51 +0200
Subject: [PATCH 09/36] [client] bound system info / posture-check gathering
 with a timeout to prevent sync-loop freeze (#6512)

* Wraps syestem info / posture checks into a goroutine with timeout

e.checks = checks is set before doing the SyncMeta,
so if it fails next time isCheckEquals compares true and bypasses
the update. This is to avoid another repeating the 15 seconds hang.
The checks will be synced on reconnect or posture checks changes
push from mgmt.

* Propagate context to OS calls that can leverage its cancellation / timeout

* Distinguish timeout from cancellation in logs

* Dont log twice

* Block on timeout failure and reapply the exclude_ips

* Refactor for complexity
---
 client/internal/engine.go     | 59 ++++++++++++++++-------------------
 client/system/info.go         | 44 +++++++++++++++++++++++++-
 client/system/info_android.go |  2 +-
 client/system/info_darwin.go  |  2 +-
 client/system/info_ios.go     |  2 +-
 client/system/info_js.go      |  2 +-
 client/system/info_test.go    | 15 +++++++++
 client/system/process.go      | 21 +++++++++----
 client/system/process_test.go | 31 ++++++++++++++++--
 9 files changed, 133 insertions(+), 45 deletions(-)

diff --git a/client/internal/engine.go b/client/internal/engine.go
index f7c7e1862..de151592d 100644
--- a/client/internal/engine.go
+++ b/client/internal/engine.go
@@ -82,6 +82,12 @@ const (
 	PeerConnectionTimeoutMax = 45000 // ms
 	PeerConnectionTimeoutMin = 30000 // ms
 	disableAutoUpdate        = "disabled"
+
+	// systemInfoTimeout bounds how long the sync loop waits for system info / posture
+	// check gathering. The gathering runs uncancellable system calls (process scan,
+	// exec, os.Stat); without this bound a single stuck call freezes handleSync, and
+	// thus syncMsgMux, for as long as the call hangs (observed multi-minute freezes).
+	systemInfoTimeout = 15 * time.Second
 )
 
 var ErrResetConnection = fmt.Errorf("reset connection")
@@ -1084,11 +1090,22 @@ func (e *Engine) updateChecksIfNew(checks []*mgmProto.Checks) error {
 	}
 	e.checks = checks
 
-	info, err := system.GetInfoWithChecks(e.ctx, checks, e.overlayAddresses()...)
-	if err != nil {
-		log.Warnf("failed to get system info with checks: %v", err)
-		info = system.GetInfo(e.ctx)
+	info, ok := system.GetInfoWithChecksTimeout(e.ctx, systemInfoTimeout, checks, e.overlayAddresses()...)
+	if !ok {
+		// Gathering timed out; skip the meta sync this cycle rather than blocking the
+		// sync loop (and syncMsgMux) on a stuck system call. A later sync will retry.
+		return nil
 	}
+	e.applyInfoFlags(info)
+
+	if err := e.mgmClient.SyncMeta(info); err != nil {
+		return fmt.Errorf("could not sync meta: error %s", err)
+	}
+	return nil
+}
+
+// applyInfoFlags sets the engine's config-derived feature flags on the gathered system info.
+func (e *Engine) applyInfoFlags(info *system.Info) {
 	info.SetFlags(
 		e.config.RosenpassEnabled,
 		e.config.RosenpassPermissive,
@@ -1107,12 +1124,6 @@ func (e *Engine) updateChecksIfNew(checks []*mgmProto.Checks) error {
 		e.config.EnableSSHRemotePortForwarding,
 		e.config.DisableSSHAuth,
 	)
-
-	if err := e.mgmClient.SyncMeta(info); err != nil {
-		log.Errorf("could not sync meta: error %s", err)
-		return err
-	}
-	return nil
 }
 
 // overlayAddresses returns our own WireGuard overlay address (v4 and v6) so it
@@ -1272,31 +1283,15 @@ func (e *Engine) receiveManagementEvents() {
 	e.shutdownWg.Add(1)
 	go func() {
 		defer e.shutdownWg.Done()
-		info, err := system.GetInfoWithChecks(e.ctx, e.checks, e.overlayAddresses()...)
-		if err != nil {
-			log.Warnf("failed to get system info with checks: %v", err)
+		info, ok := system.GetInfoWithChecksTimeout(e.ctx, systemInfoTimeout, e.checks, e.overlayAddresses()...)
+		if !ok {
+			// Gathering timed out; connect the stream with base info so management
+			// connectivity still comes up rather than blocking here.
 			info = system.GetInfo(e.ctx)
 		}
-		info.SetFlags(
-			e.config.RosenpassEnabled,
-			e.config.RosenpassPermissive,
-			&e.config.ServerSSHAllowed,
-			e.config.DisableClientRoutes,
-			e.config.DisableServerRoutes,
-			e.config.DisableDNS,
-			e.config.DisableFirewall,
-			e.config.BlockLANAccess,
-			e.config.BlockInbound,
-			e.config.DisableIPv6,
-			e.config.LazyConnectionEnabled,
-			e.config.EnableSSHRoot,
-			e.config.EnableSSHSFTP,
-			e.config.EnableSSHLocalPortForwarding,
-			e.config.EnableSSHRemotePortForwarding,
-			e.config.DisableSSHAuth,
-		)
+		e.applyInfoFlags(info)
 
-		err = e.mgmClient.Sync(e.ctx, info, e.handleSync)
+		err := e.mgmClient.Sync(e.ctx, info, e.handleSync)
 		if err != nil {
 			// happens if management is unavailable for a long time.
 			// We want to cancel the operation of the whole client
diff --git a/client/system/info.go b/client/system/info.go
index 27588859e..496b478a3 100644
--- a/client/system/info.go
+++ b/client/system/info.go
@@ -2,9 +2,11 @@ package system
 
 import (
 	"context"
+	"errors"
 	"net/netip"
 	"slices"
 	"strings"
+	"time"
 
 	log "github.com/sirupsen/logrus"
 	"google.golang.org/grpc/metadata"
@@ -174,7 +176,7 @@ func GetInfoWithChecks(ctx context.Context, checks []*proto.Checks, excludeIPs .
 		processCheckPaths = append(processCheckPaths, check.GetFiles()...)
 	}
 
-	files, err := checkFileAndProcess(processCheckPaths)
+	files, err := checkFileAndProcess(ctx, processCheckPaths)
 	if err != nil {
 		return nil, err
 	}
@@ -187,3 +189,43 @@ func GetInfoWithChecks(ctx context.Context, checks []*proto.Checks, excludeIPs .
 	log.Debugf("all system information gathered successfully")
 	return info, nil
 }
+
+// GetInfoWithChecksTimeout is GetInfoWithChecks bounded by timeout. Posture-check gathering
+// runs uncancellable system calls (process enumeration, os.Stat), so calling it inline can
+// block the caller for as long as such a call hangs. It runs in a goroutine instead: if it
+// does not return within timeout the caller gets (nil, false) and should proceed with
+// degraded behavior rather than block. On a gathering error it falls back to base GetInfo.
+//
+// The buffered channel lets the abandoned goroutine finish and exit once its blocking call
+// returns, so it does not leak beyond the duration of that call.
+func GetInfoWithChecksTimeout(ctx context.Context, timeout time.Duration, checks []*proto.Checks, excludeIPs ...netip.Addr) (*Info, bool) {
+	ctx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+
+	infoCh := make(chan *Info, 1)
+	go func() {
+		info, err := GetInfoWithChecks(ctx, checks, excludeIPs...)
+		if err != nil {
+			if ctx.Err() != nil {
+				return
+			}
+			log.Warnf("failed to get system info with checks: %v", err)
+			info = GetInfo(ctx)
+			info.removeAddresses(excludeIPs...)
+		}
+		infoCh <- info
+	}()
+
+	select {
+	case info := <-infoCh:
+		return info, true
+	case <-ctx.Done():
+		if errors.Is(ctx.Err(), context.DeadlineExceeded) {
+			log.Warnf("gathering system info with checks timed out after %s", timeout)
+		} else {
+			// Parent context canceled (e.g. shutdown), not a timeout.
+			log.Warnf("gathering system info with checks canceled: %v", ctx.Err())
+		}
+		return nil, false
+	}
+}
diff --git a/client/system/info_android.go b/client/system/info_android.go
index 794ff15ed..3c71573bb 100644
--- a/client/system/info_android.go
+++ b/client/system/info_android.go
@@ -50,7 +50,7 @@ func GetInfo(ctx context.Context) *Info {
 }
 
 // checkFileAndProcess checks if the file path exists and if a process is running at that path.
-func checkFileAndProcess(paths []string) ([]File, error) {
+func checkFileAndProcess(_ context.Context, _ []string) ([]File, error) {
 	return []File{}, nil
 }
 
diff --git a/client/system/info_darwin.go b/client/system/info_darwin.go
index 4a31920ec..e7bf367f6 100644
--- a/client/system/info_darwin.go
+++ b/client/system/info_darwin.go
@@ -32,7 +32,7 @@ func GetInfo(ctx context.Context) *Info {
 	sysName := string(bytes.Split(utsname.Sysname[:], []byte{0})[0])
 	machine := string(bytes.Split(utsname.Machine[:], []byte{0})[0])
 	release := string(bytes.Split(utsname.Release[:], []byte{0})[0])
-	swVersion, err := exec.Command("sw_vers", "-productVersion").Output()
+	swVersion, err := exec.CommandContext(ctx, "sw_vers", "-productVersion").Output()
 	if err != nil {
 		log.Warnf("got an error while retrieving macOS version with sw_vers, error: %s. Using darwin version instead.\n", err)
 		swVersion = []byte(release)
diff --git a/client/system/info_ios.go b/client/system/info_ios.go
index ad42b1edf..1b0c084b3 100644
--- a/client/system/info_ios.go
+++ b/client/system/info_ios.go
@@ -105,7 +105,7 @@ func isDuplicated(addresses []NetworkAddress, addr NetworkAddress) bool {
 }
 
 // checkFileAndProcess checks if the file path exists and if a process is running at that path.
-func checkFileAndProcess(paths []string) ([]File, error) {
+func checkFileAndProcess(_ context.Context, _ []string) ([]File, error) {
 	return []File{}, nil
 }
 
diff --git a/client/system/info_js.go b/client/system/info_js.go
index 994d439a7..f32532881 100644
--- a/client/system/info_js.go
+++ b/client/system/info_js.go
@@ -103,7 +103,7 @@ func collectLocationInfo(info *Info) {
 	}
 }
 
-func checkFileAndProcess(_ []string) ([]File, error) {
+func checkFileAndProcess(_ context.Context, _ []string) ([]File, error) {
 	return []File{}, nil
 }
 
diff --git a/client/system/info_test.go b/client/system/info_test.go
index dcda18e61..a7fa02197 100644
--- a/client/system/info_test.go
+++ b/client/system/info_test.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"net/netip"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"google.golang.org/grpc/metadata"
@@ -35,6 +36,20 @@ func Test_CustomHostname(t *testing.T) {
 	assert.Equal(t, want, got.Hostname)
 }
 
+func TestGetInfoWithChecksTimeout_Success(t *testing.T) {
+	info, ok := GetInfoWithChecksTimeout(context.Background(), 30*time.Second, nil)
+	assert.True(t, ok, "expected gathering to complete within the timeout")
+	assert.NotNil(t, info)
+}
+
+func TestGetInfoWithChecksTimeout_Timeout(t *testing.T) {
+	// A 1ns budget expires before the (real) system-info gathering can finish, so the
+	// caller must get (nil, false) instead of blocking on the in-flight goroutine.
+	info, ok := GetInfoWithChecksTimeout(context.Background(), time.Nanosecond, nil)
+	assert.False(t, ok, "expected timeout to be reported")
+	assert.Nil(t, info)
+}
+
 func Test_NetAddresses(t *testing.T) {
 	addr, err := networkAddresses()
 	if err != nil {
diff --git a/client/system/process.go b/client/system/process.go
index 87e21eb9d..07f69a212 100644
--- a/client/system/process.go
+++ b/client/system/process.go
@@ -3,24 +3,30 @@
 package system
 
 import (
+	"context"
 	"os"
 	"slices"
 
 	"github.com/shirou/gopsutil/v3/process"
 )
 
-// getRunningProcesses returns a list of running process paths.
-func getRunningProcesses() ([]string, error) {
-	processIDs, err := process.Pids()
+// getRunningProcesses returns a list of running process paths. The context bounds the work:
+// the per-PID loop bails as soon as ctx is done, and the gopsutil calls honor it where they
+// can, so a stuck enumeration cannot run unbounded.
+func getRunningProcesses(ctx context.Context) ([]string, error) {
+	processIDs, err := process.PidsWithContext(ctx)
 	if err != nil {
 		return nil, err
 	}
 
 	processMap := make(map[string]bool)
 	for _, pID := range processIDs {
+		if err := ctx.Err(); err != nil {
+			return nil, err
+		}
 		p := &process.Process{Pid: pID}
 
-		path, _ := p.Exe()
+		path, _ := p.ExeWithContext(ctx)
 		if path != "" {
 			processMap[path] = false
 		}
@@ -35,18 +41,21 @@ func getRunningProcesses() ([]string, error) {
 }
 
 // checkFileAndProcess checks if the file path exists and if a process is running at that path.
-func checkFileAndProcess(paths []string) ([]File, error) {
+func checkFileAndProcess(ctx context.Context, paths []string) ([]File, error) {
 	files := make([]File, len(paths))
 	if len(paths) == 0 {
 		return files, nil
 	}
 
-	runningProcesses, err := getRunningProcesses()
+	runningProcesses, err := getRunningProcesses(ctx)
 	if err != nil {
 		return nil, err
 	}
 
 	for i, path := range paths {
+		if err := ctx.Err(); err != nil {
+			return nil, err
+		}
 		file := File{Path: path}
 
 		_, err := os.Stat(path)
diff --git a/client/system/process_test.go b/client/system/process_test.go
index 505808a9e..44a1c8ba0 100644
--- a/client/system/process_test.go
+++ b/client/system/process_test.go
@@ -1,6 +1,7 @@
 package system
 
 import (
+	"context"
 	"testing"
 
 	"github.com/shirou/gopsutil/v3/process"
@@ -9,7 +10,7 @@ import (
 func Benchmark_getRunningProcesses(b *testing.B) {
 	b.Run("getRunningProcesses new", func(b *testing.B) {
 		for i := 0; i < b.N; i++ {
-			ps, err := getRunningProcesses()
+			ps, err := getRunningProcesses(context.Background())
 			if err != nil {
 				b.Fatalf("unexpected error: %v", err)
 			}
@@ -29,12 +30,38 @@ func Benchmark_getRunningProcesses(b *testing.B) {
 			}
 		}
 	})
-	s, _ := getRunningProcesses()
+	s, _ := getRunningProcesses(context.Background())
 	b.Logf("getRunningProcesses returned %d processes", len(s))
 	s, _ = getRunningProcessesOld()
 	b.Logf("getRunningProcessesOld returned %d processes", len(s))
 }
 
+func TestCheckFileAndProcess_ContextCanceled(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	// With a canceled context and non-empty paths the gathering must bail with an error
+	// instead of running the (potentially blocking) process scan / stat loop.
+	if _, err := checkFileAndProcess(ctx, []string{"/does/not/exist"}); err == nil {
+		t.Fatal("expected error on canceled context, got nil")
+	}
+}
+
+func TestCheckFileAndProcess_EmptyPaths(t *testing.T) {
+	// No check paths means no work to do: it must return immediately with no error,
+	// even on a canceled context (nothing to scan or stat).
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	files, err := checkFileAndProcess(ctx, nil)
+	if err != nil {
+		t.Fatalf("unexpected error for empty paths: %v", err)
+	}
+	if len(files) != 0 {
+		t.Fatalf("expected no files, got %d", len(files))
+	}
+}
+
 func getRunningProcessesOld() ([]string, error) {
 	processes, err := process.Processes()
 	if err != nil {

From 5b5f11740acdc82d8c7b80b314194bbb7420988a Mon Sep 17 00:00:00 2001
From: Bethuel Mmbaga <bethuelmbaga12@gmail.com>
Date: Tue, 30 Jun 2026 11:34:23 +0300
Subject: [PATCH 10/36] [misc] Require on-premise EULA acceptance in enterprise
 scripts (#6596)

---
 .../getting-started-enterprise.sh             | 47 +++++++++++++++++++
 infrastructure_files/migrate-to-enterprise.sh | 46 ++++++++++++++++++
 2 files changed, 93 insertions(+)

diff --git a/infrastructure_files/getting-started-enterprise.sh b/infrastructure_files/getting-started-enterprise.sh
index 5d2341cbe..135440180 100755
--- a/infrastructure_files/getting-started-enterprise.sh
+++ b/infrastructure_files/getting-started-enterprise.sh
@@ -9,6 +9,8 @@ set -o pipefail
 
 SED_STRIP_PADDING='s/=//g'
 
+NETBIRD_EULA_URL="https://netbird.io/self-hosted-EULA"
+
 check_docker_compose() {
   if command -v docker-compose &> /dev/null; then
     echo "docker-compose"
@@ -139,6 +141,43 @@ read_yes_no() {
   esac
 }
 
+# Gate the install on explicit acceptance of the NetBird On-Premise EULA.
+require_eula_acceptance() {
+  cat > /dev/stderr <<EOF
+
+  ──────────────────────────────────────────────────────────────────────
+   NetBird On-Premise End User License Agreement
+  ──────────────────────────────────────────────────────────────────────
+  NetBird's on-premise software is commercial software, licensed and not
+  sold. Your installation, deployment and use are governed by the NetBird
+  On-Premise End User License Agreement (the "EULA"). Please read the EULA
+  in full before continuing:
+
+      ${NETBIRD_EULA_URL}
+
+  By typing "accept" and continuing the installation, you confirm that you
+  have read and agree to the EULA, that you are authorized to accept it on
+  behalf of your organization (the "Customer"), and that the Software is
+  used for business purposes only.
+  ──────────────────────────────────────────────────────────────────────
+EOF
+
+  if [[ "${NB_ACCEPT_EULA:-}" == "yes" ]]; then
+    echo "EULA accepted via NB_ACCEPT_EULA=yes." > /dev/stderr
+    return 0
+  fi
+
+  local ans=""
+  echo -n 'Type "accept" to agree, or anything else to abort: ' > /dev/stderr
+  read -r ans < /dev/tty
+  if [[ "$ans" != "accept" ]]; then
+    echo "" > /dev/stderr
+    echo "EULA not accepted. Aborting installation." > /dev/stderr
+    exit 1
+  fi
+  echo "" > /dev/stderr
+}
+
 wait_postgres() {
   set +e
   echo -n "Waiting for postgres to become ready"
@@ -174,6 +213,9 @@ init_environment() {
     exit 1
   fi
 
+  require_eula_acceptance
+  NETBIRD_EULA_ACCEPTED_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
   echo "NetBird Enterprise bootstrap"
   echo ""
   echo "Traffic flow:"
@@ -260,6 +302,11 @@ render_env() {
 # Generated by getting-started-enterprise.sh
 # Holds all configuration and secrets for the stack. Mode 600.
 
+# NetBird On-Premise EULA acceptance
+NETBIRD_EULA_ACCEPTED=yes
+NETBIRD_EULA_ACCEPTED_AT=${NETBIRD_EULA_ACCEPTED_AT}
+NETBIRD_EULA_URL=${NETBIRD_EULA_URL}
+
 # Features (set by the script; don't edit without re-running)
 NETBIRD_TRAFFIC_FLOW_ENABLED=${NETBIRD_TRAFFIC_FLOW}
 
diff --git a/infrastructure_files/migrate-to-enterprise.sh b/infrastructure_files/migrate-to-enterprise.sh
index e8a3ad515..8e8a41114 100755
--- a/infrastructure_files/migrate-to-enterprise.sh
+++ b/infrastructure_files/migrate-to-enterprise.sh
@@ -25,6 +25,8 @@ set -o pipefail
 OVERRIDE_FILE="docker-compose.override.yml"
 ENTERPRISE_CONFIG_FILE="config.yaml.enterprise"
 
+NETBIRD_EULA_URL="https://netbird.io/self-hosted-EULA"
+
 check_docker_compose() {
   if command -v docker-compose &> /dev/null; then
     echo "docker-compose"
@@ -115,6 +117,43 @@ read_yes_no() {
   esac
 }
 
+# Gate the migration on explicit acceptance of the NetBird On-Premise EULA.
+require_eula_acceptance() {
+  cat > /dev/stderr <<EOF
+
+  ──────────────────────────────────────────────────────────────────────
+   NetBird On-Premise End User License Agreement
+  ──────────────────────────────────────────────────────────────────────
+  NetBird's on-premise software is commercial software, licensed and not
+  sold. Your installation, deployment and use are governed by the NetBird
+  On-Premise End User License Agreement (the "EULA"). Please read the EULA
+  in full before continuing:
+
+      ${NETBIRD_EULA_URL}
+
+  By typing "accept" and continuing the installation, you confirm that you
+  have read and agree to the EULA, that you are authorized to accept it on
+  behalf of your organization (the "Customer"), and that the Software is
+  used for business purposes only.
+  ──────────────────────────────────────────────────────────────────────
+EOF
+
+  if [[ "${NB_ACCEPT_EULA:-}" == "yes" ]]; then
+    echo "EULA accepted via NB_ACCEPT_EULA=yes." > /dev/stderr
+    return 0
+  fi
+
+  local ans=""
+  echo -n 'Type "accept" to agree, or anything else to abort: ' > /dev/stderr
+  read -r ans < /dev/tty
+  if [[ "$ans" != "accept" ]]; then
+    echo "" > /dev/stderr
+    echo "EULA not accepted. Aborting migration." > /dev/stderr
+    exit 1
+  fi
+  echo "" > /dev/stderr
+}
+
 # ---------------------------------------------------------------------------
 # Detection — read the operator's existing compose to find service names and
 # paths we need to override. Bail loudly if shape isn't recognised.
@@ -436,6 +475,9 @@ init_migration() {
   echo "  Network:          $COMPOSE_NETWORK"
   echo ""
 
+  require_eula_acceptance
+  NETBIRD_EULA_ACCEPTED_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
   local proceed
   proceed=$(read_yes_no "Proceed with migration?" "y")
   if [[ "$proceed" != "yes" ]]; then
@@ -529,6 +571,10 @@ apply_changes() {
   {
     echo ""
     echo "# Added by migrate-to-enterprise.sh on $(date -u +%Y-%m-%dT%H:%M:%SZ)"
+    echo "# NetBird On-Premise EULA accepted at install time"
+    echo "NETBIRD_EULA_ACCEPTED=yes"
+    echo "NETBIRD_EULA_ACCEPTED_AT=${NETBIRD_EULA_ACCEPTED_AT}"
+    echo "NETBIRD_EULA_URL=${NETBIRD_EULA_URL}"
     echo "NB_LICENSE_KEY=${NB_LICENSE_KEY}"
     if [[ -n "${NETBIRD_LICENSE_SERVER_BASE_URL:-}" ]]; then
       echo "NETBIRD_LICENSE_SERVER_BASE_URL=${NETBIRD_LICENSE_SERVER_BASE_URL}"

From 4ef65294e970b8559cc222c7f184313fae22f272 Mon Sep 17 00:00:00 2001
From: Viktor Liu <17948409+lixmal@users.noreply.github.com>
Date: Tue, 30 Jun 2026 18:22:25 +0900
Subject: [PATCH 11/36] [client] Reinject captured first packet on lazy
 connection activation (#6572)

---
 client/iface/wgproxy/bind/proxy.go            |  5 ++
 client/iface/wgproxy/ebpf/wrapper.go          | 11 ++++
 client/iface/wgproxy/proxy.go                 |  5 ++
 client/iface/wgproxy/udp/proxy.go             | 11 ++++
 client/internal/engine_test.go                |  4 ++
 client/internal/iface_common.go               |  1 +
 .../lazyconn/activity/listener_bind.go        |  5 ++
 .../lazyconn/activity/listener_bind_test.go   | 17 ++++---
 .../lazyconn/activity/listener_udp.go         | 28 +++++++---
 client/internal/lazyconn/activity/manager.go  | 20 +++++---
 .../lazyconn/activity/manager_test.go         | 19 ++++---
 client/internal/lazyconn/manager/manager.go   | 12 ++---
 client/internal/lazyconn/wgiface.go           |  1 +
 client/internal/peer/conn.go                  | 51 +++++++++++++++++++
 client/internal/peerstore/store.go            | 15 +++++-
 15 files changed, 169 insertions(+), 36 deletions(-)

diff --git a/client/iface/wgproxy/bind/proxy.go b/client/iface/wgproxy/bind/proxy.go
index be6f3806e..be690ed4f 100644
--- a/client/iface/wgproxy/bind/proxy.go
+++ b/client/iface/wgproxy/bind/proxy.go
@@ -136,6 +136,11 @@ func (p *ProxyBind) CloseConn() error {
 	return p.close()
 }
 
+// InjectPacket is a no-op for the userspace proxy: first-packet reinjection is kernel-only.
+func (p *ProxyBind) InjectPacket(_ []byte) error {
+	return nil
+}
+
 func (p *ProxyBind) close() error {
 	if p.remoteConn == nil {
 		return nil
diff --git a/client/iface/wgproxy/ebpf/wrapper.go b/client/iface/wgproxy/ebpf/wrapper.go
index 6e80945c4..a6156a661 100644
--- a/client/iface/wgproxy/ebpf/wrapper.go
+++ b/client/iface/wgproxy/ebpf/wrapper.go
@@ -219,6 +219,17 @@ func (p *ProxyWrapper) RedirectAs(endpoint *net.UDPAddr) {
 	p.pausedCond.L.Unlock()
 }
 
+// InjectPacket writes b to the remote peer over the underlying transport.
+func (p *ProxyWrapper) InjectPacket(b []byte) error {
+	if p.remoteConn == nil {
+		return errors.New("proxy not started")
+	}
+	if _, err := p.remoteConn.Write(b); err != nil {
+		return err
+	}
+	return nil
+}
+
 // CloseConn close the remoteConn and automatically remove the conn instance from the map
 func (p *ProxyWrapper) CloseConn() error {
 	if p.cancel == nil {
diff --git a/client/iface/wgproxy/proxy.go b/client/iface/wgproxy/proxy.go
index 3c8dfd30e..40346bc15 100644
--- a/client/iface/wgproxy/proxy.go
+++ b/client/iface/wgproxy/proxy.go
@@ -18,4 +18,9 @@ type Proxy interface {
 	RedirectAs(endpoint *net.UDPAddr)
 	CloseConn() error
 	SetDisconnectListener(disconnected func())
+
+	// InjectPacket writes a raw packet directly to the remote peer over the underlying transport,
+	// bypassing WireGuard. Used to replay the captured lazyconn handshake initiation. Only the
+	// kernel-mode proxies act on it; the userspace proxy is a no-op since reinjection is kernel-only.
+	InjectPacket(b []byte) error
 }
diff --git a/client/iface/wgproxy/udp/proxy.go b/client/iface/wgproxy/udp/proxy.go
index 6069d1960..783843aba 100644
--- a/client/iface/wgproxy/udp/proxy.go
+++ b/client/iface/wgproxy/udp/proxy.go
@@ -147,6 +147,17 @@ func (p *WGUDPProxy) RedirectAs(endpoint *net.UDPAddr) {
 	p.sendPkg = p.srcFakerConn.SendPkg
 }
 
+// InjectPacket writes b to the remote peer over the underlying transport.
+func (p *WGUDPProxy) InjectPacket(b []byte) error {
+	if p.remoteConn == nil {
+		return errors.New("proxy not started")
+	}
+	if _, err := p.remoteConn.Write(b); err != nil {
+		return err
+	}
+	return nil
+}
+
 // CloseConn close the localConn
 func (p *WGUDPProxy) CloseConn() error {
 	if p.cancel == nil {
diff --git a/client/internal/engine_test.go b/client/internal/engine_test.go
index 1ac9ceff7..fbd47ed74 100644
--- a/client/internal/engine_test.go
+++ b/client/internal/engine_test.go
@@ -178,6 +178,10 @@ func (m *MockWGIface) LastActivities() map[string]monotime.Time {
 	return nil
 }
 
+func (m *MockWGIface) MTU() uint16 {
+	return 1280
+}
+
 func (m *MockWGIface) SetPresharedKey(peerKey string, psk wgtypes.Key, updateOnly bool) error {
 	return nil
 }
diff --git a/client/internal/iface_common.go b/client/internal/iface_common.go
index 2eeac1954..8ffa0b102 100644
--- a/client/internal/iface_common.go
+++ b/client/internal/iface_common.go
@@ -44,4 +44,5 @@ type wgIfaceBase interface {
 	FullStats() (*configurer.Stats, error)
 	LastActivities() map[string]monotime.Time
 	SetPresharedKey(peerKey string, psk wgtypes.Key, updateOnly bool) error
+	MTU() uint16
 }
diff --git a/client/internal/lazyconn/activity/listener_bind.go b/client/internal/lazyconn/activity/listener_bind.go
index 666c3bc28..72a0cfc76 100644
--- a/client/internal/lazyconn/activity/listener_bind.go
+++ b/client/internal/lazyconn/activity/listener_bind.go
@@ -124,6 +124,11 @@ func (d *BindListener) ReadPackets() {
 	d.done.Done()
 }
 
+// CapturedPacket is unused in userspace bind mode: first-packet reinjection is kernel-only.
+func (d *BindListener) CapturedPacket() []byte {
+	return nil
+}
+
 // Close stops the listener and cleans up resources.
 func (d *BindListener) Close() {
 	d.peerCfg.Log.Infof("closing activity listener (LazyConn)")
diff --git a/client/internal/lazyconn/activity/listener_bind_test.go b/client/internal/lazyconn/activity/listener_bind_test.go
index 1baaae6be..7026a9c97 100644
--- a/client/internal/lazyconn/activity/listener_bind_test.go
+++ b/client/internal/lazyconn/activity/listener_bind_test.go
@@ -45,10 +45,6 @@ type MockWGIfaceBind struct {
 	endpointMgr *mockEndpointManager
 }
 
-func (m *MockWGIfaceBind) RemovePeer(string) error {
-	return nil
-}
-
 func (m *MockWGIfaceBind) UpdatePeer(string, []netip.Prefix, time.Duration, *net.UDPAddr, *wgtypes.Key) error {
 	return nil
 }
@@ -68,6 +64,10 @@ func (m *MockWGIfaceBind) GetBind() device.EndpointManager {
 	return m.endpointMgr
 }
 
+func (m *MockWGIfaceBind) MTU() uint16 {
+	return 1280
+}
+
 func TestBindListener_Creation(t *testing.T) {
 	mockEndpointMgr := newMockEndpointManager()
 	mockIface := &MockWGIfaceBind{endpointMgr: mockEndpointMgr}
@@ -207,8 +207,9 @@ func TestManager_BindMode(t *testing.T) {
 	require.NoError(t, err)
 
 	select {
-	case peerConnID := <-mgr.OnActivityChan:
-		assert.Equal(t, cfg.PeerConnID, peerConnID, "Received peer connection ID should match")
+	case ev := <-mgr.OnActivityChan:
+		assert.Equal(t, cfg.PeerConnID, ev.PeerConnID, "Received peer connection ID should match")
+		assert.Nil(t, ev.FirstPacket, "Bind mode does not capture packets: reinjection is kernel-only")
 	case <-time.After(2 * time.Second):
 		t.Fatal("timeout waiting for activity notification")
 	}
@@ -266,8 +267,8 @@ func TestManager_BindMode_MultiplePeers(t *testing.T) {
 	receivedPeers := make(map[peerid.ConnID]bool)
 	for i := 0; i < 2; i++ {
 		select {
-		case peerConnID := <-mgr.OnActivityChan:
-			receivedPeers[peerConnID] = true
+		case ev := <-mgr.OnActivityChan:
+			receivedPeers[ev.PeerConnID] = true
 		case <-time.After(2 * time.Second):
 			t.Fatal("timeout waiting for activity notifications")
 		}
diff --git a/client/internal/lazyconn/activity/listener_udp.go b/client/internal/lazyconn/activity/listener_udp.go
index e0b09be6c..4b7e0ddf7 100644
--- a/client/internal/lazyconn/activity/listener_udp.go
+++ b/client/internal/lazyconn/activity/listener_udp.go
@@ -3,11 +3,13 @@ package activity
 import (
 	"fmt"
 	"net"
+	"slices"
 	"sync"
 	"sync/atomic"
 
 	log "github.com/sirupsen/logrus"
 
+	"github.com/netbirdio/netbird/client/iface/bufsize"
 	"github.com/netbirdio/netbird/client/internal/lazyconn"
 )
 
@@ -20,6 +22,8 @@ type UDPListener struct {
 	done     sync.Mutex
 
 	isClosed atomic.Bool
+
+	capturedPacket []byte
 }
 
 // NewUDPListener creates a listener that detects activity via UDP socket reads.
@@ -46,9 +50,13 @@ func NewUDPListener(wgIface WgInterface, cfg lazyconn.PeerConfig) (*UDPListener,
 }
 
 // ReadPackets blocks reading from the UDP socket until activity is detected or the listener is closed.
+// The first packet that triggers activity is captured so it can be reinjected through the real
+// transport once it is established. Without this, kernel WireGuard's handshake initiation would be
+// dropped and WG would only retry after REKEY_TIMEOUT.
 func (d *UDPListener) ReadPackets() {
 	for {
-		n, remoteAddr, err := d.conn.ReadFromUDP(make([]byte, 1))
+		buf := make([]byte, int(d.wgIface.MTU())+bufsize.WGBufferOverhead)
+		n, remoteAddr, err := d.conn.ReadFromUDP(buf)
 		if err != nil {
 			if d.isClosed.Load() {
 				d.peerCfg.Log.Infof("exit from activity listener")
@@ -62,20 +70,24 @@ func (d *UDPListener) ReadPackets() {
 			d.peerCfg.Log.Warnf("received %d bytes from %s, too short", n, remoteAddr)
 			continue
 		}
-		d.peerCfg.Log.Infof("activity detected")
+		d.capturedPacket = slices.Clone(buf[:n])
+		d.peerCfg.Log.Infof("activity detected, captured %d bytes for reinjection", n)
 		break
 	}
 
-	d.peerCfg.Log.Debugf("removing lazy endpoint: %s", d.endpoint.String())
-	if err := d.wgIface.RemovePeer(d.peerCfg.PublicKey); err != nil {
-		d.peerCfg.Log.Errorf("failed to remove endpoint: %s", err)
-	}
-
-	// Ignore close error as it may return "use of closed network connection" if already closed.
+	// Leave the peer in place. ConfigureWGEndpoint will UpdatePeer with the real endpoint;
+	// removing the peer here wipes kernel WG's staged queue and drops the user packet that
+	// triggered activation.
 	_ = d.conn.Close()
 	d.done.Unlock()
 }
 
+// CapturedPacket returns the first packet that triggered activity, or nil if none was captured.
+// Safe to call after ReadPackets returns.
+func (d *UDPListener) CapturedPacket() []byte {
+	return d.capturedPacket
+}
+
 // Close stops the listener and cleans up resources.
 func (d *UDPListener) Close() {
 	d.peerCfg.Log.Infof("closing activity listener: %s", d.conn.LocalAddr().String())
diff --git a/client/internal/lazyconn/activity/manager.go b/client/internal/lazyconn/activity/manager.go
index cccc0669f..9de8c0fa7 100644
--- a/client/internal/lazyconn/activity/manager.go
+++ b/client/internal/lazyconn/activity/manager.go
@@ -19,17 +19,25 @@ import (
 type listener interface {
 	ReadPackets()
 	Close()
+	CapturedPacket() []byte
+}
+
+// Event reports activity on a managed peer. FirstPacket is the bytes that triggered activation,
+// captured for reinjection through the real transport.
+type Event struct {
+	PeerConnID  peerid.ConnID
+	FirstPacket []byte
 }
 
 type WgInterface interface {
-	RemovePeer(peerKey string) error
 	UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error
 	IsUserspaceBind() bool
 	Address() wgaddr.Address
+	MTU() uint16
 }
 
 type Manager struct {
-	OnActivityChan chan peerid.ConnID
+	OnActivityChan chan Event
 
 	wgIface WgInterface
 
@@ -41,7 +49,7 @@ type Manager struct {
 
 func NewManager(wgIface WgInterface) *Manager {
 	m := &Manager{
-		OnActivityChan: make(chan peerid.ConnID, 1),
+		OnActivityChan: make(chan Event, 1),
 		wgIface:        wgIface,
 		peers:          make(map[peerid.ConnID]listener),
 		done:           make(chan struct{}),
@@ -116,12 +124,12 @@ func (m *Manager) waitForTraffic(l listener, peerConnID peerid.ConnID) {
 	delete(m.peers, peerConnID)
 	m.mu.Unlock()
 
-	m.notify(peerConnID)
+	m.notify(Event{PeerConnID: peerConnID, FirstPacket: l.CapturedPacket()})
 }
 
-func (m *Manager) notify(peerConnID peerid.ConnID) {
+func (m *Manager) notify(ev Event) {
 	select {
 	case <-m.done:
-	case m.OnActivityChan <- peerConnID:
+	case m.OnActivityChan <- ev:
 	}
 }
diff --git a/client/internal/lazyconn/activity/manager_test.go b/client/internal/lazyconn/activity/manager_test.go
index 0768d9219..07dd8d84c 100644
--- a/client/internal/lazyconn/activity/manager_test.go
+++ b/client/internal/lazyconn/activity/manager_test.go
@@ -1,6 +1,7 @@
 package activity
 
 import (
+	"bytes"
 	"net"
 	"net/netip"
 	"testing"
@@ -25,10 +26,6 @@ func (m *MocPeer) ConnID() peerid.ConnID {
 type MocWGIface struct {
 }
 
-func (m MocWGIface) RemovePeer(string) error {
-	return nil
-}
-
 func (m MocWGIface) UpdatePeer(string, []netip.Prefix, time.Duration, *net.UDPAddr, *wgtypes.Key) error {
 	return nil
 }
@@ -44,6 +41,10 @@ func (m MocWGIface) Address() wgaddr.Address {
 	}
 }
 
+func (m MocWGIface) MTU() uint16 {
+	return 1280
+}
+
 // GetPeerListener is a test helper to access listeners
 func (m *Manager) GetPeerListener(peerConnID peerid.ConnID) (listener, bool) {
 	m.mu.Lock()
@@ -86,11 +87,15 @@ func TestManager_MonitorPeerActivity(t *testing.T) {
 	}
 
 	select {
-	case peerConnID := <-mgr.OnActivityChan:
-		if peerConnID != peerCfg1.PeerConnID {
-			t.Fatalf("unexpected peerConnID: %v", peerConnID)
+	case ev := <-mgr.OnActivityChan:
+		if ev.PeerConnID != peerCfg1.PeerConnID {
+			t.Fatalf("unexpected peerConnID: %v", ev.PeerConnID)
+		}
+		if !bytes.Equal(ev.FirstPacket, []byte{0x01, 0x02, 0x03, 0x04, 0x05}) {
+			t.Fatalf("unexpected first packet: %v", ev.FirstPacket)
 		}
 	case <-time.After(1 * time.Second):
+		t.Fatal("timed out waiting for activity")
 	}
 }
 
diff --git a/client/internal/lazyconn/manager/manager.go b/client/internal/lazyconn/manager/manager.go
index fc47bda39..3868e37e8 100644
--- a/client/internal/lazyconn/manager/manager.go
+++ b/client/internal/lazyconn/manager/manager.go
@@ -130,8 +130,8 @@ func (m *Manager) Start(ctx context.Context) {
 		select {
 		case <-ctx.Done():
 			return
-		case peerConnID := <-m.activityManager.OnActivityChan:
-			m.onPeerActivity(peerConnID)
+		case ev := <-m.activityManager.OnActivityChan:
+			m.onPeerActivity(ev)
 		case peerIDs := <-m.inactivityManager.InactivePeersChan():
 			m.onPeerInactivityTimedOut(peerIDs)
 		}
@@ -513,13 +513,13 @@ func (m *Manager) checkHaGroupActivity(haGroup route.HAUniqueID, peerID string,
 	return false
 }
 
-func (m *Manager) onPeerActivity(peerConnID peerid.ConnID) {
+func (m *Manager) onPeerActivity(ev activity.Event) {
 	m.managedPeersMu.Lock()
 	defer m.managedPeersMu.Unlock()
 
-	mp, ok := m.managedPeersByConnID[peerConnID]
+	mp, ok := m.managedPeersByConnID[ev.PeerConnID]
 	if !ok {
-		log.Errorf("peer not found by conn id: %v", peerConnID)
+		log.Errorf("peer not found by conn id: %v", ev.PeerConnID)
 		return
 	}
 
@@ -536,7 +536,7 @@ func (m *Manager) onPeerActivity(peerConnID peerid.ConnID) {
 
 	m.activateHAGroupPeers(mp.peerCfg)
 
-	m.peerStore.PeerConnOpen(m.engineCtx, mp.peerCfg.PublicKey)
+	m.peerStore.PeerConnOpenWithFirstPacket(m.engineCtx, mp.peerCfg.PublicKey, ev.FirstPacket)
 }
 
 func (m *Manager) onPeerInactivityTimedOut(peerIDs map[string]struct{}) {
diff --git a/client/internal/lazyconn/wgiface.go b/client/internal/lazyconn/wgiface.go
index 0626c1815..f003ab3cf 100644
--- a/client/internal/lazyconn/wgiface.go
+++ b/client/internal/lazyconn/wgiface.go
@@ -17,4 +17,5 @@ type WGIface interface {
 	IsUserspaceBind() bool
 	Address() wgaddr.Address
 	LastActivities() map[string]monotime.Time
+	MTU() uint16
 }
diff --git a/client/internal/peer/conn.go b/client/internal/peer/conn.go
index 79a513956..85e54ba5f 100644
--- a/client/internal/peer/conn.go
+++ b/client/internal/peer/conn.go
@@ -6,6 +6,7 @@ import (
 	"net"
 	"net/netip"
 	"runtime"
+	"slices"
 	"sync"
 	"time"
 
@@ -136,6 +137,39 @@ type Conn struct {
 	// Connection stage timestamps for metrics
 	metricsRecorder MetricsRecorder
 	metricsStages   *MetricsStages
+
+	// pendingFirstPacket is the lazyconn-captured handshake init, replayed once the real
+	// transport is up.
+	pendingFirstPacket []byte
+}
+
+// injectPendingFirstPacket replays the captured handshake through the proxy if present, else
+// directly through the ICE conn. The packet is cleared only after a successful write, so a failed
+// or transport-less attempt leaves it available for a later reinjection. Caller must hold conn.mu.
+func (conn *Conn) injectPendingFirstPacket(proxy wgproxy.Proxy, directConn net.Conn) {
+	pkt := conn.pendingFirstPacket
+	if len(pkt) == 0 {
+		return
+	}
+
+	switch {
+	case proxy != nil:
+		if err := proxy.InjectPacket(pkt); err != nil {
+			conn.Log.Debugf("failed to reinject captured first packet via proxy: %v", err)
+			return
+		}
+	case directConn != nil:
+		if _, err := directConn.Write(pkt); err != nil {
+			conn.Log.Debugf("failed to reinject captured first packet via direct conn: %v", err)
+			return
+		}
+	default:
+		conn.Log.Debugf("no transport available to reinject captured first packet")
+		return
+	}
+
+	conn.pendingFirstPacket = nil
+	conn.Log.Debugf("reinjected captured first packet (%d bytes)", len(pkt))
 }
 
 // NewConn creates a new not opened Conn to the remote peer.
@@ -172,6 +206,16 @@ func NewConn(config ConnConfig, services ServiceDependencies) (*Conn, error) {
 // It will try to establish a connection using ICE and in parallel with relay. The higher priority connection type will
 // be used.
 func (conn *Conn) Open(engineCtx context.Context) error {
+	return conn.open(engineCtx, nil)
+}
+
+// OpenWithFirstPacket opens the connection like Open and stashes firstPacket to be replayed once
+// the real transport is established. The packet is retained only on a successful open.
+func (conn *Conn) OpenWithFirstPacket(engineCtx context.Context, firstPacket []byte) error {
+	return conn.open(engineCtx, firstPacket)
+}
+
+func (conn *Conn) open(engineCtx context.Context, firstPacket []byte) error {
 	conn.mu.Lock()
 	defer conn.mu.Unlock()
 
@@ -227,6 +271,9 @@ func (conn *Conn) Open(engineCtx context.Context) error {
 		defer conn.wg.Done()
 		conn.guard.Start(conn.ctx, conn.onGuardEvent)
 	}()
+	if len(firstPacket) > 0 {
+		conn.pendingFirstPacket = slices.Clone(firstPacket)
+	}
 	conn.opened = true
 	return nil
 }
@@ -423,6 +470,8 @@ func (conn *Conn) onICEConnectionIsReady(priority conntype.ConnPriority, iceConn
 		conn.wgProxyRelay.RedirectAs(ep)
 	}
 
+	conn.injectPendingFirstPacket(wgProxy, iceConnInfo.RemoteConn)
+
 	conn.currentConnPriority = priority
 	conn.statusICE.SetConnected()
 	conn.updateIceState(iceConnInfo, updateTime)
@@ -546,6 +595,8 @@ func (conn *Conn) onRelayConnectionIsReady(rci RelayConnInfo) {
 
 	wgConfigWorkaround()
 
+	conn.injectPendingFirstPacket(wgProxy, nil)
+
 	conn.rosenpassRemoteKey = rci.rosenpassPubKey
 	conn.currentConnPriority = conntype.Relay
 	conn.statusRelay.SetConnected()
diff --git a/client/internal/peerstore/store.go b/client/internal/peerstore/store.go
index 099fe4528..112caa101 100644
--- a/client/internal/peerstore/store.go
+++ b/client/internal/peerstore/store.go
@@ -88,11 +88,24 @@ func (s *Store) PeerConnOpen(ctx context.Context, pubKey string) {
 	if !ok {
 		return
 	}
-	// this can be blocked because of the connect open limiter semaphore
 	if err := p.Open(ctx); err != nil {
 		p.Log.Errorf("failed to open peer connection: %v", err)
 	}
+}
 
+// PeerConnOpenWithFirstPacket opens the peer connection and stashes a first packet to be
+// reinjected once the real transport is established.
+func (s *Store) PeerConnOpenWithFirstPacket(ctx context.Context, pubKey string, firstPacket []byte) {
+	s.peerConnsMu.RLock()
+	defer s.peerConnsMu.RUnlock()
+
+	p, ok := s.peerConns[pubKey]
+	if !ok {
+		return
+	}
+	if err := p.OpenWithFirstPacket(ctx, firstPacket); err != nil {
+		p.Log.Errorf("failed to open peer connection: %v", err)
+	}
 }
 
 func (s *Store) PeerConnIdle(pubKey string) {

From 3be90f06b25d2e7ff044263f39e01a13e854a65a Mon Sep 17 00:00:00 2001
From: Bethuel Mmbaga <bethuelmbaga12@gmail.com>
Date: Wed, 1 Jul 2026 12:31:46 +0300
Subject: [PATCH 12/36] [management] Add peer expiration reason to activity
 meta (#6619)

---
 management/server/account.go |  6 +++---
 management/server/peer.go    | 11 ++++++++++-
 management/server/user.go    |  8 +++++---
 3 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/management/server/account.go b/management/server/account.go
index 34220ed3f..2c57c4637 100644
--- a/management/server/account.go
+++ b/management/server/account.go
@@ -689,7 +689,7 @@ func (am *DefaultAccountManager) peerLoginExpirationJob(ctx context.Context, acc
 
 		log.WithContext(ctx).Debugf("discovered %d peers to expire for account %s", len(peerIDs), accountID)
 
-		if err := am.expireAndUpdatePeers(ctx, accountID, expiredPeers); err != nil {
+		if err := am.expireAndUpdatePeers(ctx, accountID, expiredPeers, peerExpirationSessionExpired); err != nil {
 			log.WithContext(ctx).Errorf("failed updating account peers while expiring peers for account %s", accountID)
 			return peerSchedulerRetryInterval, true
 		}
@@ -724,7 +724,7 @@ func (am *DefaultAccountManager) peerInactivityExpirationJob(ctx context.Context
 
 		log.Debugf("discovered %d peers to expire for account %s", len(peerIDs), accountID)
 
-		if err := am.expireAndUpdatePeers(ctx, accountID, inactivePeers); err != nil {
+		if err := am.expireAndUpdatePeers(ctx, accountID, inactivePeers, peerExpirationInactivity); err != nil {
 			log.Errorf("failed updating account peers while expiring peers for account %s", accountID)
 			return peerSchedulerRetryInterval, true
 		}
@@ -1949,7 +1949,7 @@ func (am *DefaultAccountManager) onPeersInvalidated(ctx context.Context, account
 		}
 	}
 	if len(peers) > 0 {
-		err := am.expireAndUpdatePeers(ctx, accountID, peers)
+		err := am.expireAndUpdatePeers(ctx, accountID, peers, peerExpirationValidationFailed)
 		if err != nil {
 			log.WithContext(ctx).Errorf("failed to expire and update invalidated peers for account %s: %v", accountID, err)
 			return
diff --git a/management/server/peer.go b/management/server/peer.go
index 440e90044..32bf9feea 100644
--- a/management/server/peer.go
+++ b/management/server/peer.go
@@ -34,7 +34,16 @@ import (
 	"github.com/netbirdio/netbird/version"
 )
 
-const remoteJobsMinVer = "0.64.0"
+type peerExpirationReason string
+
+const (
+	remoteJobsMinVer = "0.64.0"
+
+	peerExpirationSessionExpired   peerExpirationReason = "session expiration"
+	peerExpirationInactivity       peerExpirationReason = "inactivity timeout"
+	peerExpirationValidationFailed peerExpirationReason = "failed integration validation"
+	peerExpirationUserBlocked      peerExpirationReason = "blocked owner account"
+)
 
 // GetPeers returns peers visible to the user within an account.
 // Users with "peers:read" see all peers. Otherwise, users see only their own peers, or none if restricted by account settings.
diff --git a/management/server/user.go b/management/server/user.go
index 666d6d178..b4b9ebe01 100644
--- a/management/server/user.go
+++ b/management/server/user.go
@@ -675,7 +675,7 @@ func (am *DefaultAccountManager) SaveOrAddUsers(ctx context.Context, accountID,
 	}
 
 	if len(peersToExpire) > 0 {
-		if err := am.expireAndUpdatePeers(ctx, accountID, peersToExpire); err != nil {
+		if err := am.expireAndUpdatePeers(ctx, accountID, peersToExpire, peerExpirationUserBlocked); err != nil {
 			log.WithContext(ctx).Errorf("failed update expired peers: %s", err)
 			return nil, err
 		}
@@ -1118,7 +1118,7 @@ func (am *DefaultAccountManager) BuildUserInfosForAccount(ctx context.Context, a
 }
 
 // expireAndUpdatePeers expires all peers of the given user and updates them in the account
-func (am *DefaultAccountManager) expireAndUpdatePeers(ctx context.Context, accountID string, peers []*nbpeer.Peer) error {
+func (am *DefaultAccountManager) expireAndUpdatePeers(ctx context.Context, accountID string, peers []*nbpeer.Peer, reason peerExpirationReason) error {
 	log.WithContext(ctx).Debugf("Expiring %d peers for account %s", len(peers), accountID)
 	settings, err := am.Store.GetAccountSettings(ctx, store.LockingStrengthNone, accountID)
 	if err != nil {
@@ -1145,10 +1145,12 @@ func (am *DefaultAccountManager) expireAndUpdatePeers(ctx context.Context, accou
 		if err := am.Store.SavePeerStatus(ctx, accountID, peer.ID, *peer.Status); err != nil {
 			return err
 		}
+		meta := peer.EventMeta(dnsDomain)
+		meta["reason"] = string(reason)
 		am.StoreEvent(
 			ctx,
 			peer.UserID, peer.ID, accountID,
-			activity.PeerLoginExpired, peer.EventMeta(dnsDomain),
+			activity.PeerLoginExpired, meta,
 		)
 	}
 

From 92a66cdd202407e4114c64ebfea42b6ed50c5377 Mon Sep 17 00:00:00 2001
From: Maycon Santos <mlsmaycon@gmail.com>
Date: Wed, 1 Jul 2026 12:45:14 +0200
Subject: [PATCH 13/36] [management,proxy,client] 0.74.0 version (#6563)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* [management,proxy] Agent network: per-account LLM gateway (policy, metering, multi-provider) (#6555)

* [agent-network] Shared proto, OpenAPI schema, and generated types

* [agent-network] Management: store, manager, synthesizer, policy engine, provider catalog, HTTP/gRPC API

Adds the account-scoped agent-network module: provider/policy/budget CRUD and
store, the reverse-proxy service synthesizer, policy selection + limit
enforcement, the provider catalog (incl. Vertex AI and AWS Bedrock entries),
and the management HTTP + proxy gRPC surfaces.

* [management] Fix agent-network proxy-peer fan-out on affected-peer recompute

The affected-peers resolver loaded only persisted reverse-proxy services, but
agent-network services are synthesized on demand and never persisted. As a
result the embedded proxy peer was never folded into the affected set when a
client's group changed, so the proxy received no network-map update for a newly
authorised client and rejected its handshake until a full resync (restart).

loadProxyServices now merges the synthesized agent-network services (injected
via a registration hook to avoid an import cycle), so proxy peers learn newly
authorised clients immediately.

* [proxy] Reverse-proxy middleware framework, chain, and request plumbing

The per-target middleware chain (slots, dispatcher, mutation gate, metadata
merger), body capture, access-log terminal sink, and the proxy wiring that
builds + runs chains for synthesized agent-network services.

* [proxy] LLM parsers, pricing, and builtin middlewares (OpenAI, Anthropic, Vertex AI, AWS Bedrock)

Request/response parsers and SSE/event-stream metering, the embedded pricing
table, and the builtin middleware set: request parser, router, policy
limit-check/record, cost meter, guardrail, identity inject, response parser.
Includes the path-routed providers — Google Vertex AI (keyfile:: service-account
OAuth minting) and AWS Bedrock (bearer auth, invoke/converse/streaming, optional
/bedrock prefix) — plus the Models allowlist and unmeterable-publisher deny.

* [proxy] IPv6 in-place apply and TCP accept-loop hardening on netstack listeners

* [agent-network] End-to-end test suite, module docs, and deployment preset

* [agent-network] Fix codespell typos and exclude false positives

- labelgen word pool: vermillion -> vermilion, racoon -> raccoon.
- codespell ignore list: add flate (Go compress/flate package), recordin
  (a test-local identifier), and unparseable (a valid alternative spelling used
  consistently across identifiers + a metadata-value constant).

* [management] Set LastSeen on injected proxy peer in realstack test (MySQL strict-mode)

The injected embedded proxy peer had a PeerStatus with a zero LastSeen, which
serializes to '0000-00-00' and is rejected by MySQL in strict mode (SQLite
tolerates it). Set LastSeen to a valid time so SaveAccount succeeds on both
engines.

* [agent-network] Remove e2e shell-script suite from this branch

The end-to-end shell scripts under scripts/e2e/ are maintained in a separate
testing suite and are not part of this change set.

* [agent-network] Polish module docs: remove internal review scaffolding, fix links, verify diagrams

Strip PR-review framing, commit references, absolute paths, and stale internal
references from the agent-network module docs; fix broken relative links; verify
all diagrams against the current architecture. Remove the internal AI-reviewer
prompt file.

* [management] Refine session expiration handling to support 3-state encoding for SSO deadlines

* [agent-network] Relocate agentnetwork package to internals/modules

Move management/server/agentnetwork (and its catalog/, labelgen/, types/
subpackages) to management/internals/modules/agentnetwork, alongside the
reverse-proxy module, and rewrite all importers. Pure relocation: package names,
the synthesizer + affectedpeers registration hook, and store access (shared
store.Store) are unchanged, so no import cycle is introduced (affectedpeers
still depends only on the agentnetwork/types leaf).

* [agent-network] Co-locate HTTP handlers in the module (RegisterEndpoints)

Move the agent-network HTTP handlers from server/http/handlers/agentnetwork into
the module at internals/modules/agentnetwork/handlers (package handlers) and
rename the entrypoint AddEndpoints -> RegisterEndpoints, matching the
reverse-proxy module convention. Wiring in http/handler.go updated accordingly.

* Update getting started to point to rc when agent network enabled

* Add a reference to a commercial license

* Fix docs localhost link

* Fix docs localhost link

* Add private services domain note

* [management] Add agent-network telemetry metrics (#6561)

Surface agent-network adoption and usage in the self-hosted metrics
worker: distinct accounts, providers, policies, budget rules, accounts
with log collection enabled, and aggregated input/output tokens plus
cost.

Tokens and cost are summed from agent_network_request_usage (the
always-written per-request ledger) so the figures are accurate
regardless of the log-collection toggle and carry no double-counting.
All values come from a handful of indexed aggregate queries run only on
the worker's periodic tick.

Adds store.AgentNetworkMetrics with GetAgentNetworkMetrics on the Store
interface, the SqlStore implementation, and a zero-valued FileStore stub.

* Update NetBird server and proxy image versions to 0.74.0-rc.2

* [management,proxy] Reduce agent-network cognitive complexity (#6566)

Address the SonarCloud quality-gate findings in new agent-network code
by extracting focused helpers. No behavior change.

- synthesizer.go: split buildIdentityInjectConfigJSON into per-shape
  rule builders; extract mergeGuardrail from mergeGuardrails to cut
  nesting depth.
- llm_identity_inject: extract injectionEmitsAnything validation
  predicate from New.
- llm_response_parser/streaming.go: extract applyOpenAIStreamUsage and
  applyAnthropicStreamUsage (via a named anthropicStreamUsage type) and
  simplify the OpenAI scanner loop.
- reverseproxy.go: decompose ServeHTTP into serveRouteError,
  buildTargetContext, serveDirect, serveWithChain, captureRequestForChain,
  serveDeny, newResponseWriter, observeResponse, and forwardUpstream,
  preserving the defer ordering so response observation still reads the
  captured writer before it is released.

* [management] Move agent-network access-log ingest into the agentnetwork module (#6568)

The agent-network access-log ingest path (metaKey wire contract, flatten,
usage derivation, and the dual-write of the usage ledger + settings-gated
full row) lived in the reverseproxy accesslogs manager, even though the
agentnetwork module already owns the rest of that domain — types, read
(ListAccessLogs / GetUsageOverview), the budget-counter writes, and
retention cleanup.

Move it next to the rest: a stateless agentnetwork.IngestAccessLog(ctx,
store, entry) that the reverseproxy SaveAccessLog delegates to when the
entry is agent-network. Removes the agentNetworkTypes import from the
reverseproxy manager. No behavior change; the write/read table separation
is unchanged.

Adds real-store coverage for the disable->enable log-collection toggle
(usage ledger always written, full row gated) plus the metadata parse and
group-dedup helpers, which previously had no dedicated tests.

* Add session view support in the access log

* [management,proxy] Container-based agent-network e2e harness (#6577)

* [e2e] Add container-based agent-network e2e harness (Pillar 1)

Introduce a self-contained, OIDC-free e2e harness that stands up NetBird
in containers, so suites no longer depend on the hand-maintained Tilt
stack or a real IdP.

- harness brings up the combined server (management + signal + relay +
  STUN + embedded IdP) in a single container built from
  combined/Dockerfile.multistage, and mints an admin PAT through the
  unauthenticated /api/setup bootstrap (NB_SETUP_PAT_ENABLED). API access
  goes through the existing shared/management/client/rest typed client.
- the image is built via the docker CLI (BuildKit) so the Dockerfile's
  cache mounts are honored; testcontainers then runs the tagged image.
- everything is behind the `e2e` build tag so normal builds and unit
  tests never pull in testcontainers.

Adds BuildKit cache mounts to combined/Dockerfile.multistage so source
changes recompile incrementally rather than from scratch.

Pillar 1 proven by TestCombinedBootstrap: server builds, boots, mints a
PAT, and the PAT authenticates a real management API call.

* [e2e] Add management-side agent-network scenarios (Pillar 2)

Port the API-driven agent-network scenarios from the bash suites to Go,
sharing one combined server per package run (TestMain) with each test
owning its resource cleanup. Drives the /api/agent-network/* endpoints
through the shared REST client's NewRequest primitive with the generated
api types.

Scenarios:
- provider lifecycle (create/get/list/delete + 404 after delete)
- provider validation (missing api_key, unknown catalog id → 4xx)
- settings collection-toggle round-trip with cluster/subdomain immutability
- policy window floor (reject <60s enabled limit, accept at 60s)
- consumption read endpoint returns an array

All deterministic and dependency-free (dummy provider keys; no upstream
calls), so they run headless in CI.

* [e2e] Add live chat-through-proxy scenario (Pillar 3)

Stand up the full agent-network data path in containers and drive a real
chat-completion through the gateway:

- harness: a shared docker network (combined server reachable by alias),
  a proxy container built from the published reverse-proxy image
  (NB_PROXY_PRIVATE, NB_PROXY_ALLOW_INSECURE, NB_RELAY_TRANSPORT=ws to match
  the combined server's WS-multiplexed relay) with a generated self-signed
  wildcard cert, and a netbird client container that joins via a setup key.
- the combined image, proxy image, and client image default to the
  published rc.2 releases (overridable via NB_E2E_*_IMAGE; a bare local tag
  is built from source instead). Geolocation download is disabled so the
  server starts without external fetches.
- one shared domain is used for the management exposed address, the proxy
  domain, and the agent-network cluster; the proxy token is minted via the
  server CLI (global) to match the manual install.

TestChatCompletionThroughProxy provisions provider+policy+group+setup key,
runs proxy+client, drives an OpenAI chat-completion through the tunnel, and
asserts a 200 plus the ingested access-log row. Requires OPENAI_TOKEN
(skips otherwise). The provider must be created with enabled=true explicitly
— the create default is false despite the API doc.

* [e2e] Run the live chat scenario across a provider matrix

Replace the single-provider chat test with a data-driven matrix that runs
the same scenario through every provider whose credentials are present in
the environment (keys/URLs sourced from ~/.llm-keys locally, Actions
secrets in CI):

- OpenAI (chat), Anthropic (messages), Vercel, OpenRouter, Cloudflare
  (OpenAI-compatible gateways), and Bedrock (path-routed, bearer, via the
  messages shape) — covering both wire shapes and the gateway routing.
- all providers are created enabled with a unique model string so the
  proxy's connect-time snapshot carries them all and model->provider
  routing is unambiguous (provider toggles after connect don't reconcile
  to a connected proxy).
- the client supports both wire shapes (/v1/chat/completions and
  /v1/messages); Cloudflare gets the openai provider segment appended to
  its gateway URL.

Each provider must return 200 through the tunnel and produce an ingested
access-log row. Vertex is intentionally excluded from the uniform matrix:
it needs a bespoke rawPredict request shape rather than the shared
chat/messages path, so it warrants a dedicated scenario.

* [ci] Add manual workflow for the agent-network e2e suite

The e2e suite (build tag `e2e`) stands up the combined server + proxy +
client in Docker and drives live chat-completions, so it is slow and needs
provider credentials. Gate it out of normal CI (it already is, via the
build tag) and run it on demand via workflow_dispatch. Provider scenarios
skip when their secret is unset, so it degrades gracefully.

* [e2e] Add Vertex to the provider matrix; run e2e on ubuntu-latest

Vertex (Anthropic-on-Vertex) doesn't share the chat/messages wire shapes:
the model travels in a rawPredict path and the proxy mints the service
account's OAuth token. Add a Vertex client method that posts
/v1/projects/<project>/locations/<region>/publishers/anthropic/models/<model>:rawPredict
with the Vertex anthropic_version body, and wire it into the matrix as a
path-routed provider (created without a models array). It is keyed off
GOOGLE_VERTEX_SA_BASE64 + GOOGLE_VERTEX_PROJECT (region defaults to
"global", model to a pinned claude snapshot, both overridable).

Also bump the e2e workflow runner to ubuntu-latest and add the Vertex
secrets.

* Add docker/docker and docker/go-connections as direct dependencies in go.mod

* [ci] Trigger agent-network e2e workflow on push to main and pull requests

* [e2e] Fix proxy cert permission denied on Linux CI runners

The proxy bind-mounts a temp dir of self-signed certs. MkdirTemp creates
it 0700 and the key was 0600, which Docker Desktop on macOS ignores but a
non-root proxy container on Linux runners cannot traverse/read, so the
cert watcher failed with "open /certs/tls.crt: permission denied" and the
container exited. Widen the cert dir to 0755 and write the throwaway key
0644 so the proxy uid can read the bind-mounted material.

* [e2e] Build images from source by default instead of pulling rc.2

The agent-network code under test lives in this branch, so the e2e should
exercise it rather than a frozen published release. Flip the harness
default: combined/proxy/client are now built from their in-repo
Dockerfiles (combined/Dockerfile.multistage, proxy/Dockerfile.multistage,
e2e/harness/Dockerfile.client) under local tags. Pulling a published image
stays available by setting NB_E2E_*_IMAGE to a registry reference.

Builds now go through buildx --load so the Dockerfile cache mounts are
honored and the result is loaded for testcontainers. The CI workflow adds
a container-driver builder and a local layer cache (NB_E2E_BUILDX_CACHE)
persisted via actions/cache, which caches the base/apt/dep-download layers
across runs. The Go compile still re-runs each time, as BuildKit mount
caches cannot be exported to the GitHub cache.

* [e2e] Cover real providers in lifecycle + assert real consumption metering

- TestProviderLifecycle now runs per available real provider (create → get →
  list → delete → 404) instead of a single dummy provider, exercising each
  catalog's create and field round-trip. Create is offline, so it stays fast
  and burns no provider quota; falls back to a synthetic OpenAI provider when
  no keys are set.
- TestProvidersMatrix attaches a token limit (high caps, 60s window) to its
  policy, which switches on usage metering, and asserts consumption rows are
  recorded with positive token counts after the live traffic. Consumption is
  account-scoped (keyed by source group / user and window, not per provider),
  so the assertion is aggregate.
- TestProviderValidation gains invalid-upstream and blank-name cases. Create
  validation is uniform across catalogs (no per-provider required-field rules),
  so per-provider rejection cases would be redundant.

* [e2e] Assert session id propagates per provider

Each matrix request now sends a unique session id as the universal
x-session-id header and asserts it round-trips into that provider's
access-log row. This guards the session-grouping contract end to end for
every provider (header extraction runs in llm_request_parser ahead of the
parser-specific body extraction, so it is provider-agnostic).

* [e2e] Drop accidentally committed sync-phases dashboard

netbird-sync-phases.json was swept into the Pillar 1 commit by a broad
git add; it belongs to the unrelated sync-phases metrics work, not this
e2e harness. Remove it from the branch so the PR diff is scoped to the
e2e changes.

* [e2e] Revert accidentally committed sync-phase ingest spec

The netbird_sync_phase measurement spec in metrics ingest was swept into
the Pillar 1 commit; it belongs to the unrelated sync-phases metrics work,
not this e2e harness. Its emission side never landed here, so the spec was
orphaned anyway. Restore ingest/main.go to its origin/main state.

* Fix golint issues

* Fix sonar

* Add access log session test

* Fix access log tests

---------

Co-authored-by: braginini <bangvalo@gmail.com>
Co-authored-by: Zoltan Papp <zoltan.pmail@gmail.com>
---
 .github/workflows/agent-network-e2e.yml       |   69 +
 .github/workflows/golangci-lint.yml           |    2 +-
 combined/Dockerfile.multistage                |   10 +-
 docs/agent-networks/00-overview.md            |  109 +
 docs/agent-networks/01-end-to-end-flows.md    |  217 ++
 docs/agent-networks/README.md                 |   66 +
 docs/agent-networks/modules/10-shared-api.md  |  105 +
 .../modules/20-management-store.md            |  112 +
 .../modules/21-management-agentnetwork.md     |  225 ++
 .../modules/22-management-handlers-wiring.md  |  203 ++
 .../modules/30-proxy-middleware-framework.md  |  215 ++
 .../modules/31-proxy-middleware-builtin.md    |  365 +++
 .../modules/32-proxy-llm-parsers.md           |  392 ++++
 .../modules/33-proxy-runtime.md               |  194 ++
 docs/agent-networks/modules/40-dashboard.md   |  228 ++
 .../modules/50-path-routed-providers.md       |  251 ++
 e2e/agentnetwork/bootstrap_test.go            |   30 +
 e2e/agentnetwork/chat_test.go                 |  281 +++
 e2e/agentnetwork/main_test.go                 |   46 +
 e2e/agentnetwork/management_test.go           |  221 ++
 e2e/harness/Dockerfile.client                 |   24 +
 e2e/harness/agentnetwork.go                   |  130 ++
 e2e/harness/bootstrap.go                      |   47 +
 e2e/harness/cert.go                           |   66 +
 e2e/harness/client.go                         |  256 ++
 e2e/harness/combined.go                       |  243 ++
 e2e/harness/config.go                         |   26 +
 e2e/harness/doc.go                            |   13 +
 e2e/harness/paths.go                          |   29 +
 e2e/harness/proxy.go                          |  122 +
 go.mod                                        |    6 +-
 .../network_map/controller/controller.go      |   36 +-
 .../network_map/controller/repository.go      |   10 +
 .../modules/agentnetwork/accesslog_ingest.go  |  215 ++
 .../accesslog_ingest_realstore_test.go        |  124 +
 .../accesslog_sessions_realstore_test.go      |  343 +++
 .../agentnetwork/affectedpeers_hook.go        |   15 +
 .../modules/agentnetwork/catalog/catalog.go   |  749 ++++++
 .../handlers/access_log_handler.go            |  134 ++
 .../agentnetwork/handlers/budget_handler.go   |  172 ++
 .../handlers/budget_handler_test.go           |  131 ++
 .../handlers/consumption_handler.go           |   53 +
 .../handlers/guardrails_handler.go            |  171 ++
 .../agentnetwork/handlers/handlers_test.go    |  256 ++
 .../agentnetwork/handlers/policies_handler.go |  228 ++
 .../handlers/providers_handler.go             |  217 ++
 .../agentnetwork/handlers/settings_handler.go |   74 +
 .../modules/agentnetwork/labelgen/labelgen.go |   66 +
 .../agentnetwork/labelgen/labelgen_test.go    |  101 +
 .../modules/agentnetwork/labelgen/words.go    |  136 ++
 .../internals/modules/agentnetwork/manager.go |  911 ++++++++
 .../modules/agentnetwork/policyselect.go      |  660 ++++++
 .../policyselect_account_realstore_test.go    |  181 ++
 .../policyselect_realstore_test.go            |  214 ++
 .../modules/agentnetwork/policyselect_test.go |  641 +++++
 .../modules/agentnetwork/reconcile.go         |  131 ++
 .../modules/agentnetwork/reconcile_test.go    |  232 ++
 .../modules/agentnetwork/synthesizer.go       | 1083 +++++++++
 .../synthesizer_guardrail_realstore_test.go   |  178 ++
 ...nthesizer_log_collection_realstore_test.go |   70 +
 ...ynthesizer_parser_redact_realstore_test.go |  145 ++
 .../synthesizer_realstore_test.go             |  174 ++
 .../modules/agentnetwork/synthesizer_test.go  | 1098 +++++++++
 .../modules/agentnetwork/types/accesslog.go   |  289 +++
 .../agentnetwork/types/accesslogfilter.go     |  249 ++
 .../modules/agentnetwork/types/budgetrule.go  |  106 +
 .../modules/agentnetwork/types/consumption.go |   69 +
 .../agentnetwork/types/consumption_test.go    |  141 ++
 .../modules/agentnetwork/types/guardrail.go   |  120 +
 .../modules/agentnetwork/types/policy.go      |  192 ++
 .../modules/agentnetwork/types/provider.go    |  252 ++
 .../modules/agentnetwork/types/settings.go    |   78 +
 .../modules/agentnetwork/types/usage.go       |   47 +
 .../agentnetwork/types/usageoverview.go       |   96 +
 .../modules/agentnetwork/wire_shape_test.go   |  109 +
 management/internals/modules/peers/manager.go |   56 +-
 .../reverseproxy/accesslogs/accesslogentry.go |    5 +
 .../accesslogs/manager/manager.go             |    9 +-
 .../modules/reverseproxy/service/service.go   |  109 +-
 management/internals/server/boot.go           |   28 +-
 management/internals/server/modules.go        |   19 +
 management/internals/shared/grpc/proxy.go     |  200 +-
 management/server/activity/codes.go           |   49 +
 .../server/affectedpeers/proxy_synth_test.go  |   95 +
 management/server/affectedpeers/resolver.go   |   37 +-
 .../agentnetwork_budgetrule_realstack_test.go |  126 +
 .../agentnetwork_proxypeer_restart_test.go    |  199 ++
 .../server/agentnetwork_realstack_test.go     |  212 ++
 management/server/http/handler.go             |    7 +-
 .../testing/testing_tools/channel/channel.go  |    4 +-
 management/server/metrics/selfhosted.go       |   16 +
 management/server/metrics/selfhosted_test.go  |   15 +
 .../server/permissions/modules/module.go      |    2 +
 management/server/store/file_store.go         |    6 +
 management/server/store/sql_store.go          |  339 +++
 .../server/store/sql_store_agentnetwork.go    |  664 ++++++
 .../sql_store_agentnetwork_accesslog_test.go  |  302 +++
 .../sql_store_agentnetwork_budgetrule_test.go |  112 +
 management/server/store/store.go              |   66 +
 .../server/store/store_mock_agentnetwork.go   |  495 ++++
 proxy/inbound.go                              |    9 +-
 proxy/inbound_test.go                         |  122 +
 proxy/internal/accesslog/logger.go            |   50 +
 proxy/internal/accesslog/middleware.go        |   14 +-
 proxy/internal/accesslog/middleware_test.go   |  185 ++
 proxy/internal/auth/middleware_test.go        |  119 +-
 proxy/internal/llm/anthropic.go               |  196 ++
 proxy/internal/llm/anthropic_test.go          |  169 ++
 proxy/internal/llm/bedrock.go                 |  189 ++
 proxy/internal/llm/bedrock_test.go            |   65 +
 proxy/internal/llm/errors.go                  |   31 +
 .../llm/fixtures/anthropic_messages.json      |   17 +
 .../llm/fixtures/anthropic_stream.txt         |   21 +
 .../llm/fixtures/openai_chat_completion.json  |   21 +
 .../llm/fixtures/openai_responses.json        |   24 +
 .../llm/fixtures/openai_responses_stream.txt  |   24 +
 proxy/internal/llm/fixtures/openai_stream.txt |    8 +
 proxy/internal/llm/fixtures/pricing.yaml      |   59 +
 proxy/internal/llm/openai.go                  |  412 ++++
 proxy/internal/llm/openai_test.go             |  255 ++
 proxy/internal/llm/parser.go                  |  112 +
 proxy/internal/llm/parser_test.go             |   54 +
 .../llm/pricing/defaults_coverage_test.go     |   65 +
 .../llm/pricing/defaults_pricing.yaml         |  264 +++
 proxy/internal/llm/pricing/pricing.go         |  449 ++++
 proxy/internal/llm/pricing/pricing_other.go   |   20 +
 proxy/internal/llm/pricing/pricing_test.go    |  432 ++++
 proxy/internal/llm/pricing/pricing_unix.go    |   68 +
 proxy/internal/llm/sse.go                     |  117 +
 proxy/internal/llm/sse_test.go                |  175 ++
 proxy/internal/metrics/metrics.go             |    9 +
 proxy/internal/middleware/bodypolicy.go       |   63 +
 proxy/internal/middleware/bodytap/request.go  |  344 +++
 proxy/internal/middleware/bodytap/response.go |  189 ++
 .../middleware/bodytap/routing_scan_test.go   |   86 +
 .../agentnetwork_chain_integration_test.go    |  318 +++
 proxy/internal/middleware/builtin/all_test.go |   40 +
 proxy/internal/middleware/builtin/builtin.go  |   93 +
 .../middleware/builtin/cost_meter/factory.go  |   88 +
 .../builtin/cost_meter/middleware.go          |  193 ++
 .../builtin/cost_meter/middleware_test.go     |  459 ++++
 .../builtin/llm_guardrail/factory.go          |   82 +
 .../builtin/llm_guardrail/middleware.go       |  183 ++
 .../builtin/llm_guardrail/middleware_test.go  |  219 ++
 .../builtin/llm_guardrail/redact.go           |   75 +
 .../builtin/llm_guardrail/redact_test.go      |  217 ++
 .../builtin/llm_identity_inject/factory.go    |  108 +
 .../builtin/llm_identity_inject/middleware.go |  439 ++++
 .../llm_identity_inject/middleware_test.go    |  666 ++++++
 .../builtin/llm_limit_check/factory.go        |   38 +
 .../builtin/llm_limit_check/middleware.go     |  196 ++
 .../llm_limit_check/middleware_test.go        |  186 ++
 .../builtin/llm_limit_record/factory.go       |   35 +
 .../builtin/llm_limit_record/middleware.go    |  144 ++
 .../llm_limit_record/middleware_test.go       |  191 ++
 .../llm_request_parser/bedrock_test.go        |   55 +
 .../builtin/llm_request_parser/factory.go     |   71 +
 .../builtin/llm_request_parser/middleware.go  |  453 ++++
 .../llm_request_parser/middleware_test.go     |  418 ++++
 .../builtin/llm_response_parser/factory.go    |   43 +
 .../builtin/llm_response_parser/gzip_test.go  |  133 ++
 .../builtin/llm_response_parser/middleware.go |  339 +++
 .../llm_response_parser/middleware_test.go    |  433 ++++
 .../responses_stream_test.go                  |   69 +
 .../builtin/llm_response_parser/streaming.go  |  270 +++
 .../llm_response_parser/streaming_bedrock.go  |  110 +
 .../streaming_bedrock_test.go                 |   74 +
 .../llm_response_parser/streaming_test.go     |  169 ++
 .../middleware/builtin/llm_router/factory.go  |  106 +
 .../builtin/llm_router/middleware.go          |  793 +++++++
 .../builtin/llm_router/middleware_test.go     |  840 +++++++
 .../builtin/llm_router/path_routed_test.go    |  159 ++
 proxy/internal/middleware/chain.go            |  320 +++
 proxy/internal/middleware/chain_test.go       |  370 +++
 proxy/internal/middleware/decision.go         |   81 +
 proxy/internal/middleware/dispatcher.go       |  189 ++
 proxy/internal/middleware/headerpolicy.go     |   99 +
 proxy/internal/middleware/keys.go             |   86 +
 proxy/internal/middleware/manager.go          |  412 ++++
 proxy/internal/middleware/metadata.go         |   99 +
 proxy/internal/middleware/metrics.go          |  171 ++
 proxy/internal/middleware/middleware.go       |   47 +
 proxy/internal/middleware/redaction.go        |   79 +
 proxy/internal/middleware/registry.go         |  121 +
 proxy/internal/middleware/spec.go             |   44 +
 proxy/internal/middleware/types.go            |  253 ++
 .../agent_network_chain_realstack_test.go     |  321 +++
 proxy/internal/proxy/context.go               |   43 +-
 proxy/internal/proxy/reverseproxy.go          |  456 +++-
 proxy/internal/proxy/reverseproxy_test.go     |   43 +
 proxy/internal/proxy/servicemapping.go        |   16 +
 proxy/internal/proxy/strip_prefix_test.go     |   30 +
 proxy/internal/roundtrip/netbird.go           |   74 +-
 proxy/internal/tcp/accept.go                  |   85 +
 proxy/internal/tcp/accept_test.go             |  142 ++
 proxy/internal/tcp/router.go                  |   15 +-
 proxy/internal/tcp/router_test.go             |  129 ++
 proxy/middleware_register.go                  |   16 +
 proxy/middleware_translate.go                 |  165 ++
 proxy/middleware_translate_test.go            |  246 ++
 proxy/server.go                               |  173 +-
 shared/management/http/api/openapi.yml        | 2061 +++++++++++++++++
 shared/management/http/api/types.gen.go       |  954 ++++++++
 shared/management/proto/management.pb.go      |   24 +-
 shared/management/proto/proxy_service.pb.go   | 1934 +++++++++++-----
 shared/management/proto/proxy_service.proto   |  125 +
 .../management/proto/proxy_service_grpc.pb.go |   88 +
 shared/management/status/error.go             |   20 +
 208 files changed, 39957 insertions(+), 688 deletions(-)
 create mode 100644 .github/workflows/agent-network-e2e.yml
 create mode 100644 docs/agent-networks/00-overview.md
 create mode 100644 docs/agent-networks/01-end-to-end-flows.md
 create mode 100644 docs/agent-networks/README.md
 create mode 100644 docs/agent-networks/modules/10-shared-api.md
 create mode 100644 docs/agent-networks/modules/20-management-store.md
 create mode 100644 docs/agent-networks/modules/21-management-agentnetwork.md
 create mode 100644 docs/agent-networks/modules/22-management-handlers-wiring.md
 create mode 100644 docs/agent-networks/modules/30-proxy-middleware-framework.md
 create mode 100644 docs/agent-networks/modules/31-proxy-middleware-builtin.md
 create mode 100644 docs/agent-networks/modules/32-proxy-llm-parsers.md
 create mode 100644 docs/agent-networks/modules/33-proxy-runtime.md
 create mode 100644 docs/agent-networks/modules/40-dashboard.md
 create mode 100644 docs/agent-networks/modules/50-path-routed-providers.md
 create mode 100644 e2e/agentnetwork/bootstrap_test.go
 create mode 100644 e2e/agentnetwork/chat_test.go
 create mode 100644 e2e/agentnetwork/main_test.go
 create mode 100644 e2e/agentnetwork/management_test.go
 create mode 100644 e2e/harness/Dockerfile.client
 create mode 100644 e2e/harness/agentnetwork.go
 create mode 100644 e2e/harness/bootstrap.go
 create mode 100644 e2e/harness/cert.go
 create mode 100644 e2e/harness/client.go
 create mode 100644 e2e/harness/combined.go
 create mode 100644 e2e/harness/config.go
 create mode 100644 e2e/harness/doc.go
 create mode 100644 e2e/harness/paths.go
 create mode 100644 e2e/harness/proxy.go
 create mode 100644 management/internals/modules/agentnetwork/accesslog_ingest.go
 create mode 100644 management/internals/modules/agentnetwork/accesslog_ingest_realstore_test.go
 create mode 100644 management/internals/modules/agentnetwork/accesslog_sessions_realstore_test.go
 create mode 100644 management/internals/modules/agentnetwork/affectedpeers_hook.go
 create mode 100644 management/internals/modules/agentnetwork/catalog/catalog.go
 create mode 100644 management/internals/modules/agentnetwork/handlers/access_log_handler.go
 create mode 100644 management/internals/modules/agentnetwork/handlers/budget_handler.go
 create mode 100644 management/internals/modules/agentnetwork/handlers/budget_handler_test.go
 create mode 100644 management/internals/modules/agentnetwork/handlers/consumption_handler.go
 create mode 100644 management/internals/modules/agentnetwork/handlers/guardrails_handler.go
 create mode 100644 management/internals/modules/agentnetwork/handlers/handlers_test.go
 create mode 100644 management/internals/modules/agentnetwork/handlers/policies_handler.go
 create mode 100644 management/internals/modules/agentnetwork/handlers/providers_handler.go
 create mode 100644 management/internals/modules/agentnetwork/handlers/settings_handler.go
 create mode 100644 management/internals/modules/agentnetwork/labelgen/labelgen.go
 create mode 100644 management/internals/modules/agentnetwork/labelgen/labelgen_test.go
 create mode 100644 management/internals/modules/agentnetwork/labelgen/words.go
 create mode 100644 management/internals/modules/agentnetwork/manager.go
 create mode 100644 management/internals/modules/agentnetwork/policyselect.go
 create mode 100644 management/internals/modules/agentnetwork/policyselect_account_realstore_test.go
 create mode 100644 management/internals/modules/agentnetwork/policyselect_realstore_test.go
 create mode 100644 management/internals/modules/agentnetwork/policyselect_test.go
 create mode 100644 management/internals/modules/agentnetwork/reconcile.go
 create mode 100644 management/internals/modules/agentnetwork/reconcile_test.go
 create mode 100644 management/internals/modules/agentnetwork/synthesizer.go
 create mode 100644 management/internals/modules/agentnetwork/synthesizer_guardrail_realstore_test.go
 create mode 100644 management/internals/modules/agentnetwork/synthesizer_log_collection_realstore_test.go
 create mode 100644 management/internals/modules/agentnetwork/synthesizer_parser_redact_realstore_test.go
 create mode 100644 management/internals/modules/agentnetwork/synthesizer_realstore_test.go
 create mode 100644 management/internals/modules/agentnetwork/synthesizer_test.go
 create mode 100644 management/internals/modules/agentnetwork/types/accesslog.go
 create mode 100644 management/internals/modules/agentnetwork/types/accesslogfilter.go
 create mode 100644 management/internals/modules/agentnetwork/types/budgetrule.go
 create mode 100644 management/internals/modules/agentnetwork/types/consumption.go
 create mode 100644 management/internals/modules/agentnetwork/types/consumption_test.go
 create mode 100644 management/internals/modules/agentnetwork/types/guardrail.go
 create mode 100644 management/internals/modules/agentnetwork/types/policy.go
 create mode 100644 management/internals/modules/agentnetwork/types/provider.go
 create mode 100644 management/internals/modules/agentnetwork/types/settings.go
 create mode 100644 management/internals/modules/agentnetwork/types/usage.go
 create mode 100644 management/internals/modules/agentnetwork/types/usageoverview.go
 create mode 100644 management/internals/modules/agentnetwork/wire_shape_test.go
 create mode 100644 management/server/affectedpeers/proxy_synth_test.go
 create mode 100644 management/server/agentnetwork_budgetrule_realstack_test.go
 create mode 100644 management/server/agentnetwork_proxypeer_restart_test.go
 create mode 100644 management/server/agentnetwork_realstack_test.go
 create mode 100644 management/server/store/sql_store_agentnetwork.go
 create mode 100644 management/server/store/sql_store_agentnetwork_accesslog_test.go
 create mode 100644 management/server/store/sql_store_agentnetwork_budgetrule_test.go
 create mode 100644 management/server/store/store_mock_agentnetwork.go
 create mode 100644 proxy/internal/accesslog/middleware_test.go
 create mode 100644 proxy/internal/llm/anthropic.go
 create mode 100644 proxy/internal/llm/anthropic_test.go
 create mode 100644 proxy/internal/llm/bedrock.go
 create mode 100644 proxy/internal/llm/bedrock_test.go
 create mode 100644 proxy/internal/llm/errors.go
 create mode 100644 proxy/internal/llm/fixtures/anthropic_messages.json
 create mode 100644 proxy/internal/llm/fixtures/anthropic_stream.txt
 create mode 100644 proxy/internal/llm/fixtures/openai_chat_completion.json
 create mode 100644 proxy/internal/llm/fixtures/openai_responses.json
 create mode 100644 proxy/internal/llm/fixtures/openai_responses_stream.txt
 create mode 100644 proxy/internal/llm/fixtures/openai_stream.txt
 create mode 100644 proxy/internal/llm/fixtures/pricing.yaml
 create mode 100644 proxy/internal/llm/openai.go
 create mode 100644 proxy/internal/llm/openai_test.go
 create mode 100644 proxy/internal/llm/parser.go
 create mode 100644 proxy/internal/llm/parser_test.go
 create mode 100644 proxy/internal/llm/pricing/defaults_coverage_test.go
 create mode 100644 proxy/internal/llm/pricing/defaults_pricing.yaml
 create mode 100644 proxy/internal/llm/pricing/pricing.go
 create mode 100644 proxy/internal/llm/pricing/pricing_other.go
 create mode 100644 proxy/internal/llm/pricing/pricing_test.go
 create mode 100644 proxy/internal/llm/pricing/pricing_unix.go
 create mode 100644 proxy/internal/llm/sse.go
 create mode 100644 proxy/internal/llm/sse_test.go
 create mode 100644 proxy/internal/middleware/bodypolicy.go
 create mode 100644 proxy/internal/middleware/bodytap/request.go
 create mode 100644 proxy/internal/middleware/bodytap/response.go
 create mode 100644 proxy/internal/middleware/bodytap/routing_scan_test.go
 create mode 100644 proxy/internal/middleware/builtin/agentnetwork_chain_integration_test.go
 create mode 100644 proxy/internal/middleware/builtin/all_test.go
 create mode 100644 proxy/internal/middleware/builtin/builtin.go
 create mode 100644 proxy/internal/middleware/builtin/cost_meter/factory.go
 create mode 100644 proxy/internal/middleware/builtin/cost_meter/middleware.go
 create mode 100644 proxy/internal/middleware/builtin/cost_meter/middleware_test.go
 create mode 100644 proxy/internal/middleware/builtin/llm_guardrail/factory.go
 create mode 100644 proxy/internal/middleware/builtin/llm_guardrail/middleware.go
 create mode 100644 proxy/internal/middleware/builtin/llm_guardrail/middleware_test.go
 create mode 100644 proxy/internal/middleware/builtin/llm_guardrail/redact.go
 create mode 100644 proxy/internal/middleware/builtin/llm_guardrail/redact_test.go
 create mode 100644 proxy/internal/middleware/builtin/llm_identity_inject/factory.go
 create mode 100644 proxy/internal/middleware/builtin/llm_identity_inject/middleware.go
 create mode 100644 proxy/internal/middleware/builtin/llm_identity_inject/middleware_test.go
 create mode 100644 proxy/internal/middleware/builtin/llm_limit_check/factory.go
 create mode 100644 proxy/internal/middleware/builtin/llm_limit_check/middleware.go
 create mode 100644 proxy/internal/middleware/builtin/llm_limit_check/middleware_test.go
 create mode 100644 proxy/internal/middleware/builtin/llm_limit_record/factory.go
 create mode 100644 proxy/internal/middleware/builtin/llm_limit_record/middleware.go
 create mode 100644 proxy/internal/middleware/builtin/llm_limit_record/middleware_test.go
 create mode 100644 proxy/internal/middleware/builtin/llm_request_parser/bedrock_test.go
 create mode 100644 proxy/internal/middleware/builtin/llm_request_parser/factory.go
 create mode 100644 proxy/internal/middleware/builtin/llm_request_parser/middleware.go
 create mode 100644 proxy/internal/middleware/builtin/llm_request_parser/middleware_test.go
 create mode 100644 proxy/internal/middleware/builtin/llm_response_parser/factory.go
 create mode 100644 proxy/internal/middleware/builtin/llm_response_parser/gzip_test.go
 create mode 100644 proxy/internal/middleware/builtin/llm_response_parser/middleware.go
 create mode 100644 proxy/internal/middleware/builtin/llm_response_parser/middleware_test.go
 create mode 100644 proxy/internal/middleware/builtin/llm_response_parser/responses_stream_test.go
 create mode 100644 proxy/internal/middleware/builtin/llm_response_parser/streaming.go
 create mode 100644 proxy/internal/middleware/builtin/llm_response_parser/streaming_bedrock.go
 create mode 100644 proxy/internal/middleware/builtin/llm_response_parser/streaming_bedrock_test.go
 create mode 100644 proxy/internal/middleware/builtin/llm_response_parser/streaming_test.go
 create mode 100644 proxy/internal/middleware/builtin/llm_router/factory.go
 create mode 100644 proxy/internal/middleware/builtin/llm_router/middleware.go
 create mode 100644 proxy/internal/middleware/builtin/llm_router/middleware_test.go
 create mode 100644 proxy/internal/middleware/builtin/llm_router/path_routed_test.go
 create mode 100644 proxy/internal/middleware/chain.go
 create mode 100644 proxy/internal/middleware/chain_test.go
 create mode 100644 proxy/internal/middleware/decision.go
 create mode 100644 proxy/internal/middleware/dispatcher.go
 create mode 100644 proxy/internal/middleware/headerpolicy.go
 create mode 100644 proxy/internal/middleware/keys.go
 create mode 100644 proxy/internal/middleware/manager.go
 create mode 100644 proxy/internal/middleware/metadata.go
 create mode 100644 proxy/internal/middleware/metrics.go
 create mode 100644 proxy/internal/middleware/middleware.go
 create mode 100644 proxy/internal/middleware/redaction.go
 create mode 100644 proxy/internal/middleware/registry.go
 create mode 100644 proxy/internal/middleware/spec.go
 create mode 100644 proxy/internal/middleware/types.go
 create mode 100644 proxy/internal/proxy/agent_network_chain_realstack_test.go
 create mode 100644 proxy/internal/proxy/strip_prefix_test.go
 create mode 100644 proxy/internal/tcp/accept.go
 create mode 100644 proxy/internal/tcp/accept_test.go
 create mode 100644 proxy/middleware_register.go
 create mode 100644 proxy/middleware_translate.go
 create mode 100644 proxy/middleware_translate_test.go

diff --git a/.github/workflows/agent-network-e2e.yml b/.github/workflows/agent-network-e2e.yml
new file mode 100644
index 000000000..c041bfbfa
--- /dev/null
+++ b/.github/workflows/agent-network-e2e.yml
@@ -0,0 +1,69 @@
+name: Agent Network E2E
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  e2e:
+    name: Agent Network E2E
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Install Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version-file: "go.mod"
+
+      # Container-driver builder so the harness can build the combined/proxy/
+      # client images from source with a local layer cache.
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+
+      # Persist the Docker layer cache across runs. This caches the base, apt,
+      # and go-mod-download layers; the Go compile still re-runs, as BuildKit
+      # mount caches cannot be exported to the GitHub cache.
+      - name: Cache Docker layers
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-anet-e2e-buildx-${{ hashFiles('go.sum', 'combined/Dockerfile.multistage', 'proxy/Dockerfile.multistage', 'e2e/harness/Dockerfile.client') }}
+          restore-keys: |
+            ${{ runner.os }}-anet-e2e-buildx-
+
+      - name: Run agent-network e2e
+        env:
+          # Build the images from source (this branch's code) with the shared
+          # local layer cache.
+          NB_E2E_BUILDX_CACHE: /tmp/.buildx-cache
+          # Provider credentials. Each provider scenario skips if its
+          # token (and URL, for gateways) is unset, so partial coverage is fine.
+          OPENAI_TOKEN: ${{ secrets.E2E_OPENAI_TOKEN }}
+          ANTHROPIC_TOKEN: ${{ secrets.E2E_ANTHROPIC_TOKEN }}
+          VERCEL_URL: ${{ secrets.E2E_VERCEL_URL }}
+          VERCEL_TOKEN: ${{ secrets.E2E_VERCEL_TOKEN }}
+          OPENROUTER_URL: ${{ secrets.E2E_OPENROUTER_URL }}
+          OPENROUTER_TOKEN: ${{ secrets.E2E_OPENROUTER_TOKEN }}
+          CLOUDFLARE_URL: ${{ secrets.E2E_CLOUDFLARE_URL }}
+          CLOUDFLARE_TOKEN: ${{ secrets.E2E_CLOUDFLARE_TOKEN }}
+          AWS_BEARER_TOKEN_BEDROCK: ${{ secrets.E2E_AWS_BEARER_TOKEN_BEDROCK }}
+          AWS_REGION: ${{ secrets.E2E_AWS_REGION }}
+          # Vertex (Anthropic-on-Vertex): SA + project required; region defaults
+          # to "global", model to a pinned claude snapshot.
+          GOOGLE_VERTEX_SA_BASE64: ${{ secrets.E2E_GOOGLE_VERTEX_SA_BASE64 }}
+          GOOGLE_VERTEX_PROJECT: ${{ secrets.E2E_GOOGLE_VERTEX_PROJECT }}
+          GOOGLE_VERTEX_REGION: ${{ secrets.E2E_GOOGLE_VERTEX_REGION }}
+          GOOGLE_VERTEX_MODEL: ${{ secrets.E2E_GOOGLE_VERTEX_MODEL }}
+        run: go test -tags e2e -timeout 40m -v ./e2e/...
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index 5d26d678d..511e54b62 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -21,7 +21,7 @@ jobs:
       - name: codespell
         uses: codespell-project/actions-codespell@8f01853be192eb0f849a5c7d721450e7a467c579 # v2.2
         with:
-          ignore_words_list: erro,clienta,hastable,iif,groupd,testin,groupe,cros,ans,deriver,te,userA,ede,additionals
+          ignore_words_list: erro,clienta,hastable,iif,groupd,testin,groupe,cros,ans,deriver,te,userA,ede,additionals,flate,recordin,unparseable
           skip: go.mod,go.sum,**/proxy/web/**
   golangci:
     strategy:
diff --git a/combined/Dockerfile.multistage b/combined/Dockerfile.multistage
index ef3d68c6e..79746819d 100644
--- a/combined/Dockerfile.multistage
+++ b/combined/Dockerfile.multistage
@@ -5,12 +5,16 @@ WORKDIR /app
 RUN apt-get update && apt-get install -y gcc libc6-dev git && rm -rf /var/lib/apt/lists/*
 
 COPY go.mod go.sum ./
-RUN go mod download
+RUN --mount=type=cache,target=/go/pkg/mod go mod download
 
 COPY . .
 
-# Build with version info from git (matching goreleaser ldflags)
-RUN CGO_ENABLED=1 GOOS=linux go build \
+# Build with version info from git (matching goreleaser ldflags).
+# BuildKit cache mounts persist the module + build caches across image builds,
+# so a source change recompiles incrementally instead of from scratch.
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    CGO_ENABLED=1 GOOS=linux go build \
     -ldflags="-s -w \
     -X github.com/netbirdio/netbird/version.version=$(git describe --tags --always --dirty 2>/dev/null || echo 'dev') \
     -X main.commit=$(git rev-parse --short HEAD 2>/dev/null || echo 'unknown') \
diff --git a/docs/agent-networks/00-overview.md b/docs/agent-networks/00-overview.md
new file mode 100644
index 000000000..0d76e44a0
--- /dev/null
+++ b/docs/agent-networks/00-overview.md
@@ -0,0 +1,109 @@
+# Agent Networks — overview
+
+Single-entry point. Feature scope, the module map, and the cross-cutting
+topics worth keeping in mind, with links into every per-module guide.
+
+## TL;DR
+
+Agent Networks introduces an **LLM-aware reverse-proxy middleware system**
+plus **account-level controls** (budget rules, log collection toggles,
+PII redaction). The management server synthesises a per-peer middleware
+chain that the proxy executes on every LLM request; the chain enforces
+quotas, injects identity, redacts PII, parses tokens/cost, and emits
+access-log entries. The dashboard exposes the surface as a single **AI
+Observability** page with four tabs.
+
+- **Backend** lives in this repo, primarily under
+  `management/server/agentnetwork`, `proxy/internal/middleware`, and
+  `proxy/internal/llm`, with wire contracts in `shared/management`.
+- **Dashboard** lives in the dashboard repo under
+  `src/modules/agent-network/` and `src/app/(dashboard)/agent-network/`.
+
+## Reading order
+
+| # | Doc | Why |
+|---|-----|-----|
+| 1 | [01-end-to-end-flows.md](01-end-to-end-flows.md) | Get the three big diagrams in your head first. |
+| 2 | [modules/10-shared-api.md](modules/10-shared-api.md) | Wire contracts — every other module either produces or consumes these. |
+| 3 | [modules/21-management-agentnetwork.md](modules/21-management-agentnetwork.md) | The largest module; everything the proxy executes originates here. |
+| 4 | [modules/30-proxy-middleware-framework.md](modules/30-proxy-middleware-framework.md) | The generic plugin system on the proxy side. |
+| 5 | [modules/31-proxy-middleware-builtin.md](modules/31-proxy-middleware-builtin.md) | The 8 LLM middlewares that ride on the framework. |
+| 6 | Everything else in any order. | |
+
+## Module map
+
+11 modules. Each is described in detail in its own file under
+[`modules/`](modules/).
+
+| # | Module | Risk | BC impact |
+|---|--------|------|-----------|
+| 10 | [shared/api](modules/10-shared-api.md) — proto + OpenAPI | Low | Additive only |
+| 20 | [management/store](modules/20-management-store.md) — SQL persistence | Medium | Auto-migrate (additive) |
+| 21 | [management/agentnetwork](modules/21-management-agentnetwork.md) — domain layer + synthesizer | **High** | Additive |
+| 22 | [management/handlers + wiring](modules/22-management-handlers-wiring.md) — HTTP API + gRPC delivery | Medium | Additive |
+| 30 | [proxy/middleware-framework](modules/30-proxy-middleware-framework.md) — generic plugin system | High | Additive |
+| 31 | [proxy/middleware-builtin](modules/31-proxy-middleware-builtin.md) — 8 LLM middlewares | High | Additive |
+| 32 | [proxy/llm-parsers](modules/32-proxy-llm-parsers.md) — SDK adapters + pricing | Medium | Additive |
+| 33 | [proxy/runtime](modules/33-proxy-runtime.md) — translate + serve + access-log | High | Additive (touches hot path) |
+| 40 | [dashboard](modules/40-dashboard.md) — UI for everything above | Medium | Sidebar reshape |
+| 50 | [path-routed-providers](modules/50-path-routed-providers.md) — Vertex AI + Bedrock | Medium | Additive (new catalog entries) |
+
+The largest and highest-risk module is `management/agentnetwork`: it is
+the single writer of the middleware chain the proxy executes.
+
+## Cross-cutting topics
+
+These are the items most likely to bite production. Each is fully
+documented in the linked module guide.
+
+1. **Capture-pointer semantics** (`*bool` for `capture_prompt` and
+   `capture_completion`): nil = legacy emit, false = suppress, true =
+   emit. nil-vs-false must be handled at every JSON hop. See
+   [21-management-agentnetwork.md](modules/21-management-agentnetwork.md)
+   and [31-proxy-middleware-builtin.md](modules/31-proxy-middleware-builtin.md).
+2. **`ProxyMapping.Private` preservation** on per-proxy live updates.
+   Failure mode: `auth` skips `ValidateTunnelPeer` →
+   `CapturedData.UserGroups` empty → `llm_router` denies. See
+   [33-proxy-runtime.md](modules/33-proxy-runtime.md).
+3. **respInput carrying `UserEmail`/`UserGroups`/`UserGroupNames` onto
+   the response leg** in `reverseproxy.go`. Load-bearing wire that lets
+   `llm_limit_record` ship non-empty `group_ids` on `RecordLLMUsage`. See
+   [33-proxy-runtime.md](modules/33-proxy-runtime.md).
+4. **Min-wins all-must-pass budget rule semantics**. Every matching
+   rule's remaining quota must be > 0 for the request to proceed; one
+   exhausted rule blocks the whole call. Documented in
+   [21-management-agentnetwork.md](modules/21-management-agentnetwork.md)
+   and the `llm_limit_check` middleware in
+   [31-proxy-middleware-builtin.md](modules/31-proxy-middleware-builtin.md).
+5. **body-tap memory bounds**: per-direction 1 MiB cap, shared 256 MiB
+   budget, `LimitReader(r.Body, limit+1)` for truncation detection with
+   `replayReadCloser` fallback so upstream still sees the full body.
+   `cloneInputFor` deep-copies the body up to 16 times per chain — a
+   perf hot-spot. See
+   [30-proxy-middleware-framework.md](modules/30-proxy-middleware-framework.md).
+6. **UpstreamRewrite.AuthHeader bypasses the header denylist**
+   deliberately. The runtime consumer only unpacks it via the
+   trusted upstream-build path. See
+   [30-proxy-middleware-framework.md](modules/30-proxy-middleware-framework.md).
+7. **`disable_access_log` default-false semantics**: the synth target
+   sets it true, all other targets leave it false. See
+   [10-shared-api.md](modules/10-shared-api.md).
+8. **String-typed `decision` / `deny_code`** on
+   `CheckLLMPolicyLimitsResponse` — would benefit from enum pinning
+   before external consumers integrate. See
+   [10-shared-api.md](modules/10-shared-api.md).
+
+## Explicit non-goals
+
+- **Reaper / GC pass over stale synth services** — designed but cut from
+  scope.
+- **URL-sync for tab state on AI Observability** — read path is wired
+  (`?tab=`) but write path isn't. Future work.
+- **CI golden-file regen-and-diff for `types.gen.go` /
+  `proxy_service.pb.go`** — would catch codegen drift; not yet in place.
+
+## Where to read the code
+
+Per-module file scopes are listed in each module guide. Behaviour is
+covered by Go tests co-located with each package (and an end-to-end
+chain integration test under `proxy/internal/proxy`).
diff --git a/docs/agent-networks/01-end-to-end-flows.md b/docs/agent-networks/01-end-to-end-flows.md
new file mode 100644
index 000000000..7264f3768
--- /dev/null
+++ b/docs/agent-networks/01-end-to-end-flows.md
@@ -0,0 +1,217 @@
+# End-to-end flows
+
+Three cross-module mermaid diagrams. Each per-module guide repeats the
+slice that's relevant to its own scope — these are the canonical
+top-down views.
+
+- [Flow A — Config → runtime (synth + deliver)](#flow-a--config--runtime-synth--deliver)
+- [Flow B — Request lifecycle through the LLM chain](#flow-b--request-lifecycle-through-the-llm-chain)
+- [Flow C — Budget rule feedback loop](#flow-c--budget-rule-feedback-loop)
+
+---
+
+## Flow A — Config → runtime (synth + deliver)
+
+How an operator's change to a Provider, Policy, Guardrail, Budget Rule,
+or Settings record ends up as live middleware on a peer's proxy.
+
+```mermaid
+sequenceDiagram
+    autonumber
+    actor Op as Operator
+    participant UI as Dashboard
+    participant HTTP as management/handlers
+    participant Mgr as agentnetwork.Manager
+    participant Store as management/store (SQL)
+    participant Ctl as network_map.Controller
+    participant Synth as agentnetwork.SynthesizeServices
+    participant Grpc as management gRPC
+    participant Proxy as netbird-proxy
+    participant Xlate as middleware_translate
+    participant Chain as middleware.Chain
+
+    Op->>UI: edit provider/policy/budget/settings
+    UI->>HTTP: REST PUT/POST /api/agent-network/*
+    HTTP->>Mgr: SaveProvider / SavePolicy / SaveBudgetRule / SaveSettings
+    Mgr->>Store: persist (gorm)
+    Mgr-->>Ctl: account change event (Network-Map dirty)
+    loop per connected peer
+        Ctl->>Synth: SynthesizeServices(ctx, store, accountID)
+        Synth->>Store: load providers, policies, guardrails, budget rules, settings
+        Synth-->>Synth: build per-peer Service list
+        Note over Synth: each Service has a middleware<br/>chain with capture_prompt /<br/>capture_completion / redact_pii<br/>baked from account settings
+        Synth-->>Ctl: []rpservice.Service
+        Ctl->>Grpc: NetworkMap push (services + middleware configs)
+    end
+    Grpc-->>Proxy: NetworkMap stream
+    Proxy->>Xlate: translate proto MiddlewareConfig → runtime Spec
+    Xlate->>Chain: register / replace per-service chain
+    Note over Chain: chain replacement is live<br/>(no proxy restart, in-flight<br/>requests unaffected)
+```
+
+**Notes on the diagram**
+
+- The `network_map.Controller` synthesises on every push, not on a
+  timer. A single config change costs O(connected peers × policies ×
+  providers) per push. See [`modules/22-management-handlers-wiring.md`](modules/22-management-handlers-wiring.md).
+- `SynthesizeServices` is the single source of truth for the wire
+  format the proxy executes. Anything the proxy does that the
+  synthesiser didn't request is a bug. See
+  [`modules/21-management-agentnetwork.md`](modules/21-management-agentnetwork.md).
+- The translate step (step 13) is the only place that knows the
+  middleware-ID strings on the proxy side. It must reject unknown IDs;
+  silently dropping middlewares would create a security gap (e.g.
+  missing `llm_limit_check` ⇒ unbounded spend). See
+  [`modules/33-proxy-runtime.md`](modules/33-proxy-runtime.md).
+
+---
+
+## Flow B — Request lifecycle through the LLM chain
+
+What happens when an agent on the client peer sends a chat-completion /
+messages request through the synthesised reverse-proxy.
+
+```mermaid
+sequenceDiagram
+    autonumber
+    actor Agent as Agent (local)
+    participant Px as netbird-proxy
+    participant Auth as auth middleware
+    participant Map as service-mapping
+    participant Req as llm_request_parser
+    participant Rt as llm_router
+    participant Chk as llm_limit_check
+    participant Inj as llm_identity_inject
+    participant Grd as llm_guardrail
+    participant Up as upstream LLM
+    participant Resp as llm_response_parser
+    participant Cost as cost_meter
+    participant Rec as llm_limit_record
+    participant Log as access-log
+    participant MgmtGrpc as management gRPC
+
+    Agent->>Px: POST /v1/chat/completions  (OpenAI / Anthropic)
+    Px->>Auth: identify peer (user, groups)
+    Auth->>Map: resolve service from Host + path
+    Map-->>Req: dispatch chain in slot order
+
+    Req->>Req: parse body → provider, model, prompt, token estimate
+    Note over Req: capture_prompt gates raw_prompt<br/>capture (nil = legacy emit,<br/>false = drop, true = emit)
+    Req->>Rt: pass metadata
+    Rt->>Chk: route to upstream candidate
+
+    Chk->>MgmtGrpc: CheckLLMPolicyLimits(provider, model, est_tokens, groups, user)
+    MgmtGrpc-->>Chk: decision = allow / deny + deny_code
+    alt decision == deny
+        Chk-->>Log: emit access-log with deny_code<br/>(if EnableLogCollection)
+        Chk-->>Agent: 429 (or 403 per deny_code)
+    else decision == allow
+        Chk->>Inj: continue
+        Inj->>Inj: inject NetBird identity headers per provider config
+        Inj->>Grd: continue
+        Grd->>Grd: enforce model allowlist
+        Grd->>Up: forward (over WireGuard)
+        Up-->>Resp: response (JSON or SSE stream)
+        Resp->>Resp: parse usage tokens, completion
+        Note over Resp: capture_completion gates raw<br/>completion capture
+        Resp->>Cost: tokens
+        Cost->>Cost: lookup pricing.yaml + compute cost
+        Cost->>Rec: tokens + cost
+        Rec->>MgmtGrpc: RecordLLMUsage(provider, model, prompt_t, completion_t, cost, groups, user)
+        Rec-->>Log: emit access-log entry<br/>(if EnableLogCollection)
+        Log-->>Agent: 200 + body (streamed if SSE)
+    end
+```
+
+**Notes on the diagram**
+
+- The chain runs in synth-defined order. Re-ordering middlewares
+  changes invariants — `llm_limit_check` must precede `llm_router` so
+  a denied request never hits upstream, and `llm_limit_record` must
+  pair with `llm_limit_check` so a successful check is always recorded
+  (or the rate-limit semantics break). See
+  [`modules/31-proxy-middleware-builtin.md`](modules/31-proxy-middleware-builtin.md).
+- `llm_guardrail` is also where PII redaction happens
+  (`redact_pii = settings.RedactPii`). Phones, emails, credit cards,
+  PII names — see `redact.go` for the full set. See
+  [`modules/31-proxy-middleware-builtin.md`](modules/31-proxy-middleware-builtin.md).
+- SSE streaming requires special handling on the response side; the
+  parser must handle partial chunks without buffering the whole
+  stream. See [`modules/32-proxy-llm-parsers.md`](modules/32-proxy-llm-parsers.md).
+- Access-log emission is gated on `settings.EnableLogCollection`. With
+  it OFF, neither the deny nor the allow leg writes an entry — the
+  chain still runs (budget rules are still enforced) but no audit trail
+  is kept. See
+  [`modules/33-proxy-runtime.md`](modules/33-proxy-runtime.md).
+
+---
+
+## Flow C — Budget rule feedback loop
+
+How an account's budget rules tighten ceilings on every request and how
+consumption flows back into the dashboard.
+
+```mermaid
+flowchart LR
+    subgraph Operator
+      DashBud[Dashboard Budget Settings tab]
+    end
+    subgraph Mgmt[Management]
+      Save[POST/PUT /api/agent-network/budget-rules]
+      Store[(SQL store)]
+      Synth[SynthesizeServices]
+      Check[CheckLLMPolicyLimits RPC]
+      Rec[RecordLLMUsage RPC]
+      Cons[/api/agent-network/consumption]
+    end
+    subgraph Proxy[Proxy]
+      Chk[llm_limit_check]
+      RecMw[llm_limit_record]
+    end
+    subgraph DashView[Dashboard Budget Dashboard tab]
+      Panel[AgentConsumptionPanel]
+    end
+
+    DashBud -->|create / update rules| Save
+    Save --> Store
+    Store --> Synth
+    Synth -->|push synth-services to peer| Proxy
+
+    Chk -->|per request| Check
+    Check -->|aggregate matching rules<br/>min-wins all-must-pass| Store
+    Check -->|allow / deny| Chk
+
+    RecMw -->|post-response| Rec
+    Rec -->|tokens + cost + groups + user| Store
+
+    Store -->|read counters| Cons
+    Cons --> Panel
+```
+
+**Notes on the diagram**
+
+- **min-wins all-must-pass** is the core semantic. A budget rule binds
+  to (group set, user set) with a (window, ceiling). At check time,
+  every rule that matches the caller is evaluated; if ANY rule has
+  zero remaining quota the request is denied. This is the most
+  surprising semantic for operators — see the invariants section of
+  [`modules/21-management-agentnetwork.md`](modules/21-management-agentnetwork.md).
+- The proxy never makes its own budget decisions. It always asks
+  management via `CheckLLMPolicyLimits` and reports back via
+  `RecordLLMUsage`. This keeps account-wide accounting in one place
+  and avoids per-proxy drift.
+- `RecordLLMUsage` must carry `group_ids` and `user_id` so the
+  decrement hits the right rule(s). The wire that carries those
+  fields onto the response leg is `respInput` in `reverseproxy.go`. See
+  [`modules/33-proxy-runtime.md`](modules/33-proxy-runtime.md).
+- The dashboard's Budget Dashboard tab polls
+  `/api/agent-network/consumption` — not gRPC, not WebSocket. Poll
+  interval lives in `AgentConsumptionPanel.tsx`. See
+  [`modules/40-dashboard.md`](modules/40-dashboard.md).
+
+---
+
+## Cross-references
+
+- Per-module guides: [`modules/`](modules/)
+- Overview + module map: [`00-overview.md`](00-overview.md)
diff --git a/docs/agent-networks/README.md b/docs/agent-networks/README.md
new file mode 100644
index 000000000..a7d2d2ab5
--- /dev/null
+++ b/docs/agent-networks/README.md
@@ -0,0 +1,66 @@
+# Agent Networks — architecture documentation
+
+A self-contained set of documents describing the agent-networks feature:
+an LLM-aware reverse-proxy middleware system plus account-level controls
+(budget rules, log collection toggles, PII redaction). The management
+server synthesises a per-peer middleware chain that the proxy executes on
+every LLM request.
+
+## What to read first
+
+1. **[00-overview.md](00-overview.md)** — the single entry point. Feature
+   scope, the module map, and the cross-cutting topics worth keeping in
+   mind, with links to every per-module guide.
+2. **[01-end-to-end-flows.md](01-end-to-end-flows.md)** — three
+   high-level mermaid diagrams: config-to-runtime synth/delivery,
+   per-request lifecycle through the LLM chain, and the budget-rule
+   feedback loop.
+3. **Per-module guides** under `modules/` — one file per package. Each
+   describes the module boundary, the file-level layout, its own flow
+   diagrams, the public contracts, the invariants it relies on, and the
+   areas worth the closest attention.
+
+## Directory layout
+
+```
+docs/agent-networks/
+├── README.md                              # you are here
+├── 00-overview.md                         # feature summary + module map
+├── 01-end-to-end-flows.md                 # cross-module mermaid diagrams
+└── modules/
+    ├── 10-shared-api.md                   # proto + OpenAPI wire contracts
+    ├── 20-management-store.md             # SQL persistence layer
+    ├── 21-management-agentnetwork.md      # domain layer + synthesizer (largest)
+    ├── 22-management-handlers-wiring.md   # HTTP API + gRPC delivery
+    ├── 30-proxy-middleware-framework.md   # generic plugin system
+    ├── 31-proxy-middleware-builtin.md     # 8 LLM-aware middlewares
+    ├── 32-proxy-llm-parsers.md            # OpenAI/Anthropic/Bedrock SDKs + pricing
+    ├── 33-proxy-runtime.md                # translate + serve + access-log
+    ├── 40-dashboard.md                    # UI for everything above (lives in the dashboard repo)
+    └── 50-path-routed-providers.md        # Vertex AI + Bedrock (path-routed, keyfile:: creds, /bedrock prefix)
+```
+
+The `40-dashboard.md` module documents code that lives in the **dashboard
+repo**, not in this repo. The guide is co-located here so backend readers
+see the full picture in one place.
+
+## How the per-module guides are structured
+
+Every `modules/*.md` follows the same template so the docs are easy to
+scan:
+
+- **Module boundary** — what this package owns; where it sits in the stack.
+- **Files** — path / role.
+- **Architecture & flow** — one or more mermaid diagrams.
+- **Public contracts** — function signatures, gRPC messages, JSON shapes.
+- **Invariants** — semantic guarantees the module relies on or enforces.
+- **Things to scrutinize** — split by correctness / security /
+  concurrency / backward-compat / performance / observability.
+- **Test coverage** — the test files that lock down behaviour in this
+  module.
+- **Known limitations / non-goals** — what is intentionally out of scope.
+- **Cross-references** — upstream/downstream module links + the
+  end-to-end flow + the overview.
+
+See [00-overview.md](00-overview.md) for the module map and the
+cross-cutting topics.
diff --git a/docs/agent-networks/modules/10-shared-api.md b/docs/agent-networks/modules/10-shared-api.md
new file mode 100644
index 000000000..532927b90
--- /dev/null
+++ b/docs/agent-networks/modules/10-shared-api.md
@@ -0,0 +1,105 @@
+# shared/api — wire contracts (proto + OpenAPI)
+
+> **Risk level:** Medium — wire-format surface that every other module pins against; backward-compat hinges on field-number discipline more than on logic correctness.
+> **Backward-compat impact:** Additive only (new proto fields use unallocated numbers, new RPCs default to `Unimplemented`, new OpenAPI schemas/paths are append-only; no existing field/RPC/schema removed or renumbered).
+
+## Module boundary
+This module owns the cross-process contract surface between management, proxy, and dashboard. Two artefacts: `shared/management/proto/proxy_service.proto` (management↔proxy gRPC) and `shared/management/http/api/openapi.yml` (dashboard/CLI↔management REST). Both have generated companions checked in (`proxy_service.pb.go`, `proxy_service_grpc.pb.go`, `types.gen.go`) which must travel in lockstep with their sources. `shared/management/status/error.go` is in scope only for the four new typed `NotFound` constructors that the new HTTP handlers return.
+
+Everything downstream — `management/agentnetwork`, `management/server/http/handlers/*`, `proxy/internal/*`, the dashboard SDK — consumes these types verbatim. The concern here is wire stability and codegen reproducibility, not behaviour: behaviour is covered in the management and proxy module guides.
+
+`management.proto` and `signalexchange.proto` are unchanged. `status/error.go` only receives four additive constructors (lines 208-227); no existing error types are reshaped.
+
+## Files
+| Path | Role |
+| ---- | ---- |
+| `shared/management/proto/proxy_service.proto` | Source of truth: 2 new RPCs, 1 new message group (`MiddlewareConfig` + slot enum), additive fields on `PathTargetOptions`, `AccessLog`, `RecordLLMUsageRequest` |
+| `shared/management/proto/proxy_service.pb.go` | Generated (protoc-gen-go) |
+| `shared/management/proto/proxy_service_grpc.pb.go` | Generated; adds `CheckLLMPolicyLimits` + `RecordLLMUsage` client/server stubs and `UnimplementedProxyServiceServer` defaults |
+| `shared/management/http/api/openapi.yml` | 15 new `AgentNetwork*` schemas, 9 new path groups under `/api/agent-network/*` |
+| `shared/management/http/api/types.gen.go` | Generated (oapi-codegen; see codegen note below) |
+| `shared/management/status/error.go` | Four `NotFound` constructors for the new resource kinds (lines 208-227) |
+
+## Architecture & flow
+```mermaid
+sequenceDiagram
+    participant Dash as Dashboard / CLI
+    participant Mgmt as management (HTTP+gRPC)
+    participant Px as proxy
+
+    Note over Dash,Mgmt: REST (OpenAPI / types.gen.go)
+    Dash->>Mgmt: PUT /api/agent-network/providers (AgentNetworkProviderRequest)
+    Dash->>Mgmt: PUT /api/agent-network/settings (AgentNetworkSettingsRequest)
+    Dash->>Mgmt: GET /api/agent-network/consumption -> [AgentNetworkConsumption]
+
+    Note over Mgmt,Px: gRPC ProxyService (proxy_service.proto)
+    Mgmt-->>Px: SyncMappingsResponse{ ProxyMapping.path[*].options.middlewares,<br/>agent_network, disable_access_log, capture_* }
+    Px->>Mgmt: CheckLLMPolicyLimits(account, user, groups, provider, model)
+    Mgmt-->>Px: decision=allow|deny + selected_policy_id + attribution_group_id + window_seconds
+    Px->>Mgmt: RecordLLMUsage(account, user, group_id, group_ids, window_seconds, tokens, cost)
+    Px->>Mgmt: SendAccessLog(AccessLog{ agent_network=true })
+```
+
+The proto changes split into three independent slices: (1) **mapping enrichment** — `PathTargetOptions` grows fields 8-13 so management can ship middleware configs, capture limits, and the agent-network / log-suppression flags down to the proxy without a second RPC; (2) **two new request/response RPCs** (`CheckLLMPolicyLimits`, `RecordLLMUsage`) for per-LLM-request budget arbitration; (3) **observability tag** — `AccessLog.agent_network` so management can route logs to the right surface.
+
+The OpenAPI side is a thin CRUD surface — every resource (`Provider`, `Policy`, `Guardrail`, `BudgetRule`, `Settings`) follows the same `GET-list / POST / GET / PUT / DELETE` pattern, plus a read-only `/consumption` listing and a catalog endpoint. The `*Request` variants drop server-controlled fields (id, timestamps). `AgentNetworkBudgetRule` deliberately reuses `AgentNetworkPolicyLimits` to keep wire-shape parity with policies.
+
+## Public contracts added
+- gRPC RPCs (`proxy_service.proto:52-57`): `CheckLLMPolicyLimits(CheckLLMPolicyLimitsRequest) → CheckLLMPolicyLimitsResponse`, `RecordLLMUsage(RecordLLMUsageRequest) → RecordLLMUsageResponse`. Both unary; default `UnimplementedProxyServiceServer` returns `codes.Unimplemented` (`proxy_service_grpc.pb.go:283-289`).
+- New messages (`proxy_service.proto:145-175,448-502`): `MiddlewareConfig`, `MiddlewareSlot` enum, `CheckLLMPolicyLimitsRequest`/`Response`, `RecordLLMUsageRequest`/`Response`.
+- New `PathTargetOptions` fields 8-13 (`proxy_service.proto:124-140`): `capture_max_request_bytes`, `capture_max_response_bytes`, `capture_content_types`, `middlewares`, `agent_network`, `disable_access_log`. All default-false / zero; pre-existing fields 1-7 byte-for-byte unchanged.
+- `AccessLog.agent_network = 18` (`proxy_service.proto:258-261`).
+- `RecordLLMUsageRequest.group_ids = 8` (`proxy_service.proto:496-498`) — so the record path can fan out to every applicable budget rule's window without a re-lookup.
+- 15 new OpenAPI component schemas (`openapi.yml:5072-5829`): `AgentNetworkProvider[Request|Model]`, `AgentNetworkCatalog{Model,Provider,IdentityInjection,HeaderPairInjection,JSONMetadataInjection,ExtraHeader}`, `AgentNetworkPolicy[Request|TokenLimit|BudgetLimit|Limits]`, `AgentNetworkGuardrail[Checks|Request]`, `AgentNetworkConsumption`, `AgentNetworkSettings[Request]`, `AgentNetworkBudgetRule[Request]`.
+- 9 new path groups (`openapi.yml:12797-13460`): `/api/agent-network/{consumption,settings,budget-rules,budget-rules/{ruleId},catalog/providers,providers,providers/{providerId},policies,policies/{policyId},guardrails,guardrails/{guardrailId}}`.
+- Four typed NotFound errors (`shared/management/status/error.go:208-227`).
+
+## Invariants
+- **Field-number monotonicity.** Every new proto field uses a previously-unallocated number in its message: `PathTargetOptions` 8-13 (was 1-7), `AccessLog` 18 (was 1-17), `RecordLLMUsageRequest` 8. `SendStatusUpdateRequest.inbound_listener = 50` (pre-existing) reserves 50+ for observability extensions, so 8 on `RecordLLMUsageRequest` doesn't conflict.
+- **Old proxies stay compatible.** Old management never sends `disable_access_log`/`middlewares`/`agent_network` (zero value → existing behaviour); old proxies that don't decode these fields just drop them silently (proto3 unknown-field semantics) — log emission stays on. No pre-existing field number changed: the proto change is insertions only.
+- **Old management stays compatible.** The two new RPCs are registered on the same `management.ProxyService` descriptor; old proxies hitting them get `codes.Unimplemented` from the unimplemented embed (`proxy_service_grpc.pb.go:283-289`), which is the same fallback pattern `SyncMappings` already documents (`proxy_service.proto:20-21`).
+- **OpenAPI shapes are append-only.** New schemas are placed at the end of `components.schemas` (line 5072+); new paths at the end of `paths` (line 12797+). No existing schema's `required` list, enum, or property type was changed.
+- **`*Request` vs response asymmetry.** Read shapes (`AgentNetworkProvider`, `AgentNetworkPolicy`, `AgentNetworkGuardrail`, `AgentNetworkSettings`, `AgentNetworkBudgetRule`) require `created_at`/`updated_at`; the matching `*Request` shapes do not — server fills them. `AgentNetworkProviderRequest.api_key` is write-only (`openapi.yml:5158-5161` "never returned in responses"); reviewers should confirm the response schema (5072-5138) actually omits `api_key`.
+
+## Things to scrutinize
+### Correctness
+- `RecordLLMUsageRequest` carries both `group_id` (singular, the attribution group — field 3) and `group_ids` (plural, full membership — field 8). `b22d5a181` adds field 8 to drive account-budget fan-out; double-check that consumers can't accidentally key counters on the wrong one. Field comments at `proxy_service.proto:489-491` and `496-498` distinguish them but it's the kind of subtle thing a follow-up commit might collapse.
+- `PathTargetOptions.disable_access_log` is the only field whose default-false meaning **changes semantics** on the proxy side: false → log (status quo), true → suppress. Synthesizer sets `DisableAccessLog = !settings.EnableLogCollection`, so a missing/default settings row yields `EnableLogCollection=false → DisableAccessLog=true → suppressed`. Worth confirming downstream (`agentnetwork.synthesizer`) that operator-defined private services never inherit this flag — the proto field default protects them, but only if synth code is explicit.
+- `CheckLLMPolicyLimitsResponse.decision` is a free-form `string` (`proxy_service.proto:471`) rather than an enum. Only documented values are "allow" / "deny". An enum would prevent typo drift; consider before this RPC ships to external consumers.
+- `deny_code` (`proxy_service.proto:478-481`) is documented as "a stable label" but is also a free string. Pin the allowed set somewhere observable to the proxy.
+
+### Security
+- `AgentNetworkProvider.api_key` MUST be write-only. Schema split (request has it at line 5158; response omits it) looks correct, but a regression here leaks the upstream provider credential to every dashboard reader. Check that the handler explicitly zeros it on the response path.
+- `extra_values` / `identity_header_*` headers on `AgentNetworkProvider` get stamped onto upstream requests. Description at `openapi.yml:5099` says "values not declared by the catalog are ignored at synth time" — a contract this module documents but the synthesizer must enforce. Confirm the synth module honours it.
+- Cluster + subdomain on `AgentNetworkSettings` are documented immutable (`openapi.yml:5686-5694`) and the `AgentNetworkSettingsRequest` (lines 5733-5752) doesn't accept them. Verify the `PUT /api/agent-network/settings` handler can't be tricked by extra JSON keys (oapi-codegen's `additionalProperties: false` is not declared here; spec defaults to permissive).
+
+### Backward compatibility
+- The proto change is field-number additive: every previously numbered field keeps the same name + type, and the change is insertions only (no deletions in `proxy_service.proto`), so this holds at the source-text level.
+- `proxy_service_grpc.pb.go` adds two RPC handlers and registers them in `ProxyService_ServiceDesc.Methods` (lines 543-552). The existing entries are unchanged and order-preserving — gRPC method dispatch is name-keyed, so order doesn't matter, but reviewing the diff (no method renamed/dropped) is still worth a glance.
+- OpenAPI 3.0 doesn't have a built-in deprecation flow for paths; if any client tooling iterates `paths.*`, the additive routes shouldn't break it, but generated SDKs (especially the dashboard's) need a regen to gain access to `AgentNetwork*`.
+
+### Codegen pinning
+- `generate.sh` (`shared/management/http/api/generate.sh:14`) installs `oapi-codegen@latest` rather than a pinned version. **This is a reproducibility gap** — re-running the script later may produce a different `types.gen.go`. Either pin the version in `generate.sh` (e.g. `@v2.7.0`) or document the pin in a `tools.go`.
+- proto codegen has the protoc / protoc-gen-go version stamped in the generated file header (`proxy_service.pb.go:3-4`).
+- Regenerate locally and confirm zero diff against the committed `types.gen.go` / `proxy_service.pb.go`.
+
+## Test coverage
+| Test file | Locks down |
+| --------- | ---------- |
+| None in this scope | The proto and OpenAPI sources are tested transitively by the handler tests (`shared/management/http/handlers/agentnetwork/...`) and by the synthesizer/manager tests (`management/server/agentnetwork/...`). No round-trip serialisation test exists in the `proto/` or `api/` packages themselves. |
+| `shared/management/proto/*_test.go` | (absent) |
+| `shared/management/http/api/*_test.go` | (absent) |
+
+Acceptable for codegen artefacts, but a single golden-file test that re-runs `oapi-codegen` and `protoc` in CI and diffs against the checked-in files would close the reproducibility gap noted above.
+
+## Known limitations / explicit non-goals
+- **No deprecation surface.** Old fields/RPCs are kept silently; there is no `[deprecated = true]` annotation on anything. Acceptable here because nothing is being removed.
+- **No proto-side validation.** Numeric ranges (e.g. `window_seconds >= 60`, `cost_usd >= 0`, capture-byte clamps) are enforced in the OpenAPI schema via `minimum:` and inside Go code by the proxy/management, but `proto3` itself can't express them; downstream is expected to validate every message.
+- **`MiddlewareConfig.config_json` is `bytes`** (`proxy_service.proto:163`) — opaque to the proto layer. Schema validity is the middleware factory's problem. This is a deliberate tradeoff (per the comment at 161-162) but worth flagging: a corrupted/malicious config_json can only fail at proxy apply time, not at the wire-decode step.
+- **No catalog endpoint schema for the catalog itself** — the catalog data ships as a `GET /api/agent-network/catalog/providers` returning `[AgentNetworkCatalogProvider]` (`openapi.yml:13024`), but the catalog source-of-truth lives in `management/server/agentnetwork/catalog`, not here.
+- The reaper / GC design was cut from scope; no reaper-related types appear here.
+
+## Cross-references
+- Downstream: [management/store](20-management-store.md), [management/agentnetwork](21-management-agentnetwork.md), [management/handlers + wiring](22-management-handlers-wiring.md), [proxy/runtime](33-proxy-runtime.md)
+- End-to-end flow: [../01-end-to-end-flows.md](../01-end-to-end-flows.md)
+- Top-level: [../00-overview.md](../00-overview.md)
diff --git a/docs/agent-networks/modules/20-management-store.md b/docs/agent-networks/modules/20-management-store.md
new file mode 100644
index 000000000..1acc12611
--- /dev/null
+++ b/docs/agent-networks/modules/20-management-store.md
@@ -0,0 +1,112 @@
+# management/store — persistence for agent-network entities
+
+> **Risk level:** Medium — six brand-new tables behind AutoMigrate, one upsert-counter table that runs on the request hot path, and one column carrying an encrypted secret.
+> **Backward-compat impact:** Additive (six new tables created by AutoMigrate; the `Store` interface gains 23 methods, but no existing column/index is touched).
+
+## Module boundary
+
+This module is the persistence layer for the Agent Network feature. Everything the management server stores about LLM proxying — providers, policies, guardrails, the per-account settings row, a usage-counter table written on every proxied LLM request, and the account-budget rules — flows through the methods added to `store.Store`. The module owns six tables, six entity types from `management/server/agentnetwork/types`, and a single hot-path upsert (`IncrementAgentNetworkConsumption`) consumed by the proxy fleet.
+
+Out of scope here: the catalog of provider definitions (compiled-in, no DB), the synthesizer/manager built on top of these CRUDs (covered in [21-management-agentnetwork.md](21-management-agentnetwork.md)), and the HTTP handlers that translate API requests into Save/Delete calls.
+
+## Files
+
+| Path | Role |
+| ---- | ---- |
+| `management/server/store/sql_store_agentnetwork.go` | gorm implementations of all 23 store methods |
+| `management/server/store/sql_store_agentnetwork_budgetrule_test.go` | round-trip + account-scoping coverage against a real sqlite store |
+| `management/server/store/sql_store.go` | one import, six entities appended to the `AutoMigrate` slice (sql_store.go:40, sql_store.go:141-142) |
+| `management/server/store/store.go` | 23 methods added to the `Store` interface (store.go:328-354) |
+| `management/server/store/store_mock_agentnetwork.go` | mockgen output for the new interface surface |
+
+## Tables added / migrations
+
+All six tables are created by `db.AutoMigrate` invoked from `NewSqlStore` at sql_store.go:133-143. There is no hand-rolled SQL migration script — the schema is whatever GORM derives from the struct tags.
+
+- `agent_network_providers` — `Provider.TableName()` at provider.go:76. PK `id`, index on `account_id`, named index `idx_agent_network_provider` on `provider_id`. Carries an at-rest-encrypted `api_key` and ed25519 `session_private_key` (provider.go:35,56). `extra_values` and `models` are JSON blobs (`serializer:json`).
+- `agent_network_policies` — `Policy.TableName()` at policy.go:70. PK `id`, index on `account_id`. JSON columns: `source_groups`, `destination_provider_ids`, `guardrail_ids`, `limits`.
+- `agent_network_guardrails` — `Guardrail.TableName()` at guardrail.go:41. PK `id`, index on `account_id`. JSON `checks`.
+- `agent_network_settings` — `Settings.TableName()` at settings.go:33. PK `account_id` (one row per account), named index `idx_agent_network_settings_cluster_subdomain` on `subdomain` only — the index name implies a composite, but only one column is tagged.
+- `agent_network_consumption` — `Consumption.TableName()` at consumption.go:46. Composite PK across `(account_id, dim_kind, dim_id, window_seconds, window_start_utc)` — the same tuple the upsert keys on.
+- `agent_network_budget_rules` — `AccountBudgetRule.TableName()` at budgetrule.go:35. PK `id`, index on `account_id`. JSON `target_groups`, `target_users`, `limits`.
+
+## CRUD surface added
+
+Provider, Policy, Guardrail, BudgetRule follow the same pattern: `Get<Kind>ByID`, `GetAccount<Kind>` (list), `Save<Kind>` (upsert), `Delete<Kind>`, with account-scoping enforced by the existing `accountAndIDQueryCondition` / `accountIDCondition` constants (sql_store.go:59-62). Provider additionally exposes `GetAllAgentNetworkProviders` (cross-account, used by the synthesizer). Settings exposes `Get`/`GetByCluster`/`Save` (no delete — one row per account, created on first save). Consumption exposes the upsert `Increment`, a point `Get`, and a cross-window `List`.
+
+## Architecture & flow
+
+```mermaid
+flowchart LR
+    handlers["HTTP handlers<br/>(management/server/agentnetwork)"] -->|Save/Delete| iface["Store interface<br/>store.go:328-354"]
+    manager["agentnetwork.Manager"] -->|Get*| iface
+    synth["synthesizer<br/>(global)"] -->|GetAllAgentNetworkProviders| iface
+    proxy["proxy fleet<br/>(hot path)"] -->|IncrementAgentNetworkConsumption| iface
+    iface --> sql["SqlStore methods<br/>sql_store_agentnetwork.go"]
+    iface -.gomock.-> mock["MockStore<br/>store_mock_agentnetwork.go"]
+    sql --> gorm["gorm.DB"]
+    gorm --> tables[("6 tables<br/>agent_network_*")]
+    sql --> enc["crypt.FieldEncrypt<br/>(provider only)"]
+```
+
+Reads decrypt provider secrets in-place; writes do `provider.Copy().EncryptSensitiveData(...)` before `db.Save` so the caller's in-memory object keeps the plaintext `api_key` (sql_store_agentnetwork.go:88-102). Every list/get takes a `LockingStrength` and applies `clause.Locking{Strength: ...}` when non-`None` — matching the rest of the store. The upsert path uses `clause.OnConflict` with `gorm.Expr` server-side increments so concurrent proxy nodes converge without read-modify-write races (sql_store_agentnetwork.go:321-335).
+
+## Invariants enforced at the store layer
+
+- **Account scoping.** Every entity-by-ID method keys on `account_id = ? and id = ?`; no cross-tenant leak path through the API is reachable as long as callers always pass the auth'd `accountID` (sql_store_agentnetwork.go:70,141,201,429).
+- **NotFound mapping.** `gorm.ErrRecordNotFound` is translated to typed `status.NewAgentNetwork*NotFoundError`; `Delete*` returns NotFound when `RowsAffected == 0` (sql_store_agentnetwork.go:111-113,171-173,231-233,461-463).
+- **Provider secret encryption at rest.** `SaveAgentNetworkProvider` always encrypts before persist; `Get*` always decrypts after read. The plaintext `api_key` never reaches the DB through this layer (sql_store_agentnetwork.go:31,54,80,90).
+- **Consumption monotonicity.** The upsert only ever issues `col = col + ?` for the three counter columns — no decrement path exists (sql_store_agentnetwork.go:330-332).
+- **Window alignment is the caller's responsibility.** The store stamps `WindowStartUTC` as-passed; alignment to epoch happens in `types.WindowStart` at consumption.go:51-58.
+- **Settings has no Delete.** Intentional — one row per account, created on first save; the row sticks around for the account lifetime.
+
+## Things to scrutinize
+
+### Correctness
+- `SaveAgentNetworkProvider` saves the copy (sql_store_agentnetwork.go:95). The caller's in-memory pointer therefore keeps plaintext `api_key` and any `CreatedAt`/`UpdatedAt` gorm autofills land on the copy, not the original. Callers that need synced timestamps must re-fetch.
+- `IncrementAgentNetworkConsumption`'s `Create` provides initial counter values (`TokensInput: tokensIn`, etc.) in the row, and on conflict the assignments add the same deltas to the existing values. The insert-vs-update arithmetic is consistent. Cross-check that no engine in use (sqlite, postgres, mysql) silently rejects the `OnConflict` clause — GORM emits engine-specific SQL but `ON DUPLICATE KEY UPDATE` (mysql) vs `ON CONFLICT (...)` (sqlite/postgres) need their unique constraint to match the composite PK on `agent_network_consumption`; it does, by construction.
+- `IncrementAgentNetworkConsumption` writes `updated_at: time.Now().UTC()` literally inside the assignments map (sql_store_agentnetwork.go:333) — fine, but it's a Go-side timestamp captured at call time, not a DB-side `now()`. Acceptable for an audit field.
+- `GetAgentNetworkConsumption` returns a zero-valued non-nil row on `ErrRecordNotFound` (sql_store_agentnetwork.go:364-371). Document or rename — a typed sentinel error would be more orthodox; callers must know not to error-check.
+
+### Concurrency / transactions
+- Hot-path `IncrementAgentNetworkConsumption` runs outside any explicit transaction; concurrency safety relies entirely on the DB serialising the `ON CONFLICT` upsert against the composite PK. This is correct for postgres and mysql; for sqlite it serialises behind the single writer.
+- `SaveAgentNetworkSettings` is a blind upsert with no version/etag — concurrent writes from two operators last-write-wins on the collection-toggle flags (settings.go:23-25). Acceptable for admin-curated state but worth flagging.
+- `Save*Provider` uses `db.Save` on a struct with a PK already set — GORM emits UPDATE or INSERT based on row existence. No upsert clause is attached, so a race between two creates with the same generated `xid` (vanishingly unlikely) would surface as a PK violation.
+
+### Migration safety
+- All six tables ride `AutoMigrate` (sql_store.go:141-142). AutoMigrate is additive: new columns get added, but it never drops columns nor narrows types. Three `bool` columns on `agent_network_settings` (`EnableLogCollection`, `EnablePromptCollection`, `RedactPii`) default to false at the GORM/DDL layer for existing rows; the test at sql_store_agentnetwork_budgetrule_test.go:83-112 locks that down on a fresh sqlite. Verify postgres/mysql produce the same default.
+- The named index `idx_agent_network_settings_cluster_subdomain` on settings.go:15 is declared on only `subdomain`. Either the cluster column also needs `gorm:"index:idx_agent_network_settings_cluster_subdomain"` to make it composite, or the name is misleading.
+- The named index `idx_agent_network_provider` on `Provider.ProviderID` (provider.go:30) is *not* unique and not scoped to account — two providers in the same account with the same `provider_id` are permitted at the DB layer; uniqueness, if any, must live above the store.
+
+### Backward compatibility
+- Net additive. No removed methods, no renamed columns, no schema change to existing tables. Existing deployments running a prior binary continue to work; the first boot of the new binary creates the six tables.
+- The `Store` interface grows by 23 methods (store.go:330-354); any non-mock external implementer of `store.Store` will fail to compile. The repo only has `SqlStore` + `MockStore`, both updated.
+
+### Performance (indexes, N+1)
+- All by-account list queries hit the `idx_account_id` per-table index. No N+1: list methods return the full slice in one query.
+- `GetAgentNetworkSettingsByCluster` (sql_store_agentnetwork.go:263-277) does a tablescan on `cluster` — no index. Tolerable for the bootstrap label generator (one-shot at provisioning) but worth noting if the call moves onto a hot path.
+- `ListAgentNetworkConsumption` returns every row ever recorded for the account (sql_store_agentnetwork.go:382-400) — unbounded growth, no `LIMIT`, no time filter. With one row per (dim, window) per request burst, this table grows fastest of the six; a retention job + a paginated list method are obvious follow-ups.
+
+## Test coverage
+
+| Test file | Locks down |
+| --------- | ---------- |
+| `sql_store_agentnetwork_budgetrule_test.go::TestAgentNetworkBudgetRule_RealStore_RoundTrip` | full save → reload of `AccountBudgetRule` including the JSON-serialised `PolicyLimits`, target slices, double-delete returns NotFound (lines 18-59) |
+| `sql_store_agentnetwork_budgetrule_test.go::TestAgentNetworkBudgetRule_RealStore_ScopedByAccount` | cross-account isolation for budget rules (lines 63-78) |
+| `sql_store_agentnetwork_budgetrule_test.go::TestAgentNetworkSettings_RealStore_CollectionTogglesRoundTrip` | collection toggles default off, survive save/reload at the set values (lines 83-112) |
+
+Gap: there is no store-level test for providers (encryption round-trip), policies, guardrails, or `IncrementAgentNetworkConsumption` (concurrent upsert, window-key uniqueness). The consumption upsert is the most performance-sensitive method in this module and the only one without a real-sqlite test.
+
+## Known limitations / explicit non-goals
+
+- No retention / GC for `agent_network_consumption`.
+- No `Delete` for `Settings` (one row per account, cleared with the account).
+- No DB-engine-specific tuning — the same struct tags drive sqlite, mysql, postgres.
+- Provider `extra_values` and `models` are JSON blobs; querying inside them is not supported by design.
+- `GetAgentNetworkConsumption` "not-found = zero row" contract is convenient but unconventional.
+
+## Cross-references
+
+- Upstream: [shared/api](10-shared-api.md), [management/agentnetwork](21-management-agentnetwork.md)
+- End-to-end flow: [../01-end-to-end-flows.md](../01-end-to-end-flows.md)
+- Top-level: [../00-overview.md](../00-overview.md)
diff --git a/docs/agent-networks/modules/21-management-agentnetwork.md b/docs/agent-networks/modules/21-management-agentnetwork.md
new file mode 100644
index 000000000..b64c1ba20
--- /dev/null
+++ b/docs/agent-networks/modules/21-management-agentnetwork.md
@@ -0,0 +1,225 @@
+# management/agentnetwork — domain layer + synth pipeline
+
+> **Risk level:** High — central business logic + budget enforcement + the source of every middleware-chain change the proxy executes.
+> **Backward-compat impact:** Additive within the agent-network surface; one **behavioural difference for opted-out accounts** in parser capture (the capture flag is stamped explicitly false instead of being absent — see capture-pointer semantics below). Non-agent-network proxy services are untouched (the synth chain only ships on `agent-net-svc-*` targets).
+
+## Module boundary
+
+`management/server/agentnetwork` owns every agent-network entity (providers, policies, guardrails, account budget rules, per-account settings, consumption rows) and **translates them into the in-memory `*rpservice.Service` that the reverse-proxy controller turns into `proto.ProxyMapping`s and pushes to clusters**. It is the *only* writer of the agent-network middleware chain.
+
+Inside the package: `manager.go` is the CRUD + permissions-gated facade; `synthesizer.go` walks settings + providers + policies + guardrails and emits the per-account service plus every middleware's JSON config; `policyselect.go` runs per-request attribution (min-wins account ceiling, then "drain bigger pool first"); `reconcile.go` diffs successive synth outputs and emits precise Create/Update/Delete proxy-mapping updates plus a peer-map refresh. `labelgen/` mints DNS-safe subdomain labels; `catalog/` is the static provider catalogue; `types/` carries gorm entity structs. The `_realstack_test.go` files in the parent `management/server/` directory exercise the manager + network-map controller end-to-end with no mocks.
+
+## Files
+
+| Path | Role |
+| ---- | ---- |
+| `agentnetwork/manager.go` | Manager interface + CRUD + permission gates + bootstrap-settings + reconcile trigger |
+| `agentnetwork/synthesizer.go` | Settings/policy → wire-format synthesis; sole writer of the proxy middleware chain |
+| `agentnetwork/policyselect.go` | Per-request policy attribution + account-budget ceiling (min-wins) |
+| `agentnetwork/reconcile.go` | Per-account synth diff vs in-memory cache → Create/Update/Delete |
+| `agentnetwork/catalog/catalog.go` | Static provider catalogue (auth headers, identity-injection shapes) |
+| `agentnetwork/labelgen/{labelgen,words}.go` | DNS-safe subdomain picker + curated wordlist |
+| `agentnetwork/types/provider.go` | Provider entity + APIKey + Models + ExtraValues + SessionKeys |
+| `agentnetwork/types/policy.go` | Policy entity + `PolicyLimits` (token + budget) |
+| `agentnetwork/types/guardrail.go` | Guardrail entity (`ModelAllowlist`, `PromptCapture`) |
+| `agentnetwork/types/budgetrule.go` | `AccountBudgetRule` (reuses `PolicyLimits`) |
+| `agentnetwork/types/settings.go` | Per-account `Settings` (Cluster, Subdomain, 3 toggles) |
+| `agentnetwork/types/consumption.go` | `Consumption` row + `WindowStart` aligner |
+| `agentnetwork/{synthesizer,policyselect,reconcile,wire_shape}_*test.go` | See test coverage table |
+| `agentnetwork/types/consumption_test.go` | `WindowStart` alignment proofs |
+| `agentnetwork/labelgen/labelgen_test.go` | Deterministic picks + exhaustion + fallback |
+| `management/server/agentnetwork_realstack_test.go` | No-mock provider CRUD → network-map fan-out |
+| `management/server/agentnetwork_budgetrule_realstack_test.go` | No-mock budget-rule CRUD + settings preserve-immutable |
+
+## Architecture & flow
+
+### Synthesis (settings/policy → wire format)
+
+```mermaid
+flowchart TD
+    A[Mutation: provider/policy/guardrail/settings] --> B[managerImpl.reconcile accountID]
+    B --> C{proxyController nil?}
+    C -- yes --> D[accountManager.UpdateAccountPeers only]
+    C -- no --> E[SynthesizeServices]
+    E --> F[loadSettings — NotFound returns ok=false, no synth]
+    F --> G[filterEnabledProviders sorted by CreatedAt]
+    G --> H[filterEnabledPolicies]
+    H --> I[backfillProviderSessionKeys if missing]
+    I --> J[indexProviderGroups: providerID -> sorted source groups]
+    J --> K[buildRouterConfigJSON drops orphan providers]
+    J --> L[buildIdentityInjectConfigJSON per catalog entry]
+    H --> M[mergeGuardrails: union allowlist, OR redact]
+    M --> N[applyAccountCollectionControls account toggle = SOLE capture control]
+    N --> O[marshalGuardrailConfig]
+    K --> P[buildMiddlewareChain 8 middleware entries]
+    L --> P
+    O --> P
+    P --> Q[buildAccountService: AccessGroups=union source groups, noop.invalid target]
+    Q --> R[reconcile.diffMappings vs cache]
+    R --> S[SendServiceUpdateToCluster CREATE/MODIFY/REMOVE]
+    R --> T[accountManager.UpdateAccountPeers — fans synth ACLs into network map]
+```
+
+### Budget rule resolution (min-wins, group+user bound)
+
+```mermaid
+flowchart TD
+    A[SelectPolicyForRequest in] --> B[checkAccountBudget — runs FIRST, independent of policies]
+    B --> C[GetAccountAgentNetworkBudgetRules]
+    C --> D{for each enabled rule}
+    D --> E{budgetRuleApplies?}
+    E -- no --> D
+    E -- yes --> F[attrGroup = lowestIntersect TargetGroups, in.GroupIDs]
+    F --> G{Token cap enabled?}
+    G -- yes --> H[evalTokenCap user dim + group dim]
+    H --> I{exhausted?}
+    I -- yes --> J[DENY: llm_account.token_cap_exceeded - STOP]
+    I -- no --> K{Budget cap enabled?}
+    G -- no --> K
+    K -- yes --> L[evalBudgetCap user dim + group dim]
+    L --> M{exhausted?}
+    M -- yes --> N[DENY: llm_account.budget_cap_exceeded - STOP]
+    M -- no --> D
+    K -- no --> D
+    D --> O[All rules passed -> fall through to per-policy selection]
+```
+
+Key invariant: **rules are checked sequentially and ANY exhausted rule denies (all-must-pass / min-wins).** Untargeted rules (`len(TargetGroups)==0 && len(TargetUsers)==0`) apply to every caller (`policyselect.go:393`).
+
+### Policy selection (per-peer, per-request)
+
+```mermaid
+flowchart TD
+    A[Account-budget gate passed] --> B[GetAccountAgentNetworkPolicies]
+    B --> C[filterApplicablePolicies enabled + provider match + group intersect]
+    C --> D{candidates empty?}
+    D -- yes --> E[Allow, empty SelectedPolicyID]
+    D -- no --> F[scoreCandidates -> scoreOne per policy]
+    F --> G[scoreOne: attrGroup + window]
+    G --> H{any cap exhausted?}
+    H -- yes --> I[Drop policy; record last deny code]
+    H -- no --> K[Keep as live candidate]
+    F --> L{live candidates exist?}
+    L -- no --> M[Deny with last exhaustion code]
+    L -- yes --> N[Sort: uncapped wins -> larger group token -> group budget -> user token -> user budget -> oldest CreatedAt]
+    N --> O[winner = scored 0]
+    O --> P[Allow + SelectedPolicyID + AttributionGroupID + WindowSeconds]
+```
+
+End-to-end: a mutation calls `managerImpl.reconcile(ctx, accountID)` (`manager.go:205,239,...`). Reconcile defers an `accountManager.UpdateAccountPeers` so the network-map controller re-runs and `injectAllProxyPolicies` picks up the new access groups; with a `proxyController` wired, it re-synthesizes the service, diffs against `reconcileCache[accountID]` (guarded by `reconcileMu`), and emits proto mappings to the cluster derived from the mapping's domain (`reconcile.go:120`). Synthesis is stateless and idempotent. Sole persistent side effect: `backfillProviderSessionKeys` (`synthesizer.go:249`) mints ed25519 keys on legacy provider rows and writes them back.
+
+At request time the path is independent: the proxy calls `SelectPolicyForRequest` (`policyselect.go:56`); account-budget ceiling first, then per-policy scoring. Token + budget caps share `evalTokenCap` / `evalBudgetCap` — same primitive for account rules and policy limits, `label` differentiates the deny reason. After a served request, `RecordAccountBudgetUsage` (`policyselect.go:415`) fans deltas to every applicable rule's distinct `(dim_kind, dim_id, window)` tuple, deduplicating to prevent double-count when two rules share target+window.
+
+## Public contracts
+
+- **Manager interface** (`manager.go:48-80`): CRUD for `Providers/Policies/Guardrails/BudgetRules`; `GetSettings/UpdateSettings` (cluster + subdomain immutable, only the three toggles mutate); `ListConsumption/RecordConsumption(account, kind, dimID, windowSec, in, out, USD)`; `RecordAccountBudgetUsage(account, user, groups, in, out, USD)`; `SelectPolicyForRequest(ctx, PolicySelectionInput) → *PolicySelectionResult{Allow, SelectedPolicyID, AttributionGroupID, WindowSeconds, DenyCode, DenyReason}`.
+- **`PolicySelectionInput`** (`manager.go:85-90`): `{AccountID, UserID, GroupIDs, ProviderID}` — populated by the proxy from CapturedData + `llm_router` resolution.
+- **Synthesized middleware chain** (`synthesizer.go:576-657`), order load-bearing — response slot runs reverse-of-slice:
+
+  | Slot | Idx | ID | ConfigJSON shape | CanMutate |
+  | --- | --- | --- | --- | --- |
+  | on_request | 0 | `llm_request_parser` | `{"capture_prompt": <bool>, "redact_pii"?: true}` | – |
+  | on_request | 1 | `llm_router` | `{"providers":[{id, models[], upstream_*, auth_header_*, allowed_group_ids[]}]}` | **true** |
+  | on_request | 2 | `llm_limit_check` | `{}` | – |
+  | on_request | 3 | `llm_identity_inject` | `{"providers":[{provider_id, header_pair?, json_metadata?, extra_headers?}]}` | **true** |
+  | on_request | 4 | `llm_guardrail` | `{"model_allowlist"?, "prompt_capture":{enabled,redact_pii}}` | – |
+  | on_response | 5 | `llm_limit_record` | `{}` (runs LAST at runtime) | – |
+  | on_response | 6 | `cost_meter` | `{}` | – |
+  | on_response | 7 | `llm_response_parser` | `{"capture_completion": <bool>, "redact_pii"?: true}` | – |
+- **Synthesized service shape** (`synthesizer.go:739`): `Mode=HTTP`, `Private=true`, `Domain=<subdomain>.<cluster>`, `AccessGroups=unionSourceGroups(enabledPolicies)`, one `TargetTypeCluster` target with `Host=noop.invalid:443` (router rewrites per request), `Options.{DirectUpstream,AgentNetwork}=true`, `DisableAccessLog=!settings.EnableLogCollection`, `CaptureMax{Req,Resp}Bytes=1<<20`, `CaptureContentTypes=["application/json","text/event-stream"]`.
+
+## Invariants
+
+- **Min-wins / all-must-pass for account budget rules** (`checkAccountBudget`, `policyselect.go:353`): every applicable enabled rule is checked; first exhausted cap denies. Untargeted rules bind every caller.
+- **Account toggle is the SOLE control for capture enablement.** `applyAccountCollectionControls` (`synthesizer.go:701`) sets `merged.PromptCapture.Enabled = settings.EnablePromptCollection` *unconditionally*.
+- **Capture-pointer semantics on parser configs** — see "Things to scrutinize" below.
+- **`EnableLogCollection` ↔ `DisableAccessLog` is the only access-log toggle** (`synthesizer.go:770`). Default off ⇒ access log suppressed.
+- **`RedactPii` flows verbatim to BOTH parsers** (`synthesizer.go:584-585`) and is OR'd into the merged guardrail (`synthesizer.go:706`).
+- **Cluster and Subdomain are immutable on Settings.** `UpdateSettings` reloads existing row and overlays only the three toggles (`manager.go:558-561`).
+- **Orphan providers (no enabled policy authorises them) NEVER reach the router** (`synthesizer.go:351-357`); skipped from `identity_inject` for symmetry.
+- **Provider creation refuses empty `api_key`** (`manager.go:175`); **deletion refuses while any policy still references it** (`manager.go:265-273`).
+- **Session keypair stability across provider edits** (`manager.go:226-228`) — server-managed, copied through every `UpdateProvider`, never API-surfaced.
+
+## Things to scrutinize
+
+### Correctness
+
+- **Capture-pointer semantics — `*bool` vs `bool`.** Three states, owned by separate sides:
+  - **Wire JSON this module emits:** `buildParserConfigJSON` (`synthesizer.go:678-693`) *always* stamps the capture field. Agent-network targets ship `"capture_prompt": false` or `"capture_prompt": true` — never absent. Same for `"capture_completion"`. The happy-path test pins `{"capture_prompt":false}` (`synthesizer_test.go:174`).
+  - **Proxy-side parser config (consumer):** parsers decode into `*bool`. Matrix:
+    - `nil` (field absent) → **legacy default = emit**. Preserved for non-agent-network callers and pre-existing tests (the backward-compat hook).
+    - `false` (field present, value false) → **suppress emission entirely**. The behaviour for opted-out agent-network accounts. Without this, `enable_log_collection=true` + `enable_prompt_collection=false` would leak raw user input AND raw model output to the access log.
+    - `true` → emit normally.
+  - **Why the synth always stamps a value:** an agent-network mapping omitting the field would hit legacy "always emit" and re-introduce the leak. The `json.Marshal` error fallback at `synthesizer.go:687` degrades to `{}` — comment-claimed unreachable, but if ever fired re-introduces the leak. Consider fail-closed (return literal `{"capture_prompt":false}`) instead.
+- **`scoreCandidates` non-cumulative deny code.** Only the *last* exhausted policy's deny code survives (`policyselect.go:188-190`). Iteration order is store's natural order. Auth signal is `len(scored)==0`, so this is informational only — verify no UI depends on "first exhausted policy" semantics.
+- **`effectiveWindowSeconds` token-wins tiebreak.** When both halves are enabled with different windows, token's window wins (`policyselect.go:482`). Verify `RecordLLMUsage` increments against the winning window only.
+- **`RecordAccountBudgetUsage` dedup.** Two rules with the same `(kind, dim_id, window)` would double-count without the `tuples` map (`policyselect.go:434-449`). Key includes all three dimensions — correct.
+- **Fail-closed on bad provider:** unknown catalog id (`synthesizer.go:794-796`) or empty API key (`synthesizer.go:801-803`) drops the **entire** account's synth, not just the bad provider. Confirm matches operator UX.
+
+### Security
+
+- **Redact OR-merge:** merged `RedactPii` = account OR guardrail (`synthesizer.go:706`). **Parser-side flag is `settings.RedactPii` only, NOT the OR** — a guardrail-only opt-in does not propagate to parsers. Correct because the account toggle gates capture, but worth noting on the proxy side.
+- **Group resolution must not leak across accounts.** Every store call carries `accountID` (`policyselect.go:73, 286, 298, 322, 334, 354`); `lowestIntersect` uses caller's claimed groups only (`policyselect.go:494`). Risk surface is upstream (handler populates `in.GroupIDs`).
+- **`UpdateSettings` preserves immutable Cluster + Subdomain** (`manager.go:558`). A client can't rebind the cluster.
+- **Provider session keypair backfill writes through `SaveAgentNetworkProvider`** (`synthesizer.go:256`) from a read-shaped call. Idempotent → worst case is a wasted write under concurrent reconcile + snapshot.
+
+### Concurrency
+
+- **`reconcileMu`** guards `reconcileCache`. Lock window is narrow — compute diff inside, send outside (`reconcile.go:56-68`).
+- **`labelRngMu`** guards `labelRng` because `math/rand.Source` is unsafe for concurrent use (`manager.go:638-640`).
+- **Real-store tests** use `store.NewTestStoreFromSQL` with `t.TempDir()` per test — no shared state, no `t.Parallel()`.
+- **`RecordAccountBudgetUsage` dedup `tuples` map is per-call;** concurrent calls fan out fully — correct (each request's tokens book once per applicable rule).
+- **Deferred `UpdateAccountPeers` runs inline after the proxy push** (`reconcile.go:28-35`); a slow call stretches CRUD response time.
+
+### Backward compatibility
+
+- **Capture-pointer semantics (restated):** non-agent-network callers see no field → legacy nil-default emit, identical to pre-PR. Agent-network targets always carry an explicit `capture_*` value.
+- **`TestSynthesizeServices_HappyPath` was updated:** request-parser config moved from `{}` to `{"capture_prompt":false}` (`synthesizer_test.go:174`). External snapshot tests against synth output need updating.
+- **`MergedGuardrails` retains zeroed `TokenLimits`/`Budget`/`Retention`** even though `Policy.Limits` carries the real values now; `llm_limit_check` is the authoritative enforcement. Comment at `synthesizer.go:940-948` calls this out.
+
+### Performance
+
+- **`SynthesizeServices` runs on every controller tick / mutation reconcile.** Cost: 4 store reads + optional per-provider keypair backfill. Sort + index + merge are O(N log N) / O(P × G); dominant cost is JSON marshalling. No nested loops escape these dimensions.
+- **`reconcile.diffMappings` is O(N + M)** with N=M=1 per account today — effectively constant.
+- **`SynthesizeServicesForCluster`** (`synthesizer.go:71`) walks every account on a cluster; per-account failures are **swallowed** (`synthesizer.go:91-93`) so a single misconfigured account doesn't drop the cluster. Runs per proxy reconnect.
+
+### Observability
+
+- **Activity codes:** `AgentNetwork{Provider,Policy,Guardrail,BudgetRule}{Created,Updated,Deleted}`; `AgentNetworkSettingsUpdated` with `log_collection/prompt_collection/redact_pii` payload (`manager.go:567-571`). **No activity code for `SelectPolicyForRequest` denies** — surfaced via proxy access log only (likely intentional given volume).
+- **Deny codes** namespaced: `llm_policy.{token,budget}_cap_exceeded`, `llm_account.{token,budget}_cap_exceeded` (`policyselect.go:18-26`).
+- **Reconcile failures are logged at warn and swallowed** (`reconcile.go:42-44`). Persistent synth failures (e.g. unknown catalog id) silently keep the proxy out of sync — consider a manager-level synth-health surface if this becomes a support burden.
+
+## Test coverage
+
+| Test file | Locks down |
+| --------- | ---------- |
+| `synthesizer_test.go` | Mock-store: `HappyPath` (8-mw chain ordering, `{"capture_prompt":false}` baseline); `No{Settings,Providers}`; `Disabled{Provider,Policy}_NoService`; `RouterConfigOrdering`; `PolicyCheckConfig_UnionsSourceGroups`; `OrphanProvider_HasEmptyAllowedGroups`; identity-inject for LiteLLM / Bifrost (overrides + partial disable) / Cloudflare / Portkey / Vercel / OpenRouter / generic non-customizable; `GuardrailMerge_AllowlistUnion_LimitsRestrictive`; `BackfillsMissingSessionKeys`; `HTTPUpstream_KeepsExplicitPort`; `UpstreamURLPath_FlowsToRouter`; `UnknownProviderID_FailsClosed`; `EmptyAPIKey_FailsClosed`. |
+| `synthesizer_realstore_test.go` | Real-sqlite: `SurvivesStatusToggle` reproduces the disable/re-enable 403 regression; `Reconcile_RealStore_PushesPrivateAfterStatusToggle` extends through reconcile push. |
+| `synthesizer_guardrail_realstore_test.go` | `PromptCaptureAccountIsSoleControl`; `PromptCaptureFlowsWhenAccountOptsIn`; `AccountRedactWithoutGuardrailRedact`; `NoGuardrail_CaptureOff`. |
+| `synthesizer_log_collection_realstore_test.go` | `LogCollection{Off_SuppressesAccessLog,On_PermitsAccessLog}` — verifies `DisableAccessLog` propagation through `ToProtoMapping`. |
+| `synthesizer_parser_redact_realstore_test.go` | **Capture-pointer regression suite:** `ParserConfigsCarryRedactPii`; `ParserConfigsSuppressCaptureWhenLogCollectionOnly` (log=on/prompt=off ⇒ both capture flags false); `ParserConfigsOmitRedactPiiWhenOff`. |
+| `policyselect_test.go` | Mock-store: `NoApplicablePolicies`; `AllowWithLowestGroupAttribution`; `LargerPoolWinsAcrossUsageLevels`; `StaysOnLargerPoolAfterPartialDrain`; `FallsThroughToSmallerPoolWhenLargerExhausted`; `TiebreakBy{LargerGroupPool,CreatedAt}`; `DeniesWhenAllExhausted`; `UncappedPolicyAlwaysWinsAgainstCapped`; `DisabledPolicyIgnored`; `StoreErrorPropagates`; `RejectsEmptyAccount`; `SharesGroupCounterAcrossPolicies`; `AntiFallThroughOnLowestGroup`; `BudgetOnlyExhaustionDenies`; `BudgetTighterThanTokenWins`. |
+| `policyselect_realstore_test.go` | Real-sqlite regression guard: `NoApplicablePolicies`; `AllowAndLowestGroupAttribution`; `LargerPoolWins_FallsThroughWhenExhausted`; `BudgetCapDenies`; `GroupCounterSharedAcrossPolicies`; `DisabledPolicyIgnored`. |
+| `policyselect_account_realstore_test.go` | Account budget rules: `AccountCeilingBindsEvenWithUncappedPolicy` (min-wins); `AccountGroupCeiling`; `AccountTargetUsersBindsOnlyThatUser`; `AccountRuleRecordsToOwnWindow`. |
+| `reconcile_test.go` | `FirstSynth_EmitsCreate`; `NoChange_EmitsNothingExtra` (re-push as Modified — verify desired); `PolicyRemoved_EmitsDelete`; `NilProxyController_NoOp`; `EmptyAccountID_NoOp`; `ClusterFromMapping`. |
+| `wire_shape_test.go` | `TestSynthesizedService_WireShape` — proto-shape lockdown via `ToProtoMapping`. Catches "service not matching" (mapping reaches proxy but no SNI/HTTP route). Asserts ID, Domain, Mode, AuthToken, `Private`, `Auth.Oidc=false`, one path `/` + `https://noop.invalid/`, 8 middlewares with correct slot enums, router config `auth_header_value="Bearer sk-test-key"`. |
+| `labelgen/labelgen_test.go` | `PickUnique_{DeterministicWithSeededRng,AvoidsTakenWordsWhenMostAreReserved,FallsBackWhenAllReserved}`; `UniqueWords_DropsDuplicates`. |
+| `types/consumption_test.go` | `WindowStart_{AlignedToUnixEpoch,WithinWindowConverges,AcrossWindowsDiverges,DifferentWindowsHaveDifferentBuckets,SubMinuteAndMinuteAlignment,ZeroWindowReturnsInputUTC}`. Bucket alignment so multi-node reads converge. |
+| `agentnetwork_realstack_test.go` | `ProviderCRUD_FansOutToProxyAndClientPeers` — no-mock end-to-end through real account manager + network-map + agentnetwork: provider create propagates the updated map to both proxy peer and client peer with the synth DNS surface. |
+| `agentnetwork_budgetrule_realstack_test.go` | `BudgetRuleCRUD_RealManager`; `UpdateSettings_PreservesImmutableAndTogglesCollection`. |
+
+## Known limitations / explicit non-goals
+
+- **`MergedGuardrails.TokenLimits/Budget/Retention` emit at zero** (`synthesizer.go:940-948`); real enforcement is `Policy.Limits` via `llm_limit_check`. Future cleanup implied.
+- **Session keys picked from first enabled provider by created_at** (`pickServiceSessionKeys`, `synthesizer.go:270`). Existing session cookies survive provider edits only while the first-by-CreatedAt provider stays in place. Document for operators.
+- **Reconcile failures silently swallowed** (`reconcile.go:42-44`). Persistent failures keep the proxy out of sync until the next reconcile.
+- **`scoreCandidates` exposes only the LAST exhaustion's deny code** when multiple policies are exhausted.
+- **`bootstrapSettingsIfNeeded` failure is non-fatal to provider create** (`manager.go:200`): provider lands, synth is no-op until the next provider create retries the bootstrap.
+- **Budget rules do not trigger a reconcile** (`manager.go:476-477`). Request-time evaluation only; new rules take effect on the next request without a proxy push.
+
+## Cross-references
+
+- **Upstream:** [shared/api](10-shared-api.md), [management/store](20-management-store.md), reverseproxy `service`/`proxy`/`sessionkey` packages, `management/server/permissions` + `activity`.
+- **Downstream:** [management/handlers (HTTP wiring)](22-management-handlers-wiring.md), [proxy/middleware-builtin](31-proxy-middleware-builtin.md), network-map controller (`injectAllProxyPolicies` fan-out).
+- **End-to-end flow:** [../01-end-to-end-flows.md](../01-end-to-end-flows.md) — "Provider create → reconcile → proxy push → peer map refresh" and "request → policy select → record" diagrams.
+- **Top-level:** [../00-overview.md](../00-overview.md)
diff --git a/docs/agent-networks/modules/22-management-handlers-wiring.md b/docs/agent-networks/modules/22-management-handlers-wiring.md
new file mode 100644
index 000000000..9b8a47445
--- /dev/null
+++ b/docs/agent-networks/modules/22-management-handlers-wiring.md
@@ -0,0 +1,203 @@
+# management/handlers + wiring — HTTP API + gRPC delivery
+
+> **Risk level:** Medium — the surface is mostly additive, but two changes are load-bearing: `injectAllProxyPolicies` runs on every per-peer compute, and `shallowCloneMapping` must round-trip `Private` (a missed field silently breaks every MODIFIED).
+> **Backward-compat impact:** Additive on the wire (new routes, new RPCs, new proto fields, new gorm column on `AccessLogEntry`). One management-internal break: `nbhttp.NewAPIHandler` gains a trailing `agentNetworkManager` parameter; `nil` is tolerated and silently skips route registration.
+
+## Module boundary
+
+This module is the seam between the public Agent Network HTTP API and the proxy fleet that serves agent traffic. North side: a `/api/agent-network/*` surface (providers, policies, guardrails, budget rules, settings, consumption) on the existing gorilla router, delegating to `agentnetwork.Manager`. Handlers are thin — they translate `api.*` ↔ `types.*`, validate shape, forward. RBAC and event emission stay inside the manager (`manager.go:680-682`).
+
+South side: `ProxyServiceServer` (`proxy.go`) learns to (a) ship synth services to a proxy on initial snapshot, (b) resolve agent-network domains in `getServiceByDomain` for OIDC/session/tunnel-peer flows, (c) gate LLM requests via `CheckLLMPolicyLimits` + `RecordLLMUsage`, (d) preserve `Private` through `shallowCloneMapping` so per-proxy live updates don't silently flip services public. The network_map controller prepends synth services to `account.Services` on every per-peer compute; `accesslogentry.go` gains an indexed `AgentNetwork` column so the dashboard can filter cheaply.
+
+## Files
+
+| Path | Role |
+| ---- | ---- |
+| `handlers/agentnetwork/providers_handler.go` | Catalog + provider CRUD + central `AddEndpoints` |
+| `handlers/agentnetwork/policies_handler.go` | Policy CRUD + shared `validatePolicy*` |
+| `handlers/agentnetwork/guardrails_handler.go` | Guardrail CRUD |
+| `handlers/agentnetwork/budget_handler.go` | Account-level budget rule CRUD |
+| `handlers/agentnetwork/settings_handler.go` | GET (200+`null` if unbootstrapped) + PUT toggles |
+| `handlers/agentnetwork/consumption_handler.go` | Read-only consumption rows |
+| `handlers/agentnetwork/handlers_test.go` | Real-store fixture; wire round-trip + validation |
+| `handlers/agentnetwork/budget_handler_test.go` | Budget-rule + settings toggles |
+| `server/http/handler.go` | New `agentNetworkManager` arg; conditional `AddEndpoints` |
+| `server/permissions/modules/module.go` | New `AgentNetwork` module key |
+| `internals/server/boot.go` | Wires synthesiser adapter + limits service into proxy server |
+| `internals/server/modules.go` | `AgentNetworkManager()` lazy-create node |
+| `internals/controllers/network_map/controller/controller.go` | `injectAllProxyPolicies` replaces 4 `InjectProxyPolicies` calls |
+| `internals/controllers/network_map/controller/repository.go` | `SynthesizeAgentNetworkServices` repo method |
+| `internals/modules/reverseproxy/service/service.go` | `MiddlewareConfig`, capture limits, `AgentNetwork`, `DisableAccessLog` + proto |
+| `internals/modules/reverseproxy/accesslogs/accesslogentry.go` | Indexed `AgentNetwork bool` from proto |
+| `internals/shared/grpc/proxy.go` | Synth wiring, 2 RPCs, domain fallback, `Private` in clone |
+| `internals/shared/grpc/proxy_clone_test.go` | Locks every `ProxyMapping` field minus `AuthToken` |
+| `server/activity/codes.go` | 13 new activity codes (125-137) |
+
+## HTTP routes added
+
+All routes inherit the platform's auth middleware. Perms enforced inside `agentnetwork.Manager.requirePermission` (`manager.go:680-682`) on `modules.AgentNetwork`. Permission column shows the `op` passed to `requirePermission` — read = `Read`, etc.
+
+| Method | Path | Perm | Handler |
+| ------ | ---- | ---- | ------- |
+| GET    | `/agent-network/catalog/providers` | authn only | `providers_handler.go:43` |
+| GET    | `/agent-network/providers` | read | `providers_handler.go:57` |
+| POST   | `/agent-network/providers` | create | `providers_handler.go:97` |
+| GET    | `/agent-network/providers/{providerId}` | read | `providers_handler.go:77` |
+| PUT    | `/agent-network/providers/{providerId}` | update | `providers_handler.go:132` |
+| DELETE | `/agent-network/providers/{providerId}` | delete | `providers_handler.go:172` |
+| GET    | `/agent-network/policies` | read | `policies_handler.go:32` |
+| POST   | `/agent-network/policies` | create | `policies_handler.go:72` |
+| GET    | `/agent-network/policies/{policyId}` | read | `policies_handler.go:52` |
+| PUT    | `/agent-network/policies/{policyId}` | update | `policies_handler.go:102` |
+| DELETE | `/agent-network/policies/{policyId}` | delete | `policies_handler.go:142` |
+| GET    | `/agent-network/guardrails` | read | `guardrails_handler.go:25` |
+| POST   | `/agent-network/guardrails` | create | `guardrails_handler.go:65` |
+| GET    | `/agent-network/guardrails/{guardrailId}` | read | `guardrails_handler.go:45` |
+| PUT    | `/agent-network/guardrails/{guardrailId}` | update | `guardrails_handler.go:95` |
+| DELETE | `/agent-network/guardrails/{guardrailId}` | delete | `guardrails_handler.go:135` |
+| GET    | `/agent-network/budget-rules` | read | `budget_handler.go:24` |
+| POST   | `/agent-network/budget-rules` | create | `budget_handler.go:64` |
+| GET    | `/agent-network/budget-rules/{ruleId}` | read | `budget_handler.go:44` |
+| PUT    | `/agent-network/budget-rules/{ruleId}` | update | `budget_handler.go:95` |
+| DELETE | `/agent-network/budget-rules/{ruleId}` | delete | `budget_handler.go:135` |
+| GET    | `/agent-network/settings` | read | `settings_handler.go:53` (200+`null` if no row) |
+| PUT    | `/agent-network/settings` | update | `settings_handler.go:27` |
+| GET    | `/agent-network/consumption` | read | `consumption_handler.go:21` |
+
+## gRPC RPCs added (or modified)
+
+| RPC | Direction | Trigger |
+| --- | --------- | ------- |
+| `CheckLLMPolicyLimits` | proxy→mgmt unary | Pre-flight gate; returns allow/deny, selected policy, attribution group, window, deny code+reason (`proxy.go:259-301`). `Unimplemented` when limits service is nil. |
+| `RecordLLMUsage` | proxy→mgmt unary | Post-flight write of tokens+cost against policy-window dimensions + every applicable account budget rule (`proxy.go:303-349`). `window_seconds==0` ⇒ no policy cap, only account fan-out runs. |
+| `GetMappingUpdate`/`SendServiceUpdate` (stream) | mgmt→proxy | Snapshot (`proxy.go:752-780`) now appends `SynthesizeServicesForCluster`. Live updates use `SendServiceUpdateToCluster` + `shallowCloneMapping`. |
+
+## Architecture & flow
+
+### HTTP request lifecycle
+
+```mermaid
+sequenceDiagram
+    participant DB as Dashboard
+    participant R as gorilla.Router (/api)
+    participant H as handler (agentnetwork)
+    participant M as agentnetwork.Manager
+    participant S as store.Store
+    participant AM as accountManager (StoreEvent)
+
+    DB->>R: POST /api/agent-network/providers
+    R->>H: createProvider (auth mw sets UserAuth)
+    H->>H: GetUserAuthFromContext + validate(req)
+    H->>M: CreateProvider(userID, provider, bootstrapCluster)
+    M->>M: requirePermission(AgentNetwork, Create)
+    M->>S: SaveAgentNetworkProvider
+    M->>AM: StoreEvent(AgentNetworkProviderCreated)
+    M-->>H: created provider
+    H-->>DB: 200 + api.AgentNetworkProvider JSON
+```
+
+### Synth-service delivery via gRPC
+
+```mermaid
+sequenceDiagram
+    participant P as Proxy
+    participant G as ProxyServiceServer
+    participant SM as service.Manager (persisted)
+    participant SA as synthesizerAdapter
+    participant AN as SynthesizeServicesForCluster
+    participant ST as store.Store
+
+    Note over P,G: Initial snapshot
+    P->>G: GetMappingUpdate (stream open)
+    G->>SM: GetServicesForCluster(conn.address)
+    SM-->>G: persisted []*Service
+    G->>SA: SynthesizeServicesForCluster(conn.address)
+    SA->>AN: SynthesizeServicesForCluster(store, clusterAddr)
+    AN->>ST: walk every account; read providers/policies/settings
+    AN-->>SA: in-memory []*Service
+    SA-->>G: []*Service
+    G->>P: response (persisted + synth)
+
+    Note over G,P: Per-request live update
+    G->>G: SendServiceUpdateToCluster(update, clusterAddr)
+    G->>G: shallowCloneMapping(update)   %% Private MUST survive
+    G->>P: response with single mapping
+```
+
+End-to-end: HTTP write persists rows and emits an activity event; the manager then triggers `proxyController.SendServiceUpdate` so proxies re-render. **The snapshot path is the only one that calls into the synthesiser** — on stream open it pulls persisted services then appends synth services for the cluster. Synth services are never persisted. For OIDC/session/tunnel-peer flows, `getServiceByDomain` falls back to `SynthesizeServicesForCluster(clusterFromDomain(domain))` when persisted lookup misses (`proxy.go:1763-1793`). The network_map contribution is orthogonal: per-peer compute prepends the same synth services to `account.Services` before `InjectProxyPolicies`.
+
+## Permissions model added
+
+- `permissions/modules/module.go:22` adds `AgentNetwork Module = "agent_network"`, registered in `All` (`module.go:42`). Standard `operations.{Read,Create,Update,Delete}` matrix.
+- Handlers don't call `permissionsManager` directly — they extract `UserAuth` and delegate to `agentnetwork.Manager`, which gates every mutation through `requirePermission` (`manager.go:168, 308, 549`, etc.). Confirm your role-set provider has `agent_network` rows for owner/admin/user/billing-admin before merging.
+- `getCatalogProviders` (`providers_handler.go:43`) intentionally skips RBAC — catalog is global static data.
+
+## Activity codes added
+
+`activity/codes.go:244-274` adds Activities 125-137 + string/code mappings (`codes.go:428-444`), following `<domain>.<resource>.<action>` (e.g., `agent_network.provider.create`). Audit-log exporters / SIEM forwarders need to know the new codes.
+
+## Invariants
+
+- **Synth services are never persisted.** Snapshot appends after `serviceManager.GetServicesForCluster` (`proxy.go:761-770`); network_map prepends before `InjectProxyPolicies` (`controller.go:117-126`).
+- **`shallowCloneMapping` must round-trip every `ProxyMapping` field except `AuthToken`** — `proxy_clone_test.go:50-58` enforces via `gproto.Equal`. The bug it guards: a missing `Private` made every MODIFIED arrive `private=false`, the proxy skipped `ValidateTunnelPeer`, `UserGroups` stayed empty, `llm_router` denied `no_authorised_provider`; a restart "fixed" it because the snapshot uses the original mapping.
+- **Limit-window floor is 60s** (`policies_handler.go:189-220`); enabled cap with both per-group and per-user at zero is rejected. Budget rules reuse the same validator (`budget_handler.go:170`).
+- **Manager is optional at boot.** `NewAPIHandler` registers routes only when non-nil (`handler.go:129`); `ProxyServiceServer` returns `Unimplemented` from both RPCs when limits service is unwired (`proxy.go:262-265, 306-309`).
+- **Settings GET on an unbootstrapped account returns 200 + `null`** (`settings_handler.go:65-72`) — not 404.
+
+## Things to scrutinize
+
+### Correctness
+- **`injectAllProxyPolicies` runs on every per-peer compute**: `controller.go:163, 309, 415, 681`. `sendUpdateAccountPeers` is the target of the buffered fan-out — synth runs once per debounced account-update tick **and** once per direct `UpdateAccountPeer`. Cost is O(providers + policies × users-per-group) per account under `LockingStrengthNone`. No per-account synth cache — verify it fits the buffer interval for your largest tenant.
+- **`clusterFromDomain` strips at the first `.`** (`proxy.go:1784-1792`). A zero-dot domain returns `""` and the synth call walks every account. Confirm no path reaches this with a malformed/internal domain.
+- **Account-budget `RecordConsumption` fans out even when `window_seconds == 0`** (`proxy.go:341-348`) — intentional. Verify the proxy never sends `RecordLLMUsage` for a request that wasn't actually allowed.
+
+### Security
+- Every handler extracts `UserAuth` via `nbcontext.GetUserAuthFromContext` before any work. Routes live behind the standard `/api` mux; bypass list is not extended.
+- `CheckLLMPolicyLimits` / `RecordLLMUsage` ride the existing **proxy → mgmt** gRPC connection auth. No additional token check inside the RPCs — they trust the connection. Confirm the proxy-side token-verification interceptor in this package gates both.
+- `RecordLLMUsage` only validates `account_id != ""` (`proxy.go:317-319`). A compromised proxy can attribute cost to any account in its cluster — was already true for prior RPCs but is louder now that data drives denials.
+
+### Concurrency
+- `SetAgentNetworkSynthesizer` / `SetAgentNetworkLimitsService` write under `s.mu.Lock`; read paths copy the interface under read lock (`proxy.go:236-247, 260-263, 304-307`). Same pattern as existing `serviceManager`/`proxyController` setters.
+- Manager writes use `LockingStrengthUpdate`; synth reads use `LockingStrengthNone` — read-after-write via the proxy snapshot can observe a stale view by up to one fan-out tick.
+- Network_map controller is single-threaded per account; cross-account is parallel.
+
+### Backward compatibility
+- `proxy_clone_test.go` is the regression net; any new `ProxyMapping` field must be cloned or explicitly nulled in the test.
+- `AccessLogEntry` adds indexed `AgentNetwork bool` — implicit AutoMigrate; deploy story must handle table-rewrite cost on high-volume access-log tables.
+- `TargetOptions` gains seven `omitempty` JSON fields (`service.go:69-94`); on-wire shape stays compatible. `targetOptionsToProto` tests all fields when deciding nil (`service.go:551-556`).
+- `NewAPIHandler` signature changes — every caller must pass `agentNetworkManager`; `nil` is supported.
+
+### Observability
+- 13 new activity codes via `accountManager.StoreEvent` in the manager — confirm dashboard's audit-log UI maps them.
+- `AccessLogEntry.AgentNetwork` is indexed for the dashboard's agent-network log filter.
+- New RPCs log at error level on store/selector failures (`proxy.go:284, 327, 332, 348`). Snapshot synth failures degrade to warnings — stream is not aborted (`proxy.go:765`).
+
+## Test coverage
+
+| Test | Locks down |
+| ---- | ---------- |
+| `handlers_test.go::TestPolicyHandler_WindowSecondsRoundTrip` | GET carries `window_seconds`; legacy `window_hours`/`window_days` absent. |
+| `handlers_test.go::TestPolicyHandler_RejectsSubMinuteWindow` | POST `<60s` returns 4xx. |
+| `handlers_test.go::TestConsumptionHandler_EmptyAccountReturnsArray` | `/consumption` returns `[]` — never null. |
+| `handlers_test.go::TestConsumptionHandler_PopulatedAccountListsRows` | RecordConsumption×2 surfaces both with correct tokens/cost/window. |
+| `budget_handler_test.go::TestBudgetRuleHandler_RoundTrip` | Targets + PolicyLimits shape round-trip. |
+| `budget_handler_test.go::TestBudgetRuleHandler_ListReturnsArray` | Empty-list shape. |
+| `budget_handler_test.go::TestBudgetRuleHandler_{RejectsMissingName,RejectsSubMinuteWindow}` | Validation rejections are 4xx. |
+| `budget_handler_test.go::TestSettingsHandler_GetExposesCollectionToggles` | All four toggles + computed `Endpoint`. |
+| `proxy_clone_test.go::TestShallowCloneMapping_PreservesAllFieldsExceptAuthToken` | Future-proofs clone; every field round-trips, `AuthToken` dropped. |
+
+Handler tests use a real sqlite store + real manager + always-allow permissions mock (`handlers_test.go:53-75`). Create/update/delete success paths flow through `accountManager.StoreEvent` which the fixture doesn't wire — covered by manager-level no-mock tests outside this module.
+
+## Known limitations / explicit non-goals
+
+- No pagination on any list endpoint; no bulk endpoints.
+- Synth result is not cached — every snapshot and every per-peer compute repeats the store walk.
+- `getSettings` returning `200 + null` is a deliberate dashboard concession.
+- No rate-limiting beyond the global `/api` rate limiter.
+
+## Cross-references
+
+- Upstream: [shared/api](10-shared-api.md), [management/agentnetwork](21-management-agentnetwork.md), [management/store](20-management-store.md)
+- Downstream: [proxy/runtime](33-proxy-runtime.md)
+- End-to-end flow: [../01-end-to-end-flows.md](../01-end-to-end-flows.md)
+- Top-level: [../00-overview.md](../00-overview.md)
diff --git a/docs/agent-networks/modules/30-proxy-middleware-framework.md b/docs/agent-networks/modules/30-proxy-middleware-framework.md
new file mode 100644
index 000000000..39322fdce
--- /dev/null
+++ b/docs/agent-networks/modules/30-proxy-middleware-framework.md
@@ -0,0 +1,215 @@
+# proxy/middleware-framework — generic plugin system
+
+> **Risk level:** **High** — every proxied request transits this chain. Budget exhaustion, panic recovery, or chain-close bugs hit the hot path for all targets, not just agent-network ones.
+> **Backward-compat impact:** Additive at the proxy. The `middleware` and `bodytap` packages are new (`proxy/internal/middleware/middleware.go:1`, `proxy/internal/middleware/bodytap/request.go:13`); existing proxy targets keep working until a chain is bound to them via `Manager.Rebuild`.
+
+This module is the **framework only** — no LLM/agent-network domain knowledge is required, since every example built into it is generic.
+
+## Module boundary
+
+This module is the **framework only**: slots, chains, registry, dispatcher, accumulator, body-tap, output filters. No middleware *implementation* lives here — those land in `proxy/internal/middleware/builtin/*` (covered in module 31). The package contract is:
+
+1. The proxy hands a `Manager` to its config-apply path. The synth pushes per-path `PathTargetBinding` lists (`proxy/internal/middleware/manager.go:26`) into `Manager.Rebuild`, which resolves each spec via the `Registry`/`Resolver` (`proxy/internal/middleware/registry.go:81-121`) and produces an immutable `Chain` keyed by `serviceID|pathID` (`proxy/internal/middleware/manager.go:410-412`).
+2. The reverse-proxy handler captures the request body via `bodytap.CaptureRequest`, calls `Chain.RunRequest`, applies returned mutations (already filtered by `chain.applyMutations`), forwards to the upstream behind a `bodytap.CapturingResponseWriter`, then calls `Chain.RunResponse` and `Chain.RunTerminal`.
+3. Middlewares are inert plugins that receive a deep-cloned `Input` and return an `Output` whose decision/mutations are clamped by the dispatcher's `filterOutput` (`proxy/internal/middleware/dispatcher.go:149-172`).
+
+Everything that crosses the framework boundary in either direction is value-typed and deep-copied — middlewares cannot mutate the live request directly, and the framework cannot inadvertently leak middleware-owned slices into the request hot path.
+
+## Files
+
+| Path | Role |
+| ---- | ---- |
+| `proxy/internal/middleware/middleware.go` | `Middleware` + `Factory` interfaces. |
+| `proxy/internal/middleware/types.go` | `Slot`, `FailMode`, `Decision`, all limit constants, `Input`/`Output`/`Mutations`/`UpstreamRewrite`/`AuthHeader` value types. |
+| `proxy/internal/middleware/spec.go` | Apply-time `Spec` (validated wire shape + runtime-injected fields) and `Clone`. |
+| `proxy/internal/middleware/registry.go` | `Registry` (factory map, RWMutex) and `Resolver` (Spec → bound `Middleware`). |
+| `proxy/internal/middleware/manager.go` | `Manager`, `chainTable` reverse index, `Rebuild`/`Invalidate*`, async chain close. |
+| `proxy/internal/middleware/chain.go` | `Chain.RunRequest`/`RunResponse`/`RunTerminal`, mutation gating, `cloneInputFor`. |
+| `proxy/internal/middleware/chain_test.go` | Metadata threading, LIFO response order, rewrite gating, UserGroups propagation, terminal accumulation. |
+| `proxy/internal/middleware/dispatcher.go` | Timeout/panic recovery, fail-mode, error classification, `filterOutput`. |
+| `proxy/internal/middleware/decision.go` | `RenderDenyResponse`, deny-code regex, status clamp. |
+| `proxy/internal/middleware/headerpolicy.go` | Compile-in header denylist + `FilterHeaderMutations`. |
+| `proxy/internal/middleware/bodypolicy.go` | `ValidateBodyReplace` / `ApplyBodyReplace` smuggling guards. |
+| `proxy/internal/middleware/keys.go` | Metadata key namespace constants. |
+| `proxy/internal/middleware/metadata.go` | `Accumulator` — allowlist, per-mw/per-request byte caps, redaction. |
+| `proxy/internal/middleware/metrics.go` | OTel instrument bundle (`proxy.middleware.*`). |
+| `proxy/internal/middleware/redaction.go` | `Scan` — PEM/JWT/AWS/bearer/Luhn-validated CC patterns. |
+| `proxy/internal/middleware/bodytap/request.go` | Capture + replay reader, `Budget` semaphore, bypass reason codes. |
+| `proxy/internal/middleware/bodytap/response.go` | `CapturingResponseWriter` (tee with `PassthroughWriter` for Flusher/Hijacker preservation). |
+
+## Slot model
+
+Three slots, declared per-middleware exactly once (`proxy/internal/middleware/types.go:27-41`):
+
+- **`SlotOnRequest`** (`Slot=1`) — runs **before** the upstream call, in registration order. May `DecisionDeny`, may emit `Mutations` (header add/remove, body replace, `UpstreamRewrite`) when both `Spec.CanMutate` and `Middleware.MutationsSupported()` are true. May emit metadata. Each middleware in the slot sees metadata that earlier ones in the same slot just emitted (`proxy/internal/middleware/chain.go:144-178`) — this is how the framework gives middlewares an intra-slot side channel without a global bag.
+- **`SlotOnResponse`** (`Slot=2`) — runs **after** the upstream returns, in **reverse** registration order. Cannot deny (clamped in `dispatcher.filterOutput`, `proxy/internal/middleware/dispatcher.go:153-157`). May still mutate response headers in principle, but the current chain only forwards `RewriteUpstream` from on_request, so on_response mutations are observe-only in practice. Threads the same per-slot metadata view as on_request.
+- **`SlotTerminal`** (`Slot=3`) — runs **after** every on_response middleware has emitted, in registration order. Sees the full accumulated bag plus prior terminal emissions (`chain.go:221-245`). Cannot deny, cannot mutate (`dispatcher.go:168-170`). Designed for sinks (access log, metrics push, audit emitter).
+
+Splitting a feature across slots (e.g. "parse on the way out, ship on terminal") is the explicit architectural choice — `types.go:7-15` and `types.go:22-25` make it clear no middleware participates in more than one slot.
+
+## Architecture & flow
+
+### Chain dispatch
+
+```mermaid
+sequenceDiagram
+    autonumber
+    participant H as proxy HTTP handler
+    participant BT as bodytap.CaptureRequest
+    participant CH as Chain
+    participant DI as Dispatcher
+    participant MW as Middleware (per slot)
+    participant US as Upstream
+    participant CW as CapturingResponseWriter
+
+    H->>BT: CaptureRequest(r, cfg, budget)
+    BT-->>H: body[], truncated, release()
+    H->>CH: RunRequest(ctx, r, Input, Accumulator)
+    loop on_request, registration order
+        CH->>CH: cloneInputFor(in, OnRequest)
+        CH->>DI: Invoke(ctx, spec, mw, call)
+        DI->>MW: mw.Invoke(callCtx, in)
+        MW-->>DI: Output{decision, metadata, mutations?}
+        DI->>DI: filterOutput (clamp deny, gate mutations)
+        DI-->>CH: filtered Output
+        CH->>CH: Accumulator.Emit (allowlist + caps + redact)
+        alt DecisionDeny
+            CH-->>H: denied, merged, rewrite
+        else allow
+            CH->>CH: applyMutations(r, m) and capture rewrite
+        end
+    end
+    CH-->>H: nil, merged, rewrite
+    H->>US: ProxyRequest (with rewrite/mutations applied)
+    US-->>CW: bytes (streamed, tee'd into cap-bounded buf)
+    CW-->>H: passthrough complete
+    H->>CH: RunResponse(ctx, Input{RespBody:CW.Body(),...}, acc)
+    loop on_response, REVERSE order (LIFO)
+        CH->>DI: Invoke (same wrappers)
+    end
+    H->>CH: RunTerminal(ctx, Input{Metadata:full bag}, acc)
+    H->>BT: release() + CW.Release()
+```
+
+### Body-tap mechanics (request + response)
+
+```mermaid
+flowchart LR
+    subgraph req[Request capture — bodytap.CaptureRequest]
+        R0[r.Body] --> R1{cfg.MaxRequestBytes > 0?\nUpgrade absent?\nContent-Type allowed?\nCL <= cap?}
+        R1 -- no --> R2[bypass = reason\nbody = nil\nr.Body untouched]
+        R1 -- yes --> R3[Budget.Acquire(cap)]
+        R3 -- denied --> R4[bypass=BypassBudget]
+        R3 -- ok --> R5[io.LimitReader(r.Body, cap+1)\nio.ReadAll]
+        R5 --> R6{len > cap?}
+        R6 -- truncated --> R7[viewable = buf[:cap]\nr.Body = replayReadCloser{buf, tail}]
+        R6 -- whole --> R8[r.Body = NopCloser(bytes.Reader(buf))\nclose original]
+        R7 --> R9[(release captured\nbudget on req end)]
+        R8 --> R9
+    end
+
+    subgraph resp[Response capture — CapturingResponseWriter]
+        W0[client] -.-> CW[Write(p)]
+        CW --> P1[PassthroughWriter.Write(p)\n— bytes leave to client first]
+        P1 --> P2{!stopped?}
+        P2 -- yes --> P3{remaining = cap - buf.Len()}
+        P3 --> P4[buf.Write(p[:take])\nset truncated if take<n]
+        P2 -- no --> P5[silent drop into the tee\n(client write already done)]
+    end
+```
+
+The body-tap is the highest-leak-risk surface in this module; three details matter:
+
+1. **Request capture is "read-and-replay", not "read-and-forward".** `CaptureRequest` always swaps `r.Body` for either a `bytes.Reader` (whole body fit) or a `replayReadCloser` that replays the captured prefix then drains the remaining stream from the original body (`bodytap/request.go:178-201`). This means the **upstream still sees the full body even when the tap truncates**. The original `r.Body` is **not** closed in the truncated branch — `replayReadCloser.Close()` only closes the tail (`bodytap/request.go:199-201`), which is the same reader, so close once on request end is correct, but reviewers should confirm the upstream proxy always reads to EOF (otherwise the tail is leaked).
+2. **Response capture is a write-through tee.** `CapturingResponseWriter.Write` forwards to the underlying writer **first** (`bodytap/response.go:116-117`), then tees into `buf` under its own mutex. Client never blocks on the tee. `Flusher`/`Hijacker` are preserved via the embedded `responsewriter.PassthroughWriter`. SSE/chunked streams flow through untouched; middlewares only see the bounded prefix.
+3. **Budget is a single shared semaphore.** `Manager` constructs one `bodytap.Budget` at startup (`manager.go:138-144`, default `256 MiB` from `bodytap/request.go:39`). Every capture pre-acquires its full `MaxRequestBytes` / `MaxResponseBytes` from the budget regardless of actual body size; that prevents a flood of small captures from collectively exceeding the cap, but it also means a misconfigured `MaxRequestBytes = 1 MiB` with 256 concurrent requests already exhausts the default budget. Reviewers should sanity-check the operator-facing defaults that ship with synth-service.
+
+The framework explicitly aborts capture (and increments `proxy.middleware.capture_bypass_total`) before reading the first byte when `Upgrade`/`Connection: upgrade` is set (`bodytap/request.go:120-125`), when the content-type isn't in the allowlist (`bodytap/request.go:126-128`), or when the advertised `Content-Length` already exceeds the cap (`bodytap/request.go:131-133`). This is the right place to make sure WebSocket upgrades and large file uploads never reach the buffer.
+
+## Public contracts
+
+- **`Middleware` interface** (`middleware.go:14-36`): `ID()`, `Version()`, `Slot()`, `AcceptedContentTypes()`, `MetadataKeys()`, `MutationsSupported()`, `Invoke(ctx, *Input) (*Output, error)`, `Close()`. `MetadataKeys()` is the **closed set** the middleware is allowed to emit — the accumulator drops anything outside it (`metadata.go:71-75`). `Close` must be idempotent (called even when `Invoke` was never reached).
+- **`Factory` interface** (`middleware.go:44-47`): `ID()`, `New(rawConfig []byte) (Middleware, error)`. `RawConfig` is opaque JSON bytes on the wire (`spec.go:6-12`); each factory owns its own typed config.
+- **`Decision` type** (`types.go:59-69`): `Allow=0`, `Deny=1`, `Passthrough=2`. Default-zero is permissive — important because every middleware that omits `Decision` gets `Allow`. Dispatcher clamps `Deny` to `Passthrough` outside `SlotOnRequest` (`dispatcher.go:153-157`).
+- **`Mutations`** (`types.go:196-201`): `HeadersAdd`/`HeadersRemove` (filtered through `headerpolicy.go`), `BodyReplace` (gated through `bodypolicy.go`), and `RewriteUpstream`. `RewriteUpstream` is **last-write-wins** within the on_request slot (`chain.go:170-172`, locked down by `TestChain_RunRequest_LatestRewriteWins`).
+- **Metadata propagation keys** (`keys.go`): all keys live in a single file and follow `^[a-z][a-z0-9_-]*(\.[a-z0-9_-]*)+$` (`metadata.go:8`). Framework-injected error tagging uses `mw.<id>.error_kind` (`keys.go:81`) so operators can distinguish framework-emitted entries from middleware-emitted ones.
+
+## Invariants
+
+- **Per-request context isolation.** `cloneInputFor` deep-copies every mutable field (`Headers`, `RespHeaders`, `Metadata`, `Body`, `RespBody`, `UserGroups`, `UserGroupNames`) before each invocation (`chain.go:286-308`). A misbehaving middleware that mutates `in.Headers` only corrupts its own copy.
+- **Body-tap bounded by capture limit.** Request side uses `io.LimitReader(r.Body, limit+1)` (`bodytap/request.go:152`) — the `+1` is how the code detects truncation (`bodytap/request.go:160`); the surfaced buffer is sliced back down to `limit`. Response side stops teeing once `buf.Len() >= cap` (`bodytap/response.go:121-133`). Neither side can grow the buffer past the configured cap.
+- **Headers/body redaction order.** Accumulator runs `Scan(value)` **before** counting cost (`metadata.go:81-82`), so the byte budgets are computed against post-redaction sizes. `Scan` order is PEM → JWT → AWS key → bearer → Luhn-validated CC (`redaction.go:25-51`) — the comment block in `redaction.go:8-13` is explicit that this is best-effort, not DLP.
+- **No middleware can starve the chain.** Every invocation runs inside `context.WithTimeout(ctx, clampTimeout(spec.Timeout))` in a separate goroutine (`dispatcher.go:51-94`), with the deadline race-`select`ed against the result channel. A blocked middleware fires the timeout path, gets fail-mode'd, and `IncError(kind=timeout)`. Timeouts are clamped to `[10ms, 5s]` (`types.go:80-86`, `dispatcher.go:174-185`).
+- **Panic recovery.** `recover()` captures the panic, logs only the type + a 4 KiB stack prefix (no panic value — avoids leaking secrets the middleware was processing), and produces a `panicError` that flows through fail-mode (`dispatcher.go:64-76`).
+- **Chain immutability + atomic swap.** `chainTable` is cloned on every `Rebuild`/`Invalidate*` and swapped via `atomic.Pointer` (`manager.go:44-69`, `manager.go:221-300`). Readers (`ChainFor`) are lock-free; writers serialise on `writeMu`. The retired chain is `Close`-d in a background goroutine bounded by `chainCloseTimeout = 2 * MaxTimeout` (`manager.go:21-22`, `manager.go:326-346`), so in-flight invocations finish on the old chain after the swap.
+
+## Things to scrutinize
+
+### Correctness
+
+- **Chain ordering deterministic from synth output?** `Manager.buildChain` iterates `b.Specs` in slice order and appends to `bound` (`manager.go:366-391`); `NewChain` then partitions by slot but **preserves slice order within each slot** (`chain.go:50-60`). So order on the wire = order observed at runtime. Synth must therefore emit specs in the intended execution order — there is no per-spec `Priority` field. Worth flagging.
+- **Decision short-circuit semantics.** `RunRequest` returns immediately on `DecisionDeny` (`chain.go:164-167`) **with the metadata accumulated so far** plus the `denied.Metadata`. Callers that ignore `merged` on deny will lose framework-injected `mw.<id>.error_kind` entries. The proxy runtime is the only caller; confirm it always feeds `merged` into the access log on the deny path as well.
+- **`UpstreamRewrite` `AuthHeader` bypass** (`types.go:218-235`). The `AuthHeader`/`StripHeaders` fields *intentionally* bypass the header denylist on the basis that the proxy itself rewrites auth. The denylist still blocks middleware-emitted `HeadersAdd: Authorization=...`. This is a delicate carve-out — review the runtime consumer to confirm only the trusted upstream-build path unpacks `AuthHeader`, never the generic `applyMutations` loop.
+- **`replayReadCloser.Close` only closes the tail** (`bodytap/request.go:199-201`). The replay buffer doesn't own a resource, so this is correct, but it conflates "replay finished" with "underlying body closed". If a caller `Close()`s without reading to EOF, the original body is closed but the captured prefix is lost; harmless for the proxy path (upstream always reads to EOF) but worth a doc-comment.
+
+### Security
+
+- **Body-tap memory bounds.** Discussed above — bounded by `MaxBodyCapBytes = 1 MiB` per direction (`types.go:77`) and the shared `Budget` (default 256 MiB). The concerning case is the **deep-copy in `cloneInputFor`** (`chain.go:300-306`): every middleware invocation gets its **own copy** of `Body` and `RespBody`. A chain of N middlewares with a 1 MiB body allocates N MiB of transient bytes per request. With `MaxMiddlewaresPerChain = 16` (`types.go:103`) that's up to 16 MiB extra per in-flight request. Worth pricing into the budget model.
+- **Header redaction completeness.** `denyHeaders` (`headerpolicy.go:5-17`) covers the auth/forwarding family and framing (`Content-Length`, `Transfer-Encoding`, `Trailer`). `denyHeaderPrefixes` covers `X-Authenticated-*`, `X-Forwarded-*`, `X-Remote-*`, `X-NetBird-*`. Notably absent: `Range`, `If-Match`/`If-None-Match` (mutation could cause cache poisoning), `Origin`/`Referer`. Not necessarily wrong, but worth a deliberate decision.
+- **Metadata key collisions across middlewares.** The accumulator has no cross-middleware uniqueness check; two middlewares with the same key in their allowlist can both emit it, and both copies land in `merged` (`metadata.go:51-99`). Downstream consumers must tolerate duplicates. Worth documenting.
+- **Deny rendering.** `RenderDenyResponse` only allows codes matching `^[a-z][a-z0-9._-]{0,63}$` (`decision.go:9`), redacts/truncates message + detail values, caps `Details` at 8 entries (`decision.go:42-50`), clamps status to `[400,499]\{401}` (`decision.go:65-73`). The deny body type is fixed; middlewares cannot inject arbitrary JSON.
+
+### Concurrency
+
+- **Per-request state vs shared state in factories.** Each `Factory.New` is called once per chain build; the returned `Middleware` instance is **shared across all requests** for that chain. `Invoke` must be reentrant. The framework does not enforce this — a buggy middleware that holds per-call state on the struct will silently race. Suggest a `// Invoke must be safe for concurrent use` doc on the interface.
+- **`chainTable` clone-on-write** is correct, but `addChain`/`removeChain` mutate the *cloned* table before the swap (`manager.go:71-108`), and they're called under `writeMu`. Readers only ever see the post-swap pointer. Good.
+- **`Chain.inflight` WaitGroup**. `Run*` does `Add(1)`/`Done()` (`chain.go:142-143`, `chain.go:194-195`, `chain.go:225-226`); `Close` waits on it bounded by ctx (`chain.go:75-85`). One concern: a *new* `RunRequest` can `Add(1)` *after* `Close` started waiting if the caller still holds a stale chain pointer. `WaitGroup` does not panic on this if the count was already > 0 at `Wait` time, but it does panic if `Add` happens after `Wait` returns and another `Wait` runs. `Close` is documented one-shot, so single-`Wait` is fine, but callers must drop the chain reference before calling `Close`. Worth a code comment near `Close`.
+- **Goroutine leaks.** `Dispatcher.Invoke` spawns one goroutine per call and *always* writes to a buffered (cap=1) channel (`dispatcher.go:62-76`), so even if the timeout fires the goroutine completes its send and exits. No leak.
+- **`closeChainsAsync`** detaches retired chains into a goroutine (`manager.go:326-346`). If `Manager` is never GC'd this is fine, but there's no shutdown hook to wait on outstanding closes. Reviewers should confirm the proxy shutdown path explicitly drains in-flight requests before tearing down `Manager`, or accept that the last chain-close round may be cut short on exit.
+
+### Performance
+
+- **Allocations per request.** `cloneInputFor` allocates new slices for `Headers`, `RespHeaders`, `Metadata`, `Body`, `RespBody`, `UserGroups`, `UserGroupNames` — once per middleware per request. For a typical 5-middleware chain on a 1 KiB body that's ~10 small slice allocs plus one `Body` copy each. Not a hot-path crisis, but `sync.Pool` for the per-call `Input` would be a natural follow-up.
+- **Accumulator allocates a fresh `allowSet` per `Emit` call** (`metadata.go:55-58`). One per middleware per slot pass = up to 48 per request. Cheap, but worth noting.
+- **Regex cost.** `Scan` runs five regex passes on every accepted metadata value (`redaction.go:25-51`). Bounded by `MaxMetadataValueBytes = 4 KiB` so worst case is small.
+
+### Observability
+
+- **Per-middleware metrics.** `proxy.middleware.requests_total{middleware,target_id,outcome}` (`metrics.go:34-41`), `duration_ms`, `invocations_total`, `errors_total{kind}`, `metadata_rejected_total{reason}`, `header_mutation_blocked_total{header}`, `capture_bypass_total{reason}`. Comprehensive surface; operators can alert on `errors_total{kind=panic}` and `errors_total{kind=timeout}` separately. **Latency histogram is in milliseconds with default OTel buckets** — for a 10ms–5s timeout range default buckets cover OK, but a custom bucket set centred on 1–500ms would resolve the agent-network response-parser tail better.
+- **Decision logs.** Panic logs (`dispatcher.go:69`) include `request_id`, type, and stack but not the panic value (safe). `Chain.Close` logs middleware-close errors at debug (`chain.go:91`). `applyMutations` logs body-replace rejections at warn (`chain.go:278`). No log on the deny path itself — by design, since the access-log terminal middleware is expected to record outcomes.
+
+## Test coverage
+
+| Test file | Locks down |
+| --------- | ---------- |
+| `proxy/internal/middleware/chain_test.go:77` | `RunRequest` threads metadata across on_request middlewares (regression for the "later mw can't see earlier mw's emissions" bug). |
+| `chain_test.go:110` | `RunResponse` reverse-order threading. |
+| `chain_test.go:142` | `cost_meter`-shaped scenario: response_parser registered after cost_meter still emits *before* cost_meter sees the bag (guards the `cost.skipped=missing_tokens` regression). |
+| `chain_test.go:178` | `UpstreamRewrite` last-write-wins. |
+| `chain_test.go:206` | No middleware emits → nil rewrite. |
+| `chain_test.go:224` | Rewrite filtered when `CanMutate=false`. |
+| `chain_test.go:245` | `Input.UserGroups` propagates verbatim through `cloneInputFor`. |
+| `chain_test.go:304` | Terminal middlewares see the full accumulated bag + prior terminal emissions. |
+
+**Gaps** worth raising with the author:
+- No direct test for `Dispatcher.Invoke` timeout / panic / fail-mode behaviour at the framework level (covered indirectly by built-in tests, but a unit test pinning `errors_total{kind=...}` labels would be cheap insurance).
+- No test for `bodytap.CaptureRequest` truncated replay (the upstream-sees-full-body invariant is exactly the kind of thing a regression would silently break).
+- No test for `Budget` exhaustion behaviour under concurrency.
+- No test for `Manager.InvalidateMiddleware` + `LiveServiceCheck` race (the auth-revocation race the comment at `manager.go:33-38` calls out is the load-bearing reason for `LiveServiceCheck`).
+
+## Known limitations / explicit non-goals
+
+- **No middleware-to-middleware RPC.** Side-channel is metadata only.
+- **No streaming body inspection.** Middlewares see a bounded prefix; SSE / chunked parsing happens against that prefix in the response middleware.
+- **No per-spec priority.** Order is registration order in the spec slice.
+- **No retry / circuit-breaker** on middleware errors. Fail-mode is binary (open/closed) and per-spec.
+- **Mutations cannot rewrite the request URL path or query** — only `RewriteUpstream` can change scheme/host (+ optional path replacement, see `types.go:218-235`).
+- **Redaction is best-effort.** Explicitly documented in `redaction.go:8-13`. Not a DLP solution.
+
+## Cross-references
+
+- Upstream wire shape: [../modules/10-shared-api.md](10-shared-api.md) (Spec/RawConfig encoding from management).
+- Built-in middlewares using this framework: [../modules/31-proxy-middleware-builtin.md](31-proxy-middleware-builtin.md).
+- Runtime wiring (where `Manager`, `Chain`, and `bodytap` are consumed by the HTTP handler): [../modules/33-proxy-runtime.md](33-proxy-runtime.md).
+- End-to-end request flow including capture + chain dispatch: [../01-end-to-end-flows.md](../01-end-to-end-flows.md).
+- Top-level architecture: [../00-overview.md](../00-overview.md).
diff --git a/docs/agent-networks/modules/31-proxy-middleware-builtin.md b/docs/agent-networks/modules/31-proxy-middleware-builtin.md
new file mode 100644
index 000000000..904de6424
--- /dev/null
+++ b/docs/agent-networks/modules/31-proxy-middleware-builtin.md
@@ -0,0 +1,365 @@
+# proxy/middleware-builtin — the LLM chain
+
+The registry-mounted middleware set the proxy executes on every agent-network
+LLM request. The two highest-blast-radius areas are the **capture-pointer
+semantics** and the **limit_check ⇒ limit_record** record-once invariant.
+
+Sibling module: [32-proxy-llm-parsers.md](./32-proxy-llm-parsers.md) — the SDK
+adapters + pricing catalog this chain delegates to.
+
+---
+
+## Module boundary
+
+This module is the registry-mounted middleware set the proxy executes on
+every agent-network LLM request. Each sub-package registers itself via
+`init()`
+([builtin.go:32–34](../../../proxy/internal/middleware/builtin/builtin.go));
+the proxy server anonymous-imports the set
+([all_test.go:11–19](../../../proxy/internal/middleware/builtin/all_test.go))
+so the registry is populated at boot. The chain is wired by the management
+synthesiser and executed by the framework
+(`proxy/internal/middleware/{chain,dispatcher,accumulator}.go` — both out
+of scope). Everything here reads from / writes to one envelope: the
+`middleware.KV` metadata bag plus `middleware.Mutations` for header/body
+rewrites.
+
+## The 8 middlewares
+
+| Name | Slot | Inputs (metadata read) | Outputs (metadata written) | Side effects |
+|---|---|---|---|---|
+| `llm_request_parser` | OnRequest | `Input.{URL,Body,BodyTruncated}` | `llm.{provider,model,stream,request_prompt_raw,capture_truncated}` | none |
+| `llm_router` | OnRequest | `llm.model`, `Input.{URL,UserGroups}` | `llm.{resolved_provider_id,authorising_groups}`, `llm_policy.{decision,reason}` | upstream rewrite + auth strip/inject |
+| `llm_limit_check` | OnRequest | `llm.{resolved_provider_id,model}`, `Input.{AccountID,UserID,UserGroups}` | `llm.{selected_policy_id,attribution_group_id,attribution_window_seconds}`, `llm_policy.{decision,reason}` | gRPC `CheckLLMPolicyLimits` |
+| `llm_identity_inject` | OnRequest | `llm.{resolved_provider_id,authorising_groups}`, `Input.{UserEmail,UserID,UserGroups,UserGroupNames}` | none | header strip/inject + optional body rewrite |
+| `llm_guardrail` | OnRequest | `llm.{model,request_prompt_raw}` | `llm_policy.{decision,reason}`, `llm.request_prompt` | none (model allowlist deny) |
+| `llm_response_parser` | OnResponse | `llm.provider`, `Input.{RespHeaders,RespBody,Status}` | `llm.{input,output,total,cached_input,cache_creation}_tokens`, `llm.response_completion` | none |
+| `cost_meter` | OnResponse | `llm.{provider,model}`, token buckets | `cost.usd_total` or `cost.skipped` | pricing lookup |
+| `llm_limit_record` | OnResponse | `llm.{attribution_group_id,attribution_window_seconds,input_tokens,output_tokens}`, `cost.usd_total` | none | gRPC `RecordLLMUsage` |
+
+[all_test.go:26–40](../../../proxy/internal/middleware/builtin/all_test.go)
+locks the ID set; adding or removing one is a conscious extension.
+
+## Files
+
+| File | LOC | Notes |
+|---|---:|---|
+| `builtin.go` | 86 | Registry + `FactoryContext` (ctx, data dir, meter, logger, mgmt client) |
+| `all_test.go` | 41 | Locks the 8-ID registry surface |
+| `agentnetwork_chain_integration_test.go` | 319 | Live sqlite + real gRPC bufconn; gate→recorder wire path |
+| `llm_request_parser/*` | 162 / 66 / 356 | Provider detection, body parse, prompt extraction with capture-pointer gating |
+| `llm_router/*` | 385 / 84 / 586 | Three-pass route selection (model → groups → path-prefix) |
+| `llm_limit_check/*` | 196 / 38 / 182 | Pre-flight `CheckLLMPolicyLimits` (2s, fail-open) |
+| `llm_identity_inject/*` | 440 / 108 / 666 | HeaderPair (LiteLLM) + JSONMetadata (Portkey) + ExtraHeaders |
+| `llm_guardrail/*` | 176 / 82 / 75 / 219 / 217 | Model allowlist + optional prompt capture with PII redaction |
+| `llm_response_parser/*` | 258 / 222 / 43 / 433 / 169 / 111 | Buffered + SSE accumulation; AWS event-stream accumulator (`streaming_bedrock.go`) for Bedrock; capture-pointer gates completion emit |
+| `cost_meter/*` | 181 / 84 / 439 | Token → USD via `proxy/internal/llm/pricing` |
+| `llm_limit_record/*` | 144 / 35 / 191 | Post-flight `RecordLLMUsage` (5s, debug-on-error) |
+
+## Per-middleware
+
+### llm_request_parser
+
+Detects the LLM provider via `llm.DetectParser` (URL sniff) or by name via
+`llm.ParserByName` when synthesiser stamps `provider_id`
+([middleware.go:96–99](../../../proxy/internal/middleware/builtin/llm_request_parser/middleware.go)).
+**Path-routed providers short-circuit first:** `parseVertexPath` and
+`parseBedrockPath` ([middleware.go:85–94](../../../proxy/internal/middleware/builtin/llm_request_parser/middleware.go))
+pull the model + vendor out of the URL before parser selection runs — Vertex
+from `/v1/projects/.../publishers/{pub}/models/{model}:{action}` (publisher →
+vendor via `vertexPublisherVendor`), Bedrock from `/model/{id}/{action}` with
+`normalizeBedrockModel` stripping the region prefix + version suffix. See
+[50-path-routed-providers.md](./50-path-routed-providers.md) for the full path
+grammar. For body-routed providers it decodes the body into `RequestFacts`
+(model + stream) and extracts the prompt. On
+`capture_prompt=true` (or absent — see capture-pointer semantics below) the
+prompt is run through `llm_guardrail.RedactPII` when `redact_pii=true` and
+truncated rune-safely to 3500 bytes
+([middleware.go:109–122](../../../proxy/internal/middleware/builtin/llm_request_parser/middleware.go)).
+**Key invariant:** redaction is parser-side, not guardrail-side — access-log
+reads `llm.request_prompt_raw` directly.
+
+### llm_router
+
+Three-pass route selection in `matchRoute`
+([middleware.go:241–300](../../../proxy/internal/middleware/builtin/llm_router/middleware.go)):
+filter by `Models` claim → vendor-pin (a vendor-tagged request never crosses to
+another vendor's route) → filter by `AllowedGroupIDs` intersection → model
+precedence over path → tie-break by longest `UpstreamPath` prefix match.
+Model-miss returns `llm_policy.model_not_routable`; known-but-unauthorised
+returns `llm_policy.no_authorised_provider`. **Key invariant:** auth-header
+strip+inject rides on `UpstreamRewrite.{StripHeaders,AuthHeader}`
+([middleware.go:606–646](../../../proxy/internal/middleware/builtin/llm_router/middleware.go))
+— NOT `HeadersAdd/HeadersRemove` — because the framework's mutation gate
+blocks `Authorization` on the generic header path.
+
+**Path-routed providers route before the model table.** `Invoke` checks
+`isVertexPath` / `isBedrockPath`
+([middleware.go:138–216](../../../proxy/internal/middleware/builtin/llm_router/middleware.go))
+ahead of the model lookup, so a path-carried model can't be claimed by a
+same-vendor body-routed provider. `matchPathRoute` enforces the route's `Models`
+allowlist (empty = catch-all) even though the model came from the URL.
+Two path-only behaviours:
+- **Vertex unmeterable publisher** — when `llm_request_parser` emits no
+  `llm.provider` (e.g. Gemini/`google`), the router denies with
+  `llm_policy.unmeterable_publisher` (403) rather than forward it uncounted.
+- **GCP token minting** — when the route carries `GCPServiceAccountKeyB64`
+  (set from a `keyfile::` api_key), `gcpBearer` mints + caches a short-lived
+  OAuth2 token per request instead of injecting a static value; a bad key or
+  unreachable token endpoint denies with `llm_policy.upstream_auth_failed`
+  (502). Bedrock uses its static bearer token directly (no minting).
+- **`/bedrock` prefix** — an optional `/bedrock` gateway-namespace prefix is
+  accepted and stripped via `RewriteUpstream.StripPathPrefix` so the native
+  `/model/...` path reaches the upstream.
+
+Full treatment in [50-path-routed-providers.md](./50-path-routed-providers.md).
+
+### llm_limit_check
+
+Pre-flight gate. Reads `llm.resolved_provider_id`, calls
+`CheckLLMPolicyLimits` with a 2s context timeout
+([middleware.go:24, 97–106](../../../proxy/internal/middleware/builtin/llm_limit_check/middleware.go)),
+on allow stamps `llm.selected_policy_id`, `llm.attribution_group_id`,
+`llm.attribution_window_seconds`. **Key invariant:** fail-open. Nil
+`MgmtClient`, empty provider id, or RPC error returns `allowNoAttribution()`
+— management outage doesn't take down every LLM request. Operators audit via
+the access-log; a future flag may switch this to fail-closed.
+
+### llm_identity_inject
+
+Dispatches per-rule between LiteLLM-shaped `HeaderPair`
+([middleware.go:169](../../../proxy/internal/middleware/builtin/llm_identity_inject/middleware.go))
+and Portkey-shaped `JSONMetadata`
+([middleware.go:292](../../../proxy/internal/middleware/builtin/llm_identity_inject/middleware.go)).
+Identity is the peer's email (or `UserID` fallback); tags are the
+**authorising-groups intersection** emitted by `llm_router`, not the full
+`UserGroups` — a peer in 5 groups authorised under 1 only tags as that 1.
+**Anti-spoof:** every `HeadersAdd` is preceded by a `HeadersRemove` of the
+same name; the framework runs `Remove` before `Add` so client-supplied
+identity never reaches the upstream. Body-level inject (`tags_in_body`,
+`end_user_id_in_body`) is skipped on empty / truncated / non-JSON bodies so
+header attribution stays intact.
+
+### llm_guardrail
+
+Model allowlist deny + optional prompt-capture-with-redaction. Allowlist
+match is case-insensitive via `normaliseModel`; empty allowlist disables the
+check. Prompt capture reads `llm.request_prompt_raw` and emits
+`llm.request_prompt` only when `prompt_capture.enabled`
+([middleware.go:149–165](../../../proxy/internal/middleware/builtin/llm_guardrail/middleware.go)).
+**Key invariant:** `RedactPII` is the exported function the parsers call —
+single PII contract across all three keys.
+
+### llm_response_parser
+
+Buffered and SSE paths share one `Invoke`
+([middleware.go:102–127](../../../proxy/internal/middleware/builtin/llm_response_parser/middleware.go)):
+content-type sniffing dispatches to `invokeBuffered` (JSON, status<400) or
+`invokeStreaming` (text/event-stream, partial bodies tolerated). Streaming
+delegates to `accumulateStream`
+([streaming.go:21–30](../../../proxy/internal/middleware/builtin/llm_response_parser/streaming.go))
+using `llm.NewScanner`. A third path, `accumulateBedrockStream`
+([streaming_bedrock.go](../../../proxy/internal/middleware/builtin/llm_response_parser/streaming_bedrock.go)),
+decodes the AWS binary event-stream (`application/vnd.amazon.eventstream`)
+returned by Bedrock's `-stream` actions — InvokeModel `chunk` frames wrap a
+base64 Anthropic event, Converse frames carry text + a trailing usage block.
+Cached / cache-creation buckets emit only when non-zero, preserving the existing
+token schema.
+
+### cost_meter
+
+Reads `llm.provider` + `llm.model` + token buckets, looks up per-1k rate via
+`pricing.Loader`, emits `cost.usd_total` or a closed-set `cost.skipped`
+reason (`missing_provider/model/tokens`, `unparseable_tokens`, `zero_tokens`,
+`unknown_model`). Loader's hot-reload goroutine is bound to proxy-lifetime
+context via `startReloader`. **Key invariant:** provider-shape switch lives
+in `pricing.Table.Cost` (sibling doc) — `cost_meter` stays provider-agnostic.
+
+### llm_limit_record
+
+Post-flight write. Always returns `DecisionAllow`; response has already been
+served so RPC errors mustn't surface (logged at `Debugf`). Skip-on-no-signal
+at line 81 (zero tokens + zero cost). **Key invariant:** the
+skip-on-missing-attribution guard at line 98 is a safety net independent of
+the framework's deny short-circuit — if the gate denied and the framework
+still runs the recorder, the recorder skips on absent
+`UserID`+`groupID`+`UserGroups` and no phantom counter materialises.
+
+## Full-chain diagram (canonical order)
+
+```mermaid
+flowchart TD
+    A[HTTP request] --> B[llm_request_parser<br/>OnRequest]
+    B -->|llm.provider, llm.model,<br/>llm.stream, llm.request_prompt_raw| C[llm_router<br/>OnRequest]
+    C -->|llm.resolved_provider_id,<br/>llm.authorising_groups,<br/>upstream rewrite + auth| D[llm_limit_check<br/>OnRequest]
+    D -->|deny path| Z1[403 llm_policy.*]
+    D -->|allow + llm.selected_policy_id,<br/>llm.attribution_group_id,<br/>llm.attribution_window_seconds| E[llm_identity_inject<br/>OnRequest]
+    E -->|header strip+inject<br/>+ optional body rewrite| F[llm_guardrail<br/>OnRequest]
+    F -->|deny: model_blocked| Z2[403 llm_policy.model_blocked]
+    F -->|allow + llm.request_prompt| G[upstream LLM call]
+    G --> H[llm_response_parser<br/>OnResponse]
+    H -->|llm.{input,output,total,cached_input,cache_creation}_tokens,<br/>llm.response_completion| I[cost_meter<br/>OnResponse]
+    I -->|cost.usd_total or cost.skipped| J[llm_limit_record<br/>OnResponse]
+    J --> K[response to client]
+```
+
+## limit_check ⇒ limit_record record-once invariant
+
+```mermaid
+sequenceDiagram
+    participant LC as llm_limit_check
+    participant M as management gRPC
+    participant U as upstream LLM
+    participant LR as llm_limit_record
+    participant DB as sqlite consumption table
+
+    LC->>M: CheckLLMPolicyLimits (2s)
+    alt allow
+        M-->>LC: selected_policy_id, attribution_group_id, window_s
+        LC->>U: stamps attribution metadata
+        U-->>LR: response + tokens (via llm_response_parser + cost_meter)
+        LR->>M: RecordLLMUsage (5s, debug-on-error)
+        M->>DB: increment (user, group, window) row
+    else deny
+        M-->>LC: llm_policy.token_cap_exceeded
+        Note over LR: framework short-circuits; even if invoked,<br/>recorder skips on absent UserID+groupID+UserGroups
+    else mgmt nil / rpc error
+        LC-->>LC: allowNoAttribution() — fail open
+        Note over LR: no window_s ⇒ recorder books only account-level<br/>budget rules (which run independently)
+    end
+```
+
+The integration test
+[agentnetwork_chain_integration_test.go](../../../proxy/internal/middleware/builtin/agentnetwork_chain_integration_test.go)
+exercises all three branches against a real sqlite store + bufconn gRPC —
+no mocks. Tests: `TestChain_AllowPath_StampsAttributionAndRecordsCounter`
+(line 130), `TestChain_DenyPath_GateRejectsAndNoConsumptionWritten` (line
+207), `TestChain_CapExhaustTransition` (line 265).
+
+## Public contracts (per-middleware JSON config)
+
+| Middleware | Config shape |
+|---|---|
+| `llm_request_parser` | `{provider_id?, redact_pii?, capture_prompt?: *bool}` ([factory.go:19–37](../../../proxy/internal/middleware/builtin/llm_request_parser/factory.go)) |
+| `llm_router` | `{providers: [{id, models, upstream_scheme, upstream_host, upstream_path?, auth_header_name, auth_header_value, allowed_group_ids}]}` |
+| `llm_limit_check` | `{}` — pulls `MgmtClient` from `FactoryContext` |
+| `llm_identity_inject` | `{providers: [{provider_id, header_pair?|json_metadata?, extra_headers?}]}` |
+| `llm_guardrail` | `{model_allowlist: []string, prompt_capture: {enabled, redact_pii}}` |
+| `llm_response_parser` | `{redact_pii?, capture_completion?: *bool}` |
+| `cost_meter` | `{pricing_path?}` (basename inside data-dir; defaults `pricing.yaml`) |
+| `llm_limit_record` | `{}` — same pattern as `llm_limit_check` |
+
+All factories accept empty / null / `{}` / whitespace as zero-value config;
+only structurally invalid JSON is rejected so misconfig surfaces at chain
+build time.
+
+## Invariants
+
+1. **limit_check ↔ limit_record paired.** They MUST appear together. Gate
+   stamps attribution metadata on the request leg; recorder reads it on the
+   response leg. If a chain contains only the recorder, the
+   skip-on-missing-attribution guard at
+   [llm_limit_record/middleware.go:81–87, 98–103](../../../proxy/internal/middleware/builtin/llm_limit_record/middleware.go)
+   keeps counters consistent but no enforcement runs. Only-gate means
+   counters never tick and headroom appears infinite.
+
+2. **`capture_prompt` / `capture_completion` pointer semantics.** Both are
+   `*bool`. `nil` = "preserve legacy emit" (back-compat default for
+   non-agent-network callers and pre-toggle tests). `false` = suppress the
+   key entirely (access-log row carries zero prompt / completion content).
+   `true` = emit. The synthesiser sets the pointer explicitly to the
+   account's `EnablePromptCollection` toggle. The handling lives
+   in [llm_request_parser/factory.go:55–61](../../../proxy/internal/middleware/builtin/llm_request_parser/factory.go)
+   and the symmetric [llm_response_parser/middleware.go:62–68](../../../proxy/internal/middleware/builtin/llm_response_parser/middleware.go);
+   a missing pointer must not be treated as `false` (that would suppress
+   capture for legacy non-agent-network callers).
+   `redact_pii` is an orthogonal `bool` controlling **form** of emitted
+   content, not whether it's emitted.
+
+3. **`redact_pii` is parser-side.** Both parsers import
+   `llm_guardrail.RedactPII` and run it BEFORE stamping the metadata bag.
+   Load-bearing because the access-log sink reads `llm.request_prompt_raw`
+   and `llm.response_completion` directly — by the time `llm_guardrail`
+   runs its own pass on `llm.request_prompt`, the raw key has already been
+   stamped. Tests: `TestInvoke_RedactPii_RedactsBeforeEmittingRawPrompt`,
+   `TestInvoke_RedactPii_RedactsCompletionBeforeEmit`.
+
+4. **Metadata allowlist enforcement.** Every middleware declares
+   `MetadataKeys()`. The framework accumulator drops any KV outside that
+   allowlist. When adding a new key, also extend the docstring in
+   `middleware/keys.go`.
+
+5. **Closed deny-code set.** All deny paths emit one of:
+   `llm_policy.model_not_routable`, `llm_policy.no_authorised_provider`,
+   `llm_policy.model_blocked`, `llm_policy.token_cap_exceeded`,
+   `llm_policy.unmeterable_publisher` (path-routed Vertex publisher with no
+   parser → 403), `llm_policy.upstream_auth_failed` (GCP token mint failure →
+   502), or the management-supplied code on `llm_limit_check`. These surface
+   verbatim; arbitrary middleware text never reaches the wire.
+
+## Things to scrutinise
+
+**Correctness.** `llm_router` model match treats an empty `Models` slice as
+"claim every model"
+([middleware.go:238–248](../../../proxy/internal/middleware/builtin/llm_router/middleware.go))
+for gateway-style providers — confirm no real provider record ships with an
+empty `Models` by accident. Path-prefix tie-break falls back to declaration
+order when no candidate prefix-matches, so the synthesiser must emit a
+deterministic order. `llm_limit_record` discards `strconv.ParseInt` errors
+([middleware.go:78–80](../../../proxy/internal/middleware/builtin/llm_limit_record/middleware.go))
+— relies on `llm_response_parser` always emitting parseable values; spot-check
+the streaming partial path on truncated bodies.
+
+**Security.** Auth headers must NEVER appear on `Mutations.HeadersAdd/Remove`
+for the router — a direct headers path would bypass the framework gate. The
+capture-pointer handling is the kind of place a bug ships PII to logs
+silently; every synthesiser config path must set the pointer explicitly.
+`llm_identity_inject` body inject silently skips on a
+non-object `metadata` field
+([middleware.go:262–270](../../../proxy/internal/middleware/builtin/llm_identity_inject/middleware.go))
+— header path still attributes, but body-level tag-budget enforcement
+doesn't run for that request.
+
+**Concurrency.** `cost_meter` shares a `pricing.Loader` via
+`atomic.Pointer[Table]`; readers always see a consistent table. Every
+middleware is a stateless value receiver. Integration test uses real bufconn
+gRPC — race detector is the meaningful bar.
+
+**Perf.** Hot path is `lookupKV` linear scan over <10 KVs; `cost_meter.Cost`
+is O(1); SSE accumulation is single-pass. No map allocation per call.
+
+**Observability.** Every deny stamps `llm_policy.decision=deny` and a
+matching `llm_policy.reason` — access-log can pivot on either.
+`llm_limit_record` only logs at `Debugf` on RPC failure
+([middleware.go:125–130](../../../proxy/internal/middleware/builtin/llm_limit_record/middleware.go));
+operators need an alternate signal (metric on `RecordLLMUsage` failures) for
+counter accuracy.
+
+## Test coverage
+
+| File | Tests | Notes |
+|---|---:|---|
+| `all_test.go` | 1 | Registry surface lock |
+| `agentnetwork_chain_integration_test.go` | 3 | Allow/deny/cap-exhaust vs live sqlite + bufconn gRPC |
+| `llm_request_parser/middleware_test.go` | 18 | `provider_id` bypass, redaction, capture-pointer, rune-safe truncation |
+| `llm_router/middleware_test.go` | 19 | Three-pass match, deny codes, path-prefix tie-break, header strip+inject |
+| `llm_limit_check/middleware_test.go` | 6 | Allow/deny, fail-open on nil mgmt / RPC error, attribution stamping |
+| `llm_identity_inject/middleware_test.go` | 28 | HeaderPair, JSONMetadata, ExtraHeaders, body inject, anti-spoof |
+| `llm_guardrail/middleware_test.go` | 15 | Allowlist case-insensitivity, prompt capture toggle, deny shape |
+| `llm_guardrail/redact_test.go` | 15 | Email, SSN, phone (E.164 + NA), bearer, IPv4; fixture-driven |
+| `llm_response_parser/middleware_test.go` | 18 | Buffered OAI+Anthro, capture-pointer, redact, truncation |
+| `llm_response_parser/streaming_test.go` | 7 | OAI usage frame, Anthro message_delta, truncated body best-effort |
+| `cost_meter/middleware_test.go` | 17 | Each skip reason, provider-shape, pricing loader integration |
+| `llm_limit_record/middleware_test.go` | 7 | Skip-on-no-signal, skip-on-missing-attribution, RPC failure swallowed |
+
+## Cross-references
+
+- Sibling: [32-proxy-llm-parsers.md](./32-proxy-llm-parsers.md) — SDK adapters
+  + SSE framer + pricing loader.
+- Path-routed providers (Vertex AI + Bedrock), `keyfile::` credential, GCP
+  token minting, `/bedrock` prefix:
+  [50-path-routed-providers.md](./50-path-routed-providers.md).
+- Upstream config: `management/server/agentnetwork/synthesizer` (out of scope).
+- Framework: `proxy/internal/middleware/{chain,dispatcher,accumulator,registry}.go`.
+- Metadata key registry: `proxy/internal/middleware/keys.go`.
+- gRPC surface: `proto.ProxyServiceClient.{CheckLLMPolicyLimits,RecordLLMUsage}`.
diff --git a/docs/agent-networks/modules/32-proxy-llm-parsers.md b/docs/agent-networks/modules/32-proxy-llm-parsers.md
new file mode 100644
index 000000000..0376bc988
--- /dev/null
+++ b/docs/agent-networks/modules/32-proxy-llm-parsers.md
@@ -0,0 +1,392 @@
+# proxy/llm-parsers — SDK adapters + pricing + SSE
+
+The runtime-agnostic LLM library: the OpenAI Responses API (`/v1/responses`)
+and the older Chat Completions API (`/v1/chat/completions`), the Anthropic
+Messages API (`/v1/messages`), the SSE wire format (`event:` / `data:` lines,
+`\n\n` framing, CRLF tolerance), and per-provider token accounting (OpenAI's
+cached-prompt **subset** vs Anthropic's cache_read **additive** model). The
+pricing table's per-provider cost formula is the highest-leverage place a
+small bug would silently mis-bill operators.
+
+Sibling module: [31-proxy-middleware-builtin.md](./31-proxy-middleware-builtin.md)
+— the 8 middlewares that consume this package's parsers + pricing loader.
+
+---
+
+## Module boundary
+
+`proxy/internal/llm` is the runtime-agnostic LLM library shared by every
+middleware that needs to understand provider-specific shapes. Zero
+proxy-framework dependencies:
+
+- `parser.go` — `Parser` interface, `Provider` enum, public factories
+  (`Parsers`, `DetectParser`, `ParserByName`).
+- `openai.go` / `anthropic.go` / `bedrock.go` — per-provider `Parser` impls.
+- `sse.go` — SSE scanner (`Scanner`, `Event`, `NewScanner`).
+- `errors.go` — sentinels callers branch on with `errors.Is`.
+- `pricing/` — embedded-default + hot-reload override table with
+  symlink-safe Unix loader (build-tagged stub elsewhere).
+- `fixtures/` — captured request/response/stream bodies the tests replay.
+
+The package carries zero proxy-framework dependencies so the same parsers can
+be reused later by a WASM adapter
+([parser.go:1–6](../../../proxy/internal/llm/parser.go)).
+
+## Files
+
+| File | LOC | Notes |
+|---|---:|---|
+| `parser.go` | 104 | Interface + factories + `Provider{Unknown,OpenAI,Anthropic}` enum |
+| `openai.go` | 347 | Chat Completions + Completions + Responses API; cached_tokens subset |
+| `openai_test.go` | 222 | 11 tests; fixture replay + cached/Responses-API matrix |
+| `anthropic.go` | 172 | Messages + legacy `/v1/complete`; cache_read + cache_creation additive |
+| `anthropic_test.go` | 154 | 7 tests including streaming-extraction-skipped contract |
+| `bedrock.go` | 190 | AWS Bedrock InvokeModel (snake_case) + Converse (camelCase) response shapes; model lives in URL path |
+| `bedrock_test.go` | — | InvokeModel + Converse usage shapes; AWS event-stream content-type → `ErrStreamingUnsupported` on buffered `ParseResponse` |
+| `sse.go` | 117 | `bufio`-backed scanner; CRLF normalised; trailing-event handling |
+| `sse_test.go` | 175 | 12 tests; fixture replay + multiline + size limits |
+| `parser_test.go` | 53 | `Parsers()`, `DetectParser`, provider enum values |
+| `errors.go` | 31 | 6 sentinels: `Err{Unknown,Unsupported}Provider/Model`, `Err{NotLLM,Malformed}Response`, `ErrStreamingUnsupported`, `ErrMalformedRequest` |
+| `pricing/pricing.go` | 421 | `Loader`, `Table`, `Entry`; embedded defaults + atomic swap + mtime reload |
+| `pricing/pricing_unix.go` | 69 | `O_NOFOLLOW` + fstat-from-FD + 1 MiB cap |
+| `pricing/pricing_other.go` | 21 | Stub returning "not supported on this platform" |
+| `pricing/pricing_test.go` | 432 | 21 tests — symlink rejection, reload race, path traversal, oversize |
+| `pricing/defaults_pricing.yaml` | 85 | go:embed source of truth |
+| `fixtures/*` | 21–59 | OAI chat/responses/stream + Anthro messages/stream + pricing starter |
+
+## Request body → parser dispatch
+
+```mermaid
+flowchart TD
+    A[HTTP request<br/>URL + JSON body] --> B{ParserByName?<br/>provider_id config set}
+    B -- yes --> P[matched Parser]
+    B -- no --> C[DetectParser]
+    C --> D{loop Parsers<br/>OpenAIParser, AnthropicParser}
+    D -- DetectFromURL match --> P
+    D -- no match --> X[ok=false<br/>middleware skips]
+    P --> E[ParseRequest body]
+    E -->|err: ErrMalformedRequest| Y[middleware emits provider only]
+    E --> F[RequestFacts<br/>model + stream]
+    P --> G[ExtractPrompt body]
+    G --> H[joinMessages<br/>extractContentParts<br/>decodeStringOrJoin]
+    H --> I[prompt text<br/>or empty]
+    F --> J[stamps llm.model + llm.stream]
+    I --> K[stamps llm.request_prompt_raw<br/>subject to capture_prompt gate]
+```
+
+OpenAI's URL hints
+([openai.go:27–33](../../../proxy/internal/llm/openai.go)) include
+both `/v1/chat/completions` and the bare `/chat/completions` — the latter
+covers Cloudflare AI Gateway, which rewrites the canonical version segment.
+Anthropic's hints are `/v1/messages` and `/v1/complete`
+([anthropic.go:14–17](../../../proxy/internal/llm/anthropic.go)).
+Both implementations use case-insensitive substring matching so a proxy prefix
+strip / rewrite doesn't defeat detection.
+
+`ParserByName` ([parser.go:93–103](../../../proxy/internal/llm/parser.go))
+is the **agent-network bypass**: the synthesiser knows which parser to use
+because it built the synth service from the catalog, so it stamps
+`provider_id` on the parser config and the middleware skips URL sniffing
+entirely. This is what makes the same parser set work whether the request
+flows to OpenAI direct, to LiteLLM, to Portkey, or to any gateway with a
+non-canonical URL shape.
+
+**Path-routed providers (Vertex AI, Bedrock) bypass both `ParserByName` and
+`DetectParser`.** The model and the parser surface live in the URL path, so the
+request middleware extracts them directly (`parseVertexPath` /
+`parseBedrockPath`) before the parser-selection step. For Vertex the publisher
+segment picks the parser (`anthropic` → Anthropic parser; `google`/Gemini →
+none, request denied as unmeterable). For Bedrock the dedicated `BedrockParser`
+handles the response. Full treatment in
+[50-path-routed-providers.md](./50-path-routed-providers.md).
+
+## Streaming response → SSE chunker → response parser → completion + token count
+
+```mermaid
+sequenceDiagram
+    participant U as upstream LLM
+    participant LR as llm_response_parser<br/>(OnResponse)
+    participant S as llm.NewScanner<br/>(SSE framer)
+    participant P as Parser-specific accumulator<br/>(accumulateOpenAIStream<br/>or accumulateAnthropicStream)
+
+    U-->>LR: text/event-stream<br/>(buffered prefix in RespBody)
+    LR->>S: NewScanner(bytes.NewReader(body))
+    loop until EOF or [DONE]
+        S-->>LR: Event{Type, Data}
+        LR->>P: dispatch per event.Type<br/>(OpenAI: data-only<br/>Anthropic: named events)
+        P-->>P: accumulate completion text<br/>track usage from final frame
+    end
+    P-->>LR: llm.Usage + completion string
+    LR->>LR: appendUsage stamps<br/>llm.{input,output,total,cached_input,cache_creation}_tokens
+    LR->>LR: truncateCompletion(3500 bytes, rune-safe)
+    LR->>LR: redactPII if redact_pii && captureCompletion
+```
+
+`Scanner.Next`
+([sse.go:44–87](../../../proxy/internal/llm/sse.go)) returns one
+event per `\n\n` boundary; multiple `data:` lines join with `\n`; comment lines
+(starting with `:`) are skipped per the SSE spec; a trailing event without a
+closing blank line is still returned before `io.EOF` so a server that closes
+the connection cleanly doesn't lose the last frame
+([sse.go:55–58](../../../proxy/internal/llm/sse.go)). CRLF is
+normalised in `trimEOL` so fixtures captured from live servers replay
+unchanged.
+
+## Per-provider
+
+### OpenAI
+
+[openai.go:54–67](../../../proxy/internal/llm/openai.go) defines
+`openAIRequest` with three prompt fields: `messages` (Chat Completions),
+`prompt` (legacy), `input` (Responses API). The decoder uses
+`json.RawMessage` so each shape is parsed lazily.
+
+`ParseResponse`
+([openai.go:117–146](../../../proxy/internal/llm/openai.go))
+accepts both naming conventions: Chat Completions returns
+`prompt_tokens`/`completion_tokens`, Responses API returns
+`input_tokens`/`output_tokens`. `pickInt64` prefers Responses-API names and
+falls back — same parser handles both endpoints without per-route config.
+`openAICachedTokens` mirrors the fallback for
+`input_tokens_details.cached_tokens` vs `prompt_tokens_details.cached_tokens`.
+
+**Key invariant:** `CachedInputTokens` for OpenAI is a SUBSET of
+`InputTokens`. The cost meter clamps to guard against malformed upstream
+responses where `cached > total`.
+
+### Anthropic
+
+[anthropic.go:37–49](../../../proxy/internal/llm/anthropic.go)
+defines `anthropicRequest` covering Messages API (`system` + `messages[]`)
+and legacy `/v1/complete` (`prompt` string). `ExtractPrompt` emits
+`system: <text>` first when present, then per-message `role: content`.
+
+`ParseResponse`
+([anthropic.go:82–104](../../../proxy/internal/llm/anthropic.go))
+fills three independent token buckets: `InputTokens`, `CacheReadInputTokens`,
+`CacheCreationInputTokens`. Latter two are **additive** (not subset).
+`TotalTokens` sums all four so downstream dashboards render one "tokens"
+number without double-counting.
+
+`ExtractCompletion` walks `content[]` `{type, text}` parts and concatenates
+non-empty text with newlines, falling back to legacy `completion`.
+
+### Bedrock
+
+[bedrock.go](../../../proxy/internal/llm/bedrock.go) implements the
+`Parser` interface for the AWS Bedrock runtime. Bedrock is **path-routed**: the
+model lives in the URL (`/model/{id}/{action}`), so the request middleware
+extracts it (see [50-path-routed-providers.md](./50-path-routed-providers.md))
+and `ParseRequest` is a deliberate no-op. The parser's real work is on the
+response leg, covering both Bedrock body shapes:
+
+- **InvokeModel** — vendor-native. Anthropic-on-Bedrock returns snake_case usage
+  (`input_tokens`, `output_tokens`, `cache_read_input_tokens`,
+  `cache_creation_input_tokens`) with the same additive cache buckets as
+  first-party Anthropic.
+- **Converse** — unified camelCase (`inputTokens`, `outputTokens`,
+  `totalTokens`). `firstNonZero` folds the two naming conventions into one
+  `Usage`; when Converse omits `totalTokens` the parser sums the buckets.
+
+`ProviderName()` returns `"bedrock"` — its own `defaults_pricing.yaml` block,
+keyed by the **normalised** model id (region prefix + version suffix stripped by
+the request parser). `ParseResponse` returns `ErrStreamingUnsupported` for an
+AWS binary event-stream content-type (`application/vnd.amazon.eventstream`,
+`isAWSEventStream`) so the caller routes to the streaming accumulator instead.
+
+### SSE framing
+
+`Scanner` is `bufio`-backed, 64 KiB read buffer, 1 MiB max line so a
+malicious upstream can't blow process memory
+([sse.go:33–38, 97–100](../../../proxy/internal/llm/sse.go)).
+`splitField` strips one space after the `:` per the SSE spec. Documented
+`not safe for concurrent use`; every consumer creates a fresh scanner per
+response body. Streaming accumulators live in the middleware package
+([llm_response_parser/streaming.go](../../../proxy/internal/middleware/builtin/llm_response_parser/streaming.go))
+but use `llm.NewScanner` so the framing contract stays here.
+
+### Pricing catalog
+
+`Table.Cost`
+([pricing.go:129–174](../../../proxy/internal/llm/pricing/pricing.go))
+is the cost formula — most security-relevant math in this module:
+
+| Provider | Formula |
+|---|---|
+| `openai` | `(inTokens − clamped) × InputPer1K + clamped × CachedInputPer1K + outTokens × OutputPer1K` where `clamped = min(cachedInput, inTokens)` |
+| `anthropic`, `bedrock` | `inTokens × InputPer1K + cachedInput × CacheReadPer1K + cacheCreation × CacheCreationPer1K + outTokens × OutputPer1K` |
+| default | `inTokens × InputPer1K + outTokens × OutputPer1K` |
+
+`bedrock` shares the Anthropic additive-cache formula
+([pricing.go:172-174](../../../proxy/internal/llm/pricing/pricing.go)):
+Anthropic-on-Bedrock reports the same additive cache buckets, while non-Anthropic
+Bedrock models (Nova, Llama) simply report zero in those buckets so cost reduces
+to `input + output`.
+
+Each per-bucket rate falls back to `InputPer1K` when zero — operators opt in
+to discounts by setting the field.
+
+`Loader`
+([pricing.go:212–268](../../../proxy/internal/llm/pricing/pricing.go))
+overlays an optional `pricing.yaml` from data-dir on top of the go:embed
+defaults. Atomic pointer swap means readers never observe a partial update.
+The mtime-poll reloader (30s default cadence) keeps the previous table on
+parse failure so cost annotation never goes blank during a botched edit.
+
+`defaults_pricing.yaml` is the source of truth for built-in pricing.
+Operator overrides only carry the entries they want to change.
+
+## Public contracts
+
+**`Parser` interface**
+([parser.go:50–66](../../../proxy/internal/llm/parser.go)):
+
+```go
+type Parser interface {
+    Provider() Provider
+    ProviderName() string
+    DetectFromURL(path string) bool
+    ParseRequest(body []byte) (RequestFacts, error)
+    ParseResponse(status int, contentType string, body []byte) (Usage, error)
+    ExtractPrompt(body []byte) string
+    ExtractCompletion(status int, contentType string, body []byte) string
+}
+```
+
+Adding a provider means implementing this interface and appending to the
+slice returned by `Parsers()` ([parser.go:78–84](../../../proxy/internal/llm/parser.go)).
+Order matters: `DetectFromURL` ties resolve by registration order.
+`Parsers()` today returns `{OpenAIParser, AnthropicParser, BedrockParser}`.
+
+**`Provider` enum**
+([parser.go:8–18](../../../proxy/internal/llm/parser.go)):
+`ProviderUnknown = 0`, `ProviderOpenAI = 1`, `ProviderAnthropic = 2`,
+`ProviderBedrock = 3`. Numeric values are persisted in nothing today but treat
+them as wire-stable — new providers must take fresh numbers.
+
+**`Pricing` lookup**
+([pricing.go:129](../../../proxy/internal/llm/pricing/pricing.go)):
+
+```go
+func (t *Table) Cost(provider, model string, inTokens, outTokens, cachedInput, cacheCreation int64) (float64, bool)
+```
+
+Nil-safe: `t.Cost` on a nil receiver returns `(0, false)`
+([pricing.go:130–132](../../../proxy/internal/llm/pricing/pricing.go)).
+`ok=false` means provider or model is absent from the loaded table; the caller
+emits `cost.skipped=unknown_model`.
+
+## Invariants
+
+1. **Cross-platform pricing build.** `pricing_unix.go` carries the only
+   functional `loadPricing` (uses `syscall.O_NOFOLLOW` and `f.Stat()` on an
+   open descriptor — both Unix-only). `pricing_other.go` is a build-tag
+   fallback that returns `"not supported on this platform"`
+   ([pricing_other.go:14–16](../../../proxy/internal/llm/pricing/pricing_other.go)).
+   The proxy is Linux-only in production today; a Windows port needs an
+   equivalent path-as-handle implementation. Reviewers building on Windows
+   should expect this surface to return an error at startup if an override
+   file is configured.
+
+2. **SSE scanner handles partial chunks.** A buffered prefix that doesn't end
+   in `\n\n` still yields its accumulated event before `io.EOF`
+   ([sse.go:55–58](../../../proxy/internal/llm/sse.go)). Tests:
+   `TestSSEScanner_OpenAIFixture`, `TestSSEScanner_AnthropicFixture`,
+   `TestSSEScanner_MultilineData`, `TestSSEScanner_CRLF`. The streaming
+   accumulators ride on this: `accumulateAnthropicStream` and
+   `accumulateOpenAIStream` `break` on any scanner error to return partial
+   usage rather than aborting
+   ([streaming.go:68–73, 144–150](../../../proxy/internal/middleware/builtin/llm_response_parser/streaming.go)).
+
+3. **`defaults_pricing.yaml` is the source of truth.** Compiled into the
+   binary via `//go:embed`
+   ([pricing.go:29–30](../../../proxy/internal/llm/pricing/pricing.go)).
+   `DefaultTable()` parses once and panics on parse failure
+   ([pricing.go:42–49](../../../proxy/internal/llm/pricing/pricing.go))
+   — by design: a broken embedded YAML must not ship to production.
+
+4. **Loader path validation.** `resolveMiddlewareDataPath`
+   ([pricing.go:370–394](../../../proxy/internal/llm/pricing/pricing.go))
+   rejects absolute paths, traversal segments, and basenames that fail
+   `basenameRegex = ^[a-zA-Z0-9._-]+$`. The resolved path must remain
+   inside `baseDir` even after `filepath.Clean`. Tests:
+   `TestNewLoader_PathValidation`, `TestNewLoader_PathValidation_Extended`,
+   `TestNewLoader_SymlinkOutsideBaseDirRejected`, `TestNewLoader_SymlinkRejected`.
+
+5. **Unix loader symlink safety.** `O_NOFOLLOW` on open, `f.Stat()` on the
+   open descriptor (never re-stat by path), `info.Mode().IsRegular()` check,
+   `io.LimitReader(f, maxPricingBytes+1)` with a final size assertion
+   ([pricing_unix.go:25–57](../../../proxy/internal/llm/pricing/pricing_unix.go)).
+   A mid-read symlink swap is detected because the fstat is on the original
+   fd. Test: `TestNewLoader_RejectsOversizedFile_FixesM4`.
+
+6. **`yaml.NewDecoder(...).KnownFields(true)`**
+   ([pricing.go:397–398](../../../proxy/internal/llm/pricing/pricing.go))
+   rejects YAML files that carry fields not in the schema. A typo in an
+   operator override file fails loud instead of silently zeroing rates.
+
+## Things to scrutinise
+
+**Correctness.** Verify OpenAI cached-prompt clamp at
+[pricing.go:147–149](../../../proxy/internal/llm/pricing/pricing.go)
+short-circuits before subtraction. `Anthropic.TotalTokens` sums all four
+buckets (in + out + cache_read + cache_creation) — downstream dashboards
+need to know this differs from `input + output`.
+`OpenAIParser.ExtractPrompt` falls through `messages → input → prompt`; a
+request sending all three reports only `messages` (uncommon but worth
+noting).
+
+**Security.** `Scanner.maxLine = 1 MiB`; a 2 MiB single-line `data:` event
+errors from `Scanner.Next` and both accumulators stop with partial usage.
+Pricing file 1 MiB cap is orders of magnitude larger than realistic. Confirm
+new schema additions are mirrored in both `pricingFile` and `Entry`;
+`KnownFields(true)` will reject silently-typo'd operator overrides
+otherwise.
+
+**Concurrency.** `Loader.table` is `atomic.Pointer[Table]`; readers never
+block or see a torn table. `Loader.Reload` is one goroutine, cancelled via
+context (`TestLoader_ReloadBackgroundLoopCancellation`). `DefaultTable()`
+uses `sync.Once`. Per-call `Scanner` instances mean no shared state across
+concurrent response-parser calls.
+
+**Perf.** `Table.Cost` is two map lookups + multiplications, O(1).
+`Scanner.Next` is one `ReadString('\n')` per line. Pricing reload poll 30s.
+
+**Observability.** Reload failures count via `metric.Int64Counter` keyed
+`plugin`; warning log rate-limited at 5 min so a broken file doesn't flood.
+Parser errors return sentinels — middleware uses `errors.Is` to map to the
+right `cost.skipped` reason.
+
+## Test coverage
+
+| File | Tests | Coverage highlights |
+|---|---:|---|
+| `parser_test.go` | 3 | `Parsers()` shape lock, `DetectParser` URL matrix, provider enum stability |
+| `openai_test.go` | 11 | Chat Completions + Responses API + legacy `prompt`; cached-tokens subset for both naming conventions; fixture replays |
+| `anthropic_test.go` | 7 | Messages + legacy `/v1/complete`; streaming REJECTED on `ParseResponse` (must use scanner); fixture replays |
+| `sse_test.go` | 12 | Fixture replay both providers; multiline `data:`; CRLF; comment skip; trailing-event-without-blank-line; oversize rejection |
+| `pricing/pricing_test.go` | 21 | Provider-shape switch; cached-rate fallback; cached-clamp; symlink rejection (target outside basedir + symlink to file); path validation matrix; oversize rejection; reload-keeps-previous-on-parse-error; mtime change detection; goroutine cancellation |
+
+**Fixtures** ([proxy/internal/llm/fixtures/](../../../proxy/internal/llm/fixtures/)):
+`openai_chat_completion.json` (chat.completions with usage),
+`openai_responses.json` (Responses API shape),
+`openai_stream.txt` (3 deltas + usage + `[DONE]`),
+`anthropic_messages.json` (Messages API non-streaming),
+`anthropic_stream.txt` (full 7-event sequence: message_start →
+content_block_{start,delta×2,stop} → message_delta (usage) → message_stop),
+`pricing.yaml` (realistic-pricing starter for operator overrides).
+
+## Cross-references
+
+- Sibling: [31-proxy-middleware-builtin.md](./31-proxy-middleware-builtin.md)
+  — the chain that calls `llm.Parsers()`, `llm.ParserByName`,
+  `llm.NewScanner`, `pricing.NewLoader`.
+- Path-routed providers (Vertex AI + Bedrock), credential syntax, and the
+  Bedrock AWS event-stream accumulator:
+  [50-path-routed-providers.md](./50-path-routed-providers.md).
+- Direct callers: `llm_request_parser/middleware.go:82–94`,
+  `llm_response_parser/middleware.go:113–123`,
+  `llm_response_parser/streaming.go:65, 142`, `cost_meter/factory.go:49–57`.
+- Related elsewhere: the agent-network synthesiser stamping `provider_id`
+  is covered in the management-side module guide; proxy server boot +
+  `FactoryContext` construction is covered in the proxy-framework guide.
diff --git a/docs/agent-networks/modules/33-proxy-runtime.md b/docs/agent-networks/modules/33-proxy-runtime.md
new file mode 100644
index 000000000..f553473f8
--- /dev/null
+++ b/docs/agent-networks/modules/33-proxy-runtime.md
@@ -0,0 +1,194 @@
+# proxy/runtime — translate + serve + log
+
+> **Risk level:** High — every config push from management is translated here, and the chain runs on every HTTP request to a synth target.
+> **Backward-compat impact:** Additive at the wire (`PathTargetOptions.middlewares`, `agent_network`, `disable_access_log`, capture caps) and on the proxy `Server` struct (`MiddlewareDataDir`, `MiddlewareCaptureBudgetBytes`). Non-agent-network targets stay on the no-middleware fast path.
+
+## Module boundary
+
+Turns the synth-service wire format from `ProxyService.SyncMappings`/`GetMappingUpdate` into in-process middleware chains and runs them on top of the existing `httputil.ReverseProxy`. Four concerns: (a) **translate** — `proto.MiddlewareConfig` → validated `middleware.Spec` (proxy/middleware_translate.go) + self-register the eight built-ins (proxy/middleware_register.go); (b) **boot + rebuild** — construct the `middleware.Manager`, share the OTel meter, install the live-service check, rebuild per-path chains on every `addMapping`/`modifyMapping` (proxy/server.go); (c) **serve** — resolve chain at request time, capture bodies under a global budget, invoke `RunRequest`/`RunResponse`/`RunTerminal`, render deny responses, apply `UpstreamRewrite` (proxy/internal/proxy/reverseproxy.go); (d) **log + tag** — emit access-log entries with the new `agent_network` flag, gate emission on `EnableLogCollection` via `DisableAccessLog` (proxy/internal/accesslog).
+
+**Inert for non-agent-network targets**: nil or empty chain → existing fast path (reverseproxy.go:127-139); `SuppressAccessLog` defaults false so the access-log middleware emits unchanged.
+
+## Files
+
+| Path | Role |
+| ---- | ---- |
+| proxy/middleware_translate.go | proto→Spec translation; slot/failmode/timeout mapping; caps |
+| proxy/middleware_translate_test.go | translator unit tests |
+| proxy/middleware_register.go | blank-imports the eight builtins for `init()` registration |
+| proxy/server.go | `initMiddlewareManager`, `rebuildMiddlewareChains`, `isLiveService`, `buildMiddlewareBindings`, new Server fields, `protoToMapping` stamps AgentNetwork/DisableAccessLog/CaptureConfig/Middlewares |
+| proxy/internal/proxy/reverseproxy.go | `WithMiddlewareManager`, chain dispatch, body capture, `applyUpstreamRewrite`/`Headers`, `buildRequestInput`, response-leg respInput identity fields |
+| proxy/internal/proxy/reverseproxy_test.go | `TestBuildRequestInput_PropagatesIdentityAndGroups` |
+| proxy/internal/proxy/context.go | `agentNetwork`, `suppressAccessLog`, `userGroupNames` on `CapturedData` |
+| proxy/internal/proxy/servicemapping.go | new `PathTarget` fields |
+| proxy/internal/proxy/agent_network_chain_realstack_test.go | end-to-end self-contained chain test |
+| proxy/internal/accesslog/logger.go | `logEntry.AgentNetwork` → `proto.AccessLog` |
+| proxy/internal/accesslog/middleware.go | reads `GetAgentNetwork()`; gates `l.log` on `!GetSuppressAccessLog()` |
+| proxy/internal/accesslog/middleware_test.go | suppress/default/preserves-usage assertions |
+| proxy/internal/auth/middleware_test.go | tunnel-peer group propagation contract |
+| proxy/internal/metrics/metrics.go | `Meter()` getter for the middleware manager |
+
+## Architecture & flow
+
+### Synth-service ingestion → translate → register → serve
+
+```mermaid
+flowchart TD
+    A[Management SyncMappings/GetMappingUpdate] --> B["processMappings\nserver.go:1492"]
+    B --> C{Mapping type}
+    C -->|CREATED| D["addMapping → setupHTTPMapping → updateMapping"]
+    C -->|MODIFIED| E["modifyMapping → cleanupMappingRoutes → setupHTTPMapping → updateMapping"]
+    C -->|REMOVED| F["removeMapping → cleanupMappingRoutes → invalidateMiddlewareChains"]
+    D --> G["protoToMapping\nserver.go:2181"]
+    E --> G
+    G --> H["translateMiddlewareConfigs\nmiddleware_translate.go:55"]
+    G --> I["translateMiddlewareCaptureConfig\nmiddleware_translate.go:18"]
+    H --> J["[]middleware.Spec on PathTarget"]
+    I --> K["*bodytap.Config on PathTarget"]
+    J --> L["proxy.AddMapping\nservicemapping.go:118"]
+    K --> L
+    L --> M["rebuildMiddlewareChains\nserver.go:2017 → Manager.Rebuild"]
+    F --> N["Manager.Invalidate(serviceID)"]
+```
+
+### Per-request lifecycle through the chain + accesslog
+
+```mermaid
+sequenceDiagram
+    autonumber
+    participant C as Client
+    participant M as accesslog.Middleware
+    participant A as auth.Middleware (Protect)
+    participant RP as ReverseProxy.ServeHTTP
+    participant CH as middleware.Chain
+    participant U as Upstream
+    C->>M: HTTP request
+    M->>M: NewCapturedData(requestID), WithCapturedData(ctx)
+    M->>A: next.ServeHTTP
+    A->>A: Private → ValidateTunnelPeer → stamp UserID/Email/Groups/GroupNames/AuthMethod
+    A->>RP: next.ServeHTTP
+    RP->>RP: findTargetForRequest → targetResult
+    RP->>RP: stamp ServiceID/AccountID/AgentNetwork/SuppressAccessLog on CapturedData
+    RP->>RP: resolveChain via Manager.ChainFor
+    alt chain == nil or Empty
+        RP->>U: httputil.ReverseProxy.ServeHTTP (fast path)
+    else chain non-empty
+        RP->>RP: bodytap.CaptureRequest (global budget)
+        RP->>CH: RunRequest
+        CH-->>RP: denyOutput? requestMeta + upstreamRewrite
+        alt deny
+            RP->>C: RenderDenyResponse
+        else allow
+            RP->>RP: capturingWriter + applyUpstreamRewrite/Headers
+            RP->>U: httputil.ReverseProxy.ServeHTTP(respWriter)
+            U-->>RP: response
+            RP->>CH: RunResponse (respInput carries UserGroups)
+            RP->>CH: RunTerminal (merged request+response metadata)
+        end
+    end
+    RP-->>M: handler returns
+    M->>M: build logEntry incl. AgentNetwork
+    alt SuppressAccessLog == true
+        M->>M: skip l.log; still trackUsage
+    else default
+        M->>M: l.log → goroutine SendAccessLog
+    end
+```
+
+### EnableLogCollection suppression path
+
+```mermaid
+flowchart LR
+    S["agentnetwork.Settings.EnableLogCollection"] --> B["synthesizer: target.DisableAccessLog = !EnableLogCollection"]
+    B --> P["proto PathTargetOptions.disable_access_log (field 13)"]
+    P --> T["protoToMapping reads GetDisableAccessLog()\nserver.go:2211"]
+    T --> M["PathTarget.DisableAccessLog\nservicemapping.go:47"]
+    M --> R["ServeHTTP: cd.SetSuppressAccessLog\nreverseproxy.go:106"]
+    R --> G["accesslog middleware: if !GetSuppressAccessLog l.log\nmiddleware.go:95"]
+    R --> U["trackUsage unconditional — bandwidth telemetry preserved"]
+```
+
+**Ingestion** lands as a `ProxyMapping` batch on `handleSyncMappingsStream`/`handleMappingStream`. `processMappings` dispatches to `addMapping`/`modifyMapping`/`removeMapping`; HTTP goes `setupHTTPMapping → updateMapping → protoToMapping`. `protoToMapping` (server.go:2181) is the single translation surface that materialises `[]middleware.Spec`, `*bodytap.Config`, `AgentNetwork`, `DisableAccessLog` onto each `PathTarget`; `updateMapping` finishes with `s.proxy.AddMapping(m)` (atomic swap under `mappingsMux`) and `s.rebuildMiddlewareChains(svcID, m)`.
+
+At **request time** the access-log middleware stamps `CapturedData`; the auth chain runs (Private services lift `peer_group_ids` from `ValidateTunnelPeer` — auth/middleware_test.go:322). `ReverseProxy.ServeHTTP` resolves the chain; nil or empty → original `httputil.ReverseProxy`, no body capture. When a chain matches, body is captured under the global budget, `RunRequest` produces an `UpstreamRewrite` (`llm_router` selects a provider, rewrites scheme/host/path, injects `Authorization`), and `RunResponse`+`RunTerminal` run after the upstream returns. The terminal slot sees the merged metadata bag — that's how `llm_limit_record` ships the consumption sample. The **access-log** addition: `logEntry.AgentNetwork` from `GetAgentNetwork()` onto `proto.AccessLog.AgentNetwork`; the gate at middleware.go:95 honors `EnableLogCollection`, skipping `l.log` but keeping `trackUsage` so bandwidth telemetry survives.
+
+## Public contracts touched
+
+- `proxy.Server.MiddlewareDataDir` (string) — base dir for file-backed middleware config (server.go:238-241).
+- `proxy.Server.MiddlewareCaptureBudgetBytes` (int64) — process-wide capture cap; defaults to 256 MiB (server.go:248-250).
+- `proxy/internal/proxy.WithMiddlewareManager(*middleware.Manager) Option` — new option on `NewReverseProxy`; nil keeps the fast path (reverseproxy.go:48-56).
+- `proxy/internal/proxy.PathTarget` adds `Middlewares`, `CaptureConfig`, `AgentNetwork`, `DisableAccessLog` (servicemapping.go:27-51), all zero-default.
+- `proxy/internal/proxy.CapturedData` adds `agentNetwork`, `suppressAccessLog`, `userGroupNames` behind `sync.RWMutex`; slices deep-copied (context.go:47-66, 183-258).
+- `accesslog.logEntry.AgentNetwork` + `proto.AccessLog.AgentNetwork` (logger.go:131, 268).
+- `metrics.Metrics.Meter()` exposes the OTel meter for the middleware manager (metrics.go:53-58).
+
+## Invariants
+
+- **Synth-service updates are live (no proxy restart).** Every `MODIFIED` flows through `modifyMapping → cleanupMappingRoutes` (invalidates chains) `→ setupHTTPMapping → updateMapping → rebuildMiddlewareChains`. **ProxyMapping.Private preservation:** the relevant logic lives in `management/internals/shared/grpc/proxy.go:shallowCloneMapping`, not this module, but it surfaces here — if a `MODIFIED` synth service arrives `private=false`, auth skips `ValidateTunnelPeer`, `CapturedData.UserGroups` stays empty, and `llm_router` denies with `llm_policy.no_authorised_provider` until a management restart re-pushes the snapshot. This module assumes `mapping.GetPrivate()` is correct on every batch.
+- **`EnableLogCollection=false` suppresses access-log writes but middleware still runs.** Gate is one `if !cd.GetSuppressAccessLog()` immediately around `l.log(entry)` (middleware.go:95); `trackUsage` runs below the gate. Locked by `TestMiddleware_SuppressAccessLog_PreservesUsageTracking` (middleware_test.go:139).
+- **`agent_network` flag on access-log entries is set when the chain processed the request.** Source `target.AgentNetwork`, stamped at reverseproxy.go:105, read at accesslog/middleware.go:86.
+- **auth → builtin group propagation.** `Protect` writes `UserGroups`/`UserGroupNames`; `buildRequestInput` (reverseproxy.go:333) copies them into `middleware.Input`. The response-leg `respInput` (reverseproxy.go:196-223) also carries `UserEmail`/`UserGroups`/`UserGroupNames` — `llm_limit_record` needs `UserGroups` to ship `group_ids` so management's group-targeted budget rules match (comment at reverseproxy.go:211-215).
+- **Empty chains stay on the fast path.** `ServeHTTP` skips body capture and the run sequence when `chain == nil || chain.Empty()` (reverseproxy.go:127).
+- **Self-registration is the only way a builtin reaches the registry.** `middleware_register.go` blank-imports each builtin; `init()` adds the factory to `mwbuiltin.DefaultRegistry()`. Missing it → translator drops the entry with a warn (translate.go:97).
+
+## Things to scrutinize
+
+### Correctness
+- **Translate edge cases** — drops on nil cfg, empty ID, unknown ID, UNSPECIFIED slot; each logs one warn; volume bounded by `MaxMiddlewaresPerChain`.
+- **Re-translate without dropping in-flight requests** — `Manager.Rebuild` is the only call from `rebuildMiddlewareChains`. Reverse proxy reads `ChainFor` once per request (reverseproxy.go:327) and runs the captured `*Chain` for the whole request. Verify in module 30 that `Rebuild` swaps atomically.
+- **ProxyMapping.Private preservation** — enforced management-side in `shallowCloneMapping`. Proxy-side regression catches: `TestProtect_PrivateService_TunnelPeerGroupsPropagate` + the integration test.
+- **Body-capture cleanup** — `defer releaseBudget()` (reverseproxy.go:145) and `defer capturingWriter.Release()` (reverseproxy.go:180) must run on every return; confirm no future `return` lands between acquisition and defer.
+- **`applyUpstreamRewrite` clones the URL** — `cloned := *orig` value-copies `*url.URL`; safe because overwritten fields are strings, not slices/maps (reverseproxy.go:285-292).
+
+### Security
+- **Translate validates every config** — registry membership rejects unknown IDs; UNSPECIFIED slot drops; ID-less drops; raw config copied (not aliased) at translate.go:109.
+- **`AuthHeader`/`StripHeaders` only reachable via `UpstreamRewrite`** — regular mutation surface goes through the framework denylist (`Authorization`/`Cookie` blocked); only the router middleware can replace `Authorization` (reverseproxy.go:296-304). Confirm in module 30 nothing outside the proxy-trusted path populates `UpstreamRewrite.AuthHeader`.
+- **`stampNetBirdIdentity` strips client-sent values first** (reverseproxy.go:742-743) — anti-spoof for `X-NetBird-User`/`X-NetBird-Groups`; control chars filtered; comma-bearing labels dropped (reverseproxy_test.go:1217/:1243/:1193).
+- **Auth → group propagation** — `auth/middleware_test.go:322` and `:366` cover the contract. If auth ever stops calling `ValidateTunnelPeer` for Private services, every agent-network request silently denies.
+
+### Concurrency
+- **Chain replacement under in-flight requests** — `findTargetForRequest` takes `mappingsMux.RLock`; `AddMapping` writes. `resolveChain` calls `ChainFor` once; even if `Rebuild` swaps mid-request, in-flight requests keep running on the captured pointer.
+- **`CapturedData` mutation across slots** — accessors take `sync.RWMutex`; slices deep-copied on both Set and Get. Verify no caller mutates the returned slice expecting it to land back.
+- **`Manager.Invalidate` race** — `removeMapping` invalidates after `cleanupMappingRoutes`; mapping read happens before chain resolution, so requests before invalidate run captured chains; later ones fail `findTargetForRequest`.
+- **`Logger.log` goroutine** — `logSem` caps at `maxLogWorkers = 4096`; overflow → `dropped.Add(1)` + debug log. Middleware test uses a buffered channel and 150ms negative-assertion window — review whether 150ms holds on slow CI.
+
+### Backward compatibility
+- **Non-agent-network services unaffected** — `protoToMapping` reads new fields only when `opts != nil`; defaults leave `Middlewares`/`CaptureConfig` nil → chain resolves nil → fast path. Existing `reverseproxy_test.go` (non-chain) still passes.
+- **`disable_access_log` is proto field 13, default false** — every existing target unset; gate is no-op. Locked by `TestMiddleware_SuppressAccessLog_DefaultEmitsLog` (middleware_test.go:104).
+- **`Server` additions optional** — 256 MiB default when `MiddlewareCaptureBudgetBytes ≤ 0` (server.go:1997-2000).
+
+### Performance
+- **Translate cost per push** — O(n) with per-entry registry lookup and `config_json` copy; negligible vs. the upstream gRPC unmarshal.
+- **Empty-chain hot path** — one `ChainFor` map lookup + one `chain.Empty()` check; no allocation delta vs. pre-PR.
+- **Body capture buffer churn** — `bodytap.CaptureRequest` allocates `MaxRequestBytes` per chain-hitting request; `releaseBudget` ties allocation to the 256 MiB proxy-wide budget. Confirm in module 30 the budget is a hard cap.
+
+### Observability
+- **Metrics** — `Metrics.Meter()` shared with `middleware.NewMetrics` (server.go:1990-1993) so middleware instruments land in the same prometheus exporter. No new metrics defined here.
+- **Access-log accuracy** — every entry carries `AgentNetwork`; terminal-slot metadata merged into `CapturedData.Metadata` (reverseproxy.go:238-241).
+- **Deny logs at `Infof`** (reverseproxy.go:170) — review whether `Info` is too noisy at high deny rates; consider Debug or rate-limit.
+
+## Test coverage
+
+| Test file | Locks down |
+| --------- | ---------- |
+| proxy/middleware_translate_test.go | Empty/nil → nil; field preservation; unknown ID skip; nil registry permissive; timeout clamping; fail-mode + slot incl. UNSPECIFIED-drop; empty-ID drop; truncation above + at `MaxMiddlewaresPerChain` |
+| proxy/internal/proxy/reverseproxy_test.go | Rewrite host/headers/cookies/query; trusted proxy; path forwarding; classifyProxyError; X-NetBird-User/Groups anti-spoof + CSV-join + control-char/comma rejection + fallback-to-ID; `TestBuildRequestInput_PropagatesIdentityAndGroups` (UserGroups/Email/GroupNames/AgentNetwork reach `middleware.Input`) |
+| proxy/internal/proxy/agent_network_chain_realstack_test.go | **The end-to-end integration test.** Drives a real agent-network request through `ReverseProxy.ServeHTTP` with the chain the synthesizer produces, against an in-process management gRPC (bufconn) backed by a real sqlite store + real `agentnetwork.Manager`, plus an `httptest` upstream — no external infrastructure or real LLM. Guarantees: (1) response-leg `respInput` carries `UserGroups` so `llm_limit_record` ships non-empty `group_ids` and the admin-group consumption row increments; (2) `RedactPii=true` redacts both prompt and completion on captured metadata; (3) the full chain runs against a real management stack. **Line 189-211 inlines the proto→Spec mapping** instead of calling the proxy's private `translateMiddlewareConfig` — keep that inline mirror in sync with `proxy/middleware_translate.go` or the test silently diverges from production. |
+| proxy/internal/accesslog/middleware_test.go | `SuppressAccessLog=true` skips `SendAccessLog` (150ms negative wait); default emits one send (2s positive); usage tracking runs under suppression |
+| proxy/internal/auth/middleware_test.go | `TestProtect_PrivateService_TunnelPeerGroupsPropagate` proves `peer_group_ids` reach `CapturedData.UserGroups`; `TestProtect_PrivateService_TunnelPeerDenied` proves rejected peers 403 without reaching the handler |
+
+The integration test runs in a few seconds with no external infrastructure — exercising the real synthesizer, `Manager.Rebuild`, `ServeHTTP` dispatch, and `llm_limit_record` writing a real consumption row through the real `agentnetwork.Manager` over real gRPC.
+
+## Known limitations / explicit non-goals
+
+- **Translator does not validate `RawConfig` JSON** — factory's job at `New([]byte)`. Confirm in module 30 that a per-binding factory failure doesn't poison the rest of the chain.
+- **No throttle on management push rate** — every `MODIFIED` triggers `Manager.Rebuild`. Mitigation upstream.
+- **Streaming responses (SSE)** — body capture is streaming-aware, but response-leg middleware runs only after the response completes; long SSE streams delay `llm_limit_record` until close.
+- **OIDC-only path doesn't carry tunnel-peer groups** — agent-network synth services rely on the Private tunnel-peer path; JWT groups claim is the only carrier for non-Private OIDC.
+- **`agent_network` flag on L4 entries** not added; HTTP-only.
+- **`mw.capture.bypass_reason` metadata key** documented at reverseproxy.go:151,184; namespace this in module 30/31 to avoid collisions.
+
+## Cross-references
+- Upstream: [shared/api](10-shared-api.md), [proxy/middleware-framework](30-proxy-middleware-framework.md), [proxy/middleware-builtin](31-proxy-middleware-builtin.md), [proxy/llm-parsers](32-proxy-llm-parsers.md)
+- End-to-end flow: [../01-end-to-end-flows.md](../01-end-to-end-flows.md)
+- Top-level: [../00-overview.md](../00-overview.md)
diff --git a/docs/agent-networks/modules/40-dashboard.md b/docs/agent-networks/modules/40-dashboard.md
new file mode 100644
index 000000000..4ed9021bb
--- /dev/null
+++ b/docs/agent-networks/modules/40-dashboard.md
@@ -0,0 +1,228 @@
+# dashboard — UI for agent-networks
+
+This module documents code that lives in the **dashboard repo** (under
+`src/modules/agent-network/` and `src/app/(dashboard)/agent-network/`), not
+in this repo. It is co-located here so backend readers see the full picture.
+
+> **Risk level:** Medium. The new surface is isolated under `src/modules/agent-network/` and `src/app/(dashboard)/agent-network/`, but it also reshapes the sidebar, splits `/peers`, renames `reverse-proxy/clusters` → `self-hosted-proxies`, and overlays the Control Center graph. Regressions here would be cross-cutting.
+> **Backward-compat impact:** Additive on the API side. Breaking on URL/navigation: `/peers` redirects to `/peers/devices` (src/app/(dashboard)/peers/page.tsx:7-15), `/reverse-proxy/clusters` was renamed to `/reverse-proxy/self-hosted-proxies`, the sidebar lost Access Control / Networks / Reverse Proxy / DNS / standalone Guardrails / Consumption / Activity (Navigation.tsx:165-171 — routes still resolve via URL), and the standalone `/agent-network/{access-log,consumption,global-controls}` routes are gone in favor of `/agent-network/observability`.
+
+## Module boundary
+
+The dashboard is the only place an operator interacts with agent-networks: provider catalog, configured providers, policies, guardrails, account-level budget rules, account settings (collection / redaction toggles), per-request access log, and consumption rollups all render, paginate, and edit here. Data flows in via SWR (`useFetchApi`) keyed by REST URL. One big context provider (`src/modules/agent-network/AIProvidersProvider.tsx`) aggregates five resources (providers, policies, guardrails, budget rules, settings) plus the proxy access-log stream filtered to `agent_network=true`, and exposes `add* / update* / toggle* / delete*` mutators that call through `useApiCall` and re-`mutate()` SWR. Pages mount the provider once at the top and compose presentational tables and modals beneath. The control-center page additionally fetches `/agent-network/{providers,policies}` directly (control-center/page.tsx:123-130) to overlay graph nodes.
+
+## What the UI delivers
+
+- **AI Observability** page with four tabs: Access Logs, Budget Dashboard,
+  Budget Settings, Log Settings (replaces the standalone access-log,
+  consumption, and global-controls routes).
+- **Providers** page: provider catalog + connect/edit wizard with per-vendor
+  copy (LiteLLM, Portkey, Bifrost, Cloudflare, Vercel, OpenRouter, custom).
+- **Policies** page: group → provider authorization with per-policy Limits
+  (minute-granular windows) + guardrail attach.
+- **Guardrails** page: reusable model-allowlist + prompt-capture sets.
+- **Account controls**: Log Collection / Prompt Collection / Redact PII toggles.
+- **Budget rules**: account-level rules reusing the policy Limits UI.
+- **Control Center overlay**: provider + agent-policy nodes on the graph.
+- **Navigation + peers reshaping**: peers split into Devices / Agents,
+  `reverse-proxy/clusters` renamed to `self-hosted-proxies`, sidebar
+  repackaged for agent-network focus.
+
+## Surface added
+
+### New pages
+
+| Route | Purpose | Backing module(s) |
+| ----- | ------- | ----------------- |
+| `/agent-network` | Redirect to `/agent-network/providers` | page.tsx:7-15 |
+| `/agent-network/providers` | List + connect providers; header surfaces per-account base URL | providers/page.tsx + AgentProvidersTable + AIProviderModal |
+| `/agent-network/policies` | Group → Provider authorization with per-policy Limits + Guardrail attach | policies/page.tsx + AgentPoliciesTable + AgentPolicyModal |
+| `/agent-network/guardrails` | Reusable guardrail sets (model allowlist + prompt capture) | guardrails/page.tsx + AgentGuardrailsTable + AgentGuardrailModal |
+| `/agent-network/observability` | Tabs: Access Logs / Budget Dashboard / Budget Settings / Log Settings | observability/page.tsx |
+| `/peers/devices`, `/peers/agents` | Split of `/peers`, shared via `PeersListView` keyed by `kind` | peers/{devices,agents}/page.tsx |
+| `/reverse-proxy/self-hosted-proxies` | Renamed from `clusters` | self-hosted-proxies/page.tsx |
+
+Removed in favor of `/agent-network/observability`: `/agent-network/access-log`, `/agent-network/consumption`, `/agent-network/global-controls`.
+
+### New modules under src/modules/agent-network
+
+| File | Role |
+| ---- | ---- |
+| AIProvidersProvider.tsx (~1158 LOC) | Aggregates every agent-network resource via SWR; normalises snake↔camel; exposes mutators; holds wizard-open state |
+| AIProviderModal.tsx (~1268 LOC) | Connect / edit provider wizard with per-vendor copy (Bifrost, Portkey, LiteLLM, Cloudflare, Vercel, OpenRouter, custom) |
+| AIProviderLogo + useProviderCatalog | Catalog-driven brand swatch + SWR hook over `/agent-network/catalog/providers` |
+| AgentPoliciesTable + AgentPolicyModal + AgentPolicyGuardrailsTab + AgentPolicyLimitsTab | Policies; modal has 3 tabs (Rule, Limits, Guardrails) |
+| AgentGuardrailsTable + AgentGuardrailModal + AgentGuardrailBrowseModal + AgentGuardrailChecksCell | Guardrails CRUD + attach-from-policy |
+| AgentBudgetRulesTable + AgentBudgetRuleModal | Account-level budget rules; modal reuses AgentPolicyLimitsTab verbatim |
+| AgentAccountControlsCard | Three account-wide toggles (Log Collection / Prompt Collection / Redact PII) |
+| AgentAccessLogTable + AgentAccessLogExpandedRow | Access log on `/events/proxy?agent_network=true` |
+| AgentConsumptionPanel + AgentConsumptionTable | Token + cost panel: charts + counter table |
+| table/AgentProvidersTable + AgentProviderActionCell | Providers table + per-row actions |
+| data/mockData.ts | Domain types and a few residual `MOCK_*` constants (see scrutinize) |
+
+### Touched non-agent-network areas
+
+- **control-center**: agent-network overlay (provider + agent-policy nodes); removed the All Networks dropdown; hid the Networks tab in FlowSelector (FlowSelector.tsx:9-14 — enum value kept so `?tab=networks` still type-checks); wrapped `ControlCenterView` in `AIProvidersProvider` (page.tsx:73-83); `agentPolicyNode` clicks routed to a separate state slot (page.tsx:1871-1874). New node renderers: nodes/ProviderNode.tsx, nodes/AgentPolicyNode.tsx (registered at utils/nodes.ts:21-22).
+- **peers**: Split into Devices and Agents sub-routes; shared via `PeersListView` keyed by `kind` (PeersListView.tsx:24-95). New compact-toolbar `UserFilterSelector` (users/UserFilterSelector.tsx).
+- **reverse-proxy**: Folder rename `clusters/` → `self-hosted-proxies/`; deleted `ClustersFeaturesCell.tsx`, `ClusterTypeIndicator.tsx`; new ReverseProxyClusterTargetSelector for cluster target type; Private toggle on target modal; body-capture knobs removed; new ReverseProxyEventExpandedRow.
+- **events**: `ReverseProxyEventsUserCell` rewritten with user + peer fallback (ReverseProxyEventsUserCell.tsx:14-21), shared with the access-log table.
+- **navigation**: Full repackaging in Navigation.tsx — Agent Network items flattened (no collapsible parent), distinct icons per item; Access Control, Networks, Reverse Proxy, DNS, standalone Guardrails, Consumption, Activity removed (still URL-reachable, per lines 165-171).
+
+## Architecture & flow
+
+### Page → Provider → Table/Modal hierarchy
+
+```mermaid
+graph TD
+  Nav[Navigation.tsx]
+  Nav --> ProvidersPage[/agent-network/providers/]
+  Nav --> PoliciesPage[/agent-network/policies/]
+  Nav --> GuardrailsPage[/agent-network/guardrails/]
+  Nav --> ObsPage[/agent-network/observability/]
+
+  ProvidersPage --> AIPP1[AIProvidersProvider]
+  PoliciesPage --> AIPP2[AIProvidersProvider]
+  GuardrailsPage --> AIPP3[AIProvidersProvider]
+  ObsPage --> AIPP4[AIProvidersProvider]
+  ObsPage -.wraps.-> GroupsProvider
+  ObsPage -.wraps.-> PeersProvider
+
+  AIPP1 --> ProvTable[AgentProvidersTable]
+  ProvTable --> ProvModal[AIProviderModal]
+  AIPP2 --> PolTable[AgentPoliciesTable]
+  PolTable --> PolModal[AgentPolicyModal]
+  PolModal --> PolGuardTab[AgentPolicyGuardrailsTab]
+  PolModal --> PolLimitsTab[AgentPolicyLimitsTab]
+  PolGuardTab --> GuardBrowse[AgentGuardrailBrowseModal]
+  PolGuardTab --> GuardModal[AgentGuardrailModal]
+  AIPP3 --> GuardTable[AgentGuardrailsTable]
+  GuardTable --> GuardModal
+  AIPP4 --> Tabs[Tabs]
+  Tabs --> AccessLog[AgentAccessLogTable]
+  Tabs --> Consumption[AgentConsumptionPanel]
+  Tabs --> BudgetRules[AgentBudgetRulesTable]
+  Tabs --> AccountCtl[AgentAccountControlsCard]
+  BudgetRules --> BudgetModal[AgentBudgetRuleModal]
+  BudgetModal -.reuses.-> PolLimitsTab
+```
+
+### AI Observability tab page
+
+```mermaid
+graph LR
+  Page[AIObservabilityPage] --> RA[RestrictedAccess<br/>permission.services.read]
+  RA --> GP[GroupsProvider]
+  GP --> PP[PeersProvider]
+  PP --> AIP[AIProvidersProvider]
+  AIP --> Tabs[Tabs / TabsList]
+  Tabs --> T1[Access Logs<br/>AgentAccessLogTable]
+  Tabs --> T2[Budget Dashboard<br/>AgentConsumptionPanel]
+  Tabs --> T3[Budget Settings<br/>AgentBudgetRulesTable]
+  Tabs --> T4[Log Settings<br/>AgentAccountControlsCard]
+  T1 -.GET.-> EP[/events/proxy?agent_network=true/]
+  T2 -.GET poll 5s.-> CONS[/agent-network/consumption/]
+  T3 -.GET/PUT.-> BR[/agent-network/budget-rules/]
+  T4 -.GET/PUT.-> ST[/agent-network/settings/]
+```
+
+### Data fetch path
+
+```mermaid
+graph TD
+  Page[Page component] --> Prov[AIProvidersProvider]
+  Prov -->|useFetchApi| SWR[(SWR cache<br/>key = URL)]
+  SWR -.GET.-> P[/agent-network/providers/]
+  SWR -.GET.-> POL[/agent-network/policies/]
+  SWR -.GET.-> G[/agent-network/guardrails/]
+  SWR -.GET.-> BR[/agent-network/budget-rules/]
+  SWR -.GET ignoreError.-> ST[/agent-network/settings/]
+  SWR -.GET.-> CAT[/agent-network/catalog/providers/]
+  SWR -.GET pageSize=100.-> EVT[/events/proxy agent_network=true/]
+  Prov --> Mut[useApiCall.post/put/del]
+  Mut -.on success.-> MutateSWR[SWR mutate keys]
+  Prov --> Children[Tables / Modals via useAIProviders]
+```
+
+Every list view reaches management through SWR over `/api/agent-network/*`. The provider context maps snake-case payloads to camelCase domain types (`fromAPI`, `policyFromAPI`, `guardrailFromAPI`, `budgetRuleFromAPI`, `settingsFromAPI`, `accessLogFromAPI` — AIProvidersProvider.tsx:138-562) and back via matching `*ToRequest` adaptors. The access log piggy-backs on `/events/proxy` with `agent_network=true&page_size=100` (line 707-709) and decodes LLM-specific fields from per-event `metadata`. Group IDs on events are resolved to current names through the surrounding GroupsProvider catalog (lines 515-521, 717-731) — no extra round trip. Mutators run `*ToRequest`, await `useApiCall.post/put/del`, call SWR `mutate()`, then `notify`. Errors caught and surfaced via `notify` — no exceptions escape into render. The Connect Provider modal's open state lives in the provider itself (`isWizardOpen` at lines 732-735) so the providers-page empty-state CTA and the table's + button share one modal. Control-center re-fetches `/agent-network/{providers,policies}` directly on top of `AIProvidersProvider` — SWR de-dupes but the code path is harder to reason about.
+
+## Public contracts consumed
+
+- `GET/POST /api/agent-network/providers`, `PUT/DELETE /:id`
+- `GET/POST /api/agent-network/policies`, `PUT/DELETE /:id`
+- `GET/POST /api/agent-network/guardrails`, `PUT/DELETE /:id`
+- `GET/POST /api/agent-network/budget-rules`, `PUT/DELETE /:id`
+- `GET/PUT /api/agent-network/settings` (ignoreError-tolerant; 404 = not yet bootstrapped — auto-bootstrap on first provider create via `bootstrap_cluster` field — AIProvidersProvider.tsx:737-760)
+- `GET /api/agent-network/catalog/providers` (read-only declarative; backend owns vendor list, IDs, brand colors, models, extra_headers, identity_injection — useProviderCatalog.ts:6-95)
+- `GET /api/agent-network/consumption` (polled every 5s on Budget Dashboard — ConsumptionPanel.tsx:53,65-71)
+- `GET /api/events/proxy?agent_network=true&page_size=100` (shared with Proxy Events)
+- `permission?.services?.read` gates every agent-network route via RestrictedAccess.
+
+`AIProviderId` is a closed union in dashboard types (data/mockData.ts:8-21) but the converter tolerates anything the backend ships — unknown ids fall through to `"custom"` (AIProvidersProvider.tsx:497-506). Catalog values are pure read-through: anything declared in `extra_headers` renders in the modal automatically, copy keyed by header name (`EXTRA_HEADER_UI` in AIProviderModal.tsx:61-89), labeled-fallback for unknown ones.
+
+## Invariants
+
+- Provider context wrap order on user-attribution pages: `GroupsProvider > PeersProvider > AIProvidersProvider` (observability/page.tsx:87-89). Reverse it and access-log group resolution silently drops names.
+- Every agent-network route checks `permission?.services?.read` via `RestrictedAccess` (observability/page.tsx:85, providers/page.tsx:184, policies/page.tsx:53, guardrails/page.tsx:55).
+- Modal `key={open ? 1 : 0}` pattern is used to force unmount/remount on close so internal `useState` resets between edits (AgentBudgetRuleModal.tsx:60, AgentPolicyModal.tsx:66). Removing this would leak prior-row state into a new-row session.
+- `mockData.ts` is the canonical home for ALL agent-network domain types; `MOCK_*` constants must never reach a production code path. One leak remains (below).
+
+## Things to scrutinize
+
+### Correctness
+
+- **Tab-state URL hand-off is one-way.** observability/page.tsx:53-58 reads `?tab=` on mount (despite the file comment at line 28 saying URL hand-off is future) but `setTab` does NOT push back, so reload preserves the chosen tab only if it came in via the link. Inconsistent with control-center (page.tsx:1817-1831).
+- **Provider overlay runs only in `applySingleGroupView` / `applyPeerView`** (control-center/page.tsx:557, 1159-1166). User view does NOT show providers — if agent-network is a primary lens, that's a gap.
+- **Two useEffects race to invalidate the control-center layout.** page.tsx:1655-1657 drops `layoutInitialized` when `agentPolicies` / `agentProviders` arrive; the main effect (1786-1799) also lists them as deps. Functional but fragile — watch for flash-of-empty-graph.
+- **`updateProvider` / `updatePolicy` / `updateBudgetRule` use `??` on `enabled`** (AIProvidersProvider.tsx:784, 859, 1018). Toggle paths are safe; any caller sending `enabled: false` thinking "leave it off" gets `existing.enabled` instead. Audit modal callers.
+- **Form validation in modals is minimal.** Window-seconds picker — mockData.ts:209-215 documents "minimum 60 — one minute" but there is no matching UI guard in PolicyLimitsTab; the backend validator is the enforcement point.
+
+### Security
+
+- **No client-side enforcement claims** — every cap, allowlist, and toggle is display + edit; proxy is the source of truth for deny decisions (AccessLogTable.tsx:177-191 renders backend-emitted `denyReason` as-is).
+- **Prompt display is gated by what the backend stamps.** When `enable_prompt_collection` is OFF the proxy must not put prompt/completion into event metadata; the dashboard renders whatever it gets verbatim (AccessLogTable lines 532-534, AccessLogExpandedRow.tsx:42-57). No UI filter on top of backend collection switches.
+- Account Controls disables `Redact PII` when `Prompt Collection` is off (AgentAccountControlsCard.tsx:122) and clears it on off-transition (line 100), but relies on backend to enforce the same gate at write — confirm PUT handler rejects `redact_pii=true && enable_prompt_collection=false`.
+- **Bifrost identity-header overrides**: empty-string vs nil semantics documented in AIProvidersProvider.tsx:772-781 ("omitted = preserve, empty = explicit clear"). Mishandling could leak group attribution to a header the operator thought disabled. Focused read of Bifrost code path in AIProviderModal.tsx recommended.
+
+### Accessibility
+
+- Observability TabsList (observability/page.tsx:96-113) uses the shared Tabs component — should inherit Radix roving-tabindex. All four TabsTriggers carry only icon + text, no `aria-label`; fine because text is visible.
+- Modal focus traps are inherited from the shared Modal; agent-network modals don't override them. Quick keyboard pass recommended.
+- `EndpointBadge` Copy button (providers/page.tsx:66-76) has an `aria-label`, good.
+
+### Performance
+
+- `AgentConsumptionPanel` polls `/agent-network/consumption` every 5s (ConsumptionPanel.tsx:53,70). Tab switches unmount the panel, so the poll stops — verify in network panel.
+- `AgentAccessLogTable` is hard-capped at 100 rows via `page_size=100` (AIProvidersProvider.tsx:707-709). Server-side pagination is future work; high-traffic tenants miss everything past row 100 — known limitation.
+- Observability page mounts providers ONCE at page level (observability/page.tsx:87-89); tab switches keep SWR cache hot. Moving the provider mount inside `TabsContent` would re-fetch the access log on every switch.
+
+### Visual consistency
+
+- The observability tab style mirrors peers/page.tsx. Outer Tabs `pt-4 pb-0 mb-0`, TabsList `px-8` (observability/page.tsx:94-96) — confirm chrome height matches so the page doesn't visually jump.
+- Sidebar: `Boxes` for Providers, `AccessControlIcon` for Policies, `TelescopeIcon` for AI Observability (Navigation.tsx:113,120,133). Reusing `AccessControlIcon` makes Policies look identical to the (now hidden) Access Control item — if Access Control ever comes back, they collide.
+- `AgentNetworkIcon` is used in breadcrumbs on every agent-network page but NOT in the sidebar (per-page icons instead). Deliberate departure — record so it doesn't get reverted.
+
+## Test coverage
+
+- **Cypress**: One file (`cypress/e2e/test.cy.ts`) covering only the install-page copy-to-clipboard flow. NOTHING covers agent-network UI.
+- **Component / unit tests**: `src/utils/version.test.ts` is the only `.test.*` file in the repo. The agent-network modules ship without component tests.
+- Data-cy hooks exist on key controls: `save-account-controls` (AgentAccountControlsCard.tsx:71), `enable-log-collection`, `enable-prompt-collection`, `redact-pii`, plus existing `data-cy={policy.name}` / `data-cy={provider.name}` on ActiveInactiveRow. Sufficient hooks for Cypress flows; none written yet.
+- **Tooling gap (pre-existing):** `npm run lint` (`next lint`) is broken in Next 16 — the `lint` subcommand was removed from the Next CLI in 16.x, so the dashboard effectively has no working lint gate. The fix is to add either a flat-config `eslint .` script or wire ESLint via an explicit `eslint-config-next` invocation.
+
+## Known limitations / explicit non-goals
+
+- **`data/mockData.ts` still contains `MOCK_GROUPS`, `MOCK_PROVIDERS`, `MOCK_PEERS`.** Only `MOCK_GROUPS` is referenced from production — AgentPoliciesTable.tsx:45,76 uses it as a name-lookup fallback when a policy references a group ID the real GroupsProvider doesn't know about. `MOCK_PROVIDERS` / `MOCK_PEERS` are unreferenced; safe to delete. The file is `/* eslint-disable */` so dead-code warnings don't flag them.
+- **Tab-state URL hand-off on observability page is one-way** (read-only).
+- **Access log hard-capped at 100 rows**; no server-side pagination.
+- **No optimistic updates.** All mutations are round-trip; failures rollback via SWR revalidation.
+- **`FlowView.NETWORKS` retained but hidden** from FlowSelector (FlowSelector.tsx:9-14). Old `?tab=networks` links still route to the hidden view because `applyNetworksView` still runs.
+- **Redirects are not query-preserving** — `router.replace("/peers/devices")` (peers/page.tsx:13) strips any incoming filter params.
+- **Control-center cross-fetches** `/agent-network/{providers,policies}` directly on top of `AIProvidersProvider`. Could be collapsed.
+- **Sidebar permanently hides Access Control, Networks, Reverse Proxy, standalone Guardrails, DNS, Activity, Consumption.** Routes still resolve via URL (Navigation.tsx:165-171); intentional.
+
+## Cross-references
+
+- Upstream API contracts: [shared/api](10-shared-api.md)
+- Backend persistence: [management/store](20-management-store.md)
+- Backend handler wiring: [management/handlers + wiring](22-management-handlers-wiring.md)
+- End-to-end flow narrative: [../01-end-to-end-flows.md](../01-end-to-end-flows.md)
+- Top-level overview: [../00-overview.md](../00-overview.md)
diff --git a/docs/agent-networks/modules/50-path-routed-providers.md b/docs/agent-networks/modules/50-path-routed-providers.md
new file mode 100644
index 000000000..b7cda3a97
--- /dev/null
+++ b/docs/agent-networks/modules/50-path-routed-providers.md
@@ -0,0 +1,251 @@
+# path-routed providers — Vertex AI + Bedrock
+
+This guide pulls the **path-routed** provider story together in one place
+because it crosses the catalog, the synthesiser, the request parser, and the
+router. The relevant building blocks are the `llm_router` /
+`llm_request_parser` middlewares
+([31-proxy-middleware-builtin.md](31-proxy-middleware-builtin.md)), the
+per-provider parser surface ([32-proxy-llm-parsers.md](32-proxy-llm-parsers.md)),
+and the synthesiser's catalog → `ProviderRoute` mapping
+([21-management-agentnetwork.md](21-management-agentnetwork.md)).
+
+Sibling modules: [31-proxy-middleware-builtin.md](31-proxy-middleware-builtin.md)
+(router + request parser) and [32-proxy-llm-parsers.md](32-proxy-llm-parsers.md)
+(Bedrock parser + pricing).
+
+---
+
+## What "path-routed" means
+
+Most catalog providers carry the model in the request **body** (`{"model": …}`),
+so `llm_router` selects an upstream by matching the model name against each
+provider's `Models` claim. Two providers instead carry the model in the **URL
+path**, so they are routed by path before the model/vendor table is consulted:
+
+| Catalog id | Style flag | Request path shape |
+|---|---|---|
+| `vertex_ai_api` | `IsVertexPathStyle` → `ProviderRoute.Vertex` | `/v1/projects/{project}/locations/{region}/publishers/{publisher}/models/{model}:{action}` |
+| `bedrock_api` | `IsBedrockPathStyle` → `ProviderRoute.Bedrock` | `/model/{modelId}/{action}` (optionally behind `/bedrock`) |
+
+The catalog declares the style with
+[`catalog.IsVertexPathStyle` / `catalog.IsBedrockPathStyle`](../../../management/server/agentnetwork/catalog/catalog.go)
+and the synthesiser copies the result onto the router route as the `Vertex` /
+`Bedrock` booleans
+([synthesizer.go:450-451](../../../management/server/agentnetwork/synthesizer.go)).
+On the request leg `llm_router.Invoke` dispatches `isVertexPath` / `isBedrockPath`
+**before** the model lookup
+([llm_router/middleware.go:138-216](../../../proxy/internal/middleware/builtin/llm_router/middleware.go))
+so a model the parser extracted from the path can't be claimed by a same-vendor
+*body-routed* provider (e.g. `claude-*` on `api.anthropic.com`).
+
+## Google Vertex AI (`vertex_ai_api`)
+
+### Catalog entry
+
+`KindProvider`, parser surface left unset on the catalog entry — the request
+parser picks the parser from the URL **publisher** segment, not from
+`ParserID`. Upstream host is `<region>-aiplatform.googleapis.com`
+(`https://aiplatform.googleapis.com` for the `global` location). The catalog
+lists the Claude-on-Vertex lineup (`claude-opus-4-*`, `claude-sonnet-4-*`,
+`claude-haiku-4-5`, `claude-fable-5`) at the same per-token rates as the
+first-party Anthropic entry
+([catalog.go:333-363](../../../management/server/agentnetwork/catalog/catalog.go)).
+
+### Credential — service-account OAuth (`keyfile::`)
+
+Vertex does **not** accept a static API key. The operator sets the provider
+`api_key` to:
+
+```
+keyfile::<base64 of the GCP service-account JSON key>
+```
+
+The synthesiser recognises the `keyfile::` prefix in `providerAuthHeader`
+([synthesizer.go:897-903](../../../management/server/agentnetwork/synthesizer.go)),
+emits **no** static auth value, and carries the base64 key material on the
+route as `GCPServiceAccountKeyB64`
+([factory.go:56-61](../../../proxy/internal/middleware/builtin/llm_router/factory.go)).
+At request time the router mints a short-lived OAuth2 access token from the key
+(cloud-platform scope) and injects `Authorization: Bearer <access-token>` —
+never the key itself
+([llm_router/middleware.go:621-692](../../../proxy/internal/middleware/builtin/llm_router/middleware.go)):
+
+- One auto-refreshing `oauth2.TokenSource` is cached per key (keyed by a
+  SHA-256 of the base64 material), so token minting happens once and refreshes
+  amortise across requests.
+- Mint / refresh is bounded by a 10s timeout HTTP client (`gcpTokenTimeout`) so
+  a slow Google token endpoint can't hang the request.
+- A malformed key or an unreachable token endpoint fails the request with
+  `llm_policy.upstream_auth_failed` at HTTP **502** (an upstream problem, not a
+  policy denial) — see `denyUpstreamAuth`.
+
+### Metering — Anthropic-on-Vertex only
+
+The request parser extracts `{publisher, model, action}` from the path
+(`parseVertexPath`, [llm_request_parser/middleware.go:237-263](../../../proxy/internal/middleware/builtin/llm_request_parser/middleware.go)),
+strips the `@version` suffix from the model, and maps the publisher to a parser
+surface via `vertexPublisherVendor`:
+
+- `anthropic` → `llm.provider="anthropic"` → metered through the Anthropic
+  parser, priced under the **`anthropic`** block in `defaults_pricing.yaml`
+  (the parser emits the standard Anthropic provider label, so Vertex Claude
+  reuses first-party Anthropic prices).
+- `openai` → `llm.provider="openai"` (reserved; not in the catalog lineup
+  today).
+- anything else (notably `google` / Gemini) → empty vendor → **no parser**.
+
+**Gemini is intentionally denied as unmeterable.** When the parser emits no
+`llm.provider` for a Vertex publisher, `llm_router` returns
+`llm_policy.unmeterable_publisher` (403) rather than forwarding the request
+uncounted — serving it would bypass token / budget metering
+([llm_router/middleware.go:144-162, 712-728](../../../proxy/internal/middleware/builtin/llm_router/middleware.go)).
+A Gemini parser would lift this restriction; until then the `google` publisher
+is omitted from the catalog.
+
+> Caveat: cross-region inference profiles in `eu` / `apac` carry a ~10% price
+> premium that the base per-token rates do **not** model — cost annotations for
+> those regions read low. Operators who need exact regional billing override
+> the affected entries in `pricing.yaml`.
+
+## AWS Bedrock (`bedrock_api`)
+
+### Catalog entry
+
+`KindProvider`, upstream host `bedrock-runtime.<region>.amazonaws.com`. Metered
+models are the Anthropic-on-Bedrock lineup (`anthropic.claude-*`) plus Amazon
+Nova and Llama 3.3 entries
+([catalog.go:300-332](../../../management/server/agentnetwork/catalog/catalog.go)).
+Anthropic-on-Bedrock reuses the first-party Claude prices (with additive cache
+buckets); Nova / Llama report no cache, so cost is `input + output`.
+
+### Credential — static bearer token
+
+Bedrock uses the **AWS Bedrock API key** as a static bearer. The operator sets
+the provider `api_key` directly (no `keyfile::` prefix); the catalog template
+is `Authorization: Bearer ${API_KEY}`
+([catalog.go:306-307](../../../management/server/agentnetwork/catalog/catalog.go)).
+No token minting — the synthesiser substitutes the key into the template and
+the router injects the resulting `Authorization` header after stripping inbound
+vendor auth (including client-supplied AWS SigV4 material: `X-Amz-Date`,
+`X-Amz-Security-Token`, `X-Amz-Content-Sha256`, see `strippedAuthHeaders`).
+
+### Model id form — cross-region inference profiles
+
+Bedrock model ids in the request path must be the cross-region
+**inference-profile** form, e.g.
+`eu.anthropic.claude-sonnet-4-5-20250929-v1:0`. The bare
+`anthropic.claude-…` id is rejected by AWS. `normalizeBedrockModel`
+([llm_request_parser/middleware.go:398-414](../../../proxy/internal/middleware/builtin/llm_request_parser/middleware.go))
+strips the region prefix (`us.` / `eu.` / `apac.` / `global.`), an optional ARN
+wrapper, and the `-YYYYMMDD-vN[:N]` version/throughput suffix so the normalised
+id (`anthropic.claude-sonnet-4-5`) matches the catalog/pricing key.
+
+### Supported endpoints + actions
+
+`/model/{modelId}/{action}` where action ∈ `invoke`,
+`invoke-with-response-stream`, `converse`, `converse-stream`
+([llm_request_parser/middleware.go:363-390](../../../proxy/internal/middleware/builtin/llm_request_parser/middleware.go)).
+`invoke` / `converse` are non-streaming; the `-stream` actions set the streaming
+flag.
+
+- **InvokeModel** body uses the vendor-native shape — for Anthropic that means
+  `"anthropic_version":"bedrock-2023-05-31"` and snake_case usage with additive
+  cache buckets.
+- **Converse** uses the unified camelCase shape with a precomputed `totalTokens`.
+- The `BedrockParser` reads both shapes on the response leg
+  ([bedrock.go](../../../proxy/internal/llm/bedrock.go)); the request parser
+  doesn't need to distinguish them (`ParseRequest` is a no-op — model + stream
+  come from the path).
+
+### Streaming — AWS binary event-stream
+
+The `-stream` actions return `application/vnd.amazon.eventstream` (the AWS
+binary event-stream framing), and streaming **is metered**.
+`accumulateBedrockStream`
+([llm_response_parser/streaming_bedrock.go](../../../proxy/internal/middleware/builtin/llm_response_parser/streaming_bedrock.go))
+decodes the frames with `aws-sdk-go-v2/aws/protocol/eventstream`:
+
+- InvokeModel `chunk` frames wrap a base64 `{"bytes":…}` payload carrying a
+  vendor-native (Anthropic) stream event — folded through the shared Anthropic
+  stream accumulator.
+- Converse `contentBlockDelta` frames carry text; the trailing `metadata` frame
+  carries the final usage block.
+- A truncated stream (cut at the body-tap capture cap) decodes best-effort:
+  frames up to the cut are applied and partial usage is returned.
+
+### Optional `/bedrock` gateway-namespace prefix
+
+Clients may place an optional `/bedrock` prefix before the native path
+(`/bedrock/model/{modelId}/{action}`) to disambiguate Bedrock from other
+providers that also use `/model/...`. Both the request parser
+(`trimBedrockNamespace`) and the router (`splitBedrockNamespace`) accept it.
+When the prefix is present, the router sets
+`RewriteUpstream.StripPathPrefix = "/bedrock"` so the **native** path
+(`/model/...`) is what reaches `bedrock-runtime.<region>.amazonaws.com`
+([llm_router/middleware.go:168-184, 320-348](../../../proxy/internal/middleware/builtin/llm_router/middleware.go)).
+
+## Model allowlist on path-routed providers
+
+Because the model lives in the URL rather than the body, a path-routed provider
+credential could otherwise be used for any model the upstream supports. The
+router still enforces the route's `Models` allowlist via `matchPathRoute`
+([llm_router/middleware.go:370-416](../../../proxy/internal/middleware/builtin/llm_router/middleware.go)):
+
+1. Filter to routes of the matching style (`Vertex` / `Bedrock`).
+2. Filter to routes whose `AllowedGroupIDs` authorise the caller's groups
+   (else `no_authorised_provider`).
+3. Filter to routes that **claim the requested model**. As with body-routed
+   providers, an **empty `Models` list = catch-all** (serve any model);
+   a non-empty list serves only the listed models (else `model_not_routable`).
+4. Multiple survivors disambiguate by longest `UpstreamPath` prefix match.
+
+So an operator who lists explicit models on a Vertex/Bedrock provider gets a
+hard allowlist; an operator who leaves `Models` empty accepts every model the
+upstream serves (still subject to the unmeterable-publisher gate on Vertex).
+
+Model-less OpenAI endpoints (`GET /v1/models`) are **never** routed to a
+Vertex/Bedrock provider — `matchModelless` skips path-routed routes
+([llm_router/middleware.go:427-462](../../../proxy/internal/middleware/builtin/llm_router/middleware.go))
+so a model-listing call can't be rewritten onto an upstream that would 404 it.
+
+## Catalog ↔ pricing cross-check
+
+Catalog prices and context windows are cross-checked against LiteLLM's
+`model_prices_and_context_window.json`. The proxy's embedded
+`defaults_pricing.yaml` covers **every metered first-party model** the catalog
+enumerates — guarded by
+`TestDefaultTable_FirstPartyModelCoverage`
+([pricing/defaults_coverage_test.go](../../../proxy/internal/llm/pricing/defaults_coverage_test.go)),
+which fails if a catalog model has no embedded price. Bedrock entries are keyed
+by the **normalised** id the request parser emits (region prefix + version
+suffix stripped). Vertex Claude carries no Bedrock-style prefix, so it prices
+straight off the `anthropic` block.
+
+## Things to scrutinise
+
+**Security.** The Vertex service-account key is never forwarded — only a minted
+short-lived bearer. Confirm the key material stays out of access logs (it lives
+on `ProviderRoute.GCPServiceAccountKeyB64`, not in any emitted metadata key).
+The unmeterable-publisher deny is the only thing standing between an
+operator-misconfigured Vertex provider and unmetered Gemini traffic; verify
+`vertexPublisherVendor` stays conservative (deny by default for unknown
+publishers).
+
+**Correctness.** `normalizeBedrockModel` is the join between the wire id and the
+pricing key — a model that normalises to something not in `defaults_pricing.yaml`
+meters at `cost.skipped=unknown_model` rather than failing the request. The
+`/bedrock` prefix strip must run on both the parser side (so the model is
+extracted) and the router side (so the upstream path is native); a regression in
+either silently breaks the other.
+
+**Metering caveats.** eu/apac cross-region Bedrock + Vertex profiles carry a
+~10% premium not modelled by base pricing — flagged in both the catalog comment
+and `defaults_pricing.yaml`. Operators needing exact regional billing override
+the relevant entries.
+
+## Cross-references
+
+- Router + request-parser detail: [31-proxy-middleware-builtin.md](31-proxy-middleware-builtin.md)
+- Bedrock parser + pricing + SSE / event-stream: [32-proxy-llm-parsers.md](32-proxy-llm-parsers.md)
+- Catalog → route synthesis + `keyfile::` handling: [21-management-agentnetwork.md](21-management-agentnetwork.md)
+- Overview: [../00-overview.md](../00-overview.md)
diff --git a/e2e/agentnetwork/bootstrap_test.go b/e2e/agentnetwork/bootstrap_test.go
new file mode 100644
index 000000000..a73d55117
--- /dev/null
+++ b/e2e/agentnetwork/bootstrap_test.go
@@ -0,0 +1,30 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestCombinedBootstrap proves Pillar 1: the shared combined server came up and
+// the /api/setup-minted PAT authenticates a real management API call through
+// the typed REST client (the bootstrap itself ran in TestMain).
+func TestCombinedBootstrap(t *testing.T) {
+	ctx := context.Background()
+
+	require.NotEmpty(t, srv.PAT, "TestMain must have minted an admin PAT")
+
+	users, err := srv.API().Users.List(ctx)
+	require.NoError(t, err, "authenticated Users.List must round-trip")
+	require.NotEmpty(t, users, "the bootstrapped account must have at least one user")
+
+	var emails []string
+	for _, u := range users {
+		emails = append(emails, u.Email)
+	}
+	assert.Contains(t, emails, "admin@netbird.test", "the bootstrapped owner should appear in the users list")
+}
diff --git a/e2e/agentnetwork/chat_test.go b/e2e/agentnetwork/chat_test.go
new file mode 100644
index 000000000..5e3a79273
--- /dev/null
+++ b/e2e/agentnetwork/chat_test.go
@@ -0,0 +1,281 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// providerCase is one entry in the live provider matrix. The same scenario runs
+// for every available provider; availability is keyed off env vars so the suite
+// covers whatever credentials are present (source ~/.llm-keys locally / set the
+// Actions secrets in CI).
+type providerCase struct {
+	name      string
+	catalogID string
+	upstream  string
+	apiKey    string
+	model     string // body model (chat/messages) or path model@version (vertex)
+	kind      string // harness.WireChat, harness.WireMessages, or harness.WireVertex
+	project   string // vertex only: GCP project for the rawPredict path
+	region    string // vertex only: GCP region for the rawPredict path
+}
+
+// availableProviders builds the matrix from the provider env vars that are set.
+func availableProviders() []providerCase {
+	var ps []providerCase
+	if k := os.Getenv("OPENAI_TOKEN"); k != "" {
+		ps = append(ps, providerCase{name: "openai", catalogID: "openai_api", upstream: "https://api.openai.com", apiKey: k, model: "gpt-4o-mini", kind: harness.WireChat})
+	}
+	if k := os.Getenv("ANTHROPIC_TOKEN"); k != "" {
+		ps = append(ps, providerCase{name: "anthropic", catalogID: "anthropic_api", upstream: "https://api.anthropic.com", apiKey: k, model: "claude-haiku-4-5", kind: harness.WireMessages})
+	}
+	if k, u := os.Getenv("VERCEL_TOKEN"), os.Getenv("VERCEL_URL"); k != "" && u != "" {
+		ps = append(ps, providerCase{name: "vercel", catalogID: "vercel_ai_gateway", upstream: u, apiKey: k, model: "openai/gpt-4o-mini", kind: harness.WireChat})
+	}
+	if k, u := os.Getenv("OPENROUTER_TOKEN"), os.Getenv("OPENROUTER_URL"); k != "" && u != "" {
+		// Distinct model string from Vercel so each provider routes unambiguously
+		// while all are enabled together.
+		ps = append(ps, providerCase{name: "openrouter", catalogID: "openrouter", upstream: u, apiKey: k, model: "openai/gpt-4o", kind: harness.WireChat})
+	}
+	if k, u := os.Getenv("CLOUDFLARE_TOKEN"), os.Getenv("CLOUDFLARE_URL"); k != "" && u != "" {
+		// Cloudflare AI Gateway routes by a provider segment in the URL path;
+		// append the openai provider unless the gateway URL already carries one.
+		if !strings.Contains(u, "/openai") {
+			u = strings.TrimRight(u, "/") + "/openai"
+		}
+		// Raw model (distinct string from OpenAI's gpt-4o-mini).
+		ps = append(ps, providerCase{name: "cloudflare", catalogID: "cloudflare_ai_gateway", upstream: u, apiKey: k, model: "gpt-4o", kind: harness.WireChat})
+	}
+	// Vertex (vertex_ai_api): Anthropic-on-Vertex, path-routed, SA-OAuth
+	// (api_key = keyfile::<SA>). The model travels in the rawPredict path rather
+	// than the body, so the provider is created without a models array. Region
+	// defaults to "global" (host aiplatform.googleapis.com); a real region uses
+	// <region>-aiplatform.googleapis.com.
+	if sa := os.Getenv("GOOGLE_VERTEX_SA_BASE64"); sa != "" {
+		project := os.Getenv("GOOGLE_VERTEX_PROJECT")
+		if project != "" {
+			region := os.Getenv("GOOGLE_VERTEX_REGION")
+			if region == "" {
+				region = "global"
+			}
+			host := "aiplatform.googleapis.com"
+			if region != "global" {
+				host = region + "-aiplatform.googleapis.com"
+			}
+			model := os.Getenv("GOOGLE_VERTEX_MODEL")
+			if model == "" {
+				model = "claude-sonnet-4-5@20250929"
+			}
+			ps = append(ps, providerCase{
+				name: "vertex", catalogID: "vertex_ai_api", upstream: "https://" + host,
+				apiKey: "keyfile::" + sa, model: model, kind: harness.WireVertex,
+				project: project, region: region,
+			})
+		}
+	}
+
+	// Bedrock: path-routed, bearer auth. Model is a cross-region inference
+	// profile id (distinct string from the first-party Anthropic case).
+	if k := os.Getenv("AWS_BEARER_TOKEN_BEDROCK"); k != "" {
+		region := os.Getenv("AWS_REGION")
+		if region == "" {
+			region = "us-east-1"
+		}
+		ps = append(ps, providerCase{name: "bedrock", catalogID: "bedrock_api", upstream: "https://bedrock-runtime." + region + ".amazonaws.com", apiKey: k, model: "us.anthropic.claude-haiku-4-5", kind: harness.WireMessages})
+	}
+	return ps
+}
+
+// providerRequest builds a create request for a matrix provider: enabled, with
+// a uniquely-priced model for body-routed providers and none for the
+// path-routed Vertex (whose model lives in the request path).
+func providerRequest(pc providerCase) api.AgentNetworkProviderRequest {
+	req := api.AgentNetworkProviderRequest{
+		Name:        pc.name,
+		ProviderId:  pc.catalogID,
+		UpstreamUrl: pc.upstream,
+		ApiKey:      &pc.apiKey,
+		Enabled:     ptr(true),
+	}
+	if pc.kind != harness.WireVertex {
+		req.Models = &[]api.AgentNetworkProviderModel{
+			{Id: pc.model, InputPer1k: 0.001, OutputPer1k: 0.002},
+		}
+	}
+	return req
+}
+
+// TestProvidersMatrix is Pillar 3: it provisions every available provider (all
+// enabled, each with a unique model so routing stays unambiguous), runs proxy +
+// client once, and drives the same live chat-completion scenario through each
+// provider over the WireGuard tunnel. Each provider must return 200 and produce
+// an ingested access-log row.
+func TestProvidersMatrix(t *testing.T) {
+	matrix := availableProviders()
+	if len(matrix) == 0 {
+		t.Skip("no provider keys set; source ~/.llm-keys to run the provider matrix")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Minute)
+	defer cancel()
+
+	// Group + setup key the client joins into; the policy authorizes it.
+	grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-agents"})
+	require.NoError(t, err, "create agents group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grp.Id) })
+
+	ephemeral := false
+	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+		Name:       "e2e-client",
+		Type:       "reusable",
+		ExpiresIn:  86400,
+		UsageLimit: 0,
+		AutoGroups: []string{grp.Id},
+		Ephemeral:  &ephemeral,
+	})
+	require.NoError(t, err, "mint setup key")
+	require.NotEmpty(t, sk.Key, "setup key plaintext")
+
+	// Create every provider, all enabled, each with a unique model string so the
+	// proxy's connect-time snapshot carries them all and model→provider routing
+	// is unambiguous (provider toggles after connect don't reconcile to the
+	// proxy, so we enable everything up front). The first create bootstraps the
+	// cluster.
+	ids := make([]string, 0, len(matrix))
+	for i, pc := range matrix {
+		req := providerRequest(pc)
+		if i == 0 {
+			req.BootstrapCluster = ptr(harness.AgentNetworkCluster)
+		}
+		prov, perr := srv.CreateProvider(ctx, req)
+		require.NoError(t, perr, "create provider %s", pc.name)
+		ids = append(ids, prov.Id)
+		id := prov.Id
+		t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), id) })
+	}
+
+	enabled := true
+	pol, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-allow",
+		Enabled:                &enabled,
+		SourceGroups:           []string{grp.Id},
+		DestinationProviderIds: ids,
+		// Token limit at the 60s window floor with caps far above the few hundred
+		// tokens this suite drives, so it never blocks traffic but switches on
+		// usage metering, which is what makes consumption rows get recorded.
+		Limits: &api.AgentNetworkPolicyLimits{
+			TokenLimit: api.AgentNetworkPolicyTokenLimit{
+				Enabled:       true,
+				GroupCap:      10_000_000,
+				UserCap:       10_000_000,
+				WindowSeconds: 60,
+			},
+		},
+	})
+	require.NoError(t, err, "create policy")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
+
+	settings, err := srv.GetSettings(ctx)
+	require.NoError(t, err, "read settings for endpoint")
+	require.NotEmpty(t, settings.Endpoint, "agent-network endpoint must be assigned")
+
+	// Proxy (global CLI token) + client, brought up once.
+	proxyToken, err := srv.CreateProxyTokenCLI(ctx, "e2e-proxy")
+	require.NoError(t, err, "mint proxy token via CLI")
+	px, err := harness.StartProxy(ctx, srv, proxyToken)
+	require.NoError(t, err, "start proxy")
+	t.Cleanup(func() { _ = px.Terminate(context.Background()) })
+
+	cl, err := harness.StartClient(ctx, srv, sk.Key)
+	require.NoError(t, err, "start client")
+	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
+
+	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
+	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
+		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
+	}
+	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
+	require.NoError(t, err, "resolve agent-network endpoint to proxy IP")
+
+	for _, pc := range matrix {
+		pc := pc
+		t.Run(pc.name, func(t *testing.T) {
+			before, _ := srv.ListAccessLogs(ctx)
+
+			// Unique per provider so we can find this provider's row by its
+			// session id and confirm the marker propagated end-to-end.
+			sessionID := "e2e-session-" + pc.name
+
+			// Retry briefly to absorb tunnel/DNS jitter on the first call.
+			var code int
+			var body string
+			deadline := time.Now().Add(90 * time.Second)
+			for time.Now().Before(deadline) {
+				var c int
+				var b string
+				var cerr error
+				if pc.kind == harness.WireVertex {
+					c, b, cerr = cl.Vertex(ctx, settings.Endpoint, proxyIP, pc.project, pc.region, pc.model, "Reply with exactly: pong", sessionID)
+				} else {
+					c, b, cerr = cl.Chat(ctx, settings.Endpoint, proxyIP, pc.kind, pc.model, "Reply with exactly: pong", sessionID)
+				}
+				if cerr == nil {
+					code, body = c, b
+					if code == 200 {
+						break
+					}
+				}
+				time.Sleep(5 * time.Second)
+			}
+			require.Equal(t, 200, code, "chat through %s (%s %s) should return 200; body: %s", pc.name, pc.kind, pc.model, body)
+
+			require.Eventually(t, func() bool {
+				logs, lerr := srv.ListAccessLogs(ctx)
+				return lerr == nil && logs.TotalRecords > before.TotalRecords
+			}, 30*time.Second, 2*time.Second, "an access-log row should be ingested for %s", pc.name)
+
+			// The session id sent as x-session-id must round-trip into the
+			// access-log row for this provider.
+			require.Eventually(t, func() bool {
+				logs, lerr := srv.ListAccessLogs(ctx)
+				if lerr != nil {
+					return false
+				}
+				for _, r := range logs.Data {
+					if r.SessionId != nil && *r.SessionId == sessionID {
+						return true
+					}
+				}
+				return false
+			}, 30*time.Second, 2*time.Second, "session id %q must be recorded in an access-log row for %s", sessionID, pc.name)
+		})
+	}
+
+	// Metering: the policy's uncapped token limit switches on usage recording,
+	// so the live traffic just driven must surface as consumption rows with
+	// positive token counts. Consumption is account-scoped (keyed by source
+	// group / user and time window, not per provider), and ingest is async, so
+	// poll for any row that has booked tokens.
+	require.Eventually(t, func() bool {
+		rows, lerr := srv.ListConsumption(ctx)
+		if lerr != nil {
+			return false
+		}
+		for _, r := range rows {
+			if r.TokensInput > 0 && r.TokensOutput > 0 {
+				return true
+			}
+		}
+		return false
+	}, 60*time.Second, 3*time.Second, "consumption must be recorded with positive token counts after live traffic")
+}
diff --git a/e2e/agentnetwork/main_test.go b/e2e/agentnetwork/main_test.go
new file mode 100644
index 000000000..17c5e00be
--- /dev/null
+++ b/e2e/agentnetwork/main_test.go
@@ -0,0 +1,46 @@
+//go:build e2e
+
+// Package agentnetwork holds the container-based agent-network e2e suite. A
+// single combined server is built and bootstrapped once per package run
+// (TestMain) and shared across tests via srv; each test creates and cleans up
+// its own resources so order doesn't matter.
+package agentnetwork
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+)
+
+// srv is the shared combined server for the package, ready (PAT-authenticated)
+// by the time any Test runs.
+var srv *harness.Combined
+
+func TestMain(m *testing.M) {
+	os.Exit(run(m))
+}
+
+func run(m *testing.M) int {
+	// Generous timeout to cover a cold image build on first run.
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+	defer cancel()
+
+	var err error
+	srv, err = harness.StartCombined(ctx)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "e2e: start combined server: %v\n", err)
+		return 1
+	}
+	defer func() { _ = srv.Terminate(context.Background()) }()
+
+	if _, err := srv.Bootstrap(ctx); err != nil {
+		fmt.Fprintf(os.Stderr, "e2e: bootstrap admin PAT: %v\n", err)
+		return 1
+	}
+
+	return m.Run()
+}
diff --git a/e2e/agentnetwork/management_test.go b/e2e/agentnetwork/management_test.go
new file mode 100644
index 000000000..cfd03f63c
--- /dev/null
+++ b/e2e/agentnetwork/management_test.go
@@ -0,0 +1,221 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/client/rest"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+func ptr[T any](v T) *T { return &v }
+
+// newProvider creates an OpenAI-catalog provider with a dummy key (these tests
+// never call the upstream) and registers cleanup.
+func newProvider(t *testing.T, ctx context.Context, name string) api.AgentNetworkProvider {
+	t.Helper()
+	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:             name,
+		ProviderId:       "openai_api",
+		UpstreamUrl:      "https://api.openai.com",
+		ApiKey:           ptr("sk-dummy-e2e-key"),
+		BootstrapCluster: ptr("eu.proxy.netbird.test"),
+	})
+	require.NoError(t, err, "create provider %q", name)
+	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
+	return prov
+}
+
+// requireClientError asserts err is a REST APIError with a 4xx status.
+func requireClientError(t *testing.T, err error) {
+	t.Helper()
+	var apiErr *rest.APIError
+	require.ErrorAs(t, err, &apiErr, "expected a REST APIError")
+	assert.GreaterOrEqual(t, apiErr.StatusCode, 400, "expected a 4xx status")
+	assert.Less(t, apiErr.StatusCode, 500, "expected a 4xx status")
+}
+
+// TestProviderLifecycle covers create → get → list → delete → 404 for every
+// available real provider catalog (and a synthetic OpenAI provider when no
+// provider keys are set), so each catalog's create and field round-trip is
+// exercised. Create is offline — no upstream call — so this stays fast and
+// burns no provider quota.
+func TestProviderLifecycle(t *testing.T) {
+	ctx := context.Background()
+
+	cases := availableProviders()
+	if len(cases) == 0 {
+		cases = []providerCase{{
+			name: "openai", catalogID: "openai_api", upstream: "https://api.openai.com",
+			apiKey: "sk-dummy-e2e-key", model: "gpt-4o-mini", kind: harness.WireChat,
+		}}
+	}
+
+	for i, pc := range cases {
+		i, pc := i, pc
+		t.Run(pc.name, func(t *testing.T) {
+			req := providerRequest(pc)
+			req.Name = "lc-" + pc.name
+			// Bootstrap the cluster on the first create in case the matrix has
+			// not run (e.g. no provider keys → settings not yet bootstrapped).
+			if i == 0 {
+				req.BootstrapCluster = ptr(harness.AgentNetworkCluster)
+			}
+
+			prov, err := srv.CreateProvider(ctx, req)
+			require.NoError(t, err, "create %s provider", pc.name)
+			t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
+
+			assert.NotEmpty(t, prov.Id, "created provider must have an id")
+			assert.Equal(t, pc.catalogID, prov.ProviderId, "catalog id must round-trip")
+			assert.Equal(t, req.Name, prov.Name, "name must round-trip")
+			assert.Equal(t, pc.upstream, prov.UpstreamUrl, "upstream must round-trip")
+
+			got, err := srv.GetProvider(ctx, prov.Id)
+			require.NoError(t, err, "get provider")
+			assert.Equal(t, prov.Id, got.Id)
+
+			list, err := srv.ListProviders(ctx)
+			require.NoError(t, err, "list providers")
+			var ids []string
+			for _, p := range list {
+				ids = append(ids, p.Id)
+			}
+			assert.Contains(t, ids, prov.Id, "created provider must appear in the list")
+
+			require.NoError(t, srv.DeleteProvider(ctx, prov.Id), "delete provider")
+			_, err = srv.GetProvider(ctx, prov.Id)
+			requireClientError(t, err)
+		})
+	}
+}
+
+// TestProviderValidation exercises the create-time validation rules. These are
+// uniform across catalogs (no per-provider required-field rules exist: a
+// catalog-specific malformed value such as a Vertex key without the keyfile::
+// prefix is accepted at create and only fails at the proxy), so the cases here
+// are catalog-agnostic: missing API key, unknown catalog id, an invalid upstream
+// URL, and a blank name.
+func TestProviderValidation(t *testing.T) {
+	ctx := context.Background()
+
+	_, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:        "No Key",
+		ProviderId:  "openai_api",
+		UpstreamUrl: "https://api.openai.com",
+	})
+	requireClientError(t, err)
+
+	_, err = srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:        "Unknown Catalog",
+		ProviderId:  "totally_unknown_provider",
+		UpstreamUrl: "https://example.com",
+		ApiKey:      ptr("sk-dummy"),
+	})
+	requireClientError(t, err)
+
+	_, err = srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:        "Bad Upstream",
+		ProviderId:  "openai_api",
+		UpstreamUrl: "not-a-url",
+		ApiKey:      ptr("sk-dummy"),
+	})
+	requireClientError(t, err)
+
+	_, err = srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:        "   ",
+		ProviderId:  "openai_api",
+		UpstreamUrl: "https://api.openai.com",
+		ApiKey:      ptr("sk-dummy"),
+	})
+	requireClientError(t, err)
+}
+
+// TestSettingsRoundTrip flips the collection toggles and confirms cluster /
+// subdomain stay immutable, then restores the original state.
+func TestSettingsRoundTrip(t *testing.T) {
+	ctx := context.Background()
+
+	// Settings are bootstrapped on first provider create.
+	newProvider(t, ctx, "Settings Bootstrap")
+
+	before, err := srv.GetSettings(ctx)
+	require.NoError(t, err, "get settings")
+	require.NotEmpty(t, before.Cluster, "settings must carry an assigned cluster")
+
+	flipped, err := srv.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
+		EnableLogCollection:    !before.EnableLogCollection,
+		EnablePromptCollection: !before.EnablePromptCollection,
+		RedactPii:              !before.RedactPii,
+	})
+	require.NoError(t, err, "update settings")
+	assert.Equal(t, !before.EnableLogCollection, flipped.EnableLogCollection, "log collection toggle must flip")
+	assert.Equal(t, !before.EnablePromptCollection, flipped.EnablePromptCollection, "prompt collection toggle must flip")
+	assert.Equal(t, before.Cluster, flipped.Cluster, "cluster must be immutable across updates")
+	assert.Equal(t, before.Subdomain, flipped.Subdomain, "subdomain must be immutable across updates")
+
+	// Restore the original toggles.
+	_, err = srv.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
+		EnableLogCollection:    before.EnableLogCollection,
+		EnablePromptCollection: before.EnablePromptCollection,
+		RedactPii:              before.RedactPii,
+	})
+	require.NoError(t, err, "restore settings")
+}
+
+// TestPolicyWindowFloor rejects an enabled limit below the 60s window floor and
+// accepts one at the floor.
+func TestPolicyWindowFloor(t *testing.T) {
+	ctx := context.Background()
+
+	grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-policy-grp"})
+	require.NoError(t, err, "create source group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grp.Id) })
+
+	prov := newProvider(t, ctx, "Policy Provider")
+
+	limits := func(window int64) *api.AgentNetworkPolicyLimits {
+		return &api.AgentNetworkPolicyLimits{
+			TokenLimit: api.AgentNetworkPolicyTokenLimit{
+				Enabled:       true,
+				GroupCap:      1000,
+				UserCap:       1000,
+				WindowSeconds: window,
+			},
+		}
+	}
+
+	_, err = srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-below-floor",
+		SourceGroups:           []string{grp.Id},
+		DestinationProviderIds: []string{prov.Id},
+		Limits:                 limits(30),
+	})
+	requireClientError(t, err)
+
+	pol, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-at-floor",
+		SourceGroups:           []string{grp.Id},
+		DestinationProviderIds: []string{prov.Id},
+		Limits:                 limits(60),
+	})
+	require.NoError(t, err, "policy at the 60s floor must be accepted")
+	assert.NotEmpty(t, pol.Id, "created policy must have an id")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
+}
+
+// TestConsumptionList confirms the read endpoint always returns an array, never
+// a 404/500.
+func TestConsumptionList(t *testing.T) {
+	ctx := context.Background()
+
+	rows, err := srv.ListConsumption(ctx)
+	require.NoError(t, err, "consumption list must not error")
+	assert.NotNil(t, rows, "consumption must be a JSON array (possibly empty)")
+}
diff --git a/e2e/harness/Dockerfile.client b/e2e/harness/Dockerfile.client
new file mode 100644
index 000000000..114577d60
--- /dev/null
+++ b/e2e/harness/Dockerfile.client
@@ -0,0 +1,24 @@
+# Multistage build for the NetBird client used in e2e tests. The repo has no
+# source-building client Dockerfile (client/Dockerfile packages a goreleaser
+# artifact), so this mirrors its alpine runtime + entrypoint while compiling the
+# CGO-free client inline. BuildKit cache mounts keep rebuilds incremental.
+
+FROM golang:1.25-bookworm AS builder
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN --mount=type=cache,target=/go/pkg/mod go mod download
+COPY . .
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    CGO_ENABLED=0 GOOS=linux go build -o /out/netbird ./client
+
+FROM alpine:3.24
+RUN apk add --no-cache bash ca-certificates ip6tables iproute2 iptables
+ENV NETBIRD_BIN="/usr/local/bin/netbird" \
+    NB_LOG_FILE="console,/var/log/netbird/client.log" \
+    NB_DAEMON_ADDR="unix:///var/run/netbird.sock" \
+    NB_ENABLE_CAPTURE="false" \
+    NB_ENTRYPOINT_SERVICE_TIMEOUT="30"
+ENTRYPOINT [ "/usr/local/bin/netbird-entrypoint.sh" ]
+COPY client/netbird-entrypoint.sh /usr/local/bin/netbird-entrypoint.sh
+COPY --from=builder /out/netbird /usr/local/bin/netbird
diff --git a/e2e/harness/agentnetwork.go b/e2e/harness/agentnetwork.go
new file mode 100644
index 000000000..192385ab1
--- /dev/null
+++ b/e2e/harness/agentnetwork.go
@@ -0,0 +1,130 @@
+//go:build e2e
+
+package harness
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// The shared REST client doesn't (yet) expose typed agent-network methods, so
+// these helpers drive the /api/agent-network/* endpoints through the client's
+// NewRequest primitive — reusing its auth, error handling (rest.APIError on
+// non-2xx), and transport — while still speaking the generated api types.
+
+// anRequest issues an agent-network API call and decodes the JSON response into
+// T. A non-2xx response surfaces as a *rest.APIError from the client, which
+// tests inspect for negative-path status assertions.
+func anRequest[T any](ctx context.Context, c *Combined, method, path string, body any) (T, error) {
+	var out T
+	var reader io.Reader
+	if body != nil {
+		bs, err := json.Marshal(body)
+		if err != nil {
+			return out, fmt.Errorf("marshal %s %s: %w", method, path, err)
+		}
+		reader = bytes.NewReader(bs)
+	}
+
+	resp, err := c.api.NewRequest(ctx, method, path, reader, nil)
+	if err != nil {
+		return out, err
+	}
+	defer resp.Body.Close()
+
+	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
+		return out, fmt.Errorf("decode %s %s response: %w", method, path, err)
+	}
+	return out, nil
+}
+
+// anDelete issues a DELETE and discards the (empty-object) body.
+func anDelete(ctx context.Context, c *Combined, path string) error {
+	resp, err := c.api.NewRequest(ctx, http.MethodDelete, path, nil, nil)
+	if err != nil {
+		return err
+	}
+	resp.Body.Close()
+	return nil
+}
+
+// CreateProvider creates an agent-network provider.
+func (c *Combined) CreateProvider(ctx context.Context, req api.AgentNetworkProviderRequest) (api.AgentNetworkProvider, error) {
+	return anRequest[api.AgentNetworkProvider](ctx, c, http.MethodPost, "/api/agent-network/providers", req)
+}
+
+// GetProvider fetches a provider by id.
+func (c *Combined) GetProvider(ctx context.Context, id string) (api.AgentNetworkProvider, error) {
+	return anRequest[api.AgentNetworkProvider](ctx, c, http.MethodGet, "/api/agent-network/providers/"+id, nil)
+}
+
+// ListProviders returns all providers for the account.
+func (c *Combined) ListProviders(ctx context.Context) ([]api.AgentNetworkProvider, error) {
+	return anRequest[[]api.AgentNetworkProvider](ctx, c, http.MethodGet, "/api/agent-network/providers", nil)
+}
+
+// DeleteProvider removes a provider by id.
+func (c *Combined) DeleteProvider(ctx context.Context, id string) error {
+	return anDelete(ctx, c, "/api/agent-network/providers/"+id)
+}
+
+// SetProviderEnabled toggles a provider's enabled flag, preserving its other
+// fields (the API key is omitted, which keeps the stored one). Used to run one
+// provider at a time so model→provider routing is unambiguous.
+func (c *Combined) SetProviderEnabled(ctx context.Context, id string, enabled bool) error {
+	p, err := c.GetProvider(ctx, id)
+	if err != nil {
+		return err
+	}
+	_, err = anRequest[api.AgentNetworkProvider](ctx, c, http.MethodPut, "/api/agent-network/providers/"+id, api.AgentNetworkProviderRequest{
+		Name:        p.Name,
+		ProviderId:  p.ProviderId,
+		UpstreamUrl: p.UpstreamUrl,
+		Enabled:     &enabled,
+		Models:      &p.Models,
+	})
+	return err
+}
+
+// CreatePolicy creates an agent-network policy.
+func (c *Combined) CreatePolicy(ctx context.Context, req api.AgentNetworkPolicyRequest) (api.AgentNetworkPolicy, error) {
+	return anRequest[api.AgentNetworkPolicy](ctx, c, http.MethodPost, "/api/agent-network/policies", req)
+}
+
+// UpdatePolicy replaces a policy by id.
+func (c *Combined) UpdatePolicy(ctx context.Context, id string, req api.AgentNetworkPolicyRequest) (api.AgentNetworkPolicy, error) {
+	return anRequest[api.AgentNetworkPolicy](ctx, c, http.MethodPut, "/api/agent-network/policies/"+id, req)
+}
+
+// DeletePolicy removes a policy by id.
+func (c *Combined) DeletePolicy(ctx context.Context, id string) error {
+	return anDelete(ctx, c, "/api/agent-network/policies/"+id)
+}
+
+// GetSettings returns the account's agent-network settings row. It exists only
+// after the first provider create bootstraps it.
+func (c *Combined) GetSettings(ctx context.Context) (api.AgentNetworkSettings, error) {
+	return anRequest[api.AgentNetworkSettings](ctx, c, http.MethodGet, "/api/agent-network/settings", nil)
+}
+
+// UpdateSettings applies the mutable collection toggles.
+func (c *Combined) UpdateSettings(ctx context.Context, req api.AgentNetworkSettingsRequest) (api.AgentNetworkSettings, error) {
+	return anRequest[api.AgentNetworkSettings](ctx, c, http.MethodPut, "/api/agent-network/settings", req)
+}
+
+// ListConsumption returns the account's consumption rows (possibly empty).
+func (c *Combined) ListConsumption(ctx context.Context) ([]api.AgentNetworkConsumption, error) {
+	return anRequest[[]api.AgentNetworkConsumption](ctx, c, http.MethodGet, "/api/agent-network/consumption", nil)
+}
+
+// ListAccessLogs returns the account's agent-network access-log page (the
+// flattened per-request rows the proxy ships and management ingests).
+func (c *Combined) ListAccessLogs(ctx context.Context) (api.AgentNetworkAccessLogsResponse, error) {
+	return anRequest[api.AgentNetworkAccessLogsResponse](ctx, c, http.MethodGet, "/api/agent-network/access-logs", nil)
+}
diff --git a/e2e/harness/bootstrap.go b/e2e/harness/bootstrap.go
new file mode 100644
index 000000000..defa03c14
--- /dev/null
+++ b/e2e/harness/bootstrap.go
@@ -0,0 +1,47 @@
+//go:build e2e
+
+package harness
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/netbirdio/netbird/shared/management/client/rest"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// Bootstrap creates the initial admin owner through the unauthenticated
+// /api/setup endpoint and returns the plaintext admin PAT. It also wires an
+// authenticated REST client on the Combined (see API). create_pat requires the
+// server to run with NB_SETUP_PAT_ENABLED=true, which the harness sets. A
+// second call returns an error (the server reports setup already completed).
+func (c *Combined) Bootstrap(ctx context.Context) (string, error) {
+	// The setup endpoint is unauthenticated; use a tokenless client.
+	setupClient := rest.NewWithOptions(rest.WithManagementURL(c.BaseURL))
+
+	createPAT := true
+	expireDays := 1
+	resp, err := setupClient.Instance.Setup(ctx, api.PostApiSetupJSONRequestBody{ //nolint:gosec // static throwaway test credentials
+		Email:       "admin@netbird.test",
+		Password:    "Netbird-e2e-Passw0rd!",
+		Name:        "E2E Admin",
+		CreatePat:   &createPAT,
+		PatExpireIn: &expireDays,
+	})
+	if err != nil {
+		return "", fmt.Errorf("instance setup: %w", err)
+	}
+	if resp.PersonalAccessToken == nil || *resp.PersonalAccessToken == "" {
+		return "", fmt.Errorf("setup succeeded but no PAT returned (is NB_SETUP_PAT_ENABLED set?)")
+	}
+
+	c.PAT = *resp.PersonalAccessToken
+	c.api = rest.New(c.BaseURL, c.PAT)
+	return c.PAT, nil
+}
+
+// API returns the PAT-authenticated management REST client. It is nil until
+// Bootstrap runs.
+func (c *Combined) API() *rest.Client {
+	return c.api
+}
diff --git a/e2e/harness/cert.go b/e2e/harness/cert.go
new file mode 100644
index 000000000..c8a28e470
--- /dev/null
+++ b/e2e/harness/cert.go
@@ -0,0 +1,66 @@
+//go:build e2e
+
+package harness
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"fmt"
+	"math/big"
+	"os"
+	"path/filepath"
+	"time"
+)
+
+// writeSelfSignedCert generates a self-signed TLS cert/key pair covering the
+// given DNS names and writes them as tls.crt / tls.key in dir. The proxy serves
+// this for the agent-network endpoint; the client curls with -k, so validity
+// chains don't matter — the proxy just needs a usable cert to present.
+func writeSelfSignedCert(dir string, dnsNames []string) error {
+	priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return fmt.Errorf("generate key: %w", err)
+	}
+
+	serial, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))
+	if err != nil {
+		return fmt.Errorf("generate serial: %w", err)
+	}
+
+	tmpl := x509.Certificate{
+		SerialNumber:          serial,
+		Subject:               pkix.Name{CommonName: dnsNames[0]},
+		NotBefore:             time.Now().Add(-time.Hour),
+		NotAfter:              time.Now().Add(365 * 24 * time.Hour),
+		KeyUsage:              x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		DNSNames:              dnsNames,
+		BasicConstraintsValid: true,
+	}
+
+	der, err := x509.CreateCertificate(rand.Reader, &tmpl, &tmpl, &priv.PublicKey, priv)
+	if err != nil {
+		return fmt.Errorf("create certificate: %w", err)
+	}
+
+	certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})
+	if err := os.WriteFile(filepath.Join(dir, "tls.crt"), certPEM, 0o644); err != nil { //nolint:gosec // public cert, bind-mounted and read by the proxy container
+		return fmt.Errorf("write cert: %w", err)
+	}
+
+	keyDER, err := x509.MarshalECPrivateKey(priv)
+	if err != nil {
+		return fmt.Errorf("marshal key: %w", err)
+	}
+	keyPEM := pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: keyDER})
+	// World-readable so the (non-root) proxy container can read the bind-mounted
+	// key on Linux CI runners; this is a throwaway self-signed e2e key.
+	if err := os.WriteFile(filepath.Join(dir, "tls.key"), keyPEM, 0o644); err != nil { //nolint:gosec // throwaway self-signed e2e key, must be readable by the proxy container uid
+		return fmt.Errorf("write key: %w", err)
+	}
+	return nil
+}
diff --git a/e2e/harness/client.go b/e2e/harness/client.go
new file mode 100644
index 000000000..cf7ef8945
--- /dev/null
+++ b/e2e/harness/client.go
@@ -0,0 +1,256 @@
+//go:build e2e
+
+package harness
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os/exec"
+	"strings"
+	"time"
+
+	"github.com/docker/docker/api/types/container"
+	"github.com/testcontainers/testcontainers-go"
+	tcexec "github.com/testcontainers/testcontainers-go/exec"
+)
+
+const (
+	clientDockerfile = "e2e/harness/Dockerfile.client"
+	// defaultClientImage is the local tag the client is built under from
+	// clientDockerfile. Override with NB_E2E_CLIENT_IMAGE: a value with a "/" is
+	// pulled as a published image; a bare tag is built under that name.
+	defaultClientImage = "netbird-client:e2e"
+	clientAlias        = "client"
+	curlImage          = "curlimages/curl:latest"
+)
+
+// Client is a running NetBird client container joined to the combined server.
+type Client struct {
+	container testcontainers.Container
+}
+
+// StartClient builds the client image and runs it on the combined server's
+// network, joining via the given setup key. The image entrypoint brings the
+// daemon up automatically; callers wait for connectivity with WaitConnected /
+// WaitProxyPeer.
+func StartClient(ctx context.Context, c *Combined, setupKey string) (*Client, error) {
+	root, err := repoRoot()
+	if err != nil {
+		return nil, err
+	}
+	clientImage, err := resolveImage(ctx, root, "NB_E2E_CLIENT_IMAGE", defaultClientImage, clientDockerfile)
+	if err != nil {
+		return nil, err
+	}
+
+	req := testcontainers.ContainerRequest{
+		Image:          clientImage,
+		Networks:       []string{c.network.Name},
+		NetworkAliases: map[string][]string{c.network.Name: {clientAlias}},
+		Env: map[string]string{
+			"NB_MANAGEMENT_URL": combinedExposedURL,
+			"NB_SETUP_KEY":      setupKey,
+			"NB_LOG_LEVEL":      "info",
+			// Match the proxy: the combined relay is WebSocket-only, so the
+			// client must use WS transport to keep a stable relay link to it.
+			"NB_RELAY_TRANSPORT": "ws",
+		},
+		HostConfigModifier: func(hc *container.HostConfig) {
+			hc.CapAdd = append(hc.CapAdd, "NET_ADMIN", "SYS_ADMIN", "SYS_RESOURCE")
+		},
+	}
+
+	ctr, err := testcontainers.GenericContainer(ctx, testcontainers.GenericContainerRequest{
+		ContainerRequest: req,
+		Started:          true,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("start client container: %w", err)
+	}
+	return &Client{container: ctr}, nil
+}
+
+// Restart bounces the client connection (netbird down/up) so it pulls a fresh
+// network map — the documented workaround for a freshly-joined client not yet
+// seeing a synthesized agent-network service.
+func (cl *Client) Restart(ctx context.Context) error {
+	if _, _, err := cl.container.Exec(ctx, []string{"netbird", "down"}, tcexec.Multiplexed()); err != nil {
+		return fmt.Errorf("netbird down: %w", err)
+	}
+	time.Sleep(2 * time.Second)
+	code, reader, err := cl.container.Exec(ctx, []string{"netbird", "up"}, tcexec.Multiplexed())
+	if err != nil {
+		return fmt.Errorf("netbird up: %w", err)
+	}
+	if code != 0 {
+		out, _ := io.ReadAll(reader)
+		return fmt.Errorf("netbird up exited %d: %s", code, string(out))
+	}
+	return nil
+}
+
+// Status returns `netbird status` output from inside the client.
+func (cl *Client) Status(ctx context.Context) (string, error) {
+	code, reader, err := cl.container.Exec(ctx, []string{"netbird", "status"}, tcexec.Multiplexed())
+	if err != nil {
+		return "", err
+	}
+	out, _ := io.ReadAll(reader)
+	if code != 0 {
+		return string(out), fmt.Errorf("netbird status exited %d", code)
+	}
+	return string(out), nil
+}
+
+// WaitConnected polls until the client reports Management: Connected.
+func (cl *Client) WaitConnected(ctx context.Context, timeout time.Duration) error {
+	return cl.pollStatus(ctx, timeout, "Management: Connected")
+}
+
+// WaitProxyPeer polls until the client sees the proxy peer connected (1/1).
+func (cl *Client) WaitProxyPeer(ctx context.Context, timeout time.Duration) error {
+	return cl.pollStatus(ctx, timeout, "1/1 Connected")
+}
+
+func (cl *Client) pollStatus(ctx context.Context, timeout time.Duration, want string) error {
+	deadline := time.Now().Add(timeout)
+	var last string
+	for time.Now().Before(deadline) {
+		out, _ := cl.Status(ctx)
+		last = out
+		if strings.Contains(out, want) {
+			return nil
+		}
+		time.Sleep(3 * time.Second)
+	}
+	return fmt.Errorf("timed out waiting for %q; last status:\n%s", want, last)
+}
+
+// ResolveProxyIP resolves the agent-network endpoint to the proxy peer's
+// NetBird IP from inside the client (via magic DNS).
+func (cl *Client) ResolveProxyIP(ctx context.Context, endpoint string) (string, error) {
+	code, reader, err := cl.container.Exec(ctx, []string{"getent", "hosts", endpoint}, tcexec.Multiplexed())
+	if err != nil {
+		return "", err
+	}
+	out, _ := io.ReadAll(reader)
+	if code != 0 {
+		return "", fmt.Errorf("getent hosts %s exited %d", endpoint, code)
+	}
+	fields := strings.Fields(string(out))
+	if len(fields) == 0 {
+		return "", fmt.Errorf("no address for %s", endpoint)
+	}
+	return fields[0], nil
+}
+
+// Wire shapes for Chat.
+const (
+	// WireChat is the OpenAI-compatible /v1/chat/completions shape.
+	WireChat = "chat"
+	// WireMessages is the Anthropic /v1/messages shape.
+	WireMessages = "messages"
+	// WireVertex is the Anthropic-on-Vertex rawPredict shape: the client posts
+	// the full Vertex model path and the proxy mints the SA OAuth token.
+	WireVertex = "vertex"
+)
+
+// Chat issues a chat-completion POST to the agent-network endpoint over the
+// client's tunnel, returning the HTTP status and response body. kind selects
+// the wire shape: WireChat (OpenAI) or WireMessages (Anthropic). A non-empty
+// sessionID is sent as the universal x-session-id header the proxy records.
+func (cl *Client) Chat(ctx context.Context, endpoint, proxyIP, kind, model, prompt, sessionID string) (int, string, error) {
+	var path, body string
+	var headers []string
+	switch kind {
+	case WireMessages:
+		path = "/v1/messages"
+		headers = []string{"anthropic-version: 2023-06-01"}
+		body = fmt.Sprintf(`{"model":%q,"max_tokens":64,"messages":[{"role":"user","content":%q}]}`, model, prompt)
+	default:
+		path = "/v1/chat/completions"
+		body = fmt.Sprintf(`{"model":%q,"messages":[{"role":"user","content":%q}]}`, model, prompt)
+	}
+	return cl.post(ctx, endpoint, proxyIP, path, body, withSessionID(headers, sessionID))
+}
+
+// Vertex issues an Anthropic-on-Vertex rawPredict POST over the tunnel. Unlike
+// Chat, the model is carried in the request path (project/region/model), so the
+// proxy routes by path and mints the service-account OAuth token; the body uses
+// the Vertex anthropic_version rather than a model field. A non-empty sessionID
+// is sent as the universal x-session-id header the proxy records.
+func (cl *Client) Vertex(ctx context.Context, endpoint, proxyIP, project, region, model, prompt, sessionID string) (int, string, error) {
+	path := fmt.Sprintf("/v1/projects/%s/locations/%s/publishers/anthropic/models/%s:rawPredict", project, region, model)
+	body := fmt.Sprintf(`{"anthropic_version":"vertex-2023-10-16","max_tokens":64,"messages":[{"role":"user","content":%q}]}`, prompt)
+	return cl.post(ctx, endpoint, proxyIP, path, body, withSessionID(nil, sessionID))
+}
+
+// withSessionID appends the x-session-id header when sessionID is non-empty.
+func withSessionID(headers []string, sessionID string) []string {
+	if sessionID == "" {
+		return headers
+	}
+	return append(headers, "x-session-id: "+sessionID)
+}
+
+// post runs curl in a throwaway container sharing the client's network
+// namespace so the request traverses the WireGuard tunnel, pinning the endpoint
+// to the proxy IP. It returns the HTTP status and response body.
+func (cl *Client) post(ctx context.Context, endpoint, proxyIP, path, body string, extraHeaders []string) (int, string, error) {
+	url := "https://" + endpoint + path
+	args := []string{
+		"run", "--rm",
+		"--network", "container:" + cl.container.GetContainerID(),
+		curlImage,
+		"-sk", "--connect-timeout", "5", "--max-time", "90",
+		"--resolve", endpoint + ":443:" + proxyIP,
+		"-o", "/dev/stderr", "-w", "%{http_code}",
+		"-X", "POST", url,
+		"-H", "Content-Type: application/json",
+	}
+	for _, h := range extraHeaders {
+		args = append(args, "-H", h)
+	}
+	args = append(args, "--data", body)
+	cmd := exec.CommandContext(ctx, "docker", args...)
+	// -w writes the status code to stdout; -o /dev/stderr writes the body to
+	// stderr so we can capture both separately.
+	var stdout, stderr strings.Builder
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+	if err := cmd.Run(); err != nil {
+		return 0, stderr.String(), fmt.Errorf("curl through tunnel: %w", err)
+	}
+
+	code := 0
+	_, _ = fmt.Sscanf(strings.TrimSpace(stdout.String()), "%d", &code)
+	return code, stderr.String(), nil
+}
+
+// Logs returns the client container logs, for diagnostics on failure.
+func (cl *Client) Logs(ctx context.Context) string {
+	return containerLogs(ctx, cl.container)
+}
+
+// Terminate stops the client container.
+func (cl *Client) Terminate(ctx context.Context) error {
+	if cl.container == nil {
+		return nil
+	}
+	return cl.container.Terminate(ctx)
+}
+
+// containerLogs reads up to 256 KiB of a container's logs for diagnostics.
+func containerLogs(ctx context.Context, c testcontainers.Container) string {
+	if c == nil {
+		return ""
+	}
+	r, err := c.Logs(ctx)
+	if err != nil {
+		return fmt.Sprintf("<logs error: %v>", err)
+	}
+	defer r.Close()
+	b, _ := io.ReadAll(io.LimitReader(r, 256<<10))
+	return string(b)
+}
diff --git a/e2e/harness/combined.go b/e2e/harness/combined.go
new file mode 100644
index 000000000..a6f43a139
--- /dev/null
+++ b/e2e/harness/combined.go
@@ -0,0 +1,243 @@
+//go:build e2e
+
+package harness
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/go-connections/nat"
+	"github.com/testcontainers/testcontainers-go"
+	tcexec "github.com/testcontainers/testcontainers-go/exec"
+	"github.com/testcontainers/testcontainers-go/network"
+	"github.com/testcontainers/testcontainers-go/wait"
+
+	"github.com/netbirdio/netbird/shared/management/client/rest"
+)
+
+const (
+	combinedDockerfile = "combined/Dockerfile.multistage"
+	// defaultCombinedImage is the local tag the combined server is built under
+	// from combinedDockerfile, so the e2e exercises this branch's code. Override
+	// with NB_E2E_COMBINED_IMAGE: a value containing a "/" is pulled as a
+	// published image; a bare tag is built under that name instead.
+	defaultCombinedImage = "netbird-combined:e2e"
+	combinedHTTPPort     = "8080/tcp"
+
+	// combinedAlias is the combined server's network alias AND the deployment
+	// domain. The working manual setup uses a single NETBIRD_DOMAIN for the
+	// management exposed address, the proxy domain, and the agent-network
+	// cluster — so we mirror that: peers reach management/signal/relay at this
+	// name, the proxy registers this as its cluster, and the agent-network
+	// endpoint is <subdomain>.<combinedAlias>.
+	combinedAlias      = "netbird.local"
+	combinedExposedURL = "http://" + combinedAlias + ":8080"
+
+	// containerIssuer is the embedded IdP issuer, used only for internal JWT
+	// validation (peers authenticate with setup keys / proxy tokens, not OIDC),
+	// so the in-container localhost address is fine.
+	containerIssuer = "http://localhost:8080/oauth2"
+)
+
+// Combined is a running combined NetBird server (management + signal + relay +
+// STUN + embedded IdP) plus the connection details tests need. It owns the
+// shared docker network that the proxy and client containers join.
+type Combined struct {
+	container testcontainers.Container
+	network   *testcontainers.DockerNetwork
+	// BaseURL is the host-reachable management API root, e.g. http://127.0.0.1:51234.
+	BaseURL string
+	// PAT is the admin Personal Access Token minted via Bootstrap.
+	PAT string
+
+	api     *rest.Client
+	workDir string
+}
+
+// StartCombined builds the combined server from its multistage Dockerfile and
+// boots it with setup-PAT enabled on a fresh shared network, returning once the
+// API is serving. The caller still owns minting the admin PAT via Bootstrap.
+func StartCombined(ctx context.Context) (*Combined, error) {
+	root, err := repoRoot()
+	if err != nil {
+		return nil, err
+	}
+
+	combinedImage, err := resolveImage(ctx, root, "NB_E2E_COMBINED_IMAGE", defaultCombinedImage, combinedDockerfile)
+	if err != nil {
+		return nil, err
+	}
+
+	net, err := network.New(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("create shared network: %w", err)
+	}
+
+	// Work dir under /tmp so Docker Desktop file sharing (which excludes
+	// macOS's /var/folders TMPDIR) can bind-mount it.
+	workDir, err := os.MkdirTemp("/tmp", "nb-e2e-combined-*")
+	if err != nil {
+		_ = net.Remove(ctx)
+		return nil, fmt.Errorf("create work dir: %w", err)
+	}
+
+	cfg := fmt.Sprintf(combinedConfigYAML, combinedExposedURL, containerIssuer)
+	if err := os.WriteFile(filepath.Join(workDir, "config.yaml"), []byte(cfg), 0o644); err != nil { //nolint:gosec // non-secret config, bind-mounted and read by the container
+		_ = net.Remove(ctx)
+		return nil, fmt.Errorf("write combined config: %w", err)
+	}
+	if err := os.MkdirAll(filepath.Join(workDir, "data"), 0o755); err != nil {
+		_ = net.Remove(ctx)
+		return nil, fmt.Errorf("create datadir: %w", err)
+	}
+
+	req := testcontainers.ContainerRequest{
+		Image:          combinedImage,
+		ExposedPorts:   []string{combinedHTTPPort},
+		Networks:       []string{net.Name},
+		NetworkAliases: map[string][]string{net.Name: {combinedAlias}},
+		Env: map[string]string{
+			"NB_SETUP_PAT_ENABLED": "true",
+			// Skip the GeoLite DB download — it blocks startup and agent-network
+			// ingest doesn't use geolocation.
+			"NB_DISABLE_GEOLOCATION": "true",
+		},
+		Cmd: []string{"--config", "/nb/config.yaml"},
+		HostConfigModifier: func(hc *container.HostConfig) {
+			hc.Binds = append(hc.Binds, workDir+":/nb")
+		},
+		WaitingFor: wait.ForHTTP("/api/instance").
+			WithPort(combinedHTTPPort).
+			WithStatusCodeMatcher(func(status int) bool { return status == 200 }).
+			WithStartupTimeout(120 * time.Second),
+	}
+
+	c, err := testcontainers.GenericContainer(ctx, testcontainers.GenericContainerRequest{
+		ContainerRequest: req,
+		Started:          true,
+	})
+	if err != nil {
+		_ = net.Remove(ctx)
+		return nil, fmt.Errorf("start combined container: %w", err)
+	}
+
+	host, err := c.Host(ctx)
+	if err != nil {
+		_ = c.Terminate(ctx)
+		_ = net.Remove(ctx)
+		return nil, fmt.Errorf("container host: %w", err)
+	}
+	mapped, err := c.MappedPort(ctx, nat.Port(combinedHTTPPort))
+	if err != nil {
+		_ = c.Terminate(ctx)
+		_ = net.Remove(ctx)
+		return nil, fmt.Errorf("mapped port: %w", err)
+	}
+
+	return &Combined{
+		container: c,
+		network:   net,
+		BaseURL:   fmt.Sprintf("http://%s:%s", host, mapped.Port()),
+		workDir:   workDir,
+	}, nil
+}
+
+// resolveImage returns the image to run for a component. By default it builds
+// the image from the repo Dockerfile under localTag, so the e2e exercises the
+// branch's code. The env override changes this: a value containing a "/" is a
+// registry reference that testcontainers pulls (e.g. to test a published
+// release); a bare tag is built under that name instead.
+func resolveImage(ctx context.Context, root, envKey, localTag, dockerfile string) (string, error) {
+	if v := os.Getenv(envKey); v != "" {
+		if strings.Contains(v, "/") {
+			return v, nil
+		}
+		localTag = v
+	}
+	if err := buildImage(ctx, root, dockerfile, localTag); err != nil {
+		return "", err
+	}
+	return localTag, nil
+}
+
+// buildImage builds an image from a repo Dockerfile via buildx with BuildKit, so
+// the Dockerfile cache mounts are honored and unchanged layers are reused. The
+// result is loaded into the docker image store so testcontainers runs it by tag.
+// When NB_E2E_BUILDX_CACHE names a directory (CI, with a container-driver
+// builder from docker/setup-buildx-action), layer cache is read from and written
+// to it as a local cache so actions/cache can persist it across runs; the Go
+// compile itself still re-runs, as BuildKit mount caches can't be exported.
+func buildImage(ctx context.Context, root, dockerfile, tag string) error {
+	args := []string{"buildx", "build", "-f", dockerfile, "-t", tag, "--load"}
+	if dir := os.Getenv("NB_E2E_BUILDX_CACHE"); dir != "" {
+		args = append(args,
+			"--cache-from", "type=local,src="+dir,
+			"--cache-to", "type=local,dest="+dir+",mode=max",
+		)
+	}
+	args = append(args, ".")
+
+	cmd := exec.CommandContext(ctx, "docker", args...)
+	cmd.Dir = root
+	cmd.Env = append(os.Environ(), "DOCKER_BUILDKIT=1")
+	if out, err := cmd.CombinedOutput(); err != nil {
+		return fmt.Errorf("build image %s: %w\n%s", tag, err, string(out))
+	}
+	return nil
+}
+
+// CreateProxyTokenCLI mints a proxy access token via the server's `token
+// create` CLI inside the container — the same path the manual install uses.
+// This yields a GLOBAL (account-less) token, so the proxy serves the whole
+// cluster (SynthesizeServicesForCluster); an account-scoped REST token instead
+// drives the per-account path. Returns the plaintext token.
+func (c *Combined) CreateProxyTokenCLI(ctx context.Context, name string) (string, error) {
+	code, reader, err := c.container.Exec(ctx,
+		[]string{"/go/bin/netbird-server", "token", "create", "--name", name, "--config", "/nb/config.yaml"},
+		tcexec.Multiplexed())
+	if err != nil {
+		return "", fmt.Errorf("exec token create: %w", err)
+	}
+	out, _ := io.ReadAll(reader)
+	if code != 0 {
+		return "", fmt.Errorf("token create exited %d: %s", code, string(out))
+	}
+	for _, line := range strings.Split(string(out), "\n") {
+		line = strings.TrimSpace(line)
+		if strings.HasPrefix(line, "Token:") {
+			tok := strings.TrimSpace(strings.TrimPrefix(line, "Token:"))
+			if tok != "" {
+				return tok, nil
+			}
+		}
+	}
+	return "", fmt.Errorf("token not found in CLI output: %s", string(out))
+}
+
+// Logs returns the combined server container logs, for diagnostics.
+func (c *Combined) Logs(ctx context.Context) string {
+	return containerLogs(ctx, c.container)
+}
+
+// Terminate stops the container, removes the shared network, and cleans the
+// work dir.
+func (c *Combined) Terminate(ctx context.Context) error {
+	var err error
+	if c.container != nil {
+		err = c.container.Terminate(ctx)
+	}
+	if c.network != nil {
+		_ = c.network.Remove(ctx)
+	}
+	if c.workDir != "" {
+		_ = os.RemoveAll(c.workDir)
+	}
+	return err
+}
diff --git a/e2e/harness/config.go b/e2e/harness/config.go
new file mode 100644
index 000000000..b4bed60a2
--- /dev/null
+++ b/e2e/harness/config.go
@@ -0,0 +1,26 @@
+//go:build e2e
+
+package harness
+
+// combinedConfigYAML is a minimal combined-server config for tests: plain HTTP
+// on :8080 (no TLS cert configured → the server serves HTTP and expects to sit
+// behind a reverse proxy, which is exactly what we want for in-cluster tests),
+// embedded IdP, local signal/relay/STUN, and a sqlite store under the mounted
+// data dir. exposedAddress is the address peers use to reach this container; it
+// is overridden per-run so the value matches the container's network alias.
+const combinedConfigYAML = `server:
+  listenAddress: ":8080"
+  exposedAddress: "%s"
+  healthcheckAddress: ":9000"
+  metricsPort: 9090
+  logLevel: "info"
+  logFile: "console"
+  authSecret: "e2e-relay-secret"
+  dataDir: "/nb/data"
+  disableAnonymousMetrics: true
+  disableGeoliteUpdate: true
+  auth:
+    issuer: "%s"
+  store:
+    engine: "sqlite"
+`
diff --git a/e2e/harness/doc.go b/e2e/harness/doc.go
new file mode 100644
index 000000000..937d8e664
--- /dev/null
+++ b/e2e/harness/doc.go
@@ -0,0 +1,13 @@
+//go:build e2e
+
+// Package harness provides a self-contained, OIDC-free way to stand up NetBird
+// components in containers for end-to-end tests. It is feature-agnostic: any
+// suite can ask for a live management server (with an admin PAT minted through
+// the unauthenticated /api/setup bootstrap) and, later, a proxy and client.
+//
+// The harness compiles each component once in a cached builder container and
+// mounts the resulting binary into a slim runtime container, so iterating on a
+// branch doesn't pay a full image rebuild per run. Everything is gated behind
+// the `e2e` build tag so normal builds and unit tests never pull in
+// testcontainers.
+package harness
diff --git a/e2e/harness/paths.go b/e2e/harness/paths.go
new file mode 100644
index 000000000..d7df6bbfa
--- /dev/null
+++ b/e2e/harness/paths.go
@@ -0,0 +1,29 @@
+//go:build e2e
+
+package harness
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+)
+
+// repoRoot walks up from the working directory to the module root (the
+// directory holding go.mod), so the Docker build context is correct no matter
+// which package the test runs from.
+func repoRoot() (string, error) {
+	dir, err := os.Getwd()
+	if err != nil {
+		return "", err
+	}
+	for {
+		if _, statErr := os.Stat(filepath.Join(dir, "go.mod")); statErr == nil {
+			return dir, nil
+		}
+		parent := filepath.Dir(dir)
+		if parent == dir {
+			return "", fmt.Errorf("go.mod not found above %s", dir)
+		}
+		dir = parent
+	}
+}
diff --git a/e2e/harness/proxy.go b/e2e/harness/proxy.go
new file mode 100644
index 000000000..8db2c140f
--- /dev/null
+++ b/e2e/harness/proxy.go
@@ -0,0 +1,122 @@
+//go:build e2e
+
+package harness
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/docker/docker/api/types/container"
+	"github.com/testcontainers/testcontainers-go"
+	"github.com/testcontainers/testcontainers-go/wait"
+)
+
+const (
+	proxyDockerfile = "proxy/Dockerfile.multistage"
+	// defaultProxyImage is the local tag the reverse proxy is built under from
+	// proxyDockerfile. Override with NB_E2E_PROXY_IMAGE: a value with a "/" is
+	// pulled as a published image; a bare tag is built under that name.
+	defaultProxyImage = "netbird-reverse-proxy:e2e"
+	proxyAlias        = "proxy"
+
+	// AgentNetworkCluster is the proxy cluster the e2e provider bootstraps and
+	// the proxy serves. It must equal the management's exposed domain
+	// (combinedAlias) — the working manual setup uses one NETBIRD_DOMAIN for
+	// both. The agent-network endpoint is <subdomain>.<cluster>.
+	AgentNetworkCluster = combinedAlias
+)
+
+// Proxy is a running agent-network gateway (netbird proxy) container.
+type Proxy struct {
+	container testcontainers.Container
+	workDir   string
+}
+
+// StartProxy builds the proxy image and runs it on the combined server's
+// network, registered via the given account proxy token and serving the
+// AgentNetworkCluster over a self-signed wildcard cert. It does not wait for
+// peer connectivity — callers poll management for the proxy peer.
+func StartProxy(ctx context.Context, c *Combined, proxyToken string) (*Proxy, error) {
+	root, err := repoRoot()
+	if err != nil {
+		return nil, err
+	}
+	proxyImage, err := resolveImage(ctx, root, "NB_E2E_PROXY_IMAGE", defaultProxyImage, proxyDockerfile)
+	if err != nil {
+		return nil, err
+	}
+
+	workDir, err := os.MkdirTemp("/tmp", "nb-e2e-proxy-*")
+	if err != nil {
+		return nil, fmt.Errorf("create proxy work dir: %w", err)
+	}
+	// MkdirTemp creates the dir 0700; widen it so the non-root proxy container
+	// can traverse the bind-mounted cert dir on Linux CI runners.
+	if err := os.Chmod(workDir, 0o755); err != nil { //nolint:gosec // throwaway e2e cert dir, must be traversable by the proxy container uid
+		return nil, fmt.Errorf("chmod proxy cert dir: %w", err)
+	}
+	if err := writeSelfSignedCert(workDir, []string{"*." + AgentNetworkCluster, AgentNetworkCluster}); err != nil {
+		return nil, err
+	}
+
+	req := testcontainers.ContainerRequest{
+		Image:          proxyImage,
+		Networks:       []string{c.network.Name},
+		NetworkAliases: map[string][]string{c.network.Name: {proxyAlias}},
+		Env: map[string]string{
+			"NB_PROXY_TOKEN":                 proxyToken,
+			"NB_PROXY_MANAGEMENT_ADDRESS":    combinedExposedURL,
+			"NB_PROXY_DOMAIN":                AgentNetworkCluster,
+			"NB_PROXY_ADDRESS":               ":443",
+			"NB_PROXY_CERTIFICATE_DIRECTORY": "/certs",
+			"NB_PROXY_HEALTH_ADDRESS":        ":8081",
+			"NB_PROXY_LOG_LEVEL":             "debug",
+			"NB_PROXY_PRIVATE":               "true",
+			// Management is plain HTTP in-cluster, so allow the proxy token to
+			// ride a non-TLS gRPC connection.
+			"NB_PROXY_ALLOW_INSECURE": "true",
+			// The combined server multiplexes the relay over WebSocket on :8080
+			// (no QUIC listener). The proxy's embedded relay client defaults to
+			// QUIC, which fails here and flaps the relay link, churning the
+			// proxy peer so it never stably registers. Force WS transport.
+			"NB_RELAY_TRANSPORT": "ws",
+			// Trace the embedded client (relay / signal / handshake) so
+			// peer-registration issues are visible in the proxy logs.
+			"NB_PROXY_CLIENT_LOG_LEVEL": "trace",
+		},
+		HostConfigModifier: func(hc *container.HostConfig) {
+			hc.Binds = append(hc.Binds, workDir+":/certs")
+			hc.CapAdd = append(hc.CapAdd, "NET_ADMIN", "SYS_ADMIN", "SYS_RESOURCE", "NET_BIND_SERVICE")
+		},
+		WaitingFor: wait.ForLog("Initial mapping sync complete").WithStartupTimeout(90 * time.Second),
+	}
+
+	ctr, err := testcontainers.GenericContainer(ctx, testcontainers.GenericContainerRequest{
+		ContainerRequest: req,
+		Started:          true,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("start proxy container: %w", err)
+	}
+
+	return &Proxy{container: ctr, workDir: workDir}, nil
+}
+
+// Logs returns the proxy container logs, for diagnostics on failure.
+func (p *Proxy) Logs(ctx context.Context) string {
+	return containerLogs(ctx, p.container)
+}
+
+// Terminate stops the proxy container and cleans its work dir.
+func (p *Proxy) Terminate(ctx context.Context) error {
+	var err error
+	if p.container != nil {
+		err = p.container.Terminate(ctx)
+	}
+	if p.workDir != "" {
+		_ = os.RemoveAll(p.workDir)
+	}
+	return err
+}
diff --git a/go.mod b/go.mod
index 9a57de1c9..e1c762607 100644
--- a/go.mod
+++ b/go.mod
@@ -35,6 +35,7 @@ require (
 	github.com/DeRuina/timberjack v1.4.2
 	github.com/awnumar/memguard v0.23.0
 	github.com/aws/aws-sdk-go-v2 v1.38.3
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.1
 	github.com/aws/aws-sdk-go-v2/config v1.31.6
 	github.com/aws/aws-sdk-go-v2/credentials v1.18.10
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.87.3
@@ -49,6 +50,8 @@ require (
 	github.com/crowdsecurity/go-cs-bouncer v0.0.21
 	github.com/dexidp/dex v2.13.0+incompatible
 	github.com/dexidp/dex/api/v2 v2.4.0
+	github.com/docker/docker v28.0.1+incompatible
+	github.com/docker/go-connections v0.6.0
 	github.com/ebitengine/purego v0.8.4
 	github.com/eko/gocache/lib/v4 v4.2.0
 	github.com/eko/gocache/store/go_cache/v4 v4.2.2
@@ -158,7 +161,6 @@ require (
 	github.com/apapsch/go-jsonmerge/v2 v2.0.0 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
 	github.com/awnumar/memcall v0.4.0 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.1 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.6 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.6 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.6 // indirect
@@ -188,8 +190,6 @@ require (
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
 	github.com/distribution/reference v0.6.0 // indirect
-	github.com/docker/docker v28.0.1+incompatible // indirect
-	github.com/docker/go-connections v0.6.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fredbi/uri v1.1.1 // indirect
diff --git a/management/internals/controllers/network_map/controller/controller.go b/management/internals/controllers/network_map/controller/controller.go
index 0d8fb3c47..f1b1832d2 100644
--- a/management/internals/controllers/network_map/controller/controller.go
+++ b/management/internals/controllers/network_map/controller/controller.go
@@ -116,6 +116,24 @@ func (c *Controller) OnPeerDisconnected(ctx context.Context, accountID string, p
 	c.EphemeralPeersManager.OnPeerDisconnected(ctx, peer)
 }
 
+// injectAllProxyPolicies prepares an account for the per-peer network-map
+// computation. It prepends the in-memory agent-network services synthesised
+// from the account's current provider/policy state to account.Services so
+// the existing InjectProxyPolicies + injectPrivateServicePolicies walks pick
+// them up alongside persisted reverse-proxy services. Synthesised services
+// are never persisted; the account is loaded fresh per cycle so re-prepending
+// is safe and idempotent. Accounts without agent-network providers get an
+// empty synth slice — no behaviour change.
+func (c *Controller) injectAllProxyPolicies(ctx context.Context, account *types.Account) {
+	synth, err := c.repo.SynthesizeAgentNetworkServices(ctx, account.Id)
+	if err != nil {
+		log.WithContext(ctx).Warnf("synthesise agent-network services for account %s: %v", account.Id, err)
+	} else if len(synth) > 0 {
+		account.Services = append(synth, account.Services...)
+	}
+	account.InjectProxyPolicies(ctx)
+}
+
 func (c *Controller) CountStreams() int {
 	return c.peersUpdateManager.CountStreams()
 }
@@ -150,7 +168,7 @@ func (c *Controller) sendUpdateAccountPeers(ctx context.Context, accountID strin
 	var wg sync.WaitGroup
 	semaphore := make(chan struct{}, 10)
 
-	account.InjectProxyPolicies(ctx)
+	c.injectAllProxyPolicies(ctx, account)
 	dnsCache := &cache.DNSConfigCache{}
 	dnsDomain := c.GetDNSDomain(account.Settings)
 	peersCustomZone := account.GetPeersCustomZone(ctx, dnsDomain)
@@ -281,7 +299,15 @@ func (c *Controller) sendUpdateForAffectedPeers(ctx context.Context, accountID s
 	var wg sync.WaitGroup
 	semaphore := make(chan struct{}, 10)
 
-	account.InjectProxyPolicies(ctx)
+	// The affected-peer path MUST mirror sendUpdateAccountPeers (line 171)
+	// here: injectAllProxyPolicies prepends the synthesised agent-network
+	// services BEFORE InjectProxyPolicies + private-service policies run.
+	// Previously this path called only account.InjectProxyPolicies, which
+	// skipped the synth-services prepend — so peer-level changes
+	// (proxy restart, embedded peer connect/disconnect) propagated a
+	// network map that omitted the synth DNS zone, and the agent kept
+	// resolving against the stale or absent record.
+	c.injectAllProxyPolicies(ctx, account)
 	dnsCache := &cache.DNSConfigCache{}
 	dnsDomain := c.GetDNSDomain(account.Settings)
 	peersCustomZone := account.GetPeersCustomZone(ctx, dnsDomain)
@@ -399,7 +425,7 @@ func (c *Controller) UpdateAccountPeer(ctx context.Context, accountId string, pe
 		return fmt.Errorf("failed to get validated peers: %v", err)
 	}
 
-	account.InjectProxyPolicies(ctx)
+	c.injectAllProxyPolicies(ctx, account)
 	dnsCache := &cache.DNSConfigCache{}
 	dnsDomain := c.GetDNSDomain(account.Settings)
 	peersCustomZone := account.GetPeersCustomZone(ctx, dnsDomain)
@@ -603,7 +629,7 @@ func (c *Controller) GetValidatedPeerWithMap(ctx context.Context, isRequiresAppr
 		return nil, nil, 0, err
 	}
 
-	account.InjectProxyPolicies(ctx)
+	c.injectAllProxyPolicies(ctx, account)
 
 	approvedPeersMap, err := c.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, maps.Values(account.Groups), maps.Values(account.Peers), account.Settings.Extra)
 	if err != nil {
@@ -874,7 +900,7 @@ func (c *Controller) GetNetworkMap(ctx context.Context, peerID string) (*types.N
 		return nil, err
 	}
 
-	account.InjectProxyPolicies(ctx)
+	c.injectAllProxyPolicies(ctx, account)
 	resourcePolicies := account.GetResourcePoliciesMap()
 	routers := account.GetResourceRoutersMap()
 	groupIDToUserIDs := account.GetActiveGroupUsers()
diff --git a/management/internals/controllers/network_map/controller/repository.go b/management/internals/controllers/network_map/controller/repository.go
index caef362cb..c0fcefc7d 100644
--- a/management/internals/controllers/network_map/controller/repository.go
+++ b/management/internals/controllers/network_map/controller/repository.go
@@ -3,7 +3,9 @@ package controller
 import (
 	"context"
 
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/netbirdio/netbird/management/internals/modules/zones"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/store"
 	"github.com/netbirdio/netbird/management/server/types"
@@ -16,6 +18,10 @@ type Repository interface {
 	GetPeersByIDs(ctx context.Context, accountID string, peerIDs []string) (map[string]*peer.Peer, error)
 	GetPeerByID(ctx context.Context, accountID string, peerID string) (*peer.Peer, error)
 	GetAccountZones(ctx context.Context, accountID string) ([]*zones.Zone, error)
+	// SynthesizeAgentNetworkServices returns the in-memory reverse-proxy
+	// services synthesised from the account's agent-network provider/policy
+	// state. Empty for accounts without agent-network providers.
+	SynthesizeAgentNetworkServices(ctx context.Context, accountID string) ([]*service.Service, error)
 }
 
 type repository struct {
@@ -50,6 +56,10 @@ func (r *repository) GetPeerByID(ctx context.Context, accountID string, peerID s
 	return r.store.GetPeerByID(ctx, store.LockingStrengthNone, accountID, peerID)
 }
 
+func (r *repository) SynthesizeAgentNetworkServices(ctx context.Context, accountID string) ([]*service.Service, error) {
+	return agentnetwork.SynthesizeServices(ctx, r.store, accountID)
+}
+
 func (r *repository) GetAccountZones(ctx context.Context, accountID string) ([]*zones.Zone, error) {
 	return r.store.GetAccountZones(ctx, store.LockingStrengthNone, accountID)
 }
diff --git a/management/internals/modules/agentnetwork/accesslog_ingest.go b/management/internals/modules/agentnetwork/accesslog_ingest.go
new file mode 100644
index 000000000..59e53efa2
--- /dev/null
+++ b/management/internals/modules/agentnetwork/accesslog_ingest.go
@@ -0,0 +1,215 @@
+package agentnetwork
+
+import (
+	"context"
+	"math"
+	"strconv"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
+	"github.com/netbirdio/netbird/management/server/store"
+)
+
+// Metadata keys the proxy stamps on agent-network access-log entries. These
+// mirror the constants in proxy/internal/middleware/keys.go and form the wire
+// contract between the proxy and management; management flattens them into
+// queryable columns. Keep in sync with the proxy side.
+const (
+	metaKeyProvider           = "llm.provider"
+	metaKeyModel              = "llm.model"
+	metaKeyResolvedProviderID = "llm.resolved_provider_id"
+	metaKeySelectedPolicyID   = "llm.selected_policy_id"
+	metaKeyPolicyDecision     = "llm_policy.decision"
+	metaKeyPolicyReason       = "llm_policy.reason"
+	metaKeyInputTokens        = "llm.input_tokens"  //nolint:gosec // metadata key name, not a credential
+	metaKeyOutputTokens       = "llm.output_tokens" //nolint:gosec // metadata key name, not a credential
+	metaKeyTotalTokens        = "llm.total_tokens"  //nolint:gosec // metadata key name, not a credential
+	metaKeyCostUSDTotal       = "cost.usd_total"
+	metaKeyStream             = "llm.stream"
+	metaKeySessionID          = "llm.session_id"
+	metaKeyAuthorisingGroups  = "llm.authorising_groups"
+	metaKeyRequestPrompt      = "llm.request_prompt"
+	metaKeyResponseCompletion = "llm.response_completion"
+)
+
+// IngestAccessLog flattens the metadata-bearing reverse-proxy access-log entry
+// and persists it in the dedicated agent-network tables (instead of the shared
+// reverse-proxy table), in two parts:
+//
+//   - The stripped usage record is written unconditionally — usage/cost is
+//     collected on every request regardless of the account's log-collection
+//     toggle (the proxy ships a usage-only entry when logging is disabled).
+//   - The full access-log row (with request detail + prompt) is written only
+//     when the account's EnableLogCollection setting is on. This setting read
+//     is the authoritative gate; the proxy-side strip is defense in depth.
+func IngestAccessLog(ctx context.Context, s store.Store, logEntry *accesslogs.AccessLogEntry) error {
+	entry, groups := flattenAccessLog(logEntry)
+
+	usage, usageGroups := usageFromFlattenedLog(entry, groups)
+	if err := s.CreateAgentNetworkUsage(ctx, usage, usageGroups); err != nil {
+		log.WithContext(ctx).WithFields(log.Fields{
+			"account_id": entry.AccountID,
+			"model":      entry.Model,
+		}).Errorf("failed to save agent-network usage: %v", err)
+		return err
+	}
+
+	settings, err := s.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, entry.AccountID)
+	if err != nil {
+		// No settings row (or a transient read error) means we can't confirm
+		// log collection is enabled — usage is already saved, so skip the full
+		// row rather than fail the whole ingest.
+		log.WithContext(ctx).Debugf("skipping full agent-network access-log row for account %s: %v", entry.AccountID, err)
+		return nil
+	}
+	if !settings.EnableLogCollection {
+		return nil
+	}
+
+	if err := s.CreateAgentNetworkAccessLog(ctx, entry, groups); err != nil {
+		log.WithContext(ctx).WithFields(log.Fields{
+			"account_id": entry.AccountID,
+			"service_id": entry.ServiceID,
+			"model":      entry.Model,
+			"status":     entry.StatusCode,
+		}).Errorf("failed to save agent-network access log: %v", err)
+		return err
+	}
+	return nil
+}
+
+// flattenAccessLog converts a reverse-proxy AccessLogEntry (whose LLM
+// dimensions live in the opaque Metadata map) into the flattened
+// agent-network row + authorising-group child rows.
+func flattenAccessLog(e *accesslogs.AccessLogEntry) (*types.AgentNetworkAccessLog, []types.AgentNetworkAccessLogGroup) {
+	meta := e.Metadata
+
+	var sourceIP string
+	if e.GeoLocation.ConnectionIP != nil {
+		sourceIP = e.GeoLocation.ConnectionIP.String()
+	}
+
+	entry := &types.AgentNetworkAccessLog{
+		ID:            e.ID,
+		AccountID:     e.AccountID,
+		ServiceID:     e.ServiceID,
+		Timestamp:     e.Timestamp,
+		UserID:        e.UserId,
+		SourceIP:      sourceIP,
+		Method:        e.Method,
+		Host:          e.Host,
+		Path:          e.Path,
+		Duration:      e.Duration,
+		StatusCode:    e.StatusCode,
+		AuthMethod:    e.AuthMethodUsed,
+		BytesUpload:   e.BytesUpload,
+		BytesDownload: e.BytesDownload,
+
+		Provider:           meta[metaKeyProvider],
+		Model:              meta[metaKeyModel],
+		SessionID:          meta[metaKeySessionID],
+		ResolvedProviderID: meta[metaKeyResolvedProviderID],
+		SelectedPolicyID:   meta[metaKeySelectedPolicyID],
+		Decision:           meta[metaKeyPolicyDecision],
+		DenyReason:         meta[metaKeyPolicyReason],
+		InputTokens:        parseMetaInt(meta, metaKeyInputTokens),
+		OutputTokens:       parseMetaInt(meta, metaKeyOutputTokens),
+		TotalTokens:        parseMetaInt(meta, metaKeyTotalTokens),
+		CostUSD:            parseMetaFloat(meta, metaKeyCostUSDTotal),
+		Stream:             parseMetaBool(meta, metaKeyStream),
+		RequestPrompt:      meta[metaKeyRequestPrompt],
+		ResponseCompletion: meta[metaKeyResponseCompletion],
+	}
+
+	var groups []types.AgentNetworkAccessLogGroup
+	for _, gid := range parseGroupCSV(meta[metaKeyAuthorisingGroups]) {
+		groups = append(groups, types.AgentNetworkAccessLogGroup{
+			LogID:     entry.ID,
+			GroupID:   gid,
+			AccountID: entry.AccountID,
+		})
+	}
+	return entry, groups
+}
+
+// usageFromFlattenedLog derives the stripped usage record (and its group child
+// rows) from an already-flattened access-log entry. The usage row shares the
+// log's ID so the two correlate.
+func usageFromFlattenedLog(e *types.AgentNetworkAccessLog, groups []types.AgentNetworkAccessLogGroup) (*types.AgentNetworkUsage, []types.AgentNetworkUsageGroup) {
+	usage := &types.AgentNetworkUsage{
+		ID:                 e.ID,
+		AccountID:          e.AccountID,
+		Timestamp:          e.Timestamp,
+		UserID:             e.UserID,
+		ResolvedProviderID: e.ResolvedProviderID,
+		Provider:           e.Provider,
+		Model:              e.Model,
+		SessionID:          e.SessionID,
+		InputTokens:        e.InputTokens,
+		OutputTokens:       e.OutputTokens,
+		TotalTokens:        e.TotalTokens,
+		CostUSD:            e.CostUSD,
+	}
+
+	usageGroups := make([]types.AgentNetworkUsageGroup, 0, len(groups))
+	for _, g := range groups {
+		usageGroups = append(usageGroups, types.AgentNetworkUsageGroup{
+			UsageID:   usage.ID,
+			GroupID:   g.GroupID,
+			AccountID: g.AccountID,
+		})
+	}
+	return usage, usageGroups
+}
+
+// parseMetaInt parses a non-negative token count. Negative or unparseable
+// values are clamped to 0 so a malformed metric can't persist a negative
+// counter.
+func parseMetaInt(meta map[string]string, key string) int64 {
+	if v, err := strconv.ParseInt(strings.TrimSpace(meta[key]), 10, 64); err == nil && v >= 0 {
+		return v
+	}
+	return 0
+}
+
+// parseMetaFloat parses a non-negative, finite cost. Negative, NaN, Inf, or
+// unparseable values are clamped to 0 so a malformed metric can't poison the
+// stored cost.
+func parseMetaFloat(meta map[string]string, key string) float64 {
+	if v, err := strconv.ParseFloat(strings.TrimSpace(meta[key]), 64); err == nil && v >= 0 && !math.IsInf(v, 0) {
+		return v
+	}
+	return 0
+}
+
+func parseMetaBool(meta map[string]string, key string) bool {
+	v, _ := strconv.ParseBool(strings.TrimSpace(meta[key]))
+	return v
+}
+
+// parseGroupCSV splits the comma-separated authorising-group id list the proxy
+// emits, trimming blanks and de-duplicating. Dedup matters because the group
+// rows are keyed by (log_id, group_id) / (usage_id, group_id): a repeated id
+// in the CSV would otherwise produce a duplicate primary key and fail the
+// insert transaction.
+func parseGroupCSV(raw string) []string {
+	if raw == "" {
+		return nil
+	}
+	parts := strings.Split(raw, ",")
+	out := make([]string, 0, len(parts))
+	seen := make(map[string]struct{}, len(parts))
+	for _, p := range parts {
+		if p = strings.TrimSpace(p); p != "" {
+			if _, dup := seen[p]; dup {
+				continue
+			}
+			seen[p] = struct{}{}
+			out = append(out, p)
+		}
+	}
+	return out
+}
diff --git a/management/internals/modules/agentnetwork/accesslog_ingest_realstore_test.go b/management/internals/modules/agentnetwork/accesslog_ingest_realstore_test.go
new file mode 100644
index 000000000..431ce680e
--- /dev/null
+++ b/management/internals/modules/agentnetwork/accesslog_ingest_realstore_test.go
@@ -0,0 +1,124 @@
+package agentnetwork
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
+	"github.com/netbirdio/netbird/management/server/store"
+)
+
+// newIngestTestEntry builds an agent-network reverse-proxy access-log entry whose
+// LLM dimensions live in the opaque Metadata map, as the proxy ships it.
+func newIngestTestEntry() *accesslogs.AccessLogEntry {
+	return &accesslogs.AccessLogEntry{
+		ID:           "log-1",
+		AccountID:    testAccountID,
+		ServiceID:    "svc-1",
+		Timestamp:    time.Now().UTC(),
+		Method:       "POST",
+		Host:         testEndpoint,
+		Path:         "/v1/chat/completions",
+		StatusCode:   200,
+		UserId:       "user-1",
+		AgentNetwork: true,
+		Metadata: map[string]string{
+			metaKeyProvider:           "openai",
+			metaKeyModel:              "gpt-5.4",
+			metaKeyResolvedProviderID: "prov-1",
+			metaKeySessionID:          "sess-1",
+			metaKeyInputTokens:        "100",
+			metaKeyOutputTokens:       "50",
+			metaKeyTotalTokens:        "150",
+			metaKeyCostUSDTotal:       "0.0123",
+			metaKeyStream:             "true",
+			metaKeyRequestPrompt:      "hello",
+			metaKeyResponseCompletion: "world",
+			// repeated id must be de-duplicated before the group rows insert.
+			metaKeyAuthorisingGroups: "grp-eng,grp-eng,grp-ops",
+		},
+	}
+}
+
+// TestIngestAccessLog_RealStore_LogCollectionOff persists the usage ledger
+// unconditionally but skips the full access-log row when the account hasn't
+// opted into log collection.
+func TestIngestAccessLog_RealStore_LogCollectionOff(t *testing.T) {
+	ctx := context.Background()
+	s, cleanup, err := store.NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err, "real sqlite test store must come up")
+	defer cleanup()
+
+	settings := newSynthTestSettings()
+	settings.EnableLogCollection = false
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, settings))
+
+	require.NoError(t, IngestAccessLog(ctx, s, newIngestTestEntry()))
+
+	usage, err := s.GetAgentNetworkUsageRows(ctx, store.LockingStrengthNone, testAccountID, types.AgentNetworkAccessLogFilter{})
+	require.NoError(t, err)
+	require.Len(t, usage, 1, "usage row must be written even with log collection off")
+	assert.Equal(t, int64(100), usage[0].InputTokens, "input tokens must round-trip from metadata")
+	assert.Equal(t, int64(50), usage[0].OutputTokens, "output tokens must round-trip from metadata")
+	assert.InDelta(t, 0.0123, usage[0].CostUSD, 1e-9, "cost must round-trip from metadata")
+
+	logs, _, err := s.GetAgentNetworkAccessLogs(ctx, store.LockingStrengthNone, testAccountID, types.AgentNetworkAccessLogFilter{})
+	require.NoError(t, err)
+	assert.Empty(t, logs, "full access-log row must be skipped while log collection is off")
+}
+
+// TestIngestAccessLog_RealStore_LogCollectionOn writes both the usage ledger and
+// the full access-log row once the account opts in, carrying the request detail
+// and prompt through.
+func TestIngestAccessLog_RealStore_LogCollectionOn(t *testing.T) {
+	ctx := context.Background()
+	s, cleanup, err := store.NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err, "real sqlite test store must come up")
+	defer cleanup()
+
+	settings := newSynthTestSettings()
+	settings.EnableLogCollection = true
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, settings))
+
+	require.NoError(t, IngestAccessLog(ctx, s, newIngestTestEntry()))
+
+	usage, err := s.GetAgentNetworkUsageRows(ctx, store.LockingStrengthNone, testAccountID, types.AgentNetworkAccessLogFilter{})
+	require.NoError(t, err)
+	require.Len(t, usage, 1, "usage row must be written when log collection is on")
+
+	logs, total, err := s.GetAgentNetworkAccessLogs(ctx, store.LockingStrengthNone, testAccountID, types.AgentNetworkAccessLogFilter{})
+	require.NoError(t, err)
+	require.Equal(t, int64(1), total, "exactly one access-log row expected")
+	require.Len(t, logs, 1, "full access-log row must be written when log collection is on")
+	assert.Equal(t, "gpt-5.4", logs[0].Model, "model must flatten from metadata")
+	assert.Equal(t, "hello", logs[0].RequestPrompt, "prompt must be retained when log collection is on")
+	assert.Equal(t, "world", logs[0].ResponseCompletion, "completion must be retained when log collection is on")
+	assert.True(t, logs[0].Stream, "stream flag must flatten from metadata")
+}
+
+func TestParseGroupCSV_DedupAndTrim(t *testing.T) {
+	assert.Nil(t, parseGroupCSV(""), "empty CSV yields no groups")
+	assert.Equal(t, []string{"a", "b"}, parseGroupCSV(" a , b , a ,"),
+		"group CSV must trim, drop blanks, and de-duplicate preserving first-seen order")
+}
+
+func TestParseMetaInt_ClampsNegativeAndJunk(t *testing.T) {
+	meta := map[string]string{"ok": " 42 ", "neg": "-5", "junk": "abc"}
+	assert.Equal(t, int64(42), parseMetaInt(meta, "ok"), "valid count parses with surrounding space trimmed")
+	assert.Equal(t, int64(0), parseMetaInt(meta, "neg"), "negative count clamps to 0")
+	assert.Equal(t, int64(0), parseMetaInt(meta, "junk"), "unparseable count clamps to 0")
+	assert.Equal(t, int64(0), parseMetaInt(meta, "missing"), "missing key clamps to 0")
+}
+
+func TestParseMetaFloat_ClampsNegativeInfAndJunk(t *testing.T) {
+	meta := map[string]string{"ok": "1.5", "neg": "-1", "inf": "Inf", "junk": "x"}
+	assert.InDelta(t, 1.5, parseMetaFloat(meta, "ok"), 1e-9, "valid cost parses")
+	assert.Equal(t, float64(0), parseMetaFloat(meta, "neg"), "negative cost clamps to 0")
+	assert.Equal(t, float64(0), parseMetaFloat(meta, "inf"), "non-finite cost clamps to 0")
+	assert.Equal(t, float64(0), parseMetaFloat(meta, "junk"), "unparseable cost clamps to 0")
+}
diff --git a/management/internals/modules/agentnetwork/accesslog_sessions_realstore_test.go b/management/internals/modules/agentnetwork/accesslog_sessions_realstore_test.go
new file mode 100644
index 000000000..7d53d7547
--- /dev/null
+++ b/management/internals/modules/agentnetwork/accesslog_sessions_realstore_test.go
@@ -0,0 +1,343 @@
+package agentnetwork
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/server/store"
+)
+
+// baseTime is a fixed reference so session timestamps (and therefore the
+// default MAX(timestamp) DESC ordering) are deterministic across runs.
+var baseTime = time.Date(2026, 6, 30, 12, 0, 0, 0, time.UTC)
+
+// accessLogRow builds an agent-network access-log row for the shared test
+// account. Functional options tweak the LLM dimensions a given test cares
+// about; everything else gets a sane, allow/200 default.
+func accessLogRow(id, sessionID string, ts time.Time, opts ...func(*types.AgentNetworkAccessLog)) *types.AgentNetworkAccessLog {
+	e := &types.AgentNetworkAccessLog{
+		ID:                 id,
+		AccountID:          testAccountID,
+		ServiceID:          "svc-1",
+		Timestamp:          ts,
+		UserID:             "user-1",
+		SessionID:          sessionID,
+		Method:             "POST",
+		Host:               testEndpoint,
+		Path:               "/v1/chat/completions",
+		StatusCode:         200,
+		Decision:           "allow",
+		Provider:           "openai",
+		Model:              "gpt-5.4",
+		ResolvedProviderID: "prov-1",
+		InputTokens:        100,
+		OutputTokens:       50,
+		TotalTokens:        150,
+		CostUSD:            0.01,
+	}
+	for _, o := range opts {
+		o(e)
+	}
+	return e
+}
+
+func withUser(u string) func(*types.AgentNetworkAccessLog) {
+	return func(e *types.AgentNetworkAccessLog) { e.UserID = u }
+}
+
+func withModel(m string) func(*types.AgentNetworkAccessLog) {
+	return func(e *types.AgentNetworkAccessLog) { e.Model = m }
+}
+
+func withProvider(vendor, resolvedID string) func(*types.AgentNetworkAccessLog) {
+	return func(e *types.AgentNetworkAccessLog) {
+		e.Provider = vendor
+		e.ResolvedProviderID = resolvedID
+	}
+}
+
+func withDeny(reason string) func(*types.AgentNetworkAccessLog) {
+	return func(e *types.AgentNetworkAccessLog) {
+		e.Decision = "deny"
+		e.DenyReason = reason
+		e.StatusCode = 403
+	}
+}
+
+func withTokens(in, out, total int64, cost float64) func(*types.AgentNetworkAccessLog) {
+	return func(e *types.AgentNetworkAccessLog) {
+		e.InputTokens = in
+		e.OutputTokens = out
+		e.TotalTokens = total
+		e.CostUSD = cost
+	}
+}
+
+func withGroups(gids ...string) func(*types.AgentNetworkAccessLog) {
+	return func(e *types.AgentNetworkAccessLog) { e.GroupIDs = gids }
+}
+
+// seedAccessLogs writes rows (and their authorising-group child rows) directly
+// into the store, bypassing ingest so a test can control every dimension.
+func seedAccessLogs(t *testing.T, s store.Store, rows ...*types.AgentNetworkAccessLog) {
+	t.Helper()
+	ctx := context.Background()
+	for _, r := range rows {
+		var groups []types.AgentNetworkAccessLogGroup
+		for _, g := range r.GroupIDs {
+			groups = append(groups, types.AgentNetworkAccessLogGroup{
+				LogID:     r.ID,
+				GroupID:   g,
+				AccountID: r.AccountID,
+			})
+		}
+		require.NoError(t, s.CreateAgentNetworkAccessLog(ctx, r, groups), "seed access-log row %s", r.ID)
+	}
+}
+
+func newSessionsTestStore(t *testing.T) store.Store {
+	t.Helper()
+	s, cleanup, err := store.NewTestStoreFromSQL(context.Background(), "", t.TempDir())
+	require.NoError(t, err, "real sqlite test store must come up")
+	t.Cleanup(cleanup)
+	return s
+}
+
+// sessionIDs projects the session ids from a page of session summaries, in
+// order, for concise ordering assertions.
+func sessionIDs(sessions []*types.AgentNetworkAccessLogSession) []string {
+	out := make([]string, 0, len(sessions))
+	for _, s := range sessions {
+		out = append(out, s.SessionID)
+	}
+	return out
+}
+
+// TestAccessLogSessions_FoldAndAggregate verifies that multiple entries sharing
+// a session id fold into one summary with summed usage, distinct
+// provider/model lists, a deny rollup, and correct first/last activity bounds.
+func TestAccessLogSessions_FoldAndAggregate(t *testing.T) {
+	ctx := context.Background()
+	s := newSessionsTestStore(t)
+
+	// sess-a: three entries spanning 3 minutes, two providers/models, one deny.
+	seedAccessLogs(t, s,
+		accessLogRow("a1", "sess-a", baseTime,
+			withProvider("openai", "prov-openai"), withModel("gpt-5.4"),
+			withTokens(100, 50, 150, 0.01), withGroups("grp-eng")),
+		accessLogRow("a2", "sess-a", baseTime.Add(1*time.Minute),
+			withProvider("anthropic", "prov-anthropic"), withModel("claude-haiku-4-5"),
+			withTokens(200, 80, 280, 0.02), withGroups("grp-eng", "grp-ops")),
+		accessLogRow("a3", "sess-a", baseTime.Add(2*time.Minute),
+			withProvider("openai", "prov-openai"), withModel("gpt-5.4"),
+			withTokens(10, 5, 15, 0.001), withDeny("llm_policy.token_cap_exceeded")),
+		// sess-b: a single allow entry.
+		accessLogRow("b1", "sess-b", baseTime.Add(30*time.Minute),
+			withTokens(1, 2, 3, 0.5)),
+	)
+
+	sessions, total, err := s.GetAgentNetworkAccessLogSessions(ctx, store.LockingStrengthNone, testAccountID, types.AgentNetworkAccessLogFilter{})
+	require.NoError(t, err)
+	require.Equal(t, int64(2), total, "two distinct sessions")
+	require.Len(t, sessions, 2)
+
+	// Default sort is last-activity DESC, so sess-b (12:30) precedes sess-a (12:02).
+	require.Equal(t, []string{"sess-b", "sess-a"}, sessionIDs(sessions))
+
+	a := sessions[1]
+	assert.Equal(t, "sess-a", a.SessionID)
+	assert.Equal(t, 3, a.RequestCount, "three requests folded")
+	assert.Equal(t, int64(310), a.InputTokens, "input tokens summed")
+	assert.Equal(t, int64(135), a.OutputTokens, "output tokens summed")
+	assert.Equal(t, int64(445), a.TotalTokens, "total tokens summed")
+	assert.InDelta(t, 0.031, a.CostUSD, 1e-9, "cost summed")
+	assert.Equal(t, "deny", a.Decision, "any deny makes the session a deny")
+	assert.ElementsMatch(t, []string{"openai", "anthropic"}, a.Providers, "distinct providers")
+	assert.ElementsMatch(t, []string{"gpt-5.4", "claude-haiku-4-5"}, a.Models, "distinct models")
+	assert.ElementsMatch(t, []string{"grp-eng", "grp-ops"}, a.GroupIDs, "union of authorising groups")
+	assert.Equal(t, baseTime, a.StartedAt.UTC(), "started at is the earliest entry")
+	assert.Equal(t, baseTime.Add(2*time.Minute), a.EndedAt.UTC(), "ended at is the latest entry")
+	assert.Len(t, a.Entries, 3, "entries carried through")
+
+	b := sessions[0]
+	assert.Equal(t, "sess-b", b.SessionID)
+	assert.Equal(t, 1, b.RequestCount)
+	assert.Equal(t, "allow", b.Decision)
+}
+
+// TestAccessLogSessions_SessionlessRowsAreSingletons verifies that entries with
+// no session id each form their own singleton session keyed by the row id.
+func TestAccessLogSessions_SessionlessRowsAreSingletons(t *testing.T) {
+	ctx := context.Background()
+	s := newSessionsTestStore(t)
+
+	seedAccessLogs(t, s,
+		accessLogRow("solo-1", "", baseTime),
+		accessLogRow("solo-2", "", baseTime.Add(time.Minute)),
+		// A real session with two entries, to prove they don't merge with the singletons.
+		accessLogRow("g1", "sess-x", baseTime.Add(2*time.Minute)),
+		accessLogRow("g2", "sess-x", baseTime.Add(3*time.Minute)),
+	)
+
+	sessions, total, err := s.GetAgentNetworkAccessLogSessions(ctx, store.LockingStrengthNone, testAccountID, types.AgentNetworkAccessLogFilter{})
+	require.NoError(t, err)
+	require.Equal(t, int64(3), total, "two singletons + one grouped session")
+	require.Len(t, sessions, 3)
+
+	for _, sess := range sessions {
+		if sess.SessionID == "sess-x" {
+			assert.Equal(t, 2, sess.RequestCount, "grouped session folds both entries")
+		} else {
+			assert.Empty(t, sess.SessionID, "singleton carries no session id")
+			assert.Equal(t, 1, sess.RequestCount, "singleton has exactly one request")
+		}
+	}
+}
+
+// TestAccessLogSessions_Pagination verifies that paging returns the correct
+// slice of sessions in stable order, with a stable total across pages and no
+// overlap between pages.
+func TestAccessLogSessions_Pagination(t *testing.T) {
+	ctx := context.Background()
+	s := newSessionsTestStore(t)
+
+	// Five sessions, each a single entry, with increasing timestamps so the
+	// default MAX(timestamp) DESC order is sess-5, sess-4, sess-3, sess-2, sess-1.
+	rows := make([]*types.AgentNetworkAccessLog, 0, 5)
+	for i := 1; i <= 5; i++ {
+		rows = append(rows, accessLogRow(
+			"row-"+itoa(i), "sess-"+itoa(i), baseTime.Add(time.Duration(i)*time.Minute)))
+	}
+	seedAccessLogs(t, s, rows...)
+
+	page := func(p int) []*types.AgentNetworkAccessLogSession {
+		sessions, total, err := s.GetAgentNetworkAccessLogSessions(ctx, store.LockingStrengthNone, testAccountID,
+			types.AgentNetworkAccessLogFilter{Page: p, PageSize: 2})
+		require.NoError(t, err)
+		require.Equal(t, int64(5), total, "total session count is stable across pages")
+		return sessions
+	}
+
+	assert.Equal(t, []string{"sess-5", "sess-4"}, sessionIDs(page(1)), "page 1: two newest")
+	assert.Equal(t, []string{"sess-3", "sess-2"}, sessionIDs(page(2)), "page 2: next two")
+	assert.Equal(t, []string{"sess-1"}, sessionIDs(page(3)), "page 3: remaining one")
+	assert.Empty(t, page(4), "page 4: past the end is empty")
+}
+
+// TestAccessLogSessions_Filtering verifies each filter is applied before
+// grouping, so the session set (and total) reflect only matching entries.
+func TestAccessLogSessions_Filtering(t *testing.T) {
+	ctx := context.Background()
+	s := newSessionsTestStore(t)
+
+	seedAccessLogs(t, s,
+		accessLogRow("r1", "sess-1", baseTime.Add(1*time.Minute),
+			withUser("alice"), withProvider("openai", "prov-openai"), withModel("gpt-5.4")),
+		accessLogRow("r2", "sess-2", baseTime.Add(2*time.Minute),
+			withUser("bob"), withProvider("anthropic", "prov-anthropic"), withModel("claude-haiku-4-5"),
+			withDeny("llm_policy.no_authorized_provider"), withGroups("grp-ops")),
+		accessLogRow("r3", "sess-3", baseTime.Add(3*time.Minute),
+			withUser("alice"), withProvider("openai", "prov-openai"), withModel("gpt-5.4"),
+			withGroups("grp-eng")),
+	)
+
+	filterCases := []struct {
+		name    string
+		filter  types.AgentNetworkAccessLogFilter
+		wantIDs []string
+		wantTot int64
+	}{
+		{
+			name:    "by session id",
+			filter:  types.AgentNetworkAccessLogFilter{SessionID: strp("sess-2")},
+			wantIDs: []string{"sess-2"},
+			wantTot: 1,
+		},
+		{
+			name:    "by user id",
+			filter:  types.AgentNetworkAccessLogFilter{UserID: strp("alice")},
+			wantIDs: []string{"sess-3", "sess-1"}, // last-activity DESC
+			wantTot: 2,
+		},
+		{
+			name:    "by model",
+			filter:  types.AgentNetworkAccessLogFilter{Models: []string{"claude-haiku-4-5"}},
+			wantIDs: []string{"sess-2"},
+			wantTot: 1,
+		},
+		{
+			name:    "by resolved provider id",
+			filter:  types.AgentNetworkAccessLogFilter{ProviderIDs: []string{"prov-openai"}},
+			wantIDs: []string{"sess-3", "sess-1"},
+			wantTot: 2,
+		},
+		{
+			name:    "by decision deny",
+			filter:  types.AgentNetworkAccessLogFilter{Decision: strp("deny")},
+			wantIDs: []string{"sess-2"},
+			wantTot: 1,
+		},
+		{
+			name:    "by authorising group",
+			filter:  types.AgentNetworkAccessLogFilter{GroupIDs: []string{"grp-eng"}},
+			wantIDs: []string{"sess-3"},
+			wantTot: 1,
+		},
+		{
+			name: "by date range excludes earlier",
+			filter: types.AgentNetworkAccessLogFilter{
+				StartDate: tp(baseTime.Add(90 * time.Second)), // after r1 (12:01), before r2 (12:02)
+			},
+			wantIDs: []string{"sess-3", "sess-2"},
+			wantTot: 2,
+		},
+	}
+
+	for _, tc := range filterCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			sessions, total, err := s.GetAgentNetworkAccessLogSessions(ctx, store.LockingStrengthNone, testAccountID, tc.filter)
+			require.NoError(t, err)
+			assert.Equal(t, tc.wantTot, total, "filtered total")
+			assert.Equal(t, tc.wantIDs, sessionIDs(sessions), "filtered session ids in order")
+		})
+	}
+}
+
+// TestAccessLogSessions_SortByCost verifies session-level aggregate sorting:
+// ordering by summed cost, ascending and descending.
+func TestAccessLogSessions_SortByCost(t *testing.T) {
+	ctx := context.Background()
+	s := newSessionsTestStore(t)
+
+	// cheap: 0.01 total; mid: 0.05 total; pricey: 0.20 total (two entries).
+	seedAccessLogs(t, s,
+		accessLogRow("c1", "cheap", baseTime.Add(1*time.Minute), withTokens(1, 1, 2, 0.01)),
+		accessLogRow("m1", "mid", baseTime.Add(2*time.Minute), withTokens(1, 1, 2, 0.05)),
+		accessLogRow("p1", "pricey", baseTime.Add(3*time.Minute), withTokens(1, 1, 2, 0.15)),
+		accessLogRow("p2", "pricey", baseTime.Add(4*time.Minute), withTokens(1, 1, 2, 0.05)),
+	)
+
+	desc, total, err := s.GetAgentNetworkAccessLogSessions(ctx, store.LockingStrengthNone, testAccountID,
+		types.AgentNetworkAccessLogFilter{SortBy: "cost_usd", SortOrder: "desc"})
+	require.NoError(t, err)
+	require.Equal(t, int64(3), total)
+	assert.Equal(t, []string{"pricey", "mid", "cheap"}, sessionIDs(desc), "descending by summed cost")
+
+	asc, _, err := s.GetAgentNetworkAccessLogSessions(ctx, store.LockingStrengthNone, testAccountID,
+		types.AgentNetworkAccessLogFilter{SortBy: "cost_usd", SortOrder: "asc"})
+	require.NoError(t, err)
+	assert.Equal(t, []string{"cheap", "mid", "pricey"}, sessionIDs(asc), "ascending by summed cost")
+}
+
+// strp / tp / itoa are tiny local helpers to keep the filter table terse.
+func strp(s string) *string { return &s }
+
+func tp(t time.Time) *time.Time { return &t }
+
+func itoa(i int) string { return string(rune('0' + i)) }
diff --git a/management/internals/modules/agentnetwork/affectedpeers_hook.go b/management/internals/modules/agentnetwork/affectedpeers_hook.go
new file mode 100644
index 000000000..58347666d
--- /dev/null
+++ b/management/internals/modules/agentnetwork/affectedpeers_hook.go
@@ -0,0 +1,15 @@
+package agentnetwork
+
+import "github.com/netbirdio/netbird/management/server/affectedpeers"
+
+// init registers the agent-network service synthesiser with the affectedpeers
+// resolver. Agent-network reverse-proxy services are synthesised on demand and
+// never persisted, so the resolver can't load them from the store; without them
+// it can't fold the embedded proxy peer into the affected set on a client
+// group/peer change, and the proxy never learns a newly authorised client until
+// it reconnects. Registered here (rather than via a direct
+// affectedpeers→agentnetwork import) to avoid an import cycle
+// (agentnetwork → account → affectedpeers).
+func init() {
+	affectedpeers.SetAgentNetworkSynthesizer(SynthesizeServices)
+}
diff --git a/management/internals/modules/agentnetwork/catalog/catalog.go b/management/internals/modules/agentnetwork/catalog/catalog.go
new file mode 100644
index 000000000..baf622778
--- /dev/null
+++ b/management/internals/modules/agentnetwork/catalog/catalog.go
@@ -0,0 +1,749 @@
+// Package catalog defines the static set of Agent Network providers
+// recognized by the management server. The catalog is consulted both to
+// validate provider_id on create/update and to surface the available
+// providers (and their models) to the dashboard.
+package catalog
+
+import "github.com/netbirdio/netbird/shared/management/http/api"
+
+// Model is the in-memory representation of a catalog model.
+type Model struct {
+	ID            string
+	Label         string
+	InputPer1k    float64
+	OutputPer1k   float64
+	ContextWindow int
+}
+
+// ProviderKind groups catalog entries for UI presentation. The split
+// is semantic, not technical:
+//   - KindProvider: the upstream is a vendor's first-party API (OpenAI,
+//     Anthropic, Mistral, Bedrock, etc.) — NetBird talks straight to
+//     the model provider.
+//   - KindGateway: the upstream is itself a routing / aggregation layer
+//     in front of multiple providers (LiteLLM, Portkey, Helicone, …).
+//     These typically need NetBird identity stamped onto upstream
+//     requests so the gateway's analytics and budgets attribute to the
+//     real caller; that's what IdentityInjection is for.
+//   - KindCustom: the catch-all "OpenAI-compatible self-hosted endpoint"
+//     entry (vLLM, Ollama, custom inference servers).
+//
+// Frontend uses Kind to group the provider Select in the modal so an
+// operator can spot at a glance which catalog entries proxy other
+// providers vs. talk straight to one. Backend doesn't dispatch on Kind
+// today; it's purely a presentation hint.
+type ProviderKind string
+
+const (
+	KindProvider ProviderKind = "provider"
+	KindGateway  ProviderKind = "gateway"
+	KindCustom   ProviderKind = "custom"
+)
+
+// Provider is the in-memory representation of a catalog provider.
+type Provider struct {
+	ID          string
+	Name        string
+	Description string
+	DefaultHost string
+	// Kind groups this entry for UI presentation; see ProviderKind.
+	Kind ProviderKind
+	// AuthHeaderName is the HTTP header the provider's API expects
+	// the credential under (e.g. "Authorization" for OpenAI,
+	// "x-api-key" for Anthropic). Combined with AuthHeaderTemplate
+	// at synthesis time to inject the auth header on every upstream
+	// request.
+	AuthHeaderName     string
+	AuthHeaderTemplate string
+	DefaultContentType string
+	BrandColor         string
+	// ParserID names the proxy LLM parser surface this provider
+	// speaks (matches llm.Parser.ProviderName: "openai",
+	// "anthropic"). Multiple catalog ids may share a parser surface
+	// (e.g. azure_openai_api and mistral_api both speak the OpenAI
+	// shape). Empty when no parser is yet implemented for the
+	// surface — the proxy middleware then falls back to URL sniffing
+	// or skips request-side enrichment.
+	ParserID string
+	// IdentityInjection, when non-nil, instructs the proxy to stamp
+	// the caller's NetBird identity onto upstream requests under the
+	// configured header names. Used for gateways like LiteLLM that
+	// key budgets and attribution off request headers (the gateway
+	// otherwise has no way to learn which user / group made the call).
+	// The proxy strips the same header names from the inbound request
+	// before stamping ours, so an app can't spoof identity by setting
+	// these headers itself.
+	IdentityInjection *IdentityInjection
+	// ExtraHeaders is a catalog-declared list of additional per-
+	// provider routing/config headers the proxy stamps on every
+	// upstream request. Distinct from AuthHeaderName/Template (which
+	// always carries the API_KEY) and from IdentityInjection (caller
+	// identity). Each entry surfaces an optional input on the
+	// dashboard's provider modal whose value lives on the provider
+	// record's ExtraValues map (keyed by ExtraHeader.Name). Empty
+	// list = no extra inputs rendered. Used today by Portkey for
+	// "x-portkey-config: pc-..." (a saved-config id that resolves
+	// upstream provider + credentials on Portkey's hosted side).
+	ExtraHeaders []ExtraHeader
+	Models       []Model
+}
+
+// ExtraHeader names a single optional per-provider routing/config
+// header. Catalog declares N of these per provider type; the operator
+// fills any subset on the provider record (see Provider.ExtraValues).
+// At synth time, only entries with a non-empty operator value are
+// stamped; the proxy's identity-inject middleware applies anti-spoof
+// (Remove + Add) so a client can't supply these headers themselves.
+//
+// UI copy (label / help text / tooltip) for each known Name lives on
+// the dashboard, not here — the backend's job is just to declare
+// which wire headers are accepted. New provider needs an extra
+// header? Add the Name here AND the matching UI copy on the dashboard.
+type ExtraHeader struct {
+	// Name is the wire header name, e.g. "x-portkey-config".
+	Name string
+}
+
+// IdentityInjection describes how the proxy stamps NetBird identity onto
+// upstream gateway requests. Exactly one shape must be set — they're
+// mutually exclusive and dispatched by the inject middleware.
+//
+// Shape choice tracks the wire convention the upstream gateway uses,
+// not the vendor name. New gateways with a known shape become a catalog
+// entry, not a new code path.
+type IdentityInjection struct {
+	// HeaderPair emits separate headers per identity dimension
+	// (end-user id, tags as CSV). LiteLLM and OpenAI-compatible
+	// self-hosted gateways that read identity from dedicated headers.
+	HeaderPair *HeaderPairInjection
+	// JSONMetadata emits a single header carrying a JSON object with
+	// reserved keys for user / groups / etc. Portkey, Helicone-style
+	// metadata headers, anything that wants a structured envelope.
+	JSONMetadata *JSONMetadataInjection
+}
+
+// HeaderPairInjection is the LiteLLM-style wire convention.
+type HeaderPairInjection struct {
+	// Customizable, when true, marks the wire header names as
+	// operator-overridable: the dashboard surfaces EndUserIDHeader
+	// and TagsHeader as editable inputs (defaults shown as
+	// placeholders) and the synthesizer pulls the actual values from
+	// the provider record's IdentityHeader* fields rather than from
+	// these defaults. An empty operator value disables stamping for
+	// that dimension. Used today for Bifrost, whose log-metadata /
+	// telemetry header prefix (x-bf-lh-* vs x-bf-dim-*) is a
+	// per-operator choice; LiteLLM and similar gateways with a fixed
+	// wire protocol leave this false so the catalog defaults are
+	// authoritative.
+	Customizable bool
+	// EndUserIDHeader receives the caller's display identity (user
+	// email when the peer is attached to a user, else peer.Name),
+	// e.g. "x-litellm-end-user-id".
+	EndUserIDHeader string
+	// TagsHeader receives the caller's NetBird group display names
+	// as a CSV, e.g. "x-litellm-tags".
+	TagsHeader string
+	// TagsInBody, when true, additionally writes the tag list into
+	// the request body's metadata.tags array (a JSON path the
+	// gateway parses for budget enforcement). LiteLLM only honours
+	// metadata.tags for tag-budget gating — its x-litellm-tags
+	// header path feeds spend tracking but bypasses
+	// _tag_max_budget_check entirely. Body inject is skipped when
+	// the request body is empty, truncated, non-JSON, or when an
+	// existing metadata field is a non-object value (defensive: we
+	// never clobber a client-supplied non-object). The header path
+	// remains a robust fallback for spend tracking in those cases.
+	TagsInBody bool
+	// EndUserIDInBody, when true, additionally writes the display
+	// identity into the request body's top-level "user" field (the
+	// OpenAI-standard end-user identifier). LiteLLM resolves the end
+	// user id from headers first then body, so for LiteLLM this is
+	// belt-and-suspenders. It matters when an OpenAI-compatible
+	// gateway downstream of LiteLLM (or OpenAI direct, bypassing
+	// LiteLLM) only reads the body, and as anti-spoof: client-
+	// supplied "user" values are overwritten with our trusted
+	// identity. Same skip rules as TagsInBody.
+	EndUserIDInBody bool
+}
+
+// JSONMetadataInjection is the Portkey-style wire convention: a single
+// header carrying a JSON object. NetBird identity fields land under the
+// configured reserved keys; missing keys (empty string) are skipped at
+// emit time.
+type JSONMetadataInjection struct {
+	// Customizable, when true, marks the JSON keys as operator-
+	// overridable. The dashboard surfaces UserKey and GroupsKey as
+	// editable inputs (the catalog values shown as placeholders) and
+	// the synthesizer pulls the actual JSON-key names from the
+	// provider record's IdentityHeader* fields. Same field reuse as
+	// HeaderPair's customizable path — the dimensions (user identity,
+	// groups) are the same, only the wire encoding differs (JSON key
+	// vs HTTP header name). An empty operator value disables emission
+	// for that dimension. Used today for Cloudflare AI Gateway, whose
+	// cf-aig-metadata header accepts arbitrary JSON keys; Portkey
+	// leaves this false because its keys are reserved by the Portkey
+	// schema.
+	Customizable bool
+	// Header is the wire header name carrying the JSON payload, e.g.
+	// "x-portkey-metadata".
+	Header string
+	// UserKey is the JSON key for the caller's display identity.
+	// Portkey reserves "_user" for this dimension.
+	UserKey string
+	// GroupsKey is the JSON key for the caller's NetBird groups,
+	// emitted as a CSV string value (Portkey requires string values).
+	GroupsKey string
+	// MaxValueLength caps each emitted JSON value, in bytes. Portkey
+	// enforces a 128-char limit per value; oversized values are
+	// truncated rather than failing the request. 0 disables the cap.
+	MaxValueLength int
+}
+
+// providers is the canonical list of supported Agent Network providers.
+// Update this list together with the dashboard's PROVIDER_CATALOG.
+var providers = []Provider{
+	{
+		ID:                 "openai_api",
+		Kind:               KindProvider,
+		Name:               "OpenAI API",
+		Description:        "GPT, Responses API, and Embeddings",
+		DefaultHost:        "api.openai.com",
+		AuthHeaderName:     "Authorization",
+		AuthHeaderTemplate: "Bearer ${API_KEY}",
+		DefaultContentType: "application/json",
+		BrandColor:         "#10A37F",
+		ParserID:           "openai",
+		// Pricing + context windows cross-checked against LiteLLM's
+		// model_prices_and_context_window.json. Notable corrections from
+		// earlier values: o4-mini repriced from $4/$16 to $1.10/$4.40
+		// per MTok, gpt-4o from $5/$15 to $2.50/$10, and the GPT-5
+		// family context windows split between 1.05M for full-size
+		// models and 272K for mini/nano/codex variants.
+		Models: []Model{
+			{ID: "gpt-5.5", Label: "GPT-5.5", InputPer1k: 0.005, OutputPer1k: 0.030, ContextWindow: 1050000},
+			{ID: "gpt-5.5-pro", Label: "GPT-5.5 Pro", InputPer1k: 0.030, OutputPer1k: 0.180, ContextWindow: 1050000},
+			{ID: "gpt-5.4", Label: "GPT-5.4", InputPer1k: 0.0025, OutputPer1k: 0.015, ContextWindow: 1050000},
+			{ID: "gpt-5.4-pro", Label: "GPT-5.4 Pro", InputPer1k: 0.030, OutputPer1k: 0.180, ContextWindow: 1050000},
+			{ID: "gpt-5.4-mini", Label: "GPT-5.4 Mini", InputPer1k: 0.00075, OutputPer1k: 0.0045, ContextWindow: 272000},
+			{ID: "gpt-5.4-nano", Label: "GPT-5.4 Nano", InputPer1k: 0.0002, OutputPer1k: 0.00125, ContextWindow: 272000},
+			{ID: "gpt-5.3-codex", Label: "GPT-5.3 Codex", InputPer1k: 0.00175, OutputPer1k: 0.014, ContextWindow: 272000},
+			{ID: "gpt-5.3-chat-latest", Label: "GPT-5.3 Chat", InputPer1k: 0.00175, OutputPer1k: 0.014, ContextWindow: 128000},
+			{ID: "o4-mini", Label: "o4-mini", InputPer1k: 0.0011, OutputPer1k: 0.0044, ContextWindow: 200000},
+			{ID: "gpt-4.1", Label: "GPT-4.1", InputPer1k: 0.002, OutputPer1k: 0.008, ContextWindow: 1047576},
+			{ID: "gpt-4.1-mini", Label: "GPT-4.1 mini", InputPer1k: 0.0004, OutputPer1k: 0.0016, ContextWindow: 1047576},
+			{ID: "gpt-4.1-nano", Label: "GPT-4.1 nano", InputPer1k: 0.0001, OutputPer1k: 0.0004, ContextWindow: 1047576},
+			{ID: "gpt-4o", Label: "GPT-4o", InputPer1k: 0.0025, OutputPer1k: 0.010, ContextWindow: 128000},
+			{ID: "gpt-4o-mini", Label: "GPT-4o mini", InputPer1k: 0.00015, OutputPer1k: 0.0006, ContextWindow: 128000},
+			{ID: "gpt-4-turbo", Label: "GPT-4 Turbo", InputPer1k: 0.01, OutputPer1k: 0.03, ContextWindow: 128000},
+			{ID: "gpt-3.5-turbo", Label: "GPT-3.5 Turbo", InputPer1k: 0.0005, OutputPer1k: 0.0015, ContextWindow: 16385},
+			{ID: "text-embedding-3-large", Label: "text-embedding-3-large", InputPer1k: 0.00013, OutputPer1k: 0, ContextWindow: 8191},
+			{ID: "text-embedding-3-small", Label: "text-embedding-3-small", InputPer1k: 0.00002, OutputPer1k: 0, ContextWindow: 8191},
+		},
+	},
+	{
+		ID:                 "anthropic_api",
+		Kind:               KindProvider,
+		Name:               "Anthropic API",
+		Description:        "Claude Messages API",
+		DefaultHost:        "api.anthropic.com",
+		AuthHeaderName:     "x-api-key",
+		AuthHeaderTemplate: "${API_KEY}",
+		DefaultContentType: "application/json",
+		BrandColor:         "#D97757",
+		ParserID:           "anthropic",
+		// Per Anthropic's current model lineup. Pricing in USD per 1k
+		// tokens. Context windows: 4.6+ family is 1M; Haiku 4.5 stays at
+		// 200K. claude-3-7-sonnet and claude-3-5-haiku retired
+		// 2026-02-19 — dropped from the catalog. claude-opus-4-1
+		// deprecated, retires 2026-08-05 — kept until the cutover.
+		// claude-mythos-5 omitted: Project Glasswing access only, not a
+		// general-availability target. claude-fable-5 requires the
+		// account to be on >= 30-day data retention or all requests
+		// 400.
+		Models: []Model{
+			{ID: "claude-fable-5", Label: "Claude Fable 5", InputPer1k: 0.010, OutputPer1k: 0.050, ContextWindow: 1000000},
+			{ID: "claude-opus-4-8", Label: "Claude Opus 4.8", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
+			{ID: "claude-opus-4-7", Label: "Claude Opus 4.7", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
+			{ID: "claude-opus-4-6", Label: "Claude Opus 4.6", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
+			{ID: "claude-opus-4-1", Label: "Claude Opus 4.1 (deprecated, retires 2026-08-05)", InputPer1k: 0.015, OutputPer1k: 0.075, ContextWindow: 200000},
+			{ID: "claude-sonnet-4-6", Label: "Claude Sonnet 4.6", InputPer1k: 0.003, OutputPer1k: 0.015, ContextWindow: 1000000},
+			{ID: "claude-sonnet-4-5", Label: "Claude Sonnet 4.5", InputPer1k: 0.003, OutputPer1k: 0.015, ContextWindow: 200000},
+			{ID: "claude-haiku-4-5", Label: "Claude Haiku 4.5", InputPer1k: 0.001, OutputPer1k: 0.005, ContextWindow: 200000},
+		},
+	},
+	{
+		ID:                 "azure_openai_api",
+		Kind:               KindProvider,
+		Name:               "Azure OpenAI API",
+		Description:        "Azure-hosted OpenAI deployments",
+		DefaultHost:        "<resource>.openai.azure.com",
+		AuthHeaderName:     "api-key",
+		AuthHeaderTemplate: "${API_KEY}",
+		DefaultContentType: "application/json",
+		BrandColor:         "#0078D4",
+		ParserID:           "openai",
+		// Mirrors openai_api pricing — Azure resells OpenAI models at the
+		// same per-token rates, just under different deployment names.
+		Models: []Model{
+			{ID: "gpt-5.5", Label: "GPT-5.5 (Azure)", InputPer1k: 0.005, OutputPer1k: 0.030, ContextWindow: 1050000},
+			{ID: "gpt-5.4", Label: "GPT-5.4 (Azure)", InputPer1k: 0.0025, OutputPer1k: 0.015, ContextWindow: 1050000},
+			{ID: "gpt-5.4-mini", Label: "GPT-5.4 Mini (Azure)", InputPer1k: 0.00075, OutputPer1k: 0.0045, ContextWindow: 272000},
+			{ID: "gpt-5.4-nano", Label: "GPT-5.4 Nano (Azure)", InputPer1k: 0.0002, OutputPer1k: 0.00125, ContextWindow: 272000},
+			{ID: "o4-mini", Label: "o4-mini (Azure)", InputPer1k: 0.0011, OutputPer1k: 0.0044, ContextWindow: 200000},
+			{ID: "gpt-4.1", Label: "GPT-4.1 (Azure)", InputPer1k: 0.002, OutputPer1k: 0.008, ContextWindow: 1047576},
+			{ID: "gpt-4.1-mini", Label: "GPT-4.1 mini (Azure)", InputPer1k: 0.0004, OutputPer1k: 0.0016, ContextWindow: 1047576},
+			{ID: "gpt-4o", Label: "GPT-4o (Azure)", InputPer1k: 0.0025, OutputPer1k: 0.010, ContextWindow: 128000},
+			{ID: "gpt-4o-mini", Label: "GPT-4o mini (Azure)", InputPer1k: 0.00015, OutputPer1k: 0.0006, ContextWindow: 128000},
+			{ID: "gpt-35-turbo", Label: "GPT-3.5 Turbo (Azure)", InputPer1k: 0.0005, OutputPer1k: 0.0015, ContextWindow: 16385},
+		},
+	},
+	{
+		ID:                 "bedrock_api",
+		Kind:               KindProvider,
+		Name:               "AWS Bedrock API",
+		Description:        "Anthropic, Meta, Cohere via Bedrock",
+		DefaultHost:        "bedrock-runtime.<region>.amazonaws.com",
+		AuthHeaderName:     "Authorization",
+		AuthHeaderTemplate: "Bearer ${API_KEY}",
+		DefaultContentType: "application/json",
+		BrandColor:         "#FF9900",
+		// Anthropic models on Bedrock take the anthropic.* prefix and
+		// follow the same lineup / pricing as the first-party Anthropic
+		// catalog entry above. claude-3-7-sonnet and claude-3-5-haiku
+		// were retired upstream on 2026-02-19 — dropped from the
+		// Bedrock list too. Amazon Nova entries cross-checked against
+		// LiteLLM (added Nova Micro + the new Nova 2 Lite preview).
+		// Llama 3.3 70B entry kept unchanged — LiteLLM tracks only
+		// per-region Llama 3 entries; standalone 3.3 not yet listed.
+		Models: []Model{
+			{ID: "anthropic.claude-opus-4-8", Label: "Claude Opus 4.8 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
+			{ID: "anthropic.claude-opus-4-7", Label: "Claude Opus 4.7 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
+			{ID: "anthropic.claude-opus-4-6", Label: "Claude Opus 4.6 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
+			{ID: "anthropic.claude-opus-4-1", Label: "Claude Opus 4.1 (Bedrock, deprecated 2026-08-05)", InputPer1k: 0.015, OutputPer1k: 0.075, ContextWindow: 200000},
+			{ID: "anthropic.claude-sonnet-4-6", Label: "Claude Sonnet 4.6 (Bedrock)", InputPer1k: 0.003, OutputPer1k: 0.015, ContextWindow: 1000000},
+			{ID: "anthropic.claude-sonnet-4-5", Label: "Claude Sonnet 4.5 (Bedrock)", InputPer1k: 0.003, OutputPer1k: 0.015, ContextWindow: 200000},
+			{ID: "anthropic.claude-haiku-4-5", Label: "Claude Haiku 4.5 (Bedrock)", InputPer1k: 0.001, OutputPer1k: 0.005, ContextWindow: 200000},
+			{ID: "meta.llama3-3-70b-instruct", Label: "Llama 3.3 70B (Bedrock)", InputPer1k: 0.00072, OutputPer1k: 0.00072, ContextWindow: 128000},
+			{ID: "amazon.nova-2-lite", Label: "Amazon Nova 2 Lite (Bedrock, preview)", InputPer1k: 0.0003, OutputPer1k: 0.0025, ContextWindow: 1000000},
+			{ID: "amazon.nova-pro", Label: "Amazon Nova Pro (Bedrock)", InputPer1k: 0.0008, OutputPer1k: 0.0032, ContextWindow: 300000},
+			{ID: "amazon.nova-lite", Label: "Amazon Nova Lite (Bedrock)", InputPer1k: 0.00006, OutputPer1k: 0.00024, ContextWindow: 300000},
+			{ID: "amazon.nova-micro", Label: "Amazon Nova Micro (Bedrock)", InputPer1k: 0.000035, OutputPer1k: 0.00014, ContextWindow: 128000},
+		},
+	},
+	{
+		ID:                 "vertex_ai_api",
+		Kind:               KindProvider,
+		Name:               "Google Vertex AI API",
+		Description:        "Anthropic Claude models hosted on Vertex AI",
+		DefaultHost:        "<region>-aiplatform.googleapis.com",
+		AuthHeaderName:     "Authorization",
+		AuthHeaderTemplate: "Bearer ${API_KEY}",
+		DefaultContentType: "application/json",
+		BrandColor:         "#4285F4",
+		// Vertex carries the model in the URL path and authenticates with a
+		// service-account-minted OAuth token (api_key = "keyfile::<base64 SA>").
+		// Only Anthropic-on-Vertex is metered today: the request parser maps the
+		// anthropic publisher to the Anthropic parser, so the lineup + prices
+		// mirror the first-party Anthropic catalog (LiteLLM vertex_ai/claude-*
+		// confirms the same per-token rates; cross-region profiles in eu/apac
+		// carry a ~10% premium that base pricing does not model). Gemini (the
+		// google publisher) is intentionally omitted until a Gemini parser
+		// exists — the router denies unmeterable publishers rather than forward
+		// them uncounted.
+		Models: []Model{
+			{ID: "claude-fable-5", Label: "Claude Fable 5 (Vertex)", InputPer1k: 0.010, OutputPer1k: 0.050, ContextWindow: 1000000},
+			{ID: "claude-opus-4-8", Label: "Claude Opus 4.8 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
+			{ID: "claude-opus-4-7", Label: "Claude Opus 4.7 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
+			{ID: "claude-opus-4-6", Label: "Claude Opus 4.6 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
+			{ID: "claude-opus-4-1", Label: "Claude Opus 4.1 (Vertex, deprecated 2026-08-05)", InputPer1k: 0.015, OutputPer1k: 0.075, ContextWindow: 200000},
+			{ID: "claude-sonnet-4-6", Label: "Claude Sonnet 4.6 (Vertex)", InputPer1k: 0.003, OutputPer1k: 0.015, ContextWindow: 1000000},
+			{ID: "claude-sonnet-4-5", Label: "Claude Sonnet 4.5 (Vertex)", InputPer1k: 0.003, OutputPer1k: 0.015, ContextWindow: 200000},
+			{ID: "claude-haiku-4-5", Label: "Claude Haiku 4.5 (Vertex)", InputPer1k: 0.001, OutputPer1k: 0.005, ContextWindow: 200000},
+		},
+	},
+	{
+		ID:                 "mistral_api",
+		Kind:               KindProvider,
+		Name:               "Mistral API",
+		Description:        "Mistral cloud API",
+		DefaultHost:        "api.mistral.ai",
+		AuthHeaderName:     "Authorization",
+		AuthHeaderTemplate: "Bearer ${API_KEY}",
+		DefaultContentType: "application/json",
+		BrandColor:         "#FF7000",
+		ParserID:           "openai",
+		// Pricing + context windows cross-checked against LiteLLM. Key
+		// gotchas the marketing page hides:
+		//   - `mistral-medium-latest` aliases to Medium 3.1 ($0.40/$2),
+		//     NOT Medium 3.5 ($1.50/$7.50). Catalog exposes both.
+		//   - `mistral-large-latest` aliases to Large 3 — 262K context,
+		//     cheaper than Medium 3.5.
+		//   - Magistral models are tuned for reasoning but cap context
+		//     at only 40K (vs 128K-262K elsewhere).
+		//   - `codestral-latest` still routes to the old 2405 build
+		//     ($1/$3) per LiteLLM; the newer codestral-2508 is both
+		//     cheaper and longer-context. Both exposed.
+		//   - Pixtral was folded into the main Large/Medium series; no
+		//     standalone vision entry.
+		Models: []Model{
+			{ID: "mistral-large-latest", Label: "Mistral Large 3", InputPer1k: 0.0005, OutputPer1k: 0.0015, ContextWindow: 262144},
+			{ID: "mistral-medium-latest", Label: "Mistral Medium 3.1", InputPer1k: 0.0004, OutputPer1k: 0.002, ContextWindow: 131072},
+			{ID: "mistral-medium-3-5", Label: "Mistral Medium 3.5", InputPer1k: 0.0015, OutputPer1k: 0.0075, ContextWindow: 262144},
+			{ID: "mistral-small-latest", Label: "Mistral Small 3.2", InputPer1k: 0.00006, OutputPer1k: 0.00018, ContextWindow: 131072},
+			{ID: "magistral-medium-latest", Label: "Magistral Medium (reasoning)", InputPer1k: 0.002, OutputPer1k: 0.005, ContextWindow: 40000},
+			{ID: "magistral-small-latest", Label: "Magistral Small (reasoning)", InputPer1k: 0.0005, OutputPer1k: 0.0015, ContextWindow: 40000},
+			{ID: "devstral-medium-latest", Label: "Devstral Medium 2 (coding)", InputPer1k: 0.0004, OutputPer1k: 0.002, ContextWindow: 256000},
+			{ID: "devstral-small-latest", Label: "Devstral Small 2 (coding)", InputPer1k: 0.0001, OutputPer1k: 0.0003, ContextWindow: 256000},
+			{ID: "codestral-2508", Label: "Codestral 2508", InputPer1k: 0.0003, OutputPer1k: 0.0009, ContextWindow: 256000},
+			{ID: "codestral-latest", Label: "Codestral (legacy 2405)", InputPer1k: 0.001, OutputPer1k: 0.003, ContextWindow: 32000},
+			{ID: "ministral-3-14b-2512", Label: "Ministral 3 14B", InputPer1k: 0.0002, OutputPer1k: 0.0002, ContextWindow: 262144},
+			{ID: "ministral-8b-latest", Label: "Ministral 8B", InputPer1k: 0.00015, OutputPer1k: 0.00015, ContextWindow: 262144},
+			{ID: "ministral-3-3b-2512", Label: "Ministral 3 3B", InputPer1k: 0.0001, OutputPer1k: 0.0001, ContextWindow: 131072},
+			{ID: "mistral-embed", Label: "Mistral Embed", InputPer1k: 0.0001, OutputPer1k: 0, ContextWindow: 8192},
+		},
+	},
+	{
+		ID:                 "litellm_proxy",
+		Kind:               KindGateway,
+		Name:               "LiteLLM Proxy",
+		Description:        "Bring your own LiteLLM proxy with NetBird identity stamped on every request",
+		DefaultHost:        "",
+		AuthHeaderName:     "Authorization",
+		AuthHeaderTemplate: "Bearer ${API_KEY}",
+		DefaultContentType: "application/json",
+		BrandColor:         "#0EA5E9",
+		ParserID:           "openai",
+		// IdentityInjection requires a LiteLLM virtual key minted with
+		// metadata.allow_client_tags=true; the master key silently drops
+		// caller tags. Tags go out via both the x-litellm-tags header and
+		// body metadata.tags: LiteLLM enforces budgets from the body only,
+		// so the header is the spend-tracking fallback when body injection
+		// can't run. See the Agent Network provider docs for key setup.
+		IdentityInjection: &IdentityInjection{
+			HeaderPair: &HeaderPairInjection{
+				EndUserIDHeader: "x-litellm-end-user-id",
+				TagsHeader:      "x-litellm-tags",
+				TagsInBody:      true,
+				EndUserIDInBody: true,
+			},
+		},
+		Models: []Model{},
+	},
+	{
+		ID:          "portkey",
+		Kind:        KindGateway,
+		Name:        "Portkey AI Gateway",
+		Description: "Portkey AI Gateway with NetBird identity stamped via x-portkey-metadata",
+		DefaultHost: "api.portkey.ai",
+		// Portkey hosted requires x-portkey-api-key (account key)
+		// plus a routing decision per request. The simplest routing
+		// path is a saved Portkey config id stamped via
+		// x-portkey-config — operators paste the pc-... id once and
+		// Portkey resolves the upstream provider + virtual key from
+		// it. ExtraHeaders below surfaces the input. Alternative:
+		// callers author "@org/model" in the body; both flows
+		// coexist (per-request authoring still works without a
+		// configured value).
+		AuthHeaderName:     "x-portkey-api-key",
+		AuthHeaderTemplate: "${API_KEY}",
+		DefaultContentType: "application/json",
+		BrandColor:         "#FF5C00",
+		ParserID:           "openai",
+		IdentityInjection: &IdentityInjection{
+			JSONMetadata: &JSONMetadataInjection{
+				Header:         "x-portkey-metadata",
+				UserKey:        "_user",
+				GroupsKey:      "groups",
+				MaxValueLength: 128,
+			},
+		},
+		ExtraHeaders: []ExtraHeader{
+			{Name: "x-portkey-config"},
+		},
+		Models: []Model{},
+	},
+	{
+		ID:                 "bifrost",
+		Kind:               KindGateway,
+		Name:               "Bifrost",
+		Description:        "Maxim AI's Bifrost gateway. Point upstream URL at /openai/v1 or /anthropic/v1 on your Bifrost host depending on which body shape your apps use.",
+		DefaultHost:        "",
+		AuthHeaderName:     "Authorization",
+		AuthHeaderTemplate: "Bearer ${API_KEY}",
+		DefaultContentType: "application/json",
+		BrandColor:         "#7C3AED",
+		// ParserID empty: the proxy's request parser sniffs the URL
+		// path. Bifrost's /openai/v1/... contains "/v1/chat/completions"
+		// (matches OpenAIParser.DetectFromURL); /anthropic/v1/messages
+		// contains "/v1/messages" (matches AnthropicParser). Operators
+		// who paste a different prefix get no usage parsing and the
+		// cost meter skips with skipMissingProvider — degraded but
+		// non-fatal.
+		ParserID: "",
+		// Identity-injection headers are operator-customisable. The
+		// HeaderPair values below are PLACEHOLDERS surfaced by the
+		// dashboard; the actual values stamped on the wire come from
+		// the provider record's IdentityHeaderUserID /
+		// IdentityHeaderGroups fields. An empty operator value
+		// disables stamping for that dimension (the inject middleware
+		// already no-ops on empty header names). Defaulting to the
+		// x-bf-dim- family so the values land in Bifrost's
+		// Prometheus/OTEL pipelines when the operator declares the
+		// label names in their client.prometheus_labels config — see
+		// docs.getbifrost.ai/features/telemetry. Operators who use
+		// the always-on x-bf-lh- log-metadata family (no Bifrost-side
+		// declaration required) just edit the inputs.
+		//
+		// Bifrost virtual keys (sk-bf-*) ride Authorization: Bearer.
+		// Operators provision the VK on their Bifrost (UI /
+		// config.json / POST /api/governance/virtual-keys) and paste
+		// the returned sk-bf-... as ${API_KEY}. Pin v1.4+ to avoid
+		// the v1.3.0 x-bf-vk regression (maximhq/bifrost#632).
+		IdentityInjection: &IdentityInjection{
+			HeaderPair: &HeaderPairInjection{
+				EndUserIDHeader: "x-bf-dim-netbird_user_id",
+				TagsHeader:      "x-bf-dim-netbird_groups",
+				Customizable:    true,
+			},
+		},
+		Models: []Model{},
+	},
+	{
+		ID:                 "cloudflare_ai_gateway",
+		Kind:               KindGateway,
+		Name:               "Cloudflare AI Gateway",
+		Description:        "Cloudflare AI Gateway. Operator pastes the gateway URL (with the upstream provider slug like /openai or /anthropic so the URL sniffer dispatches to the right parser) and a per-gateway authentication token. Recommended setup is BYOK / Stored Keys: Cloudflare manages the upstream provider credential and the gateway token is the only secret NetBird needs.",
+		DefaultHost:        "",
+		AuthHeaderName:     "cf-aig-authorization",
+		AuthHeaderTemplate: "Bearer ${API_KEY}",
+		DefaultContentType: "application/json",
+		BrandColor:         "#F38020",
+		// ParserID empty: like Bifrost, the proxy's parser-detect
+		// sniffs the URL path. /openai/... contains the OpenAI hint
+		// substrings; /anthropic/v1/messages contains /v1/messages
+		// (matches AnthropicParser). The /compat universal endpoint
+		// also speaks OpenAI shape so OpenAIParser handles it.
+		// Operators who paste a different prefix degrade to no-cost
+		// (skipMissingProvider) but the request still flows.
+		ParserID: "",
+		// cf-aig-metadata is a single header carrying a JSON object;
+		// up to five string/number/boolean values per request. NetBird
+		// occupies two slots (user id + groups CSV) and leaves three
+		// for operator-added context. JSON keys are operator-
+		// customisable so Cloudflare-side log filters can use the
+		// operator's existing label conventions instead of NetBird's
+		// defaults — hence Customizable=true. The dashboard surfaces
+		// the catalog values as placeholders; only the values stored
+		// on the provider record's IdentityHeader* fields land on the
+		// wire (empty operator value = key is omitted from the JSON,
+		// since applyJSONMetadata already skips empty keys).
+		IdentityInjection: &IdentityInjection{
+			JSONMetadata: &JSONMetadataInjection{
+				Header:       "cf-aig-metadata",
+				UserKey:      "netbird_user_id",
+				GroupsKey:    "netbird_groups",
+				Customizable: true,
+				// Cloudflare's docs don't specify a per-value cap;
+				// leaving 0 disables the truncate path. Header-level
+				// constraint is "5 entries max" rather than length.
+				MaxValueLength: 0,
+			},
+		},
+		Models: []Model{},
+	},
+	{
+		ID:                 "vercel_ai_gateway",
+		Kind:               KindGateway,
+		Name:               "Vercel AI Gateway",
+		Description:        "Vercel's unified API for hundreds of models. Single endpoint, OpenAI-compatible body, model dispatch via prefix (openai/..., anthropic/..., google/..., xai/...). Per-user / per-tag attribution lands in Vercel's Custom Reporting API and observability dashboard.",
+		DefaultHost:        "",
+		AuthHeaderName:     "Authorization",
+		AuthHeaderTemplate: "Bearer ${API_KEY}",
+		DefaultContentType: "application/json",
+		BrandColor:         "#000000",
+		// Vercel always speaks OpenAI shape on /v1/chat/completions —
+		// the model prefix in the body picks the upstream provider.
+		// No URL sniffing needed; pin the parser directly.
+		ParserID: "openai",
+		// HeaderPair shape with fixed wire names dictated by Vercel's
+		// Custom Reporting API contract. Customizable=false because
+		// renaming the headers makes Vercel silently stop attributing
+		// — the gateway's reporting endpoint only matches its own
+		// header names. Same fixed-protocol position as LiteLLM.
+		//
+		// Caveats operators should know:
+		//   - up to 10 tags total per request (deduped); 11+ → HTTP 400
+		//   - each tag must be 1-64 chars
+		//   - user up to 256 chars (NetBird user emails fit)
+		//   - $0.075 per 1k unique user/tag values written
+		// We don't enforce the caps in the inject middleware today;
+		// operators in groups beyond the 10-tag limit will see Vercel
+		// 400s and need to re-scope their group memberships.
+		IdentityInjection: &IdentityInjection{
+			HeaderPair: &HeaderPairInjection{
+				EndUserIDHeader: "ai-reporting-user",
+				TagsHeader:      "ai-reporting-tags",
+			},
+		},
+		Models: []Model{},
+	},
+	{
+		ID:                 "openrouter",
+		Kind:               KindGateway,
+		Name:               "OpenRouter",
+		Description:        "OpenRouter's unified API for hundreds of models. Single endpoint at openrouter.ai/api/v1, OpenAI-compatible body, model dispatch via prefix (anthropic/claude-..., openai/gpt-..., google/gemini-..., etc.). Per-user attribution lands in OpenRouter's analytics via the OpenAI-standard `user` body field; OpenRouter has no groups / tags dimension at request time.",
+		DefaultHost:        "openrouter.ai/api/v1",
+		AuthHeaderName:     "Authorization",
+		AuthHeaderTemplate: "Bearer ${API_KEY}",
+		DefaultContentType: "application/json",
+		BrandColor:         "#6F4FF2",
+		// OpenRouter is single-endpoint OpenAI-shape on /api/v1/chat/completions —
+		// model prefix in the body picks the upstream provider.
+		// Pinning the parser saves URL sniffing.
+		ParserID: "openai",
+		// HeaderPair shape with EndUserIDInBody as the only active
+		// dimension. OpenRouter's per-user attribution is the
+		// OpenAI-standard `user` body field, not a header — and
+		// OpenRouter offers no per-request groups / tags dimension at
+		// all. Customizable=false because the field name is locked by
+		// OpenAI's spec; renaming would just defeat the inject.
+		IdentityInjection: &IdentityInjection{
+			HeaderPair: &HeaderPairInjection{
+				EndUserIDInBody: true,
+			},
+		},
+		// HTTP-Referer + X-OpenRouter-Title surface in OpenRouter's
+		// app rankings and per-app analytics. Operators paste their
+		// own app URL + display name on the provider record so their
+		// requests show under their brand instead of "no app". Both
+		// are static per-deployment, not per-request, hence the
+		// ExtraHeaders mechanism (operator-typed value, stamped on
+		// every request to this provider). Skip X-OpenRouter-Categories
+		// for now — the marketplace-categories dimension is
+		// niche-enough that we'd add it on demand.
+		ExtraHeaders: []ExtraHeader{
+			{Name: "HTTP-Referer"},
+			{Name: "X-OpenRouter-Title"},
+		},
+		Models: []Model{},
+	},
+	{
+		ID:                 "custom",
+		Kind:               KindCustom,
+		Name:               "Custom / Self-hosted",
+		Description:        "OpenAI-compatible endpoint (vLLM, Ollama, …)",
+		DefaultHost:        "",
+		AuthHeaderName:     "Authorization",
+		AuthHeaderTemplate: "Bearer ${API_KEY}",
+		DefaultContentType: "application/json",
+		BrandColor:         "#9CA3AF",
+		Models:             []Model{},
+	},
+}
+
+// All returns a copy of the full catalog.
+func All() []Provider {
+	out := make([]Provider, len(providers))
+	copy(out, providers)
+	return out
+}
+
+// Lookup returns the catalog entry with the given id, if any.
+func Lookup(id string) (Provider, bool) {
+	for _, p := range providers {
+		if p.ID == id {
+			return p, true
+		}
+	}
+	return Provider{}, false
+}
+
+// IsKnown reports whether the given id refers to a catalog entry.
+func IsKnown(id string) bool {
+	_, ok := Lookup(id)
+	return ok
+}
+
+// IsVertexPathStyle reports whether a provider uses the Google Vertex AI
+// request shape — the model is carried in the URL path
+// (/v1/projects/{p}/locations/{r}/publishers/{pub}/models/{model}:{action})
+// rather than the body, so the proxy routes it by path instead of by model.
+func IsVertexPathStyle(providerID string) bool {
+	return providerID == "vertex_ai_api"
+}
+
+// IsBedrockPathStyle reports whether a provider uses the AWS Bedrock request
+// shape — the model is carried in the URL path (/model/{modelId}/{action},
+// action being invoke, invoke-with-response-stream, converse, or
+// converse-stream) rather than the body, so the proxy routes it by path.
+func IsBedrockPathStyle(providerID string) bool {
+	return providerID == "bedrock_api"
+}
+
+// ToAPIResponse renders a catalog provider as the API representation.
+func (p Provider) ToAPIResponse() api.AgentNetworkCatalogProvider {
+	models := make([]api.AgentNetworkCatalogModel, 0, len(p.Models))
+	for _, m := range p.Models {
+		models = append(models, api.AgentNetworkCatalogModel{
+			Id:            m.ID,
+			Label:         m.Label,
+			InputPer1k:    m.InputPer1k,
+			OutputPer1k:   m.OutputPer1k,
+			ContextWindow: m.ContextWindow,
+		})
+	}
+	kind := api.AgentNetworkCatalogProviderKindProvider
+	switch p.Kind {
+	case KindGateway:
+		kind = api.AgentNetworkCatalogProviderKindGateway
+	case KindCustom:
+		kind = api.AgentNetworkCatalogProviderKindCustom
+	}
+	resp := api.AgentNetworkCatalogProvider{
+		Id:                 p.ID,
+		Name:               p.Name,
+		Description:        p.Description,
+		DefaultHost:        p.DefaultHost,
+		Kind:               kind,
+		AuthHeaderTemplate: p.AuthHeaderTemplate,
+		DefaultContentType: p.DefaultContentType,
+		BrandColor:         p.BrandColor,
+		Models:             models,
+	}
+	if len(p.ExtraHeaders) > 0 {
+		extras := make([]api.AgentNetworkCatalogExtraHeader, 0, len(p.ExtraHeaders))
+		for _, h := range p.ExtraHeaders {
+			extras = append(extras, api.AgentNetworkCatalogExtraHeader{
+				Name: h.Name,
+			})
+		}
+		resp.ExtraHeaders = &extras
+	}
+	// Surface IdentityInjection so the dashboard can decide whether
+	// to render editable inputs vs. a read-only mappings strip per
+	// shape's customizable flag. HeaderPair (Bifrost) and
+	// JSONMetadata (Cloudflare, Portkey) are mutually exclusive on a
+	// given catalog entry; emit whichever shape is set.
+	if p.IdentityInjection != nil {
+		injection := &api.AgentNetworkCatalogIdentityInjection{}
+		if hp := p.IdentityInjection.HeaderPair; hp != nil {
+			injection.HeaderPair = &api.AgentNetworkCatalogHeaderPairInjection{
+				Customizable:    hp.Customizable,
+				EndUserIdHeader: hp.EndUserIDHeader,
+				TagsHeader:      hp.TagsHeader,
+			}
+		}
+		if jm := p.IdentityInjection.JSONMetadata; jm != nil {
+			injection.JsonMetadata = &api.AgentNetworkCatalogJSONMetadataInjection{
+				Customizable: jm.Customizable,
+				Header:       jm.Header,
+				UserKey:      jm.UserKey,
+				GroupsKey:    jm.GroupsKey,
+			}
+		}
+		if injection.HeaderPair != nil || injection.JsonMetadata != nil {
+			resp.IdentityInjection = injection
+		}
+	}
+	return resp
+}
diff --git a/management/internals/modules/agentnetwork/handlers/access_log_handler.go b/management/internals/modules/agentnetwork/handlers/access_log_handler.go
new file mode 100644
index 000000000..4484d8c91
--- /dev/null
+++ b/management/internals/modules/agentnetwork/handlers/access_log_handler.go
@@ -0,0 +1,134 @@
+package handlers
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/gorilla/mux"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+	"github.com/netbirdio/netbird/shared/management/http/util"
+)
+
+// addAccessLogEndpoints registers the read-only, server-side-filtered
+// agent-network access-log listing and the aggregated usage overview.
+func (h *handler) addAccessLogEndpoints(router *mux.Router) {
+	router.HandleFunc("/agent-network/access-logs", h.listAccessLogs).Methods("GET", "OPTIONS")
+	router.HandleFunc("/agent-network/access-log-sessions", h.listAccessLogSessions).Methods("GET", "OPTIONS")
+	router.HandleFunc("/agent-network/usage/overview", h.getUsageOverview).Methods("GET", "OPTIONS")
+}
+
+func (h *handler) getUsageOverview(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	// Reuse the access-log filter for the shared date/user/group/provider/model
+	// params; pagination/sort/search are irrelevant for an aggregate.
+	var filter types.AgentNetworkAccessLogFilter
+	if err := filter.ParseFromRequest(r); err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+	// Bound the aggregation window so an unbounded or over-wide query can't load
+	// an account's entire usage history into memory.
+	filter.ApplyUsageOverviewBounds(time.Now())
+	granularity := types.ParseUsageGranularity(r.URL.Query().Get("granularity"))
+
+	buckets, err := h.manager.GetUsageOverview(r.Context(), userAuth.AccountId, userAuth.UserId, filter, granularity)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	out := make([]api.AgentNetworkUsageBucket, 0, len(buckets))
+	for _, b := range buckets {
+		out = append(out, b.ToAPIResponse())
+	}
+	util.WriteJSONObject(r.Context(), w, out)
+}
+
+func (h *handler) listAccessLogs(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	var filter types.AgentNetworkAccessLogFilter
+	if err := filter.ParseFromRequest(r); err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	rows, total, err := h.manager.ListAccessLogs(r.Context(), userAuth.AccountId, userAuth.UserId, filter)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	data := make([]api.AgentNetworkAccessLog, 0, len(rows))
+	for _, row := range rows {
+		data = append(data, row.ToAPIResponse())
+	}
+
+	pageSize := filter.GetLimit()
+	totalPages := 0
+	if pageSize > 0 {
+		totalPages = int((total + int64(pageSize) - 1) / int64(pageSize))
+	}
+
+	util.WriteJSONObject(r.Context(), w, api.AgentNetworkAccessLogsResponse{
+		Data:         data,
+		Page:         filter.Page,
+		PageSize:     pageSize,
+		TotalRecords: int(total),
+		TotalPages:   totalPages,
+	})
+}
+
+// listAccessLogSessions returns the access logs grouped by session: the page
+// unit is a session (total counts sessions), each carrying an aggregate summary
+// and its ordered entries. Accepts the same filters as listAccessLogs.
+func (h *handler) listAccessLogSessions(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	var filter types.AgentNetworkAccessLogFilter
+	if err := filter.ParseFromRequest(r); err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	sessions, total, err := h.manager.ListAccessLogSessions(r.Context(), userAuth.AccountId, userAuth.UserId, filter)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	data := make([]api.AgentNetworkAccessLogSession, 0, len(sessions))
+	for _, sess := range sessions {
+		data = append(data, sess.ToAPIResponse())
+	}
+
+	pageSize := filter.GetLimit()
+	totalPages := 0
+	if pageSize > 0 {
+		totalPages = int((total + int64(pageSize) - 1) / int64(pageSize))
+	}
+
+	util.WriteJSONObject(r.Context(), w, api.AgentNetworkAccessLogSessionsResponse{
+		Data:         data,
+		Page:         filter.Page,
+		PageSize:     pageSize,
+		TotalRecords: int(total),
+		TotalPages:   totalPages,
+	})
+}
diff --git a/management/internals/modules/agentnetwork/handlers/budget_handler.go b/management/internals/modules/agentnetwork/handlers/budget_handler.go
new file mode 100644
index 000000000..5630de17f
--- /dev/null
+++ b/management/internals/modules/agentnetwork/handlers/budget_handler.go
@@ -0,0 +1,172 @@
+package handlers
+
+import (
+	"encoding/json"
+	"net/http"
+	"strings"
+
+	"github.com/gorilla/mux"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+	"github.com/netbirdio/netbird/shared/management/http/util"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// addBudgetRuleEndpoints registers the account-level budget rule routes.
+func (h *handler) addBudgetRuleEndpoints(router *mux.Router) {
+	router.HandleFunc("/agent-network/budget-rules", h.getAllBudgetRules).Methods("GET", "OPTIONS")
+	router.HandleFunc("/agent-network/budget-rules", h.createBudgetRule).Methods("POST", "OPTIONS")
+	router.HandleFunc("/agent-network/budget-rules/{ruleId}", h.getBudgetRule).Methods("GET", "OPTIONS")
+	router.HandleFunc("/agent-network/budget-rules/{ruleId}", h.updateBudgetRule).Methods("PUT", "OPTIONS")
+	router.HandleFunc("/agent-network/budget-rules/{ruleId}", h.deleteBudgetRule).Methods("DELETE", "OPTIONS")
+}
+
+func (h *handler) getAllBudgetRules(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	rules, err := h.manager.GetAllBudgetRules(r.Context(), userAuth.AccountId, userAuth.UserId)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	out := make([]*api.AgentNetworkBudgetRule, 0, len(rules))
+	for _, rule := range rules {
+		out = append(out, rule.ToAPIResponse())
+	}
+	util.WriteJSONObject(r.Context(), w, out)
+}
+
+func (h *handler) getBudgetRule(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	ruleID := mux.Vars(r)["ruleId"]
+	if ruleID == "" {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "budget rule ID is required"), w)
+		return
+	}
+
+	rule, err := h.manager.GetBudgetRule(r.Context(), userAuth.AccountId, userAuth.UserId, ruleID)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+	util.WriteJSONObject(r.Context(), w, rule.ToAPIResponse())
+}
+
+func (h *handler) createBudgetRule(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	var req api.AgentNetworkBudgetRuleRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
+		return
+	}
+
+	if err := validateBudgetRule(&req); err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	rule := types.NewAccountBudgetRule(userAuth.AccountId)
+	rule.FromAPIRequest(&req)
+
+	created, err := h.manager.CreateBudgetRule(r.Context(), userAuth.UserId, rule)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+	util.WriteJSONObject(r.Context(), w, created.ToAPIResponse())
+}
+
+func (h *handler) updateBudgetRule(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	ruleID := mux.Vars(r)["ruleId"]
+	if ruleID == "" {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "budget rule ID is required"), w)
+		return
+	}
+
+	var req api.AgentNetworkBudgetRuleRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
+		return
+	}
+
+	if err := validateBudgetRule(&req); err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	rule := &types.AccountBudgetRule{ID: ruleID, AccountID: userAuth.AccountId}
+	rule.FromAPIRequest(&req)
+
+	updated, err := h.manager.UpdateBudgetRule(r.Context(), userAuth.UserId, rule)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+	util.WriteJSONObject(r.Context(), w, updated.ToAPIResponse())
+}
+
+func (h *handler) deleteBudgetRule(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	ruleID := mux.Vars(r)["ruleId"]
+	if ruleID == "" {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "budget rule ID is required"), w)
+		return
+	}
+
+	if err := h.manager.DeleteBudgetRule(r.Context(), userAuth.AccountId, userAuth.UserId, ruleID); err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+	util.WriteJSONObject(r.Context(), w, util.EmptyObject{})
+}
+
+// validateBudgetRule rejects malformed budget rules. It reuses the policy limit
+// validation since the cap shape is identical, and rejects empty target entries.
+func validateBudgetRule(req *api.AgentNetworkBudgetRuleRequest) error {
+	if strings.TrimSpace(req.Name) == "" {
+		return status.Errorf(status.InvalidArgument, "name is required")
+	}
+	if req.TargetGroups != nil {
+		for _, id := range *req.TargetGroups {
+			if strings.TrimSpace(id) == "" {
+				return status.Errorf(status.InvalidArgument, "target_groups must not contain empty entries")
+			}
+		}
+	}
+	if req.TargetUsers != nil {
+		for _, id := range *req.TargetUsers {
+			if strings.TrimSpace(id) == "" {
+				return status.Errorf(status.InvalidArgument, "target_users must not contain empty entries")
+			}
+		}
+	}
+	return validatePolicyLimits(req.Limits)
+}
diff --git a/management/internals/modules/agentnetwork/handlers/budget_handler_test.go b/management/internals/modules/agentnetwork/handlers/budget_handler_test.go
new file mode 100644
index 000000000..4038761c5
--- /dev/null
+++ b/management/internals/modules/agentnetwork/handlers/budget_handler_test.go
@@ -0,0 +1,131 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// TestBudgetRuleHandler_RoundTrip seeds a budget rule via the store and asserts
+// the GET wire shape carries targets and the reused PolicyLimits cap shape. The
+// create/update/delete success paths go through accountManager.StoreEvent which
+// this fixture doesn't wire — they are covered by the manager-level no-mock
+// test (TestAgentNetwork_BudgetRuleCRUD_RealManager).
+func TestBudgetRuleHandler_RoundTrip(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	rule := &agentNetworkTypes.AccountBudgetRule{
+		ID:           "ainbud_test",
+		AccountID:    testAccountID,
+		Name:         "org-monthly",
+		Enabled:      true,
+		TargetGroups: []string{"grp-eng"},
+		TargetUsers:  []string{"user-alice"},
+		Limits: agentNetworkTypes.PolicyLimits{
+			TokenLimit:  agentNetworkTypes.PolicyTokenLimit{Enabled: true, GroupCap: 100000, UserCap: 10000, WindowSeconds: 2_592_000},
+			BudgetLimit: agentNetworkTypes.PolicyBudgetLimit{Enabled: true, GroupCapUsd: 500, WindowSeconds: 2_592_000},
+		},
+	}
+	require.NoError(t, f.store.SaveAgentNetworkBudgetRule(context.Background(), rule))
+
+	rec := f.do(t, http.MethodGet, "/agent-network/budget-rules/"+rule.ID, "")
+	require.Equal(t, http.StatusOK, rec.Code, "GET must succeed: %s", rec.Body.String())
+
+	var got api.AgentNetworkBudgetRule
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
+	assert.Equal(t, "org-monthly", got.Name, "name must round-trip")
+	assert.Equal(t, []string{"grp-eng"}, got.TargetGroups, "target groups must round-trip")
+	assert.Equal(t, []string{"user-alice"}, got.TargetUsers, "target users must round-trip")
+	assert.Equal(t, int64(100000), got.Limits.TokenLimit.GroupCap, "token group cap must round-trip")
+	assert.Equal(t, int64(2_592_000), got.Limits.BudgetLimit.WindowSeconds, "budget window must round-trip")
+}
+
+// TestBudgetRuleHandler_ListReturnsArray asserts the list endpoint returns a
+// JSON array (never null) for an account with no rules.
+func TestBudgetRuleHandler_ListReturnsArray(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	rec := f.do(t, http.MethodGet, "/agent-network/budget-rules", "")
+	require.Equal(t, http.StatusOK, rec.Code, "GET must succeed: %s", rec.Body.String())
+	assert.Equal(t, "[]", trimSpace(rec.Body.String()), "empty account must return an empty array, not null")
+}
+
+// TestBudgetRuleHandler_RejectsMissingName covers the validation path (which
+// runs before the manager call, so it works without a wired accountManager).
+func TestBudgetRuleHandler_RejectsMissingName(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	body := `{
+        "name": "",
+        "limits": {
+            "token_limit": {"enabled": false, "group_cap": 0, "user_cap": 0, "window_seconds": 0},
+            "budget_limit": {"enabled": false, "group_cap_usd": 0, "user_cap_usd": 0, "window_seconds": 0}
+        }
+    }`
+	rec := f.do(t, http.MethodPost, "/agent-network/budget-rules", body)
+	assert.Equal(t, http.StatusUnprocessableEntity, rec.Code,
+		"missing name must be rejected as a validation error (not a route/auth 4xx): got %d body=%s", rec.Code, rec.Body.String())
+	assert.Contains(t, rec.Body.String(), "name",
+		"rejection body must name the offending field, proving the validation path: %s", rec.Body.String())
+}
+
+// TestBudgetRuleHandler_RejectsSubMinuteWindow proves budget rules reuse the
+// policy-limit validation (enabled limit needs window >= 60s).
+func TestBudgetRuleHandler_RejectsSubMinuteWindow(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	body := `{
+        "name": "bad-window",
+        "limits": {
+            "token_limit": {"enabled": true, "group_cap": 1000, "user_cap": 0, "window_seconds": 30},
+            "budget_limit": {"enabled": false, "group_cap_usd": 0, "user_cap_usd": 0, "window_seconds": 0}
+        }
+    }`
+	rec := f.do(t, http.MethodPost, "/agent-network/budget-rules", body)
+	assert.Equal(t, http.StatusUnprocessableEntity, rec.Code,
+		"sub-minute window must be rejected as a validation error (not a route/auth 4xx): got %d body=%s", rec.Code, rec.Body.String())
+	assert.Contains(t, rec.Body.String(), "window_seconds",
+		"rejection body must name the offending window_seconds field, proving the validation path: %s", rec.Body.String())
+}
+
+// TestSettingsHandler_GetExposesCollectionToggles asserts the GET settings wire
+// shape carries the account-level collection toggles after a store seed.
+func TestSettingsHandler_GetExposesCollectionToggles(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	require.NoError(t, f.store.SaveAgentNetworkSettings(context.Background(), &agentNetworkTypes.Settings{
+		AccountID:              testAccountID,
+		Cluster:                "eu.proxy.netbird.io",
+		Subdomain:              "violet",
+		EnableLogCollection:    true,
+		EnablePromptCollection: true,
+		RedactPii:              false,
+	}))
+
+	rec := f.do(t, http.MethodGet, "/agent-network/settings", "")
+	require.Equal(t, http.StatusOK, rec.Code, "GET must succeed: %s", rec.Body.String())
+
+	var got api.AgentNetworkSettings
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
+	assert.True(t, got.EnableLogCollection, "log collection toggle must surface on the wire")
+	assert.True(t, got.EnablePromptCollection, "prompt collection toggle must surface on the wire")
+	assert.False(t, got.RedactPii, "redact toggle must surface its false value")
+	assert.Equal(t, "violet.eu.proxy.netbird.io", got.Endpoint, "endpoint stays computed from immutable cluster+subdomain")
+}
+
+func trimSpace(s string) string {
+	for len(s) > 0 && (s[len(s)-1] == '\n' || s[len(s)-1] == ' ' || s[len(s)-1] == '\t' || s[len(s)-1] == '\r') {
+		s = s[:len(s)-1]
+	}
+	for len(s) > 0 && (s[0] == '\n' || s[0] == ' ' || s[0] == '\t' || s[0] == '\r') {
+		s = s[1:]
+	}
+	return s
+}
diff --git a/management/internals/modules/agentnetwork/handlers/consumption_handler.go b/management/internals/modules/agentnetwork/handlers/consumption_handler.go
new file mode 100644
index 000000000..654f23109
--- /dev/null
+++ b/management/internals/modules/agentnetwork/handlers/consumption_handler.go
@@ -0,0 +1,53 @@
+package handlers
+
+import (
+	"net/http"
+
+	"github.com/gorilla/mux"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+	"github.com/netbirdio/netbird/shared/management/http/util"
+)
+
+// addConsumptionEndpoints registers the read-only Agent Network
+// consumption listing — backs the dashboard's basic counter view.
+func (h *handler) addConsumptionEndpoints(router *mux.Router) {
+	router.HandleFunc("/agent-network/consumption", h.listConsumption).Methods("GET", "OPTIONS")
+}
+
+func (h *handler) listConsumption(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	rows, err := h.manager.ListConsumption(r.Context(), userAuth.AccountId, userAuth.UserId)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	out := make([]api.AgentNetworkConsumption, 0, len(rows))
+	for _, row := range rows {
+		out = append(out, consumptionToAPI(row))
+	}
+	util.WriteJSONObject(r.Context(), w, out)
+}
+
+func consumptionToAPI(c *types.Consumption) api.AgentNetworkConsumption {
+	windowStart := c.WindowStartUTC
+	updatedAt := c.UpdatedAt
+	return api.AgentNetworkConsumption{
+		DimensionKind:  api.AgentNetworkConsumptionDimensionKind(c.DimensionKind),
+		DimensionId:    c.DimensionID,
+		WindowSeconds:  c.WindowSeconds,
+		WindowStartUtc: windowStart,
+		TokensInput:    c.TokensInput,
+		TokensOutput:   c.TokensOutput,
+		CostUsd:        c.CostUSD,
+		UpdatedAt:      &updatedAt,
+	}
+}
diff --git a/management/internals/modules/agentnetwork/handlers/guardrails_handler.go b/management/internals/modules/agentnetwork/handlers/guardrails_handler.go
new file mode 100644
index 000000000..81f19b9f1
--- /dev/null
+++ b/management/internals/modules/agentnetwork/handlers/guardrails_handler.go
@@ -0,0 +1,171 @@
+package handlers
+
+import (
+	"encoding/json"
+	"net/http"
+	"strings"
+
+	"github.com/gorilla/mux"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+	"github.com/netbirdio/netbird/shared/management/http/util"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// addGuardrailEndpoints registers all Agent Network guardrail routes.
+func (h *handler) addGuardrailEndpoints(router *mux.Router) {
+	router.HandleFunc("/agent-network/guardrails", h.getAllGuardrails).Methods("GET", "OPTIONS")
+	router.HandleFunc("/agent-network/guardrails", h.createGuardrail).Methods("POST", "OPTIONS")
+	router.HandleFunc("/agent-network/guardrails/{guardrailId}", h.getGuardrail).Methods("GET", "OPTIONS")
+	router.HandleFunc("/agent-network/guardrails/{guardrailId}", h.updateGuardrail).Methods("PUT", "OPTIONS")
+	router.HandleFunc("/agent-network/guardrails/{guardrailId}", h.deleteGuardrail).Methods("DELETE", "OPTIONS")
+}
+
+func (h *handler) getAllGuardrails(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	guardrails, err := h.manager.GetAllGuardrails(r.Context(), userAuth.AccountId, userAuth.UserId)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	out := make([]*api.AgentNetworkGuardrail, 0, len(guardrails))
+	for _, g := range guardrails {
+		out = append(out, g.ToAPIResponse())
+	}
+	util.WriteJSONObject(r.Context(), w, out)
+}
+
+func (h *handler) getGuardrail(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	guardrailID := mux.Vars(r)["guardrailId"]
+	if guardrailID == "" {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "guardrail ID is required"), w)
+		return
+	}
+
+	guardrail, err := h.manager.GetGuardrail(r.Context(), userAuth.AccountId, userAuth.UserId, guardrailID)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+	util.WriteJSONObject(r.Context(), w, guardrail.ToAPIResponse())
+}
+
+func (h *handler) createGuardrail(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	var req api.AgentNetworkGuardrailRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
+		return
+	}
+
+	if err := validateGuardrail(&req); err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	guardrail := types.NewGuardrail(userAuth.AccountId)
+	guardrail.FromAPIRequest(&req)
+
+	created, err := h.manager.CreateGuardrail(r.Context(), userAuth.UserId, guardrail)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	util.WriteJSONObject(r.Context(), w, created.ToAPIResponse())
+}
+
+func (h *handler) updateGuardrail(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	guardrailID := mux.Vars(r)["guardrailId"]
+	if guardrailID == "" {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "guardrail ID is required"), w)
+		return
+	}
+
+	var req api.AgentNetworkGuardrailRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
+		return
+	}
+
+	if err := validateGuardrail(&req); err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	guardrail := &types.Guardrail{
+		ID:        guardrailID,
+		AccountID: userAuth.AccountId,
+	}
+	guardrail.FromAPIRequest(&req)
+
+	updated, err := h.manager.UpdateGuardrail(r.Context(), userAuth.UserId, guardrail)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	util.WriteJSONObject(r.Context(), w, updated.ToAPIResponse())
+}
+
+func (h *handler) deleteGuardrail(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	guardrailID := mux.Vars(r)["guardrailId"]
+	if guardrailID == "" {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "guardrail ID is required"), w)
+		return
+	}
+
+	if err := h.manager.DeleteGuardrail(r.Context(), userAuth.AccountId, userAuth.UserId, guardrailID); err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	util.WriteJSONObject(r.Context(), w, util.EmptyObject{})
+}
+
+func validateGuardrail(req *api.AgentNetworkGuardrailRequest) error {
+	if strings.TrimSpace(req.Name) == "" {
+		return status.Errorf(status.InvalidArgument, "name is required")
+	}
+
+	c := req.Checks
+	if c.ModelAllowlist.Enabled {
+		for _, id := range c.ModelAllowlist.Models {
+			if strings.TrimSpace(id) == "" {
+				return status.Errorf(status.InvalidArgument, "model_allowlist.models must not contain empty entries")
+			}
+		}
+	}
+	return nil
+}
diff --git a/management/internals/modules/agentnetwork/handlers/handlers_test.go b/management/internals/modules/agentnetwork/handlers/handlers_test.go
new file mode 100644
index 000000000..27ebea5dd
--- /dev/null
+++ b/management/internals/modules/agentnetwork/handlers/handlers_test.go
@@ -0,0 +1,256 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"runtime"
+	"strings"
+	"testing"
+
+	"github.com/golang/mock/gomock"
+	"github.com/gorilla/mux"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
+	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	"github.com/netbirdio/netbird/management/server/permissions"
+	"github.com/netbirdio/netbird/management/server/store"
+	nbtypes "github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/auth"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+const (
+	testAccountID = "acc-1"
+	testUserID    = "user-bob"
+)
+
+// agentNetworkHandlerFixture builds a real agentnetwork.Manager with
+// a sqlite store and an always-allow permissions mock, then exposes
+// the HTTP handlers via a gorilla router. Tests issue requests
+// through httptest and assert on the wire shape — the same path the
+// dashboard exercises.
+type agentNetworkHandlerFixture struct {
+	store   store.Store
+	manager agentnetwork.Manager
+	router  *mux.Router
+}
+
+func newAgentNetworkHandlerFixture(t *testing.T) *agentNetworkHandlerFixture {
+	t.Helper()
+	if runtime.GOOS == "windows" {
+		t.Skip("sqlite store not properly supported on Windows yet")
+	}
+	t.Setenv("NETBIRD_STORE_ENGINE", string(nbtypes.SqliteStoreEngine))
+
+	st, cleanUp, err := store.NewTestStoreFromSQL(context.Background(), "", t.TempDir())
+	require.NoError(t, err)
+	t.Cleanup(cleanUp)
+
+	ctrl := gomock.NewController(t)
+	perms := permissions.NewMockManager(ctrl)
+	// Always-allow: the handler tests are about wire shape, not
+	// authz. Authz is covered by the manager's own tests.
+	perms.EXPECT().
+		ValidateUserPermissions(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).
+		Return(true, context.Background(), nil).
+		AnyTimes()
+
+	manager := agentnetwork.NewManager(st, perms, nil, nil)
+	h := &handler{manager: manager}
+
+	router := mux.NewRouter()
+	h.addPolicyEndpoints(router)
+	h.addConsumptionEndpoints(router)
+	h.addBudgetRuleEndpoints(router)
+	h.addSettingsEndpoints(router)
+
+	return &agentNetworkHandlerFixture{
+		store:   st,
+		manager: manager,
+		router:  router,
+	}
+}
+
+func (f *agentNetworkHandlerFixture) do(t *testing.T, method, path, body string) *httptest.ResponseRecorder {
+	t.Helper()
+	var reader io.Reader
+	if body != "" {
+		reader = strings.NewReader(body)
+	}
+	req := httptest.NewRequest(method, path, reader)
+	if body != "" {
+		req.Header.Set("Content-Type", "application/json")
+	}
+	req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
+		UserId:    testUserID,
+		AccountId: testAccountID,
+	})
+	rec := httptest.NewRecorder()
+	f.router.ServeHTTP(rec, req)
+	return rec
+}
+
+// seedProvider persists a minimal provider record so policy create
+// passes the manager's destination_provider_ids existence check.
+func (f *agentNetworkHandlerFixture) seedProvider(t *testing.T, id string) {
+	t.Helper()
+	require.NoError(t, f.store.SaveAgentNetworkProvider(context.Background(), &agentNetworkTypes.Provider{
+		ID:                id,
+		AccountID:         testAccountID,
+		ProviderID:        "openai_api",
+		Name:              "test-" + id,
+		UpstreamURL:       "https://api.openai.com",
+		APIKey:            "sk-test",
+		Enabled:           true,
+		SessionPrivateKey: "test-priv-key",
+		SessionPublicKey:  "test-pub-key",
+	}))
+}
+
+// TestPolicyHandler_WindowSecondsRoundTrip ports bash 10 to Go:
+// assert that a policy with window_seconds on both Token + Budget
+// halves round-trips through GET unchanged AND that legacy
+// window_hours / window_days are absent from the JSON response. We
+// seed the policy directly via the store rather than POST-ing
+// because the create path goes through the manager's
+// accountManager.StoreEvent which we don't wire in this fixture; the
+// on-wire shape is what matters here, and the POST validation path
+// is covered separately by the RejectsSubMinuteWindow test.
+func TestPolicyHandler_WindowSecondsRoundTrip(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	policy := &agentNetworkTypes.Policy{
+		ID:                     "ainpol_test",
+		AccountID:              testAccountID,
+		Name:                   "round-trip",
+		Enabled:                true,
+		SourceGroups:           []string{"grp-engineers"},
+		DestinationProviderIDs: []string{"prov-1"},
+		Limits: agentNetworkTypes.PolicyLimits{
+			TokenLimit:  agentNetworkTypes.PolicyTokenLimit{Enabled: true, GroupCap: 10000, UserCap: 5000, WindowSeconds: 86_400},
+			BudgetLimit: agentNetworkTypes.PolicyBudgetLimit{Enabled: true, GroupCapUsd: 10.0, UserCapUsd: 2.5, WindowSeconds: 2_592_000},
+		},
+	}
+	require.NoError(t, f.store.SaveAgentNetworkPolicy(context.Background(), policy))
+
+	rec := f.do(t, http.MethodGet, "/agent-network/policies/"+policy.ID, "")
+	require.Equal(t, http.StatusOK, rec.Code, "GET must succeed: %s", rec.Body.String())
+
+	var got api.AgentNetworkPolicy
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
+	assert.Equal(t, int64(86_400), got.Limits.TokenLimit.WindowSeconds, "token_limit.window_seconds must round-trip")
+	assert.Equal(t, int64(2_592_000), got.Limits.BudgetLimit.WindowSeconds, "budget_limit.window_seconds must round-trip")
+
+	// Legacy field names must NOT appear in the response — would
+	// signal that the management server is still emitting the old
+	// shape and would fool a v1 dashboard into rendering days/hours.
+	assert.NotContains(t, rec.Body.String(), "window_hours",
+		"legacy window_hours field must be absent from the on-wire response")
+	assert.NotContains(t, rec.Body.String(), "window_days",
+		"legacy window_days field must be absent from the on-wire response")
+}
+
+// TestPolicyHandler_RejectsSubMinuteWindow ports bash 20 to Go: an
+// enabled limit with window_seconds < 60 must surface as a 4xx
+// because anything finer than per-minute produces an untenable
+// volume of consumption rows for a feature whose value comes from
+// per-window cap enforcement.
+func TestPolicyHandler_RejectsSubMinuteWindow(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+	f.seedProvider(t, "prov-1")
+
+	body := `{
+        "name": "sub-minute-window",
+        "enabled": true,
+        "source_groups": ["grp-engineers"],
+        "destination_provider_ids": ["prov-1"],
+        "guardrail_ids": [],
+        "limits": {
+            "token_limit": {"enabled": true, "group_cap": 10000, "user_cap": 5000, "window_seconds": 30},
+            "budget_limit": {"enabled": false, "group_cap_usd": 0, "user_cap_usd": 0, "window_seconds": 0}
+        }
+    }`
+	rec := f.do(t, http.MethodPost, "/agent-network/policies", body)
+	// 422 specifically (InvalidArgument) proves the window-validation path —
+	// a route miss would be 404 and an auth failure 403, so a generic 4xx
+	// would let those false-pass.
+	assert.Equal(t, http.StatusUnprocessableEntity, rec.Code,
+		"enabled token_limit with window_seconds<60 must be rejected as a validation error: got %d body=%s", rec.Code, rec.Body.String())
+	assert.Contains(t, rec.Body.String(), "window_seconds",
+		"rejection body must name the offending window_seconds field, proving it's the validation path: %s", rec.Body.String())
+}
+
+// TestConsumptionHandler_EmptyAccountReturnsArray ports bash 30 to
+// Go: GET /agent-network/consumption on a clean account always
+// returns a JSON array (possibly empty), never a 404 / 500. The
+// dashboard depends on this shape to render its empty state.
+func TestConsumptionHandler_EmptyAccountReturnsArray(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	rec := f.do(t, http.MethodGet, "/agent-network/consumption", "")
+	require.Equal(t, http.StatusOK, rec.Code)
+
+	var rows []api.AgentNetworkConsumption
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &rows),
+		"response must always be a JSON array — even when empty: %s", rec.Body.String())
+	assert.Empty(t, rows)
+}
+
+// TestConsumptionHandler_PopulatedAccountListsRows mirrors the
+// /consumption read after a few RecordConsumption calls. Validates
+// the wire shape carries every field the dashboard reads (dim_kind,
+// dim_id, window_seconds, window_start_utc, tokens, cost_usd) and
+// rows are ordered window-newest-first.
+func TestConsumptionHandler_PopulatedAccountListsRows(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	require.NoError(t, f.manager.RecordConsumption(
+		context.Background(), testAccountID,
+		agentNetworkTypes.DimensionGroup, "grp-engineers",
+		86_400, 100, 50, 0.0125,
+	))
+	require.NoError(t, f.manager.RecordConsumption(
+		context.Background(), testAccountID,
+		agentNetworkTypes.DimensionUser, testUserID,
+		86_400, 100, 50, 0.0125,
+	))
+
+	rec := f.do(t, http.MethodGet, "/agent-network/consumption", "")
+	require.Equal(t, http.StatusOK, rec.Code)
+
+	var rows []api.AgentNetworkConsumption
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &rows))
+	require.Len(t, rows, 2, "two RecordConsumption calls must yield two rows")
+
+	// Index by dim_kind so we can assert the full wire shape of each row,
+	// including the dimension id and the aligned window start the dashboard
+	// keys on. Both rows share totals and window.
+	byKind := make(map[string]api.AgentNetworkConsumption, len(rows))
+	for _, row := range rows {
+		assert.Equal(t, int64(100), row.TokensInput)
+		assert.Equal(t, int64(50), row.TokensOutput)
+		assert.InDelta(t, 0.0125, row.CostUsd, 1e-9)
+		assert.Equal(t, int64(86_400), row.WindowSeconds)
+		assert.False(t, row.WindowStartUtc.IsZero(), "window_start_utc must be set on every row")
+		byKind[string(row.DimensionKind)] = row
+	}
+
+	groupRow, ok := byKind["group"]
+	require.True(t, ok, "group dimension must surface")
+	assert.Equal(t, "grp-engineers", groupRow.DimensionId, "group row must carry the source group id as dimension_id")
+
+	userRow, ok := byKind["user"]
+	require.True(t, ok, "user dimension must surface")
+	assert.Equal(t, testUserID, userRow.DimensionId, "user row must carry the user id as dimension_id")
+
+	// Both rows fall in the same aligned window (same length, recorded
+	// together), so window_start_utc must match across them.
+	assert.Equal(t, groupRow.WindowStartUtc, userRow.WindowStartUtc,
+		"rows recorded in the same window must share the aligned window_start_utc")
+}
diff --git a/management/internals/modules/agentnetwork/handlers/policies_handler.go b/management/internals/modules/agentnetwork/handlers/policies_handler.go
new file mode 100644
index 000000000..b821a5295
--- /dev/null
+++ b/management/internals/modules/agentnetwork/handlers/policies_handler.go
@@ -0,0 +1,228 @@
+package handlers
+
+import (
+	"encoding/json"
+	"net/http"
+	"strings"
+
+	"github.com/gorilla/mux"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+	"github.com/netbirdio/netbird/shared/management/http/util"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// minWindowSeconds is the floor enforced on enabled token / budget
+// limit windows. One minute is short enough for fine-grained burst
+// control without producing untenable consumption-row volume at scale.
+const minWindowSeconds int64 = 60
+
+// addPolicyEndpoints registers all Agent Network policy routes on the
+// shared handler.
+func (h *handler) addPolicyEndpoints(router *mux.Router) {
+	router.HandleFunc("/agent-network/policies", h.getAllPolicies).Methods("GET", "OPTIONS")
+	router.HandleFunc("/agent-network/policies", h.createPolicy).Methods("POST", "OPTIONS")
+	router.HandleFunc("/agent-network/policies/{policyId}", h.getPolicy).Methods("GET", "OPTIONS")
+	router.HandleFunc("/agent-network/policies/{policyId}", h.updatePolicy).Methods("PUT", "OPTIONS")
+	router.HandleFunc("/agent-network/policies/{policyId}", h.deletePolicy).Methods("DELETE", "OPTIONS")
+}
+
+func (h *handler) getAllPolicies(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	policies, err := h.manager.GetAllPolicies(r.Context(), userAuth.AccountId, userAuth.UserId)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	out := make([]*api.AgentNetworkPolicy, 0, len(policies))
+	for _, p := range policies {
+		out = append(out, p.ToAPIResponse())
+	}
+	util.WriteJSONObject(r.Context(), w, out)
+}
+
+func (h *handler) getPolicy(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	policyID := mux.Vars(r)["policyId"]
+	if policyID == "" {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "policy ID is required"), w)
+		return
+	}
+
+	policy, err := h.manager.GetPolicy(r.Context(), userAuth.AccountId, userAuth.UserId, policyID)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+	util.WriteJSONObject(r.Context(), w, policy.ToAPIResponse())
+}
+
+func (h *handler) createPolicy(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	var req api.AgentNetworkPolicyRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
+		return
+	}
+
+	if err := validatePolicy(&req); err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	policy := types.NewPolicy(userAuth.AccountId)
+	policy.FromAPIRequest(&req)
+
+	created, err := h.manager.CreatePolicy(r.Context(), userAuth.UserId, policy)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	util.WriteJSONObject(r.Context(), w, created.ToAPIResponse())
+}
+
+func (h *handler) updatePolicy(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	policyID := mux.Vars(r)["policyId"]
+	if policyID == "" {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "policy ID is required"), w)
+		return
+	}
+
+	var req api.AgentNetworkPolicyRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
+		return
+	}
+
+	if err := validatePolicy(&req); err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	policy := &types.Policy{
+		ID:        policyID,
+		AccountID: userAuth.AccountId,
+	}
+	policy.FromAPIRequest(&req)
+
+	updated, err := h.manager.UpdatePolicy(r.Context(), userAuth.UserId, policy)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	util.WriteJSONObject(r.Context(), w, updated.ToAPIResponse())
+}
+
+func (h *handler) deletePolicy(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	policyID := mux.Vars(r)["policyId"]
+	if policyID == "" {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "policy ID is required"), w)
+		return
+	}
+
+	if err := h.manager.DeletePolicy(r.Context(), userAuth.AccountId, userAuth.UserId, policyID); err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	util.WriteJSONObject(r.Context(), w, util.EmptyObject{})
+}
+
+func validatePolicy(req *api.AgentNetworkPolicyRequest) error {
+	if strings.TrimSpace(req.Name) == "" {
+		return status.Errorf(status.InvalidArgument, "name is required")
+	}
+	if len(req.SourceGroups) == 0 {
+		return status.Errorf(status.InvalidArgument, "source_groups must contain at least one group id")
+	}
+	for _, id := range req.SourceGroups {
+		if strings.TrimSpace(id) == "" {
+			return status.Errorf(status.InvalidArgument, "source_groups must not contain empty entries")
+		}
+	}
+	if len(req.DestinationProviderIds) == 0 {
+		return status.Errorf(status.InvalidArgument, "destination_provider_ids must contain at least one provider id")
+	}
+	for _, id := range req.DestinationProviderIds {
+		if strings.TrimSpace(id) == "" {
+			return status.Errorf(status.InvalidArgument, "destination_provider_ids must not contain empty entries")
+		}
+	}
+	if req.GuardrailIds != nil {
+		for _, id := range *req.GuardrailIds {
+			if strings.TrimSpace(id) == "" {
+				return status.Errorf(status.InvalidArgument, "guardrail_ids must not contain empty entries")
+			}
+		}
+	}
+	if req.Limits != nil {
+		if err := validatePolicyLimits(*req.Limits); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func validatePolicyLimits(l api.AgentNetworkPolicyLimits) error {
+	if l.TokenLimit.Enabled {
+		if l.TokenLimit.WindowSeconds < minWindowSeconds {
+			return status.Errorf(status.InvalidArgument, "limits.token_limit.window_seconds must be at least %d (one minute) when enabled", minWindowSeconds)
+		}
+		if l.TokenLimit.GroupCap < 0 {
+			return status.Errorf(status.InvalidArgument, "limits.token_limit.group_cap must not be negative")
+		}
+		if l.TokenLimit.UserCap < 0 {
+			return status.Errorf(status.InvalidArgument, "limits.token_limit.user_cap must not be negative")
+		}
+		if l.TokenLimit.GroupCap == 0 && l.TokenLimit.UserCap == 0 {
+			return status.Errorf(status.InvalidArgument, "limits.token_limit requires group_cap or user_cap to be greater than zero when enabled")
+		}
+	}
+	if l.BudgetLimit.Enabled {
+		if l.BudgetLimit.WindowSeconds < minWindowSeconds {
+			return status.Errorf(status.InvalidArgument, "limits.budget_limit.window_seconds must be at least %d (one minute) when enabled", minWindowSeconds)
+		}
+		if l.BudgetLimit.GroupCapUsd < 0 {
+			return status.Errorf(status.InvalidArgument, "limits.budget_limit.group_cap_usd must not be negative")
+		}
+		if l.BudgetLimit.UserCapUsd < 0 {
+			return status.Errorf(status.InvalidArgument, "limits.budget_limit.user_cap_usd must not be negative")
+		}
+		if l.BudgetLimit.GroupCapUsd == 0 && l.BudgetLimit.UserCapUsd == 0 {
+			return status.Errorf(status.InvalidArgument, "limits.budget_limit requires group_cap_usd or user_cap_usd to be greater than zero when enabled")
+		}
+	}
+	return nil
+}
diff --git a/management/internals/modules/agentnetwork/handlers/providers_handler.go b/management/internals/modules/agentnetwork/handlers/providers_handler.go
new file mode 100644
index 000000000..13da137d5
--- /dev/null
+++ b/management/internals/modules/agentnetwork/handlers/providers_handler.go
@@ -0,0 +1,217 @@
+// Package handlers serves the Agent Network HTTP API.
+//
+// All persistence is delegated to agentnetwork.Manager so this layer only
+// translates between the wire format (api.AgentNetworkProvider*) and the
+// domain types.
+package handlers
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/gorilla/mux"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+	"github.com/netbirdio/netbird/shared/management/http/util"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+type handler struct {
+	manager agentnetwork.Manager
+}
+
+// RegisterEndpoints registers all Agent Network routes.
+func RegisterEndpoints(manager agentnetwork.Manager, router *mux.Router) {
+	h := &handler{manager: manager}
+	router.HandleFunc("/agent-network/catalog/providers", h.getCatalogProviders).Methods("GET", "OPTIONS")
+	router.HandleFunc("/agent-network/providers", h.getAllProviders).Methods("GET", "OPTIONS")
+	router.HandleFunc("/agent-network/providers", h.createProvider).Methods("POST", "OPTIONS")
+	router.HandleFunc("/agent-network/providers/{providerId}", h.getProvider).Methods("GET", "OPTIONS")
+	router.HandleFunc("/agent-network/providers/{providerId}", h.updateProvider).Methods("PUT", "OPTIONS")
+	router.HandleFunc("/agent-network/providers/{providerId}", h.deleteProvider).Methods("DELETE", "OPTIONS")
+	h.addPolicyEndpoints(router)
+	h.addGuardrailEndpoints(router)
+	h.addSettingsEndpoints(router)
+	h.addConsumptionEndpoints(router)
+	h.addAccessLogEndpoints(router)
+	h.addBudgetRuleEndpoints(router)
+}
+
+func (h *handler) getCatalogProviders(w http.ResponseWriter, r *http.Request) {
+	if _, err := nbcontext.GetUserAuthFromContext(r.Context()); err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	entries := catalog.All()
+	out := make([]api.AgentNetworkCatalogProvider, 0, len(entries))
+	for _, e := range entries {
+		out = append(out, e.ToAPIResponse())
+	}
+	util.WriteJSONObject(r.Context(), w, out)
+}
+
+func (h *handler) getAllProviders(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	providers, err := h.manager.GetAllProviders(r.Context(), userAuth.AccountId, userAuth.UserId)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	out := make([]*api.AgentNetworkProvider, 0, len(providers))
+	for _, p := range providers {
+		out = append(out, p.ToAPIResponse())
+	}
+	util.WriteJSONObject(r.Context(), w, out)
+}
+
+func (h *handler) getProvider(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	providerID := mux.Vars(r)["providerId"]
+	if providerID == "" {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "provider ID is required"), w)
+		return
+	}
+
+	provider, err := h.manager.GetProvider(r.Context(), userAuth.AccountId, userAuth.UserId, providerID)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+	util.WriteJSONObject(r.Context(), w, provider.ToAPIResponse())
+}
+
+func (h *handler) createProvider(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	var req api.AgentNetworkProviderRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
+		return
+	}
+
+	if err := validate(&req, true); err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	provider := types.NewProvider(userAuth.AccountId)
+	provider.FromAPIRequest(&req)
+
+	bootstrapCluster := ""
+	if req.BootstrapCluster != nil {
+		bootstrapCluster = *req.BootstrapCluster
+	}
+
+	created, err := h.manager.CreateProvider(r.Context(), userAuth.UserId, provider, bootstrapCluster)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	util.WriteJSONObject(r.Context(), w, created.ToAPIResponse())
+}
+
+func (h *handler) updateProvider(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	providerID := mux.Vars(r)["providerId"]
+	if providerID == "" {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "provider ID is required"), w)
+		return
+	}
+
+	var req api.AgentNetworkProviderRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
+		return
+	}
+
+	if err := validate(&req, false); err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	provider := &types.Provider{
+		ID:        providerID,
+		AccountID: userAuth.AccountId,
+	}
+	provider.FromAPIRequest(&req)
+
+	updated, err := h.manager.UpdateProvider(r.Context(), userAuth.UserId, provider)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	util.WriteJSONObject(r.Context(), w, updated.ToAPIResponse())
+}
+
+func (h *handler) deleteProvider(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	providerID := mux.Vars(r)["providerId"]
+	if providerID == "" {
+		util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "provider ID is required"), w)
+		return
+	}
+
+	if err := h.manager.DeleteProvider(r.Context(), userAuth.AccountId, userAuth.UserId, providerID); err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	util.WriteJSONObject(r.Context(), w, util.EmptyObject{})
+}
+
+func validate(req *api.AgentNetworkProviderRequest, requireAPIKey bool) error {
+	if strings.TrimSpace(req.ProviderId) == "" {
+		return status.Errorf(status.InvalidArgument, "provider_id is required")
+	}
+	if !catalog.IsKnown(req.ProviderId) {
+		return status.Errorf(status.InvalidArgument, "provider_id %q is not a known catalog provider", req.ProviderId)
+	}
+	if strings.TrimSpace(req.Name) == "" {
+		return status.Errorf(status.InvalidArgument, "name is required")
+	}
+	if strings.TrimSpace(req.UpstreamUrl) == "" {
+		return status.Errorf(status.InvalidArgument, "upstream_url is required")
+	}
+	u, err := url.Parse(strings.TrimSpace(req.UpstreamUrl))
+	if err != nil || u.Host == "" || (u.Scheme != "http" && u.Scheme != "https") {
+		return status.Errorf(status.InvalidArgument, "upstream_url must be a full http(s) URL")
+	}
+	if requireAPIKey && (req.ApiKey == nil || strings.TrimSpace(*req.ApiKey) == "") {
+		return status.Errorf(status.InvalidArgument, "api_key is required")
+	}
+	return nil
+}
diff --git a/management/internals/modules/agentnetwork/handlers/settings_handler.go b/management/internals/modules/agentnetwork/handlers/settings_handler.go
new file mode 100644
index 000000000..c65efad0f
--- /dev/null
+++ b/management/internals/modules/agentnetwork/handlers/settings_handler.go
@@ -0,0 +1,74 @@
+package handlers
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+
+	"github.com/gorilla/mux"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	nbcontext "github.com/netbirdio/netbird/management/server/context"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+	"github.com/netbirdio/netbird/shared/management/http/util"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// addSettingsEndpoints registers the Agent Network settings routes. The
+// settings row is bootstrapped server-side on first provider create; GET reads
+// it and PUT updates the mutable collection toggles (cluster/subdomain stay
+// immutable).
+func (h *handler) addSettingsEndpoints(router *mux.Router) {
+	router.HandleFunc("/agent-network/settings", h.getSettings).Methods("GET", "OPTIONS")
+	router.HandleFunc("/agent-network/settings", h.updateSettings).Methods("PUT", "OPTIONS")
+}
+
+// updateSettings applies the collection toggles to the account's settings row.
+func (h *handler) updateSettings(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	var req api.AgentNetworkSettingsRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
+		return
+	}
+
+	settings := &types.Settings{AccountID: userAuth.AccountId}
+	settings.FromAPIRequest(&req)
+
+	updated, err := h.manager.UpdateSettings(r.Context(), userAuth.UserId, settings)
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+	util.WriteJSONObject(r.Context(), w, updated.ToAPIResponse())
+}
+
+// getSettings returns the account's agent-network settings. The settings
+// row is bootstrapped on first provider create, so freshly-onboarded
+// accounts have nothing to read. Rather than 404-ing in that case (which
+// the dashboard would have to special-case), return a JSON null with 200
+// so consumers can branch on the body alone.
+func (h *handler) getSettings(w http.ResponseWriter, r *http.Request) {
+	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
+	if err != nil {
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+
+	settings, err := h.manager.GetSettings(r.Context(), userAuth.AccountId, userAuth.UserId)
+	if err != nil {
+		var sErr *status.Error
+		if errors.As(err, &sErr) && sErr.Type() == status.NotFound {
+			util.WriteJSONObject(r.Context(), w, nil)
+			return
+		}
+		util.WriteError(r.Context(), err, w)
+		return
+	}
+	util.WriteJSONObject(r.Context(), w, settings.ToAPIResponse())
+}
diff --git a/management/internals/modules/agentnetwork/labelgen/labelgen.go b/management/internals/modules/agentnetwork/labelgen/labelgen.go
new file mode 100644
index 000000000..b45ff4ea8
--- /dev/null
+++ b/management/internals/modules/agentnetwork/labelgen/labelgen.go
@@ -0,0 +1,66 @@
+// Package labelgen produces DNS-safe Agent Network subdomain labels.
+package labelgen
+
+import (
+	"fmt"
+	"math/rand"
+	"sort"
+	"sync"
+)
+
+// pickAttempts caps the random retries before falling back to the
+// suffixed form. Eight is a soft compromise: with a near-empty taken
+// set the very first pick almost always succeeds; when the wordlist is
+// densely populated the fallback eventually fires anyway.
+const pickAttempts = 8
+
+var (
+	dedupOnce sync.Once
+	uniqWords []string
+)
+
+// uniqueWords returns the wordlist deduplicated and sorted for
+// deterministic exhaustion behaviour. Lazy-built once per process.
+func uniqueWords() []string {
+	dedupOnce.Do(func() {
+		seen := make(map[string]struct{}, len(words))
+		uniqWords = make([]string, 0, len(words))
+		for _, w := range words {
+			if _, ok := seen[w]; ok {
+				continue
+			}
+			seen[w] = struct{}{}
+			uniqWords = append(uniqWords, w)
+		}
+		sort.Strings(uniqWords)
+	})
+	return uniqWords
+}
+
+// PickUnique selects a label not already in `taken`. It tries up to
+// pickAttempts random picks; on exhaustion it scans the deduplicated
+// wordlist for any remaining free entry, and if none is left appends
+// `-<fallbackSuffix>` to a deterministic word and returns. The caller
+// is responsible for seeding rng (math/rand).
+func PickUnique(rng *rand.Rand, taken map[string]struct{}, fallbackSuffix string) string {
+	pool := uniqueWords()
+	if len(pool) == 0 {
+		return fallbackSuffix
+	}
+
+	for i := 0; i < pickAttempts; i++ {
+		w := pool[rng.Intn(len(pool))]
+		if _, ok := taken[w]; !ok {
+			return w
+		}
+	}
+
+	for _, w := range pool {
+		if _, ok := taken[w]; !ok {
+			return w
+		}
+	}
+
+	w := pool[rng.Intn(len(pool))]
+	return fmt.Sprintf("%s-%s", w, fallbackSuffix)
+}
diff --git a/management/internals/modules/agentnetwork/labelgen/labelgen_test.go b/management/internals/modules/agentnetwork/labelgen/labelgen_test.go
new file mode 100644
index 000000000..f03a3501d
--- /dev/null
+++ b/management/internals/modules/agentnetwork/labelgen/labelgen_test.go
@@ -0,0 +1,101 @@
+package labelgen
+
+import (
+	"math/rand"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestPickUnique_DeterministicWithSeededRng locks the property the
+// caller relies on: same seed + same taken set → same pick. Without
+// that, the bootstrap flow can't reproduce a label across retries.
+func TestPickUnique_DeterministicWithSeededRng(t *testing.T) {
+	taken := map[string]struct{}{}
+
+	rngA := rand.New(rand.NewSource(42))
+	rngB := rand.New(rand.NewSource(42))
+
+	a := PickUnique(rngA, taken, "abcd")
+	b := PickUnique(rngB, taken, "abcd")
+
+	assert.Equal(t, a, b, "Same seed and taken set must produce identical pick")
+}
+
+// TestPickUnique_AvoidsTakenWordsWhenMostAreReserved seeds taken with
+// every word in the pool except a handful and confirms PickUnique
+// finds one of the remaining free entries instead of returning the
+// fallback form.
+func TestPickUnique_AvoidsTakenWordsWhenMostAreReserved(t *testing.T) {
+	pool := uniqueWords()
+	require.NotEmpty(t, pool, "wordlist must be populated for the test to mean anything")
+
+	free := map[string]struct{}{
+		pool[0]:           {},
+		pool[len(pool)/2]: {},
+		pool[len(pool)-1]: {},
+	}
+
+	taken := make(map[string]struct{}, len(pool))
+	for _, w := range pool {
+		if _, ok := free[w]; ok {
+			continue
+		}
+		taken[w] = struct{}{}
+	}
+
+	rng := rand.New(rand.NewSource(7))
+	got := PickUnique(rng, taken, "abcd")
+
+	_, isFree := free[got]
+	assert.True(t, isFree, "PickUnique must return one of the free words; got %q", got)
+	assert.NotContains(t, got, "-", "Free pick must not be the suffix fallback form")
+}
+
+// TestPickUnique_FallsBackWhenAllReserved exhausts the pool and
+// confirms PickUnique appends the supplied suffix instead of
+// returning a duplicate.
+func TestPickUnique_FallsBackWhenAllReserved(t *testing.T) {
+	pool := uniqueWords()
+
+	taken := make(map[string]struct{}, len(pool))
+	for _, w := range pool {
+		taken[w] = struct{}{}
+	}
+
+	rng := rand.New(rand.NewSource(99))
+	got := PickUnique(rng, taken, "abcd")
+
+	assert.True(t, strings.HasSuffix(got, "-abcd"), "Exhausted pool must produce <word>-<suffix>; got %q", got)
+
+	prefix := strings.TrimSuffix(got, "-abcd")
+	found := false
+	for _, w := range pool {
+		if w == prefix {
+			found = true
+			break
+		}
+	}
+	assert.True(t, found, "Fallback prefix must be drawn from the wordlist; got %q", prefix)
+}
+
+// TestUniqueWords_DropsDuplicates guards against authoring slips in
+// words.go: every entry must be unique and DNS-safe.
+func TestUniqueWords_DropsDuplicates(t *testing.T) {
+	pool := uniqueWords()
+	seen := make(map[string]struct{}, len(pool))
+	for _, w := range pool {
+		_, dup := seen[w]
+		assert.False(t, dup, "Duplicate entry %q in deduplicated pool", w)
+		seen[w] = struct{}{}
+		assert.GreaterOrEqual(t, len(w), 4, "Word %q is shorter than 4 chars", w)
+		assert.LessOrEqual(t, len(w), 12, "Word %q is longer than 12 chars", w)
+		for _, r := range w {
+			ok := r >= 'a' && r <= 'z'
+			assert.True(t, ok, "Word %q contains non-lowercase-ASCII rune %q", w, r)
+		}
+	}
+	assert.GreaterOrEqual(t, len(pool), 500, "Pool must contain at least 500 unique words")
+}
diff --git a/management/internals/modules/agentnetwork/labelgen/words.go b/management/internals/modules/agentnetwork/labelgen/words.go
new file mode 100644
index 000000000..2028ff23d
--- /dev/null
+++ b/management/internals/modules/agentnetwork/labelgen/words.go
@@ -0,0 +1,136 @@
+// Package labelgen produces DNS-safe Agent Network subdomain labels.
+//
+// The wordlist below is a curated subset drawn from public-domain
+// nature / common-noun pools (e.g. EFF's diceware lists). Every entry
+// is lowercase ASCII, 4–12 chars, no hyphens, no digits, and was
+// hand-checked to avoid offensive, brand, or region-specific terms.
+package labelgen
+
+// words is the pool PickUnique selects from. The slice is intentionally
+// not sorted — random picks distribute across the list naturally.
+var words = []string{
+	"acorn", "adobe", "agate", "alder", "almond", "alpine", "amber", "amethyst",
+	"anchor", "antler", "apple", "apricot", "arcade", "arctic", "arrow", "ashen",
+	"aspen", "atlas", "atom", "aurora", "autumn", "azure",
+	"badger", "bamboo", "banana", "banjo", "barley", "barn", "basalt", "basil",
+	"basin", "bayou", "beach", "beacon", "beaver", "beech", "beetle", "berry",
+	"birch", "bison", "blossom", "blue", "bobcat", "bonsai", "boulder", "branch",
+	"brass", "breeze", "bridge", "bright", "brook", "broom", "brown", "buffalo",
+	"bumble", "burrow", "butter", "button",
+	"cabin", "cactus", "calm", "camel", "campfire", "canary", "candle", "canoe",
+	"canyon", "cardinal", "carrot", "cascade", "castle", "cedar", "celery", "cello",
+	"cement", "cherry", "chestnut", "chime", "cinnamon", "cinder", "citron", "clay",
+	"clear", "cliff", "clock", "cloud", "clover", "coast", "cobalt", "cobble",
+	"cocoa", "coffee", "comet", "compass", "copper", "coral", "corner", "cosmos",
+	"cotton", "cougar", "country", "coyote", "cove", "crane", "crater", "creek",
+	"crescent", "crimson", "crocus", "crystal", "cypress",
+	"daffodil", "dahlia", "daisy", "dawn", "deer", "delta", "denim", "desert",
+	"dewdrop", "diamond", "dolphin", "doodle", "dove", "dragon", "drift", "drop",
+	"dune", "dusk", "dusty",
+	"eagle", "earth", "echo", "elder", "elkhorn", "ember", "emerald", "emperor",
+	"evergreen", "evening",
+	"falcon", "fawn", "feather", "fern", "fiddle", "field", "fiesta", "finch",
+	"firepit", "firefly", "fjord", "flame", "flax", "fleece", "flint", "floral",
+	"flower", "flute", "foal", "foggy", "forest", "fountain", "foxglove", "fresh",
+	"frost", "fuchsia", "fudge",
+	"gable", "galaxy", "garden", "garnet", "gazelle", "geode", "geyser", "ginger",
+	"glacier", "glade", "glass", "glow", "gold", "goose", "gorge", "gourd",
+	"granite", "grape", "grass", "gravel", "grayling", "greenery", "grizzly", "grove",
+	"gull", "gumdrop", "gust",
+	"hammock", "harbor", "harvest", "hawk", "hazel", "heather", "hedge", "heron",
+	"hibiscus", "hickory", "hideaway", "highland", "hill", "hive", "hollow", "honey",
+	"hopper", "horizon", "hummingbird", "husky",
+	"iceberg", "indigo", "iris", "island", "ivory", "ivybush",
+	"jade", "jasmine", "jasper", "jaybird", "jelly", "jewel", "jonquil", "journey",
+	"juniper", "jupiter", "jute",
+	"kale", "kangaroo", "kayak", "kelp", "kestrel", "kettle", "khaki", "kindling",
+	"kingfisher", "kiwi", "knapweed", "koala",
+	"lagoon", "lake", "lantern", "larch", "lark", "laurel", "lava", "lavender",
+	"leaf", "lemon", "lichen", "light", "lilac", "lily", "lime", "limestone",
+	"linden", "linen", "lion", "lobster", "locust", "loon", "lotus", "lumber",
+	"lunar", "lupine", "lynx",
+	"madrone", "magenta", "magnolia", "mahogany", "mallow", "mango", "manor", "maple",
+	"marble", "marigold", "marina", "marlin", "marsh", "mauve", "meadow", "melody",
+	"melon", "merlin", "metal", "midnight", "milk", "millet", "mineral", "mint",
+	"mirror", "mist", "mitten", "molasses", "moon", "moose", "morning", "moss",
+	"mountain", "mulberry", "muscat", "mustard",
+	"narwhal", "navy", "nectar", "needle", "nest", "nettle", "newt", "nightfall",
+	"noon", "nook", "north", "nova", "nutmeg",
+	"oaken", "oasis", "oatmeal", "ocean", "ochre", "octagon", "olive", "onyx",
+	"opal", "orange", "orbit", "orchard", "orchid", "oregano", "orion", "osprey",
+	"otter", "outpost", "owlet", "oyster",
+	"painter", "palace", "palm", "pansy", "panther", "papaya", "paprika", "parsley",
+	"partridge", "passage", "pastel", "patio", "peach", "peacock", "pear", "pearl",
+	"pebble", "pecan", "pelican", "penguin", "peony", "pepper", "perch", "peridot",
+	"pewter", "phoenix", "pier", "pillar", "pine", "pineapple", "pinto", "piper",
+	"pistachio", "plain", "planet", "plateau", "platinum", "plum", "plume", "polar",
+	"pollen", "pond", "poplar", "poppy", "porcelain", "portal", "portrait", "potato",
+	"prairie", "primrose", "prism", "puffin", "pumpkin",
+	"quail", "quartz", "quaver", "quill", "quince", "quinoa",
+	"rabbit", "raccoon", "radish", "rain", "rainbow", "raindrop", "rapids", "raspberry",
+	"raven", "ravine", "redwood", "reed", "reef", "ridge", "river", "robin",
+	"rocket", "rubyred", "rose", "rosemary", "rosewood", "ruffle", "rugby", "russet",
+	"rustic", "ryefield",
+	"saffron", "sage", "salmon", "sand", "sandstone", "sapphire", "savanna", "scarlet",
+	"scout", "seal", "season", "seaweed", "sequoia", "shadow", "shamrock", "shell",
+	"sherbet", "shore", "silver", "siskin", "skybloom", "skyline", "sleet", "smoke",
+	"snail", "snapdragon", "snow", "snowflake", "snowy", "solar", "song", "sonic",
+	"sorrel", "south", "sparkle", "sparrow", "spice", "spider", "spinach", "spire",
+	"spring", "sprout", "spruce", "squirrel", "starfish", "starlight", "stoat", "stone",
+	"stork", "storm", "stream", "studio", "summer", "sunbeam", "sundew", "sunny",
+	"sunrise", "sunset", "swallow", "swan", "sweet", "sycamore",
+	"tangelo", "tangerine", "tansy", "taupe", "teak", "teal", "thicket", "thistle",
+	"thrush", "thunder", "tide", "tiger", "tinder", "topaz", "torch", "tortoise",
+	"tower", "trail", "tranquil", "tundra", "tulip", "turquoise", "turtle", "twig",
+	"twilight",
+	"umber", "uplands",
+	"valley", "vanilla", "velvet", "venus", "verdant", "verdigris", "vermilion", "violet",
+	"vista", "vivid", "volcano", "vortex",
+	"walnut", "warbler", "watercress", "waterfall", "wave", "waxwing", "weasel", "westwind",
+	"whale", "whisker", "whisper", "wicker", "wildwood", "willow", "winter", "wisp",
+	"wisteria", "wolf", "wombat", "woodland", "woolly", "wren", "wreath",
+	"yarrow", "yellow", "yewtree", "yodel",
+	"zebra", "zenith", "zephyr", "zinnia",
+	"alabaster", "alfalfa", "almanac", "anise", "antelope", "arbor", "arena", "armadillo",
+	"avocet", "azalea", "balsam", "bayou", "beacon", "blizzard", "bluebell", "bluebird",
+	"bluejay", "bobolink", "borage", "boreal", "buckeye", "buckthorn", "buttercup",
+	"cabana", "calico", "canopy", "caraway", "cardamom", "cattail", "celadon", "centaur",
+	"chambray", "chamois", "champlain", "chestnuts", "chickadee", "chinook", "chipmunk", "cinnabar",
+	"cirrus", "citrine", "clematis", "copperhead",
+	"crocodile", "currant", "cuttlebone", "daffy", "dapple", "delphinium", "dervish", "diamondback",
+	"dogwood", "dolphins", "dragonfly", "driftwood", "dusk", "dustpan", "ebony", "edelweiss",
+	"emperor", "endive", "estuary", "everglade", "fairway", "feldspar", "fennel", "fieldstone",
+	"firebrand", "firefly", "fireweed", "firework", "flagstone", "fossil", "frostbite", "galleon",
+	"gardener", "geranium", "gingko", "ginseng", "goldfish", "goldfinch", "goldenrod", "graphite",
+	"greenfinch", "guppy", "haiku", "halibut", "hammerhead", "harbinger", "harvest", "hatchling",
+	"havana", "hawthorn", "hazelnut", "heartwood", "henna", "heron", "highrise", "homestead",
+	"honeycomb", "honeydew", "horseshoe", "hyacinth", "iceland", "icicle", "indigobird", "ironwood",
+	"jacaranda", "jamboree", "javelina", "jellyfish", "junebug", "kaleido", "kayaker", "kerchief",
+	"keystone", "kingdom", "labrador", "lacewing", "ladybug", "lakeside", "lamplight", "leopard",
+	"lighthouse", "lilypad", "lullaby", "magnet", "mahonia", "mandolin", "manzanita", "maraschino",
+	"mariner", "marsupial", "mastodon", "matterhorn", "mayflower", "mayfly", "meadowlark", "merlot",
+	"meteor", "midshipman", "millpond", "mimosa", "minnow", "mockingbird", "molten", "monarch",
+	"monsoon", "moondust", "moonlight", "moorland", "morning", "mossland", "mountain", "mulch",
+	"narcissus", "nautilus", "nettlebush", "northstar", "nuthatch", "obsidian", "okra", "olivine",
+	"opalescent", "orchidea", "orchard", "ornament", "outrigger", "oxalis", "paddler", "paintbrush",
+	"papyrus", "paradise", "pasture", "patchwork", "pathway", "peridot", "periwinkle", "petalbloom",
+	"petrel", "petunia", "phlox", "pikeperch", "pinecone", "pioneer", "pipevine", "platypus",
+	"pomelo", "pondweed", "porpoise", "powder", "promise", "puddle", "pumice", "puzzle",
+	"quetzal", "quicksilver", "raccoon", "ragwort", "rainforest", "ramble", "rapid", "rascal",
+	"raspberry", "redbud", "redfern", "redpoll", "reedling", "ringtail", "riverbed", "riverbird",
+	"riverstone", "rockcress", "roebuck", "rosebay", "rosehip", "rosemary", "rowan", "rumble",
+	"runaway", "rustler", "sagebrush", "sailcloth", "salamander", "salsify", "samphire", "sandbar",
+	"sanddollar", "sandpiper", "santolina", "sapodilla", "sassafras", "scallion", "schooner", "seafoam",
+	"seafrost", "seagrass", "seahorse", "seaport", "seashell", "seaspray", "shamble", "shimmer",
+	"shoreline", "silkmoth", "silverfox", "skylark", "snapdragon", "snowberry", "snowdrop", "snowfall",
+	"snowmelt", "softwood", "songbird", "sorghum", "southwind", "speedwell", "spinnaker", "spruce",
+	"starlight", "starling", "stormcloud", "summit", "sundance", "sundew", "sundial", "sunflower",
+	"surface", "swallowtail", "sweetcorn", "sycamore", "tabletop", "tamarack", "tamarind", "tangerine",
+	"tarragon", "telescope", "thicket", "thrasher", "thunder", "thyme", "tideline", "timberland",
+	"tinderbox", "topiary", "torchwood", "totem", "tradewind", "treasure", "tremolo", "trinket",
+	"trumpetvine", "tugboat", "tundra", "turnstone", "underbrush", "vagabond", "valerian", "vanilla",
+	"velveteen", "vermilion", "vinca", "vineyard", "violet", "voyager", "wagonwheel", "walnutwood",
+	"watermark", "watershed", "waterway", "wavefront", "westerly", "whaleback", "whetstone", "wicker",
+	"wildbloom", "wildflower", "wilderness", "windsong", "windward", "winterberry", "woodbine", "woodfern",
+	"woodland", "woodthrush", "woolgrass", "yellowfin", "zenithal", "zucchini",
+}
diff --git a/management/internals/modules/agentnetwork/manager.go b/management/internals/modules/agentnetwork/manager.go
new file mode 100644
index 000000000..d88e0d77c
--- /dev/null
+++ b/management/internals/modules/agentnetwork/manager.go
@@ -0,0 +1,911 @@
+package agentnetwork
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"math/rand"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/labelgen"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/sessionkey"
+	"github.com/netbirdio/netbird/management/server/account"
+	"github.com/netbirdio/netbird/management/server/activity"
+	"github.com/netbirdio/netbird/management/server/permissions"
+	"github.com/netbirdio/netbird/management/server/permissions/modules"
+	"github.com/netbirdio/netbird/management/server/permissions/operations"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/shared/management/proto"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// ensureSessionKeys mints an ed25519 session keypair on the provider
+// when one is missing. Idempotent: skips when both fields are already
+// populated (e.g. update or migrated rows). The keys are used by the
+// synthesised reverse-proxy service to sign / verify session JWTs
+// after a successful OIDC handshake.
+func ensureSessionKeys(p *types.Provider) error {
+	if p.SessionPrivateKey != "" && p.SessionPublicKey != "" {
+		return nil
+	}
+	pair, err := sessionkey.GenerateKeyPair()
+	if err != nil {
+		return fmt.Errorf("generate provider session keys: %w", err)
+	}
+	p.SessionPrivateKey = pair.PrivateKey
+	p.SessionPublicKey = pair.PublicKey
+	return nil
+}
+
+// Manager governs the lifecycle of Agent Network providers and policies.
+type Manager interface {
+	GetAllProviders(ctx context.Context, accountID, userID string) ([]*types.Provider, error)
+	GetProvider(ctx context.Context, accountID, userID, providerID string) (*types.Provider, error)
+	CreateProvider(ctx context.Context, userID string, provider *types.Provider, bootstrapCluster string) (*types.Provider, error)
+	UpdateProvider(ctx context.Context, userID string, provider *types.Provider) (*types.Provider, error)
+	DeleteProvider(ctx context.Context, accountID, userID, providerID string) error
+
+	GetAllPolicies(ctx context.Context, accountID, userID string) ([]*types.Policy, error)
+	GetPolicy(ctx context.Context, accountID, userID, policyID string) (*types.Policy, error)
+	CreatePolicy(ctx context.Context, userID string, policy *types.Policy) (*types.Policy, error)
+	UpdatePolicy(ctx context.Context, userID string, policy *types.Policy) (*types.Policy, error)
+	DeletePolicy(ctx context.Context, accountID, userID, policyID string) error
+
+	GetAllGuardrails(ctx context.Context, accountID, userID string) ([]*types.Guardrail, error)
+	GetGuardrail(ctx context.Context, accountID, userID, guardrailID string) (*types.Guardrail, error)
+	CreateGuardrail(ctx context.Context, userID string, guardrail *types.Guardrail) (*types.Guardrail, error)
+	UpdateGuardrail(ctx context.Context, userID string, guardrail *types.Guardrail) (*types.Guardrail, error)
+	DeleteGuardrail(ctx context.Context, accountID, userID, guardrailID string) error
+
+	GetAllBudgetRules(ctx context.Context, accountID, userID string) ([]*types.AccountBudgetRule, error)
+	GetBudgetRule(ctx context.Context, accountID, userID, ruleID string) (*types.AccountBudgetRule, error)
+	CreateBudgetRule(ctx context.Context, userID string, rule *types.AccountBudgetRule) (*types.AccountBudgetRule, error)
+	UpdateBudgetRule(ctx context.Context, userID string, rule *types.AccountBudgetRule) (*types.AccountBudgetRule, error)
+	DeleteBudgetRule(ctx context.Context, accountID, userID, ruleID string) error
+
+	GetSettings(ctx context.Context, accountID, userID string) (*types.Settings, error)
+	UpdateSettings(ctx context.Context, userID string, settings *types.Settings) (*types.Settings, error)
+
+	ListConsumption(ctx context.Context, accountID, userID string) ([]*types.Consumption, error)
+	ListAccessLogs(ctx context.Context, accountID, userID string, filter types.AgentNetworkAccessLogFilter) ([]*types.AgentNetworkAccessLog, int64, error)
+	ListAccessLogSessions(ctx context.Context, accountID, userID string, filter types.AgentNetworkAccessLogFilter) ([]*types.AgentNetworkAccessLogSession, int64, error)
+	GetUsageOverview(ctx context.Context, accountID, userID string, filter types.AgentNetworkAccessLogFilter, granularity types.UsageGranularity) ([]*types.AgentNetworkUsageBucket, error)
+	StartAccessLogCleanup(ctx context.Context, cleanupIntervalHours int)
+	RecordConsumption(ctx context.Context, accountID string, kind types.ConsumptionDimension, dimID string, windowSeconds, tokensIn, tokensOut int64, costUSD float64) error
+	RecordAccountBudgetUsage(ctx context.Context, accountID, userID string, groupIDs []string, tokensIn, tokensOut int64, costUSD float64) error
+	RecordUsage(ctx context.Context, in RecordUsageInput) error
+	SelectPolicyForRequest(ctx context.Context, in PolicySelectionInput) (*PolicySelectionResult, error)
+}
+
+// PolicySelectionInput is the per-request selection envelope. The
+// proxy populates it from CapturedData (account, user, groups) plus
+// the provider llm_router resolved.
+type PolicySelectionInput struct {
+	AccountID  string
+	UserID     string
+	GroupIDs   []string
+	ProviderID string
+}
+
+// PolicySelectionResult names the policy that "pays" for this request
+// plus the deny envelope when every applicable policy has exhausted
+// every cap. AttributionGroupID is the lowest group id (string sort)
+// of caller_groups ∩ selected_policy.source_groups; empty when no
+// group dimension applies. WindowSeconds is the chosen policy's
+// effective window length in seconds (token_limit's wins when both
+// halves are enabled with mismatched windows; budget_limit's
+// otherwise; 0 when no caps are configured at all).
+type PolicySelectionResult struct {
+	Allow              bool
+	SelectedPolicyID   string
+	AttributionGroupID string
+	WindowSeconds      int64
+	DenyCode           string
+	DenyReason         string
+}
+
+type managerImpl struct {
+	store              store.Store
+	accountManager     account.Manager
+	permissionsManager permissions.Manager
+	proxyController    proxy.Controller
+
+	// reconcileCache holds the last set of synthesised proxy mappings
+	// per account so reconcile can emit precise Create/Update/Delete
+	// updates instead of a full re-push on every mutation. Keyed by
+	// accountID, then by synthesised service ID.
+	reconcileMu    sync.Mutex
+	reconcileCache map[string]map[string]*proto.ProxyMapping
+
+	// labelRngMu guards labelRng. PickUnique consumes math/rand.Source
+	// state; concurrent provider creates would otherwise race.
+	labelRngMu sync.Mutex
+	labelRng   *rand.Rand
+}
+
+// NewManager constructs the persistent Agent Network manager. The
+// manager persists provider/policy/guardrail configuration and, on
+// every mutation, reconciles the in-memory synthesised reverse-proxy
+// services with the proxy cluster via proxyController. Pass nil for
+// proxyController to disable the reconcile push (useful in tests).
+func NewManager(
+	store store.Store,
+	permissionsManager permissions.Manager,
+	accountManager account.Manager,
+	proxyController proxy.Controller,
+) Manager {
+	return &managerImpl{
+		store:              store,
+		accountManager:     accountManager,
+		permissionsManager: permissionsManager,
+		proxyController:    proxyController,
+		reconcileCache:     make(map[string]map[string]*proto.ProxyMapping),
+		labelRng:           rand.New(rand.NewSource(time.Now().UnixNano())),
+	}
+}
+
+func (m *managerImpl) GetAllProviders(ctx context.Context, accountID, userID string) ([]*types.Provider, error) {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+		return nil, err
+	}
+	return m.store.GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, accountID)
+}
+
+func (m *managerImpl) GetProvider(ctx context.Context, accountID, userID, providerID string) (*types.Provider, error) {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+		return nil, err
+	}
+	return m.store.GetAgentNetworkProviderByID(ctx, store.LockingStrengthNone, accountID, providerID)
+}
+
+// CreateProvider persists a new provider for the account. bootstrapCluster
+// is used only when the per-account agent-network Settings row hasn't
+// been created yet; otherwise it is ignored (the cluster is pinned on
+// Settings and every provider in the account routes through it).
+func (m *managerImpl) CreateProvider(ctx context.Context, userID string, provider *types.Provider, bootstrapCluster string) (*types.Provider, error) {
+	if err := m.requirePermission(ctx, provider.AccountID, userID, operations.Create); err != nil {
+		return nil, err
+	}
+
+	// An empty api_key would silently produce a synthesised service
+	// that 401s on every upstream request. Surface the misconfiguration
+	// at create time instead.
+	if strings.TrimSpace(provider.APIKey) == "" {
+		return nil, status.Errorf(status.InvalidArgument, "api_key is required when creating an agent network provider")
+	}
+
+	if provider.ID == "" {
+		fresh := types.NewProvider(provider.AccountID)
+		provider.ID = fresh.ID
+		provider.CreatedAt = fresh.CreatedAt
+		provider.UpdatedAt = fresh.UpdatedAt
+	}
+
+	if err := ensureSessionKeys(provider); err != nil {
+		return nil, err
+	}
+
+	if err := m.store.SaveAgentNetworkProvider(ctx, provider); err != nil {
+		return nil, fmt.Errorf("save agent network provider: %w", err)
+	}
+
+	if strings.TrimSpace(bootstrapCluster) != "" {
+		if _, err := m.bootstrapSettingsIfNeeded(ctx, provider.AccountID, bootstrapCluster); err != nil {
+			// The provider create has already succeeded; logging the
+			// bootstrap miss matches the plan's PoC behaviour. The synth
+			// path treats a missing settings row as a no-op, and the next
+			// provider create retries the bootstrap.
+			log.WithContext(ctx).Debugf("agent-network bootstrap settings for account %s on cluster %s: %v", provider.AccountID, bootstrapCluster, err)
+		}
+	}
+
+	m.accountManager.StoreEvent(ctx, userID, provider.ID, provider.AccountID, activity.AgentNetworkProviderCreated, provider.EventMeta())
+	m.reconcile(ctx, provider.AccountID)
+
+	return provider, nil
+}
+
+func (m *managerImpl) UpdateProvider(ctx context.Context, userID string, provider *types.Provider) (*types.Provider, error) {
+	if err := m.requirePermission(ctx, provider.AccountID, userID, operations.Update); err != nil {
+		return nil, err
+	}
+
+	existing, err := m.store.GetAgentNetworkProviderByID(ctx, store.LockingStrengthUpdate, provider.AccountID, provider.ID)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get agent network provider: %w", err)
+	}
+
+	// Preserve the API key if the caller didn't rotate it. A
+	// whitespace-only value is treated as "not rotated" rather than a
+	// real key, but it must not silently overwrite a valid stored key.
+	if provider.APIKey == "" {
+		provider.APIKey = existing.APIKey
+	} else if strings.TrimSpace(provider.APIKey) == "" {
+		return nil, status.Errorf(status.InvalidArgument, "api_key must be non-blank when rotating an agent network provider")
+	}
+	// Always preserve the session keypair across updates so existing
+	// session cookies stay valid. The keys are server-managed and
+	// never surfaced through the API.
+	provider.SessionPrivateKey = existing.SessionPrivateKey
+	provider.SessionPublicKey = existing.SessionPublicKey
+	if err := ensureSessionKeys(provider); err != nil {
+		return nil, err
+	}
+	provider.CreatedAt = existing.CreatedAt
+	provider.UpdatedAt = time.Now().UTC()
+
+	if err := m.store.SaveAgentNetworkProvider(ctx, provider); err != nil {
+		return nil, fmt.Errorf("save agent network provider: %w", err)
+	}
+
+	m.accountManager.StoreEvent(ctx, userID, provider.ID, provider.AccountID, activity.AgentNetworkProviderUpdated, provider.EventMeta())
+	m.reconcile(ctx, provider.AccountID)
+
+	return provider, nil
+}
+
+func (m *managerImpl) DeleteProvider(ctx context.Context, accountID, userID, providerID string) error {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Delete); err != nil {
+		return err
+	}
+
+	provider, err := m.store.GetAgentNetworkProviderByID(ctx, store.LockingStrengthUpdate, accountID, providerID)
+	if err != nil {
+		return fmt.Errorf("failed to get agent network provider: %w", err)
+	}
+
+	// Refuse to delete while any policy still references this provider.
+	// The operator must detach it first.
+	policies, err := m.store.GetAccountAgentNetworkPolicies(ctx, store.LockingStrengthNone, accountID)
+	if err != nil {
+		return fmt.Errorf("failed to get agent network policies: %w", err)
+	}
+	var blocking []string
+	for _, p := range policies {
+		if slices.Contains(p.DestinationProviderIDs, providerID) {
+			blocking = append(blocking, p.Name)
+		}
+	}
+	if len(blocking) > 0 {
+		return status.Errorf(
+			status.InvalidArgument,
+			"provider is in use by %d %s (%s); detach it before deleting",
+			len(blocking),
+			pluralize(len(blocking), "policy", "policies"),
+			strings.Join(blocking, ", "),
+		)
+	}
+
+	if err := m.store.DeleteAgentNetworkProvider(ctx, accountID, providerID); err != nil {
+		return fmt.Errorf("failed to delete agent network provider: %w", err)
+	}
+
+	m.accountManager.StoreEvent(ctx, userID, providerID, accountID, activity.AgentNetworkProviderDeleted, provider.EventMeta())
+	m.reconcile(ctx, accountID)
+
+	return nil
+}
+
+func pluralize(n int, singular, plural string) string {
+	if n == 1 {
+		return singular
+	}
+	return plural
+}
+
+func (m *managerImpl) GetAllPolicies(ctx context.Context, accountID, userID string) ([]*types.Policy, error) {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+		return nil, err
+	}
+	return m.store.GetAccountAgentNetworkPolicies(ctx, store.LockingStrengthNone, accountID)
+}
+
+func (m *managerImpl) GetPolicy(ctx context.Context, accountID, userID, policyID string) (*types.Policy, error) {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+		return nil, err
+	}
+	return m.store.GetAgentNetworkPolicyByID(ctx, store.LockingStrengthNone, accountID, policyID)
+}
+
+func (m *managerImpl) CreatePolicy(ctx context.Context, userID string, policy *types.Policy) (*types.Policy, error) {
+	if err := m.requirePermission(ctx, policy.AccountID, userID, operations.Create); err != nil {
+		return nil, err
+	}
+
+	if policy.ID == "" {
+		fresh := types.NewPolicy(policy.AccountID)
+		policy.ID = fresh.ID
+		policy.CreatedAt = fresh.CreatedAt
+		policy.UpdatedAt = fresh.UpdatedAt
+	}
+
+	if err := m.validateProviderRefs(ctx, policy.AccountID, policy.DestinationProviderIDs); err != nil {
+		return nil, err
+	}
+
+	if err := m.store.SaveAgentNetworkPolicy(ctx, policy); err != nil {
+		return nil, fmt.Errorf("failed to save agent network policy: %w", err)
+	}
+
+	m.accountManager.StoreEvent(ctx, userID, policy.ID, policy.AccountID, activity.AgentNetworkPolicyCreated, policy.EventMeta())
+	m.reconcile(ctx, policy.AccountID)
+
+	return policy, nil
+}
+
+func (m *managerImpl) UpdatePolicy(ctx context.Context, userID string, policy *types.Policy) (*types.Policy, error) {
+	if err := m.requirePermission(ctx, policy.AccountID, userID, operations.Update); err != nil {
+		return nil, err
+	}
+
+	existing, err := m.store.GetAgentNetworkPolicyByID(ctx, store.LockingStrengthUpdate, policy.AccountID, policy.ID)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get agent network policy: %w", err)
+	}
+
+	if err := m.validateProviderRefs(ctx, policy.AccountID, policy.DestinationProviderIDs); err != nil {
+		return nil, err
+	}
+
+	policy.CreatedAt = existing.CreatedAt
+	policy.UpdatedAt = time.Now().UTC()
+
+	if err := m.store.SaveAgentNetworkPolicy(ctx, policy); err != nil {
+		return nil, fmt.Errorf("failed to save agent network policy: %w", err)
+	}
+
+	m.accountManager.StoreEvent(ctx, userID, policy.ID, policy.AccountID, activity.AgentNetworkPolicyUpdated, policy.EventMeta())
+	m.reconcile(ctx, policy.AccountID)
+
+	return policy, nil
+}
+
+func (m *managerImpl) DeletePolicy(ctx context.Context, accountID, userID, policyID string) error {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Delete); err != nil {
+		return err
+	}
+
+	policy, err := m.store.GetAgentNetworkPolicyByID(ctx, store.LockingStrengthUpdate, accountID, policyID)
+	if err != nil {
+		return fmt.Errorf("failed to get agent network policy: %w", err)
+	}
+
+	if err := m.store.DeleteAgentNetworkPolicy(ctx, accountID, policyID); err != nil {
+		return fmt.Errorf("failed to delete agent network policy: %w", err)
+	}
+
+	m.accountManager.StoreEvent(ctx, userID, policyID, accountID, activity.AgentNetworkPolicyDeleted, policy.EventMeta())
+	m.reconcile(ctx, accountID)
+
+	return nil
+}
+
+func (m *managerImpl) GetAllGuardrails(ctx context.Context, accountID, userID string) ([]*types.Guardrail, error) {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+		return nil, err
+	}
+	return m.store.GetAccountAgentNetworkGuardrails(ctx, store.LockingStrengthNone, accountID)
+}
+
+func (m *managerImpl) GetGuardrail(ctx context.Context, accountID, userID, guardrailID string) (*types.Guardrail, error) {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+		return nil, err
+	}
+	return m.store.GetAgentNetworkGuardrailByID(ctx, store.LockingStrengthNone, accountID, guardrailID)
+}
+
+func (m *managerImpl) CreateGuardrail(ctx context.Context, userID string, guardrail *types.Guardrail) (*types.Guardrail, error) {
+	if err := m.requirePermission(ctx, guardrail.AccountID, userID, operations.Create); err != nil {
+		return nil, err
+	}
+
+	if guardrail.ID == "" {
+		fresh := types.NewGuardrail(guardrail.AccountID)
+		guardrail.ID = fresh.ID
+		guardrail.CreatedAt = fresh.CreatedAt
+		guardrail.UpdatedAt = fresh.UpdatedAt
+	}
+
+	if err := m.store.SaveAgentNetworkGuardrail(ctx, guardrail); err != nil {
+		return nil, fmt.Errorf("failed to save agent network guardrail: %w", err)
+	}
+
+	m.accountManager.StoreEvent(ctx, userID, guardrail.ID, guardrail.AccountID, activity.AgentNetworkGuardrailCreated, guardrail.EventMeta())
+	m.reconcile(ctx, guardrail.AccountID)
+
+	return guardrail, nil
+}
+
+func (m *managerImpl) UpdateGuardrail(ctx context.Context, userID string, guardrail *types.Guardrail) (*types.Guardrail, error) {
+	if err := m.requirePermission(ctx, guardrail.AccountID, userID, operations.Update); err != nil {
+		return nil, err
+	}
+
+	existing, err := m.store.GetAgentNetworkGuardrailByID(ctx, store.LockingStrengthUpdate, guardrail.AccountID, guardrail.ID)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get agent network guardrail: %w", err)
+	}
+
+	guardrail.CreatedAt = existing.CreatedAt
+	guardrail.UpdatedAt = time.Now().UTC()
+
+	if err := m.store.SaveAgentNetworkGuardrail(ctx, guardrail); err != nil {
+		return nil, fmt.Errorf("failed to save agent network guardrail: %w", err)
+	}
+
+	m.accountManager.StoreEvent(ctx, userID, guardrail.ID, guardrail.AccountID, activity.AgentNetworkGuardrailUpdated, guardrail.EventMeta())
+	m.reconcile(ctx, guardrail.AccountID)
+
+	return guardrail, nil
+}
+
+func (m *managerImpl) DeleteGuardrail(ctx context.Context, accountID, userID, guardrailID string) error {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Delete); err != nil {
+		return err
+	}
+
+	guardrail, err := m.store.GetAgentNetworkGuardrailByID(ctx, store.LockingStrengthUpdate, accountID, guardrailID)
+	if err != nil {
+		return fmt.Errorf("failed to get agent network guardrail: %w", err)
+	}
+
+	if err := m.store.DeleteAgentNetworkGuardrail(ctx, accountID, guardrailID); err != nil {
+		return fmt.Errorf("failed to delete agent network guardrail: %w", err)
+	}
+
+	m.accountManager.StoreEvent(ctx, userID, guardrailID, accountID, activity.AgentNetworkGuardrailDeleted, guardrail.EventMeta())
+	m.reconcile(ctx, accountID)
+
+	return nil
+}
+
+// GetAllBudgetRules returns every account-level budget rule for the account.
+func (m *managerImpl) GetAllBudgetRules(ctx context.Context, accountID, userID string) ([]*types.AccountBudgetRule, error) {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+		return nil, err
+	}
+	return m.store.GetAccountAgentNetworkBudgetRules(ctx, store.LockingStrengthNone, accountID)
+}
+
+// GetBudgetRule returns a single account-level budget rule.
+func (m *managerImpl) GetBudgetRule(ctx context.Context, accountID, userID, ruleID string) (*types.AccountBudgetRule, error) {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+		return nil, err
+	}
+	return m.store.GetAgentNetworkBudgetRuleByID(ctx, store.LockingStrengthNone, accountID, ruleID)
+}
+
+// CreateBudgetRule persists a new account-level budget rule. Budget rules are
+// enforced at request time (CheckLLMPolicyLimits), not baked into the synth
+// proxy config, so no reconcile is needed.
+func (m *managerImpl) CreateBudgetRule(ctx context.Context, userID string, rule *types.AccountBudgetRule) (*types.AccountBudgetRule, error) {
+	if err := m.requirePermission(ctx, rule.AccountID, userID, operations.Create); err != nil {
+		return nil, err
+	}
+
+	if rule.ID == "" {
+		fresh := types.NewAccountBudgetRule(rule.AccountID)
+		rule.ID = fresh.ID
+		rule.CreatedAt = fresh.CreatedAt
+		rule.UpdatedAt = fresh.UpdatedAt
+	}
+
+	if err := m.store.SaveAgentNetworkBudgetRule(ctx, rule); err != nil {
+		return nil, fmt.Errorf("save agent network budget rule: %w", err)
+	}
+
+	m.accountManager.StoreEvent(ctx, userID, rule.ID, rule.AccountID, activity.AgentNetworkBudgetRuleCreated, rule.EventMeta())
+
+	return rule, nil
+}
+
+// UpdateBudgetRule updates an existing account-level budget rule.
+func (m *managerImpl) UpdateBudgetRule(ctx context.Context, userID string, rule *types.AccountBudgetRule) (*types.AccountBudgetRule, error) {
+	if err := m.requirePermission(ctx, rule.AccountID, userID, operations.Update); err != nil {
+		return nil, err
+	}
+
+	existing, err := m.store.GetAgentNetworkBudgetRuleByID(ctx, store.LockingStrengthUpdate, rule.AccountID, rule.ID)
+	if err != nil {
+		return nil, fmt.Errorf("get agent network budget rule: %w", err)
+	}
+
+	rule.CreatedAt = existing.CreatedAt
+	rule.UpdatedAt = time.Now().UTC()
+
+	if err := m.store.SaveAgentNetworkBudgetRule(ctx, rule); err != nil {
+		return nil, fmt.Errorf("save agent network budget rule: %w", err)
+	}
+
+	m.accountManager.StoreEvent(ctx, userID, rule.ID, rule.AccountID, activity.AgentNetworkBudgetRuleUpdated, rule.EventMeta())
+
+	return rule, nil
+}
+
+// DeleteBudgetRule removes an account-level budget rule.
+func (m *managerImpl) DeleteBudgetRule(ctx context.Context, accountID, userID, ruleID string) error {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Delete); err != nil {
+		return err
+	}
+
+	rule, err := m.store.GetAgentNetworkBudgetRuleByID(ctx, store.LockingStrengthUpdate, accountID, ruleID)
+	if err != nil {
+		return fmt.Errorf("get agent network budget rule: %w", err)
+	}
+
+	if err := m.store.DeleteAgentNetworkBudgetRule(ctx, accountID, ruleID); err != nil {
+		return fmt.Errorf("delete agent network budget rule: %w", err)
+	}
+
+	m.accountManager.StoreEvent(ctx, userID, ruleID, accountID, activity.AgentNetworkBudgetRuleDeleted, rule.EventMeta())
+
+	return nil
+}
+
+// UpdateSettings applies the mutable account-level settings — the collection
+// toggles — onto the existing row. Cluster and Subdomain are immutable and are
+// preserved from the persisted row regardless of the input. Because the
+// collection toggles change the synthesised service config (prompt-capture
+// gating, access-log emission), a reconcile is triggered so the proxy and peer
+// network maps converge on the new state.
+func (m *managerImpl) UpdateSettings(ctx context.Context, userID string, settings *types.Settings) (*types.Settings, error) {
+	if err := m.requirePermission(ctx, settings.AccountID, userID, operations.Update); err != nil {
+		return nil, err
+	}
+
+	existing, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthUpdate, settings.AccountID)
+	if err != nil {
+		return nil, fmt.Errorf("get agent network settings: %w", err)
+	}
+
+	existing.EnableLogCollection = settings.EnableLogCollection
+	existing.EnablePromptCollection = settings.EnablePromptCollection
+	existing.RedactPii = settings.RedactPii
+	existing.AccessLogRetentionDays = settings.AccessLogRetentionDays
+	existing.UpdatedAt = time.Now().UTC()
+
+	if err := m.store.SaveAgentNetworkSettings(ctx, existing); err != nil {
+		return nil, fmt.Errorf("save agent network settings: %w", err)
+	}
+
+	m.accountManager.StoreEvent(ctx, userID, settings.AccountID, settings.AccountID, activity.AgentNetworkSettingsUpdated, map[string]any{
+		"log_collection":    existing.EnableLogCollection,
+		"prompt_collection": existing.EnablePromptCollection,
+		"redact_pii":        existing.RedactPii,
+	})
+	m.reconcile(ctx, settings.AccountID)
+
+	return existing, nil
+}
+
+// validateProviderRefs ensures every destination provider id refers to a
+// provider that exists in the same account.
+func (m *managerImpl) validateProviderRefs(ctx context.Context, accountID string, providerIDs []string) error {
+	if len(providerIDs) == 0 {
+		return nil
+	}
+	for _, id := range providerIDs {
+		if _, err := m.store.GetAgentNetworkProviderByID(ctx, store.LockingStrengthNone, accountID, id); err != nil {
+			// Only a genuine not-found means the reference is invalid; a
+			// store/runtime error must propagate as-is rather than be
+			// masked as a client validation error.
+			var sErr *status.Error
+			if errors.As(err, &sErr) && sErr.Type() == status.NotFound {
+				return status.Errorf(status.InvalidArgument, "destination_provider_ids: provider %s does not exist", id)
+			}
+			return fmt.Errorf("get destination provider %s: %w", id, err)
+		}
+	}
+	return nil
+}
+
+// GetSettings returns the agent-network settings row for the account.
+// Returns the underlying status.NotFound when no row has been
+// bootstrapped yet (i.e. the account has no providers).
+func (m *managerImpl) GetSettings(ctx context.Context, accountID, userID string) (*types.Settings, error) {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+		return nil, err
+	}
+	return m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
+}
+
+// bootstrapSettingsIfNeeded creates the per-account agent-network
+// settings row when missing. The cluster comes from the create-time
+// hint the dashboard sends (auto-picked from the active cluster list);
+// the subdomain is picked from the curated wordlist avoiding
+// collisions on the same cluster. Idempotent: if a row already exists
+// it is returned untouched and the hint is ignored.
+func (m *managerImpl) bootstrapSettingsIfNeeded(ctx context.Context, accountID, providerCluster string) (*types.Settings, error) {
+	if accountID == "" {
+		return nil, fmt.Errorf("bootstrap settings: account id is required")
+	}
+	if strings.TrimSpace(providerCluster) == "" {
+		return nil, fmt.Errorf("bootstrap settings: provider cluster is required")
+	}
+
+	existing, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
+	if err == nil {
+		return existing, nil
+	}
+	var sErr *status.Error
+	if !errors.As(err, &sErr) || sErr.Type() != status.NotFound {
+		return nil, fmt.Errorf("get agent network settings: %w", err)
+	}
+
+	siblings, err := m.store.GetAgentNetworkSettingsByCluster(ctx, store.LockingStrengthNone, providerCluster)
+	if err != nil {
+		return nil, fmt.Errorf("list agent network settings on cluster: %w", err)
+	}
+	taken := make(map[string]struct{}, len(siblings))
+	for _, s := range siblings {
+		taken[s.Subdomain] = struct{}{}
+	}
+
+	suffix := accountID
+	if len(suffix) > 4 {
+		suffix = suffix[:4]
+	}
+
+	m.labelRngMu.Lock()
+	subdomain := labelgen.PickUnique(m.labelRng, taken, suffix)
+	m.labelRngMu.Unlock()
+
+	now := time.Now().UTC()
+	settings := &types.Settings{
+		AccountID: accountID,
+		Cluster:   providerCluster,
+		Subdomain: subdomain,
+		// Logs on by default; usage is collected regardless. Retention bounds
+		// how long full log rows are kept.
+		EnableLogCollection:    true,
+		AccessLogRetentionDays: types.DefaultAccessLogRetentionDays,
+		CreatedAt:              now,
+		UpdatedAt:              now,
+	}
+	if err := m.store.SaveAgentNetworkSettings(ctx, settings); err != nil {
+		return nil, fmt.Errorf("save agent network settings: %w", err)
+	}
+	return settings, nil
+}
+
+// ListConsumption returns every consumption row recorded for the
+// account, ordered window-newest-first. Backs the dashboard's basic
+// counter view; permission gate is the same Read role that gates
+// every other agent-network surface.
+func (m *managerImpl) ListConsumption(ctx context.Context, accountID, userID string) ([]*types.Consumption, error) {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+		return nil, err
+	}
+	return m.store.ListAgentNetworkConsumption(ctx, store.LockingStrengthNone, accountID)
+}
+
+// ListAccessLogs returns a paginated, server-side-filtered page of
+// agent-network access logs plus the total count matching the filter.
+func (m *managerImpl) ListAccessLogs(ctx context.Context, accountID, userID string, filter types.AgentNetworkAccessLogFilter) ([]*types.AgentNetworkAccessLog, int64, error) {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+		return nil, 0, err
+	}
+	return m.store.GetAgentNetworkAccessLogs(ctx, store.LockingStrengthNone, accountID, filter)
+}
+
+// ListAccessLogSessions returns a paginated, server-side-filtered page of
+// agent-network access logs grouped by session, plus the total number of
+// sessions matching the filter.
+func (m *managerImpl) ListAccessLogSessions(ctx context.Context, accountID, userID string, filter types.AgentNetworkAccessLogFilter) ([]*types.AgentNetworkAccessLogSession, int64, error) {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+		return nil, 0, err
+	}
+	return m.store.GetAgentNetworkAccessLogSessions(ctx, store.LockingStrengthNone, accountID, filter)
+}
+
+// GetUsageOverview returns the filtered usage rows aggregated into time buckets
+// at the requested granularity, oldest-first.
+func (m *managerImpl) GetUsageOverview(ctx context.Context, accountID, userID string, filter types.AgentNetworkAccessLogFilter, granularity types.UsageGranularity) ([]*types.AgentNetworkUsageBucket, error) {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+		return nil, err
+	}
+	rows, err := m.store.GetAgentNetworkUsageRows(ctx, store.LockingStrengthNone, accountID, filter)
+	if err != nil {
+		return nil, err
+	}
+	return types.AggregateUsageByGranularity(rows, granularity), nil
+}
+
+// StartAccessLogCleanup launches a background sweep that periodically deletes
+// each account's agent-network access-log rows older than that account's
+// AccessLogRetentionDays. Usage records are never swept. A non-positive
+// interval defaults to 24h.
+func (m *managerImpl) StartAccessLogCleanup(ctx context.Context, cleanupIntervalHours int) {
+	if cleanupIntervalHours <= 0 {
+		cleanupIntervalHours = 24
+	}
+	interval := time.Duration(cleanupIntervalHours) * time.Hour
+
+	go func() {
+		ticker := time.NewTicker(interval)
+		defer ticker.Stop()
+
+		m.cleanupAccessLogsOnce(ctx) // run once on startup
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-ticker.C:
+				m.cleanupAccessLogsOnce(ctx)
+			}
+		}
+	}()
+}
+
+// cleanupAccessLogsOnce sweeps every account's expired access-log rows against
+// its configured retention. Best-effort: a per-account failure is logged and
+// the sweep continues.
+func (m *managerImpl) cleanupAccessLogsOnce(ctx context.Context) {
+	settings, err := m.store.GetAllAgentNetworkSettings(ctx, store.LockingStrengthNone)
+	if err != nil {
+		log.WithContext(ctx).Errorf("agent-network access-log cleanup: list settings: %v", err)
+		return
+	}
+	for _, s := range settings {
+		if s.AccessLogRetentionDays <= 0 {
+			continue // keep indefinitely
+		}
+		cutoff := time.Now().UTC().AddDate(0, 0, -s.AccessLogRetentionDays)
+		deleted, err := m.store.DeleteOldAgentNetworkAccessLogs(ctx, s.AccountID, cutoff)
+		if err != nil {
+			log.WithContext(ctx).Warnf("agent-network access-log cleanup for account %s: %v", s.AccountID, err)
+			continue
+		}
+		if deleted > 0 {
+			log.WithContext(ctx).Infof("agent-network access-log cleanup: deleted %d rows for account %s (retention %d days)", deleted, s.AccountID, s.AccessLogRetentionDays)
+		}
+	}
+}
+
+// RecordConsumption increments the (dim, window) counter by the
+// supplied deltas. The window_start is computed from time.Now under
+// the supplied window_seconds so callers don't have to pre-align —
+// the proxy's post-flight path simply hands us tokens + cost and
+// which dimension we're booking against.
+func (m *managerImpl) RecordConsumption(ctx context.Context, accountID string, kind types.ConsumptionDimension, dimID string, windowSeconds, tokensIn, tokensOut int64, costUSD float64) error {
+	if accountID == "" || dimID == "" || windowSeconds <= 0 {
+		return status.Errorf(status.InvalidArgument, "account_id, dim_id and window_seconds must be set")
+	}
+	windowStart := types.WindowStart(time.Now(), windowSeconds)
+	return m.store.IncrementAgentNetworkConsumption(ctx, accountID, kind, dimID, windowSeconds, windowStart, tokensIn, tokensOut, costUSD)
+}
+
+func (m *managerImpl) requirePermission(ctx context.Context, accountID, userID string, op operations.Operation) error {
+	ok, _, err := m.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.AgentNetwork, op)
+	if err != nil {
+		return status.NewPermissionValidationError(err)
+	}
+	if !ok {
+		return status.NewPermissionDeniedError()
+	}
+	return nil
+}
+
+type mockManager struct{}
+
+// NewManagerMock returns a no-op manager useful for tests.
+func NewManagerMock() Manager {
+	return &mockManager{}
+}
+
+func (*mockManager) GetAllProviders(_ context.Context, _, _ string) ([]*types.Provider, error) {
+	return []*types.Provider{}, nil
+}
+
+func (*mockManager) GetProvider(_ context.Context, _, _, _ string) (*types.Provider, error) {
+	return &types.Provider{}, nil
+}
+
+func (*mockManager) CreateProvider(_ context.Context, _ string, p *types.Provider, _ string) (*types.Provider, error) {
+	return p, nil
+}
+
+func (*mockManager) UpdateProvider(_ context.Context, _ string, p *types.Provider) (*types.Provider, error) {
+	return p, nil
+}
+
+func (*mockManager) DeleteProvider(_ context.Context, _, _, _ string) error { return nil }
+
+func (*mockManager) GetAllPolicies(_ context.Context, _, _ string) ([]*types.Policy, error) {
+	return []*types.Policy{}, nil
+}
+
+func (*mockManager) GetPolicy(_ context.Context, _, _, _ string) (*types.Policy, error) {
+	return &types.Policy{}, nil
+}
+
+func (*mockManager) CreatePolicy(_ context.Context, _ string, p *types.Policy) (*types.Policy, error) {
+	return p, nil
+}
+
+func (*mockManager) UpdatePolicy(_ context.Context, _ string, p *types.Policy) (*types.Policy, error) {
+	return p, nil
+}
+
+func (*mockManager) DeletePolicy(_ context.Context, _, _, _ string) error { return nil }
+
+func (*mockManager) GetAllGuardrails(_ context.Context, _, _ string) ([]*types.Guardrail, error) {
+	return []*types.Guardrail{}, nil
+}
+
+func (*mockManager) GetGuardrail(_ context.Context, _, _, _ string) (*types.Guardrail, error) {
+	return &types.Guardrail{}, nil
+}
+
+func (*mockManager) CreateGuardrail(_ context.Context, _ string, g *types.Guardrail) (*types.Guardrail, error) {
+	return g, nil
+}
+
+func (*mockManager) UpdateGuardrail(_ context.Context, _ string, g *types.Guardrail) (*types.Guardrail, error) {
+	return g, nil
+}
+
+func (*mockManager) DeleteGuardrail(_ context.Context, _, _, _ string) error { return nil }
+
+func (*mockManager) GetAllBudgetRules(_ context.Context, _, _ string) ([]*types.AccountBudgetRule, error) {
+	return []*types.AccountBudgetRule{}, nil
+}
+
+func (*mockManager) GetBudgetRule(_ context.Context, _, _, _ string) (*types.AccountBudgetRule, error) {
+	return &types.AccountBudgetRule{}, nil
+}
+
+func (*mockManager) CreateBudgetRule(_ context.Context, _ string, r *types.AccountBudgetRule) (*types.AccountBudgetRule, error) {
+	return r, nil
+}
+
+func (*mockManager) UpdateBudgetRule(_ context.Context, _ string, r *types.AccountBudgetRule) (*types.AccountBudgetRule, error) {
+	return r, nil
+}
+
+func (*mockManager) DeleteBudgetRule(_ context.Context, _, _, _ string) error { return nil }
+
+func (*mockManager) GetSettings(_ context.Context, _, _ string) (*types.Settings, error) {
+	return nil, status.Errorf(status.NotFound, "agent network settings not found")
+}
+
+func (*mockManager) UpdateSettings(_ context.Context, _ string, s *types.Settings) (*types.Settings, error) {
+	return s, nil
+}
+
+func (*mockManager) ListConsumption(_ context.Context, _, _ string) ([]*types.Consumption, error) {
+	return nil, nil
+}
+
+func (*mockManager) ListAccessLogs(_ context.Context, _, _ string, _ types.AgentNetworkAccessLogFilter) ([]*types.AgentNetworkAccessLog, int64, error) {
+	return nil, 0, nil
+}
+
+func (*mockManager) ListAccessLogSessions(_ context.Context, _, _ string, _ types.AgentNetworkAccessLogFilter) ([]*types.AgentNetworkAccessLogSession, int64, error) {
+	return nil, 0, nil
+}
+
+func (*mockManager) GetUsageOverview(_ context.Context, _, _ string, _ types.AgentNetworkAccessLogFilter, _ types.UsageGranularity) ([]*types.AgentNetworkUsageBucket, error) {
+	return nil, nil
+}
+
+func (*mockManager) StartAccessLogCleanup(_ context.Context, _ int) {}
+
+func (*mockManager) RecordConsumption(_ context.Context, _ string, _ types.ConsumptionDimension, _ string, _, _, _ int64, _ float64) error {
+	return nil
+}
+
+func (*mockManager) RecordAccountBudgetUsage(_ context.Context, _, _ string, _ []string, _, _ int64, _ float64) error {
+	return nil
+}
+
+func (*mockManager) RecordUsage(_ context.Context, _ RecordUsageInput) error {
+	return nil
+}
diff --git a/management/internals/modules/agentnetwork/policyselect.go b/management/internals/modules/agentnetwork/policyselect.go
new file mode 100644
index 000000000..9203a1910
--- /dev/null
+++ b/management/internals/modules/agentnetwork/policyselect.go
@@ -0,0 +1,660 @@
+package agentnetwork
+
+import (
+	"context"
+	"fmt"
+	"math"
+	"sort"
+	"time"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// validateUsageDeltas rejects negative or non-finite usage counters before they
+// reach the consumption store, so a bad delta can't decrement or poison totals.
+// The store batch method enforces the same invariant; this is the manager-level
+// guard so direct callers fail fast with a clear error.
+func validateUsageDeltas(tokensIn, tokensOut int64, costUSD float64) error {
+	if tokensIn < 0 || tokensOut < 0 || costUSD < 0 || math.IsNaN(costUSD) || math.IsInf(costUSD, 0) {
+		return status.Errorf(status.InvalidArgument, "usage deltas must be non-negative and finite")
+	}
+	return nil
+}
+
+// Deny codes the proxy surfaces back to the caller when every
+// applicable policy is exhausted. The proxy converts these into
+// upstream-shaped error responses.
+const (
+	//nolint:gosec // policy deny code label, not a credential
+	denyCodeTokenCapExceeded = "llm_policy.token_cap_exceeded"
+	//nolint:gosec // policy deny code label, not a credential
+	denyCodeBudgetCapExceeded = "llm_policy.budget_cap_exceeded"
+	//nolint:gosec // account deny code label, not a credential
+	denyCodeAccountTokenCapExceeded = "llm_account.token_cap_exceeded"
+	//nolint:gosec // account deny code label, not a credential
+	denyCodeAccountBudgetCapExceeded = "llm_account.budget_cap_exceeded"
+)
+
+// consumptionCache holds the consumption counters prefetched for one
+// policy-selection request, keyed by ConsumptionKey. A miss returns a zero
+// counter — the same contract the store's single-row getter uses for absent
+// rows — so the eval logic is identical whether a counter exists yet or not.
+type consumptionCache map[types.ConsumptionKey]*types.Consumption
+
+func (c consumptionCache) get(accountID string, kind types.ConsumptionDimension, dimID string, windowSeconds int64, windowStart time.Time) *types.Consumption {
+	key := types.ConsumptionKey{Kind: kind, DimID: dimID, WindowSeconds: windowSeconds, WindowStartUTC: windowStart.UTC()}
+	if row, ok := c[key]; ok && row != nil {
+		return row
+	}
+	return &types.Consumption{
+		AccountID:      accountID,
+		DimensionKind:  kind,
+		DimensionID:    dimID,
+		WindowSeconds:  windowSeconds,
+		WindowStartUTC: windowStart.UTC(),
+	}
+}
+
+// addLimitKeys records the user/group consumption keys a single enabled (token
+// or budget) limit window reads for the given attribution group, into a dedup
+// set. attrGroup may be empty (no group dimension applies).
+func addLimitKeys(set map[types.ConsumptionKey]struct{}, userID, attrGroup string, windowSeconds int64, now time.Time) {
+	if windowSeconds <= 0 {
+		return
+	}
+	ws := types.WindowStart(now, windowSeconds)
+	if userID != "" {
+		set[types.ConsumptionKey{Kind: types.DimensionUser, DimID: userID, WindowSeconds: windowSeconds, WindowStartUTC: ws}] = struct{}{}
+	}
+	if attrGroup != "" {
+		set[types.ConsumptionKey{Kind: types.DimensionGroup, DimID: attrGroup, WindowSeconds: windowSeconds, WindowStartUTC: ws}] = struct{}{}
+	}
+}
+
+// prefetchConsumption loads, in one store round-trip, every consumption counter
+// that the account-budget ceiling and the candidate policies will read while
+// scoring this request. This replaces the per-cap point reads the selector
+// previously issued one at a time (the N+1 on the hot path).
+func (m *managerImpl) prefetchConsumption(ctx context.Context, in PolicySelectionInput, rules []*types.AccountBudgetRule, candidates []*types.Policy, now time.Time) (consumptionCache, error) {
+	set := make(map[types.ConsumptionKey]struct{})
+	for _, p := range candidates {
+		attr := lowestIntersect(p.SourceGroups, in.GroupIDs)
+		if p.Limits.TokenLimit.Enabled {
+			addLimitKeys(set, in.UserID, attr, p.Limits.TokenLimit.WindowSeconds, now)
+		}
+		if p.Limits.BudgetLimit.Enabled {
+			addLimitKeys(set, in.UserID, attr, p.Limits.BudgetLimit.WindowSeconds, now)
+		}
+	}
+	for _, r := range rules {
+		if r == nil || !r.Enabled || !budgetRuleApplies(r, in) {
+			continue
+		}
+		attr := lowestIntersect(r.TargetGroups, in.GroupIDs)
+		if r.Limits.TokenLimit.Enabled {
+			addLimitKeys(set, in.UserID, attr, r.Limits.TokenLimit.WindowSeconds, now)
+		}
+		if r.Limits.BudgetLimit.Enabled {
+			addLimitKeys(set, in.UserID, attr, r.Limits.BudgetLimit.WindowSeconds, now)
+		}
+	}
+	if len(set) == 0 {
+		return consumptionCache{}, nil
+	}
+	keys := make([]types.ConsumptionKey, 0, len(set))
+	for k := range set {
+		keys = append(keys, k)
+	}
+	rows, err := m.store.GetAgentNetworkConsumptionBatch(ctx, store.LockingStrengthNone, in.AccountID, keys)
+	if err != nil {
+		return nil, fmt.Errorf("batch read consumption: %w", err)
+	}
+	return consumptionCache(rows), nil
+}
+
+// SelectPolicyForRequest picks the policy that "pays" for the
+// incoming request. The chosen policy is the one with the largest
+// pool that still has headroom — drain the bigger bucket first,
+// fall through to the next-biggest only when the current one's
+// group cap or shared per-user cap is exhausted. This matches
+// operator intuition for layered tiers ("privileged group has the
+// 10k budget, regular group has 1k as the safety net") and avoids
+// the load-balancer flapping that fraction-based scoring produces
+// once any cap has been touched.
+//
+// Ordering across non-exhausted candidates:
+//  1. Policies with NO enabled caps (catch-all-allow) win over any
+//     capped policy — operators who configure unlimited access
+//     expect requests to attribute there until they explicitly add
+//     caps.
+//  2. Larger group token cap wins.
+//  3. Larger group budget USD cap wins.
+//  4. Larger user token cap wins.
+//  5. Larger user budget USD cap wins.
+//  6. Older created_at wins (deterministic final tiebreak so
+//     multi-node selection converges).
+//
+// Returns Allow=true with empty SelectedPolicyID when no policy in
+// the account targets the (provider, caller-groups) combination —
+// llm_router is the gate that owns "no policy authorises this
+// request" semantics; this function trusts that authorisation has
+// already happened upstream and only does the limit-aware
+// attribution.
+func (m *managerImpl) SelectPolicyForRequest(ctx context.Context, in PolicySelectionInput) (*PolicySelectionResult, error) {
+	if in.AccountID == "" {
+		return nil, status.Errorf(status.InvalidArgument, "account_id is required")
+	}
+
+	now := time.Now().UTC()
+
+	rules, err := m.store.GetAccountAgentNetworkBudgetRules(ctx, store.LockingStrengthNone, in.AccountID)
+	if err != nil {
+		return nil, fmt.Errorf("list account budget rules: %w", err)
+	}
+	policies, err := m.store.GetAccountAgentNetworkPolicies(ctx, store.LockingStrengthNone, in.AccountID)
+	if err != nil {
+		return nil, fmt.Errorf("list account policies: %w", err)
+	}
+	candidates := filterApplicablePolicies(policies, in)
+
+	// Prefetch every consumption counter the ceiling + candidate policies will
+	// read, in a single store round-trip, then score against the cache.
+	cache, err := m.prefetchConsumption(ctx, in, rules, candidates, now)
+	if err != nil {
+		return nil, err
+	}
+
+	// Account-level budget rules are an always-on ceiling, evaluated
+	// independently of policy selection (they bind even for catch-all-allow
+	// policies or requests that match no policy). All applicable rules must
+	// pass — this is where min-wins lives.
+	if deny, code, reason := checkAccountBudget(in, rules, cache, now); deny {
+		return &PolicySelectionResult{Allow: false, DenyCode: code, DenyReason: reason}, nil
+	}
+
+	if len(candidates) == 0 {
+		return &PolicySelectionResult{Allow: true}, nil
+	}
+	scored, lastDenyCode, lastDenyReason := scoreCandidates(in, candidates, cache, now)
+	if len(scored) == 0 {
+		return &PolicySelectionResult{
+			Allow:      false,
+			DenyCode:   lastDenyCode,
+			DenyReason: lastDenyReason,
+		}, nil
+	}
+
+	sort.SliceStable(scored, func(i, j int) bool {
+		// Catch-all-allow (no caps configured) wins outright over
+		// any capped policy.
+		iNoCap := isUncapped(scored[i].policy)
+		jNoCap := isUncapped(scored[j].policy)
+		if iNoCap != jNoCap {
+			return iNoCap
+		}
+		// Bigger pool drains first. Group caps dominate (shared
+		// across the group) before individual caps.
+		if a, b := groupCapTokens(scored[i].policy), groupCapTokens(scored[j].policy); a != b {
+			return a > b
+		}
+		if a, b := groupCapBudgetUsd(scored[i].policy), groupCapBudgetUsd(scored[j].policy); a != b {
+			return a > b
+		}
+		if a, b := userCapTokens(scored[i].policy), userCapTokens(scored[j].policy); a != b {
+			return a > b
+		}
+		if a, b := userCapBudgetUsd(scored[i].policy), userCapBudgetUsd(scored[j].policy); a != b {
+			return a > b
+		}
+		return scored[i].policy.CreatedAt.Before(scored[j].policy.CreatedAt)
+	})
+
+	winner := scored[0]
+	return &PolicySelectionResult{
+		Allow:              true,
+		SelectedPolicyID:   winner.policy.ID,
+		AttributionGroupID: winner.attributionGroup,
+		WindowSeconds:      winner.windowSeconds,
+	}, nil
+}
+
+// filterApplicablePolicies returns the enabled policies that target
+// the requested provider and have at least one of the caller's groups
+// in their source_groups. Caller's group set is matched
+// case-sensitively against policy.SourceGroups.
+func filterApplicablePolicies(policies []*types.Policy, in PolicySelectionInput) []*types.Policy {
+	if len(policies) == 0 {
+		return nil
+	}
+	groupSet := make(map[string]struct{}, len(in.GroupIDs))
+	for _, g := range in.GroupIDs {
+		if g != "" {
+			groupSet[g] = struct{}{}
+		}
+	}
+	out := make([]*types.Policy, 0, len(policies))
+	for _, p := range policies {
+		if p == nil || !p.Enabled {
+			continue
+		}
+		if !sliceContains(p.DestinationProviderIDs, in.ProviderID) {
+			continue
+		}
+		if !anyGroupMatches(p.SourceGroups, groupSet) {
+			continue
+		}
+		out = append(out, p)
+	}
+	return out
+}
+
+// candidate is the per-policy intermediate the selector ranks. A
+// policy that's been exhausted on any enabled cap never makes it
+// into this slice; the selector's deny envelope carries the latest
+// exhaustion's reason out separately.
+type candidate struct {
+	policy           *types.Policy
+	attributionGroup string
+	windowSeconds    int64
+}
+
+// scoreCandidates evaluates every applicable policy against the
+// caller's current consumption. Exhausted policies are filtered out
+// of the returned slice; the most recent exhaustion's deny code +
+// human reason is returned alongside so the caller can surface it
+// when no candidate survives.
+func scoreCandidates(
+	in PolicySelectionInput,
+	candidates []*types.Policy,
+	cache consumptionCache,
+	now time.Time,
+) ([]candidate, string, string) {
+	out := make([]candidate, 0, len(candidates))
+	var lastDenyCode, lastDenyReason string
+
+	for _, p := range candidates {
+		c, exhausted, denyCode, denyReason := scoreOne(in, p, cache, now)
+		if exhausted {
+			lastDenyCode = denyCode
+			lastDenyReason = denyReason
+			continue
+		}
+		out = append(out, c)
+	}
+	return out, lastDenyCode, lastDenyReason
+}
+
+// scoreOne checks a single policy for cap exhaustion. Returns the
+// candidate envelope when the policy still has headroom on every
+// enabled cap; reports exhausted=true with a deny code naming the
+// offending cap kind otherwise.
+func scoreOne(
+	in PolicySelectionInput,
+	p *types.Policy,
+	cache consumptionCache,
+	now time.Time,
+) (candidate, bool, string, string) {
+	attrGroup := lowestIntersect(p.SourceGroups, in.GroupIDs)
+	c := candidate{
+		policy:           p,
+		attributionGroup: attrGroup,
+		windowSeconds:    effectiveWindowSeconds(p),
+	}
+
+	if p.Limits.TokenLimit.Enabled && p.Limits.TokenLimit.WindowSeconds > 0 {
+		if exhausted, reason := evalTokenCap(cache, in.AccountID, in.UserID, attrGroup, p.Limits.TokenLimit, now, "policy "+p.ID); exhausted {
+			return candidate{}, true, denyCodeTokenCapExceeded, reason
+		}
+	}
+
+	if p.Limits.BudgetLimit.Enabled && p.Limits.BudgetLimit.WindowSeconds > 0 {
+		if exhausted, reason := evalBudgetCap(cache, in.AccountID, in.UserID, attrGroup, p.Limits.BudgetLimit, now, "policy "+p.ID); exhausted {
+			return candidate{}, true, denyCodeBudgetCapExceeded, reason
+		}
+	}
+
+	return c, false, "", ""
+}
+
+// evalTokenCap reports whether the token limit is already exhausted for the
+// caller in its own window. attrGroup may be empty (no group dimension applies).
+// label identifies the cap source ("policy <id>" or "account rule <id>") for the
+// deny reason. It is the shared primitive behind both policy and account-rule
+// enforcement.
+func evalTokenCap(
+	cache consumptionCache,
+	accountID, userID, attrGroup string,
+	tl types.PolicyTokenLimit,
+	now time.Time,
+	label string,
+) (bool, string) {
+	windowStart := types.WindowStart(now, tl.WindowSeconds)
+
+	if tl.UserCap > 0 && userID != "" {
+		row := cache.get(accountID, types.DimensionUser, userID, tl.WindowSeconds, windowStart)
+		used := row.TokensInput + row.TokensOutput
+		if used >= tl.UserCap {
+			return true, fmt.Sprintf("user token cap exhausted on %s (used %d of %d)", label, used, tl.UserCap)
+		}
+	}
+
+	if tl.GroupCap > 0 && attrGroup != "" {
+		row := cache.get(accountID, types.DimensionGroup, attrGroup, tl.WindowSeconds, windowStart)
+		used := row.TokensInput + row.TokensOutput
+		if used >= tl.GroupCap {
+			return true, fmt.Sprintf("group token cap exhausted on %s (used %d of %d)", label, used, tl.GroupCap)
+		}
+	}
+
+	return false, ""
+}
+
+// evalBudgetCap is the budget (USD) counterpart of evalTokenCap.
+func evalBudgetCap(
+	cache consumptionCache,
+	accountID, userID, attrGroup string,
+	bl types.PolicyBudgetLimit,
+	now time.Time,
+	label string,
+) (bool, string) {
+	windowStart := types.WindowStart(now, bl.WindowSeconds)
+
+	if bl.UserCapUsd > 0 && userID != "" {
+		row := cache.get(accountID, types.DimensionUser, userID, bl.WindowSeconds, windowStart)
+		if row.CostUSD >= bl.UserCapUsd {
+			return true, fmt.Sprintf("user budget cap exhausted on %s (used $%.4f of $%.4f)", label, row.CostUSD, bl.UserCapUsd)
+		}
+	}
+
+	if bl.GroupCapUsd > 0 && attrGroup != "" {
+		row := cache.get(accountID, types.DimensionGroup, attrGroup, bl.WindowSeconds, windowStart)
+		if row.CostUSD >= bl.GroupCapUsd {
+			return true, fmt.Sprintf("group budget cap exhausted on %s (used $%.4f of $%.4f)", label, row.CostUSD, bl.GroupCapUsd)
+		}
+	}
+
+	return false, ""
+}
+
+// checkAccountBudget evaluates every applicable account-level budget rule as an
+// all-must-pass ceiling. A rule applies when the caller is in its TargetUsers,
+// one of its TargetGroups, or it has no targets at all (account-wide). Returns
+// deny=true with an llm_account.* code on the first exhausted rule. Group caps
+// attribute to the lowest intersecting group (the same model policies use), so
+// multi-group behavior is unchanged.
+func checkAccountBudget(in PolicySelectionInput, rules []*types.AccountBudgetRule, cache consumptionCache, now time.Time) (bool, string, string) {
+	for _, r := range rules {
+		if r == nil || !r.Enabled || !budgetRuleApplies(r, in) {
+			continue
+		}
+		attrGroup := lowestIntersect(r.TargetGroups, in.GroupIDs)
+		label := "account rule " + r.ID
+
+		if r.Limits.TokenLimit.Enabled && r.Limits.TokenLimit.WindowSeconds > 0 {
+			if exhausted, reason := evalTokenCap(cache, in.AccountID, in.UserID, attrGroup, r.Limits.TokenLimit, now, label); exhausted {
+				return true, denyCodeAccountTokenCapExceeded, reason
+			}
+		}
+
+		if r.Limits.BudgetLimit.Enabled && r.Limits.BudgetLimit.WindowSeconds > 0 {
+			if exhausted, reason := evalBudgetCap(cache, in.AccountID, in.UserID, attrGroup, r.Limits.BudgetLimit, now, label); exhausted {
+				return true, denyCodeAccountBudgetCapExceeded, reason
+			}
+		}
+	}
+
+	return false, "", ""
+}
+
+// budgetRuleApplies reports whether an account budget rule binds the caller:
+// a direct user match, a group intersection, or an untargeted (account-wide)
+// rule.
+func budgetRuleApplies(r *types.AccountBudgetRule, in PolicySelectionInput) bool {
+	if len(r.TargetUsers) == 0 && len(r.TargetGroups) == 0 {
+		return true
+	}
+	if in.UserID != "" && sliceContains(r.TargetUsers, in.UserID) {
+		return true
+	}
+	groupSet := make(map[string]struct{}, len(in.GroupIDs))
+	for _, g := range in.GroupIDs {
+		if g != "" {
+			groupSet[g] = struct{}{}
+		}
+	}
+	return anyGroupMatches(r.TargetGroups, groupSet)
+}
+
+// RecordAccountBudgetUsage fans the served request's usage out to every
+// applicable account budget rule's own (dimension, window) counter. The user
+// dimension is always booked when a rule has a user-applicable cap; the group
+// dimension books against the rule's lowest intersecting group. This runs
+// alongside the policy-window record so account ceilings accumulate in their own
+// windows (commonly monthly) independently of the per-policy window.
+func (m *managerImpl) RecordAccountBudgetUsage(ctx context.Context, accountID, userID string, groupIDs []string, tokensIn, tokensOut int64, costUSD float64) error {
+	if accountID == "" {
+		return status.Errorf(status.InvalidArgument, "account_id is required")
+	}
+	if err := validateUsageDeltas(tokensIn, tokensOut, costUSD); err != nil {
+		return err
+	}
+	rules, err := m.store.GetAccountAgentNetworkBudgetRules(ctx, store.LockingStrengthNone, accountID)
+	if err != nil {
+		return fmt.Errorf("list account budget rules: %w", err)
+	}
+	set := make(map[types.ConsumptionKey]struct{})
+	addAccountBudgetKeys(set, PolicySelectionInput{AccountID: accountID, UserID: userID, GroupIDs: groupIDs}, rules, time.Now().UTC())
+	if len(set) == 0 {
+		return nil
+	}
+	return m.store.IncrementAgentNetworkConsumptionBatch(ctx, accountID, keysSlice(set), tokensIn, tokensOut, costUSD)
+}
+
+// RecordUsageInput carries everything RecordUsage books for one served request.
+type RecordUsageInput struct {
+	AccountID          string
+	UserID             string
+	AttributionGroupID string // selected policy's attribution group (policy window)
+	GroupIDs           []string
+	WindowSeconds      int64 // selected policy's window; 0 means no policy cap
+	TokensIn           int64
+	TokensOut          int64
+	CostUSD            float64
+}
+
+// RecordUsage books a served request's usage against every counter it touches —
+// the selected policy's per-(user, group) window plus every applicable account
+// budget rule's own window — deduplicated and written in a single transaction.
+// Two counters that collapse to the same (dimension, window) tuple are booked
+// once, so a single request can never double-count against one cap.
+func (m *managerImpl) RecordUsage(ctx context.Context, in RecordUsageInput) error {
+	if in.AccountID == "" {
+		return status.Errorf(status.InvalidArgument, "account_id is required")
+	}
+	if err := validateUsageDeltas(in.TokensIn, in.TokensOut, in.CostUSD); err != nil {
+		return err
+	}
+	now := time.Now().UTC()
+	set := make(map[types.ConsumptionKey]struct{})
+
+	// Policy-window dimensions are booked only when a policy cap bound this
+	// request (window > 0). A zero window means catch-all-allow / no policy cap;
+	// the account fan-out below still books against the budget rules' windows.
+	if in.WindowSeconds > 0 {
+		addLimitKeys(set, in.UserID, in.AttributionGroupID, in.WindowSeconds, now)
+	}
+
+	rules, err := m.store.GetAccountAgentNetworkBudgetRules(ctx, store.LockingStrengthNone, in.AccountID)
+	if err != nil {
+		return fmt.Errorf("list account budget rules: %w", err)
+	}
+	addAccountBudgetKeys(set, PolicySelectionInput{AccountID: in.AccountID, UserID: in.UserID, GroupIDs: in.GroupIDs}, rules, now)
+
+	if len(set) == 0 {
+		return nil
+	}
+	return m.store.IncrementAgentNetworkConsumptionBatch(ctx, in.AccountID, keysSlice(set), in.TokensIn, in.TokensOut, in.CostUSD)
+}
+
+// addAccountBudgetKeys adds the (dimension, window) keys a served request books
+// against every applicable account budget rule into the dedup set.
+func addAccountBudgetKeys(set map[types.ConsumptionKey]struct{}, in PolicySelectionInput, rules []*types.AccountBudgetRule, now time.Time) {
+	for _, r := range rules {
+		if r == nil || !r.Enabled || !budgetRuleApplies(r, in) {
+			continue
+		}
+		attrGroup := lowestIntersect(r.TargetGroups, in.GroupIDs)
+		for _, window := range ruleWindows(r) {
+			addLimitKeys(set, in.UserID, attrGroup, window, now)
+		}
+	}
+}
+
+// keysSlice flattens a ConsumptionKey set into a slice.
+func keysSlice(set map[types.ConsumptionKey]struct{}) []types.ConsumptionKey {
+	keys := make([]types.ConsumptionKey, 0, len(set))
+	for k := range set {
+		keys = append(keys, k)
+	}
+	return keys
+}
+
+// ruleWindows returns the distinct enabled window lengths a budget rule books
+// against (token window and/or budget window, deduplicated).
+func ruleWindows(r *types.AccountBudgetRule) []int64 {
+	var windows []int64
+	if r.Limits.TokenLimit.Enabled && r.Limits.TokenLimit.WindowSeconds > 0 {
+		windows = append(windows, r.Limits.TokenLimit.WindowSeconds)
+	}
+	if r.Limits.BudgetLimit.Enabled && r.Limits.BudgetLimit.WindowSeconds > 0 {
+		bw := r.Limits.BudgetLimit.WindowSeconds
+		if len(windows) == 0 || windows[0] != bw {
+			windows = append(windows, bw)
+		}
+	}
+	return windows
+}
+
+// effectiveWindowSeconds returns the window length the proxy should
+// hand back to RecordLLMUsage. When both halves are enabled with
+// different windows, token_limit wins (the more common config); when
+// only one is enabled that one wins; when neither is enabled the
+// returned value is 0 — RecordLLMUsage treats 0 as "no limit
+// tracking" and skips the increment, which is the right pass-through
+// for catch-all-allow policies with no caps configured.
+func effectiveWindowSeconds(p *types.Policy) int64 {
+	if p.Limits.TokenLimit.Enabled && p.Limits.TokenLimit.WindowSeconds > 0 {
+		return p.Limits.TokenLimit.WindowSeconds
+	}
+	if p.Limits.BudgetLimit.Enabled && p.Limits.BudgetLimit.WindowSeconds > 0 {
+		return p.Limits.BudgetLimit.WindowSeconds
+	}
+	return 0
+}
+
+// lowestIntersect returns the lowest-by-string-sort element of
+// callerGroups ∩ sourceGroups. Empty when the intersection is empty.
+// Lowest is deterministic so multi-node selection converges.
+func lowestIntersect(sourceGroups, callerGroups []string) string {
+	if len(sourceGroups) == 0 || len(callerGroups) == 0 {
+		return ""
+	}
+	srcSet := make(map[string]struct{}, len(sourceGroups))
+	for _, g := range sourceGroups {
+		srcSet[g] = struct{}{}
+	}
+	var best string
+	for _, g := range callerGroups {
+		if _, ok := srcSet[g]; !ok {
+			continue
+		}
+		if best == "" || g < best {
+			best = g
+		}
+	}
+	return best
+}
+
+func anyGroupMatches(sourceGroups []string, callerSet map[string]struct{}) bool {
+	for _, g := range sourceGroups {
+		if _, ok := callerSet[g]; ok {
+			return true
+		}
+	}
+	return false
+}
+
+// isUncapped reports whether a policy has any enabled cap with a
+// positive limit value. Mirrors the eval functions' guards: a policy
+// with token_limit.enabled=true but every cap value at 0 still
+// counts as uncapped because the eval would query nothing and bind
+// nothing.
+func isUncapped(p *types.Policy) bool {
+	tl := p.Limits.TokenLimit
+	if tl.Enabled && tl.WindowSeconds > 0 && (tl.GroupCap > 0 || tl.UserCap > 0) {
+		return false
+	}
+	bl := p.Limits.BudgetLimit
+	if bl.Enabled && bl.WindowSeconds > 0 && (bl.GroupCapUsd > 0 || bl.UserCapUsd > 0) {
+		return false
+	}
+	return true
+}
+
+// groupCapTokens returns the policy's group-token cap when the token
+// limit is enabled, zero otherwise. Drives the primary "bigger pool
+// first" sort.
+func groupCapTokens(p *types.Policy) int64 {
+	if p.Limits.TokenLimit.Enabled {
+		return p.Limits.TokenLimit.GroupCap
+	}
+	return 0
+}
+
+// groupCapBudgetUsd returns the policy's group-budget cap in USD
+// when the budget limit is enabled, zero otherwise. Secondary sort
+// key after token group cap so budget-only policies still order
+// predictably.
+func groupCapBudgetUsd(p *types.Policy) float64 {
+	if p.Limits.BudgetLimit.Enabled {
+		return p.Limits.BudgetLimit.GroupCapUsd
+	}
+	return 0
+}
+
+// userCapTokens returns the policy's per-user token cap when the
+// token limit is enabled, zero otherwise. Tertiary sort key, used
+// when group caps tie or are absent.
+func userCapTokens(p *types.Policy) int64 {
+	if p.Limits.TokenLimit.Enabled {
+		return p.Limits.TokenLimit.UserCap
+	}
+	return 0
+}
+
+// userCapBudgetUsd returns the policy's per-user budget cap in USD
+// when the budget limit is enabled, zero otherwise. Quaternary sort
+// key for budget-only policies whose group caps tie or are absent.
+func userCapBudgetUsd(p *types.Policy) float64 {
+	if p.Limits.BudgetLimit.Enabled {
+		return p.Limits.BudgetLimit.UserCapUsd
+	}
+	return 0
+}
+
+func sliceContains(haystack []string, needle string) bool {
+	for _, v := range haystack {
+		if v == needle {
+			return true
+		}
+	}
+	return false
+}
+
+// mockManager fallback so tests that don't care about selection still
+// compile.
+func (*mockManager) SelectPolicyForRequest(_ context.Context, _ PolicySelectionInput) (*PolicySelectionResult, error) {
+	return &PolicySelectionResult{Allow: true}, nil
+}
diff --git a/management/internals/modules/agentnetwork/policyselect_account_realstore_test.go b/management/internals/modules/agentnetwork/policyselect_account_realstore_test.go
new file mode 100644
index 000000000..c3b13a6cc
--- /dev/null
+++ b/management/internals/modules/agentnetwork/policyselect_account_realstore_test.go
@@ -0,0 +1,181 @@
+package agentnetwork
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/server/store"
+)
+
+// GC-2 no-mock enforcement tests for the account-budget ceiling. They drive the
+// real store + real consumption accounting through SelectPolicyForRequest and
+// RecordAccountBudgetUsage, asserting min-wins (account binds independently of
+// policy), targeting (groups + direct users), and the record fan-out.
+
+func accountWideUserTokenRule(id string, userCap, window int64) *types.AccountBudgetRule {
+	r := types.NewAccountBudgetRule(realSelectAccount)
+	r.ID = id
+	r.Limits.TokenLimit = types.PolicyTokenLimit{Enabled: true, UserCap: userCap, WindowSeconds: window}
+	return r
+}
+
+// TestSelectPolicy_RealStore_AccountCeilingBindsEvenWithUncappedPolicy proves
+// min-wins: the account user ceiling denies once exhausted even though a
+// catch-all-allow (uncapped) policy would otherwise pass the request. The
+// account gate runs independently of and ahead of policy selection.
+func TestSelectPolicy_RealStore_AccountCeilingBindsEvenWithUncappedPolicy(t *testing.T) {
+	mgr, s := newRealSelectorMgr(t)
+	ctx := context.Background()
+
+	// An uncapped (catch-all-allow) policy: enabled token limit, zero caps.
+	uncapped := capPolicy("pol-open", realSelectAccount, []string{"grp-eng"}, "prov-1", 0, 86_400)
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, uncapped))
+
+	// Account-wide user ceiling of 100 tokens in an hourly window.
+	require.NoError(t, s.SaveAgentNetworkBudgetRule(ctx, accountWideUserTokenRule("ainbud-1", 100, 3_600)))
+
+	in := PolicySelectionInput{AccountID: realSelectAccount, UserID: "user-1", GroupIDs: []string{"grp-eng"}, ProviderID: "prov-1"}
+
+	// Fresh: account ceiling has headroom, uncapped policy wins.
+	res, err := mgr.SelectPolicyForRequest(ctx, in)
+	require.NoError(t, err)
+	assert.True(t, res.Allow, "fresh account ceiling must allow")
+
+	// Drain the account user ceiling via the fan-out path.
+	require.NoError(t, mgr.RecordAccountBudgetUsage(ctx, realSelectAccount, "user-1", []string{"grp-eng"}, 100, 0, 0))
+
+	res, err = mgr.SelectPolicyForRequest(ctx, in)
+	require.NoError(t, err)
+	assert.False(t, res.Allow, "account ceiling must deny even though the policy is uncapped (min-wins)")
+	assert.Equal(t, denyCodeAccountTokenCapExceeded, res.DenyCode, "deny must carry the llm_account.* code")
+}
+
+// TestSelectPolicy_RealStore_AccountGroupCeiling proves a group-targeted rule
+// binds the caller's group dimension.
+func TestSelectPolicy_RealStore_AccountGroupCeiling(t *testing.T) {
+	mgr, s := newRealSelectorMgr(t)
+	ctx := context.Background()
+
+	rule := types.NewAccountBudgetRule(realSelectAccount)
+	rule.ID = "ainbud-grp"
+	rule.TargetGroups = []string{"grp-eng"}
+	rule.Limits.BudgetLimit = types.PolicyBudgetLimit{Enabled: true, GroupCapUsd: 5.0, WindowSeconds: 2_592_000}
+	require.NoError(t, s.SaveAgentNetworkBudgetRule(ctx, rule))
+
+	in := PolicySelectionInput{AccountID: realSelectAccount, UserID: "user-1", GroupIDs: []string{"grp-eng"}, ProviderID: "prov-1"}
+
+	res, err := mgr.SelectPolicyForRequest(ctx, in)
+	require.NoError(t, err)
+	assert.True(t, res.Allow, "fresh group ceiling must allow")
+
+	require.NoError(t, mgr.RecordAccountBudgetUsage(ctx, realSelectAccount, "user-1", []string{"grp-eng"}, 0, 0, 5.0))
+
+	res, err = mgr.SelectPolicyForRequest(ctx, in)
+	require.NoError(t, err)
+	assert.False(t, res.Allow, "group budget ceiling must deny once spent")
+	assert.Equal(t, denyCodeAccountBudgetCapExceeded, res.DenyCode, "account budget deny code")
+}
+
+// TestSelectPolicy_RealStore_AccountTargetUsersBindsOnlyThatUser proves a
+// TargetUsers rule tightens only the named user, leaving others unbound.
+func TestSelectPolicy_RealStore_AccountTargetUsersBindsOnlyThatUser(t *testing.T) {
+	mgr, s := newRealSelectorMgr(t)
+	ctx := context.Background()
+
+	rule := types.NewAccountBudgetRule(realSelectAccount)
+	rule.ID = "ainbud-alice"
+	rule.TargetUsers = []string{"alice"}
+	rule.Limits.TokenLimit = types.PolicyTokenLimit{Enabled: true, UserCap: 100, WindowSeconds: 3_600}
+	require.NoError(t, s.SaveAgentNetworkBudgetRule(ctx, rule))
+
+	// Record alice's usage to the rule window.
+	require.NoError(t, mgr.RecordAccountBudgetUsage(ctx, realSelectAccount, "alice", nil, 100, 0, 0))
+
+	aliceIn := PolicySelectionInput{AccountID: realSelectAccount, UserID: "alice", ProviderID: "prov-1"}
+	res, err := mgr.SelectPolicyForRequest(ctx, aliceIn)
+	require.NoError(t, err)
+	assert.False(t, res.Allow, "alice is bound by the TargetUsers rule and is exhausted")
+
+	bobIn := PolicySelectionInput{AccountID: realSelectAccount, UserID: "bob", ProviderID: "prov-1"}
+	res, err = mgr.SelectPolicyForRequest(ctx, bobIn)
+	require.NoError(t, err)
+	assert.True(t, res.Allow, "bob is not in TargetUsers, so the rule must not bind him")
+}
+
+// TestSelectPolicy_RealStore_AccountRuleRecordsToOwnWindow proves the record
+// fan-out books usage in the rule's own window (distinct from any policy
+// window), so the account ceiling accumulates independently.
+func TestSelectPolicy_RealStore_AccountRuleRecordsToOwnWindow(t *testing.T) {
+	mgr, s := newRealSelectorMgr(t)
+	ctx := context.Background()
+
+	require.NoError(t, s.SaveAgentNetworkBudgetRule(ctx, accountWideUserTokenRule("ainbud-w", 100, 3_600)))
+
+	require.NoError(t, mgr.RecordAccountBudgetUsage(ctx, realSelectAccount, "user-1", nil, 60, 0, 0))
+
+	// Same user, a policy-style daily window must NOT see the account-window
+	// usage — windows are independent counters.
+	dailyRow, err := s.GetAgentNetworkConsumption(ctx, store.LockingStrengthNone, realSelectAccount, types.DimensionUser, "user-1", 86_400, types.WindowStart(time.Now().UTC(), 86_400))
+	require.NoError(t, err)
+	assert.Equal(t, int64(0), dailyRow.TokensInput+dailyRow.TokensOutput, "daily window must be untouched by the hourly account-rule record")
+
+	// A second record pushes the hourly account window to its cap → deny.
+	require.NoError(t, mgr.RecordAccountBudgetUsage(ctx, realSelectAccount, "user-1", nil, 40, 0, 0))
+	res, err := mgr.SelectPolicyForRequest(ctx, PolicySelectionInput{AccountID: realSelectAccount, UserID: "user-1", ProviderID: "prov-1"})
+	require.NoError(t, err)
+	assert.False(t, res.Allow, "100 tokens recorded in the rule's hourly window must exhaust the 100-token ceiling")
+	assert.Equal(t, denyCodeAccountTokenCapExceeded, res.DenyCode, "account token deny code")
+}
+
+// TestRecordUsage_RealStore_BooksPolicyAndAccountWindows proves the batched
+// post-flight write books the selected policy's window AND every applicable
+// account rule's (independent) window in a single call — the #6 batched-write
+// path the proxy's RecordLLMUsage RPC now uses.
+func TestRecordUsage_RealStore_BooksPolicyAndAccountWindows(t *testing.T) {
+	mgr, s := newRealSelectorMgr(t)
+	ctx := context.Background()
+
+	// Policy: 100-token group cap on a daily window. Account rule: 100-token
+	// user ceiling on an hourly window — an independent counter.
+	policy := capPolicy("pol-1", realSelectAccount, []string{"grp-eng"}, "prov-1", 100, 86_400)
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, policy))
+	require.NoError(t, s.SaveAgentNetworkBudgetRule(ctx, accountWideUserTokenRule("ainbud-1", 100, 3_600)))
+
+	in := PolicySelectionInput{AccountID: realSelectAccount, UserID: "user-1", GroupIDs: []string{"grp-eng"}, ProviderID: "prov-1"}
+	res, err := mgr.SelectPolicyForRequest(ctx, in)
+	require.NoError(t, err)
+	require.True(t, res.Allow)
+	require.Equal(t, "pol-1", res.SelectedPolicyID)
+
+	// One batched record books the policy window (group + user @86400) and the
+	// account rule window (user @3600) atomically.
+	require.NoError(t, mgr.RecordUsage(ctx, RecordUsageInput{
+		AccountID:          realSelectAccount,
+		UserID:             "user-1",
+		AttributionGroupID: res.AttributionGroupID,
+		GroupIDs:           []string{"grp-eng"},
+		WindowSeconds:      res.WindowSeconds,
+		TokensIn:           100,
+	}))
+
+	// The next selection denies — the account hourly ceiling binds first.
+	res, err = mgr.SelectPolicyForRequest(ctx, in)
+	require.NoError(t, err)
+	assert.False(t, res.Allow, "usage booked by RecordUsage must enforce on the next request")
+
+	// Prove BOTH windows were booked in the one call via a direct batch read.
+	now := time.Now().UTC()
+	userKey := types.ConsumptionKey{Kind: types.DimensionUser, DimID: "user-1", WindowSeconds: 3_600, WindowStartUTC: types.WindowStart(now, 3_600)}
+	groupKey := types.ConsumptionKey{Kind: types.DimensionGroup, DimID: "grp-eng", WindowSeconds: 86_400, WindowStartUTC: types.WindowStart(now, 86_400)}
+	rows, err := s.GetAgentNetworkConsumptionBatch(ctx, store.LockingStrengthNone, realSelectAccount, []types.ConsumptionKey{userKey, groupKey})
+	require.NoError(t, err)
+	require.Contains(t, rows, userKey, "account rule user/hourly window booked")
+	require.Contains(t, rows, groupKey, "policy group/daily window booked")
+	assert.Equal(t, int64(100), rows[userKey].TokensInput, "account hourly user counter")
+	assert.Equal(t, int64(100), rows[groupKey].TokensInput, "policy daily group counter")
+}
diff --git a/management/internals/modules/agentnetwork/policyselect_realstore_test.go b/management/internals/modules/agentnetwork/policyselect_realstore_test.go
new file mode 100644
index 000000000..cc8cfb1e7
--- /dev/null
+++ b/management/internals/modules/agentnetwork/policyselect_realstore_test.go
@@ -0,0 +1,214 @@
+package agentnetwork
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/server/store"
+)
+
+// This file is the no-mock regression guard for policy limit enforcement.
+// policyselect_test.go pins the same behavior through a gomock store with
+// explicit call-sequence expectations — brittle precisely where the upcoming
+// account-budget work (GC-2) refactors the cap-eval primitive and adds an
+// account-level gate. These tests drive the REAL sqlite store + REAL
+// consumption accounting and assert observable behavior (allow / deny /
+// selection / attribution), not which store methods get called. They must keep
+// passing unchanged after GC-2 lands, which is what proves "current behavior is
+// not changed."
+
+const realSelectAccount = "acc-realselect-1"
+
+// newRealSelectorMgr builds a managerImpl backed by a real sqlite test store.
+func newRealSelectorMgr(t *testing.T) (*managerImpl, store.Store) {
+	t.Helper()
+	ctx := context.Background()
+	s, cleanup, err := store.NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err, "real sqlite test store must come up")
+	t.Cleanup(cleanup)
+	return &managerImpl{store: s}, s
+}
+
+// TestSelectPolicy_RealStore_NoApplicablePolicies pins the pass-through:
+// nothing targets the (provider, groups) combination, so the selector allows
+// without attribution or consumption tracking.
+func TestSelectPolicy_RealStore_NoApplicablePolicies(t *testing.T) {
+	mgr, _ := newRealSelectorMgr(t)
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  realSelectAccount,
+		UserID:     "user-1",
+		GroupIDs:   []string{"grp-x"},
+		ProviderID: "prov-1",
+	})
+	require.NoError(t, err)
+	assert.True(t, res.Allow, "no applicable policy must pass through as allow")
+	assert.Empty(t, res.SelectedPolicyID, "no selection when nothing applies")
+}
+
+// TestSelectPolicy_RealStore_AllowAndLowestGroupAttribution pins the v1
+// attribution rule (lowest intersecting group by string sort) through the
+// real store, with a fresh (zero) consumption row.
+func TestSelectPolicy_RealStore_AllowAndLowestGroupAttribution(t *testing.T) {
+	mgr, s := newRealSelectorMgr(t)
+	ctx := context.Background()
+
+	p := capPolicy("pol-A", realSelectAccount, []string{"grp-zz", "grp-aa", "grp-mm"}, "prov-1", 10_000, 86_400)
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, p))
+
+	res, err := mgr.SelectPolicyForRequest(ctx, PolicySelectionInput{
+		AccountID:  realSelectAccount,
+		UserID:     "user-1",
+		GroupIDs:   []string{"grp-zz", "grp-aa", "grp-mm"},
+		ProviderID: "prov-1",
+	})
+	require.NoError(t, err)
+	assert.True(t, res.Allow, "fresh state under cap must allow")
+	assert.Equal(t, "pol-A", res.SelectedPolicyID, "only applicable policy must be selected")
+	assert.Equal(t, "grp-aa", res.AttributionGroupID, "lowest-by-sort intersecting group must win")
+	assert.Equal(t, int64(86_400), res.WindowSeconds, "selected policy's window must be returned")
+}
+
+// TestSelectPolicy_RealStore_LargerPoolWins_FallsThroughWhenExhausted pins the
+// core selection behavior end to end. The two policies bind DISTINCT groups so
+// they read separate counters — the only shape where fall-through actually
+// yields headroom (policies on the same group share one counter, as
+// policyselect_test.go notes). Larger pool wins fresh; after real consumption
+// drains the larger group, selection falls through to the smaller; once both
+// counters are exhausted the request is denied.
+func TestSelectPolicy_RealStore_LargerPoolWins_FallsThroughWhenExhausted(t *testing.T) {
+	mgr, s := newRealSelectorMgr(t)
+	ctx := context.Background()
+
+	tight := capPolicy("pol-tight", realSelectAccount, []string{"grp-tight"}, "prov-1", 100, 86_400)
+	tight.CreatedAt = time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
+	wide := capPolicy("pol-wide", realSelectAccount, []string{"grp-wide"}, "prov-1", 10_000, 86_400)
+	wide.CreatedAt = time.Date(2026, 2, 1, 0, 0, 0, 0, time.UTC)
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, tight))
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, wide))
+
+	// Caller is in both groups, so both policies apply with independent counters.
+	in := PolicySelectionInput{
+		AccountID:  realSelectAccount,
+		UserID:     "user-1",
+		GroupIDs:   []string{"grp-tight", "grp-wide"},
+		ProviderID: "prov-1",
+	}
+
+	// Fresh: larger pool wins.
+	res, err := mgr.SelectPolicyForRequest(ctx, in)
+	require.NoError(t, err)
+	assert.Equal(t, "pol-wide", res.SelectedPolicyID, "larger pool drains first")
+
+	// Drain only the wide group's counter to its cap.
+	require.NoError(t, mgr.RecordConsumption(ctx, realSelectAccount, types.DimensionGroup, "grp-wide", 86_400, 10_000, 0, 0))
+
+	// Wide exhausted, tight's separate counter is fresh → fall through to tight.
+	res, err = mgr.SelectPolicyForRequest(ctx, in)
+	require.NoError(t, err)
+	assert.True(t, res.Allow, "tight pool has its own untouched counter")
+	assert.Equal(t, "pol-tight", res.SelectedPolicyID, "selection falls through to the smaller pool once the larger is exhausted")
+
+	// Drain the tight group's counter too → both exhausted → deny.
+	require.NoError(t, mgr.RecordConsumption(ctx, realSelectAccount, types.DimensionGroup, "grp-tight", 86_400, 100, 0, 0))
+	res, err = mgr.SelectPolicyForRequest(ctx, in)
+	require.NoError(t, err)
+	assert.False(t, res.Allow, "both group counters exhausted must deny")
+	assert.Equal(t, denyCodeTokenCapExceeded, res.DenyCode, "deny code names the offending cap kind")
+}
+
+// TestSelectPolicy_RealStore_BudgetCapDenies pins budget (USD) enforcement
+// through the real store: once recorded cost reaches the cap, deny.
+func TestSelectPolicy_RealStore_BudgetCapDenies(t *testing.T) {
+	mgr, s := newRealSelectorMgr(t)
+	ctx := context.Background()
+
+	p := &types.Policy{
+		ID:                     "pol-budget",
+		AccountID:              realSelectAccount,
+		Enabled:                true,
+		SourceGroups:           []string{"grp-eng"},
+		DestinationProviderIDs: []string{"prov-1"},
+		Limits: types.PolicyLimits{
+			BudgetLimit: types.PolicyBudgetLimit{
+				Enabled:       true,
+				GroupCapUsd:   5.0,
+				WindowSeconds: 86_400,
+			},
+		},
+		CreatedAt: time.Now().UTC(),
+	}
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, p))
+
+	in := PolicySelectionInput{
+		AccountID:  realSelectAccount,
+		UserID:     "user-1",
+		GroupIDs:   []string{"grp-eng"},
+		ProviderID: "prov-1",
+	}
+
+	res, err := mgr.SelectPolicyForRequest(ctx, in)
+	require.NoError(t, err)
+	assert.True(t, res.Allow, "fresh budget must allow")
+
+	require.NoError(t, mgr.RecordConsumption(ctx, realSelectAccount, types.DimensionGroup, "grp-eng", 86_400, 0, 0, 5.0))
+
+	res, err = mgr.SelectPolicyForRequest(ctx, in)
+	require.NoError(t, err)
+	assert.False(t, res.Allow, "cost at the cap must deny")
+	assert.Equal(t, denyCodeBudgetCapExceeded, res.DenyCode, "budget deny code must be surfaced")
+}
+
+// TestSelectPolicy_RealStore_GroupCounterSharedAcrossPolicies pins that two
+// policies on the same group+window read one shared consumption counter: usage
+// recorded once is visible to both, so exhausting the group budget denies
+// regardless of which policy would attribute.
+func TestSelectPolicy_RealStore_GroupCounterSharedAcrossPolicies(t *testing.T) {
+	mgr, s := newRealSelectorMgr(t)
+	ctx := context.Background()
+
+	a := capPolicy("pol-a", realSelectAccount, []string{"grp-eng"}, "prov-1", 1_000, 86_400)
+	b := capPolicy("pol-b", realSelectAccount, []string{"grp-eng"}, "prov-1", 1_000, 86_400)
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, a))
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, b))
+
+	in := PolicySelectionInput{
+		AccountID:  realSelectAccount,
+		UserID:     "user-1",
+		GroupIDs:   []string{"grp-eng"},
+		ProviderID: "prov-1",
+	}
+
+	require.NoError(t, mgr.RecordConsumption(ctx, realSelectAccount, types.DimensionGroup, "grp-eng", 86_400, 1_000, 0, 0))
+
+	res, err := mgr.SelectPolicyForRequest(ctx, in)
+	require.NoError(t, err)
+	assert.False(t, res.Allow, "shared group counter at cap denies both equal policies")
+	assert.Equal(t, denyCodeTokenCapExceeded, res.DenyCode, "token deny code on the shared counter")
+}
+
+// TestSelectPolicy_RealStore_DisabledPolicyIgnored pins that a disabled policy
+// is invisible to selection even when it otherwise matches.
+func TestSelectPolicy_RealStore_DisabledPolicyIgnored(t *testing.T) {
+	mgr, s := newRealSelectorMgr(t)
+	ctx := context.Background()
+
+	p := capPolicy("pol-disabled", realSelectAccount, []string{"grp-eng"}, "prov-1", 10_000, 86_400)
+	p.Enabled = false
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, p))
+
+	res, err := mgr.SelectPolicyForRequest(ctx, PolicySelectionInput{
+		AccountID:  realSelectAccount,
+		UserID:     "user-1",
+		GroupIDs:   []string{"grp-eng"},
+		ProviderID: "prov-1",
+	})
+	require.NoError(t, err)
+	assert.True(t, res.Allow, "no enabled policy applies → pass-through allow")
+	assert.Empty(t, res.SelectedPolicyID, "disabled policy must not be selected")
+}
diff --git a/management/internals/modules/agentnetwork/policyselect_test.go b/management/internals/modules/agentnetwork/policyselect_test.go
new file mode 100644
index 000000000..dd7687fe1
--- /dev/null
+++ b/management/internals/modules/agentnetwork/policyselect_test.go
@@ -0,0 +1,641 @@
+package agentnetwork
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/golang/mock/gomock"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/server/store"
+	nbstatus "github.com/netbirdio/netbird/shared/management/status"
+)
+
+func newSelectorMgr(t *testing.T, ctrl *gomock.Controller) (*managerImpl, *store.MockStore) {
+	t.Helper()
+	mockStore := store.NewMockStore(ctrl)
+	// SelectPolicyForRequest evaluates the account-budget ceiling before policy
+	// selection. These policy-selection tests don't exercise account rules, so
+	// default to "no rules" — the no-mock policyselect_realstore_test.go covers
+	// the account gate's behavior end to end.
+	mockStore.EXPECT().
+		GetAccountAgentNetworkBudgetRules(gomock.Any(), gomock.Any(), gomock.Any()).
+		Return(nil, nil).
+		AnyTimes()
+	return &managerImpl{store: mockStore}, mockStore
+}
+
+type usedKey struct {
+	kind   types.ConsumptionDimension
+	dimID  string
+	window int64
+}
+
+// expectConsumptionBatch stubs the batched consumption read to return the
+// supplied per-(kind, dim, window) counters, filling each row's window start
+// from the actual request keys so it always matches what the selector computed.
+// Keys absent from used resolve to zero counters.
+func expectConsumptionBatch(mockStore *store.MockStore, used map[usedKey]*types.Consumption) {
+	mockStore.EXPECT().
+		GetAgentNetworkConsumptionBatch(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).
+		DoAndReturn(func(_ context.Context, _ store.LockingStrength, _ string, keys []types.ConsumptionKey) (map[types.ConsumptionKey]*types.Consumption, error) {
+			out := make(map[types.ConsumptionKey]*types.Consumption)
+			for _, k := range keys {
+				if row, ok := used[usedKey{k.Kind, k.DimID, k.WindowSeconds}]; ok {
+					rc := *row
+					rc.WindowStartUTC = k.WindowStartUTC
+					out[k] = &rc
+				}
+			}
+			return out, nil
+		}).
+		AnyTimes()
+}
+
+func capPolicy(id, account string, sourceGroups []string, providerID string, tokenCap int64, windowSec int64) *types.Policy {
+	return &types.Policy{
+		ID:                     id,
+		AccountID:              account,
+		Enabled:                true,
+		SourceGroups:           sourceGroups,
+		DestinationProviderIDs: []string{providerID},
+		Limits: types.PolicyLimits{
+			TokenLimit: types.PolicyTokenLimit{
+				Enabled:       true,
+				GroupCap:      tokenCap,
+				WindowSeconds: windowSec,
+			},
+		},
+		CreatedAt: time.Now().UTC(),
+	}
+}
+
+// TestSelectPolicy_NoApplicablePolicies covers the pass-through path:
+// llm_router authorisation is upstream of selection; when the
+// selector finds no policy targeting the (provider, caller-groups)
+// combination, it returns Allow with no attribution and lets the
+// request continue without consumption tracking.
+func TestSelectPolicy_NoApplicablePolicies(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	mockStore.EXPECT().
+		GetAccountAgentNetworkPolicies(gomock.Any(), gomock.Any(), "acc-1").
+		Return([]*types.Policy{}, nil)
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		UserID:     "user-1",
+		GroupIDs:   []string{"grp-x"},
+		ProviderID: "prov-1",
+	})
+	require.NoError(t, err)
+	assert.True(t, res.Allow, "no applicable policies = pass-through allow")
+	assert.Empty(t, res.SelectedPolicyID, "no selection when nothing applies")
+}
+
+// TestSelectPolicy_AllowWithLowestGroupAttribution proves the v1
+// attribution rule: when the caller's groups intersect a policy's
+// source_groups in multiple positions, the selector picks the lowest
+// group id by string sort so multi-node selection converges.
+func TestSelectPolicy_AllowWithLowestGroupAttribution(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	policy := capPolicy("pol-A", "acc-1", []string{"grp-zz", "grp-aa", "grp-mm"}, "prov-1", 10_000, 86_400)
+
+	mockStore.EXPECT().
+		GetAccountAgentNetworkPolicies(gomock.Any(), gomock.Any(), "acc-1").
+		Return([]*types.Policy{policy}, nil)
+	// Fresh: zero consumption across the board.
+	expectConsumptionBatch(mockStore, nil)
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		UserID:     "user-1",
+		GroupIDs:   []string{"grp-zz", "grp-aa", "grp-mm"},
+		ProviderID: "prov-1",
+	})
+	require.NoError(t, err)
+	assert.True(t, res.Allow)
+	assert.Equal(t, "pol-A", res.SelectedPolicyID)
+	assert.Equal(t, "grp-aa", res.AttributionGroupID,
+		"lowest-by-sort intersection wins so multi-node selection converges")
+	assert.Equal(t, int64(86_400), res.WindowSeconds)
+}
+
+// TestSelectPolicy_LargerPoolWinsAcrossUsageLevels proves the core
+// selection rule: among multiple applicable policies with caps, the
+// selector picks the one with the larger absolute pool — at every
+// usage level, not just at fresh state. The smaller-pool policy is
+// only reached when the larger one is exhausted. This is the
+// "drain biggest first" semantic operators expect for layered
+// tiers; a fraction-based score would flap between the two as
+// soon as one is partially used.
+func TestSelectPolicy_LargerPoolWinsAcrossUsageLevels(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	tight := capPolicy("pol-tight", "acc-1", []string{"grp-engineers"}, "prov-1", 100, 86_400)
+	tight.CreatedAt = time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
+	wide := capPolicy("pol-wide", "acc-1", []string{"grp-engineers"}, "prov-1", 10_000, 86_400)
+	wide.CreatedAt = time.Date(2026, 2, 1, 0, 0, 0, 0, time.UTC)
+
+	mockStore.EXPECT().
+		GetAccountAgentNetworkPolicies(gomock.Any(), gomock.Any(), "acc-1").
+		Return([]*types.Policy{tight, wide}, nil)
+
+	// Both partially used. tight at 50/100 (50% used); wide at
+	// 50/10000 (0.5% used). Old fraction-based algo would pick wide
+	// here too — but for the wrong reason ("more relative slack").
+	// New algo picks wide because its initial group cap is bigger
+	// (10000 > 100), and that decision is stable as wide drains.
+	expectConsumptionBatch(mockStore, map[usedKey]*types.Consumption{
+		{types.DimensionGroup, "grp-engineers", 86_400}: {TokensInput: 50},
+	})
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		UserID:     "user-1",
+		GroupIDs:   []string{"grp-engineers"},
+		ProviderID: "prov-1",
+	})
+	require.NoError(t, err)
+	assert.Equal(t, "pol-wide", res.SelectedPolicyID,
+		"the policy with the bigger initial pool wins — operators expect 'drain the privileged tier first', not load-balance across tiers")
+}
+
+// TestSelectPolicy_StaysOnLargerPoolAfterPartialDrain locks the
+// stickiness contract reported by operators: with two policies
+// where A has a 200-token group cap and B has 150, the very first
+// request goes to A AND every subsequent request continues to land
+// on A until A's group cap is exhausted — at which point B becomes
+// the only candidate. A fraction-based score would flap to B as
+// soon as A had any consumption (B's 1.0 fraction beats A's 0.75)
+// even though A still has more absolute headroom; that produced
+// confusing per-policy attribution ledger entries and stranded
+// A's remaining capacity behind B's exhaustion.
+func TestSelectPolicy_StaysOnLargerPoolAfterPartialDrain(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	policyA := capPolicy("pol-A-200", "acc-1", []string{"grp-engineers"}, "prov-1", 200, 86_400)
+	policyB := capPolicy("pol-B-150", "acc-1", []string{"grp-engineers"}, "prov-1", 150, 86_400)
+
+	mockStore.EXPECT().
+		GetAccountAgentNetworkPolicies(gomock.Any(), gomock.Any(), "acc-1").
+		Return([]*types.Policy{policyA, policyB}, nil)
+
+	// A is partially drained (50/200 used = 25% used; 75% headroom
+	// remaining). B is fresh (0/150). The old fraction-based score
+	// would pick B here (1.0 > 0.75 fraction); the new pool-size
+	// score sticks with A (200 > 150 absolute cap).
+	expectConsumptionBatch(mockStore, map[usedKey]*types.Consumption{
+		{types.DimensionGroup, "grp-engineers", 86_400}: {TokensInput: 50},
+	})
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		UserID:     "user-1",
+		GroupIDs:   []string{"grp-engineers"},
+		ProviderID: "prov-1",
+	})
+	require.NoError(t, err)
+	assert.Equal(t, "pol-A-200", res.SelectedPolicyID,
+		"once attribution lands on the bigger pool it must STAY there until exhausted — operators expect 'drain A then B', not 'flip to B as soon as A is touched'")
+}
+
+// TestSelectPolicy_FallsThroughToSmallerPoolWhenLargerExhausted
+// proves the second half of the stickiness contract: once the
+// larger-pool policy IS exhausted, the smaller one takes over.
+// Without this we'd deny on requests the smaller policy is fully
+// equipped to serve.
+func TestSelectPolicy_FallsThroughToSmallerPoolWhenLargerExhausted(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	policyA := capPolicy("pol-A-200", "acc-1", []string{"grp-engineers"}, "prov-1", 200, 86_400)
+	// B uses a different window length so it has an INDEPENDENT counter — the
+	// realistic shape for fall-through. On the SAME (group, window) tuple the
+	// counter is shared, so A's cap of 200 being reached would also exhaust B's
+	// 150; independent counters are what let A exhaust while B retains headroom.
+	policyB := capPolicy("pol-B-150", "acc-1", []string{"grp-engineers"}, "prov-1", 150, 3_600)
+
+	mockStore.EXPECT().
+		GetAccountAgentNetworkPolicies(gomock.Any(), gomock.Any(), "acc-1").
+		Return([]*types.Policy{policyA, policyB}, nil)
+
+	expectConsumptionBatch(mockStore, map[usedKey]*types.Consumption{
+		{types.DimensionGroup, "grp-engineers", 86_400}: {TokensInput: 200}, // A: 200 >= 200 → exhausted
+		{types.DimensionGroup, "grp-engineers", 3_600}:  {TokensInput: 100}, // B: 100 < 150 → headroom
+	})
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		UserID:     "user-1",
+		GroupIDs:   []string{"grp-engineers"},
+		ProviderID: "prov-1",
+	})
+	require.NoError(t, err)
+	assert.Equal(t, "pol-B-150", res.SelectedPolicyID,
+		"once the bigger pool is exhausted, the smaller one must take over — denying when capacity remains would strand B's allowance")
+}
+
+// TestSelectPolicy_TiebreakByLargerGroupPool covers the user-reported
+// bug: an admin in two groups (Users + Admins) where Users is bound
+// by a smaller-group-cap policy (50 group, 100 user) and Admins is
+// bound by a bigger-group-cap policy (100 group, 20 user) MUST get
+// attributed to the Admins policy on the first request.
+//
+// Without this rule, the fresh-state fraction is 1.0 for both and
+// the older policy wins by created_at. The first 24-token request
+// then drains the shared user counter past Admins's tight 20-token
+// user cap, locking Admins out of selection forever. The 100-token
+// Admins group pool ends up stranded while requests pile onto the
+// 50-token Users pool — the opposite of what the operator intended
+// when they put the bigger pool on the privileged group.
+func TestSelectPolicy_TiebreakByLargerGroupPool(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	// Policy A: Users group, smaller group pool, looser per-user cap.
+	policyA := &types.Policy{
+		ID:                     "pol-Users",
+		AccountID:              "acc-1",
+		Enabled:                true,
+		SourceGroups:           []string{"grp-Users"},
+		DestinationProviderIDs: []string{"prov-1"},
+		Limits: types.PolicyLimits{
+			TokenLimit: types.PolicyTokenLimit{
+				Enabled: true, GroupCap: 50, UserCap: 100, WindowSeconds: 86_400,
+			},
+		},
+		// Older — would win the legacy created_at tiebreak.
+		CreatedAt: time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC),
+	}
+	// Policy B: Admins group, bigger group pool, tighter per-user cap.
+	policyB := &types.Policy{
+		ID:                     "pol-Admins",
+		AccountID:              "acc-1",
+		Enabled:                true,
+		SourceGroups:           []string{"grp-Admins"},
+		DestinationProviderIDs: []string{"prov-1"},
+		Limits: types.PolicyLimits{
+			TokenLimit: types.PolicyTokenLimit{
+				Enabled: true, GroupCap: 100, UserCap: 20, WindowSeconds: 86_400,
+			},
+		},
+		CreatedAt: time.Date(2026, 2, 1, 0, 0, 0, 0, time.UTC),
+	}
+
+	mockStore.EXPECT().
+		GetAccountAgentNetworkPolicies(gomock.Any(), gomock.Any(), "acc-1").
+		Return([]*types.Policy{policyA, policyB}, nil)
+	// Fresh state: every cap evaluation reads zero usage.
+	expectConsumptionBatch(mockStore, nil)
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		UserID:     "user-1",
+		GroupIDs:   []string{"grp-Users", "grp-Admins"},
+		ProviderID: "prov-1",
+	})
+	require.NoError(t, err)
+	assert.Equal(t, "pol-Admins", res.SelectedPolicyID,
+		"the bigger group pool wins the fresh-state tiebreak — picking Users first would burn the shared user counter past Admins's tight user cap on the very first request and strand the bigger Admins pool")
+	assert.Equal(t, "grp-Admins", res.AttributionGroupID)
+}
+
+// TestSelectPolicy_TiebreakByCreatedAt proves the deterministic
+// final tiebreak: when two applicable policies have the same
+// headroom fraction AND the same group cap (so the larger-pool rule
+// can't differentiate either), the older policy wins so attribution
+// is stable across replays.
+func TestSelectPolicy_TiebreakByCreatedAt(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	older := capPolicy("pol-old", "acc-1", []string{"grp-engineers"}, "prov-1", 1_000, 86_400)
+	older.CreatedAt = time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
+	newer := capPolicy("pol-new", "acc-1", []string{"grp-engineers"}, "prov-1", 1_000, 86_400)
+	newer.CreatedAt = time.Date(2026, 3, 1, 0, 0, 0, 0, time.UTC)
+
+	mockStore.EXPECT().
+		GetAccountAgentNetworkPolicies(gomock.Any(), gomock.Any(), "acc-1").
+		Return([]*types.Policy{newer, older}, nil)
+	// Both at zero consumption → identical headroom fraction.
+	expectConsumptionBatch(mockStore, nil)
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		GroupIDs:   []string{"grp-engineers"},
+		ProviderID: "prov-1",
+	})
+	require.NoError(t, err)
+	assert.Equal(t, "pol-old", res.SelectedPolicyID,
+		"older policy wins on equal-headroom tiebreak so attribution is stable across replays")
+}
+
+// TestSelectPolicy_DeniesWhenAllExhausted proves the deny envelope:
+// when every applicable policy has at least one cap fully exhausted,
+// the selector returns Allow=false with the most-recent exhaustion's
+// deny code + human reason. The proxy's middleware surfaces this as
+// a 403 with the canonical llm_policy.* code.
+func TestSelectPolicy_DeniesWhenAllExhausted(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	a := capPolicy("pol-a", "acc-1", []string{"grp-engineers"}, "prov-1", 100, 86_400)
+	b := capPolicy("pol-b", "acc-1", []string{"grp-engineers"}, "prov-1", 200, 86_400)
+	mockStore.EXPECT().
+		GetAccountAgentNetworkPolicies(gomock.Any(), gomock.Any(), "acc-1").
+		Return([]*types.Policy{a, b}, nil)
+
+	// Shared group counter at 200: A (cap 100) and B (cap 200) both exhausted.
+	expectConsumptionBatch(mockStore, map[usedKey]*types.Consumption{
+		{types.DimensionGroup, "grp-engineers", 86_400}: {TokensInput: 200},
+	})
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		GroupIDs:   []string{"grp-engineers"},
+		ProviderID: "prov-1",
+	})
+	require.NoError(t, err)
+	assert.False(t, res.Allow, "every applicable policy exhausted = deny")
+	assert.Equal(t, denyCodeTokenCapExceeded, res.DenyCode)
+	assert.Contains(t, res.DenyReason, "token cap exhausted",
+		"deny reason must name the exhausted cap kind for operator debugging")
+}
+
+// TestSelectPolicy_UncappedPolicyAlwaysWinsAgainstCapped proves the
+// catch-all-allow contract: a policy with NO enabled caps wins
+// against any capped policy regardless of how much headroom the
+// capped one has, because operators who configure unlimited access
+// expect requests to attribute there until they explicitly add caps.
+func TestSelectPolicy_UncappedPolicyAlwaysWinsAgainstCapped(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	uncapped := &types.Policy{
+		ID:                     "pol-uncapped",
+		AccountID:              "acc-1",
+		Enabled:                true,
+		SourceGroups:           []string{"grp-engineers"},
+		DestinationProviderIDs: []string{"prov-1"},
+		// All Limits.*.Enabled = false (zero-value).
+		CreatedAt: time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC),
+	}
+	wide := capPolicy("pol-wide", "acc-1", []string{"grp-engineers"}, "prov-1", 1_000_000, 86_400)
+	wide.CreatedAt = time.Date(2025, 12, 1, 0, 0, 0, 0, time.UTC) // older than uncapped
+
+	mockStore.EXPECT().
+		GetAccountAgentNetworkPolicies(gomock.Any(), gomock.Any(), "acc-1").
+		Return([]*types.Policy{uncapped, wide}, nil)
+	// Only the wide policy reads consumption; uncapped doesn't query
+	// because it has no enabled caps.
+	expectConsumptionBatch(mockStore, nil)
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		GroupIDs:   []string{"grp-engineers"},
+		ProviderID: "prov-1",
+	})
+	require.NoError(t, err)
+	assert.Equal(t, "pol-uncapped", res.SelectedPolicyID,
+		"a no-caps policy must always win selection — that's how operators express 'unlimited access through this path'")
+	assert.Equal(t, int64(0), res.WindowSeconds, "no caps configured = WindowSeconds=0 so RecordLLMUsage skips counter writes")
+}
+
+// TestSelectPolicy_DisabledPolicyIgnored proves disabled policies
+// don't count toward selection — even when they'd otherwise be the
+// best match. Operators disable a policy to take it offline; the
+// selector must respect that and route through whatever's left.
+func TestSelectPolicy_DisabledPolicyIgnored(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	disabled := capPolicy("pol-disabled", "acc-1", []string{"grp-engineers"}, "prov-1", 1_000_000, 86_400)
+	disabled.Enabled = false
+	enabled := capPolicy("pol-enabled", "acc-1", []string{"grp-engineers"}, "prov-1", 100, 86_400)
+
+	mockStore.EXPECT().
+		GetAccountAgentNetworkPolicies(gomock.Any(), gomock.Any(), "acc-1").
+		Return([]*types.Policy{disabled, enabled}, nil)
+	expectConsumptionBatch(mockStore, nil)
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		GroupIDs:   []string{"grp-engineers"},
+		ProviderID: "prov-1",
+	})
+	require.NoError(t, err)
+	assert.Equal(t, "pol-enabled", res.SelectedPolicyID,
+		"disabled policies must be ignored at selection time")
+}
+
+// TestSelectPolicy_StoreErrorPropagates locks the no-fail-open
+// contract: a transient store error must surface to the caller, not
+// be silently treated as "no policies = allow". A false allow on the
+// hot path would let a request slip past every cap.
+func TestSelectPolicy_StoreErrorPropagates(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	mockStore.EXPECT().
+		GetAccountAgentNetworkPolicies(gomock.Any(), gomock.Any(), "acc-1").
+		Return(nil, errors.New("boom"))
+
+	_, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID: "acc-1",
+	})
+	require.Error(t, err, "store errors must surface — never fail open on the hot path")
+}
+
+// TestSelectPolicy_RejectsEmptyAccount is the input-validation guard:
+// empty account_id is a programmer error and must surface as
+// InvalidArgument, not as a silent zero-result lookup.
+func TestSelectPolicy_RejectsEmptyAccount(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, _ := newSelectorMgr(t, ctrl)
+
+	_, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{})
+	require.Error(t, err)
+	var sErr *nbstatus.Error
+	require.True(t, errors.As(err, &sErr))
+	assert.Equal(t, nbstatus.InvalidArgument, sErr.Type())
+}
+
+// TestSelectPolicy_SharesGroupCounterAcrossPolicies locks the
+// counter-keying design fork: counters are keyed on (account,
+// dim_kind, dim_id, window_hours, window_start) — NOT on policy_id.
+// Two policies that target the same group with the SAME window length
+// share one bucket: spend booked under policy A is visible to policy
+// B's headroom calculation and counts toward B's cap.
+//
+// This is what makes "operator's per-group enforcement" sane — caps
+// describe how much a GROUP can use, not how much each policy owes.
+func TestSelectPolicy_SharesGroupCounterAcrossPolicies(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	// Two policies, both targeting grp-engineers + prov-1, same 24h
+	// window length. Different cap sizes.
+	policyA := capPolicy("pol-A", "acc-1", []string{"grp-engineers"}, "prov-1", 1_000, 86_400)
+	policyB := capPolicy("pol-B", "acc-1", []string{"grp-engineers"}, "prov-1", 5_000, 86_400)
+
+	mockStore.EXPECT().
+		GetAccountAgentNetworkPolicies(gomock.Any(), gomock.Any(), "acc-1").
+		Return([]*types.Policy{policyA, policyB}, nil)
+	// Both policies query the SAME consumption row — same dim_id,
+	// same window_hours, same window_start. The mock returns the
+	// same row for both calls, simulating the shared counter.
+	expectConsumptionBatch(mockStore, map[usedKey]*types.Consumption{
+		{types.DimensionGroup, "grp-engineers", 86_400}: {TokensInput: 800},
+	})
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		GroupIDs:   []string{"grp-engineers"},
+		ProviderID: "prov-1",
+	})
+	require.NoError(t, err)
+	// 800 used → policy A has 200 tokens left of 1000 (20% headroom);
+	// policy B has 4200 left of 5000 (84% headroom). B wins.
+	assert.Equal(t, "pol-B", res.SelectedPolicyID,
+		"the SAME 800 tokens count toward both policies — counters share the (group, window) key, caps differ per policy")
+}
+
+// TestSelectPolicy_AntiFallThroughOnLowestGroup locks the no-fall-
+// through behaviour: when a caller is in multiple of a policy's
+// source_groups and the lowest-by-sort group is exhausted, we DENY
+// rather than fall through to a less-loaded sibling. Per-group caps
+// are independent (each group has its own bucket), but attribution
+// is one-shot — operators wanting fall-through must split into
+// separate policies.
+//
+// This nails down semantics future contributors might "improve" into
+// fall-through behaviour by accident.
+func TestSelectPolicy_AntiFallThroughOnLowestGroup(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	// Policy targets two groups; caller is in both.
+	policy := capPolicy("pol-1", "acc-1", []string{"grp-aaa", "grp-bbb"}, "prov-1", 100, 86_400)
+	mockStore.EXPECT().
+		GetAccountAgentNetworkPolicies(gomock.Any(), gomock.Any(), "acc-1").
+		Return([]*types.Policy{policy}, nil)
+
+	// grp-aaa is the lowest by sort → attribution picks it, and the
+	// prefetch only collects the attribution group's key. We exhaust
+	// grp-aaa (100/100); grp-bbb's counter is never requested because the
+	// selector attributes one-shot to the lowest group, so it can't fall
+	// through to a less-loaded sibling.
+	expectConsumptionBatch(mockStore, map[usedKey]*types.Consumption{
+		{types.DimensionGroup, "grp-aaa", 86_400}: {TokensInput: 100},
+	})
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		GroupIDs:   []string{"grp-aaa", "grp-bbb"},
+		ProviderID: "prov-1",
+	})
+	require.NoError(t, err)
+	assert.False(t, res.Allow,
+		"lowest-group-by-sort attribution does NOT fall through to a less-loaded sibling — operators wanting fall-through must split into separate policies")
+	assert.Equal(t, denyCodeTokenCapExceeded, res.DenyCode)
+	assert.Contains(t, res.DenyReason, "pol-1",
+		"deny reason names the exhausted policy id so operators can grep it from the access log")
+}
+
+// TestSelectPolicy_BudgetOnlyExhaustionDenies covers the symmetric
+// path to TestSelectPolicy_DeniesWhenAllExhausted but for the budget
+// cap: a policy with token_limit DISABLED and budget_limit at-cap
+// must deny with llm_policy.budget_cap_exceeded (not the token code).
+//
+// Without this, the budget evaluation path in evalBudgetCap could
+// silently regress and we'd still pass DeniesWhenAllExhausted (which
+// only exercises tokens).
+func TestSelectPolicy_BudgetOnlyExhaustionDenies(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	policy := &types.Policy{
+		ID:                     "pol-budget",
+		AccountID:              "acc-1",
+		Enabled:                true,
+		SourceGroups:           []string{"grp-engineers"},
+		DestinationProviderIDs: []string{"prov-1"},
+		Limits: types.PolicyLimits{
+			TokenLimit: types.PolicyTokenLimit{Enabled: false},
+			BudgetLimit: types.PolicyBudgetLimit{
+				Enabled:       true,
+				GroupCapUsd:   10.00,
+				WindowSeconds: 86_400,
+			},
+		},
+		CreatedAt: time.Now().UTC(),
+	}
+	mockStore.EXPECT().
+		GetAccountAgentNetworkPolicies(gomock.Any(), gomock.Any(), "acc-1").
+		Return([]*types.Policy{policy}, nil)
+	expectConsumptionBatch(mockStore, map[usedKey]*types.Consumption{
+		{types.DimensionGroup, "grp-engineers", 86_400}: {CostUSD: 10.50}, // over the $10 cap
+	})
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		GroupIDs:   []string{"grp-engineers"},
+		ProviderID: "prov-1",
+	})
+	require.NoError(t, err)
+	assert.False(t, res.Allow, "budget cap exhausted must deny independently of any token cap state")
+	assert.Equal(t, denyCodeBudgetCapExceeded, res.DenyCode,
+		"deny code must be the budget code — token-only deny would silently regress the budget evaluation path")
+	assert.Contains(t, res.DenyReason, "budget", "deny reason names the budget cap kind for operator debugging")
+}
+
+// TestSelectPolicy_BudgetTighterThanTokenWins is the dual-cap headroom
+// fork: when both Token and Budget are enabled on the same policy,
+// the SMALLER remaining ratio gates the policy. A policy with
+// abundant token headroom but near-zero budget headroom must deny on
+// budget, not pass on tokens.
+func TestSelectPolicy_BudgetTighterThanTokenWins(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	policy := &types.Policy{
+		ID:                     "pol-dual",
+		AccountID:              "acc-1",
+		Enabled:                true,
+		SourceGroups:           []string{"grp-engineers"},
+		DestinationProviderIDs: []string{"prov-1"},
+		Limits: types.PolicyLimits{
+			TokenLimit:  types.PolicyTokenLimit{Enabled: true, GroupCap: 10_000_000, WindowSeconds: 86_400},
+			BudgetLimit: types.PolicyBudgetLimit{Enabled: true, GroupCapUsd: 1.00, WindowSeconds: 86_400},
+		},
+		CreatedAt: time.Now().UTC(),
+	}
+	mockStore.EXPECT().
+		GetAccountAgentNetworkPolicies(gomock.Any(), gomock.Any(), "acc-1").
+		Return([]*types.Policy{policy}, nil)
+	// One shared counter carries both token usage (ample headroom) and cost
+	// (at the $1 budget cap); the tighter budget cap gates the policy.
+	expectConsumptionBatch(mockStore, map[usedKey]*types.Consumption{
+		{types.DimensionGroup, "grp-engineers", 86_400}: {TokensInput: 100, CostUSD: 1.00},
+	})
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		GroupIDs:   []string{"grp-engineers"},
+		ProviderID: "prov-1",
+	})
+	require.NoError(t, err)
+	assert.False(t, res.Allow,
+		"the tighter of (token, budget) wins — abundant token headroom must NOT mask an exhausted budget")
+	assert.Equal(t, denyCodeBudgetCapExceeded, res.DenyCode)
+}
diff --git a/management/internals/modules/agentnetwork/reconcile.go b/management/internals/modules/agentnetwork/reconcile.go
new file mode 100644
index 000000000..319553ebc
--- /dev/null
+++ b/management/internals/modules/agentnetwork/reconcile.go
@@ -0,0 +1,131 @@
+package agentnetwork
+
+import (
+	"context"
+
+	log "github.com/sirupsen/logrus"
+
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// reconcile recomputes the synthesised reverse-proxy services for an
+// account, diffs them against the previously-synthesised set in the
+// in-memory cache, and emits Create / Update / Delete proxy mappings
+// to the affected clusters. Also triggers a peer-side network-map
+// recompute via accountManager.UpdateAccountPeers so the
+// private-service ACL injection picks up the new state immediately.
+//
+// Reconcile failures are logged and swallowed — the underlying CRUD
+// has already completed, and the next mutation (or proxy reconnect)
+// will re-converge the cluster's view.
+func (m *managerImpl) reconcile(ctx context.Context, accountID string) {
+	if accountID == "" {
+		return
+	}
+
+	defer func() {
+		if m.accountManager != nil {
+			m.accountManager.UpdateAccountPeers(ctx, accountID, types.UpdateReason{
+				Resource:  types.UpdateResourceService,
+				Operation: types.UpdateOperationUpdate,
+			})
+		}
+	}()
+
+	if m.proxyController == nil {
+		return
+	}
+
+	services, err := SynthesizeServices(ctx, m.store, accountID)
+	if err != nil {
+		log.WithContext(ctx).WithError(err).Warnf("agent-network reconcile: synthesise services for account %s", accountID)
+		return
+	}
+
+	oidcCfg := m.proxyController.GetOIDCValidationConfig()
+	current := make(map[string]*proto.ProxyMapping, len(services))
+	for _, svc := range services {
+		if svc == nil || svc.ID == "" {
+			continue
+		}
+		current[svc.ID] = svc.ToProtoMapping(rpservice.Update, "", oidcCfg)
+	}
+
+	m.reconcileMu.Lock()
+	previous := m.reconcileCache[accountID]
+	if previous == nil {
+		previous = make(map[string]*proto.ProxyMapping)
+	}
+
+	creates, updates, deletes := diffMappings(previous, current)
+	if len(current) == 0 {
+		delete(m.reconcileCache, accountID)
+	} else {
+		m.reconcileCache[accountID] = current
+	}
+	m.reconcileMu.Unlock()
+
+	for _, mapping := range creates {
+		mapping.Type = proto.ProxyMappingUpdateType_UPDATE_TYPE_CREATED
+		m.proxyController.SendServiceUpdateToCluster(ctx, accountID, mapping, clusterFromMapping(mapping))
+	}
+	for _, mapping := range updates {
+		mapping.Type = proto.ProxyMappingUpdateType_UPDATE_TYPE_MODIFIED
+		m.proxyController.SendServiceUpdateToCluster(ctx, accountID, mapping, clusterFromMapping(mapping))
+	}
+	for _, mapping := range deletes {
+		mapping.Type = proto.ProxyMappingUpdateType_UPDATE_TYPE_REMOVED
+		m.proxyController.SendServiceUpdateToCluster(ctx, accountID, mapping, clusterFromMapping(mapping))
+	}
+}
+
+// diffMappings classifies the previous→current transition for a
+// single account into Create / Update / Delete sets.
+//
+// Cluster moves (current.cluster != previous.cluster) are surfaced as
+// a Delete on the old cluster + Create on the new — handled by
+// emitting both a delete (on previous mapping) and a create (on the
+// current mapping) for that service ID.
+func diffMappings(previous, current map[string]*proto.ProxyMapping) (creates, updates, deletes []*proto.ProxyMapping) {
+	for id, cur := range current {
+		prev, existed := previous[id]
+		switch {
+		case !existed:
+			creates = append(creates, cur)
+		case prev.GetDomain() == "" || cur.GetAccountId() == prev.GetAccountId() && currentClusterChanged(prev, cur):
+			deletes = append(deletes, prev)
+			creates = append(creates, cur)
+		default:
+			updates = append(updates, cur)
+		}
+	}
+	for id, prev := range previous {
+		if _, stillThere := current[id]; !stillThere {
+			deletes = append(deletes, prev)
+		}
+	}
+	return creates, updates, deletes
+}
+
+func currentClusterChanged(prev, cur *proto.ProxyMapping) bool {
+	return clusterFromMapping(prev) != clusterFromMapping(cur)
+}
+
+// clusterFromMapping returns the cluster the mapping should be sent
+// to. ProxyMapping doesn't carry the cluster directly, so we rely on
+// the synthesised service's domain (`<slug>.<cluster>`) and split on
+// the first '.'.
+func clusterFromMapping(m *proto.ProxyMapping) string {
+	if m == nil {
+		return ""
+	}
+	domain := m.GetDomain()
+	for i := 0; i < len(domain); i++ {
+		if domain[i] == '.' {
+			return domain[i+1:]
+		}
+	}
+	return ""
+}
diff --git a/management/internals/modules/agentnetwork/reconcile_test.go b/management/internals/modules/agentnetwork/reconcile_test.go
new file mode 100644
index 000000000..0855f0dc1
--- /dev/null
+++ b/management/internals/modules/agentnetwork/reconcile_test.go
@@ -0,0 +1,232 @@
+package agentnetwork
+
+import (
+	"context"
+	"testing"
+
+	"github.com/golang/mock/gomock"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func newReconcileMgr(t *testing.T, ctrl *gomock.Controller) (*managerImpl, *store.MockStore, *proxy.MockController) {
+	t.Helper()
+	mockStore := store.NewMockStore(ctrl)
+	mockProxy := proxy.NewMockController(ctrl)
+	return &managerImpl{
+		store:           mockStore,
+		proxyController: mockProxy,
+		reconcileCache:  make(map[string]map[string]*proto.ProxyMapping),
+	}, mockStore, mockProxy
+}
+
+func newReconcileTestProvider() *types.Provider {
+	return &types.Provider{
+		ID:                "prov-1",
+		AccountID:         "acct-1",
+		ProviderID:        "openai_api",
+		Name:              "OpenAI",
+		UpstreamURL:       "https://api.openai.com",
+		APIKey:            "sk-test-key",
+		Enabled:           true,
+		SessionPrivateKey: "test-priv-key",
+		SessionPublicKey:  "test-pub-key",
+	}
+}
+
+func newReconcileTestPolicy(providerID, sourceGroupID string) *types.Policy {
+	return &types.Policy{
+		ID:                     "pol-1",
+		AccountID:              "acct-1",
+		Name:                   "engineers",
+		Enabled:                true,
+		SourceGroups:           []string{sourceGroupID},
+		DestinationProviderIDs: []string{providerID},
+	}
+}
+
+func newReconcileTestSettings() *types.Settings {
+	return &types.Settings{
+		AccountID: "acct-1",
+		Cluster:   "eu.proxy.netbird.io",
+		Subdomain: "violet",
+	}
+}
+
+func expectReconcileSynthInputs(mockStore *store.MockStore, ctx context.Context, providers []*types.Provider, policies []*types.Policy, guardrails []*types.Guardrail) {
+	mockStore.EXPECT().
+		GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "acct-1").
+		Return(newReconcileTestSettings(), nil)
+	mockStore.EXPECT().
+		GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, "acct-1").
+		Return(providers, nil)
+	mockStore.EXPECT().
+		GetAccountAgentNetworkPolicies(ctx, store.LockingStrengthNone, "acct-1").
+		Return(policies, nil)
+	mockStore.EXPECT().
+		GetAccountAgentNetworkGuardrails(ctx, store.LockingStrengthNone, "acct-1").
+		Return(guardrails, nil)
+}
+
+func TestReconcile_FirstSynth_EmitsCreate(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mgr, mockStore, mockProxy := newReconcileMgr(t, ctrl)
+	provider := newReconcileTestProvider()
+	policy := newReconcileTestPolicy(provider.ID, "grp-eng")
+
+	expectReconcileSynthInputs(mockStore, ctx, []*types.Provider{provider}, []*types.Policy{policy}, []*types.Guardrail{})
+	mockProxy.EXPECT().GetOIDCValidationConfig().Return(proxy.OIDCValidationConfig{})
+
+	var sentMappings []*proto.ProxyMapping
+	mockProxy.EXPECT().
+		SendServiceUpdateToCluster(ctx, "acct-1", gomock.Any(), "eu.proxy.netbird.io").
+		Do(func(_ context.Context, _ string, m *proto.ProxyMapping, _ string) {
+			sentMappings = append(sentMappings, m)
+		})
+
+	mgr.reconcile(ctx, "acct-1")
+
+	require.Len(t, sentMappings, 1, "first synth must emit one mapping")
+	assert.Equal(t, proto.ProxyMappingUpdateType_UPDATE_TYPE_CREATED, sentMappings[0].Type, "first synth is a Create")
+	assert.Equal(t, "agent-net-svc-acct-1", sentMappings[0].Id, "stable account-scoped virtual service id")
+	assert.Equal(t, "violet.eu.proxy.netbird.io", sentMappings[0].Domain, "domain comes from settings (subdomain.cluster)")
+
+	mgr.reconcileMu.Lock()
+	cached := mgr.reconcileCache["acct-1"]
+	mgr.reconcileMu.Unlock()
+	require.Len(t, cached, 1, "cache must hold the synth result for next diff")
+}
+
+func TestReconcile_NoChange_EmitsNothingExtra(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mgr, mockStore, mockProxy := newReconcileMgr(t, ctrl)
+	provider := newReconcileTestProvider()
+	policy := newReconcileTestPolicy(provider.ID, "grp-eng")
+
+	// Two identical synth runs.
+	mockStore.EXPECT().
+		GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "acct-1").
+		Return(newReconcileTestSettings(), nil).Times(2)
+	mockStore.EXPECT().
+		GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, "acct-1").
+		Return([]*types.Provider{provider}, nil).Times(2)
+	mockStore.EXPECT().
+		GetAccountAgentNetworkPolicies(ctx, store.LockingStrengthNone, "acct-1").
+		Return([]*types.Policy{policy}, nil).Times(2)
+	mockStore.EXPECT().
+		GetAccountAgentNetworkGuardrails(ctx, store.LockingStrengthNone, "acct-1").
+		Return([]*types.Guardrail{}, nil).Times(2)
+	mockProxy.EXPECT().GetOIDCValidationConfig().Return(proxy.OIDCValidationConfig{}).Times(2)
+
+	createCalls := 0
+	updateCalls := 0
+	mockProxy.EXPECT().
+		SendServiceUpdateToCluster(ctx, "acct-1", gomock.Any(), gomock.Any()).
+		Do(func(_ context.Context, _ string, m *proto.ProxyMapping, _ string) {
+			switch m.Type {
+			case proto.ProxyMappingUpdateType_UPDATE_TYPE_CREATED:
+				createCalls++
+			case proto.ProxyMappingUpdateType_UPDATE_TYPE_MODIFIED:
+				updateCalls++
+			}
+		}).
+		AnyTimes()
+
+	mgr.reconcile(ctx, "acct-1")
+	mgr.reconcile(ctx, "acct-1")
+
+	assert.Equal(t, 1, createCalls, "first reconcile creates")
+	assert.Equal(t, 1, updateCalls, "second reconcile re-pushes as Modified (no semantic change but mapping fields refresh)")
+}
+
+func TestReconcile_PolicyRemoved_EmitsDelete(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mgr, mockStore, mockProxy := newReconcileMgr(t, ctrl)
+	provider := newReconcileTestProvider()
+	policy := newReconcileTestPolicy(provider.ID, "grp-eng")
+
+	gomock.InOrder(
+		// First reconcile: provider + policy, synthesised.
+		mockStore.EXPECT().GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "acct-1").Return(newReconcileTestSettings(), nil),
+		mockStore.EXPECT().GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, "acct-1").Return([]*types.Provider{provider}, nil),
+		mockStore.EXPECT().GetAccountAgentNetworkPolicies(ctx, store.LockingStrengthNone, "acct-1").Return([]*types.Policy{policy}, nil),
+		mockStore.EXPECT().GetAccountAgentNetworkGuardrails(ctx, store.LockingStrengthNone, "acct-1").Return([]*types.Guardrail{}, nil),
+		// Second reconcile: policy gone, provider stays but no longer referenced.
+		mockStore.EXPECT().GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "acct-1").Return(newReconcileTestSettings(), nil),
+		mockStore.EXPECT().GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, "acct-1").Return([]*types.Provider{provider}, nil),
+		mockStore.EXPECT().GetAccountAgentNetworkPolicies(ctx, store.LockingStrengthNone, "acct-1").Return([]*types.Policy{}, nil),
+	)
+	mockProxy.EXPECT().GetOIDCValidationConfig().Return(proxy.OIDCValidationConfig{}).AnyTimes()
+
+	var seenTypes []proto.ProxyMappingUpdateType
+	mockProxy.EXPECT().
+		SendServiceUpdateToCluster(ctx, "acct-1", gomock.Any(), "eu.proxy.netbird.io").
+		Do(func(_ context.Context, _ string, m *proto.ProxyMapping, _ string) {
+			seenTypes = append(seenTypes, m.Type)
+		}).
+		AnyTimes()
+
+	mgr.reconcile(ctx, "acct-1")
+	mgr.reconcile(ctx, "acct-1")
+
+	require.Len(t, seenTypes, 2, "create then delete")
+	assert.Equal(t, proto.ProxyMappingUpdateType_UPDATE_TYPE_CREATED, seenTypes[0])
+	assert.Equal(t, proto.ProxyMappingUpdateType_UPDATE_TYPE_REMOVED, seenTypes[1])
+
+	mgr.reconcileMu.Lock()
+	_, present := mgr.reconcileCache["acct-1"]
+	mgr.reconcileMu.Unlock()
+	assert.False(t, present, "cache for the account must be cleared once nothing is synthesised")
+}
+
+func TestReconcile_NilProxyController_NoOp(t *testing.T) {
+	ctx := context.Background()
+	mgr := &managerImpl{
+		reconcileCache: make(map[string]map[string]*proto.ProxyMapping),
+	}
+	// Must not panic; must not query the store.
+	mgr.reconcile(ctx, "acct-1")
+}
+
+func TestReconcile_EmptyAccountID_NoOp(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mgr, _, _ := newReconcileMgr(t, ctrl)
+	// Empty accountID short-circuits before any store call.
+	mgr.reconcile(ctx, "")
+}
+
+func TestClusterFromMapping(t *testing.T) {
+	tests := []struct {
+		name   string
+		domain string
+		want   string
+	}{
+		{"simple", "openai.eu.proxy.netbird.io", "eu.proxy.netbird.io"},
+		{"deeply nested", "a.b.c.d", "b.c.d"},
+		{"no dot", "openai", ""},
+		{"empty", "", ""},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := clusterFromMapping(&proto.ProxyMapping{Domain: tt.domain})
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
diff --git a/management/internals/modules/agentnetwork/synthesizer.go b/management/internals/modules/agentnetwork/synthesizer.go
new file mode 100644
index 000000000..9814d1a11
--- /dev/null
+++ b/management/internals/modules/agentnetwork/synthesizer.go
@@ -0,0 +1,1083 @@
+package agentnetwork
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/url"
+	"sort"
+	"strings"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/sessionkey"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// apiKeyPlaceholder is the literal substituted with the provider's
+// decrypted API key in catalog AuthHeaderTemplate strings.
+const apiKeyPlaceholder = "${API_KEY}" //nolint:gosec // template marker, not a credential
+
+// gcpKeyfilePrefix marks an api_key that holds a base64-encoded GCP
+// service-account JSON key ("keyfile::<base64>") rather than a static bearer
+// token; the proxy mints OAuth tokens from it. Mirrors Aperture's convention.
+const gcpKeyfilePrefix = "keyfile::"
+
+// SynthesizedServiceIDPrefix prefixes the in-memory ID of every
+// reverse-proxy service synthesised from Agent Network state. One
+// synthesised service exists per (account, cluster); the suffix is the
+// account ID so the proxy can dedup mappings cleanly.
+const SynthesizedServiceIDPrefix = "agent-net-svc-"
+
+// agentNetworkRequestCaptureBytes is the request-side body capture cap.
+// Kept modest: oversized requests (a long conversation's context can be
+// many MB) have their routing fields recovered by the proxy's tolerant
+// scan rather than buffered here, so there's no need to size this to the
+// largest possible request.
+const agentNetworkRequestCaptureBytes = 1 << 20
+
+// agentNetworkResponseCaptureBytes is the response-side body capture cap.
+// Token usage lives in the trailing SSE message_delta event, so the
+// captured prefix must reach the end of the stream. Unlike a request's
+// unbounded context, a single response is hard-capped by the model's max
+// output tokens (~128K on Opus → a few hundred KB of gzipped SSE even
+// with thinking), so 8 MiB is comfortably above any real response and is
+// effectively unlimited here — not a moving ceiling. The proxy clamps to
+// its own MaxBodyCapBytes at apply time.
+const agentNetworkResponseCaptureBytes = 8 << 20
+
+// agentNetworkCaptureContentTypes is the set of content types whose
+// bodies the proxy buffers for the LLM middlewares. JSON covers
+// buffered request and response bodies; SSE covers streaming
+// responses (the response parser sums delta tokens across chunks).
+var agentNetworkCaptureContentTypes = []string{
+	"application/json",
+	"text/event-stream",
+}
+
+// Middleware IDs the synthesised target chain registers, mirroring the
+// proxy-side built-in registry. Order matters: on_request runs in the
+// order they're listed; on_response runs in reverse, so cost_meter must
+// come BEFORE llm_response_parser in the slice so the parser populates
+// tokens before the cost meter reads them.
+const (
+	middlewareIDLLMRequestParser  = "llm_request_parser"
+	middlewareIDLLMRouter         = "llm_router"
+	middlewareIDLLMIdentityInject = "llm_identity_inject"
+	middlewareIDLLMLimitCheck     = "llm_limit_check"
+	middlewareIDLLMGuardrail      = "llm_guardrail"
+	middlewareIDCostMeter         = "cost_meter"
+	middlewareIDLLMResponseParser = "llm_response_parser"
+	middlewareIDLLMLimitRecord    = "llm_limit_record"
+)
+
+// SynthesizeServicesForCluster walks every account's agent-network
+// settings row pinned to clusterAddr and synthesises the per-account
+// gateway service. Used by the proxy-mapping snapshot path where the
+// connecting proxy has a specific cluster address and cares about every
+// account that routes through it.
+//
+// Returns nil (no error) when no settings row references the cluster.
+// Per-account synthesis failures are skipped rather than dropping every
+// account on the cluster.
+func SynthesizeServicesForCluster(ctx context.Context, s store.Store, clusterAddr string) ([]*rpservice.Service, error) {
+	clusterAddr = strings.TrimSpace(clusterAddr)
+	if clusterAddr == "" {
+		return nil, nil
+	}
+
+	settingsRows, err := s.GetAgentNetworkSettingsByCluster(ctx, store.LockingStrengthNone, clusterAddr)
+	if err != nil {
+		return nil, fmt.Errorf("list agent network settings on cluster: %w", err)
+	}
+	if len(settingsRows) == 0 {
+		return nil, nil
+	}
+
+	var out []*rpservice.Service
+	for _, settings := range settingsRows {
+		if settings == nil {
+			continue
+		}
+		services, serr := SynthesizeServices(ctx, s, settings.AccountID)
+		if serr != nil {
+			continue
+		}
+		for _, svc := range services {
+			if svc != nil && svc.ProxyCluster == clusterAddr {
+				out = append(out, svc)
+			}
+		}
+	}
+	return out, nil
+}
+
+// SynthesizeServiceForDomain resolves a single agent-network service by its
+// public endpoint domain. It lists the (few) settings rows on the domain's
+// cluster, matches the one whose endpoint equals the domain, and synthesises
+// only that account — avoiding full per-account synthesis for every tenant on
+// the cluster, which is what auth/session paths previously paid. Returns nil
+// (no error) when no account owns the domain.
+func SynthesizeServiceForDomain(ctx context.Context, s store.Store, domain string) (*rpservice.Service, error) {
+	domain = strings.TrimSpace(domain)
+	cluster := clusterFromDomain(domain)
+	if domain != "" && cluster != "" {
+		settingsRows, err := s.GetAgentNetworkSettingsByCluster(ctx, store.LockingStrengthNone, cluster)
+		if err != nil {
+			return nil, fmt.Errorf("list agent network settings on cluster: %w", err)
+		}
+		for _, settings := range settingsRows {
+			if settings == nil || settings.Endpoint() != domain {
+				continue
+			}
+			services, serr := SynthesizeServices(ctx, s, settings.AccountID)
+			if serr != nil {
+				return nil, serr
+			}
+			for _, svc := range services {
+				if svc != nil && svc.Domain == domain {
+					return svc, nil
+				}
+			}
+			break
+		}
+	}
+	return nil, nil //nolint:nilnil // optional lookup: no account owns the domain
+}
+
+// clusterFromDomain returns the cluster portion of an endpoint domain (every
+// label after the first).
+func clusterFromDomain(domain string) string {
+	if i := strings.IndexByte(domain, '.'); i >= 0 {
+		return domain[i+1:]
+	}
+	return ""
+}
+
+// SynthesizeServices builds the in-memory reverse-proxy service that
+// fronts the account's agent-network gateway. Returns nil when the
+// account has no settings row, no enabled providers, or no enabled
+// policies — in any of those cases there's nothing useful to expose.
+//
+// One service per (account, settings.Cluster) is emitted. The router
+// middleware encodes a denormalised model→provider routing table
+// (auth headers + decrypted API keys baked in); the policy_check
+// middleware encodes per-provider authorised group IDs derived from
+// the account's enabled policies.
+//
+// Services are NEVER persisted — callers regenerate them on every
+// network-map / proxy-mapping cycle from current state.
+func SynthesizeServices(ctx context.Context, s store.Store, accountID string) ([]*rpservice.Service, error) {
+	settings, ok, err := loadSettings(ctx, s, accountID)
+	if err != nil {
+		return nil, err
+	}
+	if !ok || strings.TrimSpace(settings.Cluster) == "" {
+		return nil, nil
+	}
+
+	providers, err := s.GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, accountID)
+	if err != nil {
+		return nil, fmt.Errorf("list agent network providers: %w", err)
+	}
+	enabledProviders := filterEnabledProviders(providers)
+	if len(enabledProviders) == 0 {
+		return nil, nil
+	}
+
+	policies, err := s.GetAccountAgentNetworkPolicies(ctx, store.LockingStrengthNone, accountID)
+	if err != nil {
+		return nil, fmt.Errorf("list agent network policies: %w", err)
+	}
+	enabledPolicies := filterEnabledPolicies(policies)
+	if len(enabledPolicies) == 0 {
+		return nil, nil
+	}
+
+	// Backfill any missing session keypairs before deriving a
+	// service-level keypair. Old rows pre-date the column; treating
+	// the gap as a no-op produces an immediate dial failure, so we
+	// fix it once here and persist for future cycles.
+	for _, p := range enabledProviders {
+		if p.SessionPrivateKey != "" && p.SessionPublicKey != "" {
+			continue
+		}
+		if err := backfillProviderSessionKeys(ctx, s, p); err != nil {
+			return nil, fmt.Errorf("backfill session keys for provider %s: %w", p.ID, err)
+		}
+	}
+
+	guardrails, err := s.GetAccountAgentNetworkGuardrails(ctx, store.LockingStrengthNone, accountID)
+	if err != nil {
+		return nil, fmt.Errorf("list agent network guardrails: %w", err)
+	}
+	guardrailsByID := make(map[string]*types.Guardrail, len(guardrails))
+	for _, g := range guardrails {
+		if g != nil {
+			guardrailsByID[g.ID] = g
+		}
+	}
+
+	groupIndex := indexProviderGroups(enabledPolicies)
+
+	routerCfgJSON, err := buildRouterConfigJSON(enabledProviders, groupIndex)
+	if err != nil {
+		return nil, err
+	}
+
+	identityInjectJSON, err := buildIdentityInjectConfigJSON(enabledProviders, groupIndex)
+	if err != nil {
+		return nil, err
+	}
+
+	mergedGuardrails := mergeGuardrails(enabledPolicies, guardrailsByID)
+	applyAccountCollectionControls(&mergedGuardrails, settings)
+	guardrailJSON, err := marshalGuardrailConfig(mergedGuardrails)
+	if err != nil {
+		return nil, err
+	}
+
+	// Use the merged decision (account settings OR policy-required redaction),
+	// not the raw account flag, so a policy that mandates PII redaction is
+	// honored by the capture parsers even when the account toggle is off.
+	middlewares := buildMiddlewareChain(routerCfgJSON, identityInjectJSON, guardrailJSON, mergedGuardrails.PromptCapture.RedactPii, mergedGuardrails.PromptCapture.Enabled)
+
+	priv, pub, err := pickServiceSessionKeys(enabledProviders)
+	if err != nil {
+		return nil, err
+	}
+
+	svc := buildAccountService(accountID, settings, enabledPolicies, middlewares, priv, pub)
+	return []*rpservice.Service{svc}, nil
+}
+
+// loadSettings returns the account's agent-network settings row. The
+// boolean reports whether a row exists; a status.NotFound surfaces as
+// (nil, false, nil) so callers can treat "no settings" as "no
+// synthesis" without inspecting error types themselves.
+func loadSettings(ctx context.Context, s store.Store, accountID string) (*types.Settings, bool, error) {
+	settings, err := s.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
+	if err == nil {
+		return settings, true, nil
+	}
+	var sErr *status.Error
+	if errors.As(err, &sErr) && sErr.Type() == status.NotFound {
+		return nil, false, nil
+	}
+	return nil, false, fmt.Errorf("get agent network settings: %w", err)
+}
+
+// filterEnabledProviders returns the subset of enabled providers, sorted
+// by created_at ascending so the router config is deterministic and
+// first-match-wins is stable across synthesis cycles.
+func filterEnabledProviders(providers []*types.Provider) []*types.Provider {
+	out := make([]*types.Provider, 0, len(providers))
+	for _, p := range providers {
+		if p == nil || !p.Enabled {
+			continue
+		}
+		out = append(out, p)
+	}
+	sort.SliceStable(out, func(i, j int) bool {
+		if !out[i].CreatedAt.Equal(out[j].CreatedAt) {
+			return out[i].CreatedAt.Before(out[j].CreatedAt)
+		}
+		return out[i].ID < out[j].ID
+	})
+	return out
+}
+
+// filterEnabledPolicies returns the subset of enabled policies.
+func filterEnabledPolicies(policies []*types.Policy) []*types.Policy {
+	out := make([]*types.Policy, 0, len(policies))
+	for _, p := range policies {
+		if p == nil || !p.Enabled {
+			continue
+		}
+		out = append(out, p)
+	}
+	return out
+}
+
+// backfillProviderSessionKeys mints an ed25519 session keypair on a
+// provider row that doesn't have one yet (rows created before the
+// keys were persistent fields) and persists it via the store so
+// subsequent cycles get stable keys.
+func backfillProviderSessionKeys(ctx context.Context, s store.Store, p *types.Provider) error {
+	pair, err := sessionkey.GenerateKeyPair()
+	if err != nil {
+		return fmt.Errorf("generate session keys for provider %s: %w", p.ID, err)
+	}
+	p.SessionPrivateKey = pair.PrivateKey
+	p.SessionPublicKey = pair.PublicKey
+	if err := s.SaveAgentNetworkProvider(ctx, p); err != nil {
+		return fmt.Errorf("persist backfilled session keys for provider %s: %w", p.ID, err)
+	}
+	return nil
+}
+
+// pickServiceSessionKeys returns the keypair the synthesised gateway
+// service signs / verifies session JWTs with. The PoC reuses the first
+// enabled provider's keypair so existing session cookies survive
+// provider edits as long as the first-by-created_at provider stays in
+// place. Returns an error when no provider has a usable keypair after
+// backfill — that surfaces a misconfigured account loudly instead of
+// emitting a service the proxy will reject as "invalid session public
+// key size".
+func pickServiceSessionKeys(providers []*types.Provider) (priv, pub string, err error) {
+	for _, p := range providers {
+		if p.SessionPrivateKey != "" && p.SessionPublicKey != "" {
+			return p.SessionPrivateKey, p.SessionPublicKey, nil
+		}
+	}
+	return "", "", fmt.Errorf("no provider with session keypair; update one provider to backfill")
+}
+
+// routerConfig mirrors the on-wire shape llm_router accepts. Kept
+// private so the synthesiser owns the contract; the proxy-side factory
+// JSON-decodes the same shape.
+type routerConfig struct {
+	Providers []routerProviderRoute `json:"providers"`
+}
+
+type routerProviderRoute struct {
+	ID              string   `json:"id"`
+	Vendor          string   `json:"vendor,omitempty"`
+	Models          []string `json:"models"`
+	UpstreamScheme  string   `json:"upstream_scheme"`
+	UpstreamHost    string   `json:"upstream_host"`
+	UpstreamPath    string   `json:"upstream_path,omitempty"`
+	AuthHeaderName  string   `json:"auth_header_name"`
+	AuthHeaderValue string   `json:"auth_header_value"`
+	AllowedGroupIDs []string `json:"allowed_group_ids,omitempty"`
+	// Vertex marks a Google Vertex AI provider, whose requests carry the
+	// model in the URL path. The router selects it by path, bypassing the
+	// model/vendor table.
+	Vertex bool `json:"vertex,omitempty"`
+	// Bedrock marks an AWS Bedrock provider, whose requests carry the model in
+	// the URL path (/model/{id}/{action}). The router selects it by path,
+	// bypassing the model/vendor table; auth is a static bearer token.
+	Bedrock bool `json:"bedrock,omitempty"`
+	// GCPServiceAccountKeyB64 carries a base64-encoded GCP service-account
+	// JSON key (from a "keyfile::<base64>" api_key). When set, the proxy mints
+	// + refreshes the OAuth token at request time instead of injecting a static
+	// AuthHeaderValue.
+	GCPServiceAccountKeyB64 string `json:"gcp_sa_key_b64,omitempty"`
+}
+
+// indexProviderGroups walks the enabled policies and returns, per
+// provider id, the sorted union of source group ids across every
+// policy that authorises the provider. Providers with no authorising
+// policy are absent from the map. The router consumes this to filter
+// candidate routes by the caller's group memberships before the
+// path-prefix tiebreak runs.
+func indexProviderGroups(policies []*types.Policy) map[string][]string {
+	sets := make(map[string]map[string]struct{})
+	for _, policy := range policies {
+		if policy == nil {
+			continue
+		}
+		for _, providerID := range policy.DestinationProviderIDs {
+			if providerID == "" {
+				continue
+			}
+			set, ok := sets[providerID]
+			if !ok {
+				set = make(map[string]struct{})
+				sets[providerID] = set
+			}
+			for _, group := range policy.SourceGroups {
+				if group != "" {
+					set[group] = struct{}{}
+				}
+			}
+		}
+	}
+	out := make(map[string][]string, len(sets))
+	for providerID, set := range sets {
+		groups := make([]string, 0, len(set))
+		for g := range set {
+			groups = append(groups, g)
+		}
+		sort.Strings(groups)
+		out[providerID] = groups
+	}
+	return out
+}
+
+// buildRouterConfigJSON denormalises the account's enabled providers
+// into the router middleware's first-match-wins routing table.
+// Providers are listed in created_at order so the table is
+// deterministic and stable across synth cycles.
+//
+// AllowedGroupIDs is the union of source group ids across every enabled
+// policy that authorises the provider. The router uses it as a hard
+// filter — a route whose AllowedGroupIDs has no intersection with the
+// caller's user groups is removed from the candidate list before the
+// path-prefix tiebreak. Providers no enabled policy authorises
+// (orphans) are intentionally OMITTED so the router never observes a
+// route with an empty ACL.
+func buildRouterConfigJSON(providers []*types.Provider, groupIndex map[string][]string) ([]byte, error) {
+	cfg := routerConfig{Providers: make([]routerProviderRoute, 0, len(providers))}
+	for _, p := range providers {
+		groups, hasPolicy := groupIndex[p.ID]
+		if !hasPolicy {
+			// Orphan: skip. No enabled policy authorises this
+			// provider, so it must not be reachable.
+			continue
+		}
+		scheme, host, path, err := parseUpstreamHost(p.UpstreamURL)
+		if err != nil {
+			return nil, fmt.Errorf("router config for provider %s: %w", p.ID, err)
+		}
+		headerName, headerValue, gcpSAKeyB64, err := providerAuthHeader(p)
+		if err != nil {
+			return nil, err
+		}
+		cfg.Providers = append(cfg.Providers, routerProviderRoute{
+			ID:                      p.ID,
+			Vendor:                  providerVendor(p),
+			Models:                  providerModelIDs(p),
+			UpstreamScheme:          scheme,
+			UpstreamHost:            host,
+			UpstreamPath:            path,
+			AuthHeaderName:          headerName,
+			AuthHeaderValue:         headerValue,
+			AllowedGroupIDs:         groups,
+			Vertex:                  catalog.IsVertexPathStyle(p.ProviderID),
+			Bedrock:                 catalog.IsBedrockPathStyle(p.ProviderID),
+			GCPServiceAccountKeyB64: gcpSAKeyB64,
+		})
+	}
+	out, err := json.Marshal(cfg)
+	if err != nil {
+		return nil, fmt.Errorf("marshal llm_router middleware config: %w", err)
+	}
+	return out, nil
+}
+
+// providerVendor returns the parser surface ("openai", "anthropic", …)
+// the provider speaks, sourced from its catalog entry's ParserID. The
+// router uses it to keep a request the parser tagged with a vendor on a
+// route of the same vendor — so e.g. an Anthropic /v1/messages call is
+// never sent to an OpenAI-compatible gateway that also claims the model.
+// Empty when the catalog entry is unknown or declares no parser surface;
+// the router then falls back to model / path routing.
+func providerVendor(p *types.Provider) string {
+	entry, ok := catalog.Lookup(p.ProviderID)
+	if !ok {
+		return ""
+	}
+	return entry.ParserID
+}
+
+// providerModelIDs returns the model identifiers exposed by the
+// provider, deduplicated and in the operator's declared order. Empty
+// slice when no models are configured — the router treats that as
+// "claim every model" so gateway-style providers (LiteLLM, custom
+// OpenAI-compatible endpoints) work without the operator enumerating
+// the upstream's full model catalog in NetBird.
+func providerModelIDs(p *types.Provider) []string {
+	if len(p.Models) == 0 {
+		return []string{}
+	}
+	seen := make(map[string]struct{}, len(p.Models))
+	out := make([]string, 0, len(p.Models))
+	for _, m := range p.Models {
+		if m.ID == "" {
+			continue
+		}
+		if _, dup := seen[m.ID]; dup {
+			continue
+		}
+		seen[m.ID] = struct{}{}
+		out = append(out, m.ID)
+	}
+	return out
+}
+
+// identityInjectConfig mirrors the on-wire shape llm_identity_inject
+// accepts.
+type identityInjectConfig struct {
+	Providers []identityInjectProvider `json:"providers"`
+}
+
+// identityInjectProvider carries one provider's injection rule.
+// Identity-stamping uses one of HeaderPair / JSONMetadata (mutually
+// exclusive). ExtraHeaders is independent — a list of extra
+// per-provider routing/config headers (catalog-declared, value lives
+// on the provider record) the middleware stamps with anti-spoof
+// (Remove + Add) on every matching request.
+type identityInjectProvider struct {
+	ProviderID   string                      `json:"provider_id"`
+	HeaderPair   *identityInjectHeaderPair   `json:"header_pair,omitempty"`
+	JSONMetadata *identityInjectJSONMetadata `json:"json_metadata,omitempty"`
+	ExtraHeaders []identityInjectExtraHeader `json:"extra_headers,omitempty"`
+}
+
+type identityInjectExtraHeader struct {
+	Name  string `json:"name"`
+	Value string `json:"value"`
+}
+
+type identityInjectHeaderPair struct {
+	EndUserIDHeader string `json:"end_user_id_header,omitempty"`
+	TagsHeader      string `json:"tags_header,omitempty"`
+	TagsInBody      bool   `json:"tags_in_body,omitempty"`
+	EndUserIDInBody bool   `json:"end_user_id_in_body,omitempty"`
+}
+
+type identityInjectJSONMetadata struct {
+	Header         string `json:"header"`
+	UserKey        string `json:"user_key,omitempty"`
+	GroupsKey      string `json:"groups_key,omitempty"`
+	MaxValueLength int    `json:"max_value_length,omitempty"`
+}
+
+// buildIdentityInjectConfigJSON walks the enabled providers and emits
+// one entry per provider whose catalog entry declares an
+// IdentityInjection block. The middleware no-ops for any provider not
+// in this list, so the chain is safe to ship to all targets even when
+// no identity-stamping provider is configured.
+//
+// The caller passes groupIndex so we can mirror the synthesiser's own
+// "drop orphans" rule — providers no enabled policy authorises don't
+// reach the router, so injecting identity for them would never fire.
+// We could leave them in for symmetry, but skipping is cheaper and
+// clearer.
+func buildIdentityInjectConfigJSON(providers []*types.Provider, groupIndex map[string][]string) ([]byte, error) {
+	cfg := identityInjectConfig{Providers: make([]identityInjectProvider, 0)}
+	for _, p := range providers {
+		if _, hasPolicy := groupIndex[p.ID]; !hasPolicy {
+			continue
+		}
+		entry, ok := catalog.Lookup(p.ProviderID)
+		if !ok {
+			continue
+		}
+		rule, ok := buildIdentityInjectRule(p, entry)
+		if !ok {
+			continue
+		}
+		cfg.Providers = append(cfg.Providers, rule)
+	}
+	out, err := json.Marshal(cfg)
+	if err != nil {
+		return nil, fmt.Errorf("marshal llm_identity_inject middleware config: %w", err)
+	}
+	return out, nil
+}
+
+// buildIdentityInjectRule assembles the injection rule for one provider
+// from its record and catalog entry. The second return is false when the
+// provider would emit nothing, so the caller can skip it entirely rather
+// than carry an inert rule for it.
+func buildIdentityInjectRule(p *types.Provider, entry catalog.Provider) (identityInjectProvider, bool) {
+	rule := identityInjectProvider{ProviderID: p.ID}
+	// Identity-stamping shape (one of HeaderPair / JSONMetadata). Skip the
+	// shape silently when the catalog entry doesn't declare one — extras
+	// can still apply, see below.
+	if entry.IdentityInjection != nil {
+		switch {
+		case entry.IdentityInjection.HeaderPair != nil:
+			rule.HeaderPair = buildIdentityHeaderPair(p, entry.IdentityInjection.HeaderPair)
+		case entry.IdentityInjection.JSONMetadata != nil:
+			rule.JSONMetadata = buildIdentityJSONMetadata(p, entry.IdentityInjection.JSONMetadata)
+		}
+	}
+	rule.ExtraHeaders = buildIdentityExtraHeaders(p, entry.ExtraHeaders)
+	if rule.HeaderPair == nil && rule.JSONMetadata == nil && len(rule.ExtraHeaders) == 0 {
+		return identityInjectProvider{}, false
+	}
+	return rule, true
+}
+
+// buildIdentityHeaderPair resolves the header-pair injection shape,
+// returning nil when nothing would be stamped. For Customizable shapes
+// (Bifrost today) the wire header names come from the provider record
+// verbatim; the catalog values are placeholder defaults shown by the
+// dashboard, not authoritative. Empty operator value disables stamping
+// for that dimension — applyHeaderPair already no-ops on empty header
+// names. The body-inject flags stay catalog-owned because Customizable
+// today only applies to gateways that read identity from headers (the
+// flags would be no-ops anyway).
+func buildIdentityHeaderPair(p *types.Provider, hp *catalog.HeaderPairInjection) *identityInjectHeaderPair {
+	userHeader := hp.EndUserIDHeader
+	tagsHeader := hp.TagsHeader
+	if hp.Customizable {
+		userHeader = p.IdentityHeaderUserID
+		tagsHeader = p.IdentityHeaderGroups
+	}
+	if userHeader == "" && tagsHeader == "" && !hp.TagsInBody && !hp.EndUserIDInBody {
+		return nil
+	}
+	return &identityInjectHeaderPair{
+		EndUserIDHeader: userHeader,
+		TagsHeader:      tagsHeader,
+		TagsInBody:      hp.TagsInBody,
+		EndUserIDInBody: hp.EndUserIDInBody,
+	}
+}
+
+// buildIdentityJSONMetadata resolves the JSON-metadata injection shape,
+// returning nil when the catalog entry carries no header. Customizable
+// JSONMetadata reuses the same provider-record fields HeaderPair uses —
+// IdentityHeaderUserID becomes the JSON key for the user dimension, and
+// IdentityHeaderGroups becomes the JSON key for groups. Empty operator
+// value is honored as "skip this key"; applyJSONMetadata already drops
+// keys with empty names. Header itself is catalog-owned (e.g.
+// cf-aig-metadata) — operators only override the keys inside the JSON,
+// not the wire header that carries it.
+func buildIdentityJSONMetadata(p *types.Provider, jm *catalog.JSONMetadataInjection) *identityInjectJSONMetadata {
+	if jm.Header == "" {
+		return nil
+	}
+	userKey := jm.UserKey
+	groupsKey := jm.GroupsKey
+	if jm.Customizable {
+		userKey = p.IdentityHeaderUserID
+		groupsKey = p.IdentityHeaderGroups
+	}
+	return &identityInjectJSONMetadata{
+		Header:         jm.Header,
+		UserKey:        userKey,
+		GroupsKey:      groupsKey,
+		MaxValueLength: jm.MaxValueLength,
+	}
+}
+
+// buildIdentityExtraHeaders collects catalog-declared static headers (e.g.
+// Portkey config id), emitting only entries whose value the operator has
+// filled in on the provider record; missing/empty values are no-ops.
+func buildIdentityExtraHeaders(p *types.Provider, extras []catalog.ExtraHeader) []identityInjectExtraHeader {
+	var out []identityInjectExtraHeader
+	for _, h := range extras {
+		if h.Name == "" {
+			continue
+		}
+		v := strings.TrimSpace(p.ExtraValues[h.Name])
+		if v == "" {
+			continue
+		}
+		out = append(out, identityInjectExtraHeader{Name: h.Name, Value: v})
+	}
+	return out
+}
+
+// buildMiddlewareChain assembles the per-target middleware chain that
+// implements the Agent Network behaviour at the proxy. Slot order on
+// the request leg is the slice order; on the response leg it runs in
+// reverse, so cost_meter must come BEFORE llm_response_parser so the
+// parser populates token counts before the cost meter reads them.
+//
+// Authorisation is fused into llm_router: the router carries
+// AllowedGroupIDs per provider and filters candidates by the caller's
+// user-groups before the path-prefix tiebreak. Per-policy
+// enforcement (token / budget caps) lives in llm_limit_check, which
+// runs after the router so it can read the resolved provider id;
+// llm_limit_record on the response leg posts deltas back to
+// management to keep the consumption counters fresh.
+//
+// llm_identity_inject runs immediately after the router so the
+// resolved provider id is available; it stamps NetBird identity onto
+// requests bound for gateways like LiteLLM that key budgets and
+// attribution off request headers. CanMutate is required so its
+// HeadersAdd / HeadersRemove pass the framework's mutation gate.
+func buildMiddlewareChain(routerCfgJSON, identityInjectJSON, guardrailJSON []byte, redactPii, capturePromptContent bool) []rpservice.MiddlewareConfig {
+	// Both parsers receive an explicit capture flag derived from the account's
+	// enable_prompt_collection toggle; nil/unset would default to the legacy
+	// "always emit" behavior in the middleware, which is precisely what we
+	// must suppress when the operator hasn't opted in. The flag is duplicated
+	// across both parsers under distinct field names (capture_prompt /
+	// capture_completion) to keep each parser's config independently
+	// auditable.
+	requestParserCfg := buildParserConfigJSON("capture_prompt", redactPii, capturePromptContent)
+	responseParserCfg := buildParserConfigJSON("capture_completion", redactPii, capturePromptContent)
+	return []rpservice.MiddlewareConfig{
+		{
+			ID:         middlewareIDLLMRequestParser,
+			Enabled:    true,
+			Slot:       rpservice.MiddlewareSlotOnRequest,
+			ConfigJSON: requestParserCfg,
+		},
+		{
+			ID:         middlewareIDLLMRouter,
+			Enabled:    true,
+			Slot:       rpservice.MiddlewareSlotOnRequest,
+			ConfigJSON: routerCfgJSON,
+			// llm_router rewrites the request's headers (strip
+			// client auth + inject provider auth) and the upstream
+			// target via Mutations.RewriteUpstream. Both gated on
+			// CanMutate; without this flag the chain framework
+			// drops every mutation and the reverse proxy dials the
+			// placeholder noop.invalid host (502).
+			CanMutate: true,
+		},
+		{
+			// llm_limit_check runs after the router so it knows the
+			// resolved provider id, but before identity_inject so a
+			// cap-deny doesn't pay the cost of stamping headers
+			// we'll never use.
+			ID:         middlewareIDLLMLimitCheck,
+			Enabled:    true,
+			Slot:       rpservice.MiddlewareSlotOnRequest,
+			ConfigJSON: []byte("{}"),
+		},
+		{
+			ID:         middlewareIDLLMIdentityInject,
+			Enabled:    true,
+			Slot:       rpservice.MiddlewareSlotOnRequest,
+			ConfigJSON: identityInjectJSON,
+			// CanMutate is required so HeadersAdd / HeadersRemove
+			// emitted to stamp NetBird identity onto the upstream
+			// request actually land — without it the framework
+			// drops every header mutation.
+			CanMutate: true,
+		},
+		{
+			ID:         middlewareIDLLMGuardrail,
+			Enabled:    true,
+			Slot:       rpservice.MiddlewareSlotOnRequest,
+			ConfigJSON: guardrailJSON,
+		},
+		{
+			// Response slot runs in reverse slice order at runtime:
+			// limit_record sits FIRST in the response section so it
+			// runs LAST, after llm_response_parser stamped tokens
+			// and cost_meter computed cost — both of which the
+			// recorder reads from the metadata bag.
+			ID:         middlewareIDLLMLimitRecord,
+			Enabled:    true,
+			Slot:       rpservice.MiddlewareSlotOnResponse,
+			ConfigJSON: []byte("{}"),
+		},
+		{
+			ID:         middlewareIDCostMeter,
+			Enabled:    true,
+			Slot:       rpservice.MiddlewareSlotOnResponse,
+			ConfigJSON: []byte("{}"),
+		},
+		{
+			ID:         middlewareIDLLMResponseParser,
+			Enabled:    true,
+			Slot:       rpservice.MiddlewareSlotOnResponse,
+			ConfigJSON: responseParserCfg,
+		},
+	}
+}
+
+// guardrailConfig is the JSON shape the proxy-side llm_guardrail
+// middleware expects. Mirrors the proxy registration documented in
+// the management→proxy contract.
+type guardrailConfig struct {
+	ModelAllowlist []string               `json:"model_allowlist,omitempty"`
+	PromptCapture  guardrailPromptCapture `json:"prompt_capture"`
+}
+
+type guardrailPromptCapture struct {
+	Enabled   bool `json:"enabled"`
+	RedactPii bool `json:"redact_pii"`
+}
+
+// buildParserConfigJSON assembles the request- or response-parser config JSON.
+// captureField names the parser-specific gate (capture_prompt for the request
+// parser, capture_completion for the response parser); both are sourced from
+// settings.EnablePromptCollection. redact_pii is only meaningful when capture
+// is on (no content → nothing to redact) but we forward it verbatim so the
+// proxy-side parser stays the only place that interprets the combination.
+func buildParserConfigJSON(captureField string, redactPii, capture bool) []byte {
+	payload := map[string]any{
+		captureField: capture,
+	}
+	if redactPii {
+		payload["redact_pii"] = true
+	}
+	out, err := json.Marshal(payload)
+	if err != nil {
+		// json.Marshal on a map[string]any of bools cannot fail; if it
+		// somehow does, ship the static minimal config so synth keeps
+		// working instead of panicking.
+		return []byte(`{}`)
+	}
+	return out
+}
+
+// applyAccountCollectionControls folds the account-level collection master
+// switches into the merged guardrail set. Prompt capture enablement is sourced
+// SOLELY from the account toggle — the account-network setting is the master
+// enable, and policies don't need to attach a capture-enabled guardrail to opt
+// in. PII redaction is safe-additive: it applies when either the account or a
+// policy guardrail enables it (OR).
+func applyAccountCollectionControls(merged *MergedGuardrails, settings *types.Settings) {
+	if settings == nil {
+		return
+	}
+	merged.PromptCapture.Enabled = settings.EnablePromptCollection
+	merged.PromptCapture.RedactPii = settings.RedactPii || merged.PromptCapture.RedactPii
+}
+
+func marshalGuardrailConfig(merged MergedGuardrails) ([]byte, error) {
+	cfg := guardrailConfig{
+		ModelAllowlist: merged.ModelAllowlist,
+		PromptCapture: guardrailPromptCapture{
+			Enabled:   merged.PromptCapture.Enabled,
+			RedactPii: merged.PromptCapture.RedactPii,
+		},
+	}
+	out, err := json.Marshal(cfg)
+	if err != nil {
+		return nil, fmt.Errorf("marshal guardrail middleware config: %w", err)
+	}
+	return out, nil
+}
+
+// buildAccountService composes the per-account gateway Service. The
+// target carries the noop placeholder URL — the router middleware
+// rewrites every request to the matched provider's upstream before the
+// proxy dials — alongside the full middleware chain and capture caps.
+func buildAccountService(
+	accountID string,
+	settings *types.Settings,
+	enabledPolicies []*types.Policy,
+	middlewares []rpservice.MiddlewareConfig,
+	sessionPriv, sessionPub string,
+) *rpservice.Service {
+	cluster := settings.Cluster
+	domain := settings.Endpoint()
+	serviceID := SynthesizedServiceIDPrefix + accountID
+
+	return &rpservice.Service{
+		ID:           serviceID,
+		AccountID:    accountID,
+		Name:         "agent-network-" + accountID,
+		Domain:       domain,
+		ProxyCluster: cluster,
+		Mode:         rpservice.ModeHTTP,
+		Enabled:      true,
+		Private:      true,
+		// AccessGroups gates tunnel-peer access (ValidateTunnelPeer) to the
+		// synthesised agent-network endpoint. Agents reach the gateway over
+		// the WireGuard tunnel and are authorised by their peer→user group
+		// membership — the union of every enabled policy's source groups.
+		AccessGroups:      unionSourceGroups(enabledPolicies),
+		PassHostHeader:    false,
+		RewriteRedirects:  false,
+		SessionPrivateKey: sessionPriv,
+		SessionPublicKey:  sessionPub,
+		Targets: []*rpservice.Target{
+			{
+				AccountID:  accountID,
+				ServiceID:  serviceID,
+				TargetType: rpservice.TargetTypeCluster,
+				TargetId:   cluster,
+				Host:       noopUpstreamHost,
+				Port:       noopUpstreamPort,
+				Protocol:   noopUpstreamScheme,
+				Enabled:    true,
+				Options: rpservice.TargetOptions{
+					DirectUpstream:          true,
+					AgentNetwork:            true,
+					DisableAccessLog:        !settings.EnableLogCollection,
+					Middlewares:             middlewares,
+					CaptureMaxRequestBytes:  agentNetworkRequestCaptureBytes,
+					CaptureMaxResponseBytes: agentNetworkResponseCaptureBytes,
+					CaptureContentTypes:     append([]string(nil), agentNetworkCaptureContentTypes...),
+				},
+			},
+		},
+	}
+}
+
+const (
+	noopUpstreamScheme = "https"
+	noopUpstreamHost   = "noop.invalid"
+	noopUpstreamPort   = uint16(443)
+)
+
+// providerAuthHeader builds the upstream auth header pair for a
+// provider from its catalog entry. The catalog declares which header
+// name and template a provider's API expects; the synthesiser
+// substitutes the provider's decrypted API key into the template and
+// returns the (name, value) pair the router middleware injects after
+// stripping the inbound vendor auth headers.
+func providerAuthHeader(p *types.Provider) (name, value, gcpSAKeyB64 string, err error) {
+	entry, ok := catalog.Lookup(p.ProviderID)
+	if !ok {
+		return "", "", "", fmt.Errorf("provider %s references unknown catalog id %q", p.ID, p.ProviderID)
+	}
+	if entry.AuthHeaderName == "" || entry.AuthHeaderTemplate == "" {
+		return "", "", "", fmt.Errorf("catalog entry %q has no auth header configured", p.ProviderID)
+	}
+	if p.APIKey == "" {
+		return "", "", "", fmt.Errorf("provider %s has no api key", p.ID)
+	}
+	// A "keyfile::<base64 json>" api_key is a GCP service-account key, not a
+	// static bearer. The proxy mints + refreshes a short-lived OAuth token from
+	// it at request time, so carry the key material on the route and emit no
+	// static value.
+	if rest, isKeyfile := strings.CutPrefix(p.APIKey, gcpKeyfilePrefix); isKeyfile {
+		return entry.AuthHeaderName, "", strings.TrimSpace(rest), nil
+	}
+	value = strings.ReplaceAll(entry.AuthHeaderTemplate, apiKeyPlaceholder, p.APIKey)
+	return entry.AuthHeaderName, value, "", nil
+}
+
+// parseUpstreamHost splits provider.UpstreamURL into (scheme, host, path)
+// where host carries an explicit ":port" suffix when the URL set one
+// and path is the URL's path component normalised by stripping a
+// trailing slash. The router uses path to disambiguate providers that
+// claim the same model. Used by the router config so the rewrite
+// carries an authority the reverse proxy can dial verbatim.
+func parseUpstreamHost(raw string) (scheme, host, path string, err error) {
+	parsed, perr := url.Parse(strings.TrimSpace(raw))
+	if perr != nil {
+		return "", "", "", fmt.Errorf("parse upstream_url %q: %w", raw, perr)
+	}
+	switch strings.ToLower(parsed.Scheme) {
+	case "http":
+		scheme = "http"
+	case "https":
+		scheme = "https"
+	default:
+		return "", "", "", fmt.Errorf("upstream_url scheme must be http or https, got %q", parsed.Scheme)
+	}
+	hostname := parsed.Hostname()
+	if hostname == "" {
+		return "", "", "", fmt.Errorf("upstream_url %q has no host", raw)
+	}
+	if port := parsed.Port(); port != "" {
+		host = hostname + ":" + port
+	} else {
+		host = hostname
+	}
+	path = strings.TrimRight(parsed.Path, "/")
+	return scheme, host, path, nil
+}
+
+// unionSourceGroups deduplicates source-group IDs across the policies
+// pointing at any provider, in deterministic order.
+func unionSourceGroups(policies []*types.Policy) []string {
+	seen := make(map[string]struct{})
+	for _, policy := range policies {
+		for _, group := range policy.SourceGroups {
+			if group == "" {
+				continue
+			}
+			seen[group] = struct{}{}
+		}
+	}
+	out := make([]string, 0, len(seen))
+	for group := range seen {
+		out = append(out, group)
+	}
+	sort.Strings(out)
+	return out
+}
+
+// MergedGuardrails is the JSON shape passed to the proxy via the
+// guardrail middleware's config_json. Mirrors the proxy-side
+// expectations and is intentionally distinct from
+// types.GuardrailChecks so we can evolve either side independently.
+type MergedGuardrails struct {
+	ModelAllowlist []string            `json:"model_allowlist,omitempty"`
+	TokenLimits    MergedTokenLimits   `json:"token_limits"`
+	Budget         MergedBudget        `json:"budget"`
+	PromptCapture  MergedPromptCapture `json:"prompt_capture"`
+	Retention      MergedRetention     `json:"retention"`
+}
+
+type MergedTokenLimits struct {
+	Hourly  *MergedTokenWindow `json:"hourly,omitempty"`
+	Daily   *MergedTokenWindow `json:"daily,omitempty"`
+	Monthly *MergedTokenWindow `json:"monthly,omitempty"`
+}
+
+type MergedTokenWindow struct {
+	MaxInputTokens  int `json:"max_input_tokens,omitempty"`
+	MaxOutputTokens int `json:"max_output_tokens,omitempty"`
+}
+
+type MergedBudget struct {
+	Hourly  *MergedBudgetWindow `json:"hourly,omitempty"`
+	Daily   *MergedBudgetWindow `json:"daily,omitempty"`
+	Monthly *MergedBudgetWindow `json:"monthly,omitempty"`
+}
+
+type MergedBudgetWindow struct {
+	SoftCapUSD float64 `json:"soft_cap_usd,omitempty"`
+	HardCapUSD float64 `json:"hard_cap_usd,omitempty"`
+}
+
+type MergedPromptCapture struct {
+	Enabled   bool `json:"enabled"`
+	RedactPii bool `json:"redact_pii"`
+}
+
+type MergedRetention struct {
+	Enabled bool `json:"enabled"`
+	Days    int  `json:"days"`
+}
+
+// mergeGuardrails computes the effective guardrail spec applied at the
+// proxy, given the referencing policies and the account's guardrail
+// catalogue. Policy enabled-ness is the caller's responsibility — only
+// enabled policies should be passed in.
+//
+// Merge rules:
+//   - Model allowlist:   union of allowlists across policies that enable it.
+//   - Token / Budget:    most-restrictive (min of non-zero caps) per window.
+//   - Prompt capture:    enabled if any policy enables it; redact_pii sticks
+//     if any enabling policy turns it on.
+//   - Retention:         enabled if any enables it; smallest non-zero days wins.
+func mergeGuardrails(policies []*types.Policy, byID map[string]*types.Guardrail) MergedGuardrails {
+	merged := MergedGuardrails{}
+	allowlist := make(map[string]struct{})
+	allowlistEnabled := false
+
+	for _, policy := range policies {
+		for _, gID := range policy.GuardrailIDs {
+			g, ok := byID[gID]
+			if !ok || g == nil {
+				continue
+			}
+			mergeGuardrail(g, &merged, allowlist, &allowlistEnabled)
+		}
+	}
+
+	if allowlistEnabled {
+		merged.ModelAllowlist = make([]string, 0, len(allowlist))
+		for m := range allowlist {
+			merged.ModelAllowlist = append(merged.ModelAllowlist, m)
+		}
+		sort.Strings(merged.ModelAllowlist)
+	}
+	return merged
+}
+
+// mergeGuardrail folds a single guardrail's enabled checks into the
+// running merge: model-allowlist models join the shared set (and flip
+// allowlistEnabled), and prompt-capture / redact-pii stick once any
+// enabling guardrail turns them on.
+//
+// TokenLimits, Budget, and Retention have moved off guardrails — token
+// and budget caps now live on the Policy itself (Policy.Limits) and
+// retention moves to account-level Settings — so they are not merged here.
+func mergeGuardrail(g *types.Guardrail, merged *MergedGuardrails, allowlist map[string]struct{}, allowlistEnabled *bool) {
+	if g.Checks.ModelAllowlist.Enabled {
+		*allowlistEnabled = true
+		for _, m := range g.Checks.ModelAllowlist.Models {
+			if m != "" {
+				allowlist[m] = struct{}{}
+			}
+		}
+	}
+	if g.Checks.PromptCapture.Enabled {
+		merged.PromptCapture.Enabled = true
+		if g.Checks.PromptCapture.RedactPii {
+			merged.PromptCapture.RedactPii = true
+		}
+	}
+}
diff --git a/management/internals/modules/agentnetwork/synthesizer_guardrail_realstore_test.go b/management/internals/modules/agentnetwork/synthesizer_guardrail_realstore_test.go
new file mode 100644
index 000000000..8ed4910da
--- /dev/null
+++ b/management/internals/modules/agentnetwork/synthesizer_guardrail_realstore_test.go
@@ -0,0 +1,178 @@
+package agentnetwork
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/server/store"
+)
+
+// decodeServiceGuardrailConfig pulls the llm_guardrail middleware config off the
+// synthesised service's single target.
+func decodeServiceGuardrailConfig(t *testing.T, svc *rpservice.Service) guardrailConfig {
+	t.Helper()
+	require.NotEmpty(t, svc.Targets, "synth service must carry a target")
+	for _, mw := range svc.Targets[0].Options.Middlewares {
+		if mw.ID == middlewareIDLLMGuardrail {
+			var cfg guardrailConfig
+			require.NoError(t, json.Unmarshal(mw.ConfigJSON, &cfg), "guardrail config must decode")
+			return cfg
+		}
+	}
+	t.Fatal("llm_guardrail middleware not present on synthesised service")
+	return guardrailConfig{}
+}
+
+// decodeMiddlewareRawConfig returns the raw ConfigJSON bytes for the named
+// middleware on the synth service's target, or fails the test.
+func decodeMiddlewareRawConfig(t *testing.T, svc *rpservice.Service, id string) []byte {
+	t.Helper()
+	require.NotEmpty(t, svc.Targets, "synth service must carry a target")
+	for _, mw := range svc.Targets[0].Options.Middlewares {
+		if mw.ID == id {
+			return mw.ConfigJSON
+		}
+	}
+	t.Fatalf("middleware %q not present on synthesised service", id)
+	return nil
+}
+
+// saveGuardrailAndPolicy persists a guardrail with prompt capture + redact + a
+// model allowlist, referenced by one enabled policy. Shared by the GC-3 tests.
+func saveGuardrailAndPolicy(t *testing.T, ctx context.Context, s store.Store, provider *types.Provider) {
+	t.Helper()
+	guardrail := &types.Guardrail{
+		ID:        "ainguard-1",
+		AccountID: testAccountID,
+		Name:      "strict",
+		Checks: types.GuardrailChecks{
+			ModelAllowlist: types.GuardrailModelAllowlist{Enabled: true, Models: []string{"gpt-5.4"}},
+			PromptCapture:  types.GuardrailPromptCapture{Enabled: true, RedactPii: true},
+		},
+	}
+	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, guardrail))
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", guardrail.ID)))
+}
+
+// TestSynthesizeServices_RealStore_PromptCaptureAccountIsSoleControl is the
+// GC-3 contract: the account master switch (EnablePromptCollection) is the
+// SOLE control for capture enablement. Policy-level guardrail prompt_capture is
+// ignored for enablement — operators don't need to attach a capture guardrail
+// to a policy just to turn capture on for the account. Off by default.
+func TestSynthesizeServices_RealStore_PromptCaptureAccountIsSoleControl(t *testing.T) {
+	ctx := context.Background()
+	s, cleanup, err := store.NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err, "real sqlite test store must come up")
+	defer cleanup()
+
+	// Account collection master switch OFF (default).
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
+	saveGuardrailAndPolicy(t, ctx, s, newSynthTestProvider())
+
+	services, err := SynthesizeServices(ctx, s, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1)
+
+	cfg := decodeServiceGuardrailConfig(t, services[0])
+	assert.Equal(t, []string{"gpt-5.4"}, cfg.ModelAllowlist,
+		"model allowlist is a pure policy guardrail and must always reach the config")
+	assert.False(t, cfg.PromptCapture.Enabled,
+		"prompt capture must be off when the account toggle is off, even with a capture-enabled guardrail")
+}
+
+// TestSynthesizeServices_RealStore_PromptCaptureFlowsWhenAccountOptsIn proves
+// the account toggle is sufficient on its own — even with NO guardrail
+// attached to the policy, capture fires when the account opts in. Redact is
+// the OR of account + guardrail.
+func TestSynthesizeServices_RealStore_PromptCaptureFlowsWhenAccountOptsIn(t *testing.T) {
+	ctx := context.Background()
+	s, cleanup, err := store.NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err, "real sqlite test store must come up")
+	defer cleanup()
+
+	settings := newSynthTestSettings()
+	settings.EnablePromptCollection = true
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, settings))
+
+	// Save a provider and a policy with NO guardrails attached — proves the
+	// account toggle is sufficient on its own.
+	provider := newSynthTestProvider()
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "")))
+
+	services, err := SynthesizeServices(ctx, s, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1)
+
+	cfg := decodeServiceGuardrailConfig(t, services[0])
+	assert.True(t, cfg.PromptCapture.Enabled,
+		"account toggle alone must enable capture; no guardrail attachment required")
+}
+
+// TestSynthesizeServices_RealStore_AccountRedactWithoutGuardrailRedact proves
+// the redact OR-merge from the account side: account RedactPii on, guardrail
+// redact off, capture on at both levels.
+func TestSynthesizeServices_RealStore_AccountRedactWithoutGuardrailRedact(t *testing.T) {
+	ctx := context.Background()
+	s, cleanup, err := store.NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err, "real sqlite test store must come up")
+	defer cleanup()
+
+	settings := newSynthTestSettings()
+	settings.EnablePromptCollection = true
+	settings.RedactPii = true
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, settings))
+
+	provider := newSynthTestProvider()
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
+	guardrail := &types.Guardrail{
+		ID:        "ainguard-noredact",
+		AccountID: testAccountID,
+		Name:      "capture-only",
+		Checks: types.GuardrailChecks{
+			PromptCapture: types.GuardrailPromptCapture{Enabled: true, RedactPii: false},
+		},
+	}
+	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, guardrail))
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", guardrail.ID)))
+
+	services, err := SynthesizeServices(ctx, s, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1)
+
+	cfg := decodeServiceGuardrailConfig(t, services[0])
+	assert.True(t, cfg.PromptCapture.Enabled, "capture on (account + guardrail)")
+	assert.True(t, cfg.PromptCapture.RedactPii, "account RedactPii must apply even when the guardrail leaves it off (OR)")
+}
+
+// TestSynthesizeServices_RealStore_NoGuardrail_CaptureOff pins the default:
+// with no guardrail referenced, the synth service's guardrail config has prompt
+// capture disabled and an empty allowlist. This is the "off by default" baseline
+// the account switch must preserve.
+func TestSynthesizeServices_RealStore_NoGuardrail_CaptureOff(t *testing.T) {
+	ctx := context.Background()
+	s, cleanup, err := store.NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err, "real sqlite test store must come up")
+	defer cleanup()
+
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
+	provider := newSynthTestProvider()
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "")))
+
+	services, err := SynthesizeServices(ctx, s, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1, "exactly one synth service expected")
+
+	cfg := decodeServiceGuardrailConfig(t, services[0])
+	assert.Empty(t, cfg.ModelAllowlist, "no guardrail → no allowlist")
+	assert.False(t, cfg.PromptCapture.Enabled, "no guardrail → prompt capture off by default")
+	assert.False(t, cfg.PromptCapture.RedactPii, "no guardrail → redact off by default")
+}
diff --git a/management/internals/modules/agentnetwork/synthesizer_log_collection_realstore_test.go b/management/internals/modules/agentnetwork/synthesizer_log_collection_realstore_test.go
new file mode 100644
index 000000000..9aa2a0abe
--- /dev/null
+++ b/management/internals/modules/agentnetwork/synthesizer_log_collection_realstore_test.go
@@ -0,0 +1,70 @@
+package agentnetwork
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	rpproxy "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/server/store"
+)
+
+// TestSynthesizeServices_RealStore_LogCollectionOff_SuppressesAccessLog drives the
+// happy default: account settings ship with EnableLogCollection=false, so the
+// synthesised target opts out of access-log emission (DisableAccessLog=true) and
+// the proto mapping the proxy receives reflects that.
+func TestSynthesizeServices_RealStore_LogCollectionOff_SuppressesAccessLog(t *testing.T) {
+	ctx := context.Background()
+	s, cleanup, err := store.NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err, "real sqlite test store must come up")
+	defer cleanup()
+
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
+	provider := newSynthTestProvider()
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "")))
+
+	services, err := SynthesizeServices(ctx, s, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1, "exactly one synth service expected")
+	require.NotEmpty(t, services[0].Targets, "synth service must carry a target")
+	assert.True(t, services[0].Targets[0].Options.DisableAccessLog,
+		"EnableLogCollection=false (default) must produce DisableAccessLog=true on the synth target")
+
+	mapping := services[0].ToProtoMapping(rpservice.Update, "", rpproxy.OIDCValidationConfig{})
+	require.NotEmpty(t, mapping.GetPath(), "proto mapping must carry a path")
+	assert.True(t, mapping.GetPath()[0].GetOptions().GetDisableAccessLog(),
+		"proto mapping must propagate DisableAccessLog=true so the proxy suppresses access-log emission")
+}
+
+// TestSynthesizeServices_RealStore_LogCollectionOn_PermitsAccessLog asserts the
+// inverse: once the account opts in, the synth target leaves DisableAccessLog
+// at its default false and the proto wire stays unset.
+func TestSynthesizeServices_RealStore_LogCollectionOn_PermitsAccessLog(t *testing.T) {
+	ctx := context.Background()
+	s, cleanup, err := store.NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err, "real sqlite test store must come up")
+	defer cleanup()
+
+	settings := newSynthTestSettings()
+	settings.EnableLogCollection = true
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, settings))
+	provider := newSynthTestProvider()
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "")))
+
+	services, err := SynthesizeServices(ctx, s, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1, "exactly one synth service expected")
+	require.NotEmpty(t, services[0].Targets, "synth service must carry a target")
+	assert.False(t, services[0].Targets[0].Options.DisableAccessLog,
+		"EnableLogCollection=true must leave DisableAccessLog=false on the synth target")
+
+	mapping := services[0].ToProtoMapping(rpservice.Update, "", rpproxy.OIDCValidationConfig{})
+	require.NotEmpty(t, mapping.GetPath(), "proto mapping must carry a path")
+	assert.False(t, mapping.GetPath()[0].GetOptions().GetDisableAccessLog(),
+		"proto mapping must propagate DisableAccessLog=false so access-log emission stays on")
+}
diff --git a/management/internals/modules/agentnetwork/synthesizer_parser_redact_realstore_test.go b/management/internals/modules/agentnetwork/synthesizer_parser_redact_realstore_test.go
new file mode 100644
index 000000000..5f42c3b39
--- /dev/null
+++ b/management/internals/modules/agentnetwork/synthesizer_parser_redact_realstore_test.go
@@ -0,0 +1,145 @@
+package agentnetwork
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/server/store"
+)
+
+// parserRedactConfig mirrors the on-wire shape of the redact + capture knobs
+// that both llm_request_parser and llm_response_parser unmarshal. We don't
+// import the proxy-side packages from a management test (cross-module), so we
+// decode the JSON directly and assert on the fields that are part of the
+// synth contract.
+type parserRedactConfig struct {
+	RedactPii         bool  `json:"redact_pii,omitempty"`
+	CapturePrompt     *bool `json:"capture_prompt,omitempty"`     // present only on the request parser
+	CaptureCompletion *bool `json:"capture_completion,omitempty"` // present only on the response parser
+}
+
+// TestSynthesizeServices_RealStore_ParserConfigsCarryRedactPii is the
+// management-side contract test for the request/response parser redaction
+// wiring. When settings.RedactPii is true, the synthesised middleware chain
+// MUST stamp redact_pii=true on both llm_request_parser and llm_response_parser
+// configs — otherwise the parsers ship raw prompts / completions to the
+// access log even though the account has opted in. This is exactly the live
+// leak path that motivated the parser-side redaction in the first place.
+func TestSynthesizeServices_RealStore_ParserConfigsCarryRedactPii(t *testing.T) {
+	ctx := context.Background()
+	s, cleanup, err := store.NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err, "real sqlite test store must come up")
+	defer cleanup()
+
+	settings := newSynthTestSettings()
+	settings.RedactPii = true
+	settings.EnablePromptCollection = true
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, settings))
+
+	provider := newSynthTestProvider()
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "")))
+
+	services, err := SynthesizeServices(ctx, s, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1, "exactly one synth service expected")
+
+	for _, parserID := range []string{middlewareIDLLMRequestParser, middlewareIDLLMResponseParser} {
+		raw := decodeMiddlewareRawConfig(t, services[0], parserID)
+		var cfg parserRedactConfig
+		require.NoError(t, json.Unmarshal(raw, &cfg), "%s config must be valid JSON", parserID)
+		assert.True(t, cfg.RedactPii, "%s config must carry redact_pii=true when settings.RedactPii is on (otherwise the parser ships raw prompts/completions to the access log)", parserID)
+	}
+	// The capture flag is set explicitly to enable_prompt_collection on each
+	// parser. With it on here, both must allow emission.
+	reqCfg := decodeParserConfig(t, services[0], middlewareIDLLMRequestParser)
+	require.NotNil(t, reqCfg.CapturePrompt, "request parser must carry an explicit capture_prompt")
+	assert.True(t, *reqCfg.CapturePrompt, "capture_prompt=true when EnablePromptCollection=true")
+	respCfg := decodeParserConfig(t, services[0], middlewareIDLLMResponseParser)
+	require.NotNil(t, respCfg.CaptureCompletion, "response parser must carry an explicit capture_completion")
+	assert.True(t, *respCfg.CaptureCompletion, "capture_completion=true when EnablePromptCollection=true")
+}
+
+// decodeParserConfig is a small helper around decodeMiddlewareRawConfig that
+// also unmarshals into parserRedactConfig.
+func decodeParserConfig(t *testing.T, svc *rpservice.Service, parserID string) parserRedactConfig {
+	t.Helper()
+	raw := decodeMiddlewareRawConfig(t, svc, parserID)
+	var cfg parserRedactConfig
+	require.NoError(t, json.Unmarshal(raw, &cfg), "%s config must be valid JSON", parserID)
+	return cfg
+}
+
+// TestSynthesizeServices_RealStore_ParserConfigsSuppressCaptureWhenLogCollectionOnly
+// is the contract test for the bug: enable_log_collection=true with
+// enable_prompt_collection=false MUST result in capture_prompt=false on the
+// request parser AND capture_completion=false on the response parser, so the
+// access-log row stays metadata-only (provider, model, tokens, cost) and
+// carries NO prompt input nor response output. Without this, operators who
+// want billing-style logs end up with raw user prompts and model outputs in
+// every access-log entry.
+func TestSynthesizeServices_RealStore_ParserConfigsSuppressCaptureWhenLogCollectionOnly(t *testing.T) {
+	ctx := context.Background()
+	s, cleanup, err := store.NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err, "real sqlite test store must come up")
+	defer cleanup()
+
+	settings := newSynthTestSettings()
+	settings.EnableLogCollection = true     // operator wants logs ON
+	settings.EnablePromptCollection = false // but NOT content capture
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, settings))
+
+	provider := newSynthTestProvider()
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "")))
+
+	services, err := SynthesizeServices(ctx, s, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1)
+
+	reqCfg := decodeParserConfig(t, services[0], middlewareIDLLMRequestParser)
+	require.NotNil(t, reqCfg.CapturePrompt, "request parser must carry an explicit capture_prompt gate")
+	assert.False(t, *reqCfg.CapturePrompt, "capture_prompt MUST be false when EnablePromptCollection is off — otherwise llm.request_prompt_raw leaks user input into the access log")
+
+	respCfg := decodeParserConfig(t, services[0], middlewareIDLLMResponseParser)
+	require.NotNil(t, respCfg.CaptureCompletion, "response parser must carry an explicit capture_completion gate")
+	assert.False(t, *respCfg.CaptureCompletion, "capture_completion MUST be false when EnablePromptCollection is off — otherwise llm.response_completion leaks model output into the access log")
+}
+
+// TestSynthesizeServices_RealStore_ParserConfigsOmitRedactPiiWhenOff proves
+// the inverse: with the account toggle off, the parser configs stay clean (no
+// redact_pii field, which the parsers treat as zero / no redaction). This is
+// the operator-opt-out path — the access log keeps raw prompts/completions
+// for debugging until the operator opts in.
+func TestSynthesizeServices_RealStore_ParserConfigsOmitRedactPiiWhenOff(t *testing.T) {
+	ctx := context.Background()
+	s, cleanup, err := store.NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err)
+	defer cleanup()
+
+	// Default settings: RedactPii = false.
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
+	provider := newSynthTestProvider()
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "")))
+
+	services, err := SynthesizeServices(ctx, s, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1)
+
+	for _, parserID := range []string{middlewareIDLLMRequestParser, middlewareIDLLMResponseParser} {
+		raw := decodeMiddlewareRawConfig(t, services[0], parserID)
+		// Inspect the decoded JSON directly: a struct decode would also pass
+		// if redact_pii were present-but-false. The contract is that the key
+		// is omitted entirely while the account toggle is off.
+		var rawCfg map[string]json.RawMessage
+		require.NoError(t, json.Unmarshal(raw, &rawCfg), "%s config must be valid JSON", parserID)
+		assert.NotContains(t, rawCfg, "redact_pii",
+			"%s config must omit redact_pii entirely while the account toggle is off", parserID)
+	}
+}
diff --git a/management/internals/modules/agentnetwork/synthesizer_realstore_test.go b/management/internals/modules/agentnetwork/synthesizer_realstore_test.go
new file mode 100644
index 000000000..1e07c0e81
--- /dev/null
+++ b/management/internals/modules/agentnetwork/synthesizer_realstore_test.go
@@ -0,0 +1,174 @@
+package agentnetwork
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	rpproxy "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/server/account"
+	"github.com/netbirdio/netbird/management/server/store"
+	nbtypes "github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// decodeServiceRouterConfig finds the llm_router middleware on the synthesised
+// service's single target and decodes its config — the model→provider routing
+// table the proxy authorises against.
+func decodeServiceRouterConfig(t *testing.T, svc *rpservice.Service) routerConfig {
+	t.Helper()
+	require.NotEmpty(t, svc.Targets, "synth service must carry a target")
+	for _, mw := range svc.Targets[0].Options.Middlewares {
+		if mw.ID == middlewareIDLLMRouter {
+			var cfg routerConfig
+			require.NoError(t, json.Unmarshal(mw.ConfigJSON, &cfg), "router config must decode")
+			return cfg
+		}
+	}
+	t.Fatal("llm_router middleware not present on synthesised service")
+	return routerConfig{}
+}
+
+// decodeMappingRouterConfig is the proto-wire equivalent: it pulls the
+// llm_router config off the ProxyMapping the proxy actually receives.
+func decodeMappingRouterConfig(t *testing.T, m *proto.ProxyMapping) routerConfig {
+	t.Helper()
+	require.NotEmpty(t, m.GetPath(), "mapping must carry a path")
+	for _, mw := range m.GetPath()[0].GetOptions().GetMiddlewares() {
+		if mw.GetId() == middlewareIDLLMRouter {
+			var cfg routerConfig
+			require.NoError(t, json.Unmarshal(mw.GetConfigJson(), &cfg), "wire router config must decode")
+			return cfg
+		}
+	}
+	t.Fatal("llm_router middleware not present on proxy mapping")
+	return routerConfig{}
+}
+
+// TestSynthesizeServices_RealStore_SurvivesStatusToggle drives synthesis through
+// a REAL sqlite store (Save → gorm/JSON serialize → reload → decrypt) instead of
+// a MockStore, so it exercises the field round-trip that a provider/policy edit
+// actually hits. Mock-based tests can't catch a field that dies in persistence;
+// this one can. It then performs the exact operation that reproduced the live
+// 403 — disable then re-enable the provider — and asserts the re-enabled state
+// is fully routable again.
+func TestSynthesizeServices_RealStore_SurvivesStatusToggle(t *testing.T) {
+	ctx := context.Background()
+	s, cleanup, err := store.NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err, "real sqlite test store must come up")
+	defer cleanup()
+
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
+	provider := newSynthTestProvider()
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "")))
+
+	assertRoutable := func(t *testing.T, stage string) {
+		services, err := SynthesizeServices(ctx, s, testAccountID)
+		require.NoError(t, err, stage)
+		require.Len(t, services, 1, "%s: exactly one synth service expected", stage)
+		svc := services[0]
+
+		assert.True(t, svc.Private, "%s: synth service must be Private after store round-trip", stage)
+		assert.Equal(t, []string{"grp-eng"}, svc.AccessGroups, "%s: AccessGroups must survive the round-trip", stage)
+
+		m := svc.ToProtoMapping(rpservice.Update, "", rpproxy.OIDCValidationConfig{})
+		assert.True(t, m.GetPrivate(), "%s: proto mapping Private must be true (proxy gates tunnel-peer auth on it)", stage)
+
+		cfg := decodeServiceRouterConfig(t, svc)
+		require.Len(t, cfg.Providers, 1, "%s: the enabled+linked provider must appear in the router config", stage)
+		assert.Equal(t, []string{"gpt-5.4"}, cfg.Providers[0].Models, "%s: provider models must reach the route", stage)
+		assert.Equal(t, []string{"grp-eng"}, cfg.Providers[0].AllowedGroupIDs, "%s: policy source groups must reach the route", stage)
+	}
+
+	assertRoutable(t, "initial")
+
+	provider.Enabled = false
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
+	disabled, err := SynthesizeServices(ctx, s, testAccountID)
+	require.NoError(t, err, "synthesis must not error with a disabled provider")
+	for _, svc := range disabled {
+		assert.Empty(t, decodeServiceRouterConfig(t, svc).Providers,
+			"a disabled provider must not appear in the router config (otherwise it would route while off)")
+	}
+
+	provider.Enabled = true
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
+	assertRoutable(t, "after disable->enable")
+}
+
+// captureController is a proxy.Controller that records the mappings reconcile
+// pushes, so the test can inspect the exact wire payload — Private flag and
+// router config included.
+type captureController struct {
+	rpproxy.Controller
+	pushed []*proto.ProxyMapping
+}
+
+func (c *captureController) GetOIDCValidationConfig() rpproxy.OIDCValidationConfig {
+	return rpproxy.OIDCValidationConfig{}
+}
+
+func (c *captureController) SendServiceUpdateToCluster(_ context.Context, _ string, update *proto.ProxyMapping, _ string) {
+	c.pushed = append(c.pushed, update)
+}
+
+// noopAccountManager satisfies the reconcile path's accountManager dependency.
+type noopAccountManager struct {
+	account.Manager
+}
+
+func (noopAccountManager) UpdateAccountPeers(context.Context, string, nbtypes.UpdateReason) {}
+
+// TestReconcile_RealStore_PushesPrivateAfterStatusToggle reproduces the live
+// path end-to-end below the gRPC boundary: a real store + the real
+// managerImpl.reconcile + a capturing proxy controller. It runs the operation
+// that broke in production — provider disable then re-enable — and asserts the
+// mapping reconcile pushes to the cluster after re-enable is Private=true and
+// carries the routable provider. If reconcile ever pushes private=false (the
+// symptom that left UserGroups empty → no_authorised_provider), this fails.
+func TestReconcile_RealStore_PushesPrivateAfterStatusToggle(t *testing.T) {
+	ctx := context.Background()
+	s, cleanup, err := store.NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err)
+	defer cleanup()
+
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
+	provider := newSynthTestProvider()
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
+	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "")))
+
+	ctrl := &captureController{}
+	m := &managerImpl{
+		store:           s,
+		accountManager:  noopAccountManager{},
+		proxyController: ctrl,
+		reconcileCache:  make(map[string]map[string]*proto.ProxyMapping),
+	}
+
+	m.reconcile(ctx, testAccountID) // initial, provider enabled
+
+	provider.Enabled = false
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
+	m.reconcile(ctx, testAccountID) // disabled
+
+	provider.Enabled = true
+	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
+	m.reconcile(ctx, testAccountID) // re-enabled — the reproduction step
+
+	require.NotEmpty(t, ctrl.pushed, "reconcile must push at least one mapping")
+	last := ctrl.pushed[len(ctrl.pushed)-1]
+
+	assert.Equal(t, newSynthTestSettings().Endpoint(), last.GetDomain(), "synth domain on the wire")
+	assert.True(t, last.GetPrivate(),
+		"reconcile-pushed mapping after re-enable MUST be Private=true; a false here is the exact bug — the proxy skips ValidateTunnelPeer, UserGroups stays empty, and llm_router denies no_authorised_provider")
+
+	cfg := decodeMappingRouterConfig(t, last)
+	require.Len(t, cfg.Providers, 1, "re-enabled provider must be back in the pushed router config")
+	assert.Equal(t, []string{"gpt-5.4"}, cfg.Providers[0].Models, "model must be routable again after re-enable")
+	assert.Equal(t, []string{"grp-eng"}, cfg.Providers[0].AllowedGroupIDs, "authorised groups must be present after re-enable")
+}
diff --git a/management/internals/modules/agentnetwork/synthesizer_test.go b/management/internals/modules/agentnetwork/synthesizer_test.go
new file mode 100644
index 000000000..0b07f27b3
--- /dev/null
+++ b/management/internals/modules/agentnetwork/synthesizer_test.go
@@ -0,0 +1,1098 @@
+package agentnetwork
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/golang/mock/gomock"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+const (
+	testAccountID = "acct-1"
+	testCluster   = "eu.proxy.netbird.io"
+	testSubdomain = "violet"
+	testEndpoint  = "violet.eu.proxy.netbird.io"
+)
+
+func newSynthTestSettings() *types.Settings {
+	return &types.Settings{
+		AccountID: testAccountID,
+		Cluster:   testCluster,
+		Subdomain: testSubdomain,
+	}
+}
+
+func newSynthTestProvider() *types.Provider {
+	return &types.Provider{
+		ID:                "prov-1",
+		AccountID:         testAccountID,
+		ProviderID:        "openai_api",
+		Name:              "OpenAI",
+		UpstreamURL:       "https://api.openai.com",
+		APIKey:            "sk-test-key",
+		Enabled:           true,
+		Models:            []types.ProviderModel{{ID: "gpt-5.4", InputPer1k: 0.0025, OutputPer1k: 0.015}},
+		SessionPrivateKey: "test-priv-key",
+		SessionPublicKey:  "test-pub-key",
+		CreatedAt:         time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC),
+	}
+}
+
+func newSynthTestPolicy(providerID, sourceGroupID, guardrailID string) *types.Policy {
+	policy := &types.Policy{
+		ID:                     "pol-1",
+		AccountID:              testAccountID,
+		Name:                   "engineers",
+		Enabled:                true,
+		SourceGroups:           []string{sourceGroupID},
+		DestinationProviderIDs: []string{providerID},
+	}
+	if guardrailID != "" {
+		policy.GuardrailIDs = []string{guardrailID}
+	}
+	return policy
+}
+
+// expectSynthBaseInputs wires the four reads the new synthesiser issues
+// in the happy path: settings, providers, policies, guardrails.
+func expectSynthBaseInputs(mockStore *store.MockStore, ctx context.Context, settings *types.Settings, providers []*types.Provider, policies []*types.Policy, guardrails []*types.Guardrail) {
+	if settings == nil {
+		mockStore.EXPECT().
+			GetAgentNetworkSettings(ctx, store.LockingStrengthNone, testAccountID).
+			Return(nil, status.Errorf(status.NotFound, "agent network settings not found"))
+		return
+	}
+	mockStore.EXPECT().
+		GetAgentNetworkSettings(ctx, store.LockingStrengthNone, testAccountID).
+		Return(settings, nil)
+	mockStore.EXPECT().
+		GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, testAccountID).
+		Return(providers, nil)
+	if hasEnabled(providers) {
+		mockStore.EXPECT().
+			GetAccountAgentNetworkPolicies(ctx, store.LockingStrengthNone, testAccountID).
+			Return(policies, nil)
+		if hasEnabledPolicy(policies) {
+			mockStore.EXPECT().
+				GetAccountAgentNetworkGuardrails(ctx, store.LockingStrengthNone, testAccountID).
+				Return(guardrails, nil)
+		}
+	}
+}
+
+func hasEnabled(providers []*types.Provider) bool {
+	for _, p := range providers {
+		if p != nil && p.Enabled {
+			return true
+		}
+	}
+	return false
+}
+
+func hasEnabledPolicy(policies []*types.Policy) bool {
+	for _, p := range policies {
+		if p != nil && p.Enabled {
+			return true
+		}
+	}
+	return false
+}
+
+func TestSynthesizeServices_HappyPath(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	openai := newSynthTestProvider()
+	anthropic := &types.Provider{
+		ID:                "prov-2",
+		AccountID:         testAccountID,
+		ProviderID:        "anthropic_api",
+		Name:              "Anthropic",
+		UpstreamURL:       "https://api.anthropic.com",
+		APIKey:            "sk-ant-secret",
+		Enabled:           true,
+		Models:            []types.ProviderModel{{ID: "claude-opus-4-7"}},
+		SessionPrivateKey: "ant-priv",
+		SessionPublicKey:  "ant-pub",
+		CreatedAt:         time.Date(2026, 2, 1, 0, 0, 0, 0, time.UTC),
+	}
+
+	policyEng := newSynthTestPolicy(openai.ID, "grp-eng", "")
+	policyEng.ID = "pol-eng"
+	policyOps := newSynthTestPolicy(anthropic.ID, "grp-ops", "")
+	policyOps.ID = "pol-ops"
+
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
+		[]*types.Provider{openai, anthropic},
+		[]*types.Policy{policyEng, policyOps},
+		[]*types.Guardrail{})
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err, "synthesis must succeed")
+	require.Len(t, services, 1, "exactly one service per account")
+
+	svc := services[0]
+	assert.Equal(t, "agent-net-svc-acct-1", svc.ID, "service id is account-scoped")
+	assert.Equal(t, testAccountID, svc.AccountID, "service inherits account ID")
+	assert.Equal(t, testEndpoint, svc.Domain, "domain is settings.Endpoint() (subdomain.cluster)")
+	assert.Equal(t, testCluster, svc.ProxyCluster, "proxy cluster comes from settings")
+	assert.Equal(t, rpservice.ModeHTTP, svc.Mode, "synthesised services are HTTP mode")
+	assert.True(t, svc.Private, "synthesised services are always private")
+	assert.True(t, svc.Enabled, "synthesised services are enabled when emitted")
+	assert.Equal(t, []string{"grp-eng", "grp-ops"}, svc.AccessGroups,
+		"access groups union both policies' source groups (tunnel-peer auth)")
+
+	require.Len(t, svc.Targets, 1, "single cluster target")
+	target := svc.Targets[0]
+	assert.Equal(t, rpservice.TargetTypeCluster, target.TargetType, "target type is cluster")
+	assert.Equal(t, testCluster, target.TargetId, "target id is the cluster address")
+	assert.Equal(t, "noop.invalid", target.Host, "host is the placeholder; router rewrites at request time")
+	assert.Equal(t, uint16(443), target.Port, "placeholder port")
+	assert.Equal(t, "https", target.Protocol, "placeholder scheme")
+	assert.True(t, target.Options.DirectUpstream, "synth targets imply direct upstream")
+	assert.True(t, target.Options.AgentNetwork, "synth targets must be flagged as agent_network")
+
+	mws := target.Options.Middlewares
+	require.Len(t, mws, 8, "eight middlewares: request_parser, router, limit_check, identity_inject, guardrail, limit_record, cost_meter, response_parser")
+	assert.Equal(t, middlewareIDLLMRequestParser, mws[0].ID, "first middleware is the request parser")
+	assert.Equal(t, rpservice.MiddlewareSlotOnRequest, mws[0].Slot, "request parser runs on_request")
+	// Request parser carries the capture_prompt gate sourced from
+	// settings.EnablePromptCollection. The synth-test settings default
+	// EnablePromptCollection=false, so capture is off and the access-log row
+	// will not carry prompt content.
+	assert.JSONEq(t, `{"capture_prompt":false}`, string(mws[0].ConfigJSON), "request parser config must carry capture_prompt from synth")
+
+	assert.Equal(t, middlewareIDLLMRouter, mws[1].ID, "second middleware is the router")
+	assert.Equal(t, rpservice.MiddlewareSlotOnRequest, mws[1].Slot, "router runs on_request")
+	assert.True(t, mws[1].CanMutate, "router must carry CanMutate=true; without it the framework drops the auth-header strip/inject AND the upstream rewrite, leaving the proxy to dial the placeholder noop.invalid")
+	require.NotEmpty(t, mws[1].ConfigJSON, "router config JSON must be populated")
+
+	var routerCfg routerConfig
+	require.NoError(t, json.Unmarshal(mws[1].ConfigJSON, &routerCfg), "router config must unmarshal")
+	require.Len(t, routerCfg.Providers, 2, "both providers must reach the router")
+	assert.Equal(t, openai.ID, routerCfg.Providers[0].ID, "openai is first by created_at")
+	assert.Equal(t, "Bearer sk-test-key", routerCfg.Providers[0].AuthHeaderValue, "openai auth header value substitutes the API key")
+	assert.Equal(t, "Authorization", routerCfg.Providers[0].AuthHeaderName, "openai uses Authorization header")
+	assert.Equal(t, "https", routerCfg.Providers[0].UpstreamScheme, "openai scheme")
+	assert.Equal(t, "api.openai.com", routerCfg.Providers[0].UpstreamHost, "openai host")
+	assert.Equal(t, []string{"grp-eng"}, routerCfg.Providers[0].AllowedGroupIDs, "openai inherits policyEng's source groups")
+	assert.Equal(t, []string{"gpt-5.4"}, routerCfg.Providers[0].Models,
+		"the provider's configured model IDs must reach the router route — otherwise the model never matches and llm_router denies model_not_routable")
+	assert.Equal(t, anthropic.ID, routerCfg.Providers[1].ID, "anthropic follows openai by created_at")
+	assert.Equal(t, "sk-ant-secret", routerCfg.Providers[1].AuthHeaderValue, "anthropic value is the raw API key")
+	assert.Equal(t, "x-api-key", routerCfg.Providers[1].AuthHeaderName, "anthropic uses x-api-key header")
+	assert.Equal(t, []string{"grp-ops"}, routerCfg.Providers[1].AllowedGroupIDs, "anthropic inherits policyOps' source groups")
+	assert.Equal(t, []string{"claude-opus-4-7"}, routerCfg.Providers[1].Models, "anthropic's configured model ID must reach its route")
+
+	assert.Equal(t, middlewareIDLLMLimitCheck, mws[2].ID,
+		"limit_check sits between router and identity_inject so deny paths skip header-stamp work")
+	assert.Equal(t, rpservice.MiddlewareSlotOnRequest, mws[2].Slot, "limit_check runs on_request")
+
+	assert.Equal(t, middlewareIDLLMIdentityInject, mws[3].ID, "fourth middleware is identity inject")
+	assert.Equal(t, rpservice.MiddlewareSlotOnRequest, mws[3].Slot, "identity inject runs on_request")
+	assert.True(t, mws[3].CanMutate, "identity inject must carry CanMutate=true so its HeadersAdd / HeadersRemove pass the framework's mutation gate")
+	require.NotEmpty(t, mws[3].ConfigJSON, "identity inject config JSON must be populated even when no provider needs injection")
+
+	assert.Equal(t, middlewareIDLLMGuardrail, mws[4].ID, "fifth middleware is the guardrail")
+	assert.Equal(t, rpservice.MiddlewareSlotOnRequest, mws[4].Slot, "guardrail runs on_request")
+	require.NotEmpty(t, mws[4].ConfigJSON, "guardrail config JSON must be populated")
+
+	assert.Equal(t, middlewareIDLLMLimitRecord, mws[5].ID,
+		"limit_record sits FIRST in the response section so it RUNS LAST at runtime — needs cost_meter + response_parser to have stamped tokens / cost first")
+	assert.Equal(t, rpservice.MiddlewareSlotOnResponse, mws[5].Slot, "limit_record runs on_response")
+
+	assert.Equal(t, middlewareIDCostMeter, mws[6].ID, "seventh middleware is the cost meter")
+	assert.Equal(t, rpservice.MiddlewareSlotOnResponse, mws[6].Slot, "cost meter runs on_response")
+	assert.Equal(t, []byte("{}"), mws[6].ConfigJSON, "cost meter carries an explicit empty config")
+
+	assert.Equal(t, middlewareIDLLMResponseParser, mws[7].ID, "eighth middleware is the response parser")
+	assert.Equal(t, rpservice.MiddlewareSlotOnResponse, mws[7].Slot, "response parser runs on_response")
+}
+
+func TestSynthesizeServices_NoSettings_ReturnsNil(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	expectSynthBaseInputs(mockStore, ctx, nil, nil, nil, nil)
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err)
+	assert.Empty(t, services, "missing settings row must yield no synth")
+}
+
+func TestSynthesizeServices_NoProviders_ReturnsNil(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(), []*types.Provider{}, nil, nil)
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err)
+	assert.Empty(t, services, "settings present but no providers must yield no synth")
+}
+
+func TestSynthesizeServices_DisabledProvider_NoService(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	provider := newSynthTestProvider()
+	provider.Enabled = false
+
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
+		[]*types.Provider{provider}, nil, nil)
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err)
+	assert.Empty(t, services, "disabled provider must not synthesise a service")
+}
+
+func TestSynthesizeServices_DisabledPolicy_NoService(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	provider := newSynthTestProvider()
+	policy := newSynthTestPolicy(provider.ID, "grp-eng", "")
+	policy.Enabled = false
+
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
+		[]*types.Provider{provider}, []*types.Policy{policy}, nil)
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err)
+	assert.Empty(t, services, "disabled policy must not trigger synthesis")
+}
+
+func TestSynthesizeServices_RouterConfigOrdering(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	first := newSynthTestProvider()
+	first.ID = "prov-first"
+	first.CreatedAt = time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
+
+	second := newSynthTestProvider()
+	second.ID = "prov-second"
+	second.ProviderID = "anthropic_api"
+	second.UpstreamURL = "https://api.anthropic.com"
+	second.APIKey = "sk-ant"
+	second.CreatedAt = time.Date(2026, 3, 1, 0, 0, 0, 0, time.UTC)
+
+	third := newSynthTestProvider()
+	third.ID = "prov-third"
+	third.ProviderID = "mistral_api"
+	third.UpstreamURL = "https://api.mistral.ai"
+	third.APIKey = "sk-mistral"
+	third.CreatedAt = time.Date(2026, 2, 1, 0, 0, 0, 0, time.UTC)
+
+	policy := newSynthTestPolicy(first.ID, "grp-eng", "")
+	policy.DestinationProviderIDs = []string{first.ID, second.ID, third.ID}
+
+	// Pass providers in shuffled order to confirm the synth sorts them.
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
+		[]*types.Provider{second, first, third},
+		[]*types.Policy{policy}, []*types.Guardrail{})
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1)
+
+	mws := services[0].Targets[0].Options.Middlewares
+	var routerCfg routerConfig
+	for _, m := range mws {
+		if m.ID == middlewareIDLLMRouter {
+			require.NoError(t, json.Unmarshal(m.ConfigJSON, &routerCfg))
+			break
+		}
+	}
+	require.Len(t, routerCfg.Providers, 3, "all three providers must be in the router config")
+	assert.Equal(t, first.ID, routerCfg.Providers[0].ID, "providers ordered by created_at; first is earliest")
+	assert.Equal(t, third.ID, routerCfg.Providers[1].ID, "second is mid")
+	assert.Equal(t, second.ID, routerCfg.Providers[2].ID, "third is latest")
+}
+
+func TestSynthesizeServices_PolicyCheckConfig_UnionsSourceGroups(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	provider := newSynthTestProvider()
+
+	policyA := newSynthTestPolicy(provider.ID, "grp-eng", "")
+	policyA.ID = "pol-a"
+	policyA.SourceGroups = []string{"grp-eng", "grp-shared"}
+	policyB := newSynthTestPolicy(provider.ID, "grp-ops", "")
+	policyB.ID = "pol-b"
+	policyB.SourceGroups = []string{"grp-ops", "grp-shared"}
+
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
+		[]*types.Provider{provider},
+		[]*types.Policy{policyA, policyB},
+		[]*types.Guardrail{})
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1)
+
+	mws := services[0].Targets[0].Options.Middlewares
+	var routerCfg routerConfig
+	for _, m := range mws {
+		if m.ID == middlewareIDLLMRouter {
+			require.NoError(t, json.Unmarshal(m.ConfigJSON, &routerCfg))
+			break
+		}
+	}
+	require.Len(t, routerCfg.Providers, 1, "single provider authorised by both policies")
+	assert.Equal(t, provider.ID, routerCfg.Providers[0].ID)
+	assert.Equal(t, []string{"grp-eng", "grp-ops", "grp-shared"}, routerCfg.Providers[0].AllowedGroupIDs,
+		"source groups must be unioned and sorted; the duplicate grp-shared collapses")
+}
+
+func TestSynthesizeServices_OrphanProvider_HasEmptyAllowedGroups(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	authorised := newSynthTestProvider()
+	authorised.ID = "prov-authed"
+
+	orphan := newSynthTestProvider()
+	orphan.ID = "prov-orphan"
+	orphan.ProviderID = "anthropic_api"
+	orphan.UpstreamURL = "https://api.anthropic.com"
+	orphan.APIKey = "sk-ant"
+	orphan.CreatedAt = time.Date(2026, 4, 1, 0, 0, 0, 0, time.UTC)
+
+	// Policy authorises the first provider only.
+	policy := newSynthTestPolicy(authorised.ID, "grp-eng", "")
+
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
+		[]*types.Provider{authorised, orphan},
+		[]*types.Policy{policy},
+		[]*types.Guardrail{})
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1)
+
+	mws := services[0].Targets[0].Options.Middlewares
+	var routerCfg routerConfig
+	for _, m := range mws {
+		if m.ID == middlewareIDLLMRouter {
+			require.NoError(t, json.Unmarshal(m.ConfigJSON, &routerCfg))
+			break
+		}
+	}
+
+	// Orphan providers are dropped from the router config entirely.
+	// The router treats an empty AllowedGroupIDs as a catch-all (right
+	// default for non-agent-network targets, wrong default here), so
+	// we don't ship them at all. Peers attempting to call models only
+	// the orphan claims see model_not_routable; peers calling models
+	// shared with the authorised provider get routed there.
+	require.Len(t, routerCfg.Providers, 1, "only the authorised provider reaches the router")
+	assert.Equal(t, authorised.ID, routerCfg.Providers[0].ID,
+		"authorised provider must be in router config")
+	assert.Equal(t, []string{"grp-eng"}, routerCfg.Providers[0].AllowedGroupIDs,
+		"authorised provider inherits the policy's source groups")
+}
+
+// TestSynthesizeServices_IdentityInject_LiteLLM pins that a LiteLLM
+// provider lands in the identity-inject middleware's config with the
+// catalog-defined LiteLLM headers, while a non-LiteLLM provider does
+// not. Together they prove the middleware is a no-op for accounts that
+// don't use LiteLLM and stamps identity for those that do.
+func TestSynthesizeServices_IdentityInject_LiteLLM(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	openai := newSynthTestProvider()
+	openai.ID = "prov-openai"
+
+	litellm := newSynthTestProvider()
+	litellm.ID = "prov-litellm"
+	litellm.ProviderID = "litellm_proxy"
+	litellm.UpstreamURL = "https://litellm.acme.example.com"
+	litellm.APIKey = "sk-llm-master"
+	litellm.CreatedAt = time.Date(2026, 4, 2, 0, 0, 0, 0, time.UTC)
+
+	policyOpenAI := newSynthTestPolicy(openai.ID, "grp-eng", "")
+	policyOpenAI.ID = "pol-openai"
+	policyLiteLLM := newSynthTestPolicy(litellm.ID, "grp-eng", "")
+	policyLiteLLM.ID = "pol-litellm"
+
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
+		[]*types.Provider{openai, litellm},
+		[]*types.Policy{policyOpenAI, policyLiteLLM},
+		[]*types.Guardrail{})
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1)
+
+	mws := services[0].Targets[0].Options.Middlewares
+	var injectCfg identityInjectConfig
+	for _, m := range mws {
+		if m.ID == middlewareIDLLMIdentityInject {
+			require.NoError(t, json.Unmarshal(m.ConfigJSON, &injectCfg))
+			break
+		}
+	}
+	require.Len(t, injectCfg.Providers, 1,
+		"only providers whose catalog entry declares IdentityInjection should appear in the inject config")
+	entry := injectCfg.Providers[0]
+	assert.Equal(t, litellm.ID, entry.ProviderID,
+		"the LiteLLM provider must be the one identity-stamped, not the OpenAI direct provider")
+	require.NotNil(t, entry.HeaderPair, "LiteLLM uses the HeaderPair shape")
+	assert.Nil(t, entry.JSONMetadata, "shapes are mutually exclusive — JSONMetadata must be nil for HeaderPair providers")
+	assert.Equal(t, "x-litellm-end-user-id", entry.HeaderPair.EndUserIDHeader,
+		"end-user-id header must come from the catalog entry's IdentityInjection block")
+	assert.Equal(t, "x-litellm-tags", entry.HeaderPair.TagsHeader)
+}
+
+// TestSynthesizeServices_IdentityInject_Bifrost_OperatorOverrides
+// covers the customizable HeaderPair contract. The Bifrost catalog
+// entry sets HeaderPair.Customizable=true with x-bf-dim-* defaults
+// (placeholders surfaced by the dashboard, NOT authoritative at
+// synth time). The wire header names that actually land on the
+// inject middleware config come from the provider record's
+// IdentityHeaderUserID / IdentityHeaderGroups fields verbatim. This
+// lets operators pick between Bifrost's two attribution paths
+// (always-on x-bf-lh-* logs metadata vs. label-declared x-bf-dim-*
+// telemetry) per provider record without code changes.
+//
+// Three sub-cases under one fixture: full override, partial
+// override (user kept, groups disabled), and ParserID empty so the
+// proxy falls back to URL sniffing.
+func TestSynthesizeServices_IdentityInject_Bifrost_OperatorOverrides(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	bifrost := newSynthTestProvider()
+	bifrost.ID = "prov-bifrost"
+	bifrost.ProviderID = "bifrost"
+	bifrost.UpstreamURL = "https://bifrost.acme.example.com/openai/v1"
+	bifrost.APIKey = "sk-bf-key"
+	bifrost.IdentityHeaderUserID = "x-bf-lh-netbird_user_id"
+	bifrost.IdentityHeaderGroups = "x-bf-lh-netbird_groups"
+	bifrost.CreatedAt = time.Date(2026, 4, 2, 0, 0, 0, 0, time.UTC)
+
+	policy := newSynthTestPolicy(bifrost.ID, "grp-eng", "")
+	policy.ID = "pol-bifrost"
+
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
+		[]*types.Provider{bifrost},
+		[]*types.Policy{policy},
+		[]*types.Guardrail{})
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1)
+
+	mws := services[0].Targets[0].Options.Middlewares
+	var injectCfg identityInjectConfig
+	for _, m := range mws {
+		if m.ID == middlewareIDLLMIdentityInject {
+			require.NoError(t, json.Unmarshal(m.ConfigJSON, &injectCfg))
+			break
+		}
+	}
+	require.Len(t, injectCfg.Providers, 1,
+		"single bifrost catalog entry → one inject config target — operator's URL path picks the parser, not the catalog id")
+
+	entry := injectCfg.Providers[0]
+	assert.Equal(t, bifrost.ID, entry.ProviderID)
+	require.NotNil(t, entry.HeaderPair, "Bifrost uses HeaderPair shape")
+	assert.Equal(t, "x-bf-lh-netbird_user_id", entry.HeaderPair.EndUserIDHeader,
+		"operator-set IdentityHeaderUserID overrides the catalog's x-bf-dim- placeholder — proves the Customizable flag actually swaps the source of truth")
+	assert.Equal(t, "x-bf-lh-netbird_groups", entry.HeaderPair.TagsHeader,
+		"operator-set IdentityHeaderGroups overrides the catalog's x-bf-dim- placeholder")
+	assert.False(t, entry.HeaderPair.TagsInBody,
+		"body-inject flags stay catalog-owned — Bifrost reads identity from headers, body inject would be a no-op")
+	assert.False(t, entry.HeaderPair.EndUserIDInBody)
+}
+
+// TestSynthesizeServices_IdentityInject_Bifrost_PartialDisable proves
+// that clearing one of the IdentityHeader* fields disables stamping
+// for THAT dimension only, leaving the other dimension active.
+// Critical because the customizable contract says "empty = disabled
+// for that dimension"; if the synth path silently fell back to the
+// catalog default for an empty operator value, operators couldn't
+// turn off groups while keeping user id (or vice versa).
+func TestSynthesizeServices_IdentityInject_Bifrost_PartialDisable(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	bifrost := newSynthTestProvider()
+	bifrost.ID = "prov-bifrost"
+	bifrost.ProviderID = "bifrost"
+	bifrost.UpstreamURL = "https://bifrost.acme.example.com/openai/v1"
+	bifrost.APIKey = "sk-bf-key"
+	bifrost.IdentityHeaderUserID = "x-bf-lh-netbird_user_id"
+	bifrost.IdentityHeaderGroups = "" // operator explicitly disabled groups
+	bifrost.CreatedAt = time.Date(2026, 4, 2, 0, 0, 0, 0, time.UTC)
+
+	policy := newSynthTestPolicy(bifrost.ID, "grp-eng", "")
+	policy.ID = "pol-bifrost"
+
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
+		[]*types.Provider{bifrost},
+		[]*types.Policy{policy},
+		[]*types.Guardrail{})
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1)
+
+	mws := services[0].Targets[0].Options.Middlewares
+	var injectCfg identityInjectConfig
+	for _, m := range mws {
+		if m.ID == middlewareIDLLMIdentityInject {
+			require.NoError(t, json.Unmarshal(m.ConfigJSON, &injectCfg))
+			break
+		}
+	}
+	require.Len(t, injectCfg.Providers, 1)
+	entry := injectCfg.Providers[0]
+	require.NotNil(t, entry.HeaderPair, "user-id header is still set so the rule fires")
+	assert.Equal(t, "x-bf-lh-netbird_user_id", entry.HeaderPair.EndUserIDHeader)
+	assert.Empty(t, entry.HeaderPair.TagsHeader,
+		"groups header must be empty — operator cleared it; the inject middleware no-ops on empty header names so groups are NOT stamped")
+}
+
+// TestSynthesizeServices_IdentityInject_Cloudflare_OperatorOverrides
+// covers the JSONMetadata customizable contract: Cloudflare's
+// catalog entry sets JSONMetadata.Customizable=true with
+// netbird_user_id / netbird_groups defaults that the dashboard
+// surfaces as placeholders. The actual JSON keys that land inside
+// the cf-aig-metadata header come from the provider record's
+// IdentityHeaderUserID / IdentityHeaderGroups fields. Reuses the
+// same fields HeaderPair customizable does — the dimensions
+// (user identity, groups) match; only the wire encoding (JSON key
+// vs HTTP header name) differs.
+func TestSynthesizeServices_IdentityInject_Cloudflare_OperatorOverrides(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	cf := newSynthTestProvider()
+	cf.ID = "prov-cf"
+	cf.ProviderID = "cloudflare_ai_gateway"
+	cf.UpstreamURL = "https://gateway.ai.cloudflare.com/v1/acct-xyz/my-gateway/openai"
+	cf.APIKey = "cf-aig-token"
+	cf.IdentityHeaderUserID = "team_member"
+	cf.IdentityHeaderGroups = "team_groups"
+	cf.CreatedAt = time.Date(2026, 4, 2, 0, 0, 0, 0, time.UTC)
+
+	policy := newSynthTestPolicy(cf.ID, "grp-eng", "")
+	policy.ID = "pol-cf"
+
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
+		[]*types.Provider{cf},
+		[]*types.Policy{policy},
+		[]*types.Guardrail{})
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1)
+
+	mws := services[0].Targets[0].Options.Middlewares
+	var injectCfg identityInjectConfig
+	for _, m := range mws {
+		if m.ID == middlewareIDLLMIdentityInject {
+			require.NoError(t, json.Unmarshal(m.ConfigJSON, &injectCfg))
+			break
+		}
+	}
+	require.Len(t, injectCfg.Providers, 1)
+	entry := injectCfg.Providers[0]
+	require.NotNil(t, entry.JSONMetadata, "Cloudflare uses JSONMetadata shape — single header carrying a JSON object")
+	assert.Nil(t, entry.HeaderPair, "shapes are mutually exclusive")
+	assert.Equal(t, "cf-aig-metadata", entry.JSONMetadata.Header,
+		"the wire header is catalog-owned (cf-aig-metadata) — operator can rename the JSON keys but not the header itself")
+	assert.Equal(t, "team_member", entry.JSONMetadata.UserKey,
+		"operator-set IdentityHeaderUserID overrides the catalog's netbird_user_id default — proves the JSONMetadata Customizable flag swaps the source of truth like HeaderPair already does")
+	assert.Equal(t, "team_groups", entry.JSONMetadata.GroupsKey,
+		"operator-set IdentityHeaderGroups overrides the catalog's netbird_groups default")
+}
+
+// TestSynthesizeServices_IdentityInject_Portkey_NotCustomizable
+// is the JSONMetadata negative case: Portkey's catalog entry leaves
+// Customizable=false because Portkey's analytics dashboard reserves
+// "_user" and "groups" as fixed JSON keys. An operator-set
+// IdentityHeader* on a Portkey provider record must NOT override
+// those keys, or Portkey's per-user filters silently break.
+func TestSynthesizeServices_IdentityInject_Portkey_NotCustomizable(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	portkey := newSynthTestProvider()
+	portkey.ID = "prov-portkey"
+	portkey.ProviderID = "portkey"
+	portkey.UpstreamURL = "https://api.portkey.ai/v1"
+	portkey.APIKey = "portkey-account-key"
+	// Operator set these — but portkey's catalog entry has
+	// JSONMetadata.Customizable=false, so synth must IGNORE them
+	// and stick with the catalog's _user / groups defaults.
+	portkey.IdentityHeaderUserID = "should-be-ignored"
+	portkey.IdentityHeaderGroups = "should-be-ignored-too"
+	portkey.CreatedAt = time.Date(2026, 4, 2, 0, 0, 0, 0, time.UTC)
+
+	policy := newSynthTestPolicy(portkey.ID, "grp-eng", "")
+	policy.ID = "pol-portkey"
+
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
+		[]*types.Provider{portkey},
+		[]*types.Policy{policy},
+		[]*types.Guardrail{})
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1)
+
+	mws := services[0].Targets[0].Options.Middlewares
+	var injectCfg identityInjectConfig
+	for _, m := range mws {
+		if m.ID == middlewareIDLLMIdentityInject {
+			require.NoError(t, json.Unmarshal(m.ConfigJSON, &injectCfg))
+			break
+		}
+	}
+	require.Len(t, injectCfg.Providers, 1)
+	entry := injectCfg.Providers[0]
+	require.NotNil(t, entry.JSONMetadata)
+	assert.Equal(t, "_user", entry.JSONMetadata.UserKey,
+		"Portkey's reserved JSON key must hold — Customizable=false on the catalog blocks the operator's override fields")
+	assert.Equal(t, "groups", entry.JSONMetadata.GroupsKey,
+		"same fixed-schema guarantee for the groups dimension")
+}
+
+// TestSynthesizeServices_IdentityInject_Vercel pins Vercel AI
+// Gateway's wiring: HeaderPair shape with fixed wire names dictated
+// by Vercel's Custom Reporting API (ai-reporting-user /
+// ai-reporting-tags). Customizable=false on the catalog entry, so
+// the synth path takes the catalog values verbatim and ignores any
+// IdentityHeader* fields the operator might have set. Renaming
+// these headers would just silently disable attribution — Vercel's
+// reporting endpoint only matches the canonical names — so the
+// fixed contract is the right semantic.
+func TestSynthesizeServices_IdentityInject_Vercel(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	vercel := newSynthTestProvider()
+	vercel.ID = "prov-vercel"
+	vercel.ProviderID = "vercel_ai_gateway"
+	vercel.UpstreamURL = "https://ai-gateway.vercel.sh/v1"
+	vercel.APIKey = "vrc-team-key"
+	// Operator set these — they MUST be ignored because Vercel's
+	// catalog entry is non-customizable. Renaming the headers on
+	// the wire would defeat Vercel's reporting endpoint.
+	vercel.IdentityHeaderUserID = "should-be-ignored"
+	vercel.IdentityHeaderGroups = "should-be-ignored-too"
+	vercel.CreatedAt = time.Date(2026, 4, 2, 0, 0, 0, 0, time.UTC)
+
+	policy := newSynthTestPolicy(vercel.ID, "grp-eng", "")
+	policy.ID = "pol-vercel"
+
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
+		[]*types.Provider{vercel},
+		[]*types.Policy{policy},
+		[]*types.Guardrail{})
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1)
+
+	mws := services[0].Targets[0].Options.Middlewares
+	var injectCfg identityInjectConfig
+	for _, m := range mws {
+		if m.ID == middlewareIDLLMIdentityInject {
+			require.NoError(t, json.Unmarshal(m.ConfigJSON, &injectCfg))
+			break
+		}
+	}
+	require.Len(t, injectCfg.Providers, 1)
+	entry := injectCfg.Providers[0]
+	require.NotNil(t, entry.HeaderPair, "Vercel uses HeaderPair shape — separate ai-reporting-user / ai-reporting-tags headers, not a JSON blob")
+	assert.Nil(t, entry.JSONMetadata, "shapes are mutually exclusive")
+	assert.Equal(t, "ai-reporting-user", entry.HeaderPair.EndUserIDHeader,
+		"end-user-id header must be Vercel's canonical ai-reporting-user — renaming would silently disable attribution at Vercel's Custom Reporting endpoint")
+	assert.Equal(t, "ai-reporting-tags", entry.HeaderPair.TagsHeader,
+		"tags header must be Vercel's canonical ai-reporting-tags for the same reason")
+	assert.False(t, entry.HeaderPair.TagsInBody,
+		"Vercel reads from headers — body inject would be a LiteLLM-specific belt-and-suspenders unneeded here")
+	assert.False(t, entry.HeaderPair.EndUserIDInBody)
+}
+
+// TestSynthesizeServices_IdentityInject_OpenRouter pins OpenRouter's
+// wiring: HeaderPair shape with body-only injection. OpenRouter's
+// per-user attribution is the OpenAI-standard `user` body field —
+// there's no header path and no groups dimension at all. The catalog
+// entry sets EndUserIDInBody=true with empty header names; the inject
+// middleware writes user identity into the request body but stamps
+// nothing on the header surface. Customizable=false so any operator
+// IdentityHeader* fields are ignored.
+//
+// Also asserts the static ExtraHeaders surface: operators provide
+// their app URL and display name on the provider record (HTTP-Referer
+// and X-OpenRouter-Title), and these land on every upstream request
+// so OpenRouter's app rankings / analytics attribute correctly.
+func TestSynthesizeServices_IdentityInject_OpenRouter(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	openrouter := newSynthTestProvider()
+	openrouter.ID = "prov-openrouter"
+	openrouter.ProviderID = "openrouter"
+	openrouter.UpstreamURL = "https://openrouter.ai/api/v1"
+	openrouter.APIKey = "sk-or-v1-acme"
+	// These would only apply if the catalog entry was Customizable;
+	// it isn't, so they must be IGNORED.
+	openrouter.IdentityHeaderUserID = "should-be-ignored"
+	openrouter.IdentityHeaderGroups = "should-be-ignored-too"
+	openrouter.ExtraValues = map[string]string{
+		"HTTP-Referer":       "https://acme.example/agents",
+		"X-OpenRouter-Title": "Acme Agents",
+	}
+	openrouter.CreatedAt = time.Date(2026, 4, 2, 0, 0, 0, 0, time.UTC)
+
+	policy := newSynthTestPolicy(openrouter.ID, "grp-eng", "")
+	policy.ID = "pol-openrouter"
+
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
+		[]*types.Provider{openrouter},
+		[]*types.Policy{policy},
+		[]*types.Guardrail{})
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1)
+
+	mws := services[0].Targets[0].Options.Middlewares
+	var injectCfg identityInjectConfig
+	for _, m := range mws {
+		if m.ID == middlewareIDLLMIdentityInject {
+			require.NoError(t, json.Unmarshal(m.ConfigJSON, &injectCfg))
+			break
+		}
+	}
+	require.Len(t, injectCfg.Providers, 1)
+	entry := injectCfg.Providers[0]
+	require.NotNil(t, entry.HeaderPair, "OpenRouter uses HeaderPair shape — body-inject is the only branch active")
+	assert.Empty(t, entry.HeaderPair.EndUserIDHeader,
+		"OpenRouter does not document a header path for per-user identity; the inject must NOT stamp a header here. Customizable=false means operator IdentityHeader* fields are ignored.")
+	assert.Empty(t, entry.HeaderPair.TagsHeader,
+		"OpenRouter has no per-request groups / tags dimension — the tags header MUST stay empty")
+	assert.True(t, entry.HeaderPair.EndUserIDInBody,
+		"OpenRouter's only per-user attribution path is the OpenAI-standard `user` body field — body inject is the load-bearing piece for this provider")
+	assert.False(t, entry.HeaderPair.TagsInBody,
+		"no tags dimension at all → no tags-in-body either")
+
+	// ExtraHeaders carry the operator-typed app URL + display name to
+	// OpenRouter's app rankings. The synth must echo BOTH static
+	// header values with the operator's typed strings.
+	require.Len(t, entry.ExtraHeaders, 2,
+		"both ExtraHeaders the catalog declares should land on the inject config when the operator filled in values")
+	byName := map[string]string{}
+	for _, h := range entry.ExtraHeaders {
+		byName[h.Name] = h.Value
+	}
+	assert.Equal(t, "https://acme.example/agents", byName["HTTP-Referer"],
+		"HTTP-Referer is OpenRouter's primary app identifier — must round-trip the operator-typed URL verbatim")
+	assert.Equal(t, "Acme Agents", byName["X-OpenRouter-Title"],
+		"X-OpenRouter-Title surfaces as the app's display name in OpenRouter's rankings — must round-trip operator's chosen string")
+}
+
+// TestSynthesizeServices_IdentityInject_NonCustomizable_UsesCatalog
+// is the LiteLLM-style negative case: when the catalog entry does
+// NOT flag HeaderPair as Customizable, the catalog defaults are
+// authoritative and any IdentityHeader* values on the provider
+// record are ignored. Without this guard, an operator who set those
+// fields on a non-Bifrost provider could accidentally break the
+// gateway's wire protocol (LiteLLM only honours x-litellm-end-user-
+// id; renaming it would silently drop spend tracking).
+func TestSynthesizeServices_IdentityInject_NonCustomizable_UsesCatalog(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	litellm := newSynthTestProvider()
+	litellm.ID = "prov-litellm"
+	litellm.ProviderID = "litellm_proxy"
+	litellm.UpstreamURL = "https://litellm.acme.example.com"
+	litellm.APIKey = "sk-llm-master"
+	// Operator set these — but litellm_proxy's catalog entry has
+	// HeaderPair.Customizable=false, so the synth path must IGNORE
+	// these and fall back to the catalog defaults.
+	litellm.IdentityHeaderUserID = "x-bf-lh-should-be-ignored"
+	litellm.IdentityHeaderGroups = "x-bf-lh-should-be-ignored-too"
+	litellm.CreatedAt = time.Date(2026, 4, 2, 0, 0, 0, 0, time.UTC)
+
+	policy := newSynthTestPolicy(litellm.ID, "grp-eng", "")
+	policy.ID = "pol-litellm"
+
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
+		[]*types.Provider{litellm},
+		[]*types.Policy{policy},
+		[]*types.Guardrail{})
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1)
+
+	mws := services[0].Targets[0].Options.Middlewares
+	var injectCfg identityInjectConfig
+	for _, m := range mws {
+		if m.ID == middlewareIDLLMIdentityInject {
+			require.NoError(t, json.Unmarshal(m.ConfigJSON, &injectCfg))
+			break
+		}
+	}
+	require.Len(t, injectCfg.Providers, 1)
+	entry := injectCfg.Providers[0]
+	require.NotNil(t, entry.HeaderPair)
+	assert.Equal(t, "x-litellm-end-user-id", entry.HeaderPair.EndUserIDHeader,
+		"Customizable=false on the catalog entry must hold — operator IdentityHeader* fields cannot rename a fixed wire protocol's headers")
+	assert.Equal(t, "x-litellm-tags", entry.HeaderPair.TagsHeader,
+		"Customizable=false on the catalog entry must hold for tags too")
+}
+
+func TestSynthesizeServices_GuardrailMerge_AllowlistUnion_LimitsRestrictive(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	provider := newSynthTestProvider()
+
+	guardrailA := &types.Guardrail{
+		ID:        "g-a",
+		AccountID: testAccountID,
+		Checks: types.GuardrailChecks{
+			ModelAllowlist: types.GuardrailModelAllowlist{Enabled: true, Models: []string{"gpt-5.4-mini"}},
+		},
+	}
+	guardrailB := &types.Guardrail{
+		ID:        "g-b",
+		AccountID: testAccountID,
+		Checks: types.GuardrailChecks{
+			ModelAllowlist: types.GuardrailModelAllowlist{Enabled: true, Models: []string{"gpt-5.4-pro"}},
+		},
+	}
+
+	policyA := newSynthTestPolicy(provider.ID, "grp-a", guardrailA.ID)
+	policyA.ID = "pol-a"
+	policyB := newSynthTestPolicy(provider.ID, "grp-b", guardrailB.ID)
+	policyB.ID = "pol-b"
+
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
+		[]*types.Provider{provider},
+		[]*types.Policy{policyA, policyB},
+		[]*types.Guardrail{guardrailA, guardrailB})
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1)
+
+	mws := services[0].Targets[0].Options.Middlewares
+	var guardrailJSON []byte
+	for _, m := range mws {
+		if m.ID == middlewareIDLLMGuardrail {
+			guardrailJSON = m.ConfigJSON
+			break
+		}
+	}
+	require.NotEmpty(t, guardrailJSON, "guardrail middleware config JSON must be present")
+
+	var cfg guardrailConfig
+	require.NoError(t, json.Unmarshal(guardrailJSON, &cfg), "guardrail config must unmarshal cleanly")
+	assert.ElementsMatch(t, []string{"gpt-5.4-mini", "gpt-5.4-pro"}, cfg.ModelAllowlist,
+		"model allowlist union must keep both models")
+}
+
+func TestSynthesizeServices_BackfillsMissingSessionKeys(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	provider := newSynthTestProvider()
+	provider.SessionPrivateKey = ""
+	provider.SessionPublicKey = ""
+	policy := newSynthTestPolicy(provider.ID, "grp-eng", "")
+
+	mockStore.EXPECT().
+		GetAgentNetworkSettings(ctx, store.LockingStrengthNone, testAccountID).
+		Return(newSynthTestSettings(), nil)
+	mockStore.EXPECT().
+		GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, testAccountID).
+		Return([]*types.Provider{provider}, nil)
+	mockStore.EXPECT().
+		GetAccountAgentNetworkPolicies(ctx, store.LockingStrengthNone, testAccountID).
+		Return([]*types.Policy{policy}, nil)
+	// Backfill must persist the new keys before synthesising.
+	mockStore.EXPECT().
+		SaveAgentNetworkProvider(ctx, gomock.Any()).
+		DoAndReturn(func(_ context.Context, p *types.Provider) error {
+			require.NotEmpty(t, p.SessionPrivateKey, "backfill must populate private key")
+			require.NotEmpty(t, p.SessionPublicKey, "backfill must populate public key")
+			return nil
+		})
+	mockStore.EXPECT().
+		GetAccountAgentNetworkGuardrails(ctx, store.LockingStrengthNone, testAccountID).
+		Return([]*types.Guardrail{}, nil)
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1, "synthesis must complete after backfill")
+	assert.NotEmpty(t, services[0].SessionPrivateKey, "synthesised service inherits the freshly-minted private key")
+	assert.NotEmpty(t, services[0].SessionPublicKey, "synthesised service inherits the freshly-minted public key")
+}
+
+func TestSynthesizeServices_HTTPUpstream_KeepsExplicitPort(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	provider := newSynthTestProvider()
+	provider.UpstreamURL = "http://internal-llm.lan:8080"
+	policy := newSynthTestPolicy(provider.ID, "grp-eng", "")
+
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
+		[]*types.Provider{provider},
+		[]*types.Policy{policy},
+		[]*types.Guardrail{})
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1)
+
+	mws := services[0].Targets[0].Options.Middlewares
+	var routerCfg routerConfig
+	for _, m := range mws {
+		if m.ID == middlewareIDLLMRouter {
+			require.NoError(t, json.Unmarshal(m.ConfigJSON, &routerCfg))
+			break
+		}
+	}
+	require.Len(t, routerCfg.Providers, 1)
+	assert.Equal(t, "http", routerCfg.Providers[0].UpstreamScheme, "scheme follows the upstream URL")
+	assert.Equal(t, "internal-llm.lan:8080", routerCfg.Providers[0].UpstreamHost,
+		"explicit port travels with host so the router rewrite carries an authority the proxy can dial")
+}
+
+func TestSynthesizeServices_UpstreamURLPath_FlowsToRouter(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	// Provider configured with a path-prefixed upstream — common for
+	// OpenAI-compatible endpoints behind corporate gateways. The path
+	// is the router's disambiguator when two providers claim the same
+	// model, so it must round-trip through buildRouterConfigJSON with
+	// the trailing slash trimmed.
+	provider := newSynthTestProvider()
+	provider.UpstreamURL = "https://corp.example.com/openai/"
+	policy := newSynthTestPolicy(provider.ID, "grp-eng", "")
+
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
+		[]*types.Provider{provider},
+		[]*types.Policy{policy},
+		[]*types.Guardrail{})
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1)
+
+	mws := services[0].Targets[0].Options.Middlewares
+	var routerCfg routerConfig
+	for _, m := range mws {
+		if m.ID == middlewareIDLLMRouter {
+			require.NoError(t, json.Unmarshal(m.ConfigJSON, &routerCfg))
+			break
+		}
+	}
+	require.Len(t, routerCfg.Providers, 1)
+	assert.Equal(t, "corp.example.com", routerCfg.Providers[0].UpstreamHost, "host should drop the path")
+	assert.Equal(t, "/openai", routerCfg.Providers[0].UpstreamPath,
+		"upstream path must be carried so the router can disambiguate same-model providers; trailing slash trimmed for stable string-prefix matching")
+}
+
+func TestSynthesizeServices_UnknownProviderID_FailsClosed(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	provider := newSynthTestProvider()
+	provider.ProviderID = "nonexistent_provider"
+	policy := newSynthTestPolicy(provider.ID, "grp-eng", "")
+
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
+		[]*types.Provider{provider},
+		[]*types.Policy{policy},
+		[]*types.Guardrail{})
+
+	_, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.Error(t, err, "synthesis must fail when the catalog can't resolve the provider id")
+	assert.Contains(t, err.Error(), "unknown catalog id", "error must surface the misconfiguration")
+}
+
+func TestSynthesizeServices_EmptyAPIKey_FailsClosed(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	provider := newSynthTestProvider()
+	provider.APIKey = ""
+	policy := newSynthTestPolicy(provider.ID, "grp-eng", "")
+
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
+		[]*types.Provider{provider},
+		[]*types.Policy{policy},
+		[]*types.Guardrail{})
+
+	_, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.Error(t, err, "synthesis must refuse a provider with no api key")
+	assert.Contains(t, err.Error(), "no api key", "error must surface the missing credential")
+}
diff --git a/management/internals/modules/agentnetwork/types/accesslog.go b/management/internals/modules/agentnetwork/types/accesslog.go
new file mode 100644
index 000000000..92b8bc358
--- /dev/null
+++ b/management/internals/modules/agentnetwork/types/accesslog.go
@@ -0,0 +1,289 @@
+package types
+
+import (
+	"time"
+
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// AgentNetworkAccessLog is the dedicated, flattened agent-network access-log
+// row. Unlike the shared reverse-proxy AccessLogEntry (which kept LLM data in
+// an opaque metadata JSON blob), the LLM dimensions live in first-class,
+// indexed columns so the access-log surface can filter server-side by
+// user / group / provider / model / decision.
+type AgentNetworkAccessLog struct {
+	// The composite index idx_anal_acct_session_ts backs the session-grouped
+	// listing (GROUP BY session_id ORDER BY MAX(timestamp) within an account);
+	// the single-column indexes still back the flat filters/sorts.
+	ID            string    `gorm:"primaryKey"`
+	AccountID     string    `gorm:"index;index:idx_anal_acct_session_ts,priority:1"`
+	ServiceID     string    `gorm:"index"`
+	Timestamp     time.Time `gorm:"index;index:idx_anal_acct_session_ts,priority:3"`
+	UserID        string    `gorm:"index"`
+	SourceIP      string
+	Method        string
+	Host          string
+	Path          string `gorm:"type:text"`
+	Duration      time.Duration
+	StatusCode    int `gorm:"index"`
+	AuthMethod    string
+	BytesUpload   int64
+	BytesDownload int64
+
+	// Flattened LLM dimensions (queryable). Sourced from proxy metadata keys.
+	Provider           string `gorm:"index"`                                           // vendor, e.g. "openai" (llm.provider)
+	Model              string `gorm:"index"`                                           // llm.model
+	SessionID          string `gorm:"index;index:idx_anal_acct_session_ts,priority:2"` // llm.session_id — groups a conversation / coding session
+	ResolvedProviderID string `gorm:"index"`                                           // llm.resolved_provider_id
+	SelectedPolicyID   string `gorm:"index"`                                           // llm.selected_policy_id
+	Decision           string `gorm:"index"`                                           // llm_policy.decision (allow/deny)
+	DenyReason         string // llm_policy.reason (raw code, mapped in the UI)
+	InputTokens        int64
+	OutputTokens       int64
+	TotalTokens        int64
+	CostUSD            float64
+	Stream             bool
+
+	// Prompt capture. Only populated when prompt collection is enabled
+	// (account master switch AND policy guardrail). Heavy free text.
+	RequestPrompt      string `gorm:"type:text"`
+	ResponseCompletion string `gorm:"type:text"`
+
+	CreatedAt time.Time
+
+	// GroupIDs is the authorising group ids for this entry, hydrated from the
+	// group child table on read. Not a column.
+	GroupIDs []string `gorm:"-"`
+}
+
+// TableName keeps agent-network access logs in their own table, separate from
+// the reverse-proxy AccessLogEntry table.
+func (AgentNetworkAccessLog) TableName() string { return "agent_network_access_log" }
+
+// ToAPIResponse renders the flattened entry as the API representation.
+func (a *AgentNetworkAccessLog) ToAPIResponse() api.AgentNetworkAccessLog {
+	out := api.AgentNetworkAccessLog{
+		Id:           a.ID,
+		ServiceId:    a.ServiceID,
+		Timestamp:    a.Timestamp,
+		StatusCode:   a.StatusCode,
+		DurationMs:   int(a.Duration.Milliseconds()),
+		InputTokens:  a.InputTokens,
+		OutputTokens: a.OutputTokens,
+		TotalTokens:  a.TotalTokens,
+		CostUsd:      a.CostUSD,
+		Stream:       &a.Stream,
+	}
+
+	out.UserId = strPtr(a.UserID)
+	out.SourceIp = strPtr(a.SourceIP)
+	out.Method = strPtr(a.Method)
+	out.Host = strPtr(a.Host)
+	out.Path = strPtr(a.Path)
+	out.Provider = strPtr(a.Provider)
+	out.Model = strPtr(a.Model)
+	out.SessionId = strPtr(a.SessionID)
+	out.ResolvedProviderId = strPtr(a.ResolvedProviderID)
+	out.SelectedPolicyId = strPtr(a.SelectedPolicyID)
+	out.Decision = strPtr(a.Decision)
+	out.DenyReason = strPtr(a.DenyReason)
+	out.RequestPrompt = strPtr(a.RequestPrompt)
+	out.ResponseCompletion = strPtr(a.ResponseCompletion)
+
+	if len(a.GroupIDs) > 0 {
+		groups := a.GroupIDs
+		out.GroupIds = &groups
+	}
+	return out
+}
+
+// strPtr returns a pointer to s, or nil when s is empty — so empty optional
+// fields are omitted from the JSON rather than serialised as "".
+func strPtr(s string) *string {
+	if s == "" {
+		return nil
+	}
+	return &s
+}
+
+// AgentNetworkAccessLogSession is a session-grouped view of access-log entries:
+// all requests sharing a session id (or, for a request the client sent no
+// session id for, that single request keyed by its own row id) folded into one
+// summary plus its ordered entries. Assembled in Go from a page of entries — it
+// is not a stored table.
+type AgentNetworkAccessLogSession struct {
+	SessionID    string // empty for a session-less (singleton) request
+	UserID       string
+	GroupIDs     []string // union of the entries' authorising groups
+	StartedAt    time.Time
+	EndedAt      time.Time
+	RequestCount int
+	InputTokens  int64
+	OutputTokens int64
+	TotalTokens  int64
+	CostUSD      float64
+	Providers    []string // distinct vendors seen in the session
+	Models       []string // distinct models seen in the session
+	Decision     string   // "deny" if any entry was denied, else "allow"
+	Entries      []*AgentNetworkAccessLog
+}
+
+// sessionKey is the grouping key for an entry: its session id, or — when the
+// client sent none — its own row id, so session-less requests each form their
+// own singleton group. Must match the SQL group key
+// COALESCE(NULLIF(session_id, ”), id).
+func sessionKey(e *AgentNetworkAccessLog) string {
+	if e.SessionID != "" {
+		return e.SessionID
+	}
+	return e.ID
+}
+
+// FoldAccessLogSessions folds a page of entries into per-session summaries,
+// preserving the order of orderedKeys (the already-sorted, already-paginated
+// session keys from the store). Entries are expected pre-sorted by timestamp
+// within each key. Aggregation (sums, distinct providers/models, deny rollup)
+// happens here in Go rather than in SQL so the query stays engine-portable.
+func FoldAccessLogSessions(orderedKeys []string, entries []*AgentNetworkAccessLog) []*AgentNetworkAccessLogSession {
+	byKey := make(map[string]*AgentNetworkAccessLogSession, len(orderedKeys))
+	order := make([]*AgentNetworkAccessLogSession, 0, len(orderedKeys))
+	for _, k := range orderedKeys {
+		if _, ok := byKey[k]; ok {
+			continue
+		}
+		sess := &AgentNetworkAccessLogSession{Decision: "allow"}
+		byKey[k] = sess
+		order = append(order, sess)
+	}
+
+	seenBy := make(map[string]*sessionSeen, len(orderedKeys))
+
+	for _, e := range entries {
+		k := sessionKey(e)
+		sess, ok := byKey[k]
+		if !ok {
+			continue // entry outside the paged set; defensive
+		}
+		sk := seenBy[k]
+		if sk == nil {
+			sk = newSessionSeen()
+			seenBy[k] = sk
+			sess.SessionID = e.SessionID
+			sess.UserID = e.UserID
+			sess.StartedAt = e.Timestamp
+			sess.EndedAt = e.Timestamp
+		}
+		sess.foldEntry(sk, e)
+	}
+
+	out := make([]*AgentNetworkAccessLogSession, 0, len(order))
+	for _, sess := range order {
+		if sess.RequestCount > 0 {
+			out = append(out, sess)
+		}
+	}
+	return out
+}
+
+// sessionSeen tracks the distinct provider / model / group values already
+// recorded for a session so foldEntry can dedupe as it accumulates.
+type sessionSeen struct{ providers, models, groups map[string]struct{} }
+
+func newSessionSeen() *sessionSeen {
+	return &sessionSeen{
+		providers: map[string]struct{}{},
+		models:    map[string]struct{}{},
+		groups:    map[string]struct{}{},
+	}
+}
+
+// foldEntry accumulates a single entry into the session summary: sums, time
+// bounds, first-seen user, deny rollup, distinct provider / model / group
+// lists, and the entry itself.
+func (sess *AgentNetworkAccessLogSession) foldEntry(sk *sessionSeen, e *AgentNetworkAccessLog) {
+	sess.RequestCount++
+	sess.InputTokens += e.InputTokens
+	sess.OutputTokens += e.OutputTokens
+	sess.TotalTokens += e.TotalTokens
+	sess.CostUSD += e.CostUSD
+	if e.Timestamp.Before(sess.StartedAt) {
+		sess.StartedAt = e.Timestamp
+	}
+	if e.Timestamp.After(sess.EndedAt) {
+		sess.EndedAt = e.Timestamp
+	}
+	if sess.UserID == "" {
+		sess.UserID = e.UserID
+	}
+	if e.Decision == "deny" {
+		sess.Decision = "deny"
+	}
+	sess.Providers = appendDistinct(sk.providers, sess.Providers, e.Provider)
+	sess.Models = appendDistinct(sk.models, sess.Models, e.Model)
+	for _, g := range e.GroupIDs {
+		sess.GroupIDs = appendDistinct(sk.groups, sess.GroupIDs, g)
+	}
+	sess.Entries = append(sess.Entries, e)
+}
+
+// appendDistinct appends v to list when v is non-empty and not already recorded
+// in seen, returning the possibly-extended list.
+func appendDistinct(seen map[string]struct{}, list []string, v string) []string {
+	if v == "" {
+		return list
+	}
+	if _, dup := seen[v]; dup {
+		return list
+	}
+	seen[v] = struct{}{}
+	return append(list, v)
+}
+
+// ToAPIResponse renders the session summary (and its entries) as the API
+// representation.
+func (sess *AgentNetworkAccessLogSession) ToAPIResponse() api.AgentNetworkAccessLogSession {
+	entries := make([]api.AgentNetworkAccessLog, 0, len(sess.Entries))
+	for _, e := range sess.Entries {
+		entries = append(entries, e.ToAPIResponse())
+	}
+
+	out := api.AgentNetworkAccessLogSession{
+		StartedAt:    sess.StartedAt,
+		EndedAt:      sess.EndedAt,
+		RequestCount: sess.RequestCount,
+		InputTokens:  sess.InputTokens,
+		OutputTokens: sess.OutputTokens,
+		TotalTokens:  sess.TotalTokens,
+		CostUsd:      sess.CostUSD,
+		Decision:     sess.Decision,
+		Entries:      entries,
+	}
+	out.SessionId = strPtr(sess.SessionID)
+	out.UserId = strPtr(sess.UserID)
+	if len(sess.Providers) > 0 {
+		providers := sess.Providers
+		out.Providers = &providers
+	}
+	if len(sess.Models) > 0 {
+		models := sess.Models
+		out.Models = &models
+	}
+	if len(sess.GroupIDs) > 0 {
+		groups := sess.GroupIDs
+		out.GroupIds = &groups
+	}
+	return out
+}
+
+// AgentNetworkAccessLogGroup is the normalised many-to-many row linking a log
+// entry to one authorising group, so the access-log endpoint can filter by
+// group with a simple `group_id IN (...)` join instead of substring-matching a
+// CSV column.
+type AgentNetworkAccessLogGroup struct {
+	LogID     string `gorm:"primaryKey"`
+	GroupID   string `gorm:"primaryKey;index"`
+	AccountID string `gorm:"index"`
+}
+
+// TableName names the access-log group child table.
+func (AgentNetworkAccessLogGroup) TableName() string { return "agent_network_access_log_group" }
diff --git a/management/internals/modules/agentnetwork/types/accesslogfilter.go b/management/internals/modules/agentnetwork/types/accesslogfilter.go
new file mode 100644
index 000000000..d571a87b6
--- /dev/null
+++ b/management/internals/modules/agentnetwork/types/accesslogfilter.go
@@ -0,0 +1,249 @@
+package types
+
+import (
+	"math"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+const (
+	// AccessLogDefaultPageSize is the default number of records per page.
+	AccessLogDefaultPageSize = 50
+	// AccessLogMaxPageSize is the maximum number of records allowed per page.
+	AccessLogMaxPageSize = 100
+
+	accessLogDefaultSortBy    = "timestamp"
+	accessLogDefaultSortOrder = "desc"
+
+	// usageOverviewDefaultLookback bounds an unbounded usage-overview query so
+	// it never aggregates an account's entire history into memory.
+	usageOverviewDefaultLookback = 90 * 24 * time.Hour
+	// usageOverviewMaxRange caps how far back an explicit range may reach.
+	usageOverviewMaxRange = 366 * 24 * time.Hour
+)
+
+// ApplyUsageOverviewBounds bounds a missing or over-wide date range so the
+// in-memory usage aggregation can't load an account's full usage history. An
+// absent range defaults to the last usageOverviewDefaultLookback; a range wider
+// than usageOverviewMaxRange is clamped from the (possibly defaulted) end.
+func (f *AgentNetworkAccessLogFilter) ApplyUsageOverviewBounds(now time.Time) {
+	end := now
+	if f.EndDate != nil {
+		end = *f.EndDate
+	}
+	f.EndDate = &end
+	if f.StartDate == nil {
+		start := end.Add(-usageOverviewDefaultLookback)
+		f.StartDate = &start
+		return
+	}
+	if end.Sub(*f.StartDate) > usageOverviewMaxRange {
+		start := end.Add(-usageOverviewMaxRange)
+		f.StartDate = &start
+	}
+}
+
+// accessLogSortFields maps the API sort_by values to their database columns.
+var accessLogSortFields = map[string]string{
+	"timestamp":    "timestamp",
+	"model":        "model",
+	"provider":     "provider",
+	"status_code":  "status_code",
+	"duration":     "duration",
+	"cost_usd":     "cost_usd",
+	"total_tokens": "total_tokens",
+	"user_id":      "user_id",
+	"decision":     "decision",
+}
+
+// sessionSortExprs maps the API sort_by values to the aggregate expression a
+// session-grouped query sorts on. A session has no single row, so per-row
+// columns become aggregates: "timestamp" (the default) is the session's last
+// activity, "started_at" its first. Every expression is a plain SQL aggregate
+// over the GROUP BY, so the ordering stays portable across SQLite and Postgres.
+// Keys absent here (e.g. "model", "provider") fall back to the default — the
+// grouped UI only offers the session-level sorts below.
+var sessionSortExprs = map[string]string{ //nolint:gosec // G101 false positive: "total_tokens" sort key, not a credential
+	"timestamp":     "MAX(timestamp)",
+	"started_at":    "MIN(timestamp)",
+	"cost_usd":      "SUM(cost_usd)",
+	"total_tokens":  "SUM(total_tokens)",
+	"duration":      "SUM(duration)",
+	"request_count": "COUNT(*)",
+	"status_code":   "MAX(status_code)",
+	"user_id":       "MIN(user_id)",
+	"decision":      "MAX(decision)", // "deny" > "allow": DESC surfaces denied sessions first
+}
+
+// AgentNetworkAccessLogFilter holds pagination, filtering and sorting
+// parameters for the agent-network access-log listing. Group / provider /
+// model are multi-valued (the UI uses multi-select; an entry matches when it
+// matches any selected value).
+type AgentNetworkAccessLogFilter struct {
+	Page     int
+	PageSize int
+
+	SortBy    string
+	SortOrder string
+
+	Search      *string    // log id, host, path, model, user email/name
+	UserID      *string    // exact user id (the dashboard sends the picked user's id)
+	SessionID   *string    // exact session id — groups one conversation / coding session
+	GroupIDs    []string   // authorising group ids (match any)
+	ProviderIDs []string   // resolved provider ids (match any)
+	Models      []string   // models (match any)
+	Decision    *string    // policy decision (allow/deny)
+	PathPrefix  *string    // request path prefix (path LIKE 'prefix%')
+	StartDate   *time.Time // timestamp >= start_date
+	EndDate     *time.Time // timestamp <= end_date
+}
+
+// ParseFromRequest fills the filter from the request query parameters. It
+// returns a validation error when a supplied start_date / end_date is present
+// but not valid RFC3339: silently dropping a malformed date would broaden the
+// query (and, for the usage overview, fall back to the default window).
+func (f *AgentNetworkAccessLogFilter) ParseFromRequest(r *http.Request) error {
+	q := r.URL.Query()
+
+	f.Page = parseAccessLogPositiveInt(q.Get("page"), 1)
+	f.PageSize = min(parseAccessLogPositiveInt(q.Get("page_size"), AccessLogDefaultPageSize), AccessLogMaxPageSize)
+
+	f.SortBy = parseAccessLogSortField(q.Get("sort_by"))
+	f.SortOrder = parseAccessLogSortOrder(q.Get("sort_order"))
+
+	f.Search = parseAccessLogOptionalString(q.Get("search"))
+	f.UserID = parseAccessLogOptionalString(q.Get("user_id"))
+	f.SessionID = parseAccessLogOptionalString(q.Get("session_id"))
+	f.Decision = parseAccessLogOptionalString(q.Get("decision"))
+	f.PathPrefix = parseAccessLogOptionalString(q.Get("path"))
+	// Multi-value filters accept either repeated params (?group_id=a&group_id=b)
+	// or a single comma-separated value (?group_id=a,b) so both the OpenAPI
+	// array form and the dashboard's single-value query builder work.
+	f.GroupIDs = splitMultiValue(q["group_id"])
+	f.ProviderIDs = splitMultiValue(q["provider_id"])
+	f.Models = splitMultiValue(q["model"])
+
+	var err error
+	if f.StartDate, err = parseAccessLogOptionalRFC3339(q.Get("start_date")); err != nil {
+		return status.Errorf(status.InvalidArgument, "invalid start_date: %v", err)
+	}
+	if f.EndDate, err = parseAccessLogOptionalRFC3339(q.Get("end_date")); err != nil {
+		return status.Errorf(status.InvalidArgument, "invalid end_date: %v", err)
+	}
+	return nil
+}
+
+// GetSortColumn returns the database column for the active sort field.
+func (f *AgentNetworkAccessLogFilter) GetSortColumn() string {
+	if col, ok := accessLogSortFields[f.SortBy]; ok {
+		return col
+	}
+	return accessLogSortFields[accessLogDefaultSortBy]
+}
+
+// GetSessionSortExpr returns the aggregate ORDER BY expression for the active
+// sort field when listing session-grouped logs. Unknown / non-session sort
+// fields fall back to the default (last activity).
+func (f *AgentNetworkAccessLogFilter) GetSessionSortExpr() string {
+	if expr, ok := sessionSortExprs[f.SortBy]; ok {
+		return expr
+	}
+	return sessionSortExprs[accessLogDefaultSortBy]
+}
+
+// GetSortOrder returns the normalised sort order ("ASC"/"DESC").
+func (f *AgentNetworkAccessLogFilter) GetSortOrder() string {
+	if strings.EqualFold(f.SortOrder, "asc") {
+		return "ASC"
+	}
+	return "DESC"
+}
+
+// GetLimit returns the page size, defaulting/clamping when unset.
+func (f *AgentNetworkAccessLogFilter) GetLimit() int {
+	if f.PageSize <= 0 {
+		return AccessLogDefaultPageSize
+	}
+	return min(f.PageSize, AccessLogMaxPageSize)
+}
+
+// GetOffset returns the zero-based row offset for the active page. Page is
+// user-controlled, so the multiplication is guarded against int overflow.
+func (f *AgentNetworkAccessLogFilter) GetOffset() int {
+	limit := f.GetLimit()
+	if f.Page <= 1 || limit <= 0 {
+		return 0
+	}
+	if f.Page-1 > math.MaxInt/limit {
+		return math.MaxInt - (math.MaxInt % limit)
+	}
+	return (f.Page - 1) * limit
+}
+
+func parseAccessLogPositiveInt(s string, def int) int {
+	if v, err := strconv.Atoi(strings.TrimSpace(s)); err == nil && v > 0 {
+		return v
+	}
+	return def
+}
+
+func parseAccessLogSortField(s string) string {
+	if _, ok := accessLogSortFields[s]; ok {
+		return s
+	}
+	// Session-grouped listings sort on aggregates (e.g. request_count,
+	// started_at) that aren't flat-row columns; accept those too. The flat
+	// listing maps any unknown field back to the default, so this stays safe
+	// for the non-grouped endpoint.
+	if _, ok := sessionSortExprs[s]; ok {
+		return s
+	}
+	return accessLogDefaultSortBy
+}
+
+func parseAccessLogSortOrder(s string) string {
+	if strings.EqualFold(s, "asc") {
+		return "asc"
+	}
+	return accessLogDefaultSortOrder
+}
+
+func parseAccessLogOptionalString(s string) *string {
+	if s = strings.TrimSpace(s); s != "" {
+		return &s
+	}
+	return nil
+}
+
+func parseAccessLogOptionalRFC3339(s string) (*time.Time, error) {
+	if s = strings.TrimSpace(s); s == "" {
+		return nil, nil //nolint:nilnil // not provided: no value and no error
+	}
+	t, err := time.Parse(time.RFC3339, s)
+	if err != nil {
+		return nil, err
+	}
+	return &t, nil
+}
+
+// splitMultiValue flattens repeated query params and comma-separated values
+// into a single trimmed, blank-free list. Returns nil when nothing remains so
+// callers can skip the filter entirely.
+func splitMultiValue(values []string) []string {
+	out := make([]string, 0, len(values))
+	for _, raw := range values {
+		for _, v := range strings.Split(raw, ",") {
+			if v = strings.TrimSpace(v); v != "" {
+				out = append(out, v)
+			}
+		}
+	}
+	if len(out) == 0 {
+		return nil
+	}
+	return out
+}
diff --git a/management/internals/modules/agentnetwork/types/budgetrule.go b/management/internals/modules/agentnetwork/types/budgetrule.go
new file mode 100644
index 000000000..6f02a5b92
--- /dev/null
+++ b/management/internals/modules/agentnetwork/types/budgetrule.go
@@ -0,0 +1,106 @@
+package types
+
+import (
+	"time"
+
+	"github.com/rs/xid"
+
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// AccountBudgetRule is an account-level, limit-only rule bound to groups
+// and/or users. It mirrors the policy budget experience without any routing:
+// it carries the same cap shape as a policy (PolicyLimits) but never selects a
+// provider. Rules apply across policies as an always-on ceiling — every
+// applicable rule binds (min-wins), so a rule can only tighten a caller's
+// effective limit, never loosen it.
+//
+// TargetGroups matches when it intersects the caller's groups; TargetUsers
+// binds a specific user directly. Empty TargetGroups and TargetUsers means the
+// rule applies to every caller (the account-wide default).
+type AccountBudgetRule struct {
+	ID           string `gorm:"primaryKey"`
+	AccountID    string `gorm:"index"`
+	Name         string
+	Enabled      bool
+	TargetGroups []string     `gorm:"serializer:json;column:target_groups"`
+	TargetUsers  []string     `gorm:"serializer:json;column:target_users"`
+	Limits       PolicyLimits `gorm:"serializer:json;column:limits"`
+
+	CreatedAt time.Time
+	UpdatedAt time.Time
+}
+
+// TableName puts budget rules in their own table.
+func (AccountBudgetRule) TableName() string { return "agent_network_budget_rules" }
+
+// NewAccountBudgetRule returns a new rule with a freshly minted ID.
+func NewAccountBudgetRule(accountID string) *AccountBudgetRule {
+	now := time.Now().UTC()
+	return &AccountBudgetRule{
+		ID:        "ainbud_" + xid.New().String(),
+		AccountID: accountID,
+		Enabled:   true,
+		CreatedAt: now,
+		UpdatedAt: now,
+	}
+}
+
+// Copy returns a deep copy of the rule, including its target slices.
+func (r *AccountBudgetRule) Copy() *AccountBudgetRule {
+	c := *r
+	c.TargetGroups = append([]string(nil), r.TargetGroups...)
+	c.TargetUsers = append([]string(nil), r.TargetUsers...)
+	return &c
+}
+
+// EventMeta renders the rule for the activity log.
+func (r *AccountBudgetRule) EventMeta() map[string]any {
+	return map[string]any{
+		"name":    r.Name,
+		"enabled": r.Enabled,
+	}
+}
+
+// FromAPIRequest applies the request payload onto the receiver.
+func (r *AccountBudgetRule) FromAPIRequest(req *api.AgentNetworkBudgetRuleRequest) {
+	r.Name = req.Name
+	if req.Enabled != nil {
+		r.Enabled = *req.Enabled
+	}
+	if req.TargetGroups != nil {
+		r.TargetGroups = append([]string(nil), (*req.TargetGroups)...)
+	} else {
+		r.TargetGroups = []string{}
+	}
+	if req.TargetUsers != nil {
+		r.TargetUsers = append([]string(nil), (*req.TargetUsers)...)
+	} else {
+		r.TargetUsers = []string{}
+	}
+	r.Limits = limitsFromAPI(req.Limits)
+}
+
+// ToAPIResponse renders the rule as the API representation.
+func (r *AccountBudgetRule) ToAPIResponse() *api.AgentNetworkBudgetRule {
+	groups := r.TargetGroups
+	if groups == nil {
+		groups = []string{}
+	}
+	users := r.TargetUsers
+	if users == nil {
+		users = []string{}
+	}
+	created := r.CreatedAt
+	updated := r.UpdatedAt
+	return &api.AgentNetworkBudgetRule{
+		Id:           r.ID,
+		Name:         r.Name,
+		Enabled:      r.Enabled,
+		TargetGroups: groups,
+		TargetUsers:  users,
+		Limits:       limitsToAPI(r.Limits),
+		CreatedAt:    &created,
+		UpdatedAt:    &updated,
+	}
+}
diff --git a/management/internals/modules/agentnetwork/types/consumption.go b/management/internals/modules/agentnetwork/types/consumption.go
new file mode 100644
index 000000000..5295b5570
--- /dev/null
+++ b/management/internals/modules/agentnetwork/types/consumption.go
@@ -0,0 +1,69 @@
+package types
+
+import "time"
+
+// ConsumptionDimension classifies which kind of identity a consumption
+// row counts against. The proxy-side enforcement layer ticks one row
+// per dimension per request — typically one user row plus one group
+// row.
+type ConsumptionDimension string
+
+const (
+	// DimensionUser counts tokens / spend for a single end user. The
+	// dim_id column carries the netbird user id (or peer.ID when the
+	// caller is a tunnel-peer principal).
+	DimensionUser ConsumptionDimension = "user"
+	// DimensionGroup counts tokens / spend for a single source group
+	// across every member of that group. The dim_id column carries
+	// the netbird group id.
+	DimensionGroup ConsumptionDimension = "group"
+)
+
+// Consumption is a per-dimension token + USD counter for a fixed
+// aligned window. The (account, dim_kind, dim_id, window_seconds,
+// window_start) tuple is the primary key; rows are rolled forward by
+// the proxy's post-flight RecordLLMUsage path on every request.
+//
+// The same dim_id (e.g. a group id) gets one row per distinct
+// window_seconds length in scope across the account's policies,
+// because two policies with different window lengths read independent
+// counters even though they share the dimension. Two policies with
+// identical window_seconds on the same dimension share one counter
+// (correct: their caps are checked against the same shared bucket).
+type Consumption struct {
+	AccountID      string               `gorm:"primaryKey;type:varchar(255)"`
+	DimensionKind  ConsumptionDimension `gorm:"primaryKey;type:varchar(16);column:dim_kind"`
+	DimensionID    string               `gorm:"primaryKey;type:varchar(255);column:dim_id"`
+	WindowSeconds  int64                `gorm:"primaryKey;column:window_seconds"`
+	WindowStartUTC time.Time            `gorm:"primaryKey;column:window_start_utc"`
+	TokensInput    int64                `gorm:"column:tokens_input"`
+	TokensOutput   int64                `gorm:"column:tokens_output"`
+	CostUSD        float64              `gorm:"column:cost_usd"`
+	UpdatedAt      time.Time
+}
+
+// TableName forces a stable name independent of GORM's pluraliser.
+func (Consumption) TableName() string { return "agent_network_consumption" }
+
+// ConsumptionKey identifies a single consumption counter within an account:
+// the (dim_kind, dim_id, window_seconds, window_start) part of the row's
+// primary key. Used to batch-read and batch-increment many counters for one
+// request in a single store round-trip / transaction.
+type ConsumptionKey struct {
+	Kind           ConsumptionDimension
+	DimID          string
+	WindowSeconds  int64
+	WindowStartUTC time.Time
+}
+
+// WindowStart returns the aligned UTC start of the window of length
+// windowSeconds that contains t. Aligned to the unix epoch so the
+// same bucket boundary is computed deterministically across processes.
+func WindowStart(t time.Time, windowSeconds int64) time.Time {
+	if windowSeconds <= 0 {
+		return t.UTC()
+	}
+	step := windowSeconds * int64(time.Second)
+	bucketed := t.UTC().UnixNano() / step * step
+	return time.Unix(0, bucketed).UTC()
+}
diff --git a/management/internals/modules/agentnetwork/types/consumption_test.go b/management/internals/modules/agentnetwork/types/consumption_test.go
new file mode 100644
index 000000000..596cc158c
--- /dev/null
+++ b/management/internals/modules/agentnetwork/types/consumption_test.go
@@ -0,0 +1,141 @@
+package types
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// TestWindowStart_AlignedToUnixEpoch is the multi-node-convergence
+// guarantee: any two proxies computing WindowStart(now, s) for the
+// same s must land on the same boundary. The implementation aligns
+// to the unix epoch (UTC) rather than local time, calendar weeks, or
+// process start time — none of which are shared across nodes.
+//
+// Table covers the load-bearing window lengths (5m, 1h, 24h, 30d)
+// plus a few odd values that still need to align cleanly.
+func TestWindowStart_AlignedToUnixEpoch(t *testing.T) {
+	cases := []struct {
+		name          string
+		instant       time.Time
+		windowSeconds int64
+		want          time.Time
+	}{
+		{
+			name:          "5m window — drops seconds inside the bucket",
+			instant:       time.Date(2026, 5, 6, 13, 47, 23, 0, time.UTC),
+			windowSeconds: 300,
+			want:          time.Date(2026, 5, 6, 13, 45, 0, 0, time.UTC),
+		},
+		{
+			name:          "1h window — drops minutes / seconds, keeps the hour",
+			instant:       time.Date(2026, 5, 6, 13, 47, 23, 0, time.UTC),
+			windowSeconds: 3600,
+			want:          time.Date(2026, 5, 6, 13, 0, 0, 0, time.UTC),
+		},
+		{
+			name:          "24h window aligns to UTC midnight",
+			instant:       time.Date(2026, 5, 6, 13, 47, 23, 0, time.UTC),
+			windowSeconds: 86_400,
+			want:          time.Date(2026, 5, 6, 0, 0, 0, 0, time.UTC),
+		},
+		{
+			name:          "30d (2_592_000s) window aligns to the 30d epoch grid, not month boundaries",
+			instant:       time.Date(2026, 5, 6, 0, 0, 0, 0, time.UTC),
+			windowSeconds: 2_592_000,
+			// 2026-05-06 UTC = 1778025600s; 1778025600 / 2592000 = 685
+			// 685 * 2592000 = 1775520000s = 2026-04-07 00:00:00 UTC
+			want: time.Date(2026, 4, 7, 0, 0, 0, 0, time.UTC),
+		},
+		{
+			name:          "non-UTC input still anchors on UTC epoch boundaries",
+			instant:       time.Date(2026, 5, 6, 13, 47, 23, 0, time.FixedZone("CEST", 2*3600)),
+			windowSeconds: 86_400,
+			// 2026-05-06 13:47:23 CEST = 11:47:23 UTC → bucket 2026-05-06 00:00:00 UTC
+			want: time.Date(2026, 5, 6, 0, 0, 0, 0, time.UTC),
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := WindowStart(tc.instant, tc.windowSeconds)
+			assert.True(t, got.Equal(tc.want),
+				"WindowStart(%v, %ds) = %v, want %v", tc.instant, tc.windowSeconds, got, tc.want)
+		})
+	}
+}
+
+// TestWindowStart_WithinWindowConverges proves the determinism
+// contract: any two timestamps inside the same window land on the
+// exact same boundary. Two proxy nodes serving requests 7s apart
+// must agree on which counter row to upsert.
+func TestWindowStart_WithinWindowConverges(t *testing.T) {
+	t1 := time.Date(2026, 5, 6, 14, 0, 0, 0, time.UTC)
+	t2 := t1.Add(7 * time.Second)
+	t3 := t1.Add(59*time.Minute + 59*time.Second)
+
+	a := WindowStart(t1, 3600)
+	b := WindowStart(t2, 3600)
+	c := WindowStart(t3, 3600)
+
+	assert.True(t, a.Equal(b), "two timestamps 7s apart in the same 1h window must align to the same boundary")
+	assert.True(t, a.Equal(c), "the very last second of a 1h window still lands on the SAME bucket as the first second")
+}
+
+// TestWindowStart_AcrossWindowsDiverges is the symmetric guarantee:
+// two timestamps separated by a window's worth of time MUST land on
+// different boundaries. Without this, a 24h window's "rollover"
+// would never reset the counter.
+func TestWindowStart_AcrossWindowsDiverges(t *testing.T) {
+	t1 := time.Date(2026, 5, 6, 23, 59, 59, 0, time.UTC)
+	t2 := t1.Add(2 * time.Second) // 2026-05-07 00:00:01
+
+	a := WindowStart(t1, 86_400)
+	b := WindowStart(t2, 86_400)
+	assert.False(t, a.Equal(b),
+		"timestamps straddling a 24h-window boundary must land on different buckets — otherwise daily caps never reset")
+}
+
+// TestWindowStart_DifferentWindowsHaveDifferentBuckets locks the
+// design fork "two policies with different window_seconds on the same
+// group produce independent counters". A 24h boundary at noon is NOT
+// the same as the 30d boundary that contains it.
+func TestWindowStart_DifferentWindowsHaveDifferentBuckets(t *testing.T) {
+	now := time.Date(2026, 5, 6, 12, 0, 0, 0, time.UTC)
+	short := WindowStart(now, 86_400)
+	long := WindowStart(now, 2_592_000)
+	assert.False(t, short.Equal(long),
+		"the 24h bucket and 30d bucket containing the same instant must differ — independent counters require independent keys")
+}
+
+// TestWindowStart_SubMinuteAndMinuteAlignment locks sub-hour windows.
+// A 5-minute window must align to multiples of 300s from the unix
+// epoch — minute marks 0/5/10/.../55 within an hour, deterministic
+// across nodes regardless of clock drift.
+func TestWindowStart_SubMinuteAndMinuteAlignment(t *testing.T) {
+	t1 := time.Date(2026, 5, 6, 14, 12, 30, 0, time.UTC)
+	t2 := time.Date(2026, 5, 6, 14, 14, 59, 0, time.UTC)
+	t3 := time.Date(2026, 5, 6, 14, 15, 0, 0, time.UTC)
+
+	a := WindowStart(t1, 300)
+	b := WindowStart(t2, 300)
+	c := WindowStart(t3, 300)
+
+	assert.True(t, a.Equal(b),
+		"14:12:30 and 14:14:59 fall in the same 5m bucket starting at 14:10:00")
+	assert.True(t, a.Equal(time.Date(2026, 5, 6, 14, 10, 0, 0, time.UTC)),
+		"5m bucket containing 14:12 starts at 14:10 — aligned to multiples of 300s from unix epoch")
+	assert.False(t, a.Equal(c),
+		"14:15:00 is the start of the next 5m bucket — must not fold into the previous one")
+}
+
+// TestWindowStart_ZeroWindowReturnsInputUTC covers the defensive
+// path: caller hands a zero / negative window (shouldn't happen, but
+// might mid-refactor). The function returns the input as UTC rather
+// than dividing by zero.
+func TestWindowStart_ZeroWindowReturnsInputUTC(t *testing.T) {
+	now := time.Date(2026, 5, 6, 12, 30, 45, 0, time.FixedZone("CEST", 2*3600))
+	got := WindowStart(now, 0)
+	assert.True(t, got.Equal(now.UTC()), "zero window must not panic — return input as UTC")
+}
diff --git a/management/internals/modules/agentnetwork/types/guardrail.go b/management/internals/modules/agentnetwork/types/guardrail.go
new file mode 100644
index 000000000..12edd815c
--- /dev/null
+++ b/management/internals/modules/agentnetwork/types/guardrail.go
@@ -0,0 +1,120 @@
+package types
+
+import (
+	"time"
+
+	"github.com/rs/xid"
+
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// GuardrailChecks is the configurable parameter set persisted with each
+// guardrail. Stored as a JSON blob to keep the table flat.
+type GuardrailChecks struct {
+	ModelAllowlist GuardrailModelAllowlist `json:"model_allowlist"`
+	PromptCapture  GuardrailPromptCapture  `json:"prompt_capture"`
+}
+
+type GuardrailModelAllowlist struct {
+	Enabled bool     `json:"enabled"`
+	Models  []string `json:"models"`
+}
+
+type GuardrailPromptCapture struct {
+	Enabled   bool `json:"enabled"`
+	RedactPii bool `json:"redact_pii"`
+}
+
+// Guardrail is an Agent Network reusable guardrail set persisted per account.
+type Guardrail struct {
+	ID          string `gorm:"primaryKey"`
+	AccountID   string `gorm:"index"`
+	Name        string
+	Description string
+	Checks      GuardrailChecks `gorm:"serializer:json"`
+	CreatedAt   time.Time
+	UpdatedAt   time.Time
+}
+
+// TableName uses an explicit name so guardrail rows live in their own
+// table.
+func (Guardrail) TableName() string { return "agent_network_guardrails" }
+
+// NewGuardrail returns a new Guardrail with a freshly minted ID.
+func NewGuardrail(accountID string) *Guardrail {
+	now := time.Now().UTC()
+	return &Guardrail{
+		ID:        "ainguard_" + xid.New().String(),
+		AccountID: accountID,
+		Checks:    GuardrailChecks{ModelAllowlist: GuardrailModelAllowlist{Models: []string{}}},
+		CreatedAt: now,
+		UpdatedAt: now,
+	}
+}
+
+// FromAPIRequest applies the request payload onto the receiver.
+func (g *Guardrail) FromAPIRequest(req *api.AgentNetworkGuardrailRequest) {
+	g.Name = req.Name
+	if req.Description != nil {
+		g.Description = *req.Description
+	}
+	g.Checks = checksFromAPI(req.Checks)
+}
+
+// ToAPIResponse renders the guardrail as the API representation.
+func (g *Guardrail) ToAPIResponse() *api.AgentNetworkGuardrail {
+	created := g.CreatedAt
+	updated := g.UpdatedAt
+	return &api.AgentNetworkGuardrail{
+		Id:          g.ID,
+		Name:        g.Name,
+		Description: g.Description,
+		Checks:      checksToAPI(g.Checks),
+		CreatedAt:   &created,
+		UpdatedAt:   &updated,
+	}
+}
+
+// Copy returns a deep copy of the guardrail.
+func (g *Guardrail) Copy() *Guardrail {
+	clone := *g
+	if g.Checks.ModelAllowlist.Models != nil {
+		clone.Checks.ModelAllowlist.Models = append([]string(nil), g.Checks.ModelAllowlist.Models...)
+	}
+	return &clone
+}
+
+// EventMeta is the audit-log payload for activity events.
+func (g *Guardrail) EventMeta() map[string]any {
+	return map[string]any{"name": g.Name}
+}
+
+func checksFromAPI(c api.AgentNetworkGuardrailChecks) GuardrailChecks {
+	models := append([]string(nil), c.ModelAllowlist.Models...)
+	if models == nil {
+		models = []string{}
+	}
+	return GuardrailChecks{
+		ModelAllowlist: GuardrailModelAllowlist{
+			Enabled: c.ModelAllowlist.Enabled,
+			Models:  models,
+		},
+		PromptCapture: GuardrailPromptCapture{
+			Enabled:   c.PromptCapture.Enabled,
+			RedactPii: c.PromptCapture.RedactPii,
+		},
+	}
+}
+
+func checksToAPI(c GuardrailChecks) api.AgentNetworkGuardrailChecks {
+	models := c.ModelAllowlist.Models
+	if models == nil {
+		models = []string{}
+	}
+	out := api.AgentNetworkGuardrailChecks{}
+	out.ModelAllowlist.Enabled = c.ModelAllowlist.Enabled
+	out.ModelAllowlist.Models = models
+	out.PromptCapture.Enabled = c.PromptCapture.Enabled
+	out.PromptCapture.RedactPii = c.PromptCapture.RedactPii
+	return out
+}
diff --git a/management/internals/modules/agentnetwork/types/policy.go b/management/internals/modules/agentnetwork/types/policy.go
new file mode 100644
index 000000000..709b8149d
--- /dev/null
+++ b/management/internals/modules/agentnetwork/types/policy.go
@@ -0,0 +1,192 @@
+package types
+
+import (
+	"time"
+
+	"github.com/rs/xid"
+
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// Policy is an Agent Network policy persisted per account. A policy
+// authorises members of SourceGroups to reach the listed
+// DestinationProviderIDs under the attached GuardrailIDs and Limits.
+//
+// Token and budget limits live on the Policy itself (Limits field);
+// guardrails carry only model allowlist and prompt capture.
+type Policy struct {
+	ID                     string `gorm:"primaryKey"`
+	AccountID              string `gorm:"index"`
+	Name                   string
+	Description            string
+	Enabled                bool
+	SourceGroups           []string     `gorm:"serializer:json;column:source_groups"`
+	DestinationProviderIDs []string     `gorm:"serializer:json;column:destination_provider_ids"`
+	GuardrailIDs           []string     `gorm:"serializer:json;column:guardrail_ids"`
+	Limits                 PolicyLimits `gorm:"serializer:json;column:limits"`
+
+	CreatedAt time.Time
+	UpdatedAt time.Time
+}
+
+// PolicyLimits aggregates the token and budget caps attached directly
+// to a policy. Both halves are always present; their Enabled flags
+// control whether the proxy enforces them.
+type PolicyLimits struct {
+	TokenLimit  PolicyTokenLimit  `json:"token_limit"`
+	BudgetLimit PolicyBudgetLimit `json:"budget_limit"`
+}
+
+// PolicyTokenLimit is a token-count cap evaluated over an aligned
+// window of WindowSeconds seconds. GroupCap is applied to each
+// source group independently — every group in the policy's
+// SourceGroups gets its own bucket of GroupCap tokens. UserCap
+// applies independently to each individual user. A zero cap means
+// uncapped. WindowSeconds must be at least 60 (one minute) when the
+// limit is enabled.
+type PolicyTokenLimit struct {
+	Enabled       bool  `json:"enabled"`
+	GroupCap      int64 `json:"group_cap"`
+	UserCap       int64 `json:"user_cap"`
+	WindowSeconds int64 `json:"window_seconds"`
+}
+
+// PolicyBudgetLimit is a USD spend cap evaluated over an aligned
+// window of WindowSeconds seconds. GroupCapUsd is applied to each
+// source group independently — every group in the policy's
+// SourceGroups gets its own bucket of GroupCapUsd USD. UserCapUsd
+// applies independently to each individual user. A zero cap means
+// uncapped. WindowSeconds must be at least 60 (one minute) when the
+// limit is enabled.
+type PolicyBudgetLimit struct {
+	Enabled       bool    `json:"enabled"`
+	GroupCapUsd   float64 `json:"group_cap_usd"`
+	UserCapUsd    float64 `json:"user_cap_usd"`
+	WindowSeconds int64   `json:"window_seconds"`
+}
+
+// TableName forces a unique GORM table to avoid collision with the access
+// control Policy type, which also resolves to "policies" by default.
+func (Policy) TableName() string { return "agent_network_policies" }
+
+// NewPolicy returns a new Policy with a freshly minted ID.
+func NewPolicy(accountID string) *Policy {
+	now := time.Now().UTC()
+	return &Policy{
+		ID:        "ainpol_" + xid.New().String(),
+		AccountID: accountID,
+		Enabled:   true,
+		CreatedAt: now,
+		UpdatedAt: now,
+	}
+}
+
+// FromAPIRequest applies the request payload onto the receiver.
+func (p *Policy) FromAPIRequest(req *api.AgentNetworkPolicyRequest) {
+	p.Name = req.Name
+	if req.Description != nil {
+		p.Description = *req.Description
+	}
+	if req.Enabled != nil {
+		p.Enabled = *req.Enabled
+	}
+	p.SourceGroups = append([]string(nil), req.SourceGroups...)
+	p.DestinationProviderIDs = append([]string(nil), req.DestinationProviderIds...)
+	if req.GuardrailIds != nil {
+		p.GuardrailIDs = append([]string(nil), (*req.GuardrailIds)...)
+	} else {
+		p.GuardrailIDs = []string{}
+	}
+	if req.Limits != nil {
+		p.Limits = limitsFromAPI(*req.Limits)
+	} else {
+		p.Limits = PolicyLimits{}
+	}
+}
+
+// ToAPIResponse renders the policy as the API representation.
+func (p *Policy) ToAPIResponse() *api.AgentNetworkPolicy {
+	src := p.SourceGroups
+	if src == nil {
+		src = []string{}
+	}
+	dst := p.DestinationProviderIDs
+	if dst == nil {
+		dst = []string{}
+	}
+	guardrails := p.GuardrailIDs
+	if guardrails == nil {
+		guardrails = []string{}
+	}
+	created := p.CreatedAt
+	updated := p.UpdatedAt
+	return &api.AgentNetworkPolicy{
+		Id:                     p.ID,
+		Name:                   p.Name,
+		Description:            p.Description,
+		Enabled:                p.Enabled,
+		SourceGroups:           src,
+		DestinationProviderIds: dst,
+		GuardrailIds:           guardrails,
+		Limits:                 limitsToAPI(p.Limits),
+		CreatedAt:              &created,
+		UpdatedAt:              &updated,
+	}
+}
+
+// Copy returns a deep copy of the policy.
+func (p *Policy) Copy() *Policy {
+	clone := *p
+	if p.SourceGroups != nil {
+		clone.SourceGroups = append([]string(nil), p.SourceGroups...)
+	}
+	if p.DestinationProviderIDs != nil {
+		clone.DestinationProviderIDs = append([]string(nil), p.DestinationProviderIDs...)
+	}
+	if p.GuardrailIDs != nil {
+		clone.GuardrailIDs = append([]string(nil), p.GuardrailIDs...)
+	}
+	return &clone
+}
+
+// EventMeta is the audit-log payload for activity events.
+func (p *Policy) EventMeta() map[string]any {
+	return map[string]any{
+		"name":    p.Name,
+		"enabled": p.Enabled,
+	}
+}
+
+func limitsFromAPI(in api.AgentNetworkPolicyLimits) PolicyLimits {
+	return PolicyLimits{
+		TokenLimit: PolicyTokenLimit{
+			Enabled:       in.TokenLimit.Enabled,
+			GroupCap:      in.TokenLimit.GroupCap,
+			UserCap:       in.TokenLimit.UserCap,
+			WindowSeconds: in.TokenLimit.WindowSeconds,
+		},
+		BudgetLimit: PolicyBudgetLimit{
+			Enabled:       in.BudgetLimit.Enabled,
+			GroupCapUsd:   in.BudgetLimit.GroupCapUsd,
+			UserCapUsd:    in.BudgetLimit.UserCapUsd,
+			WindowSeconds: in.BudgetLimit.WindowSeconds,
+		},
+	}
+}
+
+func limitsToAPI(in PolicyLimits) api.AgentNetworkPolicyLimits {
+	return api.AgentNetworkPolicyLimits{
+		TokenLimit: api.AgentNetworkPolicyTokenLimit{
+			Enabled:       in.TokenLimit.Enabled,
+			GroupCap:      in.TokenLimit.GroupCap,
+			UserCap:       in.TokenLimit.UserCap,
+			WindowSeconds: in.TokenLimit.WindowSeconds,
+		},
+		BudgetLimit: api.AgentNetworkPolicyBudgetLimit{
+			Enabled:       in.BudgetLimit.Enabled,
+			GroupCapUsd:   in.BudgetLimit.GroupCapUsd,
+			UserCapUsd:    in.BudgetLimit.UserCapUsd,
+			WindowSeconds: in.BudgetLimit.WindowSeconds,
+		},
+	}
+}
diff --git a/management/internals/modules/agentnetwork/types/provider.go b/management/internals/modules/agentnetwork/types/provider.go
new file mode 100644
index 000000000..28c8a94e2
--- /dev/null
+++ b/management/internals/modules/agentnetwork/types/provider.go
@@ -0,0 +1,252 @@
+package types
+
+import (
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/rs/xid"
+
+	"github.com/netbirdio/netbird/shared/management/http/api"
+	"github.com/netbirdio/netbird/util/crypt"
+)
+
+// ProviderModel is one row in the provider's models list. The operator
+// pins the per-1k input/output price for cost tracking; ID is the
+// model identifier the upstream provider expects on the wire.
+type ProviderModel struct {
+	ID          string  `json:"id"`
+	InputPer1k  float64 `json:"input_per_1k"`
+	OutputPer1k float64 `json:"output_per_1k"`
+}
+
+// Provider is an Agent Network AI provider record persisted per account.
+// The proxy cluster fronting the account lives on the per-account
+// agent-network Settings row, not on the Provider — every provider in
+// an account routes through the same cluster.
+type Provider struct {
+	ID         string `gorm:"primaryKey"`
+	AccountID  string `gorm:"index"`
+	ProviderID string `gorm:"index:idx_agent_network_provider"`
+	Name       string
+	// UpstreamURL is the full upstream URL (e.g. https://api.openai.com)
+	// the operator selected.
+	UpstreamURL string `gorm:"column:upstream_url"`
+	APIKey      string `gorm:"column:api_key"`
+	// ExtraValues holds operator-typed values for catalog-declared
+	// ExtraHeaders (see catalog.Provider.ExtraHeaders). Keyed by
+	// header name (e.g. "x-portkey-config"); a non-empty value is
+	// stamped on every upstream request to this provider via the
+	// proxy's identity-inject middleware (anti-spoof Remove + Add).
+	// Empty / missing keys = no header stamped. Stored as a JSON
+	// blob so the schema doesn't grow per-catalog-entry.
+	ExtraValues map[string]string `gorm:"serializer:json;column:extra_values"`
+	// Models is the operator's curated list of models exposed by this
+	// provider together with their per-1k input/output prices (USD).
+	// Empty means all catalog models are allowed at catalog prices.
+	Models  []ProviderModel `gorm:"serializer:json"`
+	Enabled bool
+	// SessionPrivateKey + SessionPublicKey are the ed25519 keypair the
+	// synthesised reverse-proxy service uses to sign / verify session
+	// JWTs after a successful OIDC handshake. Generated once on
+	// provider create and never rotated by the manager so existing
+	// session cookies survive provider edits. SessionPrivateKey is
+	// encrypted at rest via EncryptSensitiveData /
+	// DecryptSensitiveData; SessionPublicKey is plain.
+	SessionPrivateKey string `gorm:"column:session_private_key"`
+	SessionPublicKey  string `gorm:"column:session_public_key"`
+	// IdentityHeaderUserID + IdentityHeaderGroups are the operator-
+	// chosen wire header names for HeaderPair-style identity
+	// injection on catalog entries that flag the shape as
+	// Customizable (e.g. Bifrost, where the operator picks between
+	// the always-on x-bf-lh- log-metadata family and the
+	// label-declared x-bf-dim- telemetry family). Empty value
+	// disables stamping for that dimension; the inject middleware
+	// already no-ops on empty header names. Catalog entries with
+	// Customizable=false ignore these fields and use the static
+	// header names defined in their HeaderPairInjection block.
+	IdentityHeaderUserID string `gorm:"column:identity_header_user_id"`
+	IdentityHeaderGroups string `gorm:"column:identity_header_groups"`
+	CreatedAt            time.Time
+	UpdatedAt            time.Time
+}
+
+// TableName uses an explicit name so the Agent Network provider rows live
+// in their own table, separate from any future "providers"-named entity.
+func (Provider) TableName() string { return "agent_network_providers" }
+
+// NewProvider returns a new Provider with a freshly minted ID.
+func NewProvider(accountID string) *Provider {
+	now := time.Now().UTC()
+	return &Provider{
+		ID:        xid.New().String(),
+		AccountID: accountID,
+		CreatedAt: now,
+		UpdatedAt: now,
+	}
+}
+
+// FromAPIRequest applies the request payload onto the receiver. The api_key
+// is only overwritten when the caller provided one — empty/nil leaves the
+// existing key intact, so updates can omit it.
+func (p *Provider) FromAPIRequest(req *api.AgentNetworkProviderRequest) {
+	p.ProviderID = req.ProviderId
+	p.Name = req.Name
+	p.UpstreamURL = req.UpstreamUrl
+	if req.ApiKey != nil && strings.TrimSpace(*req.ApiKey) != "" {
+		p.APIKey = *req.ApiKey
+	}
+	if req.ExtraValues != nil {
+		// Replace the whole map (rather than merge) so unsetting a
+		// value on the dashboard actually clears it. Empty strings
+		// are dropped so we don't waste a row on no-op values.
+		next := make(map[string]string, len(*req.ExtraValues))
+		for k, v := range *req.ExtraValues {
+			v = strings.TrimSpace(v)
+			if v != "" {
+				next[k] = v
+			}
+		}
+		if len(next) == 0 {
+			p.ExtraValues = nil
+		} else {
+			p.ExtraValues = next
+		}
+	}
+	p.Models = p.Models[:0]
+	if req.Models != nil {
+		for _, m := range *req.Models {
+			p.Models = append(p.Models, ProviderModel{
+				ID:          m.Id,
+				InputPer1k:  m.InputPer1k,
+				OutputPer1k: m.OutputPer1k,
+			})
+		}
+	}
+	if p.Models == nil {
+		p.Models = []ProviderModel{}
+	}
+	if req.Enabled != nil {
+		p.Enabled = *req.Enabled
+	}
+	// Identity-header overrides for catalogs flagged Customizable.
+	// nil pointer = "field omitted on the wire" → leave the stored
+	// value untouched (per the openapi description). Empty string is
+	// an explicit clear that disables stamping for this dimension.
+	if req.IdentityHeaderUserId != nil {
+		p.IdentityHeaderUserID = strings.TrimSpace(*req.IdentityHeaderUserId)
+	}
+	if req.IdentityHeaderGroups != nil {
+		p.IdentityHeaderGroups = strings.TrimSpace(*req.IdentityHeaderGroups)
+	}
+}
+
+// ToAPIResponse renders the provider as the API representation. The API
+// key is intentionally never surfaced.
+func (p *Provider) ToAPIResponse() *api.AgentNetworkProvider {
+	models := make([]api.AgentNetworkProviderModel, 0, len(p.Models))
+	for _, m := range p.Models {
+		models = append(models, api.AgentNetworkProviderModel{
+			Id:          m.ID,
+			InputPer1k:  m.InputPer1k,
+			OutputPer1k: m.OutputPer1k,
+		})
+	}
+	created := p.CreatedAt
+	updated := p.UpdatedAt
+	resp := &api.AgentNetworkProvider{
+		Id:          p.ID,
+		ProviderId:  p.ProviderID,
+		Name:        p.Name,
+		UpstreamUrl: p.UpstreamURL,
+		Models:      models,
+		Enabled:     p.Enabled,
+		CreatedAt:   &created,
+		UpdatedAt:   &updated,
+	}
+	if len(p.ExtraValues) > 0 {
+		out := make(map[string]string, len(p.ExtraValues))
+		for k, v := range p.ExtraValues {
+			out[k] = v
+		}
+		resp.ExtraValues = &out
+	}
+	if p.IdentityHeaderUserID != "" {
+		v := p.IdentityHeaderUserID
+		resp.IdentityHeaderUserId = &v
+	}
+	if p.IdentityHeaderGroups != "" {
+		v := p.IdentityHeaderGroups
+		resp.IdentityHeaderGroups = &v
+	}
+	return resp
+}
+
+// Copy returns a deep copy of the provider.
+func (p *Provider) Copy() *Provider {
+	clone := *p
+	if p.Models != nil {
+		clone.Models = append([]ProviderModel(nil), p.Models...)
+	}
+	if p.ExtraValues != nil {
+		clone.ExtraValues = make(map[string]string, len(p.ExtraValues))
+		for k, v := range p.ExtraValues {
+			clone.ExtraValues[k] = v
+		}
+	}
+	return &clone
+}
+
+// EventMeta is the audit-log payload for activity events.
+func (p *Provider) EventMeta() map[string]any {
+	return map[string]any{
+		"name":        p.Name,
+		"provider_id": p.ProviderID,
+	}
+}
+
+// EncryptSensitiveData encrypts the upstream API key and the session
+// signing key in place.
+func (p *Provider) EncryptSensitiveData(enc *crypt.FieldEncrypt) error {
+	if enc == nil {
+		return nil
+	}
+	if p.APIKey != "" {
+		encrypted, err := enc.Encrypt(p.APIKey)
+		if err != nil {
+			return fmt.Errorf("encrypt agent network provider api key: %w", err)
+		}
+		p.APIKey = encrypted
+	}
+	if p.SessionPrivateKey != "" {
+		encrypted, err := enc.Encrypt(p.SessionPrivateKey)
+		if err != nil {
+			return fmt.Errorf("encrypt agent network provider session key: %w", err)
+		}
+		p.SessionPrivateKey = encrypted
+	}
+	return nil
+}
+
+// DecryptSensitiveData decrypts the upstream API key and the session
+// signing key in place.
+func (p *Provider) DecryptSensitiveData(enc *crypt.FieldEncrypt) error {
+	if enc == nil {
+		return nil
+	}
+	if p.APIKey != "" {
+		decrypted, err := enc.Decrypt(p.APIKey)
+		if err != nil {
+			return fmt.Errorf("decrypt agent network provider api key: %w", err)
+		}
+		p.APIKey = decrypted
+	}
+	if p.SessionPrivateKey != "" {
+		decrypted, err := enc.Decrypt(p.SessionPrivateKey)
+		if err != nil {
+			return fmt.Errorf("decrypt agent network provider session key: %w", err)
+		}
+		p.SessionPrivateKey = decrypted
+	}
+	return nil
+}
diff --git a/management/internals/modules/agentnetwork/types/settings.go b/management/internals/modules/agentnetwork/types/settings.go
new file mode 100644
index 000000000..d61d9deff
--- /dev/null
+++ b/management/internals/modules/agentnetwork/types/settings.go
@@ -0,0 +1,78 @@
+package types
+
+import (
+	"time"
+
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// DefaultAccessLogRetentionDays is the retention applied to new accounts'
+// agent-network access logs. Usage records are not subject to this — they are
+// the long-term aggregate and are retained independently.
+const DefaultAccessLogRetentionDays = 30
+
+// Settings is the per-account agent-network configuration row. One
+// row per account. Cluster + Subdomain are immutable once written and
+// produce the public endpoint agents call (`<subdomain>.<cluster>`).
+type Settings struct {
+	AccountID string `gorm:"primaryKey"`
+	Cluster   string
+	Subdomain string `gorm:"index:idx_agent_network_settings_cluster_subdomain"`
+
+	// Account-level collection controls sourced by the synthesizer.
+	// EnableLogCollection gates the per-request access-log trail and defaults
+	// ON for new accounts. EnablePromptCollection is the master gate for
+	// request/response prompt capture (AND-gated with the policy-level
+	// guardrail). RedactPii enables PII redaction on captured prompts;
+	// effective redaction is account OR policy.
+	EnableLogCollection    bool
+	EnablePromptCollection bool
+	RedactPii              bool
+
+	// AccessLogRetentionDays bounds how long full access-log rows are kept; a
+	// periodic sweep deletes older rows. <= 0 means keep indefinitely. Usage
+	// records are unaffected.
+	AccessLogRetentionDays int
+
+	CreatedAt time.Time
+	UpdatedAt time.Time
+}
+
+// TableName puts the rows in their own table to keep the agent-network
+// schema cohesive.
+func (Settings) TableName() string { return "agent_network_settings" }
+
+// Endpoint returns the bare hostname agents reach this account at:
+// `<subdomain>.<cluster>`.
+func (s *Settings) Endpoint() string {
+	return s.Subdomain + "." + s.Cluster
+}
+
+// ToAPIResponse renders the settings as the API representation.
+func (s *Settings) ToAPIResponse() *api.AgentNetworkSettings {
+	created := s.CreatedAt
+	updated := s.UpdatedAt
+	retention := s.AccessLogRetentionDays
+	return &api.AgentNetworkSettings{
+		Cluster:                s.Cluster,
+		Subdomain:              s.Subdomain,
+		Endpoint:               s.Endpoint(),
+		EnableLogCollection:    s.EnableLogCollection,
+		EnablePromptCollection: s.EnablePromptCollection,
+		RedactPii:              s.RedactPii,
+		AccessLogRetentionDays: &retention,
+		CreatedAt:              &created,
+		UpdatedAt:              &updated,
+	}
+}
+
+// FromAPIRequest applies the mutable settings fields from the request. Cluster
+// and Subdomain are immutable and intentionally not touched here.
+func (s *Settings) FromAPIRequest(req *api.AgentNetworkSettingsRequest) {
+	s.EnableLogCollection = req.EnableLogCollection
+	s.EnablePromptCollection = req.EnablePromptCollection
+	s.RedactPii = req.RedactPii
+	if req.AccessLogRetentionDays != nil {
+		s.AccessLogRetentionDays = *req.AccessLogRetentionDays
+	}
+}
diff --git a/management/internals/modules/agentnetwork/types/usage.go b/management/internals/modules/agentnetwork/types/usage.go
new file mode 100644
index 000000000..dd01d4300
--- /dev/null
+++ b/management/internals/modules/agentnetwork/types/usage.go
@@ -0,0 +1,47 @@
+package types
+
+import (
+	"time"
+)
+
+// AgentNetworkUsage is the stripped, always-collected per-request usage record
+// powering the Usage overview. Unlike AgentNetworkAccessLog it carries no
+// request detail (host/path/source IP/prompt) — only the dimensions needed to
+// aggregate and filter spend by user / group / provider / model over time.
+//
+// It is written unconditionally on every served agent-network request,
+// independent of the account's EnableLogCollection toggle: when log collection
+// is off the proxy ships a stripped, usage-only entry and management still
+// records the usage row (but skips the full AgentNetworkAccessLog row).
+type AgentNetworkUsage struct {
+	ID                 string    `gorm:"primaryKey"`
+	AccountID          string    `gorm:"index"`
+	Timestamp          time.Time `gorm:"index"`
+	UserID             string    `gorm:"index"`
+	ResolvedProviderID string    `gorm:"index"`
+	Provider           string    // vendor, e.g. "openai"
+	Model              string    `gorm:"index"`
+	SessionID          string    `gorm:"index"` // llm.session_id — groups a conversation / coding session
+	InputTokens        int64
+	OutputTokens       int64
+	TotalTokens        int64
+	CostUSD            float64
+	CreatedAt          time.Time
+}
+
+// TableName keeps usage records in their own stripped table. Named
+// distinctly (…_request_usage) to avoid colliding with any pre-existing
+// agent_network_usage table in a shared database.
+func (AgentNetworkUsage) TableName() string { return "agent_network_request_usage" }
+
+// AgentNetworkUsageGroup is the normalised many-to-many row linking a usage
+// record to one authorising group, mirroring AgentNetworkAccessLogGroup so the
+// usage overview can filter by group with a `group_id IN (...)` join.
+type AgentNetworkUsageGroup struct {
+	UsageID   string `gorm:"primaryKey"`
+	GroupID   string `gorm:"primaryKey;index"`
+	AccountID string `gorm:"index"`
+}
+
+// TableName names the usage group child table.
+func (AgentNetworkUsageGroup) TableName() string { return "agent_network_request_usage_group" }
diff --git a/management/internals/modules/agentnetwork/types/usageoverview.go b/management/internals/modules/agentnetwork/types/usageoverview.go
new file mode 100644
index 000000000..658832bec
--- /dev/null
+++ b/management/internals/modules/agentnetwork/types/usageoverview.go
@@ -0,0 +1,96 @@
+package types
+
+import (
+	"sort"
+	"time"
+
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// UsageGranularity is the time-bucket width for the usage overview. New values
+// can be added here and handled in bucketStart without touching the store.
+type UsageGranularity string
+
+const (
+	UsageGranularityDay   UsageGranularity = "day"
+	UsageGranularityWeek  UsageGranularity = "week"
+	UsageGranularityMonth UsageGranularity = "month"
+)
+
+// ParseUsageGranularity maps the API query value to a granularity, defaulting
+// to day for empty/unknown input.
+func ParseUsageGranularity(s string) UsageGranularity {
+	switch UsageGranularity(s) {
+	case UsageGranularityWeek:
+		return UsageGranularityWeek
+	case UsageGranularityMonth:
+		return UsageGranularityMonth
+	default:
+		return UsageGranularityDay
+	}
+}
+
+// AgentNetworkUsageBucket is one aggregated usage time bucket. PeriodStart is
+// the UTC start of the bucket as YYYY-MM-DD.
+type AgentNetworkUsageBucket struct {
+	PeriodStart  string
+	InputTokens  int64
+	OutputTokens int64
+	TotalTokens  int64
+	CostUSD      float64
+}
+
+// ToAPIResponse renders the bucket as the API representation.
+func (b *AgentNetworkUsageBucket) ToAPIResponse() api.AgentNetworkUsageBucket {
+	return api.AgentNetworkUsageBucket{
+		PeriodStart:  b.PeriodStart,
+		InputTokens:  b.InputTokens,
+		OutputTokens: b.OutputTokens,
+		TotalTokens:  b.TotalTokens,
+		CostUsd:      b.CostUSD,
+	}
+}
+
+// bucketStart truncates t (in UTC) to the start of its bucket for the given
+// granularity. Week buckets start on Monday (ISO week).
+func bucketStart(t time.Time, g UsageGranularity) time.Time {
+	t = t.UTC()
+	switch g {
+	case UsageGranularityWeek:
+		// Monday-start week. time.Weekday: Sunday=0..Saturday=6.
+		offset := (int(t.Weekday()) + 6) % 7
+		day := time.Date(t.Year(), t.Month(), t.Day(), 0, 0, 0, 0, time.UTC)
+		return day.AddDate(0, 0, -offset)
+	case UsageGranularityMonth:
+		return time.Date(t.Year(), t.Month(), 1, 0, 0, 0, 0, time.UTC)
+	default: // day
+		return time.Date(t.Year(), t.Month(), t.Day(), 0, 0, 0, 0, time.UTC)
+	}
+}
+
+// AggregateUsageByGranularity buckets the usage rows by the requested
+// granularity and returns the buckets ordered oldest-first. Aggregation is done
+// in Go (rather than per-engine SQL date_trunc) so granularities stay portable
+// across SQLite/Postgres/MySQL and easy to extend.
+func AggregateUsageByGranularity(rows []*AgentNetworkUsage, g UsageGranularity) []*AgentNetworkUsageBucket {
+	byPeriod := make(map[string]*AgentNetworkUsageBucket)
+	for _, r := range rows {
+		key := bucketStart(r.Timestamp, g).Format("2006-01-02")
+		b := byPeriod[key]
+		if b == nil {
+			b = &AgentNetworkUsageBucket{PeriodStart: key}
+			byPeriod[key] = b
+		}
+		b.InputTokens += r.InputTokens
+		b.OutputTokens += r.OutputTokens
+		b.TotalTokens += r.TotalTokens
+		b.CostUSD += r.CostUSD
+	}
+
+	out := make([]*AgentNetworkUsageBucket, 0, len(byPeriod))
+	for _, b := range byPeriod {
+		out = append(out, b)
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].PeriodStart < out[j].PeriodStart })
+	return out
+}
diff --git a/management/internals/modules/agentnetwork/wire_shape_test.go b/management/internals/modules/agentnetwork/wire_shape_test.go
new file mode 100644
index 000000000..b574ab3e1
--- /dev/null
+++ b/management/internals/modules/agentnetwork/wire_shape_test.go
@@ -0,0 +1,109 @@
+package agentnetwork
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	"github.com/golang/mock/gomock"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// TestSynthesizedService_WireShape locks down the proto shape that
+// flows from the synthesizer through ToProtoMapping to the proxy.
+// Drift between this test and what the proxy expects manifests as
+// "service not matching" — the proxy receives a mapping but can't
+// register an SNI/HTTP route from it.
+func TestSynthesizedService_WireShape(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	provider := newSynthTestProvider()
+	policy := newSynthTestPolicy(provider.ID, "grp-eng", "")
+
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
+		[]*types.Provider{provider},
+		[]*types.Policy{policy},
+		[]*types.Guardrail{})
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1)
+
+	svc := services[0]
+	mapping := svc.ToProtoMapping(rpservice.Create, "test-token", proxy.OIDCValidationConfig{})
+
+	// Identifiers — account-scoped service ID, settings-derived domain.
+	assert.Equal(t, "agent-net-svc-acct-1", mapping.GetId(), "stable account-scoped virtual service ID")
+	assert.Equal(t, testAccountID, mapping.GetAccountId(), "account id round-trips")
+	assert.Equal(t, testEndpoint, mapping.GetDomain(), "domain matches settings.Endpoint() output")
+
+	// Mode + listen port — addMapping at proxy/server.go switches on Mode.
+	assert.Equal(t, "http", mapping.GetMode(), "synthesised services are HTTP mode")
+	assert.Equal(t, int32(0), mapping.GetListenPort(), "no custom listen port for HTTP services")
+
+	// Auth token + private/tunnel shape: agent-network endpoints authenticate
+	// inbound agents via ValidateTunnelPeer against AccessGroups, not OIDC.
+	assert.Equal(t, "test-token", mapping.GetAuthToken(), "auth token round-trips for proxy CreateProxyPeer")
+	assert.True(t, mapping.GetPrivate(), "synthesised services are private (tunnel-peer auth via AccessGroups)")
+	require.NotNil(t, mapping.GetAuth(), "auth payload carries the session key")
+	assert.False(t, mapping.GetAuth().GetOidc(), "OIDC is off for tunnel-auth agent-network services")
+
+	// Path mappings — proxy/server.go::setupHTTPMapping early-returns when
+	// len(mapping.GetPath()) == 0, so this is a critical assertion.
+	require.Len(t, mapping.GetPath(), 1, "exactly one path mapping for the cluster target")
+	pm := mapping.GetPath()[0]
+	assert.Equal(t, "/", pm.GetPath(), "default path is '/'")
+	assert.Equal(t, "https://noop.invalid/", pm.GetTarget(),
+		"target URL is the placeholder; the router middleware rewrites it per request")
+	require.NotNil(t, pm.GetOptions(), "target options must be populated so direct_upstream + middleware chain reach the proxy")
+	assert.True(t, pm.GetOptions().GetDirectUpstream(), "synth targets imply direct_upstream so the proxy dials via the host stack")
+	assert.True(t, pm.GetOptions().GetAgentNetwork(), "agent_network flag must travel on the wire so the proxy can tag access logs")
+
+	mws := pm.GetOptions().GetMiddlewares()
+	require.Len(t, mws, 8, "eight middlewares reach the proxy: request_parser, router, limit_check, identity_inject, guardrail, limit_record, cost_meter, response_parser")
+
+	assert.Equal(t, middlewareIDLLMRequestParser, mws[0].GetId(), "first middleware id")
+	assert.Equal(t, proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST, mws[0].GetSlot(), "request parser slot")
+
+	assert.Equal(t, middlewareIDLLMRouter, mws[1].GetId(), "second middleware id")
+	assert.Equal(t, proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST, mws[1].GetSlot(), "router slot")
+	require.NotEmpty(t, mws[1].GetConfigJson(), "router config must travel on the wire")
+	var routerCfg routerConfig
+	require.NoError(t, json.Unmarshal(mws[1].GetConfigJson(), &routerCfg), "router config decodes")
+	require.Len(t, routerCfg.Providers, 1, "the only enabled provider reaches the router")
+	assert.Equal(t, provider.ID, routerCfg.Providers[0].ID, "router provider id matches synth provider")
+	assert.Equal(t, "Bearer sk-test-key", routerCfg.Providers[0].AuthHeaderValue,
+		"openai catalog template substitutes the API key on the wire")
+
+	assert.Equal(t, middlewareIDLLMLimitCheck, mws[2].GetId(),
+		"limit_check runs after the router so the resolved provider id is available, before identity_inject so a deny doesn't pay the header-stamp cost")
+	assert.Equal(t, proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST, mws[2].GetSlot())
+
+	assert.Equal(t, middlewareIDLLMIdentityInject, mws[3].GetId(), "fourth middleware id")
+	assert.Equal(t, proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST, mws[3].GetSlot(), "identity inject slot")
+	require.NotEmpty(t, mws[3].GetConfigJson(), "identity inject config JSON must travel on the wire")
+
+	assert.Equal(t, middlewareIDLLMGuardrail, mws[4].GetId(), "fifth middleware id")
+	assert.Equal(t, proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST, mws[4].GetSlot(), "guardrail slot")
+	require.NotEmpty(t, mws[4].GetConfigJson(), "guardrail middleware config JSON must travel on the wire")
+
+	assert.Equal(t, middlewareIDLLMLimitRecord, mws[5].GetId(),
+		"limit_record sits FIRST in the response section so it RUNS LAST at runtime — slot order on the response leg is reverse-of-slice")
+	assert.Equal(t, proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_RESPONSE, mws[5].GetSlot())
+
+	assert.Equal(t, middlewareIDCostMeter, mws[6].GetId(), "seventh middleware id")
+	assert.Equal(t, proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_RESPONSE, mws[6].GetSlot(), "cost meter slot")
+
+	assert.Equal(t, middlewareIDLLMResponseParser, mws[7].GetId(), "eighth middleware id")
+	assert.Equal(t, proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_RESPONSE, mws[7].GetSlot(), "response parser slot")
+}
diff --git a/management/internals/modules/peers/manager.go b/management/internals/modules/peers/manager.go
index e22d1e6e0..239d6b09c 100644
--- a/management/internals/modules/peers/manager.go
+++ b/management/internals/modules/peers/manager.go
@@ -220,12 +220,36 @@ func (m *managerImpl) GetPeerID(ctx context.Context, peerKey string) (string, er
 func (m *managerImpl) CreateProxyPeer(ctx context.Context, accountID string, peerKey string, cluster string) error {
 	existingPeerID, err := m.store.GetPeerIDByKey(ctx, store.LockingStrengthNone, peerKey)
 	if err == nil && existingPeerID != "" {
-		// Peer already exists
+		// Same pubkey already registered — idempotent.
 		return nil
 	}
 
+	// Dedupe stale embedded peer records for the same (account, cluster).
+	// The proxy generates a fresh WireGuard keypair on every startup
+	// (proxy/internal/roundtrip/netbird.go), so without this sweep the
+	// prior embedded peer would linger forever — holding its CGNAT IP
+	// allocation, polluting other peers' rosters, and (most visibly)
+	// leaving the synth DNS pointing at the dead address. The
+	// (account, cluster) tuple identifies "the embedded peer for this
+	// proxy instance at this cluster"; any record matching that tuple
+	// with a different pubkey is by definition stale and must go.
+	staleIDs, err := m.findStaleEmbeddedProxyPeers(ctx, accountID, cluster, peerKey)
+	if err != nil {
+		return fmt.Errorf("scan for stale embedded proxy peers: %w", err)
+	}
+	if len(staleIDs) > 0 {
+		// userID="" + checkConnected=false: the deletion is initiated
+		// by management itself on behalf of the freshly-registering
+		// proxy, not by an end user; the stale peer may still be
+		// marked Connected from its prior session, but its session is
+		// dead by definition (its key no longer exists).
+		if err := m.DeletePeers(ctx, accountID, staleIDs, "", false); err != nil {
+			return fmt.Errorf("delete stale embedded proxy peers %v: %w", staleIDs, err)
+		}
+	}
+
 	name := fmt.Sprintf("proxy-%s", xid.New().String())
-	peer := &peer.Peer{
+	newPeer := &peer.Peer{
 		Ephemeral: true,
 		ProxyMeta: peer.ProxyMeta{
 			Cluster:  cluster,
@@ -242,10 +266,36 @@ func (m *managerImpl) CreateProxyPeer(ctx context.Context, accountID string, pee
 		},
 	}
 
-	_, _, _, _, err = m.accountManager.AddPeer(ctx, accountID, "", "", peer, true)
+	_, _, _, _, err = m.accountManager.AddPeer(ctx, accountID, "", "", newPeer, true)
 	if err != nil {
 		return fmt.Errorf("failed to create proxy peer: %w", err)
 	}
 
 	return nil
 }
+
+// findStaleEmbeddedProxyPeers returns the peer IDs of embedded proxy peer
+// records in accountID that target the same cluster but carry a different
+// WireGuard pubkey than the freshly-registering one. Used by CreateProxyPeer
+// to garbage-collect stale records left behind when the proxy restarts with a
+// regenerated keypair.
+func (m *managerImpl) findStaleEmbeddedProxyPeers(ctx context.Context, accountID, cluster, newKey string) ([]string, error) {
+	account, err := m.store.GetAccount(ctx, accountID)
+	if err != nil {
+		return nil, err
+	}
+	var stale []string
+	for _, p := range account.Peers {
+		if p == nil || !p.ProxyMeta.Embedded {
+			continue
+		}
+		if p.ProxyMeta.Cluster != cluster {
+			continue
+		}
+		if p.Key == newKey {
+			continue
+		}
+		stale = append(stale, p.ID)
+	}
+	return stale, nil
+}
diff --git a/management/internals/modules/reverseproxy/accesslogs/accesslogentry.go b/management/internals/modules/reverseproxy/accesslogs/accesslogentry.go
index f2ecfd5f9..6705eab1a 100644
--- a/management/internals/modules/reverseproxy/accesslogs/accesslogentry.go
+++ b/management/internals/modules/reverseproxy/accesslogs/accesslogentry.go
@@ -39,6 +39,10 @@ type AccessLogEntry struct {
 	BytesDownload   int64             `gorm:"index"`
 	Protocol        AccessLogProtocol `gorm:"index"`
 	Metadata        map[string]string `gorm:"serializer:json"`
+	// AgentNetwork marks the entry as emitted by a synthesised agent-network
+	// service. Sourced from proto.AccessLog.AgentNetwork the proxy stamps
+	// before shipping. Indexed so the agent-network log surface filters cheaply.
+	AgentNetwork bool `gorm:"index"`
 }
 
 // FromProto creates an AccessLogEntry from a proto.AccessLog
@@ -58,6 +62,7 @@ func (a *AccessLogEntry) FromProto(serviceLog *proto.AccessLog) {
 	a.BytesDownload = serviceLog.GetBytesDownload()
 	a.Protocol = AccessLogProtocol(serviceLog.GetProtocol())
 	a.Metadata = maps.Clone(serviceLog.GetMetadata())
+	a.AgentNetwork = serviceLog.GetAgentNetwork()
 
 	if sourceIP := serviceLog.GetSourceIp(); sourceIP != "" {
 		if addr, err := netip.ParseAddr(sourceIP); err == nil {
diff --git a/management/internals/modules/reverseproxy/accesslogs/manager/manager.go b/management/internals/modules/reverseproxy/accesslogs/manager/manager.go
index ced2ec4d1..4b24adaa1 100644
--- a/management/internals/modules/reverseproxy/accesslogs/manager/manager.go
+++ b/management/internals/modules/reverseproxy/accesslogs/manager/manager.go
@@ -7,6 +7,7 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
 	"github.com/netbirdio/netbird/management/server/geolocation"
 	"github.com/netbirdio/netbird/management/server/permissions"
@@ -31,8 +32,14 @@ func NewManager(store store.Store, permissionsManager permissions.Manager, geo g
 	}
 }
 
-// SaveAccessLog saves an access log entry to the database after enriching it
+// SaveAccessLog saves an access log entry to the database after enriching it.
+// Agent-network entries are flattened into their own dedicated table (queryable
+// LLM columns + group child rows) instead of the shared reverse-proxy table.
 func (m *managerImpl) SaveAccessLog(ctx context.Context, logEntry *accesslogs.AccessLogEntry) error {
+	if logEntry.AgentNetwork {
+		return agentnetwork.IngestAccessLog(ctx, m.store, logEntry)
+	}
+
 	if m.geo != nil && logEntry.GeoLocation.ConnectionIP != nil {
 		location, err := m.geo.Lookup(logEntry.GeoLocation.ConnectionIP)
 		if err != nil {
diff --git a/management/internals/modules/reverseproxy/service/service.go b/management/internals/modules/reverseproxy/service/service.go
index ee1e3c8b2..b6438abde 100644
--- a/management/internals/modules/reverseproxy/service/service.go
+++ b/management/internals/modules/reverseproxy/service/service.go
@@ -66,6 +66,51 @@ type TargetOptions struct {
 	// reachable without WireGuard (public APIs, LAN services, localhost
 	// sidecars). Default false.
 	DirectUpstream bool `json:"direct_upstream,omitempty"`
+	// Middlewares carries per-target agent-network middleware configs. Empty
+	// for private and operator-defined services; populated only by the
+	// agent-network synthesizer.
+	Middlewares             []MiddlewareConfig `gorm:"serializer:json" json:"middlewares,omitempty"`
+	CaptureMaxRequestBytes  int64              `json:"capture_max_request_bytes,omitempty"`
+	CaptureMaxResponseBytes int64              `json:"capture_max_response_bytes,omitempty"`
+	CaptureContentTypes     []string           `gorm:"serializer:json" json:"capture_content_types,omitempty"`
+	// AgentNetwork marks targets synthesised from Agent Network state. The
+	// proxy uses it to gate agent-network-specific behaviour (access log
+	// tagging, observability, etc.).
+	AgentNetwork bool `json:"agent_network,omitempty"`
+	// DisableAccessLog suppresses the per-request access-log emission for this
+	// target. Defaults false to preserve access-log behaviour for every
+	// non-agent-network target. The agent-network synthesizer sets this true
+	// only when the account's EnableLogCollection toggle is off.
+	DisableAccessLog bool `json:"disable_access_log,omitempty"`
+}
+
+// MiddlewareSlot mirrors proto.MiddlewareSlot / middleware.Slot.
+type MiddlewareSlot string
+
+const (
+	MiddlewareSlotOnRequest  MiddlewareSlot = "on_request"
+	MiddlewareSlotOnResponse MiddlewareSlot = "on_response"
+	MiddlewareSlotTerminal   MiddlewareSlot = "terminal"
+)
+
+// MiddlewareFailMode mirrors proto.MiddlewareConfig_FailMode.
+type MiddlewareFailMode string
+
+const (
+	MiddlewareFailOpen   MiddlewareFailMode = "fail_open"
+	MiddlewareFailClosed MiddlewareFailMode = "fail_closed"
+)
+
+// MiddlewareConfig is the per-target configuration for a single
+// middleware instance. Mirrors proto.MiddlewareConfig.
+type MiddlewareConfig struct {
+	ID         string             `json:"id"`
+	Enabled    bool               `json:"enabled"`
+	Slot       MiddlewareSlot     `json:"slot"`
+	ConfigJSON []byte             `json:"config_json,omitempty"`
+	FailMode   MiddlewareFailMode `json:"fail_mode,omitempty"`
+	TimeoutMs  int32              `json:"timeout_ms,omitempty"`
+	CanMutate  bool               `json:"can_mutate"`
 }
 
 type Target struct {
@@ -504,21 +549,75 @@ func targetOptionsToAPI(opts TargetOptions) *api.ServiceTargetOptions {
 
 func targetOptionsToProto(opts TargetOptions) *proto.PathTargetOptions {
 	if !opts.SkipTLSVerify && opts.PathRewrite == "" && opts.RequestTimeout == 0 &&
-		len(opts.CustomHeaders) == 0 && !opts.DirectUpstream {
+		len(opts.CustomHeaders) == 0 && !opts.DirectUpstream &&
+		len(opts.Middlewares) == 0 && opts.CaptureMaxRequestBytes == 0 &&
+		opts.CaptureMaxResponseBytes == 0 && len(opts.CaptureContentTypes) == 0 &&
+		!opts.AgentNetwork && !opts.DisableAccessLog {
 		return nil
 	}
 	popts := &proto.PathTargetOptions{
-		SkipTlsVerify:  opts.SkipTLSVerify,
-		PathRewrite:    pathRewriteToProto(opts.PathRewrite),
-		CustomHeaders:  opts.CustomHeaders,
-		DirectUpstream: opts.DirectUpstream,
+		SkipTlsVerify:    opts.SkipTLSVerify,
+		PathRewrite:      pathRewriteToProto(opts.PathRewrite),
+		CustomHeaders:    opts.CustomHeaders,
+		DirectUpstream:   opts.DirectUpstream,
+		AgentNetwork:     opts.AgentNetwork,
+		DisableAccessLog: opts.DisableAccessLog,
 	}
 	if opts.RequestTimeout != 0 {
 		popts.RequestTimeout = durationpb.New(opts.RequestTimeout)
 	}
+	if len(opts.Middlewares) > 0 {
+		popts.Middlewares = middlewaresToProto(opts.Middlewares)
+	}
+	popts.CaptureMaxRequestBytes = opts.CaptureMaxRequestBytes
+	popts.CaptureMaxResponseBytes = opts.CaptureMaxResponseBytes
+	if len(opts.CaptureContentTypes) > 0 {
+		popts.CaptureContentTypes = append([]string(nil), opts.CaptureContentTypes...)
+	}
 	return popts
 }
 
+// middlewaresToProto converts the internal middleware slice to the proto
+// representation sent to the proxy via the mapping stream.
+func middlewaresToProto(in []MiddlewareConfig) []*proto.MiddlewareConfig {
+	out := make([]*proto.MiddlewareConfig, 0, len(in))
+	for _, m := range in {
+		pm := &proto.MiddlewareConfig{
+			Id:         m.ID,
+			Enabled:    m.Enabled,
+			Slot:       middlewareSlotToProto(m.Slot),
+			ConfigJson: append([]byte(nil), m.ConfigJSON...),
+			CanMutate:  m.CanMutate,
+			FailMode:   middlewareFailModeToProto(m.FailMode),
+		}
+		if m.TimeoutMs > 0 {
+			pm.Timeout = durationpb.New(time.Duration(m.TimeoutMs) * time.Millisecond)
+		}
+		out = append(out, pm)
+	}
+	return out
+}
+
+func middlewareSlotToProto(s MiddlewareSlot) proto.MiddlewareSlot {
+	switch s {
+	case MiddlewareSlotOnRequest:
+		return proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST
+	case MiddlewareSlotOnResponse:
+		return proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_RESPONSE
+	case MiddlewareSlotTerminal:
+		return proto.MiddlewareSlot_MIDDLEWARE_SLOT_TERMINAL
+	default:
+		return proto.MiddlewareSlot_MIDDLEWARE_SLOT_UNSPECIFIED
+	}
+}
+
+func middlewareFailModeToProto(m MiddlewareFailMode) proto.MiddlewareConfig_FailMode {
+	if m == MiddlewareFailClosed {
+		return proto.MiddlewareConfig_FAIL_CLOSED
+	}
+	return proto.MiddlewareConfig_FAIL_OPEN
+}
+
 // l4TargetOptionsToProto converts L4-relevant target options to proto.
 func l4TargetOptionsToProto(target *Target) *proto.PathTargetOptions {
 	if !target.ProxyProtocol && target.Options.RequestTimeout == 0 && target.Options.SessionIdleTimeout == 0 {
diff --git a/management/internals/server/boot.go b/management/internals/server/boot.go
index ae82b60fe..1c78af9d0 100644
--- a/management/internals/server/boot.go
+++ b/management/internals/server/boot.go
@@ -26,9 +26,11 @@ import (
 	"github.com/netbirdio/netbird/formatter/hook"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
 	accesslogsmanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs/manager"
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
 	"github.com/netbirdio/netbird/management/server/activity"
 	activitystore "github.com/netbirdio/netbird/management/server/activity/store"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	nbContext "github.com/netbirdio/netbird/management/server/context"
 	nbhttp "github.com/netbirdio/netbird/management/server/http"
@@ -120,7 +122,7 @@ func (s *BaseServer) EventStore() activity.Store {
 
 func (s *BaseServer) APIHandler() http.Handler {
 	return Create(s, func() http.Handler {
-		httpAPIHandler, err := nbhttp.NewAPIHandler(context.Background(), s.Router(), s.AccountManager(), s.NetworksManager(), s.ResourcesManager(), s.RoutesManager(), s.GroupsManager(), s.GeoLocationManager(), s.AuthManager(), s.Metrics(), s.PermissionsManager(), s.SettingsManager(), s.ZonesManager(), s.RecordsManager(), s.NetworkMapController(), s.IdpManager(), s.ServiceManager(), s.ReverseProxyDomainManager(), s.AccessLogsManager(), s.ReverseProxyGRPCServer(), s.Config.ReverseProxy.TrustedHTTPProxies, s.RateLimiter(), s.IsValidChildAccount)
+		httpAPIHandler, err := nbhttp.NewAPIHandler(context.Background(), s.Router(), s.AccountManager(), s.NetworksManager(), s.ResourcesManager(), s.RoutesManager(), s.GroupsManager(), s.GeoLocationManager(), s.AuthManager(), s.Metrics(), s.PermissionsManager(), s.SettingsManager(), s.ZonesManager(), s.RecordsManager(), s.NetworkMapController(), s.IdpManager(), s.ServiceManager(), s.ReverseProxyDomainManager(), s.AccessLogsManager(), s.ReverseProxyGRPCServer(), s.Config.ReverseProxy.TrustedHTTPProxies, s.RateLimiter(), s.IsValidChildAccount, s.AgentNetworkManager())
 		if err != nil {
 			log.Fatalf("failed to create API handler: %v", err)
 		}
@@ -223,11 +225,35 @@ func (s *BaseServer) ReverseProxyGRPCServer() *nbgrpc.ProxyServiceServer {
 		s.AfterInit(func(s *BaseServer) {
 			proxyService.SetServiceManager(s.ServiceManager())
 			proxyService.SetProxyController(s.ServiceProxyController())
+			proxyService.SetAgentNetworkSynthesizer(newAgentNetworkSynthesizer(s.Store()))
+			proxyService.SetAgentNetworkLimitsService(s.AgentNetworkManager())
 		})
 		return proxyService
 	})
 }
 
+// agentNetworkSynthesizerAdapter implements nbgrpc.AgentNetworkSynthesizer by
+// delegating to the agentnetwork package's store-backed synthesiser.
+type agentNetworkSynthesizerAdapter struct {
+	store store.Store
+}
+
+func newAgentNetworkSynthesizer(s store.Store) *agentNetworkSynthesizerAdapter {
+	return &agentNetworkSynthesizerAdapter{store: s}
+}
+
+func (a *agentNetworkSynthesizerAdapter) SynthesizeServicesForCluster(ctx context.Context, clusterAddr string) ([]*rpservice.Service, error) {
+	return agentnetwork.SynthesizeServicesForCluster(ctx, a.store, clusterAddr)
+}
+
+func (a *agentNetworkSynthesizerAdapter) SynthesizeServicesForAccount(ctx context.Context, accountID string) ([]*rpservice.Service, error) {
+	return agentnetwork.SynthesizeServices(ctx, a.store, accountID)
+}
+
+func (a *agentNetworkSynthesizerAdapter) SynthesizeServiceForDomain(ctx context.Context, domain string) (*rpservice.Service, error) {
+	return agentnetwork.SynthesizeServiceForDomain(ctx, a.store, domain)
+}
+
 func (s *BaseServer) proxyOIDCConfig() nbgrpc.ProxyOIDCConfig {
 	return Create(s, func() nbgrpc.ProxyOIDCConfig {
 		return nbgrpc.ProxyOIDCConfig{
diff --git a/management/internals/server/modules.go b/management/internals/server/modules.go
index a70da855a..6b1365f3b 100644
--- a/management/internals/server/modules.go
+++ b/management/internals/server/modules.go
@@ -20,6 +20,7 @@ import (
 	recordsManager "github.com/netbirdio/netbird/management/internals/modules/zones/records/manager"
 	"github.com/netbirdio/netbird/management/server"
 	"github.com/netbirdio/netbird/management/server/account"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/server/geolocation"
 	"github.com/netbirdio/netbird/management/server/groups"
 	"github.com/netbirdio/netbird/management/server/idp"
@@ -194,6 +195,24 @@ func (s *BaseServer) NetworksManager() networks.Manager {
 	})
 }
 
+func (s *BaseServer) AgentNetworkManager() agentnetwork.Manager {
+	return Create(s, func() agentnetwork.Manager {
+		mgr := agentnetwork.NewManager(
+			s.Store(),
+			s.PermissionsManager(),
+			s.AccountManager(),
+			s.ServiceProxyController(),
+		)
+		// Sweep expired agent-network access logs per account retention,
+		// reusing the reverse-proxy cleanup interval config.
+		mgr.StartAccessLogCleanup(
+			context.Background(),
+			s.Config.ReverseProxy.AccessLogCleanupIntervalHours,
+		)
+		return mgr
+	})
+}
+
 func (s *BaseServer) ZonesManager() zones.Manager {
 	return Create(s, func() zones.Manager {
 		return zonesManager.NewManager(s.Store(), s.AccountManager(), s.PermissionsManager(), s.DNSDomain())
diff --git a/management/internals/shared/grpc/proxy.go b/management/internals/shared/grpc/proxy.go
index 76663f898..0dfa24bc4 100644
--- a/management/internals/shared/grpc/proxy.go
+++ b/management/internals/shared/grpc/proxy.go
@@ -10,6 +10,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"math"
 	"net"
 	"net/http"
 	"net/url"
@@ -35,6 +36,7 @@ import (
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/sessionkey"
 	"github.com/netbirdio/netbird/management/server/idp"
 	"github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/management/server/users"
 	proxyauth "github.com/netbirdio/netbird/proxy/auth"
@@ -60,6 +62,23 @@ type ProxyTokenChecker interface {
 }
 
 // ProxyServiceServer implements the ProxyService gRPC server
+// AgentNetworkSynthesizer produces in-memory reverse-proxy services from
+// Agent Network provider/policy state for the proxy snapshot path; synthesised
+// services never appear in the reverseproxy_services table.
+type AgentNetworkSynthesizer interface {
+	SynthesizeServicesForCluster(ctx context.Context, clusterAddr string) ([]*rpservice.Service, error)
+	SynthesizeServicesForAccount(ctx context.Context, accountID string) ([]*rpservice.Service, error)
+	SynthesizeServiceForDomain(ctx context.Context, domain string) (*rpservice.Service, error)
+}
+
+// AgentNetworkLimitsService is the minimal slice of agentnetwork.Manager the
+// gRPC layer needs for CheckLLMPolicyLimits + RecordLLMUsage — kept narrow so
+// the grpc package doesn't take a hard import on the full manager.
+type AgentNetworkLimitsService interface {
+	SelectPolicyForRequest(ctx context.Context, in agentnetwork.PolicySelectionInput) (*agentnetwork.PolicySelectionResult, error)
+	RecordUsage(ctx context.Context, in agentnetwork.RecordUsageInput) error
+}
+
 type ProxyServiceServer struct {
 	proto.UnimplementedProxyServiceServer
 
@@ -72,6 +91,14 @@ type ProxyServiceServer struct {
 	mu sync.RWMutex
 	// Manager for reverse proxy operations
 	serviceManager rpservice.Manager
+	// agentNetworkSynth produces synthesised reverse-proxy services from
+	// Agent Network state. Optional — when nil the snapshot path only ships
+	// persisted services.
+	agentNetworkSynth AgentNetworkSynthesizer
+	// agentNetworkLimits handles the pre-flight selection (CheckLLMPolicyLimits)
+	// and the post-flight consumption write (RecordLLMUsage). Optional — when
+	// nil both RPCs return Unimplemented.
+	agentNetworkLimits AgentNetworkLimitsService
 	// ProxyController for service updates and cluster management
 	proxyController proxy.Controller
 
@@ -209,6 +236,127 @@ func (s *ProxyServiceServer) SetServiceManager(manager rpservice.Manager) {
 	s.serviceManager = manager
 }
 
+// SetAgentNetworkSynthesizer wires the agent-network service synthesiser.
+// Optional — when nil the snapshot path skips agent-network synthesis. The
+// modules layer injects this after both the proxy server and the agent-network
+// manager are constructed.
+func (s *ProxyServiceServer) SetAgentNetworkSynthesizer(synth AgentNetworkSynthesizer) {
+	s.mu.Lock()
+	s.agentNetworkSynth = synth
+	s.mu.Unlock()
+}
+
+// SetAgentNetworkLimitsService wires the policy-selection + post-flight
+// consumption sink. Pass nil to disable; both RPCs return Unimplemented while
+// unset so partial wiring surfaces during integration.
+func (s *ProxyServiceServer) SetAgentNetworkLimitsService(svc AgentNetworkLimitsService) {
+	s.mu.Lock()
+	s.agentNetworkLimits = svc
+	s.mu.Unlock()
+}
+
+// agentNetworkSynthesizer returns the synthesiser under read lock.
+func (s *ProxyServiceServer) agentNetworkSynthesizer() AgentNetworkSynthesizer {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return s.agentNetworkSynth
+}
+
+// CheckLLMPolicyLimits is the pre-flight policy gate the proxy calls before
+// forwarding an LLM request upstream. Delegates to the agent-network selector,
+// which scores applicable policies by remaining headroom and returns the
+// policy that pays for this request (or a deny when all are exhausted).
+func (s *ProxyServiceServer) CheckLLMPolicyLimits(ctx context.Context, req *proto.CheckLLMPolicyLimitsRequest) (*proto.CheckLLMPolicyLimitsResponse, error) {
+	s.mu.RLock()
+	svc := s.agentNetworkLimits
+	s.mu.RUnlock()
+	if svc == nil {
+		return nil, status.Errorf(codes.Unimplemented, "agent-network limits service not configured on management")
+	}
+	if req.GetAccountId() == "" {
+		return nil, status.Errorf(codes.InvalidArgument, "account_id is required")
+	}
+	if err := enforceAccountScope(ctx, req.GetAccountId()); err != nil {
+		return nil, err
+	}
+
+	res, err := svc.SelectPolicyForRequest(ctx, agentnetwork.PolicySelectionInput{
+		AccountID:  req.GetAccountId(),
+		UserID:     req.GetUserId(),
+		GroupIDs:   req.GetGroupIds(),
+		ProviderID: req.GetProviderId(),
+	})
+	if err != nil {
+		log.WithContext(ctx).Errorf("select policy for request: %v", err)
+		return nil, status.Error(codes.Internal, "select policy failed")
+	}
+
+	if !res.Allow {
+		return &proto.CheckLLMPolicyLimitsResponse{
+			Decision:           "deny",
+			SelectedPolicyId:   res.SelectedPolicyID,
+			AttributionGroupId: res.AttributionGroupID,
+			WindowSeconds:      res.WindowSeconds,
+			DenyCode:           res.DenyCode,
+			DenyReason:         res.DenyReason,
+		}, nil
+	}
+	return &proto.CheckLLMPolicyLimitsResponse{
+		Decision:           "allow",
+		SelectedPolicyId:   res.SelectedPolicyID,
+		AttributionGroupId: res.AttributionGroupID,
+		WindowSeconds:      res.WindowSeconds,
+	}, nil
+}
+
+// RecordLLMUsage increments the per-(dimension, window) consumption counter for
+// the user and optional attribution group after a served request. Returns
+// Unimplemented when the agent-network limits service hasn't been wired.
+func (s *ProxyServiceServer) RecordLLMUsage(ctx context.Context, req *proto.RecordLLMUsageRequest) (*proto.RecordLLMUsageResponse, error) {
+	s.mu.RLock()
+	svc := s.agentNetworkLimits
+	s.mu.RUnlock()
+	if svc == nil {
+		return nil, status.Errorf(codes.Unimplemented, "agent-network limits service not configured on management")
+	}
+
+	accountID := req.GetAccountId()
+	if accountID == "" {
+		return nil, status.Errorf(codes.InvalidArgument, "account_id is required")
+	}
+	if err := enforceAccountScope(ctx, accountID); err != nil {
+		return nil, err
+	}
+	tokensIn := req.GetTokensInput()
+	tokensOut := req.GetTokensOutput()
+	costUSD := req.GetCostUsd()
+
+	// Reject impossible counters at the boundary instead of recording them:
+	// a negative window, negative tokens, or a negative / non-finite cost
+	// would otherwise decrement or poison the persisted consumption totals.
+	if req.GetWindowSeconds() < 0 || tokensIn < 0 || tokensOut < 0 || costUSD < 0 || math.IsNaN(costUSD) || math.IsInf(costUSD, 0) {
+		return nil, status.Errorf(codes.InvalidArgument, "usage counters must be non-negative and finite")
+	}
+
+	// Book the policy-window dimensions (when a policy cap bound this request)
+	// and every applicable account budget rule's window in a single batched
+	// transaction.
+	if err := svc.RecordUsage(ctx, agentnetwork.RecordUsageInput{
+		AccountID:          accountID,
+		UserID:             req.GetUserId(),
+		AttributionGroupID: req.GetGroupId(),
+		GroupIDs:           req.GetGroupIds(),
+		WindowSeconds:      req.GetWindowSeconds(),
+		TokensIn:           tokensIn,
+		TokensOut:          tokensOut,
+		CostUSD:            costUSD,
+	}); err != nil {
+		log.WithContext(ctx).Errorf("record usage: %v", err)
+		return nil, status.Error(codes.Internal, "record usage failed")
+	}
+	return &proto.RecordLLMUsageResponse{}, nil
+}
+
 // SetProxyController sets the proxy controller. Must be called before serving.
 func (s *ProxyServiceServer) SetProxyController(proxyController proxy.Controller) {
 	s.mu.Lock()
@@ -623,12 +771,40 @@ func (s *ProxyServiceServer) snapshotServiceMappings(ctx context.Context, conn *
 		return nil, fmt.Errorf("get services from store: %w", err)
 	}
 
+	if synth := s.agentNetworkSynthesizer(); synth != nil {
+		var synthesised []*rpservice.Service
+		var serr error
+		// Account-scoped connections synthesise only their own account, so the
+		// snapshot can never carry another tenant's mappings (which embed the
+		// upstream auth header derived from that tenant's provider API key).
+		// Global connections still see the whole cluster.
+		if conn.accountID != nil {
+			synthesised, serr = synth.SynthesizeServicesForAccount(ctx, *conn.accountID)
+		} else {
+			synthesised, serr = synth.SynthesizeServicesForCluster(ctx, conn.address)
+		}
+		if serr != nil {
+			// Surface a real synthesis failure instead of silently shipping an
+			// incomplete snapshot (which would drop the account's agent-network
+			// routes). Consistent with the persisted-services error above; the
+			// proxy retries the snapshot on connection error.
+			return nil, fmt.Errorf("synthesise agent-network services: %w", serr)
+		}
+		services = append(services, synthesised...)
+	}
+
 	oidcCfg := s.GetOIDCValidationConfig()
 	var mappings []*proto.ProxyMapping
 	for _, service := range services {
 		if !service.Enabled || service.ProxyCluster == "" || service.ProxyCluster != conn.address {
 			continue
 		}
+		// Defense in depth: an account-scoped proxy must never receive another
+		// account's mapping, matching the per-account filtering the incremental
+		// update path already applies.
+		if conn.accountID != nil && service.AccountID != *conn.accountID {
+			continue
+		}
 
 		m := service.ToProtoMapping(rpservice.Create, "", oidcCfg)
 		if !proxyAcceptsMapping(conn, m) {
@@ -1617,7 +1793,29 @@ func (s *ProxyServiceServer) ValidateSession(ctx context.Context, req *proto.Val
 }
 
 func (s *ProxyServiceServer) getServiceByDomain(ctx context.Context, domain string) (*rpservice.Service, error) {
-	return s.serviceManager.GetServiceByDomain(ctx, domain)
+	service, err := s.serviceManager.GetServiceByDomain(ctx, domain)
+	if err == nil {
+		return service, nil
+	}
+
+	// Fall back to the Agent Network synthesiser scoped directly to the domain's
+	// account. Synthesised services are never persisted, so they must resolve
+	// here for OIDC / session / tunnel-peer flows against agent-network
+	// endpoints. Resolving by domain synthesises only the owning account rather
+	// than every tenant on the cluster.
+	if synth := s.agentNetworkSynthesizer(); synth != nil {
+		svc, serr := synth.SynthesizeServiceForDomain(ctx, domain)
+		if serr != nil {
+			// A real synthesis failure must surface, not be masked by the
+			// original store miss — otherwise a transient DB error looks like
+			// "no such service".
+			return nil, fmt.Errorf("synthesize agent-network service for %s: %w", domain, serr)
+		}
+		if svc != nil {
+			return svc, nil
+		}
+	}
+	return nil, err
 }
 
 func (s *ProxyServiceServer) checkGroupAccess(service *rpservice.Service, user *types.User) error {
diff --git a/management/server/activity/codes.go b/management/server/activity/codes.go
index 852193a3b..cfd809871 100644
--- a/management/server/activity/codes.go
+++ b/management/server/activity/codes.go
@@ -245,6 +245,37 @@ const (
 	// tunnel. Distinct from UserLoggedInPeer (full interactive login).
 	UserExtendedPeerSession Activity = 125
 
+	// AgentNetworkProviderCreated indicates that a user created an Agent Network provider
+	AgentNetworkProviderCreated Activity = 126
+	// AgentNetworkProviderUpdated indicates that a user updated an Agent Network provider
+	AgentNetworkProviderUpdated Activity = 127
+	// AgentNetworkProviderDeleted indicates that a user deleted an Agent Network provider
+	AgentNetworkProviderDeleted Activity = 128
+
+	// AgentNetworkPolicyCreated indicates that a user created an Agent Network policy
+	AgentNetworkPolicyCreated Activity = 129
+	// AgentNetworkPolicyUpdated indicates that a user updated an Agent Network policy
+	AgentNetworkPolicyUpdated Activity = 130
+	// AgentNetworkPolicyDeleted indicates that a user deleted an Agent Network policy
+	AgentNetworkPolicyDeleted Activity = 131
+
+	// AgentNetworkGuardrailCreated indicates that a user created an Agent Network guardrail
+	AgentNetworkGuardrailCreated Activity = 132
+	// AgentNetworkGuardrailUpdated indicates that a user updated an Agent Network guardrail
+	AgentNetworkGuardrailUpdated Activity = 133
+	// AgentNetworkGuardrailDeleted indicates that a user deleted an Agent Network guardrail
+	AgentNetworkGuardrailDeleted Activity = 134
+
+	// AgentNetworkBudgetRuleCreated indicates that a user created an Agent Network budget rule
+	AgentNetworkBudgetRuleCreated Activity = 135
+	// AgentNetworkBudgetRuleUpdated indicates that a user updated an Agent Network budget rule
+	AgentNetworkBudgetRuleUpdated Activity = 136
+	// AgentNetworkBudgetRuleDeleted indicates that a user deleted an Agent Network budget rule
+	AgentNetworkBudgetRuleDeleted Activity = 137
+
+	// AgentNetworkSettingsUpdated indicates that a user updated Agent Network account settings
+	AgentNetworkSettingsUpdated Activity = 139
+
 	AccountDeleted Activity = 99999
 )
 
@@ -400,6 +431,24 @@ var activityMap = map[Activity]Code{
 
 	UserExtendedPeerSession: {"User extended peer session", "user.peer.session.extend"},
 
+	AgentNetworkProviderCreated: {"Agent Network provider created", "agent_network.provider.create"},
+	AgentNetworkProviderUpdated: {"Agent Network provider updated", "agent_network.provider.update"},
+	AgentNetworkProviderDeleted: {"Agent Network provider deleted", "agent_network.provider.delete"},
+
+	AgentNetworkPolicyCreated: {"Agent Network policy created", "agent_network.policy.create"},
+	AgentNetworkPolicyUpdated: {"Agent Network policy updated", "agent_network.policy.update"},
+	AgentNetworkPolicyDeleted: {"Agent Network policy deleted", "agent_network.policy.delete"},
+
+	AgentNetworkGuardrailCreated: {"Agent Network guardrail created", "agent_network.guardrail.create"},
+	AgentNetworkGuardrailUpdated: {"Agent Network guardrail updated", "agent_network.guardrail.update"},
+	AgentNetworkGuardrailDeleted: {"Agent Network guardrail deleted", "agent_network.guardrail.delete"},
+
+	AgentNetworkBudgetRuleCreated: {"Agent Network budget rule created", "agent_network.budget_rule.create"},
+	AgentNetworkBudgetRuleUpdated: {"Agent Network budget rule updated", "agent_network.budget_rule.update"},
+	AgentNetworkBudgetRuleDeleted: {"Agent Network budget rule deleted", "agent_network.budget_rule.delete"},
+
+	AgentNetworkSettingsUpdated: {"Agent Network settings updated", "agent_network.settings.update"},
+
 	DomainAdded:     {"Domain added", "domain.add"},
 	DomainDeleted:   {"Domain deleted", "domain.delete"},
 	DomainValidated: {"Domain validated", "domain.validate"},
diff --git a/management/server/affectedpeers/proxy_synth_test.go b/management/server/affectedpeers/proxy_synth_test.go
new file mode 100644
index 000000000..07273b18b
--- /dev/null
+++ b/management/server/affectedpeers/proxy_synth_test.go
@@ -0,0 +1,95 @@
+package affectedpeers
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	"github.com/netbirdio/netbird/management/server/store"
+)
+
+// fakeProxyStore implements only the two store methods loadProxyServices calls;
+// the embedded nil store.Store panics if anything else is invoked, which keeps
+// the test honest about the surface under test.
+type fakeProxyStore struct {
+	store.Store
+	proxyByCluster map[string][]string
+	persisted      []*rpservice.Service
+}
+
+func (f *fakeProxyStore) GetEmbeddedProxyPeerIDsByCluster(_ context.Context, _ string) (map[string][]string, error) {
+	return f.proxyByCluster, nil
+}
+
+func (f *fakeProxyStore) GetAccountServices(_ context.Context, _ store.LockingStrength, _ string) ([]*rpservice.Service, error) {
+	return f.persisted, nil
+}
+
+func serviceIDs(svcs []*rpservice.Service) []string {
+	ids := make([]string, 0, len(svcs))
+	for _, s := range svcs {
+		ids = append(ids, s.ID)
+	}
+	return ids
+}
+
+// loadProxyServices must merge the synthesised agent-network services (which are
+// never persisted) with the persisted ones, so the proxy-affected expansion can
+// see agent-network AccessGroups. Without this the embedded proxy peer is never
+// flagged on a client group change and only a full resync (restart) recovers.
+func TestLoadProxyServices_MergesSynthesizedAgentNetworkServices(t *testing.T) {
+	prev := agentNetworkSynthesizer
+	t.Cleanup(func() { agentNetworkSynthesizer = prev })
+	SetAgentNetworkSynthesizer(func(_ context.Context, _ store.Store, _ string) ([]*rpservice.Service, error) {
+		return []*rpservice.Service{
+			{ID: "agent-net-svc-acc", ProxyCluster: "proxy.netbird.local", Private: true, AccessGroups: []string{"gB"}},
+		}, nil
+	})
+
+	s := &fakeProxyStore{
+		proxyByCluster: map[string][]string{"proxy.netbird.local": {"proxy-peer-1"}},
+		persisted:      []*rpservice.Service{{ID: "persisted-rp-svc", ProxyCluster: "proxy.netbird.local"}},
+	}
+	snap := &Snapshot{}
+	require.NoError(t, snap.loadProxyServices(context.Background(), s, "acc"))
+
+	ids := serviceIDs(snap.services)
+	assert.Contains(t, ids, "persisted-rp-svc", "persisted services must be kept")
+	assert.Contains(t, ids, "agent-net-svc-acc", "synthesised agent-network service must be merged in")
+}
+
+// With no synthesiser registered, loadProxyServices falls back to persisted
+// services only (no panic, no behaviour change for non-agent-network builds).
+func TestLoadProxyServices_NoSynthesizerRegistered(t *testing.T) {
+	prev := agentNetworkSynthesizer
+	t.Cleanup(func() { agentNetworkSynthesizer = prev })
+	agentNetworkSynthesizer = nil
+
+	s := &fakeProxyStore{
+		proxyByCluster: map[string][]string{"c": {"proxy-1"}},
+		persisted:      []*rpservice.Service{{ID: "persisted"}},
+	}
+	snap := &Snapshot{}
+	require.NoError(t, snap.loadProxyServices(context.Background(), s, "acc"))
+	assert.Equal(t, []string{"persisted"}, serviceIDs(snap.services))
+}
+
+// No embedded proxy peers → skip entirely (don't even call the synthesiser).
+func TestLoadProxyServices_NoEmbeddedProxyPeersSkips(t *testing.T) {
+	prev := agentNetworkSynthesizer
+	t.Cleanup(func() { agentNetworkSynthesizer = prev })
+	called := false
+	SetAgentNetworkSynthesizer(func(_ context.Context, _ store.Store, _ string) ([]*rpservice.Service, error) {
+		called = true
+		return nil, nil
+	})
+
+	s := &fakeProxyStore{proxyByCluster: map[string][]string{}}
+	snap := &Snapshot{}
+	require.NoError(t, snap.loadProxyServices(context.Background(), s, "acc"))
+	assert.False(t, called, "synthesiser must not run for accounts without embedded proxy peers")
+	assert.Empty(t, snap.services)
+}
diff --git a/management/server/affectedpeers/resolver.go b/management/server/affectedpeers/resolver.go
index 94e24ced6..16a795539 100644
--- a/management/server/affectedpeers/resolver.go
+++ b/management/server/affectedpeers/resolver.go
@@ -29,6 +29,19 @@ import (
 	"github.com/netbirdio/netbird/route"
 )
 
+// agentNetworkSynthesizer returns the account's synthesised (never-persisted)
+// agent-network reverse-proxy services. It is registered at boot via
+// SetAgentNetworkSynthesizer to avoid an import cycle (agentnetwork → account →
+// affectedpeers). nil when agent-network is not wired, in which case only
+// persisted services are considered.
+var agentNetworkSynthesizer func(ctx context.Context, s store.Store, accountID string) ([]*rpservice.Service, error)
+
+// SetAgentNetworkSynthesizer registers the agent-network service synthesiser.
+// Called once during boot, before any request is served.
+func SetAgentNetworkSynthesizer(fn func(ctx context.Context, s store.Store, accountID string) ([]*rpservice.Service, error)) {
+	agentNetworkSynthesizer = fn
+}
+
 // Snapshot is an in-memory view of the collections needed to expand a Change.
 // Loaded in-tx, walked by Expand after commit. Only the collections the Change
 // can touch are loaded; the rest stay nil (see Load).
@@ -124,7 +137,12 @@ func (snap *Snapshot) loadDNS(ctx context.Context, s store.Store, accountID stri
 }
 
 // loadProxyServices loads the embedded-proxy cluster index, and the services only
-// when the account actually has embedded proxy peers.
+// when the account actually has embedded proxy peers. Both the persisted
+// reverse-proxy services and the synthesised agent-network services are loaded:
+// agent-network services are never persisted, so without synthesising them here
+// collectFromProxyServices can't fold the embedded proxy peer into the affected
+// set when a client's group changes, and the proxy never learns a newly
+// authorised client until it reconnects (full network-map resync).
 func (snap *Snapshot) loadProxyServices(ctx context.Context, s store.Store, accountID string) error {
 	var err error
 	if snap.proxyByCluster, err = s.GetEmbeddedProxyPeerIDsByCluster(ctx, accountID); err != nil {
@@ -133,8 +151,21 @@ func (snap *Snapshot) loadProxyServices(ctx context.Context, s store.Store, acco
 	if len(snap.proxyByCluster) == 0 {
 		return nil
 	}
-	snap.services, err = s.GetAccountServices(ctx, store.LockingStrengthNone, accountID)
-	return err
+	if snap.services, err = s.GetAccountServices(ctx, store.LockingStrengthNone, accountID); err != nil {
+		return err
+	}
+	if agentNetworkSynthesizer == nil {
+		return nil
+	}
+	synth, serr := agentNetworkSynthesizer(ctx, s, accountID)
+	if serr != nil {
+		// Non-fatal: fall back to persisted services. The next full
+		// network-map resync still converges the proxy.
+		log.WithContext(ctx).Warnf("affectedpeers: synthesise agent-network services for account %s: %v", accountID, serr)
+		return nil
+	}
+	snap.services = append(snap.services, synth...)
+	return nil
 }
 
 // loadGroupIndex loads all groups (for group.Resources) and builds the
diff --git a/management/server/agentnetwork_budgetrule_realstack_test.go b/management/server/agentnetwork_budgetrule_realstack_test.go
new file mode 100644
index 000000000..d17f2e26a
--- /dev/null
+++ b/management/server/agentnetwork_budgetrule_realstack_test.go
@@ -0,0 +1,126 @@
+package server
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
+	agenttypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/server/permissions"
+	"github.com/netbirdio/netbird/management/server/store"
+)
+
+// TestAgentNetwork_BudgetRuleCRUD_RealManager is the GC-1 no-mock guard for the
+// account budget-rule manager surface: real DefaultAccountManager, real store,
+// real permissions. It exercises create/get/list/update/delete through the
+// permission-gated manager (not the store directly) and asserts the reused
+// PolicyLimits cap shape and targets survive each step.
+func TestAgentNetwork_BudgetRuleCRUD_RealManager(t *testing.T) {
+	am, _, err := createManager(t)
+	require.NoError(t, err, "createManager must succeed")
+	ctx := context.Background()
+
+	const (
+		accountID   = "agent-net-budget-acct"
+		adminUserID = "agent-net-budget-admin"
+	)
+	account := newAccountWithId(ctx, accountID, adminUserID, "agent-net.test", "", "", false)
+	require.NoError(t, am.Store.SaveAccount(ctx, account), "SaveAccount must succeed")
+
+	mgr := agentnetwork.NewManager(am.Store, permissions.NewManager(am.Store), am, nil)
+
+	created, err := mgr.CreateBudgetRule(ctx, adminUserID, &agenttypes.AccountBudgetRule{
+		AccountID:    accountID,
+		Name:         "eng-monthly",
+		Enabled:      true,
+		TargetGroups: []string{"grp-eng"},
+		TargetUsers:  []string{"user-alice"},
+		Limits: agenttypes.PolicyLimits{
+			TokenLimit:  agenttypes.PolicyTokenLimit{Enabled: true, GroupCap: 100_000, UserCap: 10_000, WindowSeconds: 2_592_000},
+			BudgetLimit: agenttypes.PolicyBudgetLimit{Enabled: true, GroupCapUsd: 500, WindowSeconds: 2_592_000},
+		},
+	})
+	require.NoError(t, err, "CreateBudgetRule must succeed")
+	require.NotEmpty(t, created.ID, "create must mint an ID")
+
+	got, err := mgr.GetBudgetRule(ctx, accountID, adminUserID, created.ID)
+	require.NoError(t, err, "GetBudgetRule must succeed")
+	assert.Equal(t, "eng-monthly", got.Name, "name round-trips through the manager")
+	assert.Equal(t, []string{"grp-eng"}, got.TargetGroups, "target groups round-trip")
+	assert.Equal(t, int64(100_000), got.Limits.TokenLimit.GroupCap, "token group cap round-trips")
+
+	list, err := mgr.GetAllBudgetRules(ctx, accountID, adminUserID)
+	require.NoError(t, err, "GetAllBudgetRules must succeed")
+	require.Len(t, list, 1, "exactly the one created rule must be listed")
+
+	created.Limits.TokenLimit.GroupCap = 200_000
+	updated, err := mgr.UpdateBudgetRule(ctx, adminUserID, created)
+	require.NoError(t, err, "UpdateBudgetRule must succeed")
+	assert.Equal(t, int64(200_000), updated.Limits.TokenLimit.GroupCap, "updated cap must persist")
+
+	require.NoError(t, mgr.DeleteBudgetRule(ctx, accountID, adminUserID, created.ID), "DeleteBudgetRule must succeed")
+	_, err = mgr.GetBudgetRule(ctx, accountID, adminUserID, created.ID)
+	assert.Error(t, err, "get after delete must fail")
+}
+
+// TestAgentNetwork_UpdateSettings_PreservesImmutableAndTogglesCollection is the
+// GC-1 guard for UpdateSettings: it must apply the collection toggles while
+// preserving the immutable Cluster/Subdomain pinned at bootstrap.
+func TestAgentNetwork_UpdateSettings_PreservesImmutableAndTogglesCollection(t *testing.T) {
+	am, _, err := createManager(t)
+	require.NoError(t, err, "createManager must succeed")
+	ctx := context.Background()
+
+	const (
+		accountID   = "agent-net-settings-acct"
+		adminUserID = "agent-net-settings-admin"
+		clusterAddr = "eu.proxy.netbird.io"
+	)
+	account := newAccountWithId(ctx, accountID, adminUserID, "agent-net.test", "", "", false)
+	require.NoError(t, am.Store.SaveAccount(ctx, account), "SaveAccount must succeed")
+
+	mgr := agentnetwork.NewManager(am.Store, permissions.NewManager(am.Store), am, nil)
+
+	// Creating a provider bootstraps the settings row (cluster + subdomain).
+	_, err = mgr.CreateProvider(ctx, adminUserID, &agenttypes.Provider{
+		AccountID:   accountID,
+		ProviderID:  "openai_api",
+		Name:        "openai",
+		UpstreamURL: "https://api.openai.com",
+		APIKey:      "sk-test",
+		Enabled:     true,
+		Models:      []agenttypes.ProviderModel{{ID: "gpt-5.4"}},
+	}, clusterAddr)
+	require.NoError(t, err, "CreateProvider must bootstrap settings")
+
+	before, err := mgr.GetSettings(ctx, accountID, adminUserID)
+	require.NoError(t, err, "GetSettings must succeed after bootstrap")
+	require.Equal(t, clusterAddr, before.Cluster, "cluster pinned at bootstrap")
+	require.NotEmpty(t, before.Subdomain, "subdomain pinned at bootstrap")
+	assert.False(t, before.EnablePromptCollection, "prompt collection defaults off")
+
+	// Attempt to flip toggles AND smuggle a different cluster/subdomain — the
+	// immutable fields must be ignored.
+	updated, err := mgr.UpdateSettings(ctx, adminUserID, &agenttypes.Settings{
+		AccountID:              accountID,
+		Cluster:                "attacker.cluster",
+		Subdomain:              "evil",
+		EnableLogCollection:    true,
+		EnablePromptCollection: true,
+		RedactPii:              true,
+	})
+	require.NoError(t, err, "UpdateSettings must succeed")
+	assert.Equal(t, before.Cluster, updated.Cluster, "cluster is immutable and must be preserved")
+	assert.Equal(t, before.Subdomain, updated.Subdomain, "subdomain is immutable and must be preserved")
+	assert.True(t, updated.EnableLogCollection, "log collection toggle must apply")
+	assert.True(t, updated.EnablePromptCollection, "prompt collection toggle must apply")
+	assert.True(t, updated.RedactPii, "redact toggle must apply")
+
+	reloaded, err := am.Store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
+	require.NoError(t, err)
+	assert.Equal(t, before.Cluster, reloaded.Cluster, "persisted cluster unchanged")
+	assert.True(t, reloaded.EnablePromptCollection, "persisted prompt collection toggled on")
+}
diff --git a/management/server/agentnetwork_proxypeer_restart_test.go b/management/server/agentnetwork_proxypeer_restart_test.go
new file mode 100644
index 000000000..1e4b8d016
--- /dev/null
+++ b/management/server/agentnetwork_proxypeer_restart_test.go
@@ -0,0 +1,199 @@
+package server
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/peers"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
+	agenttypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/permissions"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+// TestAgentNetwork_ProxyRestart_PropagatesNewPeerAndDropsStale is the no-mock
+// regression guard for the bug the user reported: restarting the proxy creates
+// a fresh embedded peer with a NEW WireGuard public key (the proxy generates
+// the keypair on every startup at proxy/internal/roundtrip/netbird.go:312).
+// The PRIOR embedded peer record is never deleted on management, so the
+// account accumulates a stale peer holding a stale CGNAT IP. Other peers
+// in the account either keep routing to the dead IP, or — if synth DNS
+// picks the wrong record — never see the new IP at all.
+//
+// What this test exercises (no mocks):
+//   - real SQLite test store
+//   - real DefaultAccountManager, network-map controller, peer-update channels
+//   - real peers.Manager.CreateProxyPeer path (the very method the proxy
+//     invokes over gRPC on every startup)
+//   - real agentnetwork.Manager + synth chain so the client receives a
+//     concrete DNS record that must point at the LATEST proxy peer.
+//
+// Pre-fix expected behavior (red): two embedded peers exist after the
+// "restart"; the synth DNS record points at the stale one; the client
+// receives an update reflecting the new peer but the old one lingers.
+// Post-fix expected behavior (green): exactly one embedded peer exists
+// after restart (with the new key) AND the client's network map carries
+// the synth DNS pointing at that new peer's CGNAT IP.
+func TestAgentNetwork_ProxyRestart_PropagatesNewPeerAndDropsStale(t *testing.T) {
+	am, updateManager, err := createManager(t)
+	require.NoError(t, err, "createManager must succeed")
+	ctx := context.Background()
+
+	const (
+		accountID   = "an-restart-acct"
+		adminUserID = "an-restart-admin"
+		groupAID    = "an-restart-grp-A"
+		clusterAddr = "eu.proxy.netbird.io"
+		clientKey   = "BhRPtynAAYRDy08+q4HTMsos8fs4plTP4NOSh7C1ry8="
+		// Two different proxy pubkeys — the "before" and "after" of a
+		// proxy-process restart with fresh-keypair generation.
+		proxyKey1 = "Aaaaa1aaaaYRDy08+q4HTMsos8fs4plTP4NOSh7C1ry8="
+		proxyKey2 = "Bbbbb2bbbbYRDy08+q4HTMsos8fs4plTP4NOSh7C1ry8="
+	)
+
+	// --- Account scaffold ---
+	account := newAccountWithId(ctx, accountID, adminUserID, "an-restart.test", "", "", false)
+	require.NoError(t, am.Store.SaveAccount(ctx, account))
+
+	clientPeer := &nbpeer.Peer{
+		Key:      clientKey,
+		Name:     "an-restart-client",
+		DNSLabel: "an-restart-client",
+		Meta:     nbpeer.PeerSystemMeta{Hostname: "an-restart-client", GoOS: "linux", WtVersion: "development"},
+	}
+	addedClient, _, _, _, err := am.AddPeer(ctx, "", "", adminUserID, clientPeer, false)
+	require.NoError(t, err, "AddPeer for client must succeed")
+	require.NoError(t, am.MarkPeerConnected(ctx, clientKey, accountID, time.Now().UnixNano(), &types.NetworkMap{}),
+		"MarkPeerConnected for the client peer must succeed (affected-peer fan-out skips disconnected peers)")
+
+	// Place the client in group A so the synth policy reaches it.
+	account, err = am.Store.GetAccount(ctx, accountID)
+	require.NoError(t, err)
+	account.Groups[groupAID] = &types.Group{ID: groupAID, Name: "groupA", Peers: []string{addedClient.ID}}
+	require.NoError(t, am.Store.SaveAccount(ctx, account), "SaveAccount must persist group A")
+
+	// --- Real peers + agent-network managers ---
+	permMgr := permissions.NewManager(am.Store)
+	peersMgr := peers.NewManager(am.Store, permMgr)
+	peersMgr.SetAccountManager(am)
+	peersMgr.SetNetworkMapController(am.networkMapController)
+	agentMgr := agentnetwork.NewManager(am.Store, permMgr, am, nil)
+
+	// Subscribe BEFORE any state-mutating call so we don't lose the update
+	// that contains the synth DNS record.
+	clientCh := updateManager.CreateChannel(ctx, addedClient.ID)
+	t.Cleanup(func() { updateManager.CloseChannel(ctx, addedClient.ID) })
+	drain(clientCh)
+
+	// --- First proxy startup: register peer key K1, then mark it
+	// connected. In production the proxy follows CreateProxyPeer with the
+	// regular sync stream which lands on MarkPeerConnected; the synth DNS
+	// path filters out peers that aren't Connected (types/account.go:323),
+	// so without this step no DNS record would be emitted.
+	require.NoError(t, peersMgr.CreateProxyPeer(ctx, accountID, proxyKey1, clusterAddr),
+		"first CreateProxyPeer (proxy startup) must succeed")
+
+	peer1ID, err := am.Store.GetPeerIDByKey(ctx, store.LockingStrengthNone, proxyKey1)
+	require.NoError(t, err, "proxy peer for K1 must be persisted after CreateProxyPeer")
+	require.NotEmpty(t, peer1ID)
+
+	require.NoError(t, am.MarkPeerConnected(ctx, proxyKey1, accountID, time.Now().UnixNano(), &types.NetworkMap{}),
+		"MarkPeerConnected for K1 must succeed")
+
+	account, err = am.Store.GetAccount(ctx, accountID)
+	require.NoError(t, err)
+	proxyIP1 := account.Peers[peer1ID].IP.String()
+	require.NotEmpty(t, proxyIP1, "K1 must have an assigned overlay IP")
+
+	// --- Provider + policy. CreateProvider / CreatePolicy trigger the
+	// agentnetwork reconcile which runs UpdateAccountPeers; the resulting
+	// NetworkMap delivered to the client carries the synth DNS record
+	// pointing at K1's IP. ---
+	provider, err := agentMgr.CreateProvider(ctx, adminUserID, &agenttypes.Provider{
+		AccountID:   accountID,
+		ProviderID:  "openai_api",
+		Name:        "openai-test",
+		UpstreamURL: "https://api.openai.com",
+		APIKey:      "sk-test-key",
+		Enabled:     true,
+		Models:      []agenttypes.ProviderModel{{ID: "gpt-5.4"}},
+	}, clusterAddr)
+	require.NoError(t, err, "CreateProvider must succeed")
+
+	_, err = agentMgr.CreatePolicy(ctx, adminUserID, &agenttypes.Policy{
+		AccountID:              accountID,
+		Name:                   "p1",
+		Enabled:                true,
+		SourceGroups:           []string{groupAID},
+		DestinationProviderIDs: []string{provider.ID},
+	})
+	require.NoError(t, err, "CreatePolicy must succeed")
+
+	settings, err := am.Store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
+	require.NoError(t, err)
+	fqdn := settings.Endpoint()
+
+	rdata1 := awaitZoneRData(clientCh, clusterAddr, fqdn, true)
+	require.Equal(t, proxyIP1, rdata1,
+		"client must receive a synth DNS record pointing at K1's overlay IP after the synth path runs")
+	drain(clientCh)
+
+	// --- Proxy restart: NEW keypair K2, same account, same cluster ---
+	require.NoError(t, peersMgr.CreateProxyPeer(ctx, accountID, proxyKey2, clusterAddr),
+		"second CreateProxyPeer (proxy restart with fresh keypair) must succeed")
+
+	peer2ID, err := am.Store.GetPeerIDByKey(ctx, store.LockingStrengthNone, proxyKey2)
+	require.NoError(t, err, "proxy peer for K2 must be persisted after restart")
+	require.NotEmpty(t, peer2ID)
+
+	require.NoError(t, am.MarkPeerConnected(ctx, proxyKey2, accountID, time.Now().UnixNano(), &types.NetworkMap{}),
+		"MarkPeerConnected for K2 must succeed")
+
+	// In production the agent's sync stream pulls a fresh NetworkMap as
+	// part of its normal reconcile cadence; in this isolated test
+	// MarkPeerConnected's affected-peer fan-out can race the channel-side
+	// buffer in a way that swallows the synth-DNS-bearing update before
+	// our await reads it. Trigger an explicit account-wide fan-out so the
+	// assertion below tests what production actually delivers, not the
+	// in-test buffer race.
+	am.UpdateAccountPeers(ctx, accountID, types.UpdateReason{Resource: types.UpdateResourcePeer, Operation: types.UpdateOperationUpdate})
+
+	account, err = am.Store.GetAccount(ctx, accountID)
+	require.NoError(t, err)
+	proxyIP2 := account.Peers[peer2ID].IP.String()
+	require.NotEmpty(t, proxyIP2, "K2 must have an assigned overlay IP")
+	require.NotEqual(t, proxyIP1, proxyIP2, "K2 must get a different overlay IP than K1 (sanity)")
+
+	// CRITICAL ASSERTION 1: K1 must no longer be in the store. The SqlStore
+	// returns ("", nil) for a missing key rather than NotFound, so assert
+	// on the returned ID being empty.
+	staleID, err := am.Store.GetPeerIDByKey(ctx, store.LockingStrengthNone, proxyKey1)
+	require.NoError(t, err, "GetPeerIDByKey for a missing peer must not error")
+	assert.Empty(t, staleID,
+		"stale embedded proxy peer K1 must be removed when a new embedded peer registers for the same (account, cluster); pre-fix this assertion fails because management never cleans up the prior peer record")
+
+	// CRITICAL ASSERTION 2: exactly one embedded proxy peer remains, and it
+	// is K2.
+	account, err = am.Store.GetAccount(ctx, accountID)
+	require.NoError(t, err)
+	embeddedKeys := []string{}
+	for _, p := range account.Peers {
+		if p.ProxyMeta.Embedded {
+			embeddedKeys = append(embeddedKeys, p.Key)
+		}
+	}
+	assert.Equal(t, []string{proxyKey2}, embeddedKeys,
+		"after a proxy restart exactly one embedded proxy peer should remain — the one with the new key K2")
+
+	// CRITICAL ASSERTION 3: the synth DNS record the client receives now
+	// points at K2's IP, not K1's.
+	rdata2 := awaitZoneRData(clientCh, clusterAddr, fqdn, true)
+	assert.Equal(t, proxyIP2, rdata2,
+		"after proxy restart, the client's synth DNS record must point at the NEW embedded peer's IP, not the stale K1 IP")
+}
diff --git a/management/server/agentnetwork_realstack_test.go b/management/server/agentnetwork_realstack_test.go
new file mode 100644
index 000000000..e7855c575
--- /dev/null
+++ b/management/server/agentnetwork_realstack_test.go
@@ -0,0 +1,212 @@
+package server
+
+import (
+	"context"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/miekg/dns"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	networkmap "github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
+	agenttypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/permissions"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+	nbproto "github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// TestAgentNetwork_ProviderCRUD_FansOutToProxyAndClientPeers is the no-mock
+// integration test for the live propagation path: a provider/policy mutation
+// through the real agentnetwork.Manager triggers the real
+// DefaultAccountManager.UpdateAccountPeers, which runs the real network-map
+// controller (including AN-2b's injectAllProxyPolicies), and a network map is
+// computed and fanned out to BOTH the embedded proxy peer and the client peer.
+//
+// Unlike the synthesizer/reconcile unit tests, nothing here is mocked: real
+// SQLite store, real account manager + network-map controller, real
+// agentnetwork manager, real peer update channels. The client peer's delivered
+// map is asserted to actually carry the synth DNS surface, and provider
+// create/delete are exercised end to end.
+func TestAgentNetwork_ProviderCRUD_FansOutToProxyAndClientPeers(t *testing.T) {
+	am, updateManager, err := createManager(t)
+	require.NoError(t, err, "createManager must succeed")
+	ctx := context.Background()
+
+	const (
+		accountID    = "agent-net-acct-1"
+		adminUserID  = "agent-net-admin-1"
+		groupAID     = "agent-net-grp-A"
+		clusterAddr  = "eu.proxy.netbird.io"
+		clientKey    = "BhRPtynAAYRDy08+q4HTMsos8fs4plTP4NOSh7C1ry8="
+		proxyPeerID  = "agent-net-proxy-peer-1"
+		proxyPeerKey = "/yF0+vCfv+mRR5k0dca0TrGdO/oiNeAI58gToZm5NyI="
+		proxyIP      = "100.64.0.99"
+	)
+
+	account := newAccountWithId(ctx, accountID, adminUserID, "agent-net.test", "", "", false)
+	require.NoError(t, am.Store.SaveAccount(ctx, account), "SaveAccount must succeed")
+
+	// Real client peer through the production AddPeer path.
+	clientPeer := &nbpeer.Peer{
+		Key:      clientKey,
+		Name:     "agent-net-client",
+		DNSLabel: "agent-net-client",
+		Meta:     nbpeer.PeerSystemMeta{Hostname: "agent-net-client", GoOS: "linux", WtVersion: "development"},
+	}
+	addedClient, _, _, _, err := am.AddPeer(ctx, "", "", adminUserID, clientPeer, false)
+	require.NoError(t, err, "AddPeer must add the client peer")
+
+	// Inject a connected embedded proxy peer + put the client in the source group.
+	account, err = am.Store.GetAccount(ctx, accountID)
+	require.NoError(t, err)
+	account.Peers[proxyPeerID] = &nbpeer.Peer{
+		ID:        proxyPeerID,
+		AccountID: accountID,
+		Key:       proxyPeerKey,
+		IP:        netip.MustParseAddr(proxyIP),
+		Status:    &nbpeer.PeerStatus{Connected: true, LastSeen: time.Now().UTC()},
+		ProxyMeta: nbpeer.ProxyMeta{Embedded: true, Cluster: clusterAddr},
+		DNSLabel:  "agent-net-proxy",
+	}
+	account.Groups[groupAID] = &types.Group{ID: groupAID, Name: "groupA", Peers: []string{addedClient.ID}}
+	require.NoError(t, am.Store.SaveAccount(ctx, account), "SaveAccount must persist proxy peer + group")
+
+	// Subscribe to BOTH peers' update channels — this is how we observe the
+	// real fan-out.
+	clientCh := updateManager.CreateChannel(ctx, addedClient.ID)
+	proxyCh := updateManager.CreateChannel(ctx, proxyPeerID)
+	t.Cleanup(func() {
+		updateManager.CloseChannel(ctx, addedClient.ID)
+		updateManager.CloseChannel(ctx, proxyPeerID)
+	})
+	drain(clientCh)
+	drain(proxyCh)
+
+	// Real agentnetwork manager wired to the real account manager. proxyController
+	// is nil (no gRPC cluster fan-out here) — the reconcile still fires
+	// UpdateAccountPeers, which is the path under test.
+	agentMgr := agentnetwork.NewManager(am.Store, permissions.NewManager(am.Store), am, nil)
+
+	provider, err := agentMgr.CreateProvider(ctx, adminUserID, &agenttypes.Provider{
+		AccountID:   accountID,
+		ProviderID:  "openai_api",
+		Name:        "openai-test",
+		UpstreamURL: "https://api.openai.com",
+		APIKey:      "sk-test-key",
+		Enabled:     true,
+		Models:      []agenttypes.ProviderModel{{ID: "gpt-5.4"}},
+	}, clusterAddr)
+	require.NoError(t, err, "CreateProvider must succeed")
+
+	policy, err := agentMgr.CreatePolicy(ctx, adminUserID, &agenttypes.Policy{
+		AccountID:              accountID,
+		Name:                   "p1",
+		Enabled:                true,
+		SourceGroups:           []string{groupAID},
+		DestinationProviderIDs: []string{provider.ID},
+	})
+	require.NoError(t, err, "CreatePolicy must succeed")
+
+	settings, err := am.Store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
+	require.NoError(t, err)
+	fqdn := settings.Endpoint()
+
+	// Both peers must receive a fan-out. The provider-create reconcile fires
+	// before the policy exists (synth service then has no AccessGroups, so no
+	// zone), and the async update buffer can collapse/reorder updates — so we
+	// poll until the client's delivered map actually carries the synth record.
+	rdata := awaitZoneRData(clientCh, clusterAddr, fqdn, true)
+	assert.Equal(t, proxyIP, rdata,
+		"client peer's delivered network map must contain the synth DNS record pointing at the embedded proxy peer")
+	require.True(t, awaitUpdate(proxyCh), "embedded proxy peer must also receive a netmap update after create")
+
+	// UPDATE the provider — a new model on the existing service must still
+	// reconcile and keep the private surface routable (the live MODIFIED path).
+	provider.Models = append(provider.Models, agenttypes.ProviderModel{ID: "gpt-5.4-mini"})
+	_, err = agentMgr.UpdateProvider(ctx, adminUserID, provider)
+	require.NoError(t, err, "UpdateProvider must succeed")
+	assert.Equal(t, proxyIP, awaitZoneRData(clientCh, clusterAddr, fqdn, true),
+		"client peer must still resolve the synth record after the provider is updated")
+	require.True(t, awaitUpdate(proxyCh), "embedded proxy peer must also receive a netmap update after update")
+
+	// DELETE: detach the policy first (provider is in use), then drop the
+	// provider. Both peers update again and the synth surface disappears.
+	require.NoError(t, agentMgr.DeletePolicy(ctx, accountID, adminUserID, policy.ID), "DeletePolicy must succeed")
+	require.NoError(t, agentMgr.DeleteProvider(ctx, accountID, adminUserID, provider.ID), "DeleteProvider must succeed")
+
+	require.True(t, awaitUpdate(proxyCh), "embedded proxy peer must also receive a netmap update after delete")
+	assert.Empty(t, awaitZoneRData(clientCh, clusterAddr, fqdn, false),
+		"synth DNS record must be gone from the client's map after the provider is deleted")
+}
+
+// awaitZoneRData drains the channel for up to 8s. When wantPresent is true it
+// returns as soon as the synth record appears (its RData). When false it drains
+// to quiescence and returns the RData of the last delivered map (expected empty
+// once the provider is gone), tolerating stale buffered updates that still
+// carry the zone.
+func awaitZoneRData(ch <-chan *networkmap.UpdateMessage, clusterAddr, fqdn string, wantPresent bool) string {
+	deadline := time.After(8 * time.Second)
+	last := ""
+	for {
+		select {
+		case m := <-ch:
+			if m == nil {
+				continue
+			}
+			last = synthZoneRData(m.Update, clusterAddr, fqdn)
+			if wantPresent && last != "" {
+				return last
+			}
+		case <-time.After(750 * time.Millisecond):
+			return last
+		case <-deadline:
+			return last
+		}
+	}
+}
+
+// awaitUpdate reports whether at least one update arrives within the window.
+func awaitUpdate(ch <-chan *networkmap.UpdateMessage) bool {
+	select {
+	case m := <-ch:
+		return m != nil
+	case <-time.After(5 * time.Second):
+		return false
+	}
+}
+
+// drain empties any buffered updates (e.g. from AddPeer/SaveAccount) so the
+// next observation reflects the operation under test.
+func drain(ch <-chan *networkmap.UpdateMessage) {
+	for {
+		select {
+		case <-ch:
+		case <-time.After(200 * time.Millisecond):
+			return
+		}
+	}
+}
+
+// synthZoneRData returns the RData of the synth A record (record name == fqdn)
+// inside the cluster's custom zone, or "" when absent.
+func synthZoneRData(sync *nbproto.SyncResponse, clusterAddr, fqdn string) string {
+	if sync == nil {
+		return ""
+	}
+	for _, zone := range sync.GetNetworkMap().GetDNSConfig().GetCustomZones() {
+		if zone.GetDomain() != dns.Fqdn(clusterAddr) {
+			continue
+		}
+		for _, rec := range zone.GetRecords() {
+			if rec.GetName() == dns.Fqdn(fqdn) {
+				return rec.GetRData()
+			}
+		}
+	}
+	return ""
+}
diff --git a/management/server/http/handler.go b/management/server/http/handler.go
index 0abdb854d..a57f44b3c 100644
--- a/management/server/http/handler.go
+++ b/management/server/http/handler.go
@@ -23,6 +23,8 @@ import (
 	idpmanager "github.com/netbirdio/netbird/management/server/idp"
 
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
+	agentnetworkhandlers "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/handlers"
 	"github.com/netbirdio/netbird/management/internals/modules/zones"
 	zonesManager "github.com/netbirdio/netbird/management/internals/modules/zones/manager"
 	"github.com/netbirdio/netbird/management/internals/modules/zones/records"
@@ -59,7 +61,7 @@ import (
 )
 
 // NewAPIHandler creates the Management service HTTP API handler registering all the available endpoints.
-func NewAPIHandler(ctx context.Context, router *mux.Router, accountManager account.Manager, networksManager nbnetworks.Manager, resourceManager resources.Manager, routerManager routers.Manager, groupsManager nbgroups.Manager, LocationManager geolocation.Geolocation, authManager auth.Manager, appMetrics telemetry.AppMetrics, permissionsManager permissions.Manager, settingsManager settings.Manager, zManager zones.Manager, rManager records.Manager, networkMapController network_map.Controller, idpManager idpmanager.Manager, serviceManager service.Manager, reverseProxyDomainManager *manager.Manager, reverseProxyAccessLogsManager accesslogs.Manager, proxyGRPCServer *nbgrpc.ProxyServiceServer, trustedHTTPProxies []netip.Prefix, rateLimiter *middleware.APIRateLimiter, isValidChildAccount middleware.IsValidChildAccountFunc) (http.Handler, error) {
+func NewAPIHandler(ctx context.Context, router *mux.Router, accountManager account.Manager, networksManager nbnetworks.Manager, resourceManager resources.Manager, routerManager routers.Manager, groupsManager nbgroups.Manager, LocationManager geolocation.Geolocation, authManager auth.Manager, appMetrics telemetry.AppMetrics, permissionsManager permissions.Manager, settingsManager settings.Manager, zManager zones.Manager, rManager records.Manager, networkMapController network_map.Controller, idpManager idpmanager.Manager, serviceManager service.Manager, reverseProxyDomainManager *manager.Manager, reverseProxyAccessLogsManager accesslogs.Manager, proxyGRPCServer *nbgrpc.ProxyServiceServer, trustedHTTPProxies []netip.Prefix, rateLimiter *middleware.APIRateLimiter, isValidChildAccount middleware.IsValidChildAccountFunc, agentNetworkManager agentnetwork.Manager) (http.Handler, error) {
 
 	// Register bypass paths for unauthenticated endpoints
 	if err := bypass.AddBypassPath("/api/instance"); err != nil {
@@ -124,6 +126,9 @@ func NewAPIHandler(ctx context.Context, router *mux.Router, accountManager accou
 	zonesManager.RegisterEndpoints(router, zManager)
 	recordsManager.RegisterEndpoints(router, rManager)
 	idp.AddEndpoints(accountManager, router)
+	if agentNetworkManager != nil {
+		agentnetworkhandlers.RegisterEndpoints(agentNetworkManager, router)
+	}
 	instance.AddEndpoints(instanceManager, accountManager, router)
 	instance.AddVersionEndpoint(instanceManager, router)
 	if serviceManager != nil && reverseProxyDomainManager != nil {
diff --git a/management/server/http/testing/testing_tools/channel/channel.go b/management/server/http/testing/testing_tools/channel/channel.go
index 61584a615..8b05b2ddf 100644
--- a/management/server/http/testing/testing_tools/channel/channel.go
+++ b/management/server/http/testing/testing_tools/channel/channel.go
@@ -137,7 +137,7 @@ func BuildApiBlackBoxWithDBState(t testing_tools.TB, sqlFile string, expectedPee
 	zoneRecordsManager := recordsManager.NewManager(store, am, permissionsManager)
 
 	apiRouter := mux.NewRouter().PathPrefix("/api").Subrouter()
-	apiHandler, err := http2.NewAPIHandler(context.Background(), apiRouter, am, networksManager, resourcesManager, routersManager, groupsManager, geoMock, authManagerMock, metrics, permissionsManager, settingsManager, customZonesManager, zoneRecordsManager, networkMapController, nil, serviceManager, nil, nil, nil, nil, nil, nil)
+	apiHandler, err := http2.NewAPIHandler(context.Background(), apiRouter, am, networksManager, resourcesManager, routersManager, groupsManager, geoMock, authManagerMock, metrics, permissionsManager, settingsManager, customZonesManager, zoneRecordsManager, networkMapController, nil, serviceManager, nil, nil, nil, nil, nil, nil, nil)
 	if err != nil {
 		t.Fatalf("Failed to create API handler: %v", err)
 	}
@@ -267,7 +267,7 @@ func BuildApiBlackBoxWithDBStateAndPeerChannel(t testing_tools.TB, sqlFile strin
 	zoneRecordsManager := recordsManager.NewManager(store, am, permissionsManager)
 
 	apiRouter := mux.NewRouter().PathPrefix("/api").Subrouter()
-	apiHandler, err := http2.NewAPIHandler(context.Background(), apiRouter, am, networksManager, resourcesManager, routersManager, groupsManager, geoMock, authManagerMock, metrics, permissionsManager, settingsManager, customZonesManager, zoneRecordsManager, networkMapController, nil, serviceManager, nil, nil, nil, nil, nil, nil)
+	apiHandler, err := http2.NewAPIHandler(context.Background(), apiRouter, am, networksManager, resourcesManager, routersManager, groupsManager, geoMock, authManagerMock, metrics, permissionsManager, settingsManager, customZonesManager, zoneRecordsManager, networkMapController, nil, serviceManager, nil, nil, nil, nil, nil, nil, nil)
 	if err != nil {
 		t.Fatalf("Failed to create API handler: %v", err)
 	}
diff --git a/management/server/metrics/selfhosted.go b/management/server/metrics/selfhosted.go
index efe50c88f..43fbec15d 100644
--- a/management/server/metrics/selfhosted.go
+++ b/management/server/metrics/selfhosted.go
@@ -55,6 +55,7 @@ type DataSource interface {
 	GetStoreEngine() types.Engine
 	GetCustomDomainsCounts(ctx context.Context) (total int64, validated int64, err error)
 	GetProxyMetrics(ctx context.Context) (store.ProxyMetrics, error)
+	GetAgentNetworkMetrics(ctx context.Context) (store.AgentNetworkMetrics, error)
 }
 
 // ConnManager peer connection manager that holds state for current active connections
@@ -413,6 +414,13 @@ func (w *Worker) generateProperties(ctx context.Context) properties {
 		log.WithContext(ctx).Debugf("collect proxy metrics: %v", err)
 	}
 
+	// Agent-network adoption + usage, aggregated across all accounts in a few
+	// cheap queries; nil on FileStore.
+	agentNetworkMetrics, err := w.dataSource.GetAgentNetworkMetrics(ctx)
+	if err != nil {
+		log.WithContext(ctx).Debugf("collect agent network metrics: %v", err)
+	}
+
 	minActivePeerVersion, maxActivePeerVersion := getMinMaxVersion(peerActiveVersions)
 	metricsProperties["uptime"] = uptime
 	metricsProperties["accounts"] = accounts
@@ -471,6 +479,14 @@ func (w *Worker) generateProperties(ctx context.Context) properties {
 	metricsProperties["proxies_connected"] = proxyMetrics.ProxiesConnected
 	metricsProperties["custom_domains"] = customDomains
 	metricsProperties["custom_domains_validated"] = customDomainsValidated
+	metricsProperties["agent_network_accounts"] = agentNetworkMetrics.Accounts
+	metricsProperties["agent_network_providers"] = agentNetworkMetrics.Providers
+	metricsProperties["agent_network_policies"] = agentNetworkMetrics.Policies
+	metricsProperties["agent_network_budget_rules"] = agentNetworkMetrics.BudgetRules
+	metricsProperties["agent_network_log_collection_enabled"] = agentNetworkMetrics.LogCollectionEnabled
+	metricsProperties["agent_network_input_tokens"] = agentNetworkMetrics.InputTokens
+	metricsProperties["agent_network_output_tokens"] = agentNetworkMetrics.OutputTokens
+	metricsProperties["agent_network_cost_usd"] = agentNetworkMetrics.CostUSD
 
 	for targetType, count := range servicesTargetType {
 		metricsProperties["services_target_type_"+string(targetType)] = count
diff --git a/management/server/metrics/selfhosted_test.go b/management/server/metrics/selfhosted_test.go
index ca9e10262..1fef89a2c 100644
--- a/management/server/metrics/selfhosted_test.go
+++ b/management/server/metrics/selfhosted_test.go
@@ -277,6 +277,21 @@ func (mockDatasource) GetProxyMetrics(_ context.Context) (store.ProxyMetrics, er
 	}, nil
 }
 
+// GetAgentNetworkMetrics returns canned agent-network counts so the
+// generateProperties test can assert the adoption/usage signals end-to-end.
+func (mockDatasource) GetAgentNetworkMetrics(_ context.Context) (store.AgentNetworkMetrics, error) {
+	return store.AgentNetworkMetrics{
+		Accounts:             2,
+		Providers:            5,
+		Policies:             3,
+		BudgetRules:          1,
+		LogCollectionEnabled: 2,
+		InputTokens:          1000,
+		OutputTokens:         500,
+		CostUSD:              1.25,
+	}, nil
+}
+
 // TestGenerateProperties tests and validate the properties generation by using the mockDatasource for the Worker.generateProperties
 func TestGenerateProperties(t *testing.T) {
 	ds := mockDatasource{}
diff --git a/management/server/permissions/modules/module.go b/management/server/permissions/modules/module.go
index 93007d4c1..a3a9c554d 100644
--- a/management/server/permissions/modules/module.go
+++ b/management/server/permissions/modules/module.go
@@ -19,6 +19,7 @@ const (
 	Pats              Module = "pats"
 	IdentityProviders Module = "identity_providers"
 	Services          Module = "services"
+	AgentNetwork      Module = "agent_network"
 )
 
 var All = map[Module]struct{}{
@@ -38,4 +39,5 @@ var All = map[Module]struct{}{
 	Pats:              {},
 	IdentityProviders: {},
 	Services:          {},
+	AgentNetwork:      {},
 }
diff --git a/management/server/store/file_store.go b/management/server/store/file_store.go
index bcf563cd0..a776a8b42 100644
--- a/management/server/store/file_store.go
+++ b/management/server/store/file_store.go
@@ -280,3 +280,9 @@ func (s *FileStore) GetCustomDomainsCounts(_ context.Context) (int64, int64, err
 func (s *FileStore) GetProxyMetrics(_ context.Context) (ProxyMetrics, error) {
 	return ProxyMetrics{}, nil
 }
+
+// GetAgentNetworkMetrics is a no-op for FileStore — agent-network state isn't
+// persisted in the JSON file format.
+func (s *FileStore) GetAgentNetworkMetrics(_ context.Context) (AgentNetworkMetrics, error) {
+	return AgentNetworkMetrics{}, nil
+}
diff --git a/management/server/store/sql_store.go b/management/server/store/sql_store.go
index 8bc4bcd7d..18be1b6ed 100644
--- a/management/server/store/sql_store.go
+++ b/management/server/store/sql_store.go
@@ -33,6 +33,7 @@ import (
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
 
+	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/netbirdio/netbird/management/internals/modules/zones"
@@ -137,6 +138,10 @@ func NewSqlStore(ctx context.Context, db *gorm.DB, storeEngine types.Engine, met
 		&networkTypes.Network{}, &routerTypes.NetworkRouter{}, &resourceTypes.NetworkResource{}, &types.AccountOnboarding{},
 		&types.Job{}, &zones.Zone{}, &records.Record{}, &types.UserInviteRecord{}, &rpservice.Service{}, &rpservice.Target{}, &domain.Domain{},
 		&accesslogs.AccessLogEntry{}, &proxy.Proxy{},
+		&agentNetworkTypes.Provider{}, &agentNetworkTypes.Policy{}, &agentNetworkTypes.Guardrail{}, &agentNetworkTypes.Settings{},
+		&agentNetworkTypes.Consumption{}, &agentNetworkTypes.AccountBudgetRule{},
+		&agentNetworkTypes.AgentNetworkAccessLog{}, &agentNetworkTypes.AgentNetworkAccessLogGroup{},
+		&agentNetworkTypes.AgentNetworkUsage{}, &agentNetworkTypes.AgentNetworkUsageGroup{},
 	)
 	if err != nil {
 		return nil, fmt.Errorf("auto migratePreAuto: %w", err)
@@ -5573,6 +5578,340 @@ func (s *SqlStore) CreateAccessLog(ctx context.Context, logEntry *accesslogs.Acc
 	return nil
 }
 
+// CreateAgentNetworkAccessLog persists a flattened agent-network access-log
+// entry together with its authorising-group child rows in a single
+// transaction.
+func (s *SqlStore) CreateAgentNetworkAccessLog(ctx context.Context, entry *agentNetworkTypes.AgentNetworkAccessLog, groups []agentNetworkTypes.AgentNetworkAccessLogGroup) error {
+	err := s.db.Transaction(func(tx *gorm.DB) error {
+		// Idempotent on the log id / (log_id, group_id) so a proxy resend of the
+		// same entry can't fail the request.
+		if err := tx.Clauses(clause.OnConflict{DoNothing: true}).Create(entry).Error; err != nil {
+			return err
+		}
+		if len(groups) > 0 {
+			if err := tx.Clauses(clause.OnConflict{DoNothing: true}).Create(&groups).Error; err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		log.WithContext(ctx).WithFields(log.Fields{
+			"account_id": entry.AccountID,
+			"service_id": entry.ServiceID,
+			"model":      entry.Model,
+		}).Errorf("failed to create agent-network access log entry in store: %v", err)
+		return status.Errorf(status.Internal, "failed to create agent-network access log entry in store")
+	}
+	return nil
+}
+
+// CreateAgentNetworkUsage persists a stripped agent-network usage record
+// together with its authorising-group child rows in a single transaction.
+func (s *SqlStore) CreateAgentNetworkUsage(ctx context.Context, usage *agentNetworkTypes.AgentNetworkUsage, groups []agentNetworkTypes.AgentNetworkUsageGroup) error {
+	err := s.db.Transaction(func(tx *gorm.DB) error {
+		// Idempotent on the usage id / (usage_id, group_id) so a proxy resend of
+		// the same entry can't fail the request.
+		if err := tx.Clauses(clause.OnConflict{DoNothing: true}).Create(usage).Error; err != nil {
+			return err
+		}
+		if len(groups) > 0 {
+			if err := tx.Clauses(clause.OnConflict{DoNothing: true}).Create(&groups).Error; err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		log.WithContext(ctx).WithFields(log.Fields{
+			"account_id": usage.AccountID,
+			"model":      usage.Model,
+		}).Errorf("failed to create agent-network usage record in store: %v", err)
+		return status.Errorf(status.Internal, "failed to create agent-network usage record in store")
+	}
+	return nil
+}
+
+// DeleteOldAgentNetworkAccessLogs deletes an account's access-log rows (and
+// their authorising-group child rows) older than the cutoff. Usage records are
+// untouched — they are the long-term aggregate. Returns the number of log rows
+// deleted.
+func (s *SqlStore) DeleteOldAgentNetworkAccessLogs(ctx context.Context, accountID string, olderThan time.Time) (int64, error) {
+	var deleted int64
+	err := s.db.Transaction(func(tx *gorm.DB) error {
+		// Remove group child rows for the soon-to-be-deleted logs first.
+		if err := tx.Exec(
+			"DELETE FROM agent_network_access_log_group WHERE account_id = ? AND log_id IN (SELECT id FROM agent_network_access_log WHERE account_id = ? AND timestamp < ?)",
+			accountID, accountID, olderThan,
+		).Error; err != nil {
+			return err
+		}
+		res := tx.Where("account_id = ? AND timestamp < ?", accountID, olderThan).
+			Delete(&agentNetworkTypes.AgentNetworkAccessLog{})
+		if res.Error != nil {
+			return res.Error
+		}
+		deleted = res.RowsAffected
+		return nil
+	})
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to delete old agent-network access logs for account %s: %v", accountID, err)
+		return 0, status.Errorf(status.Internal, "failed to delete old agent-network access logs")
+	}
+	return deleted, nil
+}
+
+// GetAgentNetworkUsageRows returns the stripped usage rows for an account that
+// match the filter (date / user / group / provider / model). Aggregation into
+// time buckets happens in the manager so granularities stay engine-portable.
+func (s *SqlStore) GetAgentNetworkUsageRows(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkUsage, error) {
+	var rows []*agentNetworkTypes.AgentNetworkUsage
+
+	query := s.applyAgentNetworkUsageFilters(
+		s.db.Where(accountIDCondition, accountID),
+		filter,
+	).Order("timestamp ASC")
+
+	if lockStrength != LockingStrengthNone {
+		query = query.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	if err := query.Find(&rows).Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to get agent-network usage rows from store: %v", err)
+		return nil, status.Errorf(status.Internal, "failed to get agent-network usage rows from store")
+	}
+	return rows, nil
+}
+
+// applyAgentNetworkUsageFilters applies the shared access-log filter's
+// date/user/group/provider/model conditions to a usage-table query. Pagination,
+// sort and free-text search are ignored — the overview is an aggregate.
+func (s *SqlStore) applyAgentNetworkUsageFilters(query *gorm.DB, filter agentNetworkTypes.AgentNetworkAccessLogFilter) *gorm.DB {
+	if filter.UserID != nil {
+		query = query.Where("user_id = ?", *filter.UserID)
+	}
+	if filter.SessionID != nil {
+		query = query.Where("session_id = ?", *filter.SessionID)
+	}
+	if len(filter.ProviderIDs) > 0 {
+		query = query.Where("resolved_provider_id IN ?", filter.ProviderIDs)
+	}
+	if len(filter.Models) > 0 {
+		query = query.Where("model IN ?", filter.Models)
+	}
+	if len(filter.GroupIDs) > 0 {
+		query = query.Where(
+			"id IN (SELECT usage_id FROM agent_network_request_usage_group WHERE group_id IN ?)",
+			filter.GroupIDs,
+		)
+	}
+	if filter.StartDate != nil {
+		query = query.Where("timestamp >= ?", *filter.StartDate)
+	}
+	if filter.EndDate != nil {
+		query = query.Where("timestamp <= ?", *filter.EndDate)
+	}
+	return query
+}
+
+// GetAgentNetworkAccessLogs retrieves flattened agent-network access logs for
+// an account with server-side pagination, filtering and sorting. Authorising
+// group ids are hydrated from the group child table for the returned page.
+func (s *SqlStore) GetAgentNetworkAccessLogs(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkAccessLog, int64, error) {
+	var logs []*agentNetworkTypes.AgentNetworkAccessLog
+	var totalCount int64
+
+	countQuery := s.applyAgentNetworkAccessLogFilters(
+		s.db.Model(&agentNetworkTypes.AgentNetworkAccessLog{}).Where(accountIDCondition, accountID),
+		filter,
+	)
+	if err := countQuery.Count(&totalCount).Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to count agent-network access logs: %v", err)
+		return nil, 0, status.Errorf(status.Internal, "failed to count agent-network access logs")
+	}
+
+	query := s.applyAgentNetworkAccessLogFilters(
+		s.db.Where(accountIDCondition, accountID),
+		filter,
+	).
+		Order(filter.GetSortColumn() + " " + filter.GetSortOrder()).
+		Limit(filter.GetLimit()).
+		Offset(filter.GetOffset())
+
+	if lockStrength != LockingStrengthNone {
+		query = query.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	if err := query.Find(&logs).Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to get agent-network access logs from store: %v", err)
+		return nil, 0, status.Errorf(status.Internal, "failed to get agent-network access logs from store")
+	}
+
+	if err := s.hydrateAgentNetworkAccessLogGroups(ctx, accountID, logs); err != nil {
+		return nil, 0, err
+	}
+
+	return logs, totalCount, nil
+}
+
+// applyAgentNetworkAccessLogFilters applies the filter conditions to a query.
+func (s *SqlStore) applyAgentNetworkAccessLogFilters(query *gorm.DB, filter agentNetworkTypes.AgentNetworkAccessLogFilter) *gorm.DB {
+	if filter.Search != nil {
+		p := "%" + *filter.Search + "%"
+		query = query.Where(
+			"id LIKE ? OR host LIKE ? OR path LIKE ? OR model LIKE ? OR user_id IN (SELECT id FROM users WHERE email LIKE ? OR name LIKE ?)",
+			p, p, p, p, p, p,
+		)
+	}
+	if filter.UserID != nil {
+		query = query.Where("user_id = ?", *filter.UserID)
+	}
+	if filter.SessionID != nil {
+		query = query.Where("session_id = ?", *filter.SessionID)
+	}
+	if filter.Decision != nil {
+		query = query.Where("decision = ?", *filter.Decision)
+	}
+	if filter.PathPrefix != nil {
+		query = query.Where("path LIKE ?", *filter.PathPrefix+"%")
+	}
+	if len(filter.ProviderIDs) > 0 {
+		query = query.Where("resolved_provider_id IN ?", filter.ProviderIDs)
+	}
+	if len(filter.Models) > 0 {
+		query = query.Where("model IN ?", filter.Models)
+	}
+	if len(filter.GroupIDs) > 0 {
+		query = query.Where(
+			"id IN (SELECT log_id FROM agent_network_access_log_group WHERE group_id IN ?)",
+			filter.GroupIDs,
+		)
+	}
+	if filter.StartDate != nil {
+		query = query.Where("timestamp >= ?", *filter.StartDate)
+	}
+	if filter.EndDate != nil {
+		query = query.Where("timestamp <= ?", *filter.EndDate)
+	}
+	return query
+}
+
+// hydrateAgentNetworkAccessLogGroups loads the authorising group ids for the
+// given page of entries and assigns them onto each entry's GroupIDs field.
+func (s *SqlStore) hydrateAgentNetworkAccessLogGroups(ctx context.Context, accountID string, logs []*agentNetworkTypes.AgentNetworkAccessLog) error {
+	if len(logs) == 0 {
+		return nil
+	}
+
+	ids := make([]string, 0, len(logs))
+	for _, l := range logs {
+		ids = append(ids, l.ID)
+	}
+
+	var rows []agentNetworkTypes.AgentNetworkAccessLogGroup
+	if err := s.db.
+		Where(accountIDCondition, accountID).
+		Where("log_id IN ?", ids).
+		Find(&rows).Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to hydrate agent-network access log groups: %v", err)
+		return status.Errorf(status.Internal, "failed to hydrate agent-network access log groups")
+	}
+
+	byLog := make(map[string][]string, len(logs))
+	for _, r := range rows {
+		byLog[r.LogID] = append(byLog[r.LogID], r.GroupID)
+	}
+	for _, l := range logs {
+		l.GroupIDs = byLog[l.ID]
+	}
+	return nil
+}
+
+// agentNetworkSessionKeyExpr is the SQL group key for session-grouped access
+// logs: the row's session id, or — when the client sent none — the row id, so
+// session-less requests each form their own singleton group. COALESCE/NULLIF
+// are standard SQL, so this stays portable across SQLite and Postgres.
+const agentNetworkSessionKeyExpr = "COALESCE(NULLIF(session_id, ''), id)"
+
+// GetAgentNetworkAccessLogSessions retrieves agent-network access logs grouped
+// by session, with server-side pagination, filtering and sorting at the session
+// level. It paginates over the distinct session keys (ordered by the requested
+// session-level aggregate), fetches every entry for the page's sessions, and
+// folds them into per-session summaries. The returned count is the number of
+// matching sessions. Filters apply to the entries, so a session's summary
+// reflects only its filter-matching requests.
+func (s *SqlStore) GetAgentNetworkAccessLogSessions(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkAccessLogSession, int64, error) {
+	// Count distinct sessions via a grouped subquery — portable and avoids
+	// relying on COUNT(DISTINCT <expr>) quoting quirks.
+	sessionsSubquery := s.applyAgentNetworkAccessLogFilters(
+		s.db.Model(&agentNetworkTypes.AgentNetworkAccessLog{}).Where(accountIDCondition, accountID),
+		filter,
+	).
+		Select(agentNetworkSessionKeyExpr + " AS session_key").
+		Group(agentNetworkSessionKeyExpr)
+
+	var totalCount int64
+	if err := s.db.Table("(?) AS sessions", sessionsSubquery).Count(&totalCount).Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to count agent-network access-log sessions: %v", err)
+		return nil, 0, status.Errorf(status.Internal, "failed to count agent-network access-log sessions")
+	}
+
+	// The page of session keys, ordered by the session-level aggregate. The
+	// session-key tiebreaker keeps pagination deterministic when the primary
+	// aggregate ties.
+	type sessionKeyRow struct {
+		SessionKey string
+	}
+	var keyRows []sessionKeyRow
+	keyQuery := s.applyAgentNetworkAccessLogFilters(
+		s.db.Model(&agentNetworkTypes.AgentNetworkAccessLog{}).Where(accountIDCondition, accountID),
+		filter,
+	).
+		Select(agentNetworkSessionKeyExpr + " AS session_key").
+		Group(agentNetworkSessionKeyExpr).
+		Order(filter.GetSessionSortExpr() + " " + filter.GetSortOrder()).
+		Order("session_key ASC").
+		Limit(filter.GetLimit()).
+		Offset(filter.GetOffset())
+	if err := keyQuery.Scan(&keyRows).Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to list agent-network access-log session keys: %v", err)
+		return nil, 0, status.Errorf(status.Internal, "failed to list agent-network access-log session keys")
+	}
+	if len(keyRows) == 0 {
+		return nil, totalCount, nil
+	}
+
+	keys := make([]string, 0, len(keyRows))
+	for _, r := range keyRows {
+		keys = append(keys, r.SessionKey)
+	}
+
+	// All entries for the page's sessions, contiguous per session and oldest
+	// first within each — the fold relies on that ordering.
+	var entries []*agentNetworkTypes.AgentNetworkAccessLog
+	entriesQuery := s.applyAgentNetworkAccessLogFilters(
+		s.db.Where(accountIDCondition, accountID),
+		filter,
+	).
+		Where(agentNetworkSessionKeyExpr+" IN ?", keys).
+		Order(agentNetworkSessionKeyExpr + ", timestamp ASC")
+
+	if lockStrength != LockingStrengthNone {
+		entriesQuery = entriesQuery.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	if err := entriesQuery.Find(&entries).Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to get agent-network access-log session entries: %v", err)
+		return nil, 0, status.Errorf(status.Internal, "failed to get agent-network access-log session entries")
+	}
+
+	if err := s.hydrateAgentNetworkAccessLogGroups(ctx, accountID, entries); err != nil {
+		return nil, 0, err
+	}
+
+	return agentNetworkTypes.FoldAccessLogSessions(keys, entries), totalCount, nil
+}
+
 // GetAccountAccessLogs retrieves access logs for a given account with pagination and filtering
 func (s *SqlStore) GetAccountAccessLogs(ctx context.Context, lockStrength LockingStrength, accountID string, filter accesslogs.AccessLogFilter) ([]*accesslogs.AccessLogEntry, int64, error) {
 	var logs []*accesslogs.AccessLogEntry
diff --git a/management/server/store/sql_store_agentnetwork.go b/management/server/store/sql_store_agentnetwork.go
new file mode 100644
index 000000000..b0df0cd2a
--- /dev/null
+++ b/management/server/store/sql_store_agentnetwork.go
@@ -0,0 +1,664 @@
+package store
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"math"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// GetAllAgentNetworkProviders returns Agent Network providers across
+// every account. Used by the synthesizer to build the global service map.
+func (s *SqlStore) GetAllAgentNetworkProviders(ctx context.Context, lockStrength LockingStrength) ([]*agentNetworkTypes.Provider, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var providers []*agentNetworkTypes.Provider
+	if result := tx.Find(&providers); result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get all agent network providers from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get all agent network providers from store")
+	}
+
+	for _, provider := range providers {
+		if err := provider.DecryptSensitiveData(s.fieldEncrypt); err != nil {
+			log.WithContext(ctx).Errorf("failed to decrypt agent network provider %s: %v", provider.ID, err)
+			return nil, status.Errorf(status.Internal, "failed to decrypt agent network provider")
+		}
+	}
+
+	return providers, nil
+}
+
+// GetAgentNetworkMetrics returns aggregated agent-network adoption + usage
+// counts for the self-hosted metrics worker. Each value is a single cheap
+// aggregate; token/cost are summed over the always-collected per-request usage
+// ledger (independent of the log-collection toggle) so they reflect real usage.
+func (s *SqlStore) GetAgentNetworkMetrics(ctx context.Context) (AgentNetworkMetrics, error) {
+	var m AgentNetworkMetrics
+	db := s.db.WithContext(ctx)
+
+	// Providers + distinct adopting accounts in one round-trip.
+	provRow := db.Model(&agentNetworkTypes.Provider{}).
+		Select("COUNT(*) AS providers, COUNT(DISTINCT account_id) AS accounts").Row()
+	if err := provRow.Scan(&m.Providers, &m.Accounts); err != nil {
+		return AgentNetworkMetrics{}, fmt.Errorf("scan agent network provider metrics: %w", err)
+	}
+
+	if err := db.Model(&agentNetworkTypes.Policy{}).Count(&m.Policies).Error; err != nil {
+		return AgentNetworkMetrics{}, fmt.Errorf("count agent network policies: %w", err)
+	}
+
+	if err := db.Model(&agentNetworkTypes.AccountBudgetRule{}).Count(&m.BudgetRules).Error; err != nil {
+		return AgentNetworkMetrics{}, fmt.Errorf("count agent network budget rules: %w", err)
+	}
+
+	if err := db.Model(&agentNetworkTypes.Settings{}).
+		Where("enable_log_collection = ?", true).Count(&m.LogCollectionEnabled).Error; err != nil {
+		return AgentNetworkMetrics{}, fmt.Errorf("count agent network log-collection accounts: %w", err)
+	}
+
+	// COALESCE so an empty ledger scans as 0 instead of NULL.
+	usageRow := db.Model(&agentNetworkTypes.AgentNetworkUsage{}).
+		Select("COALESCE(SUM(input_tokens), 0) AS input_tokens, " +
+			"COALESCE(SUM(output_tokens), 0) AS output_tokens, " +
+			"COALESCE(SUM(cost_usd), 0) AS cost_usd").Row()
+	if err := usageRow.Scan(&m.InputTokens, &m.OutputTokens, &m.CostUSD); err != nil {
+		return AgentNetworkMetrics{}, fmt.Errorf("scan agent network usage metrics: %w", err)
+	}
+
+	return m, nil
+}
+
+func (s *SqlStore) GetAccountAgentNetworkProviders(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.Provider, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var providers []*agentNetworkTypes.Provider
+	result := tx.Find(&providers, accountIDCondition, accountID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get agent network providers from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get agent network providers from store")
+	}
+
+	for _, provider := range providers {
+		if err := provider.DecryptSensitiveData(s.fieldEncrypt); err != nil {
+			log.WithContext(ctx).Errorf("failed to decrypt agent network provider %s: %v", provider.ID, err)
+			return nil, status.Errorf(status.Internal, "failed to decrypt agent network provider")
+		}
+	}
+
+	return providers, nil
+}
+
+func (s *SqlStore) GetAgentNetworkProviderByID(ctx context.Context, lockStrength LockingStrength, accountID, providerID string) (*agentNetworkTypes.Provider, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var provider *agentNetworkTypes.Provider
+	result := tx.Take(&provider, accountAndIDQueryCondition, accountID, providerID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.NewAgentNetworkProviderNotFoundError(providerID)
+		}
+
+		log.WithContext(ctx).Errorf("failed to get agent network provider from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get agent network provider from store")
+	}
+
+	if err := provider.DecryptSensitiveData(s.fieldEncrypt); err != nil {
+		log.WithContext(ctx).Errorf("failed to decrypt agent network provider %s: %v", provider.ID, err)
+		return nil, status.Errorf(status.Internal, "failed to decrypt agent network provider")
+	}
+
+	return provider, nil
+}
+
+func (s *SqlStore) SaveAgentNetworkProvider(ctx context.Context, provider *agentNetworkTypes.Provider) error {
+	providerCopy := provider.Copy()
+	if err := providerCopy.EncryptSensitiveData(s.fieldEncrypt); err != nil {
+		log.WithContext(ctx).Errorf("failed to encrypt agent network provider %s: %v", provider.ID, err)
+		return status.Errorf(status.Internal, "failed to encrypt agent network provider")
+	}
+
+	result := s.db.Save(providerCopy)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to save agent network provider to store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to save agent network provider to store")
+	}
+
+	return nil
+}
+
+func (s *SqlStore) DeleteAgentNetworkProvider(ctx context.Context, accountID, providerID string) error {
+	result := s.db.Delete(&agentNetworkTypes.Provider{}, accountAndIDQueryCondition, accountID, providerID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to delete agent network provider from store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to delete agent network provider from store")
+	}
+
+	if result.RowsAffected == 0 {
+		return status.NewAgentNetworkProviderNotFoundError(providerID)
+	}
+
+	return nil
+}
+
+func (s *SqlStore) GetAccountAgentNetworkPolicies(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.Policy, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var policies []*agentNetworkTypes.Policy
+	result := tx.Find(&policies, accountIDCondition, accountID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get agent network policies from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get agent network policies from store")
+	}
+
+	return policies, nil
+}
+
+func (s *SqlStore) GetAgentNetworkPolicyByID(ctx context.Context, lockStrength LockingStrength, accountID, policyID string) (*agentNetworkTypes.Policy, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var policy *agentNetworkTypes.Policy
+	result := tx.Take(&policy, accountAndIDQueryCondition, accountID, policyID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.NewAgentNetworkPolicyNotFoundError(policyID)
+		}
+
+		log.WithContext(ctx).Errorf("failed to get agent network policy from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get agent network policy from store")
+	}
+
+	return policy, nil
+}
+
+func (s *SqlStore) SaveAgentNetworkPolicy(ctx context.Context, policy *agentNetworkTypes.Policy) error {
+	result := s.db.Save(policy)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to save agent network policy to store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to save agent network policy to store")
+	}
+
+	return nil
+}
+
+func (s *SqlStore) DeleteAgentNetworkPolicy(ctx context.Context, accountID, policyID string) error {
+	result := s.db.Delete(&agentNetworkTypes.Policy{}, accountAndIDQueryCondition, accountID, policyID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to delete agent network policy from store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to delete agent network policy from store")
+	}
+
+	if result.RowsAffected == 0 {
+		return status.NewAgentNetworkPolicyNotFoundError(policyID)
+	}
+
+	return nil
+}
+
+func (s *SqlStore) GetAccountAgentNetworkGuardrails(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.Guardrail, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var guardrails []*agentNetworkTypes.Guardrail
+	result := tx.Find(&guardrails, accountIDCondition, accountID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get agent network guardrails from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get agent network guardrails from store")
+	}
+
+	return guardrails, nil
+}
+
+func (s *SqlStore) GetAgentNetworkGuardrailByID(ctx context.Context, lockStrength LockingStrength, accountID, guardrailID string) (*agentNetworkTypes.Guardrail, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var guardrail *agentNetworkTypes.Guardrail
+	result := tx.Take(&guardrail, accountAndIDQueryCondition, accountID, guardrailID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.NewAgentNetworkGuardrailNotFoundError(guardrailID)
+		}
+
+		log.WithContext(ctx).Errorf("failed to get agent network guardrail from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get agent network guardrail from store")
+	}
+
+	return guardrail, nil
+}
+
+func (s *SqlStore) SaveAgentNetworkGuardrail(ctx context.Context, guardrail *agentNetworkTypes.Guardrail) error {
+	result := s.db.Save(guardrail)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to save agent network guardrail to store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to save agent network guardrail to store")
+	}
+
+	return nil
+}
+
+func (s *SqlStore) DeleteAgentNetworkGuardrail(ctx context.Context, accountID, guardrailID string) error {
+	result := s.db.Delete(&agentNetworkTypes.Guardrail{}, accountAndIDQueryCondition, accountID, guardrailID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to delete agent network guardrail from store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to delete agent network guardrail from store")
+	}
+
+	if result.RowsAffected == 0 {
+		return status.NewAgentNetworkGuardrailNotFoundError(guardrailID)
+	}
+
+	return nil
+}
+
+// GetAgentNetworkSettings returns the per-account Agent Network
+// settings row. Returns status.NotFound when no row exists.
+func (s *SqlStore) GetAgentNetworkSettings(ctx context.Context, lockStrength LockingStrength, accountID string) (*agentNetworkTypes.Settings, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var settings agentNetworkTypes.Settings
+	result := tx.Take(&settings, "account_id = ?", accountID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.Errorf(status.NotFound, "agent network settings for account %s not found", accountID)
+		}
+
+		log.WithContext(ctx).Errorf("failed to get agent network settings from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get agent network settings from store")
+	}
+
+	return &settings, nil
+}
+
+// GetAllAgentNetworkSettings returns every account's settings row. Used by the
+// access-log retention sweep to learn each account's retention window.
+func (s *SqlStore) GetAllAgentNetworkSettings(ctx context.Context, lockStrength LockingStrength) ([]*agentNetworkTypes.Settings, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var settings []*agentNetworkTypes.Settings
+	if err := tx.Find(&settings).Error; err != nil {
+		log.WithContext(ctx).Errorf("failed to list agent network settings: %v", err)
+		return nil, status.Errorf(status.Internal, "failed to list agent network settings")
+	}
+	return settings, nil
+}
+
+// GetAgentNetworkSettingsByCluster returns every Settings row pinned to
+// the given proxy cluster. Used by the bootstrap label generator to
+// build the set of subdomains already taken on a cluster.
+func (s *SqlStore) GetAgentNetworkSettingsByCluster(ctx context.Context, lockStrength LockingStrength, cluster string) ([]*agentNetworkTypes.Settings, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var settings []*agentNetworkTypes.Settings
+	result := tx.Find(&settings, "cluster = ?", cluster)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get agent network settings by cluster from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get agent network settings by cluster from store")
+	}
+
+	return settings, nil
+}
+
+// SaveAgentNetworkSettings upserts the per-account Agent Network
+// settings row.
+func (s *SqlStore) SaveAgentNetworkSettings(ctx context.Context, settings *agentNetworkTypes.Settings) error {
+	result := s.db.Save(settings)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to save agent network settings to store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to save agent network settings to store")
+	}
+
+	return nil
+}
+
+// IncrementAgentNetworkConsumption atomically upserts the consumption
+// row keyed on (account, dim_kind, dim_id, window_seconds, window_start)
+// and adds the supplied deltas. Concurrent calls from multiple proxy
+// nodes converge — the database performs the increment server-side via
+// ON CONFLICT DO UPDATE so no read-modify-write race exists.
+func (s *SqlStore) IncrementAgentNetworkConsumption(
+	ctx context.Context,
+	accountID string,
+	kind agentNetworkTypes.ConsumptionDimension,
+	dimID string,
+	windowSeconds int64,
+	windowStart time.Time,
+	tokensIn, tokensOut int64,
+	costUSD float64,
+) error {
+	if accountID == "" || dimID == "" || windowSeconds <= 0 {
+		return status.Errorf(status.InvalidArgument, "account_id, dim_id and window_seconds must be set")
+	}
+	// Deltas are added server-side via ON CONFLICT; a negative or non-finite
+	// value would silently decrement / poison the persisted totals.
+	if tokensIn < 0 || tokensOut < 0 || costUSD < 0 || math.IsNaN(costUSD) || math.IsInf(costUSD, 0) {
+		return status.Errorf(status.InvalidArgument, "consumption deltas must be non-negative and finite")
+	}
+	row := agentNetworkTypes.Consumption{
+		AccountID:      accountID,
+		DimensionKind:  kind,
+		DimensionID:    dimID,
+		WindowSeconds:  windowSeconds,
+		WindowStartUTC: windowStart.UTC(),
+		TokensInput:    tokensIn,
+		TokensOutput:   tokensOut,
+		CostUSD:        costUSD,
+		UpdatedAt:      time.Now().UTC(),
+	}
+	const tbl = "agent_network_consumption"
+	err := s.db.Clauses(clause.OnConflict{
+		Columns: []clause.Column{
+			{Name: "account_id"},
+			{Name: "dim_kind"},
+			{Name: "dim_id"},
+			{Name: "window_seconds"},
+			{Name: "window_start_utc"},
+		},
+		DoUpdates: clause.Assignments(map[string]any{
+			"tokens_input":  gorm.Expr(tbl+".tokens_input + ?", tokensIn),
+			"tokens_output": gorm.Expr(tbl+".tokens_output + ?", tokensOut),
+			"cost_usd":      gorm.Expr(tbl+".cost_usd + ?", costUSD),
+			"updated_at":    time.Now().UTC(),
+		}),
+	}).Create(&row).Error
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to increment agent network consumption: %v", err)
+		return status.Errorf(status.Internal, "failed to increment agent network consumption")
+	}
+	return nil
+}
+
+// GetAgentNetworkConsumption returns the consumption row for the exact
+// window key. Returns a zero-valued row (not found mapped to zero) so
+// callers can use the result as the headroom basis without nil checks.
+func (s *SqlStore) GetAgentNetworkConsumption(
+	ctx context.Context,
+	lockStrength LockingStrength,
+	accountID string,
+	kind agentNetworkTypes.ConsumptionDimension,
+	dimID string,
+	windowSeconds int64,
+	windowStart time.Time,
+) (*agentNetworkTypes.Consumption, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+	var row agentNetworkTypes.Consumption
+	result := tx.Take(&row,
+		"account_id = ? AND dim_kind = ? AND dim_id = ? AND window_seconds = ? AND window_start_utc = ?",
+		accountID, kind, dimID, windowSeconds, windowStart.UTC())
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return &agentNetworkTypes.Consumption{
+				AccountID:      accountID,
+				DimensionKind:  kind,
+				DimensionID:    dimID,
+				WindowSeconds:  windowSeconds,
+				WindowStartUTC: windowStart.UTC(),
+			}, nil
+		}
+		log.WithContext(ctx).Errorf("failed to get agent network consumption: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get agent network consumption")
+	}
+	return &row, nil
+}
+
+// GetAgentNetworkConsumptionBatch reads many consumption counters for one
+// account in a single query, returning a map keyed by the exact
+// ConsumptionKey. Missing counters are simply absent from the map (callers
+// treat absence as a zero counter). Replaces the per-cap point reads the
+// policy selector previously issued one at a time.
+func (s *SqlStore) GetAgentNetworkConsumptionBatch(
+	ctx context.Context,
+	lockStrength LockingStrength,
+	accountID string,
+	keys []agentNetworkTypes.ConsumptionKey,
+) (map[agentNetworkTypes.ConsumptionKey]*agentNetworkTypes.Consumption, error) {
+	out := make(map[agentNetworkTypes.ConsumptionKey]*agentNetworkTypes.Consumption, len(keys))
+	if len(keys) == 0 {
+		return out, nil
+	}
+
+	// Collect the distinct dim ids, windows and window starts so a single
+	// query scopes to exactly the current windows in play, then filter the
+	// returned rows down to the exact requested keys.
+	wanted := make(map[agentNetworkTypes.ConsumptionKey]struct{}, len(keys))
+	dimSet := make(map[string]struct{})
+	winSet := make(map[int64]struct{})
+	startSet := make(map[time.Time]struct{})
+	for _, k := range keys {
+		k.WindowStartUTC = k.WindowStartUTC.UTC()
+		wanted[k] = struct{}{}
+		dimSet[k.DimID] = struct{}{}
+		winSet[k.WindowSeconds] = struct{}{}
+		startSet[k.WindowStartUTC] = struct{}{}
+	}
+	dimIDs := make([]string, 0, len(dimSet))
+	for d := range dimSet {
+		dimIDs = append(dimIDs, d)
+	}
+	windows := make([]int64, 0, len(winSet))
+	for w := range winSet {
+		windows = append(windows, w)
+	}
+	starts := make([]time.Time, 0, len(startSet))
+	for t := range startSet {
+		starts = append(starts, t)
+	}
+
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+	var rows []*agentNetworkTypes.Consumption
+	result := tx.Find(&rows,
+		"account_id = ? AND dim_id IN ? AND window_seconds IN ? AND window_start_utc IN ?",
+		accountID, dimIDs, windows, starts)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to batch-get agent network consumption: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get agent network consumption")
+	}
+	for _, row := range rows {
+		k := agentNetworkTypes.ConsumptionKey{
+			Kind:           row.DimensionKind,
+			DimID:          row.DimensionID,
+			WindowSeconds:  row.WindowSeconds,
+			WindowStartUTC: row.WindowStartUTC.UTC(),
+		}
+		if _, ok := wanted[k]; ok {
+			out[k] = row
+		}
+	}
+	return out, nil
+}
+
+// IncrementAgentNetworkConsumptionBatch applies the same usage delta to every
+// supplied counter inside a single transaction, so all per-(dimension, window)
+// counters a served request books are written atomically in one round-trip
+// instead of one upsert per counter. Keys are deduplicated by the caller.
+func (s *SqlStore) IncrementAgentNetworkConsumptionBatch(
+	ctx context.Context,
+	accountID string,
+	keys []agentNetworkTypes.ConsumptionKey,
+	tokensIn, tokensOut int64,
+	costUSD float64,
+) error {
+	if accountID == "" {
+		return status.Errorf(status.InvalidArgument, "account_id must be set")
+	}
+	if tokensIn < 0 || tokensOut < 0 || costUSD < 0 || math.IsNaN(costUSD) || math.IsInf(costUSD, 0) {
+		return status.Errorf(status.InvalidArgument, "consumption deltas must be non-negative and finite")
+	}
+	if len(keys) == 0 {
+		return nil
+	}
+
+	const tbl = "agent_network_consumption"
+	err := s.db.Transaction(func(tx *gorm.DB) error {
+		for _, k := range keys {
+			if k.DimID == "" || k.WindowSeconds <= 0 {
+				return status.Errorf(status.InvalidArgument, "dim_id and window_seconds must be set")
+			}
+			now := time.Now().UTC()
+			row := agentNetworkTypes.Consumption{
+				AccountID:      accountID,
+				DimensionKind:  k.Kind,
+				DimensionID:    k.DimID,
+				WindowSeconds:  k.WindowSeconds,
+				WindowStartUTC: k.WindowStartUTC.UTC(),
+				TokensInput:    tokensIn,
+				TokensOutput:   tokensOut,
+				CostUSD:        costUSD,
+				UpdatedAt:      now,
+			}
+			if err := tx.Clauses(clause.OnConflict{
+				Columns: []clause.Column{
+					{Name: "account_id"},
+					{Name: "dim_kind"},
+					{Name: "dim_id"},
+					{Name: "window_seconds"},
+					{Name: "window_start_utc"},
+				},
+				DoUpdates: clause.Assignments(map[string]any{
+					"tokens_input":  gorm.Expr(tbl+".tokens_input + ?", tokensIn),
+					"tokens_output": gorm.Expr(tbl+".tokens_output + ?", tokensOut),
+					"cost_usd":      gorm.Expr(tbl+".cost_usd + ?", costUSD),
+					"updated_at":    now,
+				}),
+			}).Create(&row).Error; err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		log.WithContext(ctx).Errorf("failed to batch-increment agent network consumption: %v", err)
+		return status.Errorf(status.Internal, "failed to increment agent network consumption")
+	}
+	return nil
+}
+
+// ListAgentNetworkConsumption returns every consumption row recorded
+// for the account, ordered by window_start descending. Backs the
+// dashboard's basic counter view.
+func (s *SqlStore) ListAgentNetworkConsumption(
+	ctx context.Context,
+	lockStrength LockingStrength,
+	accountID string,
+) ([]*agentNetworkTypes.Consumption, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+	var rows []*agentNetworkTypes.Consumption
+	result := tx.
+		Order("window_start_utc DESC").
+		Find(&rows, accountIDCondition, accountID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to list agent network consumption: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to list agent network consumption")
+	}
+	return rows, nil
+}
+
+// GetAccountAgentNetworkBudgetRules returns every account-level budget rule for
+// the account.
+func (s *SqlStore) GetAccountAgentNetworkBudgetRules(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.AccountBudgetRule, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var rules []*agentNetworkTypes.AccountBudgetRule
+	result := tx.Find(&rules, accountIDCondition, accountID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to get agent network budget rules from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get agent network budget rules from store")
+	}
+
+	return rules, nil
+}
+
+// GetAgentNetworkBudgetRuleByID returns a single budget rule scoped to the
+// account, or a NotFound error.
+func (s *SqlStore) GetAgentNetworkBudgetRuleByID(ctx context.Context, lockStrength LockingStrength, accountID, ruleID string) (*agentNetworkTypes.AccountBudgetRule, error) {
+	tx := s.db
+	if lockStrength != LockingStrengthNone {
+		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
+	}
+
+	var rule *agentNetworkTypes.AccountBudgetRule
+	result := tx.Take(&rule, accountAndIDQueryCondition, accountID, ruleID)
+	if result.Error != nil {
+		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
+			return nil, status.NewAgentNetworkBudgetRuleNotFoundError(ruleID)
+		}
+
+		log.WithContext(ctx).Errorf("failed to get agent network budget rule from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get agent network budget rule from store")
+	}
+
+	return rule, nil
+}
+
+// SaveAgentNetworkBudgetRule upserts a budget rule.
+func (s *SqlStore) SaveAgentNetworkBudgetRule(ctx context.Context, rule *agentNetworkTypes.AccountBudgetRule) error {
+	result := s.db.Save(rule)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to save agent network budget rule to store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to save agent network budget rule to store")
+	}
+
+	return nil
+}
+
+// DeleteAgentNetworkBudgetRule removes a budget rule scoped to the account.
+func (s *SqlStore) DeleteAgentNetworkBudgetRule(ctx context.Context, accountID, ruleID string) error {
+	result := s.db.Delete(&agentNetworkTypes.AccountBudgetRule{}, accountAndIDQueryCondition, accountID, ruleID)
+	if result.Error != nil {
+		log.WithContext(ctx).Errorf("failed to delete agent network budget rule from store: %v", result.Error)
+		return status.Errorf(status.Internal, "failed to delete agent network budget rule from store")
+	}
+
+	if result.RowsAffected == 0 {
+		return status.NewAgentNetworkBudgetRuleNotFoundError(ruleID)
+	}
+
+	return nil
+}
diff --git a/management/server/store/sql_store_agentnetwork_accesslog_test.go b/management/server/store/sql_store_agentnetwork_accesslog_test.go
new file mode 100644
index 000000000..793c82d79
--- /dev/null
+++ b/management/server/store/sql_store_agentnetwork_accesslog_test.go
@@ -0,0 +1,302 @@
+package store
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+)
+
+// TestAgentNetworkUsage_RealStore_RoundTrip drives CreateAgentNetworkUsage and
+// CreateAgentNetworkAccessLog through a real sqlite store to prove the schema
+// migrates and the inserts succeed for both a populated (allowed) entry and a
+// stripped (denied) entry.
+func TestAgentNetworkUsage_RealStore_RoundTrip(t *testing.T) {
+	ctx := context.Background()
+	s, cleanup, err := NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err, "real sqlite test store must come up")
+	defer cleanup()
+
+	const accountID = "acc-anet-usage-1"
+	now := time.Now().UTC()
+
+	// Populated (allowed) usage row with two authorising groups.
+	usage := &agentNetworkTypes.AgentNetworkUsage{
+		ID:                 "log-allowed-1",
+		AccountID:          accountID,
+		Timestamp:          now,
+		UserID:             "user-alice",
+		ResolvedProviderID: "prov-openai-1",
+		Provider:           "openai",
+		Model:              "gpt-4o",
+		SessionID:          "sess-round-trip-1",
+		InputTokens:        1200,
+		OutputTokens:       640,
+		TotalTokens:        1840,
+		CostUSD:            0.0231,
+	}
+	usageGroups := []agentNetworkTypes.AgentNetworkUsageGroup{
+		{UsageID: usage.ID, GroupID: "grp-eng", AccountID: accountID},
+		{UsageID: usage.ID, GroupID: "grp-oncall", AccountID: accountID},
+	}
+	require.NoError(t, s.CreateAgentNetworkUsage(ctx, usage, usageGroups), "populated usage insert must succeed")
+
+	// Stripped (denied / 403) usage row: no provider/model/tokens, no groups.
+	denied := &agentNetworkTypes.AgentNetworkUsage{
+		ID:        "log-denied-1",
+		AccountID: accountID,
+		Timestamp: now,
+		UserID:    "user-bob",
+	}
+	require.NoError(t, s.CreateAgentNetworkUsage(ctx, denied, nil), "stripped usage insert must succeed")
+
+	// Idempotency: re-inserting the same id must not error.
+	require.NoError(t, s.CreateAgentNetworkUsage(ctx, usage, usageGroups), "duplicate usage insert must be idempotent")
+
+	// Access-log row + group children.
+	entry := &agentNetworkTypes.AgentNetworkAccessLog{
+		ID:           "log-allowed-1",
+		AccountID:    accountID,
+		ServiceID:    "agent-net-svc-1",
+		Timestamp:    now,
+		UserID:       "user-alice",
+		StatusCode:   200,
+		Provider:     "openai",
+		Model:        "gpt-4o",
+		SessionID:    "sess-round-trip-1",
+		InputTokens:  1200,
+		OutputTokens: 640,
+		TotalTokens:  1840,
+		CostUSD:      0.0231,
+	}
+	entryGroups := []agentNetworkTypes.AgentNetworkAccessLogGroup{
+		{LogID: entry.ID, GroupID: "grp-eng", AccountID: accountID},
+		{LogID: entry.ID, GroupID: "grp-oncall", AccountID: accountID},
+	}
+	require.NoError(t, s.CreateAgentNetworkAccessLog(ctx, entry, entryGroups), "access-log insert must succeed")
+
+	// Read back through the filtered list + verify group hydration.
+	logs, total, err := s.GetAgentNetworkAccessLogs(ctx, LockingStrengthNone, accountID, agentNetworkTypes.AgentNetworkAccessLogFilter{Page: 1, PageSize: 50})
+	require.NoError(t, err, "list must succeed")
+	assert.Equal(t, int64(1), total, "one access-log row expected")
+	require.Len(t, logs, 1)
+	assert.ElementsMatch(t, []string{"grp-eng", "grp-oncall"}, logs[0].GroupIDs, "group ids must hydrate")
+	assert.Equal(t, "sess-round-trip-1", logs[0].SessionID, "session id must persist and read back on the access-log row")
+
+	// Session filter narrows the access-log listing to one conversation.
+	sessionID := "sess-round-trip-1"
+	sessLogs, sessTotal, err := s.GetAgentNetworkAccessLogs(ctx, LockingStrengthNone, accountID,
+		agentNetworkTypes.AgentNetworkAccessLogFilter{Page: 1, PageSize: 50, SessionID: &sessionID})
+	require.NoError(t, err)
+	assert.Equal(t, int64(1), sessTotal, "session filter must match the one row with that session id")
+	require.Len(t, sessLogs, 1)
+	assert.Equal(t, entry.ID, sessLogs[0].ID, "session filter must return the matching log row")
+
+	bogus := "no-such-session"
+	_, emptyTotal, err := s.GetAgentNetworkAccessLogs(ctx, LockingStrengthNone, accountID,
+		agentNetworkTypes.AgentNetworkAccessLogFilter{Page: 1, PageSize: 50, SessionID: &bogus})
+	require.NoError(t, err)
+	assert.Equal(t, int64(0), emptyTotal, "unknown session id must match nothing")
+
+	// Session filter also narrows the always-on usage rows.
+	sessUsage, err := s.GetAgentNetworkUsageRows(ctx, LockingStrengthNone, accountID,
+		agentNetworkTypes.AgentNetworkAccessLogFilter{SessionID: &sessionID})
+	require.NoError(t, err)
+	require.Len(t, sessUsage, 1, "session filter must narrow usage rows to the matching session")
+	assert.Equal(t, "sess-round-trip-1", sessUsage[0].SessionID, "usage row must carry the session id")
+}
+
+// TestAgentNetworkUsageOverview_DailyAggregation drives GetAgentNetworkUsageRows
+// + AggregateUsageByGranularity end-to-end against a real sqlite store, with
+// two rows on the same day and one on another, plus a model filter.
+func TestAgentNetworkUsageOverview_DailyAggregation(t *testing.T) {
+	ctx := context.Background()
+	s, cleanup, err := NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err, "real sqlite test store must come up")
+	defer cleanup()
+
+	const accountID = "acc-anet-overview-1"
+	day1 := time.Date(2026, 5, 5, 10, 0, 0, 0, time.UTC)
+	day1b := time.Date(2026, 5, 5, 22, 0, 0, 0, time.UTC)
+	day2 := time.Date(2026, 5, 6, 9, 0, 0, 0, time.UTC)
+
+	mk := func(id string, ts time.Time, model string, in, out int64, cost float64) *agentNetworkTypes.AgentNetworkUsage {
+		return &agentNetworkTypes.AgentNetworkUsage{
+			ID: id, AccountID: accountID, Timestamp: ts, Model: model,
+			InputTokens: in, OutputTokens: out, TotalTokens: in + out, CostUSD: cost,
+		}
+	}
+	require.NoError(t, s.CreateAgentNetworkUsage(ctx, mk("u1", day1, "gpt-4o", 100, 50, 0.10), nil))
+	require.NoError(t, s.CreateAgentNetworkUsage(ctx, mk("u2", day1b, "gpt-4o", 200, 80, 0.20), nil))
+	require.NoError(t, s.CreateAgentNetworkUsage(ctx, mk("u3", day2, "claude-3", 10, 5, 0.01), nil))
+
+	rows, err := s.GetAgentNetworkUsageRows(ctx, LockingStrengthNone, accountID, agentNetworkTypes.AgentNetworkAccessLogFilter{})
+	require.NoError(t, err)
+	require.Len(t, rows, 3, "all three usage rows expected")
+
+	buckets := agentNetworkTypes.AggregateUsageByGranularity(rows, agentNetworkTypes.UsageGranularityDay)
+	require.Len(t, buckets, 2, "two distinct days expected")
+	assert.Equal(t, "2026-05-05", buckets[0].PeriodStart, "oldest-first ordering")
+	assert.Equal(t, int64(300), buckets[0].InputTokens, "same-day input tokens summed")
+	assert.Equal(t, int64(130), buckets[0].OutputTokens)
+	assert.InDelta(t, 0.30, buckets[0].CostUSD, 1e-9, "same-day cost summed")
+	assert.Equal(t, "2026-05-06", buckets[1].PeriodStart)
+	assert.Equal(t, int64(15), buckets[1].TotalTokens)
+
+	// Model filter narrows to a single day.
+	model := "claude-3"
+	filtered, err := s.GetAgentNetworkUsageRows(ctx, LockingStrengthNone, accountID, agentNetworkTypes.AgentNetworkAccessLogFilter{Models: []string{model}})
+	require.NoError(t, err)
+	require.Len(t, filtered, 1, "model filter must narrow rows")
+	assert.Equal(t, "u3", filtered[0].ID)
+}
+
+// TestAgentNetworkAccessLogSessions_RealStore drives GetAgentNetworkAccessLogSessions
+// against a real sqlite store: session grouping + aggregation, recency ordering,
+// singleton groups for session-less requests, session pagination, the model
+// filter narrowing sessions, and aggregate sorting.
+func TestAgentNetworkAccessLogSessions_RealStore(t *testing.T) {
+	ctx := context.Background()
+	s, cleanup, err := NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err, "real sqlite test store must come up")
+	defer cleanup()
+
+	const accountID = "acc-anet-sessions-1"
+	base := time.Date(2026, 5, 5, 10, 0, 0, 0, time.UTC)
+	at := func(h int) time.Time { return base.Add(time.Duration(h) * time.Hour) }
+
+	mk := func(id, session, user, provider, model, decision string, ts time.Time, cost float64) *agentNetworkTypes.AgentNetworkAccessLog {
+		return &agentNetworkTypes.AgentNetworkAccessLog{
+			ID: id, AccountID: accountID, ServiceID: "svc", Timestamp: ts,
+			UserID: user, StatusCode: 200, Provider: provider, Model: model,
+			SessionID: session, Decision: decision,
+			InputTokens: 100, OutputTokens: 50, TotalTokens: 150, CostUSD: cost,
+		}
+	}
+
+	// Two-request session s1 (alice), a one-request denied session s2 (bob), and
+	// two session-less requests (empty session id) that must each form their own
+	// singleton group.
+	require.NoError(t, s.CreateAgentNetworkAccessLog(ctx, mk("s1-a", "s1", "alice", "openai", "gpt-4o", "allow", at(1), 0.10),
+		[]agentNetworkTypes.AgentNetworkAccessLogGroup{{LogID: "s1-a", GroupID: "grp-eng", AccountID: accountID}}))
+	require.NoError(t, s.CreateAgentNetworkAccessLog(ctx, mk("s1-b", "s1", "alice", "openai", "gpt-4o", "allow", at(2), 0.20),
+		[]agentNetworkTypes.AgentNetworkAccessLogGroup{{LogID: "s1-b", GroupID: "grp-oncall", AccountID: accountID}}))
+	require.NoError(t, s.CreateAgentNetworkAccessLog(ctx, mk("s2-a", "s2", "bob", "anthropic", "claude-3", "deny", at(3), 0.05), nil))
+	require.NoError(t, s.CreateAgentNetworkAccessLog(ctx, mk("se-old", "", "carol", "openai", "o1", "allow", at(0), 0.01), nil))
+	require.NoError(t, s.CreateAgentNetworkAccessLog(ctx, mk("se-new", "", "dave", "mistral", "mistral-large", "allow", at(4), 0.02), nil))
+
+	// Default sort: last activity (MAX timestamp) descending.
+	sessions, total, err := s.GetAgentNetworkAccessLogSessions(ctx, LockingStrengthNone, accountID,
+		agentNetworkTypes.AgentNetworkAccessLogFilter{Page: 1, PageSize: 50})
+	require.NoError(t, err)
+	assert.Equal(t, int64(4), total, "four sessions: s1, s2, and two singletons")
+	require.Len(t, sessions, 4)
+
+	// se-new(t4) > s2(t3) > s1(t2) > se-old(t0)
+	assert.Equal(t, "", sessions[0].SessionID, "newest is a session-less singleton")
+	assert.Equal(t, "se-new", sessions[0].Entries[0].ID)
+	assert.Equal(t, "s2", sessions[1].SessionID)
+	assert.Equal(t, "s1", sessions[2].SessionID)
+	assert.Equal(t, "se-old", sessions[3].Entries[0].ID)
+
+	// s1 aggregation.
+	s1 := sessions[2]
+	assert.Equal(t, 2, s1.RequestCount, "s1 has two requests")
+	assert.Equal(t, int64(300), s1.TotalTokens, "tokens summed across the session")
+	assert.InDelta(t, 0.30, s1.CostUSD, 1e-9, "cost summed across the session")
+	assert.Equal(t, "alice", s1.UserID)
+	assert.Equal(t, "allow", s1.Decision)
+	// SQLite hands times back in time.Local; normalise to UTC so the instant is
+	// compared, not the (differing) *Location pointer.
+	assert.Equal(t, at(1), s1.StartedAt.UTC(), "started = earliest entry")
+	assert.Equal(t, at(2), s1.EndedAt.UTC(), "ended = latest entry")
+	assert.ElementsMatch(t, []string{"openai"}, s1.Providers)
+	assert.ElementsMatch(t, []string{"gpt-4o"}, s1.Models)
+	assert.ElementsMatch(t, []string{"grp-eng", "grp-oncall"}, s1.GroupIDs, "union of the entries' authorising groups")
+
+	// Denied session rolls up to deny.
+	assert.Equal(t, "deny", sessions[1].Decision, "any denied request makes the session deny")
+
+	// Pagination over sessions: 2 per page.
+	page1, total, err := s.GetAgentNetworkAccessLogSessions(ctx, LockingStrengthNone, accountID,
+		agentNetworkTypes.AgentNetworkAccessLogFilter{Page: 1, PageSize: 2})
+	require.NoError(t, err)
+	assert.Equal(t, int64(4), total, "total still counts all sessions")
+	require.Len(t, page1, 2)
+	assert.Equal(t, "se-new", page1[0].Entries[0].ID)
+	assert.Equal(t, "s2", page1[1].SessionID)
+
+	page2, _, err := s.GetAgentNetworkAccessLogSessions(ctx, LockingStrengthNone, accountID,
+		agentNetworkTypes.AgentNetworkAccessLogFilter{Page: 2, PageSize: 2})
+	require.NoError(t, err)
+	require.Len(t, page2, 2)
+	assert.Equal(t, "s1", page2[0].SessionID)
+	assert.Equal(t, "se-old", page2[1].Entries[0].ID)
+
+	// Model filter narrows to the session(s) with matching entries.
+	model := "claude-3"
+	filtered, fTotal, err := s.GetAgentNetworkAccessLogSessions(ctx, LockingStrengthNone, accountID,
+		agentNetworkTypes.AgentNetworkAccessLogFilter{Page: 1, PageSize: 50, Models: []string{model}})
+	require.NoError(t, err)
+	assert.Equal(t, int64(1), fTotal, "only s2 has a claude-3 request")
+	require.Len(t, filtered, 1)
+	assert.Equal(t, "s2", filtered[0].SessionID)
+
+	// Sort by total session cost, descending: s1 (0.30) leads despite not being
+	// the most recent.
+	byCost, _, err := s.GetAgentNetworkAccessLogSessions(ctx, LockingStrengthNone, accountID,
+		agentNetworkTypes.AgentNetworkAccessLogFilter{Page: 1, PageSize: 50, SortBy: "cost_usd", SortOrder: "desc"})
+	require.NoError(t, err)
+	require.Len(t, byCost, 4)
+	assert.Equal(t, "s1", byCost[0].SessionID, "highest-cost session sorts first")
+}
+
+// TestDeleteOldAgentNetworkAccessLogs verifies the retention sweep removes only
+// access-log rows (and their group children) older than the cutoff, leaving
+// recent rows — and never touching usage records.
+func TestDeleteOldAgentNetworkAccessLogs(t *testing.T) {
+	ctx := context.Background()
+	s, cleanup, err := NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err, "real sqlite test store must come up")
+	defer cleanup()
+
+	const accountID = "acc-anet-retention-1"
+	old := time.Now().UTC().AddDate(0, 0, -40)
+	recent := time.Now().UTC().AddDate(0, 0, -1)
+
+	mkLog := func(id string, ts time.Time) (*agentNetworkTypes.AgentNetworkAccessLog, []agentNetworkTypes.AgentNetworkAccessLogGroup) {
+		return &agentNetworkTypes.AgentNetworkAccessLog{
+				ID: id, AccountID: accountID, ServiceID: "svc", Timestamp: ts, StatusCode: 200, Model: "gpt-4o",
+			}, []agentNetworkTypes.AgentNetworkAccessLogGroup{
+				{LogID: id, GroupID: "grp-eng", AccountID: accountID},
+			}
+	}
+	oldEntry, oldGroups := mkLog("old-1", old)
+	recentEntry, recentGroups := mkLog("recent-1", recent)
+	require.NoError(t, s.CreateAgentNetworkAccessLog(ctx, oldEntry, oldGroups))
+	require.NoError(t, s.CreateAgentNetworkAccessLog(ctx, recentEntry, recentGroups))
+	// A usage row for the old request must survive the access-log sweep.
+	require.NoError(t, s.CreateAgentNetworkUsage(ctx, &agentNetworkTypes.AgentNetworkUsage{
+		ID: "old-1", AccountID: accountID, Timestamp: old, Model: "gpt-4o", InputTokens: 10, TotalTokens: 10,
+	}, nil))
+
+	cutoff := time.Now().UTC().AddDate(0, 0, -30)
+	deleted, err := s.DeleteOldAgentNetworkAccessLogs(ctx, accountID, cutoff)
+	require.NoError(t, err)
+	assert.Equal(t, int64(1), deleted, "only the 40-day-old log is deleted")
+
+	logs, total, err := s.GetAgentNetworkAccessLogs(ctx, LockingStrengthNone, accountID, agentNetworkTypes.AgentNetworkAccessLogFilter{Page: 1, PageSize: 50})
+	require.NoError(t, err)
+	assert.Equal(t, int64(1), total, "the recent log remains")
+	require.Len(t, logs, 1)
+	assert.Equal(t, "recent-1", logs[0].ID)
+
+	// Usage is untouched by the access-log retention sweep.
+	usage, err := s.GetAgentNetworkUsageRows(ctx, LockingStrengthNone, accountID, agentNetworkTypes.AgentNetworkAccessLogFilter{})
+	require.NoError(t, err)
+	require.Len(t, usage, 1, "usage record for the deleted log must survive")
+}
diff --git a/management/server/store/sql_store_agentnetwork_budgetrule_test.go b/management/server/store/sql_store_agentnetwork_budgetrule_test.go
new file mode 100644
index 000000000..3bf7b797d
--- /dev/null
+++ b/management/server/store/sql_store_agentnetwork_budgetrule_test.go
@@ -0,0 +1,112 @@
+package store
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+)
+
+// TestAgentNetworkBudgetRule_RealStore_RoundTrip is the GC-0 no-mock guard: it
+// drives the budget-rule CRUD through a real sqlite store and asserts the full
+// object — targets and the reused PolicyLimits cap shape — survives the
+// save → gorm/JSON serialize → reload round-trip, then that delete removes it
+// and a second delete reports NotFound.
+func TestAgentNetworkBudgetRule_RealStore_RoundTrip(t *testing.T) {
+	ctx := context.Background()
+	s, cleanup, err := NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err, "real sqlite test store must come up")
+	defer cleanup()
+
+	const accountID = "acc-budgetrule-1"
+	rule := agentNetworkTypes.NewAccountBudgetRule(accountID)
+	rule.Name = "eng-monthly"
+	rule.TargetGroups = []string{"grp-eng", "grp-oncall"}
+	rule.TargetUsers = []string{"user-alice"}
+	rule.Limits = agentNetworkTypes.PolicyLimits{
+		TokenLimit: agentNetworkTypes.PolicyTokenLimit{
+			Enabled: true, GroupCap: 100_000, UserCap: 10_000, WindowSeconds: 2_592_000,
+		},
+		BudgetLimit: agentNetworkTypes.PolicyBudgetLimit{
+			Enabled: true, GroupCapUsd: 500, UserCapUsd: 50, WindowSeconds: 2_592_000,
+		},
+	}
+	require.NoError(t, s.SaveAgentNetworkBudgetRule(ctx, rule), "save must succeed")
+
+	got, err := s.GetAgentNetworkBudgetRuleByID(ctx, LockingStrengthNone, accountID, rule.ID)
+	require.NoError(t, err, "get by id must succeed after save")
+	assert.Equal(t, rule.Name, got.Name, "name must round-trip")
+	assert.Equal(t, []string{"grp-eng", "grp-oncall"}, got.TargetGroups, "target groups must round-trip")
+	assert.Equal(t, []string{"user-alice"}, got.TargetUsers, "target users must round-trip")
+	assert.Equal(t, rule.Limits, got.Limits, "the reused PolicyLimits cap shape must round-trip intact")
+	assert.True(t, got.Enabled, "enabled must round-trip")
+
+	list, err := s.GetAccountAgentNetworkBudgetRules(ctx, LockingStrengthNone, accountID)
+	require.NoError(t, err, "list must succeed")
+	require.Len(t, list, 1, "exactly the one saved rule must be listed")
+	assert.Equal(t, rule.ID, list[0].ID, "listed rule id must match")
+
+	require.NoError(t, s.DeleteAgentNetworkBudgetRule(ctx, accountID, rule.ID), "delete must succeed")
+
+	_, err = s.GetAgentNetworkBudgetRuleByID(ctx, LockingStrengthNone, accountID, rule.ID)
+	assert.Error(t, err, "get after delete must report not found")
+
+	err = s.DeleteAgentNetworkBudgetRule(ctx, accountID, rule.ID)
+	assert.Error(t, err, "deleting an absent rule must report not found")
+}
+
+// TestAgentNetworkBudgetRule_RealStore_ScopedByAccount pins that rules are
+// account-scoped: a rule under one account is invisible to another.
+func TestAgentNetworkBudgetRule_RealStore_ScopedByAccount(t *testing.T) {
+	ctx := context.Background()
+	s, cleanup, err := NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err)
+	defer cleanup()
+
+	ruleA := agentNetworkTypes.NewAccountBudgetRule("acc-A")
+	require.NoError(t, s.SaveAgentNetworkBudgetRule(ctx, ruleA))
+
+	list, err := s.GetAccountAgentNetworkBudgetRules(ctx, LockingStrengthNone, "acc-B")
+	require.NoError(t, err)
+	assert.Empty(t, list, "account B must not see account A's budget rule")
+
+	_, err = s.GetAgentNetworkBudgetRuleByID(ctx, LockingStrengthNone, "acc-B", ruleA.ID)
+	assert.Error(t, err, "cross-account get by id must not resolve")
+}
+
+// TestAgentNetworkSettings_RealStore_CollectionTogglesRoundTrip pins the GC-0
+// additive settings columns: the three collection toggles default off on a
+// fresh row and survive a save/reload at their set values.
+func TestAgentNetworkSettings_RealStore_CollectionTogglesRoundTrip(t *testing.T) {
+	ctx := context.Background()
+	s, cleanup, err := NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err)
+	defer cleanup()
+
+	const accountID = "acc-settings-toggles"
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, &agentNetworkTypes.Settings{
+		AccountID: accountID,
+		Cluster:   "eu.proxy.netbird.io",
+		Subdomain: "violet",
+	}))
+
+	got, err := s.GetAgentNetworkSettings(ctx, LockingStrengthNone, accountID)
+	require.NoError(t, err)
+	assert.False(t, got.EnableLogCollection, "log collection must default off")
+	assert.False(t, got.EnablePromptCollection, "prompt collection must default off")
+	assert.False(t, got.RedactPii, "redact pii must default off")
+
+	got.EnableLogCollection = true
+	got.EnablePromptCollection = true
+	got.RedactPii = true
+	require.NoError(t, s.SaveAgentNetworkSettings(ctx, got))
+
+	reloaded, err := s.GetAgentNetworkSettings(ctx, LockingStrengthNone, accountID)
+	require.NoError(t, err)
+	assert.True(t, reloaded.EnableLogCollection, "log collection must round-trip on")
+	assert.True(t, reloaded.EnablePromptCollection, "prompt collection must round-trip on")
+	assert.True(t, reloaded.RedactPii, "redact pii must round-trip on")
+}
diff --git a/management/server/store/store.go b/management/server/store/store.go
index 066ab285d..908c199f5 100644
--- a/management/server/store/store.go
+++ b/management/server/store/store.go
@@ -37,6 +37,7 @@ import (
 	"github.com/netbirdio/netbird/util"
 	"github.com/netbirdio/netbird/util/crypt"
 
+	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
 	"github.com/netbirdio/netbird/management/server/migration"
 	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
@@ -300,6 +301,12 @@ type Store interface {
 	CreateAccessLog(ctx context.Context, log *accesslogs.AccessLogEntry) error
 	GetAccountAccessLogs(ctx context.Context, lockStrength LockingStrength, accountID string, filter accesslogs.AccessLogFilter) ([]*accesslogs.AccessLogEntry, int64, error)
 	DeleteOldAccessLogs(ctx context.Context, olderThan time.Time) (int64, error)
+	CreateAgentNetworkAccessLog(ctx context.Context, entry *agentNetworkTypes.AgentNetworkAccessLog, groups []agentNetworkTypes.AgentNetworkAccessLogGroup) error
+	CreateAgentNetworkUsage(ctx context.Context, usage *agentNetworkTypes.AgentNetworkUsage, groups []agentNetworkTypes.AgentNetworkUsageGroup) error
+	GetAgentNetworkAccessLogs(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkAccessLog, int64, error)
+	GetAgentNetworkAccessLogSessions(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkAccessLogSession, int64, error)
+	GetAgentNetworkUsageRows(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkUsage, error)
+	DeleteOldAgentNetworkAccessLogs(ctx context.Context, accountID string, olderThan time.Time) (int64, error)
 	GetServiceTargetByTargetID(ctx context.Context, lockStrength LockingStrength, accountID string, targetID string) (*rpservice.Target, error)
 	GetTargetsByServiceID(ctx context.Context, lockStrength LockingStrength, accountID string, serviceID string) ([]*rpservice.Target, error)
 	DeleteTarget(ctx context.Context, accountID string, serviceID string, targetID uint) error
@@ -328,7 +335,40 @@ type Store interface {
 	// return a zero-valued struct.
 	GetProxyMetrics(ctx context.Context) (ProxyMetrics, error)
 
+	// GetAgentNetworkMetrics returns aggregated agent-network adoption + usage
+	// counts for the self-hosted metrics worker. Self-hosted only — file-based
+	// stores return a zero-valued struct.
+	GetAgentNetworkMetrics(ctx context.Context) (AgentNetworkMetrics, error)
+
 	GetRoutingPeerNetworks(ctx context.Context, accountID, peerID string) ([]string, error)
+
+	// Agent Network persistence (providers, policies, guardrails, settings).
+	GetAllAgentNetworkProviders(ctx context.Context, lockStrength LockingStrength) ([]*agentNetworkTypes.Provider, error)
+	GetAccountAgentNetworkProviders(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.Provider, error)
+	GetAgentNetworkProviderByID(ctx context.Context, lockStrength LockingStrength, accountID, providerID string) (*agentNetworkTypes.Provider, error)
+	SaveAgentNetworkProvider(ctx context.Context, provider *agentNetworkTypes.Provider) error
+	DeleteAgentNetworkProvider(ctx context.Context, accountID, providerID string) error
+	GetAccountAgentNetworkPolicies(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.Policy, error)
+	GetAgentNetworkPolicyByID(ctx context.Context, lockStrength LockingStrength, accountID, policyID string) (*agentNetworkTypes.Policy, error)
+	SaveAgentNetworkPolicy(ctx context.Context, policy *agentNetworkTypes.Policy) error
+	DeleteAgentNetworkPolicy(ctx context.Context, accountID, policyID string) error
+	GetAccountAgentNetworkGuardrails(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.Guardrail, error)
+	GetAgentNetworkGuardrailByID(ctx context.Context, lockStrength LockingStrength, accountID, guardrailID string) (*agentNetworkTypes.Guardrail, error)
+	SaveAgentNetworkGuardrail(ctx context.Context, guardrail *agentNetworkTypes.Guardrail) error
+	DeleteAgentNetworkGuardrail(ctx context.Context, accountID, guardrailID string) error
+	GetAgentNetworkSettings(ctx context.Context, lockStrength LockingStrength, accountID string) (*agentNetworkTypes.Settings, error)
+	GetAllAgentNetworkSettings(ctx context.Context, lockStrength LockingStrength) ([]*agentNetworkTypes.Settings, error)
+	GetAgentNetworkSettingsByCluster(ctx context.Context, lockStrength LockingStrength, cluster string) ([]*agentNetworkTypes.Settings, error)
+	SaveAgentNetworkSettings(ctx context.Context, settings *agentNetworkTypes.Settings) error
+	IncrementAgentNetworkConsumption(ctx context.Context, accountID string, kind agentNetworkTypes.ConsumptionDimension, dimID string, windowSeconds int64, windowStart time.Time, tokensIn, tokensOut int64, costUSD float64) error
+	IncrementAgentNetworkConsumptionBatch(ctx context.Context, accountID string, keys []agentNetworkTypes.ConsumptionKey, tokensIn, tokensOut int64, costUSD float64) error
+	GetAgentNetworkConsumption(ctx context.Context, lockStrength LockingStrength, accountID string, kind agentNetworkTypes.ConsumptionDimension, dimID string, windowSeconds int64, windowStart time.Time) (*agentNetworkTypes.Consumption, error)
+	GetAgentNetworkConsumptionBatch(ctx context.Context, lockStrength LockingStrength, accountID string, keys []agentNetworkTypes.ConsumptionKey) (map[agentNetworkTypes.ConsumptionKey]*agentNetworkTypes.Consumption, error)
+	ListAgentNetworkConsumption(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.Consumption, error)
+	GetAccountAgentNetworkBudgetRules(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.AccountBudgetRule, error)
+	GetAgentNetworkBudgetRuleByID(ctx context.Context, lockStrength LockingStrength, accountID, ruleID string) (*agentNetworkTypes.AccountBudgetRule, error)
+	SaveAgentNetworkBudgetRule(ctx context.Context, rule *agentNetworkTypes.AccountBudgetRule) error
+	DeleteAgentNetworkBudgetRule(ctx context.Context, accountID, ruleID string) error
 }
 
 // ProxyMetrics aggregates self-hosted proxy + cluster usage signals
@@ -355,6 +395,32 @@ type ProxyMetrics struct {
 	ProxiesConnected int64
 }
 
+// AgentNetworkMetrics aggregates self-hosted agent-network adoption + usage
+// signals surfaced to the telemetry payload. Each field is best-effort: when a
+// store cannot answer (e.g. FileStore) all fields are zero.
+type AgentNetworkMetrics struct {
+	// Accounts is the number of distinct accounts with at least one provider
+	// configured (agent-network adoption).
+	Accounts int64
+	// Providers is the total number of configured providers across all accounts.
+	Providers int64
+	// Policies is the total number of agent-network policies across all accounts.
+	Policies int64
+	// BudgetRules is the total number of account-level budget rules ("budget
+	// limits") across all accounts.
+	BudgetRules int64
+	// LogCollectionEnabled is the number of accounts that have agent-network
+	// log collection turned on.
+	LogCollectionEnabled int64
+	// InputTokens / OutputTokens / CostUSD are summed over the always-collected
+	// per-request usage ledger (agent_network_request_usage), independent of the
+	// log-collection toggle. They reflect total metered LLM usage served through
+	// agent networks.
+	InputTokens  int64
+	OutputTokens int64
+	CostUSD      float64
+}
+
 const (
 	postgresDsnEnv       = "NB_STORE_ENGINE_POSTGRES_DSN"
 	postgresDsnEnvLegacy = "NETBIRD_STORE_ENGINE_POSTGRES_DSN"
diff --git a/management/server/store/store_mock_agentnetwork.go b/management/server/store/store_mock_agentnetwork.go
new file mode 100644
index 000000000..18adf20f0
--- /dev/null
+++ b/management/server/store/store_mock_agentnetwork.go
@@ -0,0 +1,495 @@
+package store
+
+import (
+	context "context"
+	reflect "reflect"
+	time "time"
+
+	gomock "github.com/golang/mock/gomock"
+
+	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+)
+
+// GetAllAgentNetworkProviders mocks base method.
+func (m *MockStore) GetAllAgentNetworkProviders(ctx context.Context, lockStrength LockingStrength) ([]*agentNetworkTypes.Provider, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAllAgentNetworkProviders", ctx, lockStrength)
+	ret0, _ := ret[0].([]*agentNetworkTypes.Provider)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAllAgentNetworkProviders indicates an expected call of GetAllAgentNetworkProviders.
+func (mr *MockStoreMockRecorder) GetAllAgentNetworkProviders(ctx, lockStrength interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAllAgentNetworkProviders", reflect.TypeOf((*MockStore)(nil).GetAllAgentNetworkProviders), ctx, lockStrength)
+}
+
+// GetAgentNetworkMetrics mocks base method.
+func (m *MockStore) GetAgentNetworkMetrics(ctx context.Context) (AgentNetworkMetrics, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkMetrics", ctx)
+	ret0, _ := ret[0].(AgentNetworkMetrics)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkMetrics indicates an expected call of GetAgentNetworkMetrics.
+func (mr *MockStoreMockRecorder) GetAgentNetworkMetrics(ctx interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkMetrics", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkMetrics), ctx)
+}
+
+// GetAccountAgentNetworkProviders mocks base method.
+func (m *MockStore) GetAccountAgentNetworkProviders(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.Provider, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAccountAgentNetworkProviders", ctx, lockStrength, accountID)
+	ret0, _ := ret[0].([]*agentNetworkTypes.Provider)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAccountAgentNetworkProviders indicates an expected call of GetAccountAgentNetworkProviders.
+func (mr *MockStoreMockRecorder) GetAccountAgentNetworkProviders(ctx, lockStrength, accountID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountAgentNetworkProviders", reflect.TypeOf((*MockStore)(nil).GetAccountAgentNetworkProviders), ctx, lockStrength, accountID)
+}
+
+// GetAgentNetworkProviderByID mocks base method.
+func (m *MockStore) GetAgentNetworkProviderByID(ctx context.Context, lockStrength LockingStrength, accountID, providerID string) (*agentNetworkTypes.Provider, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkProviderByID", ctx, lockStrength, accountID, providerID)
+	ret0, _ := ret[0].(*agentNetworkTypes.Provider)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkProviderByID indicates an expected call of GetAgentNetworkProviderByID.
+func (mr *MockStoreMockRecorder) GetAgentNetworkProviderByID(ctx, lockStrength, accountID, providerID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkProviderByID", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkProviderByID), ctx, lockStrength, accountID, providerID)
+}
+
+// SaveAgentNetworkProvider mocks base method.
+func (m *MockStore) SaveAgentNetworkProvider(ctx context.Context, provider *agentNetworkTypes.Provider) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SaveAgentNetworkProvider", ctx, provider)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SaveAgentNetworkProvider indicates an expected call of SaveAgentNetworkProvider.
+func (mr *MockStoreMockRecorder) SaveAgentNetworkProvider(ctx, provider interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveAgentNetworkProvider", reflect.TypeOf((*MockStore)(nil).SaveAgentNetworkProvider), ctx, provider)
+}
+
+// DeleteAgentNetworkProvider mocks base method.
+func (m *MockStore) DeleteAgentNetworkProvider(ctx context.Context, accountID, providerID string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteAgentNetworkProvider", ctx, accountID, providerID)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// DeleteAgentNetworkProvider indicates an expected call of DeleteAgentNetworkProvider.
+func (mr *MockStoreMockRecorder) DeleteAgentNetworkProvider(ctx, accountID, providerID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAgentNetworkProvider", reflect.TypeOf((*MockStore)(nil).DeleteAgentNetworkProvider), ctx, accountID, providerID)
+}
+
+// GetAccountAgentNetworkPolicies mocks base method.
+func (m *MockStore) GetAccountAgentNetworkPolicies(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.Policy, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAccountAgentNetworkPolicies", ctx, lockStrength, accountID)
+	ret0, _ := ret[0].([]*agentNetworkTypes.Policy)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAccountAgentNetworkPolicies indicates an expected call of GetAccountAgentNetworkPolicies.
+func (mr *MockStoreMockRecorder) GetAccountAgentNetworkPolicies(ctx, lockStrength, accountID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountAgentNetworkPolicies", reflect.TypeOf((*MockStore)(nil).GetAccountAgentNetworkPolicies), ctx, lockStrength, accountID)
+}
+
+// GetAgentNetworkPolicyByID mocks base method.
+func (m *MockStore) GetAgentNetworkPolicyByID(ctx context.Context, lockStrength LockingStrength, accountID, policyID string) (*agentNetworkTypes.Policy, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkPolicyByID", ctx, lockStrength, accountID, policyID)
+	ret0, _ := ret[0].(*agentNetworkTypes.Policy)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkPolicyByID indicates an expected call of GetAgentNetworkPolicyByID.
+func (mr *MockStoreMockRecorder) GetAgentNetworkPolicyByID(ctx, lockStrength, accountID, policyID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkPolicyByID", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkPolicyByID), ctx, lockStrength, accountID, policyID)
+}
+
+// SaveAgentNetworkPolicy mocks base method.
+func (m *MockStore) SaveAgentNetworkPolicy(ctx context.Context, policy *agentNetworkTypes.Policy) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SaveAgentNetworkPolicy", ctx, policy)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SaveAgentNetworkPolicy indicates an expected call of SaveAgentNetworkPolicy.
+func (mr *MockStoreMockRecorder) SaveAgentNetworkPolicy(ctx, policy interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveAgentNetworkPolicy", reflect.TypeOf((*MockStore)(nil).SaveAgentNetworkPolicy), ctx, policy)
+}
+
+// DeleteAgentNetworkPolicy mocks base method.
+func (m *MockStore) DeleteAgentNetworkPolicy(ctx context.Context, accountID, policyID string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteAgentNetworkPolicy", ctx, accountID, policyID)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// DeleteAgentNetworkPolicy indicates an expected call of DeleteAgentNetworkPolicy.
+func (mr *MockStoreMockRecorder) DeleteAgentNetworkPolicy(ctx, accountID, policyID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAgentNetworkPolicy", reflect.TypeOf((*MockStore)(nil).DeleteAgentNetworkPolicy), ctx, accountID, policyID)
+}
+
+// GetAccountAgentNetworkGuardrails mocks base method.
+func (m *MockStore) GetAccountAgentNetworkGuardrails(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.Guardrail, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAccountAgentNetworkGuardrails", ctx, lockStrength, accountID)
+	ret0, _ := ret[0].([]*agentNetworkTypes.Guardrail)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAccountAgentNetworkGuardrails indicates an expected call of GetAccountAgentNetworkGuardrails.
+func (mr *MockStoreMockRecorder) GetAccountAgentNetworkGuardrails(ctx, lockStrength, accountID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountAgentNetworkGuardrails", reflect.TypeOf((*MockStore)(nil).GetAccountAgentNetworkGuardrails), ctx, lockStrength, accountID)
+}
+
+// GetAgentNetworkGuardrailByID mocks base method.
+func (m *MockStore) GetAgentNetworkGuardrailByID(ctx context.Context, lockStrength LockingStrength, accountID, guardrailID string) (*agentNetworkTypes.Guardrail, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkGuardrailByID", ctx, lockStrength, accountID, guardrailID)
+	ret0, _ := ret[0].(*agentNetworkTypes.Guardrail)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkGuardrailByID indicates an expected call of GetAgentNetworkGuardrailByID.
+func (mr *MockStoreMockRecorder) GetAgentNetworkGuardrailByID(ctx, lockStrength, accountID, guardrailID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkGuardrailByID", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkGuardrailByID), ctx, lockStrength, accountID, guardrailID)
+}
+
+// SaveAgentNetworkGuardrail mocks base method.
+func (m *MockStore) SaveAgentNetworkGuardrail(ctx context.Context, guardrail *agentNetworkTypes.Guardrail) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SaveAgentNetworkGuardrail", ctx, guardrail)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SaveAgentNetworkGuardrail indicates an expected call of SaveAgentNetworkGuardrail.
+func (mr *MockStoreMockRecorder) SaveAgentNetworkGuardrail(ctx, guardrail interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveAgentNetworkGuardrail", reflect.TypeOf((*MockStore)(nil).SaveAgentNetworkGuardrail), ctx, guardrail)
+}
+
+// DeleteAgentNetworkGuardrail mocks base method.
+func (m *MockStore) DeleteAgentNetworkGuardrail(ctx context.Context, accountID, guardrailID string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteAgentNetworkGuardrail", ctx, accountID, guardrailID)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// DeleteAgentNetworkGuardrail indicates an expected call of DeleteAgentNetworkGuardrail.
+func (mr *MockStoreMockRecorder) DeleteAgentNetworkGuardrail(ctx, accountID, guardrailID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAgentNetworkGuardrail", reflect.TypeOf((*MockStore)(nil).DeleteAgentNetworkGuardrail), ctx, accountID, guardrailID)
+}
+
+// GetAgentNetworkSettings mocks base method.
+func (m *MockStore) GetAgentNetworkSettings(ctx context.Context, lockStrength LockingStrength, accountID string) (*agentNetworkTypes.Settings, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkSettings", ctx, lockStrength, accountID)
+	ret0, _ := ret[0].(*agentNetworkTypes.Settings)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkSettings indicates an expected call of GetAgentNetworkSettings.
+func (mr *MockStoreMockRecorder) GetAgentNetworkSettings(ctx, lockStrength, accountID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkSettings", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkSettings), ctx, lockStrength, accountID)
+}
+
+// GetAgentNetworkSettingsByCluster mocks base method.
+func (m *MockStore) GetAgentNetworkSettingsByCluster(ctx context.Context, lockStrength LockingStrength, cluster string) ([]*agentNetworkTypes.Settings, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkSettingsByCluster", ctx, lockStrength, cluster)
+	ret0, _ := ret[0].([]*agentNetworkTypes.Settings)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkSettingsByCluster indicates an expected call of GetAgentNetworkSettingsByCluster.
+func (mr *MockStoreMockRecorder) GetAgentNetworkSettingsByCluster(ctx, lockStrength, cluster interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkSettingsByCluster", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkSettingsByCluster), ctx, lockStrength, cluster)
+}
+
+// SaveAgentNetworkSettings mocks base method.
+func (m *MockStore) SaveAgentNetworkSettings(ctx context.Context, settings *agentNetworkTypes.Settings) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SaveAgentNetworkSettings", ctx, settings)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SaveAgentNetworkSettings indicates an expected call of SaveAgentNetworkSettings.
+func (mr *MockStoreMockRecorder) SaveAgentNetworkSettings(ctx, settings interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveAgentNetworkSettings", reflect.TypeOf((*MockStore)(nil).SaveAgentNetworkSettings), ctx, settings)
+}
+
+// IncrementAgentNetworkConsumption mocks base method.
+func (m *MockStore) IncrementAgentNetworkConsumption(ctx context.Context, accountID string, kind agentNetworkTypes.ConsumptionDimension, dimID string, windowSeconds int64, windowStart time.Time, tokensIn, tokensOut int64, costUSD float64) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "IncrementAgentNetworkConsumption", ctx, accountID, kind, dimID, windowSeconds, windowStart, tokensIn, tokensOut, costUSD)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// IncrementAgentNetworkConsumption indicates an expected call of IncrementAgentNetworkConsumption.
+func (mr *MockStoreMockRecorder) IncrementAgentNetworkConsumption(ctx, accountID, kind, dimID, windowSeconds, windowStart, tokensIn, tokensOut, costUSD interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IncrementAgentNetworkConsumption", reflect.TypeOf((*MockStore)(nil).IncrementAgentNetworkConsumption), ctx, accountID, kind, dimID, windowSeconds, windowStart, tokensIn, tokensOut, costUSD)
+}
+
+// GetAgentNetworkConsumption mocks base method.
+func (m *MockStore) GetAgentNetworkConsumption(ctx context.Context, lockStrength LockingStrength, accountID string, kind agentNetworkTypes.ConsumptionDimension, dimID string, windowSeconds int64, windowStart time.Time) (*agentNetworkTypes.Consumption, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkConsumption", ctx, lockStrength, accountID, kind, dimID, windowSeconds, windowStart)
+	ret0, _ := ret[0].(*agentNetworkTypes.Consumption)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkConsumption indicates an expected call of GetAgentNetworkConsumption.
+func (mr *MockStoreMockRecorder) GetAgentNetworkConsumption(ctx, lockStrength, accountID, kind, dimID, windowSeconds, windowStart interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkConsumption", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkConsumption), ctx, lockStrength, accountID, kind, dimID, windowSeconds, windowStart)
+}
+
+// GetAgentNetworkConsumptionBatch mocks base method.
+func (m *MockStore) GetAgentNetworkConsumptionBatch(ctx context.Context, lockStrength LockingStrength, accountID string, keys []agentNetworkTypes.ConsumptionKey) (map[agentNetworkTypes.ConsumptionKey]*agentNetworkTypes.Consumption, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkConsumptionBatch", ctx, lockStrength, accountID, keys)
+	ret0, _ := ret[0].(map[agentNetworkTypes.ConsumptionKey]*agentNetworkTypes.Consumption)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkConsumptionBatch indicates an expected call of GetAgentNetworkConsumptionBatch.
+func (mr *MockStoreMockRecorder) GetAgentNetworkConsumptionBatch(ctx, lockStrength, accountID, keys interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkConsumptionBatch", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkConsumptionBatch), ctx, lockStrength, accountID, keys)
+}
+
+// IncrementAgentNetworkConsumptionBatch mocks base method.
+func (m *MockStore) IncrementAgentNetworkConsumptionBatch(ctx context.Context, accountID string, keys []agentNetworkTypes.ConsumptionKey, tokensIn, tokensOut int64, costUSD float64) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "IncrementAgentNetworkConsumptionBatch", ctx, accountID, keys, tokensIn, tokensOut, costUSD)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// IncrementAgentNetworkConsumptionBatch indicates an expected call of IncrementAgentNetworkConsumptionBatch.
+func (mr *MockStoreMockRecorder) IncrementAgentNetworkConsumptionBatch(ctx, accountID, keys, tokensIn, tokensOut, costUSD interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IncrementAgentNetworkConsumptionBatch", reflect.TypeOf((*MockStore)(nil).IncrementAgentNetworkConsumptionBatch), ctx, accountID, keys, tokensIn, tokensOut, costUSD)
+}
+
+// ListAgentNetworkConsumption mocks base method.
+func (m *MockStore) ListAgentNetworkConsumption(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.Consumption, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ListAgentNetworkConsumption", ctx, lockStrength, accountID)
+	ret0, _ := ret[0].([]*agentNetworkTypes.Consumption)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// ListAgentNetworkConsumption indicates an expected call of ListAgentNetworkConsumption.
+func (mr *MockStoreMockRecorder) ListAgentNetworkConsumption(ctx, lockStrength, accountID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListAgentNetworkConsumption", reflect.TypeOf((*MockStore)(nil).ListAgentNetworkConsumption), ctx, lockStrength, accountID)
+}
+
+// GetAccountAgentNetworkBudgetRules mocks base method.
+func (m *MockStore) GetAccountAgentNetworkBudgetRules(ctx context.Context, lockStrength LockingStrength, accountID string) ([]*agentNetworkTypes.AccountBudgetRule, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAccountAgentNetworkBudgetRules", ctx, lockStrength, accountID)
+	ret0, _ := ret[0].([]*agentNetworkTypes.AccountBudgetRule)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAccountAgentNetworkBudgetRules indicates an expected call of GetAccountAgentNetworkBudgetRules.
+func (mr *MockStoreMockRecorder) GetAccountAgentNetworkBudgetRules(ctx, lockStrength, accountID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountAgentNetworkBudgetRules", reflect.TypeOf((*MockStore)(nil).GetAccountAgentNetworkBudgetRules), ctx, lockStrength, accountID)
+}
+
+// GetAgentNetworkBudgetRuleByID mocks base method.
+func (m *MockStore) GetAgentNetworkBudgetRuleByID(ctx context.Context, lockStrength LockingStrength, accountID, ruleID string) (*agentNetworkTypes.AccountBudgetRule, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkBudgetRuleByID", ctx, lockStrength, accountID, ruleID)
+	ret0, _ := ret[0].(*agentNetworkTypes.AccountBudgetRule)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkBudgetRuleByID indicates an expected call of GetAgentNetworkBudgetRuleByID.
+func (mr *MockStoreMockRecorder) GetAgentNetworkBudgetRuleByID(ctx, lockStrength, accountID, ruleID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkBudgetRuleByID", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkBudgetRuleByID), ctx, lockStrength, accountID, ruleID)
+}
+
+// SaveAgentNetworkBudgetRule mocks base method.
+func (m *MockStore) SaveAgentNetworkBudgetRule(ctx context.Context, rule *agentNetworkTypes.AccountBudgetRule) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SaveAgentNetworkBudgetRule", ctx, rule)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SaveAgentNetworkBudgetRule indicates an expected call of SaveAgentNetworkBudgetRule.
+func (mr *MockStoreMockRecorder) SaveAgentNetworkBudgetRule(ctx, rule interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SaveAgentNetworkBudgetRule", reflect.TypeOf((*MockStore)(nil).SaveAgentNetworkBudgetRule), ctx, rule)
+}
+
+// DeleteAgentNetworkBudgetRule mocks base method.
+func (m *MockStore) DeleteAgentNetworkBudgetRule(ctx context.Context, accountID, ruleID string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteAgentNetworkBudgetRule", ctx, accountID, ruleID)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// DeleteAgentNetworkBudgetRule indicates an expected call of DeleteAgentNetworkBudgetRule.
+func (mr *MockStoreMockRecorder) DeleteAgentNetworkBudgetRule(ctx, accountID, ruleID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAgentNetworkBudgetRule", reflect.TypeOf((*MockStore)(nil).DeleteAgentNetworkBudgetRule), ctx, accountID, ruleID)
+}
+
+// CreateAgentNetworkAccessLog mocks base method.
+func (m *MockStore) CreateAgentNetworkAccessLog(ctx context.Context, entry *agentNetworkTypes.AgentNetworkAccessLog, groups []agentNetworkTypes.AgentNetworkAccessLogGroup) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CreateAgentNetworkAccessLog", ctx, entry, groups)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// CreateAgentNetworkAccessLog indicates an expected call of CreateAgentNetworkAccessLog.
+func (mr *MockStoreMockRecorder) CreateAgentNetworkAccessLog(ctx, entry, groups interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateAgentNetworkAccessLog", reflect.TypeOf((*MockStore)(nil).CreateAgentNetworkAccessLog), ctx, entry, groups)
+}
+
+// CreateAgentNetworkUsage mocks base method.
+func (m *MockStore) CreateAgentNetworkUsage(ctx context.Context, usage *agentNetworkTypes.AgentNetworkUsage, groups []agentNetworkTypes.AgentNetworkUsageGroup) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CreateAgentNetworkUsage", ctx, usage, groups)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// CreateAgentNetworkUsage indicates an expected call of CreateAgentNetworkUsage.
+func (mr *MockStoreMockRecorder) CreateAgentNetworkUsage(ctx, usage, groups interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateAgentNetworkUsage", reflect.TypeOf((*MockStore)(nil).CreateAgentNetworkUsage), ctx, usage, groups)
+}
+
+// GetAgentNetworkAccessLogs mocks base method.
+func (m *MockStore) GetAgentNetworkAccessLogs(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkAccessLog, int64, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkAccessLogs", ctx, lockStrength, accountID, filter)
+	ret0, _ := ret[0].([]*agentNetworkTypes.AgentNetworkAccessLog)
+	ret1, _ := ret[1].(int64)
+	ret2, _ := ret[2].(error)
+	return ret0, ret1, ret2
+}
+
+// GetAgentNetworkAccessLogs indicates an expected call of GetAgentNetworkAccessLogs.
+func (mr *MockStoreMockRecorder) GetAgentNetworkAccessLogs(ctx, lockStrength, accountID, filter interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkAccessLogs", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkAccessLogs), ctx, lockStrength, accountID, filter)
+}
+
+// GetAgentNetworkAccessLogSessions mocks base method.
+func (m *MockStore) GetAgentNetworkAccessLogSessions(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkAccessLogSession, int64, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkAccessLogSessions", ctx, lockStrength, accountID, filter)
+	ret0, _ := ret[0].([]*agentNetworkTypes.AgentNetworkAccessLogSession)
+	ret1, _ := ret[1].(int64)
+	ret2, _ := ret[2].(error)
+	return ret0, ret1, ret2
+}
+
+// GetAgentNetworkAccessLogSessions indicates an expected call of GetAgentNetworkAccessLogSessions.
+func (mr *MockStoreMockRecorder) GetAgentNetworkAccessLogSessions(ctx, lockStrength, accountID, filter interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkAccessLogSessions", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkAccessLogSessions), ctx, lockStrength, accountID, filter)
+}
+
+// GetAgentNetworkUsageRows mocks base method.
+func (m *MockStore) GetAgentNetworkUsageRows(ctx context.Context, lockStrength LockingStrength, accountID string, filter agentNetworkTypes.AgentNetworkAccessLogFilter) ([]*agentNetworkTypes.AgentNetworkUsage, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAgentNetworkUsageRows", ctx, lockStrength, accountID, filter)
+	ret0, _ := ret[0].([]*agentNetworkTypes.AgentNetworkUsage)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAgentNetworkUsageRows indicates an expected call of GetAgentNetworkUsageRows.
+func (mr *MockStoreMockRecorder) GetAgentNetworkUsageRows(ctx, lockStrength, accountID, filter interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkUsageRows", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkUsageRows), ctx, lockStrength, accountID, filter)
+}
+
+// DeleteOldAgentNetworkAccessLogs mocks base method.
+func (m *MockStore) DeleteOldAgentNetworkAccessLogs(ctx context.Context, accountID string, olderThan time.Time) (int64, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteOldAgentNetworkAccessLogs", ctx, accountID, olderThan)
+	ret0, _ := ret[0].(int64)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// DeleteOldAgentNetworkAccessLogs indicates an expected call of DeleteOldAgentNetworkAccessLogs.
+func (mr *MockStoreMockRecorder) DeleteOldAgentNetworkAccessLogs(ctx, accountID, olderThan interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteOldAgentNetworkAccessLogs", reflect.TypeOf((*MockStore)(nil).DeleteOldAgentNetworkAccessLogs), ctx, accountID, olderThan)
+}
+
+// GetAllAgentNetworkSettings mocks base method.
+func (m *MockStore) GetAllAgentNetworkSettings(ctx context.Context, lockStrength LockingStrength) ([]*agentNetworkTypes.Settings, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAllAgentNetworkSettings", ctx, lockStrength)
+	ret0, _ := ret[0].([]*agentNetworkTypes.Settings)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAllAgentNetworkSettings indicates an expected call of GetAllAgentNetworkSettings.
+func (mr *MockStoreMockRecorder) GetAllAgentNetworkSettings(ctx, lockStrength interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAllAgentNetworkSettings", reflect.TypeOf((*MockStore)(nil).GetAllAgentNetworkSettings), ctx, lockStrength)
+}
diff --git a/proxy/inbound.go b/proxy/inbound.go
index d729ba9ae..e8f93fbe2 100644
--- a/proxy/inbound.go
+++ b/proxy/inbound.go
@@ -466,15 +466,20 @@ func feedRouterFromListener(ctx context.Context, ln net.Listener, router *nbtcp.
 		_ = ln.Close()
 	}()
 
+	var backoff nbtcp.AcceptBackoff
 	for {
 		conn, err := ln.Accept()
 		if err != nil {
-			if ctx.Err() != nil || errors.Is(err, net.ErrClosed) {
+			if ctx.Err() != nil || nbtcp.IsClosedListenerErr(err) {
+				return
+			}
+			logger.WithField("account_id", accountID).Debugf("plain inbound accept: %v; backing off", err)
+			if !backoff.Backoff(ctx) {
 				return
 			}
-			logger.WithField("account_id", accountID).Debugf("plain inbound accept: %v", err)
 			continue
 		}
+		backoff.Reset()
 		router.HandleConn(ctx, conn)
 	}
 }
diff --git a/proxy/inbound_test.go b/proxy/inbound_test.go
index 584a04238..0e6081802 100644
--- a/proxy/inbound_test.go
+++ b/proxy/inbound_test.go
@@ -533,3 +533,125 @@ MHcCAQEEIIrYSSNQFaA2Hwf1duRSxKtLYX5CB04fSeQ6tF1aY/PuoAoGCCqGSM49
 AwEHoUQDQgAEPR3tU2Fta9ktY+6P9G0cWO+0kETA6SFs38GecTyudlHz6xvCdz8q
 EKTcWGekdmdDPsHloRNtsiCa697B2O9IFA==
 -----END EC PRIVATE KEY-----`)
+
+// scriptedAcceptListener returns pre-scripted errors from Accept(). Used
+// to drive the feedRouterFromListener tests without binding a real
+// socket — the production code path is a netstack-backed listener that
+// returns gVisor's "endpoint is in invalid state" forever after its
+// endpoint is destroyed.
+type scriptedAcceptListener struct {
+	errs   chan error
+	closed chan struct{}
+}
+
+func newScriptedAcceptListener(errs ...error) *scriptedAcceptListener {
+	s := &scriptedAcceptListener{
+		errs:   make(chan error, len(errs)+1),
+		closed: make(chan struct{}),
+	}
+	for _, e := range errs {
+		s.errs <- e
+	}
+	return s
+}
+
+func (s *scriptedAcceptListener) Accept() (net.Conn, error) {
+	select {
+	case <-s.closed:
+		return nil, net.ErrClosed
+	case err := <-s.errs:
+		return nil, err
+	}
+}
+
+func (s *scriptedAcceptListener) Close() error {
+	select {
+	case <-s.closed:
+	default:
+		close(s.closed)
+	}
+	return nil
+}
+
+func (s *scriptedAcceptListener) Addr() net.Addr {
+	return &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0}
+}
+
+// errSentinel carries a literal error message so tests can synthesise
+// the exact gVisor text without importing the netstack package.
+type errSentinel string
+
+func (e errSentinel) Error() string { return string(e) }
+
+// TestFeedRouterFromListener_ExitsOnGVisorInvalidEndpoint is the
+// regression guard for the inbound side of the tight-loop bug. The
+// per-account plain-HTTP feeder must recognise gVisor's "endpoint is in
+// invalid state" and exit, otherwise it pegs a CPU core and floods the
+// account-scoped log with the same accept error every iteration.
+func TestFeedRouterFromListener_ExitsOnGVisorInvalidEndpoint(t *testing.T) {
+	logger := log.StandardLogger()
+	addr := &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 80}
+	router := nbtcp.NewRouter(logger, nil, addr)
+
+	gvisorErr := &net.OpError{
+		Op:   "accept",
+		Net:  "tcp",
+		Addr: addr,
+		Err:  errSentinel("endpoint is in invalid state"),
+	}
+	ln := newScriptedAcceptListener(gvisorErr)
+	defer ln.Close()
+
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		feedRouterFromListener(context.Background(), ln, router, logger, "acct-1")
+	}()
+
+	select {
+	case <-done:
+		// Expected: loop recognised the gVisor error and returned.
+	case <-time.After(2 * time.Second):
+		t.Fatal("feedRouterFromListener did not exit on gVisor 'endpoint is in invalid state' — accept loop is spinning")
+	}
+}
+
+// TestFeedRouterFromListener_BacksOffOnTransientError asserts the
+// defence-in-depth path: an unknown sticky Accept error must NOT cause
+// CPU spin. The loop backs off and exits cleanly when ctx is cancelled.
+func TestFeedRouterFromListener_BacksOffOnTransientError(t *testing.T) {
+	logger := log.StandardLogger()
+	addr := &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 80}
+	router := nbtcp.NewRouter(logger, nil, addr)
+
+	const transientCount = 5
+	errs := make([]error, transientCount)
+	for i := range errs {
+		errs[i] = errSentinel("transient: temporary network error")
+	}
+	ln := newScriptedAcceptListener(errs...)
+	defer ln.Close()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	start := time.Now()
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		feedRouterFromListener(ctx, ln, router, logger, "acct-1")
+	}()
+	time.AfterFunc(150*time.Millisecond, cancel)
+
+	select {
+	case <-done:
+		// Expected.
+	case <-time.After(2 * time.Second):
+		t.Fatal("feedRouterFromListener did not exit on ctx cancellation — backoff or exit path broken")
+	}
+
+	// Without backoff the 5 scripted errors would burn in microseconds.
+	// With backoff the first delay alone is 5ms, so the loop must take
+	// at least that long even though ctx fires at 150ms.
+	elapsed := time.Since(start)
+	assert.GreaterOrEqual(t, elapsed, 5*time.Millisecond,
+		"loop ran without backing off — would burn CPU in production")
+}
diff --git a/proxy/internal/accesslog/logger.go b/proxy/internal/accesslog/logger.go
index 3283f61db..db868b4e0 100644
--- a/proxy/internal/accesslog/logger.go
+++ b/proxy/internal/accesslog/logger.go
@@ -128,6 +128,7 @@ type logEntry struct {
 	BytesDownload int64
 	Protocol      Protocol
 	Metadata      map[string]string
+	AgentNetwork  bool
 }
 
 // Protocol identifies the transport protocol of an access log entry.
@@ -214,6 +215,54 @@ func (l *Logger) allowDenyLog(serviceID types.ServiceID, reason string) bool {
 	return false
 }
 
+// usageMetadataKeys is the allowlist of metadata retained on a stripped,
+// usage-only agent-network entry. Mirrors the llm.* / cost.* keys in
+// proxy/internal/middleware/keys.go — only the dimensions management needs to
+// record a usage row (provider / model / tokens / cost / groups).
+var usageMetadataKeys = map[string]struct{}{
+	"llm.provider":             {},
+	"llm.model":                {},
+	"llm.resolved_provider_id": {},
+	"llm.input_tokens":         {},
+	"llm.output_tokens":        {},
+	"llm.total_tokens":         {},
+	"cost.usd_total":           {},
+	"llm.authorising_groups":   {},
+}
+
+// stripAgentNetworkEntryForUsage returns the entry reduced to what's needed to
+// record usage/cost: it drops request detail (host / path / source IP) and any
+// prompt capture, keeping the LLM usage metadata plus the caller identity
+// (user / auth mechanism) needed for attribution. Shipped when an
+// agent-network account has log collection disabled but usage must still be
+// collected. logEntry is passed by value, so mutating it here is safe; Metadata
+// is replaced with a fresh map rather than mutated in place.
+func stripAgentNetworkEntryForUsage(entry logEntry) logEntry {
+	entry.Host = ""
+	entry.Path = ""
+	entry.SourceIP = netip.Addr{}
+	// Drop the rest of the per-request telemetry too — a usage-only entry
+	// must carry the LLM usage metadata and caller identity, nothing that
+	// describes the individual request.
+	entry.Method = ""
+	entry.ResponseCode = 0
+	entry.DurationMs = 0
+	entry.BytesUpload = 0
+	entry.BytesDownload = 0
+	entry.Protocol = ""
+
+	if len(entry.Metadata) > 0 {
+		stripped := make(map[string]string, len(usageMetadataKeys))
+		for k := range usageMetadataKeys {
+			if v, ok := entry.Metadata[k]; ok {
+				stripped[k] = v
+			}
+		}
+		entry.Metadata = stripped
+	}
+	return entry
+}
+
 func (l *Logger) log(entry logEntry) {
 	// Fire off the log request in a separate routine.
 	// This increases the possibility of losing a log message
@@ -264,6 +313,7 @@ func (l *Logger) log(entry logEntry) {
 				BytesDownload: entry.BytesDownload,
 				Protocol:      string(entry.Protocol),
 				Metadata:      entry.Metadata,
+				AgentNetwork:  entry.AgentNetwork,
 			},
 		}); err != nil {
 			l.logger.WithFields(log.Fields{
diff --git a/proxy/internal/accesslog/middleware.go b/proxy/internal/accesslog/middleware.go
index 5a0684c19..9c644418e 100644
--- a/proxy/internal/accesslog/middleware.go
+++ b/proxy/internal/accesslog/middleware.go
@@ -83,11 +83,23 @@ func (l *Logger) Middleware(next http.Handler) http.Handler {
 			BytesDownload: bytesDownload,
 			Protocol:      ProtocolHTTP,
 			Metadata:      capturedData.GetMetadata(),
+			AgentNetwork:  capturedData.GetAgentNetwork(),
 		}
 		l.logger.Debugf("response: request_id=%s method=%s host=%s path=%s status=%d duration=%dms source=%s origin=%s service=%s account=%s",
 			requestID, r.Method, host, r.URL.Path, sw.status, duration.Milliseconds(), sourceIp, capturedData.GetOrigin(), capturedData.GetServiceID(), capturedData.GetAccountID())
 
-		l.log(entry)
+		// Emit the access log unless the matched target opted out
+		// (agent-network synth targets do this when the account's
+		// EnableLogCollection toggle is off). For agent-network entries we
+		// still ship a stripped, usage-only record even when suppressed, so
+		// usage/cost is collected regardless of the log-collection toggle;
+		// request detail and prompt capture are dropped before sending.
+		switch {
+		case !capturedData.GetSuppressAccessLog():
+			l.log(entry)
+		case entry.AgentNetwork:
+			l.log(stripAgentNetworkEntryForUsage(entry))
+		}
 
 		// Track usage for cost monitoring (upload + download) by domain
 		l.trackUsage(host, bytesUpload+bytesDownload)
diff --git a/proxy/internal/accesslog/middleware_test.go b/proxy/internal/accesslog/middleware_test.go
new file mode 100644
index 000000000..cf91957a8
--- /dev/null
+++ b/proxy/internal/accesslog/middleware_test.go
@@ -0,0 +1,185 @@
+package accesslog
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+
+	"github.com/netbirdio/netbird/proxy/internal/proxy"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// recorderClient is a minimal stub for the access-log gRPCClient interface. It
+// counts SendAccessLog invocations and signals on every call so tests can
+// deterministically wait for the goroutine inside Logger.log without sleeping.
+type recorderClient struct {
+	mu        sync.Mutex
+	calls     int64
+	lastEntry *proto.AccessLog
+	called    chan struct{}
+}
+
+func newRecorderClient() *recorderClient {
+	return &recorderClient{called: make(chan struct{}, 16)}
+}
+
+func (r *recorderClient) SendAccessLog(_ context.Context, in *proto.SendAccessLogRequest, _ ...grpc.CallOption) (*proto.SendAccessLogResponse, error) {
+	r.mu.Lock()
+	r.calls++
+	r.lastEntry = in.GetLog()
+	r.mu.Unlock()
+	select {
+	case r.called <- struct{}{}:
+	default:
+	}
+	return &proto.SendAccessLogResponse{}, nil
+}
+
+func (r *recorderClient) callCount() int64 {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return r.calls
+}
+
+// newTestLogger builds a Logger backed by the supplied recorderClient. It is
+// the same constructor production uses, just with a stub gRPC client — no
+// mocks, no interface re-implementations.
+func newTestLogger(t *testing.T, client *recorderClient) *Logger {
+	t.Helper()
+	logger := NewLogger(client, nil, nil)
+	t.Cleanup(logger.Close)
+	return logger
+}
+
+// TestMiddleware_SuppressAccessLog_SkipsLogSink asserts the suppression gate.
+// When the inner handler stamps SuppressAccessLog=true on CapturedData (mirrors
+// what reverseproxy does when the matched target's DisableAccessLog flag is
+// set), the middleware must NOT invoke the access-log sink. Bandwidth telemetry
+// (trackUsage) keeps running — it's the call to SendAccessLog that we gate.
+func TestMiddleware_SuppressAccessLog_SkipsLogSink(t *testing.T) {
+	client := newRecorderClient()
+	l := newTestLogger(t, client)
+
+	inner := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		cd := proxy.CapturedDataFromContext(r.Context())
+		require.NotNil(t, cd, "middleware must inject CapturedData into the request context")
+		cd.SetSuppressAccessLog(true)
+		w.WriteHeader(http.StatusOK)
+	})
+
+	srv := httptest.NewServer(l.Middleware(inner))
+	t.Cleanup(srv.Close)
+
+	resp, err := http.Get(srv.URL + "/agent-network/v1/chat/completions")
+	require.NoError(t, err, "GET against suppressed target must succeed")
+	require.NoError(t, resp.Body.Close())
+	require.Equal(t, http.StatusOK, resp.StatusCode, "inner handler must run normally")
+
+	// Give the goroutine fence a beat (Logger.log dispatches in a goroutine).
+	// The negative assertion needs a small window: if a send is going to
+	// happen, it happens promptly.
+	select {
+	case <-client.called:
+		t.Fatalf("access-log sink must not be invoked when SuppressAccessLog=true (got %d call(s))", client.callCount())
+	case <-time.After(150 * time.Millisecond):
+	}
+
+	assert.Equal(t, int64(0), client.callCount(),
+		"SendAccessLog must not be called for suppressed requests")
+}
+
+// TestMiddleware_SuppressAccessLog_DefaultEmitsLog is the regression sanity:
+// when nothing sets SuppressAccessLog (the universal default for every
+// non-agent-network target), the middleware MUST still emit the access-log
+// entry. This is the guarantee that wires-through to the EnableLogCollection
+// gate without breaking anyone who isn't opted in.
+func TestMiddleware_SuppressAccessLog_DefaultEmitsLog(t *testing.T) {
+	client := newRecorderClient()
+	l := newTestLogger(t, client)
+
+	var innerRan atomic.Bool
+	inner := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		innerRan.Store(true)
+		// Intentionally DO NOT touch SuppressAccessLog — mirrors every
+		// non-agent-network target.
+		w.WriteHeader(http.StatusOK)
+	})
+
+	srv := httptest.NewServer(l.Middleware(inner))
+	t.Cleanup(srv.Close)
+
+	resp, err := http.Get(srv.URL + "/service/healthz")
+	require.NoError(t, err, "GET against default target must succeed")
+	require.NoError(t, resp.Body.Close())
+	require.Equal(t, http.StatusOK, resp.StatusCode, "inner handler must run normally")
+	require.True(t, innerRan.Load(), "inner handler must have run")
+
+	select {
+	case <-client.called:
+	case <-time.After(2 * time.Second):
+		t.Fatalf("SendAccessLog must be invoked for non-suppressed requests, none observed (calls=%d)", client.callCount())
+	}
+
+	assert.Equal(t, int64(1), client.callCount(),
+		"non-suppressed request must produce exactly one access-log send")
+}
+
+// TestMiddleware_SuppressAccessLog_PreservesUsageTracking proves the gate is
+// surgical: with SuppressAccessLog=true the access-log send is skipped, but
+// the per-domain usage tracker still records the bytes transferred. This is
+// the cost-monitoring guarantee called out in the gate's comment.
+func TestMiddleware_SuppressAccessLog_PreservesUsageTracking(t *testing.T) {
+	client := newRecorderClient()
+	l := newTestLogger(t, client)
+
+	payload := []byte("ok")
+	inner := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		cd := proxy.CapturedDataFromContext(r.Context())
+		require.NotNil(t, cd, "middleware must inject CapturedData")
+		cd.SetSuppressAccessLog(true)
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write(payload)
+	})
+
+	srv := httptest.NewServer(l.Middleware(inner))
+	t.Cleanup(srv.Close)
+
+	resp, err := http.Get(srv.URL + "/agent-network/v1/chat/completions")
+	require.NoError(t, err)
+	require.NoError(t, resp.Body.Close())
+
+	// Allow trackUsage to land — it runs synchronously after l.log(entry) is
+	// (would have been) called.
+	time.Sleep(50 * time.Millisecond)
+
+	l.usageMux.Lock()
+	usage, present := l.domainUsage[hostNoPort(srv.URL)]
+	l.usageMux.Unlock()
+	require.True(t, present, "domain usage must be tracked even when the access-log is suppressed")
+	assert.Greater(t, usage.bytesTransferred, int64(0), "bytesTransferred must include the response payload")
+	assert.Equal(t, int64(0), client.callCount(),
+		"SendAccessLog must remain suppressed across the response write")
+}
+
+// hostNoPort extracts the host name from an httptest server URL. The
+// middleware strips the port before keying domain usage, so the test mirrors
+// that to look the entry up.
+func hostNoPort(url string) string {
+	// httptest URLs are always "http://127.0.0.1:PORT".
+	const prefix = "http://"
+	host := url[len(prefix):]
+	for i := 0; i < len(host); i++ {
+		if host[i] == ':' || host[i] == '/' {
+			return host[:i]
+		}
+	}
+	return host
+}
diff --git a/proxy/internal/auth/middleware_test.go b/proxy/internal/auth/middleware_test.go
index c0ec5c94c..6608c2b22 100644
--- a/proxy/internal/auth/middleware_test.go
+++ b/proxy/internal/auth/middleware_test.go
@@ -297,6 +297,109 @@ func TestProtect_SessionCookieGroupsPropagate(t *testing.T) {
 	assert.Equal(t, groups, capturedData.GetUserGroups(), "CapturedData groups must be retained after handler completes")
 }
 
+// stubTunnelValidator implements SessionValidator for the tunnel-peer
+// path. ValidateTunnelPeer returns a fixed response so tests can assert
+// how the proxy maps it onto CapturedData, and records whether the
+// fast-path actually reached management.
+type stubTunnelValidator struct {
+	called bool
+	resp   *proto.ValidateTunnelPeerResponse
+}
+
+func (s *stubTunnelValidator) ValidateSession(context.Context, *proto.ValidateSessionRequest, ...grpc.CallOption) (*proto.ValidateSessionResponse, error) {
+	return nil, errors.New("not used in this test")
+}
+
+func (s *stubTunnelValidator) ValidateTunnelPeer(context.Context, *proto.ValidateTunnelPeerRequest, ...grpc.CallOption) (*proto.ValidateTunnelPeerResponse, error) {
+	s.called = true
+	return s.resp, nil
+}
+
+// TestProtect_PrivateService_TunnelPeerGroupsPropagate locks the agent-network
+// auth path end-to-end at the proxy edge: a Private service must route through
+// ValidateTunnelPeer and lift the returned peer_group_ids onto CapturedData so
+// the llm_router group-authorisation pass can see them. Regression guard for
+// the failure that surfaces downstream as llm_policy.no_authorised_provider —
+// i.e. a synthesised service that reaches the proxy without private=true (so
+// this path is skipped) leaves UserGroups empty and every request is denied.
+func TestProtect_PrivateService_TunnelPeerGroupsPropagate(t *testing.T) {
+	groups := []string{"grp-admins", "grp-users"}
+	names := []string{"Admins", "Users"}
+	validator := &stubTunnelValidator{resp: &proto.ValidateTunnelPeerResponse{
+		Valid:          true,
+		UserId:         "user-1",
+		UserEmail:      "user@example.com",
+		SessionToken:   "tunnel-session-token",
+		PeerGroupIds:   groups,
+		PeerGroupNames: names,
+	}}
+	mw := NewMiddleware(log.StandardLogger(), validator, nil)
+	kp := generateTestKeyPair(t)
+
+	// Private service: no operator schemes — auth gates solely on the tunnel peer.
+	require.NoError(t, mw.AddDomain("agent.example.com", nil, kp.PublicKey, time.Hour, "acct-1", "svc-1", nil, true))
+
+	cd := proxy.NewCapturedData("")
+	cd.SetClientIP(netip.MustParseAddr("100.90.1.14")) // CGNAT tunnel source
+
+	var seenGroups []string
+	var seenUser string
+	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		c := proxy.CapturedDataFromContext(r.Context())
+		require.NotNil(t, c, "captured data must be present in request context")
+		seenGroups = c.GetUserGroups()
+		seenUser = c.GetUserID()
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	lookup := TunnelLookupFunc(func(_ netip.Addr) (PeerIdentity, bool) {
+		return PeerIdentity{}, true
+	})
+	req := httptest.NewRequest(http.MethodPost, "http://agent.example.com/v1/chat/completions", nil)
+	req.RemoteAddr = "100.90.1.14:5000"
+	req = req.WithContext(WithTunnelLookup(proxy.WithCapturedData(req.Context(), cd), lookup))
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	require.Equal(t, http.StatusOK, rec.Code, "private service must authorise a tunnel peer the validator accepts")
+	assert.Equal(t, groups, seenGroups, "ValidateTunnelPeer peer_group_ids must reach CapturedData.UserGroups for llm_router authorisation")
+	assert.Equal(t, "user-1", seenUser, "tunnel-peer principal must reach CapturedData")
+	assert.Equal(t, groups, cd.GetUserGroups(), "groups must persist on CapturedData after the handler returns")
+}
+
+// TestProtect_PrivateService_TunnelPeerDenied verifies the deny path: when
+// ValidateTunnelPeer rejects the peer, a Private service 403s and never reaches
+// the upstream handler (no fall-through to unauthenticated pass-through).
+func TestProtect_PrivateService_TunnelPeerDenied(t *testing.T) {
+	validator := &stubTunnelValidator{resp: &proto.ValidateTunnelPeerResponse{
+		Valid:        false,
+		DeniedReason: "not_in_group",
+	}}
+	mw := NewMiddleware(log.StandardLogger(), validator, nil)
+	kp := generateTestKeyPair(t)
+	require.NoError(t, mw.AddDomain("agent.example.com", nil, kp.PublicKey, time.Hour, "acct-1", "svc-1", nil, true))
+
+	cd := proxy.NewCapturedData("")
+	cd.SetClientIP(netip.MustParseAddr("100.90.1.14"))
+
+	reached := false
+	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		reached = true
+		w.WriteHeader(http.StatusOK)
+	}))
+	lookup := TunnelLookupFunc(func(_ netip.Addr) (PeerIdentity, bool) {
+		return PeerIdentity{}, true
+	})
+	req := httptest.NewRequest(http.MethodPost, "http://agent.example.com/v1/chat/completions", nil)
+	req.RemoteAddr = "100.90.1.14:5000"
+	req = req.WithContext(WithTunnelLookup(proxy.WithCapturedData(req.Context(), cd), lookup))
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	assert.Equal(t, http.StatusForbidden, rec.Code, "private service must 403 when the tunnel peer is rejected")
+	assert.False(t, reached, "denied private request must not reach the upstream handler")
+}
+
 func TestProtect_ExpiredSessionCookieIsRejected(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 	kp := generateTestKeyPair(t)
@@ -1228,22 +1331,6 @@ func TestProtect_NonOIDCSchemes_PlainHTTP_NotBlocked(t *testing.T) {
 	assert.Equal(t, http.StatusUnauthorized, rec.Code, "PIN-only domain should serve the login page on plain HTTP")
 }
 
-// stubTunnelValidator records ValidateTunnelPeer calls so a test can
-// assert whether the fast-path reached management.
-type stubTunnelValidator struct {
-	called bool
-	resp   *proto.ValidateTunnelPeerResponse
-}
-
-func (s *stubTunnelValidator) ValidateSession(context.Context, *proto.ValidateSessionRequest, ...grpc.CallOption) (*proto.ValidateSessionResponse, error) {
-	return nil, errors.New("not used in this test")
-}
-
-func (s *stubTunnelValidator) ValidateTunnelPeer(context.Context, *proto.ValidateTunnelPeerRequest, ...grpc.CallOption) (*proto.ValidateTunnelPeerResponse, error) {
-	s.called = true
-	return s.resp, nil
-}
-
 // TestProtect_TunnelPeerFastPath_RequiresInboundMarker guards the
 // anti-spoof gate: a request with an RFC1918 source IP arriving on the
 // public listener (no TunnelLookupFromContext attached) must not be
diff --git a/proxy/internal/llm/anthropic.go b/proxy/internal/llm/anthropic.go
new file mode 100644
index 000000000..523731fbd
--- /dev/null
+++ b/proxy/internal/llm/anthropic.go
@@ -0,0 +1,196 @@
+package llm
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+)
+
+// AnthropicParser implements the Parser interface for the Anthropic Messages
+// and Completions APIs. Detection is substring-based to tolerate upstream
+// path rewrites.
+type AnthropicParser struct{}
+
+var anthropicPathHints = []string{
+	"/v1/messages",
+	"/v1/complete",
+}
+
+// Provider returns ProviderAnthropic.
+func (AnthropicParser) Provider() Provider { return ProviderAnthropic }
+
+// ProviderName returns the stable label used for metrics and metadata.
+func (AnthropicParser) ProviderName() string { return "anthropic" }
+
+// DetectFromURL reports whether the given request path looks like an
+// Anthropic API endpoint. The match is case-insensitive and substring-based.
+func (AnthropicParser) DetectFromURL(path string) bool {
+	lower := strings.ToLower(path)
+	for _, hint := range anthropicPathHints {
+		if strings.Contains(lower, hint) {
+			return true
+		}
+	}
+	return false
+}
+
+type anthropicRequest struct {
+	Model    string             `json:"model"`
+	Stream   *bool              `json:"stream"`
+	System   json.RawMessage    `json:"system"`
+	Messages []anthropicMessage `json:"messages"`
+	// Legacy /v1/complete endpoint.
+	Prompt string `json:"prompt"`
+}
+
+type anthropicMessage struct {
+	Role    string          `json:"role"`
+	Content json.RawMessage `json:"content"`
+}
+
+// ParseRequest extracts the model name and streaming flag from an Anthropic
+// request body. Unknown or missing fields leave the corresponding struct
+// members zero-valued.
+func (AnthropicParser) ParseRequest(body []byte) (RequestFacts, error) {
+	var req anthropicRequest
+	if err := json.Unmarshal(body, &req); err != nil {
+		return RequestFacts{}, fmt.Errorf("decode anthropic request: %w: %v", ErrMalformedRequest, err)
+	}
+	return RequestFacts{
+		Model:  req.Model,
+		Stream: ptrDeref(req.Stream),
+	}, nil
+}
+
+type anthropicResponse struct {
+	Usage struct {
+		InputTokens  int64 `json:"input_tokens"`
+		OutputTokens int64 `json:"output_tokens"`
+		// CacheReadInputTokens and CacheCreationInputTokens are
+		// ADDITIVE to InputTokens (not subset), each billed at its
+		// own rate by the cost meter. cache_read is the cheaper
+		// read-from-cache rate, cache_creation is the more
+		// expensive write-to-cache rate.
+		CacheReadInputTokens     int64 `json:"cache_read_input_tokens"`
+		CacheCreationInputTokens int64 `json:"cache_creation_input_tokens"`
+	} `json:"usage"`
+}
+
+// ParseResponse decodes the non-streaming Anthropic response envelope. Status
+// codes other than 200 are treated as non-LLM responses so the caller can
+// skip cost accounting without aborting the request.
+func (AnthropicParser) ParseResponse(status int, contentType string, body []byte) (Usage, error) {
+	if status != 200 {
+		return Usage{}, fmt.Errorf("anthropic status %d: %w", status, ErrNotLLMResponse)
+	}
+	if isEventStream(contentType) {
+		return Usage{}, ErrStreamingUnsupported
+	}
+	if !isJSON(contentType) {
+		return Usage{}, fmt.Errorf("anthropic content-type %q: %w", contentType, ErrNotLLMResponse)
+	}
+
+	var resp anthropicResponse
+	if err := json.Unmarshal(body, &resp); err != nil {
+		return Usage{}, fmt.Errorf("decode anthropic response: %w: %v", ErrMalformedResponse, err)
+	}
+	return Usage{
+		InputTokens:         resp.Usage.InputTokens,
+		OutputTokens:        resp.Usage.OutputTokens,
+		TotalTokens:         resp.Usage.InputTokens + resp.Usage.OutputTokens + resp.Usage.CacheReadInputTokens + resp.Usage.CacheCreationInputTokens,
+		CachedInputTokens:   resp.Usage.CacheReadInputTokens,
+		CacheCreationTokens: resp.Usage.CacheCreationInputTokens,
+	}, nil
+}
+
+// ExtractPrompt returns the user-visible prompt text from an Anthropic
+// request body. Handles the Messages API (system + messages[]) and the
+// legacy /v1/complete prompt string. Returns "" on any decode failure.
+func (AnthropicParser) ExtractPrompt(body []byte) string {
+	var req anthropicRequest
+	if err := json.Unmarshal(body, &req); err != nil {
+		return ""
+	}
+	var b strings.Builder
+	if len(req.System) > 0 {
+		if s := decodeStringOrJoin(req.System); s != "" {
+			b.WriteString("system: ")
+			b.WriteString(s)
+		}
+	}
+	for _, m := range req.Messages {
+		if b.Len() > 0 {
+			b.WriteByte('\n')
+		}
+		if m.Role != "" {
+			b.WriteString(m.Role)
+			b.WriteString(": ")
+		}
+		b.WriteString(decodeStringOrJoin(m.Content))
+	}
+	if b.Len() == 0 && req.Prompt != "" {
+		b.WriteString(req.Prompt)
+	}
+	return b.String()
+}
+
+// ExtractSessionID is the body-side fallback for Anthropic. Claude Code's
+// authoritative session marker is the X-Claude-Code-Session-Id request
+// header (handled by the request-parser middleware); this only mines the
+// optional metadata.user_id for an embedded "...session_<uuid>" marker.
+// metadata.user_id on its own is a USER identifier, not a session, so the
+// whole value is deliberately NOT used — returning it would mislabel every
+// request from a user as one session. Returns "" when no session marker is
+// present.
+func (AnthropicParser) ExtractSessionID(body []byte) string {
+	var req struct {
+		Metadata struct {
+			UserID string `json:"user_id"`
+		} `json:"metadata"`
+	}
+	if err := json.Unmarshal(body, &req); err != nil {
+		return ""
+	}
+	if idx := strings.LastIndex(req.Metadata.UserID, "session_"); idx >= 0 {
+		if session := req.Metadata.UserID[idx+len("session_"):]; session != "" {
+			return session
+		}
+	}
+	return ""
+}
+
+type anthropicMessageResponse struct {
+	Content []struct {
+		Type string `json:"type"`
+		Text string `json:"text"`
+	} `json:"content"`
+	// Legacy /v1/complete response.
+	Completion string `json:"completion"`
+}
+
+// ExtractCompletion returns the assistant text from a non-streaming Anthropic
+// Messages or Completions response. Returns "" when status/content-type
+// indicate the body is not parseable or no text part is present.
+func (AnthropicParser) ExtractCompletion(status int, contentType string, body []byte) string {
+	if status != 200 || isEventStream(contentType) || !isJSON(contentType) {
+		return ""
+	}
+	var resp anthropicMessageResponse
+	if err := json.Unmarshal(body, &resp); err != nil {
+		return ""
+	}
+	var b strings.Builder
+	for _, part := range resp.Content {
+		if part.Text == "" {
+			continue
+		}
+		if b.Len() > 0 {
+			b.WriteByte('\n')
+		}
+		b.WriteString(part.Text)
+	}
+	if b.Len() == 0 {
+		return resp.Completion
+	}
+	return b.String()
+}
diff --git a/proxy/internal/llm/anthropic_test.go b/proxy/internal/llm/anthropic_test.go
new file mode 100644
index 000000000..a0c1f7896
--- /dev/null
+++ b/proxy/internal/llm/anthropic_test.go
@@ -0,0 +1,169 @@
+package llm
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAnthropicDetectFromURL(t *testing.T) {
+	p := AnthropicParser{}
+
+	cases := map[string]bool{
+		"/v1/messages":         true,
+		"/v1/complete":         true,
+		"/V1/Messages":         true,
+		"/proxy/v1/messages?x": true,
+		"/v1/chat/completions": false,
+		"":                     false,
+	}
+	for path, want := range cases {
+		assert.Equal(t, want, p.DetectFromURL(path), "DetectFromURL(%q)", path)
+	}
+}
+
+func TestAnthropicParseRequest(t *testing.T) {
+	p := AnthropicParser{}
+
+	t.Run("stream true", func(t *testing.T) {
+		facts, err := p.ParseRequest([]byte(`{"model":"claude-sonnet-4-5","stream":true}`))
+		require.NoError(t, err)
+		assert.Equal(t, "claude-sonnet-4-5", facts.Model, "model extracted")
+		assert.True(t, facts.Stream, "stream flag honoured")
+	})
+
+	t.Run("stream default", func(t *testing.T) {
+		facts, err := p.ParseRequest([]byte(`{"model":"claude-sonnet-4-5"}`))
+		require.NoError(t, err)
+		assert.False(t, facts.Stream, "missing stream flag defaults to false")
+	})
+
+	t.Run("malformed", func(t *testing.T) {
+		_, err := p.ParseRequest([]byte(`{"model":`))
+		require.Error(t, err)
+		assert.True(t, errors.Is(err, ErrMalformedRequest), "sentinel wrapped")
+	})
+}
+
+func TestAnthropicParseResponse(t *testing.T) {
+	p := AnthropicParser{}
+
+	t.Run("happy fixture", func(t *testing.T) {
+		body, err := os.ReadFile(filepath.Join("fixtures", "anthropic_messages.json"))
+		require.NoError(t, err, "fixture must be readable")
+
+		usage, err := p.ParseResponse(200, "application/json", body)
+		require.NoError(t, err)
+		assert.Equal(t, int64(123), usage.InputTokens, "input tokens extracted")
+		assert.Equal(t, int64(45), usage.OutputTokens, "output tokens extracted")
+		assert.Equal(t, int64(168), usage.TotalTokens, "total computed as sum")
+	})
+
+	t.Run("streaming rejected", func(t *testing.T) {
+		_, err := p.ParseResponse(200, "text/event-stream", []byte(""))
+		require.ErrorIs(t, err, ErrStreamingUnsupported, "SSE responses must use the scanner")
+	})
+
+	t.Run("non-200", func(t *testing.T) {
+		_, err := p.ParseResponse(429, "application/json", []byte(`{}`))
+		require.ErrorIs(t, err, ErrNotLLMResponse, "non-200 rejected as non-LLM")
+	})
+
+	t.Run("non-json content type", func(t *testing.T) {
+		_, err := p.ParseResponse(200, "text/html", []byte(`{}`))
+		require.ErrorIs(t, err, ErrNotLLMResponse, "text/html treated as non-LLM")
+	})
+
+	t.Run("malformed body", func(t *testing.T) {
+		_, err := p.ParseResponse(200, "application/json", []byte(`{`))
+		require.ErrorIs(t, err, ErrMalformedResponse, "bad JSON yields malformed error")
+	})
+
+	// Anthropic's two cache fields are ADDITIVE to input_tokens (not
+	// subset). The parser must surface them so the cost meter can
+	// bill each bucket at its own configured rate. Total includes
+	// every bucket so downstream attribution sees the full token
+	// volume the request consumed.
+	t.Run("cache_read_input_tokens surfaces as CachedInputTokens (additive)", func(t *testing.T) {
+		body := []byte(`{"usage":{"input_tokens":256,"output_tokens":200,"cache_read_input_tokens":768}}`)
+		usage, err := p.ParseResponse(200, "application/json", body)
+		require.NoError(t, err)
+		assert.Equal(t, int64(256), usage.InputTokens, "regular input remains separate from cache buckets")
+		assert.Equal(t, int64(768), usage.CachedInputTokens, "cache_read maps onto CachedInputTokens — same field carries OpenAI cached subset and Anthropic cache reads")
+		assert.Zero(t, usage.CacheCreationTokens)
+		assert.Equal(t, int64(256+200+768), usage.TotalTokens, "total includes every input bucket plus output — cache reads are billable tokens")
+	})
+
+	t.Run("cache_creation_input_tokens surfaces as CacheCreationTokens (additive)", func(t *testing.T) {
+		body := []byte(`{"usage":{"input_tokens":256,"output_tokens":200,"cache_creation_input_tokens":512}}`)
+		usage, err := p.ParseResponse(200, "application/json", body)
+		require.NoError(t, err)
+		assert.Equal(t, int64(256), usage.InputTokens)
+		assert.Zero(t, usage.CachedInputTokens)
+		assert.Equal(t, int64(512), usage.CacheCreationTokens, "cache_creation surfaces — meter applies the write-rate multiplier")
+		assert.Equal(t, int64(256+200+512), usage.TotalTokens)
+	})
+
+	t.Run("both cache buckets present", func(t *testing.T) {
+		body := []byte(`{"usage":{"input_tokens":256,"output_tokens":200,"cache_read_input_tokens":768,"cache_creation_input_tokens":512}}`)
+		usage, err := p.ParseResponse(200, "application/json", body)
+		require.NoError(t, err)
+		assert.Equal(t, int64(768), usage.CachedInputTokens)
+		assert.Equal(t, int64(512), usage.CacheCreationTokens)
+		assert.Equal(t, int64(256+200+768+512), usage.TotalTokens, "all four buckets sum into total")
+	})
+
+	t.Run("absent cache fields leave counts at zero", func(t *testing.T) {
+		body := []byte(`{"usage":{"input_tokens":100,"output_tokens":50}}`)
+		usage, err := p.ParseResponse(200, "application/json", body)
+		require.NoError(t, err)
+		assert.Zero(t, usage.CachedInputTokens, "no cache_read field = no cached count")
+		assert.Zero(t, usage.CacheCreationTokens, "no cache_creation field = no creation count")
+		assert.Equal(t, int64(150), usage.TotalTokens, "back to the simple in+out total when no cache buckets present")
+	})
+}
+
+func TestAnthropicExtractPrompt_Messages(t *testing.T) {
+	body := []byte(`{"model":"claude-sonnet-4-7","system":"be brief","messages":[{"role":"user","content":"hi"},{"role":"assistant","content":"yes"}]}`)
+	got := AnthropicParser{}.ExtractPrompt(body)
+	require.Contains(t, got, "system: be brief", "system surfaces with role label")
+	require.Contains(t, got, "user: hi", "user message surfaces")
+	require.Contains(t, got, "assistant: yes", "assistant message surfaces")
+}
+
+func TestAnthropicExtractPrompt_LegacyComplete(t *testing.T) {
+	body := []byte(`{"model":"claude-2","prompt":"\n\nHuman: hi\n\nAssistant:"}`)
+	got := AnthropicParser{}.ExtractPrompt(body)
+	require.Contains(t, got, "Human: hi", "legacy prompt string surfaces")
+}
+
+func TestAnthropicExtractSessionID(t *testing.T) {
+	t.Run("claude code session suffix", func(t *testing.T) {
+		body := []byte(`{"model":"claude-opus-4-8","metadata":{"user_id":"user_abc123_account_def456_session_9f8e7d6c"},"messages":[]}`)
+		assert.Equal(t, "9f8e7d6c", AnthropicParser{}.ExtractSessionID(body), "session_<id> suffix must be extracted from metadata.user_id")
+	})
+	t.Run("plain user_id is not treated as a session", func(t *testing.T) {
+		body := []byte(`{"model":"claude-opus-4-8","metadata":{"user_id":"acme-team"},"messages":[]}`)
+		assert.Equal(t, "", AnthropicParser{}.ExtractSessionID(body), "a user identifier without a session marker must NOT be used as a session id")
+	})
+	t.Run("no metadata yields empty", func(t *testing.T) {
+		body := []byte(`{"model":"claude-opus-4-8","messages":[{"role":"user","content":"hi"}]}`)
+		assert.Equal(t, "", AnthropicParser{}.ExtractSessionID(body), "absent metadata.user_id yields no session id")
+	})
+}
+
+func TestAnthropicExtractCompletion_Messages(t *testing.T) {
+	body, err := os.ReadFile(filepath.Join("fixtures", "anthropic_messages.json"))
+	require.NoError(t, err)
+	got := AnthropicParser{}.ExtractCompletion(200, "application/json", body)
+	require.NotEmpty(t, got, "anthropic fixture has assistant text")
+}
+
+func TestAnthropicExtractCompletion_Streaming(t *testing.T) {
+	got := AnthropicParser{}.ExtractCompletion(200, "text/event-stream", []byte(""))
+	require.Empty(t, got, "streaming responses are skipped")
+}
diff --git a/proxy/internal/llm/bedrock.go b/proxy/internal/llm/bedrock.go
new file mode 100644
index 000000000..f7802beb2
--- /dev/null
+++ b/proxy/internal/llm/bedrock.go
@@ -0,0 +1,189 @@
+package llm
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+)
+
+// ProviderNameBedrock is the stable label for the AWS Bedrock parser, used as
+// the llm.provider metadata value and the cost-meter formula selector.
+const ProviderNameBedrock = "bedrock"
+
+// BedrockParser implements the Parser interface for the AWS Bedrock runtime.
+// Bedrock carries the model in the URL path (/model/{id}/{action}); the request
+// middleware extracts it there, so this parser focuses on the response shapes:
+// the vendor-native InvokeModel body (e.g. Anthropic's snake_case usage) and the
+// unified Converse body (camelCase usage).
+type BedrockParser struct{}
+
+var bedrockPathHints = []string{"/invoke", "/converse"}
+
+// Provider returns ProviderBedrock.
+func (BedrockParser) Provider() Provider { return ProviderBedrock }
+
+// ProviderName returns the stable label used for metrics and metadata.
+func (BedrockParser) ProviderName() string { return ProviderNameBedrock }
+
+// DetectFromURL reports whether the path is a Bedrock runtime model endpoint.
+func (BedrockParser) DetectFromURL(path string) bool {
+	lower := strings.ToLower(path)
+	if !strings.HasPrefix(lower, "/model/") {
+		return false
+	}
+	for _, hint := range bedrockPathHints {
+		if strings.Contains(lower, hint) {
+			return true
+		}
+	}
+	return false
+}
+
+// ParseRequest is a no-op for Bedrock: the model lives in the URL path, not the
+// body, and the streaming flag is derived from the path action. The request
+// middleware handles both via parseBedrockPath, so this returns empty facts.
+func (BedrockParser) ParseRequest([]byte) (RequestFacts, error) {
+	return RequestFacts{}, nil
+}
+
+// bedrockResponse captures token usage from both Bedrock response shapes:
+// InvokeModel (vendor-native; Anthropic uses snake_case + additive cache
+// buckets) and Converse (camelCase, with a precomputed total).
+type bedrockResponse struct {
+	Usage struct {
+		// InvokeModel (Anthropic-on-Bedrock) — snake_case.
+		InputTokens              int64 `json:"input_tokens"`
+		OutputTokens             int64 `json:"output_tokens"`
+		CacheReadInputTokens     int64 `json:"cache_read_input_tokens"`
+		CacheCreationInputTokens int64 `json:"cache_creation_input_tokens"`
+		// Converse — camelCase.
+		InputTokensCamel  int64 `json:"inputTokens"`
+		OutputTokensCamel int64 `json:"outputTokens"`
+		TotalTokensCamel  int64 `json:"totalTokens"`
+	} `json:"usage"`
+}
+
+// ParseResponse decodes the non-streaming Bedrock response envelope, handling
+// both the InvokeModel and Converse usage shapes. Non-200 / non-JSON bodies are
+// treated as non-LLM responses so the caller skips cost accounting.
+func (BedrockParser) ParseResponse(status int, contentType string, body []byte) (Usage, error) {
+	if status != 200 {
+		return Usage{}, fmt.Errorf("bedrock status %d: %w", status, ErrNotLLMResponse)
+	}
+	if isAWSEventStream(contentType) || isEventStream(contentType) {
+		return Usage{}, ErrStreamingUnsupported
+	}
+	if !isJSON(contentType) {
+		return Usage{}, fmt.Errorf("bedrock content-type %q: %w", contentType, ErrNotLLMResponse)
+	}
+
+	var resp bedrockResponse
+	if err := json.Unmarshal(body, &resp); err != nil {
+		return Usage{}, fmt.Errorf("decode bedrock response: %w: %v", ErrMalformedResponse, err)
+	}
+	inTok := firstNonZero(resp.Usage.InputTokens, resp.Usage.InputTokensCamel)
+	outTok := firstNonZero(resp.Usage.OutputTokens, resp.Usage.OutputTokensCamel)
+	total := resp.Usage.TotalTokensCamel
+	if total == 0 {
+		total = inTok + outTok + resp.Usage.CacheReadInputTokens + resp.Usage.CacheCreationInputTokens
+	}
+	return Usage{
+		InputTokens:         inTok,
+		OutputTokens:        outTok,
+		TotalTokens:         total,
+		CachedInputTokens:   resp.Usage.CacheReadInputTokens,
+		CacheCreationTokens: resp.Usage.CacheCreationInputTokens,
+	}, nil
+}
+
+// ExtractPrompt returns the user-visible prompt from a Bedrock request body,
+// handling both the InvokeModel (Anthropic Messages: system + messages[]) and
+// Converse (messages[].content[].text) shapes. Returns "" on decode failure.
+func (BedrockParser) ExtractPrompt(body []byte) string {
+	var req struct {
+		System   json.RawMessage `json:"system"`
+		Messages []struct {
+			Role    string          `json:"role"`
+			Content json.RawMessage `json:"content"`
+		} `json:"messages"`
+	}
+	if err := json.Unmarshal(body, &req); err != nil {
+		return ""
+	}
+	var b strings.Builder
+	if s := decodeStringOrJoin(req.System); s != "" {
+		b.WriteString("system: ")
+		b.WriteString(s)
+	}
+	for _, m := range req.Messages {
+		if b.Len() > 0 {
+			b.WriteByte('\n')
+		}
+		if m.Role != "" {
+			b.WriteString(m.Role)
+			b.WriteString(": ")
+		}
+		b.WriteString(decodeStringOrJoin(m.Content))
+	}
+	return b.String()
+}
+
+// ExtractCompletion returns the assistant text from a non-streaming Bedrock
+// response, handling InvokeModel (Anthropic content[].text) and Converse
+// (output.message.content[].text).
+func (BedrockParser) ExtractCompletion(status int, contentType string, body []byte) string {
+	if status != 200 || isAWSEventStream(contentType) || !isJSON(contentType) {
+		return ""
+	}
+	var resp struct {
+		Content []struct {
+			Text string `json:"text"`
+		} `json:"content"`
+		Output struct {
+			Message struct {
+				Content []struct {
+					Text string `json:"text"`
+				} `json:"content"`
+			} `json:"message"`
+		} `json:"output"`
+	}
+	if err := json.Unmarshal(body, &resp); err != nil {
+		return ""
+	}
+	var b strings.Builder
+	appendText := func(text string) {
+		if text == "" {
+			return
+		}
+		if b.Len() > 0 {
+			b.WriteByte('\n')
+		}
+		b.WriteString(text)
+	}
+	for _, p := range resp.Content {
+		appendText(p.Text)
+	}
+	for _, p := range resp.Output.Message.Content {
+		appendText(p.Text)
+	}
+	return b.String()
+}
+
+// ExtractSessionID has no Bedrock-native marker; session grouping relies on the
+// request headers handled by the middleware. Returns "".
+func (BedrockParser) ExtractSessionID([]byte) string { return "" }
+
+// firstNonZero returns a when non-zero, else b. Folds the snake_case and
+// camelCase usage variants into a single value.
+func firstNonZero(a, b int64) int64 {
+	if a != 0 {
+		return a
+	}
+	return b
+}
+
+// isAWSEventStream reports whether contentType is the AWS binary event-stream
+// framing used by Bedrock's streaming endpoints.
+func isAWSEventStream(contentType string) bool {
+	return strings.Contains(strings.ToLower(contentType), "application/vnd.amazon.eventstream")
+}
diff --git a/proxy/internal/llm/bedrock_test.go b/proxy/internal/llm/bedrock_test.go
new file mode 100644
index 000000000..ca6f092f3
--- /dev/null
+++ b/proxy/internal/llm/bedrock_test.go
@@ -0,0 +1,65 @@
+package llm
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestBedrockParser_ParseResponse_Invoke(t *testing.T) {
+	body := []byte(`{"usage":{"input_tokens":13,"output_tokens":5,"cache_read_input_tokens":2,"cache_creation_input_tokens":4}}`)
+	u, err := BedrockParser{}.ParseResponse(200, "application/json", body)
+	require.NoError(t, err)
+	require.Equal(t, int64(13), u.InputTokens, "invoke input tokens")
+	require.Equal(t, int64(5), u.OutputTokens, "invoke output tokens")
+	require.Equal(t, int64(2), u.CachedInputTokens, "invoke cache-read tokens")
+	require.Equal(t, int64(4), u.CacheCreationTokens, "invoke cache-creation tokens")
+	require.Equal(t, int64(13+5+2+4), u.TotalTokens, "invoke total is additive")
+}
+
+func TestBedrockParser_ParseResponse_Converse(t *testing.T) {
+	body := []byte(`{"output":{"message":{"content":[{"text":"pong"}]}},"usage":{"inputTokens":11,"outputTokens":3,"totalTokens":14}}`)
+	u, err := BedrockParser{}.ParseResponse(200, "application/json", body)
+	require.NoError(t, err)
+	require.Equal(t, int64(11), u.InputTokens, "converse camelCase input tokens")
+	require.Equal(t, int64(3), u.OutputTokens, "converse camelCase output tokens")
+	require.Equal(t, int64(14), u.TotalTokens, "converse uses provider total")
+}
+
+func TestBedrockParser_ParseResponse_StreamingUnsupported(t *testing.T) {
+	_, err := BedrockParser{}.ParseResponse(200, "application/vnd.amazon.eventstream", []byte("binary"))
+	require.ErrorIs(t, err, ErrStreamingUnsupported, "event-stream must route to the streaming accumulator")
+}
+
+func TestBedrockParser_ParseResponse_NonSuccess(t *testing.T) {
+	_, err := BedrockParser{}.ParseResponse(404, "application/json", []byte(`{"message":"gated"}`))
+	require.ErrorIs(t, err, ErrNotLLMResponse, "non-200 is not an LLM response")
+}
+
+func TestBedrockParser_ExtractCompletion(t *testing.T) {
+	invoke := BedrockParser{}.ExtractCompletion(200, "application/json", []byte(`{"content":[{"text":"a"},{"text":"b"}]}`))
+	require.Equal(t, "a\nb", invoke, "invoke completion joins content parts")
+
+	converse := BedrockParser{}.ExtractCompletion(200, "application/json", []byte(`{"output":{"message":{"content":[{"text":"x"}]}}}`))
+	require.Equal(t, "x", converse, "converse completion reads output.message.content")
+}
+
+func TestBedrockParser_ExtractPrompt(t *testing.T) {
+	invoke := BedrockParser{}.ExtractPrompt([]byte(`{"messages":[{"role":"user","content":"hi"}]}`))
+	require.Equal(t, "user: hi", invoke, "invoke prompt reads anthropic content string")
+
+	converse := BedrockParser{}.ExtractPrompt([]byte(`{"messages":[{"role":"user","content":[{"text":"hello"}]}]}`))
+	require.Equal(t, "user: hello", converse, "converse prompt reads content parts")
+}
+
+func TestBedrockParser_DetectFromURL(t *testing.T) {
+	require.True(t, BedrockParser{}.DetectFromURL("/model/eu.anthropic.claude/invoke"), "invoke path")
+	require.True(t, BedrockParser{}.DetectFromURL("/model/x/converse-stream"), "converse-stream path")
+	require.False(t, BedrockParser{}.DetectFromURL("/v1/chat/completions"), "openai path is not bedrock")
+}
+
+func TestBedrockParser_RegisteredByName(t *testing.T) {
+	p, ok := ParserByName(ProviderNameBedrock)
+	require.True(t, ok, "bedrock parser is registered")
+	require.Equal(t, ProviderNameBedrock, p.ProviderName())
+}
diff --git a/proxy/internal/llm/errors.go b/proxy/internal/llm/errors.go
new file mode 100644
index 000000000..09019fbbe
--- /dev/null
+++ b/proxy/internal/llm/errors.go
@@ -0,0 +1,31 @@
+package llm
+
+import "errors"
+
+// Sentinel errors returned by parsers and the pricing loader. Callers use
+// errors.Is to branch on a condition without coupling to parser internals.
+var (
+	// ErrUnknownProvider indicates no parser claimed the request path.
+	ErrUnknownProvider = errors.New("llmobs: unknown provider")
+
+	// ErrUnsupportedModel indicates the response parsed successfully but the
+	// model is absent from the pricing table. Token counts are still valid.
+	ErrUnsupportedModel = errors.New("llmobs: unsupported model")
+
+	// ErrNotLLMResponse indicates the response is not a JSON success body
+	// that a non-streaming parser can consume (non-200 or wrong content type).
+	ErrNotLLMResponse = errors.New("llmobs: not an LLM response")
+
+	// ErrStreamingUnsupported indicates the caller passed an SSE response to
+	// a non-streaming parser. Streaming is handled separately via the SSE
+	// scanner.
+	ErrStreamingUnsupported = errors.New("llmobs: streaming response requires SSE scanner")
+
+	// ErrMalformedResponse indicates the response body could not be decoded
+	// as the provider-specific JSON schema.
+	ErrMalformedResponse = errors.New("llmobs: malformed response body")
+
+	// ErrMalformedRequest indicates the request body could not be decoded as
+	// the provider-specific JSON schema.
+	ErrMalformedRequest = errors.New("llmobs: malformed request body")
+)
diff --git a/proxy/internal/llm/fixtures/anthropic_messages.json b/proxy/internal/llm/fixtures/anthropic_messages.json
new file mode 100644
index 000000000..2c9bb663a
--- /dev/null
+++ b/proxy/internal/llm/fixtures/anthropic_messages.json
@@ -0,0 +1,17 @@
+{
+  "id": "msg_abc",
+  "type": "message",
+  "role": "assistant",
+  "model": "claude-sonnet-4-5",
+  "content": [
+    {
+      "type": "text",
+      "text": "Hello, world!"
+    }
+  ],
+  "stop_reason": "end_turn",
+  "usage": {
+    "input_tokens": 123,
+    "output_tokens": 45
+  }
+}
diff --git a/proxy/internal/llm/fixtures/anthropic_stream.txt b/proxy/internal/llm/fixtures/anthropic_stream.txt
new file mode 100644
index 000000000..2b8bb889c
--- /dev/null
+++ b/proxy/internal/llm/fixtures/anthropic_stream.txt
@@ -0,0 +1,21 @@
+event: message_start
+data: {"type":"message_start","message":{"id":"msg_abc","type":"message","role":"assistant","model":"claude-sonnet-4-5","content":[],"stop_reason":null,"usage":{"input_tokens":123,"output_tokens":1}}}
+
+event: content_block_start
+data: {"type":"content_block_start","index":0,"content_block":{"type":"text","text":""}}
+
+event: content_block_delta
+data: {"type":"content_block_delta","index":0,"delta":{"type":"text_delta","text":"Hello"}}
+
+event: content_block_delta
+data: {"type":"content_block_delta","index":0,"delta":{"type":"text_delta","text":", world!"}}
+
+event: content_block_stop
+data: {"type":"content_block_stop","index":0}
+
+event: message_delta
+data: {"type":"message_delta","delta":{"stop_reason":"end_turn","stop_sequence":null},"usage":{"output_tokens":45}}
+
+event: message_stop
+data: {"type":"message_stop"}
+
diff --git a/proxy/internal/llm/fixtures/openai_chat_completion.json b/proxy/internal/llm/fixtures/openai_chat_completion.json
new file mode 100644
index 000000000..d0e25337b
--- /dev/null
+++ b/proxy/internal/llm/fixtures/openai_chat_completion.json
@@ -0,0 +1,21 @@
+{
+  "id": "chatcmpl-abc",
+  "object": "chat.completion",
+  "created": 1700000000,
+  "model": "gpt-4o-mini",
+  "choices": [
+    {
+      "index": 0,
+      "message": {
+        "role": "assistant",
+        "content": "Hello, world!"
+      },
+      "finish_reason": "stop"
+    }
+  ],
+  "usage": {
+    "prompt_tokens": 123,
+    "completion_tokens": 45,
+    "total_tokens": 168
+  }
+}
diff --git a/proxy/internal/llm/fixtures/openai_responses.json b/proxy/internal/llm/fixtures/openai_responses.json
new file mode 100644
index 000000000..f998fcd33
--- /dev/null
+++ b/proxy/internal/llm/fixtures/openai_responses.json
@@ -0,0 +1,24 @@
+{
+  "id": "resp_abc",
+  "object": "response",
+  "created_at": 1700000000,
+  "model": "gpt-5.4",
+  "output": [
+    {
+      "type": "message",
+      "role": "assistant",
+      "content": [{"type": "output_text", "text": "ok"}]
+    }
+  ],
+  "usage": {
+    "input_tokens": 15,
+    "input_tokens_details": {
+      "cached_tokens": 0
+    },
+    "output_tokens": 414,
+    "output_tokens_details": {
+      "reasoning_tokens": 0
+    },
+    "total_tokens": 429
+  }
+}
diff --git a/proxy/internal/llm/fixtures/openai_responses_stream.txt b/proxy/internal/llm/fixtures/openai_responses_stream.txt
new file mode 100644
index 000000000..2801fa99d
--- /dev/null
+++ b/proxy/internal/llm/fixtures/openai_responses_stream.txt
@@ -0,0 +1,24 @@
+event: response.created
+data: {"type":"response.created","response":{"id":"resp_abc","object":"response","model":"gpt-5.5","usage":null}}
+
+event: response.in_progress
+data: {"type":"response.in_progress","response":{"id":"resp_abc","usage":null}}
+
+event: response.output_item.added
+data: {"type":"response.output_item.added","output_index":0,"item":{"type":"message","role":"assistant","content":[]}}
+
+event: response.content_part.added
+data: {"type":"response.content_part.added","item_id":"msg_1","output_index":0,"content_index":0,"part":{"type":"output_text","text":""}}
+
+event: response.output_text.delta
+data: {"type":"response.output_text.delta","item_id":"msg_1","output_index":0,"content_index":0,"delta":"Hello"}
+
+event: response.output_text.delta
+data: {"type":"response.output_text.delta","item_id":"msg_1","output_index":0,"content_index":0,"delta":", world!"}
+
+event: response.output_text.done
+data: {"type":"response.output_text.done","item_id":"msg_1","output_index":0,"content_index":0,"text":"Hello, world!"}
+
+event: response.completed
+data: {"type":"response.completed","response":{"id":"resp_abc","object":"response","model":"gpt-5.5","usage":{"input_tokens":123,"input_tokens_details":{"cached_tokens":40},"output_tokens":45,"output_tokens_details":{"reasoning_tokens":12},"total_tokens":168}}}
+
diff --git a/proxy/internal/llm/fixtures/openai_stream.txt b/proxy/internal/llm/fixtures/openai_stream.txt
new file mode 100644
index 000000000..058b7ce22
--- /dev/null
+++ b/proxy/internal/llm/fixtures/openai_stream.txt
@@ -0,0 +1,8 @@
+data: {"id":"chatcmpl-abc","object":"chat.completion.chunk","created":1700000000,"model":"gpt-4o-mini","choices":[{"index":0,"delta":{"role":"assistant","content":"Hello"},"finish_reason":null}]}
+
+data: {"id":"chatcmpl-abc","object":"chat.completion.chunk","created":1700000000,"model":"gpt-4o-mini","choices":[{"index":0,"delta":{"content":", world!"},"finish_reason":null}]}
+
+data: {"id":"chatcmpl-abc","object":"chat.completion.chunk","created":1700000000,"model":"gpt-4o-mini","choices":[{"index":0,"delta":{},"finish_reason":"stop"}],"usage":{"prompt_tokens":123,"completion_tokens":45,"total_tokens":168}}
+
+data: [DONE]
+
diff --git a/proxy/internal/llm/fixtures/pricing.yaml b/proxy/internal/llm/fixtures/pricing.yaml
new file mode 100644
index 000000000..3d26ff803
--- /dev/null
+++ b/proxy/internal/llm/fixtures/pricing.yaml
@@ -0,0 +1,59 @@
+# Realistic-pricing starter for llm_observability. Drop this into the
+# directory you point the proxy at via --plugin-data-dir, then reference it
+# from the target's plugin config:
+#
+#   plugins:
+#     - id: llm_observability
+#       enabled: true
+#       params:
+#         pricing_path: pricing.yaml
+#
+# Values are USD per 1_000 tokens. Public list prices drift; treat this as a
+# starting point and keep your production copy current.
+
+openai:
+  # GPT-5 family
+  gpt-5:
+    input_per_1k: 0.00125
+    output_per_1k: 0.01
+  gpt-5-mini:
+    input_per_1k: 0.00025
+    output_per_1k: 0.002
+  gpt-5-nano:
+    input_per_1k: 0.00005
+    output_per_1k: 0.0004
+  gpt-5.4:
+    input_per_1k: 0.00125
+    output_per_1k: 0.01
+  # GPT-4o family
+  gpt-4o:
+    input_per_1k: 0.0025
+    output_per_1k: 0.01
+  gpt-4o-mini:
+    input_per_1k: 0.00015
+    output_per_1k: 0.0006
+  # Embeddings
+  text-embedding-3-large:
+    input_per_1k: 0.00013
+    output_per_1k: 0
+  text-embedding-3-small:
+    input_per_1k: 0.00002
+    output_per_1k: 0
+
+anthropic:
+  # Claude 4.x family
+  claude-opus-4-7:
+    input_per_1k: 0.015
+    output_per_1k: 0.075
+  claude-sonnet-4-7:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+  claude-sonnet-4-6:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+  claude-sonnet-4-5:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+  claude-haiku-4-5:
+    input_per_1k: 0.0008
+    output_per_1k: 0.004
diff --git a/proxy/internal/llm/openai.go b/proxy/internal/llm/openai.go
new file mode 100644
index 000000000..86ee30797
--- /dev/null
+++ b/proxy/internal/llm/openai.go
@@ -0,0 +1,412 @@
+package llm
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+)
+
+// OpenAIParser implements the Parser interface for OpenAI-compatible APIs.
+// It recognizes chat.completions, completions, embeddings, and the newer
+// responses endpoint; any proxy path-prefix stripping is tolerated by the
+// substring match in DetectFromURL.
+type OpenAIParser struct{}
+
+// openAIPathHints are substring patterns that mark a request as
+// OpenAI-shaped. The bare `/chat/completions` is listed alongside
+// `/v1/chat/completions` because gateways like Cloudflare AI
+// Gateway place their own version segment before the provider
+// slug (gateway/v1/{account}/{gateway}/openai/chat/completions) —
+// the canonical `/v1/` ends up nowhere near `/chat/completions`,
+// so the `/v1/chat/completions` hint misses. `/chat/completions`
+// is OpenAI's API contract: any service accepting OpenAI bodies
+// serves at this path, so false-positive risk is negligible.
+// `/completions` (legacy), `/embeddings`, and `/responses` are
+// kept on the canonical-only path because their bare forms are
+// too generic to be safe substrings.
+var openAIPathHints = []string{
+	"/v1/chat/completions",
+	"/v1/completions",
+	"/v1/embeddings",
+	"/v1/responses",
+	"/chat/completions",
+}
+
+// Provider returns ProviderOpenAI.
+func (OpenAIParser) Provider() Provider { return ProviderOpenAI }
+
+// ProviderName returns the stable label used for metrics and metadata.
+func (OpenAIParser) ProviderName() string { return "openai" }
+
+// DetectFromURL reports whether the given request path looks like an OpenAI
+// API endpoint. The match is case-insensitive and substring-based so that a
+// reverse proxy prefix strip or rewrite does not defeat detection.
+func (OpenAIParser) DetectFromURL(path string) bool {
+	lower := strings.ToLower(path)
+	for _, hint := range openAIPathHints {
+		if strings.Contains(lower, hint) {
+			return true
+		}
+	}
+	return false
+}
+
+type openAIRequest struct {
+	Model         string `json:"model"`
+	Stream        *bool  `json:"stream"`
+	StreamOptions *struct {
+		IncludeUsage *bool `json:"include_usage"`
+	} `json:"stream_options"`
+	// Chat Completions / Completions: messages[].content (string or array of
+	// content parts). Responses API: input is either a string or an array of
+	// items with content parts. We use json.RawMessage to defer parsing each
+	// shape independently.
+	Messages []openAIMessage `json:"messages"`
+	Prompt   json.RawMessage `json:"prompt"`
+	Input    json.RawMessage `json:"input"`
+}
+
+type openAIMessage struct {
+	Role    string          `json:"role"`
+	Content json.RawMessage `json:"content"`
+}
+
+// ParseRequest extracts the model name and streaming flag from an OpenAI
+// request body. Unknown or missing fields leave the corresponding struct
+// members zero-valued.
+func (OpenAIParser) ParseRequest(body []byte) (RequestFacts, error) {
+	var req openAIRequest
+	if err := json.Unmarshal(body, &req); err != nil {
+		return RequestFacts{}, fmt.Errorf("decode openai request: %w: %v", ErrMalformedRequest, err)
+	}
+	return RequestFacts{
+		Model:  req.Model,
+		Stream: ptrDeref(req.Stream),
+	}, nil
+}
+
+// openAIResponse accepts both naming conventions in a single struct because
+// OpenAI's older Chat Completions API uses prompt_tokens/completion_tokens
+// while the newer Responses API (/v1/responses) uses input_tokens/output_tokens
+// (aligned with Anthropic). Pointer fields let us tell "absent" from "zero".
+//
+// PromptTokensDetails.CachedTokens (Chat Completions) and
+// InputTokensDetails.CachedTokens (Responses API) carry the SUBSET of
+// prompt/input tokens that hit the prompt cache. Cost-meter applies the
+// discount rate to that subset and the regular rate to the remainder so
+// we never double-bill the cached portion.
+type openAIResponse struct {
+	Usage struct {
+		PromptTokens        *int64 `json:"prompt_tokens"`
+		CompletionTokens    *int64 `json:"completion_tokens"`
+		InputTokens         *int64 `json:"input_tokens"`
+		OutputTokens        *int64 `json:"output_tokens"`
+		TotalTokens         *int64 `json:"total_tokens"`
+		PromptTokensDetails *struct {
+			CachedTokens *int64 `json:"cached_tokens"`
+		} `json:"prompt_tokens_details"`
+		InputTokensDetails *struct {
+			CachedTokens *int64 `json:"cached_tokens"`
+		} `json:"input_tokens_details"`
+	} `json:"usage"`
+}
+
+// ParseResponse decodes the non-streaming OpenAI response envelope. Status
+// codes other than 200 are treated as non-LLM responses so the caller can
+// skip cost accounting without aborting the request.
+func (OpenAIParser) ParseResponse(status int, contentType string, body []byte) (Usage, error) {
+	if status != 200 {
+		return Usage{}, fmt.Errorf("openai status %d: %w", status, ErrNotLLMResponse)
+	}
+	if isEventStream(contentType) {
+		return Usage{}, ErrStreamingUnsupported
+	}
+	if !isJSON(contentType) {
+		return Usage{}, fmt.Errorf("openai content-type %q: %w", contentType, ErrNotLLMResponse)
+	}
+
+	var resp openAIResponse
+	if err := json.Unmarshal(body, &resp); err != nil {
+		return Usage{}, fmt.Errorf("decode openai response: %w: %v", ErrMalformedResponse, err)
+	}
+
+	// Responses-API names take precedence when present; fall back to the older
+	// Chat Completions names. This handles both endpoints transparently
+	// without forcing a per-route configuration.
+	u := Usage{
+		InputTokens:       pickInt64(resp.Usage.InputTokens, resp.Usage.PromptTokens),
+		OutputTokens:      pickInt64(resp.Usage.OutputTokens, resp.Usage.CompletionTokens),
+		TotalTokens:       derefInt64(resp.Usage.TotalTokens),
+		CachedInputTokens: openAICachedTokens(resp),
+	}
+	if u.TotalTokens == 0 && (u.InputTokens > 0 || u.OutputTokens > 0) {
+		u.TotalTokens = u.InputTokens + u.OutputTokens
+	}
+	return u, nil
+}
+
+// openAICachedTokens returns the cached-prompt subset reported by
+// either the Responses-API (input_tokens_details.cached_tokens) or
+// the Chat-Completions API (prompt_tokens_details.cached_tokens).
+// Responses-API takes precedence when both are populated.
+func openAICachedTokens(resp openAIResponse) int64 {
+	// Responses-API details are authoritative when present: an explicit
+	// cached_tokens of 0 must be honored, not treated as missing and
+	// overridden by the Chat-Completions field (which would overstate cache).
+	if resp.Usage.InputTokensDetails != nil && resp.Usage.InputTokensDetails.CachedTokens != nil {
+		return derefInt64(resp.Usage.InputTokensDetails.CachedTokens)
+	}
+	if resp.Usage.PromptTokensDetails != nil {
+		return derefInt64(resp.Usage.PromptTokensDetails.CachedTokens)
+	}
+	return 0
+}
+
+// ExtractPrompt returns the user-visible prompt text from an OpenAI request.
+// Handles chat.completions (messages[].content), legacy completions (prompt
+// string), and the Responses API (input as string or content-part array).
+// Returns "" when nothing extractable is found.
+func (OpenAIParser) ExtractPrompt(body []byte) string {
+	var req openAIRequest
+	if err := json.Unmarshal(body, &req); err != nil {
+		return ""
+	}
+	if len(req.Messages) > 0 {
+		return joinMessages(req.Messages)
+	}
+	if len(req.Input) > 0 {
+		return extractResponsesInput(req.Input)
+	}
+	if len(req.Prompt) > 0 {
+		return decodeStringOrJoin(req.Prompt)
+	}
+	return ""
+}
+
+// extractResponsesInput handles the Responses API `input` field. It is one
+// of three shapes: a plain string, an array of message items
+// ({role, content: string | [parts]}) as sent by Codex and the Responses
+// SDK, or a flat array of content parts ({type, text/input_text}). Message
+// items are flattened to "role: text" lines; items without extractable text
+// (reasoning blocks, tool calls) are skipped.
+func extractResponsesInput(raw json.RawMessage) string {
+	if s, ok := tryDecodeString(raw); ok {
+		return s
+	}
+	var items []struct {
+		Role      string          `json:"role"`
+		Content   json.RawMessage `json:"content"`
+		Text      string          `json:"text"`
+		InputText string          `json:"input_text"`
+	}
+	if err := json.Unmarshal(raw, &items); err != nil {
+		return extractContentParts(raw)
+	}
+	var b strings.Builder
+	for _, it := range items {
+		var text string
+		switch {
+		case len(it.Content) > 0:
+			text = decodeStringOrJoin(it.Content)
+		case it.Text != "":
+			text = it.Text
+		case it.InputText != "":
+			text = it.InputText
+		}
+		if text == "" {
+			continue
+		}
+		if b.Len() > 0 {
+			b.WriteByte('\n')
+		}
+		if it.Role != "" {
+			b.WriteString(it.Role)
+			b.WriteString(": ")
+		}
+		b.WriteString(text)
+	}
+	return b.String()
+}
+
+// ExtractSessionID reads the OpenAI session marker. Codex (the Responses
+// API client) stamps client_metadata.session_id on every request body;
+// plain chat.completions traffic carries no session id and yields "".
+func (OpenAIParser) ExtractSessionID(body []byte) string {
+	var req struct {
+		ClientMetadata struct {
+			SessionID string `json:"session_id"`
+		} `json:"client_metadata"`
+	}
+	if err := json.Unmarshal(body, &req); err != nil {
+		return ""
+	}
+	return req.ClientMetadata.SessionID
+}
+
+type openAIChatChoice struct {
+	Message struct {
+		Role    string          `json:"role"`
+		Content json.RawMessage `json:"content"`
+	} `json:"message"`
+	Text string `json:"text"`
+}
+
+type openAIChatResponse struct {
+	Choices []openAIChatChoice `json:"choices"`
+	// Responses API: output[].content[].text
+	Output []struct {
+		Type    string          `json:"type"`
+		Content json.RawMessage `json:"content"`
+		Text    string          `json:"text"`
+	} `json:"output"`
+	OutputText string `json:"output_text"`
+}
+
+// ExtractCompletion returns the assistant text from a non-streaming OpenAI
+// response. Handles chat.completions (choices[].message.content), legacy
+// completions (choices[].text), and Responses API (output[].content[].text
+// or the convenience output_text field).
+func (OpenAIParser) ExtractCompletion(status int, contentType string, body []byte) string {
+	if status != 200 || isEventStream(contentType) || !isJSON(contentType) {
+		return ""
+	}
+	var resp openAIChatResponse
+	if err := json.Unmarshal(body, &resp); err != nil {
+		return ""
+	}
+	if resp.OutputText != "" {
+		return resp.OutputText
+	}
+	for _, c := range resp.Choices {
+		if len(c.Message.Content) > 0 {
+			if s := decodeStringOrJoin(c.Message.Content); s != "" {
+				return s
+			}
+		}
+		if c.Text != "" {
+			return c.Text
+		}
+	}
+	for _, o := range resp.Output {
+		if o.Text != "" {
+			return o.Text
+		}
+		if len(o.Content) > 0 {
+			if s := extractContentParts(o.Content); s != "" {
+				return s
+			}
+		}
+	}
+	return ""
+}
+
+// joinMessages flattens a chat.completions messages array into a single
+// "role: content" string per message, separated by newlines. Roles surface
+// system/user/assistant context which is useful for log review.
+func joinMessages(msgs []openAIMessage) string {
+	var b strings.Builder
+	for i, m := range msgs {
+		if i > 0 {
+			b.WriteByte('\n')
+		}
+		if m.Role != "" {
+			b.WriteString(m.Role)
+			b.WriteString(": ")
+		}
+		b.WriteString(decodeStringOrJoin(m.Content))
+	}
+	return b.String()
+}
+
+// extractContentParts handles the Responses-API content shape, which is
+// either a single string or an array of {type, text} parts. text and
+// input_text both carry user-facing content.
+func extractContentParts(raw json.RawMessage) string {
+	if s, ok := tryDecodeString(raw); ok {
+		return s
+	}
+	var parts []struct {
+		Type      string `json:"type"`
+		Text      string `json:"text"`
+		InputText string `json:"input_text"`
+	}
+	if err := json.Unmarshal(raw, &parts); err != nil {
+		// Last-ditch: array of strings.
+		var arr []string
+		if json.Unmarshal(raw, &arr) == nil {
+			return strings.Join(arr, "\n")
+		}
+		return ""
+	}
+	var b strings.Builder
+	for _, p := range parts {
+		var text string
+		switch {
+		case p.Text != "":
+			text = p.Text
+		case p.InputText != "":
+			text = p.InputText
+		}
+		if text == "" {
+			continue
+		}
+		if b.Len() > 0 {
+			b.WriteByte('\n')
+		}
+		b.WriteString(text)
+	}
+	return b.String()
+}
+
+// decodeStringOrJoin accepts either a JSON string or a content-parts array
+// (chat.completions multimodal) and returns a flat string. Multimodal parts
+// are separated by newlines; non-text parts are skipped.
+func decodeStringOrJoin(raw json.RawMessage) string {
+	if s, ok := tryDecodeString(raw); ok {
+		return s
+	}
+	return extractContentParts(raw)
+}
+
+func tryDecodeString(raw json.RawMessage) (string, bool) {
+	if len(raw) == 0 {
+		return "", false
+	}
+	var s string
+	if err := json.Unmarshal(raw, &s); err == nil {
+		return s, true
+	}
+	return "", false
+}
+
+// pickInt64 returns the first non-nil pointer's value. Used to prefer one
+// naming convention while transparently falling back to another.
+func pickInt64(preferred, fallback *int64) int64 {
+	if preferred != nil {
+		return *preferred
+	}
+	return derefInt64(fallback)
+}
+
+func derefInt64(v *int64) int64 {
+	if v == nil {
+		return 0
+	}
+	return *v
+}
+
+func ptrDeref(b *bool) bool {
+	if b == nil {
+		return false
+	}
+	return *b
+}
+
+func isEventStream(contentType string) bool {
+	return strings.Contains(strings.ToLower(contentType), "text/event-stream")
+}
+
+func isJSON(contentType string) bool {
+	lower := strings.ToLower(contentType)
+	return strings.Contains(lower, "application/json") || strings.Contains(lower, "+json")
+}
diff --git a/proxy/internal/llm/openai_test.go b/proxy/internal/llm/openai_test.go
new file mode 100644
index 000000000..7a5fca4fb
--- /dev/null
+++ b/proxy/internal/llm/openai_test.go
@@ -0,0 +1,255 @@
+package llm
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestOpenAIDetectFromURL(t *testing.T) {
+	p := OpenAIParser{}
+
+	cases := map[string]bool{
+		"/v1/chat/completions":                  true,
+		"/v1/completions":                       true,
+		"/v1/embeddings":                        true,
+		"/v1/responses":                         true,
+		"/API/V1/Chat/Completions":              true,
+		"/upstream/v1/chat/completions?trace=1": true,
+		// Cloudflare AI Gateway puts its own /v1/{account}/{gateway}
+		// segment between the canonical /v1/ and the provider slug,
+		// so the /v1/chat/completions substring no longer appears
+		// adjacent in the path. The bare /chat/completions hint
+		// catches Cloudflare's OpenAI direct path
+		// (/v1/{account}/{gateway}/openai/chat/completions) and
+		// compat path (/v1/{account}/{gateway}/compat/chat/completions).
+		"/v1/{account}/{gateway}/openai/chat/completions":  true,
+		"/v1/{account}/{gateway}/compat/chat/completions":  true,
+		"/chat/completions":                                true,
+		"/v1/messages":                                     false,
+		"/healthz":                                         false,
+		"":                                                 false,
+	}
+	for path, want := range cases {
+		assert.Equal(t, want, p.DetectFromURL(path), "DetectFromURL(%q)", path)
+	}
+}
+
+func TestOpenAIParseRequest(t *testing.T) {
+	p := OpenAIParser{}
+
+	t.Run("stream true", func(t *testing.T) {
+		facts, err := p.ParseRequest([]byte(`{"model":"gpt-4o","stream":true,"stream_options":{"include_usage":true}}`))
+		require.NoError(t, err)
+		assert.Equal(t, "gpt-4o", facts.Model, "request model extracted")
+		assert.True(t, facts.Stream, "request marked as streaming")
+	})
+
+	t.Run("stream default", func(t *testing.T) {
+		facts, err := p.ParseRequest([]byte(`{"model":"gpt-4o-mini"}`))
+		require.NoError(t, err)
+		assert.Equal(t, "gpt-4o-mini", facts.Model, "request model extracted")
+		assert.False(t, facts.Stream, "missing stream flag defaults to false")
+	})
+
+	t.Run("malformed", func(t *testing.T) {
+		_, err := p.ParseRequest([]byte(`{not json}`))
+		require.Error(t, err)
+		assert.True(t, errors.Is(err, ErrMalformedRequest), "sentinel error wrapped")
+	})
+}
+
+func TestOpenAIParseResponse(t *testing.T) {
+	p := OpenAIParser{}
+
+	t.Run("happy fixture", func(t *testing.T) {
+		body, err := os.ReadFile(filepath.Join("fixtures", "openai_chat_completion.json"))
+		require.NoError(t, err, "fixture must be readable")
+
+		usage, err := p.ParseResponse(200, "application/json", body)
+		require.NoError(t, err)
+		assert.Equal(t, int64(123), usage.InputTokens, "prompt tokens become input")
+		assert.Equal(t, int64(45), usage.OutputTokens, "completion tokens become output")
+		assert.Equal(t, int64(168), usage.TotalTokens, "total_tokens carried through")
+	})
+
+	t.Run("total computed when missing", func(t *testing.T) {
+		body := []byte(`{"usage":{"prompt_tokens":10,"completion_tokens":5}}`)
+		usage, err := p.ParseResponse(200, "application/json", body)
+		require.NoError(t, err)
+		assert.Equal(t, int64(15), usage.TotalTokens, "total computed from in+out")
+	})
+
+	t.Run("streaming rejected", func(t *testing.T) {
+		_, err := p.ParseResponse(200, "text/event-stream", []byte(""))
+		require.ErrorIs(t, err, ErrStreamingUnsupported, "SSE responses must use the scanner")
+	})
+
+	t.Run("non-200", func(t *testing.T) {
+		_, err := p.ParseResponse(500, "application/json", []byte(`{"error":"x"}`))
+		require.ErrorIs(t, err, ErrNotLLMResponse, "non-200 rejected as non-LLM")
+	})
+
+	t.Run("non-json content type", func(t *testing.T) {
+		_, err := p.ParseResponse(200, "text/plain", []byte(`{}`))
+		require.ErrorIs(t, err, ErrNotLLMResponse, "text/plain treated as non-LLM")
+	})
+
+	t.Run("malformed body", func(t *testing.T) {
+		_, err := p.ParseResponse(200, "application/json", []byte(`{not json`))
+		require.ErrorIs(t, err, ErrMalformedResponse, "bad JSON yields malformed error")
+	})
+
+	// Responses-API fixture: /v1/responses returns input_tokens/output_tokens
+	// (Anthropic-style) instead of prompt_tokens/completion_tokens. The parser
+	// must accept both.
+	t.Run("responses api fixture", func(t *testing.T) {
+		body, err := os.ReadFile(filepath.Join("fixtures", "openai_responses.json"))
+		require.NoError(t, err, "fixture must be readable")
+
+		usage, err := p.ParseResponse(200, "application/json", body)
+		require.NoError(t, err)
+		assert.Equal(t, int64(15), usage.InputTokens, "input_tokens should map directly")
+		assert.Equal(t, int64(414), usage.OutputTokens, "output_tokens should map directly")
+		assert.Equal(t, int64(429), usage.TotalTokens, "total_tokens carried through")
+	})
+
+	t.Run("responses api naming preferred over chat-completions when both present", func(t *testing.T) {
+		body := []byte(`{"usage":{"prompt_tokens":1,"completion_tokens":2,"input_tokens":15,"output_tokens":414,"total_tokens":429}}`)
+		usage, err := p.ParseResponse(200, "application/json", body)
+		require.NoError(t, err)
+		assert.Equal(t, int64(15), usage.InputTokens, "responses-api names take precedence")
+		assert.Equal(t, int64(414), usage.OutputTokens, "responses-api names take precedence")
+	})
+
+	t.Run("chat-completions naming still works alone", func(t *testing.T) {
+		body := []byte(`{"usage":{"prompt_tokens":15,"completion_tokens":414,"total_tokens":429}}`)
+		usage, err := p.ParseResponse(200, "application/json", body)
+		require.NoError(t, err)
+		assert.Equal(t, int64(15), usage.InputTokens, "prompt_tokens fallback")
+		assert.Equal(t, int64(414), usage.OutputTokens, "completion_tokens fallback")
+	})
+
+	// Cached-prompt accounting. cached_tokens is a SUBSET of
+	// prompt_tokens — input_tokens carries the full prompt count and
+	// the cached subset is reported separately so the cost meter can
+	// apply the discount rate to that portion.
+	t.Run("chat-completions cached_tokens subset surfaces", func(t *testing.T) {
+		body := []byte(`{"usage":{"prompt_tokens":1024,"completion_tokens":200,"total_tokens":1224,"prompt_tokens_details":{"cached_tokens":768}}}`)
+		usage, err := p.ParseResponse(200, "application/json", body)
+		require.NoError(t, err)
+		assert.Equal(t, int64(1024), usage.InputTokens, "input remains the full prompt count — cached is a subset, not a separate bucket")
+		assert.Equal(t, int64(768), usage.CachedInputTokens, "cached_tokens must surface so cost meter can discount the cached subset")
+		assert.Zero(t, usage.CacheCreationTokens, "OpenAI has no cache_creation analogue")
+	})
+
+	t.Run("responses-api input_tokens_details.cached_tokens surfaces", func(t *testing.T) {
+		body := []byte(`{"usage":{"input_tokens":2048,"output_tokens":100,"total_tokens":2148,"input_tokens_details":{"cached_tokens":1500}}}`)
+		usage, err := p.ParseResponse(200, "application/json", body)
+		require.NoError(t, err)
+		assert.Equal(t, int64(2048), usage.InputTokens)
+		assert.Equal(t, int64(1500), usage.CachedInputTokens, "Responses-API input_tokens_details.cached_tokens path must surface too")
+	})
+
+	t.Run("responses-api cached takes precedence over chat-completions when both present", func(t *testing.T) {
+		body := []byte(`{"usage":{"prompt_tokens":1,"input_tokens":2,"output_tokens":3,"prompt_tokens_details":{"cached_tokens":50},"input_tokens_details":{"cached_tokens":99}}}`)
+		usage, err := p.ParseResponse(200, "application/json", body)
+		require.NoError(t, err)
+		assert.Equal(t, int64(99), usage.CachedInputTokens, "Responses-API field wins when both naming conventions are present")
+	})
+
+	t.Run("absent cached_tokens leaves cached counts at zero", func(t *testing.T) {
+		body := []byte(`{"usage":{"prompt_tokens":15,"completion_tokens":414,"total_tokens":429}}`)
+		usage, err := p.ParseResponse(200, "application/json", body)
+		require.NoError(t, err)
+		assert.Zero(t, usage.CachedInputTokens, "no prompt_tokens_details = no cached subset")
+	})
+}
+
+func TestOpenAIExtractPrompt_ChatCompletions(t *testing.T) {
+	body := []byte(`{"model":"gpt-4o-mini","messages":[{"role":"system","content":"be brief"},{"role":"user","content":"ping"}]}`)
+	got := OpenAIParser{}.ExtractPrompt(body)
+	require.NotEmpty(t, got, "messages array must extract")
+	require.Contains(t, got, "system: be brief", "system role and content surface")
+	require.Contains(t, got, "user: ping", "user role and content surface")
+}
+
+func TestOpenAIExtractPrompt_ResponsesAPIStringInput(t *testing.T) {
+	body := []byte(`{"model":"gpt-5.4","input":"Hello there"}`)
+	got := OpenAIParser{}.ExtractPrompt(body)
+	require.Equal(t, "Hello there", got, "string input field should pass through")
+}
+
+func TestOpenAIExtractPrompt_ResponsesAPIInputParts(t *testing.T) {
+	body := []byte(`{"model":"gpt-5.4","input":[{"type":"input_text","input_text":"first"},{"type":"input_text","input_text":"second"}]}`)
+	got := OpenAIParser{}.ExtractPrompt(body)
+	require.Contains(t, got, "first", "first content part surfaces")
+	require.Contains(t, got, "second", "second content part surfaces")
+}
+
+// TestOpenAIExtractPrompt_ResponsesAPIMessageItems guards the live Codex
+// shape: input is an array of message items whose text is nested under
+// content[].text, not flat content parts. The old code fed the outer array
+// to the content-part decoder and extracted nothing, so the stored prompt
+// was empty.
+func TestOpenAIExtractPrompt_ResponsesAPIMessageItems(t *testing.T) {
+	body := []byte(`{"model":"gpt-5.5","input":[` +
+		`{"type":"message","role":"developer","content":[{"type":"input_text","text":"system rules"}]},` +
+		`{"type":"message","role":"user","content":[{"type":"input_text","text":"hello there"}]},` +
+		`{"type":"reasoning","encrypted_content":"opaque","summary":[]},` +
+		`{"type":"message","role":"assistant","content":[{"type":"output_text","text":"prior reply"}]}` +
+		`]}`)
+	got := OpenAIParser{}.ExtractPrompt(body)
+	require.Contains(t, got, "system rules", "developer message content must surface")
+	require.Contains(t, got, "hello there", "user message content must surface")
+	require.Contains(t, got, "developer:", "role labels must prefix each message")
+	require.NotContains(t, got, "opaque", "reasoning items without text must be skipped")
+}
+
+func TestOpenAIExtractPrompt_LegacyCompletion(t *testing.T) {
+	body := []byte(`{"model":"text-davinci-003","prompt":"once upon a time"}`)
+	got := OpenAIParser{}.ExtractPrompt(body)
+	require.Equal(t, "once upon a time", got, "string prompt field should pass through")
+}
+
+func TestOpenAIExtractSessionID(t *testing.T) {
+	t.Run("codex client_metadata.session_id", func(t *testing.T) {
+		body := []byte(`{"model":"gpt-5.5","client_metadata":{"session_id":"019eeb72-ab7c-7cd2","thread_id":"t1"},"input":[]}`)
+		assert.Equal(t, "019eeb72-ab7c-7cd2", OpenAIParser{}.ExtractSessionID(body), "Codex session id must come from client_metadata.session_id")
+	})
+	t.Run("plain chat has no session", func(t *testing.T) {
+		body := []byte(`{"model":"gpt-4o","messages":[{"role":"user","content":"hi"}]}`)
+		assert.Equal(t, "", OpenAIParser{}.ExtractSessionID(body), "plain chat.completions carries no session id")
+	})
+	t.Run("non-JSON yields empty", func(t *testing.T) {
+		assert.Equal(t, "", OpenAIParser{}.ExtractSessionID([]byte("not json")), "malformed body must not error")
+	})
+}
+
+func TestOpenAIExtractCompletion_ChatCompletions(t *testing.T) {
+	body, err := os.ReadFile(filepath.Join("fixtures", "openai_chat_completion.json"))
+	require.NoError(t, err)
+	got := OpenAIParser{}.ExtractCompletion(200, "application/json", body)
+	require.NotEmpty(t, got, "fixture has assistant content")
+}
+
+func TestOpenAIExtractCompletion_ResponsesAPI(t *testing.T) {
+	body, err := os.ReadFile(filepath.Join("fixtures", "openai_responses.json"))
+	require.NoError(t, err)
+	got := OpenAIParser{}.ExtractCompletion(200, "application/json", body)
+	require.NotEmpty(t, got, "responses-api fixture has output content")
+}
+
+func TestOpenAIExtractCompletion_Streaming(t *testing.T) {
+	got := OpenAIParser{}.ExtractCompletion(200, "text/event-stream", []byte(""))
+	require.Empty(t, got, "streaming responses are skipped")
+}
+
+func TestOpenAIExtractCompletion_NonOK(t *testing.T) {
+	got := OpenAIParser{}.ExtractCompletion(500, "application/json", []byte(`{"choices":[{"message":{"content":"x"}}]}`))
+	require.Empty(t, got, "non-200 returns empty")
+}
diff --git a/proxy/internal/llm/parser.go b/proxy/internal/llm/parser.go
new file mode 100644
index 000000000..81fa11f97
--- /dev/null
+++ b/proxy/internal/llm/parser.go
@@ -0,0 +1,112 @@
+// Package llm provides the shared LLM request and response parsing
+// library consumed by proxy middleware. It is runtime agnostic: the same
+// package is used by the native built-in executor now and will be reused
+// by the WASM adapter later.
+package llm
+
+// Provider identifies an LLM API provider.
+type Provider int
+
+const (
+	// ProviderUnknown signals that no parser matched the request.
+	ProviderUnknown Provider = 0
+	// ProviderOpenAI identifies the OpenAI API surface.
+	ProviderOpenAI Provider = 1
+	// ProviderAnthropic identifies the Anthropic Messages API surface.
+	ProviderAnthropic Provider = 2
+	// ProviderBedrock identifies the AWS Bedrock runtime surface.
+	ProviderBedrock Provider = 3
+)
+
+// RequestFacts captures the subset of the LLM request body that the
+// middleware annotates as metadata (model, streaming flag). Additional
+// fields are added as parsers grow.
+type RequestFacts struct {
+	Model  string
+	Stream bool
+}
+
+// Usage is the provider-agnostic token accounting emitted to metrics and
+// access logs. Downstream consumers map InputTokens/OutputTokens to the
+// plg.llm.* metadata allowlist entries.
+//
+// CachedInputTokens carries OpenAI's prompt_tokens_details.cached_tokens
+// (a SUBSET of InputTokens) when the response is from OpenAI, or
+// Anthropic's cache_read_input_tokens (ADDITIVE to InputTokens) when from
+// Anthropic. The cost meter switches formula on KeyLLMProvider so the
+// two shapes are billed correctly without double-counting.
+//
+// CacheCreationTokens carries Anthropic's cache_creation_input_tokens
+// (ADDITIVE; not present in the OpenAI shape).
+type Usage struct {
+	InputTokens         int64
+	OutputTokens        int64
+	TotalTokens         int64
+	CachedInputTokens   int64
+	CacheCreationTokens int64
+}
+
+// Parser is the per-provider interface implemented in this package. The
+// dispatcher selects a parser by calling DetectFromURL against the incoming
+// request path; ties break by registration order (see Parsers).
+type Parser interface {
+	Provider() Provider
+	ProviderName() string
+	DetectFromURL(path string) bool
+	ParseRequest(body []byte) (RequestFacts, error)
+	ParseResponse(status int, contentType string, body []byte) (Usage, error)
+	// ExtractPrompt returns the user-facing prompt text from a request body.
+	// Different endpoint shapes (chat.completions, responses, messages) are
+	// handled by the per-provider implementation. Returns "" when no prompt
+	// can be extracted; never returns an error — extraction is best-effort
+	// because callers use the result for observability, not authorization.
+	ExtractPrompt(body []byte) string
+	// ExtractCompletion returns the assistant-facing completion text from a
+	// non-streaming response body. status and contentType match the
+	// ParseResponse arguments so implementations can fast-fail uniformly.
+	ExtractCompletion(status int, contentType string, body []byte) string
+	// ExtractSessionID returns a stable identifier that groups requests of
+	// the same conversation / coding session, read from the per-provider
+	// location clients populate (e.g. OpenAI Codex's client_metadata.session_id,
+	// Claude Code's metadata.user_id). Returns "" when the body carries no
+	// recognised session marker; extraction is best-effort and never errors.
+	ExtractSessionID(body []byte) string
+}
+
+// Parsers returns the built-in parser set in a stable order. The order is
+// deterministic so that DetectFromURL ties produce consistent routing.
+func Parsers() []Parser {
+	return []Parser{
+		OpenAIParser{},
+		AnthropicParser{},
+		BedrockParser{},
+	}
+}
+
+// DetectParser returns the first parser whose DetectFromURL matches the given
+// request path. ok=false means no parser claimed the path.
+func DetectParser(path string) (Parser, bool) {
+	for _, p := range Parsers() {
+		if p.DetectFromURL(path) {
+			return p, true
+		}
+	}
+	return nil, false
+}
+
+// ParserByName returns the parser whose ProviderName matches id. Used by
+// callers that already know which provider surface a request will hit
+// (e.g. the agent-network middleware chain configured per synthesised
+// service) so they can skip URL sniffing. ok=false when no parser is
+// registered under that name.
+func ParserByName(id string) (Parser, bool) {
+	if id == "" {
+		return nil, false
+	}
+	for _, p := range Parsers() {
+		if p.ProviderName() == id {
+			return p, true
+		}
+	}
+	return nil, false
+}
diff --git a/proxy/internal/llm/parser_test.go b/proxy/internal/llm/parser_test.go
new file mode 100644
index 000000000..b3052ce68
--- /dev/null
+++ b/proxy/internal/llm/parser_test.go
@@ -0,0 +1,54 @@
+package llm
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParsers_ProviderNames(t *testing.T) {
+	parsers := Parsers()
+	require.Len(t, parsers, 3, "three built-in parsers expected")
+
+	names := make([]string, 0, len(parsers))
+	for _, p := range parsers {
+		names = append(names, p.ProviderName())
+	}
+	assert.Contains(t, names, "openai", "OpenAI parser should be registered")
+	assert.Contains(t, names, "anthropic", "Anthropic parser should be registered")
+	assert.Contains(t, names, "bedrock", "Bedrock parser should be registered")
+}
+
+func TestDetectParser(t *testing.T) {
+	cases := []struct {
+		name         string
+		path         string
+		expectedName string
+		expectOK     bool
+	}{
+		{"openai chat", "/v1/chat/completions", "openai", true},
+		{"openai prefixed", "/api/v1/chat/completions", "openai", true},
+		{"openai responses", "/v1/responses", "openai", true},
+		{"anthropic messages", "/v1/messages", "anthropic", true},
+		{"anthropic prefixed", "/proxy/v1/messages?query", "anthropic", true},
+		{"unknown path", "/healthz", "", false},
+		{"empty path", "", "", false},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			p, ok := DetectParser(tc.path)
+			require.Equal(t, tc.expectOK, ok, "detection success mismatch for %q", tc.path)
+			if ok {
+				assert.Equal(t, tc.expectedName, p.ProviderName(), "provider name mismatch")
+			}
+		})
+	}
+}
+
+func TestProviderValues(t *testing.T) {
+	assert.Equal(t, Provider(0), ProviderUnknown, "unknown provider is the zero value")
+	assert.Equal(t, ProviderOpenAI, OpenAIParser{}.Provider(), "OpenAI parser reports its provider enum")
+	assert.Equal(t, ProviderAnthropic, AnthropicParser{}.Provider(), "Anthropic parser reports its provider enum")
+}
diff --git a/proxy/internal/llm/pricing/defaults_coverage_test.go b/proxy/internal/llm/pricing/defaults_coverage_test.go
new file mode 100644
index 000000000..be23682da
--- /dev/null
+++ b/proxy/internal/llm/pricing/defaults_coverage_test.go
@@ -0,0 +1,65 @@
+package pricing
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestDefaultTable_FirstPartyModelCoverage guards the embedded defaults against
+// silent drift/gaps: every metered first-party model the management catalog
+// enumerates must resolve to a price, and a few rates that previously drifted
+// are pinned to their LiteLLM-validated values. Keep this list in step with the
+// catalog (management/server/agentnetwork/catalog) when adding models.
+func TestDefaultTable_FirstPartyModelCoverage(t *testing.T) {
+	tbl := DefaultTable()
+	require.NotNil(t, tbl, "embedded default pricing table must load")
+
+	mustPrice := map[string][]string{
+		// openai parser covers openai_api, azure_openai_api, and mistral_api.
+		"openai": {
+			"gpt-5.5", "gpt-5.5-pro", "gpt-5.4", "gpt-5.4-mini", "gpt-5.4-nano",
+			"gpt-5.3-codex", "gpt-5.3-chat-latest", "o4-mini",
+			"gpt-4.1", "gpt-4.1-mini", "gpt-4.1-nano", "gpt-4o", "gpt-4o-mini",
+			"gpt-4-turbo", "gpt-3.5-turbo", "gpt-35-turbo",
+			"text-embedding-3-large", "text-embedding-3-small",
+			"mistral-large-latest", "mistral-medium-3-5", "codestral-2508",
+			"ministral-8b-latest", "mistral-embed",
+		},
+		"anthropic": {
+			"claude-fable-5", "claude-opus-4-8", "claude-opus-4-7", "claude-opus-4-6",
+			"claude-opus-4-1", "claude-sonnet-4-6", "claude-sonnet-4-5", "claude-haiku-4-5",
+		},
+		// bedrock keys are the normalized ids the request parser emits.
+		"bedrock": {
+			"anthropic.claude-opus-4-8", "anthropic.claude-opus-4-7", "anthropic.claude-opus-4-6",
+			"anthropic.claude-opus-4-1", "anthropic.claude-sonnet-4-6", "anthropic.claude-sonnet-4-5",
+			"anthropic.claude-haiku-4-5", "meta.llama3-3-70b-instruct",
+			"amazon.nova-pro", "amazon.nova-lite", "amazon.nova-micro", "amazon.nova-2-lite",
+		},
+	}
+	for provider, models := range mustPrice {
+		for _, m := range models {
+			_, ok := tbl.Cost(provider, m, 1000, 1000, 0, 0)
+			assert.True(t, ok, "%s/%s must be priced in the embedded defaults", provider, m)
+		}
+	}
+
+	// Pin per-direction rates independently (input-only then output-only) so a
+	// swap or skew of input<->output that preserves the combined total is still
+	// caught — these are rates that previously drifted or are easy to mis-enter.
+	in, ok := tbl.Cost("openai", "gpt-5.4", 1000, 0, 0, 0)
+	require.True(t, ok)
+	assert.InDelta(t, 0.0025, in, 1e-9, "gpt-5.4 input = 0.0025 per 1k")
+	out, ok := tbl.Cost("openai", "gpt-5.4", 0, 1000, 0, 0)
+	require.True(t, ok)
+	assert.InDelta(t, 0.015, out, 1e-9, "gpt-5.4 output = 0.015 per 1k")
+
+	in, ok = tbl.Cost("bedrock", "anthropic.claude-sonnet-4-5", 1000, 0, 0, 0)
+	require.True(t, ok)
+	assert.InDelta(t, 0.003, in, 1e-9, "bedrock sonnet-4-5 input = 0.003 per 1k")
+	out, ok = tbl.Cost("bedrock", "anthropic.claude-sonnet-4-5", 0, 1000, 0, 0)
+	require.True(t, ok)
+	assert.InDelta(t, 0.015, out, 1e-9, "bedrock sonnet-4-5 output = 0.015 per 1k")
+}
diff --git a/proxy/internal/llm/pricing/defaults_pricing.yaml b/proxy/internal/llm/pricing/defaults_pricing.yaml
new file mode 100644
index 000000000..cd5c64fbf
--- /dev/null
+++ b/proxy/internal/llm/pricing/defaults_pricing.yaml
@@ -0,0 +1,264 @@
+# Embedded default pricing for llm_observability. Compiled into the proxy
+# binary via go:embed in pricing.go; cost annotation works out of the box
+# without any operator action.
+#
+# Operators override entries by dropping a pricing.yaml into --plugin-data-dir
+# (or whichever basename is given via params.pricing_path). The override file
+# only needs entries the operator wants to change; missing entries fall
+# through to these defaults.
+#
+# Values are USD per 1_000 tokens. Public list prices drift; ship a fresh
+# binary or override individual entries via the override file as needed.
+#
+# Optional cache fields:
+#   cached_input_per_1k    OpenAI: rate for prompt_tokens_details.cached_tokens
+#                          (a SUBSET of prompt_tokens). Typically 0.5x input.
+#                          Absent → cached portion bills at input_per_1k.
+#   cache_read_per_1k      Anthropic: rate for cache_read_input_tokens
+#                          (ADDITIVE to input_tokens). Typically 0.1x input.
+#                          Absent → cache reads bill at input_per_1k.
+#   cache_creation_per_1k  Anthropic: rate for cache_creation_input_tokens
+#                          (ADDITIVE to input_tokens). Typically 1.25x input.
+#                          Absent → cache writes bill at input_per_1k.
+
+openai:
+  # OpenAI + OpenAI-compatible providers (openai_api, azure_openai_api,
+  # mistral_api, and the openai-parser gateways) all emit llm.provider="openai",
+  # so their models are priced here. Kept in sync with the management catalog;
+  # rates cross-checked against LiteLLM model_prices_and_context_window.json.
+
+  # GPT-5.x family — cache reads 10% of input (0.1x).
+  gpt-5.5:
+    input_per_1k: 0.005
+    output_per_1k: 0.03
+    cached_input_per_1k: 0.0005
+  gpt-5.5-pro:
+    input_per_1k: 0.03
+    output_per_1k: 0.18
+    cached_input_per_1k: 0.003
+  gpt-5.4:
+    input_per_1k: 0.0025
+    output_per_1k: 0.015
+    cached_input_per_1k: 0.00025
+  gpt-5.4-pro:
+    input_per_1k: 0.03
+    output_per_1k: 0.18
+    cached_input_per_1k: 0.003
+  gpt-5.4-mini:
+    input_per_1k: 0.00075
+    output_per_1k: 0.0045
+    cached_input_per_1k: 0.000075
+  gpt-5.4-nano:
+    input_per_1k: 0.0002
+    output_per_1k: 0.00125
+    cached_input_per_1k: 0.00002
+  gpt-5.3-codex:
+    input_per_1k: 0.00175
+    output_per_1k: 0.014
+    cached_input_per_1k: 0.000175
+  gpt-5.3-chat-latest:
+    input_per_1k: 0.00175
+    output_per_1k: 0.014
+    cached_input_per_1k: 0.000175
+  # GPT-5 (2025) family — kept for gateway requests using the unsuffixed ids.
+  gpt-5:
+    input_per_1k: 0.00125
+    output_per_1k: 0.01
+    cached_input_per_1k: 0.000125
+  gpt-5-mini:
+    input_per_1k: 0.00025
+    output_per_1k: 0.002
+    cached_input_per_1k: 0.000025
+  gpt-5-nano:
+    input_per_1k: 0.00005
+    output_per_1k: 0.0004
+    cached_input_per_1k: 0.000005
+  o4-mini:
+    input_per_1k: 0.0011
+    output_per_1k: 0.0044
+    cached_input_per_1k: 0.000275
+  # GPT-4.1 family — cache reads 25% of input.
+  gpt-4.1:
+    input_per_1k: 0.002
+    output_per_1k: 0.008
+    cached_input_per_1k: 0.0005
+  gpt-4.1-mini:
+    input_per_1k: 0.0004
+    output_per_1k: 0.0016
+    cached_input_per_1k: 0.0001
+  gpt-4.1-nano:
+    input_per_1k: 0.0001
+    output_per_1k: 0.0004
+    cached_input_per_1k: 0.000025
+  # GPT-4o family — cache reads 50% of input (0.5x).
+  gpt-4o:
+    input_per_1k: 0.0025
+    output_per_1k: 0.01
+    cached_input_per_1k: 0.00125
+  gpt-4o-mini:
+    input_per_1k: 0.00015
+    output_per_1k: 0.0006
+    cached_input_per_1k: 0.000075
+  # Older GPT — no prompt caching.
+  gpt-4-turbo:
+    input_per_1k: 0.01
+    output_per_1k: 0.03
+  gpt-3.5-turbo:
+    input_per_1k: 0.0005
+    output_per_1k: 0.0015
+  gpt-35-turbo: # Azure deployment alias of gpt-3.5-turbo
+    input_per_1k: 0.0005
+    output_per_1k: 0.0015
+  # Embeddings — no caching, no output tokens.
+  text-embedding-3-large:
+    input_per_1k: 0.00013
+    output_per_1k: 0
+  text-embedding-3-small:
+    input_per_1k: 0.00002
+    output_per_1k: 0
+
+  # Mistral (mistral_api) — routed via the openai parser; no prompt caching.
+  mistral-large-latest:
+    input_per_1k: 0.0005
+    output_per_1k: 0.0015
+  mistral-medium-latest:
+    input_per_1k: 0.0004
+    output_per_1k: 0.002
+  mistral-medium-3-5:
+    input_per_1k: 0.0015
+    output_per_1k: 0.0075
+  mistral-small-latest:
+    input_per_1k: 0.00006
+    output_per_1k: 0.00018
+  magistral-medium-latest:
+    input_per_1k: 0.002
+    output_per_1k: 0.005
+  magistral-small-latest:
+    input_per_1k: 0.0005
+    output_per_1k: 0.0015
+  devstral-medium-latest:
+    input_per_1k: 0.0004
+    output_per_1k: 0.002
+  devstral-small-latest:
+    input_per_1k: 0.0001
+    output_per_1k: 0.0003
+  codestral-2508:
+    input_per_1k: 0.0003
+    output_per_1k: 0.0009
+  codestral-latest:
+    input_per_1k: 0.001
+    output_per_1k: 0.003
+  ministral-3-14b-2512:
+    input_per_1k: 0.0002
+    output_per_1k: 0.0002
+  ministral-8b-latest:
+    input_per_1k: 0.00015
+    output_per_1k: 0.00015
+  ministral-3-3b-2512:
+    input_per_1k: 0.0001
+    output_per_1k: 0.0001
+  mistral-embed:
+    input_per_1k: 0.0001
+    output_per_1k: 0
+
+anthropic:
+  # Claude 4.x family — cache reads ≈10% of input, cache writes ≈125% of input.
+  # Pricing source: Anthropic's current published rates per million tokens,
+  # divided by 1000 for the per-1k figures stored here.
+  claude-fable-5:
+    input_per_1k: 0.010
+    output_per_1k: 0.050
+    cache_read_per_1k: 0.001
+    cache_creation_per_1k: 0.0125
+  claude-opus-4-8:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  claude-opus-4-7:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  claude-opus-4-6:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  claude-opus-4-1:
+    input_per_1k: 0.015
+    output_per_1k: 0.075
+    cache_read_per_1k: 0.0015
+    cache_creation_per_1k: 0.01875
+  claude-sonnet-4-6:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cache_read_per_1k: 0.0003
+    cache_creation_per_1k: 0.00375
+  claude-sonnet-4-5:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cache_read_per_1k: 0.0003
+    cache_creation_per_1k: 0.00375
+  claude-haiku-4-5:
+    input_per_1k: 0.001
+    output_per_1k: 0.005
+    cache_read_per_1k: 0.0001
+    cache_creation_per_1k: 0.00125
+
+bedrock:
+  # AWS Bedrock model ids, normalised by the request parser (cross-region
+  # inference-profile prefix + version/throughput suffix stripped), e.g.
+  # eu.anthropic.claude-sonnet-4-5-20250929-v1:0 -> anthropic.claude-sonnet-4-5.
+  # Anthropic-on-Bedrock keeps the additive cache buckets (read ≈0.1x input,
+  # write ≈1.25x input); Nova / Llama report no cache, so cost is input+output.
+  anthropic.claude-opus-4-8:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  anthropic.claude-opus-4-7:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  anthropic.claude-opus-4-6:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  anthropic.claude-opus-4-1:
+    input_per_1k: 0.015
+    output_per_1k: 0.075
+    cache_read_per_1k: 0.0015
+    cache_creation_per_1k: 0.01875
+  anthropic.claude-sonnet-4-6:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cache_read_per_1k: 0.0003
+    cache_creation_per_1k: 0.00375
+  anthropic.claude-sonnet-4-5:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cache_read_per_1k: 0.0003
+    cache_creation_per_1k: 0.00375
+  anthropic.claude-haiku-4-5:
+    input_per_1k: 0.001
+    output_per_1k: 0.005
+    cache_read_per_1k: 0.0001
+    cache_creation_per_1k: 0.00125
+  meta.llama3-3-70b-instruct:
+    input_per_1k: 0.00072
+    output_per_1k: 0.00072
+  amazon.nova-2-lite:
+    input_per_1k: 0.0003
+    output_per_1k: 0.0025
+  amazon.nova-pro:
+    input_per_1k: 0.0008
+    output_per_1k: 0.0032
+  amazon.nova-lite:
+    input_per_1k: 0.00006
+    output_per_1k: 0.00024
+  amazon.nova-micro:
+    input_per_1k: 0.000035
+    output_per_1k: 0.00014
diff --git a/proxy/internal/llm/pricing/pricing.go b/proxy/internal/llm/pricing/pricing.go
new file mode 100644
index 000000000..09afec5ff
--- /dev/null
+++ b/proxy/internal/llm/pricing/pricing.go
@@ -0,0 +1,449 @@
+// Package pricing implements the embedded-default + override pricing table
+// shared by middleware that converts LLM token usage into a USD cost
+// estimate. The table is hot-reloadable from a basename under the proxy
+// data directory; missing override files keep the embedded defaults so
+// cost annotation works without operator action.
+package pricing
+
+import (
+	"bytes"
+	"context"
+	_ "embed"
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"math"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/metric"
+	"gopkg.in/yaml.v3"
+)
+
+//go:embed defaults_pricing.yaml
+var defaultPricingYAML []byte
+
+var (
+	defaultTableOnce sync.Once
+	defaultTablePtr  *Table
+)
+
+// DefaultTable returns the pricing table embedded in the binary. The result
+// is parsed once and shared; callers must not mutate the returned value.
+// Cost annotation works without any operator action because every loader
+// starts with this table.
+func DefaultTable() *Table {
+	defaultTableOnce.Do(func() {
+		t, err := parsePricingBytes(defaultPricingYAML)
+		if err != nil {
+			panic(fmt.Sprintf("llmobs: embedded default pricing failed to parse: %v", err))
+		}
+		defaultTablePtr = t
+	})
+	return defaultTablePtr
+}
+
+// mergeOver returns a new Table containing every entry from base, with any
+// matching entry from overlay replacing the base value. Either argument may
+// be nil. Result is a fresh allocation so callers can mutate / Store safely.
+func mergeOver(base, overlay *Table) *Table {
+	if overlay == nil || len(overlay.entries) == 0 {
+		return base
+	}
+	if base == nil || len(base.entries) == 0 {
+		return overlay
+	}
+	out := make(map[string]map[string]Entry, len(base.entries))
+	for provider, models := range base.entries {
+		inner := make(map[string]Entry, len(models))
+		for model, e := range models {
+			inner[model] = e
+		}
+		out[provider] = inner
+	}
+	for provider, models := range overlay.entries {
+		inner, ok := out[provider]
+		if !ok {
+			inner = make(map[string]Entry, len(models))
+			out[provider] = inner
+		}
+		for model, e := range models {
+			inner[model] = e
+		}
+	}
+	return &Table{entries: out}
+}
+
+// Entry is a single model's input and output pricing, expressed in USD per
+// 1000 tokens.
+//
+// CachedInputPer1K applies to OpenAI's cached prompt tokens, which are a
+// subset of input_tokens — when set, the cached portion is billed at this
+// rate and the non-cached remainder at InputPer1K. Zero means "no discount
+// configured", and cached tokens are billed at InputPer1K (matches current
+// behaviour where cached counts weren't extracted at all).
+//
+// CacheReadPer1K and CacheCreationPer1K apply to Anthropic's two prompt-
+// cache fields, which are additive to input_tokens: cache_read is the
+// cheaper read-from-cache rate, cache_creation is the more expensive
+// write-to-cache rate. Zero means "no rate configured" and the
+// corresponding token bucket is billed at InputPer1K. This is more
+// accurate than today's behaviour, where Anthropic's cache tokens are
+// ignored and not charged at all.
+type Entry struct {
+	InputPer1K         float64
+	OutputPer1K        float64
+	CachedInputPer1K   float64
+	CacheReadPer1K     float64
+	CacheCreationPer1K float64
+}
+
+// Table is a provider-to-model pricing lookup. Instances are immutable once
+// built and are swapped atomically by Loader.
+type Table struct {
+	entries map[string]map[string]Entry
+}
+
+// Cost returns the estimated USD cost for the given token counts. ok is
+// false when the provider or model is not present in the table; the caller
+// can still emit token metrics with a model=unknown label.
+//
+// Provider-shape semantics for cached / cache-creation counts:
+//
+//   - OpenAI: cachedInput is a SUBSET of inTokens. The cached portion is
+//     billed at CachedInputPer1K (or InputPer1K when no override), and the
+//     non-cached remainder of inTokens at InputPer1K. cacheCreation is
+//     ignored (OpenAI has no analogue).
+//   - Anthropic: cachedInput (cache_read) and cacheCreation are ADDITIVE to
+//     inTokens. The three buckets are billed at CacheReadPer1K,
+//     CacheCreationPer1K, and InputPer1K respectively, each falling back
+//     to InputPer1K when the corresponding rate is zero.
+//   - Other providers: cached and cacheCreation are ignored; cost is
+//     inTokens*InputPer1K + outTokens*OutputPer1K.
+func (t *Table) Cost(provider, model string, inTokens, outTokens, cachedInput, cacheCreation int64) (float64, bool) {
+	// Clamp negatives to zero before any pricing math so a malformed
+	// upstream count can never produce a negative cost.
+	if inTokens < 0 {
+		inTokens = 0
+	}
+	if outTokens < 0 {
+		outTokens = 0
+	}
+	if cachedInput < 0 {
+		cachedInput = 0
+	}
+	if cacheCreation < 0 {
+		cacheCreation = 0
+	}
+	if t == nil {
+		return 0, false
+	}
+	byModel, ok := t.entries[provider]
+	if !ok {
+		return 0, false
+	}
+	entry, ok := byModel[model]
+	if !ok {
+		return 0, false
+	}
+	output := (float64(outTokens) / 1000.0) * entry.OutputPer1K
+	switch provider {
+	case "openai":
+		// cachedInput is a subset of inTokens; clamp so a malformed
+		// upstream (cached > total) can't produce a negative remainder.
+		clamped := cachedInput
+		if clamped > inTokens {
+			clamped = inTokens
+		}
+		cachedRate := entry.CachedInputPer1K
+		if cachedRate <= 0 {
+			cachedRate = entry.InputPer1K
+		}
+		nonCached := float64(inTokens-clamped) / 1000.0 * entry.InputPer1K
+		cached := float64(clamped) / 1000.0 * cachedRate
+		return nonCached + cached + output, true
+	case "anthropic", "bedrock":
+		// Bedrock-Anthropic returns the same additive cache buckets as
+		// first-party Anthropic; non-Anthropic Bedrock models simply report
+		// zero cache tokens, so this formula degrades to input + output.
+		readRate := entry.CacheReadPer1K
+		if readRate <= 0 {
+			readRate = entry.InputPer1K
+		}
+		createRate := entry.CacheCreationPer1K
+		if createRate <= 0 {
+			createRate = entry.InputPer1K
+		}
+		input := float64(inTokens) / 1000.0 * entry.InputPer1K
+		read := float64(cachedInput) / 1000.0 * readRate
+		create := float64(cacheCreation) / 1000.0 * createRate
+		return input + read + create + output, true
+	default:
+		input := float64(inTokens) / 1000.0 * entry.InputPer1K
+		return input + output, true
+	}
+}
+
+// Has reports whether the provider/model pair is present in the table.
+func (t *Table) Has(provider, model string) bool {
+	if t == nil {
+		return false
+	}
+	byModel, ok := t.entries[provider]
+	if !ok {
+		return false
+	}
+	_, ok = byModel[model]
+	return ok
+}
+
+// pricingFile mirrors the on-disk YAML schema. Keys are provider names; the
+// nested map keys are model names.
+type pricingFile map[string]map[string]struct {
+	InputPer1K         float64 `yaml:"input_per_1k"`
+	OutputPer1K        float64 `yaml:"output_per_1k"`
+	CachedInputPer1K   float64 `yaml:"cached_input_per_1k"`
+	CacheReadPer1K     float64 `yaml:"cache_read_per_1k"`
+	CacheCreationPer1K float64 `yaml:"cache_creation_per_1k"`
+}
+
+const (
+	// ReloadInterval is the mtime-poll cadence for the background reloader.
+	ReloadInterval = 30 * time.Second
+
+	// errorBackoff bounds how often the loader logs a repeated parse error.
+	errorBackoff = 5 * time.Minute
+)
+
+var basenameRegex = regexp.MustCompile(`^[a-zA-Z0-9._-]+$`)
+
+// Loader is a confined, hot-reloadable pricing table reader. Construction
+// must succeed against the target file; subsequent reload failures keep the
+// previously-loaded table so callers never observe a blank price list.
+type Loader struct {
+	baseDir  string
+	fullPath string
+	pluginID string
+	table    atomic.Pointer[Table]
+	mtime    atomic.Int64
+	failures metric.Int64Counter
+	interval time.Duration
+}
+
+// NewLoader returns a pricing loader that overlays an optional file-based
+// table on top of the embedded defaults. Missing override file, baseDir, or
+// relPath is not an error: the loader keeps the embedded defaults so cost
+// metadata is still emitted for known models.
+//
+// Errors:
+//   - bad basename, traversal segment, or absolute relPath are rejected so a
+//     misconfigured target surfaces immediately.
+//   - permission errors and YAML parse errors keep the defaults but log a
+//     warning; cost annotation does not silently break.
+//
+// failures is optional; pass nil in tests that do not care about
+// reload-failure telemetry.
+func NewLoader(baseDir, relPath, pluginID string, failures metric.Int64Counter) (*Loader, error) {
+	defaults := DefaultTable()
+	l := &Loader{
+		baseDir:  baseDir,
+		pluginID: pluginID,
+		failures: failures,
+	}
+	l.table.Store(defaults)
+
+	if strings.TrimSpace(baseDir) == "" || strings.TrimSpace(relPath) == "" {
+		return l, nil
+	}
+
+	full, err := resolveMiddlewareDataPath(baseDir, relPath)
+	if err != nil {
+		return nil, err
+	}
+	l.fullPath = full
+
+	overlay, mtime, err := loadPricing(full)
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			// Override file is optional. Defaults already stored.
+			return l, nil
+		}
+		// Symlink rejection, oversize file, parse failure, permission errors
+		// — surface so a misconfigured operator sees the problem instead of
+		// silently running with stale defaults.
+		return nil, fmt.Errorf("load pricing %s: %w", full, err)
+	}
+	l.table.Store(mergeOver(defaults, overlay))
+	l.mtime.Store(mtime.UnixNano())
+	return l, nil
+}
+
+// Get returns the current pricing table. The returned pointer is immutable;
+// callers must not mutate its contents.
+func (l *Loader) Get() *Table {
+	if l == nil {
+		return nil
+	}
+	return l.table.Load()
+}
+
+// WatchesFile reports whether this loader is bound to an override file on
+// disk. False for defaults-only loaders (no operator override given).
+// Callers use this to decide whether to spawn the mtime-poll goroutine.
+func (l *Loader) WatchesFile() bool {
+	if l == nil {
+		return false
+	}
+	return l.fullPath != ""
+}
+
+// SetReloadInterval overrides the mtime-poll cadence used by Reload. Calls
+// after Reload has started have no effect on the running loop. Intended for
+// tests; production code uses the default ReloadInterval.
+func (l *Loader) SetReloadInterval(d time.Duration) {
+	if l == nil || d <= 0 {
+		return
+	}
+	l.interval = d
+}
+
+// Reload runs a polling loop that checks the pricing file mtime every
+// ReloadInterval (or the value passed to SetReloadInterval). Returns when
+// ctx is cancelled.
+func (l *Loader) Reload(ctx context.Context) {
+	if l == nil {
+		return
+	}
+	interval := l.interval
+	if interval <= 0 {
+		interval = ReloadInterval
+	}
+	t := time.NewTicker(interval)
+	defer t.Stop()
+
+	var lastErrAt time.Time
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			if err := l.reload(); err != nil {
+				if l.failures != nil {
+					l.failures.Add(ctx, 1, metric.WithAttributes(
+						attribute.String("plugin", l.pluginID),
+					))
+				}
+				now := time.Now()
+				if now.Sub(lastErrAt) >= errorBackoff {
+					log.Warnf("llmobs: pricing reload failed for %s: %v", l.fullPath, err)
+					lastErrAt = now
+				}
+			}
+		}
+	}
+}
+
+// reload performs a single-shot mtime check and reload. The reloaded
+// override file is merged on top of the embedded defaults; missing override
+// (e.g. operator deleted the file) is not an error and reverts to defaults.
+func (l *Loader) reload() error {
+	if l.fullPath == "" {
+		// Defaults-only loader; nothing on disk to reload.
+		return nil
+	}
+	mtime, err := statMtime(l.fullPath)
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			// File was removed since startup. Drop back to defaults and
+			// reset mtime so a future re-creation triggers a reload.
+			l.table.Store(DefaultTable())
+			l.mtime.Store(0)
+			return nil
+		}
+		return err
+	}
+	if mtime.UnixNano() == l.mtime.Load() {
+		return nil
+	}
+
+	overlay, newMtime, err := loadPricing(l.fullPath)
+	if err != nil {
+		return err
+	}
+	l.table.Store(mergeOver(DefaultTable(), overlay))
+	l.mtime.Store(newMtime.UnixNano())
+	return nil
+}
+
+// resolveMiddlewareDataPath validates relPath is a safe basename and resolves
+// it under baseDir. An additional cleaned-prefix check guards against
+// CVE-style edge cases where Join is used with trailing path segments.
+func resolveMiddlewareDataPath(baseDir, relPath string) (string, error) {
+	if strings.TrimSpace(baseDir) == "" {
+		return "", errors.New("middleware-data-dir is not configured")
+	}
+	if relPath == "" {
+		return "", errors.New("pricing path is empty")
+	}
+	if !basenameRegex.MatchString(relPath) {
+		return "", fmt.Errorf("pricing path %q is not a safe basename", relPath)
+	}
+	if filepath.IsAbs(relPath) {
+		return "", fmt.Errorf("pricing path %q must be a basename, not absolute", relPath)
+	}
+
+	cleanBase, err := filepath.Abs(filepath.Clean(baseDir))
+	if err != nil {
+		return "", fmt.Errorf("resolve middleware-data-dir: %w", err)
+	}
+	full := filepath.Join(cleanBase, relPath)
+	cleanedFull := filepath.Clean(full)
+	if !strings.HasPrefix(cleanedFull, cleanBase+string(filepath.Separator)) && cleanedFull != cleanBase {
+		return "", fmt.Errorf("pricing path %q escapes middleware-data-dir", relPath)
+	}
+	return cleanedFull, nil
+}
+
+func parsePricingBytes(data []byte) (*Table, error) {
+	dec := yaml.NewDecoder(bytes.NewReader(data))
+	dec.KnownFields(true)
+
+	var raw pricingFile
+	if err := dec.Decode(&raw); err != nil && !errors.Is(err, io.EOF) {
+		return nil, fmt.Errorf("decode pricing yaml: %w", err)
+	}
+
+	out := make(map[string]map[string]Entry, len(raw))
+	for provider, models := range raw {
+		inner := make(map[string]Entry, len(models))
+		for model, entry := range models {
+			for field, v := range map[string]float64{
+				"input_per_1k":          entry.InputPer1K,
+				"output_per_1k":         entry.OutputPer1K,
+				"cached_input_per_1k":   entry.CachedInputPer1K,
+				"cache_read_per_1k":     entry.CacheReadPer1K,
+				"cache_creation_per_1k": entry.CacheCreationPer1K,
+			} {
+				if v < 0 || math.IsNaN(v) || math.IsInf(v, 0) {
+					return nil, fmt.Errorf("pricing %s/%s: %s must be a finite, non-negative rate, got %v", provider, model, field, v)
+				}
+			}
+			inner[model] = Entry{
+				InputPer1K:         entry.InputPer1K,
+				OutputPer1K:        entry.OutputPer1K,
+				CachedInputPer1K:   entry.CachedInputPer1K,
+				CacheReadPer1K:     entry.CacheReadPer1K,
+				CacheCreationPer1K: entry.CacheCreationPer1K,
+			}
+		}
+		out[provider] = inner
+	}
+	return &Table{entries: out}, nil
+}
diff --git a/proxy/internal/llm/pricing/pricing_other.go b/proxy/internal/llm/pricing/pricing_other.go
new file mode 100644
index 000000000..e65fffff1
--- /dev/null
+++ b/proxy/internal/llm/pricing/pricing_other.go
@@ -0,0 +1,20 @@
+//go:build !unix
+
+package pricing
+
+import (
+	"fmt"
+	"time"
+)
+
+// loadPricing is unavailable on non-Unix platforms because O_NOFOLLOW and
+// fstat-from-FD are required to honour the spec's symlink-safety rules. The
+// proxy is only deployed on Linux today; a Windows port would need an
+// equivalent path-as-handle implementation.
+func loadPricing(path string) (*Table, time.Time, error) {
+	return nil, time.Time{}, fmt.Errorf("llmobs pricing loader is not supported on this platform: %s", path)
+}
+
+func statMtime(path string) (time.Time, error) {
+	return time.Time{}, fmt.Errorf("llmobs pricing loader is not supported on this platform: %s", path)
+}
diff --git a/proxy/internal/llm/pricing/pricing_test.go b/proxy/internal/llm/pricing/pricing_test.go
new file mode 100644
index 000000000..7ac2a85dc
--- /dev/null
+++ b/proxy/internal/llm/pricing/pricing_test.go
@@ -0,0 +1,432 @@
+//go:build unix
+
+package pricing
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func copyFixture(t *testing.T, src, dst string) {
+	t.Helper()
+	data, err := os.ReadFile(src)
+	require.NoError(t, err, "read source fixture")
+	require.NoError(t, os.WriteFile(dst, data, 0o600), "write target fixture")
+}
+
+func TestNewLoader_HappyPath(t *testing.T) {
+	base := t.TempDir()
+	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), filepath.Join(base, "pricing.yaml"))
+
+	l, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
+	require.NoError(t, err, "NewLoader must succeed with a valid fixture")
+	table := l.Get()
+	require.NotNil(t, table, "table populated after load")
+
+	cost, ok := table.Cost("openai", "gpt-4o-mini", 1000, 1000, 0, 0)
+	require.True(t, ok, "known provider/model resolves")
+	assert.InDelta(t, 0.00075, cost, 1e-9, "cost = 0.00015 + 0.0006 per 1k tokens")
+
+	cost, ok = table.Cost("openai", "gpt-4o", 2000, 1000, 0, 0)
+	require.True(t, ok, "second known model resolves")
+	assert.InDelta(t, 0.015, cost, 1e-9, "cost for gpt-4o: 2*0.0025 + 1*0.01")
+
+	cost, ok = table.Cost("anthropic", "claude-sonnet-4-5", 1000, 1000, 0, 0)
+	require.True(t, ok, "anthropic model resolves")
+	assert.InDelta(t, 0.018, cost, 1e-9, "cost for claude-sonnet-4-5: 0.003 + 0.015")
+}
+
+// TestCost_OpenAICachedSubsetDiscount proves OpenAI's cached input
+// tokens are billed at the configured cached_input_per_1k rate while
+// the non-cached remainder of input_tokens is billed at the regular
+// rate. Critical because OpenAI returns cached_tokens as a SUBSET of
+// prompt_tokens — naïvely charging the cached count on top of
+// prompt_tokens would double-bill that portion.
+func TestCost_OpenAICachedSubsetDiscount(t *testing.T) {
+	tbl := &Table{entries: map[string]map[string]Entry{
+		"openai": {"gpt-4o": {
+			InputPer1K:       0.0025, // 0.0025 USD per 1k input tokens
+			OutputPer1K:      0.01,
+			CachedInputPer1K: 0.00125, // 0.5x discount on cached
+		}},
+	}}
+	// 1000 prompt tokens, 750 of which were cached. 250 non-cached
+	// at regular rate, 750 cached at the discount rate, 500 output.
+	cost, ok := tbl.Cost("openai", "gpt-4o", 1000, 500, 750, 0)
+	require.True(t, ok, "known model resolves")
+	want := (250.0/1000.0)*0.0025 + (750.0/1000.0)*0.00125 + (500.0/1000.0)*0.01
+	assert.InDelta(t, want, cost, 1e-12,
+		"cached subset must bill at the discount rate; non-cached remainder at regular rate")
+}
+
+// TestCost_OpenAICachedFallsBackToInputRate covers the operator
+// opt-in contract: when CachedInputPer1K is unset (zero), cached
+// tokens bill at the regular input rate. This matches today's
+// behaviour (cached counts weren't extracted at all so they
+// implicitly billed at the input rate via prompt_tokens).
+func TestCost_OpenAICachedFallsBackToInputRate(t *testing.T) {
+	tbl := &Table{entries: map[string]map[string]Entry{
+		"openai": {"gpt-4o": {InputPer1K: 0.0025, OutputPer1K: 0.01}},
+	}}
+	cost, ok := tbl.Cost("openai", "gpt-4o", 1000, 500, 750, 0)
+	require.True(t, ok)
+	want := 0.0025 + (500.0/1000.0)*0.01
+	assert.InDelta(t, want, cost, 1e-12,
+		"absent cached_input_per_1k rate must fall back to input_per_1k — same as pre-feature behaviour")
+}
+
+// TestCost_OpenAIClampsCachedToInputCount is the defensive guard
+// against malformed upstream responses that report cached_tokens >
+// prompt_tokens. We clamp so the formula never produces a negative
+// "non-cached remainder" multiplied by the input rate.
+func TestCost_OpenAIClampsCachedToInputCount(t *testing.T) {
+	tbl := &Table{entries: map[string]map[string]Entry{
+		"openai": {"gpt-4o": {InputPer1K: 0.0025, OutputPer1K: 0.01, CachedInputPer1K: 0.00125}},
+	}}
+	cost, ok := tbl.Cost("openai", "gpt-4o", 100, 0, 9999, 0)
+	require.True(t, ok)
+	// All 100 cached, 0 non-cached. Output is 0.
+	want := (100.0 / 1000.0) * 0.00125
+	assert.InDelta(t, want, cost, 1e-12,
+		"cached count > input count must clamp to input — never bill negative non-cached tokens")
+}
+
+// TestCost_AnthropicCacheReadAndCreationAreAdditive proves the
+// Anthropic shape: cache_read and cache_creation tokens are
+// ADDITIVE to input_tokens (not subset), each billed at its own
+// configured rate. The two rates pull in opposite directions —
+// cache_read is the cheaper read-from-cache rate (≈0.1× input),
+// cache_creation is the more expensive write-to-cache rate
+// (≈1.25× input).
+func TestCost_AnthropicCacheReadAndCreationAreAdditive(t *testing.T) {
+	tbl := &Table{entries: map[string]map[string]Entry{
+		"anthropic": {"claude-sonnet": {
+			InputPer1K:         0.003,
+			OutputPer1K:        0.015,
+			CacheReadPer1K:     0.0003,  // 0.1x of input
+			CacheCreationPer1K: 0.00375, // 1.25x of input
+		}},
+	}}
+	// 256 regular input + 768 cache_read + 512 cache_creation +
+	// 200 output. Each input bucket bills at its own rate.
+	cost, ok := tbl.Cost("anthropic", "claude-sonnet", 256, 200, 768, 512)
+	require.True(t, ok, "known model resolves")
+	want := (256.0/1000.0)*0.003 +
+		(768.0/1000.0)*0.0003 +
+		(512.0/1000.0)*0.00375 +
+		(200.0/1000.0)*0.015
+	assert.InDelta(t, want, cost, 1e-12,
+		"each Anthropic input bucket must bill at its own configured rate")
+}
+
+// TestCost_AnthropicCacheRatesFallBackToInput covers the no-opt-in
+// path: when neither CacheReadPer1K nor CacheCreationPer1K is set,
+// cache tokens bill at the regular input rate. This is more
+// accurate than today's behaviour (cache tokens ignored entirely)
+// without requiring operators to opt in via YAML.
+func TestCost_AnthropicCacheRatesFallBackToInput(t *testing.T) {
+	tbl := &Table{entries: map[string]map[string]Entry{
+		"anthropic": {"claude-sonnet": {InputPer1K: 0.003, OutputPer1K: 0.015}},
+	}}
+	cost, ok := tbl.Cost("anthropic", "claude-sonnet", 256, 200, 768, 512)
+	require.True(t, ok)
+	// Without overrides: every input bucket at input_per_1k.
+	want := ((256.0+768.0+512.0)/1000.0)*0.003 + (200.0/1000.0)*0.015
+	assert.InDelta(t, want, cost, 1e-12,
+		"absent cache rates must fall back to input_per_1k — Anthropic cache tokens were ignored before this change, billing at input rate is more accurate as a default")
+}
+
+func TestNewLoader_UnknownModel(t *testing.T) {
+	base := t.TempDir()
+	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), filepath.Join(base, "pricing.yaml"))
+
+	l, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
+	require.NoError(t, err)
+
+	_, ok := l.Get().Cost("openai", "fantasy-model", 10, 10, 0, 0)
+	assert.False(t, ok, "unknown model returns ok=false")
+
+	_, ok = l.Get().Cost("cohere", "anything", 10, 10, 0, 0)
+	assert.False(t, ok, "unknown provider returns ok=false")
+}
+
+func TestNewLoader_InvalidYAMLRejected(t *testing.T) {
+	base := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(base, "pricing.yaml"), []byte("\t- this is not: valid: yaml: :["), 0o600))
+
+	_, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
+	require.Error(t, err, "invalid YAML must surface as construction error")
+}
+
+func TestLoader_ReloadKeepsPreviousOnParseError(t *testing.T) {
+	base := t.TempDir()
+	target := filepath.Join(base, "pricing.yaml")
+	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), target)
+
+	l, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
+	require.NoError(t, err)
+	require.NotNil(t, l.Get(), "initial table populated")
+
+	// Overwrite with content that violates the strict schema (extra field)
+	// plus a bumped mtime to trigger reload.
+	require.NoError(t, os.WriteFile(target, []byte("openai:\n  gpt-4o:\n    input_per_1k: 1.0\n    output_per_1k: 2.0\n    bogus_field: nope\n"), 0o600))
+	future := time.Now().Add(time.Hour)
+	require.NoError(t, os.Chtimes(target, future, future))
+
+	err = l.reload()
+	require.Error(t, err, "parse error surfaced by reload()")
+
+	cost, ok := l.Get().Cost("openai", "gpt-4o-mini", 1000, 1000, 0, 0)
+	require.True(t, ok, "previous table still available after parse failure")
+	assert.InDelta(t, 0.00075, cost, 1e-9, "previous cost preserved")
+}
+
+func TestLoader_ReloadNoChangeIsNoOp(t *testing.T) {
+	base := t.TempDir()
+	target := filepath.Join(base, "pricing.yaml")
+	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), target)
+
+	l, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
+	require.NoError(t, err)
+	ptrBefore := l.Get()
+
+	require.NoError(t, l.reload(), "no-change reload must not error")
+	ptrAfter := l.Get()
+	assert.Same(t, ptrBefore, ptrAfter, "table pointer unchanged when mtime unchanged")
+}
+
+func TestLoader_ReloadDetectsChange(t *testing.T) {
+	base := t.TempDir()
+	target := filepath.Join(base, "pricing.yaml")
+	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), target)
+
+	l, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
+	require.NoError(t, err)
+
+	updated := []byte("openai:\n  gpt-4o-mini:\n    input_per_1k: 1.00\n    output_per_1k: 2.00\n")
+	require.NoError(t, os.WriteFile(target, updated, 0o600))
+	future := time.Now().Add(time.Hour)
+	require.NoError(t, os.Chtimes(target, future, future))
+
+	require.NoError(t, l.reload(), "reload must succeed on valid new content")
+
+	cost, ok := l.Get().Cost("openai", "gpt-4o-mini", 1000, 1000, 0, 0)
+	require.True(t, ok, "updated model still present")
+	assert.InDelta(t, 3.0, cost, 0.0001, "new prices are applied: 1 + 2 per 1k")
+}
+
+// TestLoader_ReloadGoroutinePicksUpChanges proves the background goroutine
+// started via Reload actually swaps the pricing table when the file changes
+// on disk. Without that goroutine running, pricing edits would never reach
+// requests until a proxy restart.
+func TestLoader_ReloadGoroutinePicksUpChanges(t *testing.T) {
+	base := t.TempDir()
+	target := filepath.Join(base, "pricing.yaml")
+	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), target)
+
+	l, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
+	require.NoError(t, err)
+	l.SetReloadInterval(20 * time.Millisecond)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	done := make(chan struct{})
+	go func() {
+		l.Reload(ctx)
+		close(done)
+	}()
+
+	// Before any rewrite, the loader holds the fixture's prices.
+	costBefore, ok := l.Get().Cost("openai", "gpt-4o-mini", 1000, 1000, 0, 0)
+	require.True(t, ok, "fixture model must resolve initially")
+	assert.InDelta(t, 0.00075, costBefore, 1e-9, "fixture prices apply before rewrite")
+
+	updated := []byte("openai:\n  gpt-4o-mini:\n    input_per_1k: 1.00\n    output_per_1k: 2.00\n")
+	require.NoError(t, os.WriteFile(target, updated, 0o600))
+	future := time.Now().Add(time.Hour)
+	require.NoError(t, os.Chtimes(target, future, future))
+
+	deadline := time.Now().Add(2 * time.Second)
+	for {
+		cost, ok := l.Get().Cost("openai", "gpt-4o-mini", 1000, 1000, 0, 0)
+		if ok && cost > 2.5 {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("background reloader did not pick up rewrite within deadline")
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+
+	cancel()
+	select {
+	case <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("Reload loop did not exit after cancel")
+	}
+}
+
+func TestLoader_ReloadBackgroundLoopCancellation(t *testing.T) {
+	base := t.TempDir()
+	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), filepath.Join(base, "pricing.yaml"))
+	l, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan struct{})
+	go func() {
+		l.Reload(ctx)
+		close(done)
+	}()
+	cancel()
+
+	select {
+	case <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("Reload loop did not exit on context cancel")
+	}
+}
+
+func TestNewLoader_PathValidation(t *testing.T) {
+	base := t.TempDir()
+	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), filepath.Join(base, "pricing.yaml"))
+
+	cases := []struct {
+		name    string
+		relPath string
+	}{
+		{"traversal", "../../etc/passwd"},
+		{"absolute", "/etc/passwd"},
+		{"slash in basename", "sub/pricing.yaml"},
+		{"control chars", "pricing\x00.yaml"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := NewLoader(base, tc.relPath, "llm_observability", nil)
+			require.Error(t, err, "NewLoader must reject %q", tc.relPath)
+		})
+	}
+
+	// Empty relPath is no longer a validation error: the loader treats it
+	// as "no override file, defaults only" so cost metadata is still
+	// emitted for the embedded models out of the box.
+	t.Run("empty falls back to defaults", func(t *testing.T) {
+		l, err := NewLoader(base, "", "llm_observability", nil)
+		require.NoError(t, err, "empty relPath should yield a defaults-only loader")
+		require.NotNil(t, l, "loader must be returned")
+		require.False(t, l.WatchesFile(), "no file watching when no override is given")
+		_, ok := l.Get().Cost("openai", "gpt-4o-mini", 1000, 1000, 0, 0)
+		assert.True(t, ok, "embedded defaults should still resolve gpt-4o-mini")
+	})
+}
+
+// TestNewLoader_PathValidation_Extended covers the remaining attack shapes
+// called out in C2: dot references, embedded traversal segments, and a
+// newline in the basename. The basename regex must reject each one even
+// though filepath.Clean would otherwise collapse them.
+func TestNewLoader_PathValidation_Extended(t *testing.T) {
+	base := t.TempDir()
+	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), filepath.Join(base, "pricing.yaml"))
+
+	cases := []struct {
+		name    string
+		relPath string
+	}{
+		{"dot", "."},
+		{"dotdot", ".."},
+		{"relative traversal", "../pricing.yaml"},
+		{"embedded slash", "pri/cing.yaml"},
+		{"newline", "pricing\n.yaml"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := NewLoader(base, tc.relPath, "llm_observability", nil)
+			require.Error(t, err, "NewLoader must reject %q", tc.relPath)
+		})
+	}
+}
+
+// TestNewLoader_ValidBasenameLoads proves the allowlist is exclusive: a
+// basename containing only safe characters under baseDir loads. Without this
+// a regression that over-tightened the regex would silently break valid
+// deployments.
+func TestNewLoader_ValidBasenameLoads(t *testing.T) {
+	base := t.TempDir()
+	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), filepath.Join(base, "pricing-v2_prod.yaml"))
+
+	l, err := NewLoader(base, "pricing-v2_prod.yaml", "llm_observability", nil)
+	require.NoError(t, err, "basename with _, -, . must load")
+	require.NotNil(t, l.Get(), "table populated")
+}
+
+// TestNewLoader_SymlinkOutsideBaseDirRejected constructs a symlink under
+// baseDir that points to a file outside it. O_NOFOLLOW must refuse to open
+// the symlink even though the symlink path itself is a valid basename under
+// baseDir.
+func TestNewLoader_SymlinkOutsideBaseDirRejected(t *testing.T) {
+	outside := t.TempDir()
+	target := filepath.Join(outside, "evil.yaml")
+	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), target)
+
+	base := t.TempDir()
+	link := filepath.Join(base, "pricing.yaml")
+	require.NoError(t, os.Symlink(target, link), "symlink setup")
+
+	_, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
+	require.Error(t, err, "O_NOFOLLOW must reject symlink even when it points outside baseDir")
+}
+
+func TestNewLoader_SymlinkRejected(t *testing.T) {
+	base := t.TempDir()
+	concrete := filepath.Join(base, "real.yaml")
+	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), concrete)
+
+	link := filepath.Join(base, "pricing.yaml")
+	require.NoError(t, os.Symlink(concrete, link), "symlink setup")
+
+	_, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
+	require.Error(t, err, "O_NOFOLLOW must reject symlinked targets")
+}
+
+func TestTableCost_NilSafe(t *testing.T) {
+	var t1 *Table
+	cost, ok := t1.Cost("x", "y", 1, 1, 0, 0)
+	assert.False(t, ok, "nil table reports unknown")
+	assert.Zero(t, cost, "nil table returns zero cost")
+	assert.False(t, t1.Has("x", "y"), "nil table has nothing")
+}
+
+func TestLoaderGet_NilSafe(t *testing.T) {
+	var l *Loader
+	assert.Nil(t, l.Get(), "nil loader returns nil table")
+}
+
+// TestNewLoader_RejectsOversizedFile_FixesM4 proves the loader bounds reads
+// at maxPricingBytes so a hostile file cannot exhaust process memory.
+func TestNewLoader_RejectsOversizedFile_FixesM4(t *testing.T) {
+	base := t.TempDir()
+	target := filepath.Join(base, "pricing.yaml")
+
+	// Build a YAML payload larger than the cap. We pad with valid YAML
+	// comments so a partial read would still fail the size check rather
+	// than the parser.
+	header := "openai:\n"
+	bigComment := make([]byte, maxPricingBytes+1024)
+	for i := range bigComment {
+		bigComment[i] = ' '
+	}
+	bigComment[0] = '#'
+	bigComment[len(bigComment)-1] = '\n'
+	payload := append([]byte(header), bigComment...)
+	require.NoError(t, os.WriteFile(target, payload, 0o600))
+
+	_, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
+	require.Error(t, err, "oversized pricing file must be rejected")
+	assert.Contains(t, err.Error(), "exceeds", "rejection must reference the byte cap")
+}
diff --git a/proxy/internal/llm/pricing/pricing_unix.go b/proxy/internal/llm/pricing/pricing_unix.go
new file mode 100644
index 000000000..4f3ea33a2
--- /dev/null
+++ b/proxy/internal/llm/pricing/pricing_unix.go
@@ -0,0 +1,68 @@
+//go:build unix
+
+package pricing
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"syscall"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// maxPricingBytes caps the size of the pricing YAML on read so a hostile or
+// runaway file cannot exhaust process memory during reload. 1 MiB is several
+// orders of magnitude larger than any reasonable pricing table.
+const maxPricingBytes int64 = 1 << 20
+
+// loadPricing opens the file with O_NOFOLLOW, fstats the open descriptor,
+// and parses from that same descriptor. Never re-opens by path so a
+// mid-read rename or symlink swap cannot substitute content. Bytes are
+// capped at maxPricingBytes so the loader cannot be coerced into reading an
+// unbounded file.
+func loadPricing(path string) (*Table, time.Time, error) {
+	f, err := os.OpenFile(path, os.O_RDONLY|syscall.O_NOFOLLOW, 0)
+	if err != nil {
+		return nil, time.Time{}, fmt.Errorf("open %s: %w", path, err)
+	}
+	defer func() {
+		if cerr := f.Close(); cerr != nil {
+			log.Debugf("close pricing file %s: %v", path, cerr)
+		}
+	}()
+
+	info, err := f.Stat()
+	if err != nil {
+		return nil, time.Time{}, fmt.Errorf("fstat %s: %w", path, err)
+	}
+	if !info.Mode().IsRegular() {
+		return nil, time.Time{}, fmt.Errorf("pricing file %s is not a regular file", path)
+	}
+
+	data, err := io.ReadAll(io.LimitReader(f, maxPricingBytes+1))
+	if err != nil {
+		return nil, time.Time{}, fmt.Errorf("read %s: %w", path, err)
+	}
+	if int64(len(data)) > maxPricingBytes {
+		return nil, time.Time{}, fmt.Errorf("pricing file %s exceeds %d bytes", path, maxPricingBytes)
+	}
+
+	table, err := parsePricingBytes(data)
+	if err != nil {
+		return nil, time.Time{}, err
+	}
+	return table, info.ModTime(), nil
+}
+
+// statMtime returns the mtime of the file at path. It uses lstat semantics
+// via os.Lstat so a symlink swap is detected even though O_NOFOLLOW will
+// later reject the open.
+func statMtime(path string) (time.Time, error) {
+	info, err := os.Lstat(path)
+	if err != nil {
+		return time.Time{}, fmt.Errorf("lstat %s: %w", path, err)
+	}
+	return info.ModTime(), nil
+}
diff --git a/proxy/internal/llm/sse.go b/proxy/internal/llm/sse.go
new file mode 100644
index 000000000..3d33ab577
--- /dev/null
+++ b/proxy/internal/llm/sse.go
@@ -0,0 +1,117 @@
+package llm
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+)
+
+// Event represents a single server-sent event. Type is the dispatch name
+// carried on an "event:" line (empty when the stream uses only "data:"
+// lines). Data is the concatenation of every "data:" line that made up the
+// event, joined by a single newline.
+type Event struct {
+	Type string
+	Data string
+}
+
+// Scanner reads SSE events from an underlying byte stream. Events are
+// delimited by a blank line ("\n\n"). CRLF line endings are normalized to LF
+// transparently so fixtures captured from live servers can be replayed.
+//
+// Scanner is not safe for concurrent use.
+type Scanner struct {
+	r       *bufio.Reader
+	maxLine int
+}
+
+// NewScanner wraps the given reader. The default underlying buffer size is
+// large enough for typical provider events (~64 KiB); callers needing
+// larger events can wrap the reader in their own bufio.Reader beforehand.
+func NewScanner(r io.Reader) *Scanner {
+	return &Scanner{
+		r:       bufio.NewReaderSize(r, 64*1024),
+		maxLine: 1 << 20,
+	}
+}
+
+// Next returns the next event. It returns io.EOF after the final event has
+// been consumed. A trailing event that is not terminated by a blank line is
+// still returned before io.EOF so that servers which close the connection
+// without a trailing newline are handled correctly.
+func (s *Scanner) Next() (Event, error) {
+	var (
+		event   Event
+		dataBuf strings.Builder
+		hasData bool
+		hasAny  bool
+	)
+
+	for {
+		line, err := s.readLine()
+		if err != nil {
+			if errors.Is(err, io.EOF) && hasAny {
+				event.Data = dataBuf.String()
+				return event, nil
+			}
+			return Event{}, err
+		}
+
+		if line == "" {
+			if !hasAny {
+				continue
+			}
+			event.Data = dataBuf.String()
+			return event, nil
+		}
+
+		hasAny = true
+		if strings.HasPrefix(line, ":") {
+			continue
+		}
+
+		field, value := splitField(line)
+		switch field {
+		case "event":
+			event.Type = value
+		case "data":
+			if hasData {
+				dataBuf.WriteByte('\n')
+			}
+			dataBuf.WriteString(value)
+			hasData = true
+		}
+	}
+}
+
+func (s *Scanner) readLine() (string, error) {
+	line, err := s.r.ReadString('\n')
+	if err != nil {
+		if errors.Is(err, io.EOF) && line != "" {
+			return trimEOL(line), nil
+		}
+		return "", err
+	}
+	if len(line) > s.maxLine {
+		return "", fmt.Errorf("sse line exceeds %d bytes", s.maxLine)
+	}
+	return trimEOL(line), nil
+}
+
+func trimEOL(line string) string {
+	line = strings.TrimRight(line, "\n")
+	line = strings.TrimRight(line, "\r")
+	return line
+}
+
+func splitField(line string) (string, string) {
+	idx := strings.IndexByte(line, ':')
+	if idx < 0 {
+		return line, ""
+	}
+	field := line[:idx]
+	value := strings.TrimPrefix(line[idx+1:], " ")
+	return field, value
+}
diff --git a/proxy/internal/llm/sse_test.go b/proxy/internal/llm/sse_test.go
new file mode 100644
index 000000000..96cecc111
--- /dev/null
+++ b/proxy/internal/llm/sse_test.go
@@ -0,0 +1,175 @@
+package llm
+
+import (
+	"errors"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func collectEvents(t *testing.T, r io.Reader) []Event {
+	t.Helper()
+	s := NewScanner(r)
+	var out []Event
+	for {
+		ev, err := s.Next()
+		if errors.Is(err, io.EOF) {
+			return out
+		}
+		require.NoError(t, err, "unexpected error scanning SSE")
+		out = append(out, ev)
+	}
+}
+
+func TestSSEScanner_OpenAIFixture(t *testing.T) {
+	f, err := os.Open(filepath.Join("fixtures", "openai_stream.txt"))
+	require.NoError(t, err, "fixture must be openable")
+	defer f.Close()
+
+	events := collectEvents(t, f)
+	require.Len(t, events, 4, "expected 4 data frames (3 chunks + [DONE])")
+
+	for _, ev := range events {
+		assert.Empty(t, ev.Type, "OpenAI stream uses data-only frames")
+	}
+	assert.Contains(t, events[2].Data, `"usage"`, "third chunk carries usage block")
+	assert.Equal(t, "[DONE]", events[3].Data, "final frame is the OpenAI DONE sentinel")
+}
+
+func TestSSEScanner_AnthropicFixture(t *testing.T) {
+	f, err := os.Open(filepath.Join("fixtures", "anthropic_stream.txt"))
+	require.NoError(t, err, "fixture must be openable")
+	defer f.Close()
+
+	events := collectEvents(t, f)
+	require.Len(t, events, 7, "expected 7 Anthropic events")
+
+	types := make([]string, 0, len(events))
+	for _, ev := range events {
+		types = append(types, ev.Type)
+	}
+	assert.Equal(t, []string{
+		"message_start",
+		"content_block_start",
+		"content_block_delta",
+		"content_block_delta",
+		"content_block_stop",
+		"message_delta",
+		"message_stop",
+	}, types, "Anthropic event ordering matches fixture")
+
+	var deltaUsage Event
+	for _, ev := range events {
+		if ev.Type == "message_delta" {
+			deltaUsage = ev
+			break
+		}
+	}
+	assert.Contains(t, deltaUsage.Data, `"output_tokens":45`, "message_delta carries partial usage")
+}
+
+func TestSSEScanner_MultilineData(t *testing.T) {
+	raw := "event: ping\ndata: line1\ndata: line2\ndata: line3\n\n"
+	events := collectEvents(t, strings.NewReader(raw))
+
+	require.Len(t, events, 1, "one logical event from three data lines")
+	assert.Equal(t, "ping", events[0].Type, "event name honored")
+	assert.Equal(t, "line1\nline2\nline3", events[0].Data, "data lines joined with newline")
+}
+
+func TestSSEScanner_CRLF(t *testing.T) {
+	raw := "event: foo\r\ndata: bar\r\n\r\ndata: baz\r\n\r\n"
+	events := collectEvents(t, strings.NewReader(raw))
+
+	require.Len(t, events, 2, "CRLF-delimited events recognized")
+	assert.Equal(t, "foo", events[0].Type, "first event type preserved")
+	assert.Equal(t, "bar", events[0].Data, "first event data preserved")
+	assert.Empty(t, events[1].Type, "second event has no event name")
+	assert.Equal(t, "baz", events[1].Data, "second event data preserved")
+}
+
+func TestSSEScanner_EmptyInput(t *testing.T) {
+	s := NewScanner(strings.NewReader(""))
+	_, err := s.Next()
+	require.ErrorIs(t, err, io.EOF, "empty input yields immediate EOF")
+}
+
+func TestSSEScanner_CommentIgnored(t *testing.T) {
+	raw := ": this is a comment\ndata: hi\n\n"
+	events := collectEvents(t, strings.NewReader(raw))
+	require.Len(t, events, 1, "comment line does not emit an event")
+	assert.Equal(t, "hi", events[0].Data, "data line honoured after comment")
+}
+
+func TestSSEScanner_TrailingWithoutBlankLine(t *testing.T) {
+	raw := "event: foo\ndata: bar\n"
+	events := collectEvents(t, strings.NewReader(raw))
+	require.Len(t, events, 1, "trailing event without blank line still emitted")
+	assert.Equal(t, "foo", events[0].Type)
+	assert.Equal(t, "bar", events[0].Data)
+}
+
+// TestSSEScanner_ManyConsecutiveEmptyLines feeds a stream that is nothing
+// but empty lines. The scanner must terminate without panic — empty lines
+// alone do not constitute an event and must yield io.EOF.
+func TestSSEScanner_ManyConsecutiveEmptyLines(t *testing.T) {
+	raw := strings.Repeat("\n", 100)
+	s := NewScanner(strings.NewReader(raw))
+	_, err := s.Next()
+	require.ErrorIs(t, err, io.EOF, "100 empty lines must terminate as EOF without panic")
+}
+
+// TestSSEScanner_InterleavedCRLFAndLF mixes \r\n and \n terminators within
+// the same event. The scanner normalizes both and must still recover a
+// coherent event.
+func TestSSEScanner_InterleavedCRLFAndLF(t *testing.T) {
+	raw := "event: mix\r\ndata: first\ndata: second\r\n\n"
+	events := collectEvents(t, strings.NewReader(raw))
+	require.Len(t, events, 1, "mixed line endings must still produce one event")
+	assert.Equal(t, "mix", events[0].Type)
+	assert.Equal(t, "first\nsecond", events[0].Data, "both data lines joined")
+}
+
+// TestSSEScanner_LongSingleDataLine constructs a single data line that
+// exceeds the default bufio buffer (64 KiB) but stays under the scanner
+// maxLine. The scanner must round-trip the value intact without panicking
+// or truncating silently.
+func TestSSEScanner_LongSingleDataLine(t *testing.T) {
+	big := strings.Repeat("x", 80<<10)
+	raw := "data: " + big + "\n\n"
+	events := collectEvents(t, strings.NewReader(raw))
+	require.Len(t, events, 1, "long single-line event must be emitted")
+	assert.Equal(t, big, events[0].Data, "long data preserved")
+}
+
+// TestSSEScanner_BinaryGarbageInData validates that non-printable bytes
+// inside a data line do not crash the parser. The scanner should either
+// round-trip them or return a well-formed error — never panic.
+func TestSSEScanner_BinaryGarbageInData(t *testing.T) {
+	raw := "data: \x00\x01\x02\xff\xfe\n\n"
+	defer func() {
+		if r := recover(); r != nil {
+			t.Fatalf("scanner panicked on binary garbage: %v", r)
+		}
+	}()
+	s := NewScanner(strings.NewReader(raw))
+	ev, err := s.Next()
+	require.NoError(t, err, "binary bytes in data should not surface as error")
+	assert.Equal(t, "\x00\x01\x02\xff\xfe", ev.Data, "binary payload round-trips")
+}
+
+// TestSSEScanner_UnknownFieldsIgnored stresses the field parser by sending
+// unrecognized field names ("id:", "retry:", "custom:"). They must be
+// silently ignored per the SSE spec; the scanner must not panic or emit
+// spurious events.
+func TestSSEScanner_UnknownFieldsIgnored(t *testing.T) {
+	raw := "id: 1\nretry: 5000\ncustom: value\ndata: payload\n\n"
+	events := collectEvents(t, strings.NewReader(raw))
+	require.Len(t, events, 1, "unknown fields must not spawn extra events")
+	assert.Equal(t, "payload", events[0].Data, "data field survives amid unknown fields")
+}
diff --git a/proxy/internal/metrics/metrics.go b/proxy/internal/metrics/metrics.go
index 41a6b0dd4..5fd23d934 100644
--- a/proxy/internal/metrics/metrics.go
+++ b/proxy/internal/metrics/metrics.go
@@ -17,6 +17,7 @@ import (
 // Metrics collects OpenTelemetry metrics for the proxy.
 type Metrics struct {
 	ctx                      context.Context
+	meter                    metric.Meter
 	requestsTotal            metric.Int64Counter
 	activeRequests           metric.Int64UpDownCounter
 	configuredDomains        metric.Int64UpDownCounter
@@ -49,10 +50,18 @@ type Metrics struct {
 	mappingPaths map[string]int
 }
 
+// Meter returns the OpenTelemetry meter the bundle was built with, so other
+// subsystems (e.g. the middleware manager) register instruments on the same
+// meter.
+func (m *Metrics) Meter() metric.Meter {
+	return m.meter
+}
+
 // New creates a Metrics instance using the given OpenTelemetry meter.
 func New(ctx context.Context, meter metric.Meter) (*Metrics, error) {
 	m := &Metrics{
 		ctx:          ctx,
+		meter:        meter,
 		mappingPaths: make(map[string]int),
 	}
 
diff --git a/proxy/internal/middleware/bodypolicy.go b/proxy/internal/middleware/bodypolicy.go
new file mode 100644
index 000000000..f31486fc8
--- /dev/null
+++ b/proxy/internal/middleware/bodypolicy.go
@@ -0,0 +1,63 @@
+package middleware
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"strconv"
+	"strings"
+)
+
+// ErrExpectContinue is returned when a middleware attempts to replace
+// the body of a request that advertised Expect: 100-continue.
+var ErrExpectContinue = errors.New("body replace rejected: request has Expect: 100-continue")
+
+// ErrOriginalNotDrained is returned when the original body was not
+// fully consumed before replacement. This prevents the backend from
+// seeing a mix of original bytes and the replacement.
+var ErrOriginalNotDrained = errors.New("body replace rejected: original body not drained")
+
+// ErrContentLengthMismatch is returned when the client-advertised
+// Content-Length disagrees with the number of bytes actually read from
+// the body (short-read).
+var ErrContentLengthMismatch = errors.New("body replace rejected: content-length mismatch (short read)")
+
+// ValidateBodyReplace runs the smuggling-prevention rules before a
+// body replacement is applied. Callers must pass originalDrained=true
+// once they have read r.Body to EOF.
+func ValidateBodyReplace(r *http.Request, newBody []byte, originalDrained bool) error {
+	if r == nil {
+		return errors.New("body replace rejected: nil request")
+	}
+	if strings.EqualFold(r.Header.Get("Expect"), "100-continue") {
+		return ErrExpectContinue
+	}
+	if !originalDrained {
+		return ErrOriginalNotDrained
+	}
+	if cl := r.Header.Get("Content-Length"); cl != "" && r.ContentLength > 0 {
+		parsed, err := strconv.ParseInt(cl, 10, 64)
+		if err == nil && parsed != r.ContentLength {
+			return fmt.Errorf("%w: header=%d actual=%d", ErrContentLengthMismatch, parsed, r.ContentLength)
+		}
+	}
+	return nil
+}
+
+// ApplyBodyReplace swaps r.Body for a reader over newBody, recomputes
+// Content-Length, and strips Transfer-Encoding and Trailer so no stale
+// framing reaches the backend.
+func ApplyBodyReplace(r *http.Request, newBody []byte) {
+	if r == nil {
+		return
+	}
+	r.Body = io.NopCloser(bytes.NewReader(newBody))
+	r.ContentLength = int64(len(newBody))
+	r.Header.Set("Content-Length", strconv.Itoa(len(newBody)))
+	r.Header.Del("Transfer-Encoding")
+	r.Header.Del("Trailer")
+	r.TransferEncoding = nil
+	r.Trailer = nil
+}
diff --git a/proxy/internal/middleware/bodytap/request.go b/proxy/internal/middleware/bodytap/request.go
new file mode 100644
index 000000000..826883a96
--- /dev/null
+++ b/proxy/internal/middleware/bodytap/request.go
@@ -0,0 +1,344 @@
+// Package bodytap owns the framework-side body capture used by the
+// middleware chain. Request capture buffers up to N bytes of the
+// request body for middleware inspection while replaying the original
+// stream to the upstream. Response capture tees up to N bytes off the
+// streaming response while every byte continues to flow to the client
+// untouched.
+//
+// The package is the single owner of body access — middlewares never
+// read req.Body or hijack the response writer. All inspection happens
+// against the buffer surfaced by the tap, so streaming remains
+// transparent to the client even when middlewares need access to the
+// payload.
+package bodytap
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"strconv"
+	"strings"
+	"sync"
+)
+
+// MaxRoutingScanBytes bounds how far ScanRoutingFields will read into a
+// request body to recover routing fields when the normal capture is
+// bypassed for size. Sized to comfortably hold a 1M-token context
+// request (whose `model` field a client may place after a multi-MB
+// `messages` array) while still capping pathological inputs.
+const MaxRoutingScanBytes int64 = 32 << 20
+
+// Request bypass reasons emitted as the `mw.capture.bypass_reason`
+// metadata key by the chain when a request body is not surfaced.
+const (
+	BypassUpgradeHeader    = "upgrade_header"
+	BypassConnectionUpgrd  = "connection_upgrade"
+	BypassContentType      = "content_type_not_allowed"
+	BypassBudget           = "capture_budget_exhausted"
+	BypassNoConfig         = "no_capture_config"
+	BypassNoMiddlewares    = "no_middlewares"
+	BypassCapZero          = "cap_zero"
+	BypassContentLengthCap = "content_length_over_cap"
+)
+
+// DefaultCaptureBudgetBytes is the default global capture-budget size.
+const DefaultCaptureBudgetBytes int64 = 256 << 20
+
+// Config holds per-target body capture limits after clamp validation.
+// A zero MaxRequestBytes / MaxResponseBytes disables capture in that
+// direction.
+type Config struct {
+	MaxRequestBytes  int64
+	MaxResponseBytes int64
+	ContentTypes     []string
+}
+
+// Budget is the global token-bucket semaphore shared across all
+// in-flight captures so a single misbehaving target cannot exhaust the
+// proxy.
+type Budget interface {
+	Acquire(n int64) bool
+	Release(n int64)
+}
+
+// NewBudget returns a Budget with the given total byte cap. A zero or
+// negative total disables the budget check.
+func NewBudget(total int64) Budget {
+	return &budget{total: total}
+}
+
+type budget struct {
+	mu    sync.Mutex
+	used  int64
+	total int64
+}
+
+func (b *budget) Acquire(n int64) bool {
+	if n <= 0 {
+		return true
+	}
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if b.total <= 0 {
+		return true
+	}
+	if b.used+n > b.total {
+		return false
+	}
+	b.used += n
+	return true
+}
+
+func (b *budget) Release(n int64) {
+	if n <= 0 {
+		return
+	}
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if b.total <= 0 {
+		return
+	}
+	b.used -= n
+	if b.used < 0 {
+		b.used = 0
+	}
+}
+
+// CaptureRequest reads up to cfg.MaxRequestBytes from r.Body into a
+// buffer suitable for middleware inspection, replacing r.Body with a
+// replay reader so the upstream still sees the original bytes. When
+// bypass != "" no body is read and r.Body is left untouched. The
+// returned release function must be invoked once the request is fully
+// processed; it returns the acquired budget tokens to the shared pool.
+// release is always non-nil and is safe to defer immediately after the
+// call.
+func CaptureRequest(r *http.Request, cfg *Config, b Budget) (body []byte, truncated bool, originalSize int64, bypass string, release func(), err error) {
+	release = func() {}
+	if r == nil {
+		return nil, false, 0, BypassNoConfig, release, nil
+	}
+	if cfg == nil {
+		return nil, false, 0, BypassNoConfig, release, nil
+	}
+	if cfg.MaxRequestBytes <= 0 {
+		return nil, false, 0, BypassCapZero, release, nil
+	}
+	if r.Header.Get("Upgrade") != "" {
+		return nil, false, 0, BypassUpgradeHeader, release, nil
+	}
+	if strings.EqualFold(r.Header.Get("Connection"), "upgrade") {
+		return nil, false, 0, BypassConnectionUpgrd, release, nil
+	}
+	if !contentTypeAllowed(r.Header.Get("Content-Type"), cfg.ContentTypes) {
+		return nil, false, 0, BypassContentType, release, nil
+	}
+
+	originalSize = parseContentLength(r.Header.Get("Content-Length"))
+	if originalSize > cfg.MaxRequestBytes {
+		return nil, true, originalSize, BypassContentLengthCap, release, nil
+	}
+
+	limit := cfg.MaxRequestBytes
+	if b != nil && !b.Acquire(limit) {
+		return nil, false, originalSize, BypassBudget, release, nil
+	}
+	if b != nil {
+		var released sync.Once
+		release = func() {
+			released.Do(func() { b.Release(limit) })
+		}
+	}
+
+	if r.Body == nil || r.Body == http.NoBody {
+		release()
+		release = func() {}
+		return nil, false, originalSize, "", release, nil
+	}
+
+	limited := io.LimitReader(r.Body, limit+1)
+	buf, readErr := io.ReadAll(limited)
+	if readErr != nil && !errors.Is(readErr, io.EOF) {
+		release()
+		release = func() {}
+		return nil, false, originalSize, "", release, readErr
+	}
+
+	truncated = int64(len(buf)) > limit
+	if truncated {
+		replay := append([]byte(nil), buf...)
+		viewable := buf[:limit]
+		r.Body = &replayReadCloser{replay: bytes.NewReader(replay), tail: r.Body}
+		return viewable, true, originalSize, "", release, nil
+	}
+	_ = r.Body.Close()
+	r.Body = io.NopCloser(bytes.NewReader(buf))
+	if originalSize <= 0 {
+		originalSize = int64(len(buf))
+	}
+	return buf, false, originalSize, "", release, nil
+}
+
+// replayReadCloser replays the captured prefix and then forwards the
+// remaining bytes from the original body so the upstream sees the
+// full request stream even when capture truncates.
+type replayReadCloser struct {
+	replay  *bytes.Reader
+	tail    io.ReadCloser
+	drained bool
+}
+
+func (r *replayReadCloser) Read(p []byte) (int, error) {
+	if !r.drained {
+		n, err := r.replay.Read(p)
+		if n > 0 {
+			return n, nil
+		}
+		if errors.Is(err, io.EOF) {
+			r.drained = true
+		} else if err != nil {
+			return 0, err
+		}
+	}
+	return r.tail.Read(p)
+}
+
+func (r *replayReadCloser) Close() error {
+	return r.tail.Close()
+}
+
+// ScanRoutingFields recovers the LLM routing fields ("model" and
+// "stream") from a request whose normal capture was bypassed or
+// truncated for size. It reads up to maxScan bytes of r.Body to locate
+// the top-level keys — clients (e.g. Claude Code) may place `model`
+// after a multi-MB `messages` array — then restores r.Body so the
+// upstream still receives the full, untouched stream. Only the small
+// routing fields are extracted; the prompt is never buffered for
+// capture, keeping memory bounded. Returns ok=false when the body isn't
+// a JSON object, the model field isn't found within maxScan, or on a
+// read error.
+func ScanRoutingFields(r *http.Request, maxScan int64) (model string, stream bool, ok bool) {
+	if r == nil || r.Body == nil || r.Body == http.NoBody || maxScan <= 0 {
+		return "", false, false
+	}
+	limited := io.LimitReader(r.Body, maxScan+1)
+	buf, readErr := io.ReadAll(limited)
+	if readErr != nil && !errors.Is(readErr, io.EOF) {
+		// Mid-stream read error (e.g. client disconnect): restore the bytes
+		// read so far plus the untouched tail and abort, rather than
+		// forwarding only the partial prefix as if it were the whole body.
+		r.Body = &replayReadCloser{replay: bytes.NewReader(append([]byte(nil), buf...)), tail: r.Body}
+		return "", false, false
+	}
+	if int64(len(buf)) > maxScan {
+		// Body exceeds the scan ceiling: restore the read prefix plus the
+		// untouched tail so the upstream still gets every byte.
+		r.Body = &replayReadCloser{replay: bytes.NewReader(append([]byte(nil), buf...)), tail: r.Body}
+	} else {
+		_ = r.Body.Close()
+		r.Body = io.NopCloser(bytes.NewReader(buf))
+	}
+	return scanTopLevelModelStream(buf)
+}
+
+// scanTopLevelModelStream walks the top level of a JSON object via a
+// streaming token reader, extracting the "model" string and "stream"
+// bool without materialising large values (each non-target value is
+// skipped as a RawMessage). Tolerant of truncation: returns whatever was
+// found before a malformed/short tail.
+func scanTopLevelModelStream(body []byte) (model string, stream bool, ok bool) {
+	dec := json.NewDecoder(bytes.NewReader(body))
+	tok, err := dec.Token()
+	if err != nil {
+		return "", false, false
+	}
+	if d, isDelim := tok.(json.Delim); !isDelim || d != '{' {
+		return "", false, false
+	}
+	for dec.More() {
+		keyTok, err := dec.Token()
+		if err != nil {
+			return model, stream, ok
+		}
+		key, _ := keyTok.(string)
+		switch key {
+		case "model":
+			var v string
+			if dec.Decode(&v) == nil {
+				model, ok = v, true
+			}
+		case "stream":
+			var v bool
+			if dec.Decode(&v) == nil {
+				stream = v
+			}
+		default:
+			// Skip the value by walking tokens instead of decoding it into
+			// a json.RawMessage — a multi-MB messages array would otherwise
+			// be materialised in full just to be discarded.
+			if err := skipValue(dec); err != nil {
+				return model, stream, ok
+			}
+		}
+	}
+	return model, stream, ok
+}
+
+// skipValue consumes one JSON value from dec without materialising it.
+// Scalars are a single token; objects/arrays are walked to their matching
+// close delimiter so nested structures are skipped in bounded memory.
+func skipValue(dec *json.Decoder) error {
+	tok, err := dec.Token()
+	if err != nil {
+		return err
+	}
+	d, isDelim := tok.(json.Delim)
+	if !isDelim || (d != '{' && d != '[') {
+		return nil
+	}
+	depth := 1
+	for depth > 0 {
+		tok, err := dec.Token()
+		if err != nil {
+			return err
+		}
+		if d, ok := tok.(json.Delim); ok {
+			switch d {
+			case '{', '[':
+				depth++
+			case '}', ']':
+				depth--
+			}
+		}
+	}
+	return nil
+}
+
+func contentTypeAllowed(ct string, allowed []string) bool {
+	if len(allowed) == 0 {
+		return false
+	}
+	media := ct
+	if idx := strings.Index(ct, ";"); idx >= 0 {
+		media = ct[:idx]
+	}
+	media = strings.TrimSpace(strings.ToLower(media))
+	for _, a := range allowed {
+		if strings.EqualFold(strings.TrimSpace(a), media) {
+			return true
+		}
+	}
+	return false
+}
+
+func parseContentLength(v string) int64 {
+	if v == "" {
+		return 0
+	}
+	parsed, err := strconv.ParseInt(v, 10, 64)
+	if err != nil || parsed < 0 {
+		return 0
+	}
+	return parsed
+}
diff --git a/proxy/internal/middleware/bodytap/response.go b/proxy/internal/middleware/bodytap/response.go
new file mode 100644
index 000000000..c23e35b34
--- /dev/null
+++ b/proxy/internal/middleware/bodytap/response.go
@@ -0,0 +1,189 @@
+package bodytap
+
+import (
+	"bytes"
+	"net/http"
+	"sync"
+
+	"github.com/netbirdio/netbird/proxy/internal/responsewriter"
+)
+
+// CapturingResponseWriter wraps an http.ResponseWriter, forwards bytes
+// immediately to the client, and tees a bounded copy into an internal
+// buffer for middleware inspection. Streaming-aware in the sense that
+// every byte the upstream emits flows to the client without queuing
+// — the tee just sees a bounded prefix. SSE-aware parsing happens in
+// the response middleware against the buffered prefix; this writer
+// makes no attempt to demux event boundaries.
+//
+// Flusher and Hijacker are preserved via responsewriter.PassthroughWriter.
+type CapturingResponseWriter struct {
+	*responsewriter.PassthroughWriter
+	mu          sync.Mutex
+	buf         bytes.Buffer
+	cap         int64
+	status      int
+	statusSet   bool
+	written     int64
+	truncated   bool
+	stopped     bool
+	releaseBuf  func()
+	released    sync.Once
+	bypassed    bool
+	bypassReas  string
+	acquiredCap int64
+}
+
+// NewCapturingResponseWriter returns a writer that tees up to maxBytes
+// into a capped buffer while forwarding bytes to the underlying writer
+// immediately. When budget is non-nil the writer pre-acquires maxBytes
+// from it and the returned wrapper must be released by calling
+// Release() once the response is fully forwarded. If the budget cannot
+// be acquired the writer falls back to forwarding the response
+// unmodified, exposes Bypassed()=true with reason BypassBudget, and
+// releases nothing.
+func NewCapturingResponseWriter(w http.ResponseWriter, maxBytes int64, b Budget) *CapturingResponseWriter {
+	cw := &CapturingResponseWriter{
+		PassthroughWriter: responsewriter.New(w),
+		cap:               maxBytes,
+		status:            http.StatusOK,
+		releaseBuf:        func() {},
+	}
+	if maxBytes <= 0 {
+		// Capture disabled: mark stopped so Write never tees and never
+		// flags truncation (a zero cap means "don't capture", not
+		// "captured nothing").
+		cw.stopped = true
+		return cw
+	}
+	if b == nil {
+		return cw
+	}
+	if !b.Acquire(maxBytes) {
+		cw.bypassed = true
+		cw.bypassReas = BypassBudget
+		cw.cap = 0
+		cw.stopped = true
+		return cw
+	}
+	cw.acquiredCap = maxBytes
+	cw.releaseBuf = func() { b.Release(maxBytes) }
+	return cw
+}
+
+// Release returns the response capture budget acquired at construction
+// back to the shared pool. Idempotent. Safe to call from a defer
+// immediately after construction even when the writer ended up
+// bypassing the budget.
+func (c *CapturingResponseWriter) Release() {
+	if c == nil {
+		return
+	}
+	c.released.Do(func() {
+		if c.releaseBuf != nil {
+			c.releaseBuf()
+		}
+	})
+}
+
+// Bypassed reports whether the writer fell through to a no-tee
+// passthrough because the response capture budget could not be
+// acquired.
+func (c *CapturingResponseWriter) Bypassed() bool {
+	if c == nil {
+		return false
+	}
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.bypassed
+}
+
+// BypassReason returns the bypass code recorded by the budget check.
+// Empty when capture proceeded normally.
+func (c *CapturingResponseWriter) BypassReason() string {
+	if c == nil {
+		return ""
+	}
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.bypassReas
+}
+
+// WriteHeader records the status code and forwards it to the underlying
+// writer. Only the first call commits the status — matching HTTP semantics,
+// where superfluous WriteHeader calls (and any call after the body has
+// started) are ignored — so Status() reflects the code actually sent.
+func (c *CapturingResponseWriter) WriteHeader(status int) {
+	c.mu.Lock()
+	if c.statusSet {
+		c.mu.Unlock()
+		return
+	}
+	c.status = status
+	c.statusSet = true
+	c.mu.Unlock()
+	c.PassthroughWriter.WriteHeader(status)
+}
+
+// Write forwards p to the underlying writer unmodified and copies up
+// to the remaining buffer capacity into the tee buffer.
+func (c *CapturingResponseWriter) Write(p []byte) (int, error) {
+	n, err := c.PassthroughWriter.Write(p)
+	if n > 0 {
+		c.mu.Lock()
+		// The first byte commits the status (implicit 200 if WriteHeader was
+		// never called); a later WriteHeader must not change Status().
+		c.statusSet = true
+		c.written += int64(n)
+		if !c.stopped {
+			remaining := c.cap - int64(c.buf.Len())
+			if remaining <= 0 {
+				c.truncated = true
+				c.stopped = true
+			} else {
+				take := int64(n)
+				if take > remaining {
+					take = remaining
+					c.truncated = true
+					c.stopped = true
+				}
+				c.buf.Write(p[:take])
+			}
+		}
+		c.mu.Unlock()
+	}
+	return n, err
+}
+
+// Status returns the captured status code (defaults to 200 when
+// WriteHeader has not been called).
+func (c *CapturingResponseWriter) Status() int {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.status
+}
+
+// Body returns a copy of the buffered response prefix.
+func (c *CapturingResponseWriter) Body() []byte {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	out := make([]byte, c.buf.Len())
+	copy(out, c.buf.Bytes())
+	return out
+}
+
+// Truncated reports whether the buffered prefix stopped short of the
+// full response stream.
+func (c *CapturingResponseWriter) Truncated() bool {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.truncated
+}
+
+// BytesWritten returns the total number of bytes forwarded to the
+// underlying writer.
+func (c *CapturingResponseWriter) BytesWritten() int64 {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.written
+}
diff --git a/proxy/internal/middleware/bodytap/routing_scan_test.go b/proxy/internal/middleware/bodytap/routing_scan_test.go
new file mode 100644
index 000000000..1748c989e
--- /dev/null
+++ b/proxy/internal/middleware/bodytap/routing_scan_test.go
@@ -0,0 +1,86 @@
+package bodytap
+
+import (
+	"fmt"
+	"io"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// makeBigAnthropicBody builds a request body shaped like Claude Code's:
+// a multi-MB "messages" array with the routing fields (model, stream)
+// placed AFTER it, which is the ordering that defeats a prefix-only
+// capture.
+func makeBigAnthropicBody(t *testing.T, model string, stream bool, messagesBytes int) string {
+	t.Helper()
+	filler := strings.Repeat("x", messagesBytes)
+	return fmt.Sprintf(
+		`{"max_tokens":64000,"messages":[{"role":"user","content":%q}],"model":%q,"stream":%t}`,
+		filler, model, stream,
+	)
+}
+
+func TestScanRoutingFields_ModelAfterLargeMessages(t *testing.T) {
+	body := makeBigAnthropicBody(t, "claude-opus-4-8", true, 3<<20) // 3 MiB messages
+	req := httptest.NewRequest("POST", "https://x/v1/messages", strings.NewReader(body))
+
+	model, stream, ok := ScanRoutingFields(req, MaxRoutingScanBytes)
+	require.True(t, ok, "model must be recovered even when it follows a multi-MB messages array")
+	assert.Equal(t, "claude-opus-4-8", model, "model field must be extracted")
+	assert.True(t, stream, "stream field must be extracted")
+
+	// Body must be fully restored for the upstream.
+	got, err := io.ReadAll(req.Body)
+	require.NoError(t, err)
+	assert.Equal(t, body, string(got), "the full request body must be replayed to upstream after scanning")
+}
+
+func TestScanRoutingFields_SmallBody(t *testing.T) {
+	body := `{"model":"claude-opus-4-8","stream":false,"messages":[]}`
+	req := httptest.NewRequest("POST", "https://x/v1/messages", strings.NewReader(body))
+
+	model, stream, ok := ScanRoutingFields(req, MaxRoutingScanBytes)
+	require.True(t, ok)
+	assert.Equal(t, "claude-opus-4-8", model)
+	assert.False(t, stream)
+
+	got, _ := io.ReadAll(req.Body)
+	assert.Equal(t, body, string(got), "small bodies must also be restored intact")
+}
+
+func TestScanRoutingFields_NoModel(t *testing.T) {
+	body := `{"stream":true,"messages":[]}`
+	req := httptest.NewRequest("POST", "https://x/v1/messages", strings.NewReader(body))
+
+	_, _, ok := ScanRoutingFields(req, MaxRoutingScanBytes)
+	assert.False(t, ok, "ok must be false when no model field is present")
+
+	got, _ := io.ReadAll(req.Body)
+	assert.Equal(t, body, string(got), "body must be restored even when model is absent")
+}
+
+func TestScanRoutingFields_NotJSON(t *testing.T) {
+	body := "this is not json at all"
+	req := httptest.NewRequest("POST", "https://x/v1/messages", strings.NewReader(body))
+
+	_, _, ok := ScanRoutingFields(req, MaxRoutingScanBytes)
+	assert.False(t, ok, "ok must be false for a non-JSON body")
+}
+
+func TestScanRoutingFields_ModelBeyondScanCeiling(t *testing.T) {
+	// model sits after 4 MiB of messages but the scan ceiling is 1 MiB:
+	// model can't be recovered, yet the full body must still replay.
+	body := makeBigAnthropicBody(t, "claude-opus-4-8", true, 4<<20)
+	req := httptest.NewRequest("POST", "https://x/v1/messages", strings.NewReader(body))
+
+	_, _, ok := ScanRoutingFields(req, 1<<20)
+	assert.False(t, ok, "model beyond the scan ceiling is not recoverable")
+
+	got, err := io.ReadAll(req.Body)
+	require.NoError(t, err)
+	assert.Equal(t, body, string(got), "the full body must still replay to upstream even when the scan gives up")
+}
diff --git a/proxy/internal/middleware/builtin/agentnetwork_chain_integration_test.go b/proxy/internal/middleware/builtin/agentnetwork_chain_integration_test.go
new file mode 100644
index 000000000..96777025c
--- /dev/null
+++ b/proxy/internal/middleware/builtin/agentnetwork_chain_integration_test.go
@@ -0,0 +1,318 @@
+package builtin_test
+
+import (
+	"context"
+	"net"
+	"runtime"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/test/bufconn"
+
+	mgmtgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
+	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/server/store"
+	nbtypes "github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_limit_check"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_limit_record"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// chainIntegrationFixture wires the BOTH new agent-network
+// middlewares against a live in-process management stack: real
+// sqlite store + real Manager + real gRPC server. The proxy chain
+// framework itself isn't constructed (its dispatcher / accumulator /
+// metadata gate are tested separately); we exercise the middleware
+// pair as the proxy runtime would, by invoking each with a crafted
+// Input and asserting the wire path between them.
+//
+// This is the regression cover for item 16 in the design review:
+// real LLM request → cost stamped → consumption row in the table.
+type chainIntegrationFixture struct {
+	store    store.Store
+	manager  agentnetwork.Manager
+	gatecase *llm_limit_check.Middleware
+	recorder *llm_limit_record.Middleware
+}
+
+func newChainIntegration(t *testing.T) *chainIntegrationFixture {
+	t.Helper()
+	if runtime.GOOS == "windows" {
+		t.Skip("sqlite store not properly supported on Windows yet")
+	}
+	t.Setenv("NETBIRD_STORE_ENGINE", string(nbtypes.SqliteStoreEngine))
+
+	st, cleanUp, err := store.NewTestStoreFromSQL(context.Background(), "", t.TempDir())
+	require.NoError(t, err)
+	t.Cleanup(cleanUp)
+
+	manager := agentnetwork.NewManager(st, nil, nil, nil)
+
+	server := &mgmtgrpc.ProxyServiceServer{}
+	server.SetAgentNetworkLimitsService(manager)
+
+	const bufSize = 1024 * 1024
+	lis := bufconn.Listen(bufSize)
+	srv := grpc.NewServer()
+	proto.RegisterProxyServiceServer(srv, server)
+	go func() { _ = srv.Serve(lis) }()
+	t.Cleanup(srv.Stop)
+
+	conn, err := grpc.NewClient("passthrough:///bufnet",
+		grpc.WithContextDialer(func(_ context.Context, _ string) (net.Conn, error) { return lis.Dial() }),
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+	)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = conn.Close() })
+
+	mgmtClient := proto.NewProxyServiceClient(conn)
+	return &chainIntegrationFixture{
+		store:    st,
+		manager:  manager,
+		gatecase: llm_limit_check.New(mgmtClient, nil),
+		recorder: llm_limit_record.New(mgmtClient, nil),
+	}
+}
+
+// chainInput builds a middleware Input that mirrors what the proxy
+// framework would synthesise for a tunnel-peer LLM request. The
+// gate consumes the resolved provider id from upstream metadata
+// (set by llm_router); the recorder consumes the attribution
+// metadata stamped by the gate plus tokens / cost from
+// llm_response_parser + cost_meter.
+func chainInput(account, user, group, providerID string, requestMeta []middleware.KV) *middleware.Input {
+	_ = providerID // packed into requestMeta by the caller as KeyLLMResolvedProviderID
+	return &middleware.Input{
+		AccountID:  account,
+		UserID:     user,
+		UserGroups: []string{group},
+		Metadata:   requestMeta,
+	}
+}
+
+// chainCapPolicy builds a tight token-cap policy fixture for the
+// chain integration tests. Inlined here (rather than imported) because
+// the equivalent helper in the management gRPC package is unexported
+// and this is a different package boundary.
+func chainCapPolicy(id, account string, sourceGroups []string, providerID string, tokenCap, windowSec int64) *agentNetworkTypes.Policy {
+	return &agentNetworkTypes.Policy{
+		ID:                     id,
+		AccountID:              account,
+		Enabled:                true,
+		Name:                   id,
+		SourceGroups:           sourceGroups,
+		DestinationProviderIDs: []string{providerID},
+		Limits: agentNetworkTypes.PolicyLimits{
+			TokenLimit: agentNetworkTypes.PolicyTokenLimit{
+				Enabled:       true,
+				GroupCap:      tokenCap,
+				WindowSeconds: windowSec,
+			},
+		},
+		CreatedAt: time.Now().UTC(),
+		UpdatedAt: time.Now().UTC(),
+	}
+}
+
+// TestChain_AllowPath_StampsAttributionAndRecordsCounter walks the
+// full happy path: gate calls CheckLLMPolicyLimits → stamps
+// attribution metadata → recorder reads metadata + tokens / cost →
+// calls RecordLLMUsage → counters land in sqlite. Asserting on the
+// store at the end proves every leg of the wire works together,
+// not just each leg in isolation (which the unit tests already cover).
+func TestChain_AllowPath_StampsAttributionAndRecordsCounter(t *testing.T) {
+	f := newChainIntegration(t)
+
+	const account = "acc-1"
+	const user = "user-bob"
+	const group = "grp-engineers"
+	const provider = "prov-1"
+
+	// Seed a policy with token + budget caps; both halves carry
+	// real ceilings so the request stays within headroom.
+	require.NoError(t, f.store.SaveAgentNetworkPolicy(context.Background(),
+		chainCapPolicy("pol-1", account, []string{group}, provider, 10_000, 86_400)))
+
+	// ── Stage 1 — gate: pre-flight check ──────────────────────
+	gateIn := chainInput(account, user, group, provider, []middleware.KV{
+		{Key: middleware.KeyLLMResolvedProviderID, Value: provider},
+		{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+	})
+	gateOut, err := f.gatecase.Invoke(context.Background(), gateIn)
+	require.NoError(t, err)
+	require.Equal(t, middleware.DecisionAllow, gateOut.Decision, "fresh policy must allow")
+
+	// Verify attribution metadata was stamped — the recorder
+	// depends on these keys.
+	metaMap := map[string]string{}
+	for _, kv := range gateOut.Metadata {
+		metaMap[kv.Key] = kv.Value
+	}
+	assert.Equal(t, "pol-1", metaMap[middleware.KeyLLMSelectedPolicyID])
+	assert.Equal(t, group, metaMap[middleware.KeyLLMAttributionGroupID])
+	assert.Equal(t, "86400", metaMap[middleware.KeyLLMAttributionWindowS])
+
+	// ── Stage 2 — recorder: post-flight write ─────────────────
+	// Build the response-leg Input the framework would synthesise
+	// for the recorder: gate's emitted attribution metadata + the
+	// tokens / cost stamped by llm_response_parser + cost_meter.
+	const tokensIn = int64(123)
+	const tokensOut = int64(45)
+	const costUSD = 0.0042
+	recordIn := chainInput(account, user, group, provider, append([]middleware.KV{},
+		gateOut.Metadata...))
+	recordIn.Metadata = append(recordIn.Metadata,
+		middleware.KV{Key: middleware.KeyLLMInputTokens, Value: strconv.FormatInt(tokensIn, 10)},
+		middleware.KV{Key: middleware.KeyLLMOutputTokens, Value: strconv.FormatInt(tokensOut, 10)},
+		middleware.KV{Key: middleware.KeyCostUSDTotal, Value: strconv.FormatFloat(costUSD, 'f', 6, 64)},
+	)
+	recordOut, err := f.recorder.Invoke(context.Background(), recordIn)
+	require.NoError(t, err)
+	assert.Equal(t, middleware.DecisionAllow, recordOut.Decision, "recorder always allows; its only side effect is the counter write")
+
+	// ── Stage 3 — assert state in sqlite ──────────────────────
+	windowStart := agentNetworkTypes.WindowStart(time.Now(), 86_400)
+	userRow, err := f.store.GetAgentNetworkConsumption(
+		context.Background(), store.LockingStrengthNone, account,
+		agentNetworkTypes.DimensionUser, user, int64(86_400), windowStart,
+	)
+	require.NoError(t, err)
+	assert.Equal(t, tokensIn, userRow.TokensInput, "user counter must hold the input tokens the recorder posted")
+	assert.Equal(t, tokensOut, userRow.TokensOutput)
+	assert.InDelta(t, costUSD, userRow.CostUSD, 1e-6)
+
+	groupRow, err := f.store.GetAgentNetworkConsumption(
+		context.Background(), store.LockingStrengthNone, account,
+		agentNetworkTypes.DimensionGroup, group, int64(86_400), windowStart,
+	)
+	require.NoError(t, err)
+	assert.Equal(t, tokensIn, groupRow.TokensInput, "group counter mirrors the user counter — single Record posts both dims")
+}
+
+// TestChain_DenyPath_GateRejectsAndNoConsumptionWritten covers the
+// negative side: when the gate denies, the recorder is never
+// invoked (the proxy framework short-circuits on Decision=Deny).
+// We assert no consumption row materialises after the gate-deny
+// path, even though the test technically calls the recorder
+// afterwards — the recorder must skip on missing attribution
+// metadata so the framework's short-circuit isn't load-bearing for
+// data integrity.
+func TestChain_DenyPath_GateRejectsAndNoConsumptionWritten(t *testing.T) {
+	f := newChainIntegration(t)
+
+	const account = "acc-1"
+	const user = "user-bob"
+	const group = "grp-tight"
+	const provider = "prov-1"
+
+	policy := chainCapPolicy("pol-tight", account, []string{group}, provider, 100, 86_400)
+	require.NoError(t, f.store.SaveAgentNetworkPolicy(context.Background(), policy))
+
+	// Pre-burn the counter to the cap so the gate denies.
+	require.NoError(t, f.store.IncrementAgentNetworkConsumption(
+		context.Background(), account,
+		agentNetworkTypes.DimensionGroup, group, int64(86_400),
+		agentNetworkTypes.WindowStart(time.Now(), 86_400),
+		100, 0, 0,
+	))
+
+	gateOut, err := f.gatecase.Invoke(context.Background(), chainInput(account, user, group, provider,
+		[]middleware.KV{
+			{Key: middleware.KeyLLMResolvedProviderID, Value: provider},
+			{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+		},
+	))
+	require.NoError(t, err)
+	assert.Equal(t, middleware.DecisionDeny, gateOut.Decision, "policy at-cap must deny on the gate")
+	require.NotNil(t, gateOut.DenyReason)
+	assert.Equal(t, "llm_policy.token_cap_exceeded", gateOut.DenyReason.Code)
+
+	// On deny, the gate emits no attribution metadata. If the
+	// proxy framework still invokes the recorder (defense in
+	// depth), the recorder's "no attribution window = skip" guard
+	// prevents a phantom counter increment.
+	recordOut, err := f.recorder.Invoke(context.Background(), chainInput(account, user, group, provider,
+		gateOut.Metadata, // no llm.attribution_window_seconds stamped
+	))
+	require.NoError(t, err)
+	assert.Equal(t, middleware.DecisionAllow, recordOut.Decision)
+
+	// The pre-burned 100 tokens are the only counter movement —
+	// the recorder must NOT have added a fresh row for the user
+	// dimension on this denied request.
+	windowStart := agentNetworkTypes.WindowStart(time.Now(), 86_400)
+	userRow, err := f.store.GetAgentNetworkConsumption(
+		context.Background(), store.LockingStrengthNone, account,
+		agentNetworkTypes.DimensionUser, user, int64(86_400), windowStart,
+	)
+	require.NoError(t, err)
+	assert.Zero(t, userRow.TokensInput, "user dimension must not gain tokens from a denied request — recorder skip is the safety net")
+}
+
+// TestChain_CapExhaustTransition exercises the allow→deny boundary
+// the operator cares most about: a request just under cap allows
+// AND records, the next request post-record at-cap denies. This is
+// the same lifecycle 50-grpc-allow-record-deny.sh runs in bash, but
+// against the actual middleware pair rather than the smoke binary
+// driving the gRPC RPCs directly.
+func TestChain_CapExhaustTransition(t *testing.T) {
+	f := newChainIntegration(t)
+
+	const account = "acc-1"
+	const user = "user-alice"
+	const group = "grp-cap-edge"
+	const provider = "prov-1"
+	const tightCap = int64(100)
+
+	require.NoError(t, f.store.SaveAgentNetworkPolicy(context.Background(),
+		chainCapPolicy("pol-edge", account, []string{group}, provider, tightCap, 86_400)))
+
+	// Pre-burn 99 tokens so we're at the very edge.
+	require.NoError(t, f.store.IncrementAgentNetworkConsumption(
+		context.Background(), account,
+		agentNetworkTypes.DimensionGroup, group, int64(86_400),
+		agentNetworkTypes.WindowStart(time.Now(), 86_400),
+		99, 0, 0,
+	))
+
+	// Gate at 99/100 — must allow (one token of headroom).
+	gateOut, err := f.gatecase.Invoke(context.Background(), chainInput(account, user, group, provider,
+		[]middleware.KV{
+			{Key: middleware.KeyLLMResolvedProviderID, Value: provider},
+			{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+		},
+	))
+	require.NoError(t, err)
+	require.Equal(t, middleware.DecisionAllow, gateOut.Decision, "99/100 must allow — one token of headroom")
+
+	// Record one more input token — pushes us to 100/100.
+	recordIn := chainInput(account, user, group, provider, append([]middleware.KV{},
+		gateOut.Metadata...))
+	recordIn.Metadata = append(recordIn.Metadata,
+		middleware.KV{Key: middleware.KeyLLMInputTokens, Value: "1"},
+		middleware.KV{Key: middleware.KeyLLMOutputTokens, Value: "0"},
+		middleware.KV{Key: middleware.KeyCostUSDTotal, Value: "0.000001"},
+	)
+	_, err = f.recorder.Invoke(context.Background(), recordIn)
+	require.NoError(t, err)
+
+	// Next gate call must deny — counter is exactly at cap.
+	gateOut2, err := f.gatecase.Invoke(context.Background(), chainInput(account, user, group, provider,
+		[]middleware.KV{
+			{Key: middleware.KeyLLMResolvedProviderID, Value: provider},
+			{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+		},
+	))
+	require.NoError(t, err)
+	assert.Equal(t, middleware.DecisionDeny, gateOut2.Decision,
+		"once recorder pushed the group counter to 100/100, the next gate call must deny — allow→deny transition is the operator-visible product semantic")
+	require.NotNil(t, gateOut2.DenyReason)
+	assert.Equal(t, "llm_policy.token_cap_exceeded", gateOut2.DenyReason.Code)
+}
diff --git a/proxy/internal/middleware/builtin/all_test.go b/proxy/internal/middleware/builtin/all_test.go
new file mode 100644
index 000000000..28576e248
--- /dev/null
+++ b/proxy/internal/middleware/builtin/all_test.go
@@ -0,0 +1,40 @@
+package builtin_test
+
+import (
+	"sort"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	mwbuiltin "github.com/netbirdio/netbird/proxy/internal/middleware/builtin"
+
+	_ "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/cost_meter"
+	_ "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_guardrail"
+	_ "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_identity_inject"
+	_ "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_limit_check"
+	_ "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_limit_record"
+	_ "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_request_parser"
+	_ "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_response_parser"
+	_ "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_router"
+)
+
+// TestDefaultRegistry_BuiltinIDs locks the set of middleware IDs that
+// the default builtin registry exposes once every sub-package's init()
+// has run. The list is the source of truth wired by the synthesiser
+// in management; adding a new built-in middleware should consciously
+// extend this list.
+func TestDefaultRegistry_BuiltinIDs(t *testing.T) {
+	got := mwbuiltin.DefaultRegistry().IDs()
+	sort.Strings(got)
+	want := []string{
+		"cost_meter",
+		"llm_guardrail",
+		"llm_identity_inject",
+		"llm_limit_check",
+		"llm_limit_record",
+		"llm_request_parser",
+		"llm_response_parser",
+		"llm_router",
+	}
+	assert.Equal(t, want, got, "default registry must expose every built-in middleware after anonymous imports")
+}
diff --git a/proxy/internal/middleware/builtin/builtin.go b/proxy/internal/middleware/builtin/builtin.go
new file mode 100644
index 000000000..9ea4cf89d
--- /dev/null
+++ b/proxy/internal/middleware/builtin/builtin.go
@@ -0,0 +1,93 @@
+// Package builtin holds the package-level middleware registry that
+// concrete middleware packages register themselves into via init().
+// Server boot anonymous-imports each middleware sub-package; the
+// resolver attached to the middleware Manager pulls factories out of
+// this registry.
+package builtin
+
+import (
+	"context"
+	"sync"
+
+	log "github.com/sirupsen/logrus"
+	"go.opentelemetry.io/otel/metric"
+	"google.golang.org/grpc"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// MgmtClient is the narrow slice of proto.ProxyServiceClient that
+// builtin middlewares may use during request / response handling.
+// Only the agent-network limit pair (llm_limit_check + llm_limit_record)
+// uses this today; declaring the surface here keeps the dependency
+// explicit at boot time.
+//
+// proto.ProxyServiceClient already satisfies this interface so server
+// boot just forwards its existing client.
+type MgmtClient interface {
+	CheckLLMPolicyLimits(ctx context.Context, in *proto.CheckLLMPolicyLimitsRequest, opts ...grpc.CallOption) (*proto.CheckLLMPolicyLimitsResponse, error)
+	RecordLLMUsage(ctx context.Context, in *proto.RecordLLMUsageRequest, opts ...grpc.CallOption) (*proto.RecordLLMUsageResponse, error)
+}
+
+// defaultRegistry is the package-level registry that concrete builtin
+// middlewares register themselves into via init().
+var defaultRegistry = middleware.NewRegistry()
+
+// FactoryContext is the per-process bag that concrete factories may
+// consult during construction. It carries the proxy-lifetime context,
+// the data directory used for static config files (pricing tables,
+// allowlists), the OTel meter, and the proxy logger.
+//
+// Configure must be called once at boot before any chain build calls
+// Resolve. Calling it twice overwrites the prior value; tests may rely
+// on this to reset state.
+type FactoryContext struct {
+	Context    context.Context
+	DataDir    string
+	Meter      metric.Meter
+	Logger     *log.Logger
+	MgmtClient MgmtClient
+}
+
+var (
+	ctxStore FactoryContext
+	ctxMu    sync.RWMutex
+)
+
+// Configure stores the per-process FactoryContext. Concrete factories
+// reach for it via Context(). mgmt may be nil on tests / standalone
+// builds with no management server; consumers must guard.
+func Configure(ctx context.Context, dataDir string, meter metric.Meter, logger *log.Logger, mgmt MgmtClient) {
+	ctxMu.Lock()
+	defer ctxMu.Unlock()
+	ctxStore = FactoryContext{
+		Context:    ctx,
+		DataDir:    dataDir,
+		Meter:      meter,
+		Logger:     logger,
+		MgmtClient: mgmt,
+	}
+}
+
+// Context returns the stored FactoryContext. Returns a zero value when
+// Configure was never called; consumers must guard against nil
+// Context/Meter/Logger if they care.
+func Context() FactoryContext {
+	ctxMu.RLock()
+	defer ctxMu.RUnlock()
+	return ctxStore
+}
+
+// Register adds a factory to the default registry. Called from init()
+// blocks of concrete middleware packages. Panics on collision so
+// duplicate IDs surface at startup.
+func Register(f middleware.Factory) {
+	defaultRegistry.MustRegister(f)
+}
+
+// DefaultRegistry returns the shared registry. The proxy server
+// constructs the Resolver from it at boot.
+func DefaultRegistry() *middleware.Registry {
+	return defaultRegistry
+}
diff --git a/proxy/internal/middleware/builtin/cost_meter/factory.go b/proxy/internal/middleware/builtin/cost_meter/factory.go
new file mode 100644
index 000000000..b8a58d10e
--- /dev/null
+++ b/proxy/internal/middleware/builtin/cost_meter/factory.go
@@ -0,0 +1,88 @@
+package cost_meter
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/netbirdio/netbird/proxy/internal/llm/pricing"
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin"
+)
+
+// defaultPricingFilename is the basename probed inside the proxy data
+// directory when no override is configured.
+const defaultPricingFilename = "pricing.yaml"
+
+// Config is the on-wire configuration for the middleware.
+type Config struct {
+	// PricingPath optionally overrides the basename of the pricing
+	// file probed inside the proxy data directory. When empty the
+	// loader falls back to "pricing.yaml".
+	PricingPath string `json:"pricing_path"`
+}
+
+// Factory builds cost_meter instances from raw config bytes.
+type Factory struct{}
+
+// ID returns the registry identifier.
+func (Factory) ID() string { return ID }
+
+// New constructs a middleware instance. Empty, null, and {} configs
+// are accepted; non-empty rawConfig that fails to unmarshal is
+// rejected so misconfigurations surface at chain build time. The
+// pricing loader is built once per instance and reused across
+// invocations.
+func (Factory) New(rawConfig []byte) (middleware.Middleware, error) {
+	cfg, err := decodeConfig(rawConfig)
+	if err != nil {
+		return nil, err
+	}
+
+	fctx := builtin.Context()
+	pricingPath := cfg.PricingPath
+	if pricingPath == "" {
+		pricingPath = defaultPricingFilename
+	}
+
+	loader, err := pricing.NewLoader(fctx.DataDir, pricingPath, ID, nil)
+	if err != nil {
+		return nil, fmt.Errorf("init pricing loader: %w", err)
+	}
+
+	cancel := startReloader(fctx.Context, loader)
+
+	return newMiddleware(loader, cancel), nil
+}
+
+// startReloader binds the loader's mtime-poll goroutine to a context
+// derived from the proxy-lifetime context and returns its cancel func so
+// the owning middleware can stop the goroutine on teardown. Returns nil
+// when there's nothing to watch (nil context or defaults-only loader), in
+// which case the middleware's Close is a no-op.
+func startReloader(ctx context.Context, loader *pricing.Loader) context.CancelFunc {
+	if ctx == nil || !loader.WatchesFile() {
+		return nil
+	}
+	cctx, cancel := context.WithCancel(ctx)
+	go loader.Reload(cctx)
+	return cancel
+}
+
+// decodeConfig accepts empty, null, and {} configs, returning a
+// zero-value Config. Non-empty payloads must parse cleanly.
+func decodeConfig(rawConfig []byte) (Config, error) {
+	var cfg Config
+	if len(bytes.TrimSpace(rawConfig)) == 0 {
+		return cfg, nil
+	}
+	if err := json.Unmarshal(rawConfig, &cfg); err != nil {
+		return cfg, fmt.Errorf("decode config: %w", err)
+	}
+	return cfg, nil
+}
+
+func init() {
+	builtin.Register(Factory{})
+}
diff --git a/proxy/internal/middleware/builtin/cost_meter/middleware.go b/proxy/internal/middleware/builtin/cost_meter/middleware.go
new file mode 100644
index 000000000..4da620310
--- /dev/null
+++ b/proxy/internal/middleware/builtin/cost_meter/middleware.go
@@ -0,0 +1,193 @@
+// Package cost_meter implements the SlotOnResponse middleware that
+// converts token-usage metadata emitted by llm_response_parser into a
+// per-request USD cost estimate. The middleware uses the shared pricing
+// loader so operator pricing overrides apply to the chain.
+package cost_meter
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+
+	"github.com/netbirdio/netbird/proxy/internal/llm/pricing"
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+)
+
+// ID is the registry identifier for this middleware.
+const ID = "cost_meter"
+
+// Version is the implementation version emitted via the spec merge.
+const Version = "1.0.0"
+
+// Skip reasons emitted under KeyCostSkipped. The set is closed; the
+// dashboard surfaces these verbatim.
+const (
+	skipMissingProvider = "missing_provider"
+	skipMissingModel    = "missing_model"
+	skipMissingTokens   = "missing_tokens"
+	//nolint:gosec // skip-reason label, not a credential
+	skipUnparseableTokens = "unparseable_tokens"
+	skipZeroTokens        = "zero_tokens"
+	skipUnknownModel      = "unknown_model"
+)
+
+var metadataKeys = []string{
+	middleware.KeyCostUSDTotal,
+	middleware.KeyCostSkipped,
+}
+
+// Middleware computes a per-response cost estimate from the token
+// counts emitted upstream by llm_response_parser.
+type Middleware struct {
+	loader *pricing.Loader
+	// cancel stops this instance's pricing-reload goroutine. Non-nil only
+	// when the loader watches an override file; Close calls it so a chain
+	// rebuild doesn't leak a poll goroutine per retired instance.
+	cancel context.CancelFunc
+}
+
+// newMiddleware constructs a Middleware bound to the given pricing loader.
+// cancel may be nil (defaults-only loader with no reloader to stop).
+func newMiddleware(loader *pricing.Loader, cancel context.CancelFunc) *Middleware {
+	return &Middleware{loader: loader, cancel: cancel}
+}
+
+// ID returns the registry identifier.
+func (m *Middleware) ID() string { return ID }
+
+// Version returns the implementation version.
+func (m *Middleware) Version() string { return Version }
+
+// Slot reports that the middleware runs after the upstream call.
+func (m *Middleware) Slot() middleware.Slot { return middleware.SlotOnResponse }
+
+// AcceptedContentTypes is empty: cost_meter never inspects bodies.
+func (m *Middleware) AcceptedContentTypes() []string { return []string{} }
+
+// MetadataKeys returns the closed allowlist of keys this middleware
+// may emit.
+func (m *Middleware) MetadataKeys() []string {
+	return append([]string(nil), metadataKeys...)
+}
+
+// MutationsSupported reports that this middleware never mutates the
+// response.
+func (m *Middleware) MutationsSupported() bool { return false }
+
+// Close stops this instance's pricing-reload goroutine, if any. Called by
+// the chain when a rebuild retires the instance, so the mtime-poll loop
+// doesn't outlive the chain it belonged to. Safe to call on a nil receiver
+// and on an instance with no reloader.
+func (m *Middleware) Close() error {
+	if m != nil && m.cancel != nil {
+		m.cancel()
+	}
+	return nil
+}
+
+// Invoke reads provider, model, and token metadata, looks up pricing,
+// and emits either KeyCostUSDTotal or KeyCostSkipped. The decision is
+// always DecisionAllow; cost metering never denies or mutates.
+func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middleware.Output, error) {
+	out := &middleware.Output{Decision: middleware.DecisionAllow}
+	if in == nil {
+		return out, nil
+	}
+
+	provider := lookupKV(in.Metadata, middleware.KeyLLMProvider)
+	if provider == "" {
+		out.Metadata = skip(skipMissingProvider)
+		return out, nil
+	}
+
+	model := lookupKV(in.Metadata, middleware.KeyLLMModel)
+	if model == "" {
+		out.Metadata = skip(skipMissingModel)
+		return out, nil
+	}
+
+	inRaw, hasIn := lookupKVOK(in.Metadata, middleware.KeyLLMInputTokens)
+	outRaw, hasOut := lookupKVOK(in.Metadata, middleware.KeyLLMOutputTokens)
+	if !hasIn || !hasOut {
+		out.Metadata = skip(skipMissingTokens)
+		return out, nil
+	}
+
+	inTokens, err := strconv.ParseInt(inRaw, 10, 64)
+	if err != nil || inTokens < 0 {
+		// Unparseable or negative tokens are not a runtime error: the
+		// upstream llm_response_parser emitted a non-numeric / invalid
+		// value, so we surface that as cost.skipped and continue with
+		// Allow rather than pricing a negative count.
+		out.Metadata = skip(skipUnparseableTokens)
+		return out, nil //nolint:nilerr // structured skip; not a runtime error
+	}
+	outTokens, err := strconv.ParseInt(outRaw, 10, 64)
+	if err != nil || outTokens < 0 {
+		out.Metadata = skip(skipUnparseableTokens)
+		return out, nil //nolint:nilerr // structured skip; not a runtime error
+	}
+
+	// Cache buckets are optional and silently zeroed on a missing /
+	// malformed value; they're a refinement on top of input cost,
+	// not a precondition. A buggy value falls back to 0, never aborts.
+	cachedTokens := parseOptionalInt64(in.Metadata, middleware.KeyLLMCachedInputTokens)
+	cacheCreationTokens := parseOptionalInt64(in.Metadata, middleware.KeyLLMCacheCreationTokens)
+
+	if inTokens == 0 && outTokens == 0 && cachedTokens == 0 && cacheCreationTokens == 0 {
+		out.Metadata = skip(skipZeroTokens)
+		return out, nil
+	}
+
+	table := m.loader.Get()
+	cost, ok := table.Cost(provider, model, inTokens, outTokens, cachedTokens, cacheCreationTokens)
+	if !ok {
+		out.Metadata = skip(skipUnknownModel)
+		return out, nil
+	}
+
+	out.Metadata = []middleware.KV{
+		{Key: middleware.KeyCostUSDTotal, Value: fmt.Sprintf("%.6f", cost)},
+	}
+	return out, nil
+}
+
+// skip returns a single-entry metadata slice carrying the given skip
+// reason under KeyCostSkipped.
+func skip(reason string) []middleware.KV {
+	return []middleware.KV{{Key: middleware.KeyCostSkipped, Value: reason}}
+}
+
+// lookupKV returns the value associated with key, or the empty string
+// when the key is absent.
+func lookupKV(kvs []middleware.KV, key string) string {
+	v, _ := lookupKVOK(kvs, key)
+	return v
+}
+
+// lookupKVOK returns the value associated with key plus a presence
+// flag so callers can distinguish absent from empty.
+func lookupKVOK(kvs []middleware.KV, key string) (string, bool) {
+	for _, kv := range kvs {
+		if kv.Key == key {
+			return kv.Value, true
+		}
+	}
+	return "", false
+}
+
+// parseOptionalInt64 reads a metadata value and decodes it as int64.
+// Absent or unparseable values yield 0 — the caller treats absence as
+// "no cached tokens" rather than an error, since cache buckets are a
+// refinement, not a precondition.
+func parseOptionalInt64(kvs []middleware.KV, key string) int64 {
+	raw, ok := lookupKVOK(kvs, key)
+	if !ok {
+		return 0
+	}
+	v, err := strconv.ParseInt(raw, 10, 64)
+	if err != nil || v < 0 {
+		return 0
+	}
+	return v
+}
diff --git a/proxy/internal/middleware/builtin/cost_meter/middleware_test.go b/proxy/internal/middleware/builtin/cost_meter/middleware_test.go
new file mode 100644
index 000000000..d1c161cab
--- /dev/null
+++ b/proxy/internal/middleware/builtin/cost_meter/middleware_test.go
@@ -0,0 +1,459 @@
+package cost_meter
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin"
+)
+
+const fixturePricing = `openai:
+  gpt-4o:
+    input_per_1k: 0.0025
+    output_per_1k: 0.01
+  gpt-4o-mini:
+    input_per_1k: 0.00015
+    output_per_1k: 0.0006
+anthropic:
+  claude-sonnet-4-5:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+`
+
+// configureBuiltin points the package-level FactoryContext at a tmp
+// directory containing the test pricing fixture. Returns the path so
+// callers can override files later if needed.
+func configureBuiltin(t *testing.T) string {
+	t.Helper()
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "pricing.yaml"), []byte(fixturePricing), 0o600), "write pricing fixture")
+	builtin.Configure(context.Background(), dir, nil, nil, nil)
+	return dir
+}
+
+func metaValue(t *testing.T, kvs []middleware.KV, key string) (string, bool) {
+	t.Helper()
+	for _, kv := range kvs {
+		if kv.Key == key {
+			return kv.Value, true
+		}
+	}
+	return "", false
+}
+
+func buildMiddleware(t *testing.T, raw []byte) middleware.Middleware {
+	t.Helper()
+	mw, err := Factory{}.New(raw)
+	require.NoError(t, err, "factory must accept the supplied config")
+	return mw
+}
+
+func TestMiddleware_StaticSurface(t *testing.T) {
+	configureBuiltin(t)
+	mw := buildMiddleware(t, nil)
+
+	assert.Equal(t, ID, mw.ID(), "ID must match the registered constant")
+	assert.Equal(t, Version, mw.Version(), "Version must match the constant")
+	assert.Equal(t, middleware.SlotOnResponse, mw.Slot(), "must run in the response slot")
+	assert.Empty(t, mw.AcceptedContentTypes(), "cost_meter does not inspect bodies")
+	assert.False(t, mw.MutationsSupported(), "cost_meter never mutates")
+	assert.NoError(t, mw.Close(), "Close on stateless middleware is a no-op")
+
+	keys := mw.MetadataKeys()
+	expected := []string{middleware.KeyCostUSDTotal, middleware.KeyCostSkipped}
+	assert.Equal(t, expected, keys, "metadata key allowlist must match the spec")
+}
+
+func TestFactory_AcceptsEmptyAndJSONConfig(t *testing.T) {
+	configureBuiltin(t)
+	cases := [][]byte{nil, {}, []byte("null"), []byte("{}"), []byte("   ")}
+	for _, raw := range cases {
+		mw, err := Factory{}.New(raw)
+		require.NoError(t, err, "empty/null/object config must be accepted")
+		require.NotNil(t, mw, "factory must return a middleware instance")
+	}
+}
+
+func TestFactory_RejectsMalformedConfig(t *testing.T) {
+	configureBuiltin(t)
+	mw, err := Factory{}.New([]byte("{not json"))
+	require.Error(t, err, "malformed config must surface at construction")
+	assert.Nil(t, mw, "no instance is returned on error")
+}
+
+func TestFactory_DefaultPricingPathLoadsFixture(t *testing.T) {
+	configureBuiltin(t)
+	mw := buildMiddleware(t, nil)
+
+	out, err := mw.Invoke(context.Background(), &middleware.Input{
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMProvider, Value: "openai"},
+			{Key: middleware.KeyLLMModel, Value: "gpt-4o-mini"},
+			{Key: middleware.KeyLLMInputTokens, Value: "1000"},
+			{Key: middleware.KeyLLMOutputTokens, Value: "1000"},
+		},
+	})
+	require.NoError(t, err)
+	require.Equal(t, middleware.DecisionAllow, out.Decision, "cost_meter always allows")
+
+	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
+	require.True(t, ok, "cost.usd_total must be emitted for known model")
+	assert.Equal(t, "0.000750", value, "0.00015 + 0.0006 per 1k tokens, 6-decimal format")
+}
+
+func TestFactory_PricingPathOverride(t *testing.T) {
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "custom.yaml"), []byte(fixturePricing), 0o600), "write custom pricing")
+	builtin.Configure(context.Background(), dir, nil, nil, nil)
+
+	raw, err := json.Marshal(Config{PricingPath: "custom.yaml"})
+	require.NoError(t, err)
+
+	mw := buildMiddleware(t, raw)
+	out, err := mw.Invoke(context.Background(), &middleware.Input{
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMProvider, Value: "openai"},
+			{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+			{Key: middleware.KeyLLMInputTokens, Value: "2000"},
+			{Key: middleware.KeyLLMOutputTokens, Value: "1000"},
+		},
+	})
+	require.NoError(t, err)
+
+	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
+	require.True(t, ok, "cost.usd_total must be emitted with custom pricing path")
+	assert.Equal(t, "0.015000", value, "2*0.0025 + 1*0.01 = 0.015 with 6-decimal format")
+}
+
+func TestInvoke_ComputesCostForKnownModel(t *testing.T) {
+	configureBuiltin(t)
+	mw := buildMiddleware(t, nil)
+
+	out, err := mw.Invoke(context.Background(), &middleware.Input{
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMProvider, Value: "anthropic"},
+			{Key: middleware.KeyLLMModel, Value: "claude-sonnet-4-5"},
+			{Key: middleware.KeyLLMInputTokens, Value: "1000"},
+			{Key: middleware.KeyLLMOutputTokens, Value: "1000"},
+		},
+	})
+	require.NoError(t, err)
+
+	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
+	require.True(t, ok, "cost.usd_total must be emitted")
+	assert.Equal(t, "0.018000", value, "0.003 + 0.015 = 0.018 with 6-decimal format")
+	_, skipped := metaValue(t, out.Metadata, middleware.KeyCostSkipped)
+	assert.False(t, skipped, "cost.skipped must not be set when cost is computed")
+}
+
+func TestInvoke_MissingProvider(t *testing.T) {
+	configureBuiltin(t)
+	mw := buildMiddleware(t, nil)
+
+	out, err := mw.Invoke(context.Background(), &middleware.Input{
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+			{Key: middleware.KeyLLMInputTokens, Value: "10"},
+			{Key: middleware.KeyLLMOutputTokens, Value: "10"},
+		},
+	})
+	require.NoError(t, err)
+	value, ok := metaValue(t, out.Metadata, middleware.KeyCostSkipped)
+	require.True(t, ok, "cost.skipped must be set when provider is missing")
+	assert.Equal(t, skipMissingProvider, value, "skip reason matches missing_provider")
+}
+
+func TestInvoke_MissingModel(t *testing.T) {
+	configureBuiltin(t)
+	mw := buildMiddleware(t, nil)
+
+	out, err := mw.Invoke(context.Background(), &middleware.Input{
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMProvider, Value: "openai"},
+			{Key: middleware.KeyLLMInputTokens, Value: "10"},
+			{Key: middleware.KeyLLMOutputTokens, Value: "10"},
+		},
+	})
+	require.NoError(t, err)
+	value, ok := metaValue(t, out.Metadata, middleware.KeyCostSkipped)
+	require.True(t, ok, "cost.skipped must be set when model is missing")
+	assert.Equal(t, skipMissingModel, value, "skip reason matches missing_model")
+}
+
+func TestInvoke_MissingTokens(t *testing.T) {
+	configureBuiltin(t)
+	mw := buildMiddleware(t, nil)
+
+	cases := []struct {
+		name string
+		md   []middleware.KV
+	}{
+		{
+			name: "input only",
+			md: []middleware.KV{
+				{Key: middleware.KeyLLMProvider, Value: "openai"},
+				{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+				{Key: middleware.KeyLLMInputTokens, Value: "10"},
+			},
+		},
+		{
+			name: "output only",
+			md: []middleware.KV{
+				{Key: middleware.KeyLLMProvider, Value: "openai"},
+				{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+				{Key: middleware.KeyLLMOutputTokens, Value: "10"},
+			},
+		},
+		{
+			name: "neither",
+			md: []middleware.KV{
+				{Key: middleware.KeyLLMProvider, Value: "openai"},
+				{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			out, err := mw.Invoke(context.Background(), &middleware.Input{Metadata: tc.md})
+			require.NoError(t, err)
+			value, ok := metaValue(t, out.Metadata, middleware.KeyCostSkipped)
+			require.True(t, ok, "cost.skipped must be set when token keys are missing")
+			assert.Equal(t, skipMissingTokens, value, "skip reason matches missing_tokens")
+		})
+	}
+}
+
+func TestInvoke_UnparseableTokens(t *testing.T) {
+	configureBuiltin(t)
+	mw := buildMiddleware(t, nil)
+
+	cases := []struct {
+		name string
+		in   string
+		out  string
+	}{
+		{name: "input non-numeric", in: "abc", out: "10"},
+		{name: "output non-numeric", in: "10", out: "xyz"},
+		{name: "both garbage", in: "??", out: "??"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			out, err := mw.Invoke(context.Background(), &middleware.Input{
+				Metadata: []middleware.KV{
+					{Key: middleware.KeyLLMProvider, Value: "openai"},
+					{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+					{Key: middleware.KeyLLMInputTokens, Value: tc.in},
+					{Key: middleware.KeyLLMOutputTokens, Value: tc.out},
+				},
+			})
+			require.NoError(t, err)
+			value, ok := metaValue(t, out.Metadata, middleware.KeyCostSkipped)
+			require.True(t, ok, "cost.skipped must be set on unparseable tokens")
+			assert.Equal(t, skipUnparseableTokens, value, "skip reason matches unparseable_tokens")
+		})
+	}
+}
+
+func TestInvoke_ZeroTokens(t *testing.T) {
+	configureBuiltin(t)
+	mw := buildMiddleware(t, nil)
+
+	out, err := mw.Invoke(context.Background(), &middleware.Input{
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMProvider, Value: "openai"},
+			{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+			{Key: middleware.KeyLLMInputTokens, Value: "0"},
+			{Key: middleware.KeyLLMOutputTokens, Value: "0"},
+		},
+	})
+	require.NoError(t, err)
+	value, ok := metaValue(t, out.Metadata, middleware.KeyCostSkipped)
+	require.True(t, ok, "cost.skipped must be set when both token counts are zero")
+	assert.Equal(t, skipZeroTokens, value, "skip reason matches zero_tokens")
+	_, hasCost := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
+	assert.False(t, hasCost, "cost.usd_total must not be emitted for zero tokens")
+}
+
+func TestInvoke_UnknownModel(t *testing.T) {
+	configureBuiltin(t)
+	mw := buildMiddleware(t, nil)
+
+	out, err := mw.Invoke(context.Background(), &middleware.Input{
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMProvider, Value: "openai"},
+			{Key: middleware.KeyLLMModel, Value: "fantasy-model-9000"},
+			{Key: middleware.KeyLLMInputTokens, Value: "10"},
+			{Key: middleware.KeyLLMOutputTokens, Value: "10"},
+		},
+	})
+	require.NoError(t, err)
+	value, ok := metaValue(t, out.Metadata, middleware.KeyCostSkipped)
+	require.True(t, ok, "cost.skipped must be set when pricing entry is absent")
+	assert.Equal(t, skipUnknownModel, value, "skip reason matches unknown_model")
+}
+
+func TestInvoke_NilInput(t *testing.T) {
+	configureBuiltin(t)
+	mw := buildMiddleware(t, nil)
+
+	out, err := mw.Invoke(context.Background(), nil)
+	require.NoError(t, err)
+	require.NotNil(t, out, "output must be returned even on nil input")
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "decision must be allow on nil input")
+	assert.Empty(t, out.Metadata, "no metadata must be emitted on nil input")
+}
+
+const fixturePricingWithCache = `openai:
+  gpt-4o:
+    input_per_1k: 0.0025
+    output_per_1k: 0.01
+    cached_input_per_1k: 0.00125
+anthropic:
+  claude-sonnet-4-5:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cache_read_per_1k: 0.0003
+    cache_creation_per_1k: 0.00375
+`
+
+// configureBuiltinWithCacheRates points the package-level
+// FactoryContext at a tmp directory containing pricing entries that
+// include the cache rate fields.
+func configureBuiltinWithCacheRates(t *testing.T) {
+	t.Helper()
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "pricing.yaml"), []byte(fixturePricingWithCache), 0o600), "write cache-aware pricing fixture")
+	builtin.Configure(context.Background(), dir, nil, nil, nil)
+}
+
+// TestInvoke_OpenAICachedSubsetDiscount proves the OpenAI shape end
+// to end through the middleware: cached_input_tokens is treated as a
+// SUBSET of input_tokens and discounted at the configured rate, not
+// added on top.
+func TestInvoke_OpenAICachedSubsetDiscount(t *testing.T) {
+	configureBuiltinWithCacheRates(t)
+	mw := buildMiddleware(t, nil)
+
+	out, err := mw.Invoke(context.Background(), &middleware.Input{
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMProvider, Value: "openai"},
+			{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+			{Key: middleware.KeyLLMInputTokens, Value: "1000"},
+			{Key: middleware.KeyLLMOutputTokens, Value: "500"},
+			{Key: middleware.KeyLLMCachedInputTokens, Value: "750"},
+		},
+	})
+	require.NoError(t, err)
+	require.Equal(t, middleware.DecisionAllow, out.Decision)
+
+	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
+	require.True(t, ok, "cached subset path must produce a cost — never a skip")
+	// 250 non-cached at 0.0025/1k + 750 cached at 0.00125/1k + 500 output at 0.01/1k.
+	assert.Equal(t, "0.006563", value,
+		"cached subset must be billed at the discount rate, non-cached at the full rate; never double-billed")
+}
+
+// TestInvoke_AnthropicCacheBucketsAdditive proves the Anthropic
+// shape: cache_read and cache_creation are additive to input_tokens
+// and each carries its own rate.
+func TestInvoke_AnthropicCacheBucketsAdditive(t *testing.T) {
+	configureBuiltinWithCacheRates(t)
+	mw := buildMiddleware(t, nil)
+
+	out, err := mw.Invoke(context.Background(), &middleware.Input{
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMProvider, Value: "anthropic"},
+			{Key: middleware.KeyLLMModel, Value: "claude-sonnet-4-5"},
+			{Key: middleware.KeyLLMInputTokens, Value: "256"},
+			{Key: middleware.KeyLLMOutputTokens, Value: "200"},
+			{Key: middleware.KeyLLMCachedInputTokens, Value: "768"},
+			{Key: middleware.KeyLLMCacheCreationTokens, Value: "512"},
+		},
+	})
+	require.NoError(t, err)
+	require.Equal(t, middleware.DecisionAllow, out.Decision)
+
+	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
+	require.True(t, ok)
+	// 256 input * 0.003 + 768 cache_read * 0.0003 + 512 cache_creation * 0.00375 + 200 output * 0.015
+	// = 0.000768 + 0.0002304 + 0.00192 + 0.003 = 0.0059184 → "0.005918" with 6-decimal format.
+	assert.Equal(t, "0.005918", value,
+		"each Anthropic input bucket must bill at its own rate — cache_read cheap, cache_creation expensive, regular input mid")
+}
+
+// TestInvoke_CachedTokensAbsentFallsBackToBaseFormula covers the
+// "operator hasn't opted in" path: with no cached metadata keys
+// emitted, the meter must produce exactly the same cost as before
+// the feature landed. Critical so operators with the new binary but
+// no YAML changes see no behavioural drift on OpenAI requests.
+func TestInvoke_CachedTokensAbsentFallsBackToBaseFormula(t *testing.T) {
+	configureBuiltinWithCacheRates(t)
+	mw := buildMiddleware(t, nil)
+
+	out, err := mw.Invoke(context.Background(), &middleware.Input{
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMProvider, Value: "openai"},
+			{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+			{Key: middleware.KeyLLMInputTokens, Value: "1000"},
+			{Key: middleware.KeyLLMOutputTokens, Value: "500"},
+			// No KeyLLMCachedInputTokens — the parser didn't see one.
+		},
+	})
+	require.NoError(t, err)
+	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
+	require.True(t, ok)
+	// 1000 input * 0.0025 + 500 output * 0.01 = 0.0025 + 0.005 = 0.0075
+	assert.Equal(t, "0.007500", value, "no cached metadata = same cost as before the feature landed")
+}
+
+// TestInvoke_UnparseableCachedTokensSkippedSilently proves the
+// optional-bucket contract: a malformed cached_input_tokens metadata
+// value falls back to 0 (= no cached count) and continues with the
+// regular formula. Cache buckets are a refinement, never a reason to
+// abort cost computation.
+func TestInvoke_UnparseableCachedTokensSkippedSilently(t *testing.T) {
+	configureBuiltinWithCacheRates(t)
+	mw := buildMiddleware(t, nil)
+
+	out, err := mw.Invoke(context.Background(), &middleware.Input{
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMProvider, Value: "openai"},
+			{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+			{Key: middleware.KeyLLMInputTokens, Value: "1000"},
+			{Key: middleware.KeyLLMOutputTokens, Value: "500"},
+			{Key: middleware.KeyLLMCachedInputTokens, Value: "not-a-number"},
+		},
+	})
+	require.NoError(t, err)
+	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
+	require.True(t, ok, "garbage cache metadata must NOT switch the response from a cost to a skip — fall back to 0 cached")
+	assert.Equal(t, "0.007500", value, "same as the no-cached-metadata path")
+}
+
+// TestMiddleware_CloseCancelsReloader proves Close stops the per-instance
+// pricing-reload goroutine: a chain rebuild retires the old instance and
+// calls Close, which must invoke the cancel func startReloader handed it so
+// the mtime-poll loop doesn't outlive the chain.
+func TestMiddleware_CloseCancelsReloader(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	m := newMiddleware(nil, cancel)
+
+	require.NoError(t, m.Close(), "Close must not error")
+	require.Error(t, ctx.Err(), "Close must cancel the reloader context so the poll goroutine exits")
+}
+
+// TestMiddleware_CloseNilSafe confirms Close is a no-op (no panic) for an
+// instance with no reloader and for a nil receiver.
+func TestMiddleware_CloseNilSafe(t *testing.T) {
+	require.NoError(t, newMiddleware(nil, nil).Close(), "no-reloader Close must be a no-op")
+	var m *Middleware
+	require.NoError(t, m.Close(), "nil-receiver Close must be safe")
+}
diff --git a/proxy/internal/middleware/builtin/llm_guardrail/factory.go b/proxy/internal/middleware/builtin/llm_guardrail/factory.go
new file mode 100644
index 000000000..6dd2a8e8d
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_guardrail/factory.go
@@ -0,0 +1,82 @@
+package llm_guardrail
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin"
+)
+
+// Config is the JSON-decoded shape accepted by the factory. The
+// runtime path consumes the normalised allowlist; raw config is not
+// retained beyond construction.
+type Config struct {
+	ModelAllowlist []string      `json:"model_allowlist"`
+	PromptCapture  PromptCapture `json:"prompt_capture"`
+}
+
+// PromptCapture toggles the optional prompt capture + redaction step
+// that emits llm.request_prompt onto the metadata bag.
+type PromptCapture struct {
+	Enabled   bool `json:"enabled"`
+	RedactPii bool `json:"redact_pii"`
+}
+
+// Factory builds a configured llm_guardrail middleware instance.
+type Factory struct{}
+
+// ID returns the registry identifier matching the middleware ID.
+func (Factory) ID() string { return ID }
+
+// New decodes the raw JSON config and returns a ready Middleware. An
+// empty / null / empty-object payload yields a zero-value Config.
+func (Factory) New(rawConfig []byte) (middleware.Middleware, error) {
+	cfg := Config{}
+	if len(rawConfig) > 0 && !isEmptyJSON(rawConfig) {
+		if err := json.Unmarshal(rawConfig, &cfg); err != nil {
+			return nil, fmt.Errorf("decode config: %w", err)
+		}
+	}
+	return New(cfg), nil
+}
+
+// isEmptyJSON reports whether the payload is whitespace, null, or an
+// empty object/array. The caller skips Unmarshal in that case so the
+// zero-value Config flows through unchanged.
+func isEmptyJSON(raw []byte) bool {
+	trimmed := strings.TrimSpace(string(raw))
+	switch trimmed {
+	case "", "null", "{}", "[]":
+		return true
+	}
+	return false
+}
+
+// normaliseConfig lowercases and trims allowlist entries so the runtime
+// match is case-insensitive. Empty entries are dropped.
+func normaliseConfig(cfg Config) Config {
+	if len(cfg.ModelAllowlist) == 0 {
+		return cfg
+	}
+	cleaned := make([]string, 0, len(cfg.ModelAllowlist))
+	for _, entry := range cfg.ModelAllowlist {
+		n := normaliseModel(entry)
+		if n == "" {
+			continue
+		}
+		cleaned = append(cleaned, n)
+	}
+	cfg.ModelAllowlist = cleaned
+	return cfg
+}
+
+// normaliseModel lowercases and trims a single model identifier.
+func normaliseModel(model string) string {
+	return strings.ToLower(strings.TrimSpace(model))
+}
+
+func init() {
+	builtin.Register(Factory{})
+}
diff --git a/proxy/internal/middleware/builtin/llm_guardrail/middleware.go b/proxy/internal/middleware/builtin/llm_guardrail/middleware.go
new file mode 100644
index 000000000..e6259f06f
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_guardrail/middleware.go
@@ -0,0 +1,183 @@
+// Package llm_guardrail implements the SlotOnRequest middleware that
+// enforces the per-target LLM guardrail policy: a model allowlist
+// check and an opt-in prompt-capture step that may run a PII redactor
+// before emitting the prompt into the metadata bag.
+//
+// The middleware runs after llm_request_parser, which is responsible
+// for extracting the model and raw prompt onto the metadata side
+// channel. llm_guardrail consumes those keys, decides allow/deny, and
+// emits its own decision metadata plus the optional redacted prompt.
+package llm_guardrail
+
+import (
+	"context"
+	"unicode/utf8"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+)
+
+// ID is the registry key for this middleware.
+const ID = "llm_guardrail"
+
+const (
+	version          = "1.0.0"
+	maxPromptBytes   = 3500
+	denyCodeModel    = "llm_policy.model_blocked"
+	denyReasonModel  = "model_blocked"
+	denyMessageModel = "model is not in the policy allowlist"
+)
+
+// Middleware enforces the model allowlist and optionally captures the
+// request prompt with PII redaction.
+type Middleware struct {
+	cfg Config
+}
+
+// New constructs a Middleware with the supplied configuration. Model
+// allowlist entries are normalised so the runtime check is
+// case-insensitive and trim-tolerant.
+func New(cfg Config) *Middleware {
+	return &Middleware{cfg: normaliseConfig(cfg)}
+}
+
+// ID returns the registry identifier.
+func (m *Middleware) ID() string { return ID }
+
+// Version returns the implementation version.
+func (m *Middleware) Version() string { return version }
+
+// Slot reports the chain slot the middleware lives in.
+func (m *Middleware) Slot() middleware.Slot { return middleware.SlotOnRequest }
+
+// AcceptedContentTypes lists the request body content types the
+// middleware needs. Guardrail consumes metadata produced upstream and
+// does not touch the body itself, but we keep application/json so the
+// body policy retains the parsed payload upstream when required.
+func (m *Middleware) AcceptedContentTypes() []string {
+	return []string{"application/json"}
+}
+
+// MetadataKeys is the closed set of metadata keys this middleware may
+// emit. The accumulator drops anything outside this allowlist.
+func (m *Middleware) MetadataKeys() []string {
+	return []string{
+		middleware.KeyLLMPolicyDecision,
+		middleware.KeyLLMPolicyReason,
+		middleware.KeyLLMRequestPrompt,
+	}
+}
+
+// MutationsSupported reports whether the middleware emits header / body
+// mutations. Guardrail never mutates the request.
+func (m *Middleware) MutationsSupported() bool { return false }
+
+// Invoke runs the policy. The model allowlist is the only deny path;
+// prompt capture only affects the metadata emitted alongside an allow.
+func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middleware.Output, error) {
+	model, modelPresent := lookupMetadata(in.Metadata, middleware.KeyLLMModel)
+
+	if denial := m.evaluateAllowlist(model, modelPresent); denial != nil {
+		return denial, nil
+	}
+
+	out := &middleware.Output{
+		Decision: middleware.DecisionAllow,
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMPolicyDecision, Value: "allow"},
+			{Key: middleware.KeyLLMPolicyReason, Value: ""},
+		},
+	}
+
+	if prompt, ok := m.capturePrompt(in.Metadata); ok {
+		out.Metadata = append(out.Metadata, middleware.KV{
+			Key:   middleware.KeyLLMRequestPrompt,
+			Value: prompt,
+		})
+	}
+
+	return out, nil
+}
+
+// Close releases resources owned by the middleware. Stateless, so this
+// is a no-op.
+func (m *Middleware) Close() error { return nil }
+
+// evaluateAllowlist returns a deny Output when the configured allowlist
+// rejects the model. A nil return means the request should proceed.
+func (m *Middleware) evaluateAllowlist(model string, modelPresent bool) *middleware.Output {
+	if len(m.cfg.ModelAllowlist) == 0 {
+		return nil
+	}
+	if !modelPresent {
+		return nil
+	}
+	if m.modelInAllowlist(model) {
+		return nil
+	}
+	return &middleware.Output{
+		Decision:   middleware.DecisionDeny,
+		DenyStatus: 403,
+		DenyReason: &middleware.DenyReason{
+			Code:    denyCodeModel,
+			Message: denyMessageModel,
+			Details: map[string]string{"model": model},
+		},
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMPolicyDecision, Value: "deny"},
+			{Key: middleware.KeyLLMPolicyReason, Value: denyReasonModel},
+		},
+	}
+}
+
+// modelInAllowlist reports whether the model matches any allowlist
+// entry under the case-insensitive, trim-tolerant comparison rule.
+func (m *Middleware) modelInAllowlist(model string) bool {
+	normalised := normaliseModel(model)
+	if normalised == "" {
+		return false
+	}
+	for _, allowed := range m.cfg.ModelAllowlist {
+		if allowed == normalised {
+			return true
+		}
+	}
+	return false
+}
+
+// capturePrompt returns the prompt to emit and whether it should be
+// emitted at all. The truncation guarantee is upheld here regardless of
+// whether redaction grew the string.
+func (m *Middleware) capturePrompt(meta []middleware.KV) (string, bool) {
+	if !m.cfg.PromptCapture.Enabled {
+		return "", false
+	}
+	raw, ok := lookupMetadata(meta, middleware.KeyLLMRequestPromptRaw)
+	if !ok {
+		return "", false
+	}
+	prompt := raw
+	if m.cfg.PromptCapture.RedactPii {
+		prompt = redactPII(prompt)
+	}
+	if len(prompt) > maxPromptBytes {
+		// Back off to a UTF-8 rune boundary so we never emit a string
+		// split mid-rune.
+		cut := maxPromptBytes
+		for cut > 0 && !utf8.RuneStart(prompt[cut]) {
+			cut--
+		}
+		prompt = prompt[:cut]
+	}
+	return prompt, true
+}
+
+// lookupMetadata finds the first KV with the given key. Returns the
+// value and true when present; the empty string and false otherwise.
+func lookupMetadata(meta []middleware.KV, key string) (string, bool) {
+	for _, kv := range meta {
+		if kv.Key == key {
+			return kv.Value, true
+		}
+	}
+	return "", false
+}
diff --git a/proxy/internal/middleware/builtin/llm_guardrail/middleware_test.go b/proxy/internal/middleware/builtin/llm_guardrail/middleware_test.go
new file mode 100644
index 000000000..865dc07af
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_guardrail/middleware_test.go
@@ -0,0 +1,219 @@
+package llm_guardrail
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+)
+
+func metaValue(t *testing.T, kvs []middleware.KV, key string) (string, bool) {
+	t.Helper()
+	for _, kv := range kvs {
+		if kv.Key == key {
+			return kv.Value, true
+		}
+	}
+	return "", false
+}
+
+func newInput(meta ...middleware.KV) *middleware.Input {
+	return &middleware.Input{Slot: middleware.SlotOnRequest, Metadata: meta}
+}
+
+func TestMiddlewareIdentity(t *testing.T) {
+	mw := New(Config{})
+	assert.Equal(t, ID, mw.ID(), "middleware ID must be llm_guardrail")
+	assert.Equal(t, "1.0.0", mw.Version(), "version must be 1.0.0")
+	assert.Equal(t, middleware.SlotOnRequest, mw.Slot(), "guardrail must run in SlotOnRequest")
+	assert.False(t, mw.MutationsSupported(), "guardrail must not mutate requests")
+	assert.Equal(t, []string{"application/json"}, mw.AcceptedContentTypes(), "guardrail accepts application/json bodies")
+	assert.Equal(t,
+		[]string{
+			middleware.KeyLLMPolicyDecision,
+			middleware.KeyLLMPolicyReason,
+			middleware.KeyLLMRequestPrompt,
+		},
+		mw.MetadataKeys(),
+		"metadata key allowlist must match the spec",
+	)
+	require.NoError(t, mw.Close())
+}
+
+func TestAllowlistEmptyAllowsAnyModel(t *testing.T) {
+	mw := New(Config{})
+	out, err := mw.Invoke(context.Background(), newInput(
+		middleware.KV{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+	))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "empty allowlist must allow any model")
+	v, ok := metaValue(t, out.Metadata, middleware.KeyLLMPolicyDecision)
+	require.True(t, ok, "decision metadata must be emitted")
+	assert.Equal(t, "allow", v, "decision must be allow")
+	r, ok := metaValue(t, out.Metadata, middleware.KeyLLMPolicyReason)
+	require.True(t, ok, "reason metadata must be emitted")
+	assert.Equal(t, "", r, "reason must be empty on allow")
+}
+
+func TestAllowlistMatchAllows(t *testing.T) {
+	mw := New(Config{ModelAllowlist: []string{"gpt-4o", "claude-opus-4"}})
+	out, err := mw.Invoke(context.Background(), newInput(
+		middleware.KV{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+	))
+	require.NoError(t, err)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "model in allowlist must be allowed")
+}
+
+func TestAllowlistMissDenies(t *testing.T) {
+	mw := New(Config{ModelAllowlist: []string{"gpt-4o"}})
+	out, err := mw.Invoke(context.Background(), newInput(
+		middleware.KV{Key: middleware.KeyLLMModel, Value: "claude-opus-4"},
+	))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionDeny, out.Decision, "non-allowlisted model must be denied")
+	assert.Equal(t, 403, out.DenyStatus, "deny status must be 403")
+	require.NotNil(t, out.DenyReason, "deny reason must be populated")
+	assert.Equal(t, "llm_policy.model_blocked", out.DenyReason.Code, "deny code must match spec")
+	assert.Equal(t, "model is not in the policy allowlist", out.DenyReason.Message, "deny message must match spec")
+	assert.Equal(t, "claude-opus-4", out.DenyReason.Details["model"], "deny details must include the offending model")
+
+	dec, _ := metaValue(t, out.Metadata, middleware.KeyLLMPolicyDecision)
+	assert.Equal(t, "deny", dec, "decision metadata must be deny")
+	reason, _ := metaValue(t, out.Metadata, middleware.KeyLLMPolicyReason)
+	assert.Equal(t, "model_blocked", reason, "reason metadata must be model_blocked")
+}
+
+func TestAllowlistCaseInsensitive(t *testing.T) {
+	mw := New(Config{ModelAllowlist: []string{"  GPT-4o  ", "Claude-OPUS-4"}})
+	cases := []string{"gpt-4o", "GPT-4O", "  claude-opus-4 "}
+	for _, model := range cases {
+		out, err := mw.Invoke(context.Background(), newInput(
+			middleware.KV{Key: middleware.KeyLLMModel, Value: model},
+		))
+		require.NoError(t, err)
+		assert.Equal(t, middleware.DecisionAllow, out.Decision, "case/whitespace variants must match: %q", model)
+	}
+}
+
+func TestAllowlistMissingModelKeyAllows(t *testing.T) {
+	mw := New(Config{ModelAllowlist: []string{"gpt-4o"}})
+	out, err := mw.Invoke(context.Background(), newInput())
+	require.NoError(t, err)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "missing model key must allow even with non-empty allowlist")
+	dec, _ := metaValue(t, out.Metadata, middleware.KeyLLMPolicyDecision)
+	assert.Equal(t, "allow", dec, "decision must be allow when model key is absent")
+}
+
+func TestPromptCaptureDisabledEmitsNoPrompt(t *testing.T) {
+	mw := New(Config{})
+	out, err := mw.Invoke(context.Background(), newInput(
+		middleware.KV{Key: middleware.KeyLLMRequestPromptRaw, Value: "hello world"},
+	))
+	require.NoError(t, err)
+	_, ok := metaValue(t, out.Metadata, middleware.KeyLLMRequestPrompt)
+	assert.False(t, ok, "prompt must not be emitted when capture is disabled")
+}
+
+func TestPromptCaptureNoRedactionEmitsRaw(t *testing.T) {
+	mw := New(Config{PromptCapture: PromptCapture{Enabled: true}})
+	raw := "hello world from user@example.com"
+	out, err := mw.Invoke(context.Background(), newInput(
+		middleware.KV{Key: middleware.KeyLLMRequestPromptRaw, Value: raw},
+	))
+	require.NoError(t, err)
+	prompt, ok := metaValue(t, out.Metadata, middleware.KeyLLMRequestPrompt)
+	require.True(t, ok, "prompt must be emitted when capture is enabled")
+	assert.Equal(t, raw, prompt, "prompt must pass through unchanged when redaction is off")
+}
+
+func TestPromptCaptureWithRedactionRedacts(t *testing.T) {
+	mw := New(Config{PromptCapture: PromptCapture{Enabled: true, RedactPii: true}})
+	raw := "contact me at user@example.com or +14155551234"
+	out, err := mw.Invoke(context.Background(), newInput(
+		middleware.KV{Key: middleware.KeyLLMRequestPromptRaw, Value: raw},
+	))
+	require.NoError(t, err)
+	prompt, ok := metaValue(t, out.Metadata, middleware.KeyLLMRequestPrompt)
+	require.True(t, ok, "prompt must be emitted when capture is enabled")
+	assert.Contains(t, prompt, "[REDACTED:email]", "email must be redacted")
+	assert.Contains(t, prompt, "[REDACTED:phone]", "phone must be redacted")
+	assert.NotContains(t, prompt, "user@example.com", "raw email must not leak")
+}
+
+func TestPromptCaptureRedactionTruncatesIfGrows(t *testing.T) {
+	mw := New(Config{PromptCapture: PromptCapture{Enabled: true, RedactPii: true}})
+	body := strings.Repeat("a", maxPromptBytes-10) + " user@example.com"
+	out, err := mw.Invoke(context.Background(), newInput(
+		middleware.KV{Key: middleware.KeyLLMRequestPromptRaw, Value: body},
+	))
+	require.NoError(t, err)
+	prompt, ok := metaValue(t, out.Metadata, middleware.KeyLLMRequestPrompt)
+	require.True(t, ok, "prompt must be emitted when capture is enabled")
+	assert.LessOrEqual(t, len(prompt), maxPromptBytes, "prompt must be truncated to maxPromptBytes")
+}
+
+func TestPromptCaptureMissingRawNoEmit(t *testing.T) {
+	mw := New(Config{PromptCapture: PromptCapture{Enabled: true, RedactPii: true}})
+	out, err := mw.Invoke(context.Background(), newInput())
+	require.NoError(t, err)
+	_, ok := metaValue(t, out.Metadata, middleware.KeyLLMRequestPrompt)
+	assert.False(t, ok, "prompt must not be emitted when raw key is missing")
+}
+
+func TestFactoryAcceptsZeroConfigs(t *testing.T) {
+	cases := map[string][]byte{
+		"nil":         nil,
+		"empty":       []byte(""),
+		"whitespace":  []byte("   \n  "),
+		"null":        []byte("null"),
+		"emptyObject": []byte("{}"),
+	}
+	f := Factory{}
+	for name, raw := range cases {
+		mw, err := f.New(raw)
+		require.NoError(t, err, "case %s must yield a zero-value config", name)
+		require.NotNil(t, mw)
+		assert.Equal(t, ID, mw.ID(), "case %s must build a guardrail middleware", name)
+	}
+}
+
+func TestFactoryDecodesValidConfig(t *testing.T) {
+	cfg := Config{
+		ModelAllowlist: []string{"gpt-4o"},
+		PromptCapture:  PromptCapture{Enabled: true, RedactPii: true},
+	}
+	raw, err := json.Marshal(cfg)
+	require.NoError(t, err, "marshalling test config must succeed")
+	mw, err := Factory{}.New(raw)
+	require.NoError(t, err)
+	require.NotNil(t, mw)
+}
+
+func TestFactoryRejectsMalformedJSON(t *testing.T) {
+	mw, err := Factory{}.New([]byte("{not-json"))
+	assert.Error(t, err, "malformed JSON must surface as a factory error")
+	assert.Nil(t, mw, "no middleware must be returned on malformed config")
+}
+
+func TestFactoryNormalisesAllowlist(t *testing.T) {
+	raw := []byte(`{"model_allowlist":["  GPT-4o  ","",""," Claude-3 "]}`)
+	mw, err := Factory{}.New(raw)
+	require.NoError(t, err)
+	out, err := mw.Invoke(context.Background(), newInput(
+		middleware.KV{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+	))
+	require.NoError(t, err)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "factory must lowercase + trim allowlist entries")
+	out2, err := mw.Invoke(context.Background(), newInput(
+		middleware.KV{Key: middleware.KeyLLMModel, Value: "claude-3"},
+	))
+	require.NoError(t, err)
+	assert.Equal(t, middleware.DecisionAllow, out2.Decision, "trimmed entry must still match")
+}
diff --git a/proxy/internal/middleware/builtin/llm_guardrail/redact.go b/proxy/internal/middleware/builtin/llm_guardrail/redact.go
new file mode 100644
index 000000000..c6cb270df
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_guardrail/redact.go
@@ -0,0 +1,75 @@
+package llm_guardrail
+
+import (
+	"regexp"
+	"strings"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+)
+
+// PII redactor scope: redact prompt content BEFORE it lands in the metadata
+// bag. The bearer-with-keyword pass runs first so the keyword is preserved.
+// We then chain the package-level middleware.Scan to pick up PEM, JWT, AWS
+// access keys, generic bearer tokens (40+ chars), and Luhn-validated credit
+// cards — keeping prompt redaction in sync with metadata-value scanning. Email,
+// SSN (dashed form), phone (E.164 + NA), and IPv4 are prompt-shaped patterns
+// the metadata scanner intentionally leaves alone.
+var (
+	emailRegex = regexp.MustCompile(`[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}`)
+	ssnRegex   = regexp.MustCompile(`\b\d{3}-\d{2}-\d{4}\b`)
+	phoneE164  = regexp.MustCompile(`\+\d{8,15}\b`)
+	// phoneNARgx accepts the 3-3-4 North-American shape with any of the common
+	// separators (space, dot, dash, slash) or none at all between the area code
+	// and the body. The optional `\(?...\)?` wraps the area code; the separator
+	// classes use `*` (not `?`) so multi-char separators ("(202) " followed by
+	// space-and-something) and zero-separator runs ("2025550134") both match.
+	// False-positive tradeoff: 10 consecutive digits in a prompt will be
+	// treated as a phone number. For PII redaction that is the correct way to
+	// err — under-redaction leaks; over-redaction is annoying.
+	phoneNARgx  = regexp.MustCompile(`\(?\b\d{3}\)?[\s.\-/]*\d{3}[\s.\-/]*\d{4}\b`)
+	bearerRegex = regexp.MustCompile(`(?i)\b(bearer|token|api[_-]?key|authorization)([\s:=]+)(\S{20,})`)
+	ipv4Regex   = regexp.MustCompile(`\b(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\b`)
+)
+
+// redactPII is the package-private alias kept for internal callers; new code
+// outside the guardrail middleware should call RedactPII.
+func redactPII(value string) string { return RedactPII(value) }
+
+// RedactPII replaces high-signal PII patterns in value with
+// `[REDACTED:<kind>]`. Non-matching input is returned unchanged. Exported so
+// the request / response parsers can reuse the same coverage on raw prompts
+// and completions when the account's redact_pii toggle is on.
+func RedactPII(value string) string {
+	if value == "" {
+		return value
+	}
+	result := value
+	// Keyword-preserving bearer first so the "bearer "/"token=" prefix survives
+	// before the generic scanner gets at the same content.
+	result = bearerRegex.ReplaceAllStringFunc(result, redactBearer)
+	// Structured secrets shared with metadata-value scanning: PEM, JWT, AWS
+	// keys, generic bearer (40+), and Luhn-validated credit cards.
+	result = middleware.Scan(result)
+	// Prompt-shaped PII the metadata scanner doesn't cover.
+	result = emailRegex.ReplaceAllString(result, "[REDACTED:email]")
+	result = ssnRegex.ReplaceAllString(result, "[REDACTED:ssn]")
+	result = phoneE164.ReplaceAllString(result, "[REDACTED:phone]")
+	result = phoneNARgx.ReplaceAllString(result, "[REDACTED:phone]")
+	result = ipv4Regex.ReplaceAllString(result, "[REDACTED:ip]")
+	return result
+}
+
+// redactBearer keeps the leading keyword and its separator, replacing
+// only the secret payload so the surrounding context is preserved.
+func redactBearer(match string) string {
+	sub := bearerRegex.FindStringSubmatch(match)
+	if len(sub) < 4 {
+		return "[REDACTED:bearer]"
+	}
+	var b strings.Builder
+	b.Grow(len(sub[1]) + len(sub[2]) + len("[REDACTED:bearer]"))
+	b.WriteString(sub[1])
+	b.WriteString(sub[2])
+	b.WriteString("[REDACTED:bearer]")
+	return b.String()
+}
diff --git a/proxy/internal/middleware/builtin/llm_guardrail/redact_test.go b/proxy/internal/middleware/builtin/llm_guardrail/redact_test.go
new file mode 100644
index 000000000..ef17f1d0a
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_guardrail/redact_test.go
@@ -0,0 +1,217 @@
+package llm_guardrail
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestRedactPIIEmptyInput(t *testing.T) {
+	assert.Equal(t, "", redactPII(""), "empty input must round-trip unchanged")
+}
+
+func TestRedactPIIPlainTextUntouched(t *testing.T) {
+	in := "the quick brown fox jumps over the lazy dog"
+	assert.Equal(t, in, redactPII(in), "non-PII text must pass through unchanged")
+}
+
+func TestRedactPIIEmail(t *testing.T) {
+	cases := []string{
+		"contact user@example.com today",
+		"first.last+tag@sub.example.co",
+		"USER_42@EXAMPLE.COM",
+	}
+	for _, in := range cases {
+		out := redactPII(in)
+		assert.Contains(t, out, "[REDACTED:email]", "email must be redacted in %q", in)
+		assert.NotContains(t, strings.ToLower(out), "@example", "raw email host must not survive in %q", in)
+	}
+}
+
+func TestRedactPIISSN(t *testing.T) {
+	in := "ssn 123-45-6789 should be hidden"
+	out := redactPII(in)
+	assert.Contains(t, out, "[REDACTED:ssn]", "SSN must be redacted")
+	assert.NotContains(t, out, "123-45-6789", "raw SSN must not survive")
+}
+
+func TestRedactPIIPhoneE164(t *testing.T) {
+	in := "call me at +14155551234 anytime"
+	out := redactPII(in)
+	assert.Contains(t, out, "[REDACTED:phone]", "E.164 phone must be redacted")
+	assert.NotContains(t, out, "+14155551234", "raw E.164 phone must not survive")
+}
+
+func TestRedactPIIPhoneNorthAmerican(t *testing.T) {
+	cases := []string{
+		"call (415) 555-1234 now",
+		"call 415-555-1234 now",
+		"call 415.555.1234 now",
+		"call 415 555 1234 now",
+	}
+	for _, in := range cases {
+		out := redactPII(in)
+		assert.Contains(t, out, "[REDACTED:phone]", "NA phone must be redacted in %q", in)
+		assert.NotContains(t, out, "555-1234", "raw NA phone must not survive in %q", in)
+	}
+}
+
+func TestRedactPIIBearerKeepsKeyword(t *testing.T) {
+	cases := []struct {
+		in      string
+		keyword string
+	}{
+		{"Authorization: Bearer abcdefghijklmnopqrstuvwxyz0123", "Bearer"},
+		{"token = abcdefghijklmnopqrstuvwxyz", "token"},
+		{"api_key=abcdefghijklmnopqrstuvwxyz0123", "api_key"},
+		{"API-KEY: abcdefghijklmnopqrstuvwxyz0123", "API-KEY"},
+		{"authorization: abcdefghijklmnopqrstuvwxyz0123", "authorization"},
+	}
+	for _, tc := range cases {
+		out := redactPII(tc.in)
+		assert.Contains(t, out, "[REDACTED:bearer]", "bearer-style secret must be redacted in %q", tc.in)
+		assert.Contains(t, out, tc.keyword, "leading keyword %q must be preserved in %q", tc.keyword, tc.in)
+		assert.NotContains(t, out, "abcdefghijklmnopqrstuvwxyz0123", "raw bearer payload must not survive in %q", tc.in)
+	}
+}
+
+func TestRedactPIIBearerShortValueUntouched(t *testing.T) {
+	in := "token=short"
+	out := redactPII(in)
+	assert.Equal(t, in, out, "short bearer-style values must not be redacted")
+}
+
+func TestRedactPIICombined(t *testing.T) {
+	in := "email user@example.com phone +14155551234 ssn 123-45-6789 token abcdefghijklmnopqrstuvwxyz0123"
+	out := redactPII(in)
+	assert.Contains(t, out, "[REDACTED:email]", "email must be redacted in combined input")
+	assert.Contains(t, out, "[REDACTED:phone]", "phone must be redacted in combined input")
+	assert.Contains(t, out, "[REDACTED:ssn]", "SSN must be redacted in combined input")
+	assert.Contains(t, out, "[REDACTED:bearer]", "bearer must be redacted in combined input")
+	assert.NotContains(t, out, "user@example.com", "raw email must not survive combined input")
+	assert.NotContains(t, out, "+14155551234", "raw phone must not survive combined input")
+	assert.NotContains(t, out, "123-45-6789", "raw SSN must not survive combined input")
+}
+
+func TestRedactPIICreditCard(t *testing.T) {
+	// 4242424242424242 is a well-known Stripe test number (Visa, Luhn-valid).
+	cases := []string{
+		"please charge 4242424242424242 now",
+		"card: 4242-4242-4242-4242",
+		"4242 4242 4242 4242 expires 12/30",
+	}
+	for _, in := range cases {
+		out := redactPII(in)
+		assert.Contains(t, out, "[REDACTED:cc]", "Luhn-valid credit card must be redacted in %q", in)
+		assert.NotContains(t, out, "4242424242424242", "raw card digits must not survive in %q", in)
+		assert.NotContains(t, out, "4242-4242-4242-4242", "raw dashed card must not survive in %q", in)
+	}
+}
+
+func TestRedactPIIIPv4(t *testing.T) {
+	cases := []string{
+		"connect to 10.0.42.7 over the tunnel",
+		"server 192.168.1.100 down",
+		"public address 203.0.113.42 was hit",
+	}
+	for _, in := range cases {
+		out := redactPII(in)
+		assert.Contains(t, out, "[REDACTED:ip]", "IPv4 must be redacted in %q", in)
+	}
+}
+
+func TestRedactPIIJWT(t *testing.T) {
+	// No "token "/"bearer " prefix here, so the bearer-with-keyword pass leaves
+	// it alone and the JWT pattern from middleware.Scan must catch it.
+	in := "session eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyXzQyIn0.signaturepart expires soon"
+	out := redactPII(in)
+	assert.Contains(t, out, "[REDACTED:jwt]", "JWT must be redacted when no bearer keyword precedes it")
+	assert.NotContains(t, out, "eyJhbGciOiJIUzI1NiJ9", "raw JWT header must not survive")
+}
+
+func TestRedactPIIAWSAccessKey(t *testing.T) {
+	in := "the key AKIAIOSFODNN7EXAMPLE belongs to test user"
+	out := redactPII(in)
+	assert.Contains(t, out, "[REDACTED:aws_key]", "AWS access key must be redacted")
+	assert.NotContains(t, out, "AKIAIOSFODNN7EXAMPLE", "raw AWS key must not survive")
+}
+
+func TestRedactPIIPlainNumbersUntouched(t *testing.T) {
+	// 1234567890123 is 13 digits but fails Luhn; must NOT trip the CC redactor.
+	// We use a 13-digit value (the CC-candidate range starts at 13) so the only
+	// risk is the CC pattern firing. Phone redaction is 10-digit by design and
+	// would catch 1234567890123 as a phone — that's expected and not what this
+	// test guards against.
+	in := "order number 1234567890123 is queued"
+	out := redactPII(in)
+	assert.NotContains(t, out, "[REDACTED:cc]", "non-Luhn digit sequences must not be redacted as credit cards")
+}
+
+// piiFixture mirrors the user-supplied test fixture: each record carries one
+// email, one SSN, and one phone in a representative format. The test asserts
+// that EVERY raw token disappears after redaction and the right [REDACTED:*]
+// markers show up. Names are kept in the input and must survive — names are
+// not a pattern the redactor tries to catch.
+type piiFixture struct {
+	name  string // person name (must survive redaction)
+	email string
+	ssn   string
+	phone string
+}
+
+var fixtureRecords = []piiFixture{
+	{"Alice Johnson", "alice.johnson@example.com", "123-45-6789", "(202) 555-0147"},
+	{"Brian Smith", "brian.smith@example.org", "987-65-4321", "202-555-0163"},
+	{"Carla Nguyen", "c.nguyen@test.local", "111-22-3333", "+1-202-555-0188"},
+	{"David Martinez", "david.martinez@example.com", "222-33-4444", "202.555.0199"},
+	{"Evelyn Parker", "evelyn.parker@example.org", "333-44-5555", "1-202-555-0112"},
+	{"Frank O'Connor", "frank.oconnor@test.local", "444-55-6666", "2025550134"},
+	{"Grace Lee", "grace.lee@example.com", "555-66-7777", "(202)555-0156"},
+	{"Hassan Ali", "hassan.ali@example.org", "666-77-8888", "+1 (202) 555-0175"},
+	{"Isabella Rossi", "i.rossi@test.local", "777-88-9999", "202 555 0121"},
+	{"Jamal Thompson", "jamal.thompson@example.com", "888-99-0001", "202/555/0108"},
+}
+
+// TestRedactPII_FixtureRecord drives every record through redactPII and
+// asserts the email, SSN, and phone are all redacted, the name survives, and
+// the appropriate REDACTED markers are present. This is the spec the redactor
+// must meet for the kind of prompts operators throw at it.
+func TestRedactPII_FixtureRecord(t *testing.T) {
+	for _, rec := range fixtureRecords {
+		t.Run(rec.name, func(t *testing.T) {
+			in := "Name: " + rec.name + "\n   Email: " + rec.email + "\n   SSN: " + rec.ssn + "\n   Phone: " + rec.phone
+			out := redactPII(in)
+
+			assert.Contains(t, out, rec.name, "name must survive (not a PII pattern the redactor catches)")
+			assert.Contains(t, out, "[REDACTED:email]", "email marker must appear for %q", rec.email)
+			assert.Contains(t, out, "[REDACTED:ssn]", "ssn marker must appear for %q", rec.ssn)
+			assert.Contains(t, out, "[REDACTED:phone]", "phone marker must appear for %q", rec.phone)
+
+			assert.NotContains(t, out, rec.email, "raw email must not survive: %q", rec.email)
+			assert.NotContains(t, out, rec.ssn, "raw SSN must not survive: %q", rec.ssn)
+			// Phone: assert the local digits (last 7) are gone. Country-code
+			// remnants like "+1 " or "1-" may remain in front of the redaction
+			// because the E.164 pattern needs digits-only after '+' — that's
+			// acceptable, the personally-identifying portion is removed.
+			localDigits := lastSevenDigits(rec.phone)
+			assert.NotContains(t, out, localDigits, "raw phone local digits %q must not survive in redacted output of %q", localDigits, rec.phone)
+		})
+	}
+}
+
+// lastSevenDigits returns the last 7 digits of a phone number, ignoring
+// formatting. It's the unique "subscriber" portion that absolutely must be
+// scrubbed regardless of which prefix the redactor leaves behind.
+func lastSevenDigits(phone string) string {
+	digits := make([]byte, 0, len(phone))
+	for i := 0; i < len(phone); i++ {
+		if phone[i] >= '0' && phone[i] <= '9' {
+			digits = append(digits, phone[i])
+		}
+	}
+	if len(digits) <= 7 {
+		return string(digits)
+	}
+	return string(digits[len(digits)-7:])
+}
diff --git a/proxy/internal/middleware/builtin/llm_identity_inject/factory.go b/proxy/internal/middleware/builtin/llm_identity_inject/factory.go
new file mode 100644
index 000000000..8594c392d
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_identity_inject/factory.go
@@ -0,0 +1,108 @@
+package llm_identity_inject
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin"
+)
+
+// ProviderInjection describes one resolved provider's injection rule.
+// Identity stamping uses one of HeaderPair / JSONMetadata; ExtraHeaders
+// is independent — each entry is a static (operator-configured) header
+// stamped on every matching request with anti-spoof. A rule with no
+// shape AND no extras is dropped at New() time as a no-op.
+type ProviderInjection struct {
+	// ProviderID is the resolved provider id — matches the value
+	// llm_router stamps under KeyLLMResolvedProviderID.
+	ProviderID string `json:"provider_id"`
+	// HeaderPair is the LiteLLM-style wire convention: separate
+	// headers for end-user id and tags CSV.
+	HeaderPair *HeaderPairRule `json:"header_pair,omitempty"`
+	// JSONMetadata is the Portkey-style wire convention: a single
+	// header carrying a JSON object keyed by reserved field names.
+	JSONMetadata *JSONMetadataRule `json:"json_metadata,omitempty"`
+	// ExtraHeaders is an operator-configured list of static headers
+	// (e.g. "x-portkey-config: pc-...") that the middleware stamps
+	// on every matching request. The synth pre-resolves the values
+	// from the provider record's ExtraValues map; the middleware
+	// just emits them. Each name is also added to HeadersRemove for
+	// anti-spoof so a client can't smuggle their own value.
+	ExtraHeaders []ExtraHeaderKV `json:"extra_headers,omitempty"`
+}
+
+// ExtraHeaderKV is one static header entry the middleware stamps as-is.
+type ExtraHeaderKV struct {
+	Name  string `json:"name"`
+	Value string `json:"value"`
+}
+
+// HeaderPairRule emits identity through dedicated per-dimension
+// headers. The two *InBody flags layer body-level identity on top: when
+// TagsInBody is set the middleware also writes the tag list into the
+// request body's metadata.tags array (required for LiteLLM tag-budget
+// enforcement, which only inspects the body); when EndUserIDInBody is
+// set the display identity is also written into the body's top-level
+// "user" field (the OpenAI-standard end-user identifier — defense-in-
+// depth and anti-spoof on top of the header path).
+type HeaderPairRule struct {
+	EndUserIDHeader string `json:"end_user_id_header,omitempty"`
+	TagsHeader      string `json:"tags_header,omitempty"`
+	TagsInBody      bool   `json:"tags_in_body,omitempty"`
+	EndUserIDInBody bool   `json:"end_user_id_in_body,omitempty"`
+}
+
+// JSONMetadataRule emits identity through a single JSON-object header.
+// Empty UserKey/GroupsKey skip that dimension at emit time. When
+// MaxValueLength > 0 each emitted JSON value is truncated to that many
+// bytes — Portkey enforces 128 chars per value.
+type JSONMetadataRule struct {
+	Header         string `json:"header"`
+	UserKey        string `json:"user_key,omitempty"`
+	GroupsKey      string `json:"groups_key,omitempty"`
+	MaxValueLength int    `json:"max_value_length,omitempty"`
+}
+
+// Config is the on-wire configuration accepted by the factory. An
+// empty Providers slice yields a no-op middleware (every resolved
+// provider passes through unchanged).
+type Config struct {
+	Providers []ProviderInjection `json:"providers"`
+}
+
+// Factory builds llm_identity_inject instances from raw config bytes.
+type Factory struct{}
+
+// ID returns the registry identifier.
+func (Factory) ID() string { return ID }
+
+// New constructs a middleware instance. Empty, null, and {} configs
+// yield a no-op middleware. Non-empty payloads must parse cleanly so
+// misconfigurations surface at chain build time.
+func (Factory) New(rawConfig []byte) (middleware.Middleware, error) {
+	cfg := Config{}
+	if !isEmptyJSON(rawConfig) {
+		if err := json.Unmarshal(rawConfig, &cfg); err != nil {
+			return nil, fmt.Errorf("decode config: %w", err)
+		}
+	}
+	return New(cfg), nil
+}
+
+// isEmptyJSON reports whether the payload is whitespace, null, or an
+// empty object/array.
+func isEmptyJSON(raw []byte) bool {
+	trimmed := strings.TrimSpace(string(bytes.TrimSpace(raw)))
+	switch trimmed {
+	case "", "null", "{}", "[]":
+		return true
+	}
+	return false
+}
+
+func init() {
+	builtin.Register(Factory{})
+}
diff --git a/proxy/internal/middleware/builtin/llm_identity_inject/middleware.go b/proxy/internal/middleware/builtin/llm_identity_inject/middleware.go
new file mode 100644
index 000000000..ee3f1c20d
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_identity_inject/middleware.go
@@ -0,0 +1,439 @@
+// Package llm_identity_inject implements the SlotOnRequest middleware
+// that stamps the caller's NetBird identity onto upstream LLM-gateway
+// requests. It runs after llm_router (which resolves the provider) and
+// looks up the resolved provider id against a per-account injection
+// table built by the synthesiser from the catalog's IdentityInjection
+// metadata.
+//
+// Two wire shapes are supported, dispatched per-rule:
+//
+//   - HeaderPair (LiteLLM-style): separate end-user-id and tags
+//     headers; tags emitted as a CSV value.
+//   - JSONMetadata (Portkey-style): one header carrying a JSON
+//     object with reserved keys for user / groups; per-value byte
+//     length capped when the rule sets MaxValueLength.
+//
+// In both cases, identity comes from Input.UserEmail (peer-attached
+// user's email or peer.Name fallback) and groups come from the
+// authorising-groups intersection llm_router emitted (with
+// id→display-name translation via Input.UserGroups / UserGroupNames
+// positional pairing). HeadersRemove runs before HeadersAdd in the
+// framework, so a client can never spoof identity by stamping these
+// headers themselves.
+package llm_identity_inject
+
+import (
+	"context"
+	"encoding/json"
+	"sort"
+	"strings"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+)
+
+// ID is the registry identifier for this middleware.
+const ID = "llm_identity_inject"
+
+// Version is reported via Middleware.Version().
+const Version = "1.0.0"
+
+// Middleware stamps NetBird identity onto upstream requests for the
+// configured set of resolved providers.
+type Middleware struct {
+	cfg  Config
+	byID map[string]ProviderInjection
+}
+
+// New constructs a Middleware from the supplied configuration. A nil
+// or empty Providers slice yields a no-op middleware.
+func New(cfg Config) *Middleware {
+	byID := make(map[string]ProviderInjection, len(cfg.Providers))
+	for _, p := range cfg.Providers {
+		if p.ProviderID == "" || !injectionEmitsAnything(p) {
+			continue
+		}
+		byID[p.ProviderID] = p
+	}
+	return &Middleware{cfg: cfg, byID: byID}
+}
+
+// injectionEmitsAnything reports whether a provider injection rule would
+// stamp anything at runtime. Rules that set both identity shapes are a
+// configuration error (we refuse to guess which wins), and rules that
+// resolve to no headers are dropped to keep the runtime check tight.
+// Non-empty extras alone keep a rule alive even when neither identity
+// shape is set.
+func injectionEmitsAnything(p ProviderInjection) bool {
+	hasExtras := false
+	for _, e := range p.ExtraHeaders {
+		if e.Name != "" && e.Value != "" {
+			hasExtras = true
+			break
+		}
+	}
+	switch {
+	case p.HeaderPair != nil && p.JSONMetadata != nil:
+		return false
+	case p.HeaderPair != nil:
+		return p.HeaderPair.EndUserIDHeader != "" || p.HeaderPair.TagsHeader != "" ||
+			p.HeaderPair.TagsInBody || p.HeaderPair.EndUserIDInBody || hasExtras
+	case p.JSONMetadata != nil:
+		if p.JSONMetadata.Header == "" {
+			return false
+		}
+		return p.JSONMetadata.UserKey != "" || p.JSONMetadata.GroupsKey != "" || hasExtras
+	default:
+		return hasExtras
+	}
+}
+
+// ID returns the registry identifier.
+func (m *Middleware) ID() string { return ID }
+
+// Version returns the implementation version.
+func (m *Middleware) Version() string { return Version }
+
+// Slot reports the chain slot the middleware lives in.
+func (m *Middleware) Slot() middleware.Slot { return middleware.SlotOnRequest }
+
+// AcceptedContentTypes returns nil — this middleware reads only
+// metadata and identity fields on the Input envelope.
+func (m *Middleware) AcceptedContentTypes() []string { return nil }
+
+// MetadataKeys is empty: the middleware emits no metadata. Identity
+// stamping is a header-only operation.
+func (m *Middleware) MetadataKeys() []string { return nil }
+
+// MutationsSupported reports that the middleware emits header
+// mutations on the Output envelope.
+func (m *Middleware) MutationsSupported() bool { return true }
+
+// Close releases resources owned by the middleware. Stateless, so
+// this is a no-op.
+func (m *Middleware) Close() error { return nil }
+
+// Invoke stamps identity headers when the resolved provider has an
+// injection rule. Always Allow.
+func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middleware.Output, error) {
+	out := &middleware.Output{Decision: middleware.DecisionAllow}
+	if len(m.byID) == 0 || in == nil {
+		return out, nil
+	}
+	resolved, ok := lookupMetadata(in.Metadata, middleware.KeyLLMResolvedProviderID)
+	if !ok || resolved == "" {
+		return out, nil
+	}
+	rule, ok := m.byID[resolved]
+	if !ok {
+		return out, nil
+	}
+
+	var mutations *middleware.Mutations
+	switch {
+	case rule.HeaderPair != nil:
+		mutations = applyHeaderPair(rule.HeaderPair, in)
+	case rule.JSONMetadata != nil:
+		mutations = applyJSONMetadata(rule.JSONMetadata, in)
+	}
+
+	// ExtraHeaders are independent of the identity shape. Stamp each
+	// non-empty entry with anti-spoof: Remove first (frame strips it
+	// before our Add lands) so a client can't smuggle a value, then
+	// Add our trusted one.
+	if len(rule.ExtraHeaders) > 0 {
+		if mutations == nil {
+			mutations = &middleware.Mutations{}
+		}
+		for _, h := range rule.ExtraHeaders {
+			if h.Name == "" || h.Value == "" {
+				continue
+			}
+			mutations.HeadersRemove = append(mutations.HeadersRemove, h.Name)
+			mutations.HeadersAdd = append(mutations.HeadersAdd, middleware.KV{
+				Key:   h.Name,
+				Value: h.Value,
+			})
+		}
+	}
+
+	if mutations == nil || (len(mutations.HeadersAdd) == 0 && len(mutations.HeadersRemove) == 0 && len(mutations.BodyReplace) == 0) {
+		return out, nil
+	}
+	out.Mutations = mutations
+	return out, nil
+}
+
+// applyHeaderPair builds the LiteLLM-style mutations: separate per-
+// dimension headers, with anti-spoof Removes paired with trusted Adds.
+func applyHeaderPair(rule *HeaderPairRule, in *middleware.Input) *middleware.Mutations {
+	mutations := &middleware.Mutations{}
+
+	if rule.EndUserIDHeader != "" {
+		mutations.HeadersRemove = append(mutations.HeadersRemove, rule.EndUserIDHeader)
+		// Prefer the email when the auth path carried it: gateways
+		// like LiteLLM key per-user budgets and dashboards on a
+		// human-readable identifier; the user_id is an opaque
+		// management-server primary key. Fall back to user_id when
+		// no email is available (non-OIDC schemes, legacy JWTs).
+		if identity := identityFor(in); identity != "" {
+			mutations.HeadersAdd = append(mutations.HeadersAdd, middleware.KV{
+				Key:   rule.EndUserIDHeader,
+				Value: identity,
+			})
+		}
+	}
+
+	if rule.TagsHeader != "" {
+		mutations.HeadersRemove = append(mutations.HeadersRemove, rule.TagsHeader)
+		if csv := authorisingTagsCSV(in); csv != "" {
+			mutations.HeadersAdd = append(mutations.HeadersAdd, middleware.KV{
+				Key:   rule.TagsHeader,
+				Value: csv,
+			})
+		}
+	}
+
+	if rule.TagsInBody || rule.EndUserIDInBody {
+		// Body-level identity unlocks gateway behaviour the header
+		// path can't reach (LiteLLM's _tag_max_budget_check only
+		// inspects the body; OpenAI direct only reads the body's
+		// "user" field for attribution). The header path stays
+		// intact, so we still get attribution + per-end-user budget
+		// gating when body inject can't run (truncated body,
+		// non-JSON, hostile metadata shape).
+		var bodyTags []string
+		if rule.TagsInBody {
+			bodyTags = authorisingTagsSlice(in)
+		}
+		var bodyUser string
+		if rule.EndUserIDInBody {
+			bodyUser = identityFor(in)
+		}
+		if newBody, ok := injectIntoBody(in, bodyTags, bodyUser); ok {
+			mutations.BodyReplace = newBody
+		}
+	}
+
+	return mutations
+}
+
+// injectIntoBody parses the request body and writes the supplied
+// identity dimensions into it. Tags land at metadata.tags (creating
+// the metadata object when absent); the user identity lands at the
+// top-level "user" field (OpenAI-standard end-user identifier).
+// Returns the re-marshaled body and ok=true when at least one field
+// was written. Returns ok=false (no mutation) when:
+//
+//   - both inputs are empty (nothing to write);
+//   - the body is empty or truncated (we don't have the full document
+//     to safely round-trip);
+//   - the body isn't a JSON object (skip silently — this middleware
+//     only knows how to inject into OpenAI-compatible JSON payloads).
+//
+// A non-object existing `metadata` field skips the tag write but
+// still allows the user write to land — we don't clobber the client's
+// non-object metadata, but the orthogonal user field is fair game.
+// The header path emission still runs in skip cases, so spend tracking
+// + header-resolved end-user budgets continue to work without body-
+// level enforcement.
+func injectIntoBody(in *middleware.Input, tags []string, userID string) ([]byte, bool) {
+	wantTags := len(tags) > 0
+	wantUser := userID != ""
+	if !wantTags && !wantUser {
+		return nil, false
+	}
+	if in == nil || len(in.Body) == 0 || in.BodyTruncated {
+		return nil, false
+	}
+	var doc map[string]any
+	if err := json.Unmarshal(in.Body, &doc); err != nil {
+		return nil, false
+	}
+	injected := false
+	if wantTags {
+		var meta map[string]any
+		if existing, ok := doc["metadata"]; ok {
+			if typed, isObject := existing.(map[string]any); isObject {
+				meta = typed
+			}
+			// non-object metadata: leave it; tags go unwritten so we
+			// don't clobber the client's value. Header fallback covers
+			// spend tracking.
+		} else {
+			meta = map[string]any{}
+		}
+		if meta != nil {
+			meta["tags"] = tags
+			doc["metadata"] = meta
+			injected = true
+		}
+	}
+	if wantUser {
+		// Anti-spoof: overwrite any client-supplied "user" so the
+		// gateway only sees our trusted identity.
+		doc["user"] = userID
+		injected = true
+	}
+	if !injected {
+		return nil, false
+	}
+	out, err := json.Marshal(doc)
+	if err != nil {
+		return nil, false
+	}
+	return out, true
+}
+
+// applyJSONMetadata builds the Portkey-style mutations: a single header
+// carrying a JSON object keyed by the rule's reserved field names. Per-
+// value byte length is capped at MaxValueLength when set (Portkey
+// enforces 128 chars).
+func applyJSONMetadata(rule *JSONMetadataRule, in *middleware.Input) *middleware.Mutations {
+	mutations := &middleware.Mutations{}
+	mutations.HeadersRemove = append(mutations.HeadersRemove, rule.Header)
+
+	payload := map[string]string{}
+	if rule.UserKey != "" {
+		if identity := identityFor(in); identity != "" {
+			payload[rule.UserKey] = truncate(identity, rule.MaxValueLength)
+		}
+	}
+	if rule.GroupsKey != "" {
+		if csv := authorisingTagsCSV(in); csv != "" {
+			payload[rule.GroupsKey] = truncate(csv, rule.MaxValueLength)
+		}
+	}
+	if len(payload) == 0 {
+		return mutations
+	}
+	raw, err := json.Marshal(payload)
+	if err != nil {
+		return mutations
+	}
+	mutations.HeadersAdd = append(mutations.HeadersAdd, middleware.KV{
+		Key:   rule.Header,
+		Value: string(raw),
+	})
+	return mutations
+}
+
+// identityFor returns the caller's display identity. UserEmail wins
+// (carries the user email when peer-attached, peer.Name otherwise);
+// UserID falls in only as a defensive last resort.
+func identityFor(in *middleware.Input) string {
+	if in.UserEmail != "" {
+		return in.UserEmail
+	}
+	return in.UserID
+}
+
+// authorisingTagsSlice returns the sorted, deduplicated slice of group
+// display names the request was authorised under. Prefers the per-
+// request authorising groups emitted by llm_router (intersection of the
+// caller's UserGroups with the resolved route's AllowedGroupIDs) so the
+// tags carry only the groups that actually authorise THIS request, not
+// every group the peer happens to be in. Falls back to the full
+// UserGroups when the router metadata key is absent.
+func authorisingTagsSlice(in *middleware.Input) []string {
+	ids := tagsIDsFromAuthorising(in.Metadata)
+	if len(ids) == 0 {
+		ids = in.UserGroups
+	}
+	return tagsNamedSlice(ids, in.UserGroups, in.UserGroupNames)
+}
+
+// authorisingTagsCSV is a convenience wrapper that joins
+// authorisingTagsSlice with commas for HeaderPair-style emission.
+func authorisingTagsCSV(in *middleware.Input) string {
+	return strings.Join(authorisingTagsSlice(in), ",")
+}
+
+// truncate caps s to maxBytes bytes when maxBytes > 0. No-op when
+// maxBytes <= 0 or s already fits. Truncation is byte-wise — sufficient
+// for Portkey's 128-char ASCII limit. UTF-8 sequences could in theory
+// be split, but the gateway treats the value as opaque bytes.
+func truncate(s string, maxBytes int) string {
+	if maxBytes <= 0 || len(s) <= maxBytes {
+		return s
+	}
+	return s[:maxBytes]
+}
+
+// tagsIDsFromAuthorising reads llm_router's authorising-groups metadata
+// (a CSV of group ids) and returns the parsed slice. Returns nil when
+// the key is absent or empty so the caller can fall back to the full
+// UserGroups.
+func tagsIDsFromAuthorising(meta []middleware.KV) []string {
+	v, ok := lookupMetadata(meta, middleware.KeyLLMAuthorisingGroups)
+	if !ok {
+		return nil
+	}
+	v = strings.TrimSpace(v)
+	if v == "" {
+		return nil
+	}
+	parts := strings.Split(v, ",")
+	out := make([]string, 0, len(parts))
+	for _, p := range parts {
+		p = strings.TrimSpace(p)
+		if p != "" {
+			out = append(out, p)
+		}
+	}
+	if len(out) == 0 {
+		return nil
+	}
+	return out
+}
+
+// tagsNamedSlice returns the sorted, deduplicated list of group display
+// names. ids carries the canonical group identifiers to emit;
+// userGroups + userGroupNames provide the positional id→name
+// translation table from the Input envelope. When a name is missing
+// for a given id (slice shorter than userGroups, or id absent from the
+// table), the id is used verbatim so the tag still attributes
+// correctly. Sorted so the same caller produces the same header value
+// across requests (helps gateway-side cache hits and log correlation).
+func tagsNamedSlice(ids, userGroups, userGroupNames []string) []string {
+	if len(ids) == 0 {
+		return nil
+	}
+	idToName := make(map[string]string, len(userGroups))
+	for i, id := range userGroups {
+		if i < len(userGroupNames) {
+			idToName[id] = userGroupNames[i]
+		}
+	}
+	seen := make(map[string]struct{}, len(ids))
+	out := make([]string, 0, len(ids))
+	for _, id := range ids {
+		id = strings.TrimSpace(id)
+		if id == "" {
+			continue
+		}
+		tag := idToName[id]
+		if tag == "" {
+			tag = id
+		}
+		if _, dup := seen[tag]; dup {
+			continue
+		}
+		seen[tag] = struct{}{}
+		out = append(out, tag)
+	}
+	if len(out) == 0 {
+		return nil
+	}
+	sort.Strings(out)
+	return out
+}
+
+// lookupMetadata returns the value for key plus a presence flag.
+func lookupMetadata(meta []middleware.KV, key string) (string, bool) {
+	for _, kv := range meta {
+		if kv.Key == key {
+			return kv.Value, true
+		}
+	}
+	return "", false
+}
diff --git a/proxy/internal/middleware/builtin/llm_identity_inject/middleware_test.go b/proxy/internal/middleware/builtin/llm_identity_inject/middleware_test.go
new file mode 100644
index 000000000..aab1271d8
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_identity_inject/middleware_test.go
@@ -0,0 +1,666 @@
+package llm_identity_inject
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+)
+
+const (
+	litellmProvider = "ainp_litellm-test"
+	portkeyProvider = "ainp_portkey-test"
+)
+
+func newInput(resolvedProvider, userID string, groups []string) *middleware.Input {
+	return &middleware.Input{
+		Slot:       middleware.SlotOnRequest,
+		AccountID:  "acct-test",
+		UserID:     userID,
+		UserGroups: groups,
+		SourceIP:   "100.64.0.5",
+		RequestID:  "req-1",
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMResolvedProviderID, Value: resolvedProvider},
+		},
+	}
+}
+
+func liteLLMRule() ProviderInjection {
+	return ProviderInjection{
+		ProviderID: litellmProvider,
+		HeaderPair: &HeaderPairRule{
+			EndUserIDHeader: "x-litellm-end-user-id",
+			TagsHeader:      "x-litellm-tags",
+		},
+	}
+}
+
+func TestMiddlewareIdentity(t *testing.T) {
+	mw := New(Config{})
+	assert.Equal(t, ID, mw.ID())
+	assert.Equal(t, Version, mw.Version())
+	assert.Equal(t, middleware.SlotOnRequest, mw.Slot())
+	assert.True(t, mw.MutationsSupported())
+	assert.Empty(t, mw.MetadataKeys(), "middleware emits no metadata")
+	assert.Nil(t, mw.AcceptedContentTypes())
+	require.NoError(t, mw.Close())
+}
+
+func TestInject_MatchedProvider_StampsHeaders(t *testing.T) {
+	mw := New(Config{Providers: []ProviderInjection{liteLLMRule()}})
+	in := newInput(litellmProvider, "alice", []string{"grp-eng", "grp-it"})
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision)
+	require.NotNil(t, out.Mutations)
+
+	// Strips the same headers we're about to add (anti-spoof).
+	assert.ElementsMatch(t,
+		[]string{"x-litellm-end-user-id", "x-litellm-tags"},
+		out.Mutations.HeadersRemove,
+		"every injected header must also appear in HeadersRemove so client-supplied values are wiped before our trusted values land")
+
+	added := map[string]string{}
+	for _, kv := range out.Mutations.HeadersAdd {
+		added[kv.Key] = kv.Value
+	}
+	assert.Equal(t, "alice", added["x-litellm-end-user-id"])
+	assert.Equal(t, "grp-eng,grp-it", added["x-litellm-tags"], "tags CSV must be sorted")
+}
+
+func TestInject_UnmatchedProvider_NoMutations(t *testing.T) {
+	mw := New(Config{Providers: []ProviderInjection{liteLLMRule()}})
+	in := newInput("ainp_some-other-provider", "alice", []string{"grp-eng"})
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision)
+	assert.Nil(t, out.Mutations, "non-LiteLLM resolved provider must produce no mutations")
+}
+
+func TestInject_NoResolvedProvider_NoMutations(t *testing.T) {
+	mw := New(Config{Providers: []ProviderInjection{liteLLMRule()}})
+	in := &middleware.Input{Slot: middleware.SlotOnRequest, UserID: "alice"}
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Nil(t, out.Mutations,
+		"missing llm.resolved_provider_id metadata means the router didn't run; never stamp identity blindly")
+}
+
+func TestInject_PartialRule_StampsOnlyConfiguredHeaders(t *testing.T) {
+	mw := New(Config{Providers: []ProviderInjection{{
+		ProviderID: litellmProvider,
+		HeaderPair: &HeaderPairRule{
+			EndUserIDHeader: "x-litellm-end-user-id",
+			// TagsHeader intentionally empty.
+		},
+	}}})
+	in := newInput(litellmProvider, "alice", []string{"grp-eng"})
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	require.NotNil(t, out.Mutations)
+
+	assert.Equal(t, []string{"x-litellm-end-user-id"}, out.Mutations.HeadersRemove,
+		"only configured header should be stripped")
+	require.Len(t, out.Mutations.HeadersAdd, 1)
+	assert.Equal(t, "x-litellm-end-user-id", out.Mutations.HeadersAdd[0].Key)
+	assert.Equal(t, "alice", out.Mutations.HeadersAdd[0].Value)
+}
+
+func TestInject_EmptyIdentity_StripsButDoesNotAdd(t *testing.T) {
+	// Caller has no UserID and no groups. We still strip the headers
+	// (so the client can't inject identity) but we don't add empty
+	// values that would mislead the gateway.
+	mw := New(Config{Providers: []ProviderInjection{liteLLMRule()}})
+	in := newInput(litellmProvider, "", nil)
+	in.AccountID = ""
+	in.SourceIP = ""
+	in.RequestID = ""
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	require.NotNil(t, out.Mutations)
+
+	assert.ElementsMatch(t,
+		[]string{"x-litellm-end-user-id", "x-litellm-tags"},
+		out.Mutations.HeadersRemove,
+		"identity headers must be stripped even when we don't have values to add — anti-spoof")
+	assert.Empty(t, out.Mutations.HeadersAdd,
+		"no NetBird identity available; do not stamp empty / misleading values")
+}
+
+func TestInject_TagsCSV_DedupesAndSorts(t *testing.T) {
+	mw := New(Config{Providers: []ProviderInjection{liteLLMRule()}})
+	in := newInput(litellmProvider, "alice", []string{"grp-zzz", "grp-aaa", "grp-zzz", "", " "})
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	require.NotNil(t, out.Mutations)
+
+	for _, kv := range out.Mutations.HeadersAdd {
+		if kv.Key == "x-litellm-tags" {
+			assert.Equal(t, "grp-aaa,grp-zzz", kv.Value,
+				"tags CSV must dedupe, drop empty, and sort")
+			return
+		}
+	}
+	t.Fatalf("expected x-litellm-tags in HeadersAdd; got %v", out.Mutations.HeadersAdd)
+}
+
+func TestFactory_RejectsBadJSON(t *testing.T) {
+	_, err := Factory{}.New([]byte("{not json"))
+	require.Error(t, err)
+}
+
+func TestFactory_AcceptsEmptyShapes(t *testing.T) {
+	for _, raw := range [][]byte{nil, []byte(""), []byte(" "), []byte("null"), []byte("{}"), []byte("[]")} {
+		mw, err := Factory{}.New(raw)
+		require.NoError(t, err)
+		require.NotNil(t, mw)
+
+		out, ierr := mw.Invoke(context.Background(),
+			newInput(litellmProvider, "alice", []string{"grp-eng"}))
+		require.NoError(t, ierr)
+		assert.Equal(t, middleware.DecisionAllow, out.Decision)
+		assert.Nil(t, out.Mutations,
+			"empty config means no providers to inject for; every resolved provider passes through")
+	}
+}
+
+func TestFactory_DropsInjectionRuleWithEmptyHeaders(t *testing.T) {
+	mw, err := Factory{}.New([]byte(`{"providers":[{"provider_id":"x"}]}`))
+	require.NoError(t, err)
+	out, ierr := mw.Invoke(context.Background(), newInput("x", "alice", []string{"grp-eng"}))
+	require.NoError(t, ierr)
+	assert.Nil(t, out.Mutations,
+		"a rule with no header names is functionally a no-op and must be dropped at New() time")
+}
+
+// TestInject_TagsFromAuthorisingMetadata pins that when llm_router has
+// emitted llm.authorising_groups, the inject middleware uses THAT
+// (the per-request authorising intersection) for the tags header — not
+// the full UserGroups, which can include groups unrelated to this
+// request's routing.
+func TestInject_TagsFromAuthorisingMetadata(t *testing.T) {
+	mw := New(Config{Providers: []ProviderInjection{liteLLMRule()}})
+	in := newInput(litellmProvider, "alice", []string{"grp-eng", "grp-it", "grp-oncall"})
+	in.Metadata = append(in.Metadata, middleware.KV{
+		Key:   middleware.KeyLLMAuthorisingGroups,
+		Value: "grp-eng",
+	})
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	require.NotNil(t, out.Mutations)
+
+	for _, kv := range out.Mutations.HeadersAdd {
+		if kv.Key == "x-litellm-tags" {
+			assert.Equal(t, "grp-eng", kv.Value,
+				"tags must come from llm.authorising_groups, not the full UserGroups; unrelated peer groups must not leak")
+			return
+		}
+	}
+	t.Fatalf("expected x-litellm-tags in HeadersAdd; got %v", out.Mutations.HeadersAdd)
+}
+
+// TestInject_TagsFallsBackToUserGroups pins the defensive fallback: if
+// llm_router didn't emit authorising-groups metadata (chain
+// misconfiguration) the middleware uses UserGroups so identity is
+// still stamped, just over-broad.
+func TestInject_TagsFallsBackToUserGroups(t *testing.T) {
+	mw := New(Config{Providers: []ProviderInjection{liteLLMRule()}})
+	in := newInput(litellmProvider, "alice", []string{"grp-eng", "grp-it"})
+	// No llm.authorising_groups metadata.
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	require.NotNil(t, out.Mutations)
+
+	for _, kv := range out.Mutations.HeadersAdd {
+		if kv.Key == "x-litellm-tags" {
+			assert.Equal(t, "grp-eng,grp-it", kv.Value,
+				"absent metadata must fall back to the full UserGroups CSV")
+			return
+		}
+	}
+	t.Fatalf("expected x-litellm-tags in HeadersAdd; got %v", out.Mutations.HeadersAdd)
+}
+
+// portkeyRule is the JSONMetadata-shape analogue of liteLLMRule: a
+// single x-portkey-metadata header carrying _user and groups, with
+// Portkey's 128-byte per-value cap.
+func portkeyRule() ProviderInjection {
+	return ProviderInjection{
+		ProviderID: portkeyProvider,
+		JSONMetadata: &JSONMetadataRule{
+			Header:         "x-portkey-metadata",
+			UserKey:        "_user",
+			GroupsKey:      "groups",
+			MaxValueLength: 128,
+		},
+	}
+}
+
+// TestInject_JSONMetadata_StampsHeader pins the Portkey-style emission:
+// one header carrying a JSON envelope with reserved keys for user
+// identity and groups CSV.
+func TestInject_JSONMetadata_StampsHeader(t *testing.T) {
+	mw := New(Config{Providers: []ProviderInjection{portkeyRule()}})
+	in := newInput(portkeyProvider, "alice", []string{"grp-eng", "grp-it"})
+	in.UserEmail = "alice@example.com"
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	require.NotNil(t, out.Mutations)
+
+	assert.Equal(t, []string{"x-portkey-metadata"}, out.Mutations.HeadersRemove,
+		"the JSON header must be stripped before we add our trusted value")
+	require.Len(t, out.Mutations.HeadersAdd, 1)
+	added := out.Mutations.HeadersAdd[0]
+	assert.Equal(t, "x-portkey-metadata", added.Key)
+
+	var payload map[string]string
+	require.NoError(t, json.Unmarshal([]byte(added.Value), &payload))
+	assert.Equal(t, "alice@example.com", payload["_user"],
+		"_user reserved key carries the display identity (UserEmail)")
+	assert.Equal(t, "grp-eng,grp-it", payload["groups"],
+		"groups key carries the sorted CSV of group display names")
+}
+
+// TestInject_JSONMetadata_TruncatesValues pins the per-value byte cap.
+// Portkey rejects metadata values longer than 128 chars; oversized
+// values are truncated rather than failing the request.
+func TestInject_JSONMetadata_TruncatesValues(t *testing.T) {
+	mw := New(Config{Providers: []ProviderInjection{portkeyRule()}})
+	in := newInput(portkeyProvider, "alice", []string{"grp-eng"})
+	in.UserEmail = strings.Repeat("a", 200) + "@example.com"
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out.Mutations)
+	require.Len(t, out.Mutations.HeadersAdd, 1)
+
+	var payload map[string]string
+	require.NoError(t, json.Unmarshal([]byte(out.Mutations.HeadersAdd[0].Value), &payload))
+	assert.Len(t, payload["_user"], 128,
+		"per-value byte length must be capped at MaxValueLength")
+}
+
+// TestInject_JSONMetadata_EmptyIdentity_StripsButDoesNotAdd verifies the
+// anti-spoof Remove still fires when there's nothing to stamp.
+func TestInject_JSONMetadata_EmptyIdentity_StripsButDoesNotAdd(t *testing.T) {
+	mw := New(Config{Providers: []ProviderInjection{portkeyRule()}})
+	in := newInput(portkeyProvider, "", nil)
+	in.UserEmail = ""
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out.Mutations)
+
+	assert.Equal(t, []string{"x-portkey-metadata"}, out.Mutations.HeadersRemove,
+		"strip even with no payload — client can't smuggle identity headers")
+	assert.Empty(t, out.Mutations.HeadersAdd,
+		"no NetBird identity available; do not stamp empty / misleading values")
+}
+
+// TestFactory_RejectsRuleWithBothShapes pins the configuration-error
+// guard: a rule that sets both HeaderPair and JSONMetadata is dropped
+// at New() time rather than guessing which wins.
+func TestFactory_RejectsRuleWithBothShapes(t *testing.T) {
+	mw := New(Config{Providers: []ProviderInjection{{
+		ProviderID: litellmProvider,
+		HeaderPair: &HeaderPairRule{
+			EndUserIDHeader: "x-litellm-end-user-id",
+		},
+		JSONMetadata: &JSONMetadataRule{
+			Header:  "x-portkey-metadata",
+			UserKey: "_user",
+		},
+	}}})
+	in := newInput(litellmProvider, "alice", []string{"grp-eng"})
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	assert.Nil(t, out.Mutations,
+		"a rule that sets both shapes is ambiguous and must be dropped at New() time")
+}
+
+// liteLLMRuleWithBody is the LiteLLM-style rule with body tag injection
+// enabled (matches the catalog default).
+func liteLLMRuleWithBody() ProviderInjection {
+	return ProviderInjection{
+		ProviderID: litellmProvider,
+		HeaderPair: &HeaderPairRule{
+			EndUserIDHeader: "x-litellm-end-user-id",
+			TagsHeader:      "x-litellm-tags",
+			TagsInBody:      true,
+		},
+	}
+}
+
+// TestInject_BodyTags_AddsMetadataTags pins the body-inject path that
+// LiteLLM's _tag_max_budget_check requires. With TagsInBody set, the
+// middleware writes the authorising-groups slice into
+// request.metadata.tags (in addition to the header).
+func TestInject_BodyTags_AddsMetadataTags(t *testing.T) {
+	mw := New(Config{Providers: []ProviderInjection{liteLLMRuleWithBody()}})
+	in := newInput(litellmProvider, "alice", []string{"grp-eng", "grp-sre"})
+	in.Body = []byte(`{"model":"gpt-4o-mini","messages":[]}`)
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out.Mutations)
+	require.NotEmpty(t, out.Mutations.BodyReplace, "body must be rewritten when TagsInBody is set")
+
+	var doc map[string]any
+	require.NoError(t, json.Unmarshal(out.Mutations.BodyReplace, &doc))
+	meta, ok := doc["metadata"].(map[string]any)
+	require.True(t, ok, "metadata must be an object")
+	tags, ok := meta["tags"].([]any)
+	require.True(t, ok, "metadata.tags must be a JSON array")
+	got := make([]string, 0, len(tags))
+	for _, t := range tags {
+		s, _ := t.(string)
+		got = append(got, s)
+	}
+	assert.Equal(t, []string{"grp-eng", "grp-sre"}, got,
+		"metadata.tags must carry the sorted authorising-groups slice")
+	assert.Equal(t, "gpt-4o-mini", doc["model"],
+		"the rest of the body must be preserved verbatim")
+}
+
+// TestInject_BodyTags_PreservesExistingMetadata pins that an existing
+// metadata object on the request is merged with our tags rather than
+// clobbered — clients sometimes set metadata fields the proxy
+// shouldn't blow away (jobID, taskName, etc.).
+func TestInject_BodyTags_PreservesExistingMetadata(t *testing.T) {
+	mw := New(Config{Providers: []ProviderInjection{liteLLMRuleWithBody()}})
+	in := newInput(litellmProvider, "alice", []string{"grp-eng"})
+	in.Body = []byte(`{"model":"gpt-4o-mini","metadata":{"jobID":"j-42","tags":["should-be-replaced"]}}`)
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotEmpty(t, out.Mutations.BodyReplace)
+
+	var doc map[string]any
+	require.NoError(t, json.Unmarshal(out.Mutations.BodyReplace, &doc))
+	meta := doc["metadata"].(map[string]any)
+	assert.Equal(t, "j-42", meta["jobID"],
+		"client-supplied metadata fields outside `tags` must survive")
+	tags := meta["tags"].([]any)
+	require.Len(t, tags, 1)
+	assert.Equal(t, "grp-eng", tags[0],
+		"our tags overwrite any client-supplied metadata.tags so spoofing is impossible")
+}
+
+// TestInject_BodyTags_SkipsHostileMetadataShape pins the defensive
+// refusal: when the request body has a non-object metadata field
+// (string/number/array), we don't inject — header path still emits.
+func TestInject_BodyTags_SkipsHostileMetadataShape(t *testing.T) {
+	mw := New(Config{Providers: []ProviderInjection{liteLLMRuleWithBody()}})
+	in := newInput(litellmProvider, "alice", []string{"grp-eng"})
+	in.Body = []byte(`{"model":"gpt-4o-mini","metadata":"not-an-object"}`)
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out.Mutations)
+	assert.Empty(t, out.Mutations.BodyReplace,
+		"non-object metadata must skip body inject (don't clobber)")
+
+	for _, kv := range out.Mutations.HeadersAdd {
+		if kv.Key == "x-litellm-tags" {
+			assert.Equal(t, "grp-eng", kv.Value,
+				"header path must still emit so spend tracking keeps working")
+			return
+		}
+	}
+	t.Fatalf("expected x-litellm-tags header even when body inject was skipped")
+}
+
+// TestInject_BodyTags_SkipsTruncatedBody pins that we don't blindly
+// rewrite a body we don't have in full. The header path still runs.
+func TestInject_BodyTags_SkipsTruncatedBody(t *testing.T) {
+	mw := New(Config{Providers: []ProviderInjection{liteLLMRuleWithBody()}})
+	in := newInput(litellmProvider, "alice", []string{"grp-eng"})
+	in.Body = []byte(`{"model":"gpt-4o-mini","messages":[]}`)
+	in.BodyTruncated = true
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	assert.Empty(t, out.Mutations.BodyReplace,
+		"truncated body must skip body inject — re-marshaling would corrupt the request")
+}
+
+// TestInject_BodyTags_SkipsNonJSONBody pins graceful behavior when the
+// body isn't JSON (e.g. a streaming binary or form upload sneaking
+// through the LLM chain). Header path still runs.
+func TestInject_BodyTags_SkipsNonJSONBody(t *testing.T) {
+	mw := New(Config{Providers: []ProviderInjection{liteLLMRuleWithBody()}})
+	in := newInput(litellmProvider, "alice", []string{"grp-eng"})
+	in.Body = []byte(`not even close to json`)
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	assert.Empty(t, out.Mutations.BodyReplace,
+		"non-JSON body must skip body inject silently")
+}
+
+// liteLLMRuleFull mirrors the catalog default: header path + body
+// metadata.tags (groups) + body user (end-user id).
+func liteLLMRuleFull() ProviderInjection {
+	return ProviderInjection{
+		ProviderID: litellmProvider,
+		HeaderPair: &HeaderPairRule{
+			EndUserIDHeader: "x-litellm-end-user-id",
+			TagsHeader:      "x-litellm-tags",
+			TagsInBody:      true,
+			EndUserIDInBody: true,
+		},
+	}
+}
+
+// TestInject_BodyUser_WritesTopLevelUser pins the EndUserIDInBody path
+// alone: body's top-level "user" field carries the display identity.
+// Tags-in-body is OFF here so we isolate the user write.
+func TestInject_BodyUser_WritesTopLevelUser(t *testing.T) {
+	mw := New(Config{Providers: []ProviderInjection{{
+		ProviderID: litellmProvider,
+		HeaderPair: &HeaderPairRule{
+			EndUserIDHeader: "x-litellm-end-user-id",
+			EndUserIDInBody: true,
+		},
+	}}})
+	in := newInput(litellmProvider, "alice", nil)
+	in.UserEmail = "alice@example.com"
+	in.Body = []byte(`{"model":"gpt-4o-mini","messages":[]}`)
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out.Mutations)
+	require.NotEmpty(t, out.Mutations.BodyReplace)
+
+	var doc map[string]any
+	require.NoError(t, json.Unmarshal(out.Mutations.BodyReplace, &doc))
+	assert.Equal(t, "alice@example.com", doc["user"],
+		"body's top-level user field must carry the display identity")
+	_, hasMeta := doc["metadata"]
+	assert.False(t, hasMeta, "TagsInBody is off; metadata must not be added")
+}
+
+// TestInject_BodyUser_OverwritesClientSupplied pins anti-spoof: a
+// client-supplied "user" in the body is overwritten so the gateway
+// only sees our trusted identity.
+func TestInject_BodyUser_OverwritesClientSupplied(t *testing.T) {
+	mw := New(Config{Providers: []ProviderInjection{liteLLMRuleFull()}})
+	in := newInput(litellmProvider, "alice", []string{"grp-eng"})
+	in.UserEmail = "alice@example.com"
+	in.Body = []byte(`{"model":"gpt-4o-mini","user":"ceo@company.com"}`)
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotEmpty(t, out.Mutations.BodyReplace)
+
+	var doc map[string]any
+	require.NoError(t, json.Unmarshal(out.Mutations.BodyReplace, &doc))
+	assert.Equal(t, "alice@example.com", doc["user"],
+		"client-supplied user must be overwritten with the trusted identity")
+}
+
+// TestInject_BodyCombined_TagsAndUser pins that with both flags on,
+// the body carries both metadata.tags AND top-level user, and the
+// header path still emits.
+func TestInject_BodyCombined_TagsAndUser(t *testing.T) {
+	mw := New(Config{Providers: []ProviderInjection{liteLLMRuleFull()}})
+	in := newInput(litellmProvider, "alice", []string{"grp-eng", "grp-sre"})
+	in.UserEmail = "alice@example.com"
+	in.Body = []byte(`{"model":"gpt-4o-mini"}`)
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotEmpty(t, out.Mutations.BodyReplace)
+
+	var doc map[string]any
+	require.NoError(t, json.Unmarshal(out.Mutations.BodyReplace, &doc))
+	assert.Equal(t, "alice@example.com", doc["user"])
+	meta := doc["metadata"].(map[string]any)
+	tags := meta["tags"].([]any)
+	require.Len(t, tags, 2)
+	assert.Equal(t, "grp-eng", tags[0])
+	assert.Equal(t, "grp-sre", tags[1])
+
+	// Header path still emits — header end-user-id is the primary
+	// path for LiteLLM's resolver, body is defense-in-depth.
+	added := map[string]string{}
+	for _, kv := range out.Mutations.HeadersAdd {
+		added[kv.Key] = kv.Value
+	}
+	assert.Equal(t, "alice@example.com", added["x-litellm-end-user-id"])
+	assert.Equal(t, "grp-eng,grp-sre", added["x-litellm-tags"])
+}
+
+// TestInject_BodyCombined_HostileMetadataKeepsUser pins the partial-
+// success path: a hostile (non-object) metadata field skips the tag
+// write but still allows the orthogonal user write to land.
+func TestInject_BodyCombined_HostileMetadataKeepsUser(t *testing.T) {
+	mw := New(Config{Providers: []ProviderInjection{liteLLMRuleFull()}})
+	in := newInput(litellmProvider, "alice", []string{"grp-eng"})
+	in.UserEmail = "alice@example.com"
+	in.Body = []byte(`{"model":"gpt-4o-mini","metadata":"not-an-object"}`)
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotEmpty(t, out.Mutations.BodyReplace,
+		"user write must still go through even when metadata is hostile")
+
+	var doc map[string]any
+	require.NoError(t, json.Unmarshal(out.Mutations.BodyReplace, &doc))
+	assert.Equal(t, "alice@example.com", doc["user"])
+	assert.Equal(t, "not-an-object", doc["metadata"],
+		"hostile metadata must be left untouched, not clobbered")
+}
+
+// TestInject_ExtraHeaders_Stamped pins the extras path: with a
+// per-provider ExtraHeader configured (e.g. Portkey config id), the
+// middleware stamps it on every matching request and adds the same
+// name to HeadersRemove for anti-spoof.
+func TestInject_ExtraHeaders_Stamped(t *testing.T) {
+	mw := New(Config{Providers: []ProviderInjection{{
+		ProviderID: portkeyProvider,
+		JSONMetadata: &JSONMetadataRule{
+			Header:    "x-portkey-metadata",
+			UserKey:   "_user",
+			GroupsKey: "groups",
+		},
+		ExtraHeaders: []ExtraHeaderKV{
+			{Name: "x-portkey-config", Value: "pc-prod-3f2a"},
+		},
+	}}})
+	in := newInput(portkeyProvider, "alice", []string{"grp-eng"})
+	in.UserEmail = "alice@example.com"
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out.Mutations)
+
+	assert.Contains(t, out.Mutations.HeadersRemove, "x-portkey-config",
+		"extras must be stripped before stamping for anti-spoof")
+	added := map[string]string{}
+	for _, kv := range out.Mutations.HeadersAdd {
+		added[kv.Key] = kv.Value
+	}
+	assert.Equal(t, "pc-prod-3f2a", added["x-portkey-config"],
+		"extras must carry the operator-configured value verbatim")
+	// Identity-stamping shape (JSONMetadata header) still emitted.
+	assert.Contains(t, added, "x-portkey-metadata",
+		"extras and identity stamping are independent — both must land")
+}
+
+// TestInject_ExtraHeaders_OnlyRule pins that an extras-only rule
+// (no HeaderPair, no JSONMetadata) survives New() and stamps the
+// extras anyway. Useful for hypothetical gateways that need a static
+// routing header but no NetBird identity stamping.
+func TestInject_ExtraHeaders_OnlyRule(t *testing.T) {
+	mw := New(Config{Providers: []ProviderInjection{{
+		ProviderID: "ainp_extras-only",
+		ExtraHeaders: []ExtraHeaderKV{
+			{Name: "x-routing-key", Value: "rk-1"},
+		},
+	}}})
+	in := newInput("ainp_extras-only", "alice", nil)
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out.Mutations,
+		"extras alone keep the rule alive — middleware must emit them")
+	added := map[string]string{}
+	for _, kv := range out.Mutations.HeadersAdd {
+		added[kv.Key] = kv.Value
+	}
+	assert.Equal(t, "rk-1", added["x-routing-key"])
+}
+
+// TestInject_ExtraHeaders_EmptyValueSkipped pins that empty values are
+// dropped silently (the synth would normally not send them, but the
+// middleware is defensive).
+func TestInject_ExtraHeaders_EmptyValueSkipped(t *testing.T) {
+	mw := New(Config{Providers: []ProviderInjection{{
+		ProviderID: portkeyProvider,
+		JSONMetadata: &JSONMetadataRule{
+			Header:  "x-portkey-metadata",
+			UserKey: "_user",
+		},
+		ExtraHeaders: []ExtraHeaderKV{
+			{Name: "x-portkey-config", Value: ""},
+		},
+	}}})
+	in := newInput(portkeyProvider, "alice", []string{"grp-eng"})
+	in.UserEmail = "alice@example.com"
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out.Mutations)
+	assert.NotContains(t, out.Mutations.HeadersRemove, "x-portkey-config",
+		"empty extra value must not even strip the header")
+	for _, kv := range out.Mutations.HeadersAdd {
+		assert.NotEqual(t, "x-portkey-config", kv.Key,
+			"empty extra value must not be stamped")
+	}
+}
diff --git a/proxy/internal/middleware/builtin/llm_limit_check/factory.go b/proxy/internal/middleware/builtin/llm_limit_check/factory.go
new file mode 100644
index 000000000..1068a6867
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_limit_check/factory.go
@@ -0,0 +1,38 @@
+// Package llm_limit_check is the SlotOnRequest middleware that asks
+// management which agent-network policy "pays" for the current LLM
+// request. On allow, it stamps the selected policy id, attribution
+// group id, and effective window length onto the metadata bag so the
+// post-flight llm_limit_record middleware can tick the right counters.
+// On deny, it returns a 403 carrying the canonical llm_policy.* deny
+// code surfaced by management.
+package llm_limit_check
+
+import (
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin"
+)
+
+// ID is the registry identifier for this middleware.
+const ID = "llm_limit_check"
+
+// Factory builds a configured llm_limit_check instance. The factory
+// has no per-target config — it pulls the management gRPC client from
+// the package-level FactoryContext at construction time. A nil
+// MgmtClient on the context is allowed; the middleware then becomes
+// a no-op pass-through (allow without attribution) so a partially
+// wired environment doesn't break the chain.
+type Factory struct{}
+
+// ID returns the registry identifier matching the middleware ID.
+func (Factory) ID() string { return ID }
+
+// New ignores the rawConfig payload (no per-target config today) and
+// returns a Middleware bound to the FactoryContext's MgmtClient.
+func (Factory) New(_ []byte) (middleware.Middleware, error) {
+	ctx := builtin.Context()
+	return New(ctx.MgmtClient, ctx.Logger), nil
+}
+
+func init() {
+	builtin.Register(Factory{})
+}
diff --git a/proxy/internal/middleware/builtin/llm_limit_check/middleware.go b/proxy/internal/middleware/builtin/llm_limit_check/middleware.go
new file mode 100644
index 000000000..bebe4dca4
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_limit_check/middleware.go
@@ -0,0 +1,196 @@
+package llm_limit_check
+
+import (
+	"context"
+	"strconv"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// Version is reported via Middleware.Version().
+const Version = "1.0.0"
+
+// callTimeout caps the wall-clock budget for the pre-flight RPC. The
+// middleware sits on the request leg, so a slow management call
+// translates directly to user-visible latency. 2s is loose enough for
+// a healthy management cluster but tight enough that a stalled call
+// fails open via the same path nil-MgmtClient does — an enforcement
+// gate that adds 30s of latency is worse than a stale gate.
+const callTimeout = 2 * time.Second
+
+// Middleware is the per-target instance that runs the pre-flight check.
+type Middleware struct {
+	mgmt   builtin.MgmtClient
+	logger *log.Logger
+}
+
+// New constructs a Middleware. mgmt may be nil — that's the
+// no-management-wired case where the middleware is a pass-through
+// (allow without attribution); useful for unit tests and for
+// progressive rollout of the management RPC.
+func New(mgmt builtin.MgmtClient, logger *log.Logger) *Middleware {
+	if logger == nil {
+		logger = log.StandardLogger()
+	}
+	return &Middleware{mgmt: mgmt, logger: logger}
+}
+
+// ID returns the registry identifier.
+func (m *Middleware) ID() string { return ID }
+
+// Version returns the implementation version.
+func (m *Middleware) Version() string { return Version }
+
+// Slot reports the chain slot the middleware lives in.
+func (m *Middleware) Slot() middleware.Slot { return middleware.SlotOnRequest }
+
+// AcceptedContentTypes returns nil because the gate consults metadata
+// emitted upstream (KeyLLMResolvedProviderID) and never inspects bodies.
+func (m *Middleware) AcceptedContentTypes() []string { return nil }
+
+// MetadataKeys is the closed allowlist of keys this middleware emits.
+func (m *Middleware) MetadataKeys() []string {
+	return []string{
+		middleware.KeyLLMSelectedPolicyID,
+		middleware.KeyLLMAttributionGroupID,
+		middleware.KeyLLMAttributionWindowS,
+		middleware.KeyLLMPolicyDecision,
+		middleware.KeyLLMPolicyReason,
+	}
+}
+
+// MutationsSupported reports that the middleware never mutates the
+// request body or headers; the only outcome is allow + metadata or
+// deny.
+func (m *Middleware) MutationsSupported() bool { return false }
+
+// Close releases resources owned by the middleware. Stateless, so
+// this is a no-op.
+func (m *Middleware) Close() error { return nil }
+
+// Invoke runs the pre-flight policy check.
+func (m *Middleware) Invoke(ctx context.Context, in *middleware.Input) (*middleware.Output, error) {
+	if m.mgmt == nil {
+		// No management client wired — fall through to allow with
+		// no attribution. RecordLLMUsage on the response leg will
+		// also be a no-op so counters stay at zero. This matches
+		// the PR1 behaviour exactly so a partial wiring is
+		// indistinguishable from "no enforcement".
+		return allowNoAttribution(), nil
+	}
+
+	providerID := lookupKV(in.Metadata, middleware.KeyLLMResolvedProviderID)
+	if providerID == "" {
+		// llm_router didn't emit a resolved provider id — usually
+		// because the request didn't carry an llm.model. The
+		// router itself denied; we won't reach here in production,
+		// but defensively pass through so we never deny on top of
+		// an upstream allow.
+		return allowNoAttribution(), nil
+	}
+
+	rpcCtx, cancel := context.WithTimeout(ctx, callTimeout)
+	defer cancel()
+
+	resp, err := m.mgmt.CheckLLMPolicyLimits(rpcCtx, &proto.CheckLLMPolicyLimitsRequest{
+		AccountId:  in.AccountID,
+		UserId:     in.UserID,
+		GroupIds:   append([]string(nil), in.UserGroups...),
+		ProviderId: providerID,
+		Model:      lookupKV(in.Metadata, middleware.KeyLLMModel),
+	})
+	if err != nil {
+		// Fail-open on transport / management errors. The
+		// alternative — denying every request when management is
+		// unreachable — is worse for v1 (operational outage =
+		// total LLM outage). Operators can audit via the
+		// access-log; PR3 can switch to fail-closed under a flag.
+		m.logger.WithError(err).
+			WithField("middleware", ID).
+			Debugf("management pre-flight failed; failing open")
+		return allowNoAttribution(), nil
+	}
+
+	if resp.GetDecision() == "deny" {
+		return denyFromManagement(resp), nil
+	}
+	return allowFromManagement(resp), nil
+}
+
+// allowNoAttribution returns the no-op allow envelope used when no
+// management client is wired or no provider was resolved. Stamps
+// decision=allow but no policy / attribution metadata so
+// llm_limit_record skips its post-flight write.
+func allowNoAttribution() *middleware.Output {
+	return &middleware.Output{
+		Decision: middleware.DecisionAllow,
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMPolicyDecision, Value: "allow"},
+		},
+	}
+}
+
+// allowFromManagement converts a successful CheckLLMPolicyLimits
+// response into the chain's allow envelope, stamping the attribution
+// metadata the response leg consumes.
+func allowFromManagement(resp *proto.CheckLLMPolicyLimitsResponse) *middleware.Output {
+	out := &middleware.Output{
+		Decision: middleware.DecisionAllow,
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMPolicyDecision, Value: "allow"},
+		},
+	}
+	if id := resp.GetSelectedPolicyId(); id != "" {
+		out.Metadata = append(out.Metadata, middleware.KV{Key: middleware.KeyLLMSelectedPolicyID, Value: id})
+	}
+	if g := resp.GetAttributionGroupId(); g != "" {
+		out.Metadata = append(out.Metadata, middleware.KV{Key: middleware.KeyLLMAttributionGroupID, Value: g})
+	}
+	if w := resp.GetWindowSeconds(); w > 0 {
+		out.Metadata = append(out.Metadata, middleware.KV{Key: middleware.KeyLLMAttributionWindowS, Value: strconv.FormatInt(w, 10)})
+	}
+	return out
+}
+
+// denyFromManagement converts a deny response into the chain's deny
+// envelope. The deny code surfaces verbatim through the framework's
+// fixed JSON template; arbitrary middleware bytes can't reach the
+// wire.
+func denyFromManagement(resp *proto.CheckLLMPolicyLimitsResponse) *middleware.Output {
+	code := resp.GetDenyCode()
+	if code == "" {
+		code = "llm_policy.cap_exceeded"
+	}
+	// The canonical code is safe to surface; the management-supplied
+	// reason can name internal quota details (used amounts, caps, rule
+	// ids), so keep the public message generic and leave the detail to
+	// server-side logs.
+	return &middleware.Output{
+		Decision:   middleware.DecisionDeny,
+		DenyStatus: 403,
+		DenyReason: &middleware.DenyReason{
+			Code:    code,
+			Message: "LLM policy limit exceeded",
+		},
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMPolicyDecision, Value: "deny"},
+			{Key: middleware.KeyLLMPolicyReason, Value: code},
+		},
+	}
+}
+
+// lookupKV returns the value associated with key, or the empty
+// string when absent.
+func lookupKV(kvs []middleware.KV, key string) string {
+	for _, kv := range kvs {
+		if kv.Key == key {
+			return kv.Value
+		}
+	}
+	return ""
+}
diff --git a/proxy/internal/middleware/builtin/llm_limit_check/middleware_test.go b/proxy/internal/middleware/builtin/llm_limit_check/middleware_test.go
new file mode 100644
index 000000000..2c26c2abe
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_limit_check/middleware_test.go
@@ -0,0 +1,186 @@
+package llm_limit_check
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// fakeMgmt is a minimal builtin.MgmtClient stub that lets the test
+// drive CheckLLMPolicyLimits responses without a real gRPC dial.
+type fakeMgmt struct {
+	checkResp *proto.CheckLLMPolicyLimitsResponse
+	checkErr  error
+	checkReq  *proto.CheckLLMPolicyLimitsRequest
+}
+
+func (f *fakeMgmt) CheckLLMPolicyLimits(_ context.Context, in *proto.CheckLLMPolicyLimitsRequest, _ ...grpc.CallOption) (*proto.CheckLLMPolicyLimitsResponse, error) {
+	f.checkReq = in
+	return f.checkResp, f.checkErr
+}
+
+func (f *fakeMgmt) RecordLLMUsage(_ context.Context, _ *proto.RecordLLMUsageRequest, _ ...grpc.CallOption) (*proto.RecordLLMUsageResponse, error) {
+	return &proto.RecordLLMUsageResponse{}, nil
+}
+
+func runInvoke(t *testing.T, m *Middleware, in *middleware.Input) *middleware.Output {
+	t.Helper()
+	out, err := m.Invoke(context.Background(), in)
+	require.NoError(t, err, "Invoke must not propagate transport errors")
+	require.NotNil(t, out, "Invoke must always return an Output")
+	return out
+}
+
+// TestInvoke_AllowStampsAttributionMetadata covers the happy path:
+// management returns an allow decision with selected_policy_id +
+// attribution_group_id + window_seconds, the middleware emits all three
+// onto the metadata bag so the post-flight llm_limit_record
+// middleware has everything it needs to tick the right counter.
+func TestInvoke_AllowStampsAttributionMetadata(t *testing.T) {
+	mgmt := &fakeMgmt{
+		checkResp: &proto.CheckLLMPolicyLimitsResponse{
+			Decision:           "allow",
+			SelectedPolicyId:   "pol-X",
+			AttributionGroupId: "grp-engineers",
+			WindowSeconds:      86_400,
+		},
+	}
+	m := New(mgmt, nil)
+
+	out := runInvoke(t, m, &middleware.Input{
+		AccountID:  "acc-1",
+		UserID:     "user-bob",
+		UserGroups: []string{"grp-engineers"},
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMResolvedProviderID, Value: "prov-1"},
+			{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+		},
+	})
+
+	assert.Equal(t, middleware.DecisionAllow, out.Decision)
+	assert.Equal(t, "acc-1", mgmt.checkReq.GetAccountId(), "account_id must round-trip onto the RPC")
+	assert.Equal(t, "user-bob", mgmt.checkReq.GetUserId())
+	assert.Equal(t, []string{"grp-engineers"}, mgmt.checkReq.GetGroupIds())
+	assert.Equal(t, "prov-1", mgmt.checkReq.GetProviderId(), "resolved provider id must come from metadata")
+	assert.Equal(t, "gpt-4o", mgmt.checkReq.GetModel(), "model must come from metadata")
+
+	want := map[string]string{
+		middleware.KeyLLMPolicyDecision:     "allow",
+		middleware.KeyLLMSelectedPolicyID:   "pol-X",
+		middleware.KeyLLMAttributionGroupID: "grp-engineers",
+		middleware.KeyLLMAttributionWindowS: "86400",
+	}
+	got := map[string]string{}
+	for _, kv := range out.Metadata {
+		got[kv.Key] = kv.Value
+	}
+	assert.Equal(t, want, got, "attribution metadata must land on the bag for the response leg to consume")
+}
+
+// TestInvoke_DenyConvertsToProxyDeny proves the deny envelope round-
+// trips: management's deny code becomes the proxy framework's deny
+// payload at status 403, and the deny reason text is preserved so
+// operators can debug from the access log.
+func TestInvoke_DenyConvertsToProxyDeny(t *testing.T) {
+	mgmt := &fakeMgmt{
+		checkResp: &proto.CheckLLMPolicyLimitsResponse{
+			Decision:   "deny",
+			DenyCode:   "llm_policy.token_cap_exceeded",
+			DenyReason: "group token cap exhausted on policy pol-X (used 1000 of 1000)",
+		},
+	}
+	m := New(mgmt, nil)
+
+	out := runInvoke(t, m, &middleware.Input{
+		AccountID:  "acc-1",
+		UserGroups: []string{"grp-engineers"},
+		Metadata:   []middleware.KV{{Key: middleware.KeyLLMResolvedProviderID, Value: "prov-1"}},
+	})
+
+	assert.Equal(t, middleware.DecisionDeny, out.Decision)
+	assert.Equal(t, 403, out.DenyStatus, "policy denials are 403 — same as llm_router's")
+	require.NotNil(t, out.DenyReason, "deny envelope must carry a reason payload")
+	assert.Equal(t, "llm_policy.token_cap_exceeded", out.DenyReason.Code, "canonical deny code surfaces to the caller")
+	// The public message must stay generic: the management reason names
+	// internal quota detail (used/cap, rule id) that must not leak.
+	assert.Equal(t, "LLM policy limit exceeded", out.DenyReason.Message, "public deny message must be generic")
+	assert.NotContains(t, out.DenyReason.Message, "exhausted", "internal quota detail must not reach the caller")
+	assert.NotContains(t, out.DenyReason.Message, "1000", "internal cap numbers must not reach the caller")
+}
+
+// TestInvoke_NoMgmtClientPassesThrough proves the partial-wiring
+// safety: a middleware constructed without a management client
+// allows every request without attribution. This makes a half-set-up
+// environment indistinguishable from "no enforcement" rather than
+// breaking the chain.
+func TestInvoke_NoMgmtClientPassesThrough(t *testing.T) {
+	m := New(nil, nil)
+
+	out := runInvoke(t, m, &middleware.Input{
+		AccountID:  "acc-1",
+		UserGroups: []string{"grp-engineers"},
+		Metadata:   []middleware.KV{{Key: middleware.KeyLLMResolvedProviderID, Value: "prov-1"}},
+	})
+
+	assert.Equal(t, middleware.DecisionAllow, out.Decision)
+	for _, kv := range out.Metadata {
+		assert.NotEqual(t, middleware.KeyLLMSelectedPolicyID, kv.Key,
+			"no mgmt client = no attribution metadata; record middleware then skips its write")
+	}
+}
+
+// TestInvoke_NoResolvedProviderPassesThrough covers the defensive
+// path: when llm_router didn't set llm.resolved_provider_id (which
+// only happens on the deny side of llm_router), the gate must NOT
+// stack a second deny on top — pass through and let the upstream
+// deny stand.
+func TestInvoke_NoResolvedProviderPassesThrough(t *testing.T) {
+	m := New(&fakeMgmt{}, nil)
+
+	out := runInvoke(t, m, &middleware.Input{
+		AccountID: "acc-1",
+		Metadata:  []middleware.KV{},
+	})
+
+	assert.Equal(t, middleware.DecisionAllow, out.Decision,
+		"no resolved provider = the gate has nothing to check; never deny on top of an upstream allow")
+}
+
+// TestInvoke_RPCErrorFailsOpen proves the fail-open contract: a
+// transport error from management does NOT deny the request. v1
+// trades enforcement strictness for availability — an unreachable
+// management server otherwise turns into a total LLM outage.
+func TestInvoke_RPCErrorFailsOpen(t *testing.T) {
+	m := New(&fakeMgmt{checkErr: errors.New("connection refused")}, nil)
+
+	out := runInvoke(t, m, &middleware.Input{
+		AccountID:  "acc-1",
+		UserGroups: []string{"grp-engineers"},
+		Metadata:   []middleware.KV{{Key: middleware.KeyLLMResolvedProviderID, Value: "prov-1"}},
+	})
+
+	assert.Equal(t, middleware.DecisionAllow, out.Decision,
+		"transport errors must not cascade into total LLM outages — operators audit via access log")
+}
+
+// TestMetadataKeys_Allowlist locks the closed set this middleware can
+// emit. The accumulator drops anything outside this list; adding a
+// new emission means updating both the slice and this test.
+func TestMetadataKeys_Allowlist(t *testing.T) {
+	keys := New(nil, nil).MetadataKeys()
+	want := []string{
+		middleware.KeyLLMSelectedPolicyID,
+		middleware.KeyLLMAttributionGroupID,
+		middleware.KeyLLMAttributionWindowS,
+		middleware.KeyLLMPolicyDecision,
+		middleware.KeyLLMPolicyReason,
+	}
+	assert.ElementsMatch(t, want, keys)
+}
diff --git a/proxy/internal/middleware/builtin/llm_limit_record/factory.go b/proxy/internal/middleware/builtin/llm_limit_record/factory.go
new file mode 100644
index 000000000..b42931c0c
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_limit_record/factory.go
@@ -0,0 +1,35 @@
+// Package llm_limit_record is the SlotOnResponse middleware that
+// posts the served request's token + cost deltas back to management
+// so the per-(user, group, window) consumption counters tick. Reads
+// the attribution metadata stamped by llm_limit_check on the request
+// leg + the token / cost metadata stamped by llm_response_parser and
+// cost_meter; skips the write entirely when no attribution metadata
+// is present (e.g. catch-all-allow policy with no caps configured).
+package llm_limit_record
+
+import (
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin"
+)
+
+// ID is the registry identifier for this middleware.
+const ID = "llm_limit_record"
+
+// Factory builds a configured llm_limit_record instance bound to the
+// FactoryContext's MgmtClient. nil-MgmtClient disables the post-flight
+// write entirely (no-op pass-through), matching the request-leg gate's
+// behaviour so a partially wired environment is consistent.
+type Factory struct{}
+
+// ID returns the registry identifier matching the middleware ID.
+func (Factory) ID() string { return ID }
+
+// New ignores the rawConfig payload (no per-target config today).
+func (Factory) New(_ []byte) (middleware.Middleware, error) {
+	ctx := builtin.Context()
+	return New(ctx.MgmtClient, ctx.Logger), nil
+}
+
+func init() {
+	builtin.Register(Factory{})
+}
diff --git a/proxy/internal/middleware/builtin/llm_limit_record/middleware.go b/proxy/internal/middleware/builtin/llm_limit_record/middleware.go
new file mode 100644
index 000000000..52dfc73f0
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_limit_record/middleware.go
@@ -0,0 +1,144 @@
+package llm_limit_record
+
+import (
+	"context"
+	"strconv"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// Version is reported via Middleware.Version().
+const Version = "1.0.0"
+
+// callTimeout caps the wall-clock budget for the post-flight RPC.
+// Longer than the pre-flight gate because this runs after the
+// upstream returned and is not on the user-facing latency path —
+// a slow record is just a delayed counter increment, not a delayed
+// response to the caller.
+const callTimeout = 5 * time.Second
+
+// Middleware posts token + cost deltas to management after a served
+// request. Stateless; per-call values come entirely from metadata
+// emitted upstream.
+type Middleware struct {
+	mgmt   builtin.MgmtClient
+	logger *log.Logger
+}
+
+// New constructs a Middleware bound to the supplied management
+// client. mgmt may be nil — that disables the write entirely so a
+// partially wired environment doesn't attempt to dial nothing.
+func New(mgmt builtin.MgmtClient, logger *log.Logger) *Middleware {
+	if logger == nil {
+		logger = log.StandardLogger()
+	}
+	return &Middleware{mgmt: mgmt, logger: logger}
+}
+
+// ID returns the registry identifier.
+func (m *Middleware) ID() string { return ID }
+
+// Version returns the implementation version.
+func (m *Middleware) Version() string { return Version }
+
+// Slot reports that the middleware runs after the upstream call.
+func (m *Middleware) Slot() middleware.Slot { return middleware.SlotOnResponse }
+
+// AcceptedContentTypes is empty: this middleware never inspects
+// bodies. It only reads metadata emitted upstream.
+func (m *Middleware) AcceptedContentTypes() []string { return []string{} }
+
+// MetadataKeys is empty — the record middleware never emits its own
+// metadata. Its only side effect is the gRPC write to management.
+func (m *Middleware) MetadataKeys() []string { return []string{} }
+
+// MutationsSupported reports that the middleware never mutates the
+// response. Its outcome is always Allow.
+func (m *Middleware) MutationsSupported() bool { return false }
+
+// Close releases resources owned by the middleware. Stateless.
+func (m *Middleware) Close() error { return nil }
+
+// Invoke reads the attribution + tokens + cost metadata, calls
+// management's RecordLLMUsage, and always returns Allow. RPC errors
+// are logged at debug level — the response has already been served
+// to the client by the time we get here, so a record failure must
+// not surface back through the proxy.
+func (m *Middleware) Invoke(ctx context.Context, in *middleware.Input) (*middleware.Output, error) {
+	out := &middleware.Output{Decision: middleware.DecisionAllow}
+	if m.mgmt == nil {
+		return out, nil
+	}
+
+	tokensIn, _ := strconv.ParseInt(lookupKV(in.Metadata, middleware.KeyLLMInputTokens), 10, 64)
+	tokensOut, _ := strconv.ParseInt(lookupKV(in.Metadata, middleware.KeyLLMOutputTokens), 10, 64)
+	costUSD, _ := strconv.ParseFloat(lookupKV(in.Metadata, middleware.KeyCostUSDTotal), 64)
+	if tokensIn == 0 && tokensOut == 0 && costUSD == 0 {
+		// llm_response_parser couldn't read usage off the upstream
+		// response (streaming-not-yet-supported, malformed body, …).
+		// Skipping the write keeps phantom rows out of the
+		// consumption table.
+		return out, nil
+	}
+
+	windowStr := lookupKV(in.Metadata, middleware.KeyLLMAttributionWindowS)
+	windowSeconds, _ := strconv.ParseInt(windowStr, 10, 64)
+	groupID := lookupKV(in.Metadata, middleware.KeyLLMAttributionGroupID)
+
+	// A zero attribution window means no policy cap bound this request (deny at
+	// the gate, or a catch-all-allow policy). We still record so account-level
+	// budget rules — which live in their own windows and bind independently of
+	// policies — accumulate. The management side books the policy dimensions
+	// only when window_seconds > 0 and fans out to account rules regardless.
+	if in.UserID == "" && groupID == "" && len(in.UserGroups) == 0 {
+		m.logger.WithField("middleware", ID).
+			WithField("account_id", in.AccountID).
+			Debugf("post-flight skipped: no user/group/groups to attribute (tokens=%d/%d cost=%g window=%d)", tokensIn, tokensOut, costUSD, windowSeconds)
+		return out, nil
+	}
+
+	rpcCtx, cancel := context.WithTimeout(ctx, callTimeout)
+	defer cancel()
+
+	m.logger.WithField("middleware", ID).
+		WithField("account_id", in.AccountID).
+		WithField("user_id", in.UserID).
+		WithField("group_id", groupID).
+		WithField("group_ids_len", len(in.UserGroups)).
+		Debugf("post-flight sending RecordLLMUsage (tokens=%d/%d cost=%g window=%d)", tokensIn, tokensOut, costUSD, windowSeconds)
+
+	if _, err := m.mgmt.RecordLLMUsage(rpcCtx, &proto.RecordLLMUsageRequest{
+		AccountId:     in.AccountID,
+		UserId:        in.UserID,
+		GroupId:       groupID,
+		WindowSeconds: windowSeconds,
+		TokensInput:   tokensIn,
+		TokensOutput:  tokensOut,
+		CostUsd:       costUSD,
+		GroupIds:      append([]string(nil), in.UserGroups...),
+	}); err != nil {
+		m.logger.WithError(err).
+			WithField("middleware", ID).
+			WithField("account_id", in.AccountID).
+			WithField("user_id", in.UserID).
+			WithField("group_id", groupID).
+			Debugf("post-flight record failed; counter will lag this request")
+	}
+	return out, nil
+}
+
+// lookupKV returns the value associated with key, or the empty
+// string when absent.
+func lookupKV(kvs []middleware.KV, key string) string {
+	for _, kv := range kvs {
+		if kv.Key == key {
+			return kv.Value
+		}
+	}
+	return ""
+}
diff --git a/proxy/internal/middleware/builtin/llm_limit_record/middleware_test.go b/proxy/internal/middleware/builtin/llm_limit_record/middleware_test.go
new file mode 100644
index 000000000..a98ce9b9f
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_limit_record/middleware_test.go
@@ -0,0 +1,191 @@
+package llm_limit_record
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+type fakeMgmt struct {
+	recordReq    *proto.RecordLLMUsageRequest
+	recordCalled bool
+	recordErr    error
+}
+
+func (f *fakeMgmt) CheckLLMPolicyLimits(_ context.Context, _ *proto.CheckLLMPolicyLimitsRequest, _ ...grpc.CallOption) (*proto.CheckLLMPolicyLimitsResponse, error) {
+	return &proto.CheckLLMPolicyLimitsResponse{Decision: "allow"}, nil
+}
+
+func (f *fakeMgmt) RecordLLMUsage(_ context.Context, in *proto.RecordLLMUsageRequest, _ ...grpc.CallOption) (*proto.RecordLLMUsageResponse, error) {
+	f.recordCalled = true
+	f.recordReq = in
+	return &proto.RecordLLMUsageResponse{}, f.recordErr
+}
+
+func runInvoke(t *testing.T, m *Middleware, in *middleware.Input) *middleware.Output {
+	t.Helper()
+	out, err := m.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	return out
+}
+
+// TestInvoke_PostsAttributionWithTokensAndCost covers the happy path:
+// when the request leg stamped attribution + the upstream parsers
+// stamped tokens + cost, the post-flight call carries every field
+// through to RecordLLMUsage.
+func TestInvoke_PostsAttributionWithTokensAndCost(t *testing.T) {
+	mgmt := &fakeMgmt{}
+	m := New(mgmt, nil)
+
+	out := runInvoke(t, m, &middleware.Input{
+		AccountID: "acc-1",
+		UserID:    "user-bob",
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMAttributionGroupID, Value: "grp-engineers"},
+			{Key: middleware.KeyLLMAttributionWindowS, Value: "86400"},
+			{Key: middleware.KeyLLMInputTokens, Value: "150"},
+			{Key: middleware.KeyLLMOutputTokens, Value: "75"},
+			{Key: middleware.KeyCostUSDTotal, Value: "0.0125"},
+		},
+	})
+
+	assert.Equal(t, middleware.DecisionAllow, out.Decision)
+	require.True(t, mgmt.recordCalled, "record must be invoked when attribution + usage are both present")
+	assert.Equal(t, "acc-1", mgmt.recordReq.GetAccountId())
+	assert.Equal(t, "user-bob", mgmt.recordReq.GetUserId())
+	assert.Equal(t, "grp-engineers", mgmt.recordReq.GetGroupId())
+	assert.Equal(t, int64(86_400), mgmt.recordReq.GetWindowSeconds())
+	assert.Equal(t, int64(150), mgmt.recordReq.GetTokensInput())
+	assert.Equal(t, int64(75), mgmt.recordReq.GetTokensOutput())
+	assert.InDelta(t, 0.0125, mgmt.recordReq.GetCostUsd(), 1e-9)
+}
+
+// TestInvoke_NoAttributionWindowStillRecordsForAccountFanOut proves the
+// catch-all-allow path now STILL records (window 0): account-level budget
+// rules live in their own windows and bind independently of policies, so the
+// management side needs the post-flight call even when no policy cap applied.
+// The full group set is forwarded so the account fan-out can attribute.
+func TestInvoke_NoAttributionWindowStillRecordsForAccountFanOut(t *testing.T) {
+	mgmt := &fakeMgmt{}
+	m := New(mgmt, nil)
+
+	runInvoke(t, m, &middleware.Input{
+		AccountID:  "acc-1",
+		UserID:     "user-bob",
+		UserGroups: []string{"grp-eng", "grp-oncall"},
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMInputTokens, Value: "150"},
+			{Key: middleware.KeyLLMOutputTokens, Value: "75"},
+			{Key: middleware.KeyCostUSDTotal, Value: "0.0125"},
+		},
+	})
+
+	require.True(t, mgmt.recordCalled, "must record even without a policy window so account budgets accumulate")
+	assert.Equal(t, int64(0), mgmt.recordReq.GetWindowSeconds(), "no policy window is forwarded as 0")
+	assert.Empty(t, mgmt.recordReq.GetGroupId(), "no attribution group without a policy")
+	assert.Equal(t, []string{"grp-eng", "grp-oncall"}, mgmt.recordReq.GetGroupIds(), "full group set must be forwarded for the account fan-out")
+}
+
+// TestInvoke_NoPrincipalSkipsRecord proves that with neither a user nor any
+// groups there is nothing to attribute, so the write is skipped.
+func TestInvoke_NoPrincipalSkipsRecord(t *testing.T) {
+	mgmt := &fakeMgmt{}
+	m := New(mgmt, nil)
+
+	runInvoke(t, m, &middleware.Input{
+		AccountID: "acc-1",
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMInputTokens, Value: "150"},
+			{Key: middleware.KeyCostUSDTotal, Value: "0.0125"},
+		},
+	})
+
+	assert.False(t, mgmt.recordCalled, "no user and no groups = nothing to attribute")
+}
+
+// TestInvoke_ZeroUsageSkipsRecord proves the no-usage-no-write path:
+// when the upstream parser couldn't extract token counts (streaming,
+// malformed body, …), skipping the write keeps phantom rows out of
+// the consumption table.
+func TestInvoke_ZeroUsageSkipsRecord(t *testing.T) {
+	mgmt := &fakeMgmt{}
+	m := New(mgmt, nil)
+
+	runInvoke(t, m, &middleware.Input{
+		AccountID: "acc-1",
+		UserID:    "user-bob",
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMAttributionGroupID, Value: "grp-engineers"},
+			{Key: middleware.KeyLLMAttributionWindowS, Value: "86400"},
+		},
+	})
+
+	assert.False(t, mgmt.recordCalled, "zero tokens AND zero cost = nothing to record; an upstream parse miss must not surface as a row")
+}
+
+// TestInvoke_RPCErrorIsSwallowed proves the post-flight isolation
+// contract: management errors must NOT cascade back to the proxy
+// because the upstream response has already been served — failing
+// the chain at this point would corrupt the response. Errors are
+// logged at debug level and swallowed.
+func TestInvoke_RPCErrorIsSwallowed(t *testing.T) {
+	mgmt := &fakeMgmt{recordErr: errors.New("management down")}
+	m := New(mgmt, nil)
+
+	out := runInvoke(t, m, &middleware.Input{
+		AccountID: "acc-1",
+		UserID:    "user-bob",
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMAttributionGroupID, Value: "grp-engineers"},
+			{Key: middleware.KeyLLMAttributionWindowS, Value: "86400"},
+			{Key: middleware.KeyLLMInputTokens, Value: "100"},
+		},
+	})
+
+	assert.Equal(t, middleware.DecisionAllow, out.Decision,
+		"a record failure must not surface — the upstream response is already on the wire")
+}
+
+// TestInvoke_NoMgmtClientPassesThrough mirrors the gate's safety
+// contract: a partial wiring is consistent. No mgmt client = silent
+// skip rather than an unhandled nil-deref.
+func TestInvoke_NoMgmtClientPassesThrough(t *testing.T) {
+	m := New(nil, nil)
+	out := runInvoke(t, m, &middleware.Input{
+		AccountID: "acc-1",
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMAttributionGroupID, Value: "grp-engineers"},
+			{Key: middleware.KeyLLMAttributionWindowS, Value: "86400"},
+			{Key: middleware.KeyLLMInputTokens, Value: "100"},
+		},
+	})
+	assert.Equal(t, middleware.DecisionAllow, out.Decision)
+}
+
+// TestInvoke_NoIdentitySkipsRecord covers a defensive guard: stamped
+// attribution but no user_id AND no group_id (shouldn't happen, but
+// possible if the gate ever changes shape) must not write a row keyed
+// on empty dimension ids.
+func TestInvoke_NoIdentitySkipsRecord(t *testing.T) {
+	mgmt := &fakeMgmt{}
+	m := New(mgmt, nil)
+
+	runInvoke(t, m, &middleware.Input{
+		AccountID: "acc-1",
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMAttributionWindowS, Value: "86400"},
+			{Key: middleware.KeyLLMInputTokens, Value: "100"},
+		},
+	})
+
+	assert.False(t, mgmt.recordCalled,
+		"empty user + group identity must skip the write — never key on empty dimension ids")
+}
diff --git a/proxy/internal/middleware/builtin/llm_request_parser/bedrock_test.go b/proxy/internal/middleware/builtin/llm_request_parser/bedrock_test.go
new file mode 100644
index 000000000..827b81d07
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_request_parser/bedrock_test.go
@@ -0,0 +1,55 @@
+package llm_request_parser
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestNormalizeBedrockModel(t *testing.T) {
+	cases := map[string]string{
+		"eu.anthropic.claude-sonnet-4-5-20250929-v1:0": "anthropic.claude-sonnet-4-5",
+		"us.anthropic.claude-opus-4-8-20250101-v1:0":   "anthropic.claude-opus-4-8",
+		"apac.anthropic.claude-haiku-4-5-v1:0":         "anthropic.claude-haiku-4-5",
+		"anthropic.claude-sonnet-4-5-20250929-v1:0":    "anthropic.claude-sonnet-4-5",
+		"meta.llama3-3-70b-instruct-v1:0":              "meta.llama3-3-70b-instruct",
+		"amazon.nova-pro-v1:0":                         "amazon.nova-pro",
+		"amazon.nova-2-lite-v1:0":                      "amazon.nova-2-lite",
+		// Inference-profile ARN — model id lives in the last path segment.
+		"arn:aws:bedrock:eu-central-1:123456789012:inference-profile/eu.anthropic.claude-sonnet-4-5-20250929-v1:0": "anthropic.claude-sonnet-4-5",
+	}
+	for in, want := range cases {
+		require.Equal(t, want, normalizeBedrockModel(in), "normalize %q", in)
+	}
+}
+
+func TestParseBedrockPath(t *testing.T) {
+	tests := []struct {
+		path   string
+		model  string
+		stream bool
+		ok     bool
+	}{
+		{"/model/eu.anthropic.claude-sonnet-4-5-20250929-v1:0/invoke", "anthropic.claude-sonnet-4-5", false, true},
+		{"/model/eu.anthropic.claude-sonnet-4-5-20250929-v1:0/invoke-with-response-stream", "anthropic.claude-sonnet-4-5", true, true},
+		{"/model/eu.anthropic.claude-sonnet-4-5-20250929-v1:0/converse", "anthropic.claude-sonnet-4-5", false, true},
+		{"/model/eu.anthropic.claude-sonnet-4-5-20250929-v1:0/converse-stream", "anthropic.claude-sonnet-4-5", true, true},
+		// URL-encoded colon in the version suffix.
+		{"/model/eu.anthropic.claude-sonnet-4-5-20250929-v1%3A0/invoke", "anthropic.claude-sonnet-4-5", false, true},
+		// Optional "/bedrock" gateway-namespace prefix.
+		{"/bedrock/model/eu.anthropic.claude-sonnet-4-5-20250929-v1:0/invoke-with-response-stream", "anthropic.claude-sonnet-4-5", true, true},
+		{"/bedrock/model/anthropic.claude-sonnet-4-5-20250929-v1:0/converse", "anthropic.claude-sonnet-4-5", false, true},
+		{"/v1/chat/completions", "", false, false},
+		{"/model/foo", "", false, false},
+		{"/model//invoke", "", false, false},
+		{"/model/x/unknown-action", "", false, false},
+	}
+	for _, tt := range tests {
+		br, ok := parseBedrockPath(tt.path)
+		require.Equal(t, tt.ok, ok, "ok for %q", tt.path)
+		if tt.ok {
+			require.Equal(t, tt.model, br.model, "model for %q", tt.path)
+			require.Equal(t, tt.stream, br.stream, "stream for %q", tt.path)
+		}
+	}
+}
diff --git a/proxy/internal/middleware/builtin/llm_request_parser/factory.go b/proxy/internal/middleware/builtin/llm_request_parser/factory.go
new file mode 100644
index 000000000..8b3776877
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_request_parser/factory.go
@@ -0,0 +1,71 @@
+package llm_request_parser
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin"
+)
+
+// config is the on-wire config envelope for the middleware.
+//
+// ProviderID, when set, names the parser to use directly (matched
+// against llm.ParserByName, e.g. "openai", "anthropic"). The
+// agent-network synthesiser stamps this so requests routed through a
+// synthesised provider service don't depend on URL-shape sniffing,
+// which is the only signal the middleware otherwise has.
+type config struct {
+	ProviderID string `json:"provider_id,omitempty"`
+	// RedactPii, when true, runs PII redaction over the captured raw prompt
+	// before it is emitted as llm.request_prompt_raw — so the
+	// agent-network access-log row does NOT carry raw emails / SSNs /
+	// phone numbers even though the framework's per-key redactor (Scan)
+	// doesn't cover those prompt-shaped patterns. Sourced by the
+	// synthesiser from the account's redact_pii toggle.
+	RedactPii bool `json:"redact_pii,omitempty"`
+	// CapturePrompt gates emission of llm.request_prompt_raw. A nil pointer
+	// preserves the legacy default (emit), so callers that don't know about
+	// the toggle (or pre-existing tests with empty config) keep working.
+	// The synthesiser sets this explicitly to the account's
+	// enable_prompt_collection toggle: false here suppresses the key
+	// entirely so the access-log row carries no prompt content at all,
+	// independent of redact_pii (which only controls the form of the
+	// content when it IS emitted).
+	CapturePrompt *bool `json:"capture_prompt,omitempty"`
+}
+
+// Factory builds llm_request_parser instances from raw config bytes.
+type Factory struct{}
+
+// ID returns the registry identifier.
+func (Factory) ID() string { return ID }
+
+// New constructs a middleware instance. Empty, null, and {} configs are
+// accepted; non-empty rawConfig that fails to unmarshal is rejected so
+// misconfigurations surface at chain build time.
+func (Factory) New(rawConfig []byte) (middleware.Middleware, error) {
+	var cfg config
+	if len(bytes.TrimSpace(rawConfig)) > 0 {
+		// Strict decode: a typo'd field (e.g. "capture_prompts") must fail
+		// chain build rather than silently fall back to the emit-everything
+		// default and leak prompts.
+		dec := json.NewDecoder(bytes.NewReader(rawConfig))
+		dec.DisallowUnknownFields()
+		if err := dec.Decode(&cfg); err != nil {
+			return nil, fmt.Errorf("decode config: %w", err)
+		}
+	}
+	// Default capturePrompt to true (legacy emission) when the field is
+	// absent so non-agent-network callers and pre-toggle tests keep working.
+	capturePrompt := true
+	if cfg.CapturePrompt != nil {
+		capturePrompt = *cfg.CapturePrompt
+	}
+	return middlewareImpl{providerID: cfg.ProviderID, redactPii: cfg.RedactPii, capturePrompt: capturePrompt}, nil
+}
+
+func init() {
+	builtin.Register(Factory{})
+}
diff --git a/proxy/internal/middleware/builtin/llm_request_parser/middleware.go b/proxy/internal/middleware/builtin/llm_request_parser/middleware.go
new file mode 100644
index 000000000..64ca04e6a
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_request_parser/middleware.go
@@ -0,0 +1,453 @@
+// Package llm_request_parser implements the SlotOnRequest middleware
+// that detects the LLM provider from the request URL, parses the JSON
+// request body for model and streaming flags, and extracts the user
+// prompt text. Emitted metadata feeds downstream middlewares (guardrail,
+// cost meter) and the access-log terminal sink.
+package llm_request_parser
+
+import (
+	"context"
+	"net/url"
+	"regexp"
+	"strconv"
+	"strings"
+	"unicode/utf8"
+
+	"github.com/netbirdio/netbird/proxy/internal/llm"
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_guardrail"
+)
+
+// ID is the registry key for this middleware.
+const ID = "llm_request_parser"
+
+// Version is reported via Middleware.Version().
+const Version = "1.0.0"
+
+// maxPromptBytes caps llm.request_prompt_raw at a size that fits within
+// MaxMetadataValueBytes with headroom. Truncation is rune-safe.
+const maxPromptBytes = 3500
+
+// middlewareImpl is the concrete implementation. providerID, when set,
+// names the parser to use directly (bypasses URL sniffing). It is empty
+// for non-agent-network targets, which fall back to DetectParser on the
+// request path.
+type middlewareImpl struct {
+	providerID    string
+	redactPii     bool
+	capturePrompt bool
+}
+
+// ID returns the registry identifier.
+func (middlewareImpl) ID() string { return ID }
+
+// Version returns the implementation version.
+func (middlewareImpl) Version() string { return Version }
+
+// Slot reports the request slot.
+func (middlewareImpl) Slot() middleware.Slot { return middleware.SlotOnRequest }
+
+// AcceptedContentTypes restricts body inspection to JSON.
+func (middlewareImpl) AcceptedContentTypes() []string {
+	return []string{"application/json"}
+}
+
+// MetadataKeys lists the closed allowlist of keys this middleware emits.
+func (middlewareImpl) MetadataKeys() []string {
+	return []string{
+		middleware.KeyLLMProvider,
+		middleware.KeyLLMModel,
+		middleware.KeyLLMStream,
+		middleware.KeyLLMRequestPromptRaw,
+		middleware.KeyLLMCaptureTruncated,
+		middleware.KeyLLMSessionID,
+	}
+}
+
+// MutationsSupported reports that this middleware never mutates.
+func (middlewareImpl) MutationsSupported() bool { return false }
+
+// Close is a no-op; the middleware is stateless.
+func (middlewareImpl) Close() error { return nil }
+
+// Invoke detects the LLM provider, parses request facts, and emits
+// metadata. Always returns DecisionAllow; never errors. Provider
+// selection prefers the configured providerID (synthesiser-stamped on
+// agent-network targets) so requests routed to a custom upstream URL
+// still resolve. Falls back to URL sniffing when no providerID is set.
+func (m middlewareImpl) Invoke(_ context.Context, in *middleware.Input) (*middleware.Output, error) {
+	out := &middleware.Output{Decision: middleware.DecisionAllow}
+	if in == nil {
+		return out, nil
+	}
+
+	// Google Vertex AI carries the model + publisher (vendor) in the URL path,
+	// not the body, so it needs a dedicated extraction path.
+	if vx, okv := parseVertexPath(extractPath(in.URL)); okv {
+		return m.invokeVertex(in, vx), nil
+	}
+
+	// AWS Bedrock likewise carries the model in the URL path (/model/{id}/{action}).
+	if br, okb := parseBedrockPath(extractPath(in.URL)); okb {
+		return m.invokeBedrock(in, br), nil
+	}
+
+	parser, ok := llm.ParserByName(m.providerID)
+	if !ok {
+		parser, ok = llm.DetectParser(extractPath(in.URL))
+	}
+	if !ok {
+		return out, nil
+	}
+
+	md := []middleware.KV{
+		{Key: middleware.KeyLLMProvider, Value: parser.ProviderName()},
+	}
+
+	// Session id is an opaque grouping identifier, not prompt content, so
+	// it's emitted regardless of the prompt-collection toggle — session
+	// grouping must work even when prompt capture is off. Prefer a header
+	// (Codex sends the session as an HTTP header, and headers survive an
+	// oversized request whose body capture was bypassed) and resolve it
+	// before ParseRequest so a malformed body still keeps the header id.
+	sessionID := sessionIDFromHeaders(in.Headers)
+	if sessionID == "" {
+		sessionID = parser.ExtractSessionID(in.Body)
+	}
+	appendSessionID := func(md []middleware.KV) []middleware.KV {
+		if sessionID != "" {
+			return append(md, middleware.KV{Key: middleware.KeyLLMSessionID, Value: sessionID})
+		}
+		return md
+	}
+
+	facts, err := parser.ParseRequest(in.Body)
+	if err != nil {
+		if logger := builtin.Context().Logger; logger != nil {
+			logger.Debugf("llm_request_parser: parse request body: %v", err)
+		}
+		md = appendSessionID(md)
+		md = appendCaptureTruncated(md, false, in.BodyTruncated)
+		out.Metadata = md
+		return out, nil
+	}
+
+	if facts.Model != "" {
+		md = append(md, middleware.KV{Key: middleware.KeyLLMModel, Value: facts.Model})
+	}
+	md = append(md, middleware.KV{Key: middleware.KeyLLMStream, Value: strconv.FormatBool(facts.Stream)})
+	md = appendSessionID(md)
+
+	prompt, promptTruncated := truncatePrompt(parser.ExtractPrompt(in.Body))
+	if prompt != "" && m.capturePrompt {
+		if m.redactPii {
+			// Apply redaction BEFORE the value lands in the metadata bag, so
+			// the access-log row never carries raw emails / SSNs / phones.
+			// The downstream llm_guardrail middleware reads this key to
+			// produce llm.request_prompt; RedactPII is idempotent so its
+			// second pass is a no-op. Redaction can grow the text, so
+			// re-truncate to keep the value within the metadata cap.
+			prompt = llm_guardrail.RedactPII(prompt)
+			var redactedTruncated bool
+			prompt, redactedTruncated = truncatePrompt(prompt)
+			promptTruncated = promptTruncated || redactedTruncated
+		}
+		md = append(md, middleware.KV{Key: middleware.KeyLLMRequestPromptRaw, Value: prompt})
+	}
+
+	md = appendCaptureTruncated(md, promptTruncated, in.BodyTruncated)
+	out.Metadata = md
+	return out, nil
+}
+
+// sessionIDHeaders are request header names that may carry a client
+// session identifier, checked in order, case-insensitively. Matching is
+// against Go's canonical header form, so use the hyphenated names the
+// clients actually send: "x-claude-code-session-id" (Claude Code),
+// "session-id" (OpenAI Codex — confirmed on the wire as "Session-Id"),
+// and "x-session-id" as a generic convention.
+var sessionIDHeaders = []string{"x-claude-code-session-id", "session-id", "x-session-id"}
+
+// sessionIDFromHeaders returns the first non-empty value among the known
+// session header names, or "" when none is present. Headers arrive in
+// canonical form, so the match is case-insensitive.
+func sessionIDFromHeaders(headers []middleware.KV) string {
+	for _, want := range sessionIDHeaders {
+		for _, kv := range headers {
+			if strings.EqualFold(kv.Key, want) && kv.Value != "" {
+				return kv.Value
+			}
+		}
+	}
+	return ""
+}
+
+// appendCaptureTruncated stamps the capture_truncated marker reflecting
+// either prompt-side truncation or upstream body truncation.
+func appendCaptureTruncated(md []middleware.KV, promptTruncated, bodyTruncated bool) []middleware.KV {
+	value := "false"
+	if promptTruncated || bodyTruncated {
+		value = "true"
+	}
+	return append(md, middleware.KV{Key: middleware.KeyLLMCaptureTruncated, Value: value})
+}
+
+// truncatePrompt clamps a prompt string to maxPromptBytes on a UTF-8
+// rune boundary. Returns the clamped string and whether truncation
+// occurred.
+func truncatePrompt(s string) (string, bool) {
+	if len(s) <= maxPromptBytes {
+		return s, false
+	}
+	cut := maxPromptBytes
+	for cut > 0 && !utf8.RuneStart(s[cut]) {
+		cut--
+	}
+	return s[:cut], true
+}
+
+// extractPath returns the path component of a URL that may be absolute
+// or already a path. Parse errors fall back to the raw input.
+func extractPath(raw string) string {
+	if raw == "" {
+		return ""
+	}
+	u, err := url.Parse(raw)
+	if err != nil || u.Path == "" {
+		return raw
+	}
+	return u.Path
+}
+
+// vertexRequest is the model + vendor extracted from a Vertex AI publisher
+// path (the model is in the URL, not the body).
+type vertexRequest struct {
+	publisher string
+	model     string
+	stream    bool
+}
+
+// parseVertexPath extracts the publisher, model, and streaming flag from a
+// Vertex publisher endpoint:
+//
+//	/v1/projects/{project}/locations/{region}/publishers/{publisher}/models/{model}:{action}
+//
+// The model's "@version" suffix is stripped so it matches catalog/pricing.
+func parseVertexPath(reqPath string) (vertexRequest, bool) {
+	const pubSep, modSep = "/publishers/", "/models/"
+	if !strings.HasPrefix(reqPath, "/v1/projects/") {
+		return vertexRequest{}, false
+	}
+	pubIdx := strings.Index(reqPath, pubSep)
+	modIdx := strings.Index(reqPath, modSep)
+	if pubIdx < 0 || modIdx <= pubIdx {
+		return vertexRequest{}, false
+	}
+	publisher := reqPath[pubIdx+len(pubSep) : modIdx]
+	rest := reqPath[modIdx+len(modSep):] // {model}:{action}
+	if publisher == "" || rest == "" {
+		return vertexRequest{}, false
+	}
+	model, action := rest, ""
+	if c := strings.LastIndex(rest, ":"); c >= 0 {
+		model, action = rest[:c], rest[c+1:]
+	}
+	if at := strings.Index(model, "@"); at >= 0 {
+		model = model[:at]
+	}
+	if model == "" {
+		return vertexRequest{}, false
+	}
+	return vertexRequest{publisher: publisher, model: model, stream: strings.HasPrefix(action, "stream")}, true
+}
+
+// vertexPublisherVendor maps a Vertex publisher to the parser surface its
+// requests/responses speak. Empty for publishers without a parser yet
+// (e.g. google/gemini) — the request still routes, but isn't metered.
+func vertexPublisherVendor(publisher string) string {
+	switch strings.ToLower(publisher) {
+	case "anthropic":
+		return "anthropic"
+	case "openai":
+		return "openai"
+	default:
+		return ""
+	}
+}
+
+// invokeVertex emits the model/vendor/session/prompt for a Vertex publisher
+// request, using the publisher's parser to read the (vendor-native) body.
+func (m middlewareImpl) invokeVertex(in *middleware.Input, vx vertexRequest) *middleware.Output {
+	out := &middleware.Output{Decision: middleware.DecisionAllow}
+	vendor := vertexPublisherVendor(vx.publisher)
+
+	md := []middleware.KV{}
+	if vendor != "" {
+		md = append(md, middleware.KV{Key: middleware.KeyLLMProvider, Value: vendor})
+	}
+	md = append(md, middleware.KV{Key: middleware.KeyLLMModel, Value: vx.model})
+	md = append(md, middleware.KV{Key: middleware.KeyLLMStream, Value: strconv.FormatBool(vx.stream)})
+
+	var parser llm.Parser
+	if vendor != "" {
+		parser, _ = llm.ParserByName(vendor)
+	}
+
+	sessionID := sessionIDFromHeaders(in.Headers)
+	if sessionID == "" && parser != nil {
+		sessionID = parser.ExtractSessionID(in.Body)
+	}
+	if sessionID != "" {
+		md = append(md, middleware.KV{Key: middleware.KeyLLMSessionID, Value: sessionID})
+	}
+
+	promptTruncated := false
+	if parser != nil && m.capturePrompt {
+		var prompt string
+		prompt, promptTruncated = truncatePrompt(parser.ExtractPrompt(in.Body))
+		if prompt != "" {
+			if m.redactPii {
+				prompt = llm_guardrail.RedactPII(prompt)
+				var rt bool
+				prompt, rt = truncatePrompt(prompt)
+				promptTruncated = promptTruncated || rt
+			}
+			md = append(md, middleware.KV{Key: middleware.KeyLLMRequestPromptRaw, Value: prompt})
+		}
+	}
+	md = appendCaptureTruncated(md, promptTruncated, in.BodyTruncated)
+	out.Metadata = md
+	return out
+}
+
+// bedrockRequest is the model + streaming flag extracted from an AWS Bedrock
+// model path. The InvokeModel vs Converse distinction is recovered downstream
+// from the response body shape, so only the streaming flag is carried here.
+type bedrockRequest struct {
+	model  string
+	stream bool
+}
+
+// bedrockNamespacePrefix is an optional gateway-namespace prefix some clients
+// put before the native Bedrock path to disambiguate it from other providers
+// that also use "/model/...".
+const bedrockNamespacePrefix = "/bedrock"
+
+// trimBedrockNamespace removes an optional "/bedrock" namespace prefix, leaving
+// the native Bedrock path ("/model/...").
+func trimBedrockNamespace(reqPath string) string {
+	if strings.HasPrefix(reqPath, bedrockNamespacePrefix+"/") {
+		return strings.TrimPrefix(reqPath, bedrockNamespacePrefix)
+	}
+	return reqPath
+}
+
+// bedrockRegionPrefixes are the cross-region inference-profile prefixes that
+// front a Bedrock model id (e.g. "eu.anthropic.claude-...").
+var bedrockRegionPrefixes = []string{"us.", "eu.", "apac.", "global."}
+
+// bedrockVersionSuffix matches the trailing "-vN[:N]" or "-YYYYMMDD-vN[:N]"
+// version/throughput suffix of a Bedrock model id.
+var bedrockVersionSuffix = regexp.MustCompile(`-(\d{8}-)?v\d+(:\d+)?$`)
+
+// parseBedrockPath extracts the model and streaming/converse flags from an AWS
+// Bedrock runtime model endpoint:
+//
+//	/model/{modelId}/{action}
+//
+// action ∈ {invoke, invoke-with-response-stream, converse, converse-stream}.
+// The modelId may be URL-encoded and may carry a cross-region inference-profile
+// prefix and a version suffix; normalizeBedrockModel strips both so the model
+// matches catalog pricing.
+func parseBedrockPath(reqPath string) (bedrockRequest, bool) {
+	reqPath = trimBedrockNamespace(reqPath)
+	const prefix = "/model/"
+	if !strings.HasPrefix(reqPath, prefix) {
+		return bedrockRequest{}, false
+	}
+	rest := reqPath[len(prefix):]
+	slash := strings.LastIndex(rest, "/")
+	if slash <= 0 || slash == len(rest)-1 {
+		return bedrockRequest{}, false
+	}
+	rawModel, action := rest[:slash], rest[slash+1:]
+	if decoded, err := url.PathUnescape(rawModel); err == nil {
+		rawModel = decoded
+	}
+	model := normalizeBedrockModel(rawModel)
+	if model == "" {
+		return bedrockRequest{}, false
+	}
+	switch action {
+	case "invoke", "converse":
+		return bedrockRequest{model: model}, true
+	case "invoke-with-response-stream", "converse-stream":
+		return bedrockRequest{model: model, stream: true}, true
+	default:
+		return bedrockRequest{}, false
+	}
+}
+
+// normalizeBedrockModel strips an ARN wrapper, a cross-region inference-profile
+// prefix, and the version/throughput suffix from a Bedrock model id so it
+// matches the catalog/pricing key, e.g.
+// "eu.anthropic.claude-sonnet-4-5-20250929-v1:0" -> "anthropic.claude-sonnet-4-5"
+// and "arn:aws:bedrock:eu-central-1:123:inference-profile/eu.anthropic.claude-sonnet-4-5-20250929-v1:0"
+// -> "anthropic.claude-sonnet-4-5".
+func normalizeBedrockModel(modelID string) string {
+	m := modelID
+	// A full ARN (inference-profile / provisioned-throughput / foundation-model)
+	// carries the model id in its last path segment.
+	if strings.HasPrefix(m, "arn:") {
+		if i := strings.LastIndex(m, "/"); i >= 0 {
+			m = m[i+1:]
+		}
+	}
+	for _, p := range bedrockRegionPrefixes {
+		if strings.HasPrefix(m, p) {
+			m = m[len(p):]
+			break
+		}
+	}
+	return bedrockVersionSuffix.ReplaceAllString(m, "")
+}
+
+// invokeBedrock emits the model/provider/session/prompt for an AWS Bedrock
+// request. Bedrock is metered under the dedicated "bedrock" parser, which reads
+// both the InvokeModel and Converse response shapes.
+func (m middlewareImpl) invokeBedrock(in *middleware.Input, br bedrockRequest) *middleware.Output {
+	out := &middleware.Output{Decision: middleware.DecisionAllow}
+	md := []middleware.KV{
+		{Key: middleware.KeyLLMProvider, Value: llm.ProviderNameBedrock},
+		{Key: middleware.KeyLLMModel, Value: br.model},
+		{Key: middleware.KeyLLMStream, Value: strconv.FormatBool(br.stream)},
+	}
+
+	parser, _ := llm.ParserByName(llm.ProviderNameBedrock)
+	sessionID := sessionIDFromHeaders(in.Headers)
+	if sessionID == "" && parser != nil {
+		sessionID = parser.ExtractSessionID(in.Body)
+	}
+	if sessionID != "" {
+		md = append(md, middleware.KV{Key: middleware.KeyLLMSessionID, Value: sessionID})
+	}
+
+	promptTruncated := false
+	if parser != nil && m.capturePrompt {
+		var prompt string
+		prompt, promptTruncated = truncatePrompt(parser.ExtractPrompt(in.Body))
+		if prompt != "" {
+			if m.redactPii {
+				prompt = llm_guardrail.RedactPII(prompt)
+				var rt bool
+				prompt, rt = truncatePrompt(prompt)
+				promptTruncated = promptTruncated || rt
+			}
+			md = append(md, middleware.KV{Key: middleware.KeyLLMRequestPromptRaw, Value: prompt})
+		}
+	}
+	md = appendCaptureTruncated(md, promptTruncated, in.BodyTruncated)
+	out.Metadata = md
+	return out
+}
diff --git a/proxy/internal/middleware/builtin/llm_request_parser/middleware_test.go b/proxy/internal/middleware/builtin/llm_request_parser/middleware_test.go
new file mode 100644
index 000000000..bc185b295
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_request_parser/middleware_test.go
@@ -0,0 +1,418 @@
+package llm_request_parser
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+)
+
+func metaValue(t *testing.T, kvs []middleware.KV, key string) (string, bool) {
+	t.Helper()
+	for _, kv := range kvs {
+		if kv.Key == key {
+			return kv.Value, true
+		}
+	}
+	return "", false
+}
+
+func newMiddleware(t *testing.T) middleware.Middleware {
+	t.Helper()
+	mw, err := Factory{}.New(nil)
+	require.NoError(t, err, "factory must accept nil config")
+	return mw
+}
+
+func TestMiddleware_StaticSurface(t *testing.T) {
+	mw := newMiddleware(t)
+	assert.Equal(t, ID, mw.ID(), "ID must match the registered constant")
+	assert.Equal(t, Version, mw.Version(), "Version must match the constant")
+	assert.Equal(t, middleware.SlotOnRequest, mw.Slot(), "must run in the request slot")
+	assert.Equal(t, []string{"application/json"}, mw.AcceptedContentTypes(), "only JSON bodies are needed")
+	assert.False(t, mw.MutationsSupported(), "request parser never mutates")
+	assert.NoError(t, mw.Close(), "Close on stateless middleware is a no-op")
+
+	keys := mw.MetadataKeys()
+	expected := []string{
+		middleware.KeyLLMProvider,
+		middleware.KeyLLMModel,
+		middleware.KeyLLMStream,
+		middleware.KeyLLMRequestPromptRaw,
+		middleware.KeyLLMCaptureTruncated,
+		middleware.KeyLLMSessionID,
+	}
+	assert.Equal(t, expected, keys, "metadata key allowlist must match the spec")
+}
+
+func TestFactory_AcceptsEmptyAndJSONConfig(t *testing.T) {
+	cases := [][]byte{nil, {}, []byte("null"), []byte("{}"), []byte("   ")}
+	for _, raw := range cases {
+		mw, err := Factory{}.New(raw)
+		require.NoError(t, err, "empty/null/object config must be accepted")
+		require.NotNil(t, mw, "factory must return a middleware instance")
+	}
+}
+
+func TestFactory_RejectsMalformedConfig(t *testing.T) {
+	mw, err := Factory{}.New([]byte("{not json"))
+	require.Error(t, err, "malformed config must surface at construction")
+	assert.Nil(t, mw, "no instance is returned on error")
+}
+
+func TestInvoke_OpenAIBufferedChatCompletion(t *testing.T) {
+	mw := newMiddleware(t)
+	body := []byte(`{"model":"gpt-4o-mini","stream":false,"messages":[{"role":"user","content":"Hello, world!"}]}`)
+
+	out, err := mw.Invoke(context.Background(), &middleware.Input{
+		URL:  "/v1/chat/completions",
+		Body: body,
+	})
+	require.NoError(t, err)
+	require.NotNil(t, out, "output must be returned")
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "request parser always allows")
+
+	provider, ok := metaValue(t, out.Metadata, middleware.KeyLLMProvider)
+	require.True(t, ok, "provider metadata must be set")
+	assert.Equal(t, "openai", provider, "OpenAI provider detected from path")
+
+	model, ok := metaValue(t, out.Metadata, middleware.KeyLLMModel)
+	require.True(t, ok, "model metadata must be set")
+	assert.Equal(t, "gpt-4o-mini", model, "model echoed from request body")
+
+	stream, ok := metaValue(t, out.Metadata, middleware.KeyLLMStream)
+	require.True(t, ok, "stream metadata must be set")
+	assert.Equal(t, "false", stream, "buffered request reports stream=false")
+
+	prompt, ok := metaValue(t, out.Metadata, middleware.KeyLLMRequestPromptRaw)
+	require.True(t, ok, "prompt metadata must be set when extractable")
+	assert.Contains(t, prompt, "Hello, world!", "extracted prompt carries the user message")
+
+	truncated, ok := metaValue(t, out.Metadata, middleware.KeyLLMCaptureTruncated)
+	require.True(t, ok, "capture_truncated must always be emitted on success")
+	assert.Equal(t, "false", truncated, "no truncation on a small body")
+}
+
+func TestInvoke_EmitsSessionID(t *testing.T) {
+	mw := newMiddleware(t)
+
+	t.Run("codex session from client_metadata", func(t *testing.T) {
+		body := []byte(`{"model":"gpt-5.5","client_metadata":{"session_id":"sess-codex-1"},"input":[]}`)
+		out, err := mw.Invoke(context.Background(), &middleware.Input{URL: "/v1/responses", Body: body})
+		require.NoError(t, err)
+		sid, ok := metaValue(t, out.Metadata, middleware.KeyLLMSessionID)
+		require.True(t, ok, "session id must be emitted for Codex requests")
+		assert.Equal(t, "sess-codex-1", sid, "session id must come from client_metadata.session_id")
+	})
+
+	t.Run("no session id key when absent", func(t *testing.T) {
+		body := []byte(`{"model":"gpt-4o","messages":[{"role":"user","content":"hi"}]}`)
+		out, err := mw.Invoke(context.Background(), &middleware.Input{URL: "/v1/chat/completions", Body: body})
+		require.NoError(t, err)
+		_, ok := metaValue(t, out.Metadata, middleware.KeyLLMSessionID)
+		assert.False(t, ok, "no session id key emitted when the request carries none")
+	})
+
+	t.Run("claude code session header", func(t *testing.T) {
+		body := []byte(`{"model":"claude-opus-4-8","messages":[{"role":"user","content":"hi"}]}`)
+		out, err := mw.Invoke(context.Background(), &middleware.Input{
+			URL:     "/v1/messages",
+			Body:    body,
+			Headers: []middleware.KV{{Key: "X-Claude-Code-Session-Id", Value: "cc-sess-1"}},
+		})
+		require.NoError(t, err)
+		sid, ok := metaValue(t, out.Metadata, middleware.KeyLLMSessionID)
+		require.True(t, ok, "Claude Code session id must be read from X-Claude-Code-Session-Id")
+		assert.Equal(t, "cc-sess-1", sid, "session id must come from the Claude Code session header")
+	})
+
+	t.Run("codex Session-Id header", func(t *testing.T) {
+		// Codex sends the session as the canonical header "Session-Id".
+		body := []byte(`{"model":"gpt-5.5","input":[]}`)
+		out, err := mw.Invoke(context.Background(), &middleware.Input{
+			URL:     "/v1/responses",
+			Body:    body,
+			Headers: []middleware.KV{{Key: "Session-Id", Value: "sess-hdr-1"}},
+		})
+		require.NoError(t, err)
+		sid, ok := metaValue(t, out.Metadata, middleware.KeyLLMSessionID)
+		require.True(t, ok, "session id must be read from the Session-Id header")
+		assert.Equal(t, "sess-hdr-1", sid, "session id must come from the Codex Session-Id header")
+	})
+
+	t.Run("header wins over body and survives bypassed body", func(t *testing.T) {
+		// Oversized request: body was bypassed to a routing stub with no
+		// client_metadata, but the header still carries the session.
+		out, err := mw.Invoke(context.Background(), &middleware.Input{
+			URL:     "/v1/responses",
+			Body:    []byte(`{"model":"gpt-5.5","stream":true}`),
+			Headers: []middleware.KV{{Key: "X-Session-Id", Value: "sess-hdr-2"}},
+		})
+		require.NoError(t, err)
+		sid, _ := metaValue(t, out.Metadata, middleware.KeyLLMSessionID)
+		assert.Equal(t, "sess-hdr-2", sid, "x-session-id header must be honoured when the body carries no marker")
+	})
+}
+
+func TestInvoke_OpenAIStreamingChatCompletion(t *testing.T) {
+	mw := newMiddleware(t)
+	body := []byte(`{"model":"gpt-4o-mini","stream":true,"messages":[{"role":"user","content":"hi"}]}`)
+
+	out, err := mw.Invoke(context.Background(), &middleware.Input{
+		URL:  "/v1/chat/completions",
+		Body: body,
+	})
+	require.NoError(t, err)
+
+	stream, ok := metaValue(t, out.Metadata, middleware.KeyLLMStream)
+	require.True(t, ok, "stream metadata must be set")
+	assert.Equal(t, "true", stream, "stream flag echoed for SSE-bound request")
+}
+
+func TestInvoke_AnthropicMessages(t *testing.T) {
+	mw := newMiddleware(t)
+	body := []byte(`{"model":"claude-sonnet-4-5","stream":false,"messages":[{"role":"user","content":"What is the weather?"}]}`)
+
+	out, err := mw.Invoke(context.Background(), &middleware.Input{
+		URL:  "/v1/messages",
+		Body: body,
+	})
+	require.NoError(t, err)
+
+	provider, ok := metaValue(t, out.Metadata, middleware.KeyLLMProvider)
+	require.True(t, ok, "provider metadata must be set")
+	assert.Equal(t, "anthropic", provider, "Anthropic provider detected from path")
+
+	model, _ := metaValue(t, out.Metadata, middleware.KeyLLMModel)
+	assert.Equal(t, "claude-sonnet-4-5", model, "anthropic model echoed")
+
+	prompt, ok := metaValue(t, out.Metadata, middleware.KeyLLMRequestPromptRaw)
+	require.True(t, ok, "prompt metadata must be set")
+	assert.Contains(t, prompt, "What is the weather?", "anthropic message text extracted")
+}
+
+func TestInvoke_UnknownURLNoMetadata(t *testing.T) {
+	mw := newMiddleware(t)
+	out, err := mw.Invoke(context.Background(), &middleware.Input{
+		URL:  "/healthz",
+		Body: []byte(`{"model":"x"}`),
+	})
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "unknown paths still allow")
+	assert.Empty(t, out.Metadata, "no metadata is emitted when no parser matches")
+}
+
+func TestInvoke_ProviderIDConfigBypassesURLSniff(t *testing.T) {
+	mw, err := Factory{}.New([]byte(`{"provider_id":"openai"}`))
+	require.NoError(t, err, "factory must accept provider_id config")
+
+	// URL doesn't match any of the OpenAI path hints — the provider_id
+	// config is the only signal the middleware has.
+	out, err := mw.Invoke(context.Background(), &middleware.Input{
+		URL:  "/custom/gateway/foo/bar",
+		Body: []byte(`{"model":"gpt-4o-mini","messages":[{"role":"user","content":"Hi"}]}`),
+	})
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision)
+
+	provider, ok := metaValue(t, out.Metadata, middleware.KeyLLMProvider)
+	require.True(t, ok, "provider must be emitted when provider_id is configured even on unknown URLs")
+	assert.Equal(t, "openai", provider, "provider_id config selects the OpenAI parser")
+
+	model, ok := metaValue(t, out.Metadata, middleware.KeyLLMModel)
+	require.True(t, ok, "model still extracted from the body")
+	assert.Equal(t, "gpt-4o-mini", model)
+}
+
+func TestInvoke_UnknownProviderIDFallsBackToURL(t *testing.T) {
+	mw, err := Factory{}.New([]byte(`{"provider_id":"not-a-real-parser"}`))
+	require.NoError(t, err, "factory must accept any provider_id string")
+
+	// URL hits the OpenAI surface, so URL sniffing should still resolve
+	// even though the configured provider_id doesn't match a parser.
+	out, err := mw.Invoke(context.Background(), &middleware.Input{
+		URL:  "/v1/chat/completions",
+		Body: []byte(`{"model":"gpt-4o-mini"}`),
+	})
+	require.NoError(t, err)
+	require.NotNil(t, out)
+
+	provider, ok := metaValue(t, out.Metadata, middleware.KeyLLMProvider)
+	require.True(t, ok, "fallback URL sniffing must populate the provider")
+	assert.Equal(t, "openai", provider)
+}
+
+func TestInvoke_MalformedBodyAllowsWithProvider(t *testing.T) {
+	mw := newMiddleware(t)
+	out, err := mw.Invoke(context.Background(), &middleware.Input{
+		URL:  "/v1/chat/completions",
+		Body: []byte(`{not json`),
+	})
+	require.NoError(t, err, "malformed body must not error")
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "decision is always allow")
+
+	provider, ok := metaValue(t, out.Metadata, middleware.KeyLLMProvider)
+	require.True(t, ok, "provider metadata is emitted before body parse")
+	assert.Equal(t, "openai", provider, "provider stays even when body parse fails")
+
+	_, hasModel := metaValue(t, out.Metadata, middleware.KeyLLMModel)
+	assert.False(t, hasModel, "no model metadata when parse fails")
+
+	truncated, ok := metaValue(t, out.Metadata, middleware.KeyLLMCaptureTruncated)
+	require.True(t, ok, "capture_truncated is emitted on parse error path")
+	assert.Equal(t, "false", truncated, "no truncation marker without truncated body or prompt")
+}
+
+func TestInvoke_TruncatesLongPrompt(t *testing.T) {
+	mw := newMiddleware(t)
+	long := strings.Repeat("x", maxPromptBytes*2)
+	body := []byte(`{"model":"gpt-4o-mini","messages":[{"role":"user","content":"` + long + `"}]}`)
+
+	out, err := mw.Invoke(context.Background(), &middleware.Input{
+		URL:  "/v1/chat/completions",
+		Body: body,
+	})
+	require.NoError(t, err)
+
+	prompt, ok := metaValue(t, out.Metadata, middleware.KeyLLMRequestPromptRaw)
+	require.True(t, ok, "prompt metadata must be set")
+	assert.LessOrEqual(t, len(prompt), maxPromptBytes, "prompt must respect the byte budget")
+
+	truncated, ok := metaValue(t, out.Metadata, middleware.KeyLLMCaptureTruncated)
+	require.True(t, ok, "capture_truncated must be set")
+	assert.Equal(t, "true", truncated, "truncation marker raised when prompt is clipped")
+}
+
+func TestInvoke_TruncatesOnRuneBoundary(t *testing.T) {
+	mw := newMiddleware(t)
+	// Each ☃ is 3 bytes in UTF-8; build a string whose byte length exceeds
+	// maxPromptBytes with snowmen straddling the cut point.
+	rune3 := "☃"
+	repeats := (maxPromptBytes / len(rune3)) + 5
+	long := strings.Repeat(rune3, repeats)
+	body := []byte(`{"model":"gpt-4o-mini","messages":[{"role":"user","content":"` + long + `"}]}`)
+
+	out, err := mw.Invoke(context.Background(), &middleware.Input{
+		URL:  "/v1/chat/completions",
+		Body: body,
+	})
+	require.NoError(t, err)
+
+	prompt, ok := metaValue(t, out.Metadata, middleware.KeyLLMRequestPromptRaw)
+	require.True(t, ok, "prompt metadata must be set")
+	assert.LessOrEqual(t, len(prompt), maxPromptBytes, "prompt must respect the byte budget")
+	assert.True(t, strings.HasSuffix(prompt, rune3) || !strings.ContainsRune(prompt[len(prompt)-1:], 0xFFFD),
+		"truncation must not split a multi-byte rune")
+}
+
+func TestInvoke_BodyTruncatedRaisesCaptureTruncated(t *testing.T) {
+	mw := newMiddleware(t)
+	body := []byte(`{"model":"gpt-4o-mini","messages":[{"role":"user","content":"hi"}]}`)
+
+	out, err := mw.Invoke(context.Background(), &middleware.Input{
+		URL:           "/v1/chat/completions",
+		Body:          body,
+		BodyTruncated: true,
+	})
+	require.NoError(t, err)
+
+	truncated, ok := metaValue(t, out.Metadata, middleware.KeyLLMCaptureTruncated)
+	require.True(t, ok, "capture_truncated must be set")
+	assert.Equal(t, "true", truncated, "BodyTruncated input flips the marker even when prompt fits")
+}
+
+// TestInvoke_RedactPii_RedactsBeforeEmittingRawPrompt covers the GC contract:
+// when the synthesiser sets redact_pii=true on the parser config, the value
+// emitted as llm.request_prompt_raw must already be redacted, so the
+// access-log row never carries raw emails / SSNs / phones — even though the
+// downstream llm_guardrail middleware also runs.
+func TestInvoke_RedactPii_RedactsBeforeEmittingRawPrompt(t *testing.T) {
+	mw, err := Factory{}.New([]byte(`{"redact_pii":true}`))
+	require.NoError(t, err)
+
+	body := []byte(`{"model":"gpt-4o-mini","stream":false,"messages":[{"role":"user","content":"contact alice.johnson@example.com SSN 123-45-6789 phone (202) 555-0147 and bob 202/555/0108"}]}`)
+	out, err := mw.Invoke(context.Background(), &middleware.Input{URL: "/v1/chat/completions", Body: body})
+	require.NoError(t, err)
+	require.NotNil(t, out)
+
+	raw, ok := metaValue(t, out.Metadata, middleware.KeyLLMRequestPromptRaw)
+	require.True(t, ok, "raw prompt key must still be emitted")
+	assert.Contains(t, raw, "[REDACTED:email]", "email must be redacted before emit")
+	assert.Contains(t, raw, "[REDACTED:ssn]", "ssn must be redacted before emit")
+	assert.Contains(t, raw, "[REDACTED:phone]", "phone must be redacted before emit")
+	assert.NotContains(t, raw, "alice.johnson@example.com", "raw email must not survive")
+	assert.NotContains(t, raw, "123-45-6789", "raw SSN must not survive")
+	assert.NotContains(t, raw, "(202) 555-0147", "parenthesised phone must not survive")
+	assert.NotContains(t, raw, "202/555/0108", "slash-separated phone must not survive")
+}
+
+// TestInvoke_CapturePromptOff_DoesNotEmitRawPrompt covers the contract for
+// the account-level enable_prompt_collection toggle: when the synthesiser sets
+// capture_prompt=false (operator hasn't opted in to prompt content), the
+// parser MUST NOT emit llm.request_prompt_raw at all — otherwise the access
+// log carries the user's input even though log collection is meant to be
+// metadata-only (provider, model, tokens, cost). The other facts the parser
+// emits (provider, model, stream, capture_truncated) stay.
+func TestInvoke_CapturePromptOff_DoesNotEmitRawPrompt(t *testing.T) {
+	mw, err := Factory{}.New([]byte(`{"capture_prompt":false}`))
+	require.NoError(t, err)
+	body := []byte(`{"model":"gpt-4o","messages":[{"role":"user","content":"contact alice@example.com SSN 123-45-6789"}]}`)
+	out, err := mw.Invoke(context.Background(), &middleware.Input{URL: "/v1/chat/completions", Body: body})
+	require.NoError(t, err)
+	require.NotNil(t, out)
+
+	_, ok := metaValue(t, out.Metadata, middleware.KeyLLMRequestPromptRaw)
+	assert.False(t, ok, "llm.request_prompt_raw must NOT be emitted when capture_prompt is false")
+	// Non-content facts must still flow.
+	_, ok = metaValue(t, out.Metadata, middleware.KeyLLMModel)
+	assert.True(t, ok, "model fact must still be emitted")
+	_, ok = metaValue(t, out.Metadata, middleware.KeyLLMProvider)
+	assert.True(t, ok, "provider fact must still be emitted")
+}
+
+// TestInvoke_CapturePromptUnset_PreservesLegacyEmission documents the default
+// behavior: an empty / legacy config (no capture_prompt field) keeps the
+// existing emission, so non-agent-network callers and pre-toggle tests don't
+// suddenly lose data.
+func TestInvoke_CapturePromptUnset_PreservesLegacyEmission(t *testing.T) {
+	mw, err := Factory{}.New([]byte(`{}`))
+	require.NoError(t, err)
+	body := []byte(`{"model":"gpt-4o","messages":[{"role":"user","content":"hello"}]}`)
+	out, err := mw.Invoke(context.Background(), &middleware.Input{URL: "/v1/chat/completions", Body: body})
+	require.NoError(t, err)
+	_, ok := metaValue(t, out.Metadata, middleware.KeyLLMRequestPromptRaw)
+	assert.True(t, ok, "absent capture_prompt must preserve emission (backwards-compatible default)")
+}
+
+// TestInvoke_RedactPii_OffShipsRawPrompt is the inverse: when redact_pii is
+// false (default) the operator opted out and the raw prompt is shipped
+// verbatim, so audit / debugging consumers still get the full body.
+func TestInvoke_RedactPii_OffShipsRawPrompt(t *testing.T) {
+	mw, err := Factory{}.New([]byte(`{}`))
+	require.NoError(t, err)
+
+	body := []byte(`{"model":"gpt-4o-mini","messages":[{"role":"user","content":"alice.johnson@example.com"}]}`)
+	out, err := mw.Invoke(context.Background(), &middleware.Input{URL: "/v1/chat/completions", Body: body})
+	require.NoError(t, err)
+
+	raw, ok := metaValue(t, out.Metadata, middleware.KeyLLMRequestPromptRaw)
+	require.True(t, ok)
+	assert.Contains(t, raw, "alice.johnson@example.com", "redact off → raw email passes through")
+	assert.NotContains(t, raw, "[REDACTED:", "redact off → no markers")
+}
+
+func TestInvoke_NilInputAllows(t *testing.T) {
+	mw := newMiddleware(t)
+	out, err := mw.Invoke(context.Background(), nil)
+	require.NoError(t, err, "nil input must not panic or error")
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "nil input still allows")
+	assert.Empty(t, out.Metadata, "nil input emits no metadata")
+}
diff --git a/proxy/internal/middleware/builtin/llm_response_parser/factory.go b/proxy/internal/middleware/builtin/llm_response_parser/factory.go
new file mode 100644
index 000000000..e7d634109
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_response_parser/factory.go
@@ -0,0 +1,43 @@
+package llm_response_parser
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin"
+)
+
+// Factory constructs configured Middleware instances for the registry.
+type Factory struct{}
+
+// ID returns the registry identifier.
+func (Factory) ID() string { return ID }
+
+// New decodes RawConfig (empty / null / "{}" all accepted) and returns
+// a configured Middleware. Construction never fails on a well-formed
+// empty config; only structurally invalid JSON is rejected.
+func (Factory) New(rawConfig []byte) (middleware.Middleware, error) {
+	cfg, err := decodeConfig(rawConfig)
+	if err != nil {
+		return nil, fmt.Errorf("decode config: %w", err)
+	}
+	return New(cfg), nil
+}
+
+func decodeConfig(raw []byte) (config, error) {
+	trimmed := bytes.TrimSpace(raw)
+	if len(trimmed) == 0 || bytes.Equal(trimmed, []byte("null")) {
+		return config{}, nil
+	}
+	var cfg config
+	if err := json.Unmarshal(trimmed, &cfg); err != nil {
+		return config{}, err
+	}
+	return cfg, nil
+}
+
+func init() {
+	builtin.Register(Factory{})
+}
diff --git a/proxy/internal/middleware/builtin/llm_response_parser/gzip_test.go b/proxy/internal/middleware/builtin/llm_response_parser/gzip_test.go
new file mode 100644
index 000000000..017153e4c
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_response_parser/gzip_test.go
@@ -0,0 +1,133 @@
+package llm_response_parser
+
+import (
+	"bytes"
+	"compress/flate"
+	"compress/gzip"
+	"compress/zlib"
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+)
+
+// gzipBytes returns data gzip-compressed — the wire shape Anthropic
+// returns when the client (Claude Code) negotiated Accept-Encoding: gzip.
+func gzipBytes(t *testing.T, data []byte) []byte {
+	t.Helper()
+	var buf bytes.Buffer
+	w := gzip.NewWriter(&buf)
+	_, err := w.Write(data)
+	require.NoError(t, err, "gzip write must succeed")
+	require.NoError(t, w.Close(), "gzip close must succeed")
+	return buf.Bytes()
+}
+
+// TestInvoke_AnthropicStreaming_Gzip is the regression guard for the live
+// bug: Claude Code negotiates gzip, Anthropic gzips the SSE stream, the
+// proxy captures the compressed bytes, and the parser must decompress
+// before accumulating — otherwise token usage is silently dropped and
+// cost_meter skips with missing_tokens.
+func TestInvoke_AnthropicStreaming_Gzip(t *testing.T) {
+	m := newTestMiddleware(t)
+	body := gzipBytes(t, loadFixture(t, "anthropic_stream.txt"))
+
+	in := &middleware.Input{
+		Slot:   middleware.SlotOnResponse,
+		Status: 200,
+		RespHeaders: []middleware.KV{
+			{Key: "Content-Type", Value: "text/event-stream; charset=utf-8"},
+			{Key: "Content-Encoding", Value: "gzip"},
+		},
+		RespBody: body,
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMProvider, Value: "anthropic"},
+			{Key: middleware.KeyLLMModel, Value: "claude-opus-4-8"},
+		},
+	}
+
+	out, err := m.Invoke(context.Background(), in)
+	require.NoError(t, err, "Invoke must not error on a gzip-encoded streaming body")
+
+	in123, ok := metaValue(out.Metadata, middleware.KeyLLMInputTokens)
+	require.True(t, ok, "input tokens must be emitted from a gzip SSE stream")
+	assert.Equal(t, "123", in123, "input tokens must survive gzip decompression")
+
+	outTok, _ := metaValue(out.Metadata, middleware.KeyLLMOutputTokens)
+	assert.Equal(t, "45", outTok, "output tokens must survive gzip decompression")
+
+	totTok, _ := metaValue(out.Metadata, middleware.KeyLLMTotalTokens)
+	assert.Equal(t, "168", totTok, "total tokens must survive gzip decompression")
+}
+
+// TestInvoke_AnthropicBuffered_Gzip covers the non-streaming JSON path
+// under gzip — the same decode must happen before ParseResponse.
+func TestInvoke_AnthropicBuffered_Gzip(t *testing.T) {
+	m := newTestMiddleware(t)
+	body := gzipBytes(t, loadFixture(t, "anthropic_messages.json"))
+
+	in := &middleware.Input{
+		Slot:   middleware.SlotOnResponse,
+		Status: 200,
+		RespHeaders: []middleware.KV{
+			{Key: "Content-Type", Value: "application/json"},
+			{Key: "Content-Encoding", Value: "gzip"},
+		},
+		RespBody: body,
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMProvider, Value: "anthropic"},
+			{Key: middleware.KeyLLMModel, Value: "claude-opus-4-8"},
+		},
+	}
+
+	out, err := m.Invoke(context.Background(), in)
+	require.NoError(t, err, "Invoke must not error on a gzip-encoded buffered body")
+
+	_, ok := metaValue(out.Metadata, middleware.KeyLLMInputTokens)
+	require.True(t, ok, "input tokens must be emitted from a gzip JSON body")
+}
+
+// TestDecodeResponseBody covers the encoding matrix directly.
+func TestDecodeResponseBody(t *testing.T) {
+	plain := []byte(`{"hello":"world"}`)
+
+	t.Run("identity passthrough", func(t *testing.T) {
+		assert.Equal(t, plain, decodeResponseBody(plain, ""))
+		assert.Equal(t, plain, decodeResponseBody(plain, "identity"))
+	})
+
+	t.Run("gzip", func(t *testing.T) {
+		assert.Equal(t, plain, decodeResponseBody(gzipBytes(t, plain), "gzip"))
+	})
+
+	t.Run("gzip with multi-coding header takes outermost", func(t *testing.T) {
+		assert.Equal(t, plain, decodeResponseBody(gzipBytes(t, plain), "identity, gzip"))
+	})
+
+	t.Run("deflate zlib-wrapped", func(t *testing.T) {
+		var buf bytes.Buffer
+		zw := zlib.NewWriter(&buf)
+		_, _ = zw.Write(plain)
+		_ = zw.Close()
+		assert.Equal(t, plain, decodeResponseBody(buf.Bytes(), "deflate"))
+	})
+
+	t.Run("deflate raw flate fallback", func(t *testing.T) {
+		var buf bytes.Buffer
+		fw, _ := flate.NewWriter(&buf, flate.DefaultCompression)
+		_, _ = fw.Write(plain)
+		_ = fw.Close()
+		assert.Equal(t, plain, decodeResponseBody(buf.Bytes(), "deflate"))
+	})
+
+	t.Run("gzip header but not actually gzip falls back to raw", func(t *testing.T) {
+		assert.Equal(t, plain, decodeResponseBody(plain, "gzip"))
+	})
+
+	t.Run("unknown encoding (br) returns raw", func(t *testing.T) {
+		assert.Equal(t, plain, decodeResponseBody(plain, "br"))
+	})
+}
diff --git a/proxy/internal/middleware/builtin/llm_response_parser/middleware.go b/proxy/internal/middleware/builtin/llm_response_parser/middleware.go
new file mode 100644
index 000000000..a204460cb
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_response_parser/middleware.go
@@ -0,0 +1,339 @@
+// Package llm_response_parser implements the SlotOnResponse middleware
+// that decodes OpenAI- and Anthropic-shaped LLM responses (buffered or
+// streaming) and emits token usage and completion metadata. Provider
+// and model are read from the request-side metadata bag emitted by
+// llm_request_parser; without that context the middleware is a no-op.
+package llm_response_parser
+
+import (
+	"bytes"
+	"compress/flate"
+	"compress/gzip"
+	"compress/zlib"
+	"context"
+	"io"
+	"strconv"
+	"strings"
+	"unicode/utf8"
+
+	"github.com/netbirdio/netbird/proxy/internal/llm"
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_guardrail"
+)
+
+// ID is the registry identifier for this middleware.
+const ID = "llm_response_parser"
+
+const version = "1.0.0"
+
+// maxCompletionBytes is the rune-safe cap applied to the extracted
+// completion text before emitting it as metadata.
+const maxCompletionBytes = 3500
+
+// maxDecodedBytes bounds the inflated size of a compressed response body
+// so a small gzip/deflate payload can't expand into a memory blow-up. The
+// captured input is already capped (per-direction body cap), so this only
+// bounds the decompression ratio; the parser is best-effort and tolerates a
+// truncated decode.
+const maxDecodedBytes = 16 << 20
+
+var (
+	acceptedContentTypes = []string{"application/json", "text/event-stream"}
+	metadataKeys         = []string{
+		middleware.KeyLLMInputTokens,
+		middleware.KeyLLMOutputTokens,
+		middleware.KeyLLMTotalTokens,
+		middleware.KeyLLMCachedInputTokens,
+		middleware.KeyLLMCacheCreationTokens,
+		middleware.KeyLLMResponseCompletion,
+	}
+)
+
+// config is the wire-side configuration for this middleware. RedactPii, when
+// true, runs PII redaction on the extracted completion text BEFORE it is
+// emitted as llm.response_completion — keeping the access-log row free of
+// emails / SSNs / phone numbers the model itself generated. CaptureCompletion
+// gates emission of the completion key entirely: a nil pointer preserves
+// legacy emission (so callers without the toggle aren't broken), an explicit
+// false suppresses the key so the access-log row carries token / cost facts
+// only. Both are sourced by the synthesiser from the account's redact_pii
+// and enable_prompt_collection toggles respectively.
+type config struct {
+	RedactPii         bool  `json:"redact_pii,omitempty"`
+	CaptureCompletion *bool `json:"capture_completion,omitempty"`
+}
+
+// Middleware implements middleware.Middleware.
+type Middleware struct {
+	parsers           []llm.Parser
+	redactPii         bool
+	captureCompletion bool
+}
+
+// New constructs a configured Middleware instance.
+func New(cfg config) *Middleware {
+	capture := true
+	if cfg.CaptureCompletion != nil {
+		capture = *cfg.CaptureCompletion
+	}
+	return &Middleware{parsers: llm.Parsers(), redactPii: cfg.RedactPii, captureCompletion: capture}
+}
+
+// ID returns the registry identifier.
+func (m *Middleware) ID() string { return ID }
+
+// Version returns the implementation version.
+func (m *Middleware) Version() string { return version }
+
+// Slot reports that the middleware runs after the upstream call.
+func (m *Middleware) Slot() middleware.Slot { return middleware.SlotOnResponse }
+
+// AcceptedContentTypes lists the response content types the middleware
+// inspects.
+func (m *Middleware) AcceptedContentTypes() []string {
+	return append([]string(nil), acceptedContentTypes...)
+}
+
+// MetadataKeys returns the closed allowlist of keys this middleware
+// may emit.
+func (m *Middleware) MetadataKeys() []string {
+	return append([]string(nil), metadataKeys...)
+}
+
+// MutationsSupported reports that this middleware never mutates the
+// response.
+func (m *Middleware) MutationsSupported() bool { return false }
+
+// Close releases any resources held by the middleware. The parser-set
+// is stateless so this is a no-op.
+func (m *Middleware) Close() error { return nil }
+
+// Invoke decodes the response body and emits token-usage and completion
+// metadata. The decision is always DecisionAllow; parse errors degrade
+// silently to omitted metadata rather than chain failures.
+func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middleware.Output, error) {
+	out := &middleware.Output{Decision: middleware.DecisionAllow}
+	if in == nil {
+		return out, nil
+	}
+
+	provider := lookupKV(in.Metadata, middleware.KeyLLMProvider)
+	if provider == "" {
+		return out, nil
+	}
+
+	parser := m.parserByName(provider)
+	if parser == nil {
+		return out, nil
+	}
+
+	// Upstreams compress the response when the client negotiated it
+	// (Claude Code sends Accept-Encoding: gzip). The transport leaves it
+	// compressed because the request carried an explicit Accept-Encoding,
+	// so the captured copy is gzip/deflate bytes — decompress it before
+	// parsing or token usage is silently lost. The forwarded client
+	// stream is untouched; this only affects our parse copy.
+	body := decodeResponseBody(in.RespBody, headerLookup(in.RespHeaders, "Content-Encoding"))
+
+	contentType := headerLookup(in.RespHeaders, "Content-Type")
+	switch {
+	case isEventStream(contentType), isAWSEventStream(contentType):
+		out.Metadata = m.invokeStreaming(parser, body)
+	case isJSON(contentType):
+		out.Metadata = m.invokeBuffered(parser, in, contentType, body)
+	}
+
+	return out, nil
+}
+
+// invokeBuffered decodes a non-streaming JSON response body. Status
+// codes >= 400 short-circuit because providers don't include usage on
+// error responses.
+func (m *Middleware) invokeBuffered(parser llm.Parser, in *middleware.Input, contentType string, body []byte) []middleware.KV {
+	if in.Status >= 400 {
+		return nil
+	}
+
+	var md []middleware.KV
+
+	usage, err := parser.ParseResponse(in.Status, contentType, body)
+	if err == nil {
+		md = appendUsage(md, usage)
+	}
+
+	if completion := truncateCompletion(parser.ExtractCompletion(in.Status, contentType, body)); completion != "" && m.captureCompletion {
+		if m.redactPii {
+			completion = llm_guardrail.RedactPII(completion)
+		}
+		md = append(md, middleware.KV{Key: middleware.KeyLLMResponseCompletion, Value: completion})
+	}
+
+	return md
+}
+
+// invokeStreaming walks the buffered SSE prefix and accumulates token
+// deltas plus completion text. Truncated bodies are processed
+// best-effort; partial usage is preferred over no metadata.
+func (m *Middleware) invokeStreaming(parser llm.Parser, body []byte) []middleware.KV {
+	if len(body) == 0 {
+		return nil
+	}
+
+	usage, completion := accumulateStream(parser.ProviderName(), body)
+
+	var md []middleware.KV
+	if usage.InputTokens > 0 || usage.OutputTokens > 0 || usage.TotalTokens > 0 {
+		md = appendUsage(md, usage)
+	}
+	if c := truncateCompletion(completion); c != "" && m.captureCompletion {
+		if m.redactPii {
+			c = llm_guardrail.RedactPII(c)
+		}
+		md = append(md, middleware.KV{Key: middleware.KeyLLMResponseCompletion, Value: c})
+	}
+	return md
+}
+
+// parserByName returns the parser matching the provider label emitted
+// by llm_request_parser, or nil when none claims it.
+func (m *Middleware) parserByName(name string) llm.Parser {
+	for _, p := range m.parsers {
+		if p.ProviderName() == name {
+			return p
+		}
+	}
+	return nil
+}
+
+// appendUsage emits the three baseline token-count metadata keys plus
+// optional cached / cache-creation bucket counts when nonzero. Total
+// is computed when the provider omitted one but reported per-direction
+// counts; cache buckets are excluded from the legacy total because
+// llm.input_tokens already absorbs the OpenAI cached subset and the
+// sum-of-everything is a separate downstream concern.
+func appendUsage(md []middleware.KV, usage llm.Usage) []middleware.KV {
+	total := usage.TotalTokens
+	if total == 0 && (usage.InputTokens > 0 || usage.OutputTokens > 0) {
+		total = usage.InputTokens + usage.OutputTokens
+	}
+	md = append(md,
+		middleware.KV{Key: middleware.KeyLLMInputTokens, Value: strconv.FormatInt(usage.InputTokens, 10)},
+		middleware.KV{Key: middleware.KeyLLMOutputTokens, Value: strconv.FormatInt(usage.OutputTokens, 10)},
+		middleware.KV{Key: middleware.KeyLLMTotalTokens, Value: strconv.FormatInt(total, 10)},
+	)
+	if usage.CachedInputTokens > 0 {
+		md = append(md, middleware.KV{
+			Key:   middleware.KeyLLMCachedInputTokens,
+			Value: strconv.FormatInt(usage.CachedInputTokens, 10),
+		})
+	}
+	if usage.CacheCreationTokens > 0 {
+		md = append(md, middleware.KV{
+			Key:   middleware.KeyLLMCacheCreationTokens,
+			Value: strconv.FormatInt(usage.CacheCreationTokens, 10),
+		})
+	}
+	return md
+}
+
+// truncateCompletion clamps an extracted completion to maxCompletionBytes.
+// The cut is rune-safe so we never split a multi-byte UTF-8 sequence.
+func truncateCompletion(s string) string {
+	if len(s) <= maxCompletionBytes {
+		return s
+	}
+	cut := maxCompletionBytes
+	for cut > 0 && !utf8.RuneStart(s[cut]) {
+		cut--
+	}
+	return s[:cut]
+}
+
+func lookupKV(kvs []middleware.KV, key string) string {
+	for _, kv := range kvs {
+		if kv.Key == key {
+			return kv.Value
+		}
+	}
+	return ""
+}
+
+func headerLookup(h []middleware.KV, name string) string {
+	lower := strings.ToLower(name)
+	for _, kv := range h {
+		if strings.ToLower(kv.Key) == lower {
+			return kv.Value
+		}
+	}
+	return ""
+}
+
+func isEventStream(contentType string) bool {
+	return strings.Contains(strings.ToLower(contentType), "text/event-stream")
+}
+
+// isAWSEventStream reports whether contentType is the AWS binary event-stream
+// framing used by Bedrock's streaming endpoints.
+func isAWSEventStream(contentType string) bool {
+	return strings.Contains(strings.ToLower(contentType), "application/vnd.amazon.eventstream")
+}
+
+func isJSON(contentType string) bool {
+	lower := strings.ToLower(contentType)
+	return strings.Contains(lower, "application/json") || strings.Contains(lower, "+json")
+}
+
+// decodeResponseBody returns body decompressed per its Content-Encoding,
+// or the original bytes when the encoding is identity, unrecognised
+// (e.g. br — no stdlib decoder), or the body isn't actually compressed.
+// Decoding is best-effort: a truncated stream (capture hit the byte cap)
+// yields the decompressed prefix rather than an error, which is enough to
+// recover the leading message_start usage on Anthropic SSE.
+func decodeResponseBody(body []byte, contentEncoding string) []byte {
+	enc := strings.ToLower(strings.TrimSpace(contentEncoding))
+	// Content-Encoding may list multiple codings; the last applied is
+	// the outermost on the wire.
+	if idx := strings.LastIndex(enc, ","); idx >= 0 {
+		enc = strings.TrimSpace(enc[idx+1:])
+	}
+	switch enc {
+	case "", "identity":
+		return body
+	case "gzip", "x-gzip":
+		zr, err := gzip.NewReader(bytes.NewReader(body))
+		if err != nil {
+			return body
+		}
+		defer zr.Close()
+		if out := readCapped(zr); len(out) > 0 {
+			return out
+		}
+		return body
+	case "deflate":
+		// "deflate" on the wire is usually zlib-wrapped; fall back to raw
+		// flate when there's no zlib header.
+		if zr, err := zlib.NewReader(bytes.NewReader(body)); err == nil {
+			defer zr.Close()
+			if out := readCapped(zr); len(out) > 0 {
+				return out
+			}
+			return body
+		}
+		fr := flate.NewReader(bytes.NewReader(body))
+		defer fr.Close()
+		if out := readCapped(fr); len(out) > 0 {
+			return out
+		}
+		return body
+	default:
+		return body
+	}
+}
+
+// readCapped reads at most maxDecodedBytes from r, discarding any excess.
+// Best-effort: a read error returns whatever was decoded so far, which is
+// enough for the parser to recover leading usage events.
+func readCapped(r io.Reader) []byte {
+	out, _ := io.ReadAll(io.LimitReader(r, maxDecodedBytes))
+	return out
+}
diff --git a/proxy/internal/middleware/builtin/llm_response_parser/middleware_test.go b/proxy/internal/middleware/builtin/llm_response_parser/middleware_test.go
new file mode 100644
index 000000000..084118802
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_response_parser/middleware_test.go
@@ -0,0 +1,433 @@
+package llm_response_parser
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+)
+
+func loadFixture(t *testing.T, name string) []byte {
+	t.Helper()
+	root, err := os.Getwd()
+	require.NoError(t, err, "must resolve cwd to locate fixture")
+
+	dir := root
+	for i := 0; i < 8; i++ {
+		candidate := filepath.Join(dir, "proxy", "internal", "llm", "fixtures", name)
+		if data, err := os.ReadFile(candidate); err == nil {
+			return data
+		}
+		parent := filepath.Dir(dir)
+		if parent == dir {
+			break
+		}
+		dir = parent
+	}
+	t.Fatalf("fixture %q not found relative to %q", name, root)
+	return nil
+}
+
+func metaValue(kvs []middleware.KV, key string) (string, bool) {
+	for _, kv := range kvs {
+		if kv.Key == key {
+			return kv.Value, true
+		}
+	}
+	return "", false
+}
+
+func newTestMiddleware(t *testing.T) *Middleware {
+	t.Helper()
+	mw, err := Factory{}.New(nil)
+	require.NoError(t, err, "factory must accept empty config")
+	concrete, ok := mw.(*Middleware)
+	require.True(t, ok, "factory must return *Middleware")
+	return concrete
+}
+
+func TestMiddleware_StaticSurface(t *testing.T) {
+	m := newTestMiddleware(t)
+	assert.Equal(t, ID, m.ID(), "ID must match registry constant")
+	assert.Equal(t, "1.0.0", m.Version(), "Version must be 1.0.0")
+	assert.Equal(t, middleware.SlotOnResponse, m.Slot(), "Slot must be SlotOnResponse")
+	assert.False(t, m.MutationsSupported(), "response parser does not mutate")
+	assert.ElementsMatch(t,
+		[]string{"application/json", "text/event-stream"},
+		m.AcceptedContentTypes(),
+		"AcceptedContentTypes must list JSON and SSE",
+	)
+	assert.ElementsMatch(t,
+		[]string{
+			middleware.KeyLLMInputTokens,
+			middleware.KeyLLMOutputTokens,
+			middleware.KeyLLMTotalTokens,
+			middleware.KeyLLMCachedInputTokens,
+			middleware.KeyLLMCacheCreationTokens,
+			middleware.KeyLLMResponseCompletion,
+		},
+		m.MetadataKeys(),
+		"MetadataKeys must be the documented response-side keys, including the optional cache buckets emitted only when nonzero",
+	)
+	require.NoError(t, m.Close(), "Close must be a no-op")
+}
+
+func TestFactory_AcceptsEmptyAndNullConfig(t *testing.T) {
+	for name, raw := range map[string][]byte{
+		"nil":   nil,
+		"empty": {},
+		"null":  []byte("null"),
+		"obj":   []byte("{}"),
+		"ws":    []byte("   "),
+	} {
+		t.Run(name, func(t *testing.T) {
+			mw, err := Factory{}.New(raw)
+			require.NoError(t, err, "factory must accept %s config", name)
+			require.NotNil(t, mw, "factory must return middleware for %s", name)
+		})
+	}
+}
+
+func TestFactory_RejectsMalformedJSON(t *testing.T) {
+	_, err := Factory{}.New([]byte("not-json"))
+	require.Error(t, err, "malformed config must surface a decode error")
+}
+
+func TestInvoke_OpenAIBuffered(t *testing.T) {
+	m := newTestMiddleware(t)
+	body := loadFixture(t, "openai_chat_completion.json")
+
+	in := &middleware.Input{
+		Slot:        middleware.SlotOnResponse,
+		Status:      200,
+		RespHeaders: []middleware.KV{{Key: "Content-Type", Value: "application/json"}},
+		RespBody:    body,
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMProvider, Value: "openai"},
+			{Key: middleware.KeyLLMModel, Value: "gpt-4o-mini"},
+		},
+	}
+
+	out, err := m.Invoke(context.Background(), in)
+	require.NoError(t, err, "Invoke must not error on a valid buffered response")
+	require.Equal(t, middleware.DecisionAllow, out.Decision, "decision must be Allow")
+
+	in123, ok := metaValue(out.Metadata, middleware.KeyLLMInputTokens)
+	require.True(t, ok, "input tokens must be emitted")
+	assert.Equal(t, "123", in123, "input tokens must match fixture prompt_tokens")
+
+	outTok, ok := metaValue(out.Metadata, middleware.KeyLLMOutputTokens)
+	require.True(t, ok, "output tokens must be emitted")
+	assert.Equal(t, "45", outTok, "output tokens must match fixture completion_tokens")
+
+	totTok, ok := metaValue(out.Metadata, middleware.KeyLLMTotalTokens)
+	require.True(t, ok, "total tokens must be emitted")
+	assert.Equal(t, "168", totTok, "total tokens must match fixture")
+
+	completion, ok := metaValue(out.Metadata, middleware.KeyLLMResponseCompletion)
+	require.True(t, ok, "completion must be emitted")
+	assert.Equal(t, "Hello, world!", completion, "completion text must match fixture")
+}
+
+func TestInvoke_AnthropicBuffered(t *testing.T) {
+	m := newTestMiddleware(t)
+	body := loadFixture(t, "anthropic_messages.json")
+
+	in := &middleware.Input{
+		Slot:        middleware.SlotOnResponse,
+		Status:      200,
+		RespHeaders: []middleware.KV{{Key: "Content-Type", Value: "application/json"}},
+		RespBody:    body,
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMProvider, Value: "anthropic"},
+			{Key: middleware.KeyLLMModel, Value: "claude-sonnet-4-5"},
+		},
+	}
+
+	out, err := m.Invoke(context.Background(), in)
+	require.NoError(t, err, "Invoke must not error on a valid buffered response")
+	require.Equal(t, middleware.DecisionAllow, out.Decision, "decision must be Allow")
+
+	in123, _ := metaValue(out.Metadata, middleware.KeyLLMInputTokens)
+	assert.Equal(t, "123", in123, "input tokens must match anthropic fixture")
+
+	outTok, _ := metaValue(out.Metadata, middleware.KeyLLMOutputTokens)
+	assert.Equal(t, "45", outTok, "output tokens must match anthropic fixture")
+
+	totTok, _ := metaValue(out.Metadata, middleware.KeyLLMTotalTokens)
+	assert.Equal(t, "168", totTok, "total tokens must be input+output for anthropic")
+
+	completion, ok := metaValue(out.Metadata, middleware.KeyLLMResponseCompletion)
+	require.True(t, ok, "completion must be emitted for anthropic")
+	assert.Equal(t, "Hello, world!", completion, "completion text must match fixture")
+}
+
+// TestInvoke_OpenAICachedTokensSurfaceOnMetadata covers the
+// end-to-end path from the JSON usage block to the
+// llm.cached_input_tokens metadata key the cost meter consumes.
+// llm.cache_creation_tokens is NOT emitted for OpenAI because
+// OpenAI has no cache_creation analogue.
+func TestInvoke_OpenAICachedTokensSurfaceOnMetadata(t *testing.T) {
+	m := newTestMiddleware(t)
+	body := []byte(`{"usage":{"prompt_tokens":1024,"completion_tokens":200,"total_tokens":1224,"prompt_tokens_details":{"cached_tokens":768}}}`)
+
+	in := &middleware.Input{
+		Slot:        middleware.SlotOnResponse,
+		Status:      200,
+		RespHeaders: []middleware.KV{{Key: "Content-Type", Value: "application/json"}},
+		RespBody:    body,
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMProvider, Value: "openai"},
+			{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
+		},
+	}
+
+	out, err := m.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	cached, ok := metaValue(out.Metadata, middleware.KeyLLMCachedInputTokens)
+	require.True(t, ok, "cached_input_tokens must land on the bag when the OpenAI response carries cached_tokens")
+	assert.Equal(t, "768", cached)
+
+	_, hasCreation := metaValue(out.Metadata, middleware.KeyLLMCacheCreationTokens)
+	assert.False(t, hasCreation, "cache_creation_tokens must NOT be emitted for OpenAI — no analogue in the OpenAI shape")
+}
+
+// TestInvoke_AnthropicCacheBucketsSurfaceOnMetadata covers the
+// Anthropic shape: both cache_read and cache_creation values flow
+// onto the metadata bag so the cost meter can apply per-bucket
+// rates.
+func TestInvoke_AnthropicCacheBucketsSurfaceOnMetadata(t *testing.T) {
+	m := newTestMiddleware(t)
+	body := []byte(`{"usage":{"input_tokens":256,"output_tokens":200,"cache_read_input_tokens":768,"cache_creation_input_tokens":512}}`)
+
+	in := &middleware.Input{
+		Slot:        middleware.SlotOnResponse,
+		Status:      200,
+		RespHeaders: []middleware.KV{{Key: "Content-Type", Value: "application/json"}},
+		RespBody:    body,
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMProvider, Value: "anthropic"},
+			{Key: middleware.KeyLLMModel, Value: "claude-sonnet-4-5"},
+		},
+	}
+
+	out, err := m.Invoke(context.Background(), in)
+	require.NoError(t, err)
+
+	cached, ok := metaValue(out.Metadata, middleware.KeyLLMCachedInputTokens)
+	require.True(t, ok, "cache_read_input_tokens lands under cached_input_tokens — same key carries OpenAI cached subset and Anthropic cache reads, meter switches formula on provider")
+	assert.Equal(t, "768", cached)
+
+	creation, ok := metaValue(out.Metadata, middleware.KeyLLMCacheCreationTokens)
+	require.True(t, ok, "cache_creation_input_tokens lands under cache_creation_tokens for Anthropic")
+	assert.Equal(t, "512", creation)
+}
+
+func TestInvoke_NoProviderMetadata_NoOp(t *testing.T) {
+	m := newTestMiddleware(t)
+	in := &middleware.Input{
+		Slot:        middleware.SlotOnResponse,
+		Status:      200,
+		RespHeaders: []middleware.KV{{Key: "Content-Type", Value: "application/json"}},
+		RespBody:    loadFixture(t, "openai_chat_completion.json"),
+	}
+	out, err := m.Invoke(context.Background(), in)
+	require.NoError(t, err, "missing provider metadata is not an error")
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "decision must be Allow")
+	assert.Empty(t, out.Metadata, "no metadata when provider context is missing")
+}
+
+func TestInvoke_UnknownProvider_NoOp(t *testing.T) {
+	m := newTestMiddleware(t)
+	in := &middleware.Input{
+		Slot:        middleware.SlotOnResponse,
+		Status:      200,
+		RespHeaders: []middleware.KV{{Key: "Content-Type", Value: "application/json"}},
+		RespBody:    loadFixture(t, "openai_chat_completion.json"),
+		Metadata:    []middleware.KV{{Key: middleware.KeyLLMProvider, Value: "cohere"}},
+	}
+	out, err := m.Invoke(context.Background(), in)
+	require.NoError(t, err, "unknown provider must not surface an error")
+	assert.Empty(t, out.Metadata, "unknown providers emit no metadata")
+}
+
+func TestInvoke_ErrorStatus_NoUsageEmitted(t *testing.T) {
+	m := newTestMiddleware(t)
+	in := &middleware.Input{
+		Slot:        middleware.SlotOnResponse,
+		Status:      500,
+		RespHeaders: []middleware.KV{{Key: "Content-Type", Value: "application/json"}},
+		RespBody:    []byte(`{"error":{"message":"upstream blew up"}}`),
+		Metadata:    []middleware.KV{{Key: middleware.KeyLLMProvider, Value: "openai"}},
+	}
+	out, err := m.Invoke(context.Background(), in)
+	require.NoError(t, err, "error responses must not surface as middleware error")
+	_, ok := metaValue(out.Metadata, middleware.KeyLLMInputTokens)
+	assert.False(t, ok, "no usage metadata on >=400 responses")
+}
+
+func TestInvoke_NonInspectedContentType_NoOp(t *testing.T) {
+	m := newTestMiddleware(t)
+	in := &middleware.Input{
+		Slot:        middleware.SlotOnResponse,
+		Status:      200,
+		RespHeaders: []middleware.KV{{Key: "Content-Type", Value: "text/plain"}},
+		RespBody:    []byte("not json"),
+		Metadata:    []middleware.KV{{Key: middleware.KeyLLMProvider, Value: "openai"}},
+	}
+	out, err := m.Invoke(context.Background(), in)
+	require.NoError(t, err, "Invoke must tolerate non-inspected content types")
+	assert.Empty(t, out.Metadata, "no metadata for non-JSON, non-SSE bodies")
+}
+
+func TestInvoke_NilInput(t *testing.T) {
+	m := newTestMiddleware(t)
+	out, err := m.Invoke(context.Background(), nil)
+	require.NoError(t, err, "nil input must not error")
+	require.Equal(t, middleware.DecisionAllow, out.Decision, "decision must be Allow even on nil input")
+	assert.Empty(t, out.Metadata, "no metadata for nil input")
+}
+
+func TestInvoke_CompletionTruncatedAt3500Bytes(t *testing.T) {
+	m := newTestMiddleware(t)
+	long := strings.Repeat("x", 5000)
+	body := []byte(`{"id":"x","choices":[{"message":{"role":"assistant","content":"` + long + `"}}],"usage":{"prompt_tokens":1,"completion_tokens":1,"total_tokens":2}}`)
+
+	in := &middleware.Input{
+		Slot:        middleware.SlotOnResponse,
+		Status:      200,
+		RespHeaders: []middleware.KV{{Key: "Content-Type", Value: "application/json"}},
+		RespBody:    body,
+		Metadata:    []middleware.KV{{Key: middleware.KeyLLMProvider, Value: "openai"}},
+	}
+	out, err := m.Invoke(context.Background(), in)
+	require.NoError(t, err, "long-completion body must parse cleanly")
+
+	completion, ok := metaValue(out.Metadata, middleware.KeyLLMResponseCompletion)
+	require.True(t, ok, "completion must be emitted for long body")
+	assert.LessOrEqual(t, len(completion), maxCompletionBytes, "completion must be truncated to <=3500 bytes")
+	assert.Equal(t, maxCompletionBytes, len(completion), "completion must be truncated exactly at the cap when input is ASCII and longer")
+}
+
+// TestInvoke_RedactPii_RedactsCompletionBeforeEmit covers the GC contract on
+// the response leg: when the synthesiser sets redact_pii=true, the value
+// emitted as llm.response_completion must already be redacted, so the
+// access-log row never carries raw emails / SSNs / phones the model generated.
+// Without this, the response side leaked dozens of raw PII tokens per request.
+func TestInvoke_RedactPii_RedactsCompletionBeforeEmit(t *testing.T) {
+	mw, err := Factory{}.New([]byte(`{"redact_pii":true}`))
+	require.NoError(t, err)
+
+	piiCompletion := "Sample record: Alice Johnson, alice.johnson@example.com, SSN 123-45-6789, phone (202) 555-0147. Bob: 202/555/0108."
+	body := []byte(`{"id":"x","choices":[{"message":{"role":"assistant","content":"` + piiCompletion + `"}}],"usage":{"prompt_tokens":10,"completion_tokens":50,"total_tokens":60}}`)
+
+	in := &middleware.Input{
+		Slot:        middleware.SlotOnResponse,
+		Status:      200,
+		RespHeaders: []middleware.KV{{Key: "Content-Type", Value: "application/json"}},
+		RespBody:    body,
+		Metadata:    []middleware.KV{{Key: middleware.KeyLLMProvider, Value: "openai"}},
+	}
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out)
+
+	completion, ok := metaValue(out.Metadata, middleware.KeyLLMResponseCompletion)
+	require.True(t, ok, "completion key must be emitted")
+	assert.Contains(t, completion, "[REDACTED:email]", "email must be redacted before emit")
+	assert.Contains(t, completion, "[REDACTED:ssn]", "ssn must be redacted before emit")
+	assert.Contains(t, completion, "[REDACTED:phone]", "phone must be redacted before emit")
+	assert.NotContains(t, completion, "alice.johnson@example.com", "raw email must not survive")
+	assert.NotContains(t, completion, "123-45-6789", "raw SSN must not survive")
+	assert.NotContains(t, completion, "(202) 555-0147", "parens-phone must not survive")
+	assert.NotContains(t, completion, "202/555/0108", "slash-phone must not survive")
+}
+
+// TestInvoke_CaptureCompletionOff_DoesNotEmitCompletion mirrors the request
+// parser test: when capture_completion=false (operator has enable_prompt_
+// collection off), llm.response_completion MUST NOT appear in the access log.
+// The token / cost / usage facts the response parser also emits stay so
+// operators still get billing data on log-only mode.
+func TestInvoke_CaptureCompletionOff_DoesNotEmitCompletion(t *testing.T) {
+	mw, err := Factory{}.New([]byte(`{"capture_completion":false}`))
+	require.NoError(t, err)
+	body := []byte(`{"id":"x","choices":[{"message":{"role":"assistant","content":"alice@example.com 123-45-6789"}}],"usage":{"prompt_tokens":10,"completion_tokens":20,"total_tokens":30}}`)
+	in := &middleware.Input{
+		Slot:        middleware.SlotOnResponse,
+		Status:      200,
+		RespHeaders: []middleware.KV{{Key: "Content-Type", Value: "application/json"}},
+		RespBody:    body,
+		Metadata:    []middleware.KV{{Key: middleware.KeyLLMProvider, Value: "openai"}},
+	}
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+
+	_, ok := metaValue(out.Metadata, middleware.KeyLLMResponseCompletion)
+	assert.False(t, ok, "llm.response_completion must NOT be emitted when capture_completion is false")
+
+	// Token facts must still flow.
+	_, ok = metaValue(out.Metadata, middleware.KeyLLMInputTokens)
+	assert.True(t, ok, "input tokens fact must still be emitted")
+	_, ok = metaValue(out.Metadata, middleware.KeyLLMOutputTokens)
+	assert.True(t, ok, "output tokens fact must still be emitted")
+}
+
+// TestInvoke_CaptureCompletionUnset_PreservesLegacyEmission documents the
+// default behavior: empty config keeps emitting completion, so callers
+// without the toggle aren't broken.
+func TestInvoke_CaptureCompletionUnset_PreservesLegacyEmission(t *testing.T) {
+	mw, err := Factory{}.New([]byte(`{}`))
+	require.NoError(t, err)
+	body := []byte(`{"id":"x","choices":[{"message":{"role":"assistant","content":"hello"}}],"usage":{"prompt_tokens":1,"completion_tokens":1,"total_tokens":2}}`)
+	in := &middleware.Input{
+		Slot:        middleware.SlotOnResponse,
+		Status:      200,
+		RespHeaders: []middleware.KV{{Key: "Content-Type", Value: "application/json"}},
+		RespBody:    body,
+		Metadata:    []middleware.KV{{Key: middleware.KeyLLMProvider, Value: "openai"}},
+	}
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	_, ok := metaValue(out.Metadata, middleware.KeyLLMResponseCompletion)
+	assert.True(t, ok, "absent capture_completion must preserve emission (backwards-compatible default)")
+}
+
+// TestInvoke_RedactPii_OffShipsRawCompletion covers the inverse: with
+// redact_pii=false (default) the model output is shipped verbatim.
+func TestInvoke_RedactPii_OffShipsRawCompletion(t *testing.T) {
+	mw, err := Factory{}.New(nil)
+	require.NoError(t, err)
+
+	body := []byte(`{"id":"x","choices":[{"message":{"role":"assistant","content":"alice@example.com 123-45-6789"}}],"usage":{"prompt_tokens":1,"completion_tokens":1,"total_tokens":2}}`)
+	in := &middleware.Input{
+		Slot:        middleware.SlotOnResponse,
+		Status:      200,
+		RespHeaders: []middleware.KV{{Key: "Content-Type", Value: "application/json"}},
+		RespBody:    body,
+		Metadata:    []middleware.KV{{Key: middleware.KeyLLMProvider, Value: "openai"}},
+	}
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+
+	completion, ok := metaValue(out.Metadata, middleware.KeyLLMResponseCompletion)
+	require.True(t, ok)
+	assert.Contains(t, completion, "alice@example.com", "redact off → raw email passes through")
+	assert.Contains(t, completion, "123-45-6789", "redact off → raw SSN passes through")
+	assert.NotContains(t, completion, "[REDACTED:", "redact off → no markers")
+}
+
+func TestInvoke_CompletionTruncationRuneSafe(t *testing.T) {
+	rune4 := "\xf0\x9f\x98\x80" // 4-byte emoji
+	body := strings.Repeat("a", maxCompletionBytes-1) + rune4
+	require.Greater(t, len(body), maxCompletionBytes, "test setup must exceed the cap")
+
+	got := truncateCompletion(body)
+	assert.True(t, len(got) < maxCompletionBytes, "truncated bytes must drop the partial rune entirely")
+	assert.NotContains(t, got, "\x80", "truncated text must not end on a continuation byte")
+}
diff --git a/proxy/internal/middleware/builtin/llm_response_parser/responses_stream_test.go b/proxy/internal/middleware/builtin/llm_response_parser/responses_stream_test.go
new file mode 100644
index 000000000..0475b8cca
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_response_parser/responses_stream_test.go
@@ -0,0 +1,69 @@
+package llm_response_parser
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+)
+
+// TestInvoke_OpenAIResponsesStreaming is the regression guard for the live
+// bug where Codex hits /v1/responses (the OpenAI Responses API), whose SSE
+// shape differs from chat.completions: completion text rides
+// response.output_text.delta and usage rides response.completed under
+// response.usage. The old parser only knew the chat.completions shape, so
+// resp_meta came back empty (no tokens, no cost).
+func TestInvoke_OpenAIResponsesStreaming(t *testing.T) {
+	m := newTestMiddleware(t)
+	body := loadFixture(t, "openai_responses_stream.txt")
+
+	in := &middleware.Input{
+		Slot:        middleware.SlotOnResponse,
+		Status:      200,
+		RespHeaders: []middleware.KV{{Key: "Content-Type", Value: "text/event-stream; charset=utf-8"}},
+		RespBody:    body,
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMProvider, Value: "openai"},
+			{Key: middleware.KeyLLMModel, Value: "gpt-5.5"},
+		},
+	}
+
+	out, err := m.Invoke(context.Background(), in)
+	require.NoError(t, err, "Invoke must not error on a Responses-API streaming body")
+
+	inTok, ok := metaValue(out.Metadata, middleware.KeyLLMInputTokens)
+	require.True(t, ok, "input tokens must be emitted from a Responses-API stream")
+	assert.Equal(t, "123", inTok, "input_tokens must come from response.completed usage")
+
+	outTok, _ := metaValue(out.Metadata, middleware.KeyLLMOutputTokens)
+	assert.Equal(t, "45", outTok, "output_tokens must come from response.completed usage")
+
+	totTok, _ := metaValue(out.Metadata, middleware.KeyLLMTotalTokens)
+	assert.Equal(t, "168", totTok, "total_tokens must come from response.completed usage")
+
+	cached, ok := metaValue(out.Metadata, middleware.KeyLLMCachedInputTokens)
+	require.True(t, ok, "cached input tokens must surface from input_tokens_details")
+	assert.Equal(t, "40", cached, "cached_tokens subset must surface for cost discounting")
+
+	completion, ok := metaValue(out.Metadata, middleware.KeyLLMResponseCompletion)
+	require.True(t, ok, "completion must be emitted for Responses-API streams")
+	assert.Equal(t, "Hello, world!", completion, "output_text.delta events must concatenate")
+}
+
+// TestAccumulateOpenAIStream_ResponsesNoUsage confirms that a Responses-API
+// stream with text but no terminal usage frame still yields the completion
+// and leaves tokens at zero rather than erroring.
+func TestAccumulateOpenAIStream_ResponsesNoUsage(t *testing.T) {
+	body := []byte(`event: response.output_text.delta
+data: {"type":"response.output_text.delta","delta":"partial"}
+
+`)
+
+	usage, completion := accumulateOpenAIStream(body)
+	assert.Equal(t, int64(0), usage.InputTokens, "no usage frame leaves input tokens at zero")
+	assert.Equal(t, int64(0), usage.OutputTokens, "no usage frame leaves output tokens at zero")
+	assert.Equal(t, "partial", completion, "output_text deltas accumulate even without a usage frame")
+}
diff --git a/proxy/internal/middleware/builtin/llm_response_parser/streaming.go b/proxy/internal/middleware/builtin/llm_response_parser/streaming.go
new file mode 100644
index 000000000..6462ab4ae
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_response_parser/streaming.go
@@ -0,0 +1,270 @@
+package llm_response_parser
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"io"
+	"strings"
+
+	"github.com/netbirdio/netbird/proxy/internal/llm"
+)
+
+// openAIDoneSentinel is the OpenAI end-of-stream marker. The scanner
+// stops once this data frame is observed.
+const openAIDoneSentinel = "[DONE]"
+
+// accumulateStream walks the SSE byte slice, dispatches per provider,
+// and returns the running token-usage and concatenated completion text.
+// Errors from the scanner short-circuit accumulation but never panic
+// — partial results are returned for truncated bodies.
+func accumulateStream(provider string, body []byte) (llm.Usage, string) {
+	switch provider {
+	case "openai":
+		return accumulateOpenAIStream(body)
+	case "anthropic":
+		return accumulateAnthropicStream(body)
+	case llm.ProviderNameBedrock:
+		return accumulateBedrockStream(body)
+	default:
+		return llm.Usage{}, ""
+	}
+}
+
+// openAIStreamUsage is the usage block shared by both OpenAI streaming
+// envelopes. Pointer fields tell "absent" from zero; the chat.completions
+// (prompt_/completion_) and Responses-API (input_/output_) names are both
+// accepted so a single decode covers either endpoint.
+type openAIStreamUsage struct {
+	PromptTokens        *int64 `json:"prompt_tokens"`
+	CompletionTokens    *int64 `json:"completion_tokens"`
+	InputTokens         *int64 `json:"input_tokens"`
+	OutputTokens        *int64 `json:"output_tokens"`
+	TotalTokens         *int64 `json:"total_tokens"`
+	PromptTokensDetails *struct {
+		CachedTokens *int64 `json:"cached_tokens"`
+	} `json:"prompt_tokens_details"`
+	InputTokensDetails *struct {
+		CachedTokens *int64 `json:"cached_tokens"`
+	} `json:"input_tokens_details"`
+}
+
+// openAIStreamChunk matches both OpenAI streaming envelopes. The
+// chat.completions chunk carries text in choices[].delta.content and a
+// trailing top-level usage block. The Responses API (/v1/responses) emits
+// typed events instead: completion text rides response.output_text.delta
+// (top-level "delta" string) and the final usage rides response.completed
+// under response.usage. Only fields used for accumulation are declared.
+type openAIStreamChunk struct {
+	Choices []struct {
+		Delta struct {
+			Content string `json:"content"`
+		} `json:"delta"`
+	} `json:"choices"`
+	Usage *openAIStreamUsage `json:"usage"`
+
+	Type     string          `json:"type"`
+	Delta    json.RawMessage `json:"delta"`
+	Response *struct {
+		Usage *openAIStreamUsage `json:"usage"`
+	} `json:"response"`
+}
+
+// accumulateOpenAIStream sums per-chunk content deltas and lifts the usage
+// block off the final frame, handling both the chat.completions and the
+// Responses-API event shapes. Clients without stream_options.include_usage
+// (chat.completions) and any provider that omits the final usage simply
+// leave tokens at zero; the caller chooses what to emit.
+func accumulateOpenAIStream(body []byte) (llm.Usage, string) {
+	var (
+		usage      llm.Usage
+		completion strings.Builder
+	)
+	scanner := llm.NewScanner(bytes.NewReader(body))
+	for {
+		ev, err := scanner.Next()
+		if err != nil {
+			break
+		}
+		if ev.Data == openAIDoneSentinel {
+			break
+		}
+		if ev.Data == "" {
+			continue
+		}
+
+		var chunk openAIStreamChunk
+		if err := json.Unmarshal([]byte(ev.Data), &chunk); err != nil {
+			continue
+		}
+		for _, c := range chunk.Choices {
+			completion.WriteString(c.Delta.Content)
+		}
+		if chunk.Type == "response.output_text.delta" {
+			if s, ok := decodeJSONString(chunk.Delta); ok {
+				completion.WriteString(s)
+			}
+		}
+
+		u := chunk.Usage
+		if u == nil && chunk.Response != nil {
+			u = chunk.Response.Usage
+		}
+		applyOpenAIStreamUsage(u, &usage)
+	}
+	return usage, completion.String()
+}
+
+// applyOpenAIStreamUsage lifts the token counts off a final-frame usage
+// block into the running usage, normalising the chat.completions
+// (prompt_/completion_) and Responses-API (input_/output_) names and
+// backfilling total tokens when the provider omits them.
+func applyOpenAIStreamUsage(u *openAIStreamUsage, usage *llm.Usage) {
+	if u == nil {
+		return
+	}
+	usage.InputTokens = pickInt64(u.InputTokens, u.PromptTokens)
+	usage.OutputTokens = pickInt64(u.OutputTokens, u.CompletionTokens)
+	usage.TotalTokens = derefInt64(u.TotalTokens)
+	if u.InputTokensDetails != nil {
+		if v := derefInt64(u.InputTokensDetails.CachedTokens); v > 0 {
+			usage.CachedInputTokens = v
+		}
+	}
+	if usage.CachedInputTokens == 0 && u.PromptTokensDetails != nil {
+		usage.CachedInputTokens = derefInt64(u.PromptTokensDetails.CachedTokens)
+	}
+	if usage.TotalTokens == 0 && (usage.InputTokens > 0 || usage.OutputTokens > 0) {
+		usage.TotalTokens = usage.InputTokens + usage.OutputTokens
+	}
+}
+
+// decodeJSONString unmarshals a JSON-encoded string value, returning
+// ok=false when the raw message is empty or not a string.
+func decodeJSONString(raw json.RawMessage) (string, bool) {
+	if len(raw) == 0 {
+		return "", false
+	}
+	var s string
+	if err := json.Unmarshal(raw, &s); err != nil {
+		return "", false
+	}
+	return s, true
+}
+
+// anthropicStreamEvent captures the union of Messages-API stream event
+// payloads we care about. Each named event on the wire fills only its
+// shape's fields; unknown keys are ignored.
+type anthropicStreamUsage struct {
+	InputTokens              *int64 `json:"input_tokens"`
+	OutputTokens             *int64 `json:"output_tokens"`
+	CacheReadInputTokens     *int64 `json:"cache_read_input_tokens"`
+	CacheCreationInputTokens *int64 `json:"cache_creation_input_tokens"`
+}
+
+type anthropicStreamEvent struct {
+	Type    string `json:"type"`
+	Message *struct {
+		Usage *anthropicStreamUsage `json:"usage"`
+	} `json:"message"`
+	Delta *struct {
+		Type string `json:"type"`
+		Text string `json:"text"`
+	} `json:"delta"`
+	Usage *anthropicStreamUsage `json:"usage"`
+}
+
+// accumulateAnthropicStream tracks input_tokens from message_start,
+// output_tokens from message_delta, and concatenates text_delta payloads
+// from content_block_delta events. Final usage prefers message_delta
+// values which carry the post-completion totals.
+func accumulateAnthropicStream(body []byte) (llm.Usage, string) {
+	var (
+		usage      llm.Usage
+		completion strings.Builder
+	)
+	scanner := llm.NewScanner(bytes.NewReader(body))
+	for {
+		ev, err := scanner.Next()
+		if err != nil {
+			if errors.Is(err, io.EOF) {
+				break
+			}
+			break
+		}
+		if ev.Data == "" {
+			continue
+		}
+
+		var payload anthropicStreamEvent
+		if err := json.Unmarshal([]byte(ev.Data), &payload); err != nil {
+			continue
+		}
+
+		eventType := ev.Type
+		if eventType == "" {
+			eventType = payload.Type
+		}
+		applyAnthropicStreamEvent(eventType, payload, &usage, &completion)
+	}
+	if usage.InputTokens > 0 || usage.OutputTokens > 0 {
+		usage.TotalTokens = usage.InputTokens + usage.OutputTokens + usage.CachedInputTokens + usage.CacheCreationTokens
+	}
+	return usage, completion.String()
+}
+
+// applyAnthropicStreamEvent folds one parsed Anthropic Messages stream event
+// into the running usage/completion. Shared by the SSE accumulator and the
+// Bedrock InvokeModel event-stream, whose chunks wrap the same event JSON.
+func applyAnthropicStreamEvent(eventType string, payload anthropicStreamEvent, usage *llm.Usage, completion *strings.Builder) {
+	switch eventType {
+	case "message_start":
+		if payload.Message != nil {
+			applyAnthropicStreamUsage(payload.Message.Usage, usage)
+		}
+	case "content_block_delta":
+		if payload.Delta != nil && payload.Delta.Type == "text_delta" {
+			completion.WriteString(payload.Delta.Text)
+		}
+	case "message_delta":
+		applyAnthropicStreamUsage(payload.Usage, usage)
+	case "message_stop":
+		// No-op; Anthropic does not emit usage here.
+	}
+}
+
+// applyAnthropicStreamUsage folds a non-nil Anthropic usage block into the
+// running totals. Each field overwrites only when present and positive, so
+// message_delta's post-completion counts supersede the message_start seed
+// without zeroing dimensions a later event omits.
+func applyAnthropicStreamUsage(u *anthropicStreamUsage, usage *llm.Usage) {
+	if u == nil {
+		return
+	}
+	if v := derefInt64(u.InputTokens); v > 0 {
+		usage.InputTokens = v
+	}
+	if v := derefInt64(u.OutputTokens); v > 0 {
+		usage.OutputTokens = v
+	}
+	if v := derefInt64(u.CacheReadInputTokens); v > 0 {
+		usage.CachedInputTokens = v
+	}
+	if v := derefInt64(u.CacheCreationInputTokens); v > 0 {
+		usage.CacheCreationTokens = v
+	}
+}
+
+func pickInt64(preferred, fallback *int64) int64 {
+	if preferred != nil {
+		return *preferred
+	}
+	return derefInt64(fallback)
+}
+
+func derefInt64(v *int64) int64 {
+	if v == nil {
+		return 0
+	}
+	return *v
+}
diff --git a/proxy/internal/middleware/builtin/llm_response_parser/streaming_bedrock.go b/proxy/internal/middleware/builtin/llm_response_parser/streaming_bedrock.go
new file mode 100644
index 000000000..a82a9cdbc
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_response_parser/streaming_bedrock.go
@@ -0,0 +1,110 @@
+package llm_response_parser
+
+import (
+	"bytes"
+	"encoding/json"
+	"strings"
+
+	"github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream"
+
+	"github.com/netbirdio/netbird/proxy/internal/llm"
+)
+
+// bedrockEventTypeHeader names each AWS event-stream frame's event type.
+const bedrockEventTypeHeader = ":event-type"
+
+// accumulateBedrockStream decodes the AWS binary event-stream returned by
+// Bedrock's streaming endpoints and folds it into running usage/completion.
+// Two framings are handled:
+//   - InvokeModel (invoke-with-response-stream): each "chunk" frame's payload is
+//     {"bytes":"<base64>"} wrapping a vendor-native (Anthropic) stream event.
+//   - Converse (converse-stream): native frames (contentBlockDelta, metadata, …)
+//     whose payload JSON carries text deltas and a final usage block.
+//
+// A truncated stream (cut at the capture cap) decodes best-effort: frames up to
+// the cut are applied and the partial usage is returned.
+func accumulateBedrockStream(body []byte) (llm.Usage, string) {
+	var (
+		usage      llm.Usage
+		completion strings.Builder
+	)
+	dec := eventstream.NewDecoder()
+	r := bytes.NewReader(body)
+	for {
+		msg, err := dec.Decode(r, nil)
+		if err != nil {
+			break // EOF or a partial trailing frame — return what we have.
+		}
+		eventType := ""
+		if v := msg.Headers.Get(bedrockEventTypeHeader); v != nil {
+			eventType = v.String()
+		}
+		if eventType == "chunk" {
+			applyBedrockInvokeChunk(msg.Payload, &usage, &completion)
+			continue
+		}
+		applyConverseStreamEvent(eventType, msg.Payload, &usage, &completion)
+	}
+	if usage.TotalTokens == 0 && (usage.InputTokens > 0 || usage.OutputTokens > 0) {
+		usage.TotalTokens = usage.InputTokens + usage.OutputTokens + usage.CachedInputTokens + usage.CacheCreationTokens
+	}
+	return usage, completion.String()
+}
+
+// applyBedrockInvokeChunk decodes an InvokeModel stream "chunk" frame
+// ({"bytes":"<base64 anthropic event>"}) and folds the wrapped Anthropic event
+// into usage/completion via the shared accumulator.
+func applyBedrockInvokeChunk(payload []byte, usage *llm.Usage, completion *strings.Builder) {
+	var wrap struct {
+		Bytes []byte `json:"bytes"` // base64 string — encoding/json decodes it
+	}
+	if err := json.Unmarshal(payload, &wrap); err != nil || len(wrap.Bytes) == 0 {
+		return
+	}
+	var ev anthropicStreamEvent
+	if err := json.Unmarshal(wrap.Bytes, &ev); err != nil {
+		return
+	}
+	applyAnthropicStreamEvent(ev.Type, ev, usage, completion)
+}
+
+// converseStreamEvent captures the Converse stream frames carrying completion
+// text (contentBlockDelta) and the final token usage (metadata).
+type converseStreamEvent struct {
+	Delta *struct {
+		Text string `json:"text"`
+	} `json:"delta"`
+	Usage *struct {
+		InputTokens  int64 `json:"inputTokens"`
+		OutputTokens int64 `json:"outputTokens"`
+		TotalTokens  int64 `json:"totalTokens"`
+	} `json:"usage"`
+}
+
+// applyConverseStreamEvent folds one native Converse stream frame into the
+// running usage/completion: contentBlockDelta carries assistant text, and the
+// trailing metadata frame carries the final usage block.
+func applyConverseStreamEvent(eventType string, payload []byte, usage *llm.Usage, completion *strings.Builder) {
+	var ev converseStreamEvent
+	if err := json.Unmarshal(payload, &ev); err != nil {
+		return
+	}
+	switch eventType {
+	case "contentBlockDelta":
+		if ev.Delta != nil {
+			completion.WriteString(ev.Delta.Text)
+		}
+	case "metadata":
+		if ev.Usage != nil {
+			if ev.Usage.InputTokens > 0 {
+				usage.InputTokens = ev.Usage.InputTokens
+			}
+			if ev.Usage.OutputTokens > 0 {
+				usage.OutputTokens = ev.Usage.OutputTokens
+			}
+			if ev.Usage.TotalTokens > 0 {
+				usage.TotalTokens = ev.Usage.TotalTokens
+			}
+		}
+	}
+}
diff --git a/proxy/internal/middleware/builtin/llm_response_parser/streaming_bedrock_test.go b/proxy/internal/middleware/builtin/llm_response_parser/streaming_bedrock_test.go
new file mode 100644
index 000000000..f93505882
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_response_parser/streaming_bedrock_test.go
@@ -0,0 +1,74 @@
+package llm_response_parser
+
+import (
+	"bytes"
+	"encoding/base64"
+	"encoding/json"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream"
+	"github.com/stretchr/testify/require"
+)
+
+// bedrockFrame encodes a single AWS event-stream frame with the given
+// :event-type header and JSON payload, mirroring what Bedrock sends.
+func bedrockFrame(t *testing.T, eventType string, payload []byte) []byte {
+	t.Helper()
+	var buf bytes.Buffer
+	enc := eventstream.NewEncoder()
+	err := enc.Encode(&buf, eventstream.Message{
+		Headers: eventstream.Headers{{Name: ":event-type", Value: eventstream.StringValue(eventType)}},
+		Payload: payload,
+	})
+	require.NoError(t, err, "encode event-stream frame")
+	return buf.Bytes()
+}
+
+func mustJSON(t *testing.T, v any) []byte {
+	t.Helper()
+	b, err := json.Marshal(v)
+	require.NoError(t, err)
+	return b
+}
+
+func TestAccumulateBedrockStream_Invoke(t *testing.T) {
+	// invoke-with-response-stream: each "chunk" frame wraps a base64-encoded
+	// Anthropic stream event under {"bytes": ...}.
+	events := [][]byte{
+		mustJSON(t, map[string]any{"type": "message_start", "message": map[string]any{"usage": map[string]any{"input_tokens": 13}}}),
+		mustJSON(t, map[string]any{"type": "content_block_delta", "delta": map[string]any{"type": "text_delta", "text": "po"}}),
+		mustJSON(t, map[string]any{"type": "content_block_delta", "delta": map[string]any{"type": "text_delta", "text": "ng"}}),
+		mustJSON(t, map[string]any{"type": "message_delta", "usage": map[string]any{"output_tokens": 5}}),
+	}
+	var body bytes.Buffer
+	for _, ev := range events {
+		wrap := mustJSON(t, map[string]any{"bytes": base64.StdEncoding.EncodeToString(ev)})
+		body.Write(bedrockFrame(t, "chunk", wrap))
+	}
+
+	usage, completion := accumulateBedrockStream(body.Bytes())
+	require.Equal(t, int64(13), usage.InputTokens, "input tokens from message_start")
+	require.Equal(t, int64(5), usage.OutputTokens, "output tokens from message_delta")
+	require.Equal(t, int64(18), usage.TotalTokens, "total is additive")
+	require.Equal(t, "pong", completion, "text deltas concatenated")
+}
+
+func TestAccumulateBedrockStream_Converse(t *testing.T) {
+	var body bytes.Buffer
+	body.Write(bedrockFrame(t, "contentBlockDelta", mustJSON(t, map[string]any{"delta": map[string]any{"text": "po"}})))
+	body.Write(bedrockFrame(t, "contentBlockDelta", mustJSON(t, map[string]any{"delta": map[string]any{"text": "ng"}})))
+	body.Write(bedrockFrame(t, "metadata", mustJSON(t, map[string]any{"usage": map[string]any{"inputTokens": 11, "outputTokens": 3, "totalTokens": 14}})))
+
+	usage, completion := accumulateBedrockStream(body.Bytes())
+	require.Equal(t, int64(11), usage.InputTokens, "input tokens from metadata frame")
+	require.Equal(t, int64(3), usage.OutputTokens, "output tokens from metadata frame")
+	require.Equal(t, int64(14), usage.TotalTokens, "total from metadata frame")
+	require.Equal(t, "pong", completion, "converse text deltas concatenated")
+}
+
+func TestAccumulateBedrockStream_Truncated(t *testing.T) {
+	// A body cut mid-frame must not panic; partial usage is returned.
+	full := bedrockFrame(t, "metadata", mustJSON(t, map[string]any{"usage": map[string]any{"inputTokens": 11, "outputTokens": 3}}))
+	usage, _ := accumulateBedrockStream(full[:len(full)-4])
+	require.Zero(t, usage.OutputTokens, "truncated trailing frame is dropped, not panicked on")
+}
diff --git a/proxy/internal/middleware/builtin/llm_response_parser/streaming_test.go b/proxy/internal/middleware/builtin/llm_response_parser/streaming_test.go
new file mode 100644
index 000000000..400aac0bd
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_response_parser/streaming_test.go
@@ -0,0 +1,169 @@
+package llm_response_parser
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+)
+
+func TestInvoke_OpenAIStreamingWithUsage(t *testing.T) {
+	m := newTestMiddleware(t)
+	body := loadFixture(t, "openai_stream.txt")
+
+	in := &middleware.Input{
+		Slot:        middleware.SlotOnResponse,
+		Status:      200,
+		RespHeaders: []middleware.KV{{Key: "Content-Type", Value: "text/event-stream"}},
+		RespBody:    body,
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMProvider, Value: "openai"},
+			{Key: middleware.KeyLLMModel, Value: "gpt-4o-mini"},
+		},
+	}
+
+	out, err := m.Invoke(context.Background(), in)
+	require.NoError(t, err, "Invoke must not error on streaming OpenAI body")
+
+	in123, _ := metaValue(out.Metadata, middleware.KeyLLMInputTokens)
+	assert.Equal(t, "123", in123, "input tokens must come from final-chunk usage block")
+
+	outTok, _ := metaValue(out.Metadata, middleware.KeyLLMOutputTokens)
+	assert.Equal(t, "45", outTok, "output tokens must come from final-chunk usage block")
+
+	totTok, _ := metaValue(out.Metadata, middleware.KeyLLMTotalTokens)
+	assert.Equal(t, "168", totTok, "total tokens must come from final-chunk usage block")
+
+	completion, ok := metaValue(out.Metadata, middleware.KeyLLMResponseCompletion)
+	require.True(t, ok, "completion must be emitted for streaming responses")
+	assert.Equal(t, "Hello, world!", completion, "deltas must concatenate into the buffered fixture's text")
+}
+
+func TestInvoke_OpenAIStreamingWithoutUsage(t *testing.T) {
+	body := []byte(`data: {"choices":[{"delta":{"content":"Hi"}}]}
+
+data: {"choices":[{"delta":{"content":" there"}}]}
+
+data: [DONE]
+
+`)
+
+	usage, completion := accumulateOpenAIStream(body)
+	assert.Equal(t, int64(0), usage.InputTokens, "input tokens must stay zero without a usage frame")
+	assert.Equal(t, int64(0), usage.OutputTokens, "output tokens must stay zero without a usage frame")
+	assert.Equal(t, int64(0), usage.TotalTokens, "total tokens must stay zero without a usage frame")
+	assert.Equal(t, "Hi there", completion, "deltas must still accumulate when usage is absent")
+}
+
+func TestInvoke_OpenAIStreamingNoUsage_OmitsUsageMetadata(t *testing.T) {
+	m := newTestMiddleware(t)
+	body := []byte(`data: {"choices":[{"delta":{"content":"Hello"}}]}
+
+data: [DONE]
+
+`)
+	in := &middleware.Input{
+		Slot:        middleware.SlotOnResponse,
+		Status:      200,
+		RespHeaders: []middleware.KV{{Key: "Content-Type", Value: "text/event-stream"}},
+		RespBody:    body,
+		Metadata:    []middleware.KV{{Key: middleware.KeyLLMProvider, Value: "openai"}},
+	}
+	out, err := m.Invoke(context.Background(), in)
+	require.NoError(t, err, "Invoke must not error on usage-less streams")
+
+	_, hasIn := metaValue(out.Metadata, middleware.KeyLLMInputTokens)
+	_, hasOut := metaValue(out.Metadata, middleware.KeyLLMOutputTokens)
+	_, hasTot := metaValue(out.Metadata, middleware.KeyLLMTotalTokens)
+	assert.False(t, hasIn, "input tokens omitted when no usage frame")
+	assert.False(t, hasOut, "output tokens omitted when no usage frame")
+	assert.False(t, hasTot, "total tokens omitted when no usage frame")
+
+	completion, ok := metaValue(out.Metadata, middleware.KeyLLMResponseCompletion)
+	require.True(t, ok, "completion must still be emitted from deltas")
+	assert.Equal(t, "Hello", completion, "completion must come from delta accumulation")
+}
+
+func TestInvoke_AnthropicStreaming(t *testing.T) {
+	m := newTestMiddleware(t)
+	body := loadFixture(t, "anthropic_stream.txt")
+
+	in := &middleware.Input{
+		Slot:        middleware.SlotOnResponse,
+		Status:      200,
+		RespHeaders: []middleware.KV{{Key: "Content-Type", Value: "text/event-stream"}},
+		RespBody:    body,
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMProvider, Value: "anthropic"},
+			{Key: middleware.KeyLLMModel, Value: "claude-sonnet-4-5"},
+		},
+	}
+
+	out, err := m.Invoke(context.Background(), in)
+	require.NoError(t, err, "Invoke must not error on streaming Anthropic body")
+
+	in123, _ := metaValue(out.Metadata, middleware.KeyLLMInputTokens)
+	assert.Equal(t, "123", in123, "input tokens must come from message_start usage")
+
+	outTok, _ := metaValue(out.Metadata, middleware.KeyLLMOutputTokens)
+	assert.Equal(t, "45", outTok, "output tokens must come from message_delta usage")
+
+	totTok, _ := metaValue(out.Metadata, middleware.KeyLLMTotalTokens)
+	assert.Equal(t, "168", totTok, "total tokens must be input+output for anthropic streaming")
+
+	completion, ok := metaValue(out.Metadata, middleware.KeyLLMResponseCompletion)
+	require.True(t, ok, "completion must be emitted from text_delta accumulation")
+	assert.Equal(t, "Hello, world!", completion, "anthropic streaming text must accumulate across content_block_delta events")
+}
+
+func TestInvoke_StreamingTruncatedBody_BestEffort(t *testing.T) {
+	m := newTestMiddleware(t)
+	full := loadFixture(t, "anthropic_stream.txt")
+	cut := len(full) / 2
+	truncated := full[:cut]
+
+	in := &middleware.Input{
+		Slot:              middleware.SlotOnResponse,
+		Status:            200,
+		RespHeaders:       []middleware.KV{{Key: "Content-Type", Value: "text/event-stream"}},
+		RespBody:          truncated,
+		RespBodyTruncated: true,
+		Metadata:          []middleware.KV{{Key: middleware.KeyLLMProvider, Value: "anthropic"}},
+	}
+
+	require.NotPanics(t, func() {
+		_, err := m.Invoke(context.Background(), in)
+		require.NoError(t, err, "truncated streaming body must not surface as error")
+	}, "Invoke must never panic on a truncated SSE body")
+}
+
+func TestInvoke_StreamingEmptyBody(t *testing.T) {
+	m := newTestMiddleware(t)
+	in := &middleware.Input{
+		Slot:        middleware.SlotOnResponse,
+		Status:      200,
+		RespHeaders: []middleware.KV{{Key: "Content-Type", Value: "text/event-stream"}},
+		RespBody:    nil,
+		Metadata:    []middleware.KV{{Key: middleware.KeyLLMProvider, Value: "openai"}},
+	}
+	out, err := m.Invoke(context.Background(), in)
+	require.NoError(t, err, "empty SSE body must not surface as error")
+	assert.Empty(t, out.Metadata, "no metadata for empty SSE body")
+}
+
+func TestAccumulateAnthropicStream_PartialUsage(t *testing.T) {
+	body := []byte(`event: message_start
+data: {"type":"message_start","message":{"usage":{"input_tokens":10}}}
+
+event: content_block_delta
+data: {"type":"content_block_delta","delta":{"type":"text_delta","text":"hi"}}
+
+`)
+	usage, completion := accumulateAnthropicStream(body)
+	assert.Equal(t, int64(10), usage.InputTokens, "partial input_tokens must survive truncated stream")
+	assert.Equal(t, int64(0), usage.OutputTokens, "output_tokens stays zero without message_delta")
+	assert.Equal(t, "hi", completion, "completion must come from observed text_delta events")
+}
diff --git a/proxy/internal/middleware/builtin/llm_router/factory.go b/proxy/internal/middleware/builtin/llm_router/factory.go
new file mode 100644
index 000000000..3c3b607ac
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_router/factory.go
@@ -0,0 +1,106 @@
+package llm_router
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin"
+)
+
+// ProviderRoute describes one upstream LLM provider the router can
+// hand a request to. Models lists the model identifiers the provider
+// claims; UpstreamScheme + UpstreamHost replace the synth target's
+// placeholder URL on a match. UpstreamPath is the path component of
+// the configured upstream URL — the router uses it to disambiguate
+// providers that claim the same model: when more than one provider
+// matches the model, the route whose UpstreamPath is a prefix of the
+// incoming request path is preferred (longest match wins, empty path
+// is the catchall). AuthHeaderName + AuthHeaderValue are the
+// per-provider credential the router injects after stripping the
+// vendor auth headers from the inbound request.
+//
+// AllowedGroupIDs is the union of source-group IDs across every
+// enabled policy that authorises this provider. The router treats it
+// as a hard filter: a route whose AllowedGroupIDs has no intersection
+// with the caller's UserGroups is removed from the candidate list
+// before the path-prefix tiebreak. A route with empty AllowedGroupIDs
+// is unreachable; the synthesiser only emits policy-bound routes.
+type ProviderRoute struct {
+	ID string `json:"id"`
+	// Vendor is the parser surface this provider speaks ("openai",
+	// "anthropic", …), matching the llm.provider value llm_request_parser
+	// emits from the request. When set, the router keeps a vendor-tagged
+	// request on a same-vendor route so catch-all gateways of a different
+	// vendor can't swallow it. Empty disables vendor filtering for this
+	// route.
+	Vendor          string   `json:"vendor,omitempty"`
+	Models          []string `json:"models"`
+	UpstreamScheme  string   `json:"upstream_scheme"`
+	UpstreamHost    string   `json:"upstream_host"`
+	UpstreamPath    string   `json:"upstream_path,omitempty"`
+	AuthHeaderName  string   `json:"auth_header_name"`
+	AuthHeaderValue string   `json:"auth_header_value"`
+	AllowedGroupIDs []string `json:"allowed_group_ids"`
+	// Vertex marks a Google Vertex AI provider. Vertex requests carry the
+	// model in the URL path, so the router selects this route by path
+	// (isVertexPath) and bypasses the model/vendor table entirely.
+	Vertex bool `json:"vertex,omitempty"`
+	// Bedrock marks an AWS Bedrock provider. Bedrock requests carry the model
+	// in the URL path (/model/{id}/{action}), so the router selects this route
+	// by path (isBedrockPath) and bypasses the model/vendor table; auth is the
+	// static AuthHeaderValue bearer token (no token minting).
+	Bedrock bool `json:"bedrock,omitempty"`
+	// GCPServiceAccountKeyB64 is a base64-encoded GCP service-account JSON
+	// key. When set, the router mints + refreshes a short-lived OAuth2 access
+	// token from it at request time and injects it as the auth header value
+	// (instead of the static AuthHeaderValue) — so the gateway holds a durable
+	// Vertex credential rather than a 1-hour token.
+	GCPServiceAccountKeyB64 string `json:"gcp_sa_key_b64,omitempty"`
+}
+
+// Config is the on-wire configuration accepted by the factory. An
+// empty Providers slice yields a router that denies every request as
+// not-routable; the synthesiser is responsible for stamping the
+// account's enabled providers into this slice.
+type Config struct {
+	Providers []ProviderRoute `json:"providers"`
+}
+
+// Factory builds llm_router instances from raw config bytes.
+type Factory struct{}
+
+// ID returns the registry identifier.
+func (Factory) ID() string { return ID }
+
+// New constructs a middleware instance. Empty, null, and {} configs
+// yield a router with an empty Providers slice — every request denies
+// with model_not_routable. Non-empty payloads must parse cleanly so
+// misconfigurations surface at chain build time.
+func (Factory) New(rawConfig []byte) (middleware.Middleware, error) {
+	cfg := Config{}
+	if !isEmptyJSON(rawConfig) {
+		if err := json.Unmarshal(rawConfig, &cfg); err != nil {
+			return nil, fmt.Errorf("decode config: %w", err)
+		}
+	}
+	return New(cfg), nil
+}
+
+// isEmptyJSON reports whether the payload is whitespace, null, or an
+// empty object/array. The caller skips Unmarshal in that case so the
+// zero-value Config flows through unchanged.
+func isEmptyJSON(raw []byte) bool {
+	trimmed := strings.TrimSpace(string(bytes.TrimSpace(raw)))
+	switch trimmed {
+	case "", "null", "{}", "[]":
+		return true
+	}
+	return false
+}
+
+func init() {
+	builtin.Register(Factory{})
+}
diff --git a/proxy/internal/middleware/builtin/llm_router/middleware.go b/proxy/internal/middleware/builtin/llm_router/middleware.go
new file mode 100644
index 000000000..73cc59c95
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_router/middleware.go
@@ -0,0 +1,793 @@
+// Package llm_router implements the SlotOnRequest middleware that
+// routes a request to an upstream LLM provider based on the model name
+// emitted upstream by llm_request_parser. The router rewrites the
+// request's outbound target (scheme + host), strips known LLM-vendor
+// auth headers, and injects the per-provider auth header from the
+// matched route. Unknown or unconfigured models deny with a 403 and
+// the canonical llm_policy.model_not_routable code.
+package llm_router
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"fmt"
+	"net/http"
+	"net/url"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"golang.org/x/oauth2"
+	"golang.org/x/oauth2/google"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+)
+
+// gcpScope is the OAuth2 scope minted for Vertex AI service-account auth.
+const gcpScope = "https://www.googleapis.com/auth/cloud-platform"
+
+// gcpTokenTimeout bounds each GCP token mint/refresh HTTP call so a slow or
+// unreachable token endpoint can't block the request indefinitely.
+const gcpTokenTimeout = 10 * time.Second
+
+// ID is the registry key for this middleware.
+const ID = "llm_router"
+
+// Version is reported via Middleware.Version().
+const Version = "1.0.0"
+
+const (
+	denyCodeNotRoutable         = "llm_policy.model_not_routable"
+	denyReasonNotRoutable       = "model_not_routable"
+	denyCodeNoAuthorisedRoute   = "llm_policy.no_authorised_provider"
+	denyReasonNoAuthorisedRoute = "no_authorised_provider"
+	//nolint:gosec // deny code label, not a credential
+	denyCodeUpstreamAuth  = "llm_policy.upstream_auth_failed"
+	denyCodeUnmeterable   = "llm_policy.unmeterable_publisher"
+	denyReasonUnmeterable = "unmeterable_publisher"
+)
+
+// strippedAuthHeaders is the closed list of vendor authentication
+// credentials the router clears before injecting the provider-specific
+// credential. Strictly auth headers — vendor-specific metadata
+// (anthropic-version, openai-organization, openai-project, etc.) is
+// NOT stripped because the client SDK sets those and the upstream
+// requires them (e.g. Anthropic returns 400 without
+// anthropic-version). Each entry is canonicalised by Go's
+// http.Header.Del/Set, so listing the canonical shapes here is
+// sufficient.
+var strippedAuthHeaders = []string{
+	"Authorization",       // OpenAI, OpenAI-compatible, most vendors, Bedrock bearer
+	"Proxy-Authorization", // upstream proxy auth (defense-in-depth)
+	"x-api-key",           // Anthropic
+	"api-key",             // Azure OpenAI
+	"X-Amz-Date",          // AWS SigV4 — strip client-supplied AWS signing material
+	"X-Amz-Security-Token",
+	"X-Amz-Content-Sha256",
+}
+
+// Middleware routes requests to upstream LLM providers based on the
+// llm.model metadata emitted by llm_request_parser.
+type Middleware struct {
+	cfg Config
+	// tokenSrc caches one auto-refreshing OAuth2 TokenSource per GCP
+	// service-account key (keyed by a hash of the key material), so Vertex
+	// token minting happens once and refreshes are amortised across requests.
+	tokenMu  sync.Mutex
+	tokenSrc map[string]oauth2.TokenSource
+}
+
+// New constructs a Middleware with the supplied configuration. Empty
+// or nil Providers slice yields a router that denies every request as
+// not-routable.
+func New(cfg Config) *Middleware {
+	return &Middleware{cfg: cfg, tokenSrc: map[string]oauth2.TokenSource{}}
+}
+
+// ID returns the registry identifier.
+func (m *Middleware) ID() string { return ID }
+
+// Version returns the implementation version.
+func (m *Middleware) Version() string { return Version }
+
+// Slot reports the chain slot the middleware lives in.
+func (m *Middleware) Slot() middleware.Slot { return middleware.SlotOnRequest }
+
+// AcceptedContentTypes returns nil because the router only consults
+// the metadata emitted by llm_request_parser.
+func (m *Middleware) AcceptedContentTypes() []string { return nil }
+
+// MetadataKeys is the closed set of metadata keys this middleware may
+// emit. The accumulator drops anything outside this allowlist.
+func (m *Middleware) MetadataKeys() []string {
+	return []string{
+		middleware.KeyLLMResolvedProviderID,
+		middleware.KeyLLMAuthorisingGroups,
+		middleware.KeyLLMPolicyDecision,
+		middleware.KeyLLMPolicyReason,
+	}
+}
+
+// MutationsSupported reports that the middleware emits header and
+// upstream-rewrite mutations.
+func (m *Middleware) MutationsSupported() bool { return true }
+
+// Close releases resources owned by the middleware. The router is
+// stateless, so this is a no-op.
+func (m *Middleware) Close() error { return nil }
+
+// matchOutcome captures why matchRoute returned what it did so the
+// caller can distinguish "no provider knows this model" from "providers
+// know it but none authorise this peer's groups".
+type matchOutcome int
+
+const (
+	matchOutcomeFound matchOutcome = iota
+	matchOutcomeUnknownModel
+	matchOutcomeUnauthorised
+)
+
+// Invoke resolves the model to a provider authorised for the caller's
+// groups, strips known vendor auth headers, and injects the route's
+// auth header. Unknown models deny with model_not_routable; models
+// known to a provider that no policy authorises for the caller deny
+// with no_authorised_provider.
+func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middleware.Output, error) {
+	// Vertex AI carries the model in the URL path, not the body, and is
+	// selected by path rather than by the model/vendor table. Route it before
+	// the model lookup so a model the parser extracted from the path can't be
+	// claimed by a same-vendor direct provider (e.g. claude-* on api.anthropic.com).
+	reqPath := requestPath(in.URL)
+	if isVertexPath(reqPath) {
+		model, _ := lookupMetadata(in.Metadata, middleware.KeyLLMModel)
+		// The request parser emits no llm.provider for a Vertex publisher it
+		// can't parse (e.g. google/gemini). Forwarding such a request would
+		// bypass token/budget metering, so deny it rather than serve it
+		// unmetered.
+		if vendor, _ := lookupMetadata(in.Metadata, middleware.KeyLLMProvider); vendor == "" {
+			return denyUnmeterable(), nil
+		}
+		route, outcome := m.matchVertex(reqPath, model, in.UserGroups)
+		switch outcome {
+		case matchOutcomeFound:
+			return m.allowWithRoute(route, in.UserGroups), nil
+		case matchOutcomeUnauthorised:
+			return denyNoAuthorisedRoute(model), nil
+		default:
+			return denyUnknownModel(model), nil
+		}
+	}
+
+	// Bedrock likewise carries the model in the URL path (/model/{id}/{action}),
+	// optionally behind a "/bedrock" gateway-namespace prefix. Route it by path
+	// before the model lookup; when the prefix is present, strip it from the
+	// forwarded path so the real Bedrock endpoint receives its native path.
+	if isBedrockPath(reqPath) {
+		model, _ := lookupMetadata(in.Metadata, middleware.KeyLLMModel)
+		native, hadPrefix := splitBedrockNamespace(reqPath)
+		route, outcome := m.matchBedrock(native, model, in.UserGroups)
+		switch outcome {
+		case matchOutcomeFound:
+			out := m.allowWithRoute(route, in.UserGroups)
+			if hadPrefix && out.Mutations != nil && out.Mutations.RewriteUpstream != nil {
+				out.Mutations.RewriteUpstream.StripPathPrefix = bedrockNamespacePrefix
+			}
+			return out, nil
+		case matchOutcomeUnauthorised:
+			return denyNoAuthorisedRoute(model), nil
+		default:
+			return denyUnknownModel(model), nil
+		}
+	}
+
+	model, ok := lookupMetadata(in.Metadata, middleware.KeyLLMModel)
+	if !ok || model == "" {
+		// Non-inference endpoints (model listing) carry no model but still
+		// need rewriting from the synth placeholder to a real upstream;
+		// clients such as Codex call GET /v1/models at startup to enumerate
+		// availability and read a 403 as "model unavailable".
+		route, outcome := m.matchModelless(requestPath(in.URL), in.UserGroups)
+		switch outcome {
+		case matchOutcomeFound:
+			return m.allowWithRoute(route, in.UserGroups), nil
+		case matchOutcomeUnauthorised:
+			// A recognised model-less endpoint exists but no provider
+			// authorises the caller — deny as an authorisation failure
+			// rather than masking it as a missing model.
+			return denyNoAuthorisedRoute(model), nil
+		default:
+			return denyMissingModel(), nil
+		}
+	}
+
+	vendor, _ := lookupMetadata(in.Metadata, middleware.KeyLLMProvider)
+	route, outcome := m.matchRoute(model, vendor, requestPath(in.URL), in.UserGroups)
+	switch outcome {
+	case matchOutcomeFound:
+		return m.allowWithRoute(route, in.UserGroups), nil
+	case matchOutcomeUnauthorised:
+		return denyNoAuthorisedRoute(model), nil
+	default:
+		return denyUnknownModel(model), nil
+	}
+}
+
+// matchRoute returns the ProviderRoute that should serve the given
+// model + request path for a caller in the given user-groups. Selection
+// is:
+//
+//  1. Filter the configured providers to those whose Models list
+//     contains the model.
+//  2. Filter the model-matched candidates to those whose
+//     AllowedGroupIDs intersect the caller's UserGroups. A route with
+//     no AllowedGroupIDs is the catch-all: it stays in the list. If
+//     the model was known but no candidate is authorised for this
+//     peer, return matchOutcomeUnauthorised so the caller can emit
+//     the dedicated no_authorised_provider deny code.
+//  3. Vendor precedence: when the request carries a detected vendor
+//     (llm.provider) and at least one candidate is the same vendor,
+//     drop the rest — a vendor-tagged request must never cross to
+//     another vendor's route (e.g. an Anthropic call landing on an
+//     OpenAI-compatible gateway that also claims the model).
+//  4. Model precedence over path: a route that explicitly lists the
+//     model beats a catch-all (empty Models) gateway.
+//  5. Disambiguate the survivors by URL path prefix: longest
+//     UpstreamPath that prefix-matches the request path wins; an empty
+//     UpstreamPath is the catchall. If none prefix-matches, fall back
+//     to declaration order so the model stays routable.
+func (m *Middleware) matchRoute(model, vendor, reqPath string, userGroups []string) (ProviderRoute, matchOutcome) {
+	var modelMatched []ProviderRoute
+	for _, route := range m.cfg.Providers {
+		if routeClaimsModel(route, model) {
+			modelMatched = append(modelMatched, route)
+		}
+	}
+	if len(modelMatched) == 0 {
+		return ProviderRoute{}, matchOutcomeUnknownModel
+	}
+
+	// Vendor pinning runs BEFORE the group filter so a request the parser
+	// tagged with a vendor can never cross to another vendor's route — not
+	// even an authorised one. Narrow to same-vendor routes when any
+	// model-matched route declares that vendor; setups with no vendor tag on
+	// any route fall through unchanged. After narrowing, if no same-vendor
+	// route authorises the caller, that's matchOutcomeUnauthorised (no
+	// cross-vendor fallback).
+	if vendor != "" {
+		if vendorMatched := matchingVendor(modelMatched, vendor); len(vendorMatched) > 0 {
+			modelMatched = vendorMatched
+		}
+	}
+
+	var candidates []ProviderRoute
+	for _, route := range modelMatched {
+		if routeAuthorisesGroups(route, userGroups) {
+			candidates = append(candidates, route)
+		}
+	}
+	if len(candidates) == 0 {
+		return ProviderRoute{}, matchOutcomeUnauthorised
+	}
+
+	// Model routing takes precedence over path. A route that explicitly
+	// lists the model must beat a catch-all (empty Models) gateway that
+	// claims every model — otherwise an Anthropic request can fall through
+	// to an OpenAI-compatible gateway declared earlier. Only when no
+	// candidate explicitly claims the model do the catch-alls compete, and
+	// the path-prefix tiebreak applies within whichever tier wins.
+	if explicit := explicitlyClaiming(candidates, model); len(explicit) > 0 {
+		candidates = explicit
+	}
+	if len(candidates) == 1 {
+		return candidates[0], matchOutcomeFound
+	}
+
+	best := candidates[0]
+	bestLen := -1
+	for _, c := range candidates {
+		if !pathPrefixMatches(c.UpstreamPath, reqPath) {
+			continue
+		}
+		if len(c.UpstreamPath) > bestLen {
+			best = c
+			bestLen = len(c.UpstreamPath)
+		}
+	}
+	return best, matchOutcomeFound
+}
+
+// isModelLessPath reports whether reqPath is a known OpenAI-shaped
+// non-inference endpoint that legitimately carries no model in its
+// request (the model-listing endpoints). These must route to an upstream
+// rather than deny, so model enumeration works end to end.
+func isModelLessPath(reqPath string) bool {
+	return reqPath == "/v1/models" || strings.HasPrefix(reqPath, "/v1/models/")
+}
+
+// isVertexPath reports whether reqPath is a Google Vertex AI publisher
+// endpoint: /v1/projects/{project}/locations/{region}/publishers/{publisher}/
+// models/{model}:{action}. The model + vendor live in the path, so these
+// requests are routed by path to the Vertex provider rather than by model.
+func isVertexPath(reqPath string) bool {
+	return strings.HasPrefix(reqPath, "/v1/projects/") &&
+		strings.Contains(reqPath, "/publishers/") &&
+		strings.Contains(reqPath, "/models/")
+}
+
+// bedrockNamespacePrefix is an optional gateway-namespace prefix some clients
+// place before the native Bedrock path to disambiguate it from other providers
+// that also use "/model/...". It is stripped before forwarding upstream.
+const bedrockNamespacePrefix = "/bedrock"
+
+// splitBedrockNamespace removes an optional "/bedrock" namespace prefix,
+// returning the native Bedrock path and whether the prefix was present.
+func splitBedrockNamespace(reqPath string) (string, bool) {
+	if strings.HasPrefix(reqPath, bedrockNamespacePrefix+"/") {
+		return strings.TrimPrefix(reqPath, bedrockNamespacePrefix), true
+	}
+	return reqPath, false
+}
+
+// isBedrockPath reports whether reqPath is an AWS Bedrock runtime model
+// endpoint: /model/{modelId}/{action} where action is invoke,
+// invoke-with-response-stream, converse, or converse-stream — optionally behind
+// a "/bedrock" gateway-namespace prefix. The model lives in the path, so these
+// requests are routed by path to the Bedrock provider.
+func isBedrockPath(reqPath string) bool {
+	native, _ := splitBedrockNamespace(reqPath)
+	if !strings.HasPrefix(native, "/model/") {
+		return false
+	}
+	return strings.HasSuffix(native, "/invoke") ||
+		strings.HasSuffix(native, "/invoke-with-response-stream") ||
+		strings.HasSuffix(native, "/converse") ||
+		strings.HasSuffix(native, "/converse-stream")
+}
+
+// matchVertex selects the Vertex provider authorised for the caller's groups
+// and claiming the requested model.
+func (m *Middleware) matchVertex(reqPath, model string, userGroups []string) (ProviderRoute, matchOutcome) {
+	return m.matchPathRoute(reqPath, model, userGroups, func(r ProviderRoute) bool { return r.Vertex })
+}
+
+// matchBedrock selects the Bedrock provider authorised for the caller's groups
+// and claiming the requested model.
+func (m *Middleware) matchBedrock(reqPath, model string, userGroups []string) (ProviderRoute, matchOutcome) {
+	return m.matchPathRoute(reqPath, model, userGroups, func(r ProviderRoute) bool { return r.Bedrock })
+}
+
+// matchPathRoute selects a path-routed provider (Vertex/Bedrock). These carry
+// the model in the URL, so the model/vendor table is bypassed — but the route's
+// configured Models allowlist is still enforced (empty Models = catch-all) so a
+// provider credential can't be used for models the operator didn't authorise.
+// Returns matchOutcomeUnauthorised when no style route authorises the caller's
+// groups, matchOutcomeUnknownModel when an authorised route exists but none
+// claims the model (or no style route exists at all), else the chosen route
+// (longest UpstreamPath prefix-match wins among multiple).
+func (m *Middleware) matchPathRoute(reqPath, model string, userGroups []string, isStyle func(ProviderRoute) bool) (ProviderRoute, matchOutcome) {
+	var styled []ProviderRoute
+	for _, route := range m.cfg.Providers {
+		if isStyle(route) {
+			styled = append(styled, route)
+		}
+	}
+	if len(styled) == 0 {
+		return ProviderRoute{}, matchOutcomeUnknownModel
+	}
+
+	var authorised []ProviderRoute
+	for _, route := range styled {
+		if routeAuthorisesGroups(route, userGroups) {
+			authorised = append(authorised, route)
+		}
+	}
+	if len(authorised) == 0 {
+		return ProviderRoute{}, matchOutcomeUnauthorised
+	}
+
+	var candidates []ProviderRoute
+	for _, route := range authorised {
+		if routeClaimsModel(route, model) {
+			candidates = append(candidates, route)
+		}
+	}
+	if len(candidates) == 0 {
+		return ProviderRoute{}, matchOutcomeUnknownModel
+	}
+	if len(candidates) == 1 {
+		return candidates[0], matchOutcomeFound
+	}
+
+	best := candidates[0]
+	bestLen := -1
+	for _, c := range candidates {
+		if !pathPrefixMatches(c.UpstreamPath, reqPath) {
+			continue
+		}
+		if len(c.UpstreamPath) > bestLen {
+			best = c
+			bestLen = len(c.UpstreamPath)
+		}
+	}
+	return best, matchOutcomeFound
+}
+
+// matchModelless selects a route for a non-inference, model-less request.
+// It mirrors matchRoute's group-authorisation filter and path-prefix
+// tiebreak but skips the per-model filter, since any provider the caller's
+// groups authorise can serve a model-listing request. Returns
+// matchOutcomeFound with the chosen route (single authorised provider wins
+// outright; multiple fall to the longest UpstreamPath prefix-match, then
+// declaration order), matchOutcomeUnauthorised when no provider authorises
+// the caller, or matchOutcomeUnknownModel when the path isn't a recognised
+// model-less endpoint.
+func (m *Middleware) matchModelless(reqPath string, userGroups []string) (ProviderRoute, matchOutcome) {
+	if !isModelLessPath(reqPath) {
+		return ProviderRoute{}, matchOutcomeUnknownModel
+	}
+	var candidates []ProviderRoute
+	for _, route := range m.cfg.Providers {
+		// Vertex/Bedrock are path-routed and don't serve OpenAI-style
+		// model-listing endpoints; including them here could rewrite a
+		// GET /v1/models to an upstream that 404s it.
+		if route.Vertex || route.Bedrock {
+			continue
+		}
+		if routeAuthorisesGroups(route, userGroups) {
+			candidates = append(candidates, route)
+		}
+	}
+	if len(candidates) == 0 {
+		return ProviderRoute{}, matchOutcomeUnauthorised
+	}
+	if len(candidates) == 1 {
+		return candidates[0], matchOutcomeFound
+	}
+
+	best := candidates[0]
+	bestLen := -1
+	for _, c := range candidates {
+		if !pathPrefixMatches(c.UpstreamPath, reqPath) {
+			continue
+		}
+		if len(c.UpstreamPath) > bestLen {
+			best = c
+			bestLen = len(c.UpstreamPath)
+		}
+	}
+	return best, matchOutcomeFound
+}
+
+// routeAuthorisesGroups reports whether the route's AllowedGroupIDs
+// intersect the caller's userGroups. A route with empty AllowedGroupIDs
+// is unreachable: the synthesiser only emits routes bound to at least
+// one enabled policy, so an empty list signals a misconfiguration that
+// must not be allowed to fall through.
+func routeAuthorisesGroups(r ProviderRoute, userGroups []string) bool {
+	for _, ug := range userGroups {
+		for _, ag := range r.AllowedGroupIDs {
+			if ug == ag {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// authorisingGroupsCSV returns the sorted, deduplicated comma-separated
+// intersection of routeGroups and userGroups — i.e. the groups that
+// actually authorise the resolved route for this caller. Returns the
+// empty string when the intersection is empty (shouldn't happen on the
+// allow path, but defensive).
+func authorisingGroupsCSV(routeGroups, userGroups []string) string {
+	if len(routeGroups) == 0 || len(userGroups) == 0 {
+		return ""
+	}
+	allowed := make(map[string]struct{}, len(routeGroups))
+	for _, g := range routeGroups {
+		allowed[g] = struct{}{}
+	}
+	seen := make(map[string]struct{}, len(userGroups))
+	out := make([]string, 0, len(userGroups))
+	for _, ug := range userGroups {
+		if _, ok := allowed[ug]; !ok {
+			continue
+		}
+		if _, dup := seen[ug]; dup {
+			continue
+		}
+		seen[ug] = struct{}{}
+		out = append(out, ug)
+	}
+	if len(out) == 0 {
+		return ""
+	}
+	sort.Strings(out)
+	return strings.Join(out, ",")
+}
+
+// matchingVendor returns the subset of routes whose Vendor equals the
+// request's detected vendor. Routes with an empty Vendor never match — an
+// untagged route can't be asserted to speak the request's surface, so it
+// stays out of the vendor-filtered set (but remains eligible via the
+// fall-through when no route matches the vendor at all).
+func matchingVendor(routes []ProviderRoute, vendor string) []ProviderRoute {
+	var out []ProviderRoute
+	for _, r := range routes {
+		if r.Vendor == vendor {
+			out = append(out, r)
+		}
+	}
+	return out
+}
+
+// explicitlyClaiming returns the subset of routes whose Models list
+// names the model exactly. Catch-all routes (empty Models) are excluded,
+// so callers can prefer a provider that genuinely declares the model over
+// a gateway that claims everything.
+func explicitlyClaiming(routes []ProviderRoute, model string) []ProviderRoute {
+	var out []ProviderRoute
+	for _, r := range routes {
+		for _, candidate := range r.Models {
+			if candidate == model {
+				out = append(out, r)
+				break
+			}
+		}
+	}
+	return out
+}
+
+// routeClaimsModel reports whether the route's Models list contains
+// the given model identifier. An empty Models list is treated as
+// "claim every model" — used by gateway-style providers (LiteLLM,
+// custom OpenAI-compatible endpoints) that proxy an open-ended set of
+// upstream models the operator can't enumerate in NetBird's provider
+// config.
+func routeClaimsModel(route ProviderRoute, model string) bool {
+	if len(route.Models) == 0 {
+		return true
+	}
+	for _, candidate := range route.Models {
+		if candidate == model {
+			return true
+		}
+	}
+	return false
+}
+
+// pathPrefixMatches reports whether upstreamPath matches reqPath on a path-
+// segment boundary: an exact match, or reqPath continuing after
+// upstreamPath at a "/" separator. This avoids a sibling base like
+// "/openai" spuriously matching "/openai-test". An empty (or "/")
+// upstreamPath always matches (catchall).
+func pathPrefixMatches(upstreamPath, reqPath string) bool {
+	if upstreamPath == "" || upstreamPath == "/" {
+		return true
+	}
+	upstreamPath = strings.TrimRight(upstreamPath, "/")
+	return reqPath == upstreamPath || strings.HasPrefix(reqPath, upstreamPath+"/")
+}
+
+// requestPath extracts the path component from an Input.URL string
+// (which is r.URL.String() — typically "/path?query"). Returns the
+// raw input on parse failure so the prefix check can still operate on
+// the unparsed value.
+func requestPath(raw string) string {
+	if raw == "" {
+		return ""
+	}
+	parsed, err := url.Parse(raw)
+	if err != nil {
+		return raw
+	}
+	return parsed.Path
+}
+
+// allowWithRoute builds the Output for a successful route match. The
+// returned Mutations carry the upstream rewrite plus — riding on it —
+// the StripHeaders list and the AuthHeader to inject.
+//
+// The strip + inject MUST go through UpstreamRewrite (not HeadersAdd /
+// HeadersRemove) because the framework's mutation gate runs every
+// header change through a denylist that blocks Authorization,
+// Cookie, etc. — exactly the headers the router is replacing. The
+// proxy's upstream-build path applies AuthHeader / StripHeaders
+// directly, bypassing the denylist by virtue of being a trusted
+// proxy operation rather than an arbitrary middleware mutation.
+//
+// Emits the authorising-groups intersection alongside the resolved
+// provider id so identity-stamping middlewares (llm_identity_inject)
+// tag the request with ONLY the groups that authorised this specific
+// route — not every group the peer happens to be in.
+func (m *Middleware) allowWithRoute(route ProviderRoute, userGroups []string) *middleware.Output {
+	rewrite := &middleware.UpstreamRewrite{
+		Scheme: route.UpstreamScheme,
+		Host:   route.UpstreamHost,
+		// UpstreamPath is the path component the operator pasted on
+		// the provider record (e.g. "/v1/{account}/{gateway}/compat"
+		// for Cloudflare AI Gateway). Carrying it on the rewrite so
+		// the proxy's URL composer joins it with the agent's request
+		// path — without this, the operator's configured upstream
+		// path is silently dropped and the gateway returns a 4xx for
+		// the malformed URL. Empty value leaves the original
+		// target's path untouched.
+		Path:         route.UpstreamPath,
+		StripHeaders: append([]string(nil), strippedAuthHeaders...),
+	}
+	authValue := route.AuthHeaderValue
+	if route.GCPServiceAccountKeyB64 != "" {
+		// Mint a short-lived OAuth2 token from the service-account key at
+		// request time (cached + auto-refreshed) instead of a static value.
+		bearer, err := m.gcpBearer(route.GCPServiceAccountKeyB64)
+		if err != nil {
+			return denyUpstreamAuth()
+		}
+		authValue = bearer
+	}
+	if route.AuthHeaderName != "" && authValue != "" {
+		rewrite.AuthHeader = &middleware.AuthHeader{
+			Name:  route.AuthHeaderName,
+			Value: authValue,
+		}
+	}
+	return &middleware.Output{
+		Decision:  middleware.DecisionAllow,
+		Mutations: &middleware.Mutations{RewriteUpstream: rewrite},
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMResolvedProviderID, Value: route.ID},
+			{Key: middleware.KeyLLMAuthorisingGroups, Value: authorisingGroupsCSV(route.AllowedGroupIDs, userGroups)},
+			{Key: middleware.KeyLLMPolicyDecision, Value: "allow"},
+		},
+	}
+}
+
+// gcpBearer returns a "Bearer <token>" value minted from a base64-encoded GCP
+// service-account key, using a cached, auto-refreshing token source.
+func (m *Middleware) gcpBearer(saKeyB64 string) (string, error) {
+	ts, err := m.gcpTokenSource(saKeyB64)
+	if err != nil {
+		return "", err
+	}
+	tok, err := ts.Token()
+	if err != nil {
+		return "", fmt.Errorf("mint gcp token: %w", err)
+	}
+	return "Bearer " + tok.AccessToken, nil
+}
+
+// gcpTokenSource returns the cached TokenSource for the given service-account
+// key, building it (decode base64 → parse JSON → cloud-platform scope) on first
+// use. The returned source caches the token and refreshes it before expiry.
+func (m *Middleware) gcpTokenSource(saKeyB64 string) (oauth2.TokenSource, error) {
+	sum := sha256.Sum256([]byte(saKeyB64))
+	key := hex.EncodeToString(sum[:])
+
+	m.tokenMu.Lock()
+	defer m.tokenMu.Unlock()
+	if m.tokenSrc == nil {
+		m.tokenSrc = map[string]oauth2.TokenSource{}
+	}
+	if ts, ok := m.tokenSrc[key]; ok {
+		return ts, nil
+	}
+	jsonKey, err := base64.StdEncoding.DecodeString(strings.TrimSpace(saKeyB64))
+	if err != nil {
+		return nil, fmt.Errorf("decode gcp service-account key: %w", err)
+	}
+	conf, err := google.JWTConfigFromJSON(jsonKey, gcpScope)
+	if err != nil {
+		return nil, fmt.Errorf("parse gcp service-account key: %w", err)
+	}
+	// Bound mint/refresh with a timeout HTTP client so a slow token endpoint
+	// can't hang the request. The oauth2 library uses this client for the
+	// lifetime of the (auto-refreshing) source.
+	ctx := context.WithValue(context.Background(), oauth2.HTTPClient, &http.Client{Timeout: gcpTokenTimeout})
+	ts := conf.TokenSource(ctx)
+	m.tokenSrc[key] = ts
+	return ts, nil
+}
+
+// denyUpstreamAuth is returned when the router cannot obtain the upstream
+// credential (e.g. a malformed service-account key or an unreachable token
+// endpoint). It surfaces as a 502 — an upstream problem, not a policy denial.
+func denyUpstreamAuth() *middleware.Output {
+	return &middleware.Output{
+		Decision:   middleware.DecisionDeny,
+		DenyStatus: 502,
+		DenyReason: &middleware.DenyReason{
+			Code:    denyCodeUpstreamAuth,
+			Message: "could not obtain upstream credential",
+		},
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMPolicyDecision, Value: "deny"},
+			{Key: middleware.KeyLLMPolicyReason, Value: "upstream_auth_failed"},
+		},
+	}
+}
+
+// denyUnmeterable returns the deny envelope for a path-routed request whose
+// publisher has no parser surface, so its usage can't be metered. Serving it
+// would bypass token/budget caps, so it is rejected with a 403.
+func denyUnmeterable() *middleware.Output {
+	return &middleware.Output{
+		Decision:   middleware.DecisionDeny,
+		DenyStatus: 403,
+		DenyReason: &middleware.DenyReason{
+			Code:    denyCodeUnmeterable,
+			Message: "request publisher is not supported for metering",
+		},
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMPolicyDecision, Value: "deny"},
+			{Key: middleware.KeyLLMPolicyReason, Value: denyReasonUnmeterable},
+		},
+	}
+}
+
+// denyMissingModel returns the deny envelope for a request whose
+// envelope has no llm.model metadata.
+func denyMissingModel() *middleware.Output {
+	return &middleware.Output{
+		Decision:   middleware.DecisionDeny,
+		DenyStatus: 403,
+		DenyReason: &middleware.DenyReason{
+			Code:    denyCodeNotRoutable,
+			Message: "missing llm.model on request envelope",
+		},
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMPolicyDecision, Value: "deny"},
+			{Key: middleware.KeyLLMPolicyReason, Value: denyReasonNotRoutable},
+		},
+	}
+}
+
+// denyUnknownModel returns the deny envelope for a model that no
+// configured provider claims.
+func denyUnknownModel(model string) *middleware.Output {
+	return &middleware.Output{
+		Decision:   middleware.DecisionDeny,
+		DenyStatus: 403,
+		DenyReason: &middleware.DenyReason{
+			Code:    denyCodeNotRoutable,
+			Message: fmt.Sprintf("no provider configured for model %s", model),
+			Details: map[string]string{"model": model},
+		},
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMPolicyDecision, Value: "deny"},
+			{Key: middleware.KeyLLMPolicyReason, Value: denyReasonNotRoutable},
+		},
+	}
+}
+
+// denyNoAuthorisedRoute returns the deny envelope for a model that one
+// or more providers claim, but where no policy authorises the caller's
+// groups for any of those providers.
+func denyNoAuthorisedRoute(model string) *middleware.Output {
+	return &middleware.Output{
+		Decision:   middleware.DecisionDeny,
+		DenyStatus: 403,
+		DenyReason: &middleware.DenyReason{
+			Code:    denyCodeNoAuthorisedRoute,
+			Message: fmt.Sprintf("no policy authorises model %s for the caller's groups", model),
+			Details: map[string]string{"model": model},
+		},
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMPolicyDecision, Value: "deny"},
+			{Key: middleware.KeyLLMPolicyReason, Value: denyReasonNoAuthorisedRoute},
+		},
+	}
+}
+
+// lookupMetadata returns the value for key plus a presence flag so
+// callers can distinguish absent from empty.
+func lookupMetadata(meta []middleware.KV, key string) (string, bool) {
+	for _, kv := range meta {
+		if kv.Key == key {
+			return kv.Value, true
+		}
+	}
+	return "", false
+}
diff --git a/proxy/internal/middleware/builtin/llm_router/middleware_test.go b/proxy/internal/middleware/builtin/llm_router/middleware_test.go
new file mode 100644
index 000000000..8ae03c5ba
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_router/middleware_test.go
@@ -0,0 +1,840 @@
+package llm_router
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+)
+
+// metaValue returns the value for the first KV with the given key.
+func metaValue(t *testing.T, kvs []middleware.KV, key string) (string, bool) {
+	t.Helper()
+	for _, kv := range kvs {
+		if kv.Key == key {
+			return kv.Value, true
+		}
+	}
+	return "", false
+}
+
+// defaultTestGroup is the group id used by routes and inputs in tests
+// that don't specifically exercise the group-filter logic. Pairing it
+// with the same id on every test route keeps the legacy assertions
+// focused on routing/path behaviour without each one having to bake in
+// its own ACL.
+const defaultTestGroup = "grp-test"
+
+// newInputWithModel returns an Input carrying llm.model in its metadata
+// bag, mimicking the post-llm_request_parser state the router observes
+// in production. UserGroups is populated with defaultTestGroup so the
+// router's group-filter pass authorises any test route whose
+// AllowedGroupIDs contains the same id.
+func newInputWithModel(model string) *middleware.Input {
+	return &middleware.Input{
+		Slot:       middleware.SlotOnRequest,
+		Metadata:   []middleware.KV{{Key: middleware.KeyLLMModel, Value: model}},
+		UserGroups: []string{defaultTestGroup},
+	}
+}
+
+// newInputWithModelAndURL returns an Input carrying both llm.model and
+// a request URL so router tests can exercise path-based disambiguation.
+func newInputWithModelAndURL(model, reqURL string) *middleware.Input {
+	in := newInputWithModel(model)
+	in.URL = reqURL
+	return in
+}
+
+func TestMiddlewareIdentity(t *testing.T) {
+	mw := New(Config{})
+	assert.Equal(t, ID, mw.ID(), "middleware ID must be llm_router")
+	assert.Equal(t, Version, mw.Version(), "version must match the constant")
+	assert.Equal(t, middleware.SlotOnRequest, mw.Slot(), "router must run in SlotOnRequest")
+	assert.True(t, mw.MutationsSupported(), "router must declare mutations support")
+	assert.Nil(t, mw.AcceptedContentTypes(), "router does not inspect bodies")
+	assert.ElementsMatch(t,
+		[]string{
+			middleware.KeyLLMResolvedProviderID,
+			middleware.KeyLLMAuthorisingGroups,
+			middleware.KeyLLMPolicyDecision,
+			middleware.KeyLLMPolicyReason,
+		},
+		mw.MetadataKeys(),
+		"metadata key allowlist must match the spec",
+	)
+	require.NoError(t, mw.Close())
+}
+
+func TestRouter_HappyPath(t *testing.T) {
+	route := ProviderRoute{
+		ID:              "openai-prod",
+		Models:          []string{"gpt-4o"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "api.openai.com",
+		AuthHeaderName:  "Authorization",
+		AuthHeaderValue: "Bearer sk-test-123",
+	}
+	mw := New(Config{Providers: []ProviderRoute{route}})
+
+	out, err := mw.Invoke(context.Background(), newInputWithModel("gpt-4o"))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "matched model must allow")
+
+	require.NotNil(t, out.Mutations, "matched route must emit mutations")
+	rewrite := out.Mutations.RewriteUpstream
+	require.NotNil(t, rewrite, "matched route must emit upstream rewrite")
+	assert.Equal(t, "https", rewrite.Scheme, "rewrite scheme must come from the matched route")
+	assert.Equal(t, "api.openai.com", rewrite.Host, "rewrite host must come from the matched route")
+
+	assert.ElementsMatch(t, strippedAuthHeaders, rewrite.StripHeaders,
+		"strip list rides on UpstreamRewrite (bypasses framework denylist) and must cover every known vendor auth header")
+	require.NotNil(t, rewrite.AuthHeader, "router must inject the auth header via the rewrite (not HeadersAdd) so the proxy bypasses the denylist")
+	assert.Equal(t, "Authorization", rewrite.AuthHeader.Name, "injected header name must come from the route")
+	assert.Equal(t, "Bearer sk-test-123", rewrite.AuthHeader.Value, "injected header value must come from the route")
+	assert.Empty(t, out.Mutations.HeadersAdd, "router must not use HeadersAdd; auth flows through UpstreamRewrite.AuthHeader")
+	assert.Empty(t, out.Mutations.HeadersRemove, "router must not use HeadersRemove; strip flows through UpstreamRewrite.StripHeaders")
+
+	resolved, ok := metaValue(t, out.Metadata, middleware.KeyLLMResolvedProviderID)
+	require.True(t, ok, "router must emit llm.resolved_provider_id on a match")
+	assert.Equal(t, "openai-prod", resolved, "resolved provider id must be the matched route's ID")
+	dec, _ := metaValue(t, out.Metadata, middleware.KeyLLMPolicyDecision)
+	assert.Equal(t, "allow", dec, "decision metadata must be allow on a match")
+}
+
+func TestRouter_MissingModel(t *testing.T) {
+	mw := New(Config{Providers: []ProviderRoute{{
+		ID:              "openai-prod",
+		Models:          []string{"gpt-4o"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "api.openai.com",
+	}}})
+
+	out, err := mw.Invoke(context.Background(), &middleware.Input{Slot: middleware.SlotOnRequest})
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionDeny, out.Decision, "missing llm.model must deny")
+	assert.Equal(t, 403, out.DenyStatus, "deny status must be 403")
+	require.NotNil(t, out.DenyReason, "deny reason must be populated")
+	assert.Equal(t, "llm_policy.model_not_routable", out.DenyReason.Code, "deny code must be model_not_routable")
+	assert.Equal(t, "missing llm.model on request envelope", out.DenyReason.Message, "deny message must match spec")
+
+	dec, _ := metaValue(t, out.Metadata, middleware.KeyLLMPolicyDecision)
+	assert.Equal(t, "deny", dec, "decision metadata must be deny")
+	reason, _ := metaValue(t, out.Metadata, middleware.KeyLLMPolicyReason)
+	assert.Equal(t, "model_not_routable", reason, "reason metadata must be model_not_routable")
+}
+
+// newModellessInput returns an Input with no llm.model and the given
+// request path, mimicking a GET /v1/models call (which carries no body
+// from which a model could be parsed). UserGroups matches defaultTestGroup.
+func newModellessInput(reqURL string) *middleware.Input {
+	return &middleware.Input{
+		Slot:       middleware.SlotOnRequest,
+		URL:        reqURL,
+		UserGroups: []string{defaultTestGroup},
+	}
+}
+
+func TestRouter_ModelLessPath_RoutesToAuthorisedProvider(t *testing.T) {
+	route := ProviderRoute{
+		ID:              "openai-prod",
+		Models:          []string{"gpt-4o"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "api.openai.com",
+	}
+	mw := New(Config{Providers: []ProviderRoute{route}})
+
+	out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models?client_version=1"))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "GET /v1/models must pass through, not deny")
+	require.NotNil(t, out.Mutations, "a pass-through must rewrite the upstream")
+	require.NotNil(t, out.Mutations.RewriteUpstream, "model-less route must still rewrite to the real upstream")
+	assert.Equal(t, "api.openai.com", out.Mutations.RewriteUpstream.Host, "must target the authorised provider's host")
+
+	provider, _ := metaValue(t, out.Metadata, middleware.KeyLLMResolvedProviderID)
+	assert.Equal(t, "openai-prod", provider, "resolved provider must be the authorised route")
+}
+
+func TestRouter_ModelLessPath_MultiProviderDeclarationOrder(t *testing.T) {
+	first := ProviderRoute{
+		ID:              "openai-a",
+		Models:          []string{"gpt-4o"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "a.example.com",
+	}
+	second := ProviderRoute{
+		ID:              "openai-b",
+		Models:          []string{"gpt-4o-mini"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "b.example.com",
+	}
+	mw := New(Config{Providers: []ProviderRoute{first, second}})
+
+	out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models"))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "model-less path must pass through with multiple providers")
+	provider, _ := metaValue(t, out.Metadata, middleware.KeyLLMResolvedProviderID)
+	assert.Equal(t, "openai-a", provider, "no path-prefix match falls back to declaration order")
+}
+
+func TestRouter_ModelLessPath_UnauthorisedDenies(t *testing.T) {
+	mw := New(Config{Providers: []ProviderRoute{{
+		ID:              "openai-prod",
+		Models:          []string{"gpt-4o"},
+		AllowedGroupIDs: []string{"some-other-group"},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "api.openai.com",
+	}}})
+
+	out, err := mw.Invoke(context.Background(), newModellessInput("/v1/models"))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionDeny, out.Decision, "no provider authorising the caller must still deny")
+}
+
+func TestRouter_NonModelLessBodilessStillDenies(t *testing.T) {
+	mw := New(Config{Providers: []ProviderRoute{{
+		ID:              "openai-prod",
+		Models:          []string{"gpt-4o"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "api.openai.com",
+	}}})
+
+	// A bodiless POST to an inference path has no model and is NOT a
+	// model-less endpoint, so it must keep denying.
+	out, err := mw.Invoke(context.Background(), newModellessInput("/v1/responses"))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionDeny, out.Decision, "bodiless inference request must still deny")
+	assert.Equal(t, "llm_policy.model_not_routable", out.DenyReason.Code, "deny code stays model_not_routable")
+}
+
+// TestRouter_ExplicitModelBeatsCatchallGateway is the regression guard
+// for multi-provider misrouting: a catch-all (empty Models) OpenAI-compat
+// gateway declared first must NOT swallow a model an explicit provider
+// claims. Anthropic's claude request must reach the Anthropic route even
+// though the gateway claims every model and wins declaration order.
+func TestRouter_ExplicitModelBeatsCatchallGateway(t *testing.T) {
+	gateway := ProviderRoute{
+		ID:              "openai-gateway",
+		Models:          nil, // catch-all: claims every model
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "api.openai.com",
+	}
+	anthropic := ProviderRoute{
+		ID:              "anthropic-prod",
+		Models:          []string{"claude-opus-4"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "api.anthropic.com",
+	}
+	// Gateway declared first to prove explicit claim beats declaration order.
+	mw := New(Config{Providers: []ProviderRoute{gateway, anthropic}})
+
+	out, err := mw.Invoke(context.Background(), newInputWithModelAndURL("claude-opus-4", "/v1/messages"))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "explicit-model request must route, not deny")
+	require.NotNil(t, out.Mutations)
+	require.NotNil(t, out.Mutations.RewriteUpstream)
+	assert.Equal(t, "api.anthropic.com", out.Mutations.RewriteUpstream.Host, "claude must reach the explicit Anthropic route, not the catch-all gateway")
+
+	provider, _ := metaValue(t, out.Metadata, middleware.KeyLLMResolvedProviderID)
+	assert.Equal(t, "anthropic-prod", provider, "resolved provider must be the explicit Anthropic route")
+}
+
+// TestRouter_CatchallStillServesUnlistedModel confirms the catch-all
+// gateway still wins models no explicit provider claims (its whole point).
+func TestRouter_CatchallStillServesUnlistedModel(t *testing.T) {
+	gateway := ProviderRoute{
+		ID:              "openai-gateway",
+		Models:          nil,
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "gateway.example.com",
+	}
+	anthropic := ProviderRoute{
+		ID:              "anthropic-prod",
+		Models:          []string{"claude-opus-4"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "api.anthropic.com",
+	}
+	mw := New(Config{Providers: []ProviderRoute{gateway, anthropic}})
+
+	out, err := mw.Invoke(context.Background(), newInputWithModelAndURL("some-exotic-model", "/v1/chat/completions"))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "unlisted model must still route via the catch-all")
+	require.NotNil(t, out.Mutations.RewriteUpstream)
+	assert.Equal(t, "gateway.example.com", out.Mutations.RewriteUpstream.Host, "unlisted model falls to the catch-all gateway")
+}
+
+// newInputVendorModelURL returns an Input carrying both the detected
+// vendor (llm.provider) and the model, plus a request URL — mimicking the
+// post-llm_request_parser state for a real inference call.
+func newInputVendorModelURL(vendor, model, reqURL string) *middleware.Input {
+	return &middleware.Input{
+		Slot: middleware.SlotOnRequest,
+		URL:  reqURL,
+		Metadata: []middleware.KV{
+			{Key: middleware.KeyLLMProvider, Value: vendor},
+			{Key: middleware.KeyLLMModel, Value: model},
+		},
+		UserGroups: []string{defaultTestGroup},
+	}
+}
+
+// TestRouter_VendorKeepsAnthropicOffOpenAIGateway is the regression guard
+// for the reported multi-provider break: two catch-all providers (neither
+// enumerates models), the OpenAI one declared first. Without vendor
+// awareness, a claude request matches both, no path prefixes, and
+// declaration order sends it to OpenAI → 502. The detected vendor must
+// pin it to the Anthropic route.
+func TestRouter_VendorKeepsAnthropicOffOpenAIGateway(t *testing.T) {
+	openai := ProviderRoute{
+		ID:              "openai-gw",
+		Vendor:          "openai",
+		Models:          nil, // catch-all
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "api.openai.com",
+	}
+	anthropic := ProviderRoute{
+		ID:              "anthropic-gw",
+		Vendor:          "anthropic",
+		Models:          nil, // catch-all
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "api.anthropic.com",
+	}
+	mw := New(Config{Providers: []ProviderRoute{openai, anthropic}}) // openai first
+
+	out, err := mw.Invoke(context.Background(), newInputVendorModelURL("anthropic", "claude-opus-4-8", "/v1/messages"))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "claude request must route, not deny")
+	require.NotNil(t, out.Mutations.RewriteUpstream)
+	assert.Equal(t, "api.anthropic.com", out.Mutations.RewriteUpstream.Host, "anthropic vendor must pin to the anthropic route despite openai being declared first")
+
+	provider, _ := metaValue(t, out.Metadata, middleware.KeyLLMResolvedProviderID)
+	assert.Equal(t, "anthropic-gw", provider)
+}
+
+// TestRouter_VendorKeepsOpenAIOffAnthropic is the reciprocal: an OpenAI
+// request must stay on the OpenAI route even when the Anthropic catch-all
+// is declared first.
+func TestRouter_VendorKeepsOpenAIOffAnthropic(t *testing.T) {
+	anthropic := ProviderRoute{
+		ID:              "anthropic-gw",
+		Vendor:          "anthropic",
+		Models:          nil,
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "api.anthropic.com",
+	}
+	openai := ProviderRoute{
+		ID:              "openai-gw",
+		Vendor:          "openai",
+		Models:          nil,
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "api.openai.com",
+	}
+	mw := New(Config{Providers: []ProviderRoute{anthropic, openai}}) // anthropic first
+
+	out, err := mw.Invoke(context.Background(), newInputVendorModelURL("openai", "gpt-5.5", "/v1/responses"))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	require.NotNil(t, out.Mutations.RewriteUpstream)
+	assert.Equal(t, "api.openai.com", out.Mutations.RewriteUpstream.Host, "openai vendor must pin to the openai route despite anthropic being declared first")
+}
+
+// TestRouter_VendorAbsentFallsBackToModelPath confirms vendor filtering is
+// inert when the request carries no detected vendor: routing then relies on
+// model/path as before.
+func TestRouter_VendorAbsentFallsBackToModelPath(t *testing.T) {
+	openai := ProviderRoute{
+		ID:              "openai-gw",
+		Vendor:          "openai",
+		Models:          []string{"gpt-5.5"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "api.openai.com",
+	}
+	mw := New(Config{Providers: []ProviderRoute{openai}})
+
+	// No llm.provider in metadata — only the model.
+	out, err := mw.Invoke(context.Background(), newInputWithModel("gpt-5.5"))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "explicit-model match must still route with no vendor present")
+}
+
+func TestRouter_UnknownModel(t *testing.T) {
+	mw := New(Config{Providers: []ProviderRoute{{
+		ID:              "openai-prod",
+		Models:          []string{"gpt-4o"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "api.openai.com",
+	}}})
+
+	out, err := mw.Invoke(context.Background(), newInputWithModel("claude-opus-4"))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionDeny, out.Decision, "unrouted model must deny")
+	assert.Equal(t, 403, out.DenyStatus, "deny status must be 403")
+	require.NotNil(t, out.DenyReason, "deny reason must be populated")
+	assert.Equal(t, "llm_policy.model_not_routable", out.DenyReason.Code, "deny code must be model_not_routable")
+	assert.Equal(t, "no provider configured for model claude-opus-4", out.DenyReason.Message, "deny message must reference the offending model")
+	assert.Equal(t, "claude-opus-4", out.DenyReason.Details["model"], "deny details must include the offending model")
+}
+
+func TestRouter_HeaderStripList(t *testing.T) {
+	mw := New(Config{Providers: []ProviderRoute{{
+		ID:              "openai-prod",
+		Models:          []string{"gpt-4o"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "api.openai.com",
+		AuthHeaderName:  "Authorization",
+		AuthHeaderValue: "Bearer sk-test-123",
+	}}})
+
+	out, err := mw.Invoke(context.Background(), newInputWithModel("gpt-4o"))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	require.NotNil(t, out.Mutations, "matched route must emit mutations")
+
+	expected := []string{
+		"Authorization",
+		"Proxy-Authorization",
+		"x-api-key",
+		"api-key",
+	}
+	require.NotNil(t, out.Mutations.RewriteUpstream, "matched route must emit upstream rewrite")
+	for _, header := range expected {
+		assert.Contains(t, out.Mutations.RewriteUpstream.StripHeaders, header,
+			"strip list (on UpstreamRewrite) must include the well-known vendor auth header %s", header)
+	}
+
+	// Vendor metadata headers MUST NOT be stripped: the client SDK sets them
+	// and the upstream requires them. Anthropic returns 400 "anthropic-version:
+	// header is required" if we drop it. Lock the regression.
+	preserved := []string{"anthropic-version", "openai-organization", "openai-project"}
+	for _, header := range preserved {
+		assert.NotContains(t, out.Mutations.RewriteUpstream.StripHeaders, header,
+			"vendor metadata header %s must NOT be stripped — upstreams require it", header)
+	}
+}
+
+func TestRouter_FirstMatchWins(t *testing.T) {
+	first := ProviderRoute{
+		ID:              "first",
+		Models:          []string{"gpt-4o"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "first.test",
+		AuthHeaderName:  "Authorization",
+		AuthHeaderValue: "Bearer first",
+	}
+	second := ProviderRoute{
+		ID:              "second",
+		Models:          []string{"gpt-4o"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "second.test",
+		AuthHeaderName:  "Authorization",
+		AuthHeaderValue: "Bearer second",
+	}
+	mw := New(Config{Providers: []ProviderRoute{first, second}})
+
+	out, err := mw.Invoke(context.Background(), newInputWithModel("gpt-4o"))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "duplicate-model match must still allow")
+	require.NotNil(t, out.Mutations, "matched route must emit mutations")
+	require.NotNil(t, out.Mutations.RewriteUpstream, "matched route must emit upstream rewrite")
+	assert.Equal(t, "first.test", out.Mutations.RewriteUpstream.Host, "first-match-wins must pick the earlier route")
+
+	resolved, _ := metaValue(t, out.Metadata, middleware.KeyLLMResolvedProviderID)
+	assert.Equal(t, "first", resolved, "resolved provider id must be the earlier route's ID")
+}
+
+// TestRouter_PathDisambiguation_PrefixWinsOverCatchall locks in the
+// rule the user nailed down: two providers claim the same model, one
+// has an UpstreamPath that prefixes the incoming URL, the other has
+// no path. The path-prefixed provider wins because the path is a
+// strictly more specific match than the empty catchall.
+func TestRouter_PathDisambiguation_PrefixWinsOverCatchall(t *testing.T) {
+	corp := ProviderRoute{
+		ID:              "corp-openai-compat",
+		Models:          []string{"gpt-5"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "corp.example.com",
+		UpstreamPath:    "/openai",
+		AuthHeaderName:  "Authorization",
+		AuthHeaderValue: "Bearer corp",
+	}
+	openai := ProviderRoute{
+		ID:              "openai",
+		Models:          []string{"gpt-5"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "api.openai.com",
+		AuthHeaderName:  "Authorization",
+		AuthHeaderValue: "Bearer openai",
+	}
+	mw := New(Config{Providers: []ProviderRoute{openai, corp}}) // openai listed first to prove path beats declaration order
+
+	out, err := mw.Invoke(context.Background(), newInputWithModelAndURL("gpt-5", "/openai/v1/chat/completions"))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	require.Equal(t, middleware.DecisionAllow, out.Decision, "path-prefix match must allow")
+	require.NotNil(t, out.Mutations.RewriteUpstream)
+	assert.Equal(t, "corp.example.com", out.Mutations.RewriteUpstream.Host,
+		"path-prefixed provider must beat the catchall when its UpstreamPath is a prefix of the request path")
+	resolved, _ := metaValue(t, out.Metadata, middleware.KeyLLMResolvedProviderID)
+	assert.Equal(t, "corp-openai-compat", resolved, "resolved provider id must reflect the path-prefix winner, not the first declared")
+}
+
+// TestRouter_PathDisambiguation_CatchallWhenNoPrefixMatches is the
+// inverse: the path-prefixed provider does NOT match the incoming
+// path, so the empty-path catchall takes the request.
+func TestRouter_PathDisambiguation_CatchallWhenNoPrefixMatches(t *testing.T) {
+	corp := ProviderRoute{
+		ID:              "corp-openai-compat",
+		Models:          []string{"gpt-5"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "corp.example.com",
+		UpstreamPath:    "/openai",
+		AuthHeaderName:  "Authorization",
+		AuthHeaderValue: "Bearer corp",
+	}
+	openai := ProviderRoute{
+		ID:              "openai",
+		Models:          []string{"gpt-5"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "api.openai.com",
+		AuthHeaderName:  "Authorization",
+		AuthHeaderValue: "Bearer openai",
+	}
+	mw := New(Config{Providers: []ProviderRoute{corp, openai}})
+
+	out, err := mw.Invoke(context.Background(), newInputWithModelAndURL("gpt-5", "/v1/chat/completions"))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	require.Equal(t, middleware.DecisionAllow, out.Decision, "catchall must allow when no path prefix matches")
+	require.NotNil(t, out.Mutations.RewriteUpstream)
+	assert.Equal(t, "api.openai.com", out.Mutations.RewriteUpstream.Host,
+		"empty-path catchall must win when the path-prefixed provider's UpstreamPath does not match the request")
+	resolved, _ := metaValue(t, out.Metadata, middleware.KeyLLMResolvedProviderID)
+	assert.Equal(t, "openai", resolved, "resolved provider id must be the catchall")
+}
+
+// TestRouter_PathDisambiguation_LongestPrefixWins covers the case
+// where multiple providers have non-empty UpstreamPath values that
+// both prefix the request — the longer (more specific) one wins.
+func TestRouter_PathDisambiguation_LongestPrefixWins(t *testing.T) {
+	short := ProviderRoute{
+		ID:              "short-prefix",
+		Models:          []string{"gpt-5"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "short.example.com",
+		UpstreamPath:    "/openai",
+	}
+	long := ProviderRoute{
+		ID:              "long-prefix",
+		Models:          []string{"gpt-5"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "long.example.com",
+		UpstreamPath:    "/openai/v1",
+	}
+	mw := New(Config{Providers: []ProviderRoute{short, long}})
+
+	out, err := mw.Invoke(context.Background(), newInputWithModelAndURL("gpt-5", "/openai/v1/chat/completions"))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	require.NotNil(t, out.Mutations.RewriteUpstream)
+	assert.Equal(t, "long.example.com", out.Mutations.RewriteUpstream.Host,
+		"longest matching UpstreamPath must win — most specific match")
+}
+
+// TestRouter_SingleMatchIgnoresPath proves the path-prefix rule is a
+// disambiguation pass, not a gate: when only one provider claims the
+// model, it wins regardless of UpstreamPath. Otherwise a path-scoped
+// provider would 403 every request whose URL doesn't include the
+// path, which would break SDKs configured to hit the gateway root.
+func TestRouter_SingleMatchIgnoresPath(t *testing.T) {
+	only := ProviderRoute{
+		ID:              "only",
+		Models:          []string{"gpt-5"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "only.example.com",
+		UpstreamPath:    "/openai",
+		AuthHeaderName:  "Authorization",
+		AuthHeaderValue: "Bearer only",
+	}
+	mw := New(Config{Providers: []ProviderRoute{only}})
+
+	out, err := mw.Invoke(context.Background(), newInputWithModelAndURL("gpt-5", "/v1/chat/completions"))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision,
+		"single model-matching provider must serve the request even when UpstreamPath doesn't prefix the URL — path is a tiebreaker, not a gate")
+	require.NotNil(t, out.Mutations.RewriteUpstream)
+	assert.Equal(t, "only.example.com", out.Mutations.RewriteUpstream.Host, "the only model-matching provider should be selected")
+}
+
+// TestRouter_PathDisambiguation_FallbackWhenNoPrefixMatches covers
+// the multi-candidate edge case where every candidate has a
+// non-matching non-empty UpstreamPath. The router falls back to
+// declaration order so the model is still routable rather than 403'd.
+func TestRouter_PathDisambiguation_FallbackWhenNoPrefixMatches(t *testing.T) {
+	first := ProviderRoute{
+		ID:              "first",
+		Models:          []string{"gpt-5"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "first.example.com",
+		UpstreamPath:    "/openai",
+	}
+	second := ProviderRoute{
+		ID:              "second",
+		Models:          []string{"gpt-5"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "second.example.com",
+		UpstreamPath:    "/anthropic",
+	}
+	mw := New(Config{Providers: []ProviderRoute{first, second}})
+
+	out, err := mw.Invoke(context.Background(), newInputWithModelAndURL("gpt-5", "/v1/chat/completions"))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "no path match among multi-candidates must still allow")
+	require.NotNil(t, out.Mutations.RewriteUpstream)
+	assert.Equal(t, "first.example.com", out.Mutations.RewriteUpstream.Host,
+		"when no candidate's UpstreamPath prefix-matches the request, fall back to declaration order")
+}
+
+func TestRouter_FactoryRejectsBadJSON(t *testing.T) {
+	_, err := Factory{}.New([]byte("{not json"))
+	require.Error(t, err, "malformed JSON config must be rejected at chain build time")
+}
+
+func TestRouter_FactoryAcceptsEmptyShapes(t *testing.T) {
+	cases := [][]byte{nil, []byte(""), []byte(" "), []byte("null"), []byte("{}"), []byte("[]")}
+	for _, raw := range cases {
+		mw, err := Factory{}.New(raw)
+		require.NoError(t, err, "empty-shaped config must yield a router with an empty Providers slice")
+		require.NotNil(t, mw, "factory must return a non-nil middleware on empty config")
+
+		out, invErr := mw.Invoke(context.Background(), newInputWithModel("gpt-4o"))
+		require.NoError(t, invErr)
+		assert.Equal(t, middleware.DecisionDeny, out.Decision,
+			"router with no providers must deny every model as not-routable")
+	}
+}
+
+// newInputWithModelAndGroups returns an Input carrying llm.model + the
+// caller's UserGroups, mimicking the post-auth, post-llm_request_parser
+// state the router observes.
+func newInputWithModelAndGroups(model string, groups []string) *middleware.Input {
+	in := newInputWithModel(model)
+	in.UserGroups = append([]string(nil), groups...)
+	return in
+}
+
+// TestRouter_GroupFilter_PicksAuthorisedAmongDuplicates pins the Fix A
+// behaviour: when two providers claim the same model but each
+// authorises a different group, the router must pick the route the
+// caller's groups intersect, regardless of declaration order.
+func TestRouter_GroupFilter_PicksAuthorisedAmongDuplicates(t *testing.T) {
+	mw := New(Config{Providers: []ProviderRoute{
+		{
+			ID:              "openai-marketing",
+			Models:          []string{"gpt-4o-mini"},
+			UpstreamScheme:  "https",
+			UpstreamHost:    "mkt-openai.example.com",
+			AllowedGroupIDs: []string{"grp-mkt"},
+		},
+		{
+			ID:              "openai-engineering",
+			Models:          []string{"gpt-4o-mini"},
+			UpstreamScheme:  "https",
+			UpstreamHost:    "eng-openai.example.com",
+			AllowedGroupIDs: []string{"grp-eng"},
+		},
+	}})
+
+	out, err := mw.Invoke(context.Background(),
+		newInputWithModelAndGroups("gpt-4o-mini", []string{"grp-eng"}))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision,
+		"authorised candidate exists; must allow")
+
+	resolved, ok := metaValue(t, out.Metadata, middleware.KeyLLMResolvedProviderID)
+	require.True(t, ok)
+	assert.Equal(t, "openai-engineering", resolved,
+		"router must pick the route whose AllowedGroupIDs intersects the caller's groups, ignoring declaration order")
+}
+
+// TestRouter_GroupFilter_NoIntersection_DeniesNoAuthorisedRoute pins
+// the dedicated deny code that fires when the model is known to a
+// provider but no candidate is authorised for the caller's groups.
+func TestRouter_GroupFilter_NoIntersection_DeniesNoAuthorisedRoute(t *testing.T) {
+	mw := New(Config{Providers: []ProviderRoute{{
+		ID:              "openai-marketing",
+		Models:          []string{"gpt-4o-mini"},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "mkt-openai.example.com",
+		AllowedGroupIDs: []string{"grp-mkt"},
+	}}})
+
+	out, err := mw.Invoke(context.Background(),
+		newInputWithModelAndGroups("gpt-4o-mini", []string{"grp-eng"}))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionDeny, out.Decision,
+		"model exists but no route authorises grp-eng; must deny")
+	require.NotNil(t, out.DenyReason)
+	assert.Equal(t, "llm_policy.no_authorised_provider", out.DenyReason.Code,
+		"deny code must be no_authorised_provider, not model_not_routable")
+	assert.Equal(t, "gpt-4o-mini", out.DenyReason.Details["model"],
+		"deny details must reference the offending model")
+
+	dec, _ := metaValue(t, out.Metadata, middleware.KeyLLMPolicyDecision)
+	assert.Equal(t, "deny", dec)
+	reason, _ := metaValue(t, out.Metadata, middleware.KeyLLMPolicyReason)
+	assert.Equal(t, "no_authorised_provider", reason)
+}
+
+// TestRouter_GroupFilter_EmptyAllowedGroupsIsUnreachable pins the
+// strict semantics: a route with no AllowedGroupIDs is unreachable.
+// The synthesiser only emits policy-bound routes, so an empty ACL
+// signals a misconfiguration that must not silently fall through.
+func TestRouter_GroupFilter_EmptyAllowedGroupsIsUnreachable(t *testing.T) {
+	mw := New(Config{Providers: []ProviderRoute{{
+		ID:             "openai-shared",
+		Models:         []string{"gpt-4o"},
+		UpstreamScheme: "https",
+		UpstreamHost:   "api.openai.com",
+		// AllowedGroupIDs intentionally left empty.
+	}}})
+
+	out, err := mw.Invoke(context.Background(), newInputWithModel("gpt-4o"))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionDeny, out.Decision,
+		"empty AllowedGroupIDs must deny — there is no catch-all for routes without an authorising policy")
+	require.NotNil(t, out.DenyReason)
+	assert.Equal(t, "llm_policy.no_authorised_provider", out.DenyReason.Code,
+		"empty ACL fails the group-filter pass; deny code must reflect that")
+}
+
+// TestRouter_GroupFilter_OverlapTiebreakUnchanged pins that when more
+// than one route is authorised for the caller's groups, the existing
+// path-prefix tiebreak still decides. Group filtering is a hard gate
+// before the tiebreak; it does not change the tiebreak semantics.
+func TestRouter_GroupFilter_OverlapTiebreakUnchanged(t *testing.T) {
+	mw := New(Config{Providers: []ProviderRoute{
+		{
+			ID:              "openai-a",
+			Models:          []string{"gpt-4o-mini"},
+			UpstreamScheme:  "https",
+			UpstreamHost:    "a.example.com",
+			UpstreamPath:    "",
+			AllowedGroupIDs: []string{"grp-eng"},
+		},
+		{
+			ID:              "openai-b",
+			Models:          []string{"gpt-4o-mini"},
+			UpstreamScheme:  "https",
+			UpstreamHost:    "b.example.com",
+			UpstreamPath:    "/v1/chat",
+			AllowedGroupIDs: []string{"grp-eng"},
+		},
+	}})
+
+	in := newInputWithModelAndURL("gpt-4o-mini", "/v1/chat/completions")
+	in.UserGroups = []string{"grp-eng"}
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision)
+
+	resolved, _ := metaValue(t, out.Metadata, middleware.KeyLLMResolvedProviderID)
+	assert.Equal(t, "openai-b", resolved,
+		"longest-prefix path tiebreak still wins among group-authorised candidates")
+}
+
+// TestRouter_AuthorisingGroups_EmitsIntersection pins that the router
+// emits llm.authorising_groups containing only the intersection of the
+// caller's UserGroups with the resolved route's AllowedGroupIDs — not
+// every group the peer happens to be in.
+func TestRouter_AuthorisingGroups_EmitsIntersection(t *testing.T) {
+	mw := New(Config{Providers: []ProviderRoute{{
+		ID:              "openai-eng",
+		Models:          []string{"gpt-4o-mini"},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "eng-openai.example.com",
+		AllowedGroupIDs: []string{"grp-eng", "grp-shared"},
+	}}})
+
+	in := newInputWithModelAndGroups("gpt-4o-mini",
+		[]string{"grp-eng", "grp-it", "grp-shared", "grp-oncall"})
+
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	require.Equal(t, middleware.DecisionAllow, out.Decision)
+
+	csv, ok := metaValue(t, out.Metadata, middleware.KeyLLMAuthorisingGroups)
+	require.True(t, ok, "router must emit llm.authorising_groups on a match")
+	assert.Equal(t, "grp-eng,grp-shared", csv,
+		"only groups in BOTH UserGroups AND AllowedGroupIDs may appear; result must be sorted and unique")
+}
+
+// TestRouter_EmptyModelsClaimsAnyModel pins that a route with no
+// configured Models matches every model — used by gateway-style
+// providers (LiteLLM, custom OpenAI-compatible endpoints) where the
+// operator can't enumerate the upstream's model catalog in NetBird.
+func TestRouter_EmptyModelsClaimsAnyModel(t *testing.T) {
+	mw := New(Config{Providers: []ProviderRoute{{
+		ID:              "litellm",
+		Models:          nil, // catch-all
+		UpstreamScheme:  "https",
+		UpstreamHost:    "litellm.example.com",
+		AllowedGroupIDs: []string{defaultTestGroup},
+	}}})
+
+	out, err := mw.Invoke(context.Background(), newInputWithModel("gpt-5.5"))
+	require.NoError(t, err)
+	require.NotNil(t, out)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision,
+		"a route with empty Models must claim any model so gateway-style providers can route open-ended sets")
+	resolved, _ := metaValue(t, out.Metadata, middleware.KeyLLMResolvedProviderID)
+	assert.Equal(t, "litellm", resolved)
+}
diff --git a/proxy/internal/middleware/builtin/llm_router/path_routed_test.go b/proxy/internal/middleware/builtin/llm_router/path_routed_test.go
new file mode 100644
index 000000000..7dbd6b936
--- /dev/null
+++ b/proxy/internal/middleware/builtin/llm_router/path_routed_test.go
@@ -0,0 +1,159 @@
+package llm_router
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+)
+
+// pathRoutedInput builds an Input mimicking the post-llm_request_parser state
+// for a path-routed (Vertex/Bedrock) request: a request URL plus the model and
+// (optionally) provider/vendor metadata the parser emits.
+func pathRoutedInput(url, provider, model string) *middleware.Input {
+	md := []middleware.KV{{Key: middleware.KeyLLMModel, Value: model}}
+	if provider != "" {
+		md = append(md, middleware.KV{Key: middleware.KeyLLMProvider, Value: provider})
+	}
+	return &middleware.Input{
+		Slot:       middleware.SlotOnRequest,
+		URL:        url,
+		Metadata:   md,
+		UserGroups: []string{defaultTestGroup},
+	}
+}
+
+func vertexRoute() ProviderRoute {
+	return ProviderRoute{
+		ID: "vertex-prod", Vertex: true,
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "europe-west1-aiplatform.googleapis.com",
+		AuthHeaderName:  "Authorization",
+		AuthHeaderValue: "Bearer x",
+	}
+}
+
+// A Vertex publisher with no parser surface (google/gemini emits no
+// llm.provider) must be denied, not forwarded unmetered.
+func TestRouter_VertexUnmeterablePublisherDenied(t *testing.T) {
+	mw := New(Config{Providers: []ProviderRoute{vertexRoute()}})
+	in := pathRoutedInput(
+		"/v1/projects/p/locations/global/publishers/google/models/gemini-2.5-pro:generateContent",
+		"", // google -> request parser emits NO llm.provider
+		"gemini-2.5-pro",
+	)
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	assert.Equal(t, middleware.DecisionDeny, out.Decision, "unmeterable Vertex publisher must deny")
+	assert.Equal(t, 403, out.DenyStatus, "unmeterable deny is a 403")
+	require.NotNil(t, out.DenyReason)
+	assert.Equal(t, denyCodeUnmeterable, out.DenyReason.Code, "deny code must flag the unmeterable publisher")
+}
+
+// A Vertex publisher with a parser surface (anthropic) is allowed.
+func TestRouter_VertexMeterablePublisherAllowed(t *testing.T) {
+	mw := New(Config{Providers: []ProviderRoute{vertexRoute()}})
+	in := pathRoutedInput(
+		"/v1/projects/p/locations/global/publishers/anthropic/models/claude-sonnet-4-5:rawPredict",
+		"anthropic",
+		"claude-sonnet-4-5",
+	)
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "meterable Vertex publisher must allow")
+}
+
+// A path-routed provider with an explicit Models list must reject models not in
+// the list (the provider credential can't be used for unauthorised models).
+func TestRouter_PathRoutedModelAllowlistEnforced(t *testing.T) {
+	route := ProviderRoute{
+		ID: "bedrock-prod", Bedrock: true,
+		Models:          []string{"anthropic.claude-sonnet-4-5"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "bedrock-runtime.eu-central-1.amazonaws.com",
+		AuthHeaderName:  "Authorization",
+		AuthHeaderValue: "Bearer x",
+	}
+	mw := New(Config{Providers: []ProviderRoute{route}})
+
+	allowed := pathRoutedInput(
+		"/model/eu.anthropic.claude-sonnet-4-5-20250929-v1:0/invoke",
+		"bedrock", "anthropic.claude-sonnet-4-5",
+	)
+	out, err := mw.Invoke(context.Background(), allowed)
+	require.NoError(t, err)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "model in the allowlist must be served")
+
+	denied := pathRoutedInput(
+		"/model/amazon.nova-pro-v1:0/invoke",
+		"bedrock", "amazon.nova-pro",
+	)
+	out, err = mw.Invoke(context.Background(), denied)
+	require.NoError(t, err)
+	assert.Equal(t, middleware.DecisionDeny, out.Decision, "model outside the allowlist must deny")
+	require.NotNil(t, out.DenyReason)
+	assert.Equal(t, denyCodeNotRoutable, out.DenyReason.Code, "unlisted model denies as not-routable")
+}
+
+// A "/bedrock" gateway-namespace prefix routes the same as the native path and
+// records the prefix on the rewrite so the proxy strips it before forwarding.
+func TestRouter_BedrockNamespacePrefixStripped(t *testing.T) {
+	route := ProviderRoute{
+		ID: "bedrock-prod", Bedrock: true,
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "bedrock-runtime.eu-central-1.amazonaws.com",
+		AuthHeaderName:  "Authorization",
+		AuthHeaderValue: "Bearer x",
+	}
+	mw := New(Config{Providers: []ProviderRoute{route}})
+
+	prefixed := pathRoutedInput(
+		"/bedrock/model/eu.anthropic.claude-sonnet-4-5-20250929-v1:0/invoke-with-response-stream",
+		"bedrock", "anthropic.claude-sonnet-4-5",
+	)
+	out, err := mw.Invoke(context.Background(), prefixed)
+	require.NoError(t, err)
+	require.Equal(t, middleware.DecisionAllow, out.Decision, "prefixed Bedrock path must route")
+	require.NotNil(t, out.Mutations)
+	require.NotNil(t, out.Mutations.RewriteUpstream)
+	assert.Equal(t, "/bedrock", out.Mutations.RewriteUpstream.StripPathPrefix,
+		"namespace prefix must be recorded so the proxy strips it before forwarding")
+
+	native := pathRoutedInput(
+		"/model/eu.anthropic.claude-sonnet-4-5-20250929-v1:0/invoke",
+		"bedrock", "anthropic.claude-sonnet-4-5",
+	)
+	out, err = mw.Invoke(context.Background(), native)
+	require.NoError(t, err)
+	require.Equal(t, middleware.DecisionAllow, out.Decision, "native Bedrock path must route")
+	require.NotNil(t, out.Mutations.RewriteUpstream)
+	assert.Empty(t, out.Mutations.RewriteUpstream.StripPathPrefix,
+		"native path carries no namespace prefix to strip")
+}
+
+// A path-routed provider with no configured Models is catch-all: any model the
+// credential can reach is served (preserves the zero-config behaviour).
+func TestRouter_PathRoutedCatchAllServesAnyModel(t *testing.T) {
+	route := ProviderRoute{
+		ID: "bedrock-catchall", Bedrock: true,
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "bedrock-runtime.eu-central-1.amazonaws.com",
+		AuthHeaderName:  "Authorization",
+		AuthHeaderValue: "Bearer x",
+	}
+	mw := New(Config{Providers: []ProviderRoute{route}})
+	in := pathRoutedInput(
+		"/model/amazon.nova-pro-v1:0/invoke",
+		"bedrock", "amazon.nova-pro",
+	)
+	out, err := mw.Invoke(context.Background(), in)
+	require.NoError(t, err)
+	assert.Equal(t, middleware.DecisionAllow, out.Decision, "catch-all path-routed provider serves any model")
+}
diff --git a/proxy/internal/middleware/chain.go b/proxy/internal/middleware/chain.go
new file mode 100644
index 000000000..45d32cdb0
--- /dev/null
+++ b/proxy/internal/middleware/chain.go
@@ -0,0 +1,320 @@
+package middleware
+
+import (
+	"context"
+	"net/http"
+	"sync"
+)
+
+// boundMiddleware pairs a validated spec with the resolved middleware
+// instance the chain will invoke.
+type boundMiddleware struct {
+	spec Spec
+	mw   Middleware
+}
+
+// Chain is the ordered set of middlewares that run for a specific
+// target. Chains are immutable once built; Manager produces a new
+// Chain on every Rebuild.
+//
+// Ordering: middlewares are kept in registration order. RunRequest
+// iterates the SlotOnRequest middlewares in order; RunResponse
+// iterates the SlotOnResponse middlewares in reverse order
+// (middleware-style LIFO so the last to see the request is the first
+// to see the response); RunTerminal iterates the SlotTerminal
+// middlewares in registration order, after every on_response slot has
+// emitted, so the metadata bag they observe is complete.
+//
+// Close drains in-flight invocations and tears down each middleware.
+// Callers swapping a chain via Manager invoke Close on the old chain
+// after the swap so live requests finish on the previous instance.
+type Chain struct {
+	targetID   string
+	all        []boundMiddleware
+	onRequest  []int
+	onResponse []int
+	terminal   []int
+	dispatcher *Dispatcher
+	inflight   sync.WaitGroup
+}
+
+// NewChain assembles a Chain from the bound middlewares. The slice
+// order is the registration order; the chain captures index slices
+// per slot so iteration does not re-scan the slot field per call.
+func NewChain(targetID string, bound []boundMiddleware, d *Dispatcher) *Chain {
+	c := &Chain{
+		targetID:   targetID,
+		all:        bound,
+		dispatcher: d,
+	}
+	for i, bm := range bound {
+		switch bm.spec.Slot {
+		case SlotOnRequest:
+			c.onRequest = append(c.onRequest, i)
+		case SlotOnResponse:
+			c.onResponse = append(c.onResponse, i)
+		case SlotTerminal:
+			c.terminal = append(c.terminal, i)
+		}
+	}
+	return c
+}
+
+// Close waits for outstanding invocations against this chain to
+// finish (bounded by ctx) and releases the middleware instances bound
+// to it. Safe to call once the chain has been removed from the
+// routing snapshot. Subsequent Run* calls are still safe (return
+// without invoking) but Close itself is one-shot.
+func (c *Chain) Close(ctx context.Context) error {
+	if c == nil {
+		return nil
+	}
+	if ctx == nil {
+		ctx = context.Background()
+	}
+	done := make(chan struct{})
+	go func() {
+		c.inflight.Wait()
+		close(done)
+	}()
+	select {
+	case <-done:
+	case <-ctx.Done():
+		// Drain timed out: requests may still be running against these
+		// middleware instances, so tearing them down now risks a
+		// use-after-close. Leave them (a bounded leak) and surface the
+		// timeout; the runaway backstop in the Manager already alerts.
+		return ctx.Err()
+	}
+	for _, bm := range c.all {
+		if bm.mw == nil {
+			continue
+		}
+		if err := bm.mw.Close(); err != nil {
+			c.dispatcher.logger.Debugf("middleware %s close: %v", bm.spec.ID, err)
+		}
+	}
+	return nil
+}
+
+// Empty reports whether the chain has no middlewares.
+func (c *Chain) Empty() bool {
+	return c == nil || len(c.all) == 0
+}
+
+// TargetID returns the key used to find this chain.
+func (c *Chain) TargetID() string {
+	if c == nil {
+		return ""
+	}
+	return c.targetID
+}
+
+// IDs returns the ordered list of middleware IDs bound to this chain.
+func (c *Chain) IDs() []string {
+	if c == nil {
+		return nil
+	}
+	out := make([]string, len(c.all))
+	for i, bm := range c.all {
+		out[i] = bm.spec.ID
+	}
+	return out
+}
+
+// RunRequest iterates the on_request slot in registration order. Deny
+// short-circuits the remaining middlewares and returns the deny
+// output. The caller owns applying mutations to the real request and
+// merging the metadata returned in `merged` into the captured-data
+// bag passed to subsequent slots.
+//
+// Each middleware sees the metadata emitted by earlier middlewares in
+// the same slot — this is how llm_guardrail reads
+// llm.request_prompt_raw from llm_request_parser without a side
+// channel, and how cost_meter reads tokens emitted by
+// llm_response_parser on the response leg.
+//
+// If any middleware emits a non-nil Mutations.RewriteUpstream while
+// satisfying the mutation gates (CanMutate && MutationsSupported), the
+// latest such value is returned to the caller. Last-write-wins so the
+// last middleware in the slot can override an earlier rewrite.
+func (c *Chain) RunRequest(ctx context.Context, r *http.Request, in *Input, acc *Accumulator) (denied *Output, merged []KV, rewrite *UpstreamRewrite, err error) {
+	if c.Empty() || len(c.onRequest) == 0 {
+		return nil, nil, nil, nil
+	}
+	c.inflight.Add(1)
+	defer c.inflight.Done()
+	running := append([]KV(nil), in.Metadata...)
+	for _, idx := range c.onRequest {
+		bm := c.all[idx]
+		call := cloneInputFor(in, SlotOnRequest)
+		call.Metadata = append([]KV(nil), running...)
+		out, invErr := c.dispatcher.Invoke(ctx, bm.spec, bm.mw, call)
+		if invErr != nil && out == nil {
+			continue
+		}
+		if out == nil {
+			continue
+		}
+
+		accepted, rejected := acc.Emit(bm.spec.ID, bm.spec.MetadataKeys, out.Metadata)
+		for _, rej := range rejected {
+			c.dispatcher.metrics.IncMetadataRejected(ctx, bm.spec.ID, rej.Reason)
+		}
+		merged = append(merged, accepted...)
+		running = append(running, accepted...)
+
+		if out.Decision == DecisionDeny {
+			c.dispatcher.metrics.IncRequest(ctx, bm.spec.ID, c.targetID, "deny")
+			return out, merged, rewrite, nil
+		}
+		c.dispatcher.metrics.IncRequest(ctx, bm.spec.ID, c.targetID, "allow")
+
+		if rw := mutationRewrite(bm.spec, out.Mutations); rw != nil {
+			rewrite = rw
+		}
+		if r != nil && bm.spec.CanMutate && out.Mutations != nil {
+			applyMutations(ctx, c.dispatcher, bm.spec, r, out.Mutations)
+		}
+	}
+	return nil, merged, rewrite, nil
+}
+
+// RunResponse iterates the on_response slot in reverse registration
+// order, matching the middleware "last in, first out" convention so
+// the last middleware to see the request is the first to see the
+// response. Middlewares cannot deny; they emit metadata.
+//
+// As with RunRequest, each middleware sees the metadata emitted by
+// earlier middlewares in this slot — accumulated in the order the
+// middlewares run (LIFO of registration). cost_meter relies on this
+// to read llm.input_tokens / llm.output_tokens that
+// llm_response_parser emitted just before it.
+func (c *Chain) RunResponse(ctx context.Context, in *Input, acc *Accumulator) (merged []KV) {
+	if c.Empty() || len(c.onResponse) == 0 {
+		return nil
+	}
+	c.inflight.Add(1)
+	defer c.inflight.Done()
+	running := append([]KV(nil), in.Metadata...)
+	for i := len(c.onResponse) - 1; i >= 0; i-- {
+		bm := c.all[c.onResponse[i]]
+		call := cloneInputFor(in, SlotOnResponse)
+		call.Metadata = append([]KV(nil), running...)
+		out, _ := c.dispatcher.Invoke(ctx, bm.spec, bm.mw, call)
+		if out == nil {
+			continue
+		}
+		accepted, rejected := acc.Emit(bm.spec.ID, bm.spec.MetadataKeys, out.Metadata)
+		for _, rej := range rejected {
+			c.dispatcher.metrics.IncMetadataRejected(ctx, bm.spec.ID, rej.Reason)
+		}
+		merged = append(merged, accepted...)
+		running = append(running, accepted...)
+		c.dispatcher.metrics.IncRequest(ctx, bm.spec.ID, c.targetID, "passthrough")
+	}
+	return merged
+}
+
+// RunTerminal iterates the terminal slot in registration order, after
+// every on_response middleware has emitted. Terminal middlewares
+// observe the full metadata bag carried in `in.Metadata` plus any
+// emissions from terminal middlewares that ran before them; they
+// cannot deny and cannot mutate.
+func (c *Chain) RunTerminal(ctx context.Context, in *Input, acc *Accumulator) (merged []KV) {
+	if c.Empty() || len(c.terminal) == 0 {
+		return nil
+	}
+	c.inflight.Add(1)
+	defer c.inflight.Done()
+	running := append([]KV(nil), in.Metadata...)
+	for _, idx := range c.terminal {
+		bm := c.all[idx]
+		call := cloneInputFor(in, SlotTerminal)
+		call.Metadata = append([]KV(nil), running...)
+		out, _ := c.dispatcher.Invoke(ctx, bm.spec, bm.mw, call)
+		if out == nil {
+			continue
+		}
+		accepted, rejected := acc.Emit(bm.spec.ID, bm.spec.MetadataKeys, out.Metadata)
+		for _, rej := range rejected {
+			c.dispatcher.metrics.IncMetadataRejected(ctx, bm.spec.ID, rej.Reason)
+		}
+		merged = append(merged, accepted...)
+		running = append(running, accepted...)
+		c.dispatcher.metrics.IncRequest(ctx, bm.spec.ID, c.targetID, "terminal")
+	}
+	return merged
+}
+
+// mutationRewrite returns the upstream rewrite carried in m when the
+// spec's mutation gates allow it. The rewrite itself is not applied
+// here; the caller (reverse proxy) decides whether to honour it.
+func mutationRewrite(spec Spec, m *Mutations) *UpstreamRewrite {
+	if m == nil || m.RewriteUpstream == nil {
+		return nil
+	}
+	if !spec.CanMutate || !spec.MutationsSupported {
+		return nil
+	}
+	return m.RewriteUpstream
+}
+
+func applyMutations(ctx context.Context, d *Dispatcher, spec Spec, r *http.Request, m *Mutations) {
+	if m == nil {
+		return
+	}
+	add, remove, blocked := FilterHeaderMutations(m)
+	for _, h := range blocked {
+		d.metrics.IncHeaderMutationBlocked(ctx, spec.ID, h)
+	}
+	for _, name := range remove {
+		r.Header.Del(name)
+	}
+	for _, kv := range add {
+		r.Header.Add(kv.Key, kv.Value)
+	}
+	if len(m.BodyReplace) == 0 {
+		return
+	}
+	if err := ValidateBodyReplace(r, m.BodyReplace, true); err != nil {
+		d.logger.Warnf("middleware %s body replace rejected: %v", spec.ID, err)
+		return
+	}
+	ApplyBodyReplace(r, m.BodyReplace)
+}
+
+// cloneInputFor deep-copies the mutation-prone fields of Input so
+// each middleware receives an isolated view.
+func cloneInputFor(in *Input, slot Slot) *Input {
+	if in == nil {
+		return nil
+	}
+	out := *in
+	out.Slot = slot
+	out.Headers = cloneKVs(in.Headers)
+	out.RespHeaders = cloneKVs(in.RespHeaders)
+	out.Metadata = cloneKVs(in.Metadata)
+	if len(in.UserGroups) > 0 {
+		out.UserGroups = append([]string(nil), in.UserGroups...)
+	}
+	if len(in.UserGroupNames) > 0 {
+		out.UserGroupNames = append([]string(nil), in.UserGroupNames...)
+	}
+	if len(in.Body) > 0 {
+		out.Body = append([]byte(nil), in.Body...)
+	}
+	if len(in.RespBody) > 0 {
+		out.RespBody = append([]byte(nil), in.RespBody...)
+	}
+	return &out
+}
+
+func cloneKVs(in []KV) []KV {
+	if len(in) == 0 {
+		return nil
+	}
+	out := make([]KV, len(in))
+	copy(out, in)
+	return out
+}
diff --git a/proxy/internal/middleware/chain_test.go b/proxy/internal/middleware/chain_test.go
new file mode 100644
index 000000000..929ccee08
--- /dev/null
+++ b/proxy/internal/middleware/chain_test.go
@@ -0,0 +1,370 @@
+package middleware
+
+import (
+	"context"
+	"strconv"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// fakeMiddleware is a minimal Middleware for chain composition tests.
+// It records the metadata the dispatcher hands to it and emits a
+// caller-supplied Output. Tests use the recorded snapshot to assert
+// that earlier-in-slot emissions are visible to later middlewares.
+type fakeMiddleware struct {
+	id                 string
+	slot               Slot
+	keys               []string
+	emit               []KV
+	decision           Decision
+	mutationsSupported bool
+	canMutate          bool
+	mutations          *Mutations
+
+	// seen captures the in.Metadata snapshot the dispatcher passed to
+	// Invoke, so tests can assert ordering and visibility.
+	seen []KV
+}
+
+func (f *fakeMiddleware) ID() string                     { return f.id }
+func (f *fakeMiddleware) Version() string                { return "test" }
+func (f *fakeMiddleware) Slot() Slot                     { return f.slot }
+func (f *fakeMiddleware) AcceptedContentTypes() []string { return nil }
+func (f *fakeMiddleware) MetadataKeys() []string         { return f.keys }
+func (f *fakeMiddleware) MutationsSupported() bool       { return f.mutationsSupported }
+func (f *fakeMiddleware) Close() error                   { return nil }
+
+func (f *fakeMiddleware) Invoke(_ context.Context, in *Input) (*Output, error) {
+	f.seen = append([]KV(nil), in.Metadata...)
+	out := &Output{Decision: f.decision, Metadata: append([]KV(nil), f.emit...)}
+	if f.mutations != nil {
+		m := *f.mutations
+		out.Mutations = &m
+	}
+	return out, nil
+}
+
+// chainFor builds a Chain over the given middlewares with a noop
+// dispatcher.
+func chainFor(t *testing.T, mws ...*fakeMiddleware) *Chain {
+	t.Helper()
+	bound := make([]boundMiddleware, len(mws))
+	for i, mw := range mws {
+		bound[i] = boundMiddleware{
+			spec: Spec{
+				ID:                 mw.id,
+				Slot:               mw.slot,
+				Enabled:            true,
+				MetadataKeys:       mw.keys,
+				CanMutate:          mw.canMutate,
+				MutationsSupported: mw.mutationsSupported,
+			},
+			mw: mw,
+		}
+	}
+	disp := NewDispatcher(nil, nil)
+	return NewChain("t-1", bound, disp)
+}
+
+// TestChain_RunRequest_ThreadsMetadataAcrossMiddlewares locks that
+// each on_request middleware sees metadata emitted by earlier
+// middlewares in the same slot. Regression cover for the original
+// chain.go where every iteration cloned from the same source `in` and
+// later middlewares (e.g. llm_guardrail) couldn't read what the first
+// (e.g. llm_request_parser) had just emitted.
+func TestChain_RunRequest_ThreadsMetadataAcrossMiddlewares(t *testing.T) {
+	first := &fakeMiddleware{
+		id:   "first",
+		slot: SlotOnRequest,
+		keys: []string{"foo.k"},
+		emit: []KV{{Key: "foo.k", Value: "v"}},
+	}
+	second := &fakeMiddleware{
+		id:   "second",
+		slot: SlotOnRequest,
+		keys: []string{"bar.k"},
+		emit: []KV{{Key: "bar.k", Value: "z"}},
+	}
+	c := chainFor(t, first, second)
+	acc := NewAccumulator(0)
+
+	denied, merged, rewrite, err := c.RunRequest(context.Background(), nil, &Input{}, acc)
+	require.NoError(t, err)
+	assert.Nil(t, denied, "no deny without DecisionDeny")
+	assert.Nil(t, rewrite, "no rewrite without Mutations.RewriteUpstream")
+
+	require.Len(t, second.seen, 1, "the second middleware must observe one prior emission")
+	assert.Equal(t, "foo.k", second.seen[0].Key, "second middleware must see the first middleware's key")
+	assert.Equal(t, "v", second.seen[0].Value, "second middleware must see the first middleware's value")
+
+	require.Len(t, merged, 2, "merged slice contains both middleware emissions")
+}
+
+// TestChain_RunResponse_ThreadsMetadataAcrossMiddlewares does the
+// same for the response slot. The response slot iterates in reverse
+// registration order, so the middleware registered LAST runs first.
+// This test asserts that a middleware running later (in reverse
+// order) sees the metadata emitted by the one that ran before it.
+func TestChain_RunResponse_ThreadsMetadataAcrossMiddlewares(t *testing.T) {
+	// Registration order: [outer, inner].
+	// Reverse iteration runs inner first, outer second.
+	// outer must see inner's emission.
+	outer := &fakeMiddleware{
+		id:   "outer",
+		slot: SlotOnResponse,
+		keys: []string{"outer.k"},
+		emit: []KV{{Key: "outer.k", Value: "o"}},
+	}
+	inner := &fakeMiddleware{
+		id:   "inner",
+		slot: SlotOnResponse,
+		keys: []string{"inner.k"},
+		emit: []KV{{Key: "inner.k", Value: "i"}},
+	}
+	c := chainFor(t, outer, inner)
+	acc := NewAccumulator(0)
+
+	merged := c.RunResponse(context.Background(), &Input{}, acc)
+
+	require.Len(t, outer.seen, 1, "outer must observe inner's emission")
+	assert.Equal(t, "inner.k", outer.seen[0].Key)
+	require.Len(t, merged, 2, "merged slice contains both response emissions")
+}
+
+// TestChain_RunResponse_CostMeterScenario simulates the synth-service
+// chain shape (response_parser registered AFTER cost_meter so reverse
+// iter runs response_parser first). The cost_meter analogue must see
+// the tokens response_parser just emitted — this is the exact
+// regression that produced cost.skipped=missing_tokens in the live
+// access logs.
+func TestChain_RunResponse_CostMeterScenario(t *testing.T) {
+	// Synthesizer registers cost_meter first, response_parser second.
+	costMeter := &fakeMiddleware{
+		id:   "cost_meter",
+		slot: SlotOnResponse,
+		keys: []string{"cost.usd_total", "cost.skipped"},
+	}
+	respParser := &fakeMiddleware{
+		id:   "llm_response_parser",
+		slot: SlotOnResponse,
+		keys: []string{"llm.input_tokens", "llm.output_tokens"},
+		emit: []KV{
+			{Key: "llm.input_tokens", Value: "13"},
+			{Key: "llm.output_tokens", Value: "259"},
+		},
+	}
+	c := chainFor(t, costMeter, respParser)
+	acc := NewAccumulator(0)
+
+	_ = c.RunResponse(context.Background(), &Input{}, acc)
+
+	require.Len(t, costMeter.seen, 2, "cost_meter must observe both token keys emitted by response_parser")
+	keys := []string{costMeter.seen[0].Key, costMeter.seen[1].Key}
+	assert.ElementsMatch(t, []string{"llm.input_tokens", "llm.output_tokens"}, keys,
+		"cost_meter must see the exact keys response_parser emitted")
+	values := []string{costMeter.seen[0].Value, costMeter.seen[1].Value}
+	assert.ElementsMatch(t, []string{"13", "259"}, values, "cost_meter must see the exact token counts")
+	for _, kv := range costMeter.seen {
+		_, err := strconv.Atoi(kv.Value)
+		assert.NoError(t, err, "values handed to cost_meter must be numeric (regression for missing_tokens)")
+	}
+}
+
+// TestChain_RunResponse_DetachedContextStillRecords guards the metering
+// fix in reverseproxy.go. The response/terminal phase runs after the body
+// is forwarded, so a streaming client has usually disconnected by then,
+// cancelling its request context. The dispatcher derives each middleware's
+// context from the one passed here and short-circuits to fail-mode the
+// instant it's Done, which silently drops token/cost metering. The reverse
+// proxy now detaches that phase with context.WithoutCancel; this proves a
+// context detached from an already-cancelled parent still lets a response
+// middleware emit. (The cancelled-parent direction is intentionally not
+// asserted: the dispatcher's select over ctx.Done vs the result channel is
+// racy when both are ready, which is exactly why the bug was intermittent.)
+func TestChain_RunResponse_DetachedContextStillRecords(t *testing.T) {
+	resp := &fakeMiddleware{
+		id:       "recorder",
+		slot:     SlotOnResponse,
+		keys:     []string{"llm.input_tokens"},
+		emit:     []KV{{Key: "llm.input_tokens", Value: "42"}},
+		decision: DecisionPassthrough,
+	}
+	c := chainFor(t, resp)
+
+	clientCtx, cancel := context.WithCancel(context.Background())
+	cancel() // client disconnected after the stream completed
+	require.Error(t, clientCtx.Err(), "client context must be cancelled for the test to be meaningful")
+
+	detached := context.WithoutCancel(clientCtx)
+	require.NoError(t, detached.Err(), "detached context must not inherit the client's cancellation")
+
+	acc := NewAccumulator(MaxRequestMetadataBytes)
+	merged := c.RunResponse(detached, &Input{Slot: SlotOnResponse}, acc)
+
+	var got string
+	for _, kv := range merged {
+		if kv.Key == "llm.input_tokens" {
+			got = kv.Value
+		}
+	}
+	assert.Equal(t, "42", got, "response middleware must still emit token metadata under the detached context")
+}
+
+// TestChain_RunRequest_LatestRewriteWins asserts that when two
+// on_request middlewares both emit an UpstreamRewrite, the chain
+// returns the value from the later middleware.
+func TestChain_RunRequest_LatestRewriteWins(t *testing.T) {
+	first := &fakeMiddleware{
+		id:                 "first",
+		slot:               SlotOnRequest,
+		mutationsSupported: true,
+		canMutate:          true,
+		mutations:          &Mutations{RewriteUpstream: &UpstreamRewrite{Scheme: "https", Host: "first.test"}},
+	}
+	second := &fakeMiddleware{
+		id:                 "second",
+		slot:               SlotOnRequest,
+		mutationsSupported: true,
+		canMutate:          true,
+		mutations:          &Mutations{RewriteUpstream: &UpstreamRewrite{Scheme: "https", Host: "second.test"}},
+	}
+	c := chainFor(t, first, second)
+	acc := NewAccumulator(0)
+
+	denied, _, rewrite, err := c.RunRequest(context.Background(), nil, &Input{}, acc)
+	require.NoError(t, err)
+	assert.Nil(t, denied, "neither middleware denies")
+	require.NotNil(t, rewrite, "chain must surface the rewrite emitted by the on_request slot")
+	assert.Equal(t, "https", rewrite.Scheme, "rewrite scheme must come from the later middleware")
+	assert.Equal(t, "second.test", rewrite.Host, "rewrite host must come from the later middleware (last-write-wins)")
+}
+
+// TestChain_RunRequest_NoRewrite_NilReturn asserts the chain returns a
+// nil rewrite when no middleware emits one.
+func TestChain_RunRequest_NoRewrite_NilReturn(t *testing.T) {
+	first := &fakeMiddleware{id: "first", slot: SlotOnRequest}
+	second := &fakeMiddleware{id: "second", slot: SlotOnRequest}
+	c := chainFor(t, first, second)
+	acc := NewAccumulator(0)
+
+	denied, _, rewrite, err := c.RunRequest(context.Background(), nil, &Input{}, acc)
+	require.NoError(t, err)
+	assert.Nil(t, denied, "neither middleware denies")
+	assert.Nil(t, rewrite, "chain must return nil rewrite when no middleware emits one")
+}
+
+// TestChain_ApplyMutations_RewriteGatedOnCanMutate asserts that a
+// middleware emitting an UpstreamRewrite with CanMutate=false has its
+// rewrite filtered out by the chain. The dispatcher's filterOutput
+// already clears Mutations when the gates fail; the chain's defensive
+// gate inside mutationRewrite mirrors that contract so a stale
+// Mutations field cannot leak through.
+func TestChain_ApplyMutations_RewriteGatedOnCanMutate(t *testing.T) {
+	mw := &fakeMiddleware{
+		id:                 "first",
+		slot:               SlotOnRequest,
+		mutationsSupported: true,
+		canMutate:          false,
+		mutations:          &Mutations{RewriteUpstream: &UpstreamRewrite{Scheme: "https", Host: "denied.test"}},
+	}
+	c := chainFor(t, mw)
+	acc := NewAccumulator(0)
+
+	denied, _, rewrite, err := c.RunRequest(context.Background(), nil, &Input{}, acc)
+	require.NoError(t, err)
+	assert.Nil(t, denied, "middleware does not deny")
+	assert.Nil(t, rewrite, "rewrite must be filtered when CanMutate=false")
+}
+
+// TestChain_RunRequest_PropagatesUserGroups asserts the chain forwards
+// Input.UserGroups verbatim through cloneInputFor so policy-aware
+// middlewares (e.g. llm_policy_check) can authorise without an extra
+// management round-trip.
+func TestChain_RunRequest_PropagatesUserGroups(t *testing.T) {
+	groupCapture := &userGroupCaptureMiddleware{
+		id:   "group-capture",
+		slot: SlotOnRequest,
+	}
+	c := chainFor(t, groupCapture.fake())
+	groupCapture.bind(c)
+	acc := NewAccumulator(0)
+
+	in := &Input{UserGroups: []string{"g1"}}
+	denied, _, _, err := c.RunRequest(context.Background(), nil, in, acc)
+	require.NoError(t, err)
+	assert.Nil(t, denied, "no deny without DecisionDeny")
+
+	require.Len(t, groupCapture.seenGroups, 1, "middleware must observe the caller's UserGroups")
+	assert.Equal(t, "g1", groupCapture.seenGroups[0], "UserGroups must reach the middleware verbatim")
+}
+
+// userGroupCaptureMiddleware is a fakeMiddleware variant that records
+// Input.UserGroups during Invoke. It exists so the cloneInputFor
+// behaviour for the new field can be asserted without leaking into
+// every other chain test.
+type userGroupCaptureMiddleware struct {
+	id         string
+	slot       Slot
+	seenGroups []string
+	fakeMW     *fakeMiddleware
+}
+
+func (u *userGroupCaptureMiddleware) fake() *fakeMiddleware {
+	u.fakeMW = &fakeMiddleware{id: u.id, slot: u.slot}
+	return u.fakeMW
+}
+
+func (u *userGroupCaptureMiddleware) bind(c *Chain) {
+	for i, bm := range c.all {
+		if bm.spec.ID != u.id {
+			continue
+		}
+		c.all[i].mw = userGroupRecorder{
+			fakeMiddleware: u.fakeMW,
+			parent:         u,
+		}
+	}
+}
+
+type userGroupRecorder struct {
+	*fakeMiddleware
+	parent *userGroupCaptureMiddleware
+}
+
+func (r userGroupRecorder) Invoke(ctx context.Context, in *Input) (*Output, error) {
+	r.parent.seenGroups = append([]string(nil), in.UserGroups...)
+	return r.fakeMiddleware.Invoke(ctx, in)
+}
+
+// TestChain_RunTerminal_SeesAccumulatedMetadata locks that terminal
+// middlewares observe the full bag (the caller-supplied in.Metadata
+// plus any prior terminal emissions).
+func TestChain_RunTerminal_SeesAccumulatedMetadata(t *testing.T) {
+	first := &fakeMiddleware{
+		id:   "term-1",
+		slot: SlotTerminal,
+		keys: []string{"term.first"},
+		emit: []KV{{Key: "term.first", Value: "1"}},
+	}
+	second := &fakeMiddleware{
+		id:   "term-2",
+		slot: SlotTerminal,
+		keys: []string{"term.second"},
+	}
+	c := chainFor(t, first, second)
+	acc := NewAccumulator(0)
+
+	in := &Input{Metadata: []KV{{Key: "ext.k", Value: "ext"}}}
+	merged := c.RunTerminal(context.Background(), in, acc)
+
+	require.Len(t, second.seen, 2, "second terminal must see ext bag + first terminal's emission")
+	got := map[string]string{}
+	for _, kv := range second.seen {
+		got[kv.Key] = kv.Value
+	}
+	assert.Equal(t, "ext", got["ext.k"], "external bag carries through")
+	assert.Equal(t, "1", got["term.first"], "first terminal's emission visible to second terminal")
+	assert.Len(t, merged, 1, "only first terminal emitted; second emitted nothing")
+}
diff --git a/proxy/internal/middleware/decision.go b/proxy/internal/middleware/decision.go
new file mode 100644
index 000000000..0970bdea4
--- /dev/null
+++ b/proxy/internal/middleware/decision.go
@@ -0,0 +1,81 @@
+package middleware
+
+import (
+	"encoding/json"
+	"net/http"
+	"regexp"
+)
+
+var codeRegex = regexp.MustCompile(`^[a-z][a-z0-9._-]{0,63}$`)
+
+// denyResponse is the on-wire shape rendered by RenderDenyResponse.
+// Keeping this as a typed struct ensures we never leak
+// middleware-supplied bytes outside known fields.
+type denyResponse struct {
+	Code       string            `json:"code"`
+	Message    string            `json:"message,omitempty"`
+	Details    map[string]string `json:"details,omitempty"`
+	Middleware string            `json:"middleware,omitempty"`
+}
+
+// RenderDenyResponse writes a structured JSON deny body. Status is
+// clamped to [400, 499] excluding 401 (to avoid conflicts with the
+// proxy's auth flow). All middleware-supplied strings are redacted and
+// truncated. On any validation failure the function writes a generic
+// 403.
+func RenderDenyResponse(w http.ResponseWriter, middlewareID string, reason *DenyReason, defaultStatus int) {
+	status := clampDenyStatus(defaultStatus)
+
+	if reason == nil || !codeRegex.MatchString(reason.Code) {
+		writeGenericDeny(w, middlewareID, status)
+		return
+	}
+
+	resp := denyResponse{
+		Code:       reason.Code,
+		Message:    truncate(Scan(reason.Message), 256),
+		Middleware: truncate(Scan(middlewareID), 64),
+	}
+	if n := len(reason.Details); n > 0 {
+		resp.Details = make(map[string]string, min(n, 8))
+		for k, v := range reason.Details {
+			if len(resp.Details) >= 8 {
+				break
+			}
+			safeKey := truncate(Scan(k), 64)
+			if safeKey == "" {
+				continue
+			}
+			resp.Details[safeKey] = truncate(Scan(v), 256)
+		}
+	}
+
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	w.WriteHeader(status)
+	if err := json.NewEncoder(w).Encode(resp); err != nil {
+		return
+	}
+}
+
+func writeGenericDeny(w http.ResponseWriter, middlewareID string, status int) {
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(denyResponse{Code: "middleware.error", Middleware: truncate(Scan(middlewareID), 64)})
+}
+
+func clampDenyStatus(s int) int {
+	if s < 400 || s >= 500 {
+		return http.StatusForbidden
+	}
+	if s == http.StatusUnauthorized {
+		return http.StatusForbidden
+	}
+	return s
+}
+
+func truncate(s string, n int) string {
+	if len(s) <= n {
+		return s
+	}
+	return s[:n]
+}
diff --git a/proxy/internal/middleware/dispatcher.go b/proxy/internal/middleware/dispatcher.go
new file mode 100644
index 000000000..316604651
--- /dev/null
+++ b/proxy/internal/middleware/dispatcher.go
@@ -0,0 +1,189 @@
+package middleware
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"reflect"
+	"runtime"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// Dispatcher reliability kinds reported via
+// proxy.middleware.errors_total{kind=...}.
+const (
+	ErrorKindPanic       = "panic"
+	ErrorKindTimeout     = "timeout"
+	ErrorKindInvokeError = "invoke_error"
+)
+
+// Dispatcher drives a single middleware invocation with panic
+// recovery, deadline, and output filtering. Safe for concurrent use.
+type Dispatcher struct {
+	metrics *Metrics
+	logger  *log.Logger
+}
+
+// NewDispatcher returns a dispatcher that emits on the provided
+// metrics bundle and logger. A nil metrics bundle falls back to a noop
+// instrument set; a nil logger falls back to the standard logger.
+func NewDispatcher(metrics *Metrics, logger *log.Logger) *Dispatcher {
+	if metrics == nil {
+		metrics, _ = NewMetrics(nil)
+	}
+	if logger == nil {
+		logger = log.StandardLogger()
+	}
+	return &Dispatcher{metrics: metrics, logger: logger}
+}
+
+// Invoke runs a single middleware under the reliability wrappers:
+// deadline, panic recovery (type + truncated stack only), fail-mode,
+// metric emission, and output filtering. The returned output is always
+// safe to apply.
+func (d *Dispatcher) Invoke(ctx context.Context, spec Spec, mw Middleware, in *Input) (*Output, error) {
+	if mw == nil {
+		return nil, fmt.Errorf("middleware %s: instance unavailable", spec.ID)
+	}
+
+	timeout := clampTimeout(spec.Timeout)
+	callCtx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+
+	d.metrics.IncInvocation(ctx, spec.ID)
+	start := time.Now()
+
+	type result struct {
+		out *Output
+		err error
+	}
+	ch := make(chan result, 1)
+
+	go func() {
+		defer func() {
+			if r := recover(); r != nil {
+				stack := make([]byte, 4<<10)
+				n := runtime.Stack(stack, false)
+				requestID := ""
+				if in != nil {
+					requestID = in.RequestID
+				}
+				d.logger.Warnf("middleware %s panic: request_id=%s type=%s stack=%s",
+					spec.ID, requestID, reflect.TypeOf(r).String(), stack[:n])
+				ch <- result{err: panicError{msg: fmt.Sprintf("middleware %s panic: %s", spec.ID, reflect.TypeOf(r).String())}}
+			}
+		}()
+		out, err := mw.Invoke(callCtx, in)
+		ch <- result{out: out, err: err}
+	}()
+
+	var (
+		out    *Output
+		invErr error
+		kind   string
+	)
+
+	select {
+	case <-callCtx.Done():
+		invErr = callCtx.Err()
+		kind = ErrorKindTimeout
+	case res := <-ch:
+		out = res.out
+		invErr = res.err
+		if invErr != nil {
+			kind = d.classifyError(invErr)
+		}
+	}
+
+	d.metrics.ObserveDuration(ctx, spec.ID, time.Since(start).Milliseconds())
+
+	if invErr != nil {
+		d.metrics.IncError(ctx, spec.ID, kind)
+		return d.failMode(spec, kind), invErr
+	}
+
+	return d.filterOutput(spec, out), nil
+}
+
+func (d *Dispatcher) classifyError(err error) string {
+	if err == nil {
+		return ""
+	}
+	if errors.Is(err, context.DeadlineExceeded) {
+		return ErrorKindTimeout
+	}
+	var pe panicError
+	if errors.As(err, &pe) {
+		return ErrorKindPanic
+	}
+	return ErrorKindInvokeError
+}
+
+// panicError marks an error as coming from the recover branch so the
+// classifier can tag it without string inspection.
+type panicError struct{ msg string }
+
+func (p panicError) Error() string { return p.msg }
+
+// failMode converts an error into a synthesised output per the
+// middleware's fail-mode. An mw.<id>.error_kind metadata entry is
+// attached so operators can alert on error rate even when the
+// decision is fail-open. Slot constraints still apply: response and
+// terminal slots clamp deny back to passthrough in filterOutput.
+func (d *Dispatcher) failMode(spec Spec, kind string) *Output {
+	meta := []KV{{Key: fmt.Sprintf(KeyFrameworkErrorKindFmt, spec.ID), Value: kind}}
+	if spec.FailMode == FailClosed && spec.Slot == SlotOnRequest {
+		return &Output{
+			Decision:   DecisionDeny,
+			DenyStatus: 500,
+			DenyReason: &DenyReason{Code: "middleware.error"},
+			Metadata:   meta,
+		}
+	}
+	return &Output{Decision: DecisionAllow, Metadata: meta}
+}
+
+// filterOutput applies the output-filter pipeline (slot-aware decision
+// clamp, mutations gate) so downstream consumers never see
+// middleware-supplied values that violate the contract. Metadata is
+// passed through; the Accumulator is the single owner of allowlist +
+// caps + redaction (called by Chain).
+func (d *Dispatcher) filterOutput(spec Spec, out *Output) *Output {
+	if out == nil {
+		return &Output{Decision: DecisionAllow}
+	}
+	if spec.Slot != SlotOnRequest && out.Decision == DecisionDeny {
+		out.Decision = DecisionPassthrough
+		out.DenyStatus = 0
+		out.DenyReason = nil
+	}
+	if out.Decision == DecisionDeny {
+		if out.DenyStatus == 0 {
+			out.DenyStatus = 403
+		} else {
+			out.DenyStatus = clampDenyStatus(out.DenyStatus)
+		}
+	}
+	if !spec.CanMutate || !spec.MutationsSupported {
+		out.Mutations = nil
+	}
+	if spec.Slot == SlotTerminal {
+		out.Mutations = nil
+	}
+	return out
+}
+
+func clampTimeout(d time.Duration) time.Duration {
+	if d <= 0 {
+		return DefaultTimeout
+	}
+	if d < MinTimeout {
+		return MinTimeout
+	}
+	if d > MaxTimeout {
+		return MaxTimeout
+	}
+	return d
+}
diff --git a/proxy/internal/middleware/headerpolicy.go b/proxy/internal/middleware/headerpolicy.go
new file mode 100644
index 000000000..d041ad1e1
--- /dev/null
+++ b/proxy/internal/middleware/headerpolicy.go
@@ -0,0 +1,99 @@
+package middleware
+
+import "strings"
+
+var denyHeaders = []string{
+	"Authorization",
+	"Connection",
+	"Cookie",
+	"Set-Cookie",
+	"Forwarded",
+	"Keep-Alive",
+	"Proxy-Authorization",
+	"Proxy-Authenticate",
+	"Proxy-Connection",
+	"TE",
+	"Upgrade",
+	"Via",
+	"X-Real-IP",
+	"X-Request-ID",
+	"Host",
+	"Content-Length",
+	"Transfer-Encoding",
+	"Trailer",
+}
+
+var denyHeaderPrefixes = []string{
+	"X-Authenticated-",
+	"X-Forwarded-",
+	"X-Remote-",
+	"X-NetBird-",
+}
+
+// IsHeaderMutable reports whether a middleware is allowed to mutate
+// the named header. The check is case-insensitive and honours both
+// exact matches and the compiled-in prefix denylist.
+func IsHeaderMutable(name string) bool {
+	if name == "" {
+		return false
+	}
+	if !isHeaderFieldName(name) {
+		return false
+	}
+	for _, d := range denyHeaders {
+		if strings.EqualFold(d, name) {
+			return false
+		}
+	}
+	for _, p := range denyHeaderPrefixes {
+		if len(name) >= len(p) && strings.EqualFold(name[:len(p)], p) {
+			return false
+		}
+	}
+	return true
+}
+
+// isHeaderFieldName reports whether name is a valid RFC 7230 header
+// field-name (a non-empty token of tchar octets). Rejects names with
+// spaces, control characters, or separators that could enable header
+// injection or smuggling when applied to the outbound request.
+func isHeaderFieldName(name string) bool {
+	for i := 0; i < len(name); i++ {
+		c := name[i]
+		if (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') {
+			continue
+		}
+		switch c {
+		case '!', '#', '$', '%', '&', '\'', '*', '+', '-', '.', '^', '_', '`', '|', '~':
+			continue
+		default:
+			return false
+		}
+	}
+	return true
+}
+
+// FilterHeaderMutations returns the subsets of HeadersAdd and
+// HeadersRemove that are safe to apply, plus the list of blocked
+// header names so the dispatcher can increment the blocked-header
+// metric.
+func FilterHeaderMutations(m *Mutations) (filteredAdd []KV, filteredRemove []string, blocked []string) {
+	if m == nil {
+		return nil, nil, nil
+	}
+	for _, kv := range m.HeadersAdd {
+		if IsHeaderMutable(kv.Key) {
+			filteredAdd = append(filteredAdd, kv)
+			continue
+		}
+		blocked = append(blocked, kv.Key)
+	}
+	for _, name := range m.HeadersRemove {
+		if IsHeaderMutable(name) {
+			filteredRemove = append(filteredRemove, name)
+			continue
+		}
+		blocked = append(blocked, name)
+	}
+	return filteredAdd, filteredRemove, blocked
+}
diff --git a/proxy/internal/middleware/keys.go b/proxy/internal/middleware/keys.go
new file mode 100644
index 000000000..9c584ad82
--- /dev/null
+++ b/proxy/internal/middleware/keys.go
@@ -0,0 +1,86 @@
+package middleware
+
+// Metadata key namespace constants shared across the built-in
+// middlewares. Each domain owns a prefix; middlewares declare their
+// per-key allowlist drawn from these constants. Agents implementing
+// the G2 middlewares import this file so the dashboard's expanded-row
+// viewer and the access-log writer see a stable key surface.
+//
+// Key shape rules (enforced by the metadata accumulator):
+//   - Lowercase ASCII letters, digits, dot, underscore, hyphen.
+//   - At least one dot separating namespace from leaf.
+//   - Max length: MaxMetadataKeyBytes.
+const (
+	// LLM request-side metadata (emitted by llm_request_parser).
+	KeyLLMProvider         = "llm.provider"
+	KeyLLMModel            = "llm.model"
+	KeyLLMStream           = "llm.stream"
+	KeyLLMRequestPromptRaw = "llm.request_prompt_raw"
+	KeyLLMCaptureTruncated = "llm.capture_truncated"
+	// KeyLLMSessionID groups requests of the same conversation / coding
+	// session, read from the per-provider session marker in the request
+	// body. Empty for clients that don't send one.
+	KeyLLMSessionID = "llm.session_id"
+
+	// LLM response-side metadata (emitted by llm_response_parser).
+	//nolint:gosec // metadata key name, not a credential
+	KeyLLMInputTokens = "llm.input_tokens"
+	//nolint:gosec // metadata key name, not a credential
+	KeyLLMOutputTokens = "llm.output_tokens"
+	//nolint:gosec // metadata key name, not a credential
+	KeyLLMTotalTokens = "llm.total_tokens"
+	// LLM cached-input bucket. For OpenAI it's the SUBSET of input
+	// tokens that hit the prompt cache (prompt_tokens_details.
+	// cached_tokens) — billed at the cached_input_per_1k rate when
+	// configured. For Anthropic it's cache_read_input_tokens, which
+	// is ADDITIVE to llm.input_tokens — billed at cache_read_per_1k.
+	// cost_meter switches formula on llm.provider.
+	//nolint:gosec // metadata key name, not a credential
+	KeyLLMCachedInputTokens = "llm.cached_input_tokens"
+	// LLM cache-creation bucket (Anthropic only). ADDITIVE to
+	// llm.input_tokens; billed at cache_creation_per_1k.
+	//nolint:gosec // metadata key name, not a credential
+	KeyLLMCacheCreationTokens = "llm.cache_creation_tokens"
+	KeyLLMResponseCompletion  = "llm.response_completion"
+
+	// Guardrail outcomes (emitted by llm_guardrail). The guardrail
+	// also re-emits llm.request_prompt as a redacted variant of the
+	// raw prompt and drops llm.request_prompt_raw from the bag.
+	KeyLLMRequestPrompt  = "llm.request_prompt"
+	KeyLLMPolicyDecision = "llm_policy.decision"
+	KeyLLMPolicyReason   = "llm_policy.reason"
+
+	// LLM router routing decision (emitted by llm_router). The router
+	// stamps the resolved provider id so downstream middlewares and
+	// the access-log emitter can attribute the request without
+	// re-parsing the body.
+	KeyLLMResolvedProviderID = "llm.resolved_provider_id"
+
+	// LLM authorising groups for this request (emitted by llm_router
+	// on the allow path). Carries the comma-separated intersection of
+	// the caller's UserGroups with the resolved route's
+	// AllowedGroupIDs — i.e. the groups that actually authorise this
+	// specific request, NOT every group the peer happens to be in.
+	// Identity-stamping middlewares use this for per-request tag
+	// attribution so unrelated group memberships don't leak into
+	// downstream gateways' spend logs.
+	KeyLLMAuthorisingGroups = "llm.authorising_groups"
+
+	// LLM policy attribution (emitted by llm_limit_check on the allow
+	// path). Names the policy that paid for this request and the
+	// dimension counters the post-flight llm_limit_record middleware
+	// must tick. Empty when no applicable policy has any caps
+	// configured (catch-all-allow attribution).
+	KeyLLMSelectedPolicyID   = "llm.selected_policy_id"
+	KeyLLMAttributionGroupID = "llm.attribution_group_id"
+	KeyLLMAttributionWindowS = "llm.attribution_window_seconds"
+
+	// Cost metering (emitted by cost_meter).
+	KeyCostUSDTotal = "cost.usd_total"
+	KeyCostSkipped  = "cost.skipped"
+
+	// Framework-emitted error markers. Use the mw.<id>.* prefix to
+	// distinguish framework-injected entries from middleware-emitted
+	// metadata.
+	KeyFrameworkErrorKindFmt = "mw.%s.error_kind"
+)
diff --git a/proxy/internal/middleware/manager.go b/proxy/internal/middleware/manager.go
new file mode 100644
index 000000000..9b22edeff
--- /dev/null
+++ b/proxy/internal/middleware/manager.go
@@ -0,0 +1,412 @@
+package middleware
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware/bodytap"
+)
+
+// chainCloseTimeout bounds how long closeChainsAsync waits for an
+// individual chain to drain before forcing teardown. Set to 2x
+// MaxTimeout so a middleware blocked on the dispatcher's per-Invoke
+// deadline always wins; anything running longer is a runaway and gets
+// force-closed.
+const chainCloseTimeout = 2 * MaxTimeout
+
+// PathTargetBinding is the minimal per-path binding the server passes
+// to Rebuild. It carries the stable keys Manager uses for snapshot
+// lookups plus the validated middleware spec list for that path.
+type PathTargetBinding struct {
+	ServiceID string
+	PathID    string
+	Specs     []Spec
+}
+
+// LiveServiceCheck reports whether the given service ID is still
+// present in the proxy's live mapping cache. The Manager calls it
+// during InvalidateMiddleware so a chain whose service has been
+// removed since the last Rebuild is not resurrected from the binding
+// cache, closing the auth-revocation race.
+type LiveServiceCheck func(serviceID string) bool
+
+// chainTable holds the immutable per-target chain snapshot. It is
+// cloned into a new instance on every Rebuild and swapped in via
+// atomic.Pointer. The reverse index byMiddleware lets
+// InvalidateMiddleware find the chain keys that reference a given
+// middleware without scanning the whole table.
+type chainTable struct {
+	byTarget     map[string]*Chain
+	byMiddleware map[string]map[string]struct{}
+}
+
+func newChainTable() *chainTable {
+	return &chainTable{
+		byTarget:     make(map[string]*Chain),
+		byMiddleware: make(map[string]map[string]struct{}),
+	}
+}
+
+func (c *chainTable) clone() *chainTable {
+	out := newChainTable()
+	for k, v := range c.byTarget {
+		out.byTarget[k] = v
+	}
+	for id, keys := range c.byMiddleware {
+		set := make(map[string]struct{}, len(keys))
+		for k := range keys {
+			set[k] = struct{}{}
+		}
+		out.byMiddleware[id] = set
+	}
+	return out
+}
+
+func (c *chainTable) addChain(key string, ch *Chain) {
+	c.byTarget[key] = ch
+	if ch == nil {
+		return
+	}
+	for _, bm := range ch.all {
+		set, ok := c.byMiddleware[bm.spec.ID]
+		if !ok {
+			set = make(map[string]struct{})
+			c.byMiddleware[bm.spec.ID] = set
+		}
+		set[key] = struct{}{}
+	}
+}
+
+func (c *chainTable) removeChain(key string) (*Chain, []string) {
+	ch, ok := c.byTarget[key]
+	if !ok {
+		return nil, nil
+	}
+	delete(c.byTarget, key)
+	if ch == nil {
+		return nil, nil
+	}
+	ids := make([]string, 0, len(ch.all))
+	for _, bm := range ch.all {
+		ids = append(ids, bm.spec.ID)
+		set, ok := c.byMiddleware[bm.spec.ID]
+		if !ok {
+			continue
+		}
+		delete(set, key)
+		if len(set) == 0 {
+			delete(c.byMiddleware, bm.spec.ID)
+		}
+	}
+	return ch, ids
+}
+
+// Manager owns the per-target middleware chains, the global capture
+// budget, and the shared dispatcher. Readers (ChainFor) are lock-free;
+// writers (Rebuild, Invalidate*) serialise on writeMu so two
+// concurrent mapping updates do not lose writes.
+type Manager struct {
+	writeMu          sync.Mutex
+	chains           atomic.Pointer[chainTable]
+	budget           bodytap.Budget
+	metrics          *Metrics
+	logger           *log.Logger
+	dispatcher       *Dispatcher
+	resolver         *Resolver
+	lastBindings     map[string]PathTargetBinding
+	liveServiceCheck atomic.Pointer[LiveServiceCheck]
+}
+
+// NewManager constructs a Manager with the given capture budget size.
+// A zero or negative budget falls back to bodytap.DefaultCaptureBudgetBytes.
+func NewManager(budgetBytes int64, metrics *Metrics, logger *log.Logger) *Manager {
+	if metrics == nil {
+		metrics, _ = NewMetrics(nil)
+	}
+	if logger == nil {
+		logger = log.StandardLogger()
+	}
+	if budgetBytes <= 0 {
+		budgetBytes = bodytap.DefaultCaptureBudgetBytes
+	}
+	m := &Manager{
+		budget:       bodytap.NewBudget(budgetBytes),
+		metrics:      metrics,
+		logger:       logger,
+		dispatcher:   NewDispatcher(metrics, logger),
+		lastBindings: make(map[string]PathTargetBinding),
+	}
+	m.chains.Store(newChainTable())
+	return m
+}
+
+// SetResolver installs the resolver used by Rebuild. Safe to call
+// once at boot before any Rebuild; not safe to swap concurrently.
+func (m *Manager) SetResolver(r *Resolver) {
+	m.resolver = r
+}
+
+// SetLiveServiceCheck installs a callback the Manager uses to confirm
+// a service ID still maps to a live mapping before resurrecting its
+// chain from the binding cache during InvalidateMiddleware. A nil fn
+// disables the check.
+func (m *Manager) SetLiveServiceCheck(fn LiveServiceCheck) {
+	if fn == nil {
+		m.liveServiceCheck.Store(nil)
+		return
+	}
+	m.liveServiceCheck.Store(&fn)
+}
+
+// Budget returns the shared capture budget.
+func (m *Manager) Budget() bodytap.Budget {
+	return m.budget
+}
+
+// Metrics returns the shared metrics bundle.
+func (m *Manager) Metrics() *Metrics {
+	return m.metrics
+}
+
+// Dispatcher returns the shared dispatcher (primarily for testing).
+func (m *Manager) Dispatcher() *Dispatcher {
+	return m.dispatcher
+}
+
+// Rebuild replaces every chain keyed by serviceID with the provided
+// bindings. Entries for other services are preserved. Replaced chains
+// are closed asynchronously after the atomic swap so in-flight
+// requests against the previous chain finish before middleware
+// resources are released.
+func (m *Manager) Rebuild(serviceID string, bindings []PathTargetBinding) error {
+	m.writeMu.Lock()
+	defer m.writeMu.Unlock()
+
+	cur := m.chains.Load()
+	next := cur.clone()
+
+	prefix := serviceID + "|"
+	var retired []*Chain
+	for k := range cur.byTarget {
+		if !strings.HasPrefix(k, prefix) {
+			continue
+		}
+		ch, _ := next.removeChain(k)
+		if ch != nil {
+			retired = append(retired, ch)
+		}
+		delete(m.lastBindings, k)
+	}
+
+	for _, b := range bindings {
+		if b.ServiceID != serviceID {
+			return fmt.Errorf("binding service %q does not match rebuild service %q", b.ServiceID, serviceID)
+		}
+		key := chainKey(b.ServiceID, b.PathID)
+		m.lastBindings[key] = cloneBinding(b)
+		chain := m.buildChain(b)
+		if chain == nil || chain.Empty() {
+			delete(m.lastBindings, key)
+			continue
+		}
+		next.addChain(key, chain)
+	}
+
+	m.chains.Store(next)
+	m.closeChainsAsync(retired)
+	return nil
+}
+
+// Invalidate drops every chain for the given service ID.
+func (m *Manager) Invalidate(serviceID string) {
+	m.writeMu.Lock()
+	defer m.writeMu.Unlock()
+	cur := m.chains.Load()
+	next := cur.clone()
+	prefix := serviceID + "|"
+	var retired []*Chain
+	for k := range cur.byTarget {
+		if !strings.HasPrefix(k, prefix) {
+			continue
+		}
+		ch, _ := next.removeChain(k)
+		if ch != nil {
+			retired = append(retired, ch)
+		}
+		delete(m.lastBindings, k)
+	}
+	for k := range m.lastBindings {
+		if strings.HasPrefix(k, prefix) {
+			delete(m.lastBindings, k)
+		}
+	}
+	m.chains.Store(next)
+	m.closeChainsAsync(retired)
+}
+
+// InvalidateMiddleware rebuilds only the chains that reference id.
+func (m *Manager) InvalidateMiddleware(id string) {
+	if id == "" {
+		return
+	}
+	m.writeMu.Lock()
+	defer m.writeMu.Unlock()
+
+	cur := m.chains.Load()
+	keys, ok := cur.byMiddleware[id]
+	if !ok || len(keys) == 0 {
+		return
+	}
+
+	affected := make([]string, 0, len(keys))
+	for k := range keys {
+		affected = append(affected, k)
+	}
+
+	next := cur.clone()
+	var retired []*Chain
+	check := m.loadLiveServiceCheck()
+	for _, k := range affected {
+		ch, _ := next.removeChain(k)
+		if ch != nil {
+			retired = append(retired, ch)
+		}
+		b, ok := m.lastBindings[k]
+		if !ok {
+			delete(m.lastBindings, k)
+			continue
+		}
+		if check != nil && !check(b.ServiceID) {
+			m.logger.Debugf("middleware %s: skipping rebuild for %s; service no longer live", id, k)
+			delete(m.lastBindings, k)
+			continue
+		}
+		chain := m.buildChain(b)
+		if chain == nil || chain.Empty() {
+			delete(m.lastBindings, k)
+			continue
+		}
+		next.addChain(k, chain)
+	}
+
+	m.chains.Store(next)
+	m.closeChainsAsync(retired)
+}
+
+func (m *Manager) loadLiveServiceCheck() LiveServiceCheck {
+	p := m.liveServiceCheck.Load()
+	if p == nil {
+		return nil
+	}
+	return *p
+}
+
+// InvalidateAll drops every chain.
+func (m *Manager) InvalidateAll() {
+	m.writeMu.Lock()
+	defer m.writeMu.Unlock()
+	cur := m.chains.Load()
+	retired := make([]*Chain, 0, len(cur.byTarget))
+	for _, c := range cur.byTarget {
+		retired = append(retired, c)
+	}
+	m.chains.Store(newChainTable())
+	for k := range m.lastBindings {
+		delete(m.lastBindings, k)
+	}
+	m.closeChainsAsync(retired)
+}
+
+func (m *Manager) closeChainsAsync(retired []*Chain) {
+	if len(retired) == 0 {
+		return
+	}
+	chains := make([]*Chain, len(retired))
+	copy(chains, retired)
+	go func() {
+		for _, c := range chains {
+			ctx, cancel := context.WithTimeout(context.Background(), chainCloseTimeout)
+			start := time.Now()
+			if err := c.Close(ctx); err != nil {
+				if m.metrics != nil {
+					m.metrics.IncError(context.Background(), c.TargetID(), "chain_close_timeout")
+				}
+				m.logger.Warnf("middleware chain %s close exceeded %s after %s: %v",
+					c.TargetID(), chainCloseTimeout, time.Since(start), err)
+			}
+			cancel()
+		}
+	}()
+}
+
+// ChainFor returns the chain for serviceID/pathID or nil if none is
+// registered. Lock-free.
+func (m *Manager) ChainFor(serviceID, pathID string) *Chain {
+	tbl := m.chains.Load()
+	if tbl == nil {
+		return nil
+	}
+	c, ok := tbl.byTarget[chainKey(serviceID, pathID)]
+	if !ok {
+		return nil
+	}
+	return c
+}
+
+// buildChain resolves each enabled spec and returns the assembled
+// chain. Returns a nil chain when no middlewares are bound; resolver
+// errors per middleware are logged and counted but do not abort the
+// chain.
+func (m *Manager) buildChain(b PathTargetBinding) *Chain {
+	if len(b.Specs) == 0 || m.resolver == nil {
+		return nil
+	}
+
+	bound := make([]boundMiddleware, 0, len(b.Specs))
+	for _, spec := range b.Specs {
+		if !spec.Enabled {
+			continue
+		}
+		mw, merged, err := m.resolver.Resolve(spec)
+		if err != nil {
+			m.logger.Warnf("middleware %s resolve on target %s/%s: %v", spec.ID, b.ServiceID, b.PathID, err)
+			m.metrics.IncError(context.Background(), spec.ID, "resolve_error")
+			continue
+		}
+		if mw == nil {
+			continue
+		}
+		bound = append(bound, boundMiddleware{spec: merged, mw: mw})
+	}
+	if len(bound) == 0 {
+		return nil
+	}
+	return NewChain(chainKey(b.ServiceID, b.PathID), bound, m.dispatcher)
+}
+
+// cloneBinding returns a deep copy of b suitable for caching across
+// mapping updates.
+func cloneBinding(b PathTargetBinding) PathTargetBinding {
+	out := PathTargetBinding{
+		ServiceID: b.ServiceID,
+		PathID:    b.PathID,
+	}
+	if len(b.Specs) == 0 {
+		return out
+	}
+	out.Specs = make([]Spec, len(b.Specs))
+	for i, s := range b.Specs {
+		out.Specs[i] = s.Clone()
+	}
+	return out
+}
+
+func chainKey(serviceID, pathID string) string {
+	return serviceID + "|" + pathID
+}
diff --git a/proxy/internal/middleware/metadata.go b/proxy/internal/middleware/metadata.go
new file mode 100644
index 000000000..576c379ec
--- /dev/null
+++ b/proxy/internal/middleware/metadata.go
@@ -0,0 +1,99 @@
+package middleware
+
+import "regexp"
+
+// keyRegex constrains metadata keys to the cross-domain shape
+// described in keys.go. At least one dot, lowercase ASCII / digits /
+// dot / underscore / hyphen only, length within MaxMetadataKeyBytes.
+var keyRegex = regexp.MustCompile(`^[a-z][a-z0-9_-]*(\.[a-z0-9][a-z0-9_-]*)+$`)
+
+// MetadataRejection describes a single rejected key/value so the
+// dispatcher can emit per-reason counter increments.
+type MetadataRejection struct {
+	Key    string
+	Reason string
+}
+
+// Rejection reasons reported by Accumulator.Emit.
+const (
+	MetadataReasonBadKey         = "bad_key"
+	MetadataReasonNotAllowlisted = "not_allowlisted"
+	MetadataReasonKeyTooLong     = "key_too_long"
+	MetadataReasonValueTooLong   = "value_too_long"
+	MetadataReasonMiddlewareCap  = "middleware_cap"
+	MetadataReasonRequestCap     = "request_cap"
+)
+
+// Accumulator enforces per-middleware and per-request metadata caps.
+// Not safe for concurrent use; callers hold one inside a single chain
+// execution.
+type Accumulator struct {
+	perMiddlewareUsed map[string]int
+	totalUsed         int
+	maxPerRequest     int
+}
+
+// NewAccumulator returns an accumulator configured for the per-request
+// total cap. A maxPerRequest of zero means use MaxRequestMetadataBytes.
+func NewAccumulator(maxPerRequest int) *Accumulator {
+	if maxPerRequest <= 0 {
+		maxPerRequest = MaxRequestMetadataBytes
+	}
+	return &Accumulator{
+		perMiddlewareUsed: make(map[string]int),
+		maxPerRequest:     maxPerRequest,
+	}
+}
+
+// Emit validates the candidate metadata against the middleware's
+// allowlist and the global caps, redacts each accepted value, and
+// returns the accepted entries plus any rejections for metric emission.
+func (a *Accumulator) Emit(middlewareID string, allow []string, out []KV) ([]KV, []MetadataRejection) {
+	if len(out) == 0 {
+		return nil, nil
+	}
+	allowSet := make(map[string]struct{}, len(allow))
+	for _, k := range allow {
+		allowSet[k] = struct{}{}
+	}
+
+	accepted := make([]KV, 0, len(out))
+	var rejected []MetadataRejection
+
+	for _, kv := range out {
+		if len(kv.Key) == 0 || len(kv.Key) > MaxMetadataKeyBytes {
+			rejected = append(rejected, MetadataRejection{Key: kv.Key, Reason: MetadataReasonKeyTooLong})
+			continue
+		}
+		if !keyRegex.MatchString(kv.Key) {
+			rejected = append(rejected, MetadataRejection{Key: kv.Key, Reason: MetadataReasonBadKey})
+			continue
+		}
+		if _, ok := allowSet[kv.Key]; !ok {
+			rejected = append(rejected, MetadataRejection{Key: kv.Key, Reason: MetadataReasonNotAllowlisted})
+			continue
+		}
+		if len(kv.Value) > MaxMetadataValueBytes {
+			rejected = append(rejected, MetadataRejection{Key: kv.Key, Reason: MetadataReasonValueTooLong})
+			continue
+		}
+
+		redacted := Scan(kv.Value)
+		cost := len(kv.Key) + len(redacted)
+
+		if a.perMiddlewareUsed[middlewareID]+cost > MaxMiddlewareMetadataBytes {
+			rejected = append(rejected, MetadataRejection{Key: kv.Key, Reason: MetadataReasonMiddlewareCap})
+			continue
+		}
+		if a.totalUsed+cost > a.maxPerRequest {
+			rejected = append(rejected, MetadataRejection{Key: kv.Key, Reason: MetadataReasonRequestCap})
+			continue
+		}
+
+		a.perMiddlewareUsed[middlewareID] += cost
+		a.totalUsed += cost
+		accepted = append(accepted, KV{Key: kv.Key, Value: redacted})
+	}
+
+	return accepted, rejected
+}
diff --git a/proxy/internal/middleware/metrics.go b/proxy/internal/middleware/metrics.go
new file mode 100644
index 000000000..73745a86b
--- /dev/null
+++ b/proxy/internal/middleware/metrics.go
@@ -0,0 +1,171 @@
+package middleware
+
+import (
+	"context"
+
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/metric"
+	"go.opentelemetry.io/otel/metric/noop"
+)
+
+// Metrics is the bundle of OTel instruments emitted by the middleware
+// dispatcher. The constructor falls back to a noop meter when given
+// nil so tests can skip metrics wiring entirely.
+type Metrics struct {
+	requestsTotal         metric.Int64Counter
+	durationMs            metric.Int64Histogram
+	invocationsTotal      metric.Int64Counter
+	errorsTotal           metric.Int64Counter
+	metadataRejectedTotal metric.Int64Counter
+	headerMutationBlocked metric.Int64Counter
+	captureBypassTotal    metric.Int64Counter
+}
+
+// NewMetrics registers the proxy.middleware.* instruments on the
+// given meter. A nil meter is treated as the global no-op provider.
+func NewMetrics(meter metric.Meter) (*Metrics, error) {
+	if meter == nil {
+		meter = noop.NewMeterProvider().Meter("proxy.middleware.noop")
+	}
+
+	m := &Metrics{}
+	var err error
+
+	m.requestsTotal, err = meter.Int64Counter(
+		"proxy.middleware.requests_total",
+		metric.WithUnit("1"),
+		metric.WithDescription("Middleware invocations grouped by outcome"),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	m.durationMs, err = meter.Int64Histogram(
+		"proxy.middleware.duration_ms",
+		metric.WithUnit("milliseconds"),
+		metric.WithDescription("Middleware Invoke latency"),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	m.invocationsTotal, err = meter.Int64Counter(
+		"proxy.middleware.invocations_total",
+		metric.WithUnit("1"),
+		metric.WithDescription("Middleware Invoke heartbeat counter"),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	m.errorsTotal, err = meter.Int64Counter(
+		"proxy.middleware.errors_total",
+		metric.WithUnit("1"),
+		metric.WithDescription("Middleware errors grouped by kind"),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	m.metadataRejectedTotal, err = meter.Int64Counter(
+		"proxy.middleware.metadata_rejected_total",
+		metric.WithUnit("1"),
+		metric.WithDescription("Middleware metadata entries rejected by the allowlist/caps"),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	m.headerMutationBlocked, err = meter.Int64Counter(
+		"proxy.middleware.header_mutation_blocked_total",
+		metric.WithUnit("1"),
+		metric.WithDescription("Middleware header mutations dropped by the denylist"),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	m.captureBypassTotal, err = meter.Int64Counter(
+		"proxy.middleware.capture_bypass_total",
+		metric.WithUnit("1"),
+		metric.WithDescription("Capture bypasses grouped by reason"),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return m, nil
+}
+
+// IncRequest increments proxy.middleware.requests_total with the
+// middleware, target, and outcome labels.
+func (m *Metrics) IncRequest(ctx context.Context, middlewareID, targetID, outcome string) {
+	if m == nil {
+		return
+	}
+	m.requestsTotal.Add(ctx, 1, metric.WithAttributes(
+		attribute.String("middleware", middlewareID),
+		attribute.String("target_id", targetID),
+		attribute.String("outcome", outcome),
+	))
+}
+
+// ObserveDuration records the middleware Invoke latency in milliseconds.
+func (m *Metrics) ObserveDuration(ctx context.Context, middlewareID string, ms int64) {
+	if m == nil {
+		return
+	}
+	m.durationMs.Record(ctx, ms, metric.WithAttributes(attribute.String("middleware", middlewareID)))
+}
+
+// IncInvocation increments the heartbeat counter regardless of outcome.
+func (m *Metrics) IncInvocation(ctx context.Context, middlewareID string) {
+	if m == nil {
+		return
+	}
+	m.invocationsTotal.Add(ctx, 1, metric.WithAttributes(attribute.String("middleware", middlewareID)))
+}
+
+// IncError increments the error counter with the given failure kind label.
+func (m *Metrics) IncError(ctx context.Context, middlewareID, kind string) {
+	if m == nil {
+		return
+	}
+	m.errorsTotal.Add(ctx, 1, metric.WithAttributes(
+		attribute.String("middleware", middlewareID),
+		attribute.String("kind", kind),
+	))
+}
+
+// IncMetadataRejected increments the rejected-metadata counter for a reason.
+func (m *Metrics) IncMetadataRejected(ctx context.Context, middlewareID, reason string) {
+	if m == nil {
+		return
+	}
+	m.metadataRejectedTotal.Add(ctx, 1, metric.WithAttributes(
+		attribute.String("middleware", middlewareID),
+		attribute.String("reason", reason),
+	))
+}
+
+// IncHeaderMutationBlocked increments the blocked-header counter.
+func (m *Metrics) IncHeaderMutationBlocked(ctx context.Context, middlewareID, header string) {
+	if m == nil {
+		return
+	}
+	m.headerMutationBlocked.Add(ctx, 1, metric.WithAttributes(
+		attribute.String("middleware", middlewareID),
+		attribute.String("header", header),
+	))
+}
+
+// IncCaptureBypass increments the capture-bypass counter for a reason.
+func (m *Metrics) IncCaptureBypass(ctx context.Context, targetID, reason string) {
+	if m == nil {
+		return
+	}
+	m.captureBypassTotal.Add(ctx, 1, metric.WithAttributes(
+		attribute.String("target_id", targetID),
+		attribute.String("reason", reason),
+	))
+}
diff --git a/proxy/internal/middleware/middleware.go b/proxy/internal/middleware/middleware.go
new file mode 100644
index 000000000..16d398d2c
--- /dev/null
+++ b/proxy/internal/middleware/middleware.go
@@ -0,0 +1,47 @@
+package middleware
+
+import "context"
+
+// Middleware is the surface exposed by each concrete implementation.
+// The Manager invokes it through the Dispatcher, passing a cloned
+// Input. Each middleware lives in exactly one Slot.
+//
+// Close releases any resources owned by the middleware instance
+// (background goroutines, file handles). It is invoked when the chain
+// holding the middleware is replaced or torn down. Implementations
+// must be idempotent and safe to call after construction even when
+// Invoke was never called.
+type Middleware interface {
+	ID() string
+	Version() string
+	Slot() Slot
+
+	// AcceptedContentTypes lists the request/response content types
+	// the middleware needs the body for. Empty slice means the
+	// middleware does not inspect the body.
+	AcceptedContentTypes() []string
+
+	// MetadataKeys is the closed set of metadata keys this middleware
+	// may emit. The accumulator drops anything outside this allowlist.
+	MetadataKeys() []string
+
+	// MutationsSupported reports whether the middleware may emit
+	// header / body mutations. A spec with CanMutate=true is honoured
+	// only when the implementation also supports mutations.
+	MutationsSupported() bool
+
+	Invoke(ctx context.Context, in *Input) (*Output, error)
+
+	Close() error
+}
+
+// Factory builds a configured Middleware instance from raw config
+// bytes shipped on the wire. Each registered middleware ID has a
+// single factory in the registry. Factory.New returns an error when
+// the config is malformed or violates a per-middleware invariant; the
+// chain build path logs the error, increments the resolve_error metric,
+// and skips the middleware.
+type Factory interface {
+	ID() string
+	New(rawConfig []byte) (Middleware, error)
+}
diff --git a/proxy/internal/middleware/redaction.go b/proxy/internal/middleware/redaction.go
new file mode 100644
index 000000000..ebbe90c61
--- /dev/null
+++ b/proxy/internal/middleware/redaction.go
@@ -0,0 +1,79 @@
+package middleware
+
+import (
+	"regexp"
+	"strings"
+)
+
+// Redaction scope: Scan handles the narrow, high-signal set of
+// secrets we are comfortable masking with a regex. The intent is
+// "make accidental leaks impossible to miss at a glance", not "be a
+// DLP product". Contributors adding more patterns should weigh false
+// positives carefully — a metadata value that over-redacts benign
+// strings is strictly worse than one that misses a rare format.
+var (
+	jwtRegex       = regexp.MustCompile(`eyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}`)
+	pemRegex       = regexp.MustCompile(`-----BEGIN [A-Z ]+-----[\s\S]*?-----END [A-Z ]+-----`)
+	awsKeyRegex    = regexp.MustCompile(`AKIA[0-9A-Z]{16}`)
+	bearerRegex    = regexp.MustCompile(`(?i)\b(?:bearer|token|api[_-]?key|authorization)[\s:=]+([A-Za-z0-9_\-\.]{40,})`)
+	ccCandidateRgx = regexp.MustCompile(`\b(?:\d[ -]?){13,19}\b`)
+)
+
+// Scan redacts high-signal secret patterns from value. Matches are
+// replaced with `[REDACTED:<kind>]`. Non-matching input is returned
+// unchanged.
+func Scan(value string) string {
+	if value == "" {
+		return value
+	}
+	result := value
+	result = pemRegex.ReplaceAllString(result, "[REDACTED:pem]")
+	result = jwtRegex.ReplaceAllString(result, "[REDACTED:jwt]")
+	result = awsKeyRegex.ReplaceAllString(result, "[REDACTED:aws_key]")
+	result = bearerRegex.ReplaceAllStringFunc(result, func(match string) string {
+		sub := bearerRegex.FindStringSubmatch(match)
+		if len(sub) < 2 {
+			return "[REDACTED:bearer]"
+		}
+		return strings.Replace(match, sub[1], "[REDACTED:bearer]", 1)
+	})
+	result = ccCandidateRgx.ReplaceAllStringFunc(result, func(match string) string {
+		digits := stripNonDigits(match)
+		if len(digits) < 13 || len(digits) > 19 {
+			return match
+		}
+		if !luhn(digits) {
+			return match
+		}
+		return "[REDACTED:cc]"
+	})
+	return result
+}
+
+func stripNonDigits(s string) string {
+	var b strings.Builder
+	b.Grow(len(s))
+	for _, r := range s {
+		if r >= '0' && r <= '9' {
+			b.WriteRune(r)
+		}
+	}
+	return b.String()
+}
+
+func luhn(digits string) bool {
+	sum := 0
+	alt := false
+	for i := len(digits) - 1; i >= 0; i-- {
+		n := int(digits[i] - '0')
+		if alt {
+			n *= 2
+			if n > 9 {
+				n -= 9
+			}
+		}
+		sum += n
+		alt = !alt
+	}
+	return sum%10 == 0
+}
diff --git a/proxy/internal/middleware/registry.go b/proxy/internal/middleware/registry.go
new file mode 100644
index 000000000..c46552162
--- /dev/null
+++ b/proxy/internal/middleware/registry.go
@@ -0,0 +1,121 @@
+package middleware
+
+import (
+	"fmt"
+	"sync"
+)
+
+// Registry maps middleware IDs to their factories. The proxy installs
+// a single Registry at boot; concrete middlewares register themselves
+// from init() functions inside their own packages so the boot wiring
+// only needs an anonymous import.
+//
+// Registry is safe for concurrent reads after boot. Register / Unregister
+// take the write lock; Get and IDs take the read lock.
+type Registry struct {
+	mu        sync.RWMutex
+	factories map[string]Factory
+}
+
+// NewRegistry returns an empty registry.
+func NewRegistry() *Registry {
+	return &Registry{factories: make(map[string]Factory)}
+}
+
+// Register installs the factory under its ID. Returns an error when an
+// ID is already registered — collisions are programmer errors and must
+// be visible at boot rather than silently last-write-wins.
+func (r *Registry) Register(f Factory) error {
+	if f == nil {
+		return fmt.Errorf("middleware registry: nil factory")
+	}
+	id := f.ID()
+	if id == "" {
+		return fmt.Errorf("middleware registry: factory has empty id")
+	}
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if _, exists := r.factories[id]; exists {
+		return fmt.Errorf("middleware registry: %q already registered", id)
+	}
+	r.factories[id] = f
+	return nil
+}
+
+// MustRegister panics on error. Intended for init() registration so
+// duplicate IDs surface at startup.
+func (r *Registry) MustRegister(f Factory) {
+	if err := r.Register(f); err != nil {
+		panic(err)
+	}
+}
+
+// Get returns the factory for id, or nil when no factory is
+// registered.
+func (r *Registry) Get(id string) Factory {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	return r.factories[id]
+}
+
+// IDs returns the registered IDs in unspecified order. Used by the
+// management translator to reject specs that reference unknown IDs at
+// apply time.
+func (r *Registry) IDs() []string {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	out := make([]string, 0, len(r.factories))
+	for id := range r.factories {
+		out = append(out, id)
+	}
+	return out
+}
+
+// IsKnown reports whether id has a registered factory.
+func (r *Registry) IsKnown(id string) bool {
+	return r.Get(id) != nil
+}
+
+// Resolver wraps a Registry and produces a configured Middleware
+// instance from a Spec. The Manager uses this during chain build.
+type Resolver struct {
+	registry *Registry
+}
+
+// NewResolver returns a resolver backed by the registry.
+func NewResolver(registry *Registry) *Resolver {
+	if registry == nil {
+		registry = NewRegistry()
+	}
+	return &Resolver{registry: registry}
+}
+
+// Resolve builds a Middleware instance and merges runtime-only fields
+// (version, accepted content types, metadata key allowlist, mutation
+// support) onto the spec.
+//
+// Return semantics:
+//   - (mw, mergedSpec, nil): instance built, include in chain.
+//   - (nil, spec, nil): id not registered; silently skip.
+//   - (nil, spec, err): factory rejected the config (logged + counted
+//     by Manager, other middlewares still bind).
+func (r *Resolver) Resolve(spec Spec) (Middleware, Spec, error) {
+	f := r.registry.Get(spec.ID)
+	if f == nil {
+		return nil, spec, nil
+	}
+	mw, err := f.New(spec.RawConfig)
+	if err != nil {
+		return nil, spec, fmt.Errorf("middleware %s factory: %w", spec.ID, err)
+	}
+	if mw.Slot() != spec.Slot {
+		_ = mw.Close()
+		return nil, spec, fmt.Errorf("middleware %s slot mismatch: spec=%d impl=%d", spec.ID, spec.Slot, mw.Slot())
+	}
+	merged := spec
+	merged.Version = mw.Version()
+	merged.MetadataKeys = append([]string(nil), mw.MetadataKeys()...)
+	merged.AcceptedContentTypes = append([]string(nil), mw.AcceptedContentTypes()...)
+	merged.MutationsSupported = mw.MutationsSupported()
+	return mw, merged, nil
+}
diff --git a/proxy/internal/middleware/spec.go b/proxy/internal/middleware/spec.go
new file mode 100644
index 000000000..a154ceca2
--- /dev/null
+++ b/proxy/internal/middleware/spec.go
@@ -0,0 +1,44 @@
+package middleware
+
+import "time"
+
+// Spec is the apply-time, validated representation of a per-target
+// middleware configuration merged with the runtime-only fields
+// compiled into the middleware implementation.
+//
+// The wire shape is RawConfig (JSON bytes) instead of the older
+// params map[string]string. Each middleware unmarshals RawConfig into
+// its own typed config struct, surfacing structural validation errors
+// at construction rather than per-invocation lookups.
+type Spec struct {
+	ID        string
+	Slot      Slot
+	Version   string
+	Enabled   bool
+	FailMode  FailMode
+	Timeout   time.Duration
+	RawConfig []byte
+	CanMutate bool
+
+	// Runtime-only fields populated from the registered middleware at
+	// chain build time; not sourced from proto.
+	MetadataKeys         []string
+	AcceptedContentTypes []string
+	MutationsSupported   bool
+}
+
+// Clone returns a deep copy of the spec safe to cache across mapping
+// updates.
+func (s Spec) Clone() Spec {
+	out := s
+	if len(s.RawConfig) > 0 {
+		out.RawConfig = append([]byte(nil), s.RawConfig...)
+	}
+	if len(s.MetadataKeys) > 0 {
+		out.MetadataKeys = append([]string(nil), s.MetadataKeys...)
+	}
+	if len(s.AcceptedContentTypes) > 0 {
+		out.AcceptedContentTypes = append([]string(nil), s.AcceptedContentTypes...)
+	}
+	return out
+}
diff --git a/proxy/internal/middleware/types.go b/proxy/internal/middleware/types.go
new file mode 100644
index 000000000..1b49e6159
--- /dev/null
+++ b/proxy/internal/middleware/types.go
@@ -0,0 +1,253 @@
+// Package middleware defines the per-target middleware chain that runs
+// inside the reverse proxy hot path. It is the only chain wired into
+// the request path.
+//
+// Concepts:
+//   - Slot: the position a middleware occupies in the chain. A
+//     middleware lives in exactly one slot — separate concerns become
+//     separate middlewares.
+//   - Decision: the on_request slot can DENY; on_response and terminal
+//     slots can only PASSTHROUGH. The dispatcher clamps decisions that
+//     violate this contract.
+//   - Metadata: the only side-channel between middlewares. Each
+//     middleware declares an allowlist of keys it may emit; the merger
+//     enforces caps and namespace rules.
+package middleware
+
+import "time"
+
+// Slot identifies where in the request lifecycle a middleware runs.
+// A middleware declares a single slot. Splitting per-purpose work
+// (request parsing vs response parsing vs cost metering) into separate
+// slot-keyed middlewares is the explicit architectural choice for the
+// agent-network use case; no middleware participates in more than one
+// slot.
+type Slot int
+
+const (
+	// SlotOnRequest runs before the upstream call. Middlewares in this
+	// slot may DENY the request, mutate headers/body (when permitted),
+	// and emit metadata derived from the request envelope.
+	SlotOnRequest Slot = 1
+	// SlotOnResponse runs after the upstream returns. Middlewares in
+	// this slot observe the response, emit metadata, and may mutate
+	// response headers when permitted. They cannot DENY.
+	SlotOnResponse Slot = 2
+	// SlotTerminal runs after every SlotOnResponse middleware has
+	// emitted. Terminal middlewares observe the full metadata bag and
+	// ship it to external sinks (access log, metrics export). They
+	// cannot DENY and cannot mutate the response.
+	SlotTerminal Slot = 3
+)
+
+// FailMode controls how the dispatcher reacts when a middleware
+// returns an error, times out, or panics. Observer middlewares default
+// to FailOpen; policy middlewares should default to FailClosed.
+type FailMode int
+
+const (
+	// FailOpen allows the request to proceed when a middleware fails.
+	FailOpen FailMode = 0
+	// FailClosed denies the request when a middleware fails. Only
+	// meaningful for SlotOnRequest middlewares.
+	FailClosed FailMode = 1
+)
+
+// Decision captures the outcome of a middleware invocation as observed
+// by the dispatcher. Response-phase middlewares always return
+// DecisionPassthrough; the dispatcher clamps any other value.
+type Decision int
+
+const (
+	// DecisionAllow lets the request proceed.
+	DecisionAllow Decision = 0
+	// DecisionDeny stops the chain and returns a rendered deny
+	// response. Only honoured in SlotOnRequest.
+	DecisionDeny Decision = 1
+	// DecisionPassthrough is the response-phase neutral outcome.
+	DecisionPassthrough Decision = 2
+)
+
+// Resource limits enforced by the proxy at config apply time and by
+// the dispatcher at runtime. Per-target values supplied by management
+// are clamped to these bounds.
+const (
+	// MaxBodyCapBytes is the proxy-wide upper bound for per-direction
+	// body capture. Sized to hold a full LLM streaming response (token
+	// usage rides the trailing SSE event, so the captured prefix must
+	// reach the end of the stream); a single response is bounded by the
+	// model's max output tokens, so this is a real ceiling, not a
+	// treadmill. Request capture stays well under this — oversized
+	// requests use the tolerant routing scan instead of buffering.
+	MaxBodyCapBytes int64 = 8 << 20
+	// MinTimeout is the proxy-wide lower bound for per-middleware
+	// Invoke timeouts.
+	MinTimeout = 10 * time.Millisecond
+	// MaxTimeout is the proxy-wide upper bound for per-middleware
+	// Invoke timeouts.
+	MaxTimeout = 5 * time.Second
+	// DefaultTimeout is used when the per-target timeout is zero or
+	// unset.
+	DefaultTimeout = 500 * time.Millisecond
+
+	// MaxMiddlewareMetadataBytes is the per-middleware metadata total
+	// cap.
+	MaxMiddlewareMetadataBytes = 16 << 10
+	// MaxRequestMetadataBytes is the per-request metadata total cap
+	// across all middlewares in the chain. Earlier middlewares win
+	// when the budget is exhausted.
+	MaxRequestMetadataBytes = 32 << 10
+	// MaxMetadataKeyBytes is the maximum length of a metadata key.
+	MaxMetadataKeyBytes = 96
+	// MaxMetadataValueBytes is the maximum length of a metadata value.
+	MaxMetadataValueBytes = 4 << 10
+	// MaxMiddlewaresPerChain caps the number of middleware entries
+	// accepted per chain at the proxy translator and the management
+	// REST API. Mirrors the chain invocation cap so a misconfigured
+	// mapping cannot push the chain clone cost beyond a known bound.
+	MaxMiddlewaresPerChain = 16
+)
+
+// KV is the canonical header/metadata representation used across the
+// middleware boundary. We use a slice of KV instead of http.Header
+// because it preserves key order, is cheap to deep-copy per
+// invocation, and is directly representable in a future protobuf
+// envelope.
+type KV struct {
+	Key   string
+	Value string
+}
+
+// Input is the immutable envelope handed to each middleware. The
+// dispatcher deep-copies Headers, Body, Metadata, RespHeaders, and
+// RespBody before each invocation so middlewares cannot mutate the
+// shared in-flight copies; mutations must flow through Output.Mutations.
+type Input struct {
+	Slot             Slot
+	RequestID        string
+	TargetID         string
+	Method           string
+	URL              string
+	Headers          []KV
+	Body             []byte
+	BodyTruncated    bool
+	OriginalBodySize int64
+
+	Status            int
+	RespHeaders       []KV
+	RespBody          []byte
+	RespBodyTruncated bool
+	OriginalRespSize  int64
+
+	ServiceID string
+	AccountID string
+	UserID    string
+	// UserEmail is the calling user's email address when the auth path
+	// resolves a user record. Empty for non-OIDC schemes (PIN/Password/
+	// Header) and for legacy session JWTs minted before the email claim
+	// was introduced. Identity-stamping middlewares (e.g.
+	// llm_identity_inject) prefer this over UserID for upstream gateways
+	// that key budgets / attribution on a human-readable identifier.
+	UserEmail  string
+	AuthMethod string
+	SourceIP   string
+	// UserGroups captures the calling peer's group memberships at
+	// request time, surfaced from the proxy's auth flow so policy-aware
+	// middlewares can authorise without an extra management round-trip.
+	UserGroups []string
+	// UserGroupNames carries the human-readable display names paired
+	// positionally with UserGroups (UserGroupNames[i] is the name of
+	// UserGroups[i]). Identity-stamping middlewares prefer names for
+	// upstream tags so attribution dashboards stay readable. Slice may
+	// be shorter than UserGroups for tokens minted before names were
+	// resolvable; consumers should fall back to ids for missing
+	// positions.
+	UserGroupNames []string
+	Metadata       []KV
+
+	// AgentNetwork is true when the target is a synthesised
+	// agent-network service. Carried on the input so the access-log
+	// terminal middleware can stamp the proto field without re-deriving
+	// from the service ID.
+	AgentNetwork bool
+}
+
+// DenyReason is the structured payload a middleware returns alongside
+// a DecisionDeny. The proxy renders it through a fixed JSON template
+// so middlewares cannot emit arbitrary bytes to the wire.
+type DenyReason struct {
+	Code    string
+	Message string
+	Details map[string]string
+}
+
+// Output is the value each middleware returns to the dispatcher. The
+// dispatcher applies the output filter (clamp, mutations gate) before
+// any side effect reaches the shared request.
+type Output struct {
+	Decision   Decision
+	DenyStatus int
+	DenyReason *DenyReason
+	Metadata   []KV
+	Mutations  *Mutations
+}
+
+// Mutations describes the deltas a middleware wants applied to the
+// in-flight request. The dispatcher filters HeadersAdd/HeadersRemove
+// through the compiled-in denylist and runs BodyReplace through the
+// body policy before anything is applied. RewriteUpstream redirects
+// the outbound target (scheme + host) for the request; the chain
+// returns the latest non-nil rewrite to the reverse proxy.
+type Mutations struct {
+	HeadersAdd      []KV
+	HeadersRemove   []string
+	BodyReplace     []byte
+	RewriteUpstream *UpstreamRewrite
+}
+
+// UpstreamRewrite redirects the request's outbound target. Only
+// scheme+host are honoured; path, query, and body are untouched. The
+// reverse proxy reads the rewrite (when non-nil) instead of the
+// PathTarget URL configured by the synth, so a single shared synth
+// service can fan out to many upstreams selected per request.
+//
+// AuthHeader and StripHeaders carry the upstream auth substitution
+// the router needs. They bypass the framework's HeadersAdd /
+// HeadersRemove denylist (which blocks Authorization, Cookie, etc.
+// from middleware mutation) on the grounds that the proxy itself is
+// the entity rewriting auth here, not an arbitrary middleware. The
+// reverse proxy applies them directly to the upstream request after
+// the chain's regular mutation phase, so a malicious or misconfigured
+// middleware can still emit RewriteUpstream but only the proxy's
+// trusted upstream-build path actually unpacks AuthHeader.
+type UpstreamRewrite struct {
+	Scheme string
+	Host   string
+	// Path, when non-empty, replaces the path component of the
+	// proxy's effective upstream URL. The rewrite path is then joined
+	// with the agent's request path by httputil.ProxyRequest.SetURL —
+	// e.g. rewrite Path="/v1/{account}/{gateway}/compat" + agent
+	// request "/chat/completions" → outbound
+	// "/v1/{account}/{gateway}/compat/chat/completions". Used by
+	// llm_router to honor the operator-configured upstream path on
+	// gateways like Cloudflare AI Gateway whose URL contains
+	// account / gateway segments that the agent's app doesn't know
+	// about. Empty Path leaves the original target's path
+	// untouched (the historical behavior).
+	Path string
+	// StripPathPrefix, when non-empty, is removed from the front of the agent's
+	// request path before it is joined onto the upstream URL. Used for
+	// gateway-namespace prefixes (e.g. a client addressing Bedrock as
+	// "/bedrock/model/{id}/invoke") that must not reach the real upstream, whose
+	// native path is "/model/{id}/invoke". Empty leaves the request path intact.
+	StripPathPrefix string
+	AuthHeader      *AuthHeader
+	StripHeaders    []string
+}
+
+// AuthHeader is a single name/value pair the proxy injects on the
+// upstream request after stripping the client's auth headers.
+type AuthHeader struct {
+	Name  string
+	Value string
+}
diff --git a/proxy/internal/proxy/agent_network_chain_realstack_test.go b/proxy/internal/proxy/agent_network_chain_realstack_test.go
new file mode 100644
index 000000000..bc611fc98
--- /dev/null
+++ b/proxy/internal/proxy/agent_network_chain_realstack_test.go
@@ -0,0 +1,321 @@
+package proxy_test
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"runtime"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/test/bufconn"
+
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+	mgmtgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
+	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/bodytap"
+	mwbuiltin "github.com/netbirdio/netbird/proxy/internal/middleware/builtin"
+	// Side-effect imports register every builtin middleware factory.
+	_ "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/cost_meter"
+	_ "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_guardrail"
+	_ "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_identity_inject"
+	_ "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_limit_check"
+	_ "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_limit_record"
+	_ "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_request_parser"
+	_ "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_response_parser"
+	_ "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_router"
+	"github.com/netbirdio/netbird/proxy/internal/proxy"
+	nbproxytypes "github.com/netbirdio/netbird/proxy/internal/types"
+	"github.com/netbirdio/netbird/shared/management/proto"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// TestReverseProxy_AgentNetworkRequest_FullChain is the self-contained Go
+// replacement for the bash 50 + 51 legs. It drives a real agent-network
+// request through proxy.ReverseProxy.ServeHTTP with the actual middleware
+// chain the synthesizer produces, against an in-process management gRPC and a
+// httptest fake upstream — no tilt, no docker, no real LLM provider, no
+// WireGuard tunnel. The test guarantees:
+//
+//  1. The reverse proxy's response-leg input construction copies UserGroups
+//     onto respInput so llm_limit_record sends a non-empty group_ids field
+//     on RecordLLMUsage. This is the exact bug class that motivated the
+//     reverseproxy.go fix — its regression would land the request OK but
+//     leave consumption at zero, defeating any group-targeted budget rule.
+//  2. With settings.RedactPii=true the parsers ship redacted text on both
+//     llm.request_prompt_raw and llm.response_completion — proving the
+//     end-to-end wiring (synth → proto → spec → parser config) carries the
+//     toggle through to runtime emission.
+//  3. The full chain (request + response + recorder) runs against a real
+//     management stack and the consumption row for the bound group dim
+//     increments.
+//
+// If any of those three guarantees regresses, this single test fails.
+func TestReverseProxy_AgentNetworkRequest_FullChain(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("sqlite store not supported on Windows")
+	}
+
+	const (
+		testAccountID = "acct-fullchain-1"
+		testAdminUser = "user-admin-1"
+		adminGroupID  = "grp-admins"
+		providerID    = "prov-openai-test"
+		cluster       = "test.proxy.local"
+		subdomain     = "fullchain"
+	)
+	testLogger := log.New()
+	testLogger.SetLevel(log.PanicLevel) // keep test output clean
+
+	ctx := context.Background()
+
+	// ---- 1. Fake upstream that returns OpenAI-shaped JSON with PII in the
+	// completion. The reverse proxy's chain will redact this when the synth
+	// stamps redact_pii=true on the response parser config.
+	completion := "Sample record: Alice Johnson alice.johnson@example.com SSN 123-45-6789 phone (202) 555-0147 also Bob 202/555/0108"
+	upstreamBody := []byte(`{"id":"x","model":"gpt-5.4","choices":[{"message":{"role":"assistant","content":"` + completion + `"}}],"usage":{"prompt_tokens":12,"completion_tokens":40,"total_tokens":52}}`)
+	var upstreamHits atomic.Int64
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		upstreamHits.Add(1)
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write(upstreamBody)
+	}))
+	t.Cleanup(upstream.Close)
+	upstreamHost := strings.TrimPrefix(upstream.URL, "http://")
+
+	// ---- 2. In-process management gRPC server (bufconn) backed by a real
+	// sqlite store + real agentnetwork.Manager. The proxy's middlewares talk
+	// to this client.
+	st, cleanup, err := store.NewTestStoreFromSQL(ctx, "", t.TempDir())
+	require.NoError(t, err, "real sqlite test store must come up")
+	t.Cleanup(cleanup)
+
+	anMgr := agentnetwork.NewManager(st, nil, nil, nil)
+	server := &mgmtgrpc.ProxyServiceServer{}
+	server.SetAgentNetworkLimitsService(anMgr)
+
+	lis := bufconn.Listen(1024 * 1024)
+	srv := grpc.NewServer()
+	proto.RegisterProxyServiceServer(srv, server)
+	go func() { _ = srv.Serve(lis) }()
+	t.Cleanup(srv.Stop)
+
+	conn, err := grpc.NewClient("passthrough:///bufnet",
+		grpc.WithContextDialer(func(_ context.Context, _ string) (net.Conn, error) { return lis.Dial() }),
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+	)
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = conn.Close() })
+	mgmtClient := proto.NewProxyServiceClient(conn)
+
+	// ---- 3. Seed account state: settings (redact + capture on), provider
+	// whose upstream URL points at our fake server, policy (catch-all-allow
+	// over the Admins group → window=0 path), and a generous budget rule
+	// targeting Admins so the curl succeeds and we can prove the counter
+	// increments on the response leg.
+	require.NoError(t, st.SaveAgentNetworkSettings(ctx, &agentNetworkTypes.Settings{
+		AccountID:              testAccountID,
+		Cluster:                cluster,
+		Subdomain:              subdomain,
+		EnablePromptCollection: true,
+		EnableLogCollection:    true,
+		RedactPii:              true,
+	}))
+	require.NoError(t, st.SaveAgentNetworkProvider(ctx, &agentNetworkTypes.Provider{
+		ID:                providerID,
+		AccountID:         testAccountID,
+		ProviderID:        "openai_api",
+		Name:              "openai-fullchain-test",
+		UpstreamURL:       upstream.URL, // router rewrites to this
+		APIKey:            "sk-test",
+		Enabled:           true,
+		Models:            []agentNetworkTypes.ProviderModel{{ID: "gpt-5.4"}},
+		SessionPrivateKey: "priv",
+		SessionPublicKey:  "pub",
+	}))
+	require.NoError(t, st.SaveAgentNetworkPolicy(ctx, &agentNetworkTypes.Policy{
+		ID:                     "ainpol-fullchain",
+		AccountID:              testAccountID,
+		Name:                   "admins-openai",
+		Enabled:                true,
+		SourceGroups:           []string{adminGroupID},
+		DestinationProviderIDs: []string{providerID},
+		// No token / budget caps → effectiveWindowSeconds=0 → exercises the
+		// catch-all-allow path that the GC-2 record-on-window=0 fix targets.
+	}))
+	require.NoError(t, st.SaveAgentNetworkBudgetRule(ctx, &agentNetworkTypes.AccountBudgetRule{
+		ID:           "ainbud-admins-fullchain",
+		AccountID:    testAccountID,
+		Name:         "admins-monthly",
+		Enabled:      true,
+		TargetGroups: []string{adminGroupID},
+		Limits: agentNetworkTypes.PolicyLimits{
+			TokenLimit: agentNetworkTypes.PolicyTokenLimit{Enabled: true, GroupCap: 1_000_000, UserCap: 1_000_000, WindowSeconds: 60},
+		},
+	}))
+
+	// ---- 4. Synth the service. This produces the exact middleware chain
+	// configuration the production reconcile path ships to the proxy.
+	services, err := agentnetwork.SynthesizeServices(ctx, st, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1, "exactly one synth service expected")
+	synthSvc := services[0]
+	require.NotEmpty(t, synthSvc.Targets, "synth target must exist")
+
+	// ---- 5. Wire the middleware framework — same registry the proxy uses
+	// in production, configured with our bufconn-backed management client.
+	mwbuiltin.Configure(ctx, t.TempDir(), nil, testLogger, mgmtClient)
+	registry := mwbuiltin.DefaultRegistry()
+	mwMetrics, err := middleware.NewMetrics(nil)
+	require.NoError(t, err)
+	mwMgr := middleware.NewManager(0, mwMetrics, testLogger)
+	mwMgr.SetResolver(middleware.NewResolver(registry))
+
+	// Convert the synth's rpservice.MiddlewareConfig list into proxy
+	// middleware.Spec values. Mirrors the proto→Spec translation server.go
+	// does at runtime; kept inline here so the test isn't coupled to the
+	// proxy server's private translateMiddlewareConfig helper.
+	specs := make([]middleware.Spec, 0, len(synthSvc.Targets[0].Options.Middlewares))
+	for _, mw := range synthSvc.Targets[0].Options.Middlewares {
+		var slot middleware.Slot
+		switch mw.Slot {
+		case rpservice.MiddlewareSlotOnRequest:
+			slot = middleware.SlotOnRequest
+		case rpservice.MiddlewareSlotOnResponse:
+			slot = middleware.SlotOnResponse
+		case rpservice.MiddlewareSlotTerminal:
+			slot = middleware.SlotTerminal
+		default:
+			t.Fatalf("unknown middleware slot %q on %s", mw.Slot, mw.ID)
+		}
+		specs = append(specs, middleware.Spec{
+			ID:        mw.ID,
+			Slot:      slot,
+			Enabled:   mw.Enabled,
+			FailMode:  middleware.FailOpen,
+			Timeout:   middleware.DefaultTimeout,
+			RawConfig: append([]byte(nil), mw.ConfigJSON...),
+			CanMutate: mw.CanMutate,
+		})
+	}
+
+	serviceIDStr := synthSvc.ID
+	require.NoError(t, mwMgr.Rebuild(serviceIDStr, []middleware.PathTargetBinding{{
+		ServiceID: serviceIDStr,
+		PathID:    "/",
+		Specs:     specs,
+	}}))
+
+	// ---- 6. Build the reverse proxy, with a mapping whose target URL goes
+	// straight to the fake upstream (the router middleware rewriting upstream
+	// from the synth's noop placeholder isn't needed when we own the mapping
+	// in-process — point the target at the fake URL directly so the body
+	// arrives at the upstream the synth would have routed to).
+	upstreamURL, err := url.Parse(upstream.URL)
+	require.NoError(t, err)
+
+	rp := proxy.NewReverseProxy(http.DefaultTransport, "auto", nil, testLogger, proxy.WithMiddlewareManager(mwMgr))
+	rp.AddMapping(proxy.Mapping{
+		ID:        nbproxytypes.ServiceID(serviceIDStr),
+		AccountID: nbproxytypes.AccountID(testAccountID),
+		Host:      synthSvc.Domain,
+		Paths: map[string]*proxy.PathTarget{
+			"/": {
+				URL:            upstreamURL,
+				DirectUpstream: true,
+				AgentNetwork:   true,
+				Middlewares:    specs,
+				CaptureConfig: &bodytap.Config{
+					MaxRequestBytes:  1 << 20,
+					MaxResponseBytes: 1 << 20,
+					ContentTypes:     []string{"application/json", "text/event-stream"},
+				},
+			},
+		},
+	})
+
+	// ---- 7. Send a request with the auth-stamped CapturedData (mimicking
+	// what the tunnel-peer auth middleware does at the edge of the proxy).
+	reqBody := `{"model":"gpt-5.4","client_metadata":{"session_id":"sess-fullchain-1"},"messages":[{"role":"user","content":"contact alice.johnson@example.com SSN 987-65-4321 phone (202)555-0156"}]}`
+	req := httptest.NewRequest("POST", "https://"+synthSvc.Domain+"/v1/chat/completions", strings.NewReader(reqBody))
+	req.Host = synthSvc.Domain
+	req.Header.Set("Content-Type", "application/json")
+
+	cd := proxy.NewCapturedData("test-request-1")
+	cd.SetServiceID(nbproxytypes.ServiceID(serviceIDStr))
+	cd.SetAccountID(nbproxytypes.AccountID(testAccountID))
+	cd.SetUserID(testAdminUser)
+	cd.SetUserGroups([]string{adminGroupID})
+	cd.SetAuthMethod("tunnel_peer")
+	req = req.WithContext(proxy.WithCapturedData(req.Context(), cd))
+
+	w := httptest.NewRecorder()
+	rp.ServeHTTP(w, req)
+
+	require.Equal(t, http.StatusOK, w.Code, "upstream call must succeed end-to-end; body=%s", w.Body.String())
+	assert.GreaterOrEqual(t, upstreamHits.Load(), int64(1), "fake upstream must have been hit")
+
+	// ---- 8. Assertions — the three guarantees this test exists for.
+
+	// 8a. The reverseproxy.go respInput construction carried UserGroups
+	// into the response-leg middleware chain, so llm_limit_record sent a
+	// non-empty group_ids on RecordLLMUsage. Verifying via the management
+	// store directly bypasses the manager's permission gate (which is nil
+	// in this test) — we want to confirm the row landed, not who saw it.
+	require.Eventually(t, func() bool {
+		rows, lerr := st.ListAgentNetworkConsumption(ctx, store.LockingStrengthNone, testAccountID)
+		if lerr != nil {
+			return false
+		}
+		for _, r := range rows {
+			if r.DimensionKind == agentNetworkTypes.DimensionGroup &&
+				r.DimensionID == adminGroupID &&
+				r.WindowSeconds == 60 &&
+				r.TokensInput+r.TokensOutput > 0 {
+				return true
+			}
+		}
+		return false
+	}, 5*time.Second, 50*time.Millisecond,
+		"Admins group consumption row must increment via the response leg — if this fails the proxy's respInput dropped UserGroups again or the parser/recorder wiring is broken")
+
+	// 8b. Both the captured prompt and the captured completion are
+	// redacted — proves the synth threads redact_pii=true into BOTH parser
+	// configs and the parsers honour it at emission time.
+	md := cd.GetMetadata()
+	promptRaw := md["llm.request_prompt_raw"]
+	completionMeta := md["llm.response_completion"]
+
+	// 8a-bis. The session id from client_metadata.session_id flows through
+	// the request parser into the captured metadata, so the access-log /
+	// usage rows can group this request with the rest of its conversation.
+	assert.Equal(t, "sess-fullchain-1", md["llm.session_id"],
+		"session id must be extracted from client_metadata.session_id and carried through the chain")
+
+	assert.NotEmpty(t, promptRaw, "llm.request_prompt_raw must be present in captured metadata")
+	assert.Contains(t, promptRaw, "[REDACTED:", "captured raw prompt must carry redaction markers")
+	assert.NotContains(t, promptRaw, "alice.johnson@example.com", "raw email must NOT survive in prompt_raw")
+	assert.NotContains(t, promptRaw, "987-65-4321", "raw SSN must NOT survive in prompt_raw")
+	assert.NotContains(t, promptRaw, "(202)555-0156", "raw paren-no-space phone must NOT survive in prompt_raw")
+
+	assert.NotEmpty(t, completionMeta, "llm.response_completion must be present in captured metadata")
+	assert.Contains(t, completionMeta, "[REDACTED:", "captured completion must carry redaction markers")
+	assert.NotContains(t, completionMeta, "alice.johnson@example.com", "raw email must NOT survive in completion")
+	assert.NotContains(t, completionMeta, "123-45-6789", "raw SSN must NOT survive in completion")
+	assert.NotContains(t, completionMeta, "(202) 555-0147", "raw paren+space phone must NOT survive in completion")
+	assert.NotContains(t, completionMeta, "202/555/0108", "raw slash phone must NOT survive in completion")
+
+	_ = upstreamHost // kept for future header-inspection assertions if needed
+}
diff --git a/proxy/internal/proxy/context.go b/proxy/internal/proxy/context.go
index e05ec78aa..09bb9a8d1 100644
--- a/proxy/internal/proxy/context.go
+++ b/proxy/internal/proxy/context.go
@@ -58,9 +58,11 @@ type CapturedData struct {
 	// the JWT's group_names claim or from ValidateSession/Tunnel
 	// responses. Slice may be shorter than userGroups for tokens minted
 	// before names were resolvable.
-	userGroupNames []string
-	authMethod     string
-	metadata       map[string]string
+	userGroupNames    []string
+	authMethod        string
+	metadata          map[string]string
+	agentNetwork      bool
+	suppressAccessLog bool
 }
 
 // NewCapturedData creates a CapturedData with the given request ID.
@@ -178,6 +180,41 @@ func (c *CapturedData) SetUserGroups(groups []string) {
 	c.userGroups = append(c.userGroups[:0], groups...)
 }
 
+// SetAgentNetwork records whether the request hit a synthesised
+// agent-network target. The terminal access-log middleware stamps the
+// flag onto the proto so management can distinguish synthetic traffic.
+func (c *CapturedData) SetAgentNetwork(b bool) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.agentNetwork = b
+}
+
+// GetAgentNetwork reports whether the request matched a synthesised
+// agent-network target.
+func (c *CapturedData) GetAgentNetwork() bool {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	return c.agentNetwork
+}
+
+// SetSuppressAccessLog records whether the per-request access-log emission
+// must be skipped for this request. Stamped from the matched target's
+// DisableAccessLog flag so the access-log middleware can short-circuit
+// log delivery for opted-out agent-network targets.
+func (c *CapturedData) SetSuppressAccessLog(b bool) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.suppressAccessLog = b
+}
+
+// GetSuppressAccessLog reports whether access-log emission has been
+// suppressed for this request.
+func (c *CapturedData) GetSuppressAccessLog() bool {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	return c.suppressAccessLog
+}
+
 // GetUserGroups returns a copy of the authenticated user's group
 // memberships.
 func (c *CapturedData) GetUserGroups() []string {
diff --git a/proxy/internal/proxy/reverseproxy.go b/proxy/internal/proxy/reverseproxy.go
index da0bf6552..2c0304ecd 100644
--- a/proxy/internal/proxy/reverseproxy.go
+++ b/proxy/internal/proxy/reverseproxy.go
@@ -2,6 +2,7 @@ package proxy
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"net"
@@ -11,10 +12,13 @@ import (
 	"net/url"
 	"strings"
 	"sync"
+	"time"
 
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/proxy/auth"
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/bodytap"
 	"github.com/netbirdio/netbird/proxy/internal/roundtrip"
 	"github.com/netbirdio/netbird/proxy/internal/types"
 	"github.com/netbirdio/netbird/proxy/web"
@@ -32,6 +36,25 @@ type ReverseProxy struct {
 	mappingsMux    sync.RWMutex
 	mappings       map[string]Mapping
 	logger         *log.Logger
+	// middlewareManager, when non-nil, drives per-target middleware
+	// dispatch. A nil manager (or an empty chain for the resolved
+	// target) keeps the reverse-proxy hot path on the no-capture fast
+	// path with no middleware overhead.
+	middlewareManager *middleware.Manager
+}
+
+// Option configures optional ReverseProxy behavior. Options exist so the core
+// constructor signature stays stable across additive features.
+type Option func(*ReverseProxy)
+
+// WithMiddlewareManager attaches a middleware manager to the reverse
+// proxy. When the manager is nil or returns an empty chain for the
+// target, the request follows the fast path with no middleware
+// overhead.
+func WithMiddlewareManager(m *middleware.Manager) Option {
+	return func(p *ReverseProxy) {
+		p.middlewareManager = m
+	}
 }
 
 // NewReverseProxy configures a new NetBird ReverseProxy.
@@ -40,29 +63,28 @@ type ReverseProxy struct {
 // between requested URLs and targets.
 // The internal mappings can be modified using the AddMapping
 // and RemoveMapping functions.
-func NewReverseProxy(transport http.RoundTripper, forwardedProto string, trustedProxies []netip.Prefix, logger *log.Logger) *ReverseProxy {
+func NewReverseProxy(transport http.RoundTripper, forwardedProto string, trustedProxies []netip.Prefix, logger *log.Logger, opts ...Option) *ReverseProxy {
 	if logger == nil {
 		logger = log.StandardLogger()
 	}
-	return &ReverseProxy{
+	p := &ReverseProxy{
 		transport:      transport,
 		forwardedProto: forwardedProto,
 		trustedProxies: trustedProxies,
 		mappings:       make(map[string]Mapping),
 		logger:         logger,
 	}
+	for _, opt := range opts {
+		opt(p)
+	}
+	return p
 }
 
 func (p *ReverseProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	result, exists := p.findTargetForRequest(r)
 	if !exists {
-		if cd := CapturedDataFromContext(r.Context()); cd != nil {
-			cd.SetOrigin(OriginNoRoute)
-		}
-		requestID := getRequestID(r)
-		web.ServeErrorPage(w, r, http.StatusNotFound, "Service Not Found",
-			"The requested service could not be found. Please check the URL, try refreshing, or check if the peer is running. If that doesn't work, see our documentation for help.",
-			requestID, web.ErrorStatus{Proxy: true, Destination: false})
+		p.serveRouteError(w, r, http.StatusNotFound, "Service Not Found",
+			"The requested service could not be found. Please check the URL, try refreshing, or check if the peer is running. If that doesn't work, see our documentation for help.")
 		return
 	}
 
@@ -72,38 +94,23 @@ func (p *ReverseProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	// with 421 (Misdirected Request) so the caller sees an explicit
 	// error instead of silently doubling tunnel traffic.
 	if p.isSelfTargetLoop(r, result.target.URL) {
-		if cd := CapturedDataFromContext(r.Context()); cd != nil {
-			cd.SetOrigin(OriginNoRoute)
-		}
-		requestID := getRequestID(r)
-		web.ServeErrorPage(w, r, http.StatusMisdirectedRequest, "Loop Detected",
-			"This peer is the target of the requested service. Reach the backend directly instead of dialing the public service URL from the same machine.",
-			requestID, web.ErrorStatus{Proxy: true, Destination: false})
+		p.serveRouteError(w, r, http.StatusMisdirectedRequest, "Loop Detected",
+			"This peer is the target of the requested service. Reach the backend directly instead of dialing the public service URL from the same machine.")
 		return
 	}
 
-	ctx := r.Context()
-	// Set the account ID in the context for the roundtripper to use.
-	ctx = roundtrip.WithAccountID(ctx, result.accountID)
+	pt := result.target
+	ctx := p.buildTargetContext(r.Context(), result)
 
 	// Populate captured data if it exists (allows middleware to read after handler completes).
 	// This solves the problem of passing data UP the middleware chain: we put a mutable struct
 	// pointer in the context, and mutate the struct here so outer middleware can read it.
-	if capturedData := CapturedDataFromContext(ctx); capturedData != nil {
+	capturedData := CapturedDataFromContext(ctx)
+	if capturedData != nil {
 		capturedData.SetServiceID(result.serviceID)
 		capturedData.SetAccountID(result.accountID)
-	}
-
-	pt := result.target
-
-	if pt.SkipTLSVerify {
-		ctx = roundtrip.WithSkipTLSVerify(ctx)
-	}
-	if pt.RequestTimeout > 0 {
-		ctx = types.WithDialTimeout(ctx, pt.RequestTimeout)
-	}
-	if pt.DirectUpstream {
-		ctx = roundtrip.WithDirectUpstream(ctx)
+		capturedData.SetAgentNetwork(result.target != nil && result.target.AgentNetwork)
+		capturedData.SetSuppressAccessLog(result.target != nil && result.target.DisableAccessLog)
 	}
 
 	rewriteMatchedPath := result.matchedPath
@@ -111,6 +118,45 @@ func (p *ReverseProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		rewriteMatchedPath = ""
 	}
 
+	chain := p.resolveChain(result)
+	if chain == nil || chain.Empty() {
+		p.serveDirect(w, r, ctx, result, rewriteMatchedPath)
+		return
+	}
+	p.serveWithChain(w, r, ctx, result, chain, rewriteMatchedPath, capturedData)
+}
+
+// serveRouteError marks the request as un-routed on any captured-data
+// context and renders the proxy error page.
+func (p *ReverseProxy) serveRouteError(w http.ResponseWriter, r *http.Request, status int, title, message string) {
+	if cd := CapturedDataFromContext(r.Context()); cd != nil {
+		cd.SetOrigin(OriginNoRoute)
+	}
+	web.ServeErrorPage(w, r, status, title, message, getRequestID(r),
+		web.ErrorStatus{Proxy: true, Destination: false})
+}
+
+// buildTargetContext layers the per-target roundtrip flags (account id,
+// TLS-verify skip, direct upstream, dial timeout) onto the request context.
+func (p *ReverseProxy) buildTargetContext(ctx context.Context, result targetResult) context.Context {
+	pt := result.target
+	ctx = roundtrip.WithAccountID(ctx, result.accountID)
+	if pt.SkipTLSVerify {
+		ctx = roundtrip.WithSkipTLSVerify(ctx)
+	}
+	if pt.DirectUpstream {
+		ctx = roundtrip.WithDirectUpstream(ctx)
+	}
+	if pt.RequestTimeout > 0 {
+		ctx = types.WithDialTimeout(ctx, pt.RequestTimeout)
+	}
+	return ctx
+}
+
+// serveDirect forwards the request without a middleware chain — the common
+// path for plain reverse-proxy targets.
+func (p *ReverseProxy) serveDirect(w http.ResponseWriter, r *http.Request, ctx context.Context, result targetResult, rewriteMatchedPath string) {
+	pt := result.target
 	rp := &httputil.ReverseProxy{
 		Rewrite:       p.rewriteFunc(pt.URL, rewriteMatchedPath, result.passHostHeader, pt.PathRewrite, pt.CustomHeaders, result.stripAuthHeaders),
 		Transport:     p.transport,
@@ -123,6 +169,344 @@ func (p *ReverseProxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	rp.ServeHTTP(w, r.WithContext(ctx))
 }
 
+// serveWithChain runs the per-target middleware chain around the upstream
+// request: request-leg capture and authorisation, then (on allow) the
+// upstream forward with response/terminal observation deferred so it reads
+// the captured response before the writer is released.
+func (p *ReverseProxy) serveWithChain(w http.ResponseWriter, r *http.Request, ctx context.Context, result targetResult, chain *middleware.Chain, rewriteMatchedPath string, capturedData *CapturedData) {
+	middlewareIDs := chain.IDs()
+	p.logger.Debugf("middleware chain matched: service=%s path=%s middlewares=%v", result.serviceID, result.matchedPath, middlewareIDs)
+
+	capturedBody, truncated, originalSize, releaseBudget := p.captureRequestForChain(ctx, r, result, capturedData)
+	defer releaseBudget()
+
+	acc := middleware.NewAccumulator(middleware.MaxRequestMetadataBytes)
+	reqInput := buildRequestInput(r, result, capturedData, capturedBody, truncated, originalSize)
+
+	denyOutput, requestMeta, upstreamRewrite, _ := chain.RunRequest(ctx, r, reqInput, acc)
+	if capturedData != nil {
+		for _, kv := range requestMeta {
+			capturedData.SetMetadata(kv.Key, kv.Value)
+		}
+	}
+	if denyOutput != nil {
+		p.serveDeny(w, denyOutput, result, middlewareIDs)
+		return
+	}
+
+	respWriter, capturingWriter := p.newResponseWriter(ctx, w, result, capturedData)
+	if capturingWriter != nil {
+		defer capturingWriter.Release()
+		defer p.observeResponse(ctx, chain, acc, reqInput, requestMeta, capturingWriter, w, capturedData, result, middlewareIDs)
+	}
+
+	p.forwardUpstream(respWriter, r, ctx, result, rewriteMatchedPath, upstreamRewrite)
+}
+
+// captureRequestForChain copies the request body for inspection by the
+// chain, records any capture bypass, and applies agent-network routing
+// recovery for oversized bodies. The returned release frees the capture
+// budget and must be deferred by the caller.
+func (p *ReverseProxy) captureRequestForChain(ctx context.Context, r *http.Request, result targetResult, capturedData *CapturedData) ([]byte, bool, int64, func()) {
+	pt := result.target
+	capturedBody, truncated, originalSize, bypass, releaseBudget, captureErr := bodytap.CaptureRequest(r, pt.CaptureConfig, p.middlewareManager.Budget())
+	if captureErr != nil {
+		p.logger.Debugf("middleware request body capture error: %v", captureErr)
+	}
+	if bypass != "" {
+		if capturedData != nil {
+			capturedData.SetMetadata("mw.capture.bypass_reason", bypass)
+		}
+		p.middlewareManager.Metrics().IncCaptureBypass(ctx, string(result.serviceID), bypass)
+	}
+
+	// Routing recovery for oversized agent-network requests: when the body
+	// exceeded the capture cap (bypassed or truncated), the captured copy
+	// can't be parsed for the model, so llm_router would deny with
+	// model_not_routable. Scan the full stream for just the routing fields
+	// and hand the request parser a minimal stub so routing succeeds; the
+	// prompt stays uncaptured and the upstream still gets the full body.
+	if pt.AgentNetwork && (truncated || capturedBody == nil) {
+		if model, stream, ok := bodytap.ScanRoutingFields(r, bodytap.MaxRoutingScanBytes); ok {
+			capturedBody = buildRoutingStub(model, stream)
+			truncated = false
+			p.logger.Debugf("agent-network routing recovery: extracted model=%s stream=%t from oversized request body (service=%s)", model, stream, result.serviceID)
+		}
+	}
+	return capturedBody, truncated, originalSize, releaseBudget
+}
+
+// serveDeny renders the chain's deny response. Policy/budget/routing/guardrail
+// denials are expected runtime outcomes and can be high-volume under
+// misconfigured or hostile clients; per-request detail stays at Debug and
+// metrics/access logs carry the signal at scale.
+func (p *ReverseProxy) serveDeny(w http.ResponseWriter, denyOutput *middleware.Output, result targetResult, middlewareIDs []string) {
+	middlewareID := "middleware"
+	if denyOutput.DenyReason != nil && denyOutput.DenyReason.Code != "" {
+		middlewareID = denyOutput.DenyReason.Code
+	}
+	p.logger.Debugf("middleware chain denied request: service=%s path=%s middlewares=%v reason=%s status=%d",
+		result.serviceID, result.matchedPath, middlewareIDs, middlewareID, denyOutput.DenyStatus)
+	middleware.RenderDenyResponse(w, middlewareID, denyOutput.DenyReason, denyOutput.DenyStatus)
+}
+
+// newResponseWriter returns the writer the upstream forward should use. When
+// response capture is enabled and not bypassed it wraps w in a capturing
+// writer (also returned so the caller can release it and feed the response
+// leg); otherwise the capturing writer is nil and w is used directly.
+func (p *ReverseProxy) newResponseWriter(ctx context.Context, w http.ResponseWriter, result targetResult, capturedData *CapturedData) (http.ResponseWriter, *bodytap.CapturingResponseWriter) {
+	pt := result.target
+	if pt.CaptureConfig == nil || pt.CaptureConfig.MaxResponseBytes <= 0 {
+		return w, nil
+	}
+	capturingWriter := bodytap.NewCapturingResponseWriter(w, pt.CaptureConfig.MaxResponseBytes, p.middlewareManager.Budget())
+	if capturingWriter.Bypassed() {
+		if capturedData != nil {
+			capturedData.SetMetadata("mw.capture.bypass_reason", capturingWriter.BypassReason())
+		}
+		p.middlewareManager.Metrics().IncCaptureBypass(ctx, string(result.serviceID), capturingWriter.BypassReason())
+		capturingWriter.Release()
+		return w, nil
+	}
+	return capturingWriter, capturingWriter
+}
+
+// observeResponse runs the response and terminal middleware slots after the
+// body has been forwarded. It is deferred by serveWithChain so it reads the
+// captured response before the writer is released.
+func (p *ReverseProxy) observeResponse(ctx context.Context, chain *middleware.Chain, acc *middleware.Accumulator, reqInput *middleware.Input, requestMeta []middleware.KV, capturingWriter *bodytap.CapturingResponseWriter, w http.ResponseWriter, capturedData *CapturedData, result targetResult, middlewareIDs []string) {
+	respInput := &middleware.Input{
+		Slot:              middleware.SlotOnResponse,
+		RequestID:         reqInput.RequestID,
+		TargetID:          reqInput.TargetID,
+		Method:            reqInput.Method,
+		URL:               reqInput.URL,
+		Headers:           reqInput.Headers,
+		Status:            capturingWriter.Status(),
+		RespHeaders:       headerToKV(w.Header()),
+		RespBody:          capturingWriter.Body(),
+		RespBodyTruncated: capturingWriter.Truncated(),
+		OriginalRespSize:  capturingWriter.BytesWritten(),
+		ServiceID:         reqInput.ServiceID,
+		AccountID:         reqInput.AccountID,
+		UserID:            reqInput.UserID,
+		// UserEmail / UserGroups / UserGroupNames must flow into the
+		// response leg too — llm_limit_record needs UserGroups to send
+		// group_ids on RecordLLMUsage so management's account-budget
+		// fan-out can match group-targeted rules; identity-stamping and
+		// any future response-side authorisation also depend on these.
+		UserEmail:      reqInput.UserEmail,
+		UserGroups:     reqInput.UserGroups,
+		UserGroupNames: reqInput.UserGroupNames,
+		AuthMethod:     reqInput.AuthMethod,
+		SourceIP:       reqInput.SourceIP,
+		Metadata:       requestMeta,
+		AgentNetwork:   reqInput.AgentNetwork,
+	}
+	// The response/terminal phase runs after the body is forwarded, so
+	// a streaming client (e.g. Codex) has usually disconnected by now,
+	// cancelling r.Context(). These middlewares only observe and record
+	// (token/cost metering, usage recording) and must still complete —
+	// otherwise the dispatcher short-circuits each to fail-mode and the
+	// usage is silently lost. Detach from client cancellation, keep ctx
+	// values, and bound the work.
+	obsCtx, obsCancel := context.WithTimeout(context.WithoutCancel(ctx), observabilityPhaseTimeout)
+	defer obsCancel()
+
+	respMeta := chain.RunResponse(obsCtx, respInput, acc)
+	if capturedData != nil {
+		for _, kv := range respMeta {
+			capturedData.SetMetadata(kv.Key, kv.Value)
+		}
+	}
+
+	// Terminal slot sees the merged metadata bag from request and
+	// response phases.
+	mergedMeta := append(append([]middleware.KV(nil), requestMeta...), respMeta...)
+	termInput := *respInput
+	termInput.Slot = middleware.SlotTerminal
+	termInput.Metadata = mergedMeta
+	termMeta := chain.RunTerminal(obsCtx, &termInput, acc)
+	if capturedData != nil {
+		for _, kv := range termMeta {
+			capturedData.SetMetadata(kv.Key, kv.Value)
+		}
+	}
+
+	p.logger.Debugf("middleware chain ran: service=%s path=%s middlewares=%v status=%d req_meta=%d resp_meta=%d term_meta=%d",
+		result.serviceID, result.matchedPath, middlewareIDs, capturingWriter.Status(), len(requestMeta), len(respMeta), len(termMeta))
+}
+
+// forwardUpstream applies any middleware-emitted upstream rewrite and proxies
+// the request to the effective upstream URL.
+func (p *ReverseProxy) forwardUpstream(respWriter http.ResponseWriter, r *http.Request, ctx context.Context, result targetResult, rewriteMatchedPath string, upstreamRewrite *middleware.UpstreamRewrite) {
+	pt := result.target
+	effectiveURL := applyUpstreamRewrite(pt.URL, upstreamRewrite)
+	if upstreamRewrite != nil {
+		r.Host = effectiveURL.Host
+		applyUpstreamHeaders(r, upstreamRewrite)
+		stripUpstreamPathPrefix(r, upstreamRewrite.StripPathPrefix)
+	}
+
+	rp := &httputil.ReverseProxy{
+		Rewrite:       p.rewriteFunc(effectiveURL, rewriteMatchedPath, result.passHostHeader, pt.PathRewrite, pt.CustomHeaders, result.stripAuthHeaders),
+		Transport:     p.transport,
+		FlushInterval: -1,
+		ErrorHandler:  p.proxyErrorHandler,
+	}
+	if result.rewriteRedirects {
+		rp.ModifyResponse = p.rewriteLocationFunc(effectiveURL, rewriteMatchedPath, r) //nolint:bodyclose
+	}
+	rp.ServeHTTP(respWriter, r.WithContext(ctx))
+}
+
+// buildRoutingStub returns a minimal JSON request body carrying only the
+// model and stream fields. It feeds the LLM request parser when the real
+// body was too large to capture: the parser emits llm.model / llm.stream
+// so llm_router can route, while ExtractPrompt on the stub yields nothing
+// — no prompt is captured for oversized requests.
+func buildRoutingStub(model string, stream bool) []byte {
+	b, err := json.Marshal(map[string]any{"model": model, "stream": stream})
+	if err != nil {
+		return nil
+	}
+	return b
+}
+
+// applyUpstreamRewrite returns the effective upstream URL after
+// applying a middleware-emitted rewrite. When rewrite is nil or
+// incomplete, the original target is returned unchanged. The original
+// URL is never mutated; a clone is returned when a rewrite applies.
+//
+// Rewrite Path semantics: when non-empty, replaces the cloned URL's
+// path entirely. httputil.ProxyRequest.SetURL then joins target.Path
+// with the agent's request path, so an operator-configured upstream
+// path like "/v1/{account}/{gateway}/compat" gets prepended to
+// "/chat/completions" yielding the full Cloudflare-shaped path.
+// Empty rewrite.Path preserves the original target's path (the
+// historical, non-agent-network behavior).
+func applyUpstreamRewrite(orig *url.URL, rewrite *middleware.UpstreamRewrite) *url.URL {
+	if rewrite == nil || orig == nil {
+		return orig
+	}
+	if rewrite.Scheme == "" || rewrite.Host == "" {
+		return orig
+	}
+	cloned := *orig
+	cloned.Scheme = rewrite.Scheme
+	cloned.Host = rewrite.Host
+	if rewrite.Path != "" {
+		cloned.Path = rewrite.Path
+		cloned.RawPath = ""
+	}
+	return &cloned
+}
+
+// stripUpstreamPathPrefix removes a gateway-namespace prefix (e.g. "/bedrock")
+// from the request path before it is forwarded, so the upstream receives its
+// native path. The chain has already run by this point, so metering/logging
+// keep the original client path; only the outbound path is rewritten. RawPath
+// is cleared so the escaped form is recomputed from the trimmed Path.
+func stripUpstreamPathPrefix(r *http.Request, prefix string) {
+	if r == nil || r.URL == nil || prefix == "" {
+		return
+	}
+	if !strings.HasPrefix(r.URL.Path, prefix+"/") && r.URL.Path != prefix {
+		return
+	}
+	r.URL.Path = strings.TrimPrefix(r.URL.Path, prefix)
+	if r.URL.Path == "" {
+		r.URL.Path = "/"
+	}
+	r.URL.RawPath = ""
+}
+
+// applyUpstreamHeaders strips the headers the rewrite asks for and
+// injects the resolved auth header on the in-flight request. It is
+// the proxy-trusted counterpart to chain.applyMutations: regular
+// middleware HeadersAdd/HeadersRemove pass through the framework
+// denylist (which blocks Authorization, Cookie, etc.), but the
+// router middleware needs to replace Authorization on the upstream
+// request as a first-class operation. AuthHeader/StripHeaders ride
+// on UpstreamRewrite so only the proxy's upstream-build path
+// unpacks them — middlewares can't smuggle these in via the
+// regular mutation surface.
+func applyUpstreamHeaders(r *http.Request, rewrite *middleware.UpstreamRewrite) {
+	if r == nil || rewrite == nil {
+		return
+	}
+	for _, name := range rewrite.StripHeaders {
+		if name == "" {
+			continue
+		}
+		r.Header.Del(name)
+	}
+	if rewrite.AuthHeader != nil && rewrite.AuthHeader.Name != "" {
+		r.Header.Set(rewrite.AuthHeader.Name, rewrite.AuthHeader.Value)
+	}
+}
+
+// resolveChain returns the middleware chain registered for the
+// resolved target, or nil when middleware is disabled for the proxy
+// or the target.
+func (p *ReverseProxy) resolveChain(result targetResult) *middleware.Chain {
+	if p.middlewareManager == nil {
+		return nil
+	}
+	return p.middlewareManager.ChainFor(string(result.serviceID), result.matchedPath)
+}
+
+// buildRequestInput gathers the per-request fields the middleware
+// chain needs. Body and captured metadata are passed in; the rest are
+// copied from the request and CapturedData.
+func buildRequestInput(r *http.Request, result targetResult, cd *CapturedData, body []byte, truncated bool, originalSize int64) *middleware.Input {
+	in := &middleware.Input{
+		Slot:             middleware.SlotOnRequest,
+		TargetID:         result.matchedPath,
+		Method:           r.Method,
+		URL:              r.URL.String(),
+		Headers:          headerToKV(r.Header),
+		Body:             body,
+		BodyTruncated:    truncated,
+		OriginalBodySize: originalSize,
+		ServiceID:        string(result.serviceID),
+		AccountID:        string(result.accountID),
+		AgentNetwork:     result.target != nil && result.target.AgentNetwork,
+	}
+	if cd != nil {
+		in.RequestID = cd.GetRequestID()
+		in.UserID = cd.GetUserID()
+		in.UserEmail = cd.GetUserEmail()
+		in.UserGroups = cd.GetUserGroups()
+		in.UserGroupNames = cd.GetUserGroupNames()
+		in.AuthMethod = cd.GetAuthMethod()
+		if ip := cd.GetClientIP(); ip.IsValid() {
+			in.SourceIP = ip.String()
+		}
+	}
+	return in
+}
+
+// headerToKV flattens an http.Header into the KV slice shape expected
+// by the middleware envelope, preserving value order under the same
+// key.
+func headerToKV(h http.Header) []middleware.KV {
+	if len(h) == 0 {
+		return nil
+	}
+	total := 0
+	for _, v := range h {
+		total += len(v)
+	}
+	out := make([]middleware.KV, 0, total)
+	for k, vs := range h {
+		for _, v := range vs {
+			out = append(out, middleware.KV{Key: k, Value: v})
+		}
+	}
+	return out
+}
+
 // isSelfTargetLoop reports whether an overlay-origin request is about to
 // be forwarded back to the very peer that initiated it. The detection
 // is intentionally narrow: it only fires when the request arrived on
@@ -486,6 +870,14 @@ const (
 	// comma or any non-printable byte are dropped at stamp time so the
 	// list is unambiguously splittable by consumers.
 	headerNetBirdGroups = "X-NetBird-Groups"
+
+	// observabilityPhaseTimeout bounds the detached response/terminal
+	// metering phase. It runs after the client connection (and its context)
+	// may be gone, so it can't borrow the request deadline; this ceiling
+	// keeps a slow management round-trip (RecordLLMUsage) from pinning the
+	// handler goroutine indefinitely while still allowing each middleware
+	// its own per-invoke timeout.
+	observabilityPhaseTimeout = 30 * time.Second
 )
 
 // isHeaderValueSafe reports whether v is a valid RFC 7230 field-value:
diff --git a/proxy/internal/proxy/reverseproxy_test.go b/proxy/internal/proxy/reverseproxy_test.go
index a8244fa56..9bd427056 100644
--- a/proxy/internal/proxy/reverseproxy_test.go
+++ b/proxy/internal/proxy/reverseproxy_test.go
@@ -19,6 +19,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/proxy/auth"
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
 	"github.com/netbirdio/netbird/proxy/internal/roundtrip"
 	"github.com/netbirdio/netbird/proxy/internal/types"
 	"github.com/netbirdio/netbird/proxy/web"
@@ -1407,3 +1408,45 @@ func TestStampNetBirdIdentity_CapturedDataPresentButEmpty(t *testing.T) {
 	assert.Empty(t, pr.Out.Header.Get(headerNetBirdGroups),
 		"X-NetBird-Groups must be stripped when CapturedData has no groups")
 }
+
+// TestBuildRequestInput_PropagatesIdentityAndGroups locks the final wiring link
+// between auth and the middleware chain: CapturedData identity (user, groups,
+// auth method, client IP) and the target's AgentNetwork flag must land on the
+// middleware Input the chain runs against. If UserGroups stops flowing here,
+// llm_router denies every request with no_authorised_provider.
+func TestBuildRequestInput_PropagatesIdentityAndGroups(t *testing.T) {
+	cd := NewCapturedData("req-123")
+	cd.SetUserID("user-1")
+	cd.SetUserEmail("user@example.com")
+	cd.SetUserGroups([]string{"grp-admins", "grp-users"})
+	cd.SetUserGroupNames([]string{"Admins", "Users"})
+	cd.SetAuthMethod("oidc")
+	cd.SetClientIP(netip.MustParseAddr("100.90.1.14"))
+
+	r := httptest.NewRequest(http.MethodPost, "http://agent.example.com/v1/chat/completions", nil)
+	r.Header.Set("Content-Type", "application/json")
+
+	result := targetResult{
+		target:      &PathTarget{AgentNetwork: true},
+		matchedPath: "/",
+		serviceID:   types.ServiceID("svc-1"),
+		accountID:   types.AccountID("acct-1"),
+	}
+
+	body := []byte(`{"model":"gpt-5.4"}`)
+	in := buildRequestInput(r, result, cd, body, false, int64(len(body)))
+
+	require.NotNil(t, in, "buildRequestInput must return an envelope")
+	assert.Equal(t, middleware.SlotOnRequest, in.Slot, "request input runs in the on-request slot")
+	assert.Equal(t, "svc-1", in.ServiceID, "service id must propagate")
+	assert.Equal(t, "acct-1", in.AccountID, "account id must propagate")
+	assert.Equal(t, "user-1", in.UserID, "user id must propagate")
+	assert.Equal(t, "user@example.com", in.UserEmail, "user email must propagate")
+	assert.Equal(t, []string{"grp-admins", "grp-users"}, in.UserGroups,
+		"CapturedData groups MUST reach the middleware Input — llm_router authorises against this")
+	assert.Equal(t, []string{"Admins", "Users"}, in.UserGroupNames, "group names must propagate")
+	assert.Equal(t, "oidc", in.AuthMethod, "auth method must propagate")
+	assert.Equal(t, "100.90.1.14", in.SourceIP, "client IP must propagate")
+	assert.True(t, in.AgentNetwork, "agent-network target flag must reach the Input")
+	assert.Equal(t, body, in.Body, "captured body must reach the Input")
+}
diff --git a/proxy/internal/proxy/servicemapping.go b/proxy/internal/proxy/servicemapping.go
index 46b4d2e8d..64fccc42a 100644
--- a/proxy/internal/proxy/servicemapping.go
+++ b/proxy/internal/proxy/servicemapping.go
@@ -8,6 +8,8 @@ import (
 	"strings"
 	"time"
 
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/bodytap"
 	"github.com/netbirdio/netbird/proxy/internal/types"
 )
 
@@ -32,6 +34,20 @@ type PathTarget struct {
 	// over the embedded NetBird WireGuard client when forwarding requests
 	// to this target. Default false → embedded client (existing behaviour).
 	DirectUpstream bool
+	// Middlewares is the validated per-target middleware chain. Nil or empty
+	// for non-agent-network targets, keeping them on the no-middleware fast path.
+	Middlewares []middleware.Spec
+	// CaptureConfig holds the per-target body-capture limits used by the
+	// middleware chain. Nil for targets without body-inspecting middlewares.
+	CaptureConfig *bodytap.Config
+	// AgentNetwork marks this target as a synthesised agent-network target so
+	// the proxy can tag access-log entries and gate agent-network behaviour.
+	AgentNetwork bool
+	// DisableAccessLog suppresses the per-request access-log emission for this
+	// target. Defaults false so non-agent-network targets continue to log
+	// unchanged. The agent-network synthesizer sets this true only when the
+	// account's EnableLogCollection toggle is off.
+	DisableAccessLog bool
 }
 
 // Mapping describes how a domain is routed by the HTTP reverse proxy.
diff --git a/proxy/internal/proxy/strip_prefix_test.go b/proxy/internal/proxy/strip_prefix_test.go
new file mode 100644
index 000000000..4ff364f6a
--- /dev/null
+++ b/proxy/internal/proxy/strip_prefix_test.go
@@ -0,0 +1,30 @@
+package proxy
+
+import (
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestStripUpstreamPathPrefix(t *testing.T) {
+	cases := []struct {
+		name   string
+		path   string
+		prefix string
+		want   string
+	}{
+		{"strips matching namespace prefix", "/bedrock/model/x/invoke", "/bedrock", "/model/x/invoke"},
+		{"no-op when prefix absent", "/model/x/invoke", "/bedrock", "/model/x/invoke"},
+		{"no-op on empty prefix", "/bedrock/model/x/invoke", "", "/bedrock/model/x/invoke"},
+		{"no-op on non-segment match", "/bedrockfoo/model/x", "/bedrock", "/bedrockfoo/model/x"},
+		{"bare prefix collapses to root", "/bedrock", "/bedrock", "/"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			r := httptest.NewRequest("POST", tc.path, nil)
+			stripUpstreamPathPrefix(r, tc.prefix)
+			assert.Equal(t, tc.want, r.URL.Path, "stripped path for %q", tc.path)
+		})
+	}
+}
diff --git a/proxy/internal/roundtrip/netbird.go b/proxy/internal/roundtrip/netbird.go
index 13d386da2..cb2e7f930 100644
--- a/proxy/internal/roundtrip/netbird.go
+++ b/proxy/internal/roundtrip/netbird.go
@@ -8,6 +8,8 @@ import (
 	"net"
 	"net/http"
 	"net/netip"
+	"os"
+	"strings"
 	"sync"
 	"time"
 
@@ -347,8 +349,20 @@ func (n *NetBird) createClientEntry(ctx context.Context, accountID types.Account
 		"public_key": publicKey.String(),
 	}).Info("proxy peer authenticated successfully with management")
 
+	// Embedded client log level: warn by default (quiet in production); set
+	// NB_PROXY_CLIENT_LOG_LEVEL (e.g. "trace") to surface the embedded NetBird
+	// client's relay / signal / handshake detail for local debugging.
+	clientLogLevel := log.WarnLevel.String()
+	if v := strings.TrimSpace(os.Getenv("NB_PROXY_CLIENT_LOG_LEVEL")); v != "" {
+		if lvl, err := log.ParseLevel(v); err == nil {
+			clientLogLevel = lvl.String()
+		} else {
+			n.logger.Warnf("invalid NB_PROXY_CLIENT_LOG_LEVEL %q, using %q: %v", v, clientLogLevel, err)
+		}
+	}
+
 	n.initLogOnce.Do(func() {
-		if err := util.InitLog(log.WarnLevel.String(), util.LogConsole); err != nil {
+		if err := util.InitLog(clientLogLevel, util.LogConsole); err != nil {
 			n.logger.WithField("account_id", accountID).Warnf("failed to initialize embedded client logging: %v", err)
 		}
 	})
@@ -356,11 +370,11 @@ func (n *NetBird) createClientEntry(ctx context.Context, accountID types.Account
 	// Create embedded NetBird client with the generated private key.
 	// The peer has already been created via CreateProxyPeer RPC with the public key.
 	wgPort := int(n.clientCfg.WGPort)
-	client, err := embed.New(embed.Options{
+	embedOpts := embed.Options{
 		DeviceName:    deviceNamePrefix + n.proxyID,
 		ManagementURL: n.clientCfg.MgmtAddr,
 		PrivateKey:    privateKey.String(),
-		LogLevel:      log.WarnLevel.String(),
+		LogLevel:      clientLogLevel,
 		BlockInbound:  n.clientCfg.BlockInbound,
 		// The embedded proxy peer must never be a stepping stone into
 		// the proxy host's LAN: it only exists to reach NetBird mesh
@@ -371,7 +385,9 @@ func (n *NetBird) createClientEntry(ctx context.Context, accountID types.Account
 		WireguardPort:  &wgPort,
 		PreSharedKey:   n.clientCfg.PreSharedKey,
 		Performance:    n.clientCfg.Performance,
-	})
+	}
+	logEmbedOptions(n.logger, accountID, serviceID, publicKey.String(), embedOpts)
+	client, err := embed.New(embedOpts)
 	if err != nil {
 		return nil, fmt.Errorf("create netbird client: %w", err)
 	}
@@ -847,3 +863,53 @@ func DirectUpstreamFromContext(ctx context.Context) bool {
 	v, _ := ctx.Value(directUpstreamContextKey{}).(bool)
 	return v
 }
+
+// logEmbedOptions emits a single structured INFO line summarising every
+// operationally meaningful flag handed to embed.New for this per-account
+// client. Secrets (PrivateKey, PreSharedKey) are reduced to a "present"
+// boolean — never logged verbatim. Use this when an embedded peer
+// silently misbehaves: most failure modes (inbound drops, wrong
+// management URL, v6 unexpectedly on, userspace flipped, port clash)
+// are obvious from these flags before any traffic flows.
+func logEmbedOptions(logger *log.Logger, accountID types.AccountID, serviceID types.ServiceID, publicKey string, opts embed.Options) {
+	wgPort := 0
+	if opts.WireguardPort != nil {
+		wgPort = *opts.WireguardPort
+	}
+	mtu := uint16(0)
+	if opts.MTU != nil {
+		mtu = *opts.MTU
+	}
+	perfBuffers := uint32(0)
+	if opts.Performance.PreallocatedBuffersPerPool != nil {
+		perfBuffers = *opts.Performance.PreallocatedBuffersPerPool
+	}
+	perfBatch := uint32(0)
+	if opts.Performance.MaxBatchSize != nil {
+		perfBatch = *opts.Performance.MaxBatchSize
+	}
+	logger.WithFields(log.Fields{
+		"account_id":            accountID,
+		"service_id":            serviceID,
+		"public_key":            publicKey,
+		"device_name":           opts.DeviceName,
+		"management_url":        opts.ManagementURL,
+		"log_level":             opts.LogLevel,
+		"wg_port":               wgPort,
+		"mtu":                   mtu,
+		"block_inbound":         opts.BlockInbound,
+		"block_lan_access":      opts.BlockLANAccess,
+		"disable_ipv6":          opts.DisableIPv6,
+		"disable_client_routes": opts.DisableClientRoutes,
+		"no_userspace":          opts.NoUserspace,
+		"config_path_set":       opts.ConfigPath != "",
+		"state_path_set":        opts.StatePath != "",
+		"private_key_present":   opts.PrivateKey != "",
+		"presharedkey_present":  opts.PreSharedKey != "",
+		"setup_key_present":     opts.SetupKey != "",
+		"jwt_token_present":     opts.JWTToken != "",
+		"dns_labels":            opts.DNSLabels,
+		"perf_buffers_per_pool": perfBuffers,
+		"perf_max_batch_size":   perfBatch,
+	}).Info("starting embedded netbird client for account")
+}
diff --git a/proxy/internal/tcp/accept.go b/proxy/internal/tcp/accept.go
new file mode 100644
index 000000000..a63560a9e
--- /dev/null
+++ b/proxy/internal/tcp/accept.go
@@ -0,0 +1,85 @@
+package tcp
+
+import (
+	"context"
+	"errors"
+	"net"
+	"strings"
+	"time"
+)
+
+// gvisorInvalidEndpointMsg is the canonical text gVisor netstack returns
+// when Accept() is called on a listener whose underlying endpoint has
+// been destroyed (peer rekey, embedded-client reset, account churn).
+// There is no exported sentinel from gvisor.dev/gvisor/pkg/tcpip that
+// survives gonet's *net.OpError wrapping in a way errors.Is can match,
+// so we fall back to a string check. Stable across the gVisor versions
+// netbird pins.
+const gvisorInvalidEndpointMsg = "endpoint is in invalid state"
+
+// IsClosedListenerErr reports whether err signals that an accept loop
+// should exit because the underlying listener can no longer serve
+// connections. It recognises:
+//
+//   - net.ErrClosed for stdlib listeners (Listener.Close was called).
+//   - gVisor's "endpoint is in invalid state" for netstack-backed
+//     listeners whose endpoint was destroyed out from under them
+//     (typically when a per-account WireGuard netstack is reset without
+//     also tearing the listener entry down).
+//
+// Without the gVisor branch an accept loop on a netstack listener spins
+// CPU-hot forever after the endpoint dies, because Accept never blocks
+// again and the error neither matches net.ErrClosed nor cancels ctx.
+func IsClosedListenerErr(err error) bool {
+	if err == nil {
+		return false
+	}
+	if errors.Is(err, net.ErrClosed) {
+		return true
+	}
+	return strings.Contains(err.Error(), gvisorInvalidEndpointMsg)
+}
+
+// AcceptBackoff implements the exponential backoff used by
+// net/http.Server.Serve for transient Accept errors. Without it a loop
+// hitting a sticky unknown error burns a full CPU core. The zero value
+// is ready to use; call Reset after a successful Accept.
+type AcceptBackoff struct {
+	delay time.Duration
+}
+
+// minAcceptDelay / maxAcceptDelay mirror the stdlib defaults
+// (net/http.Server.Serve) and keep us well below 1 log line per second
+// per orphaned listener.
+const (
+	minAcceptDelay = 5 * time.Millisecond
+	maxAcceptDelay = time.Second
+)
+
+// Backoff waits the next exponential delay (5ms doubling up to 1s) and
+// returns true when the wait completed. Returns false if ctx fired
+// during the wait — callers should treat that as "exit the loop".
+func (b *AcceptBackoff) Backoff(ctx context.Context) bool {
+	b.advance()
+	select {
+	case <-ctx.Done():
+		return false
+	case <-time.After(b.delay):
+		return true
+	}
+}
+
+// Reset clears the accumulated delay so the next failure starts at the
+// minimum delay again. Call after a successful Accept.
+func (b *AcceptBackoff) Reset() { b.delay = 0 }
+
+func (b *AcceptBackoff) advance() {
+	if b.delay == 0 {
+		b.delay = minAcceptDelay
+	} else {
+		b.delay *= 2
+	}
+	if b.delay > maxAcceptDelay {
+		b.delay = maxAcceptDelay
+	}
+}
diff --git a/proxy/internal/tcp/accept_test.go b/proxy/internal/tcp/accept_test.go
new file mode 100644
index 000000000..b2824d38a
--- /dev/null
+++ b/proxy/internal/tcp/accept_test.go
@@ -0,0 +1,142 @@
+package tcp
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestIsClosedListenerErr_NetErrClosed verifies the stdlib path: a
+// closed *net.Listener returns net.ErrClosed wrapped in *net.OpError,
+// and IsClosedListenerErr must unwrap it.
+func TestIsClosedListenerErr_NetErrClosed(t *testing.T) {
+	wrapped := &net.OpError{Op: "accept", Net: "tcp", Err: net.ErrClosed}
+	assert.True(t, IsClosedListenerErr(wrapped),
+		"net.OpError wrapping net.ErrClosed must be recognised as closed")
+}
+
+// TestIsClosedListenerErr_GVisorInvalidEndpoint is the load-bearing
+// regression guard. A gVisor netstack listener whose endpoint has been
+// destroyed returns this exact text. Without recognising it the accept
+// loop spins forever and burns a CPU core.
+func TestIsClosedListenerErr_GVisorInvalidEndpoint(t *testing.T) {
+	err := fmt.Errorf("accept tcp 10.10.1.254:80: endpoint is in invalid state")
+	assert.True(t, IsClosedListenerErr(err),
+		"gVisor 'endpoint is in invalid state' must be recognised as closed")
+}
+
+// TestIsClosedListenerErr_OtherError confirms we don't over-match —
+// transient errors must keep returning false so the backoff path runs.
+func TestIsClosedListenerErr_OtherError(t *testing.T) {
+	cases := []error{
+		errors.New("temporary failure"),
+		errors.New("accept tcp 10.10.1.254:80: too many open files"),
+		nil,
+	}
+	for _, c := range cases {
+		assert.False(t, IsClosedListenerErr(c),
+			"unexpected match on %v — must not be treated as closed", c)
+	}
+}
+
+// TestAcceptBackoff_ProgressionAndCap asserts the doubling schedule:
+// 5ms, 10ms, 20ms, 40ms, ... capped at 1s. The test runs against a
+// real timer but uses tight bounds so a slow CI machine still passes.
+func TestAcceptBackoff_ProgressionAndCap(t *testing.T) {
+	var b AcceptBackoff
+	expected := []time.Duration{
+		5 * time.Millisecond,
+		10 * time.Millisecond,
+		20 * time.Millisecond,
+		40 * time.Millisecond,
+	}
+	for i, want := range expected {
+		start := time.Now()
+		ok := b.Backoff(context.Background())
+		elapsed := time.Since(start)
+		require.True(t, ok, "Backoff %d must complete; ctx is alive", i)
+		assert.GreaterOrEqual(t, elapsed, want,
+			"backoff %d (%v) must wait at least the configured delay", i, want)
+		assert.Less(t, elapsed, want*4,
+			"backoff %d (%v) must not overshoot by more than 4x — caps misbehaving", i, want)
+	}
+
+	// Burn enough rounds to reach the cap, then assert subsequent
+	// rounds stay at exactly maxAcceptDelay (1s) — the timer should
+	// never exceed it.
+	for range 6 {
+		b.Backoff(context.Background())
+	}
+	assert.Equal(t, maxAcceptDelay, b.delay,
+		"after enough doublings the delay must clamp to maxAcceptDelay")
+}
+
+// TestAcceptBackoff_Reset confirms that a successful Accept resets the
+// schedule — a busy-then-quiet listener mustn't stay on a 1s timer
+// after recovery.
+func TestAcceptBackoff_Reset(t *testing.T) {
+	var b AcceptBackoff
+	for range 5 {
+		b.Backoff(context.Background())
+	}
+	require.NotEqual(t, time.Duration(0), b.delay, "precondition: delay must have accumulated")
+
+	b.Reset()
+	assert.Equal(t, time.Duration(0), b.delay, "Reset must zero the delay")
+
+	start := time.Now()
+	ok := b.Backoff(context.Background())
+	elapsed := time.Since(start)
+	require.True(t, ok, "Backoff after Reset must complete")
+	assert.GreaterOrEqual(t, elapsed, minAcceptDelay,
+		"after Reset the next backoff must restart at minAcceptDelay")
+	assert.Less(t, elapsed, 50*time.Millisecond,
+		"after Reset the next backoff must NOT carry over the prior delay")
+}
+
+// TestAcceptBackoff_CancelDuringWait proves the loop exits promptly
+// when ctx fires mid-wait. Without this, a tear-down would still take
+// up to 1 second per orphaned listener.
+func TestAcceptBackoff_CancelDuringWait(t *testing.T) {
+	var b AcceptBackoff
+	// Drive the backoff up so the next call will wait ~1s — long
+	// enough that we can detect early cancellation.
+	for range 10 {
+		b.Backoff(context.Background())
+	}
+	require.Equal(t, maxAcceptDelay, b.delay)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	go func() {
+		time.Sleep(20 * time.Millisecond)
+		cancel()
+	}()
+
+	start := time.Now()
+	ok := b.Backoff(ctx)
+	elapsed := time.Since(start)
+	assert.False(t, ok, "Backoff must return false when ctx is cancelled mid-wait")
+	assert.Less(t, elapsed, 200*time.Millisecond,
+		"cancellation must short-circuit the timer; took %v", elapsed)
+}
+
+// TestAcceptBackoff_CancelBeforeCall — when ctx is already done the
+// loop exits without sleeping at all.
+func TestAcceptBackoff_CancelBeforeCall(t *testing.T) {
+	var b AcceptBackoff
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	start := time.Now()
+	ok := b.Backoff(ctx)
+	elapsed := time.Since(start)
+	assert.False(t, ok, "Backoff must return false when ctx is already cancelled")
+	assert.Less(t, elapsed, 50*time.Millisecond,
+		"already-cancelled ctx must return immediately; took %v", elapsed)
+}
diff --git a/proxy/internal/tcp/router.go b/proxy/internal/tcp/router.go
index 15c5022b0..307f2b4f3 100644
--- a/proxy/internal/tcp/router.go
+++ b/proxy/internal/tcp/router.go
@@ -297,18 +297,29 @@ func (r *Router) Serve(ctx context.Context, ln net.Listener) error {
 		}
 	}()
 
+	var backoff AcceptBackoff
 	for {
 		conn, err := ln.Accept()
 		if err != nil {
-			if ctx.Err() != nil || errors.Is(err, net.ErrClosed) {
+			if ctx.Err() != nil || IsClosedListenerErr(err) {
+				if ok := r.Drain(DefaultDrainTimeout); !ok {
+					r.logger.Warn("timed out waiting for connections to drain")
+				}
+				return nil
+			}
+			r.logger.Debugf("SNI router accept: %v; backing off", err)
+			if !backoff.Backoff(ctx) {
+				// Cancelled during backoff: still drain in-flight
+				// connections/relays before returning, matching the
+				// shutdown path above.
 				if ok := r.Drain(DefaultDrainTimeout); !ok {
 					r.logger.Warn("timed out waiting for connections to drain")
 				}
 				return nil
 			}
-			r.logger.Debugf("SNI router accept: %v", err)
 			continue
 		}
+		backoff.Reset()
 		r.logger.Debugf("SNI router accepted conn from %s on %s", conn.RemoteAddr(), conn.LocalAddr())
 		r.activeConns.Add(1)
 		go func() {
diff --git a/proxy/internal/tcp/router_test.go b/proxy/internal/tcp/router_test.go
index ea1b418f5..8be617dff 100644
--- a/proxy/internal/tcp/router_test.go
+++ b/proxy/internal/tcp/router_test.go
@@ -1836,3 +1836,132 @@ func TestRouter_TLS_StaysOnTLSChannel_WhenPlainEnabled(t *testing.T) {
 		t.Fatal("TLS conn never reached the TLS channel")
 	}
 }
+
+// scriptedAcceptListener is a net.Listener whose Accept() returns
+// pre-scripted errors. Used by the accept-loop exit tests to simulate
+// the failure mode that triggers the tight-loop bug: a netstack
+// listener whose endpoint has been destroyed and now returns the gVisor
+// "endpoint is in invalid state" error from every Accept call.
+type scriptedAcceptListener struct {
+	errs   chan error
+	closed chan struct{}
+}
+
+func newScriptedAcceptListener(errs ...error) *scriptedAcceptListener {
+	s := &scriptedAcceptListener{
+		errs:   make(chan error, len(errs)+1),
+		closed: make(chan struct{}),
+	}
+	for _, e := range errs {
+		s.errs <- e
+	}
+	return s
+}
+
+func (s *scriptedAcceptListener) Accept() (net.Conn, error) {
+	select {
+	case <-s.closed:
+		return nil, net.ErrClosed
+	case err := <-s.errs:
+		return nil, err
+	}
+}
+
+func (s *scriptedAcceptListener) Close() error {
+	select {
+	case <-s.closed:
+	default:
+		close(s.closed)
+	}
+	return nil
+}
+
+func (s *scriptedAcceptListener) Addr() net.Addr {
+	return &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 0}
+}
+
+// TestRouter_Serve_ExitsOnGVisorInvalidEndpoint is the regression guard
+// for the tight-loop bug: when the underlying netstack endpoint is
+// destroyed, Accept returns "endpoint is in invalid state" forever. The
+// loop must recognise that signal and return, otherwise it pegs a CPU
+// core and floods logs.
+func TestRouter_Serve_ExitsOnGVisorInvalidEndpoint(t *testing.T) {
+	logger := log.StandardLogger()
+	addr := &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 443}
+	router := NewRouter(logger, nil, addr)
+
+	gvisorErr := &net.OpError{
+		Op:   "accept",
+		Net:  "tcp",
+		Addr: addr,
+		Err:  errSentinel("endpoint is in invalid state"),
+	}
+	ln := newScriptedAcceptListener(gvisorErr)
+	defer ln.Close()
+
+	done := make(chan error, 1)
+	go func() {
+		done <- router.Serve(context.Background(), ln)
+	}()
+
+	select {
+	case err := <-done:
+		assert.NoError(t, err, "Serve must return cleanly on a recognised closed-listener error")
+	case <-time.After(2 * time.Second):
+		t.Fatal("Serve did not exit on gVisor 'endpoint is in invalid state' — accept loop is spinning")
+	}
+}
+
+// TestRouter_Serve_BacksOffOnTransientError verifies the defence-in-
+// depth path: when Accept returns an unknown transient error, the loop
+// MUST not spin. It backs off, then exits cleanly once ctx is cancelled.
+// "Bounded call count" stands in for "no CPU spin" — without backoff
+// the goroutine would issue thousands of Accept calls in this window.
+func TestRouter_Serve_BacksOffOnTransientError(t *testing.T) {
+	logger := log.StandardLogger()
+	addr := &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 443}
+	router := NewRouter(logger, nil, addr)
+
+	const transientErrCount = 5
+	errs := make([]error, transientErrCount)
+	for i := range errs {
+		errs[i] = errSentinel("transient: too many open files")
+	}
+	ln := newScriptedAcceptListener(errs...)
+	defer ln.Close()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan error, 1)
+	start := time.Now()
+	go func() {
+		done <- router.Serve(ctx, ln)
+	}()
+
+	// Cancel after enough time for the backoff to climb (5ms + 10ms +
+	// 20ms + 40ms = 75ms minimum), but short enough that a spinning
+	// loop would have made thousands of calls by now.
+	time.AfterFunc(150*time.Millisecond, cancel)
+
+	select {
+	case err := <-done:
+		assert.NoError(t, err, "Serve must return cleanly on ctx cancellation")
+	case <-time.After(2 * time.Second):
+		t.Fatal("Serve did not exit on ctx cancellation — backoff or exit path broken")
+	}
+
+	// Without backoff the loop would burn through all 5 scripted errors
+	// in microseconds and then block on the channel. With backoff the
+	// total wall time should be at least 5ms (the first backoff).
+	elapsed := time.Since(start)
+	assert.GreaterOrEqual(t, elapsed, minAcceptDelay,
+		"loop ran without backing off — would burn CPU in production")
+}
+
+// errSentinel mirrors gVisor's tcpip error message exactly. We can't
+// import the gVisor package without dragging in the whole netstack, so
+// the test uses the canonical string the production error formatter
+// emits — same shape IsClosedListenerErr matches in production.
+type errSentinel string
+
+func (e errSentinel) Error() string { return string(e) }
+
diff --git a/proxy/middleware_register.go b/proxy/middleware_register.go
new file mode 100644
index 000000000..736ee04c1
--- /dev/null
+++ b/proxy/middleware_register.go
@@ -0,0 +1,16 @@
+package proxy
+
+// Anonymous imports trigger init() in each built-in middleware
+// sub-package so they self-register into mwbuiltin.DefaultRegistry()
+// before initMiddlewareManager builds the resolver. Add a new line
+// here when introducing another built-in middleware.
+import (
+	_ "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/cost_meter"
+	_ "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_guardrail"
+	_ "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_identity_inject"
+	_ "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_limit_check"
+	_ "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_limit_record"
+	_ "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_request_parser"
+	_ "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_response_parser"
+	_ "github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_router"
+)
diff --git a/proxy/middleware_translate.go b/proxy/middleware_translate.go
new file mode 100644
index 000000000..c5d9fe016
--- /dev/null
+++ b/proxy/middleware_translate.go
@@ -0,0 +1,165 @@
+package proxy
+
+import (
+	"context"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/bodytap"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// translateMiddlewareCaptureConfig builds the per-target capture
+// limits used by the middleware chain. Returns nil when the options
+// are nil or no capture field is set. Negative caps are normalised to
+// zero; oversized caps are clamped to middleware.MaxBodyCapBytes.
+func translateMiddlewareCaptureConfig(targetID string, opts *proto.PathTargetOptions) *bodytap.Config {
+	if opts == nil {
+		return nil
+	}
+	reqCap := clampMiddlewareCaptureBytes(targetID, "request", opts.GetCaptureMaxRequestBytes())
+	respCap := clampMiddlewareCaptureBytes(targetID, "response", opts.GetCaptureMaxResponseBytes())
+	types := opts.GetCaptureContentTypes()
+	if reqCap == 0 && respCap == 0 && len(types) == 0 {
+		return nil
+	}
+	return &bodytap.Config{
+		MaxRequestBytes:  reqCap,
+		MaxResponseBytes: respCap,
+		ContentTypes:     types,
+	}
+}
+
+func clampMiddlewareCaptureBytes(targetID, direction string, v int64) int64 {
+	if v < 0 {
+		log.Debugf("target %s %s capture cap %d clamped to 0", targetID, direction, v)
+		return 0
+	}
+	if v > middleware.MaxBodyCapBytes {
+		log.Debugf("target %s %s capture cap %d clamped to %d", targetID, direction, v, middleware.MaxBodyCapBytes)
+		return middleware.MaxBodyCapBytes
+	}
+	return v
+}
+
+// translateMiddlewareConfigs converts the proto MiddlewareConfig list
+// into validated middleware.Spec values. The list is truncated to
+// middleware.MaxMiddlewaresPerChain when the caller exceeds the cap.
+// Entries with empty IDs, unknown IDs (when registry is non-nil), or
+// unspecified slots are skipped with a warn log. Timeouts are clamped
+// to [MinTimeout, MaxTimeout] and zero substitutes for DefaultTimeout.
+// Returns nil when the resulting slice is empty so callers can leave
+// PathTarget.Middlewares unset.
+func translateMiddlewareConfigs(
+	ctx context.Context,
+	targetID string,
+	in []*proto.MiddlewareConfig,
+	registry *middleware.Registry,
+) []middleware.Spec {
+	_ = ctx
+	if len(in) == 0 {
+		return nil
+	}
+	if len(in) > middleware.MaxMiddlewaresPerChain {
+		log.Warnf("middleware list for target %q truncated: %d entries exceeds cap of %d",
+			targetID, len(in), middleware.MaxMiddlewaresPerChain)
+		in = in[:middleware.MaxMiddlewaresPerChain]
+	}
+
+	out := make([]middleware.Spec, 0, len(in))
+	for _, cfg := range in {
+		spec, ok := translateMiddlewareConfig(targetID, cfg, registry)
+		if !ok {
+			continue
+		}
+		out = append(out, spec)
+	}
+	if len(out) == 0 {
+		return nil
+	}
+	return out
+}
+
+// translateMiddlewareConfig validates and converts a single
+// MiddlewareConfig. The second return value is false when the entry
+// must be dropped from the chain.
+func translateMiddlewareConfig(targetID string, cfg *proto.MiddlewareConfig, registry *middleware.Registry) (middleware.Spec, bool) {
+	if cfg == nil {
+		return middleware.Spec{}, false
+	}
+	id := cfg.GetId()
+	if id == "" {
+		log.Warnf("middleware config for target %q dropped: empty middleware id", targetID)
+		return middleware.Spec{}, false
+	}
+	if registry != nil && !registry.IsKnown(id) {
+		log.Warnf("unknown middleware %q configured for target %s; dropping", id, targetID)
+		return middleware.Spec{}, false
+	}
+	slot, ok := protoToMiddlewareSlot(cfg.GetSlot())
+	if !ok {
+		log.Warnf("middleware %q on target %q dropped: slot is unspecified", id, targetID)
+		return middleware.Spec{}, false
+	}
+
+	var rawConfig []byte
+	if src := cfg.GetConfigJson(); len(src) > 0 {
+		rawConfig = append([]byte(nil), src...)
+	}
+
+	return middleware.Spec{
+		ID:        id,
+		Slot:      slot,
+		Enabled:   cfg.GetEnabled(),
+		FailMode:  protoToMiddlewareFailMode(cfg.GetFailMode()),
+		Timeout:   clampMiddlewareTimeout(id, cfg.GetTimeout().AsDuration()),
+		RawConfig: rawConfig,
+		CanMutate: cfg.GetCanMutate(),
+	}, true
+}
+
+// protoToMiddlewareSlot maps the proto slot enum onto the internal
+// middleware.Slot. Returns ok=false for the UNSPECIFIED value so the
+// translator can drop the entry.
+func protoToMiddlewareSlot(s proto.MiddlewareSlot) (middleware.Slot, bool) {
+	switch s {
+	case proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST:
+		return middleware.SlotOnRequest, true
+	case proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_RESPONSE:
+		return middleware.SlotOnResponse, true
+	case proto.MiddlewareSlot_MIDDLEWARE_SLOT_TERMINAL:
+		return middleware.SlotTerminal, true
+	default:
+		return 0, false
+	}
+}
+
+// protoToMiddlewareFailMode maps the proto FailMode enum onto the
+// internal middleware.FailMode, defaulting to FailOpen for any value
+// other than FAIL_CLOSED.
+func protoToMiddlewareFailMode(m proto.MiddlewareConfig_FailMode) middleware.FailMode {
+	if m == proto.MiddlewareConfig_FAIL_CLOSED {
+		return middleware.FailClosed
+	}
+	return middleware.FailOpen
+}
+
+// clampMiddlewareTimeout enforces the proxy-wide [MinTimeout, MaxTimeout]
+// bounds and substitutes DefaultTimeout for zero inputs. A warn is logged
+// only on an actual clamp, not when filling the default.
+func clampMiddlewareTimeout(id string, d time.Duration) time.Duration {
+	if d <= 0 {
+		return middleware.DefaultTimeout
+	}
+	if d < middleware.MinTimeout {
+		log.Debugf("middleware %s timeout %s clamped to %s", id, d, middleware.MinTimeout)
+		return middleware.MinTimeout
+	}
+	if d > middleware.MaxTimeout {
+		log.Debugf("middleware %s timeout %s clamped to %s", id, d, middleware.MaxTimeout)
+		return middleware.MaxTimeout
+	}
+	return d
+}
diff --git a/proxy/middleware_translate_test.go b/proxy/middleware_translate_test.go
new file mode 100644
index 000000000..1a956090c
--- /dev/null
+++ b/proxy/middleware_translate_test.go
@@ -0,0 +1,246 @@
+package proxy
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/durationpb"
+
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// stubFactory builds a stub Middleware so the registry's IsKnown check
+// passes for the configured id. The translator never invokes the
+// middleware, so the methods only need to satisfy the interface.
+type stubFactory struct {
+	id   string
+	slot middleware.Slot
+}
+
+func (f stubFactory) ID() string { return f.id }
+func (f stubFactory) New(_ []byte) (middleware.Middleware, error) {
+	return stubMiddleware(f), nil
+}
+
+type stubMiddleware struct {
+	id   string
+	slot middleware.Slot
+}
+
+func (m stubMiddleware) ID() string                     { return m.id }
+func (m stubMiddleware) Version() string                { return "test" }
+func (m stubMiddleware) Slot() middleware.Slot          { return m.slot }
+func (m stubMiddleware) AcceptedContentTypes() []string { return nil }
+func (m stubMiddleware) MetadataKeys() []string         { return nil }
+func (m stubMiddleware) MutationsSupported() bool       { return false }
+func (m stubMiddleware) Close() error                   { return nil }
+func (m stubMiddleware) Invoke(context.Context, *middleware.Input) (*middleware.Output, error) {
+	panic("stubMiddleware.Invoke must not be called in translator tests")
+}
+
+// newTestRegistry returns a fresh registry pre-populated with the given
+// middleware ids in the matching slot.
+func newTestRegistry(t *testing.T, entries map[string]middleware.Slot) *middleware.Registry {
+	t.Helper()
+	r := middleware.NewRegistry()
+	for id, slot := range entries {
+		require.NoError(t, r.Register(stubFactory{id: id, slot: slot}), "stub registration must succeed")
+	}
+	return r
+}
+
+func TestTranslateMiddlewareConfigs_EmptyInput(t *testing.T) {
+	assert.Nil(t, translateMiddlewareConfigs(context.Background(), "target-a", nil, nil),
+		"nil input should translate to nil")
+	assert.Nil(t, translateMiddlewareConfigs(context.Background(), "target-a", []*proto.MiddlewareConfig{}, nil),
+		"empty input should translate to nil")
+}
+
+func TestTranslateMiddlewareConfigs_KnownIDs(t *testing.T) {
+	registry := newTestRegistry(t, map[string]middleware.Slot{
+		"llm_request_parser":  middleware.SlotOnRequest,
+		"llm_response_parser": middleware.SlotOnResponse,
+	})
+	in := []*proto.MiddlewareConfig{
+		{
+			Id:         "llm_request_parser",
+			Enabled:    true,
+			Slot:       proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST,
+			ConfigJson: []byte(`{"foo":"bar"}`),
+			FailMode:   proto.MiddlewareConfig_FAIL_OPEN,
+			Timeout:    durationpb.New(250 * time.Millisecond),
+			CanMutate:  true,
+		},
+		{
+			Id:         "llm_response_parser",
+			Enabled:    false,
+			Slot:       proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_RESPONSE,
+			ConfigJson: nil,
+			FailMode:   proto.MiddlewareConfig_FAIL_CLOSED,
+			Timeout:    durationpb.New(50 * time.Millisecond),
+		},
+	}
+
+	out := translateMiddlewareConfigs(context.Background(), "target-a", in, registry)
+	require.Len(t, out, 2, "two known middlewares should produce two specs")
+
+	assert.Equal(t, "llm_request_parser", out[0].ID, "first id should match")
+	assert.Equal(t, middleware.SlotOnRequest, out[0].Slot, "first slot should be on_request")
+	assert.True(t, out[0].Enabled, "first spec should be enabled")
+	assert.Equal(t, middleware.FailOpen, out[0].FailMode, "first spec should be fail-open")
+	assert.Equal(t, 250*time.Millisecond, out[0].Timeout, "first spec timeout should pass through")
+	assert.True(t, out[0].CanMutate, "first spec should permit mutations")
+	assert.Equal(t, []byte(`{"foo":"bar"}`), out[0].RawConfig, "first spec raw config should match")
+
+	assert.Equal(t, "llm_response_parser", out[1].ID, "second id should match")
+	assert.Equal(t, middleware.SlotOnResponse, out[1].Slot, "second slot should be on_response")
+	assert.False(t, out[1].Enabled, "second spec should be disabled")
+	assert.Equal(t, middleware.FailClosed, out[1].FailMode, "second spec should be fail-closed")
+	assert.Equal(t, 50*time.Millisecond, out[1].Timeout, "second spec timeout should pass through")
+	assert.Nil(t, out[1].RawConfig, "second spec raw config should be nil")
+}
+
+func TestTranslateMiddlewareConfigs_UnknownIDSkipped(t *testing.T) {
+	registry := newTestRegistry(t, map[string]middleware.Slot{
+		"llm_request_parser": middleware.SlotOnRequest,
+	})
+	in := []*proto.MiddlewareConfig{
+		{Id: "llm_request_parser", Slot: proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST},
+		{Id: "not_registered", Slot: proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST},
+	}
+	out := translateMiddlewareConfigs(context.Background(), "target-unknown", in, registry)
+	require.Len(t, out, 1, "unknown id must be skipped")
+	assert.Equal(t, "llm_request_parser", out[0].ID, "remaining entry should be the known one")
+}
+
+func TestTranslateMiddlewareConfigs_NilRegistrySkipsValidation(t *testing.T) {
+	in := []*proto.MiddlewareConfig{
+		{Id: "anything_goes", Slot: proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST},
+	}
+	out := translateMiddlewareConfigs(context.Background(), "target-nilreg", in, nil)
+	require.Len(t, out, 1, "nil registry must accept any non-empty id")
+	assert.Equal(t, "anything_goes", out[0].ID, "id should pass through unchecked")
+}
+
+func TestTranslateMiddlewareConfigs_TimeoutClamps(t *testing.T) {
+	registry := newTestRegistry(t, map[string]middleware.Slot{
+		"llm_request_parser": middleware.SlotOnRequest,
+	})
+	in := []*proto.MiddlewareConfig{
+		{Id: "llm_request_parser", Slot: proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST, Timeout: nil},
+		{Id: "llm_request_parser", Slot: proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST, Timeout: durationpb.New(time.Microsecond)},
+		{Id: "llm_request_parser", Slot: proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST, Timeout: durationpb.New(time.Hour)},
+	}
+	out := translateMiddlewareConfigs(context.Background(), "target-clamp", in, registry)
+	require.Len(t, out, 3, "clamping must keep all three entries")
+	assert.Equal(t, middleware.DefaultTimeout, out[0].Timeout, "zero timeout should default")
+	assert.Equal(t, middleware.MinTimeout, out[1].Timeout, "below-min timeout should clamp up")
+	assert.Equal(t, middleware.MaxTimeout, out[2].Timeout, "above-max timeout should clamp down")
+}
+
+func TestTranslateMiddlewareConfigs_FailModeMapping(t *testing.T) {
+	registry := newTestRegistry(t, map[string]middleware.Slot{
+		"llm_request_parser": middleware.SlotOnRequest,
+	})
+	in := []*proto.MiddlewareConfig{
+		{Id: "llm_request_parser", Slot: proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST},
+		{Id: "llm_request_parser", Slot: proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST, FailMode: proto.MiddlewareConfig_FAIL_CLOSED},
+	}
+	out := translateMiddlewareConfigs(context.Background(), "target-failmode", in, registry)
+	require.Len(t, out, 2, "both entries should translate")
+	assert.Equal(t, middleware.FailOpen, out[0].FailMode, "default fail mode should be open")
+	assert.Equal(t, middleware.FailClosed, out[1].FailMode, "explicit fail closed should map")
+}
+
+func TestTranslateMiddlewareConfigs_SlotMapping(t *testing.T) {
+	registry := newTestRegistry(t, map[string]middleware.Slot{
+		"req":  middleware.SlotOnRequest,
+		"resp": middleware.SlotOnResponse,
+		"term": middleware.SlotTerminal,
+	})
+	in := []*proto.MiddlewareConfig{
+		{Id: "req", Slot: proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST},
+		{Id: "resp", Slot: proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_RESPONSE},
+		{Id: "term", Slot: proto.MiddlewareSlot_MIDDLEWARE_SLOT_TERMINAL},
+		{Id: "req", Slot: proto.MiddlewareSlot_MIDDLEWARE_SLOT_UNSPECIFIED},
+	}
+	out := translateMiddlewareConfigs(context.Background(), "target-slot", in, registry)
+	require.Len(t, out, 3, "unspecified slot entry must be skipped")
+	assert.Equal(t, middleware.SlotOnRequest, out[0].Slot, "on_request slot mapping")
+	assert.Equal(t, middleware.SlotOnResponse, out[1].Slot, "on_response slot mapping")
+	assert.Equal(t, middleware.SlotTerminal, out[2].Slot, "terminal slot mapping")
+}
+
+func TestTranslateMiddlewareConfigs_EmptyIDSkipped(t *testing.T) {
+	registry := newTestRegistry(t, map[string]middleware.Slot{
+		"llm_request_parser": middleware.SlotOnRequest,
+	})
+	in := []*proto.MiddlewareConfig{
+		{Id: "", Slot: proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST},
+		{Id: "llm_request_parser", Slot: proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST},
+	}
+	out := translateMiddlewareConfigs(context.Background(), "target-empty-id", in, registry)
+	require.Len(t, out, 1, "empty id must be dropped")
+	assert.Equal(t, "llm_request_parser", out[0].ID, "remaining entry should be valid")
+}
+
+// TestTranslateMiddlewareConfigs_TruncatesAboveCap proves the translator
+// truncates lists that exceed MaxMiddlewaresPerChain rather than dropping
+// the whole slice, matching the documented G3 behaviour.
+func TestTranslateMiddlewareConfigs_TruncatesAboveCap(t *testing.T) {
+	registry := newTestRegistry(t, map[string]middleware.Slot{
+		"llm_request_parser": middleware.SlotOnRequest,
+	})
+	overCap := middleware.MaxMiddlewaresPerChain + 1
+	in := make([]*proto.MiddlewareConfig, 0, overCap)
+	for i := 0; i < overCap; i++ {
+		in = append(in, &proto.MiddlewareConfig{
+			Id:   "llm_request_parser",
+			Slot: proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST,
+		})
+	}
+	out := translateMiddlewareConfigs(context.Background(), "target-truncate", in, registry)
+	assert.Len(t, out, middleware.MaxMiddlewaresPerChain, "over-cap input must be truncated to MaxMiddlewaresPerChain")
+}
+
+func TestTranslateMiddlewareConfigs_AllowsListAtCap(t *testing.T) {
+	registry := newTestRegistry(t, map[string]middleware.Slot{
+		"llm_request_parser": middleware.SlotOnRequest,
+	})
+	in := make([]*proto.MiddlewareConfig, 0, middleware.MaxMiddlewaresPerChain)
+	for i := 0; i < middleware.MaxMiddlewaresPerChain; i++ {
+		in = append(in, &proto.MiddlewareConfig{
+			Id:   "llm_request_parser",
+			Slot: proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST,
+		})
+	}
+	out := translateMiddlewareConfigs(context.Background(), "target-cap", in, registry)
+	assert.Len(t, out, middleware.MaxMiddlewaresPerChain, "list at the cap boundary must translate fully")
+}
+
+func TestProtoToMiddlewareSlot(t *testing.T) {
+	cases := []struct {
+		name   string
+		in     proto.MiddlewareSlot
+		want   middleware.Slot
+		wantOk bool
+	}{
+		{"unspecified", proto.MiddlewareSlot_MIDDLEWARE_SLOT_UNSPECIFIED, 0, false},
+		{"on_request", proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST, middleware.SlotOnRequest, true},
+		{"on_response", proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_RESPONSE, middleware.SlotOnResponse, true},
+		{"terminal", proto.MiddlewareSlot_MIDDLEWARE_SLOT_TERMINAL, middleware.SlotTerminal, true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got, ok := protoToMiddlewareSlot(tc.in)
+			assert.Equal(t, tc.wantOk, ok, "ok flag for %s", tc.name)
+			if tc.wantOk {
+				assert.Equal(t, tc.want, got, "slot mapping for %s", tc.name)
+			}
+		})
+	}
+}
diff --git a/proxy/server.go b/proxy/server.go
index 1d8a2451b..f28d580bd 100644
--- a/proxy/server.go
+++ b/proxy/server.go
@@ -55,6 +55,8 @@ import (
 	"github.com/netbirdio/netbird/proxy/internal/health"
 	"github.com/netbirdio/netbird/proxy/internal/k8s"
 	proxymetrics "github.com/netbirdio/netbird/proxy/internal/metrics"
+	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	mwbuiltin "github.com/netbirdio/netbird/proxy/internal/middleware/builtin"
 	"github.com/netbirdio/netbird/proxy/internal/netutil"
 	"github.com/netbirdio/netbird/proxy/internal/proxy"
 	"github.com/netbirdio/netbird/proxy/internal/restrict"
@@ -77,29 +79,36 @@ type portRouter struct {
 
 type Server struct {
 	ctx               context.Context
-	mgmtClient        proto.ProxyServiceClient
-	proxy             *proxy.ReverseProxy
-	netbird           *roundtrip.NetBird
-	acme              *acme.Manager
+	mgmtClient    proto.ProxyServiceClient
+	proxy         *proxy.ReverseProxy
+	netbird       *roundtrip.NetBird
+	acme          *acme.Manager
 	staticCertWatcher *certwatch.Watcher
-	auth              *auth.Middleware
-	http              *http.Server
-	https             *http.Server
-	debug             *http.Server
-	healthServer      *health.Server
-	healthChecker     *health.Checker
-	meter             *proxymetrics.Metrics
-	accessLog         *accesslog.Logger
-	mainRouter        *nbtcp.Router
-	mainPort          uint16
-	udpMu             sync.Mutex
-	udpRelays         map[types.ServiceID]*udprelay.Relay
-	udpRelayWg        sync.WaitGroup
-	portMu            sync.RWMutex
-	portRouters       map[uint16]*portRouter
-	svcPorts          map[types.ServiceID][]uint16
-	lastMappings      map[types.ServiceID]*proto.ProxyMapping
-	portRouterWg      sync.WaitGroup
+	auth          *auth.Middleware
+	http          *http.Server
+	https         *http.Server
+	debug         *http.Server
+	healthServer  *health.Server
+	healthChecker *health.Checker
+	meter         *proxymetrics.Metrics
+	accessLog     *accesslog.Logger
+	// middlewareManager drives per-target middleware dispatch. Always
+	// constructed during boot; an empty registry produces empty chains and
+	// the reverse-proxy stays on the no-capture fast path.
+	middlewareManager *middleware.Manager
+	// middlewareRegistry is the source of registered middleware factories.
+	// Concrete middlewares register themselves through init().
+	middlewareRegistry *middleware.Registry
+	mainRouter    *nbtcp.Router
+	mainPort      uint16
+	udpMu         sync.Mutex
+	udpRelays     map[types.ServiceID]*udprelay.Relay
+	udpRelayWg    sync.WaitGroup
+	portMu        sync.RWMutex
+	portRouters   map[uint16]*portRouter
+	svcPorts      map[types.ServiceID][]uint16
+	lastMappings  map[types.ServiceID]*proto.ProxyMapping
+	portRouterWg  sync.WaitGroup
 
 	// hijackTracker tracks hijacked connections (e.g. WebSocket upgrades)
 	// so they can be closed during graceful shutdown, since http.Server.Shutdown
@@ -236,8 +245,20 @@ type Server struct {
 	// in processMappings before the receive loop reconnects to resync.
 	// Zero uses defaultMappingBatchWatchdog.
 	MappingBatchWatchdog time.Duration
+	// MiddlewareDataDir is the base directory the middleware system uses to
+	// resolve file-backed configuration (e.g. the cost_meter pricing table).
+	// Empty means any middleware that requires a file fails at configure time.
+	MiddlewareDataDir string
+	// MiddlewareCaptureBudgetBytes overrides the proxy-wide in-flight capture
+	// budget passed to middleware.NewManager. Zero or negative values fall
+	// back to defaultMiddlewareCaptureBudgetBytes (256 MiB).
+	MiddlewareCaptureBudgetBytes int64
 }
 
+// defaultMiddlewareCaptureBudgetBytes is the proxy-wide in-flight capture cap
+// passed to middleware.NewManager when MiddlewareCaptureBudgetBytes is unset.
+const defaultMiddlewareCaptureBudgetBytes = 256 << 20
+
 // clampIdleTimeout returns d capped to MaxSessionIdleTimeout when configured.
 func (s *Server) clampIdleTimeout(d time.Duration) time.Duration {
 	if s.MaxSessionIdleTimeout > 0 && d > s.MaxSessionIdleTimeout {
@@ -343,6 +364,15 @@ func (s *Server) Start(ctx context.Context) error {
 		return err
 	}
 
+	// Management client must be initialised BEFORE the middleware manager —
+	// initMiddlewareManager passes s.mgmtClient into the builtin FactoryContext
+	// that the limit-check / limit-record middlewares pull from. Reversed
+	// order would silently disable enforcement (mgmt=nil → allow-without-
+	// attribution + no-record).
+	if err := s.initMiddlewareManager(ctx); err != nil {
+		return fmt.Errorf("init middleware manager: %w", err)
+	}
+
 	runCtx, runCancel := context.WithCancel(ctx)
 	s.runCancel = runCancel
 
@@ -562,7 +592,11 @@ func (s *Server) initNetBirdClient() {
 // proxy host's resolver instead of the tunnel's DNS.
 func (s *Server) initReverseProxy() {
 	upstreamRT := roundtrip.NewMultiTransport(s.netbird, s.Logger)
-	s.proxy = proxy.NewReverseProxy(s.meter.RoundTripper(upstreamRT), s.ForwardedProto, s.TrustedProxies, s.Logger)
+	var rpOpts []proxy.Option
+	if s.middlewareManager != nil {
+		rpOpts = append(rpOpts, proxy.WithMiddlewareManager(s.middlewareManager))
+	}
+	s.proxy = proxy.NewReverseProxy(s.meter.RoundTripper(upstreamRT), s.ForwardedProto, s.TrustedProxies, s.Logger, rpOpts...)
 }
 
 // initGeoLookup configures the GeoLite2 lookup used for country-based
@@ -2047,9 +2081,94 @@ func (s *Server) updateMapping(ctx context.Context, mapping *proto.ProxyMapping)
 	m := s.protoToMapping(ctx, mapping)
 	s.proxy.AddMapping(m)
 	s.meter.AddMapping(m)
+	s.rebuildMiddlewareChains(svcID, m)
 	return nil
 }
 
+// initMiddlewareManager wires the middleware subsystem at boot. It configures
+// the per-process FactoryContext concrete middlewares consult, installs the
+// live-service check, and binds the resolver to the registry concrete
+// middlewares register themselves into via init().
+func (s *Server) initMiddlewareManager(ctx context.Context) error {
+	if s.meter == nil {
+		return fmt.Errorf("middleware manager requires metrics bundle")
+	}
+	otelMeter := s.meter.Meter()
+	mwbuiltin.Configure(ctx, s.MiddlewareDataDir, otelMeter, s.Logger, s.mgmtClient)
+
+	mwMetrics, err := middleware.NewMetrics(otelMeter)
+	if err != nil {
+		return fmt.Errorf("init middleware metrics: %w", err)
+	}
+	budgetBytes := s.MiddlewareCaptureBudgetBytes
+	if budgetBytes <= 0 {
+		budgetBytes = defaultMiddlewareCaptureBudgetBytes
+	}
+
+	registry := mwbuiltin.DefaultRegistry()
+	mgr := middleware.NewManager(budgetBytes, mwMetrics, s.Logger)
+	mgr.SetResolver(middleware.NewResolver(registry))
+	mgr.SetLiveServiceCheck(s.isLiveService)
+
+	s.middlewareRegistry = registry
+	s.middlewareManager = mgr
+	ids := registry.IDs()
+	s.Logger.Infof("middleware system enabled: %d built-in middlewares registered %v, capture budget %d bytes",
+		len(ids), ids, budgetBytes)
+	return nil
+}
+
+// rebuildMiddlewareChains converts m into per-path bindings and calls
+// Manager.Rebuild. Short-circuits when the middleware manager is unset.
+func (s *Server) rebuildMiddlewareChains(svcID types.ServiceID, m proxy.Mapping) {
+	if s.middlewareManager == nil {
+		return
+	}
+	bindings := buildMiddlewareBindings(svcID, m)
+	if err := s.middlewareManager.Rebuild(string(svcID), bindings); err != nil {
+		s.Logger.WithError(err).WithField("service_id", svcID).Error("failed to rebuild middleware chains")
+	}
+}
+
+// isLiveService reports whether svcID is currently present in the live
+// mapping cache. Used by the middleware manager to confirm a chain is still
+// referenced before rebuilding it from cached bindings.
+func (s *Server) isLiveService(svcID string) bool {
+	s.portMu.RLock()
+	defer s.portMu.RUnlock()
+	_, ok := s.lastMappings[types.ServiceID(svcID)]
+	return ok
+}
+
+// invalidateMiddlewareChains drops every middleware chain registered for svcID.
+func (s *Server) invalidateMiddlewareChains(svcID types.ServiceID) {
+	if s.middlewareManager == nil {
+		return
+	}
+	s.middlewareManager.Invalidate(string(svcID))
+}
+
+// buildMiddlewareBindings converts the path targets of m into the per-path
+// binding list the middleware manager's Rebuild expects. Targets without any
+// middleware specs are skipped.
+func buildMiddlewareBindings(svcID types.ServiceID, m proxy.Mapping) []middleware.PathTargetBinding {
+	if len(m.Paths) == 0 {
+		return nil
+	}
+	bindings := make([]middleware.PathTargetBinding, 0, len(m.Paths))
+	for pathID, pt := range m.Paths {
+		if pt == nil || len(pt.Middlewares) == 0 {
+			continue
+		}
+		bindings = append(bindings, middleware.PathTargetBinding{
+			ServiceID: string(svcID),
+			PathID:    pathID,
+			Specs:     pt.Middlewares,
+		})
+	}
+	return bindings
+}
+
 // removeMapping tears down routes/relays and the NetBird peer for a service.
 // Uses the stored mapping state when available to ensure all previously
 // configured routes are cleaned up.
@@ -2085,6 +2204,8 @@ func (s *Server) cleanupMappingRoutes(mapping *proto.ProxyMapping) {
 	svcID := types.ServiceID(mapping.GetId())
 	host := mapping.GetDomain()
 
+	s.invalidateMiddlewareChains(svcID)
+
 	// HTTP/TLS cleanup (only relevant when a domain is set).
 	if host != "" {
 		d := domain.Domain(host)
@@ -2192,6 +2313,12 @@ func (s *Server) protoToMapping(ctx context.Context, mapping *proto.ProxyMapping
 				pt.RequestTimeout = d.AsDuration()
 			}
 			pt.DirectUpstream = opts.GetDirectUpstream()
+			// Agent-network middleware specs + capture config + flag ride on
+			// the same per-target options.
+			pt.CaptureConfig = translateMiddlewareCaptureConfig(mapping.GetId(), opts)
+			pt.Middlewares = translateMiddlewareConfigs(ctx, mapping.GetId(), opts.GetMiddlewares(), s.middlewareRegistry)
+			pt.AgentNetwork = opts.GetAgentNetwork()
+			pt.DisableAccessLog = opts.GetDisableAccessLog()
 		}
 		pt.RequestTimeout = s.clampDialTimeout(pt.RequestTimeout)
 		paths[pathMapping.GetPath()] = pt
diff --git a/shared/management/http/api/openapi.yml b/shared/management/http/api/openapi.yml
index 196a0c6b1..dffb7d7de 100644
--- a/shared/management/http/api/openapi.yml
+++ b/shared/management/http/api/openapi.yml
@@ -5069,6 +5069,1054 @@ components:
           type: string
           description: A human-readable error message.
           example: "couldn't parse JSON request"
+    AgentNetworkProvider:
+      type: object
+      properties:
+        id:
+          type: string
+          description: Provider ID
+          example: "ainp_d1m3kebd9pcs0c1pnu7g"
+        provider_id:
+          type: string
+          description: Catalog identifier for the upstream AI provider (e.g. openai_api, anthropic_api, azure_openai_api, bedrock_api, vertex_ai_api, mistral_api, custom).
+          example: "openai_api"
+        name:
+          type: string
+          description: Display name shown in the dashboard.
+          example: "OpenAI API"
+        upstream_url:
+          type: string
+          description: Full upstream URL (with scheme) that NetBird forwards traffic to.
+          example: "https://api.openai.com"
+        models:
+          type: array
+          description: Models exposed through this endpoint, with the operator's per-1k input/output prices. Empty means all catalog models are allowed at catalog prices.
+          items:
+            $ref: '#/components/schemas/AgentNetworkProviderModel'
+        extra_values:
+          type: object
+          description: |
+            Operator-typed values for catalog-declared extra headers. Keys are wire header names (e.g. `x-portkey-config`); values are the strings the proxy stamps on every upstream request to this provider. Catalog (AgentNetworkCatalogProvider.extra_headers) declares which keys are accepted; values not declared by the catalog are ignored at synth time. Empty / missing values mean no header stamped.
+          additionalProperties:
+            type: string
+          example:
+            x-portkey-config: "pc-prod-3f2a"
+        identity_header_user_id:
+          type: string
+          description: |
+            Wire header name the proxy stamps with the caller's display identity (user email or peer name) when the catalog entry's HeaderPair is `customizable`. Empty disables stamping for this dimension. Ignored when the catalog entry has a fixed HeaderPair (e.g. LiteLLM, Portkey). Used today by Bifrost: typical values are `x-bf-lh-netbird_user_id` (always-on log metadata) or `x-bf-dim-netbird_user_id` (Prometheus / OTEL — requires the label to be pre-declared in the gateway's `client.prometheus_labels` config).
+          example: "x-bf-dim-netbird_user_id"
+        identity_header_groups:
+          type: string
+          description: |
+            Wire header name the proxy stamps with the caller's NetBird groups as a comma-separated list (sorted) when the catalog entry's HeaderPair is `customizable`. Empty disables stamping for this dimension. Same per-catalog semantics as `identity_header_user_id`.
+          example: "x-bf-dim-netbird_groups"
+        enabled:
+          type: boolean
+          description: Whether the provider is enabled.
+          example: true
+        created_at:
+          type: string
+          format: date-time
+          description: Timestamp when the provider was created.
+          readOnly: true
+          example: "2026-04-26T10:30:00Z"
+        updated_at:
+          type: string
+          format: date-time
+          description: Timestamp when the provider was last updated.
+          readOnly: true
+          example: "2026-04-26T10:30:00Z"
+      required:
+        - id
+        - provider_id
+        - name
+        - upstream_url
+        - models
+        - enabled
+        - created_at
+        - updated_at
+    AgentNetworkProviderRequest:
+      type: object
+      properties:
+        provider_id:
+          type: string
+          description: Catalog identifier for the upstream AI provider (e.g. openai_api, anthropic_api, azure_openai_api, bedrock_api, vertex_ai_api, mistral_api, custom).
+          example: "openai_api"
+        name:
+          type: string
+          description: Display name for the provider.
+          example: "OpenAI API"
+        upstream_url:
+          type: string
+          description: Full upstream URL (with scheme) that NetBird forwards traffic to.
+          example: "https://api.openai.com"
+        bootstrap_cluster:
+          type: string
+          description: Proxy cluster used to bootstrap the per-account agent-network endpoint when the first provider is created. Ignored on subsequent creates and on updates because the cluster is pinned on the account-level Settings row.
+          example: "eu.proxy.netbird.io"
+        api_key:
+          type: string
+          description: Upstream provider API key. Sealed at rest on the management server and never returned in responses. Required on create; optional on update (omit to keep the existing key).
+          example: "sk-..."
+        models:
+          type: array
+          description: Models exposed through this endpoint, with the operator's per-1k input/output prices. Empty means all catalog models are allowed at catalog prices.
+          items:
+            $ref: '#/components/schemas/AgentNetworkProviderModel'
+        extra_values:
+          type: object
+          description: |
+            Operator-typed values for catalog-declared extra headers (see AgentNetworkProvider.extra_values). When present on a request, the whole map replaces the stored values. Empty strings drop the corresponding key.
+          additionalProperties:
+            type: string
+          example:
+            x-portkey-config: "pc-prod-3f2a"
+        identity_header_user_id:
+          type: string
+          description: |
+            Wire header name for the caller's display identity. See AgentNetworkProvider.identity_header_user_id. When omitted on a request, the stored value is left unchanged; pass an empty string explicitly to clear it (which disables stamping for this dimension).
+          example: "x-bf-dim-netbird_user_id"
+        identity_header_groups:
+          type: string
+          description: |
+            Wire header name for the caller's groups CSV. See AgentNetworkProvider.identity_header_groups. Same omit / empty semantics as `identity_header_user_id`.
+          example: "x-bf-dim-netbird_groups"
+        enabled:
+          type: boolean
+          description: Whether the provider is enabled. Defaults to true on create.
+          example: true
+      required:
+        - provider_id
+        - name
+        - upstream_url
+    AgentNetworkProviderModel:
+      type: object
+      description: A model exposed by the provider, with the operator's per-1k input/output prices in USD.
+      properties:
+        id:
+          type: string
+          description: Model identifier (e.g. "gpt-4o-mini").
+          example: "gpt-4o-mini"
+        input_per_1k:
+          type: number
+          format: double
+          description: Cost per 1k input tokens, in USD.
+          example: 0.00015
+        output_per_1k:
+          type: number
+          format: double
+          description: Cost per 1k output tokens, in USD.
+          example: 0.0006
+      required:
+        - id
+        - input_per_1k
+        - output_per_1k
+    AgentNetworkCatalogModel:
+      type: object
+      properties:
+        id:
+          type: string
+          description: Catalog model identifier as exposed by the upstream provider.
+          example: "gpt-4o"
+        label:
+          type: string
+          description: Human-friendly model name for the dashboard.
+          example: "GPT-4o"
+        input_per_1k:
+          type: number
+          format: double
+          description: Input token price per 1k tokens, in USD.
+          example: 0.005
+        output_per_1k:
+          type: number
+          format: double
+          description: Output token price per 1k tokens, in USD.
+          example: 0.015
+        context_window:
+          type: integer
+          description: Maximum context window in tokens.
+          example: 128000
+      required:
+        - id
+        - label
+        - input_per_1k
+        - output_per_1k
+        - context_window
+    AgentNetworkCatalogProvider:
+      type: object
+      properties:
+        id:
+          type: string
+          description: Catalog provider identifier (referenced by AgentNetworkProvider.provider_id).
+          example: "openai_api"
+        name:
+          type: string
+          description: Display name for the provider.
+          example: "OpenAI API"
+        description:
+          type: string
+          description: Short description shown in the provider picker.
+          example: "GPT, Responses API, and Embeddings"
+        default_host:
+          type: string
+          description: Default upstream host suggested when adding a provider of this type.
+          example: "api.openai.com"
+        auth_header_template:
+          type: string
+          description: Template the proxy uses to inject the API key (the literal string ${API_KEY} is replaced at request time).
+          example: "Bearer ${API_KEY}"
+        default_content_type:
+          type: string
+          description: Default Content-Type for upstream requests.
+          example: "application/json"
+        brand_color:
+          type: string
+          description: Hex brand color used to render the provider badge in the dashboard.
+          example: "#10A37F"
+        kind:
+          type: string
+          description: |
+            Presentation grouping for the provider Select on the dashboard.
+            "provider" — first-party vendor API (OpenAI, Anthropic, …); the upstream is the model itself.
+            "gateway" — routing/aggregation layer in front of multiple providers (LiteLLM, Portkey, …); typically pairs with NetBird identity stamping.
+            "custom" — generic OpenAI-compatible self-hosted endpoint catch-all.
+          enum: [provider, gateway, custom]
+          example: "provider"
+        extra_headers:
+          type: array
+          description: |
+            Catalog-declared list of optional per-provider routing/config headers the proxy stamps on every upstream request. Each entry surfaces an input on the dashboard's provider modal (one per item, labeled with `label`). Operators fill any subset; values land on the provider record's `extra_values` map keyed by `name`. Used by gateways like Portkey for `x-portkey-config: pc-...` (saved-config id resolving upstream provider + virtual key).
+          items:
+            $ref: '#/components/schemas/AgentNetworkCatalogExtraHeader'
+        identity_injection:
+          $ref: '#/components/schemas/AgentNetworkCatalogIdentityInjection'
+        models:
+          type: array
+          description: Catalog models available for this provider.
+          items:
+            $ref: '#/components/schemas/AgentNetworkCatalogModel'
+      required:
+        - id
+        - name
+        - description
+        - default_host
+        - auth_header_template
+        - default_content_type
+        - brand_color
+        - kind
+        - models
+    AgentNetworkCatalogIdentityInjection:
+      type: object
+      description: |
+        Catalog-declared identity-injection shape. Present when this provider supports stamping the caller's NetBird identity onto upstream requests. Exactly one of `header_pair` or `json_metadata` is set per provider entry. The dashboard reads the `customizable` flag on whichever shape is present to decide whether to surface the labels as editable inputs (true → editable with the catalog values shown as placeholders; false → fixed and read-only).
+      properties:
+        header_pair:
+          $ref: '#/components/schemas/AgentNetworkCatalogHeaderPairInjection'
+        json_metadata:
+          $ref: '#/components/schemas/AgentNetworkCatalogJSONMetadataInjection'
+    AgentNetworkCatalogHeaderPairInjection:
+      type: object
+      description: HeaderPair identity-injection shape — separate per-dimension headers (LiteLLM-style, Bifrost).
+      properties:
+        customizable:
+          type: boolean
+          description: When true, the wire header names are operator-overridable per provider record (Bifrost). When false, the catalog values are authoritative (LiteLLM and similar gateways with a fixed wire protocol).
+          example: true
+        end_user_id_header:
+          type: string
+          description: Wire header name for the caller's display identity. Default placeholder when `customizable` is true.
+          example: "x-bf-dim-netbird_user_id"
+        tags_header:
+          type: string
+          description: Wire header name for the caller's groups CSV. Default placeholder when `customizable` is true.
+          example: "x-bf-dim-netbird_groups"
+      required:
+        - customizable
+        - end_user_id_header
+        - tags_header
+    AgentNetworkCatalogJSONMetadataInjection:
+      type: object
+      description: JSONMetadata identity-injection shape — one wire header carrying a JSON object whose keys label each dimension (Portkey-style, Cloudflare AI Gateway).
+      properties:
+        customizable:
+          type: boolean
+          description: When true, the JSON keys are operator-overridable per provider record (Cloudflare). The wire header itself stays catalog-owned. When false, the catalog values are authoritative (Portkey and similar gateways with a fixed JSON schema).
+          example: true
+        header:
+          type: string
+          description: Wire header name carrying the JSON metadata payload. Catalog-owned (not customizable per provider record).
+          example: "cf-aig-metadata"
+        user_key:
+          type: string
+          description: JSON key for the caller's display identity. Default placeholder when `customizable` is true.
+          example: "netbird_user_id"
+        groups_key:
+          type: string
+          description: JSON key for the caller's groups CSV. Default placeholder when `customizable` is true.
+          example: "netbird_groups"
+      required:
+        - customizable
+        - header
+        - user_key
+        - groups_key
+    AgentNetworkCatalogExtraHeader:
+      type: object
+      description: One optional per-provider routing/config header surfaced on the dashboard. Operator-typed value lives on the provider record's `extra_values` map keyed by `name`. UI copy (input label, helper line, tooltip) is owned by the dashboard, keyed by `name`.
+      properties:
+        name:
+          type: string
+          description: Wire header name the proxy stamps with the operator-typed value.
+          example: "x-portkey-config"
+      required:
+        - name
+    AgentNetworkPolicy:
+      type: object
+      properties:
+        id:
+          type: string
+          description: Policy ID
+          example: "ainpol_d1m3kebd9pcs0c1pnu7g"
+        name:
+          type: string
+          description: Display name for the policy.
+          example: "Engineering → OpenAI"
+        description:
+          type: string
+          description: Optional human-readable description.
+          example: "Engineers can call OpenAI under production guardrails."
+        enabled:
+          type: boolean
+          description: Whether the policy is enabled.
+          example: true
+        source_groups:
+          type: array
+          description: NetBird group ids whose members are allowed to call the destination providers.
+          items:
+            type: string
+          example: ["ch8vp3o6lnna9hg0sd8g"]
+        destination_provider_ids:
+          type: array
+          description: Agent Network provider ids (returned by the providers API) the source groups can reach.
+          items:
+            type: string
+          example: ["ainp_d1m3kebd9pcs0c1pnu7g"]
+        guardrail_ids:
+          type: array
+          description: Agent Network guardrail ids attached to this policy.
+          items:
+            type: string
+          example: []
+        limits:
+          $ref: '#/components/schemas/AgentNetworkPolicyLimits'
+        created_at:
+          type: string
+          format: date-time
+          description: Timestamp when the policy was created.
+          readOnly: true
+          example: "2026-04-26T10:30:00Z"
+        updated_at:
+          type: string
+          format: date-time
+          description: Timestamp when the policy was last updated.
+          readOnly: true
+          example: "2026-04-26T10:30:00Z"
+      required:
+        - id
+        - name
+        - description
+        - enabled
+        - source_groups
+        - destination_provider_ids
+        - guardrail_ids
+        - limits
+        - created_at
+        - updated_at
+    AgentNetworkPolicyRequest:
+      type: object
+      properties:
+        name:
+          type: string
+          description: Display name for the policy.
+          example: "Engineering → OpenAI"
+        description:
+          type: string
+          description: Optional human-readable description.
+          example: "Engineers can call OpenAI under production guardrails."
+        enabled:
+          type: boolean
+          description: Whether the policy is enabled. Defaults to true on create.
+          example: true
+        source_groups:
+          type: array
+          description: NetBird group ids whose members are allowed to call the destination providers.
+          items:
+            type: string
+          minItems: 1
+          example: ["ch8vp3o6lnna9hg0sd8g"]
+        destination_provider_ids:
+          type: array
+          description: Agent Network provider ids the source groups can reach.
+          items:
+            type: string
+          minItems: 1
+          example: ["ainp_d1m3kebd9pcs0c1pnu7g"]
+        guardrail_ids:
+          type: array
+          description: Agent Network guardrail ids to attach to this policy.
+          items:
+            type: string
+          example: []
+        limits:
+          $ref: '#/components/schemas/AgentNetworkPolicyLimits'
+      required:
+        - name
+        - source_groups
+        - destination_provider_ids
+    AgentNetworkPolicyTokenLimit:
+      type: object
+      description: Per-policy token cap. `group_cap` is applied to each source group independently — every group in the policy's `source_groups` gets its own bucket of this size. `user_cap` is applied independently to each individual user. Caps reset to zero at the start of each window.
+      properties:
+        enabled:
+          type: boolean
+          example: true
+        group_cap:
+          type: integer
+          format: int64
+          minimum: 0
+          description: Tokens allowed per source group within the window (each group has its own bucket of this size). 0 means uncapped.
+          example: 10000000
+        user_cap:
+          type: integer
+          format: int64
+          minimum: 0
+          description: Tokens allowed per individual user within the window. 0 means uncapped.
+          example: 1000000
+        window_seconds:
+          type: integer
+          format: int64
+          minimum: 60
+          description: Reset frequency in seconds. The cap counter resets to zero at the start of each window. Minimum 60 (one minute) when the limit is enabled.
+          example: 2592000
+      required:
+        - enabled
+        - group_cap
+        - user_cap
+        - window_seconds
+    AgentNetworkPolicyBudgetLimit:
+      type: object
+      description: Per-policy USD spend cap. `group_cap_usd` is applied to each source group independently — every group in the policy's `source_groups` gets its own bucket of this size. `user_cap_usd` is applied independently to each individual user. Caps reset to zero at the start of each window.
+      properties:
+        enabled:
+          type: boolean
+          example: true
+        group_cap_usd:
+          type: number
+          format: double
+          minimum: 0
+          description: USD allowed per source group within the window (each group has its own bucket of this size). 0 means uncapped.
+          example: 1000
+        user_cap_usd:
+          type: number
+          format: double
+          minimum: 0
+          description: USD allowed per individual user within the window. 0 means uncapped.
+          example: 100
+        window_seconds:
+          type: integer
+          format: int64
+          minimum: 60
+          description: Reset frequency in seconds. Caps reset at the start of each window. Minimum 60 (one minute) when the limit is enabled.
+          example: 2592000
+      required:
+        - enabled
+        - group_cap_usd
+        - user_cap_usd
+        - window_seconds
+    AgentNetworkPolicyLimits:
+      type: object
+      description: Token and budget caps attached directly to the policy. These compose with any guardrail-level checks.
+      properties:
+        token_limit:
+          $ref: '#/components/schemas/AgentNetworkPolicyTokenLimit'
+        budget_limit:
+          $ref: '#/components/schemas/AgentNetworkPolicyBudgetLimit'
+      required:
+        - token_limit
+        - budget_limit
+    AgentNetworkGuardrailChecks:
+      type: object
+      description: Guardrail check parameters. Each entry has an `enabled` flag plus per-check configuration; disabled entries are inert.
+      properties:
+        model_allowlist:
+          type: object
+          properties:
+            enabled:
+              type: boolean
+              example: true
+            models:
+              type: array
+              description: Allowed catalog model ids. Requests for any other model are denied.
+              items:
+                type: string
+              example: ["gpt-4o-mini", "claude-haiku-4-5"]
+          required:
+            - enabled
+            - models
+        prompt_capture:
+          type: object
+          properties:
+            enabled:
+              type: boolean
+              example: true
+            redact_pii:
+              type: boolean
+              example: true
+          required:
+            - enabled
+            - redact_pii
+      required:
+        - model_allowlist
+        - prompt_capture
+    AgentNetworkGuardrail:
+      type: object
+      properties:
+        id:
+          type: string
+          description: Guardrail ID
+          example: "ainguard_d1m3kebd9pcs0c1pnu7g"
+        name:
+          type: string
+          description: Display name for the guardrail.
+          example: "Strict — Production"
+        description:
+          type: string
+          description: Optional human-readable description.
+          example: "Tight model allowlist, PII redaction, hard monthly budget."
+        checks:
+          $ref: '#/components/schemas/AgentNetworkGuardrailChecks'
+        created_at:
+          type: string
+          format: date-time
+          description: Timestamp when the guardrail was created.
+          readOnly: true
+          example: "2026-04-26T10:30:00Z"
+        updated_at:
+          type: string
+          format: date-time
+          description: Timestamp when the guardrail was last updated.
+          readOnly: true
+          example: "2026-04-26T10:30:00Z"
+      required:
+        - id
+        - name
+        - description
+        - checks
+        - created_at
+        - updated_at
+    AgentNetworkGuardrailRequest:
+      type: object
+      properties:
+        name:
+          type: string
+          description: Display name for the guardrail.
+          example: "Strict — Production"
+        description:
+          type: string
+          description: Optional human-readable description.
+          example: "Tight model allowlist, PII redaction, hard monthly budget."
+        checks:
+          $ref: '#/components/schemas/AgentNetworkGuardrailChecks'
+      required:
+        - name
+        - checks
+    AgentNetworkConsumption:
+      type: object
+      description: One per-(dimension, window) consumption counter row. The proxy ticks one row per dimension on every served LLM request; the dashboard reads this listing to surface live counter growth.
+      properties:
+        dimension_kind:
+          type: string
+          enum: [user, group]
+          description: Whether this row counts a single end user or a single source group across every member.
+        dimension_id:
+          type: string
+          description: NetBird user id (when `dimension_kind=user`) or NetBird group id (when `dimension_kind=group`).
+          example: "grp-engineers"
+        window_seconds:
+          type: integer
+          format: int64
+          description: Length of the aligned window this counter covers, in seconds. Distinct window lengths produce independent counters even on the same dimension.
+          example: 86400
+        window_start_utc:
+          type: string
+          format: date-time
+          description: UTC start of the aligned window this counter covers. Aligned to the unix epoch so every node computes the same boundary.
+          example: "2026-05-05T12:00:00Z"
+        tokens_input:
+          type: integer
+          format: int64
+          description: Total input tokens consumed within the window.
+          example: 12000
+        tokens_output:
+          type: integer
+          format: int64
+          description: Total output tokens consumed within the window.
+          example: 6500
+        cost_usd:
+          type: number
+          format: double
+          description: Total USD spend booked against this dimension for the window.
+          example: 0.4231
+        updated_at:
+          type: string
+          format: date-time
+          description: Timestamp of the last increment recorded for this row.
+          readOnly: true
+          example: "2026-05-05T12:34:56Z"
+      required:
+        - dimension_kind
+        - dimension_id
+        - window_seconds
+        - window_start_utc
+        - tokens_input
+        - tokens_output
+        - cost_usd
+    AgentNetworkAccessLog:
+      type: object
+      description: One per-request agent-network (LLM) access log entry with flattened, queryable LLM dimensions.
+      properties:
+        id:
+          type: string
+          description: Unique identifier for the access log entry.
+          example: "ch8i4ug6lnn4g9hqv7m0"
+        service_id:
+          type: string
+          description: ID of the synthesised agent-network service that handled the request.
+        timestamp:
+          type: string
+          format: date-time
+          description: Timestamp when the request was made.
+          example: "2026-05-05T12:34:56Z"
+        status_code:
+          type: integer
+          description: HTTP status code returned upstream.
+          example: 200
+        duration_ms:
+          type: integer
+          description: Duration of the request in milliseconds.
+          example: 850
+        user_id:
+          type: string
+          description: NetBird user id of the authenticated caller, if applicable.
+        source_ip:
+          type: string
+          description: Source IP of the request. Empty when log collection is disabled.
+        method:
+          type: string
+          description: HTTP method of the request.
+          example: "POST"
+        host:
+          type: string
+          description: Upstream host the request was routed to. Empty when log collection is disabled.
+        path:
+          type: string
+          description: Request path. Empty when log collection is disabled.
+        provider:
+          type: string
+          description: LLM provider vendor (e.g. openai, anthropic).
+          example: "openai"
+        model:
+          type: string
+          description: Requested LLM model.
+          example: "gpt-4o"
+        session_id:
+          type: string
+          description: Conversation / coding-session identifier that groups related requests. Sourced from the client's session marker (e.g. OpenAI Codex client_metadata.session_id, Claude Code metadata.user_id). Empty for clients that send none.
+          example: "019eeb72-ab7c-7cd2-aa05-6e8eb834afcb"
+        resolved_provider_id:
+          type: string
+          description: NetBird agent-network provider id that served the request.
+        selected_policy_id:
+          type: string
+          description: Agent-network policy id that authorised (or denied) the request.
+        decision:
+          type: string
+          description: Policy decision for the request (e.g. allow, deny).
+          example: "allow"
+        deny_reason:
+          type: string
+          description: Raw deny reason code when the request was blocked (e.g. llm_policy.token_cap_exceeded).
+        input_tokens:
+          type: integer
+          format: int64
+          description: Input (prompt) tokens consumed.
+          example: 1200
+        output_tokens:
+          type: integer
+          format: int64
+          description: Output (completion) tokens produced.
+          example: 640
+        total_tokens:
+          type: integer
+          format: int64
+          description: Total tokens consumed.
+          example: 1840
+        cost_usd:
+          type: number
+          format: double
+          description: Estimated USD cost of the request.
+          example: 0.0231
+        stream:
+          type: boolean
+          description: Whether the request was a streaming completion.
+        group_ids:
+          type: array
+          items:
+            type: string
+          description: NetBird group ids that authorised the request (the caller's groups intersected with the policy's source groups).
+        request_prompt:
+          type: string
+          description: Captured request prompt. Present only when prompt collection is enabled.
+        response_completion:
+          type: string
+          description: Captured response completion. Present only when prompt collection is enabled.
+      required:
+        - id
+        - service_id
+        - timestamp
+        - status_code
+        - duration_ms
+        - input_tokens
+        - output_tokens
+        - total_tokens
+        - cost_usd
+    AgentNetworkAccessLogsResponse:
+      type: object
+      properties:
+        data:
+          type: array
+          description: List of agent-network access log entries.
+          items:
+            $ref: "#/components/schemas/AgentNetworkAccessLog"
+        page:
+          type: integer
+          description: Current page number.
+          example: 1
+        page_size:
+          type: integer
+          description: Number of items per page.
+          example: 50
+        total_records:
+          type: integer
+          description: Total number of log records matching the filter.
+          example: 523
+        total_pages:
+          type: integer
+          description: Total number of pages available.
+          example: 11
+      required:
+        - data
+        - page
+        - page_size
+        - total_records
+        - total_pages
+    AgentNetworkAccessLogSession:
+      type: object
+      description: A session-grouped view of agent-network access logs — all requests sharing a session id (or a single session-less request) folded into one summary plus its ordered entries.
+      properties:
+        session_id:
+          type: string
+          description: Conversation / coding-session identifier shared by the entries. Empty for a session-less (singleton) request grouped on its own id.
+          example: "019eeb72-ab7c-7cd2-aa05-6e8eb834afcb"
+        user_id:
+          type: string
+          description: NetBird user id of the session's caller.
+        group_ids:
+          type: array
+          items:
+            type: string
+          description: Union of the authorising group ids across the session's entries.
+        started_at:
+          type: string
+          format: date-time
+          description: Timestamp of the session's earliest request.
+          example: "2026-05-05T12:30:00Z"
+        ended_at:
+          type: string
+          format: date-time
+          description: Timestamp of the session's latest request.
+          example: "2026-05-05T12:34:56Z"
+        request_count:
+          type: integer
+          description: Number of requests in the session.
+          example: 7
+        input_tokens:
+          type: integer
+          format: int64
+          description: Total input (prompt) tokens across the session.
+          example: 8400
+        output_tokens:
+          type: integer
+          format: int64
+          description: Total output (completion) tokens across the session.
+          example: 4480
+        total_tokens:
+          type: integer
+          format: int64
+          description: Total tokens across the session.
+          example: 12880
+        cost_usd:
+          type: number
+          format: double
+          description: Total estimated USD cost across the session.
+          example: 0.1617
+        providers:
+          type: array
+          items:
+            type: string
+          description: Distinct LLM provider vendors seen in the session.
+        models:
+          type: array
+          items:
+            type: string
+          description: Distinct models seen in the session.
+        decision:
+          type: string
+          description: Session decision — "deny" if any request was denied, otherwise "allow".
+          example: "allow"
+        entries:
+          type: array
+          description: The session's access-log entries, oldest first.
+          items:
+            $ref: "#/components/schemas/AgentNetworkAccessLog"
+      required:
+        - started_at
+        - ended_at
+        - request_count
+        - input_tokens
+        - output_tokens
+        - total_tokens
+        - cost_usd
+        - decision
+        - entries
+    AgentNetworkAccessLogSessionsResponse:
+      type: object
+      properties:
+        data:
+          type: array
+          description: List of session-grouped agent-network access logs.
+          items:
+            $ref: "#/components/schemas/AgentNetworkAccessLogSession"
+        page:
+          type: integer
+          description: Current page number.
+          example: 1
+        page_size:
+          type: integer
+          description: Number of sessions per page.
+          example: 50
+        total_records:
+          type: integer
+          description: Total number of sessions matching the filter.
+          example: 124
+        total_pages:
+          type: integer
+          description: Total number of pages available.
+          example: 3
+      required:
+        - data
+        - page
+        - page_size
+        - total_records
+        - total_pages
+    AgentNetworkUsageBucket:
+      type: object
+      description: One aggregated agent-network usage time bucket (UTC). The bucket width is set by the request's granularity.
+      properties:
+        period_start:
+          type: string
+          description: Start of the bucket in YYYY-MM-DD (UTC) — the day, the week start (Monday), or the month start, depending on granularity.
+          example: "2026-05-05"
+        input_tokens:
+          type: integer
+          format: int64
+          description: Total input (prompt) tokens in the bucket.
+          example: 120000
+        output_tokens:
+          type: integer
+          format: int64
+          description: Total output (completion) tokens in the bucket.
+          example: 64000
+        total_tokens:
+          type: integer
+          format: int64
+          description: Total tokens in the bucket.
+          example: 184000
+        cost_usd:
+          type: number
+          format: double
+          description: Total estimated USD spend in the bucket.
+          example: 2.31
+      required:
+        - period_start
+        - input_tokens
+        - output_tokens
+        - total_tokens
+        - cost_usd
+    AgentNetworkSettings:
+      type: object
+      description: Per-account Agent Network gateway settings. One row per account; cluster and subdomain are auto-assigned on first provider create and immutable thereafter.
+      properties:
+        cluster:
+          type: string
+          description: Address of the NetBird proxy cluster fronting this account's agent-network endpoint.
+          example: "eu.proxy.netbird.io"
+        subdomain:
+          type: string
+          description: Auto-generated DNS-safe label that prefixes the cluster to form the agent-network endpoint.
+          example: "violet"
+        endpoint:
+          type: string
+          description: Bare hostname agents call for this account, computed as `<subdomain>.<cluster>`.
+          example: "violet.eu.proxy.netbird.io"
+        enable_log_collection:
+          type: boolean
+          description: Whether per-request access-log entries are collected for this account's agent-network traffic.
+          example: false
+        enable_prompt_collection:
+          type: boolean
+          description: Master switch for request/response prompt capture. Capture runs only when this is on AND a policy guardrail also enables it.
+          example: false
+        redact_pii:
+          type: boolean
+          description: Whether captured prompts have PII redacted. Effective redaction is the OR of this and any policy guardrail's redact setting.
+          example: false
+        access_log_retention_days:
+          type: integer
+          description: Days to retain full access-log rows; older rows are swept. 0 or less means keep indefinitely. Usage records are retained independently.
+          example: 30
+        created_at:
+          type: string
+          format: date-time
+          description: Timestamp when the settings row was created.
+          readOnly: true
+          example: "2026-04-26T10:30:00Z"
+        updated_at:
+          type: string
+          format: date-time
+          description: Timestamp when the settings row was last updated.
+          readOnly: true
+          example: "2026-04-26T10:30:00Z"
+      required:
+        - cluster
+        - subdomain
+        - endpoint
+        - enable_log_collection
+        - enable_prompt_collection
+        - redact_pii
+        - created_at
+        - updated_at
+    AgentNetworkSettingsRequest:
+      type: object
+      description: Mutable account-level Agent Network settings. Cluster and subdomain are immutable and not accepted here.
+      properties:
+        enable_log_collection:
+          type: boolean
+          description: Whether per-request access-log entries are collected for this account's agent-network traffic.
+          example: true
+        enable_prompt_collection:
+          type: boolean
+          description: Master switch for request/response prompt capture.
+          example: true
+        redact_pii:
+          type: boolean
+          description: Whether captured prompts have PII redacted.
+          example: true
+        access_log_retention_days:
+          type: integer
+          description: Days to retain full access-log rows; older rows are swept. 0 or less means keep indefinitely.
+          example: 30
+      required:
+        - enable_log_collection
+        - enable_prompt_collection
+        - redact_pii
+    AgentNetworkBudgetRule:
+      type: object
+      description: Account-level budget rule. A limit-only rule bound to groups and/or users that applies across all policies as a min-wins ceiling. Empty targets means it applies to every caller.
+      properties:
+        id:
+          type: string
+          description: Budget rule ID.
+          example: "ainbud_d1m3kebd9pcs0c1pnu7g"
+        name:
+          type: string
+          description: Display name for the budget rule.
+          example: "Org monthly ceiling"
+        enabled:
+          type: boolean
+          description: Whether the rule is enforced.
+          example: true
+        target_groups:
+          type: array
+          description: NetBird group ids the rule binds. Empty plus empty target_users means account-wide.
+          items:
+            type: string
+          example: ["ch8vp3o6lnna9hg0sd8g"]
+        target_users:
+          type: array
+          description: NetBird user ids the rule binds directly.
+          items:
+            type: string
+          example: []
+        limits:
+          $ref: '#/components/schemas/AgentNetworkPolicyLimits'
+        created_at:
+          type: string
+          format: date-time
+          readOnly: true
+          example: "2026-04-26T10:30:00Z"
+        updated_at:
+          type: string
+          format: date-time
+          readOnly: true
+          example: "2026-04-26T10:30:00Z"
+      required:
+        - id
+        - name
+        - enabled
+        - target_groups
+        - target_users
+        - limits
+        - created_at
+        - updated_at
+    AgentNetworkBudgetRuleRequest:
+      type: object
+      properties:
+        name:
+          type: string
+          description: Display name for the budget rule.
+          example: "Org monthly ceiling"
+        enabled:
+          type: boolean
+          description: Whether the rule is enforced. Defaults to true on create.
+          example: true
+        target_groups:
+          type: array
+          description: NetBird group ids the rule binds. Empty plus empty target_users means account-wide.
+          items:
+            type: string
+          example: ["ch8vp3o6lnna9hg0sd8g"]
+        target_users:
+          type: array
+          description: NetBird user ids the rule binds directly.
+          items:
+            type: string
+          example: []
+        limits:
+          $ref: '#/components/schemas/AgentNetworkPolicyLimits'
+      required:
+        - name
+        - limits
   responses:
     not_found:
       description: Resource not found
@@ -12068,3 +13116,1016 @@ paths:
           "$ref": "#/components/responses/not_found"
         '500':
           "$ref": "#/components/responses/internal_error"
+  /api/agent-network/access-logs:
+    get:
+      summary: List Agent Network access logs
+      description: Returns a paginated, server-side-filtered list of agent-network (LLM) access log entries. Available only when the account has log collection enabled; otherwise entries are not retained.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      parameters:
+        - in: query
+          name: page
+          schema:
+            type: integer
+            default: 1
+            minimum: 1
+          description: Page number for pagination (1-indexed).
+        - in: query
+          name: page_size
+          schema:
+            type: integer
+            default: 50
+            minimum: 1
+            maximum: 100
+          description: Number of items per page (max 100).
+        - in: query
+          name: sort_by
+          schema:
+            type: string
+            enum: [timestamp, model, provider, status_code, duration, cost_usd, total_tokens, user_id, decision]
+            default: timestamp
+          description: Field to sort by.
+        - in: query
+          name: sort_order
+          schema:
+            type: string
+            enum: [asc, desc]
+            default: desc
+          description: Sort order (ascending or descending).
+        - in: query
+          name: search
+          schema:
+            type: string
+          description: General search across log ID, host, path, model, and user email/name.
+        - in: query
+          name: user_id
+          schema:
+            type: string
+          description: Filter by authenticated user ID.
+        - in: query
+          name: session_id
+          schema:
+            type: string
+          description: Filter to a single conversation / coding session id (groups all requests of one session).
+        - in: query
+          name: group_id
+          schema:
+            type: array
+            items:
+              type: string
+          style: form
+          explode: true
+          description: Filter by authorising group id. Repeat for multiple (matches any).
+        - in: query
+          name: provider_id
+          schema:
+            type: array
+            items:
+              type: string
+          style: form
+          explode: true
+          description: Filter by resolved provider id. Repeat for multiple (matches any).
+        - in: query
+          name: model
+          schema:
+            type: array
+            items:
+              type: string
+          style: form
+          explode: true
+          description: Filter by model. Repeat for multiple (matches any).
+        - in: query
+          name: decision
+          schema:
+            type: string
+          description: Filter by policy decision (e.g. allow, deny).
+        - in: query
+          name: path
+          schema:
+            type: string
+          description: Filter by request path prefix (matches entries whose path starts with this value).
+        - in: query
+          name: start_date
+          schema:
+            type: string
+            format: date-time
+          description: Filter by timestamp >= start_date (RFC3339 format).
+        - in: query
+          name: end_date
+          schema:
+            type: string
+            format: date-time
+          description: Filter by timestamp <= end_date (RFC3339 format).
+      responses:
+        '200':
+          description: Paginated list of agent-network access logs
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AgentNetworkAccessLogsResponse"
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '500':
+          "$ref": "#/components/responses/internal_error"
+  /api/agent-network/access-log-sessions:
+    get:
+      summary: List Agent Network access logs grouped by session
+      description: Returns a paginated, server-side-filtered list of agent-network (LLM) access logs grouped by session. The page unit is a session (total_records counts sessions); each session carries an aggregate summary and its ordered entries. Requests the client sent no session id for each form their own singleton group. Accepts the same filters as the flat access-logs endpoint. Available only when the account has log collection enabled.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      parameters:
+        - in: query
+          name: page
+          schema:
+            type: integer
+            default: 1
+            minimum: 1
+          description: Page number for pagination (1-indexed).
+        - in: query
+          name: page_size
+          schema:
+            type: integer
+            default: 50
+            minimum: 1
+            maximum: 100
+          description: Number of sessions per page (max 100).
+        - in: query
+          name: sort_by
+          schema:
+            type: string
+            enum: [timestamp, started_at, cost_usd, total_tokens, duration, request_count, status_code, user_id, decision]
+            default: timestamp
+          description: Session-level field to sort by. "timestamp" is the session's last activity, "started_at" its first.
+        - in: query
+          name: sort_order
+          schema:
+            type: string
+            enum: [asc, desc]
+            default: desc
+          description: Sort order (ascending or descending).
+        - in: query
+          name: search
+          schema:
+            type: string
+          description: General search across log ID, host, path, model, and user email/name.
+        - in: query
+          name: user_id
+          schema:
+            type: string
+          description: Filter by authenticated user ID.
+        - in: query
+          name: session_id
+          schema:
+            type: string
+          description: Filter to a single conversation / coding session id.
+        - in: query
+          name: group_id
+          schema:
+            type: array
+            items:
+              type: string
+          style: form
+          explode: true
+          description: Filter by authorising group id. Repeat for multiple (matches any).
+        - in: query
+          name: provider_id
+          schema:
+            type: array
+            items:
+              type: string
+          style: form
+          explode: true
+          description: Filter by resolved provider id. Repeat for multiple (matches any).
+        - in: query
+          name: model
+          schema:
+            type: array
+            items:
+              type: string
+          style: form
+          explode: true
+          description: Filter by model. Repeat for multiple (matches any).
+        - in: query
+          name: decision
+          schema:
+            type: string
+          description: Filter by policy decision (e.g. allow, deny).
+        - in: query
+          name: path
+          schema:
+            type: string
+          description: Filter by request path prefix (matches entries whose path starts with this value).
+        - in: query
+          name: start_date
+          schema:
+            type: string
+            format: date-time
+          description: Filter by timestamp >= start_date (RFC3339 format).
+        - in: query
+          name: end_date
+          schema:
+            type: string
+            format: date-time
+          description: Filter by timestamp <= end_date (RFC3339 format).
+      responses:
+        '200':
+          description: Paginated list of session-grouped agent-network access logs
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AgentNetworkAccessLogSessionsResponse"
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '500':
+          "$ref": "#/components/responses/internal_error"
+  /api/agent-network/usage/overview:
+    get:
+      summary: Agent Network usage overview
+      description: Returns agent-network token and cost usage aggregated into time buckets, server-side filtered. Usage is always collected (independent of log collection).
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      parameters:
+        - in: query
+          name: granularity
+          schema:
+            type: string
+            enum: [day, week, month]
+            default: day
+          description: Time bucket width. Defaults to day.
+        - in: query
+          name: start_date
+          schema:
+            type: string
+            format: date-time
+          description: Filter by timestamp >= start_date (RFC3339 format).
+        - in: query
+          name: end_date
+          schema:
+            type: string
+            format: date-time
+          description: Filter by timestamp <= end_date (RFC3339 format).
+        - in: query
+          name: user_id
+          schema:
+            type: string
+          description: Filter by user ID.
+        - in: query
+          name: session_id
+          schema:
+            type: string
+          description: Filter to a single conversation / coding session id.
+        - in: query
+          name: group_id
+          schema:
+            type: array
+            items:
+              type: string
+          style: form
+          explode: true
+          description: Filter by authorising group id. Repeat for multiple (matches any).
+        - in: query
+          name: provider_id
+          schema:
+            type: array
+            items:
+              type: string
+          style: form
+          explode: true
+          description: Filter by resolved provider id. Repeat for multiple (matches any).
+        - in: query
+          name: model
+          schema:
+            type: array
+            items:
+              type: string
+          style: form
+          explode: true
+          description: Filter by model. Repeat for multiple (matches any).
+      responses:
+        '200':
+          description: A JSON array of aggregated usage buckets, ordered oldest-first.
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/AgentNetworkUsageBucket'
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '500':
+          "$ref": "#/components/responses/internal_error"
+  /api/agent-network/consumption:
+    get:
+      summary: List Agent Network consumption counters
+      description: Returns every per-(dimension, window) consumption counter recorded for the account, ordered window-newest-first. Empty list when nothing has been consumed yet.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      responses:
+        '200':
+          description: A JSON Array of consumption counter rows
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/AgentNetworkConsumption'
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '500':
+          "$ref": "#/components/responses/internal_error"
+  /api/agent-network/settings:
+    get:
+      summary: Retrieve Agent Network settings
+      description: Returns the per-account Agent Network gateway settings (cluster, subdomain, endpoint). Returns 404 when no provider has been created yet — settings are lazily bootstrapped on first provider create.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      responses:
+        '200':
+          description: Agent Network settings for the account
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AgentNetworkSettings'
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '404':
+          "$ref": "#/components/responses/not_found"
+        '500':
+          "$ref": "#/components/responses/internal_error"
+    put:
+      summary: Update Agent Network settings
+      description: Updates the mutable account-level Agent Network settings (collection toggles). Cluster and subdomain are immutable and ignored if sent. Returns 404 when settings have not been bootstrapped (no provider created yet).
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      requestBody:
+        description: Settings update request
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/AgentNetworkSettingsRequest'
+      responses:
+        '200':
+          description: Updated Agent Network settings
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AgentNetworkSettings'
+        '400':
+          "$ref": "#/components/responses/bad_request"
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '404':
+          "$ref": "#/components/responses/not_found"
+        '500':
+          "$ref": "#/components/responses/internal_error"
+  /api/agent-network/budget-rules:
+    get:
+      summary: List all Agent Network budget rules
+      description: Returns all account-level budget rules.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      responses:
+        '200':
+          description: A JSON Array of Agent Network budget rules
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/AgentNetworkBudgetRule'
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '500':
+          "$ref": "#/components/responses/internal_error"
+    post:
+      summary: Create an Agent Network budget rule
+      description: Creates a new account-level budget rule.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      requestBody:
+        description: New budget rule request
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/AgentNetworkBudgetRuleRequest'
+      responses:
+        '200':
+          description: Budget rule created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AgentNetworkBudgetRule'
+        '400':
+          "$ref": "#/components/responses/bad_request"
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '500':
+          "$ref": "#/components/responses/internal_error"
+  /api/agent-network/budget-rules/{ruleId}:
+    get:
+      summary: Retrieve an Agent Network budget rule
+      description: Get a specific account-level budget rule.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      parameters:
+        - in: path
+          name: ruleId
+          required: true
+          schema:
+            type: string
+          description: The unique identifier of a budget rule
+      responses:
+        '200':
+          description: An Agent Network budget rule object
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AgentNetworkBudgetRule'
+        '400':
+          "$ref": "#/components/responses/bad_request"
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '404':
+          "$ref": "#/components/responses/not_found"
+        '500':
+          "$ref": "#/components/responses/internal_error"
+    put:
+      summary: Update an Agent Network budget rule
+      description: Updates an existing account-level budget rule.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      parameters:
+        - in: path
+          name: ruleId
+          required: true
+          schema:
+            type: string
+          description: The unique identifier of a budget rule
+      requestBody:
+        description: Budget rule update request
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/AgentNetworkBudgetRuleRequest'
+      responses:
+        '200':
+          description: Budget rule updated
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AgentNetworkBudgetRule'
+        '400':
+          "$ref": "#/components/responses/bad_request"
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '404':
+          "$ref": "#/components/responses/not_found"
+        '500':
+          "$ref": "#/components/responses/internal_error"
+    delete:
+      summary: Delete an Agent Network budget rule
+      description: Deletes an account-level budget rule.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      parameters:
+        - in: path
+          name: ruleId
+          required: true
+          schema:
+            type: string
+          description: The unique identifier of a budget rule
+      responses:
+        '200':
+          description: Budget rule deleted
+          content:
+            application/json:
+              schema:
+                type: object
+        '400':
+          "$ref": "#/components/responses/bad_request"
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '404':
+          "$ref": "#/components/responses/not_found"
+        '500':
+          "$ref": "#/components/responses/internal_error"
+  /api/agent-network/catalog/providers:
+    get:
+      summary: List Agent Network catalog providers
+      description: Returns the static catalog of supported Agent Network providers (OpenAI, Anthropic, …) along with their default upstream host, auth header template, brand color, and known models.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      responses:
+        '200':
+          description: A JSON Array of catalog providers
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/AgentNetworkCatalogProvider'
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '500':
+          "$ref": "#/components/responses/internal_error"
+  /api/agent-network/providers:
+    get:
+      summary: List all Agent Network Providers
+      description: Returns a list of all Agent Network AI providers configured for the account.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      responses:
+        '200':
+          description: A JSON Array of Agent Network providers
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/AgentNetworkProvider'
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '500':
+          "$ref": "#/components/responses/internal_error"
+    post:
+      summary: Create an Agent Network Provider
+      description: Connects a new Agent Network AI provider for the account.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      requestBody:
+        description: New provider request
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/AgentNetworkProviderRequest'
+      responses:
+        '200':
+          description: Provider created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AgentNetworkProvider'
+        '400':
+          "$ref": "#/components/responses/bad_request"
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '409':
+          "$ref": "#/components/responses/conflict"
+        '500':
+          "$ref": "#/components/responses/internal_error"
+  /api/agent-network/providers/{providerId}:
+    get:
+      summary: Retrieve an Agent Network Provider
+      description: Get information about a specific Agent Network AI provider.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      parameters:
+        - in: path
+          name: providerId
+          required: true
+          schema:
+            type: string
+          description: The unique identifier of an Agent Network provider
+      responses:
+        '200':
+          description: An Agent Network provider object
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AgentNetworkProvider'
+        '400':
+          "$ref": "#/components/responses/bad_request"
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '404':
+          "$ref": "#/components/responses/not_found"
+        '500':
+          "$ref": "#/components/responses/internal_error"
+    put:
+      summary: Update an Agent Network Provider
+      description: Update an existing Agent Network AI provider.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      parameters:
+        - in: path
+          name: providerId
+          required: true
+          schema:
+            type: string
+          description: The unique identifier of an Agent Network provider
+      requestBody:
+        description: Provider update request
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/AgentNetworkProviderRequest'
+      responses:
+        '200':
+          description: Provider updated
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AgentNetworkProvider'
+        '400':
+          "$ref": "#/components/responses/bad_request"
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '404':
+          "$ref": "#/components/responses/not_found"
+        '409':
+          "$ref": "#/components/responses/conflict"
+        '500':
+          "$ref": "#/components/responses/internal_error"
+    delete:
+      summary: Delete an Agent Network Provider
+      description: Delete an existing Agent Network AI provider.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      parameters:
+        - in: path
+          name: providerId
+          required: true
+          schema:
+            type: string
+          description: The unique identifier of an Agent Network provider
+      responses:
+        '200':
+          description: Provider deleted
+        '400':
+          "$ref": "#/components/responses/bad_request"
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '404':
+          "$ref": "#/components/responses/not_found"
+        '500':
+          "$ref": "#/components/responses/internal_error"
+  /api/agent-network/policies:
+    get:
+      summary: List all Agent Network Policies
+      description: Returns a list of all Agent Network policies for the account.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      responses:
+        '200':
+          description: A JSON Array of Agent Network policies
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/AgentNetworkPolicy'
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '500':
+          "$ref": "#/components/responses/internal_error"
+    post:
+      summary: Create an Agent Network Policy
+      description: Creates a new Agent Network policy binding source groups to destination providers, optionally enforced by guardrails.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      requestBody:
+        description: New policy request
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/AgentNetworkPolicyRequest'
+      responses:
+        '200':
+          description: Policy created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AgentNetworkPolicy'
+        '400':
+          "$ref": "#/components/responses/bad_request"
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '409':
+          "$ref": "#/components/responses/conflict"
+        '500':
+          "$ref": "#/components/responses/internal_error"
+  /api/agent-network/policies/{policyId}:
+    get:
+      summary: Retrieve an Agent Network Policy
+      description: Get information about a specific Agent Network policy.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      parameters:
+        - in: path
+          name: policyId
+          required: true
+          schema:
+            type: string
+          description: The unique identifier of an Agent Network policy
+      responses:
+        '200':
+          description: An Agent Network policy object
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AgentNetworkPolicy'
+        '400':
+          "$ref": "#/components/responses/bad_request"
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '404':
+          "$ref": "#/components/responses/not_found"
+        '500':
+          "$ref": "#/components/responses/internal_error"
+    put:
+      summary: Update an Agent Network Policy
+      description: Update an existing Agent Network policy.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      parameters:
+        - in: path
+          name: policyId
+          required: true
+          schema:
+            type: string
+          description: The unique identifier of an Agent Network policy
+      requestBody:
+        description: Policy update request
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/AgentNetworkPolicyRequest'
+      responses:
+        '200':
+          description: Policy updated
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AgentNetworkPolicy'
+        '400':
+          "$ref": "#/components/responses/bad_request"
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '404':
+          "$ref": "#/components/responses/not_found"
+        '409':
+          "$ref": "#/components/responses/conflict"
+        '500':
+          "$ref": "#/components/responses/internal_error"
+    delete:
+      summary: Delete an Agent Network Policy
+      description: Delete an existing Agent Network policy.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      parameters:
+        - in: path
+          name: policyId
+          required: true
+          schema:
+            type: string
+          description: The unique identifier of an Agent Network policy
+      responses:
+        '200':
+          description: Policy deleted
+        '400':
+          "$ref": "#/components/responses/bad_request"
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '404':
+          "$ref": "#/components/responses/not_found"
+        '500':
+          "$ref": "#/components/responses/internal_error"
+  /api/agent-network/guardrails:
+    get:
+      summary: List all Agent Network Guardrails
+      description: Returns a list of all Agent Network guardrails for the account.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      responses:
+        '200':
+          description: A JSON Array of Agent Network guardrails
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/AgentNetworkGuardrail'
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '500':
+          "$ref": "#/components/responses/internal_error"
+    post:
+      summary: Create an Agent Network Guardrail
+      description: Creates a new Agent Network guardrail that can be attached to one or more policies.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      requestBody:
+        description: New guardrail request
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/AgentNetworkGuardrailRequest'
+      responses:
+        '200':
+          description: Guardrail created
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AgentNetworkGuardrail'
+        '400':
+          "$ref": "#/components/responses/bad_request"
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '409':
+          "$ref": "#/components/responses/conflict"
+        '500':
+          "$ref": "#/components/responses/internal_error"
+  /api/agent-network/guardrails/{guardrailId}:
+    get:
+      summary: Retrieve an Agent Network Guardrail
+      description: Get information about a specific Agent Network guardrail.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      parameters:
+        - in: path
+          name: guardrailId
+          required: true
+          schema:
+            type: string
+          description: The unique identifier of an Agent Network guardrail
+      responses:
+        '200':
+          description: An Agent Network guardrail object
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AgentNetworkGuardrail'
+        '400':
+          "$ref": "#/components/responses/bad_request"
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '404':
+          "$ref": "#/components/responses/not_found"
+        '500':
+          "$ref": "#/components/responses/internal_error"
+    put:
+      summary: Update an Agent Network Guardrail
+      description: Update an existing Agent Network guardrail.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      parameters:
+        - in: path
+          name: guardrailId
+          required: true
+          schema:
+            type: string
+          description: The unique identifier of an Agent Network guardrail
+      requestBody:
+        description: Guardrail update request
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/AgentNetworkGuardrailRequest'
+      responses:
+        '200':
+          description: Guardrail updated
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/AgentNetworkGuardrail'
+        '400':
+          "$ref": "#/components/responses/bad_request"
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '404':
+          "$ref": "#/components/responses/not_found"
+        '409':
+          "$ref": "#/components/responses/conflict"
+        '500':
+          "$ref": "#/components/responses/internal_error"
+    delete:
+      summary: Delete an Agent Network Guardrail
+      description: Delete an existing Agent Network guardrail.
+      tags: [ Agent Network ]
+      security:
+        - BearerAuth: [ ]
+        - TokenAuth: [ ]
+      parameters:
+        - in: path
+          name: guardrailId
+          required: true
+          schema:
+            type: string
+          description: The unique identifier of an Agent Network guardrail
+      responses:
+        '200':
+          description: Guardrail deleted
+        '400':
+          "$ref": "#/components/responses/bad_request"
+        '401':
+          "$ref": "#/components/responses/requires_authentication"
+        '403':
+          "$ref": "#/components/responses/forbidden"
+        '404':
+          "$ref": "#/components/responses/not_found"
+        '500':
+          "$ref": "#/components/responses/internal_error"
diff --git a/shared/management/http/api/types.gen.go b/shared/management/http/api/types.gen.go
index ed5060a86..7ea9514c0 100644
--- a/shared/management/http/api/types.gen.go
+++ b/shared/management/http/api/types.gen.go
@@ -38,6 +38,45 @@ func (e AccessRestrictionsCrowdsecMode) Valid() bool {
 	}
 }
 
+// Defines values for AgentNetworkCatalogProviderKind.
+const (
+	AgentNetworkCatalogProviderKindCustom   AgentNetworkCatalogProviderKind = "custom"
+	AgentNetworkCatalogProviderKindGateway  AgentNetworkCatalogProviderKind = "gateway"
+	AgentNetworkCatalogProviderKindProvider AgentNetworkCatalogProviderKind = "provider"
+)
+
+// Valid indicates whether the value is a known member of the AgentNetworkCatalogProviderKind enum.
+func (e AgentNetworkCatalogProviderKind) Valid() bool {
+	switch e {
+	case AgentNetworkCatalogProviderKindCustom:
+		return true
+	case AgentNetworkCatalogProviderKindGateway:
+		return true
+	case AgentNetworkCatalogProviderKindProvider:
+		return true
+	default:
+		return false
+	}
+}
+
+// Defines values for AgentNetworkConsumptionDimensionKind.
+const (
+	AgentNetworkConsumptionDimensionKindGroup AgentNetworkConsumptionDimensionKind = "group"
+	AgentNetworkConsumptionDimensionKindUser  AgentNetworkConsumptionDimensionKind = "user"
+)
+
+// Valid indicates whether the value is a known member of the AgentNetworkConsumptionDimensionKind enum.
+func (e AgentNetworkConsumptionDimensionKind) Valid() bool {
+	switch e {
+	case AgentNetworkConsumptionDimensionKindGroup:
+		return true
+	case AgentNetworkConsumptionDimensionKindUser:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for CreateAzureIntegrationRequestHost.
 const (
 	CreateAzureIntegrationRequestHostMicrosoftCom CreateAzureIntegrationRequestHost = "microsoft.com"
@@ -1163,6 +1202,141 @@ func (e WorkloadType) Valid() bool {
 	}
 }
 
+// Defines values for GetApiAgentNetworkAccessLogSessionsParamsSortBy.
+const (
+	GetApiAgentNetworkAccessLogSessionsParamsSortByCostUsd      GetApiAgentNetworkAccessLogSessionsParamsSortBy = "cost_usd"
+	GetApiAgentNetworkAccessLogSessionsParamsSortByDecision     GetApiAgentNetworkAccessLogSessionsParamsSortBy = "decision"
+	GetApiAgentNetworkAccessLogSessionsParamsSortByDuration     GetApiAgentNetworkAccessLogSessionsParamsSortBy = "duration"
+	GetApiAgentNetworkAccessLogSessionsParamsSortByRequestCount GetApiAgentNetworkAccessLogSessionsParamsSortBy = "request_count"
+	GetApiAgentNetworkAccessLogSessionsParamsSortByStartedAt    GetApiAgentNetworkAccessLogSessionsParamsSortBy = "started_at"
+	GetApiAgentNetworkAccessLogSessionsParamsSortByStatusCode   GetApiAgentNetworkAccessLogSessionsParamsSortBy = "status_code"
+	GetApiAgentNetworkAccessLogSessionsParamsSortByTimestamp    GetApiAgentNetworkAccessLogSessionsParamsSortBy = "timestamp"
+	GetApiAgentNetworkAccessLogSessionsParamsSortByTotalTokens  GetApiAgentNetworkAccessLogSessionsParamsSortBy = "total_tokens"
+	GetApiAgentNetworkAccessLogSessionsParamsSortByUserId       GetApiAgentNetworkAccessLogSessionsParamsSortBy = "user_id"
+)
+
+// Valid indicates whether the value is a known member of the GetApiAgentNetworkAccessLogSessionsParamsSortBy enum.
+func (e GetApiAgentNetworkAccessLogSessionsParamsSortBy) Valid() bool {
+	switch e {
+	case GetApiAgentNetworkAccessLogSessionsParamsSortByCostUsd:
+		return true
+	case GetApiAgentNetworkAccessLogSessionsParamsSortByDecision:
+		return true
+	case GetApiAgentNetworkAccessLogSessionsParamsSortByDuration:
+		return true
+	case GetApiAgentNetworkAccessLogSessionsParamsSortByRequestCount:
+		return true
+	case GetApiAgentNetworkAccessLogSessionsParamsSortByStartedAt:
+		return true
+	case GetApiAgentNetworkAccessLogSessionsParamsSortByStatusCode:
+		return true
+	case GetApiAgentNetworkAccessLogSessionsParamsSortByTimestamp:
+		return true
+	case GetApiAgentNetworkAccessLogSessionsParamsSortByTotalTokens:
+		return true
+	case GetApiAgentNetworkAccessLogSessionsParamsSortByUserId:
+		return true
+	default:
+		return false
+	}
+}
+
+// Defines values for GetApiAgentNetworkAccessLogSessionsParamsSortOrder.
+const (
+	GetApiAgentNetworkAccessLogSessionsParamsSortOrderAsc  GetApiAgentNetworkAccessLogSessionsParamsSortOrder = "asc"
+	GetApiAgentNetworkAccessLogSessionsParamsSortOrderDesc GetApiAgentNetworkAccessLogSessionsParamsSortOrder = "desc"
+)
+
+// Valid indicates whether the value is a known member of the GetApiAgentNetworkAccessLogSessionsParamsSortOrder enum.
+func (e GetApiAgentNetworkAccessLogSessionsParamsSortOrder) Valid() bool {
+	switch e {
+	case GetApiAgentNetworkAccessLogSessionsParamsSortOrderAsc:
+		return true
+	case GetApiAgentNetworkAccessLogSessionsParamsSortOrderDesc:
+		return true
+	default:
+		return false
+	}
+}
+
+// Defines values for GetApiAgentNetworkAccessLogsParamsSortBy.
+const (
+	GetApiAgentNetworkAccessLogsParamsSortByCostUsd     GetApiAgentNetworkAccessLogsParamsSortBy = "cost_usd"
+	GetApiAgentNetworkAccessLogsParamsSortByDecision    GetApiAgentNetworkAccessLogsParamsSortBy = "decision"
+	GetApiAgentNetworkAccessLogsParamsSortByDuration    GetApiAgentNetworkAccessLogsParamsSortBy = "duration"
+	GetApiAgentNetworkAccessLogsParamsSortByModel       GetApiAgentNetworkAccessLogsParamsSortBy = "model"
+	GetApiAgentNetworkAccessLogsParamsSortByProvider    GetApiAgentNetworkAccessLogsParamsSortBy = "provider"
+	GetApiAgentNetworkAccessLogsParamsSortByStatusCode  GetApiAgentNetworkAccessLogsParamsSortBy = "status_code"
+	GetApiAgentNetworkAccessLogsParamsSortByTimestamp   GetApiAgentNetworkAccessLogsParamsSortBy = "timestamp"
+	GetApiAgentNetworkAccessLogsParamsSortByTotalTokens GetApiAgentNetworkAccessLogsParamsSortBy = "total_tokens"
+	GetApiAgentNetworkAccessLogsParamsSortByUserId      GetApiAgentNetworkAccessLogsParamsSortBy = "user_id"
+)
+
+// Valid indicates whether the value is a known member of the GetApiAgentNetworkAccessLogsParamsSortBy enum.
+func (e GetApiAgentNetworkAccessLogsParamsSortBy) Valid() bool {
+	switch e {
+	case GetApiAgentNetworkAccessLogsParamsSortByCostUsd:
+		return true
+	case GetApiAgentNetworkAccessLogsParamsSortByDecision:
+		return true
+	case GetApiAgentNetworkAccessLogsParamsSortByDuration:
+		return true
+	case GetApiAgentNetworkAccessLogsParamsSortByModel:
+		return true
+	case GetApiAgentNetworkAccessLogsParamsSortByProvider:
+		return true
+	case GetApiAgentNetworkAccessLogsParamsSortByStatusCode:
+		return true
+	case GetApiAgentNetworkAccessLogsParamsSortByTimestamp:
+		return true
+	case GetApiAgentNetworkAccessLogsParamsSortByTotalTokens:
+		return true
+	case GetApiAgentNetworkAccessLogsParamsSortByUserId:
+		return true
+	default:
+		return false
+	}
+}
+
+// Defines values for GetApiAgentNetworkAccessLogsParamsSortOrder.
+const (
+	GetApiAgentNetworkAccessLogsParamsSortOrderAsc  GetApiAgentNetworkAccessLogsParamsSortOrder = "asc"
+	GetApiAgentNetworkAccessLogsParamsSortOrderDesc GetApiAgentNetworkAccessLogsParamsSortOrder = "desc"
+)
+
+// Valid indicates whether the value is a known member of the GetApiAgentNetworkAccessLogsParamsSortOrder enum.
+func (e GetApiAgentNetworkAccessLogsParamsSortOrder) Valid() bool {
+	switch e {
+	case GetApiAgentNetworkAccessLogsParamsSortOrderAsc:
+		return true
+	case GetApiAgentNetworkAccessLogsParamsSortOrderDesc:
+		return true
+	default:
+		return false
+	}
+}
+
+// Defines values for GetApiAgentNetworkUsageOverviewParamsGranularity.
+const (
+	GetApiAgentNetworkUsageOverviewParamsGranularityDay   GetApiAgentNetworkUsageOverviewParamsGranularity = "day"
+	GetApiAgentNetworkUsageOverviewParamsGranularityMonth GetApiAgentNetworkUsageOverviewParamsGranularity = "month"
+	GetApiAgentNetworkUsageOverviewParamsGranularityWeek  GetApiAgentNetworkUsageOverviewParamsGranularity = "week"
+)
+
+// Valid indicates whether the value is a known member of the GetApiAgentNetworkUsageOverviewParamsGranularity enum.
+func (e GetApiAgentNetworkUsageOverviewParamsGranularity) Valid() bool {
+	switch e {
+	case GetApiAgentNetworkUsageOverviewParamsGranularityDay:
+		return true
+	case GetApiAgentNetworkUsageOverviewParamsGranularityMonth:
+		return true
+	case GetApiAgentNetworkUsageOverviewParamsGranularityWeek:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for GetApiEventsNetworkTrafficParamsType.
 const (
 	GetApiEventsNetworkTrafficParamsTypeTYPEDROP    GetApiEventsNetworkTrafficParamsType = "TYPE_DROP"
@@ -1541,6 +1715,627 @@ type AccountSettings struct {
 	RoutingPeerDnsResolutionEnabled *bool `json:"routing_peer_dns_resolution_enabled,omitempty"`
 }
 
+// AgentNetworkAccessLog One per-request agent-network (LLM) access log entry with flattened, queryable LLM dimensions.
+type AgentNetworkAccessLog struct {
+	// CostUsd Estimated USD cost of the request.
+	CostUsd float64 `json:"cost_usd"`
+
+	// Decision Policy decision for the request (e.g. allow, deny).
+	Decision *string `json:"decision,omitempty"`
+
+	// DenyReason Raw deny reason code when the request was blocked (e.g. llm_policy.token_cap_exceeded).
+	DenyReason *string `json:"deny_reason,omitempty"`
+
+	// DurationMs Duration of the request in milliseconds.
+	DurationMs int `json:"duration_ms"`
+
+	// GroupIds NetBird group ids that authorised the request (the caller's groups intersected with the policy's source groups).
+	GroupIds *[]string `json:"group_ids,omitempty"`
+
+	// Host Upstream host the request was routed to. Empty when log collection is disabled.
+	Host *string `json:"host,omitempty"`
+
+	// Id Unique identifier for the access log entry.
+	Id string `json:"id"`
+
+	// InputTokens Input (prompt) tokens consumed.
+	InputTokens int64 `json:"input_tokens"`
+
+	// Method HTTP method of the request.
+	Method *string `json:"method,omitempty"`
+
+	// Model Requested LLM model.
+	Model *string `json:"model,omitempty"`
+
+	// OutputTokens Output (completion) tokens produced.
+	OutputTokens int64 `json:"output_tokens"`
+
+	// Path Request path. Empty when log collection is disabled.
+	Path *string `json:"path,omitempty"`
+
+	// Provider LLM provider vendor (e.g. openai, anthropic).
+	Provider *string `json:"provider,omitempty"`
+
+	// RequestPrompt Captured request prompt. Present only when prompt collection is enabled.
+	RequestPrompt *string `json:"request_prompt,omitempty"`
+
+	// ResolvedProviderId NetBird agent-network provider id that served the request.
+	ResolvedProviderId *string `json:"resolved_provider_id,omitempty"`
+
+	// ResponseCompletion Captured response completion. Present only when prompt collection is enabled.
+	ResponseCompletion *string `json:"response_completion,omitempty"`
+
+	// SelectedPolicyId Agent-network policy id that authorised (or denied) the request.
+	SelectedPolicyId *string `json:"selected_policy_id,omitempty"`
+
+	// ServiceId ID of the synthesised agent-network service that handled the request.
+	ServiceId string `json:"service_id"`
+
+	// SessionId Conversation / coding-session identifier that groups related requests. Sourced from the client's session marker (e.g. OpenAI Codex client_metadata.session_id, Claude Code metadata.user_id). Empty for clients that send none.
+	SessionId *string `json:"session_id,omitempty"`
+
+	// SourceIp Source IP of the request. Empty when log collection is disabled.
+	SourceIp *string `json:"source_ip,omitempty"`
+
+	// StatusCode HTTP status code returned upstream.
+	StatusCode int `json:"status_code"`
+
+	// Stream Whether the request was a streaming completion.
+	Stream *bool `json:"stream,omitempty"`
+
+	// Timestamp Timestamp when the request was made.
+	Timestamp time.Time `json:"timestamp"`
+
+	// TotalTokens Total tokens consumed.
+	TotalTokens int64 `json:"total_tokens"`
+
+	// UserId NetBird user id of the authenticated caller, if applicable.
+	UserId *string `json:"user_id,omitempty"`
+}
+
+// AgentNetworkAccessLogSession A session-grouped view of agent-network access logs — all requests sharing a session id (or a single session-less request) folded into one summary plus its ordered entries.
+type AgentNetworkAccessLogSession struct {
+	// CostUsd Total estimated USD cost across the session.
+	CostUsd float64 `json:"cost_usd"`
+
+	// Decision Session decision — "deny" if any request was denied, otherwise "allow".
+	Decision string `json:"decision"`
+
+	// EndedAt Timestamp of the session's latest request.
+	EndedAt time.Time `json:"ended_at"`
+
+	// Entries The session's access-log entries, oldest first.
+	Entries []AgentNetworkAccessLog `json:"entries"`
+
+	// GroupIds Union of the authorising group ids across the session's entries.
+	GroupIds *[]string `json:"group_ids,omitempty"`
+
+	// InputTokens Total input (prompt) tokens across the session.
+	InputTokens int64 `json:"input_tokens"`
+
+	// Models Distinct models seen in the session.
+	Models *[]string `json:"models,omitempty"`
+
+	// OutputTokens Total output (completion) tokens across the session.
+	OutputTokens int64 `json:"output_tokens"`
+
+	// Providers Distinct LLM provider vendors seen in the session.
+	Providers *[]string `json:"providers,omitempty"`
+
+	// RequestCount Number of requests in the session.
+	RequestCount int `json:"request_count"`
+
+	// SessionId Conversation / coding-session identifier shared by the entries. Empty for a session-less (singleton) request grouped on its own id.
+	SessionId *string `json:"session_id,omitempty"`
+
+	// StartedAt Timestamp of the session's earliest request.
+	StartedAt time.Time `json:"started_at"`
+
+	// TotalTokens Total tokens across the session.
+	TotalTokens int64 `json:"total_tokens"`
+
+	// UserId NetBird user id of the session's caller.
+	UserId *string `json:"user_id,omitempty"`
+}
+
+// AgentNetworkAccessLogSessionsResponse defines model for AgentNetworkAccessLogSessionsResponse.
+type AgentNetworkAccessLogSessionsResponse struct {
+	// Data List of session-grouped agent-network access logs.
+	Data []AgentNetworkAccessLogSession `json:"data"`
+
+	// Page Current page number.
+	Page int `json:"page"`
+
+	// PageSize Number of sessions per page.
+	PageSize int `json:"page_size"`
+
+	// TotalPages Total number of pages available.
+	TotalPages int `json:"total_pages"`
+
+	// TotalRecords Total number of sessions matching the filter.
+	TotalRecords int `json:"total_records"`
+}
+
+// AgentNetworkAccessLogsResponse defines model for AgentNetworkAccessLogsResponse.
+type AgentNetworkAccessLogsResponse struct {
+	// Data List of agent-network access log entries.
+	Data []AgentNetworkAccessLog `json:"data"`
+
+	// Page Current page number.
+	Page int `json:"page"`
+
+	// PageSize Number of items per page.
+	PageSize int `json:"page_size"`
+
+	// TotalPages Total number of pages available.
+	TotalPages int `json:"total_pages"`
+
+	// TotalRecords Total number of log records matching the filter.
+	TotalRecords int `json:"total_records"`
+}
+
+// AgentNetworkBudgetRule Account-level budget rule. A limit-only rule bound to groups and/or users that applies across all policies as a min-wins ceiling. Empty targets means it applies to every caller.
+type AgentNetworkBudgetRule struct {
+	CreatedAt *time.Time `json:"created_at,omitempty"`
+
+	// Enabled Whether the rule is enforced.
+	Enabled bool `json:"enabled"`
+
+	// Id Budget rule ID.
+	Id string `json:"id"`
+
+	// Limits Token and budget caps attached directly to the policy. These compose with any guardrail-level checks.
+	Limits AgentNetworkPolicyLimits `json:"limits"`
+
+	// Name Display name for the budget rule.
+	Name string `json:"name"`
+
+	// TargetGroups NetBird group ids the rule binds. Empty plus empty target_users means account-wide.
+	TargetGroups []string `json:"target_groups"`
+
+	// TargetUsers NetBird user ids the rule binds directly.
+	TargetUsers []string   `json:"target_users"`
+	UpdatedAt   *time.Time `json:"updated_at,omitempty"`
+}
+
+// AgentNetworkBudgetRuleRequest defines model for AgentNetworkBudgetRuleRequest.
+type AgentNetworkBudgetRuleRequest struct {
+	// Enabled Whether the rule is enforced. Defaults to true on create.
+	Enabled *bool `json:"enabled,omitempty"`
+
+	// Limits Token and budget caps attached directly to the policy. These compose with any guardrail-level checks.
+	Limits AgentNetworkPolicyLimits `json:"limits"`
+
+	// Name Display name for the budget rule.
+	Name string `json:"name"`
+
+	// TargetGroups NetBird group ids the rule binds. Empty plus empty target_users means account-wide.
+	TargetGroups *[]string `json:"target_groups,omitempty"`
+
+	// TargetUsers NetBird user ids the rule binds directly.
+	TargetUsers *[]string `json:"target_users,omitempty"`
+}
+
+// AgentNetworkCatalogExtraHeader One optional per-provider routing/config header surfaced on the dashboard. Operator-typed value lives on the provider record's `extra_values` map keyed by `name`. UI copy (input label, helper line, tooltip) is owned by the dashboard, keyed by `name`.
+type AgentNetworkCatalogExtraHeader struct {
+	// Name Wire header name the proxy stamps with the operator-typed value.
+	Name string `json:"name"`
+}
+
+// AgentNetworkCatalogHeaderPairInjection HeaderPair identity-injection shape — separate per-dimension headers (LiteLLM-style, Bifrost).
+type AgentNetworkCatalogHeaderPairInjection struct {
+	// Customizable When true, the wire header names are operator-overridable per provider record (Bifrost). When false, the catalog values are authoritative (LiteLLM and similar gateways with a fixed wire protocol).
+	Customizable bool `json:"customizable"`
+
+	// EndUserIdHeader Wire header name for the caller's display identity. Default placeholder when `customizable` is true.
+	EndUserIdHeader string `json:"end_user_id_header"`
+
+	// TagsHeader Wire header name for the caller's groups CSV. Default placeholder when `customizable` is true.
+	TagsHeader string `json:"tags_header"`
+}
+
+// AgentNetworkCatalogIdentityInjection Catalog-declared identity-injection shape. Present when this provider supports stamping the caller's NetBird identity onto upstream requests. Exactly one of `header_pair` or `json_metadata` is set per provider entry. The dashboard reads the `customizable` flag on whichever shape is present to decide whether to surface the labels as editable inputs (true → editable with the catalog values shown as placeholders; false → fixed and read-only).
+type AgentNetworkCatalogIdentityInjection struct {
+	// HeaderPair HeaderPair identity-injection shape — separate per-dimension headers (LiteLLM-style, Bifrost).
+	HeaderPair *AgentNetworkCatalogHeaderPairInjection `json:"header_pair,omitempty"`
+
+	// JsonMetadata JSONMetadata identity-injection shape — one wire header carrying a JSON object whose keys label each dimension (Portkey-style, Cloudflare AI Gateway).
+	JsonMetadata *AgentNetworkCatalogJSONMetadataInjection `json:"json_metadata,omitempty"`
+}
+
+// AgentNetworkCatalogJSONMetadataInjection JSONMetadata identity-injection shape — one wire header carrying a JSON object whose keys label each dimension (Portkey-style, Cloudflare AI Gateway).
+type AgentNetworkCatalogJSONMetadataInjection struct {
+	// Customizable When true, the JSON keys are operator-overridable per provider record (Cloudflare). The wire header itself stays catalog-owned. When false, the catalog values are authoritative (Portkey and similar gateways with a fixed JSON schema).
+	Customizable bool `json:"customizable"`
+
+	// GroupsKey JSON key for the caller's groups CSV. Default placeholder when `customizable` is true.
+	GroupsKey string `json:"groups_key"`
+
+	// Header Wire header name carrying the JSON metadata payload. Catalog-owned (not customizable per provider record).
+	Header string `json:"header"`
+
+	// UserKey JSON key for the caller's display identity. Default placeholder when `customizable` is true.
+	UserKey string `json:"user_key"`
+}
+
+// AgentNetworkCatalogModel defines model for AgentNetworkCatalogModel.
+type AgentNetworkCatalogModel struct {
+	// ContextWindow Maximum context window in tokens.
+	ContextWindow int `json:"context_window"`
+
+	// Id Catalog model identifier as exposed by the upstream provider.
+	Id string `json:"id"`
+
+	// InputPer1k Input token price per 1k tokens, in USD.
+	InputPer1k float64 `json:"input_per_1k"`
+
+	// Label Human-friendly model name for the dashboard.
+	Label string `json:"label"`
+
+	// OutputPer1k Output token price per 1k tokens, in USD.
+	OutputPer1k float64 `json:"output_per_1k"`
+}
+
+// AgentNetworkCatalogProvider defines model for AgentNetworkCatalogProvider.
+type AgentNetworkCatalogProvider struct {
+	// AuthHeaderTemplate Template the proxy uses to inject the API key (the literal string ${API_KEY} is replaced at request time).
+	AuthHeaderTemplate string `json:"auth_header_template"`
+
+	// BrandColor Hex brand color used to render the provider badge in the dashboard.
+	BrandColor string `json:"brand_color"`
+
+	// DefaultContentType Default Content-Type for upstream requests.
+	DefaultContentType string `json:"default_content_type"`
+
+	// DefaultHost Default upstream host suggested when adding a provider of this type.
+	DefaultHost string `json:"default_host"`
+
+	// Description Short description shown in the provider picker.
+	Description string `json:"description"`
+
+	// ExtraHeaders Catalog-declared list of optional per-provider routing/config headers the proxy stamps on every upstream request. Each entry surfaces an input on the dashboard's provider modal (one per item, labeled with `label`). Operators fill any subset; values land on the provider record's `extra_values` map keyed by `name`. Used by gateways like Portkey for `x-portkey-config: pc-...` (saved-config id resolving upstream provider + virtual key).
+	ExtraHeaders *[]AgentNetworkCatalogExtraHeader `json:"extra_headers,omitempty"`
+
+	// Id Catalog provider identifier (referenced by AgentNetworkProvider.provider_id).
+	Id string `json:"id"`
+
+	// IdentityInjection Catalog-declared identity-injection shape. Present when this provider supports stamping the caller's NetBird identity onto upstream requests. Exactly one of `header_pair` or `json_metadata` is set per provider entry. The dashboard reads the `customizable` flag on whichever shape is present to decide whether to surface the labels as editable inputs (true → editable with the catalog values shown as placeholders; false → fixed and read-only).
+	IdentityInjection *AgentNetworkCatalogIdentityInjection `json:"identity_injection,omitempty"`
+
+	// Kind Presentation grouping for the provider Select on the dashboard.
+	// "provider" — first-party vendor API (OpenAI, Anthropic, …); the upstream is the model itself.
+	// "gateway" — routing/aggregation layer in front of multiple providers (LiteLLM, Portkey, …); typically pairs with NetBird identity stamping.
+	// "custom" — generic OpenAI-compatible self-hosted endpoint catch-all.
+	Kind AgentNetworkCatalogProviderKind `json:"kind"`
+
+	// Models Catalog models available for this provider.
+	Models []AgentNetworkCatalogModel `json:"models"`
+
+	// Name Display name for the provider.
+	Name string `json:"name"`
+}
+
+// AgentNetworkCatalogProviderKind Presentation grouping for the provider Select on the dashboard.
+// "provider" — first-party vendor API (OpenAI, Anthropic, …); the upstream is the model itself.
+// "gateway" — routing/aggregation layer in front of multiple providers (LiteLLM, Portkey, …); typically pairs with NetBird identity stamping.
+// "custom" — generic OpenAI-compatible self-hosted endpoint catch-all.
+type AgentNetworkCatalogProviderKind string
+
+// AgentNetworkConsumption One per-(dimension, window) consumption counter row. The proxy ticks one row per dimension on every served LLM request; the dashboard reads this listing to surface live counter growth.
+type AgentNetworkConsumption struct {
+	// CostUsd Total USD spend booked against this dimension for the window.
+	CostUsd float64 `json:"cost_usd"`
+
+	// DimensionId NetBird user id (when `dimension_kind=user`) or NetBird group id (when `dimension_kind=group`).
+	DimensionId string `json:"dimension_id"`
+
+	// DimensionKind Whether this row counts a single end user or a single source group across every member.
+	DimensionKind AgentNetworkConsumptionDimensionKind `json:"dimension_kind"`
+
+	// TokensInput Total input tokens consumed within the window.
+	TokensInput int64 `json:"tokens_input"`
+
+	// TokensOutput Total output tokens consumed within the window.
+	TokensOutput int64 `json:"tokens_output"`
+
+	// UpdatedAt Timestamp of the last increment recorded for this row.
+	UpdatedAt *time.Time `json:"updated_at,omitempty"`
+
+	// WindowSeconds Length of the aligned window this counter covers, in seconds. Distinct window lengths produce independent counters even on the same dimension.
+	WindowSeconds int64 `json:"window_seconds"`
+
+	// WindowStartUtc UTC start of the aligned window this counter covers. Aligned to the unix epoch so every node computes the same boundary.
+	WindowStartUtc time.Time `json:"window_start_utc"`
+}
+
+// AgentNetworkConsumptionDimensionKind Whether this row counts a single end user or a single source group across every member.
+type AgentNetworkConsumptionDimensionKind string
+
+// AgentNetworkGuardrail defines model for AgentNetworkGuardrail.
+type AgentNetworkGuardrail struct {
+	// Checks Guardrail check parameters. Each entry has an `enabled` flag plus per-check configuration; disabled entries are inert.
+	Checks AgentNetworkGuardrailChecks `json:"checks"`
+
+	// CreatedAt Timestamp when the guardrail was created.
+	CreatedAt *time.Time `json:"created_at,omitempty"`
+
+	// Description Optional human-readable description.
+	Description string `json:"description"`
+
+	// Id Guardrail ID
+	Id string `json:"id"`
+
+	// Name Display name for the guardrail.
+	Name string `json:"name"`
+
+	// UpdatedAt Timestamp when the guardrail was last updated.
+	UpdatedAt *time.Time `json:"updated_at,omitempty"`
+}
+
+// AgentNetworkGuardrailChecks Guardrail check parameters. Each entry has an `enabled` flag plus per-check configuration; disabled entries are inert.
+type AgentNetworkGuardrailChecks struct {
+	ModelAllowlist struct {
+		Enabled bool `json:"enabled"`
+
+		// Models Allowed catalog model ids. Requests for any other model are denied.
+		Models []string `json:"models"`
+	} `json:"model_allowlist"`
+	PromptCapture struct {
+		Enabled   bool `json:"enabled"`
+		RedactPii bool `json:"redact_pii"`
+	} `json:"prompt_capture"`
+}
+
+// AgentNetworkGuardrailRequest defines model for AgentNetworkGuardrailRequest.
+type AgentNetworkGuardrailRequest struct {
+	// Checks Guardrail check parameters. Each entry has an `enabled` flag plus per-check configuration; disabled entries are inert.
+	Checks AgentNetworkGuardrailChecks `json:"checks"`
+
+	// Description Optional human-readable description.
+	Description *string `json:"description,omitempty"`
+
+	// Name Display name for the guardrail.
+	Name string `json:"name"`
+}
+
+// AgentNetworkPolicy defines model for AgentNetworkPolicy.
+type AgentNetworkPolicy struct {
+	// CreatedAt Timestamp when the policy was created.
+	CreatedAt *time.Time `json:"created_at,omitempty"`
+
+	// Description Optional human-readable description.
+	Description string `json:"description"`
+
+	// DestinationProviderIds Agent Network provider ids (returned by the providers API) the source groups can reach.
+	DestinationProviderIds []string `json:"destination_provider_ids"`
+
+	// Enabled Whether the policy is enabled.
+	Enabled bool `json:"enabled"`
+
+	// GuardrailIds Agent Network guardrail ids attached to this policy.
+	GuardrailIds []string `json:"guardrail_ids"`
+
+	// Id Policy ID
+	Id string `json:"id"`
+
+	// Limits Token and budget caps attached directly to the policy. These compose with any guardrail-level checks.
+	Limits AgentNetworkPolicyLimits `json:"limits"`
+
+	// Name Display name for the policy.
+	Name string `json:"name"`
+
+	// SourceGroups NetBird group ids whose members are allowed to call the destination providers.
+	SourceGroups []string `json:"source_groups"`
+
+	// UpdatedAt Timestamp when the policy was last updated.
+	UpdatedAt *time.Time `json:"updated_at,omitempty"`
+}
+
+// AgentNetworkPolicyBudgetLimit Per-policy USD spend cap. `group_cap_usd` is applied to each source group independently — every group in the policy's `source_groups` gets its own bucket of this size. `user_cap_usd` is applied independently to each individual user. Caps reset to zero at the start of each window.
+type AgentNetworkPolicyBudgetLimit struct {
+	Enabled bool `json:"enabled"`
+
+	// GroupCapUsd USD allowed per source group within the window (each group has its own bucket of this size). 0 means uncapped.
+	GroupCapUsd float64 `json:"group_cap_usd"`
+
+	// UserCapUsd USD allowed per individual user within the window. 0 means uncapped.
+	UserCapUsd float64 `json:"user_cap_usd"`
+
+	// WindowSeconds Reset frequency in seconds. Caps reset at the start of each window. Minimum 60 (one minute) when the limit is enabled.
+	WindowSeconds int64 `json:"window_seconds"`
+}
+
+// AgentNetworkPolicyLimits Token and budget caps attached directly to the policy. These compose with any guardrail-level checks.
+type AgentNetworkPolicyLimits struct {
+	// BudgetLimit Per-policy USD spend cap. `group_cap_usd` is applied to each source group independently — every group in the policy's `source_groups` gets its own bucket of this size. `user_cap_usd` is applied independently to each individual user. Caps reset to zero at the start of each window.
+	BudgetLimit AgentNetworkPolicyBudgetLimit `json:"budget_limit"`
+
+	// TokenLimit Per-policy token cap. `group_cap` is applied to each source group independently — every group in the policy's `source_groups` gets its own bucket of this size. `user_cap` is applied independently to each individual user. Caps reset to zero at the start of each window.
+	TokenLimit AgentNetworkPolicyTokenLimit `json:"token_limit"`
+}
+
+// AgentNetworkPolicyRequest defines model for AgentNetworkPolicyRequest.
+type AgentNetworkPolicyRequest struct {
+	// Description Optional human-readable description.
+	Description *string `json:"description,omitempty"`
+
+	// DestinationProviderIds Agent Network provider ids the source groups can reach.
+	DestinationProviderIds []string `json:"destination_provider_ids"`
+
+	// Enabled Whether the policy is enabled. Defaults to true on create.
+	Enabled *bool `json:"enabled,omitempty"`
+
+	// GuardrailIds Agent Network guardrail ids to attach to this policy.
+	GuardrailIds *[]string `json:"guardrail_ids,omitempty"`
+
+	// Limits Token and budget caps attached directly to the policy. These compose with any guardrail-level checks.
+	Limits *AgentNetworkPolicyLimits `json:"limits,omitempty"`
+
+	// Name Display name for the policy.
+	Name string `json:"name"`
+
+	// SourceGroups NetBird group ids whose members are allowed to call the destination providers.
+	SourceGroups []string `json:"source_groups"`
+}
+
+// AgentNetworkPolicyTokenLimit Per-policy token cap. `group_cap` is applied to each source group independently — every group in the policy's `source_groups` gets its own bucket of this size. `user_cap` is applied independently to each individual user. Caps reset to zero at the start of each window.
+type AgentNetworkPolicyTokenLimit struct {
+	Enabled bool `json:"enabled"`
+
+	// GroupCap Tokens allowed per source group within the window (each group has its own bucket of this size). 0 means uncapped.
+	GroupCap int64 `json:"group_cap"`
+
+	// UserCap Tokens allowed per individual user within the window. 0 means uncapped.
+	UserCap int64 `json:"user_cap"`
+
+	// WindowSeconds Reset frequency in seconds. The cap counter resets to zero at the start of each window. Minimum 60 (one minute) when the limit is enabled.
+	WindowSeconds int64 `json:"window_seconds"`
+}
+
+// AgentNetworkProvider defines model for AgentNetworkProvider.
+type AgentNetworkProvider struct {
+	// CreatedAt Timestamp when the provider was created.
+	CreatedAt *time.Time `json:"created_at,omitempty"`
+
+	// Enabled Whether the provider is enabled.
+	Enabled bool `json:"enabled"`
+
+	// ExtraValues Operator-typed values for catalog-declared extra headers. Keys are wire header names (e.g. `x-portkey-config`); values are the strings the proxy stamps on every upstream request to this provider. Catalog (AgentNetworkCatalogProvider.extra_headers) declares which keys are accepted; values not declared by the catalog are ignored at synth time. Empty / missing values mean no header stamped.
+	ExtraValues *map[string]string `json:"extra_values,omitempty"`
+
+	// Id Provider ID
+	Id string `json:"id"`
+
+	// IdentityHeaderGroups Wire header name the proxy stamps with the caller's NetBird groups as a comma-separated list (sorted) when the catalog entry's HeaderPair is `customizable`. Empty disables stamping for this dimension. Same per-catalog semantics as `identity_header_user_id`.
+	IdentityHeaderGroups *string `json:"identity_header_groups,omitempty"`
+
+	// IdentityHeaderUserId Wire header name the proxy stamps with the caller's display identity (user email or peer name) when the catalog entry's HeaderPair is `customizable`. Empty disables stamping for this dimension. Ignored when the catalog entry has a fixed HeaderPair (e.g. LiteLLM, Portkey). Used today by Bifrost: typical values are `x-bf-lh-netbird_user_id` (always-on log metadata) or `x-bf-dim-netbird_user_id` (Prometheus / OTEL — requires the label to be pre-declared in the gateway's `client.prometheus_labels` config).
+	IdentityHeaderUserId *string `json:"identity_header_user_id,omitempty"`
+
+	// Models Models exposed through this endpoint, with the operator's per-1k input/output prices. Empty means all catalog models are allowed at catalog prices.
+	Models []AgentNetworkProviderModel `json:"models"`
+
+	// Name Display name shown in the dashboard.
+	Name string `json:"name"`
+
+	// ProviderId Catalog identifier for the upstream AI provider (e.g. openai_api, anthropic_api, azure_openai_api, bedrock_api, vertex_ai_api, mistral_api, custom).
+	ProviderId string `json:"provider_id"`
+
+	// UpdatedAt Timestamp when the provider was last updated.
+	UpdatedAt *time.Time `json:"updated_at,omitempty"`
+
+	// UpstreamUrl Full upstream URL (with scheme) that NetBird forwards traffic to.
+	UpstreamUrl string `json:"upstream_url"`
+}
+
+// AgentNetworkProviderModel A model exposed by the provider, with the operator's per-1k input/output prices in USD.
+type AgentNetworkProviderModel struct {
+	// Id Model identifier (e.g. "gpt-4o-mini").
+	Id string `json:"id"`
+
+	// InputPer1k Cost per 1k input tokens, in USD.
+	InputPer1k float64 `json:"input_per_1k"`
+
+	// OutputPer1k Cost per 1k output tokens, in USD.
+	OutputPer1k float64 `json:"output_per_1k"`
+}
+
+// AgentNetworkProviderRequest defines model for AgentNetworkProviderRequest.
+type AgentNetworkProviderRequest struct {
+	// ApiKey Upstream provider API key. Sealed at rest on the management server and never returned in responses. Required on create; optional on update (omit to keep the existing key).
+	ApiKey *string `json:"api_key,omitempty"`
+
+	// BootstrapCluster Proxy cluster used to bootstrap the per-account agent-network endpoint when the first provider is created. Ignored on subsequent creates and on updates because the cluster is pinned on the account-level Settings row.
+	BootstrapCluster *string `json:"bootstrap_cluster,omitempty"`
+
+	// Enabled Whether the provider is enabled. Defaults to true on create.
+	Enabled *bool `json:"enabled,omitempty"`
+
+	// ExtraValues Operator-typed values for catalog-declared extra headers (see AgentNetworkProvider.extra_values). When present on a request, the whole map replaces the stored values. Empty strings drop the corresponding key.
+	ExtraValues *map[string]string `json:"extra_values,omitempty"`
+
+	// IdentityHeaderGroups Wire header name for the caller's groups CSV. See AgentNetworkProvider.identity_header_groups. Same omit / empty semantics as `identity_header_user_id`.
+	IdentityHeaderGroups *string `json:"identity_header_groups,omitempty"`
+
+	// IdentityHeaderUserId Wire header name for the caller's display identity. See AgentNetworkProvider.identity_header_user_id. When omitted on a request, the stored value is left unchanged; pass an empty string explicitly to clear it (which disables stamping for this dimension).
+	IdentityHeaderUserId *string `json:"identity_header_user_id,omitempty"`
+
+	// Models Models exposed through this endpoint, with the operator's per-1k input/output prices. Empty means all catalog models are allowed at catalog prices.
+	Models *[]AgentNetworkProviderModel `json:"models,omitempty"`
+
+	// Name Display name for the provider.
+	Name string `json:"name"`
+
+	// ProviderId Catalog identifier for the upstream AI provider (e.g. openai_api, anthropic_api, azure_openai_api, bedrock_api, vertex_ai_api, mistral_api, custom).
+	ProviderId string `json:"provider_id"`
+
+	// UpstreamUrl Full upstream URL (with scheme) that NetBird forwards traffic to.
+	UpstreamUrl string `json:"upstream_url"`
+}
+
+// AgentNetworkSettings Per-account Agent Network gateway settings. One row per account; cluster and subdomain are auto-assigned on first provider create and immutable thereafter.
+type AgentNetworkSettings struct {
+	// AccessLogRetentionDays Days to retain full access-log rows; older rows are swept. 0 or less means keep indefinitely. Usage records are retained independently.
+	AccessLogRetentionDays *int `json:"access_log_retention_days,omitempty"`
+
+	// Cluster Address of the NetBird proxy cluster fronting this account's agent-network endpoint.
+	Cluster string `json:"cluster"`
+
+	// CreatedAt Timestamp when the settings row was created.
+	CreatedAt *time.Time `json:"created_at,omitempty"`
+
+	// EnableLogCollection Whether per-request access-log entries are collected for this account's agent-network traffic.
+	EnableLogCollection bool `json:"enable_log_collection"`
+
+	// EnablePromptCollection Master switch for request/response prompt capture. Capture runs only when this is on AND a policy guardrail also enables it.
+	EnablePromptCollection bool `json:"enable_prompt_collection"`
+
+	// Endpoint Bare hostname agents call for this account, computed as `<subdomain>.<cluster>`.
+	Endpoint string `json:"endpoint"`
+
+	// RedactPii Whether captured prompts have PII redacted. Effective redaction is the OR of this and any policy guardrail's redact setting.
+	RedactPii bool `json:"redact_pii"`
+
+	// Subdomain Auto-generated DNS-safe label that prefixes the cluster to form the agent-network endpoint.
+	Subdomain string `json:"subdomain"`
+
+	// UpdatedAt Timestamp when the settings row was last updated.
+	UpdatedAt *time.Time `json:"updated_at,omitempty"`
+}
+
+// AgentNetworkSettingsRequest Mutable account-level Agent Network settings. Cluster and subdomain are immutable and not accepted here.
+type AgentNetworkSettingsRequest struct {
+	// AccessLogRetentionDays Days to retain full access-log rows; older rows are swept. 0 or less means keep indefinitely.
+	AccessLogRetentionDays *int `json:"access_log_retention_days,omitempty"`
+
+	// EnableLogCollection Whether per-request access-log entries are collected for this account's agent-network traffic.
+	EnableLogCollection bool `json:"enable_log_collection"`
+
+	// EnablePromptCollection Master switch for request/response prompt capture.
+	EnablePromptCollection bool `json:"enable_prompt_collection"`
+
+	// RedactPii Whether captured prompts have PII redacted.
+	RedactPii bool `json:"redact_pii"`
+}
+
+// AgentNetworkUsageBucket One aggregated agent-network usage time bucket (UTC). The bucket width is set by the request's granularity.
+type AgentNetworkUsageBucket struct {
+	// CostUsd Total estimated USD spend in the bucket.
+	CostUsd float64 `json:"cost_usd"`
+
+	// InputTokens Total input (prompt) tokens in the bucket.
+	InputTokens int64 `json:"input_tokens"`
+
+	// OutputTokens Total output (completion) tokens in the bucket.
+	OutputTokens int64 `json:"output_tokens"`
+
+	// PeriodStart Start of the bucket in YYYY-MM-DD (UTC) — the day, the week start (Monday), or the month start, depending on granularity.
+	PeriodStart string `json:"period_start"`
+
+	// TotalTokens Total tokens in the bucket.
+	TotalTokens int64 `json:"total_tokens"`
+}
+
 // AvailablePorts defines model for AvailablePorts.
 type AvailablePorts struct {
 	// Tcp Number of available TCP  ports left on the ingress peer
@@ -4892,6 +5687,138 @@ type bearerAuthContextKey string
 // tokenAuthContextKey is the context key for TokenAuth security scheme
 type tokenAuthContextKey string
 
+// GetApiAgentNetworkAccessLogSessionsParams defines parameters for GetApiAgentNetworkAccessLogSessions.
+type GetApiAgentNetworkAccessLogSessionsParams struct {
+	// Page Page number for pagination (1-indexed).
+	Page *int `form:"page,omitempty" json:"page,omitempty"`
+
+	// PageSize Number of sessions per page (max 100).
+	PageSize *int `form:"page_size,omitempty" json:"page_size,omitempty"`
+
+	// SortBy Session-level field to sort by. "timestamp" is the session's last activity, "started_at" its first.
+	SortBy *GetApiAgentNetworkAccessLogSessionsParamsSortBy `form:"sort_by,omitempty" json:"sort_by,omitempty"`
+
+	// SortOrder Sort order (ascending or descending).
+	SortOrder *GetApiAgentNetworkAccessLogSessionsParamsSortOrder `form:"sort_order,omitempty" json:"sort_order,omitempty"`
+
+	// Search General search across log ID, host, path, model, and user email/name.
+	Search *string `form:"search,omitempty" json:"search,omitempty"`
+
+	// UserId Filter by authenticated user ID.
+	UserId *string `form:"user_id,omitempty" json:"user_id,omitempty"`
+
+	// SessionId Filter to a single conversation / coding session id.
+	SessionId *string `form:"session_id,omitempty" json:"session_id,omitempty"`
+
+	// GroupId Filter by authorising group id. Repeat for multiple (matches any).
+	GroupId *[]string `form:"group_id,omitempty" json:"group_id,omitempty"`
+
+	// ProviderId Filter by resolved provider id. Repeat for multiple (matches any).
+	ProviderId *[]string `form:"provider_id,omitempty" json:"provider_id,omitempty"`
+
+	// Model Filter by model. Repeat for multiple (matches any).
+	Model *[]string `form:"model,omitempty" json:"model,omitempty"`
+
+	// Decision Filter by policy decision (e.g. allow, deny).
+	Decision *string `form:"decision,omitempty" json:"decision,omitempty"`
+
+	// Path Filter by request path prefix (matches entries whose path starts with this value).
+	Path *string `form:"path,omitempty" json:"path,omitempty"`
+
+	// StartDate Filter by timestamp >= start_date (RFC3339 format).
+	StartDate *time.Time `form:"start_date,omitempty" json:"start_date,omitempty"`
+
+	// EndDate Filter by timestamp <= end_date (RFC3339 format).
+	EndDate *time.Time `form:"end_date,omitempty" json:"end_date,omitempty"`
+}
+
+// GetApiAgentNetworkAccessLogSessionsParamsSortBy defines parameters for GetApiAgentNetworkAccessLogSessions.
+type GetApiAgentNetworkAccessLogSessionsParamsSortBy string
+
+// GetApiAgentNetworkAccessLogSessionsParamsSortOrder defines parameters for GetApiAgentNetworkAccessLogSessions.
+type GetApiAgentNetworkAccessLogSessionsParamsSortOrder string
+
+// GetApiAgentNetworkAccessLogsParams defines parameters for GetApiAgentNetworkAccessLogs.
+type GetApiAgentNetworkAccessLogsParams struct {
+	// Page Page number for pagination (1-indexed).
+	Page *int `form:"page,omitempty" json:"page,omitempty"`
+
+	// PageSize Number of items per page (max 100).
+	PageSize *int `form:"page_size,omitempty" json:"page_size,omitempty"`
+
+	// SortBy Field to sort by.
+	SortBy *GetApiAgentNetworkAccessLogsParamsSortBy `form:"sort_by,omitempty" json:"sort_by,omitempty"`
+
+	// SortOrder Sort order (ascending or descending).
+	SortOrder *GetApiAgentNetworkAccessLogsParamsSortOrder `form:"sort_order,omitempty" json:"sort_order,omitempty"`
+
+	// Search General search across log ID, host, path, model, and user email/name.
+	Search *string `form:"search,omitempty" json:"search,omitempty"`
+
+	// UserId Filter by authenticated user ID.
+	UserId *string `form:"user_id,omitempty" json:"user_id,omitempty"`
+
+	// SessionId Filter to a single conversation / coding session id (groups all requests of one session).
+	SessionId *string `form:"session_id,omitempty" json:"session_id,omitempty"`
+
+	// GroupId Filter by authorising group id. Repeat for multiple (matches any).
+	GroupId *[]string `form:"group_id,omitempty" json:"group_id,omitempty"`
+
+	// ProviderId Filter by resolved provider id. Repeat for multiple (matches any).
+	ProviderId *[]string `form:"provider_id,omitempty" json:"provider_id,omitempty"`
+
+	// Model Filter by model. Repeat for multiple (matches any).
+	Model *[]string `form:"model,omitempty" json:"model,omitempty"`
+
+	// Decision Filter by policy decision (e.g. allow, deny).
+	Decision *string `form:"decision,omitempty" json:"decision,omitempty"`
+
+	// Path Filter by request path prefix (matches entries whose path starts with this value).
+	Path *string `form:"path,omitempty" json:"path,omitempty"`
+
+	// StartDate Filter by timestamp >= start_date (RFC3339 format).
+	StartDate *time.Time `form:"start_date,omitempty" json:"start_date,omitempty"`
+
+	// EndDate Filter by timestamp <= end_date (RFC3339 format).
+	EndDate *time.Time `form:"end_date,omitempty" json:"end_date,omitempty"`
+}
+
+// GetApiAgentNetworkAccessLogsParamsSortBy defines parameters for GetApiAgentNetworkAccessLogs.
+type GetApiAgentNetworkAccessLogsParamsSortBy string
+
+// GetApiAgentNetworkAccessLogsParamsSortOrder defines parameters for GetApiAgentNetworkAccessLogs.
+type GetApiAgentNetworkAccessLogsParamsSortOrder string
+
+// GetApiAgentNetworkUsageOverviewParams defines parameters for GetApiAgentNetworkUsageOverview.
+type GetApiAgentNetworkUsageOverviewParams struct {
+	// Granularity Time bucket width. Defaults to day.
+	Granularity *GetApiAgentNetworkUsageOverviewParamsGranularity `form:"granularity,omitempty" json:"granularity,omitempty"`
+
+	// StartDate Filter by timestamp >= start_date (RFC3339 format).
+	StartDate *time.Time `form:"start_date,omitempty" json:"start_date,omitempty"`
+
+	// EndDate Filter by timestamp <= end_date (RFC3339 format).
+	EndDate *time.Time `form:"end_date,omitempty" json:"end_date,omitempty"`
+
+	// UserId Filter by user ID.
+	UserId *string `form:"user_id,omitempty" json:"user_id,omitempty"`
+
+	// SessionId Filter to a single conversation / coding session id.
+	SessionId *string `form:"session_id,omitempty" json:"session_id,omitempty"`
+
+	// GroupId Filter by authorising group id. Repeat for multiple (matches any).
+	GroupId *[]string `form:"group_id,omitempty" json:"group_id,omitempty"`
+
+	// ProviderId Filter by resolved provider id. Repeat for multiple (matches any).
+	ProviderId *[]string `form:"provider_id,omitempty" json:"provider_id,omitempty"`
+
+	// Model Filter by model. Repeat for multiple (matches any).
+	Model *[]string `form:"model,omitempty" json:"model,omitempty"`
+}
+
+// GetApiAgentNetworkUsageOverviewParamsGranularity defines parameters for GetApiAgentNetworkUsageOverview.
+type GetApiAgentNetworkUsageOverviewParamsGranularity string
+
 // GetApiEventsNetworkTrafficParams defines parameters for GetApiEventsNetworkTraffic.
 type GetApiEventsNetworkTrafficParams struct {
 	// Page Page number
@@ -5090,6 +6017,33 @@ type GetApiUsersParams struct {
 // PutApiAccountsAccountIdJSONRequestBody defines body for PutApiAccountsAccountId for application/json ContentType.
 type PutApiAccountsAccountIdJSONRequestBody = AccountRequest
 
+// PostApiAgentNetworkBudgetRulesJSONRequestBody defines body for PostApiAgentNetworkBudgetRules for application/json ContentType.
+type PostApiAgentNetworkBudgetRulesJSONRequestBody = AgentNetworkBudgetRuleRequest
+
+// PutApiAgentNetworkBudgetRulesRuleIdJSONRequestBody defines body for PutApiAgentNetworkBudgetRulesRuleId for application/json ContentType.
+type PutApiAgentNetworkBudgetRulesRuleIdJSONRequestBody = AgentNetworkBudgetRuleRequest
+
+// PostApiAgentNetworkGuardrailsJSONRequestBody defines body for PostApiAgentNetworkGuardrails for application/json ContentType.
+type PostApiAgentNetworkGuardrailsJSONRequestBody = AgentNetworkGuardrailRequest
+
+// PutApiAgentNetworkGuardrailsGuardrailIdJSONRequestBody defines body for PutApiAgentNetworkGuardrailsGuardrailId for application/json ContentType.
+type PutApiAgentNetworkGuardrailsGuardrailIdJSONRequestBody = AgentNetworkGuardrailRequest
+
+// PostApiAgentNetworkPoliciesJSONRequestBody defines body for PostApiAgentNetworkPolicies for application/json ContentType.
+type PostApiAgentNetworkPoliciesJSONRequestBody = AgentNetworkPolicyRequest
+
+// PutApiAgentNetworkPoliciesPolicyIdJSONRequestBody defines body for PutApiAgentNetworkPoliciesPolicyId for application/json ContentType.
+type PutApiAgentNetworkPoliciesPolicyIdJSONRequestBody = AgentNetworkPolicyRequest
+
+// PostApiAgentNetworkProvidersJSONRequestBody defines body for PostApiAgentNetworkProviders for application/json ContentType.
+type PostApiAgentNetworkProvidersJSONRequestBody = AgentNetworkProviderRequest
+
+// PutApiAgentNetworkProvidersProviderIdJSONRequestBody defines body for PutApiAgentNetworkProvidersProviderId for application/json ContentType.
+type PutApiAgentNetworkProvidersProviderIdJSONRequestBody = AgentNetworkProviderRequest
+
+// PutApiAgentNetworkSettingsJSONRequestBody defines body for PutApiAgentNetworkSettings for application/json ContentType.
+type PutApiAgentNetworkSettingsJSONRequestBody = AgentNetworkSettingsRequest
+
 // PostApiDnsNameserversJSONRequestBody defines body for PostApiDnsNameservers for application/json ContentType.
 type PostApiDnsNameserversJSONRequestBody = NameserverGroupRequest
 
diff --git a/shared/management/proto/management.pb.go b/shared/management/proto/management.pb.go
index 5dd529407..8027c0db6 100644
--- a/shared/management/proto/management.pb.go
+++ b/shared/management/proto/management.pb.go
@@ -843,10 +843,14 @@ type SyncResponse struct {
 	NetworkMap         *NetworkMap `protobuf:"bytes,5,opt,name=NetworkMap,proto3" json:"NetworkMap,omitempty"`
 	// Posture checks to be evaluated by client
 	Checks []*Checks `protobuf:"bytes,6,rep,name=Checks,proto3" json:"Checks,omitempty"`
-	// Absolute UTC instant at which the peer's SSO session expires.
-	// Unset when the peer is not SSO-registered or login expiration is disabled.
-	// Carried on every Sync snapshot so admin-side changes propagate live without
-	// a client reconnect.
+	// 3-state session deadline. Carried on every Sync snapshot so admin-side
+	// changes propagate live without a client reconnect.
+	//
+	//	field unset (nil)        → snapshot carries no info; client keeps the
+	//	                           deadline it already had
+	//	set, seconds=0 nanos=0   → explicit "expiry disabled" or peer is not
+	//	                           SSO-registered; client clears its anchor
+	//	set, valid timestamp     → new absolute UTC deadline
 	SessionExpiresAt *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=sessionExpiresAt,proto3" json:"sessionExpiresAt,omitempty"`
 }
 
@@ -1608,8 +1612,11 @@ type LoginResponse struct {
 	PeerConfig *PeerConfig `protobuf:"bytes,2,opt,name=peerConfig,proto3" json:"peerConfig,omitempty"`
 	// Posture checks to be evaluated by client
 	Checks []*Checks `protobuf:"bytes,3,rep,name=Checks,proto3" json:"Checks,omitempty"`
-	// Absolute UTC instant at which the peer's SSO session expires.
-	// Unset when the peer is not SSO-registered or login expiration is disabled.
+	// 3-state session deadline; same encoding as SyncResponse.sessionExpiresAt.
+	//
+	//	field unset (nil)        → no info; client keeps any deadline it had
+	//	set, seconds=0 nanos=0   → explicit "expiry disabled" / non-SSO peer
+	//	set, valid timestamp     → new absolute UTC deadline
 	SessionExpiresAt *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=sessionExpiresAt,proto3" json:"sessionExpiresAt,omitempty"`
 }
 
@@ -1739,7 +1746,10 @@ type ExtendAuthSessionResponse struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	// Absolute UTC instant at which the peer's SSO session now expires.
+	// 3-state session deadline; same encoding as SyncResponse.sessionExpiresAt.
+	// In practice ExtendAuthSession only succeeds for SSO peers with expiry
+	// enabled, so this carries a valid timestamp on the success path. The
+	// 3-state encoding is documented here for symmetry with Login/Sync.
 	SessionExpiresAt *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=sessionExpiresAt,proto3" json:"sessionExpiresAt,omitempty"`
 }
 
diff --git a/shared/management/proto/proxy_service.pb.go b/shared/management/proto/proxy_service.pb.go
index 22c215074..df42d78ff 100644
--- a/shared/management/proto/proxy_service.pb.go
+++ b/shared/management/proto/proxy_service.pb.go
@@ -117,6 +117,60 @@ func (PathRewriteMode) EnumDescriptor() ([]byte, []int) {
 	return file_proxy_service_proto_rawDescGZIP(), []int{1}
 }
 
+// MiddlewareSlot identifies where in the request lifecycle a middleware
+// runs. Mirrors proxy/internal/middleware.Slot.
+type MiddlewareSlot int32
+
+const (
+	MiddlewareSlot_MIDDLEWARE_SLOT_UNSPECIFIED MiddlewareSlot = 0
+	MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST  MiddlewareSlot = 1
+	MiddlewareSlot_MIDDLEWARE_SLOT_ON_RESPONSE MiddlewareSlot = 2
+	MiddlewareSlot_MIDDLEWARE_SLOT_TERMINAL    MiddlewareSlot = 3
+)
+
+// Enum value maps for MiddlewareSlot.
+var (
+	MiddlewareSlot_name = map[int32]string{
+		0: "MIDDLEWARE_SLOT_UNSPECIFIED",
+		1: "MIDDLEWARE_SLOT_ON_REQUEST",
+		2: "MIDDLEWARE_SLOT_ON_RESPONSE",
+		3: "MIDDLEWARE_SLOT_TERMINAL",
+	}
+	MiddlewareSlot_value = map[string]int32{
+		"MIDDLEWARE_SLOT_UNSPECIFIED": 0,
+		"MIDDLEWARE_SLOT_ON_REQUEST":  1,
+		"MIDDLEWARE_SLOT_ON_RESPONSE": 2,
+		"MIDDLEWARE_SLOT_TERMINAL":    3,
+	}
+)
+
+func (x MiddlewareSlot) Enum() *MiddlewareSlot {
+	p := new(MiddlewareSlot)
+	*p = x
+	return p
+}
+
+func (x MiddlewareSlot) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (MiddlewareSlot) Descriptor() protoreflect.EnumDescriptor {
+	return file_proxy_service_proto_enumTypes[2].Descriptor()
+}
+
+func (MiddlewareSlot) Type() protoreflect.EnumType {
+	return &file_proxy_service_proto_enumTypes[2]
+}
+
+func (x MiddlewareSlot) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use MiddlewareSlot.Descriptor instead.
+func (MiddlewareSlot) EnumDescriptor() ([]byte, []int) {
+	return file_proxy_service_proto_rawDescGZIP(), []int{2}
+}
+
 type ProxyStatus int32
 
 const (
@@ -159,11 +213,11 @@ func (x ProxyStatus) String() string {
 }
 
 func (ProxyStatus) Descriptor() protoreflect.EnumDescriptor {
-	return file_proxy_service_proto_enumTypes[2].Descriptor()
+	return file_proxy_service_proto_enumTypes[3].Descriptor()
 }
 
 func (ProxyStatus) Type() protoreflect.EnumType {
-	return &file_proxy_service_proto_enumTypes[2]
+	return &file_proxy_service_proto_enumTypes[3]
 }
 
 func (x ProxyStatus) Number() protoreflect.EnumNumber {
@@ -172,7 +226,53 @@ func (x ProxyStatus) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use ProxyStatus.Descriptor instead.
 func (ProxyStatus) EnumDescriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{2}
+	return file_proxy_service_proto_rawDescGZIP(), []int{3}
+}
+
+type MiddlewareConfig_FailMode int32
+
+const (
+	MiddlewareConfig_FAIL_OPEN   MiddlewareConfig_FailMode = 0
+	MiddlewareConfig_FAIL_CLOSED MiddlewareConfig_FailMode = 1
+)
+
+// Enum value maps for MiddlewareConfig_FailMode.
+var (
+	MiddlewareConfig_FailMode_name = map[int32]string{
+		0: "FAIL_OPEN",
+		1: "FAIL_CLOSED",
+	}
+	MiddlewareConfig_FailMode_value = map[string]int32{
+		"FAIL_OPEN":   0,
+		"FAIL_CLOSED": 1,
+	}
+)
+
+func (x MiddlewareConfig_FailMode) Enum() *MiddlewareConfig_FailMode {
+	p := new(MiddlewareConfig_FailMode)
+	*p = x
+	return p
+}
+
+func (x MiddlewareConfig_FailMode) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (MiddlewareConfig_FailMode) Descriptor() protoreflect.EnumDescriptor {
+	return file_proxy_service_proto_enumTypes[4].Descriptor()
+}
+
+func (MiddlewareConfig_FailMode) Type() protoreflect.EnumType {
+	return &file_proxy_service_proto_enumTypes[4]
+}
+
+func (x MiddlewareConfig_FailMode) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use MiddlewareConfig_FailMode.Descriptor instead.
+func (MiddlewareConfig_FailMode) EnumDescriptor() ([]byte, []int) {
+	return file_proxy_service_proto_rawDescGZIP(), []int{4, 0}
 }
 
 // ProxyCapabilities describes what a proxy can handle.
@@ -422,6 +522,25 @@ type PathTargetOptions struct {
 	// reachable without WireGuard (public APIs, LAN services, localhost
 	// sidecars). Defaults to false — embedded client is the standard path.
 	DirectUpstream bool `protobuf:"varint,7,opt,name=direct_upstream,json=directUpstream,proto3" json:"direct_upstream,omitempty"`
+	// Proxy clamps to [0, proxy-wide max (1 MiB)] at apply time. Agent-network
+	// synthesized targets only; private services leave these zero.
+	CaptureMaxRequestBytes int64 `protobuf:"varint,8,opt,name=capture_max_request_bytes,json=captureMaxRequestBytes,proto3" json:"capture_max_request_bytes,omitempty"`
+	// Proxy clamps to [0, proxy-wide max (1 MiB)] at apply time.
+	CaptureMaxResponseBytes int64 `protobuf:"varint,9,opt,name=capture_max_response_bytes,json=captureMaxResponseBytes,proto3" json:"capture_max_response_bytes,omitempty"`
+	// Content types eligible for body capture (e.g. "application/json").
+	CaptureContentTypes []string `protobuf:"bytes,10,rep,name=capture_content_types,json=captureContentTypes,proto3" json:"capture_content_types,omitempty"`
+	// Per-target middleware configurations populated by the agent-network
+	// synthesizer. Validated and clamped by the proxy at apply time.
+	Middlewares []*MiddlewareConfig `protobuf:"bytes,11,rep,name=middlewares,proto3" json:"middlewares,omitempty"`
+	// When true, the proxy stamps agent_network=true on access-log entries
+	// for this target so management routes them to the agent-network log
+	// surface.
+	AgentNetwork bool `protobuf:"varint,12,opt,name=agent_network,json=agentNetwork,proto3" json:"agent_network,omitempty"`
+	// When true, the proxy suppresses the per-request access-log emission for
+	// this target. Defaults false to preserve existing access-log behavior for
+	// every non-agent-network target. The agent-network synth target sets this
+	// true only when the account's EnableLogCollection toggle is off.
+	DisableAccessLog bool `protobuf:"varint,13,opt,name=disable_access_log,json=disableAccessLog,proto3" json:"disable_access_log,omitempty"`
 }
 
 func (x *PathTargetOptions) Reset() {
@@ -505,6 +624,154 @@ func (x *PathTargetOptions) GetDirectUpstream() bool {
 	return false
 }
 
+func (x *PathTargetOptions) GetCaptureMaxRequestBytes() int64 {
+	if x != nil {
+		return x.CaptureMaxRequestBytes
+	}
+	return 0
+}
+
+func (x *PathTargetOptions) GetCaptureMaxResponseBytes() int64 {
+	if x != nil {
+		return x.CaptureMaxResponseBytes
+	}
+	return 0
+}
+
+func (x *PathTargetOptions) GetCaptureContentTypes() []string {
+	if x != nil {
+		return x.CaptureContentTypes
+	}
+	return nil
+}
+
+func (x *PathTargetOptions) GetMiddlewares() []*MiddlewareConfig {
+	if x != nil {
+		return x.Middlewares
+	}
+	return nil
+}
+
+func (x *PathTargetOptions) GetAgentNetwork() bool {
+	if x != nil {
+		return x.AgentNetwork
+	}
+	return false
+}
+
+func (x *PathTargetOptions) GetDisableAccessLog() bool {
+	if x != nil {
+		return x.DisableAccessLog
+	}
+	return false
+}
+
+// MiddlewareConfig is the per-target configuration for a single middleware.
+// The proxy validates every incoming MiddlewareConfig at apply time:
+// unknown ids are rejected, timeout is clamped to [10ms, 5s], and the
+// declared slot must match the registered middleware's slot.
+type MiddlewareConfig struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Middleware id; must match the proxy-local compiled-in registry.
+	Id      string         `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	Enabled bool           `protobuf:"varint,2,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	Slot    MiddlewareSlot `protobuf:"varint,3,opt,name=slot,proto3,enum=management.MiddlewareSlot" json:"slot,omitempty"`
+	// Free-form JSON unmarshalled by the middleware factory into its own typed
+	// config struct. Empty / null / {} are valid (zero-value config).
+	ConfigJson []byte                    `protobuf:"bytes,4,opt,name=config_json,json=configJson,proto3" json:"config_json,omitempty"`
+	FailMode   MiddlewareConfig_FailMode `protobuf:"varint,5,opt,name=fail_mode,json=failMode,proto3,enum=management.MiddlewareConfig_FailMode" json:"fail_mode,omitempty"`
+	// Clamped to [10ms, 5s] at apply time; zero → 500ms default.
+	Timeout *durationpb.Duration `protobuf:"bytes,6,opt,name=timeout,proto3" json:"timeout,omitempty"`
+	// When true, the middleware may mutate request headers or body (subject to
+	// policy). Honoured only when the implementation also declares
+	// MutationsSupported.
+	CanMutate bool `protobuf:"varint,7,opt,name=can_mutate,json=canMutate,proto3" json:"can_mutate,omitempty"`
+}
+
+func (x *MiddlewareConfig) Reset() {
+	*x = MiddlewareConfig{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_proxy_service_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MiddlewareConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MiddlewareConfig) ProtoMessage() {}
+
+func (x *MiddlewareConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_proxy_service_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MiddlewareConfig.ProtoReflect.Descriptor instead.
+func (*MiddlewareConfig) Descriptor() ([]byte, []int) {
+	return file_proxy_service_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *MiddlewareConfig) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *MiddlewareConfig) GetEnabled() bool {
+	if x != nil {
+		return x.Enabled
+	}
+	return false
+}
+
+func (x *MiddlewareConfig) GetSlot() MiddlewareSlot {
+	if x != nil {
+		return x.Slot
+	}
+	return MiddlewareSlot_MIDDLEWARE_SLOT_UNSPECIFIED
+}
+
+func (x *MiddlewareConfig) GetConfigJson() []byte {
+	if x != nil {
+		return x.ConfigJson
+	}
+	return nil
+}
+
+func (x *MiddlewareConfig) GetFailMode() MiddlewareConfig_FailMode {
+	if x != nil {
+		return x.FailMode
+	}
+	return MiddlewareConfig_FAIL_OPEN
+}
+
+func (x *MiddlewareConfig) GetTimeout() *durationpb.Duration {
+	if x != nil {
+		return x.Timeout
+	}
+	return nil
+}
+
+func (x *MiddlewareConfig) GetCanMutate() bool {
+	if x != nil {
+		return x.CanMutate
+	}
+	return false
+}
+
 type PathMapping struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -518,7 +785,7 @@ type PathMapping struct {
 func (x *PathMapping) Reset() {
 	*x = PathMapping{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[4]
+		mi := &file_proxy_service_proto_msgTypes[5]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -531,7 +798,7 @@ func (x *PathMapping) String() string {
 func (*PathMapping) ProtoMessage() {}
 
 func (x *PathMapping) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[4]
+	mi := &file_proxy_service_proto_msgTypes[5]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -544,7 +811,7 @@ func (x *PathMapping) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PathMapping.ProtoReflect.Descriptor instead.
 func (*PathMapping) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{4}
+	return file_proxy_service_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *PathMapping) GetPath() string {
@@ -582,7 +849,7 @@ type HeaderAuth struct {
 func (x *HeaderAuth) Reset() {
 	*x = HeaderAuth{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[5]
+		mi := &file_proxy_service_proto_msgTypes[6]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -595,7 +862,7 @@ func (x *HeaderAuth) String() string {
 func (*HeaderAuth) ProtoMessage() {}
 
 func (x *HeaderAuth) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[5]
+	mi := &file_proxy_service_proto_msgTypes[6]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -608,7 +875,7 @@ func (x *HeaderAuth) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use HeaderAuth.ProtoReflect.Descriptor instead.
 func (*HeaderAuth) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{5}
+	return file_proxy_service_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *HeaderAuth) GetHeader() string {
@@ -641,7 +908,7 @@ type Authentication struct {
 func (x *Authentication) Reset() {
 	*x = Authentication{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[6]
+		mi := &file_proxy_service_proto_msgTypes[7]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -654,7 +921,7 @@ func (x *Authentication) String() string {
 func (*Authentication) ProtoMessage() {}
 
 func (x *Authentication) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[6]
+	mi := &file_proxy_service_proto_msgTypes[7]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -667,7 +934,7 @@ func (x *Authentication) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Authentication.ProtoReflect.Descriptor instead.
 func (*Authentication) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{6}
+	return file_proxy_service_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *Authentication) GetSessionKey() string {
@@ -728,7 +995,7 @@ type AccessRestrictions struct {
 func (x *AccessRestrictions) Reset() {
 	*x = AccessRestrictions{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[7]
+		mi := &file_proxy_service_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -741,7 +1008,7 @@ func (x *AccessRestrictions) String() string {
 func (*AccessRestrictions) ProtoMessage() {}
 
 func (x *AccessRestrictions) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[7]
+	mi := &file_proxy_service_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -754,7 +1021,7 @@ func (x *AccessRestrictions) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AccessRestrictions.ProtoReflect.Descriptor instead.
 func (*AccessRestrictions) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{7}
+	return file_proxy_service_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *AccessRestrictions) GetAllowedCidrs() []string {
@@ -822,7 +1089,7 @@ type ProxyMapping struct {
 func (x *ProxyMapping) Reset() {
 	*x = ProxyMapping{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[8]
+		mi := &file_proxy_service_proto_msgTypes[9]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -835,7 +1102,7 @@ func (x *ProxyMapping) String() string {
 func (*ProxyMapping) ProtoMessage() {}
 
 func (x *ProxyMapping) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[8]
+	mi := &file_proxy_service_proto_msgTypes[9]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -848,7 +1115,7 @@ func (x *ProxyMapping) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ProxyMapping.ProtoReflect.Descriptor instead.
 func (*ProxyMapping) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{8}
+	return file_proxy_service_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *ProxyMapping) GetType() ProxyMappingUpdateType {
@@ -954,7 +1221,7 @@ type SendAccessLogRequest struct {
 func (x *SendAccessLogRequest) Reset() {
 	*x = SendAccessLogRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[9]
+		mi := &file_proxy_service_proto_msgTypes[10]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -967,7 +1234,7 @@ func (x *SendAccessLogRequest) String() string {
 func (*SendAccessLogRequest) ProtoMessage() {}
 
 func (x *SendAccessLogRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[9]
+	mi := &file_proxy_service_proto_msgTypes[10]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -980,7 +1247,7 @@ func (x *SendAccessLogRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SendAccessLogRequest.ProtoReflect.Descriptor instead.
 func (*SendAccessLogRequest) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{9}
+	return file_proxy_service_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *SendAccessLogRequest) GetLog() *AccessLog {
@@ -1000,7 +1267,7 @@ type SendAccessLogResponse struct {
 func (x *SendAccessLogResponse) Reset() {
 	*x = SendAccessLogResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[10]
+		mi := &file_proxy_service_proto_msgTypes[11]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1013,7 +1280,7 @@ func (x *SendAccessLogResponse) String() string {
 func (*SendAccessLogResponse) ProtoMessage() {}
 
 func (x *SendAccessLogResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[10]
+	mi := &file_proxy_service_proto_msgTypes[11]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1026,7 +1293,7 @@ func (x *SendAccessLogResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SendAccessLogResponse.ProtoReflect.Descriptor instead.
 func (*SendAccessLogResponse) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{10}
+	return file_proxy_service_proto_rawDescGZIP(), []int{11}
 }
 
 type AccessLog struct {
@@ -1052,12 +1319,16 @@ type AccessLog struct {
 	Protocol      string                 `protobuf:"bytes,16,opt,name=protocol,proto3" json:"protocol,omitempty"`
 	// Extra key-value metadata for the access log entry (e.g. crowdsec_verdict, scenario).
 	Metadata map[string]string `protobuf:"bytes,17,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// When true, the entry was emitted by an agent-network synth service.
+	// Management routes these to the agent-network access-log surface instead
+	// of the standard service log.
+	AgentNetwork bool `protobuf:"varint,18,opt,name=agent_network,json=agentNetwork,proto3" json:"agent_network,omitempty"`
 }
 
 func (x *AccessLog) Reset() {
 	*x = AccessLog{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[11]
+		mi := &file_proxy_service_proto_msgTypes[12]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1070,7 +1341,7 @@ func (x *AccessLog) String() string {
 func (*AccessLog) ProtoMessage() {}
 
 func (x *AccessLog) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[11]
+	mi := &file_proxy_service_proto_msgTypes[12]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1083,7 +1354,7 @@ func (x *AccessLog) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AccessLog.ProtoReflect.Descriptor instead.
 func (*AccessLog) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{11}
+	return file_proxy_service_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *AccessLog) GetTimestamp() *timestamppb.Timestamp {
@@ -1205,6 +1476,13 @@ func (x *AccessLog) GetMetadata() map[string]string {
 	return nil
 }
 
+func (x *AccessLog) GetAgentNetwork() bool {
+	if x != nil {
+		return x.AgentNetwork
+	}
+	return false
+}
+
 type AuthenticateRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -1223,7 +1501,7 @@ type AuthenticateRequest struct {
 func (x *AuthenticateRequest) Reset() {
 	*x = AuthenticateRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[12]
+		mi := &file_proxy_service_proto_msgTypes[13]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1236,7 +1514,7 @@ func (x *AuthenticateRequest) String() string {
 func (*AuthenticateRequest) ProtoMessage() {}
 
 func (x *AuthenticateRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[12]
+	mi := &file_proxy_service_proto_msgTypes[13]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1249,7 +1527,7 @@ func (x *AuthenticateRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AuthenticateRequest.ProtoReflect.Descriptor instead.
 func (*AuthenticateRequest) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{12}
+	return file_proxy_service_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *AuthenticateRequest) GetId() string {
@@ -1328,7 +1606,7 @@ type HeaderAuthRequest struct {
 func (x *HeaderAuthRequest) Reset() {
 	*x = HeaderAuthRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[13]
+		mi := &file_proxy_service_proto_msgTypes[14]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1341,7 +1619,7 @@ func (x *HeaderAuthRequest) String() string {
 func (*HeaderAuthRequest) ProtoMessage() {}
 
 func (x *HeaderAuthRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[13]
+	mi := &file_proxy_service_proto_msgTypes[14]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1354,7 +1632,7 @@ func (x *HeaderAuthRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use HeaderAuthRequest.ProtoReflect.Descriptor instead.
 func (*HeaderAuthRequest) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{13}
+	return file_proxy_service_proto_rawDescGZIP(), []int{14}
 }
 
 func (x *HeaderAuthRequest) GetHeaderValue() string {
@@ -1382,7 +1660,7 @@ type PasswordRequest struct {
 func (x *PasswordRequest) Reset() {
 	*x = PasswordRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[14]
+		mi := &file_proxy_service_proto_msgTypes[15]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1395,7 +1673,7 @@ func (x *PasswordRequest) String() string {
 func (*PasswordRequest) ProtoMessage() {}
 
 func (x *PasswordRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[14]
+	mi := &file_proxy_service_proto_msgTypes[15]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1408,7 +1686,7 @@ func (x *PasswordRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PasswordRequest.ProtoReflect.Descriptor instead.
 func (*PasswordRequest) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{14}
+	return file_proxy_service_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *PasswordRequest) GetPassword() string {
@@ -1429,7 +1707,7 @@ type PinRequest struct {
 func (x *PinRequest) Reset() {
 	*x = PinRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[15]
+		mi := &file_proxy_service_proto_msgTypes[16]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1442,7 +1720,7 @@ func (x *PinRequest) String() string {
 func (*PinRequest) ProtoMessage() {}
 
 func (x *PinRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[15]
+	mi := &file_proxy_service_proto_msgTypes[16]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1455,7 +1733,7 @@ func (x *PinRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PinRequest.ProtoReflect.Descriptor instead.
 func (*PinRequest) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{15}
+	return file_proxy_service_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *PinRequest) GetPin() string {
@@ -1477,7 +1755,7 @@ type AuthenticateResponse struct {
 func (x *AuthenticateResponse) Reset() {
 	*x = AuthenticateResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[16]
+		mi := &file_proxy_service_proto_msgTypes[17]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1490,7 +1768,7 @@ func (x *AuthenticateResponse) String() string {
 func (*AuthenticateResponse) ProtoMessage() {}
 
 func (x *AuthenticateResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[16]
+	mi := &file_proxy_service_proto_msgTypes[17]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1503,7 +1781,7 @@ func (x *AuthenticateResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AuthenticateResponse.ProtoReflect.Descriptor instead.
 func (*AuthenticateResponse) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{16}
+	return file_proxy_service_proto_rawDescGZIP(), []int{17}
 }
 
 func (x *AuthenticateResponse) GetSuccess() bool {
@@ -1532,7 +1810,7 @@ type SendStatusUpdateRequest struct {
 	CertificateIssued bool        `protobuf:"varint,4,opt,name=certificate_issued,json=certificateIssued,proto3" json:"certificate_issued,omitempty"`
 	ErrorMessage      *string     `protobuf:"bytes,5,opt,name=error_message,json=errorMessage,proto3,oneof" json:"error_message,omitempty"`
 	// Per-account inbound listener state for the account that owns
-	// service_id. Populated only when --private-inbound is enabled and the
+	// service_id. Populated only when --private is enabled and the
 	// embedded client for the account is up. Field numbers >=50 reserved
 	// for observability extensions.
 	InboundListener *ProxyInboundListener `protobuf:"bytes,50,opt,name=inbound_listener,json=inboundListener,proto3,oneof" json:"inbound_listener,omitempty"`
@@ -1541,7 +1819,7 @@ type SendStatusUpdateRequest struct {
 func (x *SendStatusUpdateRequest) Reset() {
 	*x = SendStatusUpdateRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[17]
+		mi := &file_proxy_service_proto_msgTypes[18]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1554,7 +1832,7 @@ func (x *SendStatusUpdateRequest) String() string {
 func (*SendStatusUpdateRequest) ProtoMessage() {}
 
 func (x *SendStatusUpdateRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[17]
+	mi := &file_proxy_service_proto_msgTypes[18]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1567,7 +1845,7 @@ func (x *SendStatusUpdateRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SendStatusUpdateRequest.ProtoReflect.Descriptor instead.
 func (*SendStatusUpdateRequest) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{17}
+	return file_proxy_service_proto_rawDescGZIP(), []int{18}
 }
 
 func (x *SendStatusUpdateRequest) GetServiceId() string {
@@ -1633,7 +1911,7 @@ type ProxyInboundListener struct {
 func (x *ProxyInboundListener) Reset() {
 	*x = ProxyInboundListener{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[18]
+		mi := &file_proxy_service_proto_msgTypes[19]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1646,7 +1924,7 @@ func (x *ProxyInboundListener) String() string {
 func (*ProxyInboundListener) ProtoMessage() {}
 
 func (x *ProxyInboundListener) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[18]
+	mi := &file_proxy_service_proto_msgTypes[19]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1659,7 +1937,7 @@ func (x *ProxyInboundListener) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ProxyInboundListener.ProtoReflect.Descriptor instead.
 func (*ProxyInboundListener) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{18}
+	return file_proxy_service_proto_rawDescGZIP(), []int{19}
 }
 
 func (x *ProxyInboundListener) GetTunnelIp() string {
@@ -1693,7 +1971,7 @@ type SendStatusUpdateResponse struct {
 func (x *SendStatusUpdateResponse) Reset() {
 	*x = SendStatusUpdateResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[19]
+		mi := &file_proxy_service_proto_msgTypes[20]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1706,7 +1984,7 @@ func (x *SendStatusUpdateResponse) String() string {
 func (*SendStatusUpdateResponse) ProtoMessage() {}
 
 func (x *SendStatusUpdateResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[19]
+	mi := &file_proxy_service_proto_msgTypes[20]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1719,7 +1997,7 @@ func (x *SendStatusUpdateResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SendStatusUpdateResponse.ProtoReflect.Descriptor instead.
 func (*SendStatusUpdateResponse) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{19}
+	return file_proxy_service_proto_rawDescGZIP(), []int{20}
 }
 
 // CreateProxyPeerRequest is sent by the proxy to create a peer connection
@@ -1739,7 +2017,7 @@ type CreateProxyPeerRequest struct {
 func (x *CreateProxyPeerRequest) Reset() {
 	*x = CreateProxyPeerRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[20]
+		mi := &file_proxy_service_proto_msgTypes[21]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1752,7 +2030,7 @@ func (x *CreateProxyPeerRequest) String() string {
 func (*CreateProxyPeerRequest) ProtoMessage() {}
 
 func (x *CreateProxyPeerRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[20]
+	mi := &file_proxy_service_proto_msgTypes[21]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1765,7 +2043,7 @@ func (x *CreateProxyPeerRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CreateProxyPeerRequest.ProtoReflect.Descriptor instead.
 func (*CreateProxyPeerRequest) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{20}
+	return file_proxy_service_proto_rawDescGZIP(), []int{21}
 }
 
 func (x *CreateProxyPeerRequest) GetServiceId() string {
@@ -1816,7 +2094,7 @@ type CreateProxyPeerResponse struct {
 func (x *CreateProxyPeerResponse) Reset() {
 	*x = CreateProxyPeerResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[21]
+		mi := &file_proxy_service_proto_msgTypes[22]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1829,7 +2107,7 @@ func (x *CreateProxyPeerResponse) String() string {
 func (*CreateProxyPeerResponse) ProtoMessage() {}
 
 func (x *CreateProxyPeerResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[21]
+	mi := &file_proxy_service_proto_msgTypes[22]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1842,7 +2120,7 @@ func (x *CreateProxyPeerResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CreateProxyPeerResponse.ProtoReflect.Descriptor instead.
 func (*CreateProxyPeerResponse) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{21}
+	return file_proxy_service_proto_rawDescGZIP(), []int{22}
 }
 
 func (x *CreateProxyPeerResponse) GetSuccess() bool {
@@ -1872,7 +2150,7 @@ type GetOIDCURLRequest struct {
 func (x *GetOIDCURLRequest) Reset() {
 	*x = GetOIDCURLRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[22]
+		mi := &file_proxy_service_proto_msgTypes[23]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1885,7 +2163,7 @@ func (x *GetOIDCURLRequest) String() string {
 func (*GetOIDCURLRequest) ProtoMessage() {}
 
 func (x *GetOIDCURLRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[22]
+	mi := &file_proxy_service_proto_msgTypes[23]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1898,7 +2176,7 @@ func (x *GetOIDCURLRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetOIDCURLRequest.ProtoReflect.Descriptor instead.
 func (*GetOIDCURLRequest) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{22}
+	return file_proxy_service_proto_rawDescGZIP(), []int{23}
 }
 
 func (x *GetOIDCURLRequest) GetId() string {
@@ -1933,7 +2211,7 @@ type GetOIDCURLResponse struct {
 func (x *GetOIDCURLResponse) Reset() {
 	*x = GetOIDCURLResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[23]
+		mi := &file_proxy_service_proto_msgTypes[24]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1946,7 +2224,7 @@ func (x *GetOIDCURLResponse) String() string {
 func (*GetOIDCURLResponse) ProtoMessage() {}
 
 func (x *GetOIDCURLResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[23]
+	mi := &file_proxy_service_proto_msgTypes[24]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1959,7 +2237,7 @@ func (x *GetOIDCURLResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetOIDCURLResponse.ProtoReflect.Descriptor instead.
 func (*GetOIDCURLResponse) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{23}
+	return file_proxy_service_proto_rawDescGZIP(), []int{24}
 }
 
 func (x *GetOIDCURLResponse) GetUrl() string {
@@ -1981,7 +2259,7 @@ type ValidateSessionRequest struct {
 func (x *ValidateSessionRequest) Reset() {
 	*x = ValidateSessionRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[24]
+		mi := &file_proxy_service_proto_msgTypes[25]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1994,7 +2272,7 @@ func (x *ValidateSessionRequest) String() string {
 func (*ValidateSessionRequest) ProtoMessage() {}
 
 func (x *ValidateSessionRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[24]
+	mi := &file_proxy_service_proto_msgTypes[25]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2007,7 +2285,7 @@ func (x *ValidateSessionRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ValidateSessionRequest.ProtoReflect.Descriptor instead.
 func (*ValidateSessionRequest) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{24}
+	return file_proxy_service_proto_rawDescGZIP(), []int{25}
 }
 
 func (x *ValidateSessionRequest) GetDomain() string {
@@ -2047,7 +2325,7 @@ type ValidateSessionResponse struct {
 func (x *ValidateSessionResponse) Reset() {
 	*x = ValidateSessionResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[25]
+		mi := &file_proxy_service_proto_msgTypes[26]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2060,7 +2338,7 @@ func (x *ValidateSessionResponse) String() string {
 func (*ValidateSessionResponse) ProtoMessage() {}
 
 func (x *ValidateSessionResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[25]
+	mi := &file_proxy_service_proto_msgTypes[26]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2073,7 +2351,7 @@ func (x *ValidateSessionResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ValidateSessionResponse.ProtoReflect.Descriptor instead.
 func (*ValidateSessionResponse) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{25}
+	return file_proxy_service_proto_rawDescGZIP(), []int{26}
 }
 
 func (x *ValidateSessionResponse) GetValid() bool {
@@ -2133,7 +2411,7 @@ type ValidateTunnelPeerRequest struct {
 func (x *ValidateTunnelPeerRequest) Reset() {
 	*x = ValidateTunnelPeerRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[26]
+		mi := &file_proxy_service_proto_msgTypes[27]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2146,7 +2424,7 @@ func (x *ValidateTunnelPeerRequest) String() string {
 func (*ValidateTunnelPeerRequest) ProtoMessage() {}
 
 func (x *ValidateTunnelPeerRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[26]
+	mi := &file_proxy_service_proto_msgTypes[27]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2159,7 +2437,7 @@ func (x *ValidateTunnelPeerRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ValidateTunnelPeerRequest.ProtoReflect.Descriptor instead.
 func (*ValidateTunnelPeerRequest) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{26}
+	return file_proxy_service_proto_rawDescGZIP(), []int{27}
 }
 
 func (x *ValidateTunnelPeerRequest) GetTunnelIp() string {
@@ -2213,7 +2491,7 @@ type ValidateTunnelPeerResponse struct {
 func (x *ValidateTunnelPeerResponse) Reset() {
 	*x = ValidateTunnelPeerResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[27]
+		mi := &file_proxy_service_proto_msgTypes[28]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2226,7 +2504,7 @@ func (x *ValidateTunnelPeerResponse) String() string {
 func (*ValidateTunnelPeerResponse) ProtoMessage() {}
 
 func (x *ValidateTunnelPeerResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[27]
+	mi := &file_proxy_service_proto_msgTypes[28]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2239,7 +2517,7 @@ func (x *ValidateTunnelPeerResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ValidateTunnelPeerResponse.ProtoReflect.Descriptor instead.
 func (*ValidateTunnelPeerResponse) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{27}
+	return file_proxy_service_proto_rawDescGZIP(), []int{28}
 }
 
 func (x *ValidateTunnelPeerResponse) GetValid() bool {
@@ -2309,7 +2587,7 @@ type SyncMappingsRequest struct {
 func (x *SyncMappingsRequest) Reset() {
 	*x = SyncMappingsRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[28]
+		mi := &file_proxy_service_proto_msgTypes[29]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2322,7 +2600,7 @@ func (x *SyncMappingsRequest) String() string {
 func (*SyncMappingsRequest) ProtoMessage() {}
 
 func (x *SyncMappingsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[28]
+	mi := &file_proxy_service_proto_msgTypes[29]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2335,7 +2613,7 @@ func (x *SyncMappingsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SyncMappingsRequest.ProtoReflect.Descriptor instead.
 func (*SyncMappingsRequest) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{28}
+	return file_proxy_service_proto_rawDescGZIP(), []int{29}
 }
 
 func (m *SyncMappingsRequest) GetMsg() isSyncMappingsRequest_Msg {
@@ -2392,7 +2670,7 @@ type SyncMappingsInit struct {
 func (x *SyncMappingsInit) Reset() {
 	*x = SyncMappingsInit{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[29]
+		mi := &file_proxy_service_proto_msgTypes[30]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2405,7 +2683,7 @@ func (x *SyncMappingsInit) String() string {
 func (*SyncMappingsInit) ProtoMessage() {}
 
 func (x *SyncMappingsInit) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[29]
+	mi := &file_proxy_service_proto_msgTypes[30]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2418,7 +2696,7 @@ func (x *SyncMappingsInit) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SyncMappingsInit.ProtoReflect.Descriptor instead.
 func (*SyncMappingsInit) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{29}
+	return file_proxy_service_proto_rawDescGZIP(), []int{30}
 }
 
 func (x *SyncMappingsInit) GetProxyId() string {
@@ -2467,7 +2745,7 @@ type SyncMappingsAck struct {
 func (x *SyncMappingsAck) Reset() {
 	*x = SyncMappingsAck{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[30]
+		mi := &file_proxy_service_proto_msgTypes[31]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2480,7 +2758,7 @@ func (x *SyncMappingsAck) String() string {
 func (*SyncMappingsAck) ProtoMessage() {}
 
 func (x *SyncMappingsAck) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[30]
+	mi := &file_proxy_service_proto_msgTypes[31]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2493,7 +2771,7 @@ func (x *SyncMappingsAck) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SyncMappingsAck.ProtoReflect.Descriptor instead.
 func (*SyncMappingsAck) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{30}
+	return file_proxy_service_proto_rawDescGZIP(), []int{31}
 }
 
 // SyncMappingsResponse is a batch of mappings sent by management.
@@ -2511,7 +2789,7 @@ type SyncMappingsResponse struct {
 func (x *SyncMappingsResponse) Reset() {
 	*x = SyncMappingsResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_proxy_service_proto_msgTypes[31]
+		mi := &file_proxy_service_proto_msgTypes[32]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2524,7 +2802,7 @@ func (x *SyncMappingsResponse) String() string {
 func (*SyncMappingsResponse) ProtoMessage() {}
 
 func (x *SyncMappingsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_proxy_service_proto_msgTypes[31]
+	mi := &file_proxy_service_proto_msgTypes[32]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2537,7 +2815,7 @@ func (x *SyncMappingsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SyncMappingsResponse.ProtoReflect.Descriptor instead.
 func (*SyncMappingsResponse) Descriptor() ([]byte, []int) {
-	return file_proxy_service_proto_rawDescGZIP(), []int{31}
+	return file_proxy_service_proto_rawDescGZIP(), []int{32}
 }
 
 func (x *SyncMappingsResponse) GetMapping() []*ProxyMapping {
@@ -2554,6 +2832,338 @@ func (x *SyncMappingsResponse) GetInitialSyncComplete() bool {
 	return false
 }
 
+// CheckLLMPolicyLimitsRequest carries the resolved caller identity and the
+// upstream provider already chosen by llm_router. Management computes which
+// policies authorise the request, picks the one with the most remaining
+// headroom, and returns the attribution decision.
+type CheckLLMPolicyLimitsRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// account_id is the netbird account the request belongs to.
+	AccountId string `protobuf:"bytes,1,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
+	// user_id is the netbird user id of the caller. May be empty when the
+	// principal is a tunnel-peer that isn't bound to a user; group membership
+	// still gates the request in that case.
+	UserId string `protobuf:"bytes,2,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	// group_ids is the caller's full group membership at request time.
+	GroupIds []string `protobuf:"bytes,3,rep,name=group_ids,json=groupIds,proto3" json:"group_ids,omitempty"`
+	// provider_id is the agent-network provider record id chosen by llm_router.
+	ProviderId string `protobuf:"bytes,4,opt,name=provider_id,json=providerId,proto3" json:"provider_id,omitempty"`
+	// model is the upstream model identifier extracted from the request body.
+	Model string `protobuf:"bytes,5,opt,name=model,proto3" json:"model,omitempty"`
+}
+
+func (x *CheckLLMPolicyLimitsRequest) Reset() {
+	*x = CheckLLMPolicyLimitsRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_proxy_service_proto_msgTypes[33]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CheckLLMPolicyLimitsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CheckLLMPolicyLimitsRequest) ProtoMessage() {}
+
+func (x *CheckLLMPolicyLimitsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_proxy_service_proto_msgTypes[33]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CheckLLMPolicyLimitsRequest.ProtoReflect.Descriptor instead.
+func (*CheckLLMPolicyLimitsRequest) Descriptor() ([]byte, []int) {
+	return file_proxy_service_proto_rawDescGZIP(), []int{33}
+}
+
+func (x *CheckLLMPolicyLimitsRequest) GetAccountId() string {
+	if x != nil {
+		return x.AccountId
+	}
+	return ""
+}
+
+func (x *CheckLLMPolicyLimitsRequest) GetUserId() string {
+	if x != nil {
+		return x.UserId
+	}
+	return ""
+}
+
+func (x *CheckLLMPolicyLimitsRequest) GetGroupIds() []string {
+	if x != nil {
+		return x.GroupIds
+	}
+	return nil
+}
+
+func (x *CheckLLMPolicyLimitsRequest) GetProviderId() string {
+	if x != nil {
+		return x.ProviderId
+	}
+	return ""
+}
+
+func (x *CheckLLMPolicyLimitsRequest) GetModel() string {
+	if x != nil {
+		return x.Model
+	}
+	return ""
+}
+
+// CheckLLMPolicyLimitsResponse is management's allow-or-deny decision for a
+// pre-flight check.
+type CheckLLMPolicyLimitsResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// decision is "allow" or "deny".
+	Decision string `protobuf:"bytes,1,opt,name=decision,proto3" json:"decision,omitempty"`
+	// selected_policy_id names the policy that paid for this request.
+	SelectedPolicyId string `protobuf:"bytes,2,opt,name=selected_policy_id,json=selectedPolicyId,proto3" json:"selected_policy_id,omitempty"`
+	// attribution_group_id is the source group the request booked against.
+	AttributionGroupId string `protobuf:"bytes,3,opt,name=attribution_group_id,json=attributionGroupId,proto3" json:"attribution_group_id,omitempty"`
+	// window_seconds is the cap window length the selected policy uses.
+	WindowSeconds int64 `protobuf:"varint,4,opt,name=window_seconds,json=windowSeconds,proto3" json:"window_seconds,omitempty"`
+	// deny_code is set on decision="deny" with a stable label.
+	DenyCode string `protobuf:"bytes,5,opt,name=deny_code,json=denyCode,proto3" json:"deny_code,omitempty"`
+	// deny_reason is a short human-readable explanation paired with deny_code.
+	DenyReason string `protobuf:"bytes,6,opt,name=deny_reason,json=denyReason,proto3" json:"deny_reason,omitempty"`
+}
+
+func (x *CheckLLMPolicyLimitsResponse) Reset() {
+	*x = CheckLLMPolicyLimitsResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_proxy_service_proto_msgTypes[34]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CheckLLMPolicyLimitsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CheckLLMPolicyLimitsResponse) ProtoMessage() {}
+
+func (x *CheckLLMPolicyLimitsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_proxy_service_proto_msgTypes[34]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CheckLLMPolicyLimitsResponse.ProtoReflect.Descriptor instead.
+func (*CheckLLMPolicyLimitsResponse) Descriptor() ([]byte, []int) {
+	return file_proxy_service_proto_rawDescGZIP(), []int{34}
+}
+
+func (x *CheckLLMPolicyLimitsResponse) GetDecision() string {
+	if x != nil {
+		return x.Decision
+	}
+	return ""
+}
+
+func (x *CheckLLMPolicyLimitsResponse) GetSelectedPolicyId() string {
+	if x != nil {
+		return x.SelectedPolicyId
+	}
+	return ""
+}
+
+func (x *CheckLLMPolicyLimitsResponse) GetAttributionGroupId() string {
+	if x != nil {
+		return x.AttributionGroupId
+	}
+	return ""
+}
+
+func (x *CheckLLMPolicyLimitsResponse) GetWindowSeconds() int64 {
+	if x != nil {
+		return x.WindowSeconds
+	}
+	return 0
+}
+
+func (x *CheckLLMPolicyLimitsResponse) GetDenyCode() string {
+	if x != nil {
+		return x.DenyCode
+	}
+	return ""
+}
+
+func (x *CheckLLMPolicyLimitsResponse) GetDenyReason() string {
+	if x != nil {
+		return x.DenyReason
+	}
+	return ""
+}
+
+// RecordLLMUsageRequest is the post-flight increment the proxy posts after
+// the upstream call. Counters are keyed on (account, dimension, window).
+type RecordLLMUsageRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	AccountId string `protobuf:"bytes,1,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
+	UserId    string `protobuf:"bytes,2,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+	// group_id is the selected policy's attribution group, recorded against the
+	// policy window (window_seconds).
+	GroupId       string  `protobuf:"bytes,3,opt,name=group_id,json=groupId,proto3" json:"group_id,omitempty"`
+	WindowSeconds int64   `protobuf:"varint,4,opt,name=window_seconds,json=windowSeconds,proto3" json:"window_seconds,omitempty"`
+	TokensInput   int64   `protobuf:"varint,5,opt,name=tokens_input,json=tokensInput,proto3" json:"tokens_input,omitempty"`
+	TokensOutput  int64   `protobuf:"varint,6,opt,name=tokens_output,json=tokensOutput,proto3" json:"tokens_output,omitempty"`
+	CostUsd       float64 `protobuf:"fixed64,7,opt,name=cost_usd,json=costUsd,proto3" json:"cost_usd,omitempty"`
+	// group_ids is the caller's full group membership, used to fan the same
+	// usage out to every applicable account-level budget rule's own window.
+	GroupIds []string `protobuf:"bytes,8,rep,name=group_ids,json=groupIds,proto3" json:"group_ids,omitempty"`
+}
+
+func (x *RecordLLMUsageRequest) Reset() {
+	*x = RecordLLMUsageRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_proxy_service_proto_msgTypes[35]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RecordLLMUsageRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RecordLLMUsageRequest) ProtoMessage() {}
+
+func (x *RecordLLMUsageRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_proxy_service_proto_msgTypes[35]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RecordLLMUsageRequest.ProtoReflect.Descriptor instead.
+func (*RecordLLMUsageRequest) Descriptor() ([]byte, []int) {
+	return file_proxy_service_proto_rawDescGZIP(), []int{35}
+}
+
+func (x *RecordLLMUsageRequest) GetAccountId() string {
+	if x != nil {
+		return x.AccountId
+	}
+	return ""
+}
+
+func (x *RecordLLMUsageRequest) GetUserId() string {
+	if x != nil {
+		return x.UserId
+	}
+	return ""
+}
+
+func (x *RecordLLMUsageRequest) GetGroupId() string {
+	if x != nil {
+		return x.GroupId
+	}
+	return ""
+}
+
+func (x *RecordLLMUsageRequest) GetWindowSeconds() int64 {
+	if x != nil {
+		return x.WindowSeconds
+	}
+	return 0
+}
+
+func (x *RecordLLMUsageRequest) GetTokensInput() int64 {
+	if x != nil {
+		return x.TokensInput
+	}
+	return 0
+}
+
+func (x *RecordLLMUsageRequest) GetTokensOutput() int64 {
+	if x != nil {
+		return x.TokensOutput
+	}
+	return 0
+}
+
+func (x *RecordLLMUsageRequest) GetCostUsd() float64 {
+	if x != nil {
+		return x.CostUsd
+	}
+	return 0
+}
+
+func (x *RecordLLMUsageRequest) GetGroupIds() []string {
+	if x != nil {
+		return x.GroupIds
+	}
+	return nil
+}
+
+type RecordLLMUsageResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *RecordLLMUsageResponse) Reset() {
+	*x = RecordLLMUsageResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_proxy_service_proto_msgTypes[36]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RecordLLMUsageResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RecordLLMUsageResponse) ProtoMessage() {}
+
+func (x *RecordLLMUsageResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_proxy_service_proto_msgTypes[36]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RecordLLMUsageResponse.ProtoReflect.Descriptor instead.
+func (*RecordLLMUsageResponse) Descriptor() ([]byte, []int) {
+	return file_proxy_service_proto_rawDescGZIP(), []int{36}
+}
+
 var File_proxy_service_proto protoreflect.FileDescriptor
 
 var file_proxy_service_proto_rawDesc = []byte{
@@ -2610,7 +3220,7 @@ var file_proxy_service_proto_rawDesc = []byte{
 	0x69, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x79, 0x6e, 0x63, 0x5f, 0x63, 0x6f, 0x6d,
 	0x70, 0x6c, 0x65, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x13, 0x69, 0x6e, 0x69,
 	0x74, 0x69, 0x61, 0x6c, 0x53, 0x79, 0x6e, 0x63, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65,
-	0x22, 0xf7, 0x03, 0x0a, 0x11, 0x50, 0x61, 0x74, 0x68, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x4f,
+	0x22, 0xb6, 0x06, 0x0a, 0x11, 0x50, 0x61, 0x74, 0x68, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x4f,
 	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x26, 0x0a, 0x0f, 0x73, 0x6b, 0x69, 0x70, 0x5f, 0x74,
 	0x6c, 0x73, 0x5f, 0x76, 0x65, 0x72, 0x69, 0x66, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52,
 	0x0d, 0x73, 0x6b, 0x69, 0x70, 0x54, 0x6c, 0x73, 0x56, 0x65, 0x72, 0x69, 0x66, 0x79, 0x12, 0x42,
@@ -2637,368 +3247,479 @@ var file_proxy_service_proto_rawDesc = []byte{
 	0x73, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x6c, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x12,
 	0x27, 0x0a, 0x0f, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x5f, 0x75, 0x70, 0x73, 0x74, 0x72, 0x65,
 	0x61, 0x6d, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0e, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74,
-	0x55, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x1a, 0x40, 0x0a, 0x12, 0x43, 0x75, 0x73, 0x74,
-	0x6f, 0x6d, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10,
-	0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79,
-	0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x72, 0x0a, 0x0b, 0x50, 0x61,
-	0x74, 0x68, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x61, 0x74,
-	0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x16, 0x0a,
-	0x06, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x74,
-	0x61, 0x72, 0x67, 0x65, 0x74, 0x12, 0x37, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x50, 0x61, 0x74, 0x68, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x4f, 0x70,
-	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0x47,
-	0x0a, 0x0a, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x41, 0x75, 0x74, 0x68, 0x12, 0x16, 0x0a, 0x06,
-	0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x68, 0x65,
-	0x61, 0x64, 0x65, 0x72, 0x12, 0x21, 0x0a, 0x0c, 0x68, 0x61, 0x73, 0x68, 0x65, 0x64, 0x5f, 0x76,
-	0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x68, 0x61, 0x73, 0x68,
-	0x65, 0x64, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x22, 0xe5, 0x01, 0x0a, 0x0e, 0x41, 0x75, 0x74, 0x68,
-	0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x65,
-	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x4b, 0x65, 0x79, 0x12, 0x35, 0x0a, 0x17, 0x6d,
-	0x61, 0x78, 0x5f, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x61, 0x67, 0x65, 0x5f, 0x73,
-	0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x14, 0x6d, 0x61,
-	0x78, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x41, 0x67, 0x65, 0x53, 0x65, 0x63, 0x6f, 0x6e,
-	0x64, 0x73, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x03,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x10,
-	0x0a, 0x03, 0x70, 0x69, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x03, 0x70, 0x69, 0x6e,
-	0x12, 0x12, 0x0a, 0x04, 0x6f, 0x69, 0x64, 0x63, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x04,
-	0x6f, 0x69, 0x64, 0x63, 0x12, 0x39, 0x0a, 0x0c, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x5f, 0x61,
-	0x75, 0x74, 0x68, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x41, 0x75,
-	0x74, 0x68, 0x52, 0x0b, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x41, 0x75, 0x74, 0x68, 0x73, 0x22,
-	0xdd, 0x01, 0x0a, 0x12, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x65, 0x73, 0x74, 0x72, 0x69,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65,
-	0x64, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x61,
-	0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x43, 0x69, 0x64, 0x72, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x62,
-	0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03,
-	0x28, 0x09, 0x52, 0x0c, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64, 0x43, 0x69, 0x64, 0x72, 0x73,
-	0x12, 0x2b, 0x0a, 0x11, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x5f, 0x63, 0x6f, 0x75, 0x6e,
-	0x74, 0x72, 0x69, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10, 0x61, 0x6c, 0x6c,
-	0x6f, 0x77, 0x65, 0x64, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x72, 0x69, 0x65, 0x73, 0x12, 0x2b, 0x0a,
-	0x11, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64, 0x5f, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x72, 0x69,
-	0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x65,
-	0x64, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x72, 0x69, 0x65, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x63, 0x72,
-	0x6f, 0x77, 0x64, 0x73, 0x65, 0x63, 0x5f, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x0c, 0x63, 0x72, 0x6f, 0x77, 0x64, 0x73, 0x65, 0x63, 0x4d, 0x6f, 0x64, 0x65, 0x22,
-	0x80, 0x04, 0x0a, 0x0c, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67,
-	0x12, 0x36, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x22,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x78,
-	0x79, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x54, 0x79,
-	0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f,
-	0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63,
-	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69,
-	0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12,
-	0x2b, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x17, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x61, 0x74, 0x68, 0x4d,
-	0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x1d, 0x0a, 0x0a,
-	0x61, 0x75, 0x74, 0x68, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x09, 0x61, 0x75, 0x74, 0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x2e, 0x0a, 0x04, 0x61,
-	0x75, 0x74, 0x68, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x04, 0x61, 0x75, 0x74, 0x68, 0x12, 0x28, 0x0a, 0x10, 0x70,
-	0x61, 0x73, 0x73, 0x5f, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x18,
-	0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0e, 0x70, 0x61, 0x73, 0x73, 0x48, 0x6f, 0x73, 0x74, 0x48,
-	0x65, 0x61, 0x64, 0x65, 0x72, 0x12, 0x2b, 0x0a, 0x11, 0x72, 0x65, 0x77, 0x72, 0x69, 0x74, 0x65,
-	0x5f, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x73, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x10, 0x72, 0x65, 0x77, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63,
-	0x74, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e,
-	0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0a, 0x6c, 0x69, 0x73,
-	0x74, 0x65, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x4f, 0x0a, 0x13, 0x61, 0x63, 0x63, 0x65, 0x73,
-	0x73, 0x5f, 0x72, 0x65, 0x73, 0x74, 0x72, 0x69, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x0c,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x65, 0x73, 0x74, 0x72, 0x69, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x52, 0x12, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x65, 0x73, 0x74,
-	0x72, 0x69, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x70, 0x72, 0x69, 0x76,
-	0x61, 0x74, 0x65, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x70, 0x72, 0x69, 0x76, 0x61,
-	0x74, 0x65, 0x22, 0x3f, 0x0a, 0x14, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73,
-	0x4c, 0x6f, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x27, 0x0a, 0x03, 0x6c, 0x6f,
-	0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52, 0x03,
-	0x6c, 0x6f, 0x67, 0x22, 0x17, 0x0a, 0x15, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73,
-	0x73, 0x4c, 0x6f, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x84, 0x05, 0x0a,
-	0x09, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x12, 0x38, 0x0a, 0x09, 0x74, 0x69,
-	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
-	0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x74, 0x69, 0x6d, 0x65, 0x73,
-	0x74, 0x61, 0x6d, 0x70, 0x12, 0x15, 0x0a, 0x06, 0x6c, 0x6f, 0x67, 0x5f, 0x69, 0x64, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6c, 0x6f, 0x67, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61,
+	0x55, 0x70, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x12, 0x39, 0x0a, 0x19, 0x63, 0x61, 0x70, 0x74,
+	0x75, 0x72, 0x65, 0x5f, 0x6d, 0x61, 0x78, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f,
+	0x62, 0x79, 0x74, 0x65, 0x73, 0x18, 0x08, 0x20, 0x01, 0x28, 0x03, 0x52, 0x16, 0x63, 0x61, 0x70,
+	0x74, 0x75, 0x72, 0x65, 0x4d, 0x61, 0x78, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x42, 0x79,
+	0x74, 0x65, 0x73, 0x12, 0x3b, 0x0a, 0x1a, 0x63, 0x61, 0x70, 0x74, 0x75, 0x72, 0x65, 0x5f, 0x6d,
+	0x61, 0x78, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x5f, 0x62, 0x79, 0x74, 0x65,
+	0x73, 0x18, 0x09, 0x20, 0x01, 0x28, 0x03, 0x52, 0x17, 0x63, 0x61, 0x70, 0x74, 0x75, 0x72, 0x65,
+	0x4d, 0x61, 0x78, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x79, 0x74, 0x65, 0x73,
+	0x12, 0x32, 0x0a, 0x15, 0x63, 0x61, 0x70, 0x74, 0x75, 0x72, 0x65, 0x5f, 0x63, 0x6f, 0x6e, 0x74,
+	0x65, 0x6e, 0x74, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x09, 0x52,
+	0x13, 0x63, 0x61, 0x70, 0x74, 0x75, 0x72, 0x65, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x54,
+	0x79, 0x70, 0x65, 0x73, 0x12, 0x3e, 0x0a, 0x0b, 0x6d, 0x69, 0x64, 0x64, 0x6c, 0x65, 0x77, 0x61,
+	0x72, 0x65, 0x73, 0x18, 0x0b, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4d, 0x69, 0x64, 0x64, 0x6c, 0x65, 0x77, 0x61, 0x72,
+	0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0b, 0x6d, 0x69, 0x64, 0x64, 0x6c, 0x65, 0x77,
+	0x61, 0x72, 0x65, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x5f, 0x6e, 0x65,
+	0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c, 0x61, 0x67, 0x65,
+	0x6e, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x12, 0x2c, 0x0a, 0x12, 0x64, 0x69, 0x73,
+	0x61, 0x62, 0x6c, 0x65, 0x5f, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x6c, 0x6f, 0x67, 0x18,
+	0x0d, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x41, 0x63,
+	0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x1a, 0x40, 0x0a, 0x12, 0x43, 0x75, 0x73, 0x74, 0x6f,
+	0x6d, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a,
+	0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12,
+	0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xd1, 0x02, 0x0a, 0x10, 0x4d, 0x69,
+	0x64, 0x64, 0x6c, 0x65, 0x77, 0x61, 0x72, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x0e,
+	0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x18,
+	0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x2e, 0x0a, 0x04, 0x73, 0x6c, 0x6f, 0x74,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x4d, 0x69, 0x64, 0x64, 0x6c, 0x65, 0x77, 0x61, 0x72, 0x65, 0x53, 0x6c,
+	0x6f, 0x74, 0x52, 0x04, 0x73, 0x6c, 0x6f, 0x74, 0x12, 0x1f, 0x0a, 0x0b, 0x63, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x5f, 0x6a, 0x73, 0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0a, 0x63,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x4a, 0x73, 0x6f, 0x6e, 0x12, 0x42, 0x0a, 0x09, 0x66, 0x61, 0x69,
+	0x6c, 0x5f, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x25, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4d, 0x69, 0x64, 0x64, 0x6c, 0x65,
+	0x77, 0x61, 0x72, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x46, 0x61, 0x69, 0x6c, 0x4d,
+	0x6f, 0x64, 0x65, 0x52, 0x08, 0x66, 0x61, 0x69, 0x6c, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x33, 0x0a,
+	0x07, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19,
+	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
+	0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x07, 0x74, 0x69, 0x6d, 0x65, 0x6f,
+	0x75, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x63, 0x61, 0x6e, 0x5f, 0x6d, 0x75, 0x74, 0x61, 0x74, 0x65,
+	0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x63, 0x61, 0x6e, 0x4d, 0x75, 0x74, 0x61, 0x74,
+	0x65, 0x22, 0x2a, 0x0a, 0x08, 0x46, 0x61, 0x69, 0x6c, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x0d, 0x0a,
+	0x09, 0x46, 0x41, 0x49, 0x4c, 0x5f, 0x4f, 0x50, 0x45, 0x4e, 0x10, 0x00, 0x12, 0x0f, 0x0a, 0x0b,
+	0x46, 0x41, 0x49, 0x4c, 0x5f, 0x43, 0x4c, 0x4f, 0x53, 0x45, 0x44, 0x10, 0x01, 0x22, 0x72, 0x0a,
+	0x0b, 0x50, 0x61, 0x74, 0x68, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x12, 0x0a, 0x04,
+	0x70, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68,
+	0x12, 0x16, 0x0a, 0x06, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x06, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x12, 0x37, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x61, 0x74, 0x68, 0x54, 0x61, 0x72, 0x67, 0x65,
+	0x74, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x22, 0x47, 0x0a, 0x0a, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x41, 0x75, 0x74, 0x68, 0x12,
+	0x16, 0x0a, 0x06, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x06, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x12, 0x21, 0x0a, 0x0c, 0x68, 0x61, 0x73, 0x68, 0x65,
+	0x64, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x68,
+	0x61, 0x73, 0x68, 0x65, 0x64, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x22, 0xe5, 0x01, 0x0a, 0x0e, 0x41,
+	0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1f, 0x0a,
+	0x0b, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x4b, 0x65, 0x79, 0x12, 0x35,
+	0x0a, 0x17, 0x6d, 0x61, 0x78, 0x5f, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x61, 0x67,
+	0x65, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52,
+	0x14, 0x6d, 0x61, 0x78, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x41, 0x67, 0x65, 0x53, 0x65,
+	0x63, 0x6f, 0x6e, 0x64, 0x73, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72,
+	0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72,
+	0x64, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x03,
+	0x70, 0x69, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x6f, 0x69, 0x64, 0x63, 0x18, 0x05, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x04, 0x6f, 0x69, 0x64, 0x63, 0x12, 0x39, 0x0a, 0x0c, 0x68, 0x65, 0x61, 0x64, 0x65,
+	0x72, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x48, 0x65, 0x61, 0x64, 0x65,
+	0x72, 0x41, 0x75, 0x74, 0x68, 0x52, 0x0b, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x41, 0x75, 0x74,
+	0x68, 0x73, 0x22, 0xdd, 0x01, 0x0a, 0x12, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x65, 0x73,
+	0x74, 0x72, 0x69, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x61, 0x6c, 0x6c,
+	0x6f, 0x77, 0x65, 0x64, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09,
+	0x52, 0x0c, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x43, 0x69, 0x64, 0x72, 0x73, 0x12, 0x23,
+	0x0a, 0x0d, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64, 0x5f, 0x63, 0x69, 0x64, 0x72, 0x73, 0x18,
+	0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64, 0x43, 0x69,
+	0x64, 0x72, 0x73, 0x12, 0x2b, 0x0a, 0x11, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x5f, 0x63,
+	0x6f, 0x75, 0x6e, 0x74, 0x72, 0x69, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10,
+	0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x72, 0x69, 0x65, 0x73,
+	0x12, 0x2b, 0x0a, 0x11, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64, 0x5f, 0x63, 0x6f, 0x75, 0x6e,
+	0x74, 0x72, 0x69, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10, 0x62, 0x6c, 0x6f,
+	0x63, 0x6b, 0x65, 0x64, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x72, 0x69, 0x65, 0x73, 0x12, 0x23, 0x0a,
+	0x0d, 0x63, 0x72, 0x6f, 0x77, 0x64, 0x73, 0x65, 0x63, 0x5f, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x05,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x63, 0x72, 0x6f, 0x77, 0x64, 0x73, 0x65, 0x63, 0x4d, 0x6f,
+	0x64, 0x65, 0x22, 0x80, 0x04, 0x0a, 0x0c, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61, 0x70, 0x70,
+	0x69, 0x6e, 0x67, 0x12, 0x36, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0e, 0x32, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50,
+	0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61, 0x74,
+	0x65, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69,
+	0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61,
 	0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65,
-	0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09,
-	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x6f, 0x73,
-	0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x12, 0x12, 0x0a,
-	0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74,
-	0x68, 0x12, 0x1f, 0x0a, 0x0b, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x73,
-	0x18, 0x07, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0a, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e,
-	0x4d, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x18, 0x08, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x23, 0x0a, 0x0d, 0x72, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28,
-	0x05, 0x52, 0x0c, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x43, 0x6f, 0x64, 0x65, 0x12,
-	0x1b, 0x0a, 0x09, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x70, 0x18, 0x0a, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x08, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x70, 0x12, 0x25, 0x0a, 0x0e,
-	0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x63, 0x68, 0x61, 0x6e, 0x69, 0x73, 0x6d, 0x18, 0x0b,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x61, 0x75, 0x74, 0x68, 0x4d, 0x65, 0x63, 0x68, 0x61, 0x6e,
-	0x69, 0x73, 0x6d, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x0c,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x21, 0x0a, 0x0c,
-	0x61, 0x75, 0x74, 0x68, 0x5f, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x18, 0x0d, 0x20, 0x01,
-	0x28, 0x08, 0x52, 0x0b, 0x61, 0x75, 0x74, 0x68, 0x53, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x12,
-	0x21, 0x0a, 0x0c, 0x62, 0x79, 0x74, 0x65, 0x73, 0x5f, 0x75, 0x70, 0x6c, 0x6f, 0x61, 0x64, 0x18,
-	0x0e, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b, 0x62, 0x79, 0x74, 0x65, 0x73, 0x55, 0x70, 0x6c, 0x6f,
-	0x61, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x62, 0x79, 0x74, 0x65, 0x73, 0x5f, 0x64, 0x6f, 0x77, 0x6e,
-	0x6c, 0x6f, 0x61, 0x64, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0d, 0x62, 0x79, 0x74, 0x65,
-	0x73, 0x44, 0x6f, 0x77, 0x6e, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x10, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x3f, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x18, 0x11, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x2e, 0x4d,
-	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x08, 0x6d, 0x65,
-	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x1a, 0x3b, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c,
-	0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a,
-	0x02, 0x38, 0x01, 0x22, 0xf8, 0x01, 0x0a, 0x13, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69,
-	0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69,
-	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61,
-	0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x39, 0x0a, 0x08, 0x70, 0x61,
-	0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f,
-	0x72, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x00, 0x52, 0x08, 0x70, 0x61, 0x73,
-	0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x2a, 0x0a, 0x03, 0x70, 0x69, 0x6e, 0x18, 0x04, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
-	0x50, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x00, 0x52, 0x03, 0x70, 0x69,
-	0x6e, 0x12, 0x40, 0x0a, 0x0b, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x5f, 0x61, 0x75, 0x74, 0x68,
-	0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x41, 0x75, 0x74, 0x68, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x00, 0x52, 0x0a, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x41,
-	0x75, 0x74, 0x68, 0x42, 0x09, 0x0a, 0x07, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x57,
-	0x0a, 0x11, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x41, 0x75, 0x74, 0x68, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x12, 0x21, 0x0a, 0x0c, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x5f, 0x76, 0x61,
-	0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x68, 0x65, 0x61, 0x64, 0x65,
-	0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72,
-	0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x68, 0x65, 0x61,
-	0x64, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x22, 0x2d, 0x0a, 0x0f, 0x50, 0x61, 0x73, 0x73, 0x77,
-	0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61,
-	0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x61,
-	0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x22, 0x1e, 0x0a, 0x0a, 0x50, 0x69, 0x6e, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x03, 0x70, 0x69, 0x6e, 0x22, 0x55, 0x0a, 0x14, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e,
-	0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x18,
-	0x0a, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x73, 0x65, 0x73, 0x73,
-	0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0c, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0xda, 0x02,
-	0x0a, 0x17, 0x53, 0x65, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x55, 0x70, 0x64, 0x61,
-	0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x72,
-	0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f,
-	0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63,
-	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x2f, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75,
-	0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x17, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
-	0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x2d, 0x0a, 0x12, 0x63, 0x65, 0x72, 0x74,
-	0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f, 0x69, 0x73, 0x73, 0x75, 0x65, 0x64, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x11, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
-	0x65, 0x49, 0x73, 0x73, 0x75, 0x65, 0x64, 0x12, 0x28, 0x0a, 0x0d, 0x65, 0x72, 0x72, 0x6f, 0x72,
-	0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00,
-	0x52, 0x0c, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x88, 0x01,
-	0x01, 0x12, 0x50, 0x0a, 0x10, 0x69, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x5f, 0x6c, 0x69, 0x73,
-	0x74, 0x65, 0x6e, 0x65, 0x72, 0x18, 0x32, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x49, 0x6e,
-	0x62, 0x6f, 0x75, 0x6e, 0x64, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x48, 0x01, 0x52,
-	0x0f, 0x69, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72,
-	0x88, 0x01, 0x01, 0x42, 0x10, 0x0a, 0x0e, 0x5f, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65,
-	0x73, 0x73, 0x61, 0x67, 0x65, 0x42, 0x13, 0x0a, 0x11, 0x5f, 0x69, 0x6e, 0x62, 0x6f, 0x75, 0x6e,
-	0x64, 0x5f, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x22, 0x6f, 0x0a, 0x14, 0x50, 0x72,
-	0x6f, 0x78, 0x79, 0x49, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e,
-	0x65, 0x72, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x5f, 0x69, 0x70, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x49, 0x70, 0x12,
-	0x1d, 0x0a, 0x0a, 0x68, 0x74, 0x74, 0x70, 0x73, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x0d, 0x52, 0x09, 0x68, 0x74, 0x74, 0x70, 0x73, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x1b,
-	0x0a, 0x09, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x0d, 0x52, 0x08, 0x68, 0x74, 0x74, 0x70, 0x50, 0x6f, 0x72, 0x74, 0x22, 0x1a, 0x0a, 0x18, 0x53,
-	0x65, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xb8, 0x01, 0x0a, 0x16, 0x43, 0x72, 0x65, 0x61,
-	0x74, 0x65, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x64,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49,
-	0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64,
-	0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x30, 0x0a, 0x14, 0x77, 0x69, 0x72, 0x65, 0x67, 0x75,
-	0x61, 0x72, 0x64, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x77, 0x69, 0x72, 0x65, 0x67, 0x75, 0x61, 0x72, 0x64, 0x50,
-	0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x18, 0x0a, 0x07, 0x63, 0x6c, 0x75, 0x73,
-	0x74, 0x65, 0x72, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x63, 0x6c, 0x75, 0x73, 0x74,
-	0x65, 0x72, 0x22, 0x6f, 0x0a, 0x17, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78,
-	0x79, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x18, 0x0a,
-	0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07,
-	0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x12, 0x28, 0x0a, 0x0d, 0x65, 0x72, 0x72, 0x6f, 0x72,
-	0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00,
-	0x52, 0x0c, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x88, 0x01,
-	0x01, 0x42, 0x10, 0x0a, 0x0e, 0x5f, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73,
-	0x61, 0x67, 0x65, 0x22, 0x65, 0x0a, 0x11, 0x47, 0x65, 0x74, 0x4f, 0x49, 0x44, 0x43, 0x55, 0x52,
-	0x4c, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f,
-	0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63,
-	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x72, 0x65, 0x64, 0x69, 0x72,
-	0x65, 0x63, 0x74, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x72,
-	0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x55, 0x72, 0x6c, 0x22, 0x26, 0x0a, 0x12, 0x47, 0x65,
-	0x74, 0x4f, 0x49, 0x44, 0x43, 0x55, 0x52, 0x4c, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75,
-	0x72, 0x6c, 0x22, 0x55, 0x0a, 0x16, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65,
-	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x16, 0x0a, 0x06,
-	0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f,
-	0x6d, 0x61, 0x69, 0x6e, 0x12, 0x23, 0x0a, 0x0d, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f,
-	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x65, 0x73,
-	0x73, 0x69, 0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0xdc, 0x01, 0x0a, 0x17, 0x56, 0x61,
-	0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x75,
-	0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73,
-	0x65, 0x72, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x65, 0x6d, 0x61,
-	0x69, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x75, 0x73, 0x65, 0x72, 0x45, 0x6d,
-	0x61, 0x69, 0x6c, 0x12, 0x23, 0x0a, 0x0d, 0x64, 0x65, 0x6e, 0x69, 0x65, 0x64, 0x5f, 0x72, 0x65,
-	0x61, 0x73, 0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x64, 0x65, 0x6e, 0x69,
-	0x65, 0x64, 0x52, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65, 0x65, 0x72,
-	0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09,
-	0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x28,
-	0x0a, 0x10, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x6e, 0x61, 0x6d,
-	0x65, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x47, 0x72,
-	0x6f, 0x75, 0x70, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x22, 0x50, 0x0a, 0x19, 0x56, 0x61, 0x6c, 0x69,
-	0x64, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x5f,
-	0x69, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c,
-	0x49, 0x70, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x22, 0x84, 0x02, 0x0a, 0x1a, 0x56,
-	0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x50, 0x65, 0x65,
-	0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c,
-	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x12,
-	0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x75, 0x73, 0x65, 0x72,
-	0x5f, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x75, 0x73,
-	0x65, 0x72, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x23, 0x0a, 0x0d, 0x64, 0x65, 0x6e, 0x69, 0x65,
-	0x64, 0x5f, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c,
-	0x64, 0x65, 0x6e, 0x69, 0x65, 0x64, 0x52, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x12, 0x23, 0x0a, 0x0d,
-	0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x05, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65,
-	0x6e, 0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f,
-	0x69, 0x64, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x47,
-	0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x28, 0x0a, 0x10, 0x70, 0x65, 0x65, 0x72, 0x5f,
-	0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28,
-	0x09, 0x52, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x4e, 0x61, 0x6d, 0x65,
-	0x73, 0x22, 0x81, 0x01, 0x0a, 0x13, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e,
-	0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x32, 0x0a, 0x04, 0x69, 0x6e, 0x69,
-	0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67,
-	0x73, 0x49, 0x6e, 0x69, 0x74, 0x48, 0x00, 0x52, 0x04, 0x69, 0x6e, 0x69, 0x74, 0x12, 0x2f, 0x0a,
-	0x03, 0x61, 0x63, 0x6b, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70,
-	0x69, 0x6e, 0x67, 0x73, 0x41, 0x63, 0x6b, 0x48, 0x00, 0x52, 0x03, 0x61, 0x63, 0x6b, 0x42, 0x05,
-	0x0a, 0x03, 0x6d, 0x73, 0x67, 0x22, 0xdf, 0x01, 0x0a, 0x10, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61,
-	0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x49, 0x6e, 0x69, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x70, 0x72,
-	0x6f, 0x78, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x70, 0x72,
-	0x6f, 0x78, 0x79, 0x49, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12,
-	0x39, 0x0a, 0x0a, 0x73, 0x74, 0x61, 0x72, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52,
-	0x09, 0x73, 0x74, 0x61, 0x72, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12, 0x18, 0x0a, 0x07, 0x61, 0x64,
-	0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x64, 0x64,
-	0x72, 0x65, 0x73, 0x73, 0x12, 0x41, 0x0a, 0x0c, 0x63, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69,
-	0x74, 0x69, 0x65, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x43, 0x61, 0x70,
-	0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x52, 0x0c, 0x63, 0x61, 0x70, 0x61, 0x62,
-	0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x22, 0x11, 0x0a, 0x0f, 0x53, 0x79, 0x6e, 0x63, 0x4d,
-	0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x41, 0x63, 0x6b, 0x22, 0x7e, 0x0a, 0x14, 0x53, 0x79,
-	0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x12, 0x32, 0x0a, 0x07, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x18, 0x01, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x07, 0x6d,
-	0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x32, 0x0a, 0x15, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x61,
-	0x6c, 0x5f, 0x73, 0x79, 0x6e, 0x63, 0x5f, 0x63, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x13, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x79,
-	0x6e, 0x63, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x2a, 0x64, 0x0a, 0x16, 0x50, 0x72,
-	0x6f, 0x78, 0x79, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65,
-	0x54, 0x79, 0x70, 0x65, 0x12, 0x17, 0x0a, 0x13, 0x55, 0x50, 0x44, 0x41, 0x54, 0x45, 0x5f, 0x54,
-	0x59, 0x50, 0x45, 0x5f, 0x43, 0x52, 0x45, 0x41, 0x54, 0x45, 0x44, 0x10, 0x00, 0x12, 0x18, 0x0a,
-	0x14, 0x55, 0x50, 0x44, 0x41, 0x54, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x4d, 0x4f, 0x44,
-	0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x01, 0x12, 0x17, 0x0a, 0x13, 0x55, 0x50, 0x44, 0x41, 0x54,
-	0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x52, 0x45, 0x4d, 0x4f, 0x56, 0x45, 0x44, 0x10, 0x02,
-	0x2a, 0x46, 0x0a, 0x0f, 0x50, 0x61, 0x74, 0x68, 0x52, 0x65, 0x77, 0x72, 0x69, 0x74, 0x65, 0x4d,
-	0x6f, 0x64, 0x65, 0x12, 0x18, 0x0a, 0x14, 0x50, 0x41, 0x54, 0x48, 0x5f, 0x52, 0x45, 0x57, 0x52,
-	0x49, 0x54, 0x45, 0x5f, 0x44, 0x45, 0x46, 0x41, 0x55, 0x4c, 0x54, 0x10, 0x00, 0x12, 0x19, 0x0a,
-	0x15, 0x50, 0x41, 0x54, 0x48, 0x5f, 0x52, 0x45, 0x57, 0x52, 0x49, 0x54, 0x45, 0x5f, 0x50, 0x52,
-	0x45, 0x53, 0x45, 0x52, 0x56, 0x45, 0x10, 0x01, 0x2a, 0xc8, 0x01, 0x0a, 0x0b, 0x50, 0x72, 0x6f,
-	0x78, 0x79, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x18, 0x0a, 0x14, 0x50, 0x52, 0x4f, 0x58,
-	0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x50, 0x45, 0x4e, 0x44, 0x49, 0x4e, 0x47,
-	0x10, 0x00, 0x12, 0x17, 0x0a, 0x13, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54,
-	0x55, 0x53, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x56, 0x45, 0x10, 0x01, 0x12, 0x23, 0x0a, 0x1f, 0x50,
-	0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x54, 0x55, 0x4e, 0x4e,
-	0x45, 0x4c, 0x5f, 0x4e, 0x4f, 0x54, 0x5f, 0x43, 0x52, 0x45, 0x41, 0x54, 0x45, 0x44, 0x10, 0x02,
-	0x12, 0x24, 0x0a, 0x20, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53,
-	0x5f, 0x43, 0x45, 0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, 0x54, 0x45, 0x5f, 0x50, 0x45, 0x4e,
-	0x44, 0x49, 0x4e, 0x47, 0x10, 0x03, 0x12, 0x23, 0x0a, 0x1f, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f,
-	0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x43, 0x45, 0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41,
-	0x54, 0x45, 0x5f, 0x46, 0x41, 0x49, 0x4c, 0x45, 0x44, 0x10, 0x04, 0x12, 0x16, 0x0a, 0x12, 0x50,
-	0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x45, 0x52, 0x52, 0x4f,
-	0x52, 0x10, 0x05, 0x32, 0xb8, 0x06, 0x0a, 0x0c, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x53, 0x65, 0x72,
-	0x76, 0x69, 0x63, 0x65, 0x12, 0x5f, 0x0a, 0x10, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69,
-	0x6e, 0x67, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x12, 0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67,
-	0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61,
-	0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x30, 0x01, 0x12, 0x55, 0x0a, 0x0c, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70,
-	0x70, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x1f, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
-	0x6e, 0x74, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x28, 0x01, 0x30, 0x01, 0x12, 0x54, 0x0a, 0x0d,
-	0x53, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x12, 0x20, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x41,
-	0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
-	0x21, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65, 0x6e,
-	0x64, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x12, 0x51, 0x0a, 0x0c, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61,
-	0x74, 0x65, 0x12, 0x1f, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f,
+	0x6d, 0x61, 0x69, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61,
+	0x69, 0x6e, 0x12, 0x2b, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x17, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x61,
+	0x74, 0x68, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12,
+	0x1d, 0x0a, 0x0a, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x06, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x75, 0x74, 0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x2e,
+	0x0a, 0x04, 0x61, 0x75, 0x74, 0x68, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e,
+	0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x04, 0x61, 0x75, 0x74, 0x68, 0x12, 0x28,
+	0x0a, 0x10, 0x70, 0x61, 0x73, 0x73, 0x5f, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x68, 0x65, 0x61, 0x64,
+	0x65, 0x72, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0e, 0x70, 0x61, 0x73, 0x73, 0x48, 0x6f,
+	0x73, 0x74, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x12, 0x2b, 0x0a, 0x11, 0x72, 0x65, 0x77, 0x72,
+	0x69, 0x74, 0x65, 0x5f, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x73, 0x18, 0x09, 0x20,
+	0x01, 0x28, 0x08, 0x52, 0x10, 0x72, 0x65, 0x77, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x64, 0x69,
+	0x72, 0x65, 0x63, 0x74, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x0a, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x6c, 0x69, 0x73,
+	0x74, 0x65, 0x6e, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0a,
+	0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x4f, 0x0a, 0x13, 0x61, 0x63,
+	0x63, 0x65, 0x73, 0x73, 0x5f, 0x72, 0x65, 0x73, 0x74, 0x72, 0x69, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52, 0x65, 0x73, 0x74, 0x72,
+	0x69, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x12, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x52,
+	0x65, 0x73, 0x74, 0x72, 0x69, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x70,
+	0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x70, 0x72,
+	0x69, 0x76, 0x61, 0x74, 0x65, 0x22, 0x3f, 0x0a, 0x14, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x63,
+	0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x27, 0x0a,
+	0x03, 0x6c, 0x6f, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f,
+	0x67, 0x52, 0x03, 0x6c, 0x6f, 0x67, 0x22, 0x17, 0x0a, 0x15, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63,
+	0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0xa9, 0x05, 0x0a, 0x09, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x12, 0x38, 0x0a,
+	0x09, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
+	0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x74, 0x69,
+	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x12, 0x15, 0x0a, 0x06, 0x6c, 0x6f, 0x67, 0x5f, 0x69,
+	0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6c, 0x6f, 0x67, 0x49, 0x64, 0x12, 0x1d,
+	0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x1d, 0x0a,
+	0x0a, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x09, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x64, 0x12, 0x12, 0x0a, 0x04,
+	0x68, 0x6f, 0x73, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x68, 0x6f, 0x73, 0x74,
+	0x12, 0x12, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
+	0x70, 0x61, 0x74, 0x68, 0x12, 0x1f, 0x0a, 0x0b, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x5f, 0x6d, 0x73, 0x18, 0x07, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0a, 0x64, 0x75, 0x72, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x4d, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x18,
+	0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x23, 0x0a,
+	0x0d, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x09,
+	0x20, 0x01, 0x28, 0x05, 0x52, 0x0c, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x43, 0x6f,
+	0x64, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x70, 0x18,
+	0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x70, 0x12,
+	0x25, 0x0a, 0x0e, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x63, 0x68, 0x61, 0x6e, 0x69, 0x73,
+	0x6d, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x61, 0x75, 0x74, 0x68, 0x4d, 0x65, 0x63,
+	0x68, 0x61, 0x6e, 0x69, 0x73, 0x6d, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69,
+	0x64, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12,
+	0x21, 0x0a, 0x0c, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x18,
+	0x0d, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x61, 0x75, 0x74, 0x68, 0x53, 0x75, 0x63, 0x63, 0x65,
+	0x73, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x62, 0x79, 0x74, 0x65, 0x73, 0x5f, 0x75, 0x70, 0x6c, 0x6f,
+	0x61, 0x64, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b, 0x62, 0x79, 0x74, 0x65, 0x73, 0x55,
+	0x70, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x62, 0x79, 0x74, 0x65, 0x73, 0x5f, 0x64,
+	0x6f, 0x77, 0x6e, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0d, 0x62,
+	0x79, 0x74, 0x65, 0x73, 0x44, 0x6f, 0x77, 0x6e, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x1a, 0x0a, 0x08,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x10, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x3f, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x18, 0x11, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f,
+	0x67, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52,
+	0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x23, 0x0a, 0x0d, 0x61, 0x67, 0x65,
+	0x6e, 0x74, 0x5f, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x12, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x0c, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x1a, 0x3b,
+	0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12,
+	0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65,
+	0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xf8, 0x01, 0x0a, 0x13,
 	0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5d, 0x0a, 0x10, 0x53, 0x65, 0x6e, 0x64, 0x53, 0x74, 0x61,
-	0x74, 0x75, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x12, 0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x74, 0x75,
-	0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65, 0x6e, 0x64,
-	0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5a, 0x0a, 0x0f, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72,
-	0x6f, 0x78, 0x79, 0x50, 0x65, 0x65, 0x72, 0x12, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78, 0x79,
-	0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50,
-	0x72, 0x6f, 0x78, 0x79, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x12, 0x4b, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x4f, 0x49, 0x44, 0x43, 0x55, 0x52, 0x4c, 0x12, 0x1d,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x47, 0x65, 0x74, 0x4f,
-	0x49, 0x44, 0x43, 0x55, 0x52, 0x4c, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1e, 0x2e,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x47, 0x65, 0x74, 0x4f, 0x49,
-	0x44, 0x43, 0x55, 0x52, 0x4c, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5a, 0x0a,
-	0x0f, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
-	0x12, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x56, 0x61,
+	0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x02, 0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69,
+	0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74,
+	0x49, 0x64, 0x12, 0x39, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x48, 0x00, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x2a, 0x0a,
+	0x03, 0x70, 0x69, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x48, 0x00, 0x52, 0x03, 0x70, 0x69, 0x6e, 0x12, 0x40, 0x0a, 0x0b, 0x68, 0x65, 0x61,
+	0x64, 0x65, 0x72, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x48, 0x65, 0x61, 0x64,
+	0x65, 0x72, 0x41, 0x75, 0x74, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x00, 0x52,
+	0x0a, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x41, 0x75, 0x74, 0x68, 0x42, 0x09, 0x0a, 0x07, 0x72,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x57, 0x0a, 0x11, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72,
+	0x41, 0x75, 0x74, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x21, 0x0a, 0x0c, 0x68,
+	0x65, 0x61, 0x64, 0x65, 0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0b, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x1f,
+	0x0a, 0x0b, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0a, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x22,
+	0x2d, 0x0a, 0x0f, 0x50, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x22, 0x1e,
+	0x0a, 0x0a, 0x50, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x10, 0x0a, 0x03,
+	0x70, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x70, 0x69, 0x6e, 0x22, 0x55,
+	0x0a, 0x14, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73,
+	0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73,
+	0x12, 0x23, 0x0a, 0x0d, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65,
+	0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
+	0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0xda, 0x02, 0x0a, 0x17, 0x53, 0x65, 0x6e, 0x64, 0x53, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x64,
+	0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12,
+	0x2f, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32,
+	0x17, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f,
+	0x78, 0x79, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73,
+	0x12, 0x2d, 0x0a, 0x12, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x5f,
+	0x69, 0x73, 0x73, 0x75, 0x65, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x11, 0x63, 0x65,
+	0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x49, 0x73, 0x73, 0x75, 0x65, 0x64, 0x12,
+	0x28, 0x0a, 0x0d, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
+	0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x0c, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x4d,
+	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x88, 0x01, 0x01, 0x12, 0x50, 0x0a, 0x10, 0x69, 0x6e, 0x62,
+	0x6f, 0x75, 0x6e, 0x64, 0x5f, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x18, 0x32, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x49, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x4c, 0x69, 0x73,
+	0x74, 0x65, 0x6e, 0x65, 0x72, 0x48, 0x01, 0x52, 0x0f, 0x69, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64,
+	0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x88, 0x01, 0x01, 0x42, 0x10, 0x0a, 0x0e, 0x5f,
+	0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x42, 0x13, 0x0a,
+	0x11, 0x5f, 0x69, 0x6e, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x5f, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e,
+	0x65, 0x72, 0x22, 0x6f, 0x0a, 0x14, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x49, 0x6e, 0x62, 0x6f, 0x75,
+	0x6e, 0x64, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x75,
+	0x6e, 0x6e, 0x65, 0x6c, 0x5f, 0x69, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74,
+	0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x49, 0x70, 0x12, 0x1d, 0x0a, 0x0a, 0x68, 0x74, 0x74, 0x70, 0x73,
+	0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x09, 0x68, 0x74, 0x74,
+	0x70, 0x73, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x70,
+	0x6f, 0x72, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x08, 0x68, 0x74, 0x74, 0x70, 0x50,
+	0x6f, 0x72, 0x74, 0x22, 0x1a, 0x0a, 0x18, 0x53, 0x65, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x74, 0x75,
+	0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0xb8, 0x01, 0x0a, 0x16, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50,
+	0x65, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09,
+	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63,
+	0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61,
+	0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65,
+	0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x30,
+	0x0a, 0x14, 0x77, 0x69, 0x72, 0x65, 0x67, 0x75, 0x61, 0x72, 0x64, 0x5f, 0x70, 0x75, 0x62, 0x6c,
+	0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x77, 0x69,
+	0x72, 0x65, 0x67, 0x75, 0x61, 0x72, 0x64, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79,
+	0x12, 0x18, 0x0a, 0x07, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x18, 0x05, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x07, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x22, 0x6f, 0x0a, 0x17, 0x43, 0x72,
+	0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x73, 0x75, 0x63, 0x63, 0x65, 0x73, 0x73, 0x12,
+	0x28, 0x0a, 0x0d, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x0c, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x4d,
+	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x88, 0x01, 0x01, 0x42, 0x10, 0x0a, 0x0e, 0x5f, 0x65, 0x72,
+	0x72, 0x6f, 0x72, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x65, 0x0a, 0x11, 0x47,
+	0x65, 0x74, 0x4f, 0x49, 0x44, 0x43, 0x55, 0x52, 0x4c, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64,
+	0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12,
+	0x21, 0x0a, 0x0c, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x5f, 0x75, 0x72, 0x6c, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x55,
+	0x72, 0x6c, 0x22, 0x26, 0x0a, 0x12, 0x47, 0x65, 0x74, 0x4f, 0x49, 0x44, 0x43, 0x55, 0x52, 0x4c,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x22, 0x55, 0x0a, 0x16, 0x56, 0x61,
 	0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
-	0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f,
-	0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x63, 0x0a, 0x12, 0x56, 0x61, 0x6c,
-	0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x12,
-	0x25, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x56, 0x61, 0x6c,
-	0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x26, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x75, 0x65, 0x73, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x23, 0x0a, 0x0d,
+	0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65,
+	0x6e, 0x22, 0xdc, 0x01, 0x0a, 0x17, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65,
+	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x14, 0x0a,
+	0x05, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05, 0x76, 0x61,
+	0x6c, 0x69, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a,
+	0x75, 0x73, 0x65, 0x72, 0x5f, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x09, 0x75, 0x73, 0x65, 0x72, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x23, 0x0a, 0x0d, 0x64,
+	0x65, 0x6e, 0x69, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0c, 0x64, 0x65, 0x6e, 0x69, 0x65, 0x64, 0x52, 0x65, 0x61, 0x73, 0x6f, 0x6e,
+	0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69,
+	0x64, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x47, 0x72,
+	0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x28, 0x0a, 0x10, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x67,
+	0x72, 0x6f, 0x75, 0x70, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x09,
+	0x52, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x4e, 0x61, 0x6d, 0x65, 0x73,
+	0x22, 0x50, 0x0a, 0x19, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e,
+	0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a,
+	0x09, 0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x5f, 0x69, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x08, 0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x49, 0x70, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f,
+	0x6d, 0x61, 0x69, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61,
+	0x69, 0x6e, 0x22, 0x84, 0x02, 0x0a, 0x1a, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54,
+	0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x05, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f,
+	0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64,
+	0x12, 0x1d, 0x0a, 0x0a, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x75, 0x73, 0x65, 0x72, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x12,
+	0x23, 0x0a, 0x0d, 0x64, 0x65, 0x6e, 0x69, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x64, 0x65, 0x6e, 0x69, 0x65, 0x64, 0x52, 0x65,
+	0x61, 0x73, 0x6f, 0x6e, 0x12, 0x23, 0x0a, 0x0d, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f,
+	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x65, 0x73,
+	0x73, 0x69, 0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x24, 0x0a, 0x0e, 0x70, 0x65, 0x65,
+	0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28,
+	0x09, 0x52, 0x0c, 0x70, 0x65, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12,
+	0x28, 0x0a, 0x10, 0x70, 0x65, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x6e, 0x61,
+	0x6d, 0x65, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x70, 0x65, 0x65, 0x72, 0x47,
+	0x72, 0x6f, 0x75, 0x70, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x22, 0x81, 0x01, 0x0a, 0x13, 0x53, 0x79,
+	0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x12, 0x32, 0x0a, 0x04, 0x69, 0x6e, 0x69, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x79, 0x6e,
+	0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x49, 0x6e, 0x69, 0x74, 0x48, 0x00, 0x52,
+	0x04, 0x69, 0x6e, 0x69, 0x74, 0x12, 0x2f, 0x0a, 0x03, 0x61, 0x63, 0x6b, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x41, 0x63, 0x6b, 0x48,
+	0x00, 0x52, 0x03, 0x61, 0x63, 0x6b, 0x42, 0x05, 0x0a, 0x03, 0x6d, 0x73, 0x67, 0x22, 0xdf, 0x01,
+	0x0a, 0x10, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x49, 0x6e,
+	0x69, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x49, 0x64, 0x12, 0x18, 0x0a,
+	0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07,
+	0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x39, 0x0a, 0x0a, 0x73, 0x74, 0x61, 0x72, 0x74,
+	0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69,
+	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x73, 0x74, 0x61, 0x72, 0x74, 0x65, 0x64,
+	0x41, 0x74, 0x12, 0x18, 0x0a, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x41, 0x0a, 0x0c,
+	0x63, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x18, 0x05, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x50, 0x72, 0x6f, 0x78, 0x79, 0x43, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65,
+	0x73, 0x52, 0x0c, 0x63, 0x61, 0x70, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x69, 0x65, 0x73, 0x22,
+	0x11, 0x0a, 0x0f, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x41,
+	0x63, 0x6b, 0x22, 0x7e, 0x0a, 0x14, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e,
+	0x67, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x32, 0x0a, 0x07, 0x6d, 0x61,
+	0x70, 0x70, 0x69, 0x6e, 0x67, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61,
+	0x70, 0x70, 0x69, 0x6e, 0x67, 0x52, 0x07, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x32,
+	0x0a, 0x15, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x73, 0x79, 0x6e, 0x63, 0x5f, 0x63,
+	0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x13, 0x69,
+	0x6e, 0x69, 0x74, 0x69, 0x61, 0x6c, 0x53, 0x79, 0x6e, 0x63, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65,
+	0x74, 0x65, 0x22, 0xa9, 0x01, 0x0a, 0x1b, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x4c, 0x4c, 0x4d, 0x50,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49,
+	0x64, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x67, 0x72,
+	0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x67,
+	0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x73, 0x12, 0x1f, 0x0a, 0x0b, 0x70, 0x72, 0x6f, 0x76, 0x69,
+	0x64, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x70, 0x72,
+	0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x49, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x6d, 0x6f, 0x64, 0x65,
+	0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x22, 0xff,
+	0x01, 0x0a, 0x1c, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x4c, 0x4c, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63,
+	0x79, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x1a, 0x0a, 0x08, 0x64, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x08, 0x64, 0x65, 0x63, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x2c, 0x0a, 0x12, 0x73,
+	0x65, 0x6c, 0x65, 0x63, 0x74, 0x65, 0x64, 0x5f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x5f, 0x69,
+	0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x65,
+	0x64, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x49, 0x64, 0x12, 0x30, 0x0a, 0x14, 0x61, 0x74, 0x74,
+	0x72, 0x69, 0x62, 0x75, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69,
+	0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75,
+	0x74, 0x69, 0x6f, 0x6e, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x77,
+	0x69, 0x6e, 0x64, 0x6f, 0x77, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x03, 0x52, 0x0d, 0x77, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x53, 0x65, 0x63, 0x6f, 0x6e,
+	0x64, 0x73, 0x12, 0x1b, 0x0a, 0x09, 0x64, 0x65, 0x6e, 0x79, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18,
+	0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x64, 0x65, 0x6e, 0x79, 0x43, 0x6f, 0x64, 0x65, 0x12,
+	0x1f, 0x0a, 0x0b, 0x64, 0x65, 0x6e, 0x79, 0x5f, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x18, 0x06,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x64, 0x65, 0x6e, 0x79, 0x52, 0x65, 0x61, 0x73, 0x6f, 0x6e,
+	0x22, 0x91, 0x02, 0x0a, 0x15, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4c, 0x4c, 0x4d, 0x55, 0x73,
+	0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x61, 0x63,
+	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09,
+	0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65,
+	0x72, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72,
+	0x49, 0x64, 0x12, 0x19, 0x0a, 0x08, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x69, 0x64, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x49, 0x64, 0x12, 0x25, 0x0a,
+	0x0e, 0x77, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0d, 0x77, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x53, 0x65, 0x63,
+	0x6f, 0x6e, 0x64, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x5f, 0x69,
+	0x6e, 0x70, 0x75, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b, 0x74, 0x6f, 0x6b, 0x65,
+	0x6e, 0x73, 0x49, 0x6e, 0x70, 0x75, 0x74, 0x12, 0x23, 0x0a, 0x0d, 0x74, 0x6f, 0x6b, 0x65, 0x6e,
+	0x73, 0x5f, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0c,
+	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x4f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x12, 0x19, 0x0a, 0x08,
+	0x63, 0x6f, 0x73, 0x74, 0x5f, 0x75, 0x73, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x01, 0x52, 0x07,
+	0x63, 0x6f, 0x73, 0x74, 0x55, 0x73, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x67, 0x72, 0x6f, 0x75, 0x70,
+	0x5f, 0x69, 0x64, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x67, 0x72, 0x6f, 0x75,
+	0x70, 0x49, 0x64, 0x73, 0x22, 0x18, 0x0a, 0x16, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4c, 0x4c,
+	0x4d, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2a, 0x64,
+	0x0a, 0x16, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70,
+	0x64, 0x61, 0x74, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x17, 0x0a, 0x13, 0x55, 0x50, 0x44, 0x41,
+	0x54, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x43, 0x52, 0x45, 0x41, 0x54, 0x45, 0x44, 0x10,
+	0x00, 0x12, 0x18, 0x0a, 0x14, 0x55, 0x50, 0x44, 0x41, 0x54, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45,
+	0x5f, 0x4d, 0x4f, 0x44, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x01, 0x12, 0x17, 0x0a, 0x13, 0x55,
+	0x50, 0x44, 0x41, 0x54, 0x45, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x52, 0x45, 0x4d, 0x4f, 0x56,
+	0x45, 0x44, 0x10, 0x02, 0x2a, 0x46, 0x0a, 0x0f, 0x50, 0x61, 0x74, 0x68, 0x52, 0x65, 0x77, 0x72,
+	0x69, 0x74, 0x65, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x18, 0x0a, 0x14, 0x50, 0x41, 0x54, 0x48, 0x5f,
+	0x52, 0x45, 0x57, 0x52, 0x49, 0x54, 0x45, 0x5f, 0x44, 0x45, 0x46, 0x41, 0x55, 0x4c, 0x54, 0x10,
+	0x00, 0x12, 0x19, 0x0a, 0x15, 0x50, 0x41, 0x54, 0x48, 0x5f, 0x52, 0x45, 0x57, 0x52, 0x49, 0x54,
+	0x45, 0x5f, 0x50, 0x52, 0x45, 0x53, 0x45, 0x52, 0x56, 0x45, 0x10, 0x01, 0x2a, 0x90, 0x01, 0x0a,
+	0x0e, 0x4d, 0x69, 0x64, 0x64, 0x6c, 0x65, 0x77, 0x61, 0x72, 0x65, 0x53, 0x6c, 0x6f, 0x74, 0x12,
+	0x1f, 0x0a, 0x1b, 0x4d, 0x49, 0x44, 0x44, 0x4c, 0x45, 0x57, 0x41, 0x52, 0x45, 0x5f, 0x53, 0x4c,
+	0x4f, 0x54, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00,
+	0x12, 0x1e, 0x0a, 0x1a, 0x4d, 0x49, 0x44, 0x44, 0x4c, 0x45, 0x57, 0x41, 0x52, 0x45, 0x5f, 0x53,
+	0x4c, 0x4f, 0x54, 0x5f, 0x4f, 0x4e, 0x5f, 0x52, 0x45, 0x51, 0x55, 0x45, 0x53, 0x54, 0x10, 0x01,
+	0x12, 0x1f, 0x0a, 0x1b, 0x4d, 0x49, 0x44, 0x44, 0x4c, 0x45, 0x57, 0x41, 0x52, 0x45, 0x5f, 0x53,
+	0x4c, 0x4f, 0x54, 0x5f, 0x4f, 0x4e, 0x5f, 0x52, 0x45, 0x53, 0x50, 0x4f, 0x4e, 0x53, 0x45, 0x10,
+	0x02, 0x12, 0x1c, 0x0a, 0x18, 0x4d, 0x49, 0x44, 0x44, 0x4c, 0x45, 0x57, 0x41, 0x52, 0x45, 0x5f,
+	0x53, 0x4c, 0x4f, 0x54, 0x5f, 0x54, 0x45, 0x52, 0x4d, 0x49, 0x4e, 0x41, 0x4c, 0x10, 0x03, 0x2a,
+	0xc8, 0x01, 0x0a, 0x0b, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12,
+	0x18, 0x0a, 0x14, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f,
+	0x50, 0x45, 0x4e, 0x44, 0x49, 0x4e, 0x47, 0x10, 0x00, 0x12, 0x17, 0x0a, 0x13, 0x50, 0x52, 0x4f,
+	0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x41, 0x43, 0x54, 0x49, 0x56, 0x45,
+	0x10, 0x01, 0x12, 0x23, 0x0a, 0x1f, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54,
+	0x55, 0x53, 0x5f, 0x54, 0x55, 0x4e, 0x4e, 0x45, 0x4c, 0x5f, 0x4e, 0x4f, 0x54, 0x5f, 0x43, 0x52,
+	0x45, 0x41, 0x54, 0x45, 0x44, 0x10, 0x02, 0x12, 0x24, 0x0a, 0x20, 0x50, 0x52, 0x4f, 0x58, 0x59,
+	0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x43, 0x45, 0x52, 0x54, 0x49, 0x46, 0x49, 0x43,
+	0x41, 0x54, 0x45, 0x5f, 0x50, 0x45, 0x4e, 0x44, 0x49, 0x4e, 0x47, 0x10, 0x03, 0x12, 0x23, 0x0a,
+	0x1f, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54, 0x55, 0x53, 0x5f, 0x43, 0x45,
+	0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, 0x54, 0x45, 0x5f, 0x46, 0x41, 0x49, 0x4c, 0x45, 0x44,
+	0x10, 0x04, 0x12, 0x16, 0x0a, 0x12, 0x50, 0x52, 0x4f, 0x58, 0x59, 0x5f, 0x53, 0x54, 0x41, 0x54,
+	0x55, 0x53, 0x5f, 0x45, 0x52, 0x52, 0x4f, 0x52, 0x10, 0x05, 0x32, 0xfc, 0x07, 0x0a, 0x0c, 0x50,
+	0x72, 0x6f, 0x78, 0x79, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x5f, 0x0a, 0x10, 0x47,
+	0x65, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x12,
+	0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x47, 0x65, 0x74,
+	0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61,
+	0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x30, 0x01, 0x12, 0x55, 0x0a, 0x0c,
+	0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x1f, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61,
+	0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x79, 0x6e, 0x63, 0x4d,
+	0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x28,
+	0x01, 0x30, 0x01, 0x12, 0x54, 0x0a, 0x0d, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73,
+	0x73, 0x4c, 0x6f, 0x67, 0x12, 0x20, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f, 0x67, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4c, 0x6f,
+	0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x51, 0x0a, 0x0c, 0x41, 0x75, 0x74,
+	0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x1f, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63,
+	0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69,
+	0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5d, 0x0a, 0x10,
+	0x53, 0x65, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65,
+	0x12, 0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65,
+	0x6e, 0x64, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x53, 0x65, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x55, 0x70, 0x64,
+	0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5a, 0x0a, 0x0f, 0x43,
+	0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x65, 0x65, 0x72, 0x12, 0x22,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x72, 0x65, 0x61,
+	0x74, 0x65, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x50, 0x65, 0x65, 0x72, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4b, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x4f, 0x49,
+	0x44, 0x43, 0x55, 0x52, 0x4c, 0x12, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x47, 0x65, 0x74, 0x4f, 0x49, 0x44, 0x43, 0x55, 0x52, 0x4c, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x47, 0x65, 0x74, 0x4f, 0x49, 0x44, 0x43, 0x55, 0x52, 0x4c, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5a, 0x0a, 0x0f, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65,
+	0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73,
+	0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74,
+	0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x63, 0x0a, 0x12, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e,
+	0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x12, 0x25, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
 	0x65, 0x6e, 0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e,
-	0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x08,
-	0x5a, 0x06, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x26, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64,
+	0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x69, 0x0a, 0x14, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x4c, 0x4c,
+	0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x12, 0x27, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x68, 0x65, 0x63, 0x6b,
+	0x4c, 0x4c, 0x4d, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x28, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x4c, 0x4c, 0x4d, 0x50, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x57, 0x0a, 0x0e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4c, 0x4c, 0x4d, 0x55, 0x73, 0x61,
+	0x67, 0x65, 0x12, 0x21, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4c, 0x4c, 0x4d, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x4c, 0x4c, 0x4d, 0x55, 0x73, 0x61, 0x67,
+	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x08, 0x5a, 0x06, 0x2f, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -3013,99 +3734,114 @@ func file_proxy_service_proto_rawDescGZIP() []byte {
 	return file_proxy_service_proto_rawDescData
 }
 
-var file_proxy_service_proto_enumTypes = make([]protoimpl.EnumInfo, 3)
-var file_proxy_service_proto_msgTypes = make([]protoimpl.MessageInfo, 34)
+var file_proxy_service_proto_enumTypes = make([]protoimpl.EnumInfo, 5)
+var file_proxy_service_proto_msgTypes = make([]protoimpl.MessageInfo, 39)
 var file_proxy_service_proto_goTypes = []interface{}{
-	(ProxyMappingUpdateType)(0),        // 0: management.ProxyMappingUpdateType
-	(PathRewriteMode)(0),               // 1: management.PathRewriteMode
-	(ProxyStatus)(0),                   // 2: management.ProxyStatus
-	(*ProxyCapabilities)(nil),          // 3: management.ProxyCapabilities
-	(*GetMappingUpdateRequest)(nil),    // 4: management.GetMappingUpdateRequest
-	(*GetMappingUpdateResponse)(nil),   // 5: management.GetMappingUpdateResponse
-	(*PathTargetOptions)(nil),          // 6: management.PathTargetOptions
-	(*PathMapping)(nil),                // 7: management.PathMapping
-	(*HeaderAuth)(nil),                 // 8: management.HeaderAuth
-	(*Authentication)(nil),             // 9: management.Authentication
-	(*AccessRestrictions)(nil),         // 10: management.AccessRestrictions
-	(*ProxyMapping)(nil),               // 11: management.ProxyMapping
-	(*SendAccessLogRequest)(nil),       // 12: management.SendAccessLogRequest
-	(*SendAccessLogResponse)(nil),      // 13: management.SendAccessLogResponse
-	(*AccessLog)(nil),                  // 14: management.AccessLog
-	(*AuthenticateRequest)(nil),        // 15: management.AuthenticateRequest
-	(*HeaderAuthRequest)(nil),          // 16: management.HeaderAuthRequest
-	(*PasswordRequest)(nil),            // 17: management.PasswordRequest
-	(*PinRequest)(nil),                 // 18: management.PinRequest
-	(*AuthenticateResponse)(nil),       // 19: management.AuthenticateResponse
-	(*SendStatusUpdateRequest)(nil),    // 20: management.SendStatusUpdateRequest
-	(*ProxyInboundListener)(nil),       // 21: management.ProxyInboundListener
-	(*SendStatusUpdateResponse)(nil),   // 22: management.SendStatusUpdateResponse
-	(*CreateProxyPeerRequest)(nil),     // 23: management.CreateProxyPeerRequest
-	(*CreateProxyPeerResponse)(nil),    // 24: management.CreateProxyPeerResponse
-	(*GetOIDCURLRequest)(nil),          // 25: management.GetOIDCURLRequest
-	(*GetOIDCURLResponse)(nil),         // 26: management.GetOIDCURLResponse
-	(*ValidateSessionRequest)(nil),     // 27: management.ValidateSessionRequest
-	(*ValidateSessionResponse)(nil),    // 28: management.ValidateSessionResponse
-	(*ValidateTunnelPeerRequest)(nil),  // 29: management.ValidateTunnelPeerRequest
-	(*ValidateTunnelPeerResponse)(nil), // 30: management.ValidateTunnelPeerResponse
-	(*SyncMappingsRequest)(nil),        // 31: management.SyncMappingsRequest
-	(*SyncMappingsInit)(nil),           // 32: management.SyncMappingsInit
-	(*SyncMappingsAck)(nil),            // 33: management.SyncMappingsAck
-	(*SyncMappingsResponse)(nil),       // 34: management.SyncMappingsResponse
-	nil,                                // 35: management.PathTargetOptions.CustomHeadersEntry
-	nil,                                // 36: management.AccessLog.MetadataEntry
-	(*timestamppb.Timestamp)(nil),      // 37: google.protobuf.Timestamp
-	(*durationpb.Duration)(nil),        // 38: google.protobuf.Duration
+	(ProxyMappingUpdateType)(0),          // 0: management.ProxyMappingUpdateType
+	(PathRewriteMode)(0),                 // 1: management.PathRewriteMode
+	(MiddlewareSlot)(0),                  // 2: management.MiddlewareSlot
+	(ProxyStatus)(0),                     // 3: management.ProxyStatus
+	(MiddlewareConfig_FailMode)(0),       // 4: management.MiddlewareConfig.FailMode
+	(*ProxyCapabilities)(nil),            // 5: management.ProxyCapabilities
+	(*GetMappingUpdateRequest)(nil),      // 6: management.GetMappingUpdateRequest
+	(*GetMappingUpdateResponse)(nil),     // 7: management.GetMappingUpdateResponse
+	(*PathTargetOptions)(nil),            // 8: management.PathTargetOptions
+	(*MiddlewareConfig)(nil),             // 9: management.MiddlewareConfig
+	(*PathMapping)(nil),                  // 10: management.PathMapping
+	(*HeaderAuth)(nil),                   // 11: management.HeaderAuth
+	(*Authentication)(nil),               // 12: management.Authentication
+	(*AccessRestrictions)(nil),           // 13: management.AccessRestrictions
+	(*ProxyMapping)(nil),                 // 14: management.ProxyMapping
+	(*SendAccessLogRequest)(nil),         // 15: management.SendAccessLogRequest
+	(*SendAccessLogResponse)(nil),        // 16: management.SendAccessLogResponse
+	(*AccessLog)(nil),                    // 17: management.AccessLog
+	(*AuthenticateRequest)(nil),          // 18: management.AuthenticateRequest
+	(*HeaderAuthRequest)(nil),            // 19: management.HeaderAuthRequest
+	(*PasswordRequest)(nil),              // 20: management.PasswordRequest
+	(*PinRequest)(nil),                   // 21: management.PinRequest
+	(*AuthenticateResponse)(nil),         // 22: management.AuthenticateResponse
+	(*SendStatusUpdateRequest)(nil),      // 23: management.SendStatusUpdateRequest
+	(*ProxyInboundListener)(nil),         // 24: management.ProxyInboundListener
+	(*SendStatusUpdateResponse)(nil),     // 25: management.SendStatusUpdateResponse
+	(*CreateProxyPeerRequest)(nil),       // 26: management.CreateProxyPeerRequest
+	(*CreateProxyPeerResponse)(nil),      // 27: management.CreateProxyPeerResponse
+	(*GetOIDCURLRequest)(nil),            // 28: management.GetOIDCURLRequest
+	(*GetOIDCURLResponse)(nil),           // 29: management.GetOIDCURLResponse
+	(*ValidateSessionRequest)(nil),       // 30: management.ValidateSessionRequest
+	(*ValidateSessionResponse)(nil),      // 31: management.ValidateSessionResponse
+	(*ValidateTunnelPeerRequest)(nil),    // 32: management.ValidateTunnelPeerRequest
+	(*ValidateTunnelPeerResponse)(nil),   // 33: management.ValidateTunnelPeerResponse
+	(*SyncMappingsRequest)(nil),          // 34: management.SyncMappingsRequest
+	(*SyncMappingsInit)(nil),             // 35: management.SyncMappingsInit
+	(*SyncMappingsAck)(nil),              // 36: management.SyncMappingsAck
+	(*SyncMappingsResponse)(nil),         // 37: management.SyncMappingsResponse
+	(*CheckLLMPolicyLimitsRequest)(nil),  // 38: management.CheckLLMPolicyLimitsRequest
+	(*CheckLLMPolicyLimitsResponse)(nil), // 39: management.CheckLLMPolicyLimitsResponse
+	(*RecordLLMUsageRequest)(nil),        // 40: management.RecordLLMUsageRequest
+	(*RecordLLMUsageResponse)(nil),       // 41: management.RecordLLMUsageResponse
+	nil,                                  // 42: management.PathTargetOptions.CustomHeadersEntry
+	nil,                                  // 43: management.AccessLog.MetadataEntry
+	(*timestamppb.Timestamp)(nil),        // 44: google.protobuf.Timestamp
+	(*durationpb.Duration)(nil),          // 45: google.protobuf.Duration
 }
 var file_proxy_service_proto_depIdxs = []int32{
-	37, // 0: management.GetMappingUpdateRequest.started_at:type_name -> google.protobuf.Timestamp
-	3,  // 1: management.GetMappingUpdateRequest.capabilities:type_name -> management.ProxyCapabilities
-	11, // 2: management.GetMappingUpdateResponse.mapping:type_name -> management.ProxyMapping
-	38, // 3: management.PathTargetOptions.request_timeout:type_name -> google.protobuf.Duration
+	44, // 0: management.GetMappingUpdateRequest.started_at:type_name -> google.protobuf.Timestamp
+	5,  // 1: management.GetMappingUpdateRequest.capabilities:type_name -> management.ProxyCapabilities
+	14, // 2: management.GetMappingUpdateResponse.mapping:type_name -> management.ProxyMapping
+	45, // 3: management.PathTargetOptions.request_timeout:type_name -> google.protobuf.Duration
 	1,  // 4: management.PathTargetOptions.path_rewrite:type_name -> management.PathRewriteMode
-	35, // 5: management.PathTargetOptions.custom_headers:type_name -> management.PathTargetOptions.CustomHeadersEntry
-	38, // 6: management.PathTargetOptions.session_idle_timeout:type_name -> google.protobuf.Duration
-	6,  // 7: management.PathMapping.options:type_name -> management.PathTargetOptions
-	8,  // 8: management.Authentication.header_auths:type_name -> management.HeaderAuth
-	0,  // 9: management.ProxyMapping.type:type_name -> management.ProxyMappingUpdateType
-	7,  // 10: management.ProxyMapping.path:type_name -> management.PathMapping
-	9,  // 11: management.ProxyMapping.auth:type_name -> management.Authentication
-	10, // 12: management.ProxyMapping.access_restrictions:type_name -> management.AccessRestrictions
-	14, // 13: management.SendAccessLogRequest.log:type_name -> management.AccessLog
-	37, // 14: management.AccessLog.timestamp:type_name -> google.protobuf.Timestamp
-	36, // 15: management.AccessLog.metadata:type_name -> management.AccessLog.MetadataEntry
-	17, // 16: management.AuthenticateRequest.password:type_name -> management.PasswordRequest
-	18, // 17: management.AuthenticateRequest.pin:type_name -> management.PinRequest
-	16, // 18: management.AuthenticateRequest.header_auth:type_name -> management.HeaderAuthRequest
-	2,  // 19: management.SendStatusUpdateRequest.status:type_name -> management.ProxyStatus
-	21, // 20: management.SendStatusUpdateRequest.inbound_listener:type_name -> management.ProxyInboundListener
-	32, // 21: management.SyncMappingsRequest.init:type_name -> management.SyncMappingsInit
-	33, // 22: management.SyncMappingsRequest.ack:type_name -> management.SyncMappingsAck
-	37, // 23: management.SyncMappingsInit.started_at:type_name -> google.protobuf.Timestamp
-	3,  // 24: management.SyncMappingsInit.capabilities:type_name -> management.ProxyCapabilities
-	11, // 25: management.SyncMappingsResponse.mapping:type_name -> management.ProxyMapping
-	4,  // 26: management.ProxyService.GetMappingUpdate:input_type -> management.GetMappingUpdateRequest
-	31, // 27: management.ProxyService.SyncMappings:input_type -> management.SyncMappingsRequest
-	12, // 28: management.ProxyService.SendAccessLog:input_type -> management.SendAccessLogRequest
-	15, // 29: management.ProxyService.Authenticate:input_type -> management.AuthenticateRequest
-	20, // 30: management.ProxyService.SendStatusUpdate:input_type -> management.SendStatusUpdateRequest
-	23, // 31: management.ProxyService.CreateProxyPeer:input_type -> management.CreateProxyPeerRequest
-	25, // 32: management.ProxyService.GetOIDCURL:input_type -> management.GetOIDCURLRequest
-	27, // 33: management.ProxyService.ValidateSession:input_type -> management.ValidateSessionRequest
-	29, // 34: management.ProxyService.ValidateTunnelPeer:input_type -> management.ValidateTunnelPeerRequest
-	5,  // 35: management.ProxyService.GetMappingUpdate:output_type -> management.GetMappingUpdateResponse
-	34, // 36: management.ProxyService.SyncMappings:output_type -> management.SyncMappingsResponse
-	13, // 37: management.ProxyService.SendAccessLog:output_type -> management.SendAccessLogResponse
-	19, // 38: management.ProxyService.Authenticate:output_type -> management.AuthenticateResponse
-	22, // 39: management.ProxyService.SendStatusUpdate:output_type -> management.SendStatusUpdateResponse
-	24, // 40: management.ProxyService.CreateProxyPeer:output_type -> management.CreateProxyPeerResponse
-	26, // 41: management.ProxyService.GetOIDCURL:output_type -> management.GetOIDCURLResponse
-	28, // 42: management.ProxyService.ValidateSession:output_type -> management.ValidateSessionResponse
-	30, // 43: management.ProxyService.ValidateTunnelPeer:output_type -> management.ValidateTunnelPeerResponse
-	35, // [35:44] is the sub-list for method output_type
-	26, // [26:35] is the sub-list for method input_type
-	26, // [26:26] is the sub-list for extension type_name
-	26, // [26:26] is the sub-list for extension extendee
-	0,  // [0:26] is the sub-list for field type_name
+	42, // 5: management.PathTargetOptions.custom_headers:type_name -> management.PathTargetOptions.CustomHeadersEntry
+	45, // 6: management.PathTargetOptions.session_idle_timeout:type_name -> google.protobuf.Duration
+	9,  // 7: management.PathTargetOptions.middlewares:type_name -> management.MiddlewareConfig
+	2,  // 8: management.MiddlewareConfig.slot:type_name -> management.MiddlewareSlot
+	4,  // 9: management.MiddlewareConfig.fail_mode:type_name -> management.MiddlewareConfig.FailMode
+	45, // 10: management.MiddlewareConfig.timeout:type_name -> google.protobuf.Duration
+	8,  // 11: management.PathMapping.options:type_name -> management.PathTargetOptions
+	11, // 12: management.Authentication.header_auths:type_name -> management.HeaderAuth
+	0,  // 13: management.ProxyMapping.type:type_name -> management.ProxyMappingUpdateType
+	10, // 14: management.ProxyMapping.path:type_name -> management.PathMapping
+	12, // 15: management.ProxyMapping.auth:type_name -> management.Authentication
+	13, // 16: management.ProxyMapping.access_restrictions:type_name -> management.AccessRestrictions
+	17, // 17: management.SendAccessLogRequest.log:type_name -> management.AccessLog
+	44, // 18: management.AccessLog.timestamp:type_name -> google.protobuf.Timestamp
+	43, // 19: management.AccessLog.metadata:type_name -> management.AccessLog.MetadataEntry
+	20, // 20: management.AuthenticateRequest.password:type_name -> management.PasswordRequest
+	21, // 21: management.AuthenticateRequest.pin:type_name -> management.PinRequest
+	19, // 22: management.AuthenticateRequest.header_auth:type_name -> management.HeaderAuthRequest
+	3,  // 23: management.SendStatusUpdateRequest.status:type_name -> management.ProxyStatus
+	24, // 24: management.SendStatusUpdateRequest.inbound_listener:type_name -> management.ProxyInboundListener
+	35, // 25: management.SyncMappingsRequest.init:type_name -> management.SyncMappingsInit
+	36, // 26: management.SyncMappingsRequest.ack:type_name -> management.SyncMappingsAck
+	44, // 27: management.SyncMappingsInit.started_at:type_name -> google.protobuf.Timestamp
+	5,  // 28: management.SyncMappingsInit.capabilities:type_name -> management.ProxyCapabilities
+	14, // 29: management.SyncMappingsResponse.mapping:type_name -> management.ProxyMapping
+	6,  // 30: management.ProxyService.GetMappingUpdate:input_type -> management.GetMappingUpdateRequest
+	34, // 31: management.ProxyService.SyncMappings:input_type -> management.SyncMappingsRequest
+	15, // 32: management.ProxyService.SendAccessLog:input_type -> management.SendAccessLogRequest
+	18, // 33: management.ProxyService.Authenticate:input_type -> management.AuthenticateRequest
+	23, // 34: management.ProxyService.SendStatusUpdate:input_type -> management.SendStatusUpdateRequest
+	26, // 35: management.ProxyService.CreateProxyPeer:input_type -> management.CreateProxyPeerRequest
+	28, // 36: management.ProxyService.GetOIDCURL:input_type -> management.GetOIDCURLRequest
+	30, // 37: management.ProxyService.ValidateSession:input_type -> management.ValidateSessionRequest
+	32, // 38: management.ProxyService.ValidateTunnelPeer:input_type -> management.ValidateTunnelPeerRequest
+	38, // 39: management.ProxyService.CheckLLMPolicyLimits:input_type -> management.CheckLLMPolicyLimitsRequest
+	40, // 40: management.ProxyService.RecordLLMUsage:input_type -> management.RecordLLMUsageRequest
+	7,  // 41: management.ProxyService.GetMappingUpdate:output_type -> management.GetMappingUpdateResponse
+	37, // 42: management.ProxyService.SyncMappings:output_type -> management.SyncMappingsResponse
+	16, // 43: management.ProxyService.SendAccessLog:output_type -> management.SendAccessLogResponse
+	22, // 44: management.ProxyService.Authenticate:output_type -> management.AuthenticateResponse
+	25, // 45: management.ProxyService.SendStatusUpdate:output_type -> management.SendStatusUpdateResponse
+	27, // 46: management.ProxyService.CreateProxyPeer:output_type -> management.CreateProxyPeerResponse
+	29, // 47: management.ProxyService.GetOIDCURL:output_type -> management.GetOIDCURLResponse
+	31, // 48: management.ProxyService.ValidateSession:output_type -> management.ValidateSessionResponse
+	33, // 49: management.ProxyService.ValidateTunnelPeer:output_type -> management.ValidateTunnelPeerResponse
+	39, // 50: management.ProxyService.CheckLLMPolicyLimits:output_type -> management.CheckLLMPolicyLimitsResponse
+	41, // 51: management.ProxyService.RecordLLMUsage:output_type -> management.RecordLLMUsageResponse
+	41, // [41:52] is the sub-list for method output_type
+	30, // [30:41] is the sub-list for method input_type
+	30, // [30:30] is the sub-list for extension type_name
+	30, // [30:30] is the sub-list for extension extendee
+	0,  // [0:30] is the sub-list for field type_name
 }
 
 func init() { file_proxy_service_proto_init() }
@@ -3163,7 +3899,7 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PathMapping); i {
+			switch v := v.(*MiddlewareConfig); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3175,7 +3911,7 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*HeaderAuth); i {
+			switch v := v.(*PathMapping); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3187,7 +3923,7 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Authentication); i {
+			switch v := v.(*HeaderAuth); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3199,7 +3935,7 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AccessRestrictions); i {
+			switch v := v.(*Authentication); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3211,7 +3947,7 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ProxyMapping); i {
+			switch v := v.(*AccessRestrictions); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3223,7 +3959,7 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SendAccessLogRequest); i {
+			switch v := v.(*ProxyMapping); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3235,7 +3971,7 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SendAccessLogResponse); i {
+			switch v := v.(*SendAccessLogRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3247,7 +3983,7 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AccessLog); i {
+			switch v := v.(*SendAccessLogResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3259,7 +3995,7 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AuthenticateRequest); i {
+			switch v := v.(*AccessLog); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3271,7 +4007,7 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*HeaderAuthRequest); i {
+			switch v := v.(*AuthenticateRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3283,7 +4019,7 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PasswordRequest); i {
+			switch v := v.(*HeaderAuthRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3295,7 +4031,7 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PinRequest); i {
+			switch v := v.(*PasswordRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3307,7 +4043,7 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AuthenticateResponse); i {
+			switch v := v.(*PinRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3319,7 +4055,7 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SendStatusUpdateRequest); i {
+			switch v := v.(*AuthenticateResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3331,7 +4067,7 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ProxyInboundListener); i {
+			switch v := v.(*SendStatusUpdateRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3343,7 +4079,7 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SendStatusUpdateResponse); i {
+			switch v := v.(*ProxyInboundListener); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3355,7 +4091,7 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CreateProxyPeerRequest); i {
+			switch v := v.(*SendStatusUpdateResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3367,7 +4103,7 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[21].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CreateProxyPeerResponse); i {
+			switch v := v.(*CreateProxyPeerRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3379,7 +4115,7 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[22].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetOIDCURLRequest); i {
+			switch v := v.(*CreateProxyPeerResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3391,7 +4127,7 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[23].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetOIDCURLResponse); i {
+			switch v := v.(*GetOIDCURLRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3403,7 +4139,7 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[24].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ValidateSessionRequest); i {
+			switch v := v.(*GetOIDCURLResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3415,7 +4151,7 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[25].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ValidateSessionResponse); i {
+			switch v := v.(*ValidateSessionRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3427,7 +4163,7 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[26].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ValidateTunnelPeerRequest); i {
+			switch v := v.(*ValidateSessionResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3439,7 +4175,7 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[27].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ValidateTunnelPeerResponse); i {
+			switch v := v.(*ValidateTunnelPeerRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3451,7 +4187,7 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[28].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SyncMappingsRequest); i {
+			switch v := v.(*ValidateTunnelPeerResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3463,7 +4199,7 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[29].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SyncMappingsInit); i {
+			switch v := v.(*SyncMappingsRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3475,7 +4211,7 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[30].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SyncMappingsAck); i {
+			switch v := v.(*SyncMappingsInit); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3487,6 +4223,18 @@ func file_proxy_service_proto_init() {
 			}
 		}
 		file_proxy_service_proto_msgTypes[31].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SyncMappingsAck); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_proxy_service_proto_msgTypes[32].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*SyncMappingsResponse); i {
 			case 0:
 				return &v.state
@@ -3498,16 +4246,64 @@ func file_proxy_service_proto_init() {
 				return nil
 			}
 		}
+		file_proxy_service_proto_msgTypes[33].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CheckLLMPolicyLimitsRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_proxy_service_proto_msgTypes[34].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CheckLLMPolicyLimitsResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_proxy_service_proto_msgTypes[35].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RecordLLMUsageRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_proxy_service_proto_msgTypes[36].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RecordLLMUsageResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
 	}
 	file_proxy_service_proto_msgTypes[0].OneofWrappers = []interface{}{}
-	file_proxy_service_proto_msgTypes[12].OneofWrappers = []interface{}{
+	file_proxy_service_proto_msgTypes[13].OneofWrappers = []interface{}{
 		(*AuthenticateRequest_Password)(nil),
 		(*AuthenticateRequest_Pin)(nil),
 		(*AuthenticateRequest_HeaderAuth)(nil),
 	}
-	file_proxy_service_proto_msgTypes[17].OneofWrappers = []interface{}{}
-	file_proxy_service_proto_msgTypes[21].OneofWrappers = []interface{}{}
-	file_proxy_service_proto_msgTypes[28].OneofWrappers = []interface{}{
+	file_proxy_service_proto_msgTypes[18].OneofWrappers = []interface{}{}
+	file_proxy_service_proto_msgTypes[22].OneofWrappers = []interface{}{}
+	file_proxy_service_proto_msgTypes[29].OneofWrappers = []interface{}{
 		(*SyncMappingsRequest_Init)(nil),
 		(*SyncMappingsRequest_Ack)(nil),
 	}
@@ -3516,8 +4312,8 @@ func file_proxy_service_proto_init() {
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_proxy_service_proto_rawDesc,
-			NumEnums:      3,
-			NumMessages:   34,
+			NumEnums:      5,
+			NumMessages:   39,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/shared/management/proto/proxy_service.proto b/shared/management/proto/proxy_service.proto
index 14d188877..89d1f8749 100644
--- a/shared/management/proto/proxy_service.proto
+++ b/shared/management/proto/proxy_service.proto
@@ -43,6 +43,18 @@ service ProxyService {
   // issue a session cookie without redirecting through the OIDC flow.
   // Mirrors ValidateSession's response shape.
   rpc ValidateTunnelPeer(ValidateTunnelPeerRequest) returns (ValidateTunnelPeerResponse);
+
+  // CheckLLMPolicyLimits is the pre-flight RPC the proxy calls before each
+  // LLM request. Management runs the per-policy headroom selection across
+  // every policy authorising the caller's user / groups for the resolved
+  // provider and returns the chosen attribution policy + group, or a deny
+  // when no applicable policy has headroom > 0.
+  rpc CheckLLMPolicyLimits(CheckLLMPolicyLimitsRequest) returns (CheckLLMPolicyLimitsResponse);
+
+  // RecordLLMUsage is the post-flight RPC the proxy calls after the upstream
+  // returns. Increments the per-(dimension, window) counters for the
+  // attribution policy chosen by CheckLLMPolicyLimits.
+  rpc RecordLLMUsage(RecordLLMUsageRequest) returns (RecordLLMUsageResponse);
 }
 
 // ProxyCapabilities describes what a proxy can handle.
@@ -107,6 +119,59 @@ message PathTargetOptions {
   // reachable without WireGuard (public APIs, LAN services, localhost
   // sidecars). Defaults to false — embedded client is the standard path.
   bool direct_upstream = 7;
+  // Proxy clamps to [0, proxy-wide max (1 MiB)] at apply time. Agent-network
+  // synthesized targets only; private services leave these zero.
+  int64 capture_max_request_bytes = 8;
+  // Proxy clamps to [0, proxy-wide max (1 MiB)] at apply time.
+  int64 capture_max_response_bytes = 9;
+  // Content types eligible for body capture (e.g. "application/json").
+  repeated string capture_content_types = 10;
+  // Per-target middleware configurations populated by the agent-network
+  // synthesizer. Validated and clamped by the proxy at apply time.
+  repeated MiddlewareConfig middlewares = 11;
+  // When true, the proxy stamps agent_network=true on access-log entries
+  // for this target so management routes them to the agent-network log
+  // surface.
+  bool agent_network = 12;
+  // When true, the proxy suppresses the per-request access-log emission for
+  // this target. Defaults false to preserve existing access-log behavior for
+  // every non-agent-network target. The agent-network synth target sets this
+  // true only when the account's EnableLogCollection toggle is off.
+  bool disable_access_log = 13;
+}
+
+// MiddlewareSlot identifies where in the request lifecycle a middleware
+// runs. Mirrors proxy/internal/middleware.Slot.
+enum MiddlewareSlot {
+  MIDDLEWARE_SLOT_UNSPECIFIED = 0;
+  MIDDLEWARE_SLOT_ON_REQUEST = 1;
+  MIDDLEWARE_SLOT_ON_RESPONSE = 2;
+  MIDDLEWARE_SLOT_TERMINAL = 3;
+}
+
+// MiddlewareConfig is the per-target configuration for a single middleware.
+// The proxy validates every incoming MiddlewareConfig at apply time:
+// unknown ids are rejected, timeout is clamped to [10ms, 5s], and the
+// declared slot must match the registered middleware's slot.
+message MiddlewareConfig {
+  // Middleware id; must match the proxy-local compiled-in registry.
+  string id = 1;
+  bool enabled = 2;
+  MiddlewareSlot slot = 3;
+  // Free-form JSON unmarshalled by the middleware factory into its own typed
+  // config struct. Empty / null / {} are valid (zero-value config).
+  bytes config_json = 4;
+  enum FailMode {
+    FAIL_OPEN = 0;
+    FAIL_CLOSED = 1;
+  }
+  FailMode fail_mode = 5;
+  // Clamped to [10ms, 5s] at apply time; zero → 500ms default.
+  google.protobuf.Duration timeout = 6;
+  // When true, the middleware may mutate request headers or body (subject to
+  // policy). Honoured only when the implementation also declares
+  // MutationsSupported.
+  bool can_mutate = 7;
 }
 
 message PathMapping {
@@ -190,6 +255,10 @@ message AccessLog {
   string protocol = 16;
   // Extra key-value metadata for the access log entry (e.g. crowdsec_verdict, scenario).
   map<string, string> metadata = 17;
+  // When true, the entry was emitted by an agent-network synth service.
+  // Management routes these to the agent-network access-log surface instead
+  // of the standard service log.
+  bool agent_network = 18;
 }
 
 message AuthenticateRequest {
@@ -376,3 +445,59 @@ message SyncMappingsResponse {
   bool initial_sync_complete = 2;
 }
 
+// CheckLLMPolicyLimitsRequest carries the resolved caller identity and the
+// upstream provider already chosen by llm_router. Management computes which
+// policies authorise the request, picks the one with the most remaining
+// headroom, and returns the attribution decision.
+message CheckLLMPolicyLimitsRequest {
+  // account_id is the netbird account the request belongs to.
+  string account_id = 1;
+  // user_id is the netbird user id of the caller. May be empty when the
+  // principal is a tunnel-peer that isn't bound to a user; group membership
+  // still gates the request in that case.
+  string user_id = 2;
+  // group_ids is the caller's full group membership at request time.
+  repeated string group_ids = 3;
+  // provider_id is the agent-network provider record id chosen by llm_router.
+  string provider_id = 4;
+  // model is the upstream model identifier extracted from the request body.
+  string model = 5;
+}
+
+// CheckLLMPolicyLimitsResponse is management's allow-or-deny decision for a
+// pre-flight check.
+message CheckLLMPolicyLimitsResponse {
+  // decision is "allow" or "deny".
+  string decision = 1;
+  // selected_policy_id names the policy that paid for this request.
+  string selected_policy_id = 2;
+  // attribution_group_id is the source group the request booked against.
+  string attribution_group_id = 3;
+  // window_seconds is the cap window length the selected policy uses.
+  int64 window_seconds = 4;
+  // deny_code is set on decision="deny" with a stable label.
+  string deny_code = 5;
+  // deny_reason is a short human-readable explanation paired with deny_code.
+  string deny_reason = 6;
+}
+
+// RecordLLMUsageRequest is the post-flight increment the proxy posts after
+// the upstream call. Counters are keyed on (account, dimension, window).
+message RecordLLMUsageRequest {
+  string account_id = 1;
+  string user_id = 2;
+  // group_id is the selected policy's attribution group, recorded against the
+  // policy window (window_seconds).
+  string group_id = 3;
+  int64 window_seconds = 4;
+  int64 tokens_input = 5;
+  int64 tokens_output = 6;
+  double cost_usd = 7;
+  // group_ids is the caller's full group membership, used to fan the same
+  // usage out to every applicable account-level budget rule's own window.
+  repeated string group_ids = 8;
+}
+
+message RecordLLMUsageResponse {
+}
+
diff --git a/shared/management/proto/proxy_service_grpc.pb.go b/shared/management/proto/proxy_service_grpc.pb.go
index 40064fe61..76c1f005f 100644
--- a/shared/management/proto/proxy_service_grpc.pb.go
+++ b/shared/management/proto/proxy_service_grpc.pb.go
@@ -43,6 +43,16 @@ type ProxyServiceClient interface {
 	// issue a session cookie without redirecting through the OIDC flow.
 	// Mirrors ValidateSession's response shape.
 	ValidateTunnelPeer(ctx context.Context, in *ValidateTunnelPeerRequest, opts ...grpc.CallOption) (*ValidateTunnelPeerResponse, error)
+	// CheckLLMPolicyLimits is the pre-flight RPC the proxy calls before each
+	// LLM request. Management runs the per-policy headroom selection across
+	// every policy authorising the caller's user / groups for the resolved
+	// provider and returns the chosen attribution policy + group, or a deny
+	// when no applicable policy has headroom > 0.
+	CheckLLMPolicyLimits(ctx context.Context, in *CheckLLMPolicyLimitsRequest, opts ...grpc.CallOption) (*CheckLLMPolicyLimitsResponse, error)
+	// RecordLLMUsage is the post-flight RPC the proxy calls after the upstream
+	// returns. Increments the per-(dimension, window) counters for the
+	// attribution policy chosen by CheckLLMPolicyLimits.
+	RecordLLMUsage(ctx context.Context, in *RecordLLMUsageRequest, opts ...grpc.CallOption) (*RecordLLMUsageResponse, error)
 }
 
 type proxyServiceClient struct {
@@ -179,6 +189,24 @@ func (c *proxyServiceClient) ValidateTunnelPeer(ctx context.Context, in *Validat
 	return out, nil
 }
 
+func (c *proxyServiceClient) CheckLLMPolicyLimits(ctx context.Context, in *CheckLLMPolicyLimitsRequest, opts ...grpc.CallOption) (*CheckLLMPolicyLimitsResponse, error) {
+	out := new(CheckLLMPolicyLimitsResponse)
+	err := c.cc.Invoke(ctx, "/management.ProxyService/CheckLLMPolicyLimits", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *proxyServiceClient) RecordLLMUsage(ctx context.Context, in *RecordLLMUsageRequest, opts ...grpc.CallOption) (*RecordLLMUsageResponse, error) {
+	out := new(RecordLLMUsageResponse)
+	err := c.cc.Invoke(ctx, "/management.ProxyService/RecordLLMUsage", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // ProxyServiceServer is the server API for ProxyService service.
 // All implementations must embed UnimplementedProxyServiceServer
 // for forward compatibility
@@ -208,6 +236,16 @@ type ProxyServiceServer interface {
 	// issue a session cookie without redirecting through the OIDC flow.
 	// Mirrors ValidateSession's response shape.
 	ValidateTunnelPeer(context.Context, *ValidateTunnelPeerRequest) (*ValidateTunnelPeerResponse, error)
+	// CheckLLMPolicyLimits is the pre-flight RPC the proxy calls before each
+	// LLM request. Management runs the per-policy headroom selection across
+	// every policy authorising the caller's user / groups for the resolved
+	// provider and returns the chosen attribution policy + group, or a deny
+	// when no applicable policy has headroom > 0.
+	CheckLLMPolicyLimits(context.Context, *CheckLLMPolicyLimitsRequest) (*CheckLLMPolicyLimitsResponse, error)
+	// RecordLLMUsage is the post-flight RPC the proxy calls after the upstream
+	// returns. Increments the per-(dimension, window) counters for the
+	// attribution policy chosen by CheckLLMPolicyLimits.
+	RecordLLMUsage(context.Context, *RecordLLMUsageRequest) (*RecordLLMUsageResponse, error)
 	mustEmbedUnimplementedProxyServiceServer()
 }
 
@@ -242,6 +280,12 @@ func (UnimplementedProxyServiceServer) ValidateSession(context.Context, *Validat
 func (UnimplementedProxyServiceServer) ValidateTunnelPeer(context.Context, *ValidateTunnelPeerRequest) (*ValidateTunnelPeerResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ValidateTunnelPeer not implemented")
 }
+func (UnimplementedProxyServiceServer) CheckLLMPolicyLimits(context.Context, *CheckLLMPolicyLimitsRequest) (*CheckLLMPolicyLimitsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CheckLLMPolicyLimits not implemented")
+}
+func (UnimplementedProxyServiceServer) RecordLLMUsage(context.Context, *RecordLLMUsageRequest) (*RecordLLMUsageResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RecordLLMUsage not implemented")
+}
 func (UnimplementedProxyServiceServer) mustEmbedUnimplementedProxyServiceServer() {}
 
 // UnsafeProxyServiceServer may be embedded to opt out of forward compatibility for this service.
@@ -428,6 +472,42 @@ func _ProxyService_ValidateTunnelPeer_Handler(srv interface{}, ctx context.Conte
 	return interceptor(ctx, in, info, handler)
 }
 
+func _ProxyService_CheckLLMPolicyLimits_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CheckLLMPolicyLimitsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ProxyServiceServer).CheckLLMPolicyLimits(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/management.ProxyService/CheckLLMPolicyLimits",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ProxyServiceServer).CheckLLMPolicyLimits(ctx, req.(*CheckLLMPolicyLimitsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ProxyService_RecordLLMUsage_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RecordLLMUsageRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ProxyServiceServer).RecordLLMUsage(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/management.ProxyService/RecordLLMUsage",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ProxyServiceServer).RecordLLMUsage(ctx, req.(*RecordLLMUsageRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // ProxyService_ServiceDesc is the grpc.ServiceDesc for ProxyService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -463,6 +543,14 @@ var ProxyService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "ValidateTunnelPeer",
 			Handler:    _ProxyService_ValidateTunnelPeer_Handler,
 		},
+		{
+			MethodName: "CheckLLMPolicyLimits",
+			Handler:    _ProxyService_CheckLLMPolicyLimits_Handler,
+		},
+		{
+			MethodName: "RecordLLMUsage",
+			Handler:    _ProxyService_RecordLLMUsage_Handler,
+		},
 	},
 	Streams: []grpc.StreamDesc{
 		{
diff --git a/shared/management/status/error.go b/shared/management/status/error.go
index 1957c5591..e31663450 100644
--- a/shared/management/status/error.go
+++ b/shared/management/status/error.go
@@ -219,6 +219,26 @@ func NewNetworkResourceNotFoundError(resourceID string) error {
 	return Errorf(NotFound, "network resource: %s not found", resourceID)
 }
 
+// NewAgentNetworkProviderNotFoundError creates a new Error with NotFound type for a missing Agent Network provider.
+func NewAgentNetworkProviderNotFoundError(providerID string) error {
+	return Errorf(NotFound, "agent network provider: %s not found", providerID)
+}
+
+// NewAgentNetworkPolicyNotFoundError creates a new Error with NotFound type for a missing Agent Network policy.
+func NewAgentNetworkPolicyNotFoundError(policyID string) error {
+	return Errorf(NotFound, "agent network policy: %s not found", policyID)
+}
+
+// NewAgentNetworkGuardrailNotFoundError creates a new Error with NotFound type for a missing Agent Network guardrail.
+func NewAgentNetworkGuardrailNotFoundError(guardrailID string) error {
+	return Errorf(NotFound, "agent network guardrail: %s not found", guardrailID)
+}
+
+// NewAgentNetworkBudgetRuleNotFoundError creates a new Error with NotFound type for a missing Agent Network budget rule.
+func NewAgentNetworkBudgetRuleNotFoundError(ruleID string) error {
+	return Errorf(NotFound, "agent network budget rule: %s not found", ruleID)
+}
+
 // NewPermissionDeniedError creates a new Error with PermissionDenied type for a permission denied error.
 func NewPermissionDeniedError() error {
 	return Errorf(PermissionDenied, "permission denied")

From 980598ed4ab21d4ba3ec5bb45b88c7471a050864 Mon Sep 17 00:00:00 2001
From: Zoltan Papp <zoltan.pmail@gmail.com>
Date: Wed, 1 Jul 2026 14:50:25 +0200
Subject: [PATCH 14/36] [management, client] Add management-controlled client
 metrics push (#5886)

* [management, client] Add management-controlled client metrics push

Allow enabling/disabling client metrics push from the dashboard via
account settings instead of requiring env vars on every client.

- Add MetricsConfig proto message to NetbirdConfig
- Add MetricsPushEnabled to account Settings (DB-persisted)
- Expose metrics_push_enabled in OpenAPI and dashboard API handler
- Populate MetricsConfig in sync and login responses
- Client dynamically starts/stops push based on management config
- NB_METRICS_PUSH_ENABLED env var overrides management when explicitly set
- Add activity events for metrics push enable/disable

* Remove log line

* [management] Fix peer update test for MetricsConfig in NetbirdConfig

Update TestUpdateAccountPeers assertions: NetbirdConfig is no longer
nil in peer update responses since it now carries MetricsConfig even
when STUN/TURN config is absent.

* Regenerate proto files with protoc v7.34.1

* [management] Read metrics push setting in Postgres account query

getAccountPgx omitted settings_metrics_push_enabled from its hand-written
SELECT and Scan, so the toggle was always read back as false on Postgres
and never reached clients.

* [client] Fix metrics push getting stuck off after engine restart

Engine restarts (backoff retries within the same login session) cancel
e.ctx, which the push goroutine's lifetime was tied to. The goroutine
died silently but ClientMetrics.push stayed non-nil since only an
explicit stop clears it, so the next UpdatePushFromMgm call saw a
"push already running" state and never restarted it.

Give the Engine its own metricsCtx sourced from ConnectClient.ctx,
which outlives engine restarts, so handleMetricsUpdate stops tying the
push to the wrong-scoped context. Additionally make ClientMetrics.push
an atomic.Pointer that the push goroutine clears via CompareAndSwap on
exit, so the tracked state can never drift from the goroutine's actual
lifetime regardless of which context a future caller passes in.

* [management] Regenerate OpenAPI types with oapi-codegen v2.7.1

types.gen.go was regenerated with a stale local v2.6.0 binary,
causing the CI git-diff check against generate.sh's pinned v2.7.1
to fail.
---
 client/internal/connect.go                    |   5 +
 client/internal/engine.go                     |  13 +
 client/internal/metrics/env.go                |   7 +
 client/internal/metrics/metrics.go            |  74 +-
 .../internals/shared/grpc/conversion.go       |  19 +-
 management/internals/shared/grpc/server.go    |   2 +-
 management/server/account.go                  |  14 +-
 management/server/activity/codes.go           |   8 +
 .../handlers/accounts/accounts_handler.go     |   4 +
 .../accounts/accounts_handler_test.go         |   6 +
 management/server/peer_test.go                |   6 +-
 management/server/store/sql_store.go          |   8 +-
 management/server/types/settings.go           |   4 +
 shared/management/http/api/openapi.yml        |   4 +
 shared/management/http/api/types.gen.go       |   3 +
 shared/management/proto/management.pb.go      | 659 ++++++++++--------
 shared/management/proto/management.proto      |   6 +
 17 files changed, 526 insertions(+), 316 deletions(-)

diff --git a/client/internal/connect.go b/client/internal/connect.go
index 7cd2bab22..eff2c9489 100644
--- a/client/internal/connect.go
+++ b/client/internal/connect.go
@@ -314,6 +314,10 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		c.clientMetrics.RecordLoginDuration(engineCtx, time.Since(loginStarted), true)
 		c.statusRecorder.MarkManagementConnected()
 
+		if metricsConfig := loginResp.GetNetbirdConfig().GetMetrics(); metricsConfig != nil {
+			c.clientMetrics.UpdatePushFromMgm(c.ctx, metricsConfig.GetEnabled())
+		}
+
 		localPeerState := peer.LocalPeerState{
 			IP:              loginResp.GetPeerConfig().GetAddress(),
 			PubKey:          myPrivateKey.PublicKey().String(),
@@ -399,6 +403,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 			StateManager:   stateManager,
 			UpdateManager:  c.updateManager,
 			ClientMetrics:  c.clientMetrics,
+			MetricsCtx:     c.ctx,
 		}, mobileDependency)
 		engine.SetSyncResponsePersistence(c.persistSyncResponse)
 		c.engine = engine
diff --git a/client/internal/engine.go b/client/internal/engine.go
index de151592d..fb1d08f5e 100644
--- a/client/internal/engine.go
+++ b/client/internal/engine.go
@@ -172,6 +172,7 @@ type EngineServices struct {
 	StateManager   *statemanager.Manager
 	UpdateManager  *updater.Manager
 	ClientMetrics  *metrics.ClientMetrics
+	MetricsCtx     context.Context
 }
 
 // Engine is a mechanism responsible for reacting on Signal and Management stream events and managing connections to the remote peers.
@@ -264,6 +265,7 @@ type Engine struct {
 
 	// clientMetrics collects and pushes metrics
 	clientMetrics *metrics.ClientMetrics
+	metricsCtx    context.Context
 
 	jobExecutor   *jobexec.Executor
 	jobExecutorWG sync.WaitGroup
@@ -316,6 +318,7 @@ func NewEngine(
 		probeStunTurn:      relay.NewStunTurnProbe(relay.DefaultCacheTTL),
 		jobExecutor:        jobexec.NewExecutor(),
 		clientMetrics:      services.ClientMetrics,
+		metricsCtx:         services.MetricsCtx,
 		updateManager:      services.UpdateManager,
 		syncStoreDir:       config.StateDir,
 	}
@@ -997,6 +1000,8 @@ func (e *Engine) updateNetbirdConfig(wCfg *mgmProto.NetbirdConfig) error {
 		return fmt.Errorf("handle the flow configuration: %w", err)
 	}
 
+	e.handleMetricsUpdate(wCfg.GetMetrics())
+
 	if err := e.PopulateNetbirdConfig(wCfg, nil); err != nil {
 		log.Warnf("Failed to update DNS server config: %v", err)
 	}
@@ -1066,6 +1071,14 @@ func (e *Engine) handleFlowUpdate(config *mgmProto.FlowConfig) error {
 	return e.flowManager.Update(flowConfig)
 }
 
+func (e *Engine) handleMetricsUpdate(config *mgmProto.MetricsConfig) {
+	if config == nil {
+		return
+	}
+	log.Infof("received metrics configuration from management: enabled=%v", config.GetEnabled())
+	e.clientMetrics.UpdatePushFromMgm(e.metricsCtx, config.GetEnabled())
+}
+
 func toFlowLoggerConfig(config *mgmProto.FlowConfig) (*nftypes.FlowConfig, error) {
 	if config.GetInterval() == nil {
 		return nil, errors.New("flow interval is nil")
diff --git a/client/internal/metrics/env.go b/client/internal/metrics/env.go
index 1f06ce484..c19dcc7f1 100644
--- a/client/internal/metrics/env.go
+++ b/client/internal/metrics/env.go
@@ -60,6 +60,13 @@ func getMetricsInterval() time.Duration {
 	return interval
 }
 
+// isMetricsPushEnvSet returns true if NB_METRICS_PUSH_ENABLED is explicitly set (to any value).
+// When set, the env var takes full precedence over management server configuration.
+func isMetricsPushEnvSet() bool {
+	_, set := os.LookupEnv(EnvMetricsPushEnabled)
+	return set
+}
+
 func isForceSending() bool {
 	force, _ := strconv.ParseBool(os.Getenv(EnvMetricsForceSending))
 	return force
diff --git a/client/internal/metrics/metrics.go b/client/internal/metrics/metrics.go
index f18082995..cfe477107 100644
--- a/client/internal/metrics/metrics.go
+++ b/client/internal/metrics/metrics.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"io"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	log "github.com/sirupsen/logrus"
@@ -75,7 +76,7 @@ type ClientMetrics struct {
 	agentInfo AgentInfo
 	mu        sync.RWMutex
 
-	push       *Push
+	push       atomic.Pointer[Push]
 	pushMu     sync.Mutex
 	wg         sync.WaitGroup
 	pushCancel context.CancelFunc
@@ -167,10 +168,7 @@ func (c *ClientMetrics) UpdateAgentInfo(agentInfo AgentInfo, publicKey string) {
 	c.agentInfo = agentInfo
 	c.mu.Unlock()
 
-	c.pushMu.Lock()
-	push := c.push
-	c.pushMu.Unlock()
-	if push != nil {
+	if push := c.push.Load(); push != nil {
 		push.SetPeerID(agentInfo.peerID)
 	}
 }
@@ -184,7 +182,7 @@ func (c *ClientMetrics) Export(w io.Writer) error {
 	return c.impl.Export(w)
 }
 
-// StartPush starts periodic pushing of metrics with the given configuration
+// StartPush starts periodic pushing of metrics with the given configuration.
 // Precedence: PushConfig.ServerAddress > remote config server_url
 func (c *ClientMetrics) StartPush(ctx context.Context, config PushConfig) {
 	if c == nil {
@@ -194,11 +192,58 @@ func (c *ClientMetrics) StartPush(ctx context.Context, config PushConfig) {
 	c.pushMu.Lock()
 	defer c.pushMu.Unlock()
 
-	if c.push != nil {
+	if c.push.Load() != nil {
 		log.Warnf("metrics push already running")
 		return
 	}
 
+	c.startPushLocked(ctx, config)
+}
+
+// StopPush stops the periodic metrics push.
+func (c *ClientMetrics) StopPush() {
+	if c == nil {
+		return
+	}
+	c.pushMu.Lock()
+	defer c.pushMu.Unlock()
+
+	c.stopPushLocked()
+}
+
+// UpdatePushFromMgm updates metrics push based on management server configuration.
+// If NB_METRICS_PUSH_ENABLED is explicitly set (true or false), management config is ignored.
+// When unset, management controls whether push is enabled.
+func (c *ClientMetrics) UpdatePushFromMgm(ctx context.Context, enabled bool) {
+	if c == nil {
+		return
+	}
+
+	if isMetricsPushEnvSet() {
+		log.Debugf("ignoring management config, env var is explicitly set: %s", EnvMetricsPushEnabled)
+		return
+	}
+
+	c.pushMu.Lock()
+	defer c.pushMu.Unlock()
+
+	if enabled {
+		if c.push.Load() != nil {
+			return
+		}
+		log.Infof("enabled metrics push by management")
+		c.startPushLocked(ctx, PushConfigFromEnv())
+	} else {
+		if c.push.Load() == nil {
+			return
+		}
+		log.Infof("disabled metrics push by management")
+		c.stopPushLocked()
+	}
+}
+
+// startPushLocked starts push. Caller must hold pushMu.
+func (c *ClientMetrics) startPushLocked(ctx context.Context, config PushConfig) {
 	c.mu.RLock()
 	agentVersion := c.agentInfo.Version
 	peerID := c.agentInfo.peerID
@@ -214,26 +259,23 @@ func (c *ClientMetrics) StartPush(ctx context.Context, config PushConfig) {
 
 	ctx, cancel := context.WithCancel(ctx)
 	c.pushCancel = cancel
+	c.push.Store(push)
 
 	c.wg.Add(1)
 	go func() {
 		defer c.wg.Done()
 		push.Start(ctx)
+		c.push.CompareAndSwap(push, nil)
 	}()
-	c.push = push
 }
 
-func (c *ClientMetrics) StopPush() {
-	if c == nil {
-		return
-	}
-	c.pushMu.Lock()
-	defer c.pushMu.Unlock()
-	if c.push == nil {
+// stopPushLocked stops push. Caller must hold pushMu.
+func (c *ClientMetrics) stopPushLocked() {
+	if c.push.Load() == nil {
 		return
 	}
 
 	c.pushCancel()
 	c.wg.Wait()
-	c.push = nil
+	c.push.Store(nil)
 }
diff --git a/management/internals/shared/grpc/conversion.go b/management/internals/shared/grpc/conversion.go
index ced982a30..973749eb0 100644
--- a/management/internals/shared/grpc/conversion.go
+++ b/management/internals/shared/grpc/conversion.go
@@ -47,9 +47,16 @@ func init() {
 	precomputedDeprecatedRemotePeersConstraint = constraint
 }
 
-func toNetbirdConfig(config *nbconfig.Config, turnCredentials *Token, relayToken *Token, extraSettings *types.ExtraSettings) *proto.NetbirdConfig {
+func toNetbirdConfig(config *nbconfig.Config, turnCredentials *Token, relayToken *Token, extraSettings *types.ExtraSettings, settings *types.Settings) *proto.NetbirdConfig {
 	if config == nil {
-		return nil
+		if settings == nil {
+			return nil
+		}
+		return &proto.NetbirdConfig{
+			Metrics: &proto.MetricsConfig{
+				Enabled: settings.MetricsPushEnabled,
+			},
+		}
 	}
 
 	var stuns []*proto.HostConfig
@@ -110,6 +117,12 @@ func toNetbirdConfig(config *nbconfig.Config, turnCredentials *Token, relayToken
 		Relay:  relayCfg,
 	}
 
+	if settings != nil {
+		nbConfig.Metrics = &proto.MetricsConfig{
+			Enabled: settings.MetricsPushEnabled,
+		}
+	}
+
 	return nbConfig
 }
 
@@ -166,7 +179,7 @@ func ToSyncResponse(ctx context.Context, config *nbconfig.Config, httpConfig *nb
 		Checks: toProtocolChecks(ctx, checks),
 	}
 
-	nbConfig := toNetbirdConfig(config, turnCredentials, relayCredentials, extraSettings)
+	nbConfig := toNetbirdConfig(config, turnCredentials, relayCredentials, extraSettings, settings)
 	extendedConfig := integrationsConfig.ExtendNetBirdConfig(peer.ID, peerGroups, nbConfig, extraSettings)
 	response.NetbirdConfig = extendedConfig
 
diff --git a/management/internals/shared/grpc/server.go b/management/internals/shared/grpc/server.go
index 476aaa9d6..fa06687d0 100644
--- a/management/internals/shared/grpc/server.go
+++ b/management/internals/shared/grpc/server.go
@@ -917,7 +917,7 @@ func (s *Server) prepareLoginResponse(ctx context.Context, peer *nbpeer.Peer, ne
 
 	// if peer has reached this point then it has logged in
 	loginResp := &proto.LoginResponse{
-		NetbirdConfig: toNetbirdConfig(s.config, nil, relayToken, nil),
+		NetbirdConfig: toNetbirdConfig(s.config, nil, relayToken, nil, settings),
 		PeerConfig:    toPeerConfig(peer, network, s.networkMapController.GetDNSDomain(settings), settings, s.config.HttpConfig, s.config.DeviceAuthorizationFlow, enableSSH),
 		Checks:        toProtocolChecks(ctx, postureChecks),
 	}
diff --git a/management/server/account.go b/management/server/account.go
index 2c57c4637..94335cf27 100644
--- a/management/server/account.go
+++ b/management/server/account.go
@@ -358,7 +358,8 @@ func (am *DefaultAccountManager) UpdateAccountSettings(ctx context.Context, acco
 			oldSettings.AutoUpdateVersion != newSettings.AutoUpdateVersion ||
 			oldSettings.AutoUpdateAlways != newSettings.AutoUpdateAlways ||
 			oldSettings.PeerLoginExpirationEnabled != newSettings.PeerLoginExpirationEnabled ||
-			oldSettings.PeerLoginExpiration != newSettings.PeerLoginExpiration {
+			oldSettings.PeerLoginExpiration != newSettings.PeerLoginExpiration ||
+			oldSettings.MetricsPushEnabled != newSettings.MetricsPushEnabled {
 			// Session deadline is derived from LastLogin + PeerLoginExpiration
 			// on every Login/Sync response. Without a fan-out push, connected
 			// peers keep the deadline they received at login time and only see
@@ -409,6 +410,7 @@ func (am *DefaultAccountManager) UpdateAccountSettings(ctx context.Context, acco
 	am.handleAutoUpdateVersionSettings(ctx, oldSettings, newSettings, userID, accountID)
 	am.handleAutoUpdateAlwaysSettings(ctx, oldSettings, newSettings, userID, accountID)
 	am.handlePeerExposeSettings(ctx, oldSettings, newSettings, userID, accountID)
+	am.handleMetricsPushSettings(ctx, oldSettings, newSettings, userID, accountID)
 	if err = am.handleInactivityExpirationSettings(ctx, oldSettings, newSettings, userID, accountID); err != nil {
 		return nil, err
 	}
@@ -563,6 +565,16 @@ func (am *DefaultAccountManager) handleLazyConnectionSettings(ctx context.Contex
 	}
 }
 
+func (am *DefaultAccountManager) handleMetricsPushSettings(ctx context.Context, oldSettings, newSettings *types.Settings, userID, accountID string) {
+	if oldSettings.MetricsPushEnabled != newSettings.MetricsPushEnabled {
+		if newSettings.MetricsPushEnabled {
+			am.StoreEvent(ctx, userID, accountID, accountID, activity.AccountMetricsPushEnabled, nil)
+		} else {
+			am.StoreEvent(ctx, userID, accountID, accountID, activity.AccountMetricsPushDisabled, nil)
+		}
+	}
+}
+
 func (am *DefaultAccountManager) handlePeerLoginExpirationSettings(ctx context.Context, oldSettings, newSettings *types.Settings, userID, accountID string) {
 	if oldSettings.PeerLoginExpirationEnabled != newSettings.PeerLoginExpirationEnabled {
 		event := activity.AccountPeerLoginExpirationEnabled
diff --git a/management/server/activity/codes.go b/management/server/activity/codes.go
index cfd809871..eaa638fac 100644
--- a/management/server/activity/codes.go
+++ b/management/server/activity/codes.go
@@ -276,6 +276,11 @@ const (
 	// AgentNetworkSettingsUpdated indicates that a user updated Agent Network account settings
 	AgentNetworkSettingsUpdated Activity = 139
 
+	// AccountMetricsPushEnabled indicates that a user enabled metrics push for the account
+	AccountMetricsPushEnabled Activity = 140
+	// AccountMetricsPushDisabled indicates that a user disabled metrics push for the account
+	AccountMetricsPushDisabled Activity = 141
+
 	AccountDeleted Activity = 99999
 )
 
@@ -449,6 +454,9 @@ var activityMap = map[Activity]Code{
 
 	AgentNetworkSettingsUpdated: {"Agent Network settings updated", "agent_network.settings.update"},
 
+	AccountMetricsPushEnabled:  {"Account metrics push enabled", "account.setting.metrics.push.enable"},
+	AccountMetricsPushDisabled: {"Account metrics push disabled", "account.setting.metrics.push.disable"},
+
 	DomainAdded:     {"Domain added", "domain.add"},
 	DomainDeleted:   {"Domain deleted", "domain.delete"},
 	DomainValidated: {"Domain validated", "domain.validate"},
diff --git a/management/server/http/handlers/accounts/accounts_handler.go b/management/server/http/handlers/accounts/accounts_handler.go
index 209d593bd..d4342bf57 100644
--- a/management/server/http/handlers/accounts/accounts_handler.go
+++ b/management/server/http/handlers/accounts/accounts_handler.go
@@ -283,6 +283,9 @@ func (h *handler) updateAccountRequestSettings(req api.PutApiAccountsAccountIdJS
 	if req.Settings.Ipv6EnabledGroups != nil {
 		returnSettings.IPv6EnabledGroups = *req.Settings.Ipv6EnabledGroups
 	}
+	if req.Settings.MetricsPushEnabled != nil {
+		returnSettings.MetricsPushEnabled = *req.Settings.MetricsPushEnabled
+	}
 
 	return returnSettings, nil
 }
@@ -413,6 +416,7 @@ func toAccountResponse(accountID string, settings *types.Settings, meta *types.A
 		AutoUpdateVersion:               &settings.AutoUpdateVersion,
 		AutoUpdateAlways:                &settings.AutoUpdateAlways,
 		Ipv6EnabledGroups:               &settings.IPv6EnabledGroups,
+		MetricsPushEnabled:              &settings.MetricsPushEnabled,
 		EmbeddedIdpEnabled:              &settings.EmbeddedIdpEnabled,
 		LocalAuthDisabled:               &settings.LocalAuthDisabled,
 		LocalMfaEnabled:                 &settings.LocalMfaEnabled,
diff --git a/management/server/http/handlers/accounts/accounts_handler_test.go b/management/server/http/handlers/accounts/accounts_handler_test.go
index 8db76719c..df89fde9a 100644
--- a/management/server/http/handlers/accounts/accounts_handler_test.go
+++ b/management/server/http/handlers/accounts/accounts_handler_test.go
@@ -129,6 +129,7 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				DnsDomain:                       sr(""),
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
+				MetricsPushEnabled:              br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),
@@ -156,6 +157,7 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				DnsDomain:                       sr(""),
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
+				MetricsPushEnabled:              br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),
@@ -183,6 +185,7 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				DnsDomain:                       sr(""),
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr("latest"),
+				MetricsPushEnabled:              br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),
@@ -210,6 +213,7 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				DnsDomain:                       sr(""),
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
+				MetricsPushEnabled:              br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),
@@ -237,6 +241,7 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				DnsDomain:                       sr(""),
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
+				MetricsPushEnabled:              br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),
@@ -264,6 +269,7 @@ func TestAccounts_AccountsHandler(t *testing.T) {
 				DnsDomain:                       sr(""),
 				AutoUpdateAlways:                br(false),
 				AutoUpdateVersion:               sr(""),
+				MetricsPushEnabled:              br(false),
 				EmbeddedIdpEnabled:              br(false),
 				LocalAuthDisabled:               br(false),
 				LocalMfaEnabled:                 br(false),
diff --git a/management/server/peer_test.go b/management/server/peer_test.go
index 6f139e43f..6c243c4c7 100644
--- a/management/server/peer_test.go
+++ b/management/server/peer_test.go
@@ -1048,7 +1048,11 @@ func testUpdateAccountPeers(t *testing.T) {
 
 			for _, channel := range peerChannels {
 				update := <-channel
-				assert.Nil(t, update.Update.NetbirdConfig)
+				assert.NotNil(t, update.Update.NetbirdConfig)
+				assert.Nil(t, update.Update.NetbirdConfig.Stuns)
+				assert.Nil(t, update.Update.NetbirdConfig.Turns)
+				assert.Nil(t, update.Update.NetbirdConfig.Signal)
+				assert.Nil(t, update.Update.NetbirdConfig.Relay)
 				assert.Equal(t, tc.peers, len(update.Update.NetworkMap.RemotePeers))
 				assert.Equal(t, tc.peers*2, len(update.Update.NetworkMap.FirewallRules))
 			}
diff --git a/management/server/store/sql_store.go b/management/server/store/sql_store.go
index 18be1b6ed..69efe65f1 100644
--- a/management/server/store/sql_store.go
+++ b/management/server/store/sql_store.go
@@ -1605,7 +1605,7 @@ func (s *SqlStore) getAccount(ctx context.Context, accountID string) (*types.Acc
 			settings_jwt_groups_enabled, settings_jwt_groups_claim_name, settings_jwt_allow_groups,
 			settings_routing_peer_dns_resolution_enabled, settings_dns_domain, settings_network_range,
 			settings_network_range_v6, settings_ipv6_enabled_groups, settings_lazy_connection_enabled,
-			settings_local_mfa_enabled,
+			settings_local_mfa_enabled, settings_metrics_push_enabled,
 			-- Embedded ExtraSettings
 			settings_extra_peer_approval_enabled, settings_extra_user_approval_required,
 			settings_extra_integrated_validator, settings_extra_integrated_validator_groups
@@ -1628,6 +1628,7 @@ func (s *SqlStore) getAccount(ctx context.Context, accountID string) (*types.Acc
 		sIPv6EnabledGroups               sql.NullString
 		sLazyConnectionEnabled           sql.NullBool
 		sLocalMFAEnabled                 sql.NullBool
+		sMetricsPushEnabled              sql.NullBool
 		sExtraPeerApprovalEnabled        sql.NullBool
 		sExtraUserApprovalRequired       sql.NullBool
 		sExtraIntegratedValidator        sql.NullString
@@ -1650,7 +1651,7 @@ func (s *SqlStore) getAccount(ctx context.Context, accountID string) (*types.Acc
 		&sJWTGroupsEnabled, &sJWTGroupsClaimName, &sJWTAllowGroups,
 		&sRoutingPeerDNSResolutionEnabled, &sDNSDomain, &sNetworkRange,
 		&sNetworkRangeV6, &sIPv6EnabledGroups, &sLazyConnectionEnabled,
-		&sLocalMFAEnabled,
+		&sLocalMFAEnabled, &sMetricsPushEnabled,
 		&sExtraPeerApprovalEnabled, &sExtraUserApprovalRequired,
 		&sExtraIntegratedValidator, &sExtraIntegratedValidatorGroups,
 	)
@@ -1716,6 +1717,9 @@ func (s *SqlStore) getAccount(ctx context.Context, accountID string) (*types.Acc
 	if sLocalMFAEnabled.Valid {
 		account.Settings.LocalMfaEnabled = sLocalMFAEnabled.Bool
 	}
+	if sMetricsPushEnabled.Valid {
+		account.Settings.MetricsPushEnabled = sMetricsPushEnabled.Bool
+	}
 	if sJWTAllowGroups.Valid {
 		_ = json.Unmarshal([]byte(sJWTAllowGroups.String), &account.Settings.JWTAllowGroups)
 	}
diff --git a/management/server/types/settings.go b/management/server/types/settings.go
index 97ffa5e76..d17d0ef2b 100644
--- a/management/server/types/settings.go
+++ b/management/server/types/settings.go
@@ -73,6 +73,9 @@ type Settings struct {
 	// For new accounts this defaults to the All group.
 	IPv6EnabledGroups []string `gorm:"serializer:json"`
 
+	// MetricsPushEnabled globally enables or disables client metrics push for the account
+	MetricsPushEnabled bool `gorm:"default:false"`
+
 	// EmbeddedIdpEnabled indicates if the embedded identity provider is enabled.
 	// This is a runtime-only field, not stored in the database.
 	EmbeddedIdpEnabled bool `gorm:"-"`
@@ -110,6 +113,7 @@ func (s *Settings) Copy() *Settings {
 		AutoUpdateVersion:               s.AutoUpdateVersion,
 		AutoUpdateAlways:                s.AutoUpdateAlways,
 		IPv6EnabledGroups:               slices.Clone(s.IPv6EnabledGroups),
+		MetricsPushEnabled:              s.MetricsPushEnabled,
 		EmbeddedIdpEnabled:              s.EmbeddedIdpEnabled,
 		LocalAuthDisabled:               s.LocalAuthDisabled,
 		LocalMfaEnabled:                 s.LocalMfaEnabled,
diff --git a/shared/management/http/api/openapi.yml b/shared/management/http/api/openapi.yml
index dffb7d7de..f11eb2c0a 100644
--- a/shared/management/http/api/openapi.yml
+++ b/shared/management/http/api/openapi.yml
@@ -371,6 +371,10 @@ components:
           description: When true, updates are installed automatically in the background. When false, updates require user interaction from the UI.
           type: boolean
           example: false
+        metrics_push_enabled:
+          description: Enables or disables client metrics push for all peers in the account
+          type: boolean
+          example: false
         embedded_idp_enabled:
           description: Indicates whether the embedded identity provider (Dex) is enabled for this account. This is a read-only field.
           type: boolean
diff --git a/shared/management/http/api/types.gen.go b/shared/management/http/api/types.gen.go
index 7ea9514c0..2a766b845 100644
--- a/shared/management/http/api/types.gen.go
+++ b/shared/management/http/api/types.gen.go
@@ -1684,6 +1684,9 @@ type AccountSettings struct {
 	// LocalMfaEnabled Enables or disables TOTP multi-factor authentication for local users. Only applicable when the embedded identity provider is enabled.
 	LocalMfaEnabled *bool `json:"local_mfa_enabled,omitempty"`
 
+	// MetricsPushEnabled Enables or disables client metrics push for all peers in the account
+	MetricsPushEnabled *bool `json:"metrics_push_enabled,omitempty"`
+
 	// NetworkRange Allows to define a custom network range for the account in CIDR format
 	NetworkRange *string `json:"network_range,omitempty"`
 
diff --git a/shared/management/proto/management.pb.go b/shared/management/proto/management.pb.go
index 8027c0db6..faf21e60f 100644
--- a/shared/management/proto/management.pb.go
+++ b/shared/management/proto/management.pb.go
@@ -424,7 +424,7 @@ func (x DeviceAuthorizationFlowProvider) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use DeviceAuthorizationFlowProvider.Descriptor instead.
 func (DeviceAuthorizationFlowProvider) EnumDescriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{33, 0}
+	return file_management_proto_rawDescGZIP(), []int{34, 0}
 }
 
 type EncryptedMessage struct {
@@ -1907,9 +1907,10 @@ type NetbirdConfig struct {
 	// a list of TURN servers
 	Turns []*ProtectedHostConfig `protobuf:"bytes,2,rep,name=turns,proto3" json:"turns,omitempty"`
 	// a Signal server config
-	Signal *HostConfig  `protobuf:"bytes,3,opt,name=signal,proto3" json:"signal,omitempty"`
-	Relay  *RelayConfig `protobuf:"bytes,4,opt,name=relay,proto3" json:"relay,omitempty"`
-	Flow   *FlowConfig  `protobuf:"bytes,5,opt,name=flow,proto3" json:"flow,omitempty"`
+	Signal  *HostConfig    `protobuf:"bytes,3,opt,name=signal,proto3" json:"signal,omitempty"`
+	Relay   *RelayConfig   `protobuf:"bytes,4,opt,name=relay,proto3" json:"relay,omitempty"`
+	Flow    *FlowConfig    `protobuf:"bytes,5,opt,name=flow,proto3" json:"flow,omitempty"`
+	Metrics *MetricsConfig `protobuf:"bytes,6,opt,name=metrics,proto3" json:"metrics,omitempty"`
 }
 
 func (x *NetbirdConfig) Reset() {
@@ -1979,6 +1980,13 @@ func (x *NetbirdConfig) GetFlow() *FlowConfig {
 	return nil
 }
 
+func (x *NetbirdConfig) GetMetrics() *MetricsConfig {
+	if x != nil {
+		return x.Metrics
+	}
+	return nil
+}
+
 // HostConfig describes connection properties of some server (e.g. STUN, Signal, Management)
 type HostConfig struct {
 	state         protoimpl.MessageState
@@ -2205,6 +2213,53 @@ func (x *FlowConfig) GetDnsCollection() bool {
 	return false
 }
 
+type MetricsConfig struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Enabled bool `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
+}
+
+func (x *MetricsConfig) Reset() {
+	*x = MetricsConfig{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[23]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MetricsConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MetricsConfig) ProtoMessage() {}
+
+func (x *MetricsConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[23]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MetricsConfig.ProtoReflect.Descriptor instead.
+func (*MetricsConfig) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{23}
+}
+
+func (x *MetricsConfig) GetEnabled() bool {
+	if x != nil {
+		return x.Enabled
+	}
+	return false
+}
+
 // JWTConfig represents JWT authentication configuration for validating tokens.
 type JWTConfig struct {
 	state         protoimpl.MessageState
@@ -2224,7 +2279,7 @@ type JWTConfig struct {
 func (x *JWTConfig) Reset() {
 	*x = JWTConfig{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[23]
+		mi := &file_management_proto_msgTypes[24]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2237,7 +2292,7 @@ func (x *JWTConfig) String() string {
 func (*JWTConfig) ProtoMessage() {}
 
 func (x *JWTConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[23]
+	mi := &file_management_proto_msgTypes[24]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2250,7 +2305,7 @@ func (x *JWTConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use JWTConfig.ProtoReflect.Descriptor instead.
 func (*JWTConfig) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{23}
+	return file_management_proto_rawDescGZIP(), []int{24}
 }
 
 func (x *JWTConfig) GetIssuer() string {
@@ -2303,7 +2358,7 @@ type ProtectedHostConfig struct {
 func (x *ProtectedHostConfig) Reset() {
 	*x = ProtectedHostConfig{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[24]
+		mi := &file_management_proto_msgTypes[25]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2316,7 +2371,7 @@ func (x *ProtectedHostConfig) String() string {
 func (*ProtectedHostConfig) ProtoMessage() {}
 
 func (x *ProtectedHostConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[24]
+	mi := &file_management_proto_msgTypes[25]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2329,7 +2384,7 @@ func (x *ProtectedHostConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ProtectedHostConfig.ProtoReflect.Descriptor instead.
 func (*ProtectedHostConfig) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{24}
+	return file_management_proto_rawDescGZIP(), []int{25}
 }
 
 func (x *ProtectedHostConfig) GetHostConfig() *HostConfig {
@@ -2380,7 +2435,7 @@ type PeerConfig struct {
 func (x *PeerConfig) Reset() {
 	*x = PeerConfig{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[25]
+		mi := &file_management_proto_msgTypes[26]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2393,7 +2448,7 @@ func (x *PeerConfig) String() string {
 func (*PeerConfig) ProtoMessage() {}
 
 func (x *PeerConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[25]
+	mi := &file_management_proto_msgTypes[26]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2406,7 +2461,7 @@ func (x *PeerConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PeerConfig.ProtoReflect.Descriptor instead.
 func (*PeerConfig) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{25}
+	return file_management_proto_rawDescGZIP(), []int{26}
 }
 
 func (x *PeerConfig) GetAddress() string {
@@ -2486,7 +2541,7 @@ type AutoUpdateSettings struct {
 func (x *AutoUpdateSettings) Reset() {
 	*x = AutoUpdateSettings{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[26]
+		mi := &file_management_proto_msgTypes[27]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2499,7 +2554,7 @@ func (x *AutoUpdateSettings) String() string {
 func (*AutoUpdateSettings) ProtoMessage() {}
 
 func (x *AutoUpdateSettings) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[26]
+	mi := &file_management_proto_msgTypes[27]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2512,7 +2567,7 @@ func (x *AutoUpdateSettings) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AutoUpdateSettings.ProtoReflect.Descriptor instead.
 func (*AutoUpdateSettings) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{26}
+	return file_management_proto_rawDescGZIP(), []int{27}
 }
 
 func (x *AutoUpdateSettings) GetVersion() string {
@@ -2567,7 +2622,7 @@ type NetworkMap struct {
 func (x *NetworkMap) Reset() {
 	*x = NetworkMap{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[27]
+		mi := &file_management_proto_msgTypes[28]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2580,7 +2635,7 @@ func (x *NetworkMap) String() string {
 func (*NetworkMap) ProtoMessage() {}
 
 func (x *NetworkMap) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[27]
+	mi := &file_management_proto_msgTypes[28]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2593,7 +2648,7 @@ func (x *NetworkMap) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NetworkMap.ProtoReflect.Descriptor instead.
 func (*NetworkMap) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{27}
+	return file_management_proto_rawDescGZIP(), []int{28}
 }
 
 func (x *NetworkMap) GetSerial() uint64 {
@@ -2703,7 +2758,7 @@ type SSHAuth struct {
 func (x *SSHAuth) Reset() {
 	*x = SSHAuth{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[28]
+		mi := &file_management_proto_msgTypes[29]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2716,7 +2771,7 @@ func (x *SSHAuth) String() string {
 func (*SSHAuth) ProtoMessage() {}
 
 func (x *SSHAuth) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[28]
+	mi := &file_management_proto_msgTypes[29]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2729,7 +2784,7 @@ func (x *SSHAuth) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SSHAuth.ProtoReflect.Descriptor instead.
 func (*SSHAuth) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{28}
+	return file_management_proto_rawDescGZIP(), []int{29}
 }
 
 func (x *SSHAuth) GetUserIDClaim() string {
@@ -2764,7 +2819,7 @@ type MachineUserIndexes struct {
 func (x *MachineUserIndexes) Reset() {
 	*x = MachineUserIndexes{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[29]
+		mi := &file_management_proto_msgTypes[30]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2777,7 +2832,7 @@ func (x *MachineUserIndexes) String() string {
 func (*MachineUserIndexes) ProtoMessage() {}
 
 func (x *MachineUserIndexes) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[29]
+	mi := &file_management_proto_msgTypes[30]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2790,7 +2845,7 @@ func (x *MachineUserIndexes) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MachineUserIndexes.ProtoReflect.Descriptor instead.
 func (*MachineUserIndexes) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{29}
+	return file_management_proto_rawDescGZIP(), []int{30}
 }
 
 func (x *MachineUserIndexes) GetIndexes() []uint32 {
@@ -2821,7 +2876,7 @@ type RemotePeerConfig struct {
 func (x *RemotePeerConfig) Reset() {
 	*x = RemotePeerConfig{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[30]
+		mi := &file_management_proto_msgTypes[31]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2834,7 +2889,7 @@ func (x *RemotePeerConfig) String() string {
 func (*RemotePeerConfig) ProtoMessage() {}
 
 func (x *RemotePeerConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[30]
+	mi := &file_management_proto_msgTypes[31]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2847,7 +2902,7 @@ func (x *RemotePeerConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RemotePeerConfig.ProtoReflect.Descriptor instead.
 func (*RemotePeerConfig) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{30}
+	return file_management_proto_rawDescGZIP(), []int{31}
 }
 
 func (x *RemotePeerConfig) GetWgPubKey() string {
@@ -2902,7 +2957,7 @@ type SSHConfig struct {
 func (x *SSHConfig) Reset() {
 	*x = SSHConfig{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[31]
+		mi := &file_management_proto_msgTypes[32]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2915,7 +2970,7 @@ func (x *SSHConfig) String() string {
 func (*SSHConfig) ProtoMessage() {}
 
 func (x *SSHConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[31]
+	mi := &file_management_proto_msgTypes[32]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2928,7 +2983,7 @@ func (x *SSHConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SSHConfig.ProtoReflect.Descriptor instead.
 func (*SSHConfig) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{31}
+	return file_management_proto_rawDescGZIP(), []int{32}
 }
 
 func (x *SSHConfig) GetSshEnabled() bool {
@@ -2962,7 +3017,7 @@ type DeviceAuthorizationFlowRequest struct {
 func (x *DeviceAuthorizationFlowRequest) Reset() {
 	*x = DeviceAuthorizationFlowRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[32]
+		mi := &file_management_proto_msgTypes[33]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2975,7 +3030,7 @@ func (x *DeviceAuthorizationFlowRequest) String() string {
 func (*DeviceAuthorizationFlowRequest) ProtoMessage() {}
 
 func (x *DeviceAuthorizationFlowRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[32]
+	mi := &file_management_proto_msgTypes[33]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2988,7 +3043,7 @@ func (x *DeviceAuthorizationFlowRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeviceAuthorizationFlowRequest.ProtoReflect.Descriptor instead.
 func (*DeviceAuthorizationFlowRequest) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{32}
+	return file_management_proto_rawDescGZIP(), []int{33}
 }
 
 // DeviceAuthorizationFlow represents Device Authorization Flow information
@@ -3007,7 +3062,7 @@ type DeviceAuthorizationFlow struct {
 func (x *DeviceAuthorizationFlow) Reset() {
 	*x = DeviceAuthorizationFlow{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[33]
+		mi := &file_management_proto_msgTypes[34]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3020,7 +3075,7 @@ func (x *DeviceAuthorizationFlow) String() string {
 func (*DeviceAuthorizationFlow) ProtoMessage() {}
 
 func (x *DeviceAuthorizationFlow) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[33]
+	mi := &file_management_proto_msgTypes[34]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3033,7 +3088,7 @@ func (x *DeviceAuthorizationFlow) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeviceAuthorizationFlow.ProtoReflect.Descriptor instead.
 func (*DeviceAuthorizationFlow) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{33}
+	return file_management_proto_rawDescGZIP(), []int{34}
 }
 
 func (x *DeviceAuthorizationFlow) GetProvider() DeviceAuthorizationFlowProvider {
@@ -3060,7 +3115,7 @@ type PKCEAuthorizationFlowRequest struct {
 func (x *PKCEAuthorizationFlowRequest) Reset() {
 	*x = PKCEAuthorizationFlowRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[34]
+		mi := &file_management_proto_msgTypes[35]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3073,7 +3128,7 @@ func (x *PKCEAuthorizationFlowRequest) String() string {
 func (*PKCEAuthorizationFlowRequest) ProtoMessage() {}
 
 func (x *PKCEAuthorizationFlowRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[34]
+	mi := &file_management_proto_msgTypes[35]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3086,7 +3141,7 @@ func (x *PKCEAuthorizationFlowRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PKCEAuthorizationFlowRequest.ProtoReflect.Descriptor instead.
 func (*PKCEAuthorizationFlowRequest) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{34}
+	return file_management_proto_rawDescGZIP(), []int{35}
 }
 
 // PKCEAuthorizationFlow represents Authorization Code Flow information
@@ -3103,7 +3158,7 @@ type PKCEAuthorizationFlow struct {
 func (x *PKCEAuthorizationFlow) Reset() {
 	*x = PKCEAuthorizationFlow{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[35]
+		mi := &file_management_proto_msgTypes[36]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3116,7 +3171,7 @@ func (x *PKCEAuthorizationFlow) String() string {
 func (*PKCEAuthorizationFlow) ProtoMessage() {}
 
 func (x *PKCEAuthorizationFlow) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[35]
+	mi := &file_management_proto_msgTypes[36]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3129,7 +3184,7 @@ func (x *PKCEAuthorizationFlow) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PKCEAuthorizationFlow.ProtoReflect.Descriptor instead.
 func (*PKCEAuthorizationFlow) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{35}
+	return file_management_proto_rawDescGZIP(), []int{36}
 }
 
 func (x *PKCEAuthorizationFlow) GetProviderConfig() *ProviderConfig {
@@ -3177,7 +3232,7 @@ type ProviderConfig struct {
 func (x *ProviderConfig) Reset() {
 	*x = ProviderConfig{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[36]
+		mi := &file_management_proto_msgTypes[37]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3190,7 +3245,7 @@ func (x *ProviderConfig) String() string {
 func (*ProviderConfig) ProtoMessage() {}
 
 func (x *ProviderConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[36]
+	mi := &file_management_proto_msgTypes[37]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3203,7 +3258,7 @@ func (x *ProviderConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ProviderConfig.ProtoReflect.Descriptor instead.
 func (*ProviderConfig) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{36}
+	return file_management_proto_rawDescGZIP(), []int{37}
 }
 
 func (x *ProviderConfig) GetClientID() string {
@@ -3312,7 +3367,7 @@ type Route struct {
 func (x *Route) Reset() {
 	*x = Route{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[37]
+		mi := &file_management_proto_msgTypes[38]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3325,7 +3380,7 @@ func (x *Route) String() string {
 func (*Route) ProtoMessage() {}
 
 func (x *Route) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[37]
+	mi := &file_management_proto_msgTypes[38]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3338,7 +3393,7 @@ func (x *Route) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Route.ProtoReflect.Descriptor instead.
 func (*Route) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{37}
+	return file_management_proto_rawDescGZIP(), []int{38}
 }
 
 func (x *Route) GetID() string {
@@ -3427,7 +3482,7 @@ type DNSConfig struct {
 func (x *DNSConfig) Reset() {
 	*x = DNSConfig{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[38]
+		mi := &file_management_proto_msgTypes[39]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3440,7 +3495,7 @@ func (x *DNSConfig) String() string {
 func (*DNSConfig) ProtoMessage() {}
 
 func (x *DNSConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[38]
+	mi := &file_management_proto_msgTypes[39]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3453,7 +3508,7 @@ func (x *DNSConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DNSConfig.ProtoReflect.Descriptor instead.
 func (*DNSConfig) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{38}
+	return file_management_proto_rawDescGZIP(), []int{39}
 }
 
 func (x *DNSConfig) GetServiceEnable() bool {
@@ -3502,7 +3557,7 @@ type CustomZone struct {
 func (x *CustomZone) Reset() {
 	*x = CustomZone{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[39]
+		mi := &file_management_proto_msgTypes[40]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3515,7 +3570,7 @@ func (x *CustomZone) String() string {
 func (*CustomZone) ProtoMessage() {}
 
 func (x *CustomZone) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[39]
+	mi := &file_management_proto_msgTypes[40]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3528,7 +3583,7 @@ func (x *CustomZone) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CustomZone.ProtoReflect.Descriptor instead.
 func (*CustomZone) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{39}
+	return file_management_proto_rawDescGZIP(), []int{40}
 }
 
 func (x *CustomZone) GetDomain() string {
@@ -3575,7 +3630,7 @@ type SimpleRecord struct {
 func (x *SimpleRecord) Reset() {
 	*x = SimpleRecord{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[40]
+		mi := &file_management_proto_msgTypes[41]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3588,7 +3643,7 @@ func (x *SimpleRecord) String() string {
 func (*SimpleRecord) ProtoMessage() {}
 
 func (x *SimpleRecord) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[40]
+	mi := &file_management_proto_msgTypes[41]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3601,7 +3656,7 @@ func (x *SimpleRecord) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SimpleRecord.ProtoReflect.Descriptor instead.
 func (*SimpleRecord) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{40}
+	return file_management_proto_rawDescGZIP(), []int{41}
 }
 
 func (x *SimpleRecord) GetName() string {
@@ -3654,7 +3709,7 @@ type NameServerGroup struct {
 func (x *NameServerGroup) Reset() {
 	*x = NameServerGroup{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[41]
+		mi := &file_management_proto_msgTypes[42]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3667,7 +3722,7 @@ func (x *NameServerGroup) String() string {
 func (*NameServerGroup) ProtoMessage() {}
 
 func (x *NameServerGroup) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[41]
+	mi := &file_management_proto_msgTypes[42]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3680,7 +3735,7 @@ func (x *NameServerGroup) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NameServerGroup.ProtoReflect.Descriptor instead.
 func (*NameServerGroup) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{41}
+	return file_management_proto_rawDescGZIP(), []int{42}
 }
 
 func (x *NameServerGroup) GetNameServers() []*NameServer {
@@ -3725,7 +3780,7 @@ type NameServer struct {
 func (x *NameServer) Reset() {
 	*x = NameServer{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[42]
+		mi := &file_management_proto_msgTypes[43]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3738,7 +3793,7 @@ func (x *NameServer) String() string {
 func (*NameServer) ProtoMessage() {}
 
 func (x *NameServer) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[42]
+	mi := &file_management_proto_msgTypes[43]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3751,7 +3806,7 @@ func (x *NameServer) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NameServer.ProtoReflect.Descriptor instead.
 func (*NameServer) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{42}
+	return file_management_proto_rawDescGZIP(), []int{43}
 }
 
 func (x *NameServer) GetIP() string {
@@ -3802,7 +3857,7 @@ type FirewallRule struct {
 func (x *FirewallRule) Reset() {
 	*x = FirewallRule{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[43]
+		mi := &file_management_proto_msgTypes[44]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3815,7 +3870,7 @@ func (x *FirewallRule) String() string {
 func (*FirewallRule) ProtoMessage() {}
 
 func (x *FirewallRule) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[43]
+	mi := &file_management_proto_msgTypes[44]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3828,7 +3883,7 @@ func (x *FirewallRule) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FirewallRule.ProtoReflect.Descriptor instead.
 func (*FirewallRule) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{43}
+	return file_management_proto_rawDescGZIP(), []int{44}
 }
 
 // Deprecated: Do not use.
@@ -3907,7 +3962,7 @@ type NetworkAddress struct {
 func (x *NetworkAddress) Reset() {
 	*x = NetworkAddress{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[44]
+		mi := &file_management_proto_msgTypes[45]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3920,7 +3975,7 @@ func (x *NetworkAddress) String() string {
 func (*NetworkAddress) ProtoMessage() {}
 
 func (x *NetworkAddress) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[44]
+	mi := &file_management_proto_msgTypes[45]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3933,7 +3988,7 @@ func (x *NetworkAddress) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NetworkAddress.ProtoReflect.Descriptor instead.
 func (*NetworkAddress) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{44}
+	return file_management_proto_rawDescGZIP(), []int{45}
 }
 
 func (x *NetworkAddress) GetNetIP() string {
@@ -3961,7 +4016,7 @@ type Checks struct {
 func (x *Checks) Reset() {
 	*x = Checks{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[45]
+		mi := &file_management_proto_msgTypes[46]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -3974,7 +4029,7 @@ func (x *Checks) String() string {
 func (*Checks) ProtoMessage() {}
 
 func (x *Checks) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[45]
+	mi := &file_management_proto_msgTypes[46]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3987,7 +4042,7 @@ func (x *Checks) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Checks.ProtoReflect.Descriptor instead.
 func (*Checks) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{45}
+	return file_management_proto_rawDescGZIP(), []int{46}
 }
 
 func (x *Checks) GetFiles() []string {
@@ -4012,7 +4067,7 @@ type PortInfo struct {
 func (x *PortInfo) Reset() {
 	*x = PortInfo{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[46]
+		mi := &file_management_proto_msgTypes[47]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4025,7 +4080,7 @@ func (x *PortInfo) String() string {
 func (*PortInfo) ProtoMessage() {}
 
 func (x *PortInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[46]
+	mi := &file_management_proto_msgTypes[47]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4038,7 +4093,7 @@ func (x *PortInfo) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PortInfo.ProtoReflect.Descriptor instead.
 func (*PortInfo) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{46}
+	return file_management_proto_rawDescGZIP(), []int{47}
 }
 
 func (m *PortInfo) GetPortSelection() isPortInfo_PortSelection {
@@ -4109,7 +4164,7 @@ type RouteFirewallRule struct {
 func (x *RouteFirewallRule) Reset() {
 	*x = RouteFirewallRule{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[47]
+		mi := &file_management_proto_msgTypes[48]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4122,7 +4177,7 @@ func (x *RouteFirewallRule) String() string {
 func (*RouteFirewallRule) ProtoMessage() {}
 
 func (x *RouteFirewallRule) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[47]
+	mi := &file_management_proto_msgTypes[48]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4135,7 +4190,7 @@ func (x *RouteFirewallRule) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RouteFirewallRule.ProtoReflect.Descriptor instead.
 func (*RouteFirewallRule) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{47}
+	return file_management_proto_rawDescGZIP(), []int{48}
 }
 
 func (x *RouteFirewallRule) GetSourceRanges() []string {
@@ -4226,7 +4281,7 @@ type ForwardingRule struct {
 func (x *ForwardingRule) Reset() {
 	*x = ForwardingRule{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[48]
+		mi := &file_management_proto_msgTypes[49]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4239,7 +4294,7 @@ func (x *ForwardingRule) String() string {
 func (*ForwardingRule) ProtoMessage() {}
 
 func (x *ForwardingRule) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[48]
+	mi := &file_management_proto_msgTypes[49]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4252,7 +4307,7 @@ func (x *ForwardingRule) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ForwardingRule.ProtoReflect.Descriptor instead.
 func (*ForwardingRule) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{48}
+	return file_management_proto_rawDescGZIP(), []int{49}
 }
 
 func (x *ForwardingRule) GetProtocol() RuleProtocol {
@@ -4301,7 +4356,7 @@ type ExposeServiceRequest struct {
 func (x *ExposeServiceRequest) Reset() {
 	*x = ExposeServiceRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[49]
+		mi := &file_management_proto_msgTypes[50]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4314,7 +4369,7 @@ func (x *ExposeServiceRequest) String() string {
 func (*ExposeServiceRequest) ProtoMessage() {}
 
 func (x *ExposeServiceRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[49]
+	mi := &file_management_proto_msgTypes[50]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4327,7 +4382,7 @@ func (x *ExposeServiceRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ExposeServiceRequest.ProtoReflect.Descriptor instead.
 func (*ExposeServiceRequest) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{49}
+	return file_management_proto_rawDescGZIP(), []int{50}
 }
 
 func (x *ExposeServiceRequest) GetPort() uint32 {
@@ -4400,7 +4455,7 @@ type ExposeServiceResponse struct {
 func (x *ExposeServiceResponse) Reset() {
 	*x = ExposeServiceResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[50]
+		mi := &file_management_proto_msgTypes[51]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4413,7 +4468,7 @@ func (x *ExposeServiceResponse) String() string {
 func (*ExposeServiceResponse) ProtoMessage() {}
 
 func (x *ExposeServiceResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[50]
+	mi := &file_management_proto_msgTypes[51]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4426,7 +4481,7 @@ func (x *ExposeServiceResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ExposeServiceResponse.ProtoReflect.Descriptor instead.
 func (*ExposeServiceResponse) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{50}
+	return file_management_proto_rawDescGZIP(), []int{51}
 }
 
 func (x *ExposeServiceResponse) GetServiceName() string {
@@ -4468,7 +4523,7 @@ type RenewExposeRequest struct {
 func (x *RenewExposeRequest) Reset() {
 	*x = RenewExposeRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[51]
+		mi := &file_management_proto_msgTypes[52]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4481,7 +4536,7 @@ func (x *RenewExposeRequest) String() string {
 func (*RenewExposeRequest) ProtoMessage() {}
 
 func (x *RenewExposeRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[51]
+	mi := &file_management_proto_msgTypes[52]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4494,7 +4549,7 @@ func (x *RenewExposeRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RenewExposeRequest.ProtoReflect.Descriptor instead.
 func (*RenewExposeRequest) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{51}
+	return file_management_proto_rawDescGZIP(), []int{52}
 }
 
 func (x *RenewExposeRequest) GetDomain() string {
@@ -4513,7 +4568,7 @@ type RenewExposeResponse struct {
 func (x *RenewExposeResponse) Reset() {
 	*x = RenewExposeResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[52]
+		mi := &file_management_proto_msgTypes[53]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4526,7 +4581,7 @@ func (x *RenewExposeResponse) String() string {
 func (*RenewExposeResponse) ProtoMessage() {}
 
 func (x *RenewExposeResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[52]
+	mi := &file_management_proto_msgTypes[53]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4539,7 +4594,7 @@ func (x *RenewExposeResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RenewExposeResponse.ProtoReflect.Descriptor instead.
 func (*RenewExposeResponse) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{52}
+	return file_management_proto_rawDescGZIP(), []int{53}
 }
 
 type StopExposeRequest struct {
@@ -4553,7 +4608,7 @@ type StopExposeRequest struct {
 func (x *StopExposeRequest) Reset() {
 	*x = StopExposeRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[53]
+		mi := &file_management_proto_msgTypes[54]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4566,7 +4621,7 @@ func (x *StopExposeRequest) String() string {
 func (*StopExposeRequest) ProtoMessage() {}
 
 func (x *StopExposeRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[53]
+	mi := &file_management_proto_msgTypes[54]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4579,7 +4634,7 @@ func (x *StopExposeRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StopExposeRequest.ProtoReflect.Descriptor instead.
 func (*StopExposeRequest) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{53}
+	return file_management_proto_rawDescGZIP(), []int{54}
 }
 
 func (x *StopExposeRequest) GetDomain() string {
@@ -4598,7 +4653,7 @@ type StopExposeResponse struct {
 func (x *StopExposeResponse) Reset() {
 	*x = StopExposeResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[54]
+		mi := &file_management_proto_msgTypes[55]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4611,7 +4666,7 @@ func (x *StopExposeResponse) String() string {
 func (*StopExposeResponse) ProtoMessage() {}
 
 func (x *StopExposeResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[54]
+	mi := &file_management_proto_msgTypes[55]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4624,7 +4679,7 @@ func (x *StopExposeResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StopExposeResponse.ProtoReflect.Descriptor instead.
 func (*StopExposeResponse) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{54}
+	return file_management_proto_rawDescGZIP(), []int{55}
 }
 
 type PortInfo_Range struct {
@@ -4639,7 +4694,7 @@ type PortInfo_Range struct {
 func (x *PortInfo_Range) Reset() {
 	*x = PortInfo_Range{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[56]
+		mi := &file_management_proto_msgTypes[57]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4652,7 +4707,7 @@ func (x *PortInfo_Range) String() string {
 func (*PortInfo_Range) ProtoMessage() {}
 
 func (x *PortInfo_Range) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[56]
+	mi := &file_management_proto_msgTypes[57]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4665,7 +4720,7 @@ func (x *PortInfo_Range) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PortInfo_Range.ProtoReflect.Descriptor instead.
 func (*PortInfo_Range) Descriptor() ([]byte, []int) {
-	return file_management_proto_rawDescGZIP(), []int{46, 0}
+	return file_management_proto_rawDescGZIP(), []int{47, 0}
 }
 
 func (x *PortInfo_Range) GetStart() uint32 {
@@ -4915,7 +4970,7 @@ var file_management_proto_rawDesc = []byte{
 	0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x65, 0x78, 0x70, 0x69, 0x72,
 	0x65, 0x73, 0x41, 0x74, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18,
 	0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x07,
-	0x0a, 0x05, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0xff, 0x01, 0x0a, 0x0d, 0x4e, 0x65, 0x74, 0x62,
+	0x0a, 0x05, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0xb4, 0x02, 0x0a, 0x0d, 0x4e, 0x65, 0x74, 0x62,
 	0x69, 0x72, 0x64, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x2c, 0x0a, 0x05, 0x73, 0x74, 0x75,
 	0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
 	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x48, 0x6f, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
@@ -4931,43 +4986,49 @@ var file_management_proto_rawDesc = []byte{
 	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x05, 0x72, 0x65, 0x6c, 0x61, 0x79, 0x12, 0x2a, 0x0a,
 	0x04, 0x66, 0x6c, 0x6f, 0x77, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x6d, 0x61,
 	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x46, 0x6c, 0x6f, 0x77, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x52, 0x04, 0x66, 0x6c, 0x6f, 0x77, 0x22, 0x98, 0x01, 0x0a, 0x0a, 0x48, 0x6f,
-	0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x69, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x69, 0x12, 0x3b, 0x0a, 0x08, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1f, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x48, 0x6f, 0x73, 0x74, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x2e, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x22, 0x3b, 0x0a, 0x08, 0x50, 0x72, 0x6f, 0x74, 0x6f,
-	0x63, 0x6f, 0x6c, 0x12, 0x07, 0x0a, 0x03, 0x55, 0x44, 0x50, 0x10, 0x00, 0x12, 0x07, 0x0a, 0x03,
-	0x54, 0x43, 0x50, 0x10, 0x01, 0x12, 0x08, 0x0a, 0x04, 0x48, 0x54, 0x54, 0x50, 0x10, 0x02, 0x12,
-	0x09, 0x0a, 0x05, 0x48, 0x54, 0x54, 0x50, 0x53, 0x10, 0x03, 0x12, 0x08, 0x0a, 0x04, 0x44, 0x54,
-	0x4c, 0x53, 0x10, 0x04, 0x22, 0x6d, 0x0a, 0x0b, 0x52, 0x65, 0x6c, 0x61, 0x79, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x75, 0x72, 0x6c, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28,
-	0x09, 0x52, 0x04, 0x75, 0x72, 0x6c, 0x73, 0x12, 0x22, 0x0a, 0x0c, 0x74, 0x6f, 0x6b, 0x65, 0x6e,
-	0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x74,
-	0x6f, 0x6b, 0x65, 0x6e, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x26, 0x0a, 0x0e, 0x74,
-	0x6f, 0x6b, 0x65, 0x6e, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x0e, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74,
-	0x75, 0x72, 0x65, 0x22, 0xad, 0x02, 0x0a, 0x0a, 0x46, 0x6c, 0x6f, 0x77, 0x43, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x03, 0x75, 0x72, 0x6c, 0x12, 0x22, 0x0a, 0x0c, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x50, 0x61, 0x79,
-	0x6c, 0x6f, 0x61, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x74, 0x6f, 0x6b, 0x65,
-	0x6e, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x26, 0x0a, 0x0e, 0x74, 0x6f, 0x6b, 0x65,
-	0x6e, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x0e, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65,
-	0x12, 0x35, 0x0a, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x18, 0x04, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x08, 0x69,
-	0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c,
-	0x65, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65,
-	0x64, 0x12, 0x1a, 0x0a, 0x08, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x65, 0x72, 0x73, 0x18, 0x06, 0x20,
-	0x01, 0x28, 0x08, 0x52, 0x08, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x65, 0x72, 0x73, 0x12, 0x2e, 0x0a,
-	0x12, 0x65, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x65, 0x78, 0x69, 0x74, 0x4e,
-	0x6f, 0x64, 0x65, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x24, 0x0a,
-	0x0d, 0x64, 0x6e, 0x73, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x08,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x64, 0x6e, 0x73, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74,
-	0x69, 0x6f, 0x6e, 0x22, 0xa3, 0x01, 0x0a, 0x09, 0x4a, 0x57, 0x54, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x66, 0x69, 0x67, 0x52, 0x04, 0x66, 0x6c, 0x6f, 0x77, 0x12, 0x33, 0x0a, 0x07, 0x6d, 0x65, 0x74,
+	0x72, 0x69, 0x63, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x73, 0x43,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x07, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x73, 0x22, 0x98,
+	0x01, 0x0a, 0x0a, 0x48, 0x6f, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x10, 0x0a,
+	0x03, 0x75, 0x72, 0x69, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x69, 0x12,
+	0x3b, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x0e, 0x32, 0x1f, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x48,
+	0x6f, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63,
+	0x6f, 0x6c, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x22, 0x3b, 0x0a, 0x08,
+	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x07, 0x0a, 0x03, 0x55, 0x44, 0x50, 0x10,
+	0x00, 0x12, 0x07, 0x0a, 0x03, 0x54, 0x43, 0x50, 0x10, 0x01, 0x12, 0x08, 0x0a, 0x04, 0x48, 0x54,
+	0x54, 0x50, 0x10, 0x02, 0x12, 0x09, 0x0a, 0x05, 0x48, 0x54, 0x54, 0x50, 0x53, 0x10, 0x03, 0x12,
+	0x08, 0x0a, 0x04, 0x44, 0x54, 0x4c, 0x53, 0x10, 0x04, 0x22, 0x6d, 0x0a, 0x0b, 0x52, 0x65, 0x6c,
+	0x61, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x75, 0x72, 0x6c, 0x73,
+	0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x04, 0x75, 0x72, 0x6c, 0x73, 0x12, 0x22, 0x0a, 0x0c,
+	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0c, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64,
+	0x12, 0x26, 0x0a, 0x0e, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75,
+	0x72, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x53,
+	0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x22, 0xad, 0x02, 0x0a, 0x0a, 0x46, 0x6c, 0x6f,
+	0x77, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x12, 0x22, 0x0a, 0x0c, 0x74, 0x6f, 0x6b,
+	0x65, 0x6e, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x0c, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x26, 0x0a,
+	0x0e, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x74, 0x75, 0x72, 0x65, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x53, 0x69, 0x67, 0x6e,
+	0x61, 0x74, 0x75, 0x72, 0x65, 0x12, 0x35, 0x0a, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61,
+	0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x52, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x12, 0x18, 0x0a, 0x07,
+	0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65,
+	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x65,
+	0x72, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x65,
+	0x72, 0x73, 0x12, 0x2e, 0x0a, 0x12, 0x65, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6f,
+	0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12,
+	0x65, 0x78, 0x69, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x12, 0x24, 0x0a, 0x0d, 0x64, 0x6e, 0x73, 0x43, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x64, 0x6e, 0x73, 0x43, 0x6f,
+	0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x29, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x72,
+	0x69, 0x63, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61,
+	0x62, 0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62,
+	0x6c, 0x65, 0x64, 0x22, 0xa3, 0x01, 0x0a, 0x09, 0x4a, 0x57, 0x54, 0x43, 0x6f, 0x6e, 0x66, 0x69,
 	0x67, 0x12, 0x16, 0x0a, 0x06, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28,
 	0x09, 0x52, 0x06, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72, 0x12, 0x1a, 0x0a, 0x08, 0x61, 0x75, 0x64,
 	0x69, 0x65, 0x6e, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x61, 0x75, 0x64,
@@ -5435,7 +5496,7 @@ func file_management_proto_rawDescGZIP() []byte {
 }
 
 var file_management_proto_enumTypes = make([]protoimpl.EnumInfo, 8)
-var file_management_proto_msgTypes = make([]protoimpl.MessageInfo, 57)
+var file_management_proto_msgTypes = make([]protoimpl.MessageInfo, 58)
 var file_management_proto_goTypes = []interface{}{
 	(JobStatus)(0),                         // 0: management.JobStatus
 	(PeerCapability)(0),                    // 1: management.PeerCapability
@@ -5468,42 +5529,43 @@ var file_management_proto_goTypes = []interface{}{
 	(*HostConfig)(nil),                     // 28: management.HostConfig
 	(*RelayConfig)(nil),                    // 29: management.RelayConfig
 	(*FlowConfig)(nil),                     // 30: management.FlowConfig
-	(*JWTConfig)(nil),                      // 31: management.JWTConfig
-	(*ProtectedHostConfig)(nil),            // 32: management.ProtectedHostConfig
-	(*PeerConfig)(nil),                     // 33: management.PeerConfig
-	(*AutoUpdateSettings)(nil),             // 34: management.AutoUpdateSettings
-	(*NetworkMap)(nil),                     // 35: management.NetworkMap
-	(*SSHAuth)(nil),                        // 36: management.SSHAuth
-	(*MachineUserIndexes)(nil),             // 37: management.MachineUserIndexes
-	(*RemotePeerConfig)(nil),               // 38: management.RemotePeerConfig
-	(*SSHConfig)(nil),                      // 39: management.SSHConfig
-	(*DeviceAuthorizationFlowRequest)(nil), // 40: management.DeviceAuthorizationFlowRequest
-	(*DeviceAuthorizationFlow)(nil),        // 41: management.DeviceAuthorizationFlow
-	(*PKCEAuthorizationFlowRequest)(nil),   // 42: management.PKCEAuthorizationFlowRequest
-	(*PKCEAuthorizationFlow)(nil),          // 43: management.PKCEAuthorizationFlow
-	(*ProviderConfig)(nil),                 // 44: management.ProviderConfig
-	(*Route)(nil),                          // 45: management.Route
-	(*DNSConfig)(nil),                      // 46: management.DNSConfig
-	(*CustomZone)(nil),                     // 47: management.CustomZone
-	(*SimpleRecord)(nil),                   // 48: management.SimpleRecord
-	(*NameServerGroup)(nil),                // 49: management.NameServerGroup
-	(*NameServer)(nil),                     // 50: management.NameServer
-	(*FirewallRule)(nil),                   // 51: management.FirewallRule
-	(*NetworkAddress)(nil),                 // 52: management.NetworkAddress
-	(*Checks)(nil),                         // 53: management.Checks
-	(*PortInfo)(nil),                       // 54: management.PortInfo
-	(*RouteFirewallRule)(nil),              // 55: management.RouteFirewallRule
-	(*ForwardingRule)(nil),                 // 56: management.ForwardingRule
-	(*ExposeServiceRequest)(nil),           // 57: management.ExposeServiceRequest
-	(*ExposeServiceResponse)(nil),          // 58: management.ExposeServiceResponse
-	(*RenewExposeRequest)(nil),             // 59: management.RenewExposeRequest
-	(*RenewExposeResponse)(nil),            // 60: management.RenewExposeResponse
-	(*StopExposeRequest)(nil),              // 61: management.StopExposeRequest
-	(*StopExposeResponse)(nil),             // 62: management.StopExposeResponse
-	nil,                                    // 63: management.SSHAuth.MachineUsersEntry
-	(*PortInfo_Range)(nil),                 // 64: management.PortInfo.Range
-	(*timestamppb.Timestamp)(nil),          // 65: google.protobuf.Timestamp
-	(*durationpb.Duration)(nil),            // 66: google.protobuf.Duration
+	(*MetricsConfig)(nil),                  // 31: management.MetricsConfig
+	(*JWTConfig)(nil),                      // 32: management.JWTConfig
+	(*ProtectedHostConfig)(nil),            // 33: management.ProtectedHostConfig
+	(*PeerConfig)(nil),                     // 34: management.PeerConfig
+	(*AutoUpdateSettings)(nil),             // 35: management.AutoUpdateSettings
+	(*NetworkMap)(nil),                     // 36: management.NetworkMap
+	(*SSHAuth)(nil),                        // 37: management.SSHAuth
+	(*MachineUserIndexes)(nil),             // 38: management.MachineUserIndexes
+	(*RemotePeerConfig)(nil),               // 39: management.RemotePeerConfig
+	(*SSHConfig)(nil),                      // 40: management.SSHConfig
+	(*DeviceAuthorizationFlowRequest)(nil), // 41: management.DeviceAuthorizationFlowRequest
+	(*DeviceAuthorizationFlow)(nil),        // 42: management.DeviceAuthorizationFlow
+	(*PKCEAuthorizationFlowRequest)(nil),   // 43: management.PKCEAuthorizationFlowRequest
+	(*PKCEAuthorizationFlow)(nil),          // 44: management.PKCEAuthorizationFlow
+	(*ProviderConfig)(nil),                 // 45: management.ProviderConfig
+	(*Route)(nil),                          // 46: management.Route
+	(*DNSConfig)(nil),                      // 47: management.DNSConfig
+	(*CustomZone)(nil),                     // 48: management.CustomZone
+	(*SimpleRecord)(nil),                   // 49: management.SimpleRecord
+	(*NameServerGroup)(nil),                // 50: management.NameServerGroup
+	(*NameServer)(nil),                     // 51: management.NameServer
+	(*FirewallRule)(nil),                   // 52: management.FirewallRule
+	(*NetworkAddress)(nil),                 // 53: management.NetworkAddress
+	(*Checks)(nil),                         // 54: management.Checks
+	(*PortInfo)(nil),                       // 55: management.PortInfo
+	(*RouteFirewallRule)(nil),              // 56: management.RouteFirewallRule
+	(*ForwardingRule)(nil),                 // 57: management.ForwardingRule
+	(*ExposeServiceRequest)(nil),           // 58: management.ExposeServiceRequest
+	(*ExposeServiceResponse)(nil),          // 59: management.ExposeServiceResponse
+	(*RenewExposeRequest)(nil),             // 60: management.RenewExposeRequest
+	(*RenewExposeResponse)(nil),            // 61: management.RenewExposeResponse
+	(*StopExposeRequest)(nil),              // 62: management.StopExposeRequest
+	(*StopExposeResponse)(nil),             // 63: management.StopExposeResponse
+	nil,                                    // 64: management.SSHAuth.MachineUsersEntry
+	(*PortInfo_Range)(nil),                 // 65: management.PortInfo.Range
+	(*timestamppb.Timestamp)(nil),          // 66: google.protobuf.Timestamp
+	(*durationpb.Duration)(nil),            // 67: google.protobuf.Duration
 }
 var file_management_proto_depIdxs = []int32{
 	11, // 0: management.JobRequest.bundle:type_name -> management.BundleParameters
@@ -5511,99 +5573,100 @@ var file_management_proto_depIdxs = []int32{
 	12, // 2: management.JobResponse.bundle:type_name -> management.BundleResult
 	21, // 3: management.SyncRequest.meta:type_name -> management.PeerSystemMeta
 	27, // 4: management.SyncResponse.netbirdConfig:type_name -> management.NetbirdConfig
-	33, // 5: management.SyncResponse.peerConfig:type_name -> management.PeerConfig
-	38, // 6: management.SyncResponse.remotePeers:type_name -> management.RemotePeerConfig
-	35, // 7: management.SyncResponse.NetworkMap:type_name -> management.NetworkMap
-	53, // 8: management.SyncResponse.Checks:type_name -> management.Checks
-	65, // 9: management.SyncResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
+	34, // 5: management.SyncResponse.peerConfig:type_name -> management.PeerConfig
+	39, // 6: management.SyncResponse.remotePeers:type_name -> management.RemotePeerConfig
+	36, // 7: management.SyncResponse.NetworkMap:type_name -> management.NetworkMap
+	54, // 8: management.SyncResponse.Checks:type_name -> management.Checks
+	66, // 9: management.SyncResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
 	21, // 10: management.SyncMetaRequest.meta:type_name -> management.PeerSystemMeta
 	21, // 11: management.LoginRequest.meta:type_name -> management.PeerSystemMeta
 	17, // 12: management.LoginRequest.peerKeys:type_name -> management.PeerKeys
-	52, // 13: management.PeerSystemMeta.networkAddresses:type_name -> management.NetworkAddress
+	53, // 13: management.PeerSystemMeta.networkAddresses:type_name -> management.NetworkAddress
 	18, // 14: management.PeerSystemMeta.environment:type_name -> management.Environment
 	19, // 15: management.PeerSystemMeta.files:type_name -> management.File
 	20, // 16: management.PeerSystemMeta.flags:type_name -> management.Flags
 	1,  // 17: management.PeerSystemMeta.capabilities:type_name -> management.PeerCapability
 	27, // 18: management.LoginResponse.netbirdConfig:type_name -> management.NetbirdConfig
-	33, // 19: management.LoginResponse.peerConfig:type_name -> management.PeerConfig
-	53, // 20: management.LoginResponse.Checks:type_name -> management.Checks
-	65, // 21: management.LoginResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
+	34, // 19: management.LoginResponse.peerConfig:type_name -> management.PeerConfig
+	54, // 20: management.LoginResponse.Checks:type_name -> management.Checks
+	66, // 21: management.LoginResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
 	21, // 22: management.ExtendAuthSessionRequest.meta:type_name -> management.PeerSystemMeta
-	65, // 23: management.ExtendAuthSessionResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
-	65, // 24: management.ServerKeyResponse.expiresAt:type_name -> google.protobuf.Timestamp
+	66, // 23: management.ExtendAuthSessionResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
+	66, // 24: management.ServerKeyResponse.expiresAt:type_name -> google.protobuf.Timestamp
 	28, // 25: management.NetbirdConfig.stuns:type_name -> management.HostConfig
-	32, // 26: management.NetbirdConfig.turns:type_name -> management.ProtectedHostConfig
+	33, // 26: management.NetbirdConfig.turns:type_name -> management.ProtectedHostConfig
 	28, // 27: management.NetbirdConfig.signal:type_name -> management.HostConfig
 	29, // 28: management.NetbirdConfig.relay:type_name -> management.RelayConfig
 	30, // 29: management.NetbirdConfig.flow:type_name -> management.FlowConfig
-	6,  // 30: management.HostConfig.protocol:type_name -> management.HostConfig.Protocol
-	66, // 31: management.FlowConfig.interval:type_name -> google.protobuf.Duration
-	28, // 32: management.ProtectedHostConfig.hostConfig:type_name -> management.HostConfig
-	39, // 33: management.PeerConfig.sshConfig:type_name -> management.SSHConfig
-	34, // 34: management.PeerConfig.autoUpdate:type_name -> management.AutoUpdateSettings
-	33, // 35: management.NetworkMap.peerConfig:type_name -> management.PeerConfig
-	38, // 36: management.NetworkMap.remotePeers:type_name -> management.RemotePeerConfig
-	45, // 37: management.NetworkMap.Routes:type_name -> management.Route
-	46, // 38: management.NetworkMap.DNSConfig:type_name -> management.DNSConfig
-	38, // 39: management.NetworkMap.offlinePeers:type_name -> management.RemotePeerConfig
-	51, // 40: management.NetworkMap.FirewallRules:type_name -> management.FirewallRule
-	55, // 41: management.NetworkMap.routesFirewallRules:type_name -> management.RouteFirewallRule
-	56, // 42: management.NetworkMap.forwardingRules:type_name -> management.ForwardingRule
-	36, // 43: management.NetworkMap.sshAuth:type_name -> management.SSHAuth
-	63, // 44: management.SSHAuth.machine_users:type_name -> management.SSHAuth.MachineUsersEntry
-	39, // 45: management.RemotePeerConfig.sshConfig:type_name -> management.SSHConfig
-	31, // 46: management.SSHConfig.jwtConfig:type_name -> management.JWTConfig
-	7,  // 47: management.DeviceAuthorizationFlow.Provider:type_name -> management.DeviceAuthorizationFlow.provider
-	44, // 48: management.DeviceAuthorizationFlow.ProviderConfig:type_name -> management.ProviderConfig
-	44, // 49: management.PKCEAuthorizationFlow.ProviderConfig:type_name -> management.ProviderConfig
-	49, // 50: management.DNSConfig.NameServerGroups:type_name -> management.NameServerGroup
-	47, // 51: management.DNSConfig.CustomZones:type_name -> management.CustomZone
-	48, // 52: management.CustomZone.Records:type_name -> management.SimpleRecord
-	50, // 53: management.NameServerGroup.NameServers:type_name -> management.NameServer
-	3,  // 54: management.FirewallRule.Direction:type_name -> management.RuleDirection
-	4,  // 55: management.FirewallRule.Action:type_name -> management.RuleAction
-	2,  // 56: management.FirewallRule.Protocol:type_name -> management.RuleProtocol
-	54, // 57: management.FirewallRule.PortInfo:type_name -> management.PortInfo
-	64, // 58: management.PortInfo.range:type_name -> management.PortInfo.Range
-	4,  // 59: management.RouteFirewallRule.action:type_name -> management.RuleAction
-	2,  // 60: management.RouteFirewallRule.protocol:type_name -> management.RuleProtocol
-	54, // 61: management.RouteFirewallRule.portInfo:type_name -> management.PortInfo
-	2,  // 62: management.ForwardingRule.protocol:type_name -> management.RuleProtocol
-	54, // 63: management.ForwardingRule.destinationPort:type_name -> management.PortInfo
-	54, // 64: management.ForwardingRule.translatedPort:type_name -> management.PortInfo
-	5,  // 65: management.ExposeServiceRequest.protocol:type_name -> management.ExposeProtocol
-	37, // 66: management.SSHAuth.MachineUsersEntry.value:type_name -> management.MachineUserIndexes
-	8,  // 67: management.ManagementService.Login:input_type -> management.EncryptedMessage
-	8,  // 68: management.ManagementService.Sync:input_type -> management.EncryptedMessage
-	26, // 69: management.ManagementService.GetServerKey:input_type -> management.Empty
-	26, // 70: management.ManagementService.isHealthy:input_type -> management.Empty
-	8,  // 71: management.ManagementService.GetDeviceAuthorizationFlow:input_type -> management.EncryptedMessage
-	8,  // 72: management.ManagementService.GetPKCEAuthorizationFlow:input_type -> management.EncryptedMessage
-	8,  // 73: management.ManagementService.SyncMeta:input_type -> management.EncryptedMessage
-	8,  // 74: management.ManagementService.Logout:input_type -> management.EncryptedMessage
-	8,  // 75: management.ManagementService.Job:input_type -> management.EncryptedMessage
-	8,  // 76: management.ManagementService.ExtendAuthSession:input_type -> management.EncryptedMessage
-	8,  // 77: management.ManagementService.CreateExpose:input_type -> management.EncryptedMessage
-	8,  // 78: management.ManagementService.RenewExpose:input_type -> management.EncryptedMessage
-	8,  // 79: management.ManagementService.StopExpose:input_type -> management.EncryptedMessage
-	8,  // 80: management.ManagementService.Login:output_type -> management.EncryptedMessage
-	8,  // 81: management.ManagementService.Sync:output_type -> management.EncryptedMessage
-	25, // 82: management.ManagementService.GetServerKey:output_type -> management.ServerKeyResponse
-	26, // 83: management.ManagementService.isHealthy:output_type -> management.Empty
-	8,  // 84: management.ManagementService.GetDeviceAuthorizationFlow:output_type -> management.EncryptedMessage
-	8,  // 85: management.ManagementService.GetPKCEAuthorizationFlow:output_type -> management.EncryptedMessage
-	26, // 86: management.ManagementService.SyncMeta:output_type -> management.Empty
-	26, // 87: management.ManagementService.Logout:output_type -> management.Empty
-	8,  // 88: management.ManagementService.Job:output_type -> management.EncryptedMessage
-	8,  // 89: management.ManagementService.ExtendAuthSession:output_type -> management.EncryptedMessage
-	8,  // 90: management.ManagementService.CreateExpose:output_type -> management.EncryptedMessage
-	8,  // 91: management.ManagementService.RenewExpose:output_type -> management.EncryptedMessage
-	8,  // 92: management.ManagementService.StopExpose:output_type -> management.EncryptedMessage
-	80, // [80:93] is the sub-list for method output_type
-	67, // [67:80] is the sub-list for method input_type
-	67, // [67:67] is the sub-list for extension type_name
-	67, // [67:67] is the sub-list for extension extendee
-	0,  // [0:67] is the sub-list for field type_name
+	31, // 30: management.NetbirdConfig.metrics:type_name -> management.MetricsConfig
+	6,  // 31: management.HostConfig.protocol:type_name -> management.HostConfig.Protocol
+	67, // 32: management.FlowConfig.interval:type_name -> google.protobuf.Duration
+	28, // 33: management.ProtectedHostConfig.hostConfig:type_name -> management.HostConfig
+	40, // 34: management.PeerConfig.sshConfig:type_name -> management.SSHConfig
+	35, // 35: management.PeerConfig.autoUpdate:type_name -> management.AutoUpdateSettings
+	34, // 36: management.NetworkMap.peerConfig:type_name -> management.PeerConfig
+	39, // 37: management.NetworkMap.remotePeers:type_name -> management.RemotePeerConfig
+	46, // 38: management.NetworkMap.Routes:type_name -> management.Route
+	47, // 39: management.NetworkMap.DNSConfig:type_name -> management.DNSConfig
+	39, // 40: management.NetworkMap.offlinePeers:type_name -> management.RemotePeerConfig
+	52, // 41: management.NetworkMap.FirewallRules:type_name -> management.FirewallRule
+	56, // 42: management.NetworkMap.routesFirewallRules:type_name -> management.RouteFirewallRule
+	57, // 43: management.NetworkMap.forwardingRules:type_name -> management.ForwardingRule
+	37, // 44: management.NetworkMap.sshAuth:type_name -> management.SSHAuth
+	64, // 45: management.SSHAuth.machine_users:type_name -> management.SSHAuth.MachineUsersEntry
+	40, // 46: management.RemotePeerConfig.sshConfig:type_name -> management.SSHConfig
+	32, // 47: management.SSHConfig.jwtConfig:type_name -> management.JWTConfig
+	7,  // 48: management.DeviceAuthorizationFlow.Provider:type_name -> management.DeviceAuthorizationFlow.provider
+	45, // 49: management.DeviceAuthorizationFlow.ProviderConfig:type_name -> management.ProviderConfig
+	45, // 50: management.PKCEAuthorizationFlow.ProviderConfig:type_name -> management.ProviderConfig
+	50, // 51: management.DNSConfig.NameServerGroups:type_name -> management.NameServerGroup
+	48, // 52: management.DNSConfig.CustomZones:type_name -> management.CustomZone
+	49, // 53: management.CustomZone.Records:type_name -> management.SimpleRecord
+	51, // 54: management.NameServerGroup.NameServers:type_name -> management.NameServer
+	3,  // 55: management.FirewallRule.Direction:type_name -> management.RuleDirection
+	4,  // 56: management.FirewallRule.Action:type_name -> management.RuleAction
+	2,  // 57: management.FirewallRule.Protocol:type_name -> management.RuleProtocol
+	55, // 58: management.FirewallRule.PortInfo:type_name -> management.PortInfo
+	65, // 59: management.PortInfo.range:type_name -> management.PortInfo.Range
+	4,  // 60: management.RouteFirewallRule.action:type_name -> management.RuleAction
+	2,  // 61: management.RouteFirewallRule.protocol:type_name -> management.RuleProtocol
+	55, // 62: management.RouteFirewallRule.portInfo:type_name -> management.PortInfo
+	2,  // 63: management.ForwardingRule.protocol:type_name -> management.RuleProtocol
+	55, // 64: management.ForwardingRule.destinationPort:type_name -> management.PortInfo
+	55, // 65: management.ForwardingRule.translatedPort:type_name -> management.PortInfo
+	5,  // 66: management.ExposeServiceRequest.protocol:type_name -> management.ExposeProtocol
+	38, // 67: management.SSHAuth.MachineUsersEntry.value:type_name -> management.MachineUserIndexes
+	8,  // 68: management.ManagementService.Login:input_type -> management.EncryptedMessage
+	8,  // 69: management.ManagementService.Sync:input_type -> management.EncryptedMessage
+	26, // 70: management.ManagementService.GetServerKey:input_type -> management.Empty
+	26, // 71: management.ManagementService.isHealthy:input_type -> management.Empty
+	8,  // 72: management.ManagementService.GetDeviceAuthorizationFlow:input_type -> management.EncryptedMessage
+	8,  // 73: management.ManagementService.GetPKCEAuthorizationFlow:input_type -> management.EncryptedMessage
+	8,  // 74: management.ManagementService.SyncMeta:input_type -> management.EncryptedMessage
+	8,  // 75: management.ManagementService.Logout:input_type -> management.EncryptedMessage
+	8,  // 76: management.ManagementService.Job:input_type -> management.EncryptedMessage
+	8,  // 77: management.ManagementService.ExtendAuthSession:input_type -> management.EncryptedMessage
+	8,  // 78: management.ManagementService.CreateExpose:input_type -> management.EncryptedMessage
+	8,  // 79: management.ManagementService.RenewExpose:input_type -> management.EncryptedMessage
+	8,  // 80: management.ManagementService.StopExpose:input_type -> management.EncryptedMessage
+	8,  // 81: management.ManagementService.Login:output_type -> management.EncryptedMessage
+	8,  // 82: management.ManagementService.Sync:output_type -> management.EncryptedMessage
+	25, // 83: management.ManagementService.GetServerKey:output_type -> management.ServerKeyResponse
+	26, // 84: management.ManagementService.isHealthy:output_type -> management.Empty
+	8,  // 85: management.ManagementService.GetDeviceAuthorizationFlow:output_type -> management.EncryptedMessage
+	8,  // 86: management.ManagementService.GetPKCEAuthorizationFlow:output_type -> management.EncryptedMessage
+	26, // 87: management.ManagementService.SyncMeta:output_type -> management.Empty
+	26, // 88: management.ManagementService.Logout:output_type -> management.Empty
+	8,  // 89: management.ManagementService.Job:output_type -> management.EncryptedMessage
+	8,  // 90: management.ManagementService.ExtendAuthSession:output_type -> management.EncryptedMessage
+	8,  // 91: management.ManagementService.CreateExpose:output_type -> management.EncryptedMessage
+	8,  // 92: management.ManagementService.RenewExpose:output_type -> management.EncryptedMessage
+	8,  // 93: management.ManagementService.StopExpose:output_type -> management.EncryptedMessage
+	81, // [81:94] is the sub-list for method output_type
+	68, // [68:81] is the sub-list for method input_type
+	68, // [68:68] is the sub-list for extension type_name
+	68, // [68:68] is the sub-list for extension extendee
+	0,  // [0:68] is the sub-list for field type_name
 }
 
 func init() { file_management_proto_init() }
@@ -5889,7 +5952,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[23].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*JWTConfig); i {
+			switch v := v.(*MetricsConfig); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5901,7 +5964,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[24].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ProtectedHostConfig); i {
+			switch v := v.(*JWTConfig); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5913,7 +5976,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[25].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PeerConfig); i {
+			switch v := v.(*ProtectedHostConfig); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5925,7 +5988,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[26].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AutoUpdateSettings); i {
+			switch v := v.(*PeerConfig); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5937,7 +6000,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[27].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*NetworkMap); i {
+			switch v := v.(*AutoUpdateSettings); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5949,7 +6012,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[28].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SSHAuth); i {
+			switch v := v.(*NetworkMap); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5961,7 +6024,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[29].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*MachineUserIndexes); i {
+			switch v := v.(*SSHAuth); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5973,7 +6036,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[30].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RemotePeerConfig); i {
+			switch v := v.(*MachineUserIndexes); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5985,7 +6048,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[31].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SSHConfig); i {
+			switch v := v.(*RemotePeerConfig); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -5997,7 +6060,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[32].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DeviceAuthorizationFlowRequest); i {
+			switch v := v.(*SSHConfig); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6009,7 +6072,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[33].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DeviceAuthorizationFlow); i {
+			switch v := v.(*DeviceAuthorizationFlowRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6021,7 +6084,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[34].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PKCEAuthorizationFlowRequest); i {
+			switch v := v.(*DeviceAuthorizationFlow); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6033,7 +6096,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[35].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PKCEAuthorizationFlow); i {
+			switch v := v.(*PKCEAuthorizationFlowRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6045,7 +6108,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[36].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ProviderConfig); i {
+			switch v := v.(*PKCEAuthorizationFlow); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6057,7 +6120,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[37].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Route); i {
+			switch v := v.(*ProviderConfig); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6069,7 +6132,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[38].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DNSConfig); i {
+			switch v := v.(*Route); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6081,7 +6144,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[39].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CustomZone); i {
+			switch v := v.(*DNSConfig); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6093,7 +6156,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[40].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SimpleRecord); i {
+			switch v := v.(*CustomZone); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6105,7 +6168,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[41].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*NameServerGroup); i {
+			switch v := v.(*SimpleRecord); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6117,7 +6180,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[42].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*NameServer); i {
+			switch v := v.(*NameServerGroup); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6129,7 +6192,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[43].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*FirewallRule); i {
+			switch v := v.(*NameServer); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6141,7 +6204,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[44].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*NetworkAddress); i {
+			switch v := v.(*FirewallRule); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6153,7 +6216,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[45].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Checks); i {
+			switch v := v.(*NetworkAddress); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6165,7 +6228,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[46].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*PortInfo); i {
+			switch v := v.(*Checks); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6177,7 +6240,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[47].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RouteFirewallRule); i {
+			switch v := v.(*PortInfo); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6189,7 +6252,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[48].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ForwardingRule); i {
+			switch v := v.(*RouteFirewallRule); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6201,7 +6264,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[49].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ExposeServiceRequest); i {
+			switch v := v.(*ForwardingRule); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6213,7 +6276,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[50].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ExposeServiceResponse); i {
+			switch v := v.(*ExposeServiceRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6225,7 +6288,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[51].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RenewExposeRequest); i {
+			switch v := v.(*ExposeServiceResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6237,7 +6300,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[52].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RenewExposeResponse); i {
+			switch v := v.(*RenewExposeRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6249,7 +6312,7 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[53].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*StopExposeRequest); i {
+			switch v := v.(*RenewExposeResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -6261,6 +6324,18 @@ func file_management_proto_init() {
 			}
 		}
 		file_management_proto_msgTypes[54].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*StopExposeRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[55].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*StopExposeResponse); i {
 			case 0:
 				return &v.state
@@ -6272,7 +6347,7 @@ func file_management_proto_init() {
 				return nil
 			}
 		}
-		file_management_proto_msgTypes[56].Exporter = func(v interface{}, i int) interface{} {
+		file_management_proto_msgTypes[57].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*PortInfo_Range); i {
 			case 0:
 				return &v.state
@@ -6291,7 +6366,7 @@ func file_management_proto_init() {
 	file_management_proto_msgTypes[2].OneofWrappers = []interface{}{
 		(*JobResponse_Bundle)(nil),
 	}
-	file_management_proto_msgTypes[46].OneofWrappers = []interface{}{
+	file_management_proto_msgTypes[47].OneofWrappers = []interface{}{
 		(*PortInfo_Port)(nil),
 		(*PortInfo_Range_)(nil),
 	}
@@ -6301,7 +6376,7 @@ func file_management_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_management_proto_rawDesc,
 			NumEnums:      8,
-			NumMessages:   57,
+			NumMessages:   58,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/shared/management/proto/management.proto b/shared/management/proto/management.proto
index 990a72a63..6b41a78d0 100644
--- a/shared/management/proto/management.proto
+++ b/shared/management/proto/management.proto
@@ -312,6 +312,8 @@ message NetbirdConfig {
   RelayConfig relay = 4;
 
   FlowConfig flow = 5;
+
+  MetricsConfig metrics = 6;
 }
 
 // HostConfig describes connection properties of some server (e.g. STUN, Signal, Management)
@@ -350,6 +352,10 @@ message FlowConfig {
   bool dnsCollection = 8;
 }
 
+message MetricsConfig {
+  bool enabled = 1;
+}
+
 // JWTConfig represents JWT authentication configuration for validating tokens.
 message JWTConfig {
   string issuer = 1;

From ff04ffb534cfb308e70c2b3eb3c0595db8ea490f Mon Sep 17 00:00:00 2001
From: Zoltan Papp <zoltan.pmail@gmail.com>
Date: Wed, 1 Jul 2026 14:51:06 +0200
Subject: [PATCH 15/36] [client] Fix pointer comparisons in profile config
 apply (#6622)

apply() compared several *bool/*int ConfigInput fields against the
Config fields by pointer identity instead of by value, so any
non-nil input always looked "changed" and triggered a spurious log
line plus an unconditional config rewrite even when the value was
unchanged.
---
 client/internal/profilemanager/config.go | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/client/internal/profilemanager/config.go b/client/internal/profilemanager/config.go
index 5a71a981e..8ffcb16f2 100644
--- a/client/internal/profilemanager/config.go
+++ b/client/internal/profilemanager/config.go
@@ -386,7 +386,7 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.NetworkMonitor != nil && input.NetworkMonitor != config.NetworkMonitor {
+	if input.NetworkMonitor != nil && (config.NetworkMonitor == nil || *input.NetworkMonitor != *config.NetworkMonitor) {
 		log.Infof("switching Network Monitor to %t", *input.NetworkMonitor)
 		config.NetworkMonitor = input.NetworkMonitor
 		updated = true
@@ -454,7 +454,7 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.EnableSSHRoot != nil && input.EnableSSHRoot != config.EnableSSHRoot {
+	if input.EnableSSHRoot != nil && (config.EnableSSHRoot == nil || *input.EnableSSHRoot != *config.EnableSSHRoot) {
 		if *input.EnableSSHRoot {
 			log.Infof("enabling SSH root login")
 		} else {
@@ -464,7 +464,7 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.EnableSSHSFTP != nil && input.EnableSSHSFTP != config.EnableSSHSFTP {
+	if input.EnableSSHSFTP != nil && (config.EnableSSHSFTP == nil || *input.EnableSSHSFTP != *config.EnableSSHSFTP) {
 		if *input.EnableSSHSFTP {
 			log.Infof("enabling SSH SFTP subsystem")
 		} else {
@@ -474,7 +474,7 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.EnableSSHLocalPortForwarding != nil && input.EnableSSHLocalPortForwarding != config.EnableSSHLocalPortForwarding {
+	if input.EnableSSHLocalPortForwarding != nil && (config.EnableSSHLocalPortForwarding == nil || *input.EnableSSHLocalPortForwarding != *config.EnableSSHLocalPortForwarding) {
 		if *input.EnableSSHLocalPortForwarding {
 			log.Infof("enabling SSH local port forwarding")
 		} else {
@@ -484,7 +484,7 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.EnableSSHRemotePortForwarding != nil && input.EnableSSHRemotePortForwarding != config.EnableSSHRemotePortForwarding {
+	if input.EnableSSHRemotePortForwarding != nil && (config.EnableSSHRemotePortForwarding == nil || *input.EnableSSHRemotePortForwarding != *config.EnableSSHRemotePortForwarding) {
 		if *input.EnableSSHRemotePortForwarding {
 			log.Infof("enabling SSH remote port forwarding")
 		} else {
@@ -494,7 +494,7 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.DisableSSHAuth != nil && input.DisableSSHAuth != config.DisableSSHAuth {
+	if input.DisableSSHAuth != nil && (config.DisableSSHAuth == nil || *input.DisableSSHAuth != *config.DisableSSHAuth) {
 		if *input.DisableSSHAuth {
 			log.Infof("disabling SSH authentication")
 		} else {
@@ -504,7 +504,7 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.SSHJWTCacheTTL != nil && input.SSHJWTCacheTTL != config.SSHJWTCacheTTL {
+	if input.SSHJWTCacheTTL != nil && (config.SSHJWTCacheTTL == nil || *input.SSHJWTCacheTTL != *config.SSHJWTCacheTTL) {
 		log.Infof("updating SSH JWT cache TTL to %d seconds", *input.SSHJWTCacheTTL)
 		config.SSHJWTCacheTTL = input.SSHJWTCacheTTL
 		updated = true
@@ -587,7 +587,7 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.DisableNotifications != nil && input.DisableNotifications != config.DisableNotifications {
+	if input.DisableNotifications != nil && (config.DisableNotifications == nil || *input.DisableNotifications != *config.DisableNotifications) {
 		if *input.DisableNotifications {
 			log.Infof("disabling notifications")
 		} else {

From 2ab99eefa627ce92d9117cdece532f68a9b13cf4 Mon Sep 17 00:00:00 2001
From: Denis Ivanov <74763652+den-dw@users.noreply.github.com>
Date: Wed, 1 Jul 2026 15:53:13 +0300
Subject: [PATCH 16/36] [management] detach JWT group sync write from request
 cancellation (#6621)

The HTTP auth middleware runs syncUserJWTGroups in the request context.
The dashboard SPA routinely aborts in-flight requests on re-render or
navigation, which cancels the request context mid-write and rolls back
the group-sync DB transaction. The error is logged but swallowed, so the
synced groups silently never persist (users.auto_groups stays empty)
while the failing log line repeats on every request.

Detach the sync from the request's cancellation with
context.WithoutCancel so the write can commit regardless of the client
connection; the store already bounds the transaction with its own
timeout. Add a regression test asserting the sync receives a
non-cancelled context even when the originating request is cancelled.
---
 .../server/http/middleware/auth_middleware.go |  6 +-
 .../http/middleware/auth_middleware_test.go   | 60 +++++++++++++++++++
 2 files changed, 65 insertions(+), 1 deletion(-)

diff --git a/management/server/http/middleware/auth_middleware.go b/management/server/http/middleware/auth_middleware.go
index 34df0de23..ba8c66241 100644
--- a/management/server/http/middleware/auth_middleware.go
+++ b/management/server/http/middleware/auth_middleware.go
@@ -152,7 +152,11 @@ func (m *AuthMiddleware) checkJWTFromRequest(r *http.Request, authHeaderParts []
 		return err
 	}
 
-	err = m.syncUserJWTGroups(ctx, userAuth)
+	// Detach the group-sync write from the request's cancellation: the dashboard
+	// SPA aborts in-flight requests on re-render, which would otherwise cancel the
+	// DB transaction mid-write and silently drop the synced groups. Context values
+	// (request id, logger) are preserved; the store bounds the tx with its own timeout.
+	err = m.syncUserJWTGroups(context.WithoutCancel(ctx), userAuth)
 	if err != nil {
 		log.WithContext(ctx).Errorf("HTTP server failed to sync user JWT groups: %s", err)
 	}
diff --git a/management/server/http/middleware/auth_middleware_test.go b/management/server/http/middleware/auth_middleware_test.go
index 24cf8fce5..a34554660 100644
--- a/management/server/http/middleware/auth_middleware_test.go
+++ b/management/server/http/middleware/auth_middleware_test.go
@@ -241,6 +241,66 @@ func TestAuthMiddleware_Handler(t *testing.T) {
 	}
 }
 
+// TestAuthMiddleware_SyncUserJWTGroupsDetachedFromRequestCancellation ensures the
+// JWT group sync write is not bound to the request context. The dashboard SPA
+// routinely aborts in-flight requests on re-render/navigation; if the sync ran in
+// the request context, the cancellation would roll back the DB transaction and the
+// synced groups would silently never persist. The sync must receive a context that
+// is not cancelled even when the originating request is.
+func TestAuthMiddleware_SyncUserJWTGroupsDetachedFromRequestCancellation(t *testing.T) {
+	var (
+		syncCalled bool
+		syncCtxErr error
+	)
+
+	mockAuth := &auth.MockManager{
+		ValidateAndParseTokenFunc:       mockValidateAndParseToken,
+		EnsureUserAccessByJWTGroupsFunc: mockEnsureUserAccessByJWTGroups,
+		MarkPATUsedFunc:                 mockMarkPATUsed,
+		GetPATInfoFunc:                  mockGetAccountInfoFromPAT,
+	}
+
+	disabledLimiter := NewAPIRateLimiter(nil)
+	disabledLimiter.SetEnabled(false)
+
+	authMiddleware := NewAuthMiddleware(
+		mockAuth,
+		func(ctx context.Context, userAuth nbauth.UserAuth) (string, string, error) {
+			return userAuth.AccountId, userAuth.UserId, nil
+		},
+		func(ctx context.Context, userAuth nbauth.UserAuth) error {
+			syncCalled = true
+			syncCtxErr = ctx.Err()
+			return nil
+		},
+		func(ctx context.Context, userAuth nbauth.UserAuth) (*types.User, error) {
+			return &types.User{}, nil
+		},
+		disabledLimiter,
+		nil,
+		func(_ context.Context, _, _, _ string) bool { return false },
+	)
+
+	handlerToTest := authMiddleware.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
+
+	// Simulate the dashboard aborting the request: it arrives already cancelled.
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	req := httptest.NewRequest("GET", "http://testing/test", nil).WithContext(ctx)
+	req.Header.Set("Authorization", "Bearer "+JWT)
+	rec := httptest.NewRecorder()
+
+	handlerToTest.ServeHTTP(rec, req)
+
+	if !syncCalled {
+		t.Fatal("syncUserJWTGroups was not called")
+	}
+	if syncCtxErr != nil {
+		t.Fatalf("syncUserJWTGroups received a cancelled context (%v); the group-sync write must be detached from request cancellation", syncCtxErr)
+	}
+}
+
 func TestAuthMiddleware_RateLimiting(t *testing.T) {
 	mockAuth := &auth.MockManager{
 		ValidateAndParseTokenFunc:       mockValidateAndParseToken,

From 7c0d8cbae06ba2d30444af022f6727ae91a36a85 Mon Sep 17 00:00:00 2001
From: Maycon Santos <mlsmaycon@gmail.com>
Date: Wed, 1 Jul 2026 17:23:50 +0200
Subject: [PATCH 17/36] [misc] Run agent-network e2e nightly + on manual
 dispatch (#6629)

The suite builds combined/proxy/client from source and drives live
provider traffic, so running it per push/PR is too costly. Switch to a
nightly schedule (03:00 UTC) plus workflow_dispatch, and drop the
now-unneeded fork guard that only mattered for pull_request runs.
---
 .github/workflows/agent-network-e2e.yml | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/agent-network-e2e.yml b/.github/workflows/agent-network-e2e.yml
index c041bfbfa..d78e3bbd3 100644
--- a/.github/workflows/agent-network-e2e.yml
+++ b/.github/workflows/agent-network-e2e.yml
@@ -1,10 +1,10 @@
 name: Agent Network E2E
 
 on:
-  push:
-    branches:
-      - main
-  pull_request:
+  # Nightly at 03:00 UTC, plus on demand from the Actions tab.
+  schedule:
+    - cron: "0 3 * * *"
+  workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -13,7 +13,6 @@ concurrency:
 jobs:
   e2e:
     name: Agent Network E2E
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:

From 0aa0f7c76b58d9bec8655b5558190419227dbd43 Mon Sep 17 00:00:00 2001
From: Riccardo Manfrin <3090891+riccardomanfrin@users.noreply.github.com>
Date: Wed, 1 Jul 2026 19:10:50 +0200
Subject: [PATCH 18/36] [client] wire client -> mgmt is healthy check to proper
 gRPC API (#6421)

---
 shared/management/client/grpc.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/shared/management/client/grpc.go b/shared/management/client/grpc.go
index 6f5172376..781e66a3e 100644
--- a/shared/management/client/grpc.go
+++ b/shared/management/client/grpc.go
@@ -536,7 +536,7 @@ func (c *GrpcClient) IsHealthy() bool {
 	ctx, cancel := context.WithTimeout(c.ctx, healthCheckTimeout)
 	defer cancel()
 
-	_, err := c.realClient.GetServerKey(ctx, &proto.Empty{})
+	_, err := c.realClient.IsHealthy(ctx, &proto.Empty{})
 	if err != nil {
 		c.notifyDisconnected(err)
 		log.Warnf("health check returned: %s", err)

From eb422a5cd3c50a401873e704c673a353ea59abd8 Mon Sep 17 00:00:00 2001
From: Maycon Santos <mlsmaycon@gmail.com>
Date: Wed, 1 Jul 2026 20:43:15 +0200
Subject: [PATCH 19/36] [management,proxy] Add per-provider
 skip_tls_verification for agent-network (#6630)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* [management,proxy] Add per-provider skip_tls_verification for agent-network

Let agent-network providers opt into skipping upstream TLS verification for
self-hosted / internal gateways behind a private or self-signed cert.

- provider: add SkipTLSVerification (persisted via AutoMigrate) with
  request/response mapping (nil on update preserves, explicit false clears).
- openapi: skip_tls_verification on the provider request + response; types
  regenerated.
- synthesizer: carry the flag into the llm_router route config so it reaches
  the proxy.
- proxy: llm_router sets it on the UpstreamRewrite mutation, and the reverse
  proxy applies roundtrip.WithSkipTLSVerify per selected route when forwarding
  upstream (the router dials per provider, so a per-target flag alone wouldn't
  cover it).
- tests: synthesizer route config carries the flag, router rewrite propagates
  it, and the request/response round-trip incl. update semantics.

* [e2e] Validate per-provider skip_tls_verification end to end

Add a self-signed HTTPS upstream (nginx) to the harness and a test that
provisions two providers on that same upstream — one with
skip_tls_verification=true, one false — behind one proxy + client. The
skip=true provider's chat reaches the upstream (200); the skip=false
provider's fails the TLS handshake (5xx). Same upstream, opposite outcome,
which proves the flag is honoured per provider (a single target-level flag
could not, since all of an account's providers share one synthesised
target).

* [e2e] WaitProxyPeer: require >=1 connected peer, not exact 1/1

Each proxy container registers a fresh WireGuard key and its peer is not
removed on teardown, so proxy peers from earlier tests linger in the
account as disconnected. WaitProxyPeer matched the exact string
"1/1 Connected", which failed once a second proxy-using test ran in the
same package (status "1/2"). Parse the "Peers count: X/Y Connected" line
and wait for X>=1 instead: only the live proxy can be connected, and the
caller's subsequent chat is the real end-to-end assertion. Fixes the CI
failure of TestProviderSkipTLSVerification (runs after TestProvidersMatrix).
---
 e2e/agentnetwork/skiptls_test.go              | 140 ++++++++++++++++++
 e2e/harness/client.go                         |  44 +++++-
 e2e/harness/upstream.go                       | 107 +++++++++++++
 .../modules/agentnetwork/synthesizer.go       |   5 +
 .../modules/agentnetwork/synthesizer_test.go  |  35 +++++
 .../modules/agentnetwork/types/provider.go    |  25 +++-
 .../agentnetwork/types/provider_test.go       |  44 ++++++
 .../middleware/builtin/llm_router/factory.go  |   4 +
 .../builtin/llm_router/middleware.go          |   5 +-
 .../builtin/llm_router/middleware_test.go     |  35 +++++
 proxy/internal/middleware/types.go            |   4 +
 proxy/internal/proxy/reverseproxy.go          |   5 +
 shared/management/http/api/openapi.yml        |   9 ++
 shared/management/http/api/types.gen.go       |   6 +
 14 files changed, 456 insertions(+), 12 deletions(-)
 create mode 100644 e2e/agentnetwork/skiptls_test.go
 create mode 100644 e2e/harness/upstream.go
 create mode 100644 management/internals/modules/agentnetwork/types/provider_test.go

diff --git a/e2e/agentnetwork/skiptls_test.go b/e2e/agentnetwork/skiptls_test.go
new file mode 100644
index 000000000..077fd6005
--- /dev/null
+++ b/e2e/agentnetwork/skiptls_test.go
@@ -0,0 +1,140 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// TestProviderSkipTLSVerification proves skip_tls_verification is per-provider:
+// two providers share one self-signed upstream, one skipping TLS verification
+// and one not. The skip=true provider's chat reaches the upstream and returns
+// 200; the skip=false provider's chat fails at the TLS handshake — same
+// upstream, opposite outcome. This is the behaviour a target-level flag could
+// not give, since all of an account's providers share one synthesised target.
+func TestProviderSkipTLSVerification(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+	defer cancel()
+
+	up, err := harness.StartFakeUpstream(ctx, srv)
+	require.NoError(t, err, "start self-signed upstream")
+	t.Cleanup(func() { _ = up.Terminate(context.Background()) })
+
+	grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-skiptls"})
+	require.NoError(t, err, "create group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grp.Id) })
+
+	ephemeral := false
+	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+		Name:       "e2e-skiptls-client",
+		Type:       "reusable",
+		ExpiresIn:  86400,
+		UsageLimit: 0,
+		AutoGroups: []string{grp.Id},
+		Ephemeral:  &ephemeral,
+	})
+	require.NoError(t, err, "mint setup key")
+	require.NotEmpty(t, sk.Key, "setup key plaintext")
+
+	const (
+		insecureModel = "insecure-model"
+		secureModel   = "secure-model"
+	)
+
+	// Two providers on the SAME self-signed upstream, distinguished only by their
+	// skip_tls_verification and a unique model string so the router picks each
+	// unambiguously.
+	newReq := func(name, model string, skip bool) api.AgentNetworkProviderRequest {
+		key := "sk-dummy-e2e"
+		return api.AgentNetworkProviderRequest{
+			Name:                name,
+			ProviderId:          "openai_api",
+			UpstreamUrl:         up.URL,
+			ApiKey:              &key,
+			Enabled:             ptr(true),
+			SkipTlsVerification: ptr(skip),
+			Models: &[]api.AgentNetworkProviderModel{
+				{Id: model, InputPer1k: 0.001, OutputPer1k: 0.002},
+			},
+		}
+	}
+
+	// First create bootstraps the account cluster.
+	insecureReq := newReq("skip-tls", insecureModel, true)
+	insecureReq.BootstrapCluster = ptr(harness.AgentNetworkCluster)
+	insecureProv, err := srv.CreateProvider(ctx, insecureReq)
+	require.NoError(t, err, "create skip-tls provider")
+	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), insecureProv.Id) })
+	require.True(t, insecureProv.SkipTlsVerification, "response must echo skip_tls_verification=true")
+
+	secureProv, err := srv.CreateProvider(ctx, newReq("verify-tls", secureModel, false))
+	require.NoError(t, err, "create verify-tls provider")
+	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), secureProv.Id) })
+	require.False(t, secureProv.SkipTlsVerification, "response must echo skip_tls_verification=false")
+
+	enabled := true
+	pol, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-skiptls-allow",
+		Enabled:                &enabled,
+		SourceGroups:           []string{grp.Id},
+		DestinationProviderIds: []string{insecureProv.Id, secureProv.Id},
+	})
+	require.NoError(t, err, "create policy")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
+
+	settings, err := srv.GetSettings(ctx)
+	require.NoError(t, err, "read settings")
+	require.NotEmpty(t, settings.Endpoint, "endpoint must be assigned")
+
+	proxyToken, err := srv.CreateProxyTokenCLI(ctx, "e2e-skiptls-proxy")
+	require.NoError(t, err, "mint proxy token")
+	px, err := harness.StartProxy(ctx, srv, proxyToken)
+	require.NoError(t, err, "start proxy")
+	t.Cleanup(func() { _ = px.Terminate(context.Background()) })
+
+	cl, err := harness.StartClient(ctx, srv, sk.Key)
+	require.NoError(t, err, "start client")
+	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
+
+	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
+	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
+		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
+	}
+	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
+	require.NoError(t, err, "resolve endpoint to proxy IP")
+
+	// Positive: skip=true reaches the self-signed upstream. Retry to absorb
+	// tunnel/DNS jitter on the first call; success also proves the path works.
+	var code int
+	var body string
+	deadline := time.Now().Add(90 * time.Second)
+	for time.Now().Before(deadline) {
+		c, b, cerr := cl.Chat(ctx, settings.Endpoint, proxyIP, harness.WireChat, insecureModel, "Reply with exactly: pong", "e2e-skiptls-insecure")
+		if cerr == nil {
+			code, body = c, b
+			if code == 200 {
+				break
+			}
+		}
+		time.Sleep(5 * time.Second)
+	}
+	require.Equal(t, 200, code,
+		"skip_tls_verification=true must reach the self-signed upstream; body: %s\n=== upstream logs ===\n%s\n=== proxy logs ===\n%s",
+		body, up.Logs(context.Background()), px.Logs(context.Background()))
+
+	// Negative: skip=false must fail the TLS handshake to the SAME upstream. The
+	// path is already proven working, so a non-200 here is the cert rejection.
+	secureCode, secureBody, cerr := cl.Chat(ctx, settings.Endpoint, proxyIP, harness.WireChat, secureModel, "Reply with exactly: pong", "e2e-skiptls-secure")
+	require.NoError(t, cerr, "the chat call itself must complete (proxy returns an error status, not a transport error)")
+	require.NotEqual(t, 200, secureCode,
+		"skip_tls_verification=false must NOT reach the self-signed upstream; got %d, body: %s", secureCode, secureBody)
+	require.GreaterOrEqual(t, secureCode, 500,
+		"a TLS verification failure should surface as a 5xx from the proxy; got %d, body: %s", secureCode, secureBody)
+}
diff --git a/e2e/harness/client.go b/e2e/harness/client.go
index cf7ef8945..1ce8c0f6e 100644
--- a/e2e/harness/client.go
+++ b/e2e/harness/client.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"io"
 	"os/exec"
+	"strconv"
 	"strings"
 	"time"
 
@@ -108,9 +109,48 @@ func (cl *Client) WaitConnected(ctx context.Context, timeout time.Duration) erro
 	return cl.pollStatus(ctx, timeout, "Management: Connected")
 }
 
-// WaitProxyPeer polls until the client sees the proxy peer connected (1/1).
+// WaitProxyPeer polls until the client sees at least one connected peer — the
+// proxy serving the agent-network endpoint. It requires ">=1 connected" rather
+// than an exact "1/1" because proxy peers from earlier tests linger in the
+// account as disconnected (each proxy container registers a fresh WireGuard key
+// and the peer is not removed on teardown), so the count is e.g. "1/2". Only the
+// live proxy can be connected, and the caller's subsequent chat is the real
+// end-to-end assertion.
 func (cl *Client) WaitProxyPeer(ctx context.Context, timeout time.Duration) error {
-	return cl.pollStatus(ctx, timeout, "1/1 Connected")
+	deadline := time.Now().Add(timeout)
+	var last string
+	for time.Now().Before(deadline) {
+		out, _ := cl.Status(ctx)
+		last = out
+		if connectedPeers(out) >= 1 {
+			return nil
+		}
+		time.Sleep(3 * time.Second)
+	}
+	return fmt.Errorf("timed out waiting for a connected proxy peer; last status:\n%s", last)
+}
+
+// connectedPeers parses the "Peers count: X/Y Connected" line from `netbird
+// status` and returns X (the connected count), or 0 when absent/unparseable.
+func connectedPeers(status string) int {
+	for _, line := range strings.Split(status, "\n") {
+		line = strings.TrimSpace(line)
+		rest, ok := strings.CutPrefix(line, "Peers count:")
+		if !ok {
+			continue
+		}
+		rest = strings.TrimSpace(rest)
+		slash := strings.IndexByte(rest, '/')
+		if slash <= 0 {
+			return 0
+		}
+		n, err := strconv.Atoi(strings.TrimSpace(rest[:slash]))
+		if err != nil {
+			return 0
+		}
+		return n
+	}
+	return 0
 }
 
 func (cl *Client) pollStatus(ctx context.Context, timeout time.Duration, want string) error {
diff --git a/e2e/harness/upstream.go b/e2e/harness/upstream.go
new file mode 100644
index 000000000..cdffe63b9
--- /dev/null
+++ b/e2e/harness/upstream.go
@@ -0,0 +1,107 @@
+//go:build e2e
+
+package harness
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"time"
+
+	"github.com/docker/docker/api/types/container"
+	"github.com/testcontainers/testcontainers-go"
+	"github.com/testcontainers/testcontainers-go/wait"
+)
+
+const (
+	fakeUpstreamImage = "nginx:alpine"
+	fakeUpstreamAlias = "fakeupstream"
+	fakeUpstreamPort  = "443/tcp"
+)
+
+// fakeUpstreamNginxConf serves a canned OpenAI-shaped chat completion for any
+// path over a self-signed certificate, so the proxy reaches it only when the
+// provider opts into skipping TLS verification.
+const fakeUpstreamNginxConf = `pid /tmp/nginx.pid;
+events {}
+http {
+  server {
+    listen 443 ssl;
+    ssl_certificate     /certs/tls.crt;
+    ssl_certificate_key /certs/tls.key;
+    location / {
+      default_type application/json;
+      return 200 '{"id":"chatcmpl-e2e","object":"chat.completion","choices":[{"index":0,"message":{"role":"assistant","content":"pong"},"finish_reason":"stop"}],"usage":{"prompt_tokens":1,"completion_tokens":1,"total_tokens":2}}';
+    }
+  }
+}
+`
+
+// FakeUpstream is a self-signed HTTPS server on the combined server's network,
+// used to exercise provider skip_tls_verification: a proxy that verifies the
+// certificate rejects it, one that skips verification reaches it.
+type FakeUpstream struct {
+	container testcontainers.Container
+	workDir   string
+	// URL is the upstream URL providers point at (https://<alias>).
+	URL string
+}
+
+// StartFakeUpstream runs the self-signed upstream on the shared network.
+func StartFakeUpstream(ctx context.Context, c *Combined) (*FakeUpstream, error) {
+	workDir, err := os.MkdirTemp("/tmp", "nb-e2e-upstream-*")
+	if err != nil {
+		return nil, fmt.Errorf("create upstream work dir: %w", err)
+	}
+	// Widen so the (non-root worker) nginx container can traverse the bind mount.
+	if err := os.Chmod(workDir, 0o755); err != nil { //nolint:gosec // throwaway e2e cert dir
+		return nil, fmt.Errorf("chmod upstream dir: %w", err)
+	}
+	if err := writeSelfSignedCert(workDir, []string{fakeUpstreamAlias}); err != nil {
+		return nil, err
+	}
+	if err := os.WriteFile(filepath.Join(workDir, "nginx.conf"), []byte(fakeUpstreamNginxConf), 0o644); err != nil { //nolint:gosec // non-secret e2e config
+		return nil, fmt.Errorf("write nginx conf: %w", err)
+	}
+
+	req := testcontainers.ContainerRequest{
+		Image:          fakeUpstreamImage,
+		ExposedPorts:   []string{fakeUpstreamPort},
+		Networks:       []string{c.network.Name},
+		NetworkAliases: map[string][]string{c.network.Name: {fakeUpstreamAlias}},
+		Cmd:            []string{"nginx", "-c", "/certs/nginx.conf", "-g", "daemon off;"},
+		HostConfigModifier: func(hc *container.HostConfig) {
+			hc.Binds = append(hc.Binds, workDir+":/certs:ro")
+		},
+		WaitingFor: wait.ForListeningPort(fakeUpstreamPort).WithStartupTimeout(60 * time.Second),
+	}
+
+	ctr, err := testcontainers.GenericContainer(ctx, testcontainers.GenericContainerRequest{
+		ContainerRequest: req,
+		Started:          true,
+	})
+	if err != nil {
+		_ = os.RemoveAll(workDir)
+		return nil, fmt.Errorf("start fake upstream container: %w", err)
+	}
+
+	return &FakeUpstream{container: ctr, workDir: workDir, URL: "https://" + fakeUpstreamAlias}, nil
+}
+
+// Logs returns the upstream container logs, for diagnostics on failure.
+func (u *FakeUpstream) Logs(ctx context.Context) string {
+	return containerLogs(ctx, u.container)
+}
+
+// Terminate stops the upstream container and cleans its work dir.
+func (u *FakeUpstream) Terminate(ctx context.Context) error {
+	var err error
+	if u.container != nil {
+		err = u.container.Terminate(ctx)
+	}
+	if u.workDir != "" {
+		_ = os.RemoveAll(u.workDir)
+	}
+	return err
+}
diff --git a/management/internals/modules/agentnetwork/synthesizer.go b/management/internals/modules/agentnetwork/synthesizer.go
index 9814d1a11..74ac91845 100644
--- a/management/internals/modules/agentnetwork/synthesizer.go
+++ b/management/internals/modules/agentnetwork/synthesizer.go
@@ -366,6 +366,10 @@ type routerProviderRoute struct {
 	// + refreshes the OAuth token at request time instead of injecting a static
 	// AuthHeaderValue.
 	GCPServiceAccountKeyB64 string `json:"gcp_sa_key_b64,omitempty"`
+	// SkipTLSVerify disables upstream TLS certificate verification when the
+	// proxy dials this provider's upstream. For self-hosted / internal gateways
+	// behind a private or self-signed certificate.
+	SkipTLSVerify bool `json:"skip_tls_verify,omitempty"`
 }
 
 // indexProviderGroups walks the enabled policies and returns, per
@@ -450,6 +454,7 @@ func buildRouterConfigJSON(providers []*types.Provider, groupIndex map[string][]
 			Vertex:                  catalog.IsVertexPathStyle(p.ProviderID),
 			Bedrock:                 catalog.IsBedrockPathStyle(p.ProviderID),
 			GCPServiceAccountKeyB64: gcpSAKeyB64,
+			SkipTLSVerify:           p.SkipTLSVerification,
 		})
 	}
 	out, err := json.Marshal(cfg)
diff --git a/management/internals/modules/agentnetwork/synthesizer_test.go b/management/internals/modules/agentnetwork/synthesizer_test.go
index 0b07f27b3..9d55bddf1 100644
--- a/management/internals/modules/agentnetwork/synthesizer_test.go
+++ b/management/internals/modules/agentnetwork/synthesizer_test.go
@@ -1057,6 +1057,41 @@ func TestSynthesizeServices_UpstreamURLPath_FlowsToRouter(t *testing.T) {
 		"upstream path must be carried so the router can disambiguate same-model providers; trailing slash trimmed for stable string-prefix matching")
 }
 
+func TestSynthesizeServices_SkipTLSVerification_FlowsToRouter(t *testing.T) {
+	ctx := context.Background()
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	mockStore := store.NewMockStore(ctrl)
+
+	// A provider fronting a self-hosted / internal gateway opts into skipping
+	// upstream TLS verification; the synthesiser must carry it into the router
+	// route so the proxy dials that upstream insecurely.
+	provider := newSynthTestProvider()
+	provider.SkipTLSVerification = true
+	policy := newSynthTestPolicy(provider.ID, "grp-eng", "")
+
+	expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
+		[]*types.Provider{provider},
+		[]*types.Policy{policy},
+		[]*types.Guardrail{})
+
+	services, err := SynthesizeServices(ctx, mockStore, testAccountID)
+	require.NoError(t, err)
+	require.Len(t, services, 1)
+
+	mws := services[0].Targets[0].Options.Middlewares
+	var routerCfg routerConfig
+	for _, m := range mws {
+		if m.ID == middlewareIDLLMRouter {
+			require.NoError(t, json.Unmarshal(m.ConfigJSON, &routerCfg))
+			break
+		}
+	}
+	require.Len(t, routerCfg.Providers, 1)
+	assert.True(t, routerCfg.Providers[0].SkipTLSVerify,
+		"provider skip_tls_verification must flow into the router route")
+}
+
 func TestSynthesizeServices_UnknownProviderID_FailsClosed(t *testing.T) {
 	ctx := context.Background()
 	ctrl := gomock.NewController(t)
diff --git a/management/internals/modules/agentnetwork/types/provider.go b/management/internals/modules/agentnetwork/types/provider.go
index 28c8a94e2..2e3195481 100644
--- a/management/internals/modules/agentnetwork/types/provider.go
+++ b/management/internals/modules/agentnetwork/types/provider.go
@@ -46,6 +46,11 @@ type Provider struct {
 	// Empty means all catalog models are allowed at catalog prices.
 	Models  []ProviderModel `gorm:"serializer:json"`
 	Enabled bool
+	// SkipTLSVerification disables upstream TLS certificate verification for
+	// this provider's URL. For self-hosted / internal gateways fronted by a
+	// private or self-signed certificate. The synthesiser propagates it into
+	// the router route so the proxy dials that provider's upstream insecurely.
+	SkipTLSVerification bool `gorm:"column:skip_tls_verification"`
 	// SessionPrivateKey + SessionPublicKey are the ed25519 keypair the
 	// synthesised reverse-proxy service uses to sign / verify session
 	// JWTs after a successful OIDC handshake. Generated once on
@@ -129,6 +134,9 @@ func (p *Provider) FromAPIRequest(req *api.AgentNetworkProviderRequest) {
 	if req.Enabled != nil {
 		p.Enabled = *req.Enabled
 	}
+	if req.SkipTlsVerification != nil {
+		p.SkipTLSVerification = *req.SkipTlsVerification
+	}
 	// Identity-header overrides for catalogs flagged Customizable.
 	// nil pointer = "field omitted on the wire" → leave the stored
 	// value untouched (per the openapi description). Empty string is
@@ -155,14 +163,15 @@ func (p *Provider) ToAPIResponse() *api.AgentNetworkProvider {
 	created := p.CreatedAt
 	updated := p.UpdatedAt
 	resp := &api.AgentNetworkProvider{
-		Id:          p.ID,
-		ProviderId:  p.ProviderID,
-		Name:        p.Name,
-		UpstreamUrl: p.UpstreamURL,
-		Models:      models,
-		Enabled:     p.Enabled,
-		CreatedAt:   &created,
-		UpdatedAt:   &updated,
+		Id:                  p.ID,
+		ProviderId:          p.ProviderID,
+		Name:                p.Name,
+		UpstreamUrl:         p.UpstreamURL,
+		Models:              models,
+		Enabled:             p.Enabled,
+		SkipTlsVerification: p.SkipTLSVerification,
+		CreatedAt:           &created,
+		UpdatedAt:           &updated,
 	}
 	if len(p.ExtraValues) > 0 {
 		out := make(map[string]string, len(p.ExtraValues))
diff --git a/management/internals/modules/agentnetwork/types/provider_test.go b/management/internals/modules/agentnetwork/types/provider_test.go
new file mode 100644
index 000000000..1195499e7
--- /dev/null
+++ b/management/internals/modules/agentnetwork/types/provider_test.go
@@ -0,0 +1,44 @@
+package types
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// TestProvider_SkipTLSVerification_RoundTrip covers the request→provider→
+// response mapping of skip_tls_verification, including the update semantics
+// (nil pointer preserves, explicit false clears).
+func TestProvider_SkipTLSVerification_RoundTrip(t *testing.T) {
+	enable := true
+	disable := false
+
+	base := func() *api.AgentNetworkProviderRequest {
+		return &api.AgentNetworkProviderRequest{
+			ProviderId:  "openai_api",
+			Name:        "internal",
+			UpstreamUrl: "https://gw.internal",
+		}
+	}
+
+	p := NewProvider("acc-1")
+
+	req := base()
+	req.SkipTlsVerification = &enable
+	p.FromAPIRequest(req)
+	assert.True(t, p.SkipTLSVerification, "create with skip_tls_verification=true must set the field")
+	assert.True(t, p.ToAPIResponse().SkipTlsVerification, "response must surface skip_tls_verification")
+
+	// Omitting the field on update leaves the stored value untouched.
+	p.FromAPIRequest(base())
+	assert.True(t, p.SkipTLSVerification, "omitting skip_tls_verification on update must preserve it")
+
+	// Explicit false clears it.
+	req = base()
+	req.SkipTlsVerification = &disable
+	p.FromAPIRequest(req)
+	assert.False(t, p.SkipTLSVerification, "explicit false must clear skip_tls_verification")
+	assert.False(t, p.ToAPIResponse().SkipTlsVerification, "response must reflect the cleared value")
+}
diff --git a/proxy/internal/middleware/builtin/llm_router/factory.go b/proxy/internal/middleware/builtin/llm_router/factory.go
index 3c3b607ac..938a23ebe 100644
--- a/proxy/internal/middleware/builtin/llm_router/factory.go
+++ b/proxy/internal/middleware/builtin/llm_router/factory.go
@@ -59,6 +59,10 @@ type ProviderRoute struct {
 	// (instead of the static AuthHeaderValue) — so the gateway holds a durable
 	// Vertex credential rather than a 1-hour token.
 	GCPServiceAccountKeyB64 string `json:"gcp_sa_key_b64,omitempty"`
+	// SkipTLSVerify disables upstream TLS certificate verification when dialing
+	// this route's upstream. For self-hosted / internal gateways behind a
+	// private or self-signed certificate.
+	SkipTLSVerify bool `json:"skip_tls_verify,omitempty"`
 }
 
 // Config is the on-wire configuration accepted by the factory. An
diff --git a/proxy/internal/middleware/builtin/llm_router/middleware.go b/proxy/internal/middleware/builtin/llm_router/middleware.go
index 73cc59c95..2aaeb1089 100644
--- a/proxy/internal/middleware/builtin/llm_router/middleware.go
+++ b/proxy/internal/middleware/builtin/llm_router/middleware.go
@@ -615,8 +615,9 @@ func (m *Middleware) allowWithRoute(route ProviderRoute, userGroups []string) *m
 		// path is silently dropped and the gateway returns a 4xx for
 		// the malformed URL. Empty value leaves the original
 		// target's path untouched.
-		Path:         route.UpstreamPath,
-		StripHeaders: append([]string(nil), strippedAuthHeaders...),
+		Path:          route.UpstreamPath,
+		StripHeaders:  append([]string(nil), strippedAuthHeaders...),
+		SkipTLSVerify: route.SkipTLSVerify,
 	}
 	authValue := route.AuthHeaderValue
 	if route.GCPServiceAccountKeyB64 != "" {
diff --git a/proxy/internal/middleware/builtin/llm_router/middleware_test.go b/proxy/internal/middleware/builtin/llm_router/middleware_test.go
index 8ae03c5ba..425c383c1 100644
--- a/proxy/internal/middleware/builtin/llm_router/middleware_test.go
+++ b/proxy/internal/middleware/builtin/llm_router/middleware_test.go
@@ -107,6 +107,41 @@ func TestRouter_HappyPath(t *testing.T) {
 	assert.Equal(t, "allow", dec, "decision metadata must be allow on a match")
 }
 
+func TestRouter_SkipTLSVerifyPropagates(t *testing.T) {
+	base := ProviderRoute{
+		ID:              "internal-gw",
+		Models:          []string{"gpt-4o"},
+		AllowedGroupIDs: []string{defaultTestGroup},
+		UpstreamScheme:  "https",
+		UpstreamHost:    "gateway.internal",
+		AuthHeaderName:  "Authorization",
+		AuthHeaderValue: "Bearer sk-test-123",
+	}
+
+	t.Run("enabled", func(t *testing.T) {
+		route := base
+		route.SkipTLSVerify = true
+		mw := New(Config{Providers: []ProviderRoute{route}})
+
+		out, err := mw.Invoke(context.Background(), newInputWithModel("gpt-4o"))
+		require.NoError(t, err)
+		require.NotNil(t, out.Mutations, "matched route must emit mutations")
+		require.NotNil(t, out.Mutations.RewriteUpstream, "matched route must emit upstream rewrite")
+		assert.True(t, out.Mutations.RewriteUpstream.SkipTLSVerify,
+			"skip_tls_verify on the route must ride on the upstream rewrite")
+	})
+
+	t.Run("default off", func(t *testing.T) {
+		mw := New(Config{Providers: []ProviderRoute{base}})
+
+		out, err := mw.Invoke(context.Background(), newInputWithModel("gpt-4o"))
+		require.NoError(t, err)
+		require.NotNil(t, out.Mutations.RewriteUpstream, "matched route must emit upstream rewrite")
+		assert.False(t, out.Mutations.RewriteUpstream.SkipTLSVerify,
+			"skip_tls_verify must default to false when the route does not set it")
+	})
+}
+
 func TestRouter_MissingModel(t *testing.T) {
 	mw := New(Config{Providers: []ProviderRoute{{
 		ID:              "openai-prod",
diff --git a/proxy/internal/middleware/types.go b/proxy/internal/middleware/types.go
index 1b49e6159..1ed5c9d88 100644
--- a/proxy/internal/middleware/types.go
+++ b/proxy/internal/middleware/types.go
@@ -243,6 +243,10 @@ type UpstreamRewrite struct {
 	StripPathPrefix string
 	AuthHeader      *AuthHeader
 	StripHeaders    []string
+	// SkipTLSVerify, when true, makes the proxy dial the rewritten upstream
+	// without verifying its TLS certificate. Set by llm_router from the
+	// provider's skip_tls_verification for self-hosted / internal gateways.
+	SkipTLSVerify bool
 }
 
 // AuthHeader is a single name/value pair the proxy injects on the
diff --git a/proxy/internal/proxy/reverseproxy.go b/proxy/internal/proxy/reverseproxy.go
index 2c0304ecd..835a1c0b2 100644
--- a/proxy/internal/proxy/reverseproxy.go
+++ b/proxy/internal/proxy/reverseproxy.go
@@ -346,6 +346,11 @@ func (p *ReverseProxy) forwardUpstream(respWriter http.ResponseWriter, r *http.R
 		r.Host = effectiveURL.Host
 		applyUpstreamHeaders(r, upstreamRewrite)
 		stripUpstreamPathPrefix(r, upstreamRewrite.StripPathPrefix)
+		// A router-selected route (e.g. agent-network provider) can opt into
+		// skipping upstream TLS verification per its provider config.
+		if upstreamRewrite.SkipTLSVerify {
+			ctx = roundtrip.WithSkipTLSVerify(ctx)
+		}
 	}
 
 	rp := &httputil.ReverseProxy{
diff --git a/shared/management/http/api/openapi.yml b/shared/management/http/api/openapi.yml
index f11eb2c0a..f746b31f4 100644
--- a/shared/management/http/api/openapi.yml
+++ b/shared/management/http/api/openapi.yml
@@ -5119,6 +5119,10 @@ components:
           type: boolean
           description: Whether the provider is enabled.
           example: true
+        skip_tls_verification:
+          type: boolean
+          description: Whether upstream TLS certificate verification is skipped when the proxy dials this provider's URL. Intended for self-hosted / internal gateways behind a private or self-signed certificate.
+          example: false
         created_at:
           type: string
           format: date-time
@@ -5138,6 +5142,7 @@ components:
         - upstream_url
         - models
         - enabled
+        - skip_tls_verification
         - created_at
         - updated_at
     AgentNetworkProviderRequest:
@@ -5190,6 +5195,10 @@ components:
           type: boolean
           description: Whether the provider is enabled. Defaults to true on create.
           example: true
+        skip_tls_verification:
+          type: boolean
+          description: Skip upstream TLS certificate verification when the proxy dials this provider's URL. For self-hosted / internal gateways behind a private or self-signed certificate. Defaults to false. When omitted on update, the stored value is left unchanged.
+          example: false
       required:
         - provider_id
         - name
diff --git a/shared/management/http/api/types.gen.go b/shared/management/http/api/types.gen.go
index 2a766b845..3b587c4bf 100644
--- a/shared/management/http/api/types.gen.go
+++ b/shared/management/http/api/types.gen.go
@@ -2224,6 +2224,9 @@ type AgentNetworkProvider struct {
 	// ProviderId Catalog identifier for the upstream AI provider (e.g. openai_api, anthropic_api, azure_openai_api, bedrock_api, vertex_ai_api, mistral_api, custom).
 	ProviderId string `json:"provider_id"`
 
+	// SkipTlsVerification Whether upstream TLS certificate verification is skipped when the proxy dials this provider's URL. Intended for self-hosted / internal gateways behind a private or self-signed certificate.
+	SkipTlsVerification bool `json:"skip_tls_verification"`
+
 	// UpdatedAt Timestamp when the provider was last updated.
 	UpdatedAt *time.Time `json:"updated_at,omitempty"`
 
@@ -2272,6 +2275,9 @@ type AgentNetworkProviderRequest struct {
 	// ProviderId Catalog identifier for the upstream AI provider (e.g. openai_api, anthropic_api, azure_openai_api, bedrock_api, vertex_ai_api, mistral_api, custom).
 	ProviderId string `json:"provider_id"`
 
+	// SkipTlsVerification Skip upstream TLS certificate verification when the proxy dials this provider's URL. For self-hosted / internal gateways behind a private or self-signed certificate. Defaults to false. When omitted on update, the stored value is left unchanged.
+	SkipTlsVerification *bool `json:"skip_tls_verification,omitempty"`
+
 	// UpstreamUrl Full upstream URL (with scheme) that NetBird forwards traffic to.
 	UpstreamUrl string `json:"upstream_url"`
 }

From 06839a4731a64fea2ef7fb0d4857c356ca0eb60f Mon Sep 17 00:00:00 2001
From: Zoltan Papp <zoltan.pmail@gmail.com>
Date: Wed, 1 Jul 2026 22:08:23 +0200
Subject: [PATCH 20/36] [client] Fix race between WG watcher initial handshake
 read and endpoint creation (#6626)

* [client] Fix race between WG watcher initial handshake read and endpoint config

The watcher's initial handshake read ran in a separate goroutine with no
ordering guarantee relative to the WireGuard endpoint configuration, so it
would sometimes race with the peer being added to the interface. Split
enabling into a synchronous PrepareInitialHandshake, called before the
endpoint is configured, and an EnableWgWatcher that only runs the
monitoring loop, making the baseline read deterministic and keeping it
correct for reconnects where the peer's WireGuard entry survives.

* [client] Skip WG watcher disconnect callback when context is cancelled

A superseded or cancelled watcher whose handshake-check timer fires before
it observes ctx.Done() would still invoke onDisconnectedFn, tearing down a
now-healthy connection. Re-check ctx before firing the disconnect and
handshake-success callbacks and stand down silently if it was cancelled.
---
 client/internal/peer/conn.go            | 18 ++++++-----
 client/internal/peer/wg_watcher.go      | 41 ++++++++++++++-----------
 client/internal/peer/wg_watcher_test.go | 10 ++++++
 3 files changed, 43 insertions(+), 26 deletions(-)

diff --git a/client/internal/peer/conn.go b/client/internal/peer/conn.go
index 85e54ba5f..fb468696f 100644
--- a/client/internal/peer/conn.go
+++ b/client/internal/peer/conn.go
@@ -803,15 +803,17 @@ func (conn *Conn) isConnectedOnAllWay() (status guard.ConnStatus) {
 }
 
 func (conn *Conn) enableWgWatcherIfNeeded(enabledTime time.Time) {
-	if !conn.wgWatcher.IsEnabled() {
-		wgWatcherCtx, wgWatcherCancel := context.WithCancel(conn.ctx)
-		conn.wgWatcherCancel = wgWatcherCancel
-		conn.wgWatcherWg.Add(1)
-		go func() {
-			defer conn.wgWatcherWg.Done()
-			conn.wgWatcher.EnableWgWatcher(wgWatcherCtx, enabledTime, conn.onWGDisconnected, conn.onWGHandshakeSuccess)
-		}()
+	if !conn.wgWatcher.PrepareInitialHandshake() {
+		return
 	}
+
+	wgWatcherCtx, wgWatcherCancel := context.WithCancel(conn.ctx)
+	conn.wgWatcherCancel = wgWatcherCancel
+	conn.wgWatcherWg.Add(1)
+	go func() {
+		defer conn.wgWatcherWg.Done()
+		conn.wgWatcher.EnableWgWatcher(wgWatcherCtx, enabledTime, conn.onWGDisconnected, conn.onWGHandshakeSuccess)
+	}()
 }
 
 func (conn *Conn) disableWgWatcherIfNeeded() {
diff --git a/client/internal/peer/wg_watcher.go b/client/internal/peer/wg_watcher.go
index 805a6f24a..4fc883d17 100644
--- a/client/internal/peer/wg_watcher.go
+++ b/client/internal/peer/wg_watcher.go
@@ -31,7 +31,9 @@ type WGWatcher struct {
 	stateDump     *stateDump
 
 	enabled   bool
-	muEnabled sync.RWMutex
+	muEnabled sync.Mutex
+	// initialHandshake is not thread-safe; never call PrepareInitialHandshake and EnableWgWatcher concurrently.
+	initialHandshake time.Time
 
 	resetCh chan struct{}
 }
@@ -46,38 +48,38 @@ func NewWGWatcher(log *log.Entry, wgIfaceStater WGInterfaceStater, peerKey strin
 	}
 }
 
-// EnableWgWatcher starts the WireGuard watcher. If it is already enabled, it will return immediately and do nothing.
-// The watcher runs until ctx is cancelled. Caller is responsible for context lifecycle management.
-func (w *WGWatcher) EnableWgWatcher(ctx context.Context, enabledTime time.Time, onDisconnectedFn func(), onHandshakeSuccessFn func(when time.Time)) {
+// PrepareInitialHandshake reserves the watcher and reads the peer's current WireGuard
+// handshake time. It must be called before the peer is (re)configured on the WireGuard
+// interface, so the captured baseline reflects the state prior to this connection attempt
+// instead of racing with that configuration. Returns ok=false if the watcher is already
+// running, in which case EnableWgWatcher must not be called.
+func (w *WGWatcher) PrepareInitialHandshake() (ok bool) {
 	w.muEnabled.Lock()
 	if w.enabled {
 		w.muEnabled.Unlock()
-		return
+		return false
 	}
 
 	w.log.Debugf("enable WireGuard watcher")
 	w.enabled = true
 	w.muEnabled.Unlock()
 
-	initialHandshake, err := w.wgState()
-	if err != nil {
-		w.log.Warnf("failed to read initial wg stats: %v", err)
-	}
+	handshake, _ := w.wgState()
+	w.initialHandshake = handshake
+	return true
+}
 
-	w.periodicHandshakeCheck(ctx, onDisconnectedFn, onHandshakeSuccessFn, enabledTime, initialHandshake)
+// EnableWgWatcher runs the WireGuard watcher loop using the handshake baseline captured by
+// PrepareInitialHandshake. The watcher runs until ctx is cancelled. Caller is responsible
+// for context lifecycle management.
+func (w *WGWatcher) EnableWgWatcher(ctx context.Context, enabledTime time.Time, onDisconnectedFn func(), onHandshakeSuccessFn func(when time.Time)) {
+	w.periodicHandshakeCheck(ctx, onDisconnectedFn, onHandshakeSuccessFn, enabledTime, w.initialHandshake)
 
 	w.muEnabled.Lock()
 	w.enabled = false
 	w.muEnabled.Unlock()
 }
 
-// IsEnabled returns true if the WireGuard watcher is currently enabled
-func (w *WGWatcher) IsEnabled() bool {
-	w.muEnabled.RLock()
-	defer w.muEnabled.RUnlock()
-	return w.enabled
-}
-
 // Reset signals the watcher that the WireGuard peer has been reset and a new
 // handshake is expected. This restarts the handshake timeout from scratch.
 func (w *WGWatcher) Reset() {
@@ -101,13 +103,16 @@ func (w *WGWatcher) periodicHandshakeCheck(ctx context.Context, onDisconnectedFn
 		case <-timer.C:
 			handshake, ok := w.handshakeCheck(lastHandshake)
 			if !ok {
+				if ctx.Err() != nil {
+					return
+				}
 				onDisconnectedFn()
 				return
 			}
 			if lastHandshake.IsZero() {
 				elapsed := calcElapsed(enabledTime, *handshake)
 				w.log.Infof("first wg handshake detected within: %.2fsec, (%s)", elapsed, handshake)
-				if onHandshakeSuccessFn != nil {
+				if onHandshakeSuccessFn != nil && ctx.Err() == nil {
 					onHandshakeSuccessFn(*handshake)
 				}
 			}
diff --git a/client/internal/peer/wg_watcher_test.go b/client/internal/peer/wg_watcher_test.go
index 3ce91cd46..634d7974f 100644
--- a/client/internal/peer/wg_watcher_test.go
+++ b/client/internal/peer/wg_watcher_test.go
@@ -7,6 +7,7 @@ import (
 	"time"
 
 	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/client/iface/configurer"
 )
@@ -34,6 +35,9 @@ func TestWGWatcher_EnableWgWatcher(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
+	ok := watcher.PrepareInitialHandshake()
+	require.True(t, ok, "watcher should not be enabled yet")
+
 	onDisconnected := make(chan struct{}, 1)
 	go watcher.EnableWgWatcher(ctx, time.Now(), func() {
 		mlog.Infof("onDisconnectedFn")
@@ -62,6 +66,9 @@ func TestWGWatcher_ReEnable(t *testing.T) {
 	watcher := NewWGWatcher(mlog, mocWgIface, "", newStateDump("peer", mlog, &Status{}))
 
 	ctx, cancel := context.WithCancel(context.Background())
+	ok := watcher.PrepareInitialHandshake()
+	require.True(t, ok, "watcher should not be enabled yet")
+
 	wg := &sync.WaitGroup{}
 	wg.Add(1)
 	go func() {
@@ -76,6 +83,9 @@ func TestWGWatcher_ReEnable(t *testing.T) {
 	ctx, cancel = context.WithCancel(context.Background())
 	defer cancel()
 
+	ok = watcher.PrepareInitialHandshake()
+	require.True(t, ok, "watcher should be re-enabled after the previous run stopped")
+
 	onDisconnected := make(chan struct{}, 1)
 	go watcher.EnableWgWatcher(ctx, time.Now(), func() {
 		onDisconnected <- struct{}{}

From 7d4736de5579fecbef172e203ec7f6a424ac2885 Mon Sep 17 00:00:00 2001
From: Maycon Santos <mlsmaycon@gmail.com>
Date: Wed, 1 Jul 2026 22:08:43 +0200
Subject: [PATCH 21/36] [management] Enable lazy connections by default on new
 accounts (#6571)

With improvements in userspace lazy connection handling, we should be able to enable it for new accounts with less impact on users.

These connections are cheaper and only target traffic that should go through the tunnels, leaving all other tunnels in an idle state.
---
 management/server/account.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/management/server/account.go b/management/server/account.go
index 94335cf27..9d2759cb7 100644
--- a/management/server/account.go
+++ b/management/server/account.go
@@ -2057,6 +2057,7 @@ func newAccountWithId(ctx context.Context, accountID, userID, domain, email, nam
 			Extra: &types.ExtraSettings{
 				UserApprovalRequired: true,
 			},
+			LazyConnectionEnabled: true,
 		},
 		Onboarding: types.AccountOnboarding{
 			OnboardingFlowPending: true,

From 1d8b5f6e5cf08290b02af1f1300b33d0de723c4f Mon Sep 17 00:00:00 2001
From: Viktor Liu <17948409+lixmal@users.noreply.github.com>
Date: Thu, 2 Jul 2026 17:58:16 +0900
Subject: [PATCH 22/36] [client] Make lazy connections opt-out via NB_LAZY_CONN
 (#6617)

---
 client/android/env_list.go                    |  2 +-
 client/cmd/root.go                            | 17 ++--
 client/cmd/up.go                              | 10 ---
 client/internal/auth/auth.go                  |  1 -
 client/internal/conn_mgr.go                   | 55 ++++++++++---
 client/internal/conn_mgr_test.go              | 40 +++++++++
 client/internal/connect.go                    |  4 +-
 client/internal/debug/debug.go                |  2 +-
 client/internal/debug/debug_test.go           |  2 +-
 client/internal/engine.go                     |  7 +-
 client/internal/lazyconn/env.go               | 57 ++++++++++---
 client/internal/lazyconn/env_test.go          | 45 +++++++++++
 client/internal/profilemanager/config.go      | 21 ++---
 .../profilemanager/config_mdm_test.go         | 31 +++++++
 client/ios/NetBirdSDK/env_list.go             |  2 +-
 client/mdm/canonical_loaders.go               |  1 +
 client/mdm/policy.go                          | 14 +++-
 client/mdm/policy_test.go                     | 13 ++-
 client/server/mdm.go                          |  3 -
 client/server/server.go                       |  3 -
 client/server/setconfig_test.go               | 81 +++++++++----------
 client/system/info.go                         |  6 +-
 client/ui/client_ui.go                        | 35 +++-----
 client/ui/const.go                            |  1 -
 client/ui/event_handler.go                    | 11 ---
 shared/management/client/grpc.go              |  2 -
 26 files changed, 312 insertions(+), 154 deletions(-)
 create mode 100644 client/internal/conn_mgr_test.go
 create mode 100644 client/internal/lazyconn/env_test.go

diff --git a/client/android/env_list.go b/client/android/env_list.go
index a0a4d7040..d0e0a1e78 100644
--- a/client/android/env_list.go
+++ b/client/android/env_list.go
@@ -10,7 +10,7 @@ var (
 	EnvKeyNBForceRelay = peer.EnvKeyNBForceRelay
 
 	// EnvKeyNBLazyConn Exported for Android java client to configure lazy connection
-	EnvKeyNBLazyConn = lazyconn.EnvEnableLazyConn
+	EnvKeyNBLazyConn = lazyconn.EnvLazyConn
 
 	// EnvKeyNBInactivityThreshold Exported for Android java client to configure connection inactivity threshold
 	EnvKeyNBInactivityThreshold = lazyconn.EnvInactivityThreshold
diff --git a/client/cmd/root.go b/client/cmd/root.go
index f3fde2f1c..f1ef32717 100644
--- a/client/cmd/root.go
+++ b/client/cmd/root.go
@@ -71,12 +71,14 @@ var (
 	extraIFaceBlackList     []string
 	anonymizeFlag           bool
 	dnsRouteInterval        time.Duration
-	lazyConnEnabled         bool
-	mtu                     uint16
-	profilesDisabled        bool
-	updateSettingsDisabled  bool
-	captureEnabled          bool
-	networksDisabled        bool
+	// lazyConnEnabled is the parse target for the deprecated --enable-lazy-connection
+	// flag. The flag is inert; the value is no longer read (use NB_LAZY_CONN instead).
+	lazyConnEnabled        bool
+	mtu                    uint16
+	profilesDisabled       bool
+	updateSettingsDisabled bool
+	captureEnabled         bool
+	networksDisabled       bool
 
 	rootCmd = &cobra.Command{
 		Use:          "netbird",
@@ -210,7 +212,8 @@ func init() {
 	upCmd.PersistentFlags().BoolVar(&rosenpassEnabled, enableRosenpassFlag, false, "[Experimental] Enable Rosenpass feature. If enabled, the connection will be post-quantum secured via Rosenpass.")
 	upCmd.PersistentFlags().BoolVar(&rosenpassPermissive, rosenpassPermissiveFlag, false, "[Experimental] Enable Rosenpass in permissive mode to allow this peer to accept WireGuard connections without requiring Rosenpass functionality from peers that do not have Rosenpass enabled.")
 	upCmd.PersistentFlags().BoolVar(&autoConnectDisabled, disableAutoConnectFlag, false, "Disables auto-connect feature. If enabled, then the client won't connect automatically when the service starts.")
-	upCmd.PersistentFlags().BoolVar(&lazyConnEnabled, enableLazyConnectionFlag, false, "[Experimental] Enable the lazy connection feature. If enabled, the client will establish connections on-demand. Note: this setting may be overridden by management configuration.")
+	upCmd.PersistentFlags().BoolVar(&lazyConnEnabled, enableLazyConnectionFlag, false, "Deprecated: no longer used. Lazy connections are controlled by the server and the NB_LAZY_CONN environment variable.")
+	_ = upCmd.PersistentFlags().MarkDeprecated(enableLazyConnectionFlag, "no longer used; lazy connections are controlled by the server and the NB_LAZY_CONN environment variable")
 
 }
 
diff --git a/client/cmd/up.go b/client/cmd/up.go
index 0506bc65b..8b3de3c66 100644
--- a/client/cmd/up.go
+++ b/client/cmd/up.go
@@ -479,10 +479,6 @@ func setupSetConfigReq(customDNSAddressConverted []byte, cmd *cobra.Command, pro
 		req.DisableIpv6 = &disableIPv6
 	}
 
-	if cmd.Flag(enableLazyConnectionFlag).Changed {
-		req.LazyConnectionEnabled = &lazyConnEnabled
-	}
-
 	return &req
 }
 
@@ -600,9 +596,6 @@ func setupConfig(customDNSAddressConverted []byte, cmd *cobra.Command, configFil
 		ic.DisableIPv6 = &disableIPv6
 	}
 
-	if cmd.Flag(enableLazyConnectionFlag).Changed {
-		ic.LazyConnectionEnabled = &lazyConnEnabled
-	}
 	return &ic, nil
 }
 
@@ -718,9 +711,6 @@ func setupLoginRequest(providedSetupKey string, customDNSAddressConverted []byte
 		loginRequest.DisableIpv6 = &disableIPv6
 	}
 
-	if cmd.Flag(enableLazyConnectionFlag).Changed {
-		loginRequest.LazyConnectionEnabled = &lazyConnEnabled
-	}
 	return &loginRequest, nil
 }
 
diff --git a/client/internal/auth/auth.go b/client/internal/auth/auth.go
index afc8ee77f..850e0706d 100644
--- a/client/internal/auth/auth.go
+++ b/client/internal/auth/auth.go
@@ -322,7 +322,6 @@ func (a *Auth) setSystemInfoFlags(info *system.Info) {
 		a.config.BlockLANAccess,
 		a.config.BlockInbound,
 		a.config.DisableIPv6,
-		a.config.LazyConnectionEnabled,
 		a.config.EnableSSHRoot,
 		a.config.EnableSSHSFTP,
 		a.config.EnableSSHLocalPortForwarding,
diff --git a/client/internal/conn_mgr.go b/client/internal/conn_mgr.go
index 112559132..a82a4ca8b 100644
--- a/client/internal/conn_mgr.go
+++ b/client/internal/conn_mgr.go
@@ -16,6 +16,16 @@ import (
 	"github.com/netbirdio/netbird/route"
 )
 
+// lazyForce is the resolved local decision for lazy connections, layered above the
+// management feature flag. lazyForceNone defers to management.
+type lazyForce int
+
+const (
+	lazyForceNone lazyForce = iota
+	lazyForceOn
+	lazyForceOff
+)
+
 // ConnMgr coordinates both lazy connections (established on-demand) and permanent peer connections.
 //
 // The connection manager is responsible for:
@@ -28,7 +38,7 @@ type ConnMgr struct {
 	peerStore        *peerstore.Store
 	statusRecorder   *peer.Status
 	iface            lazyconn.WGIface
-	enabledLocally   bool
+	force            lazyForce
 	rosenpassEnabled bool
 
 	lazyConnMgr *manager.Manager
@@ -43,28 +53,34 @@ func NewConnMgr(engineConfig *EngineConfig, statusRecorder *peer.Status, peerSto
 		peerStore:        peerStore,
 		statusRecorder:   statusRecorder,
 		iface:            iface,
+		force:            resolveLazyForce(engineConfig.LazyConnection),
 		rosenpassEnabled: engineConfig.RosenpassEnabled,
 	}
-	if engineConfig.LazyConnectionEnabled || lazyconn.IsLazyConnEnabledByEnv() {
-		e.enabledLocally = true
-	}
 	return e
 }
 
-// Start initializes the connection manager and starts the lazy connection manager if enabled by env var or cmd line option.
+// Start initializes the connection manager. It starts the lazy connection manager when a
+// local override forces it on; with no local override it waits for the management feature flag.
 func (e *ConnMgr) Start(ctx context.Context) {
 	if e.lazyConnMgr != nil {
 		log.Errorf("lazy connection manager is already started")
 		return
 	}
 
-	if !e.enabledLocally {
-		log.Infof("lazy connection manager is disabled")
+	switch e.force {
+	case lazyForceOff:
+		log.Infof("lazy connection manager is disabled by local override (%s or MDM policy)", lazyconn.EnvLazyConn)
+		e.statusRecorder.UpdateLazyConnection(false)
+		return
+	case lazyForceNone:
+		log.Infof("lazy connection manager is managed by the management feature flag")
+		e.statusRecorder.UpdateLazyConnection(false)
 		return
 	}
 
 	if e.rosenpassEnabled {
 		log.Warnf("rosenpass connection manager is enabled, lazy connection manager will not be started")
+		e.statusRecorder.UpdateLazyConnection(false)
 		return
 	}
 
@@ -76,8 +92,8 @@ func (e *ConnMgr) Start(ctx context.Context) {
 // If enabled, it initializes the lazy connection manager and start it. Do not need to call Start() again.
 // If disabled, then it closes the lazy connection manager and open the connections to all peers.
 func (e *ConnMgr) UpdatedRemoteFeatureFlag(ctx context.Context, enabled bool) error {
-	// do not disable lazy connection manager if it was enabled by env var
-	if e.enabledLocally {
+	// a local override (NB_LAZY_CONN or local config) takes precedence over management
+	if e.force != lazyForceNone {
 		return nil
 	}
 
@@ -89,6 +105,7 @@ func (e *ConnMgr) UpdatedRemoteFeatureFlag(ctx context.Context, enabled bool) er
 
 		if e.rosenpassEnabled {
 			log.Infof("rosenpass connection manager is enabled, lazy connection manager will not be started")
+			e.statusRecorder.UpdateLazyConnection(false)
 			return nil
 		}
 
@@ -98,6 +115,7 @@ func (e *ConnMgr) UpdatedRemoteFeatureFlag(ctx context.Context, enabled bool) er
 		return e.addPeersToLazyConnManager()
 	} else {
 		if e.lazyConnMgr == nil {
+			e.statusRecorder.UpdateLazyConnection(false)
 			return nil
 		}
 		log.Infof("lazy connection manager is disabled by management feature flag")
@@ -309,6 +327,25 @@ func (e *ConnMgr) isStartedWithLazyMgr() bool {
 	return e.lazyConnMgr != nil && e.lazyCtxCancel != nil
 }
 
+// resolveLazyForce determines the local override. NB_LAZY_CONN takes precedence; when it
+// is unset the MDM policy override (mdmState) applies. Either wins in both directions over
+// the management feature flag; StateUnset for both defers to management.
+func resolveLazyForce(mdmState lazyconn.State) lazyForce {
+	state := lazyconn.EnvState()
+	if state == lazyconn.StateUnset {
+		state = mdmState
+	}
+
+	switch state {
+	case lazyconn.StateOn:
+		return lazyForceOn
+	case lazyconn.StateOff:
+		return lazyForceOff
+	default:
+		return lazyForceNone
+	}
+}
+
 func inactivityThresholdEnv() *time.Duration {
 	envValue := os.Getenv(lazyconn.EnvInactivityThreshold)
 	if envValue == "" {
diff --git a/client/internal/conn_mgr_test.go b/client/internal/conn_mgr_test.go
new file mode 100644
index 000000000..5e2c53e35
--- /dev/null
+++ b/client/internal/conn_mgr_test.go
@@ -0,0 +1,40 @@
+package internal
+
+import (
+	"os"
+	"testing"
+
+	"github.com/netbirdio/netbird/client/internal/lazyconn"
+)
+
+func TestResolveLazyForce(t *testing.T) {
+	tests := []struct {
+		name   string
+		env    string
+		envSet bool
+		mdm    lazyconn.State
+		want   lazyForce
+	}{
+		{name: "env unset, mdm unset -> defer to management", mdm: lazyconn.StateUnset, want: lazyForceNone},
+		{name: "env on -> force on", env: "on", envSet: true, mdm: lazyconn.StateUnset, want: lazyForceOn},
+		{name: "env off -> force off", env: "off", envSet: true, mdm: lazyconn.StateUnset, want: lazyForceOff},
+		{name: "env unset, mdm on -> force on", mdm: lazyconn.StateOn, want: lazyForceOn},
+		{name: "env unset, mdm off -> force off", mdm: lazyconn.StateOff, want: lazyForceOff},
+		{name: "env on beats mdm off", env: "on", envSet: true, mdm: lazyconn.StateOff, want: lazyForceOn},
+		{name: "env off beats mdm on", env: "off", envSet: true, mdm: lazyconn.StateOn, want: lazyForceOff},
+		{name: "unrecognized env, mdm on -> mdm wins", env: "auto", envSet: true, mdm: lazyconn.StateOn, want: lazyForceOn},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Setenv(lazyconn.EnvLazyConn, tt.env)
+			if !tt.envSet {
+				os.Unsetenv(lazyconn.EnvLazyConn)
+			}
+
+			if got := resolveLazyForce(tt.mdm); got != tt.want {
+				t.Fatalf("resolveLazyForce(%v) = %v, want %v", tt.mdm, got, tt.want)
+			}
+		})
+	}
+}
diff --git a/client/internal/connect.go b/client/internal/connect.go
index eff2c9489..93467b09a 100644
--- a/client/internal/connect.go
+++ b/client/internal/connect.go
@@ -27,6 +27,7 @@ import (
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/netstack"
 	"github.com/netbirdio/netbird/client/internal/dns"
+	"github.com/netbirdio/netbird/client/internal/lazyconn"
 	"github.com/netbirdio/netbird/client/internal/listener"
 	"github.com/netbirdio/netbird/client/internal/metrics"
 	"github.com/netbirdio/netbird/client/internal/peer"
@@ -601,7 +602,7 @@ func createEngineConfig(key wgtypes.Key, config *profilemanager.Config, peerConf
 		BlockInbound:        config.BlockInbound,
 		DisableIPv6:         config.DisableIPv6,
 
-		LazyConnectionEnabled: config.LazyConnectionEnabled,
+		LazyConnection: lazyconn.ParseState(config.LazyConnection),
 
 		MTU:     selectMTU(config.MTU, peerConfig.Mtu),
 		LogPath: logPath,
@@ -675,7 +676,6 @@ func loginToManagement(ctx context.Context, client mgm.Client, pubSSHKey []byte,
 		config.BlockLANAccess,
 		config.BlockInbound,
 		config.DisableIPv6,
-		config.LazyConnectionEnabled,
 		config.EnableSSHRoot,
 		config.EnableSSHSFTP,
 		config.EnableSSHLocalPortForwarding,
diff --git a/client/internal/debug/debug.go b/client/internal/debug/debug.go
index a65d8bd05..5700b05de 100644
--- a/client/internal/debug/debug.go
+++ b/client/internal/debug/debug.go
@@ -681,7 +681,7 @@ func (g *BundleGenerator) addCommonConfigFields(configContent *strings.Builder)
 		configContent.WriteString(fmt.Sprintf("ClientCertKeyPath: %s\n", g.internalConfig.ClientCertKeyPath))
 	}
 
-	configContent.WriteString(fmt.Sprintf("LazyConnectionEnabled: %v\n", g.internalConfig.LazyConnectionEnabled))
+	configContent.WriteString(fmt.Sprintf("LazyConnection: %q\n", g.internalConfig.LazyConnection))
 	configContent.WriteString(fmt.Sprintf("MTU: %d\n", g.internalConfig.MTU))
 }
 
diff --git a/client/internal/debug/debug_test.go b/client/internal/debug/debug_test.go
index ca7785d35..8286f6852 100644
--- a/client/internal/debug/debug_test.go
+++ b/client/internal/debug/debug_test.go
@@ -885,7 +885,7 @@ func TestAddConfig_AllFieldsCovered(t *testing.T) {
 		DNSRouteInterval:              5 * time.Second,
 		ClientCertPath:                "/tmp/cert",
 		ClientCertKeyPath:             "/tmp/key",
-		LazyConnectionEnabled:         true,
+		LazyConnection:                "on",
 		MTU:                           1280,
 	}
 
diff --git a/client/internal/engine.go b/client/internal/engine.go
index fb1d08f5e..a08bea31b 100644
--- a/client/internal/engine.go
+++ b/client/internal/engine.go
@@ -40,6 +40,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/dnsfwd"
 	"github.com/netbirdio/netbird/client/internal/expose"
 	"github.com/netbirdio/netbird/client/internal/ingressgw"
+	"github.com/netbirdio/netbird/client/internal/lazyconn"
 	"github.com/netbirdio/netbird/client/internal/metrics"
 	"github.com/netbirdio/netbird/client/internal/netflow"
 	nftypes "github.com/netbirdio/netbird/client/internal/netflow/types"
@@ -147,7 +148,9 @@ type EngineConfig struct {
 	BlockInbound        bool
 	DisableIPv6         bool
 
-	LazyConnectionEnabled bool
+	// LazyConnection is the MDM-sourced lazy-connection override; StateUnset defers to
+	// the env var and management feature flag.
+	LazyConnection lazyconn.State
 
 	MTU uint16
 
@@ -1130,7 +1133,6 @@ func (e *Engine) applyInfoFlags(info *system.Info) {
 		e.config.BlockLANAccess,
 		e.config.BlockInbound,
 		e.config.DisableIPv6,
-		e.config.LazyConnectionEnabled,
 		e.config.EnableSSHRoot,
 		e.config.EnableSSHSFTP,
 		e.config.EnableSSHLocalPortForwarding,
@@ -1999,7 +2001,6 @@ func (e *Engine) readInitialSettings() ([]*route.Route, *nbdns.Config, bool, err
 		e.config.BlockLANAccess,
 		e.config.BlockInbound,
 		e.config.DisableIPv6,
-		e.config.LazyConnectionEnabled,
 		e.config.EnableSSHRoot,
 		e.config.EnableSSHSFTP,
 		e.config.EnableSSHLocalPortForwarding,
diff --git a/client/internal/lazyconn/env.go b/client/internal/lazyconn/env.go
index 649d1cd65..d408083e7 100644
--- a/client/internal/lazyconn/env.go
+++ b/client/internal/lazyconn/env.go
@@ -3,24 +3,57 @@ package lazyconn
 import (
 	"os"
 	"strconv"
+	"strings"
 
 	log "github.com/sirupsen/logrus"
 )
 
 const (
-	EnvEnableLazyConn      = "NB_ENABLE_EXPERIMENTAL_LAZY_CONN"
+	EnvLazyConn            = "NB_LAZY_CONN"
 	EnvInactivityThreshold = "NB_LAZY_CONN_INACTIVITY_THRESHOLD"
 )
 
-func IsLazyConnEnabledByEnv() bool {
-	val := os.Getenv(EnvEnableLazyConn)
-	if val == "" {
-		return false
-	}
-	enabled, err := strconv.ParseBool(val)
-	if err != nil {
-		log.Warnf("failed to parse %s: %v", EnvEnableLazyConn, err)
-		return false
-	}
-	return enabled
+// State is the tri-state local override for lazy connections read from the environment.
+type State int
+
+const (
+	// StateUnset means no local override; defer to the management feature flag.
+	StateUnset State = iota
+	// StateOn forces lazy connections on, overriding management.
+	StateOn
+	// StateOff forces lazy connections off, overriding management.
+	StateOff
+)
+
+// EnvState reads NB_LAZY_CONN and returns the local override state.
+func EnvState() State {
+	return ParseState(os.Getenv(EnvLazyConn))
+}
+
+// ParseState interprets a lazy-connection override value (from the environment or an MDM
+// policy). It accepts the on/off aliases plus any value strconv.ParseBool understands
+// (true/false/1/0). An empty or unrecognized value returns StateUnset so that the
+// management feature flag remains in control.
+func ParseState(raw string) State {
+	if raw == "" {
+		return StateUnset
+	}
+
+	normalized := strings.ToLower(strings.TrimSpace(raw))
+	switch normalized {
+	case "on":
+		return StateOn
+	case "off":
+		return StateOff
+	}
+
+	enabled, err := strconv.ParseBool(normalized)
+	if err != nil {
+		log.Warnf("failed to parse lazy connection value %q (from %s env or MDM policy): %v", raw, EnvLazyConn, err)
+		return StateUnset
+	}
+	if enabled {
+		return StateOn
+	}
+	return StateOff
 }
diff --git a/client/internal/lazyconn/env_test.go b/client/internal/lazyconn/env_test.go
new file mode 100644
index 000000000..59ee40c4b
--- /dev/null
+++ b/client/internal/lazyconn/env_test.go
@@ -0,0 +1,45 @@
+package lazyconn
+
+import (
+	"os"
+	"testing"
+)
+
+func TestEnvState(t *testing.T) {
+	tests := []struct {
+		value string
+		set   bool
+		want  State
+	}{
+		{set: false, want: StateUnset},
+		{value: "", set: true, want: StateUnset},
+		{value: "on", set: true, want: StateOn},
+		{value: "ON", set: true, want: StateOn},
+		{value: "true", set: true, want: StateOn},
+		{value: "1", set: true, want: StateOn},
+		{value: " on ", set: true, want: StateOn},
+		{value: "off", set: true, want: StateOff},
+		{value: "OFF", set: true, want: StateOff},
+		{value: "false", set: true, want: StateOff},
+		{value: "0", set: true, want: StateOff},
+		{value: "auto", set: true, want: StateUnset},
+		{value: "garbage", set: true, want: StateUnset},
+	}
+
+	for _, tt := range tests {
+		name := tt.value
+		if !tt.set {
+			name = "unset"
+		}
+		t.Run(name, func(t *testing.T) {
+			t.Setenv(EnvLazyConn, tt.value)
+			if !tt.set {
+				os.Unsetenv(EnvLazyConn)
+			}
+
+			if got := EnvState(); got != tt.want {
+				t.Fatalf("EnvState() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
diff --git a/client/internal/profilemanager/config.go b/client/internal/profilemanager/config.go
index 8ffcb16f2..ed2f21999 100644
--- a/client/internal/profilemanager/config.go
+++ b/client/internal/profilemanager/config.go
@@ -101,8 +101,6 @@ type ConfigInput struct {
 
 	DNSLabels domain.List
 
-	LazyConnectionEnabled *bool
-
 	MTU *uint16
 }
 
@@ -180,7 +178,9 @@ type Config struct {
 
 	ClientCertKeyPair *tls.Certificate `json:"-"`
 
-	LazyConnectionEnabled bool
+	// LazyConnection is the MDM-managed lazy-connection override ("on"/"off"/"").
+	// Runtime-only: re-derived from MDM policy on each load, never persisted.
+	LazyConnection string `json:"-"`
 
 	MTU uint16
 
@@ -632,12 +632,6 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.LazyConnectionEnabled != nil && *input.LazyConnectionEnabled != config.LazyConnectionEnabled {
-		log.Infof("switching lazy connection to %t", *input.LazyConnectionEnabled)
-		config.LazyConnectionEnabled = *input.LazyConnectionEnabled
-		updated = true
-	}
-
 	if input.MTU != nil && *input.MTU != config.MTU {
 		log.Infof("updating MTU to %d (old value %d)", *input.MTU, config.MTU)
 		config.MTU = *input.MTU
@@ -728,6 +722,15 @@ func (config *Config) applyMDMPolicy(policy *mdm.Policy) {
 			log.Warnf("MDM wireguard port %d out of range [1,65535]; keeping previous value", v)
 		}
 	}
+
+	if v, ok := policy.GetBool(mdm.KeyLazyConnection); ok {
+		state := "off"
+		if v {
+			state = "on"
+		}
+		config.LazyConnection = state
+		logApplied(mdm.KeyLazyConnection, state)
+	}
 }
 
 // parseURL parses and validates the URL for the named service. The URL
diff --git a/client/internal/profilemanager/config_mdm_test.go b/client/internal/profilemanager/config_mdm_test.go
index 6a201235e..c6a688ab2 100644
--- a/client/internal/profilemanager/config_mdm_test.go
+++ b/client/internal/profilemanager/config_mdm_test.go
@@ -130,6 +130,37 @@ func TestApply_MDMBoolKeysOverrideOnDiskValue(t *testing.T) {
 	assert.True(t, cfg.Policy().HasKey(mdm.KeyRosenpassEnabled))
 }
 
+func TestApply_MDMLazyConnection(t *testing.T) {
+	cases := []struct {
+		name string
+		raw  any
+		want string
+	}{
+		{"native true", true, "on"},
+		{"native false", false, "off"},
+		{"string on", "on", "on"},
+		{"string off", "off", "off"},
+		{"string yes", "yes", "on"},
+		{"string no", "no", "off"},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+				mdm.KeyLazyConnection: c.raw,
+			}))
+
+			cfg, err := UpdateOrCreateConfig(ConfigInput{
+				ConfigPath: filepath.Join(t.TempDir(), "config.json"),
+			})
+			require.NoError(t, err)
+			require.NotNil(t, cfg)
+
+			assert.Equal(t, c.want, cfg.LazyConnection)
+			assert.True(t, cfg.Policy().HasKey(mdm.KeyLazyConnection))
+		})
+	}
+}
+
 func TestApply_MDMPreSharedKeyRedactionSentinelRejected(t *testing.T) {
 	const maskSentinel = "**********"
 
diff --git a/client/ios/NetBirdSDK/env_list.go b/client/ios/NetBirdSDK/env_list.go
index 88ac97957..a3ffa0ebe 100644
--- a/client/ios/NetBirdSDK/env_list.go
+++ b/client/ios/NetBirdSDK/env_list.go
@@ -38,7 +38,7 @@ func GetEnvKeyNBForceRelay() string {
 
 // GetEnvKeyNBLazyConn Exports the environment variable for the iOS client
 func GetEnvKeyNBLazyConn() string {
-	return lazyconn.EnvEnableLazyConn
+	return lazyconn.EnvLazyConn
 }
 
 // GetEnvKeyNBInactivityThreshold Exports the environment variable for the iOS client
diff --git a/client/mdm/canonical_loaders.go b/client/mdm/canonical_loaders.go
index 6e7ab19cb..b20a823fb 100644
--- a/client/mdm/canonical_loaders.go
+++ b/client/mdm/canonical_loaders.go
@@ -27,6 +27,7 @@ var allKeys = []string{
 	KeyWireguardPort,
 	KeySplitTunnelMode,
 	KeySplitTunnelApps,
+	KeyLazyConnection,
 }
 
 // canonicalKey maps the lowercase form of a managed-config value name to
diff --git a/client/mdm/policy.go b/client/mdm/policy.go
index 109fb322e..67b126101 100644
--- a/client/mdm/policy.go
+++ b/client/mdm/policy.go
@@ -11,6 +11,7 @@ package mdm
 import (
 	"sort"
 	"strconv"
+	"strings"
 
 	log "github.com/sirupsen/logrus"
 )
@@ -41,6 +42,11 @@ const (
 	// construction — only one mode can be set at a time.
 	KeySplitTunnelMode = "splitTunnelMode"
 	KeySplitTunnelApps = "splitTunnelApps"
+
+	// KeyLazyConnection forces the lazy-connection feature on or off, overriding
+	// the management feature flag. Read as a bool (native bool, or on/off,
+	// true/false, 1/0, yes/no); absent = defer to management.
+	KeyLazyConnection = "lazyConnection"
 )
 
 // Split-tunnel mode literals (KeySplitTunnelMode values).
@@ -62,12 +68,13 @@ var boolStringLiterals = map[string]bool{
 	"true":  true,
 	"1":     true,
 	"yes":   true,
+	"on":    true,
 	"false": false,
 	"0":     false,
 	"no":    false,
+	"off":   false,
 }
 
-
 // Policy holds MDM-managed settings read from the platform source. A nil or
 // empty Policy means no enforcement is active.
 type Policy struct {
@@ -150,7 +157,8 @@ func (p *Policy) GetString(key string) (string, bool) {
 }
 
 // GetBool returns the managed value for key coerced to bool, and whether the
-// key was set. Accepts native bool and string literals "true"/"false"/"1"/"0".
+// key was set. Accepts native bool and string literals (true/false, 1/0,
+// yes/no, on/off), case-insensitively and trimmed of surrounding whitespace.
 func (p *Policy) GetBool(key string) (bool, bool) {
 	if p == nil {
 		return false, false
@@ -163,7 +171,7 @@ func (p *Policy) GetBool(key string) (bool, bool) {
 	case bool:
 		return t, true
 	case string:
-		b, known := boolStringLiterals[t]
+		b, known := boolStringLiterals[strings.ToLower(strings.TrimSpace(t))]
 		return b, known
 	case int:
 		return t != 0, true
diff --git a/client/mdm/policy_test.go b/client/mdm/policy_test.go
index 47a6ed2c9..6cbe69776 100644
--- a/client/mdm/policy_test.go
+++ b/client/mdm/policy_test.go
@@ -31,8 +31,8 @@ func TestPolicy_Empty(t *testing.T) {
 
 func TestPolicy_HasKey(t *testing.T) {
 	p := NewPolicy(map[string]any{
-		KeyManagementURL:    "https://corp.example.com",
-		KeyDisableProfiles:  true,
+		KeyManagementURL:   "https://corp.example.com",
+		KeyDisableProfiles: true,
 	})
 	assert.False(t, p.IsEmpty())
 	assert.True(t, p.HasKey(KeyManagementURL))
@@ -53,8 +53,8 @@ func TestPolicy_ManagedKeysSorted(t *testing.T) {
 func TestPolicy_GetString(t *testing.T) {
 	p := NewPolicy(map[string]any{
 		KeyManagementURL:   "https://corp.example.com",
-		KeyDisableProfiles: true,            // wrong type for GetString
-		KeyPreSharedKey:        "",              // empty rejected
+		KeyDisableProfiles: true, // wrong type for GetString
+		KeyPreSharedKey:    "",   // empty rejected
 	})
 	v, ok := p.GetString(KeyManagementURL)
 	assert.True(t, ok)
@@ -85,6 +85,11 @@ func TestPolicy_GetBool(t *testing.T) {
 		{"string 0", "0", false, true},
 		{"string yes", "yes", true, true},
 		{"string no", "no", false, true},
+		{"string on", "on", true, true},
+		{"string off", "off", false, true},
+		{"mixed case On", "On", true, true},
+		{"upper TRUE", "TRUE", true, true},
+		{"padded yes", "  yes  ", true, true},
 		{"int nonzero", 1, true, true},
 		{"int zero", 0, false, true},
 		{"int64 nonzero", int64(2), true, true},
diff --git a/client/server/mdm.go b/client/server/mdm.go
index 0da0ec5d1..db7db2759 100644
--- a/client/server/mdm.go
+++ b/client/server/mdm.go
@@ -152,7 +152,6 @@ func (s *Server) restartEngineForMDMLocked() error {
 	s.config = config
 	s.statusRecorder.UpdateManagementAddress(config.ManagementURL.String())
 	s.statusRecorder.UpdateRosenpass(config.RosenpassEnabled, config.RosenpassPermissive)
-	s.statusRecorder.UpdateLazyConnection(config.LazyConnectionEnabled)
 
 	ctx, cancel := context.WithCancel(s.rootCtx)
 	s.actCancel = cancel
@@ -305,7 +304,6 @@ func setConfigRequestHasConfigOverrides(msg *proto.SetConfigRequest) bool {
 		msg.DisableFirewall != nil ||
 		msg.BlockLanAccess != nil ||
 		msg.DisableNotifications != nil ||
-		msg.LazyConnectionEnabled != nil ||
 		msg.BlockInbound != nil ||
 		msg.DisableIpv6 != nil ||
 		msg.EnableSSHRoot != nil ||
@@ -348,7 +346,6 @@ func loginRequestHasConfigOverrides(msg *proto.LoginRequest) bool {
 		msg.BlockLanAccess != nil ||
 		msg.DisableNotifications != nil ||
 		len(msg.DnsLabels) > 0 || msg.CleanDNSLabels ||
-		msg.LazyConnectionEnabled != nil ||
 		msg.BlockInbound != nil
 }
 
diff --git a/client/server/server.go b/client/server/server.go
index 3f6dabc56..e8ef2f96e 100644
--- a/client/server/server.go
+++ b/client/server/server.go
@@ -214,7 +214,6 @@ func (s *Server) Start() error {
 
 	s.statusRecorder.UpdateManagementAddress(config.ManagementURL.String())
 	s.statusRecorder.UpdateRosenpass(config.RosenpassEnabled, config.RosenpassPermissive)
-	s.statusRecorder.UpdateLazyConnection(config.LazyConnectionEnabled)
 
 	if s.sessionWatcher == nil {
 		s.sessionWatcher = internal.NewSessionWatcher(s.rootCtx, s.statusRecorder)
@@ -463,7 +462,6 @@ func (s *Server) setConfigInputFromRequest(msg *proto.SetConfigRequest) (profile
 	config.DisableFirewall = msg.DisableFirewall
 	config.BlockLANAccess = msg.BlockLanAccess
 	config.DisableNotifications = msg.DisableNotifications
-	config.LazyConnectionEnabled = msg.LazyConnectionEnabled
 	config.BlockInbound = msg.BlockInbound
 	config.DisableIPv6 = msg.DisableIpv6
 	config.EnableSSHRoot = msg.EnableSSHRoot
@@ -1647,7 +1645,6 @@ func (s *Server) GetConfig(ctx context.Context, req *proto.GetConfigRequest) (*p
 		ServerSSHAllowed:              *cfg.ServerSSHAllowed,
 		RosenpassEnabled:              cfg.RosenpassEnabled,
 		RosenpassPermissive:           cfg.RosenpassPermissive,
-		LazyConnectionEnabled:         cfg.LazyConnectionEnabled,
 		BlockInbound:                  cfg.BlockInbound,
 		DisableNotifications:          disableNotifications,
 		NetworkMonitor:                networkMonitor,
diff --git a/client/server/setconfig_test.go b/client/server/setconfig_test.go
index 7c85d16ce..0e55257a9 100644
--- a/client/server/setconfig_test.go
+++ b/client/server/setconfig_test.go
@@ -69,43 +69,41 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 	disableFirewall := true
 	blockLANAccess := true
 	disableNotifications := true
-	lazyConnectionEnabled := true
 	blockInbound := true
 	disableIPv6 := true
 	mtu := int64(1280)
 	sshJWTCacheTTL := int32(300)
 
 	req := &proto.SetConfigRequest{
-		ProfileName:           profName,
-		Username:              currUser.Username,
-		ManagementUrl:         "https://new-api.netbird.io:443",
-		AdminURL:              "https://new-admin.netbird.io",
-		RosenpassEnabled:      &rosenpassEnabled,
-		RosenpassPermissive:   &rosenpassPermissive,
-		ServerSSHAllowed:      &serverSSHAllowed,
-		InterfaceName:         &interfaceName,
-		WireguardPort:         &wireguardPort,
-		OptionalPreSharedKey:  &preSharedKey,
-		DisableAutoConnect:    &disableAutoConnect,
-		NetworkMonitor:        &networkMonitor,
-		DisableClientRoutes:   &disableClientRoutes,
-		DisableServerRoutes:   &disableServerRoutes,
-		DisableDns:            &disableDNS,
-		DisableFirewall:       &disableFirewall,
-		BlockLanAccess:        &blockLANAccess,
-		DisableNotifications:  &disableNotifications,
-		LazyConnectionEnabled: &lazyConnectionEnabled,
-		BlockInbound:          &blockInbound,
-		DisableIpv6:           &disableIPv6,
-		NatExternalIPs:        []string{"1.2.3.4", "5.6.7.8"},
-		CleanNATExternalIPs:   false,
-		CustomDNSAddress:      []byte("1.1.1.1:53"),
-		ExtraIFaceBlacklist:   []string{"eth1", "eth2"},
-		DnsLabels:             []string{"label1", "label2"},
-		CleanDNSLabels:        false,
-		DnsRouteInterval:      durationpb.New(2 * time.Minute),
-		Mtu:                   &mtu,
-		SshJWTCacheTTL:        &sshJWTCacheTTL,
+		ProfileName:          profName,
+		Username:             currUser.Username,
+		ManagementUrl:        "https://new-api.netbird.io:443",
+		AdminURL:             "https://new-admin.netbird.io",
+		RosenpassEnabled:     &rosenpassEnabled,
+		RosenpassPermissive:  &rosenpassPermissive,
+		ServerSSHAllowed:     &serverSSHAllowed,
+		InterfaceName:        &interfaceName,
+		WireguardPort:        &wireguardPort,
+		OptionalPreSharedKey: &preSharedKey,
+		DisableAutoConnect:   &disableAutoConnect,
+		NetworkMonitor:       &networkMonitor,
+		DisableClientRoutes:  &disableClientRoutes,
+		DisableServerRoutes:  &disableServerRoutes,
+		DisableDns:           &disableDNS,
+		DisableFirewall:      &disableFirewall,
+		BlockLanAccess:       &blockLANAccess,
+		DisableNotifications: &disableNotifications,
+		BlockInbound:         &blockInbound,
+		DisableIpv6:          &disableIPv6,
+		NatExternalIPs:       []string{"1.2.3.4", "5.6.7.8"},
+		CleanNATExternalIPs:  false,
+		CustomDNSAddress:     []byte("1.1.1.1:53"),
+		ExtraIFaceBlacklist:  []string{"eth1", "eth2"},
+		DnsLabels:            []string{"label1", "label2"},
+		CleanDNSLabels:       false,
+		DnsRouteInterval:     durationpb.New(2 * time.Minute),
+		Mtu:                  &mtu,
+		SshJWTCacheTTL:       &sshJWTCacheTTL,
 	}
 
 	_, err = s.SetConfig(ctx, req)
@@ -140,7 +138,6 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 	require.Equal(t, blockLANAccess, cfg.BlockLANAccess)
 	require.NotNil(t, cfg.DisableNotifications)
 	require.Equal(t, disableNotifications, *cfg.DisableNotifications)
-	require.Equal(t, lazyConnectionEnabled, cfg.LazyConnectionEnabled)
 	require.Equal(t, blockInbound, cfg.BlockInbound)
 	require.Equal(t, disableIPv6, cfg.DisableIPv6)
 	require.Equal(t, []string{"1.2.3.4", "5.6.7.8"}, cfg.NATExternalIPs)
@@ -164,13 +161,14 @@ func verifyAllFieldsCovered(t *testing.T, req *proto.SetConfigRequest) {
 	t.Helper()
 
 	metadataFields := map[string]bool{
-		"state":               true, // protobuf internal
-		"sizeCache":           true, // protobuf internal
-		"unknownFields":       true, // protobuf internal
-		"Username":            true, // metadata
-		"ProfileName":         true, // metadata
-		"CleanNATExternalIPs": true, // control flag for clearing
-		"CleanDNSLabels":      true, // control flag for clearing
+		"state":                 true, // protobuf internal
+		"sizeCache":             true, // protobuf internal
+		"unknownFields":         true, // protobuf internal
+		"Username":              true, // metadata
+		"ProfileName":           true, // metadata
+		"CleanNATExternalIPs":   true, // control flag for clearing
+		"CleanDNSLabels":        true, // control flag for clearing
+		"LazyConnectionEnabled": true, // deprecated: proto field retained for compat, no longer applied
 	}
 
 	expectedFields := map[string]bool{
@@ -190,7 +188,6 @@ func verifyAllFieldsCovered(t *testing.T, req *proto.SetConfigRequest) {
 		"DisableFirewall":               true,
 		"BlockLanAccess":                true,
 		"DisableNotifications":          true,
-		"LazyConnectionEnabled":         true,
 		"BlockInbound":                  true,
 		"DisableIpv6":                   true,
 		"NatExternalIPs":                true,
@@ -252,7 +249,6 @@ func TestCLIFlags_MappedToSetConfig(t *testing.T) {
 		"block-lan-access":                  "BlockLanAccess",
 		"block-inbound":                     "BlockInbound",
 		"disable-ipv6":                      "DisableIpv6",
-		"enable-lazy-connection":            "LazyConnectionEnabled",
 		"external-ip-map":                   "NatExternalIPs",
 		"dns-resolver-address":              "CustomDNSAddress",
 		"extra-iface-blacklist":             "ExtraIFaceBlacklist",
@@ -269,7 +265,8 @@ func TestCLIFlags_MappedToSetConfig(t *testing.T) {
 
 	// SetConfigRequest fields that don't have CLI flags (settable only via UI or other means).
 	fieldsWithoutCLIFlags := map[string]bool{
-		"DisableNotifications": true, // Only settable via UI
+		"DisableNotifications":  true, // Only settable via UI
+		"LazyConnectionEnabled": true, // deprecated: no longer settable (managed by server + NB_LAZY_CONN)
 	}
 
 	// Get all SetConfigRequest fields to verify our map is complete.
diff --git a/client/system/info.go b/client/system/info.go
index 496b478a3..1838204b8 100644
--- a/client/system/info.go
+++ b/client/system/info.go
@@ -74,8 +74,6 @@ type Info struct {
 	BlockInbound        bool
 	DisableIPv6         bool
 
-	LazyConnectionEnabled bool
-
 	EnableSSHRoot                 bool
 	EnableSSHSFTP                 bool
 	EnableSSHLocalPortForwarding  bool
@@ -87,7 +85,7 @@ func (i *Info) SetFlags(
 	rosenpassEnabled, rosenpassPermissive bool,
 	serverSSHAllowed *bool,
 	disableClientRoutes, disableServerRoutes,
-	disableDNS, disableFirewall, blockLANAccess, blockInbound, disableIPv6, lazyConnectionEnabled bool,
+	disableDNS, disableFirewall, blockLANAccess, blockInbound, disableIPv6 bool,
 	enableSSHRoot, enableSSHSFTP, enableSSHLocalPortForwarding, enableSSHRemotePortForwarding *bool,
 	disableSSHAuth *bool,
 ) {
@@ -105,8 +103,6 @@ func (i *Info) SetFlags(
 	i.BlockInbound = blockInbound
 	i.DisableIPv6 = disableIPv6
 
-	i.LazyConnectionEnabled = lazyConnectionEnabled
-
 	if enableSSHRoot != nil {
 		i.EnableSSHRoot = *enableSSHRoot
 	}
diff --git a/client/ui/client_ui.go b/client/ui/client_ui.go
index 40fb4169d..2b19c2bf5 100644
--- a/client/ui/client_ui.go
+++ b/client/ui/client_ui.go
@@ -266,7 +266,6 @@ type serviceClient struct {
 	mAllowSSH          *systray.MenuItem
 	mAutoConnect       *systray.MenuItem
 	mEnableRosenpass   *systray.MenuItem
-	mLazyConnEnabled   *systray.MenuItem
 	mBlockInbound      *systray.MenuItem
 	mNotifications     *systray.MenuItem
 	mAdvancedSettings  *systray.MenuItem
@@ -336,11 +335,11 @@ type serviceClient struct {
 	// mNetworks + mExitNode submenu items. Combines features.DisableNetworks
 	// AND s.connected — both must be true for the menus to be active.
 	// Zero value (false) matches the Disable() call at AddMenuItem time.
-	networksMenuEnabled  bool
-	showNetworks         bool
-	wNetworks            fyne.Window
-	wProfiles            fyne.Window
-	wQuickActions        fyne.Window
+	networksMenuEnabled bool
+	showNetworks        bool
+	wNetworks           fyne.Window
+	wProfiles           fyne.Window
+	wQuickActions       fyne.Window
 
 	eventManager *event.Manager
 
@@ -1094,7 +1093,6 @@ func (s *serviceClient) onTrayReady() {
 	s.mAllowSSH = s.mSettings.AddSubMenuItemCheckbox("Allow SSH", allowSSHMenuDescr, false)
 	s.mAutoConnect = s.mSettings.AddSubMenuItemCheckbox("Connect on Startup", autoConnectMenuDescr, false)
 	s.mEnableRosenpass = s.mSettings.AddSubMenuItemCheckbox("Enable Quantum-Resistance", quantumResistanceMenuDescr, false)
-	s.mLazyConnEnabled = s.mSettings.AddSubMenuItemCheckbox("Enable Lazy Connections", lazyConnMenuDescr, false)
 	s.mBlockInbound = s.mSettings.AddSubMenuItemCheckbox("Block Inbound Connections", blockInboundMenuDescr, false)
 	s.mNotifications = s.mSettings.AddSubMenuItemCheckbox("Notifications", notificationsMenuDescr, false)
 	s.mSettings.AddSeparator()
@@ -1578,7 +1576,6 @@ func protoConfigToConfig(cfg *proto.GetConfigResponse) *profilemanager.Config {
 	config.RosenpassEnabled = cfg.RosenpassEnabled
 	config.RosenpassPermissive = cfg.RosenpassPermissive
 	config.DisableNotifications = &cfg.DisableNotifications
-	config.LazyConnectionEnabled = cfg.LazyConnectionEnabled
 	config.BlockInbound = cfg.BlockInbound
 	config.NetworkMonitor = &cfg.NetworkMonitor
 	config.DisableDNS = cfg.DisableDns
@@ -1682,12 +1679,6 @@ func (s *serviceClient) loadSettings() {
 		s.mEnableRosenpass.Uncheck()
 	}
 
-	if cfg.LazyConnectionEnabled {
-		s.mLazyConnEnabled.Check()
-	} else {
-		s.mLazyConnEnabled.Uncheck()
-	}
-
 	if cfg.BlockInbound {
 		s.mBlockInbound.Check()
 	} else {
@@ -1833,7 +1824,6 @@ func (s *serviceClient) updateConfig() error {
 	disableAutoStart := !s.mAutoConnect.Checked()
 	sshAllowed := s.mAllowSSH.Checked()
 	rosenpassEnabled := s.mEnableRosenpass.Checked()
-	lazyConnectionEnabled := s.mLazyConnEnabled.Checked()
 	blockInbound := s.mBlockInbound.Checked()
 	notificationsDisabled := !s.mNotifications.Checked()
 
@@ -1856,14 +1846,13 @@ func (s *serviceClient) updateConfig() error {
 	}
 
 	req := proto.SetConfigRequest{
-		ProfileName:           activeProf.ID.String(),
-		Username:              currUser.Username,
-		DisableAutoConnect:    &disableAutoStart,
-		ServerSSHAllowed:      &sshAllowed,
-		RosenpassEnabled:      &rosenpassEnabled,
-		LazyConnectionEnabled: &lazyConnectionEnabled,
-		BlockInbound:          &blockInbound,
-		DisableNotifications:  &notificationsDisabled,
+		ProfileName:          activeProf.ID.String(),
+		Username:             currUser.Username,
+		DisableAutoConnect:   &disableAutoStart,
+		ServerSSHAllowed:     &sshAllowed,
+		RosenpassEnabled:     &rosenpassEnabled,
+		BlockInbound:         &blockInbound,
+		DisableNotifications: &notificationsDisabled,
 	}
 
 	if _, err := conn.SetConfig(s.ctx, &req); err != nil {
diff --git a/client/ui/const.go b/client/ui/const.go
index 48619be75..ce7a9a294 100644
--- a/client/ui/const.go
+++ b/client/ui/const.go
@@ -4,7 +4,6 @@ const (
 	allowSSHMenuDescr          = "Allow SSH connections"
 	autoConnectMenuDescr       = "Connect automatically when the service starts"
 	quantumResistanceMenuDescr = "Enable post-quantum security via Rosenpass"
-	lazyConnMenuDescr          = "[Experimental] Enable lazy connections"
 	blockInboundMenuDescr      = "Block inbound connections to the local machine and routed networks"
 	notificationsMenuDescr     = "Enable notifications"
 	advancedSettingsMenuDescr  = "Advanced settings of the application"
diff --git a/client/ui/event_handler.go b/client/ui/event_handler.go
index 876fcef5f..902082308 100644
--- a/client/ui/event_handler.go
+++ b/client/ui/event_handler.go
@@ -43,8 +43,6 @@ func (h *eventHandler) listen(ctx context.Context) {
 			h.handleAutoConnectClick()
 		case <-h.client.mEnableRosenpass.ClickedCh:
 			h.handleRosenpassClick()
-		case <-h.client.mLazyConnEnabled.ClickedCh:
-			h.handleLazyConnectionClick()
 		case <-h.client.mBlockInbound.ClickedCh:
 			h.handleBlockInboundClick()
 		case <-h.client.mAdvancedSettings.ClickedCh:
@@ -152,15 +150,6 @@ func (h *eventHandler) handleRosenpassClick() {
 	}
 }
 
-func (h *eventHandler) handleLazyConnectionClick() {
-	h.toggleCheckbox(h.client.mLazyConnEnabled)
-	if err := h.updateConfigWithErr(); err != nil {
-		h.toggleCheckbox(h.client.mLazyConnEnabled) // revert checkbox state on error
-		log.Errorf("failed to update config: %v", err)
-		h.client.notifier.Send("Error", "Failed to update lazy connection settings")
-	}
-}
-
 func (h *eventHandler) handleBlockInboundClick() {
 	h.toggleCheckbox(h.client.mBlockInbound)
 	if err := h.updateConfigWithErr(); err != nil {
diff --git a/shared/management/client/grpc.go b/shared/management/client/grpc.go
index 781e66a3e..bd4585455 100644
--- a/shared/management/client/grpc.go
+++ b/shared/management/client/grpc.go
@@ -1030,8 +1030,6 @@ func infoToMetaData(info *system.Info) *proto.PeerSystemMeta {
 			BlockLANAccess:      info.BlockLANAccess,
 			BlockInbound:        info.BlockInbound,
 			DisableIPv6:         info.DisableIPv6,
-
-			LazyConnectionEnabled: info.LazyConnectionEnabled,
 		},
 
 		Capabilities: peerCapabilities(*info),

From 167be3a30fb4b90f5f22e1f1986fa15df58c1a8c Mon Sep 17 00:00:00 2001
From: Zoltan Papp <zoltan.pmail@gmail.com>
Date: Thu, 2 Jul 2026 12:15:57 +0200
Subject: [PATCH 23/36] [ci] Run privileged client tests natively with sudo on
 Linux (#6635)

Restore the pre-split native, sudo-based run for the Linux Client / Unit
job: build with the privileged tag and run under sudo, matching the darwin
job. Excludes the dockertest harness (client/testutil/privileged) so it does
not recurse into a container spawn. The Docker privileged job is kept as-is.
---
 .github/workflows/golang-test-linux.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/golang-test-linux.yml b/.github/workflows/golang-test-linux.yml
index 34b215c60..ce53261a4 100644
--- a/.github/workflows/golang-test-linux.yml
+++ b/.github/workflows/golang-test-linux.yml
@@ -158,7 +158,7 @@ jobs:
         run: git --no-pager diff --exit-code
 
       - name: Test
-        run: CGO_ENABLED=1 GOARCH=${{ matrix.arch }} CI=true go test -coverprofile=coverage.txt -tags devcert -timeout 10m -p 1 $(go list ./... | grep -v -e /management -e /signal -e /relay -e /proxy -e /combined)
+        run: CGO_ENABLED=1 GOARCH=${{ matrix.arch }} CI=true go test -coverprofile=coverage.txt -tags 'devcert privileged' -exec 'sudo --preserve-env=CI,CGO_ENABLED' -timeout 10m -p 1 $(go list ./... | grep -v -e /management -e /signal -e /relay -e /proxy -e /combined -e /client/testutil/privileged)
 
       - name: Upload coverage reports to Codecov
         if: matrix.arch == 'amd64'

From e203e0f42a14855fa30be0b79eb70397839552d5 Mon Sep 17 00:00:00 2001
From: Maycon Santos <mlsmaycon@gmail.com>
Date: Thu, 2 Jul 2026 14:20:23 +0200
Subject: [PATCH 24/36] [self-hosted] Remove unused server/proxy image override
 logic in getting-started.sh (#6636)

---
 infrastructure_files/getting-started.sh | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/infrastructure_files/getting-started.sh b/infrastructure_files/getting-started.sh
index 46bef5a1f..837cc42e6 100755
--- a/infrastructure_files/getting-started.sh
+++ b/infrastructure_files/getting-started.sh
@@ -351,11 +351,6 @@ initialize_default_values() {
   NETBIRD_STUN_PORT=3478
 
   # Docker images
-  # Record whether the operator explicitly pinned the server/proxy images via
-  # env vars, so the agent-network preset can pick its own defaults without
-  # clobbering an explicit override.
-  NETBIRD_SERVER_IMAGE_EXPLICIT=${NETBIRD_SERVER_IMAGE:+true}
-  NETBIRD_PROXY_IMAGE_EXPLICIT=${NETBIRD_PROXY_IMAGE:+true}
   DASHBOARD_IMAGE=${DASHBOARD_IMAGE:-"netbirdio/dashboard:latest"}
   # Combined server replaces separate signal, relay, and management containers
   NETBIRD_SERVER_IMAGE=${NETBIRD_SERVER_IMAGE:-"netbirdio/netbird-server:latest"}
@@ -415,15 +410,6 @@ apply_agent_network_preset() {
   ENABLE_PROXY="true"
   ENABLE_CROWDSEC="false"
 
-  # Agent-network ships dedicated server/proxy images. Honor an explicit
-  # env override; otherwise pin the agent-network builds.
-  if [[ "${NETBIRD_SERVER_IMAGE_EXPLICIT}" != "true" ]]; then
-    NETBIRD_SERVER_IMAGE="netbirdio/netbird-server:0.74.0-rc.2"
-  fi
-  if [[ "${NETBIRD_PROXY_IMAGE_EXPLICIT}" != "true" ]]; then
-    NETBIRD_PROXY_IMAGE="netbirdio/reverse-proxy:0.74.0-rc.2"
-  fi
-
   if [[ -n "${NETBIRD_LETSENCRYPT_EMAIL}" ]]; then
     TRAEFIK_ACME_EMAIL="${NETBIRD_LETSENCRYPT_EMAIL}"
   else

From e40cb294f6fe62b34ba5105f6ac726853dfbae6b Mon Sep 17 00:00:00 2001
From: Misha Bragin <bangvalo@gmail.com>
Date: Thu, 2 Jul 2026 14:45:24 +0200
Subject: [PATCH 25/36] [management] Add vLLM to Agent Network (#6643)

---
 .../modules/agentnetwork/catalog/catalog.go       | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/management/internals/modules/agentnetwork/catalog/catalog.go b/management/internals/modules/agentnetwork/catalog/catalog.go
index baf622778..962b30250 100644
--- a/management/internals/modules/agentnetwork/catalog/catalog.go
+++ b/management/internals/modules/agentnetwork/catalog/catalog.go
@@ -627,6 +627,21 @@ var providers = []Provider{
 		},
 		Models: []Model{},
 	},
+	{
+		// vLLM is an OpenAI-compatible self-hosted server. It behaves like
+		// the generic custom entry; it gets its own catalog id purely so it
+		// surfaces as a named "vLLM" choice in the provider picker.
+		ID:                 "vllm",
+		Kind:               KindCustom,
+		Name:               "vLLM",
+		Description:        "Self-hosted vLLM (OpenAI-compatible)",
+		DefaultHost:        "",
+		AuthHeaderName:     "Authorization",
+		AuthHeaderTemplate: "Bearer ${API_KEY}",
+		DefaultContentType: "application/json",
+		BrandColor:         "#30A2FF",
+		Models:             []Model{},
+	},
 	{
 		ID:                 "custom",
 		Kind:               KindCustom,

From 859fe19fff6661ed0ba7904b42ed8b12d72c36f5 Mon Sep 17 00:00:00 2001
From: Maycon Santos <mlsmaycon@gmail.com>
Date: Thu, 2 Jul 2026 14:55:55 +0200
Subject: [PATCH 26/36] [management] return nil when config is not set (#6642)

* [management] return nil when config is not set

* [management] add relay invariant test and enforce config behavior
---
 .../internals/shared/grpc/conversion.go       | 13 +++----
 .../internals/shared/grpc/conversion_test.go  | 38 +++++++++++++++++++
 management/server/peer_test.go                |  6 +--
 3 files changed, 44 insertions(+), 13 deletions(-)

diff --git a/management/internals/shared/grpc/conversion.go b/management/internals/shared/grpc/conversion.go
index 973749eb0..bdb4c8cf4 100644
--- a/management/internals/shared/grpc/conversion.go
+++ b/management/internals/shared/grpc/conversion.go
@@ -47,16 +47,13 @@ func init() {
 	precomputedDeprecatedRemotePeersConstraint = constraint
 }
 
+// toNetbirdConfig converts the server configuration to the wire representation. It returns
+// nil when no server config is set (the fan-out network-map path) because clients treat any
+// non-nil config as authoritative: a config without a relay section is interpreted as relay
+// disabled and wipes the clients' relay URLs.
 func toNetbirdConfig(config *nbconfig.Config, turnCredentials *Token, relayToken *Token, extraSettings *types.ExtraSettings, settings *types.Settings) *proto.NetbirdConfig {
 	if config == nil {
-		if settings == nil {
-			return nil
-		}
-		return &proto.NetbirdConfig{
-			Metrics: &proto.MetricsConfig{
-				Enabled: settings.MetricsPushEnabled,
-			},
-		}
+		return nil
 	}
 
 	var stuns []*proto.HostConfig
diff --git a/management/internals/shared/grpc/conversion_test.go b/management/internals/shared/grpc/conversion_test.go
index 01a67e4fa..c81bef25c 100644
--- a/management/internals/shared/grpc/conversion_test.go
+++ b/management/internals/shared/grpc/conversion_test.go
@@ -8,11 +8,13 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller/cache"
 	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
+	"github.com/netbirdio/netbird/management/server/types"
 )
 
 func TestToProtocolDNSConfigWithCache(t *testing.T) {
@@ -263,3 +265,39 @@ func TestEncodeSessionExpiresAt(t *testing.T) {
 		assert.True(t, got.AsTime().Equal(deadline))
 	})
 }
+
+// TestToNetbirdConfig_RelayInvariant guards against the v0.74.0 relay-wipe regression.
+// Clients treat any non-nil NetbirdConfig as authoritative and interpret a missing relay
+// section as relay disabled, wiping their relay URLs. toNetbirdConfig must therefore
+// return nil when no server config is set (the fan-out network-map path) instead of a
+// partial config, and a result built from a relay-enabled config must carry the relay
+// section.
+func TestToNetbirdConfig_RelayInvariant(t *testing.T) {
+	settings := &types.Settings{MetricsPushEnabled: true}
+
+	t.Run("nil server config returns nil config", func(t *testing.T) {
+		nbCfg := toNetbirdConfig(nil, nil, nil, nil, settings)
+		assert.Nil(t, nbCfg, "fan-out updates must not carry a partial NetbirdConfig even when settings are present")
+	})
+
+	t.Run("relay-enabled config carries relay section", func(t *testing.T) {
+		cfg := &nbconfig.Config{
+			Stuns: []*nbconfig.Host{{Proto: nbconfig.UDP, URI: "stun:stun.example.com:3478"}},
+			TURNConfig: &nbconfig.TURNConfig{
+				Turns: []*nbconfig.Host{{Proto: nbconfig.UDP, URI: "turn:turn.example.com:3478", Username: "user", Password: "pass"}},
+			},
+			Relay:  &nbconfig.Relay{Addresses: []string{"rels://relay.example.com:443"}},
+			Signal: &nbconfig.Host{Proto: nbconfig.HTTP, URI: "signal.example.com:10000"},
+		}
+		relayToken := &Token{Payload: "token-payload", Signature: "token-signature"}
+
+		nbCfg := toNetbirdConfig(cfg, nil, relayToken, nil, settings)
+		require.NotNil(t, nbCfg)
+		require.NotNil(t, nbCfg.Relay, "non-nil NetbirdConfig must include the relay section")
+		assert.Equal(t, cfg.Relay.Addresses, nbCfg.Relay.Urls, "relay URLs should match the server config")
+		assert.Equal(t, relayToken.Payload, nbCfg.Relay.TokenPayload, "relay token payload should be set")
+		assert.Equal(t, relayToken.Signature, nbCfg.Relay.TokenSignature, "relay token signature should be set")
+		require.NotNil(t, nbCfg.Metrics)
+		assert.True(t, nbCfg.Metrics.Enabled, "metrics flag should carry the settings value")
+	})
+}
diff --git a/management/server/peer_test.go b/management/server/peer_test.go
index 6c243c4c7..d471a1302 100644
--- a/management/server/peer_test.go
+++ b/management/server/peer_test.go
@@ -1048,11 +1048,7 @@ func testUpdateAccountPeers(t *testing.T) {
 
 			for _, channel := range peerChannels {
 				update := <-channel
-				assert.NotNil(t, update.Update.NetbirdConfig)
-				assert.Nil(t, update.Update.NetbirdConfig.Stuns)
-				assert.Nil(t, update.Update.NetbirdConfig.Turns)
-				assert.Nil(t, update.Update.NetbirdConfig.Signal)
-				assert.Nil(t, update.Update.NetbirdConfig.Relay)
+				assert.Nil(t, update.Update.NetbirdConfig, "fan-out updates must not carry a NetbirdConfig; clients treat a config without relay as relay disabled and wipe their relay URLs")
 				assert.Equal(t, tc.peers, len(update.Update.NetworkMap.RemotePeers))
 				assert.Equal(t, tc.peers*2, len(update.Update.NetworkMap.FirewallRules))
 			}

From 1dfa85a917eb47e23e4dc4c142056e67966a1c03 Mon Sep 17 00:00:00 2001
From: Misha Bragin <bangvalo@gmail.com>
Date: Thu, 2 Jul 2026 15:36:51 +0200
Subject: [PATCH 27/36] [management] Add vLLM e2e test (#6649)

* Add vLLM to Agent Network

* Add vllm e2e test
---
 e2e/agentnetwork/vllm_test.go | 171 ++++++++++++++++++++++++++++++++++
 e2e/harness/vllm.go           | 113 ++++++++++++++++++++++
 2 files changed, 284 insertions(+)
 create mode 100644 e2e/agentnetwork/vllm_test.go
 create mode 100644 e2e/harness/vllm.go

diff --git a/e2e/agentnetwork/vllm_test.go b/e2e/agentnetwork/vllm_test.go
new file mode 100644
index 000000000..329994ca9
--- /dev/null
+++ b/e2e/agentnetwork/vllm_test.go
@@ -0,0 +1,171 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// TestVLLMProvider proves the proxy supports a self-hosted vLLM backend. vLLM is
+// OpenAI-compatible, so it uses the "vllm" catalog entry (KindCustom) and is
+// reached over plain HTTP — no TLS anywhere on the path:
+//
+//	client --tunnel--> netbird proxy --http--> vllm (:8000, OpenAI-compatible)
+//
+// The mock vLLM server answers /v1/chat/completions with an OpenAI-shaped
+// completion carrying a non-zero usage block. The test asserts the chat returns
+// 200 with the completion, that the request is recorded in the access log by its
+// session id, and that vLLM's usage block is metered into a consumption row —
+// which together prove request routing, response parsing, and token accounting
+// all work for a self-hosted OpenAI-compatible provider.
+//
+// It needs no external credentials (the mock ignores auth), so it always runs.
+func TestVLLMProvider(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+	defer cancel()
+
+	vllm, err := harness.StartVLLM(ctx, srv)
+	require.NoError(t, err, "start mock vLLM server")
+	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
+
+	grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-vllm"})
+	require.NoError(t, err, "create group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grp.Id) })
+
+	ephemeral := false
+	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+		Name:       "e2e-vllm-client",
+		Type:       "reusable",
+		ExpiresIn:  86400,
+		UsageLimit: 0,
+		AutoGroups: []string{grp.Id},
+		Ephemeral:  &ephemeral,
+	})
+	require.NoError(t, err, "mint setup key")
+	require.NotEmpty(t, sk.Key, "setup key plaintext")
+
+	// vLLM provider pointed at the mock over plain HTTP. The mock ignores auth,
+	// so a dummy key satisfies the "Bearer ${API_KEY}" template. The served model
+	// is enumerated so the router dispatches this model string to this provider.
+	dummyKey := "sk-vllm-e2e"
+	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:             "vllm",
+		ProviderId:       "vllm",
+		UpstreamUrl:      vllm.URL,
+		ApiKey:           &dummyKey,
+		Enabled:          ptr(true),
+		BootstrapCluster: ptr(harness.AgentNetworkCluster),
+		Models: &[]api.AgentNetworkProviderModel{
+			{Id: harness.VLLMModel, InputPer1k: 0.001, OutputPer1k: 0.002},
+		},
+	})
+	require.NoError(t, err, "create vllm provider")
+	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
+
+	// Token limit far above the handful of tokens this test drives, so it never
+	// blocks but switches on usage metering — the switch that makes consumption
+	// rows get recorded.
+	enabled := true
+	pol, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-vllm-allow",
+		Enabled:                &enabled,
+		SourceGroups:           []string{grp.Id},
+		DestinationProviderIds: []string{prov.Id},
+		Limits: &api.AgentNetworkPolicyLimits{
+			TokenLimit: api.AgentNetworkPolicyTokenLimit{
+				Enabled:       true,
+				GroupCap:      10_000_000,
+				UserCap:       10_000_000,
+				WindowSeconds: 60,
+			},
+		},
+	})
+	require.NoError(t, err, "create policy")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
+
+	settings, err := srv.GetSettings(ctx)
+	require.NoError(t, err, "read settings")
+	require.NotEmpty(t, settings.Endpoint, "endpoint must be assigned")
+
+	proxyToken, err := srv.CreateProxyTokenCLI(ctx, "e2e-vllm-proxy")
+	require.NoError(t, err, "mint proxy token")
+	px, err := harness.StartProxy(ctx, srv, proxyToken)
+	require.NoError(t, err, "start proxy")
+	t.Cleanup(func() { _ = px.Terminate(context.Background()) })
+
+	cl, err := harness.StartClient(ctx, srv, sk.Key)
+	require.NoError(t, err, "start client")
+	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
+
+	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
+	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
+		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
+	}
+	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
+	require.NoError(t, err, "resolve endpoint to proxy IP")
+
+	before, _ := srv.ListAccessLogs(ctx)
+	sessionID := "e2e-session-vllm"
+
+	// Retry to absorb tunnel/DNS jitter on the first call.
+	var code int
+	var body string
+	deadline := time.Now().Add(90 * time.Second)
+	for time.Now().Before(deadline) {
+		c, b, cerr := cl.Chat(ctx, settings.Endpoint, proxyIP, harness.WireChat, harness.VLLMModel, "Reply with exactly: pong", sessionID)
+		if cerr == nil {
+			code, body = c, b
+			if code == 200 {
+				break
+			}
+		}
+		time.Sleep(5 * time.Second)
+	}
+	require.Equal(t, 200, code,
+		"chat through the vLLM provider must return 200; body: %s\n=== vllm logs ===\n%s\n=== proxy logs ===\n%s",
+		body, vllm.Logs(context.Background()), px.Logs(context.Background()))
+	require.True(t, strings.Contains(body, "chat.completion"),
+		"body should be an OpenAI-compatible chat completion; got: %s", body)
+
+	// The request must surface as an access-log row carrying our session id.
+	require.Eventually(t, func() bool {
+		logs, lerr := srv.ListAccessLogs(ctx)
+		return lerr == nil && logs.TotalRecords > before.TotalRecords
+	}, 30*time.Second, 2*time.Second, "an access-log row should be ingested for the vLLM provider")
+
+	require.Eventually(t, func() bool {
+		logs, lerr := srv.ListAccessLogs(ctx)
+		if lerr != nil {
+			return false
+		}
+		for _, r := range logs.Data {
+			if r.SessionId != nil && *r.SessionId == sessionID {
+				return true
+			}
+		}
+		return false
+	}, 30*time.Second, 2*time.Second, "session id %q must be recorded in an access-log row", sessionID)
+
+	// vLLM's usage block (prompt_tokens=11, completion_tokens=2) must be parsed
+	// and metered into a consumption row with positive token counts.
+	require.Eventually(t, func() bool {
+		rows, lerr := srv.ListConsumption(ctx)
+		if lerr != nil {
+			return false
+		}
+		for _, r := range rows {
+			if r.TokensInput > 0 && r.TokensOutput > 0 {
+				return true
+			}
+		}
+		return false
+	}, 60*time.Second, 3*time.Second, "vLLM usage must be metered into a consumption row")
+}
diff --git a/e2e/harness/vllm.go b/e2e/harness/vllm.go
new file mode 100644
index 000000000..2f3d306cc
--- /dev/null
+++ b/e2e/harness/vllm.go
@@ -0,0 +1,113 @@
+//go:build e2e
+
+package harness
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"time"
+
+	"github.com/docker/docker/api/types/container"
+	"github.com/testcontainers/testcontainers-go"
+	"github.com/testcontainers/testcontainers-go/wait"
+)
+
+const (
+	vllmImage = "nginx:alpine"
+	vllmAlias = "vllm"
+	vllmPort  = "8000/tcp"
+	// VLLMModel is the served model id the mock advertises and echoes back. It
+	// matches a real small model commonly served by vLLM so the provider's
+	// enumerated model and the client's request line up.
+	VLLMModel = "Qwen/Qwen2.5-0.5B-Instruct"
+)
+
+// vllmNginxConf emulates a vLLM OpenAI-compatible server over plain HTTP (vLLM's
+// default: no TLS, port 8000). It answers /v1/models with a one-model list and
+// any chat/completions path with a canned OpenAI-shaped chat completion carrying
+// a non-zero usage block, so the proxy's OpenAI parser records real token
+// consumption. Running actual vLLM in CI is infeasible (GPU + multi-GB model
+// download), so this stands in for the wire contract the proxy depends on.
+const vllmNginxConf = `pid /tmp/nginx.pid;
+events {}
+http {
+  server {
+    listen 8000;
+    location = /v1/models {
+      default_type application/json;
+      return 200 '{"object":"list","data":[{"id":"Qwen/Qwen2.5-0.5B-Instruct","object":"model","owned_by":"vllm"}]}';
+    }
+    location / {
+      default_type application/json;
+      return 200 '{"id":"chatcmpl-e2e-vllm","object":"chat.completion","created":1700000000,"model":"Qwen/Qwen2.5-0.5B-Instruct","choices":[{"index":0,"message":{"role":"assistant","content":"pong"},"finish_reason":"stop"}],"usage":{"prompt_tokens":11,"completion_tokens":2,"total_tokens":13}}';
+    }
+  }
+}
+`
+
+// VLLM is a mock vLLM OpenAI-compatible server on the combined server's network,
+// reachable at http://vllm:8000. A "vllm" provider points at it to exercise the
+// proxy's support for self-hosted OpenAI-compatible backends.
+type VLLM struct {
+	container testcontainers.Container
+	workDir   string
+	// URL is the upstream URL the vllm provider points at (http://<alias>:8000).
+	URL string
+}
+
+// StartVLLM runs the mock vLLM server on the shared network over plain HTTP.
+func StartVLLM(ctx context.Context, c *Combined) (*VLLM, error) {
+	workDir, err := os.MkdirTemp("/tmp", "nb-e2e-vllm-*")
+	if err != nil {
+		return nil, fmt.Errorf("create vllm work dir: %w", err)
+	}
+	// Widen so the (non-root worker) nginx container can traverse the bind mount.
+	if err := os.Chmod(workDir, 0o755); err != nil { //nolint:gosec // throwaway e2e config dir
+		return nil, fmt.Errorf("chmod vllm dir: %w", err)
+	}
+	if err := os.WriteFile(filepath.Join(workDir, "nginx.conf"), []byte(vllmNginxConf), 0o644); err != nil { //nolint:gosec // non-secret e2e config
+		return nil, fmt.Errorf("write nginx conf: %w", err)
+	}
+
+	req := testcontainers.ContainerRequest{
+		Image:          vllmImage,
+		ExposedPorts:   []string{vllmPort},
+		Networks:       []string{c.network.Name},
+		NetworkAliases: map[string][]string{c.network.Name: {vllmAlias}},
+		Cmd:            []string{"nginx", "-c", "/conf/nginx.conf", "-g", "daemon off;"},
+		HostConfigModifier: func(hc *container.HostConfig) {
+			hc.Binds = append(hc.Binds, workDir+":/conf:ro")
+		},
+		WaitingFor: wait.ForListeningPort(vllmPort).WithStartupTimeout(60 * time.Second),
+	}
+
+	ctr, err := testcontainers.GenericContainer(ctx, testcontainers.GenericContainerRequest{
+		ContainerRequest: req,
+		Started:          true,
+	})
+	if err != nil {
+		_ = os.RemoveAll(workDir)
+		return nil, fmt.Errorf("start vllm container: %w", err)
+	}
+
+	return &VLLM{container: ctr, workDir: workDir, URL: "http://" + vllmAlias + ":8000"}, nil
+}
+
+// Logs returns the vLLM container logs, for diagnostics on failure.
+func (v *VLLM) Logs(ctx context.Context) string {
+	return containerLogs(ctx, v.container)
+}
+
+// Terminate stops the vLLM container and cleans its work dir.
+func (v *VLLM) Terminate(ctx context.Context) error {
+	var err error
+	if v.container != nil {
+		err = v.container.Terminate(ctx)
+	}
+	if v.workDir != "" {
+		_ = os.RemoveAll(v.workDir)
+	}
+	return err
+}

From 21aa9335846114319229ecf28e7faea13bf8fae5 Mon Sep 17 00:00:00 2001
From: Maycon Santos <mlsmaycon@gmail.com>
Date: Thu, 2 Jul 2026 17:21:06 +0200
Subject: [PATCH 28/36] [misc] Fix GHCR image push after dockers_v2 migration
 (#6653)

---
 .github/workflows/release.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 16eae31fb..cd431a389 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -293,8 +293,11 @@ jobs:
           ${{ steps.goreleaser.outputs.artifacts }}
           JSON
 
+          # dockers_v2 artifacts have no top-level goarch field, so match the
+          # per-platform -amd64 tag suffix instead; it works for both the old
+          # dockers and the new dockers_v2 image naming.
           mapfile -t src_images < <(
-            jq -r '.[] | select(.type == "Docker Image") | select(.goarch == "amd64") | .name | select(startswith("ghcr.io/"))' /tmp/goreleaser-artifacts.json
+            jq -r '.[] | select(.type == "Docker Image") | .name | select(startswith("ghcr.io/") and endswith("-amd64"))' /tmp/goreleaser-artifacts.json
           )
 
           for src in "${src_images[@]}"; do

From 8e3b284f4bb374c830bd85041260cf3dcde5666e Mon Sep 17 00:00:00 2001
From: Riccardo Manfrin <3090891+riccardomanfrin@users.noreply.github.com>
Date: Thu, 2 Jul 2026 17:50:18 +0200
Subject: [PATCH 29/36] [client] Increase mgmt grpc buff size to 16MB (#6641)

---
 shared/management/client/grpc.go      | 15 ++++++++++-----
 shared/management/client/grpc_test.go |  8 ++++----
 2 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/shared/management/client/grpc.go b/shared/management/client/grpc.go
index bd4585455..e3ba259c6 100644
--- a/shared/management/client/grpc.go
+++ b/shared/management/client/grpc.go
@@ -33,10 +33,15 @@ const ConnectTimeout = 10 * time.Second
 const healthCheckTimeout = 5 * time.Second
 
 const (
-	// EnvMaxRecvMsgSize overrides the default gRPC max receive message size (4 MB)
+	// EnvMaxRecvMsgSize overrides the default gRPC max receive message size
 	// for the management client connection. Value is in bytes.
 	EnvMaxRecvMsgSize = "NB_MANAGEMENT_GRPC_MAX_MSG_SIZE"
 
+	// defaultMaxRecvMsgSize is the max gRPC receive message size used for the
+	// management client connection when EnvMaxRecvMsgSize is unset or invalid.
+	// It overrides the gRPC library default of 4 MB.
+	defaultMaxRecvMsgSize = 1024 * 1024 * 16
+
 	errMsgMgmtPublicKey    = "failed getting Management Service public key: %s"
 	errMsgNoMgmtConnection = "no connection to management"
 )
@@ -84,22 +89,22 @@ type ExposeResponse struct {
 }
 
 // MaxRecvMsgSize returns the configured max gRPC receive message size from
-// the environment, or 0 if unset (which uses the gRPC default of 4 MB).
+// the environment, or defaultMaxRecvMsgSize (16 MB) if unset or invalid.
 func MaxRecvMsgSize() int {
 	val := os.Getenv(EnvMaxRecvMsgSize)
 	if val == "" {
-		return 0
+		return defaultMaxRecvMsgSize
 	}
 
 	size, err := strconv.Atoi(val)
 	if err != nil {
 		log.Warnf("invalid %s value %q, using default: %v", EnvMaxRecvMsgSize, val, err)
-		return 0
+		return defaultMaxRecvMsgSize
 	}
 
 	if size <= 0 {
 		log.Warnf("invalid %s value %d, must be positive, using default", EnvMaxRecvMsgSize, size)
-		return 0
+		return defaultMaxRecvMsgSize
 	}
 
 	return size
diff --git a/shared/management/client/grpc_test.go b/shared/management/client/grpc_test.go
index 462cc43af..c947130fd 100644
--- a/shared/management/client/grpc_test.go
+++ b/shared/management/client/grpc_test.go
@@ -21,11 +21,11 @@ func TestMaxRecvMsgSize(t *testing.T) {
 		envValue string
 		expected int
 	}{
-		{name: "unset returns 0", envValue: "", expected: 0},
+		{name: "unset returns default", envValue: "", expected: defaultMaxRecvMsgSize},
 		{name: "valid value", envValue: "10485760", expected: 10485760},
-		{name: "non-numeric returns 0", envValue: "abc", expected: 0},
-		{name: "negative returns 0", envValue: "-1", expected: 0},
-		{name: "zero returns 0", envValue: "0", expected: 0},
+		{name: "non-numeric returns default", envValue: "abc", expected: defaultMaxRecvMsgSize},
+		{name: "negative returns default", envValue: "-1", expected: defaultMaxRecvMsgSize},
+		{name: "zero returns default", envValue: "0", expected: defaultMaxRecvMsgSize},
 	}
 
 	for _, tt := range tests {

From 4b3dd9103dcf4009fbb6b088fbc44fc0db760128 Mon Sep 17 00:00:00 2001
From: Zoltan Papp <zoltan.pmail@gmail.com>
Date: Thu, 2 Jul 2026 20:42:43 +0200
Subject: [PATCH 30/36] [client] Fix slow wg operations (#6633)

* [iface] Drop redundant device dump in kernel configure()

wgctrl.ConfigureDevice already returns an error when the interface is
missing, so the preceding wg.Device() existence check is redundant. That
check dumps the entire device (all peers) on every configure() call,
making it O(peers) per call and turning bulk peer insertion into
O(peers^2): inserting N peers one by one re-parsed the whole growing peer
list N times. Removing it keeps each peer write constant-time regardless
of how many peers are already configured.

* [iface] Cache WireGuard stats to collapse per-peer device dumps

Each peer runs a WGWatcher that polls GetStats(), and every call dumps
the whole device, so with N peers the watchers perform O(N) full dumps
per poll cycle (O(N^2) work) while each keeps only its own peer's entry.

Wrap the kernel and userspace configurer GetStats() in a short-TTL cache
with singleflight: the staggered per-peer calls share a single device
dump per window and concurrent misses collapse into one dump. The kernel
and userspace WireGuard APIs have no per-peer stats query (a get always
returns the whole device), so a shared cached snapshot avoids the
repeated full dumps.

* Ignore .claude directory
---
 .gitignore                                  |  1 +
 client/iface/configurer/kernel_unix.go      | 23 +++----
 client/iface/configurer/stats_cache.go      | 52 +++++++++++++++
 client/iface/configurer/stats_cache_test.go | 70 +++++++++++++++++++++
 client/iface/configurer/usp.go              | 10 ++-
 5 files changed, 144 insertions(+), 12 deletions(-)
 create mode 100644 client/iface/configurer/stats_cache.go
 create mode 100644 client/iface/configurer/stats_cache_test.go

diff --git a/.gitignore b/.gitignore
index 783fe77f3..305f3cb50 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
+.claude
 .idea
 .run
 *.iml
diff --git a/client/iface/configurer/kernel_unix.go b/client/iface/configurer/kernel_unix.go
index a29fe181a..da69c2a35 100644
--- a/client/iface/configurer/kernel_unix.go
+++ b/client/iface/configurer/kernel_unix.go
@@ -17,12 +17,15 @@ import (
 
 type KernelConfigurer struct {
 	deviceName string
+	statsCache *statsCache
 }
 
 func NewKernelConfigurer(deviceName string) *KernelConfigurer {
-	return &KernelConfigurer{
+	c := &KernelConfigurer{
 		deviceName: deviceName,
 	}
+	c.statsCache = newStatsCache(statsCacheTTL, c.fetchStats)
+	return c
 }
 
 func (c *KernelConfigurer) ConfigureInterface(privateKey string, port int) error {
@@ -246,12 +249,6 @@ func (c *KernelConfigurer) configure(config wgtypes.Config) error {
 		}
 	}()
 
-	// validate if device with name exists
-	_, err = wg.Device(c.deviceName)
-	if err != nil {
-		return err
-	}
-
 	return wg.ConfigureDevice(c.deviceName, config)
 }
 
@@ -300,6 +297,14 @@ func (c *KernelConfigurer) FullStats() (*Stats, error) {
 }
 
 func (c *KernelConfigurer) GetStats() (map[string]WGStats, error) {
+	return c.statsCache.get()
+}
+
+func (c *KernelConfigurer) LastActivities() map[string]monotime.Time {
+	return nil
+}
+
+func (c *KernelConfigurer) fetchStats() (map[string]WGStats, error) {
 	stats := make(map[string]WGStats)
 	wg, err := wgctrl.New()
 	if err != nil {
@@ -326,7 +331,3 @@ func (c *KernelConfigurer) GetStats() (map[string]WGStats, error) {
 	}
 	return stats, nil
 }
-
-func (c *KernelConfigurer) LastActivities() map[string]monotime.Time {
-	return nil
-}
diff --git a/client/iface/configurer/stats_cache.go b/client/iface/configurer/stats_cache.go
new file mode 100644
index 000000000..71a4e88fc
--- /dev/null
+++ b/client/iface/configurer/stats_cache.go
@@ -0,0 +1,52 @@
+package configurer
+
+import (
+	"sync"
+	"time"
+
+	"golang.org/x/sync/singleflight"
+)
+
+const statsCacheTTL = 1 * time.Second
+
+type statsCache struct {
+	ttl   time.Duration
+	fetch func() (map[string]WGStats, error)
+
+	mu       sync.RWMutex
+	value    map[string]WGStats
+	expireAt time.Time
+
+	sf singleflight.Group
+}
+
+func newStatsCache(ttl time.Duration, fetch func() (map[string]WGStats, error)) *statsCache {
+	return &statsCache{ttl: ttl, fetch: fetch}
+}
+
+func (c *statsCache) get() (map[string]WGStats, error) {
+	c.mu.RLock()
+	if c.value != nil && time.Now().Before(c.expireAt) {
+		value := c.value
+		c.mu.RUnlock()
+		return value, nil
+	}
+	c.mu.RUnlock()
+
+	value, err, _ := c.sf.Do("stats", func() (interface{}, error) {
+		res, err := c.fetch()
+		if err != nil {
+			return nil, err
+		}
+
+		c.mu.Lock()
+		c.value = res
+		c.expireAt = time.Now().Add(c.ttl)
+		c.mu.Unlock()
+		return res, nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return value.(map[string]WGStats), nil
+}
diff --git a/client/iface/configurer/stats_cache_test.go b/client/iface/configurer/stats_cache_test.go
new file mode 100644
index 000000000..bcee5cd52
--- /dev/null
+++ b/client/iface/configurer/stats_cache_test.go
@@ -0,0 +1,70 @@
+package configurer
+
+import (
+	"errors"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestStatsCache_CachesWithinTTL(t *testing.T) {
+	var calls atomic.Int64
+	c := newStatsCache(50*time.Millisecond, func() (map[string]WGStats, error) {
+		calls.Add(1)
+		return map[string]WGStats{"p": {}}, nil
+	})
+
+	for i := 0; i < 10; i++ {
+		_, err := c.get()
+		require.NoError(t, err)
+	}
+	require.Equal(t, int64(1), calls.Load(), "within TTL only one underlying fetch")
+
+	time.Sleep(60 * time.Millisecond)
+	_, err := c.get()
+	require.NoError(t, err)
+	require.Equal(t, int64(2), calls.Load(), "after TTL expiry a fresh fetch happens")
+}
+
+func TestStatsCache_SingleFlight(t *testing.T) {
+	var calls atomic.Int64
+	release := make(chan struct{})
+	c := newStatsCache(time.Minute, func() (map[string]WGStats, error) {
+		calls.Add(1)
+		<-release
+		return map[string]WGStats{}, nil
+	})
+
+	const n = 50
+	var wg sync.WaitGroup
+	wg.Add(n)
+	for i := 0; i < n; i++ {
+		go func() {
+			defer wg.Done()
+			_, _ = c.get()
+		}()
+	}
+	time.Sleep(20 * time.Millisecond)
+	close(release)
+	wg.Wait()
+
+	require.Equal(t, int64(1), calls.Load(), "concurrent misses collapse into one fetch")
+}
+
+func TestStatsCache_ErrorNotCached(t *testing.T) {
+	var calls atomic.Int64
+	wantErr := errors.New("dump failed")
+	c := newStatsCache(time.Minute, func() (map[string]WGStats, error) {
+		calls.Add(1)
+		return nil, wantErr
+	})
+
+	_, err := c.get()
+	require.ErrorIs(t, err, wantErr)
+	_, err = c.get()
+	require.ErrorIs(t, err, wantErr)
+	require.Equal(t, int64(2), calls.Load(), "errors are not cached; each call retries")
+}
diff --git a/client/iface/configurer/usp.go b/client/iface/configurer/usp.go
index 9b070aab8..0a25c55bc 100644
--- a/client/iface/configurer/usp.go
+++ b/client/iface/configurer/usp.go
@@ -40,6 +40,7 @@ type WGUSPConfigurer struct {
 	device           *device.Device
 	deviceName       string
 	activityRecorder *bind.ActivityRecorder
+	statsCache       *statsCache
 
 	uapiListener net.Listener
 }
@@ -50,16 +51,19 @@ func NewUSPConfigurer(device *device.Device, deviceName string, activityRecorder
 		deviceName:       deviceName,
 		activityRecorder: activityRecorder,
 	}
+	wgCfg.statsCache = newStatsCache(statsCacheTTL, wgCfg.fetchStats)
 	wgCfg.startUAPI()
 	return wgCfg
 }
 
 func NewUSPConfigurerNoUAPI(device *device.Device, deviceName string, activityRecorder *bind.ActivityRecorder) *WGUSPConfigurer {
-	return &WGUSPConfigurer{
+	wgCfg := &WGUSPConfigurer{
 		device:           device,
 		deviceName:       deviceName,
 		activityRecorder: activityRecorder,
 	}
+	wgCfg.statsCache = newStatsCache(statsCacheTTL, wgCfg.fetchStats)
+	return wgCfg
 }
 
 func (c *WGUSPConfigurer) ConfigureInterface(privateKey string, port int) error {
@@ -348,6 +352,10 @@ func (t *WGUSPConfigurer) Close() {
 }
 
 func (t *WGUSPConfigurer) GetStats() (map[string]WGStats, error) {
+	return t.statsCache.get()
+}
+
+func (t *WGUSPConfigurer) fetchStats() (map[string]WGStats, error) {
 	ipc, err := t.device.IpcGet()
 	if err != nil {
 		return nil, fmt.Errorf("ipc get: %w", err)

From f6900fb07c68cfcececc48cdc0de1e42bf97b5e2 Mon Sep 17 00:00:00 2001
From: Zoltan Papp <zoltan.pmail@gmail.com>
Date: Fri, 3 Jul 2026 10:31:06 +0200
Subject: [PATCH 31/36] [client] backport enforce a single selected exit node
 (#6640)

* routemanager: enforce a single selected exit node

Backport of the exit-node exclusivity reconcile from the 0.75.0 line
(upstream commit 966fbec11) onto v0.74.0. Exit nodes are mutually
exclusive, but the RouteSelector stores routes with default-on semantics,
so every available exit node reported as selected at once.

Reconcile exit-node selection on each network map: keep at most one
selected -- the user's persisted pick, else whatever management marks for
auto-apply (SkipAutoApply=false), else none. Never auto-activate an exit
node the map does not request.

Carries over only the manager/routeselector logic and its test; the
desktop-only client/server changes and the BumpNetworksRevision UI-push
feature from the original commit are intentionally excluded.

* routeselector: make exit-node reconciliation atomic

enforceSingleExitNode took the RouteSelector lock three separate times
(IsDeselectAll, then DeselectRoutes, then SelectRoutes), so a concurrent
DeselectAllRoutes could interleave and be silently undone: SelectRoutes on
its deselectAll branch clears the flag and re-selects the preferred exit
node, overriding the user's "all off".

Move the whole reconciliation into a single locked RouteSelector method
(SetExclusiveExitNode) that checks deselectAll inside the critical section,
so a deselect-all either fully precedes the reconcile (left untouched) or
fully follows it (honoured). No interleaving is possible.
---
 .../routemanager/exit_node_selection_test.go  | 191 ++++++++++++++++++
 client/internal/routemanager/manager.go       | 105 ++++++----
 .../internal/routeselector/routeselector.go   |  33 ++-
 3 files changed, 286 insertions(+), 43 deletions(-)
 create mode 100644 client/internal/routemanager/exit_node_selection_test.go

diff --git a/client/internal/routemanager/exit_node_selection_test.go b/client/internal/routemanager/exit_node_selection_test.go
new file mode 100644
index 000000000..28dd0a640
--- /dev/null
+++ b/client/internal/routemanager/exit_node_selection_test.go
@@ -0,0 +1,191 @@
+package routemanager
+
+import (
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/routeselector"
+	"github.com/netbirdio/netbird/route"
+)
+
+func newExitNodeTestManager() *DefaultManager {
+	return &DefaultManager{routeSelector: routeselector.NewRouteSelector()}
+}
+
+func exitRoute(netID, peer string, skipAutoApply bool) *route.Route {
+	return &route.Route{
+		NetID:         route.NetID(netID),
+		Network:       netip.MustParsePrefix("0.0.0.0/0"),
+		Peer:          peer,
+		SkipAutoApply: skipAutoApply,
+	}
+}
+
+func TestPickPreferredExitNode(t *testing.T) {
+	tests := []struct {
+		name string
+		info exitNodeInfo
+		want route.NetID
+	}{
+		{
+			name: "persisted user selection wins over management",
+			info: exitNodeInfo{
+				allIDs:               []route.NetID{"a", "b", "c"},
+				userSelected:         []route.NetID{"b"},
+				selectedByManagement: []route.NetID{"a"},
+			},
+			want: "b",
+		},
+		{
+			name: "multiple user-selected self-heal to deterministic min",
+			info: exitNodeInfo{
+				allIDs:       []route.NetID{"a", "b", "c"},
+				userSelected: []route.NetID{"c", "a"},
+			},
+			want: "a",
+		},
+		{
+			name: "explicit opt-out keeps none",
+			info: exitNodeInfo{
+				allIDs:         []route.NetID{"a", "b"},
+				userDeselected: []route.NetID{"a", "b"},
+			},
+			want: "",
+		},
+		{
+			name: "fresh defaults to management auto-apply pick",
+			info: exitNodeInfo{
+				allIDs:               []route.NetID{"a", "b", "c"},
+				selectedByManagement: []route.NetID{"b"},
+			},
+			want: "b",
+		},
+		{
+			name: "no user pick and no management auto-apply selects none",
+			info: exitNodeInfo{
+				allIDs: []route.NetID{"c", "a", "b"},
+			},
+			want: "",
+		},
+		{
+			name: "user-deselect does not block a management auto-apply sibling",
+			info: exitNodeInfo{
+				allIDs:               []route.NetID{"a", "b"},
+				userDeselected:       []route.NetID{"a"},
+				selectedByManagement: []route.NetID{"b"},
+			},
+			want: "b",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, pickPreferredExitNode(tt.info), "preferred exit node")
+		})
+	}
+}
+
+func TestEnforceSingleExitNode(t *testing.T) {
+	m := newExitNodeTestManager()
+	all := []route.NetID{"a", "b", "c"}
+
+	m.enforceSingleExitNode("b", all)
+	assert.False(t, m.routeSelector.IsSelected("a"), "a should be deselected")
+	assert.True(t, m.routeSelector.IsSelected("b"), "b should be the only selected exit node")
+	assert.False(t, m.routeSelector.IsSelected("c"), "c should be deselected")
+
+	// Switching the preferred node moves the single selection.
+	m.enforceSingleExitNode("c", all)
+	assert.False(t, m.routeSelector.IsSelected("a"), "a stays deselected")
+	assert.False(t, m.routeSelector.IsSelected("b"), "b should now be deselected")
+	assert.True(t, m.routeSelector.IsSelected("c"), "c should now be selected")
+
+	// Empty preferred turns every exit node off.
+	m.enforceSingleExitNode("", all)
+	for _, id := range all {
+		assert.False(t, m.routeSelector.IsSelected(id), "no exit node should be selected")
+	}
+}
+
+func TestEnforceSingleExitNode_RespectsDeselectAll(t *testing.T) {
+	m := newExitNodeTestManager()
+	m.routeSelector.DeselectAllRoutes()
+
+	m.enforceSingleExitNode("b", []route.NetID{"a", "b"})
+
+	assert.True(t, m.routeSelector.IsDeselectAll(), "global deselect-all must stay in effect")
+	assert.False(t, m.routeSelector.IsSelected("b"), "no exit node should be forced on while deselect-all is set")
+}
+
+func TestUpdateRouteSelectorFromManagement_FreshSelectsOne(t *testing.T) {
+	m := newExitNodeTestManager()
+	routes := route.HAMap{
+		"exitA|0.0.0.0/0":    {exitRoute("exitA", "p1", false)},
+		"exitB|0.0.0.0/0":    {exitRoute("exitB", "p2", false)},
+		"lan|192.168.1.0/24": {{NetID: "lan", Network: netip.MustParsePrefix("192.168.1.0/24"), Peer: "p3"}},
+		"exitC|0.0.0.0/0":    {exitRoute("exitC", "p4", false)},
+	}
+
+	m.updateRouteSelectorFromManagement(routes)
+
+	// Exactly one exit node (the deterministic first) is selected.
+	assert.True(t, m.routeSelector.IsSelected("exitA"), "exitA is the deterministic default")
+	assert.False(t, m.routeSelector.IsSelected("exitB"), "exitB must not also be selected")
+	assert.False(t, m.routeSelector.IsSelected("exitC"), "exitC must not also be selected")
+	// Non-exit routes are left at their default-on state.
+	assert.True(t, m.routeSelector.IsSelected("lan"), "non-exit route selection is untouched")
+}
+
+func TestUpdateRouteSelectorFromManagement_HonorsPersistedPick(t *testing.T) {
+	m := newExitNodeTestManager()
+	routes := route.HAMap{
+		"exitA|0.0.0.0/0": {exitRoute("exitA", "p1", false)},
+		"exitB|0.0.0.0/0": {exitRoute("exitB", "p2", false)},
+	}
+	all := []route.NetID{"exitA", "exitB"}
+
+	// Simulate the state the runtime select path leaves behind: exactly one
+	// exit node explicitly selected, its sibling deselected.
+	require.NoError(t, m.routeSelector.SelectRoutes([]route.NetID{"exitB"}, true, all))
+	require.NoError(t, m.routeSelector.DeselectRoutes([]route.NetID{"exitA"}, all))
+
+	m.updateRouteSelectorFromManagement(routes)
+
+	assert.True(t, m.routeSelector.IsSelected("exitB"), "persisted pick must stay selected")
+	assert.False(t, m.routeSelector.IsSelected("exitA"), "the other exit node stays deselected")
+}
+
+func TestUpdateRouteSelectorFromManagement_OptOutKeepsNone(t *testing.T) {
+	m := newExitNodeTestManager()
+	routes := route.HAMap{
+		"exitA|0.0.0.0/0": {exitRoute("exitA", "p1", false)},
+		"exitB|0.0.0.0/0": {exitRoute("exitB", "p2", false)},
+	}
+	all := []route.NetID{"exitA", "exitB"}
+
+	// User deselected exit nodes and selected none.
+	require.NoError(t, m.routeSelector.DeselectRoutes(all, all))
+
+	m.updateRouteSelectorFromManagement(routes)
+
+	assert.False(t, m.routeSelector.IsSelected("exitA"), "opt-out keeps exitA off")
+	assert.False(t, m.routeSelector.IsSelected("exitB"), "opt-out keeps exitB off")
+}
+
+func TestUpdateRouteSelectorFromManagement_NoAutoApplySelectsNone(t *testing.T) {
+	m := newExitNodeTestManager()
+	// SkipAutoApply=true: management offers the exit nodes but doesn't request
+	// auto-activation, so none should be selected until the user picks one.
+	routes := route.HAMap{
+		"exitA|0.0.0.0/0": {exitRoute("exitA", "p1", true)},
+		"exitB|0.0.0.0/0": {exitRoute("exitB", "p2", true)},
+	}
+
+	m.updateRouteSelectorFromManagement(routes)
+
+	assert.False(t, m.routeSelector.IsSelected("exitA"), "no auto-apply keeps exitA off")
+	assert.False(t, m.routeSelector.IsSelected("exitB"), "no auto-apply keeps exitB off")
+}
diff --git a/client/internal/routemanager/manager.go b/client/internal/routemanager/manager.go
index 22458d575..32379e837 100644
--- a/client/internal/routemanager/manager.go
+++ b/client/internal/routemanager/manager.go
@@ -701,7 +701,13 @@ func resolveURLsToIPs(urls []string) []net.IP {
 	return ips
 }
 
-// updateRouteSelectorFromManagement updates the route selector based on the isSelected status from the management server
+// updateRouteSelectorFromManagement reconciles exit-node selection on every
+// network map: it keeps at most one exit node selected — the user's persisted
+// pick, else whatever management marks for auto-apply (SkipAutoApply=false),
+// else none. We never auto-activate an exit node the map doesn't request; it
+// stays off until the user picks it. Exit nodes are mutually exclusive, but the
+// RouteSelector stores routes with default-on semantics, so without this every
+// available exit node would report selected at once.
 func (m *DefaultManager) updateRouteSelectorFromManagement(clientRoutes route.HAMap) {
 	m.mirrorV6ExitPairSelections(clientRoutes)
 
@@ -712,13 +718,14 @@ func (m *DefaultManager) updateRouteSelectorFromManagement(clientRoutes route.HA
 		return
 	}
 
-	exitNodeInfo := m.collectExitNodeInfo(clientRoutes)
-	if len(exitNodeInfo.allIDs) == 0 {
+	info := m.collectExitNodeInfo(clientRoutes)
+	if len(info.allIDs) == 0 {
 		return
 	}
 
-	m.updateExitNodeSelections(exitNodeInfo)
-	m.logExitNodeUpdate(exitNodeInfo)
+	preferred := pickPreferredExitNode(info)
+	m.enforceSingleExitNode(preferred, info.allIDs)
+	m.logExitNodeUpdate(info, preferred)
 }
 
 // mirrorV6ExitPairSelections keeps every synthesized "-v6" exit route's selection
@@ -746,6 +753,10 @@ type exitNodeInfo struct {
 	userDeselected       []route.NetID
 }
 
+// collectExitNodeInfo categorises the available exit nodes by their persisted
+// selection state. It keys on the base (v4) NetID and skips the synthesized
+// "-v6" partner, which inherits its base's selection through the RouteSelector
+// — counting it separately would double-count the pair.
 func (m *DefaultManager) collectExitNodeInfo(clientRoutes route.HAMap) exitNodeInfo {
 	var info exitNodeInfo
 
@@ -755,6 +766,9 @@ func (m *DefaultManager) collectExitNodeInfo(clientRoutes route.HAMap) exitNodeI
 		}
 
 		netID := haID.NetID()
+		if strings.HasSuffix(string(netID), route.V6ExitSuffix) {
+			continue
+		}
 		info.allIDs = append(info.allIDs, netID)
 
 		if m.routeSelector.HasUserSelectionForRoute(netID) {
@@ -791,45 +805,52 @@ func (m *DefaultManager) checkManagementSelection(routes []*route.Route, netID r
 	}
 }
 
-func (m *DefaultManager) updateExitNodeSelections(info exitNodeInfo) {
-	routesToDeselect := m.getRoutesToDeselect(info.allIDs)
-	m.deselectExitNodes(routesToDeselect)
-	m.selectExitNodesByManagement(info.selectedByManagement, info.allIDs)
+// pickPreferredExitNode chooses the single exit node to keep selected. In order:
+//   - a persisted user selection wins (deterministic if several survive from
+//     legacy state, so the set self-heals down to one);
+//   - otherwise activate only what management marks for auto-apply
+//     (SkipAutoApply=false); the lexicographically first if it marks several.
+//
+// Returns "" when neither holds — we never force an arbitrary exit node on. A
+// route the map doesn't auto-apply stays off until the user selects it.
+// info.userDeselected is informational only: an explicit deselect simply keeps
+// that route out of both lists above, so it can't be picked.
+func pickPreferredExitNode(info exitNodeInfo) route.NetID {
+	if len(info.userSelected) > 0 {
+		return minNetID(info.userSelected)
+	}
+	if len(info.selectedByManagement) > 0 {
+		return minNetID(info.selectedByManagement)
+	}
+	return ""
 }
 
-func (m *DefaultManager) getRoutesToDeselect(allIDs []route.NetID) []route.NetID {
-	var routesToDeselect []route.NetID
-	for _, netID := range allIDs {
-		if !m.routeSelector.HasUserSelectionForRoute(netID) {
-			routesToDeselect = append(routesToDeselect, netID)
+// enforceSingleExitNode makes preferred the only selected exit node: every other
+// available exit node is deselected and preferred (if any) is selected, without
+// disturbing non-exit route selections. The whole reconciliation runs under a
+// single RouteSelector lock (SetExclusiveExitNode) so a concurrent deselect-all
+// cannot interleave and get undone; a global deselect-all is left untouched so
+// the user's "all off" stays in effect.
+func (m *DefaultManager) enforceSingleExitNode(preferred route.NetID, allIDs []route.NetID) {
+	m.routeSelector.SetExclusiveExitNode(preferred, allIDs)
+}
+
+func (m *DefaultManager) logExitNodeUpdate(info exitNodeInfo, preferred route.NetID) {
+	log.Debugf("Exit node selection: %d available, preferred=%q (%d user-selected, %d user-deselected, %d management-selected)",
+		len(info.allIDs), preferred, len(info.userSelected), len(info.userDeselected), len(info.selectedByManagement))
+}
+
+// minNetID returns the lexicographically smallest NetID, for a deterministic
+// default pick that stays stable across restarts.
+func minNetID(ids []route.NetID) route.NetID {
+	if len(ids) == 0 {
+		return ""
+	}
+	best := ids[0]
+	for _, id := range ids[1:] {
+		if id < best {
+			best = id
 		}
 	}
-	return routesToDeselect
-}
-
-func (m *DefaultManager) deselectExitNodes(routesToDeselect []route.NetID) {
-	if len(routesToDeselect) == 0 {
-		return
-	}
-
-	err := m.routeSelector.DeselectRoutes(routesToDeselect, routesToDeselect)
-	if err != nil {
-		log.Warnf("Failed to deselect exit nodes: %v", err)
-	}
-}
-
-func (m *DefaultManager) selectExitNodesByManagement(selectedByManagement []route.NetID, allIDs []route.NetID) {
-	if len(selectedByManagement) == 0 {
-		return
-	}
-
-	err := m.routeSelector.SelectRoutes(selectedByManagement, true, allIDs)
-	if err != nil {
-		log.Warnf("Failed to select exit nodes: %v", err)
-	}
-}
-
-func (m *DefaultManager) logExitNodeUpdate(info exitNodeInfo) {
-	log.Debugf("Updated route selector: %d exit nodes available, %d selected by management, %d user-selected, %d user-deselected",
-		len(info.allIDs), len(info.selectedByManagement), len(info.userSelected), len(info.userDeselected))
+	return best
 }
diff --git a/client/internal/routeselector/routeselector.go b/client/internal/routeselector/routeselector.go
index 232baf746..1254b384d 100644
--- a/client/internal/routeselector/routeselector.go
+++ b/client/internal/routeselector/routeselector.go
@@ -115,7 +115,38 @@ func (rs *RouteSelector) DeselectAllRoutes() {
 	clear(rs.selectedRoutes)
 }
 
-// IsDeselectAll reports whether the user has explicitly deselected all routes.
+// SetExclusiveExitNode atomically makes preferred the only selected exit node
+// among exitIDs: every other ID in exitIDs is deselected and preferred (when
+// non-empty) is selected, all under a single lock. Holding the lock across the
+// whole reconciliation prevents a concurrent DeselectAllRoutes from interleaving
+// between the deselect and select steps and being silently undone. A global
+// deselect-all is left untouched so the user's "all off" stays in effect;
+// non-exit routes are never referenced, so their selection is preserved.
+func (rs *RouteSelector) SetExclusiveExitNode(preferred route.NetID, exitIDs []route.NetID) {
+	rs.mu.Lock()
+	defer rs.mu.Unlock()
+
+	if rs.deselectAll {
+		return
+	}
+
+	for _, id := range exitIDs {
+		if id == preferred {
+			continue
+		}
+		rs.deselectedRoutes[id] = struct{}{}
+		delete(rs.selectedRoutes, id)
+	}
+
+	if preferred != "" {
+		delete(rs.deselectedRoutes, preferred)
+		rs.selectedRoutes[preferred] = struct{}{}
+	}
+}
+
+// IsDeselectAll reports whether the global "deselect all" flag is set, i.e. the
+// user explicitly disabled every route. Callers enforcing per-route invariants
+// (e.g. single exit node) should leave the selection untouched when it is.
 func (rs *RouteSelector) IsDeselectAll() bool {
 	rs.mu.RLock()
 	defer rs.mu.RUnlock()

From 3aa6c02b932db503e82f9530dddfe95d5ea212c4 Mon Sep 17 00:00:00 2001
From: Theodor Midtlien <theodor@midtlien.com>
Date: Fri, 3 Jul 2026 12:23:11 +0200
Subject: [PATCH 32/36] [client] Fix backoff.Ticker goroutine leak in reconnect
 guard

---
 client/internal/peer/guard/guard.go           |  6 +-
 client/internal/peer/guard/guard_leak_test.go | 92 +++++++++++++++++++
 2 files changed, 97 insertions(+), 1 deletion(-)
 create mode 100644 client/internal/peer/guard/guard_leak_test.go

diff --git a/client/internal/peer/guard/guard.go b/client/internal/peer/guard/guard.go
index 2e5efbcc5..6c2e846a9 100644
--- a/client/internal/peer/guard/guard.go
+++ b/client/internal/peer/guard/guard.go
@@ -85,7 +85,11 @@ func (g *Guard) reconnectLoopWithRetry(ctx context.Context, callback func()) {
 	defer g.srWatcher.RemoveListener(srReconnectedChan)
 
 	ticker := g.initialTicker(ctx)
-	defer ticker.Stop()
+	defer func() {
+		// If backoff.Ticker.send is blocked, context.Done will not close the Ticker goroutine.
+		// We have to explicitly call Stop, even if we use backoff.WithContext.
+		ticker.Stop()
+	}()
 
 	tickerChannel := ticker.C
 
diff --git a/client/internal/peer/guard/guard_leak_test.go b/client/internal/peer/guard/guard_leak_test.go
new file mode 100644
index 000000000..ded3e4aea
--- /dev/null
+++ b/client/internal/peer/guard/guard_leak_test.go
@@ -0,0 +1,92 @@
+package guard
+
+import (
+	"context"
+	"runtime"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/peer/ice"
+)
+
+func newTestGuard(status connStatusFunc) *Guard {
+	srw := NewSRWatcher(nil, nil, nil, ice.Config{})
+	return NewGuard(log.WithField("test", "guard"), status, 50*time.Millisecond, srw)
+}
+
+// countBackoffTickerGoroutines returns how many goroutines are currently sitting
+// in backoff/v4.(*Ticker).run (a ticker goroutine that has not exited).
+func countBackoffTickerGoroutines() int {
+	buf := make([]byte, 1<<25) // 32MB
+	n := runtime.Stack(buf, true)
+	return strings.Count(string(buf[:n]), "backoff/v4.(*Ticker).run")
+}
+
+// TestGuard_ReconnectTicker_NoGoroutineLeakOnShutdown reproduces a observed
+// leak: after a shutdown burst, ticker run/send goroutines stay parked
+// forever even though every reconnect loop has exited.
+func TestGuard_ReconnectTicker_NoGoroutineLeakOnShutdown(t *testing.T) {
+	before := countBackoffTickerGoroutines()
+
+	const peers = 6000
+	cancels := make([]context.CancelFunc, 0, peers)
+	var wg sync.WaitGroup
+
+	// A status check slower than the tick cadence. This models the real
+	// isConnectedOnAllWay/callback doing work: while the loop is busy in the
+	// handler, the ticker fires the next tick and parks in send(), because
+	// send() never selects on ctx.
+	slowStatus := func() ConnStatus {
+		time.Sleep(70 * time.Millisecond)
+		return ConnStatusConnected
+	}
+
+	for range peers {
+		g := newTestGuard(slowStatus)
+		ctx, cancel := context.WithCancel(context.Background())
+		cancels = append(cancels, cancel)
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			g.Start(ctx, func() {})
+		}()
+		// Force the live ticker to be a newReconnectTicker.
+		g.SetRelayedConnDisconnected()
+	}
+
+	// Let the replacement tickers get past their 800ms initial interval, so
+	// many are parked in send() waiting on the (slow) consumer when we tear
+	// everything down.
+	time.Sleep(1500 * time.Millisecond)
+
+	// Shutdown burst: cancel every peer at once, like engine teardown.
+	for _, c := range cancels {
+		c()
+	}
+
+	// Every reconnect loop must return
+	waitCh := make(chan struct{})
+	go func() { wg.Wait(); close(waitCh) }()
+	select {
+	case <-waitCh:
+	case <-time.After(30 * time.Second):
+		t.Fatal("not all reconnect loops returned after ctx cancel")
+	}
+
+	// Give any correctly-stopped ticker goroutines time to unwind.
+	for range 50 {
+		runtime.Gosched()
+		time.Sleep(10 * time.Millisecond)
+	}
+
+	leaked := countBackoffTickerGoroutines() - before
+	t.Logf("backoff Ticker.run goroutines still parked after teardown of %d peers: %d", peers, leaked)
+	if leaked > 0 {
+		t.Errorf("LEAK: %d backoff ticker goroutines parked after all reconnect loops exited "+
+			"(defer ticker.Stop() stops the initial ticker, not the live replacement)", leaked)
+	}
+}

From c9d387bd0d75173f7599228423895a3d3a3dfdfa Mon Sep 17 00:00:00 2001
From: Riccardo Manfrin <3090891+riccardomanfrin@users.noreply.github.com>
Date: Mon, 6 Jul 2026 11:39:20 +0200
Subject: [PATCH 33/36] [client] fix MDM managementURL conflict on default-port
 URL echo (#6672)

* Adds failing test

* Fixes Management URL normalized compare on MDM
---
 client/server/mdm.go                | 36 ++++++++++++++++++++++++++--
 client/server/setconfig_mdm_test.go | 37 +++++++++++++++++++++++++++++
 2 files changed, 71 insertions(+), 2 deletions(-)

diff --git a/client/server/mdm.go b/client/server/mdm.go
index db7db2759..1e1005e05 100644
--- a/client/server/mdm.go
+++ b/client/server/mdm.go
@@ -3,6 +3,7 @@ package server
 import (
 	"context"
 	"fmt"
+	"net/url"
 	"time"
 
 	log "github.com/sirupsen/logrus"
@@ -181,6 +182,37 @@ func conflictBool(key string, p *bool) conflictCheck {
 	}
 }
 
+func canonicalURL(s string) string {
+	u, err := url.ParseRequestURI(s)
+	if err != nil {
+		return s
+	}
+	if u.Port() == "" {
+		switch u.Scheme {
+		case "https":
+			u.Host += ":443"
+		case "http":
+			u.Host += ":80"
+		}
+	}
+	return u.String()
+}
+
+// conflictURL is conflictString for URL-typed keys: both sides are
+// normalized via canonicalURL before comparison.
+func conflictURL(key, got string) conflictCheck {
+	return conflictCheck{
+		key: key,
+		check: func(pol *mdm.Policy) bool {
+			if got == "" {
+				return true
+			}
+			want, ok := pol.GetString(key)
+			return ok && canonicalURL(want) == canonicalURL(got)
+		},
+	}
+}
+
 // conflictString builds a conflictCheck for a string MDM key. An empty
 // `got` is treated as "field not set" (no override requested); otherwise
 // the check returns true only when the policy contains the key and its
@@ -256,7 +288,7 @@ func mdmManagedFieldConflicts(msg *proto.SetConfigRequest, policy *mdm.Policy) [
 	}
 
 	return resolveConflicts(policy, []conflictCheck{
-		conflictString(mdm.KeyManagementURL, msg.ManagementUrl),
+		conflictURL(mdm.KeyManagementURL, msg.ManagementUrl),
 		conflictString(mdm.KeyPreSharedKey, pskGot),
 		conflictBool(mdm.KeyRosenpassEnabled, msg.RosenpassEnabled),
 		conflictBool(mdm.KeyRosenpassPermissive, msg.RosenpassPermissive),
@@ -377,7 +409,7 @@ func loginRequestMDMConflicts(msg *proto.LoginRequest, policy *mdm.Policy) []str
 	}
 
 	return resolveConflicts(policy, []conflictCheck{
-		conflictString(mdm.KeyManagementURL, msg.ManagementUrl),
+		conflictURL(mdm.KeyManagementURL, msg.ManagementUrl),
 		conflictString(mdm.KeyPreSharedKey, pskGot),
 		conflictBool(mdm.KeyRosenpassEnabled, msg.RosenpassEnabled),
 		conflictBool(mdm.KeyRosenpassPermissive, msg.RosenpassPermissive),
diff --git a/client/server/setconfig_mdm_test.go b/client/server/setconfig_mdm_test.go
index 9818f9fdf..9baf16136 100644
--- a/client/server/setconfig_mdm_test.go
+++ b/client/server/setconfig_mdm_test.go
@@ -181,6 +181,43 @@ func TestSetConfig_MDMAllow_NonManagedFields(t *testing.T) {
 	require.NotNil(t, resp)
 }
 
+// TestSetConfig_MDMAllow_ManagementURLPortNormalized covers the
+// regression from discussion #6483: MDM URL without explicit port vs
+// UI echo with the parseURL-appended default port must be treated as
+// a no-op echo, not a conflict.
+func TestSetConfig_MDMAllow_ManagementURLPortNormalized(t *testing.T) {
+	tests := []struct {
+		name      string
+		mdmURL    string
+		submitURL string
+	}{
+		{"policy_no_port_submit_with_443", "https://netbird.corp.example", "https://netbird.corp.example:443"},
+		{"policy_with_443_submit_no_port", "https://netbird.corp.example:443", "https://netbird.corp.example"},
+		{"http_policy_no_port_submit_with_80", "http://netbird.corp.example", "http://netbird.corp.example:80"},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+				mdm.KeyManagementURL: tc.mdmURL,
+			}))
+
+			s, ctx, profName, username, _ := setupServerWithProfile(t)
+
+			rosenpassEnabled := true
+			resp, err := s.SetConfig(ctx, &proto.SetConfigRequest{
+				ProfileName:      profName,
+				Username:         username,
+				ManagementUrl:    tc.submitURL,
+				RosenpassEnabled: &rosenpassEnabled,
+			})
+
+			require.NoError(t, err, "port-normalized URL echo must not trip MDM conflict gate")
+			require.NotNil(t, resp)
+		})
+	}
+}
+
 func TestSetConfig_MDMEmpty_NoEnforcement(t *testing.T) {
 	// No MDM policy active: any field can be written.
 	withMDMPolicy(t, mdm.NewPolicy(nil))

From 91acb8147ccd1528f53bed1024a3d9a5309aa853 Mon Sep 17 00:00:00 2001
From: Maycon Santos <mlsmaycon@gmail.com>
Date: Mon, 6 Jul 2026 13:47:16 +0200
Subject: [PATCH 34/36] [management,client] 0.75.0 release  with new desktop UI
 (#6473)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- **Wails v3 application** (`client/ui`) with a React + TypeScript + Tailwind frontend replacing the Fyne UI: main connection view, exit-node switcher, networks/peers browser with detail panels, profile management, settings (general, network, SSH, security, troubleshooting, appearance), debug-bundle creation, and a first-run welcome flow.
- **Internationalization**: go-i18n bundle with 9 locales (en, de, es, fr, hu, it, pt, ru, zh-CN) shared between the tray and the frontend.
- **New system tray** implementation with per-platform theme-aware icons, including a native XEmbed host for Linux (`xembed_tray_linux.c`) and a Linux theme watcher.
- **Session handling**: auth session watcher (`client/internal/auth/sessionwatch`), pending login flow, session-expiration dialog and tray notifications, and `netbird login` improvements.
- **Daemon API extensions** (`daemon.proto`): status stream subscription, event stream, networks/exit-node selection endpoints, and richer full status — with probe throttling on the daemon side to protect against UI-driven request storms.
- **UI preferences store** persisted per profile, autostart management via the daemon (single source of truth in HKCU on Windows).
- **Build system**: Taskfile-based builds per platform (macOS, Linux, Windows), Docker cross-compilation images, MSIX/NSIS/nfpm/AppImage packaging, and a new `frontend-ui` CI workflow.

Co-authored-by: Zoltan Papp <zoltan.pmail@gmail.com>
Co-authored-by: Eduard Gert <kontakt@eduardgert.de>
Co-authored-by: braginini <bangvalo@gmail.com>
Co-authored-by: Pascal Fischer <32096965+pascal-fischer@users.noreply.github.com>
Co-authored-by: riccardom <riccardomanfrin@gmail.com>
---
 .coderabbit.yaml                              |   18 +
 .devcontainer/Dockerfile                      |    1 -
 .github/workflows/frontend-ui.yml             |   98 +
 .github/workflows/golang-test-darwin.yml      |   10 +-
 .github/workflows/golang-test-linux.yml       |   17 +-
 .github/workflows/golang-test-windows.yml     |    9 +-
 .github/workflows/golangci-lint.yml           |   21 +-
 .github/workflows/release.yml                 |   81 +-
 .github/workflows/wasm-build-validation.yml   |    2 +-
 .golangci.yaml                                |   10 +
 .goreleaser.yaml                              |    2 +
 .goreleaser_ui.yaml                           |   26 +-
 .goreleaser_ui_darwin.yaml                    |   11 +-
 CONTRIBUTING.md                               |   55 +-
 client/cmd/login.go                           |   77 +
 client/cmd/status.go                          |    7 +
 client/embed/embed.go                         |    2 +-
 client/installer.nsis                         |  101 +-
 client/internal/auth/auth.go                  |   42 +
 client/internal/auth/auth_test.go             |   80 +
 client/internal/auth/pending_flow.go          |   89 +
 client/internal/auth/sessionwatch/event.go    |   82 +
 client/internal/auth/sessionwatch/watcher.go  |  387 ++
 .../auth/sessionwatch/watcher_test.go         |  519 ++
 client/internal/connect.go                    |   17 +
 client/internal/debug/debug.go                |   45 +-
 client/internal/debug/debug_logfiles_test.go  |   25 +-
 client/internal/engine.go                     |   52 +-
 client/internal/engine_authsession.go         |  108 +
 .../internal/engine_session_deadline_test.go  |   78 +
 client/internal/engine_sessionwatch.go        |   16 +
 client/internal/engine_sessionwatch_js.go     |   44 +
 client/internal/peer/status.go                |  201 +-
 client/internal/peer/status_test.go           |   36 +
 client/internal/profilemanager/state.go       |   20 +
 client/internal/routemanager/manager.go       |    9 +
 .../routeselector/routeselector_test.go       |   28 +
 client/internal/state.go                      |   38 +-
 client/mdm/canonical_loaders.go               |    1 +
 client/mdm/policy.go                          |    7 +
 client/netbird.wxs                            |   57 +-
 client/proto/daemon.pb.go                     | 1379 +++--
 client/proto/daemon.proto                     |  117 +
 client/proto/daemon_grpc.pb.go                |  283 +-
 client/proto/metadata.go                      |   61 +
 client/server/debug.go                        |   23 +-
 client/server/event.go                        |   32 +
 client/server/extend_authsession_test.go      |   42 +
 client/server/mdm.go                          |   11 +-
 client/server/network.go                      |   46 +
 client/server/network_exitnode_test.go        |   26 +
 client/server/probe_throttle.go               |   88 +
 client/server/probe_throttle_test.go          |  109 +
 client/server/server.go                       |  475 +-
 client/server/server_privileged_test.go       |   27 +-
 client/server/status_stream.go                |   57 +
 client/ssh/server/test.go                     |    8 +
 client/status/status.go                       |   78 +
 client/status/status_test.go                  |   47 +
 client/ui/.gitignore                          |    8 +
 client/ui/Netbird.icns                        |  Bin 80549 -> 0 bytes
 client/ui/Taskfile.yml                        |   58 +
 client/ui/assets/connected.png                |  Bin 4743 -> 0 bytes
 client/ui/assets/disconnected.png             |  Bin 10530 -> 0 bytes
 client/ui/assets/netbird-disconnected.ico     |  Bin 5056 -> 0 bytes
 client/ui/assets/netbird-disconnected.png     |  Bin 7537 -> 0 bytes
 client/ui/assets/netbird-menu-16.png          |  Bin 0 -> 526 bytes
 client/ui/assets/netbird-menu-24.png          |  Bin 0 -> 739 bytes
 client/ui/assets/netbird-menu-about-18.png    |  Bin 0 -> 838 bytes
 .../assets/netbird-menu-dot-connected-16.png  |  Bin 0 -> 508 bytes
 .../assets/netbird-menu-dot-connected-22.png  |  Bin 0 -> 615 bytes
 .../ui/assets/netbird-menu-dot-connected.png  |  Bin 0 -> 452 bytes
 .../assets/netbird-menu-dot-connecting-16.png |  Bin 0 -> 520 bytes
 .../assets/netbird-menu-dot-connecting-22.png |  Bin 0 -> 637 bytes
 .../ui/assets/netbird-menu-dot-connecting.png |  Bin 0 -> 452 bytes
 .../ui/assets/netbird-menu-dot-error-16.png   |  Bin 0 -> 532 bytes
 .../ui/assets/netbird-menu-dot-error-22.png   |  Bin 0 -> 629 bytes
 client/ui/assets/netbird-menu-dot-error.png   |  Bin 0 -> 433 bytes
 client/ui/assets/netbird-menu-dot-idle-16.png |  Bin 0 -> 490 bytes
 client/ui/assets/netbird-menu-dot-idle-22.png |  Bin 0 -> 602 bytes
 client/ui/assets/netbird-menu-dot-idle.png    |  Bin 0 -> 483 bytes
 .../ui/assets/netbird-menu-dot-offline-16.png |  Bin 0 -> 512 bytes
 .../ui/assets/netbird-menu-dot-offline-22.png |  Bin 0 -> 605 bytes
 client/ui/assets/netbird-menu-dot-offline.png |  Bin 0 -> 456 bytes
 .../netbird-systemtray-connected-dark.ico     |  Bin 105144 -> 0 bytes
 .../netbird-systemtray-connected-macos.png    |  Bin 3858 -> 3690 bytes
 ...netbird-systemtray-connected-mono-dark.png |  Bin 0 -> 1548 bytes
 .../netbird-systemtray-connected-mono.png     |  Bin 0 -> 1388 bytes
 .../assets/netbird-systemtray-connected.ico   |  Bin 105151 -> 0 bytes
 .../netbird-systemtray-connecting-dark.ico    |  Bin 105128 -> 0 bytes
 .../netbird-systemtray-connecting-macos.png   |  Bin 3843 -> 3725 bytes
 ...etbird-systemtray-connecting-mono-dark.png |  Bin 0 -> 1448 bytes
 .../netbird-systemtray-connecting-mono.png    |  Bin 0 -> 1274 bytes
 .../assets/netbird-systemtray-connecting.ico  |  Bin 105091 -> 0 bytes
 .../netbird-systemtray-disconnected-macos.png |  Bin 3491 -> 3474 bytes
 ...bird-systemtray-disconnected-mono-dark.png |  Bin 0 -> 1235 bytes
 .../netbird-systemtray-disconnected-mono.png  |  Bin 0 -> 1088 bytes
 .../netbird-systemtray-disconnected.ico       |  Bin 104575 -> 0 bytes
 .../assets/netbird-systemtray-error-dark.ico  |  Bin 105062 -> 0 bytes
 .../assets/netbird-systemtray-error-macos.png |  Bin 3837 -> 3555 bytes
 .../netbird-systemtray-error-mono-dark.png    |  Bin 0 -> 1571 bytes
 .../assets/netbird-systemtray-error-mono.png  |  Bin 0 -> 1449 bytes
 client/ui/assets/netbird-systemtray-error.ico |  Bin 105013 -> 0 bytes
 .../netbird-systemtray-needs-login-macos.png  |  Bin 0 -> 3555 bytes
 ...tbird-systemtray-needs-login-mono-dark.png |  Bin 0 -> 1571 bytes
 .../netbird-systemtray-needs-login-mono.png   |  Bin 0 -> 1449 bytes
 .../assets/netbird-systemtray-needs-login.png |  Bin 0 -> 5260 bytes
 ...tbird-systemtray-update-connected-dark.ico |  Bin 104704 -> 0 bytes
 ...bird-systemtray-update-connected-macos.png |  Bin 3570 -> 3328 bytes
 ...-systemtray-update-connected-mono-dark.png |  Bin 0 -> 1553 bytes
 ...tbird-systemtray-update-connected-mono.png |  Bin 0 -> 1405 bytes
 .../netbird-systemtray-update-connected.ico   |  Bin 104698 -> 0 bytes
 ...rd-systemtray-update-disconnected-dark.ico |  Bin 105086 -> 0 bytes
 ...d-systemtray-update-disconnected-macos.png |  Bin 3816 -> 3747 bytes
 ...stemtray-update-disconnected-mono-dark.png |  Bin 0 -> 1444 bytes
 ...rd-systemtray-update-disconnected-mono.png |  Bin 0 -> 1322 bytes
 ...netbird-systemtray-update-disconnected.ico |  Bin 105115 -> 0 bytes
 client/ui/assets/netbird.ico                  |  Bin 106176 -> 0 bytes
 client/ui/assets/svg/needs-login.svg          |   10 +
 client/ui/assets/svg/netbird-menu.svg         |    7 +
 client/ui/authsession/service.go              |  116 +
 client/ui/authsession/warning.go              |   64 +
 client/ui/authsession/warning_test.go         |   82 +
 client/ui/build/Taskfile.yml                  |  295 +
 .../appicon.icon/Assets/wails_icon_vector.svg |   13 +
 client/ui/build/appicon.icon/icon.json        |   26 +
 client/ui/build/appicon.png                   |  Bin 0 -> 90556 bytes
 client/ui/build/build-ui-linux.sh             |    5 -
 client/ui/build/config.yml                    |   78 +
 client/ui/build/darwin/Info.dev.plist         |   38 +
 client/ui/build/darwin/Info.plist             |   36 +
 client/ui/build/darwin/Taskfile.yml           |  210 +
 client/ui/build/darwin/icons.icns             |  Bin 0 -> 141191 bytes
 client/ui/build/docker/Dockerfile.cross       |  203 +
 client/ui/build/docker/Dockerfile.server      |   41 +
 client/ui/build/linux/Taskfile.yml            |  235 +
 client/ui/build/linux/appimage/build.sh       |   35 +
 client/ui/build/linux/desktop                 |   13 +
 client/ui/build/linux/netbird-ui.desktop      |   10 +
 client/ui/build/{ => linux}/netbird.desktop   |    3 +-
 client/ui/build/linux/nfpm/nfpm.yaml          |   70 +
 .../build/linux/nfpm/scripts/postinstall.sh   |   21 +
 .../ui/build/linux/nfpm/scripts/postremove.sh |    1 +
 .../ui/build/linux/nfpm/scripts/preinstall.sh |    1 +
 .../ui/build/linux/nfpm/scripts/preremove.sh  |    1 +
 client/ui/build/windows/Taskfile.yml          |  243 +
 client/ui/build/windows/icon.ico              |  Bin 0 -> 18126 bytes
 client/ui/build/windows/info.json             |   15 +
 client/ui/build/windows/msix/app_manifest.xml |   55 +
 client/ui/build/windows/msix/template.xml     |   54 +
 client/ui/build/windows/nsis/project.nsi      |  114 +
 client/ui/build/windows/nsis/wails_tools.nsh  |  236 +
 client/ui/build/windows/wails.exe.manifest    |   22 +
 client/ui/client_ui.go                        | 2016 -------
 client/ui/const.go                            |   15 -
 client/ui/debug.go                            |  730 ---
 client/ui/dock_darwin.go                      |   70 +
 client/ui/dock_other.go                       |    7 +
 client/ui/event/event.go                      |  184 -
 client/ui/event_handler.go                    |  315 -
 client/ui/font_bsd.go                         |   30 -
 client/ui/font_darwin.go                      |   18 -
 client/ui/font_linux.go                       |    7 -
 client/ui/font_windows.go                     |   90 -
 client/ui/frontend/.prettierignore            |    7 +
 client/ui/frontend/.prettierrc                |   12 +
 client/ui/frontend/WAILS-API.md               |  296 +
 client/ui/frontend/eslint.config.js           |   75 +
 client/ui/frontend/index.html                 |   15 +
 client/ui/frontend/package.json               |   69 +
 client/ui/frontend/pnpm-lock.yaml             | 5240 +++++++++++++++++
 client/ui/frontend/pnpm-workspace.yaml        |    2 +
 client/ui/frontend/postcss.config.js          |    6 +
 client/ui/frontend/src/app.tsx                |   61 +
 .../src/assets/fonts/inter-variable.ttf       |  Bin 0 -> 879708 bytes
 .../assets/fonts/jetbrains-mono-variable.ttf  |  Bin 0 -> 303144 bytes
 .../frontend/src/assets/img/tray-darwin.png   |  Bin 0 -> 196162 bytes
 .../ui/frontend/src/assets/img/tray-linux.png |  Bin 0 -> 177484 bytes
 .../frontend/src/assets/img/tray-windows.png  |  Bin 0 -> 159312 bytes
 .../src/assets/logos/netbird-full.svg         |   19 +
 .../ui/frontend/src/assets/logos/netbird.svg  |    5 +
 client/ui/frontend/src/components/Badge.tsx   |   43 +
 .../src/components/CopyToClipboard.tsx        |  126 +
 .../frontend/src/components/DropdownMenu.tsx  |  233 +
 .../src/components/LanguagePicker.tsx         |  235 +
 .../src/components/ManagementServerSwitch.tsx |   38 +
 .../ui/frontend/src/components/SquareIcon.tsx |   37 +
 client/ui/frontend/src/components/Tooltip.tsx |   98 +
 .../frontend/src/components/TruncatedText.tsx |   32 +
 .../frontend/src/components/VerticalTabs.tsx  |   98 +
 .../src/components/buttons/Button.tsx         |  195 +
 .../src/components/buttons/IconButton.tsx     |   36 +
 .../src/components/dialog/ConfirmDialog.tsx   |   35 +
 .../src/components/dialog/ConfirmModal.tsx    |   84 +
 .../frontend/src/components/dialog/Dialog.tsx |  159 +
 .../src/components/dialog/DialogActions.tsx   |   13 +
 .../components/dialog/DialogDescription.tsx   |   26 +
 .../src/components/dialog/DialogHeading.tsx   |   35 +
 .../empty-state/DaemonOutdatedOverlay.tsx     |   50 +
 .../empty-state/DaemonUnavailableOverlay.tsx  |   52 +
 .../src/components/empty-state/EmptyState.tsx |   31 +
 .../src/components/empty-state/NoResults.tsx  |   22 +
 .../empty-state/NotConnectedState.tsx         |   16 +
 .../frontend/src/components/inputs/Input.tsx  |  374 ++
 .../src/components/inputs/SearchInput.tsx     |   59 +
 .../components/switches/FancyToggleSwitch.tsx |  102 +
 .../src/components/switches/SwitchItem.tsx    |   42 +
 .../components/switches/SwitchItemGroup.tsx   |   60 +
 .../src/components/switches/ToggleSwitch.tsx  |   77 +
 .../src/components/typography/HelpText.tsx    |   24 +
 .../src/components/typography/Label.tsx       |   42 +
 .../src/contexts/ClientVersionContext.tsx     |  114 +
 .../src/contexts/DebugBundleContext.tsx       |  314 +
 .../frontend/src/contexts/DialogContext.tsx   |   68 +
 .../src/contexts/NavSectionContext.tsx        |   24 +
 .../frontend/src/contexts/NetworksContext.tsx |  222 +
 .../src/contexts/PeerDetailContext.tsx        |   50 +
 .../frontend/src/contexts/ProfileContext.tsx  |  182 +
 .../src/contexts/RestrictionsContext.tsx      |   65 +
 .../frontend/src/contexts/SettingsContext.tsx |  267 +
 .../frontend/src/contexts/StatusContext.tsx   |  106 +
 .../frontend/src/contexts/ViewModeContext.tsx |   89 +
 client/ui/frontend/src/globals.css            |   45 +
 .../frontend/src/hooks/useAutoSizeWindow.ts   |   60 +
 .../ui/frontend/src/hooks/useFocusVisible.ts  |   49 +
 .../frontend/src/hooks/useKeyboardShortcut.ts |   46 +
 .../ui/frontend/src/hooks/useManagementUrl.ts |  143 +
 client/ui/frontend/src/layouts/AppLayout.tsx  |   27 +
 .../ui/frontend/src/layouts/AppRightPanel.tsx |   38 +
 client/ui/frontend/src/lib/cn.ts              |    6 +
 client/ui/frontend/src/lib/compat.ts          |   19 +
 client/ui/frontend/src/lib/connection.ts      |  121 +
 client/ui/frontend/src/lib/errors.ts          |   60 +
 client/ui/frontend/src/lib/formatters.ts      |   44 +
 client/ui/frontend/src/lib/i18n.ts            |  103 +
 client/ui/frontend/src/lib/logs.ts            |  139 +
 client/ui/frontend/src/lib/platform.ts        |   39 +
 client/ui/frontend/src/lib/sorting.ts         |   27 +
 client/ui/frontend/src/lib/welcome.ts         |   25 +
 .../src/modules/auto-update/UpdateBadge.tsx   |   27 +
 .../auto-update/UpdateInProgressDialog.tsx    |  187 +
 .../modules/auto-update/UpdateVersionCard.tsx |   96 +
 .../src/modules/error/ErrorDialog.tsx         |   64 +
 .../login/LoginWaitingForBrowserDialog.tsx    |   90 +
 .../main/MainConnectionStatusSwitch.tsx       |  410 ++
 .../src/modules/main/MainExitNodeSwitcher.tsx |  256 +
 .../frontend/src/modules/main/MainHeader.tsx  |  192 +
 .../ui/frontend/src/modules/main/MainPage.tsx |  114 +
 .../src/modules/main/advanced/Navigation.tsx  |  134 +
 .../main/advanced/networks/NetworkFilters.tsx |   84 +
 .../main/advanced/networks/Networks.tsx       |  528 ++
 .../main/advanced/peers/PeerDetailPanel.tsx   |  575 ++
 .../main/advanced/peers/PeerFilters.tsx       |   84 +
 .../src/modules/main/advanced/peers/Peers.tsx |  353 ++
 .../src/modules/profiles/ProfileAvatar.tsx    |   76 +
 .../modules/profiles/ProfileCreationModal.tsx |  263 +
 .../src/modules/profiles/ProfileDropdown.tsx  |  293 +
 .../src/modules/profiles/ProfilesTab.tsx      |  679 +++
 .../session/SessionExpirationDialog.tsx       |  202 +
 .../src/modules/settings/SettingsAbout.tsx    |  169 +
 .../src/modules/settings/SettingsAccent.tsx   |  116 +
 .../src/modules/settings/SettingsAdvanced.tsx |  179 +
 .../src/modules/settings/SettingsGeneral.tsx  |  113 +
 .../modules/settings/SettingsNavigation.tsx   |   87 +
 .../src/modules/settings/SettingsNetwork.tsx  |   55 +
 .../src/modules/settings/SettingsPage.tsx     |  131 +
 .../src/modules/settings/SettingsSSH.tsx      |  119 +
 .../src/modules/settings/SettingsSection.tsx  |   43 +
 .../src/modules/settings/SettingsSecurity.tsx |   61 +
 .../src/modules/settings/SettingsSkeleton.tsx |   27 +
 .../settings/SettingsTroubleshooting.tsx      |  337 ++
 .../src/modules/welcome/WelcomeDialog.tsx     |  170 +
 .../modules/welcome/WelcomeStepManagement.tsx |  135 +
 .../src/modules/welcome/WelcomeStepTray.tsx   |   58 +
 client/ui/frontend/src/vite-env.d.ts          |    1 +
 client/ui/frontend/tailwind.config.ts         |  177 +
 client/ui/frontend/tsconfig.json              |   30 +
 client/ui/frontend/vite.config.ts             |   28 +
 client/ui/grpc.go                             |   67 +
 client/ui/guilog/debuglog.go                  |   77 +
 client/ui/i18n/TRANSLATING.md                 |  133 +
 client/ui/i18n/bundle.go                      |  196 +
 client/ui/i18n/bundle_test.go                 |  156 +
 client/ui/i18n/locales/_index.json            |   13 +
 client/ui/i18n/locales/de/common.json         | 1325 +++++
 client/ui/i18n/locales/en/common.json         | 1766 ++++++
 client/ui/i18n/locales/es/common.json         | 1325 +++++
 client/ui/i18n/locales/fr/common.json         | 1325 +++++
 client/ui/i18n/locales/hu/common.json         | 1325 +++++
 client/ui/i18n/locales/it/common.json         | 1325 +++++
 client/ui/i18n/locales/pt/common.json         | 1325 +++++
 client/ui/i18n/locales/ru/common.json         | 1325 +++++
 client/ui/i18n/locales/zh-CN/common.json      | 1325 +++++
 client/ui/icons.go                            |  112 +-
 client/ui/icons_menu_darwin.go                |   23 +
 client/ui/icons_menu_linux.go                 |   22 +
 client/ui/icons_menu_windows.go               |   24 +
 client/ui/icons_windows.go                    |   44 -
 client/ui/localizer.go                        |  130 +
 client/ui/main.go                             |  387 ++
 client/ui/manifest.xml                        |   17 -
 client/ui/network.go                          |  707 ---
 client/ui/notifier/notifier.go                |   27 -
 client/ui/notifier/notifier_other.go          |    9 -
 client/ui/notifier/notifier_windows.go        |   88 -
 client/ui/preferences/store.go                |  267 +
 client/ui/preferences/store_test.go           |  225 +
 client/ui/process/process.go                  |   38 -
 client/ui/process/process_nonwindows.go       |   26 -
 client/ui/process/process_windows.go          |   24 -
 client/ui/profile.go                          |  775 ---
 client/ui/quickactions.go                     |  349 --
 client/ui/quickactions_assets.go              |   23 -
 client/ui/recenter_linux.go                   |   13 +
 client/ui/recenter_other.go                   |   10 +
 client/ui/services/autostart.go               |   52 +
 client/ui/services/compat.go                  |   40 +
 client/ui/services/conn.go                    |   13 +
 client/ui/services/connection.go              |  223 +
 client/ui/services/cursor_darwin.go           |   42 +
 client/ui/services/cursor_linux.go            |   53 +
 client/ui/services/cursor_other.go            |    9 +
 client/ui/services/cursor_windows.go          |   17 +
 client/ui/services/daemon_feed.go             |  590 ++
 client/ui/services/debug.go                   |  136 +
 client/ui/services/debug_reveal_other.go      |   20 +
 client/ui/services/debug_reveal_windows.go    |   54 +
 client/ui/services/errors.go                  |  133 +
 client/ui/services/errors_test.go             |   50 +
 client/ui/services/foreground_other.go        |   11 +
 client/ui/services/foreground_windows.go      |   43 +
 client/ui/services/forwarding.go              |   83 +
 client/ui/services/i18n.go                    |   30 +
 client/ui/services/network.go                 |   88 +
 client/ui/services/preferences.go             |   36 +
 client/ui/services/profile.go                 |  179 +
 client/ui/services/profileswitcher.go         |   92 +
 client/ui/services/session.go                 |   48 +
 client/ui/services/settings.go                |  256 +
 client/ui/services/uilog.go                   |   36 +
 client/ui/services/update.go                  |   73 +
 client/ui/services/version.go                 |   22 +
 client/ui/services/windowmanager.go           |  576 ++
 client/ui/signal_unix.go                      |   63 +-
 client/ui/signal_windows.go                   |  161 +-
 client/ui/tray.go                             |  531 ++
 client/ui/tray_click_linux.go                 |   31 +
 client/ui/tray_click_other.go                 |   13 +
 client/ui/tray_click_windows.go               |    8 +
 client/ui/tray_events.go                      |  137 +
 client/ui/tray_exitnodes.go                   |  148 +
 client/ui/tray_features.go                    |   37 +
 client/ui/tray_icon.go                        |  136 +
 client/ui/tray_label_other.go                 |    7 +
 client/ui/tray_label_windows.go               |   11 +
 client/ui/tray_linux.go                       |   71 +
 client/ui/tray_notify.go                      |   58 +
 client/ui/tray_profiles.go                    |  194 +
 client/ui/tray_session.go                     |  271 +
 client/ui/tray_status.go                      |  126 +
 client/ui/tray_status_enabled_linux.go        |    8 +
 client/ui/tray_status_enabled_other.go        |    7 +
 client/ui/tray_status_enabled_windows.go      |    7 +
 client/ui/tray_theme_linux.go                 |  134 +
 client/ui/tray_theme_linux_test.go            |   86 +
 client/ui/tray_theme_other.go                 |    7 +
 client/ui/tray_theme_watcher_linux.go         |  246 +
 client/ui/tray_update.go                      |  197 +
 client/ui/tray_watcher_linux.go               |  176 +
 client/ui/tray_watcher_other.go               |    9 +
 client/ui/uilogpath.go                        |   37 +
 client/ui/update.go                           |  140 -
 client/ui/update_notwindows.go                |    7 -
 client/ui/update_windows.go                   |   44 -
 client/ui/updater/state.go                    |   97 +
 client/ui/xembed_host_linux.go                |  443 ++
 client/ui/xembed_tray_linux.c                 |  708 +++
 client/ui/xembed_tray_linux.h                 |   81 +
 docs/io.netbird.client.plist                  |    7 +
 docs/netbird-macos.mobileconfig               |    2 +
 docs/netbird-macos.sh                         |    2 +
 docs/netbird-policy.reg                       |  Bin 1418 -> 1490 bytes
 docs/netbird.adml                             |    3 +
 docs/netbird.admx                             |   12 +
 go.mod                                        |   63 +-
 go.sum                                        |  136 +-
 shared/management/client/grpc.go              |   26 +-
 sonar-project.properties                      |    2 +
 util/log.go                                   |   55 +-
 389 files changed, 46269 insertions(+), 6684 deletions(-)
 create mode 100644 .coderabbit.yaml
 create mode 100644 .github/workflows/frontend-ui.yml
 create mode 100644 client/internal/auth/auth_test.go
 create mode 100644 client/internal/auth/pending_flow.go
 create mode 100644 client/internal/auth/sessionwatch/event.go
 create mode 100644 client/internal/auth/sessionwatch/watcher.go
 create mode 100644 client/internal/auth/sessionwatch/watcher_test.go
 create mode 100644 client/internal/engine_authsession.go
 create mode 100644 client/internal/engine_session_deadline_test.go
 create mode 100644 client/internal/engine_sessionwatch.go
 create mode 100644 client/internal/engine_sessionwatch_js.go
 create mode 100644 client/proto/metadata.go
 create mode 100644 client/server/extend_authsession_test.go
 create mode 100644 client/server/network_exitnode_test.go
 create mode 100644 client/server/probe_throttle.go
 create mode 100644 client/server/probe_throttle_test.go
 create mode 100644 client/server/status_stream.go
 create mode 100644 client/ui/.gitignore
 delete mode 100644 client/ui/Netbird.icns
 create mode 100644 client/ui/Taskfile.yml
 delete mode 100644 client/ui/assets/connected.png
 delete mode 100644 client/ui/assets/disconnected.png
 delete mode 100644 client/ui/assets/netbird-disconnected.ico
 delete mode 100644 client/ui/assets/netbird-disconnected.png
 create mode 100644 client/ui/assets/netbird-menu-16.png
 create mode 100644 client/ui/assets/netbird-menu-24.png
 create mode 100644 client/ui/assets/netbird-menu-about-18.png
 create mode 100644 client/ui/assets/netbird-menu-dot-connected-16.png
 create mode 100644 client/ui/assets/netbird-menu-dot-connected-22.png
 create mode 100644 client/ui/assets/netbird-menu-dot-connected.png
 create mode 100644 client/ui/assets/netbird-menu-dot-connecting-16.png
 create mode 100644 client/ui/assets/netbird-menu-dot-connecting-22.png
 create mode 100644 client/ui/assets/netbird-menu-dot-connecting.png
 create mode 100644 client/ui/assets/netbird-menu-dot-error-16.png
 create mode 100644 client/ui/assets/netbird-menu-dot-error-22.png
 create mode 100644 client/ui/assets/netbird-menu-dot-error.png
 create mode 100644 client/ui/assets/netbird-menu-dot-idle-16.png
 create mode 100644 client/ui/assets/netbird-menu-dot-idle-22.png
 create mode 100644 client/ui/assets/netbird-menu-dot-idle.png
 create mode 100644 client/ui/assets/netbird-menu-dot-offline-16.png
 create mode 100644 client/ui/assets/netbird-menu-dot-offline-22.png
 create mode 100644 client/ui/assets/netbird-menu-dot-offline.png
 delete mode 100644 client/ui/assets/netbird-systemtray-connected-dark.ico
 create mode 100644 client/ui/assets/netbird-systemtray-connected-mono-dark.png
 create mode 100644 client/ui/assets/netbird-systemtray-connected-mono.png
 delete mode 100644 client/ui/assets/netbird-systemtray-connected.ico
 delete mode 100644 client/ui/assets/netbird-systemtray-connecting-dark.ico
 create mode 100644 client/ui/assets/netbird-systemtray-connecting-mono-dark.png
 create mode 100644 client/ui/assets/netbird-systemtray-connecting-mono.png
 delete mode 100644 client/ui/assets/netbird-systemtray-connecting.ico
 create mode 100644 client/ui/assets/netbird-systemtray-disconnected-mono-dark.png
 create mode 100644 client/ui/assets/netbird-systemtray-disconnected-mono.png
 delete mode 100644 client/ui/assets/netbird-systemtray-disconnected.ico
 delete mode 100644 client/ui/assets/netbird-systemtray-error-dark.ico
 create mode 100644 client/ui/assets/netbird-systemtray-error-mono-dark.png
 create mode 100644 client/ui/assets/netbird-systemtray-error-mono.png
 delete mode 100644 client/ui/assets/netbird-systemtray-error.ico
 create mode 100644 client/ui/assets/netbird-systemtray-needs-login-macos.png
 create mode 100644 client/ui/assets/netbird-systemtray-needs-login-mono-dark.png
 create mode 100644 client/ui/assets/netbird-systemtray-needs-login-mono.png
 create mode 100644 client/ui/assets/netbird-systemtray-needs-login.png
 delete mode 100644 client/ui/assets/netbird-systemtray-update-connected-dark.ico
 create mode 100644 client/ui/assets/netbird-systemtray-update-connected-mono-dark.png
 create mode 100644 client/ui/assets/netbird-systemtray-update-connected-mono.png
 delete mode 100644 client/ui/assets/netbird-systemtray-update-connected.ico
 delete mode 100644 client/ui/assets/netbird-systemtray-update-disconnected-dark.ico
 create mode 100644 client/ui/assets/netbird-systemtray-update-disconnected-mono-dark.png
 create mode 100644 client/ui/assets/netbird-systemtray-update-disconnected-mono.png
 delete mode 100644 client/ui/assets/netbird-systemtray-update-disconnected.ico
 delete mode 100644 client/ui/assets/netbird.ico
 create mode 100644 client/ui/assets/svg/needs-login.svg
 create mode 100644 client/ui/assets/svg/netbird-menu.svg
 create mode 100644 client/ui/authsession/service.go
 create mode 100644 client/ui/authsession/warning.go
 create mode 100644 client/ui/authsession/warning_test.go
 create mode 100644 client/ui/build/Taskfile.yml
 create mode 100644 client/ui/build/appicon.icon/Assets/wails_icon_vector.svg
 create mode 100644 client/ui/build/appicon.icon/icon.json
 create mode 100644 client/ui/build/appicon.png
 delete mode 100644 client/ui/build/build-ui-linux.sh
 create mode 100644 client/ui/build/config.yml
 create mode 100644 client/ui/build/darwin/Info.dev.plist
 create mode 100644 client/ui/build/darwin/Info.plist
 create mode 100644 client/ui/build/darwin/Taskfile.yml
 create mode 100644 client/ui/build/darwin/icons.icns
 create mode 100644 client/ui/build/docker/Dockerfile.cross
 create mode 100644 client/ui/build/docker/Dockerfile.server
 create mode 100644 client/ui/build/linux/Taskfile.yml
 create mode 100644 client/ui/build/linux/appimage/build.sh
 create mode 100644 client/ui/build/linux/desktop
 create mode 100755 client/ui/build/linux/netbird-ui.desktop
 rename client/ui/build/{ => linux}/netbird.desktop (54%)
 create mode 100644 client/ui/build/linux/nfpm/nfpm.yaml
 create mode 100644 client/ui/build/linux/nfpm/scripts/postinstall.sh
 create mode 100644 client/ui/build/linux/nfpm/scripts/postremove.sh
 create mode 100644 client/ui/build/linux/nfpm/scripts/preinstall.sh
 create mode 100644 client/ui/build/linux/nfpm/scripts/preremove.sh
 create mode 100644 client/ui/build/windows/Taskfile.yml
 create mode 100644 client/ui/build/windows/icon.ico
 create mode 100644 client/ui/build/windows/info.json
 create mode 100644 client/ui/build/windows/msix/app_manifest.xml
 create mode 100644 client/ui/build/windows/msix/template.xml
 create mode 100644 client/ui/build/windows/nsis/project.nsi
 create mode 100644 client/ui/build/windows/nsis/wails_tools.nsh
 create mode 100644 client/ui/build/windows/wails.exe.manifest
 delete mode 100644 client/ui/client_ui.go
 delete mode 100644 client/ui/const.go
 delete mode 100644 client/ui/debug.go
 create mode 100644 client/ui/dock_darwin.go
 create mode 100644 client/ui/dock_other.go
 delete mode 100644 client/ui/event/event.go
 delete mode 100644 client/ui/event_handler.go
 delete mode 100644 client/ui/font_bsd.go
 delete mode 100644 client/ui/font_darwin.go
 delete mode 100644 client/ui/font_linux.go
 delete mode 100644 client/ui/font_windows.go
 create mode 100644 client/ui/frontend/.prettierignore
 create mode 100644 client/ui/frontend/.prettierrc
 create mode 100644 client/ui/frontend/WAILS-API.md
 create mode 100644 client/ui/frontend/eslint.config.js
 create mode 100644 client/ui/frontend/index.html
 create mode 100644 client/ui/frontend/package.json
 create mode 100644 client/ui/frontend/pnpm-lock.yaml
 create mode 100644 client/ui/frontend/pnpm-workspace.yaml
 create mode 100644 client/ui/frontend/postcss.config.js
 create mode 100644 client/ui/frontend/src/app.tsx
 create mode 100644 client/ui/frontend/src/assets/fonts/inter-variable.ttf
 create mode 100644 client/ui/frontend/src/assets/fonts/jetbrains-mono-variable.ttf
 create mode 100644 client/ui/frontend/src/assets/img/tray-darwin.png
 create mode 100644 client/ui/frontend/src/assets/img/tray-linux.png
 create mode 100644 client/ui/frontend/src/assets/img/tray-windows.png
 create mode 100644 client/ui/frontend/src/assets/logos/netbird-full.svg
 create mode 100644 client/ui/frontend/src/assets/logos/netbird.svg
 create mode 100644 client/ui/frontend/src/components/Badge.tsx
 create mode 100644 client/ui/frontend/src/components/CopyToClipboard.tsx
 create mode 100644 client/ui/frontend/src/components/DropdownMenu.tsx
 create mode 100644 client/ui/frontend/src/components/LanguagePicker.tsx
 create mode 100644 client/ui/frontend/src/components/ManagementServerSwitch.tsx
 create mode 100644 client/ui/frontend/src/components/SquareIcon.tsx
 create mode 100644 client/ui/frontend/src/components/Tooltip.tsx
 create mode 100644 client/ui/frontend/src/components/TruncatedText.tsx
 create mode 100644 client/ui/frontend/src/components/VerticalTabs.tsx
 create mode 100644 client/ui/frontend/src/components/buttons/Button.tsx
 create mode 100644 client/ui/frontend/src/components/buttons/IconButton.tsx
 create mode 100644 client/ui/frontend/src/components/dialog/ConfirmDialog.tsx
 create mode 100644 client/ui/frontend/src/components/dialog/ConfirmModal.tsx
 create mode 100644 client/ui/frontend/src/components/dialog/Dialog.tsx
 create mode 100644 client/ui/frontend/src/components/dialog/DialogActions.tsx
 create mode 100644 client/ui/frontend/src/components/dialog/DialogDescription.tsx
 create mode 100644 client/ui/frontend/src/components/dialog/DialogHeading.tsx
 create mode 100644 client/ui/frontend/src/components/empty-state/DaemonOutdatedOverlay.tsx
 create mode 100644 client/ui/frontend/src/components/empty-state/DaemonUnavailableOverlay.tsx
 create mode 100644 client/ui/frontend/src/components/empty-state/EmptyState.tsx
 create mode 100644 client/ui/frontend/src/components/empty-state/NoResults.tsx
 create mode 100644 client/ui/frontend/src/components/empty-state/NotConnectedState.tsx
 create mode 100644 client/ui/frontend/src/components/inputs/Input.tsx
 create mode 100644 client/ui/frontend/src/components/inputs/SearchInput.tsx
 create mode 100644 client/ui/frontend/src/components/switches/FancyToggleSwitch.tsx
 create mode 100644 client/ui/frontend/src/components/switches/SwitchItem.tsx
 create mode 100644 client/ui/frontend/src/components/switches/SwitchItemGroup.tsx
 create mode 100644 client/ui/frontend/src/components/switches/ToggleSwitch.tsx
 create mode 100644 client/ui/frontend/src/components/typography/HelpText.tsx
 create mode 100644 client/ui/frontend/src/components/typography/Label.tsx
 create mode 100644 client/ui/frontend/src/contexts/ClientVersionContext.tsx
 create mode 100644 client/ui/frontend/src/contexts/DebugBundleContext.tsx
 create mode 100644 client/ui/frontend/src/contexts/DialogContext.tsx
 create mode 100644 client/ui/frontend/src/contexts/NavSectionContext.tsx
 create mode 100644 client/ui/frontend/src/contexts/NetworksContext.tsx
 create mode 100644 client/ui/frontend/src/contexts/PeerDetailContext.tsx
 create mode 100644 client/ui/frontend/src/contexts/ProfileContext.tsx
 create mode 100644 client/ui/frontend/src/contexts/RestrictionsContext.tsx
 create mode 100644 client/ui/frontend/src/contexts/SettingsContext.tsx
 create mode 100644 client/ui/frontend/src/contexts/StatusContext.tsx
 create mode 100644 client/ui/frontend/src/contexts/ViewModeContext.tsx
 create mode 100644 client/ui/frontend/src/globals.css
 create mode 100644 client/ui/frontend/src/hooks/useAutoSizeWindow.ts
 create mode 100644 client/ui/frontend/src/hooks/useFocusVisible.ts
 create mode 100644 client/ui/frontend/src/hooks/useKeyboardShortcut.ts
 create mode 100644 client/ui/frontend/src/hooks/useManagementUrl.ts
 create mode 100644 client/ui/frontend/src/layouts/AppLayout.tsx
 create mode 100644 client/ui/frontend/src/layouts/AppRightPanel.tsx
 create mode 100644 client/ui/frontend/src/lib/cn.ts
 create mode 100644 client/ui/frontend/src/lib/compat.ts
 create mode 100644 client/ui/frontend/src/lib/connection.ts
 create mode 100644 client/ui/frontend/src/lib/errors.ts
 create mode 100644 client/ui/frontend/src/lib/formatters.ts
 create mode 100644 client/ui/frontend/src/lib/i18n.ts
 create mode 100644 client/ui/frontend/src/lib/logs.ts
 create mode 100644 client/ui/frontend/src/lib/platform.ts
 create mode 100644 client/ui/frontend/src/lib/sorting.ts
 create mode 100644 client/ui/frontend/src/lib/welcome.ts
 create mode 100644 client/ui/frontend/src/modules/auto-update/UpdateBadge.tsx
 create mode 100644 client/ui/frontend/src/modules/auto-update/UpdateInProgressDialog.tsx
 create mode 100644 client/ui/frontend/src/modules/auto-update/UpdateVersionCard.tsx
 create mode 100644 client/ui/frontend/src/modules/error/ErrorDialog.tsx
 create mode 100644 client/ui/frontend/src/modules/login/LoginWaitingForBrowserDialog.tsx
 create mode 100644 client/ui/frontend/src/modules/main/MainConnectionStatusSwitch.tsx
 create mode 100644 client/ui/frontend/src/modules/main/MainExitNodeSwitcher.tsx
 create mode 100644 client/ui/frontend/src/modules/main/MainHeader.tsx
 create mode 100644 client/ui/frontend/src/modules/main/MainPage.tsx
 create mode 100644 client/ui/frontend/src/modules/main/advanced/Navigation.tsx
 create mode 100644 client/ui/frontend/src/modules/main/advanced/networks/NetworkFilters.tsx
 create mode 100644 client/ui/frontend/src/modules/main/advanced/networks/Networks.tsx
 create mode 100644 client/ui/frontend/src/modules/main/advanced/peers/PeerDetailPanel.tsx
 create mode 100644 client/ui/frontend/src/modules/main/advanced/peers/PeerFilters.tsx
 create mode 100644 client/ui/frontend/src/modules/main/advanced/peers/Peers.tsx
 create mode 100644 client/ui/frontend/src/modules/profiles/ProfileAvatar.tsx
 create mode 100644 client/ui/frontend/src/modules/profiles/ProfileCreationModal.tsx
 create mode 100644 client/ui/frontend/src/modules/profiles/ProfileDropdown.tsx
 create mode 100644 client/ui/frontend/src/modules/profiles/ProfilesTab.tsx
 create mode 100644 client/ui/frontend/src/modules/session/SessionExpirationDialog.tsx
 create mode 100644 client/ui/frontend/src/modules/settings/SettingsAbout.tsx
 create mode 100644 client/ui/frontend/src/modules/settings/SettingsAccent.tsx
 create mode 100644 client/ui/frontend/src/modules/settings/SettingsAdvanced.tsx
 create mode 100644 client/ui/frontend/src/modules/settings/SettingsGeneral.tsx
 create mode 100644 client/ui/frontend/src/modules/settings/SettingsNavigation.tsx
 create mode 100644 client/ui/frontend/src/modules/settings/SettingsNetwork.tsx
 create mode 100644 client/ui/frontend/src/modules/settings/SettingsPage.tsx
 create mode 100644 client/ui/frontend/src/modules/settings/SettingsSSH.tsx
 create mode 100644 client/ui/frontend/src/modules/settings/SettingsSection.tsx
 create mode 100644 client/ui/frontend/src/modules/settings/SettingsSecurity.tsx
 create mode 100644 client/ui/frontend/src/modules/settings/SettingsSkeleton.tsx
 create mode 100644 client/ui/frontend/src/modules/settings/SettingsTroubleshooting.tsx
 create mode 100644 client/ui/frontend/src/modules/welcome/WelcomeDialog.tsx
 create mode 100644 client/ui/frontend/src/modules/welcome/WelcomeStepManagement.tsx
 create mode 100644 client/ui/frontend/src/modules/welcome/WelcomeStepTray.tsx
 create mode 100644 client/ui/frontend/src/vite-env.d.ts
 create mode 100644 client/ui/frontend/tailwind.config.ts
 create mode 100644 client/ui/frontend/tsconfig.json
 create mode 100644 client/ui/frontend/vite.config.ts
 create mode 100644 client/ui/grpc.go
 create mode 100644 client/ui/guilog/debuglog.go
 create mode 100644 client/ui/i18n/TRANSLATING.md
 create mode 100644 client/ui/i18n/bundle.go
 create mode 100644 client/ui/i18n/bundle_test.go
 create mode 100644 client/ui/i18n/locales/_index.json
 create mode 100644 client/ui/i18n/locales/de/common.json
 create mode 100644 client/ui/i18n/locales/en/common.json
 create mode 100644 client/ui/i18n/locales/es/common.json
 create mode 100644 client/ui/i18n/locales/fr/common.json
 create mode 100644 client/ui/i18n/locales/hu/common.json
 create mode 100644 client/ui/i18n/locales/it/common.json
 create mode 100644 client/ui/i18n/locales/pt/common.json
 create mode 100644 client/ui/i18n/locales/ru/common.json
 create mode 100644 client/ui/i18n/locales/zh-CN/common.json
 create mode 100644 client/ui/icons_menu_darwin.go
 create mode 100644 client/ui/icons_menu_linux.go
 create mode 100644 client/ui/icons_menu_windows.go
 delete mode 100644 client/ui/icons_windows.go
 create mode 100644 client/ui/localizer.go
 create mode 100644 client/ui/main.go
 delete mode 100644 client/ui/manifest.xml
 delete mode 100644 client/ui/network.go
 delete mode 100644 client/ui/notifier/notifier.go
 delete mode 100644 client/ui/notifier/notifier_other.go
 delete mode 100644 client/ui/notifier/notifier_windows.go
 create mode 100644 client/ui/preferences/store.go
 create mode 100644 client/ui/preferences/store_test.go
 delete mode 100644 client/ui/process/process.go
 delete mode 100644 client/ui/process/process_nonwindows.go
 delete mode 100644 client/ui/process/process_windows.go
 delete mode 100644 client/ui/profile.go
 delete mode 100644 client/ui/quickactions.go
 delete mode 100644 client/ui/quickactions_assets.go
 create mode 100644 client/ui/recenter_linux.go
 create mode 100644 client/ui/recenter_other.go
 create mode 100644 client/ui/services/autostart.go
 create mode 100644 client/ui/services/compat.go
 create mode 100644 client/ui/services/conn.go
 create mode 100644 client/ui/services/connection.go
 create mode 100644 client/ui/services/cursor_darwin.go
 create mode 100644 client/ui/services/cursor_linux.go
 create mode 100644 client/ui/services/cursor_other.go
 create mode 100644 client/ui/services/cursor_windows.go
 create mode 100644 client/ui/services/daemon_feed.go
 create mode 100644 client/ui/services/debug.go
 create mode 100644 client/ui/services/debug_reveal_other.go
 create mode 100644 client/ui/services/debug_reveal_windows.go
 create mode 100644 client/ui/services/errors.go
 create mode 100644 client/ui/services/errors_test.go
 create mode 100644 client/ui/services/foreground_other.go
 create mode 100644 client/ui/services/foreground_windows.go
 create mode 100644 client/ui/services/forwarding.go
 create mode 100644 client/ui/services/i18n.go
 create mode 100644 client/ui/services/network.go
 create mode 100644 client/ui/services/preferences.go
 create mode 100644 client/ui/services/profile.go
 create mode 100644 client/ui/services/profileswitcher.go
 create mode 100644 client/ui/services/session.go
 create mode 100644 client/ui/services/settings.go
 create mode 100644 client/ui/services/uilog.go
 create mode 100644 client/ui/services/update.go
 create mode 100644 client/ui/services/version.go
 create mode 100644 client/ui/services/windowmanager.go
 create mode 100644 client/ui/tray.go
 create mode 100644 client/ui/tray_click_linux.go
 create mode 100644 client/ui/tray_click_other.go
 create mode 100644 client/ui/tray_click_windows.go
 create mode 100644 client/ui/tray_events.go
 create mode 100644 client/ui/tray_exitnodes.go
 create mode 100644 client/ui/tray_features.go
 create mode 100644 client/ui/tray_icon.go
 create mode 100644 client/ui/tray_label_other.go
 create mode 100644 client/ui/tray_label_windows.go
 create mode 100644 client/ui/tray_linux.go
 create mode 100644 client/ui/tray_notify.go
 create mode 100644 client/ui/tray_profiles.go
 create mode 100644 client/ui/tray_session.go
 create mode 100644 client/ui/tray_status.go
 create mode 100644 client/ui/tray_status_enabled_linux.go
 create mode 100644 client/ui/tray_status_enabled_other.go
 create mode 100644 client/ui/tray_status_enabled_windows.go
 create mode 100644 client/ui/tray_theme_linux.go
 create mode 100644 client/ui/tray_theme_linux_test.go
 create mode 100644 client/ui/tray_theme_other.go
 create mode 100644 client/ui/tray_theme_watcher_linux.go
 create mode 100644 client/ui/tray_update.go
 create mode 100644 client/ui/tray_watcher_linux.go
 create mode 100644 client/ui/tray_watcher_other.go
 create mode 100644 client/ui/uilogpath.go
 delete mode 100644 client/ui/update.go
 delete mode 100644 client/ui/update_notwindows.go
 delete mode 100644 client/ui/update_windows.go
 create mode 100644 client/ui/updater/state.go
 create mode 100644 client/ui/xembed_host_linux.go
 create mode 100644 client/ui/xembed_tray_linux.c
 create mode 100644 client/ui/xembed_tray_linux.h
 create mode 100644 sonar-project.properties

diff --git a/.coderabbit.yaml b/.coderabbit.yaml
new file mode 100644
index 000000000..85ed5cd3b
--- /dev/null
+++ b/.coderabbit.yaml
@@ -0,0 +1,18 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+language: en-US
+reviews:
+  profile: chill
+  request_changes_workflow: false
+  high_level_summary: true
+  poem: false
+  review_status: true
+  auto_review:
+    enabled: true
+    drafts: false
+  path_filters:
+    - "!**/*.tsx"
+    - "!**/*.ts"
+    - "!**/*.js"
+    - "!**/*.svg"
+chat:
+  auto_reply: true
diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index 80809e667..0661e0c71 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -6,7 +6,6 @@ RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
         iptables=1.8.9-2 \
         libgl1-mesa-dev=22.3.6-1+deb12u1 \
         xorg-dev=1:7.7+23 \
-        libayatana-appindicator3-dev=0.5.92-1 \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/* \
     && go install -v golang.org/x/tools/gopls@latest
diff --git a/.github/workflows/frontend-ui.yml b/.github/workflows/frontend-ui.yml
new file mode 100644
index 000000000..bb5bb4528
--- /dev/null
+++ b/.github/workflows/frontend-ui.yml
@@ -0,0 +1,98 @@
+name: UI Frontend
+
+on:
+  pull_request:
+    paths:
+      - "client/ui/frontend/**"
+      - "client/ui/i18n/**"
+      - "client/ui/**/*.go"
+      - ".github/workflows/frontend-ui.yml"
+  push:
+    branches:
+      - main
+    paths:
+      - "client/ui/frontend/**"
+      - "client/ui/i18n/**"
+      - "client/ui/**/*.go"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.head_ref || github.actor_id }}
+  cancel-in-progress: true
+
+jobs:
+  lint-and-build:
+    name: Lint & Build
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: client/ui/frontend
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v3.0.0
+        with:
+          version: 11
+
+      # Bindings are generated by wails3 from the Go service definitions and
+      # are not checked in (see client/ui/frontend/bindings/). Without them,
+      # typecheck/build fail on missing module imports.
+      - name: Set up Go
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        with:
+          go-version-file: "go.mod"
+          cache: false
+
+      # wails3 CLI links against GTK4 / WebKitGTK 6.0 via its internal/operatingsystem
+      # package, so the dev libraries must be present before `go install`.
+      - name: Install Wails Linux system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            pkg-config \
+            libgtk-4-dev \
+            libwebkitgtk-6.0-dev
+
+      - name: Install wails3 CLI
+        # Version derived from go.mod so the binding generator always matches
+        # the wails runtime the daemon links against.
+        working-directory: ${{ github.workspace }}
+        run: |
+          WAILS_VERSION=$(go list -m -f '{{.Version}}' github.com/wailsapp/wails/v3)
+          go install github.com/wailsapp/wails/v3/cmd/wails3@$WAILS_VERSION
+
+      - name: Get pnpm store directory
+        id: pnpm-store
+        run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+
+      - name: Cache pnpm store
+        uses: actions/cache@v4
+        with:
+          path: ${{ steps.pnpm-store.outputs.path }}
+          key: ${{ runner.os }}-pnpm-${{ hashFiles('client/ui/frontend/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Generate Wails bindings
+        run: pnpm run bindings
+
+      - name: Lint, typecheck, format
+        run: pnpm check
+
+      - name: Build
+        run: pnpm build
diff --git a/.github/workflows/golang-test-darwin.yml b/.github/workflows/golang-test-darwin.yml
index 748e3f996..420749a0e 100644
--- a/.github/workflows/golang-test-darwin.yml
+++ b/.github/workflows/golang-test-darwin.yml
@@ -45,7 +45,15 @@ jobs:
         run: git --no-pager diff --exit-code
 
       - name: Test
-        run: NETBIRD_STORE_ENGINE=${{ matrix.store }} CI=true go test -coverprofile=coverage.txt -tags 'devcert privileged' -exec 'sudo --preserve-env=CI,NETBIRD_STORE_ENGINE' -timeout 5m -p 1 $(go list ./... | grep -v -e /management -e /signal -e /relay -e /proxy -e /combined -e /client/testutil/privileged)
+        # Exclude client/ui: its main.go uses //go:embed all:frontend/dist,
+        # which fails to compile until the frontend has been built. The Wails UI
+        # has no Go-side unit tests, and its release pipeline runs `pnpm build`
+        # before goreleaser.
+        # `go list -e` lets the listing succeed even though the embed fails to
+        # resolve; the grep then drops the broken package by path. Without -e,
+        # go list aborts with empty stdout and `go test` falls back to the repo
+        # root, which has no Go files.
+        run: NETBIRD_STORE_ENGINE=${{ matrix.store }} CI=true go test -coverprofile=coverage.txt -tags 'devcert privileged' -exec 'sudo --preserve-env=CI,NETBIRD_STORE_ENGINE' -timeout 5m -p 1 $(go list -e ./... | grep -v -e /management -e /signal -e /relay -e /proxy -e /combined -e /client/ui -e /client/testutil/privileged)
 
       - name: Upload coverage reports to Codecov
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f #v7.0.0
diff --git a/.github/workflows/golang-test-linux.yml b/.github/workflows/golang-test-linux.yml
index ce53261a4..0af506bba 100644
--- a/.github/workflows/golang-test-linux.yml
+++ b/.github/workflows/golang-test-linux.yml
@@ -53,7 +53,7 @@ jobs:
 
       - name: Install dependencies
         if: steps.cache.outputs.cache-hit != 'true'
-        run: sudo apt update && sudo apt install -y -q libgtk-3-dev libayatana-appindicator3-dev libgl1-mesa-dev xorg-dev gcc-multilib libpcap-dev
+        run: sudo apt update && sudo apt install -y -q libgtk-4-dev libwebkitgtk-6.0-dev libsoup-3.0-dev libgl1-mesa-dev xorg-dev gcc-multilib libpcap-dev
 
       - name: Install 32-bit libpcap
         if: steps.cache.outputs.cache-hit != 'true'
@@ -145,7 +145,7 @@ jobs:
             ${{ runner.os }}-gotest-cache-
 
       - name: Install dependencies
-        run: sudo apt update && sudo apt install -y -q libgtk-3-dev libayatana-appindicator3-dev libgl1-mesa-dev xorg-dev gcc-multilib libpcap-dev
+        run: sudo apt update && sudo apt install -y -q libgtk-4-dev libwebkitgtk-6.0-dev libsoup-3.0-dev libgl1-mesa-dev xorg-dev gcc-multilib libpcap-dev
 
       - name: Install 32-bit libpcap
         if: matrix.arch == '386'
@@ -158,7 +158,15 @@ jobs:
         run: git --no-pager diff --exit-code
 
       - name: Test
-        run: CGO_ENABLED=1 GOARCH=${{ matrix.arch }} CI=true go test -coverprofile=coverage.txt -tags 'devcert privileged' -exec 'sudo --preserve-env=CI,CGO_ENABLED' -timeout 10m -p 1 $(go list ./... | grep -v -e /management -e /signal -e /relay -e /proxy -e /combined -e /client/testutil/privileged)
+        # Exclude client/ui: its main.go uses //go:embed all:frontend/dist,
+        # which fails to compile until the frontend has been built. The Wails UI
+        # has no Go-side unit tests, and its release pipeline runs `pnpm build`
+        # before goreleaser.
+        # `go list -e` lets the listing succeed even though the embed fails to
+        # resolve; the grep then drops the broken package by path. Without -e,
+        # go list aborts with empty stdout and `go test` falls back to the repo
+        # root, which has no Go files.
+        run: CGO_ENABLED=1 GOARCH=${{ matrix.arch }} CI=true go test -coverprofile=coverage.txt -tags 'devcert privileged' -exec 'sudo --preserve-env=CI,CGO_ENABLED' -timeout 10m -p 1 $(go list -e ./... | grep -v -e /management -e /signal -e /relay -e /proxy -e /combined -e /client/ui -e /client/testutil/privileged)
 
       - name: Upload coverage reports to Codecov
         if: matrix.arch == 'amd64'
@@ -168,7 +176,6 @@ jobs:
           slug: netbirdio/netbird
           flags: unit,client
 
-
   test_client_on_docker:
     name: "Client (Docker) / Unit"
     needs: [build-cache]
@@ -229,7 +236,7 @@ jobs:
             sh -c ' \
               apk update; apk add --no-cache \
                 ca-certificates iptables ip6tables dbus dbus-dev libpcap-dev build-base; \
-              go test -buildvcs=false -tags "devcert privileged" -v -timeout 10m -p 1 $(go list -buildvcs=false ./... | grep -v -e /management -e /signal -e /relay -e /proxy -e /combined -e /client/ui -e /upload-server -e /client/testutil/privileged)
+              go test -buildvcs=false -tags "devcert privileged" -v -timeout 10m -p 1 $(go list -e -buildvcs=false ./... | grep -v -e /management -e /signal -e /relay -e /proxy -e /combined -e /client/ui -e /upload-server -e /client/testutil/privileged)
             '
 
   test_relay:
diff --git a/.github/workflows/golang-test-windows.yml b/.github/workflows/golang-test-windows.yml
index b61c87cf6..50a5ba4d6 100644
--- a/.github/workflows/golang-test-windows.yml
+++ b/.github/workflows/golang-test-windows.yml
@@ -65,8 +65,15 @@ jobs:
       - run: PsExec64 -s -w ${{ github.workspace }} C:\hostedtoolcache\windows\go\${{ steps.go.outputs.go-version }}\x64\bin\go.exe env -w GOCACHE=${{ env.modcache }}
       - run: PsExec64 -s -w ${{ github.workspace }} C:\hostedtoolcache\windows\go\${{ steps.go.outputs.go-version }}\x64\bin\go.exe mod tidy
       - name: Generate test script
+        # Exclude client/ui: its main.go uses //go:embed all:frontend/dist,
+        # which fails to compile until the frontend has been built. The Wails UI
+        # has no Go-side unit tests, and its release pipeline runs `pnpm build`
+        # before goreleaser.
+        # `go list -e` lets the listing succeed even though the embed fails to
+        # resolve; the Where-Object pipeline then drops the broken package by
+        # path. Without -e, go list aborts with empty stdout.
         run: |
-          $packages = go list ./... | Where-Object { $_ -notmatch '/management' } | Where-Object { $_ -notmatch '/relay' } | Where-Object { $_ -notmatch '/signal' } | Where-Object { $_ -notmatch '/proxy' } | Where-Object { $_ -notmatch '/combined' }
+          $packages = go list -e ./... | Where-Object { $_ -notmatch '/management' } | Where-Object { $_ -notmatch '/relay' } | Where-Object { $_ -notmatch '/signal' } | Where-Object { $_ -notmatch '/proxy' } | Where-Object { $_ -notmatch '/combined' } | Where-Object { $_ -notmatch '/client/ui' }
           $goExe = "C:\hostedtoolcache\windows\go\${{ steps.go.outputs.go-version }}\x64\bin\go.exe"
           $cmd = "$goExe test -tags `"devcert privileged`" -timeout 10m -p 1 $($packages -join ' ') > test-out.txt 2>&1"
           Set-Content -Path "${{ github.workspace }}\run-tests.cmd" -Value $cmd
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index 511e54b62..b444a9900 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -22,7 +22,15 @@ jobs:
         uses: codespell-project/actions-codespell@8f01853be192eb0f849a5c7d721450e7a467c579 # v2.2
         with:
           ignore_words_list: erro,clienta,hastable,iif,groupd,testin,groupe,cros,ans,deriver,te,userA,ede,additionals,flate,recordin,unparseable
-          skip: go.mod,go.sum,**/proxy/web/**
+          # Non-English UI translations trip codespell on real foreign words
+          # (de: "Sie", "oder", "ist"). Only en/common.json is the source of
+          # truth that should be spell-checked. List each translated locale
+          # dir below and add new ones as languages are added under
+          # client/ui/i18n/locales/. Single-star globs are matched per path
+          # segment by codespell and behave the same across versions; the
+          # recursive "**" form did not take effect with the codespell shipped
+          # by this action.
+          skip: go.mod,go.sum,*/proxy/web/*,*pnpm-lock.yaml,*package-lock.json,*/locales/de/*,*/locales/es/*,*/locales/fr/*,*/locales/hu/*,*/locales/it/*,*/locales/pt/*,*/locales/ru/*,*/locales/zh-CN/*,*/i18n/TRANSLATING.md
   golangci:
     strategy:
       fail-fast: false
@@ -54,7 +62,16 @@ jobs:
           cache: false
       - name: Install dependencies
         if: matrix.os == 'ubuntu-latest'
-        run: sudo apt update && sudo apt install -y -q libgtk-3-dev libayatana-appindicator3-dev libgl1-mesa-dev xorg-dev libpcap-dev
+        run: sudo apt update && sudo apt install -y -q libgtk-4-dev libwebkitgtk-6.0-dev libsoup-3.0-dev libgl1-mesa-dev xorg-dev libpcap-dev
+      - name: Stub Wails frontend bundle
+        # client/ui/main.go has //go:embed all:frontend/dist. The
+        # directory is produced by `pnpm run build` and is gitignored, so
+        # lint-only runs (no frontend toolchain) need a placeholder file
+        # for the embed pattern to match.
+        shell: bash
+        run: |
+          mkdir -p client/ui/frontend/dist
+          touch client/ui/frontend/dist/.embed-placeholder
       - name: golangci-lint
         uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee #v9.2.1
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cd431a389..76a5b36ff 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,7 +9,7 @@ on:
   pull_request:
 
 env:
-  SIGN_PIPE_VER: "v0.1.6"
+  SIGN_PIPE_VER: "v0.1.8"
   GORELEASER_VER: "v2.16.0"
   PRODUCT_NAME: "NetBird"
   COPYRIGHT: "NetBird GmbH"
@@ -216,9 +216,9 @@ jobs:
       - name: Install goversioninfo
         run: go install github.com/josephspurrier/goversioninfo/cmd/goversioninfo@233067e
       - name: Generate windows syso amd64
-        run: goversioninfo  -icon client/ui/assets/netbird.ico -manifest client/manifest.xml -product-name ${{ env.PRODUCT_NAME }} -copyright "${{ env.COPYRIGHT }}" -ver-major ${{ steps.semver_parser.outputs.major }} -ver-minor ${{ steps.semver_parser.outputs.minor }} -ver-patch ${{ steps.semver_parser.outputs.patch }} -ver-build 0 -file-version ${{ steps.semver_parser.outputs.fullversion }}.0 -product-version ${{ steps.semver_parser.outputs.fullversion }}.0 -o client/resources_windows_amd64.syso
+        run: goversioninfo  -icon client/ui/build/windows/icon.ico -manifest client/manifest.xml -product-name ${{ env.PRODUCT_NAME }} -copyright "${{ env.COPYRIGHT }}" -ver-major ${{ steps.semver_parser.outputs.major }} -ver-minor ${{ steps.semver_parser.outputs.minor }} -ver-patch ${{ steps.semver_parser.outputs.patch }} -ver-build 0 -file-version ${{ steps.semver_parser.outputs.fullversion }}.0 -product-version ${{ steps.semver_parser.outputs.fullversion }}.0 -o client/resources_windows_amd64.syso
       - name: Generate windows syso arm64
-        run: goversioninfo -arm -64 -icon client/ui/assets/netbird.ico -manifest client/manifest.xml -product-name ${{ env.PRODUCT_NAME }} -copyright "${{ env.COPYRIGHT }}" -ver-major ${{ steps.semver_parser.outputs.major }} -ver-minor ${{ steps.semver_parser.outputs.minor }} -ver-patch ${{ steps.semver_parser.outputs.patch }} -ver-build 0 -file-version ${{ steps.semver_parser.outputs.fullversion }}.0 -product-version ${{ steps.semver_parser.outputs.fullversion }}.0 -o client/resources_windows_arm64.syso
+        run: goversioninfo -arm -64 -icon client/ui/build/windows/icon.ico -manifest client/manifest.xml -product-name ${{ env.PRODUCT_NAME }} -copyright "${{ env.COPYRIGHT }}" -ver-major ${{ steps.semver_parser.outputs.major }} -ver-minor ${{ steps.semver_parser.outputs.minor }} -ver-patch ${{ steps.semver_parser.outputs.patch }} -ver-build 0 -file-version ${{ steps.semver_parser.outputs.fullversion }}.0 -product-version ${{ steps.semver_parser.outputs.fullversion }}.0 -o client/resources_windows_arm64.syso
       - name: Run GoReleaser
         id: goreleaser
         uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
@@ -397,8 +397,18 @@ jobs:
       - name: check git status
         run: git --no-pager diff --exit-code
 
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v3.0.0
+        with:
+          version: 11
+
       - name: Install dependencies
-        run: sudo apt update && sudo apt install -y -q libappindicator3-dev gir1.2-appindicator3-0.1 libxxf86vm-dev gcc-mingw-w64-x86-64
+        run: sudo apt update && sudo apt install -y -q libgtk-4-dev libwebkitgtk-6.0-dev libsoup-3.0-dev gcc-mingw-w64-x86-64
 
       - name: Decode GPG signing key
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
@@ -417,10 +427,16 @@ jobs:
           echo "/tmp/llvm-mingw-20250709-ucrt-ubuntu-22.04-x86_64/bin" >> $GITHUB_PATH
       - name: Install goversioninfo
         run: go install github.com/josephspurrier/goversioninfo/cmd/goversioninfo@233067e
+      - name: Install wails3 CLI
+        # Version derived from go.mod so the binding generator always matches
+        # the wails runtime the binary links against.
+        run: |
+          WAILS_VERSION=$(go list -m -f '{{.Version}}' github.com/wailsapp/wails/v3)
+          go install github.com/wailsapp/wails/v3/cmd/wails3@$WAILS_VERSION
       - name: Generate windows syso amd64
-        run: goversioninfo -64 -icon client/ui/assets/netbird.ico -manifest client/ui/manifest.xml -product-name ${{ env.PRODUCT_NAME }}-"UI" -copyright "${{ env.COPYRIGHT }}" -ver-major ${{ steps.semver_parser.outputs.major }} -ver-minor ${{ steps.semver_parser.outputs.minor }} -ver-patch ${{ steps.semver_parser.outputs.patch }} -ver-build 0 -file-version ${{ steps.semver_parser.outputs.fullversion }}.0 -product-version ${{ steps.semver_parser.outputs.fullversion }}.0 -o client/ui/resources_windows_amd64.syso
+        run: goversioninfo -64 -icon client/ui/build/windows/icon.ico -manifest client/ui/build/windows/wails.exe.manifest -product-name ${{ env.PRODUCT_NAME }}-"UI" -copyright "${{ env.COPYRIGHT }}" -ver-major ${{ steps.semver_parser.outputs.major }} -ver-minor ${{ steps.semver_parser.outputs.minor }} -ver-patch ${{ steps.semver_parser.outputs.patch }} -ver-build 0 -file-version ${{ steps.semver_parser.outputs.fullversion }}.0 -product-version ${{ steps.semver_parser.outputs.fullversion }}.0 -o client/ui/resources_windows_amd64.syso
       - name: Generate windows syso arm64
-        run: goversioninfo -arm -64 -icon client/ui/assets/netbird.ico -manifest client/ui/manifest.xml -product-name ${{ env.PRODUCT_NAME }}-"UI" -copyright "${{ env.COPYRIGHT }}" -ver-major ${{ steps.semver_parser.outputs.major }} -ver-minor ${{ steps.semver_parser.outputs.minor }} -ver-patch ${{ steps.semver_parser.outputs.patch }} -ver-build 0 -file-version ${{ steps.semver_parser.outputs.fullversion }}.0 -product-version ${{ steps.semver_parser.outputs.fullversion }}.0 -o client/ui/resources_windows_arm64.syso
+        run: goversioninfo -arm -64 -icon client/ui/build/windows/icon.ico -manifest client/ui/build/windows/wails.exe.manifest -product-name ${{ env.PRODUCT_NAME }}-"UI" -copyright "${{ env.COPYRIGHT }}" -ver-major ${{ steps.semver_parser.outputs.major }} -ver-minor ${{ steps.semver_parser.outputs.minor }} -ver-patch ${{ steps.semver_parser.outputs.patch }} -ver-build 0 -file-version ${{ steps.semver_parser.outputs.fullversion }}.0 -product-version ${{ steps.semver_parser.outputs.fullversion }}.0 -o client/ui/resources_windows_arm64.syso
 
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
@@ -489,6 +505,20 @@ jobs:
         run: go mod tidy
       - name: check git status
         run: git --no-pager diff --exit-code
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+      - name: Set up pnpm
+        uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v3.0.0
+        with:
+          version: 11
+      - name: Install wails3 CLI
+        # Version derived from go.mod so the binding generator always matches
+        # the wails runtime the binary links against.
+        run: |
+          WAILS_VERSION=$(go list -m -f '{{.Version}}' github.com/wailsapp/wails/v3)
+          go install github.com/wailsapp/wails/v3/cmd/wails3@$WAILS_VERSION
       - name: Run GoReleaser
         id: goreleaser
         uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
@@ -576,23 +606,6 @@ jobs:
       - name: Move wintun.dll into dist
         run: mv ${{ env.downloadPath }}\wintun\bin\${{ matrix.wintun_arch }}\wintun.dll ${{ github.workspace }}\dist\${{ env.PackageWorkdir }}\
 
-      - name: Download Mesa3D (amd64 only)
-        id: download-mesa3d
-        if: matrix.arch == 'amd64'
-        uses: netbirdio/shared-actions/actions/win-download-and-verify@be5df6047383da2236e02243cceb857d8567c27e # v0.0.2
-        with:
-          url: https://pkgs.netbird.io/mesa3d/MesaForWindows-x64-20.1.8.7z
-          destination: ${{ env.downloadPath }}\mesa3d.7z
-          sha256: 71c7cb64ec229a1d6b8d62fa08e1889ed2bd17c0eeede8689daf0f25cb31d6b9
-
-      - name: Extract Mesa3D driver (amd64 only)
-        if: matrix.arch == 'amd64'
-        run: 7z x -o"${{ env.downloadPath }}" "${{ env.downloadPath }}/mesa3d.7z"
-
-      - name: Move opengl32.dll into dist (amd64 only)
-        if: matrix.arch == 'amd64'
-        run: mv ${{ env.downloadPath }}\opengl32.dll ${{ github.workspace }}\dist\${{ env.PackageWorkdir }}\
-
       - name: Download EnVar plugin for NSIS
         uses: netbirdio/shared-actions/actions/win-download-and-verify@be5df6047383da2236e02243cceb857d8567c27e # v0.0.2
         with:
@@ -615,6 +628,28 @@ jobs:
         if: matrix.arch == 'amd64'
         run: 7z x -o"${{ github.workspace }}/NSIS_Plugins" "${{ github.workspace }}/ShellExecAsUser_amd64-Unicode.7z"
 
+      - name: Set up Go for wails3 CLI
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: "go.mod"
+          cache: false
+
+      - name: Install wails3 CLI
+        # Version derived from go.mod so the bootstrapper payload always
+        # matches the wails runtime the binary links against.
+        shell: bash
+        run: |
+          WAILS_VERSION=$(go list -m -f '{{.Version}}' github.com/wailsapp/wails/v3)
+          go install github.com/wailsapp/wails/v3/cmd/wails3@$WAILS_VERSION
+
+      - name: Stage WebView2 bootstrapper for installers
+        # Both client/installer.nsis and client/netbird.wxs reference
+        # client/MicrosoftEdgeWebview2Setup.exe. wails3 writes it there.
+        # The signing pipeline (netbirdio/sign-pipelines) does the same
+        # step for release builds; this mirrors it for PR sanity testing.
+        shell: bash
+        run: wails3 generate webview2bootstrapper -dir client
+
       - name: Build NSIS installer
         shell: pwsh
         env:
diff --git a/.github/workflows/wasm-build-validation.yml b/.github/workflows/wasm-build-validation.yml
index 35855918d..e8a12cdaf 100644
--- a/.github/workflows/wasm-build-validation.yml
+++ b/.github/workflows/wasm-build-validation.yml
@@ -27,7 +27,7 @@ jobs:
         with:
           go-version-file: "go.mod"
       - name: Install dependencies
-        run: sudo apt update && sudo apt install -y -q libgtk-3-dev libayatana-appindicator3-dev libgl1-mesa-dev xorg-dev libpcap-dev
+        run: sudo apt update && sudo apt install -y -q libgtk-4-dev libwebkitgtk-6.0-dev libsoup-3.0-dev libgl1-mesa-dev xorg-dev libpcap-dev
       - name: Install golangci-lint
         uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee #v9.2.1
         with:
diff --git a/.golangci.yaml b/.golangci.yaml
index 900af4ac0..e350b9de7 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -114,6 +114,16 @@ linters:
       - linters:
           - staticcheck
         text: "QF1012"
+      # client/ui/main.go uses //go:embed all:frontend/dist; the
+      # directory is populated by `pnpm build` in the release pipeline
+      # and missing at lint time, so the embed parses to "no matching
+      # files found" — surfaced by golangci-lint's typecheck pre-pass.
+      # Suppress just that one diagnostic; the rest of the package
+      # (services/, tray.go, grpc.go, ...) still gets linted normally.
+      - linters:
+          - typecheck
+        path: client/ui/main\.go
+        text: "pattern all:frontend/dist"
     paths:
       - third_party$
       - builtin$
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index a2640dc8e..0753b1012 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -212,6 +212,7 @@ nfpms:
     description: Netbird client.
     homepage: https://netbird.io/
     license: BSD-3-Clause
+    vendor: NetBird
     id: netbird_deb
     bindir: /usr/bin
     builds:
@@ -226,6 +227,7 @@ nfpms:
     description: Netbird client.
     homepage: https://netbird.io/
     license: BSD-3-Clause
+    vendor: NetBird
     id: netbird_rpm
     bindir: /usr/bin
     builds:
diff --git a/.goreleaser_ui.yaml b/.goreleaser_ui.yaml
index 6f9b7c059..197fcd440 100644
--- a/.goreleaser_ui.yaml
+++ b/.goreleaser_ui.yaml
@@ -2,6 +2,15 @@ version: 2
 env:
   - SKIP_PUBLISH={{ if index .Env "SKIP_PUBLISH" }}{{ .Env.SKIP_PUBLISH }}{{ else }}true{{ end }}
 project_name: netbird-ui
+
+before:
+  hooks:
+    # Bindings are gitignored; regenerate before the frontend build so
+    # the @wailsio/runtime Vite plugin can resolve them (vite refuses to
+    # build without them).
+    - sh -c 'cd client/ui && wails3 generate bindings -clean=true -ts'
+    - sh -c 'cd client/ui/frontend && pnpm install --frozen-lockfile && pnpm build'
+
 builds:
   - id: netbird-ui
     dir: client/ui
@@ -62,6 +71,8 @@ nfpms:
   - maintainer: Netbird <dev@netbird.io>
     description: Netbird client UI.
     homepage: https://netbird.io/
+    license: BSD-3-Clause
+    vendor: NetBird
     id: netbird_ui_deb
     package_name: netbird-ui
     builds:
@@ -71,9 +82,9 @@ nfpms:
     scripts:
       postinstall: "release_files/ui-post-install.sh"
     contents:
-      - src: client/ui/build/netbird.desktop
-        dst: /usr/share/applications/netbird.desktop
-      - src: client/ui/assets/netbird.png
+      - src: client/ui/build/linux/netbird.desktop
+        dst: /usr/share/applications/org.wails.netbird.desktop
+      - src: client/ui/build/appicon.png
         dst: /usr/share/pixmaps/netbird.png
     dependencies:
       - netbird
@@ -81,6 +92,8 @@ nfpms:
   - maintainer: Netbird <dev@netbird.io>
     description: Netbird client UI.
     homepage: https://netbird.io/
+    license: BSD-3-Clause
+    vendor: NetBird
     id: netbird_ui_rpm
     package_name: netbird-ui
     builds:
@@ -90,12 +103,13 @@ nfpms:
     scripts:
       postinstall: "release_files/ui-post-install.sh"
     contents:
-      - src: client/ui/build/netbird.desktop
-        dst: /usr/share/applications/netbird.desktop
-      - src: client/ui/assets/netbird.png
+      - src: client/ui/build/linux/netbird.desktop
+        dst: /usr/share/applications/org.wails.netbird.desktop
+      - src: client/ui/build/appicon.png
         dst: /usr/share/pixmaps/netbird.png
     dependencies:
       - netbird
+
     rpm:
       signature:
         key_file: '{{ if index .Env "GPG_RPM_KEY_FILE" }}{{ .Env.GPG_RPM_KEY_FILE }}{{ end }}'
diff --git a/.goreleaser_ui_darwin.yaml b/.goreleaser_ui_darwin.yaml
index 0a0082075..96e15371a 100644
--- a/.goreleaser_ui_darwin.yaml
+++ b/.goreleaser_ui_darwin.yaml
@@ -1,6 +1,15 @@
 version: 2
 
 project_name: netbird-ui
+
+before:
+  hooks:
+    # Bindings are gitignored; regenerate before the frontend build so
+    # the @wailsio/runtime Vite plugin can resolve them (vite refuses to
+    # build without them).
+    - sh -c 'cd client/ui && wails3 generate bindings -clean=true -ts'
+    - sh -c 'cd client/ui/frontend && pnpm install --frozen-lockfile && pnpm build'
+
 builds:
   - id: netbird-ui-darwin
     dir: client/ui
@@ -20,8 +29,6 @@ builds:
     ldflags:
       - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
     mod_timestamp: "{{ .CommitTimestamp }}"
-    tags:
-      - load_wgnt_from_rsrc
 
 universal_binaries:
   - id: netbird-ui-darwin
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index cd1c087bb..261083783 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -79,13 +79,21 @@ dependencies are installed. Here is a short guide on how that can be done.
 
 ### Requirements
 
-#### Go 1.21
+#### Go 1.25
 
 Follow the installation guide from https://go.dev/
 
-#### UI client - Fyne toolkit 
+#### UI client - Wails v3 + React
 
-We use the fyne toolkit in our UI client. You can follow its requirement guide to have all its dependencies installed: https://developer.fyne.io/started/#prerequisites
+The desktop UI client (`client/ui`) is built with [Wails v3](https://v3.wails.io/) and a React frontend rendered in a WebView. To build it you need:
+
+- Go ≥ 1.25
+- Node ≥ 20 and **pnpm** (`corepack enable && corepack prepare pnpm@latest --activate`)
+- The `wails3` CLI: `go install github.com/wailsapp/wails/v3/cmd/wails3@latest`
+- The `task` runner: `go install github.com/go-task/task/v3/cmd/task@latest`
+- Linux only: `libwebkitgtk-6.0-dev`, `libgtk-4-dev`, `libsoup-3.0-dev`
+
+All UI build, dev-loop, and cross-compile commands are described in the [UI client](#ui-client) section below.
 
 #### gRPC
 You can follow the instructions from the quickstarter guide https://grpc.io/docs/languages/go/quickstart/#prerequisites and then run the `generate.sh` files located in each `proto` directory to generate changes.
@@ -214,6 +222,39 @@ To start NetBird the client in the foreground:
 sudo ./client up --log-level debug --log-file console
 ```
 > On Windows use a powershell with administrator privileges
+
+#### UI client
+
+The desktop UI lives in `client/ui` and is built with Wails v3 (see [Requirements](#ui-client---wails-v3--react)). All commands run from `client/ui`.
+
+Live-reload development (Vite + Go binary + `*.go` watcher):
+
+```
+cd client/ui
+task dev
+```
+
+Pass daemon flags after `--`:
+
+```
+task dev -- --daemon-addr=tcp://127.0.0.1:41731
+```
+
+Production build (frontend assets embedded into the binary, output in `client/ui/bin/`):
+
+```
+cd client/ui
+task build
+```
+
+Cross-compile the Windows binary from Linux (requires the mingw-w64 toolchain, e.g. `sudo apt install gcc-mingw-w64-x86-64`):
+
+```
+CGO_ENABLED=1 task windows:build
+```
+
+> macOS cross-compile from Linux is not supported (signing and notarization need a real Mac).
+
 #### Signal service
 
 To start NetBird's signal, execute:
@@ -251,10 +292,10 @@ Create dist directory
 mkdir -p dist/netbird_windows_amd64
 ```
 
-UI client
+UI client (built with Wails v3 — see the [UI client](#ui-client) section above)
 ```shell
-CC=x86_64-w64-mingw32-gcc CGO_ENABLED=1 GOOS=windows GOARCH=amd64 go build -o netbird-ui.exe -ldflags "-s -w -H windowsgui" ./client/ui
-mv netbird-ui.exe ./dist/netbird_windows_amd64/
+(cd client/ui && CGO_ENABLED=1 task windows:build)
+mv client/ui/bin/netbird-ui.exe ./dist/netbird_windows_amd64/
 ```
 
 Client
@@ -291,8 +332,6 @@ go test -exec sudo ./...
 ```
 > On Windows use a powershell with administrator privileges
 
-> Non-GTK environments will need the `libayatana-appindicator3-dev` (debian/ubuntu) package installed
-
 ## Checklist before submitting a PR
 As a critical network service and open-source project, we must enforce a few things before submitting the pull-requests:
 - Keep functions as simple as possible, with a single purpose
diff --git a/client/cmd/login.go b/client/cmd/login.go
index a7ee960b1..ee32a3727 100644
--- a/client/cmd/login.go
+++ b/client/cmd/login.go
@@ -22,11 +22,19 @@ import (
 	"github.com/netbirdio/netbird/util"
 )
 
+// extendSessionFlag drives the `netbird login --extend` flow: refresh the
+// SSO session expiry on the management server without tearing down the
+// tunnel. Mutually exclusive with setup-key login (a setup-key cannot
+// refresh an SSO-tracked peer — see auth.errSetupKeyOnSSOExpiredPeer).
+var extendSessionFlag bool
+
 func init() {
 	loginCmd.PersistentFlags().BoolVar(&noBrowser, noBrowserFlag, false, noBrowserDesc)
 	loginCmd.PersistentFlags().BoolVar(&showQR, showQRFlag, false, showQRDesc)
 	loginCmd.PersistentFlags().StringVar(&profileName, profileNameFlag, "", profileNameDesc)
 	loginCmd.PersistentFlags().StringVarP(&configPath, "config", "c", "", "(DEPRECATED) Netbird config file location")
+	loginCmd.PersistentFlags().BoolVar(&extendSessionFlag, "extend", false,
+		"refresh the SSO session expiry without tearing down the tunnel (requires an active connection)")
 }
 
 var loginCmd = &cobra.Command{
@@ -61,6 +69,16 @@ var loginCmd = &cobra.Command{
 			return err
 		}
 
+		if extendSessionFlag {
+			if providedSetupKey != "" {
+				return fmt.Errorf("--extend cannot be combined with a setup key; setup keys can only enrol new peers")
+			}
+			if err := doExtendSession(ctx, cmd); err != nil {
+				return fmt.Errorf("extend session failed: %v", err)
+			}
+			return nil
+		}
+
 		// workaround to run without service
 		if util.FindFirstLogPath(logFiles) == "" {
 			if err := doForegroundLogin(ctx, cmd, providedSetupKey, activeProf); err != nil {
@@ -152,6 +170,65 @@ func doDaemonLogin(ctx context.Context, cmd *cobra.Command, providedSetupKey str
 	return nil
 }
 
+// doExtendSession drives the daemon's RequestExtendAuthSession /
+// WaitExtendAuthSession pair. The user is sent through a regular SSO flow
+// (browser + verification URL) and the resulting JWT is forwarded to the
+// management server's ExtendAuthSession RPC. The tunnel stays up
+// throughout — no Down/Up, no network-map resync.
+func doExtendSession(ctx context.Context, cmd *cobra.Command) error {
+	conn, err := DialClientGRPCServer(ctx, daemonAddr)
+	if err != nil {
+		//nolint
+		return fmt.Errorf("failed to connect to daemon error: %v\n"+
+			"If the daemon is not running please run: "+
+			"\nnetbird service install \nnetbird service start\n", err)
+	}
+	defer conn.Close()
+
+	client := proto.NewDaemonServiceClient(conn)
+
+	req := &proto.RequestExtendAuthSessionRequest{}
+	// Pre-fill the IdP login hint from the active profile so the user
+	// doesn't have to retype their email. Best-effort: we still proceed
+	// without a hint if the lookup fails.
+	pm := profilemanager.NewProfileManager()
+	if active, perr := pm.GetActiveProfile(); perr == nil {
+		if profState, sperr := pm.GetProfileState(active.ID); sperr == nil && profState.Email != "" {
+			req.Hint = &profState.Email
+		}
+	}
+
+	startResp, err := client.RequestExtendAuthSession(ctx, req)
+	if err != nil {
+		return fmt.Errorf("start extend session: %v", err)
+	}
+
+	uri := startResp.GetVerificationURIComplete()
+	if uri == "" {
+		uri = startResp.GetVerificationURI()
+	}
+	openURL(cmd, uri, startResp.GetUserCode(), noBrowser, showQR)
+
+	waitResp, err := client.WaitExtendAuthSession(ctx, &proto.WaitExtendAuthSessionRequest{
+		DeviceCode: startResp.GetDeviceCode(),
+		UserCode:   startResp.GetUserCode(),
+	})
+	if err != nil {
+		return fmt.Errorf("wait for extend session: %v", err)
+	}
+
+	if ts := waitResp.GetSessionExpiresAt(); ts.IsValid() && !ts.AsTime().IsZero() {
+		deadline := ts.AsTime().Local()
+		cmd.Printf("Session extended. New expiry: %s\n", deadline.Format("2006-01-02 15:04:05 MST"))
+	} else {
+		// Management reported the peer is not eligible (e.g. login
+		// expiration disabled on the account). Surface that fact
+		// instead of pretending the call succeeded.
+		cmd.Println("Session extension call completed, but the management server did not return a new deadline (peer may not be SSO-tracked or login expiration is disabled).")
+	}
+	return nil
+}
+
 func getActiveProfile(ctx context.Context, pm *profilemanager.ProfileManager, profileName string, username string) (*profilemanager.Profile, error) {
 	// switch profile if provided
 
diff --git a/client/cmd/status.go b/client/cmd/status.go
index 5a7559cf1..c4057ed82 100644
--- a/client/cmd/status.go
+++ b/client/cmd/status.go
@@ -6,6 +6,7 @@ import (
 	"net"
 	"net/netip"
 	"strings"
+	"time"
 
 	"github.com/spf13/cobra"
 	"google.golang.org/grpc/status"
@@ -115,6 +116,11 @@ func statusFunc(cmd *cobra.Command, args []string) error {
 	// manager only knows the active profile ID, not its display name.
 	profName := getActiveProfileName(ctx)
 
+	var sessionExpiresAt time.Time
+	if ts := resp.GetSessionExpiresAt(); ts.IsValid() {
+		sessionExpiresAt = ts.AsTime().UTC()
+	}
+
 	var outputInformationHolder = nbstatus.ConvertToStatusOutputOverview(resp.GetFullStatus(), nbstatus.ConvertOptions{
 		Anonymize:            anonymizeFlag,
 		DaemonVersion:        resp.GetDaemonVersion(),
@@ -125,6 +131,7 @@ func statusFunc(cmd *cobra.Command, args []string) error {
 		IPsFilter:            ipsFilterMap,
 		ConnectionTypeFilter: connectionTypeFilter,
 		ProfileName:          profName,
+		SessionExpiresAt:     sessionExpiresAt,
 	})
 	var statusOutputString string
 	switch {
diff --git a/client/embed/embed.go b/client/embed/embed.go
index d0d88b177..99a6b8229 100644
--- a/client/embed/embed.go
+++ b/client/embed/embed.go
@@ -470,7 +470,7 @@ func (c *Client) Status() (peer.FullStatus, error) {
 	if connect != nil {
 		engine := connect.Engine()
 		if engine != nil {
-			_ = engine.RunHealthProbes(false)
+			_ = engine.RunHealthProbes(context.Background(), false)
 		}
 	}
 
diff --git a/client/installer.nsis b/client/installer.nsis
index 63bff1c5b..71699071b 100644
--- a/client/installer.nsis
+++ b/client/installer.nsis
@@ -6,7 +6,7 @@
 !define DESCRIPTION "Connect your devices into a secure WireGuard-based overlay network with SSO, MFA, and granular access controls."
 !define INSTALLER_NAME "netbird-installer.exe"
 !define MAIN_APP_EXE "Netbird"
-!define ICON "ui\\assets\\netbird.ico"
+!define ICON "ui\\build\\windows\\icon.ico"
 !define BANNER "ui\\build\\banner.bmp"
 !define LICENSE_DATA "..\\LICENSE"
 
@@ -79,8 +79,6 @@ ShowInstDetails Show
 
 !insertmacro MUI_PAGE_DIRECTORY
 
-Page custom AutostartPage AutostartPageLeave
-
 !insertmacro MUI_PAGE_INSTFILES
 
 !insertmacro MUI_PAGE_FINISH
@@ -97,40 +95,12 @@ UninstPage custom un.DeleteDataPage un.DeleteDataPageLeave
 
 !insertmacro MUI_LANGUAGE "English"
 
-; Variables for autostart option
-Var AutostartCheckbox
-Var AutostartEnabled
-
 ; Variables for uninstall data deletion option
 Var DeleteDataCheckbox
 Var DeleteDataEnabled
 
 ######################################################################
 
-; Function to create the autostart options page
-Function AutostartPage
-  !insertmacro MUI_HEADER_TEXT "Startup Options" "Configure how ${APP_NAME} launches with Windows."
-
-  nsDialogs::Create 1018
-  Pop $0
-
-  ${If} $0 == error
-    Abort
-  ${EndIf}
-
-  ${NSD_CreateCheckbox} 0 20u 100% 10u "Start ${APP_NAME} UI automatically when Windows starts"
-  Pop $AutostartCheckbox
-  ${NSD_Check} $AutostartCheckbox
-  StrCpy $AutostartEnabled "1"
-
-  nsDialogs::Show
-FunctionEnd
-
-; Function to handle leaving the autostart page
-Function AutostartPageLeave
-  ${NSD_GetState} $AutostartCheckbox $AutostartEnabled
-FunctionEnd
-
 ; Function to create the uninstall data deletion page
 Function un.DeleteDataPage
   !insertmacro MUI_HEADER_TEXT "Uninstall Options" "Choose whether to delete ${APP_NAME} data."
@@ -201,8 +171,6 @@ Pop $0
 
 Function .onInit
 StrCpy $INSTDIR "${INSTALL_DIR}"
-; Default autostart to enabled so silent installs (/S) match the interactive default
-StrCpy $AutostartEnabled "1"
 
 ; Pre-0.70.1 installers ran without SetRegView, so their uninstall keys live
 ; in the 32-bit view. Fall back to it so upgrades still find them.
@@ -260,17 +228,12 @@ WriteRegStr ${REG_ROOT} "${UNINSTALL_PATH}"  "Publisher" "${COMP_NAME}"
 
 WriteRegStr ${REG_ROOT} "${UI_REG_APP_PATH}" "" "$INSTDIR\${UI_APP_EXE}"
 
-; Create autostart registry entry based on checkbox
-DetailPrint "Autostart enabled: $AutostartEnabled"
-${If} $AutostartEnabled == "1"
-    WriteRegStr HKLM "${AUTOSTART_REG_KEY}" "${APP_NAME}" '"$INSTDIR\${UI_APP_EXE}.exe"'
-    DetailPrint "Added autostart registry entry: $INSTDIR\${UI_APP_EXE}.exe"
-${Else}
-    DeleteRegValue HKLM "${AUTOSTART_REG_KEY}" "${APP_NAME}"
-    ; Legacy: pre-HKLM installs wrote to HKCU; clean that up too.
-    DeleteRegValue HKCU "${AUTOSTART_REG_KEY}" "${APP_NAME}"
-    DetailPrint "Autostart not enabled by user"
-${EndIf}
+; Autostart is owned by the UI's per-user setting (HKCU\...\Run via Wails),
+; not the installer. Drop the machine-wide entry older installers wrote so the
+; toggle is the single source of truth. HKCU is left untouched -- it may hold
+; the user's own toggle state, which must survive upgrades.
+DetailPrint "Removing installer-managed autostart registry entry if present..."
+DeleteRegValue HKLM "${AUTOSTART_REG_KEY}" "${APP_NAME}"
 
 EnVar::SetHKLM
 EnVar::AddValueEx "path" "$INSTDIR"
@@ -280,6 +243,43 @@ CreateShortCut "$SMPROGRAMS\${APP_NAME}.lnk" "$INSTDIR\${UI_APP_EXE}"
 CreateShortCut "$DESKTOP\${APP_NAME}.lnk" "$INSTDIR\${UI_APP_EXE}"
 SectionEnd
 
+# Install the Microsoft Edge WebView2 runtime if it isn't already present.
+# Macro adapted from Wails3's NSIS template (wails_tools.nsh): a registry
+# probe followed by a silent install of the embedded evergreen bootstrapper.
+# The MicrosoftEdgeWebview2Setup.exe payload is staged next to this script
+# by the sign-pipelines build step (`wails3 generate webview2bootstrapper`).
+!macro nb.webview2runtime
+    SetRegView 64
+    # Per-machine install marker — populated when the runtime ships with
+    # Edge or has been installed by an admin previously.
+    ReadRegStr $0 HKLM "SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" "pv"
+    ${If} $0 != ""
+        Goto webview2_ok
+    ${EndIf}
+    # Per-user fallback for HKCU installs.
+    ReadRegStr $0 HKCU "Software\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" "pv"
+    ${If} $0 != ""
+        Goto webview2_ok
+    ${EndIf}
+
+    SetDetailsPrint both
+    DetailPrint "Installing: WebView2 Runtime"
+    SetDetailsPrint listonly
+
+    InitPluginsDir
+    CreateDirectory "$pluginsdir\webview2bootstrapper"
+    SetOutPath "$pluginsdir\webview2bootstrapper"
+    File "MicrosoftEdgeWebview2Setup.exe"
+    ExecWait '"$pluginsdir\webview2bootstrapper\MicrosoftEdgeWebview2Setup.exe" /silent /install'
+
+    SetDetailsPrint both
+    webview2_ok:
+!macroend
+
+Section -WebView2
+    !insertmacro nb.webview2runtime
+SectionEnd
+
 Section -Post
 ExecWait '"$INSTDIR\${MAIN_APP_EXE}" service install'
 ExecWait '"$INSTDIR\${MAIN_APP_EXE}" service start'
@@ -299,11 +299,14 @@ ExecWait '"$INSTDIR\${MAIN_APP_EXE}" service uninstall'
 DetailPrint "Terminating Netbird UI process..."
 ExecWait `taskkill /im ${UI_APP_EXE}.exe /f`
 
-; Remove autostart registry entry
-DetailPrint "Removing autostart registry entry if exists..."
+; Remove autostart registry entries
+DetailPrint "Removing autostart registry entries if they exist..."
+; Legacy machine-wide entry written by older installers.
 DeleteRegValue HKLM "${AUTOSTART_REG_KEY}" "${APP_NAME}"
-; Legacy: pre-HKLM installs wrote to HKCU; clean that up too.
+; Per-user entry the UI toggle writes via Wails (value name is the lowercase
+; app-name slug). Uninstall removes the app, so drop it too.
 DeleteRegValue HKCU "${AUTOSTART_REG_KEY}" "${APP_NAME}"
+DeleteRegValue HKCU "${AUTOSTART_REG_KEY}" "netbird"
 
 ; Handle data deletion based on checkbox
 DetailPrint "Checking if user requested data deletion..."
@@ -326,9 +329,9 @@ DetailPrint "Deleting application files..."
 Delete "$INSTDIR\${UI_APP_EXE}"
 Delete "$INSTDIR\${MAIN_APP_EXE}"
 Delete "$INSTDIR\wintun.dll"
-!if ${ARCH} == "amd64"
+# Legacy: pre-Wails installs shipped opengl32.dll (Mesa3D for Fyne); remove
+# any leftover copy on uninstall so old upgrades don't leave it behind.
 Delete "$INSTDIR\opengl32.dll"
-!endif
 DetailPrint "Removing application directory..."
 RmDir /r "$INSTDIR"
 
diff --git a/client/internal/auth/auth.go b/client/internal/auth/auth.go
index 850e0706d..51f56b644 100644
--- a/client/internal/auth/auth.go
+++ b/client/internal/auth/auth.go
@@ -3,6 +3,7 @@ package auth
 import (
 	"context"
 	"net/url"
+	"strings"
 	"sync"
 	"time"
 
@@ -21,6 +22,25 @@ import (
 	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
 )
 
+// peerLoginExpiredMsg is the exact phrase the management server returns
+// when a previously SSO-enrolled peer's login has expired. Sourced from
+// shared/management/status/error.go (NewPeerLoginExpiredError). Matched
+// by substring so a future server-side rewording that keeps the phrase
+// still triggers the friendly fallback in Login().
+const peerLoginExpiredMsg = "peer login has expired"
+
+// errSetupKeyOnSSOExpiredPeer replaces the raw management error when the
+// user runs `netbird login -k <setup-key>` against a peer that was
+// originally enrolled via SSO. Wrapped in a PermissionDenied gRPC status
+// so callers' existing isPermissionDenied / isAuthError checks still
+// classify it correctly (early-exit from retry backoff, StatusNeedsLogin
+// in the server state machine).
+var errSetupKeyOnSSOExpiredPeer = status.Error(
+	codes.PermissionDenied,
+	"this peer was originally enrolled via SSO and its session has expired. "+
+		"Setup keys can only enrol new peers — run `netbird up` (interactive SSO) to re-login.",
+)
+
 // Auth manages authentication operations with the management server
 // It maintains a long-lived connection and automatically handles reconnection with backoff
 type Auth struct {
@@ -184,6 +204,15 @@ func (a *Auth) Login(ctx context.Context, setupKey string, jwtToken string) (err
 			log.Debugf("peer registration required")
 			_, err = a.registerPeer(client, ctx, setupKey, jwtToken, pubSSHKey)
 			if err != nil {
+				// The peer pub-key is already on file with the management
+				// server (originally enrolled via SSO) and the session has
+				// expired. The setup-key path can only enrol new peers, so
+				// retrying with -k will keep failing. Replace the raw mgm
+				// message with an actionable hint that tells the user to
+				// re-authenticate via SSO instead.
+				if setupKey != "" && jwtToken == "" && isPeerLoginExpired(err) {
+					err = errSetupKeyOnSSOExpiredPeer
+				}
 				isAuthError = isPermissionDenied(err)
 				return err
 			}
@@ -473,3 +502,16 @@ func isLoginNeeded(err error) bool {
 func isRegistrationNeeded(err error) bool {
 	return isPermissionDenied(err)
 }
+
+// isPeerLoginExpired reports whether err is the management server's
+// "peer login has expired" PermissionDenied response. Used by Login to
+// detect the case where the caller passed a setup-key but the peer is
+// actually an SSO-enrolled record whose session needs refreshing — the
+// setup-key path cannot help there.
+func isPeerLoginExpired(err error) bool {
+	if !isPermissionDenied(err) {
+		return false
+	}
+	s, _ := status.FromError(err)
+	return strings.Contains(s.Message(), peerLoginExpiredMsg)
+}
diff --git a/client/internal/auth/auth_test.go b/client/internal/auth/auth_test.go
new file mode 100644
index 000000000..e393beccb
--- /dev/null
+++ b/client/internal/auth/auth_test.go
@@ -0,0 +1,80 @@
+package auth
+
+import (
+	"errors"
+	"strings"
+	"testing"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+func TestIsPeerLoginExpired(t *testing.T) {
+	cases := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{
+			name: "nil",
+			err:  nil,
+			want: false,
+		},
+		{
+			name: "plain error (not a gRPC status)",
+			err:  errors.New("network read: connection reset"),
+			want: false,
+		},
+		{
+			name: "PermissionDenied with different message",
+			err:  status.Error(codes.PermissionDenied, "user is blocked"),
+			want: false,
+		},
+		{
+			name: "Unauthenticated with the expected phrase",
+			// Wrong status code — must still return false.
+			err:  status.Error(codes.Unauthenticated, "peer login has expired, please log in once more"),
+			want: false,
+		},
+		{
+			name: "exact server message",
+			err:  status.Error(codes.PermissionDenied, "peer login has expired, please log in once more"),
+			want: true,
+		},
+		{
+			name: "phrase as substring",
+			// Future-proofing: if mgm reworords but keeps the phrase,
+			// the friendly fallback must still kick in.
+			err:  status.Error(codes.PermissionDenied, "session refused: peer login has expired (account=foo)"),
+			want: true,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := isPeerLoginExpired(tc.err); got != tc.want {
+				t.Fatalf("isPeerLoginExpired(%v) = %v, want %v", tc.err, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestErrSetupKeyOnSSOExpiredPeer(t *testing.T) {
+	// Sentinel must surface as PermissionDenied so the upstream
+	// isPermissionDenied / isAuthError checks classify it correctly
+	// (short-circuit retry backoff, set StatusNeedsLogin).
+	if !isPermissionDenied(errSetupKeyOnSSOExpiredPeer) {
+		t.Fatalf("errSetupKeyOnSSOExpiredPeer must be a PermissionDenied gRPC error")
+	}
+
+	// Message must actually mention SSO and `netbird up` so it is
+	// actionable for the end user. Loose substring checks keep the
+	// test resilient to copy edits.
+	s, _ := status.FromError(errSetupKeyOnSSOExpiredPeer)
+	msg := strings.ToLower(s.Message())
+	for _, want := range []string{"sso", "netbird up"} {
+		if !strings.Contains(msg, want) {
+			t.Errorf("sentinel message should contain %q, got %q", want, s.Message())
+		}
+	}
+}
diff --git a/client/internal/auth/pending_flow.go b/client/internal/auth/pending_flow.go
new file mode 100644
index 000000000..daeb18bc2
--- /dev/null
+++ b/client/internal/auth/pending_flow.go
@@ -0,0 +1,89 @@
+package auth
+
+import (
+	"context"
+	"sync"
+	"time"
+)
+
+// PendingFlow stores an in-progress OAuth flow between the RPC that
+// initiates it (returns the verification URI to the UI) and the RPC
+// that waits for the user to complete it. The flow handle, the
+// device-code info, and the absolute expiry are kept together so the
+// waiting RPC can validate the device code and reuse the same flow.
+//
+// PendingFlow is safe for concurrent use; callers must not access the
+// stored fields directly.
+type PendingFlow struct {
+	mu         sync.Mutex
+	flow       OAuthFlow
+	info       AuthFlowInfo
+	expiresAt  time.Time
+	waitCancel context.CancelFunc
+}
+
+// NewPendingFlow returns an empty PendingFlow ready to be populated by Set.
+func NewPendingFlow() *PendingFlow {
+	return &PendingFlow{}
+}
+
+// Set stores the flow and its authorization info, computing the absolute
+// expiry from info.ExpiresIn (seconds, as returned by the IdP).
+func (p *PendingFlow) Set(flow OAuthFlow, info AuthFlowInfo) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.flow = flow
+	p.info = info
+	p.expiresAt = time.Now().Add(time.Duration(info.ExpiresIn) * time.Second)
+}
+
+// Get returns the stored flow, info, and whether a flow is currently
+// pending. Returns (nil, zero, false) after Clear or before Set.
+func (p *PendingFlow) Get() (OAuthFlow, AuthFlowInfo, bool) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if p.flow == nil {
+		return nil, AuthFlowInfo{}, false
+	}
+	return p.flow, p.info, true
+}
+
+// ExpiresAt returns the absolute expiry of the pending flow. Returns
+// the zero time when no flow is pending.
+func (p *PendingFlow) ExpiresAt() time.Time {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	return p.expiresAt
+}
+
+// SetWaitCancel records the cancel function for the goroutine currently
+// blocked in WaitToken so a new RequestAuth can preempt it.
+func (p *PendingFlow) SetWaitCancel(cancel context.CancelFunc) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.waitCancel = cancel
+}
+
+// CancelWait invokes and clears the stored wait-cancel, if any. Safe to
+// call when no wait is in progress.
+func (p *PendingFlow) CancelWait() {
+	p.mu.Lock()
+	cancel := p.waitCancel
+	p.waitCancel = nil
+	p.mu.Unlock()
+	if cancel != nil {
+		cancel()
+	}
+}
+
+// Clear resets the pending flow to empty. Any stored wait-cancel is
+// dropped without being invoked — call CancelWait first if the waiting
+// goroutine must be stopped.
+func (p *PendingFlow) Clear() {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.flow = nil
+	p.info = AuthFlowInfo{}
+	p.expiresAt = time.Time{}
+	p.waitCancel = nil
+}
diff --git a/client/internal/auth/sessionwatch/event.go b/client/internal/auth/sessionwatch/event.go
new file mode 100644
index 000000000..3e55b26dd
--- /dev/null
+++ b/client/internal/auth/sessionwatch/event.go
@@ -0,0 +1,82 @@
+package sessionwatch
+
+import (
+	"strconv"
+	"time"
+)
+
+// internal event kinds are no longer exposed: the watcher drives the Sink
+// directly (NotifyStateChange on deadline change/clear, PublishEvent at
+// each warning lead). Tests use a mock Sink to observe what the watcher
+// emits.
+
+// Metadata keys attached by the daemon to session-warning SystemEvents.
+// The UI tray reads these to build a locale-aware notification without
+// relying on the daemon's locale-less UserMessage string, and to
+// disambiguate the T-WarningLead notification from the T-FinalWarningLead
+// fallback that auto-opens the SessionAboutToExpire dialog.
+const (
+	// MetaSessionWarning is set to "true" on both warning events (T-10 and
+	// T-2) so the UI can detect a session-warning SystemEvent without
+	// matching on the message text. Use MetaSessionFinal to distinguish
+	// the two.
+	MetaSessionWarning = "session_warning"
+	// MetaSessionFinal is set to "true" on the T-FinalWarningLead event
+	// only. Consumers that need to auto-open the SessionAboutToExpire
+	// dialog gate on this; T-WarningLead events leave the field unset.
+	MetaSessionFinal = "session_final_warning"
+	// MetaSessionExpiresAt carries the absolute UTC deadline encoded with
+	// FormatExpiresAt; consumers must decode with ParseExpiresAt so a
+	// future format change stays a single edit.
+	MetaSessionExpiresAt = "session_expires_at"
+	// MetaSessionLeadMinutes carries the lead in whole minutes (WarningLead
+	// for the T-10 event, FinalWarningLead for the T-2 event) so the UI
+	// can show "expires in ~N minutes" without hardcoding either constant.
+	MetaSessionLeadMinutes = "lead_minutes"
+	// MetaSessionDeadlineRejected is attached to the ERROR/AUTHENTICATION
+	// SystemEvent the daemon emits when it discards a deadline from the
+	// management server (pre-epoch, too far in the future, or past the
+	// clock-skew tolerance). The value is the rejection reason string.
+	// userMessage is left empty; the UI detects the event via this key
+	// and builds a localized notification — same pattern as the session
+	// warnings above.
+	MetaSessionDeadlineRejected = "session_deadline_rejected"
+)
+
+// expiresAtLayout is the wire format used for MetaSessionExpiresAt.
+// Producer and consumers both go through FormatExpiresAt/ParseExpiresAt
+// so this layout stays a single source of truth.
+const expiresAtLayout = time.RFC3339
+
+// FormatExpiresAt encodes a deadline for MetaSessionExpiresAt. Always
+// emits UTC so a consumer in another timezone reads the same wall-clock
+// deadline.
+func FormatExpiresAt(t time.Time) string {
+	return t.UTC().Format(expiresAtLayout)
+}
+
+// ParseExpiresAt decodes the MetaSessionExpiresAt value back to a UTC
+// time. Returns an error when the field is empty or malformed; the
+// caller decides whether to fall back (zero value) or propagate.
+func ParseExpiresAt(s string) (time.Time, error) {
+	t, err := time.Parse(expiresAtLayout, s)
+	if err != nil {
+		return time.Time{}, err
+	}
+	return t.UTC(), nil
+}
+
+// FormatLeadMinutes encodes a lead duration for MetaSessionLeadMinutes
+// as the integer count of whole minutes. Sub-minute residuals are
+// truncated — the field is informational ("expires in ~N minutes") and
+// fractional minutes don't change what the UI displays.
+func FormatLeadMinutes(d time.Duration) string {
+	return strconv.Itoa(int(d / time.Minute))
+}
+
+// ParseLeadMinutes decodes a MetaSessionLeadMinutes value. Returns 0
+// and the parse error for malformed input; consumers that prefer a
+// silent fallback can simply ignore the error.
+func ParseLeadMinutes(s string) (int, error) {
+	return strconv.Atoi(s)
+}
diff --git a/client/internal/auth/sessionwatch/watcher.go b/client/internal/auth/sessionwatch/watcher.go
new file mode 100644
index 000000000..e75a7022e
--- /dev/null
+++ b/client/internal/auth/sessionwatch/watcher.go
@@ -0,0 +1,387 @@
+// Package sessionwatch tracks the SSO session expiry deadline that the
+// management server publishes via LoginResponse / SyncResponse and fires
+// two warning events at fixed lead times before expiry: an interactive
+// T-WarningLead notification and a dismiss-gated T-FinalWarningLead
+// fallback dialog.
+//
+// The watcher is idempotent: Update may be called as often as the network
+// map snapshots arrive. Repeating the same deadline is a no-op; a new
+// deadline reschedules the timers and arms a fresh warning cycle.
+//
+// Warning firing is edge-detected. Each unique deadline value fires each
+// warning callback at most once.
+package sessionwatch
+
+import (
+	"errors"
+	"fmt"
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	cProto "github.com/netbirdio/netbird/client/proto"
+)
+
+const (
+	// Skew tolerates a small clock difference between the management
+	// server and this peer before treating a deadline as "in the past".
+	// Slightly above typical NTP drift; tight enough that the UI doesn't
+	// paint a stale expiry as if it were valid.
+	Skew = 30 * time.Second
+
+	// maxDeadlineHorizon caps how far in the future an accepted deadline
+	// can sit. A timestamp beyond this is almost certainly a protocol
+	// glitch, and silently arming a 100-year timer would hide the bug.
+	maxDeadlineHorizon = 10 * 365 * 24 * time.Hour
+
+	// WarningLead is how far before expiry the first (interactive)
+	// warning fires. Drives the T-10 OS notification with
+	// Extend/Dismiss actions.
+	WarningLead = 10 * time.Minute
+
+	// FinalWarningLead is how far before expiry the fallback final
+	// warning fires. Drives the auto-opened SessionAboutToExpire dialog,
+	// but only when the user has not dismissed the T-WarningLead warning
+	// for the same deadline. Must be strictly less than WarningLead.
+	FinalWarningLead = 2 * time.Minute
+)
+
+var (
+	// ErrDeadlineBeforeEpoch is returned by Update when the supplied
+	// deadline pre-dates 1970-01-01.
+	ErrDeadlineBeforeEpoch = errors.New("session deadline before unix epoch")
+
+	// ErrDeadlineTooFarFuture is returned by Update when the supplied
+	// deadline is more than maxDeadlineHorizon in the future.
+	ErrDeadlineTooFarFuture = errors.New("session deadline too far in the future")
+
+	// ErrDeadlineInPast is returned by Update when the supplied deadline
+	// is more than Skew in the past.
+	ErrDeadlineInPast = errors.New("session deadline in the past")
+)
+
+// StatusRecorder is the side-effect surface the watcher drives on every
+// state transition. Production wires this to peer.Status (SetSessionExpiresAt
+// for deadline change/clear, PublishEvent for the two warnings); tests pass
+// a fake recorder so the same surface is observable without an engine.
+//
+// The watcher is the single owner of the deadline propagated to the
+// recorder: every set, clear, sanity-check rejection and Close routes the
+// value through SetSessionExpiresAt, so the SubscribeStatus snapshot the UI
+// reads can never drift from the watcher's timer state. (SetSessionExpiresAt
+// fans out its own state-change notification, so no separate notify is
+// needed.) The recorder is server-scoped and outlives this engine-scoped
+// watcher — without the Close-time clear a teardown (Down, or the Down+Up of
+// a profile switch) would leave the next session showing the previous one's
+// stale "expires in" value.
+//
+// PublishEvent's signature mirrors peer.Status.PublishEvent: the watcher
+// composes the metadata internally so the wire format (MetaSession*) is
+// owned by sessionwatch, not the caller.
+type StatusRecorder interface {
+	SetSessionExpiresAt(deadline time.Time)
+	PublishEvent(
+		severity cProto.SystemEvent_Severity,
+		category cProto.SystemEvent_Category,
+		message string,
+		userMessage string,
+		metadata map[string]string,
+	)
+}
+
+// Watcher observes the latest session deadline and fires two warnings
+// before it expires: the interactive T-WarningLead notification, and the
+// fallback T-FinalWarningLead dialog (suppressed when the user dismissed
+// the first one for the same deadline). Safe for concurrent use.
+type Watcher struct {
+	lead      time.Duration
+	finalLead time.Duration
+
+	mu           sync.Mutex
+	current      time.Time
+	timer        *time.Timer
+	finalTimer   *time.Timer
+	firedAt      time.Time // deadline value the T-WarningLead callback last fired against
+	finalFiredAt time.Time // deadline value the T-FinalWarningLead callback last fired against
+	dismissedAt  time.Time // deadline value the user dismissed via Dismiss(); gates fireFinal
+	closed       bool
+	recorder     StatusRecorder
+}
+
+// New returns a watcher with the package defaults WarningLead and
+// FinalWarningLead. Pass nil for recorder to silence side effects (handy
+// in unit tests that exercise sanity checks without observing the publish
+// path).
+func New(recorder StatusRecorder) *Watcher {
+	return NewWithLeads(WarningLead, FinalWarningLead, recorder)
+}
+
+// NewWithLeads returns a watcher with custom lead times. Useful for tests.
+// final must be strictly less than lead; otherwise both timers fire in the
+// wrong order or simultaneously and the UI flow breaks. A zero final lead
+// disables the final-warning timer entirely (see armTimerLocked) so a
+// millisecond-scale deadline doesn't flush both timers in one tick.
+func NewWithLeads(lead, final time.Duration, recorder StatusRecorder) *Watcher {
+	return &Watcher{
+		lead:      lead,
+		finalLead: final,
+		recorder:  recorder,
+	}
+}
+
+// Update sets the latest deadline. Pass the zero time to clear (e.g. when
+// a Sync push from the server omits the field because login expiration
+// was disabled).
+//
+// Same-value updates are no-ops. A different non-zero value cancels any
+// pending timer, resets the "already fired" guard, and arms a new one.
+//
+// Returns one of the sentinel Err* values when the deadline fails the
+// sanity checks (pre-epoch, far future, or in the past beyond Skew).
+// In every error case the watcher first clears its state so it stays
+// consistent with what the caller will push into its other sinks (e.g.
+// applySessionDeadline forces a zero deadline into the status recorder
+// after a non-nil error).
+func (w *Watcher) Update(deadline time.Time) error {
+	w.mu.Lock()
+	if w.closed {
+		w.mu.Unlock()
+		return nil
+	}
+
+	if deadline.IsZero() {
+		w.clearLocked()
+		return nil
+	}
+
+	now := time.Now()
+	switch {
+	case deadline.Before(time.Unix(0, 0)):
+		w.clearLocked()
+		return fmt.Errorf("%w: %v", ErrDeadlineBeforeEpoch, deadline)
+	case deadline.After(now.Add(maxDeadlineHorizon)):
+		w.clearLocked()
+		return fmt.Errorf("%w: %v", ErrDeadlineTooFarFuture, deadline)
+	case deadline.Before(now.Add(-Skew)):
+		w.clearLocked()
+		return fmt.Errorf("%w: %v (now=%v)", ErrDeadlineInPast, deadline, now)
+	}
+
+	if deadline.Equal(w.current) {
+		w.mu.Unlock()
+		return nil
+	}
+
+	w.stopTimerLocked()
+	w.current = deadline
+	// Reset every per-deadline guard so a refreshed deadline arms a fresh
+	// warning cycle: both edge triggers and the user Dismiss decision
+	// (the user agreed to the old deadline expiring; a new deadline
+	// restarts the contract).
+	w.firedAt = time.Time{}
+	w.finalFiredAt = time.Time{}
+	w.dismissedAt = time.Time{}
+
+	w.armTimerLocked(deadline)
+	recorder := w.recorder
+	w.mu.Unlock()
+	if recorder != nil {
+		recorder.SetSessionExpiresAt(deadline)
+	}
+	log.Infof("auth session deadline set to: %s (in %s)", deadline.Format(time.RFC3339), time.Until(deadline).Round(time.Second))
+	return nil
+}
+
+// Deadline returns the most recently observed deadline. Zero when no
+// deadline is currently tracked.
+func (w *Watcher) Deadline() time.Time {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	return w.current
+}
+
+// Dismiss records the user's "Dismiss" action against the current deadline
+// and suppresses the upcoming final-warning callback for that deadline.
+// Idempotent: repeated calls are no-ops. A subsequent Update with a fresh
+// deadline resets the dismissal so the final-warning cycle re-arms.
+//
+// No-op when the watcher holds no deadline or has been closed.
+func (w *Watcher) Dismiss() {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	if w.closed || w.current.IsZero() {
+		return
+	}
+	if w.dismissedAt.Equal(w.current) {
+		return
+	}
+	w.dismissedAt = w.current
+	// Cancel the armed final-warning timer eagerly. fireFinal would also
+	// gate on dismissedAt, but stopping the timer avoids a wakeup with
+	// nothing to do and makes the intent visible.
+	if w.finalTimer != nil {
+		w.finalTimer.Stop()
+		w.finalTimer = nil
+	}
+	log.Infof("auth session final-warning dismissed for deadline %s", w.current.Format(time.RFC3339))
+}
+
+// Close stops any pending timer and drops the deadline on the status
+// recorder. Update calls after Close are ignored. Clearing the recorder
+// here is what keeps a teardown (Down, or the Down+Up of a profile switch)
+// from leaving the next session showing this one's stale "expires in"
+// value — the recorder is server-scoped and outlives this engine-scoped
+// watcher, so nothing else drops the anchor on teardown.
+func (w *Watcher) Close() {
+	w.mu.Lock()
+	if w.closed {
+		w.mu.Unlock()
+		return
+	}
+	w.closed = true
+	w.stopTimerLocked()
+	hadDeadline := !w.current.IsZero()
+	w.current = time.Time{}
+	w.firedAt = time.Time{}
+	w.finalFiredAt = time.Time{}
+	w.dismissedAt = time.Time{}
+	recorder := w.recorder
+	w.mu.Unlock()
+	if recorder != nil && hadDeadline {
+		recorder.SetSessionExpiresAt(time.Time{})
+	}
+}
+
+// clearLocked drops the tracked deadline and notifies the recorder so
+// downstream consumers (SubscribeStatus stream, UI) drop their anchor.
+// The caller must hold w.mu; this helper releases it before invoking
+// the recorder.
+func (w *Watcher) clearLocked() {
+	if w.current.IsZero() {
+		w.mu.Unlock()
+		return
+	}
+	w.stopTimerLocked()
+	w.current = time.Time{}
+	w.firedAt = time.Time{}
+	w.finalFiredAt = time.Time{}
+	w.dismissedAt = time.Time{}
+	recorder := w.recorder
+	w.mu.Unlock()
+	if recorder != nil {
+		recorder.SetSessionExpiresAt(time.Time{})
+	}
+	log.Infof("auth session deadline cleared")
+}
+
+func (w *Watcher) stopTimerLocked() {
+	if w.timer != nil {
+		w.timer.Stop()
+		w.timer = nil
+	}
+	if w.finalTimer != nil {
+		w.finalTimer.Stop()
+		w.finalTimer = nil
+	}
+}
+
+func (w *Watcher) armTimerLocked(deadline time.Time) {
+	w.timer = armOneShotLocked(deadline.Add(-w.lead), func() { w.fire(deadline) })
+	// finalLead <= 0 disables the final-warning timer entirely. Used by
+	// tests that predate the final-warning fallback so a millisecond-scale
+	// deadline does not flush both timers at once.
+	if w.finalLead > 0 {
+		w.finalTimer = armOneShotLocked(deadline.Add(-w.finalLead), func() { w.fireFinal(deadline) })
+	}
+}
+
+func (w *Watcher) fire(armedFor time.Time) {
+	w.mu.Lock()
+	if w.closed || !w.current.Equal(armedFor) {
+		// Deadline moved while we were waiting (e.g. a successful extend).
+		// The reschedule path armed a fresh timer; this one is stale.
+		w.mu.Unlock()
+		return
+	}
+	if !w.firedAt.IsZero() && w.firedAt.Equal(armedFor) {
+		w.mu.Unlock()
+		return
+	}
+	w.firedAt = armedFor
+	recorder := w.recorder
+	w.mu.Unlock()
+	if recorder == nil {
+		return
+	}
+	log.Infof("auth session expiry soon warning fired")
+	publishWarning(recorder, armedFor, false)
+}
+
+// fireFinal mirrors fire for the T-FinalWarningLead timer with an extra
+// dismiss-gate: if the user dismissed the T-WarningLead notification for
+// this deadline, the final warning is suppressed entirely.
+func (w *Watcher) fireFinal(armedFor time.Time) {
+	w.mu.Lock()
+	if w.closed || !w.current.Equal(armedFor) {
+		w.mu.Unlock()
+		return
+	}
+	if !w.finalFiredAt.IsZero() && w.finalFiredAt.Equal(armedFor) {
+		w.mu.Unlock()
+		return
+	}
+	if w.dismissedAt.Equal(armedFor) {
+		w.mu.Unlock()
+		log.Infof("auth session final-warning skipped (dismissed by user)")
+		return
+	}
+	w.finalFiredAt = armedFor
+	recorder := w.recorder
+	w.mu.Unlock()
+	if recorder == nil {
+		return
+	}
+	log.Infof("auth session final-warning fired")
+	publishWarning(recorder, armedFor, true)
+}
+
+// armOneShotLocked schedules cb at fireAt. When fireAt is already in the
+// past it dispatches on the next scheduler tick so a state-change recorder
+// notification (invoked after w.mu is released) lands first. Caller must
+// hold w.mu.
+func armOneShotLocked(fireAt time.Time, cb func()) *time.Timer {
+	delay := time.Until(fireAt)
+	if delay <= 0 {
+		return time.AfterFunc(0, cb)
+	}
+	return time.AfterFunc(delay, cb)
+}
+
+// publishWarning composes the SystemEvent for a watcher-fired warning and
+// pushes it through the recorder. Severity is CRITICAL on both — bypassing
+// the user's Notifications toggle is deliberate: missing the warning
+// window forces the post-mortem SessionExpired flow (tunnel torn down,
+// lock icon, manual re-login), which is the UX we are trying to avoid.
+func publishWarning(recorder StatusRecorder, deadline time.Time, final bool) {
+	lead := WarningLead
+	message := "session expiry warning"
+	meta := map[string]string{
+		MetaSessionWarning:   "true",
+		MetaSessionExpiresAt: FormatExpiresAt(deadline),
+	}
+	if final {
+		lead = FinalWarningLead
+		message = "session expiry final warning"
+		meta[MetaSessionFinal] = "true"
+	}
+	meta[MetaSessionLeadMinutes] = FormatLeadMinutes(lead)
+
+	recorder.PublishEvent(
+		cProto.SystemEvent_CRITICAL,
+		cProto.SystemEvent_AUTHENTICATION,
+		message,
+		"",
+		meta,
+	)
+}
diff --git a/client/internal/auth/sessionwatch/watcher_test.go b/client/internal/auth/sessionwatch/watcher_test.go
new file mode 100644
index 000000000..da2b6add6
--- /dev/null
+++ b/client/internal/auth/sessionwatch/watcher_test.go
@@ -0,0 +1,519 @@
+package sessionwatch
+
+import (
+	"errors"
+	"sync"
+	"testing"
+	"time"
+
+	cProto "github.com/netbirdio/netbird/client/proto"
+)
+
+// fakeRecorder satisfies StatusRecorder and records every call so tests
+// can observe what the watcher emits. SetSessionExpiresAt and PublishEvent
+// land in the same ordered events slice (with the Kind distinguishing
+// them) so tests that care about ordering still work. lastDeadline holds
+// the most recent value passed to SetSessionExpiresAt so tests can assert
+// the recorder ended up cleared/set as expected.
+type fakeRecorder struct {
+	mu           sync.Mutex
+	events       []event
+	lastDeadline time.Time
+}
+
+type eventKind int
+
+const (
+	stateChange eventKind = iota
+	publish
+)
+
+type event struct {
+	kind eventKind
+	// Set only for publish events.
+	severity cProto.SystemEvent_Severity
+	category cProto.SystemEvent_Category
+	message  string
+	meta     map[string]string
+}
+
+// SetSessionExpiresAt mirrors peer.Status: a same-value write is a no-op,
+// a real change records the new value and fans out a state-change (the
+// production recorder calls notifyStateChange internally). The baseline
+// is the zero time, so an initial clear before any deadline is set emits
+// nothing — matching the real recorder.
+func (r *fakeRecorder) SetSessionExpiresAt(deadline time.Time) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if r.lastDeadline.Equal(deadline) {
+		return
+	}
+	r.lastDeadline = deadline
+	r.events = append(r.events, event{kind: stateChange})
+}
+
+func (r *fakeRecorder) deadline() time.Time {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return r.lastDeadline
+}
+
+func (r *fakeRecorder) PublishEvent(
+	severity cProto.SystemEvent_Severity,
+	category cProto.SystemEvent_Category,
+	message string,
+	_ string,
+	metadata map[string]string,
+) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.events = append(r.events, event{
+		kind:     publish,
+		severity: severity,
+		category: category,
+		message:  message,
+		meta:     metadata,
+	})
+}
+
+func (r *fakeRecorder) snapshot() []event {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	out := make([]event, len(r.events))
+	copy(out, r.events)
+	return out
+}
+
+func (e event) isFinalWarning() bool {
+	return e.kind == publish && e.meta[MetaSessionFinal] == "true"
+}
+
+func (e event) isWarning() bool {
+	return e.kind == publish && e.meta[MetaSessionWarning] == "true" && e.meta[MetaSessionFinal] != "true"
+}
+
+func countWhere(events []event, pred func(event) bool) int {
+	n := 0
+	for _, e := range events {
+		if pred(e) {
+			n++
+		}
+	}
+	return n
+}
+
+func waitForEvents(t *testing.T, r *fakeRecorder, want int) []event {
+	t.Helper()
+	deadline := time.Now().Add(500 * time.Millisecond)
+	for time.Now().Before(deadline) {
+		if got := r.snapshot(); len(got) >= want {
+			return got
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+	got := r.snapshot()
+	t.Fatalf("timed out waiting for %d events, got %d: %+v", want, len(got), got)
+	return nil
+}
+
+// newWatcher builds a watcher with the final timer disabled (finalLead=0),
+// matching the lead-only behaviour the pre-final-warning tests assume.
+func newWatcher(lead time.Duration, r *fakeRecorder) *Watcher {
+	return NewWithLeads(lead, 0, r)
+}
+
+func TestUpdateZeroBeforeAnythingIsNoop(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	defer w.Close()
+
+	_ = w.Update(time.Time{})
+
+	if got := r.snapshot(); len(got) != 0 {
+		t.Fatalf("expected no events on initial zero, got %+v", got)
+	}
+}
+
+func TestUpdateNonZeroFiresStateChange(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	defer w.Close()
+
+	d := time.Now().Add(time.Hour)
+	_ = w.Update(d)
+
+	events := waitForEvents(t, r, 1)
+	if events[0].kind != stateChange {
+		t.Fatalf("expected stateChange, got %+v", events[0])
+	}
+	if !w.Deadline().Equal(d) {
+		t.Fatalf("deadline mismatch: %v vs %v", w.Deadline(), d)
+	}
+}
+
+func TestSameDeadlineIsNoop(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	defer w.Close()
+
+	d := time.Now().Add(time.Hour)
+	_ = w.Update(d)
+	_ = w.Update(d)
+	_ = w.Update(d)
+
+	events := waitForEvents(t, r, 1)
+	if len(events) != 1 {
+		t.Fatalf("expected exactly 1 event for repeated same deadline, got %d: %+v", len(events), events)
+	}
+}
+
+func TestWarningFiresOnceWithinLeadWindow(t *testing.T) {
+	r := &fakeRecorder{}
+	lead := 50 * time.Millisecond
+	w := newWatcher(lead, r)
+	defer w.Close()
+
+	// Deadline 80ms out — warning should fire after ~30ms.
+	d := time.Now().Add(80 * time.Millisecond)
+	_ = w.Update(d)
+
+	events := waitForEvents(t, r, 2)
+	if events[0].kind != stateChange {
+		t.Fatalf("event[0] should be stateChange, got %+v", events[0])
+	}
+	if !events[1].isWarning() {
+		t.Fatalf("event[1] should be a warning publish, got %+v", events[1])
+	}
+}
+
+func TestWarningFiresImmediatelyWhenAlreadyInsideWindow(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(time.Hour, r) // lead > delta => fire immediately
+	defer w.Close()
+
+	d := time.Now().Add(10 * time.Millisecond)
+	_ = w.Update(d)
+
+	events := waitForEvents(t, r, 2)
+	if !events[1].isWarning() {
+		t.Fatalf("expected immediate warning publish, got %+v", events[1])
+	}
+}
+
+func TestNewDeadlineCancelsPriorTimer(t *testing.T) {
+	r := &fakeRecorder{}
+	lead := 50 * time.Millisecond
+	w := newWatcher(lead, r)
+	defer w.Close()
+
+	first := time.Now().Add(80 * time.Millisecond) // would fire warning ~30ms in
+	_ = w.Update(first)
+
+	// Replace with a far-future deadline before the warning fires.
+	time.Sleep(5 * time.Millisecond)
+	second := time.Now().Add(time.Hour)
+	_ = w.Update(second)
+
+	// Wait past when first's warning would have fired.
+	time.Sleep(80 * time.Millisecond)
+
+	if n := countWhere(r.snapshot(), event.isWarning); n != 0 {
+		t.Fatalf("warning fired for cancelled deadline: %+v", r.snapshot())
+	}
+}
+
+func TestRefreshAfterFireArmsNewWarning(t *testing.T) {
+	r := &fakeRecorder{}
+	lead := 30 * time.Millisecond
+	w := newWatcher(lead, r)
+	defer w.Close()
+
+	first := time.Now().Add(50 * time.Millisecond)
+	_ = w.Update(first)
+
+	// Wait for stateChange + warning of the first cycle.
+	waitForEvents(t, r, 2)
+
+	// Simulate a successful extend: brand new deadline.
+	second := time.Now().Add(60 * time.Millisecond)
+	_ = w.Update(second)
+
+	// 4 events total: stateChange, warning (first), stateChange, warning (second).
+	events := waitForEvents(t, r, 4)
+	if events[2].kind != stateChange {
+		t.Fatalf("event[2] should be stateChange for the new deadline, got %+v", events[2])
+	}
+	if !events[3].isWarning() {
+		t.Fatalf("event[3] should be a warning publish for the new deadline, got %+v", events[3])
+	}
+}
+
+func TestUpdateZeroAfterNonZeroClearsState(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(time.Hour, r)
+	defer w.Close()
+
+	d := time.Now().Add(2 * time.Hour)
+	_ = w.Update(d)
+	waitForEvents(t, r, 1)
+
+	_ = w.Update(time.Time{})
+
+	events := waitForEvents(t, r, 2)
+	if events[1].kind != stateChange {
+		t.Fatalf("expected stateChange on clear, got %+v", events[1])
+	}
+	if !w.Deadline().IsZero() {
+		t.Fatalf("Deadline should be zero after clear")
+	}
+}
+
+func TestUpdateRejectsBeforeEpoch(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	defer w.Close()
+
+	good := time.Now().Add(time.Hour)
+	if err := w.Update(good); err != nil {
+		t.Fatalf("seed Update: %v", err)
+	}
+
+	err := w.Update(time.Unix(-100, 0))
+	if !errors.Is(err, ErrDeadlineBeforeEpoch) {
+		t.Fatalf("want ErrDeadlineBeforeEpoch, got %v", err)
+	}
+	if !w.Deadline().IsZero() {
+		t.Fatalf("rejected pre-epoch update must clear deadline; got %v", w.Deadline())
+	}
+}
+
+func TestUpdateRejectsTooFarFuture(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	defer w.Close()
+
+	good := time.Now().Add(time.Hour)
+	if err := w.Update(good); err != nil {
+		t.Fatalf("seed Update: %v", err)
+	}
+
+	err := w.Update(time.Now().Add(50 * 365 * 24 * time.Hour))
+	if !errors.Is(err, ErrDeadlineTooFarFuture) {
+		t.Fatalf("want ErrDeadlineTooFarFuture, got %v", err)
+	}
+	if !w.Deadline().IsZero() {
+		t.Fatalf("rejected far-future update must clear deadline; got %v", w.Deadline())
+	}
+}
+
+func TestUpdateInPastClearsDeadline(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	defer w.Close()
+
+	good := time.Now().Add(time.Hour)
+	if err := w.Update(good); err != nil {
+		t.Fatalf("seed Update: %v", err)
+	}
+	// Drain the stateChange from the seed.
+	waitForEvents(t, r, 1)
+
+	err := w.Update(time.Now().Add(-1 * time.Hour))
+	if !errors.Is(err, ErrDeadlineInPast) {
+		t.Fatalf("want ErrDeadlineInPast, got %v", err)
+	}
+	if !w.Deadline().IsZero() {
+		t.Fatalf("in-past update must clear the deadline, got %v", w.Deadline())
+	}
+	events := waitForEvents(t, r, 2)
+	if events[1].kind != stateChange {
+		t.Fatalf("expected stateChange on clear, got %+v", events[1])
+	}
+}
+
+func TestUpdateWithinSkewAccepted(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	defer w.Close()
+
+	// 5 seconds in the past is within the 30s Skew tolerance — accept it.
+	d := time.Now().Add(-5 * time.Second)
+	if err := w.Update(d); err != nil {
+		t.Fatalf("within-skew Update should succeed, got %v", err)
+	}
+	if !w.Deadline().Equal(d) {
+		t.Fatalf("expected deadline to be applied, got %v want %v", w.Deadline(), d)
+	}
+}
+
+func TestCloseSilencesUpdates(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	w.Close()
+
+	_ = w.Update(time.Now().Add(time.Hour))
+
+	time.Sleep(20 * time.Millisecond)
+	if got := r.snapshot(); len(got) != 0 {
+		t.Fatalf("expected no events after Close, got %+v", got)
+	}
+}
+
+// TestCloseClearsRecorderDeadline pins the profile-switch fix: a watcher
+// holding a live deadline must zero the recorder on Close so the next
+// engine's watcher (and the UI reading the shared server-scoped recorder)
+// doesn't start out showing the previous session's stale "expires in".
+func TestCloseClearsRecorderDeadline(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(time.Hour, r)
+
+	d := time.Now().Add(2 * time.Hour)
+	if err := w.Update(d); err != nil {
+		t.Fatalf("seed Update: %v", err)
+	}
+	if got := r.deadline(); !got.Equal(d) {
+		t.Fatalf("recorder deadline after Update = %v, want %v", got, d)
+	}
+
+	w.Close()
+
+	if got := r.deadline(); !got.IsZero() {
+		t.Fatalf("recorder deadline after Close = %v, want zero", got)
+	}
+}
+
+// TestCloseWithoutDeadlineLeavesRecorderUntouched guards the symmetric
+// case: closing a watcher that never held a deadline must not emit a
+// redundant clear (the recorder may legitimately hold a value written by
+// some other path; the watcher only owns what it set).
+func TestCloseWithoutDeadlineLeavesRecorderUntouched(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(time.Hour, r)
+
+	w.Close()
+
+	if got := r.snapshot(); len(got) != 0 {
+		t.Fatalf("expected no events from Close on an empty watcher, got %+v", got)
+	}
+}
+
+func TestFinalWarningFiresAfterRegularWarning(t *testing.T) {
+	r := &fakeRecorder{}
+	// Warning fires at deadline-80ms, final at deadline-30ms.
+	w := NewWithLeads(80*time.Millisecond, 30*time.Millisecond, r)
+	defer w.Close()
+
+	d := time.Now().Add(100 * time.Millisecond)
+	_ = w.Update(d)
+
+	// Expect stateChange + warning + final-warning.
+	events := waitForEvents(t, r, 3)
+
+	if countWhere(events, func(e event) bool { return e.kind == stateChange }) != 1 {
+		t.Fatalf("expected exactly 1 stateChange, got %+v", events)
+	}
+	if countWhere(events, event.isWarning) != 1 {
+		t.Fatalf("expected exactly 1 warning publish, got %+v", events)
+	}
+	if countWhere(events, event.isFinalWarning) != 1 {
+		t.Fatalf("expected exactly 1 final-warning publish, got %+v", events)
+	}
+
+	// Warning must precede final (same deadline, longer lead fires first).
+	var wIdx, fIdx int
+	for i, e := range events {
+		switch {
+		case e.isWarning():
+			wIdx = i
+		case e.isFinalWarning():
+			fIdx = i
+		}
+	}
+	if wIdx > fIdx {
+		t.Fatalf("warning must publish before final-warning, got order %+v", events)
+	}
+}
+
+func TestDismissSuppressesFinalWarning(t *testing.T) {
+	r := &fakeRecorder{}
+	w := NewWithLeads(80*time.Millisecond, 30*time.Millisecond, r)
+	defer w.Close()
+
+	d := time.Now().Add(100 * time.Millisecond)
+	_ = w.Update(d)
+
+	// Wait for the warning publish so we know we're inside the warning
+	// window, then dismiss before the final timer would fire.
+	deadline := time.Now().Add(500 * time.Millisecond)
+	for time.Now().Before(deadline) {
+		if countWhere(r.snapshot(), event.isWarning) >= 1 {
+			break
+		}
+		time.Sleep(2 * time.Millisecond)
+	}
+	if countWhere(r.snapshot(), event.isWarning) < 1 {
+		t.Fatalf("warning did not publish in time, events=%+v", r.snapshot())
+	}
+
+	w.Dismiss()
+
+	// Now wait past when the final would have fired.
+	time.Sleep(120 * time.Millisecond)
+
+	if n := countWhere(r.snapshot(), event.isFinalWarning); n != 0 {
+		t.Fatalf("final-warning published after Dismiss(), events=%+v", r.snapshot())
+	}
+}
+
+func TestDismissResetByNewDeadline(t *testing.T) {
+	r := &fakeRecorder{}
+	w := NewWithLeads(80*time.Millisecond, 30*time.Millisecond, r)
+	defer w.Close()
+
+	first := time.Now().Add(100 * time.Millisecond)
+	_ = w.Update(first)
+
+	// Dismiss against the first deadline.
+	w.Dismiss()
+
+	// Replace with a fresh deadline before the first's timers complete.
+	time.Sleep(10 * time.Millisecond)
+	second := time.Now().Add(100 * time.Millisecond)
+	_ = w.Update(second)
+
+	// The second cycle must publish a final-warning (the dismiss state
+	// did not carry over).
+	deadline := time.Now().Add(500 * time.Millisecond)
+	for time.Now().Before(deadline) {
+		if countWhere(r.snapshot(), event.isFinalWarning) >= 1 {
+			break
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+	if countWhere(r.snapshot(), event.isFinalWarning) < 1 {
+		t.Fatalf("final-warning did not publish on fresh deadline after Dismiss reset, events=%+v", r.snapshot())
+	}
+}
+
+func TestDismissBeforeUpdateIsNoop(t *testing.T) {
+	r := &fakeRecorder{}
+	w := NewWithLeads(80*time.Millisecond, 30*time.Millisecond, r)
+	defer w.Close()
+
+	// No deadline tracked yet; Dismiss must be a no-op (no panic, no state).
+	w.Dismiss()
+
+	d := time.Now().Add(100 * time.Millisecond)
+	_ = w.Update(d)
+
+	// Final warning should still publish — Dismiss only acts on the current
+	// deadline, and there was none at the time of the call.
+	deadline := time.Now().Add(500 * time.Millisecond)
+	for time.Now().Before(deadline) {
+		if countWhere(r.snapshot(), event.isFinalWarning) >= 1 {
+			return
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+	t.Fatalf("final-warning did not publish after no-op pre-Update Dismiss, events=%+v", r.snapshot())
+}
diff --git a/client/internal/connect.go b/client/internal/connect.go
index 93467b09a..c2fc2fd73 100644
--- a/client/internal/connect.go
+++ b/client/internal/connect.go
@@ -277,6 +277,15 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		log.Debugf("connecting to the Management service %s", c.config.ManagementURL.Host)
 		mgmClient, err := mgm.NewClient(engineCtx, c.config.ManagementURL.Host, myPrivateKey, mgmTlsEnabled)
 		if err != nil {
+			// On daemon shutdown / Down() the parent context is cancelled
+			// and the dial fails with "context canceled". Wrapping that
+			// into state would leave the snapshot stuck at Connecting+err
+			// until the backoff loop wakes up — instead let the operation
+			// return cleanly so the deferred state.Set(StatusIdle) takes
+			// effect on the next iteration.
+			if c.ctx.Err() != nil {
+				return nil
+			}
 			return wrapErr(gstatus.Errorf(codes.FailedPrecondition, "failed connecting to Management Service : %s", err))
 		}
 		mgmNotifier := statusRecorderToMgmConnStateNotifier(c.statusRecorder)
@@ -415,6 +424,10 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 			return wrapErr(err)
 		}
 
+		// Seed the session-expiry deadline from the LoginResponse. Subsequent
+		// changes flow in through SyncResponse and are applied in handleSync.
+		engine.ApplySessionDeadline(loginResp.GetSessionExpiresAt())
+
 		log.Infof("Netbird engine started, the IP is: %s", peerConfig.GetAddress())
 		state.Set(StatusConnected)
 
@@ -451,6 +464,10 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 	}
 
 	c.statusRecorder.ClientStart()
+	// Wrap the backoff with c.ctx so Down()/actCancel propagates into the
+	// inter-attempt sleep — otherwise a 15s MaxInterval can keep the retry
+	// loop alive long after the caller asked to give up, leaving the
+	// status stream stuck at Connecting.
 	err = backoff.Retry(operation, backoff.WithContext(backOff, c.ctx))
 	if err != nil {
 		log.Debugf("exiting client retry loop due to unrecoverable error: %s", err)
diff --git a/client/internal/debug/debug.go b/client/internal/debug/debug.go
index 5700b05de..3a7c0ebff 100644
--- a/client/internal/debug/debug.go
+++ b/client/internal/debug/debug.go
@@ -229,9 +229,16 @@ scutil_dns.txt (macOS only):
 
 const (
 	clientLogFile = "client.log"
+	uiLogFile     = "gui-client.log"
 	errorLogFile  = "netbird.err"
 	stdoutLogFile = "netbird.out"
 
+	// Rotated-log glob prefixes (base log name without extension) passed to
+	// addRotatedLogFiles. The daemon's own log and the GUI log live in the same
+	// dir, so the prefixes must be disjoint to keep their rotated siblings apart.
+	clientLogPrefix = "client"
+	uiLogPrefix     = "gui-client"
+
 	darwinErrorLogPath  = "/var/log/netbird.out.log"
 	darwinStdoutLogPath = "/var/log/netbird.err.log"
 )
@@ -249,6 +256,7 @@ type BundleGenerator struct {
 	statusRecorder *peer.Status
 	syncResponse   *mgmProto.SyncResponse
 	logPath        string
+	uiLogPath      string
 	tempDir        string
 	statePath      string
 	cpuProfile     []byte
@@ -276,6 +284,7 @@ type GeneratorDependencies struct {
 	StatusRecorder *peer.Status
 	SyncResponse   *mgmProto.SyncResponse
 	LogPath        string
+	UILogPath      string // Absolute path to the desktop UI's gui-client.log, reported via RegisterUILog. Empty if no UI registered one.
 	TempDir        string // Directory for temporary bundle zip files. If empty, os.TempDir() is used.
 	StatePath      string // Path to the state file. If empty, the ServiceManager default path is used.
 	CPUProfile     []byte
@@ -300,6 +309,7 @@ func NewBundleGenerator(deps GeneratorDependencies, cfg BundleConfig) *BundleGen
 		statusRecorder: deps.StatusRecorder,
 		syncResponse:   deps.SyncResponse,
 		logPath:        deps.LogPath,
+		uiLogPath:      deps.UILogPath,
 		tempDir:        deps.TempDir,
 		statePath:      deps.StatePath,
 		cpuProfile:     deps.CPUProfile,
@@ -411,6 +421,10 @@ func (g *BundleGenerator) createArchive() error {
 		log.Errorf("failed to add logs to debug bundle: %v", err)
 	}
 
+	if err := g.addUILog(); err != nil {
+		log.Errorf("failed to add UI log to debug bundle: %v", err)
+	}
+
 	if err := g.addUpdateLogs(); err != nil {
 		log.Errorf("failed to add updater logs: %v", err)
 	}
@@ -986,7 +1000,7 @@ func (g *BundleGenerator) addLogfile() error {
 		return fmt.Errorf("add client log file to zip: %w", err)
 	}
 
-	g.addRotatedLogFiles(logDir)
+	g.addRotatedLogFiles(logDir, clientLogPrefix)
 
 	stdErrLogPath := filepath.Join(logDir, errorLogFile)
 	stdoutLogPath := filepath.Join(logDir, stdoutLogFile)
@@ -1006,6 +1020,25 @@ func (g *BundleGenerator) addLogfile() error {
 	return nil
 }
 
+// addUILog adds the desktop UI's gui-client.log (and its rotated siblings) to
+// the bundle. The path is reported by the UI via RegisterUILog; empty when no
+// UI registered one (e.g. headless / server). Missing file is non-fatal — the
+// UI only writes it while the daemon is in debug, so it's often absent.
+func (g *BundleGenerator) addUILog() error {
+	if g.uiLogPath == "" {
+		log.Debugf("no UI log path registered, skipping in debug bundle")
+		return nil
+	}
+
+	if err := g.addSingleLogfile(g.uiLogPath, uiLogFile); err != nil {
+		return fmt.Errorf("add UI log file to zip: %w", err)
+	}
+
+	g.addRotatedLogFiles(filepath.Dir(g.uiLogPath), uiLogPrefix)
+
+	return nil
+}
+
 // addSingleLogfile adds a single log file to the archive
 func (g *BundleGenerator) addSingleLogfile(logPath, targetName string) error {
 	logFile, err := os.Open(logPath)
@@ -1078,14 +1111,16 @@ func (g *BundleGenerator) addSingleLogFileGz(logPath, targetName string) error {
 	return nil
 }
 
-// addRotatedLogFiles adds rotated log files to the bundle based on logFileCount
-func (g *BundleGenerator) addRotatedLogFiles(logDir string) {
+// addRotatedLogFiles adds rotated log files to the bundle based on logFileCount.
+// prefix is the base log name without extension (e.g. "client", "gui-client");
+// the glob matches both files rotated by us and by logrotate on linux.
+func (g *BundleGenerator) addRotatedLogFiles(logDir, prefix string) {
 	if g.logFileCount == 0 {
 		return
 	}
 
-	// This regex will match both logs rotated by us and logrotate on linux
-	pattern := filepath.Join(logDir, "client*.log.*")
+	// This pattern matches both logs rotated by us and logrotate on linux
+	pattern := filepath.Join(logDir, prefix+"*.log.*")
 	files, err := filepath.Glob(pattern)
 	if err != nil {
 		log.Warnf("failed to glob rotated logs: %v", err)
diff --git a/client/internal/debug/debug_logfiles_test.go b/client/internal/debug/debug_logfiles_test.go
index f6473f979..3749b3e9b 100644
--- a/client/internal/debug/debug_logfiles_test.go
+++ b/client/internal/debug/debug_logfiles_test.go
@@ -40,6 +40,25 @@ func TestAddRotatedLogFiles_PicksUpAllVariants(t *testing.T) {
 	require.NotContains(t, names, "other.log", "unrelated files should not be in bundle")
 }
 
+// TestAddRotatedLogFiles_GUIPrefix asserts the prefix parameter scopes the glob
+// to the GUI log: gui-client.log.* rotated siblings are picked up and the
+// daemon's own client.log.* are not (and vice versa, covered above). This is
+// the load-bearing check for the gui-client.log bundle collection — the old
+// "client*.log.*" glob would have missed gui-client rotations.
+func TestAddRotatedLogFiles_GUIPrefix(t *testing.T) {
+	dir := t.TempDir()
+
+	writeFile(t, filepath.Join(dir, "gui-client.log.1"), "gui rotated\n")
+	writeGzFile(t, filepath.Join(dir, "gui-client.log.2.gz"), "gui rotated gz\n")
+	writeFile(t, filepath.Join(dir, "client.log.1"), "daemon rotated\n")
+
+	names := runAddRotatedLogFilesPrefix(t, dir, "gui-client", 10)
+
+	require.Contains(t, names, "gui-client.log.1", "gui-client rotated file should be in bundle")
+	require.Contains(t, names, "gui-client.log.2.gz", "gui-client gz rotated file should be in bundle")
+	require.NotContains(t, names, "client.log.1", "daemon rotated file must not match the gui-client prefix")
+}
+
 // TestAddRotatedLogFiles_RespectsLogFileCount asserts that only the newest
 // logFileCount rotated files are bundled, ordered by mtime.
 func TestAddRotatedLogFiles_RespectsLogFileCount(t *testing.T) {
@@ -67,6 +86,10 @@ func TestAddRotatedLogFiles_RespectsLogFileCount(t *testing.T) {
 // runAddRotatedLogFiles calls addRotatedLogFiles against a fresh in-memory
 // zip writer and returns the set of entry names that ended up in the archive.
 func runAddRotatedLogFiles(t *testing.T, dir string, logFileCount uint32) map[string]struct{} {
+	return runAddRotatedLogFilesPrefix(t, dir, "client", logFileCount)
+}
+
+func runAddRotatedLogFilesPrefix(t *testing.T, dir, prefix string, logFileCount uint32) map[string]struct{} {
 	t.Helper()
 
 	var buf bytes.Buffer
@@ -74,7 +97,7 @@ func runAddRotatedLogFiles(t *testing.T, dir string, logFileCount uint32) map[st
 		archive:      zip.NewWriter(&buf),
 		logFileCount: logFileCount,
 	}
-	g.addRotatedLogFiles(dir)
+	g.addRotatedLogFiles(dir, prefix)
 	require.NoError(t, g.archive.Close())
 
 	zr, err := zip.NewReader(bytes.NewReader(buf.Bytes()), int64(buf.Len()))
diff --git a/client/internal/engine.go b/client/internal/engine.go
index a08bea31b..4367f68b0 100644
--- a/client/internal/engine.go
+++ b/client/internal/engine.go
@@ -274,6 +274,20 @@ type Engine struct {
 	jobExecutorWG sync.WaitGroup
 
 	exposeManager *expose.Manager
+
+	sessionWatcher sessionDeadlineWatcher
+}
+
+// sessionDeadlineWatcher is the engine-facing surface of the SSO session
+// expiry watcher. The concrete implementation (sessionwatch.Watcher) is wired
+// in via newSessionWatcher, which is build-tagged so the js/wasm build links a
+// no-op stub instead of pulling the full sessionwatch package (and its timer
+// machinery) into the binary — the wasm client never runs the engine's
+// session-warning flow.
+type sessionDeadlineWatcher interface {
+	Update(deadline time.Time) error
+	Dismiss()
+	Close()
 }
 
 // Peer is an instance of the Connection Peer
@@ -325,6 +339,17 @@ func NewEngine(
 		updateManager:      services.UpdateManager,
 		syncStoreDir:       config.StateDir,
 	}
+	// sessionWatcher keeps the SubscribeStatus consumers in sync with the
+	// session expiry deadline. Deadline-change ticks come for free via
+	// Status.SetSessionExpiresAt; the watcher exists to push a wake-up at
+	// T-WarningLead and T-FinalWarningLead so the UI repaints the remaining
+	// time / warning state even when nothing else changed, and to publish
+	// two SystemEvents (the warning composition lives in sessionwatch so
+	// the wire format stays owned by one package):
+	//   - T-WarningLead   → interactive "Extend now / Dismiss" notification
+	//   - T-FinalWarningLead → auto-opened SessionAboutToExpire dialog,
+	//     suppressed when the user dismissed the earlier warning
+	engine.sessionWatcher = newSessionWatcher(engine.statusRecorder)
 
 	log.Infof("I am: %s", config.WgPrivateKey.PublicKey().String())
 	return engine
@@ -391,6 +416,10 @@ func (e *Engine) stopLocked() {
 		e.srWatcher.Close()
 	}
 
+	if e.sessionWatcher != nil {
+		e.sessionWatcher.Close()
+	}
+
 	if e.updateManager != nil {
 		e.updateManager.SetDownloadOnly()
 	}
@@ -932,6 +961,8 @@ func (e *Engine) handleSync(update *mgmProto.SyncResponse) error {
 		return e.ctx.Err()
 	}
 
+	e.ApplySessionDeadline(update.GetSessionExpiresAt())
+
 	if update.NetworkMap != nil && update.NetworkMap.PeerConfig != nil {
 		e.handleAutoUpdateVersion(update.NetworkMap.PeerConfig.AutoUpdate)
 	}
@@ -1267,7 +1298,7 @@ func (e *Engine) handleBundle(params *mgmProto.BundleParameters) (*mgmProto.JobR
 		ClientMetrics:  e.clientMetrics,
 		DaemonVersion:  version.NetbirdVersion(),
 		RefreshStatus: func() {
-			e.RunHealthProbes(true)
+			e.RunHealthProbes(e.ctx, true)
 		},
 	}
 
@@ -2193,7 +2224,20 @@ func (e *Engine) getRosenpassAddr() string {
 
 // RunHealthProbes executes health checks for Signal, Management, Relay, and WireGuard services
 // and updates the status recorder with the latest states.
-func (e *Engine) RunHealthProbes(waitForResult bool) bool {
+//
+// ctx scopes the (potentially slow) STUN/TURN probing: a caller that gives up —
+// e.g. a Status RPC whose client disconnected — cancels its ctx and the probe
+// returns instead of running to its per-component timeout. The engine's own
+// lifetime ctx still applies independently, so an engine shutdown aborts the
+// probe even if the caller's ctx is context.Background().
+func (e *Engine) RunHealthProbes(ctx context.Context, waitForResult bool) bool {
+	// Tie the caller's ctx to the engine lifetime: either cancelling aborts
+	// the probe below.
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+	stop := context.AfterFunc(e.ctx, cancel)
+	defer stop()
+
 	e.syncMsgMux.Lock()
 
 	signalHealthy := e.signal.IsHealthy()
@@ -2216,9 +2260,9 @@ func (e *Engine) RunHealthProbes(waitForResult bool) bool {
 	if runtime.GOOS != "js" {
 		var results []relay.ProbeResult
 		if waitForResult {
-			results = e.probeStunTurn.ProbeAllWaitResult(e.ctx, stuns, turns)
+			results = e.probeStunTurn.ProbeAllWaitResult(ctx, stuns, turns)
 		} else {
-			results = e.probeStunTurn.ProbeAll(e.ctx, stuns, turns)
+			results = e.probeStunTurn.ProbeAll(ctx, stuns, turns)
 		}
 		e.statusRecorder.UpdateRelayStates(results)
 
diff --git a/client/internal/engine_authsession.go b/client/internal/engine_authsession.go
new file mode 100644
index 000000000..725c0903f
--- /dev/null
+++ b/client/internal/engine_authsession.go
@@ -0,0 +1,108 @@
+package internal
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/netbirdio/netbird/client/internal/auth/sessionwatch"
+	cProto "github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/client/system"
+)
+
+// ApplySessionDeadline propagates the absolute SSO session deadline carried on
+// LoginResponse / SyncResponse to both the watcher (for the edge-triggered
+// warning) and the status recorder (for the SubscribeStatus / Status RPC
+// snapshot the UI consumes).
+//
+// The wire field is 3-state:
+//   - nil                        → snapshot carries no info; keep the
+//     previously-anchored deadline (no-op)
+//   - explicit zero (s=0, n=0)   → peer is not SSO-registered or expiry is
+//     disabled; clear both sinks
+//   - valid timestamp            → new deadline; arm watcher, expose on
+//     status recorder
+//
+// Deadline sanity-checks live in sessionwatch.Watcher.Update. Any rejected
+// value is treated as a clear on both sinks: the alternative — leaving the
+// previously-known deadline in place — risks the UI confidently displaying
+// a stale "expires in X" while the server has actually invalidated it.
+func (e *Engine) ApplySessionDeadline(ts *timestamppb.Timestamp) {
+	if ts == nil {
+		return
+	}
+	var deadline time.Time
+	// Explicit zero (seconds=0 AND nanos=0) is the sentinel for "disabled".
+	// Everything else flows through Watcher.Update, whose sanity-checks
+	// reject out-of-range / pre-epoch / far-future / too-stale values and
+	// clear on rejection.
+	if ts.GetSeconds() != 0 || ts.GetNanos() != 0 {
+		deadline = ts.AsTime().UTC()
+	}
+	if e.sessionWatcher == nil {
+		return
+	}
+	// Watcher.Update owns the propagation to the status recorder (the
+	// SubscribeStatus / Status snapshot the UI reads): a set writes the
+	// deadline, a clear or a sanity-check rejection writes the zero value.
+	// Keeping a single writer is what stops the recorder from drifting out
+	// of sync with the warning timers.
+	if err := e.sessionWatcher.Update(deadline); err != nil {
+		log.Errorf("auth session deadline rejected: %v, clearing", err)
+		e.statusRecorder.PublishEvent(
+			cProto.SystemEvent_ERROR,
+			cProto.SystemEvent_AUTHENTICATION,
+			"session deadline rejected",
+			"",
+			map[string]string{sessionwatch.MetaSessionDeadlineRejected: err.Error()},
+		)
+	}
+}
+
+// DismissSessionWarning records the user's "Dismiss" click on the
+// T-WarningLead interactive notification and suppresses the upcoming
+// T-FinalWarningLead fallback for the current deadline. No-op when the
+// watcher is not running or holds no deadline.
+func (e *Engine) DismissSessionWarning() {
+	if e.sessionWatcher == nil {
+		return
+	}
+	e.sessionWatcher.Dismiss()
+}
+
+// ExtendAuthSession asks the management server to refresh the SSO session
+// expiry deadline using the supplied JWT, then mirrors the new deadline into
+// the daemon's state. The tunnel is untouched; no resync, no reconnect.
+//
+// Returns the new absolute UTC deadline (or zero time when the server
+// reports the peer is not eligible for extension).
+func (e *Engine) ExtendAuthSession(ctx context.Context, jwtToken string) (time.Time, error) {
+	if jwtToken == "" {
+		return time.Time{}, errors.New("jwt token is required")
+	}
+	if e.mgmClient == nil {
+		return time.Time{}, errors.New("management client is not initialised")
+	}
+
+	info, err := system.GetInfoWithChecks(ctx, e.checks)
+	if err != nil {
+		log.Warnf("failed to collect system info for session extend: %v", err)
+		info = system.GetInfo(ctx)
+	}
+
+	resp, err := e.mgmClient.ExtendAuthSession(info, jwtToken)
+	if err != nil {
+		return time.Time{}, fmt.Errorf("extend auth session on management: %w", err)
+	}
+
+	e.ApplySessionDeadline(resp.GetSessionExpiresAt())
+
+	if resp.GetSessionExpiresAt().IsValid() {
+		return resp.GetSessionExpiresAt().AsTime().UTC(), nil
+	}
+	return time.Time{}, nil
+}
diff --git a/client/internal/engine_session_deadline_test.go b/client/internal/engine_session_deadline_test.go
new file mode 100644
index 000000000..6127e5bb0
--- /dev/null
+++ b/client/internal/engine_session_deadline_test.go
@@ -0,0 +1,78 @@
+package internal
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/netbirdio/netbird/client/internal/auth/sessionwatch"
+	"github.com/netbirdio/netbird/client/internal/peer"
+)
+
+// TestApplySessionDeadline_ThreeState pins down the 3-state semantics of the
+// wire field carried on LoginResponse / SyncResponse:
+//
+//   - nil pointer            → no info; previously-anchored deadline survives
+//   - explicit zero value    → "expiry disabled" sentinel; both sinks cleared
+//   - valid future timestamp → new deadline propagated to both sinks
+func TestApplySessionDeadline_ThreeState(t *testing.T) {
+	newEngine := func() *Engine {
+		recorder := peer.NewRecorder("")
+		return &Engine{
+			statusRecorder: recorder,
+			sessionWatcher: sessionwatch.New(recorder),
+		}
+	}
+
+	t.Run("valid timestamp sets deadline on both sinks", func(t *testing.T) {
+		e := newEngine()
+		deadline := time.Now().Add(time.Hour).UTC().Truncate(time.Second)
+
+		e.ApplySessionDeadline(timestamppb.New(deadline))
+
+		require.True(t, e.statusRecorder.GetSessionExpiresAt().Equal(deadline),
+			"status recorder should hold the new deadline")
+	})
+
+	t.Run("nil is a no-op and preserves previous deadline", func(t *testing.T) {
+		e := newEngine()
+		seeded := time.Now().Add(time.Hour).UTC().Truncate(time.Second)
+		e.ApplySessionDeadline(timestamppb.New(seeded))
+		require.True(t, e.statusRecorder.GetSessionExpiresAt().Equal(seeded))
+
+		e.ApplySessionDeadline(nil)
+
+		require.True(t, e.statusRecorder.GetSessionExpiresAt().Equal(seeded),
+			"nil snapshot must not disturb the existing deadline")
+	})
+
+	t.Run("explicit zero clears a previously-anchored deadline", func(t *testing.T) {
+		e := newEngine()
+		seeded := time.Now().Add(time.Hour).UTC().Truncate(time.Second)
+		e.ApplySessionDeadline(timestamppb.New(seeded))
+		require.True(t, e.statusRecorder.GetSessionExpiresAt().Equal(seeded))
+
+		// Explicit zero Timestamp{} (seconds=0, nanos=0) is the
+		// "expiry disabled / not SSO" sentinel.
+		e.ApplySessionDeadline(&timestamppb.Timestamp{})
+
+		require.True(t, e.statusRecorder.GetSessionExpiresAt().IsZero(),
+			"explicit zero sentinel must clear the deadline")
+	})
+
+	t.Run("invalid timestamp clears the deadline", func(t *testing.T) {
+		e := newEngine()
+		seeded := time.Now().Add(time.Hour).UTC().Truncate(time.Second)
+		e.ApplySessionDeadline(timestamppb.New(seeded))
+		require.True(t, e.statusRecorder.GetSessionExpiresAt().Equal(seeded))
+
+		// Out-of-range nanos → IsValid()==false; same-meaning as the
+		// disabled sentinel for downstream sinks.
+		e.ApplySessionDeadline(&timestamppb.Timestamp{Seconds: 1, Nanos: -1})
+
+		require.True(t, e.statusRecorder.GetSessionExpiresAt().IsZero(),
+			"invalid timestamp must clear the deadline")
+	})
+}
diff --git a/client/internal/engine_sessionwatch.go b/client/internal/engine_sessionwatch.go
new file mode 100644
index 000000000..a46d73f87
--- /dev/null
+++ b/client/internal/engine_sessionwatch.go
@@ -0,0 +1,16 @@
+//go:build !js
+
+package internal
+
+import (
+	"github.com/netbirdio/netbird/client/internal/auth/sessionwatch"
+	"github.com/netbirdio/netbird/client/internal/peer"
+)
+
+// newSessionWatcher returns the real SSO session expiry watcher for every
+// non-wasm build. The js/wasm build gets a no-op stub from
+// engine_sessionwatch_js.go so the sessionwatch package (and its timer
+// machinery) never links into the wasm binary.
+func newSessionWatcher(recorder *peer.Status) sessionDeadlineWatcher {
+	return sessionwatch.New(recorder)
+}
diff --git a/client/internal/engine_sessionwatch_js.go b/client/internal/engine_sessionwatch_js.go
new file mode 100644
index 000000000..50e148ab9
--- /dev/null
+++ b/client/internal/engine_sessionwatch_js.go
@@ -0,0 +1,44 @@
+//go:build js
+
+package internal
+
+import (
+	"time"
+
+	"github.com/netbirdio/netbird/client/internal/peer"
+)
+
+// noopSessionWatcher is the js/wasm stand-in for sessionwatch.Watcher. The
+// wasm client never runs the engine's session-warning flow (the interactive
+// T-WarningLead notification and the T-FinalWarningLead fallback dialog live
+// in the desktop UI), so linking the full sessionwatch package (timers, event
+// composition) would only bloat the binary.
+//
+// It still mirrors the deadline into the status recorder so the SubscribeStatus
+// / Status snapshot the UI consumes stays correct — only the timer-driven
+// warnings are dropped.
+type noopSessionWatcher struct {
+	recorder *peer.Status
+}
+
+func newSessionWatcher(recorder *peer.Status) sessionDeadlineWatcher {
+	return noopSessionWatcher{recorder: recorder}
+}
+
+// Update mirrors the real watcher's recorder propagation without the timers or
+// sanity-check sentinels: a valid deadline is exposed on the status snapshot,
+// the zero time clears it.
+func (w noopSessionWatcher) Update(deadline time.Time) error {
+	if w.recorder != nil {
+		w.recorder.SetSessionExpiresAt(deadline)
+	}
+	return nil
+}
+
+func (noopSessionWatcher) Dismiss() {
+	// No-op: only suppresses the timer-driven final-warning, which this stub never arms.
+}
+
+func (noopSessionWatcher) Close() {
+	// No-op: no timers to stop and no state to unwind; the recorder is cleared via Update(zero).
+}
diff --git a/client/internal/peer/status.go b/client/internal/peer/status.go
index e48ac333c..a987482fe 100644
--- a/client/internal/peer/status.go
+++ b/client/internal/peer/status.go
@@ -7,6 +7,7 @@ import (
 	"net/netip"
 	"slices"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/google/uuid"
@@ -191,23 +192,30 @@ func (s *StatusChangeSubscription) Events() chan map[string]RouterState {
 // every private-service request) don't contend against each other.
 // Pure read methods take RLock; anything that mutates state takes Lock.
 type Status struct {
-	mux                   sync.RWMutex
-	muxRelays             sync.RWMutex
-	peers                 map[string]State
-	ipToKey               map[string]string
-	changeNotify          map[string]map[string]*StatusChangeSubscription // map[peerID]map[subscriptionID]*StatusChangeSubscription
-	signalState           bool
-	signalError           error
-	managementState       bool
-	managementError       error
-	relayStates           []relay.ProbeResult
-	localPeer             LocalPeerState
-	offlinePeers          []State
-	mgmAddress            string
-	signalAddress         string
-	notifier              *notifier
-	rosenpassEnabled      bool
-	rosenpassPermissive   bool
+	mux                 sync.RWMutex
+	muxRelays           sync.RWMutex
+	peers               map[string]State
+	ipToKey             map[string]string
+	changeNotify        map[string]map[string]*StatusChangeSubscription // map[peerID]map[subscriptionID]*StatusChangeSubscription
+	signalState         bool
+	signalError         error
+	managementState     bool
+	managementError     error
+	relayStates         []relay.ProbeResult
+	localPeer           LocalPeerState
+	offlinePeers        []State
+	mgmAddress          string
+	signalAddress       string
+	notifier            *notifier
+	rosenpassEnabled    bool
+	rosenpassPermissive bool
+	// sessionExpiresAt is the absolute UTC instant at which the peer's SSO
+	// session expires. Zero when the peer is not SSO-tracked or login
+	// expiration is disabled. Populated from management LoginResponse /
+	// SyncResponse and exposed via the daemon's Status / SubscribeStatus RPC
+	// so the UI can show remaining time without itself talking to mgm.
+	sessionExpiresAt time.Time
+
 	nsGroupStates         []NSGroupState
 	resolvedDomainsStates map[domain.Domain]ResolvedDomainInfo
 	lazyConnectionEnabled bool
@@ -223,6 +231,21 @@ type Status struct {
 	eventStreams map[string]chan *proto.SystemEvent
 	eventQueue   *EventQueue
 
+	// stateChangeStreams fan-out connection-state changes (connected /
+	// disconnected / connecting / address change / peers list change) to
+	// every active SubscribeStatus gRPC stream. Each subscriber gets a
+	// buffered chan; the notifier non-blockingly pings them so a slow
+	// consumer can never stall the daemon.
+	stateChangeMux     sync.Mutex
+	stateChangeStreams map[string]chan struct{}
+
+	// networksRevision bumps whenever the routed-networks set or their
+	// selected state changes (driven by the route manager). Surfaced in the
+	// status snapshot so the UI can fingerprint on it and re-fetch
+	// ListNetworks only on a real change. Atomic so the snapshot builder can
+	// read it without taking mux.
+	networksRevision atomic.Uint64
+
 	ingressGwMgr *ingressgw.Manager
 
 	routeIDLookup routeIDLookup
@@ -237,6 +260,7 @@ func NewRecorder(mgmAddress string) *Status {
 		changeNotify:          make(map[string]map[string]*StatusChangeSubscription),
 		eventStreams:          make(map[string]chan *proto.SystemEvent),
 		eventQueue:            NewEventQueue(eventQueueSize),
+		stateChangeStreams:    make(map[string]chan struct{}),
 		offlinePeers:          make([]State, 0),
 		notifier:              newNotifier(),
 		mgmAddress:            mgmAddress,
@@ -401,6 +425,7 @@ func (d *Status) UpdatePeerState(receivedState State) error {
 	if notifyRouter {
 		d.dispatchRouterPeers(receivedState.PubKey, routerSnapshot)
 	}
+	d.notifyStateChange()
 	return nil
 }
 
@@ -426,6 +451,7 @@ func (d *Status) AddPeerStateRoute(peer string, route string, resourceId route.R
 
 	// todo: consider to make sense of this notification or not
 	d.notifier.peerListChanged(numPeers)
+	d.notifyStateChange()
 	return nil
 }
 
@@ -451,6 +477,7 @@ func (d *Status) RemovePeerStateRoute(peer string, route string) error {
 
 	// todo: consider to make sense of this notification or not
 	d.notifier.peerListChanged(numPeers)
+	d.notifyStateChange()
 	return nil
 }
 
@@ -500,6 +527,7 @@ func (d *Status) UpdatePeerICEState(receivedState State) error {
 	if notifyRouter {
 		d.dispatchRouterPeers(receivedState.PubKey, routerSnapshot)
 	}
+	d.notifyStateChange()
 	return nil
 }
 
@@ -536,6 +564,7 @@ func (d *Status) UpdatePeerRelayedState(receivedState State) error {
 	if notifyRouter {
 		d.dispatchRouterPeers(receivedState.PubKey, routerSnapshot)
 	}
+	d.notifyStateChange()
 	return nil
 }
 
@@ -571,6 +600,7 @@ func (d *Status) UpdatePeerRelayedStateToDisconnected(receivedState State) error
 	if notifyRouter {
 		d.dispatchRouterPeers(receivedState.PubKey, routerSnapshot)
 	}
+	d.notifyStateChange()
 	return nil
 }
 
@@ -609,6 +639,7 @@ func (d *Status) UpdatePeerICEStateToDisconnected(receivedState State) error {
 	if notifyRouter {
 		d.dispatchRouterPeers(receivedState.PubKey, routerSnapshot)
 	}
+	d.notifyStateChange()
 	return nil
 }
 
@@ -702,6 +733,7 @@ func (d *Status) FinishPeerListModifications() {
 	for _, rd := range dispatches {
 		d.dispatchRouterPeers(rd.peerID, rd.snapshot)
 	}
+	d.notifyStateChange()
 }
 
 func (d *Status) SubscribeToPeerStateChanges(ctx context.Context, peerID string) *StatusChangeSubscription {
@@ -760,6 +792,41 @@ func (d *Status) UpdateLocalPeerState(localPeerState LocalPeerState) {
 	d.mux.Unlock()
 
 	d.notifier.localAddressChanged(fqdn, ip)
+	d.notifyStateChange()
+}
+
+// SetSessionExpiresAt records the absolute UTC instant at which the peer's
+// SSO session is set to expire. Pass the zero value to clear (e.g. when the
+// management server stops publishing a deadline because login expiration was
+// disabled or the peer is not SSO-tracked). Same-value updates are no-ops;
+// real changes fan out via notifyStateChange so SubscribeStatus consumers
+// pick up the new deadline on their next read.
+func (d *Status) SetSessionExpiresAt(deadline time.Time) {
+	d.mux.Lock()
+	if d.sessionExpiresAt.Equal(deadline) {
+		d.mux.Unlock()
+		return
+	}
+	d.sessionExpiresAt = deadline
+	d.mux.Unlock()
+	d.notifyStateChange()
+}
+
+// GetSessionExpiresAt returns the most recently recorded SSO session deadline,
+// or the zero value when no deadline is tracked. A deadline that has already
+// slipped into the past reports as "none": once the session has expired it is
+// no longer a meaningful countdown, and the sessionwatch.Watcher does not
+// arm a timer at the deadline itself to clear it (only the two pre-expiry
+// warnings). Without this guard the UI would keep painting a stale
+// "expires in …" against a moment that has passed until the next login,
+// extend, or teardown rewrote the value.
+func (d *Status) GetSessionExpiresAt() time.Time {
+	d.mux.Lock()
+	defer d.mux.Unlock()
+	if !d.sessionExpiresAt.IsZero() && d.sessionExpiresAt.Before(time.Now()) {
+		return time.Time{}
+	}
+	return d.sessionExpiresAt
 }
 
 // AddLocalPeerStateRoute adds a route to the local peer state
@@ -828,11 +895,19 @@ func (d *Status) CleanLocalPeerState() {
 	d.mux.Unlock()
 
 	d.notifier.localAddressChanged(fqdn, ip)
+	d.notifyStateChange()
 }
 
 // MarkManagementDisconnected sets ManagementState to disconnected
 func (d *Status) MarkManagementDisconnected(err error) {
 	d.mux.Lock()
+	// Health checks re-mark the same state on every probe; skip the fan-out
+	// when nothing actually changed so we don't flood SubscribeStatus
+	// consumers with identical snapshots.
+	if !d.managementState && errors.Is(d.managementError, err) {
+		d.mux.Unlock()
+		return
+	}
 	d.managementState = false
 	d.managementError = err
 	mgm := d.managementState
@@ -840,11 +915,16 @@ func (d *Status) MarkManagementDisconnected(err error) {
 	d.mux.Unlock()
 
 	d.notifier.updateServerStates(mgm, sig)
+	d.notifyStateChange()
 }
 
 // MarkManagementConnected sets ManagementState to connected
 func (d *Status) MarkManagementConnected() {
 	d.mux.Lock()
+	if d.managementState && d.managementError == nil {
+		d.mux.Unlock()
+		return
+	}
 	d.managementState = true
 	d.managementError = nil
 	mgm := d.managementState
@@ -852,6 +932,7 @@ func (d *Status) MarkManagementConnected() {
 	d.mux.Unlock()
 
 	d.notifier.updateServerStates(mgm, sig)
+	d.notifyStateChange()
 }
 
 // UpdateSignalAddress update the address of the signal server
@@ -885,6 +966,10 @@ func (d *Status) UpdateLazyConnection(enabled bool) {
 // MarkSignalDisconnected sets SignalState to disconnected
 func (d *Status) MarkSignalDisconnected(err error) {
 	d.mux.Lock()
+	if !d.signalState && errors.Is(d.signalError, err) {
+		d.mux.Unlock()
+		return
+	}
 	d.signalState = false
 	d.signalError = err
 	mgm := d.managementState
@@ -892,11 +977,16 @@ func (d *Status) MarkSignalDisconnected(err error) {
 	d.mux.Unlock()
 
 	d.notifier.updateServerStates(mgm, sig)
+	d.notifyStateChange()
 }
 
 // MarkSignalConnected sets SignalState to connected
 func (d *Status) MarkSignalConnected() {
 	d.mux.Lock()
+	if d.signalState && d.signalError == nil {
+		d.mux.Unlock()
+		return
+	}
 	d.signalState = true
 	d.signalError = nil
 	mgm := d.managementState
@@ -904,6 +994,7 @@ func (d *Status) MarkSignalConnected() {
 	d.mux.Unlock()
 
 	d.notifier.updateServerStates(mgm, sig)
+	d.notifyStateChange()
 }
 
 func (d *Status) UpdateRelayStates(relayResults []relay.ProbeResult) {
@@ -1110,16 +1201,19 @@ func (d *Status) GetFullStatus() FullStatus {
 // ClientStart will notify all listeners about the new service state
 func (d *Status) ClientStart() {
 	d.notifier.clientStart()
+	d.notifyStateChange()
 }
 
 // ClientStop will notify all listeners about the new service state
 func (d *Status) ClientStop() {
 	d.notifier.clientStop()
+	d.notifyStateChange()
 }
 
 // ClientTeardown will notify all listeners about the service is under teardown
 func (d *Status) ClientTeardown() {
 	d.notifier.clientTearDown()
+	d.notifyStateChange()
 }
 
 // SetConnectionListener set a listener to the notifier
@@ -1261,6 +1355,79 @@ func (d *Status) GetEventHistory() []*proto.SystemEvent {
 	return d.eventQueue.GetAll()
 }
 
+// SubscribeToStateChanges hands back a channel that receives a tick on
+// every connection-state change (connected / disconnected / connecting /
+// address change / peers-list change). The channel is buffered to one
+// pending tick so a coalesced burst still wakes the consumer exactly
+// once. Pass the returned id to UnsubscribeFromStateChanges to detach.
+func (d *Status) SubscribeToStateChanges() (string, <-chan struct{}) {
+	d.stateChangeMux.Lock()
+	defer d.stateChangeMux.Unlock()
+
+	id := uuid.New().String()
+	ch := make(chan struct{}, 1)
+	d.stateChangeStreams[id] = ch
+	return id, ch
+}
+
+// UnsubscribeFromStateChanges releases a SubscribeToStateChanges channel
+// and closes it so any consumer goroutine selecting on the channel
+// unblocks cleanly.
+func (d *Status) UnsubscribeFromStateChanges(id string) {
+	d.stateChangeMux.Lock()
+	defer d.stateChangeMux.Unlock()
+
+	if ch, ok := d.stateChangeStreams[id]; ok {
+		close(ch)
+		delete(d.stateChangeStreams, id)
+	}
+}
+
+// notifyStateChange wakes every SubscribeToStateChanges subscriber. Drops
+// the tick if a subscriber's buffer is full — by definition the consumer
+// is already going to fetch the latest snapshot, so multiple pending ticks
+// would be redundant.
+func (d *Status) notifyStateChange() {
+	d.stateChangeMux.Lock()
+	defer d.stateChangeMux.Unlock()
+
+	for _, ch := range d.stateChangeStreams {
+		select {
+		case ch <- struct{}{}:
+		default:
+		}
+	}
+}
+
+// NotifyStateChange is the public wake-the-subscribers entry point used by
+// callers that mutate state outside the peer recorder — most importantly
+// the connect-state machine, which writes StatusNeedsLogin into the
+// shared contextState (client/internal/state.go) without touching any
+// recorder field. Without this push the SubscribeStatus stream stays on
+// the previous snapshot until an unrelated peer/management/signal
+// change happens to fire notifyStateChange, leaving the UI's status
+// out of sync with the daemon.
+func (d *Status) NotifyStateChange() {
+	d.notifyStateChange()
+}
+
+// BumpNetworksRevision increments the routed-networks revision and wakes every
+// SubscribeStatus subscriber. The route manager calls it when a network map
+// changes the available routes or when a selection is applied — the peer
+// status itself only records actively-routed (chosen) networks, so without
+// this bump a candidate route appearing/disappearing would never reach the UI.
+func (d *Status) BumpNetworksRevision() {
+	d.networksRevision.Add(1)
+	d.notifyStateChange()
+}
+
+// GetNetworksRevision returns the current routed-networks revision, surfaced in
+// the status snapshot so the UI can detect route/selection changes (see
+// BumpNetworksRevision).
+func (d *Status) GetNetworksRevision() uint64 {
+	return d.networksRevision.Load()
+}
+
 func (d *Status) SetWgIface(wgInterface WGIfaceStatus) {
 	d.mux.Lock()
 	defer d.mux.Unlock()
diff --git a/client/internal/peer/status_test.go b/client/internal/peer/status_test.go
index 17ed47cd3..29404d413 100644
--- a/client/internal/peer/status_test.go
+++ b/client/internal/peer/status_test.go
@@ -314,3 +314,39 @@ func TestGetFullStatus(t *testing.T) {
 	assert.Equal(t, signalState, fullStatus.SignalState, "signal status should be equal")
 	assert.ElementsMatch(t, []State{peerState1, peerState2}, fullStatus.Peers, "peers states should match")
 }
+
+// notified reports whether a state-change tick is pending on ch, draining it.
+func notified(ch <-chan struct{}) bool {
+	select {
+	case <-ch:
+		return true
+	default:
+		return false
+	}
+}
+
+func TestMarkServerStateDoesNotNotifyWhenUnchanged(t *testing.T) {
+	status := NewRecorder("https://mgm")
+	_, ch := status.SubscribeToStateChanges()
+
+	// First transition is a real change and must notify.
+	status.MarkManagementConnected()
+	require.True(t, notified(ch), "first connect should notify")
+
+	// Re-marking the same state must not notify again.
+	status.MarkManagementConnected()
+	assert.False(t, notified(ch), "redundant connect should not notify")
+
+	// Same for signal.
+	status.MarkSignalConnected()
+	require.True(t, notified(ch), "first signal connect should notify")
+	status.MarkSignalConnected()
+	assert.False(t, notified(ch), "redundant signal connect should not notify")
+
+	// A genuine change (disconnect with an error) notifies again.
+	err := errors.New("boom")
+	status.MarkManagementDisconnected(err)
+	require.True(t, notified(ch), "disconnect should notify")
+	status.MarkManagementDisconnected(err)
+	assert.False(t, notified(ch), "redundant disconnect should not notify")
+}
diff --git a/client/internal/profilemanager/state.go b/client/internal/profilemanager/state.go
index 1bf3318af..9e9577796 100644
--- a/client/internal/profilemanager/state.go
+++ b/client/internal/profilemanager/state.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"os"
 	"path/filepath"
 
 	"github.com/netbirdio/netbird/util"
@@ -71,3 +72,22 @@ func (pm *ProfileManager) SetActiveProfileState(state *ProfileState) error {
 
 	return nil
 }
+
+// RemoveProfileState deletes the per-profile state file (which holds the
+// account email used for the SSO login hint and the UI display). Called after
+// a successful logout so a logged-out profile no longer shows a stale account
+// email. The state file only stores the email, so deleting it is equivalent to
+// clearing it; the next SSO login recreates it. A missing file is not an error.
+func (pm *ProfileManager) RemoveProfileState(profileName string) error {
+	configDir, err := getConfigDir()
+	if err != nil {
+		return fmt.Errorf("get config directory: %w", err)
+	}
+
+	stateFile := filepath.Join(configDir, profileName+".state.json")
+	if err := os.Remove(stateFile); err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("remove profile state: %w", err)
+	}
+
+	return nil
+}
diff --git a/client/internal/routemanager/manager.go b/client/internal/routemanager/manager.go
index 32379e837..16f8d48fa 100644
--- a/client/internal/routemanager/manager.go
+++ b/client/internal/routemanager/manager.go
@@ -442,6 +442,11 @@ func (m *DefaultManager) UpdateRoutes(
 
 		m.updateClientNetworks(updateSerial, filteredClientRoutes)
 		m.notifier.OnNewRoutes(filteredClientRoutes)
+		// A new network map can add or drop route/exit-node candidates without
+		// touching any peer's chosen-route state, so the peer status alone
+		// wouldn't notify SubscribeStatus subscribers. Bump the revision so the
+		// UI re-fetches ListNetworks.
+		m.statusRecorder.BumpNetworksRevision()
 	}
 	m.clientRoutes = clientRoutes
 
@@ -582,6 +587,10 @@ func (m *DefaultManager) TriggerSelection(networks route.HAMap) {
 	if err := m.stateManager.UpdateState((*SelectorState)(m.routeSelector)); err != nil {
 		log.Errorf("failed to update state: %v", err)
 	}
+
+	// A selection change flips Network.selected without altering the candidate
+	// set, so bump the revision to push the new state to the UI.
+	m.statusRecorder.BumpNetworksRevision()
 }
 
 // stopObsoleteClients stops the client network watcher for the networks that are not in the new list
diff --git a/client/internal/routeselector/routeselector_test.go b/client/internal/routeselector/routeselector_test.go
index c9d6acb4d..2b1ba3fb9 100644
--- a/client/internal/routeselector/routeselector_test.go
+++ b/client/internal/routeselector/routeselector_test.go
@@ -859,3 +859,31 @@ func TestRouteSelector_ComplexScenarios(t *testing.T) {
 		})
 	}
 }
+
+// TestRouteSelector_EnableExitNodeKeepsOtherRoutes is a regression test for the
+// tray exit-node toggle disabling every non-exit routed network. The tray used
+// to Select an exit node with append=false, which the RouteSelector treats as
+// "drop the whole current selection" (default-on semantics) — so enabling an
+// exit node also turned off every LAN/route the user had on. The fix sends
+// append=true and lets the daemon's SelectNetworks handler deselect only the
+// sibling exit nodes. This test models that handler sequence against the
+// selector: SelectRoutes(exit, append=true) followed by DeselectRoutes(other
+// exit nodes) must leave non-exit routes untouched.
+func TestRouteSelector_EnableExitNodeKeepsOtherRoutes(t *testing.T) {
+	rs := routeselector.NewRouteSelector()
+	all := []route.NetID{"exitA", "exitB", "lan1", "lan2"}
+
+	// User has two LAN routes on (default-on: nothing deselected => all selected).
+	require.True(t, rs.IsSelected("lan1"))
+	require.True(t, rs.IsSelected("lan2"))
+
+	// Tray enables exitA: SelectNetworks handler does SelectRoutes(append=true)
+	// then deselects sibling exit nodes (exitB), never the LAN routes.
+	require.NoError(t, rs.SelectRoutes([]route.NetID{"exitA"}, true, all))
+	require.NoError(t, rs.DeselectRoutes([]route.NetID{"exitB"}, all))
+
+	assert.True(t, rs.IsSelected("exitA"), "selected exit node stays on")
+	assert.False(t, rs.IsSelected("exitB"), "sibling exit node is deselected")
+	assert.True(t, rs.IsSelected("lan1"), "non-exit route must stay selected")
+	assert.True(t, rs.IsSelected("lan2"), "non-exit route must stay selected")
+}
diff --git a/client/internal/state.go b/client/internal/state.go
index 041cb73f8..0adfa26e4 100644
--- a/client/internal/state.go
+++ b/client/internal/state.go
@@ -33,17 +33,34 @@ func CtxGetState(ctx context.Context) *contextState {
 }
 
 type contextState struct {
-	err    error
-	status StatusType
-	mutex  sync.Mutex
+	err      error
+	status   StatusType
+	mutex    sync.Mutex
+	onChange func()
+}
+
+// SetOnChange installs a callback fired after every successful Set. Used by
+// the daemon to wire the status recorder's notifyStateChange so any
+// state.Set in the connect/login paths pushes a fresh snapshot to
+// SubscribeStatus subscribers without each callsite having to opt in.
+// The callback runs outside the contextState mutex to avoid a lock-order
+// dependency with the recorder's stateChangeMux.
+func (c *contextState) SetOnChange(fn func()) {
+	c.mutex.Lock()
+	c.onChange = fn
+	c.mutex.Unlock()
 }
 
 func (c *contextState) Set(update StatusType) {
 	c.mutex.Lock()
-	defer c.mutex.Unlock()
-
 	c.status = update
 	c.err = nil
+	cb := c.onChange
+	c.mutex.Unlock()
+
+	if cb != nil {
+		cb()
+	}
 }
 
 func (c *contextState) Status() (StatusType, error) {
@@ -57,6 +74,17 @@ func (c *contextState) Status() (StatusType, error) {
 	return c.status, nil
 }
 
+// CurrentStatus returns the last status set via Set, ignoring any wrapped
+// error. Use when the status is needed for reporting purposes (e.g. the
+// status snapshot stream) and a transient wrapped error from a retry loop
+// shouldn't blank out the underlying status.
+func (c *contextState) CurrentStatus() StatusType {
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+
+	return c.status
+}
+
 func (c *contextState) Wrap(err error) error {
 	c.mutex.Lock()
 	defer c.mutex.Unlock()
diff --git a/client/mdm/canonical_loaders.go b/client/mdm/canonical_loaders.go
index b20a823fb..cb9af9ccb 100644
--- a/client/mdm/canonical_loaders.go
+++ b/client/mdm/canonical_loaders.go
@@ -15,6 +15,7 @@ var allKeys = []string{
 	KeyDisableUpdateSettings,
 	KeyDisableProfiles,
 	KeyDisableNetworks,
+	KeyDisableAdvancedView,
 	KeyDisableClientRoutes,
 	KeyDisableServerRoutes,
 	KeyBlockInbound,
diff --git a/client/mdm/policy.go b/client/mdm/policy.go
index 67b126101..b76c70a75 100644
--- a/client/mdm/policy.go
+++ b/client/mdm/policy.go
@@ -24,6 +24,13 @@ const (
 	KeyDisableUpdateSettings    = "disableUpdateSettings"
 	KeyDisableProfiles          = "disableProfiles"
 	KeyDisableNetworks          = "disableNetworks"
+	// KeyDisableAdvancedView gates the advanced-view section in the
+	// upcoming UI revision. UI-only: NOT stored on Config, not
+	// applied by applyMDMPolicy, not rejectable via SetConfig. The
+	// daemon surfaces it through GetFeatures (tristate: present
+	// true / present false / absent) and the same key appears in
+	// GetConfigResponse.mDMManagedFields when set.
+	KeyDisableAdvancedView      = "disableAdvancedView"
 	KeyDisableClientRoutes      = "disableClientRoutes"
 	KeyDisableServerRoutes      = "disableServerRoutes"
 	KeyBlockInbound             = "blockInbound"
diff --git a/client/netbird.wxs b/client/netbird.wxs
index 6f18b63b5..f30a7aa7e 100644
--- a/client/netbird.wxs
+++ b/client/netbird.wxs
@@ -13,9 +13,6 @@
 
 		<MajorUpgrade AllowSameVersionUpgrades='yes' DowngradeErrorMessage="A newer version of [ProductName] is already installed. Setup will now exit."/>
 
-		<!-- Autostart: enabled by default, disable with AUTOSTART=0 on the msiexec command line -->
-		<Property Id="AUTOSTART" Value="1" />
-
 		<StandardDirectory Id="ProgramFiles64Folder">
 			<Directory Id="NetbirdInstallDir" Name="Netbird">
 				<Component Id="NetbirdFiles" Guid="db3165de-cc6e-4922-8396-9d892950e23e" Bitness="always64">
@@ -32,9 +29,6 @@
 					</File>
 					<File ProcessorArchitecture="$(var.ProcessorArchitecture)" Source=".\dist\netbird_windows_$(var.ArchSuffix)\wintun.dll" />
 					<File Id="NetbirdToastIcon" Name="netbird.png" Source=".\client\ui\assets\netbird.png" />
-					<?if $(var.ArchSuffix) = "amd64" ?>
-					<File ProcessorArchitecture="$(var.ProcessorArchitecture)" Source=".\dist\netbird_windows_$(var.ArchSuffix)\opengl32.dll" />
-					<?endif ?>
 
 					<ServiceInstall
                                      Id="NetBirdService"
@@ -62,33 +56,60 @@
 			<Component Id="NetbirdAumidRegistry" Guid="*">
 				<RegistryKey Root="HKCU" Key="Software\Classes\AppUserModelId\NetBird" ForceDeleteOnUninstall="yes">
 					<RegistryValue Name="InstalledByMSI" Type="integer" Value="1" KeyPath="yes" />
+					<!-- Pre-seed the CLSID the Wails notifications service reads on
+					     first startup (notifications_windows.go:getGUID looks for
+					     the CustomActivator value under this key). Without this
+					     the service generates a fresh per-install UUID, which
+					     diverges from the ToastActivatorCLSID set on the Start
+					     Menu / Desktop shortcuts above and the COM activator
+					     never fires when a toast is clicked. -->
+					<RegistryValue Name="CustomActivator" Type="string" Value="{0E1B4DE7-E148-432B-9814-544F941826EC}" />
 				</RegistryKey>
 			</Component>
 		</StandardDirectory>
 
-		<StandardDirectory Id="CommonAppDataFolder">
-			<Directory Id="NetbirdAutoStartDir" Name="Netbird">
-				<Component Id="NetbirdAutoStart" Guid="b199eaca-b0dd-4032-af19-679cfad48eb3" Bitness="always64" Condition='AUTOSTART = "1"'>
-					<RegistryValue Root="HKLM" Key="Software\Microsoft\Windows\CurrentVersion\Run"
-						Name="Netbird" Value="&quot;[NetbirdInstallDir]netbird-ui.exe&quot;"
-						Type="string" KeyPath="yes" />
-				</Component>
-			</Directory>
-		</StandardDirectory>
-
 		<ComponentGroup Id="NetbirdFilesComponent">
 			<ComponentRef Id="NetbirdFiles" />
 			<ComponentRef Id="NetbirdAumidRegistry" />
-			<ComponentRef Id="NetbirdAutoStart" />
 		</ComponentGroup>
 
 		<util:CloseApplication Id="CloseNetBird" CloseMessage="no" Target="netbird.exe" RebootPrompt="no" />
 		<util:CloseApplication Id="CloseNetBirdUI" CloseMessage="no" Target="netbird-ui.exe" RebootPrompt="no" TerminateProcess="0" />
 
+		<!-- WebView2 evergreen runtime detection.
+		     Probe both the per-machine and per-user EdgeUpdate keys; if either
+		     reports a non-empty `pv` value the runtime is already installed
+		     and we skip the bootstrapper. -->
+		<Property Id="WEBVIEW2_VERSION_HKLM">
+			<RegistrySearch Id="WV2HKLM" Root="HKLM"
+				Key="SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}"
+				Name="pv" Type="raw" Bitness="always64" />
+		</Property>
+		<Property Id="WEBVIEW2_VERSION_HKCU">
+			<RegistrySearch Id="WV2HKCU" Root="HKCU"
+				Key="Software\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}"
+				Name="pv" Type="raw" />
+		</Property>
 
+		<!-- Embed the bootstrapper payload. Path is relative to the WiX
+		     working directory; sign-pipelines stages it next to client/
+		     via `wails3 generate webview2bootstrapper`. -->
+		<Binary Id="WebView2Bootstrapper" SourceFile=".\client\MicrosoftEdgeWebview2Setup.exe" />
+
+		<CustomAction Id="InstallWebView2"
+			BinaryRef="WebView2Bootstrapper"
+			ExeCommand="/silent /install"
+			Execute="deferred"
+			Impersonate="no"
+			Return="check" />
+
+		<InstallExecuteSequence>
+			<Custom Action="InstallWebView2" Before="InstallFinalize"
+				Condition="NOT WEBVIEW2_VERSION_HKLM AND NOT WEBVIEW2_VERSION_HKCU AND NOT REMOVE" />
+		</InstallExecuteSequence>
 
 		<!-- Icons -->
-		<Icon Id="NetbirdIcon" SourceFile=".\client\ui\assets\netbird.ico" />
+		<Icon Id="NetbirdIcon" SourceFile=".\client\ui\build\windows\icon.ico" />
 		<Property Id="ARPPRODUCTICON" Value="NetbirdIcon" />
 
 	</Package>
diff --git a/client/proto/daemon.pb.go b/client/proto/daemon.pb.go
index 488b0186c..6fbb09958 100644
--- a/client/proto/daemon.pb.go
+++ b/client/proto/daemon.pb.go
@@ -192,7 +192,7 @@ func (x SystemEvent_Severity) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use SystemEvent_Severity.Descriptor instead.
 func (SystemEvent_Severity) EnumDescriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{51, 0}
+	return file_daemon_proto_rawDescGZIP(), []int{53, 0}
 }
 
 type SystemEvent_Category int32
@@ -247,7 +247,7 @@ func (x SystemEvent_Category) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use SystemEvent_Category.Descriptor instead.
 func (SystemEvent_Category) EnumDescriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{51, 1}
+	return file_daemon_proto_rawDescGZIP(), []int{53, 1}
 }
 
 type EmptyRequest struct {
@@ -823,9 +823,15 @@ func (x *WaitSSOLoginResponse) GetEmail() string {
 }
 
 type UpRequest struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	ProfileName   *string                `protobuf:"bytes,1,opt,name=profileName,proto3,oneof" json:"profileName,omitempty"`
-	Username      *string                `protobuf:"bytes,2,opt,name=username,proto3,oneof" json:"username,omitempty"`
+	state       protoimpl.MessageState `protogen:"open.v1"`
+	ProfileName *string                `protobuf:"bytes,1,opt,name=profileName,proto3,oneof" json:"profileName,omitempty"`
+	Username    *string                `protobuf:"bytes,2,opt,name=username,proto3,oneof" json:"username,omitempty"`
+	// async instructs the daemon to start the connection attempt and return
+	// immediately without waiting for the engine to become ready. Status updates
+	// are delivered via the SubscribeStatus stream. When false (the default) the
+	// RPC blocks until the engine is running or gives up, which is the behaviour
+	// needed by the CLI.
+	Async         bool `protobuf:"varint,4,opt,name=async,proto3" json:"async,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -874,6 +880,13 @@ func (x *UpRequest) GetUsername() string {
 	return ""
 }
 
+func (x *UpRequest) GetAsync() bool {
+	if x != nil {
+		return x.Async
+	}
+	return false
+}
+
 type UpResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
@@ -978,8 +991,12 @@ type StatusResponse struct {
 	FullStatus *FullStatus `protobuf:"bytes,2,opt,name=fullStatus,proto3" json:"fullStatus,omitempty"`
 	// NetBird daemon version
 	DaemonVersion string `protobuf:"bytes,3,opt,name=daemonVersion,proto3" json:"daemonVersion,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
+	// Absolute UTC instant at which the peer's SSO session expires.
+	// Unset when the peer is not SSO-registered or login expiration is disabled.
+	// The UI derives "warning active" from this value and its own clock.
+	SessionExpiresAt *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=sessionExpiresAt,proto3" json:"sessionExpiresAt,omitempty"`
+	unknownFields    protoimpl.UnknownFields
+	sizeCache        protoimpl.SizeCache
 }
 
 func (x *StatusResponse) Reset() {
@@ -1033,6 +1050,13 @@ func (x *StatusResponse) GetDaemonVersion() string {
 	return ""
 }
 
+func (x *StatusResponse) GetSessionExpiresAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.SessionExpiresAt
+	}
+	return nil
+}
+
 type DownRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
@@ -2129,8 +2153,13 @@ type FullStatus struct {
 	Events                  []*SystemEvent         `protobuf:"bytes,7,rep,name=events,proto3" json:"events,omitempty"`
 	LazyConnectionEnabled   bool                   `protobuf:"varint,9,opt,name=lazyConnectionEnabled,proto3" json:"lazyConnectionEnabled,omitempty"`
 	SshServerState          *SSHServerState        `protobuf:"bytes,10,opt,name=sshServerState,proto3" json:"sshServerState,omitempty"`
-	unknownFields           protoimpl.UnknownFields
-	sizeCache               protoimpl.SizeCache
+	// networksRevision bumps whenever the set of routed networks (route and
+	// exit-node candidates) or their selected state changes. The UI fingerprints
+	// on it to know when to re-fetch ListNetworks via the push stream, instead
+	// of polling on every status snapshot.
+	NetworksRevision uint64 `protobuf:"varint,11,opt,name=networksRevision,proto3" json:"networksRevision,omitempty"`
+	unknownFields    protoimpl.UnknownFields
+	sizeCache        protoimpl.SizeCache
 }
 
 func (x *FullStatus) Reset() {
@@ -2233,6 +2262,13 @@ func (x *FullStatus) GetSshServerState() *SSHServerState {
 	return nil
 }
 
+func (x *FullStatus) GetNetworksRevision() uint64 {
+	if x != nil {
+		return x.NetworksRevision
+	}
+	return 0
+}
+
 // Networks
 type ListNetworksRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
@@ -3030,6 +3066,86 @@ func (*SetLogLevelResponse) Descriptor() ([]byte, []int) {
 	return file_daemon_proto_rawDescGZIP(), []int{36}
 }
 
+type RegisterUILogRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Path          string                 `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RegisterUILogRequest) Reset() {
+	*x = RegisterUILogRequest{}
+	mi := &file_daemon_proto_msgTypes[37]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RegisterUILogRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RegisterUILogRequest) ProtoMessage() {}
+
+func (x *RegisterUILogRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_daemon_proto_msgTypes[37]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RegisterUILogRequest.ProtoReflect.Descriptor instead.
+func (*RegisterUILogRequest) Descriptor() ([]byte, []int) {
+	return file_daemon_proto_rawDescGZIP(), []int{37}
+}
+
+func (x *RegisterUILogRequest) GetPath() string {
+	if x != nil {
+		return x.Path
+	}
+	return ""
+}
+
+type RegisterUILogResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RegisterUILogResponse) Reset() {
+	*x = RegisterUILogResponse{}
+	mi := &file_daemon_proto_msgTypes[38]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RegisterUILogResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RegisterUILogResponse) ProtoMessage() {}
+
+func (x *RegisterUILogResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_daemon_proto_msgTypes[38]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RegisterUILogResponse.ProtoReflect.Descriptor instead.
+func (*RegisterUILogResponse) Descriptor() ([]byte, []int) {
+	return file_daemon_proto_rawDescGZIP(), []int{38}
+}
+
 // State represents a daemon state entry
 type State struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
@@ -3040,7 +3156,7 @@ type State struct {
 
 func (x *State) Reset() {
 	*x = State{}
-	mi := &file_daemon_proto_msgTypes[37]
+	mi := &file_daemon_proto_msgTypes[39]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3052,7 +3168,7 @@ func (x *State) String() string {
 func (*State) ProtoMessage() {}
 
 func (x *State) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[37]
+	mi := &file_daemon_proto_msgTypes[39]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3065,7 +3181,7 @@ func (x *State) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use State.ProtoReflect.Descriptor instead.
 func (*State) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{37}
+	return file_daemon_proto_rawDescGZIP(), []int{39}
 }
 
 func (x *State) GetName() string {
@@ -3084,7 +3200,7 @@ type ListStatesRequest struct {
 
 func (x *ListStatesRequest) Reset() {
 	*x = ListStatesRequest{}
-	mi := &file_daemon_proto_msgTypes[38]
+	mi := &file_daemon_proto_msgTypes[40]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3096,7 +3212,7 @@ func (x *ListStatesRequest) String() string {
 func (*ListStatesRequest) ProtoMessage() {}
 
 func (x *ListStatesRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[38]
+	mi := &file_daemon_proto_msgTypes[40]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3109,7 +3225,7 @@ func (x *ListStatesRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListStatesRequest.ProtoReflect.Descriptor instead.
 func (*ListStatesRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{38}
+	return file_daemon_proto_rawDescGZIP(), []int{40}
 }
 
 // ListStatesResponse contains a list of states
@@ -3122,7 +3238,7 @@ type ListStatesResponse struct {
 
 func (x *ListStatesResponse) Reset() {
 	*x = ListStatesResponse{}
-	mi := &file_daemon_proto_msgTypes[39]
+	mi := &file_daemon_proto_msgTypes[41]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3134,7 +3250,7 @@ func (x *ListStatesResponse) String() string {
 func (*ListStatesResponse) ProtoMessage() {}
 
 func (x *ListStatesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[39]
+	mi := &file_daemon_proto_msgTypes[41]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3147,7 +3263,7 @@ func (x *ListStatesResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListStatesResponse.ProtoReflect.Descriptor instead.
 func (*ListStatesResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{39}
+	return file_daemon_proto_rawDescGZIP(), []int{41}
 }
 
 func (x *ListStatesResponse) GetStates() []*State {
@@ -3168,7 +3284,7 @@ type CleanStateRequest struct {
 
 func (x *CleanStateRequest) Reset() {
 	*x = CleanStateRequest{}
-	mi := &file_daemon_proto_msgTypes[40]
+	mi := &file_daemon_proto_msgTypes[42]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3180,7 +3296,7 @@ func (x *CleanStateRequest) String() string {
 func (*CleanStateRequest) ProtoMessage() {}
 
 func (x *CleanStateRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[40]
+	mi := &file_daemon_proto_msgTypes[42]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3193,7 +3309,7 @@ func (x *CleanStateRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CleanStateRequest.ProtoReflect.Descriptor instead.
 func (*CleanStateRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{40}
+	return file_daemon_proto_rawDescGZIP(), []int{42}
 }
 
 func (x *CleanStateRequest) GetStateName() string {
@@ -3220,7 +3336,7 @@ type CleanStateResponse struct {
 
 func (x *CleanStateResponse) Reset() {
 	*x = CleanStateResponse{}
-	mi := &file_daemon_proto_msgTypes[41]
+	mi := &file_daemon_proto_msgTypes[43]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3232,7 +3348,7 @@ func (x *CleanStateResponse) String() string {
 func (*CleanStateResponse) ProtoMessage() {}
 
 func (x *CleanStateResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[41]
+	mi := &file_daemon_proto_msgTypes[43]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3245,7 +3361,7 @@ func (x *CleanStateResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CleanStateResponse.ProtoReflect.Descriptor instead.
 func (*CleanStateResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{41}
+	return file_daemon_proto_rawDescGZIP(), []int{43}
 }
 
 func (x *CleanStateResponse) GetCleanedStates() int32 {
@@ -3266,7 +3382,7 @@ type DeleteStateRequest struct {
 
 func (x *DeleteStateRequest) Reset() {
 	*x = DeleteStateRequest{}
-	mi := &file_daemon_proto_msgTypes[42]
+	mi := &file_daemon_proto_msgTypes[44]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3278,7 +3394,7 @@ func (x *DeleteStateRequest) String() string {
 func (*DeleteStateRequest) ProtoMessage() {}
 
 func (x *DeleteStateRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[42]
+	mi := &file_daemon_proto_msgTypes[44]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3291,7 +3407,7 @@ func (x *DeleteStateRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeleteStateRequest.ProtoReflect.Descriptor instead.
 func (*DeleteStateRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{42}
+	return file_daemon_proto_rawDescGZIP(), []int{44}
 }
 
 func (x *DeleteStateRequest) GetStateName() string {
@@ -3318,7 +3434,7 @@ type DeleteStateResponse struct {
 
 func (x *DeleteStateResponse) Reset() {
 	*x = DeleteStateResponse{}
-	mi := &file_daemon_proto_msgTypes[43]
+	mi := &file_daemon_proto_msgTypes[45]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3330,7 +3446,7 @@ func (x *DeleteStateResponse) String() string {
 func (*DeleteStateResponse) ProtoMessage() {}
 
 func (x *DeleteStateResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[43]
+	mi := &file_daemon_proto_msgTypes[45]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3343,7 +3459,7 @@ func (x *DeleteStateResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DeleteStateResponse.ProtoReflect.Descriptor instead.
 func (*DeleteStateResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{43}
+	return file_daemon_proto_rawDescGZIP(), []int{45}
 }
 
 func (x *DeleteStateResponse) GetDeletedStates() int32 {
@@ -3362,7 +3478,7 @@ type SetSyncResponsePersistenceRequest struct {
 
 func (x *SetSyncResponsePersistenceRequest) Reset() {
 	*x = SetSyncResponsePersistenceRequest{}
-	mi := &file_daemon_proto_msgTypes[44]
+	mi := &file_daemon_proto_msgTypes[46]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3374,7 +3490,7 @@ func (x *SetSyncResponsePersistenceRequest) String() string {
 func (*SetSyncResponsePersistenceRequest) ProtoMessage() {}
 
 func (x *SetSyncResponsePersistenceRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[44]
+	mi := &file_daemon_proto_msgTypes[46]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3387,7 +3503,7 @@ func (x *SetSyncResponsePersistenceRequest) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use SetSyncResponsePersistenceRequest.ProtoReflect.Descriptor instead.
 func (*SetSyncResponsePersistenceRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{44}
+	return file_daemon_proto_rawDescGZIP(), []int{46}
 }
 
 func (x *SetSyncResponsePersistenceRequest) GetEnabled() bool {
@@ -3405,7 +3521,7 @@ type SetSyncResponsePersistenceResponse struct {
 
 func (x *SetSyncResponsePersistenceResponse) Reset() {
 	*x = SetSyncResponsePersistenceResponse{}
-	mi := &file_daemon_proto_msgTypes[45]
+	mi := &file_daemon_proto_msgTypes[47]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3417,7 +3533,7 @@ func (x *SetSyncResponsePersistenceResponse) String() string {
 func (*SetSyncResponsePersistenceResponse) ProtoMessage() {}
 
 func (x *SetSyncResponsePersistenceResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[45]
+	mi := &file_daemon_proto_msgTypes[47]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3430,7 +3546,7 @@ func (x *SetSyncResponsePersistenceResponse) ProtoReflect() protoreflect.Message
 
 // Deprecated: Use SetSyncResponsePersistenceResponse.ProtoReflect.Descriptor instead.
 func (*SetSyncResponsePersistenceResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{45}
+	return file_daemon_proto_rawDescGZIP(), []int{47}
 }
 
 type TCPFlags struct {
@@ -3447,7 +3563,7 @@ type TCPFlags struct {
 
 func (x *TCPFlags) Reset() {
 	*x = TCPFlags{}
-	mi := &file_daemon_proto_msgTypes[46]
+	mi := &file_daemon_proto_msgTypes[48]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3459,7 +3575,7 @@ func (x *TCPFlags) String() string {
 func (*TCPFlags) ProtoMessage() {}
 
 func (x *TCPFlags) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[46]
+	mi := &file_daemon_proto_msgTypes[48]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3472,7 +3588,7 @@ func (x *TCPFlags) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TCPFlags.ProtoReflect.Descriptor instead.
 func (*TCPFlags) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{46}
+	return file_daemon_proto_rawDescGZIP(), []int{48}
 }
 
 func (x *TCPFlags) GetSyn() bool {
@@ -3534,7 +3650,7 @@ type TracePacketRequest struct {
 
 func (x *TracePacketRequest) Reset() {
 	*x = TracePacketRequest{}
-	mi := &file_daemon_proto_msgTypes[47]
+	mi := &file_daemon_proto_msgTypes[49]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3546,7 +3662,7 @@ func (x *TracePacketRequest) String() string {
 func (*TracePacketRequest) ProtoMessage() {}
 
 func (x *TracePacketRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[47]
+	mi := &file_daemon_proto_msgTypes[49]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3559,7 +3675,7 @@ func (x *TracePacketRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TracePacketRequest.ProtoReflect.Descriptor instead.
 func (*TracePacketRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{47}
+	return file_daemon_proto_rawDescGZIP(), []int{49}
 }
 
 func (x *TracePacketRequest) GetSourceIp() string {
@@ -3637,7 +3753,7 @@ type TraceStage struct {
 
 func (x *TraceStage) Reset() {
 	*x = TraceStage{}
-	mi := &file_daemon_proto_msgTypes[48]
+	mi := &file_daemon_proto_msgTypes[50]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3649,7 +3765,7 @@ func (x *TraceStage) String() string {
 func (*TraceStage) ProtoMessage() {}
 
 func (x *TraceStage) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[48]
+	mi := &file_daemon_proto_msgTypes[50]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3662,7 +3778,7 @@ func (x *TraceStage) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TraceStage.ProtoReflect.Descriptor instead.
 func (*TraceStage) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{48}
+	return file_daemon_proto_rawDescGZIP(), []int{50}
 }
 
 func (x *TraceStage) GetName() string {
@@ -3703,7 +3819,7 @@ type TracePacketResponse struct {
 
 func (x *TracePacketResponse) Reset() {
 	*x = TracePacketResponse{}
-	mi := &file_daemon_proto_msgTypes[49]
+	mi := &file_daemon_proto_msgTypes[51]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3715,7 +3831,7 @@ func (x *TracePacketResponse) String() string {
 func (*TracePacketResponse) ProtoMessage() {}
 
 func (x *TracePacketResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[49]
+	mi := &file_daemon_proto_msgTypes[51]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3728,7 +3844,7 @@ func (x *TracePacketResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TracePacketResponse.ProtoReflect.Descriptor instead.
 func (*TracePacketResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{49}
+	return file_daemon_proto_rawDescGZIP(), []int{51}
 }
 
 func (x *TracePacketResponse) GetStages() []*TraceStage {
@@ -3753,7 +3869,7 @@ type SubscribeRequest struct {
 
 func (x *SubscribeRequest) Reset() {
 	*x = SubscribeRequest{}
-	mi := &file_daemon_proto_msgTypes[50]
+	mi := &file_daemon_proto_msgTypes[52]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3765,7 +3881,7 @@ func (x *SubscribeRequest) String() string {
 func (*SubscribeRequest) ProtoMessage() {}
 
 func (x *SubscribeRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[50]
+	mi := &file_daemon_proto_msgTypes[52]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3778,7 +3894,7 @@ func (x *SubscribeRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SubscribeRequest.ProtoReflect.Descriptor instead.
 func (*SubscribeRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{50}
+	return file_daemon_proto_rawDescGZIP(), []int{52}
 }
 
 type SystemEvent struct {
@@ -3796,7 +3912,7 @@ type SystemEvent struct {
 
 func (x *SystemEvent) Reset() {
 	*x = SystemEvent{}
-	mi := &file_daemon_proto_msgTypes[51]
+	mi := &file_daemon_proto_msgTypes[53]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3808,7 +3924,7 @@ func (x *SystemEvent) String() string {
 func (*SystemEvent) ProtoMessage() {}
 
 func (x *SystemEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[51]
+	mi := &file_daemon_proto_msgTypes[53]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3821,7 +3937,7 @@ func (x *SystemEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SystemEvent.ProtoReflect.Descriptor instead.
 func (*SystemEvent) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{51}
+	return file_daemon_proto_rawDescGZIP(), []int{53}
 }
 
 func (x *SystemEvent) GetId() string {
@@ -3881,7 +3997,7 @@ type GetEventsRequest struct {
 
 func (x *GetEventsRequest) Reset() {
 	*x = GetEventsRequest{}
-	mi := &file_daemon_proto_msgTypes[52]
+	mi := &file_daemon_proto_msgTypes[54]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3893,7 +4009,7 @@ func (x *GetEventsRequest) String() string {
 func (*GetEventsRequest) ProtoMessage() {}
 
 func (x *GetEventsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[52]
+	mi := &file_daemon_proto_msgTypes[54]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3906,7 +4022,7 @@ func (x *GetEventsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetEventsRequest.ProtoReflect.Descriptor instead.
 func (*GetEventsRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{52}
+	return file_daemon_proto_rawDescGZIP(), []int{54}
 }
 
 type GetEventsResponse struct {
@@ -3918,7 +4034,7 @@ type GetEventsResponse struct {
 
 func (x *GetEventsResponse) Reset() {
 	*x = GetEventsResponse{}
-	mi := &file_daemon_proto_msgTypes[53]
+	mi := &file_daemon_proto_msgTypes[55]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3930,7 +4046,7 @@ func (x *GetEventsResponse) String() string {
 func (*GetEventsResponse) ProtoMessage() {}
 
 func (x *GetEventsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[53]
+	mi := &file_daemon_proto_msgTypes[55]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3943,7 +4059,7 @@ func (x *GetEventsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetEventsResponse.ProtoReflect.Descriptor instead.
 func (*GetEventsResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{53}
+	return file_daemon_proto_rawDescGZIP(), []int{55}
 }
 
 func (x *GetEventsResponse) GetEvents() []*SystemEvent {
@@ -3965,7 +4081,7 @@ type SwitchProfileRequest struct {
 
 func (x *SwitchProfileRequest) Reset() {
 	*x = SwitchProfileRequest{}
-	mi := &file_daemon_proto_msgTypes[54]
+	mi := &file_daemon_proto_msgTypes[56]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3977,7 +4093,7 @@ func (x *SwitchProfileRequest) String() string {
 func (*SwitchProfileRequest) ProtoMessage() {}
 
 func (x *SwitchProfileRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[54]
+	mi := &file_daemon_proto_msgTypes[56]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3990,7 +4106,7 @@ func (x *SwitchProfileRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SwitchProfileRequest.ProtoReflect.Descriptor instead.
 func (*SwitchProfileRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{54}
+	return file_daemon_proto_rawDescGZIP(), []int{56}
 }
 
 func (x *SwitchProfileRequest) GetProfileName() string {
@@ -4019,7 +4135,7 @@ type SwitchProfileResponse struct {
 
 func (x *SwitchProfileResponse) Reset() {
 	*x = SwitchProfileResponse{}
-	mi := &file_daemon_proto_msgTypes[55]
+	mi := &file_daemon_proto_msgTypes[57]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4031,7 +4147,7 @@ func (x *SwitchProfileResponse) String() string {
 func (*SwitchProfileResponse) ProtoMessage() {}
 
 func (x *SwitchProfileResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[55]
+	mi := &file_daemon_proto_msgTypes[57]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4044,7 +4160,7 @@ func (x *SwitchProfileResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SwitchProfileResponse.ProtoReflect.Descriptor instead.
 func (*SwitchProfileResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{55}
+	return file_daemon_proto_rawDescGZIP(), []int{57}
 }
 
 func (x *SwitchProfileResponse) GetId() string {
@@ -4100,7 +4216,7 @@ type SetConfigRequest struct {
 
 func (x *SetConfigRequest) Reset() {
 	*x = SetConfigRequest{}
-	mi := &file_daemon_proto_msgTypes[56]
+	mi := &file_daemon_proto_msgTypes[58]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4112,7 +4228,7 @@ func (x *SetConfigRequest) String() string {
 func (*SetConfigRequest) ProtoMessage() {}
 
 func (x *SetConfigRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[56]
+	mi := &file_daemon_proto_msgTypes[58]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4125,7 +4241,7 @@ func (x *SetConfigRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SetConfigRequest.ProtoReflect.Descriptor instead.
 func (*SetConfigRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{56}
+	return file_daemon_proto_rawDescGZIP(), []int{58}
 }
 
 func (x *SetConfigRequest) GetUsername() string {
@@ -4381,7 +4497,7 @@ type SetConfigResponse struct {
 
 func (x *SetConfigResponse) Reset() {
 	*x = SetConfigResponse{}
-	mi := &file_daemon_proto_msgTypes[57]
+	mi := &file_daemon_proto_msgTypes[59]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4393,7 +4509,7 @@ func (x *SetConfigResponse) String() string {
 func (*SetConfigResponse) ProtoMessage() {}
 
 func (x *SetConfigResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[57]
+	mi := &file_daemon_proto_msgTypes[59]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4406,7 +4522,7 @@ func (x *SetConfigResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SetConfigResponse.ProtoReflect.Descriptor instead.
 func (*SetConfigResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{57}
+	return file_daemon_proto_rawDescGZIP(), []int{59}
 }
 
 type AddProfileRequest struct {
@@ -4421,7 +4537,7 @@ type AddProfileRequest struct {
 
 func (x *AddProfileRequest) Reset() {
 	*x = AddProfileRequest{}
-	mi := &file_daemon_proto_msgTypes[58]
+	mi := &file_daemon_proto_msgTypes[60]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4433,7 +4549,7 @@ func (x *AddProfileRequest) String() string {
 func (*AddProfileRequest) ProtoMessage() {}
 
 func (x *AddProfileRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[58]
+	mi := &file_daemon_proto_msgTypes[60]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4446,7 +4562,7 @@ func (x *AddProfileRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AddProfileRequest.ProtoReflect.Descriptor instead.
 func (*AddProfileRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{58}
+	return file_daemon_proto_rawDescGZIP(), []int{60}
 }
 
 func (x *AddProfileRequest) GetUsername() string {
@@ -4474,7 +4590,7 @@ type AddProfileResponse struct {
 
 func (x *AddProfileResponse) Reset() {
 	*x = AddProfileResponse{}
-	mi := &file_daemon_proto_msgTypes[59]
+	mi := &file_daemon_proto_msgTypes[61]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4486,7 +4602,7 @@ func (x *AddProfileResponse) String() string {
 func (*AddProfileResponse) ProtoMessage() {}
 
 func (x *AddProfileResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[59]
+	mi := &file_daemon_proto_msgTypes[61]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4499,7 +4615,7 @@ func (x *AddProfileResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AddProfileResponse.ProtoReflect.Descriptor instead.
 func (*AddProfileResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{59}
+	return file_daemon_proto_rawDescGZIP(), []int{61}
 }
 
 func (x *AddProfileResponse) GetId() string {
@@ -4522,7 +4638,7 @@ type RenameProfileRequest struct {
 
 func (x *RenameProfileRequest) Reset() {
 	*x = RenameProfileRequest{}
-	mi := &file_daemon_proto_msgTypes[60]
+	mi := &file_daemon_proto_msgTypes[62]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4534,7 +4650,7 @@ func (x *RenameProfileRequest) String() string {
 func (*RenameProfileRequest) ProtoMessage() {}
 
 func (x *RenameProfileRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[60]
+	mi := &file_daemon_proto_msgTypes[62]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4547,7 +4663,7 @@ func (x *RenameProfileRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RenameProfileRequest.ProtoReflect.Descriptor instead.
 func (*RenameProfileRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{60}
+	return file_daemon_proto_rawDescGZIP(), []int{62}
 }
 
 func (x *RenameProfileRequest) GetUsername() string {
@@ -4581,7 +4697,7 @@ type RenameProfileResponse struct {
 
 func (x *RenameProfileResponse) Reset() {
 	*x = RenameProfileResponse{}
-	mi := &file_daemon_proto_msgTypes[61]
+	mi := &file_daemon_proto_msgTypes[63]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4593,7 +4709,7 @@ func (x *RenameProfileResponse) String() string {
 func (*RenameProfileResponse) ProtoMessage() {}
 
 func (x *RenameProfileResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[61]
+	mi := &file_daemon_proto_msgTypes[63]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4606,7 +4722,7 @@ func (x *RenameProfileResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RenameProfileResponse.ProtoReflect.Descriptor instead.
 func (*RenameProfileResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{61}
+	return file_daemon_proto_rawDescGZIP(), []int{63}
 }
 
 func (x *RenameProfileResponse) GetOldProfileName() string {
@@ -4628,7 +4744,7 @@ type RemoveProfileRequest struct {
 
 func (x *RemoveProfileRequest) Reset() {
 	*x = RemoveProfileRequest{}
-	mi := &file_daemon_proto_msgTypes[62]
+	mi := &file_daemon_proto_msgTypes[64]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4640,7 +4756,7 @@ func (x *RemoveProfileRequest) String() string {
 func (*RemoveProfileRequest) ProtoMessage() {}
 
 func (x *RemoveProfileRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[62]
+	mi := &file_daemon_proto_msgTypes[64]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4653,7 +4769,7 @@ func (x *RemoveProfileRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RemoveProfileRequest.ProtoReflect.Descriptor instead.
 func (*RemoveProfileRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{62}
+	return file_daemon_proto_rawDescGZIP(), []int{64}
 }
 
 func (x *RemoveProfileRequest) GetUsername() string {
@@ -4681,7 +4797,7 @@ type RemoveProfileResponse struct {
 
 func (x *RemoveProfileResponse) Reset() {
 	*x = RemoveProfileResponse{}
-	mi := &file_daemon_proto_msgTypes[63]
+	mi := &file_daemon_proto_msgTypes[65]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4693,7 +4809,7 @@ func (x *RemoveProfileResponse) String() string {
 func (*RemoveProfileResponse) ProtoMessage() {}
 
 func (x *RemoveProfileResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[63]
+	mi := &file_daemon_proto_msgTypes[65]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4706,7 +4822,7 @@ func (x *RemoveProfileResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RemoveProfileResponse.ProtoReflect.Descriptor instead.
 func (*RemoveProfileResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{63}
+	return file_daemon_proto_rawDescGZIP(), []int{65}
 }
 
 func (x *RemoveProfileResponse) GetId() string {
@@ -4725,7 +4841,7 @@ type ListProfilesRequest struct {
 
 func (x *ListProfilesRequest) Reset() {
 	*x = ListProfilesRequest{}
-	mi := &file_daemon_proto_msgTypes[64]
+	mi := &file_daemon_proto_msgTypes[66]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4737,7 +4853,7 @@ func (x *ListProfilesRequest) String() string {
 func (*ListProfilesRequest) ProtoMessage() {}
 
 func (x *ListProfilesRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[64]
+	mi := &file_daemon_proto_msgTypes[66]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4750,7 +4866,7 @@ func (x *ListProfilesRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListProfilesRequest.ProtoReflect.Descriptor instead.
 func (*ListProfilesRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{64}
+	return file_daemon_proto_rawDescGZIP(), []int{66}
 }
 
 func (x *ListProfilesRequest) GetUsername() string {
@@ -4769,7 +4885,7 @@ type ListProfilesResponse struct {
 
 func (x *ListProfilesResponse) Reset() {
 	*x = ListProfilesResponse{}
-	mi := &file_daemon_proto_msgTypes[65]
+	mi := &file_daemon_proto_msgTypes[67]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4781,7 +4897,7 @@ func (x *ListProfilesResponse) String() string {
 func (*ListProfilesResponse) ProtoMessage() {}
 
 func (x *ListProfilesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[65]
+	mi := &file_daemon_proto_msgTypes[67]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4794,7 +4910,7 @@ func (x *ListProfilesResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListProfilesResponse.ProtoReflect.Descriptor instead.
 func (*ListProfilesResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{65}
+	return file_daemon_proto_rawDescGZIP(), []int{67}
 }
 
 func (x *ListProfilesResponse) GetProfiles() []*Profile {
@@ -4815,7 +4931,7 @@ type Profile struct {
 
 func (x *Profile) Reset() {
 	*x = Profile{}
-	mi := &file_daemon_proto_msgTypes[66]
+	mi := &file_daemon_proto_msgTypes[68]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4827,7 +4943,7 @@ func (x *Profile) String() string {
 func (*Profile) ProtoMessage() {}
 
 func (x *Profile) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[66]
+	mi := &file_daemon_proto_msgTypes[68]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4840,7 +4956,7 @@ func (x *Profile) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Profile.ProtoReflect.Descriptor instead.
 func (*Profile) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{66}
+	return file_daemon_proto_rawDescGZIP(), []int{68}
 }
 
 func (x *Profile) GetName() string {
@@ -4872,7 +4988,7 @@ type GetActiveProfileRequest struct {
 
 func (x *GetActiveProfileRequest) Reset() {
 	*x = GetActiveProfileRequest{}
-	mi := &file_daemon_proto_msgTypes[67]
+	mi := &file_daemon_proto_msgTypes[69]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4884,7 +5000,7 @@ func (x *GetActiveProfileRequest) String() string {
 func (*GetActiveProfileRequest) ProtoMessage() {}
 
 func (x *GetActiveProfileRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[67]
+	mi := &file_daemon_proto_msgTypes[69]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4897,7 +5013,7 @@ func (x *GetActiveProfileRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetActiveProfileRequest.ProtoReflect.Descriptor instead.
 func (*GetActiveProfileRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{67}
+	return file_daemon_proto_rawDescGZIP(), []int{69}
 }
 
 type GetActiveProfileResponse struct {
@@ -4911,7 +5027,7 @@ type GetActiveProfileResponse struct {
 
 func (x *GetActiveProfileResponse) Reset() {
 	*x = GetActiveProfileResponse{}
-	mi := &file_daemon_proto_msgTypes[68]
+	mi := &file_daemon_proto_msgTypes[70]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4923,7 +5039,7 @@ func (x *GetActiveProfileResponse) String() string {
 func (*GetActiveProfileResponse) ProtoMessage() {}
 
 func (x *GetActiveProfileResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[68]
+	mi := &file_daemon_proto_msgTypes[70]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4936,7 +5052,7 @@ func (x *GetActiveProfileResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetActiveProfileResponse.ProtoReflect.Descriptor instead.
 func (*GetActiveProfileResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{68}
+	return file_daemon_proto_rawDescGZIP(), []int{70}
 }
 
 func (x *GetActiveProfileResponse) GetProfileName() string {
@@ -4970,7 +5086,7 @@ type LogoutRequest struct {
 
 func (x *LogoutRequest) Reset() {
 	*x = LogoutRequest{}
-	mi := &file_daemon_proto_msgTypes[69]
+	mi := &file_daemon_proto_msgTypes[71]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4982,7 +5098,7 @@ func (x *LogoutRequest) String() string {
 func (*LogoutRequest) ProtoMessage() {}
 
 func (x *LogoutRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[69]
+	mi := &file_daemon_proto_msgTypes[71]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4995,7 +5111,7 @@ func (x *LogoutRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LogoutRequest.ProtoReflect.Descriptor instead.
 func (*LogoutRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{69}
+	return file_daemon_proto_rawDescGZIP(), []int{71}
 }
 
 func (x *LogoutRequest) GetProfileName() string {
@@ -5020,7 +5136,7 @@ type LogoutResponse struct {
 
 func (x *LogoutResponse) Reset() {
 	*x = LogoutResponse{}
-	mi := &file_daemon_proto_msgTypes[70]
+	mi := &file_daemon_proto_msgTypes[72]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5032,7 +5148,7 @@ func (x *LogoutResponse) String() string {
 func (*LogoutResponse) ProtoMessage() {}
 
 func (x *LogoutResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[70]
+	mi := &file_daemon_proto_msgTypes[72]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5045,7 +5161,79 @@ func (x *LogoutResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LogoutResponse.ProtoReflect.Descriptor instead.
 func (*LogoutResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{70}
+	return file_daemon_proto_rawDescGZIP(), []int{72}
+}
+
+type WailsUIReadyRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *WailsUIReadyRequest) Reset() {
+	*x = WailsUIReadyRequest{}
+	mi := &file_daemon_proto_msgTypes[73]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WailsUIReadyRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WailsUIReadyRequest) ProtoMessage() {}
+
+func (x *WailsUIReadyRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_daemon_proto_msgTypes[73]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WailsUIReadyRequest.ProtoReflect.Descriptor instead.
+func (*WailsUIReadyRequest) Descriptor() ([]byte, []int) {
+	return file_daemon_proto_rawDescGZIP(), []int{73}
+}
+
+type WailsUIReadyResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *WailsUIReadyResponse) Reset() {
+	*x = WailsUIReadyResponse{}
+	mi := &file_daemon_proto_msgTypes[74]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WailsUIReadyResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WailsUIReadyResponse) ProtoMessage() {}
+
+func (x *WailsUIReadyResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_daemon_proto_msgTypes[74]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WailsUIReadyResponse.ProtoReflect.Descriptor instead.
+func (*WailsUIReadyResponse) Descriptor() ([]byte, []int) {
+	return file_daemon_proto_rawDescGZIP(), []int{74}
 }
 
 type GetFeaturesRequest struct {
@@ -5056,7 +5244,7 @@ type GetFeaturesRequest struct {
 
 func (x *GetFeaturesRequest) Reset() {
 	*x = GetFeaturesRequest{}
-	mi := &file_daemon_proto_msgTypes[71]
+	mi := &file_daemon_proto_msgTypes[75]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5068,7 +5256,7 @@ func (x *GetFeaturesRequest) String() string {
 func (*GetFeaturesRequest) ProtoMessage() {}
 
 func (x *GetFeaturesRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[71]
+	mi := &file_daemon_proto_msgTypes[75]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5081,7 +5269,7 @@ func (x *GetFeaturesRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetFeaturesRequest.ProtoReflect.Descriptor instead.
 func (*GetFeaturesRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{71}
+	return file_daemon_proto_rawDescGZIP(), []int{75}
 }
 
 type GetFeaturesResponse struct {
@@ -5089,13 +5277,19 @@ type GetFeaturesResponse struct {
 	DisableProfiles       bool                   `protobuf:"varint,1,opt,name=disable_profiles,json=disableProfiles,proto3" json:"disable_profiles,omitempty"`
 	DisableUpdateSettings bool                   `protobuf:"varint,2,opt,name=disable_update_settings,json=disableUpdateSettings,proto3" json:"disable_update_settings,omitempty"`
 	DisableNetworks       bool                   `protobuf:"varint,3,opt,name=disable_networks,json=disableNetworks,proto3" json:"disable_networks,omitempty"`
-	unknownFields         protoimpl.UnknownFields
-	sizeCache             protoimpl.SizeCache
+	// disableAdvancedView gates the upcoming UI revision's advanced
+	// section. Tristate: unset = no MDM directive, the UI applies its
+	// own default; true = MDM enforces disable; false = MDM enforces
+	// enable. Sourced exclusively from the MDM policy — no CLI /
+	// config flag backs this value.
+	DisableAdvancedView *bool `protobuf:"varint,4,opt,name=disable_advanced_view,json=disableAdvancedView,proto3,oneof" json:"disable_advanced_view,omitempty"`
+	unknownFields       protoimpl.UnknownFields
+	sizeCache           protoimpl.SizeCache
 }
 
 func (x *GetFeaturesResponse) Reset() {
 	*x = GetFeaturesResponse{}
-	mi := &file_daemon_proto_msgTypes[72]
+	mi := &file_daemon_proto_msgTypes[76]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5107,7 +5301,7 @@ func (x *GetFeaturesResponse) String() string {
 func (*GetFeaturesResponse) ProtoMessage() {}
 
 func (x *GetFeaturesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[72]
+	mi := &file_daemon_proto_msgTypes[76]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5120,7 +5314,7 @@ func (x *GetFeaturesResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetFeaturesResponse.ProtoReflect.Descriptor instead.
 func (*GetFeaturesResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{72}
+	return file_daemon_proto_rawDescGZIP(), []int{76}
 }
 
 func (x *GetFeaturesResponse) GetDisableProfiles() bool {
@@ -5144,6 +5338,13 @@ func (x *GetFeaturesResponse) GetDisableNetworks() bool {
 	return false
 }
 
+func (x *GetFeaturesResponse) GetDisableAdvancedView() bool {
+	if x != nil && x.DisableAdvancedView != nil {
+		return *x.DisableAdvancedView
+	}
+	return false
+}
+
 // MDMManagedFieldsViolation is attached as a gRPC error detail on a
 // FailedPrecondition status returned from SetConfig (and similar mutating
 // RPCs) when the caller tries to modify one or more MDM-enforced fields.
@@ -5158,7 +5359,7 @@ type MDMManagedFieldsViolation struct {
 
 func (x *MDMManagedFieldsViolation) Reset() {
 	*x = MDMManagedFieldsViolation{}
-	mi := &file_daemon_proto_msgTypes[73]
+	mi := &file_daemon_proto_msgTypes[77]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5170,7 +5371,7 @@ func (x *MDMManagedFieldsViolation) String() string {
 func (*MDMManagedFieldsViolation) ProtoMessage() {}
 
 func (x *MDMManagedFieldsViolation) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[73]
+	mi := &file_daemon_proto_msgTypes[77]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5183,7 +5384,7 @@ func (x *MDMManagedFieldsViolation) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MDMManagedFieldsViolation.ProtoReflect.Descriptor instead.
 func (*MDMManagedFieldsViolation) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{73}
+	return file_daemon_proto_rawDescGZIP(), []int{77}
 }
 
 func (x *MDMManagedFieldsViolation) GetFields() []string {
@@ -5201,7 +5402,7 @@ type TriggerUpdateRequest struct {
 
 func (x *TriggerUpdateRequest) Reset() {
 	*x = TriggerUpdateRequest{}
-	mi := &file_daemon_proto_msgTypes[74]
+	mi := &file_daemon_proto_msgTypes[78]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5213,7 +5414,7 @@ func (x *TriggerUpdateRequest) String() string {
 func (*TriggerUpdateRequest) ProtoMessage() {}
 
 func (x *TriggerUpdateRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[74]
+	mi := &file_daemon_proto_msgTypes[78]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5226,7 +5427,7 @@ func (x *TriggerUpdateRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TriggerUpdateRequest.ProtoReflect.Descriptor instead.
 func (*TriggerUpdateRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{74}
+	return file_daemon_proto_rawDescGZIP(), []int{78}
 }
 
 type TriggerUpdateResponse struct {
@@ -5239,7 +5440,7 @@ type TriggerUpdateResponse struct {
 
 func (x *TriggerUpdateResponse) Reset() {
 	*x = TriggerUpdateResponse{}
-	mi := &file_daemon_proto_msgTypes[75]
+	mi := &file_daemon_proto_msgTypes[79]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5251,7 +5452,7 @@ func (x *TriggerUpdateResponse) String() string {
 func (*TriggerUpdateResponse) ProtoMessage() {}
 
 func (x *TriggerUpdateResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[75]
+	mi := &file_daemon_proto_msgTypes[79]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5264,7 +5465,7 @@ func (x *TriggerUpdateResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TriggerUpdateResponse.ProtoReflect.Descriptor instead.
 func (*TriggerUpdateResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{75}
+	return file_daemon_proto_rawDescGZIP(), []int{79}
 }
 
 func (x *TriggerUpdateResponse) GetSuccess() bool {
@@ -5292,7 +5493,7 @@ type GetPeerSSHHostKeyRequest struct {
 
 func (x *GetPeerSSHHostKeyRequest) Reset() {
 	*x = GetPeerSSHHostKeyRequest{}
-	mi := &file_daemon_proto_msgTypes[76]
+	mi := &file_daemon_proto_msgTypes[80]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5304,7 +5505,7 @@ func (x *GetPeerSSHHostKeyRequest) String() string {
 func (*GetPeerSSHHostKeyRequest) ProtoMessage() {}
 
 func (x *GetPeerSSHHostKeyRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[76]
+	mi := &file_daemon_proto_msgTypes[80]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5317,7 +5518,7 @@ func (x *GetPeerSSHHostKeyRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetPeerSSHHostKeyRequest.ProtoReflect.Descriptor instead.
 func (*GetPeerSSHHostKeyRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{76}
+	return file_daemon_proto_rawDescGZIP(), []int{80}
 }
 
 func (x *GetPeerSSHHostKeyRequest) GetPeerAddress() string {
@@ -5344,7 +5545,7 @@ type GetPeerSSHHostKeyResponse struct {
 
 func (x *GetPeerSSHHostKeyResponse) Reset() {
 	*x = GetPeerSSHHostKeyResponse{}
-	mi := &file_daemon_proto_msgTypes[77]
+	mi := &file_daemon_proto_msgTypes[81]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5356,7 +5557,7 @@ func (x *GetPeerSSHHostKeyResponse) String() string {
 func (*GetPeerSSHHostKeyResponse) ProtoMessage() {}
 
 func (x *GetPeerSSHHostKeyResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[77]
+	mi := &file_daemon_proto_msgTypes[81]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5369,7 +5570,7 @@ func (x *GetPeerSSHHostKeyResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetPeerSSHHostKeyResponse.ProtoReflect.Descriptor instead.
 func (*GetPeerSSHHostKeyResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{77}
+	return file_daemon_proto_rawDescGZIP(), []int{81}
 }
 
 func (x *GetPeerSSHHostKeyResponse) GetSshHostKey() []byte {
@@ -5411,7 +5612,7 @@ type RequestJWTAuthRequest struct {
 
 func (x *RequestJWTAuthRequest) Reset() {
 	*x = RequestJWTAuthRequest{}
-	mi := &file_daemon_proto_msgTypes[78]
+	mi := &file_daemon_proto_msgTypes[82]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5423,7 +5624,7 @@ func (x *RequestJWTAuthRequest) String() string {
 func (*RequestJWTAuthRequest) ProtoMessage() {}
 
 func (x *RequestJWTAuthRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[78]
+	mi := &file_daemon_proto_msgTypes[82]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5436,7 +5637,7 @@ func (x *RequestJWTAuthRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RequestJWTAuthRequest.ProtoReflect.Descriptor instead.
 func (*RequestJWTAuthRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{78}
+	return file_daemon_proto_rawDescGZIP(), []int{82}
 }
 
 func (x *RequestJWTAuthRequest) GetHint() string {
@@ -5469,7 +5670,7 @@ type RequestJWTAuthResponse struct {
 
 func (x *RequestJWTAuthResponse) Reset() {
 	*x = RequestJWTAuthResponse{}
-	mi := &file_daemon_proto_msgTypes[79]
+	mi := &file_daemon_proto_msgTypes[83]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5481,7 +5682,7 @@ func (x *RequestJWTAuthResponse) String() string {
 func (*RequestJWTAuthResponse) ProtoMessage() {}
 
 func (x *RequestJWTAuthResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[79]
+	mi := &file_daemon_proto_msgTypes[83]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5494,7 +5695,7 @@ func (x *RequestJWTAuthResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RequestJWTAuthResponse.ProtoReflect.Descriptor instead.
 func (*RequestJWTAuthResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{79}
+	return file_daemon_proto_rawDescGZIP(), []int{83}
 }
 
 func (x *RequestJWTAuthResponse) GetVerificationURI() string {
@@ -5559,7 +5760,7 @@ type WaitJWTTokenRequest struct {
 
 func (x *WaitJWTTokenRequest) Reset() {
 	*x = WaitJWTTokenRequest{}
-	mi := &file_daemon_proto_msgTypes[80]
+	mi := &file_daemon_proto_msgTypes[84]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5571,7 +5772,7 @@ func (x *WaitJWTTokenRequest) String() string {
 func (*WaitJWTTokenRequest) ProtoMessage() {}
 
 func (x *WaitJWTTokenRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[80]
+	mi := &file_daemon_proto_msgTypes[84]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5584,7 +5785,7 @@ func (x *WaitJWTTokenRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WaitJWTTokenRequest.ProtoReflect.Descriptor instead.
 func (*WaitJWTTokenRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{80}
+	return file_daemon_proto_rawDescGZIP(), []int{84}
 }
 
 func (x *WaitJWTTokenRequest) GetDeviceCode() string {
@@ -5616,7 +5817,7 @@ type WaitJWTTokenResponse struct {
 
 func (x *WaitJWTTokenResponse) Reset() {
 	*x = WaitJWTTokenResponse{}
-	mi := &file_daemon_proto_msgTypes[81]
+	mi := &file_daemon_proto_msgTypes[85]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5628,7 +5829,7 @@ func (x *WaitJWTTokenResponse) String() string {
 func (*WaitJWTTokenResponse) ProtoMessage() {}
 
 func (x *WaitJWTTokenResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[81]
+	mi := &file_daemon_proto_msgTypes[85]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5641,7 +5842,7 @@ func (x *WaitJWTTokenResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WaitJWTTokenResponse.ProtoReflect.Descriptor instead.
 func (*WaitJWTTokenResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{81}
+	return file_daemon_proto_rawDescGZIP(), []int{85}
 }
 
 func (x *WaitJWTTokenResponse) GetToken() string {
@@ -5665,6 +5866,318 @@ func (x *WaitJWTTokenResponse) GetExpiresIn() int64 {
 	return 0
 }
 
+// RequestExtendAuthSessionRequest kicks off the session-extension SSO flow.
+type RequestExtendAuthSessionRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Optional OIDC login_hint (typically the user's email) to pre-fill the
+	// IdP login form.
+	Hint          *string `protobuf:"bytes,1,opt,name=hint,proto3,oneof" json:"hint,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RequestExtendAuthSessionRequest) Reset() {
+	*x = RequestExtendAuthSessionRequest{}
+	mi := &file_daemon_proto_msgTypes[86]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RequestExtendAuthSessionRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RequestExtendAuthSessionRequest) ProtoMessage() {}
+
+func (x *RequestExtendAuthSessionRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_daemon_proto_msgTypes[86]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RequestExtendAuthSessionRequest.ProtoReflect.Descriptor instead.
+func (*RequestExtendAuthSessionRequest) Descriptor() ([]byte, []int) {
+	return file_daemon_proto_rawDescGZIP(), []int{86}
+}
+
+func (x *RequestExtendAuthSessionRequest) GetHint() string {
+	if x != nil && x.Hint != nil {
+		return *x.Hint
+	}
+	return ""
+}
+
+// RequestExtendAuthSessionResponse carries the verification URI the UI
+// should open in a browser. The daemon retains the flow state and resolves
+// it via WaitExtendAuthSession.
+type RequestExtendAuthSessionResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// verification URI for the user to open in the browser
+	VerificationURI string `protobuf:"bytes,1,opt,name=verificationURI,proto3" json:"verificationURI,omitempty"`
+	// complete verification URI (with embedded user code)
+	VerificationURIComplete string `protobuf:"bytes,2,opt,name=verificationURIComplete,proto3" json:"verificationURIComplete,omitempty"`
+	// user code to enter on verification URI (for device-code flows)
+	UserCode string `protobuf:"bytes,3,opt,name=userCode,proto3" json:"userCode,omitempty"`
+	// device code for matching the WaitExtendAuthSession call to this flow
+	DeviceCode string `protobuf:"bytes,4,opt,name=deviceCode,proto3" json:"deviceCode,omitempty"`
+	// expiration time in seconds for the device code / PKCE flow
+	ExpiresIn     int64 `protobuf:"varint,5,opt,name=expiresIn,proto3" json:"expiresIn,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RequestExtendAuthSessionResponse) Reset() {
+	*x = RequestExtendAuthSessionResponse{}
+	mi := &file_daemon_proto_msgTypes[87]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RequestExtendAuthSessionResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RequestExtendAuthSessionResponse) ProtoMessage() {}
+
+func (x *RequestExtendAuthSessionResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_daemon_proto_msgTypes[87]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RequestExtendAuthSessionResponse.ProtoReflect.Descriptor instead.
+func (*RequestExtendAuthSessionResponse) Descriptor() ([]byte, []int) {
+	return file_daemon_proto_rawDescGZIP(), []int{87}
+}
+
+func (x *RequestExtendAuthSessionResponse) GetVerificationURI() string {
+	if x != nil {
+		return x.VerificationURI
+	}
+	return ""
+}
+
+func (x *RequestExtendAuthSessionResponse) GetVerificationURIComplete() string {
+	if x != nil {
+		return x.VerificationURIComplete
+	}
+	return ""
+}
+
+func (x *RequestExtendAuthSessionResponse) GetUserCode() string {
+	if x != nil {
+		return x.UserCode
+	}
+	return ""
+}
+
+func (x *RequestExtendAuthSessionResponse) GetDeviceCode() string {
+	if x != nil {
+		return x.DeviceCode
+	}
+	return ""
+}
+
+func (x *RequestExtendAuthSessionResponse) GetExpiresIn() int64 {
+	if x != nil {
+		return x.ExpiresIn
+	}
+	return 0
+}
+
+// WaitExtendAuthSessionRequest is sent by the UI after it opens the
+// verification URI. The daemon blocks on this call until the user
+// completes (or aborts) the SSO step.
+type WaitExtendAuthSessionRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// device code returned by RequestExtendAuthSession
+	DeviceCode string `protobuf:"bytes,1,opt,name=deviceCode,proto3" json:"deviceCode,omitempty"`
+	// user code for verification
+	UserCode      string `protobuf:"bytes,2,opt,name=userCode,proto3" json:"userCode,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *WaitExtendAuthSessionRequest) Reset() {
+	*x = WaitExtendAuthSessionRequest{}
+	mi := &file_daemon_proto_msgTypes[88]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WaitExtendAuthSessionRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WaitExtendAuthSessionRequest) ProtoMessage() {}
+
+func (x *WaitExtendAuthSessionRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_daemon_proto_msgTypes[88]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WaitExtendAuthSessionRequest.ProtoReflect.Descriptor instead.
+func (*WaitExtendAuthSessionRequest) Descriptor() ([]byte, []int) {
+	return file_daemon_proto_rawDescGZIP(), []int{88}
+}
+
+func (x *WaitExtendAuthSessionRequest) GetDeviceCode() string {
+	if x != nil {
+		return x.DeviceCode
+	}
+	return ""
+}
+
+func (x *WaitExtendAuthSessionRequest) GetUserCode() string {
+	if x != nil {
+		return x.UserCode
+	}
+	return ""
+}
+
+// WaitExtendAuthSessionResponse carries the refreshed deadline returned
+// by the management server. Unset when the management server reports the
+// peer is not eligible for session extension.
+type WaitExtendAuthSessionResponse struct {
+	state            protoimpl.MessageState `protogen:"open.v1"`
+	SessionExpiresAt *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=sessionExpiresAt,proto3" json:"sessionExpiresAt,omitempty"`
+	unknownFields    protoimpl.UnknownFields
+	sizeCache        protoimpl.SizeCache
+}
+
+func (x *WaitExtendAuthSessionResponse) Reset() {
+	*x = WaitExtendAuthSessionResponse{}
+	mi := &file_daemon_proto_msgTypes[89]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WaitExtendAuthSessionResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WaitExtendAuthSessionResponse) ProtoMessage() {}
+
+func (x *WaitExtendAuthSessionResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_daemon_proto_msgTypes[89]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WaitExtendAuthSessionResponse.ProtoReflect.Descriptor instead.
+func (*WaitExtendAuthSessionResponse) Descriptor() ([]byte, []int) {
+	return file_daemon_proto_rawDescGZIP(), []int{89}
+}
+
+func (x *WaitExtendAuthSessionResponse) GetSessionExpiresAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.SessionExpiresAt
+	}
+	return nil
+}
+
+// DismissSessionWarningRequest is sent by the UI when the user clicks
+// "Dismiss" on the T-WarningLead notification.
+type DismissSessionWarningRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DismissSessionWarningRequest) Reset() {
+	*x = DismissSessionWarningRequest{}
+	mi := &file_daemon_proto_msgTypes[90]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DismissSessionWarningRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DismissSessionWarningRequest) ProtoMessage() {}
+
+func (x *DismissSessionWarningRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_daemon_proto_msgTypes[90]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DismissSessionWarningRequest.ProtoReflect.Descriptor instead.
+func (*DismissSessionWarningRequest) Descriptor() ([]byte, []int) {
+	return file_daemon_proto_rawDescGZIP(), []int{90}
+}
+
+// DismissSessionWarningResponse acknowledges the dismissal. Carries no
+// payload — the daemon's only obligation is to silence the upcoming
+// T-FinalWarningLead fallback for the current deadline.
+type DismissSessionWarningResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DismissSessionWarningResponse) Reset() {
+	*x = DismissSessionWarningResponse{}
+	mi := &file_daemon_proto_msgTypes[91]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DismissSessionWarningResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DismissSessionWarningResponse) ProtoMessage() {}
+
+func (x *DismissSessionWarningResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_daemon_proto_msgTypes[91]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DismissSessionWarningResponse.ProtoReflect.Descriptor instead.
+func (*DismissSessionWarningResponse) Descriptor() ([]byte, []int) {
+	return file_daemon_proto_rawDescGZIP(), []int{91}
+}
+
 // StartCPUProfileRequest for starting CPU profiling
 type StartCPUProfileRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
@@ -5674,7 +6187,7 @@ type StartCPUProfileRequest struct {
 
 func (x *StartCPUProfileRequest) Reset() {
 	*x = StartCPUProfileRequest{}
-	mi := &file_daemon_proto_msgTypes[82]
+	mi := &file_daemon_proto_msgTypes[92]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5686,7 +6199,7 @@ func (x *StartCPUProfileRequest) String() string {
 func (*StartCPUProfileRequest) ProtoMessage() {}
 
 func (x *StartCPUProfileRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[82]
+	mi := &file_daemon_proto_msgTypes[92]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5699,7 +6212,7 @@ func (x *StartCPUProfileRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StartCPUProfileRequest.ProtoReflect.Descriptor instead.
 func (*StartCPUProfileRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{82}
+	return file_daemon_proto_rawDescGZIP(), []int{92}
 }
 
 // StartCPUProfileResponse confirms CPU profiling has started
@@ -5711,7 +6224,7 @@ type StartCPUProfileResponse struct {
 
 func (x *StartCPUProfileResponse) Reset() {
 	*x = StartCPUProfileResponse{}
-	mi := &file_daemon_proto_msgTypes[83]
+	mi := &file_daemon_proto_msgTypes[93]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5723,7 +6236,7 @@ func (x *StartCPUProfileResponse) String() string {
 func (*StartCPUProfileResponse) ProtoMessage() {}
 
 func (x *StartCPUProfileResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[83]
+	mi := &file_daemon_proto_msgTypes[93]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5736,7 +6249,7 @@ func (x *StartCPUProfileResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StartCPUProfileResponse.ProtoReflect.Descriptor instead.
 func (*StartCPUProfileResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{83}
+	return file_daemon_proto_rawDescGZIP(), []int{93}
 }
 
 // StopCPUProfileRequest for stopping CPU profiling
@@ -5748,7 +6261,7 @@ type StopCPUProfileRequest struct {
 
 func (x *StopCPUProfileRequest) Reset() {
 	*x = StopCPUProfileRequest{}
-	mi := &file_daemon_proto_msgTypes[84]
+	mi := &file_daemon_proto_msgTypes[94]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5760,7 +6273,7 @@ func (x *StopCPUProfileRequest) String() string {
 func (*StopCPUProfileRequest) ProtoMessage() {}
 
 func (x *StopCPUProfileRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[84]
+	mi := &file_daemon_proto_msgTypes[94]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5773,7 +6286,7 @@ func (x *StopCPUProfileRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StopCPUProfileRequest.ProtoReflect.Descriptor instead.
 func (*StopCPUProfileRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{84}
+	return file_daemon_proto_rawDescGZIP(), []int{94}
 }
 
 // StopCPUProfileResponse confirms CPU profiling has stopped
@@ -5785,7 +6298,7 @@ type StopCPUProfileResponse struct {
 
 func (x *StopCPUProfileResponse) Reset() {
 	*x = StopCPUProfileResponse{}
-	mi := &file_daemon_proto_msgTypes[85]
+	mi := &file_daemon_proto_msgTypes[95]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5797,7 +6310,7 @@ func (x *StopCPUProfileResponse) String() string {
 func (*StopCPUProfileResponse) ProtoMessage() {}
 
 func (x *StopCPUProfileResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[85]
+	mi := &file_daemon_proto_msgTypes[95]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5810,7 +6323,7 @@ func (x *StopCPUProfileResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StopCPUProfileResponse.ProtoReflect.Descriptor instead.
 func (*StopCPUProfileResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{85}
+	return file_daemon_proto_rawDescGZIP(), []int{95}
 }
 
 type InstallerResultRequest struct {
@@ -5821,7 +6334,7 @@ type InstallerResultRequest struct {
 
 func (x *InstallerResultRequest) Reset() {
 	*x = InstallerResultRequest{}
-	mi := &file_daemon_proto_msgTypes[86]
+	mi := &file_daemon_proto_msgTypes[96]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5833,7 +6346,7 @@ func (x *InstallerResultRequest) String() string {
 func (*InstallerResultRequest) ProtoMessage() {}
 
 func (x *InstallerResultRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[86]
+	mi := &file_daemon_proto_msgTypes[96]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5846,7 +6359,7 @@ func (x *InstallerResultRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InstallerResultRequest.ProtoReflect.Descriptor instead.
 func (*InstallerResultRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{86}
+	return file_daemon_proto_rawDescGZIP(), []int{96}
 }
 
 type InstallerResultResponse struct {
@@ -5859,7 +6372,7 @@ type InstallerResultResponse struct {
 
 func (x *InstallerResultResponse) Reset() {
 	*x = InstallerResultResponse{}
-	mi := &file_daemon_proto_msgTypes[87]
+	mi := &file_daemon_proto_msgTypes[97]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5871,7 +6384,7 @@ func (x *InstallerResultResponse) String() string {
 func (*InstallerResultResponse) ProtoMessage() {}
 
 func (x *InstallerResultResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[87]
+	mi := &file_daemon_proto_msgTypes[97]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5884,7 +6397,7 @@ func (x *InstallerResultResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InstallerResultResponse.ProtoReflect.Descriptor instead.
 func (*InstallerResultResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{87}
+	return file_daemon_proto_rawDescGZIP(), []int{97}
 }
 
 func (x *InstallerResultResponse) GetSuccess() bool {
@@ -5917,7 +6430,7 @@ type ExposeServiceRequest struct {
 
 func (x *ExposeServiceRequest) Reset() {
 	*x = ExposeServiceRequest{}
-	mi := &file_daemon_proto_msgTypes[88]
+	mi := &file_daemon_proto_msgTypes[98]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -5929,7 +6442,7 @@ func (x *ExposeServiceRequest) String() string {
 func (*ExposeServiceRequest) ProtoMessage() {}
 
 func (x *ExposeServiceRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[88]
+	mi := &file_daemon_proto_msgTypes[98]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -5942,7 +6455,7 @@ func (x *ExposeServiceRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ExposeServiceRequest.ProtoReflect.Descriptor instead.
 func (*ExposeServiceRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{88}
+	return file_daemon_proto_rawDescGZIP(), []int{98}
 }
 
 func (x *ExposeServiceRequest) GetPort() uint32 {
@@ -6013,7 +6526,7 @@ type ExposeServiceEvent struct {
 
 func (x *ExposeServiceEvent) Reset() {
 	*x = ExposeServiceEvent{}
-	mi := &file_daemon_proto_msgTypes[89]
+	mi := &file_daemon_proto_msgTypes[99]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6025,7 +6538,7 @@ func (x *ExposeServiceEvent) String() string {
 func (*ExposeServiceEvent) ProtoMessage() {}
 
 func (x *ExposeServiceEvent) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[89]
+	mi := &file_daemon_proto_msgTypes[99]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6038,7 +6551,7 @@ func (x *ExposeServiceEvent) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ExposeServiceEvent.ProtoReflect.Descriptor instead.
 func (*ExposeServiceEvent) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{89}
+	return file_daemon_proto_rawDescGZIP(), []int{99}
 }
 
 func (x *ExposeServiceEvent) GetEvent() isExposeServiceEvent_Event {
@@ -6079,7 +6592,7 @@ type ExposeServiceReady struct {
 
 func (x *ExposeServiceReady) Reset() {
 	*x = ExposeServiceReady{}
-	mi := &file_daemon_proto_msgTypes[90]
+	mi := &file_daemon_proto_msgTypes[100]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6091,7 +6604,7 @@ func (x *ExposeServiceReady) String() string {
 func (*ExposeServiceReady) ProtoMessage() {}
 
 func (x *ExposeServiceReady) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[90]
+	mi := &file_daemon_proto_msgTypes[100]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6104,7 +6617,7 @@ func (x *ExposeServiceReady) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ExposeServiceReady.ProtoReflect.Descriptor instead.
 func (*ExposeServiceReady) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{90}
+	return file_daemon_proto_rawDescGZIP(), []int{100}
 }
 
 func (x *ExposeServiceReady) GetServiceName() string {
@@ -6149,7 +6662,7 @@ type StartCaptureRequest struct {
 
 func (x *StartCaptureRequest) Reset() {
 	*x = StartCaptureRequest{}
-	mi := &file_daemon_proto_msgTypes[91]
+	mi := &file_daemon_proto_msgTypes[101]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6161,7 +6674,7 @@ func (x *StartCaptureRequest) String() string {
 func (*StartCaptureRequest) ProtoMessage() {}
 
 func (x *StartCaptureRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[91]
+	mi := &file_daemon_proto_msgTypes[101]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6174,7 +6687,7 @@ func (x *StartCaptureRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StartCaptureRequest.ProtoReflect.Descriptor instead.
 func (*StartCaptureRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{91}
+	return file_daemon_proto_rawDescGZIP(), []int{101}
 }
 
 func (x *StartCaptureRequest) GetTextOutput() bool {
@@ -6228,7 +6741,7 @@ type CapturePacket struct {
 
 func (x *CapturePacket) Reset() {
 	*x = CapturePacket{}
-	mi := &file_daemon_proto_msgTypes[92]
+	mi := &file_daemon_proto_msgTypes[102]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6240,7 +6753,7 @@ func (x *CapturePacket) String() string {
 func (*CapturePacket) ProtoMessage() {}
 
 func (x *CapturePacket) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[92]
+	mi := &file_daemon_proto_msgTypes[102]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6253,7 +6766,7 @@ func (x *CapturePacket) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CapturePacket.ProtoReflect.Descriptor instead.
 func (*CapturePacket) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{92}
+	return file_daemon_proto_rawDescGZIP(), []int{102}
 }
 
 func (x *CapturePacket) GetData() []byte {
@@ -6274,7 +6787,7 @@ type StartBundleCaptureRequest struct {
 
 func (x *StartBundleCaptureRequest) Reset() {
 	*x = StartBundleCaptureRequest{}
-	mi := &file_daemon_proto_msgTypes[93]
+	mi := &file_daemon_proto_msgTypes[103]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6286,7 +6799,7 @@ func (x *StartBundleCaptureRequest) String() string {
 func (*StartBundleCaptureRequest) ProtoMessage() {}
 
 func (x *StartBundleCaptureRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[93]
+	mi := &file_daemon_proto_msgTypes[103]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6299,7 +6812,7 @@ func (x *StartBundleCaptureRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StartBundleCaptureRequest.ProtoReflect.Descriptor instead.
 func (*StartBundleCaptureRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{93}
+	return file_daemon_proto_rawDescGZIP(), []int{103}
 }
 
 func (x *StartBundleCaptureRequest) GetTimeout() *durationpb.Duration {
@@ -6317,7 +6830,7 @@ type StartBundleCaptureResponse struct {
 
 func (x *StartBundleCaptureResponse) Reset() {
 	*x = StartBundleCaptureResponse{}
-	mi := &file_daemon_proto_msgTypes[94]
+	mi := &file_daemon_proto_msgTypes[104]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6329,7 +6842,7 @@ func (x *StartBundleCaptureResponse) String() string {
 func (*StartBundleCaptureResponse) ProtoMessage() {}
 
 func (x *StartBundleCaptureResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[94]
+	mi := &file_daemon_proto_msgTypes[104]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6342,7 +6855,7 @@ func (x *StartBundleCaptureResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StartBundleCaptureResponse.ProtoReflect.Descriptor instead.
 func (*StartBundleCaptureResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{94}
+	return file_daemon_proto_rawDescGZIP(), []int{104}
 }
 
 type StopBundleCaptureRequest struct {
@@ -6353,7 +6866,7 @@ type StopBundleCaptureRequest struct {
 
 func (x *StopBundleCaptureRequest) Reset() {
 	*x = StopBundleCaptureRequest{}
-	mi := &file_daemon_proto_msgTypes[95]
+	mi := &file_daemon_proto_msgTypes[105]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6365,7 +6878,7 @@ func (x *StopBundleCaptureRequest) String() string {
 func (*StopBundleCaptureRequest) ProtoMessage() {}
 
 func (x *StopBundleCaptureRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[95]
+	mi := &file_daemon_proto_msgTypes[105]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6378,7 +6891,7 @@ func (x *StopBundleCaptureRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StopBundleCaptureRequest.ProtoReflect.Descriptor instead.
 func (*StopBundleCaptureRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{95}
+	return file_daemon_proto_rawDescGZIP(), []int{105}
 }
 
 type StopBundleCaptureResponse struct {
@@ -6389,7 +6902,7 @@ type StopBundleCaptureResponse struct {
 
 func (x *StopBundleCaptureResponse) Reset() {
 	*x = StopBundleCaptureResponse{}
-	mi := &file_daemon_proto_msgTypes[96]
+	mi := &file_daemon_proto_msgTypes[106]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6401,7 +6914,7 @@ func (x *StopBundleCaptureResponse) String() string {
 func (*StopBundleCaptureResponse) ProtoMessage() {}
 
 func (x *StopBundleCaptureResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[96]
+	mi := &file_daemon_proto_msgTypes[106]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6414,7 +6927,7 @@ func (x *StopBundleCaptureResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StopBundleCaptureResponse.ProtoReflect.Descriptor instead.
 func (*StopBundleCaptureResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{96}
+	return file_daemon_proto_rawDescGZIP(), []int{106}
 }
 
 type PortInfo_Range struct {
@@ -6427,7 +6940,7 @@ type PortInfo_Range struct {
 
 func (x *PortInfo_Range) Reset() {
 	*x = PortInfo_Range{}
-	mi := &file_daemon_proto_msgTypes[98]
+	mi := &file_daemon_proto_msgTypes[108]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6439,7 +6952,7 @@ func (x *PortInfo_Range) String() string {
 func (*PortInfo_Range) ProtoMessage() {}
 
 func (x *PortInfo_Range) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[98]
+	mi := &file_daemon_proto_msgTypes[108]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6557,10 +7070,11 @@ const file_daemon_proto_rawDesc = "" +
 	"\buserCode\x18\x01 \x01(\tR\buserCode\x12\x1a\n" +
 	"\bhostname\x18\x02 \x01(\tR\bhostname\",\n" +
 	"\x14WaitSSOLoginResponse\x12\x14\n" +
-	"\x05email\x18\x01 \x01(\tR\x05email\"v\n" +
+	"\x05email\x18\x01 \x01(\tR\x05email\"\x8c\x01\n" +
 	"\tUpRequest\x12%\n" +
 	"\vprofileName\x18\x01 \x01(\tH\x00R\vprofileName\x88\x01\x01\x12\x1f\n" +
-	"\busername\x18\x02 \x01(\tH\x01R\busername\x88\x01\x01B\x0e\n" +
+	"\busername\x18\x02 \x01(\tH\x01R\busername\x88\x01\x01\x12\x14\n" +
+	"\x05async\x18\x04 \x01(\bR\x05asyncB\x0e\n" +
 	"\f_profileNameB\v\n" +
 	"\t_usernameJ\x04\b\x03\x10\x04\"\f\n" +
 	"\n" +
@@ -6569,13 +7083,14 @@ const file_daemon_proto_rawDesc = "" +
 	"\x11getFullPeerStatus\x18\x01 \x01(\bR\x11getFullPeerStatus\x12(\n" +
 	"\x0fshouldRunProbes\x18\x02 \x01(\bR\x0fshouldRunProbes\x12'\n" +
 	"\fwaitForReady\x18\x03 \x01(\bH\x00R\fwaitForReady\x88\x01\x01B\x0f\n" +
-	"\r_waitForReady\"\x82\x01\n" +
+	"\r_waitForReady\"\xca\x01\n" +
 	"\x0eStatusResponse\x12\x16\n" +
 	"\x06status\x18\x01 \x01(\tR\x06status\x122\n" +
 	"\n" +
 	"fullStatus\x18\x02 \x01(\v2\x12.daemon.FullStatusR\n" +
 	"fullStatus\x12$\n" +
-	"\rdaemonVersion\x18\x03 \x01(\tR\rdaemonVersion\"\r\n" +
+	"\rdaemonVersion\x18\x03 \x01(\tR\rdaemonVersion\x12F\n" +
+	"\x10sessionExpiresAt\x18\x04 \x01(\v2\x1a.google.protobuf.TimestampR\x10sessionExpiresAt\"\r\n" +
 	"\vDownRequest\"\x0e\n" +
 	"\fDownResponse\"P\n" +
 	"\x10GetConfigRequest\x12 \n" +
@@ -6676,7 +7191,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\fportForwards\x18\x05 \x03(\tR\fportForwards\"^\n" +
 	"\x0eSSHServerState\x12\x18\n" +
 	"\aenabled\x18\x01 \x01(\bR\aenabled\x122\n" +
-	"\bsessions\x18\x02 \x03(\v2\x16.daemon.SSHSessionInfoR\bsessions\"\xaf\x04\n" +
+	"\bsessions\x18\x02 \x03(\v2\x16.daemon.SSHSessionInfoR\bsessions\"\xdb\x04\n" +
 	"\n" +
 	"FullStatus\x12A\n" +
 	"\x0fmanagementState\x18\x01 \x01(\v2\x17.daemon.ManagementStateR\x0fmanagementState\x125\n" +
@@ -6690,7 +7205,8 @@ const file_daemon_proto_rawDesc = "" +
 	"\x06events\x18\a \x03(\v2\x13.daemon.SystemEventR\x06events\x124\n" +
 	"\x15lazyConnectionEnabled\x18\t \x01(\bR\x15lazyConnectionEnabled\x12>\n" +
 	"\x0esshServerState\x18\n" +
-	" \x01(\v2\x16.daemon.SSHServerStateR\x0esshServerState\"\x15\n" +
+	" \x01(\v2\x16.daemon.SSHServerStateR\x0esshServerState\x12*\n" +
+	"\x10networksRevision\x18\v \x01(\x04R\x10networksRevision\"\x15\n" +
 	"\x13ListNetworksRequest\"?\n" +
 	"\x14ListNetworksResponse\x12'\n" +
 	"\x06routes\x18\x01 \x03(\v2\x0f.daemon.NetworkR\x06routes\"a\n" +
@@ -6746,7 +7262,10 @@ const file_daemon_proto_rawDesc = "" +
 	"\x05level\x18\x01 \x01(\x0e2\x10.daemon.LogLevelR\x05level\"<\n" +
 	"\x12SetLogLevelRequest\x12&\n" +
 	"\x05level\x18\x01 \x01(\x0e2\x10.daemon.LogLevelR\x05level\"\x15\n" +
-	"\x13SetLogLevelResponse\"\x1b\n" +
+	"\x13SetLogLevelResponse\"*\n" +
+	"\x14RegisterUILogRequest\x12\x12\n" +
+	"\x04path\x18\x01 \x01(\tR\x04path\"\x17\n" +
+	"\x15RegisterUILogResponse\"\x1b\n" +
 	"\x05State\x12\x12\n" +
 	"\x04name\x18\x01 \x01(\tR\x04name\"\x13\n" +
 	"\x11ListStatesRequest\";\n" +
@@ -6935,12 +7454,16 @@ const file_daemon_proto_rawDesc = "" +
 	"\busername\x18\x02 \x01(\tH\x01R\busername\x88\x01\x01B\x0e\n" +
 	"\f_profileNameB\v\n" +
 	"\t_username\"\x10\n" +
-	"\x0eLogoutResponse\"\x14\n" +
-	"\x12GetFeaturesRequest\"\xa3\x01\n" +
+	"\x0eLogoutResponse\"\x15\n" +
+	"\x13WailsUIReadyRequest\"\x16\n" +
+	"\x14WailsUIReadyResponse\"\x14\n" +
+	"\x12GetFeaturesRequest\"\xf6\x01\n" +
 	"\x13GetFeaturesResponse\x12)\n" +
 	"\x10disable_profiles\x18\x01 \x01(\bR\x0fdisableProfiles\x126\n" +
 	"\x17disable_update_settings\x18\x02 \x01(\bR\x15disableUpdateSettings\x12)\n" +
-	"\x10disable_networks\x18\x03 \x01(\bR\x0fdisableNetworks\"3\n" +
+	"\x10disable_networks\x18\x03 \x01(\bR\x0fdisableNetworks\x127\n" +
+	"\x15disable_advanced_view\x18\x04 \x01(\bH\x00R\x13disableAdvancedView\x88\x01\x01B\x18\n" +
+	"\x16_disable_advanced_view\"3\n" +
 	"\x19MDMManagedFieldsViolation\x12\x16\n" +
 	"\x06fields\x18\x01 \x03(\tR\x06fields\"\x16\n" +
 	"\x14TriggerUpdateRequest\"M\n" +
@@ -6977,7 +7500,27 @@ const file_daemon_proto_rawDesc = "" +
 	"\x14WaitJWTTokenResponse\x12\x14\n" +
 	"\x05token\x18\x01 \x01(\tR\x05token\x12\x1c\n" +
 	"\ttokenType\x18\x02 \x01(\tR\ttokenType\x12\x1c\n" +
-	"\texpiresIn\x18\x03 \x01(\x03R\texpiresIn\"\x18\n" +
+	"\texpiresIn\x18\x03 \x01(\x03R\texpiresIn\"C\n" +
+	"\x1fRequestExtendAuthSessionRequest\x12\x17\n" +
+	"\x04hint\x18\x01 \x01(\tH\x00R\x04hint\x88\x01\x01B\a\n" +
+	"\x05_hint\"\xe0\x01\n" +
+	" RequestExtendAuthSessionResponse\x12(\n" +
+	"\x0fverificationURI\x18\x01 \x01(\tR\x0fverificationURI\x128\n" +
+	"\x17verificationURIComplete\x18\x02 \x01(\tR\x17verificationURIComplete\x12\x1a\n" +
+	"\buserCode\x18\x03 \x01(\tR\buserCode\x12\x1e\n" +
+	"\n" +
+	"deviceCode\x18\x04 \x01(\tR\n" +
+	"deviceCode\x12\x1c\n" +
+	"\texpiresIn\x18\x05 \x01(\x03R\texpiresIn\"Z\n" +
+	"\x1cWaitExtendAuthSessionRequest\x12\x1e\n" +
+	"\n" +
+	"deviceCode\x18\x01 \x01(\tR\n" +
+	"deviceCode\x12\x1a\n" +
+	"\buserCode\x18\x02 \x01(\tR\buserCode\"g\n" +
+	"\x1dWaitExtendAuthSessionResponse\x12F\n" +
+	"\x10sessionExpiresAt\x18\x01 \x01(\v2\x1a.google.protobuf.TimestampR\x10sessionExpiresAt\"\x1e\n" +
+	"\x1cDismissSessionWarningRequest\"\x1f\n" +
+	"\x1dDismissSessionWarningResponse\"\x18\n" +
 	"\x16StartCPUProfileRequest\"\x19\n" +
 	"\x17StartCPUProfileResponse\"\x17\n" +
 	"\x15StopCPUProfileRequest\"\x18\n" +
@@ -7040,12 +7583,13 @@ const file_daemon_proto_rawDesc = "" +
 	"\n" +
 	"EXPOSE_UDP\x10\x03\x12\x0e\n" +
 	"\n" +
-	"EXPOSE_TLS\x10\x042\xff\x17\n" +
+	"EXPOSE_TLS\x10\x042\xa3\x1c\n" +
 	"\rDaemonService\x126\n" +
 	"\x05Login\x12\x14.daemon.LoginRequest\x1a\x15.daemon.LoginResponse\"\x00\x12K\n" +
 	"\fWaitSSOLogin\x12\x1b.daemon.WaitSSOLoginRequest\x1a\x1c.daemon.WaitSSOLoginResponse\"\x00\x12-\n" +
 	"\x02Up\x12\x11.daemon.UpRequest\x1a\x12.daemon.UpResponse\"\x00\x129\n" +
-	"\x06Status\x12\x15.daemon.StatusRequest\x1a\x16.daemon.StatusResponse\"\x00\x123\n" +
+	"\x06Status\x12\x15.daemon.StatusRequest\x1a\x16.daemon.StatusResponse\"\x00\x12D\n" +
+	"\x0fSubscribeStatus\x12\x15.daemon.StatusRequest\x1a\x16.daemon.StatusResponse\"\x000\x01\x123\n" +
 	"\x04Down\x12\x13.daemon.DownRequest\x1a\x14.daemon.DownResponse\"\x00\x12B\n" +
 	"\tGetConfig\x12\x18.daemon.GetConfigRequest\x1a\x19.daemon.GetConfigResponse\"\x00\x12K\n" +
 	"\fListNetworks\x12\x1b.daemon.ListNetworksRequest\x1a\x1c.daemon.ListNetworksResponse\"\x00\x12Q\n" +
@@ -7067,6 +7611,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\x11StopBundleCapture\x12 .daemon.StopBundleCaptureRequest\x1a!.daemon.StopBundleCaptureResponse\"\x00\x12D\n" +
 	"\x0fSubscribeEvents\x12\x18.daemon.SubscribeRequest\x1a\x13.daemon.SystemEvent\"\x000\x01\x12B\n" +
 	"\tGetEvents\x12\x18.daemon.GetEventsRequest\x1a\x19.daemon.GetEventsResponse\"\x00\x12N\n" +
+	"\rRegisterUILog\x12\x1c.daemon.RegisterUILogRequest\x1a\x1d.daemon.RegisterUILogResponse\"\x00\x12N\n" +
 	"\rSwitchProfile\x12\x1c.daemon.SwitchProfileRequest\x1a\x1d.daemon.SwitchProfileResponse\"\x00\x12B\n" +
 	"\tSetConfig\x12\x18.daemon.SetConfigRequest\x1a\x19.daemon.SetConfigResponse\"\x00\x12E\n" +
 	"\n" +
@@ -7080,11 +7625,15 @@ const file_daemon_proto_rawDesc = "" +
 	"\rTriggerUpdate\x12\x1c.daemon.TriggerUpdateRequest\x1a\x1d.daemon.TriggerUpdateResponse\"\x00\x12Z\n" +
 	"\x11GetPeerSSHHostKey\x12 .daemon.GetPeerSSHHostKeyRequest\x1a!.daemon.GetPeerSSHHostKeyResponse\"\x00\x12Q\n" +
 	"\x0eRequestJWTAuth\x12\x1d.daemon.RequestJWTAuthRequest\x1a\x1e.daemon.RequestJWTAuthResponse\"\x00\x12K\n" +
-	"\fWaitJWTToken\x12\x1b.daemon.WaitJWTTokenRequest\x1a\x1c.daemon.WaitJWTTokenResponse\"\x00\x12T\n" +
+	"\fWaitJWTToken\x12\x1b.daemon.WaitJWTTokenRequest\x1a\x1c.daemon.WaitJWTTokenResponse\"\x00\x12o\n" +
+	"\x18RequestExtendAuthSession\x12'.daemon.RequestExtendAuthSessionRequest\x1a(.daemon.RequestExtendAuthSessionResponse\"\x00\x12f\n" +
+	"\x15WaitExtendAuthSession\x12$.daemon.WaitExtendAuthSessionRequest\x1a%.daemon.WaitExtendAuthSessionResponse\"\x00\x12f\n" +
+	"\x15DismissSessionWarning\x12$.daemon.DismissSessionWarningRequest\x1a%.daemon.DismissSessionWarningResponse\"\x00\x12T\n" +
 	"\x0fStartCPUProfile\x12\x1e.daemon.StartCPUProfileRequest\x1a\x1f.daemon.StartCPUProfileResponse\"\x00\x12Q\n" +
 	"\x0eStopCPUProfile\x12\x1d.daemon.StopCPUProfileRequest\x1a\x1e.daemon.StopCPUProfileResponse\"\x00\x12W\n" +
 	"\x12GetInstallerResult\x12\x1e.daemon.InstallerResultRequest\x1a\x1f.daemon.InstallerResultResponse\"\x00\x12M\n" +
-	"\rExposeService\x12\x1c.daemon.ExposeServiceRequest\x1a\x1a.daemon.ExposeServiceEvent\"\x000\x01B\bZ\x06/protob\x06proto3"
+	"\rExposeService\x12\x1c.daemon.ExposeServiceRequest\x1a\x1a.daemon.ExposeServiceEvent\"\x000\x01\x12K\n" +
+	"\fWailsUIReady\x12\x1b.daemon.WailsUIReadyRequest\x1a\x1c.daemon.WailsUIReadyResponse\"\x00B\bZ\x06/protob\x06proto3"
 
 var (
 	file_daemon_proto_rawDescOnce sync.Once
@@ -7099,7 +7648,7 @@ func file_daemon_proto_rawDescGZIP() []byte {
 }
 
 var file_daemon_proto_enumTypes = make([]protoimpl.EnumInfo, 4)
-var file_daemon_proto_msgTypes = make([]protoimpl.MessageInfo, 100)
+var file_daemon_proto_msgTypes = make([]protoimpl.MessageInfo, 110)
 var file_daemon_proto_goTypes = []any{
 	(LogLevel)(0),                              // 0: daemon.LogLevel
 	(ExposeProtocol)(0),                        // 1: daemon.ExposeProtocol
@@ -7142,195 +7691,219 @@ var file_daemon_proto_goTypes = []any{
 	(*GetLogLevelResponse)(nil),                // 38: daemon.GetLogLevelResponse
 	(*SetLogLevelRequest)(nil),                 // 39: daemon.SetLogLevelRequest
 	(*SetLogLevelResponse)(nil),                // 40: daemon.SetLogLevelResponse
-	(*State)(nil),                              // 41: daemon.State
-	(*ListStatesRequest)(nil),                  // 42: daemon.ListStatesRequest
-	(*ListStatesResponse)(nil),                 // 43: daemon.ListStatesResponse
-	(*CleanStateRequest)(nil),                  // 44: daemon.CleanStateRequest
-	(*CleanStateResponse)(nil),                 // 45: daemon.CleanStateResponse
-	(*DeleteStateRequest)(nil),                 // 46: daemon.DeleteStateRequest
-	(*DeleteStateResponse)(nil),                // 47: daemon.DeleteStateResponse
-	(*SetSyncResponsePersistenceRequest)(nil),  // 48: daemon.SetSyncResponsePersistenceRequest
-	(*SetSyncResponsePersistenceResponse)(nil), // 49: daemon.SetSyncResponsePersistenceResponse
-	(*TCPFlags)(nil),                           // 50: daemon.TCPFlags
-	(*TracePacketRequest)(nil),                 // 51: daemon.TracePacketRequest
-	(*TraceStage)(nil),                         // 52: daemon.TraceStage
-	(*TracePacketResponse)(nil),                // 53: daemon.TracePacketResponse
-	(*SubscribeRequest)(nil),                   // 54: daemon.SubscribeRequest
-	(*SystemEvent)(nil),                        // 55: daemon.SystemEvent
-	(*GetEventsRequest)(nil),                   // 56: daemon.GetEventsRequest
-	(*GetEventsResponse)(nil),                  // 57: daemon.GetEventsResponse
-	(*SwitchProfileRequest)(nil),               // 58: daemon.SwitchProfileRequest
-	(*SwitchProfileResponse)(nil),              // 59: daemon.SwitchProfileResponse
-	(*SetConfigRequest)(nil),                   // 60: daemon.SetConfigRequest
-	(*SetConfigResponse)(nil),                  // 61: daemon.SetConfigResponse
-	(*AddProfileRequest)(nil),                  // 62: daemon.AddProfileRequest
-	(*AddProfileResponse)(nil),                 // 63: daemon.AddProfileResponse
-	(*RenameProfileRequest)(nil),               // 64: daemon.RenameProfileRequest
-	(*RenameProfileResponse)(nil),              // 65: daemon.RenameProfileResponse
-	(*RemoveProfileRequest)(nil),               // 66: daemon.RemoveProfileRequest
-	(*RemoveProfileResponse)(nil),              // 67: daemon.RemoveProfileResponse
-	(*ListProfilesRequest)(nil),                // 68: daemon.ListProfilesRequest
-	(*ListProfilesResponse)(nil),               // 69: daemon.ListProfilesResponse
-	(*Profile)(nil),                            // 70: daemon.Profile
-	(*GetActiveProfileRequest)(nil),            // 71: daemon.GetActiveProfileRequest
-	(*GetActiveProfileResponse)(nil),           // 72: daemon.GetActiveProfileResponse
-	(*LogoutRequest)(nil),                      // 73: daemon.LogoutRequest
-	(*LogoutResponse)(nil),                     // 74: daemon.LogoutResponse
-	(*GetFeaturesRequest)(nil),                 // 75: daemon.GetFeaturesRequest
-	(*GetFeaturesResponse)(nil),                // 76: daemon.GetFeaturesResponse
-	(*MDMManagedFieldsViolation)(nil),          // 77: daemon.MDMManagedFieldsViolation
-	(*TriggerUpdateRequest)(nil),               // 78: daemon.TriggerUpdateRequest
-	(*TriggerUpdateResponse)(nil),              // 79: daemon.TriggerUpdateResponse
-	(*GetPeerSSHHostKeyRequest)(nil),           // 80: daemon.GetPeerSSHHostKeyRequest
-	(*GetPeerSSHHostKeyResponse)(nil),          // 81: daemon.GetPeerSSHHostKeyResponse
-	(*RequestJWTAuthRequest)(nil),              // 82: daemon.RequestJWTAuthRequest
-	(*RequestJWTAuthResponse)(nil),             // 83: daemon.RequestJWTAuthResponse
-	(*WaitJWTTokenRequest)(nil),                // 84: daemon.WaitJWTTokenRequest
-	(*WaitJWTTokenResponse)(nil),               // 85: daemon.WaitJWTTokenResponse
-	(*StartCPUProfileRequest)(nil),             // 86: daemon.StartCPUProfileRequest
-	(*StartCPUProfileResponse)(nil),            // 87: daemon.StartCPUProfileResponse
-	(*StopCPUProfileRequest)(nil),              // 88: daemon.StopCPUProfileRequest
-	(*StopCPUProfileResponse)(nil),             // 89: daemon.StopCPUProfileResponse
-	(*InstallerResultRequest)(nil),             // 90: daemon.InstallerResultRequest
-	(*InstallerResultResponse)(nil),            // 91: daemon.InstallerResultResponse
-	(*ExposeServiceRequest)(nil),               // 92: daemon.ExposeServiceRequest
-	(*ExposeServiceEvent)(nil),                 // 93: daemon.ExposeServiceEvent
-	(*ExposeServiceReady)(nil),                 // 94: daemon.ExposeServiceReady
-	(*StartCaptureRequest)(nil),                // 95: daemon.StartCaptureRequest
-	(*CapturePacket)(nil),                      // 96: daemon.CapturePacket
-	(*StartBundleCaptureRequest)(nil),          // 97: daemon.StartBundleCaptureRequest
-	(*StartBundleCaptureResponse)(nil),         // 98: daemon.StartBundleCaptureResponse
-	(*StopBundleCaptureRequest)(nil),           // 99: daemon.StopBundleCaptureRequest
-	(*StopBundleCaptureResponse)(nil),          // 100: daemon.StopBundleCaptureResponse
-	nil,                                        // 101: daemon.Network.ResolvedIPsEntry
-	(*PortInfo_Range)(nil),                     // 102: daemon.PortInfo.Range
-	nil,                                        // 103: daemon.SystemEvent.MetadataEntry
-	(*durationpb.Duration)(nil),                // 104: google.protobuf.Duration
-	(*timestamppb.Timestamp)(nil),              // 105: google.protobuf.Timestamp
+	(*RegisterUILogRequest)(nil),               // 41: daemon.RegisterUILogRequest
+	(*RegisterUILogResponse)(nil),              // 42: daemon.RegisterUILogResponse
+	(*State)(nil),                              // 43: daemon.State
+	(*ListStatesRequest)(nil),                  // 44: daemon.ListStatesRequest
+	(*ListStatesResponse)(nil),                 // 45: daemon.ListStatesResponse
+	(*CleanStateRequest)(nil),                  // 46: daemon.CleanStateRequest
+	(*CleanStateResponse)(nil),                 // 47: daemon.CleanStateResponse
+	(*DeleteStateRequest)(nil),                 // 48: daemon.DeleteStateRequest
+	(*DeleteStateResponse)(nil),                // 49: daemon.DeleteStateResponse
+	(*SetSyncResponsePersistenceRequest)(nil),  // 50: daemon.SetSyncResponsePersistenceRequest
+	(*SetSyncResponsePersistenceResponse)(nil), // 51: daemon.SetSyncResponsePersistenceResponse
+	(*TCPFlags)(nil),                           // 52: daemon.TCPFlags
+	(*TracePacketRequest)(nil),                 // 53: daemon.TracePacketRequest
+	(*TraceStage)(nil),                         // 54: daemon.TraceStage
+	(*TracePacketResponse)(nil),                // 55: daemon.TracePacketResponse
+	(*SubscribeRequest)(nil),                   // 56: daemon.SubscribeRequest
+	(*SystemEvent)(nil),                        // 57: daemon.SystemEvent
+	(*GetEventsRequest)(nil),                   // 58: daemon.GetEventsRequest
+	(*GetEventsResponse)(nil),                  // 59: daemon.GetEventsResponse
+	(*SwitchProfileRequest)(nil),               // 60: daemon.SwitchProfileRequest
+	(*SwitchProfileResponse)(nil),              // 61: daemon.SwitchProfileResponse
+	(*SetConfigRequest)(nil),                   // 62: daemon.SetConfigRequest
+	(*SetConfigResponse)(nil),                  // 63: daemon.SetConfigResponse
+	(*AddProfileRequest)(nil),                  // 64: daemon.AddProfileRequest
+	(*AddProfileResponse)(nil),                 // 65: daemon.AddProfileResponse
+	(*RenameProfileRequest)(nil),               // 66: daemon.RenameProfileRequest
+	(*RenameProfileResponse)(nil),              // 67: daemon.RenameProfileResponse
+	(*RemoveProfileRequest)(nil),               // 68: daemon.RemoveProfileRequest
+	(*RemoveProfileResponse)(nil),              // 69: daemon.RemoveProfileResponse
+	(*ListProfilesRequest)(nil),                // 70: daemon.ListProfilesRequest
+	(*ListProfilesResponse)(nil),               // 71: daemon.ListProfilesResponse
+	(*Profile)(nil),                            // 72: daemon.Profile
+	(*GetActiveProfileRequest)(nil),            // 73: daemon.GetActiveProfileRequest
+	(*GetActiveProfileResponse)(nil),           // 74: daemon.GetActiveProfileResponse
+	(*LogoutRequest)(nil),                      // 75: daemon.LogoutRequest
+	(*LogoutResponse)(nil),                     // 76: daemon.LogoutResponse
+	(*WailsUIReadyRequest)(nil),                // 77: daemon.WailsUIReadyRequest
+	(*WailsUIReadyResponse)(nil),               // 78: daemon.WailsUIReadyResponse
+	(*GetFeaturesRequest)(nil),                 // 79: daemon.GetFeaturesRequest
+	(*GetFeaturesResponse)(nil),                // 80: daemon.GetFeaturesResponse
+	(*MDMManagedFieldsViolation)(nil),          // 81: daemon.MDMManagedFieldsViolation
+	(*TriggerUpdateRequest)(nil),               // 82: daemon.TriggerUpdateRequest
+	(*TriggerUpdateResponse)(nil),              // 83: daemon.TriggerUpdateResponse
+	(*GetPeerSSHHostKeyRequest)(nil),           // 84: daemon.GetPeerSSHHostKeyRequest
+	(*GetPeerSSHHostKeyResponse)(nil),          // 85: daemon.GetPeerSSHHostKeyResponse
+	(*RequestJWTAuthRequest)(nil),              // 86: daemon.RequestJWTAuthRequest
+	(*RequestJWTAuthResponse)(nil),             // 87: daemon.RequestJWTAuthResponse
+	(*WaitJWTTokenRequest)(nil),                // 88: daemon.WaitJWTTokenRequest
+	(*WaitJWTTokenResponse)(nil),               // 89: daemon.WaitJWTTokenResponse
+	(*RequestExtendAuthSessionRequest)(nil),    // 90: daemon.RequestExtendAuthSessionRequest
+	(*RequestExtendAuthSessionResponse)(nil),   // 91: daemon.RequestExtendAuthSessionResponse
+	(*WaitExtendAuthSessionRequest)(nil),       // 92: daemon.WaitExtendAuthSessionRequest
+	(*WaitExtendAuthSessionResponse)(nil),      // 93: daemon.WaitExtendAuthSessionResponse
+	(*DismissSessionWarningRequest)(nil),       // 94: daemon.DismissSessionWarningRequest
+	(*DismissSessionWarningResponse)(nil),      // 95: daemon.DismissSessionWarningResponse
+	(*StartCPUProfileRequest)(nil),             // 96: daemon.StartCPUProfileRequest
+	(*StartCPUProfileResponse)(nil),            // 97: daemon.StartCPUProfileResponse
+	(*StopCPUProfileRequest)(nil),              // 98: daemon.StopCPUProfileRequest
+	(*StopCPUProfileResponse)(nil),             // 99: daemon.StopCPUProfileResponse
+	(*InstallerResultRequest)(nil),             // 100: daemon.InstallerResultRequest
+	(*InstallerResultResponse)(nil),            // 101: daemon.InstallerResultResponse
+	(*ExposeServiceRequest)(nil),               // 102: daemon.ExposeServiceRequest
+	(*ExposeServiceEvent)(nil),                 // 103: daemon.ExposeServiceEvent
+	(*ExposeServiceReady)(nil),                 // 104: daemon.ExposeServiceReady
+	(*StartCaptureRequest)(nil),                // 105: daemon.StartCaptureRequest
+	(*CapturePacket)(nil),                      // 106: daemon.CapturePacket
+	(*StartBundleCaptureRequest)(nil),          // 107: daemon.StartBundleCaptureRequest
+	(*StartBundleCaptureResponse)(nil),         // 108: daemon.StartBundleCaptureResponse
+	(*StopBundleCaptureRequest)(nil),           // 109: daemon.StopBundleCaptureRequest
+	(*StopBundleCaptureResponse)(nil),          // 110: daemon.StopBundleCaptureResponse
+	nil,                                        // 111: daemon.Network.ResolvedIPsEntry
+	(*PortInfo_Range)(nil),                     // 112: daemon.PortInfo.Range
+	nil,                                        // 113: daemon.SystemEvent.MetadataEntry
+	(*durationpb.Duration)(nil),                // 114: google.protobuf.Duration
+	(*timestamppb.Timestamp)(nil),              // 115: google.protobuf.Timestamp
 }
 var file_daemon_proto_depIdxs = []int32{
-	104, // 0: daemon.LoginRequest.dnsRouteInterval:type_name -> google.protobuf.Duration
+	114, // 0: daemon.LoginRequest.dnsRouteInterval:type_name -> google.protobuf.Duration
 	25,  // 1: daemon.StatusResponse.fullStatus:type_name -> daemon.FullStatus
-	105, // 2: daemon.PeerState.connStatusUpdate:type_name -> google.protobuf.Timestamp
-	105, // 3: daemon.PeerState.lastWireguardHandshake:type_name -> google.protobuf.Timestamp
-	104, // 4: daemon.PeerState.latency:type_name -> google.protobuf.Duration
-	23,  // 5: daemon.SSHServerState.sessions:type_name -> daemon.SSHSessionInfo
-	20,  // 6: daemon.FullStatus.managementState:type_name -> daemon.ManagementState
-	19,  // 7: daemon.FullStatus.signalState:type_name -> daemon.SignalState
-	18,  // 8: daemon.FullStatus.localPeerState:type_name -> daemon.LocalPeerState
-	17,  // 9: daemon.FullStatus.peers:type_name -> daemon.PeerState
-	21,  // 10: daemon.FullStatus.relays:type_name -> daemon.RelayState
-	22,  // 11: daemon.FullStatus.dns_servers:type_name -> daemon.NSGroupState
-	55,  // 12: daemon.FullStatus.events:type_name -> daemon.SystemEvent
-	24,  // 13: daemon.FullStatus.sshServerState:type_name -> daemon.SSHServerState
-	31,  // 14: daemon.ListNetworksResponse.routes:type_name -> daemon.Network
-	101, // 15: daemon.Network.resolvedIPs:type_name -> daemon.Network.ResolvedIPsEntry
-	102, // 16: daemon.PortInfo.range:type_name -> daemon.PortInfo.Range
-	32,  // 17: daemon.ForwardingRule.destinationPort:type_name -> daemon.PortInfo
-	32,  // 18: daemon.ForwardingRule.translatedPort:type_name -> daemon.PortInfo
-	33,  // 19: daemon.ForwardingRulesResponse.rules:type_name -> daemon.ForwardingRule
-	0,   // 20: daemon.GetLogLevelResponse.level:type_name -> daemon.LogLevel
-	0,   // 21: daemon.SetLogLevelRequest.level:type_name -> daemon.LogLevel
-	41,  // 22: daemon.ListStatesResponse.states:type_name -> daemon.State
-	50,  // 23: daemon.TracePacketRequest.tcp_flags:type_name -> daemon.TCPFlags
-	52,  // 24: daemon.TracePacketResponse.stages:type_name -> daemon.TraceStage
-	2,   // 25: daemon.SystemEvent.severity:type_name -> daemon.SystemEvent.Severity
-	3,   // 26: daemon.SystemEvent.category:type_name -> daemon.SystemEvent.Category
-	105, // 27: daemon.SystemEvent.timestamp:type_name -> google.protobuf.Timestamp
-	103, // 28: daemon.SystemEvent.metadata:type_name -> daemon.SystemEvent.MetadataEntry
-	55,  // 29: daemon.GetEventsResponse.events:type_name -> daemon.SystemEvent
-	104, // 30: daemon.SetConfigRequest.dnsRouteInterval:type_name -> google.protobuf.Duration
-	70,  // 31: daemon.ListProfilesResponse.profiles:type_name -> daemon.Profile
-	1,   // 32: daemon.ExposeServiceRequest.protocol:type_name -> daemon.ExposeProtocol
-	94,  // 33: daemon.ExposeServiceEvent.ready:type_name -> daemon.ExposeServiceReady
-	104, // 34: daemon.StartCaptureRequest.duration:type_name -> google.protobuf.Duration
-	104, // 35: daemon.StartBundleCaptureRequest.timeout:type_name -> google.protobuf.Duration
-	30,  // 36: daemon.Network.ResolvedIPsEntry.value:type_name -> daemon.IPList
-	5,   // 37: daemon.DaemonService.Login:input_type -> daemon.LoginRequest
-	7,   // 38: daemon.DaemonService.WaitSSOLogin:input_type -> daemon.WaitSSOLoginRequest
-	9,   // 39: daemon.DaemonService.Up:input_type -> daemon.UpRequest
-	11,  // 40: daemon.DaemonService.Status:input_type -> daemon.StatusRequest
-	13,  // 41: daemon.DaemonService.Down:input_type -> daemon.DownRequest
-	15,  // 42: daemon.DaemonService.GetConfig:input_type -> daemon.GetConfigRequest
-	26,  // 43: daemon.DaemonService.ListNetworks:input_type -> daemon.ListNetworksRequest
-	28,  // 44: daemon.DaemonService.SelectNetworks:input_type -> daemon.SelectNetworksRequest
-	28,  // 45: daemon.DaemonService.DeselectNetworks:input_type -> daemon.SelectNetworksRequest
-	4,   // 46: daemon.DaemonService.ForwardingRules:input_type -> daemon.EmptyRequest
-	35,  // 47: daemon.DaemonService.DebugBundle:input_type -> daemon.DebugBundleRequest
-	37,  // 48: daemon.DaemonService.GetLogLevel:input_type -> daemon.GetLogLevelRequest
-	39,  // 49: daemon.DaemonService.SetLogLevel:input_type -> daemon.SetLogLevelRequest
-	42,  // 50: daemon.DaemonService.ListStates:input_type -> daemon.ListStatesRequest
-	44,  // 51: daemon.DaemonService.CleanState:input_type -> daemon.CleanStateRequest
-	46,  // 52: daemon.DaemonService.DeleteState:input_type -> daemon.DeleteStateRequest
-	48,  // 53: daemon.DaemonService.SetSyncResponsePersistence:input_type -> daemon.SetSyncResponsePersistenceRequest
-	51,  // 54: daemon.DaemonService.TracePacket:input_type -> daemon.TracePacketRequest
-	95,  // 55: daemon.DaemonService.StartCapture:input_type -> daemon.StartCaptureRequest
-	97,  // 56: daemon.DaemonService.StartBundleCapture:input_type -> daemon.StartBundleCaptureRequest
-	99,  // 57: daemon.DaemonService.StopBundleCapture:input_type -> daemon.StopBundleCaptureRequest
-	54,  // 58: daemon.DaemonService.SubscribeEvents:input_type -> daemon.SubscribeRequest
-	56,  // 59: daemon.DaemonService.GetEvents:input_type -> daemon.GetEventsRequest
-	58,  // 60: daemon.DaemonService.SwitchProfile:input_type -> daemon.SwitchProfileRequest
-	60,  // 61: daemon.DaemonService.SetConfig:input_type -> daemon.SetConfigRequest
-	62,  // 62: daemon.DaemonService.AddProfile:input_type -> daemon.AddProfileRequest
-	64,  // 63: daemon.DaemonService.RenameProfile:input_type -> daemon.RenameProfileRequest
-	66,  // 64: daemon.DaemonService.RemoveProfile:input_type -> daemon.RemoveProfileRequest
-	68,  // 65: daemon.DaemonService.ListProfiles:input_type -> daemon.ListProfilesRequest
-	71,  // 66: daemon.DaemonService.GetActiveProfile:input_type -> daemon.GetActiveProfileRequest
-	73,  // 67: daemon.DaemonService.Logout:input_type -> daemon.LogoutRequest
-	75,  // 68: daemon.DaemonService.GetFeatures:input_type -> daemon.GetFeaturesRequest
-	78,  // 69: daemon.DaemonService.TriggerUpdate:input_type -> daemon.TriggerUpdateRequest
-	80,  // 70: daemon.DaemonService.GetPeerSSHHostKey:input_type -> daemon.GetPeerSSHHostKeyRequest
-	82,  // 71: daemon.DaemonService.RequestJWTAuth:input_type -> daemon.RequestJWTAuthRequest
-	84,  // 72: daemon.DaemonService.WaitJWTToken:input_type -> daemon.WaitJWTTokenRequest
-	86,  // 73: daemon.DaemonService.StartCPUProfile:input_type -> daemon.StartCPUProfileRequest
-	88,  // 74: daemon.DaemonService.StopCPUProfile:input_type -> daemon.StopCPUProfileRequest
-	90,  // 75: daemon.DaemonService.GetInstallerResult:input_type -> daemon.InstallerResultRequest
-	92,  // 76: daemon.DaemonService.ExposeService:input_type -> daemon.ExposeServiceRequest
-	6,   // 77: daemon.DaemonService.Login:output_type -> daemon.LoginResponse
-	8,   // 78: daemon.DaemonService.WaitSSOLogin:output_type -> daemon.WaitSSOLoginResponse
-	10,  // 79: daemon.DaemonService.Up:output_type -> daemon.UpResponse
-	12,  // 80: daemon.DaemonService.Status:output_type -> daemon.StatusResponse
-	14,  // 81: daemon.DaemonService.Down:output_type -> daemon.DownResponse
-	16,  // 82: daemon.DaemonService.GetConfig:output_type -> daemon.GetConfigResponse
-	27,  // 83: daemon.DaemonService.ListNetworks:output_type -> daemon.ListNetworksResponse
-	29,  // 84: daemon.DaemonService.SelectNetworks:output_type -> daemon.SelectNetworksResponse
-	29,  // 85: daemon.DaemonService.DeselectNetworks:output_type -> daemon.SelectNetworksResponse
-	34,  // 86: daemon.DaemonService.ForwardingRules:output_type -> daemon.ForwardingRulesResponse
-	36,  // 87: daemon.DaemonService.DebugBundle:output_type -> daemon.DebugBundleResponse
-	38,  // 88: daemon.DaemonService.GetLogLevel:output_type -> daemon.GetLogLevelResponse
-	40,  // 89: daemon.DaemonService.SetLogLevel:output_type -> daemon.SetLogLevelResponse
-	43,  // 90: daemon.DaemonService.ListStates:output_type -> daemon.ListStatesResponse
-	45,  // 91: daemon.DaemonService.CleanState:output_type -> daemon.CleanStateResponse
-	47,  // 92: daemon.DaemonService.DeleteState:output_type -> daemon.DeleteStateResponse
-	49,  // 93: daemon.DaemonService.SetSyncResponsePersistence:output_type -> daemon.SetSyncResponsePersistenceResponse
-	53,  // 94: daemon.DaemonService.TracePacket:output_type -> daemon.TracePacketResponse
-	96,  // 95: daemon.DaemonService.StartCapture:output_type -> daemon.CapturePacket
-	98,  // 96: daemon.DaemonService.StartBundleCapture:output_type -> daemon.StartBundleCaptureResponse
-	100, // 97: daemon.DaemonService.StopBundleCapture:output_type -> daemon.StopBundleCaptureResponse
-	55,  // 98: daemon.DaemonService.SubscribeEvents:output_type -> daemon.SystemEvent
-	57,  // 99: daemon.DaemonService.GetEvents:output_type -> daemon.GetEventsResponse
-	59,  // 100: daemon.DaemonService.SwitchProfile:output_type -> daemon.SwitchProfileResponse
-	61,  // 101: daemon.DaemonService.SetConfig:output_type -> daemon.SetConfigResponse
-	63,  // 102: daemon.DaemonService.AddProfile:output_type -> daemon.AddProfileResponse
-	65,  // 103: daemon.DaemonService.RenameProfile:output_type -> daemon.RenameProfileResponse
-	67,  // 104: daemon.DaemonService.RemoveProfile:output_type -> daemon.RemoveProfileResponse
-	69,  // 105: daemon.DaemonService.ListProfiles:output_type -> daemon.ListProfilesResponse
-	72,  // 106: daemon.DaemonService.GetActiveProfile:output_type -> daemon.GetActiveProfileResponse
-	74,  // 107: daemon.DaemonService.Logout:output_type -> daemon.LogoutResponse
-	76,  // 108: daemon.DaemonService.GetFeatures:output_type -> daemon.GetFeaturesResponse
-	79,  // 109: daemon.DaemonService.TriggerUpdate:output_type -> daemon.TriggerUpdateResponse
-	81,  // 110: daemon.DaemonService.GetPeerSSHHostKey:output_type -> daemon.GetPeerSSHHostKeyResponse
-	83,  // 111: daemon.DaemonService.RequestJWTAuth:output_type -> daemon.RequestJWTAuthResponse
-	85,  // 112: daemon.DaemonService.WaitJWTToken:output_type -> daemon.WaitJWTTokenResponse
-	87,  // 113: daemon.DaemonService.StartCPUProfile:output_type -> daemon.StartCPUProfileResponse
-	89,  // 114: daemon.DaemonService.StopCPUProfile:output_type -> daemon.StopCPUProfileResponse
-	91,  // 115: daemon.DaemonService.GetInstallerResult:output_type -> daemon.InstallerResultResponse
-	93,  // 116: daemon.DaemonService.ExposeService:output_type -> daemon.ExposeServiceEvent
-	77,  // [77:117] is the sub-list for method output_type
-	37,  // [37:77] is the sub-list for method input_type
-	37,  // [37:37] is the sub-list for extension type_name
-	37,  // [37:37] is the sub-list for extension extendee
-	0,   // [0:37] is the sub-list for field type_name
+	115, // 2: daemon.StatusResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
+	115, // 3: daemon.PeerState.connStatusUpdate:type_name -> google.protobuf.Timestamp
+	115, // 4: daemon.PeerState.lastWireguardHandshake:type_name -> google.protobuf.Timestamp
+	114, // 5: daemon.PeerState.latency:type_name -> google.protobuf.Duration
+	23,  // 6: daemon.SSHServerState.sessions:type_name -> daemon.SSHSessionInfo
+	20,  // 7: daemon.FullStatus.managementState:type_name -> daemon.ManagementState
+	19,  // 8: daemon.FullStatus.signalState:type_name -> daemon.SignalState
+	18,  // 9: daemon.FullStatus.localPeerState:type_name -> daemon.LocalPeerState
+	17,  // 10: daemon.FullStatus.peers:type_name -> daemon.PeerState
+	21,  // 11: daemon.FullStatus.relays:type_name -> daemon.RelayState
+	22,  // 12: daemon.FullStatus.dns_servers:type_name -> daemon.NSGroupState
+	57,  // 13: daemon.FullStatus.events:type_name -> daemon.SystemEvent
+	24,  // 14: daemon.FullStatus.sshServerState:type_name -> daemon.SSHServerState
+	31,  // 15: daemon.ListNetworksResponse.routes:type_name -> daemon.Network
+	111, // 16: daemon.Network.resolvedIPs:type_name -> daemon.Network.ResolvedIPsEntry
+	112, // 17: daemon.PortInfo.range:type_name -> daemon.PortInfo.Range
+	32,  // 18: daemon.ForwardingRule.destinationPort:type_name -> daemon.PortInfo
+	32,  // 19: daemon.ForwardingRule.translatedPort:type_name -> daemon.PortInfo
+	33,  // 20: daemon.ForwardingRulesResponse.rules:type_name -> daemon.ForwardingRule
+	0,   // 21: daemon.GetLogLevelResponse.level:type_name -> daemon.LogLevel
+	0,   // 22: daemon.SetLogLevelRequest.level:type_name -> daemon.LogLevel
+	43,  // 23: daemon.ListStatesResponse.states:type_name -> daemon.State
+	52,  // 24: daemon.TracePacketRequest.tcp_flags:type_name -> daemon.TCPFlags
+	54,  // 25: daemon.TracePacketResponse.stages:type_name -> daemon.TraceStage
+	2,   // 26: daemon.SystemEvent.severity:type_name -> daemon.SystemEvent.Severity
+	3,   // 27: daemon.SystemEvent.category:type_name -> daemon.SystemEvent.Category
+	115, // 28: daemon.SystemEvent.timestamp:type_name -> google.protobuf.Timestamp
+	113, // 29: daemon.SystemEvent.metadata:type_name -> daemon.SystemEvent.MetadataEntry
+	57,  // 30: daemon.GetEventsResponse.events:type_name -> daemon.SystemEvent
+	114, // 31: daemon.SetConfigRequest.dnsRouteInterval:type_name -> google.protobuf.Duration
+	72,  // 32: daemon.ListProfilesResponse.profiles:type_name -> daemon.Profile
+	115, // 33: daemon.WaitExtendAuthSessionResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
+	1,   // 34: daemon.ExposeServiceRequest.protocol:type_name -> daemon.ExposeProtocol
+	104, // 35: daemon.ExposeServiceEvent.ready:type_name -> daemon.ExposeServiceReady
+	114, // 36: daemon.StartCaptureRequest.duration:type_name -> google.protobuf.Duration
+	114, // 37: daemon.StartBundleCaptureRequest.timeout:type_name -> google.protobuf.Duration
+	30,  // 38: daemon.Network.ResolvedIPsEntry.value:type_name -> daemon.IPList
+	5,   // 39: daemon.DaemonService.Login:input_type -> daemon.LoginRequest
+	7,   // 40: daemon.DaemonService.WaitSSOLogin:input_type -> daemon.WaitSSOLoginRequest
+	9,   // 41: daemon.DaemonService.Up:input_type -> daemon.UpRequest
+	11,  // 42: daemon.DaemonService.Status:input_type -> daemon.StatusRequest
+	11,  // 43: daemon.DaemonService.SubscribeStatus:input_type -> daemon.StatusRequest
+	13,  // 44: daemon.DaemonService.Down:input_type -> daemon.DownRequest
+	15,  // 45: daemon.DaemonService.GetConfig:input_type -> daemon.GetConfigRequest
+	26,  // 46: daemon.DaemonService.ListNetworks:input_type -> daemon.ListNetworksRequest
+	28,  // 47: daemon.DaemonService.SelectNetworks:input_type -> daemon.SelectNetworksRequest
+	28,  // 48: daemon.DaemonService.DeselectNetworks:input_type -> daemon.SelectNetworksRequest
+	4,   // 49: daemon.DaemonService.ForwardingRules:input_type -> daemon.EmptyRequest
+	35,  // 50: daemon.DaemonService.DebugBundle:input_type -> daemon.DebugBundleRequest
+	37,  // 51: daemon.DaemonService.GetLogLevel:input_type -> daemon.GetLogLevelRequest
+	39,  // 52: daemon.DaemonService.SetLogLevel:input_type -> daemon.SetLogLevelRequest
+	44,  // 53: daemon.DaemonService.ListStates:input_type -> daemon.ListStatesRequest
+	46,  // 54: daemon.DaemonService.CleanState:input_type -> daemon.CleanStateRequest
+	48,  // 55: daemon.DaemonService.DeleteState:input_type -> daemon.DeleteStateRequest
+	50,  // 56: daemon.DaemonService.SetSyncResponsePersistence:input_type -> daemon.SetSyncResponsePersistenceRequest
+	53,  // 57: daemon.DaemonService.TracePacket:input_type -> daemon.TracePacketRequest
+	105, // 58: daemon.DaemonService.StartCapture:input_type -> daemon.StartCaptureRequest
+	107, // 59: daemon.DaemonService.StartBundleCapture:input_type -> daemon.StartBundleCaptureRequest
+	109, // 60: daemon.DaemonService.StopBundleCapture:input_type -> daemon.StopBundleCaptureRequest
+	56,  // 61: daemon.DaemonService.SubscribeEvents:input_type -> daemon.SubscribeRequest
+	58,  // 62: daemon.DaemonService.GetEvents:input_type -> daemon.GetEventsRequest
+	41,  // 63: daemon.DaemonService.RegisterUILog:input_type -> daemon.RegisterUILogRequest
+	60,  // 64: daemon.DaemonService.SwitchProfile:input_type -> daemon.SwitchProfileRequest
+	62,  // 65: daemon.DaemonService.SetConfig:input_type -> daemon.SetConfigRequest
+	64,  // 66: daemon.DaemonService.AddProfile:input_type -> daemon.AddProfileRequest
+	66,  // 67: daemon.DaemonService.RenameProfile:input_type -> daemon.RenameProfileRequest
+	68,  // 68: daemon.DaemonService.RemoveProfile:input_type -> daemon.RemoveProfileRequest
+	70,  // 69: daemon.DaemonService.ListProfiles:input_type -> daemon.ListProfilesRequest
+	73,  // 70: daemon.DaemonService.GetActiveProfile:input_type -> daemon.GetActiveProfileRequest
+	75,  // 71: daemon.DaemonService.Logout:input_type -> daemon.LogoutRequest
+	79,  // 72: daemon.DaemonService.GetFeatures:input_type -> daemon.GetFeaturesRequest
+	82,  // 73: daemon.DaemonService.TriggerUpdate:input_type -> daemon.TriggerUpdateRequest
+	84,  // 74: daemon.DaemonService.GetPeerSSHHostKey:input_type -> daemon.GetPeerSSHHostKeyRequest
+	86,  // 75: daemon.DaemonService.RequestJWTAuth:input_type -> daemon.RequestJWTAuthRequest
+	88,  // 76: daemon.DaemonService.WaitJWTToken:input_type -> daemon.WaitJWTTokenRequest
+	90,  // 77: daemon.DaemonService.RequestExtendAuthSession:input_type -> daemon.RequestExtendAuthSessionRequest
+	92,  // 78: daemon.DaemonService.WaitExtendAuthSession:input_type -> daemon.WaitExtendAuthSessionRequest
+	94,  // 79: daemon.DaemonService.DismissSessionWarning:input_type -> daemon.DismissSessionWarningRequest
+	96,  // 80: daemon.DaemonService.StartCPUProfile:input_type -> daemon.StartCPUProfileRequest
+	98,  // 81: daemon.DaemonService.StopCPUProfile:input_type -> daemon.StopCPUProfileRequest
+	100, // 82: daemon.DaemonService.GetInstallerResult:input_type -> daemon.InstallerResultRequest
+	102, // 83: daemon.DaemonService.ExposeService:input_type -> daemon.ExposeServiceRequest
+	77,  // 84: daemon.DaemonService.WailsUIReady:input_type -> daemon.WailsUIReadyRequest
+	6,   // 85: daemon.DaemonService.Login:output_type -> daemon.LoginResponse
+	8,   // 86: daemon.DaemonService.WaitSSOLogin:output_type -> daemon.WaitSSOLoginResponse
+	10,  // 87: daemon.DaemonService.Up:output_type -> daemon.UpResponse
+	12,  // 88: daemon.DaemonService.Status:output_type -> daemon.StatusResponse
+	12,  // 89: daemon.DaemonService.SubscribeStatus:output_type -> daemon.StatusResponse
+	14,  // 90: daemon.DaemonService.Down:output_type -> daemon.DownResponse
+	16,  // 91: daemon.DaemonService.GetConfig:output_type -> daemon.GetConfigResponse
+	27,  // 92: daemon.DaemonService.ListNetworks:output_type -> daemon.ListNetworksResponse
+	29,  // 93: daemon.DaemonService.SelectNetworks:output_type -> daemon.SelectNetworksResponse
+	29,  // 94: daemon.DaemonService.DeselectNetworks:output_type -> daemon.SelectNetworksResponse
+	34,  // 95: daemon.DaemonService.ForwardingRules:output_type -> daemon.ForwardingRulesResponse
+	36,  // 96: daemon.DaemonService.DebugBundle:output_type -> daemon.DebugBundleResponse
+	38,  // 97: daemon.DaemonService.GetLogLevel:output_type -> daemon.GetLogLevelResponse
+	40,  // 98: daemon.DaemonService.SetLogLevel:output_type -> daemon.SetLogLevelResponse
+	45,  // 99: daemon.DaemonService.ListStates:output_type -> daemon.ListStatesResponse
+	47,  // 100: daemon.DaemonService.CleanState:output_type -> daemon.CleanStateResponse
+	49,  // 101: daemon.DaemonService.DeleteState:output_type -> daemon.DeleteStateResponse
+	51,  // 102: daemon.DaemonService.SetSyncResponsePersistence:output_type -> daemon.SetSyncResponsePersistenceResponse
+	55,  // 103: daemon.DaemonService.TracePacket:output_type -> daemon.TracePacketResponse
+	106, // 104: daemon.DaemonService.StartCapture:output_type -> daemon.CapturePacket
+	108, // 105: daemon.DaemonService.StartBundleCapture:output_type -> daemon.StartBundleCaptureResponse
+	110, // 106: daemon.DaemonService.StopBundleCapture:output_type -> daemon.StopBundleCaptureResponse
+	57,  // 107: daemon.DaemonService.SubscribeEvents:output_type -> daemon.SystemEvent
+	59,  // 108: daemon.DaemonService.GetEvents:output_type -> daemon.GetEventsResponse
+	42,  // 109: daemon.DaemonService.RegisterUILog:output_type -> daemon.RegisterUILogResponse
+	61,  // 110: daemon.DaemonService.SwitchProfile:output_type -> daemon.SwitchProfileResponse
+	63,  // 111: daemon.DaemonService.SetConfig:output_type -> daemon.SetConfigResponse
+	65,  // 112: daemon.DaemonService.AddProfile:output_type -> daemon.AddProfileResponse
+	67,  // 113: daemon.DaemonService.RenameProfile:output_type -> daemon.RenameProfileResponse
+	69,  // 114: daemon.DaemonService.RemoveProfile:output_type -> daemon.RemoveProfileResponse
+	71,  // 115: daemon.DaemonService.ListProfiles:output_type -> daemon.ListProfilesResponse
+	74,  // 116: daemon.DaemonService.GetActiveProfile:output_type -> daemon.GetActiveProfileResponse
+	76,  // 117: daemon.DaemonService.Logout:output_type -> daemon.LogoutResponse
+	80,  // 118: daemon.DaemonService.GetFeatures:output_type -> daemon.GetFeaturesResponse
+	83,  // 119: daemon.DaemonService.TriggerUpdate:output_type -> daemon.TriggerUpdateResponse
+	85,  // 120: daemon.DaemonService.GetPeerSSHHostKey:output_type -> daemon.GetPeerSSHHostKeyResponse
+	87,  // 121: daemon.DaemonService.RequestJWTAuth:output_type -> daemon.RequestJWTAuthResponse
+	89,  // 122: daemon.DaemonService.WaitJWTToken:output_type -> daemon.WaitJWTTokenResponse
+	91,  // 123: daemon.DaemonService.RequestExtendAuthSession:output_type -> daemon.RequestExtendAuthSessionResponse
+	93,  // 124: daemon.DaemonService.WaitExtendAuthSession:output_type -> daemon.WaitExtendAuthSessionResponse
+	95,  // 125: daemon.DaemonService.DismissSessionWarning:output_type -> daemon.DismissSessionWarningResponse
+	97,  // 126: daemon.DaemonService.StartCPUProfile:output_type -> daemon.StartCPUProfileResponse
+	99,  // 127: daemon.DaemonService.StopCPUProfile:output_type -> daemon.StopCPUProfileResponse
+	101, // 128: daemon.DaemonService.GetInstallerResult:output_type -> daemon.InstallerResultResponse
+	103, // 129: daemon.DaemonService.ExposeService:output_type -> daemon.ExposeServiceEvent
+	78,  // 130: daemon.DaemonService.WailsUIReady:output_type -> daemon.WailsUIReadyResponse
+	85,  // [85:131] is the sub-list for method output_type
+	39,  // [39:85] is the sub-list for method input_type
+	39,  // [39:39] is the sub-list for extension type_name
+	39,  // [39:39] is the sub-list for extension extendee
+	0,   // [0:39] is the sub-list for field type_name
 }
 
 func init() { file_daemon_proto_init() }
@@ -7345,13 +7918,15 @@ func file_daemon_proto_init() {
 		(*PortInfo_Port)(nil),
 		(*PortInfo_Range_)(nil),
 	}
-	file_daemon_proto_msgTypes[47].OneofWrappers = []any{}
-	file_daemon_proto_msgTypes[48].OneofWrappers = []any{}
-	file_daemon_proto_msgTypes[54].OneofWrappers = []any{}
+	file_daemon_proto_msgTypes[49].OneofWrappers = []any{}
+	file_daemon_proto_msgTypes[50].OneofWrappers = []any{}
 	file_daemon_proto_msgTypes[56].OneofWrappers = []any{}
-	file_daemon_proto_msgTypes[69].OneofWrappers = []any{}
-	file_daemon_proto_msgTypes[78].OneofWrappers = []any{}
-	file_daemon_proto_msgTypes[89].OneofWrappers = []any{
+	file_daemon_proto_msgTypes[58].OneofWrappers = []any{}
+	file_daemon_proto_msgTypes[71].OneofWrappers = []any{}
+	file_daemon_proto_msgTypes[76].OneofWrappers = []any{}
+	file_daemon_proto_msgTypes[82].OneofWrappers = []any{}
+	file_daemon_proto_msgTypes[86].OneofWrappers = []any{}
+	file_daemon_proto_msgTypes[99].OneofWrappers = []any{
 		(*ExposeServiceEvent_Ready)(nil),
 	}
 	type x struct{}
@@ -7360,7 +7935,7 @@ func file_daemon_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_daemon_proto_rawDesc), len(file_daemon_proto_rawDesc)),
 			NumEnums:      4,
-			NumMessages:   100,
+			NumMessages:   110,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/client/proto/daemon.proto b/client/proto/daemon.proto
index c1e3fe513..8d5294eb7 100644
--- a/client/proto/daemon.proto
+++ b/client/proto/daemon.proto
@@ -24,6 +24,12 @@ service DaemonService {
   // Status of the service.
   rpc Status(StatusRequest) returns (StatusResponse) {}
 
+  // SubscribeStatus pushes a fresh StatusResponse on connection state
+  // changes (Connected / Disconnected / Connecting / address change /
+  // peers list change). The first message on the stream is the current
+  // snapshot, so a freshly-subscribed UI doesn't need to also call Status.
+  rpc SubscribeStatus(StatusRequest) returns (stream StatusResponse) {}
+
   // Down stops engine work in the daemon.
   rpc Down(DownRequest) returns (DownResponse) {}
 
@@ -79,6 +85,11 @@ service DaemonService {
 
   rpc GetEvents(GetEventsRequest) returns (GetEventsResponse) {}
 
+  // RegisterUILog records the desktop UI's absolute log path so the daemon's
+  // debug bundle can collect it (the daemon runs as root and can't resolve the
+  // user's config dir).
+  rpc RegisterUILog(RegisterUILogRequest) returns (RegisterUILogResponse) {}
+
   rpc SwitchProfile(SwitchProfileRequest) returns (SwitchProfileResponse) {}
 
   rpc SetConfig(SetConfigRequest) returns (SetConfigResponse) {}
@@ -111,6 +122,25 @@ service DaemonService {
   // WaitJWTToken waits for JWT authentication completion
   rpc WaitJWTToken(WaitJWTTokenRequest) returns (WaitJWTTokenResponse) {}
 
+  // RequestExtendAuthSession initiates an SSO session-extension flow.
+  // The daemon prepares a PKCE/device-code request against the IdP and
+  // returns the verification URI; the UI is expected to open it. The flow
+  // state is kept in the daemon until WaitExtendAuthSession completes it.
+  rpc RequestExtendAuthSession(RequestExtendAuthSessionRequest) returns (RequestExtendAuthSessionResponse) {}
+
+  // WaitExtendAuthSession blocks until the user finishes the SSO step
+  // started by RequestExtendAuthSession, then forwards the resulting JWT
+  // to the management server's ExtendAuthSession RPC. Returns the new
+  // session expiry deadline. The tunnel stays up the entire time.
+  rpc WaitExtendAuthSession(WaitExtendAuthSessionRequest) returns (WaitExtendAuthSessionResponse) {}
+
+  // DismissSessionWarning records that the user clicked "Dismiss" on the
+  // T-WarningLead interactive notification, suppressing the auto-opened
+  // SessionAboutToExpire dialog that would otherwise fire at
+  // T-FinalWarningLead for the current deadline. Idempotent and best-effort:
+  // a missed call only means the fallback dialog will still appear.
+  rpc DismissSessionWarning(DismissSessionWarningRequest) returns (DismissSessionWarningResponse) {}
+
 // StartCPUProfile starts CPU profiling in the daemon
   rpc StartCPUProfile(StartCPUProfileRequest) returns (StartCPUProfileResponse) {}
 
@@ -121,6 +151,11 @@ service DaemonService {
 
   // ExposeService exposes a local port via the NetBird reverse proxy
   rpc ExposeService(ExposeServiceRequest) returns (stream ExposeServiceEvent) {}
+
+  // WailsUIReady is a no-op probe the Wails UI calls once at startup. The UI
+  // only cares whether the daemon implements it: an Unimplemented response
+  // means the daemon predates this UI and is too old to drive it.
+  rpc WailsUIReady(WailsUIReadyRequest) returns (WailsUIReadyResponse) {}
 }
 
 
@@ -229,6 +264,12 @@ message UpRequest {
   optional string profileName = 1;
   optional string username = 2;
   reserved 3;
+  // async instructs the daemon to start the connection attempt and return
+  // immediately without waiting for the engine to become ready. Status updates
+  // are delivered via the SubscribeStatus stream. When false (the default) the
+  // RPC blocks until the engine is running or gives up, which is the behaviour
+  // needed by the CLI.
+  bool async = 4;
 }
 
 message UpResponse {}
@@ -246,6 +287,10 @@ message StatusResponse{
   FullStatus fullStatus = 2;
   // NetBird daemon version
   string daemonVersion = 3;
+  // Absolute UTC instant at which the peer's SSO session expires.
+  // Unset when the peer is not SSO-registered or login expiration is disabled.
+  // The UI derives "warning active" from this value and its own clock.
+  google.protobuf.Timestamp sessionExpiresAt = 4;
 }
 
 message DownRequest {}
@@ -421,6 +466,12 @@ message FullStatus {
 
   bool lazyConnectionEnabled = 9;
   SSHServerState sshServerState = 10;
+
+  // networksRevision bumps whenever the set of routed networks (route and
+  // exit-node candidates) or their selected state changes. The UI fingerprints
+  // on it to know when to re-fetch ListNetworks via the push stream, instead
+  // of polling on every status snapshot.
+  uint64 networksRevision = 11;
 }
 
 // Networks
@@ -518,6 +569,13 @@ message SetLogLevelRequest {
 message SetLogLevelResponse {
 }
 
+message RegisterUILogRequest {
+  string path = 1;
+}
+
+message RegisterUILogResponse {
+}
+
 // State represents a daemon state entry
 message State {
   string name = 1;
@@ -771,12 +829,22 @@ message LogoutRequest {
 
 message LogoutResponse {}
 
+message WailsUIReadyRequest {}
+
+message WailsUIReadyResponse {}
+
 message GetFeaturesRequest{}
 
 message GetFeaturesResponse{
   bool disable_profiles = 1;
   bool disable_update_settings = 2;
   bool disable_networks = 3;
+  // disableAdvancedView gates the upcoming UI revision's advanced
+  // section. Tristate: unset = no MDM directive, the UI applies its
+  // own default; true = MDM enforces disable; false = MDM enforces
+  // enable. Sourced exclusively from the MDM policy — no CLI /
+  // config flag backs this value.
+  optional bool disable_advanced_view = 4;
 }
 
 // MDMManagedFieldsViolation is attached as a gRPC error detail on a
@@ -855,6 +923,55 @@ message WaitJWTTokenResponse {
   int64 expiresIn = 3;
 }
 
+// RequestExtendAuthSessionRequest kicks off the session-extension SSO flow.
+message RequestExtendAuthSessionRequest {
+  // Optional OIDC login_hint (typically the user's email) to pre-fill the
+  // IdP login form.
+  optional string hint = 1;
+}
+
+// RequestExtendAuthSessionResponse carries the verification URI the UI
+// should open in a browser. The daemon retains the flow state and resolves
+// it via WaitExtendAuthSession.
+message RequestExtendAuthSessionResponse {
+  // verification URI for the user to open in the browser
+  string verificationURI = 1;
+  // complete verification URI (with embedded user code)
+  string verificationURIComplete = 2;
+  // user code to enter on verification URI (for device-code flows)
+  string userCode = 3;
+  // device code for matching the WaitExtendAuthSession call to this flow
+  string deviceCode = 4;
+  // expiration time in seconds for the device code / PKCE flow
+  int64 expiresIn = 5;
+}
+
+// WaitExtendAuthSessionRequest is sent by the UI after it opens the
+// verification URI. The daemon blocks on this call until the user
+// completes (or aborts) the SSO step.
+message WaitExtendAuthSessionRequest {
+  // device code returned by RequestExtendAuthSession
+  string deviceCode = 1;
+  // user code for verification
+  string userCode = 2;
+}
+
+// WaitExtendAuthSessionResponse carries the refreshed deadline returned
+// by the management server. Unset when the management server reports the
+// peer is not eligible for session extension.
+message WaitExtendAuthSessionResponse {
+  google.protobuf.Timestamp sessionExpiresAt = 1;
+}
+
+// DismissSessionWarningRequest is sent by the UI when the user clicks
+// "Dismiss" on the T-WarningLead notification.
+message DismissSessionWarningRequest {}
+
+// DismissSessionWarningResponse acknowledges the dismissal. Carries no
+// payload — the daemon's only obligation is to silence the upcoming
+// T-FinalWarningLead fallback for the current deadline.
+message DismissSessionWarningResponse {}
+
 // StartCPUProfileRequest for starting CPU profiling
 message StartCPUProfileRequest {}
 
diff --git a/client/proto/daemon_grpc.pb.go b/client/proto/daemon_grpc.pb.go
index 5f585aafc..2d01d474d 100644
--- a/client/proto/daemon_grpc.pb.go
+++ b/client/proto/daemon_grpc.pb.go
@@ -23,6 +23,7 @@ const (
 	DaemonService_WaitSSOLogin_FullMethodName               = "/daemon.DaemonService/WaitSSOLogin"
 	DaemonService_Up_FullMethodName                         = "/daemon.DaemonService/Up"
 	DaemonService_Status_FullMethodName                     = "/daemon.DaemonService/Status"
+	DaemonService_SubscribeStatus_FullMethodName            = "/daemon.DaemonService/SubscribeStatus"
 	DaemonService_Down_FullMethodName                       = "/daemon.DaemonService/Down"
 	DaemonService_GetConfig_FullMethodName                  = "/daemon.DaemonService/GetConfig"
 	DaemonService_ListNetworks_FullMethodName               = "/daemon.DaemonService/ListNetworks"
@@ -42,6 +43,7 @@ const (
 	DaemonService_StopBundleCapture_FullMethodName          = "/daemon.DaemonService/StopBundleCapture"
 	DaemonService_SubscribeEvents_FullMethodName            = "/daemon.DaemonService/SubscribeEvents"
 	DaemonService_GetEvents_FullMethodName                  = "/daemon.DaemonService/GetEvents"
+	DaemonService_RegisterUILog_FullMethodName              = "/daemon.DaemonService/RegisterUILog"
 	DaemonService_SwitchProfile_FullMethodName              = "/daemon.DaemonService/SwitchProfile"
 	DaemonService_SetConfig_FullMethodName                  = "/daemon.DaemonService/SetConfig"
 	DaemonService_AddProfile_FullMethodName                 = "/daemon.DaemonService/AddProfile"
@@ -55,10 +57,14 @@ const (
 	DaemonService_GetPeerSSHHostKey_FullMethodName          = "/daemon.DaemonService/GetPeerSSHHostKey"
 	DaemonService_RequestJWTAuth_FullMethodName             = "/daemon.DaemonService/RequestJWTAuth"
 	DaemonService_WaitJWTToken_FullMethodName               = "/daemon.DaemonService/WaitJWTToken"
+	DaemonService_RequestExtendAuthSession_FullMethodName   = "/daemon.DaemonService/RequestExtendAuthSession"
+	DaemonService_WaitExtendAuthSession_FullMethodName      = "/daemon.DaemonService/WaitExtendAuthSession"
+	DaemonService_DismissSessionWarning_FullMethodName      = "/daemon.DaemonService/DismissSessionWarning"
 	DaemonService_StartCPUProfile_FullMethodName            = "/daemon.DaemonService/StartCPUProfile"
 	DaemonService_StopCPUProfile_FullMethodName             = "/daemon.DaemonService/StopCPUProfile"
 	DaemonService_GetInstallerResult_FullMethodName         = "/daemon.DaemonService/GetInstallerResult"
 	DaemonService_ExposeService_FullMethodName              = "/daemon.DaemonService/ExposeService"
+	DaemonService_WailsUIReady_FullMethodName               = "/daemon.DaemonService/WailsUIReady"
 )
 
 // DaemonServiceClient is the client API for DaemonService service.
@@ -74,6 +80,11 @@ type DaemonServiceClient interface {
 	Up(ctx context.Context, in *UpRequest, opts ...grpc.CallOption) (*UpResponse, error)
 	// Status of the service.
 	Status(ctx context.Context, in *StatusRequest, opts ...grpc.CallOption) (*StatusResponse, error)
+	// SubscribeStatus pushes a fresh StatusResponse on connection state
+	// changes (Connected / Disconnected / Connecting / address change /
+	// peers list change). The first message on the stream is the current
+	// snapshot, so a freshly-subscribed UI doesn't need to also call Status.
+	SubscribeStatus(ctx context.Context, in *StatusRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[StatusResponse], error)
 	// Down stops engine work in the daemon.
 	Down(ctx context.Context, in *DownRequest, opts ...grpc.CallOption) (*DownResponse, error)
 	// GetConfig of the daemon.
@@ -110,6 +121,10 @@ type DaemonServiceClient interface {
 	StopBundleCapture(ctx context.Context, in *StopBundleCaptureRequest, opts ...grpc.CallOption) (*StopBundleCaptureResponse, error)
 	SubscribeEvents(ctx context.Context, in *SubscribeRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[SystemEvent], error)
 	GetEvents(ctx context.Context, in *GetEventsRequest, opts ...grpc.CallOption) (*GetEventsResponse, error)
+	// RegisterUILog records the desktop UI's absolute log path so the daemon's
+	// debug bundle can collect it (the daemon runs as root and can't resolve the
+	// user's config dir).
+	RegisterUILog(ctx context.Context, in *RegisterUILogRequest, opts ...grpc.CallOption) (*RegisterUILogResponse, error)
 	SwitchProfile(ctx context.Context, in *SwitchProfileRequest, opts ...grpc.CallOption) (*SwitchProfileResponse, error)
 	SetConfig(ctx context.Context, in *SetConfigRequest, opts ...grpc.CallOption) (*SetConfigResponse, error)
 	AddProfile(ctx context.Context, in *AddProfileRequest, opts ...grpc.CallOption) (*AddProfileResponse, error)
@@ -129,6 +144,22 @@ type DaemonServiceClient interface {
 	RequestJWTAuth(ctx context.Context, in *RequestJWTAuthRequest, opts ...grpc.CallOption) (*RequestJWTAuthResponse, error)
 	// WaitJWTToken waits for JWT authentication completion
 	WaitJWTToken(ctx context.Context, in *WaitJWTTokenRequest, opts ...grpc.CallOption) (*WaitJWTTokenResponse, error)
+	// RequestExtendAuthSession initiates an SSO session-extension flow.
+	// The daemon prepares a PKCE/device-code request against the IdP and
+	// returns the verification URI; the UI is expected to open it. The flow
+	// state is kept in the daemon until WaitExtendAuthSession completes it.
+	RequestExtendAuthSession(ctx context.Context, in *RequestExtendAuthSessionRequest, opts ...grpc.CallOption) (*RequestExtendAuthSessionResponse, error)
+	// WaitExtendAuthSession blocks until the user finishes the SSO step
+	// started by RequestExtendAuthSession, then forwards the resulting JWT
+	// to the management server's ExtendAuthSession RPC. Returns the new
+	// session expiry deadline. The tunnel stays up the entire time.
+	WaitExtendAuthSession(ctx context.Context, in *WaitExtendAuthSessionRequest, opts ...grpc.CallOption) (*WaitExtendAuthSessionResponse, error)
+	// DismissSessionWarning records that the user clicked "Dismiss" on the
+	// T-WarningLead interactive notification, suppressing the auto-opened
+	// SessionAboutToExpire dialog that would otherwise fire at
+	// T-FinalWarningLead for the current deadline. Idempotent and best-effort:
+	// a missed call only means the fallback dialog will still appear.
+	DismissSessionWarning(ctx context.Context, in *DismissSessionWarningRequest, opts ...grpc.CallOption) (*DismissSessionWarningResponse, error)
 	// StartCPUProfile starts CPU profiling in the daemon
 	StartCPUProfile(ctx context.Context, in *StartCPUProfileRequest, opts ...grpc.CallOption) (*StartCPUProfileResponse, error)
 	// StopCPUProfile stops CPU profiling in the daemon
@@ -136,6 +167,10 @@ type DaemonServiceClient interface {
 	GetInstallerResult(ctx context.Context, in *InstallerResultRequest, opts ...grpc.CallOption) (*InstallerResultResponse, error)
 	// ExposeService exposes a local port via the NetBird reverse proxy
 	ExposeService(ctx context.Context, in *ExposeServiceRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[ExposeServiceEvent], error)
+	// WailsUIReady is a no-op probe the Wails UI calls once at startup. The UI
+	// only cares whether the daemon implements it: an Unimplemented response
+	// means the daemon predates this UI and is too old to drive it.
+	WailsUIReady(ctx context.Context, in *WailsUIReadyRequest, opts ...grpc.CallOption) (*WailsUIReadyResponse, error)
 }
 
 type daemonServiceClient struct {
@@ -186,6 +221,25 @@ func (c *daemonServiceClient) Status(ctx context.Context, in *StatusRequest, opt
 	return out, nil
 }
 
+func (c *daemonServiceClient) SubscribeStatus(ctx context.Context, in *StatusRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[StatusResponse], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &DaemonService_ServiceDesc.Streams[0], DaemonService_SubscribeStatus_FullMethodName, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &grpc.GenericClientStream[StatusRequest, StatusResponse]{ClientStream: stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type DaemonService_SubscribeStatusClient = grpc.ServerStreamingClient[StatusResponse]
+
 func (c *daemonServiceClient) Down(ctx context.Context, in *DownRequest, opts ...grpc.CallOption) (*DownResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DownResponse)
@@ -328,7 +382,7 @@ func (c *daemonServiceClient) TracePacket(ctx context.Context, in *TracePacketRe
 
 func (c *daemonServiceClient) StartCapture(ctx context.Context, in *StartCaptureRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[CapturePacket], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	stream, err := c.cc.NewStream(ctx, &DaemonService_ServiceDesc.Streams[0], DaemonService_StartCapture_FullMethodName, cOpts...)
+	stream, err := c.cc.NewStream(ctx, &DaemonService_ServiceDesc.Streams[1], DaemonService_StartCapture_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -367,7 +421,7 @@ func (c *daemonServiceClient) StopBundleCapture(ctx context.Context, in *StopBun
 
 func (c *daemonServiceClient) SubscribeEvents(ctx context.Context, in *SubscribeRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[SystemEvent], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	stream, err := c.cc.NewStream(ctx, &DaemonService_ServiceDesc.Streams[1], DaemonService_SubscribeEvents_FullMethodName, cOpts...)
+	stream, err := c.cc.NewStream(ctx, &DaemonService_ServiceDesc.Streams[2], DaemonService_SubscribeEvents_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -394,6 +448,16 @@ func (c *daemonServiceClient) GetEvents(ctx context.Context, in *GetEventsReques
 	return out, nil
 }
 
+func (c *daemonServiceClient) RegisterUILog(ctx context.Context, in *RegisterUILogRequest, opts ...grpc.CallOption) (*RegisterUILogResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(RegisterUILogResponse)
+	err := c.cc.Invoke(ctx, DaemonService_RegisterUILog_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *daemonServiceClient) SwitchProfile(ctx context.Context, in *SwitchProfileRequest, opts ...grpc.CallOption) (*SwitchProfileResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(SwitchProfileResponse)
@@ -524,6 +588,36 @@ func (c *daemonServiceClient) WaitJWTToken(ctx context.Context, in *WaitJWTToken
 	return out, nil
 }
 
+func (c *daemonServiceClient) RequestExtendAuthSession(ctx context.Context, in *RequestExtendAuthSessionRequest, opts ...grpc.CallOption) (*RequestExtendAuthSessionResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(RequestExtendAuthSessionResponse)
+	err := c.cc.Invoke(ctx, DaemonService_RequestExtendAuthSession_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *daemonServiceClient) WaitExtendAuthSession(ctx context.Context, in *WaitExtendAuthSessionRequest, opts ...grpc.CallOption) (*WaitExtendAuthSessionResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(WaitExtendAuthSessionResponse)
+	err := c.cc.Invoke(ctx, DaemonService_WaitExtendAuthSession_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *daemonServiceClient) DismissSessionWarning(ctx context.Context, in *DismissSessionWarningRequest, opts ...grpc.CallOption) (*DismissSessionWarningResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(DismissSessionWarningResponse)
+	err := c.cc.Invoke(ctx, DaemonService_DismissSessionWarning_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *daemonServiceClient) StartCPUProfile(ctx context.Context, in *StartCPUProfileRequest, opts ...grpc.CallOption) (*StartCPUProfileResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(StartCPUProfileResponse)
@@ -556,7 +650,7 @@ func (c *daemonServiceClient) GetInstallerResult(ctx context.Context, in *Instal
 
 func (c *daemonServiceClient) ExposeService(ctx context.Context, in *ExposeServiceRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[ExposeServiceEvent], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	stream, err := c.cc.NewStream(ctx, &DaemonService_ServiceDesc.Streams[2], DaemonService_ExposeService_FullMethodName, cOpts...)
+	stream, err := c.cc.NewStream(ctx, &DaemonService_ServiceDesc.Streams[3], DaemonService_ExposeService_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -573,6 +667,16 @@ func (c *daemonServiceClient) ExposeService(ctx context.Context, in *ExposeServi
 // This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
 type DaemonService_ExposeServiceClient = grpc.ServerStreamingClient[ExposeServiceEvent]
 
+func (c *daemonServiceClient) WailsUIReady(ctx context.Context, in *WailsUIReadyRequest, opts ...grpc.CallOption) (*WailsUIReadyResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(WailsUIReadyResponse)
+	err := c.cc.Invoke(ctx, DaemonService_WailsUIReady_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // DaemonServiceServer is the server API for DaemonService service.
 // All implementations must embed UnimplementedDaemonServiceServer
 // for forward compatibility.
@@ -586,6 +690,11 @@ type DaemonServiceServer interface {
 	Up(context.Context, *UpRequest) (*UpResponse, error)
 	// Status of the service.
 	Status(context.Context, *StatusRequest) (*StatusResponse, error)
+	// SubscribeStatus pushes a fresh StatusResponse on connection state
+	// changes (Connected / Disconnected / Connecting / address change /
+	// peers list change). The first message on the stream is the current
+	// snapshot, so a freshly-subscribed UI doesn't need to also call Status.
+	SubscribeStatus(*StatusRequest, grpc.ServerStreamingServer[StatusResponse]) error
 	// Down stops engine work in the daemon.
 	Down(context.Context, *DownRequest) (*DownResponse, error)
 	// GetConfig of the daemon.
@@ -622,6 +731,10 @@ type DaemonServiceServer interface {
 	StopBundleCapture(context.Context, *StopBundleCaptureRequest) (*StopBundleCaptureResponse, error)
 	SubscribeEvents(*SubscribeRequest, grpc.ServerStreamingServer[SystemEvent]) error
 	GetEvents(context.Context, *GetEventsRequest) (*GetEventsResponse, error)
+	// RegisterUILog records the desktop UI's absolute log path so the daemon's
+	// debug bundle can collect it (the daemon runs as root and can't resolve the
+	// user's config dir).
+	RegisterUILog(context.Context, *RegisterUILogRequest) (*RegisterUILogResponse, error)
 	SwitchProfile(context.Context, *SwitchProfileRequest) (*SwitchProfileResponse, error)
 	SetConfig(context.Context, *SetConfigRequest) (*SetConfigResponse, error)
 	AddProfile(context.Context, *AddProfileRequest) (*AddProfileResponse, error)
@@ -641,6 +754,22 @@ type DaemonServiceServer interface {
 	RequestJWTAuth(context.Context, *RequestJWTAuthRequest) (*RequestJWTAuthResponse, error)
 	// WaitJWTToken waits for JWT authentication completion
 	WaitJWTToken(context.Context, *WaitJWTTokenRequest) (*WaitJWTTokenResponse, error)
+	// RequestExtendAuthSession initiates an SSO session-extension flow.
+	// The daemon prepares a PKCE/device-code request against the IdP and
+	// returns the verification URI; the UI is expected to open it. The flow
+	// state is kept in the daemon until WaitExtendAuthSession completes it.
+	RequestExtendAuthSession(context.Context, *RequestExtendAuthSessionRequest) (*RequestExtendAuthSessionResponse, error)
+	// WaitExtendAuthSession blocks until the user finishes the SSO step
+	// started by RequestExtendAuthSession, then forwards the resulting JWT
+	// to the management server's ExtendAuthSession RPC. Returns the new
+	// session expiry deadline. The tunnel stays up the entire time.
+	WaitExtendAuthSession(context.Context, *WaitExtendAuthSessionRequest) (*WaitExtendAuthSessionResponse, error)
+	// DismissSessionWarning records that the user clicked "Dismiss" on the
+	// T-WarningLead interactive notification, suppressing the auto-opened
+	// SessionAboutToExpire dialog that would otherwise fire at
+	// T-FinalWarningLead for the current deadline. Idempotent and best-effort:
+	// a missed call only means the fallback dialog will still appear.
+	DismissSessionWarning(context.Context, *DismissSessionWarningRequest) (*DismissSessionWarningResponse, error)
 	// StartCPUProfile starts CPU profiling in the daemon
 	StartCPUProfile(context.Context, *StartCPUProfileRequest) (*StartCPUProfileResponse, error)
 	// StopCPUProfile stops CPU profiling in the daemon
@@ -648,6 +777,10 @@ type DaemonServiceServer interface {
 	GetInstallerResult(context.Context, *InstallerResultRequest) (*InstallerResultResponse, error)
 	// ExposeService exposes a local port via the NetBird reverse proxy
 	ExposeService(*ExposeServiceRequest, grpc.ServerStreamingServer[ExposeServiceEvent]) error
+	// WailsUIReady is a no-op probe the Wails UI calls once at startup. The UI
+	// only cares whether the daemon implements it: an Unimplemented response
+	// means the daemon predates this UI and is too old to drive it.
+	WailsUIReady(context.Context, *WailsUIReadyRequest) (*WailsUIReadyResponse, error)
 	mustEmbedUnimplementedDaemonServiceServer()
 }
 
@@ -670,6 +803,9 @@ func (UnimplementedDaemonServiceServer) Up(context.Context, *UpRequest) (*UpResp
 func (UnimplementedDaemonServiceServer) Status(context.Context, *StatusRequest) (*StatusResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method Status not implemented")
 }
+func (UnimplementedDaemonServiceServer) SubscribeStatus(*StatusRequest, grpc.ServerStreamingServer[StatusResponse]) error {
+	return status.Error(codes.Unimplemented, "method SubscribeStatus not implemented")
+}
 func (UnimplementedDaemonServiceServer) Down(context.Context, *DownRequest) (*DownResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method Down not implemented")
 }
@@ -727,6 +863,9 @@ func (UnimplementedDaemonServiceServer) SubscribeEvents(*SubscribeRequest, grpc.
 func (UnimplementedDaemonServiceServer) GetEvents(context.Context, *GetEventsRequest) (*GetEventsResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method GetEvents not implemented")
 }
+func (UnimplementedDaemonServiceServer) RegisterUILog(context.Context, *RegisterUILogRequest) (*RegisterUILogResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method RegisterUILog not implemented")
+}
 func (UnimplementedDaemonServiceServer) SwitchProfile(context.Context, *SwitchProfileRequest) (*SwitchProfileResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method SwitchProfile not implemented")
 }
@@ -766,6 +905,15 @@ func (UnimplementedDaemonServiceServer) RequestJWTAuth(context.Context, *Request
 func (UnimplementedDaemonServiceServer) WaitJWTToken(context.Context, *WaitJWTTokenRequest) (*WaitJWTTokenResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method WaitJWTToken not implemented")
 }
+func (UnimplementedDaemonServiceServer) RequestExtendAuthSession(context.Context, *RequestExtendAuthSessionRequest) (*RequestExtendAuthSessionResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method RequestExtendAuthSession not implemented")
+}
+func (UnimplementedDaemonServiceServer) WaitExtendAuthSession(context.Context, *WaitExtendAuthSessionRequest) (*WaitExtendAuthSessionResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method WaitExtendAuthSession not implemented")
+}
+func (UnimplementedDaemonServiceServer) DismissSessionWarning(context.Context, *DismissSessionWarningRequest) (*DismissSessionWarningResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method DismissSessionWarning not implemented")
+}
 func (UnimplementedDaemonServiceServer) StartCPUProfile(context.Context, *StartCPUProfileRequest) (*StartCPUProfileResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method StartCPUProfile not implemented")
 }
@@ -778,6 +926,9 @@ func (UnimplementedDaemonServiceServer) GetInstallerResult(context.Context, *Ins
 func (UnimplementedDaemonServiceServer) ExposeService(*ExposeServiceRequest, grpc.ServerStreamingServer[ExposeServiceEvent]) error {
 	return status.Error(codes.Unimplemented, "method ExposeService not implemented")
 }
+func (UnimplementedDaemonServiceServer) WailsUIReady(context.Context, *WailsUIReadyRequest) (*WailsUIReadyResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method WailsUIReady not implemented")
+}
 func (UnimplementedDaemonServiceServer) mustEmbedUnimplementedDaemonServiceServer() {}
 func (UnimplementedDaemonServiceServer) testEmbeddedByValue()                       {}
 
@@ -871,6 +1022,17 @@ func _DaemonService_Status_Handler(srv interface{}, ctx context.Context, dec fun
 	return interceptor(ctx, in, info, handler)
 }
 
+func _DaemonService_SubscribeStatus_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(StatusRequest)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(DaemonServiceServer).SubscribeStatus(m, &grpc.GenericServerStream[StatusRequest, StatusResponse]{ServerStream: stream})
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type DaemonService_SubscribeStatusServer = grpc.ServerStreamingServer[StatusResponse]
+
 func _DaemonService_Down_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(DownRequest)
 	if err := dec(in); err != nil {
@@ -1199,6 +1361,24 @@ func _DaemonService_GetEvents_Handler(srv interface{}, ctx context.Context, dec
 	return interceptor(ctx, in, info, handler)
 }
 
+func _DaemonService_RegisterUILog_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RegisterUILogRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServiceServer).RegisterUILog(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: DaemonService_RegisterUILog_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServiceServer).RegisterUILog(ctx, req.(*RegisterUILogRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _DaemonService_SwitchProfile_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(SwitchProfileRequest)
 	if err := dec(in); err != nil {
@@ -1433,6 +1613,60 @@ func _DaemonService_WaitJWTToken_Handler(srv interface{}, ctx context.Context, d
 	return interceptor(ctx, in, info, handler)
 }
 
+func _DaemonService_RequestExtendAuthSession_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RequestExtendAuthSessionRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServiceServer).RequestExtendAuthSession(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: DaemonService_RequestExtendAuthSession_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServiceServer).RequestExtendAuthSession(ctx, req.(*RequestExtendAuthSessionRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _DaemonService_WaitExtendAuthSession_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(WaitExtendAuthSessionRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServiceServer).WaitExtendAuthSession(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: DaemonService_WaitExtendAuthSession_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServiceServer).WaitExtendAuthSession(ctx, req.(*WaitExtendAuthSessionRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _DaemonService_DismissSessionWarning_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DismissSessionWarningRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServiceServer).DismissSessionWarning(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: DaemonService_DismissSessionWarning_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServiceServer).DismissSessionWarning(ctx, req.(*DismissSessionWarningRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _DaemonService_StartCPUProfile_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(StartCPUProfileRequest)
 	if err := dec(in); err != nil {
@@ -1498,6 +1732,24 @@ func _DaemonService_ExposeService_Handler(srv interface{}, stream grpc.ServerStr
 // This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
 type DaemonService_ExposeServiceServer = grpc.ServerStreamingServer[ExposeServiceEvent]
 
+func _DaemonService_WailsUIReady_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(WailsUIReadyRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServiceServer).WailsUIReady(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: DaemonService_WailsUIReady_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServiceServer).WailsUIReady(ctx, req.(*WailsUIReadyRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // DaemonService_ServiceDesc is the grpc.ServiceDesc for DaemonService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -1589,6 +1841,10 @@ var DaemonService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetEvents",
 			Handler:    _DaemonService_GetEvents_Handler,
 		},
+		{
+			MethodName: "RegisterUILog",
+			Handler:    _DaemonService_RegisterUILog_Handler,
+		},
 		{
 			MethodName: "SwitchProfile",
 			Handler:    _DaemonService_SwitchProfile_Handler,
@@ -1641,6 +1897,18 @@ var DaemonService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "WaitJWTToken",
 			Handler:    _DaemonService_WaitJWTToken_Handler,
 		},
+		{
+			MethodName: "RequestExtendAuthSession",
+			Handler:    _DaemonService_RequestExtendAuthSession_Handler,
+		},
+		{
+			MethodName: "WaitExtendAuthSession",
+			Handler:    _DaemonService_WaitExtendAuthSession_Handler,
+		},
+		{
+			MethodName: "DismissSessionWarning",
+			Handler:    _DaemonService_DismissSessionWarning_Handler,
+		},
 		{
 			MethodName: "StartCPUProfile",
 			Handler:    _DaemonService_StartCPUProfile_Handler,
@@ -1653,8 +1921,17 @@ var DaemonService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetInstallerResult",
 			Handler:    _DaemonService_GetInstallerResult_Handler,
 		},
+		{
+			MethodName: "WailsUIReady",
+			Handler:    _DaemonService_WailsUIReady_Handler,
+		},
 	},
 	Streams: []grpc.StreamDesc{
+		{
+			StreamName:    "SubscribeStatus",
+			Handler:       _DaemonService_SubscribeStatus_Handler,
+			ServerStreams: true,
+		},
 		{
 			StreamName:    "StartCapture",
 			Handler:       _DaemonService_StartCapture_Handler,
diff --git a/client/proto/metadata.go b/client/proto/metadata.go
new file mode 100644
index 000000000..9b1dbd16e
--- /dev/null
+++ b/client/proto/metadata.go
@@ -0,0 +1,61 @@
+package proto
+
+// SystemEvent metadata markers. The daemon stamps these on internal control
+// events it publishes over SubscribeEvents (profile-list refresh, log-level
+// change); the desktop UI recognises them and acts on them instead of
+// surfacing them as user-facing notifications.
+//
+// These live in the proto package — the shared contract both the daemon
+// (client/server) and the UI (client/ui/services) already import — so producer
+// and consumer reference the same constant rather than duplicating literals.
+// This file is hand-written and not touched by protoc.
+const (
+	// MetadataKindKey is the SystemEvent.metadata key carrying the event-kind
+	// marker (one of the MetadataKind* values below).
+	MetadataKindKey = "kind"
+
+	// MetadataKindProfileListChanged marks a CLI-driven profile add/remove that
+	// should nudge the UI's profile views to refresh.
+	MetadataKindProfileListChanged = "profile-list-changed"
+	// MetadataKindLogLevelChanged marks a daemon log-level change (or the
+	// per-subscription snapshot) that drives the GUI's file logging on/off.
+	MetadataKindLogLevelChanged = "log-level-changed"
+
+	// MetadataProfileKey carries the profile name for
+	// MetadataKindProfileListChanged.
+	MetadataProfileKey = "profile"
+	// MetadataLevelKey carries the lowercase logrus level name for
+	// MetadataKindLogLevelChanged.
+	MetadataLevelKey = "level"
+)
+
+// SystemEvent metadata markers for daemon config-change events. The daemon
+// publishes a SYSTEM-category event whenever its effective Config is
+// replaced (engine spawn, Up RPC, MDM policy diff); the UI re-fetches its
+// cached config/features in response and, for the MDM source, shows a
+// localised toast. Producer (client/server) and consumer (client/ui) share
+// these so neither duplicates the wire literals.
+const (
+	// MetadataTypeKey is the SystemEvent.metadata key carrying the
+	// config-change event type (one of the MetadataType* values below).
+	MetadataTypeKey = "type"
+	// MetadataTypeConfigChanged marks a config replacement that should nudge
+	// UIs to re-fetch their cached config + features. UserMessage is empty so
+	// the change is silent; the source is carried in MetadataSourceKey.
+	MetadataTypeConfigChanged = "config_changed"
+	// MetadataTypePolicyApplied marks an MDM-policy-driven config change. The
+	// daemon stamps it with a (non-localised) UserMessage; the UI suppresses
+	// that and builds its own localised toast off the paired config_changed
+	// event instead.
+	MetadataTypePolicyApplied = "policy_applied"
+
+	// MetadataSourceKey is the SystemEvent.metadata key carrying what
+	// triggered a config_changed event (one of the MetadataSource* values).
+	MetadataSourceKey = "source"
+	// MetadataSourceStartup marks a config_changed from the daemon Start path.
+	MetadataSourceStartup = "startup"
+	// MetadataSourceUpRPC marks a config_changed from the Up RPC.
+	MetadataSourceUpRPC = "up_rpc"
+	// MetadataSourceMDM marks a config_changed driven by an MDM policy diff.
+	MetadataSourceMDM = "mdm"
+)
diff --git a/client/server/debug.go b/client/server/debug.go
index 14dcaba33..0b6ac4b53 100644
--- a/client/server/debug.go
+++ b/client/server/debug.go
@@ -53,7 +53,10 @@ func (s *Server) DebugBundle(_ context.Context, req *proto.DebugBundleRequest) (
 		if engine != nil {
 			refreshStatus = func() {
 				log.Debug("refreshing system health status for debug bundle")
-				engine.RunHealthProbes(true)
+				// Background ctx: the bundle wants a full, fresh probe regardless
+				// of the DebugBundle RPC client's lifetime. The engine's own ctx
+				// still aborts it on shutdown.
+				engine.RunHealthProbes(context.Background(), true)
 			}
 		}
 	}
@@ -64,6 +67,7 @@ func (s *Server) DebugBundle(_ context.Context, req *proto.DebugBundleRequest) (
 			StatusRecorder: s.statusRecorder,
 			SyncResponse:   syncResponse,
 			LogPath:        s.logFile,
+			UILogPath:      s.uiLogPath,
 			CPUProfile:     cpuProfileData,
 			CapturePath:    capturePath,
 			RefreshStatus:  refreshStatus,
@@ -124,9 +128,26 @@ func (s *Server) SetLogLevel(_ context.Context, req *proto.SetLogLevelRequest) (
 
 	log.Infof("Log level set to %s", level.String())
 
+	// Signal the desktop UI so it can attach/detach its gui-client.log. Rides
+	// the SubscribeEvents stream as a marked event (see publishLogLevelChanged).
+	s.publishLogLevelChanged(level.String())
+
 	return &proto.SetLogLevelResponse{}, nil
 }
 
+// RegisterUILog records the desktop UI's absolute log path so DebugBundle can
+// collect the GUI log. The daemon runs as root and can't resolve the user's
+// config dir, so the UI reports it. Last-writer-wins (one UI per socket).
+func (s *Server) RegisterUILog(_ context.Context, req *proto.RegisterUILogRequest) (*proto.RegisterUILogResponse, error) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	s.uiLogPath = req.GetPath()
+	log.Infof("registered UI log path: %s", s.uiLogPath)
+
+	return &proto.RegisterUILogResponse{}, nil
+}
+
 // SetSyncResponsePersistence sets the sync response persistence for the server.
 func (s *Server) SetSyncResponsePersistence(_ context.Context, req *proto.SetSyncResponsePersistenceRequest) (*proto.SetSyncResponsePersistenceResponse, error) {
 	s.mutex.Lock()
diff --git a/client/server/event.go b/client/server/event.go
index d93151c96..753a051e7 100644
--- a/client/server/event.go
+++ b/client/server/event.go
@@ -1,7 +1,9 @@
 package server
 
 import (
+	"github.com/google/uuid"
 	log "github.com/sirupsen/logrus"
+	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/netbirdio/netbird/client/proto"
 )
@@ -16,6 +18,15 @@ func (s *Server) SubscribeEvents(req *proto.SubscribeRequest, stream proto.Daemo
 	log.Debug("client subscribed to events")
 	s.startUpdateManagerForGUI()
 
+	// Replay the current log level to this subscriber so a freshly-connected UI
+	// learns it even when the daemon was already started with --log-level debug
+	// (the change-driven publishLogLevelChanged only fires on SetLogLevel). Sent
+	// directly on this stream rather than via PublishEvent so it reaches only
+	// the new subscriber, not every connected client.
+	if err := s.sendCurrentLogLevel(stream); err != nil {
+		return err
+	}
+
 	for {
 		select {
 		case event := <-subscription.Events():
@@ -28,3 +39,24 @@ func (s *Server) SubscribeEvents(req *proto.SubscribeRequest, stream proto.Daemo
 		}
 	}
 }
+
+// sendCurrentLogLevel sends a marked log-level-changed SystemEvent carrying the
+// daemon's current level directly to one subscriber. Mirrors the shape
+// publishLogLevelChanged emits so the UI's dispatchSystemEvent handles both the
+// same way.
+func (s *Server) sendCurrentLogLevel(stream proto.DaemonService_SubscribeEventsServer) error {
+	level := log.GetLevel().String()
+	event := &proto.SystemEvent{
+		Id:        uuid.New().String(),
+		Severity:  proto.SystemEvent_INFO,
+		Category:  proto.SystemEvent_SYSTEM,
+		Message:   "Log level changed",
+		Metadata:  map[string]string{proto.MetadataKindKey: proto.MetadataKindLogLevelChanged, proto.MetadataLevelKey: level},
+		Timestamp: timestamppb.Now(),
+	}
+	if err := stream.Send(event); err != nil {
+		log.Warnf("error sending initial log level event: %v", err)
+		return err
+	}
+	return nil
+}
diff --git a/client/server/extend_authsession_test.go b/client/server/extend_authsession_test.go
new file mode 100644
index 000000000..a1a048a7c
--- /dev/null
+++ b/client/server/extend_authsession_test.go
@@ -0,0 +1,42 @@
+package server
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+)
+
+func TestInnermostStatus(t *testing.T) {
+	t.Run("wrapped gRPC status", func(t *testing.T) {
+		inner := gstatus.Error(codes.PermissionDenied, "peer is already registered by a different User or a Setup Key")
+		// Mirror the daemon wrap chain: engine wraps with %w, mgm error is the inner status.
+		wrapped := fmt.Errorf("extend auth session on management: %w", inner)
+
+		st := innermostStatus(wrapped)
+		require.NotNil(t, st)
+		require.Equal(t, codes.PermissionDenied, st.Code())
+		require.Equal(t, "peer is already registered by a different User or a Setup Key", st.Message())
+	})
+
+	t.Run("deepest status wins over an outer one", func(t *testing.T) {
+		inner := gstatus.Error(codes.PermissionDenied, "deepest")
+		chain := fmt.Errorf("outer: %w", fmt.Errorf("mid: %w", inner))
+
+		st := innermostStatus(chain)
+		require.NotNil(t, st)
+		require.Equal(t, codes.PermissionDenied, st.Code())
+		require.Equal(t, "deepest", st.Message())
+	})
+
+	t.Run("no status in chain", func(t *testing.T) {
+		require.Nil(t, innermostStatus(errors.New("plain error")))
+	})
+
+	t.Run("nil error", func(t *testing.T) {
+		require.Nil(t, innermostStatus(nil))
+	})
+}
diff --git a/client/server/mdm.go b/client/server/mdm.go
index 1e1005e05..9836c6bea 100644
--- a/client/server/mdm.go
+++ b/client/server/mdm.go
@@ -100,7 +100,10 @@ func (s *Server) onMDMPolicyChange(_, _ *mdm.Policy) error {
 		proto.SystemEvent_SYSTEM,
 		"MDM policy applied",
 		"NetBird configuration was updated by your IT policy.",
-		map[string]string{"source": "mdm", "type": "policy_applied"},
+		map[string]string{
+			proto.MetadataSourceKey: proto.MetadataSourceMDM,
+			proto.MetadataTypeKey:   proto.MetadataTypePolicyApplied,
+		},
 	)
 	return nil
 }
@@ -125,8 +128,8 @@ func (s *Server) publishConfigChangedEvent(source string) {
 		fmt.Sprintf("daemon config changed (source=%s)", source),
 		"",
 		map[string]string{
-			"source": source,
-			"type":   "config_changed",
+			proto.MetadataSourceKey: source,
+			proto.MetadataTypeKey:   proto.MetadataTypeConfigChanged,
 		},
 	)
 }
@@ -161,7 +164,7 @@ func (s *Server) restartEngineForMDMLocked() error {
 	s.clientGiveUpChan = make(chan struct{})
 	log.Info("MDM restart: spawning connectWithRetryRuns with re-resolved config")
 	go s.connectWithRetryRuns(ctx, config, s.statusRecorder, s.clientRunningChan, s.clientGiveUpChan)
-	s.publishConfigChangedEvent("mdm")
+	s.publishConfigChangedEvent(proto.MetadataSourceMDM)
 	return nil
 }
 
diff --git a/client/server/network.go b/client/server/network.go
index 7a3c08f2e..c38715256 100644
--- a/client/server/network.go
+++ b/client/server/network.go
@@ -172,6 +172,17 @@ func (s *Server) SelectNetworks(_ context.Context, req *proto.SelectNetworksRequ
 		if err := routeSelector.SelectRoutes(routes, req.GetAppend(), netIdRoutes); err != nil {
 			return nil, fmt.Errorf("select routes: %w", err)
 		}
+
+		// Exit nodes are mutually exclusive: if this selection activates an
+		// exit node, deselect every other available exit node so two can't be
+		// selected at once. Non-exit route selections are left untouched.
+		if requestActivatesExitNode(routes, routesMap) {
+			if others := otherExitNodeIDs(routesMap, routes); len(others) > 0 {
+				if err := routeSelector.DeselectRoutes(others, netIdRoutes); err != nil {
+					return nil, fmt.Errorf("deselect sibling exit nodes: %w", err)
+				}
+			}
+		}
 	}
 	routeManager.TriggerSelection(routeManager.GetClientRoutes())
 
@@ -249,3 +260,38 @@ func toNetIDs(routes []string) []route.NetID {
 	}
 	return netIDs
 }
+
+func isExitNodeRoutes(routes []*route.Route) bool {
+	return len(routes) > 0 && (route.IsV4DefaultRoute(routes[0].Network) || route.IsV6DefaultRoute(routes[0].Network))
+}
+
+// requestActivatesExitNode reports whether any requested NetID maps to an exit
+// node (default route) in the current route table.
+func requestActivatesExitNode(requested []route.NetID, routesMap map[route.NetID][]*route.Route) bool {
+	for _, id := range requested {
+		if isExitNodeRoutes(routesMap[id]) {
+			return true
+		}
+	}
+	return false
+}
+
+// otherExitNodeIDs returns every available exit-node NetID that is not in the
+// requested set — the siblings to deselect so a single exit node stays active.
+func otherExitNodeIDs(routesMap map[route.NetID][]*route.Route, requested []route.NetID) []route.NetID {
+	keep := make(map[route.NetID]struct{}, len(requested))
+	for _, id := range requested {
+		keep[id] = struct{}{}
+	}
+	var others []route.NetID
+	for id, routes := range routesMap {
+		if !isExitNodeRoutes(routes) {
+			continue
+		}
+		if _, ok := keep[id]; ok {
+			continue
+		}
+		others = append(others, id)
+	}
+	return others
+}
diff --git a/client/server/network_exitnode_test.go b/client/server/network_exitnode_test.go
new file mode 100644
index 000000000..1c0ba0ecb
--- /dev/null
+++ b/client/server/network_exitnode_test.go
@@ -0,0 +1,26 @@
+package server
+
+import (
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/route"
+)
+
+func TestExitNodeSelectionHelpers(t *testing.T) {
+	routesMap := map[route.NetID][]*route.Route{
+		"exitA": {{Network: netip.MustParsePrefix("0.0.0.0/0")}},
+		"exitB": {{Network: netip.MustParsePrefix("::/0")}},
+		"lan":   {{Network: netip.MustParsePrefix("192.168.0.0/16")}},
+	}
+
+	assert.True(t, requestActivatesExitNode([]route.NetID{"exitA"}, routesMap), "v4 default route is an exit node")
+	assert.True(t, requestActivatesExitNode([]route.NetID{"exitB"}, routesMap), "v6 default route is an exit node")
+	assert.False(t, requestActivatesExitNode([]route.NetID{"lan"}, routesMap), "lan route is not an exit node")
+	assert.False(t, requestActivatesExitNode([]route.NetID{"missing"}, routesMap), "unknown id is not an exit node")
+
+	others := otherExitNodeIDs(routesMap, []route.NetID{"exitB"})
+	assert.ElementsMatch(t, []route.NetID{"exitA"}, others, "only the other exit node is a sibling; the lan route is ignored")
+}
diff --git a/client/server/probe_throttle.go b/client/server/probe_throttle.go
new file mode 100644
index 000000000..ec6137e15
--- /dev/null
+++ b/client/server/probe_throttle.go
@@ -0,0 +1,88 @@
+package server
+
+import (
+	"context"
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// healthProbeRunner runs the full, expensive probe (network round-trips to
+// management, signal and the relays) and reports whether every component was
+// healthy. ctx cancels the probe when the caller gives up. Satisfied by
+// *internal.Engine.
+type healthProbeRunner interface {
+	RunHealthProbes(ctx context.Context, waitForResult bool) bool
+}
+
+// statsRefresher does the cheap WireGuard-stats refresh callers fall back to
+// when a fresh probe isn't warranted. Satisfied by *peer.Status.
+type statsRefresher interface {
+	RefreshWireGuardStats() error
+}
+
+// probeThrottle rate-limits and single-flights the daemon's health probes.
+//
+// Health probes are expensive (network round-trips to management, signal and
+// the relays), while Status(GetFullPeerStatus=true) RPCs can arrive frequently
+// and concurrently — the desktop UI alone issues one per connect/disconnect.
+// probeThrottle keeps that load bounded with two rules:
+//
+//   - Single-flight: only one probe runs at a time. Callers that pile up while
+//     a probe is in flight share its result instead of each launching another,
+//     even when that probe failed. A failed probe therefore does not make every
+//     waiter re-probe in turn; the next, non-overlapping caller can try again.
+//   - Throttle: after a fully successful probe the result is cached for
+//     interval. While any component is unhealthy the cache is not advanced, so
+//     later callers keep probing frequently and notice recovery quickly — the
+//     intentional "probe often while unhealthy" behaviour from the original
+//     design.
+type probeThrottle struct {
+	interval time.Duration
+
+	mu          sync.Mutex
+	lastOK      time.Time // last fully-successful probe; drives the throttle window
+	completedAt time.Time // when the most recent probe finished; drives single-flight sharing
+}
+
+func newProbeThrottle(interval time.Duration) *probeThrottle {
+	return &probeThrottle{interval: interval}
+}
+
+// Run decides whether to run a fresh health probe or serve the most recent
+// result. It serialises concurrent callers: at most one runner.RunHealthProbes
+// executes at a time and the rest call refresher.RefreshWireGuardStats and read
+// the snapshot it produced.
+//
+// Both calls run while the throttle's lock is held, so a slow probe blocks
+// other callers until it completes — that blocking is the single-flight
+// guarantee. ctx is forwarded to RunHealthProbes so a caller that gives up
+// cancels the in-flight probe (and any caller still queued on the lock falls
+// through quickly once it acquires it, since the probe ctx is already done).
+func (t *probeThrottle) Run(ctx context.Context, runner healthProbeRunner, refresher statsRefresher, waitForResult bool) {
+	entered := time.Now()
+
+	t.mu.Lock()
+	defer t.mu.Unlock()
+
+	// A probe that finished after we entered ran while we were waiting on the
+	// lock — i.e. a peer in the same burst already probed for us, so share its
+	// result rather than launch another. This holds even when that probe
+	// failed, so a failed probe doesn't make every waiter re-probe in turn.
+	sharedRecentProbe := t.completedAt.After(entered)
+	throttled := time.Since(t.lastOK) <= t.interval
+
+	if sharedRecentProbe || throttled {
+		if err := refresher.RefreshWireGuardStats(); err != nil {
+			log.Debugf("failed to refresh WireGuard stats: %v", err)
+		}
+		return
+	}
+
+	healthy := runner.RunHealthProbes(ctx, waitForResult)
+	t.completedAt = time.Now()
+	if healthy {
+		t.lastOK = t.completedAt
+	}
+}
diff --git a/client/server/probe_throttle_test.go b/client/server/probe_throttle_test.go
new file mode 100644
index 000000000..cae776fa4
--- /dev/null
+++ b/client/server/probe_throttle_test.go
@@ -0,0 +1,109 @@
+package server
+
+import (
+	"context"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+// fakeProber implements both healthProbeRunner and statsRefresher with
+// caller-supplied behaviour.
+type fakeProber struct {
+	onProbe   func() bool
+	onRefresh func()
+}
+
+func (f fakeProber) RunHealthProbes(context.Context, bool) bool {
+	return f.onProbe()
+}
+
+func (f fakeProber) RefreshWireGuardStats() error {
+	if f.onRefresh != nil {
+		f.onRefresh()
+	}
+	return nil
+}
+
+func TestProbeThrottle_CachesAfterSuccess(t *testing.T) {
+	pt := newProbeThrottle(time.Minute)
+
+	var probes, refreshes int
+	prober := fakeProber{
+		onProbe:   func() bool { probes++; return true },
+		onRefresh: func() { refreshes++ },
+	}
+
+	pt.Run(context.Background(), prober, prober, false)
+	pt.Run(context.Background(), prober, prober, false)
+
+	if probes != 1 {
+		t.Fatalf("expected 1 probe within the throttle window, got %d", probes)
+	}
+	if refreshes != 1 {
+		t.Fatalf("expected the throttled caller to refresh stats once, got %d", refreshes)
+	}
+}
+
+func TestProbeThrottle_StaysOpenWhileUnhealthy(t *testing.T) {
+	pt := newProbeThrottle(time.Minute)
+
+	var probes int
+	prober := fakeProber{onProbe: func() bool { probes++; return false }} // never healthy
+
+	// Sequential, non-overlapping callers must each re-probe while unhealthy:
+	// a failed probe does not advance the throttle window.
+	pt.Run(context.Background(), prober, prober, false)
+	pt.Run(context.Background(), prober, prober, false)
+	pt.Run(context.Background(), prober, prober, false)
+
+	if probes != 3 {
+		t.Fatalf("expected every non-overlapping caller to probe while unhealthy, got %d", probes)
+	}
+}
+
+func TestProbeThrottle_SingleFlightSharesResult(t *testing.T) {
+	pt := newProbeThrottle(time.Minute)
+
+	var probes int32
+	release := make(chan struct{})
+	started := make(chan struct{})
+
+	// First caller blocks inside the probe until released, holding the lock so
+	// the others pile up behind it.
+	prober := fakeProber{onProbe: func() bool {
+		if atomic.AddInt32(&probes, 1) == 1 {
+			close(started)
+			<-release
+		}
+		return false // unhealthy — the share must happen regardless of result
+	}}
+
+	var wg sync.WaitGroup
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		pt.Run(context.Background(), prober, prober, false)
+	}()
+
+	<-started // ensure the first probe is in flight before the burst arrives
+
+	const waiters = 9
+	wg.Add(waiters)
+	for i := 0; i < waiters; i++ {
+		go func() {
+			defer wg.Done()
+			pt.Run(context.Background(), prober, prober, false)
+		}()
+	}
+
+	// Give the waiters time to block on the lock, then let the first finish.
+	time.Sleep(50 * time.Millisecond)
+	close(release)
+	wg.Wait()
+
+	if got := atomic.LoadInt32(&probes); got != 1 {
+		t.Fatalf("expected a concurrent burst to run exactly 1 probe, got %d", got)
+	}
+}
diff --git a/client/server/server.go b/client/server/server.go
index e8ef2f96e..363f716a9 100644
--- a/client/server/server.go
+++ b/client/server/server.go
@@ -19,6 +19,7 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/metadata"
 	gstatus "google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/expose"
@@ -67,7 +68,19 @@ type Server struct {
 
 	logFile string
 
+	// uiLogPath is the desktop UI's absolute log path, reported via
+	// RegisterUILog. Guarded by mutex. Consumed by DebugBundle so the bundle
+	// can collect the GUI log even though the daemon runs as root and can't
+	// resolve the user's config dir. Last-writer-wins (one UI per socket).
+	uiLogPath string
+
 	oauthAuthFlow oauthAuthFlow
+	// extendAuthSessionFlow holds the pending PKCE flow created by
+	// RequestExtendAuthSession until WaitExtendAuthSession resolves it.
+	// Kept separate from oauthAuthFlow (which is reserved for the SSH
+	// JWT path) so a concurrent SSH auth doesn't clobber the session
+	// extend flow or vice versa.
+	extendAuthSessionFlow *auth.PendingFlow
 
 	mutex  sync.Mutex
 	config *profilemanager.Config
@@ -87,7 +100,7 @@ type Server struct {
 	statusRecorder *peer.Status
 	sessionWatcher *internal.SessionWatcher
 
-	lastProbe           time.Time
+	probeThrottle       *probeThrottle
 	persistSyncResponse bool
 	isSessionActive     atomic.Bool
 
@@ -135,6 +148,8 @@ func New(ctx context.Context, logFile string, configFile string, profilesDisable
 		captureEnabled:         captureEnabled,
 		networksDisabled:       networksDisabled,
 		jwtCache:               newJWTCache(),
+		extendAuthSessionFlow:  auth.NewPendingFlow(),
+		probeThrottle:          newProbeThrottle(probeThreshold),
 	}
 	agent := &serverAgent{s}
 	s.sleepHandler = sleephandler.New(agent)
@@ -152,6 +167,15 @@ func (s *Server) Start() error {
 	}
 
 	state := internal.CtxGetState(s.rootCtx)
+	// Every contextState.Set in the connect/login/server paths must push a
+	// SubscribeStatus snapshot, otherwise transitions that don't happen to
+	// be accompanied by a Mark{Management,Signal,...} call (e.g. plain
+	// StatusNeedsLogin after a PermissionDenied login, StatusLoginFailed
+	// after OAuth init failure, StatusIdle in the Login defer) leave the
+	// UI stuck on the previous status until the next unrelated peer event.
+	// Binding the recorder here means new state.Set callsites don't have
+	// to opt in individually.
+	state.SetOnChange(s.statusRecorder.NotifyStateChange)
 
 	if err := handlePanicLog(); err != nil {
 		log.Warnf("failed to redirect stderr: %v", err)
@@ -235,7 +259,7 @@ func (s *Server) Start() error {
 	s.clientRunningChan = make(chan struct{})
 	s.clientGiveUpChan = make(chan struct{})
 	go s.connectWithRetryRuns(ctx, config, s.statusRecorder, s.clientRunningChan, s.clientGiveUpChan)
-	s.publishConfigChangedEvent("startup")
+	s.publishConfigChangedEvent(proto.MetadataSourceStartup)
 	return nil
 }
 
@@ -252,6 +276,10 @@ func (s *Server) Start() error {
 // "intent" (clientRunning) is maintained by the RPC handlers, not by this
 // goroutine.
 func (s *Server) connectWithRetryRuns(ctx context.Context, profileConfig *profilemanager.Config, statusRecorder *peer.Status, runningChan chan struct{}, giveUpChan chan struct{}) {
+	// close(giveUpChan) MUST run on every exit path (DisableAutoConnect
+	// return, backoff.Retry return, panic) — Down() blocks for up to 5s
+	// waiting on this signal before flipping the state to Idle, and a
+	// missed close leaves Down() always hitting the timeout.
 	defer func() {
 		if giveUpChan != nil {
 			close(giveUpChan)
@@ -290,6 +318,15 @@ func (s *Server) connectWithRetryRuns(ctx context.Context, profileConfig *profil
 	runOperation := func() error {
 		err := s.connect(ctx, profileConfig, statusRecorder, runningChan)
 		if err != nil {
+			// PermissionDenied means the daemon transitioned to NeedsLogin
+			// inside connect(). Without backoff.Permanent the outer retry
+			// re-enters connect(), which resets the state to Connecting and
+			// makes the tray flicker between NeedsLogin and Connecting until
+			// the user logs in. Stop retrying and let the state stick.
+			if s, ok := gstatus.FromError(err); ok && s.Code() == codes.PermissionDenied {
+				log.Debugf("run client connection exited with PermissionDenied, waiting for login")
+				return backoff.Permanent(err)
+			}
 			log.Debugf("run client connection exited with error: %v. Will retry in the background", err)
 			return err
 		}
@@ -424,7 +461,7 @@ func (s *Server) setConfigInputFromRequest(msg *proto.SetConfigRequest) (profile
 		wgPort := int(*msg.WireguardPort)
 		config.WireguardPort = &wgPort
 	}
-	if msg.OptionalPreSharedKey != nil && *msg.OptionalPreSharedKey != "" {
+	if msg.OptionalPreSharedKey != nil {
 		config.PreSharedKey = msg.OptionalPreSharedKey
 	}
 
@@ -575,8 +612,6 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 		return &proto.LoginResponse{}, nil
 	}
 
-	state.Set(internal.StatusConnecting)
-
 	if msg.SetupKey == "" {
 		hint := ""
 		if msg.Hint != nil {
@@ -591,6 +626,7 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 		if s.oauthAuthFlow.flow != nil && s.oauthAuthFlow.flow.GetClientID(ctx) == oAuthFlow.GetClientID(ctx) {
 			if s.oauthAuthFlow.expiresAt.After(time.Now().Add(90 * time.Second)) {
 				log.Debugf("using previous oauth flow info")
+				state.Set(internal.StatusNeedsLogin)
 				return &proto.LoginResponse{
 					NeedsSSOLogin:           true,
 					VerificationURI:         s.oauthAuthFlow.info.VerificationURI,
@@ -627,6 +663,11 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 		}, nil
 	}
 
+	// Setup-key path: we are about to dial Management with the key, so the
+	// Connecting paint is meaningful here — unlike the SSO branch above,
+	// which returns NeedsLogin and parks on the browser leg.
+	state.Set(internal.StatusConnecting)
+
 	if loginStatus, err := s.loginAttempt(ctx, msg.SetupKey, ""); err != nil {
 		state.Set(loginStatus)
 		return nil, err
@@ -635,8 +676,43 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	return &proto.LoginResponse{}, nil
 }
 
-// WaitSSOLogin uses the userCode to validate the TokenInfo and
-// waits for the user to continue with the login on a browser
+// WaitSSOLogin validates the supplied userCode against the in-flight OAuth
+// device/PKCE flow and blocks until the user finishes the browser leg.
+//
+// The daemon holds StatusNeedsLogin for the whole browser wait (set on
+// entry): the login is not done until the token returns, so a client that
+// (re)attaches mid-wait — a restarted UI, a second `netbird up` — reads
+// "login required" and offers the affordance, instead of a Connecting that
+// never resolves. The wait is also tied to the caller's context (see the
+// goroutine below), so a client that goes away cancels the wait instead of
+// orphaning it on rootCtx until the device-code window expires.
+//
+// State transitions on exit:
+//
+//	┌──────────────────────────────────────────┬──────────────────────────────────┐
+//	│ Outcome                                  │ contextState                     │
+//	├──────────────────────────────────────────┼──────────────────────────────────┤
+//	│ Success → loginAttempt ok                │ NeedsLogin held; the caller's Up │
+//	│                                          │   drives Connecting → Connected  │
+//	│ Success → loginAttempt → still-NeedsLogin│ StatusNeedsLogin (loginAttempt)  │
+//	│ Success → loginAttempt error             │ StatusLoginFailed (loginAttempt) │
+//	│ UserCode mismatch                        │ StatusLoginFailed                │
+//	│ WaitToken: context.Canceled              │ NeedsLogin held. Caller gone     │
+//	│   (caller went away — UI restart /       │   (UI/CLI) → a fresh client      │
+//	│   Ctrl+C — or internal abort: profile    │   shows the login affordance;    │
+//	│   switch / app quit / another            │   internal aborts are            │
+//	│   WaitSSOLogin via actCancel/waitCancel) │   overwritten by the next Up.    │
+//	│ WaitToken: context.DeadlineExceeded      │ StatusNeedsLogin                 │
+//	│   (OAuth device-code window expired      │   (retryable; the UI's "Connect" │
+//	│   while waiting on the browser leg)      │   re-enters the Login flow)      │
+//	│ WaitToken: any other error               │ StatusLoginFailed                │
+//	│   (access_denied, expired_token, HTTP    │   (genuine auth/IO failure;      │
+//	│   failure, token validation rejection)   │   surfaced verbatim to caller)   │
+//	└──────────────────────────────────────────┴──────────────────────────────────┘
+//
+// The defer still applies a StatusIdle fallback for the early
+// oauth-flow-not-initialized return (before the entry Set), so a half state
+// doesn't leak when there is nothing to wait on.
 func (s *Server) WaitSSOLogin(callerCtx context.Context, msg *proto.WaitSSOLoginRequest) (*proto.WaitSSOLoginResponse, error) {
 	s.mutex.Lock()
 	if s.actCancel != nil {
@@ -644,6 +720,21 @@ func (s *Server) WaitSSOLogin(callerCtx context.Context, msg *proto.WaitSSOLogin
 	}
 	ctx, cancel := context.WithCancel(s.rootCtx)
 
+	// Tie the in-flight browser wait to the caller. ctx stays rooted in
+	// rootCtx so CtxGetState resolves the daemon's contextState, but if the
+	// UI window or CLI that drove the login goes away mid-flow (restart,
+	// Ctrl+C) the gRPC callerCtx cancels and we cancel the wait instead of
+	// orphaning it on rootCtx until the OAuth device-code window expires.
+	// The goroutine exits as soon as either context completes, so it can't
+	// outlive the RPC.
+	go func() {
+		select {
+		case <-callerCtx.Done():
+			cancel()
+		case <-ctx.Done():
+		}
+	}()
+
 	md, ok := metadata.FromIncomingContext(callerCtx)
 	if ok {
 		ctx = metadata.NewOutgoingContext(ctx, md)
@@ -669,7 +760,11 @@ func (s *Server) WaitSSOLogin(callerCtx context.Context, msg *proto.WaitSSOLogin
 		}
 	}()
 
-	state.Set(internal.StatusConnecting)
+	// Hold NeedsLogin for the whole browser wait — the login is not done
+	// until the token returns, so a client that (re)attaches mid-wait
+	// (restarted UI, second `netbird up`) reads "login required" and offers
+	// the affordance instead of a Connecting that never resolves.
+	state.Set(internal.StatusNeedsLogin)
 
 	s.mutex.Lock()
 	flowInfo := s.oauthAuthFlow.info
@@ -696,7 +791,30 @@ func (s *Server) WaitSSOLogin(callerCtx context.Context, msg *proto.WaitSSOLogin
 		s.mutex.Lock()
 		s.oauthAuthFlow.expiresAt = time.Now()
 		s.mutex.Unlock()
-		state.Set(internal.StatusLoginFailed)
+		switch {
+		case errors.Is(err, context.Canceled):
+			// External abort. If our caller cancelled (the client closed
+			// the browser-login popup, or the UI went away — callerCtx is
+			// done), clear the abandoned OAuth flow so a fresh Login starts
+			// a new device code instead of reusing this one. The entry
+			// NeedsLogin stays in place, so a reattaching client shows the
+			// login affordance. An internal abort (actCancel from a new
+			// Login/WaitSSOLogin, callerCtx still live) leaves the flow for
+			// the new owner — don't clobber it.
+			if callerCtx.Err() != nil {
+				s.mutex.Lock()
+				s.oauthAuthFlow = oauthAuthFlow{}
+				s.mutex.Unlock()
+			}
+		case errors.Is(err, context.DeadlineExceeded):
+			// OAuth device-code window expired with no user action.
+			// Retryable — leave the daemon in NeedsLogin so the UI
+			// keeps the Login affordance instead of reading as a
+			// hard failure.
+			state.Set(internal.StatusNeedsLogin)
+		default:
+			state.Set(internal.StatusLoginFailed)
+		}
 		log.Errorf("waiting for browser login failed: %v", err)
 		return nil, err
 	}
@@ -753,6 +871,22 @@ func (s *Server) Up(callerCtx context.Context, msg *proto.UpRequest) (*proto.UpR
 		return nil, err
 	}
 
+	// StatusNeedsLogin is a legitimate fresh-start entry state: a successful
+	// WaitSSOLogin deliberately leaves the daemon in NeedsLogin (the login is
+	// done, the token is in hand, but the engine hasn't been brought up yet —
+	// see WaitSSOLogin's state-transition table). The same holds after a
+	// mid-session expiry tore the engine down (clientRunning == false) and the
+	// user re-authenticated. In both cases the caller's Up is expected to drive
+	// the connection; treat NeedsLogin like Idle and reset to Idle so the
+	// engine's own StatusConnecting → StatusConnected progression starts from a
+	// clean slate. Without this, the first Up after an SSO login fails with
+	// "up already in progress" and the user has to trigger Up a second time
+	// (CLI: re-run `netbird up`; GUI: click Connect again).
+	if status == internal.StatusNeedsLogin {
+		status = internal.StatusIdle
+		state.Set(internal.StatusIdle)
+	}
+
 	if status != internal.StatusIdle {
 		s.mutex.Unlock()
 		return nil, fmt.Errorf("up already in progress: current status %s", status)
@@ -815,9 +949,12 @@ func (s *Server) Up(callerCtx context.Context, msg *proto.UpRequest) (*proto.UpR
 	s.clientGiveUpChan = make(chan struct{})
 
 	go s.connectWithRetryRuns(ctx, s.config, s.statusRecorder, s.clientRunningChan, s.clientGiveUpChan)
-	s.publishConfigChangedEvent("up_rpc")
+	s.publishConfigChangedEvent(proto.MetadataSourceUpRPC)
 
 	s.mutex.Unlock()
+	if msg.GetAsync() {
+		return &proto.UpResponse{}, nil
+	}
 	return s.waitForUp(callerCtx)
 }
 
@@ -927,6 +1064,10 @@ func (s *Server) SwitchProfile(callerCtx context.Context, msg *proto.SwitchProfi
 
 	s.config = config
 
+	if msg != nil && msg.ProfileName != nil {
+		s.publishProfileListChanged(*msg.ProfileName)
+	}
+
 	return &proto.SwitchProfileResponse{Id: activeProf.ID.String()}, nil
 }
 
@@ -943,23 +1084,37 @@ func (s *Server) Down(ctx context.Context, _ *proto.DownRequest) (*proto.DownRes
 		return nil, err
 	}
 
-	state := internal.CtxGetState(s.rootCtx)
-	state.Set(internal.StatusIdle)
-
 	s.mutex.Unlock()
 
 	// Wait for the connectWithRetryRuns goroutine to finish with a short timeout.
 	// This prevents the goroutine from setting ErrResetConnection after Down() returns.
-	// The giveUpChan is closed at the end of connectWithRetryRuns.
+	// The giveUpChan is closed by the goroutine's deferred cleanup (see
+	// connectWithRetryRuns) on every exit path. A timeout here typically
+	// means the goroutine is still wedged inside a slow teardown step.
 	if giveUpChan != nil {
 		select {
 		case <-giveUpChan:
-			log.Debugf("client goroutine finished successfully")
+			log.Debugf("client goroutine finished, giveUpChan closed")
 		case <-time.After(5 * time.Second):
 			log.Warnf("timeout waiting for client goroutine to finish, proceeding anyway")
 		}
 	}
 
+	// Set Idle only after the retry goroutine has exited (or timed out).
+	// Setting it earlier races with the goroutine's own Set(StatusConnecting)
+	// at the top of each retry attempt, which would leave the snapshot
+	// stuck at Connecting long after the user asked to disconnect.
+	internal.CtxGetState(s.rootCtx).Set(internal.StatusIdle)
+
+	// Clear stale management/signal errors so the next Up() (typically for a
+	// different profile) starts with a clean status snapshot. Without this,
+	// a managementError left over from a LoginFailed cycle persists in the
+	// statusRecorder and appears in the new profile's initial
+	// SubscribeStatus snapshot, making the new profile look like it also
+	// failed to log in.
+	s.statusRecorder.MarkManagementDisconnected(nil)
+	s.statusRecorder.MarkSignalDisconnected(nil)
+
 	return &proto.DownResponse{}, nil
 }
 
@@ -1174,7 +1329,19 @@ func (s *Server) sendLogoutRequestWithConfig(ctx context.Context, config *profil
 		}
 	}()
 
-	return mgmClient.Logout()
+	if err := mgmClient.Logout(); err != nil {
+		// The peer is already gone from the management server (e.g. deleted
+		// from the dashboard). The logout's goal — deregistering this peer —
+		// is therefore already satisfied, so treat NotFound as success rather
+		// than blocking the logout/profile-removal flow.
+		if logoutPeerGone(err) {
+			log.Infof("peer already removed from management server, treating logout as successful")
+			return nil
+		}
+		return err
+	}
+
+	return nil
 }
 
 // Status returns the daemon status
@@ -1227,9 +1394,24 @@ func (s *Server) Status(
 		}
 	}
 
-	status, err := internal.CtxGetState(s.rootCtx).Status()
+	return s.buildStatusResponse(ctx, msg)
+}
+
+// buildStatusResponse composes a StatusResponse from the current daemon
+// state. Shared between the unary Status RPC and the SubscribeStatus
+// stream so both paths return identical snapshots. ctx scopes the health
+// probe runProbes may trigger — a caller that disconnects cancels it.
+func (s *Server) buildStatusResponse(ctx context.Context, msg *proto.StatusRequest) (*proto.StatusResponse, error) {
+	state := internal.CtxGetState(s.rootCtx)
+	status, err := state.Status()
 	if err != nil {
-		return nil, err
+		// state.Status() blanks the status when err is set (e.g. management
+		// retry loop wrapped a connection error). The underlying status is
+		// still meaningful and the failure is already surfaced via
+		// FullStatus.ManagementState.Error, so don't propagate err — that
+		// would tear down the SubscribeStatus stream and cause the UI to
+		// mark the daemon as unreachable on every retry.
+		status = state.CurrentStatus()
 	}
 
 	if status == internal.StatusNeedsLogin && s.isSessionActive.Load() {
@@ -1240,15 +1422,20 @@ func (s *Server) Status(
 
 	statusResponse := proto.StatusResponse{Status: string(status), DaemonVersion: version.NetbirdVersion()}
 
+	if deadline := s.statusRecorder.GetSessionExpiresAt(); !deadline.IsZero() {
+		statusResponse.SessionExpiresAt = timestamppb.New(deadline)
+	}
+
 	s.statusRecorder.UpdateManagementAddress(s.config.ManagementURL.String())
 	s.statusRecorder.UpdateRosenpass(s.config.RosenpassEnabled, s.config.RosenpassPermissive)
 
 	if msg.GetFullPeerStatus {
-		s.runProbes(msg.ShouldRunProbes)
+		s.runProbes(ctx, msg.ShouldRunProbes)
 		fullStatus := s.statusRecorder.GetFullStatus()
 		pbFullStatus := fullStatus.ToProto()
 		pbFullStatus.Events = s.statusRecorder.GetEventHistory()
 		pbFullStatus.SshServerState = s.getSSHServerState()
+		pbFullStatus.NetworksRevision = s.statusRecorder.GetNetworksRevision()
 		statusResponse.FullStatus = pbFullStatus
 	}
 
@@ -1469,6 +1656,151 @@ func (s *Server) WaitJWTToken(
 	}, nil
 }
 
+// RequestExtendAuthSession initiates the SSO session-extension flow and
+// returns the verification URI the UI should open. The flow state is held
+// in s.extendAuthSessionFlow until WaitExtendAuthSession resolves it.
+func (s *Server) RequestExtendAuthSession(
+	ctx context.Context,
+	msg *proto.RequestExtendAuthSessionRequest,
+) (*proto.RequestExtendAuthSessionResponse, error) {
+	if ctx.Err() != nil {
+		return nil, ctx.Err()
+	}
+
+	s.mutex.Lock()
+	config := s.config
+	connectClient := s.connectClient
+	s.mutex.Unlock()
+
+	if config == nil {
+		return nil, gstatus.Errorf(codes.FailedPrecondition, "client is not configured")
+	}
+	if connectClient == nil {
+		return nil, gstatus.Errorf(codes.FailedPrecondition, "client is not running")
+	}
+
+	hint := ""
+	if msg.Hint != nil {
+		hint = *msg.Hint
+	}
+	if hint == "" {
+		hint = profilemanager.GetLoginHint()
+	}
+
+	isDesktop := isUnixRunningDesktop()
+	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, isDesktop, false, hint)
+	if err != nil {
+		return nil, gstatus.Errorf(codes.Internal, "failed to create OAuth flow: %v", err)
+	}
+
+	authInfo, err := oAuthFlow.RequestAuthInfo(ctx)
+	if err != nil {
+		return nil, gstatus.Errorf(codes.Internal, "failed to request auth info: %v", err)
+	}
+
+	s.extendAuthSessionFlow.Set(oAuthFlow, authInfo)
+
+	return &proto.RequestExtendAuthSessionResponse{
+		VerificationURI:         authInfo.VerificationURI,
+		VerificationURIComplete: authInfo.VerificationURIComplete,
+		UserCode:                authInfo.UserCode,
+		DeviceCode:              authInfo.DeviceCode,
+		ExpiresIn:               int64(authInfo.ExpiresIn),
+	}, nil
+}
+
+// WaitExtendAuthSession blocks until the user completes the SSO step
+// initiated by RequestExtendAuthSession, then forwards the resulting JWT
+// to the management server's ExtendAuthSession RPC. The returned deadline
+// is also applied locally via the engine so SubscribeStatus consumers see
+// the refreshed state.
+func (s *Server) WaitExtendAuthSession(
+	ctx context.Context,
+	req *proto.WaitExtendAuthSessionRequest,
+) (*proto.WaitExtendAuthSessionResponse, error) {
+	if ctx.Err() != nil {
+		return nil, ctx.Err()
+	}
+
+	oAuthFlow, authInfo, ok := s.extendAuthSessionFlow.Get()
+
+	s.mutex.Lock()
+	connectClient := s.connectClient
+	s.mutex.Unlock()
+
+	if !ok || authInfo.DeviceCode != req.DeviceCode {
+		return nil, gstatus.Errorf(codes.InvalidArgument, "invalid device code or no active extend-session flow")
+	}
+
+	// Preempt a previous WaitExtendAuthSession (e.g. when the tray
+	// notification and the about-to-expire dialog both start a flow on
+	// the same deadline). The older waiter exits via context.Canceled;
+	// the new one takes over the IdP poll.
+	s.extendAuthSessionFlow.CancelWait()
+
+	waitCtx, cancel := context.WithCancel(ctx)
+	defer cancel()
+	s.extendAuthSessionFlow.SetWaitCancel(cancel)
+
+	tokenInfo, err := oAuthFlow.WaitToken(waitCtx, authInfo)
+	if err != nil {
+		if errors.Is(err, context.Canceled) {
+			return nil, gstatus.Errorf(codes.Canceled, "extend-session flow preempted")
+		}
+		return nil, gstatus.Errorf(codes.Internal, "failed to obtain JWT token: %v", err)
+	}
+
+	// Clear pending flow before talking to mgm so a retry can re-initiate.
+	s.extendAuthSessionFlow.Clear()
+
+	if connectClient == nil {
+		return nil, gstatus.Errorf(codes.FailedPrecondition, "client is not running")
+	}
+	engine := connectClient.Engine()
+	if engine == nil {
+		return nil, gstatus.Errorf(codes.FailedPrecondition, "engine is not initialised")
+	}
+
+	deadline, err := engine.ExtendAuthSession(ctx, tokenInfo.GetTokenToUse())
+	if err != nil {
+		// Log the full wrapped chain, but return only the innermost gRPC
+		// status (code + clean desc) so the UI shows the root cause, not
+		// the daemon's wrapping layers.
+		log.Errorf("management ExtendAuthSession failed: %v", err)
+		if st := innermostStatus(err); st != nil {
+			return nil, gstatus.Error(st.Code(), st.Message())
+		}
+		return nil, gstatus.Errorf(codes.Internal, "%v", err)
+	}
+
+	resp := &proto.WaitExtendAuthSessionResponse{}
+	if !deadline.IsZero() {
+		resp.SessionExpiresAt = timestamppb.New(deadline)
+	}
+	return resp, nil
+}
+
+// DismissSessionWarning forwards the user's "Dismiss" click on the
+// T-WarningLead notification down to the engine's sessionWatcher so the
+// T-FinalWarningLead fallback is suppressed for the current deadline.
+// Best-effort: when the client/engine is not yet running the call is a
+// successful no-op (the watcher has no deadline to dismiss anyway).
+func (s *Server) DismissSessionWarning(
+	_ context.Context,
+	_ *proto.DismissSessionWarningRequest,
+) (*proto.DismissSessionWarningResponse, error) {
+	s.mutex.Lock()
+	connectClient := s.connectClient
+	s.mutex.Unlock()
+	if connectClient == nil {
+		return &proto.DismissSessionWarningResponse{}, nil
+	}
+	if engine := connectClient.Engine(); engine != nil {
+		engine.DismissSessionWarning()
+	}
+	return &proto.DismissSessionWarningResponse{}, nil
+}
+
 // ExposeService exposes a local port via the NetBird reverse proxy.
 func (s *Server) ExposeService(req *proto.ExposeServiceRequest, srv proto.DaemonService_ExposeServiceServer) error {
 	s.mutex.Lock()
@@ -1535,7 +1867,7 @@ func isUnixRunningDesktop() bool {
 	return os.Getenv("DESKTOP_SESSION") != "" || os.Getenv("XDG_CURRENT_DESKTOP") != ""
 }
 
-func (s *Server) runProbes(waitForProbeResult bool) {
+func (s *Server) runProbes(ctx context.Context, waitForProbeResult bool) {
 	if s.connectClient == nil {
 		return
 	}
@@ -1545,15 +1877,7 @@ func (s *Server) runProbes(waitForProbeResult bool) {
 		return
 	}
 
-	if time.Since(s.lastProbe) > probeThreshold {
-		if engine.RunHealthProbes(waitForProbeResult) {
-			s.lastProbe = time.Now()
-		}
-	} else {
-		if err := s.statusRecorder.RefreshWireGuardStats(); err != nil {
-			log.Debugf("failed to refresh WireGuard stats: %v", err)
-		}
-	}
+	s.probeThrottle.Run(ctx, engine, s.statusRecorder, waitForProbeResult)
 }
 
 // GetConfig of the daemon.
@@ -1682,6 +2006,8 @@ func (s *Server) AddProfile(ctx context.Context, msg *proto.AddProfileRequest) (
 		return nil, fmt.Errorf("failed to create profile: %w", err)
 	}
 
+	s.publishProfileListChanged(msg.ProfileName)
+
 	return &proto.AddProfileResponse{Id: created.ID.String()}, nil
 }
 
@@ -1708,6 +2034,8 @@ func (s *Server) RenameProfile(ctx context.Context, msg *proto.RenameProfileRequ
 		return nil, fmt.Errorf("failed to rename profile: %w", err)
 	}
 
+	s.publishProfileListChanged(msg.NewProfileName)
+
 	return &proto.RenameProfileResponse{OldProfileName: resolved.Name}, nil
 }
 
@@ -1738,9 +2066,51 @@ func (s *Server) RemoveProfile(ctx context.Context, msg *proto.RemoveProfileRequ
 		return nil, fmt.Errorf("failed to remove profile: %w", err)
 	}
 
+	s.publishProfileListChanged(msg.ProfileName)
+
 	return &proto.RemoveProfileResponse{Id: resolved.ID.String()}, nil
 }
 
+// publishProfileListChanged nudges the desktop UI to refresh its profile list
+// after a CLI-driven add/remove. The daemon exposes no dedicated
+// profile-changed RPC event, and a profile add/remove doesn't move the
+// connection status, so the UI's SubscribeStatus path never fires for it (and
+// the tray's status-string guard would swallow it anyway). Instead we publish
+// a marked INFO/SYSTEM event over SubscribeEvents: the UI's dispatchSystemEvent
+// recognises the metadata "kind" marker and translates it into its internal
+// profile-changed signal that both the tray menu and the React profile views
+// already subscribe to (see proto.MetadataKindProfileListChanged, recognised in
+// client/ui/services/daemon_feed.go). userMessage is intentionally empty so this
+// stays a silent refresh signal rather than a user-facing notification.
+func (s *Server) publishProfileListChanged(profileName string) {
+	s.statusRecorder.PublishEvent(
+		proto.SystemEvent_INFO,
+		proto.SystemEvent_SYSTEM,
+		"Profile list changed",
+		"",
+		map[string]string{proto.MetadataKindKey: proto.MetadataKindProfileListChanged, proto.MetadataProfileKey: profileName},
+	)
+}
+
+// publishLogLevelChanged signals the desktop UI that the daemon log level
+// changed, so it can attach/detach its rotated gui-client.log. Like
+// publishProfileListChanged, this rides the SubscribeEvents stream as a marked
+// INFO/SYSTEM event (kind "log-level-changed", level the lowercase logrus
+// name); the UI's dispatchSystemEvent recognises the marker and routes it to
+// the logging toggle instead of an OS toast (userMessage is empty so it stays
+// a silent control signal). The "level" value matches log.Level.String()
+// (e.g. "debug", "info") so the UI can parse it directly. See
+// proto.MetadataKindLogLevelChanged, recognised in client/ui/services/daemon_feed.go.
+func (s *Server) publishLogLevelChanged(level string) {
+	s.statusRecorder.PublishEvent(
+		proto.SystemEvent_INFO,
+		proto.SystemEvent_SYSTEM,
+		"Log level changed",
+		"",
+		map[string]string{proto.MetadataKindKey: proto.MetadataKindLogLevelChanged, proto.MetadataLevelKey: level},
+	)
+}
+
 // ListProfiles lists all profiles in the daemon.
 func (s *Server) ListProfiles(ctx context.Context, msg *proto.ListProfilesRequest) (*proto.ListProfilesResponse, error) {
 	s.mutex.Lock()
@@ -1812,11 +2182,33 @@ func (s *Server) GetFeatures(ctx context.Context, msg *proto.GetFeaturesRequest)
 		DisableProfiles:       s.checkProfilesDisabled(),
 		DisableUpdateSettings: s.checkUpdateSettingsDisabled(),
 		DisableNetworks:       s.checkNetworksDisabled(),
+		DisableAdvancedView:   s.checkDisableAdvancedView(),
 	}
 
 	return features, nil
 }
 
+// WailsUIReady is a no-op the Wails UI probes at startup; merely answering it
+// (rather than returning Unimplemented) tells the UI this daemon is new enough.
+func (s *Server) WailsUIReady(context.Context, *proto.WailsUIReadyRequest) (*proto.WailsUIReadyResponse, error) {
+	return &proto.WailsUIReadyResponse{}, nil
+}
+
+// checkDisableAdvancedView reports the MDM-policy directive for the
+// upcoming UI's advanced-view section. Tristate: returns nil when no
+// MDM directive is set so the UI applies its own default; returns
+// &true / &false when MDM explicitly enforces. No CLI flag backs
+// this feature — MDM is the sole source.
+func (s *Server) checkDisableAdvancedView() *bool {
+	if s.config == nil {
+		return nil
+	}
+	if v, ok := s.config.Policy().GetBool(mdm.KeyDisableAdvancedView); ok {
+		return &v
+	}
+	return nil
+}
+
 func (s *Server) connect(ctx context.Context, config *profilemanager.Config, statusRecorder *peer.Status, runningChan chan struct{}) error {
 	log.Tracef("running client connection")
 	client := internal.NewConnectClient(ctx, config, statusRecorder)
@@ -1986,3 +2378,28 @@ func persistLoginOverrides(activeProf *profilemanager.ActiveProfileState, manage
 	}
 	return nil
 }
+
+// logoutPeerGone reports whether a management Logout failed because the peer
+// no longer exists server-side (gRPC NotFound), walking the wrap chain since
+// the client wraps the gRPC status with fmt.Errorf.
+func logoutPeerGone(err error) bool {
+	for e := err; e != nil; e = errors.Unwrap(e) {
+		if s, ok := gstatus.FromError(e); ok && s.Code() == codes.NotFound {
+			return true
+		}
+	}
+	return false
+}
+
+// innermostStatus walks the wrap chain and returns the deepest gRPC status,
+// or nil when none is present. gstatus.FromError does not unwrap, so a status
+// wrapped with fmt.Errorf %w would otherwise be missed.
+func innermostStatus(err error) *gstatus.Status {
+	var found *gstatus.Status
+	for e := err; e != nil; e = errors.Unwrap(e) {
+		if s, ok := gstatus.FromError(e); ok {
+			found = s
+		}
+	}
+	return found
+}
diff --git a/client/server/server_privileged_test.go b/client/server/server_privileged_test.go
index 225cf6494..8b6f78f04 100644
--- a/client/server/server_privileged_test.go
+++ b/client/server/server_privileged_test.go
@@ -6,6 +6,7 @@ import (
 	"context"
 	"net"
 	"os/user"
+	"path/filepath"
 	"testing"
 	"time"
 
@@ -59,9 +60,25 @@ var (
 	}
 )
 
-// TestConnectWithRetryRuns checks that the connectWithRetry function runs and runs the retries according to the times specified via environment variables
-// we will use a management server started via to simulate the server and capture the number of retries
-func TestConnectWithRetryRuns(t *testing.T) {
+// TestConnectStopsRetryOnPermissionDenied verifies connectWithRetryRuns stops after a single login
+// attempt on PermissionDenied, despite the fast retry config that would otherwise drive several.
+func TestConnectStopsRetryOnPermissionDenied(t *testing.T) {
+	// Redirect profile paths to a temp dir so the test does not need root.
+	tempDir := t.TempDir()
+	origDefaultProfileDir := profilemanager.DefaultConfigPathDir
+	origActiveProfileStatePath := profilemanager.ActiveProfileStatePath
+	origDefaultConfigPath := profilemanager.DefaultConfigPath
+	profilemanager.ConfigDirOverride = tempDir
+	profilemanager.DefaultConfigPathDir = tempDir
+	profilemanager.ActiveProfileStatePath = filepath.Join(tempDir, "active_profile.json")
+	profilemanager.DefaultConfigPath = filepath.Join(tempDir, "default.json")
+	t.Cleanup(func() {
+		profilemanager.DefaultConfigPathDir = origDefaultProfileDir
+		profilemanager.ActiveProfileStatePath = origActiveProfileStatePath
+		profilemanager.DefaultConfigPath = origDefaultConfigPath
+		profilemanager.ConfigDirOverride = ""
+	})
+
 	// start the signal server
 	_, signalAddr, err := startSignal(t)
 	if err != nil {
@@ -113,8 +130,8 @@ func TestConnectWithRetryRuns(t *testing.T) {
 	t.Setenv(retryMultiplierVar, "1")
 
 	s.connectWithRetryRuns(ctx, config, s.statusRecorder, nil, nil)
-	if counter < 3 {
-		t.Fatalf("expected counter > 2, got %d", counter)
+	if counter != 1 {
+		t.Fatalf("expected exactly 1 login attempt (PermissionDenied must stop the retry loop), got %d", counter)
 	}
 }
 
diff --git a/client/server/status_stream.go b/client/server/status_stream.go
new file mode 100644
index 000000000..c6ba547eb
--- /dev/null
+++ b/client/server/status_stream.go
@@ -0,0 +1,57 @@
+package server
+
+import (
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// SubscribeStatus pushes a fresh StatusResponse on every connection state
+// change. The first message is the current snapshot, so a re-subscribing
+// client doesn't need to also call Status. Subsequent messages fire when
+// the peer recorder reports any of: connected/disconnected/connecting,
+// management or signal flip, address change, or peers list change.
+//
+// The change channel coalesces bursts to a single tick. If the consumer
+// is slow the daemon drops extras (not blocks), and the next snapshot
+// the consumer pulls already reflects everything.
+func (s *Server) SubscribeStatus(req *proto.StatusRequest, stream proto.DaemonService_SubscribeStatusServer) error {
+	subID, ch := s.statusRecorder.SubscribeToStateChanges()
+	defer func() {
+		s.statusRecorder.UnsubscribeFromStateChanges(subID)
+		log.Debug("client unsubscribed from status updates")
+	}()
+
+	log.Debug("client subscribed to status updates")
+
+	if err := s.sendStatusSnapshot(req, stream); err != nil {
+		return err
+	}
+
+	for {
+		select {
+		case _, ok := <-ch:
+			if !ok {
+				return nil
+			}
+			if err := s.sendStatusSnapshot(req, stream); err != nil {
+				return err
+			}
+		case <-stream.Context().Done():
+			return nil
+		}
+	}
+}
+
+func (s *Server) sendStatusSnapshot(req *proto.StatusRequest, stream proto.DaemonService_SubscribeStatusServer) error {
+	resp, err := s.buildStatusResponse(stream.Context(), req)
+	if err != nil {
+		log.Warnf("build status snapshot for stream: %v", err)
+		return err
+	}
+	if err := stream.Send(resp); err != nil {
+		log.Warnf("send status snapshot to stream: %v", err)
+		return err
+	}
+	return nil
+}
diff --git a/client/ssh/server/test.go b/client/ssh/server/test.go
index 454d3afa3..e2be0551c 100644
--- a/client/ssh/server/test.go
+++ b/client/ssh/server/test.go
@@ -1,3 +1,11 @@
+// This file is intentionally named test.go (not test_test.go) so the exported
+// StartTestServer helper is visible to the ssh/proxy and ssh/client external
+// test packages, not just this package's own tests. The //go:build !js tag
+// keeps its "testing" import — and the whole testing/flag/regexp transitive
+// chain it drags in — out of the wasm client, which links ssh/server through
+// the engine but never runs Go tests under GOOS=js.
+//go:build !js
+
 package server
 
 import (
diff --git a/client/status/status.go b/client/status/status.go
index 5b815aaa3..a53585c99 100644
--- a/client/status/status.go
+++ b/client/status/status.go
@@ -55,6 +55,10 @@ type ConvertOptions struct {
 	IPsFilter            map[string]struct{}
 	ConnectionTypeFilter string
 	ProfileName          string
+	// SessionExpiresAt is the absolute UTC instant at which the peer's SSO
+	// session expires. Zero when the peer is not SSO-tracked or login
+	// expiration is disabled. Sourced from StatusResponse.SessionExpiresAt.
+	SessionExpiresAt time.Time
 }
 
 type PeerStateDetailOutput struct {
@@ -155,6 +159,11 @@ type OutputOverview struct {
 	LazyConnectionEnabled   bool                       `json:"lazyConnectionEnabled" yaml:"lazyConnectionEnabled"`
 	ProfileName             string                     `json:"profileName" yaml:"profileName"`
 	SSHServerState          SSHServerStateOutput       `json:"sshServer" yaml:"sshServer"`
+	// SessionExpiresAt is the absolute UTC instant at which the peer's SSO
+	// session expires. nil when the peer is not SSO-tracked or login
+	// expiration is disabled. Pointer (rather than zero-value time.Time) so
+	// JSON / YAML omit the field entirely with `,omitempty`.
+	SessionExpiresAt *time.Time `json:"sessionExpiresAt,omitempty" yaml:"sessionExpiresAt,omitempty"`
 }
 
 // ConvertToStatusOutputOverview converts protobuf status to the output overview.
@@ -201,6 +210,10 @@ func ConvertToStatusOutputOverview(pbFullStatus *proto.FullStatus, opts ConvertO
 		ProfileName:             opts.ProfileName,
 		SSHServerState:          sshServerOverview,
 	}
+	if !opts.SessionExpiresAt.IsZero() {
+		t := opts.SessionExpiresAt
+		overview.SessionExpiresAt = &t
+	}
 
 	if opts.Anonymize {
 		anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
@@ -547,6 +560,15 @@ func (o *OutputOverview) GeneralSummary(showURL bool, showRelays bool, showNameS
 
 	peersCountString := fmt.Sprintf("%d/%d Connected", o.Peers.Connected, o.Peers.Total)
 
+	var sessionExpiryString string
+	if o.SessionExpiresAt != nil && !o.SessionExpiresAt.IsZero() {
+		sessionExpiryString = fmt.Sprintf(
+			"Session expires: %s (in %s)\n",
+			o.SessionExpiresAt.Format(time.RFC3339),
+			FormatRemainingDuration(time.Until(*o.SessionExpiresAt)),
+		)
+	}
+
 	var forwardingRulesString string
 	if o.NumberOfForwardingRules > 0 {
 		forwardingRulesString = fmt.Sprintf("Forwarding rules: %d\n", o.NumberOfForwardingRules)
@@ -593,6 +615,7 @@ func (o *OutputOverview) GeneralSummary(showURL bool, showRelays bool, showNameS
 			"SSH Server: %s\n"+
 			"Networks: %s\n"+
 			"%s"+
+			"%s"+
 			"Peers count: %s\n",
 		fmt.Sprintf("%s/%s%s", goos, goarch, goarm),
 		daemonVersion,
@@ -612,6 +635,7 @@ func (o *OutputOverview) GeneralSummary(showURL bool, showRelays bool, showNameS
 		sshServerStatus,
 		networks,
 		forwardingRulesString,
+		sessionExpiryString,
 		peersCountString,
 	)
 	return summary
@@ -1025,3 +1049,57 @@ func anonymizeOverview(a *anonymize.Anonymizer, overview *OutputOverview) {
 		overview.SSHServerState.Sessions[i].Command = a.AnonymizeString(session.Command)
 	}
 }
+
+// FormatRemainingDuration renders a time.Duration for the "Session expires"
+// line. Examples: "2h 15m", "47m 12s", "8s", "expired 3m ago".
+//
+// Granularity drops to seconds only under a minute, otherwise minutes are
+// the smallest unit shown — sub-minute precision is noise for a deadline
+// that's hours or days out.
+func FormatRemainingDuration(d time.Duration) string {
+	if d <= 0 {
+		return "expired " + HumaniseDuration(-d) + " ago"
+	}
+	return HumaniseDuration(d)
+}
+
+// HumaniseDuration renders a positive duration in compact form (e.g.
+// "2h 15m", "47m", "8s"). Exposed alongside FormatRemainingDuration so
+// callers that don't need the "expired … ago" wording can format
+// positive durations directly.
+func HumaniseDuration(d time.Duration) string {
+	if d < time.Minute {
+		s := int(d.Round(time.Second).Seconds())
+		if s < 1 {
+			s = 1
+		}
+		return fmt.Sprintf("%ds", s)
+	}
+
+	const (
+		day    = 24 * time.Hour
+		hour   = time.Hour
+		minute = time.Minute
+	)
+
+	days := int64(d / day)
+	d -= time.Duration(days) * day
+	hours := int64(d / hour)
+	d -= time.Duration(hours) * hour
+	minutes := int64(d / minute)
+
+	switch {
+	case days > 0:
+		if hours == 0 {
+			return fmt.Sprintf("%dd", days)
+		}
+		return fmt.Sprintf("%dd %dh", days, hours)
+	case hours > 0:
+		if minutes == 0 {
+			return fmt.Sprintf("%dh", hours)
+		}
+		return fmt.Sprintf("%dh %dm", hours, minutes)
+	default:
+		return fmt.Sprintf("%dm", minutes)
+	}
+}
diff --git a/client/status/status_test.go b/client/status/status_test.go
index 44fc30baf..2babd9342 100644
--- a/client/status/status_test.go
+++ b/client/status/status_test.go
@@ -648,6 +648,53 @@ func TestTimeAgo(t *testing.T) {
 	}
 }
 
+func TestHumaniseDuration(t *testing.T) {
+	cases := []struct {
+		in   time.Duration
+		want string
+	}{
+		{0, "1s"},
+		{500 * time.Millisecond, "1s"},
+		{8 * time.Second, "8s"},
+		{59 * time.Second, "59s"},
+		{time.Minute, "1m"},
+		{47*time.Minute + 12*time.Second, "47m"},
+		{time.Hour, "1h"},
+		{2*time.Hour + 15*time.Minute, "2h 15m"},
+		{2 * time.Hour, "2h"},
+		{24 * time.Hour, "1d"},
+		{2*24*time.Hour + 3*time.Hour, "2d 3h"},
+	}
+	for _, tc := range cases {
+		got := HumaniseDuration(tc.in)
+		assert.Equal(t, tc.want, got, "input %s", tc.in)
+	}
+}
+
+func TestFormatRemainingDuration_Expired(t *testing.T) {
+	assert.Equal(t, "expired 3m ago", FormatRemainingDuration(-3*time.Minute))
+	assert.Equal(t, "expired 1s ago", FormatRemainingDuration(-500*time.Millisecond))
+}
+
+func TestSessionExpiresLineRendered(t *testing.T) {
+	in := overview // copy of the package-level fixture
+	deadline := time.Now().Add(2*time.Hour + 30*time.Minute).UTC()
+	in.SessionExpiresAt = &deadline
+
+	out := in.GeneralSummary(false, false, false, false)
+	assert.Contains(t, out, "Session expires: ")
+	assert.Contains(t, out, deadline.Format(time.RFC3339))
+	// 2h 30m drifts to "2h 29m" within 60s — match the family prefix.
+	assert.Contains(t, out, "(in 2h ")
+}
+
+func TestSessionExpiresLineOmittedWhenNil(t *testing.T) {
+	in := overview
+	in.SessionExpiresAt = nil
+	out := in.GeneralSummary(false, false, false, false)
+	assert.NotContains(t, out, "Session expires")
+}
+
 func TestMapRelaysTransport(t *testing.T) {
 	out := mapRelays([]*proto.RelayState{
 		{URI: "rels://relay.example:443", Available: true, Transport: "quic"},
diff --git a/client/ui/.gitignore b/client/ui/.gitignore
new file mode 100644
index 000000000..9f233d8b6
--- /dev/null
+++ b/client/ui/.gitignore
@@ -0,0 +1,8 @@
+.task
+bin
+frontend/dist
+frontend/node_modules
+frontend/bindings
+frontend/.vite
+build/linux/appimage/build
+build/windows/nsis/MicrosoftEdgeWebview2Setup.exe
diff --git a/client/ui/Netbird.icns b/client/ui/Netbird.icns
deleted file mode 100644
index 20af72825abc8eabdaa289fe0d2cd96b81217e41..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 80549
zcmeGFbx<5n6!#0yF1EN!aCevB4#C|axVuB}g<yf;?h>2;!Civ}mjHpF!6mrc<#+3;
z`@Hhht-5vZKX1L+so9y{?Vg#Q>FGY_dp@&kYwqL@fCP$d%{e#$0FnHYs<I3!5+M=*
z0H|`ZQtGcuvHxZW{Ofy#t?TOR0_3hPBLP%T5bwVxq%3vitdx`h#@BTS0E(~$VE@bV
zIupLm005H@0$^U3p#MJ02mc@6isi%n&-MQ@zEhL<_PU7>IVo|?51?ax`$*yeyy}YF
z8^!t1Z-fK*__!f)U*V;u$<8*}&UDB@LFuAym}>r%QSDhCq*?S)YScFo3q+@3W#sRq
z#0Rp-ZV0KIthAL-2v6Vqp~`Z&<`ABpHQe@II<EEJosQcN9zKQ<)-sIK*!A~3$Udkr
zWiEgX{{Ng_6ku<SrR}d4JrxeDjui_m80yB}3?@4+XAD|Lv`kQ+@mGP$ob>|uXSbB(
zYk8u|Qxt2(2YvAFP6_fASXrbxDe^{RG@W)I(P_(1v+viwFZ%vmgG;;NpmiQA`k-uD
z%`Ak)$&`<2InUjzx1ydjX0>d%EtfQl1pQSzIw4;__eIrH@*Q>|d=)BJpF?xTmxjTN
zU*E{s_OaJ|D^-Yqou>C)0t4!7W`jEOgsQ|U?~{YiwKPZ><?R>Da)SZY`^-6<EJn)=
zW<A9ec77jL%~TGG^ex7e9a_cNc!{z36n^)20e2`1H~P^ChnGexO$T<Tzms+x!b}HC
zTLejeVeHx^A0k+<aPm5`(plR&8YNX(mrh#B8};EBBNoTkA@lDt#T&;C$dK|yG{vVN
zex(^oG6BvN@K)_*t*4&(qPlh!iBo^)Vh}P}$4-!JOcIy3!?c&zn(s+CU3A*U7(#gt
z@P<<R&P<O-z1_99trjl)GI&AhBt(Sr?$21n6Km=r+dS#0wlc~??-+M4Vk0NwG@eQ&
zCEU&6w}Vm43DsFup-t?z*iGlS2iNk&t3P%wUbb&exFDBHO$E&qTS~5(9hKxG!Frs8
zitmkyNk!LF{WKDPQCuwvR9*jEK)2-K&~Dyv-c9j1^phJ=SC0?Rg`a|jAaL|KQTQk+
zTo}fPj0ufoO+xt89y0p&`d4zcoWbjF*_*yDWh>benZD)r37|M1&fFZk1sz?me=H`D
zlN1>QAv%}@D7w`W)(3q}qO>SNrtfw&(-?2cD{7o&v+L>j{O22N3-uk5^*KWC9Pv(}
zr9h#A7&#M-w}(b<OY=`oXC<LXf=7ogGV=IDm#}kcPHq8G=@S_cY>!Ks3^|58=DVN4
zBiLcP&nAm^%`Ctci~GkVLtw*FU&b{_2!z@x?q+1lgNPBk5k_e$g;7R?qR80$ZeqE0
z@-(UQi`V1z*}Lla7le+B+(j{{M@5u1VTKpgm(K@VDrIpHFw06f%NjFU+S-*y?!oe>
z=_8qfAK&VTPC;jZ%%dP>Wu?T_aSDAdO<`n=K-vcV%Jvl1MJ^WpN?WrA13_m)9iVK(
zE#RerfwP&M`?-b=LzZKVRS#O@GufP?i`C^Qykx=g(6rfJ7nh9g6V+}N0Lov5iSy^Q
z<#HsEFz4rl=w8H17!I6iVnI%E?a(ZHdgJJiOut{{SVq%5F8Ln9fW%1Xv+1L&cv!A1
z(F_JuLw92Ta7{BoIh9s*!RLIQPN^PaMHtsbn+6D%t`6TnYS1g4`))6{Synm9-YMY~
z&|;|76I!_=WvG5BAiD}9(<yDcq0wW1Aj5UI7!c$1Aq>O)gu0hU=EUBFM>LSP$HfKV
zFCjC*TR!i@n8@uVdMk`72R{1EQuO_HiHZnWx&TD}w|L{V?WrDOILFP#R#Fv22?+=n
zD6WmhFG{lTd{iW|WjNAP@605tI=b>g&UF6Hsk;E`JXbTUGXVOy`SY7X^-9N;7G381
zqIIWMO%rf2uU*D8`tW=e@}O`DAoAzp>2n0WmR8()`>Bj&FxXnZ9qCZ?{HPrT5jdyv
z$XtIz`|;OM>D)wi;CkdTx5E-Pz^&`r@QC-=>o~Pm#0918RpYa7)|)a9x9UcEzL1=n
zsmwUHmntgt+xX1|aDOl@dW`y|>OBq0Fo$4psxKavAbt?YD!W^uFs<TS>n9@>{aKY|
zY{(2ukq;=P1o0I4LX{Igkd&NYw>`qzm(zvyril~|pJm`Zum_Du*EBXD>tPT9+)k!N
z=gF3prmi8Q187V|?~k*VbwQ91z>>vp(w#$N898ShCV(1=`z8BNM++P5#iShFk+3nr
z-O(Su!AM-F@s)x?$fsj7Rm9zNrmcnSJc%uf7(L=F=K7}lMpS(=CV++|0HNdD^47>?
zQxUd|%Z7_g6X(UNVY|_)f1)qPc*@p{8HWf6@4EMwf+8phNaoSG;)xMNB7~x(6Ez9_
zX4hb87X14`ZDtXO?;{<!xy@I?hp_hAM&kknI53d@=!=+9<5kh)x;UyBIOsttQ_aAj
z1<cAm3wa-yDzY9VfyqYdfY)&0Ghz$zQ}4XF{(Va%q9mzvgVGb^;tUxdJQa@b^%iGR
zdo%G!g5fsYY(KkHsV4!}m;V`B628zKJ9?a6ZVgmpY8=+v2ErIxdQ+<tvVU@)3YV~e
zVC<d3;n%fCw~yv|ZLLX4s{q+^5viNEKK0(eypzL{mA?}}U>~(;AP@#5zovWXr0eTg
zf4{GLh)@*ko6XOslx-)-QgbLj1XBU_M==+)_k7E0A51rG$e%F@rQz4-<_n@-(Y)hY
z7tihxK^Qirdr+|#<vl1#SZ75Q<A7y`^^@+kI@ud&gPA~eeky#<Bb)>l#3gdmff<2s
zcz~RIQw>uapJ)T*<c)WVc87%sm|s*7%`kLz(Hw=n$rhu>f(*yw$iAl>ia?$d4%;1C
za~-`;35OTkPqX?qOZG9WM2J%+2_0T6i+YK<6@g@ZRMB8!V-ohu@U>8Ao=E|yEb0>8
zKhBtFc}))j>yT!<tSFU5I`T_2?eSrj?J+d&i^x=7(eL1jI73%f-d||3wo(3)Tbu^j
zXoUa*iM!0tIQg<6e4U#^VH`lB#BCpksCwQ7YYl;sx%YU2)5m4K{M<RfB=4IdhV1{_
zbV_+DX!(auYE;X&;y<fIPFh*2TEZm6)|{Oe0I+iZ7xoeKH5>GQw~xMyn2x?C{vWZA
zp#LxS(SLgYWMg5yUylIzANG-<?PuZv-0FkBt=^r7a9M(ju#ki^5IiOh|0k(+bWBWm
z7z%_aDp@h4gpcGsM&FkP-&4Gs2v$P@1w%q5i9g{)LddattU4oFkD>hL{$D!}SNPj2
z&pTI1?BiOS{o01gXC{<YbUd&8*8Hw2jD8;44Qi@G=wWfdNT4vNgcwCWhU)+QWU#<H
z=mN)a7nNbPF|q9N80k3A@dw(wv<wS(YU}#Y<hH@H(Jw{r)pAxVq;|(a?wp8&Ti6HQ
zmJn)Zy+@kyhSc?n`kD5A+t0S{o`XavFpklgX)Ipo%Ww8%X{%OEN0)NrxX>9!Wt0Q5
zlg_xTsAI-j1+3F#8M-m&8m-W%m4dy((VzVjWLwyUt@MZMiI)A0$7GW0fIC$N7pEZq
z-lO~iw#jdo=ieq&)@?Rz73z{1klt?`@4JYZk9@s#r`W*uln4EYpQdA)_&g>+?a6<C
zW(<!K_|=vZl9So0lIcrIYLcTnh~>vqGIU`<##fB94&dCOhqoykV$Ewb!+AV6GVA+s
z{+XN?$+#!i529pQ7!+uG;o^6GbS?(|OcQuB|5@WyA6z~3WHs=N2{V-++P;6l_#q$F
z#zQ!F!YEy?4i$o+4&akzBBE5IAKuS!-+Oc3T_xLy{op&<TJT0sEi_=#T7O{?ePhf`
zNBr%Xko#8M?ke!jbQ)8{w}R>X%dp{3L!$Z<JVi{5F%<FdTTQA5udK-*eXcCd-N8kv
z=*?{7=~v_HF;6wS6Zj8aMaVt6>GiiAx{3SalqL;(C7zI-F8y_?=6pfBI#_23W5T4*
zGH=o-81w)t8<Hg2d?lnQC1D46OBwbFLJ-wM%a$JxtG7YO@jOZ^Q@?~?TeE>=>B?*l
z%b;qb&-dnW!S|zkDsz>mpPbzuuo%w7zSawE%<|ysL4ytOcn4qwCEWNUGR|Rpw_VH3
zSvv}-C>r!`b3d(d*c5;iLY*K#<GLjoYHZc@6bm>BeH2DCZbc&xyf#S5{yYR&bfQ}N
z4k5ue^Sp1iMc~kIO!UruBNs!R2M=AV9!gd5pMB4Dx)j#b$hXwApX63cfPNQh5C7*v
zADkHoUTC~~U#9`w3dvsZK}D9QK0wF}TKFdW7mx4}KU*m7X3M_~zAY6$@K6}D=W-%K
z8?=GaQm=i~FgW`adK9EEzDUq!Ivc^qniaK?5<Nc{vcz^UFfbb77)l$!xw&K`b3$@=
zj+_IdjIH5&6_Uh1yU<4+giHGfL18@Nq<)`nZj}%}8t!GbqWnVH=TO`uY6p_SPd3w?
zy~Vp^p8Rs?!#X4M2;c2XbU*OO&}ldAt@ezl_{T1AgGsbFY!ZIj+lr-@hB(#w-2OoZ
zDJ?sbOB&?hp04-=zjInz{&}0oRE0+P<&8RIMvo-FsGd7~*V&CVZ?I>hHhg|{^-SkD
zhRqJ`je~~jpCRk1pL6DvATuv@Gx_^RU4s*ilyi1zP#L(@AtP7+n_~dqaFF_>RYE#f
zKIAf((_$*7BUC$ZZAx|XmtJ#cvuLZY8Xfcdj$EGxr66q~BHKe@^c9l<{cIhO15M;4
za>?cTlWK^<!5i|;FsvR^3dQ~DDIolqglUv?2)L4`qDQY~ZkJtoqOwOQR<=lgytg>i
zX61szg)+vU4NMm~31cDJt??5ilOrH0($04G<l90}t!T4nY5n6+ncXc9Hi+B`es(oZ
zH?89SoKbMVR}@;!k%hY?E2=w(<K#h*4*6kyZC+;z99|O;MCQ2UiOi?}jzh6Slg<ha
z!pL`3W@HkHcDYF1SJhIlU`bbbE3-(W`|N+5uL|b&Y9(^eaOS6VK_nCRN0aV}uypC7
zW}FTFondd=D+BT3at^qN-k;OOtBkStW$z_t9ZN5av&uSnoA5h=U0pup;~9%^DdZb?
zp6(m`gNxZwHkl8qTDp#QN3F(DyLa1V3d^{S!J73<Lu%ieKbzv2(^dNL)(L}zprz@y
z%8}S%U&QqKH(6IUa&k9ze5(ACD)&Fj8neX(4siKIVSfxnO!T^Nuy4o`@aDC^rDkk4
zwAjX<J$`(T_zJznVV}iOuRZ614`z0mw@?XPe#mv-oX2GVR@iY)d<1PX@YC^@#ko{H
z6CxEGaF-j>Mmc`Sy*FnP2QNH8wcH*sb{dUcs=hP)9t|_^d&(4S@-W8>d{YvEV8gDC
zKJxY{{YN!Dru`g^|JxlJ%`k0gZ)SbI(D}IV=IYvj3qfgQ?RY&Ng@mRq9ZrcrbS9XG
zp;TnX7Dv=*iAXnsyzDHU{VF-ce7?<Y0wFVCKP5s871e1iLJjlIvzQr&$+!`$T8z3E
zG4{0sC4xc!^O<GH=~k|7Ex+CK##`TV*apI=ffiQMAkQAT?9xvt=F<~hbkl5V!yfbA
zouC#;oL<f58bVmPZaKtt5?Ouc%7QNQ;~Z^%<4*w<qME4t1JxN#VAX9@k^pooMK7LI
ztuSX45Mt!-E)X#v4Rb|A+eZ>;RWh%54_~|uDvXoy{ANc=I|k}@Bp4&FHa54t9<M!i
z5JswjERn^ZKG+;dOcB$$NVf<!1&wk49%;60nU2iK;n1hGPhphtZ#sBtrSMp|`yE6l
zTYE)F3k>=6o{#gT8fB?0uqE6KAMJEkyU<mOmI=PDuWh8tkFNrdvMB1jDM_aJn}2G7
zU&|1SaBnBa73kEYN-lGO)a1Rv7xm?cLM)|k=ER`{kuNQgsYqsQ)!6iG&q-w-mE4;j
zrFUHe8MUDbI=g}r>ewFeMzP(Xz>{@kwR#>GZrzo3^<KA~5E&1BCeu?18+9gX{6<g?
zC4&zIe!xk<<*iyw<jB$b*+N8im5-TYwOqvJ4VCuAHe|rJ&PpC|I@&kVr*t)<#ZDM~
zD)gH{`toshz=D6a#9zcseeF-{a?90mCK#hv=-JHfMfJSSL;HE<N*9d9S9O@QyvwNL
zBV`)LFN=M?rS&1|x6Rj<lCv#ErtV>*xUb*Be?+yT;ldf0jE@z6FgnI<PU*qx!bf+L
zu(1GT6L^1~xEXy2A?eIw#J2P-e)UQzD;b{Wp_W!@6qjwwxHQ9vJ>Oe>H#KJ5F1Wt}
ztpVvLFJSbpuZ8z^33i1*zpUhA6$#=9D-^3kiM8;{h&c9p9z$wBDMF<oq^WZO_`qiM
zQ>C9CnjZ?jC(;MrWH<_w$+1pMBAo@BgJ{;F{;qTgrUR|?x%TK1(fA`-3VkXT(n0;4
z^SdnTGb5Rdz!^qY?MZ;51KWUkKpsDqs>I<{quYZ#B84>^?GSNl3tF1mWbmy=RSadV
z0**I#`wo)W9IwaarQS>%hFVp7DXuE`;Fz6FG|bVIv~Xq-#;<EFaZ+met>|Hy$7tCY
zHXM0dq2p6caj_={=}*G1jQOGZ2F0dEmH_85rPv%PLh^ph=e7VhDP4WRTJGZq9o=AS
zBr%V-O*h@~JXK_y>}oMsvgdbCx4QTx;g;ZrjT%it&xii|@Y|hdb<36E8%<Co#gWz7
zXNCc{ucTH#Vi^ldLh?V$D^(Ezcoj)~Q}Q(G_nPngqgJGyS+wS>{3mgt1Rs|#WC!c2
z!K8Q@{fQ&!PR1ORa^gw1I(-7u8lxd2S}|wOIRh2$T$A`nVkm=454`JdZtRDVaJ0ax
zN4n{0S;OkQ@gZ0^sy1#PIri&0mblO9ct_~9nw@c=5J#JnPGmvPhD7Ul-u%#>A{*j^
zho{_Od0bs`%7fa*n6SuC^JeX7b0N~k3;@UH7&NDebT?Eu31v(!<>V_56_$7=Pjt%M
zwqPM~hHJY#8ZzYOo5wGjJWjh0%Am*%7e8lvM*FHP3{^1mak;jy%WRsa3Ks6PLhzR@
zv`xM=li#Nvam3sn(+PsR+s$kR)JK%Y{H}2K!w-W)Sc^`^xp><&Q0bEx@%*vRNg_zI
zv=b#X^V6SgrtR&M_Z8sCSMQ{QYWoBuYC^LvZKy+K>gmTSmrDKYV0V(2ry3?&)^P}z
zsq5zvrlBqF@_KQ~x7r{GdY6-dFFSK;Y0^0ZjNsaWA*IH<m7c{%QXk$^*UiUp7Qd&y
z=o2+z;)hj4g$@gHsS;LfPmn6050*(^7&WcmHx)e#e)4_F!K%a~E#6;x;$$R(jj1q<
z?D0ee#Vg3=fl#Mv$?8l*k-WODr}y-N9&b9~dP=6N3INgHebJK*RIq<20A4HgCy*&3
zBRd8PRX>8Cwn(Jo`xmW3kMa6|DuBu`T6t(}Jq}Y(h|$9XW+{OW4O}Xq23}g`OX+FS
z<e1lT-%oXwTw{d3hyOCNXg8J?f!@&&9E!GaSOm*WTLweZvpkT#I5aP<ed&ZS(529&
z1>JfK!#C-AbQptEgpCP}b?Rw?y=;OZV-g3xKZjy0S6QrkV`rRBvKce>kanbFuIwnm
znTAaH5XeJ0f*tAnD_||2IqZFAKO?;T%P<^0^rlM_`Yrd_hc7=*(*wa-J%oS(gcgaM
z#~@CiB3lak)|35Kl616X?|6tfrO?tYlmC8|^ca;Hp=ruqSAo_=j4QMuAlev9E#&w>
zNdw!O$H`^4HL&!<RSq16;vov5zE2+=&M;Qb<UAUaq+Yf}m6R~1;=Qh-(3bZGHc^*4
zbZfknRlMxBSOY$g1}LS`SvoVwLZvy?MR#ac83q}8J8ML!yJ#k!5W&UkFr&#TR1Z4o
z23J@_Mt|T+Hc4%k$DnME8x^DqI(qqrCH_Hco)?MTt>G%5B|u?MT2+fqJp_-wmtvJ3
zWF-7OQKBQu7ShsIF8T9zt91(B9)#sgkDd99(NU7I{rTbilw$+O2f<56%pQS<m`Gjd
zOYucz=E>?DS1>u*%V`*#tWB_epSUAyC)HF!s9l5PSrKkqsD2D0rOQK|y2yfyV)J2^
z0AI+oE)9<Z+1-fpn$Qb1!)45{qetPDN>_Ae?H7aguoxK3Dp4BlT52!nNung%(+lTG
z7O3UEAq4Q0zJ(QPjp&#*R1kB@D<APYRJwgDVq~{_`Xg+2eLo$U(d&Vcf{;<UK8)Cz
zbppS@Ku+uK2O&WVb=XxHUP|S~_QO-QHQxI7+iZ4lw@$%fzkGM}C&ozzahxHvHHS+~
zZ%3u0X5qZ{;V^qGzY?Inac6sxb;l!Au66KtaMV8DskaSW0$xJ4dI(0<wVt-KgVkv+
z%uPi-jLPqxjh}R6CGN-KLWCmUV}gyv-#`rxkdElQ=>`t*J4(dhV{*^DJZuRc&reTy
zyA1QwPgMNOK-{A(r04;}VM9H3$QUbV!PLsI$*S>mtBZGYpHWwWDp{~6R;zZ9;`aqC
zDGL3ozkTn>-Y)J~l0|e=lh%Sy?m7Ryi~s#Sukf$A0-<-KOj;Un(2-r*w8~ScRKt8s
z5SX|K7DrX0z;X^z+a~fIUBDt4A@5~3f5EE2qnZYstOtt#x}Zs3v~Xx=1d_yVf*O8p
zA`}bhLSBE<+~cL$Z?gZAp)3PDyo}#}`Ys{G#xZwNgcKT+oDYhYX)P;+c@u_iql2!1
z%|vu^_)Dur^J!~N5tPXAWW5388FP<~BLAjO1-QbtVUwq#*{AM}9fjULK=F&(TqiRd
z2Ky_L;x@+i2K8UQ*7bG#UT@IMu|aD1$<(PNWL#KJ(2=P(F=5-${E&C|WA0CDrY^wn
z`E5(UGp>kSEOYNzABcu~EiZL*`lH-!f72mS{GPtcyB?FYR)IB@Y`z3Hd1&$0S#GaQ
zIzH*ilus#k^O*)oH6zsDBO{h1Pn#$cF9cba4AH|)3P;UCO&Rfsoo#Ubt>a=xl}I{$
zo_r>fD@*a}imxkueqM@rI=(QKnu?r^1I4%&!AC;jmHI}C;e~nZr|p@8Oz@EbR}k&>
zP%9=|`ryaf?ZiJ{+*EaA>CKOnC~xzRwr(6qFEKr16E-u!MJTx(p<d;-`ZP@n9-r~8
znL=jZIV`g?2c#qwCjBO~tL-%YZwn?)<fozsmfBsG8QDMo(}ez~I>o^S0Q7qQ-|EzV
zfjAKGzpGR4-O8-~OZ`6(y#oRNQ=R&64*+0&Kqv<QbnX8`oytLOAkoU$wb#kHY2`(a
zjL(;4LVq*61z#9@t&YD^@4NJ~O1KktNoHC35V+?1!N;s0{M*kx@i(kmZ9-`;Po&3#
z4QB%yWm7{{{>RAp-!hPMyi5R5ZusH%McI<yv+;_1QkDy;=YeL9Z-5`1Q%;4U-^u-P
zXZO?nbu&*43APDX5sJtTqV0iA2mU4g*XJO(3>!o31yBxhgOts*w$?SB@Uax<B+qP(
zq|U5CYl1pi8w!(0Hm1%MJe9tSDrFpG`rB@{ratco$&R<~D9~aMf)6TBek`DA1x>2k
z$?mzy(x1&&EPA)8+SQgc+?6L+Tf;7~+4X7KB$7Bt%(Q7UWW6{qbQua}(}wy1%5t@$
z#)xHttn79wLhj)+UvC(dI*1ZFNg5xL73D|wZ8mZBKR{r{6Ms~nv{>*)02sCskx}2~
z{J6egqfh$GT_?hc83;X2semgQxXnvuoRcITH0BOP)#RT7MI5*2m1os6Kj}~4uIQm{
zP2Z;-p6_f9_m}2$a{P&o09K~Vx^pqgstv9m+EN9&E4G5fp^|!%_;YnxHru6#Lg^=X
zZb;)nKQ)&@t^o@tUJu|0Yp@ffLsMUkZ&md~L&B&mnU6PR<{YdPM8YDh<I5`**OBx#
z^sQl%4!*p`a_nzUuK{7eI(soq0sOF#=i~owTa+=mV|c2u-lM>tN1<@$f_#-`=8Ms&
z>NfATlo4Sw@m0?TIv#)~UfcW^a>T?U%$hafFOhT*WTCOCG&fLF(74O+@RzUYLJ9i=
z0Xu_XIi}juYh=0kCl?-2HGCSN1Dkt)Wc!OZoBfu<P$y63(Bs|8rfVltJetvu>3(CS
zRV{*?#{`%YrOt1FO;nh38wGo(*InygLbcMHrFNFEY6g|P*518668-D%st2l!<}vFt
zS0AF_pj5w)%1MG@iY@7iH0~L{E*M)t5~`;>L<EfyEvE0uD)fxWbXzSI*f48>y)e@5
zO0B_(J1E8hp~sC%X_Sin&Cw%`*l1u%rmwi(fkNkCKR90}1To+xWo9PW=bbO=;C-6d
z%kTBSfiFnlaNYDr4fBsw8a0=MOvq3pMB39QnBw}iOr=UxTgjjs#mYP}2q=J4ThqpA
zyP)q;a_yWFks0X7PtRvZt1`L<(VscUzPZP8x_ZbuYdDHX(R`eZ7@$$n>5R<rLa#Fi
z$3l{aCc3C|IG@px#uJeyPX*0(is@c!JoYjeoN$)si_3ZgbWpze<Dw}yTN+cpVC`{?
zOpD`t8fTb?XySu=|LjIK_)^*NITH?=#%)fJy7Z0G@R#jMyvnC&+m6Yk$6gD!LGAn6
zY9=H8yP`A(6VN)%czRedt5E{$NrMwZ(Pei5t0?blHg?DB^0_Up5=)~)PoxiMJ@$nh
zh;b+$nyWS|Jt?BMC^S`~N@YJU6by{71b7k-L8_Gv)&<(Sd^MSsvYq*d<>Cq>ATdTH
z#AO$GCX+N<%rT^?_%TGK$^88vVq82`$d<C7j%{x3KWg^%2{a|&Mpru;E?E9dEKJ3+
zBkV>m7!WK==3wDDG|?t_D2~5XNwE)S?$%9-NKI{;@0f`H7Rvk7ud&cG+&}R993hLU
zHQ90R&+}%}+|8pb;z+70pPlQq==Gw%Wn|c!1OZIHY&`QeTSTm8DV?QHWj)a@oe)GL
zK+pxIEFb395USV0U0v{rk^38Ez3g~*>A>;#T!TwzYZNVV8r|SvVF3p-T-<&);9bS_
zpA})*1?B#361DC~566#rX<-G<m6i8@%?yt*F>$bF&8>~m#=9zQmRY-E48>r}=p`H5
z;16YkGzoG(^u$?sRN&<fB4Vq;_%&V@f^<Er><=smeEqqi7R%c(oTWwsC>f_+>79ot
zX21+W>(3jv<>ZMxe3`*bHALNKL#s%pFTzL5%gBPbF-22k^7u3{ZC2DSgmFi*BRz1T
z?@;%DMLZOhUv*$@+Fpv-obSjf5l&jM99uRo^B&9kKd$xiNRo|~TrQuY!cSg5K$gU(
zxU9OqI^)UEithKcGqJgkR#yU<oki7wqwBr;XQ;M@U3wauEcA-b!Ckku5__dRf0sXf
zu!gq1t-mrTe5X-da=iILM58wgjyS=u$pxxAMKMj@iymYx$w%Dx1>g1NjsGzoirgTJ
zt*}6RjR;%UX@4-eXsyuO%h=?p6KTSoSvRuwbx4mqA)#O+k=5*Kmx;xJcVKamH7H-6
z2~X+pN~0hL_F{aK8TM9tZk@Nl@qOak2I2q+f5q0G+EP$?9bMxGOf)Q{ez<x}LR#|S
zT%vKB4oE@^TpVd~sy`&lt_dyGcj2mOL-2NOELP-C;MT7U*|?9qi_v+oWmh%n2T_lw
zxA;$=txLQFJ_qYx*JTJBHeXuGNBpuXW|6@sNHNTb#3LEFla(&j<Ehv?62Q(Ug+YYN
z9Lhf=WF!xNC+Nce>E-Xx6`Nbh2hC*KYcI4aKeDF6IFZX^|M^>Xhfz;5pnHP>#Cf5`
z`_tSqBVggIIKrlSgg4^+=W5E(YM`5bI$0Id6|3g0<%bQ6GU}yDgt>~@d1t$Umg?r+
z#bb>FihRs(y99)G%`dUW-F--d-CNwQc?6_EUCZnSccKkecLS{ri#;qsOcGC>Du>Ui
z?R?$rLV=}g9NstpLU)5lt(w9Mdm7iOc8!_%X9KV9i!GiF4ccE|5Zp&!t@Ioj6)~ZZ
z+=Vz7v%xrbDh-v69hwN<>ng)QU+qX^@m1zc*KSE05#KMZwYIbOX?=5B4+HN|;eS4Q
zlE4AdLEjoYTz?Gz&QXfS?SL6uLvh6tV61$%BBdV;4ZIbHd^DEid;}^{z0JpNJCfL~
zo{06^A7dr-yP+4Jsj@CX492y6+=k8leo<etc(15vVqpOqSo`m#`A>Ihw8d=OIVMlT
zgx0QOkdGO-xO)fP6-=&d0*GrX&OZaaBy5>NCGB<enjhmhZcfb`9^oe!8g}Mt=(x{#
z9V>{Yu3j9vH$9jEdhwK*sW<86Z3tWgrRN`NjrF#KNU`8`zYleMu3|gmqqXXaw)}ar
z^Nu!G;4O}Tt+znq&GT1^)m|ST=A7r35=0Z`kKN2l$BqLtw+c`4!NTq*+;#75&*c>F
zb0WY^F>U!rebUg>zvWCS_we*8)>i6fJma`?^DHkB`#&Xvbo-iCf8nIX1myJ)vgkbP
zk%L}}KZ(v&v0c}n&(gJ53~blBuV!GKvwqew;&oq??78H-PldJegInAZL*}_L?e6z<
z6U$PyJbuREX5Yt9_UgqVuUe=mc3ibTIN=}J29Y^+_oM*%!)RX(uVwUBTCguvk;?{5
z@twfQ(|edEK8Om<?fqy}F;BQ3hk1Q_e&OrxU_K{PP!rCeuUoA7-REE|fT38vHpf#B
zT;b2cisZOHh~;Z~yObh79P6lWLJIUSmMG)yyD@?gbTL};_eYqTx`LDf$+7|_B(E<G
zamYxq+wKS*)LYuk^zmoxa8wXmC>CG5w^$Y5s>Q{~FLNii7==vSz5RMZ+=q&VaY@$R
zg^|CZhdSC)jxuqLoPRzmb4?A<Lwl#oPd2DTVgdlX0F3r{tbD9@S?ShH0yIhI(SOq@
zV802=b$#BQlU(<w7U&WbSV4F&clu!@()#meSYK+Y9>{lz{*u&e27jSGqis$x72+|~
zENAJ*`}3L>(N^<ABbmfHoT0{6Todd!avShymcjMDi055L3YPI1t(14c2TFk6j-Ktk
zb*A0+Q8=FW$VRh21@yhPpIVk+<6q4UIaQN%6XcMOE#fzOqF%XJ?Ce&l>O@2xZvLgE
zAn!Nn)?n!7c%1UrA?Azwub}Y;R_wmj0BY#?pqt7UPQg#`Mz-`Olju{qQrK*+;Q|!9
z!{{sz;#t?dAz#=2?!l1>`!E9ZIjtL?OdYIRa?v<U@WJ4+mUFGgnpI1ELR`{!<FS8H
zJ>H=BiDm+hH-jx}p)5aAOxf{weOLx=%0n7Y)d{#-c;b?%7vW@~oG@HZ+)duXE78o<
z?lfM`>$pf5Yad0Aeq-jZ1nORNQ+2zY@BWoIy=F1CE2Cer-ti*7<&I^4rqkcGz{db-
zYBv%++Dg>mFO;1k2_v?mCWYqgVEKMx8ay$xP@K=Z)|X%k+vW<W%-Oszt$euFdqHj6
z_pZl)kiT+sO=(XU%{nY^<)f<v#hBn;<D`tgfm2va8n2l|;TZc}-e1|cQoi)cYp?)Z
z*DaGqME;-0g~gJ4cRa9EQ5;$c^^v7$&6gs16;o#!XA^5l@Hg^3*;d!KNev!_2Ys2z
zfXnqtApb-cBIs4ZAo`g<*ti~JPh&z|;n?EWq@x=l?kXvkSW>(WqQJ+Z5z(={<T4SD
z>lIP5E@a>yr_QNT@eoYVo?Rq|;U$8VAM#G&L&MQ7ubq_mca%HIN#ur6HNVZtxxmyU
z<i9q%Y?0QQ@9%dQ?RBy%_UDD)7-k2Pimz=dX-W;N9po|zq!t;sD(Gc|cj!qFeYV-*
zQ0rd~WNv(%imlR1<!fdacs4PZ1PNWX$M78_xlv{1_Reph&$Ar+sE3>Ea)8KbI-k2#
zrqr}0CZX5ZWqQZraiT00y$K?pZEc$)YR|D}yO4k=7Z(pVCY;d;gydrft;om^du3-U
zF{dFm!E%tPEpkWtzHj-?o#^OiJ|sBDF~Ngt%AJgZ9casyr}wM?{l>t?nM}UHImKeh
zqGbJ-BO!8Vc2R1cFA%IH@<V<}K}-_Eh_-=+_q+CB+Qng8{oIkbtqZXfIT)(W%O~`V
z>_GJliN)a;BZ^$Sl7+Ud7o8I|e4)-qNc5l(>s)p-6v=Ep;6=!xIo?E91XK&*wUwS>
z-|j!dr{Ny3*1F39d$QKuf1E_qdfNk(%%~ECi6ITitxBB_Hx6$iRb(JkQ#a1`nJWRz
zs~vAX%;UVHeR-o%lqd02b79jXU7~LL#Zol$3SEddPVVK%1zG_Vb5X?7KHGVEs`O^I
zFdgL)M^SRI3wR207d@9&Bae^-|Be1!b+-FJp}tZ&T7B7s0nHVIJE0SUsNM}&<#FCy
z*gW~IhHZd-y=y`x0M*23sz1CsES~&CIQx_^YKwCekN7*qycL(a*J^BE%BEAd(vd*|
z>2P?9-5@5tKZaWtCPtD}KxEIW(V6Btzml2ZegZbf%88tAt1ukyBTs#5E079_YQjmv
zfS9WkXF1#cNh4%)2=tTNAN=Xq5q6+f1`8wvZ@q`3a6v6s8SJRtt0Gq|?rRa{G_;pz
z)1#ox0&{p$1LV;Q_&QF${ET@70wA&V^ZBh^CeOy;Dx^k+cXL%G887twSm2^cvC)(Q
zW}m;NiB^XV47{E92h|2E5i>8mk{PJnKIdPx+F@79oiEV(Xv4r)5%Z7b1|+RcSj8mT
z5n7+M;ZNlVlb4t!lfKivJiWbiFZ?6H06^AeX6BdvnmtpZAaqSim?#Gq&V;}5^s85~
zad%es%`!|ZoI;}(p-l?8uFGQxiYLjqm#d#dz35cMFGykwa1qF2ebynsX-x|g`$C|$
zozb{Vwv+gi)sebi*4=e}&_uACA}AcjZQmmghO;<sv%XJ+<bg1=01rskKMO-Z+qxW+
zsV(0O?neeOn(Ce-U)8PIN9jfr)vrlh5ZvNx$(RQ*Kde9=p5vs?h$PqmNJYyzZ+o%R
zd*EYK7B&m)w@|CRCG3I3dFJu5TQ6tYLV1a%3^olB>mPGG<05QGH<T0rgqo#FG3!9c
zMo&0Zp^yc%mE3uR&l}xQ#Bhrwf)?~;r|hAIq0!37cDA~#IN)t(0w$1bvZ&!#t<O98
zeP42t_D4R%GeItac5`L>mxTA6afM_Nnb=ztDosMUKj`in=v&INPk+?buxrUMB}62>
zjBH2$EQ){VV)z*?$4PJId^NBX#7u$+nn8^mR)rD<mTMa7m=)j7(dv&zevQrs$Y+YI
zQHkvF*Ifn-YkBD<Qeaptj2$20)Uro1G0<pY`h)~*%ja3{Iv@9LpTzUeIVWV10I=BG
zd1li9f<x8^Ge=ceGMl`=*sX9StkDcVpCDgd;#ZKEA3CF0L@V1L`&517z5?W#cPSb#
z+Rb0%{?rjG{1<sWoDGoBLy4o7PgMGj;Y{$u1iaM0FVdPIlgFQUuxBK#4`5tx4$m3#
z6dOjisYmB%Q5@hU&8Vmo2iU>+qM33#g%t59-}n?}DjVXbF@Nd+@;?(0kiM{@k=&v9
zTH`%OM@UXA)<3%%TpuP24vRjtOP0|J)gREw4;gmZ8kbH+{<zSE03n9&dCpMjkqpC)
zpivzdVl?^KACCWYnk7l1Rl*{=Xg+^C_Mi?3O0LP<Y0hq%-bj<`Gx!>{(6iUys7py)
zP)#UzNH1vchppe-)cBYBNklk^;@7b(Dw5SxrNoG7t*iN0HyUj)6v;Bs!p!jJTs5t9
zjO-79dP!u3Za>04z7s|r4Jr6b9c*XPGSU|f^e}S%Tv`e*Fm!J#VyLEPr+}z@884P{
zPC8edX5Q)PPuI}`BH|Tz&m{rs2Wn^wW!V=D9sYWlyhSe(R}6^V7;jg><$bK!aZIRV
z4E>$Xzk(pm;FdTVu^DFs6~=+Y!=cg@({^bR1m41tb+Mn4n==5B75@##J0y<=vL`VK
zi{i3j+1JAn8y<N*(Uw#o6EiXny!bkn^33myKQ%?{9U;hAHM5uoAhG=ZR|(-J>q^Cp
z&qYN9`&p$itsDIJ+}E(j7bz~3avToUWrAE<Nj{xGDmJn^E9C6zL)+;>6lrT7^h-ts
z!=X6__$I80POO-vd^8a4d?6Qk@8b8v=M1*vzelIH=p@t}bw*}v0KGNd`&vttiDa_A
z>>lSnM%XPU3u)M!{s*IT>o9XN72y&~QTo)BX&8cnJL<J=jvfdW1rS+7uhdz{ec?~<
z?tqvgj*0WOE}n>vsWmX!+K*serbnr-LFGox?t9PPtwqvMZCeTfNUT+xAn-D*f<YwG
z9g>F>gYhlxDIT@f$=dfT7d5r(l9A{U+*BP|c=YnQ?_18&hf4`wH850coXs(CDVbI=
z+Lq1YqeyJ}K|r$d&3<vw)jg}@=Y#KWBB_BQ+J)#8^y59A5w#DZu3#vqrHRKV9y5Bb
zGeaX4d!+<-Qx4AsZdf9g2jOu6*7NQk3-XMNFFu7KjW1c^K~CM9Dn$T!%Y{NxcWv^m
zLb}&dQi)z3klnd6IT|=ItbsQz|4Ah&7^fp_Ho(J>2(Nf|m`{)Ly%`*^&8it5q{cg7
zY<e5;tp;9Nb;*ItxS=a&k9e;xmg39N$PBBo`(}XEFO`)H1OBrb<;S4`mCa~l*Ppj>
zwVbDNI8}CQC{e27JC@yl4>9B`S71&T`4~L`HTdgNjlqh)*to~MSg%*;0bWPR;cLcH
zsVbV{_mhDBx%;GJ!5NnCJngKA@l{Y;=taDt`LC1vqm(St6HcCln+b4!LKsXXZCBU@
zyomK)=B1}R)T%zoVrMjh(F|E7uCH<2KjZvYNXkovjQBf70zAOIu9A<_)qFfrXT~4O
zMgp>X8kvHlt?zK?-SL;8WIZ;8%2a|-O}pPEllt>up2ptE;sHai(Gx`@!^W*8<~A_t
zHK#SB5ZeQZ<nn;Z51b`(*gplGRv5o-h8AD&TNmD}xh5p)cJzVs<=(z36FMn}=lV6M
zQH!I24UIoFMrO8PHUpy@=;XM*A;ivo|Co~3=D5SO`PvE+SD1m!S&adfQe*g(Dd!Jn
zs-Z}X^EHkEUbL&(A9%e#(J8@RfAjevvLaLNyem^0_)BTd^<s3ORysEEY$#jn1qDUI
zzjT)*RQI|by`#t2ixfj_g|2eMX*_H^`|lU81tt3`gz`@w7|gGLcpklD)i%qY!u__k
z(MEAh#;+c2aVmrkj)`O^GTbQnMo?s#gSEZqAWw1I(Rx;+xSveSfPh6Qy(6Q}%>7WM
z=beU*Fv#foP;7DAT)o82HIrQ{5al?~AmJC$`$6K$1zmt|SXltE#EOut_g#XqCk?C^
zZ$jw<pUF}^zTKlOP5$V%7-1MgL6tz)<<xWTEXGIRwa8e%Pq9*a5d&)vYoDu(M829B
zwohA}WQnj3jIlHmBhPybdxTdTN>SrMF7W&^$ZK5~(?}QaNErXmxs@Nes7UqAM$(|8
zlWQy*#jDUrfAmKKWg_H{h#|z{1RkVT$STG3AA67?<gLvp?5h7h|7jsI9H;nH&1$M8
z`(sx&qNDuF{5}Tlb7EkdiUuF)>X8{~{;Tm`H8A}tLRe9J>!Y1o2-S;WS76Wj@Xnfk
z>OHwtqOqNwDlAJ<)yeBU)V1?*<*G(vDa2cl*L+985x-4;ZNeBUuNH90I2@QBafN^g
zaHhRx!xO*9>IW_DipB`KJCOxW;ICqm&vT=TEq`48R`RGOZ)ix6>p$H-{09>Y8A^Iy
z%Pw#RjL8H^F*v@Mex#)T?BAw>uG$`e>&~pY=Xj?LZ`GAQ#*>gX$igB_a|?Pc!bP?m
z`O;WDH-tInfy9EE_ji_R%E`FYR6F{U7#1?d#9oo<Ci*?`3VaUi3o{@zyuEqa|I*0q
zNpU%g4q5s;swtd*zz)fTIGF0xn(iD%EN<LUMHJ9X5aDaZ)d_XGZ3_OZ%T|0alkNE;
zHON6=w<CwYp8iQp|N8a02l6BT*!9FxbAzpbih+Qx6`J55i~MBlC|45#Dg8RCTd!Jg
z5M&WMm>SsOwr)7$b^KA2gn0X0M44GTCXP3b4w0;AHg5V#pYlFhAa4ebQOQ{9X@<Rs
z8DvW?uJA+KT^l?+_TaJN+snC~hAoy~s$v0}!tTmQ+a1TpmlXa0VFG&%;15Ych=(M4
zU>YVu#15Trz=U14?KSFV4j8-Q0?6d8UAn+!`px!C9WR8U3*echqS#Q+$0x`8hQS9O
z*k#g3>hI2&4ftw|k4OBNI>|9e`2i0Qw)!$NAb*6+hp8W2gD58ok}wfL4qkws-NRFa
zOT-Hk#%IzLi7>PJv<+<LFC@qa3cZ%uGWK!UBhh_$f%Sqkp-78jN|?lli7AK~3FT*^
zgT#m$T=otJA1ls+E+`kNLwmtJmaLVpA)90zb6dm7x3-UQp;3M1Y~dL65|D;eY?;T4
z6ee&R4L5<~uQd4)t!l9Bo&q!Q-pc>DoNn@C=04eXS=k2+)e~DEdE*%j@MTucE^M8|
z!q?0;R`2btq+A5jKY$+4GW=faKJKEZxTYkxlu9OL)dmtwT&)M;>)V;b9=}&v*ivpB
z?HJh?JaP^PkO6#}0y9m~tkFm=dw1(+!7#}bQahb{xjhaG*Kvt_Y>uJH`UV85;_5do
zwufFrY_&3305X&nSz^1Qe)aSIj)H5bZkltSpw>ON01P!OXUy74M4$5*MZEZ-G2Z-q
z@4|vpwtE&E3D&Eak1_X^ca-}b$FhHR*1dCtxCD@5Yz(Fli(34Roi2U&m(3%vA(<cy
z@#f=Su<W$~Gtf5tvR_-jhWrPM?3nLtfk9EzH@Fq><Lh}nu&UI_3%>5!>QORu=3kE=
zQ*&>{4ZyFR-zNXLs-td#wt8%FsH}OM&q-{kSl2Xm4=lwEY@1|Mt|%IO-!wU#xo+}@
z;6_1T8UK2Kudnb}%QE6h=U2mXZmz*gYi<00mqbj(<gap5tI=&6e=xCr&}jS`z0u3?
z2X`|61w_zmtcm{EIB4grET75|H;_1Vb`H4&+z-4(PrxwQjRbs6ml_h;_F?YvNjiIS
z^<S$$g*BdlV9VvrK>NJvKNp@y73bGom<!B>$vLJQT7#PsCL5Z%J{*^%2|ien9YbE@
zOfm?Q750;N=xwYbFo&EZ{@1tZp}<?T{hIG^qrs`{^#qSP+;_vPX4mttwGTFbt-U~g
z9d|1sWA{bd^xZy&#o-V&>~KB=Ik@Dr?1j3-F2ZQpe@@j$iw`-5aj?2T1L%Xx)l^=7
z`<-|;?ebvSP@F8JCmr$zcO$oF+QD|SrrO>c?RUrB>X*Dzw&wo|keABu?u4=qPW|D&
zU!{@>6@Ue<;B_Hm7OJlUH#AkNGXK-B8)jQIMarNoII(DE=F;mx&b*m5Z5l3P5I-T(
zH}Qlww?&s!8t37?S#Mw7<{w2`HoT6E7KgnvGXsFTB^Q&ZQpbbu;cG^bSPB0pa{S<=
zgvq*+Ksx;58rL&{?wQv{3$=3je7UWA?H54sD#}j2rRR){4n+cSKWC1W@my5jkN>s$
zHE{DA+XUo-(!SKTJ?h#rBz-*QPjV6UBATFZZ)R(cO6z#3fE|Qe5XetI(ENmu(?OsM
zjE%T!&3G{1)C|-a_u^M|^SgR_%FSXliDN=QM`W^582Of>#I4#oZybwTEU|N7#wPwd
z={o=m(dY~DXkgI%f@L@VS#u{f#S}Zegdk!PIV?M3<xiBm93NiiXG?>(k5fFaEeF-3
zCOH*tFH`@cwhS!q$r=UOE+n{x2q!p!Z115`XO`dI6M^xu1>tqugs1SAmuovSgL;M;
zcL$)3LmfHDm_BabTFW(T9l-;#q+wFG>4A5(-dQvW;_Cyzh5Iv6ynSUyYhhjIlU8(y
zphesUrRagF{7A<gg^?lTq3xQyCyVDp^w+~!XGFCp7!9P;Ey%n(jNhP!Wyd!`4kmbm
zQ}9XjAu^A9%s*g17>0!Y^baW_wGog!l-kKvWlx6wvo3E|k%mIG2aDnteo=PO8m4!{
zkq-93YH-rql{aT9pQO&QSzdLpIJ5==h5f>(eG$_M`MIYSU0lk5m$ni{U;QczF5@Q#
zk572OY<U2_1<I4C7I^OFhB|Bde5f}c()e6b?Zo0l5Y&&&N-Qe_{)7wo$&cdaPrg6z
z@3EE{3pf>%Fd=n7T$kFU7kG_csJXT0>KqoPKbMv8*MiBvR4U}#xP?1gb%oGlQp4hj
zL74lb`?tj4kzW{Tx^+8DAB)MSXm}>1kf1-bcC*7TwnTQ@Giu1?aS>k!a0)-L8YWoJ
zaN&o%5)Q(7Gi)&Ph%2o+AgfXRqvSFyfa3yJYM+t<Y6KvLd_xB5Uu%HrSc@7>d#$?e
zjr5N!7rKTBO+pd0(Vr+7UpjR!R0@3iS4VWF8dswo&}@~Hx?UP+yG2jCdGjJ{q0|;~
zWk22*`T`XVI7!cDC`sd=${samY}Dgv5x(m-dd%HsCL%O`7Wt7PO3)fl4^n;08H5_s
zEee?#)4}-VzgVF<ytI%V@U_`%c71`&ha195y!-iCmy(aTW%FpEAc7x@!PB_L4c=_E
zi80iCxNioVoXdDt{ki=|dCiBb3}WRQSgctX3?ENDk*YlPxWulYo4a3+sCIX95HU+#
zF;6}e2|$wLs5jmop@wYjm(a9-Ga2lw--Pz{jeh3ah8I$~fS?+A5Mpq+7R8bjP7y|a
zRTtm#NpEk`VYA<r4{@v@SPlaKOOErTKM^UK{Rz^nC8vO{pkJd&IMAU<K&H$>aem;~
zf&yNu8o$g8iQX%dUxV}O{vO>Fqdc)m*zQ!G{EC6dL3-jN1F^g?EeX3H($QW6&f$4M
zgdLW%lMe(eGCxDazQRH858BVwe{fs^9*j3fgs^~Q{y7odMq!+G7|P5|nwzsgX$l`(
zpE&tE*yLXIP9ptIfX;R_Fg6NLuAf;mJZ-&DMLVpn;iz=f-ktZ=Q&S`Sm2?7Y#sti@
z;VN)bRI{5`o*at*%Fh*hH4Hdd%c$d3Pe*>0KG5GK^Q$~$s;IeqV}<l<112$duZji>
z;^@8z>v@T2%_6)sp)iO{0p`sEG+|N;xh7|EIS>7hZZ^g#$7qh!NnGAi8}6=2@qVA3
zXx!EHuEsq!;}tACIjr(!DY96&NJZwo-kE5gmrRgIq`9j+`K!mTd{b^PPk?qiOc(fT
z(w2cdh#Gdsj}5jAnvwaH5YDyub~HwtSI(^a89OouD0?Frl%N!Sb5@rZ-6#1S#7Q4w
zKGK<q-m{8a#oDlp%<JSkEFE==n}^sh4;(!{8o(DEwZVt+7G)U+OenF1&{2HDcr~;t
zB`kK3-8lp`_|2>E<^HgD&|xrvREfs|1k&cy-t9oqPcCM&Fl_mNXo*fj911Su#Sa0V
z8zm9Or?jTTQ46qUR6xnlgow1wCTH~{Deh}`N{FQD+%xX-TASdmm(-8QUu*o5DbWTI
zz_pk_`YDn4VK;rkazFq*fmeLJ1d#NRFdSal(EPF3;$1BB^N%@-(v#Z%YB-?VD%A9d
z&c6ECTC7R?)~f5l7%y{3mL~MzW%OH#3m{6IoGz65^dqyw?{t1VXd*Q*(;Rj56~PAf
zJjfcJ4_(^Obpl1@aT!Ime3$bf9&iGv2(lXpSph$M-=Vs1-%v?*pmLpq^9xVzTtsLl
zs?rTF)jBN+UZ!Lr`9+Ho`5(nG)$hv>UloGzvyt16pPupG=>uhz6Z&PL^tF8|WJr{+
z_l7uT!Vu4s$l!mDTGKvEV`ZFAzo?`<`3yM!{p<_=<&#Rx&wUXJ7J9F`vKjMT@?TgO
zN+?lN;ba+!hwxq3d$H_6@TJF);NjN}>%M>sMe@CR^nGux%sC~Y4k`tCEC+p}^fnvQ
z;fCSWU9<EbNxl>*@;Y!2cjHgKb#oD`XMVZ|C17~ubqvsgz)QmhDirAX%2)Z%I^JmA
z=McwE3WE@$1^&X^9FG53D!8$p9YjB-VW@ryH2q7=nnGIfcUfcUIm&0~(b?%)bvJEM
zCLI#bl0MAe@V47p?l?;e`NbNa9z=ru@p?pZHj3^UJdPNf{r^|^m=5f-Xw3LwIg*he
zGw}NQpI{+7-#@VMA6WQ*iKqMr7XAYZ|AB@7z`}oE;XknOA6WPgEc^!+{sRmDfrbCT
z!hc}lKd|s0SojYt{0A2P0}KCwh5x|9e_-K1u<##P_zx`n2NwPV3;%(I|G>h3VBtTo
z@E=(C4=nr#7XAYZ|AB@7z`}oE;s5XdeBJ*ESjY_kV0`h{zY?qb-`IQ4sHUE%eKZLH
zf`SwaO{DkUn?L}iH|ZUuE4@n(T?M2|Z_+ym3WTaC(m|?pq)P9hge3R;-n-tl?ppWj
z{dCv=1B*#==FFZwd-i_jnFibv76T%KxwQ24{R#);8AfMj$C@&ih2x-TNf6jB0tY$)
z{!+q0V8`2N9C(u^0tE7o#(`X;K;STR1P(lW2S|Yj!*O7YS~Li(cnPHHz`%E~UqI@V
zCmIBD1K#j11_V|xLKuP#$cjNgskj&rHSX&A@&bE-!=ccZSC`jUC>-_{b8`y9{r3*c
zc{mD;LxqFxUZJm0sEf066!3He2oHGp9B~G@z@nl+kc*rD(l@BBXb{2q)!Etk)kQRj
z@DhD-c6NJ;ivkg@pfITO3)C4P8VZNNfN`fWAcD(V6zcl==zjz;hyl?eqM{-rVk1BX
z5iyZbQPJ<C-o?hmMn`~fz}dx!w_smSL?rlaBp^y;OjKmJow;jdbR;4IL=+hv?O|bQ
z@#bA*6bKd_W^HL{;Tnwq#KO5-AuPf6!GKiJ(QX!&FD(J75RtKw&K6b{z?V^Rv9U28
z7Jw*`u@Mo`q1OK^3OSr#P(VP4A7sEUBq$&#AS@shAqWA11j2<7f(QYy5I@io{6LC8
z=zo3}1Qa3&Jctm22nz8>0S`t9L4*Z_f$9nhhYNuOqCp5jJRu<wAwU2I;N5~k!Xp3k
zBSH`?A_O!FpAdo{EFe$}0<NJ0%);8`|9y}pP(BFqe;;Id{$}b1`1Jq9L6(sJ$3d3=
zl>h=-`U_w!@c+GLrIRq1RoS;<Wjf?+*hQa>@IFt8MI#mA6YSmcZAUp<^ff=Y58>+4
z^T(RG=T5sca^Bz(#T~myUV#@7T7fO<NRqGLASH8I7OzMYAa<Lr0gi6}>H@bHmy*Ra
zTK(O2kEgY(cY@sgrz?;2{qyRoya&%z$PgeX17Nyv5aj<P|BoL2j}iR;wlk;@fK!PD
zlPQ2EhMy9(?(Vc<u9c129YTFa6AjJQ>+i)&ev@i{di|xC0K-6b)kSGyRJ|FwXOt)0
z*q&j(5tv0CApf6}Ky0_gX-oUf2Wp??`llSfNfA8E8a>Om@@~(6^5<5FwpDQZy0|oV
z;JT|LwhiP$mYD-zzH}(-r8TNMUlzY4QpbHHN0c_LtHIz5>(E7NM`(~1_OGy4A0~=u
zzbW@ZODx~SHu%hLtZn+bM?V5C{bsCbbU;or7sGC~>qr6JVkWzqu&lXk$T+jomGU3T
zJIiaCI-&*}b4k`kf}ldmJr-VrgQk-m@R-8_cK$>Dd{6(Hp`c|w$jW2Ae*Bw;(2n8^
z#d>PVdPbZInem<Q4r1JxanOMZy;N8_A)Ym->0cT^wEIwV--Gwr_3r1(G+D7SA#A5w
zXYrRCYTw32{801VW&!C1uf~5netJP%k%CVxnN4(nQsdjb9>=*n6aYD>9#j6ODzXZL
z*{8p*m*ZqsZr9>3LM^wB3JizQ;ps*<Dl5nK|3b@(jxJeX=dp;<k!p)qHEsR5L3^Xv
zwC^x@cWVkilp%=>B9*ve9)!*w&$bd9#rf{shJB`bQ!NuPO`34Vl+|3`tNm6;kI6xh
zT@j~wIsM)&)K;$g2UAbz1gkqxi;qzA>9cb0^3HL8)aGXz+-&fAK0E0WIrUb?J*$;-
z>e0l~H6eyHspz*SoRQjFlw7o5gWC%X9PShr_zciO$lg8-zbO-CSI)oQq+ZA1*53G=
z3exL0H<8*u3o9FF2(3v=fAR9Y<oa~>;mu&*K$jo(JtZDPaYFoSMFwuDUv8&cz^h@b
zuJz(kz-X@JXx2kQsSxUU_tUb1bibsiz%9GKR=hr!0WZ!b<on~m0<gg}Fc?Oh3lBNF
zTR<O(676~ystjCFqRe#o)-1ntlD?IVqrn0)q18D)$IU%`;NKFYDZc#@<fEAA%m@lM
zCif7}CErIclZJLB35RiLU3Xg!TyraCO_7@Q-gX@PQZs>hQ-#lrhyDAif9DG+JxY;Y
zt^wAN=rKS8A)_J=M_2E0ao=tYVHn;tU1?)#o@#g}9QWM8ep7*Sk{L^Z15Pfz`l5v3
z7t*B(saEEJT6q=&Ft}rf#DA(H4_}&2HQJ20J-X`aVifomC*o73v~24pr=+Hk_ME7B
z5le$oe<*!X`ds_)FA)_;CQ8+i4AEl^+i&$*I#m-6E_J+Z*}^+w7wzhbS(=`{Wr4B0
zL-1&x&=f6kA6!9%`8>-AG6g^cu$)f}pzuT3)2k19${+dfTK-i)Z(rwzRU!9g?JEkP
z;UyFtgAM6Xw;1bJn5n74Jp@?5X)TQq4C8s%gB>aFH1}JQHbX65ONOkMuUk<l@x3Pp
z`=V1vaeR&u)iI2Z2zmr6^w^*b<6_}Ecdf33*LuS~>=&bHPkYXNJ?W2bUDwxtWKxVj
zyb`+MALTmyoP6?*Fou!sf3r1kgezB-=ZUN>w4n1bsS!sR&O*P&%y6InNH8)&e;7<x
zi!W)W{~lD1WfdamY3SGEgE9!PgD=1NUeEWUzI>(}Yb!NBu0hu9r@ow!9NScfu_Pmq
zn0G@~y;A<+l6z%YFQ?^|8UF{n*vJ=l?WF11$(~Oz2y~Z0b_PQ!pc6`kxwA{y{qjND
zGE3gRo^cvUX3#5VlPN+75zDd1#m4VO^S@)c-j0-B*gGM6^z(Xx;kRUxl2Fq|E`@gH
z_ruY>`?u*-1aPl;k`x7obSTP5JLF~3<%+@a$dHd>7fmmwa!NQ|3SP+YsK-Y*@W|MA
zw>xG8if8?YrZ5<0m)3*Y9f)?kx)xVwNINS%vy%T+@H-}{==C;fD+bd;fc5pP5F>y;
zZblH3^;3ms?ar6C=lc5!3UpWU-+sn_-3QZIsv#f8_m|q>AHl3Op0UxtQ^W{@)(Y|M
z5bzk-6u%|fOz2x!DRH!H6Pqp82ScqJ8dF_$g8i9rvB&)4OwaQhf)Z{n68@M>MG|Zz
z)2Tmn@O1VKHsF+Jc&AK;1!fnH;FqaA$}-&uz%_NeJY8AWbyNbaeInXGz~2)M>(9#g
zvbCUPN_%i52UoPGEG+UscRoJ|Lz0Jh*#$ehNQK!af|Jr8smL%2ut0*u@@^?sTIfIa
zJC51*hpDI){wX5YX^}Hoz0tA$6c@|(<0-x~hYbaQG{d{d{<Q2g&wjkUrQBq^dP)@h
zJvhvYBlT4-(S~og)tI@({F?>RbvAZpkmn@q6wZJTT_kaYevv->L-uA_Dc}l!__7>c
zsb6FZiN<paYcXIt!lSc#inwbGl>qfW0EhFCdr(Z*e;n$TKFX21Q+u`{M*+kHxb&>~
zXkzxrKY#9ZGxxX5AfU1p5A7o03P2=8+P)6;3E|wvNu6Pc447;#qY!+zshTxix&g~G
zV;3yFvUU;Ral#5aqHrFHKQCmiE5G!FcBEZeRh?k~Ri*>BDas_BC;oY1CCkz!#8LqC
zd0wGX92%%n7<z)-mUNb5_RcS#xV|LgF=0)C4;}EwW0B1-_x#t*!5yHr8alg3I0V-G
z_4o_w=*t;<ei-CI%-aywq}184EG%;N&F{?+-U`AjThKX($pp?&4MiEu*7?dG2h443
z1o&W0T=A#SI*@SaZHBRtk)hb4-&oPguaitpgv4w7EQTZyBuKng(q!4stslKCyyx;a
z2b92Q(@pfiyS4@QE-OTse#hUWv!5QXkn+I*9)y}%r~S={xB13OCTT}O5{Z_OVNliG
z@M5C=xbE%T*)$B6PXcwiaQP%e>9*_T9fnXTc_!G8Z1_QnUjD1vFk8WGnSxQdnJR@=
zFa_DHQ9b#5SVg=$dIA)8P{pAHLVlm^j{BJ+vK%|J`2_Q~YeF#n_os}zalRScq87%d
zwcIpv1(zKhl+^t0HMeIPd@v2Ih`RpE6!WyRTzVD0+F76mmZ6tsSdJOz!BKtft5?^r
zztC__m}-Z5cR3G6lZ>^F&zVo+k2uurh~{Qg&zXzdzxg?D%$$AlReP$FR;D_}9jB7y
zoeR^jYTZ&56A@4I%ICRKJn)<#`AnRMP(r&#xoMA{i4Um2ZQO`S44>`Z2m8lRzS)~e
z7zAvl>s{X`4yv;Rx~4vQ;l2UKmO-kp=;jRj(M-Xehz!*s6E-#K)UcsvH7UV{%m*i7
zry++u{z{)}r0Bl=4x{jx5bmmxHNfdzYh&N577{k?jIS%^ls{IUxNx3$>uNXxIv6(#
zn+h`^!7rz68Em}EI$M@YqsC|>^0sj`V3G-O&;KBK-NNgdFZpG;@G>8#m27)w*U6<y
zS3BPJ5zm!Fh7sTX>9U_5ud4X_(}6&*=>ki!`y$w`T=8y1wbhIn-i2Hm+~m>sVUhjK
z^pnaaQjF~3uUNmko*AN#PTQ)skLvP1cZld3KWuYK_jz6IvTCTx{-(yKgk7Z^_~-KL
zZNo3MSk5ra``hUc9UKjDr)KgBB{TuFays<a@~NnA^Lw(M!K>{vls9Nb!lrGy)9LWu
zU)oX|w{xkFu7Zr2B{q5)V<%RI$|J3YLsxEsj-4xw_8wyv)Ch4>g7mw|E|B#OWUw4_
z%Cuc`5u3vh-}M2xB<^M9BHrmjNU|gS1EIwC&rd4~yc5%U(-X6H#a|N&ZQy!Y82*Ob
z6>ht|*z5^Qe<n^_#*sz>zyUH+Ds2Tz9LJqAe(KugTkD!AvuBxezb=@{?bjW5<VNtO
zeK#LUhJ9%oxxdkQLq#nt_d=?gUH#X^1LqMv04lL;*OD>WU$f`68yW7^PfHGxHql*&
zcQ+MW9EC5pU4+T-)2f(#d20Rmu>hIF0Su!R%NPInUt?%}Uqt*zrz0U=9E$#G?@5Yq
z7|(4ePXW%1FHl8E<A*iJQyp1D;uvwQe{Z3ciO`ar?5q*zdakVzt9}8;vUxZ9#uVQ>
zuz$te{M@+SvLM@6!Mlp8)hUAol_l;%LN=l1P5%o15O=Z<NZd@;c#iqZJk^vcVpn%;
zHqG~V2o~ll;HH>qo;Dlv+n3V7KHCmmefg%reeA)nPy@pRuxlD`FC4p@rsQn8zDlaO
zgZMH3F&XM!f7`6rd}6y(;6_Pz3+F=`&G0Ysw!1HOb|6EPyX}TeyU=3wA&%cJ`Q!wi
zr+t~%vw{t4!<n(~?(Vk?GH+UmIWCoql|Ew)nJMGLwBDRgy!*DxF6mgn)3m`(JtnJ(
zOmkFqETY5cmB#+Qz7RZl$ya?*RxeW9<}P*lrv=}&f!7R<EoX)yuast`E2azG%aeW4
z8y*=ouR3NWy@OUe7MN^9le|%}(nE)J_m|r=l^?0NQvB(@p32z9tO^Ug(|esT(i}in
zF3)fPJ#S<VQIUC#T;a%*yO?H~F{(;hJkR7&qq%U_CQ9h&4BC1%@mo%vAgzGkJ#tL2
z%Y?JHZ|J8ev*S6dCBaAfqm9x*DHeX5U~ZQA1wCt<m_sM$G=qeI7elSQPkl@{pTdKX
zqon(x8`3SB&0*Ddhe^LH02dSaYdj6qcL@G_P@8`fVa|8u7%(8&SUCh&1z_Gf)buVc
z8+Cs(L9agfmll(I(laX1;k+Z|Ub}JuO(3=@cudwPO4h^)SMqeZfXSWh^Y>*lF=_q!
zyp9@4=U0l-0d!wk>~j!er-~$z@LD|8&ncaZVI^nc{{8bGa`Jr5B6Hhq=UeG(BrXlJ
zEc@NOGIBqEenfy{NglC`Z@2PW0E-snz!~@-2{C=`C5^~<FqU(LU3C13Tlhl_LRZQ8
zDkL?HJwlF&^kGX{f8}vuuDqd}T-Pn1c~X<-+lO@AtG(TQPfsIr6(iuvPzPnAbN3;R
zBr*NF#o0BSZ;ZQ;n(+}i3XWeh``xPbTb34HY!S)MEqN&Eps{qb8F#Qpe-AUPpECun
z!2T`Zx|Et<xdiWBhj810s7XgaNshI1W)>|{8FBf{?v`VzjA*?Q+py%C<It~95k^GT
zCN=)nf4VM|_$m7rWa%&<n&%(mGDYu9eV=W;^Cd=#^$n@|S-W1>&Bu#je@u@Xx0dX7
z>{cJGnP>V$pL5_@cFRTx&eX(Zjz(483{yc0MKUt9TLvcdFFjHEhBG$QM4kWbAqJ5!
zO$<-xQ&QvbPj|6Q0X1DJPbzkGTTG?UpSYf_?D|$E7opv<*=JEHJ^NGPF|Ok;Ag;v|
zf``poGZa*pzUv+C&)MW&%z1e4`(t0n4*B?w#6{*_zvrnkFNzT-f{?w5K=@_0!4*nO
zk9;>tQp3<c_y?Zu#(_N|i5a_YWBp}#@AOjkLq1Usbli^hzu(_hJ#V+Qdy#)LCMO#u
z*Dk=Hb(JLL3_Xu|#Vhn+&)^a>^V74)JMry{_7R#h{<Un6A(b{s;P9Ay+O;}wEfW)}
z0pP6O+wLSPoQd<?R0|!1=BRrn9$Ok5d>B^BNT51PfKci?JG7z{$zRKN)jVgSF2_mk
z<rE|X$FL+jZtO<1&W()DPR_MV{*Yi-g_;tCQ$cFUA=g&5uS&CW&~{vVIj4^>>19nT
zmR~&=4pb{9u_MkaMg!=u?;T+j&C&6ZYz!@JG&tepv#`>RmuoqZeBJb$zOJAt@$Tbm
zitiWq!v)6%@t1`{q$k=GueE1R1Y`e@mL@v}6a7mIU%XrU8=S7oL_3%dbNe2E&G630
zY|*`x@b&U-52XLWb<n*!wbH*CIW{1Z<0$W1qaP_C$XIw6SC;czSxL+dQ=IvB>I;<x
zEvPOq&@HTC&-G`IIUA;vC-Y-|0Tc{thBe27iNq^o8i}jNRJH@lsi0QL7_zR<)en{)
z#P&QxSFy)!YhqXI65nt4ud#^$qo>F6a3!oSi`m*OWmsLuNxPiv+V+po{drJkZ5uIt
zUB+~B4t~lvg3QwIR<Nh?@K`cm#-cj9q~jtXgVjT_oa?v%+b$pX*0c7pie=HXghZ58
zD=IQQ7e^3-Ef{~OOeT?r7{zFdAIuf6>t)d2giIs`Ie<9c?r1vmac<mtXG@)r#XXx?
zAUM5D?%CH5KV&gX%;kCL(K7T29Y%(}<}Uu~nMyq_^6mVmv(=i}ndnI;=gZd17k};Y
zj3K-&azqq{qxiT2Nk<!h8*ZW4RT)uG$)xyXj&}Rkv`ef;EQKIsi(%A=Od<k7gD1r`
zPD4#*3-2TNI>1?w%v+3We6zd}M&}tgCcAsSq|tE3{nPyTt`O7jrr-e><P~EfT}dnE
zx#nKyr_V1>y<b(%y2u2+204}8=w#jV3#rIG!@=pfh@r!uw)mls*bDm*!#`Wf?))gW
zPTaRYP7n|&@C!I{w%yj0{ru+MK>;JPpCdsyj{0Kso3VQVt)oLM;vQx!3Z<Uzs@HAr
zcCJf#RlQAs5F=r4Kbek557QgWF%qiJ%*%<+Mtwy50b9x|P$*4E4~g~r2X&!4f_-gw
zB+cA~9Q`f@yr#c!m*E}d2z3Mq(PGXG-8VkogY3?8^EaT2$8%+M^Ez1RzDRXE3K0Y~
z!~Eye`y6P{a(s37`G3JA9!nK4j1z%7Reevaojc(iv{cmEVthhj_pe9z6Y9DTinLC%
zW&9l`v%TM6uTpsG<zn7<1HPXTI(6V4#*Fmy3EnH9KlQD;hXxw9RAyV&-8Z!4HcQt!
z^hL}IUHlJ&aBC{4k3PH{CNj-@^n|({2LNDM17o?yQi}jTBde?ZVC!yPrJt`C{T535
z0!)|+_dHo1pqADqQQqk!W=HDIOX$}ij%LjCq}D0kQPbzze`BX#lV=>Bb;iiU>2;;J
z7@YCTHkGj3{eQaa^p(0CMv<=^WCQF}CjUdjz3Jx1vGKzr%I}Vvv<f-AaTgqcaX#21
zRpGcUTF@Q$t&}g?;>p)RS?=a><Vjmw&z69<5<-1yd%iKq>Ircj|8-)!YEO=1e<Goq
z-$|K|I>TS@;u^Yhrxin|8aqaoq$5Ys)wS#+o-u^7-^yD+m1hmWi9z_r3%8%P1KDmP
zIvSs5Bq&WRmQ*Y>z=i|KD&!d&@v&xWo?*>y2g*kJ?wI7ksnhWj{}A~tu`m+FU}Muy
zixT%G{-rF$GhLdMCg@pxXsYQ<a<wKv+%fC^7hP^T7An6bP_PX1B-@XM0K*$^^31#^
zNiVU=toz68#krT?J~_^+>Z~OW_G<bGvH=XIGKJGmwELei!@ly-v{Au}mH{{kD4O>y
zk^f^JM2?@d;{H47P`k5rVQ8Q_ypvEQWzJ{h&`UaDfcNs_!uN06rn~g+o%X73J8TS1
zPBf&p{!YaiA3m%EIwPHf3jK69zp<I<pICUl3{0<S2-ct!NCpPQSn_cL>~8q_kr?;z
zy|92YxAnPLyQVc{T4f7;i#2XF)%z3dpA^m9019KWb88@pCk|>JKfT)M9#G<_H*i*u
z<pLlEya4v^z<@HNEN|juuc!OXI?}=`IB`V?`gAFiO0iJ;ctDI3YPu{^gf60dX2kw{
z%d%hc0UjKG7XQ&_s^dia-#<g?%2)smgfK9KbS*IAzAK*2EF2Uvl2tMuR|FSzd(%FF
zyz8wY8+WM3+1+nf&!92puB?dxOu3=)tlX_e8O6)=jE<S1QWMr@s}9e9?Phv&)9EEJ
zn^&hT^Um$?Nh*0ndx+qJjk^hcbt|b1N#u~vk+rk1P8?Mew`_hgmz?E@@#5}e&TI$k
z5!z^gAVP8}GYat4=Lp1ys}=4ujIdV@zh60h$AN~tmW92HFxzJJ@1BD{c+Zobn-l$8
zZE}zAh|RX*c3(WL_e^iH@*26Y9IyYpHPZ6gbI;dzduAvbKIGEVk$DA%9NbSL%vqRp
z*sgD@3NM`P&jz6jHSR95&yL2xf3K*JsW5^Qt|(1|6dy^4894F~gC5%X^iFM(IP*_b
zf=K${5g;g%VLa`F`6H}v?m5NvHcM+mr#5jo;bw2mFZi!4PcU>%9lnHRiANQOZdg!R
zaiY0RT!=xnW%1D56&Iv`^@@-ZJnW(NAtzfQU2DyGSa38>w~8yndEy1sf}>&&>hpK?
zlO9oR^%XsIO&ea8SE`!htUg^U_qMwklPq9JfRJq&Y|-p&`t3u{RYg8tAeG7uolu9n
zf66|eehoTbBbazvvTmde4yvbuXxuGnIk2m6xJfY~J-Fn0vEE5tg?eF-kPa@K$fE76
zXtr4~b1p(ZQ$^YS*9YjxlAZ_EPT$^qT^<r~HvZR)fKr^=y)R-XP~x{|;fFQLuNGRk
zuu?5OFGE`7+BN0a%=KosESvBvkBAR^&<HDU%=*tDX`#)j%j|KN8&+0Q+mYH@E$G$e
zp1MdOy4x-iB1wFRBK!FKuDB0Q$ji#3cRZT<GpO;v;-}Dp(E>d-IUX8Z%EK-CA9iMf
zPL*4&INlr}%jvrKgo0I+@SY@*@=%yR6TE#)3E8!01BW?m7`F8UJ1P8X6w0$%YN~5J
zpUEo~2&|<7<HE_4cKp;fDVZ5azkXb>(!96P-NnwUIF!bqm|R2hW^vt`%>J^|>p_ws
z5GK3(F$bSdD&0%Je8`*Po*_UO{?Koc*?*p}Qf(&w!iJ^r{*srQA<U_q`$(v^4JYs4
zW11gD?ngSr^bNg<R}40J<@>I>{7{;iKb2IZ#$R<U>L|6R5$LbWo4cs?&awb|=Fbap
zZSrz|Z=U75FpeuiK2IP0J;4TLUVbv!;pN2n9E5)$Xk8+#Up2INK*vt}0nsHVHD>YU
zvy|`bs#=1->N^3@gO`=aO|7i<fak(qa^GQZ{fiZlV2be%{z_Zx_Ai&=F<8o~Y`-fZ
zn(_B672v4j2gYw7b(16kMAb-?o3kWOs1xF6UsuHsDv+8NfWuM!H;!UV{smlV(D32=
zWd7a1BF}$-W0pUjYRll8dg7tzt{xNqPGZb~-a|boicfYGnm*beV2f^Z&f~y?R|^Pr
z*(*GfETA^M6j16}RNGvLCma7@xP(Owefw5!?(({>w-#C7gZT{CX`wY7i)tO9qBVw1
zXhV>G8kRKO<{v`QXBZy#cLD6EkBcn<BlQo0ag&gcQYt)EyToC#e;*K6LSOvQ)kCh2
zx1~+ow1sz{;*2GemI%;?Wq;@l>a_lcy~d%UXXGrbp6Ka+$=7G~WCreBeX`VgQQ$m-
zDH3$3uR8=dOg(7Hz@9*RT+nvC+6$AP7CPn7r)5x~X^mJ56JNBm=~1r_*4vq>5omSC
zxxUJ=A;S-0Otgd}|M(&RqAvm==1XUJWYB?=hfi{XO&(Cm6w=-$`2-*AmkRITyLCpk
zCx{x^<^2r4&~647rgOPx-aKPIA5D2L0zfN0;g#|P#1f++qNY__U$^(U1K19425*6Q
z=z&sAIUfZ+<;z5t!lS4)l>fDg?<tl!Z2b%jc?Vby4fA>`y_0EB-M<APGWevHC^)1-
zb4YHkOuR9#d`5nw<#GTV9;v%z9&6BMv#LH$kIw644Z<|osVKBn0><KFzdpmws@210
zwS^}DNf|#+@>GR7EMZf+4h<4OL}rhdxCv|S8tdw<erh99p<I0~_16w_SL@C8*Ey1!
zZCT0nm9jpNj?4#_TqHyDvOSVRhZal(sbnh5E8{8ip7ctJLDl+_9qrE`K}#kAB))0}
zk?IcirYBg%%S+~MZ2&{hSbOM}4}x@DfML(}jN)b2Cmzt>0HM~HXR3G%g@Tv9hjN;#
z)x~>|Cm(-?C-%pdB)XKSiWAku)#0UX;|@9cU9}3Y@F*pH2@oCE?Sm)ZtcIh0E302m
z8Mv>KL_us7;Akb2i~4WA6R+oXzbjQUM%iaG*ZRh*I;+)E(L5eCy<Bd*Xj%L?uZC){
zsoZBAp=Hl*FTTxjR0y)AW-g2!iLQxJfUl(3H|ElSDi5iq`+vUyBdZzEFyhim);1kr
zawIy;-_*HY)k}teGl+`>g#Sj@*9Mt;7u!11Y{j=HrUOjYq$BPn4=pt6wX`*}i$d%Y
z@XYR(Tm0^<EfC51=*r`c%ZT53bXxKiR)TaC+1A*1Q~I`Nr}fW@n#ieI#zS`z<`m1Z
zmw7QFG3}0v^_rEcj_nCKeUp-RPgw6rk=kRC9BgrA6t~!IWVnxercCK@yP;1Ds#>t0
zey3d9Sf8GZIQmyc28i(<=;k}$yK8tqq;l<vz*%yLD#20YNfn0DIxnXWq(9ef)l>t{
zx-yv+;7|IWB^u8)T*&fock1%|a4pT1H34ED2>hzb5VF-uE!l6=G%Xdk9XWmc?Z+Jz
zcqHA2w>K#McFdB1A9kjmR5@bfV>S^Ud|FS|f0u6s-*M2VhwgbiV&m%{9#uZ~9yjHW
zTu+rPreWh2q|>lJ+`mjjqPBXz8xg`P7FIMSWx4ind{L^~P$63oNA^UYnOh>$k;a_#
z>Jwi|MtO#>(2{`pywmQo+o3?c>6<-;e!`!yKg_>Ow#gTiq~ClywE?M2wj!H7cRzf~
z$iJl!wg*)pm8$jhMx*OtwLvguhHDaubkU@HqXTQ=ONSYwhh!wx<i})6J&ezULMq0N
z0-ainyndsFNIu04I*x*L4AW1{+`alb2c?b#FX&k184RH%#m>C9lL(2DULtGg<5A|~
zg7eB+O-3J-g7;yqwD9|)z1NNtAf4Bn7iQhd#7lb{9xaD-@CY~$OhwNJZD;J={dk;b
z+i;+UyeAvcc5S!1F!Q~8Jk)op?#6|nYN3V80ZT3%@;BQEpeUF}1DJ()$Hm9(h{M0a
z`pvpKm5C8j1U;WRpvhqo7sHvk1GViOb<MejN6vkjJN;Q!H7<Wn51OZ(sV@5WVLd!9
zp5(V0#XFcbkt$>z2dlib6SU;IZRs>|v|Hxk@CWEB)1N2xX}P8DxMc6y$!q`m@nKrf
zd!4Tdw{L&IB+O8x@eN?4yZ%N46!JP~P)W{@y~R%X+~>!$PQ0>BuKmjo<E$rkd3Cj-
zOBgmv^N-K2*V%-%b0TS|mn3{OH}+fk7l>@2KWeia;7>wwT-z|J7CZe?daZp#;}%d+
zg2($(wiyjgqM6la`|X3<8jE=Xzim1B2znS_bGm0DTdCXPe7WHJAPOjfB78o(dO+^o
z&9<kq->CVK!MlvYZxKEZ@R<v}qf}cJmawmrmvs52WOJbbsSM1CIn2!>Lb6{hJMije
z`eH~tppRuyv4}o&n1(5>TbTMb_f>8@=uhkh{5zrd86Tbf<N7JbM&gv{QQ@57xt3}i
zVI?6{0JMd;qHABvqcFSaMgDn4`-BJ*!dys~!DG{VP)`_@Uh2kLqXg>HCq?wJ-(Bk0
z%pb6-swud!2`*9VVxa<g|2wvyc8@Ccm^EV=oMKlGAR7sPTOarwzHDeF9~PKyHFNfg
zTHglxl#8%LpKM&z<dkQ5Te3y9%)#?&zsPWBX)F9ymH#yAfG!|aq=P>Vh#5scW-Z9a
zDW@&2ZvB6H)WuB$SB<2*W!%1{6QC@57E;dKIFn8KA>KVtBW;z4>=B+dn3XQ*x&`&9
zcZ+`TUW8RI%oy}Q&Q}XA&6d^VX9F5n_5I-fn;TjkqQ8juj=X`RN}`~!Xx_P~b7=FH
zd!5Ho*S;5I{LH%ypnUCaXVsW*wew<`<O|vV8^Fe%>#luQ+Pxn>M+N@eNTFm{Ky@i;
z_9fMxXZv&V#eLHAwh9dg?Zlaw`7b9UQ6omG4TZc^U{}z3S~O9=o+jRGYo}MCwuEjN
zjKeH}yf6-u<3+rO^*Ge4BV5A-i66kc>G$-=v&J6b6^^hqR3R~Lasu@g;>Aal-cMEM
zfAqcb{%=k(1nnp}Y3>t<&RedcFrAZy94$v2xVzEB{xqFEPN>b-&l{IWERiMa0sRBL
z-dW`JznRHnJmm0yl?&LF6k8!CspGo3oyNU{ZqjTXziF60b*RlXqtBzqXh+3)5;>L*
zP)FNf%Dl=o0g#lwe<Sih%(+vz)KeBgKF-)tQ&5+u4NTzeF~sPEy{t#`NPH!G0=XT1
zKc!M5tl7@Zag`(8p3)@EiU5yu3QAgi!e8d8r>G~cy{xFyWtA_q064f6(UOsIm-**2
z?PoqOR(ntTZO0JHf(MFPH#VEO0oo_~yeoT(D7yd{m>8jG?c-&<EO334d}6tm+rm9|
zD4$n2wAD88w`C1;RCY#hil<You4KL6>s6Qxxe(?wgx*79FoiZ4XB$>ywdil4e+rGv
zd+a#(rR>=u)4C9(CMyx-j3P;C!t^S3VWs0O!D-}T84~+_ClI7t1A81CA=UPrPYj4D
zwyfs=lV7*dmbT^AqIXVwXhvQ%uboMLl>;)rv!4-$-axQ<J;)CaW0Z2LC1g+;@A=KI
zUx>sE%vZU`M~!In`aJ2r_y8h+lNx_;`*YKhz!BVjjvGOQL<PY`>`hitlycFp8Q6SD
zSY+WmKE+2`FE{L3th~daR+E}}05AY_$lTAozOXzSzZkew6A_MhBCn|^c53Y{badpf
z0mm}`j6&=xJhG*rXLxes)QOQsS2msugvG@^n@fV=6~+eE0g&YrbwG|U7Xru}q50Zy
zexRSWY$0pvPKmkOZ*6Wiyc_}&gWt%|s+nd|Ld(NXMR!uZeHR1;)|@Aw44ma8ck0Rj
zm?@B0JbdoUA~t(svO*C4o)wJFd`jTVL?cD>KJ*@6VHXgB)?yXO8G55_K<Dz;n@)RH
zGt8G*o7FRo9lVuic9nVWToj6XaUu~^&KegbX#9VHAfVbLX^5NK+2Vg+Cn_$n;g2+4
z@<OOUAx^Ne-MPWj5clfn-z%R3bm&3sjOrG4WhdAj{k3}D7kWdYNwryoRoq`X&&53Z
z7F?FaO79DnfbRn)f8XP5MtUzu?NHkx`_S9|EBWF5%}j@Cy7#S_Z5W{UN$TDbz0KdZ
zJ(c@<?@4Ce`+$|Zwdg_rY;K&Jb+qpIOX!=YbTP%3^nQl3bsYFxdZiuL2JhUL(2#yX
zOX&HB3C7JJ`^_*-S&!JC>T-8gnd^%kegt4u0~^NQ-OliWFVapE=IE7v^BeZHgp@Db
zwuZifQh|+WTE5nsn&i#1Cfxdd8OH>f@L1~J5dB#?MQLvrJbkWSUQ#UPmiYDqc-#mB
zXqoBqg%qyK#!|#Pu;e+pZ`gNZ--TX2t2e&9%`FXVg+cj^Bl6N@L@(FuW+ipKh?+Yf
zA`eKE;8tmWywG<KLi)z6<})Du&90EAmGer|OYhQ~y1m_H;w^u_U9A22So`ClQ{Uxl
z_I3=p1z*>ViM~*$D65~MvkYPwniQxF&n@og4?L=JX}!*0-q!k%_n#+;GR)Ynt607%
zj-k(=d)px`2th_sw+xl8drY3XCqDKt`l%_MH^6-3j1RM^M~t?9@$`GKgjI02DU&!$
z7Sq~JlfA$CV%o7s*`a&C!>rrg)x&|==dy~Fhm#d5vfN$A<e29u^`Hv-s!H2rd_W)W
zu3x1s-6o^p`04Hk88oW1b0FOu$q4iZl1^4jX`#@e67Oa1T3^zaP#$udT)tFxv%Q2D
zU$aV^-lp0hfuVafk_R^R2UL<z#xcO;6mW7KI~e0?wW}IqHz5jml{#`h-pIkLsTMn~
zRngHlIvTOeG#yA4QfJx4k3~Q9hh-8X#tQ{p5z0{P7djPy3v{}a+H<A&R8!|fI1d{A
z2BHFOT)(H13EQm});zj6MdwGJG;B+!AK7a3?3#Vr=lQh|7N6ey;P<oA+RS@W58)YK
z9z-Ns>5<*-kvhUFp02F?)xBZ;4~V!iH4*mHm1E+HN1C5K$D0qCRMg1821XV)1Pc9Z
zDzE6?SB2m#uUA6bJ}fjTz9H0_CD-x{$9lH?>3FS5?eSs-W(_(gaYa)bjTYRdwGv{Z
zIf}^}qOH-ZF(GAq4<_H>gz({Ng5f4IO+DVKYJlr#8ntl1dZ8oL2N7{MN+7&KcPHtg
zH+Jh&R?~UX3zwa5!x5u@NH$$Ug!NmxL%ez{L>@dOuF;vkhzB&947yI7k_C7n_PaQ2
zlaTJUG1|y;s}OelkLJOS*dX<ifUhrevw<i`05T5}8`d**3-dxB8%k*K5;yP9I3*(S
zQ|6fpBeRlyN%n#ayk|6#BNUttfEsMdl9EqqDPv~L%i<teByY349DXJf<`CR^?mre+
zXTgMBj9B$PJ^F|z!^W!y@68vlLGS;&sjTM<6k;a^R@e9FH1L}{NoGH-f6{jOIv$iS
zdbf$@s{Rw%tQT5Q7|)SD5@Pm*o`Nfr*88RXzlg1@@x$RDZ1mlNf%;w+V0D<r%~_gj
zRX%1}=G%hZ=DxDey@Ut+kRRy83|RuUg!$l!>lP(2fuWPo-H8lJ%7EEN;%?WLLe5Df
zl{*$TRoj#yPM_LrOHLonDP2vvFh9P}y0g%Y#0U~Uz8_7jOk91#E-~J5d^T}Cn~g$o
zShcz>r(Q8W`mf$aF>TRr-t**gQkJa<F#i<>Fpq=Cxcg7KnukXP(bjlBpHzSMc>pg%
zP~m5qaTCt+w)JPmeayRD`n4q+=f180!eije&Q!j~oa2y&xux${>FKtC4&%Kdv)Wte
zhDN?>!@OdL4~l@R+hv9Bc<9q|sQu`6aKia+7~>|DG5wT{%m^@<boyi7By#onm}TeJ
zFV9^qOw?&0;D9~<M4}*t@Atr=!|&}LSZhUB?0Gq{+C(5Rot_FAYAH5ah-H?oJJ}E2
zOQZt2DKm{knc8d9)*t$O9D-x-xY3>ZigJ>i<H_eoDNx}{n5!eL+o;>L)5KjcTYtNc
zIqQJxuT^D9Zg3Sy`x^Dm3GWrPcfKVTAS{v%E~V@07;0YZzDbfXVM{}Ny*mSWTK6=;
zjL9vGRMgdHVBN}#EC>h{jYhx!LiiS14^aL1j#G+9hY+QnzaBT|l@G!9R*qzUYx;ey
zeE}k9@64^a&A2Kxs{PM}**S}tP1u51bXJPj@3(Bl%P_}x5KgUpoMMN(H~fToH6<5=
zMgNc(n0t*Le}RZUBG&<W!nj-Y<}hJu%_z^{2XK;3Ev1+Xrq27&-#+m`*|%L&mmc<y
z&jU&M^aP6riOZPGFX>VWLO*9t9ca6enlL$w)k--ks3uW71KLY|P)c{|w6D@#MDY?m
zp?xqTDWOYB#4*}=>epg*55Az-z&WJ0prrWd?O|#+wF^6;KN?+rIx{d<uF;fLagPB0
zefp^vc1muB8BNgm<I)y-u99`bkl|0$p1M%1{7kPPVTsq3)t33W6#CCw5vdse@U|C6
zRJs$e<0$p)zO5vGfbb&m-NWj~BLY1H9?U*2KQSPLF7hp6rFzm2^ro$+$bQd1bZ~l5
z$lw+xgnyl!d{UXyv;;~q3nE5r>>dgXD2r=^=rehAD&F9d<`BK(J}7zmRf@kPE#0FH
z_E;B^`?bX&YN7|F#R+R4f)go~jO;8gi3kwjB<oE&&OrO%y&#$yx1^xSm(a(m<(RQn
z%$KqE!lV>ry}v7esVGG}SN&lXfNn9;uUa@PC1J?`0F;-nc=<*#ZHwhh{P1%my?7JY
zn<*Qo9)d3T7~6`(csdS`y|db4V{itU@`Zcjva{VqVObrR6?49}ZY|AHAye`v-kkck
z{Z|`GZSwUqRN(pY<arhb(qn)QRf_RkDEa=1j?9S~#CeanggH*=XvN3y5w_Dir!J6z
zH4`X5BE2Q)AG6<2Y1$$*_m>$#$Rj4-WAX3}U{qjw4>Us{pe6Yp@s*Z@IL&7EH?S-Z
z6$h*>;-@zV>r#0P#G4<LH8SCv7ql-qO;2XBT}Hp%i-;4*3Gp~u^)rroAlD*a`0$BD
zG+(&Xk(D!2h7Tq-aL%-D=h__ITJZfo{~^t;f~+9q^`^j^UX6dUdZWd=(K=rjv42)V
z7@ytF+yjfU*)tZpyw5=<mqhT7k!@Q@BSVM2`ssLR-4cy+|FBZFP<5)hKlvpDOS@Nu
zp-}31%&{qX@OlfeP$1i(O7`y~0tp@T(aqMiT*oM*KIs1JX4AYF473mc35`PxEyNnz
z+g5IiT>hLSe1;w|&?&&_XQVfTJ%{gwe}8ENovN7f1#!;Fd(H5D$Zh}8VY~Lb?vICO
z4Q!nDhZ-H`zQcaXfU=8|C9hJCznTkkFvw?5o|kkl#7h93wpVbcUs4_FK#5mYIEp;3
zr*3nP=UKrGJkXEjdJH(XRWhnqa*r#umigV0^)6A%0Gs{EHQ^GMxd`ELR12D<SHsk3
z;jwhMUelOP1&ZF!tP0r6qd3k?V*|Xys|g2MUrwX)!<76Z;&=BwVv#ThG1Y0a>Mz0+
zZM;o^PYi!v%%pr_MJmHnlrzq$e|w-NH_zB`uErdkEn$Fry7?vcRWd`&tzE`zE57XF
zaK>6bOWo8ytH4)U*!XgoGwAKZ8S=8u0asfZO`oz?^dr&O=ZYmNzk$oL!Q;xUo}+<2
z!Cuv(*sSEUC;gwut-qXU4=~kAv@~f9l{Kj&sRWAdYMj}CB-T6I^_RRH%Pun425mtl
z#%*y1wO-3V{A(Poc#CA{^~4J_SSrhIoZ6SXl9IU`73w`}OMZMD*NjM+nK>_oo5!{c
z1r}ZYe8}tNs|`f-pqO`~MIE7gvpF-^F7M?hOKZXxuVxPTqm$=#>)Tljbr!N>GPHCi
zG=FRaSm!lS*41bos3rY-JI@H1>b>yNlk?;Rv+f5mD3a5ULaDEr;q)%(4XgLIU&<Rp
z*pOPMQD5elfA9)$R&of2?ImAM<B;OGwvzt%Ty-FrG>EuWwpV#!XU0UBk9bcb7BvoB
z5PX9ZZ*WBZBWf1w>Os*y-zo#4{b8QkyC`;9++>&NG!Q=(j0Tc)H30YcbMT<~H8U-{
z+{D{`lhcyVl{q9yvGvmdVSs;feU!Vx3(g`KPcCO+@kQUwLpzlsHy2csD5=|lvd8JV
zrz~W|x-Misvsrg`5ta18#>M$9;-eR=cITa$xJn|mkoOq2CP7jd0R1i<ZAYr#|Mrlv
zoejt;`u*HqK&tCv!r>p^1Yra!@0E(*uWy7Nrd(+RrFNC~XlNvWjDg)l^WFaGV_B`z
z>Qw_?7J{J9H5mL|OHaM^B3~m)I~9T7A!V?7H)Acl&n!r$yBu)^z|>VaxNM!fY<ZjF
z-0^b<*KPHc+B>_>{|a^f#5pjgFJnfW<0#H_`Byi^pDc~AK13rh)b|&YytOfOifsB7
zf{FnDbsNSctI%T^e@nZC-R{fxh6h=7UV@;B(y{!RKK&MPwe(XnM<#Tomu$G^b9y9l
zlHM&$#+B0UD-<$8Y?jP!+bWKrxgy!?()aAXAXTrR&S1$zh^bRRAF-_R1sxi9nqVtj
z?%pg2X|%4kHD13k`#RjNbou@-MQ^N|iv(l;D(o$~(&XSNjw(S(wAF@^OO+B$GnvhR
zzW#nwSs6XL*>X;<vg&MclSXz)lhx$DVn&)1#!@7YlT>8}`(+q|eXySHmRTwF52Lu0
z#F~Ni!nN0Ad0}PQf7jE0g5EsFC%j8;Y`N6MOq^3+Eqc&m)6E9I31O#`JHb*;aCDR8
zB0i|Sa-#E8P3Vo7%6)cA(bA1Wy>Ig;$;HR-ivS!n&r}jIqf+$(y$@Tk0q<u$)&TFf
z-hqn;{G$p?W+<4Gh?+0qV=rBz^S|zSoj&LM?x7z2YdW_{0DdMW3f7IQb!k0#B6mFI
z^lbUk_e#J|^_ds?IoBfArkn;UrNTgvgIBp=CF3K0@U<<mC}W?Z2h?A8m|=c4(Pnli
z!X}|;6N58uAxSU*8cMb4!vIsYaie_Z-}^dv2E8vx1-SrH;Q5R*w9i1hO6!M&)VJg5
zbUz{i&_vx|+3EUL?8k-IMUr|E_)C<uKyRxHD)~;d7}lx%nrT6TVth30ZJgfEoL{ME
zl=n}dW6~%;?H7>%{9B}L9x}yHpWWSarVAi!lW!Z8AwCQWkBsN?M0Tb`o0|<(lq(&Y
zzul9?r#Ni+-Q51E$Gie{y2@JkLxOzu6*apni_XW>tFJhxD3s_a$6RUSkJzkSB<81G
z^o4+=j^8km(^&N$C}#CuMX_)4b{(y>`)Rk07SRa-9E4{LN}9C%@$cHKTla3K9K~!I
zMo|!Q9?qp$ReKP+nF$RyzCSKj)vi~iz6x5X_QQS|#}-md)xQ&^kD{dl{7iU}mcP91
zwsvS8xsv-w)0s%dW-fH*1Dalmy`34UFJ?ku*Xo3C7g*%6cG+$RhX`fXSr_h4%I4O0
zeR8Vr#Zm^h6~l~BrC%)}8cg`znh|k>57rsw&d+oPU;RYS@@fzmILPfOE@v?ow(H;H
zdiaxzwDz)|*>Zg{k}K6~4RDhTSShu%D8SLItauzgUJr6(P=|;#ygx+!@+y1w<$hE;
zTQxYGVBAe~Im~V;-t&cl_*H}q)PcwvG@P>PJ_d_-%M3IUKII#K_)F^iPYX-Hg3PJh
zMfIVhWJooL+VLaetI@%G!iIZrJU`KzOI3@89Ft}JU@f5Cylwstxe@7$X}G?QIkZ3?
zSMY~4IdG9`w>0s$`J08*#rCX0?al|MOEIWMqP<V%bKlPXGEiD}w8C?fMS=V#lUImc
zZg*^*i&5?ZYzdA25}?Dqi~}tf5=6z@2&oi4eAtjU2_o$98a62PcE`LRIMLmF4p=%5
z<ZVHQR*!x+xhz$!MD-(N;)M_G%K+OHYRz{yvnws-rL(!*jN?zjXB2v5sX<aVhNQ)2
z&H*^Q1Jzy=6TrbHi6)S?c8yhp7Jn6geY>O48&c<}gm@~D$9GE$Y!d;m7q^PsA1}g{
z-PV&98xt;JYlI!ns=V3!%Bh)s&7^>42ll-UiV;0FTI#AdKen=Rp6B;>h4!E6E@5-s
zUVb9gp@61nz-PhdFD<(Ma}wxsuhzAr)Of-<v^qlBDeO80%?Mp=pP|#Mo*PStoSg};
zrFE3BWIVroyCn5vME@g;IHkNbA7mnb#B=n_Xs2PuoZSbThs02?qvE&^hwf}^EiDGz
zGf#d9i3iy|pA@Vp5BT+?SnS-AH4it!>Z!RaF~C~u(d~n!D_)NPw)iZ-7raSRfxR~?
zIIBru1H)^zrtct?N}F}l+T`60OkY!dMXX!9Y{k4*U{#;?uY-D5yWC7-2(M8O>%F&h
zCW;mp{CcjJ>BSS9%Gf?f*ke@y)2J{7A4-Rx_PNS^>?v^+Q8<dtqXPTIip<LLWbOt<
zbAlje<T|}#X<;%>v)SncD=E=o89BTDhk5lXU9mkpfEG<CZs|C}*ZLN^9P?xpA8{?2
znY*lm0zU7cDghcvC62BlpTh+Nb-;u8n&`_bP3<PP+gts)+T&|lJB=q>^~@%J{;M&Y
zdEJcNKK8Rw|K0J(>*#op$>Zl8IEmL}S%J?B&9p(j=(rk6DMx;t`W(xF=dwFMz)Et%
z^mX}B2wlnLkQ|AQBI&$oz^B&EKheJq_)*AbJ$$f#3O#%sAdz_osyTlBPqkKu3U~NM
z{_F4YoKHVY)75H))>2=0ALT9tG5GArbNcG)#Sj`_Q7YFm>hTk`#*BLN^8SKb;#fCO
z`3x|zEUv$eAC&}ij9!B5^o|;<FZ!>|u#EA;v_H6!Y=Rn3wEZ%kQhB0-atR4JSqfw7
z>hO%$6ySMicT;ru+70i5u1YM|MRE^g;=Jrfg&8uZNVt9Q>149w3e!-gq9`QS=T?gZ
z6ar6SNOFMKfSSKU{Ee0K#HyoFzbwftrvH}a-UH9*PZF#>FYE~2?WOp!kvFjyn-9z`
zMkYhUo9`$6#c2VnFTQtwblvYzSDIZx>CBVA=w7~W4K2LX7-&?70Hc8F-p*yh_oA=z
zJ23vLsYCbW;R|htMC0G2KuZVpFAv1kf7f+uKBFTS^81euD5roTx2p<x+uyhJ@nsx4
z(LE(&Bn*FczasA8xI@rvOPFU-t=YDfH84*?Vc{M{PXnm7sHlAP8dfuJg~sSE2fb>Y
z2*j$<(dHd#bj8BeU`{Lb!191Wb!EIqs?R;q&M}95zk$7bW*hpUF+CkXnOo0$NqZR@
zx&!A`yS7Ig32lpWZ1WsH+CqsHDbpmaA@f_)Fk_ZityU&iEyB&;p2y`5j*%HBfe3mc
z-duT(L*w07EC<orB=*7HV%MK7s!U?Y1%@KKIav#ZEk}M@;qKaisJ1PdYNSpuX(@%K
zcuWA_!Z7}zNg}+D)miH-<cwgB^Y}QmRP|kO5eP*8UG<r~e)`R?IC6pa<Q@`KvZe14
zV(tm}4REP{DE}a4E~}QFSGQ1Le$X1!9Q`i!MzhDDI`q%^7(WzS;j2sqy78QWRaisM
z%_ukISRgm2-3WGIJCpMg&8S6dN8scKMpe~DPC$qxCVRFvuE}rPR{3LDI15rzEiAnW
zwJ5~PhA@|b8Eh{p`&~)m)JIm4;T`l*HiSdXhi6Xa%vtX9UlP?CTA^Qwa5A~%Bo1fj
zqLr+FjY)r)#v`!;D&Cn!^*B+fI|9u0ib(6%C!CWte@nVlSv?wf(a7b^w?@KNmbfp|
z(tDj))$Nr)Bi-t^iziGT&xGSLJXBIiAi}ok;%TQ2nzp}}t=?3GC(R~<_Oc>^$H!P;
zCD8~Zc=Y9;M?gs0kY$wr+?D>ZN;mN@z<X15-4o&sZ$EA>9~c^0u;)KRrTX1G7lde~
z?SKRc05(qfSC$}qVLnK?6|#FTOIQ=#;J*J;FyqMy1;7C^yu72H(>ghmuQ!-=pA=XJ
zQvKmIG;Io&#9mfI(gSmfqhbG<hxod8d>p_l3SwDXN#9IZ2z~5-lFV-c7*I-Sy}qh+
z$lpr2)VsH{BkjlTjq|&`x{sg)uc6SJaA<hc{iH73I5{ZcQtrM|%ZER=gcO#-KN9~N
zZcuTt-eqdr-H~MX96swZl4aS_-Zq#G?f&Ep*+9%JO3Kx}r3WYAGmKnYcZ4~|r@q0h
z%-xrhPv+QxzOiGoh$Ko6>)V$trpmOE;`%qHyIV{;^kN5>n30U=Ro2c(p`C?Ww?gk}
zfh!gYG!jDEZgaOoLt7y)0!@il2{H{w`dTdymz<46a`Ia-S?lvAS1WD?@jS#LlG|+<
zWAK5{ddC}z{@S!9YzeCw|83;=g5dS8H)`+nRoQ!B@CngO__Z^7sUY1Od$!<(-YW@}
zqG&Kzg4p3PQa~wG;jTv1{ak}Oh8v5(g6u^<b*8=W@pr(iP7+MCRJnhC>x&$t#d(2$
z$8NU;^fk2q(RZxi>4Ts5oHA&(f4+rlvEdvY7G*wv-8`jw7tO&53@VcpO8eT>D7Ni7
zhcWb%;&^cG6(PuvVPjrGDzK;9y?!ym@RXWc|Da()Zbw)9e_{7zgQukd#L#K0suf3;
zIoE+Y?>MoX{>QO9#+1c(+(eGoV--!_0AdP#PaO_l!OEbG1$IN&96m8>-2s43iO&Dk
z-kHZk_5F|k-Z2<US+cbV5y>`#5*4E)gp@?GFO>*cv(K0r``&^GDH4jbS+Z0VDNB+h
zOZLdlj4@{Bcjo<h|31I}e&4@;zsJnOxOdJy=iK{xopWF3+;d;&JRe^#&!{8!x3p%P
z>5qul0vRj)CMDv<su8jU$GviO<q(`a)Y(t-Ghd4?&hN@ViR8$D(``RXMwjW-dye<E
z<WjzV2(P2BojGJLawUKuTFkLwlwDr8*CH)03QQtwT$W?jdasOzqFx*aPp*<CxjmwA
z@RG;JjSqUK50Bhmef#wjeXIo~vGWdO|9fndU+{|d(*(;`JJSpFfCotj_V!~Jeqaci
zu{<8)&N_ZRpn`N})PIh(v{DKBj*@tbl1LHW7bt_+vHB?ewWB1x|MGBkSI8z8-a%N}
z#YD{`qwfro><}=+x7@)j77~b9^3<K7;3Mxpu@AC+PH8_fn-pHKCLp3m`eN3U86zR`
z#-nb3_=Sn(C&Tw>$_*s!0uLI|6;?ccBMrAok*{QYI5r~CxMH3CjgfYb<Kh6S-8}kz
zcB+NG5o_{8QcB2~xAv!}n8<A@TtHqYbgsq)6Z&XRq}4k*BY*D#xliEgRpdDE7V-5o
z<zD5$guFUkAiDZ7b+>xa$X9a3s3~d{tRRE+Ih4^Z1m@@4x7b?W&XO0tr+3MibN}?g
zcYYR4sJQGP^}Xf}LyY>2nsUG1FBG@Z(Q^m?9c^Ca!AKfJS+r8so>Kf?=R3HZmBk(u
zxVjxyS7{2ss{PKeK8)O2O|N;JZuyyeKs(=Gy33PQf#gjhhgM0Rd2+kWqW;9Z1T|K&
zL`d2bw(WtJc0RiDS}Zpci>PIMo5(%z!23bSSaSfP4A-j2s_clpAD;4lfAb(q>$K$E
z0Y?RFGYT!bo#&AL*6N))G9PQ~1^2}dIBG0JJoB5l6ZLn`PE``t8hK+pkd&I3DpwiR
zqc|Hrym|fTx4v1ToM@oI26LO6v-DFu&ly|4mesvOQ9Z$7eC?mBcgas18ms!t<>!E=
z>6hJl5D#l{g;odow>M<ave%{PdZnSu5(gi+Aa|t-`HJjpm{x@QxAY_?%oAGL<-O-T
zKDcq=w}NUPfJ*9_Qb7C92t;Z~WjUta9sr9M?4~E~fZKtS$oVAj9(@A~JX>e*^<m@H
ziwU}Jr|$?($ANM=S$!x(7cpOznPg1SR+XLBFZ`$p8qfQN*g{WC{@wM+IAlPOqDAV>
zs^Ij;-eEW53N18|w!nm5L4kS1JwKSmE**|Nab-YDFVD$36%jFZd%1tW_tM6GaRP@S
z$D>o;rJJc6YkavMP76x>`xxb;uaR>)BIeut+?i2%hIm(ez$W8r5{?tKWXTPtEDv)z
z^z2+Yn5FSrOQ-slrA(I=D9?!FIroyDOyytfpnZ(>P=~gbcIp`>;Y5>=ZjTO79u*hm
zE|54W+0T?-h1cutO;bYZD1hM#ZH=dgh)t`-;`MTuH~Zv*eh<q8W-nOuab!(Mz$;6?
zX(XOF&m?QgT*sAf-ojdz9!7GgW&+U5k<~OK#b4Zg6Gt0E^mP|a6vL@e#}xcB*FORu
z41U=Wo_)Jsp2Gfesjqaau#ar{COPNuK15Ig2^t7}3v-X{$tMdn_!^j1nvL|==N>J1
zT}AFvGi=&th&9RacPzb~Ns4-zOT&kKojwquh%=Sx;sgm*N8G7rt&fJ>R$d?8H+a8-
z?mE*03W8HsdTnD~pEK}xzFLk8Qns5@se?Y*vD?j9Ob}EEeq7$@XY)%h!x<`7iwiYh
zG{N9>*}(&d=G1}A2o6)=D`)R@;b_IaCC02at)gf`$-8ww$Bd*8;_AZ;=`JDs(O%2E
zOulHJwv}sEw^|B9Li^%mGwU7C2lP&G1fMxMr@*H``?@dsjrDU^viN@M(?hpNI+h>D
zg`AMmAv!y2o4-;k)TTDQf*2-_ClS0~7xMRUFJ}f0@{$7f;m?{M+-y4`^<YKs7VpRF
ztQR+0$<20o5jm%6MY%p5<(HRxnSv8W!#)Y>jbRyUrg?vG$6MVP7Gv~I37XM-^GM<6
z_Yk%m)bM88qf5daR;Sgdd1YJ;iVuIzRoMU45tcT@ddgv4-^^Y<JIOOXF*khYujs@~
z^I&!?jI#l~jJTJfqkDe^RL&j%Grdpka28WwOm&k|khk3BMhv#|q=^nc^xD>SgZZ*)
zNGIrT0_AcJ^5tm+y!(Q2*I9nIU%}mcDFV4s^$R(-FW9aR9}KnUv+&IuP*Xwx55S!l
z@0x#mSzs8=Fluhpx~)nlztZeYu6=kDl7;?!^X&ATsQYz6xN~!RHfV&1g(=9StCiB*
zCEqF)Z1a1p{aVf&b4GXL>yL!TYQ@E8&&l<Io9gV7p`mk69YDwAtHsc_){S?KExx5f
zXnDh?>k@F{eUpKO2IWn@h`LUtu$^YTt|`jbc+EW`K)TW&4pygVFIrPS@ZlSi?lTXT
z?5~^vX5+Y27uS<-xrN?QK>k?6ioClfW<@1NGpwf4p=HpjvH|$+PH`}`ETtA251Yn1
zJ~3=E!644J!-{Jxt9pVG@}NfPtmB3KS^L3F`1tH)AEmLUhXUpNBCQOy`~%!2tE^<f
ze2}QyNl2*T_>DH5qYA18qdb1y)1q2>S;}qc2WNp?RYM4|66R;q#f`H=<(_DABUHp0
z$ui->l_p!!2r=mPul$5jvbDgkF9H=qRIRoroEevIL*BRxy_<X1BLBV<KT<S8jZ%4}
zB0Jr=r&5gCe{P&;!RT#13JKs(T-iG{b!Wf7yr28Z#+Vv&Xs#`Nm$8g54wS<SqBhSh
z`$h8*T9lvBf}TQtO2e(ZcY5Z<9Ct9nT|%$3@|C@x)h;ePm+dnTKQLLiXE$<^^>$U^
zj#pHFwcFh3_=`QWvod4fk9zPVoSE13f8!;4BtfWaTk-J@xik_c&^5Tu#Imo|_W}O}
zDUn7^prcb`cYc=r+V0Th6)GM#;7H13?k=Sk2#w@R8#bW~u>x&d_m)K)Y(C!`JXodV
zLuXhZ3oO8N31D*sq>B|3KRkX!55ioI<b2(zdj<IVUI^?_N9>n?BczX{DX-Knb_VMO
zv@cr=JjC+i!SoUEGM&du`1#=VKeZG0r#i&@Ip)fYBBTqPTCSD5BX6M*8`$cK3p4NZ
z9P{ov_j}t0wFOJfdOEvp#p|-1Pc%m4+#OMK`M3NTe7>~V=ik4fTBS4*Zik&OrO`gu
z#rBK4PdBFfGhex{jVpv@sa()^+K2Qt*}+R*7p?VN;mfnqtnq1^o?IesN~J}P&-({<
zKBvS>4&73(*~yKJ^k^vwT@I=6KKVuMc18C3<X6An`%%rYpkS7|TP*grg}tpA{cbR&
zXQa|<gi9B~jmX7|?dw4#A^C+Pr`+47v-*^)Q-RZCM~c!Y7>AI~3*BCF4lG@<arV0B
z#!)fG77-f$U4Tx3To0_^g5<|X4xA_*aQyN*m8*S_bj`6jUNBA@7|1N8lHt)Bfv4?L
zN0`y!P6^fYwH)#h>Z}pYfN%A*pe*i3?h1Ctd>?23T&L)-+Y_fA&F^?BcWWztNC@ai
zvfW_v1yhDr8a|XeBt6~fyY|SiDNX_g&wEX_xZg9QabNkW(8ZG{nO1sF7aL?FM`e-1
zW;jZ+L0QG&-xRye(Ozw}jS>U;;TU>kt!sZ-S)ds%eGT&7p;TaPTGw{+<w*M{X36N#
zo6+Tq@^x*Ao-%@3V6dmzOqS!8LflN0Djzei=OIN(dhJBQ*L2)Ol~2>N+Cw-^FGNd|
z_-j4d=?8u0jKNCx`{Ah7yPzIb#LLSy*5^1bhKH;$d$@F?mU^;wz)GMez$NRH^=Zjn
zRi6KE0Q%Cw)*aaF9N@HT4{lK~F#qc61A5|;-_G&5C{cRU#a6DUjQt+B|L&}`-CD`P
z)#+%W-1bh7XJh4ey3%V?{u2-{37ZcL$?A6BUC%2VUyw81G;V76(h?s8ZA~}UiF8bc
zsIfx6s7!d*WV1ou(i{i1sy-ZQIfF#TfEQ&>`+me)Pan0WdtDgXP)iFm3;D%}c@%4I
z^8GP%Pq+y+O|%W3njD`SR;xL+e_<%pF<ATh0Wd)aRD*`vKZ$N-<kOAkN3)sA-cb>6
z2VR@f$C^=TEqHLJ9N)b0VTRndIA=i3P7PmQQq#s^|9v=EvGQP^m^Hr@cj@xsjdZGD
z3ngsnq~~_nbzeok$=TO>;)iCFtCJ_o!!B=J5DPi(^aE%n<_R9Y<6{?ar~1Ir2W>x?
z&|^x;zCV<sH5ch)?s85dvIQs4rG7FL`w;r2iAMWWr@;JEB1J_Y6j{TM>ZA_qdl9`a
zJx}!eG|&0y9^+Ye01o_v6TlpRmc5{F$F|ot{kOX36_aYNYoGfGo|#!iSlSy_;P-Tf
z+OUu;j)+Ri(&MpS2VDUk*@DcU;N5=7$dL6LzvafzY_$-5>3{tac7Hl>&77JX-mz&Y
z`G~putfb3%&@%@Oot!q%X8fMz<xh>n&x31j4_O^;OEYDyG9m%-Se(_`qwCl2|4}ZB
zO0B9^e3ZyEQj|e^B3lD+)@eHT2lgtFv2UU<C7*_hpPiDIy5MJMhr$!VjbW7aPDeEO
zp~Hsjg&zU7glA0i?iObFpVh#Xf)Rt+>^I>}D4UE9xqWx~KG*o9<htlKJmjxNA$WkJ
zWtv6HOIh;gqS?HwNg-j)rOY7Ty(_!sR!_O0a`$m-C*jO*m-sNxZ$vfz{hp&`u6ejV
zZ$&1}4P3AB_n|#ib!eTsTa?qh7)VU!_F{g~u$H?dkKh8-Z<3XcBd<O7j!KTEyHW49
zMfouIcM!2Uz)U_oo_ey^W#gS?lwpttjboH9MUubgIBkSI!4Jo8D|j0Hu!YCSLb<~G
zSIWDDU&Sq*ll-WMsh}t}0%llG`>tj$1#h@JFf2<(sHG2OVPQEV0%x1~tA{60)4v*3
z`hzo7>!~OI8EG=w3v7-^>C5zimBZ9rX8W3jBcE~ho`Q%*BH#DQw-2d2<KP)UrE*vx
zHE;n`;7B~SmIrN<rB0u(9lv#3UR~-7b@GrH<B@5N<hhU2@35GKLCxdvNf*mK_&4-0
z*`a*ZIxoM`)?q3?zFZLW!`$zx#=OmG=VU5er=7}nIs7Cg1zCP89oOsE<kaN6>ZZqE
zA@rl-j`cO_UuV5V7_1iq#sU&V9O}kNop)mCj@na(sEwO@T7u4qu5Ino8v1So5nvTD
z`GqexWXT6e?YrMp@V&6(#W#atLg}Ub;f07ZJx?=lOnwwzqVUM?iif2iKn+P;XyK6%
z_rW=}DaNJoyN`1`b_%w#2GDQ4z}4sU<*9bQ8g7|W+siw5{lMpE!m>^$UL}JO+Z;^y
z@wZi*dyjrN6(ndR2jUx)&iURS+@c_!w5Hn1S&SPP{_V9MkcQ)DmR-h$qTB-Iq$~KC
z36oWyCWdP=gTU%ztr{?@O`(!W9xXe?x$>3EJF3n4QsdPEJ{WjkOTZU25xlI<Md9O!
zPL$p^wdQd?{6irpA*ZjJLBuy<Wsi0%_%Qm~SFRoKjyl=&d#oGTJgy~-=_+e)jIlv3
zJN~?RzPokH=<Py1hrsSva~>6HYXoc^@RGcedCs)6oyy2>f7f_f>kr+v^nO-+ku2;&
zrd1_ZDqeO4Et7YYb4TR;<-8|M35{#gTahs)!1R@@*C~ZBfK}Q~Rc2~w*^q}NTg&aA
z7~;HkjL%N$w*>5jK|jxPBPjoI)^+V~cW;9ErUYP#gnx=OcMiASElzI9ZH#8<-8b1)
z{NtzSr27@SWL)&FM=v~;+suST|I$uY^jBTWs#e^IxDI+Vf+wH6kg=q{6K8bVjWF|V
zuM8Z@v6M!0!+%!I&Ll&##=g1Vw!_*X6Zr?b>xVuqe$u|$X)V}#1e68x;6DqjeeW-Q
z^J_eQJrm3M!PxBpB48N8AOdWq&17Nidz1TezB~{IBgwgGvV6$V|2TL}V^by~S81eN
zst0%rj{ER<Wt)X8_81rKDze1Ug149>!9}ujojh<mzrs;3s)fpl=x2@Aqv?8~zwauv
zwNCc$SXAKb{6p+M{jB;bGHKW1)+^g#o~OXa{Dk^izS`Zj$<K4iNNdh+nJ#N!7b02)
zXrGlj!s?neqOKaXHV(c25}Kk8IT^YSL-7(><Ll7g_;|?;vPRMDtMH?<`->QYHsJZU
z=~#dZd4Q4lz24&2U53Q##w<m7v(YQVjiyOZ|6%EP<1u<)^58@Q8S#seQKIj*n^i&e
zzs?sbTd#$0>t8xHk}ACNh%e2q_7Du_4~<DPv&Of>oY}P3Cl>CyFAQ!FT9iI*7i>KU
zk`bq)K9p0xgm=(}19KVM3ZD@Z9~(C9#~|F4em_(`*mkOVc)RPui;uk(W``o0W1FzR
zYVjlegGtrx4(gLh+KyscoYnNej~Qi$rG2|l7RROM4V&;cm@Y3wt_6k!(o(iwZF?-(
z%6i*^EQu_xVI~*7X)J#GBMR~2wysd%{-*Mz*FpurHs;bcTK`z)o9A<t2q8CEqgZ-&
zVRvRbz?x<|J99;!%`{#%Z7cCdfLUXGoXyweuv#05;T7{HK?LodM4bvrYpiq*sEsa9
zDaS@S(gzvl&2ws#2_|(nzP7zef|dm1a)b)%=qI!(-R^zn^vgecv2^LKQ=pLQANG&E
zA=_1xrx0U}PtD&jci-Gwm%?MzxX{*f%oTa199Jy?&ycNG{>n0V{m*<197Ukqa)Avt
z-Pxq#W0NURZmoiJi0@`*?N{`4c`PJ-KbpR+86^=P%aW_=ez)jEyZn5|U7Zp&WG%~|
zU*)Z?ebn;J2O0_5D~W3s`L*Ebp4bE$(vWIHtiC+cv!VXU<|<t(jz_W?hb;sOZ?>?X
z&#*jivhVwr<r`~%7_KD+<%tiI&j$ZId<G1YD!g?z<pv|OH<{TP{Z~2~B7DAE9iz)s
ziU8?O-Tyx2Nj^Y-EwaK`$pL-LY|VbPY}^hw1k?-;eBmyEA7@oQy=z2IF`oGiHjCe}
z<5neNKd>Hd%i+I|pN5!stowKfFR5L+tDpM-OjmVGbBDno>#+WIpcL^Php(A*8-jML
zNVEZm9RLOJ)9^snHjd$PwTUm7RVLxLnWDWgxXBEmZz#0-9yCg}V1jI2DYdJ{d)6)U
ztG_l<-3;Q8Hk`??x$>pm4^J@x&H@ib3@+q?YpfD$iVMbt@~rltTHBPEFD@@=6^$gc
zaE|e#uuiNIQoio(BR=ygovO91jnY#&2=6Ek<mof@GSU%^k6S18btJn^%1SGEM~zB^
zb+`6{sU?QKet2vUOF9F}%WWSVRO;yUBH#wwhs5Y86o4MIGXD{Wts9GOXI?kfN)5g#
zvti_Pkj8jX*byVd)v}v0rcL&%(PPJV+AYwA_75>)%lQ))?&6S>pzGY>PwTx<p=Io^
zj=yZ*-N5)U>s?c?Rg=MotTHPQ2nv0LS1lrI9AqB6uuf6_#kg}U)zjr9_9Ws?n>5Z#
z`dit#Pmc%kgU4EFuOeSshhzvKtIUB_ZdGv_F19pZN)EFmxHFG`N48LIu~ZXQ;Jx?P
zwPp9;jy*pHy+5CGmn)$0*NMi>%A^Sc%^W}Xuq?E}$8QW6<y=NoTtdM#L(l?@g-O6=
z;{}P{7lYn^E70pxsq-79(S>f=$)uUFQhlQZM9wiY(!UIsJ{uSoe2ML*%R8Mv)#`*n
z-f=;efX5hrJwJtwzSWE7%dyz+EMs6iCg5;=Chpk~Rk&Mos`kd=9U1E)eE1X;n49qY
znChR(C)`!0{i20t?WNmNgU(4S9ET8z!12RI<V=*g&B1MNz!IB!y-u$i8IXM64WYEQ
zFy<jJGX931jw@W>?2Di*$a+4~-CprYdJFQaKF|m%G`HdJqkLu6sD(;ljiUGBg)&B`
z(gmks_}a7zsA-4~Vp@pRw<6p70^EHFArJcg;*oBkLEZ%tkD#PEs5TY#&$Bd6^IYGM
zLV5GX^8h0`9{&Izt?ATt?0bcB(%N0^g|YUh1ItpF^xYWgG##KBj`M#QW}Z<dcNmQg
zZ{Ib-Hy>5o0DWR7*XY~abPAL|ZcyVyTHiI+PVH`2Yrm#Ds-SxeLL6mzupQ4zbf54(
zbbNQj5S7#<6+d}nQ6=bT<8f(G<cqnfW>l9Xate*$Ri{Xa4q8nFM^HXKE>XLU!<vF>
z%5Q<ucs)!VP+w)10sG8tbg$6G7@G|B>sB8SmcCE8d=jBK#7v5B5LeY$NG|$?;>3%9
zUa&-(dazxs`FFj6>x!yPb3WKEMfoA*H`Kn?pG`O2<gm<7mmi&eSg6%7Qx!kBB)0pH
zbXqt<UGU@%B;G|M^kPx&;TABKY&?00HEUiUAxfo*V4&T+Z;mEU=MU3|+8S4exFu28
zf?;sOZ<yIE2lwgL*$lXPJ)a*Ex4pv<fV5A@CF4xF$Ist&@s4Hc@~o?Et&&5r7YB#H
z(v|E*(goRz#s3eLAVq$W360t<dXLD8m_y)We8Sw|=`p8h4_CA{n>E0`jo7x7ZA1PC
z8}k1_OT%Ujuvr6a)&QF|z-A4wSp#g=0Gl<yW(}}e18mj+n>D~@4X{}QY}NpqHNa*K
zuvr6a)&QF|z-A4wSp#g=0Gl<yW(}}e18mj+n>D~@4X{}QY}NpqHNa*Kuvr6a)&QF|
zu!qeWV6z6;tN}J_fXy0Uvj*6#0XA!Z%^F~{2H30tHfw;*8UX9Tuvr6a)&QF|z-A4w
zSp#g=0Gl<yW(}}e18mj+n>D~@4X{}QY}NpqHNa*Kuvr6a)&QF|z-A4wSp#g=0Gl<y
zW(}}e18mj+n>D~@4X{}QY}NpqHNa*Kuvr6a)&QF|z-A4wSp#g=0Gl<yh8(b0Xa9d{
zb@u-oYv2F`acb+IJ$Z}?RYDMw$O~^lra>G$HpSh<LHMI+Dg<kPie*B<IEar!K+(|g
zdRVBB?cwb>2*%FGGU2a$I0%9MNhL9nf9riPzd#V<G#*00UW_;<v>wNVpCbqm6mXLX
zuc1j0gv($;sj(20l*WX|C1N2Mk(tVbJmMjk^FcBb{)9?^0B<Xi32z!ELGYHE1SV9P
z0>Q%XKu$~hQX!}cWJ>~9Wyt`i8W91<w)BD^S8(VCh||mkLZoNGF&Y*G-2;aTLF}WO
zAY@)P1wwE>nT!1k-2h=6+v5QCg$cz$EZIp+c$S$4A(>R_IwhKnppsWoA>{G~gGnQ7
zz)UibpUDJ=)+v;ADs2r&O`$PJWW?qg69;juZmiRyncR$Z$_9CZLXRQCv^6})oJ?CM
zk~!At%(YlDg0Y4pKnOC85<^C;uB;Nth;`~J2|}#VDMT`~ieDj+!HHr)6ehR=Xf1jL
z1d<UOlvNPMq%c9)Dq#g$!;xXeTKqpjI1r7rf+UmaWM%@m_;n_k9J9i)Mxm`Ifzwl%
zt1&BxRpuHHe2GE@`(!E=h`vUPS%K+mso+$bWYP+PvbvlCQd4MTGI0f_ErTc&CM)mg
z6~x906Ql-0<H2tn$c+LN1Fta&WaQe)3LV5nP^eVmItOKaZ5_m9l3C)@S3xA^THGqc
z{I7;_a6ArZIE55LBt}OgNQ4-m;b>B9TnvE(ClG*!OXCOxBI}P7LjoEm#Ke*ah!{d5
z4&ot^h@`l<`1rV39Fc<%ON@;nz%fLYj-x?#1TJE1yss}F>>=U^EH(cd8sTJjDUujX
zKoE&I5(I;U1a9J0dk1@$NFts9$3=rGNQjFjz{DGP2Za5lXdD4t7!D{LM~uT05Yg`T
zcn2=K>)@*52=NeiHrNnI{`Le1PG=k;mViruxULi92vN=;2x%8UiXkLH$aq4$w;j=e
z!`>sF091ktb&hdBxJCnc5fL8tBnQ|n7>G`ci*f_05KaykQXsB)aK(`>_R$Wovtug6
z4e}%q!=3GM4hUyQD^?~%5)NE@n3KJOgQFABE)iTdCo#my-o*jr8$%)yh{%`_X9q_R
z`4S-pXpVG)70-$ki-QwN|93G!SfU23fK7uSZ5)P(hSe~s5C;aMu1>_j8W<eJX{DjA
zhE|J4LmHq6&=_?R8iB#6f=Z6YpfLn>E;I&%RzqWA&@cua4T1DAXby}zh83WWCPFY8
z6N|=yRNyesI2uDjLm0d|fprupTMg_%AR9c$6|EEp!5H;uG*KPG;6MZnsMQ*1bsUI6
zQb(e}39+D7YopcC=ooblaC$XRs}<1dm>6{gMjZ_VRl;b*s>2u!ASXs6Mjh5f16_a%
zB&j1b)HOh*RsflR{9#QXCO8)!9Sx3Plt5A-M>HC*4r_oU;0O`Tp{}l}4w3^|zz@tn
z=|NnUU>d9wSZTy5K~^k1dbnaRz*>Hcw=h4sg?9%p;J0isHZnL1w$iLGiVOVr4-H)f
z8`vLMSLkWSu0P<1fxC_IB{MT<KiEe>aI6P}WJLkr9pDQ=90f4M0k$wJtN`)fqtXQ&
z|7V{Su{_3Q1zdrmv4Q?M8=krIrxNW>i0Do=Y>?a21iN{R48)Jw{fMtd>9-1`A%(=B
zM(0$=#qphq%kIj?95d3CbCc<J!(s$w3adZu-#2<}M;HpWKO`vS=9`fnaH)7<j#e^e
zeecf_d2VL@f<aYwA#Er$ccUY?LB}dE{$P7CBGm?F=xv^gXgvPn@0RxsmUhoxb8mzD
zDiqM+hfe4YUQCK!l*UL-mwaD2c2?*>+_eFNiB{(27Ej5h>37Fve50;Xh7O@RYs4Cx
zyEJ90#m|i>JKFUX7CcZrpUS8z_*jb^|1^8>%NMIcn;=xtX`U5iqSv-j;XT4)w(f~y
z%EcGcfA~)b?0g;8^fusHqic^<PKalg#IgD9qjUYHb1AiFmV5Z>=e@U<=a%;#8C5cI
zQ@|bJjv1^XAH&AQ?K2TA4Hw6Mk>4|{lM<d^yeW#ypOZsNSlZ?6J-d9BYO|7)=h4U6
zq@5M{J8sry%5rbHp_4u*LhwS#3!hWmUl7+?kSdh8kcK<D=ZEi^=Wx#k+GduDyJlL1
zm6G#j7ylsn1DcN~=Jm>)jk1;F`9s<>YwR@hM(cCW!|ZBFg{q3PJ_nyypMP~mXXwbb
zBEMr5R#MN)yKU_UPxw8&0_h_PSJlq#d9h_1U&;v!vdd6S%#3Wo;ZHZegesiLztYBU
zW6xcMm|CycdF8!C!e<U|d%NTq<&*2q<&5+Db=L|WF}1N+0r8%G%6kLd9yu=FU8q8-
zG~3{pOOBre-@D!GN?3O*iu8|!_$0XmQ2fTDdfxRMla3<K<(yPh45VC&Q*<2BPv@PX
zko%|J{xM|wD-Qbo(eE7TF~a67T}=MrsJ#1wUwFMa!n0h=EKj4!hPVF6AuUu*?jEz$
z->tp3lHK>g*S=hi;^p=BMVZ(sg^DSvsO^$?u<-W1!TI=bx!uAWrFz<7Pqf@ZQ{@U2
z7P%W$PI_z_{>YH}<(`$A10&8iiv*50xDI?YGk+d2Hd6cQ;*6H~Z8M6pl-YaTPQ*+o
zyrEF$ci;ELl4qpy@KBfgH^vo;XWsD&1F?gV{2hmgF)D<iApM8lkM;gO54l`Sw&5KA
z=5Lkz#j@Hq+b*~IaHYV~?qVWg*5a9|UQo^TkK^cJtvgtW%#`)KmrCaM>+eW?d{Sh5
zWzMhtOjDkK)rRX!$%wpQ&GKv2&zKrpW?nw(A3gQMyy)*>lLaoZT5Z(>r5dWe*mK+9
zS?Ke{iR9tBFI$cn?l0Jt*X&#+Idwx%<gOi2c-vw_5TDqyIhXYI-t5V>$g%Dx_l+gO
z-%Pom8W$w1{~7pfQyOYLs`^n9mzusel}haPHh7ed+ZEZp<?NbjLxAl)O{K`K#=|k9
zG7CJp4J+Xv@;$t4Hg;#ELn=ofxJ~^U&=;9}v0&EzMt{!_G0Tw7r<`{^+_(;w<?wo$
z;-lc4?(B0zou3?7#^b-NDep@@z}D!x_<DKx2cXg4U<3z}lZ%_zMlQ(R&)>tx`+}Ua
zpX(J5@avphfRC?@oR7;@ch>-aVF->Xa1<0Uw>;$@;_jyZZ=`M%&pAIIp8y>Eh>u@f
zV*8HWR&w5fUS2(0wh9Pt6SFqARP}TZ@wWxre=|BS=j!F`?_Ve+j6>i!3PnV5NE|1Q
z>zudqHFrlrF>uH|z|}dx*~{m$il6%>cRzP;SNC%su0GzZJa_IAD=5HmeU*}y*<<^k
zoLC8M{<G`uZ)a|4;Ncno1abBYDU^}5F}FPZj{qp49de55TE?blEH64=@eKpLkocsO
iw2aKkmv8DDnp(R0Ct2nid|;MwW_{%Tv-$7;<^Kh`58k!_

diff --git a/client/ui/Taskfile.yml b/client/ui/Taskfile.yml
new file mode 100644
index 000000000..2d0af9018
--- /dev/null
+++ b/client/ui/Taskfile.yml
@@ -0,0 +1,58 @@
+version: '3'
+
+includes:
+  common: ./build/Taskfile.yml
+  windows: ./build/windows/Taskfile.yml
+  darwin: ./build/darwin/Taskfile.yml
+  linux: ./build/linux/Taskfile.yml
+
+vars:
+  APP_NAME: "netbird-ui"
+  BIN_DIR: "bin"
+  VITE_PORT: '{{.WAILS_VITE_PORT | default 9245}}'
+
+tasks:
+  build:
+    summary: Builds the application
+    cmds:
+      - task: "{{OS}}:build"
+
+  package:
+    summary: Packages a production build of the application
+    cmds:
+      - task: "{{OS}}:package"
+
+  run:
+    summary: Runs the application
+    cmds:
+      - task: "{{OS}}:run"
+
+  dev:
+    summary: Runs the application in development mode
+    cmds:
+      - wails3 dev -config ./build/config.yml -port {{.VITE_PORT}}
+
+  setup:docker:
+    summary: Builds Docker image for cross-compilation (~800MB download)
+    cmds:
+      - task: common:setup:docker
+
+  build:server:
+    summary: Builds the application in server mode (no GUI, HTTP server only)
+    cmds:
+      - task: common:build:server
+
+  run:server:
+    summary: Runs the application in server mode
+    cmds:
+      - task: common:run:server
+
+  build:docker:
+    summary: Builds a Docker image for server mode deployment
+    cmds:
+      - task: common:build:docker
+
+  run:docker:
+    summary: Builds and runs the Docker image
+    cmds:
+      - task: common:run:docker
diff --git a/client/ui/assets/connected.png b/client/ui/assets/connected.png
deleted file mode 100644
index 7dd2ab01ae50f84f784803fa2318c58578e04369..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 4743
zcmb_g_d6S08>aeFVzsE%RJDYvRVjknRTQD-YmcTzZDPgNSXDDMVy{v!wPHlgH;Bew
z6<ZOz+8R;Y$M?hc7kuZ3bDi^C&-IM^I`@4&*NN4Gsx#1W(NR!PFlcH#)2E=Iq`o|#
z+_>6fpt8CY6t|$7&y)@Qt+wZAlPtP}dv+`dhTR<f!5re0==BWZMF^M+z$<Q-{7^tm
zqbd6xbBt1T`5mD$L!kyhFZ5#z^G}GUb{K`IKm=rwc~Xh@`lws`d}`9Y1UouPsq~l3
zrARDOfwS~Q2xf8^{G1pwC;jWB>^SwO<-mS>;QYv3RXO0Yl>g(Jd5tY^9yO7fm6hv*
zc$X0R{hpY_q0ITgR7?G;nGP->=g%l2`Oo|aeIf~Xc1G;Xi)=?-%>8z6LFXZwgf7hH
zPn|~dvN_t+53P0@X~cUIekvl`Hw!mwq_hTW=TD1#Rz<geBx-=l>s8xrYDurpb|kmI
zyRUaJQ-_f=<Bzv=@ciccLyhZIs`ES?y9<EO62*n=s{|Gb{w<ts#^;hbrbTbNH-ERf
z*t?BY1)FY;f<HI*>>qB<?_98Sh)M*W|JbQDJg9N&9segCyw7r~vi(7Nz4WkkTJskX
zdW`j*^*MIpk=+}nkv*yG)jPC04koS-<&Dl(y~Vd42NL_jPFsQ1rKN9E%~q0o@3wZf
zE-w+OY-l3??V!&bDxo68F0I@F-Vhy`t;qRBxg8_68OBT<j_piv<GLtiCx2QAk$=~u
zNmHq{AG1`Bpc`ee((>2Y*}7iMMrI?=y#XZ3D#;mJ(!2%NspeGWZ2JP~Lp}n3ww5G7
z4vH=u0)$(rgXP(K^ZV=3Ic~=T%JjE7jQ0<7b;nOYKlp<sc*(1*@)Cz8TYGU~+-C3w
zmFF~#I#QuJgqAY&(ef8?9-vg+R{Z?}6NQkaY=GS+X~qfEM_O)rF1|SuzO*>r_u9$&
zBOb{3J$Rb)J=l5#x+GcE1uT7LTB@$0IAV|>23E?i16{y(L#An=Ny1Ig(4fEN@aCgf
zc@Dn}uV=dHa2tP_P_dRKDW6rXv6BJiofB$!F~T}nY{yGK!`nszV<^}Cr39*f0Kp8x
z2>Lq&Mf1E<Wi0j0_CzK18|*~f&4_^?O=hQl&O7bn<GdQ#^-}#KUsLv6+U0WrAJzpI
zS*mVBxq~Fc^6XC+(NUx#Ot<}RhR;D}CJKE7e80tUPtUN^at@p}bO>|x+)fhLdI@++
ze<RC`Rbi^ZWt7s+XkcpWb7S<B+JQl5XQxH+vl^rf?S!rjUe-I_135fMzfsm5Z{&`E
z)GHNah&u_O08fVM1zkpSpO(LMbN{BRa6jZC{Bh60#!D6Zb5+0}O{WU&_khegfnP6{
z<<Ezz6ZqU{Y{nzK=c*Cn6`*ky%Y0hDJCNW>GA%}RfmHxt;Jykc`_@FTyn2?=H0jP*
z8<%2=*sRug*Yve)JzxmY)WZnEBp|+j(gl0pD*C6f(a++W$sZ}Sj1iYX=5ho-&#Q`b
z{t5mgOMtPfogoreE>Z?$Zh&IY0pg<i60$W`A-ru~4VEw_dMdwJw+>M@(DZs)=L$&c
zTuc-y@r8B|*wy#3Hmq#?kV9v0j1dYx@|&47sc8Y^;oYRx0<92D5_LwiAxeP^em>F8
zbY}h+g>P|~2i#?NHBGz<?!asCX*vR(F06a7l1b$o>(M4VqC0C%P2wJ%Jp3R-_v)!_
zqag5JZUb6|D2k!k>==}!sY|~55GlztArNZcT5$`?L&pNVqhh`>l5=F%7L;X<c0~Qu
z{G&4s9_TNNUz2>o&ck_9V`Us=j!tcUL<5G{tU29`EET2QW2NKamcnnKP}um`91yx6
zh#r|VbS#cZZtg_ZVROP=LAI}w@Y6IUGJepBt?wSuKE7{e=R1s7v`Sl#YHp8mi@b|t
zg-BU5=2@gKlu<Oi^lKx$>&rW5O(RQ~6pStHHor*Za&PNCrFKCbTaxEoLs$GovK{Kf
zaHxVTKpb2J_i8WqMS8J%w8-I-EJcWj3tO6~E)!dx#X@0{1`X&bb#+_uIU0LA%({>L
zxulevNcZxhMsC4)sW;B>5B6>to~2}OO@YH$D@}MJO8};1@6k%B!<86^+Ulz54y46A
z9w43Ivxa(n!f!cOWM~hLJ)JLf)Zkni5bHKM|7Yn@U>7+&MPe{WvqhNIO(#vpmVb4-
zWN81=dMk5Y@$8=GZt#Y*vl%Pkp+WZ3Djw$a9p<@O?w^}b4C&8ax1?usk{2HR?;B%z
zQBk%Jv5fSHL;uf=^kUL%Hy*yOKuMORmoMon$8tEd*?|KfqKx`Kk(TYQ?eYqh>>rT1
z2J>#U$fCb?3)Z8%_cD3#<OoLg+nV3f#)ZtTSFOveL}A4>HZTN40QC0P>md15jaTy#
zL5*t4%)8-VrT5h53-(r+@+@JAb%UpV-n`7aS?^u`lI9)PwoqRezm&eSZKYjxoXW#m
zGQAOIlc!d=`Fg+IUV!|wmIk$(%%k_cQh{~qcpoI=Em6M60ZUhqa~2>hX_ZvJ1Ou`2
z%KiPZ%FBOqMTK^6$()svSBKW`GxejjzulSQwrGL(ff~?p-7vXKuDqng7(xm+uJ#n0
zJ50Ok7tb!X=BRoh<mRu^kfPqrZ~bd?Whx!GhCKmoJJIy>Bf2_}pjyk3%mAXl_syAh
zpL@-)Uc)SO*79=!n0evb&UnqVVo%G0?>JD^G?uB00s2+S-gI*y8(XR8fk(%6q0`Nt
zKzPmL8M3f2FJ%i8!D=z#L!1H#EFB}wy-Y0t<HkI$;`R00yo0FosJJWgyX#G@_YOfm
zwL(I^QjFCwh2LRg1b3#xp!4;h3%z0_=FmlsjCcWVvdCyx@|BQ6^|;ud^Im$6c$hSj
zS4HLR{$`hc!aKuODoG*@>KS;V3mg&6cufWGc=AnHDMne*##lle9!3b+y@|MiHJc0#
z{}B|Wo%R&$dDNx4EUWtOWW}zUyxDhKiDJtD<=dG2e}229Wp_h|i(Pl@Kl>c)V+Zxb
zLEzAGhGR1WDwf&@JFDM*Q;@E#QeYG3S8Y?{9mpSgBp*4Os+cYMzaBu{>Y?*aZZ;~u
zg6__4v6rTzc*rNyg~D*!spN{rd6;KTfz5mANA-_QpQ=r#GT;T6@IFxyBT+%mF->Zh
z8O~@Q!GmjsD#5JU{#~t}gtQWB5RAqSJauQayX(pmPw&Ua!J*Myt40$|ylO#X8TWvS
z%E=_EBHi!5cWm2tQvv1a%z>+1Di0*Ylcb`<3)Z#MJcN{|(Y$B*i-v{kaGUQ-51brS
zL_BwD*1P)5+)Pq@`P(hg==7z_n2xFnB2VWs>mJR!XoCYJE~|MD*-MIgI8tmmbx-st
zz`{Y0!&O5}xbXgV+=Tup50R5D>NT-=z;?<<K-{+Iw!^&RNC(m-v?XB7J}Tbq9h4^O
z*A4UL<bxF>Aje?*B`mM9Wl#e)nlmZx)LGS>E+eK64w{p@a#zR+i^ZbQSG5ZTr*?iu
zRht5~_`eR?Yh(x5_r80WcL}N*ORgoF(1|;6gRONw*p!VWuS(@USM!yHP9SF%JcA4J
z;Wmf4QtQkAeMu{tD0JNNv5In}9Lw~lKaGx#Dh&dCe5j@?$6{;y$^O}y!UEc<gF~3@
zXr6Z57T_-*_yy?<ZiD4rIF@sBQE3q2-iO1jTC3VjEUX2^cf1Oue#VJ#WhZ^^A?!`e
z>@9y$`8U#Am4V3lHQ|4R*s%F%-`Z5B_Limg+a%>t6`$7V6;H0lF?7@9VUYJ^Nt6KT
z!EU9`>iv_XGs8=|e3`HGMC2YCWf5M9aOEZ~+;tBDReJe;D!^6@Q@)p$mxavEkN-vn
zJ=^ajMGI$d+Sm^VO+dWcAQ)b^AQdw_T1VnuXzrK&;Y+^rBBBF(OdWI^Z3hD_D3EnA
zcSR}~)B%{ap}Rap7TFk>e&e783p)j`$TI1LoMYnqts6l5!aQvI&MK>IDD|Z>5$t5p
zQwjWf?Uij=!l|@NriN+_nXe^HPUbx5xQI7p^@7!c#XJcM^@7(`LRbVARvinTA%cbk
zN*FUAF7-b$qgXUW4yY;jX8*yd_0%cmaJ=EK<bgw6gG$wY8^_`9@h41lb8T(6dbZ~C
z@u9>Lf6z=B-YFgr&~RQRVXgG;<FlN#?frjVC%jS>@o!3Fu-2+vg_V$N`9zuZr|BpA
zLmpSMe9-oCudRX+6l1|+^@6wbOCWpMhosSI+%%<UPCl|rS4I=?D%@VnpeCsnR+Rhv
zwCiAIdHGmLQ^y)|Hipk~*94WDvC=<OBZa!AoxZ;8=nqyw&u$T=LKDriQofP-E(-21
zRbnNI(fTot71i@P)~qoP;gvuciO@yE;UrJaB+iQbXIi!=(u9;I+_iFv*IM6<9KdAG
zcB71QGhoGeu76X#8f7x{y|iNG@#anKV7z)}O%PrH)lKj;ds05NQRe+Br=>_y!3g*X
z3UIwkq#Wi8LKLHeh=@I;2LQu@A=vN6z;<;iAK5fdsvT&I`B%&VMCjsJ<*JZQL-qXH
zFdU<!3zdN18{Qq^cZ0DFuf5bah17et8C<|KdD-@@vtxxF8k9w)(SD}x7kq9GHYfCc
zK3NK5;95UbgM#F1-LZh7+qNrw(>T#un%=PfiM`Q0X*TYM&$EvrH>ABmbJ9*j*x+zr
zQJ%Pw^_(0b1+#w&Ppt-8B-fg@1juq~5BBnKb&gz{F1woFCK2<;B=@?>+))>omq-}B
zn(hVeOL{3k${pFTJcXL%w;%e&#p9dNfIdpTJ%<?;Y$=K0E8;<+MIN}qjV8U{DpNMk
zK2hAZ+41@a33$$Az<CF6wQs0vy!HLJ`zock-fT#RD7e5KXC(`<5R4ythZQFX;$=-g
zzCHL@t8@@M!!TJN)%=BAXBWEMk2XU-T3+HS`Y?RE&C3^y>ViAGPgtz<MBUbv?b=5h
zL<TSx-OVE8lMm{ugL0keI4lt)y@29c^^EHuRXbH|kN11H(=V_Jc_Zs7rfk+S8RjV*
zkG^yYd?56fWzN*;5#witoJC=y4ah%`_Py_<(xWG9_?Oq-Uc=||Y3XO7%e(tth)g#w
z+kssB0yEV+g$TcMd$uXw%Uq7^lhOmDRhpnaxQD+h$s@h)!D1_Xm0@Sqp-gv3#&@cQ
z2LDS@+@8$%CjrpRXzmbl&*flrkUmy-)hI_Mt(j4<@aNryJ-J1@j2(Mu8_VOdPktco
zeZj@_C7ADa+cYn^d9&F&`DSFQyZBalpt*Zu4b`fheEr|N^vp9T9lU@piRgO#nz~u0
zs0e8g2d~y2Gl*-ij<@_|(zt$|)EV$HvF_&+^wCzCY_->BSOObkc)6)pcE~lWib%!$
zMcXeg_dmV)d=AMkwOP=jPGKR#T@nw2ugmIB#*8ygn<5aNk&L&P-Z=PM?YYfrzChva
z>Ld}!-+B<&8|>_+TVeVv0^oYp*+QyLZyjI>-^jn;Uvnmz?*~I<LPEpz%lC~KnTYr5
ziiA_Ve%xZa``4l3ai-Xd6QTOUGm2q0sR*>Z!VgWyR(b7~Y`#U>erWEmPXcxu&LhM+
zJhoTTDHQR}bJg2+#K8ZP$7u+~Vg9AC+J@awXZ}`!u-IJ5u6F)_eAt10IPY`AVV;)w
zQaf$--eUd!%<@NF5K_G}vRQJckEWXKh`!h3dNP4_DWxj9(``U!dMYg%kR~Cu_H6wo
z^gI+`fO8)&iiqnn8cb70b4tNpi&IQHg%A%twx9;}3Nj)Cq-#LoRVM*@rY_Tx011n(
zu|W=~JnkrP)^;YR;52ZfEd2cRG2w#AEAf1uESr&&hX4zhW)|B<m`pa`50RnpO%`Vv
z7Ofp4GoR7R*@%un14{idqfuvq+}?Z>ZybV+LW8_v^=rqcnQF@iHrNi%3C|!8k)D(G
z`HE2Yv9IKK^0DOnMCirwSE3nrg0Z$eE;s!VIdCXlxXB{%#wv)4P#1KMLi_+ZmS|=y
zr!2Q?v0b+o-=B`1LZF=PvgTEcLfi3D#-Sk|0f*)f+8gl*)6}7w;n1Q|D(R_ytK?9T
s^lVYL-u_s(rGlM5fBhf-UMRZGdDvsbuOptA<X?r=RD(XNRI!Qp4}yLfx&QzG

diff --git a/client/ui/assets/disconnected.png b/client/ui/assets/disconnected.png
deleted file mode 100644
index 421632b522ceb79df01e0fceb295684c16df9822..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 10530
zcmdsd`6JZp`}YjRDO(-qSfZqeGM3QTNs44`qp`~}iR{~qWt8IM5E6#5RYbBIH5iOi
zVa8Ghlk730F__Gl?BjV)=Xsvb^UL!OeBVFb@B6;)?OI;f>$+3yZ7oC&9ytgCfkZ4X
zU%Una@d<-K;9q|T04=ic;bjm=nQnQ}^hUJX^5lUw7oWJjkjRUNbe=U|{p-!0km*BF
zF0Y%L?v_gEG#$a2U%GyLehM})F`=-}?D3Vy5j9Td93DB%XN+E}I$!B@<I2^;Pi!t;
zy!hnOdG2(w^y@gO!|(fxTGl(J>nIBmfhS%)M8vcE`t;z?abOYuV?Ga27(Q}2l1wHW
z*jZaoRQO>m!u5;d#+QGwooYs{*lbek<cbQ5L7^?^j8aWvY><dEsAVA*#i(Lucaw>@
z72gr{jnm05Hc`u+-Us^BnIt0f)^KAcF{s3*bC>mDugvf{L8JY&9j)Ckf6ukJ$E2vl
zZh%=-JO|S&emX!JT&R$HDMY@clTF|%>AAV+Z0s`jFgv>@YAE+~Ds#^>eSvmMUj;RZ
z3p3P<gA(?*;n7?aM77}Y4tx+(SQvXbJ<6#qdUcdzA_S^`Qj1?{?Pu@9U;0+w_K%&|
z;8Ug+S!L)Q;<oXLIBgTT9OIG_LZPi?#RA1d*=}VsMs2XJZeWlwu-a+^<LcB(?=W*7
ze`?v}NYkA+H_LXogqL0{c6X?uX2cMK&5(TA4JTtQ5Rzp94~QmFyKpc_SQz>T4%QM%
zT|xM8U+wI)$+|liyRbjt)#BO$gjtL|;_5cyMSD0D%BKa}+$&JCGwG|dBdvZ2zY)*H
zYv-We>foGe2t7<Ay}cz=q5JgnfD^24FL7|^`|D6aYDzF?aRlewaQmYxvVDrPATgi9
z%130yS``~kKS?Lm5enx1=7=+6A$!#X;_CYyHcHiGFDyRZF+Hfigp^7YI6>I!45zSc
zA4bW8^3X(a7r)&tj&q$eF0h;R0j>1G2zxc!Azgfv)6FW|s9}}qQKrs)&87~1{}vv<
zh2BBhK*hEf1{Y_??o1kW8{|ZJ6ZH-!iafO02MTjWTu`Y?W0&C^oiIurUMz)Z+xU*w
z_^e@OV10h8W)UX6C&`m=v&vz4bfsjW;nMDcD9EeM<?gM4OFd5~vToGg(p7PFHaW03
znqx9v^0IDz0hc3kQIF|akNBC+51OlJOSM-E>pL|IM!ZLc6@M_!;+Bq^h|PYNC8^BG
z7|qfh9BcVb7bJzT7Tjw8)KlwrFbunUck!6o+&+)_M$50?KbwiQTR{)l^*kMBgh7;4
zax-Lz?PA26!W3b|1M;cYvEEN=iG);UMI&r`J3P3KqQW#>Dt`N|&p-^+_aKx$=TPNP
zbB3v4SUpZqdhc1p?f-{pBuJZhna*wtebk#zPu*N+4Xh>Y>})iVW{Lz01VO&Go6VlR
zS&HMeuK2fw`Fk^K3ka58Tfm<~KF|Ym?%bm}{bnus!+7ji%-Hbo@Kn1Sv)Br)HaT_R
zDQMyhH3hI1h<nFQU}C}P9Hz6bzUws;c|ThYDL}R(+krYwzfNosg^Gd#vRU&_B72?^
zvFv^9S=m8`zLICh%>jfmuF)9UetcQG8LI%AXkvXagC1NDeB)F{67P{T*j4v$ZJH}S
zz;1lkZRr@f?Oq)bOV$o5EG&dfe?Sy$HGo0XqmPabO(DMbu+0~~?(8JWqF^TP?r<Fj
zEa+=Y^y<sCw>w*v)P0n#2EI<d>&B7Fc7Ny@E7?SC$vk3xw1plNY7X2hmZlcHoFf|$
zKRur$$lqvzh$lR{{pH0a=USH*R=N$@P{EF`j`;L_1*`1m<U8??kBiSYd8o*lxehN+
zKV+zrQtFN_=z;oBz*^4vj|NOLI4hL9Z;DH1_wK)gQ#j&})=)&Rg*I6ej7^scn{8H6
zQ4yt<QL%Mapi|airL;b9vh^N`8a8&^P^(=ht}gysX1u#kV*caz6{L3A(1{wu+Q1Fy
z&{l|G=S1l4q%?U-dPB|%9u<2aJJ6LH+E=m=ZH>UmcaI}+U=LB1X{mhA4tUb`u!xct
zZNXgx!Iv3$b&|X8;8I*Nc)6;e9ASOT%V0Re6!hs9qCmH6n=3sZWZfOH1#gRSG}Us$
zp|tA4$g7(OL`$++3)*5gZ=Xk6HtrEx-Q8{AdbAA^6~8-O*><q)%QLiZvr6l3ou;~y
zId=rmj>%YSu!b+u!*<-;-sBmDq1yYI8{1mncF)ke-m0MNUH4xmmP#~=6=|*^*4lFp
zq=D2a{M_s>ux2bhY*F5L^=FaT5g!We>;{$<-6!x1AucW+)3lAlL@Ms@RL-^<E3c?v
z7JBY16mi#$b?r>OZbC(-@4j)eA}Y2|`GKVFvkqTGdL#a(tVWQJFo`vvNR$^$_YQM>
zJcPeKB^$rwQ~Hx4-Ra&_KD%K2;B%hiz`f?`!oTuIX=h{99j}1`PEhBP-}OGGn(Hwy
zS5&wQOAid)%I$w&H>9_@SrX=wJ!flN4$3q2d6hf+O}l?C)Mc8E+P`{}b3T`Lo@!WN
zh4tL1FsyYSVQ`2Co{SG?AV7i7LnAkdIVw?us|mtmBGPXi70_09ZPDHAa|pvdM<=(H
zKl7*Y_jbPu&iFRZ3YD@BE)`RAZV50_dT$=WI8x8L2Ew=<vL%@A&7#<pzdKd6H>7S4
zwrwFTlIUWKrYilV#1`G|@@|6)@C*$<>ubFY?2$RimE0NTcfbU>77g^xadYUR!0|L6
zppM)`IKLga+x{Z9qX3Nb>+a8MI#2ZCVhp*1q&ZaR$m^T<oX279<{*hS5gBMeKDZ?&
ziB?5+%<6w2;o?KioU7Ec^))hVTt0X(VOrTN1c}`0(Cbi4WSNjYFKvBSR-GW4w@kq2
zk3N0+G{b+Lkj&@dsnQh;__$fUV;C^v3MJ>zkVw%ueLBj!B%P#o|4~42=v<tZaLkx;
ztXEHGwnR8gQqucz8_o|Ss8<2LRj&zR7C(=^m~<PV7*XnZn!ZIuR~>a9SZ(kFNo2n>
z5W>U%h(BGhe_H$WWLrme1a|$~8-H9C<*&}R>$btx>nm#}1*!#)LU$2HQi_w!q0VdS
zZ=GtC<U)JoqpB$qoo!D%qsDuCdo9B8lMz(xm^}a0A)6@6(SdF<8@oEy;N}Gia}$`n
zr!`ZYXBri)AJlU^JDlCB9QUaloEJ4(=T3+am~cz%f4`n2eBKiGth%((Z^IrL+pUQ1
zjJ3B7F3ihoc2D{?&c;Sbl;u|y@`nRfGHhI145GCOH{xj{pQksZE__qSaeh@YpJnAS
z;M8>IORlsxzRYXrqnSWaSw6!`#i2U-2j-mr+d9gL&aY<{AhMBPJ@K@^2g54}uwZ&w
zlOJAzvD`ixxNbL50nQUAj=unoU#w?liy_>AO%jG$7CftNkz3ffFIzJF>(R|lT~g+^
z+q}4ALvAxpWRN)LpEmUx7}WHZ?|M>;I*^a~(k3D(t~f-?wu{?jn;}2rp=_PBW}m{n
ztpRJ5#`~zBJjhf{In&vb-G3p8EL!8hXpz3r?SuVUC2wXu1j#uU?c1V%nh{EAG-jL=
z()g2F`k%Em;n!Z8Wwq7G=rS0SLVr<BG9w}`K}9-m-NDdIi?|df*IVP&;;f?IFFdrU
z#AYW9aFfgcGAPX&`p38|^2c*j=JU0bwbXYBuak4j4rf2UFxG}XhqxB+2G}L%h``r*
zV($%V?x6HVLHHrpB?SvVL((^hdum(&bYr`vL0qGX=v*LeNL5Q$w{ou$%r09!Q;@_8
znLRwFZCGDOwy*O`kk)BFal3o1Q25y({LrS<1q{DWO|je5;Ux}oJ=~bTzE>62=shl6
z5{D_@JfH43VrDrM?J(eXS*cu+s`&$XkH7C#N=k~6X0WK0NtIw$Swmd_%kIkdu)mDQ
zCt>4%bRk`|rgW7PWi4Oput}&V#>PfQ?P2Yoz=3Z<Z(hWW$At(CoUSa4a1}dY8TRbm
z-!^bKIr#JUkEytUkW^$le?XIP&NjR!_KfQ_vE!CuwJM}dVZ9aVH7gJEY^!?W`Cbp$
z6Sb8M<qH_~U0`qY>ecPm;Xj*i5??y1IM%j#k+to5JoE@&*yH_G#MS}dSq{~o?t1q?
zKoe_>Ha|bluX)SZUhIe^yIkFS?x#0X6C_hJF{7ARHW@<L?>FUO`@ov1=6=F)5R@>@
zc$O&I>YCKcr4OeEJ<F!WER?@oj@-88KtLNsM2o|SH><B?r_pLMnl1|cbwvDsy1gd}
zuUsy;4(>~MPCQ^grYt+O962bfc}t;xa9{v~vK!^PGV(#eCmEEwY5h7)(Vov67rJjA
z9=fo&7$DX0^vzz@y91fE7*LW5`lc!ma!AX{4a{tO$-IBUFMd6BE#HTfyX<0&sfO?C
z<PZ}s*Y$V)y!x=|JV|&X1nD!b<HXmMopC}F@@pv)KYfMpI{80k`^h8prE<Sx4jls>
z#eaA5IT-)bQ<dVXr7#M|2K#mUWDi}a3pkSA<MMUVLcDYD%({y*4mFUVTRL~jCQF|(
z{h5wxghjWiSMb&9L`TiKNgoQ5nON<|3uO_Lp2un<HrCeGiaX$ZU#r`YJs#1Kh;vuP
zge`?S$eJ<|)Jq@JIZGgkOxEk?6vm_y|8v(VS1C=1g6a$rFFXd(rgu#FB<v69N)j3O
zK5nR!INOA@zkKbq*7x}}0bE+r{(zrxhb?@inoCQ|p8FVQtDH(-1k|(&{zpA1ds{8r
zQG}k2Jb!seM8wTLR;yc)C+yBxqtE)_p^ZC9or8;Dc}s#TezF6CebGkxX~BVjX$`D1
z@~L|xMcgU@^wle^y#it1(*k5gLryB)Ixng>pK0K`iqZg-Pr&lX=*(n~xI>LoM2wtG
zC!f9AW8!<1`Bv-Gql%Lg#I_&5f@o_S5scBz^aFVdMAxG@;scbs1lMly{&7p4QVuVB
zLnE$<NqH12JDPiU+1o}Msvx3Fhdzb-k+m~^+T?0vhy?QQjzTu93YV1qPU2gEu*La}
zkBz(%5FR{qW@}@!>xl=DO@M@&oaR0Sx^Ip&iwVHBve*x>!6P2&&h1Ffa$`?PHeeLG
z7lvwH74nbVedA`Riw5VZ6LSt<zkYqar|Lc(Icqg!{tE|;{Di*t&hVOTWM7ge6Hq#+
z_ZO=n)!OmpcpWWj-4K-12d2IHTg73=RAODFv4?bSSjTB2tLbpgwq{!eg|U2fP}U=z
z_<l+!?s$vlg(2%-)U^jl8Ys*jf!7e)dW=x~*)E^zniXgx>HXGv`xYPVK4d=T<w<OP
zomAsjMZZ##@9b;Yy)WH=YINsd(b&9_+)KMH$mdo=*4dH@O1_^A$4CCuNX{vE?JZ9@
z9fx<D&(aq687M58yDMkaDf>2Z`P*_MOjpy@K|RzG^PJfIXSZ)xa57Q=9ClIS=SeJV
zV<&UJnx&Qlt<O(y#eML&2axd0_QQJiT-5_DF}=i^7vyfOu(z)k4r$N?(AVRYU7dJ8
zW^0K_v&mGi6h<w6pd3ugf=tA~56hL*9&2n?^!r5geLnHm$|7J#4c@(3_ZWzMX$_DG
z{#aRgKPahBFBpIoxVnYI8s$XJXIL|Hkk6Rl_BpGmk~p!M+$ClbtF-Q&(BjDs-FpO?
z(rS!Wuaj(2xc7dbe`jp6H$y`Z;?@?;fQ)YY&bk?RpS2n~rOIA_0SXjV3m4b$71jUo
zZ2XN=4SF>7R+evRfRsJ}8UZU1*Dxn8B*Chq?qX>7I45$;V2dT1$;Cem1*E)u?gOeb
zSu?&|tm}Q)YAE1Fhx6?{4ucZpI;iYnon3J5rJ!%uPqI895sJt+rFaXdrWP@z_ot<V
z?uJ#3Y>|;*t0BmGZIh!>X~Nm7#_2sP9p}7PuMAa>X!oB50&yiLjqlS%iA6VhGZJWq
zL?PYUWbFar!oszg(E*!$dGe`_S-v%W&r2#2bppQD`xsRv944J;zbEkn8`k#Ptu0HN
zl%w8m(B?vO9X#Xlp;3cbEYihDg1A^7xg=K%un6aQBm6NmFzgwiQw~|?Um6hd>@}nV
z_+;+KmY}WAnU_>7v2IYI=^v4J6zpFi?s=ECULwC-8TwD_@dyTNf0}*Eg%dJKIxpEt
z5GP9vM>C_gca>l8SoBOJr;pEkK7n7f*+v3B>bvj{Z<I38dMhHmga>NiM%aYIr=y~m
z)`C7FOM$6QE;R!<s(V;VNa_idgf`I>3hT=Jc*e4H>EYT7q%Zj75Q9@ZwH#?;;@tp9
zGI;5S!Ts(WAmN6wJ=S<j(J#AbED%Q-<w<}Lb;`-f5C_X6FogVdwVIuay!rev<<zVz
zmU9lYAs@YB`$34u#YSaHc?l);W|sNbjGHhV;@TR%jSK{1t0(?aOl9pRK0=i42Nt(7
z0mS9)VXRP|4=fGujs3YQpL!$f({rJ3%fGxBWBdCWS)2wNa%^PJiJY>KAMXRCiX8{l
zJaPfWGU<J=L;1IND(eO9CTEGy7X}qpAADfw$Lsxs5{N@#=7x}wU@RncRTa2?84l2X
zmY&sCpI;4^)F5HX^Lri`-uqWJ(CRnx??O}nrV5t~xn_AJIY7!oR@(+J)A@WeiAsgX
zW>8@b(Z)m5PY0wMFDv@VHhLz6WIoz>0_kD@cYwEieCzl!H~P2Wo+R)mQ?hoqXl+=n
z<o}TXOhE8CyHySx8b*XaEipiftL19!{p8A!u6Gw`?s)2I0sZyw&B@CMNC_U55wM&q
z;&n_HNi16(;EAl*v&kXI{@+D>UXCOb?%z!P?;uzjR5<IC-v4iWcarH)G#r@h8Q?}w
zx14J#3+d;{m6-cNfAL=_z~O5Pv3CC30Q--HuW9kQ|7WcsK3fBsm(EzuW%5=Sh{GES
zv4;OU06??Qf}}bTSXq{~sB4z=IT-H-edM{9^gVxH6nb-w9Ep#+V}wtDjRN`kn0Ei_
zzc=+FK+5gk-q@dcOEY`Zzo+^9i0=3Mw(BT(cc`$%zmkheB%vsm-^ww*>`Ly&`fYGB
zADyv0sfwiw>aASk{ZakxvOaNO*^Z+^fNsKQLnHJiUP{HAWgnn);aef?fXaVxb+RSa
z!X-3Lj6vEI@f%E0Sap_mqb6FdXH}eMf(kN8Xz#1VF6w|O_>5^3=Fg2Y^7p4*mY`}i
zDrZzlRw+DgY|Gnpppl(<?L7dBJK3mVa+TLV#C;%Oi_NpWto?|(rSH>P|C-)gfHEE7
zSy_&X<J4K1q^?HYx}%LAihh5&7D#ICY4AWP&)i_VTm)7qPXCAJV0_!#{?lUE9pyu=
zzr_1{#(gF0<7Uxszi=ih+M2Wo_>)_kqeRG%`Y_KS4Lg$mZNpE---%>1k2c-`ra1ca
zR}K7cjoV`yOMsuc-SZ-+45qF{KS{sOspc~e=*OHJkHSw<A__N@{nm0+-lhjX+Lu<*
zPZGJ-=%*Xg^Bw4}682-khHPE!PKak9?ZI9E(Xc!o^1Za|%X)t(b@X@YVpNfEw*L0V
ze*}G>A2a5;=73+%1997BNOQ2)|IU4~x6cmqyfBuBTc`f@*gr(+4M&xXuN-l8Y;vku
zsB?O=`0MwdmP_HACtgFol9M2}Ex*l2;3t{1=E2{25d1F<W9Z<8$<qY_I>A}mS(+&0
zN$q|)G~$MsvPYVC!%Ch6g%_JD16!WB7!@R(y<QtL@L&=<S5>R{xZFfV-DPoXUs_2h
ze??8>9Rhhd5~arrbLERKc)7&4j-ey8q)==&WFn(nC>e6c^4pE0QC~fimlu<4G?Ib5
z)e*j0eAe3(2#l3}n3u`2p*=_c4Z&0GLkGrmU9PL&1!B7<oTzu*@y+;ha{0YQUW8^X
z=fFBktbw@coaNgXAXR&Lq1vr|D{{a+L9ZP0E!<vWHEQvrs-+f;)+a``2$1kdzq=kJ
zzWWgw0^pI{{tGSmB`!ypkM^H8{**xUqge0OYPT64An9<Kq!Tp8DvM1!Wv{MKr?mSE
zu+R1?cxc7UHCviJplFpF;0&M-(R>UB87slQY9`U5(0{R_X?)r79u0reBanyOT(O?F
z3e@BpKLfx>1$|G)CTt1N?o!4Wf8W_|In<5=>~ku%eh=@qlojqzblLPvx2Sf;4MbT0
znYVFn&kOE(iS;_hesxRSi#po=Ua(rlLj<4^f1@({->Wn>lg9cu571?g>EHTt))#<)
z7M7s*Iu`Q85flUWM8);IK$khY0O51c1wjG}$_5wkfSltdk%5Olu^Ucx%Yv5oWrxDM
zE3!AQiOG710tEHsTORL0s(K*j+kjU8r{xPMv#j7c^dK5u3~}p--85Q+@%M#Lx9KFs
zTpO}%(Z`j6j4WttUuMukb5Oc*dcvl1YD_nvrr#lJY=bGE%%;^ECI=Z4K%4s`uS7!C
zsmVuT%a&f2u5wD@-bL!EU?B0fWAn|6a?-%GC!y`(5^<xk>utzGmxua)%mYz)&of_<
z6APxHLqC2n!~P(ATWxq)=6s9R?N1i<$sO+6p9goSbBn`6cA~<!7BnaB9KSr2S$i4o
zgRRF$NqXE@PHp$YNCG;x_aho@I@Hg2u-4I+agTV@k>diURfeYcNN}fp$@WR-jieOl
zC{p3Z&2%Nea4JTz`vBPgw>WG^z5mcgKsR1EE3j3F%{Lb`S`EX-8CfOlKhE!g3%`@}
z?xvZ*Lj_lN+_=$MBYd%ZC*Rd69{`o6Nbf7D6MU#3qHj>+(i&a~EC)QkQ{N>zeoiJy
zk?IRE6L?hi$aS+hbQfS$yj-QhLN1%vUPta#)wPq3)AzC^|E$Ov?}eK$-5M12xPKaL
z;Ufj)NTNiKW=*s26wc?&rsH^ht=UNc_4nX~fQ&I>#7Eg%Hydw~TYw!-G#lbmVb9>{
zEdZn58fT=H@W`J{r_&AKy4K|-yx$M13h_U2039Ab<qG0v0L~o{Pdt$6P6v+4sVArZ
z{iS@t3|C&Qic<}0c1!xe)`SpKYzKTYB|Ko;CjGLy-c({v)I^`8HJD(vdFO;#>4fIi
zdt~Ni%(Tzso?%=(kE1dE2NXCYUb69_1}LY*16or84vjFf2a@K-tIfW_(o}z9%I6M`
zgB$IdhLM)-!jFR}W|xNAmL~!vrb;3RF-GE`q$3lWNP=*tSmgG)?<>L7vdxhZKu`gP
z`#qE|9Ow{V5eml%XG;1c#10<F9BN}uG&L1=-5BIcnD)PY`*w!#6SwXb;i1@-EoQ2+
zPEZvb)Y*T{7^7^a&^6y>mXubu`Q-ord!%`pduuTmq(hpCIkl2)(<QEHKfs8tFa?On
z!Z*7V5?Y;5P<0}~`K3#0yKg^c*<d&06fro&I8j^dh>JPGdvxO@$tRohP4KHSwU{NX
zX#wxtsXk_yMRRd{c^!N8Ys^pTHQ=;;&0B`g6g;Bj$ZJVKIiM_Uoz}PGds!_bV;U2m
zjvl=)?YN>^Vv2q1ayQ>|uJnLk`niqEtKY+|p$G9J{<0pQyn76F%@!t)PTx7*|B;wN
za<{XqqCh*-&IGxO)?zlgZTGg8k;g5MkQ)Q-tb=;=r(U~_gR}yXNaTWWp`-859SfsO
zg~#{c@cy@swJwMtv^^j8#l+`IAdSZYX{x^2j~)3$%OR;85w0B;7QOJ#-zvuz|GeVi
zkb|vaU!l55Utro$V+G{wF3*kKgq4<%PVMQza0bKv(jHG$3X<N{l-gZE`znuVU!J=O
zd+I)@AJ^OHLyB$qOGBTk&?8)CLRxj!<KFJ+%+h`!fVOwb`&EL$w2u1*4(v;F(woz7
zhbGeJ(=$$$J#mBzQQIEvOsFhCvLDB_2ZDWF_2!U3ki~mnR<)dd^_z@aYU*giYBZmC
z512u;l#5=21zB6rhiq?L{7Nvd45rLr7RpX{0Isv0s5;4bb5JAn_eD<znrQPg>V>Pd
z7^bKE$hmLUyQ<$smA6xBoN@Qs&B33{rLO_Tb%x*nrnK8{j`7U&;njxf_KG^dD)7jA
zd}&4eVurzZ;aVfCr><rWNtLwAV9cKKOClb@L%Qua$o7gB3ZF)WaBbmNBeSJ>VXO)R
ztmJ2IaE`Iuz!<F=Z*WTmg<VMc8b@-aX?|8aqB*ZH`Huh-Qi%C=X5r8XL(F5~R$Fw4
z-eJ}g={rnP@OFsNPlbEoRC7NIxT{gGFE~$9b2xAupz<}pPCYGAm(tu&m~2$*$LN=j
z+%@vzff0(osK>xv+_*tG{N;M&7Cel?Zx1-ap|wW=o$kc|@#w^##}+l-m>EY~sgaX4
zm*O?O4_#?ZA>OornUwSmsyn|87#rXm;m^|vY_>BKm};mk&J2uC6qn7gp$_#LjQ9(A
zOi361ftVKVsPp}U+jcB1D=G4>-n%b)LY)t^zG`PzDG?oij&@zWMhHFkfnuOmv`^wS
z%hqi3{cGX(I3IHGR;KA`)gQzbV>%P4?KJiC)jtEm{J6K2@u{u`^uQ~@@+Nzd`K*Or
zylyu<w<>M%4S)SiwvCy<oZFbL^?bCGz<eEJ_OxpKz!j$d8z(y;g{lmb00nAn++CW)
z`spgmBn6eZf78A5{N^z>J;rYYh{EDT$(9lS{T}be>pi=2$FwJmx>z&9gUtD8n{=oM
zW?cl@O`&bf1z@IgBYt-Nj`wwkLGfN}VbVQKU3Ux^c_kfS;HtEzj|8L-+E|g*VEoR*
zLi`Ex#7@~l;muy*>$t4Z*p+|6FC1eJS~^o_35fP%pp8kQfk@P4J4+RSX6I%C<qr<g
z=yJL(3OM6N1NW%O2&fQ9=41g-65J*AW=g+S5}9hPNv_qVv_gw84!Jg~Kq-dVoF4^j
zujpM(Srp?Jp@^xq*)q}h>62+#LulxnIu@)p4c#nnl(xlH%CSKKWudlah`)2^u$p%=
z7T4?!sg&%F^23f$YFB<SCpOgS9}$r0H!jjQOh&<ZV4u0qD=5K_MB6>?mZPwmWmPg(
zTP-I>#iiJ*h4B6ffm8b+<2VTV=3R@(w$C4^yBcW>dDX|4sH^$LXtytssqlm`#{p&a
zAcpTDf_~y=HqzdzR4t=FsDi(uyqsI#X5e6w1kO{Wj<!gDz`v~UK9ADw+I$cmVbuH*
zw(@!{#Zb*%Gdgzb4?d4!;G}@nX!oB47)pNu4m@n9AxuWQAg9~8Rlx+MRnv3Ili5@y
zE(8A5H-lFuO5SQ$PTWqUqx5UbK0~s*zvUp7atcy+=VprKV{*GoWzK@r8iW_`ol;Vg
z%arecbZs{aGlke;o44hdx_8P|GOALCP`+KC%aQ@>9@Vkt>ys~#3;%42BY{xCNn7Iv
ziQ7<Jf~nTm9E9QS@r;Hj+QxjMnDNFhYKWuBA#k2d?cOgEP$by!GT4ohX(K;-92i`C
zp(Ps^>p3hwzH1fh3I=OXat5D}#y?0et`jrW7jy!8R$pwToZpJ0Hn7R>x?O?*X5wq9
z%dUp59Z(tqu`lTzxCfM|2BbH{fGQz%N<_{EJ!*IGnk)1mwWu-!p7_%dv16z}z&)*!
z1JPQ9cWW9$zUn3JeUaV?>JxuQphkyKB%SCu;@s@(@Q@0W$s-B?`kyBsL!wz5m2%fX
zeeTqWq#Bk&y%kinu5Z;95vtoVZZbFd$<x!(HcgeOyyK7Cn-ts5i7F5H3nbAT`rhf=
zIlDi%7Y=-H*NZ<_WD@;7_`&@9%C=Jb+HyU;cB70Gcuvse8aZ`P{U+e@i7LJA><<l4
zyCW4MQ(0;<$^OZP@9v~imfd}w)iNMa0!F7z)`>Y{)ITj9jX}Xr1>Eo6RQougYIg!v
zWNU3wR}!F&WBgLDQ^kcE%P+f6`LG)JLAYVgf^L~X_G2?1m1S62ec7G4M!5CE-0nO^
z#;4SN>Z)>-uM4`^jk~MHqf=Pv51jS*>%XuRt__4J%Or=&CC9P6*{rqo&CRs*{w|lw
z*s^d_{WE(jQ<-zdJWf?=LS)zic#%*zz4huv;qjKB;^?XDx#^q?h(1BjvN8U}(2p|(
zEv$$Icls|oUsnt&3OJ#^MuE7o>>K!YUuS@_oj!sE3`=v%!!$h~CscHe(a}d8Z}r`!
z7CsD*(61nysLy)&U5ek8)LUtZ-`%Rw!CHbm9zxX%k}E4K@jm>k*^P)E@nN{ZF8k=f
zBA0e0RmP|ncz@BM%97OMDtD6$$~SMvyFEdP4XQ8|WP>}wxYZ~8Ag@Y8(;N~Dct~`e
z9p?YD)=W=^5Z_3yfuP=^D}r8%(J1OFa*`s@Kc;}`R+JZvAiRQ*Vg7QKQX@QK%l%E<
z?oma9mF3{nBeC<rKJmsz?M5ahxLEM;OsPEc1V{rXVw*d0!Y&loziLZg*+kT_9-{RD
z?&B0;eK%d?Lp>3lSd=w|HmRc6*xDKg0&i)e)KTeFnah&uZf$RZQulduv~mlRd8Lj*
z$DVc4)7d$;_r}iJsNvxb1A?)>2}-r7pjL{dpf9HaydPn%ZkTUX>>%UPNx+^+Bm=Fn
z8%AfkC#N~JQOow+okbIS(5*uP%nK9G$*6@{OTCU)Z7+@$@;B6u6Zq!bS=-ZntA*h(
z9IE2|R!UTW${q^8TW~5T!)u^tl`yoxVhaut15sUTS!>yAojX&uKwcKxg2)Z~6EqXm
z%=JnOJ?()<otQou17KIgwYUgO-&49l=uWb1hOPT$YRsXI{Eny7ChEIQ<EW_HqsBBT
z;5k#qA)>+l1?nCf$7Va?cb^*XwfJE&BDa{b)(Z<Ssm>SJ?CVOWPH|rqDmVcTj!N*{
zL=Xsi4Zk-sVL*-EGo%}zw(FoCO~KLD9m>~VdI{9c4E7CDOCPgT(-sysx^ApQN6*fr
z>?-Nyl8i|=WeKjE?J_xg?IrWf)9$-FrL1Y44W`<<kuo|XcduPNVoR<vRs*&CdhOfJ
z&Jw_J3fkD&F$>*;uJ2(%pp%g^_XPtTr=I@+^0aKF<p9XBBBixBcFf@EpuL6Oopbcg
zo!C2fb66#I^BXkT>09V&_d){q(IzwI3KxGYcP>tU_i<{~U;ksC=l#2pg#F+5`0u~a
V>cxt`kmog7Ub4Mdd%@$u{{j=u(k1`^

diff --git a/client/ui/assets/netbird-disconnected.ico b/client/ui/assets/netbird-disconnected.ico
deleted file mode 100644
index 812e9d283d096d823824fd66e6533359fb375b4a..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 5056
zcmbtYi$7EU|39<EjI@<9x@|7yR<2RYb-By^t}>ci7|A8M&h;ZCN^PPP$}QB~%Kd&X
z5v|!rNJVU@G}rMvKEFTVd-m94XRmY4>+*cP-p|+TeE<Lges&KCfB{Mm0Kg&e{I;dJ
z;a-Fo0zBPoY@}zsdv*5<=LLT*-zfIn{TFb<+!ivFfAbLl9B?<*)3ps7XHO8UnT{O3
z<)9EL;>E+o=GrUFHx3^L5htA5B=438qg#UQWPc{T#JKG-w#US$_RqN6XAC0Rg`8Vf
zE84eI+8+kT?CY(*w6|8$v_58qt6?@yt`rRp4o+W0p+KAe`!VQB69F>lMHYEDU8EmB
z7N@tePkbIZ{1AEdzEZ7BL{up;Ey@4@PDO64l+0{y6W^~71xI8AOk)V?GiS9KG!e-4
z<Ma^q+jBCrTLit8Fy-vvv$HoVRg!|}_cn&|v{#XUj%dY#|Bd%IZ_iEYtvGVR1%I4N
z57N;~008Uhr<AW#>wjjCp;E}0K3Bys`GmDP<W&*+?+3p_Lqnq<Z9_!?TUo8;Nd)%T
zfobPvpS0IsSS={v>Ha?G@xr-)fPk3C+<kDsQufH&JoV7FCl=6=xlCtYe?KXJebVnD
zfaJ$6B4VoK83NEhg1qsX1GHw;unof(A};<rUwY&Eq(Cq5RI#V0=aMe+&95urGzv5Z
zH}^NZW7DN|$J8>p&GpsEgf&dW(Pj0RYnxJ7DEWCOedBaWq|c2bvwe+p6o9FF)4nvq
zKCNMCvD4f>DK8AcQqF$g!Jl1wAen&vLg$#`0rKDmcRS+plHAfvew8*DY=&-Q;H)N!
z4SG0urfykX;0$2Y6*6H4x(9;Ks%gaw*zCx-1Ft@;OnIe|`oP<I(3_1-O<Z|4y?_@8
znx3Mkl9&O?QBABpv(xp9o>h#0CB;+ny;V~3-~IH}MFv~PgfWlpAHKd3FhEOs=&?6y
z^0-#;tnI|q6urN_mT+&yl>D>p2u$}RJWgmfQsv3~#@#hj+(((pdoP;8@yS@CpHW>~
z`vH8ezSTEIE!*kgnIm_5p4^7a%+2*m32y~YpG*Iv_ZFA}Z5IsBrS;65dcS@G#l5JP
z<NkTg6Wf`QtkF$1)H{aa9w)LS;c*9!#&>`jmP-gb8F4hjIl#-SDDQ6$f*-gYzvU%9
zE{yj>S@mQ=BSiyw1Mzw%3w2#vqqyV76CBh2BS8AyyLFyID?$^si8xve6t^Fr+bP<y
zb9R<MXbcM!k1+ey#BCXH;VbMxN7RBSoujX6t+cPaJeD*~6yG@a<?CCi&5lQYk7VH3
zZ7-)!^lxh~XkC2T{!3$~F`y%q)tn`sR@Qxo1mxYoR|D!nKbI$Em0`l%m6@~eEt~{m
zsvIw~7*cvsN5k}19w>!628V)ipPv2q0T+VR#CGb|F{A1Rhg^*|SA@Oz@<fR{?;^PB
zi7k**-+eZvl=7L{0GQclS1XIMT{GlVbml9cUnaE_Hi+qH46y~`$Q+Gs$H`iDhpHE!
zEw?7CflUdn6PfBt6**Z;(!L$w4T%a#KrWrQ-?wCFXh^tBpLo356*#|7Y&y5-3#+Pk
za-0mx8}t&cW;it}3hsOK?gyRm5=hiOb!v=by212sU8~Q3r4C4eYjZJ7V>>iB_**o%
zpfBiko{N!-aLX`zq(pGi2$T3QJUpz0YNBvspB-^<a3JKo`$2sFmi1i6M8BGQ@5dKJ
zWLVf*x>8bAf?K;{;q-MQJlxsI>6v|*J{;CB_i|a?cTp$9zi!hUZspw%`F+PgVm}^<
z8h-a~@8c&=M!LH8B)UmQTw8u+o!()a6Pv+Ll@Ppu)6|Sw{tK!ow>RY|yYUiP?hz52
zc^+FVTZy)>7pDqX1epBN)>h==LcwsdxrIgFY81mXkxF7F)^P7x55ZWW4V(Dn3yc=Q
z-l0{l?X_rhQt+)?#<R1tZ{#x+{!lCBmG|yphc-0mtvD?%L4PObCs$NfszeQiX}tLO
z(MIf!0gXa%a2W;@GH4Uqp~&LLniq0SFqCSqoz0610vUU4Pmg_!dYI`ei8jz*@UWUz
z5D?~<voT>R$k2lz;Z0u@Q}Vrn8?=uKJGdk6`aM;CP(2x>jV`1w+;T%}VPTNxcY28R
zZ{NzSc$o)C;)|ZDa>Z*mUc4T?AB%*I-V6z`>mNFZ|M3006e2-Nx&cJ-r(rx6UhJFQ
zPH+ZePU^s(=0}JpNH;C3mt}ZCIpLajgSG{$V56ucw;#0x7hUAklh~_acMN7OJP2_7
z+@Y&vsduVixOfD*KO`1^#P$~Fr0n#tYkb?(Yb1}2r=%>6P2qD+d}}+xF_qo=HTBEV
zL{K=h_~n1*;9YHLXrgs`b~_Y6y+HJR+tdQxXAC?Y_SU0NC^X8m)aWsb*hjKb0CIvC
zGPu9k#V)Z$HFB~jHC2EyVCnJz1agE2K=G#7me02n#MIT*;XFZbtgOP;JK08f*l|H&
z83H=Vr0%P|y?yb7|A0%9PoeO(=YvO(i`WCwc`05yPQ9>2DK52G5=zBsXs}ee>uK86
z*WBy4G@aDt^pz@YD}B*c+dAe%m+iB!KZ8B>Q<opkoV9STj4l2O=me|V&6TnC`6DJ*
zW#BxFfnIl2u`zCXn{`j5ht(|rBaY};7JY#@c;R_1;SgBn<9jONvb2843CKV&$E1J5
zbY0JtifsQt;YWWv!SKnp7NiQ3=lZRMYr~_2<YI|Uk!Ob=BVzu1t~EP+_;4q6RJ*HG
z+G;IFN(xGCmyg}LC{wsc7ZbIFPs}pr78UXW;;>kaIE-}UAmw87lJBJfqf{l%+fs1F
z8SMk~;5<%0M>(dZv*89}wWOBJrld`26p*ZFCtWVv9oeUN3L$2a4brtTgbcSyJXCUH
zkRqsyq`paXECHp~5b~TF-0`8^cn31XbDp8SE_(9*ZI*|y@w|VFewF~BN0kje{&8r#
z>a>D_F&rBqs=sV2zxB>q89=&~THcc(wWwa?4^2~&0y!>g@9yoY-#44BK(RqV=3*UU
zwXUvCd%&er+=LGhAKZ@_S&iQD_!$|W(Vy7j)XxXxhx5fQEcng{#O%wyc*1#6EK3sv
z@)QqXr5Ue-PI5j5=-1cRkCbEP^sQEOIpQNDC&04V6FV*_ti)Y>qnd!Mzru5LCA{ew
zOTX~>_d_pnX@^ui>If(_vHI;><J=&IsgvH@iRe`C2at<h1zqOul?4}hzn~~NNPMbV
zu`IEf_5q9qm91gf+1fDuFf=HrVB>oRZFO^~fCNy@4~j!?B7H*NT@tmc632F0Qb5pZ
z{{xL$dk3A^@{iex19kyI8^tq>Jfn}|uJ>dLy8ffK;!DgjYlN1YQ3Kf1%T>rSHoPfm
z1`<cM1f(4WJ}CdqQx*r1Tv1r?V<}{k8+&ne$n?SF0V1nxzJYs4X*Wn-$Q8bn+`PO2
zmpC<$a31t#`7u95*Ogj9$VNjY_z?7pm8AZn&?vYV-7f=}`n^0jR@VuzhZ`kod$NtT
zAIt1QDFFpCwV?XfIYWkU>>p1V5;NM^pc*oJ4u=~*nZHV-2Oj@-spUvdpf{0NFkd%T
z4{Gz{RjjG1`lCBW>css!SwZV_7cW2;f19*+=?1fS#*06#hv+fxge!Y<=mWipO|eY{
zbP8RNA8!5oz@&R7&|}HNWIDi}!~+apL9R(h9F^WW2u=wmDY1As5gev`4g$%^^%IND
zgC+PEX^r;Adz{F0Z&j_{?Oc!ID_|strNyP-u62Z8veca7cNs%3eMG@0@}<Ws!=J(z
zR}~EVR$<aR!Fe8|YQROl6kAc4<(iy@69tkRRFG%m!~}F~*|ylpRk?CUx|wkcb30W;
z!Q4HjR(T8uAnnxc;E63a65SlbNL`(^1Zy@Fuv&-eTdtKEWIB<}Emob9enmiN(!^><
zuoFZ_rvsL;JgdCukd_^dUcfU;$qw$dGcWu`y>)Fg1_8l5>n*{1Z`uVgO4`z1AGi<V
z3kO!EeM&!cbtSUyTAv^I1o304fw(3B%Vdut#Cmh(ykJDZsaqE^P+<A#090c3u7*Ao
zO!o_ptn{DE5hKKttqc*~{?>ng4;(AB5Xw1;Kde~O(a~`;?R8yhvk<ZQ+oda4p4ZgW
z$WL15)Dre9le0#IgxjbJ>o-PSd?*_hSit?2G#sW&uFd07<^^WDBRyh)jN!&zV<o!q
z%z9p%9<VrJ<RgnYvI$BAALILbs5r1@VB}mdJ*QDoC)%kB2cN@%?)3G39*8Ty8=8}V
zJc-bv)pM+2WM>xV5{%R;b@cf00Pe4z<C92Wv>jbwc=wp*%8lJR>jfSPCrvZ|{tfw>
zJK%yCq&mRe(`0rAdrL8Zd|SxG74h)?b0=YtzZytjgUMtPJSxo&!U5B%+?L1dlW?At
zw+g^0SYHW1#z%1UGrirXn;Ya)$LvI#$jK(>&nfIw41nz!3Ea4TrA{K@bJNlpX6-d1
z5vr>Lxh>e5nm-rMI#a?6!TfXf?~=w!J&9S}+<ZDByM_V>_?lb-q$A8q+pftLgk7Io
zy4L(@HLAX`F{|mD^XBwF$CE#BB9O}DH2HxIi}6a5TF%PE&B;EO8|8^^M(HyenN31=
zAild(9MMm1U{y88%%{egMsc~+yhQgObT|YDL<eiRH18T`IM4p;@4=y?n)~CGhk}j>
z*hb5d`S({hiy#2>LMf3Mx-(Yh@PrjoEGVjj2xKlz(6srobwbd@FRPO=cdK@I;DF3G
zGw#wypBiru4}FfI^0C=QP6YR(&f)8^Gcz;gih?Z%xj_o2Pb+G@l)Pim5y9O!GafC2
zfjVLYJ4Q(@^5bkZhMI|@hqtPj5!VI}P$j;w=`stm0e*fMxbPtD<+ei0)(E9Z=n4kV
zz%<WPzVhAKRO|*R0eT)T(0;B+wSYNo0SETErm?MVd+lVewyAxM`&`TY^)5#p^n4Bm
znL1Xn5Gp?~UOCTIG<CfNh7k|Sc|o~H(e}Q^lX0#4#qRKOHfG6cu5k<X4Y@%MpEmz-
zGXlpfs&X!5JbE1qHOdI&STt(CKzMYbBThu@tp`0-LJP{uY@LcL!T&rXc4xcHp%SF<
z3l4DL^;+~!6k~x(Bb{H6sPO$K$UHZwn){FpATO!@Fy$2#&K{z@jHf6N!fEtpD&MGC
zB(U?*>Ga@`5UB`J6SuTm0bd$*rvtz$O*Zlz)4nq{X6Gki?s)0ag?R#boR19Z@1fCO
z!#(-8`T}zg{JTU*8|MQUAe=~;f52m*IDpg=HySQCP9rwEgL#%rcnWqhhG}MdVD9z;
zy;760pr}t$0q7y;t%TVFE{4Z^eSK?kWjoP-j%kJ``0ntGsX>!%cFY(Hy=4>r2T)@^
zrO58cgOv|SI%CY}Yy8+b7Aq|dlhKql68OHUsY$b%i?AOs1>UcVFnp!kgP$55eSs*i
zs1X0Fpv&gbVGx^3?f)skrzxea%Nm#SkQeH6a5dZ!<y)neTiMq+3cE5A(}cy5i!Xud
zEB+|ET*D9OYfcz?yx0Q)pCOQV$hS*&pn3N{(dlN{Qe-89l*-pi_slleWm~vaKUB;1
zAPn;O@#9P+o@0HZjaun5Dh@^B8!1gmr9ZXo;GhF;k$_@3o03>zlL#8X8Ss&1pDY&O
zCSD){-(OSCe#&-06+p=;yNIdfjQdH{$}fO0&d=S7rN+suZi-w}6&v<ez1Nh+=Qil@
zH|-s8cD6=t>s0=RPNrwo?a`L22A%*d57c;21=15}9?ktrkLh<YoIqzoMw^!FjLOFH
z!8|es)&$bl?{&P1D#WF)-*Y38?&M2bUwvv+Fx*O2Fiz_SzHV}FdQ@HzVTa}%=>eG#
zynCP+AlDK?7Zw(*`BGd5DVMv2A;X*ji%;H41GGji7hJ%S$|s<&<jd@HqEb511)&XB
z*44h+mnDu8lqGiIZb*B5im~v)X{-vS_``Is0Su_-rdZh_L7O4o#{u4W2qI=rsW@EE
z3S`@q4>(}d4XnxkDDC;+e%G{H+S_Y0e2hGl|Fxq)#s;ORGgch^=Q)zZB=5dqa6?Dm
zZxZ?lP8_)N=jFb6fxBuhhZ*3#DWk^}#0Xxf=E_c;HFtyRpPhX(Nl<d;CFAa{-+Pw)
z|0Q9a5efmors3#WiX4xgAMsbm5C=aOZ5I2B0krq~U&$}H1_TV<Z;D<!U!Fn+73_85
z-GyPix*i5@IFsZHy3WoTaSy&Q;{^+2{_UGL)bo}wV)JMbD5z=)2RWwv<x7n<Tz6!N
zMXLCetK#Pls=}EXCMhL98Qgjjw$FD*{?uI;#57OF5IDFgx4vD+_R+V)Ewup9&;~fN
zy?z~77oQQd{p<Sx1>}{st0p2~4nCUx*N7L{Z1yuY-~ayB3e<qxh>=i+|Lo;vZtUta
M);HIyz`Mr%AJn`~GXMYp

diff --git a/client/ui/assets/netbird-disconnected.png b/client/ui/assets/netbird-disconnected.png
deleted file mode 100644
index 79d4775eab038831d38abcc2845f671adc7a1b4c..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 7537
zcmdsci9b~T_y23gsIe6yYs|=&!VoEmL6+>KvcwRw@9R6ujJ1e}A|<=X63Uu2(nhu{
zF@)@dDU7kq%y0C5e?IT`@BR3G|AFs)-1~T)d(L^D<=%78oO>tM$UuvQk(Utwz;a3Z
zq6q*H8VLdL1GMG3Pti@<0&`T=R|TLlk!jDCo_3C~(>Bou;Fc%=xF`U2Xe`_U0RAWd
zmTUk}d;|cOSH^2&C7K}0!R*paeSIK7qv3!a!Vc(Y6lC8Egcs~v+xMpf;rlOb0uld9
z2MWM#X8`+4$AY%*Z`!nDAM@u*mks&bVm9<Y+7OUU_cy%{d(a!GLt7ZUw9S11U^=pY
zK)~Y+ZUCU4oK4OA%=GmX?L6J3Z0$X7I7kJ#d+nouQjj8zba(KxMFhFKdH5;@T@d=M
zp-7|m+0sIY-zt8t7lh38jS%XdJ`RX8QYa~ukTN3zfl%_Xzo}?)QS&c2?d*b(lb@fL
zqO^2iV4zgsX(>-1M`@XJ=gvu^WTj<gC21OxzJGZ5*#=2^_#Xe$$balybnvzFarW|a
z_VhsP+qJ#n>F;+zNNC^Df44v5^mD%Xw<izZztW;5D7`O{mXSh9|4%T7Am{%DwlDb;
z_B*dX-6`!GQ#3bm@bz@_-w#V!L00LvhyRcHcYJ>W{?@<Z;q0gUAIQJh|3;bpE&toi
zKbijq82UIn&@SZfxMcnc>z}-T=<jEzXyhE^;AVEw+1<gzcRv?d`7=t=|D)vJNOey)
zPoK+PwssE6G)KQ7|6u)F`?nwS|JBbwB!3~5r1$UkKkojYrS+Rjt1V?lCF%dxsWRit
zHDm+;JmHrvs+tBtR-R&f#^2Vw3)H)ll4Qe0XvL54y!pxV#$VHG@_sIq$aLj7@YYNU
zf(aid1eiz(cy_}HJgQ2O3(c3KKdK;*UM)TMYpNYCSxWlrj+Yr;X{e!8S&X-=T3c9@
zRLiA1u|e2a{}1gS*v_U|4j02=8k6q@u^E)@`7AyxmAu74Pdym6H&5KD_njZAd{Gbs
zxG$uFB1pbEg>}+~rZAx}5xmxf%{Aqp;p3edADySMS^}Cak1ATi##q1N@zcllPBW9J
zZ>V!m6g;1qWnq{jvCS_YUWMJng#6SHg7n5cHSkfzMG8cQF#SR0Yti4UszWACuC{cR
zihwb2^#u!qQ?CNdL19E{jnZXu>w#6pr!r)?R-%CW_j8m9lKY~0Gg9vS$K>+noh6IZ
zhjO_1C`vFg>Cj#SH|a@ZcIIsG8|4;wkY|rVg%BjEFvs5!7DqQR68*sYSolZ+pTePa
z24V0^uFB&n?m)ADe%a|RX6!cepR5EBAMA%GgDce2uIUnaL$KaMzU>(0l!tpULmI6I
zAY+@J<)x)cs@A-FXK(>M$G4ZuTUOH?j<aOP#}TWAyu7?B!k^a%*WtZVtxJ^rl8-<e
z@Ob=thjS$lKNUG;$w0ns$`EwdWZ$JP!k)m6j)ir^7eF{-o$z<iJEc7hlxKahI%7-_
zZpw>cD{W}@y?gft*|jD2g0<z!^ot_Z+0Le~VFJB*Aj=C2W+LIHvs4C#XAfijY*5hN
z5BEB0=Af4V&0O$_@DVr7t<21=v}9hnH<515SgRBEu+qFdJ0@5^S72CccUd&uC?Nq|
zHYJTQ8`-}c)|YURg3Y1Ddwev5tz6IseI_B6>=Vz~3Of&|gzWO}Wp2?`_1Sf8Q5&6Q
z9O#^MT=Ey?NbN49_4%F&nG@bgiQvZrE@|uQjv6u@-cMUf`ya)g`8<?HrW=y!Cj`Dk
zcU+h|TseQQ<fegx^ZQ?h)tEqvjYaTte7RZ58$rm+H(lYKg4PK0+tKO9R@D1P10H)g
z?#@Rxnek}h8LTA44Mk7Ykxxb$Kq1LSHjQCq#aLq-r4Uk*GDTAB`ol6SDD%31Q|zn?
z)_fj{quXnXX1dIr%yP)%dWNypw%`@gO-6=+6XDs~q{IoTEg7!1B7SiSs8Fp276q1a
zM3|xYI~%7@OBQoNjJRjS==h&H(nY7=VD+j<yp`jXjRG)ABNy}IVZrNx?mvhphq}xF
zA)$Q3qdQ!=W6eIB>+}%O2g=H<#mdZJLg5<in@YokU4qCgKyAC<R}@AbRpU|+!YOZ@
zJ4H=QFwi-2jS=_b1%<eR*Uu-5tu55C9&9+O1(Vf>P^r=GQx)9JANw5UN1jDe#eO{M
z4s_`Vgq|*<;N6+dae-~=@@zT}mx@{qm$gPc1mZn)BM13m!LfX0=MzIri|ezPmXML|
zf_IscKQiVHJB{l?8Fc*NQ;nXM=Ud0IOlmP#v6A7ett>aTXtmosTu?WkPxODIFjoIO
zfWX~0sp6hRec4}f*j_kd$8(mJDPe{UcMSAo81|+Q-DRj+Q3=mLITi3|Z*H|D=<0m^
zv~sP>(SuHVy54&zEed_##0;Nt7u7CYKo;$ZSsce)rM8ZqrTS+{X=Jr9p}9B|Kl^{v
ze{Emndr+)3J!Oj^KVDe(iW&uJzH&`SY3s{Uxd;O4^y;1T?x~WY>vSL3bHBLRTD{9=
z*5;=&jMX;;VZWowIgQSKAaGr$3-sCLbUi-|UeYc4wXL{WQjJ+BXEHD7P2Oso4}BeC
ze)2~HpT>%&X{@Mivz}K*A9$J4XB<$`y&!ENBuw}<+o|pZd%_B38<OglnCg4+3SX}M
z%mkpOC=|*C?gxHp;wDTXe2H`^)6>%oiUaok{{BAOzZ_iX!iObxzSm~1VYKGDj-!=j
z#CVLBX11I!gh0!!n-qEWN<Ru>_hhzb(=ehvSt?mZD5syPxD;=*5{SKcK7+k*8+9Hr
zk1Mw*Vj&cE2ts??5>X?|7%3f7ngW-eeE7kU8cMqe;m63U(YDLyvvFwC{82x}uY!=e
z`LcR)T!Du$2x5<FJtT0Dc$dfNJU^6wKz|_Q*&jc@cSN=2UfS`3!^};lQ5ex`w^QKJ
ziKy126ail=T{9SKo7*qEXA2J}uSfe4cbr9dsw&*8xh2JsT6#tkiW8f<SHYq`Dc*^u
z+Oj&`+LA8OCz>JLv*Yi52~B8T{Zar+h{ts>*&G=8s3l~R@l{;lOAQuw)@zv=D=LzD
zzc=b?VU+=`39<9If-an@RE|kM>b{rd-3gdmF`@s!EmzmVV(itsS81Nq;lg#VuD^F_
zbC(QbpY&A<C7<DP;mFVyHVoG<X8Oasnd)Ynn3pgF#m(Ml^%{^k`l{mr=5GDdn;qs+
z8ysH;qzrrow;sE;V=_I&Ag%GjuwQ4%7Hc<1t`<iafeW21>lu-&S%)G9>uLQhq8o}!
zH-_6tZO@DEc`N&t9oE9p^$)BJ*Hn>6v2)B-(X~O=5s3?9n6cS_&NyJh#%c7{T|IrS
z`@C;fpu-5go@J37*+bb{-I=lTyk$LP`4djO{Yfv3!{OPX<Y_zp_?odW_c)1bwtOxr
z*0lVS&A)(`@n5_K@w6McD>nIwFkB@%plr|Yrn79N*!7&pzRQdYl-|o_OqXx|JRrB%
zx2dq920=@Qr)t7(*0ikmE);9eTm*#g9MB++ukIGC1+UbzrQ0zn{U+Qp-MG|S(9qZ9
zI1z7A5QL=XIPpE8VZ3&#{F3`whD&PMk2yS(L-{Db3MxHdU5=S$C$qIR+s0K`u*xmX
zoxOI~%B}qmBDyjT%IwV=pBn@(nJyjqpk24S^>a0=yi6`!DPenOGVw!`6EOGBVd%11
z*;B+1wH$-0H<0yQkX%z4Lz98n)O;=$M2Re2++@0=%5O39g5BlIQ=UJVn6bm5HoYal
zCi+W}+HGZ1<rvxC{_f{>NJ$QGYU>VHA?;bLBT50YvqhyLo@nD}J&R(YGDDA+IHA<l
zIs1ZM*fnR3u0X}Z>kcOQsxV+Ja0AU2cE?n$HNTqCIaFbfGp?Z`wnlKa7EXdI<>Nhb
z*ed!;*eZg&qmDlLE~(b6fRYsW5^y0ri5crJuliy6<LKxp?A_FB`%3=xHbUC%b9W9T
zaiS|>vg~uzO74CVH)^ASX>P+Zs}jGXrzLhs0+@+0K-N=dvn!9ybvAMkyR%hMrk0wQ
z8GF41wm9cXoYNn9ctKj#wBbo=>mtInm@gL5Zaq#WT1rb}&dD#<<gDS~>SHxpYN-k;
zYpEfWME8&J5tV}{%MuklT7)p3Fu?SzNUdYed~B{Y(frC>o_<t0Yw#@5@`rJz5_E=1
z16lF%<@X<UceY)lYXp|ZRVEIVPSd8TUkz#)!43Bo2SQ^%c-baVY^3>pLxtEtb=DUX
zvjBn&LS_rZC)?K#OVfk!6UDtZYGXTAYRyW1m6=5yJ4LnTrTiLb;smGia~YdlC5k&_
z>dC*3Rk%EbN)w*9F|Tjd6^Awd*s=hu$u}7Ea?k7yvP30`!C83bO71!Te6$6{(F?p{
z%^p<Iti@CwPj&yot-T^vMNecZXTkoFsR{>2gW}b2bSiHlNozJ%!_VnqH(B)vxt8Ua
zt;M#p+>lnCXKFSry3y*23d9j_{n3a>m5Tbq4UYx_#_~Os^BI0|mdZpOogT-2DBmUZ
zo_i%r(0{YJxyf)d?q)*>d25xHcy<IW@lWU@HcpjAb_^HK9+z@ep2oUBkaen|4C@Zi
zv)YhW#&`Ti!fhj7qM<M4B*(Ke`P7@9u3;GE#(7G?r0>yauylXm3hJ$0_=R<1%-3sW
zaNbYe;vOwG?C4JdGd4!Z7-ud!RCbTEVPWyictobbp<9!eAC+Ie(K#F;2R&NCsp}+D
zT=)L{`<(iwxX)95_;zV#dPh>Hf>AFo`YM|f^b+%9utt#!a(*s4nImaa`?`uE7^?<Y
zeMMm;r8yPiE0LLTtlK)d$Hb}TJ(q!(p}-EMW<oZ%k5)Ag)Id%ew};YMWb5Hz7iUeJ
zriq}O$VT<bO%bBP6;mkgk$Swu#acmmAo&^YMF^fe!O*{QO_={Fu%SNzQw!pH;t+lE
z%kA#2Tv#>pDbRRm-Jw6pm=QqXBH4FVDWc<>a+1|Ji27~%W#V}el7}Rtf=#8#_R8(U
zf~z*WxA&AWL(hq>&Dh<c)|n?M<&4!mIfLn{4dgiadspc`NHFS8Dz6^3e(j?6Xd=^l
z<7XCcD|m;N-ZjA!W32&ed}1Zcx+P4q7K68ba=zTrvh|c-E#}bp$0czXa9w)B3O_e?
zrSb?%y}s(`F#A#nRZ%&Q4MZg|h9C4t@0=BF&${p_L?QdI9YR1pm)4#Z6LmnvcUI_m
zr!KNml=84MY1!O;<<+go>m>&z5%peEZDdu6c~WlP5irAmtdM`e+KUe(2FuAyyw^pk
zD(jz%Hvz2dqLW5P&dSmci8Rga2IgD~l^X4vwFBc}ua-(~huT*`ah0&0dlJI!Sq*Q#
zFUjCAr2*HLrhEm;0AfcEZX-Wc(;4kjTw<{Fax7<N<<3g{mrv@pz0Wf8jsln_5)AGs
zUOnQ`U|~=4)gW3mhctfgnPbnxmw#~Ffa1_3-b!60q8(F-uOF#-PT%^1l{Ro2Qm=>E
z{aBV#yZiIS+d#7W#M5`*t~zYil049+>*P)|huwULy)Yrm8Ja|SUqAlzs{htnRL_F_
z-L(T3<tJJW<-*Y6hoW(1MQV-9yX?)yMxUJ&8Z=on`D61QjfZu_qycgEH#IadZTOJ>
zXw`6?eZl1*j*vLIa?M^EVkDgG5tu+LBFu1uu|{82Lk#-;7Bm;WekF3g3(0^xt!)sP
zUpz@%%$#%e*_C&6I4u$_<#?dRESL6xnFKQ6M5;`XUXGVuMz_oENlq?=<|P~jIhBG-
z!=bN1DqjWiLP+wS0Q1GbG?Bt7L)+$5W1rx?{sP^U!^))A8KFGyUCtbBI&t>rUp;t@
zq5`p!?d(pr!8{50@~^V&Kto6#-x&qYXO4x*gJ4B_agfWj?hs)PZH+qG|4c1gt~hBd
zECzK<q>!y*v8z+2YpcBd6vRlY@H=-@YkH9y<N6hdYxcN)6@bTyw}+%7(f}&wp)M1$
zBKq_Dv5tm>u`uDOo_;jA$T!!S&nXP_oH+Y$OnOdB`MjN{Jd<!lGPx@X^`b%icUrp%
znmuq`)9K^S$jHcqEG%U^7S_scbU`qtGvL?H_k!1~{HtjFoYk2Ybqt=H6sWRCXlGE<
z;>mnIBgHVl14Z&%d|vf4|CaMB6)d0ye$v%=?Ktx9u|toc6&0)1PCgm0^PcYQ6N&7+
z3e8qev7PL3JfH*j1B(j-vJg~2ErzWchQ6=ezCwHX^(Gjue>?$uK^riq)(cao7!XVA
zYDj_^qJ08-|KmkyHpu@ds(w4?wEM$?j@=ottkP6g@w_i<%@GHZ(1@|MS{MbR56#x#
zD=4N`EtxVxMqyRVy4eU2z_#+yqNvu^_2$}A{}mSVXW{BuXU-+OqQf)>^$9=kKPyD|
zD3*nCtS3v5bm)q}<?3JuhgodNJ<ctfhPTh`r-$D?+_$uG7J&BCAKYkfl$H!oPExPQ
z1h*DjuTN2Gle9@&v{1ZEgEr}Ea?N$ZvS2t!StGt@vg!x~fwWQUGO)PiK#OE$=BT68
z{B&t5*`jadU?;W8y*nKkwI<cTKKDe*1OzM(mA&2T`k8@b$yT*2^k@lYNgfi-Vf_G8
zbyqv~Lk}dneAE&Q&2ONxC$j@x@YBn3u;r91BW`eT@TK~w<9#sdwz0OO@aBZVB)d)s
z{&4Dym~JwU;LQz0^x@O*h8CijxTJ(9!gg1xHDk3hwRu~U58>WSd|jy(E{Sf>knLhn
zxA<`c2a=X1SW94N7V+0)uON$*{4Y7x)$$DC2C$yY_&<1Gc{Xp~3?SYiK441%;&~CF
zi}5Yn_%P0oiYs%wP!6cyHRnYG9RGHk;a0}Glt>s_!_v;{+q)d+4qMlT6EF_l)<XtL
zCKu{_=M8R%)q2keL5%vl8+X+oj-5C+W6!mAogF&f`^-b7X~pr5F*F;-eIWnxV9QLh
zSR#ZS>R|tPC2z_zeuC(#S*SQzzob5`q}DD7YyD<aJ>Pk<C-cJP2ey$1lJGs?D)PA;
z4w{5qrECikylKPAuZyYW>SSuj9})%P#}SaEyohZ|6F0>t?UdE*9=LVT2{B+|2m-O)
zTPnqd1$kFs!oWmUZtqR>z>}%+V%3*q4rokPUAMup&nnd-do#r4-tX+-M5F0uR)CE&
z*_58+xfY}0=he?o6jF9f6)m*TilPhoDPg?P+r^QKOWZBzNxx=wuZ<i`mmUuzY-5;S
z5(GFccmXe6AoWctMSrKQKsRlJ*BinikeI*2^{8ruzX@dH4^N)Kw=S>qcd(x=NZ`h5
zJzm3p%Ih3mphxfgn25IZoY#Tt87Lhm{VE>|OT9H-G@-S^JJ)H#$L*kw1fCsH0pT)I
zb-O);7g*VMuN#Wio#X*8g;2olITj|Gpu086oyXWmxNR7=JTj60>eQw47A%M><l!{J
zPa?{Z$%p5%DY7cPEyR5Fex4uQ&MMJ$^j!!CX>%AO79{F%OQ&KHMM}ZfdUmcj*3)Zk
z!*SgkDGv7{?cYCdvx}90T`Mxh9&B>+gChKQ^^aBX3wP?l(M2piWM!#1MTxGo<Gp$8
zfO~J5TRiYsCI2Z)#&9z`hWrTqK&)1it0@#ne+~LslXbUd1|4e*7w<~D`_1R^yb}zt
zU{R09&zIc_ajj&4IGx#h-9si>e9GcY&;)ObcGCRw^x%X_M1+QIGrz(OjwXAa<6Wd(
z=0L2NAjvFXCFkB3d2KGFRWwqHaedIRBtea?6+y}o%%EHs*(g%$wUL`>xxLEK1nzuZ
zaqJgUOOVK?y=#_@NxBa}aWO5GO1szmBYSfh`(l31edent7xNDMq7>1i6-kAu>GWyG
zqQQg^v#sqT>Co}QmejZ*_@i&+EaL5c>dB^Cn=Wlx<xJyYG{>IH7fT?Mt161^6E9y(
z2cy}XBuvO@^0~9q#x6i^PZj(yzsac|pzK2X^0PS}I6*$i`yt#^Sce4>N<5s;up=!h
z4>`cQ>1_O{+}7gwYa9X@v(1~k$a4kGcE1rWu2!4X7Q)iUB$`qrN4w>yMMqce2UAuL
zjia+~9k%e|rEtu-)`{NH0UuTzzuhMtK#DQ5RA+ytam7h>9&(!Kdh+O&P_s1ZqLU11
zFXider>-lyFHSeG-_fK)JMs>8DqHa>W0fcPXQsjGyY2DrVcYlz_?~mKJ4_dmV1cME
z_N}PA_}&oP<mB4vZ1||IZSxXuexaQ)9JevjB4+>7`k6E`$%XgzZgB6z2rl5a8$LZi
zmuk$Ba~KJ>rs+O!ZRIt<B!Nlo#03?jcb6IWTe=fpMH8ZD=8K`ql}FNe8_PMaDuC9S
z9mm|IgC3%bqm@V`(d9`&DBDDhaLoKMetx&c&|PBel(UY9Hdvd>s)Mr_p42~-lN>_(
z)H|$m*kv98ix>nb(kyW~r_<}%<inHKO0P5UKB1L7(pfqMK~Ec`(5UL$s^<pTD%h^v
z@o2HE^*A<YrS*PCj5PyjJMJxxw9Gg6ixjga#F+&IOTCmD#<hB-wDNJhIK{9kTw95?
z2+-RdWB<?=m#)cq<B@d8h=RAJ;_SDW*7`GIEdB<!wy=r=oBrd0Fg<8o?@A#GLm_5l
z3qWRw>v_l1qmHUSxwN^JH=?7<7JmTUE~xm$+F7#7mlaAIe#%+Ib5WQ`xx0NDk$u2#
zOTlH>n%%c%a%stBwwhzEggrswU<3+!qnYa7_)2**<}stJ7#i8ydm{t&0K+kN(y)EP
ze{H`Xph$sx8b!&R`@Nvhk&4=h-h$HFK%wm<zvBs+NikPf*L9qb)2o9Dp5OG|T{>QB
z5$q0ofR`@qj#?Z^aqP(y*>7kiGZJO+JGlQ-dj=~Bdt4U2cyIH?+x<ThFKHNDe4%C&
G@&5orZWyls

diff --git a/client/ui/assets/netbird-menu-16.png b/client/ui/assets/netbird-menu-16.png
new file mode 100644
index 0000000000000000000000000000000000000000..d5dcab446feb5da6237b6c1705a0306aeda93bf0
GIT binary patch
literal 526
zcmV+p0`dKcP)<h;3K|Lk000e1NJLTq000mG000mO1^@s6AM^iV00009a7bBm000MJ
z000MJ0hPnJwg3PC8FWQhbW?9;ba!ELWdL_~cP?peYja~^aAhuUa%Y?FJQ@H10h>ug
zK~y-6rISBz6G0Hgf3vr7;<E#|fWoHWj}Q$=Boze>qM)J#i8=)pqN5-O$kA0)AUX;p
zOQAvH3-AGGh+-&_1sx;`2!aBqJLh(X>JHx-B!s8ic{6X`Tg`~7GE115x&iwyMM;0T
zYXW~+;mBm(yT(9N75Zn|SrGJ`+P1awGa0+>L-&Wf07-oAhQLFRg&OaxX7uKQB=OR9
zRM%^EJTN4gAF(jLhS9oJugdxG?(ns!DoMN)3#?Xag#C9ta0Yww6EdHdh>AQ7S2tHE
zriRfl0)0H$?!GRfNdwI+`TH*FrGWMj6BUnAS~GfkOJM+@PH-PPzb9rE|M_4cEDrB%
zY)uh>YIyq83aT&sb_epHYWiCngb&RFKORlytDkfAxeKg~Nav=uOVbA41#8?KWq&6C
zT<#y3<2z#7X(cbMG;iJ87}V=41nJuHB}A`?QGyd&NH{KhLuc=Hy%|8tTj*c3Y4Ckh
z(X%C*8}>(Cq?LVHeDd<}p9soTPT4)G=(8&7m^-%9)2uZmeOkeP#?06F3xMsMVLw1#
Qf&c&j07*qoM6N<$f}PFco&W#<

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-menu-24.png b/client/ui/assets/netbird-menu-24.png
new file mode 100644
index 0000000000000000000000000000000000000000..087c1c2aeef6cca5bf3793eee16d9b28acf758ed
GIT binary patch
literal 739
zcmV<90v!E`P)<h;3K|Lk000e1NJLTq000;O000;W1^@s6;CDUv00009a7bBm000XT
z000XT0n*)m`~Uy|8FWQhbW?9;ba!ELWdL_~cP?peYja~^aAhuUa%Y?FJQ@H10&q!0
zK~zYI)s?+Z6j2n#e{VjPodskCqF_vHAXF;Egcu8r|9~BKnrNaimROMJDj_bFF+@8|
zq_jXOEDVjt!omgx5(_{{hy@4@tiaCh&b)VRWck?HT|a_}ubX$zJ?EY~CwWRl*w16_
zEBn6?aQ>=$=#01N`yEPK_TG}%M%Uh+ocbdHf3UM#MBP_#-U1h8N-&mD!@!NAz~(@A
zi*mxFqD_;sC1zn~v>{W7SqlgICNf*NT)OiLs3)qj`?b*KE`ajWU1vpP3}`L`7J(Th
z^3rnL_eO_fR9&s~da0=)03{;i(p`51(v^E4_|l41o5yZl1yv^AA~W7$=LFX$0{EGt
zcxrMGcu<MotkxkL9(p-RFxLuUbO1%H-YxQ?0Dza8>QkuU$R=Z<7aO;~vvGojL$Jq$
z5?&?leH`C;w_^;ExSqTTJS&-gIf(?j*DmV`^lJUit3WApYj5vvpZ#LIj`qvIiy~3M
z!K^ey8N+;Q*x^DR*QBOrD+>VhjA~COFQMcOfL?4ujEWSHd<^kp04sT|B101Wr~2RK
zywJIzzbEF+T5Tkx=wc&*Kq}ckx%TS<0DQ<fwYjW{7b*(iyZJ;%`$)NRS%Iv5@|xJ@
zxZAdbiU;Lj;1x#b8P(;=D)K!TIDNpkbF-jY03>h-=Z+wS-AS^O*=*g@@rpZ)bl_Ws
z{w;C<<%T%zOW<q|sw}~-U%y(3Jkmja;8dHj%_pE{FIfB-!RJ=cHmW)E^}z7!W7Pyo
z9EfcmMUew2uYlXOjH)R}tWlq<MqcXR`9(WBGv8UQ$z4l??!$M}zb~*4=l_57e*gmy
V_(8n@cP9V<002ovPDHLkV1mx^QvCn`

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-menu-about-18.png b/client/ui/assets/netbird-menu-about-18.png
new file mode 100644
index 0000000000000000000000000000000000000000..bb12c6367f9673b0723b6db40818e41a43d24c11
GIT binary patch
literal 838
zcmeAS@N?(olHy`uVBq!ia0vp^LLkh+1|-AI^@Rf|mUKs7M+SzC{oH>NS%G|oWRD<U
z28Jp%28M<f28Lfip@tU>45bDP46hOx7_4S6Fo+k-*%fF5l&DCJ@J#ddWzYh$IT%<N
zr5HdaFaoh1qcoiD#;C!-3>If%U}(=|V1cUf1JWSi0mL9Z5Sn=bBUCj|YylHowa@})
z1RJDnrCM7Okm4-xh%9Dc;1&j9Muu5)Bp4W&EIeHtLo5W(2HR$cIEvKer+wR0-FY%I
zNP<<+MZkKakZ1O4j*Y^XZrofVsArgXQEh5(>)NS|x;bk@ws2+q@nm9jc2H`n-+83s
z-TgB*_ustLlfIlWy?ncQ{=Mq^=J)rRvv0W1^WXi#`EM%|>o-)&@Ko$#U^~?{<H2Wp
z!Caqt+-`iXmz^H8s9GITP*D?_aacLGz~^mCy5Dc!9jka{nU5qYe6YAL${^2K*x0Dg
zxcEZ;iB6rZ2P(gxo!{0jp!zKC|C`;{xenA^cboTpc2-Z&WO0QL?K5wzD>qN%PR?;v
zZYzDV@sB%ai^bOYOsdaf9Ar4|*ZWS{H^b!_>!v9#!bfg79a-+)$-1#q_g7;=tawB~
zrdLtV12ez9Kc6N2+`0B!kb82O>a{OgAF6_4+O`S!99jLjT;fEFU+DZK)0wdux8Brw
z#w=i9TQ+^aK+1IC-0&K;#Zy>IBtpYPj=Xquho8l;^&!{$s<3HKcRxG(ly}0TptQ`;
zGK;BGQ;(j?{S?gExwXG(=F#O}-{>h#|8ToI`<eNfjwRovz9yZ#`q3;`n?L<^;q&*3
zi`pMg`t@R##Tn;kGoK~v1nd)<@Nd!Xf4$q~y8^bpQS1u4eyp}t{1Tgg&XnDX)hTlQ
zyR+X|N!BiRx;`h?#iYE9V`83Qx8pN`zh{iSe$Jg_qnE9jV;k}6%7>}DyEV?8S#n=M
zedo=+r=L$_Y<i&K;PUO}gU*FNxqeQ6yenX)O3j(s>LK~ElRKM_h}%XV|4{ieeyzdp
b>pz)Ul%Kp@p#5<>D1mvp`njxgN@xNArAI%^

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-menu-dot-connected-16.png b/client/ui/assets/netbird-menu-dot-connected-16.png
new file mode 100644
index 0000000000000000000000000000000000000000..3a7fa31a4031def909d9e51280e930d2cfa501d3
GIT binary patch
literal 508
zcmeAS@N?(olHy`uVBq!ia0vp^0wB!61|;P_|4#%`3dtTpz6=aiY77hwEes65fI<x~
z7#K<o7#Ln9FfdrnU|<k0n6oR;1}MRn<n8VPq=De4^X_^e#aZAHS<Jv7rV7H0o<S-f
zfP(BLp1!W^uUJL-L>NBEI2;2C9rtu`46!)<cH%~^rUa4J^Y6C?W_j>dH7!`Uw`D_l
zW=8gu6$?3zZ)>}^lw;Fg#TT4RTiFg9uCEUkk?N>U|6}nyn(ssZ57y()eV>->FAJ{Y
zVQ^UZYFlu=T=?6En*$7X>s<N!)~t(Dcv=q7NnEDKHm!gCx-xrK&G)Hm9tafZt3BLv
zoZ-Nv-We^$96P4Jea@okZgzUf#HTuw-A+x6)zFwd$6?{EzLr<%mYi3^S8UT3iBPMQ
z@}ADpI^VEW%KN&}N$na&jq=C#2e_5?`SZ=bFRBFel4^--L`h0wNvc(HQ7VvPFfuSQ
z(={;FH8Kb>G_x`?vobW*HZZU<Fi5)iQyN7>ZhlH;S|t_@1`rL7Tk?SF88qNFlw{_n
k7MCRE79jK(h8UVy8G($4=#f;Ez5~+a>FVdQ&MBb@0E!Z*0{{R3

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-menu-dot-connected-22.png b/client/ui/assets/netbird-menu-dot-connected-22.png
new file mode 100644
index 0000000000000000000000000000000000000000..78b068748396091b655aa0bdceaa1cd23fd612e7
GIT binary patch
literal 615
zcmeAS@N?(olHy`uVBq!ia0vp^Vj#@H3?x5i&EW)63dtTpz6=aiY77hwEes65fI<x~
z7#K<o7#Ln9FfdrnU|<k0n6oR;1}Kpe;1l8sr2nvp^*!ZH>$sfT_}}{C)aurVgbUVw
zi<bTWza{;8hu6C07N?r^PUPqv&eA)a{gHv8Xicuel`_3kx&Qxvu-=juf1?A)ZOr=*
z6tO!u8L0R_1H<(D9H||bbb(rqWa}Kw2I>V`WR_Cl4W#5tg8YIRm^k^k6+O!)FsqbZ
z`t|Q0i~a6DOvhDra{X1h2$Z@n$9n^)lrhQM-G!lpRn`N@;VkfoEC%{l6@(c*gH%2M
z1=&kHeO=jKv5N9>aUJQH#tsyk;_2cTB5}F&VkBRSf&j~fGG-CR!uyQx>pdjXJB?oc
zs!?$$XRHxA>M7*@!Dp7>DGAlcs>6F8ES=!x8Td)*f7a61$0S}S`vkv!wRY{hJFV9n
zUzb!D+V430uV}}@`j;ovlk*LQ<!#TOcHXORe89`)MAMoLftk%7yAGZUInni2LV3D^
zzmoisV~%ad!&-I3Rx@h9-Tz3~PEKXzsmI(0fbLT*ag8WRNi0dVN-jzTQVd20MrOJO
zrn*K3A%<pFMrKxqrrHJuRt5%17k^5lXvob^$xN%nqQL;7!Es9-P(6bN+=i0O+|=Td
i#M}ae9>Wkr6DvalAcE-e$*gq-Y4UXSb6Mw<&;$URm(~pc

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-menu-dot-connected.png b/client/ui/assets/netbird-menu-dot-connected.png
new file mode 100644
index 0000000000000000000000000000000000000000..fc8ce4d857b68466807de884b622b0d22ec2c6b2
GIT binary patch
literal 452
zcmV;#0XzPQP)<h;3K|Lk000e1NJLTq000;O000;W1^@s6;CDUv00009a7bBm000&x
z000&x0ZCFM@Bjb-c1c7*RCt_XVxTc#Ax6<xQ7eOn2iHxWO*$e2;!EY(JZVtSJj4C^
z*abp*8F5Km4SmJaY5%F<s^^^a-_JkGU{k{?$@@fmd&<o6gM1UTSBrfi+JdzYC%Lr!
zc{U%H!PqRSVv$M=me1RRF2{^6&=cwwGD(MV{l8B?1&A>m1pa;b#dq-Q`>4`S0@rt4
zyL%0%4?r$&e0F;~!{2{I#SI2vX8KbvrRs_76L=~Dg*hl#$Tl1V{{CYDnE^5j!vau*
z5*z0D0LToGSuj34h>Y)6Jf?;P4A4kFtK1>W0P_JTom0zj2B<GUX2LB1Wg==B4g)YV
z!4|-BC^Z4hOq!QPU<*KH3$+b~nF)yl1<f<mwg6@(*aA?g2ufPiG8|+UtfYm<0jN}@
zmIcUW!7Tt4xzz9l$PAEK7#4uab5M~BDzL~lotfzm$PDDV0VSD&O2N3kn~`K$!p!ss
uq!+zTpm~KeFjXcxprq2LIRFFz0RR8#A;-(FjPt_)0000<MNUMnLSTZ}Ik>3+

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-menu-dot-connecting-16.png b/client/ui/assets/netbird-menu-dot-connecting-16.png
new file mode 100644
index 0000000000000000000000000000000000000000..f874706b5a357263a61b176ff373d688e8b164a0
GIT binary patch
literal 520
zcmeAS@N?(olHy`uVBq!ia0vp^0wB!61|;P_|4#%`3dtTpz6=aiY77hwEes65fI<x~
z7#K<o7#Ln9FfdrnU|<k0n6oR;1}MRn<n8VPq=De4^X_^e#aZAHS<Jv7rV7H0o<S-f
zfP(BLp1!W^uUJL-L>NBEI2;2CUG{Ww46!(!oFKv4bA#pXx)mGP_W#Vt{rY{sF*7ss
zVZ*dzd$V1C^uN2b^YiQljCZb^M)d8in|$>2pXE^>{?{9_v9Yy%@99}@_dhjrtB~l-
zZ=s)$$)|kvdBNsW@$*{S^q>AqU;O`{<P*TU=>Pxjk4FDj&iU|ZE$^->9%h|?|H_5_
z{EvSmKk0@&(42$+|Eq$;lrk7rG8}FYKGXC2p0Uxs1gGFH^Co^g%9(bomW5YCK-})r
zPkry-*>1<e|1UUK&&zq_8&ly!WtQZ|#>OofGORp23_C4D_>K!P%m;c;wZt`|BqgyV
z)hf9t6-Y4{85o)A8kp)D8H5;`Ss9sG8JcPv7+4t?BwhR|jiMnpKP5A*5{m`{hz7?k
vc|i3H8gLs*GILXlOA>Pn5PA$l3{9+zK*mG#NGeL-0crAd^>bP0l+XkKnYp#4

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-menu-dot-connecting-22.png b/client/ui/assets/netbird-menu-dot-connecting-22.png
new file mode 100644
index 0000000000000000000000000000000000000000..d8e5970f5605bfbd8a1080f7fbdfc78bce8ef0e6
GIT binary patch
literal 637
zcmeAS@N?(olHy`uVBq!ia0vp^Vj#@H3?x5i&EW)63dtTpz6=aiY77hwEes65fI<x~
z7#K<o7#Ln9FfdrnU|<k0n6oR;1}ISx;1l8sq#0SN-Jcp>=ur6IsHAsMsIXOi_67NS
zizNI0=P+DX*tbr+?3CcK6a1eK^M5$Zf0x1c-Wt`0D<Ydu@x}db`?y7z;f6x}6_NjW
z8hh7?0|nL22?NzLFwDwtRkyxx`28^7N1(<d{2!0-e?7_vF$8Go_M_)rfRsW>kY6wZ
z6DJ?HqG#CzW|gu_zyAGWvETiN>A1>HuCl*M7nwXc4`pz^1i3TG+uensgH_f8$l)yT
zh%5$rUKNBHJ%dy}00r4gJbhi+U$Khvad92#n8pqin(OJ}7$R}GbfUXZivbS{FI!F%
zuUfjy&;P>WW}<JV{kp;Kx!CbV@AKq0)i3-6+**Q!S`WG&^PFWk@A;h6OriQ5#Zz8d
zxjkW<v|K-K+M2P(`blTmHo>pK+vnarJN<6i+sxmICC{3q+y7m-tn)QA+tQyyS3CGw
zThi+$vqN8Fv;E9kGV|(AXttRcutadma2#bk<h-6qj{7RZ)Nk=0nRySZH+n8KJ_&TF
zYKdz^NlIc#s#S7PDv)9@GB7gJH89mRG6*p=vobQXGBnjTFt9Q(NV@n_8bw2HeoAIq
zB^C_^5Dku7@__0YG~hOrWag$8mn7yEAoLi97@Ala8UPVQk56W;Gf0!CtDnm{r-UW|
DB{JI(

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-menu-dot-connecting.png b/client/ui/assets/netbird-menu-dot-connecting.png
new file mode 100644
index 0000000000000000000000000000000000000000..3f8bc29d816138baefd75c584999ff4d01660e89
GIT binary patch
literal 452
zcmV;#0XzPQP)<h;3K|Lk000e1NJLTq000;O000;W1^@s6;CDUv00009a7bBm000&x
z000&x0ZCFM@Bjb-c1c7*RCt_XVxTc#CPopfsJ}tl>;FD$dAa-wUHBb-Y?4s9INRpm
zzi&5R5Yo$tOF}f%p68DJ{Q^19Pw9`I|Chn0MoyCP$)oLjGgS^MPI$fg;1{AT=zeJ7
z((>oVd|U=&v#5qeBe7Ke#2$hc+zZtW5ifeQ{Lfzo7GeyC0TyP4KQH^_B9&HOUW3yD
zkjt~4UEfZs;mDRulhX7=_6a-{fx;XVEaVyv0wBF0GeBlxSOAJpV#6FC0GR<Y3&w{B
z5&vC*$JDTZ0UGHal|RTbz<dBo=hQNs0qP5onQ#k|A6z$~mf<h}GZSn<<)rUab3F{e
z%%pi)1h$|(kMjw&4ThNswqUM;<{4^R05g+5$rJ=Yr6M&9M>h*@0jS6Y*-WY7ATvN_
zVORhv&p|~lsK6rEaFAY*8OU`5&5LV{d;n4aDso8)E|6M~9(2R8`Tz!KT4kaGP{9Q%
uTVUBAl!-v;{P*jP7l_eMQve760RR7Xh`~Y9fk(0c0000<MNUMnLSTZXN4R_d

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-menu-dot-error-16.png b/client/ui/assets/netbird-menu-dot-error-16.png
new file mode 100644
index 0000000000000000000000000000000000000000..cdc6254da525a890ac364c0388bebd4ee298387a
GIT binary patch
literal 532
zcmeAS@N?(olHy`uVBq!ia0vp^0wB!61|;P_|4#%`3dtTpz6=aiY77hwEes65fI<x~
z7#K<o7#Ln9FfdrnU|<k0n6oR;1}MRn<n8VPq=De4^X_^e#aZAHS<Jv7rV7H0o<S-f
zfP(BLp1!W^uUJL-L>NBEI2;2C-S>2H46!(!oFKv4bAx5CxNZ{f?Oj)Iz4>3C&c?>p
z7TnWQ9bQ>2e^*NU`|JgbYj&4!o)fh}q5J#W+gS(q*B_Mtf_uis`+w=^+{v0Y!Qk!o
z)vx7KzMgr(cIN-r(|%9?{^nd%|F7e4&V!%d`+uK5KfkT*`ntLI3ckK#PWkHdf^Ej%
z|L;|Pd|!XWUS(rF4-ZdM{eLfzSj#%O!wf-;ZH&t$B){)XPpdoFvh0Pe@#k)!gMM>J
zO_(&P=*i{{1;4Y!riK5Pkd*vqXk@e}EwS=zWW)|zRn?~)R~HwG7yyIH>PTd3cQy+*
z(5tE?t`Q|Ei6yC4$wjF^iowXh$V}J3RM*HL#L&#j$jr*nRNKJ7%D^D$;!kN54Y~O#
znQ4_+G#EfMIBv-Us%OxE+fb63n_66wm|K9*V;Ev+Vr2v}9->E5QTh%@lc%en%Q~lo
FCID9Cy}JMa

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-menu-dot-error-22.png b/client/ui/assets/netbird-menu-dot-error-22.png
new file mode 100644
index 0000000000000000000000000000000000000000..d9bd013d66ec215d5926a805a2bed2c3bee2b026
GIT binary patch
literal 629
zcmeAS@N?(olHy`uVBq!ia0vp^Vj#@H3?x5i&EW)63dtTpz6=aiY77hwEes65fI<x~
z7#K<o7#Ln9FfdrnU|<k0n6oR;1}IS!;1l8sq<^=yg&sI?dd7_Zix+Fg#-0lfUS3~+
ztE43V|9_^^(t}x9CBeZ*U0go8xV&?5x%B`4&6O)_<Ks8FxOf5Cvu3@EjAU+YtxZVy
zziAUtP&qahsQ&-->1Tq2zdAd=cXkHqdhg=$*~#gnvop}TiSJae11b5EAirP+CQd$X
zMbEMc%qnG<e*OE$V!!(jll^g(om_vFE;4y$x|Edzl`<xIySp%Su*!M>Ih+L^k;On?
ztAa42XOPMVpdfpRr>`sfD^^iHF0LaT)7XJRb39!fLnJPjUcAZItRTP|z@n?c^lta2
zfB((H*7|Nad*`?_)0vo-buKdmWEQ4Bdg3a%c)iNL#91F>JeDpwQ8}${tH$am>DO~i
zcda}1XtD3@pBo+vO4nRBQ~%z)|AWm3=lT~XmOsej6qYZaC!YI0=c|$Omb^nd+<R_>
zwXEFYzim>I%ZwuXz#a#l7$zIe8UZPG3ArfI4G}BYR&4p-b$^<q8tY!C(k(!Ds+PD$
zl%yn<q*^5xr2;7iBLgEdT?12HBZCk_Gb<xAD??Ll0|P4qgQSZ;rBO8G=BH$)RbtU#
z0MX#MB@d{cK?80>NoH<paY<rs0YZ;qh@pv<p#cy<^!Q}ff+C5*)78&qol`;+07{$R
A=Kufz

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-menu-dot-error.png b/client/ui/assets/netbird-menu-dot-error.png
new file mode 100644
index 0000000000000000000000000000000000000000..ce5d0e8efc17d814a17ed7a901441033f75dd302
GIT binary patch
literal 433
zcmV;i0Z#sjP)<h;3K|Lk000e1NJLTq000;O000;W1^@s6;CDUv00009a7bBm000&x
z000&x0ZCFM@Bjb-V@X6oRCt_XVxTc#Ax6=!tSo~}7Z;PNn>S@Z{5Ey<C)4-rIm0$>
z+66*-8F5LxTD6LY`O%{Sg#!oDAN}|tgH4Sb2gj2K4h}Q_%E?U-3k&-~v<1!o|GRYg
z`p(B?FgA<IHg8U>Wn|n#(1IK1&xc5tl`a4C|36W|2LmjOjDMbXbwz3z8m_@<0m$VA
zZf@I2H5}QJ3A=WABKrhx0VvFs7cII@Y_Q-0py0Y27pDn}6L>NOMJT0)g8;}3kXbN3
z+yYQ)q113}W`QjLrE_Yy9tJ>Wfy{(k0LnzvG8_hAW`Zq%<xpw@n3*&$i@+9u$`)!H
z3^NmK0jS`jwgoUV;TetB$LBG%QW7Y$ecrM~mH{~qK&2uz3`aK$ZULys1=&og;UF_W
zX2JM0FYHi~DM$iT<bo8EV>n1JdYyog4?yKP$Q7gn7f3Bg4|-j|Fkn?CI-sP|r#S!w
b00960)gi!0=-XYW00000NkvXXu0mjfUTLV+

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-menu-dot-idle-16.png b/client/ui/assets/netbird-menu-dot-idle-16.png
new file mode 100644
index 0000000000000000000000000000000000000000..354b5b860bfce07d9de3d22f59ba27cf77cd10e5
GIT binary patch
literal 490
zcmeAS@N?(olHy`uVBq!ia0vp^0wB!61|;P_|4#%`3dtTpz6=aiY77hwEes65fI<x~
z7#K<o7#Ln9FfdrnU|<k0n6oR;1}MRn<n8VPq=De4^X_^e#aZAHS<Jv7rV7H0o<S-f
zfP(BLp1!W^uUJL-L>NBEI2;2CZS{0<46!(!oFKv4bAu(idfLWMA2&z-|MmIy%tj#S
zZ7qGjynlaR*mRe_Y8ejS_w3X;G-poa|9=Hx#s&r*j;-;A8*B1wfB*fx<<gQT_9tG=
zyukb5$Lajf@A=bJC#A6g!N&S}3vJ7PpKdQ$eca%|_4)VxczAe(B5KqarykB{Sjljh
z!A$I0El^B<!-`sv*a7}${q8d&_H75+u*XTL?&y(Ed;hY3KCb-Ym1f_uzyk*u7*0z%
z@=clk^gPf5swJ)wB`Jv|saDBFsX&Us$iT=<*T7WQ$S}mv#LB?f%GgNTz`)ADV5-uz
z?I;>@^HVa@DsgLgQm@Ai)Sv;kp(HamwYVfPw*XC#5y*ImC6bELcYt~rJYD@<);T3K
F0RRG?rY!&f

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-menu-dot-idle-22.png b/client/ui/assets/netbird-menu-dot-idle-22.png
new file mode 100644
index 0000000000000000000000000000000000000000..675cf1ffecc5849c26f3f03d5a46500b8fa646f2
GIT binary patch
literal 602
zcmeAS@N?(olHy`uVBq!ia0vp^Vj#@H3?x5i&EW)63dtTpz6=aiY77hwEes65fI<x~
z7#K<o7#Ln9FfdrnU|<k0n6oR;1}Kph;1l8sq?xSd)lA-{XB(kt<Uf7EhMNBMJ+rsO
zWYjV+#;jhsx1xUH^abk|EZ;nP(YpWt8Kx|*pS5J$qLo`27}_Q;tyr;f=Ij-FW-Z>P
zpymV=oH~C4P%(q(r0U7Lfa>QgUO#8?2A~z$v5Uollw3)WUoZm`Cm*+>XW0a1m9k5}
z{;}Ba{=;N{TxBQMU!{vooHvxj4**p%CV9KNFm$lWdH^|`1s;*bK#!_|Fr#OX$_Jnz
zdx@v7EBh-}Q9drNBOTM&fkJ(rE{-7*mrE~3^0g=kuv`ce31Imid-3=Dpp-Nty_LUe
zR2<3$YlT~SS{d&OAC2+QtdNN{@C;qn+kGx%)*lo7Q>Sj7J$h@E&ZquszPqcxuvg!{
zGH>_4^~=BCUD+(9|EeaW`ElmHm7gn>qIT46dd9u>P)@(ZMxn|1(|8Pbu-I_gbsS?n
zyg0P+=pw0r%=caVw=9$$kAJRR26UNfiEBhjN@7W>RdP`(kYX@0Ff!9MFx53O3^6pZ
zGBCC>HqtgQure^1sx)moiiX_$l+3hB+!~(L>v01$XuxeK$;?eHE=kNSK+|JrU}b0k
VvBW2{))}aW!PC{xWt~$(695+S(e3~M

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-menu-dot-idle.png b/client/ui/assets/netbird-menu-dot-idle.png
new file mode 100644
index 0000000000000000000000000000000000000000..79e7bbbf8cf94aaea503fc2ce2162a6b774ddbcf
GIT binary patch
literal 483
zcmV<90UZ8`P)<h;3K|Lk000e1NJLTq000;O000;W1^@s6;CDUv00009a7bBm000&x
z000&x0ZCFM@Bjb-l}SWFRCt_XVxTc#Ax4pX>QaLM8!3|&OXkUd_z^KlPc|HRcIM#h
z=nI7OGUAf>KXodP^X@AJx#=<KZ{NI<!KOx7MC{4rnM-Ewb=8@`n4SFvn;K?pg5If<
zT)3=^cB?2z1bqMYl@FIAKytcT%1)1@mE*o}8C<@7Zu>ogKDhlsG~~#(xy%3l{YzBv
z!ClJC{Kv*CIZ{>N^%|T$0J)s!PyBjP4F`e$|Nk>Rxf>AlN67LxvQOYX0EPJmC4=j@
z!kbtCikE<U7c^mU0#Bx(2&L3;5CEA0G7H9s`(XX{qmQX!0Rz+*fu7c~3@{&n(mAyZ
zXMp+wWG37KP$r_5;V=L*6Knx2hf)*3%%pi)1hxQFwouz(n3-S;Km`}IEr6LxpJWOG
zpi+?<hNGJWw*XY+f^4SLaF7`wvoI_Gl^t`|olOLlisTv&(hD*Jxo)6&agC7=Knm9E
zf8a?<aDmi<^q?D#)dCRMIy-L<sK{Nmc2_Mvi$HQ9H6XPhJ=oOXtdo%eC6zwS0U!VX
Z|NpJ2(b<_D`!xUn002ovPDHLkV1i?1(4znV

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-menu-dot-offline-16.png b/client/ui/assets/netbird-menu-dot-offline-16.png
new file mode 100644
index 0000000000000000000000000000000000000000..f9aa5c3e981b19961b33e3b963fdef364e2233bd
GIT binary patch
literal 512
zcmeAS@N?(olHy`uVBq!ia0vp^0wB!61|;P_|4#%`3dtTpz6=aiY77hwEes65fI<x~
z7#K<o7#Ln9FfdrnU|<k0n6oR;1}MRn<n8VPq=De4^X_^e#aZAHS<Jv7rV7H0o<S-f
zfP(BLp1!W^uUJL-L>NBEI2;2Co%VEb46!)<cH%<5rT_-l_mk5VK6V{2`N=LeStX~Y
z+1Tp2yg_<VpMAl(7k}7hsrZQfKd^*ZX9CB*?dg{+3zAFnY<7R2!fm4X|G~e4ocr?E
z1E)zQGhEp6<H~EkbDLj23Dt~v&-80gtk{H~K?N@u76hm$yjpfyJ}<m@_Wy6uu8khG
z-6!t+?O}8%c;WJFok#8J8~U7=&TO!3k9;!cu#fTKbs|@MJr8WLSRfKOF}SNEvoJt2
zV1}^QqAD)ePpKlEDyx<osIRGETv47Z{D3z+)r&7RqectpE!7g&h?11Vl2ohYqEsNo
zU}RuqrfXoTYh)N=XkukxY-Mb!ZD3$!U=Yx{!V*P8ZhlH;S|x4`iZ=vWff_X6Hk4%M
hrWThZ<`$soF#;J6u|!f)`VLSJgQu&X%Q~loCIAmKs&D`R

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-menu-dot-offline-22.png b/client/ui/assets/netbird-menu-dot-offline-22.png
new file mode 100644
index 0000000000000000000000000000000000000000..5202c8baae8a3e76078ae83351c35ffe8417ae64
GIT binary patch
literal 605
zcmeAS@N?(olHy`uVBq!ia0vp^Vj#@H3?x5i&EW)63dtTpz6=aiY77hwEes65fI<x~
z7#K<o7#Ln9FfdrnU|<k0n6oR;1}Kph;1l8sq{RY`^2+;Oe)Q)5e}<`Ziz2coTYF_J
z+jMHnm;W7YTbHl%YVIk`DQ?Lstj{iLU{K1<ty@^uFeSI7<-`B~Y59#Eo$G*HpkAQJ
z<hl7k#SAW&I28OYJ^ByT!oYBPhRG73P4Xo{e!&b(oP6Aho@Eo5Rmv{?`uC5;e)k`y
z<0?D3{wiGrO5K;^y#Z9pnB?v5!qCAg>jC6&7I;J!10AXg!i=6lDj$G?>?NMQuI#T^
zMfte6j&w|82MSH_ba4!kxLkTMlCMQUfaO9Nv&hXm<vadsy3RSNF?rp2ccv2Y1L~f$
zQZt#}KVe<i6BzV_Uq?HRd*u`n)Ags;XI<WM%}PG|_OTby)|YoTJUsAq8MjT3{oWcG
zy}3XB1iUw%Z=?U(d+&Pg18y#7nsPP-zg*<8>+r#lGhMP0%F`A6mE?~cb8I^v)~X}6
zno;}h{zt-EQ7Th~?llGg-KJXN8c~vxSdwa$T$Bo=7>o>z%ybP*b&U)|3{9*IjIE4K
zwG9lc3=9HVS6HHG$jwj5OsmALLGgw_D^P<5+=i0O+|=Td#M}ZjJ%$EWh6WHzd@^gD
QfqED`UHx3vIVCg!096^#6#xJL

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-menu-dot-offline.png b/client/ui/assets/netbird-menu-dot-offline.png
new file mode 100644
index 0000000000000000000000000000000000000000..7aec5d01da5b9697291400ae9b341a6f3292102e
GIT binary patch
literal 456
zcmV;(0XP1MP)<h;3K|Lk000e1NJLTq000;O000;W1^@s6;CDUv00009a7bBm000&x
z000&x0ZCFM@Bjb-dPzh<RCt_XVxTb~$^xtSRR)5}?kQIv|8D?c5E~>$j9x}u60ho4
z@qEgOE0{C2BmMKI4>H))@bU>fNy)C5$v0)u1hK}jFGO1~Y3)OoXP4K{$7L`!i==b|
z6Z3-Q_YkzeExIj4UGmTJfB*im5MwwDFflRxx%r$Wa@W$TH7MffE+@xu5CG``=>?gA
z)d!$3?_+#+o!DT(1wg@7^j}I77AJ5YfFhJq!$AOK2FNTJpBcvB;_g}c>*o(XN-Y3^
ztCxJ#jvUz0&j9lQC{0tt^)LW33zkp77F<6v*MwSz!vM@oumwjB?4X+KVE|?(eaa#m
z2ahMzHW+3m*aA(P<TKQ^0A?oGf@2HAE`Tx!wG0QD1u~NXISxRjBDE|)HVbY6sK}*;
zFF<C1%)+n$RCa)hTu`Y<uHhiPATyBb29#t9D$hYhE;*LKifi;bf#wws){F*H2r6<5
yD?4iO#S2Idqz0rGo8d$QN-BMt13&-(0RR7_8NY-reY}bQ0000<MNUMnLSTZ#ptZjM

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-systemtray-connected-dark.ico b/client/ui/assets/netbird-systemtray-connected-dark.ico
deleted file mode 100644
index 0db8a08624e6f0f0e679fff0e69d9d182f64e41b..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 105144
zcmeG_2V7If{}(_|M8P_6pnz5DCIPGdT%oR7{|>ZTX94#_(OL&0gr!!rYF)LcAnsZe
zYu#1iz)`DU9jK^8v7$u;1VUux|NXw?VG@#%@rVJF4`1%xy}SF)yLaRJ?h(Qwmc-7E
zK<GrKTM#mp5aQ${iSLK>n~=t4OXDpGSy-PCcXvs=b#FqNbti<!lg6vFNdIL}0sOGO
zfsl7j7>l%qI8+5Gl5_|NfqF02mH-vk;@_I|cGXt{Xi=mzE0zT~fuO1mc8IVCK!OY$
zWQPi^Wy*@-8bN6t?2tSHWiJAVrO*`#fc*Y+IV?+GE29I-xdIeZ<$1znSFaog$d9yR
z9T?JlsG&o+ogE|;yH3p&yL#p%12`ZZ7$PXt;g9!Ze}LPGGb6Vc@?v?qj;?T>%<;*M
zXNTn@Po*@;m(8<;@<%!I^XRg2A=@txWiwW`41EpqGlP2v0L1KIpnp;+en}k=r|yLa
zQz5jb%VEe4req%>y-(%iES9H%vxve?*AYUOXY=w=Z);@B($}2nlnlk3d2(g3jy!;7
z6z&jV0G+=~=%06uvm~#uOuEEI4oJ(lfcrxLW&$h#m;*2zfYO^ZF0qOCwng*Ni{?XJ
z2z8)s?*X_0AZz21>dG17o;ZOJ@d`rt=7c<D5h4JjS?&PP(gjwMbiBudd(gq)9})8a
z#1g=M#tFb30Q(>62OW>D{fwl7%JCoCVKeAQC_6MX#fTf=F@m9Kkikv&$y(DOZTI2O
z9wOC3s1Qx8^rr;3?lgo5rvq-fEh`IsOA*6`8r(Y3AnkK+sh~j<+?4)-E*d|ETIm9C
zyX%M_aia~=cBl^xF<R0<;ih$?FAad(2_RpQ2I?8+m7`1#W!gLgG=$0G=fJZX#vk<a
zTaE^rZ^cj_8UVKqz`qm?O98icDQ=ZCz?j4rL6#0BG|1^nHm~9};2zIj2Dm4b!Ci(1
zDQ-$eFkXRC@%x_)4I1Od(ty7OjJ@7L-84RBA;oiPp2^g>=r)YY%-&N_+E<jZ6WKhn
z*MPe*KnfdWuO7eLea`G$y5E{9Tc0-9&=1uE+(`gbU0A24G{}tW(qX**i8gpKFW|HT
zz;O}HhnO7*<Il48SC%HogJV^hvKzF)4}4ogS=l*5X<e$u(6Vyj%q^8YT@J^ZZ8f0*
z^5Izh6aZaTK2$aam$eIMBW#}1vS-S}594(Uz^kgyEu{l>E6cC!HD_U&F?ne@sC$Si
z8l=y>ohtcOkcX>u4j_lyS1oR&BN@O_kp}6QW0R)1seITU$;ch;Lc{V4%HR(XuF$Zo
z91hMLXpfU~#rRCnqI@>wZAjAq*Ne3%OXI<L&v|xWo;QRUI+QP+-$2=p022Y$02~3h
z4)7S@6+k)w&MR*NoB&u0Fcv_T{%;^o)1_&M^mn3Vpl=9uO$AUjpHxLtJbOjHzNkyf
z1AbhihyzfCPg%OsIe%%TI$Qw$)&R2swg5zy1EuqQ9Z;EyQ~?Qysoy*Jp9LTY6tVbR
zkvY#%WJPR?tcX>K`Ev6TRsu^5s|#YXgfHf?pTauBcd*P5SV9Q52tY)LV-|pb5L-SW
zRtP*oV08k(oUp`V9snQKCb9tJe>jO`19$_Ju2Z!5IMykEWz$bX3BcT;FRZ8Z)iAqJ
zWdqv#1LPq95B-gbxN?Y*(w+k$y^fGmS$F`N`=ZQcXs3BVJuqfV@QlT0zpoCUk_Moe
zwi%jc#gH*u0=gXlG69s0QB<Yff_Y^FW#%KLUDjq4X{Y0i*%HvM%{W>e?W$~srdcs$
z#Fk+Gh4W6FAE}Zzovw~{bv8rwKT6sH^23NN0qq{;&|eHT(_V$m)CM|Ush|&S3H5@Y
z%C7XbCFvaaOgTKLlfN?CLAjT<b14tX`XpKprFoUfsk}6x9p`iJ^x&a4&`8sVq1+lC
z;>R?ZJj&XGUe7q7eM33)<NDGq&g2|b{SWE^ZAqmp@g6{h*b>nG34q#pxpXb>7OW*J
z<>ANI?Z6{I{ZGmRtt(}EP|3ggnyK|a+;^q>9J!EM_jtedqLPR5aNvF5p+am)+Mkx$
z!{PWUT|+IG2h@`)U6o@?uVAcEt}d0y3gq7(pmdMBoV8DtJW#ZI=G=nyGL?B$*b>^7
z&NhTR0sV*3jyT`Ruh+@0-N{^+p-+Z(YQ2v$GxsbzM1D=5mYsqvDeb%HyqbnUdkfC@
zdHFzx+<K!7&5G%zJSftRWuPu>OT$&+m+C=n-=(UovUI>T2-d?3)zGU*KgN-V_Eh-3
zom2VP{uKR>VPB=pIxdZ0lfH}2t1blE(f;!(znzI1%b(^))>lW8CciJ?rw+Hi_kiwh
z0Jzpm^_{49Ep<>PKl<I!^-1fdd|~vZRk1wuoj8V&e}3V<hs1ZP3|*S?g?)ew{dm2T
z$u(Hy1L|xGkfwk~q601W@Z|V{_OE1L2m9u3it^Jn4s|&JJXJ<JoyM7^^!Zh;PN3gZ
zlsz54!VXs6pK8Mg*i1v9vHbaqrhAAA{SF6oN6SD-I9?lC74t%UxX+6IU+Qp_-s8;E
zP6w#7a_YwYeI3ULd9|VJm2&Er$B%xHihhI&@-DS~+|LA^X;43St7-Rx{m$x8FFemR
zs$Y%<b$g(twBz$u-oH_<4h6jEyVycg4y5DDqY8DXtG~=W*J<kQNQr-CnK~5kAJ&9^
z7(d}Y^FD>L<<(vGK8yuajf-%ctz-RV=9{uS!Co=?!*12F?lLri@2-5`3H>~0f!e;N
zOdSfeB*56nLY8LwnjMmhwBsIXd39)hAAAi;{c@&&%q8P9&C4sNrHs!CJR|Vgs@kVl
zc|97@0rJkIWG?SBqET5Dvc$dXdbHdzg!mkQ(z%q1a@yd;{buwN84Y~__Q9ooIt<i}
zbgWmPzcZvE50L=4M~~w(q(Kv!k#8J}VmaIw9u4boit@qnYI*BMn&6`IAZ;prZrC9r
zYzqwl+5@-)pl|nh0Q5!h20%Z9K>%F=ngP8k=Nq(~ARm^~R3<c?>cSIDjE!je$_v@B
z!wU4HKSd6JI=ZyEr_$%AJbHA!545)eI0L{$dwT%72d{U-{@@vjy66Rf&q?{YkoLM+
zXjtmyv7!8c2i&8=_Jw_jwtH3H@->=bCJC4%V3L60Bp~q`!grhSCkeTdu*6Xk7THQd
zkrjj`#5~Jf5(>b1iHOlHi3)9bBoN{}NAO(2(3Z!COEKT-yucPhfq7~cyk8|2u<}LV
z!GtbLMJy@|>;>$KMWmM_#*2u9Z3q=sx4lAz#43}zPY^$pBZyxtkcNElZ^AeaE1~|V
zf8av}o>YW@9~BjXFBL@>6sJM~hK}&Q7luF|Pc{TPsUH=>KcF{@1oFU<3gyI?h62n3
zajI$vDU=Yxk4o1lL_aNe03JZ8pB5y14DXWx%ch@60#!}|u-CL0_9hosImR?#2zdvf
z_RK#v8OZYfvB^Lg?;nc{)bVae8A#V~-C-We1oVPEM7ekTlr?`%csHmFq<#?~18vrF
z6!W4#-9%;l%BE?<yP;$NYo^VC_k2D0uQ1*XCj;HyI|G?jIPZp#0ocI%cbheD2L|Ka
zFftH&YS9Lm=6xaXh@j{@SSDUkV<hRb;F^Xq(3F2ocq(0!{opc?>~UziR?dVBN_nTB
z6Gk9|T^iZ|J_GfUK^fkSK?bnj&=~mAX5U8_8K~slIAkF7)4~SC>;Pdg?0su8{-OFg
zn#c0O57idH25_GyMI#vml=|=#gAYczGANH{#rq#l2Gl;V;y716jy@0a{!3L&25~BF
z0C@*L4_O~4>2;Nn0r1`tpzQPT{rP>$_{TJ@WPt5PleVK_TPU}0RcvGG;=n)pX}q_4
z^uJYd=7z3zK=F?9(okmQ$beDaQ7$kyK%Y#>JBh$Mod2Ur=gQL6+JOx3blGBdKwb}Z
z`oMcCWWYG@G#$V{?$wKR^!ZgP10}pu{$qgWhKB1XvSaHC;~izd4$iTJca74O*f_1X
z@<KToDCHgfUcnC&<qV+Fb5v>v70NrsKb%Vg=VX@0V|n)}8K~qPePrPr8!7*<z<1Gx
zw!aS<0zLjxn#8W!wS8ssko0pZe4G`|ObY*yd`tB%|Lz@*^)!F~NE!cX(-i!>(Fagt
zKWL_91-QKd$~^n=OfNn90o7%vfPcH}b5?SFglWDssSloc=mV+Te-Xz%s?Xn3&7TUJ
zr)8<qPdiko*E_tL@GF}K_#ObD*8h}=cc^H-=@8E~RHA=Oy9>Ub<@%h;@}TQA;6gt`
zjn=|djQw@fKfKSSf_FN7j;=guS`P4|Ut;Nda^=uNowY{mPTx?2cSF$cQ_fFXQ@%9G
z2kjkwpSAWa)p0y1ZzGcPF=;)k3pZ)Pi?(@ycPHQ-&z4h%Tlqa5-yxH=7d%5&L)`c*
zQhH{Ewmj4Mp*}osB}GI0O6k=09W+_qaXh6Z?l_uueM8u<`~+~{)e?VMdhvOv{X4;u
zxsGP<vnk?K`OdbcGJ*Hq%ATpJi~UQ>;J8&zujM@JF|P)Fo+96LJO$dU&VKmt?vu(h
zUG=er^4_77m5&x@gwi}KhC2C5q1=GS6Z-I}sw@ZJ!P7+VWzWP_<V}+}?oTw<)ZQ^4
zJB)hgjXDED6%YERmv=6*4)0N_lf_O=`Iqi(M(WF7x#e+9SlPMEkfuj_S0w{{9(LA5
z29QsF4O5T4t~?o(IU5DXw##%FTWCh(wer@=fZmYuXlC?2t`EbQ4(Et^zQ3wU?~3W3
zs%!xG(rzD5Gnp&mSB(D)Yh@95RtTeVRZZK!%GSyN_f&u~>lYP76V4fr0E}P<=TdW3
zxW;!<4JCsWiZ%e_JDkhnS$r`7j{%sJ1+I<U2Ecx01mG%jW&%8G(XULhZ&2}a$Ojsn
z6lEYAhdo^!_uzgOo{fj^-K_yYUx#A=@c;<`Niu-(ivXzC2!H?p^bzU=pwZea<ioWT
z<?Bey%OpmYUt_rj{_*``wd+Z6pP6<NDs(p%zGdkE{`vyo8Sc#Rsk)xq<vkB&=`!Rs
z@Q!{p6*~Tu%D2p!35MjeJX}B{`dXg_V6s1!wJV*zGg2PiOy39o@w;+3K8XX+#@|Yo
zS5?<?XErcRJJa=Hn`MVm>u^0l7HA*(0%K=kG0m%~K9dAY5->@?Bmt8IOcJO#2~fuh
zsQQ;Cy>U?*21!HdsSYJ15Iz+{%!>#YPcN_%5l0MdvxqHxng+iwV}&7?4<{?Y`3iW@
zfh24Q6^J0c2UJi5`2wJVA}A+@3QCC8J2>P4LMX(C3b2p>u6a->3$Ecfh%^y|e8Rn0
zgn5W#Pzi;|mWV0DmP8zhh~a<+G2WMiJP5fEhX6zBR0T&d;DsL)6G=nrAP1^CNPv)!
z=@fcNh*2PkDh|gnP{kpniUT65ID`T!AK^+vN4_NP$diO{G6bIXfG0#yU<KuXGek(C
z1cVd^z$c0fWgsCHLu7#p1=5g;==KlKi2%G5HKpf70BNRkB2Xx%pGg8H378~cl7LA9
zCJC4%V3L4I0wxKVB*3f$;Qb_DIIqE%*;-AtRR#&5?g8j?%}h2>8I;Bljk3Bo*#JXA
ztt8bb)4j<CDv9#+BvYO4O*WvXaE-jUCb~D-fRQUvNAk4My~zf26ta;P(?$0t8!%F3
zYDtzpx;NQ?mcll&>`dt1WCKQ~R1L{tQukHK2H-tQe7_dolQA|}2tL+2zcVds78RlU
zDrEyqe9u(%`z@;c{ne%Cv%`b~WOb<Pbw%pFs@MR0PZH16!1p25>BLa?DwXc5jt%5t
z|8FQAtHM($bzc>1KspZ4?MxwN?50xdzDn2t^*!bf(g#!t-B%GC!1w1>_0JWNUZr$j
z*=+#MfM6R?|5Z}=mEQ&oa`sS_)_rBR0XPq*A@l)EzuzzW>@a5C&jH;bl=+U6u4$Fg
zpAhs<ou6L;&jO>?J-yEKvD<)jK8R;4$+lZ2u9?(7lkK$3dCeca4TR+3xm!%=T(J&g
zvw<?YH}wM&34s2OR&g6pse6+RP~Q^5`Cvuu4SeW+pj_RXYyfRQxVD1&0DLZdC>zjN
z_aD0rz?u+#Pb{qp*?`u%H`xGnHm~A1j>)*8`T?DF|1sMDn<ut__K)Z5GO2ULx+>ZR
z^w#}HZ3B`sE){jgbUdFkGnXmfAKCQ*#&rL2+d$sIitGbi;d_ekO^$r{W*?I_z_{)|
zRvUmb*_}ZD6*3>h@9D{WkA*QCpmkMI;m5X42>M^abRVGNn_MOvs3@b=qh9IW0AusP
zGT)z(|0a{k2K3NXMHPkT0DdDv@3EhT-z7EKKt(B1k9tA>dd&y%JCa&_o7rRodg!Vm
zit6JlMtz%I`|om_Y@i|(sYjjA2jKUZw0aKcsC#;DP@y(}^G=56o=o`>RoEO>5A_qN
zub9U3LC#VY-&>R)^U=Ci6;_B1P`byp2j<rw^tAz_)IDuC@Ex4_n)Cr2_@<;z-yK$N
z8;sh3jP7ZhW2}BX*9VMR_h<vs`Cy7#8^G_5Pl9i3D%Yj1>5S+|iSB877^xp+q@xWO
zz3!1W{J~gIwXayk=$;WBsnPxW`h9ZP5-#=oucZxC8r{=Uf%bo<Odo*XSDq}lu1m|6
z$xx?us)6n)8ri|ZIGRU&Lk(@9(&--MBApMu9}B|wgk9lV(hT?cs_N6q1~k<@j#nf$
zoj*cf-P7gEv4Kjddzv?p)fP%#_)YC;2Gc!l6B^lo#=6I`%5?Y^x@3Nv!qj;rC@U2<
zP^oo~d{OhkU}3uJ41?=lBOB04_n?1{PpSUV4i+MhO#KvWpwjCe<-+D=TEKozoPqj$
zTIY(P(tbc&-6Id2@AByOk6}JLIKLrN`p0^tHc%yWkNm(GU;~Vo#I935So^1KLCywr
z(LJUArE>Zg!#C@9A)lsSSqXsd!=%qjF}23a>|CGLt2QBJ1G?%S%8AjIX`V{MuzW`5
zgJmUHc~e05L8bDM?gzNe{NQ~6+KOa7R~K7^K1`7(X*{9wYKnQvK_&~7$|(Sz1KRKL
zY16(dG_S(gPu><nh2G3dvhvjk?cQ6d?xlSIXD;mV>(cg&pbTe`!n0p~pEHfg`C#SK
zJT=zCHQz#Y`lrT%u!d3@ZGa7Hmuh(n5r$Vry)i*E$YlV)`?Ws#wjn1s4Sl?f%SK?`
zvK-yxec(UOi3xdDraFM{zMATumZ1^M2eq;<^hc&?FDE=)nRKTwt?ZE89v}~`&j#Ya
zJi0PH133O_pZ)T-5t`puU%6I>@}T?HpnIMDzFlV-#eA@QI|M(4a@xG&{e-GM7R2Wq
z$V9*MVR0|G63hqjJtQsl5Bc+ESB5sM3yo6Ur)V#evg2pYJmY^3uwmUo2VT>d-W$+G
zS4@{do<J7KI><x03~_H@k`X@#V9#1-UPFZ&n3n&CtdAX*YXh>lt+PB-%n5N_#aPFJ
zoP}D9`^xeM=ND9sy#a|&XI_P!1^oehL&~=~?Z<t}`ic`DvduDqTk6kyg6VcITOZD^
zjBPBau-C6lx0<GTFrkMJQ3v{OfSxK;_p}}0{)*8&2fSg<2mXpQZF+{um32M{WBm#}
z-$PEWI3EPL8-oon*!Cqh6e_HAK0ToO^>X?tJHBD6eU#RNa{u7^$LGE>KM(!*XWUn;
zBA*AK`!fC;2C)U44_5s90cveb&oO_gEh~{%L`CY1sk%Ry?xpREItSoG?f1X;?^dTr
z-R~Lsd=PBbSBc%~&aaMr<_GZ=L;pVA*7~%O&vmBSDbw{pyB}=~x<?wQcY_VQH-P63
z8HE2(;b^9Hr*D1W$2<slSMR%{V_Vi$rX0!He`=rAjExoH{S;m4)S;YF`HBJk8vE|(
zz^m?Z#rFjb;VXvk^uasH2IVb87@}{RWuiPgIL{sU*2r(m!1AH=!C6qj^FesVaQqC^
z@5}d}AKX_A^w|kOYu_D1+d)P8ilHx}q4_Dr7b@JxL>tzn4t;%hN_mjC=?al0wok^M
z^D^^Fj_(K5JuSCTp}Q{n)29rK^U-%F#gIDG7Z>BcVlcMUmnMeF8}!|w%BXuv&P={L
zWIVd3ZE(6i?OD^ZQs12<hU}K6-C!a1*ZMvOjH1t{`~LSK_|WFtX{twE@=1Mnu2)vw
zQ*`6rfUfgF9OoNqedoPiwP_n`b<wLPWu*Qaag|#4Qkml3jMjYs>?z~>=SI$dKAfA_
zUK4$4lgALgJBF64R%b}TUZMfk^qI0PM&BKh`tDTJ_d1#4S?hWzUon|^oT~nSdS9FQ
zeSEFy)v|ps<|_txwLXhkOIj;h7Aos^Rp%=P{^TEMO;07gTFCV_6TV_F&s(DfPA2F!
zY#qwp9l|jluIW_1HZLzbJ$=PM_aDZ0N4IgWJnvf6A?GUwXUkNg=X`lQ=ji(G5VU#!
zD&6j7?E~k7vvM=FdN)_Lym4P|(Po^Fc|q?+;k#o1`@_An2zFQ=8$vvDq`dZ2Iqz%X
zD+Y7N5g-Sn^53Wcz2MsALOfGcwrxOKTm|4V2AjDk%crVq;2r%ps;chc9rL`k;Gfi0
zHUHQT7_Se5Ubd-$uNcVY8^93>P-)lpWn_eQd>wcSQKxf7TL2pgkg3BM+AdQxXm!ps
zJG9Ua<c8<*;5S%s{*T{egXg8uJ|ofp<O;wF0C<+`whvO3*0`1E%1_bWwTVl=)!u>~
znm-WQ$sCaJS_pAn@HPO-pD9~aS5GG3L0iQ4$*`>s$MtTcO&ea+<z<J69H8D50CjX!
z#(Nd|?hreyzy|yP;VhrL9$+IwKz<Y98vBnB0I(Hd1VALD9WD!$KH(mfCmg~6=znHH
zIF{;%uwLks)ai}Mdtg&|CXu0R+Hkh?0e!`o)Q=(Rg8ogXGs(bi45v?BaD@pw8A5(l
z0f*EEbUvHRNNvHOzG9W#4qzXk1?Vx^NOh@WUz0bvvg^f=^y7R2^bg|}Bk$War_ZR~
z9WtaY^}z-Dp9)Y_#)TE;E2fW(jlHa7eu#6JO5YdYdQJ;tm$$Lf2eQL=-r_2`9Wd%E
zW~{oZNV=qUa1_GIxpxvO98i(+`B>_PH6wf<3fH?Tn}2+jKWEy|HVAV@2UxfC1Y3v%
zxD8<3eS@C9VuqG)Wy6QQnC#G8++T)uacWH*_b!YFV6DBf$<#!zNdhJbm?U75fJp)-
z378~cl7LA9CJC4%V3L4I0wxKVBw&(&NdhJbm?U75fJp)-378~cl7LA9CJC4%V3L4I
z0wxKVBw&(&yadDs`;`RBqblOc$3>3v@hn^UxWGz2&Nr8j^H}n6LgeBlgapba6cNIe
zjf)6zq~Zb;kfS(@5D5WrfmsEFNC=?ffnq)(5(1zgqT&%EApqlWB}s)E0TJW`^il%w
z%8E*r5P)%8F;$C%0EkoQX#yZlp{EJpVMTnx;z<dR#?2v#Vt_BnZzYgQ079(K76=c-
z3=l_rj)0PjaY#pcxIn0*G>-HJ0%4Q{ARqFBEKw3bQpMsRWSNoxG8ibnC`OvFJTk-;
zr%{OLxFcTB1i*c|VlJjboT`{6fF~6#O#q)FfXYbagSbSuQUU}J4-|ua@g)RdoGS+V
z5=iPrjX8=%ln|g6qyq>5`vM_g92v3_3n(FAT%s|)6$*ilv&1}LR)Q88Bw}P1gaAJ(
z9)NKW0v+#xG^V|eH<Z#0DOf-L0;#(a{IYSR4}V<geE}6i9wa}$LYya!(+x%%l?Yi%
z9;R7Iiqq(&=0mYh6``~#5f2rov?&HDN`KNgpN>nUftD}*N$RI#QU)pMNYc2NK`~xR
zj+8;vhV<u%`DtlD8pWW1zAKIM-^VEidGF&CL+_&$!!qb8bCp3)#bwY_8k0d!#RW3;
zp$7S~aW2&lyibAn`v_b)%5qP|Wzi!;@^P#8%AxA9l9dLen7>yJb>Cc`9AJn?r4uVj
zz@o|FO5$L})UPyOpn!_o(&Yjr8A{odFa&H%@|Bt>O_!rs`jd*WG%n?fHc?s*Qj>&2
zJPPsqIG>73O%m=)^zc3|sZeT?h?L4NHA##Ms06%{{3ME}W2R6dfge1Ed|Au7u{8**
z)>i}i4u`H5E?K0yB?RN=@1IIY{W@Ru{bI!8hZ&C_&vE$D&r)#0ul3S4HLY9Dy*FUu
z>mQF?U0?grsbG&$vBFxT@6@{g#G<<Q=#Bk%TbQ%%{kY6L+TZ+^XVAt+yn;*nZv9p#
zd41sSF~N6MHa>FB!6u^dO`B<_3-*;1EF<Qd`_?}AWx<mJhyE*R?9`lrUv!PX^2o}+
z8V77%nD>9XqZ0@7QocwG>)kf^^J>4HY8ILQ$)icc!)|%xp2rvK+}mK0*?XP!y5FxJ
z9M*2}wD>%yl`qzNo<1HaI6EXbuz~ltp3xDliEGJs0rN-hs<-eP?zI9N@^*RdKgWve
z&u$USwF%0z;H^v_)^EVhwYBG%5p&+QU)uOJ@K4=%`NrK@V;lv8Ryj19voAe5%c{=o
ztnp8phm|~-^`QGZm;aeN9bBIL>NM$MF?vN--K(8jp6vE+mL(Z8FFNa5jXkkP{W>gV
zzgucUX4b2j^68f~12;4zcUDet$@s7KIXgkmq)E>1yqKertL;l#wLE0iKYPi!?E(9{
zFWx`8D8S=oWY0_XIVCII$gek^WON$b>CMaRk$%r>?3wp<-tXrhalh-?b=Ae3jNCr8
z{9pMwbeb|Vd2ZurWW=@DEerRAbpIvX-*b4=@t(P9Hl%IF%ZWR>+b#HZZP?U*lL}o5
z8h11s-X`J1ZQE)m6Q1R7AR$YV18z4YlV3mhrl49v{@MJyzYh)Mh4Uu6`@MR2w7&mN
zizbJz^sd={j40yL=cH|4NR16C9Juauvzi_D=Ds~3&Q3brto=I|mjGUT=2?sUn*qO^
z^(wmlLj&*Z75!R@c3n%dT4L>Vc0tCw^wgzSyEmS-qTp`v^A(l{{~0)89SJE)+HMhY
z(IUjFskiULO<((5d}jOQdY`zhne%$SOr03;!<(H^;TE$7`Z^C2bs$$yMkPhXzSy07
zu(x9{%QrW&x0l74=8NwPd%5Tno13c>*K*jxxqB9!6xde}JNKX9_eCr~?6bh~vHgkx
z>%C*l|7;h0?Eb?pHQ65Sj_!`u%W4(v`SfbQ_bc09@@+V0UsAPr`wdq+v^;s*uV*r+
z<XpD^(d6}?)p#<J|I6xeT^3DhlQl3ip{s*y>&ea*=7-a5SD!zg^7=$$zj@sU=k!i+
zyu?3ve&BVId+b8s*}YkUV?&SroyYs}P)6W$KZg<9NM_uTt&iK~oZV;1&)#?1yLkG;
z9l_yWtodu2wOP?3vqxT!dptOIV8%tyhnwnqK56pPuFhVg{x2}Fg!}bS&oNfvk5Bcm
z`{P2S&);?@U)nc27QASXeaR4ian?e=Z!Jb`Ens=PteNFh=TXekg|R0#&1qr1XuM<d
z`k(RdHHmnzrtRUKT{CKKSbd^J<`-FMzo!NMucS$Jk83`054N12XMSbH_#?JoH?y2F
z&2n48ihZw-r~IA%Tzqs<_raSkFI(;|s8=x1*Q%Z9^woXlql(Q(Oh}&lF#9Y?>vhBR
zE8j7#I<DD6YMeHEv~kPg+}YjF#sTv7MQ`grTGVs0>(OWr(bUK(Q;)M&jC-}*m(#kV
z^|F|GN58YQZ8fdhcu~!vcR|ld5&01|L0y|3uD`(dySxp*iC=$Hu(D?0gafBDy5#un
zD?Wd8+^Z|=-r3fT%6jE>$2_mg=uz$bn=NYn-+f`k@vPy3;*8wAW{1x7^8Izo>Uy~+
ztP^?NZ1;DmW@DCc_heR=858=f>(cpX6SLW;dM*5QOOHnOTynKzlw+HhS86=plXK?c
zt9q?`&aL)5an*iaD?8gpZC;kV3e33HFUW7hQP$zslcyb?BEEC!|LkYh5MG|Tu#dUd
zsQ}0Q-HIPS`#Wi9z1oE}CT}^)^4dRS88jj5e2X3@wl3Qpbokr2Mk98-ZtFclQ1eS(
zz;97;X)}UmO?l|Ql|9qiZ;sm;Gr^A3{Lq1RF;S5}*FXAtZIab<`{lg4*2T?-<{!9l
zvR&4B=R<#;Twg8hd7D+s3KHh|kL5q$`FM4H_sVwT>>9#9wj4Tp@BFg(9jq@#AJ3W=
z93Hy4(;pdKV(xs$>X`fc7xP!<?@T;Va(Nwxv#r48!UJB@!9ImIing^)`MdCH@n?nB
z1%;NYK4<+DSAT!bwpw>$-lP}XAIO~?b=ULWD3^I#-B^LIA{!U%zL&b)tfO7$sHb6Z
zUu|-%b=fX!)Ki~0>)g84iaQLg@n3Y!UiZ#)Jl3O$@3Ad;$1W7UZYi*Bv~_ObrjjvM
zyb`Z?yZr-qri?kV)ZEj@)@n+hI&oJwyx<lOZOAHcSvAV;o2Xn-XP<-Iqi^gTpldZ-
zxOLuvn?7-_Cr6GB-s2ND;~2M@|MzZ7qb$DphCQR#jG0dlI~9k9hwL4HcTfgA<PIhs
zZMvM-<oAP4g@?YJ_eWRJ*Pn|2jE2sAHn&>ar28p}|K-hIan|DX(PLSoLTyO#&(5(M
z<DuF$B^j|hSAP38{NJ#+=93;ysouUhe{%*f_)V{l_dRwmaUGtzw76$Y-nMSGE#}Th
zx|kKd3vWhmbqjhiCPnDh)Nz`b+w5;M<9uy82i||O(60-tm+!K~BlFH?ObZ?t`ehGM
zu2uURWPV!bqwQX|9l?F)y!x5d$$me7-E{oIo|gRigrwSe@XeE~n$>(Ta-Dh7F7~d-
zKMGf!-<#~e)p!1IVUb<t(Ssg6{T~Y58s`tSo^SW!e!C-yFRq7fASV;ATe{Sqx7FEW
z&D!LEuo>>+#B)tn_FdKU*n<Z9GJ7>ywbA~c3n|V2``&5Exb6k5e_s|G(7tH!{DR|0
zx419){`kB3eh#3QJ+<y;UOAr9DJ`={AO1Fn)>jXu54*Fthq?QX%XOyj8|XVX&+mAu
zU&Esp-;zH3)wQQ5AI{?R{9$QNcj(8{Ie(}2BLw)`xTdq$km>HfO!xec6?wdP?~=NN
zoU!gO>FA9u8&bQw`=78|dOV}cjWdf1AMG2nIqK93XG<SmS8nlVSIN2wJ)F~`Z)~|G
z8gDD;bTMW@pL%ajHe2B`@qw`2bDP9>J{IFbn$0O3oFnWob=1xcm^|6y<rktW?VhDw
zNNF+GoOqAgx$X7kV;Q4f{v24NaQK8hu{qE(6Y{!l&hAEt@Dp<3?31{*NjC<!%U=9+
z?oatF@<(@z=QDOE2lV@K*-EF(#tR<5xZc+elHDvO?~W2T_GI1pO1zu5uG<f7aub?8
zTy}bB{qq)tT|21r=k>DB-q=#V+i%srpq{%y>GSF}JDkqicx(B+i7^j_<65zPN~v*Y
zRa(p?Gw6*P+_7<51kL-Cr7o-`e?Q~yt<$#&#|xT$byq^1UMz18_Sz?DS62Az3+WMI
z{^y<quJ<-~%4}ONwP~o&W8t{|B?$@n{dixrhR!6o7V&m4JMy@{!-9yz%dgp;^K{4^
zxiYfEJt~}cd*X}^tv;<*?Bkv6xp_%`=uQG7h-y8}ug3r5(RW9zXiK(F2mY1LUj0)S
z_2hM{wRFa)MOhxKS%<DnT$LOUf1pdXYyE7GThwp1?d;}iC*E?~tZL*w2O4o7pVrZF
zld|nw4lVw<&4D4JMF;!WC+<Ig8y4-8bGM%Dq1razC(j+bfJGd>uWv2zoK5VSE{Zt3
zw`)f8*GnQ?>JGCcb{>7!?-T3`Z1iwOdaTPNXbjEAS!_#t5R*G;W#po1^PV1Ve9SL*
zg!4ger`OOLZ`~yGv44G<?sF+-X3kyG=t99n@0Y-Rv@PK$c$)p5a;~%2;Mh|Q_t#tK
z?+<#3sZRKDc8Sg>&b(dudW^s0r!XeD^9vzAHd*EWub;ys;lW!$+vDAvX62QH|IwBZ
z!K10d_16#eKEi!`rP_nJBCFQ9-P;9pY%%KYX+kd7>Nh@&B>UeT+W1Yx%fj2sew{vr
z5dKR$#|Lv-H~+L_(dW_EW|`G1IMShL@Jt`_yjH*2%iR-~z3G{BX9j=Os>1(mim65T
zb4EEo7<nV|;PKIQ&#(qgNTZ(mM?ODrmqqTUx4je=w|os*GA3tM|C7)|=dnnq6pv7!
zbFcS**TC){Kq<KLPiU*L;nxPN$;_KZIvqN`)V%qbCxLZtl2*^%g1RlO;hUVW<Mf+a
zD>MAW{Th<5|9jo`k`K4A?V?)WT%Gtt7;%~Wyz9`R-fztlVrL&beLK3_yt##gCy{N@
zGm$RnV!pi9>+Ns;FE9V|;<|;ocTn4J!%k+TU1j|hW8U`;mGr~i^ar&!J{ZJH4w$p)
zRQu5uUMDhcI|@2`Pbf@&HMrV%FX8vIbN=0N+G#+5Pu3$|1E0ddsWwqj(Y5;Bf015)
zPvWSKJMQH^dYu_Hm>Nb}ZVux)_$IsTt5@*p9+$Nn&&}>`F{pvpq}e%Bf?3|vhmCT+
z;lm||SBWnSxfd6^AunbHuk%Tls4!}D-12V_S!b_F8{#9yJ2u$0j<stz3rx#~_tQ<E
zsiVjv^ZPH_bvZ2h?sy;XS2Nr%`J5ZXCT+WRy)=^L`Z_u<vLt*JciQI`o7-C~PkfR7
zPeNp%@2j)~?)10QvL+pjwm)$@R}lEq3ZL4%=JDKDulhgi`RTP~2eJ=cZ&V}kU2&UH
z7S&=i7GVM2)yLV3?{1nKQ0%fMH}<(rRP>g{UAl>*g4_;$`E2=&Z1c@i&1yC<TNXI=
z`47*m$oeybZ&)-W^<Vq!X+oY{Y!tP|*<-KhyKj1X-`pNFaKbcrka=hOxVnB_bZU8T
z9?Rp4p9Gh)UB)&r8@Y;`w4nOcKX1FPJyATQLrJRnuUx38Wvvsp)7`d*+$7ghzRJy<
z*)%?KRws+SLs<TEa*q8WT5B8q#BOC#<V?5aXa8t7vt-F`zi-$5*>rC8J7bDYUG6Q2
zf6l+fUHUTZxYyHX33nTstuJx&+3b0KO}}O4chiHPXV#k2zeeA>P-k<C=kW(WCz7sh
zP5!medD)JR<9j;uecb!tFtm2F`tQa*7@4>>b#Zt^`;xD|pIc{P$*`qoGDe*ieKzt@
z^XE4Fb#DaR@PL?ZE(4xe2e$G)C<-c=X7=_IkEY}2_&wS?vrRzM+d({*xA)w3k3HOH
zzU}$npYCTH&8dFBeaZOk&Q5`Y|D2UGavWft{LapsH0*jLW7^wg_7`nf_VJMiKegD{
zJFrutr%&Ns&!SU5IrB;D>2Hol1||09PsvXEHI!$Y8hLMYcG|#DcZYT(YPpROjqA@H
zmbxRTSx(I2LH3r*nsB{$iiVzJh1pyF&%Cw!;f)am2^+@O+n;l2?aKwd8mzrGh<_z}
zT!#Su^j3oWFV|ZM=j@viogMoo>F(OPnGaXI8{K2W<{K9N4sm(UxbK#?-(JJlGPZB?
z_!GseJ@Y%%$~&FDYiazIXIqa$@l?_F23(Knt@va#^146gtMj*iI#FDm<rtpUDW^B!
z>F!eU=qEct8-AN#7LO2(Z``%0^Spb*u3mZ8ra8AMAt{$L2WJoM_U{6o8}I7@!D}14
z1b9C>b@`UhrJW79Su<M+l0|3R2MF$L<*!Pg_wMD(IdN-aiut=d%~qs5h^P@dzUY4`
zm*4ngr{!MXYU_WKyx9L;@?my(t$q_*2c#_aDw@AIFCwKV`DX51H?kM)bYSe$=PSll
zXEg{c?%g4P$71h#omX;fM(jbm@VEeHdoG`Jefn-;!Ol%#aV>v&+4j=2!(K1rZGD?$
z{d~-aYySP`^(JH|xh#KX)z!S~@!xK2srh{;DrGaK5Rc5q0fW~C1(#eaI=m|0EAHo2
zjshF+-$J?{S`oW)tXpPFK2$e5-j+>pu2Mbrji1BypCuJserDB>yg5-k=<--6i_t}S
z;m1Tlo2}gMcJ}Jn!oJ#n7mDn>0r87xR%8FH-u3mKZy%rUgDV36*XVYwe*W!Cie7Bk
z+swyjN>LqqZsM~>JTQBYaL2AQThG5U_V46p_NS7c?}~|8oigh4dfdc+8u2ozp;X}E
zf?ej>N5QE5gV*F_7w+B*^>;I0hqIXFV;3Z5E--H$5OpLid0dk?mznJYqQY2-3nE-*
z)hqZl<a)23d6(mJGGcyAIrdAq<Man@c(AhY)Vi6aBXMpZ{vo??QMW|kYHVlo#ZQ9l
z7Zr~D#4p?Y$qkE#V~gCwr;=gqi{d?sKKt=X@t~+1@wR_Vw-oHYF>3q7b^-i%gQ7AZ
zWwK>#-1c+(68|>u_1nrLqM;6v#al^u;BWQa$eygQbk0Uc|L5_xqa$m?ioAa4MS`CQ
zXZ6WWYad3!#k=<pW%<v}896#)mH5)UE{nSHpGDTsv%$eZ*dHL-%TvwTm%NMK&aya@
zk@VsjH@nxJE_J=LBRf89#9LrCUNk8?Zusp%y!g1$8(F9-vKYo$t7ApeM%u8_Qoa2A
z=Y%`1>_mFc%&7*M23)htnp(84*_Og*R?TgAf`|S`L|fc!Seci(-}MNn$F&<n9D3d>
z{1rw~m!G*D@~*zPdr4|));>|tRWqmiKHSLZ+4(7#egX|ggimd<E;%6YRBmcy=cpb5
zqyO60p?3qAw(dRa{J2K$RL3ty)t(n98uRe`o*N%^iF=pSbmf(O!@qU|b6zs+Zz4SY
z&zehVLw{@DwJv+#o%+N(dy9QP(&NmgUaOuxigdQKPXMw7^_))n#PwU;&2BAO<yhU{
z((d(z6xVGvLOZN`W@Q%1vPgN6-U*`Zq9D41_4@IU+kI1arqAoN$}K3?;+rCOz8kNv
z*<+#G`K|6<&DsYzC6el=Z)|C^oF_Kx5a7iBnirMqKl1!-7Ps2?B6pq}`6_EzIy8hq
z{4ay-xpwz$oF4jc>u#$dat;Or5v;yvU=HEN%5UB#z$uE{PafE1qxZ$Uu7C3Fd_RkZ
z9M&k%&(}D6drgkFwfKa<3Qm?|`eTdbyq<L$aP9cby=OtQ@tqJmW<5r2cs}Q>1%smg
z2Q5MH&IX?D%e&UyKME{maWhhHg;SrXYS;j;{uI?aswH(5?bJJ}A9dw=xKGp+>Wbyk
zCn}7(s&lw^)E?@}*`;?>Jaxs{=bZQ!8|-t|XU_a*R(#?#baX9N12M;vEV($adaP)u
zH(58TF(%nS(!TYe+k|-H<Z`z$7~a<$a&_FXP_SiZxEV7X@^6_)*5wZb(~YyUB-PHh
zhAtqCLs~Zs>&=Uw8_IJ3VoXC2^&}f&ee)62wdDeda@r2P7<X9V_=4=AO|}FS<=09|
iRka5B`@dpVpL0JJHT`t`->^nXzUnum@1fq_!T%2=xPHU{

diff --git a/client/ui/assets/netbird-systemtray-connected-macos.png b/client/ui/assets/netbird-systemtray-connected-macos.png
index ead210250d7a4b25461aa0311fcb6c13cec75057..d29a7ade8821d87b12982d8b051ab5294a7a329d 100644
GIT binary patch
literal 3690
zcmcInXH=8fx(;m^^?(Y}j3f+2K#)+R1%y#yAan%;1VWW+C;}lw+Q=x~3?R}`5C%|+
zND~r3lqN;0p#(w+Jti@M5C%lf$GL0Wb?=Y!@0@R~z4m^e=Y96`?zQ%}_u9!eRwe=`
z&z}T=KmrI;qgx;lSI}|$nHNA#y@nrmQeLLFEI}abMGz?d4-jY{fZ{hmpa@kEXv-Z0
zg6D!jVj+cXH}wI6+tb{{2n2eSE~5@aCqhh}!hm^%j~f>#zfc?i`NI*G#{64+yr)kJ
zG^9HD1J1e#qic4US=#(UgtUohA5+iZprhz_(phnnH#$7(FD`VwIh*v4D-ti#f6e0R
zJ8KH&(&6@(afe=c`v>n%4gFPHOA4a`Li8O0vDYgeceq}W25kO&Uwpq9RZuF+3Y&+3
z8Jfe|BYcgFykVU=F<o(vIB`UTdRE@|OJVZA$1)bm-Tn+|@l-j=Y#l0Vp!Z8evgX@P
zRgSm>ts(?JI|pC2tTdObH|W1cB-%d0hQH0MiSlkj^@W1rMRRud39+ay?0`+e{==9*
zi`Zpdo#zu`{!AFEmKP+))TmGM&p29Nh%RslXYJLqiCO%e@K(*!8+*;o#RhwtSw&I5
z_O%p|sO72-)b+1ZqSf+e3?kmDonD`$XoXyNWA|m`5S^`;t%;KFPiV}{ns}A!%{WJL
z{TNa@Dx<Bu6Nr1ZR&OyzBu@MsH=CqYk-1lv?uS?8V)1zx`mo&RAIU;iwW%rusX62h
zYqXzDa3f426!`W>2b(ke^e%A`!&d0VWjS<{gNks&ADwiD&CYYkw(<z$2gj*+)#-=)
z2uu0F*_i{UpQ8M{r?!!?9F5lo!L(5XtUY{uaAf>&uP$_CLg0I<@62Gs*Hzfek)LP~
zIJvn$?z<6bB;$ZaH`Oqf4Z}Wd|Ly>}3&TA^s$FR)iGy`IMlM~&hjh--sZ-GU-OZc3
ztP1@B3J#~OyCdKd5XVlObBgS`BhUGQI)(i+{SRd*1ly_sb<IZyODaQ&Yp2wjX)DO<
zEE!s9o8hkQWp=gQYci(uakNZo+4@gSBc@900*J|uTo|h0n-1CGyQVu`k$nx!v;s5j
z%So;dL=RR)wry2QQe@V8Sq}epMz<E4t9bG@;WSGYoM&B}JxiW=7?BpebxGe!py`}k
zeSXJ{PgN^Uv>v>*I*dKpIg!?K)799dYUvqE=k~`w;U^@X0IYDw+^wAMwa>nfg<f1&
zVj^8<hIpxqlU*F?tvkh;j`Ex}86{ov#o<fs@l4|N=GMP`44Q3G9+G+alaj&nRbLY3
z((=J^@;QZOzun1&&Fm4Cdc{_x_-E4LYf-5!J_H@1A+gH~p<iRh!Zf5W6tDT9B%i`-
zhQw4lHqAV>p%CHH^<Hy=BG;2OngHe<Ur*(}FfP?F_8{q4`?3~8HS;Xcz_}WIPLBby
ztn6$FVkyian7%=CtfwR+FG6R_VX*fXSH!(YrY=O<u-LJ;K*(Jvq8sm!=B<;4@28Z^
z>lOGAY^L)~A}eET)2`#2r0A4nOTrW}!!MCDPj1VcuG#;4dD-<xQM%hRivdm$<AwM&
zC_9aFmZ^ADQ6~YD-kXQ%l=EUXogP$#-8iAjQ^zb;+BfiNv9KVR2Wd@kPM+28)iXY!
zYD_RkIlSP_wPXb8-K*PR?_t9&2!mgDi5&j1Xxc7P39C;#{0+(wl7E)Z^n4h#D>uns
zXS)-r@wYv8b!a8ljbir}M0FLZyR5K(-hsRDJcIC@ph@ZRhAbCV@M7pq@YSI?UvMzE
z6X(QtaQINe7&dWuHYj^LlX2f6xP4`+TZ^n~9$!JKxsPNOX4!Bn52=&eOXJ*xJO4tD
zAofe8+!Qq2Bjj;SrNO!?y2JJj<8pQRe!ZzH%IF6<`q}zH)&nwrvjtu@+*iWf^yjXP
zy*?-R-j;UFNqa^V0(+~_zG~|rG{}*!(5ttIyq4(p?25e>U|<qO{dVe0bs2n~m?kEX
zO@cXg@b0y48bnp-)|ByX{F;ZMdPZcmL)*;Z6AOk4T=1LH<UskuQSxG}^NPJqJkB+=
zfP0MCk!XRxgE%poO~AJ&l=8Ql#Xm2gzx?#n3)l(@3T}i553GVHeN#IGKc|x&uHYb1
zs~t_7pdliz`F^c;)<B-ik@188BGR3)iqO8GC#0ZqGE8T!nRPe+FE?gikXd|fc{<08
znWD8YG*x(_8;Vb0vzFe5Gk5K{zt63ubo599$IxvldqTo;(?B+;?*g9E{9dJ6Oz^xS
z`T-T)LmT=~qlY%EdY*3kDZm03S%(oJ1ycf_%<o644P%x*Ow!&Mn8yQ7G)Pwy`{6IW
zPca9Vxq6{^%?0gpUdJLPhxK!cZ;M`bnjSjv<imXChrCddO-v4mf}1DFQXc7fElZvo
z(bK>+{g}QQeoMCjDVrt&X27lFy!J_Q;;_OLk|0T`c<iHqu3Lc*ZV|nVS;{paFPs}$
zqxo786RsjHFv@cil7WGWT(SD-)4C3{wH!HcNphr(J`N|e7+P?8cYjC3c^Gr^QON?d
zvWgco_n6aF_zG>yeQ#j3box5;AF;7{>oH)1Dt&fWSqoCIEW&`?lnug>0^Y1c4RdX{
z?~S%%I4OPDOI(naC8ccWL9GPrRoK=_Kn<p_1+bw0gpG?<G|@oXZF&(R<lZ}PgWLjM
zcl`)nNEZ_zLHJ}8AWQYUdmRFCs!^{+{d-db+81c9!6&}Gi{O#L%zy2HnQJjnEgTDG
z-C?m=N7I)@h2j;dLNnx}9O3RZ^Y~Dx1$~lY%*L)(c?<NRhRX}ziw)EwD)zKH%;OoP
z=n&aJ>WM@cczZN}q)n}2QBouLUyVB0iNro#sKzh$0Jl=*Lplc<lUr|iAhHAzy@XF7
z&$aO&&(J-zed-7~he;;G!~3ZN(VBXia|pv%W*@(pR8D7u++L4)VMm>;!2#~}+|h9*
zat7ous((V<Z9K>jc_S^IGk{%QTp$`Z8hcU>+eg1E-}P@d67TcT{?u9oRb#4zeezf2
z*FD34&+DZ$o4OG2UmF^}A2cOJKKkp2`i)t?)b8#F8BsycOzM6kDA_fishml9MH{<B
zB`6!VLzuNTt(d?_Co1;oHudMhtU6O5=OS6nO=@&UVZnZ2b!JMIEHZFJnW|q%mw3YY
z=IYkxgp9Udb}f15JhlF$Iq4#qIih<{S4R|pqM49`^xhH-EOVqQq%k?NoaHi}$GST|
z$VAFPI#p)7@wYZ9SJ@9Xa+VJ-Z%(tvE|Rmyk5aJ7eyJ`g9L^t<C#hP@TDvw(Mcae^
zR!l_{Iz#O^$4r><RJ&JKgb^+l+G|{ZaR|T?Y!|kHjWBWbXwOfWVK#4hhjpPv;{h}n
z1_*-Yev8o!j3$K5S1~ln#if=6*Ns&v>sMfjPI0`X*1Dy_gPB&q3hgeF$j$s56ZeJe
z(U{y)-&48QLl>)FCwBS29JYR%JDZ;7KF2xF9tlkK)0VYJD$ybvfq$~<2@_-TIa?Bv
zwJh#gsSMmOA|y6{6hh_d#93G6!U9}Vw8tK29GprOZZMQNgDRyBjtbJMm=|YN8^A7Q
zx!{qyB(1UC<<|ivp3ChQXN^cahkUte$9!Y5;~V?#?b>9mdp+da20qjg_|k4U!TCuN
zI;(l?ltZj9Nqw6tM7x;YinuX^o<2t|&5<V?;cwz^4mzll`^L<n!KL$+1!LxpTSm;V
zo$=lRKkb0otIp=#2jM&8JwOzw5vmy0cM!cZ-VH=bz+bVJ##!C4#A%NOP2b3rOP`@h
zdg)*%mMt5>&*%m<y2~}G<UNcq?Jt^;3To@Q-MC4x3n3Xj5hMf)9>DY&!wi4|{1vU_
zaLz+hNw8EL@|dP*eR?@Bzcur2W0L~Rl(YX1C5egwh;8(+v9lOZC85#q%Zl9WM_}E<
z)J#arRpW#Egydb3cm6uF>wu>2*8y7uZp=V3xHLvYOXXwHKEE^W82_NmRG&HnpmOMB
zvDr94lWlqwNFyI}Mqh)8jsN0;)Kv~NyY(DlQlAl>r@pl<OIC}WSx3Ev#SJnAiGzvT
zqQ=sr0fgg&I@7g8yiuIt-i~=!=52E)HS!Ho-zBq-cRCiJmzUm>mNWe1$X(dY5GT5j
zJ06gmC;kF{={E@hG$G=ie>Wq;fXojb)1Ou6*u8)!_;HM8I=bfA=&?t+c|7X45bzbP
zwXRwiFwxix4_oePy?>3uf+3r;Kyf+BEij^_srN4}MAyAVm{WgPrtis53_cZUR^nWC
zq2OZUjtRs4s_dfuEQX)D1Y(o}bwW;lyO|G!9-s=~)_4Qq4*A>&gmj*qG$5qIRlQvZ
z2@x$^>3aaG!gD7SsA!(gbAuvTjX&8v-lOLjDJ<@#L+)xzeed|Y-%Hnj-+2BrZxfsT
zBd#Xr9f^;^iolZ#Bo}V%81C&6ei!a_|1Qvh)K%5BE~{!@R=r}UstZ@uforNOsj9+N
zRTrq0kpCw@1$+DZME!d~ZS$E@K%nry4&nZ&yJ6uTsF44wQPYI0slwGX{>Mb{{&vdo
OIuXWJMzz=7AN~`y+wr{s

literal 3858
zcmbtXXH-+$)(sHQL=Z3r2`va1lqv!uA_*uG6;VMUQlz(M#88w@AUsOAm+BJ>UAZc~
zNQu-SAOu2H1Vtp25KvG8p#%uzoy+&VfA8NrW1O+qo@1`H*O_arG0slBaSba5m4Sjl
zAhFAr%&b8m0l*Xh?H2(S$ACgFV1f8uvI_)(4#56?1wfhE(tlF|t+D4p<^6I$fDPE&
z)Y23Ls!Bb;a}@@G4!*f;W_l|`;Meyle`cp-{1i@$zu`F<1b(8-J}cxI?GFx4iKb0H
z78sGFA?_Ipc1!je3eqJ9W4p@=t}*?ChjiyfTHX|YxOw@ZoC^!TD0o1F{J%c5k`_~s
z@CoC`#>15Bm?-}0r?l$p;%iSCN{_zDtrPNoriwo_F{O4eSW$%nm&_9qwm6>#47p2b
zcsb-xBv~aOq%c){Eia(~r>S;9g(L)R4o)V6PgAq`>>H{9!s-`n9;`miXH7C*6hzY1
z$l!v>jiNs;DME>iEva<H31C|aNe3OAXHLj?l1qJv^%&=V`r*v7VKVIx)<$lI<BP9X
zY*tTPwo9K_sBjQYhxcN05*=N?+S{1fy38Moian*pmNnz`E^S<&FXfD-oSRtE{@5qb
z%((t=^~mz6G<8LXa>?`*kpN*2x{c%yA4Qx=ol~6pj~Dp?C7ZE~)Jumk#>08<9?3+H
zw}psO(VkLW$ahn{R4t*N+N3UvNNAKC_I}eMWkekmzRvl6WX%YzUC!Zeq&RDzneoM7
zK3nj2In`TB)tIQTt);xd+To|YSmJjFg|0UVTL%ovZI-%X@~CO=b9Xj326iKMztSy|
zXYA)*`|WNL&;|*Czdl4@^V*PfhFzryAyn9fw<U|~AMj!<(Aze_y+Dl7Y7D=l?(nKh
zq7QnRJHhv=(2t&TE?dPC5n=V?^#~s4$3WoDRdhUhT6V}eG=jh6c5p|0-aKVQpPG;x
za_*&9sG;vUts0H(5b-r3v82}KV!VxlYPAG^|F-;D6SETq>5}hoWwsezxcz}&Ugq9J
zbk|;|*us*NnPW#C%3(Ur^3q|gb22tRYNX63o#4gSI`AUMLEl#61tEF)?&j(`M^%L^
z(^v|mbEdmbV_OSvW9z3f*FR>_hh-#o?F%UNRT*ue+r|NvlYY3t{mgtjC?<O6gpU<W
z-5N%AHkXTcGQ5AEIET8?UHfU>8m0proSMlnkiIK8RD5V#$ZTJY*J*ufJW9{{VY9{q
z<qLS$h#J_#=e+W*W2u~Gl-+t6YeS5atg!{6HQ3PR!UKNI=r0(>+=Sh(K=FEUA;0In
zfeiZ5RLj0QYV>R0tr6&+YHIbzr9$0DggozTh8DCw=>B>pdwJ~D_su1PF?HrRzYMSP
zV)NdE*E!j>YQ(9g@R^On0G^#7%K7&FQh82J6%@VL#xNKnno3PN&7P%}0J62~+I$#z
zFuUX%c|RYtVN}s$p2Qqmw(C)kO^}V^%lpD7iCwit*m7idEvH~KHm|`&j&tlnL5`r-
zHhzF3+nMh8FNu0l<Of%cj5=(Iq~rQmg*k(4SUpO~EizTSeM5OXxJGx{pnqQft!vnm
z*0;r6d3p3Srp0K?FlIYMxqpd8wXzsE^sX6-P6~3*CanCUioD^+KE4?H0_Epx!@F98
zESVbk^1GpEF$q8{<=I0E#N;bksLIb-{YmnthQV4z5DdH_X)`y-(glyy&-<ctfg(w@
ziBA>m>)P_P8Pg+a8e6n}F*LTAT$5RLE#0_VGEJpX0<8Vac9%@b6Bpoe6}mrR4-lNu
zx({qmCfe^7^9ZyaRrwGeA+3j8cy(Zcov|5VVoH3KhCk#G|A7v^(;4w2C^YJt;*5}a
zl$n$MBm60c$D?x#2LO8Q!!}%}_*2A+jdDF|xEjT~HGhhQUr=s2IOsV(#0vgozH+tL
z8-bqqL@c%VdC(c5C1(3zmD)3rE039Or!BwbM(1sonXHxwDhJdmSE+t3Q6r*&5U=$2
zjj&;xL#y!muL><!iYMFiH*Xu`(aOI=Jtu*Tnn!rQKaLRgtu<*puCfcuJ*+p~4Ce~i
z-J@H!vaJBFL&n^vcq|ZUg3}n@x&B)*n|<>I{h7n#xy|THs$kWQjH(>eWc~b7J^+qD
zFv5VQc$=XiD#TsZ(#33hhQ1Y@2gnqd>YJ`D-5|SoFGkD#w^eS%AHbLOmd)Xu(l_k{
zg^?nCU1N>cxQ3=rbtsw6p%*$)er*G`6-lK#Yu*-j&o`*8<}r_XE(SJM6xA1nN1Dt7
z$uAmH1LE4k{#?t<+)HY-SQ5F<2R$OiQOC*H5vrW5;dj;>>qL>NW2v<-3-~|HN1SUa
zGDba*x?{wxji+WneO>lx5&-(n+4jQ#5K->cLGGEM`$=$!r%JzIZpofp1)m{EO~R4&
zrl+Raa*0*Z#!Dh4K<-07qf?~_IVhD<<ppi0b}WhIo@}ogk;F~yORF4dNe*ed9;fA=
zV!!VRr{$)fS(`%%<ko|)1J&2K?647!i&(ziNC+|FeS#^c%Bx6-E}z|LopvjUXqi9l
z4M@~~Lp35>Dy2Z_1R^ri<b4;V28pjbTRHyDPt=Jqp`w0r>@*32(d>F&i+U1HSy_6T
zQQMUKg>B`d+p;+O@Xh3pP6mO7s__wI%(M><@$vd^$2Idr<<c!ra5a1W(Ar)r=2wo_
z=0OU%QO)(>8*IDB!bp~0ZrLblHU-CPiMcltQS$rIhuh1#nsRifo*9Kd+vBJuN?8U0
z+itx)(Z<qQ|5NOb6oL4~Hrm<&|F-M1bte~V&ndhO_=~~2BB(s7c^;4?>z|dQXR91v
z4DhZfVYM8hmC>T|I|R*CiU3ggLuXgk;&97GXCqXc*)Jb=eT#-^4^%9UTO62i6h@l2
z3|=gT(VHK@3l$qT#;U<ULk9?JxoJkqvS%%E7^M~FD{n~1cQIQUyryt=`Sj%GtjPr?
zVkQvwj2*aZWJCYi5rE~*;ZAq3jhAsW_*>fS@{9Z!1<o-7y8+QLIK*f?sNp{UHt)fy
zbah8W&w}mZ_f3%>-GllpDPmY5<|uAk?BgfwUvZl~Nxw&_BpDNoaAc~Z#XjcUyP%!%
zDokE(ae|PNX|w9+W&PCRbGe+8TaIgks$3Nn_o$~kYSgCJ6L{qOx#(EkA>tJFApiML
z3q(!=(lLLei8dA0g1OtySn_v{CTGERE=cS1yv-X?Z1FnJ5VgyNl}^$H@%&z&Phhog
zI_%KKVep|$<ef<BKa0nMV97(TA@`=tCR-~g7M6<7M-`60WJh^%4M>Z~I+>8jZ^Ph6
zI(6ZY%IU!E(y7MOQ+fO4Lc+KA&{42j%SOK}aob1f4T(;%vQ$L48(HRmWW7hk51@Ov
ziLIms%1r=m=c{*94(;l?hr-z0^~qe3`wUxsk_YRXZS`r=l{~B$f}Rzf-rl+rY6ZK5
za)%YJie*%lLOk9bIyq^8xhvRx*bQvt#vMrdmSwW4E+Dka`3seH)pf@YE5?8B?*Jq7
zl3GbYoL8u{UfR~tRGD4fnJtvWT5dFHo%4DRbln3RP%a(1gM?iXm5lU<LP$fNcc-VN
zi&8FWmvct3D5+GIN1MXvwoHJPQlbt{+j9&Ri{z}h47a9n@L{4p={{?28|gDcZsSYM
zJhe2L!olV{L&l3Z3876bYP|XhiX<+8c;fZ)nV>jl%lwkW0VDlzSRqrC|NI5J1oA*H
zs-p%+PO1x*sFT^q?GtDecNDhsIA}R=67efH$D90yblVlj&4G_VGN!(P?UMrsMBL);
zOa*&6O0{kB|FL}IO8Xngao+A8N^qH8kw@n>;fKIaCd?hJxXof6(8e}KwEs>DVeNLY
zLzc<Ksg2VT>Wk1QWeS=R^)fkN_KX^oN+E@ia9r8r8d>DT(>-xi>PvRGEEygYM}1*v
zVxh`RIgQR|1CH8kz;S6g>zUD*v=uiTK|T@^N0n^n3!MqB(Rs<H{2${2%okPsxm^u=
zc-K~BTG(ldK=Uzj74l8$XwrH8d42t4YUHnIbzV-655`~Un*qU{^(zuhjEho*MxrV{
z`*v7~GVh0JCp%9uNLQ$r$M3?VLn5<u^+*+eLzPBb*S$O)RDX#~Ot5H{laH3wd9og*
z8<CM2zIr5};|$$k@4R?We&^Lvqxy_-OP9$l-;`nSeFU|QDruf{xtw`VP>4bZj73#?
z05p-+2*D+X&p+)1%S1I8Ed8wLE-rkx1G<bdwtz{qzp+TW=ejD`sy2y+o3JV|E`ei$
z(d-0(K<whhlailI8hsUfDrNy6m836!x|CmOq6iB8qJ-z?D9qrvuxI3E3AOFr&Mbi_
zV<5~vuMVgE@W}5O!LZxzJZRL7jCTiI6|yAhtzp~lF7^6<Q*M$QC4ia)!^kIzaTxMu
zto<?8`Db089j7F``J#^6AAz$#zsdFgPdWoAchS5z?gmiqEE6Umhx&7Jy|mi0jLA_}
zOT%9f(f6Ij?0qLO4^>xQ78XK6^hihNZ^L&pY}~X(^+~gqF8k3VF{Ljh!d(j?8U(=$
zY#k{NxOqweHM2FSM6sk^dDP7cc7yvNF&$r32=v;tkJ4z&9?~7mv_E-Q5K28$%(U0r
zGfw=+(5VYv#Q|=!=Yc;ozhPij{N0%LXZA>$wAzq8#QHzRt?t_BJ!B=<@xUcujE<;w
zwxsR?Y<{^V)81^)O(#H8Nnaq&S#HOqJPsIkJn}b+$4DE9pfIpZ{BGY2aqIaRs6Tau
zXAu=ysH`+yoUcr!mBSAc)9<Js=P5PX-r!ygD$8g8xoB@Xb>wSpOq=#wyl|Ye$0!u~
iKNA1@)sdFM6HoJBMX13Lhkz?A=<>yDX65HyV*U-9o1%dL

diff --git a/client/ui/assets/netbird-systemtray-connected-mono-dark.png b/client/ui/assets/netbird-systemtray-connected-mono-dark.png
new file mode 100644
index 0000000000000000000000000000000000000000..1f7d40121c11e9886d395344ee8ec2ce96a6238d
GIT binary patch
literal 1548
zcmV+n2J`ueP)<h;3K|Lk000e1NJLTq001xm001xu1^@s6R|5Hm000HkNkl<Zc%1E-
zYlu}<6vzMf&YecbCbN(pm}LdM9~3<li^3p~>_Hh4NDur_7DX8JLaZd~Q+=?az^Di#
z`qD$9h_XU5De*((2eCvXvotF;P-n*b>%(4a&YI)7k8>Rwf?2RRch1>+t^a@Rwb$Nj
zPX*BbS*oKA;7DbRz-Y@Dfs)b{eqSnSnWS$e?Upnkso$QB+5vlhHKYajuUgffmjmwu
z2PrRgpdYx>_126>CD)?FJX`b)N%a<<uUelcB|W2T<_|Too0maJHA$~aS~mn}1owfO
zGBQ!AgMUfV{o#98UO^LaN9~hzj-=mB&(I7^meeO{nxrX`PPTUwCG|?`wgLMk?UA%g
z(l$w3tZi5FP+q!}y!@<zKOm_`<=0-_bUi0&hv81MZn5-O2l43g53m7P4$KDnfQsp@
zS?tdRHe3I}lKKx>?EeIeH+`;uh(HB+%?9iT2HI@(0)yWHJ!Fg4+i}3V9gy(8x0#-<
zs5hS>+`vEy19g&@4%pv|$eeN>aAMBJ(h?-R&(}rZ^8~6uH}FXZBz&5GB!x}IbZr8D
z0j@JUJ@#DOrj0?<eOW64PND+z0&7c>a8Jz+`W^`1>%fEdew;mDXko*3zSRhPo<N-D
zNx%;|MXkVp8gv{F>@?s5Brifr76Oj4=jsMFJS_JDr;r?*UsHtyBGW0r&n-x}p#k6m
zvh46;Zk!VVxH}M?3j9qLf_bMbCd+1pJA9*U-$|SW{ASABi&5OrD`X4zY|?_xgQ{Eq
zgTO_B?87--K5i>8fn3^bmq28F39zStgnNHCa01yBf0zSQMEHBMJ)(z{<6WQkxq~LL
z-wuID;u_NaP!C>pLyJQHSxvyZ<U>ioefG`|cxy>sZwkI00+GZ`!9#;aWD_Z?RL$6i
zHVAl#Y__o#;8<W+_%?$!yx%SXk#f3#`3Ax_t(!xi1#N(L$?vWLUbS~`w+p@ufk<MZ
z8Cp%2O(p`rlErZ&@$mCw$SShMKgZrrrAgX65&|)to&v54@1GCAT7i$*X)oDP<8<Jm
z;FM^$LW4}yNj>1_dzWdFHrg?{QDIWo@FR4r32u?}fgO<tZG66nqTu%sn6lz$^O`-E
zOB!d2i@+Z;JAX);Dd|1?yWhslXaLsnA!&lLf@zqInmQBrXvKgW=9vJ#%fMeRX@jKo
zN`!ATJr@R@MU`BiQW3vJ(%e8G^)0yuVoZ9br~#iBtN~xlyGfg&$j(6Bz(@9d8(D&I
zy}kzefHgtqn|Umq5)j#`vTBCbnGrt%1N=#L6t0E-6(jQ{DQ)_3K7yY>ssr3H?wl3C
zF`W|dY;ZKNo-7kpfyuze;H|%aD{|nw7@kqO8J_PQe6Nvn@R(EFG47O()9BNtXeV%P
z_&ycbLE7l17kIuX4D;Z}178$?_ru_vIIawMpZZftg}m>k+kn$Tzl(vZ3p_7iCRtS$
zXTrgc13t@vkB7WlbNWgV@Ifns0VlDMv>_FRgD=qAt?$a5L;Tr8DvBW8zD4kL(#=M6
zN+|*kY&zLg`flpR){xcJ-rq^gWq45&%fu>aL4Vx9^L1ce&KVsO_{NmSN~=yPdS(Sc
zam;+OveNH10p18CS2X|+SzT}#c%ZF~%x~A`DeaoRIYsH0wAsF8w`NIBvUdaa>{dE5
z+@*BWH%ZbB%I-e>8nG&AzNB};_`{`z=RHPyfh`oDHvRAIq!KiG-)G~IFmv_XxcJ+{
z6X4Efp7+*n=sa#p`^my4HlO;fz!^F4zUUscKJi8`ZhFx<_p}4P6#)luCgtw(cL3)z
z{7mm8o+u#U;N9~Ja$}mdW^2F?R{JDfYcbgB4!^E+o4sGd4`v?U%Ph8+=3?GYxc5q0
zVe6zg=1Z=Dk#4ad@|p0kSy;yN-rDKpw*zHbqkEi60JtQCkb`d-^Z7QC|DkDDDoWup
yDCuRTT49OGgiTa73Is+}#{N${+A>C9wB=t`id?nuydebu0000<MNUMnLSTY`xbe6E

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-systemtray-connected-mono.png b/client/ui/assets/netbird-systemtray-connected-mono.png
new file mode 100644
index 0000000000000000000000000000000000000000..8a871074621b33cca4276e8d89580b1d417200d2
GIT binary patch
literal 1388
zcmV-y1(W)TP)<h;3K|Lk000e1NJLTq001xm001xu1^@s6R|5Hm000FuNkl<Zc%1E-
zYp7IJ6vuyOW^Pxn*^}sjSyoW=peU>qi^4t$l8}Z(5``biq6nj`kc#N>sXo{ff{Ku$
zpeTtV$_mM%haVz8h!t|l4DI%?=w7|vGkw_W&t9`VGjq<|ixkX)&6%^$-fR8;Yp=8R
z+Gn6Ied$YIDoEY^z6f{}_#7Ak#)18IZP&)^`pF?f?4)Mbi-EU*eL%Bf%LybeO_gV6
zpbj*WR(GxFSuIu80sQ^IgadTI?(-7h$L;!T341+>2xV=+KV<+W40u(~PXK=aCpw)p
z?0Ot96PN?c0#35NBY`1cz?6&ve*$}eVc<t=I}KDSbu;`3a4R8(2PwB|UUJj*7_iH5
z=YGJNiXQRpZ(s|s4p?N4&?+<x>@r|GF>I>nSBQNNOgDY$Dw6@v+k{a%X9C}fV)sjm
zy?hMtS`Q>NcB$#9Qy?-X1A1Yq#OIjZuXav32RI?I@o)ta8uMu<@KRnQ#QJ+ZkkB%J
zM+lqDbZrBE0<JPUgLYk8(uT6s+-?L!A|t%Cn=6u#rxrPVx4GvzaJ%(Sv+EOGY)I$J
zWx#t907nDgCW^X&f8Xgi7T9gT$BDUrjg2|Xt{dCfP+0B-PA2YCr9@0;0Y7vhAw%Q9
zdBp7SWHL`gn!t^Y=xjo6Pd78oTWe#L?n{eEoC*9wjPrKhf5ygVz*&SBIt7*6_<g|n
zj_jR@F3sBk%%Dx$EF)rlAz|}MNyz&n!12T-ew+5IroOL;d&D3i$4j5aTxa@9#eO#u
zR}l7xoaj{<TJ6R!>;PUZ4JCkEtWO2rW`frz1wJKlHPJ%{jL0@ZR#73ir33+m$ab5X
z0Y?$a6Fr-6Hm8IDgq#kr!a!)#TH?m6ECD_ZrKN8EbJq9DRD(}RtTICz?Y>4R`hF(H
zaXa7&Kb0XHOh*PRw*J{vOq*3i;q)MInd^U?*7)uO-e;%1#8Trl;12tpg3stN6BS9S
zd=Bsroew7Is`zZP#PrBHDbTFV??NzTM76mNFzW~}W3$MBfvo|*0t<lG?S8+_neWDC
z*5~mx3Hw2#gN@3f6xRUWq<#3v%X<j>352|_y<&pa62yz{X9C{<Z@B(RlaK<D_^^P4
z!e+#QR}C}(ykpOYi3vh_J@`#d=S!0X?nPB)%?y1(^t!<RMl6LJZhU5BJ|?71mGd6_
z48l1;j*)X-0FLMtw6ekBz}Lh~R3n_Bw-UYeJ8($?zD{dK8K5=a3;d9g^Q$^Rbj)0O
z6ajh26zvAicF$)M4&7tGykt&MYV@M#(}9l)z^fQs+$(r3{V9Zlyk5{@;8Zv60^srl
zyu7@Ccq;QNA@I|H4-)Xc$h#)dS4lK!y)z&ZTL~LdQ8?%Yz1GIAch56-9VBF=CNaed
zd`|eX0X>`zJotIUrPQV+W1EQQYK<3(Wwah@{4udcc%k2=*z-BCJaI<P1U}>7lU7bR
z^em+HQ={grARa6AZL<ly=typ81KyttCJlah0^SoCCcMCKaNOTbTq$47H3=uVS37{e
zKG9iO6r)3gPl!d;rtWtVj-VdAR^u*5K2PTP-wMwraD&b5+4COAy|j8UZSvj@;PeE%
zymt?+rF6RKdFR|T72pNn461$0-vyjYYfUc__Z5&xJ-;%U(@{DNQdRgDaHSdTRz&55
za2s{=F>npSKQcAK=SB62KpnW5P$~?Vz5kr}1CdrjVY4b3Gi9RExk_udQketz05OCF
ueo`@isKk?anow84{{(zr`qGyvmVW_=B(lq~X2f^^0000<MNUMnLSTaT4Uy^q

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-systemtray-connected.ico b/client/ui/assets/netbird-systemtray-connected.ico
deleted file mode 100644
index c16bec3f51e8e41d8263b2b4b5dc2095b51e1261..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 105151
zcmeG_2V7If{}(_&6hW(q6SP{Xq6TrV;NFVXRVOZ-C@x$`!cu?YthLrrL9JEmLQ&ij
zRMh@0qEd^B3Zix40D*w4{J-CqJWN6oGG0Q!<inSHckk}L^X}dFzI%kQh&i#fB@jB2
z8D@ld5<(muMe&1>ejC!*Y;n9XAwD$-adQ*Jow^fJzY`%mo;YsFBE45a1@OcAhC<%C
z!7Sngai|JXMClL^0`*?4A_6L|#=o|+i6w#>MT)YD%btM{L2e!FKtX4KI0-n+4iZ>N
zloi4?g4{aTfmsB~UIh?}p*<1+`F$nIVOb@02wFke0;)Vukl1QsMqS8{d}AFH{}7f`
z$8T(Zfv}Zlrm)q7j6{ICNC$=p;(F*heDR*-4{$rW%*-r+yjY&Dqdi<Fx_D*Au!FOa
zry`o9%VwEF`3RQ<S#(*cki9$$Wiv*y41EpqGl6@D0EFxSpnpmceo-9|r|ty`o<nFw
zm&1@9K*@fm_&$}-WvMg`E=wrfbRB_oc{VQ_^|oHJEPd@VgOZ`pWxiBdtRoAcK7~6_
z;78{#7W!uW<+3a*uUNXsMh=O~H-h_v0cHU#0+<Uh41m&`I4-h@FSbSV(Us;ySqOEY
zZSMz&1(3AyP-W%xaZeaWh;TI_d{aW6u?R^9q-kyd&`OgnMCo{s2lt?Z!9OD80SHBa
z{fr}k8vyn{)DJoyP5T*91!dzuw8Q!cr9rJ2_Y(*a^h$#SZn{ran+9>a4}ta&suY3*
zXktY_Ik+{aAy6;_aMNvBUg%wf7%r6H)`$jipL<sU4XWU#^-tr+P%T{mZZ{3_Q+O1}
zL|qz=s!4-X{o2w1xE%qqWoe+EVG}dt>7iJAV}OQWN&GJGtcLLi{rr}qLDD8AueG58
za90NSkD_4(;PxoOt&j#7lXxSPK!cR7B=gE%1MYF`m4JIvG2F#y5aXs~1mhJL6@U3j
z$U$Y?SQ_v*g0a_UsGG(oFQj-b$}^Q37sbQ4%;XCNMSVpvJCV#Ic@4O010=Cg_R8@~
z-FKOjN%vc`B<oY>8v3E?fI9(zstfB>l?I7%T`G*%tEqz*^8!v=02~+5d<fZG7=ISG
zzv47O9vrJml-;5Ze&E{*%1X`|it17{hL)6z%e*4l)8%li*;Ex8ARms^&jHY7r9*jR
za7nv>Hp1q~EqkFP{4icO1H6j*+#)(qx03uyUc2}d8<Q86gSrPRqCx!3+oO<g8F{o4
z&jF-xdn?6_bR+_p%hDhob8J-=H<b_jBMG^qU8q=oQ8E01g4HUPmBQgN7uw_0Od&oK
z)F_`0dF^Q$;CiVVWobM(?}=t}vpgVtuR-~u`3;n90WcY0J-`WoTL4c0-T<Tm;Jh*(
z;0(Y<fH44)^pAu%O_!=6(%+hvfwm#k<q4o@KB<VN820LHZBZAM2mH835e1+KpS*Or
zbN-@AHMju$P5^TNwgH5e07dhC4Nw`2lmiI}so!V#p9YZ3&0+C5Ii@^^91CKTZ$T^y
zO;?!~vf@}mSX~g3Wqcuz{S4L_7Q!+Ew~!D{K0pp34ru_%gxK&2u|VJv0;>}Mri3LF
z@&Nd-HjxG({liHl8^8mgXq}?b*Rf6kEE|6+N&w~#JrPvQZcy2P?%n`dV(4v9#Fapd
znDz_^>9q{JE)zTeooF*CcbaxO#5Bfi37)a|?Dy6H6w(0n(KbWVEE^&ZjOYRAt_$!H
zK;9TdQQBRYSK7%lA2IEcHX}<r9cRpzfOd7p(aLC7WHU6)vLPe31oJPPcjEj=k-X`2
zWwa}^8Ke_ImVS&gVoN}~dkORxfXz6|vzd0YNfn^ujRN}6PN@DLLPd6^wJnL~z!ys3
zL7DvJ*^ZQbi1|>a2ZeotJh{oH0qr=S`>X{I-GN4$J`APS@DLxSN#v2WCoH2?zXY^z
zDS>`mU%KluHA7MVgL*()QYcHj2cQ#M0@|wqD4my!*YfVdTC!Xousz7?RyHo?f!38g
zJt*W~wl3K?(2x7Bbe|&?QtKXH)?O6yAX}%rIPjnoTN3xD#rAMqyydQ;mdFF@Ns+Ef
zu%$Pu=u)0+K>ob}iuSlmSo>7S14a9UjJvR2rZA5JTSD8?*oKfNp#M19k;_8q^*YJ5
zJBjOJ^hwZ8t@pXi%Dlu5lwQ-PWhY}xa{Deiuc{%?-pFNfRyNQfwcaQ}vut`153;ml
z8K?`}(lAB%#d=WMcPT0>FCB0Vg!S+|CG^VDk8$L|nF_zOb1EO(m!kg(?5mi|!-r{_
z+PiFhKs(xhHs!Z7S!Mat{7Cxhh|;9@C6>$LV=@kOcLcz-UaIdzy{oB%V)@bUhOSRs
zH{}b%B;8mS^qn|{kbZvQzK6(nsu*3W@`ZhX1pRouhsiZq5$%GeQ12@lJR%*axrZmk
z7qovl`#RV+cVtTbP?saXGkLVrX)d$nKEF!T3G|z?vZv!W*a7nUQ+4<Po3RHPOP;@|
zx`!y!@3?^OXc@=}$EicBY+k4j_gT^ZOBs%$doJ_U(*f$Ngt~Emzr^vLEZrCfxmSU*
zH%h2q8bA6$%K8z?$h*k)aX%Aurb7MTt)|`&_B$=1UU;6XRKFAr%Jx8uXvgQRw11;i
z9Wr>)cd?PG9Eiu45i)fstH0R2R@0T+ksSZZVs*&iKduV>Fn+>)<^wWiORBs0eHaTU
z8W-U>Tf_Q`%{L`^g1ut&huyAW-Nk4E-(Bgx6Z(0VMN0dcVs*&S5(i@=GfA51Yj$8J
z(vEwmCDoz&eeg9X^2?b9G8c`{R4*@|mSR3D@QlE*ykehT`Sqwo2gv&)C39(?5tYg+
zkR|S2SEuEUA;jkb6wRd+lv4*M?l+^K$Y^mNT;!+2K;1~kW*Pe1LK^ZA3V?g`I6gxf
zRG}I9#<3`t!+qh=uns3H9~`fiv~HvdE;<j=rqJhx9hie{!4AL~zzqO>yT<{bFM<aE
z`WXxaXb(^y=v6r1pydSlu$-zgq3Ki>o?&8aMAKJN$c7zOpdbAyG60m(rOrKtK0hVV
zqv?I1{X2jQ08F&EhoF1#de`p{o{^}Ft^oL)l%5NzuNxozQZJ1S<p(_A9u>AP>_gPu
ztMZVp(HJvIz$gKu1oS5Xk=GEu+k`(+$PtBw4x%vMMik~)Kv+mj(@aHSGB__0A-W||
zp$(64A<lCE&m|0Pczn1N@-3p1Z6HiGeVzvIR|%6@**W0Bgf2_@EGp!71$Kowq^kqQ
z^GRKsKq|Dfxj}`*;v;pRAbu!E5Wg^49P+`x3FADhg!-fYfe#gUQV{}vR8$DQR1{rM
zoC=dMbb$B0Fa-K|k|EGZ{iqQB0ljI2%L7L$loMYZCSx9mQ&mGqp@a~ARJuwb`f0fV
z@BoVZv>@SYc%KYdHvWtfD0dQoy{4rI<&H5G7!vbN@0ov9GLYf@tCE2N-oFYNl)$^*
zWFTI{b%S{*6VMg*5T)Mnlh^!J<XwL<5c@@d4Afc6k<E+#bd%-rE19My?|P8|teG|h
z-m|sfUzfb=Nd}s|cLp-k2k$zU0ocHocbipj2m0h)4>Ax;P@@en&ASiu4G1)!%0iut
zk;Kn}zf_cgs{E_MQ_-4ismnmL$D!(4ITJD{;+=j@7=R4+sb~ZE4Ae#j#dtRa8Nhx+
zZQx6teIHF^ppbXNkbz*i8a5zg`w0qQ?^~7e57p1nJeCxeR$BlYz<rt|m1N*o<ik?{
zJ{Tp+pd_AU@0XqosC{7BajtY6eIBI!m&%(Aq7>Qy@(z9;l0Hu2>vAIl;JpPv@#o=}
z^ZVrSk7;Vj0Naf!ZAZnnP-5RI+s2f|fq(SV_+t0ye=FzA4NdKU;vMCsqRdK=0i(R5
zTwrd1KAEC-5`lL(|3{I|<)tgN0}0;gvIT6vtj@~xf%g>1fN|bwI)H!Ns~2kM^D9>d
za(Jiw#{f^Pit8wnV{4u9jxt~eWSGOdMyYaaoYq@Op_B~d@{WG5;D?EF22klaDz*ci
z@=oy&=hDDAnI-X9(tSz>3VBB#Svbc=%>NtkU93#oUulLwkFS^}VJr38zC3w|`Z)zY
z&N62vg_I`WV!cbhdxv8^)!#po$G_4v8UJqd0aV!!nrT@9ZV!NB&wf19ON)L$aoK6$
z-!A!_6<wcTnlDxAgJ&N4K+5-D#IcX!^Y;|<r@-cESt|6?4iaef4zDWwO6CE+`vNHS
zKV{+_Dw=OP#B&Yh=pWPWgYRdFKBtmAXnGB}(9ck%wQvPvf6ep{?{g{Oolc*tDNm}F
z1N`WhSoEG;3G`5Bt<k#EHdNu=5cK<$@{?ATFIDnEdq>}AwS7x991lv{i0FJwTF=VD
zt*Y>%ZXV#>5qQV5<&@!;e^0}A$RzCr&yZCSH$IExo>`$T&vbsM56@dkQW3vgI@Ns#
zO_FyUPpOGJil$xL5cVsp0q*;1;xA4wJ`dG@Cs;JsQSE&;S)2;r*;Z91@V;B|GgURQ
ze{mTcw@T@?gl9eGRiV$5<(rNtL7Uas4<FurQh27THnvdGJ9LurQR9qInrGQiqdhQ`
z8}N8W8$K14b-{P=RMC6!GjU~kQzef36SY;fcg)8Qrrvp@&VW$FgSP1<or|o&dz8v#
zu}4+@#e18f+VWRod0Z2gcP=xeY0=&l$pD{+ZB>y0<da^*)S|B|Ne0EvM!~V|N)5&q
zs?qpYNo!?5Z(vC@GkPD_hha>Ib3`rQUsa@c+4KpDYykLDZy!%JnakprjsFL0Wjpb#
z5Ju&yn704qt(5_8Pk>_U7doN|=Zq%+hO+}Qsktg#<2$MPlEG?O8-Vd0&Smi|zM}w7
z0GN~ou8qV4V81dPa1}c<0iLz!S0>sw(7hb8fd)re8A!%qPZ!5MxSxe*<KcUE>jBW$
z;WR)DKpa4V1YrCs0P1xofFA(*2(<=KX>Atr;aZCPbtL9xa#WIEL%9b2@%>??>q&5*
znRXH+a5EIXCFubEdII1X?#%G1xSsfuo`;fj>GK+RN52}Kjz7inEp}#tKKU#O7tn~l
z)|UX7?2jewN~7<Llteev_kn->t{jd}q5#zKx02*l(Y4f>4NTL{bbZ)n*+JAgTxXC4
z+K0Bl*jZRi^J=WmC;_7cj1n+Pz$gKu1av0>>R16q|6Yl2Tos4@;!u35Lm}b9r(%d{
zKH=c$1r|BP0YjTKVgsM1!SBmhV94Ra$qI130v>cA3hkkS97yjB734!cKd2xd$_b%@
zLSpe54tanO3h|)=ER+n_JSda~*Ki!fs~iaVgmX0?^AHFBLJE-$5mJcFi7*rq!vPIK
zye|rQ5ON?60fyA63JyZR3qL59BMzy99H{Cb0YW~eQ|Lt@Mu8-%I2^}76^D>24v47Y
z5GGUk2uB<`@I`S4o+yNqA@H;ZJRyPt3n&MiAwmizAfz||K2c;S0}-hhA`4WQEDouN
zX8-V<2*68GQ*=%QkY+q50)=Ay86{wpfKdWQ2^b|{lz>qJMhO@tV3dGS0?bMPzQ5v)
zz-+C?+RB0iQ19@58g-6`(FV$b#+ai~Qujt1U{0=Op(c5{H`+j1(46)(D$~8u2DF#2
zA=jXa?u|BJ$Qsm~Hg$Awv;ocKY=|W_(Y?_I3{jKn)1-~=jW(dZybY-Y6S_CrfFWsA
zby}FzeR;A0c+V2wuf_Ld3=Mq1$6DierX?*y7rHN3Ho(O9OclT1qR8K0S$Z}*SkPBe
zhnimNQupP>2H<;=c%}xv52;Ki`np%9bYFgKAPf6{ed$;co-(QX@?Znvae!uL3Nd3h
zWm@;;!Um}CF_%goP%d;|PHX_*pI6jB>mt2e>AtMn0Gt8A)}#K*rS8kV4d~_Up>nPJ
zvTOrz9*#Zq0ZhN&FZt{+Slz>V!CVAde@uk92BGQtMQN1-{Zr@X>)=^n(7LDP{k7YG
zcs__{D@nFnCa#&(KV$6_^-b%Z4!?RE2+YEBx0ukmY#jz=1M+llv;mO>K>rct*#?y9
z-e?2Vw}fy$sH?q!Qtby+(Y?_I&;|q>b<_vobD>mhKpowG?KS{wLijzgSLMY9G||1$
z2B@=nWyf($#`V$<XrueD*#_7=p&7J)JYSbdoy*pxQyXAH_g}RQh|ai_)fv<AY?oP?
zO!@v4tq(A%`>)#uvJUIA4`>D7Q-p7FWWzW67_$Lg=>BW90XUQ05%jN<`5=BzPvUzl
zjM)IKD_w<XUrg*1&~-q42EAVZ`d`g-AE4lyTt*wvmC<TZuXt~OvH4)J@6SkolgVfU
zTIfnwMd3Ms--yt9?5E;)NsTt3D@AHiFX&&Z`5=BrQjKpj8*M-fUFo8zHojuix7pSI
zF1OJJbfHKs>V!T3zsIE3b3jAg({lrz+5pZwnVfslV|r~vUCv>(P(Km-im5ywbXlR`
zdyCRzK3dm`LY>$ErF&d^V0itZyy~8|8~6^+0#*6|7x<>6M&BKlZySu-fQ0U8n`5kg
zZPo`2wcXRY$51>UOj2qC_}%d-@QqFRy3{nC5gp0VJxvcI^`ne5v4OInd*ls&Fcwto
zE2bOWGom9Uy8lwYR|Z?erFQ?-v4OIrds-^c{x1~k1MvIGQ>E5*X}K~PYSd0u&^<*X
zJ3tUc^Qdj8iVc)S-J@K@^T97;LHM3<EBKZ)!+pM@`qZ)kRdtW!6_HJ657$=rba`bq
zP*!zM^9HioM#&4msXbk9x~FYIB^yv#_c&IW0pCIw&2N*KI*$ZpCC>)Ry6%xLYCaes
zNNqJ!@48pX2Gr6$=-<VwNdIUDKFA|eKS>)X54uOWuz4TNU_U2HPklbEbJ<XCKcKGe
zkq4KBS#<lyFq<8aZO@ecu^!ZWdC@)c17m<KFkTY2npSG<pSA@l8_-1el>S#p>0b!n
ztlx)x8h^zl0J;wrKP!dQ8ZWbReOj;Tgp>_vs(UCWL|dkLDhh+M8JQ0jmtfgV0p0r-
z$w#~&&}vqx_W@`tqV-%&Y!Uh}S)Ro4xU#D$<|zl6ERriHKX?wPzsILe`_^e*nX#X=
zEd&WXn3rVPs}b70hg{u@`v8}Du*a`S+cSVNE=y#d{nGoKub7+<mOaf=V?A8+%~Pg-
zYAgtAC}q(G*syk~l(#@ZNLkby6EuTd`T~4e>yvI9QgTz#$IGy61lBD}&^_J<{<9pJ
zkY`z{1NiQ#s_tnS8o+!|E&D=$WSaI8!sBI0ciPg*4$SNf@=*J1AQzZNm!)Tbi?7mW
zzqD-xW%txpu4SP-=-vr*ud&~EtJwxIA1v7p!B3%tHZOZWuDp*0@i_-F(e8X$+zT!P
z^Fe$MNlpDj{;WA=p$%(7qgeMz>dU0~_}OK?;Xeo1ux_CNudkTi8_+~oOqW5PKo*G_
z$V0viac^LX0Y3*|&st+%g9KZcmVas1#}3Y{46=yVSRM-Igt)F^sAEAFA2r5(#rcEt
z3(CjdfXJsaOJ`?6mx6Cd$u_6{xKCbRai%oeEEBlJ{=8?HZugS);rz<b#)2|?{ql6H
zYMMI}dMJ%L(0>E;q*L9~c7XdU2J;;7fH@!dE7G)S877w1`5=t-b$Y&slw5H>2y!<B
z8(^^Qi)<)JQ0zR}(rC}>-~`=omeNo0@eNb$qo^K~d#URmpZoIsJhbDVabGcYbg6D$
z(0wug4ZYX`&Ifh>et=RN({jvTWXp2owNqU^lt%ti)4jNTQRe`Z)_(sN|88Y^)cl@-
z&j-O~z2(@g=KN~dXO@bu82a~Vw$`VPd~TISn^pxUwENM9pnIf&dN)|ldjojxkY4x?
z5{y<wANtG#e#`@bcjdl28n$IkW$Ge2`%me!nz6AWyq}^eof?!gC|@z4UuEAN4S3aD
zuK2#7K77USoj!OcS+BeW3Ig@nz7^qO2V}Vc-zxcS=~+IMK3o>*cs>Zv7?<UG>i4Dl
z&r<gl1AVpzP}_G$-*%u&UorGW)Hgpx_<{rn6tzoTr)%rGQ^bR`P3uIK*ghG1&P&WI
zUA#+C_q5!C1a7+4wQT(`&PU&!Bz@{oTU?C$iow`YTbdXuuh(~n%A)QmIWzh0km2Z_
zw!s;)ZB!R=vF}a-Lv~BkuD1~TYi*wc2GQr!egBsbd}y<6b)j>*PO<OKt+J|nif-H+
z&~!eC<9vOs?|jj#I&EVktt+NOvHwO?nby5nrnonwb{_zH%J}}df%BgY=O#MqNcVd2
z-_VzQ)jC58_7e55rq7gZG5YS1*mp-)-|J+GXSM60e8nW@af<o_>V0kI_wm)HSIu_8
zn6DV%Rr@SvHEGqgEELw?N|~=1_>-5?nw~;>)sSmE6TV_F&s(nsPA2HqZyoa99l|jl
zuIZG$HZLtZEq%p6_od^zquIDuns+tokn$CSvt`QAbG{^=Gc<j72->`Fxo-E8_JQ-k
z*_j{JdN)_HykTE&Q+F-^dN&B)9X;3|?w##q2WPP%#4|@qYENbJz8bz_Fn1gdaxf_W
z4IStO*DihVOi{_U0clY>z-0(Fb5)X0Mc2SP`frq1-NQTPSsTGWsl8(Uu^%v89|o;#
zQw3i!kj+TI5eiUd*Y+i3gm!!jcnVaeb6Hye8}XB<!w}joQ#7b`&NMqH&lco{=kee-
zSaAN2-(-X5rNKTU(f{NIz-j<^mTR^TQl8eh<>+d;ti7uf7k{h05j!ZmKeUs%Amfb?
z;<{iw0Lq^!TUA!iN5F%&i0_kOTOEe$-AJ1{yeP}d4$P?w^(Fx*qoXX|)9JfI?BLwW
z;0Fk2`DAql8yO7pn+(_3e*^-6tq67kghJZ!;y~#W?ooL{AoPR&XBLEGsD23Rg+57{
z-k7`xHic&r>C2||XG^8%E5@XL^idb|ZyKFR26m%AeQJU$SkPJ@@+%KG#5SPu*<=Q4
z3wrexE9-Uu`v8qVkBJ7VOAY&)tf^&PFZ!e(=M$iR7`GUB->y1+2KDZcK6R-LF3`Ux
zKzSJ#>daS68yOpVS<(Cu=P+fyFTnMjMuskLL!}R7hwr>am2o>@)K|<<b)`$X#C8w?
zVcFa}2@>?xrF_1Yx?#----p8WuCnGIU+&MD*0&A9oUtyfTTTF52nC1-FzmiTOJ6a4
z%eSoILtjjGP$up#!@4-NCXRa-h6AwHUe;u4q}M0`qXdi+FiOBE0iy(r5->`@C;_7c
zj1n+Pz$gKu1dI|eO28-qqXdi+FiOBE0iy(r5->`@C;_7cj1n+Pz$gKu1dI|eN<dly
zLcRS8xzeceInwbQ2kCg4jdVQOLORYjm5%dR(s4qh;)R58B@^-q;Yh}F2yvj|$tWNP
zVHzPK0^kC(CKDnefQoa4d_qJ7KtV*sBSb_1#^Fko3N->E$O-7h1mKkgl`0|t<2FL7
z77+mur_j>`K%7EP6TriY_=Lq16CjS8LK4LQUzFb>Su6nvu|69hoQoMCj`$n^B?se>
zj`VPVPzP}w>E!}plms9j@`Ef<5<pUgLVskLk^nNu6<!r0O;{co;s{?+i0HTjUeE-<
zeY#=}rbC>nm?nTH7A;KxpCW+DNacgLNVj4Fk|E9&f_?Et1Yw*b1p7)B)r%T)5av)q
zfLf3aAOP$Ogn)5m$U>M*2?66Gjqxo|2y~n!<N>oHw8$V4BC{X__)&2`jDry9cxR;X
z)t9)vm}W@9`tir5?uzhB#*se!am4qNsTlGg`tfDrJaL?EFyg34$YSy^%|cY1MlUuW
zihZgGrA?7|s5qrfAxKgD6UX^<TqF&&eDP0IKOGY@NJ&SO#=#7-@gj1>45Bu~KL^ZD
zO9Rp<29xQ#;yC|HoMMpoB~CH)B}y?Yfu1r~3G`H40zIWM3G`GvS)xAFAYU@hq56R@
zDG>h>fhz||?y0yWdSpmCZt+DqR6Q1w(ts4xFUq0rn@W=d4DqORVj&7xG&vkm9ITl7
z73Je5Q*j%*99NW~h)oegz_ut~k%`iDIS9o+u^5ZuV!mh-rR5+tNhrjl5PymDskqoA
z;l4-@U*e()#U_bJsr+J-#CS55fLEfQNbz*c7>XqDKlj0XtgUKWfv~Lm_3b$fx>~qo
z5leFj#w|GLNk|R*em%PlU;60%lOgl!_E~P8c3`>Fitj5~O>4sbY3Y(1mJ577PBMMc
zePzJb%e*${AMxIIscpBv>dfdqH_T6tx_kMB{re_iKW*{vaxkO9-V@I_RVxpOFgsMW
z*Pu%sD(|dqz1nsBlkwxZxu01fryDI8?Rqb7(c%%=iKHqMzd=KfS-1`V_jSan!=c~S
z2%c+_Zx_&_`mm};zW0dD%DK2LxrHe&fSv37euK@4-Hn!71Ptf>+-t)6G0}<5j#+eT
zy)iTXbb;BnP8ADB@D?xIFn2Gx`66!Fi$8mRKj*mLE^B-8!urjD*?G-gHxA&e<7Jug
z)}#*Y)pruF%3KyP<?ZS?G}C!$>d)7Y-cNl<k_WD>Tgz*I>fSVqs+mh$Bsm60KTLg?
z__<{V)3Dy_BkwI{&9w@z@~rB?nf<-JauX_(S=R;x4;kzf{2oeQdXqGTY#QP0yRmNb
z{6TP8W1run`}KTV@TVnAY2e0-jc^!ZSNKQcV-~&Bm!0407uM<Q@zMEy?)JOtJ<nLi
zy;h6d_x$Ly<Gb2RGG8?9@+s)v+5Nc>y+4GWt6w+f*_)BM{^pmxyHwfX67jxWh%5PX
z>OVs++>5Rk+pBBKLseQd&s}Ivw)!k`iK}OM{@9J~P5w*BYnfZSg~_n*hn%@*WA<QD
zdR{-?vx{C)KUOBK1XEoLcD>4bnz!KLU5Dg`j<q)Vofk~45ZbI;T-N9r{*5bf<IkGA
z1^4BQud_IOpV^_*6L%)}ZyB2Fz&)B8{gd!hipA*srvtpR-!*x-HD%)9QzV4r+%(!@
z(B-Z-e;^?3ArpUl+~eup(REU5W^dVOJ#zonD{R)P&&NAeT=m@S>cn~;OCN3h!Ru;@
zO`pwPQQsszUw-FCOn%)bC&EI^X7~4QFf_-S-26Q(AuRmm?}>-6kbnl>nVevMOP^k8
zVf)yx8`<yfaLw^L|ADaerK=U9+?*;8x7c>E5+Ytb{m#m^z1Nz}u9sY|>XDd#FaOBf
zV`5Is-R);2CvI@eyKn#FnrG}s{pVS(ZTa2iv7p7Q-jQDUD;MXdy=ge4+QogmHrr3l
z{cwF)^46}Q{n}4;zuDc=d_sbQeV|v=mZVv)AHHuLTd51z*7Ue}v*xDkJ66K1wO1~U
z>iSo!1k;Y^BZdB{^WEp0j9cdQ?S-)~R}8V{J>PfUqhQ9P-2oxpM*inofmPUv<ukI~
zgt<vm6Ay;^ObgzYz3Rom*o4#fl0t<y{@ya`-{{FpTG*H!O?&m7r{%cJN*lq<|ER=m
zxl;JrXL%2^gkN)6?)H}6Evx#D$bRQB&-Hy{t0m*2dNm!)i%n>Ia_5K%J?1~E`Q7$8
z{hkIV$4!e9F34|Z8}?J8Uz3UEH>~S^To}`J;4=H4f2-yF)?xQaNS@F{xbafr%s*TE
z*qiwOVDA)N??`fL!#)<raxD&CiA*~3d<E<F%AcnFl>F1c@wErAsx7K;wsBl~@?Rs*
zN1WL%u=D$D<ulG^``<^Ls$YIMefu|wynV5!nvAQwHsp%i?8k3+MPGXJBdccNl^+%-
ze!P|%n>T2c+pY}>Rvpit&Yj<O>8F{wyh_|jht9uWl9DwzFR)4I9}eAKat89Q9N-Sk
z{wK*}{L!>!kM|s$k~r_*D+Bzq&)gepb@o~A`X4U6aPP)FK&%gD@Rs-BJEo0W4;E|J
z)(qwTJ^zo??7>+-_1ThQK^|7fG_6p;_V2vJZ%O;#uKXUm?QW{w=Z3e<QW~tbTJD`Y
zamA<eZkM7T@<vrZ8Icf?^l<5$?#-hoB;K4mD|tXdsOg9U+|j!}=Wf2Tbd#G;hdOD&
zZ~r;-zTIK(A^e4P9<HvP^C)X|xBvb+W>Te+@3RJB4ozP>EE|(NW_#O-->usbusiYQ
zF_W{YIj(!E^=$UKk7tZ?-j*!Z=imm(L07_V#;^R7{lUtYeZ9^0)+fU@b?$v)pRn$Y
z0~K~zw|-w~XCH3Z)B)i)3KqTJTE(aO3Ujkb53ht)Y*DT4wR@nIVR04C-icfFm;I<P
z_Kf_%22&=t&zcw%;qUq2k)Tuh!asdoKYp7X`mWh)hvwC1n>6A!aevjJ&cU%ypida~
z<}bIy1#`l7Kd(03r0^bRY{y}#e+_2Uv}_)JF|FOvPy3?nO$wV{d_T(H@At5%=ihf5
zzbN{~@`U}rOgB9yi0~hI_R0j4!c9FgyrS-LQpug9W~<yrSOwnhAJH!PzQEhPZT0k!
z&L_E<+`k%xMUA)^5N@)+$(fn$a$QsXqVJA8-@;>Ct!-}~3z`Lv4Q|}}6o^uABk=g#
zso6h=ZLTqJ$B;SA^K1O>Fn|7?pAYXi)P)caXr8gQ-aUM3Oijvi+F)nFjr<hXtYiO4
z7v3Cj`|n7B_0gv{BOeY3TQ&#^Ht6BTnQG~LKRGhV`7pQB9H)EEpZ7ltj%qmN(KJiv
zhJ4R>u#(yx#)a=$vvR?~@3M1O*pUv4>-T;7&#~3dYWBgK|MR?U_HMRsV%#F%T@`oT
z`6sKe(v3SWY!VauNA>3|86WlL!P%z**XZU~zO7%kz<-q|IR|zy!l%Zcq50K&r<*=*
z_&4;$=jxl@@g`)8tvkO<!o1FQCl5PX9P2ZwH)mFMjljr6-|gNDh6xs}Yxb_`aGTJ`
zf_2vmA_D3LbrAHgJtJe<m40O0>*-ggPZ>Aaa`^M-krOA?zQZ~F(Y)d2$wR#6u8kiO
zYTfJqD$RU0uWDA)O&9mqtG9NCUxc4?{-A}qCnC1FEn6J<c|mU1Dx_dQoj;Q{LU(_g
zvuqWwLkIUw;}iBBOfRU+T2{AD*l$gvpWLtWFfw)0uDZWi*qeARa!d3JPKw`mHo<gw
z0Ox%DtDPs95&p66z1rM;d8?xJn)NUD*H4?7IPaHsEE0bBPOCwH=2Kx6+oa~#c6;T;
ze)<sKHM`$0jl;9q*TSr;zPig@TbWfW=9>jA9{JW<AD2Z2yFMDYVz2j&toFWDZ$(aQ
zFr9aMUc(2qGrgh8GY&2ntS&kK;uY1s3ad+HVZqv*b7}2j6A5`R!l}uH`CfT7md8Z}
ztvnPy?13M&@YLmXZ!N7y$cl>O*@TZ1x2C@QW9w2d-q<`s9@R7X)c&4VRKt%egB(BB
zUi9SUt)8|la>~^Vx(s2PizWxR6#mF+u(;X}@Yrpaw<xq}Kt<wF&BSY#Q_6~+$9umH
zw=>&%z4`sPRmW}&U3&4Dg?sNhV?s{PN}RXdtgl})_h!4#RIB8XIB%r8EAR2S_3viA
zyJYsFL5T3z-nL%Xd}n4%Yj~3o-mi7m-aHntZrsKzEl*ZDKF{vc=jFm)0oJ^WhuzmL
zv5j1uIIq@c4u?~dwQA3tyjZKYgxAmVnophicf2k;Z>j2gsr~C)wi^rG!a{fvlV>*n
zZnahJ1%BkE+Ap7cv&v*#&Q80`%8oS$^r*V*TFS)hXHFA`L=bXP7J1wH?Sb)6qE}Wp
za;|>J_jB`V9C&Km==h58#s|GWzRPkxyHz-I=-*@kG=JM!J*pO%hD13ndv{}Czr|Og
z#<uyBkSp(+R`=T3a%|_b9oheY>D;YAy#E>D#9MKK<+kXt*X23$AN6{W0iE04%EU2j
zRl|+Z`?$3p%}fn%Ik|nV>E`Apw=-VEXMVdTbjkGj&yLqVy*zXHp5ELU4-)+%_Ws6t
zaeG2sVQfO;nz8p^-ZH7RCq0IL=S+cTF9*U4y<|2uY9%0;vB1Us`#E_zpqDXK36I+#
ztjF9X|5bfBJ8j{*sn6z(nQcPa&vp8=KXtx$;_==VvCigidB?LS{yqW*#IM?(v>ESH
zV{O5kt}Sj}{?8$d{rX7GxlQ9nq?(XlTUVc7!(>jz2+oPe?e1nD$Qyq5|3FVyUAoRW
zzh_O|1<&HFb|#oPRh~RHXXn3<$jv%yTh}t_mVGXJ*U@-hjT+etn~tqR+#<#YPaXA;
zGs?@Q&IMNgNqJj`ocud$MZ}@|EYdn*#F|RnU%>h<zD!sLRy{J+l!Pa_2YFrIG4z$Q
z<L`hn`s%&vb&kfoa3Ay`YdRS{D)AC)^Z1WZmea`(pSHXGcFFAQ`-ENRKUlAM57uH&
zT;INHdd(~9<%kcpk8Fy$2%|n0yU+OX!7rNZp48^(+rc4kuU*1K@3ns-UEQjTiwY5J
zZt`D`cE5m%>`A5JZ=gJ<PZjsM^&Iz7Ndt~Rce&?pPm{-jg@^y17TqxCyjLGCFOe7g
ze%}5w)xD=YOgIs{ZN=LF$IoK}UzwkpkvPw8I;l{@%jrtni7lOi{THO4`s08n*TU<O
zU}p?rhdZ0S;3fKX*w1c1Jonz7d)szYVQq;?u!la*gV>MxXGGtHi8lO@l&J9EtXs^P
z9(cWnTb;)>?_3Fvnpv4w?d9SclXo8f-<y;;Zd^ah>Z2{!osQjB(cG;cX!0=m0P5Ph
zb5#DhKYDn)ndx@T>+(Q0Y1-cY`3_Rc=Wgyk;og+EHnmL#*qH>*$jB;;S&|OmRcKj1
zvgvZ4PJ?U;+nq~#Nt}k|$Jfuk_n}rlpWm-vXfdQO?>6VR1-;xY6a79;^sRYkV!cb-
z59eghJCYgxqH@^YSGC)95+3w-J=P~>)y#BL>sT{8XS3zPzi)0^>p(I`MS7Z4=2;2a
z#@FZFYHxbV#q9s8bB}Gd{dM8=uwf4-Jh}OyO^(a<4ny-hbZWpS2Oax)XXMmuUdg{{
zOlU+slU5&3{r$=->W2`{D6S=&^snu;zun+PRXUnB;<miY{c~}3?(JEYfA2C``sC&8
zndz_ITKnG=9(v>gO?qfX+_(1+2fR4Cv`5(Ol(-)&`A?5Gy^;LxLA+Pgm6*`OEzKGh
zOrN!FLUe4em8O`{q4M0`6@%8N#67fREfY+(cANQlSizhJ*IrG%b~a~WRuDPEvR<D%
zb5zHr?k{Ff8`X`o?)kToKjz23ecJF{euQ92;_*f4Lk>swx><|Y;7K&su3*gK37am~
zDjXPgD8=G!XvLcg-4=WQB{;kO{;+(v``d{rpa0bJ(GPC3K6QC}(d|;zxt6Ve%s<z$
zhg;!}oP?K$BU9qG+OW)d{@Wr8244P{#qPoH1q@oUz;5c!ii#|l)v|EhIa?1>z4emB
zIJX%Ml27I=9MPS>Iz80mXwJfy4Qy{%ZJqXACGM@)eP-Qry))%<jg4=vgw1<yamOuv
zNVCiAo3-3n%lAM2hr9d5V*idGbL;(f`$me(_KG>}3q3;|*l@AZ=@b9y`__Y6e@G}e
zpF1gKd>*@H$n^g^xt+J|`Mirc2bzag^fnLg*)Zlz!MX|AgRHauOkI*4ur0=Q%H4td
zTj`ye`-R;c$YX^gpNBL0MMwN}Cf}0PGUQeDjP7{9W#Qu#+vM;0-_PmX)VGE8x~KuW
z7FYjta;eqLAr^#xA$`RU`SCA9t9YAxTlGuZla*re-EXt&KIvU|R=R0RPm`zXlWwJ0
z4BlDs$l3b8Y~1ickazHe!_t2Sc;xq3=<2^Ig!AgjgG<c|zg_T&7gvj4cQJJB|9bS;
zY`-?C)6<&V1=ieL&lQ3*wTLU2=I&~lyYkb_yYph^bqkBJVUxj5D=u-poPBCcP9JOQ
zoo-s0x2^M&{+t=mpH{3hK6rG#o!NwZu!xOqBHvFBJGQE!vtOl#PJTRB-jrL9e9yV}
z=~2}#s>0^#9DXgrTmDfH(QTDg?(~ePrjS~-2Bh+PS}Yl7GpXun&!+<r>r})V4$}j(
z(M!5)m^QHX+VGs_Yr=ED0`j~#TTa+nvamus&Ye%>;G>tff<bBL*&H*Vr02MNw~(5w
zJ_V-^!|a&XCSl6=QzG}Q*%lL;<U9Gz-G5`(ah|4FjOlE8r`g$BAiF-+y*7*q`8+m1
zx7p5(k#jxscmKI3$N!hx#5YOMY@lgwpEm6~+YSlgjyc`r!C8l>KC_zoh3$7GKSpmz
zb@^v+V7CKxx~H2)|7|vAc)nXDQ@+p6<JU#A$>nd?2fj*d*U9h3tQLOc^;y3mgMRWm
z-}XZ?$2RR8hvyc;X)-FUWt1N;%2&uawtC#${0*a>{KBTW@($EnI{(bX#@%XiZ%1r*
z8xZ0!<8DKb>Xo=ds|#D(*qM(-4n4`>N51#JKc8Z;E6!}pgnYLFo+NMVn`sp~+2qXV
z`Ev{>HhLg0#wM(>E7_lRF4g5{2j6!wHm$pU<B{$V(v<`}70iYPRNIPWCmgW%sd?S3
z_+vXBr$)V8?tFdBi2M$>#s)bTezSKsE9b$>!<$Chac|#)>NulLh47;1=AAyDbKw42
z_RSQ|h*PfQjoI0>8!4f~;vq+r`_C-Y8yV-*rOLO?g&mr%;$@__e0Da+zpts|?`<cN
z(fO6OR%Xq+&b6{x>#&AR0%m8#q_pI-%`VmvRvrRL&SXRV)RnPW?X9My*Kx8pdAdQk
zrcaDbPdfsbKlk)4Y<Hp&DEj)|hvqLLC$4{b;X&ZN`W)wJx9u8)L{;Ay|8(64v*i&R
z!<tQbx324e3&&P3csC?zPLFCEhwS(CG;uDxxA#}pJFh=3_5570^!Wbv-#9fm*YPvg
zj{D<KGyaw#@fJgO<++-rq%2D}t-8y^?9BT!mP0I3s=B3{`p1!g@i}8xx%!7!fKDsf
zm6x38`x`{PD}e6#t~{6p@0js;NtY^z+kay@z$3=Stg~s~Mt8h8-|VUw^esQd!o->v
z1`oE$mN_l&K&*2Gdl35(j{|L3o1VYng_^YRbL7|JHOdKJ9Ao4CUGhGDh=b)EbKCck
zp%rhN<=b`x8e+-bCop~3&RYS^$=00!CtVu9K39KrO?#6MJ%J84mhHHmEfeicVndGP
z_`8`TzZqG(aLOew56jj~t^m@}W^=H<7L^~>fX5T-ZvqM?FlG7Q*&J5fbn;l>dTqPg
zrG_p2_!%UuZ;-u7b0<H?PX|o5G%5VFa#fNrcdXO7cgvlEPyG(9k+f<2v+azb&?Asp
zKYeU)=VXe7J^82g#2#V6*n)3XNa`N8pSr3sv3pnyb=5eb!5vusfmO8~hiyI5O+Cma
z8+hp330=&|=RJoYDJqENRv2CnboCA7syVg+KP5B-k`8qOy&srNHif=LyX{_?d>VBh
z^0$m3j!|2!S$5n8kQ6%8GCZf!6yk2bb`=RpvNYvgIpK^3V^6C85)Yl)L@P*gtz+Ws
vx7Tj@$H_Jy$G<yQ-(0~u<j@}q9cnK4{l>{AcN)V|De2d1aL;4iJp%q8pU2%;

diff --git a/client/ui/assets/netbird-systemtray-connecting-dark.ico b/client/ui/assets/netbird-systemtray-connecting-dark.ico
deleted file mode 100644
index 615d40f075b41f3b3c9241611cc4b249d0851899..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 105128
zcmeGl30zFu`%b0JQj%v^kHkxlnIfK0)@03|zbKJxDZM0HjTU)4S)x2)B3pL#?9$l1
z7b>15q3|d~dDRpx^Z(9m?ld#aG<R0Ty}!QBoO{nX-+InH%XiMjFdC+f85&{`nqqUb
zFl;u4VWy^4@q=*xF5IKjdGSsd=HDE{?Cq=KT?S%Uds_@+GI?=b8a8w#6aW`0uMebM
z7)HaoKpcvKJ5~1~z%VHHYLhC!<8|mCJ%rO2AXNZ-5P4iK_b&vs{YKB|A;kcks{mXc
zY^p7fV7VwAx*(qwKn0$k$$4+(TG+Pg3Hkq!cPD)nhif&vh-)>y@IAmL9z25bdPpk?
z@|!Z|7F9qVlwSxKUPagGVI>la02ydQ{zQgvu~0su9Qv|iB%A+<D**Cpz_WM&E<G6N
zpDBzR#qnn$oL3O)3zk6-#$_MFdyc1L1PIf>Sc2mw$_OFy)0rhm?&}5f62BR9a2awL
zi-hu`GKvA(qcR{2B+}OiR}}xnSXx|G<9?Nm#Pjl-!Sm4o^8ow+76Oa|z;(}ySJ_0h
zZ4rF*C-|r>gfftA?*q64AZX*P+VZL68JCOd7=~Ro!>|_s+3>r-pbD~eFpRBP1xy-H
z1Aqc9vnmhDhuRra0DAz`{@@ohJax65sUnd2|FtE+tM}`mKCo&5e)|jUwG+Tw9yk&7
z%X**4heE(R2Y{%{HN((iT_QaXF9i7YR^IzWJ{0oW+;oXFgmP4hzlsKqy+r)bZV~hX
z*GiW^Q8wT|DuIUML>g6wfZG(HM3e^n9p+l-r%K#J*?>Dt5I+On)zDuc-s4B%9p2a4
zwNMuU`VDX#;HcFM+50F2PQegxHv)K#)36+HyYX=oG>8vf3ljy)QRFw^cA>8X+%rhx
zM*Sm@5%gD}SFHF2_|2g2^%>+Uo>y`AXW{*#`_M1bP=o@&-5MZ^j$|(mkA!=S1w}-=
zHBVmr&<+^`?neN4S*T31Gzj$T-qS-lMzYcXI1K?%zlh+2OAmtnCmH*LG^npCkT+5m
z{J^(9<P{t<@XM0ahZd9z!<#RAA|L8&T9Bau(xJZkIRGNBa44=1E@%T#N9atkc`r!A
z5B+s5z$>ZE<<o(5E6A_lZ-#%3J~=-hls#G!4ZL^WZi#%0$is>^1`xvSQ!8#nM<#%_
zC=I+m$5yhq@pPy?5|BHx3zGS3yf+|UILW+1I2a3|KF%uQqIZG}`9DG0mV^x8cYq9e
z2|Q@rbD17g>;~ZnIr6gv@OOj!?f~lnP6DI=JOg+O@E!n-EAIoG0oVZWKLA1cCqbN`
zi)@JKmpbMqXp|O0S+fBojVC41be$e9dCV>ir|5IQkLD<n0VLrQcVFz7U$ksl;()&k
zzyg410G1TskN0K4L8bk6B)}Ut@q<#$Msxzo;diAbms?4L#~A!Wz=UZDCKd!!3_+C`
zW>*eSieV-N0NEI3z{W5g1WXKr843VRJQHMOL&gF$Zzy!3c?vp!8vuWv0_HoYc?u8+
zbx{(aBv9ui0Pk4z?)Q-aT<A<_K?N>o6m<b20Y32n{pQazp`<7dpl})iwD?b;yDdOI
zfVe)2xO?~<y<j;!x*!m`gvNdF1ko;f$(%+IFYy~_m!%&aM&u(xAPUJ{^!h|RM<F~^
zN*cj3iQh2(LgP*}J`yKy(R+1{e#8gR?nILQI%hvs^y6!77fA4s18G!JH^IiF)^WmS
z#Dzc?8qa+u!GoK){B_|T&>kt3{$S2qSj%l)7w8qG0cbY@sC8V<o6AdwdD6Pd16p?#
zZFlfEKJQUI_mTtiFw?DE|En>t1NYFJxEnw^O2cq3tdT}kcFKzL+S3|qI1C?&bEt@q
zcz`e-px@|T^*obXVT`iqBU28@e<%QdjhoEerx3k@v{(Huvzl3?w0RejJRC=M#Q0Ts
zzD^3A)iM|1fibTri5{ZZoIV-4i8MgF8DnvAiNKnVMB2#k1ZAN*G>#}=)gj;-3G?A)
zWN0IkhQ0!){~4^SsJt!%?a2O1aK9aQfqE!n6J+Sd(+ICiEK{ZIf$ly4Xs)-a%>=!Z
zrc(lc$nS<Ik5@K-9bTEdK--D>5W?>-wC+*mJ0&+Cs0|RHAN}5~%sE&j11Qr10QJvA
zad8<kuHgyk3$16?T-QNub01~N9?C-N-7mz^PTXV6m-zmwRWHzP){qCU%$xLJ#oJS`
znU+wV^zjSXHAIm*fOJR5KuqYOhz_7Uw9bnBziPw5f5uoOn+}l9q?C=;_rU{H_6y|R
z1oGaLQob;L<OeD0M<^n1zU`y+OwbvL^224N9@aZ`p<H;MlPX_`hT7IZ`LqL10_)&H
z`NiNwzKbyPOzz_KFB8R-BMlG#xs_+_b|l8XlAl)sUQ&KJ(0@Yf%m*ZtAq_|MbLb05
z>KCDYww&eH>N5gs#mFD_4>`-OK@<4y3b&ik&NKXKZEI?jAwo+k^o_K{SrI*?2+@w#
zP^FbY{yDsp_<lJaAoHsJ8TtI;X{q6}0`Ca)Zk6oQE5003bb!3`ahVJIjF8GJL6&Ik
z+E`Er5MKzuA4^HdCksxr-i-W2oOx|9-%m#gWg|LpKY4-&h}!@l9#{ZqjUM&S5DjE#
zMtq~bD9VS{g`L4CNK`(kze;A_hzvfI2GJ(b=Y}3qit54-0G0su0LZu71pxUXxB(zP
zgOLEe0ont-QpX#R4&@^&6Eb|9QAXd0(4n*ttqB1A$e*GRfDC<P(n$3Akw%Za&w+Mx
zfC~W1sBamdd!e~jdFhfRAG{-xF8TwY_oVPxNOs-$%Ys|kX_5SZ2ed|o>KAH5WLc|1
zY2B1f6IC810ZIat1jtIDYGD>%gN2{c!%ECRa}^uIh>**R^FwCUb1qW{Pse5JRF#_z
z4o|53Y~1My1DB-$I}`^8Cp<*XPACqJPX;2P4vNEbJcRU`D4xv=ffgEyGcovw|Kb0@
zhYCEYFbs;rL&y$@V4oK+%toOJ?Daw+?Ehj4hOiF|zwi+LfyY$=7Q_TcDzsM3=7rfP
z4aD)HA;eKa2p4{zREYev>;aend_OI?LHTKcK&Xq703`uR0+a+O2~ZM{DgoXcu04z^
z6#-L8h@eAb0gwn#%!8BY-q%Vm4lnSI`$a%VW)4SO8nHeEh);lg0MQHGt04n)4?tz<
z#qo~r!JKIa;JrkC{)^j-D;s!0x|Vd+*b@s0RhnKLjl@0RJzQ@7!^N*L06)m)C0)e?
zZX$$)Dosz|5f_3DRPSw;wH}0)iCtq+H9xYJFOF})d!Ya6a@jzrMEghWo}}xfAa3*<
z5~?)4C_d3R?_Kbh95Sfa?Vq3=fOoXUA?sZEZox7He}hg@n~vHw;{AtoT%+wL@~ApJ
zfv2_*_>Ys(21;OFTP6Nawb7}nXRzMT8u*uW-RFR+==mDu0{_covVlNY`*ts!_cdr$
z1x~O5v`&*nN(PAcDjyznCfOWS(DOCQ1m4j)u(<wi^*!YCP}6^D9~obItLgu>1$i9+
zAeH_r$sk#x3=r?&=OO6hB=EZge(wf3jDz!N+V^%V(dyw=sD*x`d-${Ig(wY?zXW_o
ze7^>dwc!Nby8+aEA6B2=N6@c$=vw&MYF1%~+UWTj&wzjAr%`S5$p2Q%nHvJSlwTHZ
zg{1t()F}rT8z7&|d|U>=JDmR`KY!KsF0l-HU~yk{@<#?2@Q&8%x$^q_lC}-x<B87t
z30K??m<(TJ)6jzpwPCLjI;&Hn-jwnT{4jAl1K%UEw5cN<&=d~mWU7{T<Rc5`*zov&
z3%-ku)WMrH96-+s9!*>;71w={Gn3XyqfOP%fp6ixcc`ydede6f?Lox98~Fg5shUSg
z<pXXvfEw?9bf%Y5>bhuK;(@n)g#8m?jd>DD^eXc{yz@}sSG@ls>ifuY{+=kG65<m5
zv_m;VmC2j5vViYl0JZv`qP=s<wgGgmA>b7U55V_Rs?Vu3zQ{ZW{K(Ic)LeKieSg_y
z1N*ro@J`%cNQQnz(g1$sm&o5ICxssTtTkoX0ExXJ$nR6gPg)UPMe{;^N50Q8`<5!D
zKUj4>CZXrr!mXloD<clPn*#6XY`NNSi+?8P9x_3@L1)O4#EsrXmdfCnC<Dqv=dEOs
z#4nakS@)m`@{ambGU84qXje3ZIa?#Z{Xj<iHR(m~LwWWDli$xKic{=*gDmoZ{ceW9
z_Z@|K=hYe1Zxzz3gm=7P8WL@uDBnap3+k-ge)zEWN#dEVipWFS9y%f3$)6EQ@GKez
z$f9o|Es`7Xct#OECFNzHJ$PjFUh_;`QQpYJ(fWi;=ataI@I7ye`a0A~o3wM0<=97A
z8$OBaZiK#xkhiwUlB7GO-A8l6;?8A;dkWNdNisn1LmPs}+CoStJclXIyPjm88fT-R
zzU@jm`WEEy{UvR#40sPwntsX9gyx5#Plv{c3hrN(q<7K#(<SL1_?B%Qj|_j()4Ybc
zvKVw$h??a7THIV2;GPXoWBx)#G@&u$Nq`CT;39mi3ct~wRCUQ9T+{}je}~4h0RTq<
zo&hLR7HDqdJ^*T0CIGG)XC}bA7WtJ`tsAIb4#)?=R8$6naahwu{T{TQh0ex9d+F8#
zAYX@50M`Lh0UikeieCjldW``H1VBDQJpf3}%|bdfmm+>1N%=B4D#&kL`3?M|{lm4+
zC&6>&)RRz-eO=*OkPhH)FaSEkT{(P8F6X|q_n{zN>iiA7BflDz_CI;@t<!!eKqK<C
zP6AM7dn{;Ia(!n+owk5*0srW`a;Sfj3?Qq&l_0<3ehZ!1pl;q|#fR!FJrtjZ>kG0#
z_Ms>!?JO)=d7;u%5}+hNNq~|7B>_qTUrz$Cmq4+LiJ7b_HCY9x7nq<A-txn2UYrOE
zcyS^u<>f1fV;Rszgq0XN*a4k-fDU$m3--L=DVXS>2Dl)^pRlV#bo2u{xB=~s5ekDK
z4(Z_YH+Vic5dxKmPKKyDRlx+|g$oeir!7E;ALIatveA7A*(d~rOkRirI2i&zlmQUp
z*&)QU10p;-gxPpH%#IhDu&d%G%&HJhhCru1pc5i+(1Cmi1<oOx$5}Q)1Q$HRLxc;(
z5es+-3Gh&Xf9RYDCIF&_e@+DaqRxpxLZL270+a+O2~ZNCBtS`kk^m(EN&=JwC<#y!
zpd>&^fRX?u0ZIat1Sknm5}+hNNq~|7B>_qTlmsXVP!gadKuO?RmH@b1&;eoqG6BkX
zfPO~<D7^n1%Ba`n*QR^eXNmULqJ1)76PCgE+r*wpTpR767hM1rfV7JR31r@Xjq(7X
zywWZfB&c)c*Cso`XP|q<zh^3We~UO@f6;q41?eI48_65s0sz?yr6sK+lop`gmQO~8
zL>l;>Bsx<A?S~ZAi@M?=1TADk&<zVf){FJMluwpVA|34gMD4%2^ev1hxY&uHgG>lY
zx0F@!0_o|}aMbtmrST{3Ij<ie-<d*++D&LNa(yLzfqqcGPTng<8X_pTUY9S8KS|G_
z{=@f}zd{=jUScSTCUN&cKd5gn@0BU8Ou>6laJ?>HkQZ5hgZ|O}dExe1#c^3_1pSoB
zt9+DK8ov5ozBK-7dk*~oI;H>mZC|zNm&`NJKRP2seQiK!8P)!iZ_uQ^zsTsgwlr`a
zPD{|gviJ8(wkO&9e=+36RU>6|ZM>srkfUCgFO5Gk&q4qA`T1&T2SPcrj{nenth|@h
z`CurxUYAcsztYn1#)If=CCT+xdC#c%A9B`Adj3k9e#tzCz92exOC9>ZN`@Z6G$5{e
zJwK~z`UPdB$Zybpq8e<V49<&hDJz{k8L}XhcCjD<>A8P`4wMG~<&}1^AVHlgpWs80
zkT)Jw$J&6OymW%>(R?tPvqSSXXl?)j`W*uxb-q^`UMQnpmoJS!Y0shlZ%{)UkOgOI
z$y|q|(M~;ATmsMrpzn$0sKEy2C{8U^f+{2cx<_a8s=6--Hdd^%Z-%HsF5gR;$Ug`4
zkIvUstqp{7;=UJ|);B&u_vnmE)#@M0XLuD+?}0jM9MC==R;3MC!S@v5n;a$Z&AwrE
zR0Q8OS#T!1Dd=A%<3aR2J%R7BP&QCUEe-S^uIx5I!Z*2)4a};eV)$;!;;juRZ9G`x
z`!hAa$;5(hvCFhZOh!4@ZvPoWdlLtslJd#WP+!x)djNeSLgBuk4BsWqL2UuuEnnt+
z0-`d8GIT-ba{zJxh<A?C$`{4=t;RwB3XKQRcO>QbHghKE%opme%<BbKkO%PjLjEiP
zy%YK;!c6!!qVKn=GiCC{TN{w84Zy$6uGn|E%RrYm0Ya=@3!T6oy7YFd_9I2_3v>@X
zLuo+YR{_du(L164s&ICZvodA%t(FCC0Qw%2Og5kd-3#lgx(!#}{TYR?(0k%r)tj>T
z;`xe^9uG2>OZeWRDs-r5nX`%ll_jTdxg7WojxU)ufC1l>l<T|0it16`{BAH0<zCeG
zTh^U2c;k%+vud>g^xg59{JysG+G%-pOE%xkq65m1(YIa(^aUmRiq%)$BO5_|RIfsX
zeMr7_{UiRM{$Hrk2B7aN&k~x~tv_|2*GABTImzFH{uJerHy*6+3&Qt=t>9bIq{m!j
z+hld7b1&qLZAvC6DxdEmKh*zdybVC#)b_0Bx<__42fl?~HNK_%(?}RFJ{}C_ytkVB
z4d@>9555S5{!!>pLImG+5;`+q3)XXz>vfwi@P1+ZS}dsl5_$a8zbAu$K0qY&m$+6Q
z-$?ymE~I}he6ybNPm^HKp!+c1yON8~@e0(Vdf6Vp*bmt<!4p3WE1|}NA~pcJU&WUX
zZ#}?jUOjIEpbZn{i5E{5VgI|1f=v9x$|(@u1B$Kjebup}NZ(J`7D730-?h?t%tO6*
z6RUe(8^G{}HU4_~9$+jHdG`yibLM>S`;|cVXwJ8+HvQv$L6}3Sk2XMuxyxF43*oH$
zUfTeW%P@fIxjx~#AtW~$e7x$8oxr@M6y2lez<;sn_htjY_h7QRCuCUP#)HTonV?-t
zc>H_PKRu+VFUUjYvw;{ej;>Gd0LF@1-~Gb25n3|%d$0k}eHYNZ+<xCy^XtiY5d0LR
z)Ope8so#2E5WVL>CW@U8i`Ihc!FUkuLy}SdkiK}qx7r5qbe|==OltO@8H?)vdw>q}
z7IN^K^DV9oAf7-LnR3WOybRIWz|1=Q9)LA#xp@ucM1D(c06naz5y;}c-13kxCPecp
zb+s?Z@Ry<ASChXI`ZuyRQ03EEtg^G9>!fdp?EOA*ZN-`T-UjgedCw@j-V2t8##eQ%
zFDSCsFHW~)?>W_18$kXWpeL2;p0ES7zEWr218y+p1Aj$=HU-1X`Z^wjzP?J&_YjgR
z8V`cp>w*m^vF=ydP$*|%eQN_i_nU<DQ?q}gtop$(2g&`b>mR-M#rb(C#(%x?6$9PZ
z@ZV62Euit>SKc3>V4t6F%VOju^;<)Ap^f-zy64p|{2YL<<s(q--(8y?<$qSk$Ae(A
zK4R=vetzX_Grx+j81nCvZ>~=k`J~i^Ixda|sP|vzdtYK~1m7F1=CuKI?vPq+Ka^AF
z&XNE>=8?dA?Y=u=^rT98F{;k~Q%`>o_NS<l7m>2-l&=`jM%s5rgb&rq4DA<Ghp!mg
z(+7K!)yi84N9J#wh-<SIy+;o&wg<jR`E99LKDa&@ekvXh!aIhsOik^+aQpeyeZ@eZ
zJpg3(-BGt4sM1#q`68;DA3nZN&R082LQ&rxJ`ch+trA(H`l*UJA%@Ra)IA}$P>#K#
zZMdxYp`VX@ce2!}Lq%~Z-B%3ymWtA(r2J~#J5(QakIPw^dxz?d?g<-I%lY;^-<?NF
zvRi_7wS}m?R`fkkC)#|X?XM2Ohqn5xN?F@;GU<7~J1O;5_c+~XZ9v}fAnNC<YksF%
zud>vQ4P^8vPa2;8MsmH@Jx``+ZARuc0M?Yz{_{G{e+itMDD_*kvg%(QzB}rct4wD|
z!CImk=Jb_iTT0zK#Pi)z$M-sw#XqTXa9=SJ>x1}yZRM}ylcG_9I-xXQF`z-_vzQg2
zTh($AD&ML$Uor3}|4MUuLNv-L%lpdk6@zi!dO7hcg9p`@A#U#w>f@m~o%&bjh2^E7
zuNdh5>-g@-*Y6ePU4}A*e8u2wnR@h|m&S9UynBbB&ae2U>%E|Tpz+}RqI{Y5<_hMo
z+rOh_?(5eP-yJpBA6h$$p@$XIA(VX1blujkv^Ib%%ibXvJ5B((*D3!E71#lqyYxqA
ziVD^ZxR<N~T+;QUdi%O6$fu;=z&rBa_*Qifd(4YBfPYeN$^4^spziuGC}f)?e8oUE
zlK=+`px(~y3&;rBaSHGhQk%|2Z2@c~P@s&uP<NF@gG}d4(?iP)L2l?g9`p?sH2z25
zWP|sm+Wniz@{jyaZUTe@z`I<&b&zjqj$4ebmWkTCEOFkq+Rf;pCBvbfECd;EfDp|K
z-UmSPC#x$((&YmlWQ%A&8LF$}(0n(dO%`5iOG^(aZ42dQ0VqOeUCgV}y+ib{FO9$t
z5YF-`?h7_D8sz5=zft=U0sywci2-22z2h|j*C#x~)2xFq5Za%45dIHuhfulDCe@}l
zWj+I&LT3`G%cj+5D__x9Oqu#oM_JIm$#o_f*p2%1DG#nNP7ig+?_0pZvjMr!Caa^i
zpjKb8`fdlX4qyg)%&eojl(VfVo>kxVqE7nJcmnhf{gyi3wv(r?PVF61r!E!21^S;2
z@U8R<Rpu+Eh>Yuc-m38-8pG84wgAoNnALT8*H!vJc4*IAay_>LrTU81Rb8o)E}k7E
zLRdf7PC_}uR4JeDrEHipLi?f6d{=$*kN@V+nO3(A!kDow%v(+eTVMg)2dLX^gMz+d
z>XvVP!-sq^>7hkveHrG(@i}p{c2Rc#=GyC<OeuOP2~ZNCBtS`kk^m(EN&=JwC<#y!
zpd>&^fRX?u0ZIat1Sknm5}+hNNq~|7B>_qTlmsXVP!gadKuLg-03`uR0+a-VCBUUF
zTml6K+^RorHV8<Q%O?J~1rXQaGHJZO8u3#6Ifiko{<xy?a*^ki5I5i@hAdpsI6MM;
z)#cTQGew@`@oM_GY+-s4Lj*Ix6}Kv0%`akzCTInsam0||bI~|rFi0Q)V#rP;ZXysz
z3>k>Tfv&6kTTDp6<yPZlL)@;s8V8EgnAJG4Ar2QGM>Za<jw21i#m6ZcM-0KGLlA%%
z5)((V!!N`jTzsKPi1QiXJ?F=H<?|Wh;pfMB^zj+Y#?e(X$QFq+d2xb4UX);%Ku<78
zpa-kKF9JOgC(siNW)tP{7-kc39z#r#I6qp&5Fb6yDn#Raa(E2#$>GKM<nT0@U0puT
zFuOXAYmiwT#~G}S;tUF)#~BnrkH-bj<7O{_9*<`Wl!q8(3&!oZT&74|FbXCqh#oO0
zh#oO09M{2Hlj<UL@Ybg~uF1`=j=(Rd=R$F4w5sAdRRImvJ#^Vs1*p+N7e8H4HXb)1
z@&#2T;Ijz~LIPmBDjnZM3A#+Uyo)DBew@b_VWNZ__;rqlusY7h3E|f{9)jw4Re}6E
zh|>jG2>b+v)$uCHSI4PeNCLk(jdp0P-&!9;*Vu8`;BjCJ@RNq=YD3`SdvG>}HK#ca
z9xx%`$%kjDzHKJ^YZv7Au>Wgs%f_=hzaIYb_ubq7wprMDdCUrp5#8MebvONMMD&oR
zX8U~o6aIAc-_y^)ZPax8q9X~zhD=+^)P0q3bL=@YcjvvP`v3Nug2n#0QR_l_(8r`_
zS;zmLxVgceF(JA4&*Z=D-@>$m60SWAcUx@Fl;TVJF>kQl`rBy*{f$TI4xHFSYtG|{
z)TOlc4BEyP%Ur|mT<sqfjG5RswJ`k8bd1Bhvo2@aX{9^<+0KTe;S%4V)Ol5>e)iUe
zSfA1*yUyKfdihOxi?QK)%pJQwoH#kzp{vu1dzw)i*rC&L7C#Qq>3M{PHN&PX&Wp{V
zv1}R6G0DvrV-b6AZGJxV?B3up6VhLvTCqxNXV}#A*XgdmXv7XIwz<-&!KCKS!T&Xy
z&||Di8?J3Ltoh6Jnye#+fa&O*`Q=;&&FNS`w(YFmpL#{;F@4kLhmRV6wO@l{k0Zjc
z1`k_YYB{oeeZvJhLthup>v(bDynqgUOP`tMTDE=p+>v{&DdsV|WMNBfZG$`6-TL{4
zwmjl!`)*gM_vw&0-+)t1r}tv7%v_Wf`ddPlSp?Q)>vY=%^BNm8?)-U&Sx?I`WlPMl
z?HL8LcZECk@VYth=K7B%EKcju8uvy{_X>T~Jm7Xn)+l|yF&1T`+%;maO+OZ15|EUC
zQO9#<1#Ps(IE^Pw+H`+^w)5Jk56*MeTANqiSk#2+p6>rR_d$WP@ou=;hv8{Zv0?gr
zTW8;_+-#kI0^9EFxUlYVhd;TF?$N*?FnJg=HS*%~lo6O$`1;8?I;k5UHEJFH=26aH
z2F-2{Ul-d3dzPLxpLRZ+cHa9#-0~+o$4|T(l4Y{!@4%aZH~iBabP8$P!`GT?^ccM8
zC&Tg|Fh3vrUZ!)L-*PN+?b92q=IZr1^my#```cs3H%#04K5qPt(349#uehaWH%7P5
zxT^`j>e*+`h_efS^L|jMZrVYb$-zBiPjl|*`!&eLa_!R?Y}UNBxkm>L?r$Fcd}zSb
zra@M}<r!T+^*J+r_DfcZ`>R(vOAWI%X|4OrdG^#Yg|_QmVJow6-QZi{*VtuW`bEa(
zEh%?swrpjuMh-e(=KQGrys=H9uKi8jOLm<f_bKr(&S)|xz?(ZhbCJ^ueV3#YM*X(G
z_8c<`bMRbz{hrU`_Q8<@&b3}|Y+O1M>$}T!Y2wQ9&zF5T5x@BP^Y@W6Vvf(Z=9cFg
zH0yfYa+S`7#c`o-T0vdhL)ngY++ppaBS)7feJV`4@WN}N%gl!*%-A^gq}WpP_vx2E
zE_<x6W#E<H;rapgm$0pKdfr*C8@@8|-T=q{ni>afEB@jgnng3X<IJ(GwCO!ByEN3A
z6WF>_$P@?dwqMFTA0}j-ENN9S11xUs<(cNRRJ}fX0@n1owEkEB>?6tH<F-_ox9ivN
zM5%}IT&7363q7Oy?ww<CV!uwn7vGL6E?#JVdjF-15jRf{+CS@E@MD9r9j~2RojB9}
z^p?m0uRG+n3_10r?dcm14R(|kj(LJG*}e_3(%W)B-DN=I`Gu~7cSbL{asVEVsCxLp
zWcqVG?}1~ck7Sm6?n;R&*B&u0XW7$BxAx@qn)~i3dwH7|+p#lV`Mo_xlxY-(VA>nk
zF)zlsb?|Xn-7M(UejBZGCyb6-oLIO#>!+z-+<gi(nIEw?@$9}0V|5;~nj9E!Hn(tV
z?#fpe*K}O<U)m+M-)QbB9q+FHwu{i-(P7OG3x}Az`SkGQ|AMDE|2C;{0h^O!|Mm~o
z{+tzs1AQLr#oD%Qe0JcxjI9;s*FWl=J!|xg&OUS6uF>|LA9d3<e7e%#ZI|9{*3v0%
znU-FcHV^y9*l$s%FOAq8Q&@U;?ANm|4)dqKf9@7&&$8BY{xSF3lxLmSUz@h7#9+}V
zo%NQtI%lp~!m+!Y?m=_V9CCq`lVP&$WT(gewhML~esS`IC$q)f?WH4vBSRbf6%V4=
zznIqTRNO+JHHQuT^to<b7^8X@u~x^ea{qTC$M*Ej9(K2LZaq7&T%$0jZIg$XZspJ)
zTl~`c*8d)sl#Pj;=Mnqa|DR2omcN>1cPkt*+H;=uL1Uj_y3Q|S%GZxb>d`WidBHup
zVjR7@)*GGaMzgM8b9rdn^^YTsduK)T8S1k&N$ctEihn(l|2T8XV4F#pqv_8B4ovFK
zp<TTFgO10bre|{3m8VvE=W4zgbH!G7yrFf#$O~y+vny67t@m-f+|Am?V+tpx!H6*H
zE(h~^{Z#n+a?a#EKaVxG3UTaw|Dt)NyH)qzziiubbf$SB92He~CT^5D&DPH$cKPYJ
zmZO_gZccf0*l+NODMc1e9nV#)e&g*Blh?`V;vVzLmucPHb}{sJ#IqB!_PPYwF6c7O
za^>`bYpy%C`ES$OKh`ZN_qXIlVLQ4#b}|ck5`8(bGNKc+={a4k{MMN>&R)NFE$i&S
zan=qRpSxbni|)}sLM!5@cY)k^hVi+R&(;^jV5R?XMn|vzkl<=$*|f<oJ{%qW*0kR(
zj}2y>JnY0N^0aFb$n12bY5a@~|3>zg^{|#^G}`F}`2kaMBkW7O95(&FbnFLP?ZSnH
zTSK?5OPCyf_U~f@GkoInqPu)_)jFT=nHO)I_NJ>|SH0|Uw(l<Wzh)I_-=|wtg}XKL
z^SNaPhVeJ1o;ufMlHE!h<3DzeX%=+<)>6}eROdd;n<phMgqKO;my?On?7V~pg&vFT
zIJClx`VPr$JdzzB+ATF-^{=06tnKNzTRuVOnG2&k?%rv^j)N9&{|9<R_-o93)vVtg
zJdz)m743OiNHfa*HIuR9+HYFeiNj7VL;n1na0T1$P&iKK>;z8CzaurU#}jichn)VL
zkPuYXC9C7L2&fLfl+5iO*lGyvzp0JV=TF;Gm}fWi0+aK1<i894{5;&4^#L1wf2zS$
zi-0+{O(t*Im)9btty7to-tdqnQINN+Y2x9un7_wy*6lOcc8ptg_}!apS-m}*VeDfA
zJDwkZEW!22%D|5$N3V2vd=VPdgmyQl>==z<%k{9z=lQIt4{!Fz_wM_t*WJ%r*aTa>
zTz|)uz(t%So$jpGe?9|&b~nPD?wG}{T=jWfkdA%S?d}?-|2U3Jo6_6Te=)1aMMsQn
zsy88i_nP-!m-J_pZ#Og!={eV7TIQl_5s&<_#DfFppB%om;;s>PxlBLa_WAJJA@J5c
zJ{0S?u4}rdM}DW+)PMpLM!}x-+qy!fFR-Fv_J6cl3pxjT^;!3k{Wd(z<x*BqYwu?4
zgNL13u}qK5%gDF<60|U|o4()5pUOu4XG6n6%$!c&T$2R0Vg2FqgP4%^r2!nBzB{#c
zOo)2u{-nh=lfGS-H@|(Z`RcwqO55ZV>$>f=Y&@i>fk9>BS(_Hw?lH#)f68oPIwHyc
zagUyTo5s$tjoRzXSvThSSS@c`CnMtpKR;c2G3K+$<h4!Nw^rD`D}Ca0t^8VuUAJfc
zGxwVH<gzCHJW&HH&$F2D#Kv{$qU?|Mt|@_$!=o|gjLAP5?7FUv^?VJqwKzO2w4Hb1
z*1<nD!?MQ?+T>M`XV-A%sl|^gtaena+B`~Q*T1iK7MTBY=RjibPtg&#4JJ3Y@QVwK
zt}x%~uSHMr>H6i#gPUu*K6ukr=gFWKk*hADC;e&ILXJ^d(z{ci{~oj{a#e@Nev3da
z7Mn1vWHa;Axo2Ak`JG{>o-~8z-69fW#;xvPu;Aw91lQG^b$>MK(LO8RZqz;_41<c;
zYk_}ri?Vn9ZE~mIZDZ&+Z*i~Ao9`cT(ZIAD4_VNOcKY+*yWTwQm0tW{<-LQmG%#l6
zj|+{TISnq`QJOMjSBaKxACH*QHj^{7=<~Xan`KmRJ~ippf9D$=9C7YZ{E-D3*xC;k
zdu=y!Pt6N^J+?7)^v-pUyT!TmI{uy>*5%k?!_Jky4|R%6UzJ$S$nYNbx*4`HXi(GB
zpDl()#bK;TC5|Bn_A!?J`NRE7jdm4#YTTMOJ5_s2ULbdFZ;h7Lt@UPQj9_{sznoRP
zz&-;yY^(L$21ZQ_bLMoN{_fc2;DfiJCXd8A-#T=7W999xNA~PH`sc8tPw|@vhGkA1
zwnXc^_ww$C99-}2@=Lh~R&UPy>7HM6_l(rdD{tEvIPI}<b)?gF%&7GLQ_s=H$SouF
z*p!70CtW`?(Y8#}QuD^?Gfj`_`IH@bbn;I0N?*sO<%@$CYg#~szt+@#<f1lfPuz*t
zoZhLd-2`~|{HABRDseOOV`5%Tuvz4Bj|GKWwVK%vynkN5RaC`OH>18SoGwE{I})?*
z9e>y`bHy*_HwL>+$z0LtvKBq=`qo@)Yy)=svv2wz(X>urRghP|Ed1<#`_Og;dHLI|
z%{5Y<0t35Fk3+qz5^k@6D_Ysxu!9vJx7Y?-xZorW*U>(FD!CVX$A@9LjmMj7Bsp6r
zn2yAL$~zYRGd7v7L)Yt_8`@cO$cbN)jl43N+-VNav}ltyR9-R5Zrkr|!jYG_=&av)
zg`U~4xXE_S;N*#chmLJKt95XA%yF~Qi8}`zZ)Y=c^reU`g=@3>nbSI7Y+sfbo9J^3
zDu3W8Pq%l@J0JFPy4y84c|-wS|MfsuZXX>}?fLg2&Yzy?+c<@(SNvqg`1t{?b55P_
zNKY+onmM7&;c7ybaa)?%ta+u~KF)u=r$az=M_Nn~wy|}T*Uc9e=1eXBM^~e;8Jk&~
z*6A+|cVz!iF~aE_t~axSp&8x(N=>?B=61bpT7K)Oiv4aHYu;W<aMc*8aXqr|@x?#?
zO62w!i7|=*?WRg?BlA@+*Tjx5)7e##dPU1HBtF%q$j-6g^uTUUp2z7Qe9`}SMe2>#
z4_f)>ub$ynVD`SGXR5|&gOuM~((b-Y?l&W&yLJS2*KkgGg6p1=m5=Q2W<I~L`OA9W
zT$5(a*v1#$&*+-6HMnzwe1_hvQSTnRls|fB^LgZ2y=-G>fOee9YcZAXa(DX}!`U;N
z<hB`I4tn>|Z|u`CHIciCxuL1&o4)N&<VBBs=8tu2-T%Xq#1oC1EZ1vWX?*s<RHw8C
zvl<?<o5SoJ96R12NfRrK;byc7dh6eH!R;Bx;?q`N>2W>VYH)vz9-(_SEk78NV8Y^z
zSfiJ%wLfCwPv>3o2O70(Uof<&?AP8UbN(}By}390p9Y3Ii@Y<Bo|rP|gqZ~kJHKVb
zz_V;~R-#)gpDR`U=A#YL96mYP&l=GHx?*R0_TBjFsrz4Yq7JUmc+mBa(B#;u>$sJn
z2IaSzdTv)zY+u|Tc&y?;8oW-%&Yt?FPqzUr*6Qf2Iyd>+fS}DECOtmVYD&Yw{qOB%
zozwgjO>4&9Ho47<#hOpgwA0x*)5xcQov|?N&Uw9KKi+tk((OjRwK;P)8ojmK;Ki!A
z=>d(AR?JGq{9|{wY#6Gg@%f*dr7N##(f@?;O&1uD^)~m|q%}BgtlqJT2XBJBGM=+~
z`~Q#Y+sP@Z*Lll=p95KRn(367?rr|;N>9FBet4OW;kJoct5bmavDUt>rqfJbl{9FE
zF`o}b!{f|FBWF(6Em|7v8XenJd;Yp)ZvJtvo1;G-Dqo3#hEs||Oj`CGx`65IXs@;N
z(ze6VfhI#vzcN2Fu|ExJ(hJ885xpJV0t&kSy65+o2a6K1xtS|63@;wtIHI$sW&83i
z6FhP-7}?B)k?k#R|Kh$QZH!-B9+P-5PnZ4A$#?HB8#HROw$apepRx~3ndqyPy)2`<
zjpjBJ&7!h5S4YI`D2V&l;unpyKJ7Cjer!fFyy)FO2QnXWX>OWt<2u9$4YG6RXD-^9
zY|&FA&HwSOq&t(xYVADJq~P2K`YrFR!?EM@&Q6a?Ot$Es<NIjKBoA}i2<uPbal5%a
zArsfaTH}`QVw3mt-bVk_QNv<0#<985wOjvpwhbFR%qWXU826i&X|S)~y5@et=dTBb
zP3W_447Sgrj5f7z+4!j8D^2X7ZFmrOpyKYVPfuJYw!w~Jr7i7sV}En?-uF=>*DdXb
z^5xiu!F%U-opi&*u5#RDnu}Lq&xRArZ-!;2cfRgDIR;yZ&G|7Su~`iEaPZ#oez$+O
z3oPH4q?LQ>>g*{^0x{i<sTS7{jD4{B&~wcKWA-SsAfH1Gvf~duZ?h{&|9a`G>#k3l
zvQyR<*fv@{(jyIqD&3l&I{9Ks4r61+Q%4=P?^w_AIN}HlT9hCD{<UCG^B~KGQ(Je)
z>~69;zc`@u`R`e~OGo^H4gWQnJ10oLb)`XS->e@qyJrn+#$IyOiyr9kvimfRf|GY1
z{qg3+))Mp8kA9oNT58^t(YsmCmdR~CMO)AsMHhF=?DyZZ;CbA`w@Ola-D|sW-6vba
zpm-x@{LE8+o<YAX{p*8e<M6Ov4WAy4nbKrmD{kJWXmi?@qj|l?rD?^k|0U9Lc`JHl
zt5@AeY0yu(zyEhgx@nffw(v(GKR3L<nft?|d%xRFE8jN^8RH1;GY(Os@5DwHnjdq1
za%$+%%-Q8Xz3e_jqs!C`Z<n9#d*zH;v0zb2!eg6PV@`VIH?#jKC2;1OFXuL31J_-M
zzJ9t@&|0tME4%vq@npr$*)ux*UA$!Pq0AF!?1xVtJnq@c+okuf=NIe7PVl;vH#gvt
z*A13?=5urAvkNnvZzPzE-E?sjwkj$y&vU?|LNDt|<4lefZA<)}M^j)LYH7ab&6giN
zPFCgV#DuyWbuQ2IGS~U3|FzN&H}a=xq+z`d`Eqoyw*Ou_Zqs6T#ja18>$47PrNM;I
zu-yiuoR_rxcNf<F^7F;H9dCH|3OsIP-zg<f+vLq>&ee}6v;Oxu@s4Gme5*>oPs@Mp
zn1&jxz020Q8>cr8D4jDWz1M_kcMsic|BBTw(0eF0ac60>%MPEt2lc_)8=swOkg(vy
zU!|TKveq?aA6{Q@p7t>_;_46auY8|RTeW(_zWxI$r_Jqy^}oIBMdKTGQ_Jsez$>iT
z{WlGtr(Z2MY1J<9$EZ!-)6RzsSpKftt0f%+b3m~08sDp(GGu{gZ_A5oS6m8hhfOZb
zJDOS=c{9JLlYR4DoOSWGL2FXrML1-^?+xeE0}q{jac@FN&!n;+q93}KN4-3-+3CUl
zLxGV6BhK_If7!EDa^@%7m3sCc(_EtuOxG?LQ?O*I*NriQ6}x^bx1)KNKRQ{yGZ*GW
OF~=dJ2Ok^g7W{u+(t)V}

diff --git a/client/ui/assets/netbird-systemtray-connecting-macos.png b/client/ui/assets/netbird-systemtray-connecting-macos.png
index 0fe7fa0dbe50bcf8c08e45c7cf13b7e6e2348335..306c6ddf555e6049c57ce8bcf98eee80bd2db730 100644
GIT binary patch
literal 3725
zcmcIndo<Jk{~x-zB#Kmsgt?`SV!6l1UC88a5~hTWnQf9waw+AKyK>DfF*Rf?6D8L|
zsbOaLkP^0$w$S*_=X1{Q{C<D@{`|hrd7an$@pwNT&&PS4^E%J-eBZm|U?nOnEerqv
zL~X3ip#T6MVs{Dd;V~k0`n%gne`}~c0B{os0K_K(0Gm82{yP8=2?hXu_yPd>1pvU&
zup*L^A@2jfpPiLC0PrkLQJaT^!mK?acy%Op7a!nJ(J>ymA8liAvH!>3Jz~P5P4_*5
zc*)*2=BAf%)Rn2OsLAtEovZm1WRP>$$s>u*ra5yZuFj?f!u7SCRN>`=^ECDXx~!5v
zSUq#0RV7GcM9!}_PxGFbQfG?QPTcv69UB+L%SulEeMrfI7xiC!9zrOh7l65YYL)w*
zA69aQSel#bu7!`E*q$QwT0hJ3yb%S;Hsjx{HA$u`bQwuWY@C#+t!hN{2|?Drkc3#*
zPPsMa#>^_a%L9M^tys@#%y0Wuo*<w5J|IZ0k=htYOLkDscj#G4`Q$FIjhg|z;54=v
zUso;d?W7O-+*lGw`2=e{uuMK(FD5&n8-6b8mQTX3uD{yU+qA_-7;r?)?@JAylm$L2
zx&A)cM>xV~xJlmDKL+4bZ7a3VHG!q=OBZZ#w2IB~jS-I{AOPu4;X(4!MpJz~Bq7z|
z?u|l>!kq5F&wj(x&N*$ru9`>n9HL%SUVU@k>{Wr}Nr+&6MV`SDP>GN=UH_OR&;?69
ziB)VX;WXqJ3e|RM@9{`iY8J8O+dSTO=kA_b#-K?hX(#T>aG4;eWul+aABSzsF8<?)
zY0OT$8#1tQY#yOhR{~ih6jgXGRGd&3I$W7`^0jT`&U3`C%bIb7?6l<o#kl^34)<1R
zo9p*)si`y%9&eK`O~0&Rrd^X8GVkcoZ|N$qLOA{*VLPq83Gv1m)5V<&zrtj`C0*2*
z=)-#S|JYs!rhpUdR>X`4(;_A6T~JF1kCEcjmHntS@%f&1Y|sEc(l_@iV%rq08Qhi&
z+^{x?<iJf_q4GzFf08+WWr6}8p%F9OyAR;>%tVgZPb&|gZ10`9$@r-1&u8ZZnav8u
z5hPk<;E9W0j}Kn{q19bS?^Wt6j&k%9sRLw4yWyB{4UxiiV|9A$sPqz8-T7-+(G3kX
zs9y=AJU~6_)9*J1N_uBv*QSFu4WPLdPS41dvb}~yC13=RwXS%pqtfA?y|9UPCE!TU
zVS1ArCO~?rbG3X~%*k!7vRl1PhdGhSJyAtn-20&SQ-Fc)*g}kfYc)k-?jDmxvBxv!
z8%GIhNL2r2?N6WoC@%RVJc&zNhJ%(I{C$FE@r$5?=N9BWJHnTPK1F;~IB%=38?kg@
zH7Ibq>)lb9?ef}$uKhYeO}X8M593M|3yThtBnw-$+?RhnD2TL=3r~2?qEvNDsk9VZ
z%E@f8fP2TYYgi@fn`iZ!VnVjN_1lA&W>~|6Zxmp*Au%oKulhzM26?K2#0=KK)RN}?
zbNVR5<}LW>`cYxKpCh3fW2rvZ^QF3rOU4s9G<~I>iuEsaQqFiTsiT!8x1FB`u>-oW
zZ!j%C-Vt}13pM|JVCT!&`q4uJFwnTlUR(p^(szQw-U8FwStF-r^5Bia0+t+#P}t#e
z_mUs3#+t8MkXfFmk;(raC`pvnRrQ=Ql0P9qe_PL{5chu^@LVx+Yi^xprWv=V6u95m
zye|iwFfognaY<#Lxye*k&A7;z)~U`Cc;Vx+dP&;CYYrM8^VWb_NUVPS9iPY=%H}tG
z`P?=t0MYadE6eOfcg2!@@z>!b&@42{dkw}ArpRvu`^nJtoa1{3bJtqu3$ru%WeecA
z{T5qi4l|u!Ehxo6Gi3%2xEuBRH(d8hw{wvA;#8Y;&HfzM0wq;PPARgL%fqAg*l&d$
zfW`+R_KPtrKR%OG>-7KXPzdojNV^iCwVve&vpqfS<^UmF#G0l+>>f$$w%>VT5%rVh
z{Kd&eXNt0Z^tdR|C+xT6%-|D)pAKj7N_*YoufFj*>Y6_>S^lbWbcb_C(pMo_kQt@0
zGGaUvtJmiPj@Nd5r@2osbOmYsx-Pd8a6b$C5?gWIwBesBI*Vs9!JGH_zKS4W;3-il
z8drV>(*e#seW~G`H<-p*ZFGT+Eb8xSy1oh$4nyNXgWeyj5&n=l3<3K5=<=HT#?{nn
z*s4E7t@BBhD6`NnLl?Uc9LT@wkM-xS&bFgxVNhWfyik=Y1;J$VqfffvAgM8;`TWb;
zm|o4>#h!6tBi00}7f~G%Dn%m^qU##cYAa>9Zw*x0e$kMQz-7u#YS8BWQ|qvUUV*~k
z*kww?p(3w1-@6}G+6V3VdNQUSZQ0xKkw&>5a%oR6uWAEm<9HiE-Ys~8_Dc4|>{@()
zi=fm|<#rhh^2;dqrCvsh4Lp>qP+m9AVr%6-2twwTy;i+ULyea`B_!@g8B2bU?t%|*
zKk?mUb+~?Zr3PPIz-yMU$EDtlroHrm#t-*0bZZ)?+C5N8=Vqr=f2b+$#km9Vc;nc2
zuA^64N7&nZj%uB6KXn{jaBq1mIrFs0G1dNvPR`H3lA5X*Xw-7Il6#!2^%5EvZO12<
z=Mg+uT3W!nQsvIGCnP8Ha`+8Tuehm~5@Ebz5g{lYw-7f^Vb+Vwns}4;oQg$|_f0uE
zNpdDP3Q(%iL}7zU*N-Z;7z#eHBv{;2>#V8bcF${hRW5>PH%Zh<<UdX$ocr>-$I4dB
z@RwNp?<G`CRtB6xy^mi`s-3T6`6qlg*n14?hpJ$JXd(l(l_}v~5o$HF$&F)`&_DJQ
zyrS?=)a<rjd{!P(3#N6NW0aI<vdDUw8MCmQBR>5|ioNPP5Jfc1l(XHd{keWP_Cgpj
zxX8#9={FS*6{oG7!OMsT{retzhNe7Z><%fDyr?=X(uh7vJB5T_n@T(kMwMb0!Ocll
z%YQC}l}Z#f6xZQpF6~R$l6@Ww22w;-1-fE9=X9;<UXZc_dpJQmjfe}^Zj0!h+QZQ+
zg~O*3hjvALT`^RL*!;9eMSbCa;gF@Vz9@2tlr)2w)8RF?eL3+OIV%aYw#Q{F^Y}=K
zWi1qOvd;>e-=r}_5<(Q`zGXGwWqdPcC?5Ut6#Ki9_5T3U!(kpc%mYj$@1z0BNLiTd
z#`8bDBq53*<Jh!p631lf!(rcsmB=c%<nyKD*?#lsU;Wp&i^FB6XayPXzYWqh0p+LN
zoaVy&XIH-QnH@9FB!?)Txn&sBf(@!77#FAxnz0pyka8M35+XI`=G7)woTQtCU+nnH
zW7h1qvvNZM6xSkN^JW+&>rAl|a_Q`$uj-ZoO~&W_MSrZ2jK^^rL~Un=inSt9g+966
zn91LL`&&ltungU<5aW4avJd~aT?JCl=eGZBTe_f03=RpWN5F8IkIzO=s?+b@af65Z
zdAimHKRu!%$`#l$J%2Op9E^J`Z4{aJpkKc^iF0ao(F~V&%@Jl|Im-^Q{!tuz;<Ntf
zyUj(ekZr@}toNkMz-9_3vL`#q7STu%8>7}FXo;1S8cpU2$-Vb}ijviu<)WVv7tUC^
zf2?7V5+NY%r1B)~X3mqSip>hWa#1gZQ_Z~5%JER-uu!PGr{zAZH%=gs3XSi5u0^4I
z*hdYj$x4J2wJl3h=Pz7pFY}SH$Gt7&O*pfnR({U$i4a<=oj5JLj(pn`ZNqn%9#-xp
z%)-sOdP`PD3um%0i@ywsN&&d{<KElFWqG#MYo<T8INOW>MU9O!SF();K1Fk{e}U}9
zwRfLRF#`5|>2HrtHBcmvi6!xx_2*ewzf16nn-Q>qzLWwTsGYw$feCrY4!qak5y|}Z
zml}-M=r*Xe7Lna!_(9R&T~Tg0jlu4m8BclfE<Kh<P~klzbnNeO(ya+UIo1L>_UYHh
zwv4LD;~bY7BN+M7W_e4WG;Q!Z8@<z*<mMD-<{x(_taw9Ndb)!6y+pr=oXS%S=_7g_
zRqEunsOm#r<gwDvtyT=+mg6jNjag&Fc2R3#`@}*04>Cr!{>Ht6%}>XDe@SHHcZCIa
zwnhQY1@`mPV`Mg^<0WS^TblW-Q??FpCDkaFJ7j=e!_5Cu(V@@y99V1oI6g-lZZ~1_
z2+B<Ct)>8<Jy<Hwv80Es9eax@B<|+S9bo)X>)cP+npmfLZBgh;jyE238JP>es56NU
zB}>O}ZPK(_LHoSliNC5r@<L+?)6v}X8cg-h?fhw?5!*GbW4p2kf)b0ig<5TM9XinT
zv9ud+zP*YqdiXQB(f?~OT7(R;iEN&a450|@$L2pi(qOQ%xcTLCM#Y(Z2Uiet4>^;a
ztsmZBSPrcV8VHHc%fkqOAcA6utKw8cs)8f;JUB#{ML@$;zH!U-40EnsAX;{jnYZF>
zstO*#I5%m9%*|+-!DpSdv(Q@PTHDVS(*+fuX;L-_H5ILs%-M`SZWk8q+J70iX1t`B
zY&0hJU;Ik}B(KKV-U!}TkT<!^i%~{fxT6EEqT%}fC^&BeXoIzNHNiTX;B%M3divn=
z`a0SgV6Z+IJiYW(?*AA<kpV%0QUAZ8p+)=&&!GB03Fx3ucm(=tXxRVuXzA!{f%Ub{
W{u^=-^)q$%@HQ3><_%`P3I74R7UD$!

literal 3843
zcmb7Hi9ZwWAKxsKV`S@a4LQ1z<hH_BHp!9Xm}4DSHn-)@S`zzyeK9d-COPs|$uU<l
z%GZ%lXfkIgSCTOd+kWcz`v-on*YmtS@6YpkKd<L=J+J5aknL@e5HUG100027LRmNf
z0Ki=c1ndRx3iptwKD$CR2;~|I0EokWO&}mAPv#dT)B$M@c+smczpL!Qn%S5E0F^1?
zJJ*E)0Ld&X3p2+E;L=!6_J|WTVWkdHtz>ww8BQ9L&hqTVnMm(VHeJ{&1|y{dKffC8
zlC}S(ws`iw%h`)dEHU_pdi6w_!N!#5PadL=QO=_N`v+iSQXXKHruP4hlr2#ImWi<%
zoXzW?5qCCq9zWzAKF>etFjCUW=XJz{cY;N>4EbkxDG*Z)mIC{22W_B*_&~D~F>|Qs
zfuCgL?asi2(Og$66y)<{L5gjPW2J8>|Lb96mYj=*R~wyiLKm`Q>^?GkDZx=zBsMz<
zbs%^$vu6X95kUemyud|bem^J2p;jpI9KDUwfk+KV4!sD8{!p`Q*v~9*wYF@!=pY_~
zAr2Ez;#o{1kUxY<_qITrzOmuUr5U`{M+KMgcyPtro-FD#kME!@KROYJThh7^Y3l~^
z>Y1mAMg0b{{{u_&^{G<ApXeo^*kyZ-aV0iZ(+l)L7uwOfeAS1u33FE9Zk#R9%rMAb
z2>m&9vpb`dM`a12q+-u)pAxi}#xJhT=C5oEYp&EtDXkU@1YgYf8?DRRDT3IPSqFv}
zdNn#Q60x4J)0xqYTf5n6r{%S~S1=tnVRzn|>o8qESav)wmjB4E=S#Yq_SnbS$%<}F
zcBO=8wQ%YtPu|(K&xi4;=gmCeJwKI!*yJG=`@h7g<Em%tmx=Taxt6!iC+~Eemx_9{
zJSY*%+uTl<syX^ay;*lFdzw#7^!>nSl{XB*vJw;xUR-t?&a+iGRO3{#qA>%JU2A!L
zJcly<{`*rRWE=KE8E2*PP_bVBFYlT9_|uSDbV}J;jjqiQmGnM}m7|RBO*X2Ngr1uW
zB`57iAB>tDcg%oubmKB3<b%4JiV8IR?VjmkJ1S)dU*@J7D31Dhv*<Y#VL#u{8)Fws
z=*ulDBn9h5Up$LWO%}d{mw6S<>k2{7iHY{@pXqG5=O@HDdO793TXK0W;|fg17hgDb
z5xg)sz$6g(=MG<oJ=IXXjWMlh_4c{Cs{cje`SA;O;vUDpoC)<eI*}gqfSF1O%lo10
z>&-GE(oT<cP6;b_mpnmK_~PZXvT0BAY_2s(v}O1H9KCF7=QhyD;pToCEJkNP#a~ph
z+?ZTeI9|t`_YKUcGa&vocMCsNn@^HSdBl3e=Uc?W{cQ!K^S&PlXB&&jqd3bc@a!0j
zHbB83b5|e7bKTtS++eT%CA6WivE!zE;VRG%o4Fm2OS`L0#Yt_lnmePT9bltLe!ET;
z6ya~P=>*l?tM44khezIS;X$xhQ`{%|nQavaP;k5K?MtN+FfL)=nb!f4e5ae%ZaR;@
zsofv|=}9vlZk&B*dIEy^PFSRyPGNh~5lfYI=nrG|Jh{AjeeGFRA2chIQcr(-a%%CF
zDox}5klXZ*2Tz_JLv7*ACsI0{rwI@3lH)fIIw`{SRj$M8&#DH4*+V&rnJ&vAIw3cq
zdL-+r!<J>+x|Zy-B>FgkT5l$r+hQo2sAEpaS?(Iz!wf6qwm_^S<X5g(waqC<Kc`{U
z>|ibf)q9}&y;xC`{CpYm*V<aksY7hK!v60c&->lNw`a&1Tt*Ix9CKJ5YPME!DqK3y
zk;u2&b>Vcl(G9gu&&3Au7!{}P4v^8BG2FkWEiX>}9pD1)+(z^T%+U{1Aj^rzNKTEe
zPN>?#)|O<|P?T?28*XK)>VES-rO##MvPlN2`^&ifO)5<ApMxGFJ0A4>Fdv*3RNFI^
z!8B}8brLTHBi*+#Gt7MW1Wff~yU)r4gMk;OOIYD3LZ!y-zQL!vSt>yFgz7*(Tjb>^
z*_<ydAA3_?^xHbTSBdHr1q%+dFZxmZZP^CBy;MLcjYs=YDI&r!&XQP@S@rV<(cK)S
zzGk|UV^~2_7jT*gVxZ@ZJK_5z+hiZ3dJLhFCIuy+dmyn47du#@``q&GX@=FRwjvjB
ze6*$eHkRUogv|v<#pGwU4VzJNtYZ${Ir3%f+ELK{vIYy4x<B>oi@uGnI;Y&?x(dOy
zp<WeqLfCI+Xb%SQ_}?QhReRBWNvC*Q)rPY6m*HQr>^!xA)o4swSsBtpxh76U7ukpL
zD7e`W&q<T`ZIgBJ(ROgvP|i*Mf;pmF<JqiN+dypQ5$T&qK6*D=S}(BN`1MMQM+YyC
z_QpAew|zEUM;klF=YKsk+NT4>-c`{ZN`q*J&6EdQT%9k&0`vQ&Rn6AX`0ivG!@xty
zO_^q9wS$!a<Tylcw|MZ~4`d9(9)TU7YjkThk!9e!9x%TreuQD%%s-*G^rn6%v4QEA
zrL|?-s(3Z9?8xaUUq<KmL}|{mF6kkDkINKy<-eY1_+<sc9IX>_(vA)7v7D0F4b8zS
z)%E}%xGK(}@Dgk;aRtG}`)kO5Tf{Q=an_G$C{yZ0CEB`NvE{N^%foMI74cu2{x*<)
zqH1^N`OyX2*0Bs4?Zb(gTS66NO3;#kzV<%6Cxe7QXC&9hhwO%>m@U8R5oObY+F9(m
zN=nX(uTr%X`v<!;e0pO2Uf<#eoK4+Aud57lN<s(UkYO=;v(j+2+Oj4JF{G8GasKU#
zPZkOiCgJ+Zk8?kSa_<@J!_G9e29=W|I^R)4R-GYp4St6&warZ~kb=sGwK2$SZutX0
z!$9EoU)B))Rl-0aeHh(a-9v|(eqV2vd<0$XhW@pV%-M>7(aeKMS9U9vB~Q@x?ufw{
zi4Q)`-S}MnD>5~@leqVzV|V)k8>14|K4#{t@4Kz<f^-8tXIgv*o0!0}QWa4#I3ZB5
zEwMB^6Ta$CrZLbIi|-^xaxK`khg^T`>D!K&dC|-Iacb_{NbFk^QM>K3R8lS2S)AN>
zVEfw+FeCk^La5}j6j!J5v;NZ}=VJ-;?~^tbF|A;G+k|CGw{M)L59rve<kuRrL)F0a
z6(KwAuj`=3ED_+UwStzD)v>xjDem3gZwF0d2TF+M>YM$^;==&;#R#mcmEPT7P|n^;
zo**r6dJe9cT6`x#^9HDM_Po8XsMg-bM2IqtX6RY?PnF)BpWfY=l7Y*D$WFzK^bf;+
zfXF2&u5_-cm7+-fU5GLRp+`zHIS>J?*mLS=aLi<pNEtgP>~-@6Y_NDi9->17sCBgm
zk9#Tl=wGlsli<{HB$f6Gh^+#q>+6yj1$j`TzaZCS-I9kykEPu2Woz9!K0s|D><f!4
z<n<jE{GIOwa$&mp2^sDfD`GGI5ygs<2=9^oFgz;s^sU<{H1Ui_>=FxO!|G?UYHQa}
z!k79sCQ>`7wO|j8-ERm=;ZXg2ak`<VLG}x;Xk;`fXr6!)mWV;m`3c>gfj9oC5AyJd
zs_x6};}7SXgm0@;iFuoZ(@RT-iL()7Z}ROXLIuM#ghw24%kZnnyQbPjyNJ4CF&Qpf
z?$*{UIf7hO0j1U6Dgke#eO`WO5KzeAZpu=0rBK3zm^)?)zICGC4Fbl}8?QD@f0j^@
zb25K-DtKHukAErIEIlz$Xkc>Qb)CD1Jnfo-Zys?JSQiO_doia&5o<SDnaQ7HUR<9f
zY6kN^rRp*(4p_UN>kNTs<d5tDFN}NH#_)_1S&Ktr9<M5lQjy^oG*taPd`#deS-1dt
z>~o8brk*9aoEAK5)IA?J-XFk2lM?Wc@u5gXt;i_MaGY0vhUaPG&)EPWL`oog+udaT
zB6)Klpg5-`QRH2bEBJ<p;CO>xSG2;8L!w1~EAd?@doK8=b@fu`2p~icXr)7#QQEl@
zGG=+o_W|V$q~(b6)o;lmae{Q|jgjJi)u)!P)QO`0mT~d<IkKlHUY!cx(F6LL=^|ou
zhN}0d-7!NV;wFwLAJB8afU?dgA1^mvP}pT02rXY0M%ApGDC4IJ3MB^uy4H&Fl?*&v
z(l=|$&%8c=t#4%v$WUa9b6yt=Y;go7bo}3Vp4Qi7Z}sG5^QJW;GRdeHr}hjZrAAd6
z)HqA>U1I;qr8911$K@~?e!Nd|$BiRY+4A1%H%bRk!}QB<wlbeF&~R_CA0hT}p06N8
zjc=Tk-oWkJ%6!g15BS(8i@K@6z17&ZPbf|J!uuR8SK_B1o%+{9k5VvYV8b*lZSWTr
zN8W+yIbU27AQgg)^eYmvyly6jP6~nP8yT~$Tkd>On^N0-s23Il4>-A!F@%~$XZEWn
zO_^<#{O+;$);BHRg%5QSW;hb{7-fcZwHA)2vw+z?Xo}oMA~t3?ux<knmQf}LGpod@
zXaK5F8A*EPKk$vjYlhM^f1b{{=pM+V;iAE8!_f+LElKjG-y&^g82?)S^vCwG*x61*
zO5wV9g|`1#Ot%S>_*x3@4*>Zqaf!z^Od7GSp$r<Q?`1pqG~6-rZPaH#bMF?`Wm@}g
z?yGmcCF)8F(ksKv^V8KsOn?zHy!sE73Pks?&P4v#@7aNUA?tV?fP6b|{p3>MsaeFT
ztAI0JQ3h<f_NdP22s^4fL`5?+wmak*14{PREIma@ZYsHAZ~gj^_JRX?kx|8``vFHQ
zJsY(4XG@y%GT60kaEoewx4&!G!#HE=e10)ooU1<B90U!9?k^kOI(gP1b}HjinaI5+
z@Wnf&Lv7W3??p@-VRD%dPV4ML;#`SWpo^Go8awR_^qk|smb`Xqp!p{%v;$}x^Q@NR
ztVIcL`9$pxPg0Mme86$`YaE{Cx3gj1HjtxJErWP!G@Z&hf0_7KILH?C<zV1uWOQd=
zdZs~h@g`ST&@(@}Uh{Lw)#=Ta61{zdl+iIS8<G1*^OLb5eBjI2|F0KJBaj53uD!Tb
V)|@AEw`T=dU9h!yVSer2e*g#NdB^|&

diff --git a/client/ui/assets/netbird-systemtray-connecting-mono-dark.png b/client/ui/assets/netbird-systemtray-connecting-mono-dark.png
new file mode 100644
index 0000000000000000000000000000000000000000..f208cb6bfcebe99a4159843ddb6b3d6773a6bf1d
GIT binary patch
literal 1448
zcmV;Z1y}lsP)<h;3K|Lk000e1NJLTq001xm001xu1^@s6R|5Hm000GVNkl<Zc%1E-
zTZola6vzMP%#4>t@RD|+>@qzliDtg|6k$YG5<(Yy2!bvT#?S?l5(?@m2okc;)Q5VA
z%!;xRO6#E;l`jQ_nuQ5sL6%8bgHChioL>)nt@+mZ=A1d_J4RD53pU^R_Fj9f^<R6f
z_3gb+3DEzU$`ftCnbIVHiKa;a6HSu<3Q$Q>S9rf#(zBAjl=Qo#ilkwCHfuwYkhF1B
z3h-~Vk~IM<fe(Nh#i(ZOC*WL{-5tCW+bF&!o{ZzMHS@fbR(qqQ{xDW;qPG!MC3Q=B
zLekHp!vDc9v4=-Z8JK9;Tas3rA(6iwsv7@3Ny|)rRnq7R%$GD<QlF#?C0!tCuB4fg
z&N9B5q|=g4N;)p-sHDS^4oNx^42x8@{+G@8(~_naFg#D|B#kJ7w^&+NFdicf0|$W@
zfm?xjA>O-zF5q_HknxWcl<)kzOlB7$zha_2ZH%XYN@ydw7RRa$6n+Sl^NN5uz>b0-
zYNq2aU?Isd<wgKp*;bo4+@^x4WXRrc4hmKP^T{fafTxVF(uQp3*+2vDM*yWT_-X+K
zPVUk7g1obVKY?Swjn+Tao=>)+qiXFKFq`CgcS6Gu^5y9Q-YEdWSD*qc2}+*J@jaXa
z@q7+^p1gl8O}w86pn!53@Nt_UT+t>nM=T=6ZIvu{03I`*DW>bwCLsL%E3!f`#`}!`
zI0yl=fG=8r@MS&$oD=50n=_;qWZV^iUIq-BjQC~tdDk+I_nQHT6V3y^ZQ`Za_h6WN
zLlgd*^$h`w$vpaaj^CdHt&ATJK%96n@IwQm+-u*Eg+vc<fGjVX0p4r!%fJla#{keP
z+5#Gs%_0CIh|7Urg5lAaRe}Hh20-)Vp>#)>_o(%GDSjrWzheL*C6R#Tz)4f!--$hB
zc{2|<&e(X)(};~9Agx>pINxMfNxRLaWwR3i5yUm-r3zzXxm8(=<g4i42a$cH@1{-f
z7Xc7KtTIKLsV|$uwD!JJ#rU=d8Eb*VWZ$Be-Y*IudgV4!a=Vh<W>}Fu4y3%AX)+c7
zSLO7yY@M73%1T>nr|Tu{R<>tvmue<!g`|&)8WD{tN;M@z%aW!^+N63wMdV1*a(ni4
zVo#@sdiUOlq@DJAyrmrP$hkDgEbNFgxs@1EGHRWqElQ`hN*Kp@YN|h4#=e@QORc|?
zRqPl5lCD&W`yNU6NqWV8M+3V}$B?8!o9lhPiZ7j!Ed{HPe_R%mPHy*D{}ihn1EJFV
zMmmVB04^f!tCj%|0sD<-fHpr^&042rbdMQO1#Ypv9@1X_bJAX?ZyY(jz;)rhV*o|U
zXqSb|O_Fw5sCX!>lJvg4_Zr_R3#mvR_anK!a&A1I4`tOCiqRX8b^&-2c1!wN(gM}r
z{hX4tQqpHRrH!gjyy&Vm7<V2T{2nvjZsNGIen|_JC7>JGD``N|66@;<#xIq$P15U<
z)>xl=+GY1kdQ;K{r8_CC-wnM&($<`eL~SN+nRMbhLF4_7Z;@Ard?=C5$b&iF2Lg}C
zZbF>C2j-I9r!EHm$nmUq`-&v)=A5xk4rUm*l&mTV*k)s=$<D|}f$28hM|P0$9WFqB
z(7z?f@Vlr%A8!>xp16x7-K+Y<^$@9rrzfW`@hoLq4^QY`NmK0i4AtkC+cPKF5M}sP
zXs-{p0)S0=!3=OE9-n^aUy?Lc(j_*}6Lq`s_9)Anx0UW!yCofzv{%_3YLC)?1UrKb
zQHJNn8<~ZzLua|g<$lunw^7>%d<WcVbGpgSvg=8?GX%Uw+CImNv_9Yy3&A768tQXT
zz$3t~7KS@WHzpl#r~gwl`5)Ot(<Fe2rbz%3O@9N}2a$4BVRD@S0000<MNUMnLSTaZ
CF0(EG

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-systemtray-connecting-mono.png b/client/ui/assets/netbird-systemtray-connecting-mono.png
new file mode 100644
index 0000000000000000000000000000000000000000..e254321fd57f76a6470b220186550669ea9fffb6
GIT binary patch
literal 1274
zcmV<W1O@wvP)<h;3K|Lk000e1NJLTq001xm001xu1^@s6R|5Hm000ERNkl<Zc%1E+
zS%_R!5Qe|$&a}~qWQ-b>xZwB@F;0xW<UvFu;ubXG`XC4{Xdt+uXh0u)5(EX;r~!RZ
zTmqsI)cB%AB>JErnz*2XM8RMbx53Qxbl>)&s&eX{zPIna?PNf>KOAoN*{bS4r|Q%>
zP@_hT8a4hW7y+8@|JlH!z^A|;z%0<#Z(f-Odcb4zr1O4^XaTqYcn?TanX)C(@-uK$
zmVgGr&;nPQ86|FSIOPT@-vpkFl<EN8lE%#H_vRwDhJ_jEjWJ>xz#C5KP6>r$LwmsI
z1mZyd02~J#2223Q0?U9SfW^Qe+Ajh20e=E}f!)COz_-8;2$L}yTK@vDPRAcyiIz0(
zR%4o34OJNNr44)qJP%w697$LOW9u3<)U#QY{Wo>aKIIJ$X~%y^dwwS>zO9=f@O^?m
zc`N~5sc1x^GG>6230txcChS=Pt5u>ymk{DEck`}6wkL#Dd62YImT}xiB0c-yWAw`v
z1jNhyuAA?0;BR0LaIw}Oq~8Zh$mnX>gZO7rv`dB3w<;K6D=-VJbV44F`rQ>7@kC^N
z9x3a!e=hqTX5~U)dr2cq&{K|x70ABrk`9~qX`hzL`Y^```~Mjs5Da8LHUeNA_@uxH
zTjt+@rEcuoks^tk<9cW4Nx&5ShnbB#Py3c)-@^tR4SY>DOTO-QH};~O{)yI21Cs<s
z?~nT1ck8gq$3~n0{FtGXvGyflON;`$2!4@g@JEC+WD)R_GteU1at4IWsz#gw{Nfb%
z%B*$$Z_O|?FEn23#@(xR7K$H^<o_pFy0IEbBm6nBP1_pC3A~r$<gBCZyO5O|0glnR
zyGXWKDr^p8#JLDdmYe&%Toe{#=kF2D2MDM14f=mh*v~RztqR(t|1E5`sg@ciz)Nn9
z^+<APXVILo?_sQ5g*dkfd57}sTSV$1ezjQVSPq;O$vGg1qr!z$Q$F5C=gg%tWsnd;
z;6mgCPKKNZBshSC;L7?88)Fk4+W}tJ-@O6-djr~6xjBa+Vkp?&x4rr_>G0~)hxkCV
zIy<yJj^>;<oUY$d{k}+AL9g^aB(?T+X6!9G{(w5J!48*6<mPsx*0)rFtxmz;k&DP0
z;CLjjIs>=^*h$ED=JdcSg0ZxX5J|4kx=|$8-+|;h69eWM1I~B<=fwb1{u0t#W!5Rv
z01ic7GC+*-rA0Up4R#x}H>a$?(jfg#RT-8QwvZPH%Qo%godV9x5SqoTf9T3%K7Lyo
z)Lsf^^_^s=)ji-><VqQ*0;_<{z!u<Ytuy0{m<_;dh|esG`T(4UJUI9{O2b~(mLfN=
ztbE5(<aIh`RE4iZR>$|f&Gmus5@O{$<WbEGoCN-g`fRLXfU&<RQZ~+O+Q5n0x250B
zgfMD%<lThVxe3BW#=kyqaPpsVbC};vS!2;j+|&UpfSXiMgY*g{?%UCEcIu83QV(N%
z%o(_dz_fSZB~AxFhXsJK0=@Ucy#E8ztmhTWCQZT1T$}mLbK15*joJ~l&j6=79WJGx
ztSx1fx2>}p*_S(!`)^kH0{8~F&M9YXZbW=%8h8~+pZ!DHgc8(79*Mo9+Z^{GL1G5E
k_>7k^phk@vHEI;%U;0C8@{CnPx&QzG07*qoM6N<$g4?le1ONa4

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-systemtray-connecting.ico b/client/ui/assets/netbird-systemtray-connecting.ico
deleted file mode 100644
index 4e4c3a9b114af61a28150b9fe2deaea75acdaa06..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 105091
zcmeGl2V7If`vnk00Tpo-1xis7R1%#3I>5b^x^P0Yim2e8h!B>zaMUVVRB*IfM^zlC
zh{QorsiIOVh)7TY7XktSW#s?e%OD8}d6@=$@5jgG-n+YR-n|>&-NP^nrjIpkia}_F
zdFo-92Zmu*R^0e;xc>m|QK`ImdkkCE0>hl0xpCWp7-rE2!x#)+ydeb}x*iIE3zgRb
z(k=?2V73s4qTmkqJ_HyB<=!&k0v^|*f7Bp$Uw~vGSi&RkE`$isCG9sx4JrX(-vZ$9
zU?(?=)I7pv;YlH%BS0mdpTU0b=w8&8R|eq#@*bcDusMz%#T-YsqW1thdGHj<>n^Jx
z$ZtiPUt9@!P<|1hc^4;8LrSF<0W#2s{O4)QN<{MU%c1&|AlXclQ~>1FfoFdLaHxSm
z|IebhQ5=63#C`=~BjGZrfw=4=c+c^4v^AnM&{pHP`DFz0^HUk6NN-`ndHKI-p12G-
zw51|>Q5huw7N`se{rKr?guW$rX=_W$YuxAB$e+CYHt>8bzyg330E+;|1K_&n#kn?7
zZCiXk`t$jyErc?VZT}8%A3)f~BWug2iDw)Rh9S6NgJD?!Ecji}gbOSK3}fnYfk6Rk
z08qeTaPy#isGYF_a0Wo_4}L+zqpj@>mq7CW*OmaU-fw~W5LpWdx4$kx^IIOE-~3D7
z`}};U?eGNP*X5dFa7jZ!VlHm5cnkregMXpl^4#a=1N?ZK`$#Gc!ECkSM}z=wXQ}w1
z-4YOsVe-mZT6&=(xjzB_X(=?EsgYO>HvqR4K&dzl_&dzKXoVV3)+iEihX~`R!Mhsz
z3;g%^X?TbC?dD$85CQrPa0cMC<1G36C^eA74Zv*#kd4!@4sg>2xcM|l4&95+ODa#1
zdw_cebv@voMG!aYAAyXZzXH8t<uAZ*1AVX0AXmw}O1eJ>?-!*&zf4CN3IO+a0GU)I
zdr5et+@pCF^V_WjisFZM$P92l1;EQfWfG-9s9*P<8q7A8mj=Mu6ae*$_<V4v{?Pv<
zVt<eZ^;L!P?ve*T@ZAXV3Xd5CWl8Hp3(JMJSRi|TKGfH=BSHhDLw)rt0Q|h7p`<>z
zunj;Rp)w@qjg^HT`s;dtS6Z7Zpabbvm|x-Fv{g0w<br%q_E>2&@ZNccr1C8$4@ce@
zKm_-aT5%&f(gF0vY2fuab`!;or$g<Lklc}75X@iWy#e_`3FZ~SL0bg%aZWJ@y%Xff
zUkGVi^JM_P*T|8Vj|Yu=ZczP8=n&>9kUvrge^<yq8z2ne96%C42Ebc@_W)>InF0_4
zupM9;fH3`&A<n0ZXo%>SIp*fmC@X}rJOHGPC#BJpKn;~XW|xIi{5jx9a}@Ca((p;T
zFLBH-UbZ}Oz;6rS1rQDpDFX!KeR*(@Y3q*!IAT|st`U_F74W-Cm&2)|Kq3tOAz;9?
z1OxMjft7z1hB;LLlwp`<0RRibnlLfU009HTV1@!f7taJ4nUJvnK=eZM6jT5@fMA{i
z<~zuF3J?f+krE&!p!E`fcPx7MFOdUgP#I`yO5{RwN@$!^$OH6Sc%BKOcw7}}P+5Wt
z=xz&;4<M<JBI(|rg3Q%F5MBKFHhzfi316y8BU~o_8)%oOA01Mo0IuBmbn`=`3*igJ
z`Oo;FB58!n#DBy13ynL`_(+nx#qVhy{fG&m-Gw0iT4z68`tf<+SOPrcLK=0|O(N|8
zZZnep0bOW3_n80>bV>QO;U3VwOD6q+?6<I%`<*t>D^3H@ZVFKAxSTha_Xy@mwUr07
z?ke8y;BkE3qk8To7v^Ey9Nj<FnAd@OXil6C@Cc=$%`U2uMqGBPiu2mj8f!STB~s^5
z5g&g7gzy0UM)#`cndn6ks-llbIUxU`0D?7cB6FW2^a|6?{ax<(bFs?iT?q1U2H6p9
zx#)bI3_7c2F2)0GL2(>4NVz$EB6Rc90PQxkl_jM@Yd%tGBf=Auh3e3Fe);MS0oQ1l
z4=*P|8<8|rU!497SXWVdT?X2b{g>i?JF|uAp_ok&p&L&lx-Q|PPT2$9KLVh+UT&KS
zdM8Y$6#kIk4Zl2I*~07aDq{!QPSl4GeSe{K53cW&!hE1MK!|?y`;aQ<V37czOgjM7
zKNH8rp~<<1C!#O3o>_BU2er*Vs!H%smK8vjB-;7+XbYvjziQPBw3{{L!7DS78mN4G
z3O3Uk%9A~QA-aYrRtJ#o_%e_X&QL}NP##)mMgCv4;SfBdEtO9PNM|z2M(g|F0V@9m
zayNmzi89I;#gF_T#r+7y<Snp$w4Mn%BT#;*ywt;bXG16#-sgnM7onlHHBbTVz?0BA
zxJZ5pIFaun%sdmjc>T-s63UT<NATQnUhQ@y!M{?FR|;N2emT&8LhH=Oq?92GNA+{)
z3rOo1p?<c4<=5&n0&B&{A9kODW!Inye0N3LO=#z7D{5_PYLp>HOEUD0^dwmkHK-WT
zj@D3Rl|lSDypsfeIdehg-2NHy{E}&@;j;qo2=s21?$ax|971$}yz_CHi~5WZ$}2^d
zXzkieSO*Ya1RxkoNy#S<PPE>P{6wbk+F*g7jta^~bnFzPzbD*7JVXMZHG0%PLo^Vf
z8S#z!q9`9)7oGw>LE`d3{Z%6KMnv$TG>A5-J~z~$GE^5@0(1s&20*^uGXRh;0v!PP
z8H@(#4PXKE${cS%I+Ty7Oo;Fiql&(fupVpsjn)K!e&kP41VDs7B59=h{M1H^GS7ha
z4gj$Ls;F;ipnLJTR%OT|lo#HSNEiJ9(0fvJEF`~fRuMv~rbI}7zyn&NLiG!^A@ZzM
zp|o^0kwz9vN`RCADFK-h;Cc<g;wyg14y&*xx&cfK<A)qxTo5w2&p8YOJROH=03}1Y
zEO2<jL)_^J1DB;WPACozPI!o%olqPcpPGn;1}F~C@etDMqBx5e0xc92XJGIT|HJ=*
z4;6S)VHgyLhmai*!9Fiu$U>nd?Daw+?Ehj2hp-O}zwi+LfyY$==Fb2}DkLW+FJz%K
z5XXy#5Jw3iT=;!Lp)Hi*48Q;o_-Vln(oYKnLSCc<NC}V<ASFObfRunt3Gn7{onc(5
z3|Q5I2+cd42PomeIS8fBMe&}gGd-XXy?}SzF9Jd$b2yUHNb?~;eC7i{?@k2JJxMZ9
zcX~iu^MW~3Yv8?9asEpzYL<%MLAn;_ogYU!7QfV;UL2nw4!nmd%zvolH3ldg**u?L
z@en-|zto*x9G@T#Hc-8{S>AdOTrP2q1qxR;Kk}9@;8)TQ(7&5PHV`b;{*jG~>zyA*
zwl03DJH0qQkvQ*Na905t)amw5SO~y7TH}y+uKbX28DhUtn~rpiY!w00v81*iZsV7_
z)AR924T1k7a@s&C%xkN~|4Ay5YJ33e4c`I(@~-<FQzJ<lFB<swk;?}BVC{Q$(E^PV
zswRYB18AKllaLG$?_3`qbS9annn==kvA{c82bR>|t-gnR9%}k8{Z7P}-qGz-Taec=
z07B_CE&xCX{Krd`0pcC}JcNCmgnpO8??WJm@o*lEMQ?hkUUzzt9{P>$;m_QPP#S*z
zQt%yF_BD8{4JYv46`<z(u=@NyKK;sv?nR#+=M-7jM$gxH2K*yGjcS`m{<jj&+z`^G
z;<BI@5%L?;q#R&ufP6CZaTx&baQ=_t{8ih#)H0}kC4Du?9}!%@J6fyfDC+Y|*fx-l
zCpzmVRCzyOB76}|Lk%p_hrLGVtWK$VQ^_;%!^G_je2<9IripYwQz)F1sb1cZk1U*H
z!{h%g_%0f0f;U+>fF55SO&mux*L|@wleWmBP2JCdZ_&MXsIOOj=A6pyLCn7!`2gCe
zn@4Ho18zD%jdwpf(@Q0FUA!%si?@Az`{##}=1HWHtg`#?&O?1)$^MI|?<3Fod*Xab
ziA(j<4rUKk8Dj(r0=|a>)arkV_Rgu=2GF^NfL9Vc0pCxVKBoj&lbHnYBR@kzbK$l0
z{pFVp?B|lgJOBP7nZzrZ0PrKfM8Q5e8T8<1t*Oce2<#0(exD+K(n_)`k{#+h@_m-u
zw^SwlLGJmOd_C6|?iL|hMG@fL3V26n%hiTk@-qeZkO|ujIzyHqZuBndtRlAYVxT;9
z-byAx{1WMucMqB{@2Ec|C+>Jv@egyhrhxm2ocL?fi{6Kd><K2mpG_R6wDktUqJjNx
zO@Z(GO7qUEGpOGxqE{*Jc;Pez+B|W-`SDDsvkLp+!`>&UXSymQ4_SNYM0h8DMkt?W
z@o)`cWeX)laswV?l;KlaUK-kiM?~*6&%_nyjYu4=Psnv%2{i=Y^QNq?L#?#QIu}`i
zeU!D~t8Lv)Nb4|<%iXIODNT1OyN~9CC7sI*_mrsb(qw?%hdo6Yl@ft;qH~yvyz2?(
zsc|+6>f5eYpl?A8-(6XAWx#uo%JfTwCNw_`eL6HoRC52SG`)-8cax%aw0<GqIvx@J
zWT(l7xv~g!R)~h=o-Jvv3~+k@)R@0e6HRE$cn)A9HLw^TtHN)zCsk822o<*h=-;8S
z>>7a602u(Plm(g_NdZ9Z%0$3b<IDtj*CM|%?z(~c<$!z;ti)v?9EUYs)bBy-S?Fv$
zw3jXn0Qovx1V{i#26!q2D1Hk7=`{kt4*>ZHbq63cHw)>|T#Dp*B-P90v@pNg@*DU^
z`-f|tPlD&FsVBi~XKmqIm=54?FaSEkT{V14FDFIT`%suJP5uVnkzb8k`=31dYPBB<
z(C7>h2cXLKSlF%<`p$?ZZ2{o|{?T{kQ2!(zKwf_<VSXk3-l=JRl);DUEHxOPhwBTn
zK=z?5sO&5(W%wfVk`f>#KuUm=04V`d0-BWoeyo5p{}`BMK$&F#oL*pwK6on#S-dzu
zEa1iYVHq!91suzOE`C^rp@SXJsR!s_2e@E!44#644r+i4Li`D{Iz&f5po1Im(<X#N
zf4C3n;PW?lJ~$Bqm4{A-;GU{riSWV&2=LPuAjA)H07NWwA3`Py0U?7Iq5w{Yzz<~r
zgm`uc@$7&I&ki9APlq}2LQ5t$Zpq+=a54ls?E#$-frA0$Lnv?#nLN%|2oYTH3=a`5
z6vsCQp%4<FK$#1j6TtvL)CkUrfM4V}5lATHMM{8_04V`d0;B{;36K&XB|u7mlmICK
zQUas|NC}V<ASFObfRq3!0a5~_1V{;x5+Ef&N`RCADFIRfqy$I_)N=_?fxifVbbxXm
zpx@yDs@Q*C*UJYnNWNg7CE8z$_Q`xr@PY5QNjsBRGU432Xis${0PcoUONi1avj4iS
zmk(^qzCicNf6r9<{uW8T{^Iu%Wm8!r1=39{fGpkfpQE($*g#z`zlOl1-GJ{&qBAwn
zen@e>Xeu5gjka3uqdLvkEzuC=A$ryI@`>_^r-QwpsQuTJzD4l_mbl18EccyGROjO9
z(7RmLh58KQ`H04~p?q2V)p*Y92Pk%?kg|3YTw+^;pxSSsejQPLh^LFFy=eStT`!*i
zi#3x#{fF-{e}y(6w6tkWYHGcM`u5^_B^pP0WnFc>d|CWSeGd9Z`{za5XEn#A5+nUV
zIXoh&Z}D^}udJ)CmoJMysn4MwKqd8$&moB04biwZ*q2oO5_tgnM`wg+t_=t-C)<DG
z?O8ez9V(Ls&ckU9`d9V-e(ClkfB!E6_#;{$#nYj_ovf>_moJMyna@H0`1$!7X$OMY
zE;0!cO@PK&;(8?-Co&&g*UJ}`mI5)}co3bfB)#6M?io4%L(HBd6;P$ZS)eb7&fU_4
z{%<KjWL=-1RX6<#h_q%F(EoW2*g!d)7vH)jcA0mO3{jns)%K$_D6PC#T`yl=eru%X
zjR!TcHn5@wa^g48J011wP~W(m2k1BI$Dwz*vR7R%Un%~f{%_Yn8;}WSYAI4jmEw)e
zEL#H52B7bW<!ZnNJY`curuZ5X0NtardDYz)1RE<++c!hLhTQ54PUN2h`bX#Ms@DdB
z*+=S&%<3B-pnG)2rF!)b<<q>2$@hSk8V|J3C)H^Kj_^H2_$Egwe6w%3mWtq;CJWAF
zw*vjEWju(!rziA17SaZ^)Y3rzp{i~Jq<oVL*}xnv6~i}67H@4pW#hpb-=C@ZO{Pfr
z7JE}w3%ncslNq!(M*!4PzN+cfrt;uDfW8r-bYD=8?~>-Cwtz~{S7e`ni0Gh<hM;p#
zfLs9nJ4a>Ziy*7V5zxO<<3aQtNd>;moDMo$26b2N^#Vu81NfFf{!Agg^YzaU)8X5Q
z%j&V(RK^-_Z9t(m0RJ|-a^K}H2VEut1a)&Sashj=?M<)tBSr5EbPqj4X+Yn%0Lp98
zJ753Y(4%;Y$^=!93xYNPeUC{l8&HAnMRir(hO6%WtfE)wJyDNUrxMn9zG8&OgS2&0
zzPG3j9V%PqoMJzf2&tYI0^h+|Mx+g(!8aup`tGo@dQ>z&9p<5C7q_kF>QkCM-gq#x
zRvSRy9sgO-*H&FSt*CB^=KHz$n9>6J1`2?_pmblcx~h9*BdCw+U8D*hl6r3iQ2%3V
zv;pY*%5y~Kb?Z*u=d}^kKz4k+SDp$O<c$Zb`-1R2VMq9uG~qE9(KcC=>1G%4#x|uB
zRUo2zUj)?uaJ&sb-_)L0$90eF%oDza&K=*9{%HiP7atD>vfn$-uLrsZ{ev$8U;ijv
zML-1KbP_5fUk}!E;_GyqFZ6z)EiVz)f2o3g>fek_Kp$Wi^p`k}bL&a{Unin}4t%qo
z^iPvw&7k`b-n){6&+!V?qdM6hz}OGjGM^_w7*a}(2gPgvbRQs)4{trdaX}q#1E38P
z=ZP0j7GwXLj)F{9NR*Qwya$w9<NK;(N3p)2s4WDu>EE={dCWt-r%Tj5uMMCrhBf{=
z`W~RI7JK)Lu5;#o>-&{J_h`<yyf*#geL<K*sf#v1g}KXGc?)81`BvKikjrp@>bXAA
zx*;MrIefgd$4+40Qikr)bKt+k>RYn`;CnDp-ScHw*T#d$ADK_PjPT62q<?BqabJ*!
z+-C#PU>seS-T^e<THpPmwh>%9_*<|6(7i3_USYp)$AxudJP3XYGU~ke^W^&87ewzl
zkco2V!=km|IxrqY`;g?+Kcp}5s;_MTPxqPf%cN%inYL8>-vd;bw@`rB-1@jSfOrB~
zq$?l~$udN113zo=djQs~73MXVy{kU80o0IUBalUk!t#(ZCPecp+S(VSt&*ePSChX|
zYCTyS;QDlysO>Cht@I6%zuzaRt%#}XZ2-@oH%8U<Ubs9ozS6e7px9c!B;69d=TcW~
z0Qql#p46&)z8#?T6|H#>&|%C6{)&9slnm4B>Ua?P`f5GjLqx7<JP2~v1{+Xe-RIg+
zFndv5YXd;{J4N(Uvwx$i`XML>$^EPAAHDY_`FSYEf1UCb1Kro~-_VFHpz+{W-XEZ3
zpI>0h66A%>AJzKntLdIszwmPazLt+bwSRYQdQ|+GmX8O)W|v5?TgCZRu+97`zGBF~
zPqDc^dE}F%tqlOw`>*r8F9|k+?+w=Q+5kFtNF%l%%+|WIB*2e(H1J-#?~VjLsZ(Aw
z?%98u=?}vG6m{|<R<>68iUDneeRst8P_N9;enCz6ilIGyuqRogyallp`NoOLUmeuI
z5_E<uA-^pR%Lms7ZH1c0gYb@_`Dm!!7i~Ykx~~}Mvpay?zB`(>19kd}AzwsI^CQ3)
z%>HU;Nhs^PBj7>Qrqv=#R6o@*Cq!HF6?M;-TQJ*M<&C<G0->Lee0MT6sY7LPsoYl#
z`j*Plq@w&9-8)nlb&tzgm3xP@NB4Xi)X4evJl~zCDzaNX?HUVFd#&tyKr7mOe%oIi
zf)8!=S(P%HZ-pN7e0P%Ss_t>R(b|Bb<3ZHV*VOz@wO-|^8`~99EP+fs|Bd)Mt$UtK
z(b|mMZ2+t(qy6Vv&VMPKn@Hqav;;I>okSD9JDQfOTxUqZTA~K#^i^eBD&0H8^WD+J
z_c~R@KcRAPUoisfgZO@J)vx0dqEU%Dp)y}Fph51ln3bSg-Et8r-?27dG4Ln<N^^Q5
zG%6^|6jk_&!8k8WLHw%VLH%V&+B<~$cxX<i?$vowc`4~D2D<+`zB`KbdqsJdqYM#W
zF*sYM4!!4P@m!?n-XW;-zV*7^3)=@84=yaumuqjXaDMInjlN$k*9Cgl3f~<K*dJOu
zi=c*-P$5KTj>xJ{b@RC#zG5(ToCtEzD*p{N=mpJPu0m&u3Reuc7q13f+F&!cg!z>A
z8+b?l8}(K9u*bY)JNPH{md-zF2ej9RK`GlL;422QnG8500qX4BzL1QN9VY=#LAB{z
z+!nw_{DjKThPtaN8ss`>ni^c*6y%1^<3ZnGLF0e)O*VL6YVA7``JW^LgaW|3T(NbK
z`ZUKaL03NF_AXDH_pNptYH;aDs3(g+#@iu8^MWY=NdBs_)!NF*2Rz6Y(S9;iSI49I
zZbX|rywsMK8dTO6%FP6*jgGqbOs#u|s3BjBzz-14@+s*HHZm6EHyeJV_9F-YY=s>G
z5DE9r)C63g@C;A01wub)e-=PE4R41~xzHxnrZ-hS1Dir;5^2h&HD^m-(N|2B`q4yL
z(7q{jCK=d`=Jcrut`K&2O~|i4;NaPS!e^6dsV!*KSFEnv0jvYqfF9GeRF?|2H6?TE
zx?VI%KN?Sf{-NKZ<!w80`m}2AkS2Ah3@*^W2S9!47pl!yOc@z#dtUDN5RGB#d|QC#
zb8NI--r7nZ$PVp!i?8E$pi*BkZPk@J>EhYJc?j#~+DR~bxH{$Yt&|OOMrc12n(wM>
z{_*wxoM}zlAdDH?!n~y$*g_;g3V?RE4NCfoX<EK@4IlEwqy`tG^<|hB$LGY++J*K2
z%(d4wnUeI95+Ef&N`RCADFIRfqy$I_kP;vzKuUm=04V`d0;B{;36K&XB|u7mlmICK
zQUas|NC}V<ASFObfRq3!0a5~_1V{;pN`OONxC9ECaJYXQ76?d}!{q;Q3LtL4VNiH~
zHR5IXa}48f|2X3D3bE%^5O2au3|Tnhad-sys>`bpXNWz=<JI(Wn4<I|hWN|?R~&A<
znqR~aMc4|&<A@>Q=i+h1pubQ8#E_F%+)^lx7-}LG2fA(vZZRMMhf|G{32~>2Y8)s|
zVN~N_K^!gt4i+A*jw21iCBP{jM-0Jbz$XAPBq5GuhhK<6xCBCz5*IMQdoGCc$`>%i
z!!L;Q=o2u=!qHVT$P|k+cyT_1yeOYxK6*ZbeDq)y_{B%hkMq&<8D#Ox<1x(S$9W7f
z#NvV|mmvXqo>hp)1?2D;6p+J<3&`PVkX2ni&M>n&j%$!n9mg50j^Ydop~o2%LXXFV
z(Boz=gdUHxgvvt<GKJ$#91cS)E*u4u6h@C26h@C26pb6;tx0te26*dJ9oOZssw40V
z>bXc98ZB<zfE!Ry-9wiXH$aURx&-O`S$Mn&Kc7E0fq+e55E1~}+;jpH<<n)!;axm2
z3gSGz_$JDigP_jw5LU;TI3a>M$3svZ=N2fagE(D~g^!<4VRf7<`RX|N3rS#;%h+MY
zjlOFHqB9;beDHX%1^7w98tOwZW7%;J3^RK^V(@^8Yo6t0Brh{}U8P@;-`)A{Q8VK?
z9kWNi{KvV+Ztv$~**#12_P8-OxH(6Mcimz=d}Q{AIrDdY7`)Dc-g_<O(fNDUEmmez
zthXjv49osy<E)<oZFiK;p)fW$H~PRSeep5hH9Okomp3U^AK#{zu87p%sEW&TbE*l$
z_Vf+cS?O)9CJyL>`RNWZ4|HkKg);5ZtL1KtE*-E>H(4jouJ3(&SyR?}+kp)Rntbv)
zx@pvy^Z`u|433@kel5d3472QX_LPCAfsXSq_uQTK=FPmi`ZX)ri`{AS%y@co#2dZM
z+YOk@Fy|+$CbqD7b10w(M%S@Axy{(er0nLV8_!<eKW?z3!;n2jJ#Wr!;d^ScNpkim
zn>SrDwssv;b*~M!d%@XeUG2}FU^@OfEGl}_%V))z`>^9?XN-NL2kJ#^>2)OUt^dzD
zQ3IE<`pmgj&@0T4(TMhDgLevZW`n;{w}oI0{tLg}x=Y2F#$E<PpA;?o;o73_*4VVI
zSk$z5kIB-~qYg{;ov)<DHs26%L$}-2k=xsTufOnd*q4re_g5{MXzbAI=6n6i^ZJ<l
zMw`HnNN9u2b%e6LSpiwrk-LrtBo$qMpy&K&m_yE5Y)Ja5&MTh3_Tj9}yfwsmWOnw@
zH8TT30nzv<|M6*yTQ<kqvuF3amQ=JpH^V9KO_L?fc9=d~l<M>7_RODFcqI;8zCRkM
zUx=A)S#|5bsDRMJ4ZRZw7H#_9`gi`tahHPHmyXeQV&2HVhD{&kKGgM<f1gKf+gAAP
z#3DO>_H!6VxnO?D?O?l%K`*GD?S6Cr*wJb9S-UQQepqow|HXQ5EcM^SU))|5@z?$n
z<|cmrw>y=$D{qrNz|uHJ_d=5v-g=&!Ue2~E>w&%TbdIs|ocfk+_h!H&gTFb3J||Kq
zCA``Y^|awb_tuA96M_pXR+TXt`yFgr4D3H>kL7JRou%{aj7c+V=aZCcXEslM@~oHr
z!&XrSQ3eB&G5-a&hht2decszv-#n|!kctGG=uu`*TP_|FvB|&d_ONkHK3Or#buO&<
z_v)3IyD10XR<>y$+A#1==xyfvFa35!eOO&Fthvw1jz%4I*MG9ocQf8IO)qMmUgm*j
zUXh<2H+va$zkZ2xF0Z$3{|0{@oWAMO<BAXF&6$sWnt878!Aqg6*)E4VbZgL{sx{W6
zm8;w0%!wBU^zvG`E4=i}oaZ_3r@f1eteBN^*FK3wk6H9f)2*x~bN^|2`Ax3n{Fmb&
zhr~bi^IOvK+V7he{`1A6X|Y+ViCO0BetlA>H|Z0=3doyzw9IUZQ;g|pkF~~G7m~;Q
zXg6ZffWpuVx&F;7jMmuBP0KG!VjT~7^}}DO<@0|rdi=nscS-5EXVIDGp6;udl|Q!i
z<{N`LP?8OO4zFQ!xE{8A1?xn7sN=7d9_=z3FR4nheT;>#eD`?DryYk+Gk>#S6>bSD
z$a>+Ey01KMOy3Lb9NVXu-M*fd+dc6fBdFx;kr_rOS`J8VeX2*xv;F$nvu;NENAIcJ
z7WZNV=Z=lbm|+VW7@z6_b<*v*iRJRFWQVCqeu-}RW8Bv)?Nedo^XZn}9sis^y^_wH
z?L4Oc_ViY3fsFfcW@Vp;Uhcr`lHO<R=f{Vbz77n^YaOe6+r16jhQGR*dEtujfCr}s
zpKNq0{l)5g;r-2x{ji5KnSERC?MNwRe#yux)*tcAx4lnB@66l#oL9baq5CYZx@fT2
z{&l+t`unXn?pZX{(yZ|DxoLq1rf-^Tyd;xd?wq#IGB?+^X!MfQ#!<2RjV}-U?(^<S
zkA#ngYy8?@oyAz}9pC2HgC84Fw-$yCV)kve*Qw|N^HO*3>%R>D*Q~f=WN{}(m!y2d
z-=l`o54Jb|=Zo)!{!!!h>78m?{IYLG$1S&K29!2gI%Zf{=Q|zyY+POJbmP%{$~@h<
zv97NlSq@J#^*UyL=|T4bm(*^|#>cu;w7)Ur<}YRw*%7<nUBOz#{^ZpA_N0bBzsJ*l
z-P>XRm*iV%&i~tNSKcmt>>kUU^{+ps<mwdV>gX@T^!$(PXuRL}b(j42mAQ9|=R_qe
z`gfP^jGWQTnK`+E+y3>K*ombxi_*xgEMm{+NA%G;A2-irCo%gr-<!X7<c?O&i_X1R
zdpA3cu_fd9JU!R6QOtHfj&@^@iaWiYSz$F=XR4u3n8%e~tZeoYm!4)zxAeEKdc*nc
zdwP}4wLq#a?MV8CQ5haD9D1iV3~%wl@#hH#=f-!RVmJEG(df)m&n=r=zijHg<?yd9
zM*q04<;8+lyVm}laO0>~*uLk@F|6~8%{}+&eRw!Cpnpuegf&YGatHQz+x<h}{pd)Y
z9zUfn_AH!y;jWubw*A5^2a`PA9K&7AKSy>hzi(F@b8CZj_Tyvi9V!ww%?}?zw`lNR
z67V<qURI#-kj=*iwaIv&KSgKnj>gUff1PW$VR~n1knP*|Sl+?q+T$d@5wBj2X6=ps
zt2EMl&_46@^oH?<jB#H1E1slwEpLCrG;6Q!F#o8dZJ4(|?|w63Rf~I(Rj(6S22-r}
z@6hj>zKvr0KMHol#)^3<uicqO87<yi&$Io7mi%sg0{sz~#@S`#*`J!arcJW7?7F+s
zG@<gmb7|$)e!EP;IA^t|%=j?0(lzw*KQ=qUw#<!BHKO~S$TS{&qVV9e87)ud_cz~s
zG&kjDX5VEk8@}ka$7IOd{8Q$Q{Zmd|&->7RhucB#>!&^@_NO2GZ&q>aPwa@fl?UdT
z4j)_E;OfFYo7<KiYw~7n57TGn4N|9FYvKLO<kgxfCUn!`f3KOy-V!%1`9z$B6$K=H
zYs7xoXc*flVbahD2YaKaA>AETGDgjfpZdTCW6TU0JHZ2Pm&a^>mof0el(fZrmgloS
zI~=ifUfN_(@ifaPeZP!*)ITcdoz4Huy|0@l%<IGG)#g-ayB2-VwhOgCF`m6;F2%Fr
zs?P5N43hlL?_a+qZPJ^SlRA|rIO>hg<Wx>txjbv}Z|4m$y6YjsjMJ0T9RBO?R8l^E
zRx>ZuqIxAR{q9(EjOnJsh<{o>Z*J_B`5jCgD#k4DPr*vY>Rg@hDB6AhdP`<ftiE^5
z=aDzJ=wbhMGla@s^)eH?v+MIzEb_-qhCZW0v-@XsY`oYMqmI;Bxxn_NPsEw=t>atj
zCD6xQ{V8)*+jFljwsZb&rDvDPC!;gx>sXbA4g76ejA>EShh9l1xtdQoQEK|IW7~>h
zM%O%l$Qc=N#^%~+40FleV13p8VL+bk^TV-AzIc2eex@`sF<p=P)^1`#pN8+JvHOHo
zMMmUr(OK_)&+q)TF&NX<aAIE1*=N#yTZ}eXQt~pYyuU>yWn3%Dyh*=b+-uSxXI=6=
zxAx0F8V<7PS}~@`N1yuB?hV#owgz#!|8=^-<<uPepDHft-bslvzcfa7yPjv-w)UO&
zRKDD`+U!QU$*+11(nt0BA%Ak!u}QP_spnF|e6II2qd6@rNc_FeqJMrpn#IXDv3n%O
zh@2T>m!5Od)?`MzHw)7iPtFF>e6)LgBQ6z-`s11R_06*{ZaMo3?DzN_9jxyH+h|>j
z$`tD4>7f}XZ$7d-o@&h+0j;@H(ABl8Tehl--kDH1A!KC6@k}tA-3KV6J7;XYzN)0>
z%V`%s+c8XBzRZrwM^DCKjEFeB;<c5}d|Mp)C&9Uy*VVEWk)0Rp#IVv|7=>3db`M%{
z=62~hYq0SJyD-L)4c4XJi8rF%x3QC^8g;jD&vzPk+7!d~yKh>Q`oV5u$+7a(sN}{k
z7*S6>uU^@)e^MT>vA}k=z2VvWu2mOU*Ejv;1TF8h4j9(j;^ojZ;~^{Vgv1XtTRVmk
z<$5tBe*VQV*scxMb30JZlt1tD*YOm_9}~;}w;S#{Uzr)Q!gaHg>*;gWCn(mbeT(Lr
zrM-x;e)1y)%U;>y<xTe+8yFU^D}HMM4bX}8I@spLwl{maXWv=gl9iIOKAJUa{>Wyh
z6IR$BSy#CaYZRUyM`;oJ!r$Tn_Qz-sowaOJdfJ)3YctGUE<!6kOK0!Sd9L5@sk|3{
zW#L(?6U$J4jcNGlo!wEVLZg#jQ|-GvKE4XSX+9^<?r5w|Moe6*k|Pd}J7%1?@OfmQ
zA$?otnITiy=jT|y{f}bzZ;riT2gU@{o_>GVL#K0j+U}fa`Xt}!F-M%3j&!f&UN?JC
z79C)(_bQqjIb))p{{hw&N)Nm8`!9{G{<v&BBsC|A;;^gI<Q=?y67+U3=Z|nMoyuN5
z;FpA_c9#%3t3zvNh8QLJEutEJY<xWHW@h&e470KC>~8mT-?r&o(<x7Sx{shzj;`=)
z|HX{ilG)R}>yIVfqi%vZ(RJ?7IZdCMZ9Lo9qH^Z)djsja(|z0DxHWm`nUBF)RUG~8
zd$G37v9QeRS(~H23$OH8s=wn=z>Nj3@{P~Z`<VLN-yh=aaIno((+&(H_J6lb81_@J
zy?Sj|+&mCqojPO2rc2(TIgQ|1Aa-(?|18rb+YYXnHn}J|vvUW=uh0iP{qupKmJHV7
z-T5c%J;qYrJqAhnO`Onr#jQ*C?&j`XHo4igL>pGH>jeLn&_ACF>~Ejn=#NcL)~?sh
zK4o1NtJmv@%lE}k92R1;&vwW-zPL|^r)Q1!K7_h>F(7g2b=TDmatt$PM|{WeoWhO>
z>c$8jtsB3+JZ{;5X4jJTF~;~{!*#>G6SM3(F!X@>ZP=_|B6l`!v^I1Evt{KdmsnhE
zHU-nt9PTE^-M679=ukhH@2Sk8>uh{`JK9}mv`+S}^QqS^-#x<VI~t=IU7a<3XQhs5
zhk#ETqn?%-SX7R?rPnlQ{vQ!vB5l@8|Gt%1{!hl;mu%0iI`(teJF|7GZ&Imiel30f
zTSrQIXp6xQ=I2+$_nV#Op#K0H+sv~f+Wqj;^-rB2JbMwl`OEHQ?<|`)XSQAUepbii
zjt!C<z4+PmPDJ-}YpdMfr@!vjsRN@INNv@#Xm_t0WlR6N7DTmd%zU^c%K<E}*F&t=
z=DuGn4cC}2UG(5(|0KV=-MtN1hYK_OB6nZ9vD6{pmZfftPvb^k7+!-)))^NJZ(97D
zCmW+LEpl3yl6f`7aC+k@p7s}hr+U*a>+NhpF+Swk!s6ZW4~emrrn7Z=2h5*6>0Z~T
zu{-qs)_t+jZ?*osOCAQF`?l(Jq(9@$(KC4~Zm!b35q;d(=*_b44YS%t`2KOjk+n6h
z<ZSbX7E>D2H-6g1xO1t|$96B5tn0g@@x}Ddx!WM|6Z<Q{@ki5hIhD;8myHN8r2oAo
zJ?qu@2bH-G*9Uwa@VH;jk6i~?ZZ0<nxHA3kD5tw)J9_onda8l7<$}kh&jZR%G7RbW
zlEMnEQa+|_)3v1<_U^r8)sM4c=Las_SXex_)vMAr&6%mlQZ|KN+Fq6NX_2jU;Qd2;
zd$_vZ>)1^v!1v|P75!)Hv|i`e$Jc7}w!GdR**o<HKb&CrSLKr&fA91ck-b;-;Vf(K
z64&Q{T?)GRMN%nNQzIPAFE~)0j#W*{aBBF^iNz_|2gar@Xnm#Qj_cbC%L5HDCjAHB
z<IL#1-Z`{ny)WHwoEi17RnWzv`11TS-ic#Bo~T@jfrb-HZZz4t=!c%pr);bOU%349
zWJ~-O>-43&(icQxP?HLd4jZ=LhH6m}e#K?z(tp3WF;013_iFfJ@|}cT-C7zrwV#yU
zg8^fk2z?8~&GBR78lE>E(z~ov*s}-N=;kM{oA}Y6yUck$ZEH~E;}h9N%o4B}eX5gQ
zYm@s1t$JNy4ZHhfnSK-+R}AWkUcI09ql7bCM7`<hKG*a{&dd967N#%V5x<~^E{s_1
zuHAQ?suveyQg9`YdS~&)k(h(|Ww+f&;_dq9zWS@v$!DE)CVONx88(5l@X{+Q&Jz#)
z9l0s%Pc59|Ke|mbmtA@VzCT=h`SSGj`L<^tyjcBf_%s`=*~BB$Perxr-i2*{^xmJo
zI>#rbHA&5R6!~f5+xM7$#@W*r8F{PiVsopyV6K?2o|WFiza7HImr{zU3mR9oW1KFG
zzY<&+8TEJ)=9=#N`=QO8-mC4uq~81^9b1IGu}X_;9)bNw{X&0syDazkhfYkefs>A9
z6f0-ixK0O;G+=dQBx3yseKJ4x<EzNHh?n!)_>U+=vpBPVsOUFz!XI{T98M2zHR`#W
zIrCN_r|6;Xk~Z1x#<cPOr_BC;x@bIj`~fS}u4>B5oPn>)vvmDFJBMz~JY8nL53^ey
z$C=}QFQO`j_H1(c`KKNgo!n!W88Q=lx*wayTxB?Y{`Z_8l25VMn0NU*e`p2t3tlDq
zxaNKL*>A)}&Lp$)tO(ETF$rbuHpY)PWOhF{?aGn({S|le_Ftq;o8L8Q-W^Wc@WNvo
z;~fp77R-&`^h-<3`_#VIX-SO2V_V@Sv-`+1yTS(s-CR6t5oNMzZpS;hGkz<aw=v$-
zkiNLzhvENg|J&mpqq8pN+V5F)dUwjDHvSvR>~~@(CbJ{{YuG5hL*)-!V#5>BZSQrF
zm>o36(bUeq`c0=jkL!EsepxrK^!K9zPX3$oe$1Z9hY$M?>vOi0@oRs^sqo(2s*DQP
z_0v5*F~VWpw1bNy3g@L>iZP_asCV+Y55p#QSlrw>>PhGFsSiti)3-X^x)e7Wo3x;4
z<!>+%^{71U{N;6Pz3@D%4e1Y!(<gN;pIYG5GNv8PFSc-9IM$sRcC~FK1v3cAKY8Ea
zcfZ84yub4&=|F4P^XR`39ZvNzYBUa;es;CR)dcR7<8#xJSwVp@4-E=VhxAJy?6<{p
ztJB<y7c&}Oh_P6u^JnHD+Q@hM&-F*fN4+!sG#&f7qSLEV4}F)XAx_PFr`+`L!9Ipx
zo?f~$|6Q+F<J!cx>c$8+&swSb{CvC6E{|{jZhBScBGz|c;mr9ySbyiL+_<eyLn<C5
zBg6H!d79Js#iLu}7q!VdQug1|xWb-awq}Nv9T<o0_A1)F<GUGM=TGQ|x&HJ|=-E5C
zd8EIc!1(cbUaJZIg-yecnwN}v=4S4DR{zzpX$xmv_;|PtC)Qxy_Wx#AuwNeA?5SI(
zf4BdNKCRamJi8P$ucGLG>l-<boj>c}_>YbZ|G@a|P~u?au3ztPbklN+ds>GMvxezT
OY{ZbUgZ~;x5BxvcE4?TH

diff --git a/client/ui/assets/netbird-systemtray-disconnected-macos.png b/client/ui/assets/netbird-systemtray-disconnected-macos.png
index 36b9a488f16673b1fcb1c87037d3d1606dfb1e5b..48cfa7c609bbf6e7cff2b3cec89a7eea90d31c47 100644
GIT binary patch
literal 3474
zcmcImdpwiv|G$am5OOHVDW{0ErRd41B*}<EF>=T;F@)JLheS`P2unf-Jy~oc$6+Jq
z&Excy#~w2yrw$L>vXwdeP2b<^_xk<*`2G34U$5)FuIqh$KJWMEeqXQqy6=oDj<zyV
z2c-Z2kg>aT!5IKV!grd4m=KZ1o9}do{4Y6Q27vg(0FaUf0Bb@h<tqRnApr1?F94W7
z0|4d7;^wOs!Ua)3d)o^DQ1M8|L^zX-yabOH@+j^!5#V|80U-#AvAb*o`bS($PD-XW
z3myUhdv4lYuyRF@vsqS2GqiowrN2uS-<)p$tN7KZ{(+w+c!=;W*<ai?(bg*R!Yg)A
z=2<ZiB}y|f%2UiqXCGjsc-!f<xXlQNHlOpHc3tb9O8;S?D=(D#&t2!{@{k}%&iT}Q
zg*jVE1p-t@TN}D+#*yA)#CKh)$Z>|PYGd=xX|5v{m31dvuJ#T&+Z{<q+76;~lHE}v
ztL1Z!FXlc`#1}%&d-ERrw34lP|H5$YO->V`Uk8uyq$9p6MHThNZ;szyIASf!lU}xJ
zpy%!0j@q+qCF|_rq(&k4nv8+q!Vv~<VjhQ?O8q(4UUi<+ziYh3n1GW@!q%9|-4Zk)
z*AtKQ&&L<<5J{#vr5_#WWT05P9VOtJk1a^PmKiUJ&=f@&oMHP02V%fcB3rJ7njug)
zX?m#YbG5_pe)@<+a+y5BQE#dJWGTB$j3$@1X%L8DrR$pUMw_LFBuL6ubj8&(TzxQ7
z0e1I{82qyC_+wbgDq+IvLaGv&4R)q%BzJFH%b&3b0<XW>X7zb5^L!Y6-m%&>e7+ei
zUYq;^#TytRtWoN$wX9N=goYmR-oi8aO2*rMU?`){am$!o5HuaGJ-mOF<y5yxn22z*
zHQe_^?c>E*9+*LMG}CGEvn-U^gs%2BOH&s+HZe_AU~u(vhz@iW7Z$*eLZ3*3+^rh-
zNh|;@9CJ6CJ5EMeg~DN$w07$p5P$e>NH)Elck|}f#TbNVT)z1#4BE%Z-gLFMG-CXD
zYO+ep=g*_xnyfe{OtAd>x>3m|UNQ}*%{5H6R3Lxn#|Ix=a#UT4D`R?nq2J^M8{(WJ
z<iYVnb~*K{m;6-8fYbBq6gi%*eR=#4Ec|6iJ@O&O(BuYg+#@sB-SNZgIaeOxTQ^j<
zumJPVR7el>s?9~bYl3~#<M~K*M>9(sCpX<^jI<*}ojH*Y>?>2?u3`rq5bDJiD@lq-
z#Isy?t?bV_s?n4@*Pu1=9#1@|s3?J7U2^-x0&Py0i(YUf(xaFm;Tt74q6}3+g0`L_
zBdm_MddNoQAaJHbo)ptr8*9W?nGET%y0T?~ddGA~_<p)o@5sc)qpXPL+%Yzp`qyyu
ztlnfk0Oc=>OibSHe%Fyf?XH?SGecAX57LY#g;BhI|KKOl{+bc66w7%fZlRyWXgZZj
zcOuMsdHk-E+!Utv5!=<E{L)`N4(+ERjIx`P=e{~%mvDgeWZ^YSzbJ@u#l6s$L}VFV
ze9iLMi$eP;a?_EzWu5Ec5ngtSj+>Y}OB&mGkD&I4=MzXM;sL7%@jcWBD-XAERVrZZ
z6&835Cx-q8zc<qKTI@HVYN=8wkz3<=`0%8ExY>w6O5UOeY9k4;p-{&w&q+o?+F7w<
zuf8G$@i7h*DuYer%9XB;vs<qGXq@`;=**;lvHR_wERBlxsq=~7rEHQ5T72{jf`h&e
znL6s(`nKR_>PItMd$7QIPr{f^!~lA@=y$Z7i>QUbBRwie1Ek75$;mDhU*Al9TUzjK
zOTz8XI2F!9rSIlbA4Miw4lZiJ;^gy9`cF&hwLO9NKn>PVc`K&%3639?#aFEgMes&(
zN0ky)XN+(#QzIK*MMe<i(x4wn@C=tbu>8jjs}XOtdkU`#sl%OKM)BBEF?0nHi_9CP
z&2}H^ndFrlWylEhanNc9LAosJ=}FUY%DqzCPWp6k1>6qVEZnu-CnuBIm+VtCi#Rms
zK!~2+IZ#gq>DYDBJ%P0V>$p862TO5$D9=sLOS%P){BUso8bnl+Jo8lNg6F!*M=lcv
zOR3yLW|FV}@O`K7iCP9d`K>lKv?ohmMmfUk8U0N<d0Twq*eORn^@A0Al=t|o$0Rr>
zz8*oc=?|6PsA~IZz*01s=ZA6Op{EuaJj(^ru}y@H-!6|-t<)DOyb2AOwREGD4uJWl
z!J<o{D8%OSbWP0Cva9IEn4!(o3_To{qH<{;*JH_J77LIGtUI2*!So2Vlg^9Fbap25
zdAcVl_H6mfM=rf#KeAC*D4Fc4CDTySmW#s)@5X<jpoAd>-;Hr1OQ-RDQs>?`PL$23
z!0g}Q1Ki6;M1pYZ^%l3gYndgm9wO^`>Z>41WEs=UbxN;or9J^0K#9cJQ$oA>Pd``F
zt5^tq?AxD3X_bDnCDif&hvY1=*>smX%$xUSR4i}g@asdCB`V_|D?k1=n^=W5iy$3`
z*Da&zv(=GKB>HD(QOt)}(rGvL=fPaX*BK}xT0>K>EeP+CkhrGmIe>nW-moq==PDZ3
zu$&0NRj~2_{rRY?VP)vuXHlO|hqLvuI9Z3(pUk^;gH$L<!MAq6Ghu71EluH*SV<P@
ziUr+8@;zhxLpf#&B_u0x(RY*Xo~2-cBI2!YiF~}85PU0GqGJJW|1M1Vfam%L^Ml~S
zVWSckiRd({!lyf-XCZO;{UJSBVd~uFL6X>5m`$IA_o;+C!M(i+OtzQdR{fMqFUc%I
zy*p1W&7~Lr9h3SDB?;lQ%~@G`2Y?Nn^rGEKratq3ZM<51u9TTPOBO><RM4LsCFrZQ
z9v!g8BLsApd8+<`Y=BmP>%K{v+rlyQ5~Fz+{9ml?;ooyN8C4P}vU#o1*K2h3@2Qa_
zay{qVAAdIQ^4`laJH^;HnAE^YQ7*pXy*~i!)o7EH(}GmC@SSg6H0!)2T`(4Ru@Nj;
z$SE-*LO<=AZq@zU@&FbI!W^3TGRn9=m-X-A=0NkV67g1=yw*ekrr;4$*&I)ReiE5J
z69N7}8*Elo7hjM?pKAm&dPxqm16N5x<)$8T9VZ2Zv1S~jnUfXkS~h%H;t7Nab}Y}B
zTvaRmxLJ}kc(@Z?Kv#cn+lVyd6(N<ig*0P26CQFrR<rcgR3vC|v$uJd3WJ7w*s8Xg
zy&**D5~zn~O)>>OwNU$%rUoW<?N$>f*dY@Oy{>^5fC<d6pW88ktrPp{ief&TQo8@p
z(%=`-^9O8l?pfGimhNB>5fQ|O7Y-{m`JESL1_I}YzsLIgc-FVRM&aRGw;QFXS_4qw
zIX?V-tA@AQvz~!er8;&;t5zp7T`0=*JV~FY`u+-hej2aKa@6>s-no;-A8G>}M%!&E
zp$olf;B4g%h3KfDWazu)^=H!+bv7nAG-zjmNvCz)Kqs9+r;Kc<%t%eV^HWrez_Z^^
zz!hZH6kcqjhlu)$tw%vpLn}*VVh`@`Re9y3^CDr9{l5NZKu5u~m^4by`f$AAw0%L1
zSAVR#${lFf`<>@tE9qpDTaJj7PB%p7`@zDyB~&X6L`t=OjDu!Ep<xKi!ta5nXKtSk
zqX=WP8pOVyp8Um#%yo|&V-J+;9{k9jsLe+0kmd6BY6Z;`a&6Zqg-U(I>AP0rtQ|LU
zW?XrRwc~6rPp88exa{8WBKCVB4C!h{?Bf>h6v+0S*7#){M0lL|H*`)4FhpOWcECep
z2Y>dmx4SU0N!?<+n%v^1?vt)?=-_=Qc2R>{NpAUNT;G!pb=0HLW4|6gs_qt5!>o&|
ze00Z@uHCeVo#NYP))K9|J+}#sqSp)3vl+7Z&0%Ioyos<-yE^|_B7?0SjRW1dTMbLW
zdG^1J8h48SMQuM4iJM?wmfR~-dsP(E#IpGzaHibbDVi8pCzl)a;gE0}-KRQq0)L^3
zPN@5fs@(LQ04V?5DNg}wvKUs{-XJ!1c9Qzv<=XQNUf#aeCE-1*9$n;iL*%URt3wYY
z{c^F!G<#_k4f<&y1$Pm>F!Cra4P4*2nYxyoW%LOzHg;;V?aA9XbOy=jB>|e_K>Ndx
zl2=tj;&dTb!dQ0${2GqHrE2_8%fFS?L=DwQk{-}BcixBp+>g4DxvhRhGt=~oHhr*A
zS2)#+v2l+HxET{@?jIE>>;MypiJ39P)EIKo6>{1f@|(G-i4g>14uMQ9ywmtU35bY*
zkf6B#KcTW=Z>ccB;C~ciLJ)z`F*gyB|2yZnsrhk;`SBC~7LkqOX9{xwI~&IfmFIm^
F{|k6OYw7?1

literal 3491
zcmb7HhgTEZ*9~BTbb$u~0fdAmQUs(+Q%dO4q!<lK6CzEDAT@wbB4_|L7^%`hkzSt!
z#7OTV9fF|rP8323-|+bt{MMRT_nf=VoW0M!ckax=-moxYV-{crfk14=2z_f1hz>C6
zKxZMqfP7fw4h&3w2*&^rh=u#~rUSiA=Q|Avur|5|`q(G93^->z^vv}@pb8wz(Ooc*
zNzGVa&o+c^eY!VU(CG2g?WeCcTAj)-vLKwwdvh&vWON7Von@DHKwH^Ps?#DIZ!1Bs
z!0H++`X9hmw<q7UoJ*%WnD712v$A-8dyzGkH84kdx3s?pVw@uOzg_(Y5YLD^f+_4&
z+I+uG)DdAI_P^_qM;>{^-q_<q9Cag!jh$k16hwOp*43I2+)2ghEMiXRGh7~ZM8Shx
z13J>KM{53@LB5U~#;~y;EF~h?(kvHI7b*+OFyF5$3Lk$j3Z3=czK>F5uyzsL4@yZE
zm}@CZ+e{YNW@e1+HAAqC&Gt5lrzG)S$=c}0?LHQ`g6@p3&ZbT%eH+boG*u*u7lT7f
zn;$^(z&%D8SR$l*A|;tOY3o(<6ETY|S?hG_<0#ytjMUnBH8QHiJ$Cf)w$O3Dl>9O}
z`hz;$+TgFjU!0RlQPv&F#3(gL70D@+x598v+pD5FeiAIva>;7!kz_@5d-KE38BrG)
zR*=~FTy4fE&0ysIm~XLCG-YWqp?^m{d<DsILS~_j{oq3F{cy=V*yF(M)EPCCBaSv7
z?aTbWxSLFF__bcI`O`>l?fqbPj83@d^~aRMtP97qttxyWb9;mEv(_*DC-XM`AswY}
zJSgh>lRH_+K}LCX2E@@e)LwYRz4`mMRw|@tTJ+>_X%FR?N_QTAzgMUoeUhMM4-$^5
z8G3XSIj|bY@pU#zo2I?UaBRH)%r_x&A>{bNJz>hGAIxaEXLNwO9quJx_zmk~wCV;W
zUz@RNIXjhB(kb|8LHE#TENcriXu|a*v8BmThA_|HdUedHsZeofROR+931;XrI`)Hl
z*u+&$M19L5SEua?3*685ZCB=>XP?pO5TsIB@qHsQ6x}->AOn#_N{GEsRSg>tZjz{q
z7K-rsaH}(%lA$KoQBj>ttiA2a@6Zw+SJ7CP1;ag&OWHEl!<xx-zy>0@))65K^^M1x
z=P_m|==x2?!2%#Y_i*nL7cXWc#q$uH!}f<@w@!}Jtj@QMkO_Pj7qKwJdPV97ySFGI
z@@kLrvfE^1RP(*ejyV>QZue{*-(@sZo{)7v-N3oQj6}%VdQj|<SLQu^NR##YXx;Q+
zSXrFYC4}PPz9JN4crdx3wLzAK98A<VdBEBNaKVc@I#x5fS(D9yh8kDM&o?~bdvDFA
zW~U;51wgu>O948R@~HQKHZFT_Fnr6T{xm7FDC6u*+y?n;BBkbYn2AJR;KCxFsCpT+
zr<&Pg0!;o0GaeS1Lhe&<bqPctLi<YaNb=xlo39qP{|?Xkn+yCBUHl@hVbeP_@3t4j
z;A`E+BtH6yl#5~20-~;I({nWMzD#1UenO~eqW;>YsaswAShU9~zoWt^SG^peKKBcB
zZn7>vT_~=u?(6Y?2fo7(Wij1K=ipW!pYMugab@iDvI{e)!tQdasS?z<e@(uPPj&EZ
z?wooPXE2-oAl?d1G%PUVbXd)+BC(k`oU!QCPiM882)As2mDk$$O8PjodXiA4ur|=w
z$%9Zuw`VPHN4OAEYNK2s+HeJ~?hJ3YIZdjQ5A%zq3o4YFc`vr~BFz<UThHB8njF>v
zOXLvbKkm~-X_f~<?ukjwjM!*~!*2HPF+eDc3=!+3lvweuGXUNS`O<+FM)*8m1TIr~
zXtYlzxoB^d5r_|{lDvtNPZg&az$4ZNI?PC&H}ZQI7uYIPZsbpwu9NMc%N~V>5}flq
zza}4>*OFF#3_7>vo;dn=ukR=GVYMw1R7nJRuv3)u<(#VZ`(cHK;@loF(%wXs-Dq=?
zXQ<~vqFgWwN?iFITyMM9(47burn)+F*iAGI)0&LYS?mH-hobg-{Gm3N2WRqIGy`jt
z&tvox>7Lcq*uw0g!tYGd(3|A6R0lF^D^`uaq`E;Lw#ir>c-`;XJFeA>^vM~KEOrw}
z#jrV6fH=yeEjNl28}tu`v#xzH)I43w)-&LFbAt9uKb5gqCg5p9SpPGiwBG!^vdqC<
zCwc}2u77;d>ucDmr_$bXHBrBLw0JRE{v!vjuFGXQ|4DF{cxBTph!WVzqp+-(4Mj#x
zBGo|Ti<xGPFD(x<ey9Ic%+yV+4FYf`(Y_N5@v9#S#pYd_175~g6o%hY5<Wh!S{Ys#
zA!mhq!c|w5w35jO1*E4_zUxYTaTu!TFHtnKaI;dhE%TvwPtisAdf=@3UtZ{O?%bb&
zKROy%nJaUjvkR(2Wv;(gsl&4=m>@OGiySrao1d_J3_u0%$GKg^h~7-f=w(k5x4$A#
z_xo|brX@lQ+-t_#Km?%Ev4-WW8F2*^QpG#yM2Z;3%z3YiLqFCrd38rOrWDzq`O8GO
zQnHQK73?~kub%<Cd~QChtFET*LH$gK8#IU5WXytiB}>okZ&F(|YKGkW+L~4N<aN4X
zdc4Aof`}$buYy@xYro}v9+Q7CbtFUx<;2?X<D<?r4BY88rrv_EU4be+YWv+6At}Or
z@_WInMc1rQFg`hEqUsL-v60vh9q{V42`XDoB&dCR?cMNNzo%j>eczG4bf)81M#ZA?
z+GBH4Z;OpQ16LyxeDM(pt48RCd?}T<m;74j_n$J2%Mb5JnvwWs=P-Wn#{-%$8i)2m
z<Ni*Jg4pD(r6^CB9D~UwD(HTDs^%Sujis%BX^=aYu=T8CyA;~@=V2u-S6xL6bDH%=
zt^Xi5iwkub8bkX_#gni~gQL-Ch0!~ZaP8$4tsx`JQt@-j&<ELNm=P}^r?3vY83HG!
z&4a<JaYPj~$c25ZgGZit8E{po(jW%{uCkJI`Pp=-)FFF)bBJ*W1=siQs#y41p^3zS
z08&fLOZrbQ74rSn7JmR!v+xds#$;Vlfof44wKH+|x4bi5kw?pB@+HsMK6k)OFqz1%
zas;h}Ji)y&Ib_jDQ>E)R6-3=ME~?fM+M&znQHtJKusMnI+A`JbbET8I^rNTptqjNm
z_`gwp_f};|hBx{lWG$&C;%VPKI;lmnl{XXWtVRMjJ3ULCm{ZcIvg8UxEVNsl_;(1E
zTzvP^5!BTPd~jvxl|wJgvhqgnY?PlJ{+ZjNv@hYTg`JOiIg=-iCQ=T#HLxC_-&6iq
zxwq`TS1!<}4H(OSf_g2%GW5Sf`Tbxlx)A}K`<JAFlnx+##r%F|bQfYt>?97an8nni
zdRJ9y;^e{(YU#ZUsQUn%pv!df@1EmuaxxMB!$+N4gWv)3-Us)e$>}LWg;DHNgDFAP
z-m-9O@a_Q(+BG&fnvE9cFODHqd;tyu$GImjsphqN6je}aU$pIKQlW(h=Y9BQvh<tg
z@x|S~)Qh`w#;v}b+R9ADF+Jae24Lk#i9BWqaf(xk7c)U+!_i7a{3k@xPqMgnkGXj<
zg^Dn{%l?lGWonk%!>hJcXJ?M!r)boSs^Qz72`z=J2%b;#mFyZ;ZJ;S~$R7j`D{|CI
zvWstaMQ=EO%Nk5r)m+6Z-nri4ydukO4K9mct-jU8hef+^bcRsu!PxzFpHtu4qdWAu
z?Pq<IP)HnX-TNYdp+ElOC`B>&M)kC*hi-|pCAIJW-B0VLKZUHp3_%)!#h#=pWed0k
zg2#0w$ZM2K?G)kG%A*Z4LhdBXh(f5;{2+=)3?J4`w3W1^pw2+@m?iM*OZ*8fHk10&
za)TC6ElH*n$J2SI#=8qn^zCLq0o9{aS^AlM8*zdPV~ajNbe6dN$)Lp9bduq2P9j~s
z?-l-2l?FFNLegd3svGewfYADB4B76Se3-+3Q<9|-)!(;e>D!OuZ1oB<EPOfD+^>~5
zJ5&22&F@&Z-I|U3ESA?gqNukZ?zR?v2nG}`cWcmt5>n7iYna1le|7oA=)+-<{RcR!
zt-;*htW!&{q<H)HXI=A{7vOG}VrxkvCM45W%_!>?MZ<%PA)#@YU*zdZPC(0f>3olX
zB|5;-a5i27{;*(y?ReYIcojx3oPmg!ECyK=F|;W*A(WSIvtoJ$=2O6q;4!P#)J41I
zBx1TJUjduN<8_Ui6nc@(jrDx3q^MnzXPEOy4_>iNX;MMd?(zUF`_orgQWCRi2*tPJ
zY$AfEXY^Ak2T6Q4MUhyI*EIyxX%|7FImfhiLr?i1v$p0}y-S?-$l4Vyj=@AiP%OnY
zc-?CyBHu<q5Ax57&1wCE0d}N4MS07~q+p7*HO|(dH8<+Lfv&VqPT6O7&Km*5ca}_9
z3P!*y`SiMWcG`|?gtYSDubbj8Ok*_dPueIUkjwplsz9%{yG3>2|68j9v^Fu#4Akd~
VFbHp#EYMSdj14UGKVEZ=`9J&Jr*QxP

diff --git a/client/ui/assets/netbird-systemtray-disconnected-mono-dark.png b/client/ui/assets/netbird-systemtray-disconnected-mono-dark.png
new file mode 100644
index 0000000000000000000000000000000000000000..035e71ba7f80e8a04caa63fc13b77bf2ed147381
GIT binary patch
literal 1235
zcmV;^1T6cBP)<h;3K|Lk000e1NJLTq001xm001xu1^@s6R|5Hm000D<Nkl<Zc%1E-
zONd-m5QhKTJ>yJ_qL}CyOhD9#t2|Ip2C{LXh-gq;1UGS!=pvv*R1ic^M8$<}ghV2U
z?p*i+-S_~(MTigyVn8K9Fp94j-)5ZdzMqRzHMi!bANTgm*a%&4xOdLEr>g#{bL#x3
zCj<0<md2<ZSgMQxj9SJ3MlE9iHKiHeuaWeWq=S-vmei6oZ_i$BPEuRahYMPO|Dt6;
z!``n0-U9xizU06>aINc}FdSK_E#T`C#qxM;y(E*AOL|n&W1+v(!)`ZeOPY{$K+>TF
z#mjgS`|`-O7)-<Z_Di}aj5k$XJV3uox=PYdre`4o>m;2g=`u;{C0!zEt@WKPX;LX#
zbCP~D1t%mOmvl_h*EZe_R7cX&=KP$bDb?S5x#@aB(huf$o}i_*^w1FN(Pa)e3LF4#
z2iAo3J^?g=?e+~oyQcn*t^Ln|Dbt<#9*7(5Ih$}AXoc1etyOBBE(Q+=Ls9>^z)Jx{
zUJ-x;-fnuDQLjp!ZlG0BIp#=*lnH=66qV;{;L?(fhiiav=ilq*d<2l$U<SN41PC|u
z2}O#hfUkg)6w#Zq=iZ7oJnNeW0gxGP0F#Ee4hRQuebD!y^?8&ZvHod$K0d&P>)hYV
z`7!_pkpZiLgB3xzp*Mn#i-BKAORF8ed6LDMc)O&-#h2wNV1^>N0|6*}xEA=dhk>%8
z)4)cG>hMBoo}Zuq_XRsMz>lUQ76hMnKSed`ddl}Y`aNCif#ZEZc;7P=dua>ZD^wo(
zXM?TXC0%{XW>o+Y#75w|pq%iY+t~ROnR~wi;G@C0Ch(c*ip%ZRk{`7J#MEsit;Yz$
z4ebu!Z|~#0i|?s>!@Ql==LD~3*{lm7g4hQ9MX?khmCYt8lGDH!6#Jr=c;-$3=TH=l
zZ*6RzK4o(l01?DZr09C2V%dD46ybj28QK}<KWlx@S9QJ)fC%CaGxR2l%jT&N-6{Zb
z(th#He<Sb*a3Oul=28Ge5O<T(TrQhc4?YL^H?YBUYyj>IL8;`^F!urH_b!_x9ag%K
zG&J~P;?gmSyhGBfDyVm+{+FXOoT)3$&6`TRd|%L0)p@CKayHCusD|^>@R#}+sUyP}
zRsnXCJ##J2Y$X{MK&Es@m83nAUQx<MtELVlU7>X2%T+Ifl7<I>($%x0<oI2ZUN=YD
zy{Da_Ba`%w&1tHB7Hd}_=Or_wgJ*~JPXcFAorXuYc~RZU6I<O0ez<tqoC9v4D6y-7
zLlr>yLAJM~cSQlXk*yS@D<{#5+3?L85;=>GMybU%R|3EX!8zwVCn@+#Mmm&w(QyC!
zmXh8T1>i<*>*AEZe*;_|=3EJUZ)0T!`|ff$UloA=t~m{SNq4sCjvWKmQ7nlqz^~z(
z4g)UfD*?dykF(8QT;DhC5#WO0+%^*D@$r4j<$M(Yv1~fq?8o)p$&Y|l!O5Gg|4&lc
ztjso-3cwwB(HyAqvtV53)1)&(z%GhQ`m#hH`m<4Iotq_nY^P*Zw%L-jO47@cc3GdF
x(6!j+AX(0z*GD4b|B;Pa#sEewV*sO;e*xEJ!J}<>$UXo7002ovPDHLkV1lEZT7dun

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-systemtray-disconnected-mono.png b/client/ui/assets/netbird-systemtray-disconnected-mono.png
new file mode 100644
index 0000000000000000000000000000000000000000..d68c4dc5bbc9b83346dafb3f5c886e07dbb461a9
GIT binary patch
literal 1088
zcmV-G1i$-<P)<h;3K|Lk000e1NJLTq001xm001xu1^@s6R|5Hm000CBNkl<Zc%1E-
z--}gM6vsbz?u;|3Vd&HtjSz)Cnvzfq_|k(RqC*iRz08Z|Ltu<l5J(RpCO+6pp;4gz
z0g^#a{(zu|=)sUksF(=Su*|F|^^VTHw}-vHoaN@+d-play&#+~Y|gp+?7i0d?!C_1
z-!lUhDpaUY;XXp$-ERWk1HJ<O1nvTN?Aoa{fCb=-fkkYn0Yi5GEbtjH53~!m7J=k5
zogCDGVb|(8Eq*>^^SeR8zY_(t05mPIUcukB>xVsjm4*n$WEA`{3!rI%7hU-#@E0)Q
zY%*-uM}ZZ<6Tl?!7%*;qOMwwH&;b4c{s1lmKLK;VFZMi-R1-J^?6LWyK7d5D%+>+m
zcZ<8_2fS5qMSN=jmw=Cf7lBnSK&9EVjZxYZv9A>S-jUBu+4pV2ZSH;Z7hH?0LNmwV
z1@c$<LEyL}k&^eG@U+>flLK|ifnJy*`Ps1FubHhH@HFsv<m2rEBozGFZo$i$Ucgf&
zNXXGQWLrE6{0v-ot2b)b*+d`O^{09fz#I<|Uf8n*Nr=F6&fc43JJbgDTmP6{-|gW;
zHjkwQ?@82vWrPzlb(Pw{r_RP|LdjFf)R==dMmzC&WFt<?8)RiOxpHaXIPh%;2eG5u
zz*@5E@KH2RCukdZ-T9dSu9*#A5HxR}ja9i%hPG>xQ0qI9P~Tx2UjsIfU!hvAf6DpV
z9ob4Qo2ew$0#}{!xISM69wOVha|whmx!~%+cV^3{+m0xXQqb0IB;=zfAxFF2_~|ae
ztLdHE>*mc^p9EgdvRQ`2X5c1SDyVEq(2W5<ki8e32x#Xn1Ix*Z#;^A54vA&642i9T
z)zwP*viSz-rB^#N<K`c+z7G~V_?W~?=IFHjR@uBkx-`})e9mmtfaigKfrlwrHp`HB
zm9Wim*-Sn7MDiA}#%!zsUa|YW1TVzK*OQ69RDtHx=w-8`lqpm)%P^HT*VoxmXQzns
zwq125=&P`uKRh30x2kCl+rY&#j>*Wbw`+^&Bc-2^b8Y)c0s+Z|l;+FnNMv^)n6&FK
z<z%>5o09W=hjhsV;o#Y6{Ug8<(q*_;n~yl#eTP;_WwQZnvA$u#iTX9YNoe(FBfEWt
zoNOc$T`hvVm~vxQ5yV+1O|)ogvn+x0E;wnP>ty<+MmUr@$#DJN9@*_H<m82%pmcu)
zc+$;T2mD69f;|)2?JIP^i~&EAuQnCf9N~{-N{J1?-`u-n$sg&91?eBD%}!chFYQHO
zr3-E|LG$SOQR^Rg*_7Jsru7x%m%sxq$ZgjDAE9jaO>M?d0H4r(_4Cr{3?c1w%I+fj
zNFUhhL&(>8Le1~>4+yne1QI96{uD0^R4!DgP@zJFuJ|9-pl)IY;7^MH0000<MNUMn
GLSTZl>>!^2

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-systemtray-disconnected.ico b/client/ui/assets/netbird-systemtray-disconnected.ico
deleted file mode 100644
index dcb9f4bf83dcfcb18d4858d5cf553895b092eca0..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 104575
zcmeHQ2V4|K7vDRYK@>3p8d0!Cqo{XiY*E32n%Ib4L*M{g6a~d#qnwmrY?v5>Ey2XZ
zE=4Q^3x^FA6O0WbDyRthDFPlG-~so&*}FaOjw^eWLzkb=x!K*BdGG(;%uabTi(xd(
z9Ba`6gU|_^Z;D}aF${BZ62|w#^?%?RgCUA{!LVRk40Cf6#=8y2u=bx}7@IAMH=$vp
zLLmeAL;2Z!h+&JPX;?RiLsoD_cpU-^gM8077ZM&fqW>6?yum=(^(d5=?c&SzSH&tL
zvI2v&=Ya%b3g-!2{I~)aFD}=G#ci!R51tF8t;N%`A?@sPlvYUI+;~;#(S1n!3u6tW
zohy-6m`AOPH@BavJRrRj^PBQoak)hK5Hc5)Ut~mAD$D{fFo*Oh%%v4?`Ibn}SXF_r
znI$g+NK1!%2Y>{O2r+JN^8p<3dy%{+5L!y+!HB@I-zmC}KgV1l%>#2eUN(_OB$1xM
zu0)t^luS$fX3iI4$Xp_o7UfX^)E?ylVHojzy)dNW3Ug%zzutABjT{iA?+o`R04)Go
z2DBJx5|D%FK8g!%LejQ`zlWk{RQ*AEWZQoN{S72(<D_g#RsP!C7YHy65yut7@*Ra#
zYK>ut@-5)HiICVdC<O=w0=6&>N{8ARCm=T<)c)Xq(C`>*J0oO}`oEzO5Y_wjP#@ye
zA*O%%3SIFI<<18p+9Z`BbBU-;XK@GVf(KEX`!5+Dm_ZWlsW&&v#kZWU8y<LWs>)}6
zD^WJ_KJn(VbWuLa1Ij<5hzIoEkoPWxYen#Ghu)0#e^9m)P^Byn_&dy7^!_L0mJGeQ
z>$NXkm;;m@Em=Mj-qp}wP$WBXz1qcx+gTSpK-pG6PjMbrL)k2qWea)m=BDVPe3S>2
z?a2s*vVBOFjdTGRL4O5$#oGTt`JJKfRjt6@2+XC!*?7O`CiKg+s*h0iM?iTDguSGV
zsrU`;A<=Fv&=dh^hgw0|IY4+`C{MCHNc8JoFrs)Z)#U-oYypJ&MT8sz2I{wyu|IeQ
z^;IR(Zc(RvklPZ{N{<-`3>5UCC2?T}h_NSlKz+^bWO#t*P+$EoAR?`FD6bDLX$w$C
z7%)bWlm3*d@}a+O3h5NKxkR2y+Fk)OxL%)Jl9vgJco4nwek00I6}pJV08+RIDlHrF
zkqcxl%Y&%Tu~k)>Quk4NB!N2`TS?tlq(2x-)GI%d7eg|wR2j_0P#<9|irxuoq%VVK
z#baLhy+Vz&L^){OlfekDU_n@{LHc+C14!Eo$QNiMP%=;!&;y|7KrevMxbh~@NuXGu
zSwNEfPlGtY7ugW;-<RM)+Ys`a3#4c~sfeeGj2OjZc6E7z^3fbcI*_9B<Xx9L=2y3D
z$>*W`Zb1G(aX|4ZNIc$`%!B&<{vaTb`K!Vl1yz_ekcFTIs17s1Nr2H{S^<a+(-Lef
z9Htn;>oCl<2B-?d97}=nG0d8SVHSwk7zQ&GKqh!1NXUVNr9jeuXr6)r!~zn}Q$Wv|
znx_Cjs6Pq;3IU@>0N%0a-5;ncf<F8Lm`8$DA;bIu-wr?}K=S%1>Rk(iF`_R%{zuDa
z2KxivHR(r7%l39%3XLsb9;;mKakHiZ!}tr0JJI+^nkTYxd|gate#V;{t0_O4qyyeP
zG~yqv%gvEHx50-wC)7nS$e(Bod`c}D5byKk@-7^odUH=QSS1GG9~A<;qw!odDH&ic
zgILRx981gmt_2;8GnfEE8Mdh8AMw6G3GNbe127kv1LO22hLQnzZwaJyT&~Vs9<C1-
zcd4QHN96$jXx&wATZGShNa9QGcNw&&c7~Ec)SlK`!(j%Jv>ACavADk&ihq#~Mu85*
zYut+b2W0B2)V!F?JwE6_XY(#(umJuOksV2`lgY!D<Ta@CXBd&%&FPcjn|KCz?+oi~
zl_b`Dl;JMEht}*M&q+l7`VOJ2aWEgwm$3seKk8m*gy8%?fOVC6^SHW}1$amHUy1we
zpgtu@8&UY2^t!|<UGpoMAMia02+j54ZK&L}S~cZC?`k4HQQo*OjAXgG_zi6*>O)As
zztFlzecvgybb{Id3I5UV-*h<#i)4p9y8{);lq1xEnrnDcc7)b5>#ysewpk}W2O{2`
zAiqcQcqgtg7i#wYLVYD751BBN5uts13O3Uk@>M;4A-jesQ#Y8PI~l$u<DS~sJ>-kl
zS&{#jWS$Cti~UVxc$BgiiF-(AD)L6_`x^O70Pf8pZKjI+rOQWS7NP&8>iUb;GeKu0
z@{dth2e97R1oDOVIjQ`mcu=+mDyavFb#STla>_)$i==%vME%PYIr*q6M|@xDxDo6}
zj(?>%t%7nB$>;$3PiUQapMpG8mGSmI^aT|4i%>sX!~B){jKEqk@`v57Vczw40^eQf
zIsolFbD7e%rd}R0yktY)NbcMnBeERvj@D3B<w5>Fn)f06a$pWc)ITGiUOq4Nd{*Ec
zf!?i(eR}2RLy8Z;y9CD^`WQOG2CZGUlB^35UkoH3OX;8-wBC&TL}rNEV6mT$4)R7g
z{2;@BKe&cuhzCMz^r(M^cp!rrk{k6!Q986PJOg}!Wbr}$RdVx2<jO?6DfGEvL{_1?
zU<c$3<OYO%yFG!BF9Hh)`5BA@8UWND_*FUHfag#;vY3#;?W8XHMv{6|_M5>LpgM;9
zDY!sn_#^X-LZ2UHyl8U|c>fsa6p$|J+kc>YgU#I$a>F|k>0&4ldQVD^h1AzgFp+OV
zga|*70j*J?`i0sMb=Rs`4Z$~6CWQcn0EGZTK<G6@J_O$+3$zc42;rv*ii<-w?$Ctx
zOd-c64BV5T44`~)Y?2JYvB?$1i4ZwEp*T1`S<8eLC=U1W5S}+damWu3A%7Z*voZJ&
z|A+qv{6T>j2HD{uB!>cFpO+}iN1-F^^+F-+{bEaoun!FX!$bHFJg!QyaF7VHMh;iP
zFdsbwaXf1X@gmj56D`8J0kMI^ep+yW^3wu9s6Pq;3IPfM3IPfM3IUY}h~{wJU>vG{
zir~3{&x1y5D=G!i;sKBy_ltm#%p8u!&)~i~-dwfz-)SKh>7+1c+7V>0)TjIszCOs0
z(3v!I26_-=kI|R>^?ZfAxn~R{7U^QZ2Hx&%)?qzBYYCETfa2diTo2OB8R$XKzn3m;
zK&hXJH}?Vfm8+abH<0LfF`{?D6<uJU@>~G4CePxoFr<8B$^zNZ8i!VM<#3*k!nIhj
z{UiCk;moDk+>glcWyohh{ym!70P+nXwJ)9U$zXARGo)-}%7XQVk3fF)*L~0$JhA>u
z$fr821^*9~XI_!vTbIv({HxTm0kqddec6TY25;^a@IBM&YzSS-j`9K<K<hMlq%c6T
zll9?IWDmYvFI~%^ZGIp-S_f9%-$gzT+RBbF@#a2t`KH23Tb^~D9^_9~hyjva{$3gR
zeI7-+C$9T&)%M%cwY;+Vf$Y72>c0==pWmmM+=Tqz+-i6qc9i9zq2nMw^3!-*50L+@
zoHIA1-tB};>V_;XDZep8Vgh3W<da!~V}SPhd?VwhrLK%Bo@azr3^t^EWXb~B(OSJg
zQ=ebbwt;*+(OEyn_CAc@n#26X3(|6^(6PdNVE-O&XW)B8MlXhX26&3W`}La2MKT?l
zBNEB~9DEmz;(ZAGgot<&xahg=%bb~{v$NwgwG)tAdhZ?T>#06-PUH8WjDI)s0VM4Q
zt*MNP(m~lQpnC6qbf%ZW`b*Nz<))v5w|#{D6JfF<{`7er-g&6+E8l++^?fuQ>nOoT
zp`UgXZ<Ib|mCYOE9s{J*|5WMRmJ%7|>Rt3aI@b`&l}ES1_tPMAWl%oyGbA+^uG79h
z?B`M-J8^xnte$iohw_nMqIjR23V!gj)|BZ}oqHtqh9JLBDL-jl$`AD&`97=dTdI@(
zpzwT5LeI*=t-6$%$O~k50@=~oa>~k<e^0|bWRkXl=88#{jow8%T|0vO(0MC)B+Hk}
zr@DL4BxOhaDK*PZC-kOm2)@WIq3qjgmS3M=^gh&NPcRzmklW8DTc*}~wqd_p{WDcH
zv42q-)Nhs2D~Wd?i8fDGZX%usbyj0PeAxS>@Jv^2Y(do?I!S!gI3tvhSvJ&Y?Fiup
zGM>~%PDN>%X#Ss!-s_)<D=QnBI9i`jYwd^;jqiEWtFMEqvs5(LN2v@8(rZVewas`%
zy3^TpG$$<YTxPhYMSWL<0eT;jT04U0q~|cTXzNsARnOl6^=(5n=v$EEQRUhZ@EfU$
zXPw?h^TW`mLt{iO_pd6_yX<v^YeyiLdh2-PFqbV~HvSam%66i&LUf9&V&0z0n=6B|
z=K|H6zt9s;Xv~-lG=&i%^y`4%Xiuu4FsQe71pPZSmR$jK1n2>fF0nv!BR7FiyD|mJ
zs^`}S?^@(nCR{hrKMs|^gOjp8F|6sLeh*sDLTBTleRmsykgvmWpo>7+KsgeG;^%>o
zUUve80U;luzCfhrX5l$Bmm+^2N%xo>Q6_&w-2?g2{$Zu_NpN2`^(2bt)=+XPD;MM&
z353pY*NvQt^SNnkYexhwAUpD_(QE%xgm1kw69^uRAp{<guk{%qUAD)PcBRpGMhuM&
z$dA4&hx#Y!K<fKjDXs$u3#l_33@w|w<)J#uh{EUL1_STNKC~sBorR^YEY$N90u%xi
z0u%xi0u%xbhk)>00WJP#;|DdM(+kjn4R{C#GzbLw===m>h#v-l4oC=xI1!@L4O}6P
z4pJaOM~I`-4y+|Y0mR{C2=oyfaYz(Igi;0NLjv?X3d14fh(b1mt`LU+h4`roj>7U$
zfruXz;s-fEf%zy7AqRy}5L*<Y03^ecLqYgC5D?<Yp+G!2g!%Y$n5!ss<Ot)AY+(o|
zL!i?h&<PPZSwK3mgd7o+`63A69xfp&3k1MLz(aTd54HFYofE+ZLfnYYiGW|!IS~jH
z>W@NzLV!YmLV!YmLV!YmLV!YmLV!YmLV!YmLV!YmLV!YmLV!YmLV!YmLV!YmLV!Ym
zLV!YmLV!YmLV!YmLO>n@u+I|huSNT0-Yr_g3xl)E2gs9|x+aYP=wAEpnJV|~m)z@M
zkl!xw&1N|F=_VtvQsaI1(kQ*VG5DS&I#UDfhct+8^j(gN<acR(xOzW_=UuQ2*!zjv
z|3<HWiSHH&&vszJnccqSt=|P5=~D(#KR~lHg^a{*6rStD;>PI{yLTmTsQ>Ui=Em6u
z)H}mM@>~~m{-ZaS@vi7epK^fy(f;{H^&U|8%@Ro)@Zp}<CvNXb-p~(VG$#F{GkQp$
z@9I}R<6Y5{KIH)YqccK`z6~J#-4>!9U~!)?SS8eWP=)cpc{r^>|GM7auTy(cTla(w
z_?3sL5TCjY2!Q_a^Ye|d9bm3jaAq5!W94Bbj0YVkB`ZfjG#*4}E9tb}YMUPu&ZU!k
zUY~NEOP}-TTfR@Z^weF10Q3dXxm(7ge{^=SCg;}5u?^-N?qEvGsu2MFrx=9|Al>WY
zyH$iOu(;W(rKg?{jRzZcZ9rGwEF*MJgtNKxDGjSe0P25igS7$Ztn%4<`hE$ETf|sU
zPU>7p)hNBYPe2=hz9&{>a2r79^1}C}$ehuw@iTth*mqZRx|0lakIv>bTwf6BUeDjI
z64^|pOF+3!zfqw()Qu-623ueX`bX#M8pH++q<dnGIMH~JHeOCZ_vnmEz3U(M-68sD
z1`6RDnI6WAyzy`beSt&zv;i0Ro}$L@a&2q{`HIC*zGA8@4bEhD0{!b{JXp_nM;m==
zlGc~<6;q{ubRYB|qw6+6q3@0+dek%x_=+)BP`+ZSY(TU&ptJFyQr{g-b*X7O%2!O4
z`tkel9zfrS(7G?EkMELd)qg;~V&7CyzG5V-0Q9fbco2O@lC<xRruA8qbiS0Y7zy>G
z^+An&#WeQc&_th_q?t?kijlJc{CiAly$6h5_sCv+C|@yB`WO0&ksc3f>APdtxq;b~
zuNWyCh^kmhrZ0&5?&!#WL#sX>+4lj9OZkeCFaXhbFi)us=-PjStPZt(&X4jHBVhul
zFR0j8tg-4I*$x^HE~54hk+T8bsd{Yy^4-yw|Aw}8n`C-M1TUS8{O|iSqVeF{z9915
zfp1A0<Xuftmum9@{S~22S5A4~^-D&6z$y;M%MiXh`qH^%zVqQ*=)!r<JZgPVwFTgN
zhaz|{4C=ojsV^P>X2Mw#BK@N<STzFg_Y(|ui7Bk-q^sS|>R4~ODxVotA*ugLMnolb
zmV^=$hd#g-=r0Le<}~v6zQ`V#tEKcWfN$3CQ6m0(eG7CSO|+Hx9IuhqY0_;2jQx-;
z6Ecaz=t^pRP{z_h_iM!Xh}MN0!jF%%Zpqjtv|+L`iQ?4WAqo8hCd=gF6bA1BG=D+{
zYa@I{rtc?h3sF3l1O)HxPpJ1Sxw;p%0n7kc<2ORxlHm!REuuuWqW66~2)ajezI-JZ
z;qOmf?b#)xGhIHzfVoShvPJUNzpoV^a2W&icCJr}FPPE!c#&z3VBS)N?$LdazryK#
zvjLEMBw5`P7&f-?Ao52hcvlg=S9^yTk>!H{54Fz*LgQ#%w$1v^iy5Ny-7jq$QI#X#
zhc*Co-wkxHvER4L!bUPD1m{essPnS-v)}c;AbQUMCfc13i`If0!FUkuLsC=!@O*{;
zyV?ebbf2d_CiVNz%q7PE9$>({g$A+~y^CuDNG8A{R|7ocV~ExU{EYZL0Ow6;ENc{R
z%e&MDFrv$?0E?R%<Dp<oh@aU?W(?K<&oG14==ar^uafbOtPKc#IxF;c7PQ{ab<xCj
z)bIDnYb#DR_BKG|&wEnW^<FYRG`=#nzM#xnzdYTNz1C>Yl0g0&peMcRp0ES7zM}7O
zJn8&dFy;e)MS?di!`#L?9)!NWUeEWC!WE4N0e8|m(xgo%nMQ|oUuZ*7yhiukA<+E~
zQu?XiztL6w5a)w%Z*cvi_r5$o5AEb{RK8-M`+EKx2C)S+9&F(K0b2I?#kMR5ubqvd
zFW6wZ7u7HP8~~E-w9ea#xBlJA^r-ngBOecf%?8S`Tg~Owu+3}`Uoqt0r`cSeI{0K6
zYa0Od-e|t}h3^eE@Y(=6cgP^NAH_4e?+$?<^Ei-Qx$lmKby-tPnT9<356+g=lur%P
z8I`XX@K4%zM*~?k#}(}tG{pG;Xip#PNj9i#k-SJ_cn>flD%?PBQhr+o#s}92sc-pd
z(^rId40Dx%+I{Kvv%!7EK%aeq)b`ymv>oWvR}A?g8d@H4c~QIu`|gmozB^(Wq-|O+
zSfcu=^Kl-u8O*>2)IEV)6wl4j?*ZuNBj24oL+Vi5vUKh%27OCydD2mOgYF$_jJn5h
z*5%$I<Iz1~g9iETkjQr@M@M!`@NTdWwb$Cd2aKZ4C))nEA^6Z%w$SH$K;*lV)mU|p
z^NrR9G#wA3e!ijRci!q%ow^aLFa3-BH_{um?nRiQwHdYB09aE-`_GMB{z^tvh0eb_
zWC-6KL*uH}8B(y8Xn;9=UD=jS_YR4CcZ}nEotm|Ya&g6d#YoKg;QO_8zm6}LCmq%S
zo%xCZPkVI8m%imzD}NVdzGC1{-avDDYRRBLH#+(55RCISD#%|KJT`nD^7am)J|3FW
zX?%5F8c!{K#X$EB<GZ87HlB>_O8JT{XjJccX?@qnjjQS2A;2w!40i9tGiW@xu)IXA
zy}9+VR;7!Ex*w<Rco1}I6uvtKur0K9wv!Q!zBi)eoax4+Yxy>&hOZcm9j5^9M&-Yu
z2RlG>m%->vQOUXi*V6S+mVBKU)~3!&%Bko#$d3Fs-c{Yh9`lM=@J||`SbqGwL(nD|
z+=oN|HbTNz46vC7vd058+PQrR-61>90+}L}>0H(pz(&F(^3cCt3}<U<oiojd;<o_Y
z(0M%Q8!Tx2kG{!f%yk3#pJW2X0KxfTnyrJpOLN?SgRK3olC^hr;-YW0cV<LYegXAl
zF<=}EA(|Jw354*MEl(fu5-11RBHB-e>gpsk-;H=vM;2wzG9s%SAm2P7eemCqdFplV
z5F`4H75D+dSw0nm!A2$ke!lP<wI7i{U@N?xK=E)bu|DDYgnRfi>mdw-_GbZvv+#BZ
z<qK_+GQH{Y9@rE*lgLmuZ8)1~KwmLk>c<dyLHnlBnPgx$hSR4eWkvJ)8Unv}p$w4?
zXnZ!Ak=lYmeZ?BP9l$z3XV7D=k?K;zwx(isW7mrz`A6dk&_DEBjJ$0p&!1849WtaY
zwJ8hqKNsj-=@;tFS4<m>jXkY!e2B&{jlL~F^EsW39dBdh53oaf-qIVn9q80o%vg1$
zPrgKUkOE=jTsw*4jnOAQ?@Qh=XN2}cq4}=H<{$sgpEGS}8-y{V1I$}`fi1)X-2^i3
zwn0l@F+=0q*vdoa_A#Q$!Ow&T^WylNI9j_f9)h{{#)c`yFNFYw0EGaB0EGaB0EGaB
z0EGaB0EGaB0EGaB0EGaB0EGaB0EGaB0EGaB0EGaB0EGaB0EGaB0EGaB0EGaBfHVRE
z>Q4rNd?7%N#N|?9+*(n*N_gLbxGx*85#Bc;?$^nW(}?>5;eAYDoGpAHoOnPs&Jo^s
zCGO|Tk2@0g^(3HJAd$f0xY`1W1PUh@7R6nOxJW=pMR9cn6lqMXQ3V<l3nVL`C@$8Z
zY+RHd7A|5~WHI8nh+oWAbYCPN<|vAb<QK=;nDCD<QBf2V#fjoEkw8T8n8+lF;)ys>
zJSGw_pU6)X=MZs`fNYt#I4TrKTs$TeNH#8J2NMb;W=9kkvx5l*%72?bE+FS^92b!N
zHjWGUHi`=<Q9Lf7MDciBqIe7mC{a8f&zHy#3CNL*y9xwsnYd&W1e7cu2`E`S5>PsB
zA&_DRG$_Rm2$V0Czlk(EAP`%4-$EGBh`Q%0N+ybnp9{~&Z&(xQ!i5ir#RLK20T5gG
zoY+JOz8nRjKM~*JxJWL-L<t;ljp0eyc)@Su96T;=HAMxyjSDjr*Fl^wNJ5lPaQHSZ
zME-4@`h^hq-ebb(W|kjW0(8wjA2V_ihSA_B4QpZ!f#=fwb1|&t-Ooo3o3i3w@q?1Z
zZF9Dpmlh2faq+jFsYh>eb}qi>GUH{~-{qEf&PH77pY%h3(}bbsC;Vrv`!{UtOY5(8
zyZLnK?@?*_@<G!X*|vxG4ZCsJ=k8pyE62vYIL#mS`xld24m@8S^w0K{VQyHDjt543
z!To1D_n*NgEo^k~_pj-aA=vNk&BE;~U$(u_{aKs*9FKCRwNsNja@M^lTbZ3dv?*rh
zQ*|o!WdC#Sex=M-$#iD_*S>#5#turb7`DuzIJ3uR=J6xV1qmGY(8ynHurxvFtH0LS
zWX!G1>O6<$6fob_>%Zr$+ug!GGwt;eb}(V|ZMTS4Hj8OkQ*7Y3v-cF4dk;)by?y4_
zKd^a|3N8nBI=eq2@1XD2%-5f`{9|8YSI3R%1y<|@pWa{FyL;f|HS0ZIt@+=_>w0YQ
zPQg5SKD<|Y<pUf4;KZ)hT?LL!v8n6Yo*muXuI}Sx%%jV9wW;$ug&g5@O~@S1roY&i
ze&4%l=WI{w4Lgc%kE+?ev2;vo8GqR3Umu>&$qZfJ2kZVfuXsQ|yULe!GglRSkeu43
zc6Q*)N>A%eJ079u&0eLpw-~>D0e}1xE4F1D-jiQPrOx~7a#5G>1HZXbITM@jW6_m+
zKl1mYRnE(9RfPy<#y;xk)UyC3rCUQupRdVSvMBu<XY8lktct3I?MqgdygGfxmE-Pq
zbr`?wYF6{Jb{7x6NWN|r1pF^)#&-EP?6k{<QnyygaM9nlXkx9k<BL^E1?gp%tOK7^
z{+dyHGv~*w{~RauHR)fMv^K+jWqZeh4s70&t<(4M5<A2?PvgCGP3W4JmE65&#2T9U
zlf+Ju8NX)aKls{e!l0moi&D#CI*rXOxg6wa{U*>aEb`&6zgtAwez~hpgg1@-D&TsL
z7KaCXzS{N=4=Z-0!1O@(6I03twEW|T4AwVM$G$i7D>_uw-oA$3VN92ET}mubvH!MQ
zl~~#0JgW<R=(LMp+<d&#wsn)u^f4XA^eoL8^TX*=F`X|wX53#J(CujNkAL{;_tYC_
ze(*00^J?Q7vb0lwbH}Dhzw`h7`^;Yd{OF<awU0NuZI1G2y}~P;we(o+rlFti%Q^XE
z#p&N-11@k<GVFfF#vI8{e`qr}q-fTUsqL?4{8bzKb!_C($@#ChA1|oum^~yJb9i;z
z*4}z=F*CLGlmlhshOH6w<3zr?ms>V|YFp4=@QPIdW19P(O>nNMDRbTX>hw~Z`*(k7
zYj4`4YHYhcroG-oj~-Ojt>j$ZSJ{paHwEl}Y<VaQGd)1J-uO88=sb(u7i9-+?g!P{
zee#*vo$SM1`maCzUEn?Yj~@hl{xIfo@Ad5k8_NQm+?t-K-E`Kfxru}0l8ZyfJ@HL?
zc8xt*Q0jb-_u1<~Ps084Hu)v5;B;&;U|9EctDohca$aqb@Wx`lTW-L;N5`?OoF7Lv
z>-GG?f#g<B?i1I1^~OBbd+`P96FE<AZ?`VVU-P2F<e}|`6|N609C*XrAtCe7)r-65
z+Wc|n@w8)6F<VmTy=tQO%?BO7Xjkbv({#u4z#~rQj=YNd{LSk_RZRQ3bCZr0FE6N=
z@a9rh;^XY!GV{i<&&`X!GNQUouP<UMpEP%G0|wh?qS?d$)&_hKc)p_TzNOE{u+r^0
z^rd#2D_c36{@P>7qktRN+&1@FcxAlVov+iEcaIyImsdq|JBjgUu;N=kYg;ru=H>^l
zFN8c@^}yNs@wnXsmvv5hekDCP$g4xil79KN!<N2T^?GM_uR)VL-v!m}HG7p-=dgbO
z|H;c80r5?FlT02w_UG8Q+?vDN`SZXJ16TI^Yr&cl&+yjA20UoV`svY{PMo1Ochk#~
zILF<6&%VBFYngWX=Mc;Mvrn?4>~>FM#TVsn`*vP<s9St;lK~yZq}+e7Z|(g9oKve)
zf9DUgYxSf3<r9^zmmc}h=9zqZYVy;Ejx!i7U%I<`t?YWv#AmKsi^85YPcz)l?U-_l
zxAVmHP})BgTh{z{eom7c_gq_F9UnBIcHSfZ-R-9yuiaF$tK-DNZwu;fwp&yCm08<E
zv}=6Jfm#2#{daX}Uii<$mz)2Ow`I!1{Fd|Rbw?-mxHmbsb^^`5Ne_>*b9sN9J8AA`
zQ#!rygg1@%7bh%xM8wg%8%|dA8v9A5`AgoGTb8~0jO92Ex|+xPs%l;_ooC@=)9s7R
zqkdV{o71DXaJN;fvh_m~!%74{+pq-P2S+Ah$^5u)a^CdG3d?vjD&)(IpW4J-_2>7D
zIC9SH76>x!O>xGlg;z#=dFyDz=b1MT+SR!n&Hih^wzxx!_LkEz>_OWrAFpS(P3v;K
zUCy2XGaN!@U5TImWGyS@)hV})Q+aLw_i#+V?Oi<5)9mVwUZ=6*lbT$c>X#cZ>(BId
z=Id^ajlX@mG;Yqgubk;A-IBa2LB3hR_ExP9{JLqjU{-jxC1=|%vukEAR<#aWa;&uf
zfuC<&+wNAeAb|h0o#Q<E=v&{O6<lN9sy=_B|KosWrH%=C%WkGF=0DA_dqlJ5)wzxD
z!%lvBykPQP%dHc`E&ZNY-0kSFrAeG;EN%Z^7{+&ZW5*=qt(g4mXSd~F$98n&pMEgU
zYFaz))|f4kN2jk&y*A~yrB%0hS)abzM}N>P=w<Y+7U&*5Fd^Q`tK?D3^={0eCu&_%
z*tG{j?OPm}dun0O*So^rShbqzIi_iN%H>ZuA@kc6ulrwEN|<xa_@!@>`;28RnR6**
zV5s9McIch&j^xFj$m?4aKX|=cSXz(kJ#+SSE337_LjT<m5!^A7576#?;p5QmXNwu8
zuajxVYhBX!75(jH-6FELXY8W^Uac_pf#EZ6+i;&onH^hKI>{P%-B~!EhHdNKcj7Nh
z?+Fj{dhJ;LLGnDPnGZwnK?8ANciPSl=8M>KU)6SfhF$jwTDNQcwnWb-K||PEta6@A
zwY?uSq`7zBKa1n8v}{p(kalF4b#B<r)3s~2cP~G&_gJk<8(MISI{ws(php2eo;1T)
z2d{5i{OO_MxaUJ$oARgl*!cfCbL^{A?K1~^*<<XPbhp$ZzWvid_m8!RwXgelr8mY7
zwx@;ud;Ns>&y_<*Zl2yOZBzBtPHXAdv6Lpy#;^qKADVl7%%8&E{Nn}F=g-fqDtR?|
zB*P55+nc_~vQ^oT!b5ib4x0_bU$^<I9JXh^ScR>hKjPSoL-)eCtvNNbI<(8)bAdje
zKfdV#bH)j%-1o|zX`$yf3O2j9VEUegmc?c^4P$?7u?|!olQ8;`{ey@c`=-?)X9dm~
zcI+hwJw8ly@?V%6(7x8y)z#k2{I_GZd(FPW*tH$6AIn-BxvBc#w&sssTp6}}#C^WW
znqKq?3%@wFZIdaF&$;LIDfd<L5wu=4<1JU2Gw%H4W)u3)#_;xecjzG-s;_<;mSfWG
zW|Cv2f7EFD;nenHz5Mxex|V!$ZKd_Bh=>^Iyks1ynYiGB73*;B#2X$a?k{8SSEbyr
z54-kLXG_6?+oNnTCosoLmqMmqj7%{Zv4}r@p(hP%J}H`>YS$LK)$g;yL)|A#jv5kM
zeRa<dW>}MM9tCEpmEKX`e$*~_-v_J1cl)eoXRfTCS~Kug_Mw#2(&-zPS-<K&<%M;#
zQ^oy{Btu2HnX@Gz<jjWDsZ4L%>m3$&TUnifJ7s2AX`iuf%kSB9r$!I5H*rsT{^UXE
zy7}%jtfmLOUqNb**k{2T<NZcJPvrPs42xOQ5$aOpqV$%<cT!r<H$e^BG+PXt;WaiP
zZJh0bHxEKRum7?xob9x6P*|_d_P5jM*h`Cbsom)ts=LQe+qLr<A7wuW)bwxrggfoJ
z{obip&D7to2GLEwxrxd+fo(8x|DQ8`Ske8}2?x)!H}&NY-Fl=a=62@5@U$+s9S@zD
zVfz5H@jn~X^K;MiliiP}VOYhVmP;Nb`gU^5`>AF}Gk?G?l!hI&Zsl`r`jD%;%%YYp
zkMEfJ)eaALP$p`3?ATYg1}}0u|4(InbRYHyPqw>lpGo)U-`;n4p~;S5FcxQQ^3`#+
zzPX8E(UT+1KHmbhWCphB%V`HU*InpzIL)^B*qB={p>Er;KWsJL_D0V&uhPQoi}&=l
z@0~XO`|7KaW~}cz9vJS=A9!^A#XGc*T5-2pH03y;wzM<6SQojTv>VuShHc*QMJ3ir
z&9?pb&!~{G?6%zYncI3-7VJ7#GdMHUWENEROKsdn%`|au&3(FNdUcq^BIt1X(JuRV
z*<AnnL~Y3Cd1c4HXL_$p!V3EKn0onWagoK&CuwXuFi~IH49=1R!#7mF9`{`|XYZwu
zry2C5-KeR=DruKOs^`D*af|dj`<g}T##(MYz15f`vsbmDedcvYx&j#no}7C9MedT*
z{PaSbrtEoEEo!qqm}h!CwYdMrKJ18xGwyGw`;R_0Vf65T?a3`#Ul`J9;W@eohqvmq
zW&VfGG-rDIL4{Y{pevs9V@yI!VN*LceM83I=X=jEJ-sKh-OtBQLq2A#VdpniUHYM5
zcNb2`?wTo~%x{}q|9M;D;HrITY#-NG2OPp3KH1l*aD*ML_vv4&PC5-alL>g&ZSTbi
z4h)*Mc=xVJ+q?@>TSs^QEm4qc?qqlJk9aH3*em`0O$z(I%p9_@bU>Ehw_{oHrJaI5
zc{4rhM4r_yTEXm2H3MJxJw1HRGk+YXOQ^}1sIdu|k9yd#9iSUEmG*dW_75qRD`VX`
zwza3e`TE-Q_RiSA)3<q9+|yiV`UGd%o;7oF1I+E%8#XQCKjn1va2*)^chJuJ{Ooh|
z%^6VnTV0&!<YTixw#kiWad7oKee;@P=YAEgn+7IsPD#l7vgydw^L~QryL)!{@q-=O
zt{*)oJt5S$wc|9KfqS06c5I(q97mgn1-1VBAup>U&EC1-rx(j}JX|MFsO{rR+vc-+
zh*wYUgp8ZlVw~x7wlwb-7oPWUbN1;O*aXJQ%row}VcWMy=Fa3=o?Gfn>y#CpJ{a!o
zHlKdzKHt&h^oG>F`vT(@rH6naGXbF{LlcWFT*mHZ*!=N}_bjjCxDT6hn9wtrbE%`p
zwKm^{^om%-`9##S?Z>uBs@&sqHLyAK95(e~f3mfA&EMyz{8lrv_o?>7_gBs9hlWKn
zdo~RZVodG!*>m5ZYS%3nDh3R{=$dSDKJ0!<1iaDw#!dL-8vpcS*4{2o|2tYd-LxrZ
z%}S<sFNVkLO<fKzPk(gI+s4y$<k@Y#?Uy+vO{_k&qjSWv>RbU_AGV8zxfKN7b~Ty#
zXwHSvA)Eu@ZDyr^wFF?w7;674<&NO0Q^|s(HJPK+mkinT@%&mV&dS{0*)!U7qqk<2
z?^u+6^jI3!YGd`%j9t?&|HZR|DzNp?aWmH4*wuD*$7)|QTm$AE+}z~G{!BlC3$#FY
zn=iIZdc4YEy^Fm+e;wv`_KTdWwq5c7;F+8{*6vdY7L$g|9G+Iw^+fH}J6GGVgG)IT
zt-tV@^;7rqq5JBl&i|UWe^B9};GSb_TS5~wb=Fkum}6oT^fV4%IWT-IXH05k;unW3
zIft5fc@|Iqey{mDM&Y4JM?S&kJa~|~uvrgiDi3-sv}A7qC@#70rlrs90as@AxX1pi
zZCTfd1&d1`^>|==*U>a7Vf4|~mqKpuq4B@39(g_Oo7ttP(jRo+AKrfZrwPSzBlhF*
ziF=y5^;}+A<{5~JpAS}$);A5Sf_5chSF>j>kGmXBDV`pGsTaLpVThn*b^C7Twk5v#
zG}wIimwdar!m^<r1)k@#Z<cOOKNU$Iz7Al_+zz1JpI>0LySQmMw`yDW3)_14|7bb}
zg)hz6H>JaKm%^;Aqipe-oWJhHlBjc@Nt+XLnT*1$Bk-y_QTw`2dY}Uo(|cddtPi@g
z7p2o3+}D3UEba7_6Y*m=Zl~Sd|Fu2;r>j_@iA9`^;KO}&37`Is`6p%`qF+eJv^lmT
z#T1y28Py81`eM>_8`ibB{t>+~fBx3Pn>w=EaG$Q<-PEmz?^(|o^lKKkXMeEPsko-C
z-`NnGWwiO@uf>^6H3P`AdS{%VoeaoKPF_*4%3=Jz^O5tDTV6gjCQfkqMEt~vUudo8
z<R&)1(Ua-%hu_Mx>GL9-u|=Dzm;Sb4N(UQgL%XHYIUu#=pO(qRMMv^2*&lg6eVDf~
z8gH+U?6#vp8pqeBsGxvhe`9xf+z|=e-7awZhS*)RVl%z#k|$a%dr?r*r!Xr#;~JJ)
zTI3j%@ejOpuEhx=x?zd^9v42m^I2fmKP{PsJ**zuBQR%X*e7HT>$-D-ZOdUFefuA;
z>6%J2$cn~bR|h_}JlAA-T3%p@BR$cc2KTNtNpjt>ta_q9Uk7tTHa1^wu5%ps(K@DQ
Uw;PvXstfzveZt6u;jD=N1N46qGXMYp

diff --git a/client/ui/assets/netbird-systemtray-error-dark.ico b/client/ui/assets/netbird-systemtray-error-dark.ico
deleted file mode 100644
index 083816188d695c0a083ba7dcd78c1f31e9f06080..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 105062
zcmeHQ30xCL7vB)dp&+1mE1<QAN;N^MR;`Iv6k88Giqu-c3%pQJKW`yi#X>z=4?GLj
z18=liZv_uLX~o)V6_tn<Y%K!i3L41w-X;qRBq7Hp98G?|m)Y5!nfKoRy`7zFX9<Eu
zm=M<11cVO63}b@uB?!X7K^or&=YN579F8ph9ziT>P7r*)H10HrAnf`Pgg_vRo3V%?
zE1>}RVR<53f|wh@BAg%&MZp>Ac?bvs%DvJ=N@QHczt5c|W=K@>s&VSPyik_*6og1*
zIkICiPUYc*74-+YL!(P@+>VxCLd!=Tm&?QnD<mNO6(C7D1sA2cOv<lXMzy>&8C)Q5
zDVbkTBysUAP%A%{19^9FLLjf7+`JSH%4Bfh&MYVexvTP4il3Bsp$YIm&YfQ<f&57H
zGR)vwJ0!{ul-{zuMsRIEkc1No@=qo6mzTi_BJ-xf^@l)>D&-9&vEN4KmEq4_QZ55o
z24{I8=A~>CM&;)SiV?Hbv};rv33o;TsRuW(u>71XT_J>aQn`zQ<mDyLtth<7U0V27
z!S(&J{GH(XNT69j3xVbWjR9&WyN+?GPgKZH$uoe`Ls<y<(YN;i{R~9+@mOW~^l?qH
zg&-urC<#c&l2R@lBVjy=EhPaQ6F?Y91VE4p3F{dLAU+V*KjaT89!=^QY392B5BHB9
zk|IfKx~?dnD(7WoKY<XbnhZ5vSA~b7G_<m@{z9rGLrvG|<;w2+Xt*C@mC!VL9y#Tg
z%b@HUy$t#>@SOof-OGx?0D2xJd=Lu?mvXu2d8;17GYjk7y9~*o7H>)x;LWdzKlguR
zU9JiaD(Ow}rb6I<Sdk3e#pTZtUGjGT{>4>gAfI90<a1C}-joe0-4~Re%0l2BLFdn1
z270T`8~Lg2e{^|(w*}Cjqzub}w~xwtle#LoFRIm1biVXs;60JE5_nH8Z+p~)dnKIZ
z$WZAzotM00;NJ<_UL~@&6WR8FV?{E^Et@8T-0SlA;yK{m1}GicNfcjtC{G53xXNTu
zc)h9&P!HJx?*~9+9mt&{ZFecdfnEmW3qYcuQ}r0~Sp#9asG|N2hW4k_|L7RtaWx*u
zmzH;~s(djW=-mkNR_-%U7*w>O70Li@Vmfb>AKRK;RgnSGVO#wSP=(&~<H~LDYBIP?
zD+u5~A4N|7b2ahjgcce@K81BIRVJ<Ot;%15*Qj)I!jXz(kUjHu%E=?QJQrCXfbNUj
z0HwUK9PDeDRFy&2=GdqzZ!#U$N7B9&8Dif`#rzAa@eeDCR55QQ9^AQbKTa!<;4?vu
z{CSYJ6(s{4FHs{e#RvO6mpH+NJ`iSWkiWct19`gxO#xaBbPVV=&=a7)fL;MT2f7Dz
z3TQ3R1R%Qno)D+xQZ+>RT`3H-4WTSwAVvL2MKUFGB8#<UU7jEK;}}IEkRpEa&QB;W
zfT086?*udlC<Z9D1}g9GGsNCdOg%$DLjJO{B$6vvB$AL25nI3#v69##LTD-`0<6kN
z5}HcjoCK~(!a_nMA&{2H$|@s*g2hCCo``5=pGy$-LV~bLA_!9?0YShB1rVEHNhFX@
zk_6)txj>bFI8MO<@&PIzr|8tM$0<Nn!%qbSpuId8Nrj|j5_Qw7TCOJPK$amug)$ma
zQyJ=}uc<t3uFGV}hmh(w<FP^=)J?CAY&GQtS<q(?cS?3D#B<erN!|4F_`@?6pZ#QC
zOT}<5C%mYIys|)^K|u24M?LU-xgGGhhO{s%Rr3#I#`%XFAbD*RMd$7+(E)8h_aDjz
z7?QpulU-SwYPM3Q3CONVJGv$vl-WVqHML|%y`cYv{Z8y3DZ*RPd1X2%^Ch}XsAJSg
zC7+RJ3y|GI1NkK|FLxKl6%^eM%6y5EoAN8Qai{Ac>jR%tO9$zkBKAS=!nmL^9TfQs
z%8u8xlAY26WXJwoiAp-aSOzthhw}HFRG>(HW%Udte|fz`$)afpvahdEew2My`FL1O
zvMZ`*s`?KjI)Lm=ft2>kX=8cHWLNYoqsvV{X3~#v-c@d$Lymh$$6l1luFPjpPDS?v
zp4ZwAvih{z91b@?Yo9@1Lc1udm&j+Frv6Xm1N?^omCte0)(<GdU762R@(-B~%Iu(Z
zodohHpdWD;R2r{SR#z%|W}%$bo=tcTNS+RI(^J^08iMSdV4kg5Hs?bhb5y27Ro@_e
zMiEb$9q4tG()5bTk#`>CAI_au@RmMSN;|Ge2gDGmMn910pmKV7vQ|9@vZMbOlk0Y-
zl+QiUZBWy57k#6e&s60@#WAfq>8X73LXf*J5RUbdb*OBvwyNw@T%jEll-)v6+go0G
zb<aWFiEW6=&o7+!@GY-9DY@yPN;*KfEr76IR@iP;S6+I0D7Pz67ErZk7gzoqp2|8v
znUw5Q*^KG{<vRd9lP5cMjyqea4Nw=kc7Xg<Wv6sV=7bg-(J|EI7<{G`@Tj@}qIeEb
zp&ek&TMO(XP#DMwCu$-yl?Tehc~)HiMPZ^e<ObGggK|4yp8(oR%4A1gIKK}oK-K>N
z?oA-?bya02(_x>bVjUqJ_o~NtVb1?92W+N7`H|{M5A&V4_VI!WWmn^`Yz~z6e5+|b
zlwK~bUF@W)4zl*;aZO~W^1xcus(4q5%UNGZmsj3#f-3TJ!isU8Ii8Y3<8TGE>7;96
zD#?xbV>?^Ja+N->VXhe0W^K{1>}oP`{j1mj^x-a4Yd*JXnRhr5#m4gNzzHir*>MiF
zY97twxE`8XmoptO2b(ZZ{;aC<!!rWLsFbYf)j}u0JBP#^+87MTj%DE7HLSR=_(6Ow
zP<dYpj<w~5^Ub(U#7kBOm#@=dplp=w+Y0H)bx6J79O@7Ygmd)RK0_H)(F66ywkYPq
zd0{VTKUT#D+pDUL8>z+<WmCB3h7%^jdjZ=d&Om%1T-!Yn2-hO`0O2}=;Xr+W>_A=<
zIv(<lAsyyZ6%$o(JH<rXNS>_n&T#}1yvIC&@_|&5Pn9$Z*Zjznfr)b<yCcv!ASUj&
zhhY2i_eq$LPn9y@8Hu(S0EExU%6%dAZL>%fp1Mkd_<;^MM}_wn)*<T5Rbg5mUCCxB
z*MNWl0RsXxAs}5fgzq-tj|@vBu!<2Pxe_Zf6b6}+VN!osc~l0=kXn%;TS(w}f|W~P
zI)V@p_7Dn)6$FnA2N1y!CK1w5C_68drOTD&%axTQl9nqGo05DaVz!j8m?f1%L`dbz
zC4#ennM6qNV6haIZy$o80HnZ>fR|0-uM8CrCJ3=C6k*7dzUPIZ5aagJ_rOqo0mi8i
z^df&`2!Eh2uob{UD#Rs8778&9#L1!|Bw0cTKk~dvA+FQn0||i2*J;6thWtJmsA~8b
z5NI$6z}&_XBuy34HovBPnaC%Toti6G8v||gGogc~WmJ(}Z49){uc_Qj<WnHK${1*y
zp9vi_Eu#k6Ys5g?{EFn3jp6d4U#Sh@vT>z9kbe;nrKhs6T796R?pUTqeS6TITo(bM
zDq}eE(v(8Keu`26;G!lN=vsG_8OBUIg6_py=#Q8%j)6XOr)&oDM{23RE-+AbpHSB{
z@_9;cDg+;>c(+;e`#|3qFrs?}21Sz?@Bw{cz^Lwsf$UjulL-u9Uw~4Wk7Tk=r2Jju
zdY-bgvJiB~IS#GH%3(hpYA#k67%*=4s(66@yEOFya$Qfwd+D%8Q-LZzfPEpleU%+o
zYadjVU)wm$H?#r$)t~plIe2RRcT&DCbf<990|rIQ)bfEK+T6Epb=M09-~%{Mldcj5
zsC&g49$ng<(wz!*>Ia}Z&I9A~Oflh_huYCyUl=4R)E{++bsn-cPE6Y!`%4=4nY66~
zsr;aOccALeLtM93u?CfK-6{Tc1Or^BQE?C8`rC><H*}_ZUBLkQ2Dm0Ohr|Hi^_f}j
z^XU6bws91;ZB+CFh50EgH4Q;`oU4~8So6yS1~tlF0|qtb*Hm}R#|h0hfwi-*=<7MF
z9BYGt%CalKK;`_JVgR;}B-{10eQv7guj##@w(M0fP&>c67=Z38(D#vCD&PCmvyUFC
z;|ChcF2g|M{HkIAI#+)84%>PP*4fhhK_v`Sm7%uMf$ly))t>$E4inwpijK9y0QgQ(
zWlU99*uXOn+rIMGFJjxLqMxToe>|@d2Bhv%+*KM=Wf}wE?+&DN{b>#FP|-0_3j><&
zRC`OW7yy4<XQ<LxIIZnZ*H_-LN*Kt|osNN4@71W{BfuZmCF0s-im%d;+<#N~^N@~(
zQVf*nPRW4lJ}a%0Rz)XO)4=_XYoFC#TdJTvNY|TwEEfZ4SK&JAYV|CfqjaajjjHOS
zPCC%t0eIowaugrcL)G3PQ-}eM5#v~~io7wMvpTxflorav{Z`Ud<S!Q&72iRth5@NN
z>|?Jc@5GvPQuR7KUz-B&-__(_9RqwGDt;%Jt~dR-6rQ1_D!$KFmFE~$bySoN-gmPG
zy?@qPciBC|T~z6vdb*wpk89W;w5rbZcsks(8n45Lcb^pQ>8cGLHN8VeYadJ0*dvs#
zH~m<nu}{PebUdYvo{I8var|F}=OMPA6_ugJd7PhUqsYJIo##Z5@4RWd)<LQ4w7pd1
zVxhr%l*;(+l&7b>bF#V3ST*of##iw*922gX|Ej<M&S`PKE8>UGj$ZQgt$Gg9RUX6C
z<XNv`9@^e0QvG3^n6pxYwuNf^Zo=NNMpgBt$3gcno!gx*D~=COgFP~!kErGQtBUMi
z_538dzVu_zTfKQax*nPz{|RGd+i<TCJ>mW*yyt5{*Bg(4w=a;o?JG@X#y;aQpmChg
z0`mPxIL3EUH7!rwe38}k4=4MwOF)LhKu>^}!~(}g?g3%FG7j33)%Hw)XDzNPlg=CH
z9*1I(!J#S!^f=7vV!H?Dvv6-be3x!D5UzFj2`Cxp4$uP{Vf+dZ+I1Tcen$z{2)P1P
z^EWy#>KM}DSc?2{B<3+WO!2KtA?T0q4=Wu{g6rz~yZrRwMf|#?J0%O~Hy8-_aF;JP
zbLa2X^gN_w(su~D<GLE1wm)U~R@*Z{-?}Q}2Qu=3E&wrEAJhHn7543w$xs)rf&Tbi
zIc%RK0;#{=O8GrgY0rkbpsz9+@Sf#_ljCsx0SojGZK<y^euirX1Pllm5HKKMK)`@N
z!$g4GRzSgDS#Vh}UJ~=fJPbwlB6|t^a;<W$Fcg}?cV-0e9T|3#DePWgmCF)XL1-$1
z9S|f!f(?5l@E~Nt1_r_KDH(Db1q_4n^D>Z#2cM{sU?N#ao`=NbHV0+0d=gnX5`nZ_
zi9pInk|gDeA<7{Uf>bD%&{Qg?kS&!vi6zxTP`(!hsTS}d)dK$ZB70IEGCRm8Ee^J4
z0JT6Lf+YYs1qA#c!~i~#1KIJ1;*%k$gTG+NPKH8h$diTkNz%BzKpMi15V+d|?hHYa
zDZ(QF)&MKA1V*3<GJ+pmBSYkcag>1!Apsd`@rV0F2!K$U@_i!U$gocYf@1g?5HKKM
zK)`^20RaO71_TTU7!WWZU_d}U1mHcC03`KtF_*fw`7@_U{VPd^J@p>4-hH69`PV;-
zF(+{q?Dg&gwauS7B<o*E3b5Ck57ajQ`e!lbB(4E_o%=v-^Jfmp`d5;Q*z3#(YMX!k
zvlw#{tBF11K2Y2InM1Pvm82o|jQK!q^RIsvV@_f%vDexMYMVcENY=lS7{Xp-AE<5q
z_0M9=N(}hV1)}W7M5yu@5yQ4e+2=Bgj{MT#JxhGQ7T=SpU1I1xklOHp`f7X1Bf$3B
zf6r9;+J5@G4vLP8IT1zfluX)$`t*VNZhOQTz9)%$YT)~jifp5=^YzLH8iMVq`wZUw
z#QI-fc2>rxUid&mvOQS`NZSFL?J2~(-_&UzXlS;tr~~kO%yps;!1|#s`v4Pt3#tsg
zwDTz&*AxQo`2M`I`dOdX8oCeEDch6Jfv`eO9kPEzt_SLz?Wwu}?2mhd=<`0WiC06b
z2kNZt$vPmkpcUAk>G%6<vT;q<8;TFqY1`B40CN9)Lp{Lgcyhh4Jy{1x`-8Z*Qcd@z
zUaxak78biqE~u;HgjAbeURZBzUr`4X;=WsYwXafsxOcI1-`Zl>i?=@cK)thlg%1=R
zS85Y|`3Ks*;=5J2Pi1}afqH9u@;M;w57zG7K;>_iRqWAP_kEyV+n!bjtgW>=0QV}N
zrtteE#XTn#GW8t5_k!d-x3xK^^7;V^>$(`i+z@_GEKBb`fcx_L)mz(Be$zmFfZUr`
ze{Dguz2a|I)%E+HvON{ndmrEkB*t+6<NmsO@qq?p`-bBK(mgJ9Zhx0q^}f!hY+g02
z|Mfsv;Xz&20WNbJtnDdZsMkIKd$K!#{dLkG<OVc&+cyv&D2imd4p8z<uKL#2qikGL
zSa0hA*_v_2`h(TJKU48driN;J$~Wq-4}=xtHzKrd3o7|8X+yVt1MmUu`h)NtNk!jg
zuFJN^cZ_Q7J)^obJ_zH28m|>2zs)ZHyWDl!_7wgGACMve&j9=$lUmP#`fhuJ4^Rle
zyF=2oVk-9sxyxZ(SKjv)VJ@!@&*dnb$1~Ie-~-`>^Hr$>xbRI$1>YU6m$s+wg8#Y?
z$ohlnN`0XE`VDFxzh2wk-~&<wpe?9)t(aol*X4CQ3hR8z=2b(6>jAa-SCvQKak&4_
zRjUJV?T+I08|8IC9b3<*G4>4kfX4jwZF4$5S%0viEr@G(;9JtFd}F;1t>@Dkdo6uH
zYyNbb==&J%{}{3kP`-9Ykx$h2noh>B*U$$T<F9YKQ~b#OU}(`RCF?g7*`7LITRy-z
z_G<b7<NPU`=riO9a*Sa<CsD;ZpR#$?P~SeFGwfCL0iE&Jr|pp!v;o$0u<oC(@^inc
z?WwrFd_d>e*Wd#>=dUjx0NY1U?SFENw_+ZbvZ=bEu6;mn*emb>z46zz4}k4MDBDw^
zl68FQ_<^o`K=0UB@d3T_*Od=|y%$n8uM`Hsb3pzapE~x(v`qUztzj?ofm-9wv=6|2
z?^DU<RptV@^I(o&`{w|oKEN~v|JCxq_BiJIR+;_DwxIN#T_*g1v3lUYYBQ$v2AjJB
zRgCpjx$o&dp=6DhCO%QCK0xZt&_1P1*+Spt00x6qwLRqr4D<)-zEUebK-ymF^Nj69
zqi@@3%a0RQ&>wJ6dv74_a>m*LlppBT2WYmZ);j&?d;o0k1UP8C?%QRy)?-4H?Ws^N
zJ|M^T|2ZFkwjRFsquu_nI2X)Je~_|2hC1~DCAR<1_<+pz%GdWOY5xI+6jl;$Amh&g
zo%w(Ywx{%Ju+IWcXff^um`1muR>wFuFqQG=0OLNOhV2`y4{#z1EC7dlTG^X+?^ES)
z7we=BV9W<JuszKOiaFZ0vFk#9>6*?$o$Up!WM3Dwqc)^fdq4}@Q$BF2F4#{S8D#5u
zPf_=)E<)}Kr~{a93sQcgkq<Cnd&&nqw86hN^Wypqz(J?Br~HZQuakCwMn1sx%Xf#d
zYL&(_DfyLzX`IMnv)Z(yro5r8uhacKDq)8GLHX|jQ8v^zRH+`owa46rg-qFAS_gy|
z)w?-9u>H4{>?5b`#`JaW0-d!5Dc@1*1894fY5B!CPsOlqP-bx}P47c}=L6eUTff0D
z9`f<U{$S1T2T-=uG?eQDr0rq+h`XpzzHHk2|2BQwQ4@Z(W_uaF<URn}wfR-?i%LE~
z+1_PFfv#*XEjOZW_Xpt~575hfUc<e_&|0yY{DAa<a@#}yg9B@nbgchvP3}p3<bnIX
z&V28Sd^cEk{Xx246q9oXP~YIbLprv-wEXZQFMZfk9Uh$UqT!&s^0hlP+_Ow$$5p)d
zAKiY;9K+tSOv|sNysWy^9|Sp7Ub~}2C+6|P_XU|-E2h{_fCmTON!F`wVMSr;+@HEi
z%Ly&ygWk;cbs4NDpdYT-ZcMZh;TgkSrl)$pGA@95p@XjMs!F+FcUK^_*Y4=~K4IeB
zA%#AKYZ3LWPdUHvqIgy8q>D7#uH7lup|Vfw1WUX>wVVTzo1Ys{i?*k53oqj9!oJGN
z#Ciwpm#$A6YRil9wPMh=)K(^j^50QrE2gj2N86J)GxzS01osqY$aYMXGlOY6%PUW|
zcIQDI(_Li@vA)*!IZ!9+e5&rR2w@Fvv9&y#F?CM1cIS3|wLK{}&JAeVAH;UPzQ%Vd
z?5eVFgMMq7vUSyRWa~E)>$UA=nBv@w+I0ZTDdYR+bzJ{q*f-I+s_nFm>tpSXzHwD!
z4=HjkQ4eGKO!-!Vw)Upym#y8Y8{g~HtWK1RE4fxog|Q!8Po#r+e7Q0)cn>hPRt#iP
zdoN}N_0TC!F3Q%5!Fuvq8q;G!=X*@d4M0C{b$zj=Msmt~cL>{fIHtq=+8rkBs(Kk(
zt`!5@*Us7<2J3iLe4^4?G5AJYJ$la9<O}(lt`!5^R;YqqgGht@!Px~l*dAyQ`c%Gu
zV(4u-RgM9JI<a;~54OO$vu&IR{N9L?eWokpS^s=QjkRLXcN_<}*QxazI`9J=yIh2O
ziqh`~IG3mcUUk7=uF&;VbPT%V`i+Kadw9pZa4oD)>Z4eH^1DM&C+K|*hwgnug|%XU
zjVI_H3si5%_Gz|5KfVn*g(<UnRbK!f38Iyud%Nh**V5JL4|2laS_5vl9}j+m1^fT_
zjqbX9Z{Yfq>p+n}uz#3l^B@grj2m#M>c7jX`nx)D*|*v|al(r~f%{}GV7wMW92dL?
zg!otGr;B(F@Ihb1_sQ^H9fRZDD4ROEC`-!;6SaeK(}8p$e{Ghj(|3nB5pOJD9U$!G
zQ`jGTWF+7>1&*=)2m=CNDcS}U3+EE56KPMlMy82|FbL|OSrASj>me)`>Lg`$WAYmK
z6z)l+FQ3+*Pt@XCF(&P!kFubC(`ZjJ@EiTvQxjehMXvh5uOaY|`GCfIlhsjQ(Cb>U
z`tAoX56}thm{vz^sbO7HIIX_hMW6Cxe*)|e?Up)Tx2rB+oqBgjpSIM77ueqysG+nA
zb+%Sa8;t9EUTOaj`!MysF2M1ePIVpcx+))Fhwr>4)^k5#bgfujwUsXAlKH`L2<zwE
zNqCXFF7f%VlnrA>_&yYlch$G`@psgj8~Cr-QyV>@&)5#eEhm95!~)#|s@rvgmTSed
z!Ro(|7w<1lcmb?4DS~lva!efOF6s`!So?p$4h9_!2pAABAYeeifPeu30|EvF3<wwy
zFd$$+z<_`O0RsXC1Pllm5HKKMK)`^20RaO71_TTU7!WWZU_iitfB^vm0u31fiN1bi
z!4e4)^%L_X5+v#;vX@AZs9&y?M1n;9gr*V+67@@BOC(6tPr#B$kf<L)NF+$IUl~CJ
zBT;cNLGX}haeEON7lOIj5=d*6OQwf^0?H)_Qz2O%#-UsR!A`>S63B(=AOfeTI8P$P
z(<m=+Aqaa3nGN-UlA&yAHhU^=Dow_NIB=2)AQKnkqyRE?1b6}kAlZ`#QUOTzfC^qG
z1(3oe#5gH{6izZu3Sf`yD9Jz%TAY@iRFGC)xxzAjq=GbgP(ix97$*Uh>4OT=^~E?1
z53(d0UZg@aJjpl>ZwW$;nPm3BINe^TAl;rAC)wMBB0K~@B#oE*gIJor++W1f^2+@Q
z6as$00||Z*2YD*|5#l`3SA|joKpga`@Mi!F^tCVdcaQ@F;+5YI;3^<+aQXcL`bil{
zq`xEpOm;{H0*D8fr<OVpue>y=!`YW}lX_Z(G@w5GKvJ2sQh%t>2H=EWg|<@v0s$x?
z1bCgiyGUtB{{;j<OAt!t?|=Y>HlTq&yt{aKopc`%KnQ6tPKpBvB+26BjROJ*5H<Kg
zI_gKplc*S}1nE808M1nyA`oI+#-2QjsLI%v$7SrLx!}5teR*6cJ(B(hlg?OihF6I_
zsbIxLII^$A9^-WOs9@!|DTRit6w}J$fI`Ab<+EkRp-!@}mcXB>G+@b$L-3?=LKZJi
z7c3+%SW)?cr3uQ_1O*`hs4Yz=wV(ukGMMb~7=JPt?a2uI$@C&EhUa8v0JoF<1SI2%
zcoG>WEl8%2GN_143#8o_WO~|tAtX;w#Zw$B;)Wwc;A@YOLoFM%X#`+d4s#zo25vMs
zWD#a25KNrE&zB%<6Ne2RIBv<K>>Z;Pw0*EK`HsKGrY;9v*L~FGLCWc-OR_&X<JbFK
z2j0LJJC1)H*TZ4drtZ;A2T$0zXKFC(?!)1WMh{?ZJmedHWb3U(;ivyO?b>E^yC(0g
z`YQLebJAA>t&PvNeNtLhQ1aQCTef*w0|Z$G*~`!6u+2JzTMuIXZ|tgU!mP_JVei1}
z=Z72$9ce7Kh-zYdtm`AA6aLq;`rFv0602HT1T|Yc<l{MmZ3cvQ^mN#JWBkYWbIZ17
zJD6>WEXpW~HhVC^rtGs2%ayA~b|Myvm)o83{Mh*1t60aCZHPdV?Bwj0vtJI0^0pAH
zHWM7k-e)v8b!g+oEP)CC(EK3<wk!Tzb?Hgr7sKp*9NnC`e|+70TyEpf7B21X{cdR4
zo-b~`{cCLs;eOa+QHJF^ubqyv{<PUQcW~g;H-2r1{Sjj?clNZt^!m-=7tab3?-K5N
zJVZ?b$B4FlWy0?|IW@Z9-iRKyr+xdiFmgJ&@~?Y=&*p8tvB;-W|4G?bdyi<mHauf7
zd!Xc3Gw+nQ&3h7K+6*nu=;LyF-nH?6*$lM~JNN6SO)|@VSrpL80@GXO?#b?R!=k5u
z;^&)L>o&G3$XIhSApPi#tWLjP&io<$9^pQDWcSQ7R&Li9IlplJtFSEE?n+08E>{ok
z5bZTuZkxExDS(rZ-Mg`+;6>)2i^T8TDc+HFaQe_-fgArjHeeJpTQtb_%d}(b-f`|C
z9&x1&aWfpSjf?nb^wpD7J4D+Y?_U_(|Nf$*S67b7W7{U?4_*@R*YOv-{;}#jjb)qY
z?H=x(we);UJn<+xEus6GoDTC^pBS2X{q4=6A0GI%W1m%mu!1bl@UYS0VZGM|20Yz3
zc0^c4aip_<V$VCr+7}E?Nx0j(OW#$gEs}qC&mBvo9*aw}K5=;X^5z9Q`w%0`niYH&
zxG(DZ`vVi3KNDWIF15CNo}87pvW2++z|@!)y>|2@K!a!REDUPZVMzF*#v+gA*{Roh
zcMEXf+w<*1FS5!Wjp;OR%{tMHCSf~7Cp#|Ze*K4=ZSVW@I-ffeJO0|XQPKUQa(5E`
z?bptI9o{i_<AB&>A9k|tG@unb;Z^ZB?fesukNWwh6<DYFva>eq1e0#VjpF7R2QT|L
zH+S`&@2)Q5cYaXBJK5g!<{BgW3qNh_@AU8E1(rVZ$Bmz}eRnq3%i_QW*RdYLJ2pp8
zUHsp&6=Q$5SQa?+!IGs3qqcuja(1++<S$9eKj(jBMLp@ezeB4__OEVOdllqceSYQb
z(#FB@-}6qlO!rK-JbTg9>`kNo-`IM`>}cQ4|N0a6fb^oK!xq{85j4Bond7%+o8240
zyBqlFzbxBe=VfIvmlIi5UH&NQ_ts^zMZk)yQ5Rx&`+B(c^!Yo--YqT2Z&K&d*j>v5
zolTazvhLUvxCPqJ7Ja#C7yDqD-H(IP=54xpfr#OK+I02N{bOUUHMJVO(DwAfggnuo
zBhN2B(SC8u0V^z*pZwUd#H-n~ix2%;`#lnbWuHFiY!VR>H_zhr$?n2u3q6xA#|9sI
zRManjS$^5Kj@FLrCk$-7_yKRkn;yKi_Q!LxS{^)E`pfyJOB0urEEUg7E!k#nE#cmI
zu~Xc>*R<7d1K$p64bI+TQX}z{&KJ8S`KLAR{O1oJhm;H<*f*N<pN>v7YZrg@a=L3{
z)6nxjZG1f1C#~qwurn{qyu?IYq+qEtXH>_RvtKQaT)*H(&&+NQUimJy?imu0x-+TZ
zj^xp<Q_cTva-0=!-6>}7dy<LCpZc{iFS_qJ|2pCQu&mvUzc=T!Sbp(g%WvM;6s&tF
z=;nU#{K<6ZEq+Fmo_;cbo0KyrxYh1H%bb!pSJ=R+BPaOz%n<*mZ%S@`d}L=_%&G5Q
z5q4f>!`)fGnWY2`;J%6uT*;5UYkbJzrQgFRe$D5PdS`&$v#-{eer_GRWX+tRk`ITE
zY`od>x1VD^vnve=efQG$#Ti9y-~Y$l&t%D^A1`~`d38GUb=0Gv<F=1l3TO5BaMciz
zS!htUy~WMdnZrw4UYZkUcVO1r9ZO?B`#$CEjVD9B%~I04TF*8f%o}~9xi5SA*dnM7
zyk`2v6;Ap!=D{D+9EII8XSxlY)$_IOQN9<edCRiBpD&%w*(x|UZSLE{f`=_P&s*||
zM+?X2C!bCqee0><)rH;jjO_zA3HrU{1g9nBE^p7y{9>p1p{Tg@2?vW!&i~rW^iRIc
zsnpWH*OtY%GRjQ2+|6t}KSk6ldqVp0e_FQt=W5$VBextIw#7fO<I&H&1Y1Fs4HrKW
zz483l!}h0foSQ379JuT~BxOK!*wSNrw)|>I5O{C8viiN;$@l(aO~&p%q7&co5`@;5
z<~}*c-!rbr@^JddMIU||7xZ^m@$`XKM1HvA(G6|Vf{u@SlN}J}e&OZut&M{}pVD`?
zx$~fq?6Zx7@BKFaw2=Sp-*<O@lT)}jg&6aqk@bbyb0VL$*whFvPWd^-_&|KoN$;nk
z&F0&89(h&T@|s81w)WXqy@w_x%<0kBb<U~Mf0J4~GjGzaG-RubV8iV%ZvJm%^RD)#
zPp$IUb8PmyH{Nz~Dlw}U;WNj`sQ-xzxgMz>huEd9>1gkp_;9?1=SP{{tUO2FnzTCC
zCce?euuuIHCkFDGzdROuEMc(a)QkW6Bojx9z6-M-^2cuTLtjPvC#JMYT9JOf?W%Fd
zvmZ@t>B(E!#J0<tQ4xu5H{2YS-SO&c`}+m2-XObI=^p?@pXqB#emuKoYEu8%p>Lkd
zc>D8|()ID?FNUstXW5K?QB5B#AYSHkEV3td?C+Jh<DW-Op3m`W!f$pXGH+jY%+e8W
zCqH0!x}4yDonzJ6f)I||dFVH8=Iur%sa?N{=_>$PKi|$J1Y;vMjn3NKquZ-~LzbMf
z?svavTk@GvZ~yfh)^z9DpRF%s5(C?px~0Z!xi{b=Vxje#n-5#%Z|pW8jkW!{Prug(
zgcq~>Ozg1Xq<56rn~%BMh=75+KH4$&9dBX+&ob_Vmp*CpTKMs%jBMU_gp)r{I5f}u
z$%r@O7q2h#NXgtk+{bJ)Tk_!G-@ec0wehn=32i^Jh|li*epx|!<`%(#{I_E!+x&A8
z>fWR6ue)sTMF@@?6Tu0^vD3d7jm_LD`19G`ZqEWBbCxAB<D@xY@hB+zYOKp_qrQTe
z#g>ok@;93HupnmaHGk>hQ}%$zO8L%B+~v5V&-aal_d0RmDZTIMla-#A+Ommjj;Xst
zIv!bDa%+%XUi@|!*7NZLJuF^-(&NLU?T2PA@i+Adcl@SB<DJ>#2aE6Z&$+gvahvS@
zam`AHcbL6qZPWa??B3DiTk~)IdHBV$m&c6@h8<6~8a~}9>Y~-us}ozJ7~uVb?3{jx
zG;06HnjiX1U&VXx1D4qSP4{%?7yrV2oO_@6b^o9aPY1qSkd`n!FMhXUoFqGQ@!_P9
z9$=^QAD{#7d@|&p{LKknug1>*U+=%HOwWG(?fUe>@dNBiS)-x_$HQGF439L*U+w3g
z(CmP%#Pyez5A0f$?ak}Ub~m3Mx9as+@$G=@bBh8~#vc)ZK8|6N9&_LC-!#s@-=_1T
zM@0w6itqLL*4)f)(%Fqm#+Sr8uCj2Lej%n{WqYS77k7#Bg@YU&-k0QfTHb>GR(zw9
zKAE@oipI{_Do6kULwgd!X$RJs7EfUd+DNXgIO9-e+s#oZ+MLkecqSnj%69wy%E4WU
zpJt5O|GTmA%9)dUhVSB8A7v3!n+Z;DGZ*!GanCI;{<kScAz#~@Jthd@uZLfpI`VYL
zKle8Gh)Iqev)|m<DJYI*LY)5aQ@*#TXXb6wy!dgDJj#B?Di-m2iy&{><Bg*-Ms@k!
z*r)|B)qzbovfVEJ*gmp{KhGWth%z_sUY6Ii?W&(cI`-X==f+#pR&XaHc5iO;FiUG*
z>QM`aKmYZd|K$D*uKl$Y5gmi#d>m7)^VpUj5Jamrxx=2Y-4?zKde);;Ui=G}5R<R%
zXB=hiX1o3E%6gFXIMS(X!*It`PTty>#{pQ$Cx6iYz?&m3AKA8w%o0a9m(Bd;u(_*;
zm><?tu;J|9MrT$edyl<pwSB$0>p1cAJ<W*UpL!p;^Z3GxQ^PW1eg9oKwg1njzRob6
zLB#L7Y&>!9+YdeycL8Hva*NxKXZ@U(A6U1v>4%?}%sVT(x%t`y!nezU1M3d@^P*yR
zrxKYS_s4Z8eR{z-I-~QwRN|M(zwaNk%qewh+QB}S$)kLCvYdT3?jLmIv(hhZ6N7SZ
zd;evcXt8Yl_y-S0vAqU;3s<sVKR+PqAZinu;2#}#^Hn@+n!}xO9Ufd;@!|Vr!`A)m
z!iu>+ihaZVen`jet4sbJBwp{cZL-mk!?7mo!lpaMU4MO|^n6oEr<X@ZBqbM~TX6c{
zRl9bGZkwI{@NLenpchxqB*tX$3VkNVB#O^%TxvPu3tmrw(L{LuZfWn7acgsroMbEG
z81vKTgM5i@x$`@hu?4e_Ow6$l7mfPpp=5YcVPQ|USIBdlxlZeZ*0z#%o^PI;p1)(f
z!V8LNUh-^GJA29af*X5T#$C$B_Q>>h6yAQbg>~r0?67`^gI$u|>6c@FUc}0AVa0+D
zULm`(Pd65}=}z<-9%qvg>wMp;S+0MntDyO+j*qv9J&v2Zej;A)cFx~uz>!!Jk9C(u
zu6UdBBCavNz-mHC{3G|gQ7v-znv2c`wc)c&E}Y)wBI!Qx%)V7m5B_4@=KZppk-|;p
zqVsq$rOj*St!<rJHowc8^;gcPd82|`&D|`>dF9uZ(-{nVw}qYG(m7j}vpmFE?@Uf`
zYjqi9esT3gZsei08@olleDZrwR#Y%+lS_yPB7f=bqQ}i0e#vil=7)8QqqY&ru_0SW
zIP5OGN6Zg6kR6k?bY4qH&oljC3x5V$Z`$0n9;Ok)`60dY_Ga(7<2?9D>9+lU7;kSb
zS!<J7HrLBIh5!BKbeEKi-}ssM4i*G;TQ+sU%3|J|le|dV(vs_6?t6Ty{q+*oCht}Y
zCy5XAe$gW_{pYu?i=RC1kTT)eZ^3qV(;A)mt~9UF!XcTF7X}u4_r;7QchYkPok%_L
zVwsV1?`CG7iHV+qJ?)-EKffUy{V-wM;@ccwBR8XoA2l=koV+x6>xJx?SN}`@U|sY>
z`#Zzq+yw`x8|{p?k7GH%n9=XG=dmxBd{SUHBJK?ly@lWGs#UJ7aN>bKx~}MM(rV@U
zd7GU^nMN6JE?pScCBt+xYkTw%(eC+qZ2ksGuPMkUWs|w<F!A%X5!-jBob>knD(PiE
zU!&hmmjpScy5_M{h|Dp*X+3(rV-m$_=G0Uu9v(;Detvx(tvUC@%Lz*tY~_z&ecvl&
zZ&a{&^t!R<#r=aO-aaESD)92T*gR=ka1-Rd>J^bX4yu5Wj^`hJJ+F=M)3iXsl@)p`
z*(#NA{Ox|x?SbEhbaV~j?;9v4W)saetuFZy&m1y0=8r(3iKD+2-43xcOBw5Hv^s7G
zigoRTu)u!LiTpcFeH?`yK0q{t07loNll!fiZrj>vP_taK##kjpTwn3|*BhZRzUiu!
z>tn*Reg5>Ym;MnG_m~@pxj`+~-Kfd3!0RV+-32GJy`t7Fjx$TT9Jjy=DoUY6(xGQ-
z5;9Cjnnb;5^}Y$GSwJIGD8!W=00wEz-aPN!mw^}Kxy_D3yM#QS`oTXB*X*?YK|D5s
z@HO%bbQkm4mT`Y`y?<IT#c1hk2jdw=o&m$f{3|0_Ct98|oxQ|%18cW!D<`Aeg>e_%
z&U6lno7_6-V2imXU4r6Lomqk{{P+8G4T>Asn$L+yoDTdOM<!djI<b$sWZpKJ>9{U`
z+jK_{)|zPh8SW;z&}VSm=No1<zKe^8v5%w2q}12s1&7ccbFO>5-P)t;55*g{2rT>C
z@KOo3*^%rRHr$ax-!1rbeyXwO<#+SgA#Ic5S}tC3HZ7r1)bQqQcs5HS#-F^xTm9|!
z&aS<3J6y9je?&}dmp`3-=DVC;Q)~(%r}RpA?YJ`SSbQJe*?xOo9KLzbs<%g*dtj@F
zEngl__Wm&0+cWjxyb+U3FZmLWW=(oFuk~${C=c;_8N(c{ce9{R_a*UQ&h=*<v$hb)
z-YmP#{B<U&1#rXp#y1)*Zk}=4+}Mv80PVbi1;vfd49a^Ddd1OtoK0%-la<?tq{c`t
zWxko$rEFP?tVxqO`z!?hiS5kZ{Q84vcJig+4x7pN?hMI>j8n(G7Q2M_xDfYd-T!$&
z#7<H6a}P)BaFRc3N?KqatK^&}Yc}((O_EM}n>Ym(2P7Gv?@gR6b>Zioi=N&r_pI5C
z%XoozbX==~zU&z(n-hNU5SRIMX_niI-REq}>)&2_7m8_|oYVOOKclC<#J4|YFYa!e
znE2av^CdHh5q9}M*+!)Y&vIqujASjjATe?(JG$@L!lZK+{C8Ij%DWSi(Zf3KX~447
z8J1fF<69GHL0SB~mS(xv|GMx?PCt*yj>6ACwDfjPWk#&;?Ve<dZ{#)V$(m<@9v}6?
z?0!w+<3x>(`vlJo9y=nbEn8Sv*3(1$j?u*PGlw=Ck<^&I<fmql=MFEn!Ti2pu9=R)
z6*lYq6I<hn%=9A%yF?7k>Pf6A*%}Ix_#C_NX6tw6eRi;pX7_$4+1nxM_uhY7eAF!9
z5wYr=>p=1Pm_~mX&mcPW9??|t;yv~UEEqa*YnIGg`WG=GsidPr;5Y7Aje3X$rV#^Q
zNan)m&Eq~xJ00>8?}TRsztOV|X0vRAvHo3mxlae9#u-*KOI?W{n|iwWj27=a1W7!v
zMVYm;4mQIiWA=S!+~n)@VyMI2Xa3gF$TT@8|IJKd_qeXjL#|{L{|~Z`>AP`N5<Bnh
z=^z-Q3LoPp{8qH`3!bH5+>kCEb3McZ;Q7n%I{iJHCC)+K@RV@aIM&^mwJJRli+uk@
z(}Dbq#VfIxwp#{U$BDk21X+K(HOR);IcPjQ`5k`hIo{aPIx!lgvF^6L>A<k7cM6-$
u4=ocvKN6H1_+U}Hi9Dr4g)5#(Sj+m(Ke#GCtQ!sp4|5wi_{boi(EkIl8^Uz}

diff --git a/client/ui/assets/netbird-systemtray-error-macos.png b/client/ui/assets/netbird-systemtray-error-macos.png
index 9a9998bcfd1f2f4b686f2c08ac4be42198111d83..580fe647c29bce036a816fd20f7ce0a6ac0824cb 100644
GIT binary patch
literal 3555
zcmcIndo+}5-ySyGmMt0KtuQFZaXyw|COH*3)^<oHLXLwpnvopJE{BPULI_1DW*jGC
zjKenAPB}%)<f$BE3=KIBdLQq%*0;XzkMECft@nM_y4QXGuKT*K-|v2&-?N_eBsthw
z2_HIs2m*l!UpQ~>1cC5`9E{)iKt!nA=wOodKJR1;f!tAqK;r&{Kz2YV?i&OWp#^~~
zdO{#Z&ma)Vu;-1A#^46;bsH;l2&63Kqz)JfhMjl21^S2`3?4|%^M8P#0QQ2dg}@>|
zpU5HMT7p{u1oC^$1#{EOcm{j&bHwyJ@h%P`YQtp7vq7BXWJ-}%7XQbkdo*#^H?1T0
zDB{Y}-(K;a5kLQ?)sDX>p8cq6tUw6bN`th(jD74=EgsWDWmgXsf+hSXuQbguMBGKA
z1z$zlt~~9>7~-V7yudasI05Aj(@tOXQPkbGowMWJ17O97Q=iDsdO!PU=q`|OGmqZx
zj@*%SC}=SL`-xOuJ+PzqQX_)Cqip4Nr9kyV(G$c(j+HZWqmMbbFw>mAy+h__U3z%@
zgXB`t650OvZn^fj)tR2Y9eNv;sTv>sG-Ev}K6EWPL<Us{?98-P+R60&V$`HgwukNJ
zbOXjO+L-`*zF5nJ6|vziG^TU}8BwDnGCv-9;`GbPo$#6B^)V%m5=**OP<Mi1<^Afd
z6bZ+(-v@6QzO575UT|W~wZz|sHS$|5BhjEfed|?<KUIZimEQ|>qox*ka7t#ja*X=@
zepu8{Z$;X`TFknW(#xaY%ru#nh3waSt^<9Og!7t{L0kg1^5?b9pAJ6?&}(V~EBl*n
z`Lk~O@PSn|0nsyC$9|pAuUXudZQ-6NN5a^H7c^<u;a<&Q+WyBXHr8c-%Iz>n+$Kt)
za~~vF7OJn77Wi|s8(L7(0VRn(cEs?<vAso7Gt~~nm)ZP#0^6f^B!OC?&EDzen5dMu
z_6PgjMaIo&U}n(pyCXNZvZfB;56TNJbC;kz$@o)EQiMk8Cu-O-T?Kj*inq`Hj)|H$
ze;zraQO50xDJw?8N6QR>P`PW}@(VOmw%@A^?!!}ou)eH1+tb8N@mS$!e%8^0mQ5p;
zyA{K;6}U04)zS?2H!GqmmIY7Hx96;&OjmxqlRF35^MvGs+#!9~$d@2_&s=i(Y8*i>
zR!$oIA#EL^Fc7E-M5nJg+3z9xIR<6r{+W${(|d3ItNB`?*BnQ3zt3hio-)A2+)(CG
zr9fAxNqO0x($9^yWXwH!FF{#8-Z4H3#QF=h)~MDk;9T9Uwf^04ySEP_d;*<tO%e6Z
zhz1xoWOwpvIQ&?E7t*KQz4COkEZ9pigU{#Hft=|Mk^9>(W^=m$NfVb}{`$J`NsS!u
zREk);M+j|9AKy#(_~*A<(+a>-h``#$uXkzu9ggctXh~EoH?e*Wf78-~GnPSj_Cr$>
zjSV+AC48ryY&mG<RKJ+7>(%RGEc^he-Ld70#Nh?&>s$hJ+yb5N+L;UWghtS*E>hj=
zTFWQr&8Rqoe$F|sAeqS^cJ7oi#YSjK!#;S5MoBeCG*xbZ31mJn2?X3W&LGB3N9A)l
zEq>~^o!9Ci@>7@g3!3NfqHQa8+O!o~ZQR*;`6sO7j^R@_uU4;^Irq}()S2tLduX})
zUHDREo{~h|o7qE8A+-yW>IrP|D3c}`X|WZZa@smK-oM#7N>e<_czMqfwgNTG1aHl6
zYfEOYMbM?=pGUu;@62X*?=^RleR#&oRe>uGOF>r!!-AXE(2+r@l0}h;xP0iBhGwJL
z><J$PU=RbVJ+#5%_e-W-+$4sT8*6SOmlw$icddh`^J@9<jV8(iHu+Id>$nGQom7{l
z&zLFX+aSAPN&f9~**xV+k!s@H%;}S*4T~gfce!HDv_-f?In4&J-XG6@s_V~4@OI$U
zt5uO%elcEtRH5|}rj(Q$ECkc6QKo?n2JPLnx5Ig7FaIJP<2HPG0>7DT(&L_R?e%->
zGA5><BVQEG;_uCZpz3I=1bRRST!qKTK@n&?(a0qYEf>33hU{_$6wWGH)1v~KV4+^D
zj4VZF+TNs_h$^t<Dqi0sgAsKcyVx0h<$~Z~Miclvu8V|cKoZdMkFu%yU4;9q9q#qm
zfO%Dh_gqMbf^^Rx4_U%onOok5*ku{uq)v~hb}#hHyPS@yhTKRd`2&kT!PptFqF6la
zn|uoKusN}UupmYT>Z@FrK;Z;fU)y~brZ6tN7xm*i`#}Qyu_|CX<dO>YY$U|LQ>YSR
z-HW$O9t9fzxEa+oB$1YAqZp!4u8jm}g;_t=vp>{hcW~8|J^7;QUN4Mw+(NlHL;t=F
zi^uGdHm6R7XHJD4&>U(lSY^~+Fe`f0-98$g4fo8s|6&gRwXe$ewS+?J^IP)<-JHMj
z<T!_u+3(AeHr8`{ve#w3UXSCmS~B{gJD3Wm(Wk}hrRrRQwS5Jv=>4B=&v5?Ij&5pE
zsmojy^7UOjI*)pDH78XleX##+u}xgDb=Z8_<Zg}6NxcKlS8$$8l160;*XqW{nAjJ=
zf>ptkIdf`67U8;3hlG;}KNU+sqMsdM|C&d{bwgiRP{z!u(eqQ2aCB}7pT8LSET#0z
zhyGC~PNSZ}*>e8~^Qhxv@w}T3Hz^iqWRDy}tZGj#+?11C)1sE$E<Ke0a1(5&3<$Ys
zRE+&*tC<m1vK1sF^r)=qlWe964-|8B3~pw48&G6u4XW(l2o`+o-%h?+pKg94Bn8e>
zLfA<8^ekV1wV&43d4WO<*L#!|@$+xbKC;iEKeMB^G1f<W*ICDkf|>H2MAf{DkYulN
zYL;PcziaZ$J-R)CciSXhbhaz<&_IvvoqY0Ap%pr$A*Ko1^^ZkR*18T1bV+=!I*iC^
z&_IWA`3U>&zYIE1jetBO@?W+DINucuM0690YbCmaceg}f4wl-Dcy}v=$HCI^W9%-&
zj50z8{f^?cCjfMz2@=fMPT$5yC2za~%Mj5mMGbQ#*k2FaOORbmZ%P7K|4+4;8sJ_s
zX%;q7x2M3#@9bb%j-?WReQ@{g*3HHS#B60zM}K~RA0~$I?mD?6*MB-MbIO*&X{+*!
z3VNDiIFz3#kZrXaA;eK+hz<2R=3f@kiQz<^3C4iHlj`*8S0Gzyn!8fi#rI?FPTQ4(
za3=aZlL$&56SV^ofO*t8yXa$Hm3L(K8a_s)g80+XZd0ZOox2w9+H&9<zMt(xO(b8`
z1={X>51W|#>&rsS^peH<*(&6;G%4Y5mIpx?<c%_}Nz=KB<VjmakoYC6pByObJw@C7
zu_yu31P*`v2CFw~O1kaqEc(kG$?D0v1F`VO4x}@34w1yNuMANDb>lCpQ)FDHK!Naa
zGhS$|l(U`j?z;`V0LwJ~eaztZRCl%qt|@-~vFUuw_aj~OT111a&Ci|Qo=$|T$T4gM
zs#gDxCaxuDknsDJ@-#D(x1f|Ker)hs=JP;M7iSup<@0wJd80xJ%=Yd@md2q=iMT2m
z4f?o})XuZnsx`67O_>!>6W7F>1^6wHxFLNIsa%}j{zOv~3)MC!NnY)R9V4<`+a%J4
zRC{wbzt2{oV>7;z&umBVUCk=wd!_>bMYc`wngNM>a-0e|2Av9RKrJN-w$%p~g7~0s
zUj4M$pn_4w?vNs|JSmxY_EX@>(H`?$JT-I0c~}RS1!>am;)K>qH9-qOJ(jt6gg*TE
zJ#2k))>EPZ=XSug)4bc$7%|KgJGH|lV6Bs>!Jsq6_jHSg>%cSI3<lFnHy9Gm=Hr=G
zpxCht{1jl)VML<8Sg53Pr)Z)ZJ36lb3~mXnL8QbgV4LEYDNJxEa#vrSC=ZBN$9@Q9
zfyG&ptm8(K4LAmzvy=hK<88y)v}}yvAdX@YzF%To<1We;8j_F$Mr&vpBss>J_fU?;
zb$d#srTd?Fmv5Q=<%R0!n&94Uyd-soJe{fvFO(L=h)#J3Q=y*Z17XJa5%xEKf}ZqB
z0U0No_MmUZb8w}0*Tk{Ku*R;@?^*`aop8z{pDK}tdLkpJ>Zcpj5`f*vf4|lc%}vJ!
zG2FQQSDKBG$1iJ6E*&ddg4x=LRXSjP`ZKoh56ZY!Bb^=a%b!s>2FB=@N&7<-FV3O<
zAH<T5F1X$(Dn~-Ha`5U;{~RRxW%vG&o=4NU+P$KHkJI8g%P?D^&LQws{eMsYrk?`T
zzCf#YQk)t!z5;Yqz*@LseY~)~M&9AR-~`dp(lJoi(pT5gyR3D_Nb9tbz7AYV%ScP>
zGwZd?{}NzAeFAPo{@;R%x+8_4K>5EjU;{9|x3FHAu>Yyi);H4DGSb%luOx@V*OCv;
OdBMWYyyBea{eJ@L!Le-s

literal 3837
zcmb_fXH=6*w+=;+Py`}M6Dd+e5vfY=MKK^KT?j3}M-W6rkdhDtBuAuZ5C}>rDn*LH
zLs1|>jG!O{jyW_13{53R5}HX!OuoRncisEr{=46-^{(0FnZ5VCd(WOVsEh6{l0Zcu
z0059Y=j!MM00{6&0l<C{{&eMfeI$PpyXNYj2mpwKc0U0C=8^m^B+<*o9?&wX{DaR3
zN7;ex003N}I45);03db$oTJ_46oH?!KZ}<JiU-zh6n5ZL<myRjQWor1-%G%8@taV)
z#gl%inGg4&MUS*)-rv{WW{ciei;N6V9vu}Q3-W&NXhp~)=VwXWlxwVXBnSwp|9{6u
zW4!b<_5h<~joLkkC1h~Qi|*<(w%PNlvY(ZI(Nw6(j3iq-$U@;JuU^2_@eX@ueh`~T
zw^4;XTBDNkgs*qCk{H{C?AMoOFN+leq;$5P!W@Y>)(=h{+Z=SlPe!-)CE=`zC@*jH
zm&veng7cgBOA0bB2RR+vN7UWZ9pA+JgVd#z$12hSFWW~rY<~L9TI_MHo_4#J7aI-#
zS&ov!^j>zJzmJyu(a!CF=Ea6sQ!fyK!*jYCZOH7(jkJ2A;JmumC?}PdKbJH&gStcg
z?SwI_nq*gxa@C(o5P|P2VUAC#k$wWxiBLyH#XPy9-csECIH2w%W}eO#TVH5pY}+(F
z5mB9VwakXh8*VNVUM)OEWJu`1G*zruFEM|gO;{d;2U-cadcff+KD>AO71Rw{##gFj
zY05mQaQiPFk9F?%<_8)?g~vL)<-h8-Vnk@sV=NA5{H{E~i23n33&K@(NZnw^V>xiv
z^pM-V@MgD5T^x=D!T65bb{M|KgTh$$`0_%u^_EBxb4S1B%G$^r^;17fvW%aLPHh6O
zB*WlFxL7=%PM_h$w3=krAp(9RbIiBezC2anEUz<O!L=&0@e9=PqbVuBAw=b!qvJWs
z?J&5c)%rE(dmA^**I$g+C@-q4y6DOyExbPsS)P1G;YqNq%<WPd95pqr)y*^+9w14t
zyttL&0X;ThFdGQIY${95{O8puGyP`Kn51=Q{e{}z(}KymzDWZRBWCs~p*VkR^moU9
zZnu9k-yD;$?784-+4D+adCIBzqli1v(yy1C{_Al{m)hWjbJ&sYXed8-Z|l3+t-43W
zgVd@$fH7oZE?Jo4+h3SnX|@)Z@lC4;l{A*xAcp1RU7BeYvN3{lx{GXaN6|l{Znopa
z^y=$kc5q`QvNJ}L4=ESz#aF8h6RxzFpsvTZ<7s935#xt#JM=UvkLD%icQ(-y+`%E;
z7@a6?_BU4x4O~Ie)^>BunwO{4YNf7ct`#dja^`W8^TLtMJnH9c8R}Q(R+M2dJ35(5
z(_S?SQ{l~+$c}O1ZalfI+-|tse=Gf4LjF#E8C5zoqe2Ol^g`pIr*i-^1+;zUi9m8=
z4Yj+x*iY2b3p!NpV;%RCAtKR5?J=}4kfrvyG<d05USTm^Rt>+lEYAF`H|aq%XU@TD
z9;LrMyHY3t+Lk|P7Hrkps-zvJm-X#DI&|N_{f4v-#p?G4)P#&#GZ0M8a^e8GScfgQ
zrm>xmR;pttP8-a+eeD=RTUew&<1h=ziCGJa+g<o>-ra!LrG48_baDNe0hT&ev7+nF
zgFEA>Y)s$G5ZcHS(S+KNWzU`|A3a7Eo**L)1A<zM8$JpDN*(vFaS$^>YMOYu=W2!H
zYlA^kpM6KP%^!|Ii8SvTiQB8;8Nub|;1Cantm_SThHOf&^N?#SBlg54_ygK9_>By!
zQwVpc#rxX%-dbzB2L=R_Qb&K(ly*Tr=MNc}0Iby0IcqgM=rsidb%NXU6}8Ia4&fsG
z&X-qxC@UR(zQqt$p9|U2Uh>w!9eU|pvIFn6+s3st8$q2o*ZuA1jAdbVZWE4X3Yh#`
zS2Lb92^lMNc5ctM7oWWw&?XB_f5P>PZ_t1`F{4k{zU1ll&RW2q<U8iqy%QZOhX7M}
zmqQ$VEGTK7Zr;xxiDB|t6BwZiox#oKA4b>PRk&#MUUYi?n-&Y2HVS7Q9wfxK<AY|{
z%T<~-hyIv4>4raEMrU|^by<o`ixWf{N;DR>`;_#2rtb$2d`ZpdE}fc}%LXk+L>sRB
zRdPJ-fu~3Oes@<-)Nf<t{rIdS)gQ{-eBqWNiC}d2SOmvyMJq@1*SN6rj<rfTL^Oii
zyX1y6y4D$*Vc&S}d(4Zw{0Lt~GWE~H)vp28rsCjU{!3|M^3Y@T))PLIR*J-zs~2;P
zWpHATj%&|oYm|4i-aYUqb}`!+%AEe{raS(v$LMp<@tayJJ43)+>^-gz82x}Bg2o-h
zO;x_^yawJhV?<h+FX|m(2Sn|ZMKPSyuX5|WSHr6vA2F;9t?d)4xK|_-LW#cnPub}}
zv$VqJ+?e{K<j2p?8ZMlWa8?j&EKDk-VE^v9(zSHB>`4*Gy8q%v%nJ$dKu;$fLQeT%
ztQPlp%36BwS0#}s*n7+%NJ9v9I8S@%!&t<}G)Z35R!Nq|!kiCS^%H3juK6t>uptfX
zj7em4bRl~7^6~Tde$n*iR^$88lfs6}7x>GpvUv;n*zJ;B*{hgL&w*s}QCK|R_7_uz
z7ozu^X;J-WVXdJCv(ezUHWd)rR6oeH>&S2(2r8d6Fqy{RKx{X@4W|hHDmvuKv}8y9
z0%gMR3TM^3!<Z6-xUXH7qomvI^J4GOyv>z`OiwLUXN88bl!IKx<L_zQjcEL3#zZFC
zaQ5t>9K<W33=*VL{+0Eyr!68DUrvkUAbJ_WBL8G?H$J}KDY}4uKv{jE%b7GAXK<Fw
zi<9imp+m1-3X$Vd<@pPPuZ8(v<R2iW8Jp3;!Xl2>cd~|0xc@0W6m^iR_t=xUysz}$
zx|ag<*g<ad2v+boXQO0tO|$5Dls#oWz@Ad-+jB!7>E(M{0Z7P8LqRZoj%FmKyZ!nL
zmuq4}Byu3f&|ZgcAM3DUpWvt~VJ<SAUZXEEv5G3seS1j+i%kg7i+S{;63-B?;xNYM
zbcgG34ttzI6smpC;09rC*V73-tTdn<ZIkww%R%mRU<Kih^p-X6l;#ZfcWo|$w2PbN
zo1Kj1TIE(TSji`<>5!K!#=)$)Z}aU&Kwk6aAIiJ5i33I7gpjv~hiyN_e#E~$Y9QQ8
zf~5S;RR{9$yWW>kj=hC|G;u^W-v{EBT}?XZy9uXqPbG=E4z6O*(<Jz@l<t%5<el5d
z@2BbQTJR~0*Gat!dauKov){D>oHR!Mw=OP3hf}<3;3>d?QYfDlG{OsvI8n#mK`gLD
z2=3&of^QeYQ<iUCU6RvSuiPgOCuOx)ib;&cawgGgq4(;=QsM;pE#_taJWj?$pb#8V
zwI(kIXBC2C1S>IpV<G84ge{gvwLPLu7Pd4-R<Fy;aaCmxh@VE3*O9S6M9c>$QNaX>
z0f$UQ=K~P{5aA@h2e&HVZyV9^Z{D1hgV*8ff}}w-h@Br57az)$8lw+PiAIHcGarBW
zQ!>mRT;&ate^lU2N$#K0%HwzD8F0uoYaa*G62F@cg{*m&?Jd4AU{~nuV0s3Z{$}M2
zEyftBSt=7n7XEcPH}(_`PJ!1*nF!=S6uW<MxuB$}tijQGF&)lzqs5M#NA+(HS>AL8
z+fqs^BH|!p8cFE^^r=lI2rtjIucHt9T6@KX7LpB4rTmkR$?VsEer$+mP^giVFRo%y
zt5roG4g)0}+5!C!-z}STIK8Ui(|<YHcxJSH82-O__1ckz$=CTQ9ZMef`5_*Jv(7)8
z)tcG}7K{-D5-by+{EmE27Ndwhg!G{4@20Gu01;9Ad@l#bgH@|{9jb#q#}(vb`Vt2^
zU^Vn)bxQby2(oacQF_z8enPn0+-aD1;GCN+e@C<eO8lpKvGfsor#p}*6_FlSi87ZG
zKWeiZIPHtfd_{DPR3MYd&(Q20Uf>Qor7Ls5sCHB?n_nRs2D21Mw!zK#eqQ;Km&>X=
zD(TnJJX~-xxqHF^=t`V+4cx7>R;?G|<$g*H(A@%z5wwUT&e%4ak`L%`#wRZL1f(J_
zv??_YBp-+~AQ|<i#=eSd>o4}JSZQy(r7xf_64s2uWG15gDxQARIxP*;BMS?b<+Xc0
zG({5e62t%@6C_~82#OxTbr`b$B`Aa|=*8Gdm-|)J4)WpDvgcyLp~RVkR;Ea#-(Ub(
zHIK+8aXp?-K#3-jMDu|dL8LOOT_zQ_yYlLYVo{AO&eZn9jtoyE?8v7>CaUi)5Cb@W
znNTKeo5H8tM3y4wL9lVy-+4BCJcX}6^MM#ZS1cLNu_}hywuBJ_zAKh^G8q?z+RocY
z@$&l#b&5srtU<5@H(zH8Brum3bx&xcC7b5d6r_-YxH|m+huOqQy|2(p*AE#P(&4~{
zgXLeE9icuIS#rvy<vjP_Ln(!yaal}n5Lr5*Fn`zQxgn4@V>lP3RJh)&Sj1!I(cU$B
z@8T4Or=7#E1PJ~0a}d7AQ~hgkL4iV#E9kwpCc3rsR=vekpM)!#F;$nu=EX17?iq@U
zA|F|7HW{mC-S;Kk^?JQ095Ucv&@kB7^8~d@Rt$mVjD>uE%YVZlm>60Q#htk=I#fX0
zVkY+2eOe^hsCi8*!%0yNwJJhu%9DNP=hfRr&oI4rKJvc&SU2d|=rL{6$R)hQju-HI
zywjDOzGxEvnovJw9}+vbOH}0cO;zryOvR9tJG%rXw~xN30^5f$p<7mn;zqU89HX5|
wf@_Jie1bfXaAWj)+NRQfZqEC^M-yEiQ-;c<NV<~vuT{V~CwIpd`;e@E1DQ;k00000

diff --git a/client/ui/assets/netbird-systemtray-error-mono-dark.png b/client/ui/assets/netbird-systemtray-error-mono-dark.png
new file mode 100644
index 0000000000000000000000000000000000000000..6bcdacd447ee52d82d3a511abd5435b9a81297bc
GIT binary patch
literal 1571
zcmV+;2Hg3HP)<h;3K|Lk000e1NJLTq001xm001xu1^@s6R|5Hm000H*Nkl<Zc%1E-
zdx+IV6vw~!-qqEuO?zslnHZ@_L`hLbWYk|m53DEykwOT}q!KC-p_0rpdQcPz5hY45
zj3DTRQb;BeqA8J75>lCl;3IO|$Nluj%-P?$v%h=y-s{>D?7%R;`}@tD^ZlMVbLPz4
z0-*nMDGoM(6D>mo2D=OqXt0#r^9)HVC4D35kfbh2ow2P}J7W7~uN2_Fs>Rq|3493r
zL*u0kbOKkI+?L3rkW^oMoXz`&q;fx&FUCI0Bt5BY=6h=BO-r|=7D;bN+S&_f0QZ3w
zWn{ci1OJMo``!0aDxgL&LmiVeP11oVr*{U<meek3lBDsH#>ID|B(+Hz76%-cbVSmh
zlJ-g38|!Zh7D`J=!OBlX@Ewv`)%e;gM_Erx+8=R;S&zQ-SQGwe<u716@G>wPXa@>W
zZcFt2JAfZ!|Lz9m_e9_S2^bmWnfzV?1>p5K;5g7#XD#O_+y=CgEn2H*0Pi$G!usAG
z<&?bKG(wnyt_Bp830CTezn731WjZi6(XpZd64vLdJn$)jA}|d2qzMu>&ASP1Q;4$m
z0KWn^Mm?>uU0$b-?kM|;{s<U}0?-C*X^@0jYPOTN$bByZi{twdv3<TD9VYXwYT#1>
zewt4QzDor42mVth<4oXS1l~okB7|Te!t4mxR7Hom<xyY)!LaF?$|c~Ljt743hlDBW
z0xlto4lg9*j0nIzWNYMn;4qmBrbby#7R_>Z_-fm}k(dJf5rvr*eKAF^I#5#y3px)}
zIewc+X3>WdSvKw$;1rUuSuX+4`f}h%4hggVAz+LH^icxH_bmf+35&TD$Fve+y!Ekh
zcT>an>mlGt%p&X$WoK1Ww8Ztlp$2#l%5QW67RK+E;BAS0YJ#tafLC&hvyi#N9zs+p
zMrGR*0v`N4Di^R3DFCAhi{94BOzN<Hy#&0{c~OCFTDQ7B3v$5Q^ZXp}>3XwFU`@T?
z8zJD8+jMV=zl*>q;CCv0-N4^V<xJXac>)FCHsG_U$KDm(^9d91ARY&<b?;X>>wEAE
z67oKlr*VCxlb;7Tmqeok@)S=3{*IRSQRKb^yn&ku+?l*fffn4@#ZG4*63q~>X>W<`
z$7CCofnS(_H<!7T5OyKUF0D_&Rm;uZjeXZT<5iGomVo(Y3$P(7u@JZ@v94KfI@zXZ
zN!py8z6R1V<KwY?JCDSP5b!hcc~p|RjVYT#NEr;g?I&Gik!-jlyFT{qOxkshq=2Tc
zRgg3y9v91!=1AHh={k1=EW~~Vg=6S$H`czDB)uo;W`!#iB(0S+SK<0(SbS$Vcc}8b
z-S7;UkDdyAOBRWWz*)cn;C(kcenGYo4knOoSUv9dO~7l3#eGD3!0Bpw4VbS!5rrNE
zE_UC?5mMmw2?<l$4s1?Hq{q@8_ujxiNTq8wMZo-dBH<u!!uJ6exPBK!3)(@%M-~C6
zksX*kSf6(IZx1KNYnp(C!gbDqM&f(m90zhne7`0EZ!$&$TN9wZ*lzx4E%1#HFvVAs
zO|4D6xxzNW+VB}Hz_LV!we5s8<1<_@&vGI=M-K>rucPqvgl0-NlI1cYq}S7^bS3-t
zB9+HYE9Of3f$JH788C%+RRN!p_#j#>RqDaN6#IJc-Bhj#fMaBluBkO({@VuZrSC#Z
zi>28s;`rh8wS3-fMBd`H_9$>oH4^n&e`yrfN#?U@wVBxoOeTw3K6iO82fU42O}4Pp
zec}jV{aG}ui-2{!koxcPcLC=n<BNn-+cP=f?RjPFJC<-cmPg_c!JR6uSZZCb+jc)j
z(&V_cSG&WvwBQFxhm~EaTYH(L?aKZSC@Q<}UnOa&q~S507$<3?q^Yh?XZ*fd(kz#*
zoRoiP(wyC_Wyeu}N3@zs-}ZM>dtx7({awI$=?v5hs8naIcJwoa^PNjP>%jYQMq+|<
zr=5f}rH_G5#tc-emd88-yy?K^kv0;OfiDO*c>aBF9mv0!2Bi%BPdwOVh`?Z%e*sEd
VpKP%8!^Qvr002ovPDHLkV1iNR^nw5Y

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-systemtray-error-mono.png b/client/ui/assets/netbird-systemtray-error-mono.png
new file mode 100644
index 0000000000000000000000000000000000000000..164d65a4f20c892e9c852a5e2f978dfa1e7e7881
GIT binary patch
literal 1449
zcmV;a1y=frP)<h;3K|Lk000e1NJLTq001xm001xu1^@s6R|5Hm000GWNkl<Zc%1E-
zYp7IJ6vuxvb02BmvZuG3W@4lj5hX<#K~bNCN_x-(L<%7=i%KdZghDdQ=s{7`m#8p`
zq6mauB#C7qVVDtJdJs}s#)Y)#+I`IQVXZ%B&Aw;m&di<q5VK&j&z!yXTK~1z+H0?~
z2RhWD4t1yrDuw4oz<S^lU<eomM!c`p4toFLe}*_v(ff0NH-W!_N|UXO8F_9hyx<B-
zKv&XAq2-MgQ(<+$-wTWfKx6*9+yMAd@1JQvUrQu|3N^q#<p9PVc(W@%4*U)r7i7}q
z{V_lvFb|jw4EVdlf$2cE3mFFX1HS=#fbYHi<e*Y2x#9<ao3R+~r7^EXD!Z%)fxV8q
z92wR$xgxRs3G4)(1eW+h$O~N#_G;i8vao4JzC!F<V4BNIy-Wdk)+Y>8KNG~37rQ&i
zU*#i#S6VPayjQuL5;-JgQlJgfOne^n->bu-oCfqKI@UE|gm|{r125r4EY{y{!3eqe
zODt>(E^83@5xB(l^m@OxK^@9cXHRB;j3{86c6*aXXr-0}d8@*B8MxKoAL9L^ljxAl
z7a9Q{jQ}_T_#zQB8TfaCjH7^k4t$g>_pfoDZtu6$(4nwA0L&pfry3$zIve<I5+kH&
z6gZtMJ3N-mlOYx02InaNCt$ffJ<K$3t@A3~H%u~O0q_f1oYz|Yrvs>k*oMvnRrayD
zWGi}mB1`jr01l-_+H8bm^;y{Al^UVd9|C3tKyNY8YvL^f*I}DkWk@fU<He(S*Soxi
zVt+CtF2v4<GTEw1(dxi|aUJjxR6OVaR{FRKyzS02CGe>cmy@lK!eJ20Dk=nbGBNfA
zewoYB29_ZOU?#TdwNDoNcv}pJN|(6;9a>8R&x#!IdS0FbUL=sJ1fEOYw~eG+?%v|R
zi&)Y3Gu5#!@HaYNSKyD}RKZ>eyz6@Ou0Vc;+cF8neZU3b{RXNtjli$)aTy<Td79U!
z1^Ib^+h#<ncpmT<w(>EH+~nf|FK~;2Ym#><P=W2nPVizFYYXY?tORT(JE#PHWdI<4
zfHSbPTOq41#Zw4Pwb`rA`;zmtd?uu%*z5w{pgIMva-JCTV3ny3MHOjR<nRilD&t}A
zUu>rl5+EbqBR_1UYynm>#C;;KEp^@=GGkwM-jSr=6pWlQsj4gjGl0)su?&mh&<}h>
zb@i!iH3D4b^9oqFM9?uQ+)0y#T}lEq1Ne+A6BU7@fnR~wa*O~g)3@drq2HHcHx9MH
z-x74SOp4X}UFbgG)G$7PmB6Vdq_hv%mKc$KmX0$K{B1rz?;vcL6wh<94|xgS1DqK6
zPR3SHA0jc701hMjV2WU4*%8O?@Oe#_)F~+yZX#Pj8SxcxYyi24tSpG&C1WP=X#zC$
zLK(Qb-Qdq7bFEyjP}qU(jab1}u-mvOLwz5%XJUmL<*6ppcXV3}_?Y}JG%5Xntd;>Q
zuTSykSla+RPW9(zT7K^ZE^^)}c|Z!UtpPqY;&p7*Ql%066HE-BF{<}O1^9z3)3s!T
z;&(cBg_v%%w5iNq=kt4*xbk_o5qX<e{Q=<oR*jI-d&u&0xki&`b^-IrvQ|9yAISl)
zc^k<#c6v_i$MzpIaSn*_BpScV-;LcK$N5F<)P5)jyq?!PZ$EZ9mS@Be7EV<salN9b
z;1g$ID>_<-zk+$|YpmueVqQ^yCib~G9srDCA+Z7Ta1Z9;0W29T3_K$~z75N6klaqU
zlWP4xpwH2GN3_w$6x;DmYLMzGcQ<f6E!0BVfQ__T9+JZ4WFhfz03YYch&g28v<veL
z)Q_5fl~l*v1w8N1wTzY#^MUuV8@%|wLmleS|AqbmcYv>X<lkGh00000NkvXXu0mjf
D8PBLr

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-systemtray-error.ico b/client/ui/assets/netbird-systemtray-error.ico
deleted file mode 100644
index 1abc45c2a5b33f21617a3552231e5d9a7a114801..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 105013
zcmeGl30M<HcLU)R1Q8Ui0xDVsl>llzkl<CpyH?Oz1-x&-`#>OEYHdAHsXw-0YwIm|
zffo?8YOMz<S`Sp>iLD|i5Ksd9zu9DAfh6SEgg~?3_cA-PGxN@wo#X8U!x)%8W^Rr_
zXot;aV%SU!!|d#Y@qLhf1JYP5QM@CDEwjQf4-a9y^FR!<>4#w)jwo)(z`hKD3gANZ
zUADxqfM^ER8RAeCqzKa?z%Z!yLQ^3SaT$NQV5x>(uyclF_L^}rU0f*4o0<Y4z&WS~
z)m0TI%djH(ZUC7S$bkDcl>B&Axm5DLk|tJUF$VcB0N|An#?N-~Ev#8bt+EsvT%c?@
zQJ%xcU1k<ZDPJWIvOEf*>`$z4C_77RS&<w_`fJw#<?Wp36qN(rHF2Y|HRP9C$-fYH
zu|AYP?!2fNhw=!hbr{04HVDXis?%Mp1JCvY;H(Ise;QG~vJO@#Q8pW%KL9YURyKl=
zeH>9%B!A}>l{64_u!4(GSyDHVWO){+1j%dz<r$d=cb;8D@Zr3$xH3(YuNXobA<z6!
zab=0L)x}qwR~DB^c)nj$-X5Nh0+<W11RwxlEI=F4a}*caL>2ucJ?<nQ(n2VYZ2LEW
z>i|?6kC#?X9nbKc7={BPE&z`qgaWunfZ|+TA#mUx13&@J0f0gXP(Nb_-~oX8AL4?J
zN0EL;SXlFaq5arEUq;xUIBM&9F0PEMX~McwA43RGn})ic%Zf)_K1$uF4@FRohPs|p
z>lC&7@1Z@!OM&UsGGgklq(SntREc^5yt4twwk#<Ol8pvJC!}0NbV<gI>V$U|>T_?=
zM1x$oNuB_=M_u@xmlA!sEOL;EZxS~d0{+92XmDO$`5uu2f9-Zb;u04EZaaXInlupa
zFhAlwC@XGK2i4kzIGi=p0CzMMzw;{KTXx){{(xwc3ef<#O#ogJGz0@~f0_A4xS>BJ
z0Ns=LMYbTjE&%r=RtVspQaSdhOYQ`2QkG(9sP>%9Cn*H{_AvJPC>lEvV-L8OM1$D6
zDKv<EE(LdMz@G!-BoZ$*6i0)^eoaJ!#OF0>fPTmlaNh$U`atLT!f}^0IZ*3>azO~F
zX|mo!IdcFsE~@H(!(jX=v_Gm0(0wf&2rs2<fUI~?KH%FJ%2uB<kTR$mLrbIq#>7<I
zh<-HIbdZGx$cM)2rva+?rruW{gV&<LWqMH%3+5<d%Ac(ZKP#e`3FRdAxn!M`zPBcR
z96clRi3vwZqCxb|+byPy*!o;Va{#I>ItNL`jp{*j4gH!lh{hb-WyMY8L;aC(E=7cB
zZY5*+CAIKJ^4H2(wi*uS0BDcXi*WQ#kfZ#2$ZJi~0QW28C`;l&^PUV=Sg}8Zc?y)T
zoZmp%?f_E(HUJz2xC-zX;2(fD0M7xk08#)p0Zas-((eOtk}g?8M1K!b2Fiv|*GvFO
z^GQiGU1Y5-Q5JP&dBBg>DAEBW;S-lWv9bc1ZUBF0fcXHi0P%G|<$Rwe^xA3~m;`X*
z%FV^`3m0%aJiJtw!zg8NbxSdxfdC6Ks~~`9fI}J%&+y3ba6BCHV!62$SZJ64b7Plc
z*0u#0X3N7cGcJZ1AmCsatWW^xVhkLIayS>(B?<tlUud0z1>g@*xlUo<xYsFwRqZ8%
z1Yo>87}in-%aE1GB5!_K>s2Hl(DEffu@KIESyvtM=C7+hWuA*@DTI)mGs3-O9^}oh
z3~hCl1zNyn2)UEAlOgD$wk^q<UmSjT$D(&XG1rnY3}8j^TZpR*=ou)1e#8gjq0*Kh
zPTCmBBQ->}2fI>rUqCb3f5-<AH%5_^c1sEmNC#B=q0&Xzl8AOGc~WI=_lQHFU6FBg
zT|6KeQfVjeQM$Bea?viNpV%Wp^CL;}mXt1y2WhrM@<I(|wi$6&1+<S*fPNhI<!-^c
zf~58!&6cRNBU_SN?o>WRbKtXb@gUq&M03zvur4T#2TAsVctFpTqMhUeXh-w8k23K9
zYZ>HT9-`mXw@4EG()t+@{Z;)ENsFQ(&>mAK{fPFtmFr=3(JrZ<sbN3#@Bp-107#ve
zQ`YjN(Jtv-Mx~p24|Y`h9jAyMfPS>^Dz?ud);)x4FVbk2W;4j%CA9~{L*+Y85!z81
zXv=6Fuht%pbCA+DL-aGKy#h$GD@dn<2mY79L**Vf#eYDW+@;wJl6hr6BjQ1t9xC%H
zt_OZ1vLolk)z<5z^_7y|S%}VB;~A6&AdUyI`Q_yUXt#%bwi3~v4|UB^8V@yXgRmJ%
zxJ7!P+LF}#lIjtc4)l+34lF98u9Z^m>*4{)5J8=GAmTyh{NiY>nFh2Y`!6B<cBWSD
zJyCT~*LxS)MlGAEiHD4%yz=BH%ZUqt?!EwMt(WLSMSHb1X(!_n^&p|{7Lvx^;_}Oz
z27M<QLsWl%p?!~;m3=2kH#L-r2dK9N0P2?|j$7rWmzp2ybpXf(sP*o07QcrlGY?QF
zNjq6Ltvo>eb^uSs(N3m0&y%VH#EV!xK>3=qlRR8xMU?1JWvIwK*o-ycsC)h*c@I&d
z9>C|V1)3v}G7u9^QiNu*4Ah7AS&{!2DHExo^TIlHP^kwrCxG#iG};j^w7(A?pz>cJ
z_oh(xvaGZd`OuuD%8!sL_nP;&V9);+3v?z!{cGi=9`-wt?_;VAb=Sf#Z4Z?4eyeLg
zlv*$HU9^{#2hsTQxFWQZWxyA;ro5}g#rRiJ=@oaMC=30p$P%>AyqBay;czvK>4d&8
z)#yg@N8@Y->y`SxhP`6so3&HHx@*zoyr6~-fFI{2a_#5VtTU4pUBVQn2UcVeq8;s_
z)-0oV9Qi|&emOHh=AaWA>YrPaet1WqH8#mUy-M%|^3Eq@4r2@&Xh(IRy=(Beueu-}
z08lxXf_r6gq5Wp$Co)0Q2Uq&(&`>v`ZA%sP#QJ70NJBit1E4*6G(JN#$ifHW8;wO#
zIkYc40mhFt<%7nnvaK7*h7-{y(dUL0S&G^M8k2Md@Bl!*-ID;2FM>Y+@-r9#&>O%8
z=&j{9LX{7?hkU4<tTK^BZYgw(jcU><DbC{HhzB2lLI7FllO>NtpC3tdD4PzncLF#I
zKu3Ff0J^XCJ%zIL$x<HPkw_Qr0O&ngeJ&)wZkEY{Q&oA8{D23vM}^uK>O<t&t3rAG
zRYjY&UabVQ63|MZE(r*|hS0Z7=pw?8ICwEaqyRS~LSCo=5pvzY^QZ#ckgSPNmxrNr
zj8TB0d>B@W*+R&{R%2`;bjQLV<YK~*Cramu@)d~66^QC771oOj3<x~9Kv#%Yz!1_=
ziV5i|z`}9?8P3Dl;4Fpew+%-j2dF?H1|OTkPX%H;48sJXuoQ)C;dfpr<e|8&@H;R>
zKL^Fh5cnc4B7`5{7tnIRkqXI$D++li55$S8AtX>j2p5qqQ;7VuJODTVm3~@~(3rm`
z16H+{RsxMi0<gES0`?_WD9Vts<rT$CM>!$wq%V*BGElZW9Xu#nM|Ilemw~e76{VYw
za^h*1T?WdQr-KJY>yS=+-7-+Nyd=6sYq%aTuT%z*+ql#V=wAjv^^cKoU%Nk$jd!AM
zh359aJK+}rp)6}S;_{Tkynd=w0l-5=WT0x^5zVk>+8%f>QG$OY6WV2<4&F(f0sU*0
z<X;6ckfpt(DrEB{-((0jQ1xxI;_X1)GN6U`DjD#7X|Mrx$$(bgkqkudf-7{$0L}#{
zhy6$z`^0K(fp*?0Hh}gxlv*o?^K{6)SXIbCWxP{l@T;OWK=}1keU}brG!@BW127k=
zre6tT1C*!s_<*FFt`PPcS_A*`@B5%Vcyj;Ow@?MVlQL3=4EU?$vVl;_-nUA5SC0(9
z2GBlDj!ZH@yjS_~s8H`D?_{W2I{@C%J}`QpNe1NeP%pfzO$O-_`A58ipNGiDiEh24
z`I5qOCi?n9;v1IQ??dFbR^@|AJMSd@8X^Par%}}gkpFGfnHwtOT~lNLa|7g)nNP?7
zed{x)(&mxv(>cbGIJS||4kVT*WvOTgyraE(T!POp9Wtns_Bv!xXL&_=N99-%h5Fz-
z`-bYzS>s+A8OTh#1R2O&UQro<?$;9IddfLBHTYMwEyzuK4H?K?US1gh@2ipRBXFtS
z_Q`i2HI&B=6sBDy1BJ`WDg)rT`nPvztS7<GmSPVw$v{>b>MI}c?hjDw-4EX|QS~k9
zUMU#>-l?*zsj5mg@XkYHU-ABnXzWup&y&PIN>@k*1n)w*%e1CSw+sNkCxBG{(>lJP
zqRK=r8Blm9$6IQZ0pLe|hBB>%Q^x*Oe#PC(Bm*(LQ)QskcQvxu2;fJ4iO4sZ#49x<
z&fk>&KBUS*stly?PSSw<KCAgj%fgead7!-`-)FgfOC^j4seDuK#mWH2Rmjh}RzC}A
zB=2OnT~>bN$p^gK0WNg59EnHvP_}Q#B+3A-5u>$Y8F8b0UFG4euDnnmI&URMM*L#s
zBI7q`wPZl>4(Hg*i95Y6o@9Lv?^g@JeOFHWwPk?bhmyYurt(d_FNb$%xs2bl)x<eg
zRvsnggYVtUf$!@|^Db&L&daKOQ%~hn;(Z<GgVyAk8qa|?tFRwFeETHvOjl*(QP($g
zl<_ex#~GnizNz;L`A#9Z0goxl@F}URGg|+b;eCk4&ywnpBOUEew3cMw;?h~s#5Zrs
z`Z`FZopP3nSXn6W9i=pUyT$P-E={zz883%?rQwzQ46O-Q?SECt0Me9b?~?GLcSkRA
z{MJl^eAU-56?xaoScY;oijaR;CuW5xFt(5l-xWAJR;MPv)Hv`SsdBwjX+`V9)8UK^
zm?J9r{i-Cr*G%`N@=Lu3zUAA;qw=Bn{YzLYi$iCHs7dZG;X7XwD&OcHaL)vgcYLKN
z&1lYe6kr@HqKNoD67JDAsfyMoZ@IO#_>UsyvMYdw!vK!~=#&Lo8_5Dd{mM8POV&Cw
z0p7L9uS~dapn5r!01b9EWk8L?o-P{qbO%6Z<DqZqHUJ=Bhm!yo0WtyZQ2@m+03f}_
z0ibWLk&jRhfLiuO#YNsjKD3r1ejSN^nH(nZYElUNqwj~Mt|!5BdF@?%{wThOCh<<v
z0{jgIKxep%r<=a?th(NZBu(lLfp_FrqtfxGNWQhsOi(wk((nO|9ssETboR$oyLyA>
z_R?t3glE7%`d>LTK1m0V-``4lo2hnYgC_7RjRw?aSy99~oEyjj*@v>wR~kO;Gpz))
z63|LOD*>$pv=V5X5+IHhknmFxRuP6C3D^QQ3QKKEZE?5?%nHm<$TNWdnc=|y$mntn
z;Pe8s0tUwnLIXIsz!v9Wx^PAU8$t#gU=Rj>B|{vefWk2J_cD-)4S!LCqfDZZNQcbC
zF$Wc*a=54-oFl9k=LqrOTp?Z*B06v$P=)B?83^g*=?dxQGK73^D$k-I*aAERTY%rT
z)Rv%!C=T=qtApbifGyw$V{m{@4h9#5D1g7nf#T>w<P#yVgRU?rPJ}#R$QFgRTw&an
zBMjk02z1&5IvIih10)^}pa!ublz<30L5SdjXGDl_p*W&}2q6OzD)EEPiQoVrYAVl(
zfIICu5lAT7ODh4b1hf*+N<b?Ctpv0Z&`Lln0j&hI5|B><@EuAJe3Kp|Un%->*EfFp
zIB9q_31wgT9kSYOpuX`pJdM#uadp|N-v;U%KYfyHcr}Taz4~mRzVSCajnPN3blI!k
z2I?C>eUfZ=HOVG>)!9IO<8OExqmN?wWKX{h)Hi<mB-!w4QcU*r*+6~cZ+IG`k7DIy
zue=S^H-7pg+3;$jNA`-_Kz-wHcp9UZ;x1TP0O&x<S(NfVlYO0#Ufm-)(*o#~j`-T(
zJ4^I^E&5KTeu1X%K<dK=8mjI|ivZm#|9_^^efz23I!L-NVMX&jNt%=i)oB9_UH3@N
z@PCr%Obzrsq$J&_E4@M4Kx5E7+0NkGPt^abOV85qGzc4LOu8rf0O2@5u``9}w;PSN
zfySo$sy+byAG1dE0jPh_U>lHk9w9BiddB&rj_V3R?&$k@Y5lW0pEYtD&@9~(?}5l-
zmImp+5%&X{r+cz*0R5vgLe$yL>%!H@`T@<=J<$h56j_7*>HfaIE*;nPyph;|X6v5P
z2N37yYx@CdV>fx9H4NPoeSmO2h|X53t6i$~xpPQyiOZBC4P7UcW)BTV_f>sBF*<ik
zt@@RU51m~sJh!$4&f;xAHqh{NUu6UQ<5G2^F8e^bulnCAbWUXhv4MuGd*VGHoDbIT
z-az&LEUP-BRpV`-Ve6jK2W+ahJ^-CnK3(Gfmz22r7Sr?|K;H#Pdw(nPOm_bPQr4On
z!rl=2Ke1f3+W<P3cUD8yJ!vnE#RiD8dDS--M7o#!-&Gpk?n&K~VZ*lp76)fS`$y;N
zs>KExkM0|h4G7P;RJs0L<~H;`pVWEHuo3hFk;Mm9*$21;G*;b{w$QL`0M2B$1O2OH
zKIk0O*md7nY=FO(?mj@ue{waju^y@8y26Ir4~TrmX`2t$`u~}#|72>Ux+iU;0oy=i
z3Hpx+rN@F&{+G0o>%KAAfO7Le_#a70|IMtyx<}s_)!%nUnzTL$>w*gViV^?KF8+VH
zHCp$i{Ixb9lmxs3(El;X^&V*Gy4TtODFOI)Na!mj^L)@b7}j;g{of+&<!SC-j^uqj
zZ9f1u5LLWLmOj84{!>!I{|+}u-IJ~0zitDf`CyJz8>sESLGI%>Xx(dVKqvti3rhAC
zldO9U_T!P<=aV|G8PeMi$dA7!J?f4_`#)Q&4?w;<lKnR-`vA@I=Tltv^w@yn_|>g*
zDn8MCuxc!be0Si#q-FV!b<OeTQ(pGU*?{u+sX9^jJ+%K=q7RVnyCcaa>e;80KG`c~
z1N7lnx86y7#C$M<|3-@ch9upS>Gfm-^vhm88=xOQsS|aEEKWWX_H)u@?DI*T*9_Hc
z1FDm~Y&M`e{OZ&_!Ubc17#8aLXUP2Cuc>=7t|l8$z3ipifa>w9%LYLA(d77_SmUkQ
z$0c<tZ>VA$P@n9@+kpD;tJ(%Y_u-`O$xw<PpFDP;A{$V@?5o>=`thsE20-6SNS#*;
zL*YFjeveNc{iD1z+d%!vUT6dLho5d6fOhX+P3JZC0-Xb4k6-!s0IfDaw+#NP^?~lu
zns1pj{S#wB;WxW<*a2<*z<*U|bny*3_XMa~>#Nc3sWu_S$4e2Ls8<^x_@?QcQo3}Z
z?s`B5gJsn{X$LgS2dTDFFE&8vUTE{QokgQ=-6@NY6<Op4a*+FMAm?D(#sQ=qsMQ82
zx+i^|{&O|}y6+5fP}uL=WuDS&LZt4=P%SnfM)&_Y8-TGM`tC=$^I_3mFg^1@QvWDa
zsSQZc{eQ*=M7o#m-y>!G2QnmOg*z{#{XL*E8<0WwBwvm8UBHScL1zJGQ+24+J=z<X
zM*Dk!b{mjG_l?#DSkXl$Acria^i65|WIfKyRniC0W&;Z7o?-(fEM>>onowTo(^;&t
zv!JD%>w@&C3@9}oP(t^l4Wwv-{*<9X<j<QzwpUez&a0shpnoh#+KoasK!ff{8yKUE
z{OhwU^4|bCs8si)JvlE>$v8kE8*rXg=m~4pGOcHl^h*h|S!+uS>r;=4;)b!lO3(MG
zCNnf26#p#{sY7K$nfd|bd+fZVm@eH5`+z9ETK>OHQ9X+*2fE)<O+RABZgf9)UaYdQ
zAZa^NZ2;-sWqM%=+NYwKH>k73TAZ9UF%5KI%YTDrd5D)Unh)0feE_LTMMJSRK<FOU
zkDQkki>FO_`;XH^UDu?k-gGaLFL4fla$|m3?4p_tkh*u7U8E}A3+s*6?D-(H@gTLd
z^E%oRO}=7v*#Th#mAZ%d2Mc_ZRLuX?n(a+f;?V9j=KsEkZ-Z4gAEeqv39)AY{S7*I
zNX5Dr)*r>6peZ^h>0m|iM*#2AeRt|;vvkYOS@PL`RQ=I&4`<8LO}~`-ay4l_2z1Kq
zyCa1s`sIhd7o^WuOtPH-4i<cqtXAG4`H^JXtIv=XQS1SH(>vFtv7dl>xMaQ2F-C-U
zjPoir_50Q30x~bQt5@Ae@_T^p<@ViCb338q+aZZIgnSXz%}*u1DE{91(!a94JC!_C
zw`rBg617hy_khHfcMhsY-IH>Q;(Msu22j5P`pZ$L4wc14yRR6GEtRE-rt+EU)PF<N
zJt1fMz8%8Rnc_6*j;?xUtHTCFzB~6cjCYx3i27?~-vb)a=aYSZRR}(`CFZKM0g>;{
z)rP8jf^M`opy+%Mjq}yDzEh=FnQa^R+oUS}i~Kjz8?^34GDUkca`yqSr;NTo*Kqzz
z;M~NnblZSBe0S6>S2@m*BK8v1u%=I!Z6(sFf06HwX8d2LVtt}mxe~r&GOYa|e<Bs^
z<BO$<#x_8kuNcrI_gTy|@}W{Wxk&RB1Ap>*TGOM0=PWw*24J4Ip`qwfAv(o<JA}q~
zXibNH-yJ&iDtjGD`ig<>>&JJ8#y(yao2ce12LBP)fZp?U*+QYBzG5J^)w0O0QRG4M
z!FfgbXgts;_^IB0V&xqRf($gmcSjAnKznC#tZ4LqBT~+pt}f4pXCrd>iox7*9LQax
z{5Mo!2Wahb89Gyx+BP69T?M!_!Co#<`IK}Iyd(dO#;SYx#=LkF_$T$2%s=tJL(nIv
z-G@W<HX?(s7|6y4c#j8YuxtAi-61=^3Oq$h(|Ju>02>LV)S-I4sL$4N<e3k$qRPxc
zZs<H7^dBr}{*V5nTa()c@;|u@uoeK$4^wO(q%o~=gB)tw@2Z;iE>B$aU+wm+sFGpO
zP69y2n;=B%f>{7a{x$KbBAyR;kS(I`$xvGzi`KglZSwFUEiWswv<=jo1E31}>$6Uk
zemlg9{$v7vfN+*iu^ZUPD3IS&xJUg*Bmme7KMo)s(h_R}p-*^5<oO=LQ0RZ=LO7A=
zhfuxHCrQ&AozK9g(3wQ)vT60%L_PY7(WxJG)CK*ULT8eJ-KbBWir|Xo_fUuY8UqfI
z4JdpznTFbeT7AVDx*fnifIa9jTSIlJU|&-_y`k$xo%Eym1n3{eEgIgp%TAw0eLJL1
zT`GeM^gk1zv5X5<<}0R*j5WQiaDIs9Fb%#hK<hd7nl5imr4M9>zIjV;;C4W(ub8Il
zN|khp?BF<r4Rh}#itnjP`TSSvhBYJfJrr8+YH0rPneyxn{8#j;44*J(Yy<0-zF-US
z09gQ<-8U%dE2fOB{tIPM`(i~Efu9K<*2Rf6akO`#IRI<z{{=m0dDKckD*>$pv=Y!t
zKq~>Q1hf*+N<b?Ctpv0Z&`Lln0j&hI63|LOD*>$pv=Y!tKq~>Q1hf*+N<b?Ctpv0Z
z&`Lln0j&fYvjlK;T@_(Cj)1%bY#c{GUZu7;j)1%h%y1k5dGQQz907T8b#WX4d2tvx
zj)1%{495|Ot_lnbLqNs_7{*3GiQASEaUQ5!7l*uN1w?-M#h_jcGvE>Rp*Ymb!F0JO
z9fwjVA4DLDjI(hbN=Ebo77Vk+iDHN!s2S=O7PBSe2EuG?hyx}O0U~lyoFG8N4hJP5
z0tocPjgSBWJxB#TCkPOVi-+O_0YY&Sae@F_gpQ;P_@Klo`3VLo^;I$~!bdPjp$9QY
zr5D8sfr|J+3{v?;af&>Mnke!j7^29Nh*RW^BT=J5B7LAZRbPlfsy<PiKyM3-u#o^t
zh4D&z5D4>E+KWI~U!^?(Lx2x(Ab<<vKu?uDLYz(5Do>~Yhyy=W_6!08er+r59q0gp
z*p=-8Oa%xIt86d8pAZo)ytp7R(Jc{hARbnkTWCP+%G!hmXIqI)XlYf{0Q+zOr6OvD
z_E5zQh!d_VZiV&*1dv2<&~u`75!4X&3lab>fhdu^g9J!vgEY{ES{EBVC(H*3;6WY~
zC&&Q_a7A&V;Q#>~BsI7oA9)dRE*T@3AgqT>A-V@L0wIcv&=aXhsv`82aS?i9DR?eI
zUm52K?}Wc$gfUj7u&bdb7_52-ced5gqc{~kVz7GLfRu))7K7^K07JZL_3Mh1Lnbm%
zFM%!tVZab62V)E4m?&PEFN{Y#FeA%_2{Tl(2@FC8U|X0^s6iYqk(g}JJ-S3<v?U_&
zBjStD7)leV0nAQxaR|g!aV`-jG)UwSBB+WBE2OjwB0r^F@Q4JmdJ<z*TziKk@ZFeE
zLrsla8-uV+y*vkxg@y*V49rj;f=P?^&BQRvjb4KXj9c+A?{Vg$&&Ds)FUarZd3D=3
z<LR^h+WtpR-TZTlGrOPN+|&EP#v+{#ul4p^yFKHp2+xBv_aF81C_2ZTo&0srAsr9C
zy)!)V7n|7r-G?-bW^MB@KHvWv&d5kR!=eRCO3Jfx694l4-Eeb>j+?>W{5*G4^JX+$
zx0o}6vB5)3Lt8E{>i5SlH^1ZfdE5*i*fk<q=V9{Y+;fJTc4B`viOjk9(=GEiUqxlw
zt<ziA>c!Qs980HP<lC*AxyAQUXxpa~9nYs5CUwuh`JE-!Dl9&J($%kw`^}60yi0Se
z&!ANc%ZiQ9Y~kJ0_3y7^H#K-1W31<`^C6hOj@`i<%>KG*i-tX~c=(gO-UP2L9V7Er
zOtuW|7SVmv%Xxb?`<{zgy*1>DF=uYi`y21+o%)>HH!9v^>DLi)F@CO$G2KS#xqq|U
za@pVS>_>OPHyCjoE^?Ru`Tl&4eJAX|9|<j&FKJ??cWP#ESEgao()We%V9%d?ZfCc(
z+3&kOKL7Pa-tx$Ss}@GBJ)U;am@{l~f!)Rq8-}i0y~C!@z&Ve`r|w}F1}7T~oznZ!
z#=to|$L!|`UB1o^&6>ctIaWXQREKVEw<o<=ymjuBX-`UaV*8Sw$E>s&aPw&Y7JVK2
z<%B(%cFNE*x=q046z2UI1!uiD6^9n2&l!PDe|z0Wu=#S?jj~m@_OiJ{JY4KjPnFNq
zGuxgpFSu)u%MsD(UXyeaChcjNV$kia!+`ma7=Qcw;dspDhc;bLJ2eUAWaNWdoI<xu
z%EW_y>0>Pj{i<2$ybmj!%otF}%;|^3c7bzF4E?nC&6T102X7DCZObTs`^G1#qVqt!
zyhBlDzr_dUSPLrtJf64wRi9*o5Q}U1H(MF?U3b$b;^3C^nGBChjK^yRW)DjlA8i@o
z9wdk#=nxUo%xzwmJ%<g;@3y;b-u%)Vr{_Z_6%<AdJTUQoP<Mu>Q-Im{TPynw{J}7<
zMZr$Phr3S(wn#|iSb7*okJAlXV6?SlsORbtO(XM4kJ#Z;Egt;F{NmobPW>)rIzEpb
zt-sRpsjJ?J8IR7KZa$3TRQ&0Om_a(xf2{q3TllH}w4}V{{QYa5xUYNO_2%)<oD1eB
zowvaD`;?ZHSpIyjWXRV0HaFj&F3+65De^;e-lyNLzgV~>_vbill>1%1H<xDwn{?Or
zb~tFsEZt;ye{#0l<Fx&ABYhujvHJPRo0#Xl{Jv<yW|zh9@0WNeG9zH}4)YV|<Nw`f
ze(H6u?a7GIBU)CB>K|5Mm*yA|ckPqS7*D+w7Dj1Z&i3tnfBo4l=R0J7y+^>jf9Ax_
zN8i4h)p<uq=+^f;UQ9Er7*|y4bRnH#X7z~QuWVY-ZSMOn<KLEV>lpdVcE<29-10HM
zU*Y0oc%K#KmxoP@_2Moz-f!V{-ne3OZdUlg3Y&>jvjZPqIf=!lds=*#)UNs7OIz16
z+cMr=?dKMJyluYC{ELrIoB3rN$!iz0(<=H=%d)PEW_}iwWVJl{`vFtF@;rH|{BMV!
zNBHPXDlN=BmK{1P^vR*H=@y1rS0)Z<QgY9I^zASFE@hr7$c>$mQhq~lt}yNWtE;6s
zcE<xdc~oRM-ECgHe8PCgbG9i?f8FQD^(q<1yO;ewMDNkb{tF#qO{|KR8{g!d(b;FF
zH-fp*apBXz+mF`R#rBE`)|vm{=YHFV^DkwXVaLo~&ochBlDTqL`M*JZ*LuY{{Td&a
zJKzxWe7iw<KmCj+54APCv-Xhwu3t7!Iu|22w%+!qgB|aK@_yD&OD^ww^FxtY;o`I>
zUt9myY<m1%j^nt4=b-VN4%YE~G9q9e&n(%`#9<WQigoQhw_QTK<LmVIN!;Z23(`hd
z_tZ;0xAPHJaR0-+fqLtFZU)cH=$d%>jqZo7UR>ko9+{6rc1(F>RXRH=&Lv>_0QZ&A
ztK%zNceQDe)Oug`c<<0px_aM6r2cy`uVmtV@3*aZ(L<VqbvoraA!dDY`R`U|oVa&=
zZ*ThYRMY4a{FZBe_-@KSY_o&mtHzy#rc~0kaJui%ckU|>C*VE<lD_mPat%Loes042
z8S(k-%(2V$C%);pf7M!3ADwr%og6;x`TO}#I^E5E5}rYWAD+|t2QTjA(<$XU5=tzK
zmb=+^{{F_wZ}X3BTNKDW>AQ7q^qaRGc}-jWFR;w2V)9T<g|D+w*Wv9J9KI9G@SXF8
z!Hhx8QvUQUj<48j!YChq(bX_Ep{Ud)Z(`W22kfAvwuw#d&$#rvOG^2Ap3f9U&jn>8
z9n1N=d2v^ocicBaFJ@-Ufff~uZU;|l(_@C?%weN3ENR&n52jco4dPq9IGOiV8>gme
z`(9)^_8vB6@4K@eGaQ1~{td17ZO1X`XIfNz*zBGV?`qU_-1Fp|6T@=a_Ojd`d+yN6
zr%sta@^>;{HS<6C4mdoydQ#GE&*JI(F5UaoZwKb`ud#W^o&{zXy6tFD(dq8i|9xXL
zE|I^0o%Q~xMekpa6qe_1+<n7uSyJ1u=8W{C{r|an{|VnUqucpuO;>-??dgr}yc&1K
zbeWYyyx{fF0^LXLukCBmYyKw2zCH}>xqSlX^W@KMj312O+#&l{)~_Z13%TTf7mQ;<
zpU(Z-Jnehdc>9Il7O;O^m_BB62lnN(ZLJ@!-kG!&JHp>uk=?A<kIWs<pC$VRw7$vi
zm9Nu&%j)F|j(mT2e7xz9^@Veu2HGrTtaJZ+hx__}e?IhCldzaWX>UOglXfmhJ9Oi@
z;Z3JF^YVcCWh0MQ{N-x&V@wCV2Pys6TjXXLyzsU*%A3^8Ch_seW%JFRzfEexwfFxr
z_(Wc8@TlM^i3a-&(@*wa^UW^!;_$5TOYfm^PL4h7yn8q;<qU^+&Mq&M+->YENG|L*
za7C<nzvR3xuAd%X_MxSh#qKk4?N%M$l;B>zec*xLo0jb{`_pch{j6WF$KEQPZ^m<r
zJbcR0c+>n%7p!*AFPpJ#VBc}8bTOZf54T@A%=1ntF2s`c+dksQy?Q(R+L3{KqmSho
z2rLETmv1flchuIV+n@CIHZoy6E(uF(AJAPea#1e^_SRwBmhzzF@=lTLvXpPUJbXWe
z97q~_|MZESZpr;O4%syd!-9>lil6h@3w#P@&FsXudVOT<vjTWA=QhV~zO}bYJP&<K
zOTo^6?Co?{th}3$*UPWdIZw>PHHHIS4F0Jlmi2)dHnXqM>z2j^`(u8D*Yvo2XuD5G
z>R^|=61+@@ObRUAzSgT?)~Jq*yn7J|w@)Rm^2*`&UbN{RA6q|r;Jl;e$>r;r_@42P
zPaSu-b)@r>U;GU3tbcy^4>!R4%3E*qY3L^mQ)4-9fy)YXn{VgX74P2gqa&Efik%o{
z_hL=^V~KXU*}rx^@&hk(x)+A8z4P+>=t=H5VK#xyJ^uFY{D-4q$P>P!YpLru7Mt;9
zg{dtP@~<Z6^ayN@u}10ap8Vz8#c_!a5$wfFKlfUz`+)oBm6A{MY}w_E(JdK!qi;_f
zvBvmQzs%&+joz&UF}s2j`%fy3d$Ck+v(az6*S&QvZMiTnb=gs*!3AasBjBBNtDBp*
zM>c=Lh>vIT#?LAkz33N<F)J3mANB0<U-%w72hO#LPF^7kI{y;pUl13x+hR;NJkiJ0
zfq{iCv-$w_T<2xpAEA>LP&TqjcLsKOa<tp27N22*%kI6p8qLd`;H9%M<)cfp={lI(
z+|D12eM3H-wG`}}7{fuYc*CbzwuZe?)52Z`bmV;-GrDCY`|IHrhFwd;xy@k=41M^M
zyI0qR%q@Jms9=`ENF9bg`zD8poq90b!?!H!)z!7U%yC<pI;Nos?ToM>C!^V;A5Q)V
z2*$>Ea5Kz$bY@_mn+{1!?%&iexqP)r#fUCmb_G1!(MQAQ_p;owyLEig^A$P;eM&#K
za-WvOfC7hf{+tA_g8Os3y&4pkI3~ij^8}+F_NC!#I$@ag#-OwB*0gt7686+-4=>ZY
zW4OK^`zDXMxu@lRSEEx;a^3&nWxg1uW7?$R{kG5Ec{>I8O~}YPkmwK-qL&vGpT0RV
z?Dpw-I;JL}2^m%%zaKd=uzURbd)s&hH}*4Iw-!9#-<&fy(J40e-OnGg_weGEd<dQP
z=z7X`8D=cTuCYTbf>vfH?$3yCRrIWBcWk6-D94ER!?Cl*|Kx6oal}WOg|?n2Xw5z0
za@P3tnY_!qy(Z1MCNq{=ZMA*um}D*J@tqN`&DCXATSN5v9P9sm7Nl%2^4~b)jPdE@
zfAgmn<Uh;GdHXCYA@IY$p9DLx7M*W<|9SFk*{Rlo*8hHHTD&38ZuSRAU&Q*y;l;!_
zr&ws850{zuSXnUw>+^C!=VxQ%oNOc5S=;P+4<VaL*I_z~Uff8IADt0z)Zge-@37_W
zN8A=cuWQ9f`5h10_T{KHWo6canD&2eFkL<GH@`tyuQH7jIMDg#{j;Y1krN+3^e+uB
zaA3sdW*Yk&1tvdd>zsP^*T;%>(D2M1825<ep&cGs+GV&~3tYPvUN$TBGb&|;`C!9W
zmDz3FRN=U4t}7!7P^>=0T)mU+$my7xb?V-y&rJ_K{8+x*fX(yk$jbs!cc1|dW6}i&
z{|-hy+LgMd*)wupWipeZI-gICahf|yXQXk(4{yA<mp{5PEPLGFnE&%XZB7^u#_hJJ
z9~fy;@xwtc?mhH~_4;DluZ|~LjBClfb@^_`@J<F{mrmOA3IT=jO~+GTBnBp&v0GR1
z)i6BOq$2**R_5w>b_&DPbk)M46IblWJv!q_6HW#@?s~WL<{%30=76W0R@xpsV))CZ
z9f?e9LGE#HqbQfKPMEI2w+qKJj$T=O$140&(h3Xz0w<s47KU>`5&EMRl<joOkDTho
z$%yxx>}7WX2z$|EadxK1ZhJd!*@_(gozb_N;@8Lh#GGVWaV?1(d|?Q;&4?BiEp7$R
zedNmeTyM|e*Qpy${)CTMklu7>Ixnkxg3SY)%PS8|uwK%?bm-<de0|{Z5%Ib6doBOY
zw~NoGOp6e^G2=h5eK|Kg(;v58f}fsNw)9Vdan3tz?7nXowf*Y|b08S16?dS4*|Xla
zS4`w*_Dr2&?Z{X>W1LPq12)&#f4Ap{z_M25k2dwV6D`;@tD}FwgJE_>JcA#xSAAhL
z?ER>_Tl0`>_G3=|;+0^OVOC(yo8<k-VRa|dAJSasb^7Z9V{xaox+9G$-oF{>>J^o}
z-GGe^eihs7xCJXV#bWl@0^LK{OozqUPATnJpTf6$+<oP(GZNb8n*p=7oz9E>HhfL{
zL(FSGjW_DyT*~Ogac!FX?1;sZ!-7Sf!Y7XSJp6ZkHg^!m^~vg1?1L}whc)dp_GXTw
zM{ZbCGlOeGHh;$L-R{24)s+WKP-EP7A+L0Ye%i7AO*vki17;{`@Ph16{q;R8r&t&c
zYMWseWXk*FmtKCoEa!AS-;;sgwGv>C7`7w1+{DvwK)Qd&o6Mzv&)ENv-d?=3clNnh
z%#nfLX)C~*V~8&7P4eZVo?F(mAE8r`)C^KRp7!$dx%8L4x&61$b-6LRX1}_+=CyA4
z8AvjYgQOMBf^L4_?@aVw<Js9Z!<+qXIt1%(a^@1emrRdfMaJ(wwia*~4r&(p_f)_X
zd&*qkF~||Smr}kci&Nnq(Pn4=4cj@Bk1*LcZyI~}B+Uyp`EA{`v&M`=%=wGDl!ohf
z;vC3cefM2&qaP;?Fk~6s=S_r)`!P5BKC(H)n={79?(2lzhTIF`XHHoQJT5qJF0=^H
zYbEg5?W==1hWCZO#Us*z;}7OHr6bQWHqv(X7(M^ruE&~w)6u{5#xaY|@o#{KJvu8=
z+xmUI@0Gso5r^AjnEoBdw6Kk^o$aZYU}^KvW>DVZG`n@~EqruZlv)TpbS*rBK<0P!
z1{Aqo_;zcgmwzjFJ+}D@9qXcJ8%K{X^WN<_e)s$4;e*;dw5jN_<vn9$xle!V=X(;G
zbG~1YHh;|cYu!8e82>ZopA855dCd)e+v?u8%V+(S)^p|Eh{??P*OKEIseA35a?@X$
zR4m%IaNdVims)k6(=+gC;Fck#L#zca-~VP|=)!0-|Keoq9*m2I<aT7}hkab_sWYGx
z=XWPTH<!oW>oWY>-iz@FGU8qaTNoVXG-kZDU};bvBj!oN*Uuh@?D~E40X*Z<!~9l|
zx^N0>pD_nGvK)JNYQeoL7l+yXNW_ov@Ld^!k;Aupu&g)%J>N`?KW{Dg`}8;?<`%+O
zbf#uM53-5OX?4Ut+|B|6o%$E_yBuxL3(?^v`!zKQo%LXpj<1u>qNh#<`spp_cQaWv
znbG6->*K#N2@Sk|fO+mP*3{;Yg?rxL;rHHkkykSI@pev%m4`h{JzGZRe7khKj&CPU
zr<9Kq*Jb3V_Ko2zUyHfrgf-O<8}o1PHU&p?HXEk261cKTH*B!`Vsb!_i9<W`y!E&X
z(icP0$YuFU%hPndeRO=iF&H0)X9Uhavoz&Rx620)G0%BnsEac?lYIH9rGEO+!cY7!
zdK#^W!B(W<C_dziyxCJN3fePZ3FPUMzt0*%+PUR#=S;K+3T?JIJM?R7!KL+&jvVaL
zB=W|1Y<^)+sQu9E)KC8#Yt(x(BPcsiCo*S3t1tdFNwo;-%h-JOf98Unn`5AfwVF4!
zVAjBqI<S<o=R0_BIUDs(H}ni3I?PrAPFa)43p)9xj+o1<XP-~Gn_>GebnW}hV<Qr7
z@XQuK_dD*#CIkFCln(kIyE)eF;!N}VCKY4gP2w^9cr#{qW|(2&ES-e0cUm#K>!s(T
z``dRQT|YgONcV<xgY-lq-MbmnoteG~-4EN=is`PG9*FM$+6L+R>7$ACZq1qQ2I)>j
zx|LCcc|^`y=<LUI8xdi*hqpWgkrU@Oz<g@KSvPoT9JqVV&ahAE<ez}Fy8%At@S>Z%
z3+}&hZp9pF9C{=E^?kpBIVG8;C*}pW*~ONy{P*!0&ba=>+O-{TUKuP<VqQZ=4L&l^
GKjQz)PQdQ~

diff --git a/client/ui/assets/netbird-systemtray-needs-login-macos.png b/client/ui/assets/netbird-systemtray-needs-login-macos.png
new file mode 100644
index 0000000000000000000000000000000000000000..580fe647c29bce036a816fd20f7ce0a6ac0824cb
GIT binary patch
literal 3555
zcmcIndo+}5-ySyGmMt0KtuQFZaXyw|COH*3)^<oHLXLwpnvopJE{BPULI_1DW*jGC
zjKenAPB}%)<f$BE3=KIBdLQq%*0;XzkMECft@nM_y4QXGuKT*K-|v2&-?N_eBsthw
z2_HIs2m*l!UpQ~>1cC5`9E{)iKt!nA=wOodKJR1;f!tAqK;r&{Kz2YV?i&OWp#^~~
zdO{#Z&ma)Vu;-1A#^46;bsH;l2&63Kqz)JfhMjl21^S2`3?4|%^M8P#0QQ2dg}@>|
zpU5HMT7p{u1oC^$1#{EOcm{j&bHwyJ@h%P`YQtp7vq7BXWJ-}%7XQbkdo*#^H?1T0
zDB{Y}-(K;a5kLQ?)sDX>p8cq6tUw6bN`th(jD74=EgsWDWmgXsf+hSXuQbguMBGKA
z1z$zlt~~9>7~-V7yudasI05Aj(@tOXQPkbGowMWJ17O97Q=iDsdO!PU=q`|OGmqZx
zj@*%SC}=SL`-xOuJ+PzqQX_)Cqip4Nr9kyV(G$c(j+HZWqmMbbFw>mAy+h__U3z%@
zgXB`t650OvZn^fj)tR2Y9eNv;sTv>sG-Ev}K6EWPL<Us{?98-P+R60&V$`HgwukNJ
zbOXjO+L-`*zF5nJ6|vziG^TU}8BwDnGCv-9;`GbPo$#6B^)V%m5=**OP<Mi1<^Afd
z6bZ+(-v@6QzO575UT|W~wZz|sHS$|5BhjEfed|?<KUIZimEQ|>qox*ka7t#ja*X=@
zepu8{Z$;X`TFknW(#xaY%ru#nh3waSt^<9Og!7t{L0kg1^5?b9pAJ6?&}(V~EBl*n
z`Lk~O@PSn|0nsyC$9|pAuUXudZQ-6NN5a^H7c^<u;a<&Q+WyBXHr8c-%Iz>n+$Kt)
za~~vF7OJn77Wi|s8(L7(0VRn(cEs?<vAso7Gt~~nm)ZP#0^6f^B!OC?&EDzen5dMu
z_6PgjMaIo&U}n(pyCXNZvZfB;56TNJbC;kz$@o)EQiMk8Cu-O-T?Kj*inq`Hj)|H$
ze;zraQO50xDJw?8N6QR>P`PW}@(VOmw%@A^?!!}ou)eH1+tb8N@mS$!e%8^0mQ5p;
zyA{K;6}U04)zS?2H!GqmmIY7Hx96;&OjmxqlRF35^MvGs+#!9~$d@2_&s=i(Y8*i>
zR!$oIA#EL^Fc7E-M5nJg+3z9xIR<6r{+W${(|d3ItNB`?*BnQ3zt3hio-)A2+)(CG
zr9fAxNqO0x($9^yWXwH!FF{#8-Z4H3#QF=h)~MDk;9T9Uwf^04ySEP_d;*<tO%e6Z
zhz1xoWOwpvIQ&?E7t*KQz4COkEZ9pigU{#Hft=|Mk^9>(W^=m$NfVb}{`$J`NsS!u
zREk);M+j|9AKy#(_~*A<(+a>-h``#$uXkzu9ggctXh~EoH?e*Wf78-~GnPSj_Cr$>
zjSV+AC48ryY&mG<RKJ+7>(%RGEc^he-Ld70#Nh?&>s$hJ+yb5N+L;UWghtS*E>hj=
zTFWQr&8Rqoe$F|sAeqS^cJ7oi#YSjK!#;S5MoBeCG*xbZ31mJn2?X3W&LGB3N9A)l
zEq>~^o!9Ci@>7@g3!3NfqHQa8+O!o~ZQR*;`6sO7j^R@_uU4;^Irq}()S2tLduX})
zUHDREo{~h|o7qE8A+-yW>IrP|D3c}`X|WZZa@smK-oM#7N>e<_czMqfwgNTG1aHl6
zYfEOYMbM?=pGUu;@62X*?=^RleR#&oRe>uGOF>r!!-AXE(2+r@l0}h;xP0iBhGwJL
z><J$PU=RbVJ+#5%_e-W-+$4sT8*6SOmlw$icddh`^J@9<jV8(iHu+Id>$nGQom7{l
z&zLFX+aSAPN&f9~**xV+k!s@H%;}S*4T~gfce!HDv_-f?In4&J-XG6@s_V~4@OI$U
zt5uO%elcEtRH5|}rj(Q$ECkc6QKo?n2JPLnx5Ig7FaIJP<2HPG0>7DT(&L_R?e%->
zGA5><BVQEG;_uCZpz3I=1bRRST!qKTK@n&?(a0qYEf>33hU{_$6wWGH)1v~KV4+^D
zj4VZF+TNs_h$^t<Dqi0sgAsKcyVx0h<$~Z~Miclvu8V|cKoZdMkFu%yU4;9q9q#qm
zfO%Dh_gqMbf^^Rx4_U%onOok5*ku{uq)v~hb}#hHyPS@yhTKRd`2&kT!PptFqF6la
zn|uoKusN}UupmYT>Z@FrK;Z;fU)y~brZ6tN7xm*i`#}Qyu_|CX<dO>YY$U|LQ>YSR
z-HW$O9t9fzxEa+oB$1YAqZp!4u8jm}g;_t=vp>{hcW~8|J^7;QUN4Mw+(NlHL;t=F
zi^uGdHm6R7XHJD4&>U(lSY^~+Fe`f0-98$g4fo8s|6&gRwXe$ewS+?J^IP)<-JHMj
z<T!_u+3(AeHr8`{ve#w3UXSCmS~B{gJD3Wm(Wk}hrRrRQwS5Jv=>4B=&v5?Ij&5pE
zsmojy^7UOjI*)pDH78XleX##+u}xgDb=Z8_<Zg}6NxcKlS8$$8l160;*XqW{nAjJ=
zf>ptkIdf`67U8;3hlG;}KNU+sqMsdM|C&d{bwgiRP{z!u(eqQ2aCB}7pT8LSET#0z
zhyGC~PNSZ}*>e8~^Qhxv@w}T3Hz^iqWRDy}tZGj#+?11C)1sE$E<Ke0a1(5&3<$Ys
zRE+&*tC<m1vK1sF^r)=qlWe964-|8B3~pw48&G6u4XW(l2o`+o-%h?+pKg94Bn8e>
zLfA<8^ekV1wV&43d4WO<*L#!|@$+xbKC;iEKeMB^G1f<W*ICDkf|>H2MAf{DkYulN
zYL;PcziaZ$J-R)CciSXhbhaz<&_IvvoqY0Ap%pr$A*Ko1^^ZkR*18T1bV+=!I*iC^
z&_IWA`3U>&zYIE1jetBO@?W+DINucuM0690YbCmaceg}f4wl-Dcy}v=$HCI^W9%-&
zj50z8{f^?cCjfMz2@=fMPT$5yC2za~%Mj5mMGbQ#*k2FaOORbmZ%P7K|4+4;8sJ_s
zX%;q7x2M3#@9bb%j-?WReQ@{g*3HHS#B60zM}K~RA0~$I?mD?6*MB-MbIO*&X{+*!
z3VNDiIFz3#kZrXaA;eK+hz<2R=3f@kiQz<^3C4iHlj`*8S0Gzyn!8fi#rI?FPTQ4(
za3=aZlL$&56SV^ofO*t8yXa$Hm3L(K8a_s)g80+XZd0ZOox2w9+H&9<zMt(xO(b8`
z1={X>51W|#>&rsS^peH<*(&6;G%4Y5mIpx?<c%_}Nz=KB<VjmakoYC6pByObJw@C7
zu_yu31P*`v2CFw~O1kaqEc(kG$?D0v1F`VO4x}@34w1yNuMANDb>lCpQ)FDHK!Naa
zGhS$|l(U`j?z;`V0LwJ~eaztZRCl%qt|@-~vFUuw_aj~OT111a&Ci|Qo=$|T$T4gM
zs#gDxCaxuDknsDJ@-#D(x1f|Ker)hs=JP;M7iSup<@0wJd80xJ%=Yd@md2q=iMT2m
z4f?o})XuZnsx`67O_>!>6W7F>1^6wHxFLNIsa%}j{zOv~3)MC!NnY)R9V4<`+a%J4
zRC{wbzt2{oV>7;z&umBVUCk=wd!_>bMYc`wngNM>a-0e|2Av9RKrJN-w$%p~g7~0s
zUj4M$pn_4w?vNs|JSmxY_EX@>(H`?$JT-I0c~}RS1!>am;)K>qH9-qOJ(jt6gg*TE
zJ#2k))>EPZ=XSug)4bc$7%|KgJGH|lV6Bs>!Jsq6_jHSg>%cSI3<lFnHy9Gm=Hr=G
zpxCht{1jl)VML<8Sg53Pr)Z)ZJ36lb3~mXnL8QbgV4LEYDNJxEa#vrSC=ZBN$9@Q9
zfyG&ptm8(K4LAmzvy=hK<88y)v}}yvAdX@YzF%To<1We;8j_F$Mr&vpBss>J_fU?;
zb$d#srTd?Fmv5Q=<%R0!n&94Uyd-soJe{fvFO(L=h)#J3Q=y*Z17XJa5%xEKf}ZqB
z0U0No_MmUZb8w}0*Tk{Ku*R;@?^*`aop8z{pDK}tdLkpJ>Zcpj5`f*vf4|lc%}vJ!
zG2FQQSDKBG$1iJ6E*&ddg4x=LRXSjP`ZKoh56ZY!Bb^=a%b!s>2FB=@N&7<-FV3O<
zAH<T5F1X$(Dn~-Ha`5U;{~RRxW%vG&o=4NU+P$KHkJI8g%P?D^&LQws{eMsYrk?`T
zzCf#YQk)t!z5;Yqz*@LseY~)~M&9AR-~`dp(lJoi(pT5gyR3D_Nb9tbz7AYV%ScP>
zGwZd?{}NzAeFAPo{@;R%x+8_4K>5EjU;{9|x3FHAu>Yyi);H4DGSb%luOx@V*OCv;
OdBMWYyyBea{eJ@L!Le-s

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-systemtray-needs-login-mono-dark.png b/client/ui/assets/netbird-systemtray-needs-login-mono-dark.png
new file mode 100644
index 0000000000000000000000000000000000000000..6bcdacd447ee52d82d3a511abd5435b9a81297bc
GIT binary patch
literal 1571
zcmV+;2Hg3HP)<h;3K|Lk000e1NJLTq001xm001xu1^@s6R|5Hm000H*Nkl<Zc%1E-
zdx+IV6vw~!-qqEuO?zslnHZ@_L`hLbWYk|m53DEykwOT}q!KC-p_0rpdQcPz5hY45
zj3DTRQb;BeqA8J75>lCl;3IO|$Nluj%-P?$v%h=y-s{>D?7%R;`}@tD^ZlMVbLPz4
z0-*nMDGoM(6D>mo2D=OqXt0#r^9)HVC4D35kfbh2ow2P}J7W7~uN2_Fs>Rq|3493r
zL*u0kbOKkI+?L3rkW^oMoXz`&q;fx&FUCI0Bt5BY=6h=BO-r|=7D;bN+S&_f0QZ3w
zWn{ci1OJMo``!0aDxgL&LmiVeP11oVr*{U<meek3lBDsH#>ID|B(+Hz76%-cbVSmh
zlJ-g38|!Zh7D`J=!OBlX@Ewv`)%e;gM_Erx+8=R;S&zQ-SQGwe<u716@G>wPXa@>W
zZcFt2JAfZ!|Lz9m_e9_S2^bmWnfzV?1>p5K;5g7#XD#O_+y=CgEn2H*0Pi$G!usAG
z<&?bKG(wnyt_Bp830CTezn731WjZi6(XpZd64vLdJn$)jA}|d2qzMu>&ASP1Q;4$m
z0KWn^Mm?>uU0$b-?kM|;{s<U}0?-C*X^@0jYPOTN$bByZi{twdv3<TD9VYXwYT#1>
zewt4QzDor42mVth<4oXS1l~okB7|Te!t4mxR7Hom<xyY)!LaF?$|c~Ljt743hlDBW
z0xlto4lg9*j0nIzWNYMn;4qmBrbby#7R_>Z_-fm}k(dJf5rvr*eKAF^I#5#y3px)}
zIewc+X3>WdSvKw$;1rUuSuX+4`f}h%4hggVAz+LH^icxH_bmf+35&TD$Fve+y!Ekh
zcT>an>mlGt%p&X$WoK1Ww8Ztlp$2#l%5QW67RK+E;BAS0YJ#tafLC&hvyi#N9zs+p
zMrGR*0v`N4Di^R3DFCAhi{94BOzN<Hy#&0{c~OCFTDQ7B3v$5Q^ZXp}>3XwFU`@T?
z8zJD8+jMV=zl*>q;CCv0-N4^V<xJXac>)FCHsG_U$KDm(^9d91ARY&<b?;X>>wEAE
z67oKlr*VCxlb;7Tmqeok@)S=3{*IRSQRKb^yn&ku+?l*fffn4@#ZG4*63q~>X>W<`
z$7CCofnS(_H<!7T5OyKUF0D_&Rm;uZjeXZT<5iGomVo(Y3$P(7u@JZ@v94KfI@zXZ
zN!py8z6R1V<KwY?JCDSP5b!hcc~p|RjVYT#NEr;g?I&Gik!-jlyFT{qOxkshq=2Tc
zRgg3y9v91!=1AHh={k1=EW~~Vg=6S$H`czDB)uo;W`!#iB(0S+SK<0(SbS$Vcc}8b
z-S7;UkDdyAOBRWWz*)cn;C(kcenGYo4knOoSUv9dO~7l3#eGD3!0Bpw4VbS!5rrNE
zE_UC?5mMmw2?<l$4s1?Hq{q@8_ujxiNTq8wMZo-dBH<u!!uJ6exPBK!3)(@%M-~C6
zksX*kSf6(IZx1KNYnp(C!gbDqM&f(m90zhne7`0EZ!$&$TN9wZ*lzx4E%1#HFvVAs
zO|4D6xxzNW+VB}Hz_LV!we5s8<1<_@&vGI=M-K>rucPqvgl0-NlI1cYq}S7^bS3-t
zB9+HYE9Of3f$JH788C%+RRN!p_#j#>RqDaN6#IJc-Bhj#fMaBluBkO({@VuZrSC#Z
zi>28s;`rh8wS3-fMBd`H_9$>oH4^n&e`yrfN#?U@wVBxoOeTw3K6iO82fU42O}4Pp
zec}jV{aG}ui-2{!koxcPcLC=n<BNn-+cP=f?RjPFJC<-cmPg_c!JR6uSZZCb+jc)j
z(&V_cSG&WvwBQFxhm~EaTYH(L?aKZSC@Q<}UnOa&q~S507$<3?q^Yh?XZ*fd(kz#*
zoRoiP(wyC_Wyeu}N3@zs-}ZM>dtx7({awI$=?v5hs8naIcJwoa^PNjP>%jYQMq+|<
zr=5f}rH_G5#tc-emd88-yy?K^kv0;OfiDO*c>aBF9mv0!2Bi%BPdwOVh`?Z%e*sEd
VpKP%8!^Qvr002ovPDHLkV1iNR^nw5Y

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-systemtray-needs-login-mono.png b/client/ui/assets/netbird-systemtray-needs-login-mono.png
new file mode 100644
index 0000000000000000000000000000000000000000..164d65a4f20c892e9c852a5e2f978dfa1e7e7881
GIT binary patch
literal 1449
zcmV;a1y=frP)<h;3K|Lk000e1NJLTq001xm001xu1^@s6R|5Hm000GWNkl<Zc%1E-
zYp7IJ6vuxvb02BmvZuG3W@4lj5hX<#K~bNCN_x-(L<%7=i%KdZghDdQ=s{7`m#8p`
zq6mauB#C7qVVDtJdJs}s#)Y)#+I`IQVXZ%B&Aw;m&di<q5VK&j&z!yXTK~1z+H0?~
z2RhWD4t1yrDuw4oz<S^lU<eomM!c`p4toFLe}*_v(ff0NH-W!_N|UXO8F_9hyx<B-
zKv&XAq2-MgQ(<+$-wTWfKx6*9+yMAd@1JQvUrQu|3N^q#<p9PVc(W@%4*U)r7i7}q
z{V_lvFb|jw4EVdlf$2cE3mFFX1HS=#fbYHi<e*Y2x#9<ao3R+~r7^EXD!Z%)fxV8q
z92wR$xgxRs3G4)(1eW+h$O~N#_G;i8vao4JzC!F<V4BNIy-Wdk)+Y>8KNG~37rQ&i
zU*#i#S6VPayjQuL5;-JgQlJgfOne^n->bu-oCfqKI@UE|gm|{r125r4EY{y{!3eqe
zODt>(E^83@5xB(l^m@OxK^@9cXHRB;j3{86c6*aXXr-0}d8@*B8MxKoAL9L^ljxAl
z7a9Q{jQ}_T_#zQB8TfaCjH7^k4t$g>_pfoDZtu6$(4nwA0L&pfry3$zIve<I5+kH&
z6gZtMJ3N-mlOYx02InaNCt$ffJ<K$3t@A3~H%u~O0q_f1oYz|Yrvs>k*oMvnRrayD
zWGi}mB1`jr01l-_+H8bm^;y{Al^UVd9|C3tKyNY8YvL^f*I}DkWk@fU<He(S*Soxi
zVt+CtF2v4<GTEw1(dxi|aUJjxR6OVaR{FRKyzS02CGe>cmy@lK!eJ20Dk=nbGBNfA
zewoYB29_ZOU?#TdwNDoNcv}pJN|(6;9a>8R&x#!IdS0FbUL=sJ1fEOYw~eG+?%v|R
zi&)Y3Gu5#!@HaYNSKyD}RKZ>eyz6@Ou0Vc;+cF8neZU3b{RXNtjli$)aTy<Td79U!
z1^Ib^+h#<ncpmT<w(>EH+~nf|FK~;2Ym#><P=W2nPVizFYYXY?tORT(JE#PHWdI<4
zfHSbPTOq41#Zw4Pwb`rA`;zmtd?uu%*z5w{pgIMva-JCTV3ny3MHOjR<nRilD&t}A
zUu>rl5+EbqBR_1UYynm>#C;;KEp^@=GGkwM-jSr=6pWlQsj4gjGl0)su?&mh&<}h>
zb@i!iH3D4b^9oqFM9?uQ+)0y#T}lEq1Ne+A6BU7@fnR~wa*O~g)3@drq2HHcHx9MH
z-x74SOp4X}UFbgG)G$7PmB6Vdq_hv%mKc$KmX0$K{B1rz?;vcL6wh<94|xgS1DqK6
zPR3SHA0jc701hMjV2WU4*%8O?@Oe#_)F~+yZX#Pj8SxcxYyi24tSpG&C1WP=X#zC$
zLK(Qb-Qdq7bFEyjP}qU(jab1}u-mvOLwz5%XJUmL<*6ppcXV3}_?Y}JG%5Xntd;>Q
zuTSykSla+RPW9(zT7K^ZE^^)}c|Z!UtpPqY;&p7*Ql%066HE-BF{<}O1^9z3)3s!T
z;&(cBg_v%%w5iNq=kt4*xbk_o5qX<e{Q=<oR*jI-d&u&0xki&`b^-IrvQ|9yAISl)
zc^k<#c6v_i$MzpIaSn*_BpScV-;LcK$N5F<)P5)jyq?!PZ$EZ9mS@Be7EV<salN9b
z;1g$ID>_<-zk+$|YpmueVqQ^yCib~G9srDCA+Z7Ta1Z9;0W29T3_K$~z75N6klaqU
zlWP4xpwH2GN3_w$6x;DmYLMzGcQ<f6E!0BVfQ__T9+JZ4WFhfz03YYch&g28v<veL
z)Q_5fl~l*v1w8N1wTzY#^MUuV8@%|wLmleS|AqbmcYv>X<lkGh00000NkvXXu0mjf
D8PBLr

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-systemtray-needs-login.png b/client/ui/assets/netbird-systemtray-needs-login.png
new file mode 100644
index 0000000000000000000000000000000000000000..722342989aeee5ef415db850382f16f5aab10fc0
GIT binary patch
literal 5260
zcmbtYc{o&U*grFlWkgLA*)#QyokUqmnX#0um&w|K5s3&PuY@tED9J=9%4j8GY@x)=
zRFtI9VsA!jOtzWA7|r54zQ4c!zH?pYI?wXEuX{Q7bN}w^xr}#rQj}Mh2LM3P#o5sl
z0ASD%2FS@kAOE<@lh6lo#`#D*0Ib`z_QHUY+p24jcuyyLp!S32FK7aW+5Kw=0QGt6
zM8~B8KxwOsqn-CT*xdNXc+J6BSzg%@ypm2Kd^q-Te&sd+yHu}b4DMYOXR)NBDq4rp
z_Sx)!M;bZhr@<y@^hFCFgMpT@Iw#7@r>+gI$1yM0yCA{DG6I%m_o_2E@!PD3L*xpt
z<H2<4Y)16*;$rEqt#HVQ|Mx?>auv9-N0b+QKV|>L?(l!~{*o1<hWySRSEw0P;qPGt
z?;dx81IpGz6>pkuO)bW2a4v2&ME<Dm{>rI{1kvPSgRhjIXA^FGq74NxcTr~p%M$(A
zKNg1KYjk_Ux$i0_5hx&gB7>OQ9PdE0ZnC2+yiu?lH81JQj{ei;4D6_kx631O{e1^|
zjVQT#^QmxE`b2d7snSGRU9uobvuFA3yqNj-w8(4K&l~77QV}>>30lkYrs`#<{Z4X@
zE^(cKzMMh0w#<Zj8YNfT7kdc=?%1=|#f=E6?cpSM&3Pq_pV`r)beii9YvJCpl$lQj
zT?8L@z$Cf;Sjy?lG^_)!hn`C_7{9e_0BI<xXt}b@^jBa~T+tReMh|iLgCJ;rO0HZw
zn(DEzY`&xXRw(UAB@m>O@+9U!G?nIpcDKA&v!CJwCv~}du%AuUzLbg;tw?gVWa^@K
zz0{%28Dnw0o)eVP%%mP-BN;#sEqu%wwf?5Uoo{HzI&4BlOs-2TqxR3e@3TzzcT-RE
z;lOYvnxd?K&Ie`E(8%0kaRjyqDB>|<nEQEd#h=72#C?)V$t&1q9B(H7=VCSaP4!-o
zrSdbUM{kgv=X#V<g!T8ZRphvihURD9ZhKg9V7J!6xzSRmvuFBmc|Eq{%^V6F=8g^a
z(LZFYC`YxjdQXjS39Fq_OXb+6q55X{dI8!eMvU@2%(uJTelbiNrA&V0N0~Qp;|E&L
z9xPDZ)YWKuB{^JRaGa2nGLY8_(qY7u%a(!ebAhjAma{oins4iKW7r9PZ6=$(TM17L
zg*ITXDdaM54;&7OvmP@MpuTCrmCyCPDNNJm9xC@m;Vj-Jo!%+?bhq00i}YBJu<qlh
z(?&xSFT<vmj5gKHCQ96-+F$r6+4hNZRnJ%+4ha!j8tnWl)==A*GC4SDrZ~GeCUF8I
zhP2*0#SpZa6*Aio0%6Gs4y6^LHdYyZ3e#k&(kzA6(%YToS4*?)cpSN1FnH!XRktFf
zqxO(P7$S)M!Km~?koIj4xn_GofVMKcg!q>?o@%d=Mokq@n2gR&=xH4x*aoK871~8}
ztfKs6J+P+D@f{5tKC{dS&5O*t$|v-NXU+B8@|WjqXvu98zbRRRBzwhT@rN{xJsPam
zyld_5wraa-6!3p%KAnZazx<oa+uQQwfvhw9-S09+-<F!;6ZjA=sg`DMWGw96)3%wV
zH5z2TJL=ZE$Mxl8lgSlu%fgi{`<NzMc=h6!S=47<sdm?&UX38kHokurN_P-un1#!9
zUi^5__!pa#A8_=Ew{*DZSL1X8^BLEQo9PUX-7}+nm7}YdF-1_y>l1tm{Sr!xXL9d(
z45_@)<9EiEqFsL`4!@d>3Ez3_mALh3c*t<f*Oy-Dl)23|e3+Hoz2Iv*4QWjuPoE+H
z+>sV-4f}1#+RiS*mzU}2+fmjtNXO2UG?ZvwOdCqn9=^bfa%U^cIJzjCvyC{yuSrP5
z^mDE4t3SS1>|4Das|=IN?;n~MuU_7RkHo0@!T-yOEylI~nd#h3Yx=@C8(f`ED_19P
z(|Fo4YgNrZNKdTI!`8d7tiXt8<+ioIal)H_jvX@)A+n?$A|VZqeRzB+*gU6gbSH8B
zs~w?i{=6MwVfFzwsKWuJ3g+F{NEpprS0<mb>tQ7O1X()#&xPqZ@szcVG0vi|r7d7y
zeB^%EVz+y}r0Z>f73mgC-Z)Zp5m!*Br)47SjW|mnE&tagyYksm*W3!+bYUm6rDf`X
zMPFWRk@$nyrU~xvw4IXF)%#+7#+Ug$e<(u{tN?GRs7PVT>VDtnJNpXn{Kh2jKUN9;
zFw{<Ls@U$~E8mBnrB~7lxV{}0s`(`Ur^RAldKUPz*cub=HtaA-ttw2GibK^^AJjfx
zMAEGNy_|}*J9TY#-Ey^pOOQ`W#p9<$?wh`mUOO|q<K{uZ%sK9=x@{6CPwfNRA7&-_
zJ0@&PD>(XJ>#@@#7?QzGsfhStD#BRVvhPy^^U2qk4Idl~l7hA}g5FOaUw)awNoNP$
zyc_&z38bGpYLHLg(F#s^oy%gEWail<CGCG>B3w#Q(Wf?sWfuS^5sOr67eR|n8oLcU
z9K6f__SwI)LFLXg|KahlNve$18PJ7guc@7CC8;_;902Vs`%iKslMwXD{*V=+j$J1%
zmsS<%xzjLxeyL+tMXr#ZlzN9t<As%P**9*&pLJsugEi{shfTpEIS<5;urbife1j6h
z`!4@h%%btL<Cl3LbEp91wChe{f+&(Ku;xq;(doezH#mY~Hnen;ip<o!(SGy!jLZ(7
zO6mL}u|3b{3R|Cn>3g-dhXJ<e|B0Kf)xe<+r@s!RjR@kt#|*TQ-rhW)7&YHhPD@o#
zI_2&)8FPKMVSHUGetnbC^er-!=;gHk-lM`l=$nYcp1ED7xrHR*UqZoTq%AnZCj>*c
z2ET+bDilifu4~KxI7{)!(>w0?AP|$j<Kewf+Vin@xYuHmaRuQzE;z#UpmJ43o*5yt
zE(%zvu--&^0MW|5^&LBW!s~6{q$o0$q=MTn93E<58pqP2+~NGJ>DiOnRk25}hI3<<
zuNItU*L_@)T0iL$=WumJek<Q9RghF4W&YfW^}1npDwd@k_RvO)pWm&0bJ~-qbFUwJ
zpl+A`nc<kCA%fW>`S$Hap;&h2YJ2<d3rvA{&=9s|$NBQK<S5Tg!-8tmoe(o0&IKDL
zHb0aW!4u~7y1`S5?z6ovKKs4QU#b__oXRn6*x`obu1Ff$(lje8#9rSQ;~5%hK8DvC
zJl)~*;4L}zw44lP>A!F`**nm}dJzhH#E7whE^JUBj0dNLgL1?eOGIn3MnnmwE0=bP
zmbiT6VwJ6tUiuB0E6&;rK2FZOWU5ZOr=J74Sln=@zGUIB_k5tIs>$Y84TJ&~^?XCX
z=~kVWS1tc+Pz;TH>2%rPFu(L++{3~O`A%CmdP?bkyv9aXdY|JfRWpN-4*SY|U$(K+
zw?z+g$)6+s5$vOYoYg24GNqpUV?nHPs1y)+-&LieKfjnAJjqM8MciC1T=8#<^t%Do
zV$akD9li9S?f-n;%dXC0E&HRacOBcMyyDON(z+aW==O0`Pq-Q6nCEcA;N$I?G}p2C
zn!4Y9%AHS(>lKt@dx&z9ix2h<qTZxj%%1)p_s!<UKO-#~Pu<^z2k>Wh3aTBw;cEMu
zlG76ItX5S%GUa`<o55{N4DkrPBu~`6i>m7(PE&nzqcy9$9^0!!$)P6tMs~r?K$)jM
zW!CoCUcR>T<fG44Y&UyeawY~g0lDjFLk{T0UDtaM!8J7yv<DUdd1e~@z6!}{o0qiI
z#x(f{qjk!o-d4P3EuVLRUzf(_NQ#V`-IATALtmG4rMRpoQa@pk$9avI`EE>X5h>|W
z*!$v3tmQorSO)7h`RFvp6mi3~E8vtok@^LLjO8_+Kmj&d`f<fFk3xq%LU_qFnDn=q
zl>G_1K>-fym11*g)Sr4lFN5$!aFqdOP;`7?=l0@HRQ3m}ccpZqL{ARskewlYn*f`#
z0lm}>N)zq0#V*1@23J}q{Q`uCei81vZ2@U<_p+G`&Cdvd*(@^d-h%s5a3@&&M}00a
z)kn=r;>w7Z1h1D=txJX@AVZtsyuT%en3bzE?+i+B4Tw@C7NtnD5|UDP=dI+I0G{%a
zs>Z2O_eU#_R7DDi@_RWLbkeZt7uK?1<xx+wq4O?*8j60kxkA2>$=+tO`dAiw+qpw_
zM|JOGd(UDqQpDN{d*A=nd+S2(3-~(51|MfY<#0k3xvlNv#>*M3tRv3Ax+ms7&PN9c
z!8~j^MV!ynKZI)5Mg(2f^}6_AeB3F5SA1jc_pvK3xOe=2V4sl?c;u#OH-o!cb`(W!
z5<3GHU$peMo%-MKd%C~}AYnAU0TXoXhp`Zfz9}Drjupmk!%KN2=Ga)q6ZZ;#|H7!m
z&Qi?;)p6#d#}>2f*cNB^PxJ4?!&!G`COuBdUU61ic(_k+<a8nF$DEUNUB*;fXUv?o
z-^1HnZ3muTCm!L<Bzglz)+GZLR`?5f!i}P-Cx5<&jTpfcNAu)^_M65iclNLT5IX3R
zRH1wi(J2oV9)dmL__$adSPim)7l$M3WwD=p5#b|53`u#f_{C6jn*UFh_BO-=q^PV2
zQywL}4)~I%&Q8vn?t>0}2D6|H+!c*Q;T*EsI&<R-GEeiS(!%zv)<FNI>@%i30m7@F
zx&O+1q-^=wY{Okq=6pWx9fRxQ1}|yRMwF+=<whHqXmIlBOpOSQj8$3Bd=h`|jd>8d
zWm&ub{+_(3g+M?~vU16P+tuTct)QXP;^_0d-fvF}>B4G1xSS+M(FgIm0g5;5-0;Ww
zk2z%O1coebO+w*#rh|#7>{E~h@E6UqDt{8N5k(+Uw6s(R29HAim9V!9rNeK4v#*#<
zt1h1M^BM_vzy~t4#4*-0yG?bM$X!hHz1!dSDm>}7jWd789D3fc%-n?fPUD1)^7Y!B
z>=XJ`Z)_2HnGZ^GC3Q~ec-UuFk@)C$!}P=%?6=J@jZc4mX1<zB`-a{s`O@BZ@cyap
z)bKV`wuL~=kfc-g&G5>L2dNQ9I3};~hzpVTQQ5oycO%X#ZP=6}?1&-w7SCX}6yjQa
zjM9fPDO+L2tXlpI>%WOW2`nEsSfZP*ltGz5vfu$@hAG=eeJMmW%Y#Z;QWN&;WjztZ
zOY$tZZbhEW24Ybb;lNc_wEws(`XMW<5@3fzJ%!~l*g@I>oxZ303vm&Qk9g=jup0<b
z#dyTx#64GZCo9Yu*g3W$IVpK6x#NK1be={zLzb_Ho!q;6@7(8}`c-&JPW_+i_ZD(9
zFDG!;wwf%gmm={Ji2ohjA{go#(?S6*!1MLc%9*N`P#W;B%oQ}^_1!#H7zcLys3kj6
z4q7SKD<=@vwD;k9h_LtRHQ<)}C}%s$+EU%d%fv$`XC@j!Jc9Enk=OWR6JRPF4jRTx
zlqe|Kq549ySz+CJq(>ngmq-|7#a*b{+yQ*G7A(MG@S6iFyOYfLm>&g?o1|*?cZj8*
z6xiRD+OMjf*`S~$G9H#E6^ol>u<=s+;RkZeyy0=qa>Sw&(&*G-YV&|(wXg=fmeC<!
zNT)vlv2G3UGhw1m^ahIIYdk{1$rCaLg&Pd%IG<Po+Sj5_IK#ySP+fcM05p0%(XQ<$
zdL!tOJMb4K&XjATGS{l+3)Q7vkk5)I5j(u$;|1y><6H9R5-7zgLC5QwYqKD-8Nq>9
zh-2-{aV<|BfTRw=_Kup=jwsIkkkR(EP}6^jM>IJ&K-JceWPE@0#?9G=`f4eeLORd{
zVsmU^jxDn)be(j{g#ar$87%pvBr=``>ABc{{e%g3yS?ugm^M}G^06*)#ib|O9<aim
zT-gJ2)`Y_44&Pe5an#{acdT!8dy7>W89CsTm>k6{c@f!f2`f0lUxz1BuCGM@_PWN3
zanfkf<vKJelN2RC)YE#5HS{xBF?mI<=yxDXJ<ZV%@!^?10xcM=*ottx1$f4YOm^D%
z$T65&zg*DI!SdMmgUCNLi|BH>3|ex20nYnh+~vgOjlD8y{IsTopX)Pd8&DdVhkSs;
z{B?8&)}FWQ60C##SDFN+kgWi_pSQuzb8U{lHt>9?!VFwxVSM0+FhC%`@!>(cI@Jt<
zf`JSA3JBrVk)rR;&hY6?K#@2C$IG!ei^7kCj!>%$(&Qa1WPJR9?yD;i@(gMhzK}E`
z&-zt!@2%U2-pvgRswZ=81#NYh--gT})N~lZ3K8g^W(2pbf-f^W5tTL|eMPbkEx14M
zW`guwp8jJab39C0P7>s0b;5hTyx-Ok=A#Vh-A-a{@V)cRNZcV6;0v!Z1fa$wowdQz
z=J~O|Z+~w$f>|KwcepX(r7T%USfzK)!vaz10$4NCWHPWr4W<7*xCwe=NGfg8&=muO
zNZ<|?97Q3S;Ohpa0+?2(+cM+&&`iGrPQOW&hvtu#r`;Z+kO8ouVJe)V{Ulc-p(_yK
zm>ju-<15eLcHRb|yNtuG(5Pf><a`Ah-30G-?6Yp7D!ur`F&Erg>|(`cPRS?(U_q<i
z>>fdNFvJExxT7a>QB4$RJemgrxh`@UTQitB$D!gHq~jpNATzk9m=NmlFwzdaRj{vj
z4OPS0DTk4!RjiRfxkW0N4z(?7WC1i)^`Oa`qO#^W=>Fwv!bVU%gZXKVGy5)EX5zef
z$wwi!1onJ7fDBh4dc1-N7FXemfcHYYv8IIMUx3brlyt8tX_rG}+=O`O`I>m?9y=t|
z!=NB)0nR_wmkVA`^cYza=dz{kAopF?JW+MDkn@BXcxg`dj2(}%9XW90FJJ2azLLYW
Z(%>Cos#cWtK%X^)%YJvqTKk}k{{iS8*lPd)

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-systemtray-update-connected-dark.ico b/client/ui/assets/netbird-systemtray-update-connected-dark.ico
deleted file mode 100644
index b11bb54927fe232adf7924216fbbce9569d5156d..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 104704
zcmeGl2V7If`;xFkDyS&#;HtP2v}#?UXscE0tQ&!<=--9ZIuMlv6s@aTZPlt3N2^w<
zI9f+ViA5ZBAhw8`6sp*Q0<waP_y4|^JPaY5gqi&KxcA+=yKmmz_ujjAj}R8IA`T7&
zQfKl%3qocPLY$pt_+iMu4S77C9B)g=;s%7cxyf)BcS2h9Aw(pS<2Eev(F$k)e%RiY
z`h@s~u!sxb&=lmz@*yDv+Ks9s0~*)k-^P@VHX8u+s8U=M>jIoXP}c@;Wlmp!7zGI9
zt;(@gs7t{yg32~{E3*mIjRK(L&<h!W^2?ceSeH3g#Rt@L1t_HJi*g>hdSy0)^2j^3
zfhi-020n7W=LO|Zt~0VISI^8x0L_XOA>&7}jpd5x@EB-2^JirhLOransSTPZ#rmKF
zE2w{pzaX2b%cOyd<y0L*T{hJHiIzPW_@7ox{{--Xu0*I<izo!;`n+IT_q*u2a{crD
zX&&OCE_j^m2Xzw=7#vfcC>Leks90BioWY-$<pSkx0G7*By1rr_lnqo-7kywPwlA+s
zL3$k^MGkn3dCQ?(8-U>evjG+Y_yUXuu#?wE`l0gjScd`3)2TmDF%HPbY=AsD%%);=
zs){TW|DbMvgyIY%98fW!qcwzxIfVSpB18ghruzXv?~w=~za79#7;hjSPSZev2T;iX
z6rsl%XUKP>&*2gLz*`I*XJidjjsGwnw19D>MMZFnv;m$Vls69ww3#tkZyx0Rem(TF
zP>rxE2dA>)p9<QB^RP1Ke?Xg=FI1(_6W;zb&^Cw%`IsB4h6i0})Ak3x82Xs%WecF~
zW*~i}jXucuVOe-MswWRLZN@TX<pF3r1LP|6K+j=bnX2qis?QsNhY&^j`~a9gy^81H
z5<D<+E2m}Q0chI+JfnG72DH74X)`f|p*)nZl`_wYIMDXstpM7em7;AZ4?5FEK7f83
zh`sU@VlRfSVycfGO8JSRyo$#_y9q!74|V@G_EUMRSkD;8Fb+8a?RWrs4CK$HV^@{5
zkvC(|WZD3l4gj|p+H@*}__MVCAwSUoCE_25hc*F3%3%}Jt}ZFaZ42}iuNjKx02MLx
zGoal>xm`J3CMJwjKCcc3x)`gUqvcgK2bGM$(I@Ha8Rhm2p%3x81<+MD=DyXzl44(+
zu1uG~^`$SL^Y*EgTS*t-i{CM{Fa>&D0Bo5&b@Zt_7PeTHDTk>%=J-}u+E6YUz=~-D
z+G_!T*ATbx81o@T-z#B%JO_Yfux#-d0Bx<&gEo%E#r_8Epgh<nLkrt>2Pi>bo`>g{
za##ob++Ppc=mTzy+;TZl?~3hW`}qKA01PcW#ykec6zg<>_7J85;I-ZffExf$0R9C?
z0Z0P)6W|QMCIFryeK`+|UKQKdbX;sF<+cpPK^C;b0RT;O@!SFG?pr@Kl%A@3^6N=I
zprNd5q>FiehFo8&qNOPh=%D{8`UD=s9jfyC0X@bijBaaPr2rmmO=W9cd8q8=DEgNN
z|I+~^LMcluka9#^sWq`LuqM_;oYkBnRt$?Gl!ziiF(nfGO^LV=Y;dU}fCAD?ASHbT
z>14S;LJ9<8*3E8W)~c2wxNkwM5kxGC5_6z^dy0~BDXKs~QAI*Z{=<t%98kOg@IER1
zYg04sQ^<rh|JOwWa1AvO?xzgYrEFy@1H69(kc|K`d{o)^)5MRQ_e@Bc`v{p;MF!w`
zAnII!cSZ)ZgVB5mVj_G#;b#D-<pFqRe1_p!IW?Lu0pHC4(g2FDF?2YNh37yGRr!vb
zcSWC3=AFTf=1ah@K5?`r-qraG!?SW~6kmetFTC!2WCXpd@^|E!9)DEy1^S#Z`ZVx9
zQVaiu;4_`n_)Hz(?O!$gp)a9b5Y+iqnSDuq4SZgU4Ep*G>b<z1%Vkh&qq2@mz&l>g
z<&{AOci@rX57ScD4Vb4;Mpb_((;Nr9Z`Hy-#S6}f<xkI4H~yfXpf45cUD@aG9DqrD
z33#su@KTcu@_Tu)a4%V<3}2;oEPg(#%sYe2WngTj$_{GfXWCGg0`K_TRporZ_bqWB
zQmqW?+E&a58BF3!^6|9PGaSBO3Er7|sb!TxlP~=XeOjw66?MWKgZ@7Pkga<FTd27A
z$?%V<F=SBoCBzN(A(R974@W=Ze^GqTQjurn<Fd-2=u0ZcE=ISyroej}{-W$$g=ap>
zJS*d6l|k#+r7Q1P4)`C&pP!Wv{-MmLCcI2C=rVTcA_MS_{+~;)+nK5t|0r9aE;LM4
z2Kep`kO4rCq2NQB^sVY#kg0gn)-H^l7(<ktzwo(-Z0(dPURC8)i2i}^4gkrF-W5~6
z4$ttwZ{h%Y08CKU6WmXn4iKsY)0N8^iUY6sy!&rOo|TXJb5zb>jQ-Pr?+)td%lTHm
zKOU;CygvEhGmU^(?bk2rpCRHHHCz)-Q}GXc<8xMA<ES#;QO@UouF?it{oNG&gWl@^
ze^-@x)QICc$hYeV(RadKr)01-=^oD+n}2xTX#;#-(8#MAoABR01C8q@Uk6#9{LACZ
zQ-<)))N%b^RvPeLVjUH&=Q|c`curbsA)>DOr|wwVP<O1<+LO037oRg9V)!sHEre?@
zmHid?TnrEc&_>ZFy6}&6<aHM-)@6?2Suw7M{mww175lf!{tC1|0$`rs;d8U%YgstP
zv0v@@iDdzp=Wf_Wab4t}w=xTP$7iUDd>C>Z4);+?*%#=c?il(EpUB5z@Ci1gD*2b6
zLz^*jGj*{o+J?MfdOfhZHNE=C5C^<FF!p3pDi(ZJ<}(a!<@6AoKMJ6nk9l}bIiJDN
z4{@CF1t`9jDuWGrFgz=!RIC;1SCtMKJ}@m*!KbP`rjE>Zu@>kzJ>)WkLW<AmF+R%&
z&_(wsH^!n^&sULe<zwJa(T5p63`tA$9c4Pal~R<cAwVYpHvnAQ?Ex?qz#Cu^z%YPb
z04>00td!eOhl32v7-9(DSf|w3rH+=V@}WQ20Uw(DTAgfA$C6$nZz|q&ZCAb?LR+6;
z<iIufi(!34sc}tLdZsD|d<_Or9#<K@F~xI(O-0`r?SfCV0v=-l6#2$u$g^x^3>v0x
zLq(rB1nWC0g|F)>JLntdiG?)$X;JBXT~|5G<;)r=PYuYH3*oy>_>-jqSz5%Er3Ln~
zRB8=r5#gkBWT^xeFA<7Zi{T&q*^7t}QW2LB0jBmMF&t82>q`=QNF|)4bXd1UNm#j3
zSi?l66RH4Su!2-r1Oii1BA^g2fW=QM>C~RON~hLT8hzfH<}aPdQi(hj6YC%f&Wi|_
zPJue6(54X60(mNhB8aCGR&o%$%OxS4q#$S?s$U8MdLmd*g)e)F2rx_kxJ)W0z%Q@~
z6rmAVaD_!61y1R-h?X0*2kk>b)4?=Kj?;W&h6)@nQr!SV0LAOHAfqO{PX;2Je`XC-
zI}O0IJ%4yM>0j*x(?KAV9e{pjUek1-D0@xQfhyT+iVif%UY<IT-^0awKE{ClyfwL6
zucLI4y<Bx5Ul##7(B=M}x-z()ZmPE7P9NFJO9$}$q!q|s>fK&F^kFjD%TEV-y?3VQ
z116WfJahm)@b=wi-TOhg$zDD>$nmT|pI;0zA}FsNEQOmYMv~73*LBo^uC~`jrsC&|
z6|Mu>GY(y!O&LQ6#j-PVM<vj~0Udn+$HB7bpp@*DK?m?m9`_l@G_elU%3e8ikQ1PX
z{1h)Rrx5m}&?Ww%$2mquZD~dI1@HlUPMx5W4g!nU@D#$@RINJDCbRPSiqir899S{d
zDSa#|mYrGmR^4<Esn!Qjb|01N&#H|MKz3YzT6#WwyMG^JcjdGqb)a=@RqkV&aFBm{
z2_L}qxBpXV_sXCHqsoqYfolU?lPP;A5oCw`f0X6agqNou7+rS8FF<}=vqWiG^Q%q|
z<)H(U$xiz~aHbW!Ym@@(Q`O0+E#H(nFsbaaK9IA9zf|w{29$MT5*;u;YN{0c9`^vH
z=YCiH`o6OKh!>iQPgArDa+iGf4r9Hyd(NqnPivkj_%ubEAUm%8D>e7SJ4{+-)HF_*
zf>&d=33DE<fmFSw6JsCs`|oMe4ZUZvv3WIidm#5<0FCc08}JU*Ggx2m3Vso-j$c@Z
z<pvO_2He!uGiE->-5)@wd*Nzge^vI+1-W}6pWQsO)UKVC%dNa7kik{1kvFpJxOYbJ
zdvb7G`g%_xkKTV%w|HQ>E__y`{LtTV?Q_ZZ>=a~Grwbk8!R@-pj%6xJevsW6<iow?
zG}>F`dG+s*VLyn5cbU}syRu#?LVl15_ghI&DVvV^Q1cEN?uFS%Sw>BGdCL#aD{*gx
zxU$Gj*Twm;<U7H|<DDjXmCu!@{P4b8={;3-w6`jK@fVl4HqdFjt0?*5-6!1ZQsthm
zs$|nO&vhmp7wSCTRfPO7*5Q3!+&@$Qu})i^71<icJ6s<RJ{|_pMp<^m4e@_?Hxb{j
z38U_6f6s&$LcjAy?*U-~`Ef5+wc{QA4TZPwjNu-rLzH!(ulykU5U7J~VT^QC)B7s&
zXPcoWkQ@C7<3&2YQ<jOrfxiGbpG-W5@0tbRdpXPxaEyJK^U7&){D*SVbxXg)7QnQn
zoC1F(?_p~5W&O@;9PfZvw3E7b>y9$M3uUy*5AR1}A5!)1A?gchl=3T(eI<bL`@5`7
zjpH5ggZ-27QDvJlc$~bPM)~D^9m_KHRHaC(czgl5^?Qz|pPr)Oy<?5>9q@wVohm++
z^N{Zg8p`51ZF*$d3`741*=GQhx_@CLU%+-<mHU}8j=l|itMgZeUt^}l{R!ebyq3ki
z_>KZR0WhX6@ZQKdUP!jqcfREB9^&|?ZVWJn{Mfd?#yMbRF2+6hJPY^6!#yH50^nMQ
zUjc9*bKG|#UI7rtIOznyE&zPz8rKMQ2hb{aDPNF{gSz^#K03iROO1QV^eY1neByYh
zZ4A>#_Be>EipRUkAfq-Oj5sC~_jPSFE8F=pjtN@(dS#PW9Y5G_0rVLYs!U&3C$n<C
z9%Dk4>+8z0s>5{{6RK=qS0}S_zM3(i+Vpj0dDY<xV?wp->*{1y&ZozODmJex%V5UM
z8Zc|XtbvNs0KI*Hx_`;?6H)RsNS?}fb$|^DDA*r?Qvh2mP_W^F6t-A^)E+i6fKSs9
zE^KUosQ@-Qz}*dmun~eRZ3GR#z6|2N&;aaqAPIy93ZS0sBQ@4}u*m~_tOhEHaZd)Q
zB!OcQR7!_q*bah{LMp~eSO%yT(S(31O&E|+Bn&6vM^lFs7^QI{OJO4i8i$P>IP|A(
z2&s)}Iw4$4C9vTGreb+2f(;)K2SeefaiBU2Q>>1u6w-`z`%O^YIz8RqT0)4u#Lo^>
zuGqnbBZg)~PzQic2{eZ|qyh=DfXzZ3WD(lpVhU{wFa?@IIu(J~_!G+{p(G$F{-ks@
zs34$Gh0pcKa1H-)p9tWC=A?L^2w=;+PXsE({4;C7tO2tI%o;Fjz^nnY2Fw~TYrw1l
zvj&W-0eE-U5B6*DGj6Nq)~bRA(Dne#zGh}0s0v0i5|4_uH~WB*lv+iaQDu9x4^$E3
zm61(Nwm17g8I@bftLtKWvkz2qBO1t_KDIaefPqS`q}2?uz1asUsWJ6rt1PxR`+%Ox
zu4KiHVSBR=R5GLL$c`~>U!8ma-m}E_Yw<mq$_9&JZ}L*#@zl}WC5oBC_SMP<%Kkl5
zW527J%L~ad$~WOmY5VHp1Modb+*1SJi8i(!4Qa1R*}nStKsJv5hS<xPb*iN8tAh{7
z<A9_J^nogE`)c6>D|04Pko~KL?W>6o;QRB&9MiS6Rjq7a)qMc=TjG_Y{i~(ztG*AI
zbnhW%JgC;TugX5a3(jf;V}L&2Q(<hXYg(CY?+dm=DD@pDL-VTQdP1;2y??$5=7LIX
zd*;SrP4@x$^&sx8q-&qnwVW~SZ_Iw`%h;YtYrGGv%*K7UbhWEK<tm#Gl(N0q2V@!m
z`=6@jKA_h2W*?xxC4|?5rg}C|(c^$t+narW-j{QeiN*k&Gb+jlbhdp>_W`&kgx?cO
zu0}qfx9!b7K<~|~PmHH;+433(47Pnu_5q%VvVi`N`|Ij!SAEKx+6T&P`x@;7D|6gT
zY=88XT>k7VW3ByBygy(x+t+L#$PP2554if$-z3R}Z}u6}2aIm}n(71aoo)Q~lu51!
z`F<t7Q)o0FU~FZow5HuB1pBWs_86e%n_OleFqPAmp<Vg20i#_H@)wl&7MJq(7|lLV
z23wh`D$E0uj4=l2_+3)7517i3WoQ@dU#9CpzCZMP-M`Ij_JK0k$`n=0vQ~`#HoNY&
zXXXU6517J`WoQ$|0Q?@4KKFPi18rZ^eZXYbuw^hmk*^ig`FfDQ48A?<oypkJ(6pwF
z1C`SDjNkB9WiQZW4B)RQ_1$4Z?T__piVsw3+oKQ2uLlz}`T%}+d|H|Ny|TYlcOR(q
zwl5w7G_4ggjqMp<sIERxWo-Y}2XfAr8UsYo@28izugloYm}zzMfhuQvdLEFyJM=ad
z3<BHFFuCm+KdLT1P$g}zFa~U=$ADn4{mgQ+eRc7HDs6ju48V7Xf^$+_XO+9{tGW+V
zdE3+W7o}Oi^PEVyK4a`r5ouMM3#x_f<uSlk=>L?fPlfe=#^0)p4={6QRZro0KnN56
z)Ax8Qb__s2F#A9`IThGGh_OABy3VffF@W}ga#BH!B?I<e$k@C@8VK`%{?GWB@!M!=
zjWtX;2oC+;yM)b^o(1yfYh2r7G#hJ*H_Jf{HIf9_9^Vhn*JOV>7Mxn4*8=#NVDrz&
z8UULQ26%g~PpRK4`h<>ayi7J07+Lfh-yGO>psu!O{GcMQ2Wz~+jHm$K%B;R%Q@!^F
z;xDVXIKYVF*XX9e_AX$1gV%k#&MCL+!F<JdutporNWw#`hwuHAZGTvN7F<5pgVVct
zW=^H=|G+&cBdMUqHY2ya=Jh=q;y)$^z?A>FY3G4%UYT1NLv{Dc>IFWK#Nhg*RICMM
z2<StjDwO2~=i**~j}&cKrel0IFwJE1Kx8lPlHZKz=9$&Z5Iq}Wd#qy!t;$-57m{TM
zw*IqB_Es@2@Ryim3`laFl3|doRq4N`+h4Y(Guvc)K^u8(NG^``s_bZJUQM>Yd_C_O
zWA}T-_V~+T3@~0SINeY?tE*R2?azbt8(=4s+Me+P{=Bls0gCaSI$Ii&Ut{gR(zN?~
zFt(>tydEsuyFjJlJwt4*s!mO`KV0X1UBW&pVmD)-=YL^vENIktPuT}*n*G7{rPgm4
z+tw=E!|Or)-w!Z)yjPR$UtzYFk1zB-0Q#*JGkUyNQ|%9Z(obc-EQhgQk*=<5#Y`3N
z)kOP4zptq8eU;iTfPObv`}Ls7;=P(?f8MH`VbK3HuiYu<F@P`I`%m3E5R=AxHOc;9
zcb(VnD2~x4KgRb3Rj(B@dAwIs?9U6%#ywnhTDN6#d#e~<_zP8D51KsQs|of8dv*uV
zd+knn`+?$GvGR)ds=NKmx^|~LeSjZOJO-3oyjPv=4{<)O-7(7gjq>sX*ST3`j`yfL
z789sDmLAHs)derl`+vwIzyw|R(zi@iv_1G(E?l3K>3J@7*P=VvFjsEJO;n77g+96~
z5BpOwHa6g+>*cg^sk@fl_2E%lS^3(X`10zrMx;}wc#n#)Yy>(@P_p59%-5zf=Dbo}
zo!5df^|hsP9?vV$NzjK!O*G_dcWxNbCZ+D#n5gaI^?RD+Q+JMvAr_!hWxX=?OVG8C
zDcOaouQgT2mtsDQ^*A;qsG$LVYGb2VUf*N+`i)2v*~gTA5XoCpa{ZpZvV%@HsnIKA
zyIfsj0xfMYZIw#3@k`J3Z|9{__2qQeYimc{`SMu1V<Nvwf_DYWw0=*nTXi~B&es?d
z7~B3zbG<SzrEvq|R{7c;Q+=<~l>Oe=@m^_ts$S2nHYPBp{ngC%+IZAE9)y0W_g>5<
z>dX52iYekfZTe--tBeVZWq&PmJ;Q^#ROfgQuJbll5?ktPdsD`H>h!9dUn(XrhW&M%
z>y>#?#<j+SVEc+$yQAX%y`DZ;9`T;CJ~iRRF+o}EulHQ9dTvtWQ*As5`d+T5&h_n|
zrYc|F@t&eSH67D2fuZ&{aIV+HkL;X^co6JfDc0^7;D2R~_wf3MinW{oc4F@FY1g6l
ze#W$sV6gqwU)M8j8<L`oCGHQyp8KDI-YeDm4L$szO!1!LwJ+Y!0o|0vUWVACJnNK-
zPeISPexs_|J|BG7X!e(n19-nz-95kZw3V@God^Feb<Y}}jf?~PhXPc^d;3g0v9+xC
z`bvxg@O%e+K-;}PW824c?cIgvLOR?B=B>(i0Dr*!c<>u6c>RyxWUI96dw@4we{vOI
z4U7XWiZ(RHF~kIuzz<9j6PV7{CF2s{-LPlYjQ-@`YH!0^l{*Bk4SnHTjhi6F`+|SU
z_0RM{Q>JM^3w;s47aa&N8tmN(d1LrARa%8(f>Lw6DRjgOd1D9b0AVkm?7rY5!@)LF
z;TXq{l>p!?IlBO0e#s6m4YWPs99?ETq=7L0%!YIlJq}^JFeaITZ++T?K2+6W0+n;U
zJ~Erjmec^Q`KS^xfsS*1N$Jd(t{SMsF+rK<dR=u;)5}%Dn4nzd`kHQcMfodHOkket
z6%A94#}ytEnCJR(w6=Ou6%Z4c=X&+#sE{+|7!#Q1`U<hIcB17F6PV|E?PjRZ5+;iY
z%yWH(+EriTMvMu}bG^RGuO#J-5EGc^`buI;L)j=pOkket4OMz2tEYENV4mwMnFWo*
zjt((_d9F8(sw-_P8e#(TTwiIeW?aTp#02KK-nc5R^sN=g1m?NE(%Z_+pjiWE4VX1x
z)__?9W(}A%VAg<H17;1FHDK0&Sp#Mbm^EP5fLQ}(4VX1h6*WMW+pkDil2n19BrfHa
z#MA9d;u7nUxR_HC7qLp>u&0aSuZR$#B3?j<KoOS`!liKunvqMT6Cz^(4zQ?%5E%nB
zE~LbS$QXc%NJ>PAi~+>qNR|sN0wE{~<mC+Dku{wwV*qh`if%>50N^xvh5^87@(cqa
zY)DL4A~^$coC8_30Ag8rYl&O~kYaoGz_<_#0FLyyKvIA><Rd=<V3aGzkzXM&Mr#1d
zp*$!OtpQ|}qJmIlS_3Gckcy&^C#;VG38-Y65QB5^fMEd6GYtzcA8@*1h5?aWwG0Dd
zngO~XT@G-WZRHF|02g9IVi`k-3lNvc+C__T5eFs6l41tvY!pb&fB?_SECvUl1O}I>
zRz?;DlpTQ*;78*^JOU-akH!Ufl#KsmIF~-8|6%(wPGosVUlB)s6>*6YE>^-tN;skl
z^=Wn#aGJaVPLo%_Y4Rk763Ju+E#fb&7#AZ7=a};%#K99798uJ#94{uX2A8n|>XDz9
zu_GwPW$XxxaS7c%Xii>Utb~gYN7m)%>C@<_GF-+Enp=jy)rJgzs|^`0BhRI1ePq&3
z4J`_&m0150`W*g*6bo??v`XV(bHpK^MhW0T5lhyoAcqA$#uc%obf*KHLrICfh?P#b
zGIp%NRjoxV39)C`kr0lEB_`G~cI?q8A{M9_QuuM@Y!Da(@Fyt7MKmtN^7ylsB|_|r
z__LQKT%b??xDr_+^I4RO#z9+jie3)~Lew5+$UOv589`LD{6`azji7W6O@Pasm31;%
zFO}udb`ick|8_u?=ZR@2ds{$4JK0+t2r7`H2?*YvrF)@J5eGp^plGiWKM6XC!cTcZ
zl5!PJ!lCknR`P5m#nz4-KIk3WCbnSAcRn6Ga5UHy?MiH{An{mmcm^T$Cw@HegHQb*
zzI^h;*CT$Zm1N1w#t*j~?cMs&;5$8Ro_id=@Najwuh<!NeyDx8d++}yw)xd9NW5+E
z*A46(zZ5RuY}-<M^DEJ-&skp#4H=O#E9l<wq=)qbrVnXyyC{IyY;CjKF%P@V2~Wsn
zu`ll*e5`KXg;V#=%)I!HLtQ<7aYyn7`}U*;_@4K)t~>Fshg-*Go=EM%UE3Z1ZmjIK
z?C#<VU7Ws2v2=K_aK?y-QFiCqzigt;v47iGujz>RvGLhW=KbN(Rdj9JuY(pm<3&B4
zp1~23mr-`h=4|>gDd77aeBx5;)}RHGMfqgX7e$kXT7>@amy@KfX#YJR6&Ymh;PG?T
zT3h>F10HWE94sb#|97i*TFQ`pUB#`*hqIn8^%`%xf@MWM9F!Rm-toVSWD{}R_+w1|
zZ>>^m^N5RW*q+=)(f6>u;F*a~;`Bx6?7=gnaJZ8${KG>i%ud6?y-wfG|IPhX?Q|Qr
z4^Aw78sA`nmx$$d$!{SXPWKWGBCq%KOkOdCl?_`x{qtS|7XB9tKYg76&3%I{NBonw
z)N6b03RVl&wT_p*&t0_ip_4b++|#{ZTFUDa$n(;c|72e5!p&#fkp*40z+w0sc3<}9
zZn41V(mPnV{)y1sMdxTX?)~WZH2&FdUB$#XtX`kAlm)aTKMyX72){uy_iNJ9$R@jx
z+~IM3)5gy{1x5EhOpl1H*OBI-*Ph&W!cKH`m`<*Zdm8ZOzZVmK9JT+wPG0?^>^>BR
z{p1+X_)b%5N$UagckEm8ym7$nuowRZHV;^vTo~|IoReP*(sf;)!^?epH`;Y>+bgtv
zK{GP_(>tAAei?XY^yxEOZKv1-h+`?o-&);wy5#guh%dA=Pt=7oZQ)ZV$uz$kUfcJK
zKKs7^&?nupE$7&i2Y*an`Q9&~_FuOi5XOq=9Nf@xK|9MS@ktf|wlCN(-1kjpQ*jQC
zGgrHewpsJM^|^N>U!^Q+(=zJ$-w8+N)%W^iFlpBHb*HFDv;Pubv;5!H(UOjZ`5S)U
zCvvYlnU@}s_T|2dZqJB+V9%JVA$2}zYWseN-RJ*Z#dbUMsr1Zv$NnpxJ=yPfVQ&Zj
zr%P@O^zxoTBK*fWdGvjFI+-kpx9>f}^*?^!<%Jg#cc%Q>>G#ZwJ;(i5yZcotSyC9$
zubCt<wp)HQ$9d5E0sBN}1HW85(l%taRQOf@-!7&V_O8zlydaL*{%`HWE6?Z6tLu@}
z<LS|Q(!z6-qZh@e>{ye$BBpb!(>0!$>k;0^XV9afT^F6G@A}OWTt9v_F?WaLE-&g8
zpecbv7B3Eaab&>UYbTs8Z+@@e_2U^2mqiac=HzPc6~q1NNLuS_M3Oo#_S+3DC2k#?
zzA4=BM|`IB$N4KP+8twOr9D5_;lzzOx#O~THtw<fyv4Q5z%~uDEQe3A>U;lopZ)1;
zQx>)Ra9>!H`@QlX?N144Pr}o#&Ul()Is8I%Y3j?wJ@x#B&3ktUKHcn1-QU9dZX3$l
zle;mZ)9EdDFXejNJ=^t;f2Zy53VJMRA%5^Ex}VGAg%{E<dlY=uhq{y9>SRmX_&JC7
z9vb4&XZhrL4~wp>Ntr$7+q0`hZ)VIH6L`9tb#O$EXU5lO2jBaq{bT88eIox}Pz%O|
z@!uA$iDdtFt6s{=MPH<C2%CNU*sJ%3{>;5l>*kyzyPsO`=u`Ja_T=by2Z&umZY3|t
zeEh7QRmy*R;wO8AjPUAu;#E|?oIS_Fd=Ff<vap{L?(@~li68uwJ!5aXK6%Y8{Xg$`
zppE}s$GQEtO|cJW&mHmTbx-cvxbZ)8FCHBpH~fncubeY~9`4wp#l;`H#Jo9vZ<siK
zeuG_Y)0f3>YTI~EcT4*<XH#Qy?md96Jbwkta^bG1ysPg+H%Rtv5I;2CC#vDO`L@Tx
zJb`vI$~_;u=qRtfhcd_gJ!DK!%##ks*q)(_5`RCqcRY+1{j)4*yjS?{*cP>m=6*RR
zcyE^mA)Q|yl;r$9dG>)b#{#-=DOZr=)n~`LoPV?A&nKNbzgI8y{LzT)A)NE;IPR%~
z!`t5<)7E#~gV*_YEOz_M8_|2q-vjRZuPqEdnDE1ozIF=&!(R9d@L0Vd@b<?8+&{Ur
z8AheK*_I1;25#MUvD+Q#yvug1If?Uat^A+H`|RtwH!f?}FL#e#YQ)|a{lw8OCn7xT
z_C=BJpY!kjk!v;GW<o=+F?aG)@(;$P2e4iqOlUK$r`6w`SnFHOvfUZ+<lC4}#1l6}
zy!>tIpYykzIL`@PcE+XG*lSxF?F_C9L)OuUP7@CP+w=O1mzQELOm=L1d|{JOZCm!V
zJRnF*nY6F#@lT;vEQD64&a4~p{>aN)(su@5hY@n@%i5hDW$l{YmyqENPIlOQ(0fCC
z?k8dC0YN|R3fwxo7V&mu?{4e;VamvK33SJo3+jS{)wc~DUg#W?|FB_>rDKbok3WcO
z2qDY52}w)FY)&p*HzV6}Sogwr<C+jMK-{qL;q`?=|Eq@%LWPbyU({|i>&+*wIlV<6
z_8NQG^V#^u)448|J%w3UWBM;Rx9!Rvk4YTcU6YF(ysY=8+}!iaP-o%AV=Z<TJ-pY#
zf@Cduo!{6m`g!iKAUnrDUajZ)jPTjG@r&G|3w{^6?3!9f)H^QFqSvd(M-w|7vi+`|
z*B<GVx%-;+@AabK$jg8!{|LfZWP`igXCIx}(P8Tf%cVUsX1e8%w7R`3_#Z(E1P3G5
zoW1#z`;2cAZr@+K&Lh>UuupQ&CM_f1uO-Ty{9#(2LsPq;xNB5<Z(efJ=%>=mgvc+V
zvU^|m8qOw?Pxp<z?sh9MNAT{L`>9I;zdP^QHShXFLUy-3ZX4@T)OxP%-C@Hy#M`FR
zfIaQ61%^b%9CW@V0i~~Y8~begP><jlV>Ta5Z$(6-Y`(GG{{G16{U3xTNO$F*gNhdO
zX#yWEY%0t=-hS}ar40x<WP2+v>TXQYRmkY-?}QnjwC04Ioca7&GE~{IokjeP-1)(F
zdtvuTXOQo6V5LL%ck|=A<j)dL>0!Awc@ZJaT-e^vt|auGYkTlkJ|TDOu=0HKZUpYU
z?>KCN1B?97nC&{!h4P>t*Xm*UXM<sc9B>#sYwwrKC+DA{PRze@(0g65Eph(-CwJGw
zhcbHRE<4$N$8HImGzxJ`J!SDv$DXZ|p{1dlL9={&$FEmdzVDaw@`2;9!N*y=JsljA
z`q-pIq#j!N$)$xBO^MjWV(PM{8T<KOISqe5=xrNZhd3Xb$bQ!=ZT|Frb8SEB3Q=}q
zEmqz*){iM;cV9l}{dm6(k@(oG>OE8(?IZXEigemZ$VV+5{&V~KwXop9n-NpT@H|IZ
z5{KttoGZ&8Om4F)n7^(I5gqu+eQHks{}z3{Ae--X@7^B=y%+AcBhGt+S|wbfW>VAc
zJ8l^I3wjFqBjJ0|+Lobp{@2qoe|%s@)A;p2=IyUTi2utAiLJd7KAOAy=JunD=5)7=
zjC^x@4Lk3C_M}-CUvNnJ7u!UAGjdLbKIiOs>ev_Dudp!AE7jdED!bmS6THyiZCTUX
zMII16Iu_3&QN9iTdLZ03+AnjEupqTHc>(Topjm&1z5R-$UIl-j`XTVD`_{+yha$HM
zce94a96T95vUkAw`R@dDm@{{8Ct>H!eaNJ%f@>sw@)p7FqTzu8&at!7r>-LpI28^|
zPZbWcuOA|~0%z;>6Mfv}knP0gnLZ<KWV8SG{>Kmq+pRw9yKL{5SHp7;4Q$(#Bn7qV
zF~F_p@)KTO+XsZC4sWmp`bpxOy7j;RW+5Rt2W>5->jXpGUbDzwf{~YZ@x2DtZ$t+D
zXUl5r@=ZeKgV2J@q}Rc(escfXGv~ly9(i}i?hco41pd><O6+*>pzZbTkKb%fXhgdG
z+<WZcoCg1Vmon&s?p%)dS7Q&_W}M`Ph*-zPu46*{A8c~JMDC3AIWltZw2LmI?8qm-
zjR|pYo;lXKf%N;Gqs8Q~_b8id-8^%ej<J0b)S;(G_{!%=f5z3D@kxVqJ~!i!T!|JI
zdB!ff&~WFbKBBg}&yV#8ZRS$%@{<*vyffB>^bs{EIKEXt{Mz5;dwqLC8Wq)CY`f>3
z&p#2d^Sv`pNjIKPzhynX%ks<*j-Kjxjx!-P^Ze4HRKckW-*80H^Ph&y?|+v4HT0Js
zj|CQOrzYI68~TcjTR36rsf?a&k3SD+>w8>!tIwzc;=Ca8*!P6vZCUs-f+MMSPvkfN
z>;II<4Qp@Fh;+Q>I`^V<(`9$eya|~tA#-T&``70W@O;XyO^#bl7q*S1!cIzWO`cFN
zZS?@>*Isb}&E`IvH|o!Xwue0%Oc$*0X)&ST`79@D$0dg^v*Lg8^r^q=(4N9gqrz=Z
zMmCJU(fzCF`JT@bx!oMu5q1+|FO7S;&FbQvyz~4g7T*BTyV1hO>$cmR;~YLbR}%Cp
zVeEXHlcB34>w9PHn)!n?=-VZ1JCW_1M@t8>mVO&EYQD{1o1)%fHH=((Wu0(th=Vuz
z)GzU**S9gty4`fZDiPAF+w53YqJuweFYI8`8Ci=PS1@hpDz|3MkL(;ftDy7fz_5?H
zar#|J>=~YuC^+Um4Se?<pD)fGrMf@Z#m-)xGN^mg^$C5$qU}F@SW8;?=|4e5Px{6T
zN&T+qw`b$OTapw7O-}4ul+=AO`!TE2=CwsWkwd(454HU(>=^gS&`yDwyBiAj{#xIg
z+>A}Q-6yPjQN!zj&j;CnJ-+ZPm{!|eG)UCA&gs{uyPudm6D|UWcuNyrtzHWX&O9jH
zwCnR`k~-d2*ZnT!BwCAZK6&)z#DeEbCl-irq7m1vJR0#%NYi^4_pO}B21*f~i%z^w
z|MWsPa*((5!H8YasDk7b88^}&CJXYCmu(f^Bs=Z^7enrR{`ywuRb+ia#K`qrZ?gMj
zYD(e8pFTh006ClKob-k5sEyxVNnkG;)?jMJE~kJDPK2E__}3eO4R$nf`8}~`*VT#E
zXF2|##qQ|pG|bNNGbl4OgY%e0c=^7Oy$6rjS1=}<+W^|zv5pHe{17z4qw8la;*Rtm
z3clqzH`<;@kQKJa!V6!0ctqB~v<!|N$=zOf<ma)i(Nxis3fvM|$NvKoCwp4{SCEAQ
zIen4AsnwHZfBN;}2jV^KNyp+(Znz%Qs((XDdaK={Cl4R~@uqc`K<B@kyFIu(<8ZWn
zvv(ZdZ_@esyo~ja!!z&Q8+R|QBPZIv&2OCa!jqw=>$y<l7g@(#j!6{wM)$ej%PVq(
zT?4`97j@ir-d}XVs&$hWJsz?g1tT97zC3y~!O3bp7lx4kT4efcbRYlT@y~P4upFr!
z$t^ce%HXVR&YIqFe)H}poR*VS6AIehOH26NIXcn0-Xm7udE)g;@{hL3O0<r6RO<&2
z%e{}trHPR5NUgn^6xeR_0+8t?*}Wmpwf*Tt>)mM<qq_z=f8AWX_4|S??)`d7kGHy#
zD9Dherh!^of1FCb`F+i?_~QkMt-A(_-wYQ;Q=_w34p}~tj_ZUsM}u>XSog+8lC-1i
zy!H)%!jy#1MbW}ZfAt~UtIKD7{HrwR;bL~DqJQ^4VOcDD(DfNKo#yS^PMjFp`C)TW
zclO+Z6H+hNU!c>)IQfvQGnsWnLyyIes<oc_rNIDk-W#X>{m(?(4{SnOZp>ptt(n&y
z(q|NQ<8IGSv~Fc5l3ZDSLh2OOi2d{^^;c5H0cp@Rw#2*R{Pn-T7oT$HN@Dz>#_XrZ
zsOY5hLwL&h{*A!??V}SC)>^g{Cx&;~c|#PDI`ei&xG+BGwRA@NF<t7Olx|O&|8V@L
zJ=iNwZQ9#;Kx&JK&@)rI`lM!t7W~=o%d3NaTKhd&FI+k*mB850E;Fz3Q0pb^xb}-0
zkO>7h*0&;o((MK7U2YfI1)cTxEO4_JB$9N=zZI3_)|c%P=$zi%?fAyX56{-Ond}^G
zZ*h@h6L>Se)8ksJI_^!hW<O=Y#njSqQ)9Aw&yN1yZ34SvptGd8+q*%YIbp$lg8aZF
zZhJxdJHn4NVi(o^MH&RR96s2TH_37nC(!mRpi9V>zXKLT+xxYX91ySP+RU|fc<B?_
z;cWf%0Tw{-H0R5llU@xT*E;L;aR!HF=_c%x=JLVS?A{S#2fudvfdyOCY23z^-d@w8
zd_6K^$?Np_DO0Rhi~7}VC~$DA&wFqqaO`pZgz&-8ytlQO@73gN{lg<JN89^f<VbuX
z*PX4;>-aj+y01N1H(+zi&2HG!PPRGhF!%>4+$)*rIMAlerv-4kqElvXi+UXc;VwrV
z|HkZE4FzzcVNir^&_Em&HV^Pz<@P&v-D~_qEjRmPBd<kUp;vO?WV@eNll7FP6<HcJ
z1YHoa#?OYqnQ9NEhIa<rhOT3|dAc?M*ZU6cmvnB8S?eKda(mEWZ9ciSY-k8s?^PS_
z$Be|RhmDA%-BD<M{O@G%-kZ>t(8rG0-u?@+x`wdaKImN+#=ZSn9?~~UzOU^?%>kW#
espdB~PZ;hT{c(YJ@@g1n$;TfKA9&2&JNW;EI&!f9

diff --git a/client/ui/assets/netbird-systemtray-update-connected-macos.png b/client/ui/assets/netbird-systemtray-update-connected-macos.png
index 8a6b2f2db85a6b6e312015ce634ec49096c45059..8b7b9f131f7581a4fc9d86c7d248735b2e6bce39 100644
GIT binary patch
literal 3328
zcmb_ecTiLL77i$jipUBIN>C{Zh%`Y!x*{#olp-J_MIsV9QeueNATF|i^b(XN3Ita`
zgiu3!^eQVTC6EMxpp+z#01-mSyJ2VEy!XfZZ!>e}cfRjC=R4<~+&gpQZ`oQ1ACWu)
z0)d1fmZtU~5ML1QI&=_Vgx>4%4ry;odm9iaN*)A?{v8C`0jTI7AW(!l2(;`80_o*|
zKoTK&O}7mIf&adhg((R1XOf%-fDVUPx`qKhV!VqF^eXQZKnjLKY|I3g1rCZF5w1ye
zg#p?K#Pqu3V*-^(kC5&E8ojP>v=^i?`KkT)*Zt8)hs>olKo&qW96fxk_qb&;DDdFy
zp|!ZrL(-qGIZd=gtc);ML_Ull&C9?AX7zU~%y~oqlfRCm8jtDxo?bG7x_uo;9Z;aZ
zZcDH~{T|=O5R|1!&B%i)XwvWTUpZRMP2GanRzKV^=ZHUQuw<WCC=LD+WGJaUrlZ6{
zjGmp&X}w+a5rPcx-Z6hrX+y9km(A#14JZwEJP#f9*)fkbQ3wQpyblkU&Furv<>KLu
zq>d76AY0L8ADArdgBOcDCC1l|r~KZ{1N@Ub(-5d3OcT`!NrvPufsZ}nQGLpEo^EX*
z4>W+zYQa(ht;x3*bpJl9BU2E(ncmpTQ$Hpxfe+t&h3nNW4Yqb96dTrEMtR57A{&ap
zV>+^#2KyC<9C!8wxog51Ta$NYH#pr$!5Cp#jlNYBJ8p=?Mb{J>i^e5>&>dJ`<({P|
zT5K0eQ51t^8S=p-!3ZxEF#VooRT>&e?`YJRFX)$kHUv#2L$~(Y0;DK5$qadP|1^6M
z@nxDp;>dC?wzahtop_zuAoy}nx~*TDS;M+7@_`}G&2mO$Obm^*hlz!)<UUcMD7^8Q
z(L4=R<vtl{vgReEIU}^tI(Pf(UTPk**uJ;7K{~9aIpqX5nl-Dd&TRawSsiI?M6H+)
zBZFBA=;b<0zOob9+g~4hrYYhH4Nq#eW7w=C%GUEDe~hm;()E}|eK*&2%Qo{Of7aBl
zeHyYtA<j8sX|?S2g~_J;R&EG-*}Fb#G_76_SQF8fTuZ57l86joR}p%sk%ex~yAh5_
ztq~yR+mbgaoV@U65gMCbYxo$u=yiuEvV<+3CpOaCdh3`xbIl)0-+WitDY~d>R#VxD
zcWQK8Eak7MFQ^}3*AaU$6IpOV$0M(5J3RkcuK>5ly_8`0DYh%2!=CHx0!~}#ts<y7
zV&J+$gXge>(fM&BrzxrlBYil<A0L<%QXVBV=pmPGKJ!ZM{)AA!l@-g=yG~R*`+FN{
zJl<`E5lxdw$K0Xy_XLoH28ZK%#}eF3y?5LnV;$c#RZ48Qxw!AyyJ^zCEFtIfZ@*g}
zKxTxO<KxK@s}G+C&0HMQ5$Xr~4ItCPi^s&X=OxnpdJQ9Xd}I(7DwxiojFc<Cc{MgN
zEO$Z^yV^cir5?RyL3-Aa)}yQ(e9y>F48FR7LUBVDrwob6X`K=|VHCU>71^Ui%K^Hb
zu~E6%MsQ;WTSxMd>7>GdsqQm+sG8Ilx3&b{43=9oHL_1-hbGQ&w>wNU>>DS9XkSw{
zLN<}HoTBWAnR;xnc)D2TE7r4}G<P?b=gG!fq2wqn@$Gb9NIU{t$S<Y2^~`v8@sRFZ
zt2QcFBmA#2#$MC|b-mG%ZvnEc+IBOt81C`vRBQY3uOx8Iyn%;H4@p$UW9A&sxPPEg
zC5D=~J&$$Vjqk||<w}aXTK=g>@uQclhpIvefqje~4zR^j#$ckN486)Bda!u@NzR5-
z<9tCY_7nx(GHc+ehDqPi$#!_$CG6CSh|A}n8H8-mj(`&yz_Tw|zgD4B=-fN3WD@H*
zT&z{Mq~-8rJ<~&%(t=V8)#;e`qgRzIY;{f)bCMoN%?0(SB4-ApTO?ImmB=0G4Y_G-
zKRV`hizM4FC~N7o4DI>CF!Ipk+jZtzqj+`~G4siUP){Cz^9(~-IUau*!8nHh?LKP$
z_#+<F)n$+rSK~N<4;YH7Wo0@<druGiL`c)*r`)M6M<<`j%!Zar05*#F=FU<IroE8w
z*|)H3GsD$QQjxbfq--Ipxu6^~5)2FK)yBtO2-UG+NByhn^8GX0WtZN*RiO1OEw&u_
znY{kpubelHK}&P3EuSqX{@26?{nuG6jag)D9>3JIGEWppdf(C+bfu<n_va4aOEZlk
z-DrnH^o?umjeG#OOsU$zg4A@VKp(i=h2UI=XoogC#W`BvhTDYNfwQP(d&YceW7T<D
zr8Qn^oOWV%va}vRpRD_lr`H<7N^o{>c$n6;nD2dYJ9O->izqy9PBrcf|JmDY(Tb0;
z6z`2tQ8=c9xhKBnD~_JrLU?Uok<p%`IZh%2D|yTL5KCFxTd)532i{Ev0ra%^4s@v#
zJ)X8bQYZwl-tY1BX_-2o&~s4Ll!pf#mFH*#>WY8_Uy3KY-#}1C+d9&azKaDR6k@CW
z5h8pZxhzdYw68bt3h}q9vJ_4q5PR}TfAz$y!#FM;EM|!A^F6(GG7<}l2mkr$!`7CO
zfaT1strb5yqP=bF=VNEjYPwJt!<J7}=fu&cR*=FJ$}j0d{ChSuhv=@PfI3x}7(88#
zq<<?`W-TDW$i46&nn`-9w7^bvl)hA0a^Cx}#+vKRg7X{BR_&%K$uJR;U`jS3pTAs=
ziYOJ~Jdam_d1zs7)Q#Zcns%M}#<R8{tH!Qk<^>RT0u$e!3Xgqa%Qv2_jc|rp5Z?CC
zh-RcL2nYK7w^4ce5sKk)moUP@y`m?Gi2@)+(T=22Y(qMkz+GE$9|ID)iA}BFas7Cc
zNJKr)qi@k!Po)&d7#+cX<?&#^CUS{Fi~?L_@|%&Cxy_d{3*c(740!CGbReU$Kf}Ou
zcV!8|0?P4VS&x`^n9i*nZG`@`dD}q;22CrF5sAym^jO`DF~r);1Z|0lz39)yee-;o
z>g7u+78dkI(4GZZqB$#&TwG$+8Ps)mSw<^H0M^;PiM-ijYA{f7#S&~AspFngHFA|r
zBT%Y}g%wzpf7uQLE<R|Mz+DRiLIMtgKap}>&EA^yeL~2uI1t749}RN+speU_P?1qb
z<$QqPU8nz$@ISfU0Pe=A+>oLAbd&Dvc^pq^xothIBt9B68Mcuqo&i@{VS8jmc9zZ*
z%a8|s_H78QvzSjidlSV(+~xviWN)Z;ljjG6u>xv`r}u@1z_~$RO#MC|Dp{xu%lJD+
zs41yE9QsP~DyO4u2*YD|yZ1q)aaNl=_1Nl3kMW#Aui%<it`-dLS+P61ys$quExHGI
zi^Q1^yCz)7+*de!m6ILPlBBRdm;{boZ)M4LhZYm#Q5i7uktCdc5&O2yg%XsC_9(5(
zdJ~1m;d*1_s6pjmJ9b!jF;RH91o{qE7-vB+<`9vBL*2X7s9_(5vWMA%E2jxVPi8o|
zw}^;-UmT#jUuc6DF0|t#?Y5TH!ln=zkvbd36)nBZ5d5`|g|0V9#rKkGzgdy2fZ#mm
zJ%~M+ixaBVLNB?E@Pa-DqdrduCgERr@#!6=JoWxm9{;LB@Th7w@nX9XL!KIA_+X@{
z1aR{l$AYFm0e^U1#K4<afbiADq*qXE2(i=nR_0fp3GK5M^%Y>!K`|1Tv;`VAS0E=N
z7HtUKOkDvNG(bGfM~-SO62l1|&G2jeCI!v#Zy9Y+nclA6oLr6y8@_9%FXh^b)ZtVn
zNxG1`1Vf-GwpM%EW|AhK#dy8JFH)}L^0OgO&Skl1xfPK=_@!LYxO208J2zYb{Tx>K
zY69?x-A>DChJdpU^TMK3Uf6`ufxW$7&yWvvq}?SIC;jpQnA^AOJD>^c0(<zJa}JTA
zEqMiV0QS}?Z1k6Z;IkP==YC_lK7aQia0GC>5N_rY4)qFupy&PQ0dRmc)HSqK)U{O9
zuQ;mf>ZxDV)6%%4uCAx9PF^WH`#%MN!BChF;{O*^*8TbhC{X-Qhj3WngRpR~z>xp0
exvZskSzYh4=HE?@Jz^&C?h#^UYg%dI8S`(A!F@6S

literal 3570
zcmZ`+c{o)4+dt;93@T)bBBT*Q^R!4=VxCMHdzOqPWJ#!mERh*Yzo!hEj4Tfg6C#Xl
zBrOJ&r6EzWYsm71XfkGuWz4*1^n0)C{pUT`b*}sV-1q0cKlk_hJ?C84Nw&8=w_R$l
z6aWC*(H7<o03ZUoA^=nzG#+73FM~$%hJ|Z507%OVZxJB(k)n_i?r`oepz5RY90)`M
zkTysFs3l1AE{TDi?xM|+PSGNZU%#b~zL)#^8`Fay;y*!ek-CKV!~ez&Q3vrm2YUVE
zyUnsiy5we+-^{AlD2vc~58HX*$HWp;*zAe8@>kDXN<Sy&%!!vGec+(R|9^QDmjX3M
zm@1Rac1yOv316=4-MS%3vp$A#tLA17uVa<XjslJ!G%+9GOq-tF9VbH8?%?n*`SdCP
zdqV?hruwte0Fw5cQLvXS7Vk|gspOW5$BC%jb06FQ17{cf3RXee=~~I1lLp?vhpU7Z
z`OuBorvMyk$ncs3?IQ~9cl}%9?ST!)11U{_{T*%$E(jD!U39`t7IfGGyUQYes~ywm
z7t&q9wt42ROuOytkQQ^JHp`#xKAM06%IkOJpW+k$ZS~70_{U}$(hJCIaHJIL$r*_#
z)n#({U&x5~Zi|rtP{!|*g4xvbS6egmQb;};MF9(<#}hgHMv(K1h+!g<b=M(KJg3Q~
zSHbKgs6~a=%G;kB*ziwk0?IR6V{mEj3lZ_1H4HC<59<(9`Z>e3<!)D=&G`7g$^wSc
z=IVgvT!dG_<YyetBw0Y>@n+@(xKnF;1{YNd6^z+3O9(yhi$FWvW<7ssssLxYwze7o
z?<l;%Tb7AK?C2OO4AqtR^mt`u^bF6j2XQl_TN{|$&zO%5Qx$A{c8<}(4*Kq2?V<NH
zS6rOizv83kmV%I3s=MrwTD2>FDl^7<0XKW=v+pb4BdgrL9^Vh;Uv}-OUY*J;xPJ3u
z`z`$@`Bj@^`$E3?wFTWXPw9!VCfgEF`b3fs>4#pstu&jsqqRJpgNZikk9D5mV<{N+
ztpv}{2^bTsGl>}OqIiV5TX#6N4ZD=?(^$HJjF{wOc`x-h4%;B+%wVcyw++Ck%`m%_
zGZa`7i<T(7@+FcJKpVgO;ivSNm7#1~VM&w-n!<IzPuUZfP#bhRYdY@NHfvW3w?VFM
z9Rf>W)n*qMwHbM}QeX6?wW~kS7)-iua=KII2Y<0uv-_dBoYp>18>AHPgnIBdiI2n_
zEsb||+BxQ`WX{V>Kec3a`=eA|ZXy%*-MGKzYVxz2M>pqJqBAFh&L3W3^;Phf`%L#$
za6`?Fyh^kn{z)Yhgix$f*GBaHpr$m#*K-D_;)YZ?Fw9jXXp;7oa*vQK%a<SR5@ZEx
zg3FW4O(cXa7Eu@-5mhAwhdlkwl2tV@o=mxBAhw}!zh`5pYEI|m^ZtUtp)LWcVQ=i(
z+{|)r>Fuliu^yh2!wR!A#o0a5jKA2dx|PupN+2_)v13{v{evrpKe1UdTmMs<VHtfo
zF}Ay8LeJ|WM<qjhU_si?nRVr5Y^4Fz{T`A}>}-Cr7@@=reTni~#ay_yZWCI~ktpuB
zC_htHGBMWSa*NPaX}Kb1JigzvK3kxMB6vAxdp@s51Y;AHRq{>|7qT5`huZ2yvrrdE
zN>of`VD|M}izcVTU01}$^03w4DoU1%97($E&j!O7Q*}<wzqkQn!%wu6)&C5*5u9~A
z#3cARt-d%Z9FsGu@U&`<n+wOc=!KT9e;t8+ppu?3eEl@$R>q!Ee`g*l!p>C(RtL_-
z2zD|<sW+{>$S&UK+i9!y7WkR^<k5<4%+N!RaWhdD#@Ts^0g{vgU5$&uQf^gT#F9#d
zLlsA?J$&rLz(N#DwPi$I=O>_PQt-@mW}F^Pa6zMcQi5KTjKfGgiQ1A`*l4Xb#)pPW
z=0;~mjwnEf*?EN-0<!^G*GR*)mwn()U)75W@~Ac>_8z0;^ZHCSWAl4p9x2?MH}(jD
z2nUahWYL>{aID|dM-!A%IV@Etf(3Pnzc5}I$o;mnv17Yf>Ns{;Wk|m$JFU2@VUoIc
zLB(`Q#RwLL5WKl~fV!{^!ON$OOq*b}u1FgVL{ifa@~U>{B{HV&Cc5FWS^|duanp4V
zmWm<lmkNFfg%8hOUnN!Qi_tn{bu5CIN_UbLrj>BqRc^+}gvosj+QA6b!aDZ#^*<do
zE=r9ZJ9R9BilFTBsoT$bVQdvEimvv`;JvzqZQ>pBH0@cF{2Q`st`O2yc+pfc10>j;
zOvZ?=P<?L&z;&)W_QqO&dzv8-eW5{|kNX<iHf>UJV}Op^X`PIWq;@L%ww92&FA5<v
zp5|Mt^cmb}NRYX3QoTc;x^PDy+Ljly;s{r4kjz>XDrU{@-tv3uF^h_Q;SSp*zMJ`j
z5q#gQ-vM+RfpdHX|7}9~X)oBRT`^1Pq+ejB@98wC&6}ifvICb@po~6YShia0nKF`>
z2-ZGnY(8uJ-ZtyPsei4`$2$H3OLJW0-s8hZLly^pyEn$jVS_6aoju^Xz$)7`+Wd5!
zr>xoM7?fJqN43hZ4~|9c;OM82vgjYM1ltpga$fDn<dNJ&#`ixG;F)@mq=kpZA2rUq
zJN9neR?8uJ9k8W-D*LeHippPg8?P{Ch9|^Z!V<jv4`{dh_N-Jl-Y2+eA{%@DNSyaG
zkfe^hS~So<tS^?KlJd??ax!j*EJiaA-Ag}v)G%Lv>Y4V*rn*iy17xF@X`+(mFQViF
z|9}V92WN6auSzuy&iFeAGOAU#&+6kKjTvc1=)2@42U9WV<H1FF+yj#F6!#odE!DHZ
z<|kZ<RD7mL<W5+1p!{p_>58o8!+<+CtFtvDvcC2UiY5;lhymRrKh}$X`W?`|?BEFW
zHU{_X1P?(=2x=s=^EJFVs2tlR;y;l1ZuGjRsQB<HeqN=7tS9l>RJ9`oUIKV8Gv1&5
z99adnp7=n<NLq_r8M1quOT5ZdH*Zm{81lNKj~c@&#V6R-GG5h*0^9uCEIm@*Lw+q@
z+H;;baC9vrKFw-`(QleE-SF!|1hea&q<EX9C$V`)ho;M5(<vR#2QZymXujbi)93l>
zvR^!FcjioUqptNx;m!UeO~Mg$ue*aMD376{Ec6j#_H^~TFJH^GAV`l`GL%jTZ@BJ!
zP7bPG_SHS!72f=xmm5wFqKOtk)lk25-tMgH4pzb>N&Nwe<z6%LI9FZPoVb}a4aZpz
zjP^N-Cf2A#6HW6S!sEe2>lRDPWCfO>X4sz%l3as#Vew|Nq<PDm#O6o!<DB!NiL=fw
zZ!>r+jaj!rT1<Zi8{VwP#LA%5?s-PQPt!w6vo0fq0FKiMdfj(M4mt_CH|rVyK7lH(
zugXRpngX#?J+3`T-CM0}f$p&p+$x-0OZ8VFRQLE(9^Ip2Yxu&rR~hPm_8C=Xo1^`k
zk(l`x4F@OBz19Yf`B&yyqy6z_Wm8}G5^-k?*Wk{?YjRo<kKE6&LM%Q%gDVR@Dh*pv
zwIT54?L?ffxQ*#2-{mTEIgH^P)dDLG7qr8_V&9rpq`u5RfX8CS3hCACHd;#RoV{**
zUza!zp*JH*S=(F4M_(m33l9!tI1R88hRRZ9)Yk?<^d)w9`+Hk|cDd175i`UNOcOUH
zZbTj`a-q>xZ{cEzxOd{2d&n|ifJ9e~@FDV)vYaBx*z<d6^Va+;@(-uSU(h;bh7duH
z?9D|qKkY{=xqDX}Sg2ZYePa0Y1ZsRdf4ZaL@a9NT&MtvxoREcm@pCM1R|C|1D`${&
zTS8yQQ|?|<vk9FLLY!9|qnt#kt@BslrhK+5XIofVfFuULl{Jkh52*=04Ee-u&|F)x
zzCcPk{q*#2@WD1hhEI<9-SZflV;4^`%=#}e2^j&xSItB68gdp`o?6*YN#TP87o`(Y
zsPiOXs#aqyWlJE%u-`}o+}jk<{cEA0hU~k_!y&01nbU}^ajHhjKK`!UMkiDd=N|#!
ziK8YT@Q!UdkJiY$9X<SgMP_Na565&CL}}T^^-t9b4#NyC4Chvhx;9E<!gkGc5)}OV
zO~J2?HA|ruYA!{@`I9EC@9W~tx{$1DUG4UM!Eve<L{FT~^e)9@Oe?y=M2M;>@U~p|
z_jHupmHif2%_JY2hgKj^TMMm=!t0;cg1}9|*ELsHNIh%#zYcNa^}3^|1=gB<zV_fY
zRQ&Ya^kR(s-|A+pcfDjx#+G9NYHT_77bwYRz>b%uX+Ac}cz`Z*06p3ytmoS(!Gc-#
zU?W8|UjNpXSeyez(i~)0urnt2G%s?`N7GefjP1N;f~_CXd`xP&FgvE$Zv47!e8XmZ
z`m7QGz-X-x_yW7}O>0{5|0xVH-QoRsM5sccWPt<yVcVDjf|JXKz@^wH*9(Eu<w{{D
z^Uy_5njH2-$QHdM1Zs*E!VFSR4`j=ZjR`^8i+bn-o|$jSZg3B-d<h1ZE3r4K5{$K+
ueWU=!hH`wtffLeVbcm||_aCWcU{m#PL)X8<St|CzI2vVZUiFuE;{O1%#N<Q(

diff --git a/client/ui/assets/netbird-systemtray-update-connected-mono-dark.png b/client/ui/assets/netbird-systemtray-update-connected-mono-dark.png
new file mode 100644
index 0000000000000000000000000000000000000000..284efa880be4c41677c67a5f57a85bcfe5eded92
GIT binary patch
literal 1553
zcmV+s2JZQZP)<h;3K|Lk000e1NJLTq001xm001xu1^@s6R|5Hm000HpNkl<Zc%1E-
zTZmO<6vzMP%uEjIXo8g@8Dt1O^b#RRLitn*Ax5a(iwq;_N*Aakh#s<15V5ihA@lN}
zQN4s+DGIU|2}%QdD2j|y${0(XbLQ8>UTgL`-|RVipBZctT=22a+23XT|7)%9TkAWg
z2Ix$d`gj8vtDGe;M(MWaL`i!jt+wxVRmBF3SL?RtCBT>D@@yE>RkqG}0IvmL*8;yA
z@ByG{pWgwdB}D%h1nS}QL%^T`ZUheu*z;T9vN96wtW-0FMa}y=0q<6y0BkXk&0zH?
zPU0AFeV9K?XI#8Hu~1cuc2gd!Zo%2W=K-X9ph%)u)+9QI)~-QeBI}bh+1dn2U6PP=
zQqplre_1P&n$2xUx=PY^Nwe&Gcbj=bXN<MFq+OEkmeg-^8<K_y++qr5n}X>9d{i`O
zB>E-&Cg}%B2PEy2wAaWLS!9)@jgopKHI0-5tc?IXzIVd=B`ue9C?A=*Vqu88B5CJp
zfTO@9TK7jCm;$^M)`;<56#J>psMqlw29|pWd9wIK(tJtB%tFoJJ_TzK+Mta)DQT*t
zHTJF^#!i-Wa~SV^P5a!GbgIAu$4zI==E*#8O41BTi&GEu*z+3Tlv$_D>d{he%{#~s
z1>e~7&3X+R>z4e+^!*Xm@xHCVJwZo<d{ci!*vRpua1u9!NmWU>;#ZQj{Pelk`cK;P
zJ>XoR4>(ak;7yyige*KEGtw`>jDUGq9&p7g1F$j@ewH5rrZfDkb`r1I__blog}~nh
z1h$cT@KQ2w0W6?3rxYeKC-F!i(N5g850anL7X#<en)v#F>%y2CFtZH-0loG-A6Ojb
zmS$on@k|K`-zx_L;4a`0@B+nUfRj=M0%>v`mT23R60Ue-8xn4Px2%9wp?^sL5{ozw
zp(+HF%&kNqowTihgoA%SSZ5mWEBU_o6PO$N9eAe%Mr`da4SsfaNxDtay9z1X&gh1u
zN5gsjq@)W%u9zxmx3UXMO~qNdQP7%ga3v_K6>K%K4fU~E=pTD-4i=qj?_&;ei|({>
zeY94xvnZCgs(PSGLFF0rgrudCK9qEYq@$9aw!T40&q?Z4o@J%XV}p`bD64}GOS)fq
z7Vej{$@-$Mec}6<J&>LN(}5p>r$XOCvs^5Jqj&;)o8%m?*haj6RPjLSi6fG(R8~%V
zz4Bto+`6Oz6_?OO?@+!E;@%myk2)bBWh82neh!PRlytdT%j6<JJ<3BPN~7SNi-+fA
zWg*;9N}@worpc%W_`W23d?Rm2La}PdP6hS@d&2vna2hQE8TdM|h^&H5>v!xuWXW)t
z@(SRm0AGal-bjrwTJW`Gp=Aa>R<LgQP2?N56Yzbs-k*KF*W>uHc;GJcLQw_lmVY?`
zUq-^gPXazo3_)0T`)CRH@wdPh+G^h?*z@6_Y%{IkW9%1^h~Pgd0PmNk<G@X0Ay5at
z3Jb2YJ}-UOlV3=p<po?F#uZhW6UlB|Mc@a?Jg_KY>IA%}_1kUHMo_XQ8RJ&2k%!og
zHg*@eN1|tXfe+e%A0V%Kea*@QTu~qJ6Zt(jR*+ASm*MFqckn*eW7s{^3+%N%kMk7#
zk^&=DCg34ZbiwhHXD6*UFbBV!yu2<dnY+mD$mzO%EH{9qB$n@lfCIV+=%=;X^nGxU
zR!=$jIRQ-k9ms)h0d}_m-z58yp%8pk0&e{sws@Lxo2Gny81F>7fYo8%U^1`ha}3XA
z?Z8(d;Na&O$dlwrB{q-SwP9|oAnzN2M57J(6=mSd2)Gp|0tcuruaa#_4?PF)fc1~`
zQ%wvrKj+7Eq48_t97*3v`dY<5#71dKnki|Xq|ek^MsHA7t*%pk=}CXGtV_C8(hg<S
z>p+RV|MVXkw`TmkDQ;HCa!hI1#Ma3%+DR)T@pvHN;P31dd?y4>hbJB*mr;SIWDlG!
z@jok`mvo-8E9zENjrl}I`itp|k@5bge#~-~z<A5Q%nsL*Vl~8v00000NkvXXu0mjf
Dgi`O2

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-systemtray-update-connected-mono.png b/client/ui/assets/netbird-systemtray-update-connected-mono.png
new file mode 100644
index 0000000000000000000000000000000000000000..ed9ceb8a2952233812cfbc0b61954a23531b4278
GIT binary patch
literal 1405
zcmV-@1%mpCP)<h;3K|Lk000e1NJLTq001xm001xu1^@s6R|5Hm000F<Nkl<Zc%1E-
zTZola6vuz(oS7U(#|k7W%OFGOA$kcR5Xz@A5Gg_}ii#4W=t>ks5=0M)Dac@D8C}fu
zA)_FO?i2+XL==@lJrqGkC7Fyl<D5$md;Q((?Djd|xltp`g3b5M*?X`3|F6B)+G~FU
zvob3uv<%sE6xa*gZhx1p&1ez$^MFr*hP6lCn96?*suL*@fn5&#P5?d))a?Cr;8Ytk
zlq&c?#k<8lK%D@%O5A~Idwv64U}L)`QL<KU(bV6K$m(-|9R{*Sw7PF1@fUEFo8NNH
z3V~&}fm615MZPKvE&@JwAhiRz=67X7vgUDV#b^weXKjuFYyeZh5#X@3B9XsWflGj0
zz(V`G6Sok7GO!0&2Ta)9swZ%rEwIQISm40>h3ZCP0{9L15%?C^2fStE8W|w#fpK7%
z;4<2=26-c<zl-n}z#8EDbi#6?-{o4nt!@AZfw?rtM;Vw8JmGYBf6w`Tx~5-O_zoC}
zf5}C_A!A$3DDX-JrV32j^D)z-U@HM<5(2SKvrkvub1DOVq6JZneIW%uY|qPpV>YSC
z>YkJqxzUl3n_O(xlTl>JuWh|QogVc)2i%$v7U}nBk!(cbYB#A<5?c7FM3>^{w#0&O
z0;dp?#bk!SOEzy6!9BGTzW}G_z^5c`alnd5D3||12>vuEMdBG7ztN338~8gzU?*`0
z&nN6w16XFiwN2Y1aUadrEy~w-+q^PxE^rdf2j3X5(v2wrXS5*zFk;WsfGgbGLJ^5a
z3P>nc_B+58LYmuTI?{aaE6pMT>EYV(L0fVQkGCNq>#uZk*Sr2z4u~(}<U*YgAeq~-
z_(?l6Bn19#8&f7!kiQb+;t;UJ^$U2n1bP;cC=p6rPoie;7dk+XJ8~lU72(2CN%V@q
zVbgOAIBM_D4~hUp%Z&i<8>pl9-0lD^vETg}BC@+}+!)Q3>_YOf^=hXCI$>Bh5|hA{
zz`KM~`ylYJ_0<U{@rV&nunk$?T0&wt0NiQ)HNuIzjhHmF);{<5z(k-H06zf_xxVEz
z$3@z7fW2npyA8-*?jKnZiL(fWnu@m1X-_~t{)Wx>1cov#7cc31&yr@6bp_xX2EIYO
zm~^@WGT1ztQ)=I$!)O@zfnw`7fUOCrPSyZ8nQ#x->wX^yiD6T=f?(lX`7O(jce%L0
z&j&tn`d&=>dlrF^qSeHjKTV<AY)sorxfAIeqxt?Ueb4rZ{kYsr*o9mLE6YD=eF9%Z
zLg42DAJS|HzoWZ)1+Cy)M!a}HxH|*f>lWMY<|tc9awI(X4>I6&X*vR2+Yf;<@R?J%
z+4@xaZXsSsyyXEdb>nhX<|yIDl>=WV?7)g%!7Gj3K+HN?WJ59r;^89~yT-=uA?}FZ
znGxWfHsGg;Rj+h*ELvy`_?dVQ_7&uV#4<b$a)H-a`LK3qgz#C$`*{l9m*!oITp)MB
zQRdlA^9@Yk*AUC=T*+J^+>ukgO3PJ34F)|}9tY?gLh<FRO~t`}8|%NP0xWi5{O1t?
z-2uGP27Hb1k)dbs5Uu|*`4d<7f-P>mh*SvwwD3EXW|j2ayXWdbfnRDMr-+A&Z}QuX
zZmzE&?`T1y+6MgEe!<I%qlE9DtqQfYJxvHoxt;*rMRb+iryB2O%JY3)XiBDZG4LJm
zCB>ycjc`p|3VdWFrfr?AgdN>Xy!1$)NR)x=3GO;<b7zdmSpIvH57q|ZjDbGfrj=B>
zY^_8j9w3qs_?xV6;NS->B5^;_bxs)Y5|P+M*bO*=z|YF8%p~~-v?X|kQ&~E000000
LNkvXXu0mjfn;@Q*

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-systemtray-update-connected.ico b/client/ui/assets/netbird-systemtray-update-connected.ico
deleted file mode 100644
index d3ce2f0f322f6df5c47adb9b46c883fe0eae86bb..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 104698
zcmeGl2V7If`$9k{BA|lWRt>ndRuaTjt%=s%ivH`i7AWGV1Hp;P2q@w#SX&oG=uoTH
zqIEBbRjSrnSDmOt)T&hk1lf@P_r2sn60#R7`SEe@?%jR+?!Ncly?cZ(NIl}{NFa3~
z(=7>^N(gar5$At~^1q>s&6ecb60*>l5FSsQ@6ex+mc0q#^Cfv31{o9r2;hhK);1=@
zKaxQ@Kps#*iMSjRLICd>dofUXE&g?%Ntz&N(WJbpr0sP`5ftKJFU#u#a9IlWu$SlA
zO0^ZiF@i!I>}78Vv^@hLl0Z*n0P63OYKLuA;K*}_wxv{ieqO4(cTRJtk8&dpN`6Sy
z;fQ00=ZV~>=8D|Ca#8`Bmn%Zd58|P5?2<l*$3WYK^JQ)+w8QqQa8Nu+w+9{6gZ2kF
zbKlTy=`>Wjo}y!DYXNO{QL;w>|C7t<?*~56l}O}dat1-ZJv)NZeJs^hqJK^h#ltOV
z3mzx_LEAJ0I*%!vpN}%HlWr?H&gRU{?Ev*{0D>hc)n2*`>V_(4i#{+C@k`o@AiV(a
zLIQY<Wx-Id4S*-W41oCn{s5l>*h$(W{dh@zY(oQ<*<c-YKYjqk#|)@nD1jMK)77=A
zd>-2NMW}p6_Y%=%LPSx72$+OCWDp_*R9V1p7W5t=7s}fMOoQ<T%HcExBJcpwQvea6
z#u*nV=TYbI2!7x#x{fnq1U2J7^yBdeRl%)<b}^&~CgnkjHa#Y5&4Z-huYrCRuM(E$
z;Z#=sQ$SmH9+u@z2io*}p(ur(Q1MeiTPGeQWA0TYJZM6jwm(fDQ>|<Pw0Szxr|2lr
ziMBlK)shDp{QB|$v|Rx5<$0jyFz*~icBs_f48TLAG=0tzm_NPC=U^EgDm+s5NFN@6
zwjIC|iif2@+ozm19Yg5KgN&_YIhM@<?Mdtqp#4Q9+Pd<fF>T}o=(mB`t57QTqUlPf
z+UTK@pU6sFkptTA0Hm=|_Z6|9!sCiohB<<9$O&lQ0-(k~&MYc+RY)6oGYnNR7NF?}
zaEYc(rC|_%R`x&SCj~$z{(*QX8X#E$(c16^a@ztu>1&4aIY2=S{RC*gBadG~myQXO
z<<Be216_>Ok5Td}nuBCxaP-NZig4*dAL4aOpsQ@mt<b@ua$odQL>tSrr7xNDzE>)@
zoG!o@w@A|ldR+i)=`v;Xu@2Uy>tQO1Ilk4DHq=W2s7K=fd@TX+8sZWjV>zVgdouRN
za{yQe>r(ZwF5rsNf;NuD<^BeEP#(ld(?Z<+0c7Y)%J3Xr58I%h2WdeYeSn8N(?7t0
zdY8tF_=^ED0ccuyjAe8lQ*6@(@FDmD;I-a<fQtb40iFZA0C)s&9pDH+Gyt2XO{ai|
z)~hsrRmbIaqH*Y(t`OVdM>!c4@$e(o)t8>4_LA$#0N_Dh*T@H!1?X~psfd=UGN6P0
zC+!n>40otZ_XB#gPZ-?Rno5CoHkPe5<)OOQ6H&iH_@4zJ3@cy=xCKl;tH7E#lvoq%
zGUf_q8RIfTL_~ZM2@{C;+=n7Q3xW-ns0^TlH0KtOKHMx4%oUOnu7L4ZR{>+WD<AG#
z5NiZJLnIO~0l$MtRKOC6O1L6XS(r%j!;459P<#OJJ}LEUQ#bBYh=n!Hf4By*K`;$9
z!%~s(eh5;88YKhpi}%WrZ~9&U9vfx;F|5|9d-Uit(!5K{P_69%d@JMK;4(l=gwH1e
zbbtYhY=-`!MDH~3bZQV^0=}CAWCE05V`y-E6`liCdS;}7-f7<H6lKucmw;bw;%Gzh
zZZH|(`U|f+Q}xihranXSET8J_OTha`HT;)?&vaJe^TFT;@;piBkv|0KGWlb@d`WT*
zd_s*33Vo-W>OOm@2b@<^hn7W88K~>ILLFsLG-e|2<^2<6P*jKJola2(o#!~<eS;eQ
zMeK;Ys~o?aO5=|le=@w&ekWIl=2<?~*$%*aBY+H5GDz;_U4?teie$jP9E?6g^DLhl
z+n0cMeD11nKH&Jv+=o;sgFL^A@><wIsU8&J#WKlwTIm@MCqRaG`d+HBWe8Trr>b($
z{~!SIx(Bd@f_tAd|Cs6{gQ~fM8oN~Ssp=f?pNM|MnOA<#QkrM^V|`>$G%hLZ|El<v
zKL@<G;VgKQFZIkvo@e>Ip=8jTca#PA|AaFqw;23Go=;VIePmEOcFF5lSsr*t|Ieq^
z?f7cNKgt%W46iB5f$t9hvH_?u6nsdPz7?GdHwB-HXu#Ns_k?BVFMRGHUOT0TS4Cx2
zqJQAK6Tnki@6stpgJ*c)H#Y#f15|oO2=_Go0OI99=`$Ebx>Z#Myt)89l;&Cfm@`x1
z{6*_O6Zr0=jE017`FrB=%Ia%V4nETicvXM>qWl>mj!~YfXc~)u;2WQ_;u=SV@s4~s
zCs3gc)cU(I_y@h)1Aph_c~qIlb&wV72+?;E-9OK^P^Ei3XK4Q6d8ZBVc}gX(N^HWZ
zcm{f-t7ILdDfySgmj`s=oo?ekJvS40?;y|ja$jNrx-P%wqR(rp|43hAgE;7R@+o^+
zK0asON%Ns&S_;=-3i~VYxe(wo0Nly1_-VpFwvn`5SkbcL2%Z(=de|*G@+{rI74}!4
zJqUn)euvM^2GP{v7{`94<0sYypr5-Tj`FsMgS{*ldB<m{(tPN0oCx<(D%lt4q3&q<
zG@r-^+5>$`A^+encn<5(a?@=Q7iB|s1hpPm*_vK$WVivmJJLF(Q}kJ&g+4>mmQQ!W
zxxEU`V;P>4uTSSMBW}>SKS24llpZ$dPV+3CF85QaLz)jvOBL{`sElqy*$#07zuhG=
z#6ybD=rKMk2GB(JC^yEU*v?;?Z~0^3PuhoRK6FWC`i?vu_Ob$$sR=-503HCY?VbeS
z3*ZAV5#SSmo&YVuXUf-m$m5dFgADW-q6^>Hrqb9YPs7;x6@J7H_)z87%4FLa32lwd
zpC<Sv>md}4D~fo>HTVl*eMF^kO%qzitOI-v0gxY8rDec#LyXCTzPN$ERsdH4r1{2U
zENi7Nep9rEwH)$&VkefFg0`V(M2Y9x`JnUpcx))VW;|vM)MgEcmkZ&$O(GE&Ryspc
z#uBF`4&t=HTAXGvAuS_JAuL+LR6wvC79x=_OdSZ}Lds_m0)HYt<l#>wu;vS3y^=`C
zJS~K^OCllTQ5L*dCCVbA0#GcZVI`Or5N;W!C9wDj&zBGf(K0Hv7M-KcTjTpzP+y!1
zC8>Z|hhsUPu&5Ncz!Y$WVG6jZ6ljSspG6o?!{J>nAz?lW2fWbybU4uAqZ~k&k4#fP
z7M%(R@C|GNML+@zt|+-+!4)MZ=!=pcPEh)Ql;Q)@Ge8d#_$g2EB9#Zg2Pj{s1qF5C
zeKHW){Hui;fM=}T5o)1mYDJRBo((BNozj7n?DRALI->&xvey|MsF1zZ>p%n9O{N3M
zJzTu!V+iQWj>=bg9i@frrqh9BT?FVrllynd>fm}hUsZ#>4zim>2k`u)706!c-Ciy9
zVNBUgqyw$qJCpVSQ^;;~9e@v1yxXjKKQN{2CeT5iR~7m^9skjCs!EL#BT43h3mWP`
zt?gk=A;$E`t14OWTsEw)?5;(9stt~(s>WMg&VlUsj6>6BQ-;t1B|FV)HPOM38u|c^
zgZk(|M)vBW19&En`wZk5SqBPbuRc1+TcU;hB6etADeOt1GX9bBZI!ZD2OWS9;B)FU
zjdT!NzJ{k1)~2e}0giRFjOtP;ov9l`4L&A<?D!m5I@YOt%rBRnUiYR}2kK;&KVQW<
zNLH!?lzocA^=Gw42OvAHKdn3;R_xzL+g(1bN*!o4zR3HTvOLJYNyZ0o{q1yxcCQXP
zFsSUP6Sy|OHJRdf5<zy@|3_X<Re4kTfx%^`eFEgiHA^BjYkrmK!4x_$n(UMhMC8<i
zca2`a`c!2ysw+394vZ?hxDVt-aTaU+-hjMLjG_Z=;tATHwMoJ6aSu>x?swO&@5{@N
z`BH6YS9M*GTlU>MjP)w^oKqy9+On#aNmKeDJFfk!H21?hOloCRHBM+szbfm&oQJWm
z;x(NZ`zYUkPnB+{J&UVSE=_2I+(Q6VzPGHyJ5*0#eZ4#QMT#;WU>z0@AXEwPl(jQt
zImq1?K%;x%N@9OS_Rj~odm^7*y>gYVot4Nfzb25*D_kRQVA<V4_VV}S;JEVjo>UpN
z|E6Z~fS)FOR;B#V-*N4;?0a@nvMSSs2Jzq~O=QP9RV6>j?gH}R-f}AKt?<0^cgV0G
zq`<pOO8s44FI6Ew$b|c?q$!k5LwzWD2MzbaY$h+Gs=TS?hv$`zK<*p*$WFDz`B3(q
z;PUZKmAvxjOesIS?^bzFRSoT}NMD?VGS>zgjdxWgKfL>ddtEBr(^ZjdnwGgwqvAr1
z$GfVKAI3VouZ#O<YCqPgYZLND<#;DqGrtG?yp6o<nAgSs5f{K7P1fGCBdK@Zs68Nz
zAV2QKs&u^L`%v=H?~LIdsKexSpsoCf0|0ShjI=k(NBJ6l$+OLPBgl<@gz+L3-^t5F
z=YhW^5<cm84&OCff_kBUkjL1UJ};k^$A2g%wgr%XUu_AEOFjkuWba|B^JVSMs~qou
zPqdRfue5x7@%<{~7wV{$U($zYKcaEaDblFqS0MW`0K@lpF;11^9q@zwllD=XPx<tQ
zq@GIoC3Uc_e0%9U(kdTcKyK}x<7ua-6nO7gWqb#`;CLs^pR!}*`;>~hcut)jY216z
zpFsAh0F~}v7|0h8uRGFF^^?3isLWq!ehrzH_a}(&@LCr4;@b;wAHa~hz<VRd*pYA4
zzVjt{_fXMzWk|WP?+2-RXAz$1V%&qzvv6-b+#_-w0Iqd71c3XP<GvHOqyY06C+!D_
z1;BT%agC4%fLgib{Q~%tp05lkJNAo8<DNYI>X3)=8^=R+W0*F&xq&#VgKV1eV8Ah<
zysv9YySmiVb4*a%*Q<-1>iE!MOsFw^U7hUoc`e3-8rRop8P%m4j0rWiud9=tKCfg<
zs5O0^mQ!6SH73-$zOGJo`aF&aHEmv}c{itK4VX1x)<9KjK)jED-2bPN{256aE=eW3
z4#36)R6z;hieP^PW&v!iAc74KU;_h89biKP_%sb+!3GDIa$y4m+}$7yWTn$E+?Rph
z3=qI>2ZBC;0QO}Nh5~{zzyq5<K*}r>@c{ug769;}u@C^Zg#ctoh$||<bJ&<71dS=e
z@DCV)oft%-csvg&{D4s^CE^q|a-j0Ckpq+Z)D0o^G0h@`g{crWe85y7N%^qh1Ljc(
zNTE3cQ*4fD0i@Yk4$;uuIxEY;S_r#T2m|aeWeFT@U{ed!17QGADFJkthm<Qs77#78
zK^6fQ3sb<&#T00UQ7Iq9#h*YdiAV^N;;(>e1`W7WR_b#-;=GFgxK9M|L2**PPXw@K
z-X{W;V*Z&mVAg<H17;1FHDK0&Sp&w=K(`sh4#7Cs%~-3m2GH*Cj`|q{vkz2fOBtRw
zDcjTU?V5eS@M^A>7!}yw>;u)(Qif+rh3(BgV0d*`D~uZ0-s}U_%3_9NMhn}UeZX*P
zuNIheu)Wy_s)gnBXF?C#n|(lk^;and1K8f|16684-H98}_GTZ@-3(RI(g?OU`#_ag
zQhTCCw0*7c0eH_6->=2@WU3o1guTgaw6}Og3lrGBcKCq)-!nDzyPEmz$h;vHmel^p
zgto8oJ^<g7#630eooGYbQ5SqQ(e|~#2j1ZLuZz75*`_AjzDE0iBo25~g+5RlY+ti|
zU|HVyDzblVvVBeW0epYnkYl<!T(!~mHP#1Uza_Q_?O&U1UxR(XsCy65<3U}peU0=1
zc0_J77z4EVo(gSKP1Cw$`<m$klKu0IFc(yJ+n<5&m*5&;+HQtSYs{Kb$@L)at)yw6
z*0i2M>~AC+o%ukr{@+OW(U)qD4=j6w`)+A!S8eK5M<1YUPv2?A`^RP<p!VcDPzQWK
z#`b0(pfx~!O9-zAjrDAxI*bDfZBJ{!JPuG}K(vv@0Gu<b(g#%9-s}Tn4ZuAi{GQm;
zTIK^9+1~5}v=2~w^J)|0X<OHn<A7GSH~Rq00eq1q^ncu6S6jPkQ{NOmpp)&*K0w6*
zJR{p5eI=hWBUkUWKT59M^s>F#2dL|TJ;w9_cYo@eB>C{oK12I}L2O^weE{}k$8S#=
z<$914AoHC<L;8S0ZEyC0yeLDD0ZP8fWe^|0d%CpE44u}+`va0^0|vVu<jj@%7MJ|@
z81?o6L)%;)U!C-UW%&~gF$QS(T~f0T7;y}f_h(J>V1K=?2RT8|?=}B6v)Ko#nGfi*
zR*d>KyXLm1=LEA4R68G_zQ?4^Jsy#cwm16#tQ|0BEUW3bFI`WvR!rmTLC#Y6_N-41
zZA)F#x;PG0JKNKKz+V1lt|qY{C#2GMhjq0-wyR4%P;G6GJ|MXsOjGFt_}%fzdiQ&I
zf2j*TP_1oWJ_e{-D`p(q)4oufeV|6zzQPCcPE;BL_|WhDWbW(Ib~9vJ8-1Wg*`AsQ
z#P1GO#Dd{q`>95^J?%%e$p>nj?WM+mP1G0=0k)rJGTYZCAE>dmr^Wz$cPJw7h5MH#
zw|#B!ff{Xl%KrRJOL(4>4A*D0J*pzDiE}}Xx4k3=*Z}=s<UXa!`akV&HOU8Ri|r%n
z_@BDRTeV{V`azBGf$DZomyYGMN#R*gIBk16b)Qk?V*up?+Q?z9tGx!m-t%dj%cP+&
z4`~04j~>4bmTE7NxrL@0fPU{IV{^In;hZ@t*Y+69#;W2?O=U6H(@q0mdwf5*Se5;$
zSkSjhuLbZk!RDWVH2^jr0#I?UPp;of`-FyTyo@#$7+CZ=j}B}*KvUb(eo&RygLU3u
z22=ohS#BS&sn&Y~ah6tH9AH54>oh8`eFw0;&g;J2XPWGKuvj`CtkXs_knj-e;d?*&
z?GKC3f=zQh=-1UN$CtYQ1NWc|q=Gt&Mq+!_>w8qhe{>9hDJRgl^FUYcoDH<0JiK#z
zf)6~R^V+15lZi+d(1u1$sLPJX$GrekrERF!F+LlZY_xeGxu=ipHzT@w<u=zv&$`$i
z+vq~8y0&3Q=GuX+uj^%R1>*u|kx|BgNA90z>tt(1`mgKu7q97jW3;`X4ZJoaAIEw{
zcGR`3F56$Sp7)5M`@J+iPB4rChKmLLbhWdxc6HVMY*@bmb~38%X+Pl1);|uAj`x(=
zQkU{NYyV|$jJm%EZF?%k>p}hA1*#P9>0)a|ZR(=^;W}@<jC~ZuZiYV3nWu9sXwZ01
z-UsTM{lWH?)^8Zv)(Y|A^`Q3e2N*owtIPJUGTTeW7iu2>?beDJJl?CT_J=+hps-(>
zVC<KstLa)XW5s)Q(f-iytLl4SmG%pu-VIiNJ!rIeuddmjy*%#|=zpr$?wEKC;E4DB
zQ??GosPSH1vOm~e<Fz}|W3<ta@qIzXYsHKn@6{Fivm@T%9<Ca#+cLVn6^t*O`3kQG
zjUMmS1^a_NJpi;`yJKoUkX|chs(7!q+h5<cJErsj&XV#mz+~}WZMHwe`M7q+AnP|w
z<p=Jwa`le);2z$1fJySU)g*7q`+t$XWD@eK318aQsfo4+AIpd96TP12u9!?bK&SbX
z9sNi&--lRgqdQaBKgx&L0G%}wTKUMcHax1UD_Og9%T#^VfOPbV_n<#D1D&SH+3-Z<
z6w*wc&gk=UZ8csCMz>d&N_adWM<)%-)wR{+ykzapMFZNT(mfj^;Vxglr-_{Mb+Dg<
zPUZDV+b?Z}pJshb&MtI&wW&Nmit>`NDNPBD6F4p?YNu(LWc^06k?dnkKS*Xr$*$ki
zRA#y!=rmf1UTNFmoS-%)P=kZURVk(UP?k#OdhxuZe2wWEW$o3Kn_}&bk^Jfryep{J
z`aOwmE7?S$E!D&X3fm~RS2;~(_K}<G%j+wp12Lg8T*}HNYj=$Gy-s8Hd&9<i8rVsq
zccn3bQoE?Zt;jY?=6ZELpmjV5{qjd6^-W{i9&sBZ-czSv`n<xJz)<#AGuP8RC`&bt
z2jMzzT@AIpG2=aDdX+D)6cZT2{u<8p^1R6B)y9Kh`>I*Hqu~C%mOf~Tcu!uR%JWh&
zfj;)vdahS9rvNWX<3Z4Ou$DSE_E@ede$&Q#>UB)}1r-zMYJVN)dYZQKR6#rlcCQv|
zcXaSSz2iNMv%p4pe^=eLlyaRa_lY!}?O*x6lP>h-+n|gx_lIH6{n4QJYPEht3qQ~+
z-jj~8@qP~IMjw00>$<w-E5)avXI#HgQ*B=izH2c1qc1>=jrV(%-Sew%_SA--6F8qp
z`#T=Pvyri2|9F6!cyFJM4>ss~uTNSp`~YGJexUB&pEkO$(z+nanyBgO?*p@!7dwJK
z;C?*#4Hmrq$8WM#+x0!b8?HY&2M`70KnH0X8sZqnfr$XdhzU&P50$P(wbhH{TkUPw
z%kzi9wV^+Jvo{)2yf1iNqJO#%8Z*rVTIh@TK3OQhr(o~S$eXtEXj{Jq#{`w;dTnLb
zq&_>c$PU&4!d^aa`hbskf^B@^7{`xg0N^Wmu>df?yh*GKls(}bRc8&Pp)mf;fOH}?
z4k2C`lQiMOn00DkOrUVCH>QqiJMNki6KFcu*LHguOTKCx6X-qH8%t-k4R1A!2~0BA
z*ET!qBTqGo3Cwf7K8DnzZB@qv=DA)E;~B7N6~qMQx!!>GGXyFV#sucM-Vg>e0uB?z
z1m?Nk2zE0hN@K+Y=DFUGRx&;=1I7gAx!(BZG71F)#02KK-YAwa9a24F0`pvNIx`uS
zlD08{d9F9AIjRh~1~GwouCFrdn1-;5n7};Oo5loHPDMdXV4mx%+$yGJfQ|{wbG>Qx
zZl-3|fLQ}(4VX1x)__?9W(}A%VAg<H17;1FHDK0&Sp#Mbm^EP5fLQ}(4b&A4hz#~C
z3zJ1v!j;Vzuw?UD4zhWnwQOF%l+E)QvUx&e@@0gCNf(q5!j;Y!5W<qqXAvU9fRGR|
z18{&<1%!whfQpEUPl%WSDj!CDoSVW2h=CO#FJS=l3=xo*Fn~u)5mk#~0Bc%{C@d5M
zn0F8f;lG3dIH1VW3_zYDPcy(rLQn`liUEE_J`4*4;`$6I=VD$c#>a$mmL!k#tf8D@
z09ZkO9H<m3K#KgbfMrSpkfJ<X5QNeI<Wb%*WE}CKfWVLlc?yF(mUBhnB2*byl4ps|
zP>iu4kM$fxPbtPI1|V;Z<un7(jwVc{0tsQ70mxH?X$FLl4?_f!a?Eov&lfWcc*T+n
z#CS1J5e6k-H55p~097ou7<Gb$=P^%74obj0(v>g}R-UJhs8aEHE}j7;z>liW!Xr=u
z{1Bg*fu~d+>5KDJR?0WTd7<2Sfn1(1m&dFWK8n0lo+2-mr^rj?Q9XoQ7V#;WDKkMn
zvpg@r({PSH&&NC%iq2ye^(o1hlUI@#v%@N{FJ^~Zo)@zdR-PA9_(3xgd;+;VAM?n%
z<UDm6{Yab_vxDXq=PR@!&R1wdoEMX4i70*K(AwaNmSOwTlv4wRFcAaue85W41Dj(W
z`vsj3<1-|k2H7hiEIy-v>Qqnx`<nxwkwsWycCbHM^BF?oK(iwxOg=+Eti|k5;{~4q
zY8FCk^lkx_671yg<Cf?7R6a~3q*7unPQt`K23{i0vw%MJV+qBH*k`GJjRl}Bs$6mq
zhT6jdiHAT|OpxlXn4>zgv=fR6u&7hiKT1$;MV_)tSVbNQNTH_)NTC;@L}<nGA83Z^
zy>tN(;L^vK0)a5;JV+#yMSIEogfi$sA{q2BY_Mdii{vLf*|XI&w`!#4;0Ctu*n%+|
z3>`AyQ&2kEmDtpSWYXN9rxMb5)X)L_MhD%^xIcW(q+5%vvqZ-}y0dZb2dx)1JlJ4$
zVZCFATf02_!KLZ_k6A8FIy(RS{lGTwPucQ#rRACJ-c1ID7e#vZ<>y-2c8c}4Tb|$8
z<2u>Z&~i+>f6hB~+q(34Gy87M|Gs!Ef7?<o5m&%(yZXDXZQ@1W<=opcjkMC@_rsF=
zx9<zq-EWY3ao^C}USxgXqPxTUgk-q7Y>EnVZTT?b=$f$PTl-IWTyI94HaRT%?AgT-
z-r;tAubqzcYkSyn$SgPh`OUG(MWnREXIM6qSHHA`^jJ7{w%hfeR%BQ?z8yGu5wm}2
zJ>j}uqW>D$OiDQ+Y899jpM2<)U*jOlgne<nGxx0i(M>=S0xtE<++&;MCTK|_zbsqq
zJtixJkw-f8nejAaOuu|9s2uPO)=0$4?9p5}+>MnBM_h)=BeC-NIZG}V?~Zt0Kg)&}
zy1Vpb;-8sG(EUp$zk<WmB(jt|Zh8RFJ;<}V&2$O7-79m?>)+f2t;w;=TXK>*g%w%Y
zk-4!;p@vs3)>w3G@q=+s272>9By%^ULh;|ohs%+mMNmA|o6q3A%E|}S$0*eGl7aYl
zFY52J=H*2OLXFYh{K4e6_O}6baR{RxxziBD`t}A^_Va2E=*AXXykx{o2#m`gGvNg?
zJ#|3XgK<+1ql87-C%wPfk99}8ZOgyNzS-2rf&br`oKWXMMHYQ5VnX|5&K&FQEx1Tx
zG7c7&Ebw3?tpBms`6!VCVXoTvI<D!ncDzNoPX|T3a_N`9Zu0zry<hAOZSf8u_<Y9m
z`r{q=*L_1*-Q@icX*t|Auvf!^!6fEPgn$2pj%~MEB(A=16K>z;xZpyVMT?Gs9omMb
zIX?4fG~X@v>K8sfK@Xxz>~@3=%6`^Ay-QM3^3E6aZ?+`A#dR-kdSwZRx7zYjy{u6k
zuP*1!*q-p>csy?$X+c`p%%3X^d#BNzcbR_wTYd)IZDmP##*_j5+Qk+WJ=pk_+xE8P
zk2QUUW{qNaY#-1md~63Rujj>G?V{`~CIp-o<RrCSQe+Xy6sCA?{mQmQqxWro>Jad1
zM^|?eH%WLT@vT0g8KE2Rc#U-JlbJg9m>at*@nqd-yK%(fjE?+&@;<cR(mbzO%TsRx
z4^LhCe*Nr|nX89|gkL8;?+*WLS>KH#THe`o+PB9D;r{798R@5fnY^^)JgBqn>kvlZ
z!43XHR(11#l<{ZyWw*W4j?7M+++|ySi*YC2ViKagQ@s}c<$1VtQJh;Dbc~>)yNoqy
zQ(ku}D(u_$-t1kWgXZp!TX6Q{U(WAue>R5m`4*oim!c1hnC<4*rEh#%`$(_BF+`BE
z@aForJ`zMsbr<}WG4QVi&|6~CA};lf_i)X+lr^nK+Lk@!RGf!%ue`+>4}O02X@v9B
zE{xYFSt|=e!sl&bL?6C3reoH+j46W$CbWKMeBh4a%P)$*-%=PHJ}-xK@%LNW|M$`t
zS6tUmzp&}6<*zPf?0FEEKk(NlU+(`qZR+APNdhR@z}ozQ<Ky%}hpod;93IzV%M;e&
zYa?d4SuETBS6(CAXRS`ZlQb#KBlM#8uXB70cy|t!4j<Y5$+X_{T3v}{O^Y8U*!fLP
zydVx5^&Wd`-=ak3^MM76*h3zqggsk2WzrYkX=!I%7B_Wlk(#zPvdt^s5f5$HulBx~
zwZYYAv*6z~aUO?`uSm?y>~$)|Ih|9lbkWYz{_h@Hl(;N>JmYNZ)Q`6eef-&hZJmC}
z^-Y+T`kcw=eDWvW)}z;)P8RM7dHSox%HWy*Z4~|cmB;a~5?{q9#)aJvC0lxqZJ*vS
zsp#3=U!prTunL*^Vd`JumuIJaJ003JKY8@uD|t5`KtEg>5^i75_f??h;!auH-@IIC
z-*@(Hm*U~4Pc2+@^wgoU`m;sQv*VI@O_%vixyspfWqj7hFYYWL(Vf%w2kq<l>?WY7
z9}@od@Z_P9X-$Pe{BFIP`}J#g_MVedVUwhi=~hcKe!Wrb{l|k-_Q1>5Lz%JZ!TjGD
z0mtGNc-!s!-I2Yc@YD2%SN-q)c6_zltsac*+gJ7;!`^?=&84MtVbZrtrX^g=_$AgZ
zpn*k;u8TU&4eVxB3Imq=t)}B|=f;jM+IxDCTkEMd%^HV}x^gZjX?Ibv#V}yz+XwH)
zxcZDgKfGT&3`hUHtlyz~X}d9@^G2@VfAO%J)fqr>?S9h^S8`*2dU8M9?eGE5E&=P9
z1J~N@>evj`ayW^%e@9xI*>fC1pNDP?+#TcU>S6T}47|G^H0^K?TD?#BU)Zz}9Qx0D
zl~X~g)7pn86L$xDCyc&6=j)q<@YlS!GuhsWb2fR0PcRH|1B)%%#)fV<XiWsW`VT6+
z?z9#L%wdPzMt=Xi$F7aAZJ?`Qg2kYtX-<z9d*A;(iFas6+D~^ah>+KC@+5!T*C)O2
zy-eagfx?MQ;$yS9Rk81}{5hG&{(<_*yAOmg-UpEn0dhxnzrGD)1|QA2<$ZF|x&Qj-
zy;{HzUiUO)xM#6N;lvh$J8WO?b3FI(^*N1&%ne80X5MLfzV}Y<pT7=y=e<pNNf&1&
zUhL3xP{iW%=k0wSUt6*;Zd7FMhP3#?&u6t__31OQbn(T!<L5&LF-fx(e9|&C>CyKw
zQ5LU*(lhxtKfZG$&8f}Pw;>`7>MQ7G?{u|wnET}Rou16iEV}$M`KnE?OT$RO?wFRZ
zMV43Ma{{-d&awUa`Y)EKkTDmMHkUr*wrhC%<zBC$vlBPn^Lw9=zZ?DBzmt>bt?pJ|
zw%fxXY|B4m&RM+PCrF+)DrV}wmV|ti@N-FVqfH5SoPO%~oeklSiX466OyRoZWAPVv
zxC{?yM~J8M!~uu0dpN{Kc>KMKke*|v|Jr33w<!9HQ8Avqni8_pc6jSzi^bzEU%w1U
z8n$N=;pp#&T6HPz7}~G9)rE&tlL0N8oOrpjWWgP$wcD;UNWezI|8rgP;@eJZV{;hf
zYzvFmZcp5bJNk}d`+8Xt$7wd_lXzvfik^Dz>)6a~js@t7_X%_0;|+INrRV(D4nN&&
zu`}WI85QZ5yzP&)d#Qe-*dIKwB5b?xE7RUO&%N_@uX8(mCY`h+#Ab2A%05mpgKzq8
z8-99a(7WWvUHx5?BKG}#F|-p<k2=C2b|1MM+|<zRot!EDuCr|a5WFDd_pNOcatg~P
z-aNCzC+nmGarw?MW`t!-s#nT{S+*<QUrC5pBtP+h<*Z40qt5Q|5k$O2e41G#**jej
zJ^TA+Sfkj8hqj#{_T6ba=50W`9vXEx3aZ>;J9K&o>&@}=CyO?_O`bVr6uW1?dPI1Y
zw?0`=I#|SkdTno`CzFS-JbCA0M%4c%HsX}S1JU-3lxxBL;L71-VPM{_J#MXU_Wk$b
zKgXT7MvO>I&R?~><gdJmUnU8eBw*e~e(=99r*KnxvrlylI#`r*^ZJX-%#YH)%4mDd
zH?*(ix4E-=hq&+?q`n~he(kgWd&&K{OJM%s<ih(q$(7GeeGN|f4R2;{c5>mH%pZzc
z<P4wB{qDiSq6rq`KaBnJqwsszE{4p!;yiS+)#9?tjb1bO{}x!kP5jrqj=G-enLM2D
zFzepomuntw2(<{xWnE7h@GzQ9?ll?c;Pdq*=(Oj8w_HDXigarKCv@*Ja%8xJQ(!@1
znbWT6OdpStXZ>u>bLaK=#D7(HLJo|IeEdB>cxrLW#&OOI2>Ex1?c##9+||5X2Kk3O
z^6VCl_khODNc;b68PEaaUtf*Cca}68b#C<cJh$Tixilk<=X*M*PvOpO!Su2H9FXPT
zE839SjC36x*Qt$z)#LpcOZ$1Sm_A>18WkCICpuU_#wYwW+SMzswKtnMIc@3m`1xkH
z)lN*_`u|3|dY=ov(J!dXb2!I`IPL3T`IzHYyv`=v)BEvzhi~=E;Sk#;;<;gGNav?h
zxFm74=(X3){im8F-ar0z`c3Zk1rIEl3Cm&B&$tlY%IoBbXh!GI;r^cwb=~KXJvaGp
zN8v|ft+=yxIxr?RnE%(fFW}^$6o;#Q3S+xGzGj<LkoZad@IdR4r?bh-M&|=;nsC>6
zN9UwCkW0rGTHIrd&h>3SJX+Md*UDaGe96{N+{yy)E~3ia&rN;Ank$UR`1bbc^jm&`
z+01S)Et?VNT$t<0xIo5AjwLks*;%ymrlSuT9n<D^pVE)~Tm|X3ej1-0J-t4o9&hO2
z)aUgc?>Qo{fDf2_oxI_6*tiKLTfcd)tl|5vjs=M`KK$zLmmjZwp4iAK@#8k!w|XGL
z(eIV5|I^j+S>l(cUbmgKZD}s6wb!O0WnOo^b}R(Za-Bp&wmS-^2qLg;_pGJghP`_&
zmj7Epx2vC(JR0_StH<^U2`9s&c8kWIe1Cn(ZBZOq<GrD1HLJt1#-RTzsl&!u#WX2w
zo_%<E!DnF~@lz6qo=V|<+7l$R`tI1vagTEzWOqeAHg_yr-``b0MtZ#Y&6|-F31}K0
zNa6m_+~SM*KhGHZQ}&S|WdrP{)%##=O5&=xbk>o5obxUC5y89e-3;6MxW!x9hclLX
zybFzrQye<Hw7eJEVJ>e@`{5g!TOUvMFWY(cST<VfUWc;4uBh+MF+<*542?{B6+Lg|
zt=VZO#sLdQ$CU`aizDD?55^v!xE(0IZrr0ku)HcZh3nqUGRSiC!=K|0KW>!w0!AyI
zy<J(%_}C6-({G*4NM|kjx2K?mz|Q@2#@#h6(r776(%Cc9M`SY__h!@+I1SD?XcgZ3
z5C1E_cV;w6ZWrn-+Wc_i1_nD42Dd-$R-m-pHOcimj>}3}^tOQX+<D~NUu{>7d9R1R
z3u?!5WC>vkzx(ZS{;eH<?CKAaSab~KGXnm|$;jO_=$)|o|8T~v1l{sd9J1Vn9Vc%p
zwY}19<Z>wSNpT3U4w!Luv)jA#?VP^Ip4rGJn|Y5xt`yHm{^0ztyt1e1+)ltzcoQ!0
zKa!bt+w1o}KTHVTh<4<!Vfl~*U}c!koxBg4baaQloZcg=EbmYvSD0?yjO4i$J5Sit
z-=^o7l6nu)lJeeIPb%R(W{h0$*QN#+dN)dco$DCzYe7`XsMOCsdv{{8n{89BV_@Sf
z(BkWQ_Lf%;p4#Z%&U$svi6xH?CLcQV@Xd)|MrSh{W)g74qKPGf3%vCkuKKog;tJ1r
zy8M=I-ReH$Xy~006YL+0-us|*^7AFx(eviDcl;uox&9RayUb4Px2E0)>o$%{aX5Ok
z@yde*;Wo^KR~+v@Y~~MOzSlH!@tBg<ua@)9rZ@~(XbBfkiw`bmW-<kt>8xq_JslSV
znhdh7hw$v4(oS#fEMUa;W;EgQS1u&|Jj#CWR2DdOkwxdSQCDA*U)C00>v%8S`jb~+
zoM{90GlLGtc{%_5v_apsHYW<s-8j+MCp*4ziapOJ*mr4zCrw$yvzZI9?kFo3@$$}F
zv!`HiZWLJ)wj&{$bor|A(<alhqp#0v?vs7lIoDp0!tow9zJ&i3^rf)xeHM`iUU`$V
zM|3*UIAB_-Rpy>!>DCqx80S|+t>ZQkd890|@ZanGZ8j7(;Dh7Z3U_BLaQZzxe(;Bu
z_a=#2ja|*M@gTwP<XC|xPYtv=da7)~FV0*TLxOtzyC%i^>`TY2$)y{9X~K0JPnsXP
zzR_v?fm8NVI+wZs9mV&4!P@UtLiYI;pGX*$w0!u(>pv!sI(gj1!#3PG!J$dmVz1JF
zo<5wCyc);HvwcgpZn$mLW_-yLt9h2^-`$pUd+-l!t#5PTf@|!pY;f$KCNZuYDt*6W
z!iDt2b}PxV+1vM644IwyqsI!K-FNSWy2OyISHGos*oDXRnoz<c4B`DL$%~s=xXwLX
zz_=XCf6%?G$rqE^PM%G<!a{pNF~|ErKzm1vr)yYQLDpANhhA@UE<9twKdXB)ychqk
zgnzC#f54I@cM@%0Sq47_3v8>$zco2&wXaRV**)pjefn4gefaMl+m_aoo_?OqZ25}#
zMWkMJ<_hBYsV6&!3J$d3?b}qkTIeb0_Miz@c*ox5_QlYF0qup25`kU^vgEVpyJN;5
zI%VIUZ8=F80vN1#j?h0>x%!N9OmPTmL@pm0B}%(_!rqSYZbZjW!LoKf2LYka<SXAK
ztY&5TSPL^w6mLEo$A9azGgnw(&xcN%?wQb~A5aS-G3S1NE8GYB-^jQUhwudI=zd9q
za3LPWyj2#-b4qbwlk-kt{av<VU-bLB*wt}NHq(x{U%KzO^49{q_aOAL8889H4*smb
z_Le`q4`T+e`yGeypD84>^ZL6KVbjMJIWUoMPZO6Oo9i>0h?><S$9^nx^vNCpq(1u(
zi=5ydNi-H+7C^1%SkxSf#=U_exN+ff<XZ<A*esx7Vvx<g0%s06@9-ZWbpwiJ<C{ar
zi2ypA?qE?k6!l_3(brJ4bDS$_!u{V`@SwmK!)7dfdqAb%*i!EI%sV%RUYZT@9w9>q
MdJg!tzfZ*f0jyzlfdBvi

diff --git a/client/ui/assets/netbird-systemtray-update-disconnected-dark.ico b/client/ui/assets/netbird-systemtray-update-disconnected-dark.ico
deleted file mode 100644
index 123237f665722d0194d825033775bc90616a6a3a..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 105086
zcmeGl2V7If`z0(z6l%d;L8}%)A%K53f>!G+Zbb`%3paub2P6SRTdbw6TWg`Tt~zjU
z0ZY+VL~w$l4HgkZEhvzHjQqdvB@aSKLN=hu@Au{2y?1xtyu0u2-Q6Py8evG7nGq0L
z5%cv4!iOLTD=R_#Al$zN_ZSReyemPhvLFaoS3%r*2tjllKoD%UFy4eld=Uf%zz@qa
zgS5V3G{PF<P!!w|+=qZ5pxlHO0wCjB{^Q@)Pe71_mJ!Mw2#_KM2Othq3x1H7gFwYa
zLq=#Z0cjHe_(FICp*5s$0uU$+$^4@CYL>xuggh0({NwPMFfSj%zX4tf0k831plE))
zhP-<j!CbzhPtgg-8HFt%4dRa!rpG)K;Jqdi@>@A9D5`+Ge1J3nYkrCu(y<VrR0s?C
zDYdc!?qWm0f68H5G3KS<4P3h+9>_ZgK^!N>Auk>B9wK=U0s3cG<;QX=9A_0W8SBY3
zn9fkN3`Phk`#oe{q5K_I*Pwy#5KxSIIU$5lDnEnGLz!(B%}ZT7%r7E&aPTMdQhLR(
z7@(toZZ4BbUn>kO{@Y<qaapbV0vZnq^LK&gZU74bRsi?{OaSO0e2#I-CPZn#Yl*U?
zc%wo{hqk>BAQ?c^#v`dT^%e5@U>7+A5kHS0GJ%Mv00ju2L;N$iuO|RD4Q>Kpz-I$s
zJ^*ZItN>gAu>B!_(D2k}J0l?C!}y2#903p~ga~bOEyPQ;X>s!67uNetP#+@YfL)LV
zdal|(W$|N4Q09C9@j5LjKBqQj!5!7`lkMs4I%wD>iW~6R0T@&Fq~YhM>KkKPDxI_t
zaJ$ODp9s&Y+IlFjBLMb+$#{)rLWs6kL;v^;0MlSvGMzO1cpq>al|Vx_+-pbWgL04`
zER({8We)+UfnRtJpHb;BPnEo=@<c<xV+Ftyqrp`)4U~a$7cCddF9XO2pm5<e-lO6e
zVjg+)5GINr`mIFhcdPhETA&<CuA=43x~|fbC@+$(0k;VN%AC(w2Yt6U+5cw)4Shw^
z0}ZH$Ujby{#b>|r@5q+BXt{U|xIGv_fO}>Q-=h?0s8Rof{*WKw5SKOL#e05|{3CIE
z;&H&=1$-~WNBK^o;Vwt7!m7G}c>xdFpQugXHF)TX{{VM801hd8$@q~LSvDcJuEnVX
z-_IOyrvZ>{pTlB--z7y3l5IjkT~jmwPBQ@Xi>ljQ7Wkh6`xBMF=yffdpvqGu1ip;{
zujrVeiUu(sS`>HHHOOff_{3E<0cD~8U8BxQqeqzb0)$mKYh2g%!K?6+dVxB^V3T>V
zjYiu+!0SuWa8mcdU)P6plG@xFw4l!}#Rm8et7`b<*lq~g4go*pc!R<x8Vbi5zd-sL
zxTM7$g<}9wIvo6J;FeTQ29#H&7Ye`7=h!9<m&E(n9*NXPv<r#pYV)&#!b^paZ=;-f
zYv6G3h59(Bi0`mgZrqq3$G>evaIaPZH;#L*GFZjl5WZF-f20V0JIFr^U^4)Y1Cs!r
z0K5Qr36KSF7vLN~1i*9vQTnGqyoOxlh$H>IC>m4^p)4N&Y2!(0v?Ve&@>E4#l^^iq
z97P;}G<=foPp>LKO&5UQ8elQN4uHryplZCYCiJ>u8kq$6Rljl<KEK?hga`zHkap9l
zoVLDGCCoEa8i7xx$ENXV@p^oAfhnKe*OE_kaH%9(u*wM|ehEQ~gt-aJOoA|tCkP`1
zHbFp606l`n=R;n8Jj_cJ0Mz{9JOu;58=z{QqKj^x0>q*Fy=M}DF~}T%NHM4}hHA(x
z3+WagUsm}N4ViYNO;hwkAB%mzpNdfDe2fO^?*O#t14!~w<hd8a2;tJ}(!ZwYN4!A0
zGJZ7jb{_y{#_RrRmVWXb5sr`KkvEkFb%tGNjUUW0(gA9{h?19neyTweeyU-e`mBKz
zB0$SH1?a~yfW+}A(76gA1pqvO>YqIHV;*7NRn<A=yAqCpFUiRRQ&Opb`wIYS{tM@w
zzM#^<HMady+fPgjK+RiW8C7|yGU^I}b{x-@*1<yzV}0%V3iwcV6n=_Mq+=D>1RX+&
z^b4P%&M3aAyjWHZ9o9uZJ_p*j$e{l|&|a&)@^6F93T%eLEgl|#=SKm=@8dmuCVroa
zqaD_&OS1R?+FJrh8<+Q%l$U?o5alaLh7=tbR!E>z(mg7VKzFzGm8r}4-j!-+M8o?q
zzh)ze2fPRLiP|tlhcaP}x+4vrwEIw(an7&SI~)f;at<{g=8ncm%L_bEZHO{-W1d=V
zmo!|m?gRZ_0AM>w%3o~mvkZ7(I(imK)GgEp6QDzuT}$H)@)(%NqDzryKzj_*@36e)
ze4WVLT?|~;s?Uf+_&%YoIzjP)YcN*9`vr;eP=sdDv_N|ohn2-Vc*js<zEOmJyni2{
zRzFOY19Xi55N}s0x-rCOBdGN141xYJ4oi#BR%FqS&#+EN?2nNiu!+t<<81&@y73zB
z8FW@B%~V-HJK8^wT(>i;PWq7tT%W^q@_H-L1|-yp1Mn_PZMII)jUmw89{}fi1$B3&
zRQs2tml&`&$#nwSa*+8767DMAu8Yzr?Hbxn^dV~YU-;g`N9Ow{aX#(?4^r!dG~BA*
z2fA$lawxfrh7S1twC;K!nue?s4DWnZ$&xES&}s$nRFr1%YllS&=>T~l`w0iHxB7As
zp=2VknKnRc-Q$<K-yw?1zv>#^v4GE7+(Mi@z}W&|p!j`7;*cNTv!(!u`Z-ds9sCv3
z0qRUxHjXu`d?&cZxq7^Z@91jrCJzrFcjW&%0EMIO5Z6K0Tt`?X=UVjx-)Dl(M9Rl8
zCyw*n0Pvc6wox8>Mbp6h&L)umibxq$S#^f8-hqnpAY9)lULL+Hs`9IZ_=_Qwd#ob#
zFHb2$JC(<Ao@_gku)b295Ak@6sC=beGeUXzo*CEhisx4>9tiEJ6u$`lY$eMdB8_gm
z5ATX`ohz<8Q?~pX`5cyr=>Yg~SfSAS+#2NpT`7z(p2W765n6<_N2rT-vK%(lWoli{
zT#z~FL=ELH6xRVGgj^3SeNC?l`T%+7lQIV%Lk+ZJ8TjtnT$Bfh`vQp9c~$UX8-nXZ
z+=Xp$)jA!xr%Jh0-XFy1?+xW550L=)jvoCpq=8B=D@4B07sY(|Uf3PxP{ief{%T$G
zMzU~-KSSE8`Z`fw@R|`?f_0%4Ko0;{09@Pc0f1`}ya8~X!5DzP03CteTI)t?mr3T6
zS0>{0N{XKYyO%hY5XY^KID^dxxo~kkMInGBdX%{*bxfxYnkAJ1w08rz1fY)k_7HTh
z(EOVuniRbUeI)8)5CHa*HOE4V>qg<ZXhrFjl^*2>Jm5PjtY6rMDEh9-TUPnHXF3V!
zB%qUkCM6(PH3ajJ<gaEJ4Evq%wrE&M5G;&SAtoW86SSP*9Eh;>vVyN;Xmm9=6vB8|
zvILu`_?f088~jX5L0AAwnqVapzrZMyz;#e1v;qQ>@XLvE0+K+;Bv@qVLLib7!j!~Q
zKo})pJd@BP_hiN6Iw**<fiMiA^nvgP^bu`X1QZ582um<@5$yHCFcagJu-6Miz{?g5
zfgbWlhVTb;77#1}AGqKO`QZZv@Pm*n8bU-VQH~^ikU&z16M3!xY=EkDT5v<Rp9}<|
z`{^X0lR%@C0K7+W1z<`6*G9>d0z?b>7JsKl#hD5e)hLtd_$O_j(zkf15&aA2aB<E@
z{ji>ErHCQcm;QnG7yxDFb7bYg_egCT2mi&LfmWUxWq@V%RfKm;TVMJ|+(7R}HS#|P
z%T)ANzx)?h?`>ACF6>a0Zz_F#@{crt{%5FY1BtNqTI$?5u5SSz4+C_ecoq$n;UCr(
z<NCP6{5z_z6BG6Ye=8{ine81vg{<Gynom3fV3a8Dc&#Y^!22l3gJoe~c~l+i&471&
z$D!z4d7bSY(6?4dC)KaxTG6$*u8#Ua9DQHvxp-LB|0ADd-r8$W*HUGv5(59fDrf^T
z+dH5Y^(1X=>`}^gAx)k9!}?~dLzEqf%LsAQvMWVp0q+~y0sr#8_mSD&0X<khDH|21
zmx|vPrjyCPu&!fTDxahfaY<}n6p;h)zg7+#klEfLKA;8LJ4tkk-$S~u$ViLN>XIW>
z=3zy6m6R520N>MaWXJ&92uDeIMem_)1KrZ>m7-UjVO4z+r9+u(;1Aye*X85Z>E{X8
z4rBW#tqo8I|5)~Fb@TzEvI73&q{;x-d(0)zLXp}2QRM-BqWzURc&5t0dZBW=N6{%7
z0`GPJwfjTC`F)~m)po%8cd5P)RVL7h?O|PQ7{!-7;eGI{RBrDm`Xq(GKd#fLt_QgO
zR>GMZu+}XR)?n2+=2K&vptia$iErv2tf|2@nS%9&z&o7(BdT}t>uivLrrQLK)OCtq
zNg?o$@9Oz-uKAVw>>VZA1dY{oNqkfH7$Jp*aK_3@(e<2iT&ufH(0E;^_!SR9_Z#87
zF>za$C$6qGK`V7#oNtT+?}2Fh2#&JrzBGBL(k5uVu8Yb5c&@qkjtMf5vd*@S`k+jk
zP%m|z;vabT2B_8d!yYDSdY0$D{B44U`*n&>Ng?!k==(}uzlgpMwa!<uJuH-b<Z2Tn
z(WQ-h!1o9Mnd?tsA0EYvvY}jUf;RXS#Q}WdIzzeU!ol}fmUk+j+--s=jhea!zHwb*
z)jm16uJ(B)T;o}5b+mc%KHmZTN}Xc|P4SK8LVd@z&kC<CmD3-TEr&U<uLsX1Twg48
z>;TVkPuD_C$N+e^g0k^!Ihp#F_*}_7WTJM1=b#JA&W81|wZ;zc4CiEVei{3s9_o|<
zl!xc7Z~!P86b=>LgC@#5`cq=KvE8kjPk?J50MYg+PF?(itXo3axaUor2F2poAIi5U
zxMn@5y`N1KFOIouj=QVroS>=<V85Fgl%K3J??RgJtj`*HmBTNPvL8-V2GXuMP-m51
zhYx$7q@L-jiahGtLnkU91<nYSCWF<=*Z|56cs!>HpVIO=;2u1A^bY>Bv@#U9kMAes
zI!Bk16C;e=^QMWl4pscraV|1niG7q+WlNCFFBETeg~E56krK*~RlefSa86j#xy*1+
zh59ay4(tylo?#;{4@f7iEtOWb()Y#AMj_8CU<9ey$5gld;&lBDXUEFi7Y4kCYFzK4
z^x^z4_;ff%RB`{RIIq&;GsN{x#er{m-s4FtSK0g7Fjuw*&kE6!+_PbyZ>_UK05|$h
zwdOB0L=z9nJpnL@5h57Nz%}kk)s_r4QaYzX@b7ReyBgpqz!Ly<$^z#`?gC)DG6`_i
zIx_+KT3lBqcyFM2Iq-l6D~fkXA-vN?zX#uE;h71z?`|^yu5~yAkO+_hkR}2cPXIu@
z?g3x|;2NP`0JZE*GEQ<XMe;n7`ekxd5)Jiz4`hY=hh@$u!E^Q0ll5HJ`sP;>e&BB?
z0G{El9zLa)bGNSkP!fIGxCgxBx*Co8pF;U+WS&G_G6EW10j>b3vpp8ItCu*oR~NmS
zDhK$-@5-Tn5(gmfdMi;rWnI@evq4ilsH<G8voQaM^Kb(J&^}a!{_3JlSB_2sItl0`
zpp$@30y+sa9tn`g2h{ZkpO7Jcl0r5dgMjzrt3y7<GvWLML8wQD1%%$40@Dciq>NEP
zfhm53#x&E<#0bt~u#7irq6eW16h(v64yX_gMj+2%aLI&|65yLOmIZL40)$2-aKZv0
z)Ppk^Tp*<J@rVXMNPe~kLKpb#4aO}qjUbFCOiPe{HerOH%z?zTN|xYM1&9G&GB?me
zmIm~ZSRgxm6(@(}i_lBJ?2s`Ov*U%}PzG4KPM!k+A!dgk3$tUGNd|<AFtm&p#4Xu^
z5D%?@(;o1I2oj7SAEH2lQIyC4k^pB=;8%DAA>zU~(m;lgfDBdm!*e3o07y;MIT3KB
zJ0}8#qWkG2pp$@30y+ukB%qUkP69d!=p>+%fKCEB3FsuClYmYFItl0`pgsw}K3{qE
zve!zZJ_>Xt)u#k>`mayv*FSEZ{_9@{^+|zF|Me;T`p2!)fBoyAJ}J=Yzdog3|G0Jf
zuYVoXCj}ph{$Zab?ytptGK~pV!TM{Z_fyMbS09T0Q5K+k)xT#deSeFrHUG*!t2%E%
z9$hMv=EKr|37)Be`yrLphc@$VQAVGN=J}BHkFtTipV<CuQ;*8viqmwvPua-_r+<MT
zpxl{4+OeA~IIF({r5{a)ADaGAo>2eY8)zGVd&T=|TIZtWe~9`Q+5qmKSEg;&WFC$C
zd!o9>>kn7|#f%1~f35g?I{jBm0Q8S%glMup%UibA{Jm=K1y>(x{YUQMJRCf`Qr-Le
z<<&WrPGx@&zQ5uQ-=Fai*R4EpZR#Is1aOy!E^Va&{gdbC*Hb&7vcCu4nCJyM<O%f{
z0pB#yS44K&&_8_pqzTyQCLt~!d}pGUA~b3;t#Do#&sL)9qc%g8{5^h(K^u@MM@)y8
z@V>k<6U$p`otL!da+fcl@se0M97Sl97nic>U``0n-O{Gs5tmB-9(=b>A7m;nS4w{z
zdFz;%Ua0(ahVsZ7+Ino8I8tzcoi@?vyA640q|$&sPHE8wRQC5krV&!)O6iU#k55oX
z8B|%dLP~DZLb9)~?w4xi7vkL{Ex)$!LmPnOL2bMnP=mh*ew6&{c4hhm3Y1erhtl*T
z*4Nj_BN3O9eycS6s@w<tM`*YWP`AHVw|oV5BGo65s1rGCOOl+0{)n_bNgAyU#vg<>
z0KX@eqd^<cguf?EuHyG4`UL9Ie;s|jI4$Dw2ICKc?(uA1P56SE^!LQ&DJ@>hCs2p}
z<?QRF(L~*E5dI*8&DRJ0<N3Pkv;l4Sdz2jI39EbpRrIfLUtf2>(jfdn&^?}UsV@C%
z+uxH%|ComK36#~pl6`&Mv^5Za5PX5dYOn#7{XO)v__qz*K~K~iU)?gSyPi>HaFo`+
z^l?2^wlX2|*dXSI;Y@Zb(7&qVL6!VHQ6C%Ub3it#=t~)WXfuyQ|5Q{4+P((;Z&aZT
zD1&p8)uw;s9ohk$?^SesrA-|wi|Z2Dx7>5q+Oh-Ty8%_lgIm<OmJi?WfDP0&_ou8L
zw4d(|yccRf^T6V^1^obiBSKYQFb=*mq}DZk&=yPwJJ5trpe-8!+Le1}Ev_R?$3g!p
zjR)~NlJITjEGMtGebq^8BlZazTwgCsFT!^NO0@yxx7n+|%gqBj_|ScV2HDrk(my_f
zHUPiJq>v4W>0b03j9VDq`D%Oj*=T%%2Hw}pvH{^*F}cTs4(p_RZ;|>Ar&nQ|qi4~F
z;uAEQzFwvctS??BPaEI>-;|W|yTc!XPtd6PdYSqc>>c9Bv;q9?_-y#bCRNYt4&P^=
zpi%bqGHpQCS~10SFKQ?6mru}$`+8aW$7fLgFV$)T@cYVhibVCP`1SkY6TBCFy(}B3
zwN?ziC+z5>qVB8viN@>`yf=NlEd2}HfE{ETfZx=fr#9VFZAN4C3EsQDUX~4z<G~Q_
zOUDIj*F9we7&Z={;63i^rP%<3ov-h(tT;{qKVMX@@?SS>pWwak>!s>Hw0H}g)4+F}
ztI_&T*-1n62|k#<Ufc%2{|lr1e{znu+IOS$rHQa1`2-(SUoWbE(0wqadn$BXsFgN=
zvZ?y@2|mESp3*<)dj+NQ8X*(<f$DdBl%6yf){jr{!S?m2f2jA~HFPfaF3@2qyyMqS
zKS1Hprcdy}_Vq&D<Nn|>S^6h^!C4B;`%`*UCDevb@WJ-=0^M^*fZpYL@9VHq>umsK
zJDTwcKH$DysQaPv>Yi#Fv@{;1^j;lmz$ZW%e5gN0Xwg8>slsOiIjpO<HUMow?LNVW
zsDIGCHRxXHb>EJQv^pNFZUY4Vr`mmj56K3=&$j~It9Cvtz6;jocu?}VL#;l+hhPIj
z-OFCzBR1}%`hD@x!M|Sn0YRIf^9kfOTSf>E&jQR4*Q3&Ld^a$=Ui$&6U(opkbyxu-
ztjGlPd{=2*OKB4v0vbRYpz{f2YG1I&uUKPeL2F=b2vx6@33Wb!h&2fJcb-#sy%#Od
zArRVt`u7E^Z3TUT1?t^*AR^L6bBXIWKu;RgJ!J<DOB#e9Ag}@NLOvt7I7=Ph8Gya9
zebu?QS)0ZKzP>un_mFQt7>)-)?pl67BoUv(@?wf+IGaTI^9jJV=K$dOCcfI#n>uiT
z?th@_rnW+qd%f!)_NCx^DlwiFI-fx3FKrPigNI`$b?8MKWq|H$t=|ygMO-%Oi{p4u
z)%^jI=XvC|D~DB8bzhvXIH<>U?nT5jAgeeD^4g;f-KmPB-gGY<ACl()sHj7w+mQK1
z;yM?P%k&9AcKAMoBSH6qa>95FRrRCE{6M##RNAGC-!+k5%WK61Z3B!y7_df34t^y1
z1dvbA*UOeuk|y=1O4(q$4d#1a<lbN{j|X9$x;(lUO+)$w68d`4G_|kSa~s6jZKAdU
zebyMTU)gJSWZQLZK2=Qb;H$;)AnZ?(quxtO69@SaBt4UMFQ*}m2Z46E*X}6Dr!@ZM
zyN~+?wXs$Va4=v`vQ~Ku<%WvZzxujngcQ31-*T<n(z1L=eK@Sp@OTjV7>BhAxBKd_
z6_9zcRek9l@q#{k0Vuq7N85Iw$+cp*7E#;$RN-6CJy2izS9R@96%UH_drHX~>!;G=
zIT_<f2fupMJtepGTvu(|0Jb}zKaMtas46bCuN4E|QdOGNls`qA`frT7C*`cpy+aL0
z_mmCJ*M<!U*Y2dL$!;mywH9J~t!h8eAliJY?XM1D4K2@1lQtk+yOY#dbx+cb?*^0|
z52By1`23F6Y#aEC(3Jj#>o?*WweE#=1>emm+y=lqW!!(>!1>2H<sRy`0d1_^(Y9O_
zIztNHCCWLc-w^C0MxFW>uH8AMZT)B(AGuac#<-4ZA8<X9g!lLjLC>;i7^f~906i#t
z7PF>xr>^oHWvvy1_2l(5rzcCV@;<w(j&}nv&fBamSvSaXB<&qS9}nkrYOmdqSN07f
zor-J4K=<{tcBgtgqZK*USSto+%QT{XzApI`D!Wz;>S|zvtgo7|4IB?HD#}NH;63Dd
zhoXJ}$e=;2-O++B@ZH%SMi_pJyco|Mc^~!9XDF~%491R=Kn@LR{e}kgf^(Ov@JvzB
zx&im%G=Qri*i?cjpVF>@cU-^mzUm(Km={OD`Xs5}go5YL4m8{~3@X{C9BaiuHd6pc
zBtWB`+ZT}$+Hn%_6e>&S;&lORfGJW&L#VszqJg8xc#yHa%nam)=kee-SaAH0-(-XS
zvcdL|xc=liz(xS*%awZ%@;=RROVHI?aeG%JF8o$|7sh(tD5xjCAma!KabEB)0Louo
zwkoTfe87XYi2KQ~u1>)DZlp~SUSy?ZgqGmG3l4xRIvV3MjqV*{guOF?b%1b|5A0o7
z&vOI$&4O!eKSBY(R=9frBH><4Z6Ngt&&V{JAY?-Ovk=1RWIKfALYpK@Z|ZyoHic&r
zY0IXyXG`_CR!p7x(MDO&zTqC6_s<5xxV^L?zxM%$&<2z~n+)tndv#lWTv}Z#*4XU;
z-UD<2J!UjeT`Fl`%I`&Q?D|xOejHDL{=si)ko8#^8)#5_hm_GtedGcC`vANzK7q#8
ziq(g1w1rbJKEyFhqi+jvKBtSe<o3Sd0omc6x41@b2Wnj__P*&@9)5&&a0<f4`R-&r
zcZ58A>e9%T0L&TTekh#pYHaJ{QxthOAX^H$rzim!Gj@P^%Nbw`kpOoA8g|>D;#x7C
z)@4fo>lb5v5x!rBd2w=19N%3u9DuoY*&OJe>Lj3(fKCEB3FsuClYmYFItl0`pp$@3
z0y+ukB%qUkP69d!=p>+%fKCEB3FsuClYmYFItl0`pp$@30y+ukB%qUkP69d!G;|5@
z8}5%yt4W)d;+dq%T=;w;z5+7N5{m<A!sjLAbFny*E__~&&-JR~l^8b?i<?%*`S@Hs
zZplx<@(LjtpAFAl_@NlTO2t`x8phcekB8^{N&@2q3*woAIEziIq~bJwIbq4Bl|VUs
zJ}{`qFCk3Xv;x9X5I2IGMr>LpNe3`!3WeygY4If8!Z^XE3HSg8ElH$+2l)gBUBu!n
zk_dQ?d;^0lM2bJ;6XKSDpZr;3oDH{0DPcnRk!S_aF$!@&!^Rr|3&{k21qcy6$*>Rs
zSv=x$5g@Q6pF`Xd1OPu5G7h+n1PEDV93BY}2n`V8a1}4$4pJa(Bo>kzLEHtg2+)zw
zNdzurab%q2h$V<4YRHO(kU!)d5P-e}KT<Y;Kv=v$cEFLacmb=xk)<HHKoq9@au;D7
ziW5qjyde;!Ks0!R<Xk8^j0;82!fX7I=qcGiJd-RBL?-;j3*r<t0`yhFLB7Zz#f?yt
z$gK;OP!(rYl5qh!kj1jZk`F&2IUvmfGA<+sILahZW|F1DpI$r}kEh~7p4ruLlIQ9u
zWt~-bki;tVa2MlM=rI+<tI!MMnHW+(meB5~xQoy(MdH*Y8Cq6zFN}+#M+2%EH>ybv
zSWOLbfT7G9<?9J-qv{^C2!d-PK>#g+;O8O?h4HF%tW5HODV2{UNKnNlFbD~NZ9zI=
z1>#qU$r3KfpHPgJ!YIX8mC*>TfHHAPZq@O4l8|bv6);{M7YK?nGC)J7r>Ydh1r$>F
zDZ8tV>#k4&-;8q`-rTsIF-WiZ$Pq&)KqY`n8qvfM0*_?}eF(xlZRF6wlU6@^{bc5{
z_QO{h74X}$e;l#EBK_D_+i$YM?7f?hHG8XX>lxq8-g}y*XRDEBTW?tQd`XYqtG9C<
z-LdrN?DT%@<Hyc?vSU=sKgQALnpM0F)^AO3>gU67dUCgrKl#FqmLsBQGyf@C_oUF!
zs<Rq?(I3rPM+{w19BaJid7EF1chd@nTkkeo|NHzVsmGlM<rt*TB%&td23hnr3hH4%
z^Bw$=joDkP$j$fOjDNzl`r0n~=<zo;@vo<|SrffSM%*^hXa79#mQ&i|p~s#1!|u%_
ztme(PU3~fX*<Ht#A2RA;KulT^apUul77Nq$2}9y!-s8b3dV>OH9q-3-$s>Lm`9s$$
zNBu?`uqGrLFE6Dx?ca>|Ys3cDGZVJ){S4zB=IP_So8E95cYElG{_o})5;lK+Wi)77
zr;yjBWw-yy<v0-Ij;+od@a%L!pKuy`+3iJPUrtO&Gk$#5xfR`fzI~wogp&3a=^fjY
z=FGP(zj^Pt{lJnZR=GV)3W|rB`Ww3L>KE8%L-5s)m!BLR(V>&!o;%?eTMzPC=l5*m
zuSW}<^a5wE>(I+*@x!GZ<`KQN%&=X&u=!Y%O@VGdw%dNd`4-`NXs_?{HS}S3x$e1_
zpECIiToO84?OS%*g1JB5&Xn1wd+L?>kXMiB%DwmrGdYm6Cc=I|nO+b21o|W6_AxI@
zrkmTIy*^~32N0Rqjz|Q#-ab5Ys`)RkPo%DxWf%D_vf{|=t3Q@)Fmj0x<*cEtY8CtK
ze}D4*qr0yz*s)3f{ElZiqj%9k)*U>ZFKoE%liFryoY&YvBgSoOHMkFPF~KE`zQTxh
zG3}qI0Sj^_-7m<rkLa7k%wb;VMy0fPKD(DucsF{lp>N!*O3a9&XKY{B)Z=$vPfiVv
zZuV2<XSoOeb+s6~D8#L&YrwIH?;>bf_d^SsHe+_}lslq%(k%mGN!aGf4!h$_%{sgO
zYWR4<u!M8mWaAYExkRpOszbcjqVU{D#Q3(MpD(rbnEI!Ew;w#C-S>J$oc)+Tqm})j
zwci`je4D1GZh4UWrB{oBU4tUGWSR{&+t!KU=f(QFi#vA!|8UcaN`}csqjv>gm^^O2
zeY$?sY<<4}u;T&QN!BNwqwZd*7`r4Q^xuh@w~Eiq|13G*&4idYZ)M`07pI-|Hx0hf
z?v}ZENeYp^*K6ISpo#yiJ$n4mO5gmRTkiJuI(&%5Dsh<|Fk>3sbk)lZw5v@jJ^nNa
z9v1iZhyH^`O)pvZlDEz@Vddl_j(I!SQNPB|h$`v*^5NB)13a4Qk6j!$EPQM*7jVwr
zo@3@#c4Oq&?Og(*N|rw=U-~sCxaFt|uL3F;_&tdCkF+RT*3K~Ww3D7&Mbc-lPjW8g
zw5?2en!qp*^)w9r@#7Uk-{`LlY@PEe{&!Z><m0dU{P$`)yS>*JKNz|{_~Gb@NkhW-
z)Ay|X_CU<JKb|D4I`3F~{bl+Y=Q*SH+kG8$B4zHao_gFzPs2~PdDeRH^)`ziJU`y2
zzpeMvm_Q#-?f_n3>x!<S?8sXS4gR<I7VD#xGhCWPo-CMZcgn78@4DELrk9y!%obNl
zeCU&y&o8|C+r@ii-et>xX>(4z>f@U?C3EUmPxliq&vN?C9bHB*+(H<BzlVMKfVY*O
z$A+-D@e|vJczA8<Z9YGPnZLDXkpHp*J$6Up`JwpoR<038y*_dKxXXgVZMkc*%FX7{
zD^p|RS9If_GRn7k=6uWWr_Nuu`fvEAH3L^3+3uZ|7TsKL;Mt0PsjqIP+?^e}rc;|0
z^jz9Jy<^``UzNnnn#I$<e4^Ep|HTKKbuk$=)>J?Dddby6-pr48dhKkLzI}i4)Ry1u
z4*AD@(;$Q6vrC<RF~8U3=B7DDr(*jbGR<9XNVC=7+c$u>YuLZX;+Gn_-{0~@t4ZDL
zKgxf_3O;q3eJVIQXiLsR%MlM-zM5;h*yGU5sp(Ep=61H_U9WbYIe6K0Zu=d1u|)pq
zXkSMBCr$c?u^3x-cKhkw*o23!4sWM}ko%u1cZ~ToATqY)POoKs-Sw<WhKD_Vw%BUX
zw0vHq&;9{=$>*ZK>o9wl6D?rZyncHRCI3B&)@*&hzb+K?S@`^`P=_YxZMi2oCO4Y}
zmwwZI@RTt(GuF=Qx@Dc-Ey(uK<C*rffcY+^C%y90*6QtyYZ@AVM1Sw}E9uP&953~=
zZXbSrnAbBFmo?gw!Ls<z>ZjnHTar#U3rao`dHkG(UHA04*Y@|=QE?}8!c1d>o@JYp
z%DI_^i*EmHZG6c4PGYZ^KfJ~~H`o+9@?n1;M^o6G6W4KxQ<L;xjOamg*O?zkygKhf
z;FZgthP;l>r~hwjMqFz7+SAE1=!v$!7qs5EidNV@G=8742T15;T#NSM=A$E9dz5T)
z+OKCAyuf^ZYtNGQlmB`V(tOz413~>RJm8!l7+v}VX9mq)*T(n6BzQPt{_`<btT6ks
zuAf-Wqvx2P;jr@Bga@8TI9iZFl>Euv!`=LPZd{l1Ls#DjKIJkl)x<mZ+VrCCmyG9*
zW%ay%)zt4BzYz=F&pI1MfgkgeK8?m*9Ov(q8|=zS?>Nly`LHtqCeNQdw{2=W^5JbF
zAbqlRd%K=xUEA@Tf@8bqq|ck+x+kW~5q);R^zl3%ZF^gNpR9jRdM!3&#7)VkcfP+m
zV2NG${jrhFhuyKA_;hKz3&#4EZAKr6j^-R`59U9`WfiyO2>YboUQ;;N+s6-#`Qvu}
zwUeB_FCzzrx-NV7MU>Im;XgbrdqID9CxYF3JbQ0x@%#)f<CbX>&4m8<&XzsP5}9M|
z!()uhA6^<le{5TnocL@gK>(G<IzI}WHj_yHb<K+|A>SFgZ>J5qQTAun9VmProrpg+
zWJmXt$vd|3c!r4{LwcldX}5i8VB28{59j&XPWY~8*<Q<^L(?bc&U!b-`=VRrmbo@1
zuAK@?7q{*mpVfZR?I)W$CS^tcZ~T#qJIf+Br*MgGFU}-bSPVSj++u3U$ycqDI*co0
zWb7MkaItf`$9YTV-Q49dmg^%wcUpM!MJ7;iU;=ymE1RO;UfU~Xz4$a^*R2JytcO=k
z3FxqgPrGk0=}C|B&C7Zd#4DR#zZo%s$+amdPLFH`{+NHgVq1?qdgt`m*jBI23&tmx
zyxHn{zkRq#|KP}N{Lz1vzp%Tyb$@o5|GtX<Mt)*>VS1@$c9Dtq!5hto7418a#Pt7X
zo#~-t?IuMvyLx4sDKqogC8LqOx19t1eltOzh}u2a722q{eLH{4zBce<tG~Ng4UV;(
z8hw!+b&6rl{cq4I>n{nyEyQ(OyYTb>JU?vKZSY{mFi7$EBD>AvQMP&0OMaWsJ^RHz
z<D-c-XI=&DBAQel{QljuE3|3P%KX1P(rl~u!=)aFe2CBcJcu3}l;1Tf?oFo4Y{rSr
z?%PY59$WJ0$4-}yirxy2VW6*dv=ROF!;WEJ6%jf1t!{MUL@c^&m-!ZagHi2?4W40v
zmqSu>Dk@K<^4perEW63eYWKiEKYjU{IDW5v{Qad5CXa|L3%Z(eB*fHW?c`=jyr8L%
z+QxrB_KN;#ug#l+CVaf2_=5TF{IXknmhLfiq7{BM?n2Kv|8Ju1wqBmIcgebmOv`Od
zLq@NYZW(8sxA!{jb)};6#5b>s6MGb9ru^K;iTz8$#+lZJm*~9~M|Az>_y2eiPv2O^
zmNh$2-tUc%A!E|DV?+KqTe>?e$~Ju6z>>mjPf~8<LKdB%xi&vsnKd-EU#nArSseb`
zzqsy!IdchO)V*=fx~}G0CI-fh`zLa(<B~U99sc9FY%FD7y}XxZ((`dd#|vxQ`tN%b
z_+>&MXZMXjJ<pdmzs2b9|7%dmcmKYN_53G=*x<3qde+ZxGUvrE^~#P7+xXSfKD2^e
z$qu=}@deAgo|m;ac$2LDE7E+XcH-p!x4irFGPgso`rMu}^%t9b-n`iSpKl}+8{X+X
z?s@T-5&L*$PMm-VbLSC6!AXnW$L<}sb#?#q<t{IJu5CvCBje{~-~Il|gs?t)`1_6{
zid!(Bm)$yy#`g6L`s7QGB1)P4CapDOYz>&&DQL!t!xf``%ui#b7QbU1cG{D$IMc*?
zXh$d7>t;7owiy$*a>_ObE$Q%}z}b8>L0okUVy_#%>COq~v(XO3w=d58vH#Fam%|%6
zZ=1&bctxW3-Qv-!V_q*>ZstAp&8qKPM@@8cKQ`UW+nC`KYq9d=LhA|J=Ej}$h;!kE
zGM9DmW|e0e5eB=j)3`azdlng4JzDC;8=TCu`7LgWcgW=EK(FAX4naO?;}W;n+&8c(
zX#QnPT8pWZ3c4icPni?PDt%jV-eyAUg39*&51$?!|8j2Jk2z&;IQ#i4Y5R#CJHZXJ
zzxdI!UW4q*O25y)J~`|nq33Ec@}lvYpfizPVAM0x3<g&0fBvc4)J_pQD$0|2S#OWq
z#S`DBp0<iws{j16ltFjGpOw9FX%Ux4A46+-F}Br`HkogRMYK)XUh(_Z{Oj3Yd9rC%
zVVj`DfPlz_&&&MROl)27a_i*dX<t3%5x(orb0Psv*O+F0hK$fYdPi)`o)XLs<y|i@
z`Hy0Idl{skV}eidFV`ymzcWEg9(5em&V+DUeZXR64*ke(zAb-fcqw!3++)oc#Le7v
z?_at0hC5F=|JatnNg2}pB|Y0^<+K&)EvAM%?frBRqvXQY4A!pvc}It?q}?KX%=FXy
zmL+r;_xmoQu%dkHLF8)!IH@ja{pPo5QaN%jf6}h}oR}UfY1iX^_ss(}8c(rbJLZ^8
zh-rrw^qag*&jLN8eAf|k=j5e--#th#`}fWz^Ww{sFSJa`atSQ+avNJZdPn~Cna8K`
z$G7%8(yTA9`AW|ii{5889Pnp8*tOs4aZ0{^>zGgdRz~Obn3%xxXHD_73E|z(TfHm)
zQbHoCg1+&!U)L8){(QE7$Umpd^>^l9`s>g|wqD`gx2r3x0(WzNrace)X@#*(i!`2R
zPCOI1nsw3dp?z@XlMo-e2glyjhzo)>`~1g0ICJ0r)O2e$GjO>}?q|k<p$o^9X61%w
z&fw2}X!kCxpWfG3?+ss7o@~8(YNtNS+jJ?ca6C1ob*4#X%Z;W93`Tm&yERV#eezcz
zr?o+vL0`S|L!;j8sA%b&UuL*$<+aad#^y(cyri2D6FZzu*w!Q8e4t&4RghWcyV$t!
z$M*3AV=%DIx%kN5^y)~n5rGDs3M*`^f3u5UMC+DH1QZS|i)`v<_o-XzXm(lY;VwBZ
zo4D&=cHN%DJmL9Z-1@Ro+nzBmo9v`}SS8JkOW)tid}i#}HTMnL5Z3^k#rPxcYu;=M
zAqs=uUAp-ajPTmclN=Y@cVD=zZQABo{$2gHuYnKmKW|Sd+4VZqlJJ{+=?v?C9-ISz
zJ3a!^{C-a}-t&cD3b(IS?tFH3*wNe{UjH%%ny6Uls7#0hV?JsBAf+<I`OwVLYddc8
zx}V*ZM?XS~hmN?7-oV%st@=4<L%Va{94(57TD5k$X*2WOA$}>vp<vfde>>Q0(jWrK
z3_D}La;jbr`^WQQ$37e}z4gIB;;*1M{))}sncTM9N}1ggk2RZg(J(c`IL#vc^uTX@
zo#WqHTsLOj<T?9~^o%-5ivl|LZwT^#db1mjy9&LAev<Jy?R+Gs&)s969$akfotN(S
zFEkayCPuur=seuBbo|mC49?QlmEqU^ShT;_k!JUp_cF2~COZ;E(`Vj&#N_|Iea5+j
zm?fs2+gP1+-k^VR*73E0qm5&-I@sUX(B=p|_fe(Uzq>DGa?bupbH(w-hGtC%v7WSW
zIoEIfuftw^?e9JOSy%nsd(B&wZAuKd^GTllja5&)$FskCos#7^%kG%oBs=2Sljn<k
zLN;?OH~f;^si^hbj2GRHdFNle8r_VSK4AJ*w`A|O;h$v8-WBcKecY7an;gVp?`+Ns
zg6KQZ{0RTxr54BNr|oyYg?4vHe%z|S(YHPsP#pARDDjzZ>B=vTFE2mwcvq3%J|ANE
z|IYiL;mqyO-MFKv-}PT!96b~0VwaXjr?1EheeuF$t`A}NiZ^!5oB1=HPwtNJ%1C?e
z&kl0;aQNnKi=;5<RzFQT_+;(3y$(4#5w=TWeG;RiCPJfRch8`kMa8wror%kjjF%2L
z|El%aGn+zQXGP4taLL+pPrl1$kVA)!%dS7jX%(>Yx0W<l{Re4j^HTdx3FMU7EPmAC
z&o|MFU5`&qP3jj3ZR=`J*W+8BEiW8I^o@JfdU#lPh}{uriw;)M{ll4Ams=2FkDnaq
z%MCEL8+Fd-__vpD`E&)hz$VHr^~>cPB1Vt>@sik+&jQ9DKMl04d0_BwtBPxD+7lg~
z<hu;uhll(FK1%ku)?a%Twa-~Xq)tE7jCFVQMDrpCPK52Li>`k}bNbrr#lz5*=9j_k
zyDaPT@u^vXF2|<5q%T19CPYVz%KhD!k54UwyKVF6hwyGQ0;Xi19R7pTE8Et1iX9ZS
zz|(5U?WI3WCGFA1{fzT>L$>{9?Vb&p^j8Mo8y4q3!+^-&Uh%Jgob_LUE@wx-q&p#@
z9}|~7xtkJRM_UzEtnYT;;H34t&4t~Fo$X@JIU6Q<*cv->B5%8UT5Ul(-_fugaeWm@
z+Z%QM+;Lx?+vjJ3t~eVF9p+Z*nP>F<nMGxfdbyUAMZcO;@py(lJI(Zu0~R+cKJ$P3
z#iwfu`w`C$6?J#rheSkMkH{XEN2J1Zkdg1}?2g03L!QM>Fk(+QTWa%NMYL7FnA5b(
zf|+fmta@l~XSB-r#|&`K=ts*>dJSyx%DhX!Hb-Lh?dOO4_AtIPbYC;#=QE`?hMPiq
z4Sqpq8=g-(#j=41{q`9XSEi(|&s?67W!<xt!GbY|=){f+$M|Tg&ERqNUA)oOgPWwk
zDP+a|UNm-CoXH965eG(nM0|Jlk7bV^T=H-?@50k_g%)zN`{e;gQ{2su49wAU9hMPj
zv2obdQOo-ilP)Gt^@rOG``zu#PIMa4-z|ms+S<#67;15iaGf+$>5HLq{H9d6bh-ZD
WuRrb?z6NGGiIKzHh8`Q@9rAy92WzMR

diff --git a/client/ui/assets/netbird-systemtray-update-disconnected-macos.png b/client/ui/assets/netbird-systemtray-update-disconnected-macos.png
index 8b190034eac6588e58a36365880d83d9ea8d8db0..b6afa3937ae8e93102d69d1669c16f40844e8343 100644
GIT binary patch
literal 3747
zcmcIncTm$=yAFsS;)*PwpeUeHl@|I+T|k<2sTvGj1WbYfO+rXu1wmi|0RyrqMVg3I
zfgousMT&w_L`q1cN(&(r0}03t?982eXYT#)`_9anGw=JJ=Y7umoO6D^IZ4ir*1|`n
zjsgGxVOyIk*8l)M=zc#U!1Mf4X|O+>3$VH7002ZO0syh`004*Qik$}l?g0USMPC5G
z;3)tg8UC!r#fTT+_qVgY0sy>9mDA!`Lg6;oBY1hl_d6fpuV<%tPQgf92TQ@l!vZ2l
zh2NxH58*MxZLgTQA;%aKlc-Dj67N}AM%&~;GsTnfpm&+a%i?NJdczKv9UA0AsQ4Ow
zvptMdiLLsZc63CfiFsJ=+sBU?X(iix8|P7CXLSC`nY8JOJHn&+&$V-FSqQ;jZRM&y
zmf(C!al-`d3m4#zO$SUSHE7nyTvI;=DpEceW&K{j30_o^r#3$QKo3&a4j~%CJM_2l
z2ubJsw?^G5XSHEfY+#XUP&-H2`g)Ye$)5hMxH}Val@N6G_~($By2neK)*z(F>8sA*
z+Vpz1jLu9=yRYo5vNrP%ixslO>E+_rB*EjTJV_nY4)q4}odsD61s9oLZQ77AnF&)w
zvty6LxOYr79ulrCEvGlF%KSc4k<p0$trLv@BerQCK2z05i`#m`D+QQU6{BOtQ50mV
zpEF%=Rbkjyk9U14SgC8cZO8Pxf?a&1=W6TyQf_Qim2XY3b^B>|AK@3p{Mi(QB<<G~
z?}qxynROx^eqG7$B2c92j!M#fE4$cP@3$b)kWv&ZCTnh&qD!~v2k-P%67zS~-NCc&
zKb30ME(wZWo{5kO^z5$w9=DV6>E#?MEYa#lNNI)#7B{y`PcU|j_^t$=Jy!#Nyw@{H
zLLpztk6qa7Q5xI!ej7uT4k>#SX#a^9>w0r`=5oKb`m52;F^}m)LU@k`6^7?>c8!No
zQQ2`j3ZK??z_j+y9;+_g#F#F9raCe#(3RR$`22N{XesjcY#z6Nv>_EyyH*=%Drzwf
z)~g3n2JUx|Ml5=x+>+g)L{oEec3&jane%8!3kG!IbVrAQ+Ln-@)dIc<rwXUVM|eoP
z?9qu8&Nu0@ogpn8N0fDI<7q>EglQ%@^=7Quy$-IjMt%17yvs#~F=SG@*hu#<xO_!7
zMWHV9XF_JhjQeH>LHBeHe3$}B!(VeS^Q_?Zt{HfkqgwBA(=uuCF#RQkI@Fw8n^>W_
z8Vmb$q)U|;=bAutdQshRT`Vkc8XI^q9e?$Wx#{0q{Sy7}Z_Q%w6b+-S%jAPPLHdnj
z-P472-7t8!TYY)o?h|2H)zp>*{7Lb$;LUY-3VsfG_tqqKVCrV4qoncIL#-KuBdVmh
zYh{9L@voGH>~<N`-M$y>kr^>qHbC$LLwE}dQcim%yaV1_LddX&&uUaFtI%2$>Nat7
zMpRmA4DmYu*@_Y*B6&KOzO_qUQlhc)QHjOTrFYH_s3kFAChx0*QB$XR*&LpTGCl6f
zv)h`PDB}%u@ZedE6HP1qq^};y#h;;S^Pc%z?dS#Rq^KG4I0!HQqXbLDvK;sN-s{`_
z)q}>f&F>08YOJXnkDNF;<T+%&1(|!eQ<aYvHKaFK=O+Yw;5}{Zxq<0|=9;h^-;UbT
zRW=?65Y@5)YE#cc3H)}k{SBj#M94{!3|VGEi57Any~K^9t&K5AZW~A{H`Ro8Q8D|k
z>5e1o^X1O6M5})K=6rAnPEMSQNv#Ovrx7lhjG6a;#oEONOiSa}cv4t>I8VEq4X82p
zEIym-&@f#!&DBi#M)3(Rn=hS639mexgOo)y(#oT+Mo&ve2mz`2Po~9!9b3hG{qtGS
zle^r|oo8dlN<UH_?3m>qsxd^Vp2VcEG6ubMFQsn3N}5CZ^#$M&Jry%3v<uh_0!w=*
zR+#6o7OruERPV)qtnoQ~A`m@&SZo?8YPqOZz}pq1#^s6jwJ|{hbnd3=)2&;!o*~l{
zm!eJ}q{*(SS8uoMvWz=0<Ou5s;v?k=?7I!S*c=B>l#io|XYig6ez;xC_g@3;Aj!(k
z`Q6W$k~hCCZMSvoQTF_d?P7CnM43T~yPs*_uw3JkH)fbG#=nSl1$a^o%o-Y*=hxXw
zJDUY0cg!1sr?_SUNitcc{RThrPRl@GWiz84-p;yEgk%jr43S(IwWxC4D0kU3aKmWh
zK03b+Y9402ZDVw-{yd-ag?B(Ry#IVOTPuJZ%}yx355`1H^kr{i-<`+foCbAv7fqq6
ze7Ab_Xd=nM8`~eE8M2zUN$&Jtn1hMq%Tvz>#l8jQok<6U{d{01;K2eb=c`PJ`7Vd)
zAN8x_ohlV5Qv%B6S(+xas;TSIdr}2q>?^4g$Me36o%;%X)YXjqP7pxSJZN#pG}@T6
zb<RdDbhpgg770*`UbN6^6{%M3q{S4;*=XgX?ihx$dknXDhPhLo2{MuIOvH}+fjZ=(
z)cLB3iQ=gKPIM_!hf<?iG+-6GawCr|b`Gak{ka`oggjfL@cShQHJq9Kuge;|*@7Z(
z2_&CdSEC1=`s>ai7PC>rh@1Q+0|{e|NPIHgfg)g2nhG`__sdD9+ff9XwTu?CbGmh+
z)9_HC)r%pu5EX_ac*YV{;B^9umMD2Rr9Ys~H|8;xPM7uM?iwhMEI^q%yo;d1m>U#k
z=_lYf%*wFKKk_eP4QAcoLC7aXD1L-eZY*BB;Hy|6rc@f6-G^Qk1yvH0OIx6wuNo{;
z7YR|RQ^D8N_};(Xx6UM$WvaBvg!!bo(ZzH8g@6t`&|DuncJlkraqdWV{lIbESInej
zQ=I+HkVL63Z25)Iual6Vk*}KKKChVF+fuqCSls<){paj(x#!Jxu{7NMmo6Bm_XhqA
z5ij={&|>~PA?>*#+@I!~#(d*8@A@hSj<ajmWun_pgb4vVuNn@$B&#$fiRF5$Fr14y
z)x#sOTSppketXyM%)Q`LXG5abY8u)|D@3P5Q?)6Giw6vzJ&H61_pu_Y&6^c0A1q0W
zk@^K~OGo4nbFZ9Bz~ZY-VL={alX440CjtLcQq0VMat}OCkGxuQpu<(nG)XHON~yUh
zL^{K}-TXhY7Xd@AA&KeL>n0~_%To}Lf0*X6#IOUg2<G^GNZGSXj8#LoC5)CYV;q-t
z6HzK{GS$Zo{6<#FWp6Dw6U&|Vr9#ZzxZGox9u9^kKEGNj9qLBE4x&)H`-UiYWtccW
zANavC3_%lxSsS9Q3kS74uNYJbq9dIe4`g4C{^>>XA#R$Yok9+l60ES3s_7uHt6b-T
z2@aGtvLv*#)c=`l?@cKmQuou4nK%?O@sg}v`}XdGNcvqp58(r(Apvh;$g87bzx44h
zyS^P5bXCPZ3ryd~T}c^Cl$~hHdEtUF{46P;>F88-fKtM*+>Mg?vw$#nut`~qXwbH)
zZ~@`Rfhj)r!^GHwl}`}tt?VT^adeKo6|^m2)Z!u3fVqA>niA&Hk2uG4cVb?WJJp&s
zTBU89F6ZbHHW0_c535#^fJOEJ-nFl%CQf(E5g}U0c;_Xe6UXhfb-r>Xa)}8ph1g~E
zr;Aql*!(?}r%*KoLE(11LeI!TmrAcHW_B;zJ3j4&!U##T={b3p%@B%ehkr?-FS|EW
zkJXgxm5(Jt#G#c8K6`ob`W6}Kj!?tpt)$ttW!CFfHGdZjf~FL0AR}B1kz{I$w(K~M
zYf%F#nWb!@g5xO_Gv9B$@d?*n9kmb#jfbaKkaKMm8`6G-<{?G$yb|;?ZzQ5`Z}wi%
zDmwKQLO`+$ywq!qGBM4ToE%4c`79|o#QrqXMEnD2+<H2m0NccnVt~PTfm2Y4alb~-
z&T-lE9Y+xbi|7SROSyc9x={)ecH&b6)2V6dAqa%g&ahw9jB0>1wb5ck)tM$%AH!3q
zF)@A@a@~j(B^V;iLG@nD%aevwd?idVGpS1a;rQGTIL|9oKdeK9UA0J9H|%xQv6En!
zh!Pbx-q%nrn<t0+RFZQ{%8@NUik%P~B+M#a(V^K=-6x)>P6|ojloG96`~w+(#YS>v
zeK9X7&>xH^pQcFv2=E`>dzh(3EvFwH!WW!c=vNriW32>^K)MDJxW$~6YtI~a9*6RN
ziSIoN*Ucz618N&OS#-F1((&FB=aW%uYWoz`pvVUe{|(w|%!g**mhG6P4aF0pWb9&5
z?Rnvz>NNzP@>KoFYHAj`@KfF_iNrilbzi^9zmdjsj*S`j6zMrdZp0J(x9t@^<xNyA
z!Q`k)*tM0|x@gLcd3SQxdCr?ZQ-j@6Tcd<SW#n6DAQ@Ior`gAIKkz;-LsOI*=WMr7
zh75QQDZV1UIpkHfOd=G*A8V{hG5RasIt{r-pzpX!y_glLzqZ{$IAmpztKgMV+usxS
znrNtb*qtQ&NBxYOagfle(4<x45&c(|%`R%KsiC4!x0LYW8}VnpT%f*`_`gH{#`nzc
z(4QiMp1$QKHNuy9X%!+Zy&?nsB7+P9;6c0rpas;@Qv>R%0d?Gfmkofw8R%-M0D%TT
zAbshj%>M#FV1XgGQ2#%my6M*!Jb?0lGem|!f+8aQAmRTLqp5442{h2u{)gl^d_8%;
OSX)cSE7j({5B>{<{Ua~{

literal 3816
zcmb7HcT^L~(x-a?8;MF01qA{Yq(rKOL|=p;ovW8FND%}fC`L*MO}Uz92oRdoAfm#h
zM3f>3Nze#_K#*R85IRD@gc_2(_`bitKi)aJXLo1kH#_q?b9Q#I4tACYWRzq?L_`i)
zA>d9TBBH{nsK_5u!olNy>22X49foiX7ZH&K{_dh8x%mpeRl=PtuZUE2D=!Kc5&@TO
zFN=s&r^xQzk`xg+h_QlSz8)#MGO>c1Y0de2YRsHZ>7drix!}FW6pbIXSg3|bB=5IS
zj6a@W_{jWtLX%woT?vAk0uZz~6_YB_Snhxn-9mLU6;-VKs>wYY#m6PA2<rb^)7d@I
z%a4g5J|MDG1ba*-Q5v!nMx^YCmLb_b0=`~cBVAg47a%YYq#Tcre$YsdGvk}+?6G>3
zBDQu^O7QusY`!^#G5@mRjC7f}rU&O0__U-UC10>^F2C#M0#RoUcwO$272uq?xr(WY
z_ok5PxFb(x<HllAj?fN$SgY@Re1t0f46RK_Rm$~RrPs5g-7ccrpZ52}Y<6;L12+jc
z7UBB83OB}X!-BlYOE#QZm(46(KkQTXo*cpD#};C?bDk&rSAqLS<`kRXd)qFO!CG3<
z$^3;UANyJeJ{_`f0;8P@(Nz1tNppa=hKkHT!CjIRFNY&>AL&Hb_5-jXgxUGnN&jPQ
zl<=#wlVkC2=hnl@>0eaZPB=3*gEwSUAzb!HonOe9Tn~EzBO(Se1we9F^d@%&6v($p
zB9Hf(2^GX|IZ^z{zqlj6jLpaAbv#U*t)a*E7UlIz0^$VB_Y^3vArl#*91IDOv5(_J
ziH1+!D1X_*n#;$X7jzv6U(0nC!II*b9ewXdQg+{kU7*H%pbH>e?&NT`sLFY{u6-xF
z`OfG&;*tFFOg?S?+0Ac|5Get7d&`9Ko%k5Jp1c5!G8V||>Fg5MA1T*@i7zxyR+Tn4
z<=dIr)ZE<N{$nRc#^T4zk&8J`T9lv0CGpPPR4rC_Z2u$XVizGQGD%mbuGAnijlBB+
znNxbVgmiEu`~ocomAWQM)FzAsUcgZ;foJ8XL!_Y7ZSnP;DR&p}<V(TyhPAhfaAT1A
z$$#fHb394y7sD)x1*nWp=Sl37efMh&dz~jYvJ#}`&fz|y_pUc+KS+8UArs_Re99<c
z+lrR9mdRXgjbKRVV^E`x`f_~;FW$m7`P3BXuy)QcQq^=Se`H`Aq}+oT;nekH0=jd8
z!G|3_i6*DoKnu--d#xu;$;ju>uhYk2qqmEo(C^MF^_^bQ-L^%ZppG2YTK-5k!V5FO
z-Tupf<<$IOsgR)M8@Xu!9`i(5>@KrUwnYHNF{n^hju!Kk`$zVWeZNspfMBQ_@nkOO
zfqlVvu>S0^`JH4I*kKYzWcGaC4h=0Kb+77)`<En5B8&NtmE%)hFKiovd!3(bW!RYX
zb+Ft&8tRIu94hRz!*K@In@jpnn|bc===}ylVZJBiJ`Ybeg+_xq+Kp;_$^Oqv1L9Bf
zP&4ZXn0T_(srvx`{gR`EGIXud3k31Ry_nApJwq^fr+r467WddHcmtOa9KgZ-d`<^^
z(9XI4`%vU$PV{O~Bw7v6T8(>|CEPF<_g7!4y~j_rPqvDA{H%?7S$$k$5cFp^oL2|x
zu>Kjr@H+^a0=)%kb__4Em2yn;s5hYxvW$x!=TQkZ8R@su4dY4}pttq)x%SE~pHk!~
znQ%q%>&WHo_WluxP0slQTFcJ)glw>rMe#&=rOl2NIlK7BQ~n~{OT2#I)0rENMDKJ%
z%I16Zj%ysu)Yk>DIOc%&%KnVBqG<PQyKT5DWJp|!lbJx4s-E*X<DY0d+QgYZ%QH_n
zsiM0p8~q*O^~hE26~hY(+o-GRN_rO^6YhG2q_h|ev%X!Nzdx@gDunUpptRwgh?@0@
z+O$}yT0emQ9*kGVAb|Zh!h&^~196!zA(vuHaBvl!XZ9Ij70KesqYB@HB4{W3o!T?N
zEuavx0Xxw)1Gw{@qv*Nv2jyB&5l&)Y%uPT1YST<X!ndO#!_%3c<E!enQXXYBY4<a4
zyS~$U?owX_J`~{z*udLDU*@eu0TCH`LMI2WwZA!#B1@T1qH|;U=wy>D2RSSclNk12
zZyPMG4T@(Sk?=w{jUqbNk8(#PuG#H^@Al5+HaK)szhU^yL;;yLh6CT^l_P%o0u`#E
z<W9nuhW;dy{7i0yD=2h%hyZ;?PF?Hswg(NDbh($zlo$8CC!rgDErY7cW&N&u(&+#N
zEw#%Vb)f~avz=b$G-ki$D2~MFVS>V5<To=E&!C)(X3+by1|>l?WeMBB-6%lYUc-<d
zqhHNj6T1G;Q}spH0ghg^W=H#5t2}pq_1Cm-q$W^*C*r4c!Ft`~sQR>0nGw0M7ct)M
zu~g?UZG6b7`S2LKks5zR0c(^7p0yF;Ue3VpVz-YEOyOv`G+`c=G6n-1R6VEg3cwFD
zZ(8()K?j<g60SGXjT~D=2F8>O<V()g@D<kKCW?l4!u#`6t9pWfUn9pze%G2_Iqw^o
z-dX>zoxkKM4|S?1K&fW}gbAapXAPz3XcLBS0~NHG=%sptApO}`YXV0H+n7g%n;48K
zn#jkvSDyW6M{in~y{J)nNa0p3Rw)lw)}Cj~7?@;}4UHT^#R8gEBCIE)7|uX(f6zKi
zvCIJ--7ZPz2K^jtg9UWt6n*`)bgFRcXzSMvU_(FnryaFToW>?!QF4Xm2&r=LOSo#+
z$|j2)cQtwe^xscyE0|B5$Dn@T{ejUXI2xbCccgQrjWjTyPmt^vY#Ola!dUrDcWexU
z7;Ho_e?5cL8np9>jPf~@k+u+iOUDYd8YSo)T7jrR*uC#1^k;=7uQYq^N@w;U`+0ZD
z9dy|Q6v)mdl%^pe)<yj{LW+oz&7d?oH>ZA#Sbd==06+wF!%eI~zV?e#O_aF+p)AfS
zqgj7H&8sJvu(;erxfoDl`KtSGEXI?k!--;eDJ_eg4LZH*b2E=Y=US%=0b&3>`Cp?y
z7k}gHE)?ZuL|ToS=3ol9vgdFQk`i2GcXB<3x1!?iRLBO_+EjdLGPE>d>Dab5#vj{F
zFqVx9!ACN@`iur8Isd>Z&VtTrq1|wc=oWZBwh<(6#v)-+q8JT1Wbp;;Ja3us+wBXq
zf{Mw1&-3&#fu695iOp}344oXXX-y%66W+p(O?Httew%$#3!q)NwG8t0{P7lWPqTWS
z7s4HFq+ZsT4iO7So3W5YuxSZA-}Xo1JTI&ILYM<~Qzsb0YD2U(Qcrd1e00AnR=CCd
zB1D8VOZ%CzEV~s?bW;t}mxcN#eLR1}OD)-*rE@VF!UMuAI_%ZyT%Hgrnw*gbQ>1gz
zUlmVud|gSO6RJamR$6c#P**b+3#_;-_T+wBqx5uCoS^!`;T|qGzm$oeb>2tkwzVrJ
zrEb@Nhg{;V%`IYD*nBx(Pt|y=y?Cz=aIGosr(cEaMKJM8ol+`oUbcfxjxv`QN>WE2
zI@_gqq4Dz=wtsgZSe$go;xz-5`m~K5i*u15hWU)_Jmg2<brq!P+%zGB4g<7bEzh4t
zpcxWotTr4f;Tm9hA5(sF(dOq>?+V!?5i2GUK2S5(*3o6Lr2XTDhk-n6;af>h=(<tf
zrS-uC<31f><ZX@A1F=Qpu>3{(_#7gAL^+smkf|kjSD$@(t%*W+k$1UO+^q`7oMWXw
z7LuSTB+3@s_-GCP+>E87HYmvmd%;(2Qp*BXgUZT?z}*h2VS(4OFRgxUJT89^M?Uj@
zLKQwHF(>vt3re|@j{8DIn)cn+1>94w5dUdH@sV501FV2zL4!px%P%w?fm6f1ec#)s
zCuKpS2W>!uAYFj(Cvw($b!Fw)clWqOS*(J12DVlj-uw;|b-WyfE`*blgTAwlA|VM8
z-{8?%Fk11C@j}kkOYZfH4e(C$_X}Hz2`-NeG<$_yhTlLhR#sGwZM;GtU)3#a{cVFw
z*wqK#gKNp)Ni`(Y*iC(@z`Uyz=lnZR7|H)MKFtvGb|$2}vTe~ods$2^+OfE+sG=*!
zxGvT;&vo-x?S?|LMm6u8?Xy_q^WlfE(DodKy7MwsI}1U}>#jcE8ey%)ljVRhTfCDA
z@L$Dz>(MlnTS}Lb?`)k5$6fV3Pkp2h<WQ~^xzcvsJ>{F5!Lryf9z(Y$_R}~af~M=V
zIp5(CHyZ>24Iwfphm#j>pm%D<F8OGoUN>(z-l%M2x@r7I95e2VeV2jANRi7PcCZW`
ziZ%;1U~KciLR%SuP{+*=(&|;0=vgu6Z!A}9O^r6jU!^30M(s0%cVlsL?bQ~Wk%#ps
zpEv=Qy&PRR?%rglx<d6@0=8NjcRm=IZ24#X$w!32eo2cO#A}|q$tTd-AnioiOO#+p
zm%I+q-qpU?6Pu{)4~#6+a^dRrS8~Z&*-K*KD(=D%?^QhUu-I0(H_f)nE2HSuu5RT5
zi1b^}V$TUFHo<?8HajX=zkB0)CAX<=9wquLR#s!w9`_eE%-pQHV360G33R)Ay4B}y
zCYBjEF(mW)O`F?LCmR0(1wHrN1}CX-Dqxd@QaP8Jpdd@P^}bZeb-t|Lw5xIt7&uWc
z<73XQE8L&P#$$peNHVH&zG)58cS$JX*?6piY{irO;p{<PS*w)K`HGu>Sy!=FHLLV0
z9-i+X6UT9*Ow7}_c3=WGoljLmJ*>sCLm#$DdKAiDBIXTVLs&zC^?69KO0Gk)4b24}
zDi%_^N~zk2j<qtg@yJ|Hc#=y+a^7s5u951YI+`!M%Y2-YV_E|3A@20WvO_8km6kjp
zs<7BVQygSms=qo);=^TDy{N_n^#IIN*GOcMIxbQo9xk4Gu=9Tr{C}Up5*S}p(arl!
VcGc?N!jGwl)m1xq)fMl={{UUVt)2h?

diff --git a/client/ui/assets/netbird-systemtray-update-disconnected-mono-dark.png b/client/ui/assets/netbird-systemtray-update-disconnected-mono-dark.png
new file mode 100644
index 0000000000000000000000000000000000000000..eb0c4bcf5396f1b52f0532f61aa3a86d77c88588
GIT binary patch
literal 1444
zcmV;V1zY-wP)<h;3K|Lk000e1NJLTq001xm001xu1^@s6R|5Hm000GRNkl<Zc%1E-
zYp7IJ6vzMP&h>FEvBCmP=}88qP$@}RRv-EjNkx5%iVUnEDuN0MO6a9Xkwk&^AP6Lg
zf})_J2MS?AMGz^ZqA7)yQrY8P@12=nANF4Ntl6HKd(Paci*OfgW@hiT*INIz*IN5A
z8K7gC`X<_d@zNxKiKa;a6{+UFFP8MQq^*(;Ng9zf96#H&AxU*fpN&cZ{*RUceewHJ
z;2q!y)u{;#0~ed@{)i(>+9<vPFQ((ZwWCZ@Q_^FSR=fU28@)wTm((w5qoi%4f_u0R
zSa>wm3Z^giZIHCejn`D3%t41GEs%6D${AgOxsql{I#bd-NvBGh9s6cTni3}rO8P_6
zuafpl+AV39q#qQ#Sp=#fX>BxqNYXS_&%I`p^|+*8qTS5^EyU6TUBsi&5U?G11-Jp2
z?c%*3r~xa0ZzF%bqWngT{T;xxC_A$p@QL<poG=KCxK?*<Bx#KTg<m^GUjFeBq=9Ib
z1Ym$yL^(AtS4pQS7%nNCXh?&w5&(CRSDwYd8HtXEDu6KKKPocb1IXfF2D}+3jZ^?(
zioS|6GGIEe7dQl57xhewpZ7W)?Lai6++kqRSO9#j?gu`s2*Lnd;p9E&3;}pF_D_$W
ztH;n`GGA<Gd<sD12{Hrtyd(%y^p=w`2l$;3T6M>>me!Sc*XgK}=ahxzA>foKGtH?&
z0CJ2c0pBD>reul+fwRf0!%N9L+d%>DC->;dz=1?&gWPHNkyo?AUB2DcZ_70o*x3Pu
z^{pWf!wYHkrUz>=zs%`c1^fft3cTj{w*ym2%4S&r9>iI|PX!>XKK}^JB44>rO90*h
zOd$`~^PJvCBHuNM9hCw2rCS6XbcTClZg>3GcQD?_LdlZaZ+hnGCCTru0eBFX0DsaN
z&tFCl^%1JePV&4cB3m_pC&)c)N$O9nrCM1=194R}emEL(x#O`7YOJz21gxah`#wzC
zR-Eww@F1>@hP>?*`m$NHF&U^mgq1X-Z37i>J}|QYP|pB(5Vrvf$z$~8#89KA>-!`E
zH96kXHxn*6+kn#(T|EWhm)+V0<eQcEzF&>!omXp#hu1l<5Gvl4j<;hXcLTs1(GPq<
zzT+C%_hI0UIL9AVL^yW8@A#W;ULCkQnb%VQw!}5yxu|p``P>Iw>Uc9}{6)a`3BQqF
zxebK<qHSJuYkZanwH&aE`etCBGv3GhO~7Amj5qSRvl*E0Wc6$XEZNLMZ$yPJBwq8L
zd&(KvZm;lUAoc^x9f-mkS=j{62-W0g;1*}-afF>X<rQ!u;VA{G-NuX`LO$J@+SE<*
z3V79d=;~xF-BA}24raz*WL!$=ZtnA9JuuJ>05fn2dDUqWj?&BHn4R+t#A$?+W@>zs
za;xA0`n<4Bv?~CcopAHgZ-o1=Pc$pD>k|OpvzrJzxEW|;TL|UZ&$IEvxSL;9<8LhR
zj43?;oSX1l4tyMWtV)d#cJl$?Z)czxyD^U0jm_@H5UN<E9I$vE0CrP++B86W$xEJ{
zGBd)>Ymei(Eb`1J4>1p5lhgmC)AJ0im9Nrq`r*Xbl&t?d!ade<!B%4#@E+loX8`B4
z0q}YRJ~i^Lr1kJvx{Mn0Ttb}NnWs_E{5@eS`N=Zl=<|#@r4s=2bjPFhSZ|b>!lUXs
zNhiej$y$8dOj{P;P$g-pqz@#`Ok`OrdPglH;v1;RKk5a$KkabT7Zoj(v|Q3Ym3x%U
z6#k4@AZd-Hdz>MjrwTRO4RiuvlXgiuC;qOYxT)~6of_X$>IA@Oa2)cFjAL#oDg!{O
yzT}?%(|^)?`47#6(B$8&6HSu<CYp|U0RI9DJWwh}g4=Ka0000<MNUMnLSTYPxv*0J

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-systemtray-update-disconnected-mono.png b/client/ui/assets/netbird-systemtray-update-disconnected-mono.png
new file mode 100644
index 0000000000000000000000000000000000000000..519ea014a9575ddde4408412505f2cfa91fbef83
GIT binary patch
literal 1322
zcmV+_1=aeAP)<h;3K|Lk000e1NJLTq001xm001xu1^@s6R|5Hm000E>Nkl<Zc%1E+
zS%_R!5Qe{=&N34f7mP5Y!MLD;X22yF#Qnh+F{tR1s2CwCh>D<sf(ou7C<YgZ8-fr7
zQBV|ATo^&3pdyF~XvCOch)an3OnQ3p;ndHqd-`<uz1^+&&;^&<eQ%wr|F2W$RGkYW
z8OcaSQbMZk_i4aGz-C|%Fb~x1-szeH>c9v89poStV9b860$v050j-i(lR)zHP7bQT
z0(VstSNwj=#&;8ezb67z2O0*f7x;O*KheWi-y(uB8G+wu02&6oY~&ljUf?iilLdC4
z0uBU@295v@2M)DoOMr!DWES`h_!-y<d<$#?zBdOcQVn1ou$GX+i#>pX(llH50Y4e;
zrdPPFWJLTm2W$bJ11>Y-0;n`w4SY$KHf8K9#kM-~$&`K62F#LQ`E_^2yFw%3@N?2p
z-rq=yM3KDrgjbuLDhbg;IjEJ0kn(fR{@-A>Duk`_sL011B}fSTJKey`nHJ#7<X3%}
zD1Bx&D!@3fov_DWVty9e{buK*6N#qTtpU@$2#CZOA#dL<NkRn9bM|g`Kw7}v_I%v#
z_xA81n@<%1FVO;70(?}EgdDx%Y)k^bl5LsNS!X($iPxPE)dZiGd&suU!aJ7~4*|Z2
zKz7RiS>RZ*-Qk&NoGNGwxYcy3z*1m$WV7Ldc8lq1yDu!7t|{P~E+q8qVbiYwr;v}P
zC##%4)A?Ep{0&?Uyx{b=0E;MA>AR9R2H2G#q5b&>Lc!C_y<dRvRzh)9x}NC#-er0h
zML7BrP2Du`iv#Y#T<i2N?E+qxQb~*27d=IKW%Pd_5s5Q^Kgj3vr(_M?I3eA%E>hrq
z<95H<)p(^!**2pTi3<#T&48TibX1^vZHsfj8XF_9K21vPIAug6E;b;qI){GSOcf@P
z`i?M@0<8iHa1wBUd-t!1NL&M~Aj{EbNk_lwp1nsPDmy;XR}v05p8(4vUqhF8dQT=R
zRzCWEHXbL7YL$G1*ORZ<yMXhZ?obwTEdF%%G3|#G{jLGm*%;rdKxn()boxy<t`6K7
zjT^eC*ME$B`sls`ILql)9Qad#uSut!pSg{MdI3XT7n)WX)f&)2eTHzd6L_ERR{(!@
z0H0brGr%%uYiP3E?uyV$=I}}KQS*^|kbI=OHHn_!PT(9zqVIK~VlxT+2wdfW?nkJ^
zu`a;Dgik3x-+O^it*7hz1ujuEpC^mZh0(jXqD~VUvsB9T>T*--VgoQS2>6v`yN<q8
zXnNJ>i^P$HPBRAIq}VLfqcO6fBH9;$8E0Hk+Dkb9LblMf&2ESY_{eS|RPZ?J9}>1_
zKThv|Cx7xQ1^#l{BO|A~ffFKqt$}yR?^5%GYCZw{MSFywws$(Q>1^C0>|&)v`8+}R
zkd^8-MQA(Omghe^E+zCq(mC67mXW2HC$P!+f57>9#GWmrgeWEMq&@m65?>L{v5<Xl
zg>VXcgK)|d!O0E;UNqv1Om_|W=CSZLD&;9co~!3+BrbnW*i6=0>N86!DBTD^h;-LB
zqF0YmF@x)YgUAZgSmLUXP3<b+El0u=sgVATni3I{{kF(=E6ro(Xa!-L+(EIXszQk5
z@r1+vO%90HDI?8JFS-%Xpl!f$_P>ndCgH#ygCD9CX^v(Gu)lABv4x~)cQ?qPqBX$S
gk&I*{Bl(}pKYr1pMy#m+HUIzs07*qoM6N<$g6rga!2kdN

literal 0
HcmV?d00001

diff --git a/client/ui/assets/netbird-systemtray-update-disconnected.ico b/client/ui/assets/netbird-systemtray-update-disconnected.ico
deleted file mode 100644
index 968dc4105c8fcc22249cc187ff1b2fc5786616af..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 105115
zcmeGl2UrtHcLP$yg8IYR1$&2p{Vbqo?^sb$5e4fBHf)s8j#EzYY}iihT~YBYs3aB+
z8{!@IMr?2vgp(4GlK;I;HY_2%0h)Z@%k1pV%&Rl=W_D(lAQ*%(QKJR{p*1n95<z$n
z1YvD0h#!Lcci|qBDU3HK2yaV*aC8*JTlFD`M%@X5#S+F%8AN|yC;)y~UVBJ8KZHTF
zf;bcfcLet#AP6Y;T6F=CaUK7KOed}(NJ7gD%IN`+C<X^14pa+%kT)5Diqk`8P&NT+
zuL1Cd@E?S&AiXJok1!<j)9;lmBgY={6bkc?#Am|1d<bs>d=vs+<2@gGe!Pafe=q}b
z`1T%Ir|hR>R);i*KT?<;^H6~IOeN&Ewws+*2zmJcj{sV+yhu9cK>9o(%n6+(o)d9r
z8w37myM@`9mxBM`dN`(ryuA=g=OptQK;FY7?}0%7bWwgRr_kOl(~lXPjcE{!>18kj
zN!f2F^9to}x2yyWe7mLDsFzbh2%_>cSv-{48hT#p+HO`B$%EYjGB2f946^|mVHptm
zQRz#CKG`?zmS^Xex-X#durPl!cs?9p4!~l7`2eE;8VH|boU#cz4R|e4mY9$JgLG)y
z`vDRF=r$fnPgfS#d_F<&Qwf4IlOVW2z$<_Zgr6YZ67CxcfW?5D02uID0GJN|+Zk&B
zM*wVp$R9L3W!cUMi1<GKp+1KLu!Rt=Yp#WOsWy$RD1KqR4}<y;sQ_$+G|+RE{;7%|
zOM)_I0f^UWN%0w_F$?afho5Xu|CU3;RyuCLX9HkH-IInN(_mUEowN{eJIcTx2hT)p
zJ(Sl70Q<lMyv8yiMB6K&e|!djX)rCBP8xo^4>*oXpy3_dt4HO7a*!V^lfs2%_W>w@
zUw99nQRy&`NM2NV^bqh^1MtLXaHOY!GEnaHa<Tk;fOG%~7hdB%DvlxMQA7_Rbo|h7
z#X-L-;vZ>&awxgd%a?U6(i5E*N!Nh8Dgery&s+(8w=3EIzXKY&($oJU(8FFa9wpJR
z7t_-7%DV>KE=*s*J*|ZAkq0!CsDDC#$O~u?mo?IX_q-(eM+)F?2EG^KqkJcNxYd4Y
zrl>ApS%3%ak8Trq4IaAkKj6I{Kr$(N$@q~LSvH}tuEnVXztIA4KLQ}zKD&7Wze|c7
zB-(_sx~6CVoHYQ@FDh<#{lWhf*dJZ~^y^YKL6xUW2z;9XUiz3pM1z<QO~);|203j7
zpIBrQP!{^%CF-m+dW2~&Kq$gl;<~gCF2YOd1?mWsMdrme8f^ywuP;i&N!<s3y%MC8
z)aI6;1$}lYHo&*@F5#17yCG;h1pJWW4GJGU1exRbVK+btT+-t9!Z84y4m+<BxFwbI
z49XMfg~BiNIW|edCGkGCN3{Bgb|EocX?_+{c&QNbg({f01P;6TP#<Sx@$FV9j2rXg
z__q!X_c9f5<GAMv(?8o4!Za1~N7C@yKz=uXH2^pcybbUI;61=cfHwe10OtV00VV>_
z=^qF25^_->j`Vk=XiztVvOEB!jVGni7RL<bsf${aAMoQG1sgybK1uf{iVD!s1>kQ5
zFb^OCAW{y9#`_vVuP>&8Nq{f<6*%zu1rE7{4*-OWI~@ub!HtVxo}tJD<`fKB3_gQn
z$Y*7k^I2W3_(TJTBBHu~0b#<=B^Z$~H(|vk2y+fWm>{qS0&)Tv5)3{c^71(_FOdOI
z@`v*jOaNB^(L6;n{X7MTL;w56BmiTO832)DP+|;Ko>>;sEk33c`4Z)scBD;P^g|zu
zeZQBQAa_1Si}W`D+S36f`6!Cqi(&@m7|7GVw&+K^K)Wh_H1hTU0A|MJ|Fla#`Hl$3
zM~cXsN`pGXF0{li*o`m%T1`vbgovW_hqw`@ScZ6hd2yg+q!RSw7(n896zKE@NCW^+
zp!lZ<{g_9X*Sk2UVpqa3@I?iA@RL+3;O-AV&41y%Q-3NQTw~iWwf)4j0Mxt{mLbYZ
zl_4(#+HpLWCx?e9W^n2H3iwcV6n=_MqyzPVHYJgMuorxWX(+y_yjWHV9m=C0p9Ae1
zWYGTrXfIV?(PjY`+6;wTJUj@`j!Srs_wbo`dMciXWh+8Al?G_91t4u)-kC~A4})h&
zl_5n3hJ_O7lyr~EL+TF8rsGoN8tBLOu2efi4<Eq%S{rF)0DW{Drsz;5EKzr);gfbB
z>N3vxm3oI`=S9w;ro-IPNNIV22dWKGg>KAKs_l}7OV)j$zdr!BlcfB`=05X*2S5AC
zSrT>o%M79_&>_pNrSWz!1oFzFOPOatdlb@dx2WWN9c}I|3a(4lXT%|VpCGASkwiPL
z!SIIn3lim_49)bkKzlR0CD}Z9$53Lvkw!n>e*jRbAEwFyx&{J>x2tp>@Yz5ry(UAT
zf2f^j7TSs|`tcdo35oqN(gXB00r(q$PB&iTy(XHZnJNotNBifI>vr7a(vLjg`W(Lw
zQ@=>G0eBZ8UMCLXJqn*DL!kRd0G#U;)ZHag?O&2!qQKrH)`?I-U%MD&z8J4HNi$Uz
zw4LZfl<dFoy@!X)_fO({JOCb~)(HxirbD2+4L~X-cY0`t?@#5|19}>=PB2~5HBF|(
z@_<%+-~EbCv-q{$T%~k?ypa8b-PA9YBqG(&O|Y3dK&$-mi~M(pboq;};T;S3tl8DY
z$pxI%0eXnvS0)bm@jYuI0Nu}#dTqBrIUS(Rgk|GcQ{+3rHO|%JJ$y%3iZ?}g0J$Uo
z@c<MK`5~@@EV+(QB<E7~1K($Y&S>T1m=ni&!vXM`dKRh(z4SEjzS9))U#68ol_fWn
z^$wKIgK&MLczO7)NaR-u@n=J*@K{CYUq-7!JC(<NrffTsu)b295Ak>uUB1$;nL#{!
z&x~t$#q%o{_ks3QieH3&wu<HVkw!P(hj+#Jo*LJksak%Ce0D#J=>Yh#TddUk+!Eyh
zU5U&Pp2W768I*;zhii&<vK&}zAX=B>4l)OwXrTN#;yPdklIww`ujy4oA0Y2^Qs&@e
zXn=Ms1K(X+(0PFPd;sw}uMR$JLvWplv#<>ot<!;f>Xb|6{auXy&QLD$5D9?q=+Qqz
z8mRQLLgX8LQOt+$g`HszMO;4UugaS@l7&P38PX=|>*&1TH8Us|>%tEJ?EoABaBa5>
z0Io%F1;BL%Ljk%1Gy-}{ts5y_CYeuBnTXRXDSi&@UMoJfIPIiNSbUI64z8!j1dv3J
zD)*$0=_JvhiF-hM3xJCNny7D2K=(?`ziEaCvc2mCJYYXraxA30Zj_#j)&vh!87M#C
z0pC$!{lYdx*>_d0R9X5^F9E#-^b*ju1O%&waBma-N`?W#I6W*P2!D)IAtoW86O7b=
zREV$)-vq>CXmTYW2tp1lS%OVee6Bgk8lP(=2s2<w6Rc$7XP9saTnClQ$RHpIzknzp
zAPIzigg+TN5Qrp~FemY35GL0!&Ls><dO5fb3gRpv3_~cr2mAqjL>+$u3WFbnxfnVK
z_IhE+#kdvh^}-PFvgjeuL;lDR{(#O5!e77#F1SK|_&@>tAS8>15K&5$qqtn@ah%9=
z1YiM()@i{F{eChKi2kRSfL;O>QUdTE#Sy?y3OH6srj#IB$hY`AJu2>}L{Swosh)q*
z_9=afhg#9Ua1Iyed^8WiIo8S;Vp-`Qc#i^5Wj;q%9(<2fr(*D*-2`amX;21OR##<s
z$Fyaof5Z*+hH8-i8Ca&Wzp~{&yLfN2dUYW}S-z?CWywF%0Q#SzrVYfw+H0wE<H9vB
zM}f~~6wmZf75=d-fTNmNJ0t81ZmK8)ne83Rm8{>?nom3fU@)C`yjGTfECT?`!oKo&
zsH^&GaDaDw$D!<8x!m>+=vyJAlj_%Tt>_Ar3-yCI`o7e2@le$NBcGTTKzzOF3aTu1
zLg0U|k~Sc-y#qQ?PvW#v{2j;jkw`D3k;}iZ4pDYQl|hAwqm*4KD+_ohUk~_K^u3SF
z_73R5`bpU+MW=Z9K$uP@|H3qwRy;pFj<_VYFUrUP_+O!b4ajWoggV9cj!vJnYoz<K
zjI{Vno*b#Nk1E5fq_kiI_?{+Nh77Qcu$PpVeowgeSDL+2^lCB`)h9X~s$2tq_#RlE
zk1N;D6RsVW)Lv<lZ>;;vw6NxwEma1%-ou?d3q@x8N68-OqxV;u<Q?mU+U*`iCp`q-
zZ2(I5hl2C_=xfy?VEwyP--jv_+HY(R<+WkT$mRi-NtLgS5ctP+8pZVh*WXGwa|718
z#ladZxnn*Jwh0=m>$2nqYie*!reJ*`@DAty(Dg2U{SIWH?KVLxbzQa$$anR81=sv4
zeD;nCZGzV7x=j89GmYVlm5=oGoC;iPx=qk}U6&>Uu>VjvZ%o|Q6^U!AP0&eQm&8Bt
z?nAYI_Ok1~G<m4gCg{Ab(`5jBm)v{j2W`KUb+&TqgDP!8nbdWPf8gB}pj6)vdzhr@
zS&{n+w+Y(r*C{?Fh0y1r?<;xzBKkfh&)-voZ+aSq+5|~->Ea&nJrF?V`cv44N9RYC
zYlYebUGPiC0es^+LxtwT!S`2%Z+aeu+XOm|+PVh5ab2QlpB!8l`@9ma@vJpDZJwgf
zBcNZAJ9f|(-&iixcU=3d^x9Gd{XyAsm;w8G@La;+Y^h@hc#eCz=4e9(z`He+jc3cr
z)VIXvD()ep+YO$BE-d>UtdA`<c7SI%CyVpT*cY|aqzs@uJZ~i#fTBU^P}x0bbl%aQ
z62pz{u4q01t~~(g?Gam3{DZ7(LD{(HO`Hbh;@BT5wkNn`Jt)1OjgA+`+$G1|#dMBR
zR|c@(tp=2zpf>M9n((a85_(l&Z>yC3aC8|+yH18WtMWR0*!v{)OjmW}A#V>IT|P>j
z5h_gv%T%!elpFAPP8~j_<+Z~-c#7y9{AX!pC~+U(PbhSbE+r>s2)XA?8*3dz{Kz>M
znXke=N>SMoWV4&%O<pK`w;3s+3|ZwX{|x7ZC7sI*_tdEG(&)hcP~sUj;_`rW(%MpK
zWvhH&>}(YBtOBO5nte=h+b>SnO*lJN=DslCJxJ?%r_+b?!{F257*WmrtKz&$i%${P
zHx&oI6?u;*tz1>_zk|85?RZv*j^zFh_W71NI|Oi}?^J63LQ6F9pxjdcW0--0u?$?}
zo>X1QAe7QM6@q_<W7%Z@#{pgdXi^q9H<AQ^?aCOyRqD(H=xcFZnc%&F_T|6>8muYa
zC57-#7yTZ5pM_^8;J&*x0JzrSPk=apM1V&$!1y%))a!NtKLA`K)DfVRy-CJN&ZS76
zN7B4Zj!UAUtnY!WaR0E(`6PI*nR*hO<5<@GO2QBP^##B)+%?0e^m3Bq^@oz^)5SgD
z9oN-p)&CUAS1a=*nvxOF=m>BbK$Gn;-L5|3*j`igYO5UJAHOSy{s|jE(e+kzK4o2(
zII}@pJZP$1tg|rxhx2ef0MI_vg&#FVo4y>q1oRTnOF%CHy#(|Us5laU^9AJp;1e?B
zPg2N&V-WB@r#R$eoD1hC2tq?L%peT^%P<dzPs*5NWSHYeXw11@RZZYL1}jbtQ$q+H
zpeP2Mc0h%2Fami7g98^%N`P<DSY^P83J{v)!U+q2&=AgGaDb4($0Hg5A^F)F2p!<F
zHyF3#nn1`Q%yW@`7GZ*)%z?y=B7ecD3J?RlWNx5`EDh)*u|RhCDo!fN7h!k}vqQ!p
z%#Ig=LmA*$2J##T2r)bS{4qO*TrwaWgrOBj5Vv9pLOiqrPJ6%;B1kZSe24-GMo}UI
zNCKQefnVVfgoq2{NCO!{0y0$N56_8U0U$M^b0XkMe@+AnMgP-FKraEk1oRTnOF%CH
zy#(|U&`Urs0lftD63|OPF9E#-^b*iZKywm+eZI=<X&0r{90mH4%2EP){g<Wm%O1C0
z|7EX(vZO$-|FV>R+2hvhzwC8TmK5mqUzXA@d)#{cm%R?kl7jC=|FF*z_t)Y+nTiD7
zu>M-*{nU!s)%T)*lm+Ns{qLDd-`^r@&A+P8MCUCiqDxiMd|&#{#WOW<KcuSq&}F_2
zs_0YMJl~W4Q8uvm6Wf1X>QNP3Y;Cvul%0Hc`WN^Cs+}pM8@qV}XZ1Ir^rP+Yd(%J4
z6Y9TnIc)=QuXtB&>zrQx_o#oN4dDKHRoZ54=Fz&pN7p@Gf4}<AW|lMk>%`yF>%Uk6
zpnp6gM4R<l(Xw^s?-g?|xcXk}KXMP};o#Yon%>{9sLrW$YWsVjLuUXNaos8s*QNeL
z+z1z>RS~*$l?L>W-@2!Cq3cj>e-F;0?g%pFk$Rj#gu{26Dk&p7UFbj5l`sW7VM1Iy
zq*)mnwV75pFN|j^>00-QPc45B>Qfz%X|k9OFNU}ibrhAESYFZkE_wGAE?+?7MX~ad
zk#<GP&~`eQ6T)-1bgh52{5`DaAX9O<Qu<4VZ@DN`$HeqP<(C^Oq7z};lq?0uMQj%o
zDMuG+K>yJ?v;npKJ&<X*6uDBm!#+W-PavlZs;p9>Je>&pdO^P=eT`|DymEB)9NGXJ
z59;FGfcpNPz>g}W6N$Q%;}b~CBVAu2oYM3n*4K;DOT`1cNGnU%_d);RT5bb0>+dO`
zC!yS>`UFz-BByLgx)J&#()uK6woq>TL1+W;dt#|tv;l4Sd(z}8eqW+bpeg;!>FdR5
z5s#M}e-Lz!XY*>q7u2S|CoWHE@lrm4CiJghUoVX&>VCQK2bnB>CD1>fud7KL(1pK8
z$x(ht^9j_^ztVlZoIV9;DHr}A=pN6w)Rg{p>+i{zF=Zd5PoS#)RqX32+|t8x;tzr^
za8v^}ptiq<eirBm=Xd3erKHPLx=kdjtpC#UPO9J+&x1Uci}_(VlieEhukLtIEq{;h
zW8-`d$VMG~iOagY#U=WubQ$RS8uTBkMjMb1=O$}R|HwP|*f`&-?D(p@=~)sz7qLIl
zwSMK{6TTZzcRaX3lWY0loAs5z4&=@KNs@87ya&95h0ZEJ^T6UZ0sR1eBSKwYkPY7%
z(&(B#Xa^<&Xu~Jam7SCti;By>yu?BOYK;f+JCg8i<~JRte(9=7o+_|UQ11GAS$Yw^
z8&IhYAivFC{9SGy*unSi6O_xoUY7px8MFcTJtn1WKuq`aZ!m6Px~6OF-DgGd3Ceq4
zFUtmmYsC~E58ADi^1VgsJDgK9+4hsOz89aM!u0hrZ6G*%p(1U79eh(#!S4=#4?aPK
z>g#3dU$A#5S*8u(cgLs0H#VtyE<gO1eS!+v*UPj4S!>0V*FD`%zA2xeBKP&O^pDS=
z{$DKB2H^LVXJpa!sr>b~;S+oleZ4FjD797$z9($&p{DMO`-zI|6MQp$y)69;+kgnN
z4Zv?|&(xUisWzh``UKxxUoXoB$njuc&PV&%8rMB#0~l5apWs{W>!sNMla*e{ZeccC
z2|u5%SH-W(w@>iR_w`csAC$cT&S~J=yKA-nQ+84weS+_%uNSug@c%+6|DT-WE%x0g
zeQ6^sPd>qS)z{PY54sPabWer$b9B-MP&QSjKEe0c*HiijeJ`eTULy2^exUdrAEhVl
zg=OOte7Ai)>L2R8YYCl;y$iJSgm?V9=?5r0y7URY+rD0?d)yzKFH8TVFX*P!yg#K!
zbwXYE1mA66FVKC?K+wBF?|to-=)4V}Y)30T!S~$P3w7UDQQcE*gO0|7l-`R&E%*c|
zgYWgn49e;OI#v2?AiI@i)&`(0Xxu0G9`z5pZw0zndEK}DT%C>wi`xK!|EY1G;Cr$G
z@bj%f_v)Pwi|>MUIUbZe?$D@D@IBaoQ1`Oe_lS-AsD58Ov|CW7{eYlN(E9`mn=Lbt
zhi3sk6W624aeOy0y-fQ7s$bCi1aho^8In~M^qi!!uBEgIc1z1a8=&_IWNKfq$1huJ
zXF+RWZ3tDbRSESz0nHkO`#aBRy57^vv-5#ApzM9YVp~C<V76xW9neHtVJ>m~2Ixtv
zx~J^G?&osh2MBDyHIvT_$bO@V?+n1+*shw~+pJ6D0bgGe=X)r&9}LHXAa@<VACidA
zZc#QxGn`GL`uPN4+cN<0e3SXQ)SD)7f$o2&>ZYzjlzW-$ANHl-dnz%Wl{%k5=r3)c
zmBGWYlP2_{i!wm>rPgoIcoCP4=HfUWRCj-X<ar*2?aIzuRQJXCVnaQayB87DfUMXO
z<h5NFx>FZNndx3QJ|xcpP*aC0w;{8##C0wnm+2FL?C^a^vIN}=$_e2y)zyzS^8?*p
zQfZeme%D5N9j_G=v<)!+V8R+D1^AKZ6F@#eUoTrux3#H1b;<_YEjQo$BKHRCcsvN}
z)D_V^Jq_s-Na*Y7X-Z!Q=ah@H+vv6eeb!L0U)gJSWZQLVKGjTbH(!V2LD-+7K)sig
zh7I`;Bt4UMFSR_42Z45l*X}6Er!@W*yN~+?b+J|qa4=y{vQBvm$_b*^zp}b!24*_~
z-wLhU(y@F<eb_D5@^}#X7`qipxBHr~6_9zhby?{h@q#`(0w}$9N7r_s&9!2<7E#yy
zi0}pH94ssStGjkb#DjAEo=URD`l<4GPR2OW&Z`V{PsuGf$5Gcdfb9<GFIks5R2P@V
z*NTB}sV+?#%Acr9{Z~ZYlXBMN-l6iNd&&l9>B0ttYj+-L$ZjdxbrxcKt!_V1F4}ym
z?Jo{t4K1&RHf=z-cIS3Q)jdf!z8g?=Jcxe2^7A`7vu)rnTwD4VuHRr+Xx$6z3cj0B
zx($GL%DDf$ob!)!%I!351G-qdqieY;b%qqYOH^=9zdYDSlqU5rT)PvkYyD^&AGuac
z#<-4ZA8<X9g!lO6LC>;i7^x{606i#u7PGc>r>XMoWvvy1_2gwVrzcCViatxy#Jd3)
z=dIC{tjlFNlJ*XvkB4(QrPuB#D*N)0PR+Gqp!>2}yHh-#(TN;OtQCW^WhziVFHb(1
zs;(7-y6RId>#H_w1IL4Nv(nKY_y&27P}UCs8I+5)J37z>zB}8_48d=aXXBY8-=hBc
zOeNNe!Ps#O$e~=V-_U|yaPHC@&lIKC4Y<eF0<Q94Q`hKxO1lQ$as9@(s(aXDo*fSB
zlcatV3Z6qdP=41isAZc9tQ7;<i~}5z02Ov_pC%);<J-VfkSv{x*9EWvKUx{(q3&vm
zhGb>NgUsOk8Xz}3j|acOg5!VuCL8pZ<+hK+^(XNFp#adAtM(q`TbkpRpsN+)_O47^
z_^tM4%wXPNs3-G5#^Dg+ykHUl%3o8qDyy7yz=O7k`^m7bj>7qFq)i!KWTj;W<>J1J
zWB^%oRK#am-8;k#`C1j$0m4~6uy-MtHyq^W2G`hr1Ob4p<ZK6sgnLn?fz&5FBh!RI
z=m+i390(_p?GTm=ZIUd#Y4RD^6rM?>E1TAxEtTO~F-_`67iB^FhI??nJsSwg>8K0&
zeG52*HlXs^WMDtKtJ{j>(&<{Uif#w+9-tZM@mV?5rHb~Y`d;*ku1{6y$MFQ{AN-bb
zS)Wz0fpWEXNEMxwMIO+<2f(-D6KHL%SXt;sS2zXZLmb0Y__hG&bDHT&Zr>UnkR9%M
zV^?rH(CAvRZ%xOF@FTQ?Xb3CjyOZFYfr{{{Pa|6bFlU7Op>V#dqOFflROa1)Y$@oU
zq6A>f*Z}4&r+_U)0we*H@3ukBwPJd$%a#DvFJ^ESzF&rUadJ)^-(8d+fVp<r9O$3w
zC7_ppUIKav=p~?+fL;Q63FsxDmw;XZdI{(ypqGGN0(uGPC7_ppUIKav=p~?+fL;Q6
z3FsxDmw;XZdI{(ypqGGN0(uFQcM0&z?~lbONt=%1TvBBYe7+E01{wDkivwxG=egu_
zu{e@0d|rUh4U6MN7&j4%n-|CV_*^`0#ZScYG9ekC1<xJ$K^VV6#r^pVjI%J#f#>`p
z0^@`~#JPgFKZ{XB#Tonp!ivSng>v|OV9=1COPI458HAM}ZUQ$=SPU*n2QX+3g&49J
z9FlHfoM15od;o)1BvQbGd;)_GVsU?x2zZWs1B3pE6o1Gk#H|27`Ln_}3vQEA!i4Z6
z(F&ep6ykt}g*OBi!UcW>2oXKWun+-RJmPW?Ah05zL);1k06zyZ4!BJO2>r=8JQ5%f
z8X&~siX-3-QXp+47Lpr5+ySu&(2>tc1P)|zWSr#4Ul2#skQECdf5<x^0DTF5q-+3z
zuy}#&fFoh?0#<<|D?xIBD9rf<4#GGTCzLdKLm*0lXz&KfxlnW%7mD5=uklBsr(^?h
zE?FLkO!(sn;uJLk^djLPU*wPCMyN^T)&WZp#r=!OxPTnUVwG#fho6ufkY)xM7m@=U
zaY>Y1vUK<}<dAU=6&Lc%Dvpyp7e^`U6x~4*Md;x!#zp8c6~sm8g>f#1)X!gNcU0U#
zXqU7&bxDR+#oP<ybo6LICF3R~$pNb=K@Kp)Em6Lqz&1qpphXZ|n+O7E5d=R6VJM7?
z()n}A2j)~he?bBfo4_C>0Ja6`gcXP{5|b5Nl0Tsst%OmEFOks*t$;FdN^Zq*4oOI{
z)e0Cdjtc}u85y7<(^FLn;sOdO{FL1l$MshzfmI`i52$8V&kUqjZP38Jqo5MNC4(?E
zhQMXvArFGE$QsnQ_n2i*(_UOzSbw~?F_+)5)su}K8$CX;al`620g;^JElnpJZg;xg
zd!u>(+`8I!(!^V}2G!VjZ2yeoqb#58`NM>n%BZ#Q3vq3VN6X*l&Kt0Qeek_zjq6_R
zIf2D>v?ja_U-)_^7qQ!npU{Ni;`nb8Z^z2~j*fjb@iV-hL;QN+LG1q?-Wd|y=8zF5
zeb=GhHID3Q<M<#acSmj4Fb2zPw{Od1OS(Io8u$?X4msWk^66|J%1fPR9yrV5c<6&5
zBBBkW$SJ_cchy8|;tX%m&I=w*0~7K-I&EOEcI?hRxq=zG-|@fv&L?XSBmeB##=P>j
zL#_>pI>e15|1;@no_lB2m9GT}hbnuu=(qVym#apW1yd}C+<CXC*{q!x>t0UgH=Rjr
zJet%0{4UNmgDN9;27GC;`rQ?W4#Y^CDcv$|n$?_lH~BYjWBytO%RbI9x$%GycJHdh
z##P=uk8L&k+{Wu>j<e~=T?;<1h|1{F>SRymm&D998KXyEIg!C#8nkQqiLi@%{jS#~
z_IvQX>lhoG5A}>_)U8j|hx;4-*}v#c4)=z6VwbBUs%7j?TX1jPZg=*y9gKTJpJtyt
zVA+G&?n}2pZJc*xEixvyJ^kBbr^(3s^TI=he@N#=W_538@Xwf?p23lAP9_8;4>LQ{
zzkPnS>BO$<)$6~SoRWX{qW{w;R<1SI)w;LBx#x~+lbzZ<X;fvH*Wg#4HRci)VGpm(
zxfuAfQ}EgNJ{wkb^ZnpoaPh3kkk22j3J7z*RHMf~E^Qjqfd6P!3+|Pv?P_r+u1~g|
zVYVy#<kx~fUv_$H88qinLH3F-^8=5ZF`dY`_kn+*)~*ND?yV>^n)t?h_@-*+MX!I2
z{<QS9-B}Y~A11r+@uP<tJC3#RG!Enujw?+TTLvE4G(Re^g++VrzYe`eTdq8^%(-UA
zwv350f1LHT4zv3F5Oe2@wx+#Dw{c!<L(J-V%=_-HoVm3d8;ohoF*$PR>%-Uy0h@_o
z#4yus#<`37)x7+&-<a#%doNALTmBa|XhuY<&8g$}CR`66@+Qv2{EIcm#9+*yk76#Q
z+-CGjN=>R#y=En+ng)iv?Ak*E-Ps$=hyDBL*|f(F_wu{Aap#{r+>hASKO;Um@Q>&&
zdv4^g*5>3moatG8^@xDmspIz?pWUc?XQDym1IsD{l5%RaGj>1XFnT1HZRonv@7;r(
zVH4&)y0-1^f|Z`XH~2Ge;?A%C74qxGWZp7Zc5>1qbJPAAp*=iI+kLeRzw@eaUkH1A
zqvY6zCyuynbz&2hh8cMq#GRX+SUsoyt5Md=T=UzH@-gdpH>&U4=pLb7Psa~^I%)m$
zz}MzUDgM3%)h+IAyzSRA(m1|agQXKr*&gs?Zt?cu9QOZj=tYqH@~`}8|L#@eT(|e$
z#jP~VsRyS)Y}g`i*9UBthjUJSZ=d#@kor#h7(Xm=o!icG-JS!SnAq#ruC4J}$*yTL
ztRTDFyl0K<n|EmWtM94A*~8lzo~{3C{pmVyYxhp7b8P%w*O^}9I9I3scP9o=<@GOY
z9>j`VJJ-naSmM<1ZK3C`hPErPynPJF+v)k-yt-$|_}zOwTR6te+<9Yd!4FmJ<MS8P
z?pN=&-?bL=je0#cePrbPXW?J1CqJ#Z#i|mMb%}A~nVGRc{C?-$`W;U-zLB?S*06wI
z(s;w)|8wwikQK4moM~>9;zan)F8ttCuj!!eQGFBZr$%)BUq+~Rr32lHB6}_y(%5rR
zXRbx>#h*PE+l3um`=HjRg287zSovoiOt$@zw_xF&E+dRycn~k%%;Q*&8sz!J)A`d*
zR_$?n602tXk!Bur;NVJw#cl;|Cd}|kDJ>5eogJ2x(sotfVZCjS^|fL=K3%Z&p2dCB
zJ4rK4q8nv>F#H<an`73y!`&CY9>1S&n-ONS`Oil;0$0DS`}&W<0bPez>01BBvxo^h
z3j<nD3ha3_^g*=cyecb=Ew0WEVK;Mbc4tt35XFHQTh8|ELzasd)D86bY*n@SfyxJq
zHh6Vj7k+GW;qXg$+nJ{<dHXrZFd(mWP*5i#knMD%{*G$<+NTv3ZMd^|=B~UI_cum3
zza7e%oU)+*%sEMuTDt}?4eQn}GEVTB%QR*zjhm9QJz#korUSG2z_3-zC#9d+x6qRV
z**XT^{?wdXJ+0Z)ob6x#oI<47UbSYn?Hz3&k#4l?@QVf;tMz-nXGF9^K6{Vh7KbWJ
zYut4lnr@%wGPOfm%Xyx`Rm{A%o@$-o&Ytac*vqUNG($rQbGVsp|6bc_;bGT*W^Eh$
z%C<%3#<(l{<~8ha7~G&OQ`dB^Tj|rio&k*>H;Qvwkg=e}RNM4lT|1;-bj)_ovF*sN
z_w(rp$D%K73gULR=k#!^(RJ)vkdS@hqiH|=?(=@bjw=2O{yGzH&0J-$=28{^poQHg
zpWHn#=S<Vfa|;_*A$-3W*SIu&p82)*o6X>1<%AuTXV~)G+56tS8Oja5l#@TA!B0DF
z&$4U!)hDc;`X$Aly8J1kQiN%ESFaqCh1(celbu)favQ%p>wRKe*Ib58&746-VQ1rs
zw+#r^lo~Z$<8$isLOxf{3Q2QnHht&jmGQ0*e~w*$a{b1h>96fCn(e=~-<{p}jbFQa
zwc{G(4_!Dbb5rmpBEzHSoWiGZO@cV{TwHR(5{Q)4FOwbj)k{B-u>925_tCp=WUU^P
zyS?ue!@#9$_K$XY>G^QY)nx0VR^3-t9%`G=dFr_2_$r(pt*`x^{@3Yb=Euk$L5>T*
z_Sv=a?10~2=g($*y%WyrJdSld@4>939Om%qw;5FpZf-GXpC9KpVnk+?$=fFv`xv;~
z&Q6GX+m|37k8O3L$5WpP(};vU%inhmJYej+(dK31*XwWofx>4R5S$Zz4&IDTh}gvA
z8RWV2Y4`Ydvmb1q|GKB>Q-^5F*70DG)f0PvYSVFBuOGH--oT%6*zD!l8$O+%g;ew6
zUmcwF<WQvhg1@)5+C2GAVR-z^mBgDf(0-VKzC+vkOvnj)S9Roa+ZX$L8%=ED?69;$
zOqcgOvXyAvDP^(O6VEN9TXU?vEmv%^z3q2u@w(4LQ(GlFq;XAHi@NMxIs1Xpm>2B|
zsx9nH5TDxIKe*Blm|T%KV${<%J=Uei`wpzPgi&+e&Z(=;F3dgTQLxNx*QaXzViGus
zxA?7R6wQj@Zfx-`f5EW)7aO`=N}u!2e_c`sR;+y&i@#^?w8@WKp8oUDB@cEPv^PDG
zup-0oa(bg?PsY6T-X7J=tR}%)Xv|16y~DS3Tfez(rZcPA23Dm!KbKV>3<6Uw%#U5l
z+uCoM0dcR2f%}|RuUBl3a@kVJ=t}D^h38*CG`j9O`GeE#t1UZi>a%mot$P!Xjk)c2
zuriCg)NE^gb{Fe4J`N{NEeSAamtU>z{i?gtL5RPnU#^r@)4XW9@$_fE?%$do-|2)6
zcQ8^?mmoN)zch(ydGBnR)A@cpuP<)9s{)!|J{s77bFl9uV^{Ln8}V&TeP5<KR4Ggj
zNNj!$%J-Y>$Z8nD%O5c+*K?ca<dCdY$+Zjav{^P{chv0pd9mqc-3|ZEJRHIDzO~>~
z;{8hPeVbfJ$&bxUd6sf*D5r<n;B)V~*wpOU-OYx5VYcV3^u1RTiLb^FXHPmCZ(l8K
zqbJ*cUX$((?ZSHGCZ#4+-Q@`m&+02@iLuY75887qzi|3_{`T~u>#hC!U)svZvOINk
z-MOD*JsQti^}3#U(Y)ogv2vN3dA09M9GdpPe~alh+qia9a>E^7MECq5d3jxeWzflD
zx$(|I6T9TZO}v9U$4u(6|F`_Y5w5Y39Xw|ezNz#3^IR_fc7Dvyu`Q;>dJdZ%8*pNY
z<v)f2H>1sC_nwdSjNo-(^?Foq^_KV^xm(kpjgRqsRn$M%o$#5nsA^10=B4Kmd9j9r
zI~e|Z@nkJukLaW8(wFkOS!Vhk+?ca{*3qLQxAO8kBrhHD-h=S{!=~5mi@OINChv@z
zJ(D0Zjx`#WIPPS7$1U+6w?-QL8<4j2XQNEt0h_#yiMP+j4&?3gF>%QBP2IG@_+G>S
z+kn%P)8c*Dbq4n|{P%Xu(RICAKY8HS?<UV7HhOh<de`V~cZ}~6#xv~xcW*7H!1)Nl
z^^5iYb4r};Ot#75-MreTLpm(1#`nHFd*!U<(}_C&oCxhS`pW!?)%p#N{?u~Tsw**>
z5gC395B{=tzTw3BUkCkfW?<ZDBgO&Zr<9LQ9ghFf#C<|e+dJ9$<70DcG>q>48fsR(
zA3bVYB~Lls^G**t;<t6<#y2j!Q0afin!L-u=V`axV|)m=_tp;v&2xVl9`(XBVoZkX
zw)o96*#3;n!t=MBYG)MH|MBSTAl9SXesPJsH(z3HI2K%s%%gv&9ID@Y`0LEmku9N~
zynJL-hj1JC&)6Fuj}{i(f^;!9-1l8N)n5=}w*1nk)CI9t5&laU#;o8LMhxG^OowGT
zzi)1t9De&~3^AG&jE<1;d4~@(|B7~JuZKFkd~9u3V$0P-C;Gg6@#5eP#BkrJ;79j&
zpS+qDG~zTjNA-jsf4qcom+;8g6XtHz<kOY#Aa<)q>HZ*`sdqm=b;xBn+U}ly_P?8d
zY)kunXb{8I*z@7uhg*r;DG{$n?Awx_xbGxVRQGa6=c5Ie8FwEyx><Eg`oZ1nmIS<x
zjA{4OGk8dE|LtBT{}wslNMqmOjUK-vhL}loFf};VkpHUc$U|F+%)+Xc2W>b6b3cqS
zR_s}Huda1&_a#N6-D4xe`rJ2abJk>J-?SCZNoJp?^|fiUh_%Bct2X0)&cFdRo-BVd
z_hFvH*--nx<Cl(W{Ixmj(a+}Y#!)|cRj$pSa4J92|4h#<PR@o~u3kBw5zuOLi^8>M
zjZ$py`d+%jJH8;=hWotB{Urlt@<SK+J=%J}`gvlyS?Y<VUOgr)2|vuuKhJLK*(z}9
zrxeB=-XE`BCbK%RDy`jI*lW<2I?JnFUOw*G)uF7s*svW(s&r*Kv|oE|(yME;)9bqK
z92_-zq~DhG?umYrS*;z1HjOB(W%_c|jc48V8M-9f*2vE{+G2419++gclbt?h-soXJ
z%w+ACLjSz9r58JdcN&dG*Z&+*a6D~y*Ij0Nhn&wH5q>g%s?$r`yLBC_ddzo?PyQ|N
zoW+;^#zAlWikd`wH)PBu4nAf#{3YPZ{HKZA7p6O=<iEUe&W2N$)7oGS`%}cf%aiRc
zTLw;GCi6zdqP8ld1HEmjS)(5=b@#2o{Tlmd;WJxK6K)+4^9Hj<*0){85_xO-@Qj#)
z8pUT9*1F-&Cgu{;8+5*Uv4%^+ySVk)wOnJT{`lkp*lYiRr;{Bz9W-KmPPM%_^h8tF
zYOcW@BMRNN-y0d6*Q@c~7|8h(;v?=KzqHKA^lsZM*Ig|*K9NOjve9fCM}Ojt2#f9d
zp}Fgp^rWuu?}K!zE{m<{Hz%KKLR>m<{FXzV6X{8n-hTpP?us?J>3NTp4Qh1k#Cd&T
z&A&U-b`QPolWf!h>(1IO-HuIg$gkqPFEFl3m-CU4Zrk7gXz-A5o&Ch~SH|b5&a0m9
z`~q#1%NMjkVq~|N3!z44XRObs6kJL4VH4{g84b1~fY|j0RW?tF-Ou<T@x_eT5r+qj
zsolz#SoZF7ue_tiljmM(*(fEypT$L+kss<gu59Wu*7d~~=EOyiI%Zt%^w{)OH<twb
zW6UB)z}|5o9k%akZQ1TFc>ZTY4Osbkg&lH!4E*N+;Zc3=@CF6Mu0!vKtPHs^-sQ>p
zG3R}z4&7@J)$Q_>$=q9i?SEyp(VjT-aa!7$Nh>Fu^m=TX{<Kl0m_@&*HEwpV56j)>
z&-MNdQ;%-y)M_*1%shY7Q)_b1wRb1(;n?Kbz`&!SYch^Ju$wo<vrogvHJ8V<h`G|Q
zAb-uUxlMCZ{=$gkwzCeujc$En+J@GSDbUxnaL&*6t~0UWwJu#c|FQG+>QB3#UFiCu
z${!aKJ`P*#UUOahXFt^)GSo2nx9S`Bw=tO0^Vr$clOGoo#Pil>Q}W!NT^LK)t@(X)
zQQLEwmn*+{)Ma?1?);cj)vGP^OzXLI-m8y^w&D4+4|@=aZN1*iVJDp*W$~$K#gpCd
zk6-q2u;G0$032>Vj^9RL)i8Nju;JuXi|5DAtw@^maq6smXuLk(H=6jbaoEBAgZ5V@
z#y#~(SlzGpIq2104psTB_19```w?9qo7#3e|Eczftzm&~^>ROC_M7)`(zs-P$Iek*
z{>x5{IPN<?`TF+uo0<^6a*Dow%{pRhnS3rixYN<SxpUmBt@~rgl!QX?1D=00IKAoZ
zqRd`ISN5mc11_u%jJwHub1TZmYtG-ETOKiXO*WsqIVxw!27bRQO;Yj~xKFM9>)5RN
zDN6{iJqhEt`Pi8K&@DN<?d=%HJA0Cuo`$Tw`Gqr6r#jt>gu>5!G^o7V@7kqm#KhK%
zUwPJwTpd^hZT0?fwFi!aGTe#B&}0%ePZ|yI@M&fCbqBaLD<@ko0K^dt&fcrZ&Endd
zZEl<#KKE-3XG}l#w3kLKXf{8LedW3SwWZPRi1hePXKa}6kbXQ#XdCCVJ=eNe9&F|O
z60o0N5>OYhn-MR;D}3YUv@Xxj=ioylkG5Z{Wws!eUHnu#^mf1ADfu_oL{+)t0t5{s
zn3g`CE30n4FwSB|ti#dq9}Ny$6#lZjCRtC2-DwM)QwKZM@YtH?H+bzw1CMTD7PrDS
zyW$|X`JKY}1)2SuPFS?NxiiDk&v@h!clNU9t;|L>w)l~-IGHfMmrHB2^_gZ339~0D
zZ5?vL0^eS`YRoEpHqH5|JNvv#E3@@UX7ve!_JyaX_OSV6(QKxrJ+bU>NZQWqALo!N
z#LhqSZkdDycI^MkfMuNf+f4r9ldT4}v}l8srdr_9v++*OkaArgBf=(sKdWEwdLy?G
zCzDMh&VPz9`@!hFGkBv_{9C&@ty^o+gy@lM8n$3ky4y6Tb<fQSXbL;H{rCAyujx)F
zvv!yh&413^Wc7p5kc9Wd$Pb;T=1p@tc|B#Gx$AluAqKY`Hsn{Aw^>zLzn+dG9LKm-
oCHgl1OVtZSrWI#A;2W-US^xZI%VRfT8k88+Z+PDmeOv?o53_1~_y7O^

diff --git a/client/ui/assets/netbird.ico b/client/ui/assets/netbird.ico
deleted file mode 100644
index 2bab8a503d92aad4dd9bb5eccc02f044762a7f6b..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 106176
zcmeGl30zFi|80k;2q8xYa!0l0mm@0oEr0jXr6MG9tkSs&xz8U-BKMKD9Fa=4$W@fW
zCQ2cG6gJzf<NuxAeO=mZx3(?3KE7t>&71k2Z{ED`d}jv3NLULD{gJTl*vu{%wiJF-
zshoVjmLx0`t{E9|^P@2=y$1=?*5>3d^v1B3)=;xMH{TY+g13{fwveLsmPujQ{G%jn
z`;6%mTFZ8og{E6inmBeQDn-x|p*C520dRKdGHL9n*^Vh+Q#T${wsHNG6F+OD`m}jB
zt&8?$dbXY4Ub)R8JF|3ppMlobjt$$seG=7L@qm%uD~ng@vt}jwt6BwX-ylauOSD-d
z5heAm^VK&;)T3GqHdVJ$*6#e)+d6fY`toyGkJMgR^>W@5dE(NS??3atcnA7?`(mEA
z-u>srtODvbQT!=KhiV#~QJH0R-szmh3DPl%lAcUCx~_*J^*m`pD2*&xHjUKXr|ldK
zW0^7;X3zA&>DK-q!f5ior0J?_O}9LBIkh6QUwTKnE!CS8Z*My5sY`-FwAuiy*FUFn
z9w!Ayv>B>WILALd?A)=Gt&0_@5=O^%+&3Py_-hxs@0AE;rU_#(Hoo+ky;48y-u?><
zH@0C8ng4VA^}Dna(aA3jM-(VXQ*(E#czzz8nMs%K^|~OXRjPZ|<8G^h;!DSnx{tIO
zG<EMhvtg}$spcC@<FW8(3eiDo#gb5I_Uyo8dLy6q?&bU=#&3E0o4(~U;Qn@VH2Pw`
z9)@GblnxGkt`O~fykv|tb^VLy=R%~d;$C|=kTgsf>ez^u5jK(L{jf8(z}-fA9$n6q
z(bH>Kyh8NFBDa&+zCB;V|0}w`)9Y!A`yTBWc@Gyyj+}L(=)o4Zi*~x7AFdC%dO!N@
zLFJbR*KhYw`Z=mFb;~#ZcGT;GF3oj&5#5)n2#v9dlP%TU5|(=>o&&DCF+1jF7zf<8
z&@}lny(?+rl>EK7={x0emZq;{ggiWz_Ejdt%RB6#gwfGXb2MVD-gTog!fE3=<tdI>
zw?NlnHa2nAsV^z*?G>3>G~4~XZzq|X>nFsibi}TnDSZ)=*_pMPJ_T@2DV}^qwQR~Y
zhnLfh7Ce7G&bG8OYgleZ{H6sKeqC(KNIu<2*@1Iq#{@_BIq!40>kzem60y`wy8Zj|
z)|2LSkxafHIDM_l`WDFw$}3BTNaT}d(G9v?3%^c2w&r%E=D7E^UfZ9XpX8J?so3<B
zOh&<?jZ~JRNB%qw4a=d&Po%!Y0=nI_qMmMZE3jt~y&&M5EB)zxJAGzykDFdp8Tk>N
zt<?HSA9Oakb2!!dt@8mNgZUAvg;tD^iL*9PU2mvOHAs8x=`>s-*h<SL<#kBcyVoYB
z=#{&?&tHGw{e!;u?au_vyWA@C{?|{POeWARwp}`Oo1RKH-CbVRxv*WbTBiwp)yPjz
z-}om<W~Xn0m*Et>8^sx3nyv@OzX;KYDrs-uo@sKx;A{MfH|xiB&c@uZmC}(4&#AAK
z!i?^QfPN&IYi4SX{`cIQjF{Qu^|oFMGzdOx$Xp+yW0^6m*T`3&R>k)y+WOr0>_3!r
zLyy<g?-Dm(-Y(4Vn051|{-TvOU_%|!4QIrc4%~QFZL|4`Pabk^%g)17(A8FhF4y&@
z(tej@-J9>V$83;%+aglh<+eqrUD2}g4P(c@KcsVb5dE6zowkYBeM`ERq;60fA!R(+
z)};^gt%o^j`rVX+lk(3@DOV;%gsnNf%4f%=LqQVeEm$${mVGsJ4%3QS`%f{`<`F5~
z&u<`o?2E}A3l$F(J@1w3CjUm>rH!KdUA5GdkY}T22bLHxCoweo4Z3wtA(}OO0d@O*
zjriyv(+-TWKcJ#djh8q<-+3oHXtkmIxqw42I(_RtEO)>wX3HZ7OZ;Cx%dnAz?jc@g
z6=~0g+jA2StI%zz-7Ht<XJzKSy%{)S=%u+d>9mhdz0dSso#V+o?Wg%+`=G}l)E<xW
zQZ-D2eAa(3OLq!p{EYfAa!Ts3OLGU%3lc`SEch|fDo#sjg6*2~a>G}8&zv0?AzxVD
z>->w!H)7~YR9iX66N^-*j>u%5QgK#I+LEzoMts@8EA%O)-Af8q4b1NU^WW1eGDCXZ
zouoo~xYwDgurPbV<fso%Z>f!c@i@z)o2gRYK}Dfzn^$MQjQ%+C!t-SHk~M<|#`)f+
zdqqXQbzJJZ`<CB_4t9^WwjBCMAzCIZgf6{zz=Ri%7g5W-o-$)kcL{&6`P?$|d%;;V
z&q#MG?f&NZ6KTz41-e4?UjN9|MT2AQBc4QDa0{AHa$%C@uEW>E6>Rk!oKNo5lL8s6
zwK$#ikN3A7H+`*@PD+PAm~n@pp0@NrfMTz}r+Gu3p9{a8&|6=k<Al4@=x1pRv#`70
zWWoz3EuwVF)*Mr+st}&k>!(leX_5cCtmL%z@W%rr3;7ONvGF8>55;r#J$+@jv*gix
z>-Es+-ET>>6aQ`_U)Hr+<kUWPTAtKktD6ggEXog9ck2A8U-$!yf+1@jblIk+cTZt?
zxsj|(vRZ4~+Y23&rj44Qd2E+mVvmp4Xy)yfkCD%LALttJ`r`d%M!wRt>>FF3nHh|l
zV(Kwv)KE{d4Q9Ts`0B*icYb|7cX>U)cV(x01<sFR&L<kbNL*GpU+aW_=8g2SWp*i@
z-Mr2m+-)5t|LCTpOg8Dl+wYVJ<>e`RnW0x1#)&T@u$X7|TFiy%`EGXxB!)RUdv9f~
zJMAG8kw0EBamTgNyo@L_!$}j?7?_$mAB%DEJk#pJnSHzEb38{DzSN{TT#orSWSzf^
z!FQPq+v1$DDo^BR%lA<unUUVS-D`Q4vcY-p*6h6d`!}uHt!e#K-gSiJ&G#3hO1eid
zdi6+1^6Qv5Jp8qVbHw|n-v-}Pa2mcd*qQdjlljzb<bru0TMTTGq2Mv^K%Bq&@)@g3
zgU!RU2S5MLa#Gckw9rp@vD5W%V#uRWrQMH7xp`U-AGBs*+OtpVe%kbKqu-tWx!))m
z3B#5@i+iWMc;x}ssmC0?{$6sR=OgBw@0Q!tbdpVFJ@lq7%*rcW|C45{@J%Me+e0^D
z(wV3CUXM7h|M8vOZa>e&9h9@J6<yyROw7YDrYF<f!?5?Q|7I6IoZe;Shp-*@pGHmS
zC^4=0U$xCQLml58m%^xOo6E71j>9KDH`FW2pC%XnpsnGlyPKyZD;#_O<&kqI40CI1
zCbNF<y6uCt(hfxi6l9xip|{t}^JJ>dGfqoFNbGg(_Xl)T?o0{RPh@>{?-y?DD=Fug
z5FMi__uobg>#%pwuF>DMR(7^FzFsuBfB3u}+Iv}G51Ch~ky6x+uRDFoE1a7C-GsK%
z?3LuB{0%9uM)sNWv!8M}<%U_I3}akwUQj!`;b*BiWvzy$=I!`2sf6nF)hYa8TF#y;
zN7QAU&Qqn$vSl(HOq3G6+tHQX@4gI+irjDgc)(|gaEA4ly9$p!KAzR}V4K5tjPH7>
z6)R&{jKvTCyzK9!x9e~J@L_}+818&Gq4frLJ=^aI2A;R*ly>WiRWa;r-ogDbC7rZ0
zilrZ3b)4X97nw-!bH26Bjk5gP;hmqunC6~xUlKM$c11WjLblK&OR2}frTVK`nI<al
zyi$+fcw^(xO)D~v(#~rwNU>~LsNV;jcPGN!dR*<JwR>o`+cvdW$9?~NKlZLT@X6q%
z-@BbBVd*j%p7e5wnYsff>+4UWZ8!y@Q1l|}=f1FXeR1AYDaZP$BnCZ4_@ppdI|tJ#
zodymMHy$7JT0S>I`kXEWUe4h$6cywBM;#8RZ8pTrT4%2@opSWm$lE~GSos|FTd8XH
zerlU9X8ZdcWou53>1!mbxoq0Wq2XSoM;9yP2JK#;_Vr$H6s4Wqq&XN?II3{k0bOa9
ze)pBL-oADjX5r8^dp&KmMVwk|H3!psqh~51`*2frRJ`RLe$!&B$MTSlhDZ0RE7KJ$
zBWz8St{j=&0-4weiLzr65gmtjSRMPs%W}Eytydj}1}INGb9v0&jG5ioHl}dwb66Y3
zO6wN1*R<3nSJM{eFEwm==fALRXU`1BFnIjhw=`j7Onsc<l1I6%Hl_6Sx*jqf4xyT-
zy7)M5*?Br+Xz(kFie_@^Edztd!m#i0<4<^QbV0H*QF^v(suYzx<Fe9IN!mKoDdsP_
zIhV=IPtjL-^8SBva~R_WYbcU1i~Bd`Ykk%!*-Nwi>|K~sqL#mCX8ve<*ZwVa*Xb-;
zDuG$_YH6kL^Nxo*#dJ#0E6F`e3nujl*U<HDy*lSh+5}UjXFH}!WAusI!)yaxC7E*=
zA-OZ-&*eSs>AU^zrcU#R=;-ag*!pmsG-kB??guvoH<{2EltH&G3c9TPw|Iz)`Kyr^
z-*zcB24Tih+66wg#;{#d83w^Y(tS)BiF3NFV!g2KuPQy3ev7tq*@UIY3i>!m1WCAk
z2s^y$ihk0NaN~u^t`}9LP2S05l%jjiu`Ol7B&SwyK7}3L^JMg~JU#P~hojXc3SP;d
zIDMdq-9H!{ppD)eN;|8V^WI1QW2(c3)nCR>{B(Ge_BHRIPd(XkkL}|tsSiZ#kw205
z(xHFX-mU>d+q)-H+W9@4hGGA1ve#gCwFt^uxbV;eJ@ea^1!vw#UF<wG>DaY@k{HWA
zenUe%yIx)`XT5NxkT(QHEj^dgA^2kFL9Q^Uj*GY5AI_%3mfq!zo$VTfVXIj$G_Jh<
z*w2}oM>F?a^>7I?LPuTZgEKBS7e?snp1*Z2cIEqE|86htKRX{6Ysa?HR_R)kY_<G+
zl;gg=-<SIJ!}9Ms_uc4uVGdJhY$+)0PrP>hhferj4ZXEGPEHfntk>~7uO8B)fc?n*
zocQXW6g?eHui#tHKKXf=_uI2|NVwUjRb97XSij@BJG)U~s860S?<Zx#n>*MM(o>yb
zKd-f(iXG8iWqreJs9fQ;tcBU%jy?VMK3cwX_-3aNwapG;W~r;X9f2>zVK-v#zl`V@
z`fNeFHJ5@`#GWyj`fr#@T)0V)jh6gukl&E!U+y0rB6-3gr(^}|g{y0__thwc6+R<k
zT>4AG(-qS?#Pj}6W0}Y_Mqh&qph2?lRG&2UMdbX|ra_iL@?a<(7^`<vVLZqP`lNi}
zm22^3uhZ0PCC?tc+4HJ}9;on)bCxYt->KAO!(_Wir;8JG`?{tmM4J>GSN@OP3FuE6
zv;RbH_N3<@0}7V@m%sl|DSa4iUI3$o0n)!q=WGqCjPn(jaE*|_%RkPBpQgsb)A%}X
zK;BUa|0sn%?kf)Lr{ADy4s}*sWIb1D$Q4zIw69LC#iK~}+bq|fdJsURnJzsLbumyU
z_S^YIL3z?{ZNII%ZBXiuIkq=!X-i)%G0RUgR(0aI_dB8%hwI3O4x%Z%O?R48JdUKj
z_r8?E`J@c_JP?h$%5en?58YU+w<<@-zG)}r;Poa)S4;dTeSX7<&zX<<U)}e4&v<Oe
z;DwJ{%S+RH!YEjtX>&bn$?|S}ODDd4C3)TXQl3HZr*PVxw;ix4P}_?BdeO#Rb9}YV
zuXH|5-C1h!qX#3Tz*oY*6}<DLO_HDc*-(<>L-aHi$}ZYO6ok`WOG_Ia1m-(CexF$|
z%QvV)^4qo830<Ax<bAteb;JhsJG?^)V+_o7)=%}eO<K|_9}C>fWbAm*sq7Wy39TQt
z(Bf&?jhMJHbBnb1_l9SCw<kY2?qn+S(&wh#8q+JfP7iK8R4a8`X~{ZIpXOEe=G*^#
zg9cxbIofr*>qFyn2fNLerRsGU@^UFTf>hYv|CQ^^3){8Rq@`$C>!*<t`nV4sLCv7h
z-S6o?|ENJZtV-JTkEXQRGFfVy!qXWY4pUT)yY?9we6MBt^sF@@SzVKiND2MNr2DnK
ztHapxaIs}4->&)DiN)HbiVyNVB>W}+7xH6r`pteu8TUGGHJ#VX>#EEr6(84^3Zwg~
zoJ^WXN;p^gVwM**_IP2`40S14n#RGtBl7gix+g=ItTC+vX1C*tyYz^HV6`@$1%tO3
zElfUtT#iXHJW{ehD=cv=DPijcr!Qps{USG;!yXQ!FVE9!-R7;7V~4oVtOJSTS0~*_
zo<{$lT<ObQREJH{D$4ecRU=zze~}5Hg*e5^NgM5iFD2{rz$vNm9R{W4$db-4^$G7|
z5v?)*)4}L-`z8FP^AFxpupc&URi^KOm_?_jNctU(lE@mbc})3;o_XL5?7Bs<mqV#4
z(-8E(U~$f#IW0pi)mi=Fh4VRV&-Izu;Qn2Mc45A+H(nkV{Vs5B%Ur*xwf3J?+jveT
zB@B#RKzFw-$XI$PMt^dT1mmSXrOQ4)PDwY*dMzbwqzIHr9kpw9qvg8mF_&ky%-!-p
z^;+Wkk|DAB(njkvTRcvkzwc&><=g>MPEQ8jR63;T=lGnWviv+Ye>C_ZT9o{6i1+8f
zD@U%5_P5zuIBD_jTW=^`7WiZH?|r-SsY|-7ll|bg`cEw<%X*k;s~?;5X7I_PBfhBE
zesSS6`cCJo_L6Bioo21SeYnVSYthW2FWY@h8T&iRQl;Ueu8X6w@rirA7_E=AW7zsC
zZVk)%>O+ft*j}0*t%*&~F1qHpyY2jMPLy>PUDO7eE(lKo)Tgi`6J`gFP#hY*+Iapl
zlTjD8_WY{B40Sl;>Yb%?bv#M?&J!bdnUCvQkK1Yz<fP}5xna!b11ZxP6zkm*>61Vh
z3~G|!h@#*y*^njMUdugrWozoaf1Fc*isg!=luhK1y7aC#<2uk;b~-Uf_O#c0Ld_}i
zO#GN)Z0dbrTvw8EbZ3?ly+19>Vwhv!g{73E<T#th^NioT3)^)$ana=-m*&nT&0$dD
z$m%QlUG243((Kk=ecN>tNle{t9#$qwYx=!k6!E@;gdF*9zU$f8zTeiEPB`2jqq5yc
z3|iKaz5N3M5+Y<rd{BAyUNNKvRib;2+f0`ZW~N(?KOT7VQ<3-c{982jEa(Y=lOfc3
z;WVrMA6xEp*fkoX_E<H@?@MZW*sc+s{|k)$ykd#Zme(FO;k2_0^4E-su%ec)Y+?I2
zKPEF^#oINelU3z&ThgQ7?mMYqcp;$eU6-k9W#76aW83a)*iz{fm9L$XX`@x0r#(9U
z9U6oJx=tJAjIdoBHa=)$Hm}FExX5sqabMdpC?6gfwJ?HDT+DH2*6`t$T}`)?kXm_2
zIJ`ccy~IyzVw->LNfvL*+mF!+H_m6c(gG4DmW`qBO1?HPqVI_Gussov%Dnu?CCy5*
z!L%r*6Bv$<D3Z5U_0x&-j%7SwwbpdJYU|n9)V)E2B)mgur?W;dr|%-i!pK^3Ygqpj
z3K&a(hb(6MWEefkl<`b)OE0NJX9FwexZvC8N}^I!XjxF+3dCD9EPVunk~=#sOm<_o
z|4O|uP4)N|eK2Z)L}XS^r&Xck_76t|C|%oi<wvHXz6oQ$jbu9vIvfqU8elb#yE^{h
zvw`Ilxi{q8UBz<%YxuxB<Bqo9ZTMDwSoV+^eG`1!F{eMY*YarR{PE$IgIBV2erOhu
zs4B&Z>04;A_E8;lQ|2r?;yc%5*3TVTIxR-gBrU?6zD!Q<$)JQ<Pu@)%y<qXsW#fm&
zQo4BdWRNVboTjg#W!Vp!V!9<x+xu|P(HUNE4IbHHV_!Vh!jAT(MP0t`7%)p!LRxik
zN2PF0t9>8zFzOVK5y!hR^sYUAr{b5^Ry%g+os!7yw`p0Od)<;p1}4pXP0O07zV6=`
zWuNG_o!{x7eLt_v52%^;GG9S!d6?7VeKEdL$Fsr?58kP!o1EIeh}BIy(sfeN(Ud^i
zlrDpBbtBD>DEBldnet;#$dQhpJGVO0V^xCJ+ubJ8pnv7oyTC9tBL3+#Ypt?`>a26t
z@s!eq@|R4cvEWuiA5+@-kQp=1{HHCo^;T%EN6KBA`HoSCd@*o$9rU;vMpIumb?xKe
zE^C-?q`&3u`7o2A71cd<9F|PRG}R52qVv7IO-4NbP8+@S$h9fnQ?ngz7kds=B59jm
zDA5GZVb;Uzx3=~y9lp+TThO8M4eyd@^PCfwz%#P*rKU{Ur?5RH{c<m!+}1-+{qnlo
zVFx_1?s_()crdP2ag>f<mW<iogEq)~<dqkBmnPqr?0)IE(+K;MS;N=bEKnFjw>sbd
zK{u12Q@wOlFbk~~b3<u8y$=_h3)r{d{<$9=Gv3qY8MpUo4FVq4x=<Y+2cIq{!&{G&
zeKRcF>A%U0tlowPAHCcku4(Y9gXQ<}KT_W5kBiejl4(&uIWDpEUgXBiC5zm$o%}x7
z=nRvXueZoik=dR>k(ZtIWi(J_uqcw2KaP>r(<{~ln>vSam|74@vr0J9vD5cty)krc
ztMQjpT+Yt;C_%S)Dl>h(>4WY%6Xr))rL^?up{ZeRnv`I;MW-XOWBGJHFa+z56L$`~
zw52W6F>cXfnJ}{L(Io>g>J#eD*ts9trakL)?b0o<o6z9(8}0UH9bMw)(~A0eMdlKE
zmMNo0tJNVfmrZ&~$*$}_(mmeGlrcaqb}W{idi{n)hAe~fFav4cth<!_k<9$5tPOU>
z=NI&m@VAINA!!S>jWbnl8qGT?aiX93qMr_oyhrb5s$tI@mvo##G4&cqA3WOMF*&}c
zZhKoByB22*u;7(abHg>qbjta#wda_Kn=X_>|E#Ol%P+P;Pjc_{AZT$K^T5`g=N^`B
zQO{n=$P~qN!nSSKGwxu!75Zg<){QWRxe{#Bxaniz+j3Js_)SF@U?K(0v~d1N*q(tH
z8@LyUgpdFs0YU<V1PBQb5+Ec%NPv(4Apt@Hgail)5E39HKuCa)03iWF0)zwz2@nz>
zBtS@jkN_b8LIQ*Y2ni4pAS6IYfRI3i1hhT#WdYm(sDBh}%BPZ-<?2^3O8np{0nqy?
zfbu^H$hNuVI_9i5+ADHpcrs2Duq6O`?+U>BQ}j=^1KpdkIIx)INT|7P34rdM{sjG#
zS69(JvH^3}51pmCu-^so$4>&F`<4J{zq1XH*W^_`_xSUVQVW(pKi-Kljs!sWvwm0o
zlh^UkJ;x5pbgWshB#`*yCxJm;ObqlN`McQwnZj51oIb&V^+3;=iMA*r{`g1$bgv0e
z^1Ijo*+Br^<L?5?ToXR56GdDJfbPA22mO;BLHFj|aXzkNeyKU@gU*UvIYQC=B>=kb
z0Pw9j+W^@~NZsRhv6!`)Klel_k^ty_b+gsKGw9wzi02;HJxa}41v*PvJqRuHmjLKq
z8sKHKvjJDo{o;D+9=8Jv)@A<O6QxK3p!<o<O8;*8<vNxP)IDwkRxBez%XLct^na~c
z*nm6e-bzHeM>b%=dZx2JSF&yi{M~ne?)v}~HK`3yLHE`o)IHt@ShAM=-P#q5d(i#P
zCeyzM=zd8JpFXa?hNkAMEb?+zJHe#z_ud7%R{;1=>^6XOZ_`M+$8BdZYv13iS;096
z-CK)Q|C{p5A%3Iw`5at#qDhOPf9Wr{B>v7jwKf+>fc~F|#Rib>SBORT_}sv)zf-Hi
zaSgg32~gJ9Ho%VE5zVtLc>iIY3!AzUe|1R!bbp~S^<OP^N1Qfb!AgPH5zetGbqV1w
zE(hJK0^~J@4Up}{*yq<~Tb3-!U#wbzSqI&tSYeUIi;~xZU$-`$i1V5`D+k7$u=zCc
z$4>&FdlWPNPE<BPUf&FKkK5T|mLEUfi877^K=%top?~s*W~6(L4U|H>s4k&r{u0pI
zlt%*n-)o2suw!?GiQmAV(Z)_KSogH4a7F_0$5#TNdtHFi`q%(@BRu!bQTMoQS?4a~
z%REuYmH_D9PiXx&Bz^<ePh+R%taoI)JaoDx@yAC3pnD~N9D!}X1)lr*#_lw>&TF=B
z$@1XCI#I-x0O+0~kp5j^KBu9vJ2iFGn0a$nK70?V5sKz70nmL5fE2zqAj;UC#?*Pu
zwimN5^5>o?MG^qrPv@zBQOEAo)KMen!8bL8&@z7s%(+yKY~a=}Ho%VEX=1-_1MNfG
zBR^VeYa#JH$lnBz{s#d3tgrzTzp?c9);$`paQT^62m3@ZNC0GYfGsbW!*BH1od!PF
z0?ju-{1I3G8CstCtq3LamjKABz4oU3Z1VEo{JH1a7MhRd>K~=<{JAGewKwNW!gwiC
zpl3@Q&u;^9pmpU{^pEDfRR}HDE&;Mf0h$vy2G4)v#q2gvpTgQDT4z{A|LFI*+PVL`
zuMXS89{=ybWySXIi&<B~>Q<2ZVeDU1|0w>A*jKEExr0ooxbE>(tTCL8VQbda-u+eW
zAWmm<p+pT4{Iyxo_gY-%)l%g1YtD0gb=XXev0qjFqu-W)t-`A?4st;20(iy*H+f87
z9XjUs4nVOf)$F-?%-bg@Yg0uOf89^ue;xq;y<(6LNK|Wf8=y;mdgfK84Zcf0`bT9u
z{yL>|83x{`02J3DAGZ7i+Mh|xy5*(witDiEPypW0y4YTSn+*WZMgaK&$frVvzndQz
zy|)D9@5<k#e~^hDzz+dsQz=6f^V8g(aX$2DL!62bJdXbxYyjjj2;i#_a;YZ6CRx|T
zN5?$v5%!r7lE>#{&wQyr*#<x!y#UadS6JCp-jCt{euLOAA^QGG-aPZ|{#5;g&Q$=?
z8>D-#-SFI_w?5BlBh}FczePQGMg5}UpJoHVQzwArddQ=88KSuXQSRd-Y8$AW@2#DF
z{{7#fKS}?f^R@u-BGWzI2MDugtElx`M|*YneCo0Z6#FvhPp|=P&pbKc<-VwOkGIz>
zV?)4Ch2}1C8ta)xXzncktxW*<mH`N_C;x)U53K{J<5?7UIa-4(BA);EyBYw*I7xvF
zf<+_;zVd9cy&h__I~3>l>s&8i`uWJ{4V3+M=MKS|PPE6*89sc~S01(3L$Sfl<a<zr
z&pyuUZ*}gFwr3%V-8n2a-Q#0H{^xdx=N%!M_dc$7JVidz-{ah&a(3*_HgW5ojSqbf
zLY#%T-}P1THE_(2>$|qp|92P%fF7Fk>@W5?4z<0L#c&PnG1!Q9kJiRF>vM;IzLky0
zzreC>l6Y~5O{%A_Phh@4w)b^BbDQPbA)w6+fM@KESnUF>4Hk2(SdG|jVRS0&z0L02
zA<*qifXcO6{Qa83@>{R_e>uCc5&Qo}?)Pi*{{dv(Y|b45S|$J#0@S3lY4a#nOdR_I
zpz(g)v0b8;g=cdZ3xdu^0OU41-Q(YbjlCBfdguSTrbE=auC2WSka_o}v;n}c1Hf#q
zy2t5iwEh0!eS%^UaXd|s1~iraf!F>3Uz&ht;pL6ac58%pe?8+mgr}eXd(}wXHUK*B
z0f5FJqUNR1+7orG7<pBre&-7#hXj~g72CN(p!2Q(Xg)$18k_!J6e}j8@4-6O@iYam
zHsa_5K<DTj&*#6L?(wmpeZ$`a=$o<`@{iubZ5z`Dp#3%gvCWWo!S&I=wL@a`?+DIQ
zWk0;PvGlL)S%CKEj{2>2kM{xf*&iC_l+m0*Gv^<zo$4oQ8_@DBKzs4sXy&{Nr5mBv
z4xx2h^^4yXiY5`s_l79-uf4fI66gvL5p7K&kJ@nxxORv=#&3B1UhOng_S>Q^pDYR+
zfNu&Ezj6GJ(>?wkSji_w0OHAO*{4O+dTOlplC?MIHR#--Ayjt!#{NH5_iVmuTRQ~b
zhisqD@Au5tw57ET=>tGMoBn9s<9$GtGlGzR=r?-L*VK2-Jo3qRs*epoz4d>C?%6zU
z$}c0Y%>5zc+T5D5Zm#*G!s;JnvJ{|s#BVg-_z39>&7GlhCNuze?=#)FG&Hu|pnX)x
zg4zJwi_Tv{@nwxoS5vl+)*Yg=1v=nz(cp}A8h33<)5$c7ytx2pm1hd_m<Axw-Yall
zQ|hlixZeZKXdl5L1GnVXDg!7({lK5f|D0Nxu5uB0UkGpl06ibSd;gF6y@voE0E0C*
z=L-}o3HQ1J)W^P>dmXgSUf_ME;of!tqXAGqc^Uxb7uoO2=E^4v=tI6~wB7*qWA&N`
zLHi6t-8%rymCuII<yz%&7y2ix;X|_N4S?ip4{#751OUwiqHm3c&?abIgy#tWIxiYM
z+j9Z>0f=nw8`?s96NqGA3TQ`AzQl1~F3_VawBiM<0ByGh=mRhk0L1}Y1EBt6GXU}<
z`2w5)xC9Uca0MV3fCg|8;1s|SfL#D?0CoUqJURwo0D#!`Mdaf93aL2sB2FA<1ytu>
ze;ept4?tY~nz(ELjq8U0^~x1c03a)L7AcCW5SM<$fhU%{C7;-5T5uca1^Q?FVK%T>
zK=z5-Kmwq91%SXm$Oh1!d#wrO3N8WUHv*Y00YGc;#nDeUHjZtAb5GofO8|7Q0&w{c
zumQAI@2}fu8rNe(Q;?kjz}?^64uTshhrhZ$XWj_e0rF=wt98#p*yY&2T8AQH9^~B(
z0QtL6d_4NjZtVBBsM=2gzxN-#&$NhCEO0ZR`>p^M0LKAd0HFCOQR%BO+F2<ubHt58
zO8|7=3V;kS2Ve~VwVA;myU)1L$|5Qd5+Ec%NPv(4Apt@Hgail)5E39HKuCa)03iWF
z0)zwz2@nz>BtS@jkN_b8LIQ*Y2ni4pAS6IYfRF$o0YU<V1b$NqloNk7B#_S0q#Ayi
z$;m75$`^9VW$^Nv`4UdKBwo(Vlkj{Qr@SJMpZANG|B|P2D!Ah})XdX4<%W29Iw!Bj
zD=%sWYcf<b{|iGL`Y@cnaw_M7JAQ$iH^lRFPI*N>os(C?%WLNA$zV;5Rpe_j#3Nt9
z5Le?Bd9H<E?p%WLydgKwr5D5VTz)V$ZaJO9Z$+NU&EqD@&0^d<mplyPnkY^V#$^ac
zkLPjp7}q4z@%FfRI-ch;M6JlXvk9!oau}>Yk8v2PK+nxrpvO22RiOVh&t@pSvVAr~
z^cs0;WuDDoWtPog6>``NRw0L-uR;!n7_34Lh8Rk((jLmwtL6>MapUD&g?!awV6ZBB
z#9&qQ7-*~-deB%k^uOdKtCIr^RwD-(qH^%#dqU#msBy`{^Z0%4>Fff9iah6r3N|?m
z0o$DWDohloQ>~o)$K?YzNu1A$JXa2E4YI3n2&&A}*%vCFIWB_AJO@E#ugT>E$B$E3
znde}v%oD$m1kk3@MgUX*64o95hd(0>+cS^@>^$)wApt@Hgail)5E39HKuCax1Ym6o
z+AGWuz^Kt-Q@#<LyQ;v0lqS0je2Zm`I69vI&b0DwGDdkI2L5{hpgndQW4#)?O|(xt
z_e{SMIOA252PsW<8F)u~pEU~q<SP4?vt?k;iqvzi{*~BdjB^nK@A3d2L@fg{uk&0j
zShJd%=bHF|cN0<aPv&=akvS_(XDO>?O&Xdq54@8A9*9B)==`NR&+oHfIX5N0wc!Td
z(Oz;5S`$v*C;;!A^G#VgmaJ~I(b1IGfPepb+W<PN2hQIT`21FL*6F6?wKm+qJ6aQt
z_Nf)_ec%GT3x9rj8PpkC8y!t~4S3%u6#sDMRy}y<*oiso5uDQ~(7w;&k_qtM5+GF|
z8KARi;7oaeZN9d%jV)N_;^IwEJiz<^>g1mayu<lR4dNZi!<_XI&UtHA`<!WQ%EN&F
z+dO4}c!%@m8q7Ox4;CyhL3Jap`+)aB0Ke{+gU;q$Dni~lGAIOFQWqC*g5m-G4^^`P
zIByERV@0QTT>mJwU<C<Em$>c&-W379v1NdGU*1T(bL9Z%IvI$IH$m|L@2e31qCS`W
zm%anW4}j+h?BU+5_I(AKq``mj<rjLZ+O8;m+f<y_Y%Qp68vDLsd)Vje?PQPZMZqJV
zHmaOc{~2W7EPQ1^hYJA5kJHG{KKf?HaY4GPv2|Nl`#=Nxxv!uJjdMkGE`4p!k~WMb
zD{y({7s2m7b<x;Z<$&7);FoV<bf$W3v^V&gb;Yw^RR-4@i$8wt0^hR%YTpYCjeUgw
z&Z|>q?6WLu|K^;?k5*Ba0pAk=knL5~L$%*z3ViGG>Bs6*rtMno*{_Q4CD0-*YCdag
z5AdKfG4lBFj+cpa><?pUyj>pY>e}cP<u$;I_R!Daf&W+foJ3~>HTwNuadF0<73aW-
zl5f-&@Qlta$r6}%{Cx=Lkk-f6tJSe)kNIljx#qP-nL7fWdjez%%RBpi<ojsg`;hFw
z^SQ6dKkAP~I(G!^p}j!U*u3!R@A#FI*VNwz(6<!7wreSi)bXtSTs&c)323_m0P0(X
zrJ?%$@J(1R{}=d)Ym9fQx67NZ2G1P<&*+?hCk^Hu?+5tJ_3(I4qB)X!;z#yc@3|wW
zD+?g<{jhc5+pSu^#)EHk51JFLC+~PYCt>ZK+t0TEyrB)mjnhy)MgD(2JmY0({44_e
zXnvxrFfxGqr2rcBYz#P`nXe4UYZ|Qgs<JyJDF0fX1!!)w{_|SA`=YA!lxriOaBcHn
za7}<QPW86x#)-bo>YO{$_GJ6955m2|wqLLNe~EWMV_W!cZY2B<wKwPSojU@&TN(*>
z?L49PA(|6`Z$uRTAO_rKyq*KVy+I84Yx0;$cFH@d4d2OP!i~nR@-<}u*OmeN;=gDl
zn$Q^?R{&-KNORArZk+c_?a%R+TKG2rTATn-pZ^A+6hKruL1XbmfWrXj49Q>S?%-N?
zfbRgJ!pW~46u;K9rVOg)p&X5Sv;YvjXm4+He&uO^8vro?@c?K%oD6{Wf`1AS4S@9O
z3*Zi53ZMrdSG8?kzu`XQOZj#FtZ`%#$cv7qybk=&1t<pKr$14Zjc!U_dEo}$#{h`q
ze8OjdM`UO0^5UmH*MY7s06_qv(lxJkme+?qan%9-jR3*{8tdJJ{8;V8#ZP_l0FCIp
zMiggs2LPRU%uAp3xxT-?bTvgi;9UX$#bJ*CK=#p4&~FMp2%Llj2ni4pAS6IYfRI4b
zN}$2JB~UTW{v!0sl)ZUFI`D-W$5XVF$sO`|iuQRhggn|P15ec;kG69_yGh_F+W&#Q
zdjy_RD-p4GjiAE@2XKD{qI9?s<>5LTA)ZnpZwS{RK`Ck<_UYhkU;zjbJqR&-$rT_>
zM|nu;C<R1Rlma4@K+3KTh`9TFaH<1B?usq<boPCiA)S+|;VG4q$78loia-YHArx#*
z>0A!extu{6n?r;P7+}-DPT>Z2+JOJiJ`vgg7629dMD!x|i2!jBe}n`G3H$~UfbU=(
z0DDmZ#G0&txf!v<k|FT|-DoYDXnf!(_7tr%GG~d^zXkMf0H}`-rm_x-6RKP%^cm*H
z6vbtJK)Vb;O1*hNbGi_liqGG(Q*)MB{YyambO7P~g(z0F_BBeypo0No)B*Bu2{#{x
zXy+GGV$Qm$V=KOOgFyd405s26Y1h1d3${k63}OYQi%SOx572&~PWln;D{9y~uecU-
zRx&)-t;EFx(B2*(n;#E##h_GsjuBtxto7oepR0ovyy$1|5yDH>ysziLd!e(qcmUc_
z3{^r+9;)o|QN6F^O?Tye<}5#P(a+VvIH12`KKz%M6+vjOe$P+nPyZ1Y4{#1VdX{NO
z2R!%Ks7_y{ta)6AXZ{YfC$@EGfJ+_L5fnBwei(nA(V7HkbGF!Y0Pkdo<@<@_Z)mCw
zdnW+>X#n+(?G%)Ez=7;PAI0d@D|WZ04WU?GcyB<P2wViEqdxaR`}zPmTwLX%Sc`(z
z^WyDs+g7O$ZFSXwwo&}a*DAQ!a%<>XYVx{Y;>=EwJ@e}#N2qe3xj(?CYP93yAGGgB
zO`8xj59<d|++>Y*QGC&Gp$O!2Gqi=~R?}<XsD`t?YkSdHiATE+;d+DnQ)r_zz$+d&
zDsiK4tlDBv>(B$Y->GZ|*C{78<0IBOi-2ad#^9H+0xw=re6TQfgmlKME$(%+rxos#
zt&`rWH=ud|_qpxVg@;p)`qRqqT>iYEwcgd&d-B4uwJKeL{05p^0^AmgcCOyhdK^J?
zAjG;Iw4M$;&w~BIz36-WYJF(O>yY_<H^TE!k2rJ~Yvt9+0N_V4_GfWA>Ybvs1U%MN
z@mVLz%YM*x<U1I{j{$CsyidJpuHJ8ylkIAJLjpeyjE6@3NUgp*xQ^ocQ9LI<83<Q~
z{66?PU+|%5gHA-y{)(D9;L`2}sqp@tI`{>7e`CwMa%|R69?-r7)z)D`9{FcQNjr*{
zy#+8IpfvykprLeEtzXS|2W<}lSPgIjAQk|P&jgKEMc<H2ZoR{hBAToDHX%P8K$QDy
zBKc_4v?DwZWoS>=P5{VXH5y<h0E%0-1Xv8P0AMNr;#(C!2CvI2g?r2Z5Z<bCY{>6W
zXp8T<4PLa==Q`}Cg1(pM0HAeK4WS#ai|k#jzB|M>;Oql{o()kvZ?B*ovH9+By@Brn
z_0<Ld=sj8eTS$1_Q1Et}A_e-<I7<frJzuB~L4Bbxu(&DcCU6oGAS6IY07-xoVkCG9
z@lg=Vgkg9JKOu+;>f<Su6HJAIp4ivv+%z3UZNYCmh2SScl*iLT6tx9;NEJ{DK~Z=r
z!@bT<;eJV!hjvIPh4$Gg6@v`>ANxOc9G5$WvE#TPg=PUEhCy{egkkC2l#WvH5Ky@(
zN-%sx#7^NqSW&~o+<`M_8byq8(sXny<k?L^%0?-yJW-rhcK{=Ria4#dM4T3ggZSek
z0T^eXanufg6T$$@k8b4CtWZUO*9HI|6W5t?{d;BL+t3#Z5s#YzH~Q8|5QGNgBd_Au
zii7>v8|<4!WC3oYy71RJM`6yg<iVEEmjQnOFB<sx^Zo<>MjN4#)lva)cL&I?Nkg6c
zz?-vn)Y4qNE&*=OYWUIqR6KlWRqUV$eCECDg|J2?z%2)W{LSUar!KHB-kf!{MpO09
z0&Wwuk6MM_st(^jTMlUcWmEpxdLyk;5%BkdJ&lU1$hYb<SNm_yzJEzjSE@==LjQ#N
z-2l?qvKNGJ?mZ}81nMEM6&fkG0@UpY@RHk3xiB#(Rs85EuBE-OG(a6RPw@oD%}xcK
z3qtd@FlSMv?g3%&Lp@~k_o~#dXiJcoidy!<;p^L~N*mxr^90BjQh~GDZ}55Yor^*9
zFTc(^qPD{7+G7juL4N+gYWQlQgHPXE*M2ZOeM^87#nPRu3pZX~+g{ZI%ptsn`uHfg
zLhLX{fZlii;%y6*qW-8#KP<%FPa7%_bAJH7tpee!p$qn01nOttoghSg6l2gCrvZLD
z2vHZugZ#sEnCC-&*ZTOnD&nG`z9s<j;qC?q20*^*Gyvq2&jLX2o<x9~0DA!z0#v1c
zF64#v8zTA#<1%Py3T-U`5Y)Gh%MkT1@WmyXKWGd2>mmX0_6127hz5IQD}cW*fE|E0
zz==A*v$7`f>u;0*$FETNKNGwqh2SA61b0jcKpA*N5R|jsFR-kP3a$w%+vVa8jtN8X
zgBXGjL=Bu33h4lJ@N!T&0NxGoa7dzxs1hB3iToPX{*a#n+!AbGMTMUNMr_UX++ld0
z&|V7hzkq9gJjA@&0V{m}pdR|Zz6(&<KUA(`_yO;<E_@q+La3_?fcj9*-f-2|5%||t
zAC*JhW9&G+U(eep1se3~Y6I$bhcS6sZDVqHFUCMQ&%PDPqyet;8q0CtrwePN0qUV|
z^9ul+7`K{nF_34MdFH=|wAy}3kVmrj<(9MWV}DCl8P``CH>2`RI1St}3VKK4?N_Au
zSg4lx5A^K{UO~3J-D|7MzUGqm5Y7QWW7LW^tNgymt=|i-83Uj=ZwdhF<NpVs%q?F9
zzj?if4bVMx{Xu<X+i3pm2|!gFKT%iR#x92r2>K2TqZ<OKfu9wC3I0_kj3(0o=+N6x
SQICVH4ge+4?Xc^hdjAI~Fqqi@

diff --git a/client/ui/assets/svg/needs-login.svg b/client/ui/assets/svg/needs-login.svg
new file mode 100644
index 000000000..5c01b48d4
--- /dev/null
+++ b/client/ui/assets/svg/needs-login.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32" fill="none">
+  <g transform="translate(0.5 4.5) scale(1.0)" opacity="0.7">
+    <path d="M21.4631 0.523438C17.8173 0.857913 16.0028 2.95675 15.3171 4.01871L4.66406 22.4734H17.5163L30.1929 0.523438H21.4631Z" fill="#F68330"/>
+    <path d="M17.5265 22.4737L0 3.88525C0 3.88525 19.8177 -1.44128 21.7493 15.1738L17.5265 22.4737Z" fill="#F68330"/>
+    <path d="M14.9236 4.70563L9.54688 14.0208L17.5158 22.4747L21.7385 15.158C21.0696 9.44682 18.2851 6.32784 14.9236 4.69727" fill="#F05252"/>
+  </g>
+  <circle cx="25" cy="25" r="7" fill="white"/>
+  <path d="M 22.6 24.5 v -1.4 a 2.4 2.4 0 0 1 4.8 0 v 1.4" fill="none" stroke="#D97706" stroke-width="1.5" stroke-linecap="round"/>
+  <rect x="21.6" y="24.5" width="6.8" height="4.9" rx="0.9" fill="none" stroke="#D97706" stroke-width="1.5"/>
+</svg>
diff --git a/client/ui/assets/svg/netbird-menu.svg b/client/ui/assets/svg/netbird-menu.svg
new file mode 100644
index 000000000..bd4e9d65d
--- /dev/null
+++ b/client/ui/assets/svg/netbird-menu.svg
@@ -0,0 +1,7 @@
+<svg width="32" height="32" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <g transform="translate(0.5 4.5)">
+    <path d="M21.4631 0.523438C17.8173 0.857913 16.0028 2.95675 15.3171 4.01871L4.66406 22.4734H17.5163L30.1929 0.523438H21.4631Z" fill="#F68330"/>
+    <path d="M17.5265 22.4737L0 3.88525C0 3.88525 19.8177 -1.44128 21.7493 15.1738L17.5265 22.4737Z" fill="#F68330"/>
+    <path d="M14.9236 4.70563L9.54688 14.0208L17.5158 22.4747L21.7385 15.158C21.0696 9.44682 18.2851 6.32784 14.9236 4.69727" fill="#F05252"/>
+  </g>
+</svg>
diff --git a/client/ui/authsession/service.go b/client/ui/authsession/service.go
new file mode 100644
index 000000000..28efe7cfd
--- /dev/null
+++ b/client/ui/authsession/service.go
@@ -0,0 +1,116 @@
+//go:build !android && !ios && !freebsd && !js
+
+package authsession
+
+import (
+	"context"
+	"time"
+
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+type ExtendStartParams struct {
+	// Hint is the OIDC login_hint, typically the user's email.
+	Hint string `json:"hint"`
+}
+
+type ExtendStartResult struct {
+	VerificationURI         string `json:"verificationUri"`
+	VerificationURIComplete string `json:"verificationUriComplete"`
+	UserCode                string `json:"userCode"`
+	DeviceCode              string `json:"deviceCode"`
+	ExpiresIn               int64  `json:"expiresIn"`
+}
+
+type ExtendWaitParams struct {
+	DeviceCode string `json:"deviceCode"`
+	UserCode   string `json:"userCode"`
+}
+
+// ExtendResult: ExpiresAt is nil when the peer is ineligible for extension.
+// Preempted means a newer WaitExtend took over the IdP poll — a no-op, not a failure.
+type ExtendResult struct {
+	ExpiresAt *time.Time `json:"sessionExpiresAt,omitempty"`
+	Preempted bool       `json:"preempted,omitempty"`
+}
+
+// DaemonConn duplicates services.DaemonConn to avoid an import cycle.
+type DaemonConn interface {
+	Client() (proto.DaemonServiceClient, error)
+}
+
+// Session bundles the session-auth daemon RPCs the UI drives.
+type Session struct {
+	conn DaemonConn
+}
+
+func NewSession(conn DaemonConn) *Session {
+	return &Session{conn: conn}
+}
+
+// RequestExtend starts the SSO session-extension flow on the daemon.
+func (s *Session) RequestExtend(ctx context.Context, p ExtendStartParams) (ExtendStartResult, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return ExtendStartResult{}, err
+	}
+
+	req := &proto.RequestExtendAuthSessionRequest{}
+	if p.Hint != "" {
+		h := p.Hint
+		req.Hint = &h
+	}
+
+	resp, err := cli.RequestExtendAuthSession(ctx, req)
+	if err != nil {
+		return ExtendStartResult{}, err
+	}
+
+	return ExtendStartResult{
+		VerificationURI:         resp.GetVerificationURI(),
+		VerificationURIComplete: resp.GetVerificationURIComplete(),
+		UserCode:                resp.GetUserCode(),
+		DeviceCode:              resp.GetDeviceCode(),
+		ExpiresIn:               resp.GetExpiresIn(),
+	}, nil
+}
+
+// WaitExtend blocks until the user completes the SSO flow started by RequestExtend.
+func (s *Session) WaitExtend(ctx context.Context, p ExtendWaitParams) (ExtendResult, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return ExtendResult{}, err
+	}
+
+	resp, err := cli.WaitExtendAuthSession(ctx, &proto.WaitExtendAuthSessionRequest{
+		DeviceCode: p.DeviceCode,
+		UserCode:   p.UserCode,
+	})
+	if err != nil {
+		if st, ok := gstatus.FromError(err); ok && st.Code() == codes.Canceled {
+			return ExtendResult{Preempted: true}, nil
+		}
+		return ExtendResult{}, err
+	}
+
+	out := ExtendResult{}
+	if ts := resp.GetSessionExpiresAt(); ts.IsValid() && !ts.AsTime().IsZero() {
+		t := ts.AsTime().UTC()
+		out.ExpiresAt = &t
+	}
+	return out, nil
+}
+
+// DismissWarning suppresses the daemon's T-FinalWarningLead fallback dialog for
+// the current deadline. Best-effort: a stale call is silently swallowed daemon-side.
+func (s *Session) DismissWarning(ctx context.Context) error {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return err
+	}
+	_, err = cli.DismissSessionWarning(ctx, &proto.DismissSessionWarningRequest{})
+	return err
+}
diff --git a/client/ui/authsession/warning.go b/client/ui/authsession/warning.go
new file mode 100644
index 000000000..91ae7f101
--- /dev/null
+++ b/client/ui/authsession/warning.go
@@ -0,0 +1,64 @@
+//go:build !android && !ios && !freebsd && !js
+
+// Package authsession holds the UI-side domain logic for the SSO
+// session-extend feature. The Wails facades in client/ui/services/session*.go
+// are thin adapters over these types.
+package authsession
+
+import (
+	"time"
+
+	"github.com/netbirdio/netbird/client/internal/auth/sessionwatch"
+)
+
+// Re-exported from sessionwatch so UI-side consumers don't import the
+// daemon-internal package directly.
+const (
+	MetaWarning          = sessionwatch.MetaSessionWarning
+	MetaFinal            = sessionwatch.MetaSessionFinal
+	MetaExpiresAt        = sessionwatch.MetaSessionExpiresAt
+	MetaLeadMinutes      = sessionwatch.MetaSessionLeadMinutes
+	MetaDeadlineRejected = sessionwatch.MetaSessionDeadlineRejected
+)
+
+// Warning is the typed payload emitted on the session-warning Wails events.
+type Warning struct {
+	// Absolute UTC deadline; best-effort, stays zero when metadata is
+	// missing or malformed (e.g. an older daemon) and the UI falls back
+	// to the Status snapshot.
+	ExpiresAt time.Time `json:"sessionExpiresAt"`
+	// Configured lead time, so the UI need not hardcode the constant.
+	LeadMinutes int `json:"leadMinutes"`
+	// True on the final-warning fallback event.
+	Final bool `json:"final"`
+}
+
+// WarningFromMetadata parses SystemEvent metadata into a Warning, or returns
+// (nil, false) when the event is not a session-warning. A field that fails to
+// parse stays zero; the event is still surfaced.
+func WarningFromMetadata(meta map[string]string) (*Warning, bool) {
+	if meta == nil || meta[MetaWarning] != "true" {
+		return nil, false
+	}
+
+	out := &Warning{
+		Final: meta[MetaFinal] == "true",
+	}
+	if raw := meta[MetaExpiresAt]; raw != "" {
+		if t, err := sessionwatch.ParseExpiresAt(raw); err == nil {
+			out.ExpiresAt = t
+		}
+	}
+	if raw := meta[MetaLeadMinutes]; raw != "" {
+		if n, err := sessionwatch.ParseLeadMinutes(raw); err == nil {
+			out.LeadMinutes = n
+		}
+	}
+	return out, true
+}
+
+// ParseExpiresAt re-exports sessionwatch.ParseExpiresAt so UI-side call sites
+// don't import the daemon-internal package.
+func ParseExpiresAt(s string) (time.Time, error) {
+	return sessionwatch.ParseExpiresAt(s)
+}
diff --git a/client/ui/authsession/warning_test.go b/client/ui/authsession/warning_test.go
new file mode 100644
index 000000000..297073ded
--- /dev/null
+++ b/client/ui/authsession/warning_test.go
@@ -0,0 +1,82 @@
+//go:build !android && !ios && !freebsd && !js
+
+package authsession
+
+import (
+	"testing"
+	"time"
+)
+
+func TestWarningFromMetadata_NotASessionWarning(t *testing.T) {
+	cases := []struct {
+		name string
+		meta map[string]string
+	}{
+		{"nil metadata", nil},
+		{"empty map", map[string]string{}},
+		{"unrelated event", map[string]string{"new_version_available": "0.65.0"}},
+		{"flag not 'true'", map[string]string{"session_warning": "1"}},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if w, ok := WarningFromMetadata(tc.meta); ok {
+				t.Fatalf("expected (nil, false), got (%+v, %v)", w, ok)
+			}
+		})
+	}
+}
+
+func TestWarningFromMetadata_FullPayload(t *testing.T) {
+	ts := "2026-05-18T13:30:00Z"
+	meta := map[string]string{
+		"session_warning":    "true",
+		"session_expires_at": ts,
+		"lead_minutes":       "10",
+	}
+
+	got, ok := WarningFromMetadata(meta)
+	if !ok {
+		t.Fatalf("expected the warning to be recognised, got ok=false")
+	}
+	want, _ := time.Parse(time.RFC3339, ts)
+	if !got.ExpiresAt.Equal(want.UTC()) {
+		t.Errorf("ExpiresAt = %v, want %v", got.ExpiresAt, want.UTC())
+	}
+	if got.LeadMinutes != 10 {
+		t.Errorf("LeadMinutes = %d, want 10", got.LeadMinutes)
+	}
+}
+
+func TestWarningFromMetadata_BadFieldsStillEmits(t *testing.T) {
+	// Older or buggy daemon: the flag is set but the timestamp/lead are
+	// missing or malformed. The UI should still get a warning so it can
+	// at least surface "session expires soon"; field zero-values are fine.
+	meta := map[string]string{
+		"session_warning":    "true",
+		"session_expires_at": "not-a-timestamp",
+		"lead_minutes":       "abc",
+	}
+
+	got, ok := WarningFromMetadata(meta)
+	if !ok {
+		t.Fatalf("warning should still be recognised even with malformed fields")
+	}
+	if !got.ExpiresAt.IsZero() {
+		t.Errorf("malformed timestamp should leave field zero, got %v", got.ExpiresAt)
+	}
+	if got.LeadMinutes != 0 {
+		t.Errorf("malformed lead_minutes should leave field 0, got %d", got.LeadMinutes)
+	}
+}
+
+func TestWarningFromMetadata_MissingFieldsStillEmits(t *testing.T) {
+	// Only the flag is present (e.g. future-trimmed event). Still emit.
+	meta := map[string]string{"session_warning": "true"}
+	got, ok := WarningFromMetadata(meta)
+	if !ok {
+		t.Fatalf("warning should still be recognised when only flag is present")
+	}
+	if got.ExpiresAt.IsZero() != true || got.LeadMinutes != 0 {
+		t.Errorf("missing fields should be zero-valued, got %+v", got)
+	}
+}
diff --git a/client/ui/build/Taskfile.yml b/client/ui/build/Taskfile.yml
new file mode 100644
index 000000000..590d4791b
--- /dev/null
+++ b/client/ui/build/Taskfile.yml
@@ -0,0 +1,295 @@
+version: '3'
+
+tasks:
+  go:mod:tidy:
+    summary: Runs `go mod tidy`
+    internal: true
+    cmds:
+      - go mod tidy
+
+  install:frontend:deps:
+    summary: Install frontend dependencies
+    dir: frontend
+    sources:
+      - package.json
+      - pnpm-lock.yaml
+    generates:
+      - node_modules
+    preconditions:
+      - sh: pnpm --version
+        msg: "Looks like pnpm isn't installed. Install with: corepack enable && corepack prepare pnpm@latest --activate"
+    cmds:
+      - pnpm install
+
+  build:frontend:
+    label: build:frontend (DEV={{.DEV}})
+    summary: Build the frontend project
+    dir: frontend
+    sources:
+      - "**/*"
+      - exclude: node_modules/**/*
+    generates:
+      - dist/**/*
+    deps:
+      - task: install:frontend:deps
+      - task: generate:bindings
+        vars:
+          BUILD_FLAGS:
+            ref: .BUILD_FLAGS
+    cmds:
+      - pnpm run {{.BUILD_COMMAND}}
+    env:
+      PRODUCTION: '{{if eq .DEV "true"}}false{{else}}true{{end}}'
+    vars:
+      BUILD_COMMAND: '{{if eq .DEV "true"}}build:dev{{else}}build{{end}}'
+
+
+  frontend:vendor:puppertino:
+    summary: Fetches Puppertino CSS into frontend/public for consistent mobile styling
+    sources:
+      - frontend/public/puppertino/puppertino.css
+    generates:
+      - frontend/public/puppertino/puppertino.css
+    cmds:
+      - |
+        set -euo pipefail
+        mkdir -p frontend/public/puppertino
+        # If bundled Puppertino exists, prefer it. Otherwise, try to fetch, but don't fail build on error.
+        if [ ! -f frontend/public/puppertino/puppertino.css ]; then
+          echo "No bundled Puppertino found. Attempting to fetch from GitHub..."
+          if curl -fsSL https://raw.githubusercontent.com/codedgar/Puppertino/main/dist/css/full.css -o frontend/public/puppertino/puppertino.css; then
+            curl -fsSL https://raw.githubusercontent.com/codedgar/Puppertino/main/LICENSE -o frontend/public/puppertino/LICENSE || true
+            echo "Puppertino CSS downloaded to frontend/public/puppertino/puppertino.css"
+          else
+            echo "Warning: Could not fetch Puppertino CSS. Proceeding without download since template may bundle it."
+          fi
+        else
+          echo "Using bundled Puppertino at frontend/public/puppertino/puppertino.css"
+        fi
+        # Ensure index.html includes Puppertino CSS and button classes
+        INDEX_HTML=frontend/index.html
+        if [ -f "$INDEX_HTML" ]; then
+          if ! grep -q 'href="/puppertino/puppertino.css"' "$INDEX_HTML"; then
+            # Insert Puppertino link tag after style.css link
+            awk '
+              /href="\/style.css"\/?/ && !x { print; print "    <link rel=\"stylesheet\" href=\"/puppertino/puppertino.css\"/>"; x=1; next }1
+            ' "$INDEX_HTML" > "$INDEX_HTML.tmp" && mv "$INDEX_HTML.tmp" "$INDEX_HTML"
+          fi
+          # Replace default .btn with Puppertino primary button classes if present
+          sed -E -i'' 's/class=\"btn\"/class=\"p-btn p-prim-col\"/g' "$INDEX_HTML" || true
+        fi
+
+
+  generate:bindings:
+    label: generate:bindings (BUILD_FLAGS={{.BUILD_FLAGS}})
+    summary: Generates bindings for the frontend
+    deps:
+      - task: go:mod:tidy
+    sources:
+      - "**/*.[jt]s"
+      - exclude: frontend/**/*
+      - frontend/bindings/**/*  # Rerun when switching between dev/production mode causes changes in output
+      - "**/*.go"
+      - go.mod
+      - go.sum
+    generates:
+      - frontend/bindings/**/*
+    cmds:
+      - wails3 generate bindings -f '{{.BUILD_FLAGS}}' -clean=true -ts
+
+  generate:icons:
+    summary: Generates Windows `.ico` and Mac `.icns` from an image; on macOS, `-iconcomposerinput appicon.icon -macassetdir darwin` also produces `Assets.car` from a `.icon` file (skipped on other platforms).
+    dir: build
+    sources:
+      - "appicon.png"
+      - "appicon.icon"
+    generates:
+      - "darwin/icons.icns"
+      - "windows/icon.ico"
+    cmds:
+      - wails3 generate icons -input appicon.png -macfilename darwin/icons.icns -windowsfilename windows/icon.ico -iconcomposerinput appicon.icon -macassetdir darwin
+
+  generate:tray:icons:
+    summary: Rebuild Windows multi-res .ico files from the per-state PNGs.
+    desc: |
+      The colored tray PNGs (assets/netbird-systemtray-<state>.png) and the
+      macOS template variants are committed to the repo as the canonical
+      source. This task only regenerates the Windows multi-resolution .ico
+      files from those PNGs by downscaling each to 16/24/32/48 px and
+      packing them with icotool, so Shell_NotifyIcon picks the frame
+      matching the user's DPI instead of downscaling a single large PNG.
+
+      Run after replacing any of the colored PNGs (e.g. when copying a new
+      version of the icons from client/ui/assets). The SVG sources in
+      assets/svg/ are kept for reference but are not built by default.
+    dir: assets
+    sources:
+      - "netbird-systemtray-connected.png"
+      - "netbird-systemtray-disconnected.png"
+      - "netbird-systemtray-connecting.png"
+      - "netbird-systemtray-error.png"
+      - "netbird-systemtray-update-connected.png"
+      - "netbird-systemtray-update-disconnected.png"
+    generates:
+      - "netbird-systemtray-*.ico"
+    preconditions:
+      - sh: command -v magick >/dev/null 2>&1 || command -v convert >/dev/null 2>&1
+        msg: "ImageMagick is required to downscale PNGs (apt install imagemagick)"
+      - sh: command -v icotool >/dev/null 2>&1
+        msg: "icotool is required to pack tray .ico files (apt install icoutils)"
+    cmds:
+      - |
+        set -euo pipefail
+        tmp=$(mktemp -d)
+        trap 'rm -rf "$tmp"' EXIT
+        resize=$(command -v magick || echo convert)
+        for state in connected disconnected connecting error update-connected update-disconnected; do
+          for sz in 16 24 32 48; do
+            "$resize" "netbird-systemtray-$state.png" -resize ${sz}x${sz} "$tmp/$state-$sz.png"
+          done
+          icotool -c -o "netbird-systemtray-$state.ico" \
+            "$tmp/$state-16.png" "$tmp/$state-24.png" "$tmp/$state-32.png" "$tmp/$state-48.png"
+        done
+
+  dev:frontend:
+    summary: Runs the frontend in development mode
+    dir: frontend
+    deps:
+      - task: install:frontend:deps
+    cmds:
+      - pnpm exec vite --port {{.VITE_PORT}} --strictPort
+
+  update:build-assets:
+    summary: Updates the build assets
+    dir: build
+    cmds:
+      - wails3 update build-assets -name "{{.APP_NAME}}" -binaryname "{{.APP_NAME}}" -config config.yml -dir .
+
+  build:server:
+    summary: Builds the application in server mode (no GUI, HTTP server only)
+    desc: |
+      Builds the application with the server build tag enabled.
+      Server mode runs as a pure HTTP server without native GUI dependencies.
+      Usage: task build:server
+    deps:
+      - task: build:frontend
+        vars:
+          BUILD_FLAGS:
+            ref: .BUILD_FLAGS
+    cmds:
+      - go build -tags server {{.BUILD_FLAGS}} -o {{.BIN_DIR}}/{{.APP_NAME}}-server{{exeExt}}
+    vars:
+      BUILD_FLAGS: "{{.BUILD_FLAGS}}"
+
+  run:server:
+    summary: Builds and runs the application in server mode
+    deps:
+      - task: build:server
+    cmds:
+      - ./{{.BIN_DIR}}/{{.APP_NAME}}-server{{exeExt}}
+
+  build:docker:
+    summary: Builds a Docker image for server mode deployment
+    desc: |
+      Creates a minimal Docker image containing the server mode binary.
+      The image is based on distroless for security and small size.
+      Usage: task build:docker [TAG=myapp:latest]
+    cmds:
+      - docker build -t {{.TAG | default (printf "%s:latest" .APP_NAME)}} -f build/docker/Dockerfile.server .
+    vars:
+      TAG: "{{.TAG}}"
+    preconditions:
+      - sh: docker info > /dev/null 2>&1
+        msg: "Docker is required. Please install Docker first."
+      - sh: test -f build/docker/Dockerfile.server
+        msg: "Dockerfile.server not found. Run 'wails3 update build-assets' to generate it."
+
+  run:docker:
+    summary: Builds and runs the Docker image
+    desc: |
+      Builds the Docker image and runs it, exposing port 8080.
+      Usage: task run:docker [TAG=myapp:latest] [PORT=8080]
+      Note: The internal container port is always 8080. The PORT variable
+      only changes the host port mapping. Ensure your app uses port 8080
+      or modify the Dockerfile to match your ServerOptions.Port setting.
+    deps:
+      - task: build:docker
+        vars:
+          TAG:
+            ref: .TAG
+    cmds:
+      - docker run --rm -p {{.PORT | default "8080"}}:8080 {{.TAG | default (printf "%s:latest" .APP_NAME)}}
+    vars:
+      TAG: "{{.TAG}}"
+      PORT: "{{.PORT}}"
+
+  setup:docker:
+    summary: Builds Docker image for cross-compilation (~800MB download)
+    desc: |
+      Builds the Docker image needed for cross-compiling to any platform.
+      Run this once to enable cross-platform builds from any OS.
+    cmds:
+      - docker build -t wails-cross -f build/docker/Dockerfile.cross build/docker/
+    preconditions:
+      - sh: docker info > /dev/null 2>&1
+        msg: "Docker is required. Please install Docker first."
+
+  ios:device:list:
+    summary: Lists connected iOS devices (UDIDs)
+    cmds:
+      - xcrun xcdevice list
+
+  ios:run:device:
+    summary: Build, install, and launch on a physical iPhone using Apple tools (xcodebuild/devicectl)
+    vars:
+      PROJECT: '{{.PROJECT}}'   # e.g., build/ios/xcode/<YourProject>.xcodeproj
+      SCHEME: '{{.SCHEME}}'     # e.g., ios.dev
+      CONFIG: '{{.CONFIG | default "Debug"}}'
+      DERIVED: '{{.DERIVED | default "build/ios/DerivedData"}}'
+      UDID: '{{.UDID}}'         # from `task ios:device:list`
+      BUNDLE_ID: '{{.BUNDLE_ID}}' # e.g., com.yourco.wails.ios.dev
+      TEAM_ID: '{{.TEAM_ID}}'   # optional, if your project is not already set up for signing
+    preconditions:
+      - sh: xcrun -f xcodebuild
+        msg: "xcodebuild not found. Please install Xcode."
+      - sh: xcrun -f devicectl
+        msg: "devicectl not found. Please update to Xcode 15+ (which includes devicectl)."
+      - sh: test -n '{{.PROJECT}}'
+        msg: "Set PROJECT to your .xcodeproj path (e.g., PROJECT=build/ios/xcode/App.xcodeproj)."
+      - sh: test -n '{{.SCHEME}}'
+        msg: "Set SCHEME to your app scheme (e.g., SCHEME=ios.dev)."
+      - sh: test -n '{{.UDID}}'
+        msg: "Set UDID to your device UDID (see: task ios:device:list)."
+      - sh: test -n '{{.BUNDLE_ID}}'
+        msg: "Set BUNDLE_ID to your app's bundle identifier (e.g., com.yourco.wails.ios.dev)."
+    cmds:
+      - |
+        set -euo pipefail
+        echo "Building for device: UDID={{.UDID}} SCHEME={{.SCHEME}} PROJECT={{.PROJECT}}"
+        XCB_ARGS=(
+          -project "{{.PROJECT}}"
+          -scheme "{{.SCHEME}}"
+          -configuration "{{.CONFIG}}"
+          -destination "id={{.UDID}}"
+          -derivedDataPath "{{.DERIVED}}"
+          -allowProvisioningUpdates
+          -allowProvisioningDeviceRegistration
+        )
+        # Optionally inject signing identifiers if provided
+        if [ -n '{{.TEAM_ID}}' ]; then XCB_ARGS+=(DEVELOPMENT_TEAM={{.TEAM_ID}}); fi
+        if [ -n '{{.BUNDLE_ID}}' ]; then XCB_ARGS+=(PRODUCT_BUNDLE_IDENTIFIER={{.BUNDLE_ID}}); fi
+        xcodebuild "${XCB_ARGS[@]}" build | xcpretty || true
+        # If xcpretty isn't installed, run without it
+        if [ "${PIPESTATUS[0]}" -ne 0 ]; then
+          xcodebuild "${XCB_ARGS[@]}" build
+        fi
+        # Find built .app
+        APP_PATH=$(find "{{.DERIVED}}/Build/Products" -type d -name "*.app" -maxdepth 3 | head -n 1)
+        if [ -z "$APP_PATH" ]; then
+          echo "Could not locate built .app under {{.DERIVED}}/Build/Products" >&2
+          exit 1
+        fi
+        echo "Installing: $APP_PATH"
+        xcrun devicectl device install app --device "{{.UDID}}" "$APP_PATH"
+        echo "Launching: {{.BUNDLE_ID}}"
+        xcrun devicectl device process launch --device "{{.UDID}}" --stderr console --stdout console "{{.BUNDLE_ID}}"
diff --git a/client/ui/build/appicon.icon/Assets/wails_icon_vector.svg b/client/ui/build/appicon.icon/Assets/wails_icon_vector.svg
new file mode 100644
index 000000000..83c4c22a9
--- /dev/null
+++ b/client/ui/build/appicon.icon/Assets/wails_icon_vector.svg
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!--
+  macOS Icon Composer source. Designed on a 1024x1024 canvas with the bird
+  glyph centered and sized to ~75% of canvas width, leaving padding for
+  the system squircle treatment.
+-->
+<svg xmlns="http://www.w3.org/2000/svg" width="1024" height="1024" viewBox="0 0 1024 1024">
+  <g transform="translate(128, 227) scale(24.77)">
+    <path d="M21.4631 0.523438C17.8173 0.857913 16.0028 2.95675 15.3171 4.01871L4.66406 22.4734H17.5163L30.1929 0.523438H21.4631Z" fill="#F68330"/>
+    <path d="M17.5265 22.4737L0 3.88525C0 3.88525 19.8177 -1.44128 21.7493 15.1738L17.5265 22.4737Z" fill="#F68330"/>
+    <path d="M14.9236 4.70563L9.54688 14.0208L17.5158 22.4747L21.7385 15.158C21.0696 9.44682 18.2851 6.32784 14.9236 4.69727" fill="#F05252"/>
+  </g>
+</svg>
diff --git a/client/ui/build/appicon.icon/icon.json b/client/ui/build/appicon.icon/icon.json
new file mode 100644
index 000000000..4a0371af3
--- /dev/null
+++ b/client/ui/build/appicon.icon/icon.json
@@ -0,0 +1,26 @@
+{
+  "fill" : {
+    "solid" : "srgb:1.00000,1.00000,1.00000,1.00000"
+  },
+  "groups" : [
+    {
+      "layers" : [
+        {
+          "image-name" : "wails_icon_vector.svg",
+          "name" : "wails_icon_vector"
+        }
+      ],
+      "shadow" : {
+        "kind" : "neutral",
+        "opacity" : 0.5
+      },
+      "specular" : true
+    }
+  ],
+  "supported-platforms" : {
+    "circles" : [
+      "watchOS"
+    ],
+    "squares" : "shared"
+  }
+}
diff --git a/client/ui/build/appicon.png b/client/ui/build/appicon.png
new file mode 100644
index 0000000000000000000000000000000000000000..977d2400a04587b0ced0c7ee5218b4ee3940e021
GIT binary patch
literal 90556
zcmeFZhg(xi)HNQeND&nj0Vyg)K)Qf*Y#_ac-XkD2AiV}uM7o0XE<FK4?;!{R(iI53
zNhkDPlYGIe_kF)#`42A7bCQ#DX6DT7*?X-u<q)c&ra(o`Kn?%^s1#p3(*gj9@u$Q9
zGE)2(go)?v#V?!3s*eGHvS^BP3ljWqR?rJARRF+;0{{qo2LPPnF9ogu0PX?+0NNY?
zkVpgo=$upQHKp)3ysY#UtyNV4-1u`c05Jgr;GzTq{2@cY`0u$q!F>SH@9TsBK#1+{
zI$Wet!ygxaAMwY<?|;6DG70{q#$U@M{F|B>kV*7E=NH)sG_)G=UzeR<7`OreH`y-^
z0!1yhZTzinTOEBjeN`0+5ZIB=;w9M9iqFf@`63rU%1Z)&>S*O=!RqDc;N&XdC4KjI
z3JLuA#by4xtiO}E*-PKmSJhyB3Vv<HD#|CoCvaDWoRyVT>h()&39V=Hf3o9$N#A|t
z=H@KH&+qB!$>%A|2YzkCFDNc9&MzRuFC@f^Pr>Wz?c`?R#p~pH@1H{cmh;TY74+KH
z+07R0#ClP#g(cYCP5SQLiwFJt_fI{oylnsHNlvbRnuTv5|HU1CK|TTgf6K;amAbep
z@f7R;ey#0n0kV=2l=_|Ue_#5ar~H#z!`92nLI0Vpqm`2@zD6=4f<k{X{Xg&gf95p!
z|IPWo?)=Fq#edP<|JD3|Z2S8v-ncU4QvCmRlngl_coy$>asb6=k9E8V)~D<vm{$Fl
zkCwfm=*fnZsb1^7zE9HSFMr1K4jLMiEs}-O6s4I*k_dGz&Ak+Rv7mbMre)jv_2Xbe
zf&~*_B43MExd-OIs0bH=+oyXOQru^~D#AwM@4yw3<5U&m<>&8&JT3ROJzO+i(~(vW
zP*2<B5NEUbZV|iQU1L4!t_Dn#0A@h756&};=vxB;gk-G$ef(#G|NP*;F!&D&{zJn5
zknlew{0|BLL&E=%@INH{4+;N6!v7ly1IupxFO!tAkhH|OpaM)}5_INIlZ6?B5&PH{
zj<soPOrhQBFI~lCFWGd!It`)v)668|LB+Rq0Zm{T$2V0RQju`~{F$$9n`vD;;>1_w
z00b8wK_*;R<7JW=T&Em|#<ltO2U|uY`$iv@wQ|`Tqn{u^#@~y$Z2Sb0+^d1{7BL2;
zJVzfQp8$fUI6kt~zq~)n?<!l}?%`XA@sAa)50O0xF(Dai5T%i$Qy~5K5d_2@@MaIi
zCh?Tylza9~`K3#`7GPt?e6`%8KDX531X232o~7w41E##x8<j~%`Q$bg-{Q5CxCYBy
zghPc0Q@JEKYI``W<vaI#Mt^7-rc(w^`I47fk*)Iu-8%El4u3xfvG*OG@R6h~scER*
zZ8CaF+U#$T_~GABDrF>w&LXiy!W;(%o<EG7DQtVqp#9L<;^A~YYXtSd19t_To$61V
zzjAEZschOq*6s}X#a9^%gzi{$rLZYhM!dm%%LT3?$u}Hg3JUs2<L0knx8Aq*in5l9
z5$p8N3_W?U#4@CMY)OVa5Mp}Yy2btZX`Qb!?j9dKz;~V&#B=ShvHdwSXJteZBK<dx
zT@~wfM`INx3T>g%*hTAdiw-AfY#v8%jH#z%Q{F<gqZLKo{z2t~r6O068<>75EwUu0
z_MXxQF)e#F^1>`gNO4tC%r9Py@_v05B=mCAwd?@il=k#e;~y+ks8=Jpqs5}1WXV`d
zm5Dj@B5y4kRk3Q3X7ALsw+g&K)S*TX^kRxPX4q35NdNV=<^Vb}{>G1uulIRYLr-EU
zK*DxI1Lv>oOb}*E9kiKZI@}Pg(4ly(5gVO>86Beu@m#1q$2)_u`^s_z2=q2jyj~BB
z(JyYEOz0=Z@~aKALZ&1*^8MBvW7$`hDkb*gIjLsCa~*RyN<7Lpx0355M4-8^`^`;3
zOW5?<zhYI$R@WS7&T#7kC+8L;2SxGOq|FsE%fA0(JnqsdYuwVF!MgiQYMQRd`6nZm
z9JCjBopg0%jWb+L)Wg2Rc#ffjtm7?37g=dIbYRAfL%fi?iuXn_7g2NDb&U9p37fD{
zRA`2(-?n?)iV<)%gRK3hb)C_JnIogY8vi(j%vZA5$ndriROw05Mw?d<-iI0^<%*ur
z?lHO-8y;~KS=;XU#6NTju-NWE-!MO-PSHb7A+sFr{Ernk=`?=Ti)5Vq_$>Im*o<E-
z4m6>p?W+>HSWS2c2A=p$_-4Dj;$}i*9=UJCjqj)A#H%Xpzdha4E-2CR%eJv^^Qq3_
zuGESI=(U{!Lj#I>kW5GF=FoR16O7UemSE)Fczo0nv0sJDin!l{8h<-*A;UH7GVs$f
zGU7_LA&c=QLT#qanWW98kCYtl{jFDNIB~V|@v=?}^2>EBN!1j;f)mIpZ}==id2q?R
zJ-FPWeT?3wE52e?(EaPk?(?10xzlQf#SGn+y25AsjbF}HZXD*{=#`uY(IW<i%fgCp
zYM?N^h;)@1?yob@1{TIyp$m{wf67XV1Cr(lf~?H1eAcWpW~i7H|4g}&e<;7rlJ*_o
z#b84*b79oqh_+5c&^Advg+w9*Zw)i@EV->dnV5_K9@wX`?Q99>tshVN!^BDoq2&~P
z90t9Hz_Fvge8ro}hbVd3NXLWj*|?j)7(<GVu9G?$jkbL-%_y>W-T!W{6W+a?u6+oC
z9DKhDbmUgT)$elfldR$D_^iQ+vM1qKr?I|}u`5CVX8BO7e{qoLekn>BDITD<u@zEg
zY?`*ixmvK!42Au)7v#&(=JGRws}~yLKF@ht5syZNZK)SNGjlv@HAd;k7W`0TKNTFV
zVVL2o)5}8Y)&t8SzNZA=tP`%und?z}QvsL^Djf*E<{5Ps=IXJVdMMhn>`tH3Gl`l&
zR=K<cI4BCp{{zN&L>|5Q;VbUPdGpTB&SO}79QRMSYOs)BKH<5ocJk5cCm+X@(QG9Z
z>rml?hk_+TPs;NBfm3>ykzE~7(R1#xkqGWnh}=(1`ii){(R(^FR_BkzmJTeq)!kef
z+`7E=hOF*4NS2tsNr@OvRnPyE)NEI^WZZYaXj(^b@sq!mNKcm2moO3*Q}8)9)iPp=
zh<R#VpLg@L%B9A)i#=<jNV0eUV=MAgmZn2#qy0KIo?(^0z^LgN$|6?rGO`7N2t{mn
z(C+AV2B2(av?myw$S&GNAGGlX<7GkNlp`x`auk1Xwb{NR+}lak0BAX$#P6$Qe}`z6
z>+zn*UkTXkM00^giH8RcL&oCTe4=^Are}RV12PXE{vr~s(XL9C&E`I*l8yqane6Ab
zi^pxla%7K_V_MN^vWEk>L-z9qN8}hYo`q&DNXkdoke9s;k|EhWz2Woa=XxOR21DFJ
z?yuGokQlE5X|t0Ag9F9iSlK2fu~fv_=PjoThl>cWbBaltf!)c?#OlPYRE0KDWwQae
zk2{+Y=`|x<Z>0;laU#K|+GTdQ;k>r%{z}I+4{zNIY!09ug`UD^WtUuU=3X9gUu}qA
zSZ&uS9veCLqMvjn!V|;h$Fi^gHa7dRPV~m$y|a4z18@>W=l-K!Bxg>i1J5Y+E2&&(
zYy^6HM0hzbE>9If1yn>*nIaC2V(H|+LR8kK)20z;Q`wF*%J=XA*kEWLLv)q)WVwq_
zzmUB%yq?*#QKGhd9D9-wW`fuNm*M@bk>pCnziyAXe^sW$^bAb35xK>SE*#%KQfc^9
z^qDH<bAGC;F!_3a0Ts>xWe*`^0`AF{Kz6SAQ^g(I@9MtV5;dDjFQ=0pwZ1U1Cb8u@
zi!XLCj=umhSfYd-Azy<VrA$5&7uIHQUDedBfyJ{End>oK5heXCJMbS~QbD7>xPnc!
z8#d^)Rn0@DJGT8k^GN>DaTU9bhPZS`4n?8dvT5ikGNvy0$YA{&Tqh0JtFvXoSQf|R
zJo0S%0z=O9GfO-)7)ZUZVa?oekgS;v+-k8qWPS>Hs??O=nL-(e@Y^5t_@hN0{U9Xo
z0g<DU%}$-CK1<v97!2k-m%f}$gNA{}*_R^T;0zci_8AYRSz30Wsz~UWUdEsT$eBg&
zddL1SKQUg?;7f=Nw{us00A%7mJVzE$1}>fyp(M{?{LzOJSMa@xAuGrH=~ZV|63cDK
zJY5q~`-*6?@Y{0-=gw5+uISoXYYK3aG694~alMFp$0o~ekj3~HXd=K~z73;%O3lV5
z8HtBT2XdXSkn4<3l3uU(hS|xRs144sG-OKP;3Ga~1Ywkc7-!nCOMe@7l@K_A#mm9H
zy@N>2?|EIDeya{fRzRE2a%tLg2N9<I5^GVCAjYr9YARjOeI?v#+~@nNvRCuTB|`y(
zTN<pUobFlsrxkfT%f*u;x=)sL?Q5`Ac^jA@ya6GUV?=+S10XDO#FeI}IS2SiP`9$E
z2uZS#pWTVm>CNc^Xea`wa`U*zZ7dZb+oBM;6fB-}`R?L-Y3l{+&*wngQM>oCP1hsD
zkKNXhp6=z5^>Fz#-2dwtqZx#v=Usau+LTj_Ba+2U;~OI_+wYX}udw%}Ybs(JPYWc9
z;{n=AaePn_2viHF)Doh<1b-}of$d=TE#McLmWd|OSb84)q=aI**~k|-4@>^Il`t#2
z$wUv(3?lgJfTPa|f9>(J>0!@Nr(Ug%BguthC)F6wp$G0w`@i0z3&GGN4p;K^ih;PY
zZ)S+&kcXtFAQsr^4D+U+zc2U2g9wN>X+M00B<mUg=D(Ce3a@DM2lwEdUd1Q$vZS+2
z)~%aDRPj74`^G``FXed?ke~$@ZQ&2n>|bJ>25{}LG+j%>uL=2)6|Q~samOLvjO#A;
zj>^(!>TOEUG7|{p?tI9+m)S!NRDi&R$M?U;9I86ZE6E>;eQyTquPgC(ftVO}0=(pH
zZkmPvrPgObx6YA=j4Z|dSDZwbOA=<*@{K~Yjj+Cj6?^0>$ftJ#goUfK+hPVzeKdwL
z5(Jk<I6*_Q1|16|kl%WXSy65S15?onJ_$C3bK4x$xTPU9%=Sil)YG@r`KqHUyG#%Q
z^nixb?NXON?v5Xs3}s~qFUKvN^K5|=%Tt(rKpPq{^--?aN~J@(BE`P@iV`+Yy>+(i
z4eOz)XpD7AK(3k?2#5LJDsu<lGWF-I!|BN{^WSIY=NCXBEAPz{idEsO1c0^x3hex5
z48heKxBkVge6~{Bw~)OoHQdzmhT91&N-g`p<V$5=Qi$arWBu_R7I!u;s~4ZeOyqyC
zBs*5$prCFWe!_tFV{;t&OFK~RZPd>KO0%6i#wy0R@W^|N-Af(#7@jwcB`9Ty=01D(
z$C3?7thy6o89$MSXDNBh<y68_bM}jFtt09@d1gOc&n!D}cfhUJZYWr}%!7*HwkZ7!
zo8Mx8^l^~>sTm5O(GRVkyUBfmTmqi5`27^t<D)(TtwI*=5t(07zpESkx5F9@<hYc5
z=jo8h!H3=xk-O9lhL5y(rlJd|k#!GtW}sbosw+`PoOE1=WB{4Y3U?q8C!uFEMV-DE
zO$s4~zQJAXnmw&o;U7^wv5aA(>#a1Y$QU(a!cB3>lQyR@H2$kGJmgqOF@}*Q*t0Eg
zQ{HtP=<U~E1GIy7U6A(o`dut)Kz1xQW~A2Vof+j}jnesQFXYk{LfA#Cm{~RA&egF6
z!;lqj8V_l<rTWfu)jb>Gv(xJ;q|HQX<Qx|q^xGe{p5c{XLcnTkWRk_0#1KEWIO!Py
zk^&+k=p^I*3t^a_e7<%K(q8+8%rm#mk^?|=k*ztFu3$o+gq5=W&Uw1nuNFIg+;~-T
zgZH5;e{{xqjcfzBb}esjUGy#Z-^LtP%Tb>9f~EAtFs44oyUx>Ai=R~o2GQMHFD$x*
zxu-Hv%*?|`MG;)@6#L4|L`Pb&0w4&%t^w>H;8+_sx=(F>i@fSg%=%<|zW}){3}5oK
z2Q&NI<KxLqSms})I>}SIZ|pyRaF0dBQNJ{DCz^EaW(-@Snd7-p*fH!n&gB~P3btBC
zWgE%<_0|Qq?GggFGj!Z>-DT7x?o<KUFM7cVg$+aN8JqNb=-8PLHs@3?0aEis%_Dy-
z);xXVxLsY!44m^+Ot@l{Ik|jZ#ajueNM}Est{WV9V(#ZKZw8Y%oS0O7gGKl@j=jcf
zsxw01G5F2VbP3uAVVTyjI60IoXf`_Hh^vXZO%E`-9`WzkN#QD)vW>lW_Ccdqn;*J2
z+HfsuwEQ@r_)9EDNilg|X8~DNZCB!KM3C%P$dLI(U#B<80Z-v@U^mW7b<@WlTWD(X
z3OwmG)p)+>el~~QIKino3IR5UW<~y$O*aXDk;En%<gy?ajk{|tgd@7Nl@$5(m(?$U
zqYEk_nwPuf#T7wz@x^bjM4CnWH=TMeBxicA93^%>lfz)AUP=p&!<ctjAxuTvvL>6n
zG!r)73VtMT7Kjq|#q-o}$BM?!S41=zo_#ltIkJ|R-<5UF^C)`gvTm*O<smE`qn*pT
zCX>e>u4o|3j*SlO>%f~Ji0S%^L2gD?eu^_H>C>$PAweXa114<se8)Vb$x^-OJ!PP@
zOXBE@KP2a+OGrLfe1eaT;z9}BP%Y%)P)jOTFTH)MCJC;C_S{p4GgJ4*1IL>OG{>^A
z?6#u|ile@%5eiw2L}n=;9H?bCSvUDN*$3o63l3(fH!8$m0@f>tx;B50dhl-Ecln)}
zY(kPz9*QNHrRR-o@*~`cBUwnr5JGuItG~N^BeE*HtP3XwJKLJ9so=P%S5U`|QlkSL
zA~gEgi0jEQFA7j=UJ{|(gWHy@vt}ufGQtmMjw0sv{(|uqaZAUI<7F|Lilr;`8S0#O
z#F=!);WsgyH&*(&s~*A9)GU9ngy^qj{H8;5&&xV`)|j7FM!{H*OjBHgVrlpMM`N-4
z5sF?3jjs?X349AmTt62-#&_67ZEPNFbFzpfc~7T`T39!U_24SLjb|%fmnrH+-@i7d
zTe`J7z;is}JR1{*GTpm`&oe4aC_;CJ5zB6*gsi_ste{U4^5}d=dS-lhhsho};|1}h
z&5sqWf2zN2P0+SemifKpf%J?f2rK_-nX{-uL2FG7*1Pg$iFd{9Ui`kEAQF4^3~BJ`
z=mI%5uNCm2QA;cIyzL8jM(xo#?sbdZ=_e`h$n_bC!~_>1fJeW0SNz`|5Wb2ZX2qGw
zj;J_A<XJn;&*(kb(Kn^VebNTve6&b#2AlrU-$<(b1-ChmA*7eW;Lk4LPm9$Qh7yOp
zpH<$f$Lmt#ig`Lj1swT0ccsZ!m|u*~<p-${;L7+ln}0|Y56nia57LV1U3t<FR#y_N
zMD2wkhP=<CCGDemh|I?)erS#&({v`+7a(VQjsMU_8ewc7ZphJ|Y_0yo4EoHWZDN0T
zZ_f-xV?@0vN80>V`fy$RpFp@|$m+3Q^C@D+sw+6ya22=r;Ie{aDT~&ZGArX(Bs7z?
zAA+$y?wPrx-WLq9b$O_$+$D0A%KxOHs}Uiv7>*Q3*x)@A*Iq{;#_D)Eh|HHC7|{HQ
z<#mD}{a9Q(e`9`yl)hu%S)a>V%iN<x;o<sw!=wkB;5GDpJK+`1;~Aom&#D)usV1>J
zz#XfP_>i1h<ap|d{IctzD9!M-YDCNu_&+9XCXn7<7yVOj&DloixtSIis~~^CLLMqE
zSd9f2)Z>hMlR!%M^X3OehBSvnsn~H7w7+fQfskwTX~?O6PX}V*<Doc;EbGMf3%vwa
z_H<)RkVNVhM0l_!|L#Zfr|wclL6Ewa1F>SNukYLU7_eNa%dEzJO(pAN*5k(se?5*@
z3LVmSgDv33ocL#=E>LB=kC?-t_UoEY(-+Q~$<h-2s_LeaQ-It2T`eKN^q6;B{vX+4
z9!>U+PQ|i3`oV(2rM<6oxZv?)7CrKnZ1Qu-P-@5V)2&ZLoz@p{0KRjT2#3ztb#eEf
zx#hbzf!^3^(WyUtPaj~_%J+%j>Ir@>Bs}(m!QXK8B(XHYDI?v=U3lOq>ktfx@3MlQ
zrTWBG*jb7<J1t{wOn9svw(?-6K_QtJ&tPx)1h@_o-k@Cyal@a&PS4uo^mHg@q4a%G
zm$BfCJ1+r~)w4JLb|z;~?lM|oFPM6~TuP#+3u#*{{lx|=4Nt}%H14~z)4&G4)OO>`
zR=<?){}^BP{g1h2Be;)r!QycH(=}ciY;NZOEYHu@>#8(!Wj~&`Uc6uZTk&OLOBLK4
zMLWXz@TntcSM6GtHaERQ`Yqol?6^I<y_uhC>_*pQsh%87-m!jrfyE8PP&-_*&}v&7
zEtJsN<mio+>Pqr2XSr3JiSa{%+LX7Re~Zp130MrVmz_jNNQ<7BQQS#=n2S^Y{2&!I
zpK0?@ZKxY^T^X<Oe$O)p`Lkx;4)jvxr--$$)FM4Hf}TRYs+gFSWi-;}3r^mVqY9K1
z@cK(3zS^1S6?OJA%-7S#%blrI^Mmd6v3-g6(3Eycp{?A#G%yU!`BpEeNB4r9!8Z%W
zv3ig<dLs~jlNqsygOMUdr^EyL0|KwrUKa7~txmwB?R@-p#^2bo?ub|3M>5AhgL{sa
zHVSZNtJi*T#`O3<W0zy9I>;E9HpqTyewz%-dFA{$K5h=f<)*k`V()%EN|gN}f_=j)
z)-;(aJhH)QnzfIUxs*g1c$O(}`Ok>u@V(q|=<-@#(vV#%_DfBGpyEd1Xg87>Ae~QZ
z@iZ3){GmRJ6pP|Cx@f3WQM2v@r0V3zZYl1p44D^TQc{KPO~-u8h+_7TzT_zWe<9T<
zC!xiv!-lT)%zUHxc;(5A$1t;Mgm;F|89r!!m6&3WI{7LXe>d@ZfgPsf4TJ=j>sj-;
z)3+@jThmwuPx-VJv~Ny;XCa5y+kc33G?-9n#b9r3Ihm1>v3NMs#aQ}`MUQ*?GnV(3
z%|vpBZX0&o!{=ls_|iw!3nkzom)S+E@fJe0)<srp_0*AlXBFx_lOW3IztNnq-U|Fk
zP)beB-SCezZw|OwTkcjO?ux=qB-yf1hn~QJi;z22OZuf8+9^10$ER^Pj2~$!7+>i?
z!K8644^3wNdn_`04Hs<Pw4(}YYO<59My*jO9nr87%?5C*JjGYxg4;|uGnvnePkKV~
zNUa5!jD57yWYTozwi06kE9`JHKOE?kv6r!)Q(2(57pa+OKCt6<GD;3W7$(E{l5ul*
zavsx|dXi;F)2ob<50ruaKIUV*|5)TOR_^$mqH}!aY}`${8&`kbH(zTWH+btffujeC
z&fm**VZb|H{@cE$3ts|X$IoGYQ9!I%n$cR--g;8Iu(yj73iWSoJg38m@%Bxek>Rxw
z3oXaR;0fQ#=FO`bm!n1aZ`HW$pvL55dfwkn)wO}-7g13pixrP4KG?wnHd9A<@o#xo
zDc3_RAo>}726-Osi}*CuVuu(W7vLY*=x!a2CD;~Fdhqs-;!-!sB*&u0W@dc^jaW`u
zDuz=lLou4U=XuIolF4SklW4}9!UX?}%nsprH9n6tcP!jVHpS4m@B3sKcqH`BE~e+X
z@OXV_RVQtJ%34PD7pYBxN^@pS5hv6o4JSi3A^t)#*<QGJ*S*TRAign_Y*j~Y(d0Al
zFPxb%=+<$^9sRhIOTs!C0tlhYdMHANu}Oxg4SwxY*=s&$Nc_AO;+pbbe%Gc=B*w9%
ziFUR(a&<sDBwfpwCaJkswic|$w07a#BtBs&-}HXlO$rqBpx6h)viSTM8g|NGy|%cO
z;!)-husN_z4<1iHJxy%r`^UccdaRQNZNE|MvF}I8ccPzIgoFCp4zY*t-r(rjkH^b4
zZ6-B<XE`OyC66o}h%bocCCS`#h!&BY36{ich0j@)Cf;}6bmT!Q%PVFej^)=?4Wij=
zrTVmg;yXPRuY}={?Y9(#M-;^_Cp4x&Y{fUfjF^Dp$+LQ>Urd+p>+>S|3pJHS2)rUk
z_Iy=-yg6m~bf)sFi9>X2GA5DBb6I|Cy7(@U`4KZ?HRV4JO>_@0)?^cS)uZhXEXr0K
zynDv?bGT1ggoi!fX;3K5X?}AxSG(kKQH=s(XbevA8j=ALT(U{D7AiPm-#2;eIv5rA
z^%k>cAZ4HeG05d_cpDH@ov5qk2lyF}w|$I;2qi8&OMZ96vjASODrozWF$=NjHDJV>
zp;V6;%~y?~#yq~(G^<+sqx3{ib<-)`L?UA=&VN*OLh=8af4!u_TCgyaXfZ{(*Y@Du
z{5>1sE;y>)4o7|}ob7`n#$8&^G55R}*j&~T!HEn@XATv!dg>yuDbDWh#w<O22$gNz
zmHz8^=Du^A<!?-P&>Y7`^E5-IQ~AQyUzy&NT`ZDLH#n04Ir<wPKOn^t<DzYP@-O%a
zabJT3r$+U)D4j(6ead)9_Z<qHf<;g6Q@Yq`)5-j)@?N|Yj=%TS;~!UZ4kYg5Pb+2;
z$!^cQ9}WGCdj_2~Yd{tZnLeHWJc|RQQLc02P2kKDlz2JQ*t}|w+8#>b(S0@^X3qgz
z8cuk124R7Rq&*{TZdEF~{U<QiKgbmw$|`jUE53+|pY~S@ZJaNp*czt6qM!f5L(j9M
zxQmDT8nJ5bAUCNIn%A&NVuw!}ZW#-h$sn!Ga+Yx&;^mtzGCejIcKQu!3fBt8&sor-
zPn;Dx?uZwPrgiLZeW<A})Pg`Uvg91y7oz1%Ba{0Ce#o=HeZq2UtwdtJ#8iv}uYb>p
z)TjbG#9mVULvgIzR|(5%a8>n^i(N}Ulc{8L1Jcy>muIp|($QAGXz=9`-wnU0;F&&t
z4#3vXiXbAq%o|7#NRV&G&3GG{%Ixl*e3h9#$gj2^0(jXC`Ca>`-Iw(6=|_5>Wb4K&
zpxc?Xqx(8g)q5Yfy@qq2RN>zG+LbO}z#M|`u{18lS^Fq#ZTPH8!_{QZa-BNxmkUV&
z!FKH%Kjz;JCLo^H!k5<CPJMfewl$mYvuyEo9E~j+X~LqFf|J|E#ryPJ2-hp`1C!6y
znK5)d`ut!L#sFC5Qj5wey!U+nq$zL5Jdx?qjRJyFq7Oxce~R7Yzxoz3Xi{`0U`WY#
zTaR$Fw#-6M_iTid47=6eu7fxBtlZ_5X^rQ2hka}JzHkb;dTO5VRux{z()?x?vaEK=
z4zQleZvSVsB}kIEWm#3|_%wvB)uCy{539(y-pM9n6W3+0u?x9G%m2FvReB3;Zh_us
zm*JGiepyO(;(k<$mL#b|83FH^@a$#Yao^zQV_FUA9PZYE2aZww;HZA5DE^F;9$A^x
zh?<X1QS0`M!Ty`RI>%L7qazP7;+TfYo5GJG#l5+)B1>JTb0!&*qDc<%4Q19th__)w
z9Ic1pofC_T#q>uk{2tJ#n%=mLu~@y1;mI5*N`=96uyJ|rTpWQdul84(kTF9xa1SrG
zFJN{OIOg|KfK`1?Q3)I%$MdO-@HH!ZO!>24H5CXw$&RgZ&VjJ)*zJKQFPqRuqw$5)
z?jIuIQKFI;WYg#xlvogn`z$rIafj9?>oW{t$6(cezL1-RVOwnvvkAef6nVa~Dk2TS
z@MU%nEQsyZxfa$5Rd#Q%DW895YO4CkkRn;}N;}qDvJtNmAAzZaC6x}|!2%>iL)VVw
zEsab4^*D47l9O%cBHB&BLa<dPxRW~YnW&Iqbl!;emXh@G!+MTWF#)UOmFF=$;SbeH
zJtRN!0YP1c8Hpc92Wa_z5?Y;S@&eaHdFJ)a0@Rnea&Ic3vkKa$NgXwBwJF1^4S9Ix
zy!3tGPI@g_dA+K(t@ZqG6dhhg4YsTZPqml!sI1zzT8k^STR<Hm--GDRe`!va7a}Xs
z?M&K7AyJMCd7_KGxYOX42P>9MV@cs2&c3p99Kv{~pT2qA_y$KOv-?SWkcD|QaxX(Q
zLfSxi{gMv6qA&*X28ZzX8uP(>pSc2w1M0r?eUg;@&uD~UL|2A3df(F33Bz+p1J^i3
zW{=zX*0ipH+{vVXK^uYR&xKd}=Z^Y-^Ll7|K1BArsl*ezQ+MH__E7pd)ccy5*Y?AS
z*0%gfWhuk)6Up@qp`gK{_=>5rwdl7dk8<RU=2J3MX;Mfe#SS|K6pig)*&URFd?QhY
zy;j3T$vwBWo=C1ldUiICko()Tvf1Vtsy>zNqpg`RWT*_Vp^(+e+;Zs6RbnwRA|~19
z7&ZI?FzY4(57<53mj`B5rt*F2dZ*zA@5r*V^s5p17C~r#qoTuK;}-leV|EqW*N}3z
zt_RNJ1&?ffKZp|>8ZMqcPu)6TdQ9N2I(9u*w>VN$H!yv;I87<_z+016UfD{Go*bR(
zz8(k8j0lPs16fJEE2EFQyWi^e*}fZL!n5176ChgQ6J_5YT_WOsZD#vdNE70R*!ykA
z`Es}_S<-OAm~*j>3M_BcTHnz|gHLI4c=ZwU%4Lg+8Xdt0!%79<O@(X*Gee^*!FF6y
zN69y%L}=uNV^3;KlOsA`eTbkWle$5Gkt-JW6<zgcpy-N}%Jb_3)xY6upEYB|W0Fo3
zq1l@YnL!oQ`>sY*_c>_V?ZDC`jlgu|o+UV0c0#3pBhq9{*vKGhE2-G(>9tYX0%*Lc
z-rc<rB+`}?kpmv*e${tFbXhfpE%feMy$c^#M;_2C<0X||^iJ)Ox3K0%<Img?Vvir!
z*|%lZ?LSv$A5)CsplWOI*%C1c{-s;iu;go|+s&l}zJE2^YD=&>s%=Y<h8G((SNW)9
zdP1KPPR*UE+Y6w2tXa#kB1^J@dL8BiGJsU^Aqv`E0&W+**|{~jhC8+_pF4hHKW_Ze
zo_2YfnL~LE^HO?3*zK|Zti~eitNgiIpW-q*8lCQr+d+>ECYWv7r9RlHj)y&&5j40T
zbx;tGP76m>S0;|Uh5|B~BHS;}y*8Rpl>BvIoNz2-%^gwsB;$S~omOGol`5~o)w1~n
zA+H%d=8!9T1L2_J0y8@wX)2Q`&aR&?;@F3Bk9BxAl4iRO1ekLS`7XOJvW9#~Pi*31
z$n|boN$$G?#vXgNFAa8CjE#FZ662?#*HZ%nvWL&d6((BauusTN)VT(C+~P-BehdxQ
zl2v&Le!%@%h4?@y7;2#BlF-iB+Je*0rQokL-hnMS`?q0_l|i39OamDJlHe|et$UfK
znXv1&z2mnt+~qfBdmBWaJI*FF3<?H{hEv?5Q(ow06z1mP-e`ZNubPo;SMOvx9tA~p
z#2gzDY1;?DT8_T@+|zSEsb{P%=8DxUY&O|3(|t+hudS6_o|`GInN;SJ!UuFpe|Q7K
zZhJqDAk*%!uTp2Uc-EMn0P2}Txci>(dD(GeZtu^tQC*ROVZ@T&<0kO^W1vi+5P&1d
z&se?<ZJ6-I1T{Be*0%bXo}esen(M@f<dh@w1OU9x1Uf!8@YjHFQ~T$Q_dnt);g>HE
z^t{7YA>x3TVgReoFx!uD8^d)=rQKu31NJH<tvd{W+CdF@s&^M^1ye!~?7&sP6na1k
zOK5l-ZjM>K$pi+awX_cMXpIu#Tq0h9+p&IQHSOlO^9>%cHb5}qutsX=SqRFa1TYF;
zt}na(#98eI@sm%6Gun9{pe%_^vm#-Gjs~u|KA}~MwUlqQPKcqYKehQDuTDDO6H)xx
zugYJ+7z|ORCtQpym%%vR+oQfdgRxD!26dUW_pVwC(C2T}Fv7nwM~o7<<!OZ4Z|n1+
zKa=uWWNcqRZ_WBI_v;PX);o7}wkYFQ_w)y<)^)+U2SHcXLj1LmYoPkX!i5>`<7k}V
zKl)GL+6UVo$LdF<>@zJdR=>i0AP2)fkVi+Z5czG~JGIZR`U0D2XbK1+?h!Sw51(%2
zOsm^XjYT;oR#MhT3_n^tLP>IOs{)IgiglL^>{>s!v^czKEh-^RLjUxnm4J2?qz&JA
zQt?z|IM`AtDEl-{>oP*AA1H3@{taZlX<z^OzDH%1B4u$hKq+V##L5g8<Q~XK-M71G
z#;cF0INgN)kd`mJ_H>Vf{sy{=TWyfr(t!zNpc?Jch*f!C>~g>-k3fYN7ouLD>QvPZ
zJNu3rKGB}*ezbL{0OM~!I2_p7huZOa`kktVOOG2BuWy1OgB>D!hey)^?j2gFC6#Gq
zTl>|{@XinsZF&NuZs2_9(%K^1Jgd{&*B;y;Rp^x#Yx%cAx92P+z8FTD0$HN9p(n3*
zU6f39+;6_y`V7nIBYUDDs@bz62(`#Or7klfv7#(6ea}Gu?uh}7{i*S~i;L=DhlH!{
zfs7tw#Er$ng;w)n9UhDIHIJub)Xx#OitS0-bX<K*il4UY>7F7$t_n(Lp)*+~;|sHU
zbObc<eZ%`iDHXOGNEFFIrQzOrh-DIkZ`}FX-CJ<`i;ZY_w0#zoc+(9iXb247hfX*B
z>R8H;n?&k}ZG?L$Vx9|1T_dmqNL?GoRA}Xn%xw)O(uopTR;@*_AHjR+M1j!<2T4iK
z((00e!_kv!?1yWEAe)d}_o;`G><4dk9GCj@6pL4?fF&u(OXf;03FL0ETyZqHdH3@w
zmvnfiCr;y4zGf^jqHa}Hgf)T`yvl5wrg`qk@wQco50cZOzBfd4JI1fWW~Jko+h-^1
zz0^9)P1$!{CgQGTUgoZjT-=hUCrR<8ZB-3^<6=G8`KaW5F`dg}Dj!BYS4sRXG>Fhy
zI<iKuQksVpC&--slF&gtU@&}QZR&if*5HT|IK-Gg4PKH~mYsZ83q9TdS9NtZ7CTNd
z=&j8J2pcE>gL(QARc6wSc+c`=jf6Sp?If!?90M9p1M`4b7gH&7qwW==9miBXCga}W
ziCZhMxj^j_7l-Dn`?bVYHw&geEVU<-lywJrJvGo)`=L)S%jl9WM6UZ%a+qEs*L|@o
z%W$y1qi_lK^!cJvLsi~1oLW?LK=W2VO47cyD#hw}y$06)rkuRK3j*zsVz09N;D4j1
z(5NFwZE&?}pvUgq3KOobGFtT5+^jKwAXqe%APB*uVRblcCv5O*IW8qX2Iu?)S?6T}
zUrRWSA4xzoj5z$BJa3*S`^J{GNrzVNYJZa$Cm&yQzYuA?3n@!m@J~J18#|+T=1EGt
zdF_K>9LM-bz<hSqQe<2X%~GDuaQf+*m<@&d+Yu*`adL}t7r}IG=k(PON%$*Rdai{o
zK@wWK!Mj*4cRN6Bty4!}T2n6X`O_jxcpw6LouQ#zJCNB}wRa0-<<+bCHQ;=cJ4TlW
zTonngW{dyUVgKw#4UCPeIw=|qt7Fj1%6#+nSR9d3^wd6-zcTe^MC;4Vg#&+_6QAdd
zx4QG3@aec`qr%QdskmPoO|K|Q4EdOkIxp?d5>7qZ_o-M4GPP9<-jTQ?qUcZit*)$B
zK5nh3Z3t*!Y_26=NHT;A)D`1XcGt@+xgEh&K=QP(or;Jz-|B7p+AH8zb4M~U+V8G`
zZopGNuNL>Tu<V|bHJ8)co?+D9T<xMf&trcMkBJJ{0bBP3Y{po)V@Y|uS~{-c1HX3*
zA?o0e#qUT3JawLMx{+35vk6`qaeE=|(Az0ecS<1htJwVDci{OxXU!X)L$b-7cfB*3
zZ^80&7uN}FP92|b1?<h8cHF=3{Us!Z0igcb^Qfp1{gB_O&-yYp*OSVmyyTLwSUxo7
ztg0K$sE(L}jrrNRg3lb?8Q@+vhXeAh>{K_t!}}85<H|>3o^spuhxy%x&Dj{tU9l~;
zn=pW;_#0_|0h{8`Vf(NM0Hzj1Dks%15ms*bd{h4}oOvC^mC+vd%`y(7Na5A1VehOu
zd{sfPb^=;zhN!!D&0vw*fiGM0yxF=ymL6PUErc-4Jk>_gAu;iK_?<M&$@xN33v{Yi
zYMk!+2#ULNILd5Jw{y1^bg_*}6+iUdBXaqQe!J7ZwALA(NK|~wRF#aw|7O8Aq+L{I
z3Fnh68gG-Wy;0A1eX=Cjyj)j9CYt*A*Co5N-R>x-pRF|OpUYWxm%RM#Qai@UD8zbi
zn7JkNEjglC_4Rs#MvvsiZhdabc-N}n`@BeeJIwBijz4wc9#G^_gN}bqQw%}S)E)fv
zMuxYkNIhvqUp0PeMGeg<RNSb4&>?gpExpk1<+*;<==Zw!_A?SuZ9^rv9+xL-veLip
zTDQ_Ze?M)=ZZyKnWngB2W-9D0Vz(INTzcbhXSzc)$=Z=uutS|E=w^B2M4Gmqr_Yk1
z|FCb|Xvl8qm%P)__;7MwG@lE1r(TG+Ob-vMRuNcd(e#><01$lav+t`MTBq|o2Tj>u
zYnT_~d(vh#_oBP-wwYBfv<bfW&;Wiw;$v1-I1(+b7XDcOJn{W;z~17^mMI8}@ZxbI
z3)0uft7eU4dQQb>%@MM9sYWf;&c{!9wbfiJfzA5iHyN`1#Am46Kkm8&CA#M_kQk{;
ze~3$u3(o6MxUVn)V}87zlKI14<dZ1$8O`uPRvFf0aQyxB8BbUFt^2TFN=1qq<0>Mg
z4yN{$B`}3lKf5ZI)}f7K;U(oMb|Hf4Q+=VMLh=>nK?C(QS*Vg&KI-cFyhQ&p1&hwS
z@`zX3>`uqm3#P%3<KhE1X*i0RUo*Wn8;7sT?9{7vtE23Sd8{$fx?Jm{F+Q(Bc)Agv
zNHcXkM-;^7DuQ>cH&56O(;?6MYdojQ$d?)l9ow&;S2J_NMUU?QbCU<Co)%j#-_#Z}
z%m6xnQ5%RI(<jfUwNzuuL!nN_EZX?o<6iP{KZEmVMYEr{2QQY9LmXUXb05j$1INvb
z067igs%(;1x75D+kV`9a;zo^=WNy9~5anB3mz?E2@$~$|a3(Ug4K_7i@&$>w#edc7
z65&MtY<9pQ0ZVFX8fu2SgIoSM))oc6lin(r4TBbF72m~%QaGd^mF*E&#kVmK*I9d4
zfkOSSeoNg*zp1SX$exMq!loI1)rTqEX=f0$&PlB-Y>D^Q;!wpDDZma)wdvN*2bYLo
z8QAsOb&rrP^B0&Q71LX&+X92FE~t@aS+K7#tcxte*H#NO8)cR|+#T2)b$P|FdPyuD
z2K%YZ*@?M~aud&D`BwD0J&&VXVZ#6K{{qnSQfp#rwSIol7frMpuF5n{D>LpHsNr5;
z>VuwWhxeDxUPC<l)g1GzJo`z@*pKMQkh^|U1$3CNap08h@WyF7O6wbshIVIZzo!@`
z7tZHu^%opjXrfY3q%*gHyG12(mTDw|Nnc1vc6W9>vWnjst-HaqUQKhQu*T2A3d(&d
zP1awV<er`8Br9}io!)Br=9V6i%CNRI5jWWZSh@CI!T9{zaL*U~IHdWh+5Ihjfu<oa
z7dBFa6q*qGseHO6ho7)2jBEZOW;X12Z-5fxhGLAOE~^fNQWFEiwIc~YBL_r19qsTH
z&PP3szE6?8K@tyZb37grvBdD4Zd|cX!VmD$ezxyyR{a_>cG(3%a+=61O-YG8^jRNB
zkBmCIvZ$CmN=n?8Mc+2nxiXTfw*OK~_B{<aq|<;2@4}_aB-KiqLN=h@?`y4h&rNc*
z_$o!u>3VSIC>h)MeAf?!1lw+@TPHVjzk~eDdpi1amxg~dc~mc3!cQZM((2=twpBaE
z>c8xM0*d&>EgY4<H(7g`SM5=2s%-z<l&>HW8DF>XF}<uL##b1Q{_ZY4vz{36!aeR0
zv!=PG-c=X<%jKi6rZ5tquiS<ZXcnGhpc?cpnXhBk^lhF)@a3Hj?}mkd@}yXmK*hQ~
zw&X;W4B|&FB$Q<9W<j0exT|NL9dC9P7xc6+?NHzJyXTz<{w0EMexi)~AG&)Np)=;^
zk*i1fkg}yfpUxr)rlG+rHv8I4`Cr{1s$;Gl>)11_Jjog+w$6-bN)|eLk5<r&X1GPo
zC^lZTZk>K4d$xfoG2AXN)o_wmto?cWb1v+xZEr0%DNLQii+%WsfKE*~IVCmERha-j
zBgUm(!$B5Qr_U1`yqvX?AjP>b?VRJM%PuAwXVrqZRdZyOZWPWqOa4H7fqm<FZ5y*@
zUCF@G>!-kt?o;3O$tQt=$_9C?{K34L6%(eos_5zpKM_Zd*b|qzH9K>-=#iqo&P|H2
zrnRt9x&z5qw7JarFIBaFHfv(^(LVCteh*Bc07UleolYpU6-WT;=?S$86|9YR+^HF#
zg#~ITPiwwmp{}<KM|0lF{?riQ=!x*&4v<=~q&6jRz4}Ow5bT?U00kYtjw$nKSPHZ|
z&=HIi+J!Ra1VGCA3AV0lzcK*Qk%2HdD3sia-Snupk#w4z-n+%o%I1WnFT+1Q6>AIP
zsJrmETEs#+QE!}6b^c?VZn%^9ksRj&XdRlIm22NwCtP248=kuu!yTUX!+*g<>8DlG
z4|=-(nGStfmWvhCtN8t*g8tgt6OhO=ABO>!`*gFG-H|v>Z8vyI?ucb1z==hD^@lc*
zc}Ny$?z{2u{9cr7!nf;~->=@pdtmt2Z2Kdp%IXXUSZowQR#r+>TNRTbB#ZA*2xaPy
zGV}_60p)YxQSX-kQYs)ywvbr&0YWzKS-j5=&sgsBb{=ik>Na?~Cp<&t+`#rjHroAx
zna;aX5tA+Gbp=e?c|AurPj(=FlTCVQ^8~hMQ=hdd^;}{etefQP1D|n1jpa>qx&#2D
z<%H+vDd(>$oLa4kr<A~Y5L#4T)(<5|V$emxlx|F+2mYrnMG<d;cC30O#7bKupQ%sZ
zN?N+4`{wj!?ZYecQFFCVt&3!c8Kx(Vd3qbUZ*0@P={m{8{lusubeQ2x+#M7Wu{x(2
ze9*qG#`09{DNjpzS1B9%e>OJMDzoNU%^?$C|MY)SMeVqLfJ4i}SJW{kZ*XBtT-ZB!
z<CVfhPqQQ41bq5aeMf2oDtn^iT}uRS({&7W<tFuoXoolyi|e>|vT0JEib@w9BB~x<
zW@6tImUi+}VhV%l`O{^5D10OvztFL~R2a6+W)Y{-E)&1KhJ@yrb?ztbkEq-2!on)1
zUymjuL;|{llkiK}{m;zTj_AX+VIyUUW=7@oTWhGL>nXCBUIwBrp8fjtm3XM=v-+?V
zt4AfzpV)02eWT`*)$pe*00-SIuzjrI?N|;C@rxo2_I{d>jQ#Yji6M21s%!s^E0oK*
zF+fB$_G^LXCVDi-o6KxHu}IGz^hkqHqN51E?kmyJbNpR^3Sx9rIGD6&<EADOepl4?
z&atcpC$Z$k7F($txf@@;Sx1p$!?j3mv>W%v%!#3*f3ERnIDB*KdRh|J=J5i*R#p>q
zeohf98p(g#Uq*xx>VIb89%Dv1g%&Fx5>=8MEJbrcDk1~Eh@J*uKAiT#cmidiU#j!2
z&voqIaPd=GbvZcRP`l5Ba@LI=)8;?(nHmU%=QU*&-<9Ci!l-Z%V3zvt#KVsDf7LKp
zLQNInz29{GOsLM?IPhBw%vmlsZuA>ce6!-v3-SVvmI!8EH?Sg}Y?6A&9pAea&H?iX
zMAI8s(Y_PdZMX87Qjdr>2=lL6)vaM|+6vEMel4b<YyBnak^&|}vZi`xuW4nWrrmnB
zCAUqAe|T_vlFpPz$CGQ64#s(VJ^NmBi35dSJ6r3+44{Hgh`V|iy>ht3#GEz{)R1dO
z>g69u3m^=0et5s_*F5NBtDQhqih-_?U^f3W-$d=qrKH1W#G<hw>My5!19HpivkNf|
z6&wpyO^o+5JtGDBqVFe7ITuP6mNw?HZE>;tJ=9(H_0dURV$y1n)GisWH06xc{{r_i
zL9D}612ni4<Mg!{F&b7)1v*wSoVw4kN8-1^u~46sF<<PhQX>4q>^9+1-5V7dzmW(p
zRHBLo>0>`O3kNNY1Kv!j?`2Eh*4vM7eSNKeoYfAJCVKhYfa<Aq!|WHCac$sRIE?$T
zx=6e!is6*8ur87Pz+yQX>4m48`}N58+b47}n>_HI)yoyQw7y7TXxrgPWr+5?R$3>T
z<R}Z{-Z;j1F-OlyVi}e#V|#|2=I^4rv16v;|IG{+-aS^lg_%^gyVAT}Npi)3Dv-N2
zdR#1{-?9_CJGRQUbI;T3hsrQ2WY{e)2J<n;JHWnaDW*Ps!2Jtllcst(H&JHgqN4kE
z)B|N#`NE9&>p#Nne2w(#3>0$ja?6GTPl0OJl_xFH_jOlB>`AaG9gncL=L8Bx#kmGY
z8j8nalYZ|=VK$r%N{DW-Ua`yWR&OLMB-KRK1e&Uy-qdKt9b38Vcv%g&JLcGH6&m`M
zy&upR1O-^DizLtOPv;;BCX|7f8hiGFPD-}AT09flav9OetOfi*Gyx7V)naC6*)6yA
z_?ETe%B~{cSVWWQ9Cg9yCensfqsbv!`OPkA6sl<y<XFxlxO6#>1IKT@tbOx?Z6r71
z+K_G8<$LbW-GH$rS5(2rh>R4e&=oH5b+a08l`FK*RGO3NB8;TZeijZbh)mqN?K&-@
zVo<;dBH90%IxK{)>u*x#v{Qzwlf4K+Bx$vX6~pF`rX4ZoiQZoTvNG-6P`=`f%Aa}|
z92xWk^{A=I{zt?a6?LK?@_Ewl{Ri=Kjr22~qsf{kANM({We2WiJjpabM}E7JybxzE
zpnK_^o#d>m$vSzj$>qK)D4R|ztJjCI4^EPyC+?{JPBB!OE&tJK+XH(_2C%V-sGh9G
zD4ki69rL6oV`43gxP&)t!!2gq49M|gmCXf*aB|ptuEAL;$p6Ad!TrrTl-C;c8>l_r
z%Bg6v#afa|7kzKcszpb-7@QThj7%qrK%A4F1lf3gJ~W{UOnh1VD51}KY3Vy(hEp!E
z6I+~Yd0MvSsiSI!*v_|J)L7lGMQC~$=bounwa8{Yb6PhrqX*bUZ}rm0E!7Ma4r>;d
z=jo^!@k9kd9QJCZRg#C$G@eyIqZzYo4a2Tu9Jx*L;+gN7m-!EmkqCW$E_rXk?-i)M
zDU@euN%l^C9*=RVc-?^aGL$p!TL6iWRnB3Yg20c)lJdtCsJkl?(ky%nQ`l{<j^H+U
z^hjSiY7ZhTYiC9ujcRD_oN0QPM;&DH`t@WPJ$^@0?~r`&V@=7;AxNZ<SDqVRrKMvv
z8tc(f-gvQii`PlLgo0FAI&Z@$C&QeW#D?aaQOU#g90P~Qa&J)xN5|rr-%%6<cAf3_
zg#KE#repntY+gxe3XzREjFPANC+=q4a0m0zOz!Kmyu04g9_qkb#Yvi$9KeJC-Z%#?
ze|r#6KVR!X+&V0wsJHsGs}6d-S&-{C(%Sa}cuQEyeAhqz<@F0$EJ?CiJ1~U^0w-q~
z6Ha}1|5WKzv{uZlVFyZ)0Y;F6fQ<La%}Q453$2MZ%S&3NQRI){lp_b_rDl5hucyA4
zK&n(yS`S&U;f(utoW%|*d^}CR;`Z_m8=b;9+Y3*Ml(5mOr7S1}Z)9}F0`pN(6y?kX
z6|DyZC8~VD8GrfCofy|LVFu(~qu7{6%L?}DiRql;_uB|dMfjGG29Dp$TPp7>q?S!E
z?sWBBM}d-T;|~pWht9ai)Q6qi8Tv*PWW;mRkCMaI)w#+BhHX9CjjH;Oun}r64%)%X
zmGLU@`T257cZ|=2fpMjwNoMuDHl&LoDi24`EYQS&?+Y(OLZgwdzD;0P`6A}4;O#Db
zpcIQ)QaxYx&Ktu6b`5lugfg(9fK4=CD^KqG!;1V)6O55(D7|f?#jb@#M=N%=p^0be
z5o3F>LI2xyA%Thgd&2oxZ5)axSRBUl@bY`#D{ZlfnP){to73OVd&=&~9E14ST%nzU
z+R0k<za%XGOy^3;nV<1xy&u4DVkqo2lXby{9c-fGme!9S9qnHFE{*7%=vZ0xUz9w{
z>xa?JRV?+#diwjjd=0h$IqYh4=YegiwoCNO;Q-u}l5Mrl&xambI(qL1i<-E)uhS_X
z(j1tY9JFi|D;)yaa$_*iXUP577>uI!h~y*YkGuZO3!c^5e&iRj^b(<`u{fu1_GOoG
zU7CW?5V@Ww?j`7_a`c31y(AI*2$nU&qNt#CDqhJScj+EZmlmFBTX8u=yv8M<^Gd~}
znVJg8jqX+K=JF*0)DPeNl<q5e;Qxx7S3bO|{;V=;-nJ@RGM{K%!z{XtKJ^OC@AoGF
zghzBAj&Ldn?3$AxH^p9l*r2K2R9Qx$Cxc#H^vuk<t@@O^2%x2--wHn{OJ=dl$<xTt
zf_E%yM^E)Cn}OM~RdN;V!^37$Y?*bwfXC5Ba}n3?F-cc&$FJ86HRMR_X``^29oq(|
z7gdipjt<1qBbB~7u)lzfB!59i0xjRiVDkOZJO21^FeBc)OeS(iEj(fBxPPYP&Q*AC
z87RnS(vt-1La_Cw7{)hy-vb7fA%>0<)IS8*>P%6@=Sech*BM@+v^()EdY1vb<s(F&
zRQan{*~jmyI^BoQl41{%a>NgXp*7<9MX!NpH41JTLjFN-aGjXf%S{m?zqfO(a|RWk
zHQj}Kwce*aHya7J%4jGlq$3jA@$C2+)v=m%r3`9OMUc?Xo`*=i5}j)Nprs%#4r?^T
zhK!xqm3Apo%bPAHw&D@Ac-+mi^NO15Bym`a4z^<?9jzaY9)#duv3<?`YsMH{G{QoY
zWb{-eZraAHdEx9qCmSA(06_}ZYUjzNPDYo2-aJorqi^UiKW@~Ycv8`LN~X~aKCj*1
zad{goapOZY6?&}&D<U0gUQD*A7gwu)^nZA|>aeEYuf2^Cqq~vOA&r9clm=-@rMpGC
zhYHf5NJ&a}hcqH7-6@SUNH=>2e1GqC?N9jZ*?G>n&wcK5&X#i$(N=%^eL2jLRqeZv
zQBW5NhT?*+6~j|nZIU|v{`Tf{@0GqE7+$Ljj2i1slY{H`gCWR)yYVMH^MfBEp5Byr
z#{22nBe-jlw41FYJgv+8&wLzrrz=Z=Z;vke!Y_LkU3j<Kz6Vj9orD{YYLN`{Zw0i(
z=()>4nj^hpgfqeN8Yy!9g~Iv58%G+LNEP(JLVnZ&vr<8Ni+p1)tkSBorFKBJh7>uq
z`W@Cty71IazxFAwL46@5=v$6$!zFm^qtQu%5Y7Rlu(Q1cYyvq>_iBS5Y=<aKxC9yw
z_8F0j5WJCZ`Q^w_H~eFmCRX6+6L)M~qP9C&aorU3afuGx?$|%#d=jv^rG_(lAnx<B
zlT%6SpF~}nc)N`b_#W=zn6JJk+-^jE&+)6ty$a>q>fL6RcT8|~WiaKUQBC|)J3C(P
zrIkb?a!fVRvTw#3#vni}@x6UMLz!Gt2-{WjCV99se-NY4NaDx4hTUcr)8{Q`F@(1X
zqgh0DM}tk?>irGwd>RkQHl$TdFhfvD72O3nm3qRp{Vu}wBua(2tm6mAgbT_L1L_|^
z7jB)&rlrRP1ZDHME2a6r0`}6@FQj)({NlplwPGX2n{}Ns!iXjtS0@GE4IjO@u-_hO
zku;+0pDf;``Oa3CJ!pc@NrG$l>Su1Z#s6pw`XizoXvn^Om|xHkXvMiIEDgsk=yjOe
zw=_gaS3h7s=cTD8N>uAoDewR8wR*Ozb4~R4U)TGP;(`ozhEVIz&$1Pw^9m#$)~Ozm
z{#fU07NWEG*ZCSguk4jpyCuV_45>HFGkmT|Zne48#_$wJqZ6)wHc(_%@}^hTP4%nv
z+3OfP>fdHAo9hd+w(AjxL&p*F3&1oFX%)u2nNNR?#=R2`XdExs4S9M(<!!4Mqqc6n
zM4hz)TCCB<gjq_6v)o_yq9dI%0EG^JfBYZ~E%vyOA`P!MbSzFOcfL05Mgv(@TAW>b
z)=&TxbL=>tmYlv6I+nk<VqX&~mip7sF?wk5)89qic+kv8P_GYszm0@H)dJ#O5i~%s
z_(IsEo!lc!^}ru%F7d4LqY~JdL|=(<Bx~px{telzkN*3cyE(7+PhiD`<~aN7-4oL0
zExQWw%eDPmuQMrUV)0YiEvHkXu3AkA(dw3W-Nc!hUf92)*p?-j4u$e9)pF_)dkY%j
zV)v7S9xnsf&(qAvx@514*xxmn5S=CE_ZuLN)N0QX3fEUuV2g<sfcB5^gk;jQ;h(kz
z>T+sbV^`<Y+az<<rW{si&yu9NiJn~+5#A*P6wq12Z5LQpQ%s-#q~5E@cHA9a@M+Um
z7SS1_o0FT{QM7duuGIGplVxJ0x=LcaADv3#YJQw#fy;s{{^<M_@G3;R<`VnIg7zLT
zUv{BAo-1i}F8@$<X|9oSl142}<Y?w1WIeMqQsus_Nev6|P?`9nqjGv;^NmdFcU85?
z8}Ad}^%i1VFwYKOK+l0!CzU4Ch~JV}im{yKpC7lT1*e{Rc+{6s)w-hw)uN^fJ8nd9
z%f@mav3n|Bg8yS3O-m`*JzO4@PfQ6at_jT>^Uu-)d&L>$+XQb(w0;Ux$hOO}J}iw5
zdHZ<vcC9_zR@ZlhWR%0%988_C6<R29lv26ra=GH=Gm!Z0DXm6t!=}^H_}KgKGkvEo
zl>~R9EEidDt$|o9r^DKe2lcHWa?eTi{8r){pP}IzM6BUxQEZeF@S2e~z(V|ljB1H&
z-qfqciETJDP4oJ#A`QSQZlCoh=@mvgX)7tY={+QS??ZTPG<^YogqHgmCh&t*@P>%R
zI+clvqEv!4bKo<$d0H^-$`ZC7KK-1(S{NNOtZ7@HoP@9yEd^hNr1OkAh6~!F?et;?
z{39BiMDNL4vvYeTD%+7EyVHprL0<^H6L*kA)E>Ot<o2!w$24{VS8};zt4Ca0R$t`X
zt@NY8D*>NDJ2z2_1`E}UU&xgviE+NoWcLV!j2dE-gIA(JYVK9O+3Q%=5dZ%sOFZC6
z=&3<M4{b*QMS3nKV~=WP1%|kIiB(o^@0&69Nln9p-YrWD%{nx0@0g;q2C7nOhwRLo
zW1Z*b@5a1#FTL$IRW_$FTk@!5On+Wb{0Z7TK>*iDV(xQ>16KQM+l)CE9MkbJKc&wz
zOxpEn1BBkwjn^YjuS~}27I*Rf*-T>Wgdz=1DIEA-*UMatL(H*$!a!YwFrK2eV6$M5
zq97O4J{m3x=j83YZ{|57q2^J!5S<oQ-X5LTH<(ZMOL&pj$jdVOKRTG^!rS&!L(76h
zCm#(X#}hw4p2*RQm^XTZ+r}+XYkcTsealFbI4y%*7-ADwGIGQnwUsBQ5h_9>lr0ML
z-Ajl&Z7%rb8MQD!Cs}jHG+~Pntak4LdVZ48`Xu(Urjk&%ZDxD-{;+Y$+0=ivm6z`9
zJVFlp$D=A6&YGp|5zZQ!2ODL2vDY+Aqsnzv*Tzg!Gv@M2aF+G~n+KpO^Ie(s<DIrg
zy)iu@Nv8}ipfGwNblO}B?pKvha<mB<N2E0gM%6IZZC}&VA2~SY`|cOmKw^i~UwlwT
z;R}0KY;5P#=^tMH$76@WZt#F&$+`WQJVK8%0KG)?l!BD5hj8)xV0bz2BRfp2a6BvA
za8)Y0Z*i=QdhE{yRn#?`d>8io_!+Km)|zy^^v4djni^IQBaRNu=li_*8N>-bA6!Xa
zFOz-e^MCINrb1n~;@|eHes|+sX`Q^VQJ``e(Y9wz1eOR<{@itw;fX#XNZ@iM?*2{<
zGeM3J3M7OEd?1Yet0AyrP2OMU$}w~5O!xP8603MY?4&uKH?sF&=0gQd$3CGs5TAt{
zL~_lqzhHecR-0gwZV`d27I|DlT%{^PksTdC9alt7e#Qs`AzxR_Z!JGwIrIXuF@5)e
z9rH|Lfk8Q8q_V<jk;0jzPNKVQZ<VI^lr@^F8?Jz*e>hyf1+dQ^36|83YgVaR{W_&d
zB=9HL94Qzn_DFe)X&s2%uA$6HG9jRgbF<TyO{VpshC~A(SrPCJBf=q*RvYD7o@>Ld
ztzE^L^WNfY*Yjy(jS+^ga|owL%zQy6kg~$mXWvoWXSf@3I|u>F%nOhMb9#(LQ$BW|
zkZ@rJ>ANE{M)QH(DceQRzW}Vd&?;A#K9g#IXH@q;L{?J`{iFJqj9}WWi*PeCfRD~7
z>AM+j&Gh^oKBcv1sU~W@+2~NX8Qa`HtZE7;_QiicL%~>#!OKNBed$Zj)+;0v50-<2
z<&0i|vqCtI8*gjhx9ZC_IK3|1li&<=(A9Jtb4pR_$>Upr56Wku!jj{<3Dbp}G_h)z
z>U9U7pSPvWgphjh6}(?&k|gCY=jGXxM?MV>#(lXM**+qHufgvksz{}=^M{yS{3Y;h
z$wx)bC$L%7>)a(2Yv4kP+wR-mN|6)21N&Qxan~sO(rQiBn#+|Q9W9=32D!gcN$M-D
z#0DucnWJk6g`Z}u{*gxnKn_1WT%;~Dv{<^O10Mwr@H5pOa^v_E;Z=OBZRog6ne>I2
z7;f;0Su|shZ7qM_uQy*=F-<Mt>=A|`*^=vF1HrCBt|KJ+A0v;~!?W0!-sXM}$CauH
zn8Bm#60HA#SLQdSgz+LJ(shKO%ryCmx{pq<suTf^VW?#ZD=f_mbEdiZuyPa}u48*L
zx*#^bH#TS-l9TpAl-s-07fU(bWI>p%|B+16gLT2+4Cb;)ToX3^(!fXXHHXQYXIi~=
zV#O1PSK5wk{<xBq7>qL@C>m?8+z<Dvn)hW!;YUkEupl$)iMO3Q(hQko(VbHZ#4F3G
z56^>x_nvSM11X`_AEdrd)N`P})#DF%6fhL?SiuK1!8~)Ws?v?%ukCAl!E&nG@uY7h
zGsT5HA*#N6*%RHqsG`{~Gp7@@WN7$jQeH@@q;DRh1&7qqBjXK7*!>J>y@tO?Mdp>D
zG5g!uR`vJ9_>TOs`$9O^q2VFqxPtfMfY_U`cpg<&y43s7Zc<=Sc-D*C0xXJF+P@IF
z5pNBNe*e;p_|6TWDBx3p<agBW_~~MVj@{%GynL91Xajp~jm;ryU*d=LIsH&>B`}n>
z^+;~9ZE*#1MABxdV@m;N&4Mp$BbBcK6BpidlUsih4*fyRE|`R8&u%HYDVYNvY#;~D
zYI-c~jL<Ls<JuDTbMp0oqrX{(?S$(|kWM>q)<+mS2jC+UW{UG*KI}%psj{rj_S>u%
zZYE+zyM!wRW#cpZi_nlcl&p_pneq=o_5$QhVj)EOT~2`Y{4F}ZF2+mg_2LrP#Xh+`
za=%E)w4`-K&r<_+R_~ywfU|nRLLl{N%1Z1>je3lm4v6^gZDz4MQ_))w+ymj<2sVcL
zSGT}`hqEp&ftTHI?J=~jG~R}9#~EGJjBUn!iy7xuzwm$7Cgm%6$gc@R<*oovi66C_
zW7i}<jy>VWuQh@UCH2ZF!e5!QFeu&~F_G?V?(+!T3@$)cfBySn`znngguWt}#Y5@a
z2PXKlsvFZj)7O>k*QOe*cJa+y%{gfe^E8anDv}re4PJ-Ie8pYKwmxH4HwmYGo}#}#
z;jm=<x`#yMqt96I*$~S?`dX%wUL-hOFJuGvt5L<=%{m)|Hr%#vd6#0J6Uap%0l<h@
zVx22*NMM{2%(AQC_Gt2Lx&g}y;)lVPef7MM5GR#;Tk>Fn+-FiYpcP<zZ$Oo-uuc4s
zzdnH>(1aa+^t4;US#Mh2wl5j0P05w6s9}qU)77v1d#H5b?N22N&7Uf`^I2l~CEt`P
zz2`=kdcGV)E*Z#{1#?+|7K0xQ3J0G)PhT)ezj*t4qjjG3B0J(mU6rf-5x><i`G^d(
znh@}kGD6rXTXk0aPzmnWoIYMD*M~Z&u@FAk!KIBZ_gdG?=iWm#z<ZOelnJFjor{k|
zOCf*6Vcyjr>b|<Vm>ZH=Dx|22MP<hd<P2`bk7e_7p43V}oO@;W!7z!BTH}RXRH+Du
z#4AJg1O)k@&<IZQXYo)G8q&m!fp%m9K)$fQz^lwr6R+^rB+4!gU#zr@>l<E7%KrUZ
z)1h_+P3!QE2!d^K08BWRpY>>3))$;dJ|(Gonb&ai7GmU+&E4a!s*~xO#J1Sp{)6Q{
zILVm;ysIVX<(7P^jNs>}a02n`gG9^$6EFDdK#3$a!|kr>at)ip#vB3n?Sjj1G`Y+u
zC)W{i!Z=}YUyL^%L0Ys8>UIuQELB{|znll#4%1m}*MpZ3P0Iob0zRa7M~;RaLgbQ2
zP&r(~e2Fp<ic{RxQIB>vqWaV>_J`&FAVe;{)hC=W?4-Vjx*nLQr3fE+VP6`ymi<PL
z&O1uYHT+OYYy}xY@1S{j7(K?EwMQn3T8FFIU&DV-l7Z~A)dfJDCe+ux6mMqXowsa-
z=K0wngRUP;eD%ay4$8(+-kjJt^}Z@;J4UGY<fVOaBXGuxT=bL4ftH~_38Vu)-_wG2
z!f58-T@}0-`cwriFB*8mK2KO;5!pPq_W`CNvY#5uF$9e10ou#V8QaC4PO8NlHf+^%
zuFL>^K;7)IxXO`cPJjcym&PoAJH+k}+UfzBQ)|xr(5(%Z(^>97ivwT`C@rg#Y1wm@
zW5B0xS9qF}t7<Co^Cn8vRamu8L=4rqYv#joQ80|3A2&21YHG!NO_mwMag?b@T1Q|i
zt!{u?WA7hiL{Sgv@X?Fb=acVjXlhJtziZ3}I>&zV`gYTe_dRZ-SFKh#!}P~scS!Dv
z;P^nCa&qIf#rlq^F!lo84I=q;%=AYfE%=G&9E*Zq!~^hsM51c@JC45q!cdv8p6u|l
zDjxmxKTZl-cvD=@ZqV^NwcM*Nu&=T9lCO`*;!c&Z-j1^jA2fLtERpzQ*LpRsHtb8H
zx0=o2&Tqn_Kk+>HYILhU*bJ-*(kkD4F>d&Q5>=7U-PZg2RsLv;M`mQNoq|`e`h~;^
zDS-FH-2~jO8L#=+=TB&*J&Gk9i#3_GWslfxnFt;S;N|#_0T4<Wl@c>`(YyBq^~6d~
zn^wasG?$;L>Qb9NF%*mJv~P1?QYxl=eKOg?G*xuDYr0*XBdpuDW})jDXnlQ(?dMGC
z{_ic7ob3(<87}ril0IXB?kbOA{G`SS>wLmXQ;eo$Go8?;aMP#tHt09vW+{7B;cFLL
z$aZtaH0=dz?e$@;uq`*`pjeo?&jfkkVL@Yb9N=oXoBQ*9bcV;b{=um#dIa$7BM~hH
zUKGya?qJr})#`5;LDIGC>i#(*dmC6<O{DAGR)zl5FJ?D~0?iXhq-tkpr+Mbb4mKYS
zCC><rkXCEF%@nL7nvp11{v%L)suD-l@OX>CxlC?l!=LbIS8bViZ7=g0y16huzK&9@
z>R>y_X)Tfb$$w3nc$7p3)Xk^xo!DlY{Ems;<;@<jlx~z@2uq~-2|%Z^j)6Q*2$vSP
zUY@)ty_?wkJE6;Ww)x{=d|PBg(d-_t3+c-xZ{(hB_%|_jg#3Vg=e?hFsw`4@eF?vv
z1*CNKZpayI)wBu6A`aFE(@mmv^`~w|h)}D4=v&7|`cPs1V=^7TQiTt)t|+HtwSN3(
z^4!=;wIle9?g4cK0z`1!5CEH|j=w(U-#pxEN6WXl+WP|P4~&tqZx(>{+vqas)9Kzo
z)Pa(K->(7o`Lw&wp)L!xVfHF9Ny%-Z#2$zf7P#hp@}xG3V-oSk-$zEPz_=R_(5DM%
z_ssA=_d0uA@X;J-1i=qFN_bWW23nDPQ6Wo;ebKD_DAd2}AxZ%d#?SDL-QfudxT(Yw
zrx{6>R^k%sUvChV=RWhOTTk@rRti=`b!h=9pwE&4^HDJge4QZ=7KMP@4X|zVel8Tv
zlH^u4uNTLK-d>)ZV#i-AzCgoa#Z8<HFy}NoFH45SkGoUsatRH3a})aNQ9SOYr%+Uc
z14)?XgC3&qE0TIGj>K|jOyk~WhKbAt6v8gTg+K{U(qEy9p-tJo#Ap>_ioq}#N8zHu
z{LgXgn4$Ix`GRNuwIm-~P)Ro990DaI>a=Et2K8mP+oDN8iPeB$emQMN7mG!TX>$Kz
zVLWl*4qvC_1WzTZDLwh)pJe+OY6nsOr2%NbN1_cXP-_n7qqRx2REI@&{1w3|vsKy&
zKms+~em|8I2pQCsiMl(mj3RX6(@;rp!?8dgfV3RkZ^B|%m3JK_z%6r7HMh~cXR58h
z&Z;Cp)#3g^ul~*PwLiEu7ev<PLinEW&6{`lX2jBwgLjw<BqYZGTK~*m!h8!rU1<Ab
zZ+6I?iFoJdh{fGCvc??;@C^enU}2sPHf=T7VFN?&6ZPS9sLi9syr0o~OVUrEM*=*9
zt#9l~sQnzYv@^L@eOkNa+4&uT`0JT|UOB$bx$~?EZ7+r&_XQ1<m^k#JVKbrRA*#T^
z&;KJ8(Oe+<iXMy>*4y$!ZZ>>r0|6njsLTCoa4;vz^1_nsf7ZTWfNn|n{C*)e@_J$`
zq7_S^;SqD(iC*+Iu*W0R+|9_LO*U--vtI<WFha(1_*)yA!X<W`tXHL4&SJX;UlH??
zP~!hs#>jI(Xwz)K#zdQemL;jVIA!-V(M_t^qzJeD8#0zMo)X*B8mkx71ID1|rN3Z|
z9~$<{*WE-JADA>+zz<Iza)OQn+^-13Y6XP6;M8SI=2C=x_^o1LTQo1It{f2UBl**<
z-m9{D+-5xa;ICxi`rCITv&=pqDOAxC42oV$=1&g}Yztl{@S_-y=e+f4ap{~~AwYQR
zqO`|>h%feJKd;|&86vRM`e$fNy3<@x+!#FU$w6$*TnWvl`o;c1&$9mkYI4Kd0|sZ#
zlO;v&yuW*&YYuw@oa4ik5tFPpT_VUj5QDTe*erkUr}6uTr1eD!mL<S?^mde(?Ut0`
zLJb|Byr5Fs?8A-wE=@nV)sXe<=YBs}`GxS1`OcbOc@{kCzYCbATMV1@Ul;!V)F0Sy
zDS+Ld+cvVgJe@CLW5E*pvgZ%@l!1NjCTYw+D0t=A+rX;8!J6y?%~9D^T8B}Wa1o%U
z{5Ct>KbV8qK3|1{=z*a|i-9u26>XU^&-wJY(`YrH$M1Jd04ny6Yn$SLRTuzbwEOCX
zG(dY(NJkK@Fv~dbN$v8*?cQ+DCYmgwGIqf|SLRTn7FZEwa64VA{POjFp6xVZ%qn6W
zc)ZYcVXAXALN<*NOIPcY@b>Oe&;T%Dv;`!zPG6P?SJv+=<;p)guS*?x`dN%R2y#s9
zh2BmN+gUN2f<6*9I`Y78yT-Yr65%NTG||jOTh1D@!UWPA2_t`7Taoj=X}qSfR`cd1
z?_j<Q35QPp#2=rS6fn=~EDZ`KlTv6*`-(>P1o{jG0OnNQ6nG)4$$m7RQ@b81_m>X`
z2dTjHay`rpPCpQiu8P0g_aF)b=(52Cgd)?}Cecq`&OL;ioRJHdz6lMHAw860V>02a
z<n1MNj8$kki=(R(=XgGB-ldZ&^@nsy?RWKMU|~$bUz*unFMnD^V*@Vs6L+Uu);P>3
z>R477JaLCTpT68@$#!s7N6_J}nH`!!-Je#2uZPA#ItsACA0_Ee+cAM&6)j|8fVxNi
zvXqMV7XS^AB8t{_lmC1BczgrAhiAO&GaI`jQTU3oaBGvIh~O74T*`70Kp$_51y4vL
zcDdQ3s;)jctvNX6&}#b;!3KC8ZR6%7-zmJ;EqLJg|9JPAFxV^eKq@hl`}MV_&gbYW
z<lT=9<G)7f7LSy)3xKWp>(sSg-JQ6#6(jhNJ4r{_bh{1H2*N_z&|mgFE!A2Bxf#AC
zwZMA1o3tSp$^I_a@9)~T%T2*+w?bQGD{b~nuQ#3b2?$8R?<(o1pJ9q{wKcRf$@^O7
zA3G?+PV%6}HP|ZSqwJs2(#uXGiQun4Se_B!NDF^$(gAnd0Lw6VG@5*?^x)S)DM0VM
zgXp`P`|=!SFnG8}x+Z~rf@?4y_S{MWXu3YlpfLW0K(W(=7;FVB`&7~W^m01ho$9&!
zDCJZ1_yp$!XeDGF-jK)fS&m3ERjg%+?w+F}>xmS273{#OF}xXX_84IR30;8>#&Mn!
zAnnk8&@k!f8F}w6Mmu1ssNssKIt>w3`<g1QQcoKj$$Y9`d+Lw8XD9+3@zYUT1$E|x
zguh$ZB#EfJ;jeeD5M9zt){6I0L7;D7Ct&gl!a$tBy~SnV13Tt{1h)s}bagNwyhQ*q
z(~q0Zbn!_t$I;(%*)1E|L7;`G!RBym?!`C6Ui}sb6!!;av_h}S^BDrm%-n7HX?q=K
zZ`b!S)<U3sC#{MDTZpa|7w&CVRph%lc0zNq;8$3p^g~xgcUPz~qBLW)PpMTIsweh=
zuU~BOfcW7MMi4nu22=in?gr}Kx+Y8^@kmiQQAW8pW--=~3Nl{xul^wmKURWS?+Gnz
z9@1WF+L+NWWUi-bAJ=M@uc2<wj<|SCvjg~{lA4+E%zY<JMB{X;)C9Pyk#MLpqO8yE
z@z?SD;Y+jtIUzCKb@AFo>w6pk5<Ytd{5&-@_M>@J?Dek@k8qii2$7u#lx1soC(sAQ
z`am&Zz@k`g?Ya$cWq?f_$$g+*;8o3C;}HIjQ0!gNoTr1HzY%{bPS#oGMKuO_zs)hH
zhyxx)pO`?>9p<LAc2Dayy(X;B!L7*@F5o9$e=-8bvh#$+79TZA-8&!*^obtIfXFyk
zY;kU+*$P6rEpL}E0-DAAQ1~R>DBoxvb0i-wlF@OGl)5a?%TP6C3qHpnWk+JWvJefC
zt;fSjLfbu-mwWWEn-ebR+2uy6y1~usg?9z%eb!W75}^<PSy=Psqi#N;lvd;yj$ly^
zK5%5}Q~<GMLr4xKrt2yS?CZ{xsyQ+1N=pKskO{)mAemFXr_dU)ueiYfV*fiqw05~&
z82~@f9K|^q!SaNm_FKbji*Ms$^&hJ;XDgNUh!_PpDd4J`!dEFUX0*5%<~q5A@lSvn
z(D$5}$h0p<#$9g}--z~XN&AinBVR@f;AOQF4`Sa13F;#<>GG&zpxLUS7FM)U<cd-W
z|3mSD9RX*(RU0bPbE}V-bda>I%}UXA(A3jsNARX!@2>crUuRzvXcQq~putf4aery!
ziQ)GbDb`dB;y^Cahzs0qVG=!%D7~uR1KuvqgQaXFe=RTi$n>o<I9`oFpi7ZblUE7d
z2=5h)kkKA?;5pV+Gcf!d4SxLnac~p1Wcxy{G>pD7<}*@7lj9C}&&{nn8L*3pe^F==
z;p(rWemmkk9;oG|(UCwK2jB!e3S7ive=TG<h2hgsASs5PXg;qy32$f>C<2t}K~eq}
z?{GNlFFrl4(3bGH-t{W>ZbJWQ6UCq@378#D^xrBv-TQnS{RET|BSj^HDF3wmt`-wv
z-fR48Z0yBQ(dqne`7nVMetOWDE-k^6RpR3L?CXg@|8?G6;q}HZ-rN&tK7AT{_CH=_
zFtsv()+Qg)zJXGDDaS0%lVQFyLzw|-`GFT<G`YZEc=h{4tuGmz${hi9T-N3fl<*l3
zFfo<mLkxN9juEIel<$&dv1aFVqVqRayg1*a=)Z`IUoY?AhQWeiD@J25AMopzie_Bj
zNo!EIkaYN`maLd<@2<(kUjoPe(wO^vvzh{DZ8>0O_{*n|8VlVFMP4_zAF!PgT7w;2
zx<ve7n%18fQeJXdWk$yfY#S^#xtTjQlX=x)vQZZKnnL8z+pS1$gA5NaNIf^%t2}3-
zv}%^6pIg{;(A~BCV`>eS^g=U*K0q3I<senR*n2lipY+CN68gr^&48e(5-86L`Ze~c
z$vWC4Gz!H9^s(X-Dx6diaE``9G}Zf0>e|=G?BVlINd$cP9G_?F7JDm6J;(lJ%TTn!
zbn>{%GHW}QZXF5lZ(Bk5o&%ynqn!C6)fHTvx+DXyE#rqELmOfC?q=~Q;_oFG9@rug
zP|d|WOtyVxP}dwk>bz?++Yw&$_sJ--0l-5K8gXQ&`WA(s8B0@iQ%lX-Fb7e@VMTn-
zJ`B!i>talR&9$U1vNDU<l(4T5m$FUtA8*I<mjV8zN{0_-uI#!_k<}->W#FU!pJ&a*
zz~%_gNQ@goEu=XBX2%lTIC6ae`AHKXAPnG~RU2hTaz(f+c5%RX?~1Ujb6cV&j$$<n
z6vv@J2mIziA%2l+qgw?Dcl~-@3OOiW1w)V|elQ2nVQ#13ooDr;ci8tztdZFuA;D#%
z%*W$AakjVz<hNh%Z4K=OOARlG&_7DLwG`@inmNtUAK|1ga0zO^N>IG^{ZBvGlTXie
zx7tpgb(?UoDXntA)JU>9s&AA>z8gL4j|&X-r&xAl#|oK3?js3=%vgO_RmFan3*31l
zq#<1PJb<H>H{J3;;2{%H&_g+SrTA+DQCOR5f_zhj0eb@qOLR#^*w8qDED*gJ=t7ZZ
zzMSzUrd6i8D*$m92mtWvxXy7V*{Yl1D+JYia&67~%hJXogK00zr(0S~EQG-ravHyR
z0HDinn1;<|Lu@X&+6pyg`0TY93rUZ4DAEIG(bZ{86U_lpE1VBtR`CM*2uPM~C?IEF
zr{%zOQ!y+EfZnI8)?bk0<8Z4oHM`tz&-7{(xYM))Nn;V8j(TSW^I~wHb?Iwf6mGeA
z{%$!YEh2e4Ji3LlVJ;M=7VhlvRTf#EqO9-Uy#=%woP`>6xZlpg|Mid6UJGl}2wm&2
zJq#9{O?-gEgUVW=0N?2l26U-G3&k<^kpFTh2Q!FyM2!29D~`DZvgSW9I`55zTA416
zxX`4?>SG|wxwyS^V}AkkdQckRr*-wrmdCup;v9X}57gXaOkotMcC2i#&cnWdN3FCE
zNy97*9&F)F;?G{ybWMU={uI8GO%kD}zGKY>#JESSA%>w*Zk}z!{F9-4P20K1Z^=dZ
zw!^Q#Cde&ng7d<fF}oJUf4GaOO|jZ*GY`=ECk-!2Qz5@lzIf0hRXD(0s1d(9hHrk+
z<4F1LdZUFwBN(vH)l^oY##Ni&rou9M<1TJ>Ap-Tmy~{*Klx1dyoBXDkUj7b^FOYvN
z4;p#XjfMqqVQ6rzVv|5OG^=&9DOO3nOpNcy#9jzb?7R5I6iN#CwBo*C*sD&(G9#O$
zU({r6{{y}Su?18YB$MzCc9NVn3ofEQ)CqP(_~wQ(6)O=YGars#d-O0*5c2hEo>p{B
z0G{3BL_i}xzWxhP5HU^UYpWMq%G*pUWbv>6)SuIu7LG`^Bispsdk6G$FPv1tNcB@K
zHYwKY?0mMIuQmI<+I|ONfMv2%*ASbL6@-U%q!I5fBC|fis~Yip-=LtYnw6`L3g!T^
z7$K%nIXqwKu+Kprv5o*CGCX_LV;XM(-a88Mive2tGlRD2pPuoecvK{OR!QPIB(5}m
zQ2gji6^{=VE}nnEKDA&>zOvL8hSEYo;Q~$Tg7<nZGK1f_xI}g*RM{GI=#c83{DA0#
zx)dZ0Yp?KFO=FmflF^;&m>@!4vkthOdX2JUUe@%tBNEKBLgB24iY0UOrUf(}pw7<?
zM8)Jpb>#^{j``~WC;7ori#NeWY>K!3Qe6PyTf~Nfbr-kNWiHl2VR6&WW}Ae}es8{N
z;AmdkjP50vob~N|_#JwDQGgL^vX;32y{)~<pnSb5J6N7TLHSAy=t)Kj{A=Y%TTBd{
zWJ8k>*1mm@42WT{%kiEw?)+_%M-Qhv=wwC9yEb=s##O(GO);83y44pl1X^siLi2v^
z?~~)ZTD|Lq?-BO>$QWXz&CxC)ifUr?#Ql?B8d_Mg`yEaPtP<dxKbc>?K<>brdzmnD
znA*apxM7V^Lb)tY!`bexM)WHz>uM!UVCF?&-cK~6S?;#M1Uwcv7E5**QdW2*2W6MU
zyGG;24F{MJ6pOoM=h@u8;?KKo=p2prDfR>7!R%d$@>;9F<mC4A!FQjSPzI*=hPBXv
z44v=HpUOMb=0iUtbR2b#un;AI0Upt`%ntlu-q(PPz3^E06DFp+enSgM!2&@kqJI2#
zLu$B4RwJs5Qbb%72N}scZEs!#x?XN3)@)U6eLo;8;&<L4)(QLpB2(pRl>!_r%PYbO
z{z7Q)`_2puW$snNsij=&<Y<yG4xm}s4X9hZrXu?2fqA?Gm8ZgUP_RM^BP$#rG(g1^
zlYIF#iM2$LwhhIFXTS0wuN-S?#i@O6b#yKjCzA`L;s6Q=9`=)vAr0w-Pc}+vfXo3B
z@q3{vND{^<pmw}chp6DIWX&O5rTk@tas25?GV2vRjpNeCbMVG8IEzLs@QC`99NTt2
z5XlW!!C7_i0q7u3gL1K6E*U23NmBEEzkZt9$!FPMyqBCnfk4x4;aB?Zn_|xWe~_!?
zB-cVJo4PN7I-eRVP`@)#=0<PPXddvkM@2noHsm1SCSa-oXNjPZ2}8~@tSajUmn_kN
z!1YJ_1mL{;o?u%u4o%{5B!6-gvYecKZd^$Ea!1r@slM@mT+YZ4JR~^4!v&)C@)P{G
z;AC9>$7bNN!-S^SeeO8LJG0c4cZ~7|M5zqyBoPt+uk#KCOPPFlVdKs-tw?Ga+H{Mz
z`nR#ikYOl3dgZ7DWv`9ebFmD-tv6{9-Q*L0FHEV!U<TUa9Dsi^vw@tgrPjrUI}RMa
zZkMs#j+=%%IM5s@MYstFV+dpvo(K=!aXIla&Cr<Iv=O5fMo$BH={I_2ynCI$aUjrX
zbvXQxAwSVUY3eFEoJUp$Kh?4LH%Nfm^pF+C_HpeLrsP16>pj7jdj=dv&mfD_pkcj@
z7z*m0s9$3sQ?5FBS|6k2amvKybqtLD$Z;{G7~yrY)smt<UtVJQTV}ggX0rvoZk4qW
zbSiAkn#D+$OOAeroKq6Wvg+TSoBhuB>jpICw|j`&3!JSaC-JJcaME#wN3cuYuFpay
zsL(H}2$2t7jQjWH_y>AuDa!(pYpW}$@D|gtWI7Jw-%{Lfl6|Z0tU9>ldnk!4Fd*Hw
zuk74&yfU={dg&8x291yXN#g)iJcrXinJ6-Yy@0Ezt@oG77>(pso>YU<QL@Qv)W0?$
z7>H-wSwzrN9O%VQQ3_wbe<4T%Mai^U+g88Eiq#+QT!55(wJrEvJDK@>wKfnYN)-8o
z5SD&<ZR37*6*bR6ellKWi(PR1-tw3v;qq(7MmahZSl7;aSE#g#LylwpKgsJW$fWTi
zL<z^wxfWPjf&QF-xrlaNxK!6h({z(n)ikkzP<K}LvCoGa@7rk99|3a#()&!AnOwa%
z<|oc&gnr+J7Mh%Hef^mY%%^-k@ymn|IGg~&SAZ<SG{4ieKQe`!ae&H+I$dlXyPt$c
zlg6J_LfFk?z~<zc$P@?z;nCwqJ?nBFV9OB;p4cdn7w@i_#DqmMr7;fP_aLA^Fnyxo
zt@Q>#S@6KCz&bZRf~#a~a13RbiV$B(hAt4Cr^3uLs@h+Dxj37<#C|DNXm$JDX{#c4
zcj4#e=Fl<?{MlJO3L&|t%)S18s0`E7lC$~T<)4r^>za(e_Jz(9%vjn^N|+=R`tpMW
zKrCQz*kyKAI-VC<KXu~)J;g|_t%_<WKJG=OIM*f_*VY$rJuc0kU-ja<V8cXF$^X%8
zEJqGZxPo>0J9TN6!h%GFKe>uW<UU1$lqO6tMBj{{-J#{9Id$f}(|AL=^D6ArN;yyI
z`*|5Z!IHV1!p&j<LM$myD{><k?@3tr2lx}RCT2+)gg&y^CdYVlIBR@UjksoJ=HZQQ
z{Rt^USzO$a`PZAMmwQy)V)5$i>wyAEBL)|V&&`bo)17R<B1T~jCRk!Xf;RGXs+eAS
z-at7&vuqV<v3A8IIJ19}wJoC1@+Y7ZDVNjDXqST%+6;t&%li=mZa$RA-m5Z1s+9WW
zC0W0OOHR;dM0SZ=T3M?9l^kc@8ZlOk7!0(t@Ce%Xd_h4wR_rv!aL$dX(!tyuKr>*B
zJA~T@p!_XGgvuI^O)0!Ddw0#qp!TgiART-x(RXt`JB%MK8WTxLaTBjhHEogxco%UG
zCNgrcm%hgPSnfu+eywAq!VHtimV#qFVacijZ9d&wnO4B)f61|%fRfAXUF4ij3n9C+
zUSJJ47hVSbmnt>JV)k71zv>^1A8kw}XHyc1!W!-1hz@^aDklznlCQ-f$RnD;gec>K
z3%!52dj$z5Y{d;&U1u<r1F^BFhBIFk$cR+6L>a(e*OT0?4Ofo@`R#dn@*|D@9f@I!
zs^>CCrbtr>Ti4`ZE>Ut2twYoLG7XK$R2*$MNT<AI!<o5!Fz@S>R$q)@6Y?l}=i_tn
zX!W;xhpGbQAp91<m-s#vm=O|k$OV9#kK=IqA;i9uUpx_7N!dLnh52a>T#ig=gwLJ;
z^#IhAOI8l)$cEIUSoQ?f!f6en18<JPR38$G=y=b&5JLW{oe=(kFtZ0s9GQXOU<2uN
z?qX?Ngp^qf!Rnnf#G4fclaNR`p9=aB(c$ietS_99MMn8*yNsaz#qX&vur^3{A-X|J
zHVSk@uK`R8I6~Dv_pd%#kG*`surzFWtS*HFFt*<ut~hZamXQv`zD*!nxHEZM0Upl(
zz6&5ap=%`lsnsoKB0H2D_doOV5=5(+s9moRn6U?&{tgC;3Do>We#MHD;Pfb=5$vre
z6_UOn8CTEY0DGZed2#J4_rlC$+~&uQjA(bQovm<`pU>)(V5wtU`oA6ZZ%eRJx00)c
zJ<xmuqe#O2s7hk3Aw2bsi!pcJy@(5B4bmdD4a^|F0Ho)+p(`=twzI$piaBHu{g53~
zMZo8bf1mID3s(|mz*ON`2540@9}T)(9}b_h2~0wq@wz(8=Ah92y}jmy>@dNw;7w1|
z--b`VN2&zrZ-%J8Zx=1Q@`PCpKDMOd0a=Z*z%cnft0A*=Hz`mJU>-wYGQB+b%&Z##
z>`@_TGCww~nWBVWV3XewlTS=g_7-r$wIU0EnRe4F{k?etkb_o(Mda13x6ir%TkvwC
z-G>H-{U<J<5y;~F+4Rh$xJUJkaOpoRX6(W0uWa8(|GgO2cKo@WDWwSiZizyBS7x|_
z=&PSYTsU{WpEoco%b~-;b)C^TpqoaQKL)o!+f$NWhmo1uu&g|Kfs05NjEA}oh(YWV
z-Xn~Dpzq&dBWNpmwON)$s_CJxM~*Z)E7ISviPtwAn4NDIiX6cGZ@rp^*^0^S*LkGM
zgLNg9JOhF`=&AnGJn$jGBP^M18RxyMyt08nx=gx(*FD=!uYJTbdn_uDw-O`^jhlR$
z?Df0`?}d5!a{TK9pC)gYis{7-#J{Qai-9o$jnu1>(D6`}H*798qow@HDR|Xhq={ZX
zCofN;<wNyLaH9{YEsl}ZFQFogSR(O?o1u;GtR=9?1yp9PWEY3SVe+Mm?=q^NdRrH?
z!6)A9$wqch1k3P1s+XC7x~7QuE*tW1{z2~D#W=OciCE*PUbhSAl74H$cRYJIk!g!;
zgx_PApZ~d&jm@~%t-95p_s%wuqy+4cpY-O#QfuT4NW6}w0A=iS9krROba3<QUbTLd
z6Ypi#0xaV}xlqbcF_d}llj$!Esd|Z9<Ku-F4oInU(#JGDqEvf(o9NKO7#i>$f8$I9
zXKlW569e)icQNLCxx?h_eA6+AsWq^qR2<$XX2`SU)Xf&iHGz|5C)|d;l!>%pg(6H(
znbmvQ>nY{MLThS<p4-vYbGDd@Awz=2NG2HS`l=|^AN0>FPYJt`1&7jCv%MB|9Gx9;
zBzDb~tloAhWS1ADrEV^YF3`XDWW0Dsx8G*1)O~M8J8*U=(MU+uD<|<MXk*ht8&Xug
zGFHz5dG>U7J`j<&av=IIJ*0yuQ4+L=HP@cMG31)Nw4nFpGr!!xz0!%qxAu2Jt1e+m
zb|G=bm}O)3K}Z#dzM+>YC;%Mv0%lRhYxWWD0`j@svea65CDP!$I+YzoZce-HW(-Lm
z7h0HHKVUvU(F2(=)+S;j@t~Xl9~Cb&wa}Q`getbF+`L1Fminw9EFqH5xRy7EUL2SO
zGb%;K{lw1FFL`J_I79nWfS@BQ;@@TM2kmZ?yg8O+{z}=eU*ZCh?|-N4N_L1`Cbd)+
zysy;g)sd|FL9N%c_#_Tr&8EZH9I&&*fSka{93&C{j4aLg!BW#ifrd36Rf7B>rY~@%
zpj<>Zk>B$)Sh=WnsD<&>Z-c=V%IPdowzkEy<pOgf^^F#N$3g0X=M&vte_5cuP6$^}
zMjI<~%BoO2<lxizyWX$!Xlsa!_53r2%0UyWW#ZJ8K)OpB^b6R0*d10^AZf_UU<)@a
z^yQP5pe9ydY({*dXg+$$$0iW`Qe2*Z!FQ<<T=!(4dpn)g8IdxxDSTGStK<H7>d%d~
zMs}jov$ME8No44<--Ry8{<%X*;UK!r_qmA~E^F?DS}ktfTy47g&?%d>HHQBMt~g|e
zW|O4Du+utkY?sJDxw)n`y!#km546g-lK7HviZ(#!wzDv!u*&uYy&<k-lc;N-t=h!`
zt)$=fKkyXrtw&Hu(+9sjud_nqGp*55gpd~bMYQvh?AND;lM{B7D!PNCJ777xJzf(e
z_Jz<5?Q_P4yjs>8ALn(~&;mrarj9*AzeS({H^CcM;Ih|fYpCWq(=C06hd9cj^a05P
z(OcXVwFfTvL2jgvU7B`W&KqPtwdCF&ugMI&<*74eM0RR;+h{v7OSK$bB5T=|c4wuZ
zp(I!S=6r2F`Oi)d6i$zFe&<X(_`&NQVeiQtr{!rh_~bz9;_WY_eq(b2(d6UK=mTC6
zMJoeb=spc>DkZFxB*E-8-yfD-o@_*X-m2m~+@ymRPV$*0x1y&R;vjkpM`xMVN-xdD
zEUT`t)*1`R5ogs-()L47p>3G|;b9X5_StzB|Bv3(qQz6faj7q+&;aE6&g_=3l}WiZ
z9_<iYI@UR`ci=<b0VTvN68`GKil5S}WxfqQ$GzhE??uN1;$=Sf_^}9Eh$Yu3Q8H8y
z!1&A=jiP$;P70`+w<BLLEbC1BurO@CJ4e}0Kw!J%|M9RJ>Um^<v@->gLa+X|DzV$)
z=~w-WE5xR*wR|Y42&en?cUK;o2;MtBd;U*LxwcpXrw?J+c2FTavSqT@(#V9Y63xJS
zUwb}_ea53?0q)*O0PjauPaT%7e0I4sLvN#C31Z{bOT_hnMRs^0N;v<Ab33GU!35Ey
zgqX>;%YcEo9WO`Pj_4Es<aZvil=SZ}*md1ofG)ai)6&Q1bKItEa==VE5aU}INWC9x
z`GnTMtWDMTr?7hiRlWa==2|w<IGMXs3g>U&^r0m>12Xk~a8leZP5$2uhF9Rl`vXf!
zTkZ0fi$TNe@Jkg%c-3Ey6(yt+O%0-t>&a{JaE|Atym+aGgHQe_1pbu*DWwzg`6YrY
zV6d<L(>%*jwQ#JV<RZOd?M7wGvyTPABDyuKy4@RJvjfBd>T$*&g7@xbFt8S0zp)o+
z2&-RoT*^MyEW-WAocR*SKrD_8+#oW-Pxr(_esC8e{6L)0mf82g%m#A}zG|Fb{*I(P
z>GXREmO_Q&g><vPqwrWwk0Crcjf<x8Mqn^h?Quj0EcvOu?YQ30Bft64d91?OZ9}n3
z4Q^w53S{t#A%izO^<pZGmA<HC-cBjSVf@8<zdMT9r}$C!dRD<<2{wAiLA9PK)882P
zsU`uVJK<$xhizRH8@rEP5Qbc0C?|0F9aGwxDAE~WIT%vD9rP}eh)->r9|m`KVY8aH
zV>2C@vK=+y0pQLTQ1&EKPd-{<H&C=-)#X3;I8Em>IT4O)zz%{tUi1VHzkJ0$S3wQD
zNo2Hh(SG-q;R*1naMj;$aJ-*6#8l5^S_2p&(P-n1LF%1m7(wDdzT}>ldh-yur`#vV
zg$NO?8>%0OmhrqviN-q9$#x<4`3s(#mAjigD5t%OIWT#5DaQRov$l##SS)I=5-Ip}
z)!@Wr=UJ*77*yP6Q<wurw^flH-;2kuuPHuZGxFer)N_!6BmUP$2y*HQ#vzee@X1PY
zM(5N~w<abq1UX8^_*bWS`D3$X&>T^of#cro&TB-g<F@Hq>no!S7mCN=YkVIdb@j~2
zwN!9f+kK8h4(t;qHEv%jBkXW|S4V)*P)ZaC_6NXkEi+^KH~=NBnJb{YC9HRuC$+~L
z+04g|g=Jm;Y7n3#rqZhhlFeetG%Or`6)Yru<(r4M-Y;)Ni_EZPcyhW3OaryOIezYO
zdwe^Q?DZi@He|8?R;T`hr{d?0$EeZ<<_~(6Cujs%=HBb`KC!hNKYD=K+W3k_S<Nzr
zx>v}p9tDH~$%=<}_sMMXeB_`J-u(Nx)ct0Yv)WVaOW|k|U#BP*IB(RPjtu=PS~r#6
zP1|^ng(B_Qw+`C2C-B}4!1>_YD+V3*GD}p&?`E*7d%i722nSiX4?RIfeoRxajU5|N
zqGn>~*RSOuN*x`52aC72P!1C;=Urk*4+NM$AZ_?7TFc&5c+X#&|6L*9_zj8cK_~Jz
zfbx2|Sr`-gvIx^rVd~Bn*avM`y_@a}d7AI{;>Im-o8p{3JnhrbH8_Cu<7w~yk@E%J
z=~?7BK+oQu&N@WqQh)9-#+?41&aDog9JCtj_3j-bpZiei6W&-ih?u9MjjU_lb*{i`
zeln*`LknntHj&5anqH>YT5b5D%2%cAkDiM0Vk!uLfzc>wAxLh+6}|D&^7_6xozDm*
zq%yF_&AiRH6LEqGnb)V4a51nYnTAHmjqKl}=(?H^dCOV;1$W{|D-fxO9;O%^iHzm_
z`-=oobQb71@gW~_=^MYk)byX-z{S?to9u>kaqmpee<DZmj6BG>dV929ej@i@g}o_7
z13T0jKV{NS-k`?;-eUg<v5$`fBzBuHBbDAo1MqU)REAZ@Y*TZWGb0Z+$SE<56R>>4
zliG3bOEK^&=52D0*C)T-ybnL-BO4AMD~!cs&X@yyiI5%2X0^40F#hWNf4eO?jemPA
zx*i(~w`RY1j<A1*nT+{iUR7$}|Isv0Kl0RxbkL(~x{^A57yr{@z_T+6{<@^pkKL_w
z?}<8S%|{%Tq=0dNuAz}o5*SB$`4Y)XY{qC-kh<>`Rp$WD*}|sEM}>uNGq_q~QS<l>
zd=qn0YdXygl2~w`bp(n=X(5kXQS*;X%)p5G-+(1*1IJm9ka3bYjA+{4-pB{}Pbqx?
z__pgvqND1SrR5d__Zl}>%m@Y4G~_UGjS!z)4(bUu(bXw3Gv=IaU;pOnrEBevO79FG
zENbfMt$EYMx~DSm6wG`}2iBW(w?7c^8^_zthhqQ!XX}-}=;=@7SlI)`&;RIH^9g^|
z90|aTg!uV5+<cRr2FUdwrx(OrkUQz1^Le`AX~rR|IB@mIKoJnv@3e}UCJ(}6R6XX+
z*?QGLQ_rol?%*Bxmp0Z=`?Z$DGZs#46bNG|vinUKOVbk`t^<0r|I*G;pbbf3EA<+L
z8du#SG;qv~AOPc!hjM&Jk>yA&$O8jN5&xNB!ejfyT6|Tu@g;}>3N_dGo#~>`Ge)cj
z0w9ByF$~__B1WOZVQLRYJl5J=YejWE8GC~@nZ?W>4a-1k2vD`@&vV_4m6tw?sp?cG
z$bBI0!Z>ja3>QdgV^|s31KmV_^OzI(B?;7d-(=XMhlY{}XnzQ1#zc1E8UP0?I*{Y4
zP?0z`H}rA>ML5F{%jIMzCGs~4kUX{^%;b{xV@}AoI=y$N-z*zv1x0@DRplHG(tmjg
zsshMaG&AyPA)ACOO16rhep3Dw=%@d3<gq^f&&$?2lR7!|VO~Y}KE=q(!oy4WqG5y(
zxvsBY2mL;c(<s6jJ7b;b1E>jt+YK&qpBCLRczQGx{?VKLNL8x)tVfGU)|}2>o}{G$
zo3YFhG_K+>6<<<R&84F6*TH^8Vml{<G2GD1yDpmPYb%{$ffPZIT!IKc0H>5a?6W^Q
ziV_P~Qk&e@m2R8&m7KL|+hj`P9YBGI3wM*^3}c-1XW=okCO<z$rNLkIf3Y+Rh(v2&
zP|2{kwJx5%py`Xz7d>+J=W;{hYqT85PM9!}vnPVsz-=#N{Z*N$rwc#FmL^$&P&XYG
z{`c)4V@RxfcNEEs?4)cEMf?5sc%|8CwW>3~8x8vckrRql8pE8<>Z_OoAulyN^{#tF
z2cFr8t8~z<(U4`P)JFEDniQ{9Ks}5wT0l=<yi}KhFmR5)Wm0utJ>@je5kY1=C1x3#
z6D}vA#j{oH!4%id0$BSZWy!!G3qnqXj(lrOI32i&H--4hmz*Knyhux2u1!wxxS?$J
zpKsu_8ffEB{;*@=nF%L^m_@)}39d*-$V`<xko5odNk2gl+3;&yE1ANON&SlwoCeS{
zkk;ObTPlX!hbhbI`{u!9GrI?3#K$X4ZyeZ^JK<J)ByV?$WaZJ0paY*R52@Iu*b6Q^
zYlWt-nryXB6mdaX;-jfV$bh{Y+dDB7vMru(i=GTR?aN_Pax9!VQfELmyNAJEYl6dS
zW~*ObwrbM3CI3*LDyH!*cKdmeahfXqz22zG8$}o#s;>uP6uKf8B<!XIvMRe_IkF|F
zHVB^*j~{BIjij1vg7G(%g5I_hE;3@4BSH0Qefm2pJ~GdXg49kvpaODQ985TO4BzSf
zVYe$q7;Y8Ty0;sj{!8r>iD@;$C>!+Pp?3Br(+@mv<Q>)Q*nFDZn}8r5_%7l?z%Bb@
z{M|4$tEU>@Jy)871e-9v-cb^}6+I0`HXr{5gR^!*ztJU~qeS!dA7Ue0z&vk2Vu@Pp
zNj90Y#RM~Nrvu$|Q$#1eA4<GAZM<5<P!*)2?tQb+BbF_S+%a)FIzM=v%1^dPa&ogl
zCAROml?2E^&gZ=$!(&bbcOolx;cnZKKrv#bhM?wsk3E0Jt_VRdA7Kb}0{rVPAttXD
z_+O;yLM>+SURQ;$QPDLWWG)POwY1Lq1i}KUrAC`A(?NWLHAQ-&r6rD1A56|J=>|W;
z+U{V(nBvRChE!9kvvW%N8-wZ@4xzQbOISvbJwREvR+R^VuU+<2X9`EcZV*r{$gJuW
zu|Mxs{NSr-Kmc7ec$tsGT(1a_^`^^Qq&mc;T^@P?hE4`0oV5fon^&v9n%(WnMK%&h
znJ$F7$UDJV{9yrLG#O-<jWo)THKqRDZNx-<mmSNsQ|5`#;AGSiogaR>t&x$+O2nN4
zhvYu1*(mb;4sz~{$9^wWLy4Jc;8*aj(yaG@Am?K+rZ5K(39%me!A}|FLHTs)SG&^B
zw{dZ`Ur*dPS25Qz*Zj#H|72jZNZm0zw#v+)fCY#P2q45)gvWDpxL`VXb%1Z_=Yz1O
z;+F8zBjQb=`zjCn3CQZj?A0q7#9h0)d+6vn5|7t(1<H{#*l)7>?o<lwk1)pC<+KT9
z8!hAp(Nn`s^WAGr*E+fi&eyR4(SMa>q~Y~bd2;JJLM80{1S;_;&IhlHoXJvh{jf_1
zDm(M|VM~E@oWOTlj0tb<xVrTcv_zWWmi(f2`x#vd0EslxAoY3PL&qGo4Wz0OwOEOL
zr24eS#DQOlff1@%IF)p@u!C$I6lv5}@A;Lz%c{;uO(h5eOjHp3MW=Q3Kw|PUQOWtG
zN8m*a)c@n@tplR!zVG3gVThp_x*MbsB_&3>Lj(!wRFINJU;t6Nq#Hr$?gj}FkWNVv
zq(Qow_s;YA{@(u?X3o9m?6daTYwi7qxU^h5gM7DHVRH&%8q4FYG&l&#Yg4ze`Y%xC
zk%lQLD#+)jinuSn>jKh%xdL~Wz73O@4YZV|D+u;Z&eTI+ztK&z(x5Pf2TYOR@2gm5
zJYPbW${#4k57`4zQC`tWzK{T`*6w)vG~Xu(Eq~0^Vf=73HOm}_&fNu!<b<)AQssfD
zJPr?I7twh?wz2iPJ$i7=zBWjU_F+&!Wy>2Xn_aAAfd>~g$D!}<>zA?b0Xx_nQBct@
zs-n9h&7kQs&m#SZ(1ZHoAOA#cXBN)x7DHB;fqUB=8v%dIF6TNi3UqaBq<e#9(n{wU
zf@yd9dGa;6Wq8w?tTXpU0=|vtCt1i3W+p2kp=+)Tcj(wDBQceb78CzPH9Nu)v+LpD
zu$>gC7#(EoR?Fed?>S$}q5C%;dams@+!-%4N2>Iw3Eh@GpwKx^NyxxE=<~asX%-H4
z&Bt~3np&-Dzfvzg|I5<vXK+=eRm%bKasUttDB|(ak_EPgU~Iomlv1dFI=<nbpovKI
zFUI)S%bMXulav=omt|*%n0Om^q=o}7R{XNOh+1;ms>tJ5!lhj@OMl7pMjqoOESxj{
zDI^xnJjJR;t;i6AP1?b7i%xQ{oK?h~m$_T<1xnTuO7Z@18$sy8xB~&m>Y@elQ+g^6
z@zs)-Ov8XYJGY7ShpaRGP-lVR|EE~U6MstJW^ks(H?)WXsskz;f!c{aIj$seH9rv$
zR@PM@VTX=_KK<0+R<YT)S@G7&C(f?n&xEt`q#BH83=X)35U~VBk!-0s2z4vVi?jwy
zJLv=z$RYEysfQdn?98CrnC{e}jHQrN(mAUnq`eL3>fvs02l25Qa7Af^2jy_T2c21i
zlWe5%BT@1TYwry2#$`vxJ?@(X`{tQ}oNjO3hWi-{gRb+z6m7=~gMX5NBJQ5#Lr^EC
z<B1;J3s5`5>~ppc@jwQk%n{^0rAwCSt!ArE%>$=m0CU}}VX#&Z)c{fI7VS=DPzMOM
zZyxo!v~ilVlJt&ANu42PDtwkqXu77u97vYAf?}mR$wvaTEXt{{BD1;6UgevP54O!e
zFzFh2FR-ltAUEo<+NB_T04NEFk7uGNdPOTnGPB;<s4`?B9wWnZetc_9wJ#KY95_W}
z@~!#uSN=*;CsU9*X<P}(8$~N^Rc9}`v(g}40Zp<-nZjU!J<HP^dQcia_)3|M4|E(q
z8m`K2T6R!Bol(BOuV``=>N8xN-m~DTN81kWlOa2k2>^3)uSMYld3X)1H~-G^Tx$|#
zy-98*Dggnu?@IxDOhJkBch5?2!uF^!_XQdC8kuuMR?BEgUo^8%ODummX2e*N-iP)I
z@B*kKw5u<6xc;y7yY07qwkHCGEnlO4hYtbcY(gpj9aV()KS=zlg{)pDU{r+^voJlQ
zP0Y0a`8G|REg$uHPq~S8{7m{-2DTo9=p>w@>3_#`md4@>s+uK_+nUW<d<YmTR;8i1
z|E^<QiwG6(J0UlydDy0OIqrP|Ze`=a328P*&=d)f<L%V&J|X$A_?y3dGt_o&Y0jfR
z=R1#=NbewM?5fdK!<I*}M#aqYhvv65I1o3wN#k@heH_Bp7-L-q#er&2P*DhPx)G;`
z+)mh3Qd4#uAQ|eS_aW7_q2txDI6Ks@=Cg7s`D*m<R%<daIRT#}mk5b(V{7#3IB(M{
zWNoFrYBghKze?AB?WbR@`68`kc_i};LGO^L@54f2|0q%5zr~>o*_<XHfnq?P0;|o(
z_K$K{qYH%*$SG1s!og0wRUgiCpl;8!t6EZ%5Kk`&4oh$MHTU>#R6hed>%=Md$&;+V
zuDS1eu@Dl-a;OaXKdxf)(+yPq`K-*l_PpS4F?tlz;9&8#&{^gpM5dREiM$$!f&y3_
zHgR0MI`w#zXw0n)h(cf^8)*O<c$W6e*&Z|QW(@(lyRTH9i?SZUk_1gj{z=ADtQ>jQ
z&RhRJ2r8t2h<E}d48b64&vv7B3Gpv&Rx>B}*+E($vt|?>12|T~z*-@Ml5CGO{zViN
z_(No!Iq}bz^w`?=dmQHzFtljkpE-o;ew@@^8}A>?h0gC+h;%AtrENM|dNX|Y{q<CI
zj7K0czR<YD_@;OeCRWscJe{T~Nt&VtTs#9d4V;h0y}_-IrfKUVa2w6fWj>Ch3<u6L
zs)*+Lz7%2Wn@;>kRS=Ve`C_`Vv8LDb<>W`+0_9vFZn;W@??%^E=-~N{I-jt?tkaPL
zNi`N7oqf-yvc_7H1l@U(o_*2WkeM{h+3j^DN4~TRlqEH5*U7p4|9uWz7N#>cyd;-o
zrsI<o3=sA%NdR>yGgU&@vb#DUe|A758IL!UV3Qh<8z6!AOmz4I0{U`}<$i-BwAQeM
zcze%1I@zw;6M@qUx`Ly!2;}NRKX-2V{1tt-@w3EJ*N6fOKEMX>Yt}->lUWbiBC`I|
zBaAJ{d+pKrT5YaUx#&8yM>70UejGn5j3&=wU;`OU49$r#p!ECACPBe%Y?i9Vdu93r
z3G(_X>=s%eW*4&&dqB*`U*QYx8`z1yG5Ceks%yOSQ*^GRKuC#t`;K_EtnyBK&8uJ5
zeC<c{!HQdoZLrfO`Np<TCWtpb|Gd6`%aV-w91_KDcBu`gdIB!K(SE*1$bl<d{X^My
zou6#;%9P6QToAI&vRd`}gX7n!+52X0M2k>dwUi+E6+dovP*|~-TzLR#h(=E3`zJZv
zMY|5yOMCj#f(G}3M*s;GcgZ{G3@z0QI|ZoK^rc@|dvLq*w{N#VbHR>~5I||X-e@hj
z(ag!@8xdvNZ;IMTWld=opn$r7Ag(3}5^R(9y>Mg@)a^g|lu64otA=lXIKi>x^FqsD
zdRz!g+%DS$Hlm_dhCW=z^y=3^!v!DeBVn-aOtPBdw%S(p-Gz0(C2`o4?7R%U_z#1G
zE@s$if$$fJrr2Q<ibGWOH<nqnu;W~dsp8QD3_0?+HIlT38v*9D$E*sBxwYNFQ69f&
zD}q2%ZvtuMRNv+?20WvdszlcScHq4@pSoB9>Iu+@|Cv?N0!dY$+ux`ya6jJF2MSrg
z>Dr)s=Bfy}S3o5|TIo_APW1>(eYNt$E-fErH9{;cJq@+wLC$?vJa6wfd(Igd&k4}<
z#Al43%w%sDkZYZPF<(2#YV4Jm*=+|Bi<%B$p?41}<D(qhZK#XZ(wzRv(Ttf+p7her
z9BwAWl=pi1Le?{F3&_`nh=O5kL6W4z3JQwc4#Z2AZ*6p*e-6r&46*p7vPulSKHD5A
z0j=H8C4+o%$zw_(bP(Raba{wWpG*y1=q6RWmEL7Wo?9bF&)=HY0o5@{g#}-L+MznY
z2O+-JiW-Mc&N5x6&@2o>tDs}G-g2XV$U7pRi)@5y&@&ld{hW&HGGk>LykFK)jd&GE
zK%#{Pgv$O25*#zaH9sEiQZWfyha%WG2W9?bdbWhFnY=I(;Mx!<Wi7A37qMY4SI34)
zhJif3Vvql>mxsG_R<xbHxbJU{(6fu0IebdQ&kH_XIAW;`V+U;{$=lKbtzZDYjE|hV
z!NHQKueT!q(1?r-R`ySd5J-tbn25QQnn?EK+I7c5do`cWEN#zrKa~u=U<v||i{;CI
zzg1L=^*P<m+((u~I<AgPbPc7?_Ur(Hns2a4=;J6o7n&0%6J-=3hR75-o@8)}7_m1-
zNH2=>E(pcKARd=c`&SrhAfFyI#J2_%zBWSFonF=npN$%hQ;Vr(z{R>kSlk&?!o_a^
zgbs$V(46<mUB<YHAm_It9{GyfH#(R(QB>vfCZX`HAAPFQf;>+;heepFQGf>?7`3Zi
zl@G0WbkCoQTkSmp7@6UV#RZpQp!#mTL1`ri!Db<D)b{UNaax7`y>HbwdmdTIxb^pz
z1h|T%V9K1J4<FqzvHxM3YnqShfe*qXI49*0SRbuhipIZ&>RVH1y_6v_@@RDwHJh5w
z5c`gRT%mE)?YhU;XEfoc{|OF^yk79~f^%7UEp<S=_<w&*`~-Zz>Net}pI!jY!(Lh?
zwi6@V)B_#TI0;UA=cE3#@%$06v@;U=xnoV)C9xS*@&WZ^CbU#>zP_?ZCHVkc^S6BB
zDdO54$l;Tq(qRU>hiL?+wIWMmB8J`y+p8aRL%(NDln3i@N?A!dC`4EQ35PN}IR2M*
zC|_H`6YAPx0Dmec%57-bL{PngD@zA8Idv<wz-6|jxtZ@Dmw`X)ffI5d{c(T<1rg!?
z<I&)33kh^bmzV&UV!YcpsQELiczLUBXXq9I5oZFHOK0tt{K=r4+izoCy^&sjrnRDO
z@1@vbnMttQ7_xUFJ|%#6$T|&UQW28I#&qXZ^JAdX@yL!2oz>%~b(xxh$^zv+{9GW4
zMDSvNzUq1%SVHh(e5gjFNL3Cn*HL&bi~ff8cJcrudODJKVXZ{KaS7jSvPoO|?jdCh
zo(XMol<ubg%FCx~xM-olj->7STSY+fsq9c8bFnfFxR*EWi_&U?yVhf}Ks%XB3U?uO
zTS-Sx3;O36k?sQkM-&W`AM6YwkJPuAZ6T=R!D}gyu}Bgv?AS3k25RV6Y`_}d{q_6%
zj4umR+3Z@oAnyB4k1{fnzYcGv*=G1GA+)E(mB{5Ud;}VgNQU*E#QyP5o*b-;M?8b|
zo(U{-3TH=A!WKi21A*GN<9-_r)eChEZ5FCZjZ=R;Jh@gvD77|15YGjU<DY*OB7!dJ
zQe`xGS2uawuG2<lcdUw^1)SbxU%d06#_J>t29<WMgQ1hkkXIZ`e58p4t<e}q*PS8g
z8bI|#W@(h45llHh{5OkKD25^VD%JTZQ_{@huwL7j9}h0$F}w6z_XDVZ4wS3R-mOeW
z(=J>at*;5akW4jzhXFzgCXQ}@4jg%b)8=MPdk+1UL1Xt3K7>Eg8B~Tp=EbN;&q8YW
zQ{Fla`GBs*^&l|$ZQ3g}yr9<IeD{9Wy~ljbDGT1`)>2$;B_ZHk4vDywC?U1dOZ5$z
z#=c<KA!#mu?`J?IUlEZO@ySl@=lPe??3&o_-$StgAuhi1Vsnh{vJN_6-S9}~6%dZ#
z-1e2NgcAKU*G1d!c=wwJFYSU5ynNrVk>ap@Mn99M->yAG@Kmg6YUB_RUk(*Q8yw2-
zxv_%&rg!+86~g&5ul7=A=fH7UZMLd}ia;KR{iolIJrnc}0xjuSoY`1&vp<EnM<{p)
z83I(pQ2YA{UU?0<Z<F0y@rVPQ0c7;Ba7@<y54-=!iGC%fijP9a0v@_M4|X>$k3+PU
z1%im(RwN>JO86Jvczv6i68=@WN6FBcVgkwROIm9C=|3oa*;XU-FMYoM{f<+zDrcut
zSqpf6gIm2jYID0r<kxB{8X$2&3#4VMUC?S64T@v3(2#Zyl^@LgtfSC^0LxF);xBWP
zxPI48X;7<L(qlqDuo1_7rXp9%$M8n2;FR5^7@!VAS%3cfQXF`@fmNY%tR}1YkkAUP
zda7RA?D?p%x{$5Aq-z}8n7b!Hy)yEoH2L4ocQQeqiay6hZTu$;Z8AWllg0_F5nzox
zQhfM^aqN;DPW2F6oa0ycw<<eE4CAuthJ-jxvo5eOYtm?lTU&Vdv}W=?;+coLvCdT|
z<CE-B%Alf(b)FyUZx~>UMW%e3Mc2JPhwEPE)TwHzH0P%Ir>`9LT<a(}@S7zN3`3Zc
znZ%F@_|q#d4Z2*1kqRpTRV*}I6M}UGOwon@jnxC6K0X)9?2SQM|J94JWY<s`SF&&~
znT9PzK1gWvn7a)>j{j8yOkJ2us!se{Bq>;Y!3nJQruKIdK1q{N`?ybZx+AooFI08Z
zVIz5rq>5t)D+XvDmDgtb?3p@3k^CZt_p2CJlmyH=8Cj(5SMIT%`dZJn_6Z-1bi+)9
zOc7{pQ4v~iXFjcJI8T#=!of$ychLikOH)WNwjpQkI83m)?!>KW{GLt{96<K=Tfnl!
zqsq);>in{Y20S9W#HrG7Wq6Q*CFvK&B)Fwf-ME5of>5|CbC4e~@|&}R(Y(oX%i_-J
zK0?}Yzpk}n3(~NNEd1M^THP)8{N3S*hV%5pQ|BU59WEQn>8eLT7h2?CPf!7OE7g1t
ze2g*Y6(j7|8R9CEexn=S#oq%*NcPIUds_LB0dciam3ZX`2mEO)$$bl^3Tq@z-IYMO
z6Dayl8B$-RM4x%~{<~`OBSH4a@Sa2KS6XQ3^bS@}N{;qgu8(!NzMwM%KO7fwq?Dj{
zDiLIQ^v&Evpjfs3&WFe>Ckp~w%Stk-6OR0P=X#!8aCaH<U6nbvig_8dppn2sLlK@e
zJVM3@8fVE86Zj7mCMY3x{w`mKOYoLLw!HO_>wT#Y2gSf#G3=uc%yxZO7de@S?uzTX
z58o}#e|aQxvH6b|-8QN!1t{g5PprD~<K*VK{69y*F=gWMW|j6H_btfDk^+<*oyU&g
z$AyrJ2SAP<d`=}A>Td=tZlwKaeJo<9($Nyk^nVp+Zis6jS%ewr5cOvNG{N!HhOO?c
zOf)ycJ3?4NI5Ow!fKUaSpf+SWW51jTJ4dEL_gal!GbO5!pSlo58)cP=BlRL!5W`BS
zf>2QVZyPlX2T+%vKOiKe0L4Q{%sxq>cW(_$SxPai%&Pz+H(ZtPnGL4#%kQp$tiOka
zsZae@l=(f?m07p?h>thu_RXKGw<Txw*Hzg=HwlPe=&-vlK5)sH3QEWS&reXyx^J?7
z>qEOG&TCT#IA}8nW5DbE6J_!mLqR#;7=ahMn1YPDj$C7^kIqM3^!4Jg#Th`3iaMvv
ziie&Rq8Y@fFyw%}V)sRk9=cP78`t6kjomkyG3!kv3L&w~LC?`#KuJwxJUuSBjG$FV
z>Sms`#J~4LD6RyE-|7<88N3tNmhYjH9c~CteDwj6Bl?patV5jpU|=zjz4p-`P0)G6
zMva)@I2R|=8Ffi=c|L?PH!A5y3RE`AH9F@mZ)Wv?RH58S?rgzc->LYl+~;h1;mI}4
z6VOC_NYsWHK!KanO<fJklOTG2^FOZ?eJ$+#f?5h&FOXtrz!C9&{)2-MkC1vB`+xjP
zK@xHcyC!@Mu;`-|1PBNh8<U3tnkcra<QndES1??!>1bA=&Ca6H53MPgtig@($h}ol
zL0hDnhyeJxh>fqc8QX<!m7pziGovNEaBTnz>{r|#Qfy@mJ`bESnl^qY_nr>TaD<Q$
zhZA@V)K`C83$#0^%Cz%3?M^*@!6xVgk<w6aCM3-DY^Gp=s)0<N+NAjY^nAN0p4hyp
z7JqVA<l-Ude?m^(#6@;`NEt~Q$?ct&)(n00lughaLe`9hpV+7-0Dk;HQ|9DZI|X#X
z1tn@Xo{MmrM_!=_X;SPZ<+#<&W>lPIso%n>IKett){Yz^Xx5*&KaKUB2n_!N;$@1}
zP<HoXk{2_;Rg4MF)j7nC>-WgIDzzUOnCQ)amIP4=#3ST$MN3qufam0eb31%ey0m{N
z<JMZRH2ZQjpZ(#9f$4e1Z(4-DxGhl^{WD3XASJf37xzmdEfYpts-Lb<6ZQS3^-9nm
zm7fr9uqNV9n^g)OpaQ4b08Y``XH<^{EOpXkc_zj+%X@P7QXu*F-mir(@y-rLRfoRu
zZ;<`v$(J+&_y{UKXK6l6Xu*-#-QG~E4ZY(B)zQ$AZUN-4-Yb(+Ati#yIvMn<j8#S?
z-g(DV?E#Jf76f3EeuiLb_!oao@5~h@lArnx62BK3X!L}4qAWenO;~H&W&=(6ldQsx
zlh*B6tx`ddDJys!EJ{`gmP<ZPJIymmIw+HO8y*<;#a6)Y*FAmVse9O0&IE_KDYi!^
zRHfD=amiSNoery@{CiIfKOHzad#zCcoqzdDMWcL#DHz(0FIwF`Y-<`Ts5g;FmJh)1
zdDyg_px#M?{t~L=|44rUGF}_jVIpbnc65%u+-5cWQ5`{(@M$_Ns|HtuS09^L4HPD1
zEM}I^-WB)z<b0luc$9#GB-+wQ<RrD2C8#N&wxgC8KMq}r%scAZQLn)88z$d9bz^t&
zxI0xhwr<!GLIK7r$wbf#u=fL&fFP*t>!mE`E17!6OrZ@`>gZwil}VIz`sW{lTlJ!j
z9tNt)s|--ziF7xAg{~PFmh6kb*vb>2!2v=Mr)%wdL?00^s0~&Z#{x{s<D?yqvOeBQ
zAQ5I4>`ClS>Dr-Dyibu@x+7S5)M%&w>ukL5y%tN5BjB$_h#bckQ?Y<e^v><C)D{Ls
zcgF`ozarSXL}&_HzQMuATScxkmUP|@aAiJlF*9K77TLzh-If8QjtD}WF-ioXkdM0x
z*=C@TgG1JW$H*H)y_ZCKHYbBWs2jNRhp?o%SfNFY)@-b4QNKxD^lXxUIX^LczH_=>
z;Mb^sonQxO-EMNWu(oKZ0?00*aAivHD+_Bj7i?^*E3cZuqT~umYe$t;L1-^!*JC54
zBTN@EziWsX{?EmG{qzL*-+Qah$(>(jAA3C<zO`&l$y(?FzT&+>^gCw=Lc8U`6rJhL
z5KEX~r&B}Ak_*9~`x>FHw#SMFAHL>AyNypgzEbR+`qWhlQ?5*nx{aI=$N&^Q=rFNI
z8n)Xxb>nSyHyY4EBo_Mlb_lDPr)w*ab_t|b^QK5Kau9{IIPq*|CLSFa)Cf+~hKu0`
zIm>C)`l*&zN?+}F?umYTl++Na1@f<6O*`!O=b;BG30MMw8RU@oI;@~_Aa~hcdrzkp
z_h0v+D<)8=%rPeD)nvw=1F8yl>y`TzqU$+BCSWb;kEDraa&cl{MV*W!24J6qP6Xx!
zL<j@y?h~NL8UXUW8VUS*4}zWw+h}#3Puc#MEp<^OHH73kw0wyFNx=su1SQJ+;0IHm
zQTCaw-+K=^y-pJX*62qP#)n+HYwzfJ%jUue`F!7V$LJmyjcI*mWFB0eY_{lAWB0->
z$L#1afFVP0TzLOJb@z^j9>{@OqVx}gwf@Yu-#N~Dj(%hQ`RLd7cgg$?0vWDJ_^R}(
zw}cFoX>UQ}@k3z8v;{@N1krb>Gz{1<(kFMs#W9)pzc2a`EpD&#t<Jv76*_6mHU{YG
zbu{oy3K6;b0d{XU^tzfy0yyq-p}8YsXLS7{qoSgCr2Er?&)<%DQ2<u44f~fF$sla@
zp%t58gygT497xwVN`0N1^eF_JmFX~K4ja*y0&ohz(!3NoZN9J<F62!RjLs>PL7VCf
z!~y<3kkLgF;49IhfE#FEWqj8Xv;gRPODP~c)tbGPs<sn&{_WpOCE81<b}V_cZ=`Mu
zz$>&CAHDqw3!B2~UaqhDczkFi*4>Os8*$@^fu1XX4l#|t-yl0c=b@2i-@cIu7R&QY
zz%VXsl#Oc#y+*Yd_;@v(+8&?<Epc7Uz%{u_{O?j1juiVd6}oFt?DCGUF3Cn+H{-<&
z{~B*pwgn6%56JA$8oPn);WI!Ata!6t>xd4lR~*E#_mh-}j-hV3XN*G{H2Em84~H_1
zxQ~z<RaUP{$R3Mdqll4!?&XFFv1H8{2jG5hD)5WGoqnKW{p$s#jvp_&eKvd!l{Q+m
z$9B%DpbtEoCAxZuk9{d{!jJ-QQM2QXyl+tpm%N*E6V}XLX@Ji~5)7O^$)2bc=JcCb
z60+gjL#AS$nXMfBtX3&Q!#k_H>}K2kPowMcUCL+(z?OOyS4JA<TOexNVz6n?=kmn{
zPYtxW2e+;4e*V)#0hLFXc=jyr<g}0V?(@H)t<I=p*L9iA(BL1OK~m6le_~^BuU`l2
zIcUv-jq^97;%(oN89nwB{m{}uU5D43MRnZhCxO9)$g&0z```g7Zd2iyx=EYC^TLrf
zhTxIV23MI6ssO(L2=>K8oshPC_d*wJK-aX11VpZvFrE4Oij#$w4j)hRkb4}UR#5)K
zd5CKOmhS+KtbJk5E?Te6wEKgDb4B<JUzIquH_vUML@V$8V#(tjnP?}Z@ZAx0H5a<v
zO9cWz2tJ6#`6=Wf*q`9_=;BKy4fP67wdI5cPlm}kK$&D^UkG`%XbmWh)k%oEO+)~+
z&UYUL2*QDndy@xwpPEU)=5;Q)AN$-B4=GV`RO{#S%(vJ?zws-X%0156Oz5s73IXm4
zDlEO_N3*~-U7dU(Q+xgO*L>Ds^;^cLTIW_@v}N#qqB1vkzk|LL*~8*?g%Z+wzqcC#
z?AN!mF9sla+m199Hd4UH2WT{pZe%5J`Ye_8F(2gWwjoK6>VqW1L{(_PKLVnK@3pxd
z&CfU@zFSg#$Z^Tb&LZMVet{MMQK1QX`~;3e1&BZ7u&iWtZ%T-Fjw2=OjB<6*6P!||
ziX<%*v6z~Rr+`@pA<R-^6Yl|G1;s?)V>B7`v1{2&(UE{@lgdpack`CW>VCw@O886k
zn1EBA8mX~!hiix@OEW*U`mG?K9Pyxf?xO|heO&a?etWmHIWVATf6Yf?j{1Y{7VV-p
zHUIE1%rtJ)DJ3VL!s95QpVOB5!HV}w{O2rV|MNWDq0`<&LcrFH2Rg(zrKuJ`-rRlI
ze58Shkb9VZQ`umwf5)xbTmHjoKPAc622V5jivzlWn>iA=^aT;AZRD^;4FpZaE?&w)
zUybpx+V6K;rz{<{!LPvdkG<=lO|(=pg^@^{<C?QVkjp_}OHFJwdr&nzZbX)PA$o<i
z#%_QftaESE<DyK-^8lDGKp{11{L*1dBnh=hj?LjM4=n%`OlXn}={HM?srRd*ZbT#S
zNqVzd|F&J-gk54ar}bZBstLIHfMM4HQ368CNLQ7k4sk{FVmyU63slV{Ghlaw)|Ah)
zgLpu1$pi=uAX~5YYz!jk!Sg>4TY>4a;fGIYf+st>N{n4nB{zNkwwshva&&n6v%8hO
zn{~bf>=dj2fYkz4fi?^PjUdr(0Ul1Z@*4ffj_J2~o<sVr!nfM^g}?tb%wpV+(H;T0
z2pdGmxADbM;c9llqQy&Prg`9~GH0|YSz8UT2idd1Nm1hjRTW8wZ?HTIf2TO?&~PSh
z)F1@MS(%BaTjM3eiGc2q+7-U_VR<otoqHwp6(~ja&mHOWZ<Ctytc1y+nF%<ukBuG5
zRAn6IphKxo>i2NdCNd#m*y^zgU@(=xO7T)8!3LU?Xj*ES0gm0&ad~F9>yJv*`QzzL
z9(L2Cp@T~$lt!I?JN^Q*E+(ot=wM5X4oEoKK5FnLMxfR|o@Q7nEVW|x7&CChs1@?5
z(c>NCpCZCYOzn>?0Oz4a9OQlAB<ZH~knd?)Pf;9V5NE*eeX=~)P+gCL=nhZ6Od)G?
z;YMbOad}GJ3j-&<X$)@E$3H`6pSl2dk;gv^vo#Okh7E#`0c{c^fHsLvhZG&7vj@-S
zF9M-jV&qLOxF#S2L1Z!rgMB1}-~+Ob>hqpxmBq1YQ?uOx$~?QP71$W-@yJVvSWvbC
zfLp<!Q_Q&SXG|I@U{e%{kpaQ>DAV!cOv}wml5AsHiRjLRXxuB1Ivp%34FEp<nc#Qt
z_+erI*1Y+v*{*YndxH6A6x|*1Xn`P~+_wYZONO4sC(B0~P{iI2nU;b7v+u6vLf5lc
zG7P{2{c*1#0Ot9i{$2TFpXGpW->Y`I$GgHFe?F)`$UkO0`YnSN1sH}Vq0b9GRQmc>
z-{5k2?RD+^9cte1g6T(1>&Ri|TW4wRT85?RX_F<XyVM|(3C&s|L4#ve9%i3#%s06<
z;6@fY!Y7tJB+uTzc@^!AGxNT&|GuZSs|L>!mg-S9OFIXCt%9^5X)u3fN&~ZhMZ9CE
z`1+yl(piAavHzje_m!2OZBoKZld&a(-`mqxCS7?RIomG#jci)yocLv}7&c^g62yMz
z+dqAzm`0a<g9BZ~Z33U-IbUHx;o;?^B@P!+ZUmX~WQdo)CKhSm#TTLlQmaQe2$Cq>
zwRD!#PU~Txw#s8&YGz_B@?&gW9QeJkxr`}M(!G!4`_n5|U6jKe-jg3?3Go!w>1=Tt
zkSNfAZD;k290K$<ck*qeNIz|~>XuJrkS?C`hgz)qKs?W*xk^=PdmIU0gY-D>ZMaqz
z6@~%&TXT(}2?H!?cT|Q`d?m%Lgw}Kq&jwV#<3>rhaz}{NDexD(Efgy)sAx3EvtaMS
zL0aq^Ht;-x{*~^eB=6iT-Vk(L)X_hbJMdw*n=-BvcH)0#!~&N1?Uwcm&LiOn?S*6Z
zt?2!OW(U6Lv4WTI999GSE3Qii#%2{pMX6J_hszW@fZg>&K=I+@z=Bdd23flLiVyMk
zyqWZ7ygoly28>&a0xt!&?ikavZRI93ktCp3hs-n1TQGB3_v?ItsiCJ9onNLtPahCA
z^u+VIdgk4Hr*KVsOiKM~E2t`Ho0aLf$$Op9cT3`%?=|-j4Uqd-Cm@7I*hoNhRzma9
zL?!Ml-*b&wy-~*5o;+CJHMNU|2vvx#8AgGIAnrNHy{18Q4;C!QThX0Qou_*q)&@Bx
z2TJVrw<!@us9A#tUXYQQbCe#g{Hv|v@!}9=$Kwn@R4pURLjqd6+B_sCMnB~iRYX7e
z15^cMC2<c+yBE)>qcy@?n=&#f&{~|L5UUPFP#|GiV|qy&G>ONVe7lpo(|425RRlMO
zb`_mVE@VkSQkk;u$D-45L!_*GO}d7jD95*kpR{`OOUHZLu?@-<@3#D|)Ly&NV))qE
z=Lodl>te!jj{>>&#t-{G79sph>FYLX;2C~G+e}}cUp_$5;9k*|-{9PPtfA#J7zr>x
zZOq`mAa6NdNfk&4tKh}_v>=MU&`F8!LUqfJf&_$DHPud?d;)ph_Z}3on?BxJtL#Yp
zbB|%>Zs@Oi!j+l4u($v=9@^6E9*GdDa3>4oYX#@p$3GWe?&YnyR%#hlvSejLt;Cky
zPY-Mhyw4~NlssZ|cG`8={}N;PhIUs2V#o&UF5YvRUCAk^ppK;%G9&3V@g9>Ye+(2U
zSr=V<qrwKV$;-Qk6%@L%1P(D<pj5VGq};Z*8E4)@KSU#h{<8gvk*BY=PDdD<0-cB{
ztkYXO#v^K+zK9D?e?HFHuCUp7q>dB^2`&1RUAvH`Uj0bn*~w|Y5~T@B6KOD*QUpv-
z7%rje2G(Qo!T2q_Y-9cqmg*nQrQsM6sHHNLTehtg!W_6mwy443AmrL1+Zs-+D;vT%
za&Ml`=l3#koYRT_RcXkBXN`j8i$^ERc5m71A2)c^&SbP6m!LTb7KF}$&ihMg7=9S&
zt9qf#`EdXreghv1I8MwCJah6U|4iBqqqjuH<}=u1<iVnTfW?|W>1ZG)TgtAhQr@3=
zMYu8;OdV*ws1oDdulBUvAoM#2ap~QU!mJ3UdPj*(k$=`NviS6;=<E`qM2srAE6`Mo
z+?8G*8Mqi*(1c$@@S%H32SxhKkcIu=$d2&J3oV+Er33{rOXeUa(ya$5Pf7<=A0B0x
zIId`3U-3eLj}&m1V3ULit{RllGWM*pS`nG(6R{)>o(ve1U1St`<YxWCt-qNaDWc@Y
z>wYmPbFJ`$Tdr1<+b<@G1`|T3sg##8->*)Znh}EY_#(93lE0DM!VamdfcI<LM7>Dw
z3pFfmdql%wqpyl>8MU69nmm(j*{*Ev4P*Ng7bWxKVOu$UNpkoBBkdbYYRujH=#nDk
z%GVjjrP;+Fp5K2gX`N5Shno{3@jYouB|k%HM9(=-oNsK%=hMF8;mr}QT8=yl#CFpW
z$6uf^x;YFxwy2HO0y@OvENRZ%V|$Y^MpJ<cdf_HFTqxiK#34p;*sP+}?S&YAh$Z$A
zKktY6#FCnfj(MGY!z8_-qWw7*K=LZmiFWc`p206OzvFy7p`I!<jEV!Xg0OIM8aaY`
zh{wX9+T{~YUnt%@z3L2E-NU>@U68=E0Z*cZ@^Nh}TUQw>R=$@A_}FPG^1-zmTfDMV
z2fe@wJ;XBq)xxW)H8aCuj(@j2^>DKMlIw0v!{>^mnqJx`+-xq^K$I5~k_d>0UTYyn
zO^BBC>h<oD8&M0H5t`T{+~25Nm=ApdX&=2VCRZJ1!-LT!Ae9}SNknv(c8NscAjQBh
zZn04RMPCq(xn(UJjI93g2?xaW!+ScQuak>~*o)vRk;-#ABV7-p$`3OEgRc+It(Om2
z1wctCvNOt3p%y3=Sg^%^G}$f@xtC#_ow^K5TIj6+H9pK^fp_T%me168kATTygnrdx
zR5XOy{9yioWIGM)nqJ#4*4{D$fe;`S`KQkTx3*#`GD^jAR+F$Kwixv=3<vW4{hoeX
zY&pu)KYs>KywT?mkM5~<LC1wbw+=Hx&*Hgn`aT^uBrd4VH}?4T;myn=es?=J%{$g`
z=s(Fj&ByNQEZ_&61bQhK4G)D#5s%;cc|%4!lay#czC)QW0PU%_Bt%G>*>pPdTNy_)
zDB=iz0CD_1e|A<&<pp`}QU2b?ygN4E*V2N&1(NM>jj!cI*(#!dZV617z>?#FHO<MD
zSF50cKO{U%6uvytHU2g0FtdZHUKbhG0(2L^Vg(bbx%bM%GHUHvsLlL}$Wa{m-!+#D
zY-G}W5Y`eYQG4eDlv{2qvD{x8&293+VO4Sasp4B1GWr#^pbk=C6L+v~5~$=pf%f98
z-v2(c-41!}zj^xP{zA4wxb*lp)rd^I=wCziZwiVK_m5{|re9dgn?YJkHS?-B51lI8
zzW>)IC4^(_A*cz98^Zd9pRh%?4b={{ZV_ZyBYyY^8gHz4+^Mj_b8BmV9LarcxxYMm
zA`Dy<<}g8sdDX3t7hH@2tlpq0Rr$^3ne(=6)892^Q2TqyCwg=mDot`y2L@qEe}>ks
zQan(nRndxpwMl4Qv&#DfD(Jeo3VBdN*>7u#`44HflfJ(-t5*+y*JoM*!BUw7yo1HH
zgRdV7jZp>F#06~cBrS@Xa=kph-Evg(k@?HzA${0tmpO^42%$^b!+A#}Tffx*966m<
z@j)r#HS5^6BMZzr3aMPWRwGLY<WpE&;bt0^2Cwj`?Cn%%dzV6RK*KBxF7oddUkk6`
zG|2eNwzp6^TS$)49HSju7wAj0UH&p1Dx?gWtnm9g__J#K!JC<$Z|Sb%!ET<^4VMxW
zxOE9Ii4YB|BtI3Vqk`}YvzT=cfx{mT=njuvIyhmj&pv|^Tq7b-IuAV0p0F7AD)da}
zJ_lMFmyF2sD9g3^%4WURxzYk1#X~0)n5uKWmg<)Q&6T_IU<2~IfA76tXvmm2>}%fh
zmicW$Hr;*|pNN}v!fKvL<5WL6%&Qz0z^4av6#wMHW~XG2ya+OhF_4L^Kwx73FEDj=
z!PrPCqd*lgPjTY`4(t<MCDyXAxHX{N>(PHSCGhlH(;pr`seelm&jeIwu+WM_GGNsR
z+$W)WEJ6A3u=0K5#^B@^%l2Z<<e!dMhL3p&pJ1$}C+tKYPw4z6T)2?Wm2NsWGv$;$
zuc}Yl2j1F%bdYtFsvFoEn9A(*ltrtz`9s|YzwV02O_?0g8{G}x=w+0;mjI8<I@JCN
z{V}2KiQ*?@Yl)=CZ&_(7nL7=|(i4m2JFEA9vreQuU_#Gh;z9XWtxXF%nh)O8!Dy@Y
zh8KI8H^o>N6?!>=m&C=&gavXnCbyxG<400Uvdj|<nd8{o-#@E5HM5PYAJ{>WyY;`z
zYr9su&c{2u)VN1)EOxLWsG!E!fD10h0I(k&OQE6q6=EH>c=tldn|y0s*=?E}JA&1V
zjEDTUo*b|+V!n?LZsF%SWyO8Ez%v5=gK&`bUc!+Yq0i3=FG%$cBOYA&s_;31&Ij`S
zX1zbVXU3IeU+mEM?U_2VVUo;?uv8K9o%!FQ+F<+UQX}mjzj3F4z4cj(GL$M=bE9$z
z!^*6URb9B~p7@By<&q-_;8}vyDl`N-!i&j7BG-SR96gvF)F7;Ch<*WamfLPgTUGjf
zGd4r<(FsvVaO*1dhJy)F*?qq9Hf0i{2~Xnrrk0eK8XW;I`Vnye@aX@30{g#Zaq^Lv
zO4;e5N)}0H720~JTvtiY2&kzcOeZlT22WgVh0@26@aT3ZzODcN7AqALGr~CgDBN7t
z|I5eH;P6Fcm~13#oCnGcdRFvRMs_2x$v2~%S|9Qlgzqp~W5PDZjFgwOczC<GmfG%L
zYx7fvh~?~&=5}RwNR5*uy^lec(&mpi)Ju4{#<#obzboA*0!nnUPu4Z;PJk!&Aqv6i
zQ`~pJ?&d;`KwXO_lgAkhP}}q<??25pIL^FzzMO8B@w{ZBGyNaBC*pTz1V)$Z)=?{4
z90|k{s;!oiuDL+I85(I&-xwwA=U~)I!2+Rz#l;6m>I?V1O)ks$vbksQ;0o>b1Cxr0
zWz$FDQn}PC{yu->SJN=l(mtU0q@P^$#MAPorR7IGD*qpbIqk<_gyS%6L~<1g@Qtx-
zs{z~dnXeCG^t`k>2zWsJf1__K_D`wp_8wDUP_5(SKH7*Udvpn=-eyjpr<aV!LE<v>
zMfU#}XARkytY|zT_J>%=?w{Y^w$%A9e+rg5#Hb6o0A#s%)S%7$_PfAGrcL$qPiTBi
zF_zJZ7A;ilrDq6B<x>bXbFPd#tM{wYv4M@L8s}kIHiwJ41;m*GU!r5jOTxJL4$0@j
zq|Rv%?%cw1KA6_ZF|U6FZp~+ki2iD8-ap<mCnGBB7`cRro@WEw(_=f+N2I19gMp(*
zCs=G_dXQsO8oJk9FHTc4k57}Ps*X-O=>mpnRM~|b6~3lbco*~-gK9__`TJ5~0Eg%m
z0iM)aL7->*9Tg9XEcIi4>^v@<N)IB`(S73l)dCZc#545lj--l~DEm%3b#q?@Ys(hg
zw??zS$0H^UFfeR4Xu0|_?Y;ZkbSZO|9YDttz`1m%=MqqcY;)#rIyFq$esPL!q_cM>
zDZSFSz?nm8;-IP=$p(~>rx$C?uOFDALJU#Gw~P=58C4+FQiTY`u<L+S*bv-25_Czg
zhcNkr-&aMSqB5$m_Y(V6Z+46p@p{IU8-k&V??D70)`@XP4%ng^BJft9=fz^*2&jIP
zIsSOGA@L4#udHpIOSjKRwJ?5LwBcgqMxkSb5KI!+R}iu|?AEIYB1tqvC&5g+Q22%!
zOXj-yHVn*$tMAse8@qIW%8-B^NMno}SVE(xpHqqo-{X|~<fb)n@|kVy32;nKWB4l7
zA+I=Btw)!`_49Y4It%I=kv{JTgr+InQN*7lS-}&_A+aSnI0I{UT7(g=Vp;kxfcID<
zziLhf`rcS^vFKn+UW8H=efVXn&Vxspp-n<+9_R1ht-C`BchflNH3D(`wFZD}Q9?n@
zFEU8q?kIlQ4%DMmv+AFu%o0M;M}Z~>b$#Z}tLKHhum`5J<O@W?94f+<-rql&=P^zO
zwQ>BkDG@K@MJHy9N{E*RRFh><&Vp{fLHNF6n@ble*<x5hnVh*MJYiF228D<6`gg9m
z$2_Rh|A%d@(b!gK?p2u(%>5Hcp0jY%^i7l~P11mOWY9Do&V{j;k@I)vz^1gVXtyfs
zFeJ{mwJV_5!vbEfr$a|AHbHf0f^uPj2Hhqc{@wT8o8^yetIxwOQ676Vb-&8e26@yh
z{41nt>2?`zh0tIGXG~Lq>Y$AWRuI#*xOwsU_9n+@L@D}7-U)YHp6OARUnDSU<Z6%<
z4-^e5-fa-Ah{NgCzTM|f5D)Xh&yegNlzH+m+UE#ZF`@xBaQnXfjdk+G90~H%^iivB
z4=M5`f{+#}TCPXyvwzp-+)n9PQfh{xMeW%5qGDrHUjWn@34j;6#!mX#fZ-i+Ihprc
zcpl_r=d52S%irSZZxhVjd;Lo;N~~5_pcgW^^E7({*XopvxG?(+`j1XAH-HToa6WqO
zHsFwKMH05@LxLN3O%x%E8G|(0Lp2ii(o%l?DppDt$=|6C3E>1{diMp`0Reb31ik#l
z7kyW@LxUeyD&{%JCZ}K2`{2C;W4cz1)h3i2`1;!bJ-$C0uG_>&p%QWoqd?Cr!z=C*
z1A!f-Y;KR!`}b9yVvUi-?WBU_M7u}XLDKeTWId`wzdl(H#r*t0tzPkL_C@0^USYuT
z#!NN;hyZ|Y@H0Ul2ZFr7JP1HajtpPPx{DWhp~mq`fdM2BZh8_|+)$_M_YbT0b22{N
z6zAl$v+J8N9oM2xATqI4{t><UZ`Q|$ROIEC?F?y8?4d<|?60vnf$1YndXaygS3LKh
z{O<hl6gBtW2O#k!!3Pk*OKEcgWu`1>!1_@A^<vV>5yXFj_7UdZjo%Nk6SJp6sco&C
z$OoysA)I6JGYJKO6~UyIAZ1CbkV<CYF#%huoq4QUxs{_|iu$C9wkuwI=y|XQ>T;L2
z=FZvT(JH%EtJz6?pb}s4PQ1Xd0Fc)eL;zd(*))9_KCIv)NFL;6dtlp#)g2?thLqC;
z6_UVm>*OK5C7od~UM`k6@2-UJWO~th0Ki}h%7znfpv<8lf+?kMd?zhB5)qjTk(o;m
zOPZ)JNuRvF!O|F1Vi^RK5!X0^*of=v_rgHa7?R5$GV}Q7%O(NBHRt-v8<IHKL)nEL
zBq~9;Zyq5^N}i-Ak%SWfRfC>iC<)UrPF|9L4XOX|2o)y8#lck+neSDnPAOh?cM-MR
zn0EvH8ZSULcqTJoc3sPNx41jZqtprO1O@;Kx&R3wl{aM-5Hy`2pH;KdTkE}KLyehP
zz>r;v+*{{Ab9QV9)oaZ}fAOYs8Fu<_uhD5|7BVVmEngD=J;!rU(^~RYis0KF{ax}@
zUHz%-*V{zeSAmXkw@ff=B<L;3I`@--0$dq8$T%taE?Fze=XWvFFgY{t%i*i*L-8-)
ztBnya6$Xv{54hszK=f-yWw+m#10O<^eKgV?I{%uXQ5Kag<nyJ~V&r$ZsK}Pb!_oUr
z3)U_F;*J^FaUf^h|M=!U-vlnbH+hEoZQI`J^=BH0$5<Kw%@=Y22BtCz$s$I%{AAmk
zUi>@LZ+nD{p<uGym$fe9{+S8F*jF^X@D<#Z;d_X&Pq++N+szSB>pd%Im+Pt$qA8r(
ze~GrX^$(>Rxd$JIZ>Ga>E3kdIScx-kp6PSy16!A=54uQqjIq&qmKbrWuDgH&tAGVq
z9(4s0=H)HoTF@xFE`6+c4WS(jd_NV%-SyTGwQ>|pU}8Ma^k4am3QSF;Q1bK7KzF`W
zNVoRd%k3S=du&Pq+u)y*G^Mvwiagpf1Uy~0O|S1_(pwGt{4!@4qhb%^5F9WUgJJ8&
z>IpVMF$f%%YgE4Ux}E(AWO4i#A3}0&R&%<p`|DE{m8#Q^$Oktn{eeCOsWXfRZ2-ZB
z@P*MufmTy5#{wb>9mfBW^nGlTwv??fD12cdZYbws_P|-{6!Pv9u((gqHPlU7nK%!+
z4URVCpyasZ@JdUo)X2Tx;TKBB!JpagbVcz?KNW23Pept@tz}y2Z<r*?lQ#AT9Lcbf
zo`N3X7c>P|E->=GZ=cM<K|)?HPy^ZTAy`knYTf@5lJ)v=`Hk-G;v21bRI@inV~Mo8
z96lO97CCzx!?(}?{WO8UQUlVX4%&qbY5jC`FstmbszO>LBj?^bF+$`_XvN6nYs|Ol
z!6ZY3zNo(4zW?x5zWQoz3-=$^?|s<!G}aMLT9XMq*ctcY^|nc-1gz_4h5>;Xhx7$k
zUAzAXfZw=Bk{g!YE^QU9!Xyl3qPIVLT2^!0-#B9F*JWte9&2gXMLH*UxnE=*9}hA)
zD6#IPaF&U&#}j#Jc(c;W{MqPOIvah<#&s#f<EqDcT*SgT2QbaQ{(Eo$jMZ{W0ewCP
z{Sep6pwX<LqP(*j^=X`5Ursqya{5vB4fwf&1!!KRfPTm}9wCE+c;~X?Q}lUr%JX^6
zF8?#Ue=NMe-N}_c#e<}_Fi9*w$>D?7HZ0NM1z;tjkx}v3Z^3QnggHS7N1kLEBi6T-
zrDCP$nUyno%T6Vg>JOcQJK=CDH%J0w(tqt6W7H8*po7jUxAM!U)30B?TM#g!%@kI&
znEn#LVmH;eTHU3LWc|~QiX?U{U$>zc?W79_GbL{wpu|T1TjBsom)N$E(38B4n(C~m
zSUOg-i$@Qre*f9gC=DReM_&DM+O3>9wmlg<5f~i)Z+X4w<@II_eT_$S;)GEhE&7m?
zv$l)d_Dm=1sTshLakAKY(|vjG6Wd$HXjz6MoH-0{1V%UL{-cBAx_1BDuwp(b(ZhXi
zAeHwxNL%Zr*I`z+HP2gxylOozLf)YtVjc9sC!#mAH5P1Rfe<G`9zM~W5n+MEZ1<V$
zM>_Xb2DaYIR2LLsbXQF8bMjErgZK1LCen9-*#f&&OB}yZ(Db`|8$2L(w5Tz~JK2aL
z4Gkb{%j8!e_|L{x(V>xPXym!2SiC2V@m;aPZZqQqW?){GaYy-P#nAs&xsG1tI{olp
z;3dMg#4iiAmT+-(T=TbZd1e$MXMT~((^&Sjh%tTAN&UVZ*L#v9$*^g3%a2A@_&h-&
zA9Sb%*lCdL9K^I>M6Y3E$Q5<5b>u?m;(EoiS(Wfk5;zqJWZ)CJn1FyRvHn~1*r-q!
zX!!cBGC?5LpIimp8T<ya;+Pfj&P>blBWU#5uo#_7{9M=YL3b3(lSiVibYw0>Ucv$C
z=(cc*A;_pKA8P(;84WmCkcO|bGAUS=aJU<1`mJAT3d-5><|6d({my2<iJHJcz=^<^
zx*Ox;Y^ES)bODEX-#{c1ilwrOG5g%z!Xod>kkxL<R=L<Fg$0g5&^5Oo9(FjB(13*P
z&hqEIp>ab9u}mSDN!Mgx5V%ZF(-1;V5#2t$(IY~es;<>sP}=VjCbbeq-5eku-QVHK
z!}I%E{{(=e^niGkACx~f<j4xcM<PEUeos+~O#L{y>7LvS_+@k<Pt}Bi@rTuBSLPs+
zZUxC)-){r~GfXg;X1nqqpa8h6Z_fc=!sr|pMdNexUf2MXl|<JPM8&v2k455rY-Jys
zcTW>_>_szpXWH{O`Fp?f)CK{X`WR;h7CFA{(2xkd)&$PV?5IG!o0H|w_xElE({S!;
z?k5;w+&pW_ya}i6w$v?o17&L&Bz<P@4Sb}2x$%O~jBZ?)6`C~yYtwx2X$^93+vUz#
zd1IPgR3tv~02_3~1&e}$2bWpLe>$?k@RLEF*oeCEZOhca9cLq26QttJpSb{giYL(F
z&$gz}`1ca~w5K{sSFs`%rAb+7>~O?;!<a>9P~`uLehd&Hebok@GSr2p)xX51S(2fE
zP#+Qgju}2l6KA7~&h7|FvtJ&al>yg7%40*@jT&KrD&|15PKdetbvhqAfLFT?K>y6l
zUdad4+1|O#bJarQF^q}D=igEVfu~-rRK1m-*AluPVl8KL4h!c*gT+;#8;I-Ut1g`A
z{OW^P8KWn8+8;MN*Ld1XvN|jHr`d3w-`lgvfTV%<-D`z`Rtm%cfvt&1I%9!*FD7Xu
z^HRiW57TZxmb!e@UQ2^jg^3lMpcxlWy_R13n<P7Mz9^h49WM3`-Jv{4jyUd!EIaU!
z3`=hwmK!EF5{=y9`8j-5U0KN>e-K+uJNkyS{yyb%Nkwt<i{>2s%PL^+pr8JObBP6Y
z2nI`TPA7@FXyJ~Y%?o1@d1+9zJ*d7SGZZ-cI6Q7q??}3z6B=F!C>;Z>3D8>wnB@JG
ziCU%)oBw-QqP4Wb2z}%ml+nnxu;X2$k)xs>H;VO`)%=mlDi~@H@&-|5a{wtT0r(*#
zGa}uLD8F4mb_uolt2yvhR&#mQyl{3+e^0>A_GXXk%5-H%_<=w+sw6yC2W~XEqEZIb
z*??ARVH2?rr!6tt=<?UDUSO5TJVuS}yngh|A)E4DjW)iFM=4xiF+}!jz!xA7J52&I
zR{y@A89*Hp2P_4IKiMRQylS4fpA^hdWlRLCSPU3P`m3()(V(?*RY|?IJ4!3i{{_-<
z7#-b<jVl~7mHWc_hPhxb#)bR+$9hh+Un3W^a$5QfZJ^gV8f-xyNr=TW{<|x%WV`$?
zw}X%IHtuxqy{I<%$u$lbpPuBvOdj)pj_e8UBZ;5>b!#IJ4B+rQl4k*(A1Uj+Vd~Ua
z2F9M4E8`5Xu^d!D2<HjRu|mrBpn|>ds>kI(O5wfepfJukzIJ7~6`;en(ZG&N<Xj8v
zk|;so!jE#<tlef4w1-^(X-wZKww(@LuBlxPo+fl4TcRjP*0y+q#Ca&ko4*u`%1z-8
zhfs0h4csYv|2L~LMg!45z8+WY5%zuBdRd-SE_EzJf1AAYEaF)`RuakzmEaBFNnA(`
zEBAlT1V5%r$*G<r@L*e@I099#sLjiQ-KC(ljbbQ4aqTv<K!te$e5VYGpJOU-)|}{^
zI}sTD5|xNquw;D?FcnNe6(q`!E$7`S1_Rre85ruDx+JWeXAgu|@l@VQu8%*3$?eA3
z&+=I=EUiq97(d@h-s9={FMzvhll^xrfZ1(`=dRbl&?vm!q;#SC&-K3Dui9hIB8}&0
zwBHF=M^QvR#wfMPapL`bk6n9DRGm_yC6Dg228MU>z6AwG)gBGItu7KvB{jpr?i6qO
z=}JV~1m~zv_Lp56eZwT;G?;^=iR1LN|CdX<Kx9s?+U+;)QeN~Fb!;g)3Ai0pzE$nS
z9Eo~aP#yWGfW}`tjMh84)c|l3Fva~cDR8X#6Y5>^p}yRtw_gp|bLbA$UAvX+lpx+=
znk&!;u5Tq-r&{&{?>~F?4BWPkZI7lz+ys855!l~twh-}C{)9eL3@Jb+Aj!`a08DGk
zErc@FG(|G{=P_U!-{Ag^=-+t~@0JmEpOWb9$}LIaU^)J^P?)-_PhmbKzZUxcvGvta
zQGL<BGs7S$5-KSSB_)jrA}~sWfJh@9B8?y&GpKZ@BB=<9bW3*#N(x9LEl79GyfgUy
zy;$r0r)yp2-m}ln&n|?&8eS9R?#n9NbT<Q-P)^vgG_6zcvxs^L{+9jd>*k}<M!OHo
z|8iB8PKwb!I%XO-xlJz*Q($RgfGD(d;1=KRg*8=IXV;u$yP_WD<#H97hwG6!6D4({
z2%*ceuLC1oOhVx_#AB)-MQy@8&*hGtW@pDy7kOGl03%R7l~iWgo!-vpP-CIxQ1!lw
z506mz!reE9UyP~*=yOF*#Uuw_2+Iae=@?zbIU^w5Pi~kB^6ds(qz5t8o?w2nhqJAw
zcvZLp&s|rSkMA2g3t#C8#Z_Pl>NPtX1o$rkQ&8{;rL|t90R=<Bzr?5yTr4pjjyImH
z6pnu={9GcRHjQQe^Gx&=yhafup=$`^-+*ahD~tiveT6|1o9PYlRjY~po_gJ%HxW!t
zDX}#o#?9ha?Vz%Rfjdk^=T6876-r2$?7ut@E;XG~Ae17gXA<0WIfp$X;J#t1Ht$Ew
zM6vuiEGLm#c`>qRl?m%zb_(&51B{+eMf37K|C&+L2?+Y@D4-$FHoi~(=zbgK9#d=s
z<=+(hOA65-7>k&XOf7Z5BL`liIh?#5fEo+8|7joOCP<Dt?fj~h*gxwoDbTyA^1AEy
z`!M<qed+?9dC{NK3E#Odm=q8}9x@sHngcM-pseY}iFfg#QGC($@><Xx-!<?Dl$Wcw
zt}(|##=aACKBj-I{$!~8ww!%ya|QOf$IivBn7!BNh+3By5d}{fUKQ6}*L{2MX|ZAj
z$=mC$2BWY~7;;sg5-r`)os{8;6AqIkdxHPZdm*qWiSv>-hjx)UvardL-l>2gUxHY$
zOL;%0=Bb*y%02ZDdmLui=PHA;>24RXJ~OMcbLur2WRNSgtB!+U>Hb<d2|0BYcQ9SB
z&GCE{&55+7w2^2qyhaIK3waTLvk2@P=@*6#t?J07d7g66*Y0cnx>-#4e))sb-b}ED
z={@3!$5Z#m3azh+_Xbj_$SG`l%pG5GZYCvp-`U)}d696Q0qLQDR{V9S{_^&R0;R)x
zZiV{yTGVTpY-Z7jpJX{PR%zi<i>->7$F1FuAr}~dCjyZ79{J@Nph6U>0>t9CgBy!y
zLJlg^2D=DmuOl#jX+ClPq81oAmt#=&i+vZ?!XHcn`>ITJQHP?KsSb}5)MJd#Qm@)r
zaxiB_4-$s8l8N^^j&U|#3(QWlPOtu^pPiEF#Y;)^00%F$s9D7;0#FMvR^sYfw6U(+
zdlt4sCw%-tx9u?q;;=`XEliIc18JSJv%)H21FHA10Im6wO0?Eqj4A!a2Ut&ob=ETQ
z9x0^er~h|@Qwk_Y0LgIBP)4(ekO|o##vr$7W93SJeriR7r5~<hfd<;|G*`z2G*t<q
zB3qN}`|`ZA$(y40j6<}_L)y?j<O{arZKnvPwG+v6mpO;kThOl3!`x4)p3iYwb%i~^
z@|GH-k5>_&N$vVE^+X^^e%a-|6|26ti;?df&HWR`{z*HdGJqJaw71>?4$+|Ef9dps
z>4PY&rd;!%r{vejZ{X7DGf=NWwpa+uXm$=*C`nv>Jso+^wF`sNeHeduf%l=|CkhD0
z=;sp2oNUBAtQ!K!eE0Yd&It6tSc34G>-UzWEF>#LcDs9S*ZsIK9nowtvCNyX>$3zv
zK;$FP4M75(EkF6-RX@Zy(1YPIO9uh(3$4nUM7T#vg*4BESzg>E_!pi2^S&=}MEf<I
zYdDRjkEgcJ-+TyNb8|QZvj9F6P8mIN|EaR;0|E@z2Z%_PosdjxVQ{<}Bod2B-I@L}
z?Opl#CvCj2^yf5rHnhKlWlf2e91M9}l~P=7zTTLZwK(TCM>rXn0pY)o3sZtYmZOLv
z<kfz!xj>SqUXiOBDU9ou`Om1l0=N7#g<j0VkCVRQqi4MPS^T<e3Tni8Ke&Oy{)oej
zAOGUYr^GqZRL+~pni{)?j(NW)+^qI*6zs#?<q98Mwf%UL5{ysU#&8g{mv?TM`d{oH
z^?rct`29*j-ElB2JZz31)O_5i!(7&?rL(D@yNA*)(30WCI!K+VfT1RyfRh)urGBX6
z%o>uI2uU-z`l{Q>(7V%1z2a#B84CVjkV-tO@!IA!g6l*G)?3`OtDZ0WQQ_zxwRYI&
z=@&}>0x|LpTAoRL9Vi;CB<qg15;2DNWdP5KXSn-V{>$jIzzvnRQjXEbCmad1Pqdj%
zsm64JguC(nY~z3jACNnrHD>Vz2uqAOtYmAqjyPPr{u*fHg8sb0reM%A-KAKy{B96I
zk$LH{>@AfMj0zjNF6XmoOyR8Rg)0uaBZ93SswpdXS|!(x@4k^KnOiq$4IQ>E)7RKf
zefvh!U>AOi3CE=JrlvyA$C1TS;AX}+AlW93dy|Qi!r61}{Xxqgy0C)wiN4cA2gI_U
zeP>vqvR_{>ORwgi>zap=Yecd-9iZ&(!ERI>D1H>-hCN}sWF-rEOLQ;n$t|l@k)#T)
z0`|Qbkw?|qR+H*_){fLqo}hA;joZa9l#Un!P&y1z)Y7<fn!`%Tc4*y%wW>pZbY0a=
z48NXM!Sm>AiR9xtA`|QjCkmE$86m97)&Ja9WDQ{m^Q<WwGR&5GB5Z=sp9W%xPxXt>
zWzya>D@E09<EnMy)%|OE4`BK%NNKGk?{GKZnt9#=7=VB3pHHrd1))xD2#@K*;m(DD
z-JdDW0fyu(iGvnKe?pkzVz0rn6BCo;_E7}USBIkr<4ss`ZXGcDN)Sf@qYkQ2$lH#r
zzwrK{Z@-<_V{$)|7oB?~K3$QrNPEY$`%XFwR+bAgRAm1XSdRns(_{hzeA`da@A{~*
z$`PMix?v-tF(NQt<<T((MW!WQ1M)SuxVMfhIzi?h7NFqU3I8|=AqRg<2aWlz`BsXB
z6T|Cyt{dUbBXR#d7;huj$OOtCgn;uT<b27ixEtJ{jBJxpp!9M}ps(B0r5`kZ)3@?Z
zp5LMpv%cp?^kc8pQ32K!!rkr9@yDe668+kJR*1qR^NCvt7x>fUn+S`Fh;LpDA)peu
zl@e_P^|rgwvCovHSRq3B%d{bk;rrNI-K2XaC=nOTgWtm|*Urx_w<Z0nNErZ;<LtA^
zBVIrzQu6-M%rO32<>e;EJ+!EAcWdp_p0pY$E2UoTc%Z{S&U^{|N`Zf)*$!u{AVdrq
zNXqw#_ZYEZM%54O`Q5wC8^$%p9mStaaxbX;{k%?3S=Mx+;uJuO2)_bGv=NN-26M*|
z=u}7pci;8ZeUh1o0w_O%x+%Ij%Vp$fmEp^#8!shNUW*gsPEe_>f7%#5%JSv;M|}7N
z+bPlpSlR>Gl$Z#GD1LynAq3DY+HtLKDzFCYB2PAEObwEmstQbW?l^691g%4VhF^G@
zj5xEE-e9SM^IVY-ap(hWBZpN($Kk_0^OZ^Ek9&9Bb>bqAKgiB{H;po3U(DUVOLHKN
zVBXp0`Js+GX;TQ;pDU&Ea|G?T7ApDR3w|Gp<k)Vt7?$s;T$IlPY6+!3G-`^bz-u0&
zFQNJH78h}@juL<x+I6KG-%ix}4Lv*8OfQkXp?~g1ovS)CN<oUJ;PKPrqv&WtJHD9Z
z(0!#loXg_fIlBbS1~~17CMS2G4{L1wARs<BipTcqm~a|(<8>^?n>@GZNc<2RndaPx
zI$u&v*1oVgv%lb+?-=Qsac(DQDmn3jFKrq+KC_5b6*qW2S@qJw=pJvJz0%%(6d&s7
zW+*uqBilA6oLb4ar}^T3*kX)f-}KV%<z(f=y4q5?e)Ikjevm|x<GnwgIZrhR4XOZ^
zR7?sw_8)7@2Q|6gNm@r87bc(k7FOnF4LaCgIimE%_Hllav@)bfeq(k;3`WLz?oLgA
zn;C{2!FG;{mEQhMc)0xEQrswc<fK{Y0h1i{qWW2R5lUdU?XbNY6)N+~mg}&Hb=~-_
zy*x^MyA`F;TAlU%p`QbulRP-vWpI^U^3o+qfQ^jUoUJyVu31{-M-^lwr45iM*J`sp
znMR|pAx{-X7G=6obKBILD3?bM*UX)^AA`SO>$iXrbpCzS=i@uEup_kGCQrbY)BFy5
zHz$EuEuTC7iRPDgF9V5`RF46l3XsC*1g&Z4T0}4KA2Xt_SEP-8?UF3E<hDpemQoi8
zNyGD2B81!-9=|Q2n8Raq*Py-MzH8D+_3flFR6!7Sfg6G1;#X+W9h#$kn)HROy{n9;
z3`{(lO2(xa9&M+f1Co*43HFI24(0WN+-mk@vyVv^u514_aLyHCdE?grwGW5ybvoVV
zXnk5?Q=b^Ln-o#T^Jw`F!sdRYhuUi)aYp^O``Fl!qYM04@isJcAug+LvBK+;I5zRJ
z*(JTebF=KYD|yPi-#!R&WBoR$rla6NX~+zR)Yho@b)X%)=mM&xr%D4ic^t}Hp0$@9
z-&Qm*x!qydT&W_SXQY-j$>GmVnZk+LI-8LE^;qs<{OIEazYB2$I6HZa+>zKrqB8W?
z&J%&C&Z>~j@LM9|S_LC{8Y}*cTsBfB>Gr*A(GKio%I;#NIp7j<aVgH99uz!)#{DWV
z@}^WwSHY5Oo`%D_$+%$*>`Y)yvAHhN7ybS-mgVCV2T7RvO>tRSixm`qZRjY#W)K0>
zl!_g@3nf(^wLbfmQ}>_PY2!}}ZrEgvsP;Mlg#0ps@wa2e5ulxE2(FYZMB<GqIH#vC
z%yrb`LrblzUA4CzSJz_I@2KiUaX0)h6r(=WuLSapf;2niHl)u1e*_8&Wr%;YK@k6{
z(=To@V$9`5hX*hrbwMoCQZubOT@EDa8Vw`ENs&@i+^5UzROdd}gvJjUwalmAE-oKA
z3SOVNrs#DaeDp0!G-7FQGViimjmG^2><8*U5+j`72#Q}Fn(rIGzAbKkU&B|}MTg95
znu2i~S852LD})N1ENaG&t}p%=UPV^mqH3`xl$62iv^h+7BBO;V+uJoWQbO3l@7AV2
zEf~)SC@XLYLz)z*>7KZjWu$2RP%^pJIeXr?FtO4YxQY@I>5abT_w6XU7!^ziDLmcO
zklrf2kPCHCViSXx(%ixB(a+s4HC)i>LNMQc*c^unF2GEhldsH#B{Vv_{4I(-i@x|Y
zZw25j*IV@PfanpF1jq_`_;1J;Jl;M?d`@DZ;89FJdtJ8KsBYLep34{o(72+L1>SCi
zvQ9GYT%|I|z4HUYnL^jiJ?zm*2?es6u&g_(!kZ@}yz-&3MY@*}@3`CVi)7&n3n)Wh
zVR>jA2CmbS@a*TZjtsU|jUOKHZnRe<ZE!bzWX3YTSE05;aRfCg>*I5ajqHj>CAfTC
zkruMUWuTj6U17@WuY2T#5|$i_=J+~gyzrf$^%T1t-rP$PxUy83o(0XE_<m8_JW2&(
z{xz?yYdBK2!PzL0*seEui2{>>Z!2fHf)ycEc4=Sej_k{2p&?C*co38zj(!67K+8lS
zW4YpAlE(~~-(ExFMnl|&`)Ni-1rIN2VJ3W!z@o&=DqQh(m9H1BA18uJ3}AgV+kMk#
z$&(H5zSVB;-qm_j7v!B$T4VqFbLb)AcTakKKU@Su;{^+K=j$+f9v#Yz5FeEj^Y>Xt
z@r3;}X(o48NLlgN9p~+f!dlgbSN+b$F%1B7X`ow35#Luh8kisV{qX&}7?xY>w`@P8
zKhbjV=ofp;3*3XCCMybgg%x6Kk<I#PJ!r_0x76DtaqYG@)+DPHB#L46xa`36&f+le
zHcQo!c{BbdQiqEbkAIb`uh!LA%KW`V&T=5F1Xr{`9{42lf^S7Y^#`w+Bi{(#SgW5?
zMDs;%h7RaS47ai0p&#)j7PQ=ruYIa=-d1q^H?EKpWRHM+n0)kN0u*^j>Flb^-|$u3
z*a;q={;4xk)M{B`jJ%ka!R6`?%f`|{9HF;@KsBuMmS^jg8ylAPGEGbcX>Mx6C1nrs
zcfWnvab5eOPZj@aGWLQ+PaXgk^=tl~0&dbW33*&#F%-Eak?@IsS@O`K*H!rU*B^O=
zxlrCHNYn@JwkpN~>L0i6=zyFtIIJwP{KY^Ud#Oq~hdjiKZ}Ba+H(5&O?BhtC%m(!A
z%ZY6BqfZtVK5MJ<dzdQdE)YC$mVS?6{)^?d$R)zBdEFCF#<^+K`@B0c+<FrSLSP3@
zkJUsqu2Fqq*h$UeLj2PZ9Yi4?_%BU;WYFBEKD|E?1leqK5uk0|E!yigmi+Q3dNOVi
z(pe|-SObT>$2863YEkB&&*3r!@)3{+SXFjxp$&h2s)y)_6rnveGgZ=NnC+vZefWZ?
zWkkn2wQR&l^<7zUd050R{y;EVgOWxW<d+e0q;(3nO6K@4Su8Tdoofqd=j)B0ln*W)
zuq8nmwoA{zCO_cbg+u&wI$Js~%0hSo=vDf>=lvZ@XY;5G)-=1$P%w!*DWlc4vH}UL
zqvDpbi=T-JFRWJ#XnQ8`6kKBT^=n%Sp+H`bXeKOPPM8{~DK>lPrIMRMFi#rg>E<7a
zBQ=>ixTRq04kz%!2uOf+qgkz1focQO$=Ra$eUqRa6iY}x$Ik4U<pbZQrbO0Qh)$ch
zXQbh)SP1JDl^GS_%%E6w#5_&k4VOAa**Eed4QgPDjzNk798##|06*|xTa$K=J0I^M
zaXg*Kh(3%JAH03cj*}}fGAJD+N+x>dA5|PTlp89oRdQCI{yxtL>@aD%u6D?S9rS*_
z88T{;4?FH%vy}NXs!zPd_#gfyO4xPe7a?evb4lD(x+$lmF!U;#$Fq76%{x1h(HJOa
zaX}0L8eIAt;CZ-8w#TrISA9$GsD8(Lt?|jK?oNGP@><!oh->&0AV&&`+53J~>J=e+
zR1VfPDobqnFD0xf4W%u6u2>_*r9j)TD51#6V{%1i?RuI!iOw~Y%Gli8o-n`8MWPE_
z?o}wolmC()cj3m8jeopUUAsm1Z4~`ALm)K4J5J^STV@I7p;wp`U0@+z6&5s}zebN3
zakq_&m|u`W6$+9c66r}H!U-$$2UBvcZA9dj)Gr&~RWoeXuxs7KIj2o_I0ZvTA_a^p
z&2yNeW3SfFPaIiYXK0<JQYRKcScI9$Gqw|In=L52*V?oqM4Vq78W)*v9^8*t*gS-j
zV=z9MBPL>~3y+-sIXef^Wkb+5c+q^jbN(l^YcJXj+vu2<!bDQ3lYm`Ltgaq)5IUmK
zT~Gk*qL^8W1B8sy>u}2^<%y8Gqj`(!(Q@697DG4l&poUW=go>?*3UFQ%uAPgv2b>G
z0RY0>JW)X&>{+<DILi<;C&q>0!(;_jTQZ)u@Zgsv+N!^HWu^B<2t^XHGW`n*fT_IY
zaQ2O*XAOv*Wq8wMd|>X=-}+V`RK_(o(TF?rvKqf16=t+4_iLP87A1>th1t*B0=fDI
zT@?1nZnI}LcK|=4Xv#)tnyTgwjk)C?%q6aVtD*2(;A&477WHW$0wX|Lm*{Gt64`1P
zoN<wRFb2YnEb7{+0pv+$hHR@j{UjEjZxL>AFC(AscwR{On^$M}3J1pR9q-J;4-ioN
znmhyJ0epo7&EB*}R|JoGVwjk=F!LHh*rIto2XUi-!$!4DX_PK_!UmTFE#HH$0U!r-
zUB_&epX630-K0BsI6JAGwV$2pqWSqdz0>KTSjEHF9co97;-O-X$8MOCi0X#IWBv~A
z(8gZ>kFy445CaQ>I-M5f3$Pehp>*l|a%ya?fEI7W=9At#qt2ldpKR@(2xHBe#~2RG
zbZ2q+6I(wu47ju;Pp5G%Z3VoLThn1|yUQy+W>d}L(Y?h4(NHo}zIS*(XVxuNXjEXV
z$%UuaKoz4j3tAz99}<`FQln<KJEKs_mB$lhBZYQ(qCbBoy#0q_f+`QtmhrC8R1WaS
zr3bU!iGuvxXE(C5db~`qm%BVaz3g9VTihl0+T8x~&JYm_7mJmJAs;6wLM*|k|EBr(
z3pkCcm{|n3JWG;^fVgyt@xAjGDxCk*{8&IwBuA@0_b1c*{BE|vy4+i+C~(LJPEq7n
zGyWCKfo7j+{Cu2bWD<T==X8>0x)!sH8qs`u-DQeqb?^o#8OxG=mLT)6kRW>DthsMT
z{6gSBqXmQ3j@+^I(MkF{_Exbv?1=3(&NZFeQB&IwE_X}+h5l2ge1LL_x~O7NKu158
z*}|5L-3pI1u9_vPSX;lM;ggqTUnb)xI9jqIzHYH3$BP9JLTd2`G(a)|s>!DGpQjEc
zEI+3WZl&S9WSG|2s9dshrLQq!&g`T6*0vQVHbba)Qa>X97Cx?<4V3s$WI_>cMlGPZ
zfM_qU>6>+A=`fXn+)#%n2Xl+6z7@qa_7=lvWtTse3#yFlT!{ZPVhtf%$CKQ|d+Hrq
zcop^;FUL10`5r^;<&MvigpSj!F=r}<rzkX429T+b!AKVWoKN!kL^x9H1vG8Eu$#QI
zwCSU4(rf2IA%RgHf5d#8aki$R#1|oVsq`vh>;_`>FB$pF5%j^+Xxp|PoISkAT+oIu
zA`MXzw5CGnMog<e12prCY95N7DXr?ql<v)+x*mJC<?x!;G`4|Hhg8PZ<tg8NISdTI
z3R6H4$c8>xxeeOf%esE~Ua!5g$UJw$Z=$hP$H-9LC4}f;Ha1oI@BWb&&R~GRgItjm
zdT1y~TWBWKK~`G%K2cw%_le`k3(dZ7bA10G3J!pbeJnH4;{nezQaHQn?i75$inQG3
zU+wbcc>UE?l^&cc#MO^GlvQaY!Tjn$PKnFa9tg`fB7_v{XlKn{?zcM7DFW0^7@D+I
zY-0%`_Q=btXLl|id!IaaqBl2Ca9%3Q#XI-x4gV;aZ-P2b(IDJ#{9nUo76{nbTglYS
zV^nzL`%$k%q+E*L;bsSON4pP(-P?<Q6I){!ew8b$*q%R87WSf&^zSFhIXAaCl79yj
z4R{sb(!A`c8|3tsfK7GwW_tde$O+9w7daz4ewvV(CE%%nGy^m4jK!LIz>Wf%IJ<6c
z+ZCKs@lqSftzZ{l7UeLvFTOHGuDY{4y54WRfFI&PfMi2Y1w8vUoK=5Jv4v}WWOJs0
z30)6=uhU`2AVA$o73B77OZ|^z*5oIa^`*nAyu3grtob!34%Sn%jg~&#Wg};B-lEfI
zFIMo@`;_F>4l2Vc8d9lSsp9iCu5`=3%Odtryrf@ki7x~w(Hf9fXSrL`xHoOlL6458
zG8#yS9~W;hkyO0EQ_uVLz+KL#dRYF^<=nGQ&m&yv-y)8LJ7nhjfP^)&v(|i9drk)?
zA_d<hxI4Yta=#g2$Y^(mz~ru5f0r!cWzN8QDyZ|&2@vCGn$7E?!&y*JE%w!#8l6gg
z+WSuQg~`hn)RSv3rMVKG<Wc+k-Y13q6K8LnIQvnTyaeCY$v(T3FlPK?xx%{dS%Eck
zd7>Gd6ESA|w_oYiWrSna&!AXH=enbR2F_Kgk(q5;K)g5KehuA}PQnDgl^Su*4+{A5
zd8qH__H=-{$MQkl#S-DYmjG|~zMnXXo1cFf8e(g3z97-VUgUjKOJ@XQ(oK6Cs?i%#
zp2Qtmph;^a+s;PW<jw*u?oJSgKHiNt$LUb{5VVYOl6yc{QChe?!%3r=+t#<H<O!<#
zR=TKJy0S{Pw?`m;kNJPj!s4vzyIMgspGT!Q@}m2h8>J|eUpow2e>ovmpN#F2R;jk>
zPR+W13(<cn$)7?o$awqQqUSB~_wL$QH~Mk8l+{TtZtVFg;WW6BOdfC}{nsMu2*Kss
z64mW2Jub*?nBepi&lqxgxg&ieXhc2j5Q{+Ori!J+r9vpwx;7x!Qa^t7in-9tF-RxE
zkP&_YSjhtCEWYsw-N?C={K9c*DCRN#Q%%%L#}rM#wAO3g3*);%N#00#p~pzsp`g;1
zM?z!3(^1FA_Ig8#Afa=$77v!dhh_Urm~s|zP3oc$vVqE3M@}zsc&Ge{pqTs12S$BU
z_WSiLb)X0YIM4Cm4x)%+Ou(axV8$9|4O83a<-bdm^=?yvH-j*ZC);iS%leBw7GiZT
zV0i|C5s8Awq(agT8K2`f09YL-BBZc}g)ld6+raD0SZ}Va;i8G>_0DrSx{@7M$J#ha
zq@e*m?4_XeJGhz^-T<Di_f^sb6=@pX5>N`qL0gg^w0)&Iae4)oZ3ko`NYZ}>1wdyU
z&Zd=UtjRia>|eEJ9{a_c#1f;GSjFoE|Duv5Lbf@}CGK8gT$BdpNc`oxoqlK4CsOE*
zWM5jRHHSSR$6Z75<e_AVX@4Vm9>70yvT;<IyVI?DTcAT2rz*23x_kuiXtb}au6jfc
z>_+}bYoClPas<pHT*?s1*$9%Qpd<vi#x(?<DDb=^RsY6vdhh6(@i)<R@q&H*f{6SN
zeK|X*nBHbZh{jpGBE+lrA6VIs2h%&>)XFR{2<9@C<ouPCvonL&TgL{t1O#D_{{Mn7
z6GGqhR`q4={Wf6>zM5Y@H|j54LL<V$x-c_uP7lv+mWG(Y=o)2Vit%xZ5F+^-aW@ZA
znVkUHK`Rhq_S-mW-9B?zs$-<$(OO@%??&$)M(doyWN`v_GcmTXP-(8=M9W1WD~hwv
zi4xR@>jYkWdZpOM;^NA{GD(ww^~|TIQ>ZSNufv+RB+8__iV*w*u~%Twf%E6IvN6ot
zjpN~|6F;bTCFZFtd`26+EuQ7X@x{!sgC7-A1P&<eUlAN)G8;*R*lT<=!;@}%_Y_L#
z^rpn!l`iA^T5*~PHnK5spbP|jo)VPEaIr8&h^|Z?Xrdk<v#J1wVekQ1W~u%lzx>OX
z@7{!3?eSCB`6Ac(s>&H3BQtrk3uFJ65*Yhhzs`5yvKbI)2kdu8xBP`b_m<s#+N`|@
zmyuT_9BQX`68Px1&%!@)vsR15h(jR(7cq8}8j=NTW!P?k{#D{_x);_eXuL<~9o3B;
z__mV*2xSAhxR3_kFZTgYh}{gZ4zCvQ<w%(A5ub0kMz{S(p!B#h$oIR-r{gtptsj=)
z2<F;y_uMY0TCySE`9!*b00Y>XfpfFlNj9vckw!0<QTM$tjiZ5QAG{aCE3WD!YXdI_
zl$24;ei@Kqou>wb8<a=ZVI^#-YB9<BCdXyJR*Fayzh+t-dQOO^SKjp~kYXw6R^%i2
zeuH~@Gjo^j%7sz}SFVH@Ip5Y_zEy{LqLv)lWw)NB#!N9=@hku2E%jU{?wS$xI14e|
zVD<z2kMR|lsP|>7>XUMzcW=-tLFx!~g{#%^7uoh6!9BSI6k*}h)pSMlO*J7()0Ntc
z%Rm(a0KFu;n^`5d*yno#?^ktmim|iTGkQAGC)C%@O9tMmMXAT>;>@cA5bD8cnS5N%
zJByI!+L)3>eY|pT+}<X<6vL7Cn`wXQx0eZ<t{^<5T?Ta4+@{3quwu(cq*d;KAt-2g
z6cRDLe}&6}{QgKwjK0kErfZ99+Sjy7@DPbuR>UF>f`6<GG8GB#q<KINLE^M>ZRQc*
z!(l9A<yq@E>O8XFR~`O-Uv~KhZT%ga6(E2Mu&*gpNboM<5}&p0uREGJDG=ZWBXABU
zuK(0Y&_xCO-f`Evg8h73+n5Wx_rO9+tT+uklyx7xXkf*<G7cUThd!MxtNt>2iv>2z
zP={GA7sMC&No{mzAT+r2_Z7PY&SP`J7#hNF1PD16s3q6`l)2GUk@Gi>ydQG^L07R_
zJ&E~VmGS0>wu1XzFAzC^#BYon&?A=h1o|jS8V#7<>E>qAPj>$AMqT2EQ_fD(17U_X
zvd_y?(n4}SoV5~~7SlX%$1ip<b|-k|CaW(<`5#Vi`Z;2#{jRm4rcITZ%LWxl*Voq7
zH)Kg~SyND4M7_ln<kA%XLdfW*rJ?kw4>nd=w2OO0A<k5KwKkMD#C$HVx<p=)hlS);
zSzMhJLi4#U;q-%$DzXLp{z&4JHolVOp$H3PN3H_%xZ?ZQ+=qv^c+|lKAb?BYNlu%N
zvlYBhOPj&dzU0ul;Th|4kFlYRTURHZ|Al3m!A<L)n&bcB#4K5IP@0m&70SZ8;vmPQ
ztkB1&^w#a*P2TFr1Z?WrKn>&KI+I@3vV$e2RO^|8VYPeN@G0FE8Sc_RF*OLpq+O?R
z6PIY<nN_QSsORr#j*V%L-}TMy=MP@`QW&(;*Z%JC{WW$Ipu9*|Xy9`UP%X@+Ogk0s
zMirWDtP`K}-bys6=q*U{)g5xx!YFLMX}TWYv_ek)Jmx|(2+7P2S96f4Un;{YeSD=7
z>$2H$@?#7U5%$8m@ji8!oUC#j)hru}0R@!YO-eh|9rE8S02ZhgArIO&r~^$yg_}(f
zK?apRIFq2Kt0;&xC>=k4_ruFWOI24P81@82z5-!DBn86idqv|fz<}Y!ic%)I0%4tM
z{aZ&&!Iva%PNQrdf7pCl?p2>x*&oXq3R7f^->t6|27P+qEV-=x>4J}VKc4BPPehgn
zQe+leb!+1Kct$aw3On_fafS(0fg$hM>==N@CBd$Q#uMpj&9{1!l7aSE-HMSnz6ENt
z_V=PRj!}dsa5WCfrnLolNafZIS@>tdB*<|D4g6ml7@W}a5?;E_aK9@yx@8>u3}x+a
zzP>AQ^3Hq-OR<6yjfKl61D8R*`f$vhvWqf6oDGvQ!*pll;e%u8%L5LVj2WWLg8#^9
zY%MCXK;k+V&ddti|M|t2h}x!65ni75v{|;GIP%l??zXR^A9pgE$*dBA4Isny&IHSM
z@B?a+zQ*C8{;drJg~>f$>gTGUh?7c|kKav+VG=J_H_7oGIxd!J0OG+46=lARD^2KA
zMBm!yTm!UrCWM)<?Tx=zyT3B#W&QKU?InMOAD`KWYxE`BvX3-yX20te&|E?jZuw%k
zd-Krt@=<vb*z!GDpU}DNS4lPe@Nxpm@z~>|Nq}PW<2YJ`*HzYkLJkV%E&sN*aByN%
z^!_&fj?7J)1N%jFH?w)Y^lH=Afs*%>43PcnbFSZTq3{#PkKhTY{X!4b=wa^VtR@WJ
zYpe-+Jen7x`MCL(4y)N4nMDdB)0~M~JiSnOh;HMY;PJ!j6P<T292!YD<<!hkFUuO%
zxaUrzt)#HYbfM#yLt`hGpS1)uCLq`V8^7rwL6vr60+cjlFkN*iyLV=8#Kzco#c`2H
zw-k>2S4SN#zAzRF5+x-vPU1!|@xU++7A_BI!UfPYmtbiXSUt&{)gw&}@v<-r)phOo
z%NoJ&lkLF(FfeO14%GbqH}r!vuBrF<v*9m~%{$5_2QC{*uQBR!vAeQ&vi-fkr~iTc
z#5W}9Zsd@~Tft6%zAkyR#q>*@PYFUGD)L3?(O%jKQa_&4v#Eoh(<F<oiQ4;`BtPzt
zMju{0<4>7MU64`k#g8+R7s2SUjw`7$R^NJ0zsuQ+K?`$5Zd*`_^fS2dwp+J?W%0Yb
zF1&MaYO)}76IcDy3S(aH$`Ag|?*q)DDi?mQn1D80#aTgIor~c8Z3`e3=j^jmNA`}=
zGbcg5&4!QOAM<f$EkEgw6j#wNSd)xJ@XmERN75d@QiRmv(U*YzWt$%79d!sCCH9ig
zp%&Q0vW5aP=O;s6yLp(mH3h5gOis^VtnvCArvalIh%>q^YG#Q*zaeMOay~uS)cUof
zZa1HU_#7!gvVD1uj=hrc{J};fJcbjJ%nq8DSZC{S?VjpHrhnsplk5fujy6(?*T31#
z+Apb_s2fOqnH_(jqvWG;0$0>GW=^Rn3H8|jqU&(pnd_^Bl73y)lkP4YGZ)6E^{yLr
zrM3u9H~KdtB@rZCg@LFTcms@&m$QLvdCLO-%7g_{o~O`oVw4Yk>*QEve2~}v!wH4C
zG?)5M^7nAH`Fkg+yf?u{GBnwj(V{w$>ruJS*C%g@V1$+FX?Q^K)DWaUc!Mfe|0#hW
zg-0bZaDbS;?p_Dfo#MzWiBVe15d{J3fHIFsz8yDqYWX`4;8M#V@clwV+WDMB5tjl2
znd%<hOW~JXv-kXFb4VuU)C)IzeQ*CmVkv-d>SH05R7Axyq3{(Ic26ptu!`Lcs9ZLY
zd;ffm(AwZ<I_9#`7PVUMna%!+?jo)TP7!g6BmKFQB?+#ZG~}@HEzhZ_ee>>S?}KCh
zc|(mJVzsN@*we{jA(<{_4KVxF)l2mW=|y7WV<OV0BgD=+R_5u1O@&SQ7+;i6tyoV5
z)@EI7Bpifx{NShislS8G+&C8}WTyx-HN&f#Z=W9eZr}>SY>3^Yn#(tO0wYOmTr^D`
zPLkkf)RMITkGVl(>47Fz>)wF;3#Nr&<{1%JXn5YA>3&GXT(<k^J8gf9bAL4*<n$0$
zMjfj-CQAn5=69)g0+{i8=qBx>cUA74svkL+>(hcD9>k}&!yA*W`r&cLF`zI!f3bpw
zAP(<e>j2_1+<a5IgNqZZ>WQ)I*6isR?a8B$ZyrM_ElOYZYrBh6sY&41UoH040@d<@
z(Ei^3(x4~%ky>3{s_-f;=ewc%E3%80E2!XsCPolv=*K|&8n16kvp`b;{4!0iH|1%8
zy9{7BPd`#W;nME0-M?)&d1J;k<A=IjPj)W<C=tkfg4@VUn@?uI{lhd9KAF06n8+h$
z*GHQTrl4QdVCKXEpBw43l%B!?;O@KE+h^A5`1>yKTGM`b8?2vC<Ku9Uwzul?E5H4R
zT0=~khtdJ93P39i;HF3nY@jOB;g{5!jI@m%{-#;qoA7=R+<aPMvK!d-Wv7X!gLqOs
zbAJ5}mFG)Ni03ckaCl6)K@ri+A?l6w#kU2+<9;jna3fc+l_oBYFBh_RpGZ^}3=%X<
zuKq6YvbnGgR|DEI;&YYDa2e-Tnb~X}-FuD362B`9hPvO{6#Te)h6z$zyn0yjodNVX
zP?dr#SsBp<Gl89k`R8{GzU5@Q(LlHjPV-{lJdxJ@Wz{`+-;H<^=Kv}LmqyX5s`xRR
zz+HGc=iAcAN$DmX)SKNcOx9xj{nth*w3v(yCg@dv;ptE~xn1M}{PTSnNO9JjMpm!}
zFtZ`LQEDz7w!<Mi2Z4`rCkk}dJElXsPc*T6+TPgU;=VC9K&mXN%)X_SzelRz-xie4
zO#U?j+JfxXd-;RjBhS)?2%+SDaTJiw*Avl2Oc7w_EK)jTmk}KH3QOjVq_bK`XV~_n
zi&1dJC(O4zRo~R1Z?E2N-@8DKOyNz6?h^E>AS*JvRJf2=y?w{-n(^L))3mMGRJ+g5
zB1paw%-jk767YIT?Lk9QDum@}>;BSe1YGQ@jQ?Apj=SJ>o-@*mELq$k5Iv%DZ0_ew
zC+X*(DxycVFwqZ_OmM~aI)F$tBk5MPiimZ%yN6`{UdHqB)POTl=>39^TMyc9E8E*_
z*5U2HDr73cz8PbSmJxMKSWY#%2=zdfzW}C-{Iz%+3)dh2g`b5Pqx69#b0hovDW!<e
z3vCL<f`d1FB_PBZ(7kl@X|}a%#SNc9C()wrag?-E&ht@Ua_5Q0>7mW$8?s};SN-o$
zBHJ88;m>B-Tw!|<F@Dg(i~tcuG%KY1%edhYEluKb*0aMA&yA4-pQ0YlwtwNjGe5A+
z8|*EkfV7eTKbxgDKIptROrzV79tfQ+cO|ok9hp1+blCXm$j9S(Y+E}y;s$3dWaq9@
zeY+YyDKKxqrwd`l3ii$lw$)&BZhN<T>A_~TH2XA;H*eYj=2kTQ3UCAg!}D(=G00V-
zTY0<fLxEe;yNL}~#n1BtpooYMb*&Amw`kd8IFG;(I#HLa+fNSW<2uDCky5REz0U~B
z#@S+|VCkfsk1%*Myv>ke)AJUmz(A0!<KfpC0t;+Ia56n817f4SJ$$<dFd22k0cJG3
zTD~_ua1KSLw4kC^3md_7elh!?KqeVt=9sznkp^ZN48a9Q#;&&=BVMAwFGQ(lN?Od`
zC9775950o3c(%CydGJ^I30$6@jz0QIGA^0~O%?!Ux#*(=^9xFLil(KezYq647{Ee3
z&-e`-IDWVMu0;J={gO3$vt)LXo(QqbPMJxRYnZMnCVkh!KOQchiY8@pp%E0a)!z0y
z<$8_j(_QW18REcxgv}#`C?mzVL@)5k>9^<*n+vtv?*r>=6Poz=ZCTB<0?YN<UafVT
zi3eNXD8AVb=IXqTstt?b%X#Ycm*&#ezfzYdSrD~<SYWlXr&1X9dfM*&bl<XixMdvG
zL3bmR8=y370?Ig7U%CEAWn2@4$i9B>MRkImf7SC77vn!pFX0|SA^H4;bTxLDehJop
zbsKztqkSf|iRc?qab$`T*sDZY=PMrpzxcYXw-;gSnEVrsUO)WSu63QO7&8GQL$2?<
zB8<C2XCSc#;tmnOW%4zrW1f^NR|2H5nca(tJO<0Xb5YijqWFZ4TA0&UsA3NaT!{48
zvV)>MLmc}05(p2QC<xn_F$TdpV{UoF@2HPXsciE{1bG;Lhn-!3vk}*EKb+S%W<a?j
zfkPVUF%rF}+@37X&4*3vr?Nd`aVr70WYiFU7SxWgQ;KNb@+U0NmZ&a1dDw+(2KLFb
zMMch3bW{qI+b{a<^4$Hjtb1M8y}NIwDFoM_3xd2YF;HtV`<!!I82qmj;oPqGBrVF&
zRi4N70gvRLRAIfQZ$cn=cYGuBuost;`s{2f0Ze|>!_4}FnQt2(ZW~%MDOrx@7m4zH
z&RyxEUZlo31g3CYITc(YP4#AgKjkk?+sV<T)67ki-qUSL^fuyW$#$$L+W(*pvYGhe
z1qUTEqm3vOtPjLTp1HF$^jNnc{#An>lH(lLO32Tw)N?!>H_4nXt}kIaQVOSRr*@w=
z0A&UE795if!Uzj?0#=(L4YDU*;J@*w?u$>hfl5Yup8m6Q@l=H+)N!Yf3!D;PI@v2u
zVQHPQIs-=k5EgthGp+p|rRjlQb4<yc-4h=$bK>?DzZ+n;0gxH_RFHa#6uX3D+RQb$
z)Y%LFBJZ67acZO2nFo#q`(sZn!=oIh3$uE^<4fo;@d{u00IjnL*$#mer>rYN2&x!a
zp+Z9`!0FlxL^Jtd(i~_j!lx{f45u;g=yx|Bt}pQT<wBe;E<#2gboK=0%ZxElD&htF
zIyK=u<|b8Bh)vlqXAHKzb7>KDF59eR-XFaWpcQhNre;=g>6Mdh47jyi1fm9Im|7Wf
zW1_tV>yXCpxSIUUp~CM~iA?SayAE)|LE#th&ng%#{FD$RaQ_Xz<CE!*7smKl{DrEX
z-W3}yi6WUGjP?6dZ{tqOa|I5{*@jfeP6I>e*32&P_9gHR8}?aRQn-P3nl(y={ti>Y
zX2ad*rz8?52C0&41;bD4akd>KYr$K_3(eXU5h?KE^$d;S^Em4kBFl5>SNT}s{-wFJ
zS*m)z6kdyhS~cWVUvV;dXxHunnCaX_g7Z-Wk$=yrr<m3-&qY#4dK8(<CijfOyHPsc
zvHQ661S=Gzl1g;-I4HXW0*1SvblyDcuB|A2Bf0KJl6ptj?AfkE0blE7i{V=JOe&(x
z?KN^%WGWQ`sfOnLl~W=NsS5im<zgHQFGV8l(Z&*RPC`ka37e`}VvJKQRdsf9ib;Y4
z<iEsq6b@5WfOi%FmYP%t3MX*8o+0U^&vvoTc3ruDn>Yj(B0V{9xPfKqix7n#dv)2f
zJ!er8L0b1T^{QK!9~bYl3E0BNH7^;g=ihb|9<-erwRJk1%nhr_`3jc1_+PQdRRZba
zs{ZoCyaXv}jKJvP&E*;Q(gnI@`-KLkoe8;*XFQ<K2p}ehRoh)j9MVxRsbrb_E~T!+
z5V*6%x*}S^KZ6OUx9MOXPCHMeF{iA58|S=EsK$qOPiuYF0<WCw-`Hel?dUI0zI*}T
z`r{A^X`5YRHi1caghO?%&a5i^dQQpHUAU;j0cY-Ik53*IZY=vu5pdJ1NZsunbG8_K
z*!DO|W2a<;Ny9R+|Lrhm(dbiqVKCo4kkRr6koEsPS2r3A+%T;@y1e-KYW<bpm^Xgv
zlK7)PLJ{R9P_#Tc;>BEM-q`W`6+tcdeaIyVloA_Sl?8evL-*ne;NpHwaQ@{s;?LT`
zdn{wio9;C0{)O*7bUU%@wq>90EVo~16<M6IWx4U=X&jOtRM|?UX!`sxFR<^s|3bn#
zl?$o6D`%3`JEF29<Gl{bes=JH8}0R4w2A2|4d@JZra~Xim<{RGFO?hY8)_xrFtJ*}
zIv<KZ0sChA6@cm6qY!nHgSCR~FW4o`jZ%_xlJucX8T!6EtWW4VDoa)USo%xo{;+HS
z#~BwPUD>5{C&;A8R6lQ;h(R(Dy><WF=-N=gx`wUE7;XGOvU)J5Q+`LVvkm3<mv|ai
zl-NboWvg<bnL$M5G<{pN|5K{=r`SCw$_Y%Q#3HFARzacL$(^u^l%0SQk9&+;z>AmS
zA{W>y1Hpb;Y`kp`8L`!FMjaTf$*ql)rKm5dhmQR#vsBDf!39d}F?FOw5n!U_u{Ub^
z;lig6o1^k32MH<dE$gM1V{3?z&)_ueCUVphx1<poq#zZh!9ke`Q-Nr|<a@c4t!P>d
z3|?QecSJwdd*#o}D+<$wn&FeYikz`JmvuQy*hL-y#2`4!R3jHR${av(0dzH!w1<As
zE#z_=K^`Ag#JXW0VHTN4h+c%EJu%seZ0KjiI|lxy-vU12%qlHMruN4QM|p0;$l?Q3
zj@Fkn%p!e3L{-@E1rqUpN(#W9nD3JMpO>v0RL52xH-Gj(3a2;(Qs_8@2Z32?Mr??%
z1~Gyj&)3T{dZ{r}P;N1<iy~aGLXF=J`~IvdVXB1=E!Q{NxU_tZe_OloX{83hn}Esw
z_!dNBTpJ8Jk?=uf$X#l-%F-fx=MLm{XV3HHNt#Ls2*V5{9B5WS=9^9U&0jKvTm(b}
z-o^>izooL7X@~rUC316(H`<~cj%&WA@h7<_o=A=zzWV3gX7<1-1;6yXxhU=rN<`+L
zq2`>f(VG<YeNJi!b9l#RR=-5_7XEd8rr6!vV4PjKL5zfBOO^%7z&Ni6(YthaGdufB
zJ^^qL<|zcse+?DdhAj>Cem<@kPiv>vp>~&cj!ecfMI)pEA`d#PSYwVf$qspO;~h+2
z5PiRo|HKAtTvTuN5ymURa-}NymSpt=@@_IgldBh~Id0mEFNj+UgC<u{k{wcyHSZt#
zVii${-&=60yTDjXeCqX1pGd~oALS9y$c?bTY4j2@3pXVY9F7bp4jv`>^Cw_>j_XdJ
zel=Fde;>bRAJM}2VmYGwd{Z8l*$gV1NYnvaQHqdezXap}nUICX&oh{4I@$DEtH_#p
z`y>4)AxS@vet3J^^}fTw<;Vk~e#k%YAkzsxseNSNq21szm=-v+pYQHXssbsNkto9)
z7EpO+jS{jMqmsY1amKX0?{dZY=X;c%KNP9W$i|v%({DG@tY6Ep)!A2|ImwugvcM%@
zf&#!zxAunvIBhQg<YDYKeNP`YFs3nuzuathSEYXNsr$w0Ay{p?Z3+{BA@Hpjh%(zx
zqd{^k*u7a1O&~lk!6pE<R=J_BY)crd%QjRm-IFvK+Y#;bKe%3XPH#H1H3BZ-|H@rN
zsn0Hyb%?BSxX7#Kb)^J#F1;3Azh~dsC{~1Xuwpzh^MRaS)yiCX!O&7X?nY(YRH|=h
zn=$*1WOzt9ai?M0GEtuo*XN?nOeX06)^Xz)c9I>;IQ-XOyd?mWSkBs!RY6^0C<Iwn
zqX$blT);V$HOOi^5ODD=T86h}6SAU{+xRKOp{btO_sYM(lv(fI^gFnT3c#Tv=n=e%
zm5(XQ=*0e-@NYN?ocp%=?wwEKG*+hgqNGi6_A@;0T7ts4R3p%h0x<aGWa3$<p(`o<
z?TiZLjN5vLSHuB|K)C1k^c|->Bza%~sYA>@0QqKj&kEQXMFOa0#C=FINy*~Om;Im0
zkFH>_2OGD#3;*8wdo+ETD)IB461Ng>F5MHPeMu_%9gR7|`0GVe1X%~K^wPjROL04K
zl60dwD@duc^nJ#-c9O4)R$ze=vtW=FKR?yDOt2&Ab@}Y~+U&VYPpURv9P}Pe)hHC|
z*m3{SnR4wt&)CSTnHTrL9^5$CTK8LB($r1ap~&GEr<arECP!w@!ek*=>(JjAVSU`>
z{`2O!6{~&0vwbyP{*S&q`$Rt-Ew$$FB?<GRQcSr#KKn-Jby}PR8!WT-Ci?6$9Z_cA
zfEr8`PEHeoPQ9xWP5;2swmER|@f_boX?3O6_C$PA2Np>j_=*MH^oaPGTj*sdoZRzk
zQ^ByJ{P}WzS?9+vQTBq*&mAmm+;|;4B+uIKy=<Z&c}6dT8hc>`iG=k#I@b3Vr6G!$
z1rPxn(Lra<dh=F6y_K&a_H68~cevh+_VyXYhDz8IBG3?+0y`4kq@m=>0C(Z+ms~gL
zQ9I@|B<|qT`XIpZ$^OfWyY*J7E^j&F3{3;d6~0gt&E_nU8Id42M-|Z`U0)^0^-T#%
zgODBYJ=W1kNO8_Ip9iMxNtu>YzDf1;NpJ<VzqWMR|9%s}e{Z^paJXs5XGjxkF!A-W
znX%fbM~mL48CsnsC!v#!vK@w+g=r?DOo&SuvR6Rr#U@<no@s!iM~OT{kJYI2Jw>XK
zsEfED<$7=9<hd4^SRhzL56H;}y$cD-tNX?aQ|H_ICOj;kd(wK7ZMnPmtoQ{%>NB^v
zumh4}<`|m*5r9*lp!g|~RH|&qobaf&YwC#c(;tfCy|;Q4c5{TYr3JEABl-Q;?e^yu
zlNgu*mBy$|bu15hLawqnFTjMPhu+0oJXbuci%-NZj=a^H{G!w8Y^gG#tB@{07SePd
z|3Cru?2ShaBjj9<AaUWCkU`IM#<HZXrkKy}dA_@S`7~!@m9cNEXDZ&S9T*&N)D^%{
zd(c=T#3MGS&E!Na_K)BE;z+NOzRWtie(|5wy{p}GsMLcZ#l?G9y_9^ucwff)#6s-i
zd?Mk`RQS<S!M*7Bo)R(Nvaa<<CmN@op%oR71+;;EZk8L^7hqke_(7UOts+6wKoX&X
z3<L^4fQLY4)4;);u6<>*5UJfK8WI{3GT8-Zc`8$^F`neT7GE8RRD+kZf5^g)(<0fB
zYQ&M2OZv0ZD~*>`_4kVSI3R}Z8hQ;@Psc?tyN0D7Z$RNYd`LKQS|w(Wwck3Rmfsh<
z;z@Z<V%_opxbJZ#DPwA#o#Rj>2Qs5%Y-)h;qtoQ+C|vK2F*Fk1f4gg6d|at12m<T7
zl^KcElX^6g{FFn~sjIxyE?W>AnD#AgQ8QfEJ>wYi7kocCayAz~1mbB6M%W>@;VmCR
zqt}C!&Chb#UTgO1B_BE|i(tZaM`V&&9cI_qBVmfzoWm>Z#L4orG4MTCtA{L~qUz^a
zT_tiWDouoSS6w{D**z2qo>pCmL^LG=Hmh;>UQiP`(QDm@<p&);>K%o<hT?zD@*}2F
zZD@r>W#N_;D=?cf8PqWwT~lutF*O~unA`6+9X{etD4g>o1$}m-vdOsCM9PFuB)io?
zTL<bXr^Z?<a<{U6JD`1oW4$=O2}6MdM`2_J0?6v@Nf=;8={X-sqETHgaYLa%f9(V9
z@}#9ebGAc{St+6jpITAjY={uO=j4rQE>k}s7kdc3jD53jQ5SJGx_D?Y(dOSC@k?T<
zL(AoDr`62GLDX-8pN<#bz6B@d-`WVH&#PMR6Q94{z342zWUqD-74ciK_Ya)Ycl(O&
zB_F3}6XEcXr-v-iI1x&O-_R$S<koB%M+#3{sKePCtGULAvpeG@*ti$4TVqd`>9ZWy
zqUwF+UUvT?$DQI5FL+g^3VNP31{$yxx|=w)KP9*}S?A_%{NR00jj!f7SvQhW2?jg=
zzs`Y;?qa0iY(Pg~=;;lZUti;Yqr>(0*P9}d@Qmj!ArKhhf()7v?VCWAD?8f{Z<!0+
zk<Z;L<UA^~vhaT}F7@eMvu-5mR5A0TX8|JR*=*Gbx1omoludSQ=u14GBu#y<5}%7A
zT+b;&YD%!pRcT{!2=tvS3hbEYPb2=KB)fBQn9qG2Gpz(eC?MyLESU%w^i5qfdk?Im
zlgZO!+<RYJT4~W?U9KY^V0R7kKb}Ki<4vO`GLov9#^o}|+RlA{I_%4)pe76Wg6rV<
zSNNLM;#*#)vmjScr*(8xqmR;lGir&GH}b9!@CsTk!nlAY1iZz`@K*9=X-(x8cI)*A
zT4b(+8$~N#14GRN_dkYPusDB&)!(Tt=+emE-rRcuaS-QfI%xo7)l|s|WDq8>@uTR}
zhYV#;KivrI^Ra$I*F&${c(&g-anwXzyDf6uO`a<U-bj24$YKD=n|$Ui&VXXh_0*^L
z%qgV{cQK1DhUrBd3boY7XP-xRX<&g={W=eURhpWoyPR3I?++}KXC_)6vt})esa$lD
zQ9JhFDc#U<Z4=GjF5>w0-*IAa$KfW8d)cHxJSjw-r@2;eDA$|nT5`^8v&^u`_Wo8L
zwv1UI6=uVR)Gp<}4*`57x-b-5NF<Odv_Ka?K>Tb%dT<0KkQSxl*fl74#~}82{@`P+
z*WZJg5vC)S4Otx3Xg;H(9EzFIO)*3(E7;ssZ!W<D%egGg*vna^wyttZ7(2hHEiAK-
zbj;K#d`~m8F^Ud~WNY#ho0K)pK>O<K&6_(YE-YK{()f%f{gwB0G@mdWaTEbZL_z}c
ziO2z<LCGvh$WV$F#f;`ji&LELYc6)7WVxNJ7hkBB9%X3#UibxvFt|XAPydokG7-%J
z<40xsM2c4yX4!bA_&b*H1w9z-g-Ej+JSs~5WpdDat3q^*2ZWrX?hDWT)uKMKi4npG
z5zYco76{o=dl^MneG|2nec8B;YKK%hnJ7d2?-YI7iswInx|oz(X3oG)NOGwqdC;k>
zWj;nuc0IwD1DL6Qg;U4NH+(<6!}r&7KFNx`DY4_HT5tz8rcu003PxyY0How0^_5VW
zOe~E5-ENj!?LM>3HosP?B!5L!vipBp7h6AO5rw~p$IMGB!J_*@6>|9*u(C1p`LQqH
z>2gSVY{@~$Sikazt;@&H48!M_-f&w_?Hut>J-gS_;Kd6Lfo}RuyrOrB9!5wS+GOH4
znP7WUOO=o#yBhUaZCq=>n;{a*?1dNe;}ccCiE=$T(bfz9x-V~G-YqoN6GDN1)dYUK
z*UnY`;BTnxSwRVgrx-G$k<Wo4;#AX*qk=PXAzZQZ@{0=T!b+zRCEwIl=CRdJw=AN4
zDXsul$oN?V=qpmzP0ojIB`HGIB`su3L*SFs3~$L(os{8CwlvZH5((ccLM7IoP|`NF
zpk(%p5qX4&7<EAT9eu}-bOCrIhWe6Ba!);S7RJj46Ov=e&`P23;?#r9ri40EJ^Vdt
zVM$@MJl=|1z4~2(U*t5`aT=E0;#F17Qo)qSdsp4LE*(`bwKrY=3BgyK5bz`7f|1g2
z%a}pO=+5~cQRkmi%e>xGrg+hgFgSVGS5d{>|L)IO7TrR!LLf&kJ?|p-?(Wpk)2?@r
z`+a2nKKWahES*2&mv8^C_P+8j%I^DmW&kCW6cG>^8l;pCg%JdXR#Cc?mJUHeXRwfN
zkQAjv>Fz;Ay1P;72I-o4&WwJ4f5G$e_64u}T-UkIIeYE3*52ogSsyAnN77=O#Ci2z
zY0dF4opbdA-@_+|VqpIRD6}*|Q=)U@sh1RgGLmGNJnH<t9UB$cWLau$s*Ke}?&j5G
zRdtM8{=(So%*`qCMl^LT34f9}5vN5+)^)u>^pZGK9Dm``X^op3wyG*K8fB?D3DxZ_
z(Zu3I;Uj4e^iE6^CoAa<ji3Ds?KMXI8-W^bLsgsIRs(-5+mC}%Yw$cYRUu7sY{MrK
zGO60lM0O{-J7(%<`tF5KwVW$3SIIs3gE)$nKUYwq?`HQET20<-eN4&CPT3)h-%k(D
z(tNOf(^wJW|Bci`1y>N-^wl%WOXFSqCeAhIduYo5Dmy*)oc_hEPpvI*;vEJt6FNjq
zf4?~NOytF|zy>ye7%1nGzz*E>PE&!N+TdVoQDA8MN<s0aS=)Cr5Yq6ofJM!wMIhN>
z+I;4ntj|By9!q-JDAt`8wIsTKO=KL^Q(X}1KR~HHFn!bT9J)kY$v~FIdNq{z6Yyf*
zzg_u3?V>d`Jhb|%7{^+CrlHU2*@BPVp|GU9r$ILH-({Fp0?SYvb7ATBPc-ad??|4r
zV@Q>!y-4|bWyh&J_g1Tjat@Dk7ST_1@(mXM0E)#HOjyLS@aN~1JLOJ0#cR@=&iN$O
zfKu&MWYH&&?luXkzllqt?=Kd^x|@`90wViH2fX2zfS23NbFi}gkdaF4Oy7hVufg^e
zgW?nY8aj_Hd4OMw6=-FchFY*$lfp(GS)n>70+TR0-AitZiPK=|e_39)JsnBcY#MI7
zpxs8dCaH3D`ZKHJV<{$l7=zuq2w4nZKSsbUV85aUMt_I8S<cUAnurL8;_d=&$9@+Q
zg0;!bMQZsI_eJ9F32S#wflIZ?@3$z%#X5~+k`@}r3$Laad3C;<7Teeu=+LH{5wYAj
zQydI|k<g?OrNK#5C8&`koIBHw;TS2MC5QKJEI9XjC|TwgjQtWwAJzBmV8IsC8>U>A
zKr@JkwTFtFm!>zmglLB*(S+qSVr<Xr?&hEIA}juNQK4dWqv`ARgSe-eT;cs?PcD#r
zy^i0saukb9O+Z@Q;q_-o*&o+&`;0L#D6!L>chvH=;CTG_^;Jue=m$_o@g?CerXJry
zm5DMc=B_fsylHx>aAPg;(_tnCh;r+fMy_`~d~F=E6=&pyGm$cYl=)XsP(wF8>DF(-
zr(uKk7IRGl-N+=155^MH9N8yHPEY(Qh|pSSKL){^?n=ZFwEqmIG-4uVf{g|u<2ME<
z`A(wdAAsBf6t*)MPMhG^eb;ol*EoKtz%bL`n4W#N<Meavuv12~QE@U!AK<*C@J(uH
zUKZG5h+D*_X0><fYaTF`33aS+J=KZL{V|3`j&qZ=UL8fi$6;eF!)E#>42X0{X-(bm
zb@=cIb&Efm5*rZa>iOfgr}UVXXP4g}<+0G%mpjq737PIJ$aI@<`gKKk0PNQcgL)^g
z0cosD6VpDMLEfQ9djL%$R$4$KD%sh;v_g{^*SF}^@79b(LO=k%SL6i0wOW;y<0W$<
zym2Rxc|3A|F-U;@n9)dLnES<aTtJ_f*DZJLa{P+?2Ge%uM1(uwJNqV4QWuv~7m2&^
zRlDe}kuCEV696>*{mE9tiF<_hO|v1PIR9AEv(IDDwPw45{1`S7_a9E`=NjG!Ce-9#
zE=Z{2ug>KHsRnG<F2M9#yrEHk#P<<;SV?iw(ZXMuE!D3-Z}VjQkyw@;dVCg=0;$!e
zzJx{`eXWtFHP`I>Xmi$9T}S<Wx}cB*u?RfP`A1al75<G@A6Yf5*Q3s;Nk`nIet-U`
zS+AGi-?vQR-{MOah5f(~vG-CuTT72wRqTqayTY<lv!aX0%DX094@Mf&5{53%E#*Me
zOa>CSXjMf-`NEDa4hEm}M;79;I!-ZG>|S5ymd_t26_jt>jN~Wq@T!Y&7<~AL%5U(K
z96uKL%Zx;Yk&W|JkwJ%dbLu)PqB8ovwB33IfxWy~2?npb9#J%q!9WJm+a(V&S3jD!
z9_tu!)&4iKw25y0Ki2nW)DD{tzD$ooNdZMdq)Fl3h-`t@R%&tptDWyWX1Qek$O~6A
zKO^PPwQ*^SE0=u}@kW3n;wJR;{&Im3xciJhiA}qAN?3Vc@;fub&`Z%THD8^?)ScRE
zZD$40f7QAY4IGxn%cUy!Mhj2_e#~xa@A6}*yZK7Os^h<tbH~I4sa^MHH5GXj-q5sE
zBE~rO%f+Fy{a;GHJP8zkrd4q)G~><Y{hFqyBFWTa8B+_jzw02sl47#FI#DJ4<YYO{
zB!dWHg%=MX`+#kO&pzLITvV6s?VsNen}``0_n5;;-|ERC0n1})0C#k?V>rR8`=H|b
zwZ_PKBEqokEhwFN=&DDp!In_2M*M=I7?whB!V*6zi@G<>!Gmv*8&_TvDKa=B%c&KN
zQJ*&vagiEcCpI_<@4?-;$YXbf-QScGJ=lct7*!IbeJDr+d9LXLnRVX$6OTl*`6!+f
z`U1$d$H{b}?%VGbwdaSUqfQlU1}2zNe9Nv^#<*G%qU$?eE*4sj3c~_;sZFo<dP?U=
zG0$_*S*~MPVwsE$s7CFLF8}Tw6^D`TC?Up7CP!9I??QZT)?tLtKI9?2p=`c!8rS07
z%yKAb5U8HAmf-bHCLI^<I`a^p)3RZPgXSP|E|a|i7vonQ{oZ<Po4h`9)J?L|b%|Bk
z?qJ~)wdz&a)rjY|;!Y~hL)StkKF~mxMxifCJ9ebU5EhDQ-LR!`wU3Z7w=qmvV}hRL
z7AEs<NwqcV*O~0ol@iGsyg(^t2XaAI?S%(?GXo~dkaDg^!?*uku!ERjwo~E`_ia0)
z->P2Ux50ooV7?rM&L&i7Bs%1RmTUBfUpQK&c`I03ent7k(ZWX@zRen%OKvfLw-E_F
z*hXn2>gD7DE;5YK9}=k4HzpMZ6H300@lBHnwcKG#fshD!73&)NPo1rh4ODp^n{H60
z2z-Iqi-}@Cc5<)WhFz#QI2$PnL}>0wkbb{y{P%dv(ZI}4DSnP(Q}q@M1*K;qxx)hS
zDC!~xV&QVAsLHK0Vc0ab@v!Z2jof@~ir3dJ^|?Iu-OBYv`A}RvbqO8u86G&RbvmZa
zM~JF!C+kchH(I}N*9@VI<JvL%j*FkWSw2CjI$7_RIf^4HQXwp~0A4U;_Q3^7Zz#Y8
zOnEClZyi#9Ge{btQZxE>zn_OggZeo!6BSzokAEpc0efIv6K3!Oifo^Z`H$Uj+Um~M
zjk&;5Yb``p=u-C^?c5x@@6(OzC0UR2wWngo|4!Fy1~6TlN*ZT^*<CE$Mct-Yf)za`
z0<LjwW1I6L6O+ZrZ5b|P#<ZS=u@}nIB5IbznGmQvyl6{RN*muB?&6xMD>0%y!Z<nF
ziGS9}XWo`^$G!g%H_Q$=q%;U=I1h=ENPrPsp#IXZ5r4m<vuTuPg96{5lD<7*FBvhi
zH^(Wr)+zXUR(eY~+>~@}-N!cLkq~W81Y7ViuV|)orYSLEvauDX;h_I#zDqtNK0kN7
zeNrkqU4yb&fgst?5Ecj#Vj+U`@@+&SWGJLm<>Mz2A-1nPxn<3nTf*;6_+Ls1oOn^I
zrv@YPiA&4k^2yRtU_gMPGIh{}tk=zDBY^s}k1slLY`5}~6yc{ODHN%r6JKqwUgab}
zb;C74SFfGR)VQ)OxM^?mxie+RH>G5OlVc;c5J#8N7+=HxazWN61CXgJTxp@tMjamH
z+j64uWY}EY(3RNU%kf~Lm4w~#^lZOfGgdQ!$c2M)YoQZ)m}P+VIc?qlCQ5K-{s=WN
zLA-@;^_kfM1wDf@0!R8<{YdvRUctiEe&juxoj@gSnI5P0oUx?z|G>~=_PB1*0NPf!
z;!|@h2uF=lKMiS^5`J@|_08@1m|T*Xb!Asy3y&^`r1r^oQO&F1rd+&p62y);i@2*6
z<##~~p?t8G=)G}J&M3>bBL3{YE)M5ScJMwXM8@%;|3KI{GMbI}ia;8xr`_sGBE(Z8
z(MiWGAwu?$1XakeU$2BX4y<PI#vnNjI+f>(JvcDMbdUKlwa0TT-XZU!E8e;i0chkc
zhYSWhiWjbGFKKAb_`oX3t>BPlwT`>aSd|dFjJmBU*!@~<jOOVX=;@CkibzN|TFOs&
zuovYxdzLwI>I~VwS9>2_p$N0&Sa5I%mTFq|#bpk3Lm@@snTA3PQ47kG#Pk5$Tco>l
zD`!Kv(e*&i?xfpOMsA1_A_FZpa>zIb&d>Bv)l1BCk|Ty8l@;6#p3dj=u!U@eW&{b!
z1SBZ?wx;)jad6Zm<`Q$X7TT<;cLZmg&w-ag=K|1STzH<;L~OZ^G9E{M79!ssdhMOC
zEf2ywY6!Rc4e%*Nfi%p7k1}NK+psO9E`Prl3MX}NrYrnY^3YKwD`GN^6dfA|hy->l
zzt-eH+MD^J7v2m1fseieD-B9_?oFG%14$0y)Z7^6?k7=A7`G<51rB+&2ZA;vs%|t=
z0#L_t)s@b$c6#7lj{A6`4GUCNR2m+(E<DB@N%VN#cB$vm(>3|w*QD}mY{c5JpZ4he
zmtxK$0{aF;V=<fiSOK`c!ig05^yN0Sb{$Gxn(ZGoql+PFGo`3!4OR@`qGfXwC)#r%
zI})PQ#^LS#*nhnZSBwrhha2XEnTuX;Wmz(<w{LS#zWpcXfj1j~zX%jw>zcipO*4lX
zHH9<_;%FET&3I$KxkuHJO-BYo+?0gzIMZ+wXrDqbKVa~(Kp_r4*>_7pqJ1^Kdnz&G
ztiCu?mW&G>3v&+%jaDC{Eco+k_WrE=5qd~)vM%ZRJ3V`-FREQn)A9~|{=J+TUxMub
zGfM5Eqm124K?6XeE#_{!QMbgQu~FIfFlw@hykbW4$CiVrf?%BLeos)>DeLYBp-|iq
zB)ahfAqGU?Ap4vl_veJC5n$WR*XC$)&dp8tqMgs(<sBX)ww$)ABnTd0t_Y^RtOLCw
z>ymFmw$$9iK?}nd`aiv&e5Wv=QPSGv1!U^n-Gk(unEWKIVx5+A(R>8#CIZ;)0vAdR
zY4}AJ(mBX6P1Zafm=dp)#50Rb?>q2f+Sgvh{i-UlAtvW2lqUzt?c0SFe-ZX)a$``=
zUJFxph(z?yOuDpcYo2V$j-xL!*I(i5G6?e)u$q_tNJ2)t-yojODR}R*ejN1_t>Ub6
zqi}Vw&Kxx>XJNvP^0M9YM^F-%&hex`oZOr>AqAZ`fldHdRKDz6QK#J%{8>!{vF3^S
zzH!zjKB{xqp03?&v@rfjCh1?V>LJ*f<|EV4S=3LUIx9nyGJ7-TcsM<_Z(B}YXZ#cY
zxHh#mffDV{Kuv~#JLAzb{@%t%%+AReg+ft9-2>cQ{P)B-_bed_h``yIIG(0-?oiyL
z_?uPuC8Y$pzu{KtQz2LYyGxN_e$u{D<V~I@d#q91xUI$j+U!%=3l5$^2v?H6Dg`^v
zhWns&vN3GS4iur$p083qF46OMRA%FAW^V9Xb4{H|@ddT@Mk687*Z<Bu#Wijha}iTC
z0!IvluXULKkWdv<DKS@%KAk&>*IW#nyS9%(4Xl#+|Ds)NdZ8Y-t5+|;5PAkqi=Za2
zelm`otmXQe@Sw^w`{qRn$>)WJH6B&I_gY?9Cp!?Fh0FJW{q-_v%a8bo6O;}Fx6}KJ
zzPuNaJG8yFmwRp?RQ=2JGCIYSKsAXdGR&^XoJTO7YH>gbB{>9`tL{Um^sR<~pCqF+
zJ&#r|&P~N8hMb_9+9z;J80V=JfO57ilS{JfvVq)O1VT?lmqui6zH|8!bjI=%N<<=a
zDQu-9usP)Z%w=)$DMnIwk0jLb!g33$nj5{YfANf^hCW+R(b|vTC(MVMb}JiCH*_;<
zos)`Kr0L*b9b!bP@R{I<2V?@Az$hK;>;)<L<@EUgON05>K_wdz{<#0ScnwfKZy6YA
ztqJ^;U6lh0ig6%@kHu-z2JNpr=7Aas5uBteSL_p0igD`TPP;POjJ?<*_cHqJ4QFHk
zgpfe-WuG2bDA-z3;EI;5;LH@=C!7)wr$(;<zwq<GjO_`ltF((0@f&3X^PwHUpwoRB
zl6PnBy!AroGxbw`or;Ua>3xnYNYI`FM@6ZX)Vc9A9t+f84@zh6Z371hz~)*5SDW+<
zkEZd>{-Kct!>{3Tf0S<EP5m2rV9tB&4{8zs`4*xF@Mf1L6$#PizY#H9HDy>Nw^!2_
z>8_%T6AoxG78S$@Qe|e!MU=YUA#A5razMf+i`lG{==E>1CRln6z1q8OccN`%&!a#Z
z){mtxYiMPFG1B%Z*N0&N{Mcrrr&MOlsNG6cy`KbkwvB}i4bWOt{0_pH<RsP<NMvUS
zqY04=@jr`K{pJkoN<Z%qXGA(zphh+CYaDWPCBBY&gB!m#q$a?RV-1p$Rf72Y!j|5-
z2%k*v4G~|n?~570_u6O3I%(K6+$_#D?Pb5(dJS`8=B)Hfn=8@5uC(`%x&L!+-DXn3
zvPk$}rbl|?4%oJ5i(Pm?NhG4WqHfEq>wdHpQ?%h;D|{Pg_1jwYh`5>`m;GcL%bIW#
z&)<&0q5NhyqX5XBS>N&g&DbxD7Yn(`BubM-E7+@YYka=<9dx_+M~Z=Yf-?gmY?*!;
z`QsX?-;tm9bNhAHv(s`m7B~xuk!Zp9_XF!#-hAT;C$&VT4UgNFok{D3h|*pc0wAQ>
zL@Y*&AOiKc+b~jvy>k5ptojVb?&R}H9Uol_7S7i!X|3gF!{eL7r9=n@13Ew}?YR_u
z$obOJabEQg_@w*goKmFOLUCj{m7$kRY7DNd4mMLHc!|7*z!>R49cy0&y12W84dM2E
z7oF*do0^}?rCgzf7Cz21@_JCiw=cRcKln=+Fa8@80lq%vJx>MiVFh(4vr}hb-7IIP
zt}=y6&fN<4B2m$MtwOyA8{yYMDaSvXdU5y0SX8a9JrPI|J;B6_dm78`_2Y|vK`%F>
zo>L%OFj|+typB3GF_5#i6ELlFx~f;P%FY5gEw@I2w;^c2+jt-4L}fdW2{0KMj9n4-
zmgL)AoN<%pPM7lAD}JDsamN1_eb1SC)3?MeJHBbMN5XTQ>P-?>w??ZqrYq;v_J-P)
zEt8s1__{J4o)UmMgzNmc^@yDB+FokpQZ>#su*;ZNY5k_iXV2Wpt+_fTFE)3LEU;$U
zpjd+T<G14hzdeq0Gf<fVg{)LY_<4b0Em*lfsqKvX6vYqQG7c1%zI)w$5tL!7mQ!d~
zeYtGJ?SH{xOx^>HXn(}f>rF!%uTi=?Z<r|}DKE_9kVy44ylqp{Ab&bIzf;{5$pa(3
zV2ofsU`ooMAbOnLfMrrBh(@eiF~^|e!t+m@J4{$R)-onWB{sB{_bm3SZO_DtgaLOC
za10LrQ~3>PH3?NE_%W;iIfL25?sqHijxA})9wIH*7*%)Q>E@ORX+D!VwnCEAT)OH%
z6(1Gr9&H=lr<&|7No%fXn94-f5I=;Nq8wY_aGLDLCUi;_V+2{m)$N%x%X-7>hSXT+
z39Ao*X#;lL5Y4-F8F<e>SwtC3a!N$$72ZYuz}jTeO0rlkWo3`hgYpuT7@Q6_N<Id^
zdH5ERLXO~R=#5p}K-R_LUcNdV4n03U)mWkEu#p_3TW0j;U%V5M_59-m(G<1YJIn71
zG;z5D=?rbIPff?LIwJe>eMh2C7J0m86M(dAgw;voJa5<Mfastqu!lL&lDRZ;v57W?
z@U87KOM*hXo*(J(Bh2=4%W9Wn$<x?gT)Gf-SOA!`3kY;?3+w{BK}#w^zxIw$g|f0`
z>3l|V_F+cHVZ1l)O%rM_DCh#HbA2ZUtpkfL{>m`hyjvSKvNBNS+Ky)1*0$^Xk1!KL
zT(bC9lzZoPxL8g2TsT3Xr(MIlKUuu3NL^xZd0Je#%IbcMa+GMfBQ`T*#Y6U0B>am+
z5q=|9(JVf*nhYlHX#unkTw}oVbs@ksq}VCs3I}J`D)Kuj)8b<{H<z#Dk!PtO)z(Y5
zMXm-Y9@ifM#J$tu#-&Geq0+}kJZRigNUYN}r&LqgzM0FR|E>|U`3DzUP&M>{=J73N
zax&a}VD6KIgnX6C&~%8^V>&WDGAXa4N)loC>BReBs3T?AH(HExX=L>xo<ODb;6I@H
zY3syYidRZAkGT^)zT#@joY;y3Jz*gSVP*J^frh*Bq|LwtvANhIEaVsw)<(~G=mpmL
z;GVDb)Y&y4941L2{OP#NS*kj5bqPb<UPnjllVhcR?;iU~D*S68{yaea{#1>5N(s}3
z!*|VVL?q;+-q{*|6kW({MJar4>uXh>!I2$2CCArV5ccP)DbbWHwqg)_fP%ORr&)|=
zrGC0ev!?T8v8$7T?uq@F5)<x}!6qD!QZ9gAUNfH4bfVHR-#Tm?Sl?m@SxYX7#Mu;Y
zPWz1?2i>2c-2Sx642B}b1R7AxYeD6q0@OBq!dWyGf}X`7QKB!FN<S7})~H-cKCNX8
zcCO!x*IWM4B~74c)KcVt+J`A5SX?kgEZ6Tj)!lRZ@Ql6up{YpjgW1m>Fb^Y~p`<mQ
z&5^U=oq+(FJ|tSf(y1_E<oL&8*4K7M%OOi>LrvFsXyo0J-38%gRmM>;Enq-TCBUOo
zJHz!j(zcKC4)dtOv;+!LZ6%}PEqgKUTy$BlxXJ&(Ls3(lc&{CLdas{)*OU`c5wF7z
zRnW}0qbu`O`QYZqnQ*s!T}ej&g?QP$%W}-pCHFUS1@$_-9tQ_|KrXA^a-qhr_D`4x
zp>=AChSWGpyl7aW+2j$A6@0bw{?GXrMYo49LvIFv#e$M&OuHFI_h{jJLqbivZw3%y
zzog^91s##NIOFBwh*d%6ggNEx-nc4U2$r=cI-8&lZ|H;C$=MngVbB8P^6OiRR^Dm!
zJy)YoajP{M>$1T5Ghq+**^K7@qX8=N>1YpFCH_NRe~yI6{&57?{rjuwFymY$bJ<Iy
zM(Tx9T82HJopu{>JU<+0cV53@YjcC~?_N?N%{bi;e@ae82wAK{Z)1f<&9dbn4k>ic
zjydxBWhNXI(adw8wo}nzCo3)rKE2}uLX@UmePr<VCeEohvVrF-(pwx^eSbNxxJh28
zKRY~2Pe`Uz_+83&Z6dT`hWHy7-Jtr0ypzJVG=m{)`B18=-zDFPm8X}%Ab6AU^&h0H
z_$c$qa0wBTS{5*<J3aa1oAEp{{TIFt@`_;Set0ge=XG{&h3D}8<9(-eY2o##xK+Cm
zVrwCp>HN-D8PYZ>NuUzSCv6pN@yU8*igcC%N?Z-Q4ZD023dm{Q9xCDiE;M!CdE5vk
z8`v=^Y8}*s`>NzkLP*aRpnm)G95ofk<~9G$(V?fto~&Un3?g)JDX~4Bs?*o|plLV)
z{3vp#2^xeFzgty;Ey_Sxz(K4QqFl1g2FaIEu^yfJ_MXvFC$B54?Ig*jjW-;oPN&-S
z45|ERyzs;alt<11l(<23MVQ6Z-x>AWFOyDO#i}>Un}@-mAxD5-dWpikcz&~<zeO5G
z>Jd;<X8j?)*w{lUW~bcP$`_43KQ#i6=I#(YWT~PzGQ&-Q78BM@jdg{vQ8j%C<Vuq2
z?OXTpp@8_AfTtVQ3ZB;-U=Ozxyt55Y<yN9gK3K@}(ogAV&OF(|JWPjU@FDL-($~Y|
zxY<7Z5S%Pyhn#?V$uml`Sd$XG6#Y3q<j{7ZSTg$4Y0ZbrChtGT+fOUa5vp$x*eQL_
zdpkV&MmL0ZcJiuqTxXad%W2VSu^J!_{1p@AXo$Pnu>SNa`0hJ5ppLWl=M{%ZdUzo$
zPCr*6FM7rsRRSFfWsWe6A!Ze>PX@KL^OJV<%G&=5QV2MD4Ytr7{ZYHSB-mw8?HP=E
zzs2UQx?D~%H`1Xdm_IQ@Ul5#V_Xm(M;L*WPMOMWRCQBziL_&Np`D8sYSp}xU7dIoE
z5_juJAtf{Eo8HcA_lk?WpZp%ulU%jZ#j^HQkc=whQ|@g*VL2Yo!<DG@W43ZPq*=o6
zE1y>GPFCTXGbxz^%=3n<2!0GHyiglqRJ{*!+uB2?6Z@$-c2VF*+Y!$=8LT*o&-8rU
z!fe!ie?S20{~JFIiQKNe&DGA7u5c-vZdI&lVN>cNXZ>Z{Lx!TtRyv?0z95b!4+@d!
zxY8H9(uxC&X$GNU-@kgu6k#qpRMLcVql{(Nopmu=6+TP|f{+Gc_W>BQ;+)lj5)El^
zQ(i$#`_OB;p-S(Z`q0+e&Y+Id4PBFdAE&#2)aCG5qn><G(u#?!5Ootc4z_0DF>5KR
z&&AtmCF5H7a6_~f8%I&oVm2n7#_Op9*T<K5o)DtAiXn{%zORHlLumv&z0CT(sjY;_
zz(cJ~;j%j1CowEfM(;-HFYOszp*s4M1C7Wh=@V9SJZR5>PKFTIb+<9tD=~emMx;3@
zZYqsA9@y*71$7)2#Bv-bxV4^k?L9s&Ka?yOoLgtRvlu6V!&_IR=kB2SAViG|J<>Fl
z0yDa<779a$NnsA}qWi@=TZ%iG2HFU9Mi*+RBT4pjsv%J?w=;V@oBsZDVbk0s3xhM)
z2V^7+BSkqU<aC|e5+HUb?KOXe(N9uPE|!8>Qbs!amq~Vo$L1dM<&+5BZ<{~1?0B5j
zzvU|PDRyHb(gz<uZ;AW1)<AE`lG<PijMJVrgcnuA@GQ)e_JTuy6Drpoo@=Mp0t~FA
zVZ*!I?YjwmZ8>I`F#&zgR!TgcAl{I?gGK!M#%A}DA)*TBT4i@tWFMD7eDXfVT|zJO
zir&X9`GaCM62L=sprEx+DFBWaL+*)rJjik_-W6m;vm=?0exSpB+1(sHFRpRB;TF2p
z7ukd<f^RzDQ6!1AK&TMk@Y5OI8i+IOexR{plhJf!JbrNZ^J5Yrk76)U0m2ayUcQl#
z-qT2k3>V^kItz?sWWrQV;jN#J?x|U5$|(y&fW2h-a0QR05CU3^yhzBUZk)i!3L_8B
zxKh?Yl2b8gt!aB%bVw5z39ZyGfUl=wLU|d`5puqWFd$iAJu6G6N-d?cnMo}Cm@7jL
z?MoJteiKzm_fM9$=cLz`LEVP{N=N`oQumxF<9Pf9Et<YW9u9X^zLp}-=31kx=ZJ>R
zk}FDhUsdf30&3#|5`!$`X77anDFGS-s68Gco`sdCxmVluS)FHWRs2+uzKNo>kN1=u
zcb;&n9;ArJ@Y%N)6O0tNODUM2%XyM2?E!y{z0lj~Qvo_6zft#;9o5`EY`qWv!x0PS
zp2vTkx{9;%6SyF^%iY|uT_59MTzt7Xc9J6A%y};7Es~$GnEz|;iIyXKrJXEX!K}m3
z#wI-;*bz*7gesnk{+vJ6NZ6I2T@*CsavsMbA+j7^EhA6$qc<i_vq?Kf^;`thaqY>d
z>8NDTzN+cmxe@z&@n~e5u1t=iSQd{Lpescmgfvgq@4)ZuF829XMm?q0=_G}BD_nEj
z!&+uFvp;;YyZJ<4paqB?xQiveh0ichi1M8>(auHk4kO%`)IDv<z{~2j=aW=7SB7+l
z4CewhE$Tl-GyiRE1dZCD&xh#YLYe`6L@%z*sYYfv=o?o~fKX#mLaa4vv`zZ6-HA=v
z0FnVveTB4rE_;4ArH{~w+!OFU7@_GV=@4R<F$(kVS~(7K@lrJdc2l+2z4x24>Kqm!
zyp7Cp8u;ybcmW8-_jAghscs>(ju#}Fm6hpOx!LWtrB=dJznBr-s|iKPKq#RpCis-N
zkMBl{DB(r>rsE_^XYY&bYLW6!9mci}Ip{Fqz;O|jw>zF~B7Xkg=5h279$dD3`kw4L
zTk)^6FUgu^Re9|b!N_Z7kt|^3$h7^}_FtlS82LB4Fn~RtUt;W;cYlM4DBED~J0u?}
zrDMo{YLj2_;<(@E?bKz|!mt;`eKkuG{98bo(gQME`V;AiBJtQkeb0?+?kMt3D3NB>
z5aAZDRFgTHo=z{4#IKisGdaEoKpCS9Tb$n6L5EL%g`}q0O^rvHcTRG?ljTUacArmi
z7eC%8o_G?;orF)e5SS7`)U-t|4eS;Ev`~}|Hd{3PgX`5LPS)55IM8^HJp0$#YG@!{
z2NxOxS3bhM*mIb8WI2zl$Jft%sb-_WZrn`k(u&m}t}{$ssGSL-J}6%D`1xu0PAQ5}
zed`(HPj39CZMcIkE?xMc!OhC?GcoTPSO2Mv317=cl(nJOVYY?lU-#za#h$^S(kCfH
z`Xa!~N;)o>yin7(8LxBtgP%>JqI1VuB}#h+)w9777LKPcJ@iPF)-Qy)Ey<AA^mPfD
zHB=i(4Ykp>R*s!kg{)lP7?XJUhi66+u7H*XAvS_X!jLb-XdBvDs<|7=#lDCZXQWDC
z)!oYVN14{5a6uWHh7-1aWn*Jij@aV|ET=YqaRN>U7Qyo4C1hh7K?`aO<POoH)IK|9
z8xP!sKFHneG)-~8qdHSbn9*aB>NWc+MJ<|<P|}|9rT8b@^@UcO(}`Mzo<EFgR>#+T
zb}I@b7*D6o-Wsdmap+PhsO-HIf`-Xo^T!-j@`-mRxqr}+v54MeOE^YVGoCCq&^G!L
z{QN6IX`z00n&Wq?*g0@o3`80n&@&^@pL>sRFT*tiD+`T9){6xb?A4o3_BfxlQVDBc
zA@t#bKm)Zye4tTR9uO@|4(ZxxU5t}44NF&LUVTbCo1r=RAyXhDLW}_CwVH5nski;L
zr69pEGM51s=os4vveG7XRAc#N6bD~IO}VkDth_512i=7!?iLopM=J_MVErhsLk(D!
zp(ckI&vp%6<(c;t+yaeX-^Y+oRBGq4+-7mR)Q-M^*Av=YX=Z(6n^&Uwf!2KNX0uV0
zJ+`4!i)6-eWd~m0)fzaYTO!u~EN-ZmU-4~>0`pi#yGY&i1%AcR4Ih9P<MOF?^+qu4
zo_x&M*wSO;z|5mh=TWlGx&7TQ#IU>gJ}wXs9TfO@5MBqVMkV2C!oILcbLe_43e4%p
zzL6BvVS$w!>>qs}1->)f*GeIX(%|PZXaGE1-a<W!>Z)o<+*f6BtDlR0Tw(SzBD`~*
zunI@KY0>4}8N0$DhcN-i;uT9()(Vlw#^OxT`uKxfcU+$87<X=qqGYt%$zd0A?#<!y
z@G|fflL%8qYN-rglke7efh2_m;GI1SYYlenI8R2RlrSsWmG0ZyNUNkLi)Lpd|H7mj
zXPP)8%jq!N`MSkj#r(<Dyknl`$o#Wa^+H7!Uxt)cJUORCggt9mtEv7_;b#Z}`#<N9
zQWHpcNz=pL<%8*sEAA}YQQ~{a_b+5;e!R4zp~-{`Q0@)`pXC3YKH>~!MG5wl<!BfQ
zVF{3LM53J_Xz?<wRrz@R60y6O)2sw+S2^e{`RPKDRQFdD27_JI{ju48o2$@vb;r%Z
zSZiOBi@w6*o>FqO&m$RoF*9$rGQxm>E$-}o{&+YsbZ;?hdi~k@q^1fkk3!QxF>C#$
z0i~<H#Pcl88MBGM%2`AZ`1M)A0gbylKf|i7$<$lRo9CLnZQHv!2JKlt=rav1dav@x
zjPPU?5D_T5of=ify?Ajbz^K(WqGv(GJx!>IHLGiRoD$BjsPp4L&QiqA>>62bsm-)(
zcR&fNNG+Atz}6ilYySAD3@m_?S}0-hAd8PjXz??S$Epfc_%2*+7elYp9N$2AAgj#(
z9busFiA2>Q_nr1Xil;mu^4zgeyoigQ4wao6rDtUlcVAW;>x5JNOZyQfzyK&VlE}!_
z2F>LKr;TS9Rz24|GV8V<=2WGqzQ`rvEtAAopf~8mYVd)2hA-lI0<c)Y^$lL2ux?zv
zQY$v+Z}XP8ayY<T(MXG_Chn4#!N+rPO)AUwdkh|f_)-HtQx^-nZ0rjht8%?2y^-0_
zp~SGv+#l)K@rJrn?QBD7$W&!%{y~iIoYmjmLEoc=_L#*842v_t>rP|rri^xkTVhZ;
zR9~Hvq;g-;_%=_x>k~Tj@7ZqP90fusDDbvia6{9QrGsVmcFDbcqqmPL;5v{jP>{%A
zfq1}f1Pc`4+v7!eBc2!8zciD9;rsS%e6~!T78%VF-7s=0vSg_)D_y4*#ftV!YxfSK
zRv+^@m0{#)94Cw73rbU6Byarl5B(_?yE&L)ujxsH8QS_Y=igH8Sw31-wRtjy`LJa+
zLd#<TzN0}7ui!L!KrdauO&=Db<J4VCJ;%+VH*o?d6~F5Y82Mha9RHzT)A~pD;F5rY
z&1QW<F5V)+pA#5#I@~Uw>28WVO{>Lv^dI*Uoj<<3lXioZkan5zmazmjvv(uQ3JQEZ
zQa44=PC0=kV~2ipTEz%(nRk}ocqX0SSP*k{?}&MrNp`e_HwV8IfEl!sl(HtD2maoK
zVd#qz_r9O<+`AQgHfv8wi#>D<`2?)<Tj>c<b_xUd=dqYR%(ppW2ktg`mXj>4Y)w6q
zXTIh``@=pZur<^xX&3+&Mzn&kXGMg;TFeK(C6)^XMbUeu+iRGFpt{3PCBW9hz8m=c
zxt;@>T&#EmNmY&=#v_3=;H{g!=TVaV!NmF~Km0e<&_Iee-}7<3kLN{aZqBcLnVGIF
zcEWsGxb(l7GQ-c*ms;c+9VybJJ5kn4`S(35<2T0(d1O2xPwwreZ{djjZs7R|Z$6?z
zNqDrs3vC+E@O=n)pePn>JjT%g=d71SDbRlV#az?vfruuI2K)aWj)EO+H@`uAAa?Tm
zqp>^Ev`3W`ksQpvZAx}3->Vg+R>7_JDLIOffZ#kA!Oa5eW_0Fxz}3_Ac@`#dG^d?`
zJJWAhGizP=OPS~D>0SF;zwMDpy%lXgjZ}OU3}~Gu;GMMS`$r_((Dg`TZM4FEq-5L_
z<`-Z2jI+4+{)-{Y_ejA!+|BX3PeJP#`2S8MJHrTJy9<aT$vQJp?%^6qN2H}-g1Ga9
z30;L`NAjoy_>p_I|9!xF*ccUP{AMH0aCP1Yt9P#LC+D$Pk$aeTO0xvfkEl_1YvX3Z
zz2>zN@dv}%QAGqGN-y4zOPvWic~P42Mc-*z;rb*dQUmVp+28aF^QOhGs;cIA*8+FA
zBJQn``jtT3(Fi%bVC#0{7^I@Dv`lt9Zj}<!RPUL0&H2`8U;w?NcRJj5`Cs<hC$7%(
ztBM_Z)#hfh(Lev}+O2O`Be$|E$sMP{39(Jf;79{z<X@Y$A^dc-{Rubn2JC8~=dY8I
zclIYS=avN;>5qjN+Y=%Yol$c0kE$U9{)AZkDTnt7&B#v^BA!52tvS_OUg?(5)wAsz
zuQYZFi+5GeiN3GzjriAOMLKH;Y(irO*1&1uYep%>H7S<t`l9Q<KXEBaooCIxKk{~H
zVx#d1VQHVi>~MucZ)eXoDw|qEM<#p7_(gmjl!i!iPlv!khMEKQlXt5+GkC8CjnE=l
zgtXXwja;oDf2IAt;GK2NZ=){GuLCo@C&H`>e6}~WRvZLIcXY2g5%kt7Sw=gXdMGk0
zG@<J$Z$RS!`vSJX$9LFiNP<BS!(MAbz|0^vkY%p7MH+uXJ3ckoL8&i0Yso-m+`8sl
zyjg9JxAzFq{PYvzh~onbwC}f<P?(itLyG6Dp0UeHcl-jaMZVn5+zk+9_#vhe_cc`9
z$V@0@-$X!flB6BZ?Q31?_sELU@89uU@$a71`is<81g?$7Oo!k3qZeP{wIXYQ{RYkr
zs4@OqN$@1X<No{e-$dZI)qnfozd87CAN&^v|3SfjNcbNT{)dGBA>scIBy8Xy#>%7D
W$z{*+P_040KUF2I+xZISFa95i8Dww(

literal 0
HcmV?d00001

diff --git a/client/ui/build/build-ui-linux.sh b/client/ui/build/build-ui-linux.sh
deleted file mode 100644
index eab08214d..000000000
--- a/client/ui/build/build-ui-linux.sh
+++ /dev/null
@@ -1,5 +0,0 @@
-#!/bin/bash
-sudo apt update
-sudo apt remove gir1.2-appindicator3-0.1
-sudo apt install -y libayatana-appindicator3-dev
-go build
\ No newline at end of file
diff --git a/client/ui/build/config.yml b/client/ui/build/config.yml
new file mode 100644
index 000000000..08b95b6bd
--- /dev/null
+++ b/client/ui/build/config.yml
@@ -0,0 +1,78 @@
+# This file contains the configuration for this project.
+# When you update `info` or `fileAssociations`, run `wails3 task common:update:build-assets` to update the assets.
+# Note that this will overwrite any changes you have made to the assets.
+version: '3'
+
+# This information is used to generate the build assets.
+info:
+  companyName: "NetBird GmbH" # The name of the company
+  productName: "NetBird" # The name of the application
+  productIdentifier: "io.netbird.client" # The unique product identifier
+  description: "NetBird desktop client" # The application description
+  copyright: "NetBird GmbH" # Copyright text
+  comments: "Some Product Comments" # Comments
+  version: "0.0.1" # The application version
+  # cfBundleIconName: "appicon" # The macOS icon name in Assets.car icon bundles (optional)
+  #                               # Should match the name of your .icon file without the extension
+  #                               # If not set and Assets.car exists, defaults to "appicon"
+
+# iOS build configuration (uncomment to customise iOS project generation)
+# Note: Keys under `ios` OVERRIDE values under `info` when set.
+# ios:
+#   # The iOS bundle identifier used in the generated Xcode project (CFBundleIdentifier)
+#   bundleID: "com.mycompany.myproduct"
+#   # The display name shown under the app icon (CFBundleDisplayName/CFBundleName)
+#   displayName: "My Product"
+#   # The app version to embed in Info.plist (CFBundleShortVersionString/CFBundleVersion)
+#   version: "0.0.1"
+#   # The company/organisation name for templates and project settings
+#   company: "My Company"
+#   # Additional comments to embed in Info.plist metadata
+#   comments: "Some Product Comments"
+
+# Dev mode configuration
+dev_mode:
+  root_path: .
+  log_level: warn
+  debounce: 1000
+  ignore:
+    dir:
+      - .git
+      - node_modules
+      - frontend
+      - bin
+    file:
+      - .DS_Store
+      - .gitignore
+      - .gitkeep
+    watched_extension:
+      - "*.go"
+      - "*.js" # Watch for changes to JS/TS files included using the //wails:include directive.
+      - "*.ts" # The frontend directory will be excluded entirely by the setting above.
+    git_ignore: true
+  executes:
+    - cmd: wails3 build DEV=true
+      type: blocking
+    - cmd: wails3 task common:dev:frontend
+      type: background
+    - cmd: wails3 task run
+      type: primary
+
+# File Associations
+# More information at: https://v3.wails.io/noit/done/yet
+fileAssociations:
+#  - ext: wails
+#    name: Wails
+#    description: Wails Application File
+#    iconName: wailsFileIcon
+#    role: Editor
+#  - ext: jpg
+#    name: JPEG
+#    description: Image File
+#    iconName: jpegFileIcon
+#    role: Editor
+#    mimeType: image/jpeg  # (optional)
+
+# Other data
+other:
+  - name: My Other Data
\ No newline at end of file
diff --git a/client/ui/build/darwin/Info.dev.plist b/client/ui/build/darwin/Info.dev.plist
new file mode 100644
index 000000000..78f5a7b1c
--- /dev/null
+++ b/client/ui/build/darwin/Info.dev.plist
@@ -0,0 +1,38 @@
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+    <dict>
+        <key>CFBundlePackageType</key>
+            <string>APPL</string>
+        <key>CFBundleName</key>
+            <string>NetBird</string>
+        <key>CFBundleDisplayName</key>
+            <string>NetBird</string>
+        <key>CFBundleExecutable</key>
+            <string>netbird-ui</string>
+        <key>CFBundleIdentifier</key>
+            <string>io.netbird.client</string>
+        <key>CFBundleVersion</key>
+            <string>0.0.1</string>
+        <key>CFBundleGetInfoString</key>
+            <string>This is a comment</string>
+        <key>CFBundleShortVersionString</key>
+            <string>0.0.1</string>
+        <key>CFBundleIconFile</key>
+            <string>icons</string>
+        <key>CFBundleIconName</key>
+            <string>appicon</string>
+        <key>LSMinimumSystemVersion</key>
+            <string>10.15.0</string>
+        <key>NSHighResolutionCapable</key>
+            <string>true</string>
+        <key>LSUIElement</key>
+            <string>1</string>
+        <key>NSHumanReadableCopyright</key>
+            <string>NetBird GmbH</string>
+        <key>NSAppTransportSecurity</key>
+        <dict>
+            <key>NSAllowsLocalNetworking</key>
+            <true/>
+        </dict>
+    </dict>
+</plist>
\ No newline at end of file
diff --git a/client/ui/build/darwin/Info.plist b/client/ui/build/darwin/Info.plist
new file mode 100644
index 000000000..1e12b049b
--- /dev/null
+++ b/client/ui/build/darwin/Info.plist
@@ -0,0 +1,36 @@
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+    <dict>
+        <key>CFBundlePackageType</key>
+            <string>APPL</string>
+        <key>CFBundleName</key>
+            <string>NetBird</string>
+        <key>CFBundleDisplayName</key>
+            <string>NetBird</string>
+        <key>CFBundleExecutable</key>
+            <string>netbird-ui</string>
+        <key>CFBundleIdentifier</key>
+            <string>io.netbird.client</string>
+        <key>CFBundleVersion</key>
+            <string>0.0.1</string>
+        <key>CFBundleGetInfoString</key>
+            <string>This is a comment</string>
+        <key>CFBundleShortVersionString</key>
+            <string>0.0.1</string>
+        <key>CFBundleIconFile</key>
+            <string>icons</string>
+        <key>CFBundleIconName</key>
+            <string>appicon</string>
+        <key>LSMinimumSystemVersion</key>
+            <string>10.15.0</string>
+        <key>NSHighResolutionCapable</key>
+            <string>true</string>
+        <!-- Accessory mode: tray-only app, no Dock entry, no Cmd-Tab
+             presence. Matches the legacy Fyne client and the sign-pipelines
+             Info.plist used in signed .pkg releases. -->
+        <key>LSUIElement</key>
+            <string>1</string>
+        <key>NSHumanReadableCopyright</key>
+            <string>NetBird GmbH</string>
+    </dict>
+</plist>
\ No newline at end of file
diff --git a/client/ui/build/darwin/Taskfile.yml b/client/ui/build/darwin/Taskfile.yml
new file mode 100644
index 000000000..8a5c27bdc
--- /dev/null
+++ b/client/ui/build/darwin/Taskfile.yml
@@ -0,0 +1,210 @@
+version: '3'
+
+includes:
+  common: ../Taskfile.yml
+
+vars:
+  # Signing configuration - edit these values for your project
+  # SIGN_IDENTITY: "Developer ID Application: Your Company (TEAMID)"
+  # KEYCHAIN_PROFILE: "my-notarize-profile"
+  # ENTITLEMENTS: "build/darwin/entitlements.plist"
+
+  # Docker image for cross-compilation (used when building on non-macOS)
+  CROSS_IMAGE: wails-cross
+
+tasks:
+  build:
+    summary: Builds the application
+    cmds:
+      - task: '{{if eq OS "darwin"}}build:native{{else}}build:docker{{end}}'
+        vars:
+          ARCH: '{{.ARCH}}'
+          DEV: '{{.DEV}}'
+          OUTPUT: '{{.OUTPUT}}'
+          EXTRA_TAGS: '{{.EXTRA_TAGS}}'
+    vars:
+      DEFAULT_OUTPUT: '{{.BIN_DIR}}/{{.APP_NAME}}'
+      OUTPUT: '{{ .OUTPUT | default .DEFAULT_OUTPUT }}'
+
+  build:native:
+    summary: Builds the application natively on macOS
+    internal: true
+    deps:
+      - task: common:go:mod:tidy
+      - task: common:build:frontend
+        vars:
+          BUILD_FLAGS:
+            ref: .BUILD_FLAGS
+          DEV:
+            ref: .DEV
+      - task: common:generate:icons
+    cmds:
+      - go build {{.BUILD_FLAGS}} -o {{.OUTPUT}}
+    vars:
+      BUILD_FLAGS: '{{if eq .DEV "true"}}{{if .EXTRA_TAGS}}-tags {{.EXTRA_TAGS}} {{end}}-gcflags=all="-l"{{else}}-tags production{{if .EXTRA_TAGS}},{{.EXTRA_TAGS}}{{end}} -trimpath -ldflags="-w -s"{{end}}'
+      DEFAULT_OUTPUT: '{{.BIN_DIR}}/{{.APP_NAME}}'
+      OUTPUT: '{{ .OUTPUT | default .DEFAULT_OUTPUT }}'
+    env:
+      GOOS: darwin
+      CGO_ENABLED: 1
+      GOARCH: '{{.ARCH | default ARCH}}'
+      CGO_CFLAGS: "-mmacosx-version-min=10.15"
+      CGO_LDFLAGS: "-mmacosx-version-min=10.15"
+      MACOSX_DEPLOYMENT_TARGET: "10.15"
+
+  build:docker:
+    summary: Cross-compiles for macOS using Docker (for Linux/Windows hosts)
+    internal: true
+    deps:
+      - task: common:build:frontend
+      - task: common:generate:icons
+    preconditions:
+      - sh: docker info > /dev/null 2>&1
+        msg: "Docker is required for cross-compilation. Please install Docker."
+      - sh: docker image inspect {{.CROSS_IMAGE}} > /dev/null 2>&1
+        msg: |
+          Docker image '{{.CROSS_IMAGE}}' not found.
+          Build it first: wails3 task setup:docker
+    cmds:
+      - docker run --rm -v "{{.ROOT_DIR}}:/app" {{.GO_CACHE_MOUNT}} {{.REPLACE_MOUNTS}} -e APP_NAME="{{.APP_NAME}}" {{if .EXTRA_TAGS}}-e EXTRA_TAGS="{{.EXTRA_TAGS}}"{{end}} {{.CROSS_IMAGE}} darwin {{.DOCKER_ARCH}}
+      - docker run --rm -v "{{.ROOT_DIR}}:/app" alpine chown -R $(id -u):$(id -g) /app/bin
+      - mkdir -p {{.BIN_DIR}}
+      - mv "bin/{{.APP_NAME}}-darwin-{{.DOCKER_ARCH}}" "{{.OUTPUT}}"
+    vars:
+      DOCKER_ARCH: '{{if eq .ARCH "arm64"}}arm64{{else if eq .ARCH "amd64"}}amd64{{else}}arm64{{end}}'
+      DEFAULT_OUTPUT: '{{.BIN_DIR}}/{{.APP_NAME}}'
+      OUTPUT: '{{ .OUTPUT | default .DEFAULT_OUTPUT }}'
+      # Mount Go module cache for faster builds
+      GO_CACHE_MOUNT:
+        sh: 'echo "-v ${GOPATH:-$HOME/go}/pkg/mod:/go/pkg/mod"'
+      # Extract replace directives from go.mod and create -v mounts for each
+      # Handles both relative (=> ../) and absolute (=> /) paths
+      REPLACE_MOUNTS:
+        sh: |
+          grep -E '^replace .* => ' go.mod 2>/dev/null | while read -r line; do
+            path=$(echo "$line" | sed -E 's/^replace .* => //' | tr -d '\r')
+            # Convert relative paths to absolute
+            if [ "${path#/}" = "$path" ]; then
+              path="$(cd "$(dirname "$path")" 2>/dev/null && pwd)/$(basename "$path")"
+            fi
+            # Only mount if directory exists
+            if [ -d "$path" ]; then
+              echo "-v $path:$path:ro"
+            fi
+          done | tr '\n' ' '
+
+  build:universal:
+    summary: Builds darwin universal binary (arm64 + amd64)
+    deps:
+      - task: build
+        vars:
+          ARCH: amd64
+          OUTPUT: "{{.BIN_DIR}}/{{.APP_NAME}}-amd64"
+      - task: build
+        vars:
+          ARCH: arm64
+          OUTPUT: "{{.BIN_DIR}}/{{.APP_NAME}}-arm64"
+    cmds:
+      - task: '{{if eq OS "darwin"}}build:universal:lipo:native{{else}}build:universal:lipo:go{{end}}'
+
+  build:universal:lipo:native:
+    summary: Creates universal binary using native lipo (macOS)
+    internal: true
+    cmds:
+      - lipo -create -output "{{.BIN_DIR}}/{{.APP_NAME}}" "{{.BIN_DIR}}/{{.APP_NAME}}-amd64" "{{.BIN_DIR}}/{{.APP_NAME}}-arm64"
+      - rm "{{.BIN_DIR}}/{{.APP_NAME}}-amd64" "{{.BIN_DIR}}/{{.APP_NAME}}-arm64"
+
+  build:universal:lipo:go:
+    summary: Creates universal binary using wails3 tool lipo (Linux/Windows)
+    internal: true
+    cmds:
+      - wails3 tool lipo -output "{{.BIN_DIR}}/{{.APP_NAME}}" -input "{{.BIN_DIR}}/{{.APP_NAME}}-amd64" -input "{{.BIN_DIR}}/{{.APP_NAME}}-arm64"
+      - rm -f "{{.BIN_DIR}}/{{.APP_NAME}}-amd64" "{{.BIN_DIR}}/{{.APP_NAME}}-arm64"
+
+  package:
+    summary: Packages the application into a `.app` bundle
+    deps:
+      - task: build
+    cmds:
+      - task: create:app:bundle
+
+  package:universal:
+    summary: Packages darwin universal binary (arm64 + amd64)
+    deps:
+      - task: build:universal
+    cmds:
+      - task: create:app:bundle
+
+
+  create:app:bundle:
+    summary: Creates an `.app` bundle
+    cmds:
+      - mkdir -p "{{.BIN_DIR}}/{{.APP_NAME}}.app/Contents/MacOS"
+      - mkdir -p "{{.BIN_DIR}}/{{.APP_NAME}}.app/Contents/Resources"
+      - cp build/darwin/icons.icns "{{.BIN_DIR}}/{{.APP_NAME}}.app/Contents/Resources"
+      - |
+        if [ -f build/darwin/Assets.car ]; then
+          cp build/darwin/Assets.car "{{.BIN_DIR}}/{{.APP_NAME}}.app/Contents/Resources"
+        fi
+      - cp "{{.BIN_DIR}}/{{.APP_NAME}}" "{{.BIN_DIR}}/{{.APP_NAME}}.app/Contents/MacOS"
+      - cp build/darwin/Info.plist "{{.BIN_DIR}}/{{.APP_NAME}}.app/Contents"
+      - task: '{{if eq OS "darwin"}}codesign:adhoc{{else}}codesign:skip{{end}}'
+
+  codesign:adhoc:
+    summary: Ad-hoc signs the app bundle (macOS only)
+    internal: true
+    cmds:
+      - codesign --force --deep --sign - "{{.BIN_DIR}}/{{.APP_NAME}}.app"
+
+  codesign:skip:
+    summary: Skips codesigning when cross-compiling
+    internal: true
+    cmds:
+      - 'echo "Skipping codesign (not available on {{OS}}). Sign the .app on macOS before distribution."'
+
+  run:
+    deps:
+      - task: common:generate:icons
+    cmds:
+      - mkdir -p "{{.BIN_DIR}}/{{.APP_NAME}}.dev.app/Contents/MacOS"
+      - mkdir -p "{{.BIN_DIR}}/{{.APP_NAME}}.dev.app/Contents/Resources"
+      - cp build/darwin/icons.icns "{{.BIN_DIR}}/{{.APP_NAME}}.dev.app/Contents/Resources"
+      - |
+        if [ -f build/darwin/Assets.car ]; then
+          cp build/darwin/Assets.car "{{.BIN_DIR}}/{{.APP_NAME}}.dev.app/Contents/Resources"
+        fi
+      - cp "{{.BIN_DIR}}/{{.APP_NAME}}" "{{.BIN_DIR}}/{{.APP_NAME}}.dev.app/Contents/MacOS"
+      - cp "build/darwin/Info.dev.plist" "{{.BIN_DIR}}/{{.APP_NAME}}.dev.app/Contents/Info.plist"
+      - codesign --force --deep --sign - "{{.BIN_DIR}}/{{.APP_NAME}}.dev.app"
+      - '{{.BIN_DIR}}/{{.APP_NAME}}.dev.app/Contents/MacOS/{{.APP_NAME}}'
+
+  sign:
+    summary: Signs the application bundle with Developer ID
+    desc: |
+      Signs the .app bundle for distribution.
+      Configure SIGN_IDENTITY in the vars section at the top of this file.
+    deps:
+      - task: package
+    cmds:
+      - wails3 tool sign --input "{{.BIN_DIR}}/{{.APP_NAME}}.app" --identity "{{.SIGN_IDENTITY}}" {{if .ENTITLEMENTS}}--entitlements {{.ENTITLEMENTS}}{{end}}
+    preconditions:
+      - sh: '[ -n "{{.SIGN_IDENTITY}}" ]'
+        msg: "SIGN_IDENTITY is required. Set it in the vars section at the top of build/darwin/Taskfile.yml"
+
+  sign:notarize:
+    summary: Signs and notarizes the application bundle
+    desc: |
+      Signs the .app bundle and submits it for notarization.
+      Configure SIGN_IDENTITY and KEYCHAIN_PROFILE in the vars section at the top of this file.
+
+      Setup (one-time):
+        wails3 signing credentials --apple-id "you@email.com" --team-id "TEAMID" --password "app-specific-password" --profile "my-profile"
+    deps:
+      - task: package
+    cmds:
+      - wails3 tool sign --input "{{.BIN_DIR}}/{{.APP_NAME}}.app" --identity "{{.SIGN_IDENTITY}}" {{if .ENTITLEMENTS}}--entitlements {{.ENTITLEMENTS}}{{end}} --notarize --keychain-profile {{.KEYCHAIN_PROFILE}}
+    preconditions:
+      - sh: '[ -n "{{.SIGN_IDENTITY}}" ]'
+        msg: "SIGN_IDENTITY is required. Set it in the vars section at the top of build/darwin/Taskfile.yml"
+      - sh: '[ -n "{{.KEYCHAIN_PROFILE}}" ]'
+        msg: "KEYCHAIN_PROFILE is required. Set it in the vars section at the top of build/darwin/Taskfile.yml"
diff --git a/client/ui/build/darwin/icons.icns b/client/ui/build/darwin/icons.icns
new file mode 100644
index 0000000000000000000000000000000000000000..fb78a18a98a10de8864b2652083800a679808444
GIT binary patch
literal 141191
zcmeFX<wKO;_XRo#f{K*VAqq-}bhnZM0s_)8<j@^M4~hsMQo2DzKstu5A*30)1{gxR
zJBFCKgWr4qiu-%@JTK-sXP<S}T6^zv#@52g9dM5|)YgKR2LL#d{qLiiBGDt-M*skT
zNa?+tCIEnkeZ>Pjz{fry3>?7#KoCGl?%gNvj9sLCq!q$v;bOzs{vcqe&=9Qcd3MVu
z5Sr9g%dW-w4fOK0+)uouCwe^J$ugQ4@T%kA%KUl%{b|5Q-k@C(VshCppTpihUsaKE
zdBaLc&+(Bw#nt08dF)TCC}s_2-^K##M!zeAY4<t%mUhI(C*U`DDhmQRseO%M)@$0H
zC@eD;)NVSzE~#0dxC;>gAeOxM?+Gvn`rk8%^7;Q>e%ycXzZV;v|N9Ac1OE?~J39Oy
z8SYT{KQi2*@PB0Zhr<6)$-s7geV0OltlOupgN>bm;qXc*S+(}uWXuGmFf_3#0>09-
z9=CUpdQYUnceLhXy;Ey#adupK-^F#p0wI++_FMYbt>{9TMw;3pRM%3Ie5N?zI~_T?
zH)%3t&Cnl9dF%{*Wn*99d8>nw_YeP=KaRJX9cPPCt!>eok=7VRN}WH2wL1E`$^t-l
z`>+(^1$haiB1Aq*YlR9SOZTSEP)vib2n`-gDN%;%%(5B6W(pOgfTs#g5uO!%1_o~u
z!z(*t**Lyz-}hnT+zvC!8{9BAwS5!BDo}WPvbtnzS!;n1J245(yp<|veS0@Y5S5PB
z4Y+k9EZoTH0zB1Wps`k*X%(+~qH^Xow7?$WV&sI>IEAJ~Ab%WHM*AfWxN+70tl|cB
zQ6n4qVsdO0FsdNlG)u1B8-l|>gTMOMG-1pbqKg~QYy7}n+_OXZXSY;1cN3jQloyZ8
zRSB!X$Rna=hq5xbCsgw5{9FgR&0KTXJ|(zX`&rb)y-w$tPH-!De-<9{QGcXL-t)~)
zy$Z6!Lq}70jF+EdEiIlSO@Dgurv#W)8>YVhS@n^WG0_~o$)=$ffIGZJ@RVzSOP)Q(
zh}Ij{+c+1nT>kR(Zt^zwwesdCKxtG{SL!6x-h!w}n^#O<Z*w<)ls(=vcdJCn9pTx&
z+CtqKu97&P{EEV=x~wmF@R7aFvcX4w=4ll$KRZD-`IQvIH24DaamZ@iHSl7~kq6uX
zXvKlQvhdaJ;|=xWGNx;~^}P5CM>U^d5LfoOw^BV9osaJVkkG!E-dzlAn9y--tS3(l
zHG={Z@?AHnfLj@*RQ;|qA{6GE-)7bQ4xO}T{>x~gA|GztXkatu2`T$U;hq@Bnf3-W
z%)k#7p=+O(WxfQJ?H-ivI%?hsa|ejI35$<zpp0=`sP){D6&X-x5UQnW6ZyvC;+*OV
zmU(eKpM}@Jij5(QHv7|b_U+}*Pr6N+S4OmRMjA7P839s_0V5wyM0bKg3+}e?4-85J
zEL}wz(VKo%o5xF<%kkol7od^XO<$0VqjeyfeP+R%r<A7?w}4if_#JiauYK~C?z?DM
z{gzux&6zZ(hY8Gnr|9DPCJT@MZsCVS4bmO3W4A)_8e7NKkF?)P#TAP(hrj*YJd43o
zH;x)0d}qt0=lZ%^BzfoRl}}0xXahMBZ!cKiPw%e;dgs&l*$et2d+ygrc0l*miXZc(
zpM_qk^0PK~a}pN1D0uThpVP~&?v7EBifj?;F4(^U?=b4HPtxU}X`}8cSnVQus9@=&
zv6L|1?nU>F89V2y#-*vwW~x1>-Wv{Rv_5e|Sf21&0M|S`ZsTV|-q54?u|P}cJxstO
zzwJQ4aJ=9(TDaZ9xZozgsjP7gLjJ4nR2)*@w778*_55yuZ5Df;Thm)Ac>)jOUb9nn
zRtHpTbvsF_aa&FM7esEjP5l&9y>@ta?9R8N+&cDV5=@acG@INYDd5JKz(|X*mSb#-
zu&cFx-|qxQ-guRGmgnv#NtOG5r<{6vH~f<Qhj7g2){WCk4@lYTaRO+OygJ(YL+!6$
zBm*bS^5XjMtsZZaYrL@1<|5oTsc%{X5y9*e@~zO*bdA!anNUFWn5-5CI$x^{g=JeM
zgRd@}JbW=8bGxRh%1n0?*oXpQdRyls9zr@7SDoIUR1$rQy65ILWKL10%gqf*Ra+ga
zn`5G>@V)@m9Gc~rak9W<R5c-{)BgO{zVR5hE#d&3Xzylr!sCI8o_F?+K6sN&9kt6(
zzzuu(Z+v#hTH<e1`dS5eLq=@W_;K#`u*ct<(a$%zLRDQw{ZxY`ba@nnugPWBG~Z`&
zfc4K=>6QtCf{WgymHo<1I8}$vCAunOhV>@ThOEno&#&iOY5o=ZoXa~@#lqE3O~(FH
z4n}(WEpxaNdhXl&a?h_PmuX!Z(^zwPkwO_arys9f)x25df>|{C%Gmb8nq=x$oy)^B
zZqZ|0-1U<Kr%nqpnAYdXU99wO@Y(<l?&LYTOzFzMuC_*zt>Y2(5*z0l+<$-eam)D>
zJT_B0W=a=kzFlwdNL8rmI5oK#y+-2tTo3}(&C>whnF4OpnXkKbjlI@<F|#cw*ijcQ
zbZ@bV?BDQwXe>|miFc>KlbJuIBgNAWy2T6ac{2%L(DM#cS=P>b?16zi&~cDXW3zo#
z3;Z&T>vnuP!<_N0eag9xV1r_aqp;&dl5<*@p>+(s(%9s!RF^aDoxQfb_`CD^Tc%4{
z>xjM{Z4zX5<;G11?d~)g+p#O_cF;vlwPupCHnb{KH`I`ju9>zsc~NGU{g?6WoQKR)
z+*8FG%%Xmv57_S_8;KmOlR9-TkGVtoe=QY3!hx#hZK}FQg4Y+X{;crErvcsyk5pc4
z%jlTY(sSY2_94}U?XT7{w=Sm^3<4{Y7y-|a=iI6Go5yteffh9xbE4<&z-RjxsDR>s
z0ww;TbOhOP4!Drnc0P+fRiu*qlSn$w8XUSNwj=&UfGU@hz-J4d7D(cmMX%a<b;NuN
z7y+psF{*-;S4za){F>OdVT?w)XP_D=R)+$l|G*`M&!UGEMz-y&?KjuVXH8Vw*I&U%
zjW}40zx#{oi7;3i>zbs@_pf6G!aGI+ILK`fYphzO<ARCzPcm?KwruZX{FcsdAoO>=
zVGwTHwDx1Mwbbv)NeWVz3wpCf)90@I4D72^t5Xj{d{sAEcN6_;N2m42NdVr>Ht@$m
znMb{toB^)kwRXCzV|%*uqOrj2x$(Dmu^pQ8VGzk2lfj2m@Q?;$pMv9dn)v8$Qz|0^
zqWqIMPL{2&eGxo!HDZ2QQ#a7tD;&VVUVAeeW8dU3XnL)Y%hp3L9P*Ds&E7XB<$vrk
zH^rGpN$3PyS0B#>^rVe}Dngp&qRWI#*XXs@`xaX&2scXzT12|hn6XP5&<s;L0+OrZ
z@s!zLQ|$*%4%~1os5tLT19uKCP?D<u)O77oo{p(GQ$f0c#rM&px>V~w*Ch&09@Rei
z!d34-*^DTMaB*;}UF<-rBQQC7KOO<DSsQL@RfH{sojr6qYE2}Kl6C$e7a+inUc3xZ
z_e{F3^WzX62e0KdScK$3S{~G<<w-jpo3I;xf5S4s07kIEDbKHOA-I4;Ri1QJ%y1Fh
zW7r6`SvHUvbrT(UT7&GIk`KAVZ%OpT^L`7<IP5gGY|P8`v@|NW@&VzC)e{y&{w~6}
z(v*UDc<b#u`07N4wfz;6WSW5;u#21C;?h7s7|>UT-20|~6n*0qF!TSSC;{Aw{|jUU
z&fI>K%*Ljb(d1}PWb5#DMVu<5kk4=l3i7^BJicjI!`I_CW&{~~uT6?wHpS>uXy+;{
z9a;XT;+hV*Vkms7yND%qgCyZU1cy_aK4d4_qM0T4zPhOduQVvDAm>F7#;^s%F+?Dp
zF}Y--q_+-13n}<Z5LD2=4@PGjnYDP;fve_-hR>qQS|mjxb20xs*}K-L$`FGDbDs*N
zk#vr-%B=MilLx*9aaav9didx%N%qMqH#pE<uWe;+<TPL71yQ|AQM*-t=Jl#+RKr)W
z+go0x)=b*1o)#k+`42z#xt(puiZkTbMYkH8`q_0)+;-lNzh4>{lW&ap|8ke6mK=hk
zE*WRV)dAi(Gr?2{WZhcrmWHtQ`rOqmbLiER4|l^HlB<SeiltBf+mC&hCf;a>8BqMm
zsCy{QNTCz41X0$UR(0nJX*~aH%t#3ECKjW7d4Zm})rH<1w`7hoHfx2<QAuB{9br`g
zmHXdt0=a0|p{8P!cvoc|L2=H92+D|)^=0o;k9Ny}xM-!<7v~35^3nhaT|aw_aS^A@
zQVr5&tGhC9d4Cp&*|vcVALujRjpR)`1>AOM@wu@GL8W>2NN-Y3nV-hg`<I<=g<<N?
zkC#buE(wA*3fR#W{1?(u&_$1}(#8?)JSL;Py{yI9*2cwx%fWy8@{dPvh649JBHoF(
zt^T=rYx{yNbKv-CBEqLn$JhsMNx_W9syW3IJuEuc@&;z{VxGv%RrabQ$K)CodKb!4
z`VuxRX@K|FN_=a2uiimj<~47Tag^cI>#t%uXE`KOoRp790N0kz+mMuJb<i!w_g+4M
zJ5%Xb$H_u_lU}F5SN~QdgAV_hL~+W>1!sTkEA?T+(g6B>*spelMchnNSoMH+YnueX
z4M=A&mTKT4S*zVq7XIKRdo~)|;`?gvgk4JbA0^e>rYXvFvyJ}C&15EAId#U@E{J34
zae4WE!0C0|L|^>%fUnrpa2VDhsKbB$hoewfEA4h6tTj>I=vijFTz7pP;57X7UwZMg
zX}rel#SA)5m~cje)qU4Elp9UgS%W(YpL4SPw!=?4zKy{FG@E`%syZ%xgEZRo5<1;0
zp1b<&WnA^}Zb7ZY7!)@5**SqX7Y%)-Xk^h5>wzV2ItX5RDzL+?Q;B+<e1DHJ0+zZ=
z{Z24Yg}D8Rec0xHvZtfBB4&*{ro<|h^Is%Qmj&F3w8-e$2a1V`Dx)htx*}G`&^XSf
z>No5Q2dn{*5O%<lycv{=WjO8(>M!1ir1onrJW2PQ`~Sqh4VEg^<lbq%>D?YOJw1?z
z#`9jWzT`~tU$8PuaC69-Z!}Z{i0BoKoLVwO$6>s@nx2T|E*gkco<yVj>99q8-R;}E
zB^eA`i_0PPAwD^A;GNOU$ot|ZdLqtMPvfRudLA5X986%T!UPRHzY(@wbvm$|j%vv8
zI!#`ro(0-&SY_OeP(AzW5_W!)?0Yoj;)-a*d{Zh=@Vs><K)A6AbwNb?8&-w_(Et}x
zfe;A);eqH{Mdq6DYdTn3a0}|H#`jv5(+MH-FOq?2Zk;itIjSr=?-Q3{>agF`mZ_Im
zZ&DRXW?aV3tGM@W7@iO5nAE20{Jw+z^<%Z#zxxBlu<0~O4C6oIR>wiEG#e;-7(W^q
z7Hgs}1~ysYdn=$ctwYh|P}kCY#ZUI3;ee%}qBkG7mc)ZI0$-^lQ@P)U`p)goZhShp
zXxL-Dv;UFTT!>QGnIoa_)rD`d&vNyBX<jd59>N~DzkZe4dCNOUI0PW_{(K7E#1hg<
z@~Vkz+|$<DG}|wrd2yp|@vc00Yu{WOSlRfRlb+G5bvSn@k`t3>TB~_KGp?Dsz^Flb
zW-R6}BY-%%Z&LivI;}|z6t;I<*ZmrEvASmHes#Pbn7tSgbO#H)FUH%r3o#e2IItgX
zB~2@l4W6bU@tU<%H1bj7b9Z*NW&?=eor__b<`|NZRUa4mcN~iHqayBtXfxX=XDhl{
zo!zvAOuFAPrfpR}3h1{a<h_=#zr|TvnoGZOW)VhAiR>iDdH7V$c&h|2BC9;_0q$%h
zsI&i7(-psU6IfBZMq);i;wR(q=urAj!Y}RkMx~N7Y<atn?%;G!4mC^iq8JkdH<h&?
zr~JkIJC=44DTPgliW*#}<axM#%!fIEdN{VMQau&6+FQ})rP2U;Z!0p(V-4dS!Q_RE
zc#K72muDXLU14nU@=o<jBPkQ7<*h#t`@3R>RdPdS$3^4S6cIG;rM?ySm0|<1(Ytu_
zoWX3D4VrH9RfH{TOWS`8Z(?%)EqnP0x(E!woS)@YDnQzi!>`vMid9yGVodt<1@xI@
z*u9f*@Ksf>!3y*x32f6TxyJh>I$#}Z#_9+1ve@YX#LfAm+2r8s^y1@sb15lqLhE3U
zdCLf?rVZButP6K`?86S<)EOt&TA~=Vn)BeyN{x5^+wtP=V*;!q7Ev<=Q~k|QyG|rV
zByH#qpZ^$=Qh}XYs4mp@eEwESAJC>X`S6_^W27-`eauS55V&2snSa~66N#3_zw-!@
ziW{tl|E4OotMFqolp-S(w=UB{1jrwk!5eS1E^*tItLn}d*AQP6d@>gM#>Cw-7ou-_
zrRlH*YRm6`D12VUns`%QfMKr~0y+vL1hM9xn%OtrTr(S^aR8x;?v5nmf2G%4rt|C@
zdSNM6&UPu_^XnTE%YPg2)^__U8#XaFJDZli16KE|7<bEzx5w6_>1SvU6hV-zBkiHV
zkf?LxO_`4;>-yg;sT)IE*zlgb!W{&}3HCe5zKUfVki3Z-+n6i$!5W<uwT43aJPF71
zx<%H90Pp;MQp>TS_g7ZJ#`{sVXuYd`$?F$nfM$X_1-d-1A2>zCaGy^Ck3VK4UhBuJ
z-AB09&U@;UVuN4$=vQ$LwCE$qcR|jV6<f<*Kb*V{2;>&K`}DBmWEl2D7(FMgx1Ep+
zvw5`fXbl3^yktdH4allJ;=0>ESqII_o*9Q5;B;Sk{q>}TGA8tAOCC37`A&E5-eN}q
znCQWMF}mcnW&WNGbSqWUfl?`%{3n9RNiQSDxiI7yzzF_$3r5nXR(#)!Lnp9Y3+}k3
zJ=-er@Lvovv-aoHFnw+?K1!NrTtDJGIF2(fgUaZUpSCo%n5B2RC_tybiWho`0YW_*
zl53rRW7Zf})Z3r_BM>(|P&Z}1;MDosBvW#a8$IxQ2TgpEu@r0?>wS^{k(={c4^MaD
z={93=_A5`H`kbcV%3BgFbJ+hkc`79)+dy;PK${k`A-d^6(Q%<%%cE>Ngq&Gq1Q_IF
zn^H`t#vW{AED@!4#hO;`yvbUAr#<4hip9G_mWm#r#snR=cBi*<Y3<dg2VO&iL+`!*
z<oPrR)<8g~*fHAohXF3&;hNNi*sbm%Z)-#Q^0U+{OqAK()tdJUY`dS%cs*kfdonvO
za_gcaqNQ*v+PAJC3eMm}1AYXg;kC7>nXzrv>ZASEm-}yKglA4Lbc%PlpCb?auQYuu
zY>hne&;B#rO3-(mvMjLld8fJdAJ#EvyFuJWZt>1d)iinO+9RcqGM}ki$kTs>Z$0*;
zFxbp^#wxy?dlb|7H<js1@#R5uoUVC<G{B}*?ExRk33kqHiCQa*3RKT^x&Hg_c&jcr
z>~7*+I?QRFCas46btW59og_F@aO;<)J6EC`*6VF@ujkN8ea5+_fyT!>7u}iY<EvzL
zG)(DEDyG1jp#tq~tIYD9<5jjvY05#hWDsMLzO~WDnC&S6pmc&9({7nBpcZI2HfM5$
z(NWQjG5Jp%OIQM$JEeQ?n;63MGAAnL%Ey%&ve^gKRK#9D_gB$h@77zYk2&a%bFRN}
z8k)=;iMa5%sMEW~a6ZR=2pCSpraRHdEtykqzO}=rESX$iAiZ!g&rEi#z{5d&w$^&r
z(t}k4C!Uz9*3;Q<Ey^1hXZe|fyF;11(Grw&Bhr(EwddI|{)txmjknNF!=GyGVnv%U
zX)#6%$ss%MmakN8<&H3=7XS8@%ip+5fi;7$5M0HFseCSO@dA==nfYnsJ+>I!6Jke4
z{QM8leWnNWL`~)#V?<w%&Go=;3?SGNm&f$q0P8GW7}ZkG;)H0hWx>3sLD>q+PQ^MS
z;P8R28_E%ktj-W_el+K+U2+R~lyZknR-w|7^k(4jR*0_)pZAq(-w?Sx+Dj?3(F?mP
zL4zP9#@Hf$zY)dFGQP&l4s&1a0nQ1cKS@vw{=;YR*X8v2e`@E;4@m-Ne~t4=zfiy;
z!!P8wyzW%h`e6>S_s#Gqx>`%?Mq2WJUwnm_RALg<GY;2A|NE|(&07bp9Fgy9jJ&}G
zJktqz9*^JYiZ%wr_!t#oWeug^)70WlY%SIK6#%%Tyfn!jJ3}1RAddd-UY_S|9i6s4
zL$%Gx`dJj$CbvRekcE3hO5E5?p&>jh?&ow>ZJ*Bi3{|fMU5VPOl-&1M^M`XlHx|7Q
z%2)o#jC&hS?@RLq>`f@7ETl8C`ybHPXkO9*i}v!mI%;NpP8V+X_D}c5fv1RzPU}UI
z?11bvW_B)@OB6@=6&#w#xG4Dyn&}q8&zC7ss8R<3v^{HDL@gR0`?~GCMtFLTW1G|M
zHmT0+h=Q$3dAy(=_w3st|9#CId)y{o#(|X3<r!p+jL;)7vygs=;JSgKRgpBh1fe%y
zP)@u$j|m&-DCWIn!;_G{@{jwS=JfOK*M%6R3_7xLu*87F={2(ghu8|sKmB3r(s%&J
z1zm85^&tn{5)@U6WItu>$D8*BC)>J3J_3$Qyn4m%)$A0FkibW|xNQ-wySkAPuLmbU
zt8Q$D6_nT08@%LC7V3W|!t0uXKfPYF8&T;LIqwn>rjHEXu;?7kpg?W6@R)pLWt6ND
z)T~K4lZNC>rTLeq5`G4_)cd0;x^$&beH44d(Fc)=81012(w_knsxAKr)D|%HMj0GK
z3ASuBAsJU!K2mnJIsxw~npmG=*s+u+uD-sHDuxD9!h8!wTNe-yx@4Jm$LvlnRf*Cp
zCV1v|K-W*f$$2JK#k8S$efNJWLtnjbS@)@xByO^(tI1ubZ9<~Am<+aR`G#CcEmG)y
zZ~wYKx3y4Q^f7I}Fv0E6hg((jPhgoHk&JF7Td>3T9;*!hw2sbS9c3pKABlBBnED6p
zhBe%Z%^#?eB$P1CV+@c*rti22HF8klow64r`YcekY=5FkR7Dkv>8G_idx}p5*i&6~
zd|SMJyYCv><Reu6#Vw9Q`D~S+fW61m=hJkJgda`+%U6sWVtH?}2WSU!V+22FS4psa
zW2Sg9ryx12Jv5LPWhCx%spib)XoYEYF4rcwkQP;IiZ3sH6R&&%_WITEy54>yqoCL!
zS|#2>x-scMIe1Ca`rOkaePuF=&V-TuCQtY!CuP}k?AG-`An$OX)C1a}jbEuWo=4{M
z3kxRDUt02y3kE&SHE$wfvAmSsZI9U1pNkWMdyLDpmM%)mOk=ErXaFML(+cy1t*+1q
z`-QNlU_oi?F1Bwx+xn5C+w&R^c%uY$H|PhPHa~11Whl1TQ0|aZRyDK9rlga@*{9w6
zDJ{sF++x@_L{ocAbHsfhLxnyj37$yFAv^mM+b|Fm$2UF14s<M1*bVjLW#5H!HmW}I
zklzcT<Z`!1b0SU`s}X*0QUp20WXDO)+9%kcEd>&2@bvk!fN8&5Nv>>oRDF}QzgE_~
zHKTCAOsP*n(_G2-S_2`!tJO_qxM6#GTN~8s{_wiaFdETf!N<<(yfDN&!=oOpAHc6(
z<M7-kyuB7`c$@(aZdQA-{~?-dkEL#c-QO^2+{H%rzIudqB{PZbc+ahjiQ>U-Z}Yy~
zUeP{Fi;=Vavdxq;=2%bqm2fT^kQI`DiD}ACW1L4AyEESE@nmx62E=@DUzz2=8f051
zOI=FlPyK6{;O`UZ-m$fYkC=>T&;1$T?O*RZS2o87WDx>ku$4c%-n^UVBd0Hvz;;cQ
zEfeG&tW)3KwOIP@gsDawcD_5g{A<qb5EI9lfDrI%n$w-UHl>k)K*i%IGI>&j^F%)Q
zIB8-MJrUX;KPbC{D1(cc^L~^1IZ+a-6YA@**>JHb*6|eBj3zY2bv=ixhF@(NXvb)n
zIT@^Ol=c1muvYRtTS5^IvvO)@tqJ7kh1n=<%U0Otly|U9HVvBtvMH}?g}3?yi0**|
zZ+^)*vRp`i>OE-L0@ht+mt{0!e)R+_tw=jGep-s{$)~82q~^Oop!TDF6(F9rpny>F
z9MrCoT`S?flM~3o-A4%A;G^{?-N!>6UZ+a?t*?pmR5j_#@!KlPF|Utm&pOIhJ<WVr
zQzmPw4TbDGSz-)}WVQ$1M8#jkPZxU36&kaDZP&@sJHV!mS)I(q&0RL6a%P^i=)~fG
zKG!|L#R9{VzfoexKjQsKk?Ky3Bwu3cHqv_3-#D<8lB2H}m2xMeA(u7N`9NX*M?pP?
zx)aFEwapa^#BNEST3<7(zF><U0Kj8K;-q1pOakxlj4xY6&NGzUtR7&q6!RdUjen9H
zUEa5EbaUyyyW4H&=hNQ!I&Kkr&BpW_`dmFEQ7RkS-{G&Jzt-ljUsff+Szqjdh+~nj
z_H*~J<?Xeo9f_Rj0hL|;;u+S4#<3X+mgcxyYu0$Ngj}v}Nb02!!3dnQMAF?8DDu0U
z_@^WrNL7O$=^pBf?!&`iq50dMl3pdq0*f`0XJ@uin?S?QbGhYGY&(uq_tucGjF^cd
z^&R2q?B}2AF+PmxFE2aQYg;yUqbi0M>`8nnBs{L9cFacn!N<FP^B=N#_9$kO1aC<a
z3mBLD7)6Ykmiprr6+HQ^+f~hMH2e20g!9;lpb`U)Y`Vub;&IdKwY(?`i?MG;77>jb
zW4(5;r@0Ea(+Y#M8_|wF#uJ&o^`Z&W5iNPDXC0TbnaE5nj-L42UT!ECQOeO-#AI}}
zx%^o+KJ-NU5TY{nSHw@S0VFml4KM|{aZ{(6Rf8zEJe8c+Dg);~8SUAi!%HDK3kU8J
zB`G*T7alO;04p6*U^8_(@p*9#1znA2H2r@D@l$0UxxRfu$=&VveH~sJHoH^Y;Wkte
zdXwTONhKf4VQiBjYxTc>%Xqf@{=tL?S9uMu77<l|t}VSz2(Z1Xr8F{8uC=V{NMspK
zkJ>eK(Y1~LJ1;X@UCvJd<vq6(>Try|Cw&#%r65#FZSA?apnLPfZP9N$|30Q^0pmF{
z-MVNUQVHAWneALWQH&-TI0zimI+S{f_w33e1}^aoHPq0Nt3tkTGIzEK+wh%-go1}1
zDiqOAQM&=43u)x9kqgoe@5Z3^9@Q{Y+F=mo?obl51KzlZwWI0+Ri3y$tznKlKOIG%
z@Vo$5Rc+k%EQOG7{t*abUrc@Fod>PpovF{fDS!n$?<(2jD}HLE>^WX+Y9(F_tWOe(
zOCp?328pu_f=FkIf&5$dL`Kpo>WZQhJWb&FP!?%s#A@Th(O|DM_JUAVaYG`{;likK
zoO6W%G4@RXLuHT2egOh3Rf0lbEk}geMZR_Wf9?bI9~)Dk*7w%L3`C`;Gj%mZ%X&CQ
zKjk|VBU-d5TX)OUjw|dmt&()p^3|OP?WVf?zy=k<S~4rENv@jpx|F#g>yl<dh-TD{
zs85D5LmJsNNGt$qxv=7p;v-~!Fdplb9kp_xswWKj6;yYT4sB5f7ZU8PUp5$vEF3&V
zbq>4lskS}9=J+3fa~uhb+usNeJUte;SH-huYznfSN^G}&DjL`1pP}id@1?&8*K*lW
zKY7WRQlge6Y((2d>fC!$k>u3xsQ1m^{rFNOG5wi?1l2dN1j^el5M{!el#B9%H0Nj)
z|5xKE@;Gg0ZxIDm^b$H_ynk|%$#?UrAv)T9U$wlC;DD9@;O%vukM8-|paK&w+k;@s
z{FO|@Y)qnbYZXfNae{=_Ai(CoeA}#NkxRhaw&#D~4h6mu@ZQ_*xfUCwgV}MhNPn$(
zcE_&;{no}wqDngWKEr6fa`E5Mu}@REM{yslXgW2N5;;oo^<PaF8D-koeF4PlfTXPn
zt3XWP$?7`7obl?&6HtHaUd_nK&B&$e_$Mc4kIPt^HIi@PjI^l`?_amev8$oZ68zvC
z^)B~oA*p57Svrhxll0RU{*GQexB4!^A)(f^5)x$Xi%9cIeY>T02a)t3-V_E!zVhIX
z^;J);{YI7$*!uj*#}|Y0h+g;E$M13*YvpyR&$`niR${xyW*v<O&d#s8Mw`tSJ{1L!
zN_bwgA1FwBxfM*gEtf+I5A!dAOziX95smNv9Ld;*V}@Isf6oAkg&<SEpqeIb(1w;p
zR<0&MkR%C<n-F+cwqdVvjEH?+M3a%>cBELB4V}#k!d|Ji23C%BD@<&iM1-3}*VgI2
zF-V=zA3})d6<F}?L~>?+)M5Qok!H+b1<WMBWZ_IDhZb*rV}x%Qy`FCoXJ0Mm>(&pa
zD!2x-eJEnP0A;ocmJhHvtEVF+`83PH@U6gkszc7e+r`<?l^|3;w@r+F{SN|u!hAZZ
z!A5C;cfo6YE2C*v_v0_t)<Y$C_k5QSR#|Rp`bk>HIZB>Md+&>KQTZws$qT%Q=NtZ<
zcsm1~f<Dh!I1aq4G$!{J>C>Vp4?LX<EmnrN>uRST;vC+?x*=h@{00I11m!eQplVPG
z<^Is*<3fZFkSId%6(d$>6-5z@^{4q1TdYNP`)NXulV`yU!_WA!N0zqiRZ?_)Kp)X<
zHOJ{{+K%&?qIzRJZo?7(ir4ywKY8+a4vVT1pUP7^aT!*OadL4Khv%5^hD6IV#JjPw
zWqkbDGp`$5vXZZDU)u=n0*OoL3+^pBx8%FG<PB99-=40{KVyhWR@H5`hJdZk4&S#t
zE5WRDk*T)}-&&kL6MwlY7?q+%`oOPGI|a_hcFt0?Tf^$_&GOEP3HQQO$c>%A*_ZUC
zk~mA$tFsSM4_<r%P1WW9m-j6xpt4pVoc-Jv@$EuPyhVogHbKhwpdipUqqdF!p}pG0
zoNExgWI!94Zi0)kk+N^txtgc4uT;Uw%3*nU9g-~8SQsMGZ!I%I(~tzMuAe4OV3Y#1
zO<VV^)folyCr{?1Cq@}=0T8h)0xV-l(NJ#i1S0Cz9^z*8DMrj4iLUA^jt!-VFZwxH
zEUG^Z&3=%t=9ZaIXo1kR)B#QZ95nwvtR9|3Izgn#_9#NNAuFwP@6A92NV%W^<-uR4
zpTjRI)!ut6d}%-6EK2-^we@4GpL3}GYt!1g&UO#{cZasz_n_a?a!Z`}Dwq0RsUvnk
z>u=AElegLC9*^0S`1io^t%#i){G`*3iQ;p6?DeI7_xpEhQ9ETW1X@?rYi8f(EYg$S
zThc!~OKvnYTeFZqgleFH>AP~ot$)izG8sEbo&lCL{Iun09Bjtm@Ae>CWdrVpD8j1)
zh;y=E(nc^1;CeL>e5($8?EyA*HkyCfrQnEkYklC}_l5F{XIxiKBK$pC4N(&nqB+@J
zsiytujIC7vu;}rTjnF}gy<nQB-HDc)=NE)4|A8ff_aeVIa5|3-+AtDn;=2aQm!SJY
zLgI`#KkU5?W@f&yDP~3UUMK>Q>F+A)M!(t%1^=+MLkJYUIgsZ5;4YXhNOPD!Ze^23
z+;|-8Kuh(EvPvMqjco9Wk{mu+x2ye~L?SQRUSe}0t-OCOcXVGJa=l+`o<$-w#&cC_
zBAqwV$7(Y7!QhQiak;SSgH)$b=dX8H3%t~4MJ7^(CH&#FOt!X~H#^HnWdI;06^Z$<
zA70gT2CX*6Yl<azw(~B}zk~#);8c*XbhW`@*M%rIkMd2&o=Mli%rXaUO7YH5<?Mb1
zkzO*#PMIE4A0!*HJ?hjV4dOmo*4^iivEuivr!jq#7Sitor@gr`B?`1rIA)}6$6jYm
z&P{uDK{|kvfwG@jFIuT)FH%KG9SpSOp}w^zW<u<tzh{k2tQngOmG|ekqGW49;Crcy
zJkUV3#wQ<|UR+T$TxijhTMgjWHPr3=q-8)}cCfqvWPL3!o(W6l!n+vPj-7(<MW#wU
z*Gk>7g+4}00RRh*ZV)XBxYuY?rvWSpSw0wY1j+Ti&YxPOegcq?9t3#zvj{8t8lHD=
zC7V}j%pu}W<e}1N*e1ES8NFKRCs(jh_kN~$MCK2-gaG(zCVjX?yv1V!txr8wYQ2+0
z@2uhJqt{xXq7P<bA;5+LrAle!0eW<Q4SF9HQ`Qc-c_3wc^x66#00LhCufK(UvOf08
zz`rLnCuniS>r?yCyt-m<zYiXhA`mAty?RS(37XBMN0ydnye7<X4ldn9eA^B<jmDgc
z7&BaZzq67ma^>`dIyt{A^)lL(2|}1)rac<P(z@;WqzjEQco0Q~TmnRC4Su))e<D8~
zu(zgf<g2C^Av=cRXZwE_e_cWr9ssi9Kv8Iy;!P5m<12sDdC^n_)^X)c;_fqcI)ie(
zGk3+(ZKA57KbywTzk2;96r)r|I{68daLwQS9|cy9a}X4ZUz#(bmU^~$LlNCHa95)Z
z#X3H}Y#<|~ssLw3@k02;%+AmK@s8K9Ynt=kNF4V8Le;mV)jT`xfxgFzH9Xft2;#6l
zE78e?<mRL<Kcr1(U}@dz+WwIZ@a#MIs<58^%f<NC(Am$h+vTCW9SaKPi^W;KmE%!`
z@jbLutBdl=N^l1zt#2s#1<*ySyo`bkdoC8^4oS_Gm}Ylq@@R=XTO0s653SY9A7O5=
zr}8nw!{@`0wbg-;TDx&po#5?v^%sg(W=KoLMjbons6ZpOMB$jG(C9Cj0v9F^#9rCD
zNmw6ev1hpI3#XJTzcv<{cF3Xf51iG;7+)``(}l8c^u(+-EwnI71$F*a0ulRX(%^Qj
zMjb94k7TyGL4d)rmiqbk-5Eh4n)%4zM%K2vqvQ!-cLs5(N4FykfA~U|_ti~iXRhcP
zOsJ6z#f&%G|Be1$cyp7--K=4+>Qo-y;zv?E{F*p?)GdL5-~LP9(<%@+r5Ag=+2)rj
z_||Q>b?ex#Y}-p;2P|+y1ftx>^~GL20Chi}m2(a#PC9L73y>Hy#zdz#(}lZCC2p*G
z4dsb8WXF~8p)?x$9cnF)XE<feraTbbM$bT6-kg3=5HMyx1``FI+{h<v%PRMK2U%qx
zVG1@K{~|f)OPGR~$-ljCr)2wa<MXdd0%WYeDWa^m+QJE_RF+xv7^pqAuam=JwfmSd
z@LJgE={<TWG)njH`A&KHr#>`)JlCI1$UAJu;v<heYW3!h7mptD*u$(lWtzaptX^SI
z(*8}&*T&h`cWr%nlz}+z5B7alCzz34aV;HHviV@AOUYtHI`))mOxfp+LT*#Bb{K<x
z0E^GQmpK9t&^Ly#nNm@rT1~@V63w?*JR;<a$gj2$LM|0Ih(C&JU|)1j$CwVGPrdwW
zo%z6;fL0~o#qm+Ecs^X3ai6n7IGhf|f8XEB>Jdm5{K_Xw7~1af?epH(AAKw0<AJ!f
zS`#&6HWSlef5k0`(4?+2%Da8Q|MbH%jv?#YcIPQE&bl)ey*8Y&o6_b$tH7KGDxG54
ziM!RQXGTRS=XdKp|Iy&OcWn0EIN2lMM`k-XVBa$w6EN0D15mZT(IwwEzL_x3(Xc|I
z3%|?i7E19q6e^XSaKWjnNb3EE^7!M#SUA&4Hp!<1*)Ihoc){GpAbnA(8DSVoVtFUC
zP56)pAmMo+u4P(F_zsG;sU^gQ|MoXrLUDWs>YsA*zRUoz?_KfkJ1i3kwxGeZL7fYB
zA@sps3Jvv|Nyxy9(j8%s+uWL#tJhFG;xO<OH`kj#+rtAVDC$lK*{{i2_wv3k88Bl&
zP*3{2=ASJd*-T^ShMQ8?qQH`&NyCAwnmQWt8R<|b{I=WMvuW<6M#*Zrjg4@SCB{j+
zx7!Td{+ceiawIdC-MfH3sldupUBg-iip<IcqnfR-eZOd(zh;$k8A^W{D0z%>xYECk
z6}<ATP{?j#25_gaX0acRaN%LgcV{mK*E+<{ymjSdSsSm{G)g*Yh%%r3bO*zCo;-8J
z4M{PzV1fdwFWHy<-Yb8*0(DYDPo}$9^wyy;56=%IpQ&QXfhC`a{B9e?7|4h4Q0C)x
z-PZh5*gu@(0Jy7LhA_u2J*suP80&+@;8o>=lM0N_f_tN1S^XkaTO5;(CZ2qJO_h!D
zZzjkTcbN#JKEcwKwf6Oza_Uv^6pQ(LF80JOkZ3r2Diei<roN%;E?c<v3vwlm{x}t(
zt|&HJc}>#7ym$7=vQOF`uLowgW}mb!e#+j@+RD67S(mysAdx+rMKd^fk053LWFhO~
zn$MWETL`Eztw%in@fDz|9mCz?=MOa*W@OhM>TDP-TCp;yRm6x7R)t@e6F5%LsFC&3
zxh8arP`O76C|Xzs5hD80LngPTrRG7%YwJ3Q&xJi18I28zj@I+^R}bJ#CUVImrXC-v
zx+V3@Ez|H}I2BIoAb1JA=)B9He07u?Ueef6N1eZf0Uc&#nA85r59xU}6FBf4Iy_f0
z_Rpm)K?bYKP|(bmSrIa_hB~#=MR@^Qo$<C|@6OVr<11&gQ$s^Bo%%X_E}RijYsSUv
zMw_xxmkpSwRH(*qmyyBmmkn&Qdg;`zIUh+zU!^fdxgWhEq*iQ;|Lk<{g@lr6!qP)h
zQ6_P&0UWlr%OZ>8U2TplSwU+iCO7p9l}8?vPh1?}kI2*Ndet~_vJ>AvTqljH8M>{Z
zr|-v8#uGCBD)yOEz>YoMAn!^SW7q6C8AqN@R4gVgMY}CRM%T)d_}5NH_ASFVTvPe_
zkTEwddPxY2p2)!)vE|;}XHv9Pp15RW2#dK=Jh*Au{%7UY4*KBqY&yv-qmPCQ?zrP|
zkaMWIqVCbz<{5Xk<X(wT+z;2j`*g!=duJe_&q2Z+JV_l~_uj}=uK?T{dZS_~d8>;K
z32KKXNkEA3R+7@h+bJF0(%pzKi4tAGm-Ad#@vd^c;g1?iz6FWa;|DFtzW;*lC#z_R
zc;@*!DJ?Dp#hfPTmgge%q}=|rK3v_=yERve2V4&T$|x5_X$sDus4v&lp9fsYv+nVZ
zi5&p<euRb18$xe~yUGv-69M7nsR#k{>-T2nmL_}Nkj*B%pq7I|`YF3VBvF6f+Y^s-
z5wJK}t*^!Y&KhWU%n)=FaGHt#OdS)(N|f^cGwZ`h(Zh#NeE6TeAd5{3jV%rF^V;ik
zF5MNkvjWPkx;ERrwGmIxOWC_WqxL}H0RCL#t+?5JCJ~Dl0MC&~%Ov6-W&>RhPT5`w
zF7j~bo<!A^%_@$QQ{{^NjSbqFewxWu(Gwn~5br|HCHC&y3EnVus;myKqBcfeZgoLy
zPYOB-`30)AtOyx#c||@}gpaw+*~nekTe$>fhx4?OP7fJLq#Fdh+2{n1%*zF%RpA#y
zM^X5Z@)hIyMvM~pdKodsWr&au%@hU{g(U$)fd!8+WhZAfRoqN&Klal}T^{sqKjM2u
z$`tyIM&_@qq_|j^)3diB?dUiUx<V9{(%fU}YXxOp(Ij*qgX+CqB97ME8J)-r`L_66
zvTUIxo4D;}2vz~owM7JUQAB`<_AbVgZ*wcT?vM_W!B2hx0b^s=cy0ZO^xKKQeMKer
zcV`~N_1}N8LcFhJkrK9*^%5!f)|>C10(@RcarLp;lOJ;?wssdh!RJ_ZoF)<|KhUey
zer^YU>>_Y2#aFHJa24<g`V^m3h*^OSe{L|xAfj!|?q;e&+vCjg*QblY5H0@J&++#y
zjudjKAdBx3C`LJ3%Rb86b|7Lw;{FS!768u$7?vEm;tog$-oejSxI(x$PkwsSq$^7D
zjPIx<)MiCTmxk5rT<%c83#@InVm?dkw4HpVFpA8@W1>poPdS<MyO8}r`l4FrvM-al
z_~6Q#eix`DC--a&`Q#pwehcbNWgJ`q=xL-G|5HH6^9gre_`SoE8)fA>QKvp&N5j}O
zUDO<aR#%YB1*qeX?A7r<ZnF5QLbhjtH;n(48DH%8_FaIA&@HY%#9tG4o<T^1409)s
zSu1FgP^pE!<>l&Lr&2iIA4a!*O=ZYi@%eIJk9yead$Zj^;1m_YWSL|;F)ZwHb<-=n
z!*DHp(wYmRKT`%KDLi=0KPv&niWT_n@TH10_rP2YYr!+yEg}srUdBmlbb)Yk4;?dl
zCU#9{FUUGS?i|fi^Bf>`E$~zO52`uD9jE@gyM%dL{e95Wy(`5hWU<p7nGJp<Kg`-G
zAJ+!`ClexlD@cUC{@~0C2tQ=*ibe7HbIPGf7<>?<3lB`+eAO`y)T`fl1bh7+8=dfu
z14YHuSLc;P{??a{^P-WWJxcdp<V)Vqb(Uijji7U>cRbA-4?LBpvS=}qy8UTUt&cgK
z19D078q{61eiYx02k0|o-CWSi8c6Gg+=k(D;fUbyOe2b3U>%Yhu>=z|rjIk-!4c}|
zy;T^TKb_vmbHf5>Qd;m7;Ba;@=K8WmRUsmXf@#KJ$JTPr?<R-h0a>i<j?)E3hwsOv
z0%_@r5p)(upZDDd()R{H8BwMwB9Z<FbU}+@!hicM3pJ2eo9WZKo!-7TyE3>(@0a+s
zqNXpIL&wha<<yOjdo(xHo-9A!QZv|C)RL21#i`c8&<u9q59$O+)IJh!MJLe#Pg`1r
zd}>;Me^2%t3tU%yDi{&d^y`rMC08e65y#~vUaqHh1SJ_+yQDoqH6JcKhAA{5NL0Zy
z4fPEr*4B8xiD9tzugF!^XZxuKz$l~USPlnOvkBqL!DU2oJv#P4>>1;K5CJ}kRMrK;
z<M(mj^!^#jJAw2Cf3JOMp}0Tj3qVuiw|-dKpMf2*oC4`Hd7>cf{qU}e;W@vvOe!-!
z**#{{D201w_YgE=+mT^mz0pn6#Ls)D+Ihb1-uRLx4HJJQdW`?;B`1?IfRe%GPmdnI
zitu(+U-+w5P*<^Gn_M_EIL?dDl#LZ{x2KG}NF!j77aZLtI`#-2_!%F=#B}_;KC>5!
z2NH~!_Xlk3yqb!+DZ$!X5%&`S1HMa*x0T!DqyLr^&^gRp8%#HjxU2!2^gGi##pGnM
zfnJMR_uB--wV#LE@thQfRN<VFy3n=d6QCskJ3cGAxIf{_w)Wc-dPa=-7WYfN1%c1F
zn^UEX+=$Q)Uc1?ZiaAAh0RYle?a8f(9L&F^<EOhW1h7%LQUY6Ad+k5oz|_y=@BLs_
zxkp|gRO)^Im0S0ldir@Ws6>HP!9BKz&zYFY*IEl6RUppEzOI#={pU)pnLJ5S!HKKG
z)Wa-QdA2kb)mItoCU~TMeY#US!sdOWZ`5-{w&Fe=|Lo@MygN3kciUR6eV#@v9ghcJ
zYZ7asJ}#vwPeS}U^CeBw8951)4#7$L1M7f9z-DjJlNbp>ef8~vpquN5CT^7&b)0Cw
z@|QtjVG?4k+rde_yg8}zTtztR@uaWur{2s6<COT-OW*Ib<BCR0$Z6RAy2;ymH@|4p
z1@1|lpR!HPXJkII%m5$U<4I!KOA~KteM?5RWuLhTi`c|5tPILNsW4nK+5@WxT;@F~
z%>R{rrhV^6usj}gC%s19KY5@a#q0EC{iy#>pIPb;N&sx=0<}BAdzOIj_PQj!b*+CM
zQa|BKrxvjzc7MqVzqa~n2@S7%Wylz{Jt>o$X8tk*=GqcnTmhn+g2LtlEakz9@uR<&
zS>I;8@R@z1A~#}cr;E*gf}ZO`L?Ar-_K(D?62{FR(}7BYmj{r5RKR8h(>!ICSo?%p
z5A*rsc9qIbzqgTjwm~|t<>V~O=Ot-O!!qqjA4LD|Oc9dNBYOLa&p#@*bV}>uUX(q3
zW%(<!X5VVGBHgXnLsRKM*J}Um(+l~>$z=0AN*OpZ3ni0QTIsK`8=QxbTQ|_g*xTAo
z6V<D}#MCc2;&jnj6|rym-38Gb2k7cMi(54184~Frn;GN_C(f;K=#v@d!vf*}R>!wo
z`Rjkp&)n_MmHYOG!YqDNJQ=Tw`Pg=#<fHU8O*F%i!DyTX-GJvW=Fiz%F<N+4d!E#N
z?Q{CyH!?a?aPI5*QCXLBf0UEEq6MGd(hX{kaMD&Raja=B(=C?S9ZFMQiQ$ZxsWW$6
zz|KD9cJsf_B_VC5mcI!E<VJZtd5eWYx|xq=#KCojp3iW120;3_q@!f?fsl&%cxnLq
z_u@!Y!Lu3aVeXd52!5j0Ixs~nbQ3e|kCAK9kfLf+|6Wfodd(FSqUOjzMi%S0d`<@q
z(}0^2Dw#{ukRr4G^k-LkL#KA^69~qq9|jSd1lNHlr?j%&hyL0obN1=6i&M1a0C2U*
zu?slw<cP<?Lzv*bP)vaXW>Uzc`uT9ZCNd0NDwGJ#qT8o-glgAdN156jELM>*KK@%>
zv!ACQdDE6@mVW41PRY$=a_MN>Y(x8FOL*^ju50I4)Iy{PJ~NIKsjbiHEv*thZ*gM*
zZ>`V%2811b181wsoRx&k5<I++TfLkHME;X2!RIEa{c6eBfua|Na=N%nT7-r?Iz;DB
z`X&K4uy%)#-dmq-y;KK(+r1wwIJ=$BX(bE{*JcC~G*1tNkLA+7W!P<DJuuj&798Sm
z088Bd@3xG_N#6)_s`pn%uX%Ly?5r=CE({M~pe_d8`2JV-#J-`1Qy01Pn1Q;pKS>_v
z`*0kfrS&6r1$MPND??em06B+Ocq~=J1kto5%bP`CRq;FH<pg30Yr5Ee2mm3Wh5=K8
z(J^HcpN}el3~U@ibG{rY2vOXj(FQUA?M*~jFYfZt*SgT0cQegoCsDsXGH?fK2V-#f
zc^(Eut35GY8PrN<xNYcoAT4+J-;jyID;znwUsU^=9MAo--AkT6#xE8WS7R4>Iw)j&
z`E-nv;8NPPVP0W5{hU(@EQuJfzw#$L5<l8^cd20=d@X&@%SzpF0x&0>z2?R$gOl#2
zsl@E$WwL3CV;h8LRm9!$bz{TyUeYe?vl76=QYnb=Felt<Z1mAGF+j1C?yY@b3!u~v
z3m{IDN@>tJ`@J{St!*025;EtgIA%~7&$Ep5%8ByjFWiPlg|tJ%+TVu>Zi3UJ)(_4_
zv=bMjik;w&3^AMPltvzrZLt7%ToDX549PJk-g|>n!3et-TqWxYk9MY~T1S!<7y9k#
zW}dzE${78RqhYK&_5k1_r6{4YBtyPj4(Mf7z84nuo&;I^*)uu|L@BR9Q6ZqznNQR2
z(yTV4+_~a2QmU4<7E$k!{|$EL7p0hr*Zai1tGI_l<0g<mLcg~G)A3j_ZX)CFzYJD8
zd@F3Ij*CeK%q#0qV$NbyQ;AG=kXu5>n|G~WJJT16f+wqsHIdcp67k~19=zTUOIhu`
zoS<SNOiW{hV0*}{A6xE}#yufh9%dw4)gDf*oH-Lq_AkPxdW`zrvpO_g(~h*=S`v`l
zZ{rmNTP{|?7+`%|dD&D?@4V<eYqIaGTaUxhST@``s#~TD0zL&JB!W;^qq#(Zz6w}6
z2v%UV=|@Y(Wiq%jkt&>zLnX17i#Mc51|)c1aF;+%<C`WP^_rs_!aM;l9{z6oNLaxh
zR6KOp@Yax}yEWk#>iA_Auw`)zN2fUr2+q}IzEZg#sxB}mALD}e!ycV&M}@WO8iDlR
zB15!AFTMRcgKVi*5cAZa%B#dgT*-c&^NBVVfS5PYLROaT((z96n?ljz0<b~Br&-k0
zGN2TeD<+PGg5-{w#g&#zHajOmPH+FV8F>8+T2>;63>`^P)tI}N^@U=kd-|wr)-b4z
zX-xO_1sxrkdSoWv&vD|dU!N^_#C}U+>w-|TLy#WtOqH<1>QGeDVPsm|JE23Y9)_vN
zAl6$B%YXU?oOub=N3LUnBzhjG1H#5X#VTS`pY;4$WsP(!*r8gDN-nCxx045}3%71*
zp3X5ABvo6-dLPW&tkusjh+>feSEb;!2AcJOgnrnbGquQqEx{yZcv!E!SrbFQC=1V<
zf^X`iUiKD3sQE2mt43hP-|8_x+-$(6w>nuN1=YtBXT9o=V2!W(pkbi+WKn0yzfEAA
zJ9FJ=wjx<gWpEFU1^Ci_VP+xnj{BqMfM(Iq=Y}1XZW-{FF&eUKyH=UL^~BR~iff~x
zRm0`7yIn|oK!vTwyZ3}aJi0^`PulNqxJ9h-?`+W!72q$7yab5NaxgO2c(3kJcF0p9
zpnzeqP<{Z@zv|&}5R$0c{gel4M6L}`*|ycgYcN}A1(@?juA*B)6ygZIC3^`U-za@4
zXhD%t*KrVsVOtXwXk~8?BD&J9GgO-B+gzCrX6C(>Jy~{Eq3s#uu)ze_W@2%KB8M`2
zDhLhFEb^|<KaTh+_`sWZr6d$v`!nqLnr@s1QCBeIi|@Cc2sHKf8h>+F@6HMQ50vcR
z$pv*%Z*%A{Wu909V!NugA(6hvl$z934~AF;fm2Hm@5g(3Gl6S`^y@+j_94uRM1;vk
zZJ`gdK0}`ZGB57L-Mh3@M)Dr-31z1?&dVqTJzkQSstDWO|A(fpjEm~~zP>YbN=PFe
z(kKlQ$^g=$bVy1gNJ`EiHHd(KbV-TQjdV##qcjXiH%KEf|2yC3_q_0pA3d}0K6|gd
z);j0TSdI&}vnt!ndEq>CyatD3a!IOv;`>^pPXFLKLkAkh;>v7vAB`g~qIYmA_7g?h
zh^>GJKk+;Ay6ZUXoP}B>h&fi~ha>^ipRmcu;~rOK;@iV5K8skxte_Rv2pOlI<D}&p
z943`6wtU2;{$q$902bs_X9<EnB-I6{I$H9565-|BHNQYLm0Oay9A+$&zm80O(G$T3
z9yRLJO3WN?^nx1VGTM(Zgo;jKj^w*jHdRF=0{bvMW~Tfe62INP&KJn2*!8D7aJ-qo
ze~)DJ8?wzAoxN()Q@?Tb?-H227K#y~(Z8HO&7Yd$_P4XA1n%*p>@`Y16%BWLbmYp|
zT0$ybiM(z9kF(Li<{}ZJMr(yma-03@d6!b^5YZ-=g@Z(V@bLsQ|9*sg>)2-5SdyGN
zOiaT?cWsP*2;8G7yZe#4r#SK2-{OzE+<Q22`?ufM*b2taFnj~|X;Xdpr<ry+{yLP&
zrnGj&mH$0sRfIQNyXNfK#wT!Hsf?<1)}Qo{I~JrBGOS+A(3Mnjbb$kP^*3ueHbt;W
zKp}OSp1!6wyk>i>^Lp0AkkGa`=BX-Xc-bgip8X86mv4+A>0`=qnn1sfL=2<3+1MhU
zJ2Bdzpi_!Vj`Rgis-c>-q+LAQr#OuH+3=u+CZDw=-ozeLw+2137ox4*9czQExT=n8
zieS89c+Lq5Bo*`~X0;2|GXbw!DG7pcEhi?~uVg9SmED{!L}Io=E%Qr<l=z}+c)K~#
zQa0Dtzig&c330>U*zLm7q69!q)>6;%(5zpn{zICDzri9bNeU&YwOLF5m7>CC$zkDM
z@6FkX4>z<^b{xpeM>Gbou_=~{pdJ_=uSkEO3NZ(qb6!fv+aJm|FTXTb5Hh_!(IClg
zJb@OOsB9xuo>vd}uE2?w-*#1wUNaSOVK6)IOs#doB;@Rw%ihf*Y6H!JhN~Q(&sd#F
zEnWvQF7@#5+;ht}V`o8Kz62kD>CG-s9e!tDp5A%Z|6IzPHd{vKugb(r@OU^|5hE|+
z0p_<k@AE6xf@ShG@hrND8Eop#a{dD*p}E>~v<~k-pF&7ltnyV341w%>=HD$DabjyZ
zGf15$iISF<GaB1QyUF~vHpTjWID!%vr_0ULCxZ9JB_ETcTOqy8ti%6aeBrzU0xkPq
z2i(w7{8`%u3a!$Sd2Yls49UPRg(+N3&8g!#GAY4uDdx`qrIcV99tES>5hgnfTQtK#
zN8N;85zLMe4<Vyt0q)sXqfu+_wUt{L>9~7!9s2hwEK5T^Rlz?i%Br)mvE39j6}2sP
z1z#*sKvb{BrW0|WO+ACzuvFe~$zU%$BMGNq7rc<H_pEyf>Ivo``nkFU;G&>-<-SsH
zUHs;O%8#{2hdv~d^n<2+1f&1SO~vTaj(R;~KD1@6UI%;;tx=Nz<RxX2wf{Z4>MUdY
zHmgb=*E-ewie}lF<oo#3y*op@byS`5boWa6|D=8k=K{hPbF@HOBnCmj^J<!(FS?Nz
z-g`60FbR2`lZid55eaVT?=JnD#VC0pPfpVKGL>09c8j)hutv{*3`bT_6DNHXzhfo%
z?H^%wYLU|+T$1tU3t)fk_eiU5=ScIGk7K0FW4;f7_l(qSGQh29-@^1CNM+g6+z_ql
zLoF87MfcJ!>-=_V5W6i{l9OuC?~#*NB`S|KaWU1jo3w8n0zYVQXgA#knQy}uyTUgR
zLGV-v5Q0V&OEbxJybe{=jJC})#C>8auZ{dS|C=6+-xoH{4}4D0wPiUkh(1^Hk&t;B
zBalz!oj3v7!3u(EFLxWM&L6yPiarO5FakuAWbn7~+4UDwj11f=J-IsUg5Bh3k&l!p
zK8&8m`|7a|w_9uThc2<$6*QqsM&$w#h;nys0<!u92x+M<fI*Ng8mVL@fR`j3&VVq<
zsgf4cNinv5;AFJ=aTL4VtO9BAy)_bjyT>0r;~CoCH?Qn8KG<WC|2zitg;>1Hn|+E7
z&!yw38_Py!9S~a4@9fVX{{q<upNu~`4xz8O1ac>3h!@H29cE2n9t%=!ZN89!ZvZDj
zYEMK$Ns`^;u2`{pe$`}RZ=QyML*H$?<htJAMlo`F|I2Atd*c;7F}}&(EKsY@hDdl^
zhyy0q@OY9zX@*4dRBrykv_|NKkIIt(yIp}7YcI{S86QmmZ%O#smU^N|e(&%>GQ?+z
ziPJ@Omj>H!H$x(kePqW?MYrd3fboAziP?t89iuANql+6pmO-X}OnDi|eGm-_1kOZr
zkLDKrc=3FsFE)EsUk>(OK(Kn~9Y*<7zzT}M>oj&cfa_zi5I-FlI->}|l0+4eEcG;L
z5h1v+z<<EtLjepy1{{U2M<Czz7G^IpSMnBTe^Se=jp{&`AcyqV7d9@kN>$J!@kqLM
zHS8i!VbUjd8X$nG`%Iu8&*u2n|ANw+wVg=|D8OvmT<&Pw<66rCRO9OouXDtW)kQDl
zn{~04Ab(T8H3m{gO_aConUhJr@F`R1>TdQ}v~K?z53sRSaZCH7cS>c^MzuFVvsZBW
zCT*gxb=pMsQ@CykIbO!?_WpEFYQaHprX=_pWmEd6C2$B&qsanpsPG7F`lb$)q6sK4
zUdv`0%aefDV$od`vUd3Ml@?Sf6ROiJCj;OJ0Su>5XyK)+4Igeg=~GCvBNh_58=-ZQ
zU9*0{AvR5sA#m}Y&r-aUI<ZUox2SF4)5&WIf9B=cu(sRKoHv5J(|81O<Q*tT#b*pS
zK1w>XkSeJ=znz+9?!Da$8(z$L!N8)9?Ky!vO4r2378^atglpYJ9OZWXO?2t(-}W+5
zvYhOTz0*@wS02dW$Ew%U9#8oyCUE1Gh%yKu9-@4d`n?}d#z3Kl*T{F{Q?zj>YX2AX
zNt2+$xhmu_=GmEO#^@?i#-4Fi%qSSDF(wHy$x3UKzJJ69783T*)TcjDoF%5;rnDQ)
z#c77Q2Wg&~_VxY|0FM6~Mv7azH|2E(w+!>C0Bv~c+J2j2Vb5c%!&7}1Knu(?t;hr}
z8M!YpPV(MOIoA?1^m}6Qr#3$u5&mP)-vr0SNfreVd%rlt*PWNg!r3=8>=J-;8>VpU
zIQYzk=eBWyO`Pw)CNGQazoN$gmV)*hJHeUs9C8aHp3Wy-G`!b?x-B5C+&s4a-D{&H
zx#V?Ol^(!8Xx7&|Rt*fxL`VRAoc~4Yv{mzCFWAk{y%ZZE55rp8p9QSJwo=grS6zMl
zDg>Uqz#kG~B4#13dJ{1;fAXW`3OBnc>*ODOf&6{QVM-N8dvrR1vT~C98_^AcLELF5
zi5?J%sWNx-Iwz%T;l1(Q+or3sMj#SX0*^jSeh=vw6z2~WQx2m_PB-kD^;%GRmEQBk
z|3{XxsL%D2Kfe<;78wV#SUOdnX5_8B0^X#hQ44|A?!>g55WJ=KT>jJB?_7ZQ&R~X0
zX@m@Y)m=d4^DOvz=cCPH>npps4RLR;T_N9Vvy$MaoXyR*Sytkiyzx3vi&(I|)M;!P
z8f@Gv$=s`%#O->NIvs)M7|OF+R^oIz=aYE_H~c0J4qiovXpyS!p7n()$BHmOFhiy6
zOGn%8mj_!+)ojb08BD22p%yAz8usNpQpqU%4FHBo=F=}PPTR)7DK2~$?N7T<3*nkA
z#MS_76meS$TXh?NzR>Zm)_Bsc88QU>AeS=GU=(mUpx*5LRpgaBjT*4~fI2R#=Xoi)
zQq;E@MvH1(!OkkdECUSRd)aYN^sgM^qVD5@SkD^^y3fPPc0{;`t$^SDUV<OTE}fQH
z=uaB&*S=y0{zmQHK<zbsB8EKcjo7xXF>_*vi~Ic|I-!)d$Y#uHtIw(@6~s$GL0w)Y
z_Em2nz!f{iwe;4b%8bE6w-6iI_vc3@wgTZa;iDkIl!aOTiJ$|__{-h@@L!aaplcze
zBX6upM*ZZl8rT5%JDyah(_qG+)N14T4f7XvG?N|}XnwIWVu}aC=6<pJTTzVtnaF47
z)#j*UqT2in$3vm>+y|R-)yor)l#BA#Rxe~C-FP+*AJY$~R9gd?nEHv(useVkn4Q9-
zWlVt8j*6C0@;wkt8<WIO4tUrUOY~0VoBm7$IGT%3?>X+mi>N*R>_)sSv4<+`D-j?9
zdzPbd9rN^7h3#TQ5CXI=4KsUr|1F!aXM8h7cowoFCuVuh^Ix;uT<m>d9<*Q;vl{CQ
z`#L;6a|C}mv1I--swWHYN6@aCrHJ5%-a-%gJ~Ba-!5be^$+bV+knwl_E%(HKsj=m}
z4YgnNO)2Q@LLv5tS}i;`mAOJ}SP=;eTUX>v%Lu=fE{=0f+%h*--duv^rF4{pQ%kGd
zma7_g0W!$8C}{Qc)ICkv1GP-Y!jBs|p)Vmk*Ob?qjqIz~DLYx5X%mbslOg%ITXg3$
zB^AsDzw#zL24c%8;{3yxpS6x^FiW?X?Y!W@2Bd1e?Oe#TKku%#?yoU)Thv<~u3K_M
z0+YBcE~d!CsZ2uj<{S@h7C&<VXU5epGMq9gmSSqO2oPEXWO1zH&6!kI5$j8B>wjI}
z%?M0x%gZPE@XbtG$6Y;xE&=4iaw2*vdHQF9StRSW#D>uC%7$vZAfb3z<7}`7-_u((
zk>*r@g){oBi?l#Uu+t-E0@%&Jf_r_3cOMi9YTfClr`iSPa_dBJhl$8Begfe3elVrn
z6DHi}pc0Gw(_WSf=OI(uD?*QcILLAoaxnC_>Mn26*F@weVlRaz$-->hUPWZXjPm|a
zc0Cs!UU$DJm5i}1)6SXS*-7Zg`BH(0KV1MGhSvX_c>XEMj?HbhOP|;<qIQx8Q=N1V
zgQgVEdKa_^p6Yo#hT)p~2axekHyRm!D{MG@E?sx|J8Y-1sUIuKFAx$j!=1gTw&G)!
zQan}k>y4bb_>ryi*?P*L|3fGNFE04Z)3g5QE-p(wsMo#GnsV=<&n6+I3Di&vf)1?_
z?s1JKByr689&ZeOXB}|9!_k&fGK~JaI)Jv!Y%7V@I$HV!Z03}3Dg5<&RT4L+(I<m)
z?rEnIaVDew3eLN}rJb^W<=ZEC1C5SYqO*4<EXd*@zvPbFF3m%1y7Ah`-U%=^xaAHz
z{S@!-(jh?v9rn}ktu0T$<%2g3DH_OCUV1MriY$GtlvT~s0?Ctw!@*6x-&On6`?K3~
z*v7^)>$+X?@iQJsZ)qYF>7|B1o|I4iY#TVzaA=nxPAQW@A8dPi<gL*ZgJnwhNDVlF
zK)t`b%@ZYTBXtk2aKJJkcwIL@_e%c$Dd<VzY8d=&+oQ505%tdl2dIw=aH9dUA){6N
zEZ`r?+4xqZ<>B)uIzB?aZ;K$KD(^>xI2qu_n?o605`oK%#MN;tRPkZE45C<IQYB|Y
z;Bzd`*gw{s-|oCbF=WEe71}BFoeH2CPTHiaC)MO}x1DD%Eqa}Qx>E&@NF9c4XRh{K
z-a-57QN3E#xeu<NCbax(q_sxx+r-pkExhV2poDV%Vanq`O7gf4a&NsG1Bp_3&ncVf
zz$b{G_K{DsEjCDoEJ|=c!&cr|2UP}q!C+IY+DgBi4es*FK?e3Vx1;a*oy<S(KMw0j
zGEO>-18G`Tm0<r~G;PE6|H?x;3B9gO+pJ`W=pg&{ecKSXl9org-uf`VufG02yJw7D
z#7@t+ZM~be6P9s*MwRoSe)~Q=>eI!pxDz)-b3!8l9(h4j>;~UO^?5->r{5mS=$1c)
z<&W%v1;BHDTjhTM&nvbK;bG@tYpM1iOraZmPESLe5xdiR{SWR3o(h14|Ahe2Dz4`!
zin`q)?dPGPQYJ9{*?pZ3^!}=ua2f;a>1npZo$J!yYQTMcRG~EG!@bAwY0pv)M7=(R
zMW=4C0gTktd*BVsWA$JtanM;V=f)PfJg1`OfRQF4+Q)N&ACy9^nXk6Pspi!XnhZC@
zA28IpDjK?-4DxQux!PXSF?5H8nHWR-S(i`dJPVsUqL2T8VbFO1;U&p$a##P&QLZtS
zuQOOlQWUn`<u0F&4leZW_|VJU#eey;d#nlaLF~DJKqT@cY}ogB4Xi~kZNR?HTNs<=
zQ;I;WuuCTKQp~h>CgKAZHq0h_t$L{S>+iq|pN?H>r(2;|L5vl1>`-2=iJMIUU?G%3
zBNJW+vTY={SaJbA_;b)_1tB{3)XC#e)n<w4TE9mrPp;x>cA%RZJZyNOG9LXr7GhW%
zSPR#0TlLq#b3;%t5aV$IxY(d8Wu<LhaI|o6VZQQv_`3xT1&zmWpb%nAnf|vBsIqaq
zm2N>r^Q)}9-(rhHYJ2YmV@W2q<g6Cd(@)FMQ_1Fzn5(Ry)p1~2sIY5=jMTu5Jn`Rq
zOMHo#kGKPVM88<*cxqnpWlGdH%N{Hrd;NDg%ALPQ?vih@E@oll8w)TI=Iq#|c}{qa
zj_AYARGW_A3QP1*1IMS63`<{r_Wyi2p7N&M@YwE5?nmvwq7Unn6=#cotnai}85b?v
zk(d!ByA)i3LS31EX>{!BfehAz<B7X59*|BjfSoCD|6^8~(R?NF_SOn`J#jsY_9B*$
zFaigPKPX8dUA6`*Qu*vsWqwZltQPd`_YA+1=^JQ*V2x#4J`X)CI$nEKu~)YDadU&8
z&EIYVHol7}m+o+X@5#!-&)C%;j*G6E(#5g>XUEkcb8_qH-{MmVScADcD!aIYif#Fc
zT#pF}Kjze^YDC(<+i9-_t+#i>thSe3z*(AIZf-g0|2`%{Ux*i@f*)m>?xwX|Dbrt^
zDx{Oj1)ykz@!%~OG4dx5yB)!1>Dm!pv(0V58{L^}odW61z|l>YAS*)iuvMX*r%>=x
z!aL;)s&_c$V5<+j{_W(`MgC^z_pk20zdkwk*HNh$UBxV_%;=^c+6A6wC_5aH47;Hy
zM<~9NCAf;RWd9eW{A>uiVjRq+)4`3wfb{kB@UtF-3@Gy5VBiGvmCST$dSHa--0y#`
zZSlR<@!0(Pvkbj8_zcMIh$X4X%K|NVhqN{L!|rFDci0XIyN1&vF#j<waJ)rm-f79l
z-jf>=UzXjbg+~?_(SF7-{*JB)W%%CA(CtC;Pd@8buphhBt-Dw;XOZ1em#Y_BZOg<o
z@wCjGZgLxk`H%(<u~T(Ww?R!pTAn$SUxNe>_|(PCH`l^PAY26IaNhh_TnAZQJFONU
zz7aCx!Z)oQ8>63eF{rEPLp~z}hDq=;q<2t*T|%moR(VAVdp`IL%EAlyhAAX}m>wFZ
zNek~O_~%f%(ggOBp?-rvfVRZ<+z^n;)(s3B(U_Ph>I)j@0Te^0mgM25MCyx1(oMdr
z(*@cxq1^G<%$#ooV|-BvNj(e^{ab?<pznC+pXjtqhWGHk<HWmZw^9xO9M*CE1F!GJ
z%q+>DPK#O$cLn_#)MSRJVWv?K7-Q=B-MFkw!>^Q=ILwkxKNt~8B2J=B_c0v&QTT9?
z>!$HuVwWanN1m46N-E;l(Y-V0R!PcCH^q6qS;l&$W!=I03Ou22AAdSTg|f7z$-`%6
zb)zON1YrL;BuCFcfjl+mk5&f{;hHL1YR1hdEihK@%vkfi)oKrPWopWe6Z`7|6BD#m
zu5fLSm3ZL&s`5_&?Q?#)Y%A}4t#DuEtxPgW<`3!$_TDBTnC#u@_tv{LnDCh?y^_iW
zw_>-d`ka}-UXRH1FpG$?Hy3n%-Jgj<gnwMjpRT6MHRweTz#kK3iymhyyDi$fISD>N
zvN>Y17BnlN=ETBR?D(paH=uh8R_8T=jlV;xk6SW(o0cWS7NPHL{}lEe`R&|NT6K>z
z4{fG`zPhMR_FQjcq}2q78;ZLbqE~9icvpl~thm~#p`GqdE>AFJh_~*ecQdu!HXj8B
z>`qe}RPQTNhGW%TV92bgQg>*yaBp=9*3t^hz?tDe{b&gTZV5tU@-q3b<SaZ?$$+58
zGpUe$B94mOmxQT;1S$sgs>5|plTEyO&`v+d^nu?WC0w`>(`Wh1$Su#B<vWuF`XM0n
zA^a#C%bf48>~`cp2k0t%e7j=zWm{!n;(gT0%+fMlc!fgsD<>}}%znoCZ=%i*YLA5O
zfZlzaqH7aeQ-pS>;~B(-sRxJg8z=vE3=5vRb!%7H8Ii%!Q=%0HlZH0(UxLx=D{$<t
zZyXl{h?>v8Kq~xjPfb(*mAD%bU+FpB!u>T%&umh+=0NH8uVCv*5vK_qo6a{w3>W+Z
zI8zq1nr~LH*^jy3o6qO&L*3gy0g|R4z*2X8oy2!}--ml+*@3w;KDAVujWZGCnZ7tX
zvscVD=jKdtU>YOFz1z}k5d}<!gsWD+?VU5*?Uh2{TR0PdWN6UsrC0V<$My5tw7~~7
z<soO9*yov~f_M?Mx)_Xgc1wcRX?>n${9fDSn8ul?GQkM_JtqdSn!qNb^X5>%t6th>
zwUDAwYNLJNXX#+QmaZcI*D4PLiHHOWAmUjy(Ew<d|JX9_H}T|Fl~Ro0By+MYJ;evL
z!0I!MvM?&8@-<yhMeN^2a4jf>lg_yk+mhawa%X>KNJu(B6U(Gm%qE-n0L5xMl#MQI
z^}(JfWd{ScWEZ4i1Hb8`cPISGnPw4)-Vr1wArJX#muD>(9H0tkNsdq?am)HZ19)U&
z{u=vwPGP?2(?GWI9Pxnb|D1`4WH3U*B<zcJB0Y{U0oP_li&+E}mUy4Oj{&&RQl5<l
zw=edtk^@2ir|;Rya6nc>4wD7ZP;dXdp%IwB+V4{|EP<cjwltoOpw95#WcDgQm)Pzb
zc(A9Uz(i7`pNa3K2D6#|o2Z0-(!X~XO*wNXCsQ~Q((6s}8M7pdQ}+2{0689Wg=3GA
z%GDnJn5eDJ{^@DteFzI^#Lh>&<c|<t5O(8g|3YF|F!QCOs;vA4*nOl#Z9A-0%-)3<
zl%k_AHIq9*IsY;-^r1CUUGDcPF`N2Sb&}EJStU?RaHww3TP(&DTXf0H`ew!gO@&~$
zEj0$dXhkB4Mec-Z+WMnQFXg@#e8T#8@9t|OD2w!rU$!h}UCE(j7dft{B@*;!<xn>#
zPqs@v)8@*Kb4Oz%KWzeFCTRluEjoJKKCJ|=k<L|I(P|<%eUj;4F*84#qPjo2fW}+?
z;N+T;&agDd{jAfa{TWG(FXDI_rU+(^rU=4PezvP#p!WBttIQ8><$3##F+mk_IPH=R
zeklq=86Jwx7MCQ|fCfQ@7?Ag+e+}@oomAxWrI?&9B5=#qqXaOO9rF3|VRUW@R3YB)
zs;<M9zvp1i{$Z4Ss}5+pMS6a9VlRKvu0>ra9?NQ`*`FFd^MQSev7rD&K4O73r!_q+
zL8+&hQ^dZ{4s~37wubMOJ9{n&3_8UU6B2K8uo2DS-^N4X8|CapSta7R&`9+LMsyM=
z7hSj^eu0so=T~fo9I7+stC&kfi~Zuk`*sshUE?7Q1T!wh81dnZZdHE!L$xI{@0&k^
z0>2N_?{M;mawC$tO(*AN!??;P;G@44d2qMTYqn$)4861iUX$Gq!Nl_sAGCst)45t|
zt~`NEVwUkK=|IbnRQ6(QwT|yVPn3cb=nedfrU2aGwL2!PXxTRED>vTLE&LAkhWr1}
zbi!F*N?{56&TJ3ez%jC8uXj`K!R=l;qq&u+Me!L`M({C{Y%~#j)Z<0|!K(F?v-Y-^
zt2u#feV*xQtTO7Eal60WHh5(*ZUKz(%8LAtpS81f>9PTVR)RQISCR<mS*K-^pQ?c8
zEHh;j@V)U*L1U`W{89p5u&@8!@!>@?kUbaS$8}?^t@%)B=V*MB9F&iZc=Yl7ZnpNG
zLrGE_x)e<zmepUt4>YGl<@!KqUGlfZqWZw=1V+`*{SVq+TaRluCICES;&ZA9_Af?0
zaX}sWC-SFdj_uDoI&1rs>RrXhOI1OkbfZcD_*yjM%I`bwoNT!ZYhiuIs-_?olct>j
zuW&!MY$__-@wDACSU3f3Ha*xs92wU>i_+Ue<tHX(GHw4FXA&Is@?Dj{kwVAcy=X!r
z^wOxzEbIHVyTXN^n>T5A>2!lfoHgS+E*Yi#k=pay2ntKF&LZqbKCN8i+R`Kap)(=F
z;CD{0*L+|fS075YWpzges|jCcLE!pD;<rP@&ijKSH%j9>JCqGHV)u@o;ZMI9VKt+b
zZ(Kh%eHfbx3{vP1zk3gE`qQ@mltH;M?qhp-P{f=xQ*9+?wxFMG8CGLZ=Nr3qB4%uY
zw7t(shXnAo#~zeBxuR;m6a6o&?QEn)d$^&Q0dfc%{^J4=MT>ql2T#Ys%;M0)D7fBD
z^5e=((>F#3L*1<YBV%P7b;#YO^?@NJ(8yruNFx585Ra}eOs6Z=OaiZQvz_OGN#&T~
zXvevL&OiL9D9cd|<W2t}=_#Rk{tOOYQhRPE?=`yJMoc@WM~T=o=NsX1|2&(BR>U{G
zQ=zB)dWeck;+fw|D(U<Khap9#D5^hh%WAKSJx@++P6D#Vs<8znXVZaoO0Zn=v){6m
z)EC{Fr1E~@3hA9~ssDcJ#trUzGuYpFtp1lu*p^PXx9`d8-5L1M+^xR;2~)by_5WqB
ze^{%mKq4l-VPE#Ya<l1pmrcMrNdA=~X)k!3KLL4y<G)4??Byf{zcLf!r;yE7B31KW
zYrFhHTCp5rF3e2rc4P=*5#3$-^!}`hLh?V$-Pf~!R}9!ZXb9u3@H>umLJxqC7`*lS
z(!%RlJE_3K-vn+)<AZ*dfuA24K4Rsr)MXO(Z8iv06;>spB~4^pLhlNt&v@eO&ltDQ
z`<j{$QFp^|5fnfbca_mdYO1pI!>YTR>m=U2_Q#^Xjqzw4>QrHVecpRFQ;y$=8~0)A
zxoOmFcwvY;6|e5_N3U1vz}>4tb6@&CloaJkkbR}io+cBN<F@_tQX;}aJ2V`vs*)9D
zB?n>AdhzSta~P?<{~@zJ$QX-33F8QPWhjZT1_idvYlYuCL=<#_ne1gAHX-fL1*YY3
zb|<I91DUb|DxYY!^aDEJyu4f9(dKDc7gyb{l-%QiJ4j!lV3?_Z;p>dw_eIbx`cGf=
z?UuQKZI0~AvbZ8~7&6coYgc>lT_Gyjtsx$4#1Lic2QxJKFyag*)rIZ@LR%VvPHo`P
z4&yNJ|4iRAqbp>Mb2rAX$f3}DSd%t#j_;Phst!GT>Yu6-UD{{u&{}g;+Jc@4ua_qb
zpR+moJH}qC^hji46dOTI&k5L=S0L{i7Wp=Ilg(t%*;*RHc5DEQEMuev3%rZPbE4tt
z95Z;ncw{*3wJvW-A|i;p(rNGb3N#I;mdtVExB#2Q3S^CN^c*|U8qJ?v?X<2!{-rs5
zLl5#NpE7fJ*{XV_W$V^izCsMYosL>O4L5FjOhOg$%)7$zYL&>o$81%{Mu<TrC8QvD
zt+CfiF4;7l_Pp&u?Q@~?fB#@iiQxL?e;alPP<}OOT$UZ&TP0G%bd}hK<7t|DZJ;I!
z_Sy^EFA0B7EHjsgeJD+*u=+-L?rMbWolEMB-@9wIq3AL*DX9W|CETQ*m+mYjZ^iDc
z_VBKrE7z!d?uTG&b%n9xHhxY6*s2UL)}L+DHu}ri?EtG)Cf0yS?55}Rt>jfRy-6J2
zctFElV}Eo#h3gd5ZNMPjoX%XZ#FogE4NHvxkRk)`i2$lNAJ#3$G7%MI7JNhdQXp%L
zYq4qKMLXf>lCrlIgEtQz3GWXk7a%6yS+dg7^c>fMucJKN6kU(Ude!DufT$6ESxSY9
zCKK!x^b2qQW)TEsQN&yfVbW=;w^em&r=-q&kM94o4#XIG^CDy{XLulU>hgY?$a%eL
zo;Nz;Fg42*oZXo7OLQ<R+zuNqI>+lN@bEi0aIm^T@+~1TkSO_cNLlC6o&Y~i^@P69
z0!ID#ItLj{z)3t;g`dj;aVnGBvBn6?i4OzhzfQ@2r1Ns~b+Le#LHhn2ACHt@Z87%=
zYy?Wvu-0otBomxd<E<}|h2%@$XFGZt;6DP7Mrhe3b(M&u?-O9ZtJyv6cxOASv|mt7
zrli9D9X!D?cDz_N3|dit+E&$_3vTTp4}=A;Y=#pa_}A9OI`6r1Mib=+@CL}{cft@?
zQZy!m5tBxHQw?Y~nUWpR54t=+od3+e&p2_9pRoQ?XU5pNj!c&Qp->ka=tcMa@%sBq
zq&8LC?BDZN<C}rVAJK^B44?f#>=<rAlRQ9=QUSJKSbg3$iPF$r(HavO;`nJf6+{vm
zKj0TAxF}79$djg0u&FoQRWM}#d*O%Bj7<$>YIw_Z>sLB8#Z_ehW-^P_B3bV6$pm+?
z$@;PkX~tPaqQ&$k<1B^&JtEtg-C?ZxCv-$u$4Btl54<E+aqp%ObR;a)aZLcDC#Cum
zAiz^jfXiI19-BDa9=uG6HruOnT`f{Z4NCdHfUV2Y2LA?^nm6%3bY%chhrnm}2~Awm
z83#hloR8;^bS=Qvq7R!+h2T4fBG$q;<j*@=gdbL(P{{uq!o1sJBLt>Yc51iiSf$+H
z<GMIjXQss#aXXcbDnO(Q*3wJ$^HlW9;xx8$9-NOg<`QZUWX->1BNdSy5B<Ss?=u8e
z8I!-X%H}4*>7?mjs4fa4)VqsUD3LK?_y76FG&6SHI<d#3(N%X7dFjIPLrNhZ5>rX+
zJB{s*KO&pC@Z1IwAW=&{`t1HyEIt0oZd&G`8v8Ue_A+(+IJdI4MdXNv!>M_A3<WSQ
zfj^zP96f&jTDp&}^9xo5?h3U9B(0Jn?sXBE!9(x1*YC8%le?nkYJ~;bbN++~__;>q
zg^g8#EmPu2h&ah!jy}5h|Ccuy1U`P(=q-e3g^zA8fN<rG^s<G{VbSvWD5WW_)_Q3T
zeXZ9TsCdpt0Ny#N`Z#MK#WA~aBawa5;a|caOrx|fVFmm3)nEYhBI0gxu@NVkC0y;*
zLN0paHUjNK7ZxJQWpVRWXQSpAfjZo%FDRooq_o=M)fV*WbDUyPB4B~vAs!M|yF^qh
zmulE+^7^Y@Tuy<R`FMQ~swM6Eqgk3-LeBtF@=4b__Lm2Y$1@W4)C#L^j^!5Nnw>??
zr8c<x0h%zT6wX1WvQeg+9bG_*BTf6*bd@a5B<n(ez3tJqgnV+>>8n=rUq2r<gN4|t
z$In)A(LLn&+!$xxQ#k$24?pZrpRmcKeqfGm^d8dqiY}<8<!6F_gWY&`%N_nKui<hX
zE3c&btHC>B39trReFDI@EE&dpZkRQGy<q)tm+>tRO#>Qx>1|q__)XD)kUM^j!R^@Q
z?#;$9La92K?M~rwTID3nc-m@57m>k(!=hMv`8y_emmte8cFs2CZzWn*64jC2qPqo3
zg<T0wApf8e=~i=FOY*j!!s1tO5N?kqJ@03Xe2!VHwKEbyu*JUi$?Ylr{DrtpAKLy1
zsV6C@!ZX<`To*R7JtNcwiXu9Eezxgf65@xlu2*_*v&zIe@ApStO8$Ec-p}~9KgFh4
zUj5u?S<6()9{1U5WsSM~Tp{$+m^76|rzbCh_?~xS9P4+wCHO$s>*%X(Xpy-<f?v<T
z;R~n&E^c{8-m@8mx&c(urTt!e9RT`@&e0H9`24;e_(e{zvzR>)4Qj<~`YMilQpXHM
zJ`=k$A!*$5lPbPWz@->PZR3Njvz2O&j?85x=-qnam|5OFU_Q>o{UAR6`SyKZ#a4#N
zOBWK2&i8XOSLHO#eJD$Rhx@p>FLDwohkPa$$>=PMCeYJji&ONdR!7@<v)v%~foQ=D
zzq45N-_@q11mJW&Y^KTiXV9bXgk$n><wKkgS&4>XG^w(tQzS9-|Lh1GbI)wTk9FoA
zY>J4v;w;;WkMx!HF+>h6FaO<{Fx3lzOKFJe#s}LBZR}r>O$ovmafnVmhQscV2e8HL
z-UEn0noJz5MKr;55iv1|f)|6PgkuNnEUPvtLejDH1w?C87oZEUITKbfz;cE_<kzrX
z$A;DlRbk#;*rAkqss{8a{A@&zu-@x`lc+%*@}>vtzl#_uJIX?AA!SYDZTcKaq~TlO
zDoh~P!xf=dvz;eiPiE{qntD)XSI;P|Q!b>isuS4kD~}G|I`JAvNVHyQNbWcZXFbmk
zuFdG`?`yb^y#~N=^$T@9=ql(fUg71>U#1~<TZWzZD)hKz>-2X83tzF*X$%#5f?A<p
zEp6GO<1mrTu}#)0Me4<WFBe2IiZ1+o^_eOP-#|-?(@VZF-q5mRaIunX{jo0K^lSw?
zu4AI*DBE$dtuL6cNegFmM;pBMRtaYc|A+2Hwczz9E_l5|-wwB2evM!%wNn@PwwDvF
z8TGeQbejCFux+ZLg*9DLioJ@n^WYCH=aQC6;vp?->vT@rDm(OaHzFd(h}w@UJg|bH
zx=&pA(V$@0XS#|xTpNi!!8;3rO(xGL*>~df5)%*nM-J-a&QYJL1{SuHboDO(1$7z~
zB=K)OEqZkRsCC2VuKrew?So%;wQe2M!n$4qV>j^>ztu)ww=FM@KQe!G6Sck<kl(sQ
zywN!-3uU3H<O0SnHVtk@hHp(476flqU=b>i1+T4ApnF#zfvAU$zJ1Dt)?$G&f77!x
zOnMh!O#bPwm=keRAgrqs8_>k&dAwM4sP<d-ti5sdm~Y+7Xo%O!9)e84W}#OM8i_)Z
zGA~Am_QY3aKZeXb*i3S)+$QX;tMrOi|0!B4$(<W%70ccpMs&G{r`5{N+;`c2s1uw)
z^u+X`qF_vPIyEd$YdkW1-v)e1D1QI;I8w>;;$J;<(5@cJD53u`xAG(EDw_kSleu>#
zhEq0TbON`sv{Wf`lZyI6LkWoL#FMs|?)ynJQL`F8sD9PXYdiT^U+#kkelB@$H5!&@
zeQ>4Y%NU_-?!5s&P@Ezbz}LSwzb!qwwwnFr-o_KrxROvZ4?CjL;qC#*32WHRCt4<A
z#YgrEeH_3T{&x1wfzA1?tE3=67X9wl{sH!Ue+@Nau!0(h{(?$=MayAc6IT>4H2Aah
z8N5nnC3z&^EQ~}D7_G5}BDmr|k>%-ZJ$+#QS1XCcFt{%*)eG{L3xZVEMc@9t)neyH
z!@8#6%xA7RhXLl}hKIIw4(*M1y?V92OP2|^J^As%RJ1ayk?<z2e%^VQZI<`0R_pFv
zB0^K~5F#kgdrCXTcCzRg=Ob4cXbsNh(XRYhU&UO#hataP*lx?#1yjM;*y7R~Eh}<e
z>k0TD%Mm7*%Z&~Ab=ViTt@lU*AkBI4FLCaRxjXgU{Y6Ax{dbFnOR(r6Uo@a((PRrR
zTr#>ubH`TBf3GiHeNqm!Vb&Og<>P!V<DyD%BeDOHaZOnud7ksF;#p%xwvzRksoRkm
zZVN5G+$u}q#1<Ap^1z4^VQ<fod2Pa1`ma2_bEgNXYy^C_2CL5f$M_zH9L%B5FE&14
z)6YC=udH5()=e>BhnXsNlJ9NR{5llSc@Kt2n5<5;P;XI2Cu4H@ku$iI-ZM{Pfee#E
ztm0eBXt}wBNu5@6hl|&-D}yl6=Usj!hI~(Uz}Q;oX#ji2rw%zX^~U~V1~TwToS=@b
zAk`s(4$}pxuO6LBKyKG>=E_s98?%#ehyEzeG^BFIDXJK{kT|CV=}7dXk69fUhO7@Z
ztBO3V=PELIlAyf|JJS2vFFyu=8>|~wNF$@NqQ$QKeO#%6WAy!F2>}6FTQGU|9?p4;
zNalg1SDp=h*6QjYiadFlTcj@$n}$DW_Bs9SAKK(kk!MQ+fT))mTz{eyF4v@kyjGL=
z>GJhYLBLXLcVsAU5+(T`;|F7`ALnEuC#gSk&TwX$MzYfz`5XKcXrWRd3|Jg@J89h|
z3|729jvSK9vx4W)qfrB2itU1Kh4L)xW9@$nLlj<c^N?Nru)<sL?qWB^?W~e8IS&`$
zMk;}gD}DEox`t>gZh}n7!ed3Y`l)zp${l3C<AIogbFE-9bz|3S=CS*P5eq<W4o}PY
z%q{GCqt_{{jRKy(1U2>KLYFFNU9=MlBk#N7vCR4$ZAXSoRD1kb`pGah-G?ex^(#ET
zbup4I%Ak82OL_0}ZYvrk5$IfpTg^#%IVFfcU=MG3uzN-x&C3Pu6M+RyHh=wkthaY}
zCuej4afBDSb85k>K1`enH&;Iro6s=pe%$y+H^x8!^DkC4YKR5u?p)Dx0qTHSH<-7f
zR?_C_1Bk+jO@o<0=FP5-XH3z^5OV1`<jfp$q+r0Yc-4k{K%h|L%Aa}PUbf{NJ;??b
z%prTU>wwQB5O)Nht+sk=_7)jZz4bT!_TO?@w|nVx>KC)oX{LXmz}Su@6!9es@NV@i
zH7dtza(ga5t?Bw)%tFP27u@hYp{#pcY5d~P2D&^B5=meF2Q+wGnqlR%HSaFo8k8Nr
zB+Qiom$>h7wvpw!Y`1u+QX0b;%Zh{7u=?Xx5W82mnn6TTm9^1lrom#z#twaD7ZElv
z2D2_UC;H5{71rp&p$eo{o&*kUaP3v2l1*v3%uUUr*EmBK2G>^a9AC~*{TQhWUy#ey
z>1CzS;cB?I)HNcp{iYc!uB!7j{WGfSw2t^2;$9HZZYpK%&<$7GqI73m{z%e{x0DOQ
z(~To*PH%hv;;IGYlC{KHOp~zCi!rw~GVKMR#~5%b%S{+Nmy)0nuGEiNFXi2E5Su8Q
z1o+$=1sNIi2ney1-OU{3`P9J3$e3KhuG3G5*#l>9gn9HmIf*tVG~V^5oxe6U2%s$x
zE&zG9Df>tZzS_Nz`@@9k`I+r2tUByzv6SEyx?KM}|6u};6lGE0>#SL(fb3s#al0YN
zZxDey#dseH`AvHZYzM*aOYia}9@`OCC@N5i8Dx7D>~_}n=AC-*<{gGr<kX2iu#y+P
z8LcXPS#R68Q$BH0B22FN6>#enD8&&TF$QYnF`(mq##~y~n|*&boaG<4h{~MPTdT?e
z93WRBf&j>!8uR~{!7niR9$CCS&H=E@L4T)WvozwB{L>b_d^>=54>4D$s(~{p)|Hl~
zYis4yM;Ucb>oyYg2nAI*38&uC*(*o$5v;r@lYDV^$%?k`4)Abe<;1tEkaWyx(*SRT
z3tGQ_vq5DEOVEV4sKo>LwgUHD&Qvl2EXK{$m^ig8groGf35&5Q0v{63M|an1Sx@h=
z(@SVzGRX5dma45eWYmRA0t=Z0nIZoSv7|t3#_*>fI@K}sZOV^%S_lBMD)AXNG<wx$
zB6Iqy60){+Oi~Sfg@j{f%gte%npG6@jvI5@>%qS~JkIi<4YZP%a`?7+hEjE`vwSjF
z<+Yw0i;j=L8qtHc-|KgTFj@-$jS?*?s;r(ZBemZ7Z8;S?)s7<;QuUl8rcs!(d((vt
zjHPpMZjOJMi(zZC46lNyw?xFzrY&1^u8HOvRLdr!6GPy+-yWpg>a?P_P$wg|>8$$I
zF(D;qFZD#{K)_yLm;_iFi5CA3*7h;=uK&AgJ)Y|PA}{i5ELTBr6?)DDh?s%6Uo|$n
zSB<XYbGS=8m`SclHQ)#dRS-^=y%#bUh&`5h(yC$l@sa5Aw6m(E`Z{47-rc0Esf{!Y
zmVLK^A~ps4sW!Ljvu1fitC)(xrb?Nxv=<>z5JlJ_BKr<}$rr*zAr^!QMGE3pG_Lhs
z0egY`-0Geql6tI-c$5AI0RU_3)`A^-^l;itME7b=`yUzLZYuWYZyS(>pToBjVTxk8
z4n4+zXL5Wl9LS)gRIDvNs*y02AD_O}91I9FPzxv`Ti^rRVE?iE;;sntO<8SX`d*2D
zY!zM-&LmLM#Q|uFp|G@Ifh9N!K3kKAs)H8ee?QtTd3F=%8`v@-B`>)f<x3z6p0U`%
zSN<ase}j7)_t|cz+OP1Mmfu4kee$``54oEHhBPjJwKzO{Tkm_8jjS>TNG745C4^`=
z9>kT!?%|{?!0Zh+V%GFGip=frG`YZ5V!*<``p5wpHa`xV$6|PC$1801Zkv!;GuSKi
zm?=$M-0jR9#0?nTf(IWySjVyHut99(kn@5C)uNZz-DPSYbmTts1{dtAUCmAM@6)nY
zkCXB+<OnOi9B=z&#*zzezlsKQRJ0HGym4#18lAa&b&=1?1`?^3%GKSr_8<8~7MhvY
z)~?>xuWfHUj%*sl!1167#X!d6DmF8-4`hQbKlHzT-HJ~wOUofK`~jxw5rgCogPlwO
z<20oXvlC>Lf$StN(bmeo{n?8PFYIZBJz5WT*j1<pMQ)(Ye-zX=L;6_!{;*HR%_m^v
zNkjxmpHk(UX2k@R@s8$+Uq$Fffe#lHW5q_32G|ZbMN1`L62BS}As)5}g*@40sZdt=
zt3qg+?I0e6E4J_vod1}*%C~?b?3w$i-hLV|8yqfG3A51CP5$9LF(@tk1AJhZ)dZZ)
zuNqwCWyriS-b1~|*tPG!>UpmdX@Zz>M&k-$nYDArxs4S<_y4Q^Ju+z<BY&ZdbM~xb
zK!xS4F#cK&>Ppa-0>SkdF2<LB;UuC7RKO_714Dw~arba4!t-kZ_nySRJjoijW)E+s
z3}2}SQyttC4h;-(mPccFz&OYQJb~8w(2L!Gg1nUCl<)yAL)>S<Ml=XJaM_-v22_fS
z-;<TkZs2duoT<Vd>%vZOG2tp2Uu*x?@cC?fYS}u=Gx%D*v7#Ns5V;k`&`rRIfYq(>
z`wr7>?2nTtf)%k4_emUYdW9vh8QyS#iZ&C(5brQ>Y<t>;fDtOV*?y)5Gz(D4igHp{
zv6*$tQ&ivOXh6sDt%HeL|M)}lJ$7)XNuM2bc)46Y=QgjIs8~vF?k7Zu1$%|50`xv0
z9>LDl@Lm&HE<UKm9llj@oF&aLA$Vu;Dvt+)zNEMtOt6S{xkE$Ju*}r65S3QSim2h$
zE~pe%Avf>_1$Mc0zIkO+y4Lkg;|louP75vIP~b1car-gu!gI#@BJcb@0ah@6uHl=7
z!Jm(p<nDgsACdEM5#TA&fL&p_Ly-kUyH@wAQ9(leCy7-w#b2j!$Cqjzf(!Q_%v^4?
zXChH0LD?O1z!&3(XO$?)r{XxTTd15$>8N+UcVfMQ;e~mS<|^704EVB0>|g~Xw+s5w
zT!#XMB!0hHv=YIGq+}W$+TDeN7(BvFNZw)uvYks&2w8^cBs7Ihbxa-@j>L2Rbyxnt
za*Cnh>>&GJKg|vsBPsd4yO`X?eWGrRN<Y;n3+EH0Nz(Hg8WjH(s4Kz+vF9g7{n=|c
z1``;pn){7?1~0*8{+GC-qLMympWbY7bV>p|H>A4(ckB=4Rkz9!lE_1*so{XATadcz
zkQtDqO3%iFeE{QAx~WDFogBVjq?ZJD!?PUPo;g}W-Og`FWYKxb#MvM`6XJX|-TF10
zfo)8irdjWqu{}QeG?Mf#B>;;US&i%-=Brf}VO~vg7i`|roSG=v#;(Lq07N^TNA~5l
z9Vo_brv20LHEZTp7(`NfaE(Ob)aD(3S5}NJuV!y9{mrKu`*__s;gap|8q_lJUSAZy
zeyQR<SFH4RM#d-jif*E8t7n<$7D(eHcu_A4-FCVHgPnJ<sH&P8)N~lJX?_ekVJ78r
zbHSOk?i2Fu+SoAL**O}R8>^UmDoT<9u+Yb^UYKkpo&_|S#fDh$Jp7cIAV#h`G#;oI
z6KroYos}uAzsHq(Bbvf%Rb_8g(2XAa{Y;{dw0V)NRx?AUAM6cQkmT9-sb!a6F2m0z
z6D40ShW;#r3T-f=$no8oD9*ByOtC-bfRn<+3{lsf<}On-Af(0C$b2Kmq28=2cN4xk
z-KLR-lDA`Z!&joOOqLhzqOl7ZcHPiRUR8wmFTisZK|Mb9ky91Ho$WHD6t*B(k#8lT
zS?TcpUYut(riOUuUR;_ReU3t&rIPI4R>!7Fy88>v6z4D?OQkC(_P&nBk3aDN`9vDm
zp9=6jkks+o$uaZ5UEVaw$?4N-GE?67*JhNAu~!Frq{vO-euc3%+R?^}ZF%y0ADkiW
z+k!15pTC-3W|8%;E)u|&T4uvj`JKqn-ZszWS{cPLT)+Xt1&~j{w;`J+VT=<R`NY$j
zAufa!ScdLw;~)p`S~_n=B1xey07^c(CXUl+XOkZWE!0Kv>2p1kV)_9r(l+3H6SY!<
z8%7>4dK`rx%nrPv{YvnY^lcM9VZX>HKETtE<6fwfrbX$=HT>cIjnunrv##z<BU_r+
z1t}9y{OQFHO(=PDT6{+5sp4yS)GE<m+coXj>xeLchR#>7a=Usk5vsc48Ge<>wP!G*
zPzV-C**!}D7>UMmrv2sX->AeONy%IpQYB}=db(qVtoeP-`&(b8H^xiqlAE3sWGeJJ
zg>tu6_vDYy7GJCEhyJqC$uOnhhU0x?FWTZCl%&fG83pIBD&8OP1ePc{I&u^73P+_>
zpnrpdpk42v^3(2hglY}@5mOZIJn?Y{^SW*2qZelOq@d&S>%F2>E_oscMDA$$wMa~z
zZvO7XPqG<zwx%S_8!4__ERko|2a`sof|BH8mKFkt%JZTGD_qxbO_8}nTbZ{NhANTh
zBG9*?2Vm^4&jKelU1ti)d&;h?7@MSC7!fHpcT4p%sBeru?&Cr?vTq5Ra%`Qy>5fE_
zM$stXyzWVnqgRYC1+dxTXp1VR<s~BQcGfn-8nUmg)W4S~ii+-PMJk(q!%iHhaqKoN
z+qRUD4KUL1{xOOWCQ!grIM=<|5ROKYrjwq?Yp_I9ZNZ=R+#i1)A>FJC^Kgn5`44LT
zSdjp^Z^l~d{6*1a<`Gjb?nMzn8&Zho&*_9|dW|#@mi2KxCi=m1(g0h2BKoF1mYn=v
zO^|uQJ*=nyau``Wyqn|*qMP5TpV7``8n%IOGwhWmFuY&ZvexfzH|@fn<_&V?Xab(c
zW0?!zBm(tVByjY_yUJ+Oz<Jz?naA|v3}2NxjsIFJg1@XRCSp(gR0%Qhb(7&DVoe<6
zG2yWw+&^F|D6W)^aa@^0-L$POX{&5UK^s2adDrI9?kr)e12p2@B<49UyLu&a0PRBD
zZ1h}MHHoMv6oaphmCHP1OIEXc3KGzUW?eAe%I!kkcMK}WjeMP;ez}h!41;}C7Y*#(
zb=K2du-C}X&bD5(#voblAYULtwQ0ig!s{U)GDRUQMd4-#m6XyYH12i2dtuh5&$;Ny
zGkD3Ob5=Q4ugFB<hjSx_&UWtM%rt#rEFaH-l&zkhZzx)PL8KN_^}em;G6h(2$5<R*
zPGr{9P%FgM0?K*^*#%@={!vYDO0q?l{8pFEQ)TqN{=_R+0_hBS0R{*a`{^2s53B8B
z^f*6>>G3dBgo+Z3f+S@B{oc3hkxX$mdMXXbhp;(2bV7)YOGpX*{I==u*KdxrMU4%y
z5cV1b7H8+>-nR0H)4gAdr$U4c`$nrPbP%SWGUq7}B`(NjOx0ML(iWXbX<@eO4K4Xt
z#i=WneIe1O=ZxMV_T{LRPMq;8MirDkapPUwu*FETAcEVdA&|`=Uq)lLCW!-*^_Y=4
zvFPryn0h==#a|KLF3l!9ys}AhxjQfKGmW&@J*8A@&a~kuuqN4&eOw33{ANK3Qg_l1
z^ixDL4U-_b5Rjw9UZIWFE%!gq$^PLr;mgqj8^<}aj$AlkfL^`|^&m@~yh}QPv_E-T
z_bL(Vok-fc!4;jp+<dqiE(L&aN&WeY_d6=4PA-tK{C7Oxhe-Q;kZXxTuq#xAgnsOu
z?b`AQmPj4HN-0ap#i=fHtBrj*U@-wlfwMDD<D3JSHXvCjeG`^KFiQTkE5lsRa7|Ln
z8v`(!7yxATyJO6Evqh@)Xnc2{@y3o+k|uTShnpPD&pF~gmC84Ru=<hP`f7jl9EKXP
zm!OxPw;RW!aE0x5%as)bJ;@B~DF+OQy+uM_Mn5sZ$#TNb{F7O5d(&9@9sRu?Y~y+`
zxDfH;nmp_%qVv16j8p|0yU#LiHe%?>qaQMC*1y%<8a?f$R4rwVoBq5*SiE}t`h427
z7&C^(x*LEo?5bY!rOvPbQTV^~%%y;g`fQ562H|#2EO!m4Mgzavj)WPgvoS;;#*(Y^
zYNk$aY}^<qB*qV4_`1b8W7ZYSq5V;;{79Z~)z7l*i2Hw>e{2WzPVJ%pG3o`=H$j?2
zf8M7EM9vg-_}$q~QAP0BVx2qoV%a%HB9${q=Jh)n)WenkG5^p-e4*Q>FzgPiYQ1oe
zlR?ASW1I?Ml-u9R+fnBzhP}(Q#r}~;hhpT-OD!#38f4)QH!>twto<56!=*OWl!8F?
zEhv?GVDPnBA`7TQ`p_-bnR!I%`IH$x<C8f3{3C9rBgQB20^uhAo7ERlnV53i{{WUF
z!C4FE54#P%dyiX}^^&?Rjj*Xic5J)u$E1HD0A0#4Nrv5Wt4Sy=ZbNO7vtz|m%S05P
z<K>q}9UvG;E`jz^XadEu)pbJwT}$Pt-uZD{FE{a#UP?)mLI4>)4TNi<G*cx1{6>Pq
zw-RLj(U~Q0ztwU2z9Bz8<gmu!7RHN~b&TtEw>bOO+_?CN@OQ+59GjoVcR)cDCqI;S
zAX%EL(eZJ!4KH{PkFv51<XbN+4|n-}hLQFebUOgCy7Wsjz1lQ`w!M<?sZ;DG29@oc
zuW}!BJdhu|TWKE1A2B?vVZ9OT1G)V_p1#5_s_%LK(o&KN5`uI{C>@duh?I(ScZakf
z>>{Fsh?3GuNrR*`s7Qw*%>r*4>0Dr8_jlIM_x1Y&_U^rNW}bQGnK|d!&P~1kvHV8n
z9$wU8b_0PnmnKPHlaLGkM`0Yu?2m1Z`t*1bJY-)^8Mj%#tXoqhVRWV0!anZwx0<<3
zJ&f!sx6ccY`ibAHmCMh;)^a_xz|?uo$CxxrFvM7`OS0Pf>s?aOPg^Hr@ZQ*FN0|5y
zF&(rue03HS{88-V2RzBf1$W`{&b|O<ETzYJ(^U+cGD&=D+M-ZVQ)-o+dRM%sVeyPV
z_!FVTTg>GqQspO=o8K1UF!39~mu6SK(xr3Z*{=rVXrN0`6HJ7?Nw*~Hm>u~-zQ6uh
zE#ACW@WAI-lqQZ6Q0c;VfJ#r6HT)qGd{3yAYf4i?sde&t@B`ro(J;L+_|<pO&a;%`
zc-AEw9R*AHhmO?+uLhN>?#YQY#|i?yK-?2&{DS3;F3*auH6vrIYtt{_<B^!^4j~e6
zO6d>Mb5})AZUbTbUMP1g#8N`@i)&r)qB)^$T`4MGM2t_{mE*+a>FJa26M}km3Ns7$
zC}2yk$syQiKaN7b_iVNiHh)Fv&@oP5B&&S;8&}69vpj0IQB@sA2hs*h(abPhOi7kZ
zT+PEkTY&d%ect0}tv=WiA4>p16kw;7es7b!%jZa~5*D}KkT2(UUIyxV<KrEOUP+R`
z`}qL71?NQ`Hv|Nn<dn+5#QDvqKfB1aj&ViZwjczNTh*ID9t{6A9w(1^tm7Hnm80HM
zi5b>Q0ktqQ4U!pWy-bLwz-an#I{?{i&HtD`)*1<`Pw1IfI<{is1TsQSa&@%x<Ksl#
z(5<zTuI;t98x&u@jT@Bxc4<2A?|)kQ1C&a3v77m@B)-tL)kDRj@#Ge-`8PsE%zHl0
zCs%nBCM>OPnG-THr|Vw$cY`wy9!c`8Dzek)<jx)P=Y*;HY;B%IL@8x{DE52u<$dZx
zstRQ`((_5%i4e9wcJ`8&$qulCM;w~?@@MYkk8CDXQ~s2dy`vO!C-}+L@s+Xch;4W3
z1}8_lcnhWVyyi)#^(vx?ZYo-5;@ad_?=8k00hk>q2RVY1e~%@9J&*X@Pqb#a|HYr;
z>&=*u*Ggp6d#;E_DOr~jukz)vaa&u8Uwu?zbR}#ss!@zy%<No~Rcp5z;P*s>6^rvf
zt3)Jb;^s@->-u;VF}65jo{Ro2oDgNH28HYa5!W$m{?7l2xT=HIT!^LTKH`)+7v1tG
zJ(&IvvHe=M<rCBD*PrZ$1pb!!+?ARMni-9KgQ3%bfEWp@+y;*@E9i$)!w!^0m&g{q
zd(+S&x1@tNbs=40jfj?}^_;QDK!8zxJ%;(^oGv-tGtiF7-Lt@60=3p$SDyaxNv~J5
zb3g7f;kdyz6<FSNiQ}L8P7lca<8nQsk_OA%Uz8}hrp%HK(0BCghgia3qc0lpw#YSk
zNETa71~WY6=%w=ZdL-*Bo@%B!t9XYdMeVFF<sjd<?q-E_l?ty4F<hylB|PQfeJpyl
zN<AV!!m6CKj9W>=lPaw7fhuhD+rA_MeQT-}8=hzpw=G3+s$x@dynB#}X%WzSYLe#s
z801`7;Gc{K*+8;=%USW0W95GN7OXzAM>rAUeBp$RcAmyP!UrwmY4M@%iT$;A27gA9
zQ8*aU1Z*X0F25@npr4fEi&K00wHSQ!fyjd#Ci}VWjr*}n<*HyQ8$1I}+Pg}yF!2I$
zvoAZ24R`}ro0XUHP+zZnTmD3&Mq_#BW0@Knz8xjJG%s8WsvwSOE8t|mGB~)`pUN8v
zz67B{Ol?JMuYn+bsfqY>5E6iCqy-<>^8xy*H;2#>D<ctW5`*6|>b{ne$ek|EQc3sA
z;tMUy!F(94rLI2=8?Ge0ihmYQ`C;>C-<=7YJ^?Jc1foHt%uW*lR~1M(4t)m6uuB)X
z3?-Xc1ac*CLoiz!cR$XHOeymm4HOlw6i<B|#dEb;jiX8M@r&FUq)Tm+LHI2Fm%9|r
zw$3qPbh-*u@jJ!m!!}GbI?bJg5c-E)!d66d8l4O2L!(48>I%Gn?7jELCs`UKT?mWv
zQt13MCLK7>`Z`>MgTY4^!-KfNgLl;!Acz?9Y(l6pln@c+Y<jFwcZ)i6h!%>R3FT=u
zrTuWlVt2O?`3Nm0(M+R+eYCG#@q)_I?I|9@`7Y?;z)-7Xemmu#>$#HrCHR@`HLaWR
zYk!1mA|f0^0<g~>Bt{h?7yObh7g>ADk7>n}?8M6W^JzoGs}58>fDXjN@OmBQH(WOH
z`kz>v<-}Q6Q`nh^|BTQ3z!L)8^TedRd#D0^XpowHxl54==jKRvY;6;TmW#OSpxHZG
z4b7*b!PhjeVl#*q(;>sGvmCP9U&Hh2M0)A|m-DY)1#*Vpa02TKC+a1Z`iruP42>y@
zeuM<HDN5=MxevEuTe8xk*2jXFJ6Mm0F{&^dLn*aEl`_ssT<_194n`;Z4~koGG&$Sr
zx+208z1SS4CJ{U$Lk~UUTif$M010<egV>p~^qh_IHst*&GK$Xu;a@}D+|bz~=RhX>
zEVw~7M)C3F@v1JWa{R#a@IY)B@ONe!*4wxkZ99HNqnGtsBzP+G*Vo?$w>4Z#hsthM
zU6nqWW~={vpcvQ?6=linMG&Op)6A3m`hIt*fo)x1abC?}e?jC<)r<y=B;L-4V_M4a
z#rIXt#-Yfmh7W&b)(+WdI-jj=u_Bf^dGL00+W*1>POK)7+oy_HmFOr-k3C65&6Ecu
zGe`VR8xyfC(jD8&gy5#!;?1W{A(!)&%J-AF8NeL9zJOb2a3c1@O!GHnZC@YNek)10
zdOT*p>->PJXSrnQat{Y2M{&S{n|;~eU0r8NO#S&hulZ;MB1$jJIMQi5apFbdN^xmb
zKW|D?_qUJPIT_D-DMX5TXT}!3KYUB9i@zeev~yn;F_zw8itiVsOh@yJ`GIiLu74_i
zuMUdL500ncjZacq+>0%LC*l_%n1jv|xz})5-ag<!o9hDnpJuxmWfk83P&m-R(~-5y
zdTbzNph}>s9->Kv0$r;9!Ux34VKA?rlUZWXuJd6ttrV4!a83QL%9!=PUrvJ>Py;u8
z=%UxD_pd`7veZ6Ab9<4L^4?)m!OOG5#nY-!?Xd)eRK%a;|7^k+C#B<C6ERcR0LgtX
z&GQ@P%C|UzRa;54HGUHz&NjlPU)mgutpEJ-d~Cq8-Uj|>e70}kqHeruMjiG#7UUvX
zQJ^6IJzMb{dRx{gZNC4)0lF4`{L21LBINbL!O7Upu$G6T$xR!gp!OP}j4bEOnct9q
zp8u9MhYvRT%Fc^J*4t3!N~ZA7vj&X60UU3SEuzPSCX<LdXqc<Rt&ayAHd+t}ijDBw
zA)Xw$QamPgr7R$%JqbQk|20auC!+Gc0@`G)!;*r=klac4Y2#W(8K0_nC@3~^33$1G
zbga}<U8cX<kLeWpUPWvy)%Z5bcY2~Qqyz)neK5a3zu|Iz{Xg*!PLzKH!^wpr$5ijD
z{r`TS-{OaisH<_I3t!CZs>H-XR!`@>bwxh>)yV3(LF)bOjV8jZx&%88t3IqW=yt<K
zMeRi9U#onP2<YC!77Htf-^Z8_K$_fiQ=7v)p_Izp#Uyetx$(7rL)%9c;-pDG=jAlF
zU(rKf3<*p(Tw5r5V(>Oa;~;$=yt|;~2dh;qJd%VOkMH_dRiu>_YZgrIQv#qVWM%+?
z_OMrMA~&(^unycqc%^4Jc1onEk=fR>o9H1!&yg_xk%qg%%$e8MWeJ@KLyp|gWLCV9
z3a(0*4<|gs4*_+LHDF?muVar=FyZ@|V_MdIym4yAo;&fK2&}2!W7GAU-R5EeO(h)(
zP$}^YHG6`K9zMm+lP>F{oT&9M%9B$4yT{3(ds0-gojw&n(l}U1-|&B}zNC!lJCZb%
zIhT{1L@y&7k%|AIq-(U)QqfPZ=yt8HjaIAa8`6D*pTISK6LwU1;~~HUjq8yHfWb=_
zZ0JCA^7uQKzrY6N&<g)nY(D-(?3YWj6koH0fjVa#OZgA9)1qFfXIpM9lxMx_>Wp!D
zX!u1!qEv-ib)Zm~RP?KsghR6d3`X+v<PZLbg)jrp3F$YK<BxhuV#@FbCBf*+%UWRp
znqSoSzD(XbkBxs$dc0S<U1aPRZcf3jNY<lCS#~AD`gbBU<vduO3-29*%kSC2V18cb
zVvC+BRejfux^(6|pjJg)YA&icX+tw&_uhptjoZff*E4WjC5{;2pmPzS=rh|d`j(Ya
z|9#^&;Lqr3x>Dlka@Jg|iGO;}0L$xa{QxE|9uZocvo!-HtQDkv3m$$rb!E{xgy+w+
zJ+?S{-IEZ^SJ6Bg=2fsdELA-6<~}Je7%>~n2)#%0OoP4Wners_SWmugR80-GX~|kh
zGq8l`co;nN_SJVPrnmHbz<nQ?*DqDERCRPADEJSaoE)JYjLfvvR5C5_AHFVtGjW7?
zTZ@Uq_0OLmBZ;(hR|;Qyl-PW>BJ;9Mgj!HwrL8Hmu{l)=C*!`4%21#G2Hh9)4&z3Y
zSJblM`hmI1KrVoBu9&+tMq1rN?WXInkpDFmf3J1*6phb<vek6ebXWQ52^697tpPYQ
zPA%|z7<}oGQk9TqBjpHR!Jj}!_=nyWx#CU7+APc5I5w5$wr$f87o|=PqC@;~LOM>%
z&5X-Sk4d_>#bcczI)kU}@H+v*^#pmnoMNJ!^VjXOz)7##^kOtW9P2$@uL(V172C%3
z1f4~ITAKU*$@%vOEthk2Qin0Ab__pwe8i|*ScMx0O?YgHltz2uJ}2!$4NKU>Jts~M
zCN<%#yUjN;qC7-t!lm!<H5E=id~J2oQB&i~EYjQEHhv=j4MZ7jr3npK;(bU?-?V7B
z!%Gz>G}ApHdfYGU!?gSCU?J<z(-i!LAw`;Boz=a?1S6GaPNH-l@je!=PW<OiP-hp0
zbK_q>a0^iTd+fOA<Wj?mKT7D_bHTcrh4>)q{^R~<@<w>oHP~r-<Ihs=ORZSo&Lug?
z!`ID_Ed|)^pAGZd63x`o%dqtK|ILRiG)`TwSe9azT3!+fz!l+4Iyeq^pRVKIyn|zN
z4dwd`*8u%+kMJ#~gqZFnsQ@sS#gY46YI68|zk-OpVLU-c=k{H-0@Sw_$(0Q?b!_yy
zKQ4PPk@Hp=ckc(nt6N89Ny%e~n;B)#W~kFpPi0G(&t&}I1soZtW~vD17Lrdem>sv7
zcOBpMJ8rLr$0kc0X&1b86xw$29z=#*Yl_!mW-lI?G5?DYNnC{7=1P78-y(1Ju$sBs
zqeCZ1UbRheytT8me;<ER>Dph+6r6)YmZg5}XY!r&Q>q7aP_AP=!Dz|(^Re!lnRtaJ
z&=RCU(%}3=5@u}}Tu^VOcvwkYtG5!X{D_^wHyo`8rEUJSt4gjwjMrpggRD{T+lC@h
zQ9Kd;qrL3|Z`U}K))V@@nLHAQ`Mg7gD?(X8M{sV~!GWVm4EKIz_eq2EMVli;8*XGI
z-@BmIb`=%x;zqH@3uj*f(Y5VP8>#ie7CgUjyQBBP!fc<qzU<>B1KpIUb$=Ymu+w;8
zWEa9>7Bmrfxx4pkLwA{+<10{cckfu&GjBS_ZB!o?jO&zMnk5=wqoZE^^yGyS=*K^}
zzdpXnp!{y@LgPy}rC1U{&9F0KMPH<Sk_G2_@^3U#HDE`sK14So?c}^CwO#R*QlJ^4
z5!%<kv;nZlVL9s_D8t0neu@*lQ<&B!nxyXu)~X$+i1jzOkud@4jQZ0kZP<}xFIy^g
z3*GMXsw<gKWl&UI%PI=*0+~g{z?nHz>xEjNPb4_wZ%d^O0~3)l=hRnj{t>5Qw$Aq=
zpzci<O3=o%Zt%))otsx2HlN~JfqBzD983~8r<1NhB`?UW`HTe=Z9Z(|=Wx(>>lnG2
z#)WWf#$GbKc7egZOQ@3~Fm?mhJn!o9C`GDWm5n=HIail+qIQ1rQN%?@?P&SL9+FVk
zi-b;`LC6|`{ntbX4~Kdim>;s3(t^a%o}7I)F&JKhWvQT{q0~!(ys7x!^?MR9{vuSW
zG-(_;R%mGc655Mk7W;G|KC4Z{cIIxOUOfgAFTt^bFR2t^*~;bvnqy{xtT7pm#;;uT
ztyw92>qbFucQa^9l7<F!_rJcnmNz5PzwL{4Ec|k1oV`d~HcQsD@jA#Jehs+CMB5Ob
z_35Yj#t&T=`N@=XsBlq4mq`T^AxKa>;zAVC!E>@MHF%lrtJk<Wn1pqPFZ&5nxS&}Y
zt%fdjcUd70>N|8_C9SVXqg^Bd^CrtNjY*a+RG<kX9`^6)x9~&g$?y1RNVW<ZT8H&M
zF}mgKn7YS0H#>7Oi{7Q$l;QzwNC(A*ryli@?P&yQ+11Xs#U9d=JVRN_`jJsPq^M6(
z&WpyRS9x#tj+JV(X(A47qT-JfNbu%}*%`V5sxssguJY9hyNqEyz?>P)FTO8+%-XBf
zgdL<>Uigfk2$gmpJ-!dzpp|aM>5q3P&-!!x_cKZV>)_??<FHGIg<tuR#hZ6IR#FTV
zAEv511w?Bh7)drE<Lp`dvz?qMXZtvCZkFc+*OBYG>|_a@8S*We5a2KCVYtGXuK%V6
zf}G(XPXF_qaEEI6q8*3y8h#@o`x}%TDSM^x`P#&6DFfc*5-m;KtFW9*4KS{x>*gca
z!FM$JzZRg*qevT>D=V5_HjR5RaFguD>y*uLF!8p32IMwccqAOiooUwJ=xw57^v7Mt
zdV8++0`M8!*f6-TXZu-P)bf=5!*CDPT36Gu>ptBLU;I4?56NKSy6V<hi6HrbQG?Z?
z>!#)8^JJss%82-HdmqW4URA2{(u6d5FPgFpFB_1zP5ZJ_Ku$P9uYxEUpoRWZN_V@j
z^SAZeh%(_!R>h?jm3hv@PNkiV4X?>0;KEe6DEW~{Yb!3m+PflP!>;vZs^oQ9tjT97
zhxrCBXcz;O*7#1$6jl3mC9F(Rwk{xlb?ntlN`@2R!odG(*?`Cg(^q~F6)OS{<2P#l
zvH%N{^gj2sTyb0da^uzFccq<B8g_K_IE}HHwN8iW6sjf_IH5&~?uAgwvc#6!jA+uF
zU`*?Cp@X1X15;Qj-&xG*-)|~zUxhexH9J4?)96q>Bc`cm^Nbxe;0^0V7!ZsTjbCd7
zj9h8I-JT&D3|GMNyu{t0ATf89FLM;nJqi|>;;n83D1=AxsEKZYQwUiLKUb8m!}pP&
z0}dNk3s0w*iP14iH^D%KliE`bl=zh=N`dAHkkSvJZNTilJ2+uOkO5DnLmTV`N3PP6
zKivL?X=DgFaqfnn^}NPZ%UrnQ)98@lVEM1Pu#g{{^Kk9E?=dp`s%5q#adUqxtb->s
zA*B9s&UbN++<lwM!);ZLODbF9_bK@PN&?=E5+Cp2lh8#uCwRkSq6$+0H;ptk{veon
zyQN!ML||4=dVxN3i1|k`JYoiq3-IQGW=uVQ%Sk+ts*RgidBlj9p}^l)@3GB<BrU5>
zplAR7I46>r{V;Z-NbKsyC)9vj5_B{uh|*0Dj%?SQXI=cnjXlh&wzQ4#kX80fUMGc#
z5RTJ}&-qC=K(k>(A8v>Tyn6tZjUPTGF!ltR5DXnB0lu#!8B<mg$(Dv({~0DRa*>WF
zBC{q;@-8!G1!kGYqXhpko^hms7-tz_F6<&u)P=#8RJootnrJn2U;V_EYSu2I{X^nO
z{-Pb4J8|LAS3_=Mg>&q5!Au#HTe#PA#s47xWm4w1hm@>vLm6!fn4`+@ka_=A>JmQ4
zh1hOH<@^H7U|%AC2Kwz!^2p%NU>?uaO<^aTfPiZ$go7Sp)D@+Tzx5(5QVl6?{;7H9
zVg0b{1m7L-4g{|JV$MG%iA=akU6(zFjvw!sg74t`nW_=_nHMYL)C=#wl@A5CKmRvo
zU~!xi{Rw_&^I|uW_q)Nfzovdw?Q%3axGA-$b4|o=L61z&i7p?l@YIaIRW=;~@L;$g
zsdb0|R`6etly_p#@6Hdy{a+i~u&&v6$uv}hYmHYTz)at-PEs&G%#r&ZbarraxwBv{
z_Z8nz(Zb^*Ogr&%_@v1P3JT5++m63DIa8eG{1=vQbHJCRfoufLYX0s*K|#`tz@0y4
zIq=@M0|GHCFP2F!Z5R&qewC71uW3!B9|u>FJ2}w6N102Ax1f~l-lM5T_{t98e6Xr}
z4G@cWd-iSoju!rUgM#$ovy%S)A@3ay_FNZScN|vvpOd0d^!Hswi?<x+48E)p=2Wn@
zsp93!x4zEgW#4=MJq7dW;;4rHD$i81g(SrL8@=K-H(OcSvljd7q=u-yijx}*w*KnG
z6+`P1ToQN+7tix<cFW=OlT>BQxoc2TuIY3g&VjXz&Le3cnYYptHQt?J6>}k5eBf+a
z{3l)=XC@nKN?;{9X$w<l_ltoU#l)Ge;+DajRL0a7l3~;WzGOPPSGa&XjPLe`*54~6
zNrbM9)?h7m_l<~~`G>F>Et7pyXCe(J*g#H>b9I1hG{|r$;4i1hxJ7@!V69z=#Z%G$
zet=YPz+#QRAi2-eWMk`Q>A>Jy&I1_wdKE4a_&L3p$96v7Ijfucn&<UiUf9L`mTj}e
zm3Oh=NR_2w=tsiIhU<ppl)~}urJCIxKf+1(QgqU{3O3|ZgNq~EKzJAf$c13Cg60>i
zF=_SD?CSGUR#r;<w7|vH+u}|(;}O*iKxzX_vW|)i&2H=ZDn;r~gp$A&-_3P#I~$1`
z9I~)~Z{9mA=cHS^w5!ZcwMKwuzCKwTWO=xU|0o=WkbJ2L?DUjpDy>o)T~9enfk0bP
z^vF!03#O4*tR8-ko3g!d5)-TQmmfsJIb_Xe!SS)dtS8bhrhV!b@MW04?v<qta;L&%
z!ilD6T|Zb9_01(kIbTd=GeIbs{ZuozD}}_dP%%_(>IT|#Unc(pj>L*%$x)UO$qRqa
zb`@xT93K{9G@!<!j@j~0=>*GB+}H97P@y!|LSQ&Gibo|g^y<!K>iwHUV2bxpz@NZy
ztSRT!S7r^$<4{+AnqL<GWnZKD<@UAy!dR3|GXA;>3&Z=wMekYm9Ro87<&!=Kk#RzH
z4koJz)|MSTN(2}HaIH#LZcrm*9vU<VCo;U`&HaQ6{dEcXlZkpq=D|G0WyI@PqGyxr
z-JF%3Qhy?S5OV1}cuz(xINiX=8%#VUIJAL8do;{^V5d}MSZ?F;NL}u?;=@V*u^l6;
z+cV>V^1gz0VEK!1*jf8JS$Hi&BFkS*PLRXNhA(P?nHSr`b0&-qe||E5nV>5_r3n+y
z-Z{LE0EL0r58_Sf9s$IdB-8e8kmH@{;X+y(B-s5zO+#5lC7-g%5<Q<_)Vv_KLjq;)
z;)@jqGLkw5sx{jI3TBy1D2lV#Pj$)t2KSgS5oBPsFbkKW*xRub?XogHjBxE&zr|l`
zOz2r#j@;&Nqa`pHfu&6Q4MNty$8tVQFYGw(dbtYUpq|^{1(Q3M>Ck`Mk$4;&Ok(Kw
zkf^>=3E7k%GAM*ttnPE$H+M!FO0ZQ32D>4cY|fga@V6B$hmZ1Jzi_$Yc>C34)=zf=
zDS{ROQfm|1k6;3q=9lq0YE)r!bhkP?wg=?T-OfiwlU~JB$7w}PF?%9^3uuim;-g-H
z4JsVDepf}38}){RCR;j&VkU2NM7I7nYvDmi$%FT8ODqxm=aO2@gvHmfLEdD7U;8f{
z7u>n&8=CHpzI~Yp=1}l(E`OXf_gH$IU!HhPL=&+~yWqYY`d@|P&ZWT%_r=|}PMQcI
za8IKJn6H6}|J^zff_e=x7Cl6o29p)>`z=bI^>Uc`?nhO@o{o*7*4x}1P2@Ok^G8fc
zGCeZ0=2V+6;Cj_Ff|!JtGQ0bXMHKlE*j2&7Bob&s@X_kn>WB8bCm1U!;{vzGR%tE`
zUva|;FaD*dUdmxbaLF>K$342Vdpj`U73=O`{gaRiyfLiiRQ~+Ek1n(y!F;?D7{sOd
zb^q`1^3qlfoAF5N(y-Q5tQkulx$2loAUCmRrhA2f-sPwd>Yb?`?C2Ga7jB$Lo9C4t
z&b`RP^Pa}zrCdBI&_0|ChQMYDnmCdfeS(FnR7AZBi~~PLpojWn{*T-jChx$nlyh?g
zkN*38z}bQJ0{J}2KGmA)*>wV4^)IUl<(cTqIusAyTNJq0P6ryE0q&)qKzSSAc|5*<
zQ-qK{^C;}=7#`+H_-4)Es&CQ8EBV$QfD=so|Lj#guT+(RBBGIF?#Pm`=4tJMv+-af
z&fov`9@YXX3kQ=-1Qiszgv9z;bUY!V`6G~PIF%+MzOvCZWFwv$weE>SQT<*(rz^uy
zX}SJ457seNG3KIOvz-@?Q)`%Qh-$Jl5$a0^KEcU7bJkFH9kJZLj|F8MZg6+f&Mf@e
zBXp8jpl`369pfMmM=&R@t-f*8VRv;}T6m8)ll&(2!Uq*(_|P|WyWiI}UqA15ZW<aS
z=gi^uM38*`Jh!W(oM`F!^ER^7`LH9AwjW?`hIqn1n(DF!3smsi@gjNm`p}l)md_JA
z>4<Hw3;07U!%#u17d8OOL0<LV900v@P#XG|5+m%pAS-k)H4iByE-TPp`C@Z=>e<;9
z%jpzBFtI=r$AwdMiVw%wLh`9evP_%~J~G~<SGL?)n{IFJ!hPb>fBrWq2%NB-VjkqP
zWVeks#0xkJ>@`!PoVjpyxqjD!)I+50X;hj8{Vpa2T9f_jbk%<q$)>$JYAG%KsrL?K
zm3%bhvLpbU>!E|#g_#6&a`BLw%K)3#v-IjlpV*K>MCR?`(6g>pYBQbx^Q+>=b5o?5
zP5PgRK96mE__j)vkaVe-gv2T*9DnOnB4cm9`wo{uZq1kxSSwAdW#HG7TDLBhy=rWf
zt;i<<r}(R1!zmdOWk+pQQ^<RB64<YdH-%qH<0&h|yb?$5Q1OwwSRj@I5LZUFZ-aP*
zeP5|jo7&<-*t<Y=bJ+Y<>zo7IiNFS?<Zs<=lkaYoank`n1PR1h;OM7^L9Jt`f&%Ra
zIl3r04<%<FA7>}5)$kk_qz~+scdPj-HGxHSr#8C>M0w35ncc`m1J`ilU?Rc!r{C$1
z$i>+Tc!Tc_?T<O`cVb@}TH?NW3%NxM<P+%drgP(&8`6QTJ6s&;k3&51dWd@GOf>A!
z36RvoC<U_*n})*A%Vux-XhlcO;iiS17fnb#OB05*K03jc%OGEB!49seksE1e5;zaY
zvs?I&Jz#UTy;EHBy#!tH51PNym(H=E;t&`9SJycbcXrQ<NimBL{TS))0>?Xh6H-eZ
ztz#`Oxs>i`;X9`g7Rmg}Wcab?^R!9>Ej+)ll*#Lf?;Dvla?jtkV97$9IhdGnA7<bD
zdvh&a!#rx~YQS&Oo1*tcAJbu5%|R|SB9g_Wh*vA)Q}F-Q)<!ebhZ)j=2{@|={`+yr
z*>=s~)vylbn?q~M9>g*<-Ar$1cd+dJk{Ra`c+Ugml(HHKKp{ldYiUB$fu9h9&G4vG
zlw3H^JhW0@mRyOL$hDD5{=ev@>wj=%bEa(_UrrEj=$pMdV)nish6K#4!o+E{|1<bS
z`NJ@4@^8QsXHBrLa4P`Bo)FHI9LHcc++OS2i>kwSs%x(ydHRgOx7`DZqk8xQCe??#
z1D+FvqQc<xIM&*S2?t?q%$u)1+}5}irnOe^{P`_s3NV)iL%kpej`vAeZVXAs5lnXF
zExGp-HKg%SI@+W>ES{C(Vp3Yj8Gz&a@XwLo@~*2kkSl*mmwP<fR(;GXJ5Uc^MG!|s
zVI_En&t9_ycvF#tXOVcrK$yqPXPz0-LN2sQB(C_lB;sd%5Dr}}FN%aOWtw|=d5Wx5
zwALPD1j~9<U`x@s*Kqj}w*UTl>9qk@jp68?2>eunpMD35&Z4B&1e%C17*!fDAEwX9
z@u-Zv>gKgtK^%o;#EsPJBvoQ2IiHEYRg|^E*lKKrWc5V6N2z5bdH9g@yaz`j@5cYp
z!{@_!7@GUt@*F&lu$j87izBDz`Oa!I(ykmQI<JTA0m(C+&zCntnPq09r+-RGRHWmL
zazdM@tz@4?J(|t2645F{^Q-Os)^#NsgO96&0S8?dCl~M2rpHn%bO!QXMitWG!uZY>
z0~>#>YgZ!cD2jZ~Tj3oYbU>>&vfMt5cQ=Oz@5gU&oCes~#Q`QVgvGsk1(fs;F({p_
z;LkPt$FmoU<0wltd9VkC21)hLv{kgTx^|9|QOEbG`)-iP5RF0{jOZF{C2x;<Ng1$f
ztq81|5W!CS+Hl!^EVFEgA)-DBC(rM9gKkbbb^JBorx!N~gQVBCX7J=#Lk9IO0=_~!
z&gp~?iGsiD|6^-@4GCFTaV%T6ZmLe%8}^HP{L86(2Mqrj8o$C8iXU+>g&4k=`RO><
znMFyHEisviN7U=sLDzaq*hFtGWCd@T7?TkdHP-^hP6qyDKB4sdPJ+yuN}TMvwl@bq
z$4;Re*c+=i+YYhip+mg`O`n9n(j(OK(&@P_)z<Z_(j~cn)n?oz66&kI9Zkr#_CD;x
zM^0&*Vfm7y)f@9amlMUQ0{D2o*{Y_fOLnJd)N4P>|HNI&9~02PMV{L<vaWs&(PZRc
z;Fw)A0dveIEa~)=WGX6Y300(-8Y9}P4)5zXal;Nxcid;kgRG0{V&MkZ-&^^+RxynV
z+m6E-=%l`H@cdY8_Cp>#M>Z{d@%#8tM`G2SnF9w=4bu47>P@tv<L~dy=Q&~UVa(e8
zDY&in+!=xx1C-U|>1^+c^fPb`Hs0Pq<?339kS;jTew62^is(0lPT!V=%(pkUY&^Em
zG&XQ`bKPFcdUO{O<-q;eHG_mLvt;Pzg|n?`-;2;xd*5<-9=jTJB`16&PZM$Rg$t2L
z2q6N03u8t-N$O0V9HE7gLsSRY&oXj#vd2_AEGHqMkas5TS*AcPskzL5q)#K#xRnt3
z(4)OF&R`$=)smK-e+{ol8{Zox0JX>^_TLVSMcIy+E>7(<#+z5nFv2q-MjdeoqTseN
zY`Rxms+n!kI}3+Zucb%oorG9~jx}rRH0dBjjd<`{wDH9?fngpgXFdJ0)5&}nPJI_H
z!_#!H?isva0i6>YR!IfDW%kX*qxgL67JaSjh3!*aPhXylr_ZcQ3;o1N-zm6~J-i_3
z;6(ajk;vLLM>)rR%Ys65<+k4Y41Cdq``|-lcdC&&q+-d=iZ^bXJQxt^6KC~J>+f|t
z!Ql6OQyfUuL{M(>;F)reLe^V#vDh-X%iWJfKjx!44Q**K{q}Wd3+IDI8JCu9P$nTQ
z1igyU3Rq*aD!%4&mm3u;EYznm-S&ccGXy&y$Eu0<4w$#$>0!~r;JRt-j$2~!gh$#U
zTgN&F&P!U_E>w;q#}{+>%lzx!!R33dn>~A!mm5kFKTP-`9$aSdhzBo8j1KAudH}Yg
z-aP!MLmn)cj`bNxkb2T^8CFRN>C%!ykm`5tj3%k%>uQH8Ng~7(waauX7MWX^c4k4g
z4Lhp5QxegzGF02z_2kn4o2R2H{+!x_o-T*ib}mUof8z{7w!LVDJu3J+kTK(w5jihf
zQ(EkzJ08lGcZ$7wQwyJKMH^w87b1%wOMsxCTC`=C*$p|o7?Er41(QhAG@$3yZxw#H
zpt8<?4?&_VDGtqo&7-$oi8%($<@-9eylxfY!h_z(2+r>g{Gm`j<}>q;9825CSKg<x
zW_gGEMWKTH`<p*g$y|yP*0H-4zUAKpZBf|XdjYZ?-?=)1W#~F&SfP&fzeBL?md?5Z
zu8N=$=JY+QF`3qa)zV{}OXw0%LJ+~Q7vIz~w>;B(fi}PL)dF*pOw?G;P=3KgVds+*
zEqa@Hh|#^GMw6hC;G~;ebkil53tJTmo!z8}eI){@Ln-9!6>aFn5;@&*YrmQx=4G12
z(=+;1*Wr(-z*PT4$mUastdhBuKS7mx8Ggt8jWNuvV`pW#LGkA@JT?xlzHp12Q`d;V
zd(hGgVh9l)V29}%=|MRmLlsEttqU91f3{+~JNq<6HK*u%`m8pQMExtG2%1N8=v`sf
zuWouK#`@QHT$~g?gXPl2#hbHPYHab}3Tzy^*@L@qWycz||DyGC6q*l2MoN&2iY{0c
zEdfcLH{b9@1*W^;<5@RmdPYwlBzf{qpH2TMXqC9Ul#Bak8@gs^h&V;Ws`5#C9BG=x
zku`%($p_dzeD*C5-fs<6{2RnqtY3ajGZk)T7#w%ioE>G@VW~z_S<m7Y=iP;`h+}i|
zDv98jx7xE)x4RaeeZ2BM<pEp4@B#_VM`YXZ+WfEAnlvFyA09>VNH3<}j%kyu$tihn
z#ZRTdpE__bD3Cxj4CiOssS|W7y;Ch|*$oRdj_D^wBW>nOG21WYvkC9_?Si;xR38sT
z-_?KP7!o<7n{pk+E6|2{U?+JJ@(dcG;sOZ5(*Bfl$_vx!?(jRTFTdc&MW(jIume4o
zw@8Z4I#(M%D2;IP7Kq!^+F0x#?YoM6k1yq<%v{_hv3$tNa`^I^rOPn@wEsPfK6MLo
zJi&87s*{1vZ4~ZN5lDNwi{;<o23FA^N+5(ple8lTn659DaCf=ZJeCuUfkSq0Ks<;0
ztdSeJG6*J$1P@d;ol&K2s0fObJjwaIzR#s}I}vIQAH{<xB6o(`W8_amiQuEO=xe2g
zfvdxpLt*U`#Ly)SKwO7+uj|wkro+|TMl12rBrOSjnXck_au%si&+QWgG}=Bh5LhFo
z@=!(2ol?l!o44J^3lq0J&FG+?3?SqQK3QCBt|`jM)HH>Ca;DFD>u98ZRwjK?32$M^
zm6+1P50WCSasqKj!L@l$1^r)$nqxa{grUHHova(jtY(D(eOi8j<z@8bbG8eSr4LXq
zJmkqb9^z&>uR!Vdyd5Cf<D`NZsSN|5+d<!T{JEQ$A2&CjENE{oV%7JlARL^(Bw;(9
z>)mJ_r_ut+MS*KnMGzIxs~I=t)ymb86c~Uhf5=O^5OT7If<DfdiPh8|zWVc~Q1NZ&
z{CzrXU7!2YK%bKg5*&_F;4?wc`A}-|PG9NGr2_Wme6BxD=t13m#rwgUh+20tt`*e9
zJBZ?i#$Zpb=)I`w5JQ*kzp83Th5j8yC<=sI*dg<SzjSQP?|!WMrZiw)4OG%U(!aE1
zm{V??VRLNKL^y-y&U-Ehf!S!iG|o-QkQ~*-5*gH1e@XVx4m-&hR1l$ph>1}X`0J$;
z6;^t`BhJl#y9@KZB&reJJm@GqfXG*N;HC<+3OdkHY8t)v9k5+<T1;yqhN~G~+%(wp
z7?OSgT%#?xf~nB<KSi7Bf|#>wnog#XFX*sr?#g7N4zwNpTuNEs6-Fn7F*QSza8>}w
zb>>Y-_i?MKw3%jXcsokA84Gz6hDbu^KNaESvds)U_a<`(u1A<SI)?vupt|Txh5!!;
zyBmMktM|DCR~V|};G87v{Fs=H7upK|5pom>;(W_#bl$BmNAKYDyJM4Ik?o7^rCWB7
zrG2?b-)V&@(Lx;?_hr{Gy|Ewfr5T!~U}AG!8*)PO8U;b7Ky-gGBKW9S-#|wdHY8*&
zI{HRC(T9AyU!r32Ra9~g*S1DMNWk~+yLby+CMcmE?K|lK<P!m=Ur5HHr+*slw)g#k
zLqR0qMKWcvQw%ldhM9WIam+ks4+L#KSt!(-&Vp-@zS(IajKM4=2zY6kaV_Y>iCqeo
znX2tE{Y*n)jadeOQMAPsXipkAg>JHl;JT;m`*m;AVxjb{mgdh1H&7U=FP8tTiAK+@
z3xyRyZ%ug5ys|1A2bk|nmhhT-G&0p|11H^m1w2FF-ze2>t@Mm4zq&MXCRRB>K_n(d
zZsvz-snG%|0jinPgj$417eJ`6<m6{yhs}!Hxew*;l!tLwj?bB&j(TmOLOdYR9stSG
z5?M%WglWKsF7O!s_dLiJ0g=zr$06ZC0j*q0kB0~zp4|&v!k6Y5cjIZwCGq(2k)+UG
zE0Inv*yOz<C*Vf74^sPlI-&8Id8$(_Rbkt6SR>Yn>+L1;jolQ&^{lHS?4;1blyT+o
z2S1F1h|W^`9!xNVB+!Uq749|+QY<u2<C~6``IgGRVruB+14*Y<Cx^C$l{74)vPL50
zawY+|Pmttz>+Zb8ocCE9uZ;wcjYn9?RINj`I<#jAKv?=3bEQQ_`T&z6?QDub_3rzr
z=cQ5n%~;MN6oC*q7DvJ)fuAM<H$zogTzp2l<PCBhV*mc$c6^WR9#`?GYkIy`HNQ!K
zu)!tGXf$$|zqH5g*JW;gY^TZ?cMSHaHMlmcPmjfk2SR+Fh(66&d9)uUj?^;U*m=YA
z_h&aLBu|4gM3RW$J#F~9PszBikk{o0`(cTDx;_Px#KDTocQIH|(keiHd;sIf*5;e%
zvyIY8l@xF}CF*x~I364;FU|>xw8KIRq<6qekT&16owed?c{)VDsvYnX88M2-$ktkH
z@jvpjXWxXvguHod@!PXDNTe{>TdhV7hr-`q5<&>NI!>L>*Ta4n6g-%2B(iQwHv4>b
zpUPTWK83LA%#*f5s_f7p5>WLZqwPh-%>d|X%x#Ric=^`aenv(dl4L&g(6Hv8F;sBI
z*b9(Bb-7(*<w`s*v`BKfb3aY1bA=weRAjX9IX=|kCa|gPO$XP;=MoP}i@VMP;Twi|
z^Zob;8&&Y@-qVXZuzU96wU|h@o)E@Cta*~pc5rHy)yiR_yKfXPA#yT{v}#TVKgb?f
zwm}QW2s4yt?uPUW?x%)wJhKZZt)AGe!|M>W1#WLQF?Cs~Ti9o|7W<8XuEr&i#~g<3
z)P^9vpTWB%o{u^k^15_N|BP?Xrs;UJsRUesvhhJ)>E4aaDPh@?H!dnVzLA(BKlvgb
zbOo_b^9i2t;I(=1AOIUxG6EFPvT9fJB8JF{f5)p`!57`ouvN&2A%XP5fl=*N`pKr}
zv$Rzd?8q3j19T6DH1{&m@eLp|FIX6#DOeY#q+LaBRnYH9KK6PH*!n0Z9<*Rwz8xB5
z%Y#Js7k*7LK5&ZIFwgELyT;n4<He&?fOh$lMmmzPsJ@;_(edbgM^Lq{bkSkjufD{f
znZey4iOUIv)K>qUvC0W_s{+L62q1`s*~+j;ch|nU%J~7q;Pc-FCCOci$1HR2lXKL2
z-_t8Svu6+Gw5GWC92xSabAo*I@=vW;=*CvIr;q0qNS+)}`?qS%r}O0(U1yq#E%fAA
z{>1EtkNmvn@u=S+K2NwE5(Wbkp|&v{KwQ|Ub|JEajBW1dR`=-gEzjNAN=!NSx%Kl*
zs6*@)_`0tzCy%Ba1x>E3k~^lyR=*UKkpI%12<1bFFLtdRA2vn?PzTiGF)>Iv24*2Z
zG=gww&JsH~P4by1c2OT7C|#(MC$4<k!YoA}JK}5Kk9l0>!=ofZ+CfLk=mOkR|DAT6
zJilf1@9maJ44ld%#N#}tT;d#O4kD1R<;AeGv1tKJb>~l7=<~HYRmTdF7TNSxoM}7a
zpU266Lfl!nJ8Tg!436Go2#FnagJJO&K8!%no;IMDO9XAp&w{z1qLcFb<2ZCd*~VxK
zFt1!2|Hoa@DlJ-w(cn|YWuV?tc*eY*;0d|m*tV2ZOjeo$F&3}msSR*Qr^CycTlHII
z8d(h=#X7~e50v6wIbHA5;3@W54spbX^1Ax|gBLRDggl;ntNB!s=jml+pNV=ne#ae9
zDlHT@+BXZ@6y7zvNFp+OupCP!dCgaB5gX)ad7Zd54N?QVZ^;j`P6E8|cCFP`*gM{n
z-8>fuc;4A-6qC*6`Jh+rKSOZi43QkLUnyc<JoqP}xXJHM4}(6r3wpvrcRzk<w7<kb
zW0k<WjZ4&2J2FjzY{f0oWqWqn{_+C5|DXmJtB-K8I%*R3DfpobYVBHV>DWiM1otm#
z3=#)Z(jX6XB+1HQZw03jTHj_A-Fm#ajEyZ^d^Iqq{TRJcn=tol>(4(9n1^F6sB%z>
z7eD#pf2-#@cSZn;l<pTi^P?s0M^tZelGU@{c&fcOk7M&Pyc(Z#)=fJWNHz*xhTtqp
z`VrV9bb}r%g0<e>)4MuU>>@SmCy~Bt&w_qUH?D<00Qlbm#u>yb3pJzqC$Y&<l&a80
z0!jI7Y5V@_#Q2Uo{DdbFtT2~18F&vTlftp@8$aB~wb!%*3{Sj8u1i1rG<&Jnukr2k
z4N-SMOUBQpDLVfOq3TkeZ}(lOEY(QeI3$I5BSE;MR@y4`biF2d?M+LbT%frXXZr5Z
zHDjfPs1l(SZAk7e9XlY?#998rN^&B94BwxYGakL_zL>DB3(^{`ym<r&xo96quR*q9
zs?qfZQyHk(Xun^xJhM+|^s&FFG@S5H?Zg0+t<cbE`ldrQ>n~D%O|Fhg{AAmU?vezN
z2m=d3=fZ$RDV+TBO^#SRfc-kpa17uM)OqCosZzy>(1DlKdb|1)_ZglhWc?8A>E;oz
zpBDJ-JxXUbHFJNQ7t<^B_L2ZWrw$&Jm<GS|@@J>{_1cddCf*a7kvlAsA1j09uqJ19
zkHS_ONhvaY4%(Z~!nH#V><3l9Hb@%{KO4jE=*<Hw676mwTnGvqJ7v=cwCw^lQ-(XF
ziP&F(;~w}g#gJSG4b4V+DnNT8@+~f$u1{C?emA_1P1I@_?ZbFYtfF>Z&in(wn$U|%
z-RKB8SlLW&EW1O46jq<=vc^?x@trm+yr$?!{G(8~o{aU#*IA3~kP%bu+G$zmvE$K7
zsW<U-Ai)FRc&>q|5pf(m4jR0tz($MCH&3Oq%iKaWAzlYNsPgHNd^py{@95(~uuXqY
zB!G@Ieh*@rd8ZE-N=;}yP1PEVN}i(LJOaS%V&g^F5f~77FS@$s`c|fSO@dB?TiMA9
zlaV{4G>-EWLcb5@&uR(IyPHIG#Jc#lo7_r!jy@JWk*vsS?Mee|HU^N6AfqfhY`P>f
zUHgC41+I%u$R~rob|Tjz*1m8leE?cZF3?<vHKC7eWvP(pm|610y!z;aOK)&5?w}&_
zv`5jsT^0}e90?*OaCuv+ZgYY+X|lFaBz=m=#JSz+gYS+aF>*;0@{hl={PO97pZ|2%
z_*r_!*(VY+gQ_udy57#kRN2Z0PzQf5Sfs4b{~m0MmR=G)ds;_(#9-evG7u{;^O-TI
zb?3>AOZW#uYE5XNmK(`n`isoee`E0DmKA>~^6c+KyX7uw8nR}2YQ%-`S`r@ZD*hAu
zm2p<MPkiO^U>{xP)MfXGbULB5EEQsrP5P;Z=XJr`r-d)ZeYGU1YWjw>MBaDfA;N$>
zxZq)4O@iI*E)*QRj7>XA<Flar4Qe;4?}aFPz`<T?BI53njsX2BlYaAfUga}Q)x`aa
zRG-m4bKmWXp-{Jp6c-3mQUvAsUVs$6-@}|o`o4}~L)zp!DGyKWil*MvL*NsB+?&0W
z@`CAG?3CWxA8Stc0t>2y#r;T<O5vb2aa8SKp6Kkc?LL-wN+r8H2??ht56mE~azSz_
z2`4}ucU&2;#oE{Z^ys&)R?JL2xj4QQLzkwec(MMA*dg4y_M|3f%k8;-3M%$)r?;0#
zyc+|5^U{(>CUnb&9^3I{v#pR!3K<{0b1h^L>GjtT2~<r)8^H6A->nR*_op>P3U9$H
z9xp38RtxI5l+179za0dj?ye9(2W@^jtfPAXT6FS>uY0izlxgDyd(~;>+Pd4Gp|)va
zSiFz(;0@M;w(B-Ex#d1+C9b}Rv{!iP{c{DJr1*vfd_eS<p)~AG<dZ-bBNy}0m&l2%
zsoZ%t0tlGk;rT-e?J=_xI%S*U$NPdivUI-WKd^Uv`gm)TH4*loG6?yCH6dQ`=Wzl1
zR$oTKwpr?bpJsTPeo@E7^;Y@Ld(OGylu-zfgz37WwMqjjNvguzFV)EFi;7~R7uh)9
zazWk~19<}(J8jpI6X|KYGpU{+7vF}IK>2PxaCUIqXP6RdwYYy4b7Z8`^k>gFQ6JCd
z$8nRHi4-YyAD5Cj)njE^C`d6u_hjBq(7F4?+ykCPk;26P;`)LeDskT-uL6iipi@0v
zY=CaIxu}c!@BCSn<~<t}n_Xw0-uL|H_FQ-fR99bWtl80m+@q(0FaHKR1PAM9RC=!}
zg55Hp5M(^e3B5CFm^n<=PBV~_5R>Cy{8y$+@#lR&x$4X=NYskCy9PNmA!xV6;)1u+
zzVOm;(JH#r@TyURCANGX?PZp8T7u(!1TTSHQuy3NInGZ-EwkP__WIWIXVU3k!MkiY
z(|%;3o;=H@hxRJUwEI33bB}&XL+ad~_0Tq6qO)3=RD>ACxgf+He<P7`N2v@ptrr!q
z{$QTJ8(NDr%IsrXDoG_Q(u@HGyczhQz~576Uf9v(wNGD{3grf2?bEV!bMk?^@qckj
z!om#DAb-9S5i~FHaE#otrAgF^KFc2{Js7gQ>VNeoGl+}cqn%4Bky-ce;J$<!A-Jcb
zkyKYJ77|4Ocd{$AxbPYe3*w2(NEOh$&`it@M5O^yq)TycTNAO4<m#w+PY69|y^(g4
zOKL`+$?NCG<kf)C?F;PQap+PqK12`=?BLiY5NSFmpZL>nXmGf<7FVA^Z?CLyCO(ll
zxCdYk+>O}WBgHCk8urB4fOh<<6UrAbK1Oq#4Gt43bjCf_^gHXGPzDS-9G1%$Zea-G
z_wO#s|K~uf<fVrXfsv<+&twVDYVKb!KWfS<jGHf0U^D!T-O2in)BE;za38W9sQB4k
z&oU9M)+>@;Hr@6X6!&ceASxQf8ei1SUbgk`)|J>8!PhcK!1Ft-0Rw+SYGoK~d>Ov>
zq_(0bhD~D1mogrwp@{AQ5k_-&>!MwVRH-=P4qa202#T8dt`%xyIVYrWMhqntIKX&8
z0!6$9AJ5}iZly)bI^guFj(w`7cc=#mkS$0>Lyx#eniX2=m36{2Ym8co&!ntTC7m}3
zI5plOhF(D+C@8+#H;-=kaW?4jf-F&@*8AD4k%$IMlC3R5DvH#>_j^0&tU0HJKXRob
z%8dbQf@V`bRxh!NuTEZGSZE(=xi-GNT3Y_k1mLOyh_k}t!tE^5wa{K59Y_Z+k^}EH
zXD+e@wFgf%{!dbB`5=0=Y!u_#7h{lSm_afYQJgXFd=g>;A$S4FWAwLbF_f81Lwn~g
zo>5<jWNg}s{Vb`mAeGPZX;4hkL=5Q+3-zMP(3B!VZ$8#0UZN%`+W1G!Di)38$-M@y
z_5R~|K|TWzq;Bkl!k*awP01NviH&xj)~4IJKHc8?ihGaZ?GWMp_yIyl{mnghR}-7n
znMY4+(#OV!wZYWn?DNP@I3x-K>zUVoRH<kna~eTHZs`>&dB?(kv?YIl4->vb^Og%Q
zSPbtk7oKRaO4W&P@VwwY_Q^<}aws;={W!2*F+`sNOMtiq3RK2NZMSF6zLyt|xMph#
zWlBxS@be(QXMkkV&BGrX>WFVm2>6FwB6jTPV?<GvfJ@yYgHb*Vp7lB?1JuXnUi02A
z$6iYmaVVtfzc3d>J!nrQdXvu{DHcCSD9uia_|Gvb%y5l#Hs)4X|KR+66^xglSUEUe
z7H+(YItLiSMhRIHo>6i?Xb^}V5+-(ew3;Yf%G8YQ=-t@9a9WvAKTBp{c{P@|YCtnM
zk$0q||J00a7<H5<UxR1O2-HgTHzI;ty6xgtgMlKE@|c&J!_96bMyI}A#F_7Q0ygrv
zly32-wgA-p{u$**8Lg2TP{!28LTfg4mLlnj?JqCfe~J&OMnCK7=y}Hf<Ez}vo2R!v
zTpti;a3D2u?clFENUXaoN^(JTd=`48xAsS|*Fx5NH2aw`xu%a7+!d$HBmPqZm@82?
zqo4eJs{Lku!2>lm?}kRln{)x#aJuo3@JLTi_JLqtyb&2z_SB22+Zp%qtvf&yX+Q<t
z82o`3lauF%uBu1PgbZ)bh5W~cbiw6P#OLm8LQxe<i#E$=Rr*=A3$fd;HO9CKKnmsG
z<i<<53pQG~Qb6B3Ee^~($CD;qtIf8o&c0=-0<viR6#$<4OZZM#*?W2|%VWX9J$|Y7
z**6NEbxhuU!6J?M@~qZ7fM-Q;LBvMunP}el=-vKWo<k8cwFW2oo%H>1eCRtaa0S}n
zaxXbDDJu>gW$Elkg{jQT@k0N9OU;hme;1vamfIhItaC`a`SL;2r<w-oLpDeq7rKO}
z)h|x`R!1(xq9Y4TqZrI3Z{W%^rJNQsTI)P*{90g!s@j|wlXXA5zvcO-fsrm<S52{C
zD;V<$)igM{w4(|D5QU7FRf$EDx!mo94e@mq(X2qKG}t~B1%+G!K5#EQ`_|8S{Hf1W
zJ9h*~12aB_IV++blmhhyVxa=Ltja9xQ&V6dhO;opKevP}$^DB7y@3F^wGwDA7_al-
z#oQ%jPk<O9P1J0Au1%QLfs`r}#=*3FHZ5$$41H<I3@w}jYVZogs+E566Z0#DYN>^J
z=$FNri+^^B@Pn53pFtqV*vp<{8tJb+AB`BNnyqItnf#>{^Dp!K`|*?JQ!DftmEQRH
zrHX^d*&9uxJhuwptsMOe0)jOQCwyZm(uYx85a{8avo(1vwQ|*2z3DVOxI}vmWy3?e
zam22J59kFHrOagYG@ma;2hwE|vBN0^L<r^a(yza}Z>sOdk50^78tuKJof*y>x8192
z?3?20QiR^z#2KL}EY#Lf4qfVKT4H~$kUCWFGYmUoV{~63|I=p%C7hksgEGVsf58t_
z%K0HDR-^jZ@6H(Y_fwT?iA{3PPLluS5bq0sIjTK?q?z%TbUwfHUZlzWadiy9oBu#~
zMSMg*7c_6$t*#UA4_s3$!l~Ax>9}9~1RXf|Wx=6@VoRpkCGYIFYic?9dnB*4chxfd
z72`bG<mfs=J`+f5LYbL!qkY;!X<qcoA|WGv`QuVsUdaD&RNxUvgEnGV+nxhtW6}4T
zXzu^V-dBD__5E!h8YHC=1r!7YDJfB5Ktw`9M7qC}baxDhf{I9klqgD<bTc5`DqTZ|
zbPh4h%(LhF``!P*^Xgg8x_QAG*5d3rXYWs5*LC*xcsH4HOA|zNh4(zrd5hYmRRF&K
zb`%yht7zYG@UC75RXM~L0ZiCYh(%lQZ&z653rc_FfQ{u&>q<K=)M6x!;@RI|em=^T
zztHBGG+Rr?FoA0$Ks9W>V$$zB>Rd>Dv%6`>WR|JsvpaoIY=aml1IRSEjq3+pnFw7I
zm(koul^yfdx3ovUx7VF;vIgsd(N?&*DMA>mIINLzX9a47g2Ef9Y@?`PVM@rg96uL7
zlS}ndtBz6|U@mWh{(OHLrLXpk4dTuk?<n++gnJ|##<>7i(euppD*dJ!Ci;zCsmZAT
zH6kw+dGAmz;9q-O2EHBMp0T~n)9xyCyd3D68FgS6Z_se-ixBjr`!|oA-wX4#0RJFg
zU0qUDV^PxScRA`6jxzb5ClgFpkf5X>!au}(pK$i^>Xfm-hM2rzZ(J=`h3aQ*dWbt0
zaArTVZ@obkHr`Z>gM6Q$ZV^1wGrTZ+bEZ0ifn^LjJ58yBup1%@kX}|-Wb=!(m+Cw!
zUQ;u|pC<iMvg6poa3Pny#VO{MnxCXXzPO_Fn-+LzkA}Xu!`#6G-Sagl-(!ylWOk50
zNM~X7&mFd;U{_w5BpzwSn{-F&yIq3JE05!#s=E|)eLO81DZ~&m;=2i^;XwDwT-;g4
z$Z+Y)tb-g~cqtM9n~(;r7!*RV3c$sDYv+!v1{10rl@z^|jHauS1fgzp|HYD=p`Q%p
zNRN)jXFsU*d}F>B7xz?5jSgt!;ENMrMMOYn^EFyy*M1{QAb4sP-n(KuRcZtPfX=tc
zzqcup)$4v13H0B~ocF!aq|GC!e0}2c&HBGOO^v$&4ls{BBQzeu{=g)}86tmdK%z-&
z`*1Y9E;Ih@RUduHNQkH+J*4^d!J+2PYSc^9<evqP^o^8hjr#iVRaPwk!bI}$&6oDT
zay$SDv~e8Cg3EqtlNhqj7of^n$zX$MZ3(xg+UAHp;`^^xR>(W_nC7Q7@r&~?4fQuV
zn6L*C|Aw0*U>l^M(4C#;x4*uxNZEX=h63MzLA08r%6;N;kLaPf&>righ6_`1v%YUA
zam)Zw7Vy*0z&43iVRr;Z+n=%&Cbq2|Ebh4wPkM;Hi#IMHSYN+MkkiK#0vd7|U=rUO
zPv&IWbJRA!76^B>yJ$M?I<fx-c4Y+YiU5?V5jneqO4mNCKl()3I#?Sp5B%4~1E?@K
z0LVc*gz@p2{M=tn$#jyq5z22X{g@u=WChuxWlMS3P7G@mBWRrh<Fn&k?OcXKb3)3J
z;H`83Go#cqFeY)3WueK1UJ+*bmwX{T!thhEzRX2(e$^^b!<qfRLH~$0fTU$!1h-fP
zO1!)Lrg3MA9(`(zI0#?n`jR;V$Mm!lOf6M^Qab&wUV{btg1|rgVl?2^{!C?}pJhLP
zn5opn_&rix*nY=xiNKc@G#ME_ACi{6;-IBlf78)xqEb$VzrX=C!uhF9UmGXz2mplX
z;sALdXK*b36Z%ZoB9b>VR{XEC{NN5OgwIu+M2_D4p@H<pkYN3p_X5ycIJFJ-I|01~
z0PZ00{b4O;&8E_)!&YBMZ#jDoVa8uAGxgoZ5<I-V$&6W01Kpox3h~PrVpf)IPPcU)
zsB)JHm&^gQ7RW}Kit{SLhTGv_pb2*9d?1;r8rjbqX_KzfFT}$<*fX8H&kIx?d(Agj
zxCJ;vHPL{Jse{|thkx-;D6apx(eL@^%PARj1k&93PKRN3N%YNkChFf|!e?hU{5#9w
z5HcAV@C4YQ5ih|M;&VJPtMx3WpU=6%<@bp<POoL73RB07q+FW(f9)O<K%`^=gmRpq
zVyrTyC|8VJ$XbrStFsKe5tJnluRSO~G`mhAa=;<sb&1w6*%KkLGHnDesrFgQ0bL=q
zM@IpD(VXhQeGGOLqCS55z9ZKJ)%bMSoekKRX7S0Y77f7`55d8|2sdEop1e5@1`x%h
zw!PWMR^3(X_kHu7-Jqpk08xOh$`e8Bna^S~RT2kQuEPZEOz|C;>mAUxAk`o*GNN+6
zhxhCK$~0o<Vgg~EKXM+Qh*#lLGQ^<-u1s@?7qts4h)F7Fm0d4C)8)_x4{$XSpz|I;
zW+lb&MTOpc0xtx@v`I)Ds9t2;n$_S%HA{MVxv1loGM?bm1?$5ZYVxB{P=+}o4APWW
zB3lEs%2QQ<HEMK%IDMXXTW%jPZfb%)4J_6URXjU?DSh5zi6G=<z=<TBmH*kc_m#a}
zF7W$8NgZW8ykvzKCoz9~+}l#VM|)^ZZ{DOvxXeQku64_{qf?xt+Y_cLCG*=!VyT1;
zWd8XK5DPS>&#NAHw7zQe8np7TkzCpd1^ifg?ZMlY2r+^`-?W!S#EUM<QvMO&W-8C9
zyt1p~;J>G8nM6SgKs8X*-c$UKDoRHu`0l5qyN8M?ni7<j2e6R%;|VoLz?Sf38(`5N
zfqQt2R!T_eQ9HI-L@*EN@zNf`o>kQE$7Tj(kN#^F0N<ETsI~IJ?k5_?@@mJKd7fpZ
zS(|ELLH+E?@BaV`Xt_A3t>Z<lpBVA1`l}u1@bj+#n}U!;;L6IteM4)vwXMwkiF$jx
zi>IsJWo(gG^kyIpok^!kq)5vdppG8_Cs84!Dj&IjhRga|D>R(Oabd;;B-IyhT(<Fa
zZAhyUcq9^`NeryWM!xuv*|T-V#wvBa-`N|i?GXXkrpPinSV&7g&AHi`SyEx3`T>Fz
zY6$?~T>201ecU-LDF6P+DrzzZO&wp7BY$`oh)kgKoMhs4Y9gTUFy$ox%R#C|9!D~F
z*dJUcVw9pfKKJbSKhg@w*9FAK`06`_C0iP{qUoZ48&%f&eYXi%>A?KGN`%phxzrYx
zJoZtr@fjZ*sst?-r1_p0a{U98P@;O#aK-me4d`X>jMwRM2pAg>v62I*H9J6ujyY=t
zFkmt7xm(?l<>vsa$erbst4M4&a`xx$J90>@TijXxDMgECI$HJsMUc*g_-eIQ9A$sJ
zwV2hzJiGM0pP!cj!2VQ>0v@3%XRDq^mqMiqu@wN)KH{q1VM+|t<K*8!8GuQGG(VC;
zu8&Nczgq1sahfS_1SB8o?#I8IWKz*?LSySblZre84rb^x4yy$;n9-Oz;a<)t3u@i$
zl9W^KJB$ZOv7@6kdweFwrUFq&1W~bH0Zi@L{6*yTKD;UlIl!!z>H)}nB38#}a5SzN
zw|YqMEk0aB+Q!|vDAip*`xD`toBuMktg_;OsXZ`B9?xAw&P0;{o!B{LxyW>{<xdcD
zLv=}eoqjf`grKAZZ#%~m-*duKwWugsBb5t7Peev1Mvs>n^<Qiq+GTHuZK2o$*t)96
zKaW;fW-qdO_<4c(v2y%}K^LLg8%a?jaY+qS&l%O#-P+7Gb72MYijZ76U{W@C5#%fd
zT24~SxGV{q`n^x^gd*Cwkbw0DprODr;pIQp^bjBaUmIK#`Bbu<px!~GqD{@(&dmlJ
zU_&9f3ix44%}h1_BxM|j5B7<(_vd^In75~Hd3Nc4Frtun%avbn?GJyPKQtHjbNK4c
z{=(>`oYO+S_Q0|%m-{XSs16cG!>pN;=mo$Km+{>e6dspM^7lIs-pnNt&#P}g))yu)
zpVHI4*nDYNW_1|7w&vnArI&bu?>O;&>^)wg$*GaW$6u|cmLqL~<uB!fX3L!TY6e-1
zD8u~sPl?nl+RmVgvCz3*B$*v9h!2>bsezBy-a$OekhzDuY!EyecdEc^<k+FVvccM-
z{NLgM2EM*{N1tcoB4~A>UC#t-Lylrn&vpqu^l=_VH%S8H1l`_MqU0_4rc@Fa6XgMx
zn^nTG4!WP``@w?7x`|V`9(e-7GGOHKJLhICVj1$^)x5k_hwQ@d0)S->0TI^Thp7%k
zFg8A3tZ<XXFrvfu)#Rv}>~!-TZ@hr+A0S)wv>!`a4j7Xb4B=@RE<<uFJ5TjJ$93?$
z%>L|Bq<dW4v|<fp2qCs01^DVpF;<qzT)XrjUU^OZ{$|G0dl0Kdlh1!~B2Sr2RiD+&
z8L;7-sT8G;;O`BK;0b)G)gt<p0D4#m_z2XAA<Xg5bHR#TkH3xrCu+uIM66!&mq7l|
z{#wm5$49Xj3^GV1L*brH>{OvpLlE62;&=Mn!sO<oG5LQJ$hEEKghTV7E^8{(73^kV
zILqqe<-uz=Wj_uQne(;`Z-N;2_z?Z(tci!BVNLcx$&1E_7`n;_x<2g#pnjU{8tP*o
zB5}dirkLE$(mW0@fm}CUG1`Es7y<hMzWdd12FqLc;~%%q5;vmDF*A$&jCDl2FhU_q
z3eg<ChKIu86H{p?S#D#GK1o#=B$HL!LmzI&LA#m9;W$4}?SJ(XrOHS1?`=S}0(Ak*
zU@xJXC3V>D=7sN~p(=Q%b28<VKy7*>Z^*u-HT}F=3h~=G_Z~oaHKw7=R6w&OOs2Sj
z6HV2nxrD<E1fpAg<{C%0@X*k=2;{>(M(pX~c!A%aPioeY^3^YM-mARx*oB3-=}HpZ
zk5+A{mpPC@ruZfJJ^f=6zmvnfIfwagzx8kLxf_pHK8@SYS(f=CJ<#9PlCQjHaC9MH
zb!ghLU6&-h|37l)brm3f@^eh79@r|rVTUQ#i<7e1Ol-odX+`SSdx&<2@eS8)Pa)r0
zuK&uPD2+fsoL2@yXKkpT*tY@Mgmczfoi3@hvvZnV9dxumWEuqcXF4lb3-n$?W`Jm+
zwVSN}ehQbM&U3-;7j{)3#DDpAVx!M|VNvq0Oc4}#KO!ig?XGqN{ebTK;_Y$U9V{wo
z*6IM{^W|TWWS@VPGs?P3XXI&g+C^pr;D#C!>eJkIVNhe3k1FA7QDGpo1e>(q9sVjX
zBSGoIo-c)86}~92DzAgjIZg5<QHPx5ttG1GZ+nE66^rgA!l1wgaB#VJmoUYz$uqsR
zp^P=V#_d&~KRt_j6^Hu+Q&QMGBtC^d;RH@jaa#U!)iC>?R^d-SvsAS2mi9gfkj6JL
zKJLIhJvmxfnQ+&d0&oM7FQ;x<(f-3+a~wD^td76K`F7AXBEtgE{@dS%4;jQF>$-+2
z|GB8_w>7?mR~5({A#V-u{0^}|GBF$LCf<2)kjds|ePHJNTztBa2eqQg9Bkp!<fVzj
zNNq|o!zqE{ZHXD0Z<=}W%>UkS+$#NHg^eVqwF-bAA%(8qS$Luz*LGY@OsB<eLmJEG
z#XEN1xjsPy?VNzMjVNY(fm8_^P-I)D!+6eJN?4ro)6w_MO66w{qk-@V+LL`K%U~|+
zZ9~Aw4mhVn*54@*$RJL*uj)~sI!YTn8&brB3uQBlP0smBrT)#Wr}N-;9_(3XCx#a=
zUu3;96R$~C!B=7rvrU<00r~aK;DU4E?uu5up0dNcn*qte=ZQr4oSF;hfjuEm_2yvz
ztaxUf8S4xngeE-%J5+>5p?Nl-I#TA)BxL-SNK9^hG#5YNdUz~8A^dv8Wo~kICPP$K
z3xaYZ!4M@SWW&f;7klY<`co#^d}yzt$)GNCKzc>zU>nlB)vK9?FXXkNHicgdx&y9f
zegqVV$c~TVCQpx~!hSwaJ+)R56P4n{5w*CjH^nA(5u)OtGGLciu{?4Ce^W?$8j-3O
zb1XIjWYfjtI}$(7kJAuy8+cD$0yxXwc0a<mI8~h|UiAE?kBPW}O%{MgEu}V8AnofF
zId@9<84K+UWom;DM{V$H#HtCBR@W(D$qXYZ#sy3tX7c&>^b1K^Y8}Sb(vyS`3~v_L
z0D63&VI(fF4H^7+KBkEz*T(&DBEhA5YvAR1;vIG5Cw~i@e`&7|!obTccRm;MjU618
zkw@C3O4|LLeT2S|I17jFUDq{D<WYJKt$b;*5Wx0{;jGJVq`I(hNDUOQ5A^m|AB|4n
zO&l+xohQd#RBgx?dRM2MMsW#d=QHz^>T3YqAYVaXd{u$ZA0YWoBYvA^0bc59Rl7Sk
z#DAWBV?q__dpMXv=2N|$1Hc66Je(MMc3}NxJO5qJjdQhsyszuu<J%>Ej;EAdRl#CX
z8C;rQ*g^P-ecGr)8&bJ#t9g92km>*(ubdfJ6%PM0-3LpY@m)a7JXCiPXzHs7ssva6
z|CCk;51h`^_eMZ~PY|q7t%1n$K$#Vi2Mdrk{XW`r@X|!4VoT;8tm793lzRycI3vSS
zwZAi<)-&lyuo^`Ib?kh?HFd(%*iyHUG${J{r8j9Dj3sD>_^Hphl8OLS4Vm{S0C)g7
zU<uTIg$FEae3-rGu`HRA6>ADv`N5@>Q0G(|PY9^+K+Ws@Q;wIwzY0MTeRq0L!A*Nr
zpo+S9GxH*Cb-tJt68Q)w<oQeSps~a|ulxV!brlFw+QIFblu-d15TFSr_hZgJCzSXV
z1f)(6I(^Z-1hLwRLn0`^N#B!@W`Xn63TEf*#yOTGcD=@v9}t*`cc2Nx*H!pw_$7oD
z+w9kob+q1h5SrDXrG+<)%^-5&D1W>T5Bd^83U#J}HcU<Bo38L;HkZjIl{KgU2%R8O
zwcVMlt?obwcCh}yC&gXLDAJ~|Y_wn;d$vi9ch0ca;M%d>U=4$%)Dr*CCS^Zi);7uP
z9DL{|A*kiSp7VlBJaY1kRx3IV3c6FKAcfu){r#EDY=F_(FlSm|ZE=SUUlW9UB?u`y
zUOX|QeDL6Gaz3~@j@P!|seX?&eD#MN#Hs`&LLkCyXw$d!YEpp`uf*6$F^5by-_ba&
zPJ&D779i-!sX^v7)17E26dUb1%2jJl@Nc{|?0Ki3lvn){bc$CQjQ|m?Ou%VCZZ-y<
z_(p@}%V)kbMAV;Nqy<n-sLuh>#EW2m0iZSL`31F1><>yzuNWGt=NfPSoMX2BiZK*P
z2IX9f2+%9+b;UusJqc-N7HiG$ic!kZwy+Li%=p;tQbIt4;VonBc!i}Pvg#17s~9XH
z8gxfFazK9sbgwNj6mbKd@c=Q|OIk*c$=uj`J@-d@bL)ad@GSMaRHXfRVqliP5(0C4
z-h+h^L3>A!5G+tSZ?dDRc7E3wNe@eyI4Ga%4A4>l01LU!&^wE(4CLX1ds#-OQoc!%
zG--CeK3VzBQ%TrsiWVr&d4SH0eR~l%*ay>3!^VesTpzbp^VWH{%9y~9XJ@`LeFv{s
zWfi3n=WRX)_XUO632QD1Gvy?voHx~opA?(mmG6LQ1r{fpWbIKHF>E90kmJFdktoyX
zzzB)-$CXdO7C<3C3#UZJ7|7J?${g!-oZ)kb`LEw#B5O-G<A>Q%6b8ns{3wg~!Rmug
z_>A`f`WL$i44|K%KeZtQ*m@-zHge~A)9Q|kmCF9+=;3jLVY8Pn75ozD)EUJf5$22V
zxWnlJ##Z6pt*km;;{ts@Mdb@Xr#yZxTYhl)<C%Te{pg?BXweD7qc$0n`cVflAlLt;
z44E&3Lb3^Q-cwQC;8Qm>g>&mEVRY7R`U(eeLxj-ZW%Xa#Rmh`_em}d1M)dO*w5^Rd
z52GF}*d!FIX^sG#{T)CCAO)b*d@^?t*}7@u@$Q;XEgxmvKo8@s3j*`Uld&1N-hCc|
zdIj9W`WHSmCfUua4BlowHjzul_W{%nlGqdE*vdcl|G;o%T!J_4^y4NS1)?eNG{7r=
zm#weU<m7l=b^A+D|6U9=M)Sz6A>owUxIqhn!?_PRiItP*O(|Au&9jZ85A$JQO1ePV
z@+1`$aQ)WcI1%r%7y#|Q$D=1AG{FCnY9U8jmh%{#i=X&mPD5!&Ue&w)lkKN9SNML|
zgZZQac<dd#+`Oq_KXqmQOuS4}wSMNUTU<UEfYjdv`Q7L!qHY2xX8{eAstJ<p{YiMo
z&&tg|_J-<ag9WHghZ@=w&827psKxCDLC9|}ADMk~+nWz;b0*Ctw}m{a0SDT6Rh{sA
zbSmNQByF|(Izr${#WktvJ8_=enbH-<*PD7lybt*bdOPkOGw|{zZlAM1M=O&C^k<Q4
zRs|h1A5MXl#3I>)4NfD@fMoIv%+Dq`Kf1nrQ2>x(bM+_ZN4s-Vm8I`VA;^3^1_B#S
zqa>y=Xa+mo49OG4c(a%{m0}3+?ikdW4BjhiRHAPwQiDDjGJDd=6scMqyYfm`mh$g*
z9T0$ah6fUH-w6adr<t)Gvlte=_{W^oHY|pUTK}>Fmb;P+cvfy11hQG#&?>}`(O2K$
zf!$>lluPPxqSTO#Z#HrbMghda_;q>Tu+`g<FD?w;Ukeuflw(|A;3FIXaxJUR${@Cl
zQEt})pr-grkdn6gG84xwC#Szf-d@^eLvTW%-ZuQRO9FLu+zb#oEBo8{7l<u0r7Aed
zb8hyOv*IgOrK4~{U1MFZe7mMl_-yIBo-ik)4O|1?d2wfJ>uv@bji|8&Dq1L<wFWZx
zoO$*`_hEd_WctCFU(cZ7k9mz#fF*tc?=n`ao(1{ne`xR<&aRL6QK04!v55v!7RY=8
z_-*$@ZLpI)|5dDVOwyl%pv<0Cro<|^@b^lP!FRcoGc@0$x*iKndfyOkob1N1$2qUr
zElJU4(iZA9`vSH5Qxa(206&a=-oTW+X@9NV{qHK;2W{)#-Qm<g(|mm1wk>c&%7A{r
zn(Q;$Fkwvc6)G6J8+d4bwtHX!7~^0NaOf{0#|!K$3(DAD)Na@<;=snRjX~GOn{6zu
z7yyKK)OkHOjzn8_n@PAb`So7uohhPe<g}@ztRiTSLP?<~5!ap!k7$Uz`I)FhtMc}D
zojnoMScr^x{1X20G39l220KJzd)2(f;hWycNB&JipiG?ib+r_K65gN&JN(U-fBA)=
zTGY!27*j^@=3%-WBk$1SW?=)_F(%&^vsyS1Tng6v-=7dZ=JTfid~`j)*Erxug!KR6
z5A!(7E*fI|Z4#du(YjlJk1ZkiKSKyWv<HYkutPwW{QDnN<oM65bok#QT=?JSa`@l>
zd%^$C(*JL!@eJ5C4u=S(`t?Z$t%|pD6-AB5C6CNs*;$GLA-vVQch5AGs4ras85p8g
zQGWa!g7B_F2$6#%1ReQ~fWE>?8Gme|Z~E3OMS}6TALl8~$4uw=eWE`3d-2;Tl{~%W
z3<e)F+TVRo_f3yo`>@3GJWkpzz2E8~LuU6CzFrka=_me<#ajIekFt1_lhmhUWe5pM
zavncVAXiD~P@icbl@o{lu_Ri5Qd))ZLAYo%73i7F62C2OaPY%rQpXZ2AKh#~2H*nb
zFwL7_Q<BH|ZD22_#|e+9z(xy?Z@2&NAOAZC|Ce@<V0Qv`Kl{@TwFc0c)3u&bPrsTu
zx1YDlhz}Ot=3w`VVS_e9k5^g-4RlMT{eRqQm`^@@DgySj60Dd~2tFd}M*3rpTlGgW
zXUj#C^TVfVI_==1-9=zaC+W2@r(T<}{J;M4BIK-kR{1JYgo6a5RauzWCT~=d6pZky
zOhvj`7=B}N{s}U=`7!ni?e0}~*E)-r@XK}TQU*2-(lP3=MaTHJ#%Ti+)HV}~Tn;87
z7PM3=>C1#}Y;sroYYF8<3uV$x1fN`*7jeiji!YL`pD~NT4@uwAcf$FIhG=~Gpfx<0
zvv$E<q?UTnnUxX8`w1QUej+Ng*5UdDD|z^1V~vmxpN`n>Sd!|Y30f49=5%lM8*rm}
zVfq(aEad%9U$^a@uC}k2<*#7x;~kFWSKz!$V_oUn8T0FVX&JQ0t-C4gVlhT{!_x?w
z2BjVQYt;}1$80>da!*3Jp5I9sr8ML`Hf$Ik4-OxK8{UBW->E&Zr+vM$cjmM8$g2)P
zN(8nak90whrJP`o#+rZr`t^*J#^qhPzXx4y8i{WNS3o53L=v@?@&GB-`XRr8M6LbZ
zw633rGjU{r+6RTtaqxu#nBZI3?Vf{}FZB5`ET?;|*qPA3iKqVHb`$)C;ZWUXNrT%D
z_`M2J=k*-bG34hr7vJxnxy8<hb8)xPus&1BEU<3tY~xt-n;6HPM{(>0t`C#wV}_Tm
zGPba3&Bk}MfBMi4Z`xu78=5CNqKoS$RfEZcg4oYZc9`8-8;B2tBxd3UY6tAAJJXKR
zMmbOS4}vbp4D{=x-6S>jO82*v=FK&p9ho*8Q5+j#5U^OY{L&r}wel?x;af-HHB_pI
zxo4iO(`eE$%!hj?+H^DNm+PKbw23SiAPL1e_ls#S&J{k>1{gY%hDFAIFDQ7xySi)o
zz(~3-&MY3Rw!dLxtP8q2^tpIr>zX@ElBZRZZQ14L!q|uS0aK@m5J#PXj=u8&8NaBA
zW^&Hc%B=nk;e_-sYp#mevxqf;1?@DS4?4OBn|HyvL7D{vsI}_ZdK+HP@e{Ix5^(6=
zV+~}YmwRz^^2u+O^RbBFJ|Y<Q+Uc*{Q42RS?5WQ4<xtG(g-qJ#dm?3j%#!i<^WI4b
zE_xA5ofvxTvK!Voel=K#Ze}sP=){Id$EEd*^E_~Vc;l%JZn2-x{JG9<A>)BC?UrKY
zAG0)Yb-ih0KQ6X7EYZuT<^{=auhq&f(LqJ%1huJEv7S}amBsSFC56oU3g!Dl@3>rb
zQI|iz`?(=C7IbjhZyy*$3f<T+tiI-KZ@=Ukyp*$9E{_``IG_}{IBw}#?RLENf;c?s
z+Qm$Z(zWceffs6u`>82A9Q*@UV|DDQJHVQl*rL5_X_M#5bMlC!s2wS=C1PiOmoL2B
zYCGA_b<`^-4d<>T`Umc5ujxNW>Ah{-Q3RW41+J=DRCTuCFaL(Rm3jVaz~Sn-%ayC%
zyA0jvj-KeW$xi=x4&}|e@Sy4;GMLxrH{~#GiK}i%@3p&1U3wl=z*0w;9MRRSjhxMH
zw;r6H(9N@C#Ak|EINVSuX^vLCGJ9IvubJWGHkq0BG4SXaEA!`V^y$F~8qSTs^!Jv+
zdYS<m<q+B3oQu#5rl5f<gbu{=(qcPbXU?AHQC1#B7h%YorkV>Du`XBd->;jpv;Z5N
zePrb9J*<IWq;7;@`+rzrzse&mUpd*Ym&%+jt*%FL51-BFmc;gBNmk7nEWV$drPL8|
z&X6Fc6#l*Vc|eXPF1My=;E1-VX?c$}!wRl-)%obXh0fcQJC0jRVVU)BC310uYeic!
zpN~vAP2uRWN$(H%_;f!!XnnQ0_t{Q(YwH$_E&|R-j$~t#e9aM>TA84}->NyA=Qfr3
z>HWgvWv`RKy@N7|!WXC-Mi45hG6;kaLDQY8yeH23tC<fXPS}1(i1%zflHugM7^yPs
z!xFYO`Ue(XVL}AVc0F?({{*}?ulS=gq73o=Yt7NxUBt2uR)x1kF!mpP>hd4|^n&%M
zv6<xTFP!?6vNI{-cIx?{3tv+>S%mcC#=O|kGpU(xD6u3VCvVL?UXqV64=z~{ac+1=
z_F~i3-k5T3je89BXuRIO$^ve$xZXCHda}3L$fdu2K6zmV=0)Rj9Dcp@SPA=xfir7o
z%n-HKUhuVsMSV-&Jg{Iu!4fRPsMn4H`#6nr(6AXL6^=d>O;TDbSuk*3B|BOQJ2~6S
z<@oJ;#(D1+mF>6go&3crJyNAF+Z<Q$Uw4UUX4wVdwE0VJm6Lp?v}M5rY3YP9f!Sh4
z0t_|L9<Sp31O8#fUjCpqP!r&2j{h=qM7ZN|xKFcnaXg$i98S}!j^tSzI4#Na*L6U^
zwIA#>ZIfQ&)7z{>MB<m3$?KfkD596hXl`X5TNQ>Oa+xR~?OO87Pfn3Qq90U1ch}T8
z74y%7&W_658@iJ4-@zo-fH{vEEDkWE>&E>J$$ZDSsgG2$i|NNwuQGYJG$O_JmRl>f
zIrId8yBc~|^=R(b%y}1cq5I_Lu@c0)Z>ccN2FNZF_=d?qIZTxD@t|Tj+0Tumr$hml
zs{$MW(ERqL!K8Ps!HoN`oaBk{)jiO(r!mp<T*KVk%r#9aa;`fMg(Y@x(uV!QS;Kd#
z{z}qrd*QE|oba}K)VS>wHaUYMh=ngQjo+SEtLw{r{xj~7{|jBZ?x_rBZIC1B!L-?b
z>`jnz`lGSR+<v^g<moZAgE4i|Zk#OL-wZs}E_K*G*$v4m2;$2NkM7A}IP;F)4g_Da
zUXXD*ut|0>u{T^Nd$LJ$dPZIyx{JQ;WO$A#BrLs@HCty8R6M&>PY0g9p1(S1+PuT*
zeA*SouCeFSXi@CqeZ2H7^N)oV0^aSYbIk5%=4;>g(J~PX{|G<)`wYzSKpRud-(6*M
zPUh}8l#K$on=1yEOPnFyZBIzB$Yf5K<m8T9(`Eb@+(5+^D~w8{&2fjK)!$weT_FV)
zC9Z0Nqeq}?R7$<gvhTspn`s2lM(=@V3Qapqi|V_j1rL&>&_>SN23_pgrf_C!Iv{Xz
zMMcQZsFnZ3TD68QZ&46?JPo#_N;z*?NnQw&o#5WiyBsWN{!L22q}-o>v5wgZ^g3U6
zjX3%@PML5y-)_40N{ih2jrrAAcHR0M?uP>{g&r|!&h?i+9o}so>ytFrOZ&E<CZFbG
zsb_rZam_PQ_LEUWdek`9>gt|CsG>ICc23m~QAjE?+=7T|+MM;xf-WoAN8SAsNpZ<H
z#Cz<|b1zt$+fEzdUIr}N&|%W-Nz4h7!{?Sv@V4zB<CIMG(^dg*rU~zR4{0J!#?lm`
zEYqgLyVaA&i8XGlS^c88!S`pkSBsU(Mu#V!x}Z7LE3{AbQ{T$@O(WD8AGyaram5(w
z#XEa3R9q=k#@i=@#3E#&d3N(WbcvmI4mR>!8iAOhpqZ>I1m^aG`6v9O!k28D3pOff
zEWR%i>01e1S_r!(@?t<mQHOuy=X-x@^tnfDBER8}_cT^w$QUiN+i0&Ot)n5d7>TV>
z#JP;C+WtMpfCV;=`gqKh@)ai-b~w%rC+d1|(r7`=iA}JvKQ4z+^goDC?$?7iXex2W
zUw$!-f5t-8rAab-O-*9f#@`u}#x&J5#T3u-N&R}PjfGg08A&yGSX4y7YxK88(!HFy
zUQn&Lmzb%O4Om4Hg;P}#a}gn@WA3p*j?ajRR)6Qxuxa(Q7(8KQi_~-Cv80Cw+1i9c
zgLPBa^dGmkcjRimA6X0^88V1U`yqj4g$2b&{20XwhksX3Ea-$6-*7X1M)0uxMxi3H
zd|r$pD>)N0=?!bq1V&x@h(@+cAuEc;NVZGJz@EA<bm3a^I;$BThbe0JO6e0QE!NSO
zpKxGeg_DCuS+a@~#eP>Xt!p}kCC3hKrYGu}p`ll1jmKj?Hm_#jo}o>1>|^^2nszo(
zf8q1rCDEB58iQ{ioJ~h4ee@g&g}J=e+wmK*+4}aad&Yk=isqJ$jR4W)7nFIjTFyqX
zFnhNvoz>V2#j&;aF=DowCy&ScCP;k^$jZFvigdaSp|F3}!}MWX(xJzrIjb7&^4}#%
ze4e@Su9~~PKMfVKU!+>)@goU&6XDyq@WNj6Ac;nRva3M&BA}Zc9=62g`nj(5Cd>fG
zUW8&-3Cz>EAXzj^s9k!af1#u=cqfm+_tOa0De$7y9Bc;LJx_g$y@*he?Z(Z^X;R%q
zkQkv_%0xn*M!rYIs7U(2^-mOyna3C{H?E`W{95FKkIBhyq(A)YCUArF^{5uQaR8TG
zgVl$_=Um8_!!El<0e`%$n<+EugC(QU(Rz6K4a$g!%rx+ccWX^RU^0KAo=YPS?0x@f
zxKoPLbokxFQ8mf#x}r$qYOV!yN%Ar4kSL*;W5OD(bjQ2#>X0ObYZTeo`>8J!q#0je
z47DE^D5%K$9XdB?QF7NqQ|i7y`Yz3&i4{*t&)mHpxDSt1oNIm)QD^e|+}|Nk|LWB(
zY8dYtI&nG0ya#3oV|`%i7~>!E!(Tt-eylQa>^t8><~Ie`xfDei9~YUoh!flPAAMj*
zkD?l;|68Z*S~AopUD~`(Ju1TarbA7-vDx+RPmRZc13w<x&($5Ej9lngF8t|g;rZdk
z&A*Y!v~bnJH^W%-!3Bv!)Za%7?I!Fn37P4gGLw&=n_ey5Ja>qd9<GrXmKw<%cu_IQ
z#bR|WOMVnfom8eS)a}^ITJ76bb;&VbW=7pAgEgE>@=l8!udDQBD>cDya@EYIMczb3
zn3&TtX3c2fquR1@Orki)DT}{sk0J-o9f`>HBG)@mcfxG9CtaWhN`2l~IzRc`fonhO
zve>r|8<|tq=XwjhOOKq(SBy2xL#ooH5IJ_TX{603d}?A&O$*szdwHy;^DU)F)la|b
zy?xbt&d*fYZ4T}aw1Uw_)yg8L2-^%ag2_G1zVU7csyV^12h+eDB1WTlj5_{>o@3*f
z^!YK(%VA<hV!kU+y4xfwCYd-e+bEiRJA7)5%*t2xlBDf?O%ZK*8c&N&--M)GiNxmg
z2e~oniBvhO7U>>ouEOx5*1PuP8<bo0Lo?j!%?puh?Ue9;L}cbp8jrtz>Mz~YtUho5
z8|9pt?CKyhH0LfMWo2-{Qi^UWaqq7_g&782Uw$~Qdeutpd$WQlc5Ne5%jrybV=*I&
z-*w~aBeECjbdQP)LV;W(jpCQj7@LN!;>W@bl}4Z0{4+ChO+8A<%+W8#gBgYW8tSj5
zcIB$3g{DUTnRYQXq9R3d-aBJ@V{8T&Bx#f#yqv9q;dlLqKb(Q)_iUR-MOXd4>>r77
zw};;l$DMa#2388!DIcEq22FZNyBWPw`!Px~0nXeTStcbYVTg?)EOOgdXhwz96cHGR
z^{^Isb9?l-Uu2b5ESH)h9tuY$b<|y|zhI7dGfwtq^-qN$X4g#9N@M;S&nx})tNgJ_
ziUT$s%jrKmukG=hcQvl>+gtIWpJk+%*r-lUdL#}oFz9SOnuuaKbiaRID1~wf?3+3{
zmOjzCd{HU29LLo^^e|iJE}GW3@xC<6?Phzeg{3fVOFj_B1%A5;K+^;#W;k0bK5S?4
zWV7`0U81REwmh1(Zwtk2d@k;TB|}!rPehGjx5`JqY?A1+zui>WmXAJtqLVg2X76f<
z{^)1mi@1h!dCq40lm(Iea7Ng(V(FUeO~DJP<eTs!2Ws-CM5%9;jU&me`oEhoI$UYs
zt5M;SC3<)DS?HG=$Q2XPcsW%2Dr9-zb^G_?*Z?2@?hzkls2Yv#)9iSUW_Qd~e4@D1
zy^AR_y2igbUNt{^5SJq|k9ZA??k%O?sxs6-A0jQ)8h8G3ay}T|aWl!UHXW>@n3;%(
zF{*L%s7Cm!oAI(xvy#@lZA(j!-!w;YL(X?6(zx8C*v3w*jWbh@?VO&xs=YHf`c#x<
z)p4xcWni$T?PJBsXX|^oU=q7P*|^<0@m>~VL5}yYqn<sZ;U0L(W%~tH&`R@j`PrzF
zlDn35W9nalq7Kiq{jRRU4CE48brj2>6TH^t9OsCGyRx0x##(UuTrddUMicS!BjKi1
z2a^)qrJhG1X;|r$zC=UrwO$@V(bO0V=_?6XY?O5OvHW~6@eQez-T_zdurSAN;=9CO
zP+xW<=Z4Zq_RE{@Bs2;>To<l<F%<D|G((v64mC;CtG=n+J~9n{kwV|9SNUqhuPn)r
zLQZ^1-qPq5V80(a3&EYME1jl&>-2QVw`!2y>UFS_()4&*_C4N}kMJy;$;|lLt<uG&
zpj<+9u@?gU$K%yb6H0HZ;N#q+89ayvpb<}lMhV_H_TTeSpd)sXj89W&8=$GxO?T|R
zXTTjU>#~0GkHHA;L1fd8Ji_WpX8*bH^IZ*3Sr%H70c)4tkYDc-sBaZaerNmmpiS0A
z(*Bj+d}J;^`Jq@ThrpaC3;%3wL`(4DdFaMDHI9Ms%!DZT(WrIpQs&Ery7<^y(J2)P
z^ka*x(@_WS4+Ee^*Rz}~ahU$tPwc$SDL1k!ra#O=?R@y7=4i#W;>1^g$8>Nmo!W{z
zBy_6Hw7B{8Ts@nx-vlD~uj%QRT&5av#_p^byPh@8j_XuhH(hj}RfrKvThRzB7LaB9
zz23hzL`B1V*z(xm$$gwxs8d85^&D#a9E}bhm%eC}qT-jrTo#-<T_aYE+6sPo)DXn|
zEuukmy{3LcJ*3J&!TROi)ZKEa655&Q+jm`t$dT_qG~K3j^o)_Gc5G2ACneT_e~rMz
z#YrQ*@~Ex$ag_;yyis&ZnLf{sZWqzE_+PG*r1MK7$I5c~#m~R^VKdwOzBoX3#KG+I
zIc8C-e|jdITS>LNP%Pke^4^$(2T>5tsIzD8eLrbjudZo$g7-ia{GUrzOB=2yY=Y^5
z9?7r^w<-a!8#(mqWbS~$h4y@TPC5dSNb!RrT%PtQAS!M39*@M_TE?V@uI6mE1l@dN
zDV4pLO(dZ*+mA-62Ldq|x{F_p%`d3GmHD}7kFU@$S`n{EVhhD5Q3Gv?KHIQC(w!Qn
zT7$%0%)1{}sLabLTBER(w9-KT;auA0v7Iu(h{EQdYw*q0fx9B7g$5CDKxF2t82j6f
zy^OIH6bq2u%I`{-qPuf7g>ILV{4u}AGji@U=GMz%L8in*x?hEjerKA*!(x)J<yBf=
zaLUm&9d7UHTES^UFHB0;Et_CkCYVYX7y057%b~mp_zwIid-p_D?{{HyyF+~DA5_{L
z&*WD)6NGz0E%mZVJX-3qYKB#fYliq7ukyE_Ed&-^&-ZL93cU5(KR>U^C5kc?;)d0E
zZ&+DKw8<^h%vB4rZlRT*>=nlLJSpvrgJq4C!$L_21|P@Hnr3{Ss@tiK*WTusb~i{W
zd?+ij{0-*cWJMM{K+=i;C%4;E5j-vql}jx&@9`s}Cw*ne`svlir*|^nTEw(E5RJS=
z=|SG-%KNhqE|-i<;6VhqgUu=C)%?lz16^&mE6MYFud+QIk}&dg_XGsCL|Ham;Eq;v
z&9Op4Xe0Zx0%%dY4e4)5cZ4w_J`k{(*kIqKHvlJsE{H&}oxRXO>}0}inwCk18(0-V
zT{E`4{(+0}uVUG;);ki<uo-D^#>v(>4}&warsV4qmganh57Byj_i|R@E<*P!9QwK+
zH_uucY4rK$yUfv?a9&Kq#gqFm4J|#eV;iH9jocA;mDrc9Z`$N8Qomez+wV8(1`VYw
z1R(X`d86y?uECDZ(x#UufRQAc_rVx?E?CG*qAQy%lE-gn&t{dwzL@`LC^p8z(QsVi
zH~b75p$ccK+g31wE(0s1aBkOwXoU&hYWkb?KPbZq<is>oMf!a!zKNja*N@*h+F;*Y
z1O^|ZhI+ga_$#O1@FcSKn9rE^@SWUpQ|#Bw(#^LUm1Re}>3*W@$M2(Q)R;MAuUR@x
z<~79WF1y#za*?}W_I>mvPhGiAv%7!%79*xJ8Oc(AeZwue$j0ugGO|$PUMvguXxG9v
znXFlmm+w6>KJIVHGiK&H_~_|<>jZAyjtSSBUW^*&y_|$Xv!uOm#I@bJb<w(~6z#o@
z5AG|51TIQBdAk=q#+es6Zv)^~)t|42tpB<BH1?0<M;*9gOl&Q@<pV!W+TW9TYZtQ@
z{&s;kU_rBk`-|+D&qEhi%3T^zd~l((4nFlgA)OxAB~C4qimf3PrXQSn=eQZ%pXOXE
zmcWLtYI@zHf|~8_#4t`=zT7Lg@F1p9%Bb%ycUE7;I#Z~!7~{QnQZ$1~1-S!zj9;Rq
zV{<9be*SggkdDL6`#Bq~$@=%Dk)qK!?an&0ecnx98T!$i6>vRpR%i(l8?ZCeueXe{
z6a!17YOr63lzrX&a_IrQlWd23um{b^x~Lwp-m8C@{_4CwM7c4zG&DY|K%LDhvjsk!
z7A(wv#_ixvW)ojQzNP1~HH5I96-JR9pgB%OweJ<r?)hGO-YcOu{W!)=_jy$WHznM5
z-RC6QI{<-`av!xNF#fP5x6<yS0c-Nx&Ur9@XYFw?4NaKo^{Vy`Iyuk3-;dJ?pMGp*
zwzY4A!ij8+GHQKV`-I8DS}ny^e1g$ON|(r11(a+AjKb#<-dx0ymqfg;NE)Yn{CDgV
zCh|5_?wvog3ZJB>`e@-rotNZ(R=cnl*_8MR^PG|s!yK41Sy~dItiqA|0R~6@kmTmT
z$JB*s9Zs3ps(wKsZUn*jb5s|0Cc(Yf8XjscdxWZTzm5xFhj}ggf+hK*8%V-+oqI`f
znj<JTVKSAH&WZ#zJgA~kM=$586Q>jU-M3|<kjQ|^kv{gAtu@;4CYrXGOBxp9)ZKdh
z$9WhmWp2V=gY4~nrNc_tC;v8!!{0m9N*~jmPil3;j0S{xxf#wvD@uc&K0*-j3g6>W
z`;0Dy;WFO}DQz1Tko@f=c=Ie0ZuKZSN;e_RNhA32kZPwUfi5xKs7r99uCyQ9^Y`uX
zLsm<f@wbmrF}j6A-Wz4JeNH+=(4q{1wg*W+?1p`&SBoqk2w;8cG3lKYr*U#?9d@@g
z3U5gA{h%Prpx0M14_2X@w^qLW%U#21TWNjN^wpCS+O^KXD!-S7Hlsvx1L3ijVg?!K
zeFal%B=_ctwGJ+Y00-c|IkZ1j#Yo|3`eigp;gXJd72;!9h+Hm-t_|In1eIPa@oM{^
zzst$T<StrM6`uj;(IhD3)T^cEwjk5)VZj3;^Zs{!CB$@s45BUeVu8?2hvuc^WhLW>
z6Xb+qglP%qoDTAG$;M%gSM$4gI9>P%*S-TxmjBXrY)zoOe+h_b>Q0o9goCW8q{X3!
zPvM#Hg9$CZmlOosSJ||Z?YCZ*n829FY;Ylp2j{Xl6*>`uK$%<OVJ%lTTDgS8tmwWV
zwS_~Y&@XR|Xxyu4u%#5fwtHNT$ey|a*@t7N%Z6ny;bz#I7ekgxB!%C(yyyg$n$0M8
zS?=scjksO@jkj0i&3ju1DeefD&fV&Eh^tSRxMY6i8g8|5(lS;+)~(Iy7ASBEi?<2B
z*tjmwJ1{fhM*4T$UukQw6228m8%@S8b$L}`p_*E@Jw=T(2R{iqG6GtC`9(T97sfm8
zaOn7B5~;rIfxq%YZ`!Lc&+6GF`-qR^kOUF8Wp3qFY#Bc|f$2lnbuKK^Qd9W)KZcoo
zRT04)KQ1i>LCMC*xq4U&G4l<i94mtP6SICc(jlajB+p0?U~VKax5Wau`jgEPGRQ##
z;l2I|de*RV1b4)_y`VHh*_cs=RLIj4)>6rNx;>xUVu9sRK8I6t>HV5t3uGs;&E7Yh
ze~2OS^?S~uESpo(e2BP`BE$K3r*&aLFK6muW%b`rP{<SVb;{0<;aYyV1=|#aDV`;!
zajm^j7UjLUPQ>0_TijZFBeO`T-@7!j$-2X1+LzbJv?2`eZEJS88jkFy6sBK&sy#XP
z{2CKPmrV93Ldi^;F+5S&cN8u5D!=6>U)BMQf~R~{AGZ)X{>@l(-!G(I+!A3@GxH}R
zI(LbX`(_90c`{EQKf5&gS?=ZB%+X&DfVviE+!umIx`j@^5|Jq>u4oW(Tp|_&ez69q
zi})z`;c>)~q7>GoB)gQPH$?q`GyV6HUo)qC&m<nKs_$~ZVqu9WO?xF$Nc@o;YMB!K
zj2gDqB$IkM#hRSU{`XX$_-%Ay(Vk$jpYNBJtfbKp1A<3(fp+20#?@jBmZ&?OAi7rd
zC`@Y3t7vAYtjeg1G~~+UJCU&8Yi%MIj#l+jbSbuApzBdS;9Q~1vGFavBiDiKQ9`D6
z9YX(-GR=?xqP#Hixp0ab5?j%a8f^F85itO0oNs*{3OWBAvaz?nI85#qAr*9kj**q{
z)^REZ%hHQoJnVC18ai?^q0W;zIt)?2zeD}y<L`6~<sG`T7l$XCGe@$Mk$JP0o5a^R
zA^YVL%az-Wr$n5KG-40g-X;)&u#w=bGHI4?in5Jr>KC|=hR?E^BCdQHc3ud%UW^e}
zfQp*|OO;O&qWT@Bz&SZSj`Vh~A5hq2HMtDgm$1v1iChjEYMd=880vIV@%5$4{{5#M
zad9^hV-f}C$k$n7e1ctMsF`4dH)`$G+kB|Bb#rI2J%!tD^91*#o);Q%tn(1h6nMdL
z@_xEwtL_7l0+gLxqBc3l<lw~TD7bd1-!+V@xMZvx@j*d;0F@+ufl7M7_uK?k^Fog#
z<jUDm>zTVKPQ4T*E!Mb9d>vf<1i-x$6Q?YQ0po=zc(T0V3F+&Q!LcF6yf=yGyo%wF
zp@AR<J4&U*eJT^L9o#s(v>|T70@+IjZ*)7t?NHYbv4apRb-D=gvt1)Yl%D>Za)iKW
z`4u{s=jmjge<VKgtx|ASx-%zY-u1tZ4Qf;E$aR?%)wMgBxUa4U7X55_|L?OQnfcLX
zXjmbXEAGi9bMh~r6B95J=a{ZsOtI(WoX*Q;`j>VbRux6`UlQXRsXbo(Dr`!ZXs})X
z^}EMAx{$%k3Cc4NyDQ6fcEM4Kx=ALz*naU-Rjxrvsq#Zo5@yuqj}G*5sT1+Eay@T>
z|BKi$KS4saTgF}DUkA!IxEpTrTi>A*8=F;{?vm4juQ%)OLnBntSEU_R_HdE?Ammxn
z{5l`#WF^e2sZ7E!vFBpG4zS~dMmJ3<$UQF|cgi0xHE+N<OAYED^<YdN(~<Wgw|W8@
zWj{<u4^#&@W)y6Kr17hZHeKk+8{ER^4*mRh2H*(S*B)$_wn<`53f|}u=4D=YEh!V0
zGeVK<rDhBK0lu%sbkEw<M^6O9--i{t^YR2r>dQrG3@E`*QooTK^U|GZL2W;*#N5|}
z<LOOaY)k6K)OI$@qIa7is8XEfQIit%=$)Pvk9KApxo$(+Wv>RSIlcLILV43sj$1mB
z@cNaLkC_f&84NUwpfAloUShbv@%648=rz_L$lC{r35$h^MWE-&_JZg_aSe3joQ?Nd
z8zP^LkQqhNPIgJBPB=s;^JarZ`$*wc-NS%RGwHw_U>u$@4A3uff*O+2tA*zq$&FL9
zq45+8bp#{DfMpB>#wG<jGpgL7e0fCq<L`M2DHVZdK65X&|8C6fJej<eUfQ`b0oiL|
zNI6ZCkkr`A>sPL_3g~_l_HPSfYnA5Ucx>WeH<?*2doMs?b5(BOY15++^{{pNN*gP{
zClv_WG0KRfvoHO@-CVB&fq>#w{Xz?tNJ}5nSb(wC6#?ayNp{tiuzfm;1@&tS{?3N{
z*SRcNhWD}V&my`nQvdXHB2Ifh{pjAgUDw+>CH7@jVUtvb4YIdlxxnuKP7eB>8O0b)
z+;T?&@=E-^RjMzH-t3r!7j`faMtKll0z(`=bzagS9#rWm41yhuDoK6(fTs{=vuuG0
zH2B=O$~t?J^#ogiJTfA%0%h}k<e3I~6U2bNs`Zx(&%b$?e?^{ux*lS96N6P$`|AB@
zWaqQs)rW)Sh^OOVZ~WuL5PRH6v+ckZjSK1;8Hj9o0wXpTitX19pL;!ZkWtI~aK0Jx
zPyrIuuiV$P8dT#v9z8g5sTGvvj2F@xA_Fltw0HTaU;9~I8`Ydo%=7uz;2xqSB(bB|
z%Bg$Xr65KM={+Tv%f3vw%0`$s$ee19?%w?Rt54<|L&RWpfblFZ6Tz3&aB#}N`B6WE
z7UQ-^Rc=SoPX^-rZ+Es&GRcbErp!`5W7LbUbNyv%p^Nb!m_&Rcxv@s&j?gU>ZVa$(
zR8JC8uqT8TH$wLR$@laxJ^6ht1S8^_cdwb|i$<K|g}`_pc5xh{B-_fRRe-9Ln@6k2
z^tkf!raVGvIgR5Vh|I2j^~!z$tV2ChR?18Wf%=p>cRiftDxLeykf{={C9{$Blet^y
zr<)asch^JcLHY>0vZY3hSER7^VN29D2;~MkHPwf7-yhNjR1HZ-Bxiu&6_FQop(@CZ
z`~Fk|ZDdD9ke@u0N<`-IDytw+s$jjw%Ie14PMKHX3(}C(<IIP$v%9$*N3p^3Az}X$
zvvfuSgAIa~<{C$Aady+EKB8-s1VuE;QQx<Ou^-bK`Ez_qGm6t4PipH8fC3rRqkOqP
zpa11JtQMpDAT5gcLH}##w-&#6K+2WHZ-pRTO+PHrNPG=hk}JmpW3X+SY>PeTv+mN*
z2I<KrpXNW6-ooMUl3&xD_uC4eH&Bo7ick?$-Zw;J*0hAt41-wVykokr_lU_WYo9%0
zTLPPJrMk2cYgzfX+-UIG+y6IqPG`%4V27#sJ&b8S&<VrFGNilyq?0QIB@MQif9BNZ
zwxJ#&KVg4m`n49iU)ph#2=Y4+ui`dR)q2%>lHE+glZh3g=O*i_GQMEgJ=VPH%1=YE
zFU-2jUFi-S{yiAMz_5V3n9AHR#GU(@DDly2fXa~*Mz}BUtFh`J%68(rY(bUuxdr<5
ztl=01-`Z2je*(|rFry}33U$Cg{}=1AyXYFa<7{{m#-w>!CxoJs=SNBsT}xp#S|Z7u
zB<COB0W}}mM4OM_i=<KSEufcLv;^pAJ=KNe0Y^PZn!WoGIhUd7*e!JYIqe{}RN15S
zHGv`Hgkz9P$W54vNj?Y&uD2e)Z(8B{SCsM<OfVA_^mN3z%>n%+T3;WV#g8Js5&zRU
zv@$&|2d09+ogJm4YM!U25i<RH)w0Ti)cf7|kKbSK3;?2(dcSCzYm$9<AGzapOivne
z7<2ih^HHLL4rkEsHrOX7wS8iFL*{{U#G7E;KCfhOQHh}#v9H|PCWg@-j%>6!o2zxW
zlYnWxyO^`E{WVbESNF*?r;`bP3ZfPgP^?|wVvpjl9Zn14=DyoTC)bx%wN)x<q?3dZ
zOtv9^3uPGH(+rg%tbf`!{o_~RcHxzs>45cHeb^*6q89d;%a6lsP5sNV&ZS+>2joP$
z=;ZXa0<GaQr!`y5K9s}(#GWbO3CPm+R(B7@Jji5g1x&@hS+_&3m&+LzQr`u^igbTo
zvqAZC#o3a75deI3;uULnZxp=GS*y>Sz~-i`uAi14m)G~@B>pHc6TW}+ju(z=IMeX=
zf0?M|X3VubDo$ZpljCXyolMtPHxwX~q_JV_&nI0l=L;ig74l#H69sRe*Mc1n8yz3K
zSgM4*>%-!^kqD{5=3bM#0$~L6^gSkBy$a`l%nV-o_(tav-x4GKb<=M4G&vomw<zfJ
zf7tuas3w;$?jKG<fFK|s9hEAg^de29NL4^UrASBVMNxWB=)DLcpfo{1ihvYFdJzzj
zCMZpM@6r+=B>4~LcR$bizj|Ig@9wp7-kfvRVlvk?*X%uee`n8pIwk+ST-a-UFW%~|
zs8po6ogYk33EwX{GJM~;^P@%4*a<ueBT1`m5*-8fD$YA=Z3~jk_$aj-F<js{ek3h&
z7(~d#Rn)1aLVcq{As7;mLO_%VjxLtIB(?8P*45o#<8Rg!2b~q~$;v<eYqK`Vc5+$N
zSK;{wQTQM!??A@;%|sBi)c?5`oUVrZ35h@@{4znOg=<I81uJ}1;FF^R0l``ObKes_
zeHCBkxZhz9-K0E=#LV@oc10An5^a&C<+cy4w)|1=A99NPP8d9i_!(``v`+ct1fp({
z;j};K$4=79I3eohQn)@KZ^P~l8{>!y`&E}O0oN<5ok52Abt}Hc)oM65%s$Xc;oK&7
zXjyJReqil4<Y};<&bc}A;pIC<@KG86#Ajxn3tS7@A7Z|AkVL-^oW~t&bRstv_hoWk
zCwMjpbw26u)vP;P8a)@AbM}YwFKQGngAD106{Jqn89YlIf2X_?dMWPvoFC!?flWdw
z=F?^ckEDvywbn~x9JzhKi*+(Mb<?d)eYGM`{P|vXo(yFxdb*o$?<Ra2JGj9i+wp?j
z0jF+F1$7)bdGPS!MZ%B90?(MP0t$g@MI|{Qms5#eh&$cE+t!~LTlkV!qL2^^<aKnw
zL2KRde2(v!Ik(JG7#HX7<RHTDt}gJ_o(X^O5Vh!Dl8wu($NW~3ytYV4qmf+H_bt}e
z=xUH4yb*;6<_Ew0^e}1<X=6e730-)Bh(dPy=-!R}lVRgFVVO#ksx$28pm)ljdnJIe
zGUiP+Qj8M5qP-bhY2tfVeSQb=5m>dY{@aHKAVj?XXD{vdfe5TEgOdVkMs_FB25q_Q
zh|DT8W*Zx$snlb0pmGtocC5R>iGVY@qB~j-+9bb{3_oQzSqBeNZGw0dsZya?aKan!
zl1QJy@R>>{vY-eDMzLDxI(3{SX-&3tcdw`Im~smep`(J!E>rY>r2Yu~Wg^6jCYL#W
zGaUErkGq7l%fxfRjlU;x-{WbiZWuOkW}ZW5FL$-559hQif0VT+WR)KCw?cMdix3;=
z3x_RE)!r)^B&6q=5HZvLo{y&y9IO`MruffLBZ%R5a_=@*pYCAXeFKFZY8qSk@U2@P
zFu!~8dLr1^x9NLxGi&P=tMBo+H{_)-!$IY74*g&wgN~_<!t+^9n7UsvP%F|N@;OY7
z@8g`r_5t6HeAbu75h(VNO^oZ|)S~ZW5COgnPhndyf~pykmWBNZBCw_y@1ImU&fOiS
z%SpKXv=vg>KHWq=2l>~?@1<IjNX`vrro00v>>26B*B#7AS{O0vJvL}{(|Tj2Osi&x
zy?2mZ#QtCHP62Rp{7El|*4H{jZe0w=pLabm=es5fKZpX|G=Dm<WPEnIq1<N#t=-|U
zBo!>RL5slLEAL7)e0h+`5jbN3%!VHPg73chHJZKwd}}2Byu`5p`E^ntQuy8ewbOFt
zFq^Q6naMJ-BxT?Yy4+d~E4QfL)P)DD7&GenTjILvb=h+q_Xi&&Lai8kp7Lq!hxhQ&
zPF!Bz$~b!dfSu=W6A)E%T*r?_w?7Rr8p{ae-tRI_4WEX1*s@`yf{R%!_L;W&nF|x$
z(zLN+kg_Upb6TOOCI8Oh^fqnviuid(zJSYvo?waZu0{%GqRIR54aWOrsF;y~7lWPh
zB&)xK__6NS!eW~G)7UGf$S38co<JO8L8K(3sMmuW)<7FeG%_HR%i$jRuY(Bt;9Vq=
zt6}r<m)og>joulf$v;S665H{{EPP+{N{n4+flR0>c-nk!5yu{W$I6k4ud~4FH8uoW
zhIVH74|7(kTcjJyrIl(HGs){esM#Vz9DQ!tTvOoT*<E89fr8d|6nq0rR{G^<n*wj6
zj50Yjr`aXo9(C_$kOk8_9PvQ}ZHT-wQ-b^Fyb<Jc#@Q;t&G6d6w_B9owlA{DyOmEZ
z<dITAo_=0#Nz_%}-^VCDwTE2t>i<94U4?sd5WxVA-BIg_P>N+Mx*5^l5h8rw83Y(t
z8@rp1-Mi2KC|4^I(t9fg@j%TDT#}VDD&LOLCJeS&eC*?6h24Dg>!9e$F3oG)p$til
z;NXQcf{2>iKyuxtuIBn~sM6W;H2}h1ml_rlrO2_<U6LZ8?UxuGTa(MJU7>(>(GFhk
zH$pRi5u4j=F_P?sIq&~D_Djh<S^92(qI8zs8rXc#RWBzk?H*@~%!-8Ox{u9vpKprL
z#0%4(M$<PMHlWz#U_MJVrqwgZe8I9P^%g=`ehx*hy^sgOC1A#w$>(;@bU|x0X^3yd
zk)fF7arR%Ysu3`EHozM(Z4k!hQm&=7<T)YPW#lebz)?G}n=008EmD*}`D~F^<CYaE
z;W3FvSc|2IR?1Jye(AmyQp-Fo_6t8*5>K}Ds34aMrHW3!?X<X+nNYMa_>M2BUJZ*6
znJBeIb6~I{S8S1HC%Um}rI2v-WBZUaTbKLe95z1$*hP!MQnt_>GZM@KxjBf)bq>Kr
z@~B!KIALruwQsVsk63^pDP|-QYw+w;EA>xRE6fP`+T=`Sz*hMEX3q7o@>xtR_DYNw
zj)Uf^^dLNrI@2sE8VQYW6w*D@=P5#-4*E@4hJg?%6Iaxqx2$AF`Y3OA+cH-#Q_M=&
zw?yVo)Q^#Opzrj}kbx&NA3g;3zrB@7_fr&JqhgJ=eD%ME1HaB1M%ALR-XX~)^7nU#
zq@}l6-nwGOR^!3&$*|sjbtuxLU#y<<u-cWh^_EI2KagpYTu#A<OQa#_&-1r#NMdo6
z`h5w-Ck;h<GCfr-{oRm3QXBYh$%oi%#xU>nHSbG$2q1oxy$2p<MF5-c0a|fuo#4Qp
z(a@9YCv9&v5>kN`*2|Eggt_GOWCNcOh7G89L_6tWuUKG)={1??v{yKaUi`1^#!|@j
zCU{DfBAx2=bI!7L`O#ax|6Cfn)zTuMxv_trU({5&iB(<1U3T)({Pu$iDv*0PB0Ug9
zsQLEG09ARvNMLRKe4Qv(+WpCjl~+rBMw*RlfF_wI6!gr)v(VWVEioe&zm1xYgq7Yz
zQ#=al*=*5Qq)4zuj+A^oM?0?U-O6Ad)bp_`x|M>z5M36fa6m32I}9dUfi+}R*$wPc
zSnbtzi!bk>=1BPv%;#w|hs+&#Yx?mQi&{TzCR!AYU)Ezn!)`dMPs-Q*)+407s+&>l
zdR*^c=(qg+JE9j~PeG!TmVEi4d;fsqg^a*{C^pj?QRf7<cH_s9FN<(P;gbF9B`xgy
zBrk@y8C=NB^wH!DeVcM7#R|=~|0Q5UOOGL|PsH6^>;`q^A4%duSkA*k?yy})am{K<
z>R6U(2BLE^(cO`XLciS}<T752&oePf^3$*0q|qZuFyx*bmM*QR^*8f4W`Wda#${&y
zda`D*v#SQ}QvE4X2Cwn=Ft-8uA`|3e<!0jaqb-x_3H$eG<Li8-YEAxgLO@<+y^pQ$
zUCMcN`K+=uUYLVKiRRIM^e2kGpHo{+1UHBrKS~^K7HqSoxP}?1QmkjWy|CHP#dW{=
zixD*W%j5G1Myd6tY3YO0v+OIjoQgy#kp;gxBw>j7PhE$1n@hl1R9ZVh|K$-k5@O1v
z3}J(BOCdd*mY1|u`2rVrHgYmJQq5yexE?TrvET~LQ8;>|)~RSv;Vs*Cov$$dGPFsC
z)!0G{td+Zo!uQ=Jtn_Cn2V>)d&#Js{j|*h)&9?;qPnq&qVuASm1c!W!-6T%{LAx~A
z>aXmG3Q7!~Y1He8+$~<(|9hm7R$L%PtJyTp@}YUR!WixS10-9=8Tnx8m;%kUw?fPa
zpK#sg*H5c3p9LWOWL31V4{BQD9LeLz=r1?w11RHzowy+Ko``2#pI^G1Qo>0q&@utL
za^m6^F2EE)AasyB!BbY@dJyG<djg+aP`w&H1ry0Fm>~oN(lgr=JjRm;Vx>afyI#5w
zwrxr3AipIdE>~vffAV6{16YSqA~aW{2XRBXekZ9S%=^tmcG>s$3u5h*$@xJAyZus$
zCuG8}aYKwI*C=ZItT{LE@>f6=I_JaS30&yXFA4Dwr-p9zvmc4<ITORNG+~bqNFg+K
z@L{M*E6h=QkRK+1&^AVE7`+=p4A$)O-z~6Bx!XYQeQaWCE%V9A;e;E7-Hra_{*;|f
zh@K3^ZbS*i4m92}`52aC)X4+2kvinc{kl6~^|Ez2+!k4LE4dG~bi#UJH%95pYq-=l
zO?*e!)t{T$zLqzy$k%pofl+-h3-->>*QHqwe%}!tvxbW1oY2zh;tGP2O(_Ji`L<l~
zgm_&FLGP8H9734zx=oR!JpOD%-oK%E9_xK@1WSm64D~9BP9Ix@mf!fjBiiwwmwGP(
zzp{fL0%-<Z8b7pm#}Jn?3Tc+JB)RcLB&xVLOYirT>?N6gwv6d^ND_AyNovnpMv*@5
zvfWWLiDvORDDY~dc7#7;N8R>{LTM*<O5ff>KTZTzKwlqVbM_-Nw1C!Rd&OcnmmRbh
zmp)smim=&H;N$!Jh)#WIaG6uc774`U42Xm5-M{ooOnxwrp#p;(TsLzV#;M|n7IP^}
z=4@jpZ>bxSq%0mXpSy0cvvvOA=^*rXHVw4r7xM2;%Zm{a@bsE@6!dCyjmycQ8_A=P
z|BuMz*AkJ+JkunxopM(`0?JunV{=0>myex(R}Q`xLed^i50^U?_AE%QY7w8WQoLqQ
zs1XNJQ!S0*Z<OXjW$t+-b>$!^)_^k_`0M2FS(f))PJf0ObFdYKyiW&*0T}n)6T_xw
z)=+6#cU&V-`>D9_Ox*A}O+T1VG>LuSsAB`Urx>Wcmz<3&-oBn%c)k}nJ&<lH{rE^&
z+;y~6z~ma?U{n?VxvbnYai!|bim*=eiFAkquW?g{%|0sk{8Q>oIKDMn_O{rA<7d1h
zu1`-6zJkqgbpdb!q!LYEkwvLh;GcV<CUJ@B{{KWH^MV3fq%WA^>kiFi2=Ga>F3K=V
z;WOG7f481aIok{HH9VdQDZfMl>HHJ$#HD@3-kbF_EwiWe1<!ET?G^KjFrbk$uD`9S
zJJ2nCGUSX>cb+}pnEpRe*4P#O&x|)f(<{zkLSD+mm<lp-<6tHs>+|uyf!~_~=Vj);
z)$EGr`WHdLz6hAzBUg8wA>TAeP2KsN8pvyNkEOI}!7VM?o74AnFQq$R>KvBDAcNc_
zARtZ9oYU<)C|7#^<1X$_%EZH(&~0Pp(Z5HdGFu{RN8RI!AM=)-QQv8Eaz-ClK!Nfk
z^9Z8NwmGdC1eB+<U7GyVZirIs$hHxVLoVP~z+s~HVQK&PTB}ePs+{{U<MnG&lPBXG
zwQXR6yfA7#|1|-;5?n_w`d0R?@af5akvjOeo}!S!jc;5K@<dbK6BU+bCK=g{_ZH_y
z7?*;D?jZ$V`JjPlRGh_D0liYysW@tQ2#rd=*>PQBDk~>j;YSc*tqr2I!pk#gR!OML
zm|1I@PNA?7e{N0-Gm*v{<KDL%=`lHH?hn9~O3Mx<mCT}lLGS&~6>~k9iske>ofycx
zUgK$1Q^EpS4VkC?H{V+k1yZjjB&R_7dV+PBDTpOTpEWv^bprYIm0^!F%1+kmEw3$-
z?0<)$Fp=2qNqJ!tb1KL|1Sp(9e+tFsUu%3wZ8?CjyNUjb0^8v?r0`47(&uYA6J>`k
zV5&!1InRtkJ{I9@=L(zVHy)p<O!H4;UU5@FJnmO956vD0r?pr56-i_5)I~=>2|$4^
z9-}nAlXFuQ7iAS}AXKg{R<k0hv~f`!s$6j*ZiP|sSY2H#p^2DCfTDz>H&uO{oCxj)
z)ZRXw(@IG+nI1X_hwIqt4+>a~U%M53Dm*c)ocxqaD2I-7N@tY-q4#_$Fxj%w{{KQ7
z<|QRGS;-*vHeWWCY{!^$BGxY#`m|HTTxNu^RU==)4a)}b3z3TSklMF5452kculU!_
z)y3rWE%WljUR?9<Oqt&3ke&*1@j6t$ofQTiCpPYq06=b7I$nZp-VIKjWQUp96S%DQ
zXS)>FZ~Ym|eel#s)(WKlW@zvBj4AoX7igfT6@Y_D=2EPzBK=vrGlwsy&sW=<J=Ga5
zw+?$-%~sm7BXSOld#I7Tcy}_wtrdKY|Ch#Ok_y$+cml~4s9NeD3UDkrs56>;+`7*i
zi4KQ2UdQ%I^Fvw-kn5tqn%!D~Sny=};`z77@+1q^_J*$Tk!UavV$7?pUCPBhPlrSg
za!4u%DB2CEp&wKAfo}nGv4i*V@7{LLs*to^P;m6}x>#VY?tna>+{UEM^(N4|#HB9K
zt81X|*87)%3J^58j<Vx>lz}nAYMjIK<$D3E08s<?oF6~TuTkRg3*Lm^-zQ_|7lW(<
zoI0DYc~XOsciMO+C;Pi-3EQ~NtmgSM`Zzol#dwkjHg0*)*dpO4D4$rxiqG>)sGcsx
zYYg^H6WPbZonoxTUk(dBtRcC!Ts#%p>Px539%3(8X&CXsb6+3@uHx|FIDB!nWG|FA
zh?*8d+WO-a$>(RM?mC)IKJAVNt6i6^_j|z++Ka$HRI%cZh9vIuo>J1BzEetQn0Q(q
zl<;pa0%e0v1Ziu}q_)Co@i6bGG9#+oOxCKmOHs0-`*&Ug_AEwM)C3k?#ddNOJiJtS
zWM6{r?w@;~Qnz$>KREEWiGPNZH5vrXBWiD+26vonl%_gRHdgKq2%^A7N@6Z8E)~oc
zkqzd&@-B!{Z=X~`Tvo^cLF^}95Ym;E%MN?(%xZOiJZD4z0^H@)m1**%O;h8euePUK
zDOblV3}}3Y{mHU#`FI^S!wz9&5O7Y5LWl7EC4E5^Ax8RCt!qxZkz&oMm&8;G-^o|f
zH>wP=Cydy>!9v)mgJ1h{D7m9W?1E=6p|GVv%e>>J6>^+suM_iOYUU4_2uEs6P>=uk
zWw`iP!ES`~cB-Lr^^79;fh@MC!SYNBtwvwZRqCPno`=K~%U?9WsUT4)5=Qc7>$0~S
z$d#I$ZA3QtK4)hg58c~Hlua{cMm!6#$`!kP`<KXUa?P{TSh$oxrFh+bPW=P7X9kUI
zq7F)3Oy!ZKCxX&H@Mf3dby@#)o{me*;4Bp$mI-#(6@Ph7iZUDliV;oILM#4SSrB_f
z%TGjMXsIzplrENJ(C5e<t!sXFeP^`*oqoQ+)^XzpvRBO(sWe12b6o?yCFHHMnC3b=
zqQwGn=sZ)65)+#*IUUH-+)Ad)Xey(9o?WHr{0e8@&keiZ?T|@!DGjRLTdnxHc2hUl
zh;eS)^I^fmUNN)vdsL7b{xi)8g**<|ls$1-+?ouw!Y3=Yf~_@JFaCq{jb3QlJ1#wN
zAS>?iA7AVV%3b$If|xLFm=sL6l9zP)qdyx@<L-Jy8sRKBufcVM*<m0`I0u?WK3dQi
zc|=jy?$-Jz&I~(sOLUzF$&o!H{k3eNARAn&P^#&b`%6(0dxg8noKX=0FQANoyvE(9
zab~AtFt=67eLaqZyrufRT^hEZUsdWWDmCPL)@KUXL$f=VqRSccEOLD~_|b7l1qqu#
zz6q@68VI`O)yk{5^!DB8KrKO4q&#Vur6s0k0mOc>z_EO;Lrd77+b?i%{V?{}ZXi0h
z{)2Aoh7Okg%2RC+^!q9E40QDp-hIPDg^?UeZWB4z87kBUr;fiC8v!3KOiBW&?JLyf
z$P{7TpE+R93I7pW?sd@xt@3Gkvn6PPBMo1S`Npx^^%e5s?yPM<yJ;_8JfyKWP)?As
z`61<~fb^4fUJwTuf}${+&kx=lt1}$Saf!1<h22$oWd}A#fD#Lq8b57u-9)yJ!5?{#
zEZP-K62BErFW#~FY#+G1dZbB{;YSXhV(J9QW$54TG*Mp$NMx=&Q8*6;MLXFbjA(ds
z5gKTnzrm}31Kq>gY7!5)hTE&fFK~!!d)#G#eBdd=eRE!^DrlES1&Kk<cYpa7(|T?b
zquV4j4sH%0xuSTi{!xsr<?3$GBg)?{mWv%&4j?E!lkC!J0@nxJi~x}k_qqIvjI}iL
zE8SOU5-Wo`7OHdn9=QK<O<H|$5yo4DYs;K1Giu^1$yWGx8-!Q3VB{0TZ;1QV>tEYJ
z^KMd?JScHZS>DX?GisVuGtq>KoIbYHNAq1PUb7^<pwKw?aM-={hS@q77_0kE?m3((
z8}1}t@zf^jFy|WWr<m_ihU$BN6cuKa-!@={|FK!U+tj7vWB4p5?fFlp7rzSZUQZ+A
z_+R{nn=FR%HpjHB^G6!zvLJ_ARu#x$q0Ju-=s&MEY6u9t7Rm_6cb3Fdmi*mJ0~D?f
z*#a+|@R&nMv@vLFl5;!Fz&6&F^O61YTH2&GWmBs>_T;kXor(eZy#IU?$aH?-RRte(
zrepBg!3$uM*ZJ=V4h*n0!!zIgs~odwut;x~q<B{!V<jgpt1-45Lr}XQ|AH5lXK~_}
zJ%Gs@2Dy}-SIfJ-#!c0+gxv?OR-kjM$(Je3@4P#{Vl*NSOAf8?&u{6;D*XXl6p5N9
zu*qXn*q7Hh*-s_X{uaGH&(GAL&k1kq*-0RtVQ%QHNw*89`AYxnlrklmlv6D1Um(E4
zhyFPo5r^wlIDCdDB$Gf*1)yv~NKz*|ur(?lI#jF@f1Xv<C=QC6=vS!nL_A&&L@W~Q
zcltvX`73S(69$f-Ju@&aWzwoj5;PVUA7giYN;b?MJQYVR6<d4cIUU8KL3{q{O}~?m
zA)^^l3DN24zE*Y<b1&*R%)YaPzGR+=KyO!0pvSD3f@u+3B@c?xWsNf#-``3Lh=kMf
zUl(w-n<gYiYU;ypUW;ucV5fEhR?vg_iU)_&ipJR|Jcm#vH6?X6u3Y@P@3czt9rGHH
zXdTp|FQFt|x?>=%eSP>ygxT(wa9TYF38df$#F(FYhoK1DG|nVZOwj%jgGXwGp&p06
zo+mE~xTGYXi_Uj>U<ti5Jt~re5m|2fvM`T3g4^j<ZY7!oLs1Vr*WP{Pc`Y!_C=<|r
z@tgwQ%)j^kwKQrdyNL^)hYC9K`~6qCL1mSN3b4CXt@ONyO0itn5ZSaaw?OHbrqy)z
z6W0E82k~*!R4=j0-~Fn67G{>n@O&ytTScGY-=iX5UkDrqztbn!jHTIVfV~~Y(;BMy
zzbKyP*uZvDuKW^CIWzEr<<qB=QepfUxlSPaqMz~MErj7z7q6I5e3%gvgX<Y-Qo(9O
zEl$2TjJ6cdhETA#+z{Kf_m#RS9QA>h1#*oM&3O*@6>kbTR%Q%x_`0>@2Fk$%RFo`n
zFCgc33$H)tMb&5Ao@a!_Pv9$8n=Zf5!WV1cyL)<SO7lSyt5jTf!(-o&c@a}O=JhCl
zYloi?e`jA!2!2N~7np*s%Q+iFu5k4&hHG&ck~;@Vv-%GB!A^I3i@@}!$dM<vCrI_s
zV`C9}$?NuN|5#nGg|okyoZ-jwCd;UpQ$Hv#GPZ2cC@JIDq4f;wGFC$5uRJbn&1A)Q
z8t?=9rsBXS@G%kufTNTm%j$?QU#^^izisR`ox~eje|@Nzmt(Ugy;=#Ct&~rye+Bt{
z?VL~OWy-)qy~pbXDUL>JP0?T~JJna&tCDypwg>*axEC+k=iF?n8v!A|GoGsgMn8Vu
z5y{Tv^Yz*^2fFRA>r#ug*w&8^(qa(3$<uA<;$COF27_B-WW1k<(U;wwsVf6iZZOsx
ztDJm@2Wg*<8j*KutD=~hly6NFBCS`3g=76d%v;-c@1mD0Lz_ZT{Um3(FSvei#G7s;
z=ZXxdkuZu*IQ^*DQw2#+Hpb2!97i+T-nt30x_iJ=nKtgyY6@GP)*!aa{4O3$o48|g
zz_OWig8p+2PW6ZZ0cur-JFD>>v}k_7<5(KtEBaL)?RSv`^6~3LQ=c9oeo{F#RPSqB
zo+I*6N8rh>rjl?rC$N>vWn%v{It8D*wZRCgLs`h|Nc^A)@NbgRVxOHkpC8MSq?$H;
zNlsM!XX3k0@Oshc5QcKIjuQnXItg8E2K+;9im7@yj>e9Z*>{Q~WFS%~bfGeFTe_Gv
zEb_KTz2(+&%VqPE7l`lO^l(t}GJGQ&7wdapZed?$Br-)qb|Ys3Si_$YZQIeCtuq^$
z0b^8OyF9-HMjn(Qpg8amSOuS9-MI^szKXUEycRsQp98&I1-;m1%SAOZQF0i)6fx{m
z$E6nHK87#8Y^xOsmw_LQ@98Rl;=3+33DnPyap%0bqe16=*Ftk9TVORGGy0^r{xZmX
z8Mr=8bE6;YT5W^)&?MZ&m1}cIGAesJ>48;WpeU1!_Hip=@NdD)_qqIA2ayvI)ewh!
zV`IzByjuh+&Kzp_AMcC<rjh6P4y2dK9*x+M3j8j|k%<NOjVi`DSIFK%P2A;t{=`7U
z=eE_1P?lW3F=52e44V78bjox<UwwK-?Yz=I3rmi_lZElf9Zp&GI&?h~O#Rk-hxj+3
z+WYBHBT$<8SA;5eg!|0`5+d<>4PfGJ1U|*;HH%<;Jx_`U^XpE7)4a@kXme4jT&<`l
zx75=UNgU#NC-Iq9FM5u79`|RnofM6V6q;YOr2$j#)#WhLN7DapLogkc(`9NaxGz6!
zl~Ly}zJEkuH-b6b%lJKjO><b7=^5<tA^aM*ZqK=?2?gy&Hn%TtbZ+2uUR0C26}z1J
zOGne{aqv)muO#35<3h98Emr%;ea%vvw0ilUc7I{^OAVdA0?;QtX#2C5CXe%LbIS!j
zZ-c&wCRg{#8K)~<2(3#nkFh+%Hk03G6uGs74p@m!0j97-CO%8~EU$a7K(aj|ZmQw>
z_Y(YB4*&G13wEP57O9e_CTc=)jpXKHzDnqu?iyP2mc=P#?oHO4$T2&+#P2fvj-!A{
z3{et#fiAuHBk!x6zOC!(5XXs+k}J6-fhRf@WrwJAh=Ax)zBhcNfO`Ppdvq=f*{`*<
zOQ_#B=szja2a%)aMG_C6;lj($t7fQ7f8Na9a+OTxYK4khfysC?-Vuq4o{(MKlrzW-
znwyLComMP}g`&zQk$w&v&k@+Xhd5P-Yd#)#z-!)_*AjwLby<hy=U1`7Rwr(tlkWsh
z%qV|2@-%4YNVp~Ldwpvn3M7>EV;1n^wwE-~b^c8~^$E^c)A$pW*pqfOaX4@bgSC#@
z*iheV(}Rt1x>-2^S-^KvoVEHn_1Qjjaj`e}Ng``Vf(vM6gZK^=|3<4cTKEavLzC_<
zzO|1&2rtlTse63-EnuRS4wzbb_oq)=YCTJ?;dA?15nMYT{de#)SGO&JS&M`ET8pis
zJCENLH#LU+lPf|Z540yF=_EmhBq^q(KGb4Ba_M==WZu@jzFxb;D1!6eF1+o3&cNJw
z0cgjC{PYIQ3bOVqgrgpwN16>%d1N5pl|p_gH$%APxbx?rr!|{pr)#>wYpvgq#;ZYd
zFOZ=%434LlHFWO1H@|rQ0<ce$tqXPf)Ad@YK=v^Psh|YEt@Rw4YYwt-D%P4rE>t<^
zG&n|QG1AZdFLGIcFX7x6S|ckQiZXm^w@H%!ZbDvXG2brP)eP>xxo4S11+5+JJb|}e
zgR9PfVyD6`)w_(r%F9jribj@!emF&obRF=RsUSl#*n}>+nH)(!anog#nivA+q3IT4
zbqOZwl9bHboc1JeM0UOa8SE>9z6oClmuAv^Z_YHd1jeT1r|V?X(6=r3m??-^cMfKT
zUqBi4O#pfyfdX;dg%w-}tdjwTZ7UPRo1Et`*9QIdQv4D|)kn(L)Yi~4;U{FVZwIYg
zO>x_n63=mocNR=UP=AE+9|$27Wkcgnn@$A7%GH~;1|kh2nFD7zObKbs{RQUqLvnNH
zAm)rD@5OIc-5a@#`fjKq@)>6y-u1GLDUnVXD!$33W*T(9H5Ik#_!$)9>-2XVcZ&$$
zyTvz<_r~j~>JCtE%6}{(*;%Rj6e>bY{Tsj%eubTU#6rumNlouutz}FFo(h^V<baKp
z!e3`9?Z^MNnjy>(R=#!CIP=tBAcOcB%_tz47hT5|axJB-LR~Y_Z+l9Sf?~IUp{^zx
z!S)=s$*mCI$*SvCW*VVIed9ia({UpXyGagDnX}g3Gd1q!NgYikdt9N5uUFm{nHjBL
z5DKX!q`arH8q-)IRdPA*Px3QzU&u*kTb|v__|e`jvDYV24J`fO8L)yF7b@Q&ysk{=
z6qjgn^yik}cgo-+c-LP+N*B2xT^mR;1X#rTEoyUbD%`@%_tZFZ*Ruf?PK}aMPMVY(
zt8c@X*R;dx_@D7SKTL&Ou5n1Boh0!GJzCz_+R5`qk7&#It9ISL3%*(@&?0xfcS&L1
zRk&7^{H61IrNTkeyL3p{GK@goE{#Ne7<$c>Youncj3_bK9pG8vKzgl@9iMe-0y;G&
z`(Ac&nrr!dx>c;2>6Fi53-{fC7wxoz9j|k6B+DcH8P(lPE5c3xQeT9D_w%R)?^jib
zU-<l((>smqsB|!Y^(}{w2k)U|vY*bm`BW4%){xYR0>zb!{m<vO$zkJ<zj9C^7moCS
zv3~@&m^Jn3Vz>wUNTf;mF}^Pk?b_p!r7z7WzIW2Y$?Gl*N`S#Rw_oTbu7B%hpxts^
z<w|Hh)mf{)FRqrBH@qz&f8i>6Ge;Vwe6G|`+XT98ulNEa-;<K`PnWXG>(+9f`tFUG
zo%O|J4;?fe3vD>Je|znr#iB6H#XXDpeLO3){GJe;MbJ`FNRRrT1nkHJLHn$DRddMS
zqyekw#2%@h(CBt^D<-O()CjUF#1!cf8@g#U8yMA(wV#}k)VjpL(Bu+^3OXyOSe{b+
zS*)E-nUi_m9?z*!`3g+o(GV!=brx<tLfj00p7A)2^<)e^3Iic5*Li3l6?E$Tr`?L6
zMG^jY9fVSr<}Yg-8X~~U4Ap{M^ZOV}4RWdr^LCho%mq#M8CR<*4j-{#UZB;hTG|l<
zRTN#m1XS_F_~5b1%JPaOQ#MA|9OOUTH2R<8;A-C9vj+>)dJX|4yL&U-(G(%^v><^{
z<wAi?knufja%kp{fYr@3g-rbJw(I4l{~k8<ErjATbDMV1Vu$G0FXv2+T(J_*PMsyA
zMXuD+=90bABaqUM1vE~!r`O-?->Xsd`EWTBvp`>=|DUTloIeMdYZsD!CJ5gS3g0ZA
zT714R!=_mVSEYw*q2i8CVjwcND~E4@%o^6l>yFoOcaLqE*xlR>KQmSfDhR8$i;MrK
zLCZSE)|QHPvWriVjmMTM@u4AksVF~0)K!Ey+~d6oi{Yb3p6CmEc)1OoCLgJ-H&Gzv
z;q0JF>RX+8LoW+SeJTpZs_#cCs*7a~#sa&k>OPT^LAeOK#9on^by|HZ)(K3AS{R8^
z#J#vJwtsAYug6UO)Z6P@(s7DhgtslxS`GO^si13`*_aBY&R86K)d3F4qWD4#tcE7x
zP|kc1KZ0wt-T1Mpm0|}jSgp=UWmJ<qTn{VcdMe?1zNmDbBP&Y=`=i4Jn}4<!c3<MC
z^@Cr-sO)i+bdR*~jmFcWSt08%==F;p-}6{ux2}D_v3=4~)#h@y*s@d>JhfRk`kDd8
z#EF*-MO8(f)cfw={osJ&^`|5L&nGM=*sR0oB2mFI@aG{`*v=IR5GctJ-q4&LeU--b
z)bw&YNrGl?IHnKT-Rl+g#z{ZpJkLj<Mt}*r#l#wPKBg{0Hemk^ow>-fKaKko`T2E-
z+l-}L?SKI_NnZn@Mj-zV5Bv@;T^M8wD79c<!17K=w2t1#oBnO@Pp0t2AYCYrb`TPU
z*hE3aC1e`q8DtSJKQh(gg1re@cD4wXCkThgr3PfH>QbW&VNA*P#Fteg9oU02_*5#w
zK~J$s4{-sUb)EhU<LJ?~d571rk>q0VvJ9Ka9C|^e_8G$hKb9F8h19bqV90rz18MuI
zX|`X)VC5^@OamqdN|BKuBjyTyEvxQx@5%%|*Xzd~OHPpcp5)wJs*w&Bi1?Eo5Ebsn
z_-B2Oq)N7)w3LokQOf4B5(3M5v}{{k@u|(UF2SWYrD*wAdAx&=7{mq@&t=(vh=i4R
z8wJyWQKNHgj<R5y?>@8CkG%IMbBz2u-|ww{e`%y!U`{s#vXJkn@b!egb(<D`uRqi7
zph<=eB1r}w$5O)}U8cbk{_ta^v*b2Ds}+`dmp))7GM2#qKfmA{56$h)!cSrjcr2Uc
z^`<tcaqki_>H8-$<`+6b^DyNIt8bivhqSF<p`~d7R98a^N~#rwt~YxhZD{a45RU%<
z3L*U-ZT(6T`A;X1|7Rf)J>zPDYxosI%h`Fd0J&}wAiJ=DGWc|&^N2B>UQS@1#$d(H
z;`A&S83)DI9fkOy$>-P8T6!rI)~LZ8IYgyehiM&lLu)Gzz0(p&%DeVrq7nMG3Lfav
zk`z#?wXy1PW;a?%UeFpT7m<)~<zqX#uLCN7-Wr3$2EK<oK^H`J&f@$BTRVXa=Um?5
z@qen=XVwKAYH)3hP(J0b1ro}%X{$*NfQ^Rujr`r39Mwu{P^2BVwhMkS*Yc&zjAE6<
zh9yb)NtCFFZ5p^Vl2TvTxIakW*yN}nVBtvltb2M;aZyEnA5lYKf;Q_h0xu36YV7N7
z1m$}s*vZFczFgF@o@oTCw*;3_{0N-hG^|z0@3vG(@w%tF)dd+0Wzz6&VNRCIb(*Bh
z!VG+F$xaP0b>_--X{}U?B;)-9yY{CJYb55*O>c0hE7+HVP5D3m;vy*3`1Fa|7T!5f
zJYnB>mtzty4zi+0&@E{PA^2izKPs#%ChE?Cy}|A}vLb|!48H?(2xlHm67a;I#8xj!
zZHjjUg}Ur11R=p-1@_R+t_whKexv=zwA-b~w`{N#hhX1o@Y(wSQP}zw^$UC>Eq;IX
zk)>t^8O(jx@6rmteU1mBQn{=Kb3>UhCpL2M8$0;?hYZUqodcZi1i^(BJ1~*22~k1h
z=e=n-zdRBQP=#Z{>^2%-ELdKZR7Qb>)tG~)@h_U3rgpS30)&YFxeHA&q=|Ko9oz9&
z$5!+e^suWdT`g2v5h!5x<7je9hKC9($Xu;C*Tw(&jI+O|sT5;)DH3D?_l}q*d;1jW
zXr#Ut!(%1P&T}hiidN4Rt5VDFbDJ^ouumQ-3_SENF!D=ONsgQ2WG_kh>)KjBD{5-~
zCumhms@M5qIBIcO()KgvjW>=P<Mtbo+@NOZzx*C?&U;z^nWW0g72NQotpptGWELYb
ztv;2^z3jA_`!}fA6m;g6Z$e3wn6c>Fb;%-sSK*dYFXP_<^~Er0Id;_+h{`xt1hi)#
zPg?X&$|57{R@Xj08k9EHkC``k#XHgdT~Jk+r#@Z`aL=>-KPxj6vI3*5wAYAa{MkOP
zt8bq@e(=ATZsa;>H{wqIa<sX<``cWs!Po~3n9)uDOVPP+ia*l&eA;9|2^}gUOiZ<O
zlornAcjmPC-2{VhlLC}KO&kYfTKJT}p58PK2`FS}(9)(Y3x^bkqv%2zp87iJiG-mT
zhw<Qu1@^P3ziPGy@7e3!Ju^B#zHTXutn@$DD1ysx8x$B3gOno^j(9q$JH_lUr<uxQ
z9|sSbp9u-sILZ<&HU$x<8UOXS6&80IuIA}<FrtL5Q4IV%JNuO+wBzgd<}sDMil2%D
z!D{j`=!OLYEFv&aEw{HDAu{t{toJ5mM{qWtxf%8uNB8j?WbkS8=fDs89yvxYO&c}n
zz{=+Qi5u=<8K?_6w>m*vnYZQot^_ZwfIy1weP1j96MtQm3S$24e7jKD#iQJkY1fd$
z>Gg{QpTi>OUkGTFijpiShyBRax_*(3borgkyAap^lRT=Xff_qCJMW!GB3Ci8oqc4B
zz-5izyI^@kOkF0?4zUXRFU0HbsbMD6JVrB1$K|B!g5X!D6Eeta5kyOR{Q&tO^DiS?
z#5h_*XqbiFMnGBVyt$V;O6l>tHV(<%$ZP^`NW#%bb)*M;%x`}%0nZ;={8eBahn~r&
zWppswL^^ixfFpb(<6ODE7#jN2yF35FzIG}G?IB(R8~cy~$_JrX;Jh0OX3xv~WoJ79
zT{-7bswi3KDBs#>ng5MP9O}N}@O9)q`+Ao_@n~t_XQ5Q7ZPi?C)8kk$H~&01TVY?(
zvTptpYX=U1R68>(JR)+r)U{a<rQ2{LPX~;`oUnY2=aruuQzb`X(hM@7)!!eqqBetV
z{glx7oAaMrzUuA978HEts33Gx4ug<<g!-%~a!V~Yl!xQNOMjK`ejt9!_tK1`V_*N4
z3W;5(k1oVDZPO*_Hhw;^n=qjBq$ER~m-3#>rv3`S$h85LR{puNfM*sXSMFa{u-6T8
zL${FYaI}hNs^yjs`bgOiv|$EqJU10xL^QdMzK|WaC$moCuc-kE&D#)>RJT>ZkLHFE
zvYMGKWzsApRi{ARt3=N#^%6$;0QJxXoa)fL=N9*TOADIxI22vP3}f>q@Z0GuhR6_n
zmfF9$?+KP{eGK~m)FhAG{j<#cJ9!SJ{xgXbpz&Gx?&}u&6wwaa_vUbJor4PWV=WJ$
z31N?X);YR#&0KUzRl)X7ZU+dR^~dV8z!f@eg@fHYbQSnlh5ug>EsF0!&C0hxkn$-`
z9C@>?ciS@+S@;6USG5$lsmFG93Zf;)vs&jcViJo$Kk<y~qIuWJm8(w!9g=wrgwNZ5
z%qS!ne`f3tv>OH0uf4Um8{PKiT{l0|i-&jEm4uCigW#?5TrMO2(F%sC-h`3sSDL?T
zaJ5?1(&{xFONIB1V)cLiacV1>Ml(<01QIeRyR}k~vb9Vt^!J&bljes0t$B)3zrRVT
z?@jU?YzAJw{`Ep`lp)0C8)xUY(^jSmIEZ1|GJmK&^#4(4kK|kUP=og7{sB%`oZszI
zxklRj{H@IK+mdlB+;&bPzF4J62>wVO&M<h1=kGkNp5g)d?~+*&14@pa3U;}fiJ9PQ
zreM~fpyDIQ1t}3f2)A@P#U%d2zEC9U<m1-^R?#Q-)0BW?+#BTJld+%YpzK&{`7YDG
zLHI&%%S@s~p3X8UnKZz>qn~Q3;>vrLh49GU)}za!$?age%r+A9pL1v{#dW>+^EtZM
zU1V}#sq_j|5?!wjea^dxiJI-Ts{;Q0;poe6%#3%A#kpopcqj0jUgEF*4XsHGTuwvZ
zxP0O81}JIkdp7e`N3w3TIA9EQX#iVPUh{;P^Bh!#sgJhq&oJz*76D{_yXSR{>{fz4
zFWvoFTj!Uj{RDF7<z-cilUNRBK5wJ^&x+Hyhs;{#a2X}Cd9n8U)w{LfkZ8QPtCPmP
z=MIZYMmk^WobrBxRzvOg<fMx!(WSGvTRS;^%GSI}^R%KYktl-%x}e?~MLzng==b3g
z$RwUeCcS&nRbfz0-ZK{+KJmrKU>iZbG}z6N)rf!i1+1l3wuriuuh0iG4=VLZ@ih!#
zy02P-4%$s#-+LtqMxt`UKJVf*-G^=ZHYV2#Ei{cM4@II!tKD{4=Af|&U;MtLqQ2DN
zinDH4dVIL)zQ;S~OHdW+gd~L&x6DXwUcrzSom_Xl76O#F>I+;}bxg45o!wB^r`VL^
z!Eq5uX-xi*>pkr+O&)pdz^mAK(U$A6pXNUNIzY7n&fEZ(Je_Jr@o#XCu?x}t6bakc
zBdC+k<rmqN@&VU70<HvqDuo@Q`RHx2^KkYm#}{01EMcTH**eVGa&LD5g*O4Ge-5OT
zm8!M|ip}=;6-!Qjh<Kj`Y&SdU52eUZQdQ*Mi~(xT#9lU(L_GeCyMMKe3L1X&LWyIV
z3FbryYgc~g-&1<o1oI=-ewhF5hfy&|&CtBw%xh)Zr>B$m39Hs1W>ozz`E}-M9aTZy
zFv1x8%uJ!QIK?zpoZih=ll+(*?Pm@aN#p;NRd7^6|8EOraI^a4Of7qo@<=UPxA|))
z<N}w4)qbt&r74_|^3jYD!wkWduyGvgn5H?>3l1x^cI7?{!ae)Ij(S3=e4h@?lP(G?
zUJ`ZaTe!{i&u{%<{fhM-yCXx9z}wdpf(BM@k5`mFUHY3%>A~D681*E$0Uu3U0NKDC
ziV9Zg70(t`KRW6u+;s<wjrzz2XuvrbuJqK3pK8~9r-O51+eI6qN+&klNb%z)heZ{K
zZp*fAq4|aTOrnsQHYNPx6}#BT++(Y&JGS*`XGdnW5w5b_tMAg>B>!~-;?uT5fQJ|e
zE6)D$yD$lfj*1eG0+-Q7T?+*l-V*=k|Nb$+BLPi>Kwy2(L}9PeYYP77{{<oul_i2m
zh$Itmne_jk6pwG<w)X$aaWF&>2@ym>1d$LyBt#Gi5kx`+kq|*7L=XuPL_!3S5J4nF
z5D5`PLIjZzK_o;F2@ym>1d$LyBt#Gi5kx`+kq|*7L=XuPL_!3S5J4nF5D5`PLIjZz
zK_o;F2@ym>1d$LyBt#Gi5kx`+kq|*7L=XuPL_!3S5J4nF5D5`PLIjZzK_o;F2@ym>
z1d$LyBt#Gi5kx`+kq|*7L=XuPL_!3S5J4nF5D5`PLIjb3D@utV5+aC%2qGbZNQfX3
zB8Y?tA|ZlEh#(Roh=d3tA%aMVAQB>oga{%bf=GxU5+aC%2qGbZNQfX3B8Y?tA|ZlE
zh#(Roh=d3tA%aMVAQB>oga{%bf=GzGlK(p}E&o43Bw`W}2%l24o{k3fIkt0vQ9^z9
zj_Lyl1PcBW3PF&8f0?;`u!BIZ67H(r*7wQW%%Vs)x6N1~?09c~^mp#fre!h?4Q8=&
zVcoiKKeC<8?(gD%iBaRz<+Rraw-ipaG5Oq8smvt8AH{#vNU13+(FWIWQ(xnc`H;&k
z{61MzS(%ge`-8juwNr<gJ6kI*m~8&!ktWYH_igzdUFW+m>oI+@D_CSNHjrR+n>K8W
z8^(zcQ->?jK8Zu1IKQ#bL2gHhaYI6AtyLj#uC6EuLOG5ON*l()^MC6fMgziM*w?*(
z7n6Jzax#-|z1mD&8MFR`yKc|87LgV1gl{&J;oAGBnEgvWLkHvO=_$0N`s6G3&7of>
zHg+b@_ysMjK0Nz#X=6x`gcDMj*EnuzLOyH%`!pMYqP^||aVmShewv*<osu3`EjjX4
zt^J2^*V<2yD(*J}N;I!D=~Lcq6<KunpDx4-LCBzG$7x}|ww;i=a3#cLb{Qe_*2a{Y
zc3)C)i>cuvkxC^2#!7}b1u|AI>}L+Q*r|%3Q0c6$fjK-0H{_)|Yl5h$w3j7rMB+F8
ztoL&RRGF_WTncoxybCNIUO5qgn>j#=jAxHg+zt0kgND%;WxvK}!&EFV8oOJ#tc{LM
zGcj0DdQKj>({Ugj<elx<JsJOF*<Sjo=ut@5TiNJQvF8zX>xX!`^zpSNoYcKx#nfom
zl$_w<BMSI*N5QYzkO7*+KYJV85anUtC)CLTx@MkUVi^JM%KI~@k>fYM@22K!ajSkj
zJ`K`*$%W=Zo8~gyQqeCku>(5th8xacHr)#)H}qVhs#oIL_2O=1%w^Pm_3NiaJ|Bkg
zYuUNW@=&k8bGSpT+NYQG%Xa_h$xYBz#~k#ErVQa!IYdN<7Dq!V6PiKg#nwEtTJU?6
zw3;U~CMkTGx@k=6R$3aEscf1-R=;DOh`$gEo+cR_XG(e3HqFM~88lQ*chuA}Cz!gf
z!AE%<A6wy>rs=E(S8_mT2+O%Xt~YIpXZYhVYhb0hzV|o#eV_D&3Jm%4v8toO&e3h3
z$K@itFwPNDOL)hvol{E5Icv_-TDvzDwJkD?ULIK*zS}eoq<<BQ-4)AL4pkvxvhIsj
z51E<#RxGLV62&WjZKr3ZI`Rqe-e6O_=Tzs|GIdpRgUQ}2VRZiuH>5rDn%Nhp)L%V`
zrmbo}M=E-+Uw1sY*J1d`+s5EY-;B;%pT_Al1}Lpl2zgTFh%e#yFOLG!Ms;TvD#z2l
z!elfF;^Zy^<;?rq$=Ji@as*0G@-&*>&%LV(!}n^JqEAM}563iLghSmWEwgO!!X~IU
zmVrNFq~|~$C%2y-C|(=X5bRQRJpITsh?NNCxNgI@-DCC4u_Xh1uj=Hc`OOsiwQYg)
zRUDH$jn;yzkj{=SdX$cueY0UZ0~hb-NC%m#TO>2g&c0JvF_i0V{PVh<<I%_W$!P0)
z-)7zhyqM9wczgn0Q>^EsJmyBHc}}&`&fuFA!KNTBib5R2u1>X0xh4AWWsiEZhQ>M6
z)ZIDmYh^HM8kLVG%^{T^RQ<bzR@US@vHt#>J1eZGo7JsrMHr{e%XTj03-N=m9DiOa
zHSalJCZqOZ)a2@&1sX~(X+8dVSaoxg|IR-SHXPH-=KKJ<ID3B`t?Xw0tV|hYbFz26
zcS<aJXM=3-i(FqXct2FCwaQ!If8#@BdVTcuj~NYjUofX9b6%m3VX#8V6y0ZtVkz6w
zD!XT|7JE-r^NpT(t1soNhf1&0-L=yngxw{(CvL52x*P_z{u`1i#2D9pI?@KK{Bnmi
z{jp`Wy6Em2qt<Yf{HRGT##ud$3Tvv{x!SRfJG3_Y(Ik>J{;70mhko6B3F>jVE5@V5
z#*<H9H%H3ng;Cn4N1?B)!flzXGu}DeSAHB^{3$8;nCgJeU7Dc)ai>0?MHAxUfb}Pn
zCG3CEA~&;1xEQ<NR<2O@%Nc2(2)hBj8myT>!dTridr8TdG>-o9tJX;EzQ|S?r5H4w
zLrdqaJVEyBOj_2s;~v5CnUo@_f93NcWt$=l4~+N=6r65S2K_qfKsD9m+-BkHQoK^(
zxA)ramg2n}*sV`wJw{oz;#s|UIgbS;^ylGM73gwPV$ShlBy{GlycV;52kWb5k%tu2
z%rl5ld3}~QK&LkJ4L30icdrIVz9O-#%PZ{elFKs*qFy<ShLUVY3f-96Msi^!j`QYl
zKaa(nX=7BsUyr|Z!Rbbp_Lczpy~V6Ele`gJK3@oDHpH($6MG)5`zGc0g!C5}`=j5f
zA|;ZlM~dh`tJl=H$F$m5y194l4%^M;S3TLO8ydVV;R|^NrS<NW%e+Y@{V_V#xw?Gq
zYZNM3PaK0-LtnFoDNwJ>Y0|ySW2HWHAZQ9pTfAZVN+>dZ<8@De-{hwR;cC<Stiia?
z9h;e9BD6jaBrZ!aWZN&Bzj1u~#3fQ#K7}0J*YVGX<spTswR^_?%rlk)gFcU{*Ydb`
z?{MLYtIWm=Dr>>_JTD)~0uFf#)rSrefs<DmX6ZVEy}5DKh;_4$TnWjIVb&Tmx@AXo
zk<bf2c7#IZs|hAS)^Ei0S1MQd+)?)5ERR)()kQzl)lDc~lg-OLPI|ZM`0<lkaL$!S
zru$#ps{_sDG)%b=ozDIKj4AbZLoL>%@Uu~O92hqb!y-aRyGCggk+W4PWEi`*hd~BY
zkNq8F!cSr1ewMGpK0QdWu)TJ3^j83r5+Cijiud*>gI?FwYRNq>m)Up}$qc+n?36B4
ze&T+vU~44A@69_x>rdTBOs>Mq)eX#nk4GQnTTdX5*XftNOD`%NoY!htnzxyr@e83u
z!sW}f_nXW!<`kv&<?Wk#zXt!Vki4+|gf^=?ZaBk1OahaH39E~rdfML>A)KiD^hi1f
z#%;_5Z+}0f!?>Sx6`u+VGXK7Zp1%B+=9hZ6y#Mx216j{}@e1-%Zt1CS%MJW<gy88?
z?xB5sL`1XM4lXO+m>DXmKh1fl390z~AzjvKpmZwmQDdaxX7;kSs5NxvoMppxYRXlf
z+{Ea9*gvMefNSINTjBft$Qvytgr9=iPuK4$NQkF3QHG~j?)s6MSc@GV*&m1hkqAtU
zMdk}_^xH`X=}($yjh5kcO^PcV3n`1nZ&3*4Kgrrk`20%l=Af!aRPGmtWsTN@ltxLZ
z8qsR(9fJzr@nTBKK+0$E)vVWE%>0Yx5h}SDj^8H88tnQzIg{OHgPEOx<q&CBvU2GR
z;iMF+xd%GVew3cu+ybU#mAcMBu+~uCD)u#rFSqWoUfTcZBj!HsU;7T<VkemN4(W4*
z8P>CU@;5^=G2p!kT}4{SP8}}bQI0&JMQq4OyU?BY9s@OhG?{n(?CbAKx9Ges9C1C}
z#mUO!8!~7{RvA~a|D<f!8<4mTS~Od3+sf$w3OY5r`<7$%;@IBv(&>iv<R4yq*6DA9
z-V2#Mrd9m-my!SZf%F&88~7(&zOj|B8*cM|%rG?7CZxTpZ<70D6}bC`5--(&-b|S@
zn7vm-zeD!#P5x#jtqB4vWoebt>V3#AIAS(c#O~C*L(>9{9>pE|?u6XVslJg_!kR3R
zz|tm<D36VkZ(5;vf^Q;ot<i3hdwC~7C)BX_j_@s5xcs{)LR9kcw7#8>4ynSjW}j*B
z%mG5%Lbm3U$B*@z2VEv89S=?U=tF-S1k;FzI_Y-va!|o4_29Z<2~Ss@qZNhU)V=<1
z5~VNB3ALFX@hCI3MhH{6I(s4vbfF=GoSHo^Prp3c*gynSieIM9i?Dn?%<f>qR#~<B
zsmt-JXVQf~3NVgO<T-eYgoVv+Cbl0nIDDL?NkMx{#0z+!4$MkLdQ<Sdy2dE|0W;(7
zhlXNHRnFwfG=&;SAbjxZ--n65AqsZ}u?#+$t!(|ntAvC>)zj&m7l=3H{^FCCR6KFA
zlqhQR7C!0E-ZRpzbrvt(Zy17KsJmF_liWJ~!%^K^fG^k`F8_oQ8eG)aVZ;r;$Ma~4
z{2Rvm9%B%Lp`a%Ps;{adQCsKDLrdE~1Q*)E06JRk5XB~uwv8nc%Al|qT8D<+hJ2{M
zek&<~p-`KWE!uUz;IDG=KuL0QbaP!GcbU&R6Xb1YM%F^{_0yEww;X8Q@a$e(HjUaS
z`I=F$g#ixhA`ycJ(UpHap}pBmabJgFtkgG>V)~3;-k5pWy3E&3Rm24bB8P*mkC{(V
zxAkL;9xYuI;@d0?O20U=thoImK9`oE@i3SKo|UH7uHHIr-+-}S=G!;i{k*U>;zCMI
z4|&`Cvz(;o0lxZMoz_eFRR%glyxWd$t4u3z1*YO^A9E&?woh!BINOIDw~0hPsL4#u
z_@AV8g~LHTXyv<~Xl6;q3bG^r2)B4aRd{>rMs@Z7)6QE4wH3IHo=FH0oB&0O1$TFM
zcWZGeP@I<H7Tk(ciWMpD?k+7Y#flUNPK$eSzxluS?#w&0cXnoH_rvZ?Kc1QANS^cf
z`Q-sisEk`%Xs|r4z0Ti>M^o%-4q1CGT^4JJ&<ddz9E<V)yarux2iEQOyxl*t?s*ph
zd+dP;wX(n_W$z=Tu-52~jPw`pCg_F9Ntt#YM#hM)-RN7JMa65;t)E-ApdJ2vJ5O8i
z5@gBecKC}@q4Hfj>@kKGHfarV=zUH(+gQgq(kcG^RL)D@QojT|yJ0~dHlMz69G^hx
zykM2L@Hz`He{R<8iM2ab8hxTBcVm*bsp7yIbZikW<mNUh8C-F|8m=%Iwd4T&$UPYO
z62d#S6<0rP?eXxJ>o5;fj5DtU6Rt5gYw~32&_ncoSOJ`+&V4AfK0ZegG$hp)@_KZP
zz@1x-MtxZ7P|4JCXEE~1*`Z?CqMF|f;Otkka!wI;lM24q@zp9iAaN!bS`!EUHYj@7
zx~B?Z=}+STVdi}B49Nr&KOQXp1(RTUn+osP4S$wZ1NSldUX)n4fA3O<wlLRLM2a)v
z3>`mkfD*+b#w)b$#!xGKq(%2ZbeQ5~?(p<%3h_gsl9#n=)q#5pb#hrMKadyru<+L=
zt?CEP04@)a1OJC6>IsHJA*FBL^ejFwZcP}7PwNhd_u*~v-RGpsY!x-sz8-+tpd6m`
z*$1@K#t+HTe`?hH*SYR9%@JC2$(PwEn_v1<TDgT8VcILlcwJ>`TWehtE@DJp>Pm&h
zNVBA{VyI^7b^7q`D@~A$d_J_zLCSueYZczKYI;%%W|W~$Xob|7bQ8qR({BY+l2P9&
z%=1vjrDFkdmP5IxNjv16%q#oQUuopycCF;axsyDSf4I!Xf`M$s1l{WWP0C-p_$*xb
zzqK0nWS4~k+F;u1FKt=@w`Z6EFH9r0q-hS(JL{j(Y0uFe!PYqLSvH>YuOb><er(mr
ziBc6{0G>nVKT%VPaYHt^*rsf(nRUg+2P_hD)}^vOTvmR_gmFU?iPqmo^jdhnTuMP2
zJbndWp8aX+u{`E<0B7i2098E}q90>~)wgggWw;&mWT#CGl%~Ga4IdBQSrap<zafth
zbo)FynTu3^{3L3h-FK2!Ep<xqzt0rzxzKbBO(QD$7muX`mbch+uUQ5N^6^;gd!_3{
z-!efD9x`wG|L7l~(?;n(OU4IeM_4Qe7HN+JhbX&oLwr*>28S76pKV?}LW@ngTOcR2
zn?Z*|cg8Ar62p^WGvT~PV>G-V%jrDdJxhlQ9}c)!+Gp61!4B!D@|{9g-EdQCc+|H{
zV&UnJxb4l4d=(IeUjasb^iTVBHWlg07;uea&&A8VoC`AR2TBxc=D!5@O%}kh<>OUl
zyBtb)N2t%{=As#xRW7)+6`}rWSr!?H!=D?@%4-6gJ8GBj19~jYP){Br-=ep{K-1Gf
znts*9*|l{Tq;WeubB<MXyeOMZ)Fq@{1wWP=Bo2}sX;YBS9DJBws)oA%7WG~kTY*)$
zl*zbjwb$x86Zk^|4>q^uvU;~?c(rcvqTQN#HgJ!&0r~TKy?z)X&6#K&`plav1R0$^
zXI@qkSFl^|{S>soJ8|iOhgDU}_}`LyDK`^1AOp^b^U5p7Grgf}&n_H=1oP!mN)~Fm
z+|RL#?%5isth0eH*w%Vt%BSRLqxhL%TmW}$g_isDg?oCQrygf!0w!pN;qtK9;oR1B
zjqJFebUMN@6<<s0@Cv)B*;OSP`BViQ;J%W(J&r_P_i_;47gaDao?WW?H_ISuS((>N
z#rI;f&$hkViZ}NpnF-cSVkFiLugarZpn&WdgKVnE7D*R;x5U(DQo@`_>hgz2ocso<
z{J;`W|DGhxqnxBg*C&|WnE{py10bOwdgUGk&B6-*c+ZCm_(b&S((C>M;@$f33oy3g
zCq#ru?Bl1ZoXc#>>ba}h<qp1sq`iV_FyM&CdimnF#uez+5p`vH0k*afpwW(HXZ|U7
zJT$>@h(4<jzI*p@>i+#(AXluQMf0Q=(v1`Q)Fp-92{{GEgO2x=<&rHu^VWi%67=BG
zhBW&w_<xlobqX6!T34rjSw3xwDGlJ3n<I1q&Ii6mdzMGpmXA3g>H~4P<i4OMMg6N7
z;qlu%qoC39j}-N&{i??k#5}8fJUo9JljIyBE^Gk7cZ1^t1rl`o{O2Db0rEP3=8`H3
zO_!qvT5lX_|9pDm-arX8#?LWaMxO_ADpqu8Ni;PB=5zSlgv6|jpVZf$N+E<UZp;Kr
z$5IJf$lJmCQDsUipay%mks8HS-u<A}^rjXGGB4%$&xc5td}-&?@MF|`;(aYec)6Dl
zkyUMnR%!8rT?Fgp7O8hB*eVgkD)tD8Jr!1s5M%zGt9u9*l?AN5Lib7_8J!}D@%<$8
zO-IZR<2ugbF(|lka4N_^n+jF^COcQQC(8U7Z-Xb!*Ua0_|4+r;jNC8;K6XEPvR?Fk
zj^*SKtza^!MwV|X=+FyM3zdIOglwxqZj==EPadihKexY21N4z$IE!kt+SUSX3U&1z
zDU1q`s^@t-J~mu^b;XhhY6vPwbw8pu8u9A|q@r)zUp~iWNMf9NgLIA5g?6Rvn@Xay
zZnWmO0_DlA9}g<*#7_x|?nK<c;fu0aSl{!qqe34W%-_Av4gikNbf|q_b1Um#w#o7Y
z<$rc%-ne><@F{*s7)GjBif;1rqR{ddmWkCV+Q`9p>(;V~+At;{$8l&eH}vIo6YO4J
zN8}R)hh51-tjnvjS@qCD`1d|zX*P)AmDN(pb8>RmF^bmQ1Y&@2By3SIo8gfNn5a0X
z9d2Q~tmH0)!W&Ww5Hx8Nt4q1`SUKYPk<}r#_aArqjoMct)VO<vU=Jb~)newVCc=Q8
z_&<3eZ2>mU+$G<qA2$xU&JKbPPX4mgva|nFiPSPX7%)Dt_RE5zN~%2ik(5#{SsGD0
z=F*b|LLG;w>nPA<zgq-3NR9Pfr5Zl=Z*}Rti;f4()7Pxrdkpe&8H95bP{gWN9?6Yw
zQLi&!!?dOK^g?B_xlj)Tquq)|$4^VTUWP}10L&Mv*jS#)S?<3LJ5QMG0+(>y`#MOa
zBtP+-CMswNyy2NtyMw+_Y3$+C;iY!F&z4VofdL3GD$qdY(|tCa4SP94;PxLA?5n#8
zU@*^QIi01TBm*h3vp%5*w(8oo&9`|+bJi0AC=d`f2baeh)CaP#>xlH&zV}TQ!wUfd
z7)oH(TnPWIputp7>S%z+oPnGe`8{qjLplgBXFRI@vC7S9%<0*+G@DrjqN78L)aO~m
zQd)kmMhB0#qvFfsyzKUvV_hZES|cTAR6qg*n?&!|JO}(yJOoe33@lpQq4i>ZuD0(;
zIbTO;r1of#l=dV(a89DJ7g&oB95M#1MfV-u@63nD*gf(lQ#sWXC~xauIfw)a_R-U<
zW}E^46SR7~osWC+1nGYX!Y)CUjrVGIr6r75Ld+$#WL{^^kp;>$ho#-qK~tAbh2l8h
z{KC#fIW4&l(I=-dw>oSss56~kbsfSX@Zl6L*F5Dcr5@SvV4mm(908)t<V!i3$On(F
zd1x7BZscpF4}A)-K>v;Qbt!(q$xCT44ZzlmnkDV61z;Zsjdm3owHn6e+KL|b3V3lc
zI_aL?H?1BEy9HK$LRw51q!0U+Pm7XY!{a}hQnubzE;)Z}&PUv(hg^}HB8kbH(voul
zu8MHWA=}q=YCUjNY(qX)pU%!0_VIL`q+FjjcI)?F44{-tC+^E{y?rZ}yND8Ce-kxO
ziY0#Yv3mJ`-h^kT=k3{<>4<qb<ciEOp++_cF+qO<o!F7{d+K<@X%X}MINX?p>z?Ow
zmjLfF_@+Ee15)pT4;04T9ZfJZZQx}3nuxR6i8=chGo;Caiuc$J9AX^WT!PZxu(}HS
z>WzC$dE-0%J6;$DXiP$;Iy>UA9}pk;S!?Ev;)k{!j(ZhEtyNmQET%bX0W0Uhd4v?g
zH9b}+4;ecb4_*`|K%}3Y2YLNS#r#!_dCw+ydI010=<O|fAjk8)beOF{NsE^}sL$|p
znrNxcHYRc?f&$A@{(Q*Jn?!V^k@n^-YY*|=e(RidWjLJk$x(CQZ5wJde}Q|C3+(;L
zus^QZa#Mi{g_G~}`28rXx+o<&o#avIdn#0PuDs)?3`W#`f1{i0scNWsXQl5HsON2W
z-EJ5`?kNv&q!-{m*Q@i)l<9idsgc!PE`8R9b(3p*{pJ!yz4j=Ky5!;-g#(9wBN{Lh
zZNqHs8Z_B-jTz=M$B(QDJgMJ0_spj>S@69HkWpPxUSr+|^f#=;o{BqpB=L48h7-Bc
zLxCA6X(30CyCwb{E;!65R2JY7hh7Y1wd!!M@n!cqu@!es11EYOynZy(KVVax$cu;u
zj6(guc779EozWtNeRs}K%hfHlsi3i8Z?wj53q<^lcUMoZ@cRL7k(?|4RUQ#Ig(LNa
zLN3oDlF}XDKgY5W7Teuqp+o#=9J+cG=d;@mK=upY9KUj?IPL%9mWyYF0X(g*Sflc&
zU*hcqe`b%jp5m~ib?LoH69RvDjldmqzzUvBG`6!UlyJdf8)v2iO#(E@m$GL?&Nzwc
z^}bxbP!VqX5C*{H1RGY|JqNklXxZJxSq+mJ$OFjX%j<d-`xEtWi}5qkBGyuP#Fku%
zw;+JOx+Bp}oV#7>?zekkoFEK<lYg>cl%o=k$M-Y9cqsqoU{nd&@FaTp3WRCYZqbd*
z2Iit>3vu)moc))LOMf~cr^ooZ%DZEL$c-k4Hz?#=$mj1~XTtxA!u=6iP?F{^tC}YF
zi*<7Ek>4IXQ^eMnq-fW=vEQ}Ff0D+K=CISIHoC-!h47=U(nhNb9a;-Z<uj>}^pbr<
z7T`1>ZFF?WhNcN+2B|6;dxupEs$2-Y0@ygBmu`~pCg;^JA#dB3FD1yL0BH;Tp9w!c
zk!3t8iv0-U!<Gtwz8J_ikB0EaHON2~@%T~)Ce)q&cE0(aW+^f-S0gDC_DB_8JnqnB
z8G(lxFl`$LN4t=g&nK(v{QZ$Xg#Ec?D*7F7CvG^UVJ8iU8=X`eHEyLqrMrK_=J~}{
zkhHq=2w@1n`CBjTGQ7)Qz_iE+(CVT<y_6R+mC1lDan*6V?l<N4<Sfq{p1@Q%7T~p*
zK3yEuf`He`Wz=(jrlD|>3+R%j1w!hXm-=BiL^}T9dOkMIs%T{*{EXwNY2h@ep9Fa4
zM4n%a$Rv)2%p^*k!Ro$*`%gvTN<opQL?TbgX=vJ>jpSV!Q&%Z{Ff?199>dpe6{B>Q
zhbw^h1{cq5EGrdH?GSBDBwq6WIRWRSFV<J}C&OsKUQ?6BtPgAwtL)1&Xp%w*0>k<C
zJ4=|`ZsvT0$Uz1Iigey@6uUxvzc~<{t^#@2XX#j!(48}Rn%x`2Xo!Bilp}96DO%7n
z>OLpWO%4SNV31<wfB8L<mlIgG(}oq?2qg*$@@~W@V25cFnup+hDNLIbn(8Q!uu__-
zi3aEckzaq-a=jhaJRb}Gc8uR?5dw*!Wx(DmBe2~Usc%*r{dG2u_VR#={C6uO1~dWi
z%#QuNhp=myG+@l8ECQPp25S7xc@JF|fjPPVT&t<Cqx+AzT?o3Snv-f^QiuVf@zx<@
zQA-<))ZS?1@l!2?f&O~@oz{_%)$q&_(y3)-#{4NmIIT;-BPdsB8*%Wr3Vn}oWV^*x
zAb#Fj`wWjPl7%r3M;g2){2nK#A)2V#YT&!y7P7J>zz6yhtwqCqFx10zH19O(3*3&#
zm+tlFc|1Wdz;J<B`wj=qty*9evaDyK0iDT%16UoTxXG?XKB^*3{kuIKGSH*7hkPjI
zn`Rh&F<BSUyKtfe>M2m}^}%Rs%dU|Y{#JzU??$<Td~u&bk=bVrNUsmOpknMY?z{^$
zu|Lz;U?uv`M<E=PCqWT&KjwoBQ4A=&FiBv%6CV92#8=#Px$0L!7CZD3+|`sfz)4?~
zo$m5H7hCMJrYzVJP2AmDOZR6Ksqmu3wUh6iR92-nHjcuGgOq!6wA=C5lGP|mJ>;;7
zI}AqLo1D2)llk5zEyo#0#)x)RyNIG53dAjXNE<kgjhQ;+kJg=k<4Fz!02w8_ty##v
zk~8M4<y~TZc+rXJd-o8-#BN)iC)8$ZG!ONJ!2nd3mKMdGt0m7Kt2`ZgS(zzflWdqb
zqNOVuyTPG%4<Guae#YE)TmM~nE)NjLM5!ECWxntpomp*YvS`*`QxlR_YvP0Lm_m^Q
z0_iTT)Smj_lkza6O_fIjd}aeJNsm!ZRL$bYj9&XNLHt2AvXpilTTdnsXO@WL_lMLs
zzQ|X^3j+ZDmR9v>vv}5{dCuCM&02>JNBc`am3^>6Dd|85T=y<qWdmbO%e_JrNd2oH
zpsuYI$K8G4m8>GOA0OMQ{L(dKQ0CDE1_@gDlHUHh`E4Q;fm9fwKX7MP;*<-}<!S7h
zS2i6I3EM2_wfUR4+Q+=iB4{zj^b5r8c_YF^KJo&^^1E8ao&2ZFNLU<VSq;7nq8?J>
z-_7nokIKUm`z(xa0$c+!(|rm+hdkY6%m#ke)CO<0))pw+uH#{&;H6j5;e}J`nMPLw
zhzM(6VCYg$H5y#Sh|0(%M;tmb>#iL4D#_t-c6nYU*U`md)e`|8=VOT)Pk}JwYPN2z
zI|5RSrtAX9$LSj9l!D{E!%u$f2N@gk?5H%o{12t_=e_)eU-u++hWUtI4vnYL{DpA`
z_CDFs=^$tXEvgy3K<?Li_TxrHoK}_zvw^VpQUu)M(4E8<h`w`A(k9q#$5^t919?Hk
z18{zA>v660xe>Wb$B7Vyi#0Pr(+%j9>*c19uA*~~u|^dbj&7JU5c}(OO=E|aSl^#C
z%D5T`G9TmP_Sd-{P%gCy9Yk*^JA>g|p*sA2D>!Rf4}z2RV^Tivg+ps(L#BhWh*m#t
z4kQl7GxrQB0vfivtOba=Erc36w9+tgX%1quDwA4Q^L8=`Mm^PBS0tf!{BIbEK_~Y}
zO2OqF88z5lbFlJGo-9~r()9q!LsYJRwGLzJDU@ozX{C*T4JiQ9IbWRk!Td_?RNb8<
zf(Dt~UHhOR#kmE_q{GoD4pNNwKWA<hhql;EMa=<Ur2@yTlWzUdG-JcZj7Y%>G&qw}
z?p@&fCh8C-8Na|M4ioQ|qveRgpFcsCc$d@N-+LJqf}t$gwUZ~B_+G6m+Vro_P`}_g
zsV~zBTC7k11ZiI%{Lr#D{K!3h|APH~?5nz5@)yK+g88w!8`xSxPuf5b^V!!&95JP=
zhlGKHcU6EB073Z77xlKu=9}2r(Wm)Qe&kDZ7nBz|1zY8JB%((6`w>J@xsHorG*8uo
zEUhnsEz7PVjF*`z{v$c#ESLNi;TC1M<ws7GU0XJp45~XOWIE5n_&rEd1*z`Pni0t=
zP$rb`YrTQF%diESOe7RAQC#iGcE2kEoL_PJrh-<!S{WgYQA3aj!|;lSNTQ}{iSisW
zdTa6WH4!BfAQi=)Q;qS{p5zbf?90lC{DN<wNXN1Q<@Sz=jN(zx<yP0=7AP%Nd|@HD
zkLrMl;NeM+uUlm*NC5vi2K%e+!WEk#WG5}fT72DurpV48oj?GO3Go<5yFSi2b4x*v
zDsv0I4JeYv`UqNtlcY7cnx4cL{EUoZo6#7C^rZve701_HL4TqmCFw$Tr6rJFx<c*D
z`h`Mo>$*@Q_C;B00u;_ye=E!EmuT19p*0U}X6b>9&T0?c#c8@oeKFB!5uB{<JR8F`
z$)KR51qAGlJj&|^zTg|*5zemVJ~4|3;0lq{=K$GebGhRVQS?X&@GoWMN3>5uK}q`>
z55;y}2L4Y}4)-{p*+GZ}QSoeue#M=z)-Rj72JhbgM1`yt68J&iNGi61Q^xCh_Im;R
zCthCPNLUA^9JIFs4|i~l!oR2ecZ6Xi`;4Xu764D0A+_9_cl`p{lz?QMc>WWll>~?|
zG6EbG+N3__-CI=-K65OsMztIfzB0uLNFtM%x)X}YZ_Z!>DR)X`2ZbX0S77JMmqHwm
zzs67TKR<IUazTYlwZJ|||3!I^TYf}nYeyPe#(-VacEF%rb0lYK9oG9Pmzx?-#JWHg
zVF<uf)2%g-KenFOQuBK<T%(9}|DsJ_w@N*ft^Q)QD1Puu9o@4EI;a=G1DT*rwDn`u
z_}6U_nfIxDRL}e~f5}K3DN82;^xyhDvB0X1dwqAx>ud-sN)N$s;0V**sv|y<qxq)&
zIBB5>;3&;o)|EtmHb0g4dhotxKA@Szg$Zyygdw3?&Zqp_$g8!sXgLZUr6RANm_$wK
zT<G?f%L=uZvaCy!+1Wa<?B{*vL#*GT*Td)OwHaY9(iI7rhFv9ma6w>_x&Hs}(5)vb
z0O09~uc)(jDm5tuNyGtE6g1^)WGzD-Y`BI0@pJ#*BJ%$6bN~3cfBf7(e(oPX_m7|Z
z$It!a=l=0?|M<Co{M<i&?jJw*kDvR;&;8@){_%7F__=@l+&_NqA3yhxpZmwp{p08U
z@pJ$9xqtlJKYs2XKlhKH`^V4y<LCbIbN~3cfBf7(e(oPX_y5*1wf{?gP6z;iZv3D3
z&jH{_%ntrv`{xEFt$rYd3jUA%b6D>wH$8`+wmaR95ntm%bk#XV2Tu{g6{>0aI@Aty
zA5?e4RP)n_%FEN5c<V7(a9COzI~bc7Wa6FCDb%g4Q>FDvnbV94idi^9!lRxY|1ht^
z{yJ3K?A<-lc{M)jU2$W#b#!sDyzGB9zHhh1L`#3Xl*xDY&^s*R(ZdJgNoFLL9*RN5
ze`5`l&v^lWGW|b1R6%p;<6^_c??|^F2fhqx=@UbI4lVdOhyJzVNrD)zhP~Wv{l>rL
zK~?i-v+m!Kls<!$dUkYUknF&W91XV|#GNPe8W&}iv3ShE8psb^ZQW`}8FJ$uItHEV
zVDv<ik%Y;Az3(gwLI7#N{oH@7tVpHGZ8h29XuJEex1v=qf2f?6GN=ftuE~KN`NV|z
zKIGMnhg|qZG=!0{=VNS8?gl*d8xMa0l@UIQ>+1dZ6{HTiRSP?f!Zy{E-{Ok|OB)2T
zefw&}O(&!Jq1NGc=!%aITd^LnXIWL**qEkXLpM1#`mS7G;{A_!Djyr8{?QRev_y>W
zi-<EN&53u;?C_VuzH_!NlyRJQ9xCSy7*)K~m40pV`I7>7HxOGYsnqnai3u-Lb~xEu
zZMCtvtY2#XJ2p6KO0~+e^F6l>=8Wt8Z;TC>G$|gD#nXC#BX_&)g_3H{eI)(8V3<mC
z;5UjMOpHmJ?<mV|qn?)RaMpAGxyM}1CIjB;WZh<Q<Kn~W6*o=IrH?;1IT7eKHLE_H
zfFs>?yO07Wf}ITI91eC>(;U9nKB~qj28QnFQ-8sco0~5_7xu39Nq(a-MXn_A4&4=X
zn7F78J*$gugM@kO_G~Ll^k!dCRz#Y0v4@pA``2ff=O`D8(o?9#e9<LdvQqANfzM&L
z5i#@{g_)`UCAV%UbI99XUe6z*eEcw0d~TT`8+IO5d3#8JB08SzumkY7IvOd6Tl3~|
zD!`@o%b#=uY6jIqG<o|<0m*~X4DG@X_Y+Me!C8MF<Sy=A$2;}a^6rdUNQQk_>>G{f
z`+ndMvw`bOdDD~Eeq=ac0I|rv@g$)o)kS_Ln-D35I=45Ju-PP_F@P`$#986f07{fI
zD>xd#Bs#y`^D&%fXbyMl))GQyV>2bQMtY3xN}-ajiMJdPo0(-o{@coPZa@Cq<(6Ny
zk}R>VwzCU0mmTsF>{iCS7Kj#=>C)vj!?0vQaRIAhmOiCZRHR$E(}TG`)V>JR+2-EI
zt4gSzg@7yHlm(axZnyD(@&MDcu&ytC6uKWD+Gi!0cGBCor62!}M0|-@K$p43l9M%S
z`+`{AdyuU*?9KkA^h@V)N58vQ;@EtwWU3|Lx)J}np}%dw`2Y-^b$o@Z0~j)tDk?5|
z17Ag7zX%^nEH3Cp_<w%d!RgF5cpC3o-RPdHMHxa#NjA8ev0h$%d5v+RGj%gDb#wF(
zfB)E}kdOJC{O=doPip8-Pu<XSGICM%#P3Ag?~F>lK%NAX4*0=n-)HVBYfbM|c@j&f
zRc<g{4kR|8zuYr!OriaSl4g+HP3#na4ioIVe~q~;<#yfL{8(T2X7=q!k+<xcqSFic
z9Xg9yZY?bmL**PS@Dam6B7eEWtf078k<Xi9DL_+yk{y#{_1)l&>#7MEuj^-x?qPC?
z;rHHVUEZ_J`R9Wvrx*_L@f?gH4$pZq_KCkc*C?(Of`S+^dK0lZ>q{ER<5KZ|cg5j@
zP)WZYF4U|jZF}UB@fq-D<MqfjG?~LK2n|UbN7iWGh_*JZY~a(IF-*j0Q4D`!_)0cC
zTt`*b48TDkM0qGInz77B)HNkVR;Nd^D$*YJ`Xvd9xgZ-4p;aWb)$y~VUxo9t)fD3U
z2Eo7Ew4dyk-%0z}wKCERyHfYr1KK|vN%8WodW>aOrmy(C?wxsm0X}kafC{_DEqvRy
z>>X;23W}$h!2hEH%&l9@9pC`Tlr)as@phc{YJ4iq4SRdDVpMR32J4#cfLT`BBog?<
zme}0?QHO$a!wEvfO$5lpA@=LTqe{wLhpz=;#@;QCf~ya!L$@TTr$5sPLzeH_<&z3u
zp=MR!(%SQLL&W8iO4SR5!=&dGQGTIbC+k0ITQu4`GMkAswqJ?Bp9}%R5u3&W{(;B!
zgYVf73oJZjV+9hbpW`s*u!NM*WdT=RMON^-l8F)KLgpC)IkmYfGY>_t9$Z0aCN}hz
z&ms(U;5?O^+i!0up&2V7<QR%9C&~G+F(+Akx6=41&9*lyk*JoEKb*CW2`$@WqN7+w
zVeX^62P;zB*&z-iFm8azYhNsxMDSLb+WRMEhui6zPacv|p98sh6(?L%-l`28P!~K4
zIb2T6#1eNDZV$^L;#NtL151*;hvY<1!}Tyu3`edKJ3Wtl-ClkcKX0-+NE*Gu+CPm{
z1AlN`h0Ks!_LM0dM_bZo?82)IMt`dm-U$dzEY9Q#Orw6s#S0`HePV~`5miJK9A0MP
z7}B$)diNBVSK#+AR0xC&t6v3C(R80DEu1ci2Tx}c?`BgIDdIc?aeG1Xi7=t_WL+h_
z7G8H*@n>SaAM50~RW_G}%yl%+baC0K#{b}T|GpG3U1;`m=m{22rCOAIzYI#3MIj6c
zd?{d=@Inu6!sR=HB{zmSkYz3_BK8Gq#KHXD(eLfwH(WJ;5G}U1Bgx6{8rovu$4ueP
zE4Yf_mPPx^$<y1V9z~kFhX#@AvgE!Fy}9fX*oqY9H<$CoDD>s-(1^;rU%R<-_MT>U
zm^@D=q54hB7SJ?rJHew%0a@F+oi2rfAM`WjH@l691rk%K_W1n>EX3ajrp>f2tZ@4X
z=Hd0Fo>6T5w!nz5%g7svP3Yt{u5fU-w^C&!T>Wl)<#Ja$Uf)?tCSGou+*x}?%73HK
z@AEy#{;(UI<I`(5@u1Nbh+~x?IQXnE-bu)@#`@2S=|sQKvZxJ*IGb6D0R`bX4(L8M
zRePfv!n)Lx(%QYc-c@e7^r_rZbPTIo`ZU?k>xw_DwAqO_`wn-nqa~MSm538JnWXR8
z>7&jSNsx#6ito=Nq3vht-cU}^*Mx(u)>Y5xabq9zt}>3*r!(-+!_djY-5-U%LwC!4
z7$n)|A;$h`LL#Fmkp?qBpZ2mJfk(#16c!am#e$SRW~w$QA?T(gArj5Zt!`6KD~WG^
z@vuZy-*>e4n^d{qMWVj1j@w^C%(C}<;QA5Rd}XWLBL`pg)BtOA9ePkS5NeM9pni?d
zHio5DqNUaSCn8>;c6Tm9y}@jm3-I+L<Q~gg-ty{E=XklN-JPJ+x9Uw|zV*6yTKHx4
z&C#12ydDy6b+@BHRqj=VH9d`(zL=|zRhIABP9GUrYEc;v+oa_R0Th-8njdaEyBkkr
z14!Tt`YeTa7QlOnkO@ILkp0D&ar9+Hrl7_QbyV5>a^vdcW?|YDM`!`0D7@S^wRRVs
z3gs0EG?70?TX*-;7ymeq%WyOf9xB2+_Q}{4&w493b@cjIXut$|5F(ByP9YeEC*e_L
zPtw?>l`;0B7E(bHRMSK0M#TVHcGlI+?LU}?Q~pJLGWwNqpPXoyj?om&a~SIN_hiS5
z@iCJ7&cm!7d^zA25aeKPZu6zndGXJvo?gVFkTUDo{z=(H2`i}9I&e0(Q17M72@tRd
zE)aHdd})yNvA5ColW+uItaG)7oiFtBlH>p$?{LS{gcjjMBW)R$k?aj&YUcS&pydHU
zXj7(w<(E6#i=*760%u-GMuh~9{=tz5w#K50K&;WV0yEfB)*J7=En{S7hA-C#LRD5=
z_oW_dpQWA!?P=-tfoh6pvt9gf>df-!MvHJo0OPsVF&@S3yu{EwicY4sZswNf_%c5i
z7ma@ul*H;oTSXQ9A<>(3AG5u$HZn$Ocpm`j|EcQKy05*5d{iNvOldxuTbrmOZ$E{k
z6t3(>P=^hpzISoCc}$gABohT@uz$mQJ`p|j$+9cI!a_%Q;~_rZ*$Z>Ypo@~g5Ut;%
z{Aa&?SPRtZ863k!)JH$RDI~*!F>k7CNpZ~l%dQ`xmqT|dhG5H2lv2jf7Cb9rKn|~f
zpM!+MHA_5xwnT*jBFN9=WlWVPTmV;@JDAJi{DJ-T-E&zEKq@laOF8*W<7R=o<vOii
zv|^HC7Qlj{%8Cx(`g?2fg_{E+YQ`zbaDqeCGMH_8(O=U(OX{cjRJAOjF2-jewsU)w
zYX@ltT#ws|B&%1W*S&AV?ii|(UxLB3J){W33nHJ4_zO?CWES-`%22iU+IH{&_w`MK
zTTO6Ub!d^X99Z5^2mQ4;=$i}HnOhzPqQp^_4RF-q%EDX^%vUg!Gr^K}Y*fgPU5Z4m
zPB_fQpD3BY?ImsEXoeh;$f?F0RF7V_^*_5<G<d^=h9Hxb{oti{8iJqh<1NYgWlhhN
zpXzgz6f@XGk3&`jM09NCSxtYB6E;c~jJRkNvMx)ugvyzY!Xa)ES~Bc0*Qdz6xWu0B
zsgoG+&LsMxrz~kUr=a#iU2q&FG`#YGO|=7?K9l<M$HCv1285!(o$~QSl{G%>tc4aw
zD7)3g0E7BIaPtx)h`I5qZ&7BEm!g26Z?|ULOOEjvaKh#h)H)0W0-NZ?VeXDMAtx0f
zr%a*EcCNAv@Q9c{rP6z0qZc|1AP;`X6dzImD4wN0QjJA@QBoF`jWj{RtAL%iuqyPj
z?gBgkQJAuHHF_v<$OSI^NkU@JOb1;EBLXmbscEOz8ZxBx{^t6fSAApyg!q;#G<I2n
z8tyB0h*i31q`?f%cX>I>B9muh$kTJved-~f6pl%x)A<CWsgnu4`h$tS^7pu64B7^`
zbyY-2J5pkFbnM~@B78|4>A4jqw-O;ED!I~JZ`K#hNsy}QLv_E%+7FJ4c1=FeWuFky
z7$KG!H-QRo8~BcdQjZ>z`AlT9`O4*kNIU$$SSPii<QE@oZ5xlZ&pT)EOMm2L#==w3
zuGzejGX8#DKw@-~B8{5l<kT61k@v1=?3lF$!fX>OJrHLairMOxLECD6?lV#6Z+{il
z2iBf%+fpUi@R|>6V)|}=S$fn(6oOc$yN<%r)OwunZoE~Z0j+UDk_q!{*XFvPbXz$>
za~MFa1gfkX56AVBR7KklY<p{rArNV`s@u9(w`_Io=2t*_(Qj6w1w#=6A-7FL-;V<V
zy)6>e(r*)vL2DOtuU-`ON{3sVU5Pyi5U6g65a<uxT@h*p2~m%`RCum;0#wx+^Iokn
zewVcOG3pU|Z695H_JftR)+mN4B59H2AaI)`ci{k~2h*~svJnMV4^&qpkG<+t*mU|6
z(E>SO((Xl@Us>ztvUAvDsa3zgvOrBzp?9-d^Ty^{>WM5%HW>1#wCpHDK|}RnJES5#
z8#X^a(E#X~&DC0d_H-7p=?_Zi5iKYh9A_x|UFtZ;yB_1b)u+`ZG~*ut1+2aY6Kr?@
z4DUKmvQd@5p!~QkP3Cgu^&sIG%Q(@t7%tFct%W}dq}8g0zm}%Vl+>$^V8A&}7UYEg
zcl|tf1(?TifjvPH-pOfU37`O&LbFzafxnb3HBp-hR7;j6A6c*;%_kKomxj&)fyI9q
zgh1!z+F~P{;RH@P%nP@=iF&KU30H|wibVv~z6fPgyX(d-gnOlVL$_?j?eGZ0{<!tc
zTZ|O#qk>dz&~|Edxcyr>`&=x9dh4k=V5?ER7~yI==|)~ad0ScMQl-ue)%FZd+^=#e
zwePy~($e-3L{01XRrQKE51n>%+9+&k@ZglSVCdjsY7KPgl6?>;@w&0AuTwxeMHuKT
zz%(b1_3kn273o)n$+i~(Js+mJtgZJLO@n;j9}j_|h3f$@<X|A05Q}Ex|JLDsFmhP)
z^u*fmMwPuXO%{3Z-~J)V!wUdFD*rbV9%-bQ^nXowDjeRdAcY+N*M!H|<h_{z*<(-h
z#As$ENAV^s3nHjnkS|V}*T+QF)s;~uLl}+0WtujLt^sLbLf^Cw)vlT<BE@fJG<NI9
z1QQ9MMLWcLmVA;ex8{;Aoy#0QG`%#>d+DDi;bAAbJt}$U{5Ff*V(L$k|3vTOMRjoC
z(^G9T&dT-+#{6mAcjQ07?+_uHHkoiuu}KGZ!bt~o(Rf>s=%I9J@_rMFnhfgpZ-I~3
zR9sgPiQg<gDDgH+^i3F5PSgp%CEex&-mWllvc2@T$-J+E@6(%OhDnBgW&NZv0cg1V
zP+qYBeOmQZf>XWdEZMkPH6`f5%}Puiot>C_NZ+vdj*s>}yw6&dI1yXC&YM5T%N)w>
zvD!Rm#2%O47E-irh#;xsUMa*$3LsGqwTG}B9#D!sI6pL=g#w;gs;&qKB?l<4MJ*$Y
zDKz*m>=Ion6*Jyp_biVpC63QXxhYH2OFG@D22EgcO?&`0jU=(LkI~rP0j6=jy_h5~
zXSW(56{AWjmAEM#nHH7ssd!><J**M*#JBuzdS)=?Ox%Vrj-bsp-x{av=a8%lYVmmG
zGdED$IH<nT`?%5N)9zNEz`svlg?d7ZUrAd9_{o;P=zt-ucbtdCLjVL&OOy41^9k|s
zRJ?}xd~kZm{LpQpxVWfTXT`L;-5%^gev7E)cF!~<8_R!atSmIr$?sxGP~denGXpun
zZ0%0HEbghOhJHmd?842|aViPq2lCdO0fX+u6-kOJ2ejv)z&mT9ODbvPwv^5MJMa8<
z+PVczNya`pR`}7;f^d^(y|<l`{(6N$am^AQ&C2IG>5*S#_G1wmG~WSAVDTtk*1fNX
zu(zW=U83v$<=%UvAFn6Z`Qq=hz6?n?&Aq$0aD$#cbIQC3oxx$vR|Ox-?xBsT0&iYa
z@oM+rzqK1DrwHJ%n7=DkbQ@!fK&KY>fw_%PFhBg%rj5&#lg(He2eioVu|vCT@_A%6
z73M8_oB8FL1CHj7JGIgumkyRa{D3QWx1H7(oXT9H!0%}&3WPJ*1u@zzp97BxFOh5W
z2rD{hwACWUyJ$DQV<|}(Q2$O3+q668LSSD6*+0<^?tKb>T!)e=hUUX3GmU%7XgQsq
zvs`9ioGH`yln*y21vWTMKT4=|&(~3mx-C7G9Pi`y9sO;H2D6N?>V=n(jdz&a*r{Zo
z9h8NPBtLKBJuyX0YfJVKs^cqaEUt%aOs+_GP|j$ZB;!A2;=LXfppSEsbh^>wgC`J{
zS#y451Q!rk1%KN(`AL7w<x4f$>)_K`6&#f>G^Hf#axtNJq(EqPKPEx|@sCYXfT3+P
zG3^wy^qwyk<uZuk?=CkT+Zy|q=C`U>CTmxw>jMvb*aOC%ip&XRrzQi~$}WXc#_|2m
z2R8Z}RhHEPU^9B8k8vTvBn7P|KX5UPeipa;t(#!dqW{8Rl>3|I8lil%JZ-U^i2WpS
z!^}Yyvnh16=uo{Zz2oy)*?nMpCHvzg0j}X9qm}V<`$0bVi);G(2|Zh^)&hsKW_*r3
zj7#FkV4EU0sOTqV0+74|*K5zBj%sd|veB;!1ka=qznUGMlq+qT)Zr#+HI_RhNk=%g
z)jIS;4sI}lrU-{xhPH$CTeY!Obe%>*#?EEIli)1+Lk{^0Ju70Xv;Ijf8X_ElFA>Sw
zd6zjS3+Jhc5Jv6@5B?&%x8#P|cX4#XQ}bGZ?BlTe-27X*m*TI=GH;Uct9$eUjV7BG
zm%>{rbui;wW!kO^v#xGVV}9CCAzb&(;a`$fwYV?2UkOo^5h%#Mi{8%hWT|3UcjCwW
zyz$*2hLikxx4?jwPnD$K_rXFv2bb1Bo`H=5-JtvH2Y3s?U%6pt{nO@@%Pc%yy8dKx
zdFPHMB?tebRl3?18`0EkT1jzH0SS?pfb%q3kkNi;mQ>tqB9vIn0BAsROZ(j|Wp=oo
zP9rE&&d$iDvgc{_bno3JmHq`=!q3k#-Fd`1ub^eZomJ#}Z|3TnorI=4`|-rDZ&^@%
z;&X|xtPG>c<p!?Tw}P8DKDO9f2~GQlOnKKnmcdQh(Wp?yVhtG=;XfVAt5lrA#=^d!
zF!9x8nSpnHoX{K#rtCXwa+6>j80h2M;$t>4N$~l!csn25um>ongVSn^pB$2eOcd;M
zcNF8nO&YQRoi=888^7x#TEz}&2toR7O^G5NLf_)(?8$zyt*aa>5Fa>v1dAxyM(16n
zUET9x<=MQFl`eL=*p>-$T^ZAi2MgUKg$IZd*mX+m;NX3zJ}l{uc%2RZKJbhLHJt)*
zna9`eOFzT;Yf==Wxp9N~O1%46>hQJ`--U2;6KBc#o0dQq!df3sSms?8ceXb{627;;
zp<jD&$?XrXKr?I?s5WPnh5h$Mu%K2c4@O|<OS(S7lz`v(0=-!$;&%}5_c^Y^bBf9u
zaLjKDIX7rAYy``DU+J;w=?ad#w(+_Pr@4wQJXnet^POvYa@RDh5NgJ|L-g2~Te3jA
zQ%9cME_iDoTH<N@)_;EgGayrM;AVctBH*tq$6pLJy&?K4<mBXw!q4JB6!G?r-Syz&
zQyvyw=%iHA6D*oydUba$xz14%!@~h@@Vr7R{9?jCIvqoMeFQJGD^ABZ6}NeC`~<lP
zhv>1ADP)~Vs6TzB^pZ+NLQ%F!Uiw->t7hAfAP*byki)>(PxBsB^WHVQyKLuXAO2}2
zdBx{#(+rL#Nlo{7s_WVN(;eGQ+3GP9N(OMS`fq%y^~*oVN6u#eb%+OyrqqH3Z|`Ax
zq*xxn@39NZtv~KezW$>4T<j3eaqR!T%IU$DJ>=?P`|tlQlRu&Vr&Q7LAT=mO3qL}Z
zApgBo;Q;`^l>eJjg$5}`^IxTkho9d$0D!Xeze*J&jn}3Iq!QabAJxU=QjD8D3H7<L
z=;+tRn<-@QWjb`3qh)cTVI4nTXLQtY7X8EwRUpxQV^cuGS#*s8Q)Y4eWI2UjZ&)qB
zp&`1ZVb6HHOn23jX(zkYtzMs`(KBYV(z)tAe&umAOzK?kLO9Qezj6R))3fm>eJxBA
z#fwLltZ}AP5McLM0*%I95z<7v!;ply&x6D=Jm(v}PD*0XWW!4=Pq3nOqHX7MJgn%R
zFKWHjT{DyHF<$M+5dv2==Us4de0tZ*0>3Cf6>~^|a<@@T*1;t}=s1)1ENZj_Z!o4r
z==e+^6dpddM=;<lUV;SbUk>jTARnEJQY1d)zHnaBnBAx+Dla6E8*)KPs{Zl~4b2=X
zM&CY^;41%f2S?8EzRjw<#=T{T3PIQ}%u(5^M-WbtJoTacrv9D4H17)E3p`b~fi;Ji
z5Ck>vXj?~2GzpYV=Cv0Vb5o$8pK2&A?ZV5!+d(n&Pfv$_?8mz1WrB{Ew#vhh1#$O}
zDli&zp!0`<3i-GF(rmai4=b}}2GYk~p@nBu^PXi5M01W@7^0dT%w!=s4Dj^n(&IT+
zOA-tP^=?t+wgVI)-+@*!CnKo^?Xhuc6gPHL*(D#Ufo=JZ&h&Ws!5C(R=vs@pDU-Ic
zV}>NgHIJS8&2IuSqQ<#43EU0Y^SZSY_a{_uQ+nJev)=YUpKO?(Le$+d>A7>XGnU{w
z9Dic>{OnWwron`#)BH<o+C(l^%2s&MvFVL2!C%yRBe8~qIxmKM_L<$8DRS}qXV#us
zO2p(6gzkpS6Jt>^xYDABDn366U3Z>qmu#@-f7^c+lple2Yo7hUg2m)bcJVPdxBkuF
z_eEr-8d5%QE`60$6CC1?I=qW(=ZC0l$K~BRaN;&Ir?mt6YSxStKZSj?NqD7)BiCcb
zZuB@RhL{#L$4M0-__!++#aoPPfqHXbFleOnoN|@jOKXu^{Wfn6aC`+beU)YP)pH@`
zxS_`K_SYcR?3lHiamd#{-E>4u^yl^T8H-@>9%82D032Y<o^#Xj@y}a~*VLfJRUw%$
zC|mFMz7S%J#-3+RR}w)=1igb-%kigD7&F64)HF9f9Xr3!lERi%@KwS7P3LcHOGr*k
zK_nJSCZUJ^z(0rkQ8fzI$|ojCEHN}=k4lAKqkJ3oGy5j{R+Oa0|ETrKcykbRBIuXI
z%)$=d?anW)c8Aibq5hoNp`^*9tEXF*S|&t(rZa)qT7A4xh!K55x0VT>bc-QX!u~`5
r$*D(JF4Sd@Xth#aNY(O(%a5lFXToc){{)8;?JXi#zI@OB9vuD$_W%=!

literal 0
HcmV?d00001

diff --git a/client/ui/build/docker/Dockerfile.cross b/client/ui/build/docker/Dockerfile.cross
new file mode 100644
index 000000000..a487b8db0
--- /dev/null
+++ b/client/ui/build/docker/Dockerfile.cross
@@ -0,0 +1,203 @@
+# Cross-compile Wails v3 apps to any platform
+#
+# Darwin: Zig + macOS SDK
+# Linux: Native GCC when host matches target, Zig for cross-arch
+# Windows: Zig + bundled mingw
+#
+# Usage:
+#   docker build -t wails-cross -f Dockerfile.cross .
+#   docker run --rm -v $(pwd):/app wails-cross darwin arm64
+#   docker run --rm -v $(pwd):/app wails-cross darwin amd64
+#   docker run --rm -v $(pwd):/app wails-cross linux amd64
+#   docker run --rm -v $(pwd):/app wails-cross linux arm64
+#   docker run --rm -v $(pwd):/app wails-cross windows amd64
+#   docker run --rm -v $(pwd):/app wails-cross windows arm64
+
+FROM golang:1.25-bookworm
+
+ARG TARGETARCH
+
+# Install base tools, GCC, and GTK/WebKit dev packages
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl xz-utils nodejs npm pkg-config gcc libc6-dev \
+    libgtk-3-dev libwebkit2gtk-4.1-dev \
+    libgtk-4-dev libwebkitgtk-6.0-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Zig - automatically selects correct binary for host architecture
+ARG ZIG_VERSION=0.14.0
+RUN ZIG_ARCH=$(case "${TARGETARCH}" in arm64) echo "aarch64" ;; *) echo "x86_64" ;; esac) && \
+    curl -L "https://ziglang.org/download/${ZIG_VERSION}/zig-linux-${ZIG_ARCH}-${ZIG_VERSION}.tar.xz" \
+    | tar -xJ -C /opt \
+    && ln -s /opt/zig-linux-${ZIG_ARCH}-${ZIG_VERSION}/zig /usr/local/bin/zig
+
+# Download macOS SDK (required for darwin targets)
+ARG MACOS_SDK_VERSION=14.5
+RUN curl -L "https://github.com/joseluisq/macosx-sdks/releases/download/${MACOS_SDK_VERSION}/MacOSX${MACOS_SDK_VERSION}.sdk.tar.xz" \
+    | tar -xJ -C /opt \
+    && mv /opt/MacOSX${MACOS_SDK_VERSION}.sdk /opt/macos-sdk
+
+ENV MACOS_SDK_PATH=/opt/macos-sdk
+
+# Create Zig CC wrappers for cross-compilation targets
+# Darwin and Windows use Zig; Linux uses native GCC (run with --platform for cross-arch)
+
+# Darwin arm64
+COPY <<'ZIGWRAP' /usr/local/bin/zcc-darwin-arm64
+#!/bin/sh
+ARGS=""
+SKIP_NEXT=0
+for arg in "$@"; do
+    if [ $SKIP_NEXT -eq 1 ]; then
+        SKIP_NEXT=0
+        continue
+    fi
+    case "$arg" in
+        -target) SKIP_NEXT=1 ;;
+        -mmacosx-version-min=*) ;;
+        *) ARGS="$ARGS $arg" ;;
+    esac
+done
+exec zig cc -fno-sanitize=all -target aarch64-macos-none -isysroot /opt/macos-sdk -I/opt/macos-sdk/usr/include -L/opt/macos-sdk/usr/lib -F/opt/macos-sdk/System/Library/Frameworks -w $ARGS
+ZIGWRAP
+RUN chmod +x /usr/local/bin/zcc-darwin-arm64
+
+# Darwin amd64
+COPY <<'ZIGWRAP' /usr/local/bin/zcc-darwin-amd64
+#!/bin/sh
+ARGS=""
+SKIP_NEXT=0
+for arg in "$@"; do
+    if [ $SKIP_NEXT -eq 1 ]; then
+        SKIP_NEXT=0
+        continue
+    fi
+    case "$arg" in
+        -target) SKIP_NEXT=1 ;;
+        -mmacosx-version-min=*) ;;
+        *) ARGS="$ARGS $arg" ;;
+    esac
+done
+exec zig cc -fno-sanitize=all -target x86_64-macos-none -isysroot /opt/macos-sdk -I/opt/macos-sdk/usr/include -L/opt/macos-sdk/usr/lib -F/opt/macos-sdk/System/Library/Frameworks -w $ARGS
+ZIGWRAP
+RUN chmod +x /usr/local/bin/zcc-darwin-amd64
+
+# Windows amd64 - uses Zig's bundled mingw
+COPY <<'ZIGWRAP' /usr/local/bin/zcc-windows-amd64
+#!/bin/sh
+ARGS=""
+SKIP_NEXT=0
+for arg in "$@"; do
+    if [ $SKIP_NEXT -eq 1 ]; then
+        SKIP_NEXT=0
+        continue
+    fi
+    case "$arg" in
+        -target) SKIP_NEXT=1 ;;
+        -Wl,*) ;;
+        *) ARGS="$ARGS $arg" ;;
+    esac
+done
+exec zig cc -target x86_64-windows-gnu $ARGS
+ZIGWRAP
+RUN chmod +x /usr/local/bin/zcc-windows-amd64
+
+# Windows arm64 - uses Zig's bundled mingw
+COPY <<'ZIGWRAP' /usr/local/bin/zcc-windows-arm64
+#!/bin/sh
+ARGS=""
+SKIP_NEXT=0
+for arg in "$@"; do
+    if [ $SKIP_NEXT -eq 1 ]; then
+        SKIP_NEXT=0
+        continue
+    fi
+    case "$arg" in
+        -target) SKIP_NEXT=1 ;;
+        -Wl,*) ;;
+        *) ARGS="$ARGS $arg" ;;
+    esac
+done
+exec zig cc -target aarch64-windows-gnu $ARGS
+ZIGWRAP
+RUN chmod +x /usr/local/bin/zcc-windows-arm64
+
+# Build script
+COPY <<'SCRIPT' /usr/local/bin/build.sh
+#!/bin/sh
+set -e
+
+OS=${1:-darwin}
+ARCH=${2:-arm64}
+
+case "${OS}-${ARCH}" in
+    darwin-arm64|darwin-aarch64)
+        export CC=zcc-darwin-arm64
+        export GOARCH=arm64
+        export GOOS=darwin
+        ;;
+    darwin-amd64|darwin-x86_64)
+        export CC=zcc-darwin-amd64
+        export GOARCH=amd64
+        export GOOS=darwin
+        ;;
+    linux-arm64|linux-aarch64)
+        export CC=gcc
+        export GOARCH=arm64
+        export GOOS=linux
+        ;;
+    linux-amd64|linux-x86_64)
+        export CC=gcc
+        export GOARCH=amd64
+        export GOOS=linux
+        ;;
+    windows-arm64|windows-aarch64)
+        export CC=zcc-windows-arm64
+        export GOARCH=arm64
+        export GOOS=windows
+        ;;
+    windows-amd64|windows-x86_64)
+        export CC=zcc-windows-amd64
+        export GOARCH=amd64
+        export GOOS=windows
+        ;;
+    *)
+        echo "Usage: <os> <arch>"
+        echo "  os: darwin, linux, windows"
+        echo "  arch: amd64, arm64"
+        exit 1
+        ;;
+esac
+
+export CGO_ENABLED=1
+export CGO_CFLAGS="-w"
+
+# Build frontend if exists and not already built (host may have built it)
+if [ -d "frontend" ] && [ -f "frontend/package.json" ] && [ ! -d "frontend/dist" ]; then
+    (cd frontend && npm install --silent && npm run build --silent)
+fi
+
+# Build
+APP=${APP_NAME:-$(basename $(pwd))}
+mkdir -p bin
+
+EXT=""
+LDFLAGS="-s -w"
+if [ "$GOOS" = "windows" ]; then
+    EXT=".exe"
+    LDFLAGS="-s -w -H windowsgui"
+fi
+
+TAGS="production"
+if [ -n "$EXTRA_TAGS" ]; then
+    TAGS="${TAGS},${EXTRA_TAGS}"
+fi
+
+go build -tags "$TAGS" -trimpath -ldflags="$LDFLAGS" -o bin/${APP}-${GOOS}-${GOARCH}${EXT} .
+echo "Built: bin/${APP}-${GOOS}-${GOARCH}${EXT}"
+SCRIPT
+RUN chmod +x /usr/local/bin/build.sh
+
+WORKDIR /app
+ENTRYPOINT ["/usr/local/bin/build.sh"]
+CMD ["darwin", "arm64"]
diff --git a/client/ui/build/docker/Dockerfile.server b/client/ui/build/docker/Dockerfile.server
new file mode 100644
index 000000000..58fb64f76
--- /dev/null
+++ b/client/ui/build/docker/Dockerfile.server
@@ -0,0 +1,41 @@
+# Wails Server Mode Dockerfile
+# Multi-stage build for minimal image size
+
+# Build stage
+FROM golang:alpine AS builder
+
+WORKDIR /app
+
+# Install build dependencies
+RUN apk add --no-cache git
+
+# Copy source code
+COPY . .
+
+# Remove local replace directive if present (for production builds)
+RUN sed -i '/^replace/d' go.mod || true
+
+# Download dependencies
+RUN go mod tidy
+
+# Build the server binary
+RUN go build -tags server -ldflags="-s -w" -o server .
+
+# Runtime stage - minimal image
+FROM gcr.io/distroless/static-debian12
+
+# Copy the binary
+COPY --from=builder /app/server /server
+
+# Copy frontend assets
+COPY --from=builder /app/frontend/dist /frontend/dist
+
+# Expose the default port
+EXPOSE 8080
+
+# Bind to all interfaces (required for Docker)
+# Can be overridden at runtime with -e WAILS_SERVER_HOST=...
+ENV WAILS_SERVER_HOST=0.0.0.0
+
+# Run the server
+ENTRYPOINT ["/server"]
diff --git a/client/ui/build/linux/Taskfile.yml b/client/ui/build/linux/Taskfile.yml
new file mode 100644
index 000000000..94d041375
--- /dev/null
+++ b/client/ui/build/linux/Taskfile.yml
@@ -0,0 +1,235 @@
+version: '3'
+
+includes:
+  common: ../Taskfile.yml
+
+vars:
+  # Signing configuration - edit these values for your project
+  # PGP_KEY: "path/to/signing-key.asc"
+  # SIGN_ROLE: "builder"  # Options: origin, maint, archive, builder
+  #
+  # Password is stored securely in system keychain. Run: wails3 setup signing
+
+  # Docker image for cross-compilation (used when building on non-Linux or no CC available)
+  CROSS_IMAGE: wails-cross
+
+tasks:
+  build:
+    summary: Builds the application for Linux
+    cmds:
+      # Linux requires CGO - use Docker when:
+      # 1. Cross-compiling from non-Linux, OR
+      # 2. No C compiler is available, OR
+      # 3. Target architecture differs from host architecture (cross-arch compilation)
+      - task: '{{if and (eq OS "linux") (eq .HAS_CC "true") (eq .TARGET_ARCH ARCH)}}build:native{{else}}build:docker{{end}}'
+        vars:
+          ARCH: '{{.ARCH}}'
+          DEV: '{{.DEV}}'
+          OUTPUT: '{{.OUTPUT}}'
+          EXTRA_TAGS: '{{.EXTRA_TAGS}}'
+    vars:
+      DEFAULT_OUTPUT: '{{.BIN_DIR}}/{{.APP_NAME}}'
+      OUTPUT: '{{ .OUTPUT | default .DEFAULT_OUTPUT }}'
+      # Determine target architecture (defaults to host ARCH if not specified)
+      TARGET_ARCH: '{{.ARCH | default ARCH}}'
+      # Check if a C compiler is available (gcc or clang)
+      HAS_CC:
+        sh: '(command -v gcc >/dev/null 2>&1 || command -v clang >/dev/null 2>&1) && echo "true" || echo "false"'
+
+  build:native:
+    summary: Builds the application natively on Linux
+    internal: true
+    deps:
+      - task: common:go:mod:tidy
+      - task: common:build:frontend
+        vars:
+          BUILD_FLAGS:
+            ref: .BUILD_FLAGS
+          DEV:
+            ref: .DEV
+      - task: common:generate:icons
+      - task: generate:dotdesktop
+    cmds:
+      - go build {{.BUILD_FLAGS}} -o {{.OUTPUT}}
+    vars:
+      BUILD_FLAGS: '{{if eq .DEV "true"}}{{if .EXTRA_TAGS}}-tags {{.EXTRA_TAGS}} {{end}}-gcflags=all="-l"{{else}}-tags production{{if .EXTRA_TAGS}},{{.EXTRA_TAGS}}{{end}} -trimpath -ldflags="-w -s"{{end}}'
+      DEFAULT_OUTPUT: '{{.BIN_DIR}}/{{.APP_NAME}}'
+      OUTPUT: '{{ .OUTPUT | default .DEFAULT_OUTPUT }}'
+    env:
+      GOOS: linux
+      CGO_ENABLED: 1
+      GOARCH: '{{.ARCH | default ARCH}}'
+
+  build:docker:
+    summary: Builds for Linux using Docker (for non-Linux hosts or when no C compiler available)
+    internal: true
+    deps:
+      - task: common:build:frontend
+      - task: common:generate:icons
+      - task: generate:dotdesktop
+    preconditions:
+      - sh: docker info > /dev/null 2>&1
+        msg: "Docker is required for cross-compilation to Linux. Please install Docker."
+      - sh: docker image inspect {{.CROSS_IMAGE}} > /dev/null 2>&1
+        msg: |
+          Docker image '{{.CROSS_IMAGE}}' not found.
+          Build it first: wails3 task setup:docker
+    cmds:
+      - docker run --rm -v "{{.ROOT_DIR}}:/app" {{.GO_CACHE_MOUNT}} {{.REPLACE_MOUNTS}} -e APP_NAME="{{.APP_NAME}}" {{if .EXTRA_TAGS}}-e EXTRA_TAGS="{{.EXTRA_TAGS}}"{{end}} "{{.CROSS_IMAGE}}" linux {{.DOCKER_ARCH}}
+      - docker run --rm -v "{{.ROOT_DIR}}:/app" alpine chown -R $(id -u):$(id -g) /app/bin
+      - mkdir -p {{.BIN_DIR}}
+      - mv "bin/{{.APP_NAME}}-linux-{{.DOCKER_ARCH}}" "{{.OUTPUT}}"
+    vars:
+      DOCKER_ARCH: '{{.ARCH | default "amd64"}}'
+      DEFAULT_OUTPUT: '{{.BIN_DIR}}/{{.APP_NAME}}'
+      OUTPUT: '{{ .OUTPUT | default .DEFAULT_OUTPUT }}'
+      # Mount Go module cache for faster builds
+      GO_CACHE_MOUNT:
+        sh: 'echo "-v ${GOPATH:-$HOME/go}/pkg/mod:/go/pkg/mod"'
+      # Extract replace directives from go.mod and create -v mounts for each
+      REPLACE_MOUNTS:
+        sh: |
+          grep -E '^replace .* => ' go.mod 2>/dev/null | while read -r line; do
+            path=$(echo "$line" | sed -E 's/^replace .* => //' | tr -d '\r')
+            # Convert relative paths to absolute
+            if [ "${path#/}" = "$path" ]; then
+              path="$(cd "$(dirname "$path")" 2>/dev/null && pwd)/$(basename "$path")"
+            fi
+            # Only mount if directory exists
+            if [ -d "$path" ]; then
+              echo "-v $path:$path:ro"
+            fi
+          done | tr '\n' ' '
+
+  package:
+    summary: Packages the application for Linux
+    deps:
+      - task: build
+    cmds:
+      - task: create:appimage
+      - task: create:deb
+      - task: create:rpm
+      - task: create:aur
+
+  create:appimage:
+    summary: Creates an AppImage
+    dir: build/linux/appimage
+    deps:
+      - task: build
+      - task: generate:dotdesktop
+    cmds:
+      - cp "{{.APP_BINARY}}" "{{.APP_NAME}}"
+      - cp ../../appicon.png "{{.APP_NAME}}.png"
+      - wails3 generate appimage -binary "{{.APP_NAME}}" -icon {{.ICON}} -desktopfile {{.DESKTOP_FILE}} -outputdir {{.OUTPUT_DIR}} -builddir {{.ROOT_DIR}}/build/linux/appimage/build
+    vars:
+      APP_NAME: '{{.APP_NAME}}'
+      APP_BINARY: '../../../bin/{{.APP_NAME}}'
+      ICON: '{{.APP_NAME}}.png'
+      DESKTOP_FILE: '../{{.APP_NAME}}.desktop'
+      OUTPUT_DIR: '../../../bin'
+
+  create:deb:
+    summary: Creates a deb package
+    deps:
+      - task: build
+    cmds:
+      - task: generate:dotdesktop
+      - task: generate:deb
+
+  create:rpm:
+    summary: Creates a rpm package
+    deps:
+      - task: build
+    cmds:
+      - task: generate:dotdesktop
+      - task: generate:rpm
+
+  create:aur:
+    summary: Creates a arch linux packager package
+    deps:
+      - task: build
+    cmds:
+      - task: generate:dotdesktop
+      - task: generate:aur
+
+  generate:deb:
+    summary: Creates a deb package
+    cmds:
+      - wails3 tool package -name "{{.APP_NAME}}" -format deb -config ./build/linux/nfpm/nfpm.yaml -out {{.ROOT_DIR}}/bin
+
+  generate:rpm:
+    summary: Creates a rpm package
+    cmds:
+      - wails3 tool package -name "{{.APP_NAME}}" -format rpm -config ./build/linux/nfpm/nfpm.yaml -out {{.ROOT_DIR}}/bin
+
+  generate:aur:
+    summary: Creates a arch linux packager package
+    cmds:
+      - wails3 tool package -name "{{.APP_NAME}}" -format archlinux -config ./build/linux/nfpm/nfpm.yaml -out {{.ROOT_DIR}}/bin
+
+  generate:dotdesktop:
+    summary: Generates a `.desktop` file
+    dir: build
+    cmds:
+      - mkdir -p {{.ROOT_DIR}}/build/linux/appimage
+      - wails3 generate .desktop -name "{{.APP_NAME}}" -exec "{{.EXEC}}" -icon "{{.ICON}}" -outputfile "{{.ROOT_DIR}}/build/linux/{{.APP_NAME}}.desktop" -categories "{{.CATEGORIES}}"
+      # Wrap Exec= with `env WEBKIT_DISABLE_DMABUF_RENDERER=1 ...` so launches
+      # from any desktop environment use the working renderer. See build/linux/Taskfile.yml :run for the matching dev-mode env block.
+      - sed -i -E 's|^Exec=([^ ]+)(.*)$|Exec=env WEBKIT_DISABLE_DMABUF_RENDERER=1 \1\2|' {{.ROOT_DIR}}/build/linux/{{.APP_NAME}}.desktop
+    vars:
+      APP_NAME: '{{.APP_NAME}}'
+      EXEC: '{{.APP_NAME}}'
+      ICON: '{{.APP_NAME}}'
+      CATEGORIES: 'Development;'
+      OUTPUTFILE: '{{.ROOT_DIR}}/build/linux/{{.APP_NAME}}.desktop'
+
+  run:
+    cmds:
+      - '{{.BIN_DIR}}/{{.APP_NAME}}'
+    env:
+      # WebKitGTK 2.50's default DMA-BUF renderer fails on RDP, VirtualBox/QEMU,
+      # and some bare WMs (Fluxbox, dwm) where DRM dumb-buffer access is
+      # restricted. Disabling it falls back to the GLES2/cairo path which works
+      # everywhere. Production launchers must set this too.
+      WEBKIT_DISABLE_DMABUF_RENDERER: "1"
+
+  sign:deb:
+    summary: Signs the DEB package
+    desc: |
+      Signs the .deb package with a PGP key.
+      Configure PGP_KEY in the vars section at the top of this file.
+      Password is retrieved from system keychain (run: wails3 setup signing)
+    deps:
+      - task: create:deb
+    cmds:
+      - wails3 tool sign --input "{{.BIN_DIR}}/{{.APP_NAME}}*.deb" --pgp-key {{.PGP_KEY}} {{if .SIGN_ROLE}}--role {{.SIGN_ROLE}}{{end}}
+    preconditions:
+      - sh: '[ -n "{{.PGP_KEY}}" ]'
+        msg: "PGP_KEY is required. Set it in the vars section at the top of build/linux/Taskfile.yml"
+
+  sign:rpm:
+    summary: Signs the RPM package
+    desc: |
+      Signs the .rpm package with a PGP key.
+      Configure PGP_KEY in the vars section at the top of this file.
+      Password is retrieved from system keychain (run: wails3 setup signing)
+    deps:
+      - task: create:rpm
+    cmds:
+      - wails3 tool sign --input "{{.BIN_DIR}}/{{.APP_NAME}}*.rpm" --pgp-key {{.PGP_KEY}}
+    preconditions:
+      - sh: '[ -n "{{.PGP_KEY}}" ]'
+        msg: "PGP_KEY is required. Set it in the vars section at the top of build/linux/Taskfile.yml"
+
+  sign:packages:
+    summary: Signs all Linux packages (DEB and RPM)
+    desc: |
+      Signs both .deb and .rpm packages with a PGP key.
+      Configure PGP_KEY in the vars section at the top of this file.
+      Password is retrieved from system keychain (run: wails3 setup signing)
+    cmds:
+      - task: sign:deb
+      - task: sign:rpm
+    preconditions:
+      - sh: '[ -n "{{.PGP_KEY}}" ]'
+        msg: "PGP_KEY is required. Set it in the vars section at the top of build/linux/Taskfile.yml"
diff --git a/client/ui/build/linux/appimage/build.sh b/client/ui/build/linux/appimage/build.sh
new file mode 100644
index 000000000..85901c34e
--- /dev/null
+++ b/client/ui/build/linux/appimage/build.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Copyright (c) 2018-Present Lea Anthony
+# SPDX-License-Identifier: MIT
+
+# Fail script on any error
+set -euxo pipefail
+
+# Define variables
+APP_DIR="${APP_NAME}.AppDir"
+
+# Create AppDir structure
+mkdir -p "${APP_DIR}/usr/bin"
+cp -r "${APP_BINARY}" "${APP_DIR}/usr/bin/"
+cp "${ICON_PATH}" "${APP_DIR}/"
+cp "${DESKTOP_FILE}" "${APP_DIR}/"
+
+if [[ $(uname -m) == *x86_64* ]]; then
+    # Download linuxdeploy and make it executable
+    wget -q -4 -N https://github.com/linuxdeploy/linuxdeploy/releases/download/continuous/linuxdeploy-x86_64.AppImage
+    chmod +x linuxdeploy-x86_64.AppImage
+
+    # Run linuxdeploy to bundle the application
+    ./linuxdeploy-x86_64.AppImage --appdir "${APP_DIR}" --output appimage
+else
+    # Download linuxdeploy and make it executable (arm64)
+    wget -q -4 -N https://github.com/linuxdeploy/linuxdeploy/releases/download/continuous/linuxdeploy-aarch64.AppImage
+    chmod +x linuxdeploy-aarch64.AppImage
+
+    # Run linuxdeploy to bundle the application (arm64)
+    ./linuxdeploy-aarch64.AppImage --appdir "${APP_DIR}" --output appimage
+fi
+
+# Rename the generated AppImage
+mv "${APP_NAME}*.AppImage" "${APP_NAME}.AppImage"
+
diff --git a/client/ui/build/linux/desktop b/client/ui/build/linux/desktop
new file mode 100644
index 000000000..deadfe9f4
--- /dev/null
+++ b/client/ui/build/linux/desktop
@@ -0,0 +1,13 @@
+[Desktop Entry]
+Version=1.0
+Name=NetBird
+Comment=NetBird desktop client
+# The Exec line includes %u to pass the URL to the application
+Exec=/usr/local/bin/netbird-ui %u
+Terminal=false
+Type=Application
+Icon=netbird-ui
+Categories=Utility;
+StartupWMClass=netbird-ui
+
+ 
diff --git a/client/ui/build/linux/netbird-ui.desktop b/client/ui/build/linux/netbird-ui.desktop
new file mode 100755
index 000000000..6b6ed42a5
--- /dev/null
+++ b/client/ui/build/linux/netbird-ui.desktop
@@ -0,0 +1,10 @@
+[Desktop Entry]
+Type=Application
+Name=netbird-ui
+Exec=env WEBKIT_DISABLE_DMABUF_RENDERER=1 netbird-ui
+Icon=netbird-ui
+Categories=Development;
+Terminal=false
+Keywords=wails
+Version=1.0
+StartupNotify=false
diff --git a/client/ui/build/netbird.desktop b/client/ui/build/linux/netbird.desktop
similarity index 54%
rename from client/ui/build/netbird.desktop
rename to client/ui/build/linux/netbird.desktop
index b3a1b92dc..a81f3698a 100644
--- a/client/ui/build/netbird.desktop
+++ b/client/ui/build/linux/netbird.desktop
@@ -1,8 +1,9 @@
 [Desktop Entry]
 Name=Netbird
-Exec=/usr/bin/netbird-ui
+Exec=env WEBKIT_DISABLE_DMABUF_RENDERER=1 /usr/bin/netbird-ui
 Icon=netbird
 Type=Application
 Terminal=false
 Categories=Utility;
 Keywords=netbird;
+StartupWMClass=org.wails.netbird
\ No newline at end of file
diff --git a/client/ui/build/linux/nfpm/nfpm.yaml b/client/ui/build/linux/nfpm/nfpm.yaml
new file mode 100644
index 000000000..a05daef62
--- /dev/null
+++ b/client/ui/build/linux/nfpm/nfpm.yaml
@@ -0,0 +1,70 @@
+# Feel free to remove those if you don't want/need to use them.
+# Make sure to check the documentation at https://nfpm.goreleaser.com
+#
+# The lines below are called `modelines`. See `:help modeline`
+
+name: "netbird-ui"
+arch: ${GOARCH}
+platform: "linux"
+version: "0.0.1"
+section: "default"
+priority: "extra"
+maintainer: ${GIT_COMMITTER_NAME} <${GIT_COMMITTER_EMAIL}>
+description: "NetBird desktop client"
+vendor: "NetBird"
+homepage: "https://wails.io"
+license: "MIT"
+release: "1"
+
+contents:
+  - src: "./bin/netbird-ui"
+    dst: "/usr/local/bin/netbird-ui"
+  - src: "./build/appicon.png"
+    dst: "/usr/share/icons/hicolor/128x128/apps/netbird-ui.png"
+  - src: "./build/linux/netbird-ui.desktop"
+    dst: "/usr/share/applications/netbird-ui.desktop"
+
+# Default dependencies for the GTK4 + WebKitGTK 6.0 stack (Ubuntu 24.04+ / Debian 13+)
+depends:
+  - libgtk-4-1
+  - libwebkitgtk-6.0-4
+  - xdg-utils
+
+# Distribution-specific overrides for different package formats
+overrides:
+  # RPM packages for Fedora / RHEL / AlmaLinux / Rocky Linux
+  rpm:
+    depends:
+      - gtk4
+      - webkitgtk6.0
+      - xdg-utils
+
+  # Arch Linux packages
+  archlinux:
+    depends:
+      - gtk4
+      - webkitgtk-6.0
+      - xdg-utils
+
+# scripts section to ensure desktop database is updated after install
+scripts:
+  postinstall: "./build/linux/nfpm/scripts/postinstall.sh"
+  # You can also add preremove, postremove if needed
+  # preremove: "./build/linux/nfpm/scripts/preremove.sh"
+  # postremove: "./build/linux/nfpm/scripts/postremove.sh"
+
+# replaces:
+#   - foobar
+# provides:
+#   - bar
+# depends:
+#   - gtk3
+#   - libwebkit2gtk
+# recommends:
+#   - whatever
+# suggests:
+#   - something-else
+# conflicts:
+#   - not-foo
+#   - not-bar
+# changelog: "changelog.yaml"
diff --git a/client/ui/build/linux/nfpm/scripts/postinstall.sh b/client/ui/build/linux/nfpm/scripts/postinstall.sh
new file mode 100644
index 000000000..4bbb815a3
--- /dev/null
+++ b/client/ui/build/linux/nfpm/scripts/postinstall.sh
@@ -0,0 +1,21 @@
+#!/bin/sh
+
+# Update desktop database for .desktop file changes
+# This makes the application appear in application menus and registers its capabilities.
+if command -v update-desktop-database >/dev/null 2>&1; then
+  echo "Updating desktop database..."
+  update-desktop-database -q /usr/share/applications
+else
+  echo "Warning: update-desktop-database command not found. Desktop file may not be immediately recognized." >&2
+fi
+
+# Update MIME database for custom URL schemes (x-scheme-handler)
+# This ensures the system knows how to handle your custom protocols.
+if command -v update-mime-database >/dev/null 2>&1; then
+  echo "Updating MIME database..."
+  update-mime-database -n /usr/share/mime
+else
+  echo "Warning: update-mime-database command not found. Custom URL schemes may not be immediately recognized." >&2
+fi
+
+exit 0
diff --git a/client/ui/build/linux/nfpm/scripts/postremove.sh b/client/ui/build/linux/nfpm/scripts/postremove.sh
new file mode 100644
index 000000000..a9bf588e2
--- /dev/null
+++ b/client/ui/build/linux/nfpm/scripts/postremove.sh
@@ -0,0 +1 @@
+#!/bin/bash
diff --git a/client/ui/build/linux/nfpm/scripts/preinstall.sh b/client/ui/build/linux/nfpm/scripts/preinstall.sh
new file mode 100644
index 000000000..a9bf588e2
--- /dev/null
+++ b/client/ui/build/linux/nfpm/scripts/preinstall.sh
@@ -0,0 +1 @@
+#!/bin/bash
diff --git a/client/ui/build/linux/nfpm/scripts/preremove.sh b/client/ui/build/linux/nfpm/scripts/preremove.sh
new file mode 100644
index 000000000..a9bf588e2
--- /dev/null
+++ b/client/ui/build/linux/nfpm/scripts/preremove.sh
@@ -0,0 +1 @@
+#!/bin/bash
diff --git a/client/ui/build/windows/Taskfile.yml b/client/ui/build/windows/Taskfile.yml
new file mode 100644
index 000000000..f51f7fbee
--- /dev/null
+++ b/client/ui/build/windows/Taskfile.yml
@@ -0,0 +1,243 @@
+version: '3'
+
+includes:
+  common: ../Taskfile.yml
+
+vars:
+  # Signing configuration - edit these values for your project
+  # SIGN_CERTIFICATE: "path/to/certificate.pfx"
+  # SIGN_THUMBPRINT: "certificate-thumbprint"  # Alternative to SIGN_CERTIFICATE
+  # TIMESTAMP_SERVER: "http://timestamp.digicert.com"
+  #
+  # Password is stored securely in system keychain. Run: wails3 setup signing
+
+  # Docker image for cross-compilation with CGO (used when CGO_ENABLED=1 on non-Windows)
+  CROSS_IMAGE: wails-cross
+
+tasks:
+  build:
+    summary: Builds the application for Windows
+    cmds:
+      # CGO Windows builds from Linux use mingw-w64 (lighter than docker).
+      # Docker is only needed if mingw-w64 is unavailable.
+      - task: build:native
+        vars:
+          ARCH: '{{.ARCH}}'
+          DEV: '{{.DEV}}'
+          EXTRA_TAGS: '{{.EXTRA_TAGS}}'
+    vars:
+      CGO_ENABLED: '{{.CGO_ENABLED | default "0"}}'
+
+  build:console:
+    summary: Builds a console-attached Windows binary so logs go to the terminal.
+    desc: |
+      Same as `windows:build` but links against the console PE subsystem
+      instead of windowsgui, so stdout/stderr (logrus, panics) print to the
+      terminal that launched the .exe. Useful for chasing tray, event-stream,
+      or daemon-RPC bugs that have no other feedback channel on Windows.
+
+      Output is bin/netbird-ui-console.exe — kept distinct so the production
+      binary built by `windows:build` isn't shadowed.
+
+      Cross-compile from Linux works the same way:
+        CGO_ENABLED=1 task windows:build:console
+
+      Pass DEV=true to drop the `production` build tag so the WebKit/WebView2
+      DevTools inspector (right-click → Inspect, or F12) stays enabled and the
+      frontend JS console is reachable — same DEV handling as windows:build:
+        CGO_ENABLED=1 task windows:build:console DEV=true
+    deps:
+      - task: common:go:mod:tidy
+      - task: common:build:frontend
+        vars:
+          BUILD_FLAGS:
+            ref: .BUILD_FLAGS
+          DEV:
+            ref: .DEV
+      - task: common:generate:icons
+    preconditions:
+      - sh: '[ "{{OS}}" = "windows" ] || [ "{{.CGO_ENABLED}}" != "1" ] || command -v {{.CC}}'
+        msg: "{{.CC}} not found. Install with: sudo apt-get install gcc-mingw-w64-x86-64 (Debian/Ubuntu) / sudo dnf install mingw64-gcc (Fedora)"
+    cmds:
+      - task: generate:syso
+      - go build {{.BUILD_FLAGS}} -o "{{.BIN_DIR}}/{{.APP_NAME}}-console.exe"
+      - cmd: powershell Remove-item *.syso
+        platforms: [windows]
+      - cmd: rm -f *.syso
+        platforms: [linux, darwin]
+    vars:
+      # Identical to build:native's flags (including DEV handling) except no
+      # -H windowsgui, so the binary attaches to the launching console. With
+      # DEV=true the `production` tag is dropped, keeping the WebKit/WebView2
+      # DevTools inspector enabled so the frontend JS console is reachable.
+      BUILD_FLAGS: '{{if eq .DEV "true"}}{{if .EXTRA_TAGS}}-tags {{.EXTRA_TAGS}} {{end}}-gcflags=all="-l"{{else}}-tags production{{if .EXTRA_TAGS}},{{.EXTRA_TAGS}}{{end}} -trimpath -ldflags="-w -s"{{end}}'
+      CGO_ENABLED: '{{.CGO_ENABLED | default "0"}}'
+      CC: '{{.CC | default "x86_64-w64-mingw32-gcc"}}'
+    env:
+      GOOS: windows
+      CGO_ENABLED: '{{.CGO_ENABLED}}'
+      GOARCH: '{{.ARCH | default ARCH}}'
+      CC: '{{.CC}}'
+
+  build:native:
+    summary: Builds for Windows natively, or cross-compiles from Linux/macOS via mingw-w64.
+    internal: true
+    deps:
+      - task: common:go:mod:tidy
+      - task: common:build:frontend
+        vars:
+          BUILD_FLAGS:
+            ref: .BUILD_FLAGS
+          DEV:
+            ref: .DEV
+      - task: common:generate:icons
+    preconditions:
+      # When cross-compiling with CGO from a non-Windows host, the mingw-w64
+      # cross-gcc must be present. Native Windows builds skip this check.
+      - sh: '[ "{{OS}}" = "windows" ] || [ "{{.CGO_ENABLED}}" != "1" ] || command -v {{.CC}}'
+        msg: "{{.CC}} not found. Install with: sudo apt-get install gcc-mingw-w64-x86-64 (Debian/Ubuntu) / sudo dnf install mingw64-gcc (Fedora)"
+    cmds:
+      - task: generate:syso
+      - go build {{.BUILD_FLAGS}} -o "{{.BIN_DIR}}/{{.APP_NAME}}.exe"
+      - cmd: powershell Remove-item *.syso
+        platforms: [windows]
+      - cmd: rm -f *.syso
+        platforms: [linux, darwin]
+    vars:
+      BUILD_FLAGS: '{{if eq .DEV "true"}}{{if .EXTRA_TAGS}}-tags {{.EXTRA_TAGS}} {{end}}-gcflags=all="-l"{{else}}-tags production{{if .EXTRA_TAGS}},{{.EXTRA_TAGS}}{{end}} -trimpath -ldflags="-w -s -H windowsgui"{{end}}'
+      CGO_ENABLED: '{{.CGO_ENABLED | default "0"}}'
+      CC: '{{.CC | default "x86_64-w64-mingw32-gcc"}}'
+    env:
+      GOOS: windows
+      CGO_ENABLED: '{{.CGO_ENABLED}}'
+      GOARCH: '{{.ARCH | default ARCH}}'
+      CC: '{{.CC}}'
+
+  build:docker:
+    summary: Cross-compiles for Windows using Docker with Zig (for CGO builds on non-Windows)
+    internal: true
+    deps:
+      - task: common:build:frontend
+      - task: common:generate:icons
+    preconditions:
+      - sh: docker info > /dev/null 2>&1
+        msg: "Docker is required for CGO cross-compilation. Please install Docker."
+      - sh: docker image inspect {{.CROSS_IMAGE}} > /dev/null 2>&1
+        msg: |
+          Docker image '{{.CROSS_IMAGE}}' not found.
+          Build it first: wails3 task setup:docker
+    cmds:
+      - task: generate:syso
+      - docker run --rm -v "{{.ROOT_DIR}}:/app" {{.GO_CACHE_MOUNT}} {{.REPLACE_MOUNTS}} -e APP_NAME="{{.APP_NAME}}" {{if .EXTRA_TAGS}}-e EXTRA_TAGS="{{.EXTRA_TAGS}}"{{end}} {{.CROSS_IMAGE}} windows {{.DOCKER_ARCH}}
+      - docker run --rm -v "{{.ROOT_DIR}}:/app" alpine chown -R $(id -u):$(id -g) /app/bin
+      - rm -f *.syso
+    vars:
+      DOCKER_ARCH: '{{.ARCH | default "amd64"}}'
+      # Mount Go module cache for faster builds
+      GO_CACHE_MOUNT:
+        sh: 'echo "-v ${GOPATH:-$HOME/go}/pkg/mod:/go/pkg/mod"'
+      # Extract replace directives from go.mod and create -v mounts for each
+      REPLACE_MOUNTS:
+        sh: |
+          grep -E '^replace .* => ' go.mod 2>/dev/null | while read -r line; do
+            path=$(echo "$line" | sed -E 's/^replace .* => //' | tr -d '\r')
+            # Convert relative paths to absolute
+            if [ "${path#/}" = "$path" ]; then
+              path="$(cd "$(dirname "$path")" 2>/dev/null && pwd)/$(basename "$path")"
+            fi
+            # Only mount if directory exists
+            if [ -d "$path" ]; then
+              echo "-v $path:$path:ro"
+            fi
+          done | tr '\n' ' '
+
+  package:
+    summary: Packages the application
+    cmds:
+      - task: '{{if eq (.FORMAT | default "nsis") "msix"}}create:msix:package{{else}}create:nsis:installer{{end}}'
+    vars:
+      FORMAT: '{{.FORMAT | default "nsis"}}'
+
+  generate:syso:
+    summary: Generates Windows `.syso` file
+    dir: build
+    cmds:
+      - wails3 generate syso -arch {{.ARCH}} -icon windows/icon.ico -manifest windows/wails.exe.manifest -info windows/info.json -out ../wails_windows_{{.ARCH}}.syso
+    vars:
+      ARCH: '{{.ARCH | default ARCH}}'
+
+  create:nsis:installer:
+    summary: Creates an NSIS installer
+    dir: build/windows/nsis
+    deps:
+      - task: build
+    cmds:
+      # Create the Microsoft WebView2 bootstrapper if it doesn't exist
+      - wails3 generate webview2bootstrapper -dir "{{.ROOT_DIR}}/build/windows/nsis"
+      - | 
+        {{if eq OS "windows"}}
+        makensis -DARG_WAILS_{{.ARG_FLAG}}_BINARY="{{.ROOT_DIR}}\{{.BIN_DIR}}\{{.APP_NAME}}.exe" project.nsi
+        {{else}}
+        makensis -DARG_WAILS_{{.ARG_FLAG}}_BINARY="{{.ROOT_DIR}}/{{.BIN_DIR}}/{{.APP_NAME}}.exe" project.nsi
+        {{end}}
+    vars:
+      ARCH: '{{.ARCH | default ARCH}}'
+      ARG_FLAG: '{{if eq .ARCH "amd64"}}AMD64{{else}}ARM64{{end}}'
+
+  create:msix:package:
+    summary: Creates an MSIX package
+    deps:
+      - task: build
+    cmds:
+      - |-
+        wails3 tool msix \
+          --config "{{.ROOT_DIR}}/wails.json" \
+          --name "{{.APP_NAME}}" \
+          --executable "{{.ROOT_DIR}}/{{.BIN_DIR}}/{{.APP_NAME}}.exe" \
+          --arch "{{.ARCH}}" \
+          --out "{{.ROOT_DIR}}/{{.BIN_DIR}}/{{.APP_NAME}}-{{.ARCH}}.msix" \
+          {{if .CERT_PATH}}--cert "{{.CERT_PATH}}"{{end}} \
+          {{if .PUBLISHER}}--publisher "{{.PUBLISHER}}"{{end}} \
+          {{if .USE_MSIX_TOOL}}--use-msix-tool{{else}}--use-makeappx{{end}}
+    vars:
+      ARCH: '{{.ARCH | default ARCH}}'
+      CERT_PATH: '{{.CERT_PATH | default ""}}'
+      PUBLISHER: '{{.PUBLISHER | default ""}}'
+      USE_MSIX_TOOL: '{{.USE_MSIX_TOOL | default "false"}}'
+
+  install:msix:tools:
+    summary: Installs tools required for MSIX packaging
+    cmds:
+      - wails3 tool msix-install-tools
+
+  run:
+    cmds:
+      - '{{.BIN_DIR}}/{{.APP_NAME}}.exe'
+
+  sign:
+    summary: Signs the Windows executable
+    desc: |
+      Signs the .exe with an Authenticode certificate.
+      Configure SIGN_CERTIFICATE or SIGN_THUMBPRINT in the vars section at the top of this file.
+      Password is retrieved from system keychain (run: wails3 setup signing)
+    deps:
+      - task: build
+    cmds:
+      - wails3 tool sign --input "{{.BIN_DIR}}/{{.APP_NAME}}.exe" {{if .SIGN_CERTIFICATE}}--certificate {{.SIGN_CERTIFICATE}}{{end}} {{if .SIGN_THUMBPRINT}}--thumbprint {{.SIGN_THUMBPRINT}}{{end}} {{if .TIMESTAMP_SERVER}}--timestamp {{.TIMESTAMP_SERVER}}{{end}}
+    preconditions:
+      - sh: '[ -n "{{.SIGN_CERTIFICATE}}" ] || [ -n "{{.SIGN_THUMBPRINT}}" ]'
+        msg: "Either SIGN_CERTIFICATE or SIGN_THUMBPRINT is required. Set it in the vars section at the top of build/windows/Taskfile.yml"
+
+  sign:installer:
+    summary: Signs the NSIS installer
+    desc: |
+      Creates and signs the NSIS installer.
+      Configure SIGN_CERTIFICATE or SIGN_THUMBPRINT in the vars section at the top of this file.
+      Password is retrieved from system keychain (run: wails3 setup signing)
+    deps:
+      - task: create:nsis:installer
+    cmds:
+      - wails3 tool sign --input "build/windows/nsis/{{.APP_NAME}}-installer.exe" {{if .SIGN_CERTIFICATE}}--certificate {{.SIGN_CERTIFICATE}}{{end}} {{if .SIGN_THUMBPRINT}}--thumbprint {{.SIGN_THUMBPRINT}}{{end}} {{if .TIMESTAMP_SERVER}}--timestamp {{.TIMESTAMP_SERVER}}{{end}}
+    preconditions:
+      - sh: '[ -n "{{.SIGN_CERTIFICATE}}" ] || [ -n "{{.SIGN_THUMBPRINT}}" ]'
+        msg: "Either SIGN_CERTIFICATE or SIGN_THUMBPRINT is required. Set it in the vars section at the top of build/windows/Taskfile.yml"
diff --git a/client/ui/build/windows/icon.ico b/client/ui/build/windows/icon.ico
new file mode 100644
index 0000000000000000000000000000000000000000..7abbfa5a3276e654a567589fbafc3c2907a5076e
GIT binary patch
literal 18126
zcmdSAWmJ^W_doi~FvtJ`Gc?lO0@6KnhqTfm2uO*9<j@@gigcH>(m5gu3QBiNNP~3G
zfBb%b@9tgex9+-c?wz&f#W`m`XP@Vsy+1q7egFUj+ynmmV*uot0Kgv8KqCM3FaX*x
z04T@wArSv<U*Z73*&_hp=l^f}3>yFrBruc=|84)l0)TY{0KhQM{d*n^27p0D0Ep4m
zRw2N9fQRWMP*YXZ12A0w{h|L@o4qW@@MOYOQ<O9C&E8$WPop)=;5$5+I~BWC|0CCr
zB?qCRN3?y}H1~9<`Ni|c;-Jkq-BZPZbCu^0UNpQF72P4UHSDPxtxXIiw!nRaf-)86
z7ZP5`KTCT|cZ>IvTMEp`NYs|9-K}l7ce`NN{!4r-S^G+AJNtvg>Fwl?c*s?Dt&Y#F
zv+<t!5;=-egO?EarWcQetS4Osta!eP0hAg7|Nrh1+y+xt-UBVC4qTkKEC(LS_!8%a
zpS#^_PD9f<TN2w&{3SY)UMOp73adxe9g4||<wBQgNIQNCt(X8K54;lU5#jPc3!aEb
z_2%tsPRpL}-)*8EO0lMzCX3TWT+*@Dj|nU{hyw=(if+cpPw@QjLb_09u?V=5xrbCf
zE6Q^M`SNf}uR9V8`L$>I=$uC+E9)1cn8;7QgZ`}q0qD=%JG3)F{t-@VaNRZ9)bF$9
zVLd(U&cuRCEq1cO?%F5q%8Lfzc|=mFBl{Ux<%2JOfgCPDR}}T318ARc6RF`#hP(_H
z246h7hGPF<amzjsYTIcuHr1iIdFTpwb0G%06$WM7U3PceWthX)E|7d#TbAb<v+Tg6
zwf8XRj<d5dxh;;?E1xa}lS5pHls<8`HMP}iJOnW+ye}%CL>C81pZ_YVvE%%FJxCe{
zsH_;-PaJd6xM2q6I6^%N(fB)Dzr$o${7zW5l-7SFybbtA6f^%pa4}AG0J=O@8iHRU
zAN>Bumupx-m$*6tLY?&yi_h@r0p_&~Ru>#-9HviRvs`sJF3(AI)zoIh$J{;N_F1J{
zc(Uc}4%F%Do>w$EKl{a!KcE?+aS>_Zf(vnH5r@{fx;D94mehU$p+0Pw1^Pwde^Y0=
z3g^@n3s|1YcDZl}_Uc}kJ70COh{8e|#=q+v`jNAoi_h@R6r41q21XNA^6CS=v1h6&
zQ_F!2m44NSKWrQyjVxRe4!x^H_Bz1c9BfaidCcncxbT{r=9ZtGiUB4w9frYIQ+oXb
zr6@v9wWS4zQ)?=y-UkOB;|0oZJ07xt5xI}yABr^HrN;2h_b25o%6SvH2%rKAU6B|h
zd_lA-{2GE%m#4^0c@sBRb3$rv4LnGdTC0@|T-6z^<>|ZiHmUs%LfH$w`uhD-=h@^b
z!q?TBmA;ZsLFc*x7x6T1=JQCMMLHIemdvZ$xy!b3o&^##+CBNlw)?KmcaLaE!1&~r
zXK-o*uu@TUUi6Gt(aPctq4&91PSQMV$eWE(cR?kaG8FRy?%QSQ2T|X;C&%*le~Htr
zXhouuj$^wv^Sdsi@>LgXEXDa@XFKdnz;h~-I^TNiI#ez&!6w%vDm+tNUam#lR1|82
zcz%kUz29rk^c+-ZFFy!FCP3fCZ~)(v?^I$Lq5-K}9_%-I#iUngXd)UXge|653>KdO
zwWX^Nu>Kt_w+*P#7;>n*U_2*C5?i%RT%}p+l8$<!`#4zJ`t{!L)hucJ8WOPV`XQFo
z8@vaB<uXI3B2&LlnceWNUY%E*F}Y`Ec1}LAS01Dwr>!LAW$IB<Y=D9ig|)J|$p)E`
zt%^eU&`eN1E_P=0bJ!bB*s#uziX|BN9g)^;T=V;@gU#U;VBJ(#O$jN7@Ks#qEL1~K
zk^tA(zq62aeW`UgNbd)LWLiG0-fvg_mu|a0X9t$q3*zvz;cBCD>TqYTyExcyJ)OUG
zvg-1Am573#PkY?{ch%$vkJI5Ok^z*&v&EFAjr+VpFKp|XBrJ%#%o)1Op<))C{sI}V
z;=xYr*gp~P1qjeq%4pOWPQe@5(38BICG6nPC0(7o;4-ue@2StlbI0h<4$rR835<0Z
zsJL#t3=T*8*dJP6;v@irA%`k(tuOeyrF*}&v1_%!T|CJa2x7k1uKRD<C>P^qa#o)O
zzZVv9^a{d-^D)X?FgxH3UCG*gFF2UomX@al>59I;_SCR%Y=~Y}9sUknXd|SQ7_!Sr
zI~4Lp;ByR{+aHK%euxH)|D+2E4SPUH*Qj<$D`mG9f>XN?j{JST6@>+lC;6NVt0REt
z8Y^N&hL%a|xGV@h>NpN3m}4)zqI)@$m=qG?!~C14*81V|l<&}Yo3y&IccrhNE!8@o
z%8=n8gUw}{T5Mgv!Prye4vg?5@5>$Ng=3(!j|%KS75xqshSSQ#MYsEP3U`Y-ro9KJ
zTIGJZ3S5HH?yz-@bR?PaP@J<uhe3+4hNceDNxG4JFtTQpb7rA<tP%+;JH(P6>ACrI
zm#Zf_$9?sy_SFBa-NE`n?!<Vu_(;>CkkYUtRZFkop)14$3hcducZ|Qnkw8n(QfZUm
zX}bf2m&_1`D`tk9MAEYtr`axLZ)Z;GN!`q5M<g5w7j3D3+jjKu`Q6nkD%NUqUCPcG
z6G|BmoM#FEY&F{#`Hs<_pjNo>?EBDTp5PazV*Zy?vF;ZHLPi-q2^z96O*AnW^s?=M
zWLE^1r&k=r3%RvNcg-)~G!D^1SEW5Ghc04ahr-{dZr^+f1G%?07W$Y=FCLU<SLz%f
z_z#46|I+mt;<$B9v^^@-qGfy!K6N;N(*mIm&`smw!-D#em@+Pcu$W41v?pUc4*V}=
z*M3s2>`8j;otU`9<(sow>1+GyrP^W*Wc~iHl6MK`@4-u76ndXC(%i?Ar8HApjpolM
zz13vAX_@iz*VrSdo%5ZU415O*{xWo|qI0m1wZ^zCYuDy?P}%4IE`Z1?;4}s8RN&DJ
z^L?2Z{KRIZj$hYFmRP1VItZ~TH9mhj*i;nQ`Kj$#Gs0aI_CV?+$s)DuugbaUoFAG_
zV}7Ce>9e0;O?ydM7R{S?h=8mwKC!kXuzPJf0q#QGV2G@;?s;bI(_qw39l9fYul#HC
zW0%UyB`wCqA)nhK2fRQ>X&yvS@AiX>A-_(ynK5K*rKD^ugDVBJ?<KTXzrZC8{(?$4
z7U%{c+xt}36+F9S`0xA8)*j=1fm!~sxE<lvzE*3Q+~003UOX^wn%^$TQw;wZEfzH=
z_jPLgaR_q^q=!U(#6?kv<Gx23LMkRWXyg;YZQYR3KnRg-)4^N6E}yUXA=wievKmlP
zJfu<j0bQR3BlLtSn2#_O**dI^+$iAYdlG0JG?AybU0C||mdxeAFd^0-JZs+RgBLzP
ziukqmE4020`f9-S0Zx9PnDL&R?i_qv21x#Fz+BlKAJhh+qot><{{BTquwr|-@!k0%
z544RmMCgKo<Bk+bGn(@(6z9WBs8cg=DgjP_6aj>xR{|%41nbf63mw6)9fL`Q4FdO@
z+We-N%PTq11ogh7I)-#WzDM?vmHZ+4Iascf5wVAmmgnG+v1u$xAL72~+B>^p`S2iK
z*J91Mo$j`hi1&qj2tCl19Zws0=nphdgQTQxe(9{_(LyMd0@VN!Ao6JLbE)n2PSEt;
z>uvPRjJagt2j;ZOa~|YJiyc!=Kr|D4%$;eHJuEY>aF>xumkieZa(Rt)DaV;~ujlOn
z=L&krt;zm6FZScRVb`S<d-sG+{~CtE;6^csjY8fnJE(k|TXPU6BrM+>S6A|Oc^L-P
z52~MB1{p8Xc<~l2cK2bBN7LcNM(L1t4z+omP`~_{7riUHFpPeVcaB4t-=)@H6ykot
zuB`J0{nu5Dt#~2u!w2?Vir(ExI0^g1WW1m>0dYuSG0|lGGDFP;&Pvj~c`G4=8$<E{
zqb`A|Pfwwx$(QZia_5kzdj!z~d4XdgF~?FBL7y36v?-rYr3~A3xzSh#%%7hlzllM(
ztk?1uNu!-T0?{VprwCqA92fJyyV|(F&2&Z%#30+XVtb;Gzs{iRD1O$`PIDp%Xand)
zKFJpmfqau%3(x;Np3>JH6At)kE<Fd`qA?!Tza-PCB0Twg03LQH$b4fPWLIwt?8!@a
z_A~Me>NB*&das$iHXm=)G(1-7$XE{?DoSx^P04lr4J)S(TphywyDMwBl42!$?-PVD
z3N=DXVFX{8f48?p>?N%~@r<lHa2<sN4tOfYjp%U4CqFxOO9cF)tm5IRVOXQzYj}Yr
zM||40dNf(?{JOGD`kSqn%j+KIQ}L3`iTkxwHB{1jqVaz3Ez+s^zFvc&LO&P}jV>K!
zBM?&!)iWQtxBV7B)C~O<_93`2@^i{ynSJI74cDd*C;~oYI(Ek{if!7J<*`rGM-lw_
ztxy{!cd@netLs3?eBjmg9fO;`5BiJZiBiS$>EAFYfp*4O+?sWK&(F^b;OF#75C(L1
zH@721twxfw-R04?Un$A=)SHZ&E*#jVe980i-xlB%lvS%+`B)IyIDm)PgXc$%(SrSE
z`KA|+O^v2dZbdbJRGB1ic5AxY-z*QrTBT6O8mKH?c!o-%-*AVc7GFgnsjAL{u}K4%
zx1T1mjVcUT%=mKyfrjwcG+;xHs&gM^scRi!VaQp@K`vrtjulD$h}+*Xx+S|P_NH#&
z)v37(1YHG<cEe56!H6;NoW-7gF>L_!Ky6ADC2~4xffnBqYgREI&}1S4EXRIy2_x#h
zp-Wa^96BqPw{2S2Z<*=A4W`BRvHY@oe~2qiKYa>QcswPTY63w96Azr6do!c%h0JT@
z8$>wDQpSBB4wm>j0~%+3t4tKKEZ}=puy=;$-+rnNj{^=@0vRlWgM7t7E*p_dg4_+4
zqYmhnb1QBsy^i*JdUla8$8JWQQNO`Z3NPuBXf2Fi(B?U})_)hHK{jGeE=rp5Cig5W
z{_jjM*L|l6#$lvOKYqIa<8XJA*$g_We23Gp3XBpB-t)xyM%W)$T#R!e@Ox|PQ*e#;
z&h3}ADd|{*Lc)~zq^z}?(vXI`YjoSYm%R^xfPav@8}D!VidA}$(OoQduEA1#xcdb>
z|G{&66k3M#4LvY5)WGaH-}?v%aB*(h)msi+)IX#q3<*1t6Qq0fM{PIiH_o)hxDKy~
zJQPCIJmU7Pqux!)T%*;78px-on?1_Z`}IdkDR>PAB`v*W_<k)wPDeLOGPX7FXl*V)
zs||0GK6OC?qYCS>UI5a9`S2tz+`Wn0kzubBax!y-lm)9E&U7;@X&@t0Xm_tFj6x3@
zeFJ3^+TN-6$^Zx-vTa&LrMy!X>Ga7O`IyWz?y#=(H^WNuezQ6w4@qAU*r$rKX($57
zeXj8-X3(#{q@5{~kxUIl_KOSbYIu_HPO1}f&Czqi`Gu(Q>a*Cc#qymB0~;`KA|0~0
zgpcwhLnR6clU6uq)%p$866LShnd5CP1hPo)wJNW*UmGw#1}zI3pWNtizRuNia(gO|
zqCeUx2ySh^W{K`1RaLe8{Ci(Ub*jnEpJ{Gd@O}(FFsuVRljQ(COjb`YA?UJiscTPK
zY;1nqJyDSk#%)O<^ga*Cd-7}lK+#;Ik(dg|=fk<$R|@5WkN7g56Au%O-e+A!m8)AD
zF>K(6pETqZ3Mjp#wf9L>G1qA%4&0pPzIHW67{fxwq8amRZ&jFFj}0B#iaa#WsW|rc
z!w&aK-(qz~x8?G)+|@a5Z?}VxMqEr2s?Ctt_Uqn)pT?bQ&8$f~KeapClZvOv5LMpi
z70SP{fY2Iw=Qmblh*crdf~N=jB(_4t-OqY_-RXO?9u4^86xFcv5WoSMxt(@A_~fN*
zaq$wxc=z)Ji9ONOn^1P?qnMG<vYUMwoz|Kw`|-x`3TrU%Dc{09`ytRWqUoyu$ADPc
zjn~n{a1ueE9cg~qZFF&pyOwEFu+RAEKWdcEQ}5w=n$?#~ZC~)b?bNbuvTBtv3Zd4O
z@SYCz)rvIP?f5ix&tJKl-iz1Txf}qbiG5!Nj8k<@r@pdeb2N`QT;7*SXjtsl^Pt3r
z?A%TSsWt5Dh`9b#GFEdDG6OC)?3?#KE&M&ERg+a4we5upOfRrMwBg6&Xt-p8p(p1j
z(DWk)k4*_MC!zu#I{4YrGMIW&$rAo=i(=pp@MrUs1n~N6&x5JbNOmyhZKMtaNI?9&
zIrRRt;n8WxLs^=B8dtATM-7Ku1v9+wrixRg&N7m@wOPO~PmLr5h6$9eEWK&YX^i!B
z%&22GKcRiq%Wl;XMY`wSzx{mZb(0ckb$!MU%y(*6uu!7h?dwkz4|sGwIQ*X0EpBN~
zQa@-|f|D8HBu*Ug9_w6-E7rOGn!<_PIsbK<9t#}Ka5tU!$NqYkViB*e@TRAM{_AU>
zJjz2ptnE{T!JWV{{mtT@f1S($WzIMRspB@yFg_EzIUyE~8W*wjcz=*s9WVwf|1xRw
zd0)n<mci`2AbfXUKfwSSIrMZ9%@O*PjchMgK>?0#lND&cR#d~@0XtQQ?M1m~O-vjs
zYAx}w=}`dr?RclMng~mS*vP7A`TUl4BAx5EnmV|XhxYloXZj~RZ#wEl4q&ns_W@`w
zLjVG7uBeDp1(k^ibLqPHW~p{W9j}-0)Ex>*jzw^`)wDVfI5)mdzff}l5W|L>u80;z
zxaQ=i0#$1tdg<<;IKfYzSBVT1AE$>U*-4%6A6iOx>Cpl*{;v<JffGZewFz#>0~?>b
za!m$AKW*5NOBY+TJFh*C$`}9j3ynYk;V$k@3-aa$e>mk0`6q7E3uTLVonW?}>*ZLN
zE@1y>)$VJt1`2H`A+lqmX0aAGR9N>*jeJzY<!_8--O37K3=Fy}AJT6~E$$FWkR>BT
zhV>u$p=S`&40YZFN+*73<=F*xyt_XXJui^xb$Qu6oUC1LoO?Z7d}?AqDT>FpR{YBV
z?sNTV^9YP~#vi`1eB1L3Wp~Q=3}-CpHh1*}UQq+fZ@@P$_2V2HZ(nO#^!`VM7aTof
zL5zh~QEN`$c9>fJs>CkOPVO#KGa99H&;Vno-Q{x5H6^`~TWcxhs-ZhusXYp|PQQ<_
z5p9^GJsDmUJr5EcY)gs6T8180Vtr{9I0(@B5cL5sMBX8*KxonC0~{T-BL8(P1Ou?6
z<tcUh|DsN($2NNI0FBaICU5&%xY>sKg-Zz|GD7BjeuLYfm@A8rNAsF-*j#HNFloHF
z1+oIXmph&?wa9wqndeC+ZQ%-a&#Ijr6*U~7G0ga!&}|%J@C74Y1cXT9!C!=~*x{ed
zO0EX>xJY;Rzlh#B^~eEFuATwprhy{~8E>(MCfYh!mI02(_OA~Z)WtN^{c6%+!wzWN
z+_TDzn^z2CCBbSzK6!mEZ`!Nhm9XOCAgFe^ul;~!nu^W084qGNPwzOF7RojZwst_F
zB9=cC@=sfCW<;IMpJLuA?fdrjZ72A34b!woaU|1MM_CM@dI~+69SixKNf<Dk=_aF_
z)Rq#8l@He9z86#>_0J3(m?{9TXKTC6-v6!mapQ-!HdvIn=}C3%RM!9#BJrNJUDHF5
z_{Dn6lctmRJ+o>hUMAg{Aqsv{0Q1)7t?Ts?#uWZEfMH$xe~_QE&|^UZS$4aPf4l=q
ze91ig2v)3T`c{v6=gGen8hp2y@o7i2WkYF5j(2X&yZ#!BrsWZ4N1~f!Z)98Q9iO2G
zylQztVt~9=^=3O9*0x5eX#<%vDaoPp((>$PeP2_8uKW2$vZ$OJ7eiz-^k5-8^&%cO
zV9(NLY#ut;eEH)|%FZD--(J#(hL%+T8sl#@xzuCUsQBw~z<Kv##}{MBw)a8!Il3-*
znf>uQavvIiF@Im5f^nGj9jE4d6^0F16r$7WZdZ1F#7cUP-I1u!3|(=3^V~|M2LuE6
zHT)uprcG42BKc~It0;*f-ONDV>~`hhL?Uz*ml}*uWXZf-Jo-Sotbex0B!R#9u^eKH
zxWFyU1i@hM0Ub{uc?BIE3(}J=lJe3YXJrN9AjocPX}@25e74Nw_Ct%~2p#c;D8z^`
zr0p=&(!Szmh+4G44yQ@QT#p#De~jtoN8O}7WoBwow5t*jO~6bQ$x8!nRHj4n!ho%G
zqtq+!@lzIT97II<^|*-jgY+lzLIcb+^AZpqpgtPN5{EdcaX_YuJQPq*JF0?tw*CIe
zgS<HRF%{EAvS)FTY%L}DPBlM9A>W8c9!WFr98_|Ei84}HXaKVJCV^MD;7yIs3mX||
ze_C)x0Mt$l(qj(=I34pSBeM$HTvsZ-fOJ8SWAGTtr(H1nwrrGfIE@IDrNF?`_Pq=d
zoaWW+rGK#ccq&zh26*<M+i5Epj{M`heMlWFIKnubO$3TlV7On3aDUSzmwKf<-pB&S
z=m6c;y)ph3;xXi<MTDvU4(vGyhOatA><%@k8D1mNY83DcJiy1ysfd~L0>ARuHh+0l
zaN!~=hA>1#7DAf;nK?v#1{@N86~>%1S5(7VAqJ=`F64N^{_2e(+S4$+yK?ElpF*E~
z;ShuTU_F_ofBBYR$9_pfjMPh7?JG!^X(;p)Y?%*(gUJ_+4E8vT`N70AVAe7J>x_%A
zjR<Mk__lW}s{qI6wGU&9YS9!-k+OZo3RZ;3_q9juM&UR22>QpbLr0Szb)LSjwvW^O
z2GRwGY$%nYQU@~5xK#uoiHxpnkHX|rbsCnN-kDzAQDXS^f%wB>CTQsykV8g~_KXS9
zjUIF%?+4DY62B2|=H2F%v2`$RKYakgK|TJL0T221>>Z=Mu>^)vy2R^#6zUD6Qx@8<
zHzjO|UaNdOH3k&}5_=kVyP5Noj3oDrxuo%6fLI=4a0BMc-AS8;+fA1z=wUqGD1=9d
zWEQKl->QeWSHwII7r@YR36ZW~?8UH_ObpxGg2|tj*YhFeJC39@fQl7Kwlnl*%rED*
zEOS;DGA9OM=-yO$f4K0@)DJC<Ss*SBO6X<fFJC@zwho-mKLR#9L{QvOnOxz6E;Jv_
zcXs9{$#TNrJxrA%3!HSmEq<1#Tu_;;>S0`f*^oz$`a7k$T^ME<iE$IiFh5!%L&<7R
zZE)i`x^dXxLa@hmjP^ImogFc!ufMx#G0${=_2mF+68i8qNi_<Y<Hq~0Fp{b5J3CxW
z-}QN?<6#13u79+Hg5)>Si~(Y?nDgiKCVQHe8_CoZa>qLSMZv{wk=lzlAr_0lt>b#3
zuONhiI-2rt2^vn;j>qeC6UlVx*!@^&ZI(pjMIOdORsIS}cF5HFlM!7u<<uE$Lb%0c
zCt?pJoeiL3o1bWCJ$Qp*X-9*(8ua%1qlYkK<D?V4voBQ07p4a*uS(06&jp0|@jA3l
zVS<q&j6K&Cg=QTNV6H`W>KA2sB5LGY5L<7<5{SW9ub~k1Zm`1jPply&bDbi=qK6Dl
ziJLb|z=_&hl(gNcZSNisOFHZd-%ZIn?2B;;$xo*9*^QYitYIb4lLq^Kx=!;JT6r`8
z(-P=Dku8)rW?ax^Sz!is2c)O5nAW&;|D6%Vc*q18@1xpi&H*^AeW@mWbxi2YkuvP2
z(tP>oP(|y*K}fl?THN?ORPXkAE(h#RjbR&$W9y`-*Aut5!_J#*)TJvr(mZYwlbylL
z#j8gRK+mvCQ9fS-XKT&WUU29=KUQL!AL*+2Q(wNLmTGVhbzw*w%my2(@ye>@VAxQw
z(tatAXug!6jg9P(*?v08<^@75SY<}1XM&T|MjI?EQYLj-o*!c)?*$gU)?ebrsJ=)A
zJ`&gS`%(%DP11LIXU!Rj0)w;34q*M1P>#(Jk9l-8X3<3k*r>aG{XbMaheLNpW>eQu
zCDXcgaskw_P>4I(`fz09u}F7=?6%)1haqU#Zq5O}R~FyXCr^x9g!BpNP$U!8!bV(|
z17E;)83q%LDsYkWA4-Bl0Sd&+vhUn4RiQ$C>=2B5=B=S&9`@ups$JlFawdQPq3!Sj
zqNY$&cPhlqHS!T6mK;`|JG_C?BSxvN6;Nc%gvMP8^lroj<=Cx9Mjgu&-&L8+3S$`_
z`;gJ{)42D646u2n{|MvtOh43@8Ro$(hSFRC-dQaQ&zGZq>bg1e7>ze=KtK=dhfL~l
zg(e9dVS?jW0wtzxuHva{{Hx1k-__i!F2O8q1suT3hlc^B!4pzAQg-{JKp~%1R_XaT
zA0*zY6HS@faMtouvTx_OX7~9634jJaohn-6ayPgoj6i97%&>fT1OI+o+1BKu<@nix
zNyP&ZAiGjR2djrqPkuH)sbE+al2jeY2O@z>>DKzQxs)%o*S!>e0pug&cuA6+doc&Y
zB|<9x&WRlSe(99*euv{^>Eh?Zr4Yjpj96BW+E2dV9gca-EU@o~!tyhPN$at}j8f~u
zm8M?;pBYt0;v+>L?mbrud)R#c#fk=c^pgH<xts!gVFN#nN#8=y+4dm!&>|zEU<GWo
zX!h3;d_y0wS{q;x_D`>^C@)q^zy3P!d96fV8i|MeJCWnYjEvI?L5&5y9U)NKh#J#X
z)VT)jiSo3Pe+tt!5&n26WB@=>$66s}B2O_f_2^jGdpC|p?ME;U&Fca=pQp_yw-0wE
zo`^kQ1HQFM-WdSd-1;3Dg^hYe_MxsIS{Cm(+Ts^()Lg(<69ow16~?dS5#zWF&OO6d
zDJXzGWP!P?M<CpZ-XPu|UCm_W1=V{SesmI61jLN`ROC=ge}`qw^cC{6BbhKU6|(P}
z=}O|$ss0bC7XW43@3ooe-;eaIB9qXEZ|8IsA#;B1R{f2h-6PGl7G58Ju*d*UXXozt
zfB=48m##wH7aSj-W0E=Eb=BwRSt?g_RSpSNk75Xs-wkQmarqyPVgey^&9E^>EBej?
zRg4GP`J>qRP)2pxyK*aa695<=3SnpWOx>M&s4Bp(hhhIBO@)QYj}?DnICktxG+qFj
zW?ol$%%~>`E$uql7!lsAk;loS?r*;I^VWMUs%*~8ZO(*+#N4qyx__*vv22EMcx5{?
zKDcreo)E~h91;aF$W8rh4;*lQJk_V}plps{ohRuO#E#Wr0NV{hTqEWf+zA0Hz$OWa
zYb^69^ZNp=msXWj3_g+qbJdO|&x2j4BAwLyCNWJm=mo36Lk@v(XYzR=u?Jpi7%IuY
ztMq)yb_!9xds#SWfxmb_cG`jnl^1Qiz_%aC{aMKPdUtn#|D6pD5MM%x1K4tY1EEY}
zJ^nw{HH{_$05qBoCC=%wdDnxf4FS}Yv=wXQtwR5=6(j%>GmQLC1<4l~>j6yB3EBTt
zkmUF$oAnuf>mEB7Zm%pmeHG0di_Fn$@U!C3JH#<yRgwc4#v~wnTT)0t`YoXaT;JY!
z8&{4D5PJ82dA15w3RhR<@{a!eIvG|7gd$^H_G-fGR;Q=AE(;oSx%c)5JDaa{7X&}i
zReLucx77Zfw|woqo+Ejl>wmqo@7bnvPS(HW^b+(+ycKB6HUrGHA0i*JQy|h)@$(11
zV-K&dfj3|NKOeR&b3swl(penXMCepJ@L<bNB}u8d?)|<sL%$A=hSEhQ$fHf|I3_iI
z6ChhG1ZufSjE2Lx0qwqr3xkpdChf#T0K2U4^|2Y?!Y|ViG(tQV7zMlGe)f&;V=qAy
zD|vh9V37k`dB#hfGI$-NfaZr_E=qRr^z}m|Imf|VM=lGxhN&$ENlh~lsu!<|R#j#g
ztJwQAlJZFvJ?uIwa@1qiw+4O=4mL(7@Knhf5+87i8PyuR?a3uHm@WMo<4p2HPkJ5u
zkF4O5Kr8UT%5Nxg2eK=N-Ldp3;!hOUrw9v$bNM!5rbBJ6E|bjj7Q3I@Qa7DhGKe}l
zAD6#45Z|_C!O<Q|vLUuTKxUgDF>ueRZ=Dw<b+~Xl5XdRRsyeS8J~(yZ_o~~H@U@<9
zi)VqYCuk6KFn8GW@_FEhXYV_`auluZ>W+s?2!k$BTUg&WatRR%6i=x1?ZIKmX|%&w
zmSn}`lsiu-{SS(;<OAomi(YKhmv09!-*x4l#yH9g<68$MrQ*8=uN4iGByo}IOhU=3
z*{O)YlsdP^9xpmZ4jQn7?QH3<s!Bqrs|*S{l}$P_V~jrba53>vgtMl+77)CGa_}!3
z$?Jcx$nt_#-*V+a^~v31q93Ym94k_?M|fZdDM9^&PrmvR{mSjkG@j$StI={ZRz$B&
zpOn7DA@3@+N+s0jKFF;LiaC>|5<1F>grH2VweH3v-&)jq(kgTshPuKA-3(C@Ol|Kn
zjDZFdXiFl4L2Q$^Q_Zb0)&2F1ZVOky@b31?m^+W(_?`(1GbU{b<bYSO`DJ;d6MItn
zXqI2kdY_n)3~e7>Q+EYDo7oayds5g<;w<yQIxlFj_hP+gxL;QEs*@X%k56qXVoAc~
zg@wo>tBa7MMs+0Oa+_<IggPnY@EaOaq&({0`9<<sYl6Crk8_YHW2p@^GIgpz7J7(>
zw1os%a!Q!xrq~YbJDR~tq_gPHUeq^|T;Dv9PDF_7TJqdam>(THuYn;P&%Y62*-&5&
z;AyYhmb{Ydw&;IS!EC^Of386ave!s*jLRgU8SZwEBe2$OdCPc1Ql-vemHz3w)AY8P
zp&x<5alD$BX0WQDU(^y;nu1H6AF+r3x^d8Xo9~#jT6)bZjD*(3Sef#N63ElB|2_cU
zuugqpZ1a5a(R+8?9i0`y8)SuBFQS{{T~=G<+)dwKC@R!uH7}dRtqk_ElpwRIr0);r
z7RwRUEjQ&be?JzoPe&<l)#w~|j`xv{JAEtWXkQC!%)hB>tnX=V%YbK9;=_O`rZn(r
z74`4b>VRMi_T+<wmRY_rQ8Uw<_@MVWgod_jKTgX12v`H6LY83CCOqOyWvtdt=fx%q
z+l28!1rwfw11E=9%_t9az17H-_G#iD`SXm)N^*4yDwCf4_4_Y}J(z<g>JE}6`HvnJ
zPO=0{h;)_t-h^9q%%yLO2iA*%XH}qV$cp3ptRSy<`P#{s)%1*B{VsTdi?#BMzABXw
zNy_$Eods_kV%D@m*3vsfkx&zGK&c<S!D}!L@whX@D+Q&W!w4QCe+tR-Y)ZOQk^JM>
zKj4Xzn1Ea0N+|F3RFXC)_MwT4&hn$55A4cs4u#}8S@N|V+J%SB-_w7XN{i^+%dNB)
zU7C?OYvDaKEifR_#)(Cdc3HwvH#ndwD@eWtlV`xBqORu+>gI2*OOa>kYheX_k6dZ~
zD`~JRZV8u{RX9{eW7!Hc)jY|oY1AJ6{Y4C-8MU6AWDX6(DHO9D`?^Vx5VSz-8(c2d
zAgKr`J<|b6$t5h+lglA=`S8o}XJ8>Ba)!!wag}j>d`cd_-o*~nQU*>Fw`hI%abi0;
zvXUdA@H6Ul<HMCSq(pib6fdzg%I$<OA%OLRXOmgfLdZy1=s2z740%Y!ElC@8{v=yB
z_pycUDtP;a9}~Z$MF>}fiP+Cds#&Mr&d>Eag0?8)w^VIa)_Ag2C%1b!<wr#p8nvwM
z+}2BXi=S<E6kjhk`Fpsz+gX<T=6P#><Omi2(j~&r^j_5nlE`3wZAln5+E*y!!{TaY
z?QVxk-yX}=;^alP5$j(MOw{pl6@6F$<q^jaP(Bvk#~GLI{OVwlcy;sU@^8fF5y=}}
zS{^YbK_-4{OUl0=JE;2Vi1ohlhHh`?vUil|U$2S<7l&k1$1iR~Z4Wrcp~mmj5autK
zcAdAu{0p%U+!#MT2QQS|OR*Lt7^6p*(+mg~N>P!)+dj7vrD0v33MpARZBoVh#2Nzu
zF(?6vh&BzfUd#F@<u0lrGMjRGgMj+A){^tf0*N$bdE6MMX;E71rC_p)Dj>a(LXLHJ
zRRf?Xl0IJV)sufUB}j2=wcUKHduN=KY9?uwdB+f1SG$65WKS`%wb>4y@(sE{O7eU2
z%nDj+zc75|@i(fB^)PE)H-VKCyn1o@eLM)uaD(8&=2bP)He+p)qQkwdU_yEi=1jdH
zDRxE7bDFD%8v2%_YvUA*yNr)Z9z+`usp&lY(7@|1x-LCdR*E*l#hCd_yRB|-^SGy{
zJxn(zTCl**zQeMljyf*GiH*6-+Z1#gFaI6Af61H|_oJioO?3K(3%&S5)kPY0nf0&y
z9#(W$c3-)51n<`H-xmBa8WCPfuX;aGmsnod;Iin<<^fL-^xef}9G^rSU6y}}weRT?
zs%QkeT!3?{6&&v7dWNS9%711hDXt1RTu)mgIz^ME))j?3_)|9w)tk?zh8KY5x*ko*
z+jZR>tg(Hu-OQw3tW(TW&5-eGz4|3r`R|(3Q%4_%qbm|&B3ViX8plk_sf)w?pFA?f
zvJ77ObrjUs;(hLBC#&>U(p5YDp}bdX{U|9DCE#eW?KqX&V#D0mqQ+Y>KudWGhA-8$
zG=^iOtPC`vnQ2VC>7U^$RnXua4eS*r$pkaH9^0pG7jfTDlvYILG_o%J)WyFZT{2!%
zADj)-NLbMQ%%=Kv$pc5Fi?rR^Gudz9?>&`${pB2O5?t2OGs~)Y)U%4MT9s=MJ^|6r
zHLn_Bc;QO%Zd*@e!$Y$qQGUI&*n^3c75SfR6HX?2tGCtpTHGXch%SVe*N~h;-y5{%
zXoue;Mu0NUYHbKyLC3|DW+=3@of~hhC?VV(!nTV)-g0ys81q0RZV(E*4NsZ7)eQ{l
zG7HU^kpA<??8xhId_Fi2_ZoVBMw*nTI$PuSh!x<HZ<RYNc*#MZqXXee6sm3Eu>FP0
z^r?+qx5(8>`hDb+Q#*BlpGj;#Pj;yJs^H2yP+m==(tk9Zi#yK#8g#XkLS<*oPL`Kl
zmY|xbDf6T8JVC1sgifUI|I&!zTvwYa;<5Y#lXrXT=n*tHCv$b~m|>{Hh7F7n$LIP)
z%x`O)+9hd}ZZvnavGcY(ATX$S@w=*&5x%vZ>)l@k2no6Gra5DazAYUu_iB8$@T8<k
zq+r&`(CB<vVLx$%*)hwAc?>)}tdf++z}iJUv1|Q1ylt#D@f>H{ZuvSmw@K~P&I0)7
zTR7+ha+op8X-9fjya;z1<&Z}aZ=etMx#@z1T|RAp?*L4O-9M9S6yrxbQ`z~vhmtPW
zBl#}7J5jR9P2!)vHvsDX*THW?s_oBR@0H`goVB160!+h1EoL@|a%<Y(r7lA+9&rPA
zhdO?`M)e=zHm7b+A%RaJKX`yG2>iWJt;WejPgA{HiOYbQoe{7u9N2v@d-Cb7ihwHt
zN)BpJE@*RnZ7*P*m%>VTvESg5k)(-d_3~h@X5y~fz%#v;Jj6r~4tm4`9wLU3pPkc5
z5pR_eK2A{snfz!U`1Cc&+=aw}IkW_6^7eB)3?PJ;zV*up=@<2iP8q~SEw%qGqiXp{
zMDfssIdmOql2P4{>S$L1<PW7gagr3fDiqS}v;n+A6L-aek#xZa@G7fl=a0-_W0?E~
z{mF@W{4@P1j_>2nt3TRB7Zp*p>6!Dni_unwO2D>R+c9>VGWINk%3ksH>dZK!`lB)M
zVJG!9Wy6@0$Br`zZIw-QNw!mAx%Z9gA#)(k@40_8%*bJi;5G5WCAZbD9TGgn6Zh5C
zAZ)v-M=36qCjVBg3B~x$@4WO@ej%F9f3uC@J^$lO5Jt|<2R6Uv#XoNk7QT}GZqe$6
z(TC4c%i=bMSc&M+!DuVqu&Wf35bqmxy}P_A$=knnHIxJu_zcsZF8`2SgspR^cgMm*
z40EKm6D%Q(Q&XS6(fKWJ3I4U<eX2)>d{_qSsI<bD+@|oMf=?U5Nq-Z-rQ;g@1h@G7
z?qBNldF!ic2z<`fI`9nlb>J+e(4&HjA$>{0=6w~d?61@GdQv1e;fi%?njeeVke*+%
z-f<2S_DZF>DJ~l+!4%}xK9j@1c?Xxfo85~38+NK%K<C4Sm6_jH-aTE)0!)V=n4<X$
zdPSVC*Pg6IEB@OB1BmWo^Om2{MJj@gqKpbo`awnxg3D@0?)!cgO%ZXcBSY~vM=ezw
zpTV);^ZAqT#9#$V_=yv|Ay4=B`#PQ5gYm++a}`J1QI>~Dy?S&`th<JIiRc^UH--ip
zaxlVJ?tS!#B8@kjQXzQRdYYxG&;ed@*=5fh$_iAw@>Z5xjgDW;N#o>Ry)+Z~N5nCg
zCA&F&g6}wS=VxL_tX}>-ocL2km<>IXrVB<y)HDH#a~BJx@V!TpV`sJOX;n`1<)N%r
zxH7}nQ?^NcE|$bB&5w(FR51RZZ!%(f>b^2$s!omTi7G?{{zI?phtc~PmLYpJ7RKJC
zi6y>}Icl|Ibu8x4w{OM6E{W9#O9|z1_)i25P$Q|1(^NPZrIf!<@nU<xWW787snHt~
zk@K}T+|VvPmHCp@Jhd-fEz#z{%A!_xDMHlY^IubFE_;FE)Lk;wy9DbiOgJgz5}#>;
z34C_&7~N;Kb2aq?pWW<+r-Z5<_Y^HUBn9xgkQA{Q(W9Evmo}cfvgKU<H8WN4us|`+
zNR#-7x|W2tw+QBprXjiy_R+X(_jgdO$rbaf_eMl4RZyHETezqB{>v5h4O+2b)3K2+
z)^Ujy<QT$QYT%-Z46TY4xoYTx(I!@Qc5=NT+(EVU|99c@f3pd{<KqPbeiv>3FWCeH
zW*qUKY{Caek3|5$LH$oQ;i>5hGvkT7Nr|cY)Qh2YH;q<BdAWSmR>p@!Qa#LC-0<Qv
z+?YbVa#%7BhaHVzjJ^S+kOBV2s4zSfQ)^VH3T0Gsf^*~(A5KS%lE!96%4=p%#|V15
z`tvmm#hdrh4Gp%MkZ|5zjb@8G?70Q{?|F&$#b?p%fbVCb^6MX>@^SA!_`hjb6J;V~
z-&4=EKI`}JX36yCx21-pEoC+df7LPmz}FQ^{RF9D8E~!oY&G&0CIKu5#tgf3DF9@L
z3v3Xrj``?S6$-w$z0E@X4&J^aykGJrQ4WDw%~{U%#2lbdMXS33Eat3|!Ho1UQ|I9B
zk0)0IVVl$YKF$Rsxh|dTBcY1xUOuc`gp8UeL$^-1H6>GS@1f6W7Q7IScU^8{?y#Lv
z8qqo^)P~liP$eBbX$VjWb|1`>&g>gCoshGBjEE3*d_(Yb+LMQ|L=B7hdEskvGy8XO
ziOb#54i4pKPQyf>zg;XQrSzwYkcg%}GI#szMQL5!wMv(p`Sfn?H=IAC>9>TNK2y7@
zFNNwNwpBaSmCPy}(Pazw6(Hi3mIlKSjtrAeN!-cu9V2fPkP`45qk0KJgDi>eY(#+F
zfj>#lCy_DTssW!x>(J4ciy9BE%e~Kje*g>hof}BUB|Vg2ukI~Uvhr0M7}{Z=O^JTJ
zXl7d~bP^4HiqBN?2XVoS8^l(eTVY`7tCbr{*3oeOdZ{$fx&AmZs)EM4N_H!0Qm4vW
zXCUKxIoxgG7;C6;pRn-dkQEmc#1<OQAXl~V{xBSG<S_EWs`x3~KqMdw#(G7xXm^Ws
zLQ+1_!duAOGnVVT=ce2ipzLCDzojR72yUYi)`ZuORou(kx|gA~t#DRQp<lV!d_sQ$
zwQ=*^*k>>*<N7u0^?gHC_#w0>5-|in5s&N|w=pXodV)7(?-`%ByCEg<6a4BhV61sB
zDZE~ylbneXrv$g3rqM`LiY&hj_i8EaF8DEAGaS1<vkYR}xxcr`DD7_lP;IS--^gnW
zk%sFzd3xVGc%vf6rxtedI<)tzqC2n1M%UKFwuApd`!=~-xt6wn@jjGT+_ZiG&bV+}
zi8L$vC0!m9$tH*9?uOPVL5WY*ZSS^4uUfmE<MmG?ro`S!_9*5ZYrsB-H=Au+_eH~C
zCp$AqSiEeqmp|S`S!C?|$;geG4~J`fl-0DG{d5$E_*VZ!J!eNeq=8wk^i#Ei2&d+W
z=iBYI)mxb{<9D7!=n~h|HbJ9DI~y=Yf?HVfK%iK6c!r3$brY+_&>ZgbOk8z$4*ce>
zu@3#5E9nLa7`LNXwmF34D#b2O_E{w3<AWlrA9QfKN}3w<!?;^buV3_860ExCEKKza
ze^R&hMW423Tw-Ux7TM1c-8GtNzptqBs3!R~XL)#YT#)>*Ua@)Gg^wq#bH3B7UCKKS
z+y`U4ob7S0;pv~)YMF>(r)(J#o8V<FjyZ^pLEd)=j(FpJ`hMpHie-bri0`WYcu#7>
zv)S)%v$qHtuxKM+mX;hDG^#SQgM)t?_S8e1fQOB$WHv*YZY;vj98(c);)uC}q*cr}
znoO@l?ejH~kqo!oQNDjHYIJ36;dNB@T8qN<tkWq_O8rD3S1T^4w4J_TJIK+Ewq!xB
z>GPKJ!x-Lon$O(C)ib<rMy{~rnEC>vD84+}JNHcMG_2=WY*euyvL?A=pI1l?=CWyO
z@Tk?xX^~YQS6i}Oe!y@n{=-6)hbFAwE|4L599uLoiA>mZyJKf^=R8vD)b{$(A3pyD
zs~5^hmkdWey5d<&wEnnV1-QXNa>Vn+(dP%a%UsH^9a&?8qlHJBPoGgfLETL6n@*R~
zTT^BkSb10Wva}>?^B`3Yajy@@mwwbeae_<}27mu_`4boSLJR!iy-1zZb=OZ_f}5V}
zqh7v&k54jzkvD<<kfVzJlYVeA!QmeGs3a}GO5#_k9=t)q?A{V~8XJ;HdVg-WqUn?U
zJ%%#gP*XF=k`4dZ-<8zU7(Hn7<5*zjVo}m%g9zvEsYNMMiwivahDl8EImc~V`C8?(
zL-W`kaR0QorDEa{7nUVgXq1t5opF%)HnvkzyZqI3WFLE3+>v==4_NW6|2EflFLr!8
zw}k0F6<nzQ2U}>ynS6ELQeEKhH-%=B1-eu(;`jXU-v@J`bcYTy_f%DnKMQZ)SbI<n
z?l;6n-?dy<<MUCh%(^7ZGeju|_RYRKd9tlZuR{%L)9Mx&@D5Q60Kay+u)Cd7^7U45
z1^s4jUm_arwC-MPwpLu$0+wdY!@XzP?M>AxFo*mSKbfEQn78RDU{ptm5_Ew!rr_iC
zS0wUZ%JSpn>kCTOKyF;@`<rbL-NWwM%IfXUN`P_?6b*zc7v53H2TGrV1DQSn6y1lv
z5@0oIXR%G-3aBZh<CFkS-nF01+W3=w=M#4NX3QY?1<haCKaw|zuFv@J_25mozMjsm
z{LlDCkFr+!*tFk$L=f3san~Py?v!klpO7+~#2F*~HojLqIF${rV~Mcvd?v>RQjPh3
zGZb0xRD(@*DZ8iFU&h_X9^6iTHZ=kgy|s+1#pizx4*S*ygt75IuljF8iw}jye0GXP
zi~9)OGdu;4{4a+8->0nn|1tc=;L9ig!0!AX!=GXPoNS7`5A8g3F5PPJvoltdqJttp
z@?}C#VB7Sl4Bp$&y|A>&D4CObBD}968`*S)fgJK0fg=W75#-lQp)w66&$kpfd4)H=
z5S8oB7EfM~X^jhd+S?x(o@LXJq-J~CvsHgik%jcwo#mq4synBuq~X4UjrZ%upWZWZ
z;>F@=r1J+nIqCNg=5E|<T5}mB#u6V7%JW}0J-AEbil!F_(nWo+-_7Ha&t<eehd$=V
zE}_$D3K>qnHTcFU_2a%f6_b$Y9-+ye2k$3+PGue{J&>Nq2XUe2W(j>I$t5^bcdBCq
z3p2+{h9QhH-Y)gRv1B*8&vF(1^a~+XZGu&XE}av0j)9Xe9idML<X;KsrvugY-_*Zy
zKtl^q>Iehe?IxSHd;J2&CbHHBH|n<zMXkr?d=!#q`q{5u*lNJIisMcLX4n{`$C2j)
z!z(jWBtW;B8P32q>$iLN?ux8#79caFGgg+WZAbxmwL`L{GOwdQ`L);npD~|8ei4lL
z@zo=6%98gw-!_K#b>SlHabO0#CF<(0ZZfeC#SbO_PDgq#snv)UHb$!DE#1ag6D+L*
zIfXJ6bWc2k5eY#12TEbJVjd{I{>V}{mlYO%)MEU=uPY-;aiVMAHrHj>MDxRGcqG6h
z7yS(ir#vCLHzO$bovDb>k}Ue}&xu8g(D?yTXMcz9X30|)omTI=^Q<!tFMe0hiaA0H
zK3<N@tm2EP`p64n3UXsS#_Us^HB(y`GjyFQr%7s*O&siN<9CURWX=DEJ)ZCa@=os1
z`Q^C4_}tI^j6WYMUp8((-8f@NS=xwL#sx<SeL_^+6}iGM?v?yd)Dz(pFe#W)acypM
zvnE+ja0bV9xog#rB#rVevRr}kzbPJ{)&TX9j1sNux$au>l*d!r2g@Ymh3|w21Pmi<
znPZ!<;g)BEClxw{^B-)sHRoB}8!vN*4J*mnk<!(J&5+?EE(#T;!J%;*;f<yc)xuzk
zW&d%e+A(nlmg@qla$7w93+7s(3&Vk^Qpd8KAHzhUUz?r|iqaId3c4t($i5Y-(!o8P
z=Xno?GKsU=7-|a|elT}R|3wh8>Yz};wujB2YMdzvA)HkVe%PCH`J^tscNEn8=xFue
zUjF*qU%?9M(iCdzrk`e)?6$&zrC(NEp!|^A44%#9i#Kh%-$o=I%f1`1FC6tdf*P6i
zxI`QhG=JESe<&4(>l|b#mrMv)85aKd>hD<AZ?>7U_$HNY<d@0Boaq@zSnZOqOag!6
z>du2#p0Z-h!to-NM}N&vf5smt33vIe$)n?H?}(a+li~LaHk<c!Gr?|lIZQrdt7n8=
zL;7NC;Y`<~8NAqHSK*BAy|a=h=94R}pcb=T826@HW9+d5gChm>&b-U9eRDuiMigO{
z(Qan?BHFm3n71FlK<BAc3|52lrh4w*Rv@&CVCQp#X`Wl7M|~!v(aVoCAN$E6vPS7_
zE*|_zL~BFH%Ti}5?%$4I+BlgP@^5*idj}m8{oAjGjE*n+>u+zm_RD~)lnok^ilEH!
zHudF-vu6{6(2(Cl5;8Q?nSH(r8IMp^fuliv#jhRaS@37ipWgFo_!S=X1}BA?*h9x+
zm1yI~OHY@jZ|StDceSPq5ori0;wDutVgr`Th$<$eNF*d$dnv6^0b(2Ys*P0l$O=tG
zP>#VC1E6uxbKBR|Ut-UBd(N>+?zwC32=|FhDt!#>)MU^^yb|coVVtDa77b;o%S#*#
zFgK0Y1C9U4ioM_QKzVD&4s5NZFzppxJeT$|-zrWaPC(kUqAP(bZt11V7kmY5=7E}#
zH$I?MOTZFjmrXP7Pksf-Fm@SuuDcbKiLJe<EV@)yp**EVm^2pCgY(B?P*{be@h5Wi
zJ=URNeQf5{fK9G}Zn)OpUYpVj{q1@*{mdhjo->tI#i=O<$kFIbFDK<)W?cCHg8B@Y
zafbh(zNeqx2>@W#{157<4>_9|lJ<4~nLl6bn93B1og^h~2*v+eJdTzNe;3;3&Z@W2
z0-JAfa*C|qQdfe{N5?i*{?_xbl^cHhkSCQh)K;#(QD5C@R7mjP=RCd2K6R-Yn_H0L
zy;&u~C+nU5U3tf=Ii67-=`Ivj6b$bh6gXwu%Wwl#Bi<9fhuB|B-V?E^d{Cm^C?kN}
zJsHyhKATeQ3Sj%C$%S}gi?cBl!dzbR0p(*Xy<=a$)XJ}|is@a)lbNu?ID<q9sh;!&
zrScdg6&Z&bU1q3o^fJCYVL>HHzQn<8phrMZF~brJQyJ?-Ail4Dx5S1IYrUBBBnzUu
z0QhJkHQooPYNHE|`*A0F9Uwi75z{;P{p)p}=y$ZA<Ieg=7aG0BbEh`3>l~9VhGZfH
z*hR&G3y;ciE{K?S+-Z8ZE$dtB(5i0dJ1?4hb_c&gkRc2Vo6e9TY+qdj{9fsTY5$tW
zags>&7yY+aM;p4H8rp`II+AArGy;*rkyHHO;$}z=8L9?8PZlY(Qpr#GbiGW+ja(%-
ziOu*!tsU)kbrhw&j9#<mLNpZ&tHn8tQ60oMcBJ80arFfKiC6uE^VJL2j%>$k1!8iA
zWC}AZmXZW8F$1Cd6mDU&JU?g_59*!U^{q*Jrd0l|GWVEoef8eZEo`x#A~_4&dSeLs
zQ8REvu&V#^B4;+D5Q+Dtqg&6Mmr6X>(Nsfzmg}Q@@~_g(>yFkr$oICo*bvP*FWWlZ
zVnG<g)CZmg<VfFWVtY2kT<*Zc2q*e{@RIoPV%6hh(UYiau8FHePzUSVr8^@~V(B+?
zUe3^VHCWsVK-aL|S52>ZHk9JnC97$>Cc^W7Hh0an<{NTn!<H_bW%8?~{W6OYgQn(p
zwP*j?K8WqBU3sjB?ROB*>>%3=wUq21hL$@^@~-SoX51p4e!pk=%MROw&*uvyTI%m?
zdvv-qOXj{Z<E*F4(^yRMdm7#`|5)(4?s@aJx$`fpq%Yt1=j-xLh60Im$0t@r?0&al
zp=Lu`%=T-w0*?FM-qB?ZmvgUCark`ZjiBJ3i`S&HuQ`9HYv9j`->Z65VcPde>sQtL
zvNXuf^>pHkiC<!Q#N+^f?wU6poGUl(zhCxkap6(JH-0yw=G1DY)Y)AQ`g4=}0DlSN
zpC4zno$?Z&y$LE-XK39QeyaGgs;l^97h5*tC(|xl|6PBm>TsQX>AOe8)`G_u@VEq8
zD@sq@yyb;obV9YY)(z+6(!aLp<$v2x>K&*D9v$-kzh6b?8vV+D?+Ijc&^aUm;A}4c
z`F|qt$dQwfY`$f(eYQxT$kFqa#+$9{g~YidLtI!6Dg^E>`Sy(Y24_>#()kLj*QhLF
zlxF2t>|NSqCiaUrr%7!=Sd+x;2DXWJ=b9Vmzni)}v9#P#P%Pj4{k+e+i=Uq{p0P2F
zt>wSgo3*;zl-YDeexFZ$(X_Me_o2dxaV`y)1IiQ^Z~k}dP@>moxhba=f}BDdJC3NY
zeN!p6U0ggXeHTOj#1jl$3*tF*oIZH*zB^L5A!I7k#o7#GqZ8icwr_Ln7tFV^DE^i>
z%kBCSk&0f$0}UEwqFJ1_DhV7vE}osBp;bBgO0@TzLw}<b<88MKx*rsMt@v*X)054O
zVGPEtma7&pGBGJ_k}2O7@3&;anw;3P-rrU7Br5jTJ-+Zp^p^S;YeDmls4q89^t_aq
zJom+<(y!ec6uz+6m;d#$RoXsDddJkl^DGVhW~(h$>WNq1;4Rt1cqFNT@x8hAd%Hh^
z4^BVp<qnL#JxRkY(XCBl%2&Uy8)N2Q^Jn<->?E_+E-4q5ehmrj6%HN_3%5u4-+%vC
zbVB>hUKL*dANq4uT*~I0c*eWt^7Z2W`*}XI4gYDsz8m~`+X2Vh<>wu*9KKr1q|3SV
e_}7QtfBI+rH2cQ`N&)vKZ~gJRe(PG~6aWAvO9`j|

literal 0
HcmV?d00001

diff --git a/client/ui/build/windows/info.json b/client/ui/build/windows/info.json
new file mode 100644
index 000000000..a67c8fd81
--- /dev/null
+++ b/client/ui/build/windows/info.json
@@ -0,0 +1,15 @@
+{
+	"fixed": {
+		"file_version": "0.0.1"
+	},
+	"info": {
+		"0000": {
+			"ProductVersion": "0.0.1",
+			"CompanyName": "NetBird",
+			"FileDescription": "NetBird desktop client",
+			"LegalCopyright": "NetBird GmbH",
+			"ProductName": "NetBird",
+			"Comments": "This is a comment"
+		}
+	}
+}
\ No newline at end of file
diff --git a/client/ui/build/windows/msix/app_manifest.xml b/client/ui/build/windows/msix/app_manifest.xml
new file mode 100644
index 000000000..0ae55ce77
--- /dev/null
+++ b/client/ui/build/windows/msix/app_manifest.xml
@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Package
+  xmlns="http://schemas.microsoft.com/appx/manifest/foundation/windows10"
+  xmlns:uap="http://schemas.microsoft.com/appx/manifest/uap/windows10"
+  xmlns:uap3="http://schemas.microsoft.com/appx/manifest/uap/windows10/3"
+  xmlns:rescap="http://schemas.microsoft.com/appx/manifest/foundation/windows10/restrictedcapabilities"
+  xmlns:desktop="http://schemas.microsoft.com/appx/manifest/desktop/windows10"
+  IgnorableNamespaces="uap3">
+  
+  <Identity 
+    Name="io.netbird.client"
+    Publisher="CN=NetBird"
+    Version="0.0.1.0" 
+    ProcessorArchitecture="x64" />
+  
+  <Properties>
+    <DisplayName>NetBird</DisplayName>
+    <PublisherDisplayName>NetBird</PublisherDisplayName>
+    <Description>NetBird desktop client</Description>
+    <Logo>Assets\StoreLogo.png</Logo>
+  </Properties>
+  
+  <Dependencies>
+    <TargetDeviceFamily Name="Windows.Desktop" MinVersion="10.0.17763.0" MaxVersionTested="10.0.19041.0" />
+  </Dependencies>
+  
+  <Resources>
+    <Resource Language="en-us" />
+  </Resources>
+  
+  <Applications>
+    <Application Id="io.netbird.client" Executable="netbird-ui" EntryPoint="Windows.FullTrustApplication">
+      <uap:VisualElements
+        DisplayName="NetBird"
+        Description="NetBird desktop client"
+        BackgroundColor="transparent"
+        Square150x150Logo="Assets\Square150x150Logo.png"
+        Square44x44Logo="Assets\Square44x44Logo.png">
+        <uap:DefaultTile Wide310x150Logo="Assets\Wide310x150Logo.png" />
+        <uap:SplashScreen Image="Assets\SplashScreen.png" />
+      </uap:VisualElements>
+      
+      <Extensions>
+        <desktop:Extension Category="windows.fullTrustProcess" Executable="netbird-ui" />
+        
+        
+      </Extensions>
+    </Application>
+  </Applications>
+  
+  <Capabilities>
+    <rescap:Capability Name="runFullTrust" />
+    
+  </Capabilities>
+</Package>
diff --git a/client/ui/build/windows/msix/template.xml b/client/ui/build/windows/msix/template.xml
new file mode 100644
index 000000000..437a68097
--- /dev/null
+++ b/client/ui/build/windows/msix/template.xml
@@ -0,0 +1,54 @@
+<?xml version="1.0" encoding="utf-8"?>
+<MsixPackagingToolTemplate
+    xmlns="http://schemas.microsoft.com/msix/packaging/msixpackagingtool/template/2022">
+    <Settings
+        AllowTelemetry="false"
+        ApplyACLsToPackageFiles="true"
+        GenerateCommandLineFile="true"
+        AllowPromptForPassword="false">
+    </Settings>
+    <Installer
+        Path="netbird-ui"
+        Arguments=""
+        InstallLocation="C:\Program Files\NetBird\NetBird">
+    </Installer>
+    <PackageInformation
+        PackageName="NetBird"
+        PackageDisplayName="NetBird"
+        PublisherName="CN=NetBird"
+        PublisherDisplayName="NetBird"
+        Version="0.0.1.0"
+        PackageDescription="NetBird desktop client">
+        <Capabilities>
+            <Capability Name="runFullTrust" />
+            
+        </Capabilities>
+        <Applications>
+            <Application
+                Id="io.netbird.client"
+                Description="NetBird desktop client"
+                DisplayName="NetBird"
+                ExecutableName="netbird-ui"
+                EntryPoint="Windows.FullTrustApplication">
+                
+            </Application>
+        </Applications>
+        <Resources>
+            <Resource Language="en-us" />
+        </Resources>
+        <Dependencies>
+            <TargetDeviceFamily Name="Windows.Desktop" MinVersion="10.0.17763.0" MaxVersionTested="10.0.19041.0" />
+        </Dependencies>
+        <Properties>
+            <Framework>false</Framework>
+            <DisplayName>NetBird</DisplayName>
+            <PublisherDisplayName>NetBird</PublisherDisplayName>
+            <Description>NetBird desktop client</Description>
+            <Logo>Assets\AppIcon.png</Logo>
+        </Properties>
+    </PackageInformation>
+    <SaveLocation PackagePath="netbird-ui.msix" />
+    <PackageIntegrity>
+        <CertificatePath></CertificatePath>
+    </PackageIntegrity>
+</MsixPackagingToolTemplate>
diff --git a/client/ui/build/windows/nsis/project.nsi b/client/ui/build/windows/nsis/project.nsi
new file mode 100644
index 000000000..8d2530972
--- /dev/null
+++ b/client/ui/build/windows/nsis/project.nsi
@@ -0,0 +1,114 @@
+Unicode true
+
+####
+## Please note: Template replacements don't work in this file. They are provided with default defines like
+## mentioned underneath.
+## If the keyword is not defined, "wails_tools.nsh" will populate them.
+## If they are defined here, "wails_tools.nsh" will not touch them. This allows you to use this project.nsi manually
+## from outside of Wails for debugging and development of the installer.
+## 
+## For development first make a wails nsis build to populate the "wails_tools.nsh":
+## > wails build --target windows/amd64 --nsis
+## Then you can call makensis on this file with specifying the path to your binary:
+## For a AMD64 only installer:
+## > makensis -DARG_WAILS_AMD64_BINARY=..\..\bin\app.exe
+## For a ARM64 only installer:
+## > makensis -DARG_WAILS_ARM64_BINARY=..\..\bin\app.exe
+## For a installer with both architectures:
+## > makensis -DARG_WAILS_AMD64_BINARY=..\..\bin\app-amd64.exe -DARG_WAILS_ARM64_BINARY=..\..\bin\app-arm64.exe
+####
+## The following information is taken from the wails_tools.nsh file, but they can be overwritten here.
+####
+## !define INFO_PROJECTNAME    "my-project" # Default "netbird-ui"
+## !define INFO_COMPANYNAME    "My Company" # Default "NetBird"
+## !define INFO_PRODUCTNAME    "My Product Name" # Default "NetBird"
+## !define INFO_PRODUCTVERSION "1.0.0"     # Default "0.0.1"
+## !define INFO_COPYRIGHT      "(c) Now, My Company" # Default "© 2026, My Company"
+###
+## !define PRODUCT_EXECUTABLE  "Application.exe"      # Default "${INFO_PROJECTNAME}.exe"
+## !define UNINST_KEY_NAME     "UninstKeyInRegistry"  # Default "${INFO_COMPANYNAME}${INFO_PRODUCTNAME}"
+####
+## !define REQUEST_EXECUTION_LEVEL "admin"            # Default "admin"  see also https://nsis.sourceforge.io/Docs/Chapter4.html
+####
+## Include the wails tools
+####
+!include "wails_tools.nsh"
+
+# The version information for this two must consist of 4 parts
+VIProductVersion "${INFO_PRODUCTVERSION}.0"
+VIFileVersion    "${INFO_PRODUCTVERSION}.0"
+
+VIAddVersionKey "CompanyName"     "${INFO_COMPANYNAME}"
+VIAddVersionKey "FileDescription" "${INFO_PRODUCTNAME} Installer"
+VIAddVersionKey "ProductVersion"  "${INFO_PRODUCTVERSION}"
+VIAddVersionKey "FileVersion"     "${INFO_PRODUCTVERSION}"
+VIAddVersionKey "LegalCopyright"  "${INFO_COPYRIGHT}"
+VIAddVersionKey "ProductName"     "${INFO_PRODUCTNAME}"
+
+# Enable HiDPI support. https://nsis.sourceforge.io/Reference/ManifestDPIAware
+ManifestDPIAware true
+
+!include "MUI.nsh"
+
+!define MUI_ICON "..\icon.ico"
+!define MUI_UNICON "..\icon.ico"
+# !define MUI_WELCOMEFINISHPAGE_BITMAP "resources\leftimage.bmp" #Include this to add a bitmap on the left side of the Welcome Page. Must be a size of 164x314
+!define MUI_FINISHPAGE_NOAUTOCLOSE # Wait on the INSTFILES page so the user can take a look into the details of the installation steps
+!define MUI_ABORTWARNING # This will warn the user if they exit from the installer.
+
+!insertmacro MUI_PAGE_WELCOME # Welcome to the installer page.
+# !insertmacro MUI_PAGE_LICENSE "resources\eula.txt" # Adds a EULA page to the installer
+!insertmacro MUI_PAGE_DIRECTORY # In which folder install page.
+!insertmacro MUI_PAGE_INSTFILES # Installing page.
+!insertmacro MUI_PAGE_FINISH # Finished installation page.
+
+!insertmacro MUI_UNPAGE_INSTFILES # Uninstalling page
+
+!insertmacro MUI_LANGUAGE "English" # Set the Language of the installer
+
+## The following two statements can be used to sign the installer and the uninstaller. The path to the binaries are provided in %1
+#!uninstfinalize 'signtool --file "%1"'
+#!finalize 'signtool --file "%1"'
+
+Name "${INFO_PRODUCTNAME}"
+OutFile "..\..\..\bin\${INFO_PROJECTNAME}-${ARCH}-installer.exe" # Name of the installer's file.
+InstallDir "$PROGRAMFILES64\${INFO_COMPANYNAME}\${INFO_PRODUCTNAME}" # Default installing folder ($PROGRAMFILES is Program Files folder).
+ShowInstDetails show # This will always show the installation details.
+
+Function .onInit
+   !insertmacro wails.checkArchitecture
+FunctionEnd
+
+Section
+    !insertmacro wails.setShellContext
+
+    !insertmacro wails.webview2runtime
+
+    SetOutPath $INSTDIR
+    
+    !insertmacro wails.files
+
+    CreateShortcut "$SMPROGRAMS\${INFO_PRODUCTNAME}.lnk" "$INSTDIR\${PRODUCT_EXECUTABLE}"
+    CreateShortCut "$DESKTOP\${INFO_PRODUCTNAME}.lnk" "$INSTDIR\${PRODUCT_EXECUTABLE}"
+
+    !insertmacro wails.associateFiles
+    !insertmacro wails.associateCustomProtocols
+    
+    !insertmacro wails.writeUninstaller
+SectionEnd
+
+Section "uninstall" 
+    !insertmacro wails.setShellContext
+
+    RMDir /r "$AppData\${PRODUCT_EXECUTABLE}" # Remove the WebView2 DataPath
+
+    RMDir /r $INSTDIR
+
+    Delete "$SMPROGRAMS\${INFO_PRODUCTNAME}.lnk"
+    Delete "$DESKTOP\${INFO_PRODUCTNAME}.lnk"
+
+    !insertmacro wails.unassociateFiles
+    !insertmacro wails.unassociateCustomProtocols
+
+    !insertmacro wails.deleteUninstaller
+SectionEnd
diff --git a/client/ui/build/windows/nsis/wails_tools.nsh b/client/ui/build/windows/nsis/wails_tools.nsh
new file mode 100644
index 000000000..b63101b32
--- /dev/null
+++ b/client/ui/build/windows/nsis/wails_tools.nsh
@@ -0,0 +1,236 @@
+# DO NOT EDIT - Generated automatically by `wails build`
+
+!include "x64.nsh"
+!include "WinVer.nsh"
+!include "FileFunc.nsh"
+
+!ifndef INFO_PROJECTNAME
+    !define INFO_PROJECTNAME "netbird-ui"
+!endif
+!ifndef INFO_COMPANYNAME
+    !define INFO_COMPANYNAME "NetBird"
+!endif
+!ifndef INFO_PRODUCTNAME
+    !define INFO_PRODUCTNAME "NetBird"
+!endif
+!ifndef INFO_PRODUCTVERSION
+    !define INFO_PRODUCTVERSION "0.0.1"
+!endif
+!ifndef INFO_COPYRIGHT
+    !define INFO_COPYRIGHT "NetBird GmbH"
+!endif
+!ifndef PRODUCT_EXECUTABLE
+    !define PRODUCT_EXECUTABLE "${INFO_PROJECTNAME}.exe"
+!endif
+!ifndef UNINST_KEY_NAME
+    !define UNINST_KEY_NAME "${INFO_COMPANYNAME}${INFO_PRODUCTNAME}"
+!endif
+!define UNINST_KEY "Software\Microsoft\Windows\CurrentVersion\Uninstall\${UNINST_KEY_NAME}"
+
+!ifndef REQUEST_EXECUTION_LEVEL
+    !define REQUEST_EXECUTION_LEVEL "admin"
+!endif
+
+RequestExecutionLevel "${REQUEST_EXECUTION_LEVEL}"
+
+!ifdef ARG_WAILS_AMD64_BINARY
+    !define SUPPORTS_AMD64
+!endif
+
+!ifdef ARG_WAILS_ARM64_BINARY
+    !define SUPPORTS_ARM64
+!endif
+
+!ifdef SUPPORTS_AMD64
+    !ifdef SUPPORTS_ARM64
+        !define ARCH "amd64_arm64"
+    !else
+        !define ARCH "amd64"
+    !endif
+!else
+    !ifdef SUPPORTS_ARM64
+        !define ARCH "arm64"
+    !else
+        !error "Wails: Undefined ARCH, please provide at least one of ARG_WAILS_AMD64_BINARY or ARG_WAILS_ARM64_BINARY"
+    !endif
+!endif
+
+!macro wails.checkArchitecture
+    !ifndef WAILS_WIN10_REQUIRED
+        !define WAILS_WIN10_REQUIRED "This product is only supported on Windows 10 (Server 2016) and later."
+    !endif
+
+    !ifndef WAILS_ARCHITECTURE_NOT_SUPPORTED
+        !define WAILS_ARCHITECTURE_NOT_SUPPORTED "This product can't be installed on the current Windows architecture. Supports: ${ARCH}"
+    !endif
+
+    ${If} ${AtLeastWin10}
+        !ifdef SUPPORTS_AMD64
+            ${if} ${IsNativeAMD64}
+                Goto ok
+            ${EndIf}
+        !endif
+
+        !ifdef SUPPORTS_ARM64
+            ${if} ${IsNativeARM64}
+                Goto ok
+            ${EndIf}
+        !endif
+
+        IfSilent silentArch notSilentArch
+        silentArch:
+            SetErrorLevel 65
+            Abort
+        notSilentArch:
+            MessageBox MB_OK "${WAILS_ARCHITECTURE_NOT_SUPPORTED}"
+            Quit
+    ${else}
+        IfSilent silentWin notSilentWin
+        silentWin:
+            SetErrorLevel 64
+            Abort
+        notSilentWin:
+            MessageBox MB_OK "${WAILS_WIN10_REQUIRED}"
+            Quit
+    ${EndIf}
+
+    ok:
+!macroend
+
+!macro wails.files
+    !ifdef SUPPORTS_AMD64
+        ${if} ${IsNativeAMD64}
+            File "/oname=${PRODUCT_EXECUTABLE}" "${ARG_WAILS_AMD64_BINARY}"
+        ${EndIf}
+    !endif
+
+    !ifdef SUPPORTS_ARM64
+        ${if} ${IsNativeARM64}
+            File "/oname=${PRODUCT_EXECUTABLE}" "${ARG_WAILS_ARM64_BINARY}"
+        ${EndIf}
+    !endif
+!macroend
+
+!macro wails.writeUninstaller
+    WriteUninstaller "$INSTDIR\uninstall.exe"
+
+    SetRegView 64
+    WriteRegStr HKLM "${UNINST_KEY}" "Publisher" "${INFO_COMPANYNAME}"
+    WriteRegStr HKLM "${UNINST_KEY}" "DisplayName" "${INFO_PRODUCTNAME}"
+    WriteRegStr HKLM "${UNINST_KEY}" "DisplayVersion" "${INFO_PRODUCTVERSION}"
+    WriteRegStr HKLM "${UNINST_KEY}" "DisplayIcon" "$INSTDIR\${PRODUCT_EXECUTABLE}"
+    WriteRegStr HKLM "${UNINST_KEY}" "UninstallString" "$\"$INSTDIR\uninstall.exe$\""
+    WriteRegStr HKLM "${UNINST_KEY}" "QuietUninstallString" "$\"$INSTDIR\uninstall.exe$\" /S"
+
+    ${GetSize} "$INSTDIR" "/S=0K" $0 $1 $2
+    IntFmt $0 "0x%08X" $0
+    WriteRegDWORD HKLM "${UNINST_KEY}" "EstimatedSize" "$0"
+!macroend
+
+!macro wails.deleteUninstaller
+    Delete "$INSTDIR\uninstall.exe"
+
+    SetRegView 64
+    DeleteRegKey HKLM "${UNINST_KEY}"
+!macroend
+
+!macro wails.setShellContext
+    ${If} ${REQUEST_EXECUTION_LEVEL} == "admin"
+        SetShellVarContext all
+    ${else}
+        SetShellVarContext current
+    ${EndIf}
+!macroend
+
+# Install webview2 by launching the bootstrapper
+# See https://docs.microsoft.com/en-us/microsoft-edge/webview2/concepts/distribution#online-only-deployment
+!macro wails.webview2runtime
+    !ifndef WAILS_INSTALL_WEBVIEW_DETAILPRINT
+        !define WAILS_INSTALL_WEBVIEW_DETAILPRINT "Installing: WebView2 Runtime"
+    !endif
+
+    SetRegView 64
+	# If the admin key exists and is not empty then webview2 is already installed
+	ReadRegStr $0 HKLM "SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" "pv"
+    ${If} $0 != ""
+        Goto ok
+    ${EndIf}
+
+    ${If} ${REQUEST_EXECUTION_LEVEL} == "user"
+        # If the installer is run in user level, check the user specific key exists and is not empty then webview2 is already installed
+	    ReadRegStr $0 HKCU "Software\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}" "pv"
+        ${If} $0 != ""
+            Goto ok
+        ${EndIf}
+     ${EndIf}
+    
+	SetDetailsPrint both
+    DetailPrint "${WAILS_INSTALL_WEBVIEW_DETAILPRINT}"
+    SetDetailsPrint listonly
+    
+    InitPluginsDir
+    CreateDirectory "$pluginsdir\webview2bootstrapper"
+    SetOutPath "$pluginsdir\webview2bootstrapper"
+    File "MicrosoftEdgeWebview2Setup.exe"
+    ExecWait '"$pluginsdir\webview2bootstrapper\MicrosoftEdgeWebview2Setup.exe" /silent /install'
+    
+    SetDetailsPrint both
+    ok:
+!macroend
+
+# Copy of APP_ASSOCIATE and APP_UNASSOCIATE macros from here https://gist.github.com/nikku/281d0ef126dbc215dd58bfd5b3a5cd5b
+!macro APP_ASSOCIATE EXT FILECLASS DESCRIPTION ICON COMMANDTEXT COMMAND
+  ; Backup the previously associated file class
+  ReadRegStr $R0 SHELL_CONTEXT "Software\Classes\.${EXT}" ""
+  WriteRegStr SHELL_CONTEXT "Software\Classes\.${EXT}" "${FILECLASS}_backup" "$R0"
+
+  WriteRegStr SHELL_CONTEXT "Software\Classes\.${EXT}" "" "${FILECLASS}"
+
+  WriteRegStr SHELL_CONTEXT "Software\Classes\${FILECLASS}" "" `${DESCRIPTION}`
+  WriteRegStr SHELL_CONTEXT "Software\Classes\${FILECLASS}\DefaultIcon" "" `${ICON}`
+  WriteRegStr SHELL_CONTEXT "Software\Classes\${FILECLASS}\shell" "" "open"
+  WriteRegStr SHELL_CONTEXT "Software\Classes\${FILECLASS}\shell\open" "" `${COMMANDTEXT}`
+  WriteRegStr SHELL_CONTEXT "Software\Classes\${FILECLASS}\shell\open\command" "" `${COMMAND}`
+!macroend
+
+!macro APP_UNASSOCIATE EXT FILECLASS
+  ; Backup the previously associated file class
+  ReadRegStr $R0 SHELL_CONTEXT "Software\Classes\.${EXT}" `${FILECLASS}_backup`
+  WriteRegStr SHELL_CONTEXT "Software\Classes\.${EXT}" "" "$R0"
+
+  DeleteRegKey SHELL_CONTEXT `Software\Classes\${FILECLASS}`
+!macroend
+
+!macro wails.associateFiles
+    ; Create file associations
+    
+!macroend
+
+!macro wails.unassociateFiles
+    ; Delete app associations
+    
+!macroend
+
+!macro CUSTOM_PROTOCOL_ASSOCIATE PROTOCOL DESCRIPTION ICON COMMAND
+  DeleteRegKey SHELL_CONTEXT "Software\Classes\${PROTOCOL}"
+  WriteRegStr SHELL_CONTEXT "Software\Classes\${PROTOCOL}" "" "${DESCRIPTION}"
+  WriteRegStr SHELL_CONTEXT "Software\Classes\${PROTOCOL}" "URL Protocol" ""
+  WriteRegStr SHELL_CONTEXT "Software\Classes\${PROTOCOL}\DefaultIcon" "" "${ICON}"
+  WriteRegStr SHELL_CONTEXT "Software\Classes\${PROTOCOL}\shell" "" ""
+  WriteRegStr SHELL_CONTEXT "Software\Classes\${PROTOCOL}\shell\open" "" ""
+  WriteRegStr SHELL_CONTEXT "Software\Classes\${PROTOCOL}\shell\open\command" "" "${COMMAND}"
+!macroend
+
+!macro CUSTOM_PROTOCOL_UNASSOCIATE PROTOCOL
+  DeleteRegKey SHELL_CONTEXT "Software\Classes\${PROTOCOL}"
+!macroend
+
+!macro wails.associateCustomProtocols
+    ; Create custom protocols associations
+    
+!macroend
+
+!macro wails.unassociateCustomProtocols
+    ; Delete app custom protocol associations
+    
+!macroend
\ No newline at end of file
diff --git a/client/ui/build/windows/wails.exe.manifest b/client/ui/build/windows/wails.exe.manifest
new file mode 100644
index 000000000..f8b7b8e14
--- /dev/null
+++ b/client/ui/build/windows/wails.exe.manifest
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3">
+    <assemblyIdentity type="win32" name="io.netbird.client" version="0.0.1.0" processorArchitecture="*"/>
+    <dependency>
+        <dependentAssembly>
+            <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"/>
+        </dependentAssembly>
+    </dependency>
+    <asmv3:application>
+        <asmv3:windowsSettings>
+            <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true/pm</dpiAware> <!-- fallback for Windows 7 and 8 -->
+            <dpiAwareness xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">permonitorv2,permonitor</dpiAwareness> <!-- falls back to per-monitor if per-monitor v2 is not supported -->
+        </asmv3:windowsSettings>
+    </asmv3:application>
+    <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
+        <security>
+            <requestedPrivileges>
+                <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
+            </requestedPrivileges>
+        </security>
+    </trustInfo>
+</assembly>
diff --git a/client/ui/client_ui.go b/client/ui/client_ui.go
deleted file mode 100644
index 2b19c2bf5..000000000
--- a/client/ui/client_ui.go
+++ /dev/null
@@ -1,2016 +0,0 @@
-//go:build !(linux && 386)
-
-package main
-
-import (
-	"context"
-	_ "embed"
-	"errors"
-	"flag"
-	"fmt"
-	"net/url"
-	"os"
-	"os/exec"
-	"os/user"
-	"path"
-	"runtime"
-	"strconv"
-	"strings"
-	"sync"
-	"time"
-	"unicode"
-
-	"fyne.io/fyne/v2"
-	"fyne.io/fyne/v2/app"
-	"fyne.io/fyne/v2/canvas"
-	"fyne.io/fyne/v2/container"
-	"fyne.io/fyne/v2/dialog"
-	"fyne.io/fyne/v2/layout"
-	"fyne.io/fyne/v2/theme"
-	"fyne.io/fyne/v2/widget"
-	"fyne.io/systray"
-	"github.com/cenkalti/backoff/v4"
-	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
-
-	"github.com/netbirdio/netbird/client/iface"
-	"github.com/netbirdio/netbird/client/internal"
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	"github.com/netbirdio/netbird/client/mdm"
-	"github.com/netbirdio/netbird/client/proto"
-	"github.com/netbirdio/netbird/client/ui/desktop"
-	"github.com/netbirdio/netbird/client/ui/event"
-	"github.com/netbirdio/netbird/client/ui/notifier"
-	"github.com/netbirdio/netbird/client/ui/process"
-	"github.com/netbirdio/netbird/util"
-
-	"github.com/netbirdio/netbird/version"
-)
-
-const (
-	defaultFailTimeout = 3 * time.Second
-	failFastTimeout    = time.Second
-)
-
-const (
-	censoredPreSharedKey = "**********"
-	maxSSHJWTCacheTTL    = 86_400 // 24 hours in seconds
-	// mdmFieldSuffix is appended to plain-text Entry widgets in the
-	// advanced Settings window when the underlying field is enforced
-	// by MDM, so the user sees the lock indicator inline next to the
-	// value. Stripped before any read site that feeds the value back
-	// into a SetConfig request (saveSettings / parseNumericSettings).
-	mdmFieldSuffix = " (MDM)"
-)
-
-// main is the entry point for the UI tray/client binary. Parses CLI
-// flags, initialises logging, builds the Fyne application and tray
-// icons, and constructs the service client (which may open a
-// requested UI window). When a window-mode flag is set the Fyne event
-// loop runs and main returns; otherwise main enforces single-instance
-// behaviour (signalling an existing instance to show its window when
-// present), sets up signal handling + default fonts, and runs the
-// system tray loop.
-func main() {
-	flags := parseFlags()
-
-	// Initialize file logging if needed.
-	var logFile string
-	if flags.saveLogsInFile {
-		file, err := initLogFile()
-		if err != nil {
-			log.Errorf("error while initializing log: %v", err)
-			return
-		}
-		logFile = file
-	} else {
-		_ = util.InitLog("trace", util.LogConsole)
-	}
-
-	// Create the Fyne application.
-	a := app.NewWithID("NetBird")
-	a.SetIcon(fyne.NewStaticResource("netbird", iconDisconnected))
-
-	// Show error message window if needed.
-	if flags.errorMsg != "" {
-		showErrorMessage(flags.errorMsg)
-		return
-	}
-
-	// Create the service client (this also builds the settings or networks UI if requested).
-	client := newServiceClient(&newServiceClientArgs{
-		addr:              flags.daemonAddr,
-		logFile:           logFile,
-		app:               a,
-		showSettings:      flags.showSettings,
-		showNetworks:      flags.showNetworks,
-		showLoginURL:      flags.showLoginURL,
-		showDebug:         flags.showDebug,
-		showProfiles:      flags.showProfiles,
-		showQuickActions:  flags.showQuickActions,
-		showUpdate:        flags.showUpdate,
-		showUpdateVersion: flags.showUpdateVersion,
-	})
-
-	// Watch for theme/settings changes to update the icon.
-	go watchSettingsChanges(a, client)
-
-	// Run in window mode if any UI flag was set.
-	if flags.showSettings || flags.showNetworks || flags.showDebug || flags.showLoginURL || flags.showProfiles || flags.showQuickActions || flags.showUpdate {
-		a.Run()
-		return
-	}
-
-	// Check for another running process.
-	pid, running, err := process.IsAnotherProcessRunning()
-	if err != nil {
-		log.Errorf("error while checking process: %v", err)
-		return
-	}
-	if running {
-		log.Infof("another process is running with pid %d, sending signal to show window", pid)
-		if err := sendShowWindowSignal(pid); err != nil {
-			log.Errorf("send signal to running instance: %v", err)
-		}
-		return
-	}
-
-	client.setupSignalHandler(client.ctx)
-
-	client.setDefaultFonts()
-	systray.Run(client.onTrayReady, client.onTrayExit)
-}
-
-type cliFlags struct {
-	daemonAddr        string
-	showSettings      bool
-	showNetworks      bool
-	showProfiles      bool
-	showDebug         bool
-	showLoginURL      bool
-	showQuickActions  bool
-	errorMsg          string
-	saveLogsInFile    bool
-	showUpdate        bool
-	showUpdateVersion string
-}
-
-// parseFlags reads and returns all needed command-line flags.
-func parseFlags() *cliFlags {
-	var flags cliFlags
-
-	defaultDaemonAddr := "unix:///var/run/netbird.sock"
-	if runtime.GOOS == "windows" {
-		defaultDaemonAddr = "tcp://127.0.0.1:41731"
-	}
-	flag.StringVar(&flags.daemonAddr, "daemon-addr", defaultDaemonAddr, "Daemon service address to serve CLI requests [unix|tcp]://[path|host:port]")
-	flag.BoolVar(&flags.showSettings, "settings", false, "run settings window")
-	flag.BoolVar(&flags.showNetworks, "networks", false, "run networks window")
-	flag.BoolVar(&flags.showProfiles, "profiles", false, "run profiles window")
-	flag.BoolVar(&flags.showDebug, "debug", false, "run debug window")
-	flag.BoolVar(&flags.showQuickActions, "quick-actions", false, "run quick actions window")
-	flag.StringVar(&flags.errorMsg, "error-msg", "", "displays an error message window")
-	flag.BoolVar(&flags.saveLogsInFile, "use-log-file", false, fmt.Sprintf("save logs in a file: %s/netbird-ui-PID.log", os.TempDir()))
-	flag.BoolVar(&flags.showLoginURL, "login-url", false, "show login URL in a popup window")
-	flag.BoolVar(&flags.showUpdate, "update", false, "show update progress window")
-	flag.StringVar(&flags.showUpdateVersion, "update-version", "", "version to update to")
-	flag.Parse()
-	return &flags
-}
-
-// initLogFile initializes logging into a file.
-func initLogFile() (string, error) {
-	logFile := path.Join(os.TempDir(), fmt.Sprintf("netbird-ui-%d.log", os.Getpid()))
-	return logFile, util.InitLog("trace", logFile)
-}
-
-// watchSettingsChanges listens for Fyne theme/settings changes and updates the client icon.
-func watchSettingsChanges(a fyne.App, client *serviceClient) {
-	a.Settings().AddListener(func(settings fyne.Settings) {
-		client.updateIcon()
-	})
-}
-
-// showErrorMessage displays an error message in a simple window.
-func showErrorMessage(msg string) {
-	a := app.New()
-	w := a.NewWindow("NetBird Error")
-	label := widget.NewLabel(msg)
-	label.Wrapping = fyne.TextWrapWord
-	w.SetContent(label)
-	w.Resize(fyne.NewSize(400, 100))
-	w.Show()
-	a.Run()
-}
-
-//go:embed assets/netbird-systemtray-connected-macos.png
-var iconConnectedMacOS []byte
-
-//go:embed assets/netbird-systemtray-disconnected-macos.png
-var iconDisconnectedMacOS []byte
-
-//go:embed assets/netbird-systemtray-update-disconnected-macos.png
-var iconUpdateDisconnectedMacOS []byte
-
-//go:embed assets/netbird-systemtray-update-connected-macos.png
-var iconUpdateConnectedMacOS []byte
-
-//go:embed assets/netbird-systemtray-connecting-macos.png
-var iconConnectingMacOS []byte
-
-//go:embed assets/netbird-systemtray-error-macos.png
-var iconErrorMacOS []byte
-
-//go:embed assets/connected.png
-var iconConnectedDot []byte
-
-//go:embed assets/disconnected.png
-var iconDisconnectedDot []byte
-
-type serviceClient struct {
-	ctx      context.Context
-	cancel   context.CancelFunc
-	addr     string
-	conn     proto.DaemonServiceClient
-	connLock sync.Mutex
-
-	eventHandler *eventHandler
-
-	profileManager *profilemanager.ProfileManager
-
-	icAbout              []byte
-	icConnected          []byte
-	icConnectedDot       []byte
-	icDisconnected       []byte
-	icDisconnectedDot    []byte
-	icUpdateConnected    []byte
-	icUpdateDisconnected []byte
-	icConnecting         []byte
-	icError              []byte
-
-	// systray menu items
-	mStatus            *systray.MenuItem
-	mUp                *systray.MenuItem
-	mDown              *systray.MenuItem
-	mSettings          *systray.MenuItem
-	mProfile           *profileMenu
-	mAbout             *systray.MenuItem
-	mGitHub            *systray.MenuItem
-	mVersionUI         *systray.MenuItem
-	mVersionDaemon     *systray.MenuItem
-	mUpdate            *systray.MenuItem
-	mQuit              *systray.MenuItem
-	mNetworks          *systray.MenuItem
-	mAllowSSH          *systray.MenuItem
-	mAutoConnect       *systray.MenuItem
-	mEnableRosenpass   *systray.MenuItem
-	mBlockInbound      *systray.MenuItem
-	mNotifications     *systray.MenuItem
-	mAdvancedSettings  *systray.MenuItem
-	mCreateDebugBundle *systray.MenuItem
-	mExitNode          *systray.MenuItem
-
-	// application with main windows.
-	app                  fyne.App
-	notifier             notifier.Notifier
-	wSettings            fyne.Window
-	showAdvancedSettings bool
-	sendNotification     bool
-
-	// input elements for settings form
-	iMngURL        *widget.Entry
-	iLogFile       *widget.Entry
-	iPreSharedKey  *widget.Entry
-	iInterfaceName *widget.Entry
-	iInterfacePort *widget.Entry
-	iMTU           *widget.Entry
-
-	// switch elements for settings form
-	sRosenpassPermissive        *widget.Check
-	sNetworkMonitor             *widget.Check
-	sDisableDNS                 *widget.Check
-	sDisableClientRoutes        *widget.Check
-	sDisableServerRoutes        *widget.Check
-	sDisableIPv6                *widget.Check
-	sBlockLANAccess             *widget.Check
-	sEnableSSHRoot              *widget.Check
-	sEnableSSHSFTP              *widget.Check
-	sEnableSSHLocalPortForward  *widget.Check
-	sEnableSSHRemotePortForward *widget.Check
-	sDisableSSHAuth             *widget.Check
-	iSSHJWTCacheTTL             *widget.Entry
-
-	// observable settings over corresponding iMngURL and iPreSharedKey values.
-	managementURL string
-	preSharedKey  string
-
-	RosenpassPermissive        bool
-	interfaceName              string
-	interfacePort              int
-	mtu                        uint16
-	networkMonitor             bool
-	disableDNS                 bool
-	disableClientRoutes        bool
-	disableServerRoutes        bool
-	disableIPv6                bool
-	blockLANAccess             bool
-	enableSSHRoot              bool
-	enableSSHSFTP              bool
-	enableSSHLocalPortForward  bool
-	enableSSHRemotePortForward bool
-	disableSSHAuth             bool
-	sshJWTCacheTTL             int
-
-	connected            bool
-	daemonVersion        string
-	updateIndicationLock sync.Mutex
-	isUpdateIconActive   bool
-	isEnforcedUpdate     bool
-	lastNotifiedVersion  string
-	profilesEnabled      bool
-	networksEnabled      bool
-	// networksMenuEnabled caches the last applied enabled-state of the
-	// mNetworks + mExitNode submenu items. Combines features.DisableNetworks
-	// AND s.connected — both must be true for the menus to be active.
-	// Zero value (false) matches the Disable() call at AddMenuItem time.
-	networksMenuEnabled bool
-	showNetworks        bool
-	wNetworks           fyne.Window
-	wProfiles           fyne.Window
-	wQuickActions       fyne.Window
-
-	eventManager *event.Manager
-
-	exitNodeMu           sync.Mutex
-	mExitNodeItems       []menuHandler
-	exitNodeRetryCancel  context.CancelFunc
-	mExitNodeSeparator   *systray.MenuItem
-	mExitNodeDeselectAll *systray.MenuItem
-	logFile              string
-	wLoginURL            fyne.Window
-	wUpdateProgress      fyne.Window
-	updateContextCancel  context.CancelFunc
-
-	connectCancel context.CancelFunc
-
-	// mdmManagedFields caches the names of MDM-enforced policy keys
-	// surfaced by the daemon in GetConfigResponse. Each refresh of
-	// daemon config (loadSettings, getSrvConfig, config_changed event)
-	// updates this set and re-applies the lock/badge to the affected
-	// menu items and settings-form widgets.
-	mdmManagedFields map[string]bool
-}
-
-type menuHandler struct {
-	*systray.MenuItem
-	cancel context.CancelFunc
-}
-
-type newServiceClientArgs struct {
-	addr              string
-	logFile           string
-	app               fyne.App
-	showSettings      bool
-	showNetworks      bool
-	showDebug         bool
-	showLoginURL      bool
-	showProfiles      bool
-	showQuickActions  bool
-	showUpdate        bool
-	showUpdateVersion string
-}
-
-// newServiceClient instance constructor
-//
-// This constructor also builds the UI elements for the settings window.
-func newServiceClient(args *newServiceClientArgs) *serviceClient {
-	ctx, cancel := context.WithCancel(context.Background())
-	s := &serviceClient{
-		ctx:              ctx,
-		cancel:           cancel,
-		addr:             args.addr,
-		app:              args.app,
-		notifier:         notifier.New(args.app),
-		logFile:          args.logFile,
-		sendNotification: false,
-
-		showAdvancedSettings: args.showSettings,
-		showNetworks:         args.showNetworks,
-		networksEnabled:      true,
-	}
-
-	s.eventHandler = newEventHandler(s)
-	s.profileManager = profilemanager.NewProfileManager()
-	s.setNewIcons()
-
-	switch {
-	case args.showSettings:
-		s.showSettingsUI()
-	case args.showNetworks:
-		s.showNetworksUI()
-	case args.showLoginURL:
-		s.showLoginURL()
-	case args.showDebug:
-		s.showDebugUI()
-	case args.showProfiles:
-		s.showProfilesUI()
-	case args.showQuickActions:
-		// Suppress the on-boot Quick Actions popup when the daemon
-		// reports DisableAutoConnect=true — that flag carries both the
-		// user's "Connect on Startup = off" preference AND any MDM-
-		// enforced override (applyMDMPolicy writes the policy value
-		// into the same Config field). See netbirdio/netbird#5744.
-		if !s.disableAutoConnectFromDaemon() {
-			s.showQuickActionsUI()
-		}
-	case args.showUpdate:
-		s.showUpdateProgress(ctx, args.showUpdateVersion)
-	}
-
-	return s
-}
-
-func (s *serviceClient) setNewIcons() {
-	s.icAbout = iconAbout
-	s.icConnectedDot = iconConnectedDot
-	s.icDisconnectedDot = iconDisconnectedDot
-	if s.app.Settings().ThemeVariant() == theme.VariantDark {
-		s.icConnected = iconConnectedDark
-		s.icDisconnected = iconDisconnected
-		s.icUpdateConnected = iconUpdateConnectedDark
-		s.icUpdateDisconnected = iconUpdateDisconnectedDark
-		s.icConnecting = iconConnectingDark
-		s.icError = iconErrorDark
-	} else {
-		s.icConnected = iconConnected
-		s.icDisconnected = iconDisconnected
-		s.icUpdateConnected = iconUpdateConnected
-		s.icUpdateDisconnected = iconUpdateDisconnected
-		s.icConnecting = iconConnecting
-		s.icError = iconError
-	}
-}
-
-func (s *serviceClient) updateIcon() {
-	s.setNewIcons()
-	s.updateIndicationLock.Lock()
-	if s.connected {
-		if s.isUpdateIconActive {
-			systray.SetTemplateIcon(iconUpdateConnectedMacOS, s.icUpdateConnected)
-		} else {
-			systray.SetTemplateIcon(iconConnectedMacOS, s.icConnected)
-		}
-	} else {
-		if s.isUpdateIconActive {
-			systray.SetTemplateIcon(iconUpdateDisconnectedMacOS, s.icUpdateDisconnected)
-		} else {
-			systray.SetTemplateIcon(iconDisconnectedMacOS, s.icDisconnected)
-		}
-	}
-	s.updateIndicationLock.Unlock()
-}
-
-func (s *serviceClient) showSettingsUI() {
-	// DisableUpdateSettings no longer gates the window from opening:
-	// the daemon blocks every actual mutation at SetConfig / Login,
-	// so the window is safe to show as a read-only view. The previous
-	// early-return also blocked Advanced Settings whenever update
-	// editing was off, which conflated two distinct kill switches
-	// (see comment in checkAndUpdateFeatures).
-
-	// add settings window UI elements.
-	s.wSettings = s.app.NewWindow("NetBird Settings")
-	s.wSettings.SetOnClosed(s.cancel)
-
-	s.iMngURL = widget.NewEntry()
-
-	s.iLogFile = widget.NewEntry()
-	s.iLogFile.Disable()
-	s.iPreSharedKey = widget.NewPasswordEntry()
-	s.iInterfaceName = widget.NewEntry()
-	s.iInterfacePort = widget.NewEntry()
-	s.iMTU = widget.NewEntry()
-
-	s.sRosenpassPermissive = widget.NewCheck("Enable Rosenpass permissive mode", nil)
-
-	s.sNetworkMonitor = widget.NewCheck("Restarts NetBird when the network changes", nil)
-	s.sDisableDNS = widget.NewCheck("Keeps system DNS settings unchanged", nil)
-	s.sDisableClientRoutes = widget.NewCheck("This peer won't route traffic to other peers", nil)
-	s.sDisableServerRoutes = widget.NewCheck("This peer won't act as router for others", nil)
-	s.sDisableIPv6 = widget.NewCheck("Disable IPv6 overlay addressing", nil)
-	s.sBlockLANAccess = widget.NewCheck("Blocks local network access when used as exit node", nil)
-	s.sEnableSSHRoot = widget.NewCheck("Enable SSH Root Login", nil)
-	s.sEnableSSHSFTP = widget.NewCheck("Enable SSH SFTP", nil)
-	s.sEnableSSHLocalPortForward = widget.NewCheck("Enable SSH Local Port Forwarding", nil)
-	s.sEnableSSHRemotePortForward = widget.NewCheck("Enable SSH Remote Port Forwarding", nil)
-	s.sDisableSSHAuth = widget.NewCheck("Disable SSH Authentication", nil)
-	s.iSSHJWTCacheTTL = widget.NewEntry()
-
-	s.wSettings.SetContent(s.getSettingsForm())
-	s.wSettings.Resize(fyne.NewSize(600, 400))
-	s.wSettings.SetFixedSize(true)
-
-	s.getSrvConfig()
-	s.wSettings.Show()
-}
-
-func (s *serviceClient) getConnectionForm() *widget.Form {
-	var activeProfName string
-	activeProf, err := s.profileManager.GetActiveProfile()
-	if err != nil {
-		log.Errorf("get active profile: %v", err)
-	} else {
-		activeProfName = activeProf.Name
-	}
-	return &widget.Form{
-		Items: []*widget.FormItem{
-			{Text: "Profile", Widget: widget.NewLabel(activeProfName)},
-			{Text: "Management URL", Widget: s.iMngURL},
-			{Text: "Pre-shared Key", Widget: s.iPreSharedKey},
-			{Text: "Quantum-Resistance", Widget: s.sRosenpassPermissive},
-			{Text: "Interface Name", Widget: s.iInterfaceName},
-			{Text: "Interface Port", Widget: s.iInterfacePort, HintText: "If set to 0, a random free port will be used"},
-			{Text: "MTU", Widget: s.iMTU},
-			{Text: "Log File", Widget: s.iLogFile},
-		},
-	}
-}
-
-func (s *serviceClient) saveSettings() {
-	// Check if update settings are disabled by daemon
-	features, err := s.getFeatures()
-	if err != nil {
-		log.Errorf("failed to get features from daemon: %v", err)
-		// Continue with default behavior if features can't be retrieved
-	} else if features != nil && features.DisableUpdateSettings {
-		log.Warn("Configuration updates are disabled by daemon")
-		dialog.ShowError(fmt.Errorf("configuration updates are disabled by daemon"), s.wSettings)
-		return
-	}
-
-	if err := s.validateSettings(); err != nil {
-		dialog.ShowError(err, s.wSettings)
-		return
-	}
-
-	port, mtu, err := s.parseNumericSettings()
-	if err != nil {
-		dialog.ShowError(err, s.wSettings)
-		return
-	}
-
-	iMngURL := strings.TrimSpace(strings.TrimSuffix(s.iMngURL.Text, mdmFieldSuffix))
-
-	if s.hasSettingsChanged(iMngURL, port, mtu) {
-		if err := s.applySettingsChanges(iMngURL, port, mtu); err != nil {
-			dialog.ShowError(err, s.wSettings)
-			return
-		}
-	}
-
-	s.wSettings.Close()
-}
-
-func (s *serviceClient) validateSettings() error {
-	if s.iPreSharedKey.Text != "" && s.iPreSharedKey.Text != censoredPreSharedKey {
-		if _, err := wgtypes.ParseKey(s.iPreSharedKey.Text); err != nil {
-			return fmt.Errorf("invalid pre-shared key value")
-		}
-	}
-	return nil
-}
-
-func (s *serviceClient) parseNumericSettings() (int64, int64, error) {
-	port, err := strconv.ParseInt(strings.TrimSpace(strings.TrimSuffix(s.iInterfacePort.Text, mdmFieldSuffix)), 10, 64)
-	if err != nil {
-		return 0, 0, errors.New("invalid interface port")
-	}
-	if port < 0 || port > 65535 {
-		return 0, 0, errors.New("invalid interface port: out of range 0-65535")
-	}
-
-	var mtu int64
-	mtuText := strings.TrimSpace(s.iMTU.Text)
-	if mtuText != "" {
-		mtu, err = strconv.ParseInt(mtuText, 10, 64)
-		if err != nil {
-			return 0, 0, errors.New("invalid MTU value")
-		}
-		if mtu < iface.MinMTU || mtu > iface.MaxMTU {
-			return 0, 0, fmt.Errorf("MTU must be between %d and %d bytes", iface.MinMTU, iface.MaxMTU)
-		}
-	}
-
-	return port, mtu, nil
-}
-
-func (s *serviceClient) hasSettingsChanged(iMngURL string, port, mtu int64) bool {
-	return s.managementURL != iMngURL ||
-		s.preSharedKey != s.iPreSharedKey.Text ||
-		s.RosenpassPermissive != s.sRosenpassPermissive.Checked ||
-		s.interfaceName != s.iInterfaceName.Text ||
-		s.interfacePort != int(port) ||
-		s.mtu != uint16(mtu) ||
-		s.networkMonitor != s.sNetworkMonitor.Checked ||
-		s.disableDNS != s.sDisableDNS.Checked ||
-		s.disableClientRoutes != s.sDisableClientRoutes.Checked ||
-		s.disableServerRoutes != s.sDisableServerRoutes.Checked ||
-		s.disableIPv6 != s.sDisableIPv6.Checked ||
-		s.blockLANAccess != s.sBlockLANAccess.Checked ||
-		s.hasSSHChanges()
-}
-
-func (s *serviceClient) applySettingsChanges(iMngURL string, port, mtu int64) error {
-	s.managementURL = iMngURL
-	s.preSharedKey = s.iPreSharedKey.Text
-	s.mtu = uint16(mtu)
-
-	req, err := s.buildSetConfigRequest(iMngURL, port, mtu)
-	if err != nil {
-		return fmt.Errorf("build config request: %w", err)
-	}
-
-	if err := s.sendConfigUpdate(req); err != nil {
-		return fmt.Errorf("set configuration: %w", err)
-	}
-
-	return nil
-}
-
-func (s *serviceClient) buildSetConfigRequest(iMngURL string, port, mtu int64) (*proto.SetConfigRequest, error) {
-	currUser, err := user.Current()
-	if err != nil {
-		return nil, fmt.Errorf("get current user: %w", err)
-	}
-
-	activeProf, err := s.profileManager.GetActiveProfile()
-	if err != nil {
-		return nil, fmt.Errorf("get active profile: %w", err)
-	}
-
-	req := &proto.SetConfigRequest{
-		ProfileName: activeProf.ID.String(),
-		Username:    currUser.Username,
-	}
-
-	if iMngURL != "" {
-		req.ManagementUrl = iMngURL
-	}
-
-	req.RosenpassPermissive = &s.sRosenpassPermissive.Checked
-	req.InterfaceName = &s.iInterfaceName.Text
-	req.WireguardPort = &port
-	if mtu > 0 {
-		req.Mtu = &mtu
-	}
-
-	req.NetworkMonitor = &s.sNetworkMonitor.Checked
-	req.DisableDns = &s.sDisableDNS.Checked
-	req.DisableClientRoutes = &s.sDisableClientRoutes.Checked
-	req.DisableServerRoutes = &s.sDisableServerRoutes.Checked
-	req.DisableIpv6 = &s.sDisableIPv6.Checked
-	req.BlockLanAccess = &s.sBlockLANAccess.Checked
-
-	req.EnableSSHRoot = &s.sEnableSSHRoot.Checked
-	req.EnableSSHSFTP = &s.sEnableSSHSFTP.Checked
-	req.EnableSSHLocalPortForwarding = &s.sEnableSSHLocalPortForward.Checked
-	req.EnableSSHRemotePortForwarding = &s.sEnableSSHRemotePortForward.Checked
-	req.DisableSSHAuth = &s.sDisableSSHAuth.Checked
-
-	sshJWTCacheTTLText := strings.TrimSpace(s.iSSHJWTCacheTTL.Text)
-	if sshJWTCacheTTLText != "" {
-		sshJWTCacheTTL, err := strconv.ParseInt(sshJWTCacheTTLText, 10, 32)
-		if err != nil {
-			return nil, errors.New("invalid SSH JWT Cache TTL value")
-		}
-		if sshJWTCacheTTL < 0 || sshJWTCacheTTL > maxSSHJWTCacheTTL {
-			return nil, fmt.Errorf("SSH JWT Cache TTL must be between 0 and %d seconds", maxSSHJWTCacheTTL)
-		}
-		sshJWTCacheTTL32 := int32(sshJWTCacheTTL)
-		req.SshJWTCacheTTL = &sshJWTCacheTTL32
-	}
-
-	// Only attach the PSK when the user actually typed something:
-	// - "" means the field was left untouched (we deliberately render
-	//   an empty Text + placeholder hint to avoid leaking the daemon's
-	//   "**********" redaction through the password reveal toggle);
-	//   sending an empty pointer would tell the daemon to clear / overwrite
-	//   the on-disk or MDM-enforced PSK, which then trips the MDM
-	//   conflict gate when PSK is policy-managed.
-	// - "**********" is the redacted echo (legacy non-MDM path); also a no-op.
-	if s.iPreSharedKey.Text != "" && s.iPreSharedKey.Text != censoredPreSharedKey {
-		req.OptionalPreSharedKey = &s.iPreSharedKey.Text
-	}
-
-	return req, nil
-}
-
-func (s *serviceClient) sendConfigUpdate(req *proto.SetConfigRequest) error {
-	conn, err := s.getSrvClient(failFastTimeout)
-	if err != nil {
-		return fmt.Errorf("get client: %w", err)
-	}
-
-	_, err = conn.SetConfig(s.ctx, req)
-	if err != nil {
-		return fmt.Errorf("set config: %w", err)
-	}
-
-	// Reconnect if connected to apply the new settings.
-	// Use a background context so the reconnect outlives the settings window.
-	go func() {
-		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-		defer cancel()
-		status, err := conn.Status(ctx, &proto.StatusRequest{})
-		if err != nil {
-			log.Errorf("failed to get service status: %v", err)
-			return
-		}
-		if status.Status == string(internal.StatusConnected) {
-			if _, err = conn.Down(ctx, &proto.DownRequest{}); err != nil {
-				log.Errorf("failed to stop service: %v", err)
-			}
-			// TODO: wait for the service to be idle before calling Up, or use a fresh connection
-			if _, err = conn.Up(ctx, &proto.UpRequest{}); err != nil {
-				log.Errorf("failed to start service: %v", err)
-			}
-		}
-	}()
-
-	return nil
-}
-
-func (s *serviceClient) getSettingsForm() fyne.CanvasObject {
-	connectionForm := s.getConnectionForm()
-	networkForm := s.getNetworkForm()
-	sshForm := s.getSSHForm()
-	tabs := container.NewAppTabs(
-		container.NewTabItem("Connection", connectionForm),
-		container.NewTabItem("Network", networkForm),
-		container.NewTabItem("SSH", sshForm),
-	)
-	saveButton := widget.NewButtonWithIcon("Save", theme.ConfirmIcon(), s.saveSettings)
-	saveButton.Importance = widget.HighImportance
-	cancelButton := widget.NewButtonWithIcon("Cancel", theme.CancelIcon(), func() {
-		s.wSettings.Close()
-	})
-	buttonContainer := container.NewHBox(
-		layout.NewSpacer(),
-		cancelButton,
-		saveButton,
-	)
-	return container.NewBorder(nil, buttonContainer, nil, nil, tabs)
-}
-
-func (s *serviceClient) getNetworkForm() *widget.Form {
-	return &widget.Form{
-		Items: []*widget.FormItem{
-			{Text: "Network Monitor", Widget: s.sNetworkMonitor},
-			{Text: "Disable DNS", Widget: s.sDisableDNS},
-			{Text: "Disable Client Routes", Widget: s.sDisableClientRoutes},
-			{Text: "Disable Server Routes", Widget: s.sDisableServerRoutes},
-			{Text: "Disable IPv6", Widget: s.sDisableIPv6},
-			{Text: "Disable LAN Access", Widget: s.sBlockLANAccess},
-		},
-	}
-}
-
-func (s *serviceClient) getSSHForm() *widget.Form {
-	return &widget.Form{
-		Items: []*widget.FormItem{
-			{Text: "Enable SSH Root Login", Widget: s.sEnableSSHRoot},
-			{Text: "Enable SSH SFTP", Widget: s.sEnableSSHSFTP},
-			{Text: "Enable SSH Local Port Forwarding", Widget: s.sEnableSSHLocalPortForward},
-			{Text: "Enable SSH Remote Port Forwarding", Widget: s.sEnableSSHRemotePortForward},
-			{Text: "Disable SSH Authentication", Widget: s.sDisableSSHAuth},
-			{Text: "JWT Cache TTL (seconds, 0=disabled)", Widget: s.iSSHJWTCacheTTL},
-		},
-	}
-}
-
-func (s *serviceClient) hasSSHChanges() bool {
-	currentSSHJWTCacheTTL := s.sshJWTCacheTTL
-	if text := strings.TrimSpace(s.iSSHJWTCacheTTL.Text); text != "" {
-		val, err := strconv.Atoi(text)
-		if err != nil {
-			return true
-		}
-		currentSSHJWTCacheTTL = val
-	}
-
-	return s.enableSSHRoot != s.sEnableSSHRoot.Checked ||
-		s.enableSSHSFTP != s.sEnableSSHSFTP.Checked ||
-		s.enableSSHLocalPortForward != s.sEnableSSHLocalPortForward.Checked ||
-		s.enableSSHRemotePortForward != s.sEnableSSHRemotePortForward.Checked ||
-		s.disableSSHAuth != s.sDisableSSHAuth.Checked ||
-		s.sshJWTCacheTTL != currentSSHJWTCacheTTL
-}
-
-func (s *serviceClient) login(ctx context.Context, openURL bool) (*proto.LoginResponse, error) {
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		return nil, fmt.Errorf("get daemon client: %w", err)
-	}
-
-	activeProf, err := s.profileManager.GetActiveProfile()
-	if err != nil {
-		return nil, fmt.Errorf("get active profile: %w", err)
-	}
-
-	currUser, err := user.Current()
-	if err != nil {
-		return nil, fmt.Errorf("get current user: %w", err)
-	}
-
-	handle := activeProf.ID.String()
-
-	loginReq := &proto.LoginRequest{
-		IsUnixDesktopClient: runtime.GOOS == "linux" || runtime.GOOS == "freebsd",
-		ProfileName:         &handle,
-		Username:            &currUser.Username,
-	}
-
-	profileState, err := s.profileManager.GetProfileState(activeProf.ID)
-	if err != nil {
-		log.Debugf("failed to get profile state for login hint: %v", err)
-	} else if profileState.Email != "" {
-		loginReq.Hint = &profileState.Email
-	}
-
-	loginResp, err := conn.Login(ctx, loginReq)
-	if err != nil {
-		return nil, fmt.Errorf("login to management: %w", err)
-	}
-
-	if loginResp.NeedsSSOLogin && openURL {
-		if err = s.handleSSOLogin(ctx, loginResp, conn); err != nil {
-			return nil, fmt.Errorf("SSO login: %w", err)
-		}
-	}
-
-	return loginResp, nil
-}
-
-func (s *serviceClient) handleSSOLogin(ctx context.Context, loginResp *proto.LoginResponse, conn proto.DaemonServiceClient) error {
-	if err := openURL(loginResp.VerificationURIComplete); err != nil {
-		return fmt.Errorf("open browser: %w", err)
-	}
-
-	resp, err := conn.WaitSSOLogin(ctx, &proto.WaitSSOLoginRequest{UserCode: loginResp.UserCode})
-	if err != nil {
-		return fmt.Errorf("wait for SSO login: %w", err)
-	}
-
-	if resp.Email != "" {
-		if err := s.profileManager.SetActiveProfileState(&profilemanager.ProfileState{
-			Email: resp.Email,
-		}); err != nil {
-			log.Debugf("failed to set profile state: %v", err)
-		} else {
-			s.mProfile.refresh()
-		}
-	}
-
-	return nil
-}
-
-func (s *serviceClient) menuUpClick(ctx context.Context) error {
-	systray.SetTemplateIcon(iconConnectingMacOS, s.icConnecting)
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		systray.SetTemplateIcon(iconErrorMacOS, s.icError)
-		return fmt.Errorf("get daemon client: %w", err)
-	}
-
-	_, err = s.login(ctx, true)
-	if err != nil {
-		return fmt.Errorf("login: %w", err)
-	}
-
-	status, err := conn.Status(ctx, &proto.StatusRequest{})
-	if err != nil {
-		return fmt.Errorf("get status: %w", err)
-	}
-
-	if status.Status == string(internal.StatusConnected) {
-		return nil
-	}
-
-	if _, err := s.conn.Up(s.ctx, &proto.UpRequest{}); err != nil {
-		return fmt.Errorf("start connection: %w", err)
-	}
-
-	return nil
-}
-
-func (s *serviceClient) menuDownClick() error {
-	systray.SetTemplateIcon(iconConnectingMacOS, s.icConnecting)
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		return fmt.Errorf("get daemon client: %w", err)
-	}
-
-	status, err := conn.Status(s.ctx, &proto.StatusRequest{})
-	if err != nil {
-		return fmt.Errorf("get status: %w", err)
-	}
-
-	if status.Status != string(internal.StatusConnected) && status.Status != string(internal.StatusConnecting) {
-		return nil
-	}
-
-	if _, err := conn.Down(s.ctx, &proto.DownRequest{}); err != nil {
-		return fmt.Errorf("stop connection: %w", err)
-	}
-
-	return nil
-}
-
-func (s *serviceClient) updateStatus() error {
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		return err
-	}
-	err = backoff.Retry(func() error {
-		status, err := conn.Status(s.ctx, &proto.StatusRequest{})
-		if err != nil {
-			log.Errorf("get service status: %v", err)
-			if s.connected {
-				s.notifier.Send("Error", "Connection to service lost")
-			}
-			s.setDisconnectedStatus()
-			return err
-		}
-
-		s.updateIndicationLock.Lock()
-		defer s.updateIndicationLock.Unlock()
-
-		// notify the user when the session has expired
-		if status.Status == string(internal.StatusSessionExpired) {
-			s.onSessionExpire()
-		}
-
-		var systrayIconState bool
-
-		switch {
-		case status.Status == string(internal.StatusConnected) && !s.connected:
-			s.connected = true
-			s.sendNotification = true
-			if s.isUpdateIconActive {
-				systray.SetTemplateIcon(iconUpdateConnectedMacOS, s.icUpdateConnected)
-			} else {
-				systray.SetTemplateIcon(iconConnectedMacOS, s.icConnected)
-			}
-			systray.SetTooltip("NetBird (Connected)")
-			s.mStatus.SetTitle("Connected")
-			s.mStatus.SetIcon(s.icConnectedDot)
-			s.mUp.Disable()
-			s.mDown.Enable()
-			if s.networksEnabled {
-				s.mNetworks.Enable()
-				s.mExitNode.Enable()
-			}
-			s.startExitNodeRefresh()
-			systrayIconState = true
-		case status.Status == string(internal.StatusConnecting):
-			s.setConnectingStatus()
-		case status.Status != string(internal.StatusConnected) && s.mUp.Disabled():
-			s.setDisconnectedStatus()
-			systrayIconState = false
-		}
-
-		// if the daemon version changed (e.g. after a successful update), reset the update indication
-		if s.daemonVersion != status.DaemonVersion {
-			if s.daemonVersion != "" {
-				s.mUpdate.Hide()
-				s.isUpdateIconActive = false
-			}
-			s.daemonVersion = status.DaemonVersion
-			if !s.isUpdateIconActive {
-				if systrayIconState {
-					systray.SetTemplateIcon(iconConnectedMacOS, s.icConnected)
-				} else {
-					systray.SetTemplateIcon(iconDisconnectedMacOS, s.icDisconnected)
-				}
-			}
-
-			daemonVersionTitle := normalizedVersion(s.daemonVersion)
-			s.mVersionDaemon.SetTitle(fmt.Sprintf("Daemon: %s", daemonVersionTitle))
-			s.mVersionDaemon.SetTooltip(fmt.Sprintf("Daemon version: %s", daemonVersionTitle))
-			s.mVersionDaemon.Show()
-		}
-
-		return nil
-	}, &backoff.ExponentialBackOff{
-		InitialInterval:     time.Second,
-		RandomizationFactor: backoff.DefaultRandomizationFactor,
-		Multiplier:          backoff.DefaultMultiplier,
-		MaxInterval:         300 * time.Millisecond,
-		MaxElapsedTime:      2 * time.Second,
-		Stop:                backoff.Stop,
-		Clock:               backoff.SystemClock,
-	})
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (s *serviceClient) setDisconnectedStatus() {
-	s.connected = false
-	if s.isUpdateIconActive {
-		systray.SetTemplateIcon(iconUpdateDisconnectedMacOS, s.icUpdateDisconnected)
-	} else {
-		systray.SetTemplateIcon(iconDisconnectedMacOS, s.icDisconnected)
-	}
-	systray.SetTooltip("NetBird (Disconnected)")
-	s.mStatus.SetTitle("Disconnected")
-	s.mStatus.SetIcon(s.icDisconnectedDot)
-	s.mDown.Disable()
-	s.mUp.Enable()
-	s.mNetworks.Disable()
-	s.mExitNode.Disable()
-	s.cancelExitNodeRetry()
-	go s.updateExitNodes()
-}
-
-func (s *serviceClient) setConnectingStatus() {
-	s.connected = false
-	systray.SetTemplateIcon(iconConnectingMacOS, s.icConnecting)
-	systray.SetTooltip("NetBird (Connecting)")
-	s.mStatus.SetTitle("Connecting")
-	s.mUp.Disable()
-	s.mDown.Enable()
-	s.mNetworks.Disable()
-	s.mExitNode.Disable()
-}
-
-func (s *serviceClient) onTrayReady() {
-	systray.SetTemplateIcon(iconDisconnectedMacOS, s.icDisconnected)
-	systray.SetTooltip("NetBird")
-
-	// setup systray menu items
-	s.mStatus = systray.AddMenuItem("Disconnected", "Disconnected")
-	s.mStatus.SetIcon(s.icDisconnectedDot)
-	s.mStatus.Disable()
-
-	profileMenuItem := systray.AddMenuItem("", "")
-	emailMenuItem := systray.AddMenuItem("", "")
-
-	newProfileMenuArgs := &newProfileMenuArgs{
-		ctx:                  s.ctx,
-		serviceClient:        s,
-		profileManager:       s.profileManager,
-		eventHandler:         s.eventHandler,
-		profileMenuItem:      profileMenuItem,
-		emailMenuItem:        emailMenuItem,
-		downClickCallback:    s.menuDownClick,
-		upClickCallback:      s.menuUpClick,
-		getSrvClientCallback: s.getSrvClient,
-		loadSettingsCallback: s.loadSettings,
-		app:                  s.app,
-	}
-
-	s.mProfile = newProfileMenu(*newProfileMenuArgs)
-	// Seed the transition cache to match the actual default menu
-	// state (visible / enabled). Without this, the first
-	// checkAndUpdateFeatures tick that observes DisableProfiles=true
-	// is a no-op (cache zero-value == desired-false) and the menu
-	// never gets hidden — symptom: MDM enforces the kill switch but
-	// the profile menu stays clickable.
-	s.profilesEnabled = true
-
-	systray.AddSeparator()
-	s.mUp = systray.AddMenuItem("Connect", "Connect")
-	s.mDown = systray.AddMenuItem("Disconnect", "Disconnect")
-	s.mDown.Disable()
-	systray.AddSeparator()
-
-	s.mSettings = systray.AddMenuItem("Settings", disabledMenuDescr)
-	s.mAllowSSH = s.mSettings.AddSubMenuItemCheckbox("Allow SSH", allowSSHMenuDescr, false)
-	s.mAutoConnect = s.mSettings.AddSubMenuItemCheckbox("Connect on Startup", autoConnectMenuDescr, false)
-	s.mEnableRosenpass = s.mSettings.AddSubMenuItemCheckbox("Enable Quantum-Resistance", quantumResistanceMenuDescr, false)
-	s.mBlockInbound = s.mSettings.AddSubMenuItemCheckbox("Block Inbound Connections", blockInboundMenuDescr, false)
-	s.mNotifications = s.mSettings.AddSubMenuItemCheckbox("Notifications", notificationsMenuDescr, false)
-	s.mSettings.AddSeparator()
-	s.mAdvancedSettings = s.mSettings.AddSubMenuItem("Advanced Settings", advancedSettingsMenuDescr)
-	s.mCreateDebugBundle = s.mSettings.AddSubMenuItem("Create Debug Bundle", debugBundleMenuDescr)
-	s.loadSettings()
-
-	// Disable profile menu if profiles are disabled by daemon.
-	// DisableUpdateSettings is enforced at the daemon's SetConfig /
-	// Login gates, not by hiding the UI — so the Settings menu (and
-	// its Advanced Settings submenu, which has its own kill switch)
-	// stays visible and the user can still inspect current values.
-	features, err := s.getFeatures()
-	if err != nil {
-		log.Errorf("failed to get features from daemon: %v", err)
-		// Continue with default behavior if features can't be retrieved
-	} else if features != nil && features.DisableProfiles {
-		s.mProfile.setEnabled(false)
-		s.profilesEnabled = false
-	}
-
-	s.exitNodeMu.Lock()
-	s.mExitNode = systray.AddMenuItem("Exit Node", disabledMenuDescr)
-	s.mExitNode.Disable()
-	s.exitNodeMu.Unlock()
-
-	s.mNetworks = systray.AddMenuItem("Networks", networksMenuDescr)
-	s.mNetworks.Disable()
-	systray.AddSeparator()
-
-	s.mAbout = systray.AddMenuItem("About", "About")
-	s.mAbout.SetIcon(s.icAbout)
-
-	s.mGitHub = s.mAbout.AddSubMenuItem("GitHub", "GitHub")
-
-	versionString := normalizedVersion(version.NetbirdVersion())
-	s.mVersionUI = s.mAbout.AddSubMenuItem(fmt.Sprintf("GUI: %s", versionString), fmt.Sprintf("GUI Version: %s", versionString))
-	s.mVersionUI.Disable()
-
-	s.mVersionDaemon = s.mAbout.AddSubMenuItem("", "")
-	s.mVersionDaemon.Disable()
-	s.mVersionDaemon.Hide()
-
-	s.mUpdate = s.mAbout.AddSubMenuItem("Download latest version", latestVersionMenuDescr)
-	s.mUpdate.Hide()
-
-	systray.AddSeparator()
-	s.mQuit = systray.AddMenuItem("Quit", quitMenuDescr)
-
-	// update exit node menu in case service is already connected
-	go s.updateExitNodes()
-
-	// Features (DisableProfiles, DisableUpdateSettings, DisableNetworks,
-	// ...) only change in two ways: at service install time (CLI flag,
-	// static) and at MDM ticker diff time. The daemon already publishes
-	// a SystemEvent{type=config_changed} on every MDM-driven engine
-	// restart, so the UI no longer needs to poll GetFeatures every 2 s.
-	// A single fetch at startup covers the static CLI-flag case; the
-	// event handler below covers MDM transitions. updateStatus stays in
-	// the 2 s loop because connection / peer state genuinely change
-	// continuously and have no event yet.
-	s.checkAndUpdateFeatures()
-	go func() {
-		s.getSrvConfig()
-		time.Sleep(100 * time.Millisecond) // To prevent race condition caused by systray not being fully initialized and ignoring setIcon
-		for {
-			err := s.updateStatus()
-			if err != nil {
-				log.Errorf("error while updating status: %v", err)
-			}
-
-			time.Sleep(2 * time.Second)
-		}
-	}()
-
-	s.eventManager = event.NewManager(s.notifier, s.addr)
-	s.eventManager.SetNotificationsEnabled(s.mNotifications.Checked())
-	s.eventManager.AddHandler(func(event *proto.SystemEvent) {
-		if event.Category == proto.SystemEvent_SYSTEM {
-			s.updateExitNodes()
-		}
-	})
-	s.eventManager.AddHandler(func(event *proto.SystemEvent) {
-		// todo use new Category
-		if windowAction, ok := event.Metadata["progress_window"]; ok {
-			targetVersion, ok := event.Metadata["version"]
-			if !ok {
-				targetVersion = "unknown"
-			}
-			log.Debugf("window action: %v", windowAction)
-			if windowAction == "show" {
-				if s.updateContextCancel != nil {
-					s.updateContextCancel()
-					s.updateContextCancel = nil
-				}
-
-				subCtx, cancel := context.WithCancel(s.ctx)
-				go s.eventHandler.runSelfCommand(subCtx, "update", "--update-version", targetVersion)
-				s.updateContextCancel = cancel
-			}
-		}
-	})
-	s.eventManager.AddHandler(func(event *proto.SystemEvent) {
-		if newVersion, ok := event.Metadata["new_version_available"]; ok {
-			_, enforced := event.Metadata["enforced"]
-			log.Infof("received new_version_available event: version=%s enforced=%v", newVersion, enforced)
-			s.onUpdateAvailable(newVersion, enforced)
-		}
-	})
-	s.eventManager.AddHandler(func(event *proto.SystemEvent) {
-		// Daemon emits a config_changed event after every engine spawn
-		// (Server.Start, Server.Up, MDM ticker restart). Re-sync the
-		// tray submenu checkboxes from the fresh daemon-side config so
-		// the user does not have to restart the tray to see CLI- or
-		// MDM-driven changes.
-		if event.Category == proto.SystemEvent_SYSTEM && event.Metadata["type"] == "config_changed" {
-			log.Infof("config_changed event received (source=%s); refreshing settings + features", event.Metadata["source"])
-			s.loadSettings()
-			// MDM-driven feature kill switches (DisableProfiles /
-			// DisableUpdateSettings / DisableNetworks) ride the same
-			// config_changed signal because the daemon re-applies its
-			// MDM policy on every engine spawn. Pull them in here so
-			// the UI is up to date without a periodic GetFeatures poll.
-			s.checkAndUpdateFeatures()
-		}
-	})
-
-	go s.eventManager.Start(s.ctx)
-	go s.eventHandler.listen(s.ctx)
-}
-
-func (s *serviceClient) attachOutput(cmd *exec.Cmd) *os.File {
-	if s.logFile == "" {
-		// attach child's streams to parent's streams
-		cmd.Stdout = os.Stdout
-		cmd.Stderr = os.Stderr
-
-		return nil
-	}
-
-	out, err := os.OpenFile(s.logFile, os.O_WRONLY|os.O_APPEND, 0)
-	if err != nil {
-		log.Errorf("Failed to open log file %s: %v", s.logFile, err)
-		return nil
-	}
-	cmd.Stdout = out
-	cmd.Stderr = out
-	return out
-}
-
-func normalizedVersion(version string) string {
-	versionString := version
-	if unicode.IsDigit(rune(versionString[0])) {
-		versionString = fmt.Sprintf("v%s", versionString)
-	}
-	return versionString
-}
-
-// onTrayExit is called when the tray icon is closed.
-func (s *serviceClient) onTrayExit() {
-	s.cancel()
-}
-
-// getSrvClient connection to the service.
-func (s *serviceClient) getSrvClient(timeout time.Duration) (proto.DaemonServiceClient, error) {
-	s.connLock.Lock()
-	defer s.connLock.Unlock()
-	if s.conn != nil {
-		return s.conn, nil
-	}
-
-	ctx, cancel := context.WithTimeout(s.ctx, timeout)
-	defer cancel()
-
-	conn, err := grpc.DialContext(
-		ctx,
-		strings.TrimPrefix(s.addr, "tcp://"),
-		grpc.WithTransportCredentials(insecure.NewCredentials()),
-		grpc.WithBlock(),
-		grpc.WithUserAgent(desktop.GetUIUserAgent()),
-	)
-	if err != nil {
-		return nil, fmt.Errorf("dial service: %w", err)
-	}
-
-	s.conn = proto.NewDaemonServiceClient(conn)
-	return s.conn, nil
-}
-
-// checkAndUpdateFeatures checks the current features and updates the UI accordingly
-func (s *serviceClient) checkAndUpdateFeatures() {
-	features, err := s.getFeatures()
-	if err != nil {
-		log.Errorf("failed to get features from daemon: %v", err)
-		return
-	}
-
-	s.updateIndicationLock.Lock()
-	defer s.updateIndicationLock.Unlock()
-
-	// DisableUpdateSettings is enforced server-side by the daemon gates
-	// on SetConfig + Login: any attempt to mutate config from UI or
-	// CLI is rejected at that layer. The UI deliberately keeps the
-	// Settings menu visible so the user can still inspect current
-	// values — read-only by virtue of the daemon refusing edits.
-
-	// Update profile menu based on current features
-	if s.mProfile != nil {
-		profilesEnabled := features == nil || !features.DisableProfiles
-		if s.profilesEnabled != profilesEnabled {
-			s.profilesEnabled = profilesEnabled
-			s.mProfile.setEnabled(profilesEnabled)
-		}
-	}
-
-	// Update networks and exit node menus based on current features.
-	// `networksEnabled` is the bare feature flag (read elsewhere, e.g. at
-	// connection-status transitions). `networksMenuEnabled` is the
-	// transition-cached state actually applied to the menu items —
-	// it folds in the connection state so a Connected client with the
-	// kill switch off shows the menus active, and only flips on diff.
-	s.networksEnabled = features == nil || !features.DisableNetworks
-	desiredNetworksMenu := s.networksEnabled && s.connected
-	if desiredNetworksMenu != s.networksMenuEnabled {
-		s.networksMenuEnabled = desiredNetworksMenu
-		if desiredNetworksMenu {
-			s.mNetworks.Enable()
-			s.mExitNode.Enable()
-		} else {
-			s.mNetworks.Disable()
-			s.mExitNode.Disable()
-		}
-	}
-}
-
-// getFeatures from the daemon to determine which features are enabled/disabled.
-func (s *serviceClient) getFeatures() (*proto.GetFeaturesResponse, error) {
-	conn, err := s.getSrvClient(failFastTimeout)
-	if err != nil {
-		return nil, fmt.Errorf("get client for features: %w", err)
-	}
-
-	features, err := conn.GetFeatures(s.ctx, &proto.GetFeaturesRequest{})
-	if err != nil {
-		return nil, fmt.Errorf("get features from daemon: %w", err)
-	}
-
-	return features, nil
-}
-
-// disableAutoConnectFromDaemon returns true when the daemon reports
-// the active profile has DisableAutoConnect=true. Used by the
-// --quick-actions startup path to suppress the on-boot popup when the
-// user (or an MDM admin) opted out of auto-connecting; both cases
-// converge on the same Config field because applyMDMPolicy writes the
-// policy value into it. Returns false on any RPC / lookup failure so a
-// daemon hiccup does not silently swallow the popup.
-func (s *serviceClient) disableAutoConnectFromDaemon() bool {
-	activeProf, err := s.profileManager.GetActiveProfile()
-	if err != nil {
-		log.Warnf("disableAutoConnectFromDaemon: get active profile: %v", err)
-		return false
-	}
-	currUser, err := user.Current()
-	if err != nil {
-		log.Warnf("disableAutoConnectFromDaemon: get current user: %v", err)
-		return false
-	}
-	conn, err := s.getSrvClient(failFastTimeout)
-	if err != nil {
-		log.Warnf("disableAutoConnectFromDaemon: get daemon client: %v", err)
-		return false
-	}
-	srvCfg, err := conn.GetConfig(s.ctx, &proto.GetConfigRequest{
-		ProfileName: activeProf.ID.String(),
-		Username:    currUser.Username,
-	})
-	if err != nil {
-		log.Warnf("disableAutoConnectFromDaemon: GetConfig RPC: %v", err)
-		return false
-	}
-	return srvCfg.GetDisableAutoConnect()
-}
-
-// getSrvConfig from the service to show it in the settings window.
-func (s *serviceClient) getSrvConfig() {
-	s.managementURL = profilemanager.DefaultManagementURL
-
-	_, err := s.profileManager.GetActiveProfile()
-	if err != nil {
-		log.Errorf("get active profile: %v", err)
-		return
-	}
-
-	var cfg *profilemanager.Config
-
-	conn, err := s.getSrvClient(failFastTimeout)
-	if err != nil {
-		log.Errorf("get client: %v", err)
-		return
-	}
-
-	currUser, err := user.Current()
-	if err != nil {
-		log.Errorf("get current user: %v", err)
-		return
-	}
-
-	activeProf, err := s.profileManager.GetActiveProfile()
-	if err != nil {
-		log.Errorf("get active profile: %v", err)
-		return
-	}
-
-	srvCfg, err := conn.GetConfig(s.ctx, &proto.GetConfigRequest{
-		ProfileName: activeProf.ID.String(),
-		Username:    currUser.Username,
-	})
-	if err != nil {
-		log.Errorf("get config settings from server: %v", err)
-		return
-	}
-
-	cfg = protoConfigToConfig(srvCfg)
-
-	if cfg.ManagementURL.String() != "" {
-		s.managementURL = cfg.ManagementURL.String()
-	}
-	s.preSharedKey = cfg.PreSharedKey
-	s.RosenpassPermissive = cfg.RosenpassPermissive
-	s.interfaceName = cfg.WgIface
-	s.interfacePort = cfg.WgPort
-	s.mtu = cfg.MTU
-
-	s.networkMonitor = *cfg.NetworkMonitor
-	s.disableDNS = cfg.DisableDNS
-	s.disableClientRoutes = cfg.DisableClientRoutes
-	s.disableServerRoutes = cfg.DisableServerRoutes
-	s.disableIPv6 = cfg.DisableIPv6
-	s.blockLANAccess = cfg.BlockLANAccess
-
-	if cfg.EnableSSHRoot != nil {
-		s.enableSSHRoot = *cfg.EnableSSHRoot
-	}
-	if cfg.EnableSSHSFTP != nil {
-		s.enableSSHSFTP = *cfg.EnableSSHSFTP
-	}
-	if cfg.EnableSSHLocalPortForwarding != nil {
-		s.enableSSHLocalPortForward = *cfg.EnableSSHLocalPortForwarding
-	}
-	if cfg.EnableSSHRemotePortForwarding != nil {
-		s.enableSSHRemotePortForward = *cfg.EnableSSHRemotePortForwarding
-	}
-	if cfg.DisableSSHAuth != nil {
-		s.disableSSHAuth = *cfg.DisableSSHAuth
-	}
-	if cfg.SSHJWTCacheTTL != nil {
-		s.sshJWTCacheTTL = *cfg.SSHJWTCacheTTL
-	}
-
-	if s.showAdvancedSettings {
-		s.iMngURL.SetText(s.managementURL)
-		// PSK is rendered with an empty Text and a hint via the
-		// placeholder so the eye toggle never reveals literal asterisks
-		// (the daemon returns the "**********" sentinel — writing that
-		// into a PasswordEntry would surface the literal sentinel when
-		// the user unmasks the field). The placeholder communicates the
-		// configured / MDM-managed state without exposing any value.
-		s.iPreSharedKey.SetText("")
-		s.iPreSharedKey.SetPlaceHolder(preSharedKeyPlaceholder(srvCfg))
-		s.iInterfaceName.SetText(cfg.WgIface)
-		s.iInterfacePort.SetText(strconv.Itoa(cfg.WgPort))
-		if cfg.MTU != 0 {
-			s.iMTU.SetText(strconv.Itoa(int(cfg.MTU)))
-		} else {
-			s.iMTU.SetText("")
-			s.iMTU.SetPlaceHolder(strconv.Itoa(int(iface.DefaultMTU)))
-		}
-		s.sRosenpassPermissive.SetChecked(cfg.RosenpassPermissive)
-		// Re-baseline the enabled state on every refresh: when Rosenpass
-		// is on the checkbox is editable, when it's off the field is
-		// inert. Without an explicit Enable() here the control stays
-		// stuck disabled after a previous refresh (or an MDM unlock) had
-		// turned it off — applyMDMLocksToSettingsForm below adds the
-		// MDM lock on top of this baseline.
-		if cfg.RosenpassEnabled {
-			s.sRosenpassPermissive.Enable()
-		} else {
-			s.sRosenpassPermissive.Disable()
-		}
-		s.sNetworkMonitor.SetChecked(*cfg.NetworkMonitor)
-		s.sDisableDNS.SetChecked(cfg.DisableDNS)
-		s.sDisableClientRoutes.SetChecked(cfg.DisableClientRoutes)
-		s.sDisableServerRoutes.SetChecked(cfg.DisableServerRoutes)
-		s.sDisableIPv6.SetChecked(cfg.DisableIPv6)
-		s.sBlockLANAccess.SetChecked(cfg.BlockLANAccess)
-		if cfg.EnableSSHRoot != nil {
-			s.sEnableSSHRoot.SetChecked(*cfg.EnableSSHRoot)
-		}
-		if cfg.EnableSSHSFTP != nil {
-			s.sEnableSSHSFTP.SetChecked(*cfg.EnableSSHSFTP)
-		}
-		if cfg.EnableSSHLocalPortForwarding != nil {
-			s.sEnableSSHLocalPortForward.SetChecked(*cfg.EnableSSHLocalPortForwarding)
-		}
-		if cfg.EnableSSHRemotePortForwarding != nil {
-			s.sEnableSSHRemotePortForward.SetChecked(*cfg.EnableSSHRemotePortForwarding)
-		}
-		if cfg.DisableSSHAuth != nil {
-			s.sDisableSSHAuth.SetChecked(*cfg.DisableSSHAuth)
-		}
-		if cfg.SSHJWTCacheTTL != nil {
-			s.iSSHJWTCacheTTL.SetText(strconv.Itoa(*cfg.SSHJWTCacheTTL))
-		}
-	}
-
-	// MDM locks must run before the mNotifications-nil early return:
-	// the Settings window is rendered by a separate UI process launched
-	// with --settings (see handleAdvancedSettingsClick), and that child
-	// process does NOT run onReady — so its mNotifications is nil and
-	// the early return below skipped the lock pass entirely.
-	s.applyMDMLocks(srvCfg.MDMManagedFields)
-
-	if s.mNotifications == nil {
-		return
-	}
-	if cfg.DisableNotifications != nil && *cfg.DisableNotifications {
-		s.mNotifications.Uncheck()
-	} else {
-		s.mNotifications.Check()
-	}
-	if s.eventManager != nil {
-		s.eventManager.SetNotificationsEnabled(s.mNotifications.Checked())
-	}
-}
-
-func protoConfigToConfig(cfg *proto.GetConfigResponse) *profilemanager.Config {
-
-	var config profilemanager.Config
-
-	if cfg.ManagementUrl != "" {
-		parsed, err := url.Parse(cfg.ManagementUrl)
-		if err != nil {
-			log.Errorf("parse management URL: %v", err)
-		} else {
-			config.ManagementURL = parsed
-		}
-	}
-
-	if cfg.PreSharedKey != "" {
-		if cfg.PreSharedKey != censoredPreSharedKey {
-			config.PreSharedKey = cfg.PreSharedKey
-		} else {
-			config.PreSharedKey = ""
-		}
-	}
-	if cfg.AdminURL != "" {
-		parsed, err := url.Parse(cfg.AdminURL)
-		if err != nil {
-			log.Errorf("parse admin URL: %v", err)
-		} else {
-			config.AdminURL = parsed
-		}
-	}
-
-	config.WgIface = cfg.InterfaceName
-	if cfg.WireguardPort >= 0 && cfg.WireguardPort <= 65535 {
-		config.WgPort = int(cfg.WireguardPort)
-	} else {
-		config.WgPort = iface.DefaultWgPort
-	}
-
-	if cfg.Mtu != 0 {
-		config.MTU = uint16(cfg.Mtu)
-	} else {
-		config.MTU = iface.DefaultMTU
-	}
-
-	config.DisableAutoConnect = cfg.DisableAutoConnect
-	config.ServerSSHAllowed = &cfg.ServerSSHAllowed
-	config.RosenpassEnabled = cfg.RosenpassEnabled
-	config.RosenpassPermissive = cfg.RosenpassPermissive
-	config.DisableNotifications = &cfg.DisableNotifications
-	config.BlockInbound = cfg.BlockInbound
-	config.NetworkMonitor = &cfg.NetworkMonitor
-	config.DisableDNS = cfg.DisableDns
-	config.DisableClientRoutes = cfg.DisableClientRoutes
-	config.DisableServerRoutes = cfg.DisableServerRoutes
-	config.DisableIPv6 = cfg.DisableIpv6
-	config.BlockLANAccess = cfg.BlockLanAccess
-
-	config.EnableSSHRoot = &cfg.EnableSSHRoot
-	config.EnableSSHSFTP = &cfg.EnableSSHSFTP
-	config.EnableSSHLocalPortForwarding = &cfg.EnableSSHLocalPortForwarding
-	config.EnableSSHRemotePortForwarding = &cfg.EnableSSHRemotePortForwarding
-	config.DisableSSHAuth = &cfg.DisableSSHAuth
-
-	ttl := int(cfg.SshJWTCacheTTL)
-	config.SSHJWTCacheTTL = &ttl
-
-	return &config
-}
-
-func (s *serviceClient) onUpdateAvailable(newVersion string, enforced bool) {
-	s.updateIndicationLock.Lock()
-	defer s.updateIndicationLock.Unlock()
-
-	s.isEnforcedUpdate = enforced
-	if enforced {
-		s.mUpdate.SetTitle("Install version " + newVersion)
-	} else {
-		s.lastNotifiedVersion = ""
-		s.mUpdate.SetTitle("Download latest version")
-	}
-
-	s.mUpdate.Show()
-	s.isUpdateIconActive = true
-
-	if s.connected {
-		systray.SetTemplateIcon(iconUpdateConnectedMacOS, s.icUpdateConnected)
-	} else {
-		systray.SetTemplateIcon(iconUpdateDisconnectedMacOS, s.icUpdateDisconnected)
-	}
-
-	if enforced && s.lastNotifiedVersion != newVersion {
-		s.lastNotifiedVersion = newVersion
-		s.notifier.Send("Update available", "A new version "+newVersion+" is ready to install")
-	}
-}
-
-// onSessionExpire sends a notification to the user when the session expires.
-func (s *serviceClient) onSessionExpire() {
-	s.sendNotification = true
-	if s.sendNotification {
-		go s.eventHandler.runSelfCommand(s.ctx, "login-url", "true")
-		s.sendNotification = false
-	}
-}
-
-// loadSettings loads the settings from the config file and updates the UI elements accordingly.
-func (s *serviceClient) loadSettings() {
-	conn, err := s.getSrvClient(failFastTimeout)
-	if err != nil {
-		log.Errorf("get client: %v", err)
-		return
-	}
-
-	currUser, err := user.Current()
-	if err != nil {
-		log.Errorf("get current user: %v", err)
-		return
-	}
-
-	activeProf, err := s.profileManager.GetActiveProfile()
-	if err != nil {
-		log.Errorf("get active profile: %v", err)
-		return
-	}
-
-	cfg, err := conn.GetConfig(s.ctx, &proto.GetConfigRequest{
-		ProfileName: activeProf.ID.String(),
-		Username:    currUser.Username,
-	})
-	if err != nil {
-		log.Errorf("get config settings from server: %v", err)
-		return
-	}
-
-	if cfg.ServerSSHAllowed {
-		s.mAllowSSH.Check()
-	} else {
-		s.mAllowSSH.Uncheck()
-	}
-
-	if cfg.DisableAutoConnect {
-		s.mAutoConnect.Uncheck()
-	} else {
-		s.mAutoConnect.Check()
-	}
-
-	if cfg.RosenpassEnabled {
-		s.mEnableRosenpass.Check()
-	} else {
-		s.mEnableRosenpass.Uncheck()
-	}
-
-	if cfg.BlockInbound {
-		s.mBlockInbound.Check()
-	} else {
-		s.mBlockInbound.Uncheck()
-	}
-
-	if cfg.DisableNotifications {
-		s.mNotifications.Uncheck()
-	} else {
-		s.mNotifications.Check()
-	}
-	if s.eventManager != nil {
-		s.eventManager.SetNotificationsEnabled(s.mNotifications.Checked())
-	}
-	s.applyMDMLocks(cfg.MDMManagedFields)
-}
-
-// applyMDMLocks disables and badges any tray submenu item or settings-
-// form widget whose underlying field is enforced by the active MDM
-// policy. Called from loadSettings (submenu refresh) and from
-// getSrvConfig (settings-window refresh). Locked items keep their value
-// already set by the surrounding refresh code — this routine only
-// flips the enabled state and the title suffix, never the value.
-func (s *serviceClient) applyMDMLocks(managed []string) {
-	set := make(map[string]bool, len(managed))
-	for _, k := range managed {
-		set[k] = true
-	}
-	s.mdmManagedFields = set
-	if len(managed) > 0 {
-		log.Infof("MDM-managed UI fields: %v", managed)
-	}
-
-	type submenuTarget struct {
-		item  *systray.MenuItem
-		title string
-		key   string
-	}
-	for _, t := range []submenuTarget{
-		{s.mAllowSSH, "Allow SSH", mdm.KeyAllowServerSSH},
-		{s.mAutoConnect, "Connect on Startup", mdm.KeyDisableAutoConnect},
-		{s.mEnableRosenpass, "Enable Quantum-Resistance", mdm.KeyRosenpassEnabled},
-		{s.mBlockInbound, "Block Inbound Connections", mdm.KeyBlockInbound},
-	} {
-		if t.item == nil {
-			continue
-		}
-		if set[t.key] {
-			t.item.SetTitle(t.title + " (MDM)")
-			t.item.Disable()
-		} else {
-			t.item.SetTitle(t.title)
-			t.item.Enable()
-		}
-	}
-
-	s.applyMDMLocksToSettingsForm(set)
-}
-
-// preSharedKeyPlaceholder returns the hint string shown in the PSK
-// Entry's placeholder slot. The placeholder is the only signal the
-// user gets that a PSK is configured, because the entry's Text is
-// forced to empty to keep the password reveal toggle from leaking
-// the daemon-returned "**********" redaction sentinel. Returns "" if
-// no PSK is present, "MDM-managed" if the key is enforced by MDM,
-// and "configured" otherwise.
-func preSharedKeyPlaceholder(cfg *proto.GetConfigResponse) string {
-	if cfg == nil || cfg.PreSharedKey == "" {
-		return ""
-	}
-	for _, k := range cfg.MDMManagedFields {
-		if k == mdm.KeyPreSharedKey {
-			return "MDM-managed"
-		}
-	}
-	return "configured"
-}
-
-// applyMDMLocksToSettingsForm disables the per-field input widgets in
-// the advanced Settings window when the corresponding MDM key is set.
-// For plain-text entries (Management URL, Interface Port) the visible
-// value is suffixed with " (MDM)" so the user sees the lock indicator
-// inline; for the password entry the suffix is skipped (a password
-// widget renders every char as a dot and the indicator would not be
-// readable). The widgets are created lazily by showSettingsUI, so
-// guard each ref against nil.
-func (s *serviceClient) applyMDMLocksToSettingsForm(set map[string]bool) {
-	type entryTarget struct {
-		entry     *widget.Entry
-		key       string
-		inlineTag bool
-	}
-	for _, t := range []entryTarget{
-		{s.iMngURL, mdm.KeyManagementURL, true},
-		{s.iPreSharedKey, mdm.KeyPreSharedKey, false},
-		{s.iInterfacePort, mdm.KeyWireguardPort, true},
-	} {
-		if t.entry == nil {
-			continue
-		}
-		if set[t.key] {
-			if t.inlineTag && t.entry.Text != "" && !strings.HasSuffix(t.entry.Text, mdmFieldSuffix) {
-				t.entry.SetText(t.entry.Text + mdmFieldSuffix)
-			}
-			t.entry.Disable()
-		} else {
-			if t.inlineTag {
-				t.entry.SetText(strings.TrimSuffix(t.entry.Text, mdmFieldSuffix))
-			}
-			t.entry.Enable()
-		}
-	}
-	type checkTarget struct {
-		check *widget.Check
-		key   string
-	}
-	for _, t := range []checkTarget{
-		{s.sDisableClientRoutes, mdm.KeyDisableClientRoutes},
-		{s.sDisableServerRoutes, mdm.KeyDisableServerRoutes},
-	} {
-		if t.check == nil {
-			continue
-		}
-		if set[t.key] {
-			t.check.Disable()
-		} else {
-			t.check.Enable()
-		}
-	}
-	if s.sRosenpassPermissive != nil && set[mdm.KeyRosenpassPermissive] {
-		// MDM lock layered on top of the Rosenpass-on/off baseline
-		// applied by getSrvConfig. No Enable() branch here: when the
-		// MDM key is removed, the next getSrvConfig refresh re-baselines
-		// the control on cfg.RosenpassEnabled and brings it back if
-		// Rosenpass is on.
-		s.sRosenpassPermissive.Disable()
-	}
-}
-
-// updateConfig updates the configuration parameters
-// based on the values selected in the settings window.
-func (s *serviceClient) updateConfig() error {
-	disableAutoStart := !s.mAutoConnect.Checked()
-	sshAllowed := s.mAllowSSH.Checked()
-	rosenpassEnabled := s.mEnableRosenpass.Checked()
-	blockInbound := s.mBlockInbound.Checked()
-	notificationsDisabled := !s.mNotifications.Checked()
-
-	activeProf, err := s.profileManager.GetActiveProfile()
-	if err != nil {
-		log.Errorf("get active profile: %v", err)
-		return err
-	}
-
-	currUser, err := user.Current()
-	if err != nil {
-		log.Errorf("get current user: %v", err)
-		return err
-	}
-
-	conn, err := s.getSrvClient(failFastTimeout)
-	if err != nil {
-		log.Errorf("get client: %v", err)
-		return err
-	}
-
-	req := proto.SetConfigRequest{
-		ProfileName:          activeProf.ID.String(),
-		Username:             currUser.Username,
-		DisableAutoConnect:   &disableAutoStart,
-		ServerSSHAllowed:     &sshAllowed,
-		RosenpassEnabled:     &rosenpassEnabled,
-		BlockInbound:         &blockInbound,
-		DisableNotifications: &notificationsDisabled,
-	}
-
-	if _, err := conn.SetConfig(s.ctx, &req); err != nil {
-		log.Errorf("set config settings on server: %v", err)
-		return err
-	}
-
-	return nil
-}
-
-// showLoginURL creates a borderless window styled like a pop-up in the top-right corner using s.wLoginURL.
-// It also starts a background goroutine that periodically checks if the client is already connected
-// and closes the window if so. The goroutine can be cancelled by the returned CancelFunc, and it is
-// also cancelled when the window is closed.
-func (s *serviceClient) showLoginURL() context.CancelFunc {
-
-	// create a cancellable context for the background check goroutine
-	ctx, cancel := context.WithCancel(s.ctx)
-
-	resIcon := fyne.NewStaticResource("netbird.png", iconAbout)
-
-	if s.wLoginURL == nil {
-		s.wLoginURL = s.app.NewWindow("NetBird Session Expired")
-		s.wLoginURL.Resize(fyne.NewSize(400, 200))
-		s.wLoginURL.SetIcon(resIcon)
-	}
-	// ensure goroutine is cancelled when the window is closed
-	s.wLoginURL.SetOnClosed(func() { cancel() })
-	// add a description label
-	label := widget.NewLabel("Your NetBird session has expired.\nPlease re-authenticate to continue using NetBird.")
-
-	btn := widget.NewButtonWithIcon("Re-authenticate", theme.ViewRefreshIcon(), func() {
-
-		conn, err := s.getSrvClient(defaultFailTimeout)
-		if err != nil {
-			log.Errorf("get client: %v", err)
-			return
-		}
-
-		resp, err := s.login(ctx, false)
-		if err != nil {
-			log.Errorf("failed to fetch login URL: %v", err)
-			return
-		}
-		verificationURL := resp.VerificationURIComplete
-		if verificationURL == "" {
-			verificationURL = resp.VerificationURI
-		}
-
-		if verificationURL == "" {
-			log.Error("no verification URL provided in the login response")
-			return
-		}
-
-		if err := openURL(verificationURL); err != nil {
-			log.Errorf("failed to open login URL: %v", err)
-			return
-		}
-
-		_, err = conn.WaitSSOLogin(ctx, &proto.WaitSSOLoginRequest{UserCode: resp.UserCode})
-		if err != nil {
-			log.Errorf("Waiting sso login failed with: %v", err)
-			label.SetText("Waiting login failed, please create \na debug bundle in the settings and contact support.")
-			return
-		}
-
-		label.SetText("Re-authentication successful.\nReconnecting")
-		status, err := conn.Status(ctx, &proto.StatusRequest{})
-		if err != nil {
-			log.Errorf("get service status: %v", err)
-			return
-		}
-
-		if status.Status == string(internal.StatusConnected) {
-			label.SetText("Already connected.\nClosing this window.")
-			time.Sleep(2 * time.Second)
-			s.wLoginURL.Close()
-			return
-		}
-
-		_, err = conn.Up(ctx, &proto.UpRequest{})
-		if err != nil {
-			label.SetText("Reconnecting failed, please create \na debug bundle in the settings and contact support.")
-			log.Errorf("Reconnecting failed with: %v", err)
-			return
-		}
-
-		label.SetText("Connection successful.\nClosing this window.")
-		time.Sleep(time.Second)
-
-		s.wLoginURL.Close()
-	})
-
-	img := canvas.NewImageFromResource(resIcon)
-	img.FillMode = canvas.ImageFillContain
-	img.SetMinSize(fyne.NewSize(64, 64))
-	img.Resize(fyne.NewSize(64, 64))
-
-	// center the content vertically
-	content := container.NewVBox(
-		layout.NewSpacer(),
-		img,
-		label,
-		btn,
-		layout.NewSpacer(),
-	)
-	s.wLoginURL.SetContent(container.NewCenter(content))
-
-	// start a goroutine to check connection status and close the window if connected
-	go func() {
-		ticker := time.NewTicker(5 * time.Second)
-		defer ticker.Stop()
-
-		conn, err := s.getSrvClient(failFastTimeout)
-		if err != nil {
-			return
-		}
-
-		for {
-			select {
-			case <-ctx.Done():
-				return
-			case <-ticker.C:
-				status, err := conn.Status(s.ctx, &proto.StatusRequest{})
-				if err != nil {
-					continue
-				}
-				if status.Status == string(internal.StatusConnected) {
-					if s.wLoginURL != nil {
-						s.wLoginURL.Close()
-					}
-					return
-				}
-			}
-		}
-	}()
-
-	s.wLoginURL.Show()
-
-	// return cancel func so callers can stop the background goroutine if desired
-	return cancel
-}
-
-func openURL(url string) error {
-	if browser := os.Getenv("BROWSER"); browser != "" {
-		return exec.Command(browser, url).Start()
-	}
-
-	var err error
-	switch runtime.GOOS {
-	case "windows":
-		err = exec.Command("rundll32", "url.dll,FileProtocolHandler", url).Start()
-	case "darwin":
-		err = exec.Command("open", url).Start()
-	case "linux", "freebsd":
-		err = exec.Command("xdg-open", url).Start()
-	default:
-		err = fmt.Errorf("unsupported platform")
-	}
-	return err
-}
diff --git a/client/ui/const.go b/client/ui/const.go
deleted file mode 100644
index ce7a9a294..000000000
--- a/client/ui/const.go
+++ /dev/null
@@ -1,15 +0,0 @@
-package main
-
-const (
-	allowSSHMenuDescr          = "Allow SSH connections"
-	autoConnectMenuDescr       = "Connect automatically when the service starts"
-	quantumResistanceMenuDescr = "Enable post-quantum security via Rosenpass"
-	blockInboundMenuDescr      = "Block inbound connections to the local machine and routed networks"
-	notificationsMenuDescr     = "Enable notifications"
-	advancedSettingsMenuDescr  = "Advanced settings of the application"
-	debugBundleMenuDescr       = "Create and open debug information bundle"
-	disabledMenuDescr          = ""
-	networksMenuDescr          = "Open the networks management window"
-	latestVersionMenuDescr     = "Download latest version"
-	quitMenuDescr              = "Quit the client app"
-)
diff --git a/client/ui/debug.go b/client/ui/debug.go
deleted file mode 100644
index d3d4fa4f8..000000000
--- a/client/ui/debug.go
+++ /dev/null
@@ -1,730 +0,0 @@
-//go:build !(linux && 386)
-
-package main
-
-import (
-	"context"
-	"fmt"
-	"path/filepath"
-	"strconv"
-	"sync"
-	"time"
-
-	"fyne.io/fyne/v2"
-	"fyne.io/fyne/v2/container"
-	"fyne.io/fyne/v2/dialog"
-	"fyne.io/fyne/v2/widget"
-	log "github.com/sirupsen/logrus"
-	"github.com/skratchdot/open-golang/open"
-	"google.golang.org/protobuf/types/known/durationpb"
-
-	"github.com/netbirdio/netbird/client/internal"
-	"github.com/netbirdio/netbird/client/proto"
-	uptypes "github.com/netbirdio/netbird/upload-server/types"
-	"github.com/netbirdio/netbird/version"
-)
-
-// Initial state for the debug collection
-type debugInitialState struct {
-	wasDown        bool
-	needsRestoreUp bool
-	logLevel       proto.LogLevel
-	isLevelTrace   bool
-}
-
-// Debug collection parameters
-type debugCollectionParams struct {
-	duration          time.Duration
-	anonymize         bool
-	systemInfo        bool
-	upload            bool
-	uploadURL         string
-	enablePersistence bool
-	capture           bool
-}
-
-// UI components for progress tracking
-type progressUI struct {
-	statusLabel *widget.Label
-	progressBar *widget.ProgressBar
-	uiControls  []fyne.Disableable
-	window      fyne.Window
-}
-
-func (s *serviceClient) showDebugUI() {
-	w := s.app.NewWindow("NetBird Debug")
-	w.SetOnClosed(s.cancel)
-	w.Resize(fyne.NewSize(600, 500))
-	w.SetFixedSize(true)
-
-	anonymizeCheck := widget.NewCheck("Anonymize sensitive information (public IPs, domains, ...)", nil)
-	systemInfoCheck := widget.NewCheck("Include system information (routes, interfaces, ...)", nil)
-	systemInfoCheck.SetChecked(true)
-	captureCheck := widget.NewCheck("Include packet capture", nil)
-	uploadCheck := widget.NewCheck("Upload bundle automatically after creation", nil)
-	uploadCheck.SetChecked(true)
-
-	uploadURLContainer, uploadURL := s.buildUploadSection(uploadCheck)
-
-	debugModeContainer, runForDurationCheck, durationInput, noteLabel := s.buildDurationSection()
-
-	statusLabel := widget.NewLabel("")
-	statusLabel.Hide()
-	progressBar := widget.NewProgressBar()
-	progressBar.Hide()
-	createButton := widget.NewButton("Create Debug Bundle", nil)
-
-	uiControls := []fyne.Disableable{
-		anonymizeCheck, systemInfoCheck, captureCheck,
-		uploadCheck, uploadURL, runForDurationCheck, durationInput, createButton,
-	}
-
-	createButton.OnTapped = s.getCreateHandler(
-		statusLabel, progressBar, uploadCheck, uploadURL,
-		anonymizeCheck, systemInfoCheck, captureCheck,
-		runForDurationCheck, durationInput, uiControls, w,
-	)
-
-	content := container.NewVBox(
-		widget.NewLabel("Create a debug bundle to help troubleshoot issues with NetBird"),
-		widget.NewLabel(""),
-		anonymizeCheck, systemInfoCheck, captureCheck,
-		uploadCheck, uploadURLContainer,
-		widget.NewLabel(""),
-		debugModeContainer, noteLabel,
-		widget.NewLabel(""),
-		statusLabel, progressBar, createButton,
-	)
-
-	w.SetContent(container.NewPadded(content))
-	w.Show()
-}
-
-func (s *serviceClient) buildUploadSection(uploadCheck *widget.Check) (*fyne.Container, *widget.Entry) {
-	uploadURL := widget.NewEntry()
-	uploadURL.SetText(uptypes.DefaultBundleURL)
-	uploadURL.SetPlaceHolder("Enter upload URL")
-
-	uploadURLContainer := container.NewVBox(widget.NewLabel("Debug upload URL:"), uploadURL)
-
-	uploadCheck.OnChanged = func(checked bool) {
-		if checked {
-			uploadURLContainer.Show()
-		} else {
-			uploadURLContainer.Hide()
-		}
-	}
-	return uploadURLContainer, uploadURL
-}
-
-func (s *serviceClient) buildDurationSection() (*fyne.Container, *widget.Check, *widget.Entry, *widget.Label) {
-	runForDurationCheck := widget.NewCheck("Run with trace logs before creating bundle", nil)
-	runForDurationCheck.SetChecked(true)
-
-	forLabel := widget.NewLabel("for")
-	durationInput := widget.NewEntry()
-	durationInput.SetText("1")
-	minutesLabel := widget.NewLabel("minute")
-	durationInput.Validator = func(s string) error {
-		return validateMinute(s, minutesLabel)
-	}
-
-	noteLabel := widget.NewLabel("Note: NetBird will be brought up and down during collection")
-
-	runForDurationCheck.OnChanged = func(checked bool) {
-		if checked {
-			forLabel.Show()
-			durationInput.Show()
-			minutesLabel.Show()
-			noteLabel.Show()
-		} else {
-			forLabel.Hide()
-			durationInput.Hide()
-			minutesLabel.Hide()
-			noteLabel.Hide()
-		}
-	}
-
-	modeContainer := container.NewHBox(runForDurationCheck, forLabel, durationInput, minutesLabel)
-	return modeContainer, runForDurationCheck, durationInput, noteLabel
-}
-
-func validateMinute(s string, minutesLabel *widget.Label) error {
-	if val, err := strconv.Atoi(s); err != nil || val < 1 {
-		return fmt.Errorf("must be a number ≥ 1")
-	}
-	if s == "1" {
-		minutesLabel.SetText("minute")
-	} else {
-		minutesLabel.SetText("minutes")
-	}
-	return nil
-}
-
-// disableUIControls disables the provided UI controls
-func disableUIControls(controls []fyne.Disableable) {
-	for _, control := range controls {
-		control.Disable()
-	}
-}
-
-// enableUIControls enables the provided UI controls
-func enableUIControls(controls []fyne.Disableable) {
-	for _, control := range controls {
-		control.Enable()
-	}
-}
-
-func (s *serviceClient) getCreateHandler(
-	statusLabel *widget.Label,
-	progressBar *widget.ProgressBar,
-	uploadCheck *widget.Check,
-	uploadURL *widget.Entry,
-	anonymizeCheck *widget.Check,
-	systemInfoCheck *widget.Check,
-	captureCheck *widget.Check,
-	runForDurationCheck *widget.Check,
-	duration *widget.Entry,
-	uiControls []fyne.Disableable,
-	w fyne.Window,
-) func() {
-	return func() {
-		disableUIControls(uiControls)
-		statusLabel.Show()
-
-		var url string
-		if uploadCheck.Checked {
-			url = uploadURL.Text
-			if url == "" {
-				statusLabel.SetText("Error: Upload URL is required when upload is enabled")
-				enableUIControls(uiControls)
-				return
-			}
-		}
-
-		params := &debugCollectionParams{
-			anonymize:         anonymizeCheck.Checked,
-			systemInfo:        systemInfoCheck.Checked,
-			capture:           captureCheck.Checked,
-			upload:            uploadCheck.Checked,
-			uploadURL:         url,
-			enablePersistence: true,
-		}
-
-		runForDuration := runForDurationCheck.Checked
-		if runForDuration {
-			minutes, err := time.ParseDuration(duration.Text + "m")
-			if err != nil {
-				statusLabel.SetText(fmt.Sprintf("Error: Invalid duration: %v", err))
-				enableUIControls(uiControls)
-				return
-			}
-			params.duration = minutes
-
-			statusLabel.SetText(fmt.Sprintf("Running in debug mode for %d minutes...", int(minutes.Minutes())))
-			progressBar.Show()
-			progressBar.SetValue(0)
-
-			go s.handleRunForDuration(
-				statusLabel,
-				progressBar,
-				uiControls,
-				w,
-				params,
-			)
-			return
-		}
-
-		statusLabel.SetText("Creating debug bundle...")
-		go s.handleDebugCreation(
-			params,
-			statusLabel,
-			uiControls,
-			w,
-		)
-	}
-}
-
-func (s *serviceClient) handleRunForDuration(
-	statusLabel *widget.Label,
-	progressBar *widget.ProgressBar,
-	uiControls []fyne.Disableable,
-	w fyne.Window,
-	params *debugCollectionParams,
-) {
-	progressUI := &progressUI{
-		statusLabel: statusLabel,
-		progressBar: progressBar,
-		uiControls:  uiControls,
-		window:      w,
-	}
-
-	conn, err := s.getSrvClient(failFastTimeout)
-	if err != nil {
-		handleError(progressUI, fmt.Sprintf("Failed to get client for debug: %v", err))
-		return
-	}
-
-	initialState, err := s.getInitialState(conn)
-	if err != nil {
-		handleError(progressUI, err.Error())
-		return
-	}
-
-	defer s.restoreServiceState(conn, initialState)
-
-	if err := s.collectDebugData(conn, initialState, params, progressUI); err != nil {
-		handleError(progressUI, err.Error())
-		return
-	}
-
-	if err := s.createDebugBundleFromCollection(conn, params, progressUI); err != nil {
-		handleError(progressUI, err.Error())
-		return
-	}
-
-	progressUI.statusLabel.SetText("Bundle created successfully")
-}
-
-// Get initial state of the service
-func (s *serviceClient) getInitialState(conn proto.DaemonServiceClient) (*debugInitialState, error) {
-	statusResp, err := conn.Status(s.ctx, &proto.StatusRequest{})
-	if err != nil {
-		return nil, fmt.Errorf(" get status: %v", err)
-	}
-
-	logLevelResp, err := conn.GetLogLevel(s.ctx, &proto.GetLogLevelRequest{})
-	if err != nil {
-		return nil, fmt.Errorf("get log level: %v", err)
-	}
-
-	wasDown := statusResp.Status != string(internal.StatusConnected) &&
-		statusResp.Status != string(internal.StatusConnecting)
-
-	initialLogLevel := logLevelResp.GetLevel()
-	initialLevelTrace := initialLogLevel >= proto.LogLevel_TRACE
-
-	return &debugInitialState{
-		wasDown:      wasDown,
-		logLevel:     initialLogLevel,
-		isLevelTrace: initialLevelTrace,
-	}, nil
-}
-
-// Handle progress tracking during collection
-func startProgressTracker(ctx context.Context, wg *sync.WaitGroup, duration time.Duration, progress *progressUI) {
-	progress.progressBar.Show()
-	progress.progressBar.SetValue(0)
-
-	startTime := time.Now()
-	endTime := startTime.Add(duration)
-	wg.Add(1)
-
-	go func() {
-		defer wg.Done()
-		ticker := time.NewTicker(500 * time.Millisecond)
-		defer ticker.Stop()
-
-		for {
-			select {
-			case <-ctx.Done():
-				return
-			case <-ticker.C:
-				remaining := time.Until(endTime)
-				if remaining <= 0 {
-					remaining = 0
-				}
-
-				elapsed := time.Since(startTime)
-				progressVal := float64(elapsed) / float64(duration)
-				if progressVal > 1.0 {
-					progressVal = 1.0
-				}
-
-				progress.progressBar.SetValue(progressVal)
-				progress.statusLabel.SetText(fmt.Sprintf("Running with trace logs... %s remaining", formatDuration(remaining)))
-			}
-		}
-	}()
-
-}
-
-func (s *serviceClient) configureServiceForDebug(
-	conn proto.DaemonServiceClient,
-	state *debugInitialState,
-	params *debugCollectionParams,
-) {
-	if state.wasDown {
-		if _, err := conn.Up(s.ctx, &proto.UpRequest{}); err != nil {
-			log.Warnf("failed to bring service up: %v", err)
-		} else {
-			log.Info("Service brought up for debug")
-			time.Sleep(time.Second * 10)
-		}
-	}
-
-	if !state.isLevelTrace {
-		if _, err := conn.SetLogLevel(s.ctx, &proto.SetLogLevelRequest{Level: proto.LogLevel_TRACE}); err != nil {
-			log.Warnf("failed to set log level to TRACE: %v", err)
-		} else {
-			log.Info("Log level set to TRACE for debug")
-		}
-	}
-
-	if _, err := conn.Down(s.ctx, &proto.DownRequest{}); err != nil {
-		log.Warnf("failed to bring service down: %v", err)
-	} else {
-		state.needsRestoreUp = !state.wasDown
-		time.Sleep(time.Second)
-	}
-
-	if params.enablePersistence {
-		if _, err := conn.SetSyncResponsePersistence(s.ctx, &proto.SetSyncResponsePersistenceRequest{
-			Enabled: true,
-		}); err != nil {
-			log.Warnf("failed to enable sync response persistence: %v", err)
-		} else {
-			log.Info("Sync response persistence enabled for debug")
-		}
-	}
-
-	if _, err := conn.Up(s.ctx, &proto.UpRequest{}); err != nil {
-		log.Warnf("failed to bring service back up: %v", err)
-	} else {
-		state.needsRestoreUp = false
-		time.Sleep(time.Second * 3)
-	}
-
-	if _, err := conn.StartCPUProfile(s.ctx, &proto.StartCPUProfileRequest{}); err != nil {
-		log.Warnf("failed to start CPU profiling: %v", err)
-	}
-
-	s.startBundleCaptureIfEnabled(conn, params)
-}
-
-func (s *serviceClient) startBundleCaptureIfEnabled(conn proto.DaemonServiceClient, params *debugCollectionParams) {
-	if !params.capture {
-		return
-	}
-
-	const maxCapture = 10 * time.Minute
-	timeout := params.duration + 30*time.Second
-	if timeout > maxCapture {
-		timeout = maxCapture
-		log.Warnf("packet capture clamped to %s (server maximum)", maxCapture)
-	}
-	if _, err := conn.StartBundleCapture(s.ctx, &proto.StartBundleCaptureRequest{
-		Timeout: durationpb.New(timeout),
-	}); err != nil {
-		log.Warnf("failed to start bundle capture: %v", err)
-	}
-}
-
-func (s *serviceClient) collectDebugData(
-	conn proto.DaemonServiceClient,
-	state *debugInitialState,
-	params *debugCollectionParams,
-	progress *progressUI,
-) error {
-	ctx, cancel := context.WithTimeout(s.ctx, params.duration)
-	defer cancel()
-	var wg sync.WaitGroup
-	startProgressTracker(ctx, &wg, params.duration, progress)
-
-	s.configureServiceForDebug(conn, state, params)
-
-	wg.Wait()
-	progress.progressBar.Hide()
-	progress.statusLabel.SetText("Collecting debug data...")
-
-	if _, err := conn.StopCPUProfile(s.ctx, &proto.StopCPUProfileRequest{}); err != nil {
-		log.Warnf("failed to stop CPU profiling: %v", err)
-	}
-
-	if params.capture {
-		stopCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-		defer cancel()
-		if _, err := conn.StopBundleCapture(stopCtx, &proto.StopBundleCaptureRequest{}); err != nil {
-			log.Warnf("failed to stop bundle capture: %v", err)
-		}
-	}
-
-	return nil
-}
-
-// Create the debug bundle with collected data
-func (s *serviceClient) createDebugBundleFromCollection(
-	conn proto.DaemonServiceClient,
-	params *debugCollectionParams,
-	progress *progressUI,
-) error {
-	progress.statusLabel.SetText("Creating debug bundle with collected logs...")
-
-	request := &proto.DebugBundleRequest{
-		Anonymize:  params.anonymize,
-		SystemInfo: params.systemInfo,
-		CliVersion: version.NetbirdVersion(),
-	}
-
-	if params.upload {
-		request.UploadURL = params.uploadURL
-	}
-
-	resp, err := conn.DebugBundle(s.ctx, request)
-	if err != nil {
-		return fmt.Errorf("create debug bundle: %v", err)
-	}
-
-	// Show appropriate dialog based on upload status
-	localPath := resp.GetPath()
-	uploadFailureReason := resp.GetUploadFailureReason()
-	uploadedKey := resp.GetUploadedKey()
-
-	if params.upload {
-		if uploadFailureReason != "" {
-			showUploadFailedDialog(progress.window, localPath, uploadFailureReason)
-		} else {
-			showUploadSuccessDialog(s.app, progress.window, localPath, uploadedKey)
-		}
-	} else {
-		showBundleCreatedDialog(progress.window, localPath)
-	}
-
-	enableUIControls(progress.uiControls)
-	return nil
-}
-
-// Restore service to original state
-func (s *serviceClient) restoreServiceState(conn proto.DaemonServiceClient, state *debugInitialState) {
-	if state.needsRestoreUp {
-		if _, err := conn.Up(s.ctx, &proto.UpRequest{}); err != nil {
-			log.Warnf("failed to restore up state: %v", err)
-		} else {
-			log.Info("Service state restored to up")
-		}
-	}
-
-	if state.wasDown {
-		if _, err := conn.Down(s.ctx, &proto.DownRequest{}); err != nil {
-			log.Warnf("failed to restore down state: %v", err)
-		} else {
-			log.Info("Service state restored to down")
-		}
-	}
-
-	if !state.isLevelTrace {
-		if _, err := conn.SetLogLevel(s.ctx, &proto.SetLogLevelRequest{Level: state.logLevel}); err != nil {
-			log.Warnf("failed to restore log level: %v", err)
-		} else {
-			log.Info("Log level restored to original setting")
-		}
-	}
-}
-
-// Handle errors during debug collection
-func handleError(progress *progressUI, errMsg string) {
-	log.Errorf("%s", errMsg)
-	progress.statusLabel.SetText(errMsg)
-	progress.progressBar.Hide()
-	enableUIControls(progress.uiControls)
-}
-
-func (s *serviceClient) handleDebugCreation(
-	params *debugCollectionParams,
-	statusLabel *widget.Label,
-	uiControls []fyne.Disableable,
-	w fyne.Window,
-) {
-	conn, err := s.getSrvClient(failFastTimeout)
-	if err != nil {
-		log.Errorf("Failed to get client for debug: %v", err)
-		statusLabel.SetText(fmt.Sprintf("Error: %v", err))
-		enableUIControls(uiControls)
-		return
-	}
-
-	if params.capture {
-		if _, err := conn.StartBundleCapture(s.ctx, &proto.StartBundleCaptureRequest{
-			Timeout: durationpb.New(30 * time.Second),
-		}); err != nil {
-			log.Warnf("failed to start bundle capture: %v", err)
-		} else {
-			defer func() {
-				stopCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-				defer cancel()
-				if _, err := conn.StopBundleCapture(stopCtx, &proto.StopBundleCaptureRequest{}); err != nil {
-					log.Warnf("failed to stop bundle capture: %v", err)
-				}
-			}()
-			time.Sleep(2 * time.Second)
-		}
-	}
-
-	resp, err := s.createDebugBundle(params.anonymize, params.systemInfo, params.uploadURL)
-	if err != nil {
-		log.Errorf("Failed to create debug bundle: %v", err)
-		statusLabel.SetText(fmt.Sprintf("Error creating bundle: %v", err))
-		enableUIControls(uiControls)
-		return
-	}
-
-	localPath := resp.GetPath()
-	uploadFailureReason := resp.GetUploadFailureReason()
-	uploadedKey := resp.GetUploadedKey()
-
-	if params.upload {
-		if uploadFailureReason != "" {
-			showUploadFailedDialog(w, localPath, uploadFailureReason)
-		} else {
-			showUploadSuccessDialog(s.app, w, localPath, uploadedKey)
-		}
-	} else {
-		showBundleCreatedDialog(w, localPath)
-	}
-
-	enableUIControls(uiControls)
-	statusLabel.SetText("Bundle created successfully")
-}
-
-func (s *serviceClient) createDebugBundle(anonymize bool, systemInfo bool, uploadURL string) (*proto.DebugBundleResponse, error) {
-	conn, err := s.getSrvClient(failFastTimeout)
-	if err != nil {
-		return nil, fmt.Errorf("get client: %v", err)
-	}
-
-	request := &proto.DebugBundleRequest{
-		Anonymize:  anonymize,
-		SystemInfo: systemInfo,
-		CliVersion: version.NetbirdVersion(),
-	}
-
-	if uploadURL != "" {
-		request.UploadURL = uploadURL
-	}
-
-	resp, err := conn.DebugBundle(s.ctx, request)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create debug bundle via daemon: %v", err)
-	}
-
-	return resp, nil
-}
-
-// formatDuration formats a duration in HH:MM:SS format
-func formatDuration(d time.Duration) string {
-	d = d.Round(time.Second)
-	h := d / time.Hour
-	d %= time.Hour
-	m := d / time.Minute
-	d %= time.Minute
-	s := d / time.Second
-	return fmt.Sprintf("%02d:%02d:%02d", h, m, s)
-}
-
-// createButtonWithAction creates a button with the given label and action
-func createButtonWithAction(label string, action func()) *widget.Button {
-	button := widget.NewButton(label, action)
-	return button
-}
-
-// showUploadFailedDialog displays a dialog when upload fails
-func showUploadFailedDialog(w fyne.Window, localPath, failureReason string) {
-	content := container.NewVBox(
-		widget.NewLabel(fmt.Sprintf("Bundle upload failed:\n%s\n\n"+
-			"A local copy was saved at:\n%s", failureReason, localPath)),
-	)
-
-	customDialog := dialog.NewCustom("Upload Failed", "Cancel", content, w)
-
-	buttonBox := container.NewHBox(
-		createButtonWithAction("Open file", func() {
-			log.Infof("Attempting to open local file: %s", localPath)
-			if openErr := open.Start(localPath); openErr != nil {
-				log.Errorf("Failed to open local file '%s': %v", localPath, openErr)
-				dialog.ShowError(fmt.Errorf("open the local file:\n%s\n\nError: %v", localPath, openErr), w)
-			}
-		}),
-		createButtonWithAction("Open folder", func() {
-			folderPath := filepath.Dir(localPath)
-			log.Infof("Attempting to open local folder: %s", folderPath)
-			if openErr := open.Start(folderPath); openErr != nil {
-				log.Errorf("Failed to open local folder '%s': %v", folderPath, openErr)
-				dialog.ShowError(fmt.Errorf("open the local folder:\n%s\n\nError: %v", folderPath, openErr), w)
-			}
-		}),
-	)
-
-	content.Add(buttonBox)
-	customDialog.Show()
-}
-
-// showUploadSuccessDialog displays a dialog when upload succeeds
-func showUploadSuccessDialog(a fyne.App, w fyne.Window, localPath, uploadedKey string) {
-	log.Infof("Upload key: %s", uploadedKey)
-	keyEntry := widget.NewEntry()
-	keyEntry.SetText(uploadedKey)
-	keyEntry.Disable()
-
-	content := container.NewVBox(
-		widget.NewLabel("Bundle uploaded successfully!"),
-		widget.NewLabel(""),
-		widget.NewLabel("Upload key:"),
-		keyEntry,
-		widget.NewLabel(""),
-		widget.NewLabel(fmt.Sprintf("Local copy saved at:\n%s", localPath)),
-	)
-
-	customDialog := dialog.NewCustom("Upload Successful", "OK", content, w)
-
-	copyBtn := createButtonWithAction("Copy key", func() {
-		a.Clipboard().SetContent(uploadedKey)
-		log.Info("Upload key copied to clipboard")
-	})
-
-	buttonBox := createButtonBox(localPath, w, copyBtn)
-	content.Add(buttonBox)
-	customDialog.Show()
-}
-
-// showBundleCreatedDialog displays a dialog when bundle is created without upload
-func showBundleCreatedDialog(w fyne.Window, localPath string) {
-	content := container.NewVBox(
-		widget.NewLabel(fmt.Sprintf("Bundle created locally at:\n%s\n\n"+
-			"Administrator privileges may be required to access the file.", localPath)),
-	)
-
-	customDialog := dialog.NewCustom("Debug Bundle Created", "Cancel", content, w)
-
-	buttonBox := createButtonBox(localPath, w, nil)
-	content.Add(buttonBox)
-	customDialog.Show()
-}
-
-func createButtonBox(localPath string, w fyne.Window, elems ...fyne.Widget) *fyne.Container {
-	box := container.NewHBox()
-	for _, elem := range elems {
-		box.Add(elem)
-	}
-
-	fileBtn := createButtonWithAction("Open file", func() {
-		log.Infof("Attempting to open local file: %s", localPath)
-		if openErr := open.Start(localPath); openErr != nil {
-			log.Errorf("Failed to open local file '%s': %v", localPath, openErr)
-			dialog.ShowError(fmt.Errorf("open the local file:\n%s\n\nError: %v", localPath, openErr), w)
-		}
-	})
-
-	folderBtn := createButtonWithAction("Open folder", func() {
-		folderPath := filepath.Dir(localPath)
-		log.Infof("Attempting to open local folder: %s", folderPath)
-		if openErr := open.Start(folderPath); openErr != nil {
-			log.Errorf("Failed to open local folder '%s': %v", folderPath, openErr)
-			dialog.ShowError(fmt.Errorf("open the local folder:\n%s\n\nError: %v", folderPath, openErr), w)
-		}
-	})
-
-	box.Add(fileBtn)
-	box.Add(folderBtn)
-
-	return box
-}
diff --git a/client/ui/dock_darwin.go b/client/ui/dock_darwin.go
new file mode 100644
index 000000000..dd8c60073
--- /dev/null
+++ b/client/ui/dock_darwin.go
@@ -0,0 +1,70 @@
+//go:build darwin
+
+package main
+
+/*
+#cgo CFLAGS: -x objective-c
+#cgo LDFLAGS: -framework Cocoa
+#import <Cocoa/Cocoa.h>
+
+static int lastDockState = -1;
+
+static void refreshDockPolicy(void) {
+    dispatch_async(dispatch_get_main_queue(), ^{
+        Class cls = NSClassFromString(@"WebviewWindow");
+        if (cls == nil) {
+            return;
+        }
+        int visible = 0;
+        for (NSWindow *w in [NSApp windows]) {
+            if ([w isKindOfClass:cls] && [w isVisible]) {
+                visible = 1;
+                break;
+            }
+        }
+        if (visible == lastDockState) {
+            return;
+        }
+        lastDockState = visible;
+
+        // Set application to "Regular" and show dock icon (when visible) or to "Accessory" (when hidden)
+        if (visible) {
+            [NSApp setActivationPolicy:NSApplicationActivationPolicyRegular];
+            [NSApp activateIgnoringOtherApps:YES];
+        } else {
+            [NSApp setActivationPolicy:NSApplicationActivationPolicyAccessory];
+        }
+    });
+}
+
+static int dockObserverInstalled = 0;
+
+static void initDockObserver(void) {
+    dispatch_async(dispatch_get_main_queue(), ^{
+        if (dockObserverInstalled) {
+            return;
+        }
+        dockObserverInstalled = 1;
+        NSNotificationCenter *nc = [NSNotificationCenter defaultCenter];
+        void (^trigger)(NSNotification *) = ^(NSNotification *_) {
+            refreshDockPolicy();
+        };
+
+        [nc addObserverForName:NSWindowDidChangeOcclusionStateNotification
+                        object:nil
+                         queue:nil
+                    usingBlock:trigger];
+        [nc addObserverForName:NSWindowWillCloseNotification
+                        object:nil
+                         queue:nil
+                    usingBlock:trigger];
+
+        refreshDockPolicy();
+    });
+}
+*/
+import "C"
+
+func initDockObserver() {
+	C.initDockObserver()
+}
diff --git a/client/ui/dock_other.go b/client/ui/dock_other.go
new file mode 100644
index 000000000..0ace89552
--- /dev/null
+++ b/client/ui/dock_other.go
@@ -0,0 +1,7 @@
+//go:build !darwin && !android && !ios && !freebsd && !js
+
+package main
+
+func initDockObserver() {
+	// macOS-only; Linux and Windows taskbar entries already gate on window visibility natively.
+}
diff --git a/client/ui/event/event.go b/client/ui/event/event.go
deleted file mode 100644
index 3b43fdc7f..000000000
--- a/client/ui/event/event.go
+++ /dev/null
@@ -1,184 +0,0 @@
-package event
-
-import (
-	"context"
-	"fmt"
-	"slices"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/cenkalti/backoff/v4"
-	log "github.com/sirupsen/logrus"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
-
-	"github.com/netbirdio/netbird/client/proto"
-	"github.com/netbirdio/netbird/client/ui/desktop"
-)
-
-// Notifier sends desktop notifications. Defined here so the event package
-// does not depend on fyne or the platform-specific notifier implementation.
-type Notifier interface {
-	Send(title, body string)
-}
-
-type Handler func(*proto.SystemEvent)
-
-type Manager struct {
-	notifier Notifier
-	addr     string
-
-	mu       sync.Mutex
-	ctx      context.Context
-	cancel   context.CancelFunc
-	enabled  bool
-	handlers []Handler
-}
-
-func NewManager(notifier Notifier, addr string) *Manager {
-	return &Manager{
-		notifier: notifier,
-		addr:     addr,
-	}
-}
-
-func (e *Manager) Start(ctx context.Context) {
-	e.mu.Lock()
-	e.ctx, e.cancel = context.WithCancel(ctx)
-	e.mu.Unlock()
-
-	expBackOff := backoff.WithContext(&backoff.ExponentialBackOff{
-		InitialInterval:     time.Second,
-		RandomizationFactor: backoff.DefaultRandomizationFactor,
-		Multiplier:          backoff.DefaultMultiplier,
-		MaxInterval:         10 * time.Second,
-		MaxElapsedTime:      0,
-		Stop:                backoff.Stop,
-		Clock:               backoff.SystemClock,
-	}, ctx)
-
-	if err := backoff.Retry(e.streamEvents, expBackOff); err != nil {
-		log.Errorf("event stream ended: %v", err)
-	}
-}
-
-func (e *Manager) streamEvents() error {
-	e.mu.Lock()
-	ctx := e.ctx
-	e.mu.Unlock()
-
-	client, err := getClient(e.addr)
-	if err != nil {
-		return fmt.Errorf("create client: %w", err)
-	}
-
-	stream, err := client.SubscribeEvents(ctx, &proto.SubscribeRequest{})
-	if err != nil {
-		return fmt.Errorf("failed to subscribe to events: %w", err)
-	}
-
-	log.Info("subscribed to daemon events")
-	defer func() {
-		log.Info("unsubscribed from daemon events")
-	}()
-
-	for {
-		event, err := stream.Recv()
-		if err != nil {
-			return fmt.Errorf("error receiving event: %w", err)
-		}
-		e.handleEvent(event)
-	}
-}
-
-func (e *Manager) Stop() {
-	e.mu.Lock()
-	defer e.mu.Unlock()
-	if e.cancel != nil {
-		e.cancel()
-	}
-}
-
-func (e *Manager) SetNotificationsEnabled(enabled bool) {
-	e.mu.Lock()
-	defer e.mu.Unlock()
-	e.enabled = enabled
-}
-
-func (e *Manager) handleEvent(event *proto.SystemEvent) {
-	e.mu.Lock()
-	enabled := e.enabled
-	handlers := slices.Clone(e.handlers)
-	e.mu.Unlock()
-
-	if event.UserMessage != "" && (enabled || event.Severity == proto.SystemEvent_CRITICAL) && !isV6DefaultRoutePartner(event) {
-		title := e.getEventTitle(event)
-		body := event.UserMessage
-		id := event.Metadata["id"]
-		if id != "" {
-			body += fmt.Sprintf(" ID: %s", id)
-		}
-		e.notifier.Send(title, body)
-	}
-
-	for _, handler := range handlers {
-		go handler(event)
-	}
-}
-
-func (e *Manager) AddHandler(handler Handler) {
-	e.mu.Lock()
-	defer e.mu.Unlock()
-	e.handlers = append(e.handlers, handler)
-}
-
-// isV6DefaultRoutePartner reports whether the event is the IPv6 half of a
-// paired v4/v6 default-route event. Management always pairs ::/0 with 0.0.0.0/0
-// for exit nodes, so the v4 partner already drives the user-facing toast and
-// the v6 one is suppressed to avoid a duplicate notification.
-func isV6DefaultRoutePartner(event *proto.SystemEvent) bool {
-	return event.Category == proto.SystemEvent_NETWORK && event.Metadata["network"] == "::/0"
-}
-
-func (e *Manager) getEventTitle(event *proto.SystemEvent) string {
-	var prefix string
-	switch event.Severity {
-	case proto.SystemEvent_CRITICAL:
-		prefix = "Critical"
-	case proto.SystemEvent_ERROR:
-		prefix = "Error"
-	case proto.SystemEvent_WARNING:
-		prefix = "Warning"
-	default:
-		prefix = "Info"
-	}
-
-	var category string
-	switch event.Category {
-	case proto.SystemEvent_DNS:
-		category = "DNS"
-	case proto.SystemEvent_NETWORK:
-		category = "Network"
-	case proto.SystemEvent_AUTHENTICATION:
-		category = "Authentication"
-	case proto.SystemEvent_CONNECTIVITY:
-		category = "Connectivity"
-	default:
-		category = "System"
-	}
-
-	return fmt.Sprintf("%s: %s", prefix, category)
-}
-
-func getClient(addr string) (proto.DaemonServiceClient, error) {
-	conn, err := grpc.NewClient(
-		strings.TrimPrefix(addr, "tcp://"),
-		grpc.WithTransportCredentials(insecure.NewCredentials()),
-		grpc.WithUserAgent(desktop.GetUIUserAgent()),
-	)
-	if err != nil {
-		return nil, err
-	}
-	return proto.NewDaemonServiceClient(conn), nil
-}
diff --git a/client/ui/event_handler.go b/client/ui/event_handler.go
deleted file mode 100644
index 902082308..000000000
--- a/client/ui/event_handler.go
+++ /dev/null
@@ -1,315 +0,0 @@
-//go:build !(linux && 386)
-
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os"
-	"os/exec"
-
-	"fyne.io/systray"
-	log "github.com/sirupsen/logrus"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-
-	"github.com/netbirdio/netbird/client/proto"
-	"github.com/netbirdio/netbird/version"
-)
-
-type eventHandler struct {
-	client *serviceClient
-}
-
-func newEventHandler(client *serviceClient) *eventHandler {
-	return &eventHandler{
-		client: client,
-	}
-}
-
-func (h *eventHandler) listen(ctx context.Context) {
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-h.client.mUp.ClickedCh:
-			h.handleConnectClick()
-		case <-h.client.mDown.ClickedCh:
-			h.handleDisconnectClick()
-		case <-h.client.mAllowSSH.ClickedCh:
-			h.handleAllowSSHClick()
-		case <-h.client.mAutoConnect.ClickedCh:
-			h.handleAutoConnectClick()
-		case <-h.client.mEnableRosenpass.ClickedCh:
-			h.handleRosenpassClick()
-		case <-h.client.mBlockInbound.ClickedCh:
-			h.handleBlockInboundClick()
-		case <-h.client.mAdvancedSettings.ClickedCh:
-			h.handleAdvancedSettingsClick()
-		case <-h.client.mCreateDebugBundle.ClickedCh:
-			h.handleCreateDebugBundleClick()
-		case <-h.client.mQuit.ClickedCh:
-			h.handleQuitClick()
-			return
-		case <-h.client.mGitHub.ClickedCh:
-			h.handleGitHubClick()
-		case <-h.client.mUpdate.ClickedCh:
-			h.handleUpdateClick()
-		case <-h.client.mNetworks.ClickedCh:
-			h.handleNetworksClick()
-		case <-h.client.mNotifications.ClickedCh:
-			h.handleNotificationsClick()
-		case <-systray.TrayOpenedCh:
-			h.client.updateExitNodes()
-		}
-	}
-}
-
-func (h *eventHandler) handleConnectClick() {
-	h.client.mUp.Disable()
-
-	if h.client.connectCancel != nil {
-		h.client.connectCancel()
-	}
-
-	connectCtx, connectCancel := context.WithCancel(h.client.ctx)
-	h.client.connectCancel = connectCancel
-
-	go func() {
-		defer connectCancel()
-
-		if err := h.client.menuUpClick(connectCtx); err != nil {
-			st, ok := status.FromError(err)
-			if errors.Is(err, context.Canceled) || (ok && st.Code() == codes.Canceled) {
-				log.Debugf("connect operation cancelled by user")
-			} else {
-				h.client.notifier.Send("Error", "Failed to connect")
-				log.Errorf("connect failed: %v", err)
-			}
-		}
-
-		if err := h.client.updateStatus(); err != nil {
-			log.Debugf("failed to update status after connect: %v", err)
-		}
-	}()
-}
-
-func (h *eventHandler) handleDisconnectClick() {
-	h.client.mDown.Disable()
-	h.client.cancelExitNodeRetry()
-
-	if h.client.connectCancel != nil {
-		log.Debugf("cancelling ongoing connect operation")
-		h.client.connectCancel()
-		h.client.connectCancel = nil
-	}
-
-	go func() {
-		if err := h.client.menuDownClick(); err != nil {
-			st, ok := status.FromError(err)
-			if !errors.Is(err, context.Canceled) && !(ok && st.Code() == codes.Canceled) {
-				h.client.notifier.Send("Error", "Failed to disconnect")
-				log.Errorf("disconnect failed: %v", err)
-			} else {
-				log.Debugf("disconnect cancelled or already disconnecting")
-			}
-		}
-
-		if err := h.client.updateStatus(); err != nil {
-			log.Debugf("failed to update status after disconnect: %v", err)
-		}
-	}()
-}
-
-func (h *eventHandler) handleAllowSSHClick() {
-	h.toggleCheckbox(h.client.mAllowSSH)
-	if err := h.updateConfigWithErr(); err != nil {
-		h.toggleCheckbox(h.client.mAllowSSH) // revert checkbox state on error
-		log.Errorf("failed to update config: %v", err)
-		h.client.notifier.Send("Error", "Failed to update SSH settings")
-	}
-
-}
-
-func (h *eventHandler) handleAutoConnectClick() {
-	h.toggleCheckbox(h.client.mAutoConnect)
-	if err := h.updateConfigWithErr(); err != nil {
-		h.toggleCheckbox(h.client.mAutoConnect) // revert checkbox state on error
-		log.Errorf("failed to update config: %v", err)
-		h.client.notifier.Send("Error", "Failed to update auto-connect settings")
-	}
-}
-
-func (h *eventHandler) handleRosenpassClick() {
-	h.toggleCheckbox(h.client.mEnableRosenpass)
-	if err := h.updateConfigWithErr(); err != nil {
-		h.toggleCheckbox(h.client.mEnableRosenpass) // revert checkbox state on error
-		log.Errorf("failed to update config: %v", err)
-		h.client.notifier.Send("Error", "Failed to update Rosenpass settings")
-	}
-}
-
-func (h *eventHandler) handleBlockInboundClick() {
-	h.toggleCheckbox(h.client.mBlockInbound)
-	if err := h.updateConfigWithErr(); err != nil {
-		h.toggleCheckbox(h.client.mBlockInbound) // revert checkbox state on error
-		log.Errorf("failed to update config: %v", err)
-		h.client.notifier.Send("Error", "Failed to update block inbound settings")
-	}
-}
-
-func (h *eventHandler) handleNotificationsClick() {
-	h.toggleCheckbox(h.client.mNotifications)
-	if err := h.updateConfigWithErr(); err != nil {
-		h.toggleCheckbox(h.client.mNotifications) // revert checkbox state on error
-		log.Errorf("failed to update config: %v", err)
-		h.client.notifier.Send("Error", "Failed to update notifications settings")
-	} else if h.client.eventManager != nil {
-		h.client.eventManager.SetNotificationsEnabled(h.client.mNotifications.Checked())
-	}
-
-}
-
-func (h *eventHandler) handleAdvancedSettingsClick() {
-	h.client.mAdvancedSettings.Disable()
-	go func() {
-		defer h.client.mAdvancedSettings.Enable()
-		defer h.client.getSrvConfig()
-		h.runSelfCommand(h.client.ctx, "settings")
-	}()
-}
-
-func (h *eventHandler) handleCreateDebugBundleClick() {
-	h.client.mCreateDebugBundle.Disable()
-	go func() {
-		defer h.client.mCreateDebugBundle.Enable()
-		h.runSelfCommand(h.client.ctx, "debug")
-	}()
-}
-
-func (h *eventHandler) handleQuitClick() {
-	systray.Quit()
-}
-
-func (h *eventHandler) handleGitHubClick() {
-	if err := openURL("https://github.com/netbirdio/netbird"); err != nil {
-		log.Errorf("failed to open GitHub URL: %v", err)
-	}
-}
-
-func (h *eventHandler) handleUpdateClick() {
-	h.client.updateIndicationLock.Lock()
-	enforced := h.client.isEnforcedUpdate
-	h.client.updateIndicationLock.Unlock()
-
-	if !enforced {
-		if err := openURL(version.DownloadUrl()); err != nil {
-			log.Errorf("failed to open download URL: %v", err)
-		}
-		return
-	}
-
-	// prevent blocking against a busy server
-	h.client.mUpdate.Disable()
-	go func() {
-		defer h.client.mUpdate.Enable()
-		conn, err := h.client.getSrvClient(defaultFailTimeout)
-		if err != nil {
-			log.Errorf("failed to get service client for update: %v", err)
-			_ = openURL(version.DownloadUrl())
-			return
-		}
-
-		resp, err := conn.TriggerUpdate(h.client.ctx, &proto.TriggerUpdateRequest{})
-		if err != nil {
-			log.Errorf("TriggerUpdate failed: %v", err)
-			_ = openURL(version.DownloadUrl())
-			return
-		}
-		if !resp.Success {
-			log.Errorf("TriggerUpdate failed: %s", resp.ErrorMsg)
-			_ = openURL(version.DownloadUrl())
-			return
-		}
-
-		log.Infof("update triggered via daemon")
-	}()
-}
-
-func (h *eventHandler) handleNetworksClick() {
-	h.client.mNetworks.Disable()
-	go func() {
-		defer h.client.mNetworks.Enable()
-		h.runSelfCommand(h.client.ctx, "networks")
-	}()
-}
-
-func (h *eventHandler) toggleCheckbox(item *systray.MenuItem) {
-	if item.Checked() {
-		item.Uncheck()
-	} else {
-		item.Check()
-	}
-}
-
-func (h *eventHandler) updateConfigWithErr() error {
-	if err := h.client.updateConfig(); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (h *eventHandler) runSelfCommand(ctx context.Context, command string, args ...string) {
-	proc, err := os.Executable()
-	if err != nil {
-		log.Errorf("error getting executable path: %v", err)
-		return
-	}
-
-	// Build the full command arguments
-	cmdArgs := []string{
-		fmt.Sprintf("--%s=true", command),
-		fmt.Sprintf("--daemon-addr=%s", h.client.addr),
-	}
-	cmdArgs = append(cmdArgs, args...)
-
-	cmd := exec.CommandContext(ctx, proc, cmdArgs...)
-
-	if out := h.client.attachOutput(cmd); out != nil {
-		defer func() {
-			if err := out.Close(); err != nil {
-				log.Errorf("error closing log file %s: %v", h.client.logFile, err)
-			}
-		}()
-	}
-
-	log.Printf("running command: %s", cmd.String())
-
-	if err := cmd.Run(); err != nil {
-		var exitErr *exec.ExitError
-		if errors.As(err, &exitErr) {
-			log.Printf("command '%s' failed with exit code %d", cmd.String(), exitErr.ExitCode())
-		}
-		return
-	}
-
-	log.Printf("command '%s' completed successfully", cmd.String())
-}
-
-func (h *eventHandler) logout(ctx context.Context) error {
-	client, err := h.client.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		return fmt.Errorf("failed to get service client: %w", err)
-	}
-
-	_, err = client.Logout(ctx, &proto.LogoutRequest{})
-	if err != nil {
-		return fmt.Errorf("logout failed: %w", err)
-	}
-
-	h.client.getSrvConfig()
-
-	return nil
-}
diff --git a/client/ui/font_bsd.go b/client/ui/font_bsd.go
deleted file mode 100644
index 139f38f40..000000000
--- a/client/ui/font_bsd.go
+++ /dev/null
@@ -1,30 +0,0 @@
-//go:build freebsd || openbsd || netbsd || dragonfly
-
-package main
-
-import (
-	"os"
-	"runtime"
-
-	log "github.com/sirupsen/logrus"
-)
-
-func (s *serviceClient) setDefaultFonts() {
-	paths := []string{
-		"/usr/local/share/fonts/TTF/DejaVuSans.ttf",
-		"/usr/local/share/fonts/dejavu/DejaVuSans.ttf",
-		"/usr/local/share/noto/NotoSans-Regular.ttf",
-		"/usr/local/share/fonts/noto/NotoSans-Regular.ttf",
-		"/usr/local/share/fonts/liberation-fonts-ttf/LiberationSans-Regular.ttf",
-	}
-
-	for _, fontPath := range paths {
-		if _, err := os.Stat(fontPath); err == nil {
-			os.Setenv("FYNE_FONT", fontPath)
-			log.Debugf("Using font: %s", fontPath)
-			return
-		}
-	}
-
-	log.Errorf("Failed to find any suitable font files for %s", runtime.GOOS)
-}
diff --git a/client/ui/font_darwin.go b/client/ui/font_darwin.go
deleted file mode 100644
index cafb72f59..000000000
--- a/client/ui/font_darwin.go
+++ /dev/null
@@ -1,18 +0,0 @@
-package main
-
-import (
-	"os"
-
-	log "github.com/sirupsen/logrus"
-)
-
-const defaultFontPath = "/Library/Fonts/Arial Unicode.ttf"
-
-func (s *serviceClient) setDefaultFonts() {
-	if _, err := os.Stat(defaultFontPath); err != nil {
-		log.Errorf("Failed to find default font file: %v", err)
-		return
-	}
-
-	os.Setenv("FYNE_FONT", defaultFontPath)
-}
diff --git a/client/ui/font_linux.go b/client/ui/font_linux.go
deleted file mode 100644
index 4aa92494a..000000000
--- a/client/ui/font_linux.go
+++ /dev/null
@@ -1,7 +0,0 @@
-//go:build !386
-
-package main
-
-func (s *serviceClient) setDefaultFonts() {
-	//TODO: Linux Multiple Language Support
-}
diff --git a/client/ui/font_windows.go b/client/ui/font_windows.go
deleted file mode 100644
index 6346a9fb9..000000000
--- a/client/ui/font_windows.go
+++ /dev/null
@@ -1,90 +0,0 @@
-package main
-
-import (
-	"os"
-	"path"
-	"unsafe"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/sys/windows"
-)
-
-func (s *serviceClient) setDefaultFonts() {
-	defaultFontPath := s.getWindowsFontFilePath()
-
-	if _, err := os.Stat(defaultFontPath); err != nil {
-		log.Errorf("Failed to find default font file: %v", err)
-		return
-	}
-
-	os.Setenv("FYNE_FONT", defaultFontPath)
-}
-
-func (s *serviceClient) getWindowsFontFilePath() string {
-	var (
-		fontFolder  = "C:/Windows/Fonts"
-		fontMapping = map[string]string{
-			"default":     "Segoeui.ttf",
-			"zh-CN":       "Segoeui.ttf",
-			"am-ET":       "Ebrima.ttf",
-			"nirmala":     "Nirmala.ttf",
-			"chr-CHER-US": "Gadugi.ttf",
-			"zh-HK":       "Segoeui.ttf",
-			"zh-TW":       "Segoeui.ttf",
-			"km-KH":       "Leelawui.ttf",
-			"ko-KR":       "Malgun.ttf",
-			"th-TH":       "Leelawui.ttf",
-			"ti-ET":       "Ebrima.ttf",
-		}
-		nirMalaLang = []string{
-			"as-IN",
-			"bn-BD",
-			"bn-IN",
-			"gu-IN",
-			"hi-IN",
-			"kn-IN",
-			"kok-IN",
-			"ml-IN",
-			"mr-IN",
-			"ne-NP",
-			"or-IN",
-			"pa-IN",
-			"si-LK",
-			"ta-IN",
-			"te-IN",
-		}
-	)
-
-	// getUserDefaultLocaleName.Call() panics if the func is not found
-	defer func() {
-		if r := recover(); r != nil {
-			log.Errorf("Recovered from panic: %v", r)
-		}
-	}()
-
-	kernel32 := windows.NewLazySystemDLL("kernel32.dll")
-	getUserDefaultLocaleName := kernel32.NewProc("GetUserDefaultLocaleName")
-
-	buf := make([]uint16, 85) // LOCALE_NAME_MAX_LENGTH is usually 85
-	r, _, err := getUserDefaultLocaleName.Call(uintptr(unsafe.Pointer(&buf[0])), uintptr(len(buf)))
-	// returns 0 on failure, err is always non-nil
-	// https://learn.microsoft.com/en-us/windows/win32/api/winnls/nf-winnls-getuserdefaultlocalename
-	if r == 0 {
-		log.Errorf("GetUserDefaultLocaleName call failed: %v", err)
-		return path.Join(fontFolder, fontMapping["default"])
-	}
-
-	defaultLanguage := windows.UTF16ToString(buf)
-
-	for _, lang := range nirMalaLang {
-		if defaultLanguage == lang {
-			return path.Join(fontFolder, fontMapping["nirmala"])
-		}
-	}
-
-	if font, ok := fontMapping[defaultLanguage]; ok {
-		return path.Join(fontFolder, font)
-	}
-
-	return path.Join(fontFolder, fontMapping["default"])
-}
diff --git a/client/ui/frontend/.prettierignore b/client/ui/frontend/.prettierignore
new file mode 100644
index 000000000..c78cb7cc3
--- /dev/null
+++ b/client/ui/frontend/.prettierignore
@@ -0,0 +1,7 @@
+dist
+build
+node_modules
+pnpm-lock.yaml
+wailsjs
+*.min.js
+*.min.css
diff --git a/client/ui/frontend/.prettierrc b/client/ui/frontend/.prettierrc
new file mode 100644
index 000000000..e47a94f56
--- /dev/null
+++ b/client/ui/frontend/.prettierrc
@@ -0,0 +1,12 @@
+{
+    "tabWidth": 4,
+    "useTabs": false,
+    "semi": true,
+    "singleQuote": false,
+    "trailingComma": "all",
+    "printWidth": 100,
+    "arrowParens": "always",
+    "endOfLine": "lf",
+    "plugins": ["prettier-plugin-tailwindcss"],
+    "tailwindFunctions": ["cn", "clsx", "cva", "tw"]
+}
diff --git a/client/ui/frontend/WAILS-API.md b/client/ui/frontend/WAILS-API.md
new file mode 100644
index 000000000..494812d35
--- /dev/null
+++ b/client/ui/frontend/WAILS-API.md
@@ -0,0 +1,296 @@
+# Wails Go API reference (frontend)
+
+Reference for every binding method and model shape exposed to the frontend. Generated from `client/ui/services/*.go` via `wails3 generate bindings -clean=true -ts` — regenerate after any Go-side change. Authoritative source is always `bindings/github.com/netbirdio/netbird/client/ui/services/*.ts`.
+
+Every method returns `$CancellablePromise<T>` (a Wails3 wrapper around `Promise`). Call `.cancel()` to abort the underlying gRPC call; in practice we just `await` and let it run.
+
+## Imports
+
+```ts
+// Services
+import {
+  Connection, Peers, ProfileSwitcher, Profiles,
+  Settings, Networks, Forwarding, Debug, Update, WindowManager,
+  I18n, Preferences,
+} from "@bindings/services";
+
+// Models (types-only)
+import type {
+  Status, PeerStatus, PeerLink, LocalPeer, SystemEvent,
+  Profile, ProfileRef, ActiveProfile,
+  Config, ConfigParams, SetConfigParams, Features,
+  Network, SelectNetworksParams,
+  ForwardingRule, PortInfo, PortRange,
+  LoginParams, LoginResult, LogoutParams, WaitSSOParams, UpParams,
+  DebugBundleParams, DebugBundleResult, LogLevel,
+  UpdateResult, UpdateAvailable, UpdateProgress,
+} from "@bindings/services/models.js";
+
+// i18n / preferences models live in sibling packages, not services/models
+import { LanguageCode, type Language } from "@bindings/i18n/models.js";
+import type { UIPreferences } from "@bindings/preferences/models.js";
+```
+
+## Push events
+
+Subscribe with `Events.On(name, handler)` from `@wailsio/runtime`. Handlers receive `{ data: <payload> }`.
+
+| Event | Payload | Fires on |
+|---|---|---|
+| `netbird:status` | `Status` | Daemon SubscribeStatus snapshot — connection-state change, peer-list change, address change, mgmt/signal flip. Synthetic `StatusDaemonUnavailable` is emitted when the gRPC socket is unreachable, and a synthetic `Connecting` is emitted at the start of an active profile switch. |
+| `netbird:event` | `SystemEvent` | One push per daemon SubscribeEvents item (DNS / network / authentication / connectivity / system). Used by the tray for OS toasts; the TS side reads events through `Status.events` instead. |
+| `netbird:update:available` | `UpdateAvailable` | Daemon detected a new version (fan-out of the `new_version_available` metadata key). |
+| `netbird:preferences:changed` | `{ language: string }` | Fires after every successful `Preferences.SetLanguage` (including the caller's own window). `src/lib/i18n.ts` subscribes and calls `i18next.changeLanguage`. |
+| `netbird:update:progress` | `UpdateProgress` | Daemon enforced-update install progress (`action: "show"` etc.). |
+| `browser-login:cancel` | (none) | Either the user closed the `BrowserLogin` window (Go-emitted) or the page's Cancel button (frontend-emitted). |
+| `trigger-login` | (none) | Reserved by the tray for asking the frontend to start an SSO flow. `layouts/ConnectionStatusSwitch.tsx` subscribes and runs `startLogin()`; no Go-side emitter today. |
+
+The two stream loops behind `netbird:status` and `netbird:event` start automatically — `main.go` calls `peers.Watch(context.Background())` at boot. `Peers.Watch` is still exported but the frontend doesn't need to invoke it.
+
+## `Connection`
+
+```ts
+Connection.Login(p: LoginParams): Promise<LoginResult>
+Connection.WaitSSOLogin(p: WaitSSOParams): Promise<string>   // returns email
+Connection.Up(p: UpParams): Promise<void>                    // async on the daemon
+Connection.Down(): Promise<void>
+Connection.Logout(p: LogoutParams): Promise<void>
+Connection.OpenURL(url: string): Promise<void>               // honors $BROWSER
+```
+
+`Login` Down-resets the daemon first to dislodge a stale `WaitSSOLogin` (so a previously abandoned SSO flow doesn't fail the next attempt). `Up` always uses async mode — status flows back through `netbird:status`. **Do not call `Up` on an `Idle` / `NeedsLogin` daemon** — the daemon's internal 50s `waitForUp` will block and return `DeadlineExceeded`.
+
+Full SSO sequence: `Login` → if `result.needsSsoLogin`, open `result.verificationUriComplete` via `OpenURL` + `WindowManager.OpenBrowserLogin(uri)` → `WaitSSOLogin({ userCode })` → `Up({})`. The canonical implementation is `startLogin()` in `layouts/ConnectionStatusSwitch.tsx`.
+
+## `Peers`
+
+```ts
+Peers.Get(): Promise<Status>            // one-shot snapshot
+Peers.Watch(): Promise<void>            // already invoked from main.go
+Peers.BeginProfileSwitch(): Promise<void>
+Peers.CancelProfileSwitch(): Promise<void>
+```
+
+`BeginProfileSwitch` and `CancelProfileSwitch` are normally driven by `ProfileSwitcher` / the tray, not the frontend.
+
+## `ProfileSwitcher`
+
+```ts
+ProfileSwitcher.SwitchActive(p: ProfileRef): Promise<void>
+```
+
+The single entry point both tray and frontend should use for profile flips. Applies the reconnect policy below, mirrors the switch into the user-side `profilemanager` (so the CLI's `netbird up` reads a consistent active profile), and drives the optimistic-Connecting paint via `Peers.BeginProfileSwitch`.
+
+Reconnect policy (driven by `prevStatus` captured at entry):
+
+| Previous status | Action | Optimistic UI | Suppressed events until new flow |
+|---|---|---|---|
+| Connected | Switch + Down + Up | Connecting (synthetic) | Connected, Idle |
+| Connecting | Switch + Down + Up | Connecting (unchanged) | Connected, Idle |
+| NeedsLogin / LoginFailed / SessionExpired | Switch + Down | (no change) | — |
+| Idle | Switch only | (no change) | — |
+
+## `Profiles`
+
+```ts
+Profiles.Username(): Promise<string>            // current OS username
+Profiles.List(username: string): Promise<Profile[]>
+Profiles.GetActive(): Promise<ActiveProfile>
+Profiles.Switch(p: ProfileRef): Promise<void>   // raw daemon RPC; prefer ProfileSwitcher.SwitchActive
+Profiles.Add(p: ProfileRef): Promise<void>
+Profiles.Remove(p: ProfileRef): Promise<void>
+```
+
+`Profile.email` is populated by the **UI process** reading the per-profile state file (`~/Library/Application Support/netbird/<name>.state.json` on macOS), not by the daemon — the daemon runs as root and can't read user-owned files.
+
+## `Settings`
+
+```ts
+Settings.GetConfig(p: ConfigParams): Promise<Config>
+Settings.SetConfig(p: SetConfigParams): Promise<void>     // partial update
+Settings.GetFeatures(): Promise<Features>                 // operator-disabled UI sections
+```
+
+`SetConfig` is a partial update: only fields you set are pushed to the daemon. `profileName` + `username` are always required; the typed fields in `SetConfigParams` are optional (`field?: T | null`). `managementUrl` and `adminUrl` are always-string for historical reasons.
+
+**PSK mask quirk:** `GetConfig` returns existing pre-shared keys as `"**********"`. If you send the mask back, `wgtypes.ParseKey` fails on the next connect. `SettingsContext.save` drops the field when it equals `"**********"`. See `modules/settings/SettingsContext.tsx`.
+
+`SetConfigParams` carries one field that `Config` does not: `disableFirewall`. There's no current GET path for it.
+
+## `Networks`
+
+```ts
+Networks.List(): Promise<Network[]>
+Networks.Select(p: SelectNetworksParams): Promise<void>
+Networks.Deselect(p: SelectNetworksParams): Promise<void>
+```
+
+`SelectNetworksParams.append=true` merges into the existing selection; `false` replaces. `all=true` ignores `networkIds` and targets every network (Select-All / Deselect-All).
+
+Exit-node filter: `range === "0.0.0.0/0" || range === "::/0"`. Domain network: `domains.length > 0`. CIDR overlap check is client-side.
+
+## `Forwarding`
+
+```ts
+Forwarding.List(): Promise<ForwardingRule[]>
+```
+
+`PortInfo` is a daemon-side oneof — exactly one of `port?: number` or `range?: PortRange` is populated. `protocol` is the lowercase daemon string (`"tcp"` / `"udp"`).
+
+## `Debug`
+
+```ts
+Debug.GetLogLevel(): Promise<LogLevel>
+Debug.SetLogLevel(lvl: LogLevel): Promise<void>
+Debug.Bundle(p: DebugBundleParams): Promise<DebugBundleResult>
+Debug.RevealFile(path: string): Promise<void>          // OS file-manager focus
+```
+
+**Log level case sensitivity bug:** `proto.LogLevel_value` is keyed on uppercase enum names (`"TRACE"`, `"DEBUG"`, `"INFO"`, `"WARN"`, `"ERROR"`, `"PANIC"`, `"FATAL"`, `"UNKNOWN"`). `Debug.SetLogLevel` calls `proto.LogLevel_value[lvl.Level]` and falls back to `INFO` on miss. `useDebugBundle` currently passes `"trace"` (lowercase), which silently maps to `INFO` — the trace-capture flow doesn't actually raise the log level today. To raise to trace, pass `{ level: "TRACE" }`. Fix on the cleanup list.
+
+`Debug.Bundle` uploads when `uploadUrl != ""`. Result fields: `path` (local copy), `uploadedKey` (set on success), `uploadFailureReason` (set on upload failure — the local copy is still saved).
+
+## `Update`
+
+```ts
+Update.Trigger(): Promise<UpdateResult>             // start the install
+Update.GetInstallerResult(): Promise<UpdateResult>  // poll the outcome (long-running)
+Update.Quit(): Promise<void>                        // 100ms later, app.Quit()
+```
+
+Typical enforced-update flow on the `/update` route: call `Trigger` once, then poll `GetInstallerResult` every 2s with a 15-minute total timeout. On `success: true` call `Quit`. On `success: false` show `errorMsg`. If the gRPC poll itself starts failing for `DAEMON_DOWN_GRACE_MS` (5s), treat that as success and quit too — the installer commonly takes the daemon offline mid-upgrade. See `pages/Update.tsx` for the canonical implementation.
+
+## `WindowManager`
+
+```ts
+WindowManager.OpenSettings(): Promise<void>
+WindowManager.OpenBrowserLogin(uri: string): Promise<void>   // uri appended as ?uri=…
+WindowManager.CloseBrowserLogin(): Promise<void>
+WindowManager.OpenError(title: string, message: string): Promise<void>  // custom branded error window; both query-escaped as ?title=…&message=…
+WindowManager.CloseError(): Promise<void>
+```
+
+Prefer `errorDialog({Title, Message})` from `lib/dialogs.ts` over calling `OpenError` directly — it's the app's single error surface (the old native MessageBox wrapper now routes here). Both strings must be pre-localised.
+
+Both auxiliary windows are created on first open and destroyed on close (mutex-guarded singleton). The BrowserLogin window's red-X close fires the `browser-login:cancel` event so `startLogin()` can tear down the pending daemon `WaitSSOLogin`.
+
+## `I18n`
+
+```ts
+I18n.Languages(): Promise<Language[]>                       // from _index.json
+I18n.Bundle(code: LanguageCode): Promise<Record<string,string>>  // full key→text map
+```
+
+Source of truth is `client/ui/i18n/locales/` (shared with the Go tray). The frontend's i18next bootstrap doesn't need `I18n.Bundle` at runtime (bundles are statically imported by Vite via the glob in `src/lib/i18n.ts`), but the language picker reads `I18n.Languages()` so the list matches `_index.json` without duplicating it in TS.
+
+## `Preferences`
+
+```ts
+Preferences.Get(): Promise<UIPreferences>                   // { language: string }
+Preferences.SetLanguage(code: LanguageCode): Promise<void>  // rejects on unknown code
+```
+
+`SetLanguage` validates against the loaded `i18n.Bundle`, persists to `os.UserConfigDir()/netbird/ui-preferences.json`, and emits `netbird:preferences:changed`. The frontend's `src/lib/i18n.ts` listens to that event and calls `i18next.changeLanguage` so a flip in any window paints in all of them. Missing preferences file → defaults to `en`, written on first read.
+
+## Daemon `Status.status` values
+
+Mirror `internal.Status*` in `client/internal/state.go` plus the synthetic UI label:
+
+| Value | Meaning |
+|---|---|
+| `"Idle"` | Tunnel down (Up never invoked or Down completed) |
+| `"Connecting"` | Up in progress |
+| `"Connected"` | Tunnel up |
+| `"NeedsLogin"` | Fresh install or token cleared; needs Login → SSO → Up |
+| `"LoginFailed"` | Previous Login attempt errored |
+| `"SessionExpired"` | SSO token expired; needs re-Login |
+| `"DaemonUnavailable"` | **Synthetic** — UI side, emitted when the daemon gRPC socket is unreachable. Not a real daemon enum. |
+
+The tray also reads a tray-only synthetic `"Error"` for icon purposes; the frontend doesn't see that.
+
+## Model field reference
+
+`Status`:
+```ts
+{ status, daemonVersion: string;
+  management: PeerLink; signal: PeerLink;
+  local: LocalPeer;
+  peers: PeerStatus[];
+  events: SystemEvent[]; }
+```
+
+`PeerLink`: `{ url: string; connected: boolean; error?: string }`.
+
+`LocalPeer`: `{ ip, pubKey, fqdn: string; networks: string[] }`.
+
+`PeerStatus`:
+```ts
+{ ip, pubKey, fqdn, connStatus: string;
+  connStatusUpdateUnix: number;
+  relayed: boolean;
+  localIceCandidateType, remoteIceCandidateType: string;     // pion: "host"|"srflx"|"prflx"|"relay"|""
+  localIceCandidateEndpoint, remoteIceCandidateEndpoint: string;
+  bytesRx, bytesTx, latencyMs, lastHandshakeUnix: number;
+  relayAddress: string;                                       // set when relayed=true
+  rosenpassEnabled: boolean;
+  networks: string[]; }
+```
+
+`SystemEvent`:
+```ts
+{ id: string;
+  severity: string;       // "info"|"warning"|"error"|"critical" (lowercased proto enum, "SystemEvent_" prefix stripped)
+  category: string;       // "network"|"dns"|"authentication"|"connectivity"|"system" (same casing rules)
+  message: string;        // technical / log line
+  userMessage: string;    // human-friendly — render this
+  timestamp: number;      // unix seconds
+  metadata: Record<string, string>; }   // keys: "new_version_available", "enforced", "id", "network", "version", "progress_window", …
+```
+
+`Profile`: `{ name: string; isActive: boolean; email: string }`.
+
+`Config` (read-only mirror, all required):
+```ts
+{ managementUrl, adminUrl, configFile, logFile, preSharedKey, interfaceName: string;
+  wireguardPort, mtu, sshJwtCacheTtl: number;
+  disableAutoConnect, serverSshAllowed,
+  rosenpassEnabled, rosenpassPermissive,
+  disableNotifications, lazyConnectionEnabled, blockInbound,
+  networkMonitor, disableClientRoutes, disableServerRoutes,
+  disableDns, disableIpv6, blockLanAccess,
+  enableSshRoot, enableSshSftp,
+  enableSshLocalPortForwarding, enableSshRemotePortForwarding,
+  disableSshAuth: boolean; }
+```
+
+`SetConfigParams` has all `Config` fields as `field?: T | null` (partial update), plus the write-only `disableFirewall?: boolean | null`, plus `profileName` / `username` / `managementUrl` / `adminUrl` as required strings.
+
+`Features`: `{ disableProfiles, disableUpdateSettings, disableNetworks: boolean }`.
+
+`Network`: `{ id, range: string; selected: boolean; domains: string[]; resolvedIps: Record<string, string[]> }`.
+
+`ForwardingRule`: `{ protocol: string; destinationPort: PortInfo; translatedAddress, translatedHostname: string; translatedPort: PortInfo }`.
+
+`PortInfo`: `{ port?: number | null; range?: PortRange | null }` (exactly one populated).
+
+`PortRange`: `{ start, end: number }` (inclusive).
+
+`LoginParams`: `{ profileName, username, managementUrl, setupKey, preSharedKey, hostname, hint: string }`.
+
+`LoginResult`: `{ needsSsoLogin: boolean; userCode, verificationUri, verificationUriComplete: string }`.
+
+`WaitSSOParams`: `{ userCode, hostname: string }`. Resolves to the user's email.
+
+`UpParams` / `LogoutParams` / `ProfileRef` / `ConfigParams` / `ActiveProfile`: all `{ profileName, username: string }` (different names but same shape — kept distinct by Wails for clarity).
+
+`DebugBundleParams`: `{ anonymize, systemInfo: boolean; uploadUrl: string; logFileCount: number }`.
+
+`DebugBundleResult`: `{ path, uploadedKey, uploadFailureReason: string }`.
+
+`LogLevel`: `{ level: string }` — **uppercase** proto enum name (`"TRACE"`, `"DEBUG"`, `"INFO"`, `"WARN"`, `"ERROR"`, `"PANIC"`, `"FATAL"`).
+
+`UpdateResult`: `{ success: boolean; errorMsg: string }`.
+
+`UpdateAvailable`: `{ version: string; enforced: boolean }`.
+
+`UpdateProgress`: `{ action: string; version: string }`.
diff --git a/client/ui/frontend/eslint.config.js b/client/ui/frontend/eslint.config.js
new file mode 100644
index 000000000..f00623b68
--- /dev/null
+++ b/client/ui/frontend/eslint.config.js
@@ -0,0 +1,75 @@
+import js from "@eslint/js";
+import tseslint from "typescript-eslint";
+import react from "eslint-plugin-react";
+import reactHooks from "eslint-plugin-react-hooks";
+import reactRefresh from "eslint-plugin-react-refresh";
+import jsxA11y from "eslint-plugin-jsx-a11y";
+import globals from "globals";
+
+export default tseslint.config(
+    {
+        ignores: ["dist/**", "node_modules/**", "bindings/**", "sonar/**"],
+    },
+    js.configs.recommended,
+    ...tseslint.configs.recommended,
+    {
+        files: ["src/**/*.{ts,tsx}"],
+        plugins: {
+            react,
+            "react-hooks": reactHooks,
+            "react-refresh": reactRefresh,
+            "jsx-a11y": jsxA11y,
+        },
+        languageOptions: {
+            ecmaVersion: 2022,
+            sourceType: "module",
+            globals: { ...globals.browser },
+            parserOptions: {
+                ecmaFeatures: { jsx: true },
+            },
+        },
+        settings: {
+            react: { version: "detect" },
+        },
+        rules: {
+            // ----- a11y / semantic HTML (jsx-a11y recommended) -----
+            ...jsxA11y.configs.recommended.rules,
+            "jsx-a11y/no-autofocus": ["warn", { ignoreNonDOM: true }],
+
+            // ----- React -----
+            ...react.configs.recommended.rules,
+            ...react.configs["jsx-runtime"].rules,
+            "react/prop-types": "off",
+            "react/jsx-no-target-blank": ["error", { allowReferrer: true }],
+            "react/self-closing-comp": "warn",
+
+            // ----- React hooks -----
+            "react-hooks/rules-of-hooks": "error",
+            "react-hooks/exhaustive-deps": "warn",
+
+            // ----- Vite / HMR (Fast Refresh) -----
+            "react-refresh/only-export-components": "off",
+
+            // ----- TypeScript -----
+            "@typescript-eslint/no-unused-vars": [
+                "warn",
+                {
+                    argsIgnorePattern: "^_",
+                    varsIgnorePattern: "^_",
+                    caughtErrorsIgnorePattern: "^_",
+                },
+            ],
+            "@typescript-eslint/consistent-type-imports": [
+                "warn",
+                { prefer: "type-imports", fixStyle: "inline-type-imports" },
+            ],
+            "@typescript-eslint/no-explicit-any": "warn",
+
+            // ----- General correctness -----
+            eqeqeq: ["error", "smart"],
+            "no-console": ["warn", { allow: ["warn", "error", "info"] }],
+            "no-debugger": "error",
+            "prefer-const": "warn",
+        },
+    },
+);
diff --git a/client/ui/frontend/index.html b/client/ui/frontend/index.html
new file mode 100644
index 000000000..e62139956
--- /dev/null
+++ b/client/ui/frontend/index.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html lang="en" class="dark">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>NetBird</title>
+    <style>
+      html, body { background: #181A1D; }
+    </style>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/app.tsx"></script>
+  </body>
+</html>
diff --git a/client/ui/frontend/package.json b/client/ui/frontend/package.json
new file mode 100644
index 000000000..3131b36cd
--- /dev/null
+++ b/client/ui/frontend/package.json
@@ -0,0 +1,69 @@
+{
+  "name": "netbird-ui",
+  "private": true,
+  "version": "0.0.1",
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build:dev": "tsc && vite build --minify false --mode development",
+    "build": "tsc && vite build --mode production",
+    "preview": "vite preview",
+    "typecheck": "tsc --noEmit",
+    "bindings": "cd .. && wails3 generate bindings -clean=true -ts",
+    "format": "prettier --write \"src/**/*.{ts,tsx,js,jsx,css,json,md}\"",
+    "format:check": "prettier --check \"src/**/*.{ts,tsx,js,jsx,css,json,md}\"",
+    "lint": "eslint \"src/**/*.{ts,tsx}\"",
+    "lint:fix": "eslint \"src/**/*.{ts,tsx}\" --fix",
+    "check": "pnpm lint && pnpm typecheck && pnpm format:check",
+    "check:fix": "pnpm lint:fix && pnpm format && pnpm typecheck"
+  },
+  "dependencies": {
+    "@radix-ui/react-dialog": "^1.1.15",
+    "@radix-ui/react-dropdown-menu": "^2.1.16",
+    "@radix-ui/react-label": "^2.1.8",
+    "@radix-ui/react-popover": "^1.1.15",
+    "@radix-ui/react-radio-group": "^1.3.8",
+    "@radix-ui/react-scroll-area": "^1.2.10",
+    "@radix-ui/react-switch": "^1.2.6",
+    "@radix-ui/react-tabs": "^1.1.13",
+    "@radix-ui/react-tooltip": "^1.2.8",
+    "@radix-ui/react-visually-hidden": "^1.2.4",
+    "@wailsio/runtime": "latest",
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
+    "cmdk": "^1.1.1",
+    "framer-motion": "^12.38.0",
+    "i18next": "^26.2.0",
+    "lucide-react": "^0.566.0",
+    "react": "^18.3.1",
+    "react-dom": "^18.3.1",
+    "react-i18next": "^17.0.8",
+    "react-loading-skeleton": "^3.5.0",
+    "react-router-dom": "^7.1.3",
+    "react-virtuoso": "^4.12.5",
+    "tailwind-merge": "^2.6.0"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^25.6.0",
+    "@types/react": "^18.3.18",
+    "@types/react-dom": "^18.3.5",
+    "@vitejs/plugin-react": "^4.3.4",
+    "autoprefixer": "^10.4.20",
+    "eslint": "^9.39.4",
+    "eslint-plugin-jsx-a11y": "^6.10.2",
+    "eslint-plugin-react": "^7.37.5",
+    "eslint-plugin-react-hooks": "^7.1.1",
+    "eslint-plugin-react-refresh": "^0.5.3",
+    "globals": "^17.6.0",
+    "postcss": "^8.5.1",
+    "prettier": "^3.8.3",
+    "prettier-plugin-tailwindcss": "^0.8.0",
+    "tailwindcss": "^3.4.17",
+    "tailwindcss-animate": "^1.0.7",
+    "typescript": "^5.7.3",
+    "typescript-eslint": "^8.61.1",
+    "vite": "^6.0.7"
+  },
+  "packageManager": "pnpm@11.4.0+sha512.f0febc7e37552ab485494a914241b338e0b3580b93d54ce31f00933015880863129038a1b4ae4e414a0ee63ac35bf21197e990172c4a68256450b5636310968f"
+}
diff --git a/client/ui/frontend/pnpm-lock.yaml b/client/ui/frontend/pnpm-lock.yaml
new file mode 100644
index 000000000..b6b3dd336
--- /dev/null
+++ b/client/ui/frontend/pnpm-lock.yaml
@@ -0,0 +1,5240 @@
+lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+importers:
+
+  .:
+    dependencies:
+      '@radix-ui/react-dialog':
+        specifier: ^1.1.15
+        version: 1.1.15(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-dropdown-menu':
+        specifier: ^2.1.16
+        version: 2.1.16(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-label':
+        specifier: ^2.1.8
+        version: 2.1.8(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-popover':
+        specifier: ^1.1.15
+        version: 1.1.15(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-radio-group':
+        specifier: ^1.3.8
+        version: 1.3.8(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-scroll-area':
+        specifier: ^1.2.10
+        version: 1.2.10(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-switch':
+        specifier: ^1.2.6
+        version: 1.2.6(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-tabs':
+        specifier: ^1.1.13
+        version: 1.1.13(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-tooltip':
+        specifier: ^1.2.8
+        version: 1.2.8(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-visually-hidden':
+        specifier: ^1.2.4
+        version: 1.2.4(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@wailsio/runtime':
+        specifier: latest
+        version: 3.0.0-alpha.79
+      class-variance-authority:
+        specifier: ^0.7.1
+        version: 0.7.1
+      clsx:
+        specifier: ^2.1.1
+        version: 2.1.1
+      cmdk:
+        specifier: ^1.1.1
+        version: 1.1.1(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      framer-motion:
+        specifier: ^12.38.0
+        version: 12.40.0(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      i18next:
+        specifier: ^26.2.0
+        version: 26.3.0(typescript@5.9.3)
+      lucide-react:
+        specifier: ^0.566.0
+        version: 0.566.0(react@18.3.1)
+      react:
+        specifier: ^18.3.1
+        version: 18.3.1
+      react-dom:
+        specifier: ^18.3.1
+        version: 18.3.1(react@18.3.1)
+      react-i18next:
+        specifier: ^17.0.8
+        version: 17.0.8(i18next@26.3.0(typescript@5.9.3))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(typescript@5.9.3)
+      react-loading-skeleton:
+        specifier: ^3.5.0
+        version: 3.5.0(react@18.3.1)
+      react-router-dom:
+        specifier: ^7.1.3
+        version: 7.15.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      react-virtuoso:
+        specifier: ^4.12.5
+        version: 4.18.7(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      tailwind-merge:
+        specifier: ^2.6.0
+        version: 2.6.1
+    devDependencies:
+      '@eslint/js':
+        specifier: ^10.0.1
+        version: 10.0.1(eslint@9.39.4(jiti@1.21.7))
+      '@types/node':
+        specifier: ^25.6.0
+        version: 25.9.1
+      '@types/react':
+        specifier: ^18.3.18
+        version: 18.3.29
+      '@types/react-dom':
+        specifier: ^18.3.5
+        version: 18.3.7(@types/react@18.3.29)
+      '@vitejs/plugin-react':
+        specifier: ^4.3.4
+        version: 4.7.0(vite@6.4.2(@types/node@25.9.1)(jiti@1.21.7))
+      autoprefixer:
+        specifier: ^10.4.20
+        version: 10.5.0(postcss@8.5.15)
+      eslint:
+        specifier: ^9.39.4
+        version: 9.39.4(jiti@1.21.7)
+      eslint-plugin-jsx-a11y:
+        specifier: ^6.10.2
+        version: 6.10.2(eslint@9.39.4(jiti@1.21.7))
+      eslint-plugin-react:
+        specifier: ^7.37.5
+        version: 7.37.5(eslint@9.39.4(jiti@1.21.7))
+      eslint-plugin-react-hooks:
+        specifier: ^7.1.1
+        version: 7.1.1(eslint@9.39.4(jiti@1.21.7))
+      eslint-plugin-react-refresh:
+        specifier: ^0.5.3
+        version: 0.5.3(eslint@9.39.4(jiti@1.21.7))
+      globals:
+        specifier: ^17.6.0
+        version: 17.6.0
+      postcss:
+        specifier: ^8.5.1
+        version: 8.5.15
+      prettier:
+        specifier: ^3.8.3
+        version: 3.8.3
+      prettier-plugin-tailwindcss:
+        specifier: ^0.8.0
+        version: 0.8.0(prettier@3.8.3)
+      tailwindcss:
+        specifier: ^3.4.17
+        version: 3.4.19
+      tailwindcss-animate:
+        specifier: ^1.0.7
+        version: 1.0.7(tailwindcss@3.4.19)
+      typescript:
+        specifier: ^5.7.3
+        version: 5.9.3
+      typescript-eslint:
+        specifier: ^8.61.1
+        version: 8.61.1(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)
+      vite:
+        specifier: ^6.0.7
+        version: 6.4.2(@types/node@25.9.1)(jiti@1.21.7)
+
+packages:
+
+  '@alloc/quick-lru@5.2.0':
+    resolution: {integrity: sha512-UrcABB+4bUrFABwbluTIBErXwvbsU/V7TZWfmbgJfbkwiBuziS9gxdODUyuiecfdGQ85jglMW6juS3+z5TsKLw==}
+    engines: {node: '>=10'}
+
+  '@babel/code-frame@7.29.7':
+    resolution: {integrity: sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/compat-data@7.29.7':
+    resolution: {integrity: sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/core@7.29.7':
+    resolution: {integrity: sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/generator@7.29.7':
+    resolution: {integrity: sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-compilation-targets@7.29.7':
+    resolution: {integrity: sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-globals@7.29.7':
+    resolution: {integrity: sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-module-imports@7.29.7':
+    resolution: {integrity: sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-module-transforms@7.29.7':
+    resolution: {integrity: sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+
+  '@babel/helper-plugin-utils@7.29.7':
+    resolution: {integrity: sha512-G7sHYigPY17oO5SYWnfD/0MTBwVR781S/JI643e/JhUYgVgWE/61SoW3NH9KWUKyKq5LVh3npif99Wkt6j86Jw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-string-parser@7.29.7':
+    resolution: {integrity: sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-validator-identifier@7.29.7':
+    resolution: {integrity: sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-validator-option@7.29.7':
+    resolution: {integrity: sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helpers@7.29.7':
+    resolution: {integrity: sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/parser@7.29.7':
+    resolution: {integrity: sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg==}
+    engines: {node: '>=6.0.0'}
+    hasBin: true
+
+  '@babel/plugin-transform-react-jsx-self@7.29.7':
+    resolution: {integrity: sha512-TL0hMc9xzy86VD31nUiwzd5otRAcyEPcsegCxolO0PvcXuH1v0kECe/UIznYFihpkvU5wg/jk4v0TTEFfm53fw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-react-jsx-source@7.29.7':
+    resolution: {integrity: sha512-06IyK09H3wi4cGbhDBwp5gUGo0IKtnYa8tyTiephirPCK6fbobVGiXMMI5zLQ4aKEYP3wZ3ArU44o+8KMrSG/Q==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/runtime@7.29.7':
+    resolution: {integrity: sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/template@7.29.7':
+    resolution: {integrity: sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/traverse@7.29.7':
+    resolution: {integrity: sha512-EhlfNQtZ+NK22w5BM61ciuiq1m58ed33Wr1Xan//ZRTy6hgjnwyCffRYwzsGXdASJSUJ1guZILsErh1eQcl+zw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/types@7.29.7':
+    resolution: {integrity: sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==}
+    engines: {node: '>=6.9.0'}
+
+  '@esbuild/aix-ppc64@0.25.12':
+    resolution: {integrity: sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [aix]
+
+  '@esbuild/android-arm64@0.25.12':
+    resolution: {integrity: sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [android]
+
+  '@esbuild/android-arm@0.25.12':
+    resolution: {integrity: sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [android]
+
+  '@esbuild/android-x64@0.25.12':
+    resolution: {integrity: sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [android]
+
+  '@esbuild/darwin-arm64@0.25.12':
+    resolution: {integrity: sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@esbuild/darwin-x64@0.25.12':
+    resolution: {integrity: sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@esbuild/freebsd-arm64@0.25.12':
+    resolution: {integrity: sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@esbuild/freebsd-x64@0.25.12':
+    resolution: {integrity: sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@esbuild/linux-arm64@0.25.12':
+    resolution: {integrity: sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@esbuild/linux-arm@0.25.12':
+    resolution: {integrity: sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [linux]
+
+  '@esbuild/linux-ia32@0.25.12':
+    resolution: {integrity: sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [linux]
+
+  '@esbuild/linux-loong64@0.25.12':
+    resolution: {integrity: sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==}
+    engines: {node: '>=18'}
+    cpu: [loong64]
+    os: [linux]
+
+  '@esbuild/linux-mips64el@0.25.12':
+    resolution: {integrity: sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==}
+    engines: {node: '>=18'}
+    cpu: [mips64el]
+    os: [linux]
+
+  '@esbuild/linux-ppc64@0.25.12':
+    resolution: {integrity: sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@esbuild/linux-riscv64@0.25.12':
+    resolution: {integrity: sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==}
+    engines: {node: '>=18'}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@esbuild/linux-s390x@0.25.12':
+    resolution: {integrity: sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==}
+    engines: {node: '>=18'}
+    cpu: [s390x]
+    os: [linux]
+
+  '@esbuild/linux-x64@0.25.12':
+    resolution: {integrity: sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [linux]
+
+  '@esbuild/netbsd-arm64@0.25.12':
+    resolution: {integrity: sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [netbsd]
+
+  '@esbuild/netbsd-x64@0.25.12':
+    resolution: {integrity: sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [netbsd]
+
+  '@esbuild/openbsd-arm64@0.25.12':
+    resolution: {integrity: sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openbsd]
+
+  '@esbuild/openbsd-x64@0.25.12':
+    resolution: {integrity: sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@esbuild/openharmony-arm64@0.25.12':
+    resolution: {integrity: sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@esbuild/sunos-x64@0.25.12':
+    resolution: {integrity: sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [sunos]
+
+  '@esbuild/win32-arm64@0.25.12':
+    resolution: {integrity: sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@esbuild/win32-ia32@0.25.12':
+    resolution: {integrity: sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [win32]
+
+  '@esbuild/win32-x64@0.25.12':
+    resolution: {integrity: sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [win32]
+
+  '@eslint-community/eslint-utils@4.9.1':
+    resolution: {integrity: sha512-phrYmNiYppR7znFEdqgfWHXR6NCkZEK7hwWDHZUjit/2/U0r6XvkDl0SYnoM51Hq7FhCGdLDT6zxCCOY1hexsQ==}
+    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
+    peerDependencies:
+      eslint: ^6.0.0 || ^7.0.0 || >=8.0.0
+
+  '@eslint-community/regexpp@4.12.2':
+    resolution: {integrity: sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==}
+    engines: {node: ^12.0.0 || ^14.0.0 || >=16.0.0}
+
+  '@eslint/config-array@0.21.2':
+    resolution: {integrity: sha512-nJl2KGTlrf9GjLimgIru+V/mzgSK0ABCDQRvxw5BjURL7WfH5uoWmizbH7QB6MmnMBd8cIC9uceWnezL1VZWWw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/config-helpers@0.4.2':
+    resolution: {integrity: sha512-gBrxN88gOIf3R7ja5K9slwNayVcZgK6SOUORm2uBzTeIEfeVaIhOpCtTox3P6R7o2jLFwLFTLnC7kU/RGcYEgw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/core@0.17.0':
+    resolution: {integrity: sha512-yL/sLrpmtDaFEiUj1osRP4TI2MDz1AddJL+jZ7KSqvBuliN4xqYY54IfdN8qD8Toa6g1iloph1fxQNkjOxrrpQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/eslintrc@3.3.5':
+    resolution: {integrity: sha512-4IlJx0X0qftVsN5E+/vGujTRIFtwuLbNsVUe7TO6zYPDR1O6nFwvwhIKEKSrl6dZchmYBITazxKoUYOjdtjlRg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/js@10.0.1':
+    resolution: {integrity: sha512-zeR9k5pd4gxjZ0abRoIaxdc7I3nDktoXZk2qOv9gCNWx3mVwEn32VRhyLaRsDiJjTs0xq/T8mfPtyuXu7GWBcA==}
+    engines: {node: ^20.19.0 || ^22.13.0 || >=24}
+    peerDependencies:
+      eslint: ^10.0.0
+    peerDependenciesMeta:
+      eslint:
+        optional: true
+
+  '@eslint/js@9.39.4':
+    resolution: {integrity: sha512-nE7DEIchvtiFTwBw4Lfbu59PG+kCofhjsKaCWzxTpt4lfRjRMqG6uMBzKXuEcyXhOHoUp9riAm7/aWYGhXZ9cw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/object-schema@2.1.7':
+    resolution: {integrity: sha512-VtAOaymWVfZcmZbp6E2mympDIHvyjXs/12LqWYjVw6qjrfF+VK+fyG33kChz3nnK+SU5/NeHOqrTEHS8sXO3OA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@eslint/plugin-kit@0.4.1':
+    resolution: {integrity: sha512-43/qtrDUokr7LJqoF2c3+RInu/t4zfrpYdoSDfYyhg52rwLV6TnOvdG4fXm7IkSB3wErkcmJS9iEhjVtOSEjjA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@floating-ui/core@1.7.5':
+    resolution: {integrity: sha512-1Ih4WTWyw0+lKyFMcBHGbb5U5FtuHJuujoyyr5zTaWS5EYMeT6Jb2AuDeftsCsEuchO+mM2ij5+q9crhydzLhQ==}
+
+  '@floating-ui/dom@1.7.6':
+    resolution: {integrity: sha512-9gZSAI5XM36880PPMm//9dfiEngYoC6Am2izES1FF406YFsjvyBMmeJ2g4SAju3xWwtuynNRFL2s9hgxpLI5SQ==}
+
+  '@floating-ui/react-dom@2.1.8':
+    resolution: {integrity: sha512-cC52bHwM/n/CxS87FH0yWdngEZrjdtLW/qVruo68qg+prK7ZQ4YGdut2GyDVpoGeAYe/h899rVeOVm6Oi40k2A==}
+    peerDependencies:
+      react: '>=16.8.0'
+      react-dom: '>=16.8.0'
+
+  '@floating-ui/utils@0.2.11':
+    resolution: {integrity: sha512-RiB/yIh78pcIxl6lLMG0CgBXAZ2Y0eVHqMPYugu+9U0AeT6YBeiJpf7lbdJNIugFP5SIjwNRgo4DhR1Qxi26Gg==}
+
+  '@humanfs/core@0.19.2':
+    resolution: {integrity: sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==}
+    engines: {node: '>=18.18.0'}
+
+  '@humanfs/node@0.16.8':
+    resolution: {integrity: sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==}
+    engines: {node: '>=18.18.0'}
+
+  '@humanfs/types@0.15.0':
+    resolution: {integrity: sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==}
+    engines: {node: '>=18.18.0'}
+
+  '@humanwhocodes/module-importer@1.0.1':
+    resolution: {integrity: sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==}
+    engines: {node: '>=12.22'}
+
+  '@humanwhocodes/retry@0.4.3':
+    resolution: {integrity: sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==}
+    engines: {node: '>=18.18'}
+
+  '@jridgewell/gen-mapping@0.3.13':
+    resolution: {integrity: sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==}
+
+  '@jridgewell/remapping@2.3.5':
+    resolution: {integrity: sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==}
+
+  '@jridgewell/resolve-uri@3.1.2':
+    resolution: {integrity: sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==}
+    engines: {node: '>=6.0.0'}
+
+  '@jridgewell/sourcemap-codec@1.5.5':
+    resolution: {integrity: sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==}
+
+  '@jridgewell/trace-mapping@0.3.31':
+    resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
+
+  '@nodelib/fs.scandir@2.1.5':
+    resolution: {integrity: sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==}
+    engines: {node: '>= 8'}
+
+  '@nodelib/fs.stat@2.0.5':
+    resolution: {integrity: sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==}
+    engines: {node: '>= 8'}
+
+  '@nodelib/fs.walk@1.2.8':
+    resolution: {integrity: sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==}
+    engines: {node: '>= 8'}
+
+  '@radix-ui/number@1.1.1':
+    resolution: {integrity: sha512-MkKCwxlXTgz6CFoJx3pCwn07GKp36+aZyu/u2Ln2VrA5DcdyCZkASEDBTd8x5whTQQL5CiYf4prXKLcgQdv29g==}
+
+  '@radix-ui/primitive@1.1.3':
+    resolution: {integrity: sha512-JTF99U/6XIjCBo0wqkU5sK10glYe27MRRsfwoiq5zzOEZLHU3A3KCMa5X/azekYRCJ0HlwI0crAXS/5dEHTzDg==}
+
+  '@radix-ui/react-arrow@1.1.7':
+    resolution: {integrity: sha512-F+M1tLhO+mlQaOWspE8Wstg+z6PwxwRd8oQ8IXceWz92kfAmalTRf0EjrouQeo7QssEPfCn05B4Ihs1K9WQ/7w==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-collection@1.1.7':
+    resolution: {integrity: sha512-Fh9rGN0MoI4ZFUNyfFVNU4y9LUz93u9/0K+yLgA2bwRojxM8JU1DyvvMBabnZPBgMWREAJvU2jjVzq+LrFUglw==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-compose-refs@1.1.2':
+    resolution: {integrity: sha512-z4eqJvfiNnFMHIIvXP3CY57y2WJs5g2v3X0zm9mEJkrkNv4rDxu+sg9Jh8EkXyeqBkB7SOcboo9dMVqhyrACIg==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-context@1.1.2':
+    resolution: {integrity: sha512-jCi/QKUM2r1Ju5a3J64TH2A5SpKAgh0LpknyqdQ4m6DCV0xJ2HG1xARRwNGPQfi1SLdLWZ1OJz6F4OMBBNiGJA==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-dialog@1.1.15':
+    resolution: {integrity: sha512-TCglVRtzlffRNxRMEyR36DGBLJpeusFcgMVD9PZEzAKnUs1lKCgX5u9BmC2Yg+LL9MgZDugFFs1Vl+Jp4t/PGw==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-direction@1.1.1':
+    resolution: {integrity: sha512-1UEWRX6jnOA2y4H5WczZ44gOOjTEmlqv1uNW4GAJEO5+bauCBhv8snY65Iw5/VOS/ghKN9gr2KjnLKxrsvoMVw==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-dismissable-layer@1.1.11':
+    resolution: {integrity: sha512-Nqcp+t5cTB8BinFkZgXiMJniQH0PsUt2k51FUhbdfeKvc4ACcG2uQniY/8+h1Yv6Kza4Q7lD7PQV0z0oicE0Mg==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-dropdown-menu@2.1.16':
+    resolution: {integrity: sha512-1PLGQEynI/3OX/ftV54COn+3Sud/Mn8vALg2rWnBLnRaGtJDduNW/22XjlGgPdpcIbiQxjKtb7BkcjP00nqfJw==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-focus-guards@1.1.3':
+    resolution: {integrity: sha512-0rFg/Rj2Q62NCm62jZw0QX7a3sz6QCQU0LpZdNrJX8byRGaGVTqbrW9jAoIAHyMQqsNpeZ81YgSizOt5WXq0Pw==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-focus-scope@1.1.7':
+    resolution: {integrity: sha512-t2ODlkXBQyn7jkl6TNaw/MtVEVvIGelJDCG41Okq/KwUsJBwQ4XVZsHAVUkK4mBv3ewiAS3PGuUWuY2BoK4ZUw==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-id@1.1.1':
+    resolution: {integrity: sha512-kGkGegYIdQsOb4XjsfM97rXsiHaBwco+hFI66oO4s9LU+PLAC5oJ7khdOVFxkhsmlbpUqDAvXw11CluXP+jkHg==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-label@2.1.8':
+    resolution: {integrity: sha512-FmXs37I6hSBVDlO4y764TNz1rLgKwjJMQ0EGte6F3Cb3f4bIuHB/iLa/8I9VKkmOy+gNHq8rql3j686ACVV21A==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-menu@2.1.16':
+    resolution: {integrity: sha512-72F2T+PLlphrqLcAotYPp0uJMr5SjP5SL01wfEspJbru5Zs5vQaSHb4VB3ZMJPimgHHCHG7gMOeOB9H3Hdmtxg==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-popover@1.1.15':
+    resolution: {integrity: sha512-kr0X2+6Yy/vJzLYJUPCZEc8SfQcf+1COFoAqauJm74umQhta9M7lNJHP7QQS3vkvcGLQUbWpMzwrXYwrYztHKA==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-popper@1.2.8':
+    resolution: {integrity: sha512-0NJQ4LFFUuWkE7Oxf0htBKS6zLkkjBH+hM1uk7Ng705ReR8m/uelduy1DBo0PyBXPKVnBA6YBlU94MBGXrSBCw==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-portal@1.1.9':
+    resolution: {integrity: sha512-bpIxvq03if6UNwXZ+HTK71JLh4APvnXntDc6XOX8UVq4XQOVl7lwok0AvIl+b8zgCw3fSaVTZMpAPPagXbKmHQ==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-presence@1.1.5':
+    resolution: {integrity: sha512-/jfEwNDdQVBCNvjkGit4h6pMOzq8bHkopq458dPt2lMjx+eBQUohZNG9A7DtO/O5ukSbxuaNGXMjHicgwy6rQQ==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-primitive@2.1.3':
+    resolution: {integrity: sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-primitive@2.1.4':
+    resolution: {integrity: sha512-9hQc4+GNVtJAIEPEqlYqW5RiYdrr8ea5XQ0ZOnD6fgru+83kqT15mq2OCcbe8KnjRZl5vF3ks69AKz3kh1jrhg==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-radio-group@1.3.8':
+    resolution: {integrity: sha512-VBKYIYImA5zsxACdisNQ3BjCBfmbGH3kQlnFVqlWU4tXwjy7cGX8ta80BcrO+WJXIn5iBylEH3K6ZTlee//lgQ==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-roving-focus@1.1.11':
+    resolution: {integrity: sha512-7A6S9jSgm/S+7MdtNDSb+IU859vQqJ/QAtcYQcfFC6W8RS4IxIZDldLR0xqCFZ6DCyrQLjLPsxtTNch5jVA4lA==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-scroll-area@1.2.10':
+    resolution: {integrity: sha512-tAXIa1g3sM5CGpVT0uIbUx/U3Gs5N8T52IICuCtObaos1S8fzsrPXG5WObkQN3S6NVl6wKgPhAIiBGbWnvc97A==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-slot@1.2.3':
+    resolution: {integrity: sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-slot@1.2.4':
+    resolution: {integrity: sha512-Jl+bCv8HxKnlTLVrcDE8zTMJ09R9/ukw4qBs/oZClOfoQk/cOTbDn+NceXfV7j09YPVQUryJPHurafcSg6EVKA==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-switch@1.2.6':
+    resolution: {integrity: sha512-bByzr1+ep1zk4VubeEVViV592vu2lHE2BZY5OnzehZqOOgogN80+mNtCqPkhn2gklJqOpxWgPoYTSnhBCqpOXQ==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-tabs@1.1.13':
+    resolution: {integrity: sha512-7xdcatg7/U+7+Udyoj2zodtI9H/IIopqo+YOIcZOq1nJwXWBZ9p8xiu5llXlekDbZkca79a/fozEYQXIA4sW6A==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-tooltip@1.2.8':
+    resolution: {integrity: sha512-tY7sVt1yL9ozIxvmbtN5qtmH2krXcBCfjEiCgKGLqunJHvgvZG2Pcl2oQ3kbcZARb1BGEHdkLzcYGO8ynVlieg==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-use-callback-ref@1.1.1':
+    resolution: {integrity: sha512-FkBMwD+qbGQeMu1cOHnuGB6x4yzPjho8ap5WtbEJ26umhgqVXbhekKUQO+hZEL1vU92a3wHwdp0HAcqAUF5iDg==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-use-controllable-state@1.2.2':
+    resolution: {integrity: sha512-BjasUjixPFdS+NKkypcyyN5Pmg83Olst0+c6vGov0diwTEo6mgdqVR6hxcEgFuh4QrAs7Rc+9KuGJ9TVCj0Zzg==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-use-effect-event@0.0.2':
+    resolution: {integrity: sha512-Qp8WbZOBe+blgpuUT+lw2xheLP8q0oatc9UpmiemEICxGvFLYmHm9QowVZGHtJlGbS6A6yJ3iViad/2cVjnOiA==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-use-escape-keydown@1.1.1':
+    resolution: {integrity: sha512-Il0+boE7w/XebUHyBjroE+DbByORGR9KKmITzbR7MyQ4akpORYP/ZmbhAr0DG7RmmBqoOnZdy2QlvajJ2QA59g==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-use-layout-effect@1.1.1':
+    resolution: {integrity: sha512-RbJRS4UWQFkzHTTwVymMTUv8EqYhOp8dOOviLj2ugtTiXRaRQS7GLGxZTLL1jWhMeoSCf5zmcZkqTl9IiYfXcQ==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-use-previous@1.1.1':
+    resolution: {integrity: sha512-2dHfToCj/pzca2Ck724OZ5L0EVrr3eHRNsG/b3xQJLA2hZpVCS99bLAX+hm1IHXDEnzU6by5z/5MIY794/a8NQ==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-use-rect@1.1.1':
+    resolution: {integrity: sha512-QTYuDesS0VtuHNNvMh+CjlKJ4LJickCMUAqjlE3+j8w+RlRpwyX3apEQKGFzbZGdo7XNG1tXa+bQqIE7HIXT2w==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-use-size@1.1.1':
+    resolution: {integrity: sha512-ewrXRDTAqAXlkl6t/fkXWNAhFX9I+CkKlw6zjEwk86RSPKwZr3xpBRso655aqYafwtnbpHLj6toFzmd6xdVptQ==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-visually-hidden@1.2.3':
+    resolution: {integrity: sha512-pzJq12tEaaIhqjbzpCuv/OypJY/BPavOofm+dbab+MHLajy277+1lLm6JFcGgF5eskJ6mquGirhXY2GD/8u8Ug==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-visually-hidden@1.2.4':
+    resolution: {integrity: sha512-kaeiyGCe844dkb9AVF+rb4yTyb1LiLN/e3es3nLiRyN4dC8AduBYPMnnNlDjX2VDOcvDEiPnRNMJeWCfsX0txg==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/rect@1.1.1':
+    resolution: {integrity: sha512-HPwpGIzkl28mWyZqG52jiqDJ12waP11Pa1lGoiyUkIEuMLBP0oeK/C89esbXrxsky5we7dfd8U58nm0SgAWpVw==}
+
+  '@rolldown/pluginutils@1.0.0-beta.27':
+    resolution: {integrity: sha512-+d0F4MKMCbeVUJwG96uQ4SgAznZNSq93I3V+9NHA4OpvqG8mRCpGdKmK8l/dl02h2CCDHwW2FqilnTyDcAnqjA==}
+
+  '@rollup/rollup-android-arm-eabi@4.60.4':
+    resolution: {integrity: sha512-F5QXMSiFebS9hKZj02XhWLLnRpJ3B3AROP0tWbFBSj+6kCbg5m9j5JoHKd4mmSVy5mS/IMQloYgYxCuJC0fxEQ==}
+    cpu: [arm]
+    os: [android]
+
+  '@rollup/rollup-android-arm64@4.60.4':
+    resolution: {integrity: sha512-GxxTKApUpzRhof7poWvCJHRF51C67u1R7D6DiluBE8wKU1u5GWE8t+v81JvJYtbawoBFX1hLv5Ei4eVjkWokaw==}
+    cpu: [arm64]
+    os: [android]
+
+  '@rollup/rollup-darwin-arm64@4.60.4':
+    resolution: {integrity: sha512-tua0TaJxMOB1R0V0RS1jFZ/RpURFDJIOR2A6jWwQeawuFyS4gBW+rntLRaQd0EQ4bd6Vp44Z2rXW+YYDBsj6IA==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@rollup/rollup-darwin-x64@4.60.4':
+    resolution: {integrity: sha512-CSKq7MsP+5PFIcydhAiR1K0UhEI1A2jWXVKHPCBZ151yOutENwvnPocgVHkivu2kviURtCEB6zUQw0vs8RrhMg==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@rollup/rollup-freebsd-arm64@4.60.4':
+    resolution: {integrity: sha512-+O8OkVdyvXMtJEciu2wS/pzm1IxntEEQx3z5TAVy4l32G0etZn+RsA48ARRrFm6Ri8fvqPQfgrvNxSjKAbnd3g==}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@rollup/rollup-freebsd-x64@4.60.4':
+    resolution: {integrity: sha512-Iw3oMskH3AfNuhU0MSN7vNbdi4me/NiYo2azqPz/Le16zHSa+3RRmliCMWWQmh4lcndccU40xcJuTYJZxNo/lw==}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@rollup/rollup-linux-arm-gnueabihf@4.60.4':
+    resolution: {integrity: sha512-EIPRXTVQpHyF8WOo219AD2yEltPehLTcTMz2fn6JsatLYSzQf00hj3rulF+yauOlF9/FtM2WpkT/hJh/KJFGhA==}
+    cpu: [arm]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-arm-musleabihf@4.60.4':
+    resolution: {integrity: sha512-J3Yh9PzzF1Ovah2At+lHiGQdsYgArxBbXv/zHfSyaiFQEqvNv7DcW98pCrmdjCZBrqBiKrKKe2V+aaSGWuBe/w==}
+    cpu: [arm]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-linux-arm64-gnu@4.60.4':
+    resolution: {integrity: sha512-BFDEZMYfUvLn37ONE1yMBojPxnMlTFsdyNoqncT0qFq1mAfllL+ATMMJd8TeuVMiX84s1KbcxcZbXInmcO2mRg==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-arm64-musl@4.60.4':
+    resolution: {integrity: sha512-pc9EYOSlOgdQ2uPl1o9PF6/kLSgaUosia7gOuS8mB69IxJvlclko1MECXysjs5ryez1/5zjYqx3+xYU0TU6R1A==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-linux-loong64-gnu@4.60.4':
+    resolution: {integrity: sha512-NxnomyxYerDh5n4iLrNa+sH+Z+U4BMEE46V2PgQ/hoB909i8gV1M5wPojWg9fk1jWpO3IQnOs20K4wyZuFLEFQ==}
+    cpu: [loong64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-loong64-musl@4.60.4':
+    resolution: {integrity: sha512-nbJnQ8a3z1mtmrwImCYhc6BGpThAyYVRQxw9uKSKG4wR6aAYno9sVjJ0zaZcW9BPJX1GbrDPf+SvdWjgTuDmnw==}
+    cpu: [loong64]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-linux-ppc64-gnu@4.60.4':
+    resolution: {integrity: sha512-2EU6acNrQLd8tYvo/LXW535wupT3m6fo7HKo6lr7ktQoItxTyOL1ZCR/GfGCuXl2vR+zmfI6eRXkSemafv+iVg==}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-ppc64-musl@4.60.4':
+    resolution: {integrity: sha512-WeBtoMuaMxiiIrO2IYP3xs6GMWkJP2C0EoT8beTLkUPmzV1i/UcOSVw1d5r9KBODtHKilG5yFxsGRnBbK3wJ4A==}
+    cpu: [ppc64]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-linux-riscv64-gnu@4.60.4':
+    resolution: {integrity: sha512-FJHFfqpKUI3A10WrWKiFbBZ7yVbGT4q4B5o1qKFFojqpaYoh9LrQgqWCmmcxQzVSXYtyB5bzkXrYzlHTs21MYA==}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-riscv64-musl@4.60.4':
+    resolution: {integrity: sha512-mcEl6CUT5IAUmQf1m9FYSmVqCJlpQ8r8eyftFUHG8i9OhY7BkBXSUdnLH5DOf0wCOjcP9v/QO93zpmF1SptCCw==}
+    cpu: [riscv64]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-linux-s390x-gnu@4.60.4':
+    resolution: {integrity: sha512-ynt3JxVd2w2buzoKDWIyiV1pJW93xlQic1THVLXilz429oijRpSHivZAgp65KBu+cMcgf1eVVjdnTLvPxgCuoQ==}
+    cpu: [s390x]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-x64-gnu@4.60.4':
+    resolution: {integrity: sha512-Boiz5+MsaROEWDf+GGEwF8VMHGhlUoQMtIPjOgA5fv4osupqTVnJteQNKJwUcnUog2G55jYXH7KZFFiJe0TEzQ==}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@rollup/rollup-linux-x64-musl@4.60.4':
+    resolution: {integrity: sha512-+qfSY27qIrFfI/Hom04KYFw3GKZSGU4lXus51wsb5EuySfFlWRwjkKWoE9emgRw/ukoT4Udsj4W/+xxG8VbPKg==}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@rollup/rollup-openbsd-x64@4.60.4':
+    resolution: {integrity: sha512-VpTfOPHgVXEBeeR8hZ2O0F3aSso+JDWqTWmTmzcQKted54IAdUVbxE+j/MVxUsKa8L20HJhv3vUezVPoquqWjA==}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@rollup/rollup-openharmony-arm64@4.60.4':
+    resolution: {integrity: sha512-IPOsh5aRYuLv/nkU51X10Bf75Bsf6+gZdx1X+QP5QM6lIJFHHqbHLG0uJn/hWthzo13UAc2umiUorqZy3axoZg==}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@rollup/rollup-win32-arm64-msvc@4.60.4':
+    resolution: {integrity: sha512-4QzE9E81OohJ/HKzHhsqU+zcYYojVOXlFMs1DdyMT6qXl/niOH7AVElmmEdUNHHS/oRkc++d5k6Vy85zFs0DEw==}
+    cpu: [arm64]
+    os: [win32]
+
+  '@rollup/rollup-win32-ia32-msvc@4.60.4':
+    resolution: {integrity: sha512-zTPgT1YuHHcd+Tmx7h8aml0FWFVelV5N54oHow9SLj+GfoDy/huQ+UV396N/C7KpMDMiPspRktzM1/0r1usYEA==}
+    cpu: [ia32]
+    os: [win32]
+
+  '@rollup/rollup-win32-x64-gnu@4.60.4':
+    resolution: {integrity: sha512-DRS4G7mi9lJxqEDezIkKCaUIKCrLUUDCUaCsTPCi/rtqaC6D/jjwslMQyiDU50Ka0JKpeXeRBFBAXwArY52vBw==}
+    cpu: [x64]
+    os: [win32]
+
+  '@rollup/rollup-win32-x64-msvc@4.60.4':
+    resolution: {integrity: sha512-QVTUovf40zgTqlFVrKA1uXMVvU2QWEFWfAH8Wdc48IxLvrJMQVMBRjuQyUpzZCDkakImib9eVazbWlC6ksWtJw==}
+    cpu: [x64]
+    os: [win32]
+
+  '@types/babel__core@7.20.5':
+    resolution: {integrity: sha512-qoQprZvz5wQFJwMDqeseRXWv3rqMvhgpbXFfVyWhbx9X47POIA6i/+dXefEmZKoAgOaTdaIgNSMqMIU61yRyzA==}
+
+  '@types/babel__generator@7.27.0':
+    resolution: {integrity: sha512-ufFd2Xi92OAVPYsy+P4n7/U7e68fex0+Ee8gSG9KX7eo084CWiQ4sdxktvdl0bOPupXtVJPY19zk6EwWqUQ8lg==}
+
+  '@types/babel__template@7.4.4':
+    resolution: {integrity: sha512-h/NUaSyG5EyxBIp8YRxo4RMe2/qQgvyowRwVMzhYhBCONbW8PUsg4lkFMrhgZhUe5z3L3MiLDuvyJ/CaPa2A8A==}
+
+  '@types/babel__traverse@7.28.0':
+    resolution: {integrity: sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q==}
+
+  '@types/estree@1.0.8':
+    resolution: {integrity: sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==}
+
+  '@types/json-schema@7.0.15':
+    resolution: {integrity: sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==}
+
+  '@types/node@25.9.1':
+    resolution: {integrity: sha512-xfrlY7UD5rMJk3ZVJP8BNzS28J36YJg+xp+LPXV1TdWxr8uMH5A860QNxYDGQe/ylDSgjxE52Q9VnO7p75tJxg==}
+
+  '@types/prop-types@15.7.15':
+    resolution: {integrity: sha512-F6bEyamV9jKGAFBEmlQnesRPGOQqS2+Uwi0Em15xenOxHaf2hv6L8YCVn3rPdPJOiJfPiCnLIRyvwVaqMY3MIw==}
+
+  '@types/react-dom@18.3.7':
+    resolution: {integrity: sha512-MEe3UeoENYVFXzoXEWsvcpg6ZvlrFNlOQ7EOsvhI3CfAXwzPfO8Qwuxd40nepsYKqyyVQnTdEfv68q91yLcKrQ==}
+    peerDependencies:
+      '@types/react': ^18.0.0
+
+  '@types/react@18.3.29':
+    resolution: {integrity: sha512-ch0qJdr2JY0r04NXSprbK6TXOgnaJ1Tz23fm5W+z0/CBah6BSBc3n96h7K9GOtwh0HrilNWHIBzE1Ko4Dcw/Wg==}
+
+  '@typescript-eslint/eslint-plugin@8.61.1':
+    resolution: {integrity: sha512-ZPlVl3PB3et/59Ne0fv/sci6ZXz4T4Hp4nTJ56i/Y0gR89ARb+KphojTq6j+56E5PIezmOIOOWyY+aWQFd+IkQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      '@typescript-eslint/parser': ^8.61.1
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/parser@8.61.1':
+    resolution: {integrity: sha512-PJ5vePq5/ognBbrIcoC5+SHO5dfpeLPzP9FpLkzWrguoYQEeeSjlJpVwOpo1JRSTEi7dRcwNy4h4dzV70PqHcg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/project-service@8.61.1':
+    resolution: {integrity: sha512-PrC4JYGmR241lYnfhmKGTXkFqv8+ymbTFgSAY0fVXpY82/QkMw5TZPl+vGzuDDU2QYJk9fIDOBTntF+yDv9LEA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/scope-manager@8.61.1':
+    resolution: {integrity: sha512-L2bdIeoQS8FlKAvONAr20w6OcLXeB+qiDKbAooS9A0Ben+iSIkBef0FxqwKWYqt5sa0i4KJtxVyVmhMylKzF5w==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@typescript-eslint/tsconfig-utils@8.61.1':
+    resolution: {integrity: sha512-UN/H4di+OO7EWx2ovME+8t31YO+KVnK0RRKEHR3kOt21/Ay8BOq3M1OMvWs5vNiqcFCYGYoxK3MXPZzmMUE+yg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/type-utils@8.61.1':
+    resolution: {integrity: sha512-GYRicKmVK0C4fsKgaACaknOUAq9Oa2kwsjnpFhFcS/5p4Ht5IP9OVLbgIgcK4SRk92nVHFluurg1lumD9dBcLw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/types@8.61.1':
+    resolution: {integrity: sha512-G+CRlPqLv7Bz1IZVs03x5K59F1veqL0EJUROAdGhKsEq8qOiRiZbI+HUojPq5l0fEGOKModD9br6lObhB8zkoA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@typescript-eslint/typescript-estree@8.61.1':
+    resolution: {integrity: sha512-u+oQD3BqYWPc8YV9Zab4vaJElJuwOLPRc10Jm1o/qS+6Qwen14HCWwx0Seo4LnSn2wxea2Ik8DxPt2/FHmuhrg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/utils@8.61.1':
+    resolution: {integrity: sha512-1+P/3Dj6jvtybE1q0HQ6yBt/gq+oKJyLdEv4HdnqasaEXRSYCAsD59mXEVQnM/ULNdQxbX77tdG4jPRjIS6knA==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
+  '@typescript-eslint/visitor-keys@8.61.1':
+    resolution: {integrity: sha512-6fJ9MHWtK14C1DSkiMlHUSOmrVebL7150xZJBlJiL62jjhIA4JmOq6flwBgDxIdBKKdoiZRel+dfPD5MLfny3w==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@vitejs/plugin-react@4.7.0':
+    resolution: {integrity: sha512-gUu9hwfWvvEDBBmgtAowQCojwZmJ5mcLn3aufeCsitijs3+f2NsrPtlAWIR6OPiqljl96GVCUbLe0HyqIpVaoA==}
+    engines: {node: ^14.18.0 || >=16.0.0}
+    peerDependencies:
+      vite: ^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0
+
+  '@wailsio/runtime@3.0.0-alpha.79':
+    resolution: {integrity: sha512-NITzxKmJsMEruc39L166lbPJVECxzcbdqpHVqOOF7Cu/7Zqk/e3B/gNpkUjhNyo5rVb3V1wpS8oEgLUmpu1cwA==}
+
+  acorn-jsx@5.3.2:
+    resolution: {integrity: sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==}
+    peerDependencies:
+      acorn: ^6.0.0 || ^7.0.0 || ^8.0.0
+
+  acorn@8.17.0:
+    resolution: {integrity: sha512-xRQbDb9BnwDafYNn6Vwl839DYVjqXYb1XVGtWAZ1kcDc6iwAL4hg3B1dZlRiuENFeO2H53gFG3in621AdERVAg==}
+    engines: {node: '>=0.4.0'}
+    hasBin: true
+
+  ajv@6.15.0:
+    resolution: {integrity: sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==}
+
+  ansi-styles@4.3.0:
+    resolution: {integrity: sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==}
+    engines: {node: '>=8'}
+
+  any-promise@1.3.0:
+    resolution: {integrity: sha512-7UvmKalWRt1wgjL1RrGxoSJW/0QZFIegpeGvZG9kjp8vrRu55XTHbwnqq2GpXm9uLbcuhxm3IqX9OB4MZR1b2A==}
+
+  anymatch@3.1.3:
+    resolution: {integrity: sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==}
+    engines: {node: '>= 8'}
+
+  arg@5.0.2:
+    resolution: {integrity: sha512-PYjyFOLKQ9y57JvQ6QLo8dAgNqswh8M1RMJYdQduT6xbWSgK36P/Z/v+p888pM69jMMfS8Xd8F6I1kQ/I9HUGg==}
+
+  argparse@2.0.1:
+    resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==}
+
+  aria-hidden@1.2.6:
+    resolution: {integrity: sha512-ik3ZgC9dY/lYVVM++OISsaYDeg1tb0VtP5uL3ouh1koGOaUMDPpbFIei4JkFimWUFPn90sbMNMXQAIVOlnYKJA==}
+    engines: {node: '>=10'}
+
+  aria-query@5.3.2:
+    resolution: {integrity: sha512-COROpnaoap1E2F000S62r6A60uHZnmlvomhfyT2DlTcrY1OrBKn2UhH7qn5wTC9zMvD0AY7csdPSNwKP+7WiQw==}
+    engines: {node: '>= 0.4'}
+
+  array-buffer-byte-length@1.0.2:
+    resolution: {integrity: sha512-LHE+8BuR7RYGDKvnrmcuSq3tDcKv9OFEXQt/HpbZhY7V6h0zlUXutnAD82GiFx9rdieCMjkvtcsPqBwgUl1Iiw==}
+    engines: {node: '>= 0.4'}
+
+  array-includes@3.1.9:
+    resolution: {integrity: sha512-FmeCCAenzH0KH381SPT5FZmiA/TmpndpcaShhfgEN9eCVjnFBqq3l1xrI42y8+PPLI6hypzou4GXw00WHmPBLQ==}
+    engines: {node: '>= 0.4'}
+
+  array.prototype.findlast@1.2.5:
+    resolution: {integrity: sha512-CVvd6FHg1Z3POpBLxO6E6zr+rSKEQ9L6rZHAaY7lLfhKsWYUBBOuMs0e9o24oopj6H+geRCX0YJ+TJLBK2eHyQ==}
+    engines: {node: '>= 0.4'}
+
+  array.prototype.flat@1.3.3:
+    resolution: {integrity: sha512-rwG/ja1neyLqCuGZ5YYrznA62D4mZXg0i1cIskIUKSiqF3Cje9/wXAls9B9s1Wa2fomMsIv8czB8jZcPmxCXFg==}
+    engines: {node: '>= 0.4'}
+
+  array.prototype.flatmap@1.3.3:
+    resolution: {integrity: sha512-Y7Wt51eKJSyi80hFrJCePGGNo5ktJCslFuboqJsbf57CCPcm5zztluPlc4/aD8sWsKvlwatezpV4U1efk8kpjg==}
+    engines: {node: '>= 0.4'}
+
+  array.prototype.tosorted@1.1.4:
+    resolution: {integrity: sha512-p6Fx8B7b7ZhL/gmUsAy0D15WhvDccw3mnGNbZpi3pmeJdxtWsj2jEaI4Y6oo3XiHfzuSgPwKc04MYt6KgvC/wA==}
+    engines: {node: '>= 0.4'}
+
+  arraybuffer.prototype.slice@1.0.4:
+    resolution: {integrity: sha512-BNoCY6SXXPQ7gF2opIP4GBE+Xw7U+pHMYKuzjgCN3GwiaIR09UUeKfheyIry77QtrCBlC0KK0q5/TER/tYh3PQ==}
+    engines: {node: '>= 0.4'}
+
+  ast-types-flow@0.0.8:
+    resolution: {integrity: sha512-OH/2E5Fg20h2aPrbe+QL8JZQFko0YZaF+j4mnQ7BGhfavO7OpSLa8a0y9sBwomHdSbkhTS8TQNayBfnW5DwbvQ==}
+
+  async-function@1.0.0:
+    resolution: {integrity: sha512-hsU18Ae8CDTR6Kgu9DYf0EbCr/a5iGL0rytQDobUcdpYOKokk8LEjVphnXkDkgpi0wYVsqrXuP0bZxJaTqdgoA==}
+    engines: {node: '>= 0.4'}
+
+  autoprefixer@10.5.0:
+    resolution: {integrity: sha512-FMhOoZV4+qR6aTUALKX2rEqGG+oyATvwBt9IIzVR5rMa2HRWPkxf+P+PAJLD1I/H5/II+HuZcBJYEFBpq39ong==}
+    engines: {node: ^10 || ^12 || >=14}
+    hasBin: true
+    peerDependencies:
+      postcss: ^8.1.0
+
+  available-typed-arrays@1.0.7:
+    resolution: {integrity: sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ==}
+    engines: {node: '>= 0.4'}
+
+  axe-core@4.12.1:
+    resolution: {integrity: sha512-s7iGf5GaVMxEG0ENN9x+xTr7GFZCb1ZP/1uATUpCEK2X78nDB3RwbtFCo9pGAf9ru+VwoQ464DkaLEeRM08wJA==}
+    engines: {node: '>=4'}
+
+  axobject-query@4.1.0:
+    resolution: {integrity: sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ==}
+    engines: {node: '>= 0.4'}
+
+  balanced-match@1.0.2:
+    resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==}
+
+  balanced-match@4.0.4:
+    resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==}
+    engines: {node: 18 || 20 || >=22}
+
+  baseline-browser-mapping@2.10.32:
+    resolution: {integrity: sha512-wbPvpyjJPC0zdfdKXxqEL3Ea+bOMD/87X4lftiJkkaBiuG6ALQy1SLmEd7BSmVCuwCQsBrCamgBoLyfFDD1EPg==}
+    engines: {node: '>=6.0.0'}
+    hasBin: true
+
+  binary-extensions@2.3.0:
+    resolution: {integrity: sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw==}
+    engines: {node: '>=8'}
+
+  brace-expansion@1.1.15:
+    resolution: {integrity: sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==}
+
+  brace-expansion@5.0.6:
+    resolution: {integrity: sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==}
+    engines: {node: 18 || 20 || >=22}
+
+  braces@3.0.3:
+    resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
+    engines: {node: '>=8'}
+
+  browserslist@4.28.2:
+    resolution: {integrity: sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==}
+    engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
+    hasBin: true
+
+  call-bind-apply-helpers@1.0.2:
+    resolution: {integrity: sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==}
+    engines: {node: '>= 0.4'}
+
+  call-bind@1.0.9:
+    resolution: {integrity: sha512-a/hy+pNsFUTR+Iz8TCJvXudKVLAnz/DyeSUo10I5yvFDQJBFU2s9uqQpoSrJlroHUKoKqzg+epxyP9lqFdzfBQ==}
+    engines: {node: '>= 0.4'}
+
+  call-bound@1.0.4:
+    resolution: {integrity: sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==}
+    engines: {node: '>= 0.4'}
+
+  callsites@3.1.0:
+    resolution: {integrity: sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==}
+    engines: {node: '>=6'}
+
+  camelcase-css@2.0.1:
+    resolution: {integrity: sha512-QOSvevhslijgYwRx6Rv7zKdMF8lbRmx+uQGx2+vDc+KI/eBnsy9kit5aj23AgGu3pa4t9AgwbnXWqS+iOY+2aA==}
+    engines: {node: '>= 6'}
+
+  caniuse-lite@1.0.30001793:
+    resolution: {integrity: sha512-iwSsYWaCOoh26cV8NwNRViHlrfUvYsHDfRVcbtmw0Kg6PJIZZXwMkj1442FYLBGkeUf1juAsU3DTfxW579mrPA==}
+
+  chalk@4.1.2:
+    resolution: {integrity: sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==}
+    engines: {node: '>=10'}
+
+  chokidar@3.6.0:
+    resolution: {integrity: sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw==}
+    engines: {node: '>= 8.10.0'}
+
+  class-variance-authority@0.7.1:
+    resolution: {integrity: sha512-Ka+9Trutv7G8M6WT6SeiRWz792K5qEqIGEGzXKhAE6xOWAY6pPH8U+9IY3oCMv6kqTmLsv7Xh/2w2RigkePMsg==}
+
+  clsx@2.1.1:
+    resolution: {integrity: sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA==}
+    engines: {node: '>=6'}
+
+  cmdk@1.1.1:
+    resolution: {integrity: sha512-Vsv7kFaXm+ptHDMZ7izaRsP70GgrW9NBNGswt9OZaVBLlE0SNpDq8eu/VGXyF9r7M0azK3Wy7OlYXsuyYLFzHg==}
+    peerDependencies:
+      react: ^18 || ^19 || ^19.0.0-rc
+      react-dom: ^18 || ^19 || ^19.0.0-rc
+
+  color-convert@2.0.1:
+    resolution: {integrity: sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==}
+    engines: {node: '>=7.0.0'}
+
+  color-name@1.1.4:
+    resolution: {integrity: sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==}
+
+  commander@4.1.1:
+    resolution: {integrity: sha512-NOKm8xhkzAjzFx8B2v5OAHT+u5pRQc2UCa2Vq9jYL/31o2wi9mxBA7LIFs3sV5VSC49z6pEhfbMULvShKj26WA==}
+    engines: {node: '>= 6'}
+
+  concat-map@0.0.1:
+    resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==}
+
+  convert-source-map@2.0.0:
+    resolution: {integrity: sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==}
+
+  cookie@1.1.1:
+    resolution: {integrity: sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==}
+    engines: {node: '>=18'}
+
+  cross-spawn@7.0.6:
+    resolution: {integrity: sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==}
+    engines: {node: '>= 8'}
+
+  cssesc@3.0.0:
+    resolution: {integrity: sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==}
+    engines: {node: '>=4'}
+    hasBin: true
+
+  csstype@3.2.3:
+    resolution: {integrity: sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==}
+
+  damerau-levenshtein@1.0.8:
+    resolution: {integrity: sha512-sdQSFB7+llfUcQHUQO3+B8ERRj0Oa4w9POWMI/puGtuf7gFywGmkaLCElnudfTiKZV+NvHqL0ifzdrI8Ro7ESA==}
+
+  data-view-buffer@1.0.2:
+    resolution: {integrity: sha512-EmKO5V3OLXh1rtK2wgXRansaK1/mtVdTUEiEI0W8RkvgT05kfxaH29PliLnpLP73yYO6142Q72QNa8Wx/A5CqQ==}
+    engines: {node: '>= 0.4'}
+
+  data-view-byte-length@1.0.2:
+    resolution: {integrity: sha512-tuhGbE6CfTM9+5ANGf+oQb72Ky/0+s3xKUpHvShfiz2RxMFgFPjsXuRLBVMtvMs15awe45SRb83D6wH4ew6wlQ==}
+    engines: {node: '>= 0.4'}
+
+  data-view-byte-offset@1.0.1:
+    resolution: {integrity: sha512-BS8PfmtDGnrgYdOonGZQdLZslWIeCGFP9tpan0hi1Co2Zr2NKADsvGYA8XxuG/4UWgJ6Cjtv+YJnB6MM69QGlQ==}
+    engines: {node: '>= 0.4'}
+
+  debug@4.4.3:
+    resolution: {integrity: sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==}
+    engines: {node: '>=6.0'}
+    peerDependencies:
+      supports-color: '*'
+    peerDependenciesMeta:
+      supports-color:
+        optional: true
+
+  deep-is@0.1.4:
+    resolution: {integrity: sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==}
+
+  define-data-property@1.1.4:
+    resolution: {integrity: sha512-rBMvIzlpA8v6E+SJZoo++HAYqsLrkg7MSfIinMPFhmkorw7X+dOXVJQs+QT69zGkzMyfDnIMN2Wid1+NbL3T+A==}
+    engines: {node: '>= 0.4'}
+
+  define-properties@1.2.1:
+    resolution: {integrity: sha512-8QmQKqEASLd5nx0U1B1okLElbUuuttJ/AnYmRXbbbGDWh6uS208EjD4Xqq/I9wK7u0v6O08XhTWnt5XtEbR6Dg==}
+    engines: {node: '>= 0.4'}
+
+  detect-node-es@1.1.0:
+    resolution: {integrity: sha512-ypdmJU/TbBby2Dxibuv7ZLW3Bs1QEmM7nHjEANfohJLvE0XVujisn1qPJcZxg+qDucsr+bP6fLD1rPS3AhJ7EQ==}
+
+  didyoumean@1.2.2:
+    resolution: {integrity: sha512-gxtyfqMg7GKyhQmb056K7M3xszy/myH8w+B4RT+QXBQsvAOdc3XymqDDPHx1BgPgsdAA5SIifona89YtRATDzw==}
+
+  dlv@1.1.3:
+    resolution: {integrity: sha512-+HlytyjlPKnIG8XuRG8WvmBP8xs8P71y+SKKS6ZXWoEgLuePxtDoUEiH7WkdePWrQ5JBpE6aoVqfZfJUQkjXwA==}
+
+  doctrine@2.1.0:
+    resolution: {integrity: sha512-35mSku4ZXK0vfCuHEDAwt55dg2jNajHZ1odvF+8SSr82EsZY4QmXfuWso8oEd8zRhVObSN18aM0CjSdoBX7zIw==}
+    engines: {node: '>=0.10.0'}
+
+  dunder-proto@1.0.1:
+    resolution: {integrity: sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==}
+    engines: {node: '>= 0.4'}
+
+  electron-to-chromium@1.5.362:
+    resolution: {integrity: sha512-PUY2DrLvkjkUuWqq+KPL2iWshrJsZOcIojzRQ7eXFacc9dWga7MGMJAa15VbiejSZB1PAXaRLAiKgruHP8LB1w==}
+
+  emoji-regex@9.2.2:
+    resolution: {integrity: sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==}
+
+  es-abstract-get@1.0.0:
+    resolution: {integrity: sha512-6PMWXpdhshVvFp+FoWYs1EvG1Nj0tvk0dZM+XcK0xMEM1czRVcP6ohqPWHy6qPagSpC8j4+p89WXlT+xXJs/fg==}
+    engines: {node: '>= 0.4'}
+
+  es-abstract@1.24.2:
+    resolution: {integrity: sha512-2FpH9Q5i2RRwyEP1AylXe6nYLR5OhaJTZwmlcP0dL/+JCbgg7yyEo/sEK6HeGZRf3dFpWwThaRHVApXSkW3xeg==}
+    engines: {node: '>= 0.4'}
+
+  es-define-property@1.0.1:
+    resolution: {integrity: sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==}
+    engines: {node: '>= 0.4'}
+
+  es-errors@1.3.0:
+    resolution: {integrity: sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==}
+    engines: {node: '>= 0.4'}
+
+  es-iterator-helpers@1.3.3:
+    resolution: {integrity: sha512-0PuBxFi+4uPanB97iDxCLWuHeYud2FALrw5HFZGtAF38UpJDbDC8frwp2cnDyae692CQ0dou60UwWfhgsa4U/g==}
+    engines: {node: '>= 0.4'}
+
+  es-object-atoms@1.1.2:
+    resolution: {integrity: sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==}
+    engines: {node: '>= 0.4'}
+
+  es-set-tostringtag@2.1.0:
+    resolution: {integrity: sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==}
+    engines: {node: '>= 0.4'}
+
+  es-shim-unscopables@1.1.0:
+    resolution: {integrity: sha512-d9T8ucsEhh8Bi1woXCf+TIKDIROLG5WCkxg8geBCbvk22kzwC5G2OnXVMO6FUsvQlgUUXQ2itephWDLqDzbeCw==}
+    engines: {node: '>= 0.4'}
+
+  es-to-primitive@1.3.1:
+    resolution: {integrity: sha512-CxN9N56HYfd2m/acc/NOFrZQsN9kU4eh+2kk6A707Kz1krH8tKmfrs5RnftB8WNX80T0NS7vSQsDOlg23diR2g==}
+    engines: {node: '>= 0.4'}
+
+  esbuild@0.25.12:
+    resolution: {integrity: sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+  escalade@3.2.0:
+    resolution: {integrity: sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==}
+    engines: {node: '>=6'}
+
+  escape-string-regexp@4.0.0:
+    resolution: {integrity: sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==}
+    engines: {node: '>=10'}
+
+  eslint-plugin-jsx-a11y@6.10.2:
+    resolution: {integrity: sha512-scB3nz4WmG75pV8+3eRUQOHZlNSUhFNq37xnpgRkCCELU3XMvXAxLk1eqWWyE22Ki4Q01Fnsw9BA3cJHDPgn2Q==}
+    engines: {node: '>=4.0'}
+    peerDependencies:
+      eslint: ^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9
+
+  eslint-plugin-react-hooks@7.1.1:
+    resolution: {integrity: sha512-f2I7Gw6JbvCexzIInuSbZpfdQ44D7iqdWX01FKLvrPgqxoE7oMj8clOfto8U6vYiz4yd5oKu39rRSVOe1zRu0g==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      eslint: ^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0-0 || ^9.0.0 || ^10.0.0
+
+  eslint-plugin-react-refresh@0.5.3:
+    resolution: {integrity: sha512-5EMmLCV98Pi4o/f/3DP/v/tNqLHMIc9I8LKClNDWhZ9JTho89/kQcitCXQBMG7sAfVRK0Ie3T2EDOzp1YXYiVA==}
+    peerDependencies:
+      eslint: ^9 || ^10
+
+  eslint-plugin-react@7.37.5:
+    resolution: {integrity: sha512-Qteup0SqU15kdocexFNAJMvCJEfa2xUKNV4CC1xsVMrIIqEy3SQ/rqyxCWNzfrd3/ldy6HMlD2e0JDVpDg2qIA==}
+    engines: {node: '>=4'}
+    peerDependencies:
+      eslint: ^3 || ^4 || ^5 || ^6 || ^7 || ^8 || ^9.7
+
+  eslint-scope@8.4.0:
+    resolution: {integrity: sha512-sNXOfKCn74rt8RICKMvJS7XKV/Xk9kA7DyJr8mJik3S7Cwgy3qlkkmyS2uQB3jiJg6VNdZd/pDBJu0nvG2NlTg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  eslint-visitor-keys@3.4.3:
+    resolution: {integrity: sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==}
+    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
+
+  eslint-visitor-keys@4.2.1:
+    resolution: {integrity: sha512-Uhdk5sfqcee/9H/rCOJikYz67o0a2Tw2hGRPOG2Y1R2dg7brRe1uG0yaNQDHu+TO/uQPF/5eCapvYSmHUjt7JQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  eslint-visitor-keys@5.0.1:
+    resolution: {integrity: sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA==}
+    engines: {node: ^20.19.0 || ^22.13.0 || >=24}
+
+  eslint@9.39.4:
+    resolution: {integrity: sha512-XoMjdBOwe/esVgEvLmNsD3IRHkm7fbKIUGvrleloJXUZgDHig2IPWNniv+GwjyJXzuNqVjlr5+4yVUZjycJwfQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    hasBin: true
+    peerDependencies:
+      jiti: '*'
+    peerDependenciesMeta:
+      jiti:
+        optional: true
+
+  espree@10.4.0:
+    resolution: {integrity: sha512-j6PAQ2uUr79PZhBjP5C5fhl8e39FmRnOjsD5lGnWrFU8i2G776tBK7+nP8KuQUTTyAZUwfQqXAgrVH5MbH9CYQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  esquery@1.7.0:
+    resolution: {integrity: sha512-Ap6G0WQwcU/LHsvLwON1fAQX9Zp0A2Y6Y/cJBl9r/JbW90Zyg4/zbG6zzKa2OTALELarYHmKu0GhpM5EO+7T0g==}
+    engines: {node: '>=0.10'}
+
+  esrecurse@4.3.0:
+    resolution: {integrity: sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==}
+    engines: {node: '>=4.0'}
+
+  estraverse@5.3.0:
+    resolution: {integrity: sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==}
+    engines: {node: '>=4.0'}
+
+  esutils@2.0.3:
+    resolution: {integrity: sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==}
+    engines: {node: '>=0.10.0'}
+
+  fast-deep-equal@3.1.3:
+    resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==}
+
+  fast-glob@3.3.3:
+    resolution: {integrity: sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==}
+    engines: {node: '>=8.6.0'}
+
+  fast-json-stable-stringify@2.1.0:
+    resolution: {integrity: sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==}
+
+  fast-levenshtein@2.0.6:
+    resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==}
+
+  fastq@1.20.1:
+    resolution: {integrity: sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==}
+
+  fdir@6.5.0:
+    resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==}
+    engines: {node: '>=12.0.0'}
+    peerDependencies:
+      picomatch: ^3 || ^4
+    peerDependenciesMeta:
+      picomatch:
+        optional: true
+
+  file-entry-cache@8.0.0:
+    resolution: {integrity: sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==}
+    engines: {node: '>=16.0.0'}
+
+  fill-range@7.1.1:
+    resolution: {integrity: sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==}
+    engines: {node: '>=8'}
+
+  find-up@5.0.0:
+    resolution: {integrity: sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==}
+    engines: {node: '>=10'}
+
+  flat-cache@4.0.1:
+    resolution: {integrity: sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==}
+    engines: {node: '>=16'}
+
+  flatted@3.4.2:
+    resolution: {integrity: sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==}
+
+  for-each@0.3.5:
+    resolution: {integrity: sha512-dKx12eRCVIzqCxFGplyFKJMPvLEWgmNtUrpTiJIR5u97zEhRG8ySrtboPHZXx7daLxQVrl643cTzbab2tkQjxg==}
+    engines: {node: '>= 0.4'}
+
+  fraction.js@5.3.4:
+    resolution: {integrity: sha512-1X1NTtiJphryn/uLQz3whtY6jK3fTqoE3ohKs0tT+Ujr1W59oopxmoEh7Lu5p6vBaPbgoM0bzveAW4Qi5RyWDQ==}
+
+  framer-motion@12.40.0:
+    resolution: {integrity: sha512-uaBd3qC1v3KQqBEjwTUd183K6PbS+j0yR9w9VmEOLWA/tnUcSn8Xa3uck7t4dgpDoUss8xQTcj8W2L07lrnLFg==}
+    peerDependencies:
+      '@emotion/is-prop-valid': '*'
+      react: ^18.0.0 || ^19.0.0
+      react-dom: ^18.0.0 || ^19.0.0
+    peerDependenciesMeta:
+      '@emotion/is-prop-valid':
+        optional: true
+      react:
+        optional: true
+      react-dom:
+        optional: true
+
+  fsevents@2.3.3:
+    resolution: {integrity: sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==}
+    engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
+    os: [darwin]
+
+  function-bind@1.1.2:
+    resolution: {integrity: sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==}
+
+  function.prototype.name@1.2.0:
+    resolution: {integrity: sha512-jObKIik1P2QjPHP5nz5BaOtUlfgS0fWo8IUByNXkM+o+02sJOi94em77GwJKQSJ3gfPHdgzLNrHc1uokV4P/ew==}
+    engines: {node: '>= 0.4'}
+
+  functions-have-names@1.2.3:
+    resolution: {integrity: sha512-xckBUXyTIqT97tq2x2AMb+g163b5JFysYk0x4qxNFwbfQkmNZoiRHb6sPzI9/QV33WeuvVYBUIiD4NzNIyqaRQ==}
+
+  generator-function@2.0.1:
+    resolution: {integrity: sha512-SFdFmIJi+ybC0vjlHN0ZGVGHc3lgE0DxPAT0djjVg+kjOnSqclqmj0KQ7ykTOLP6YxoqOvuAODGdcHJn+43q3g==}
+    engines: {node: '>= 0.4'}
+
+  gensync@1.0.0-beta.2:
+    resolution: {integrity: sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==}
+    engines: {node: '>=6.9.0'}
+
+  get-intrinsic@1.3.0:
+    resolution: {integrity: sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==}
+    engines: {node: '>= 0.4'}
+
+  get-nonce@1.0.1:
+    resolution: {integrity: sha512-FJhYRoDaiatfEkUK8HKlicmu/3SGFD51q3itKDGoSTysQJBnfOcxU5GxnhE1E6soB76MbT0MBtnKJuXyAx+96Q==}
+    engines: {node: '>=6'}
+
+  get-proto@1.0.1:
+    resolution: {integrity: sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==}
+    engines: {node: '>= 0.4'}
+
+  get-symbol-description@1.1.0:
+    resolution: {integrity: sha512-w9UMqWwJxHNOvoNzSJ2oPF5wvYcvP7jUvYzhp67yEhTi17ZDBBC1z9pTdGuzjD+EFIqLSYRweZjqfiPzQ06Ebg==}
+    engines: {node: '>= 0.4'}
+
+  glob-parent@5.1.2:
+    resolution: {integrity: sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==}
+    engines: {node: '>= 6'}
+
+  glob-parent@6.0.2:
+    resolution: {integrity: sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==}
+    engines: {node: '>=10.13.0'}
+
+  globals@14.0.0:
+    resolution: {integrity: sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==}
+    engines: {node: '>=18'}
+
+  globals@17.6.0:
+    resolution: {integrity: sha512-sepffkT8stwnIYbsMBpoCHJuJM5l98FUF2AnE07hfvE0m/qp3R586hw4jF4uadbhvg1ooIdzuu7CsfD2jzCaNA==}
+    engines: {node: '>=18'}
+
+  globalthis@1.0.4:
+    resolution: {integrity: sha512-DpLKbNU4WylpxJykQujfCcwYWiV/Jhm50Goo0wrVILAv5jOr9d+H+UR3PhSCD2rCCEIg0uc+G+muBTwD54JhDQ==}
+    engines: {node: '>= 0.4'}
+
+  gopd@1.2.0:
+    resolution: {integrity: sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==}
+    engines: {node: '>= 0.4'}
+
+  has-bigints@1.1.0:
+    resolution: {integrity: sha512-R3pbpkcIqv2Pm3dUwgjclDRVmWpTJW2DcMzcIhEXEx1oh/CEMObMm3KLmRJOdvhM7o4uQBnwr8pzRK2sJWIqfg==}
+    engines: {node: '>= 0.4'}
+
+  has-flag@4.0.0:
+    resolution: {integrity: sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==}
+    engines: {node: '>=8'}
+
+  has-property-descriptors@1.0.2:
+    resolution: {integrity: sha512-55JNKuIW+vq4Ke1BjOTjM2YctQIvCT7GFzHwmfZPGo5wnrgkid0YQtnAleFSqumZm4az3n2BS+erby5ipJdgrg==}
+
+  has-proto@1.2.0:
+    resolution: {integrity: sha512-KIL7eQPfHQRC8+XluaIw7BHUwwqL19bQn4hzNgdr+1wXoU0KKj6rufu47lhY7KbJR2C6T6+PfyN0Ea7wkSS+qQ==}
+    engines: {node: '>= 0.4'}
+
+  has-symbols@1.1.0:
+    resolution: {integrity: sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==}
+    engines: {node: '>= 0.4'}
+
+  has-tostringtag@1.0.2:
+    resolution: {integrity: sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==}
+    engines: {node: '>= 0.4'}
+
+  hasown@2.0.3:
+    resolution: {integrity: sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==}
+    engines: {node: '>= 0.4'}
+
+  hasown@2.0.4:
+    resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==}
+    engines: {node: '>= 0.4'}
+
+  hermes-estree@0.25.1:
+    resolution: {integrity: sha512-0wUoCcLp+5Ev5pDW2OriHC2MJCbwLwuRx+gAqMTOkGKJJiBCLjtrvy4PWUGn6MIVefecRpzoOZ/UV6iGdOr+Cw==}
+
+  hermes-parser@0.25.1:
+    resolution: {integrity: sha512-6pEjquH3rqaI6cYAXYPcz9MS4rY6R4ngRgrgfDshRptUZIc3lw0MCIJIGDj9++mfySOuPTHB4nrSW99BCvOPIA==}
+
+  html-parse-stringify@3.0.1:
+    resolution: {integrity: sha512-KknJ50kTInJ7qIScF3jeaFRpMpE8/lfiTdzf/twXyPBLAGrLRTmkz3AdTnKeh40X8k9L2fdYwEp/42WGXIRGcg==}
+
+  i18next@26.3.0:
+    resolution: {integrity: sha512-gHSgGpUXVmuqE2El1W61DmxeyeTlFfZgdJRWMo9jScAn5pu7TuTuiccb1zh3E2J9hEBVGJ23+96x0ieBhfuIHA==}
+    peerDependencies:
+      typescript: ^5 || ^6
+    peerDependenciesMeta:
+      typescript:
+        optional: true
+
+  ignore@5.3.2:
+    resolution: {integrity: sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==}
+    engines: {node: '>= 4'}
+
+  ignore@7.0.5:
+    resolution: {integrity: sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==}
+    engines: {node: '>= 4'}
+
+  import-fresh@3.3.1:
+    resolution: {integrity: sha512-TR3KfrTZTYLPB6jUjfx6MF9WcWrHL9su5TObK4ZkYgBdWKPOFoSoQIdEuTuR82pmtxH2spWG9h6etwfr1pLBqQ==}
+    engines: {node: '>=6'}
+
+  imurmurhash@0.1.4:
+    resolution: {integrity: sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==}
+    engines: {node: '>=0.8.19'}
+
+  internal-slot@1.1.0:
+    resolution: {integrity: sha512-4gd7VpWNQNB4UKKCFFVcp1AVv+FMOgs9NKzjHKusc8jTMhd5eL1NqQqOpE0KzMds804/yHlglp3uxgluOqAPLw==}
+    engines: {node: '>= 0.4'}
+
+  is-array-buffer@3.0.5:
+    resolution: {integrity: sha512-DDfANUiiG2wC1qawP66qlTugJeL5HyzMpfr8lLK+jMQirGzNod0B12cFB/9q838Ru27sBwfw78/rdoU7RERz6A==}
+    engines: {node: '>= 0.4'}
+
+  is-async-function@2.1.1:
+    resolution: {integrity: sha512-9dgM/cZBnNvjzaMYHVoxxfPj2QXt22Ev7SuuPrs+xav0ukGB0S6d4ydZdEiM48kLx5kDV+QBPrpVnFyefL8kkQ==}
+    engines: {node: '>= 0.4'}
+
+  is-bigint@1.1.0:
+    resolution: {integrity: sha512-n4ZT37wG78iz03xPRKJrHTdZbe3IicyucEtdRsV5yglwc3GyUfbAfpSeD0FJ41NbUNSt5wbhqfp1fS+BgnvDFQ==}
+    engines: {node: '>= 0.4'}
+
+  is-binary-path@2.1.0:
+    resolution: {integrity: sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw==}
+    engines: {node: '>=8'}
+
+  is-boolean-object@1.2.2:
+    resolution: {integrity: sha512-wa56o2/ElJMYqjCjGkXri7it5FbebW5usLw/nPmCMs5DeZ7eziSYZhSmPRn0txqeW4LnAmQQU7FgqLpsEFKM4A==}
+    engines: {node: '>= 0.4'}
+
+  is-callable@1.2.7:
+    resolution: {integrity: sha512-1BC0BVFhS/p0qtw6enp8e+8OD0UrK0oFLztSjNzhcKA3WDuJxxAPXzPuPtKkjEY9UUoEWlX/8fgKeu2S8i9JTA==}
+    engines: {node: '>= 0.4'}
+
+  is-core-module@2.16.2:
+    resolution: {integrity: sha512-evOr8xfXKxE6qSR0hSXL2r3sd7ALj8+7jQEUvPYcm5sgZFdJ+AYzT6yNmJenvIYQBgIGwfwz08sL8zoL7yq2BA==}
+    engines: {node: '>= 0.4'}
+
+  is-data-view@1.0.2:
+    resolution: {integrity: sha512-RKtWF8pGmS87i2D6gqQu/l7EYRlVdfzemCJN/P3UOs//x1QE7mfhvzHIApBTRf7axvT6DMGwSwBXYCT0nfB9xw==}
+    engines: {node: '>= 0.4'}
+
+  is-date-object@1.1.0:
+    resolution: {integrity: sha512-PwwhEakHVKTdRNVOw+/Gyh0+MzlCl4R6qKvkhuvLtPMggI1WAHt9sOwZxQLSGpUaDnrdyDsomoRgNnCfKNSXXg==}
+    engines: {node: '>= 0.4'}
+
+  is-document.all@1.0.0:
+    resolution: {integrity: sha512-+XSoyS05OdBbhFuELhgTCpFNHkpBOJqtsZfUFFpe5QTw+9Sjbh8zitxhQkYAo6wV7e1Vb8cAPvpCk9jGam/82g==}
+    engines: {node: '>= 0.4'}
+
+  is-extglob@2.1.1:
+    resolution: {integrity: sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==}
+    engines: {node: '>=0.10.0'}
+
+  is-finalizationregistry@1.1.1:
+    resolution: {integrity: sha512-1pC6N8qWJbWoPtEjgcL2xyhQOP491EQjeUo3qTKcmV8YSDDJrOepfG8pcC7h/QgnQHYSv0mJ3Z/ZWxmatVrysg==}
+    engines: {node: '>= 0.4'}
+
+  is-generator-function@1.1.2:
+    resolution: {integrity: sha512-upqt1SkGkODW9tsGNG5mtXTXtECizwtS2kA161M+gJPc1xdb/Ax629af6YrTwcOeQHbewrPNlE5Dx7kzvXTizA==}
+    engines: {node: '>= 0.4'}
+
+  is-glob@4.0.3:
+    resolution: {integrity: sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==}
+    engines: {node: '>=0.10.0'}
+
+  is-map@2.0.3:
+    resolution: {integrity: sha512-1Qed0/Hr2m+YqxnM09CjA2d/i6YZNfF6R2oRAOj36eUdS6qIV/huPJNSEpKbupewFs+ZsJlxsjjPbc0/afW6Lw==}
+    engines: {node: '>= 0.4'}
+
+  is-negative-zero@2.0.3:
+    resolution: {integrity: sha512-5KoIu2Ngpyek75jXodFvnafB6DJgr3u8uuK0LEZJjrU19DrMD3EVERaR8sjz8CCGgpZvxPl9SuE1GMVPFHx1mw==}
+    engines: {node: '>= 0.4'}
+
+  is-number-object@1.1.1:
+    resolution: {integrity: sha512-lZhclumE1G6VYD8VHe35wFaIif+CTy5SJIi5+3y4psDgWu4wPDoBhF8NxUOinEc7pHgiTsT6MaBb92rKhhD+Xw==}
+    engines: {node: '>= 0.4'}
+
+  is-number@7.0.0:
+    resolution: {integrity: sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==}
+    engines: {node: '>=0.12.0'}
+
+  is-regex@1.2.1:
+    resolution: {integrity: sha512-MjYsKHO5O7mCsmRGxWcLWheFqN9DJ/2TmngvjKXihe6efViPqc274+Fx/4fYj/r03+ESvBdTXK0V6tA3rgez1g==}
+    engines: {node: '>= 0.4'}
+
+  is-set@2.0.3:
+    resolution: {integrity: sha512-iPAjerrse27/ygGLxw+EBR9agv9Y6uLeYVJMu+QNCoouJ1/1ri0mGrcWpfCqFZuzzx3WjtwxG098X+n4OuRkPg==}
+    engines: {node: '>= 0.4'}
+
+  is-shared-array-buffer@1.0.4:
+    resolution: {integrity: sha512-ISWac8drv4ZGfwKl5slpHG9OwPNty4jOWPRIhBpxOoD+hqITiwuipOQ2bNthAzwA3B4fIjO4Nln74N0S9byq8A==}
+    engines: {node: '>= 0.4'}
+
+  is-string@1.1.1:
+    resolution: {integrity: sha512-BtEeSsoaQjlSPBemMQIrY1MY0uM6vnS1g5fmufYOtnxLGUZM2178PKbhsk7Ffv58IX+ZtcvoGwccYsh0PglkAA==}
+    engines: {node: '>= 0.4'}
+
+  is-symbol@1.1.1:
+    resolution: {integrity: sha512-9gGx6GTtCQM73BgmHQXfDmLtfjjTUDSyoxTCbp5WtoixAhfgsDirWIcVQ/IHpvI5Vgd5i/J5F7B9cN/WlVbC/w==}
+    engines: {node: '>= 0.4'}
+
+  is-typed-array@1.1.15:
+    resolution: {integrity: sha512-p3EcsicXjit7SaskXHs1hA91QxgTw46Fv6EFKKGS5DRFLD8yKnohjF3hxoju94b/OcMZoQukzpPpBE9uLVKzgQ==}
+    engines: {node: '>= 0.4'}
+
+  is-weakmap@2.0.2:
+    resolution: {integrity: sha512-K5pXYOm9wqY1RgjpL3YTkF39tni1XajUIkawTLUo9EZEVUFga5gSQJF8nNS7ZwJQ02y+1YCNYcMh+HIf1ZqE+w==}
+    engines: {node: '>= 0.4'}
+
+  is-weakref@1.1.1:
+    resolution: {integrity: sha512-6i9mGWSlqzNMEqpCp93KwRS1uUOodk2OJ6b+sq7ZPDSy2WuI5NFIxp/254TytR8ftefexkWn5xNiHUNpPOfSew==}
+    engines: {node: '>= 0.4'}
+
+  is-weakset@2.0.4:
+    resolution: {integrity: sha512-mfcwb6IzQyOKTs84CQMrOwW4gQcaTOAWJ0zzJCl2WSPDrWk/OzDaImWFH3djXhb24g4eudZfLRozAvPGw4d9hQ==}
+    engines: {node: '>= 0.4'}
+
+  isarray@2.0.5:
+    resolution: {integrity: sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw==}
+
+  isexe@2.0.0:
+    resolution: {integrity: sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==}
+
+  iterator.prototype@1.1.5:
+    resolution: {integrity: sha512-H0dkQoCa3b2VEeKQBOxFph+JAbcrQdE7KC0UkqwpLmv2EC4P41QXP+rqo9wYodACiG5/WM5s9oDApTU8utwj9g==}
+    engines: {node: '>= 0.4'}
+
+  jiti@1.21.7:
+    resolution: {integrity: sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==}
+    hasBin: true
+
+  js-tokens@4.0.0:
+    resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
+
+  js-yaml@4.2.0:
+    resolution: {integrity: sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==}
+    hasBin: true
+
+  jsesc@3.1.0:
+    resolution: {integrity: sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==}
+    engines: {node: '>=6'}
+    hasBin: true
+
+  json-buffer@3.0.1:
+    resolution: {integrity: sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==}
+
+  json-schema-traverse@0.4.1:
+    resolution: {integrity: sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==}
+
+  json-stable-stringify-without-jsonify@1.0.1:
+    resolution: {integrity: sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==}
+
+  json5@2.2.3:
+    resolution: {integrity: sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==}
+    engines: {node: '>=6'}
+    hasBin: true
+
+  jsx-ast-utils@3.3.5:
+    resolution: {integrity: sha512-ZZow9HBI5O6EPgSJLUb8n2NKgmVWTwCvHGwFuJlMjvLFqlGG6pjirPhtdsseaLZjSibD8eegzmYpUZwoIlj2cQ==}
+    engines: {node: '>=4.0'}
+
+  keyv@4.5.4:
+    resolution: {integrity: sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==}
+
+  language-subtag-registry@0.3.23:
+    resolution: {integrity: sha512-0K65Lea881pHotoGEa5gDlMxt3pctLi2RplBb7Ezh4rRdLEOtgi7n4EwK9lamnUCkKBqaeKRVebTq6BAxSkpXQ==}
+
+  language-tags@1.0.9:
+    resolution: {integrity: sha512-MbjN408fEndfiQXbFQ1vnd+1NoLDsnQW41410oQBXiyXDMYH5z505juWa4KUE1LqxRC7DgOgZDbKLxHIwm27hA==}
+    engines: {node: '>=0.10'}
+
+  levn@0.4.1:
+    resolution: {integrity: sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==}
+    engines: {node: '>= 0.8.0'}
+
+  lilconfig@3.1.3:
+    resolution: {integrity: sha512-/vlFKAoH5Cgt3Ie+JLhRbwOsCQePABiU3tJ1egGvyQ+33R/vcwM2Zl2QR/LzjsBeItPt3oSVXapn+m4nQDvpzw==}
+    engines: {node: '>=14'}
+
+  lines-and-columns@1.2.4:
+    resolution: {integrity: sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==}
+
+  locate-path@6.0.0:
+    resolution: {integrity: sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==}
+    engines: {node: '>=10'}
+
+  lodash.merge@4.6.2:
+    resolution: {integrity: sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==}
+
+  loose-envify@1.4.0:
+    resolution: {integrity: sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==}
+    hasBin: true
+
+  lru-cache@5.1.1:
+    resolution: {integrity: sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==}
+
+  lucide-react@0.566.0:
+    resolution: {integrity: sha512-b18qC/JAh1X9rVKlF5EtSIyumdIYuh78b0JShynZnHbcaWR4AW4oZyi8Ms/aQYVSnLPlAnMhug2hSr19BgVZAw==}
+    peerDependencies:
+      react: ^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0
+
+  math-intrinsics@1.1.0:
+    resolution: {integrity: sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==}
+    engines: {node: '>= 0.4'}
+
+  merge2@1.4.1:
+    resolution: {integrity: sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==}
+    engines: {node: '>= 8'}
+
+  micromatch@4.0.8:
+    resolution: {integrity: sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==}
+    engines: {node: '>=8.6'}
+
+  minimatch@10.2.5:
+    resolution: {integrity: sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==}
+    engines: {node: 18 || 20 || >=22}
+
+  minimatch@3.1.5:
+    resolution: {integrity: sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==}
+
+  motion-dom@12.40.0:
+    resolution: {integrity: sha512-HxU3ZaBwNPVQUBQf1xxgq+7JrPNZvjLVxgbpEZL7RrWJnsxOf0/OM+yrHG9ogLQ31Do/r57Oz2gQWPK+6q62mg==}
+
+  motion-utils@12.39.0:
+    resolution: {integrity: sha512-8nadJAJjTtqRkmRF36FoJTrywK9nnFmnPwnSMyxaOCU7GDjN9RTMJIxx9De8ErM+vpPhMccr/6fo5WciyQLnMQ==}
+
+  ms@2.1.3:
+    resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
+
+  mz@2.7.0:
+    resolution: {integrity: sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==}
+
+  nanoid@3.3.12:
+    resolution: {integrity: sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==}
+    engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
+    hasBin: true
+
+  natural-compare@1.4.0:
+    resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==}
+
+  node-exports-info@1.6.0:
+    resolution: {integrity: sha512-pyFS63ptit/P5WqUkt+UUfe+4oevH+bFeIiPPdfb0pFeYEu/1ELnJu5l+5EcTKYL5M7zaAa7S8ddywgXypqKCw==}
+    engines: {node: '>= 0.4'}
+
+  node-releases@2.0.46:
+    resolution: {integrity: sha512-GYVXHE2KnrzAfsAjl4uP++evGFCrAU1jta4ubEjIG7YWt/64Gqv66a30yKwWczVjA6j3bM4nBwH7Pk1JmDHaxQ==}
+    engines: {node: '>=18'}
+
+  normalize-path@3.0.0:
+    resolution: {integrity: sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==}
+    engines: {node: '>=0.10.0'}
+
+  object-assign@4.1.1:
+    resolution: {integrity: sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==}
+    engines: {node: '>=0.10.0'}
+
+  object-hash@3.0.0:
+    resolution: {integrity: sha512-RSn9F68PjH9HqtltsSnqYC1XXoWe9Bju5+213R98cNGttag9q9yAOTzdbsqvIa7aNm5WffBZFpWYr2aWrklWAw==}
+    engines: {node: '>= 6'}
+
+  object-inspect@1.13.4:
+    resolution: {integrity: sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==}
+    engines: {node: '>= 0.4'}
+
+  object-keys@1.1.1:
+    resolution: {integrity: sha512-NuAESUOUMrlIXOfHKzD6bpPu3tYt3xvjNdRIQ+FeT0lNb4K8WR70CaDxhuNguS2XG+GjkyMwOzsN5ZktImfhLA==}
+    engines: {node: '>= 0.4'}
+
+  object.assign@4.1.7:
+    resolution: {integrity: sha512-nK28WOo+QIjBkDduTINE4JkF/UJJKyf2EJxvJKfblDpyg0Q+pkOHNTL0Qwy6NP6FhE/EnzV73BxxqcJaXY9anw==}
+    engines: {node: '>= 0.4'}
+
+  object.entries@1.1.9:
+    resolution: {integrity: sha512-8u/hfXFRBD1O0hPUjioLhoWFHRmt6tKA4/vZPyckBr18l1KE9uHrFaFaUi8MDRTpi4uak2goyPTSNJLXX2k2Hw==}
+    engines: {node: '>= 0.4'}
+
+  object.fromentries@2.0.8:
+    resolution: {integrity: sha512-k6E21FzySsSK5a21KRADBd/NGneRegFO5pLHfdQLpRDETUNJueLXs3WCzyQ3tFRDYgbq3KHGXfTbi2bs8WQ6rQ==}
+    engines: {node: '>= 0.4'}
+
+  object.values@1.2.1:
+    resolution: {integrity: sha512-gXah6aZrcUxjWg2zR2MwouP2eHlCBzdV4pygudehaKXSGW4v2AsRQUK+lwwXhii6KFZcunEnmSUoYp5CXibxtA==}
+    engines: {node: '>= 0.4'}
+
+  optionator@0.9.4:
+    resolution: {integrity: sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==}
+    engines: {node: '>= 0.8.0'}
+
+  own-keys@1.0.1:
+    resolution: {integrity: sha512-qFOyK5PjiWZd+QQIh+1jhdb9LpxTF0qs7Pm8o5QHYZ0M3vKqSqzsZaEB6oWlxZ+q2sJBMI/Ktgd2N5ZwQoRHfg==}
+    engines: {node: '>= 0.4'}
+
+  p-limit@3.1.0:
+    resolution: {integrity: sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==}
+    engines: {node: '>=10'}
+
+  p-locate@5.0.0:
+    resolution: {integrity: sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==}
+    engines: {node: '>=10'}
+
+  parent-module@1.0.1:
+    resolution: {integrity: sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==}
+    engines: {node: '>=6'}
+
+  path-exists@4.0.0:
+    resolution: {integrity: sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==}
+    engines: {node: '>=8'}
+
+  path-key@3.1.1:
+    resolution: {integrity: sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==}
+    engines: {node: '>=8'}
+
+  path-parse@1.0.7:
+    resolution: {integrity: sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==}
+
+  picocolors@1.1.1:
+    resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
+
+  picomatch@2.3.2:
+    resolution: {integrity: sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==}
+    engines: {node: '>=8.6'}
+
+  picomatch@4.0.4:
+    resolution: {integrity: sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==}
+    engines: {node: '>=12'}
+
+  pify@2.3.0:
+    resolution: {integrity: sha512-udgsAY+fTnvv7kI7aaxbqwWNb0AHiB0qBO89PZKPkoTmGOgdbrHDKD+0B2X4uTfJ/FT1R09r9gTsjUjNJotuog==}
+    engines: {node: '>=0.10.0'}
+
+  pirates@4.0.7:
+    resolution: {integrity: sha512-TfySrs/5nm8fQJDcBDuUng3VOUKsd7S+zqvbOTiGXHfxX4wK31ard+hoNuvkicM/2YFzlpDgABOevKSsB4G/FA==}
+    engines: {node: '>= 6'}
+
+  possible-typed-array-names@1.1.0:
+    resolution: {integrity: sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg==}
+    engines: {node: '>= 0.4'}
+
+  postcss-import@15.1.0:
+    resolution: {integrity: sha512-hpr+J05B2FVYUAXHeK1YyI267J/dDDhMU6B6civm8hSY1jYJnBXxzKDKDswzJmtLHryrjhnDjqqp/49t8FALew==}
+    engines: {node: '>=14.0.0'}
+    peerDependencies:
+      postcss: ^8.0.0
+
+  postcss-js@4.1.0:
+    resolution: {integrity: sha512-oIAOTqgIo7q2EOwbhb8UalYePMvYoIeRY2YKntdpFQXNosSu3vLrniGgmH9OKs/qAkfoj5oB3le/7mINW1LCfw==}
+    engines: {node: ^12 || ^14 || >= 16}
+    peerDependencies:
+      postcss: ^8.4.21
+
+  postcss-load-config@6.0.1:
+    resolution: {integrity: sha512-oPtTM4oerL+UXmx+93ytZVN82RrlY/wPUV8IeDxFrzIjXOLF1pN+EmKPLbubvKHT2HC20xXsCAH2Z+CKV6Oz/g==}
+    engines: {node: '>= 18'}
+    peerDependencies:
+      jiti: '>=1.21.0'
+      postcss: '>=8.0.9'
+      tsx: ^4.8.1
+      yaml: ^2.4.2
+    peerDependenciesMeta:
+      jiti:
+        optional: true
+      postcss:
+        optional: true
+      tsx:
+        optional: true
+      yaml:
+        optional: true
+
+  postcss-nested@6.2.0:
+    resolution: {integrity: sha512-HQbt28KulC5AJzG+cZtj9kvKB93CFCdLvog1WFLf1D+xmMvPGlBstkpTEZfK5+AN9hfJocyBFCNiqyS48bpgzQ==}
+    engines: {node: '>=12.0'}
+    peerDependencies:
+      postcss: ^8.2.14
+
+  postcss-selector-parser@6.1.2:
+    resolution: {integrity: sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==}
+    engines: {node: '>=4'}
+
+  postcss-value-parser@4.2.0:
+    resolution: {integrity: sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==}
+
+  postcss@8.5.15:
+    resolution: {integrity: sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==}
+    engines: {node: ^10 || ^12 || >=14}
+
+  prelude-ls@1.2.1:
+    resolution: {integrity: sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==}
+    engines: {node: '>= 0.8.0'}
+
+  prettier-plugin-tailwindcss@0.8.0:
+    resolution: {integrity: sha512-V8ITGH87yuBDF6JpEZTOVlUz/saAwqb8f3HRgUj8Lh+tGCcrmorhsLpYqzygwFwK0PE2Ib6Mv3M7T/uE2tZV1g==}
+    engines: {node: '>=20.19'}
+    peerDependencies:
+      '@ianvs/prettier-plugin-sort-imports': '*'
+      '@prettier/plugin-hermes': '*'
+      '@prettier/plugin-oxc': '*'
+      '@prettier/plugin-pug': '*'
+      '@shopify/prettier-plugin-liquid': '*'
+      '@trivago/prettier-plugin-sort-imports': '*'
+      '@zackad/prettier-plugin-twig': '*'
+      prettier: ^3.0
+      prettier-plugin-astro: '*'
+      prettier-plugin-css-order: '*'
+      prettier-plugin-jsdoc: '*'
+      prettier-plugin-marko: '*'
+      prettier-plugin-multiline-arrays: '*'
+      prettier-plugin-organize-attributes: '*'
+      prettier-plugin-organize-imports: '*'
+      prettier-plugin-sort-imports: '*'
+      prettier-plugin-svelte: '*'
+    peerDependenciesMeta:
+      '@ianvs/prettier-plugin-sort-imports':
+        optional: true
+      '@prettier/plugin-hermes':
+        optional: true
+      '@prettier/plugin-oxc':
+        optional: true
+      '@prettier/plugin-pug':
+        optional: true
+      '@shopify/prettier-plugin-liquid':
+        optional: true
+      '@trivago/prettier-plugin-sort-imports':
+        optional: true
+      '@zackad/prettier-plugin-twig':
+        optional: true
+      prettier-plugin-astro:
+        optional: true
+      prettier-plugin-css-order:
+        optional: true
+      prettier-plugin-jsdoc:
+        optional: true
+      prettier-plugin-marko:
+        optional: true
+      prettier-plugin-multiline-arrays:
+        optional: true
+      prettier-plugin-organize-attributes:
+        optional: true
+      prettier-plugin-organize-imports:
+        optional: true
+      prettier-plugin-sort-imports:
+        optional: true
+      prettier-plugin-svelte:
+        optional: true
+
+  prettier@3.8.3:
+    resolution: {integrity: sha512-7igPTM53cGHMW8xWuVTydi2KO233VFiTNyF5hLJqpilHfmn8C8gPf+PS7dUT64YcXFbiMGZxS9pCSxL/Dxm/Jw==}
+    engines: {node: '>=14'}
+    hasBin: true
+
+  prop-types@15.8.1:
+    resolution: {integrity: sha512-oj87CgZICdulUohogVAR7AjlC0327U4el4L6eAvOqCeudMDVU0NThNaV+b9Df4dXgSP1gXMTnPdhfe/2qDH5cg==}
+
+  punycode@2.3.1:
+    resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==}
+    engines: {node: '>=6'}
+
+  queue-microtask@1.2.3:
+    resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==}
+
+  react-dom@18.3.1:
+    resolution: {integrity: sha512-5m4nQKp+rZRb09LNH59GM4BxTh9251/ylbKIbpe7TpGxfJ+9kv6BLkLBXIjjspbgbnIBNqlI23tRnTWT0snUIw==}
+    peerDependencies:
+      react: ^18.3.1
+
+  react-i18next@17.0.8:
+    resolution: {integrity: sha512-0ooKbGLU8JXhe1zwpQUWIeXSgLPOfwJmgheWRIUpcoA0CpyabpGhayjdG+/eA5esC1AQ8h2jWpXjJfzQzeDOCw==}
+    peerDependencies:
+      i18next: '>= 26.2.0'
+      react: '>= 16.8.0'
+      react-dom: '*'
+      react-native: '*'
+      typescript: ^5 || ^6
+    peerDependenciesMeta:
+      react-dom:
+        optional: true
+      react-native:
+        optional: true
+      typescript:
+        optional: true
+
+  react-is@16.13.1:
+    resolution: {integrity: sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ==}
+
+  react-loading-skeleton@3.5.0:
+    resolution: {integrity: sha512-gxxSyLbrEAdXTKgfbpBEFZCO/P153DnqSCQau2+o6lNy1jgMRr2MmRmOzMmyrwSaSYLRB8g7b0waYPmUjz7IhQ==}
+    peerDependencies:
+      react: '>=16.8.0'
+
+  react-refresh@0.17.0:
+    resolution: {integrity: sha512-z6F7K9bV85EfseRCp2bzrpyQ0Gkw1uLoCel9XBVWPg/TjRj94SkJzUTGfOa4bs7iJvBWtQG0Wq7wnI0syw3EBQ==}
+    engines: {node: '>=0.10.0'}
+
+  react-remove-scroll-bar@2.3.8:
+    resolution: {integrity: sha512-9r+yi9+mgU33AKcj6IbT9oRCO78WriSj6t/cF8DWBZJ9aOGPOTEDvdUDz1FwKim7QXWwmHqtdHnRJfhAxEG46Q==}
+    engines: {node: '>=10'}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  react-remove-scroll@2.7.2:
+    resolution: {integrity: sha512-Iqb9NjCCTt6Hf+vOdNIZGdTiH1QSqr27H/Ek9sv/a97gfueI/5h1s3yRi1nngzMUaOOToin5dI1dXKdXiF+u0Q==}
+    engines: {node: '>=10'}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  react-router-dom@7.15.1:
+    resolution: {integrity: sha512-AzF62gjY6U9rkMq4RfP/r2EVtQ7DMfNMjyOp/flLTCrtRylLiK4wT4pSq6O8rOXZ2eXdZYJPEYe+ifomiv+Igg==}
+    engines: {node: '>=20.0.0'}
+    peerDependencies:
+      react: '>=18'
+      react-dom: '>=18'
+
+  react-router@7.15.1:
+    resolution: {integrity: sha512-R8rl9HhgikFYoPJymnUtPXWbnDb3oget6lQnfIoupbt61aT9aOhRkDsY2XRhZRyX1Z/8a5sL74fXmFNm3NRK5A==}
+    engines: {node: '>=20.0.0'}
+    peerDependencies:
+      react: '>=18'
+      react-dom: '>=18'
+    peerDependenciesMeta:
+      react-dom:
+        optional: true
+
+  react-style-singleton@2.2.3:
+    resolution: {integrity: sha512-b6jSvxvVnyptAiLjbkWLE/lOnR4lfTtDAl+eUC7RZy+QQWc6wRzIV2CE6xBuMmDxc2qIihtDCZD5NPOFl7fRBQ==}
+    engines: {node: '>=10'}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  react-virtuoso@4.18.7:
+    resolution: {integrity: sha512-xNF5zDGEEIMB7cKwcen/pLig0YDf6OnfFrVgKFa7sHPf9fRem0CaLshyObbBcP88jzn0enavL39EgplgdyT21g==}
+    peerDependencies:
+      react: '>=16 || >=17 || >= 18 || >= 19'
+      react-dom: '>=16 || >=17 || >= 18 || >=19'
+
+  react@18.3.1:
+    resolution: {integrity: sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ==}
+    engines: {node: '>=0.10.0'}
+
+  read-cache@1.0.0:
+    resolution: {integrity: sha512-Owdv/Ft7IjOgm/i0xvNDZ1LrRANRfew4b2prF3OWMQLxLfu3bS8FVhCsrSCMK4lR56Y9ya+AThoTpDCTxCmpRA==}
+
+  readdirp@3.6.0:
+    resolution: {integrity: sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==}
+    engines: {node: '>=8.10.0'}
+
+  reflect.getprototypeof@1.0.10:
+    resolution: {integrity: sha512-00o4I+DVrefhv+nX0ulyi3biSHCPDe+yLv5o/p6d/UVlirijB8E16FtfwSAi4g3tcqrQ4lRAqQSoFEZJehYEcw==}
+    engines: {node: '>= 0.4'}
+
+  regexp.prototype.flags@1.5.4:
+    resolution: {integrity: sha512-dYqgNSZbDwkaJ2ceRd9ojCGjBq+mOm9LmtXnAnEGyHhN/5R7iDW2TRw3h+o/jCFxus3P2LfWIIiwowAjANm7IA==}
+    engines: {node: '>= 0.4'}
+
+  resolve-from@4.0.0:
+    resolution: {integrity: sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==}
+    engines: {node: '>=4'}
+
+  resolve@1.22.12:
+    resolution: {integrity: sha512-TyeJ1zif53BPfHootBGwPRYT1RUt6oGWsaQr8UyZW/eAm9bKoijtvruSDEmZHm92CwS9nj7/fWttqPCgzep8CA==}
+    engines: {node: '>= 0.4'}
+    hasBin: true
+
+  resolve@2.0.0-next.7:
+    resolution: {integrity: sha512-tqt+NBWwyaMgw3zDsnygx4CByWjQEJHOPMdslYhppaQSJUtL/D4JO9CcBBlhPoI8lz9oJIDXkwXfhF4aWqP8xQ==}
+    engines: {node: '>= 0.4'}
+    hasBin: true
+
+  reusify@1.1.0:
+    resolution: {integrity: sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==}
+    engines: {iojs: '>=1.0.0', node: '>=0.10.0'}
+
+  rollup@4.60.4:
+    resolution: {integrity: sha512-WHeFSbZYsPu3+bLoNRUuAO+wavNlocOPf3wSHTP7hcFKVnJeWsYlCDbr3mTS14FCizf9ccIxXA8sGL8zKeQN3g==}
+    engines: {node: '>=18.0.0', npm: '>=8.0.0'}
+    hasBin: true
+
+  run-parallel@1.2.0:
+    resolution: {integrity: sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==}
+
+  safe-array-concat@1.1.4:
+    resolution: {integrity: sha512-wtZlHyOje6OZTGqAoaDKxFkgRtkF9CnHAVnCHKfuj200wAgL+bSJhdsCD2l0Qx/2ekEXjPWcyKkfGb5CPboslg==}
+    engines: {node: '>=0.4'}
+
+  safe-push-apply@1.0.0:
+    resolution: {integrity: sha512-iKE9w/Z7xCzUMIZqdBsp6pEQvwuEebH4vdpjcDWnyzaI6yl6O9FHvVpmGelvEHNsoY6wGblkxR6Zty/h00WiSA==}
+    engines: {node: '>= 0.4'}
+
+  safe-regex-test@1.1.0:
+    resolution: {integrity: sha512-x/+Cz4YrimQxQccJf5mKEbIa1NzeCRNI5Ecl/ekmlYaampdNLPalVyIcCZNNH3MvmqBugV5TMYZXv0ljslUlaw==}
+    engines: {node: '>= 0.4'}
+
+  scheduler@0.23.2:
+    resolution: {integrity: sha512-UOShsPwz7NrMUqhR6t0hWjFduvOzbtv7toDH1/hIrfRNIDBnnBWd0CwJTGvTpngVlmwGCdP9/Zl/tVrDqcuYzQ==}
+
+  semver@6.3.1:
+    resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==}
+    hasBin: true
+
+  semver@7.8.4:
+    resolution: {integrity: sha512-rUCObTnP32Q08R2uuIrt7r9PlEonuTmtuXYcW6s5kjdlj3xbnwe+21yXptAUYcMAABLkYYTtnmzb3w3EDZfueA==}
+    engines: {node: '>=10'}
+    hasBin: true
+
+  set-cookie-parser@2.7.2:
+    resolution: {integrity: sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw==}
+
+  set-function-length@1.2.2:
+    resolution: {integrity: sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg==}
+    engines: {node: '>= 0.4'}
+
+  set-function-name@2.0.2:
+    resolution: {integrity: sha512-7PGFlmtwsEADb0WYyvCMa1t+yke6daIG4Wirafur5kcf+MhUnPms1UeR0CKQdTZD81yESwMHbtn+TR+dMviakQ==}
+    engines: {node: '>= 0.4'}
+
+  set-proto@1.0.0:
+    resolution: {integrity: sha512-RJRdvCo6IAnPdsvP/7m6bsQqNnn1FCBX5ZNtFL98MmFF/4xAIJTIg1YbHW5DC2W5SKZanrC6i4HsJqlajw/dZw==}
+    engines: {node: '>= 0.4'}
+
+  shebang-command@2.0.0:
+    resolution: {integrity: sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==}
+    engines: {node: '>=8'}
+
+  shebang-regex@3.0.0:
+    resolution: {integrity: sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==}
+    engines: {node: '>=8'}
+
+  side-channel-list@1.0.1:
+    resolution: {integrity: sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==}
+    engines: {node: '>= 0.4'}
+
+  side-channel-map@1.0.1:
+    resolution: {integrity: sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==}
+    engines: {node: '>= 0.4'}
+
+  side-channel-weakmap@1.0.2:
+    resolution: {integrity: sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==}
+    engines: {node: '>= 0.4'}
+
+  side-channel@1.1.1:
+    resolution: {integrity: sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==}
+    engines: {node: '>= 0.4'}
+
+  source-map-js@1.2.1:
+    resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==}
+    engines: {node: '>=0.10.0'}
+
+  stop-iteration-iterator@1.1.0:
+    resolution: {integrity: sha512-eLoXW/DHyl62zxY4SCaIgnRhuMr6ri4juEYARS8E6sCEqzKpOiE521Ucofdx+KnDZl5xmvGYaaKCk5FEOxJCoQ==}
+    engines: {node: '>= 0.4'}
+
+  string.prototype.includes@2.0.1:
+    resolution: {integrity: sha512-o7+c9bW6zpAdJHTtujeePODAhkuicdAryFsfVKwA+wGw89wJ4GTY484WTucM9hLtDEOpOvI+aHnzqnC5lHp4Rg==}
+    engines: {node: '>= 0.4'}
+
+  string.prototype.matchall@4.0.12:
+    resolution: {integrity: sha512-6CC9uyBL+/48dYizRf7H7VAYCMCNTBeM78x/VTUe9bFEaxBepPJDa1Ow99LqI/1yF7kuy7Q3cQsYMrcjGUcskA==}
+    engines: {node: '>= 0.4'}
+
+  string.prototype.repeat@1.0.0:
+    resolution: {integrity: sha512-0u/TldDbKD8bFCQ/4f5+mNRrXwZ8hg2w7ZR8wa16e8z9XpePWl3eGEcUD0OXpEH/VJH/2G3gjUtR3ZOiBe2S/w==}
+
+  string.prototype.trim@1.2.11:
+    resolution: {integrity: sha512-PwvK7BU+CMTJGYQCTZb5RWXIML92lftJLhQz1tBzgKiqGxJaMlBAa48POXaNAC2s4y8jr3EFqrkF9+44neS46w==}
+    engines: {node: '>= 0.4'}
+
+  string.prototype.trimend@1.0.10:
+    resolution: {integrity: sha512-2+3aDAOmPTmuFwjDnmJG2ctEkQKVki7vOSqaxkv42Mowj1V6PnvuwFCRrR5lChUux1TBskPjfkeTOhqczDMxTw==}
+    engines: {node: '>= 0.4'}
+
+  string.prototype.trimstart@1.0.8:
+    resolution: {integrity: sha512-UXSH262CSZY1tfu3G3Secr6uGLCFVPMhIqHjlgCUtCCcgihYc/xKs9djMTMUOb2j1mVSeU8EU6NWc/iQKU6Gfg==}
+    engines: {node: '>= 0.4'}
+
+  strip-json-comments@3.1.1:
+    resolution: {integrity: sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==}
+    engines: {node: '>=8'}
+
+  sucrase@3.35.1:
+    resolution: {integrity: sha512-DhuTmvZWux4H1UOnWMB3sk0sbaCVOoQZjv8u1rDoTV0HTdGem9hkAZtl4JZy8P2z4Bg0nT+YMeOFyVr4zcG5Tw==}
+    engines: {node: '>=16 || 14 >=14.17'}
+    hasBin: true
+
+  supports-color@7.2.0:
+    resolution: {integrity: sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==}
+    engines: {node: '>=8'}
+
+  supports-preserve-symlinks-flag@1.0.0:
+    resolution: {integrity: sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==}
+    engines: {node: '>= 0.4'}
+
+  tailwind-merge@2.6.1:
+    resolution: {integrity: sha512-Oo6tHdpZsGpkKG88HJ8RR1rg/RdnEkQEfMoEk2x1XRI3F1AxeU+ijRXpiVUF4UbLfcxxRGw6TbUINKYdWVsQTQ==}
+
+  tailwindcss-animate@1.0.7:
+    resolution: {integrity: sha512-bl6mpH3T7I3UFxuvDEXLxy/VuFxBk5bbzplh7tXI68mwMokNYd1t9qPBHlnyTwfa4JGC4zP516I1hYYtQ/vspA==}
+    peerDependencies:
+      tailwindcss: '>=3.0.0 || insiders'
+
+  tailwindcss@3.4.19:
+    resolution: {integrity: sha512-3ofp+LL8E+pK/JuPLPggVAIaEuhvIz4qNcf3nA1Xn2o/7fb7s/TYpHhwGDv1ZU3PkBluUVaF8PyCHcm48cKLWQ==}
+    engines: {node: '>=14.0.0'}
+    hasBin: true
+
+  thenify-all@1.6.0:
+    resolution: {integrity: sha512-RNxQH/qI8/t3thXJDwcstUO4zeqo64+Uy/+sNVRBx4Xn2OX+OZ9oP+iJnNFqplFra2ZUVeKCSa2oVWi3T4uVmA==}
+    engines: {node: '>=0.8'}
+
+  thenify@3.3.1:
+    resolution: {integrity: sha512-RVZSIV5IG10Hk3enotrhvz0T9em6cyHBLkH/YAZuKqd8hRkKhSfCGIcP2KUY0EPxndzANBmNllzWPwak+bheSw==}
+
+  tinyglobby@0.2.16:
+    resolution: {integrity: sha512-pn99VhoACYR8nFHhxqix+uvsbXineAasWm5ojXoN8xEwK5Kd3/TrhNn1wByuD52UxWRLy8pu+kRMniEi6Eq9Zg==}
+    engines: {node: '>=12.0.0'}
+
+  to-regex-range@5.0.1:
+    resolution: {integrity: sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==}
+    engines: {node: '>=8.0'}
+
+  ts-api-utils@2.5.0:
+    resolution: {integrity: sha512-OJ/ibxhPlqrMM0UiNHJ/0CKQkoKF243/AEmplt3qpRgkW8VG7IfOS41h7V8TjITqdByHzrjcS/2si+y4lIh8NA==}
+    engines: {node: '>=18.12'}
+    peerDependencies:
+      typescript: '>=4.8.4'
+
+  ts-interface-checker@0.1.13:
+    resolution: {integrity: sha512-Y/arvbn+rrz3JCKl9C4kVNfTfSm2/mEp5FSz5EsZSANGPSlQrpRI5M4PKF+mJnE52jOO90PnPSc3Ur3bTQw0gA==}
+
+  tslib@2.8.1:
+    resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}
+
+  type-check@0.4.0:
+    resolution: {integrity: sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==}
+    engines: {node: '>= 0.8.0'}
+
+  typed-array-buffer@1.0.3:
+    resolution: {integrity: sha512-nAYYwfY3qnzX30IkA6AQZjVbtK6duGontcQm1WSG1MD94YLqK0515GNApXkoxKOWMusVssAHWLh9SeaoefYFGw==}
+    engines: {node: '>= 0.4'}
+
+  typed-array-byte-length@1.0.3:
+    resolution: {integrity: sha512-BaXgOuIxz8n8pIq3e7Atg/7s+DpiYrxn4vdot3w9KbnBhcRQq6o3xemQdIfynqSeXeDrF32x+WvfzmOjPiY9lg==}
+    engines: {node: '>= 0.4'}
+
+  typed-array-byte-offset@1.0.4:
+    resolution: {integrity: sha512-bTlAFB/FBYMcuX81gbL4OcpH5PmlFHqlCCpAl8AlEzMz5k53oNDvN8p1PNOWLEmI2x4orp3raOFB51tv9X+MFQ==}
+    engines: {node: '>= 0.4'}
+
+  typed-array-length@1.0.8:
+    resolution: {integrity: sha512-phPGCwqr2+Qo0fwniCE8e4pKnGu/yFb5nD5Y8bf0EEeiI5GklnACYA9GFy/DrAeRrKHXvHn+1SUsOWgJp6RO+g==}
+    engines: {node: '>= 0.4'}
+
+  typescript-eslint@8.61.1:
+    resolution: {integrity: sha512-V7PayAfJokV3pEHgN7/v03D1SpujhRfQtYLbLIiBfDDncdg4PAiRBfoS4cnCANK4jmAPncczi59QO3afiXUlNw==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
+      typescript: '>=4.8.4 <6.1.0'
+
+  typescript@5.9.3:
+    resolution: {integrity: sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==}
+    engines: {node: '>=14.17'}
+    hasBin: true
+
+  unbox-primitive@1.1.0:
+    resolution: {integrity: sha512-nWJ91DjeOkej/TA8pXQ3myruKpKEYgqvpw9lz4OPHj/NWFNluYrjbz9j01CJ8yKQd2g4jFoOkINCTW2I5LEEyw==}
+    engines: {node: '>= 0.4'}
+
+  undici-types@7.24.6:
+    resolution: {integrity: sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==}
+
+  update-browserslist-db@1.2.3:
+    resolution: {integrity: sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==}
+    hasBin: true
+    peerDependencies:
+      browserslist: '>= 4.21.0'
+
+  uri-js@4.4.1:
+    resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==}
+
+  use-callback-ref@1.3.3:
+    resolution: {integrity: sha512-jQL3lRnocaFtu3V00JToYz/4QkNWswxijDaCVNZRiRTO3HQDLsdu1ZtmIUvV4yPp+rvWm5j0y0TG/S61cuijTg==}
+    engines: {node: '>=10'}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  use-sidecar@1.1.3:
+    resolution: {integrity: sha512-Fedw0aZvkhynoPYlA5WXrMCAMm+nSWdZt6lzJQ7Ok8S6Q+VsHmHpRWndVRJ8Be0ZbkfPc5LRYH+5XrzXcEeLRQ==}
+    engines: {node: '>=10'}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  use-sync-external-store@1.6.0:
+    resolution: {integrity: sha512-Pp6GSwGP/NrPIrxVFAIkOQeyw8lFenOHijQWkUTrDvrF4ALqylP2C/KCkeS9dpUM3KvYRQhna5vt7IL95+ZQ9w==}
+    peerDependencies:
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+
+  util-deprecate@1.0.2:
+    resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==}
+
+  vite@6.4.2:
+    resolution: {integrity: sha512-2N/55r4JDJ4gdrCvGgINMy+HH3iRpNIz8K6SFwVsA+JbQScLiC+clmAxBgwiSPgcG9U15QmvqCGWzMbqda5zGQ==}
+    engines: {node: ^18.0.0 || ^20.0.0 || >=22.0.0}
+    hasBin: true
+    peerDependencies:
+      '@types/node': ^18.0.0 || ^20.0.0 || >=22.0.0
+      jiti: '>=1.21.0'
+      less: '*'
+      lightningcss: ^1.21.0
+      sass: '*'
+      sass-embedded: '*'
+      stylus: '*'
+      sugarss: '*'
+      terser: ^5.16.0
+      tsx: ^4.8.1
+      yaml: ^2.4.2
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+      jiti:
+        optional: true
+      less:
+        optional: true
+      lightningcss:
+        optional: true
+      sass:
+        optional: true
+      sass-embedded:
+        optional: true
+      stylus:
+        optional: true
+      sugarss:
+        optional: true
+      terser:
+        optional: true
+      tsx:
+        optional: true
+      yaml:
+        optional: true
+
+  void-elements@3.1.0:
+    resolution: {integrity: sha512-Dhxzh5HZuiHQhbvTW9AMetFfBHDMYpo23Uo9btPXgdYP+3T5S+p+jgNy7spra+veYhBP2dCSgxR/i2Y02h5/6w==}
+    engines: {node: '>=0.10.0'}
+
+  which-boxed-primitive@1.1.1:
+    resolution: {integrity: sha512-TbX3mj8n0odCBFVlY8AxkqcHASw3L60jIuF8jFP78az3C2YhmGvqbHBpAjTRH2/xqYunrJ9g1jSyjCjpoWzIAA==}
+    engines: {node: '>= 0.4'}
+
+  which-builtin-type@1.2.1:
+    resolution: {integrity: sha512-6iBczoX+kDQ7a3+YJBnh3T+KZRxM/iYNPXicqk66/Qfm1b93iu+yOImkg0zHbj5LNOcNv1TEADiZ0xa34B4q6Q==}
+    engines: {node: '>= 0.4'}
+
+  which-collection@1.0.2:
+    resolution: {integrity: sha512-K4jVyjnBdgvc86Y6BkaLZEN933SwYOuBFkdmBu9ZfkcAbdVbpITnDmjvZ/aQjRXQrv5EPkTnD1s39GiiqbngCw==}
+    engines: {node: '>= 0.4'}
+
+  which-typed-array@1.1.22:
+    resolution: {integrity: sha512-fvO4ExWMFsqyhG3AiPAObMuY1lxaqgYcxbc49CNdWDDECOJNgQyvsOWVwbZc+qf3rzRtxojBK+CMEv0Ld5CYpw==}
+    engines: {node: '>= 0.4'}
+
+  which@2.0.2:
+    resolution: {integrity: sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==}
+    engines: {node: '>= 8'}
+    hasBin: true
+
+  word-wrap@1.2.5:
+    resolution: {integrity: sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==}
+    engines: {node: '>=0.10.0'}
+
+  yallist@3.1.1:
+    resolution: {integrity: sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==}
+
+  yocto-queue@0.1.0:
+    resolution: {integrity: sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==}
+    engines: {node: '>=10'}
+
+  zod-validation-error@4.0.2:
+    resolution: {integrity: sha512-Q6/nZLe6jxuU80qb/4uJ4t5v2VEZ44lzQjPDhYJNztRQ4wyWc6VF3D3Kb/fAuPetZQnhS3hnajCf9CsWesghLQ==}
+    engines: {node: '>=18.0.0'}
+    peerDependencies:
+      zod: ^3.25.0 || ^4.0.0
+
+  zod@4.4.3:
+    resolution: {integrity: sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==}
+
+snapshots:
+
+  '@alloc/quick-lru@5.2.0': {}
+
+  '@babel/code-frame@7.29.7':
+    dependencies:
+      '@babel/helper-validator-identifier': 7.29.7
+      js-tokens: 4.0.0
+      picocolors: 1.1.1
+
+  '@babel/compat-data@7.29.7': {}
+
+  '@babel/core@7.29.7':
+    dependencies:
+      '@babel/code-frame': 7.29.7
+      '@babel/generator': 7.29.7
+      '@babel/helper-compilation-targets': 7.29.7
+      '@babel/helper-module-transforms': 7.29.7(@babel/core@7.29.7)
+      '@babel/helpers': 7.29.7
+      '@babel/parser': 7.29.7
+      '@babel/template': 7.29.7
+      '@babel/traverse': 7.29.7
+      '@babel/types': 7.29.7
+      '@jridgewell/remapping': 2.3.5
+      convert-source-map: 2.0.0
+      debug: 4.4.3
+      gensync: 1.0.0-beta.2
+      json5: 2.2.3
+      semver: 6.3.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/generator@7.29.7':
+    dependencies:
+      '@babel/parser': 7.29.7
+      '@babel/types': 7.29.7
+      '@jridgewell/gen-mapping': 0.3.13
+      '@jridgewell/trace-mapping': 0.3.31
+      jsesc: 3.1.0
+
+  '@babel/helper-compilation-targets@7.29.7':
+    dependencies:
+      '@babel/compat-data': 7.29.7
+      '@babel/helper-validator-option': 7.29.7
+      browserslist: 4.28.2
+      lru-cache: 5.1.1
+      semver: 6.3.1
+
+  '@babel/helper-globals@7.29.7': {}
+
+  '@babel/helper-module-imports@7.29.7':
+    dependencies:
+      '@babel/traverse': 7.29.7
+      '@babel/types': 7.29.7
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/helper-module-transforms@7.29.7(@babel/core@7.29.7)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/helper-module-imports': 7.29.7
+      '@babel/helper-validator-identifier': 7.29.7
+      '@babel/traverse': 7.29.7
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/helper-plugin-utils@7.29.7': {}
+
+  '@babel/helper-string-parser@7.29.7': {}
+
+  '@babel/helper-validator-identifier@7.29.7': {}
+
+  '@babel/helper-validator-option@7.29.7': {}
+
+  '@babel/helpers@7.29.7':
+    dependencies:
+      '@babel/template': 7.29.7
+      '@babel/types': 7.29.7
+
+  '@babel/parser@7.29.7':
+    dependencies:
+      '@babel/types': 7.29.7
+
+  '@babel/plugin-transform-react-jsx-self@7.29.7(@babel/core@7.29.7)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/helper-plugin-utils': 7.29.7
+
+  '@babel/plugin-transform-react-jsx-source@7.29.7(@babel/core@7.29.7)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/helper-plugin-utils': 7.29.7
+
+  '@babel/runtime@7.29.7': {}
+
+  '@babel/template@7.29.7':
+    dependencies:
+      '@babel/code-frame': 7.29.7
+      '@babel/parser': 7.29.7
+      '@babel/types': 7.29.7
+
+  '@babel/traverse@7.29.7':
+    dependencies:
+      '@babel/code-frame': 7.29.7
+      '@babel/generator': 7.29.7
+      '@babel/helper-globals': 7.29.7
+      '@babel/parser': 7.29.7
+      '@babel/template': 7.29.7
+      '@babel/types': 7.29.7
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/types@7.29.7':
+    dependencies:
+      '@babel/helper-string-parser': 7.29.7
+      '@babel/helper-validator-identifier': 7.29.7
+
+  '@esbuild/aix-ppc64@0.25.12':
+    optional: true
+
+  '@esbuild/android-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/android-arm@0.25.12':
+    optional: true
+
+  '@esbuild/android-x64@0.25.12':
+    optional: true
+
+  '@esbuild/darwin-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/darwin-x64@0.25.12':
+    optional: true
+
+  '@esbuild/freebsd-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/freebsd-x64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-arm@0.25.12':
+    optional: true
+
+  '@esbuild/linux-ia32@0.25.12':
+    optional: true
+
+  '@esbuild/linux-loong64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-mips64el@0.25.12':
+    optional: true
+
+  '@esbuild/linux-ppc64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-riscv64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-s390x@0.25.12':
+    optional: true
+
+  '@esbuild/linux-x64@0.25.12':
+    optional: true
+
+  '@esbuild/netbsd-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/netbsd-x64@0.25.12':
+    optional: true
+
+  '@esbuild/openbsd-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/openbsd-x64@0.25.12':
+    optional: true
+
+  '@esbuild/openharmony-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/sunos-x64@0.25.12':
+    optional: true
+
+  '@esbuild/win32-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/win32-ia32@0.25.12':
+    optional: true
+
+  '@esbuild/win32-x64@0.25.12':
+    optional: true
+
+  '@eslint-community/eslint-utils@4.9.1(eslint@9.39.4(jiti@1.21.7))':
+    dependencies:
+      eslint: 9.39.4(jiti@1.21.7)
+      eslint-visitor-keys: 3.4.3
+
+  '@eslint-community/regexpp@4.12.2': {}
+
+  '@eslint/config-array@0.21.2':
+    dependencies:
+      '@eslint/object-schema': 2.1.7
+      debug: 4.4.3
+      minimatch: 3.1.5
+    transitivePeerDependencies:
+      - supports-color
+
+  '@eslint/config-helpers@0.4.2':
+    dependencies:
+      '@eslint/core': 0.17.0
+
+  '@eslint/core@0.17.0':
+    dependencies:
+      '@types/json-schema': 7.0.15
+
+  '@eslint/eslintrc@3.3.5':
+    dependencies:
+      ajv: 6.15.0
+      debug: 4.4.3
+      espree: 10.4.0
+      globals: 14.0.0
+      ignore: 5.3.2
+      import-fresh: 3.3.1
+      js-yaml: 4.2.0
+      minimatch: 3.1.5
+      strip-json-comments: 3.1.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@eslint/js@10.0.1(eslint@9.39.4(jiti@1.21.7))':
+    optionalDependencies:
+      eslint: 9.39.4(jiti@1.21.7)
+
+  '@eslint/js@9.39.4': {}
+
+  '@eslint/object-schema@2.1.7': {}
+
+  '@eslint/plugin-kit@0.4.1':
+    dependencies:
+      '@eslint/core': 0.17.0
+      levn: 0.4.1
+
+  '@floating-ui/core@1.7.5':
+    dependencies:
+      '@floating-ui/utils': 0.2.11
+
+  '@floating-ui/dom@1.7.6':
+    dependencies:
+      '@floating-ui/core': 1.7.5
+      '@floating-ui/utils': 0.2.11
+
+  '@floating-ui/react-dom@2.1.8(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@floating-ui/dom': 1.7.6
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+
+  '@floating-ui/utils@0.2.11': {}
+
+  '@humanfs/core@0.19.2':
+    dependencies:
+      '@humanfs/types': 0.15.0
+
+  '@humanfs/node@0.16.8':
+    dependencies:
+      '@humanfs/core': 0.19.2
+      '@humanfs/types': 0.15.0
+      '@humanwhocodes/retry': 0.4.3
+
+  '@humanfs/types@0.15.0': {}
+
+  '@humanwhocodes/module-importer@1.0.1': {}
+
+  '@humanwhocodes/retry@0.4.3': {}
+
+  '@jridgewell/gen-mapping@0.3.13':
+    dependencies:
+      '@jridgewell/sourcemap-codec': 1.5.5
+      '@jridgewell/trace-mapping': 0.3.31
+
+  '@jridgewell/remapping@2.3.5':
+    dependencies:
+      '@jridgewell/gen-mapping': 0.3.13
+      '@jridgewell/trace-mapping': 0.3.31
+
+  '@jridgewell/resolve-uri@3.1.2': {}
+
+  '@jridgewell/sourcemap-codec@1.5.5': {}
+
+  '@jridgewell/trace-mapping@0.3.31':
+    dependencies:
+      '@jridgewell/resolve-uri': 3.1.2
+      '@jridgewell/sourcemap-codec': 1.5.5
+
+  '@nodelib/fs.scandir@2.1.5':
+    dependencies:
+      '@nodelib/fs.stat': 2.0.5
+      run-parallel: 1.2.0
+
+  '@nodelib/fs.stat@2.0.5': {}
+
+  '@nodelib/fs.walk@1.2.8':
+    dependencies:
+      '@nodelib/fs.scandir': 2.1.5
+      fastq: 1.20.1
+
+  '@radix-ui/number@1.1.1': {}
+
+  '@radix-ui/primitive@1.1.3': {}
+
+  '@radix-ui/react-arrow@1.1.7(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-collection@1.1.7(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-slot': 1.2.3(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-compose-refs@1.1.2(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-context@1.1.2(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-dialog@1.1.15(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-focus-guards': 1.1.3(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-id': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-slot': 1.2.3(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@18.3.29)(react@18.3.1)
+      aria-hidden: 1.2.6
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+      react-remove-scroll: 2.7.2(@types/react@18.3.29)(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-direction@1.1.1(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-dismissable-layer@1.1.11(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-escape-keydown': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-dropdown-menu@2.1.16(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-id': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-menu': 2.1.16(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-focus-guards@1.1.3(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-focus-scope@1.1.7(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-id@1.1.1(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-label@2.1.8(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-primitive': 2.1.4(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-menu@2.1.16(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-direction': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-focus-guards': 1.1.3(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-id': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-slot': 1.2.3(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      aria-hidden: 1.2.6
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+      react-remove-scroll: 2.7.2(@types/react@18.3.29)(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-popover@1.1.15(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-focus-guards': 1.1.3(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-id': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-slot': 1.2.3(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@18.3.29)(react@18.3.1)
+      aria-hidden: 1.2.6
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+      react-remove-scroll: 2.7.2(@types/react@18.3.29)(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-popper@1.2.8(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@floating-ui/react-dom': 2.1.8(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-arrow': 1.1.7(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-rect': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/rect': 1.1.1
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-portal@1.1.9(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-presence@1.1.5(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-primitive@2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-slot': 1.2.3(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-primitive@2.1.4(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-slot': 1.2.4(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-radio-group@1.3.8(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-direction': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-roving-focus@1.1.11(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-direction': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-id': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-scroll-area@1.2.10(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/number': 1.1.1
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-direction': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-slot@1.2.3(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-slot@1.2.4(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-switch@1.2.6(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-tabs@1.1.13(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-context': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-direction': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-id': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-tooltip@1.2.8(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-id': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-slot': 1.2.3(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-use-callback-ref@1.1.1(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-use-controllable-state@1.2.2(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-use-effect-event': 0.0.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-use-effect-event@0.0.2(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-use-escape-keydown@1.1.1(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-use-layout-effect@1.1.1(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-use-previous@1.1.1(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-use-rect@1.1.1(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      '@radix-ui/rect': 1.1.1
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-use-size@1.1.1(@types/react@18.3.29)(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      react: 18.3.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  '@radix-ui/react-visually-hidden@1.2.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/react-visually-hidden@1.2.4(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)':
+    dependencies:
+      '@radix-ui/react-primitive': 2.1.4(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+      '@types/react-dom': 18.3.7(@types/react@18.3.29)
+
+  '@radix-ui/rect@1.1.1': {}
+
+  '@rolldown/pluginutils@1.0.0-beta.27': {}
+
+  '@rollup/rollup-android-arm-eabi@4.60.4':
+    optional: true
+
+  '@rollup/rollup-android-arm64@4.60.4':
+    optional: true
+
+  '@rollup/rollup-darwin-arm64@4.60.4':
+    optional: true
+
+  '@rollup/rollup-darwin-x64@4.60.4':
+    optional: true
+
+  '@rollup/rollup-freebsd-arm64@4.60.4':
+    optional: true
+
+  '@rollup/rollup-freebsd-x64@4.60.4':
+    optional: true
+
+  '@rollup/rollup-linux-arm-gnueabihf@4.60.4':
+    optional: true
+
+  '@rollup/rollup-linux-arm-musleabihf@4.60.4':
+    optional: true
+
+  '@rollup/rollup-linux-arm64-gnu@4.60.4':
+    optional: true
+
+  '@rollup/rollup-linux-arm64-musl@4.60.4':
+    optional: true
+
+  '@rollup/rollup-linux-loong64-gnu@4.60.4':
+    optional: true
+
+  '@rollup/rollup-linux-loong64-musl@4.60.4':
+    optional: true
+
+  '@rollup/rollup-linux-ppc64-gnu@4.60.4':
+    optional: true
+
+  '@rollup/rollup-linux-ppc64-musl@4.60.4':
+    optional: true
+
+  '@rollup/rollup-linux-riscv64-gnu@4.60.4':
+    optional: true
+
+  '@rollup/rollup-linux-riscv64-musl@4.60.4':
+    optional: true
+
+  '@rollup/rollup-linux-s390x-gnu@4.60.4':
+    optional: true
+
+  '@rollup/rollup-linux-x64-gnu@4.60.4':
+    optional: true
+
+  '@rollup/rollup-linux-x64-musl@4.60.4':
+    optional: true
+
+  '@rollup/rollup-openbsd-x64@4.60.4':
+    optional: true
+
+  '@rollup/rollup-openharmony-arm64@4.60.4':
+    optional: true
+
+  '@rollup/rollup-win32-arm64-msvc@4.60.4':
+    optional: true
+
+  '@rollup/rollup-win32-ia32-msvc@4.60.4':
+    optional: true
+
+  '@rollup/rollup-win32-x64-gnu@4.60.4':
+    optional: true
+
+  '@rollup/rollup-win32-x64-msvc@4.60.4':
+    optional: true
+
+  '@types/babel__core@7.20.5':
+    dependencies:
+      '@babel/parser': 7.29.7
+      '@babel/types': 7.29.7
+      '@types/babel__generator': 7.27.0
+      '@types/babel__template': 7.4.4
+      '@types/babel__traverse': 7.28.0
+
+  '@types/babel__generator@7.27.0':
+    dependencies:
+      '@babel/types': 7.29.7
+
+  '@types/babel__template@7.4.4':
+    dependencies:
+      '@babel/parser': 7.29.7
+      '@babel/types': 7.29.7
+
+  '@types/babel__traverse@7.28.0':
+    dependencies:
+      '@babel/types': 7.29.7
+
+  '@types/estree@1.0.8': {}
+
+  '@types/json-schema@7.0.15': {}
+
+  '@types/node@25.9.1':
+    dependencies:
+      undici-types: 7.24.6
+
+  '@types/prop-types@15.7.15': {}
+
+  '@types/react-dom@18.3.7(@types/react@18.3.29)':
+    dependencies:
+      '@types/react': 18.3.29
+
+  '@types/react@18.3.29':
+    dependencies:
+      '@types/prop-types': 15.7.15
+      csstype: 3.2.3
+
+  '@typescript-eslint/eslint-plugin@8.61.1(@typescript-eslint/parser@8.61.1(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3))(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)':
+    dependencies:
+      '@eslint-community/regexpp': 4.12.2
+      '@typescript-eslint/parser': 8.61.1(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)
+      '@typescript-eslint/scope-manager': 8.61.1
+      '@typescript-eslint/type-utils': 8.61.1(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.61.1(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)
+      '@typescript-eslint/visitor-keys': 8.61.1
+      eslint: 9.39.4(jiti@1.21.7)
+      ignore: 7.0.5
+      natural-compare: 1.4.0
+      ts-api-utils: 2.5.0(typescript@5.9.3)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/parser@8.61.1(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)':
+    dependencies:
+      '@typescript-eslint/scope-manager': 8.61.1
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/typescript-estree': 8.61.1(typescript@5.9.3)
+      '@typescript-eslint/visitor-keys': 8.61.1
+      debug: 4.4.3
+      eslint: 9.39.4(jiti@1.21.7)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/project-service@8.61.1(typescript@5.9.3)':
+    dependencies:
+      '@typescript-eslint/tsconfig-utils': 8.61.1(typescript@5.9.3)
+      '@typescript-eslint/types': 8.61.1
+      debug: 4.4.3
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/scope-manager@8.61.1':
+    dependencies:
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/visitor-keys': 8.61.1
+
+  '@typescript-eslint/tsconfig-utils@8.61.1(typescript@5.9.3)':
+    dependencies:
+      typescript: 5.9.3
+
+  '@typescript-eslint/type-utils@8.61.1(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)':
+    dependencies:
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/typescript-estree': 8.61.1(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.61.1(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)
+      debug: 4.4.3
+      eslint: 9.39.4(jiti@1.21.7)
+      ts-api-utils: 2.5.0(typescript@5.9.3)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/types@8.61.1': {}
+
+  '@typescript-eslint/typescript-estree@8.61.1(typescript@5.9.3)':
+    dependencies:
+      '@typescript-eslint/project-service': 8.61.1(typescript@5.9.3)
+      '@typescript-eslint/tsconfig-utils': 8.61.1(typescript@5.9.3)
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/visitor-keys': 8.61.1
+      debug: 4.4.3
+      minimatch: 10.2.5
+      semver: 7.8.4
+      tinyglobby: 0.2.16
+      ts-api-utils: 2.5.0(typescript@5.9.3)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/utils@8.61.1(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)':
+    dependencies:
+      '@eslint-community/eslint-utils': 4.9.1(eslint@9.39.4(jiti@1.21.7))
+      '@typescript-eslint/scope-manager': 8.61.1
+      '@typescript-eslint/types': 8.61.1
+      '@typescript-eslint/typescript-estree': 8.61.1(typescript@5.9.3)
+      eslint: 9.39.4(jiti@1.21.7)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@typescript-eslint/visitor-keys@8.61.1':
+    dependencies:
+      '@typescript-eslint/types': 8.61.1
+      eslint-visitor-keys: 5.0.1
+
+  '@vitejs/plugin-react@4.7.0(vite@6.4.2(@types/node@25.9.1)(jiti@1.21.7))':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/plugin-transform-react-jsx-self': 7.29.7(@babel/core@7.29.7)
+      '@babel/plugin-transform-react-jsx-source': 7.29.7(@babel/core@7.29.7)
+      '@rolldown/pluginutils': 1.0.0-beta.27
+      '@types/babel__core': 7.20.5
+      react-refresh: 0.17.0
+      vite: 6.4.2(@types/node@25.9.1)(jiti@1.21.7)
+    transitivePeerDependencies:
+      - supports-color
+
+  '@wailsio/runtime@3.0.0-alpha.79': {}
+
+  acorn-jsx@5.3.2(acorn@8.17.0):
+    dependencies:
+      acorn: 8.17.0
+
+  acorn@8.17.0: {}
+
+  ajv@6.15.0:
+    dependencies:
+      fast-deep-equal: 3.1.3
+      fast-json-stable-stringify: 2.1.0
+      json-schema-traverse: 0.4.1
+      uri-js: 4.4.1
+
+  ansi-styles@4.3.0:
+    dependencies:
+      color-convert: 2.0.1
+
+  any-promise@1.3.0: {}
+
+  anymatch@3.1.3:
+    dependencies:
+      normalize-path: 3.0.0
+      picomatch: 2.3.2
+
+  arg@5.0.2: {}
+
+  argparse@2.0.1: {}
+
+  aria-hidden@1.2.6:
+    dependencies:
+      tslib: 2.8.1
+
+  aria-query@5.3.2: {}
+
+  array-buffer-byte-length@1.0.2:
+    dependencies:
+      call-bound: 1.0.4
+      is-array-buffer: 3.0.5
+
+  array-includes@3.1.9:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-object-atoms: 1.1.2
+      get-intrinsic: 1.3.0
+      is-string: 1.1.1
+      math-intrinsics: 1.1.0
+
+  array.prototype.findlast@1.2.5:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.2
+      es-shim-unscopables: 1.1.0
+
+  array.prototype.flat@1.3.3:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-shim-unscopables: 1.1.0
+
+  array.prototype.flatmap@1.3.3:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-shim-unscopables: 1.1.0
+
+  array.prototype.tosorted@1.1.4:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-errors: 1.3.0
+      es-shim-unscopables: 1.1.0
+
+  arraybuffer.prototype.slice@1.0.4:
+    dependencies:
+      array-buffer-byte-length: 1.0.2
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      is-array-buffer: 3.0.5
+
+  ast-types-flow@0.0.8: {}
+
+  async-function@1.0.0: {}
+
+  autoprefixer@10.5.0(postcss@8.5.15):
+    dependencies:
+      browserslist: 4.28.2
+      caniuse-lite: 1.0.30001793
+      fraction.js: 5.3.4
+      picocolors: 1.1.1
+      postcss: 8.5.15
+      postcss-value-parser: 4.2.0
+
+  available-typed-arrays@1.0.7:
+    dependencies:
+      possible-typed-array-names: 1.1.0
+
+  axe-core@4.12.1: {}
+
+  axobject-query@4.1.0: {}
+
+  balanced-match@1.0.2: {}
+
+  balanced-match@4.0.4: {}
+
+  baseline-browser-mapping@2.10.32: {}
+
+  binary-extensions@2.3.0: {}
+
+  brace-expansion@1.1.15:
+    dependencies:
+      balanced-match: 1.0.2
+      concat-map: 0.0.1
+
+  brace-expansion@5.0.6:
+    dependencies:
+      balanced-match: 4.0.4
+
+  braces@3.0.3:
+    dependencies:
+      fill-range: 7.1.1
+
+  browserslist@4.28.2:
+    dependencies:
+      baseline-browser-mapping: 2.10.32
+      caniuse-lite: 1.0.30001793
+      electron-to-chromium: 1.5.362
+      node-releases: 2.0.46
+      update-browserslist-db: 1.2.3(browserslist@4.28.2)
+
+  call-bind-apply-helpers@1.0.2:
+    dependencies:
+      es-errors: 1.3.0
+      function-bind: 1.1.2
+
+  call-bind@1.0.9:
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      es-define-property: 1.0.1
+      get-intrinsic: 1.3.0
+      set-function-length: 1.2.2
+
+  call-bound@1.0.4:
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      get-intrinsic: 1.3.0
+
+  callsites@3.1.0: {}
+
+  camelcase-css@2.0.1: {}
+
+  caniuse-lite@1.0.30001793: {}
+
+  chalk@4.1.2:
+    dependencies:
+      ansi-styles: 4.3.0
+      supports-color: 7.2.0
+
+  chokidar@3.6.0:
+    dependencies:
+      anymatch: 3.1.3
+      braces: 3.0.3
+      glob-parent: 5.1.2
+      is-binary-path: 2.1.0
+      is-glob: 4.0.3
+      normalize-path: 3.0.0
+      readdirp: 3.6.0
+    optionalDependencies:
+      fsevents: 2.3.3
+
+  class-variance-authority@0.7.1:
+    dependencies:
+      clsx: 2.1.1
+
+  clsx@2.1.1: {}
+
+  cmdk@1.1.1(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
+    dependencies:
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-dialog': 1.1.15(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      '@radix-ui/react-id': 1.1.1(@types/react@18.3.29)(react@18.3.1)
+      '@radix-ui/react-primitive': 2.1.4(@types/react-dom@18.3.7(@types/react@18.3.29))(@types/react@18.3.29)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+    transitivePeerDependencies:
+      - '@types/react'
+      - '@types/react-dom'
+
+  color-convert@2.0.1:
+    dependencies:
+      color-name: 1.1.4
+
+  color-name@1.1.4: {}
+
+  commander@4.1.1: {}
+
+  concat-map@0.0.1: {}
+
+  convert-source-map@2.0.0: {}
+
+  cookie@1.1.1: {}
+
+  cross-spawn@7.0.6:
+    dependencies:
+      path-key: 3.1.1
+      shebang-command: 2.0.0
+      which: 2.0.2
+
+  cssesc@3.0.0: {}
+
+  csstype@3.2.3: {}
+
+  damerau-levenshtein@1.0.8: {}
+
+  data-view-buffer@1.0.2:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      is-data-view: 1.0.2
+
+  data-view-byte-length@1.0.2:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      is-data-view: 1.0.2
+
+  data-view-byte-offset@1.0.1:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      is-data-view: 1.0.2
+
+  debug@4.4.3:
+    dependencies:
+      ms: 2.1.3
+
+  deep-is@0.1.4: {}
+
+  define-data-property@1.1.4:
+    dependencies:
+      es-define-property: 1.0.1
+      es-errors: 1.3.0
+      gopd: 1.2.0
+
+  define-properties@1.2.1:
+    dependencies:
+      define-data-property: 1.1.4
+      has-property-descriptors: 1.0.2
+      object-keys: 1.1.1
+
+  detect-node-es@1.1.0: {}
+
+  didyoumean@1.2.2: {}
+
+  dlv@1.1.3: {}
+
+  doctrine@2.1.0:
+    dependencies:
+      esutils: 2.0.3
+
+  dunder-proto@1.0.1:
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      es-errors: 1.3.0
+      gopd: 1.2.0
+
+  electron-to-chromium@1.5.362: {}
+
+  emoji-regex@9.2.2: {}
+
+  es-abstract-get@1.0.0:
+    dependencies:
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.2
+      is-callable: 1.2.7
+      object-inspect: 1.13.4
+
+  es-abstract@1.24.2:
+    dependencies:
+      array-buffer-byte-length: 1.0.2
+      arraybuffer.prototype.slice: 1.0.4
+      available-typed-arrays: 1.0.7
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      data-view-buffer: 1.0.2
+      data-view-byte-length: 1.0.2
+      data-view-byte-offset: 1.0.1
+      es-define-property: 1.0.1
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.2
+      es-set-tostringtag: 2.1.0
+      es-to-primitive: 1.3.1
+      function.prototype.name: 1.2.0
+      get-intrinsic: 1.3.0
+      get-proto: 1.0.1
+      get-symbol-description: 1.1.0
+      globalthis: 1.0.4
+      gopd: 1.2.0
+      has-property-descriptors: 1.0.2
+      has-proto: 1.2.0
+      has-symbols: 1.1.0
+      hasown: 2.0.3
+      internal-slot: 1.1.0
+      is-array-buffer: 3.0.5
+      is-callable: 1.2.7
+      is-data-view: 1.0.2
+      is-negative-zero: 2.0.3
+      is-regex: 1.2.1
+      is-set: 2.0.3
+      is-shared-array-buffer: 1.0.4
+      is-string: 1.1.1
+      is-typed-array: 1.1.15
+      is-weakref: 1.1.1
+      math-intrinsics: 1.1.0
+      object-inspect: 1.13.4
+      object-keys: 1.1.1
+      object.assign: 4.1.7
+      own-keys: 1.0.1
+      regexp.prototype.flags: 1.5.4
+      safe-array-concat: 1.1.4
+      safe-push-apply: 1.0.0
+      safe-regex-test: 1.1.0
+      set-proto: 1.0.0
+      stop-iteration-iterator: 1.1.0
+      string.prototype.trim: 1.2.11
+      string.prototype.trimend: 1.0.10
+      string.prototype.trimstart: 1.0.8
+      typed-array-buffer: 1.0.3
+      typed-array-byte-length: 1.0.3
+      typed-array-byte-offset: 1.0.4
+      typed-array-length: 1.0.8
+      unbox-primitive: 1.1.0
+      which-typed-array: 1.1.22
+
+  es-define-property@1.0.1: {}
+
+  es-errors@1.3.0: {}
+
+  es-iterator-helpers@1.3.3:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-errors: 1.3.0
+      es-set-tostringtag: 2.1.0
+      function-bind: 1.1.2
+      get-intrinsic: 1.3.0
+      globalthis: 1.0.4
+      gopd: 1.2.0
+      has-property-descriptors: 1.0.2
+      has-proto: 1.2.0
+      has-symbols: 1.1.0
+      internal-slot: 1.1.0
+      iterator.prototype: 1.1.5
+      math-intrinsics: 1.1.0
+
+  es-object-atoms@1.1.2:
+    dependencies:
+      es-errors: 1.3.0
+
+  es-set-tostringtag@2.1.0:
+    dependencies:
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      has-tostringtag: 1.0.2
+      hasown: 2.0.3
+
+  es-shim-unscopables@1.1.0:
+    dependencies:
+      hasown: 2.0.3
+
+  es-to-primitive@1.3.1:
+    dependencies:
+      es-abstract-get: 1.0.0
+      es-errors: 1.3.0
+      is-callable: 1.2.7
+      is-date-object: 1.1.0
+      is-symbol: 1.1.1
+
+  esbuild@0.25.12:
+    optionalDependencies:
+      '@esbuild/aix-ppc64': 0.25.12
+      '@esbuild/android-arm': 0.25.12
+      '@esbuild/android-arm64': 0.25.12
+      '@esbuild/android-x64': 0.25.12
+      '@esbuild/darwin-arm64': 0.25.12
+      '@esbuild/darwin-x64': 0.25.12
+      '@esbuild/freebsd-arm64': 0.25.12
+      '@esbuild/freebsd-x64': 0.25.12
+      '@esbuild/linux-arm': 0.25.12
+      '@esbuild/linux-arm64': 0.25.12
+      '@esbuild/linux-ia32': 0.25.12
+      '@esbuild/linux-loong64': 0.25.12
+      '@esbuild/linux-mips64el': 0.25.12
+      '@esbuild/linux-ppc64': 0.25.12
+      '@esbuild/linux-riscv64': 0.25.12
+      '@esbuild/linux-s390x': 0.25.12
+      '@esbuild/linux-x64': 0.25.12
+      '@esbuild/netbsd-arm64': 0.25.12
+      '@esbuild/netbsd-x64': 0.25.12
+      '@esbuild/openbsd-arm64': 0.25.12
+      '@esbuild/openbsd-x64': 0.25.12
+      '@esbuild/openharmony-arm64': 0.25.12
+      '@esbuild/sunos-x64': 0.25.12
+      '@esbuild/win32-arm64': 0.25.12
+      '@esbuild/win32-ia32': 0.25.12
+      '@esbuild/win32-x64': 0.25.12
+
+  escalade@3.2.0: {}
+
+  escape-string-regexp@4.0.0: {}
+
+  eslint-plugin-jsx-a11y@6.10.2(eslint@9.39.4(jiti@1.21.7)):
+    dependencies:
+      aria-query: 5.3.2
+      array-includes: 3.1.9
+      array.prototype.flatmap: 1.3.3
+      ast-types-flow: 0.0.8
+      axe-core: 4.12.1
+      axobject-query: 4.1.0
+      damerau-levenshtein: 1.0.8
+      emoji-regex: 9.2.2
+      eslint: 9.39.4(jiti@1.21.7)
+      hasown: 2.0.3
+      jsx-ast-utils: 3.3.5
+      language-tags: 1.0.9
+      minimatch: 3.1.5
+      object.fromentries: 2.0.8
+      safe-regex-test: 1.1.0
+      string.prototype.includes: 2.0.1
+
+  eslint-plugin-react-hooks@7.1.1(eslint@9.39.4(jiti@1.21.7)):
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/parser': 7.29.7
+      eslint: 9.39.4(jiti@1.21.7)
+      hermes-parser: 0.25.1
+      zod: 4.4.3
+      zod-validation-error: 4.0.2(zod@4.4.3)
+    transitivePeerDependencies:
+      - supports-color
+
+  eslint-plugin-react-refresh@0.5.3(eslint@9.39.4(jiti@1.21.7)):
+    dependencies:
+      eslint: 9.39.4(jiti@1.21.7)
+
+  eslint-plugin-react@7.37.5(eslint@9.39.4(jiti@1.21.7)):
+    dependencies:
+      array-includes: 3.1.9
+      array.prototype.findlast: 1.2.5
+      array.prototype.flatmap: 1.3.3
+      array.prototype.tosorted: 1.1.4
+      doctrine: 2.1.0
+      es-iterator-helpers: 1.3.3
+      eslint: 9.39.4(jiti@1.21.7)
+      estraverse: 5.3.0
+      hasown: 2.0.3
+      jsx-ast-utils: 3.3.5
+      minimatch: 3.1.5
+      object.entries: 1.1.9
+      object.fromentries: 2.0.8
+      object.values: 1.2.1
+      prop-types: 15.8.1
+      resolve: 2.0.0-next.7
+      semver: 6.3.1
+      string.prototype.matchall: 4.0.12
+      string.prototype.repeat: 1.0.0
+
+  eslint-scope@8.4.0:
+    dependencies:
+      esrecurse: 4.3.0
+      estraverse: 5.3.0
+
+  eslint-visitor-keys@3.4.3: {}
+
+  eslint-visitor-keys@4.2.1: {}
+
+  eslint-visitor-keys@5.0.1: {}
+
+  eslint@9.39.4(jiti@1.21.7):
+    dependencies:
+      '@eslint-community/eslint-utils': 4.9.1(eslint@9.39.4(jiti@1.21.7))
+      '@eslint-community/regexpp': 4.12.2
+      '@eslint/config-array': 0.21.2
+      '@eslint/config-helpers': 0.4.2
+      '@eslint/core': 0.17.0
+      '@eslint/eslintrc': 3.3.5
+      '@eslint/js': 9.39.4
+      '@eslint/plugin-kit': 0.4.1
+      '@humanfs/node': 0.16.8
+      '@humanwhocodes/module-importer': 1.0.1
+      '@humanwhocodes/retry': 0.4.3
+      '@types/estree': 1.0.8
+      ajv: 6.15.0
+      chalk: 4.1.2
+      cross-spawn: 7.0.6
+      debug: 4.4.3
+      escape-string-regexp: 4.0.0
+      eslint-scope: 8.4.0
+      eslint-visitor-keys: 4.2.1
+      espree: 10.4.0
+      esquery: 1.7.0
+      esutils: 2.0.3
+      fast-deep-equal: 3.1.3
+      file-entry-cache: 8.0.0
+      find-up: 5.0.0
+      glob-parent: 6.0.2
+      ignore: 5.3.2
+      imurmurhash: 0.1.4
+      is-glob: 4.0.3
+      json-stable-stringify-without-jsonify: 1.0.1
+      lodash.merge: 4.6.2
+      minimatch: 3.1.5
+      natural-compare: 1.4.0
+      optionator: 0.9.4
+    optionalDependencies:
+      jiti: 1.21.7
+    transitivePeerDependencies:
+      - supports-color
+
+  espree@10.4.0:
+    dependencies:
+      acorn: 8.17.0
+      acorn-jsx: 5.3.2(acorn@8.17.0)
+      eslint-visitor-keys: 4.2.1
+
+  esquery@1.7.0:
+    dependencies:
+      estraverse: 5.3.0
+
+  esrecurse@4.3.0:
+    dependencies:
+      estraverse: 5.3.0
+
+  estraverse@5.3.0: {}
+
+  esutils@2.0.3: {}
+
+  fast-deep-equal@3.1.3: {}
+
+  fast-glob@3.3.3:
+    dependencies:
+      '@nodelib/fs.stat': 2.0.5
+      '@nodelib/fs.walk': 1.2.8
+      glob-parent: 5.1.2
+      merge2: 1.4.1
+      micromatch: 4.0.8
+
+  fast-json-stable-stringify@2.1.0: {}
+
+  fast-levenshtein@2.0.6: {}
+
+  fastq@1.20.1:
+    dependencies:
+      reusify: 1.1.0
+
+  fdir@6.5.0(picomatch@4.0.4):
+    optionalDependencies:
+      picomatch: 4.0.4
+
+  file-entry-cache@8.0.0:
+    dependencies:
+      flat-cache: 4.0.1
+
+  fill-range@7.1.1:
+    dependencies:
+      to-regex-range: 5.0.1
+
+  find-up@5.0.0:
+    dependencies:
+      locate-path: 6.0.0
+      path-exists: 4.0.0
+
+  flat-cache@4.0.1:
+    dependencies:
+      flatted: 3.4.2
+      keyv: 4.5.4
+
+  flatted@3.4.2: {}
+
+  for-each@0.3.5:
+    dependencies:
+      is-callable: 1.2.7
+
+  fraction.js@5.3.4: {}
+
+  framer-motion@12.40.0(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
+    dependencies:
+      motion-dom: 12.40.0
+      motion-utils: 12.39.0
+      tslib: 2.8.1
+    optionalDependencies:
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+
+  fsevents@2.3.3:
+    optional: true
+
+  function-bind@1.1.2: {}
+
+  function.prototype.name@1.2.0:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      es-define-property: 1.0.1
+      es-errors: 1.3.0
+      functions-have-names: 1.2.3
+      has-property-descriptors: 1.0.2
+      hasown: 2.0.4
+      is-callable: 1.2.7
+      is-document.all: 1.0.0
+
+  functions-have-names@1.2.3: {}
+
+  generator-function@2.0.1: {}
+
+  gensync@1.0.0-beta.2: {}
+
+  get-intrinsic@1.3.0:
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      es-define-property: 1.0.1
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.2
+      function-bind: 1.1.2
+      get-proto: 1.0.1
+      gopd: 1.2.0
+      has-symbols: 1.1.0
+      hasown: 2.0.3
+      math-intrinsics: 1.1.0
+
+  get-nonce@1.0.1: {}
+
+  get-proto@1.0.1:
+    dependencies:
+      dunder-proto: 1.0.1
+      es-object-atoms: 1.1.2
+
+  get-symbol-description@1.1.0:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+
+  glob-parent@5.1.2:
+    dependencies:
+      is-glob: 4.0.3
+
+  glob-parent@6.0.2:
+    dependencies:
+      is-glob: 4.0.3
+
+  globals@14.0.0: {}
+
+  globals@17.6.0: {}
+
+  globalthis@1.0.4:
+    dependencies:
+      define-properties: 1.2.1
+      gopd: 1.2.0
+
+  gopd@1.2.0: {}
+
+  has-bigints@1.1.0: {}
+
+  has-flag@4.0.0: {}
+
+  has-property-descriptors@1.0.2:
+    dependencies:
+      es-define-property: 1.0.1
+
+  has-proto@1.2.0:
+    dependencies:
+      dunder-proto: 1.0.1
+
+  has-symbols@1.1.0: {}
+
+  has-tostringtag@1.0.2:
+    dependencies:
+      has-symbols: 1.1.0
+
+  hasown@2.0.3:
+    dependencies:
+      function-bind: 1.1.2
+
+  hasown@2.0.4:
+    dependencies:
+      function-bind: 1.1.2
+
+  hermes-estree@0.25.1: {}
+
+  hermes-parser@0.25.1:
+    dependencies:
+      hermes-estree: 0.25.1
+
+  html-parse-stringify@3.0.1:
+    dependencies:
+      void-elements: 3.1.0
+
+  i18next@26.3.0(typescript@5.9.3):
+    optionalDependencies:
+      typescript: 5.9.3
+
+  ignore@5.3.2: {}
+
+  ignore@7.0.5: {}
+
+  import-fresh@3.3.1:
+    dependencies:
+      parent-module: 1.0.1
+      resolve-from: 4.0.0
+
+  imurmurhash@0.1.4: {}
+
+  internal-slot@1.1.0:
+    dependencies:
+      es-errors: 1.3.0
+      hasown: 2.0.3
+      side-channel: 1.1.1
+
+  is-array-buffer@3.0.5:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      get-intrinsic: 1.3.0
+
+  is-async-function@2.1.1:
+    dependencies:
+      async-function: 1.0.0
+      call-bound: 1.0.4
+      get-proto: 1.0.1
+      has-tostringtag: 1.0.2
+      safe-regex-test: 1.1.0
+
+  is-bigint@1.1.0:
+    dependencies:
+      has-bigints: 1.1.0
+
+  is-binary-path@2.1.0:
+    dependencies:
+      binary-extensions: 2.3.0
+
+  is-boolean-object@1.2.2:
+    dependencies:
+      call-bound: 1.0.4
+      has-tostringtag: 1.0.2
+
+  is-callable@1.2.7: {}
+
+  is-core-module@2.16.2:
+    dependencies:
+      hasown: 2.0.3
+
+  is-data-view@1.0.2:
+    dependencies:
+      call-bound: 1.0.4
+      get-intrinsic: 1.3.0
+      is-typed-array: 1.1.15
+
+  is-date-object@1.1.0:
+    dependencies:
+      call-bound: 1.0.4
+      has-tostringtag: 1.0.2
+
+  is-document.all@1.0.0:
+    dependencies:
+      call-bound: 1.0.4
+
+  is-extglob@2.1.1: {}
+
+  is-finalizationregistry@1.1.1:
+    dependencies:
+      call-bound: 1.0.4
+
+  is-generator-function@1.1.2:
+    dependencies:
+      call-bound: 1.0.4
+      generator-function: 2.0.1
+      get-proto: 1.0.1
+      has-tostringtag: 1.0.2
+      safe-regex-test: 1.1.0
+
+  is-glob@4.0.3:
+    dependencies:
+      is-extglob: 2.1.1
+
+  is-map@2.0.3: {}
+
+  is-negative-zero@2.0.3: {}
+
+  is-number-object@1.1.1:
+    dependencies:
+      call-bound: 1.0.4
+      has-tostringtag: 1.0.2
+
+  is-number@7.0.0: {}
+
+  is-regex@1.2.1:
+    dependencies:
+      call-bound: 1.0.4
+      gopd: 1.2.0
+      has-tostringtag: 1.0.2
+      hasown: 2.0.3
+
+  is-set@2.0.3: {}
+
+  is-shared-array-buffer@1.0.4:
+    dependencies:
+      call-bound: 1.0.4
+
+  is-string@1.1.1:
+    dependencies:
+      call-bound: 1.0.4
+      has-tostringtag: 1.0.2
+
+  is-symbol@1.1.1:
+    dependencies:
+      call-bound: 1.0.4
+      has-symbols: 1.1.0
+      safe-regex-test: 1.1.0
+
+  is-typed-array@1.1.15:
+    dependencies:
+      which-typed-array: 1.1.22
+
+  is-weakmap@2.0.2: {}
+
+  is-weakref@1.1.1:
+    dependencies:
+      call-bound: 1.0.4
+
+  is-weakset@2.0.4:
+    dependencies:
+      call-bound: 1.0.4
+      get-intrinsic: 1.3.0
+
+  isarray@2.0.5: {}
+
+  isexe@2.0.0: {}
+
+  iterator.prototype@1.1.5:
+    dependencies:
+      define-data-property: 1.1.4
+      es-object-atoms: 1.1.2
+      get-intrinsic: 1.3.0
+      get-proto: 1.0.1
+      has-symbols: 1.1.0
+      set-function-name: 2.0.2
+
+  jiti@1.21.7: {}
+
+  js-tokens@4.0.0: {}
+
+  js-yaml@4.2.0:
+    dependencies:
+      argparse: 2.0.1
+
+  jsesc@3.1.0: {}
+
+  json-buffer@3.0.1: {}
+
+  json-schema-traverse@0.4.1: {}
+
+  json-stable-stringify-without-jsonify@1.0.1: {}
+
+  json5@2.2.3: {}
+
+  jsx-ast-utils@3.3.5:
+    dependencies:
+      array-includes: 3.1.9
+      array.prototype.flat: 1.3.3
+      object.assign: 4.1.7
+      object.values: 1.2.1
+
+  keyv@4.5.4:
+    dependencies:
+      json-buffer: 3.0.1
+
+  language-subtag-registry@0.3.23: {}
+
+  language-tags@1.0.9:
+    dependencies:
+      language-subtag-registry: 0.3.23
+
+  levn@0.4.1:
+    dependencies:
+      prelude-ls: 1.2.1
+      type-check: 0.4.0
+
+  lilconfig@3.1.3: {}
+
+  lines-and-columns@1.2.4: {}
+
+  locate-path@6.0.0:
+    dependencies:
+      p-locate: 5.0.0
+
+  lodash.merge@4.6.2: {}
+
+  loose-envify@1.4.0:
+    dependencies:
+      js-tokens: 4.0.0
+
+  lru-cache@5.1.1:
+    dependencies:
+      yallist: 3.1.1
+
+  lucide-react@0.566.0(react@18.3.1):
+    dependencies:
+      react: 18.3.1
+
+  math-intrinsics@1.1.0: {}
+
+  merge2@1.4.1: {}
+
+  micromatch@4.0.8:
+    dependencies:
+      braces: 3.0.3
+      picomatch: 2.3.2
+
+  minimatch@10.2.5:
+    dependencies:
+      brace-expansion: 5.0.6
+
+  minimatch@3.1.5:
+    dependencies:
+      brace-expansion: 1.1.15
+
+  motion-dom@12.40.0:
+    dependencies:
+      motion-utils: 12.39.0
+
+  motion-utils@12.39.0: {}
+
+  ms@2.1.3: {}
+
+  mz@2.7.0:
+    dependencies:
+      any-promise: 1.3.0
+      object-assign: 4.1.1
+      thenify-all: 1.6.0
+
+  nanoid@3.3.12: {}
+
+  natural-compare@1.4.0: {}
+
+  node-exports-info@1.6.0:
+    dependencies:
+      array.prototype.flatmap: 1.3.3
+      es-errors: 1.3.0
+      object.entries: 1.1.9
+      semver: 6.3.1
+
+  node-releases@2.0.46: {}
+
+  normalize-path@3.0.0: {}
+
+  object-assign@4.1.1: {}
+
+  object-hash@3.0.0: {}
+
+  object-inspect@1.13.4: {}
+
+  object-keys@1.1.1: {}
+
+  object.assign@4.1.7:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-object-atoms: 1.1.2
+      has-symbols: 1.1.0
+      object-keys: 1.1.1
+
+  object.entries@1.1.9:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-object-atoms: 1.1.2
+
+  object.fromentries@2.0.8:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-object-atoms: 1.1.2
+
+  object.values@1.2.1:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-object-atoms: 1.1.2
+
+  optionator@0.9.4:
+    dependencies:
+      deep-is: 0.1.4
+      fast-levenshtein: 2.0.6
+      levn: 0.4.1
+      prelude-ls: 1.2.1
+      type-check: 0.4.0
+      word-wrap: 1.2.5
+
+  own-keys@1.0.1:
+    dependencies:
+      get-intrinsic: 1.3.0
+      object-keys: 1.1.1
+      safe-push-apply: 1.0.0
+
+  p-limit@3.1.0:
+    dependencies:
+      yocto-queue: 0.1.0
+
+  p-locate@5.0.0:
+    dependencies:
+      p-limit: 3.1.0
+
+  parent-module@1.0.1:
+    dependencies:
+      callsites: 3.1.0
+
+  path-exists@4.0.0: {}
+
+  path-key@3.1.1: {}
+
+  path-parse@1.0.7: {}
+
+  picocolors@1.1.1: {}
+
+  picomatch@2.3.2: {}
+
+  picomatch@4.0.4: {}
+
+  pify@2.3.0: {}
+
+  pirates@4.0.7: {}
+
+  possible-typed-array-names@1.1.0: {}
+
+  postcss-import@15.1.0(postcss@8.5.15):
+    dependencies:
+      postcss: 8.5.15
+      postcss-value-parser: 4.2.0
+      read-cache: 1.0.0
+      resolve: 1.22.12
+
+  postcss-js@4.1.0(postcss@8.5.15):
+    dependencies:
+      camelcase-css: 2.0.1
+      postcss: 8.5.15
+
+  postcss-load-config@6.0.1(jiti@1.21.7)(postcss@8.5.15):
+    dependencies:
+      lilconfig: 3.1.3
+    optionalDependencies:
+      jiti: 1.21.7
+      postcss: 8.5.15
+
+  postcss-nested@6.2.0(postcss@8.5.15):
+    dependencies:
+      postcss: 8.5.15
+      postcss-selector-parser: 6.1.2
+
+  postcss-selector-parser@6.1.2:
+    dependencies:
+      cssesc: 3.0.0
+      util-deprecate: 1.0.2
+
+  postcss-value-parser@4.2.0: {}
+
+  postcss@8.5.15:
+    dependencies:
+      nanoid: 3.3.12
+      picocolors: 1.1.1
+      source-map-js: 1.2.1
+
+  prelude-ls@1.2.1: {}
+
+  prettier-plugin-tailwindcss@0.8.0(prettier@3.8.3):
+    dependencies:
+      prettier: 3.8.3
+
+  prettier@3.8.3: {}
+
+  prop-types@15.8.1:
+    dependencies:
+      loose-envify: 1.4.0
+      object-assign: 4.1.1
+      react-is: 16.13.1
+
+  punycode@2.3.1: {}
+
+  queue-microtask@1.2.3: {}
+
+  react-dom@18.3.1(react@18.3.1):
+    dependencies:
+      loose-envify: 1.4.0
+      react: 18.3.1
+      scheduler: 0.23.2
+
+  react-i18next@17.0.8(i18next@26.3.0(typescript@5.9.3))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(typescript@5.9.3):
+    dependencies:
+      '@babel/runtime': 7.29.7
+      html-parse-stringify: 3.0.1
+      i18next: 26.3.0(typescript@5.9.3)
+      react: 18.3.1
+      use-sync-external-store: 1.6.0(react@18.3.1)
+    optionalDependencies:
+      react-dom: 18.3.1(react@18.3.1)
+      typescript: 5.9.3
+
+  react-is@16.13.1: {}
+
+  react-loading-skeleton@3.5.0(react@18.3.1):
+    dependencies:
+      react: 18.3.1
+
+  react-refresh@0.17.0: {}
+
+  react-remove-scroll-bar@2.3.8(@types/react@18.3.29)(react@18.3.1):
+    dependencies:
+      react: 18.3.1
+      react-style-singleton: 2.2.3(@types/react@18.3.29)(react@18.3.1)
+      tslib: 2.8.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  react-remove-scroll@2.7.2(@types/react@18.3.29)(react@18.3.1):
+    dependencies:
+      react: 18.3.1
+      react-remove-scroll-bar: 2.3.8(@types/react@18.3.29)(react@18.3.1)
+      react-style-singleton: 2.2.3(@types/react@18.3.29)(react@18.3.1)
+      tslib: 2.8.1
+      use-callback-ref: 1.3.3(@types/react@18.3.29)(react@18.3.1)
+      use-sidecar: 1.1.3(@types/react@18.3.29)(react@18.3.1)
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  react-router-dom@7.15.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
+    dependencies:
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+      react-router: 7.15.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+
+  react-router@7.15.1(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
+    dependencies:
+      cookie: 1.1.1
+      react: 18.3.1
+      set-cookie-parser: 2.7.2
+    optionalDependencies:
+      react-dom: 18.3.1(react@18.3.1)
+
+  react-style-singleton@2.2.3(@types/react@18.3.29)(react@18.3.1):
+    dependencies:
+      get-nonce: 1.0.1
+      react: 18.3.1
+      tslib: 2.8.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  react-virtuoso@4.18.7(react-dom@18.3.1(react@18.3.1))(react@18.3.1):
+    dependencies:
+      react: 18.3.1
+      react-dom: 18.3.1(react@18.3.1)
+
+  react@18.3.1:
+    dependencies:
+      loose-envify: 1.4.0
+
+  read-cache@1.0.0:
+    dependencies:
+      pify: 2.3.0
+
+  readdirp@3.6.0:
+    dependencies:
+      picomatch: 2.3.2
+
+  reflect.getprototypeof@1.0.10:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.2
+      get-intrinsic: 1.3.0
+      get-proto: 1.0.1
+      which-builtin-type: 1.2.1
+
+  regexp.prototype.flags@1.5.4:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-errors: 1.3.0
+      get-proto: 1.0.1
+      gopd: 1.2.0
+      set-function-name: 2.0.2
+
+  resolve-from@4.0.0: {}
+
+  resolve@1.22.12:
+    dependencies:
+      es-errors: 1.3.0
+      is-core-module: 2.16.2
+      path-parse: 1.0.7
+      supports-preserve-symlinks-flag: 1.0.0
+
+  resolve@2.0.0-next.7:
+    dependencies:
+      es-errors: 1.3.0
+      is-core-module: 2.16.2
+      node-exports-info: 1.6.0
+      object-keys: 1.1.1
+      path-parse: 1.0.7
+      supports-preserve-symlinks-flag: 1.0.0
+
+  reusify@1.1.0: {}
+
+  rollup@4.60.4:
+    dependencies:
+      '@types/estree': 1.0.8
+    optionalDependencies:
+      '@rollup/rollup-android-arm-eabi': 4.60.4
+      '@rollup/rollup-android-arm64': 4.60.4
+      '@rollup/rollup-darwin-arm64': 4.60.4
+      '@rollup/rollup-darwin-x64': 4.60.4
+      '@rollup/rollup-freebsd-arm64': 4.60.4
+      '@rollup/rollup-freebsd-x64': 4.60.4
+      '@rollup/rollup-linux-arm-gnueabihf': 4.60.4
+      '@rollup/rollup-linux-arm-musleabihf': 4.60.4
+      '@rollup/rollup-linux-arm64-gnu': 4.60.4
+      '@rollup/rollup-linux-arm64-musl': 4.60.4
+      '@rollup/rollup-linux-loong64-gnu': 4.60.4
+      '@rollup/rollup-linux-loong64-musl': 4.60.4
+      '@rollup/rollup-linux-ppc64-gnu': 4.60.4
+      '@rollup/rollup-linux-ppc64-musl': 4.60.4
+      '@rollup/rollup-linux-riscv64-gnu': 4.60.4
+      '@rollup/rollup-linux-riscv64-musl': 4.60.4
+      '@rollup/rollup-linux-s390x-gnu': 4.60.4
+      '@rollup/rollup-linux-x64-gnu': 4.60.4
+      '@rollup/rollup-linux-x64-musl': 4.60.4
+      '@rollup/rollup-openbsd-x64': 4.60.4
+      '@rollup/rollup-openharmony-arm64': 4.60.4
+      '@rollup/rollup-win32-arm64-msvc': 4.60.4
+      '@rollup/rollup-win32-ia32-msvc': 4.60.4
+      '@rollup/rollup-win32-x64-gnu': 4.60.4
+      '@rollup/rollup-win32-x64-msvc': 4.60.4
+      fsevents: 2.3.3
+
+  run-parallel@1.2.0:
+    dependencies:
+      queue-microtask: 1.2.3
+
+  safe-array-concat@1.1.4:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      get-intrinsic: 1.3.0
+      has-symbols: 1.1.0
+      isarray: 2.0.5
+
+  safe-push-apply@1.0.0:
+    dependencies:
+      es-errors: 1.3.0
+      isarray: 2.0.5
+
+  safe-regex-test@1.1.0:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      is-regex: 1.2.1
+
+  scheduler@0.23.2:
+    dependencies:
+      loose-envify: 1.4.0
+
+  semver@6.3.1: {}
+
+  semver@7.8.4: {}
+
+  set-cookie-parser@2.7.2: {}
+
+  set-function-length@1.2.2:
+    dependencies:
+      define-data-property: 1.1.4
+      es-errors: 1.3.0
+      function-bind: 1.1.2
+      get-intrinsic: 1.3.0
+      gopd: 1.2.0
+      has-property-descriptors: 1.0.2
+
+  set-function-name@2.0.2:
+    dependencies:
+      define-data-property: 1.1.4
+      es-errors: 1.3.0
+      functions-have-names: 1.2.3
+      has-property-descriptors: 1.0.2
+
+  set-proto@1.0.0:
+    dependencies:
+      dunder-proto: 1.0.1
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.2
+
+  shebang-command@2.0.0:
+    dependencies:
+      shebang-regex: 3.0.0
+
+  shebang-regex@3.0.0: {}
+
+  side-channel-list@1.0.1:
+    dependencies:
+      es-errors: 1.3.0
+      object-inspect: 1.13.4
+
+  side-channel-map@1.0.1:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      object-inspect: 1.13.4
+
+  side-channel-weakmap@1.0.2:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      object-inspect: 1.13.4
+      side-channel-map: 1.0.1
+
+  side-channel@1.1.1:
+    dependencies:
+      es-errors: 1.3.0
+      object-inspect: 1.13.4
+      side-channel-list: 1.0.1
+      side-channel-map: 1.0.1
+      side-channel-weakmap: 1.0.2
+
+  source-map-js@1.2.1: {}
+
+  stop-iteration-iterator@1.1.0:
+    dependencies:
+      es-errors: 1.3.0
+      internal-slot: 1.1.0
+
+  string.prototype.includes@2.0.1:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+
+  string.prototype.matchall@4.0.12:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.2
+      get-intrinsic: 1.3.0
+      gopd: 1.2.0
+      has-symbols: 1.1.0
+      internal-slot: 1.1.0
+      regexp.prototype.flags: 1.5.4
+      set-function-name: 2.0.2
+      side-channel: 1.1.1
+
+  string.prototype.repeat@1.0.0:
+    dependencies:
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+
+  string.prototype.trim@1.2.11:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-data-property: 1.1.4
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-object-atoms: 1.1.2
+      has-property-descriptors: 1.0.2
+      safe-regex-test: 1.1.0
+
+  string.prototype.trimend@1.0.10:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-object-atoms: 1.1.2
+
+  string.prototype.trimstart@1.0.8:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-object-atoms: 1.1.2
+
+  strip-json-comments@3.1.1: {}
+
+  sucrase@3.35.1:
+    dependencies:
+      '@jridgewell/gen-mapping': 0.3.13
+      commander: 4.1.1
+      lines-and-columns: 1.2.4
+      mz: 2.7.0
+      pirates: 4.0.7
+      tinyglobby: 0.2.16
+      ts-interface-checker: 0.1.13
+
+  supports-color@7.2.0:
+    dependencies:
+      has-flag: 4.0.0
+
+  supports-preserve-symlinks-flag@1.0.0: {}
+
+  tailwind-merge@2.6.1: {}
+
+  tailwindcss-animate@1.0.7(tailwindcss@3.4.19):
+    dependencies:
+      tailwindcss: 3.4.19
+
+  tailwindcss@3.4.19:
+    dependencies:
+      '@alloc/quick-lru': 5.2.0
+      arg: 5.0.2
+      chokidar: 3.6.0
+      didyoumean: 1.2.2
+      dlv: 1.1.3
+      fast-glob: 3.3.3
+      glob-parent: 6.0.2
+      is-glob: 4.0.3
+      jiti: 1.21.7
+      lilconfig: 3.1.3
+      micromatch: 4.0.8
+      normalize-path: 3.0.0
+      object-hash: 3.0.0
+      picocolors: 1.1.1
+      postcss: 8.5.15
+      postcss-import: 15.1.0(postcss@8.5.15)
+      postcss-js: 4.1.0(postcss@8.5.15)
+      postcss-load-config: 6.0.1(jiti@1.21.7)(postcss@8.5.15)
+      postcss-nested: 6.2.0(postcss@8.5.15)
+      postcss-selector-parser: 6.1.2
+      resolve: 1.22.12
+      sucrase: 3.35.1
+    transitivePeerDependencies:
+      - tsx
+      - yaml
+
+  thenify-all@1.6.0:
+    dependencies:
+      thenify: 3.3.1
+
+  thenify@3.3.1:
+    dependencies:
+      any-promise: 1.3.0
+
+  tinyglobby@0.2.16:
+    dependencies:
+      fdir: 6.5.0(picomatch@4.0.4)
+      picomatch: 4.0.4
+
+  to-regex-range@5.0.1:
+    dependencies:
+      is-number: 7.0.0
+
+  ts-api-utils@2.5.0(typescript@5.9.3):
+    dependencies:
+      typescript: 5.9.3
+
+  ts-interface-checker@0.1.13: {}
+
+  tslib@2.8.1: {}
+
+  type-check@0.4.0:
+    dependencies:
+      prelude-ls: 1.2.1
+
+  typed-array-buffer@1.0.3:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      is-typed-array: 1.1.15
+
+  typed-array-byte-length@1.0.3:
+    dependencies:
+      call-bind: 1.0.9
+      for-each: 0.3.5
+      gopd: 1.2.0
+      has-proto: 1.2.0
+      is-typed-array: 1.1.15
+
+  typed-array-byte-offset@1.0.4:
+    dependencies:
+      available-typed-arrays: 1.0.7
+      call-bind: 1.0.9
+      for-each: 0.3.5
+      gopd: 1.2.0
+      has-proto: 1.2.0
+      is-typed-array: 1.1.15
+      reflect.getprototypeof: 1.0.10
+
+  typed-array-length@1.0.8:
+    dependencies:
+      call-bind: 1.0.9
+      for-each: 0.3.5
+      gopd: 1.2.0
+      is-typed-array: 1.1.15
+      possible-typed-array-names: 1.1.0
+      reflect.getprototypeof: 1.0.10
+
+  typescript-eslint@8.61.1(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3):
+    dependencies:
+      '@typescript-eslint/eslint-plugin': 8.61.1(@typescript-eslint/parser@8.61.1(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3))(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)
+      '@typescript-eslint/parser': 8.61.1(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)
+      '@typescript-eslint/typescript-estree': 8.61.1(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.61.1(eslint@9.39.4(jiti@1.21.7))(typescript@5.9.3)
+      eslint: 9.39.4(jiti@1.21.7)
+      typescript: 5.9.3
+    transitivePeerDependencies:
+      - supports-color
+
+  typescript@5.9.3: {}
+
+  unbox-primitive@1.1.0:
+    dependencies:
+      call-bound: 1.0.4
+      has-bigints: 1.1.0
+      has-symbols: 1.1.0
+      which-boxed-primitive: 1.1.1
+
+  undici-types@7.24.6: {}
+
+  update-browserslist-db@1.2.3(browserslist@4.28.2):
+    dependencies:
+      browserslist: 4.28.2
+      escalade: 3.2.0
+      picocolors: 1.1.1
+
+  uri-js@4.4.1:
+    dependencies:
+      punycode: 2.3.1
+
+  use-callback-ref@1.3.3(@types/react@18.3.29)(react@18.3.1):
+    dependencies:
+      react: 18.3.1
+      tslib: 2.8.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  use-sidecar@1.1.3(@types/react@18.3.29)(react@18.3.1):
+    dependencies:
+      detect-node-es: 1.1.0
+      react: 18.3.1
+      tslib: 2.8.1
+    optionalDependencies:
+      '@types/react': 18.3.29
+
+  use-sync-external-store@1.6.0(react@18.3.1):
+    dependencies:
+      react: 18.3.1
+
+  util-deprecate@1.0.2: {}
+
+  vite@6.4.2(@types/node@25.9.1)(jiti@1.21.7):
+    dependencies:
+      esbuild: 0.25.12
+      fdir: 6.5.0(picomatch@4.0.4)
+      picomatch: 4.0.4
+      postcss: 8.5.15
+      rollup: 4.60.4
+      tinyglobby: 0.2.16
+    optionalDependencies:
+      '@types/node': 25.9.1
+      fsevents: 2.3.3
+      jiti: 1.21.7
+
+  void-elements@3.1.0: {}
+
+  which-boxed-primitive@1.1.1:
+    dependencies:
+      is-bigint: 1.1.0
+      is-boolean-object: 1.2.2
+      is-number-object: 1.1.1
+      is-string: 1.1.1
+      is-symbol: 1.1.1
+
+  which-builtin-type@1.2.1:
+    dependencies:
+      call-bound: 1.0.4
+      function.prototype.name: 1.2.0
+      has-tostringtag: 1.0.2
+      is-async-function: 2.1.1
+      is-date-object: 1.1.0
+      is-finalizationregistry: 1.1.1
+      is-generator-function: 1.1.2
+      is-regex: 1.2.1
+      is-weakref: 1.1.1
+      isarray: 2.0.5
+      which-boxed-primitive: 1.1.1
+      which-collection: 1.0.2
+      which-typed-array: 1.1.22
+
+  which-collection@1.0.2:
+    dependencies:
+      is-map: 2.0.3
+      is-set: 2.0.3
+      is-weakmap: 2.0.2
+      is-weakset: 2.0.4
+
+  which-typed-array@1.1.22:
+    dependencies:
+      available-typed-arrays: 1.0.7
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      for-each: 0.3.5
+      get-proto: 1.0.1
+      gopd: 1.2.0
+      has-tostringtag: 1.0.2
+
+  which@2.0.2:
+    dependencies:
+      isexe: 2.0.0
+
+  word-wrap@1.2.5: {}
+
+  yallist@3.1.1: {}
+
+  yocto-queue@0.1.0: {}
+
+  zod-validation-error@4.0.2(zod@4.4.3):
+    dependencies:
+      zod: 4.4.3
+
+  zod@4.4.3: {}
diff --git a/client/ui/frontend/pnpm-workspace.yaml b/client/ui/frontend/pnpm-workspace.yaml
new file mode 100644
index 000000000..5ed0b5af0
--- /dev/null
+++ b/client/ui/frontend/pnpm-workspace.yaml
@@ -0,0 +1,2 @@
+allowBuilds:
+  esbuild: true
diff --git a/client/ui/frontend/postcss.config.js b/client/ui/frontend/postcss.config.js
new file mode 100644
index 000000000..2aa7205d4
--- /dev/null
+++ b/client/ui/frontend/postcss.config.js
@@ -0,0 +1,6 @@
+export default {
+  plugins: {
+    tailwindcss: {},
+    autoprefixer: {},
+  },
+};
diff --git a/client/ui/frontend/src/app.tsx b/client/ui/frontend/src/app.tsx
new file mode 100644
index 000000000..c7b12e538
--- /dev/null
+++ b/client/ui/frontend/src/app.tsx
@@ -0,0 +1,61 @@
+import React from "react";
+import ReactDOM from "react-dom/client";
+import "./globals.css";
+import { HashRouter, Navigate, Route, Routes } from "react-router-dom";
+import SessionExpirationDialog from "@/modules/session/SessionExpirationDialog.tsx";
+import UpdateInProgressDialog from "@/modules/auto-update/UpdateInProgressDialog.tsx";
+import WelcomeDialog from "@/modules/welcome/WelcomeDialog.tsx";
+import ErrorDialog from "@/modules/error/ErrorDialog.tsx";
+import { AppLayout } from "@/layouts/AppLayout.tsx";
+import { MainPage } from "@/modules/main/MainPage.tsx";
+import { SettingsPage } from "@/modules/settings/SettingsPage.tsx";
+import { SkeletonTheme } from "react-loading-skeleton";
+import "react-loading-skeleton/dist/skeleton.css";
+import { welcome } from "@/lib/welcome";
+import LoginWaitingForBrowserDialog from "@/modules/login/LoginWaitingForBrowserDialog.tsx";
+import { initI18n } from "@/lib/i18n";
+import { initPlatform } from "@/lib/platform";
+import { initLogForwarding } from "@/lib/logs";
+
+// Must run first so even init-time logs reach the Go log pipeline.
+initLogForwarding();
+
+welcome();
+
+Promise.all([
+    initI18n().catch((e) => {
+        console.error("i18n init failed:", e);
+    }),
+    initPlatform().catch((e) => {
+        console.error("platform init failed:", e);
+    }),
+]).finally(() => {
+    ReactDOM.createRoot(document.getElementById("root")!).render(
+        <React.StrictMode>
+            <SkeletonTheme baseColor={"#25282d"} highlightColor={"#33373e"}>
+                <HashRouter>
+                    <Routes>
+                        <Route path={"dialog"}>
+                            <Route
+                                path={"browser-login"}
+                                element={<LoginWaitingForBrowserDialog />}
+                            />
+                            <Route path={"install-progress"} element={<UpdateInProgressDialog />} />
+                            <Route
+                                path={"session-expiration"}
+                                element={<SessionExpirationDialog />}
+                            />
+                            <Route path={"welcome"} element={<WelcomeDialog />} />
+                            <Route path={"error"} element={<ErrorDialog />} />
+                        </Route>
+                        <Route element={<AppLayout />}>
+                            <Route index element={<MainPage />} />
+                            <Route path={"settings"} element={<SettingsPage />} />
+                            <Route path={"*"} element={<Navigate to={"/"} replace />} />
+                        </Route>
+                    </Routes>
+                </HashRouter>
+            </SkeletonTheme>
+        </React.StrictMode>,
+    );
+});
diff --git a/client/ui/frontend/src/assets/fonts/inter-variable.ttf b/client/ui/frontend/src/assets/fonts/inter-variable.ttf
new file mode 100644
index 0000000000000000000000000000000000000000..4ab79e0102bbe0ffa1ed879b13e52ac8c6487833
GIT binary patch
literal 879708
zcmd>`3A|5L+xOSB*S7ZI5JEWr|2a73ka;Gv49PrYCYcj5B}qsUGF8Y>NEt#hq%@h5
zN|G|2V@^70QVHk%UH@wzx4L`oyXSe|_jx{__wDof_FMn8_g;IgbzN)iy{@$nA%ze*
z@INEUG^|&@!CN0bFhJ-5mxM^1(6GhbtqydXv{LA&h6&YSYQt7->I4gy%oN@^T-3E~
zqqcXp)Y)=(7q&rrAxfNUhTliJ=RGOx(Aqd*<=w4HmyKL}@qQuXX8i8fs`Z_%`;Be7
z8pqG$_tEYnx(^+1hkq#SgYV;a`JMy2581kDY(*hTUlpQv$v!wP^QH~P@n3O#(|rR*
z_4(na`*sWQUN)ifPrVPvRjWoDg&np|*k4}l+q-+O@^gn(!u_h_{EB^%k!xb)KKver
z--Y@P95ymb(@UvBs60a4etN**p55bG-BUz}IYsgN{J`!bhs4bmmvR1loS!(T`@r6-
z`)~P5s1pl>$kKGk;0K3&@o1$dg}R9PkM{)ioe_0<U43Lg*R0il7CI9$ggABY?6RRg
zdL{R@0XbJ?I)>j`sMr-KUI>53_3T32I_ygBU;5%Woqp4Qaii!Q{C}dzEQSa_ye{Jm
z`fa?ZoFP0RymICv9C(gZeI%x-7tliCY2+$lQbds6QY=ZwuOup<Wvgbb#10|S)42}*
z4w;53;Tklii+2E$C^CDsWh1i=r9Upp|Btgl^zeYaAbR);ng%X|#>`FibFnm?e{;S6
z=Jo!MqWsNx)y2j?k<+#o)o<h-7Nfm?&yd(TJH<wO9M?ksl2nm1xI=6t%*X$&OrraF
z=h2tNz#Zu0f#7lQ02qb7d@Ow;9sj3#Z9zS^q@Ob}#enz~{qZ-j@nZDf!TSOA`avuY
zmC}E}Rz%&9XR~p>e^PAB6rSV9q3%sVYtbXq46qW+1`Ck)9b=cLPo(pxjDL47oudk)
zy-i8e_kxerdXWqIGxFo;7}5v8C2$>lkGxyK+%Uf}^dx={0MDxOVi9zst|fXPf3F@d
zdgv+W<M+W)up4{=3Nl<C%Ka*RB45Mx(33^y{~GC6ZobZg?LFAu!uA%nx3Ik>+wWsC
z&NbE2s~h;jjo&jxFGGA0D$-sz*yAs-n^4wr92>~T%_Q{aKaqa@M&7%ktXU#*+7Yl%
z)qjok;Rk<<^mBjbJpUJz7lEJNOrAgezWLby=``Kz&t%-=4E(n+C<TA+2PS|)U<7Oy
zNiPtqGtT)#-NS1$1sJ3G(f=9bL_5o4Ucztt!auI@;G2Jo2+o@fN{KvP0Ws`9&8xV!
zIQ-&YQCigYipbr6IOiu^mj+1xZ$kI@C(^In{CvT@Q~p1~8!oEcU?I{3<qg7fb)%>p
zQ%e6U+6zm^eINZq+5)zI5zL1Ve8YK^Z_V|y8RvMJVCTQXZDO<;Cp!KQv*_mg`|U)>
zn=xla-~T}t;obpQWR3&Uo0)~W5lceN`2AP<7wxcxMPF~tU$@WQBl>1~UG$Bq3C~#t
z{hy<kx**Q0%Oa<G5znu6&~8wq?EvURa6#0HDbBImL{2;_`Vx2^#5CjgKj~P}(!2|{
zp?|lDDZs_pir>Ir7|UPe#fzL?W|SK{p8kf}Mu;&0*QKvz<#XjFF%~S+DPobll)etU
z4i14MA)BDz(>c)1;57IG{2W4grNM5T(=sgY5&S+2HvR*;Px?CCXRO*TYSD4ElR^58
z5W40p)y4F>8Pxv|zeRrf9oFe5TtoNyl78!UBEK$^{)URRCw5LFwK=8_<D63=+hgw*
zJz$$PV35eETY^Hc4ZU-e7gN;yjCA@b{4S`<r(cVee-!<!{$t1vH{)HQ-|4$zeg3Co
zH=jpoyGktbvg7=H@PmKQ%Iy5Z@0*YPpHI`h{>(nn>Zbbq?R)y^qOa|Tu~`sh(tJR6
zy?I{X^o@B-YuGPF`X*>8LhXnV=EsgVLViE3(^H|N0UdjoNk3%<;~qp6G2p*QA4AWw
zTzGf9hH<<I{y{7Nli(xu(hu5RvAkj#$FvI1$vF3hrhlZy!;dmJeIq?4%xefuQse(P
zCe6>N|2p_W&e#~HvHqXsnSXl?-Q&-M_xTU*`|r!7>#zR@{GB#DA}X4ju+v0?e~0NJ
z?)(E!q0hoH@Vx&+c^Uct8TEX;cZ9^Qn}Ra?i*bJ!_|Zx{_cnSD;@t!9mtJi#Ew)B`
zOiaSMYP28Vow69-V}HSWCGabQ+IVjn3urBdHBTn2dHf@cU6TIHzdeV_i{f5gQRcgN
z_kp4wIlU5COQ0_1O+0s|qr5euihoE{G2e@aJz9&j0a!<PSNR>++l4gRZWp7h_p!EU
zg>s&QUt&Iu>2t`-fpT7k;#^Dhq;+OltTD0vaRTYXVn`->|1B(PdX<oWES5JK?}DT4
z8>rJSV!XMG`!B_PwqYIjGM<Ai{(HbWa#75tuVQ{`iur<=6lzn^2kE}vENI5DztSAI
z_V4)i|IRsx7w~f_eOIV!q2s|2JePKZl{e`@qz~a(D^_}brFR0KgN;~wR5T;SFswz3
z{c$eF+&LX>xi0$Zt^ehD=bz>&_)TAL44wm3@O&Er{lAFWBN~_;Xv5=pCOmuthxe$W
zc8s{wE)#d^pG21%_G%0JuLtA6TKKd<yPpf$j4@ISbq3~j@EMNx57YE}Bg#iVd5_?J
zB`^m~0=qchya3$}pmsK(dyK^Og>gQf0p=p^0sP*gm|qgVXNg|+E$CoT+O)yDMYmX9
zUt1M@*8taS!uc2@<}Fc?){e1v={_Q2PKiM}0(}SLa)D@y@mn6(SEV(ezZK)`9?<~r
z&E@^2q9mOgTaRTGgKSYzDi(t}jB!mI0=OnF5%xKO`cB2QpNRRHu)g>9i}~hY`ZqV?
zd71Idy;F2Esp7d9G<TE`BhA|w$0sm;FJrAV8Tum>X}pJy)@3kX(io@nRv;gEWyExl
z3buo}U=&yn=7CLMewfZU?_vC=bKW8p$B1S?GZ>%~MLHM)TC&Ol;qSl9_sYoTjCeaN
zmy|ddvJv{;P0+EhUeY4{U${=}M4d$jUJ;Bp%*CpiSPb7=Op5o5#U{6CnW>a$iF8Y(
z`<QrWyy&C85nq9B;AF@c=oo#!m;uJX?xXSh=5zjV%)3PtK)h<CI*IqHm!(z3#12a9
zHDZQASQ~BXMv->Hj7JEaDG%*}=f*6s0O>q`KL1~xt8$@TL?3YgW9ERKBo@c$B1XzI
z)Fqc_f!{6UZqY|i6@5I+y*}D{^Kbc`n6AGN(^YfKd(F{D7tluwP$tqh=*P!mzme8C
zL@&?+&y-%Eh1W!^0pEiCAt#~4d*HxL(D4;uIry(!lcJYnGb2q5jqw3&r^Hai58v}z
zi(ZILtjqx8vZdKCT6(j=S<Fr6L>D}ByXcq11ieJm)kj5hIY+eDV=(3ph(TbZnTGd<
zhcP!~7fZbyxNf)DsxGFV^&IAa(I}%Y{J)}TpvQ^fx~^yqZLQmi)~c*XL=3ex${LO`
z2gteUzv+^(^l;4k!zo|)kDWi9u2GHgJAyUcWn4$cI*JPBRZ&(~5EXS7Q9)M{1NCZg
zFQEpDo~k=yo=;%>%@p_PIbe<G9piEM=TkVZ2dIU*JqHbct0LkV&>SoTz4RdQgdQxO
zgwFkcp$+nh>qB%l(Ol;dO;tY8L<OR;`d;+ZS<u#8AW3v0)D<yIXGTA~4|a-%+QT*B
zZ+)8>h4Y8$yke64Mm!Fx%fn(k=mW-q>HjVFI3$|bU80G<Tr{_*pf8D@wm&o;&#%+5
z{GR?~`1fYf$)3dTr^PV5-!`#FkRFHpDPowNDH_r-Cy{qVoDJ5BvsoS!XYt;cn8_Ed
z@gCV4b65j^j%c9fh?V+Ru?jjD^VCwaRpzw!%AC46=EFdo)Ca^t9iT6T=!yAZwCW*>
z(=o4y%&C&a^YEuGn8pTym0)hjLFh?3Ux=$esM?r|0quU0Vl5#uZKW+so&(jZv_XjD
ztz&bez}&(+r8tNF%d}l=bbZ8xOkKo;*gG`#)MD@X@nQ;|yL*GJV(+cP#NLdwzf_7~
ztHiFR6d7s6mal+gAy?>{c){0_+E+u?v$`T;FL*Pf%zsz@Kb3dWz3AR}hd=J;meVuk
z5`7524c;Hxh#mj*yS%8KF>gV4{FzLBu~xa6X<~gQqLi3-gU(`WCZg6&DDkVUjkaab
z1@$O};{a_upMl#d)_|><u)k!_WBqg%{mSgiP`g^}!+K*YVU96z5s@cGW>NbOnvwti
zi&FdlKZM?OE%sAseBwPlwg(p5x1o3GUa{EVLs&1x;&xh#hbV5OD29W$4Tku9jQK?&
z6Y(xa?`De?-qAA1_)U8Ap2r{38T;h)zP%Ig)!?u8ievBP*hh`U2x9xG=_jzS3B+qe
zMjOne^y_}O-*;oLE@SWOX3c}PQ`~{}vTok5`tv?i#@^Du+9%4`OTrw7_4^IHjQtzz
zuXq`R`zqA$8T+6adh<TUAJQ4ILE0BM8}g?(KE>5zaq(^G?_(V|m)3HK%g#ew_X8%D
zrr2~W{!I1_W5IJM_L~vArFd(Mf5ch;5!a;nC*`9)@CRZJ@mKLgwFvvwVZ86gy7I5q
z`V?!Ue8i@1j%k^U_|;8uFOv~p%IJeXDYaL<h<X)5+hXx*tntUEzYl+%OFsKA>p}53
zst3MjAitvc3&nvb1{Cun@)g8vVlgkodMKVlcEf&3FIq$2SU*$$VBJb<Tw2poj0y1t
zvPrCbq(^`~8NW#}hSvWXyvMIs#d*DxaSZSEd|qK(^Jh?o*H#wG0PnLi@kB0$ahmab
zUypPQye||(U(K~$WU<&@!^D`c%%%I#^>kci$J(bl-ot=dCkur{palQk3I%xI*h1jl
z;8Wsn%qvgbG_O4Mr+H<uye_8dz5jrIXF&Og6>bdnW8C7q7caXQNeVl~*3`K7c)aWP
z2pNXs6A(|^=yGFT8ISAcW1hpjN9%gq1miLX_MP{OL4IAVX>wsLk`?7;#oD92XixbV
zryEUY(b4-%4DfJ$IQ|xSd&E%F4r_|`h^=%G9ci6mBCvfo<daV*^c%${i1e6_Mhv10
zK7U(eT8r7Su}ar-86#tw@w<bV6e|xtOmQhM32n`XnC}x<=inSK0dwzJyz7k;h4BuU
z({w`KG@N$@{SlA%#2R>40jSqBiurh-V@xc-xu-;7(-QUVD;nXNj$R(bBdEN1%=ewe
z6!g_*(-`L<jzjSsjW~{eUJRnOw<>`3@NqE(bHzqCSPVdZ4~6dp^g?_yR#?=D#ZM`Q
z8YBHTnvY|1HO;Ryx6?dI@nX!0i0y3jCWu^kU*1U10{;=%1aTx+4A*xO<0$q^anE2O
zVj>hr$+$k8Ln%Irdv2uhNio@2-1VmM8XKqK7>&)rYjJ<v?+>xBa6B5sy6iA;C+sp4
zb5I5J*L2a%e+9owiH;PXqxe#6d}IElK8eLfF)va4iN<~`rUje-(_BFJ$e2fOniFDk
z+a&nP+h`~C6U{5sMyR3ZE%rDNf2$aqM|dx|m#L3D@&{Vm<`k3c4A^fUd>6m5ZmdnQ
z;aEJD<`bNUIc8Vv-eEf};){6qpGUxEU8w(X{zf|#{rE~~hgU>-_o*l!_X}+DJo3m^
z&x<PV9n6E1V)cwYqkTMI;SWPJ_AC((8*2xPvGA+n-cC_GQ&&+jxEuZ0JeF4hdS|AZ
z;!fHlr1%`-UY+S#gK^i|`$(+Ex@R2bC4q627j<fcaWzH1h;{xV(H{QZ6mwE6j)C%9
zdKh1-A7UKHr?`O~FKQzHD~!`gvAo{6_H)E;j*Fs%ej)uj+S;D{8}&`Wx@RQym936A
z0p<(%a2Je=ZZVLCKQF~IagZu1%Er>Tx9p2J!#$!l;uf=T?S$CzR54T$^<wwAjInco
zz`gpYLa6gipzM))UhKY&Vr8Dk9_pVtjWt^B^q+8EAH=+JqCNAyLs-{g-`@LLjKq2j
zYct~71n6#X9P9%-!gN&}tAlPV8s=Ze@7hQs|0<SBH&}x-u@Ni>DC^o#fTi5kZeS;v
z0&qN*w-q`7zYl|1V5JaOa)Xjcw+A?Otp`|&bXhPP;LA@@RIW$dDnu<5E!1{!4txh1
zVC@KKJxbtNHCC2GU(#9@YfwD5a-xjUpif9oXmQXB$DUxW)A8p)7l8AwMuhl%473{<
zf;yp$YdCbZJV*@l3qapRCjPtH7ssislc0G)W<ci-!@=4B<;U7x1NqrO9p?9LxDUA6
zG|X#`a~Feyp(1@%;heKLo(XB>Uqv0SZU(s5)tX=$j-&5>Z-6xJcl83G^9br^Dq|nm
z2zH<x3sC&kp<n|z9;Pcp=^C=>Zk$sU6h*ob7>V-HXIDGoLY#w`z$fA$#>Jc9GJLSL
zx`=1hI*uF2@6uB!ju88OK)gtHpmdBdKXwk~#cU*slfA+?#7f*3ZN6GqHxdsLNTZFh
z_EKG_-KhJuM9`dUPWQsI3-2b^N+~=mp(x`z+I+1KSPbag#Tu~;v?B$a#qVJ>7E#u6
zK>awCi5<r|*Ye`MrD(=`3%)NYPN2SThMZKRaU5|G&>^O^G3IUpbI?xQGuHlCUlqZ#
zn3;mPbDW-!coU#Ll>PBMK>af22>Ols#3PQCh<7!s4&h#l#5B1S@z+{niR>lH%GZ&O
zha!#nf3w+xca4qo{*}H7*LReIMIM_Sb9psUo1VKK_74T>i+Sz@ji>);EYbMEc?Z#_
zi(?eS+*UsQk}ijG5bwcw>!KQ_-;2JkO-g-5{zvsgoiBo;;3P=HG4i9Ph*y?X7Gw2m
zuun8X-z-Ngy)4xO_d=KAyL5aT&*@y9@k_>jYY_;6-zFFQQ=UYoPoo+${j0K(d{4Dj
zW7I@7L%pbt4s>RnRp-#R>U_GOE~-oF%DS%Zp$F>``Vl=<Pt!~E7y6jKtgo0+W}!*<
zO2^kq5D8fl@+H(wXq?b2p+!Q=g!T!Y5_%^rNLZY(E#ZrVa|vH3{2X~cnl*ZBG$C3f
zS}R&V+AP{G+9BF0dT;dM=;Y|y=*H;#(a)ksqTfY-ie68QODvMuCb3;&*Te@Brzb8*
zT$}iM;?~3+iN_PqCtgaDNjk|UxuhIPxswVc6;3LVR4S=#QnjRJNnMj3Nt%@OMAEZK
ztCC(zdOc}d(kDp=k`5-FNIH{rF6lx6RlpX=S|EFYyagf!N))JApizNt1$q~lU(hR<
zr(ltSB?^u&IJw}H1wSrSuu$JZ9~Ziiyfk@L@`mI$lD8+nle{bW!{m>X&nACYSQNH}
zs~7HGxOd_Hg%=meQ6zVfwncgsnNsAtB3Fv#C|<dQEs>){{t|^sjxG7f?dhfREPr7|
z`pczKL`qyriIlri?oR2P(j}!|%J`JYDKk^%rYuX@p0Y3HY|786HZ@4inwlduPileG
zLaD`5E2Y**ZJXL9wP)&ksV7oXPwqN-_~g+vKP^bho|ZE$cUp2<{j`Q@52Q^@dphme
zv;}F)(+;E^N;{sGdilNU>FMdPFn#~OSgetE$q!UpHBL=Zv($2J|6t?7uyG|_M>o(t
z^)NkJPlS!9>t*_=zNCNCSIu~{_zyO22piuG8@GjxdxSQAJK=D``GgAzS0f9f*`j%(
ziP56b+R;YQ7NL#1M#o2|MAt<(MR!IIMUO>)h+a+<iP;iM$80<#aaiJv#KnoPC2mf9
zGx12w#sW6>Vm8i|6oHM4->`9uq;5%%!NxO^UQSw<v>|D0XyfBar$ZZiu<<Q_uyL;f
za|&wMIQfQ+_ru2B3T=Xo7sJNulQ$)AP2Q3Ge)8TMHugdr_q)l)<6+~ULmOxROB<_{
z%qb;PnxwQyxfeF>pYmwRl$2R1^HN?+*`0DU<ww}qrDjgOB{g?yQq0CBQY)v{Ol=pl
z@qttr`Q+}CU#7`4mzFtZ<Ak)ruyLcbp=p!TW~4orwlHl)+GlBp(@umorV;)Z|M`>k
zF@K`}m_JTq4)=%nSb_K*?Du@?wIhGNBz^bgs}~1f>~*o-`O`w2PXVVuDtPMrwDXS(
zadA4p%p=5^eyP3B^upi9TsxU~rvJ(5C!acrIqNjeJ-sEP+|%C*arWof+2ha7$;i#n
zufO>E$1{h{z(dbm`MNsgp1gSGt21Ao=y>|eGm~&nyi=U10EVBz)Ah{aGu6)2JX7z?
z)H4&#+<)f2(-GV$2MA8fQ@@^CeQNEgnWymNK@R50(|4RYbn4Sn`*Hu<PZdA8<>U*g
zFQnw8qZ$9D4m$B!>e$rAsf|)Ir+l4q_S9P`3sRyf`A>Xz;(SVQGAhJzcWl7X#z)H>
zZE>{0muEg7bFB6k6MLTMKC0V^A`KJgBpy%tMTi0~2vIOgq2tNP$@nX!<R0JvUWz&v
zJ45#=cB0tPVh4+TR&0M^JcA0OJ%tVyvdPVhJy5t{;Ua~zb6s-2kaPE~18<$4J74bn
zl#~B`@NWLr`2TDnvK5ZYLNmBbQ47>YecpWK{c7vj=C+5O<k#U6`2Rkhy&3=cmHp~|
z1K7NUKf*umr}!8Bv`pt+fsEs%?jSf6a+r@eXn?0nVB_j>PUb&clNq_0$AP_>&t?%>
z@I=W{5>(BC_CeQWS)b)>mh18P;|s+XjW5F`2oYb3Qt>5OZ{!w79_ko>SL|r}jQoEn
z9pR%l<<*Qw9q2m#Fa8gG5MMdIYJBzhI`Q@Xd|k%*|Im2U{NMc-51)z0GnxO(_!ZW;
zV|?d~Bc$<dL6@6z=y!a-_yITP#Se&|f&4|WEAapLrF_(W?>*yv<gNA+>?ht#Z=bi&
zTV&(BAG~AU2Jg7H)~n&w^lEu`dUd?IUVX2D*U)R^rFy5mi{2&gTW_BC61INs6pck|
z(N#Plo)SyM2QrXZ<!!Q%EGh4l56N+IynISNFIURl@<Vw*9+sE97rgb}5*t|GekFfb
zb<|y|jq0N&;|Z}yy{0}^U#JvyU3)s0Zldqet@V9+lzv7Z)Q5GdKC7>L%e-~oi}1)F
zyg6RPOZ3)wQSUVyu}5vZ&Es9L)@HFOHn(@#*0&ApVLi|0_s-aJwywR+`^LUwx7&BU
z=Y%IL-bM`GRWgYhqKW7xusbVyiVwv;@sZf&^2^(01KAMoDRpHX?<ZMLu9C0FSLJH?
zm2rB6$|kQWqw=aal}klcGj+e}r~0e=)K;}ky{R^uHh9|Q)A@CR&ZBdCKkM7{v-&yx
zyq>KusK)vn{@N#p$SkjkEGlPgb=yqcjh)RF;%;@1XsbH8ysE9}r3Q%JY9LmVgT#H<
zLGG)D;A@UKVy2oaW~q7D8J;hesh7peYNgn(Hi?h1y81-DB|cR<!~wP56;dC`ICVf~
zQ(wB4GOs!>^Qo_8es#eWR_A1rN|mK_W?5Qik!5tetfVu^#yTSJ(oxw&C(04Jk$hBl
zmJ{^7@-f{-PS^e9)4IQ$p$EvBdZ1jOAC(LB1XoOtmuvJKxmGWb>-0kTnqDN=>lfq(
zy;$zkN8}OxjXWy9H(LH+jQr7f>M2!MG;n!TJy+b_D_V-XR8!Gev~l@V2Uksuc2Spr
z=w6a|+LS;X_psO_bF0JZq-*7FmlbuKd{EZcd0kQ0Mvl?VTuJ$?9_}KpmL4saxlZyW
z`LdpCintQ;OMPDcs?%MfE8yz823~Eip6l$Ix<PKZ8{r;u!|*QL(<RG->X0iUYwMgM
zUTN`}dPg?ZNphoJB45`_<tDvMzM)@~oApcTagkMJ7THu*QBx)2Ym3=pwt80HqP~*N
zbOG617j#LkuKLW~h8_RzVvc$aJ94Gu9XhLUDmT7rPm;ZLRdEY;xwB)1a=&^&^ixCe
zw*Id8T)ijn)`esXoh&EnuJUo+O>WW4<yO5y&eDVABK?>v=vs&u)hbt7b#!H1SNV&<
z-`%P#qQ81j-lGf4mb!>+rHjhex|lqsFRHWJ>4()W*UfborNlj|i7X)T=5D0B!}SpL
z<t|rNj8c7NX0=B?qFc#nx~)8=zgGENC0AM1ckNU=)!tQiwcVX&gn0<>-6Pd*^^9w*
z7MRnnih4;cRm;>C^Ss)xPN_5Mv}>(}mMR@@^FH3>>+8m@t!uB_xemI$?x;KH-nx(O
z>uR`rTur>ykJ0np05?#7uD{a1>T5>1I<B6(%iZmoyQ;o*J<V{n&<#<as^jXKZt0r1
zW~ztk<+`|zdYqc+8oFMtw`-)9s};7C8)M7Z%5JP1?MB%eww8CqI~rHf`!KFTT#dNu
zah2jK2PJ}%!R<kDd)%Ihs~VgQ&IRY=YQ|NIs}ff>u6$g%pnOm+Xb_YN?g+}*RC~&v
zw&(2$`(@B9Xc`o>Wo;E(GiV+(3>pVbg1dr7!Pmisph8g5`#2~aR0=8wRf4KPwV--X
zBd8ga4Qd6ogFAydLEWHUP~U!IF9fq}n*BDI9n1`71apHq_EPX%@O+RQ6qYsJId{N)
z<_>!2WEOkGp2b&4XT?~tPJAWLn4DNeCLvZEm^d*;{wCI%%;HO#2VXf9leJ71iLamJ
zSd&$*kf%*H`GvW~WEV%|S<}u8Gml}dwAr*ZL(BtasCm#lY9^TH%=7MJv)X;)J~eA}
zHM7>NGaJq8W|Mit?9pe;hi0EyWVYz)W~=$gedxY$hfPsa%oI0!-Iwl=+v`4eU%4Zy
zl{zQ~yQ4u7(MlFK8{9tkkwXklOg63EIMW<|0exP4E#pl?)5zTE9+g$xBvV<GF(pMq
z_pm7~9yeu7Sy@?DHRVi2Swd`+54Z{LF*ngYZmO87ZnCLnYM45vuBm70n+B$_xyv+B
z`OO(~)|@jJ)T8Db^Q}p9FPlr|XY;GMq8pfW-9okYg#OW!`m|>}>p3s*GJ9FPI4`@G
z!^^2AsK?Y2x7^FEhp7+MKJ~em&AUY{cCWZq`X|qGQ{1cW2`{Ug>Q=ia-5NK|t#wbi
zb#A(Q%{}ebyBThSsif<fR$hKL(`|IK^j+>nw<jnRj0#2vV}h~4!@)zrNLj;t=U(#S
z<!Ig1+-}ah@ouGQ>fLJYFc;l3?sb{V{9wwPALXs)C-I8;U92`&O*1c-x!cR*X1h&p
zj(fw+b(`Hhw?%&LX;a<1&D8XKQ_IU_YO8gog_qaOcU#@F?m4&3R50JW=dsJM%3Kq#
zn(J<Xds7xQzp1O@4wZoQdj#wK0*E<IH21jeZlQb2Epl(W7u*ih(#t2Sxp!oB_pThO
z8_HqsJvrRH?-sicunzlKU%{IDcm0c7;&!@6+zPkU?J}jz*Yc33+%mV@7PZA~344bv
zXDiyOwwmo`@3#Z&KzBaa5xf(;8@v~658e+x2zCa$g55#)U{A0&_%PTPd=%^tJ`O$!
zdIUX#UP15R)8IfbA~+GG1gXJEMD}kJbr7wns~U=Wsu3a{Ek!%kS+rO8iVms^c3QgP
ztDtV!i5?~fs^N&%ju3;@L-^u%q<B)zz)s)u;wANpSdK4LR;bm8=)NFUsx@M-dPD41
zugmP}h|HmmBKmYpCa7;@L|v3o^{q@)X);+WSy*dXL>pOFXOrdhEwa4ME-UC9vW+e-
z+v*asoh~Wc>)Yi>-CT~+cgsn-yPT|h$SJy~d_wn<&*;H&wjLtq=m+FnJyg!q56Tzx
zM7dZ$E|=&@a;csyx9OGgP5rXmu2;#o^eggh{i@uf56Qjy3;B^gD);MS@?-s_{6rs@
zpXw9xGksDX)TiWe{jL1TSoyQ@<z<set<_U>icV9vs;6Ba`JB5Ce={79zbn2)<W`=@
zqkM6j%7nPO6ZsIw$&Wp>1SLd7NfAXHC{d=12h=FUu}6ys)fmLI#){$UVKG9D6A!6J
z@crR<aY(%{zEB^?4!V@=s7uREx{U0s?~wQEva*XVC%fwMvYW0TyX%Uwhpr@h>dLa0
zt|E8n)$$#^M!u`p%J=j-`M!QlexTROoqB^jp}&(U`jSl5-^-Kw2UpJZb>-dtu7c}l
z+M5ohqv>Qin|n<c(^V8ibSYUB7DW)<DuxK~Yhu0FfQZ=ZVv~3S(X$uKVzb07HOtJ4
z<|VUS92LjJadASVh*U(JPRR>qzxmjFVm>to%xC7H`P|%Ua+%yFkGaj{HTg__)6E?-
z<K1yH&7CkST#ByiPMY`JDRao35#>aAfp7XmB~e*a5mn7oX1aOW%rG;}Ec1++E#4H{
z#arTSu|vEg-WBheFU(={rTNMnF-OfYbKFEs)FhfDQ@|87g-o&;gfE#(h?3%VQCd_B
zCb+Y~qrua`G&9G{HS^4T^Q?GGOcYzhR`Gr?F_;ugF)Pi>W|d1dub5ZGX>mrJ73YG-
zgUP`Y=6&;l+38N3*UWme%j}ll$cyq@nI<0&rUp+2PnnbElpG|7m;{r<6b_~bj|GWA
zlJ~l|(c9#`5k!Lm-d^uR?^Ex9x8M8N`^5XqX0p!P>}?BjdMVzCAcy_YergYR2ffd|
zL*8NUOYf^7n|I#(I>_bC_MQ)J4e|upgIj{E-d6jBx7b_i&G(-5=6bVig7>DkJ-98%
z9pnx21+9YoK|&C*ciPgnk-f_{vCXieyxX?1ZEZVyk8Nqo+o5)t9bq4`qwE+v){e7}
z*ztCfoouJr3HCAD-gdTq>|pnx?TVFXPut7(w)fe7wtsMsSH>&rRrN}E6}(bj5wEgW
z+^eX1dxgAWUOBJ4SJW%*mGo}+?(hnG$zB1kl2_2H;#Ch?25$v#`UCwz_H%pCmo}Sx
zQcktmZ4P^j-DCILkL}xbhkeh!Z$Gd*?Jm39?zJD<efA^!X5d`^APD08OnzQJi=WTW
z<tO;r{TzNy|5m?;-`nqQlTDmW@_zIe`%C;~{!+h{-^Oq4xAX7yyZGJwu6_l-ieJgE
z7Na~?&lUZuG3xmZY+=8q@BDZ_x1ZU+#lKB$R&T4FYOnf4x6z%vlU`S^o7dgzX*1ir
zHlJ-}TiXt{qwQqxwOwpqJID^P57>$JaXZycv(xR<cBXyC&bD*yJUibmvoF~dcBNfq
zU$v|4TD#7^W={qe<5~pY25G@}argKy`OE#4{>%O<{}n&gKk1+HPy1*6bN+e%Ywwf@
z<aa8MzN()He)ChrPWhsmqMlGw)st$Pnr@HzEBp=q8UF&-|KIv){&)T*{~P~%{|Emk
z|7ZWQ|BL^l|7%<;|BC;+f7QR{U-#29iA*xM64%B5Ev{+Y{c-)``e#yc55^6{zgvR;
zntu|mR<VY?@gJfSB9V#3mXeSL-ZM~&9sukrB2dD3tD%J$?3yEF!dNQ1FyrAn3Cu4s
zu%jB=L&IDnyoE?3Za~;LXbA?p+5%%ZhIb5lJL4g8gtzS&-f?JY##;+51InVz8qjh8
zu_o_MXhl#3>H1K_k_ayqT8;5eLn&Sbyo*q}9(b3aH5u<)Xf4K@2d&Lul`gPKXE5!H
zIw6!-H>5GNUI?N<g6ctZ1r+xn5K9sbL!N>*3RwcB>xmBl#a4g}piLN=721@Mw?UgR
zl5EnPk<^!WGm`4of{_nF?_uOPXiG+phqhuQ)raa0B<%&ZVdP3EVkCsz4Q<EB51|zO
z0rCK}10xZO5*-=rR149G@ep&v3N?ne9(ph1QQNyPmfB1G1@NViKtv&i{R-Nhk-tNG
zFpBKZlTp-Xy%<Gx@6D(_&=55l>H8Qp3rg`XpcX;zXVh!ZevJAU+MiKhKnE}?1v-#X
z*P(+L?Lh}KIu~>ZqsfL3Fq-Tzl+o1R4>FqSHH^`tpu-vc40Hse4?@Y7KvO@DWOOQ&
zt^xWibTp%>Zetj48FVb;t%E+ycrQZ7G5F#~h{cTk0ZO(3-W=#s244;cL1h6i5lYts
zZw>S%#*0FiGamKl3dYj4<WImJg}%(-%OD|EF*XnM6~?;&eU-5mO7{RZ3v?}GQ=rry
zU~@z1e!#m7B|qDM{QA(1jHP~ioxxWE`1h<Bn;-fH<DG$SX6!lW7RJ_vZe{Fk&~1$O
z4fIXMz60IPSkku``!4it2C*|Cb^yxrz<VJE`hJLpeh`ugx-+B(bXN%Z)o$=1=mz$I
z{eXUx?-F$GCyb*ue#*$(p$7nbN;ZIg&PZzGAx6^p`hxL(f>PfBSr7UpfDI+t?HD6z
zoE~S4gPveC`ELrNvO!ZBc@=t+QPlQRjLHi=&8Rpi*#oFt(6fvpA0yiU?CxUY0l;4r
zjpJ_^bszL1NJBo^?K?)1FI-|w8|e3pwovkWv{mPW{><n+(94V_ANz&z==iS;{(?e?
z-vH(({VbH)2J~#`HAa&^UuW=_FZjp57{oGZvmk~*dnJAlh;It17<!UR_(TkpC(&Po
zz*vy*Ap&twA<+hco)yw(@a2z?@F9Yp8xpo55HF2AV`9%4I*0BJ5JMG`?g!|3BIzCg
zaaAGXnb`9nE7Cx9g2JwZgYD!k4C1dsW@lpGn^1dz8UUrb0-C4gt&AE7g^dZCvnBeP
zK<ri^RuhBfZ+iX_YA}@UNB+_m3Y!s#@d}xr5i_6(4C1~*Vh$o=-*m!<BtR@!$V5iW
zf+jJD4+~j<5zjyiGHO1w5JU5zOlA;A7P2rybDJ!}Ahs-IQHI7ReM?Fp-YjHshQ=!5
zH!%={7W6ESJ<mUZ-p(K{Eo3Q%#<48Ts2$KU42@}d2ZMhZOUSZ}qxzO(@UPPeSw4hp
zUV%|`ZN-pm&`ON@5?YyYEumFHsPC&X_zFhIY9VBY>I{AHAZvt>O=>a<V?owp9Q9dk
z246M_dUuIIcEB7&s8nd(5bA?^j3z&=A42`nfYI<**)W9qrV*p#p?8H)`<gI16SQea
zV`wu*lfN_%q3iBuH2F@85GsSl2GHb3)JMb!(2CJ?|JEUoLfbI9Gqi2U1ZX=(-wSOY
z@))!Oqq{&mhD?WcVst+!l|?)a=z5_0L+Kh~2I$IY8iU<JW<t9&dLXn%$O33jMpK=8
zg)D^9xCNT(Ok)+`t5YFqd;&cl+Bakk^nM0^wI?Lil~@a?en8W`s7}N>K=lBc?lman
zHRxalU)u;dBxF7G0Y<+79U8I$`XHkhLx+XzgAQl(5h&S-p!7qG{suZS<S2Ah$oJ6E
zjM30BAwNLJGR8n34*3x}jxiqe5k@@)r9J|R{F?d~&^kd<p8}T$O11}z{Cy(hibEe~
zu=^wAB!=GW<zyzdewczZP)(svF!T;Cr!w@8FP~&wKIk+?k*`tx0CtmvBtHZ6UK#T(
z_?IL9Cw~IiYZ8)t2nZ^B7K8mKA)jFc`Q&WIlz@^S0PIc)IhTpOTg*cmh&|BxA-SQ?
zGU_n&IYym?KF_#TQ1T(*ZikZJ5ETLW3ea&-@(+UiVsS`)=n_Wfg)U`WQRp(pQD0GA
z39|W1jBW;9&bX4$6(LmLm5d$^eVK6)=qkq5g1*9N>f2XC=$@+?*9l7FhoF1Xm?5Y<
z8Ye(g|GmbTBGC1Wqki5H@+EX5qt8QM5BU|kiP7oMHyD=)-OSJz2yzS9ioT`3+QxXb
zp>Hx?J?M7Ek&nH_IP$%>88-;J1H6lJs88Nwu!|_<2MnzR<xWQRgzjQoGIV!HK`8kL
zz?XqS?q%>7i-OjrF{p0)80<<4`4J=Hq5B!^R0{bqBR+$E!l-wkpN3HV4=|eina(4q
zFAp;KD{3J>521dgIsr|7^hF5uG5Idg%b;Wrg8KU_248FQ9CQRqeSehEWcOnX_D_X8
z&WNng6O76XO<_bfXext!R(v<eP@F@aVpJmZG$W=%&oJ1J74j@2D1DAm&qB#>h+Dwd
zjH0?<2%)j?4Wr3tE`~IRe#_{B&@{$Te}2cfy3k9EqW=A!!9K8%KQI(CkUui2JM<?;
z%z^&QV82+%%M7g*<u8mY1^qST4(M+T_LYUa!UzZboxxtSp!G>?jY8w}8l$Mr*F$<k
zY0LoZNed+yf&Ni4B!J=oA+ket2&D}}u?OXaJOH%}#UZfszzl_EVrb2Voe1V#DBT0l
z8jjXWG2Vm1Ct`kaH#7^Q3qj)<dVeARAapVmenZf620I@ybXO?V70@$>)+B`P2F=OP
z+@Nk{@O6J|ou+c({H;i%9|^qznunq11NNq3=t0oD49(FhAEO_G=4bG)dkO5o#lZf(
zP!WdW4zv!8u?m{VxYAJADMm+V0mhYqQdz)JyQnV!`G}(S10$e?89{BuoDzfjuP8$?
zA$+mTJP0k$(EFb%!DuR@Bt!3l>UKs`dGJMo-VGJi6=*7(>IdjOQQg64x=&e#<^WZW
z(HL8*e8^d71xAx!RAlg1Izm+n*#)f(s-W#;JMvdRaaL80p%|g69?}F_gP}E$!rVd7
zvkqTi$I$mfYcq!Y{Z7VF-Rm&;N<z^44I%17>oGL1EBX!a4TZoyWekd8sfHnap^X??
zi>k&Ud!TnQ^ggAiu0T_NHf88thT;N*ZVPSB(ELa1UP6BjC4VBw@2LH-m7_kRvIwdp
z*#o$CP%4X*XwNw6vkm~h=BPh9fzI%y5zu=XL+$Fqn2}KOKVmoN7V-?VJL9OW)OW-J
z(33Hzp}iOfTdLk6FG2f&`@m8_eMf8o_cP{sXupvC(EcIRCj&yxKnI4<y#_Ik`d}~^
zf_{T3)dL~v(4mYDpbs+IhYn*j%?-mDP5nvz0yMSpA;wX^QojI4{Yw1>H1+dn#&v*>
zVKkjHj?w6MMScJ@oiiRhiZu1j1V&R|JjOWk>xm5hRZpQNF^+tEGNY-yDU7CjKEdeu
z(5c`_)RX#*{0!*Np-(aTE9i6vf7Kz>(~Q0box$L*t^~!P30DV7wg;{rbT;G2$LBDP
ze0DD5$d~6at}2x31bhp9mT}}S&oPGjo@`Gn1msV^!IrV#l=mrE6mlH;LI~A)F{3dy
z)Dp&Fyv6(szUFA0Eeq)ZeKDjLbUEX?Kvyu1?6s1?zXBsDZW3cAbQR+oLSF%|qI@c6
zHRBpV*MPNv%3jCVQqb2JNA_CJ*fP)!jI9ja$hfi4*BLh&x`}b{Iegy`!`6UqW^66!
z7O+(a?+A1o6IT)XCgXhw-Oj{SfWF1VQ8{ljan+$az&k?3Rf4_?-p9AQC7>TLL2>9#
z#*!^|F_y;WZYHiObPvEigR{_mOk7RqM@(Eb=zb=y3iM+pt}OHuCaye`Y!BkfK@Tti
z<$uNmlz)&38bCj10_yWa4F1J@L3<=bKz)9gv8m86!B>dGpMp}~0ec>Ll(8qE#~4fJ
zQky|QenrPX&=i`&1O=f~F0j;=lZ>S{(mjBsemKnp&7stHARxb@{sIBbKj)aB36$yt
z0vdN;GeINh1@H~>Deofq7HP6?8skyFe#Zo*p_jlfIEU=}D-%#Xe*@{ruZ8(SFc#%%
z$ynS+D<+r)#Yu$4eY9aL?oDxOBA5;JnP4U~6BEpUIwruJLGv;Z%z<WRf@h#v8H+aQ
z9853|dMks!@Q%g7DHa|)i*!N8qOJ6PLs+zx-f8IlC3p^6k_i?-(SBVS`3s?SKwYFC
zfi?g=kbVK$6AVVWHFOvlj&w3~1ViycS{oA%wxYS1-fJBEl;#e?qkJkC$Slx_jD?@+
z#~FJTI*AblppzMo@~1GgKc=5x#5(9yM!<LVG)CSBozBpjNk7e)oKWg_V5se64<M4D
zWJ@66OSGRydjf`RLiPZH+C+8&v@W52DT4O6=y^jJvK!d|h%cek*MQ>U`0Lvkw6{%h
zv{)>y7?k=Q$Xd`vjG_Laeh0D-bTMP%p-UKwW6>IwFj=85G8EgOwJ1SrM|#&MOg1PT
z1GL`NE5XaizXiIA5oC*37<m@@Dr4F~S2Kp}zlJf7L8<+~P&>#Tz-)%T#+bIy_26~n
z4}oq1Zy^0Bl+N3NH1*R~#(fOk#u&Qin_xS9=@aN%jG_C#9a0Ut1H6NBs4nk<50Ksn
z-N~3e&|M*Cpt}L`%!kmujG?}#-@u?wdS3|H>m$Zc9rrVa@~E!B(REb6Pm!j+CBHw2
za*9GfXAIrv5aY-<=sZAwC!&usj?Ov8IJ)i<_#Wqc1^t1c_g(!XL-W1<iJ_RQ{+V%9
z-em?~tqT1cBk0;I4DD&?tBlzIy#~^8FSHxen4q<Sm;_ZJt)ZH67|#?xjnN$HF%%0l
z7WlaKJTwy{<Dm`&pdpA0xf6;pLpb;Y`8`2<7v$@NqdH^_sSM4=h%!+4Zj6%9?2MrD
zb1?2<XwHz*&|4YtI5bxXm6JQ9EHn>8dnx8NMplL94JilB7g7<LpOGb?2@LHyn+QWO
zZxaQW&)fuPK~M-#8<QC~8Cp05{!H<~7&V~qAw%t}18xV@j>drM4QTys?f_IT__iq@
zasgU_q4#V<btS$5l>oKxTR`;y?qw*oleh$^9t3>KR1f(TN_8TxfSL?FD@?5r_>ig1
z=oV12F`%_stPN-f+(nqW4EeID$9NK2pV6nGR4(wy*T}BGv(QEWec+K#-36K;O@7pr
z@yNfLfxD4UenIuP2X&zSZ^_U*vT4P*<xr|0@W>b1F!ZdW`HSX1dWSRZ8G5%e9Y9B%
zpAFiHQH!CS8TShGUdFA0c426|ny!q8jxgOAHwD_Aaj!yqFzyLxPsXEh(2H?Xp}iTm
z8rp|(PeSiw+!|<K#!Z9X&$zYFevEqx+MjXjpaU2;9XgP4uR#Yf?rG>?#;u1AVcZNT
z`8seLphH8**B)dv*_ry3puQi@c;v$)7&jC85aTvNM>1{}bQGh>=HnUnBJ@$l?SYbw
zK~M<#7?_MST}S<kz6_{r>N_CGkEy?i?*R1?a4$irUx0@>$WUJZ+EX&rexRE|sm;Xg
zfa*=02UJ(!sE*GtZY6Yf2wgje@ot6A4Y>n4FXSS0KI5p2XBqc8^f`w1;3-}Z;|J)1
zkn+%lAwNPFGqi_q$nS}tz*0uM0$mpJJCynqh}BT)3*suEaY8f$D;SUJKy4%L1}`&S
z9_T8@QM>6Lz-@xQ$~fu+x(9G?K-Vyi`eQBQHbd7jj{4>`#%+PFXXNM54UDIu8$+r?
zslR}C8<g%%(7Z+W1D+41dk{2-QMtg&1l<}^8@i2ARF^kHT0plmUS8;1jGGUAo58<S
zD9jG<4%+xE^j*eLdGCc(fW9B{J@f;{k!^Q|T!!vq1oi9gkZVx#dmyM^_l8`De#kiT
zi+zlvx_`vb_YP)%$Zyb(8Fdx<2_wiSKV>MsYYs4?Ec7#mV!h@dBdD*)9)M!H<`5&M
zK)+xpu44{|+yniRanzSzF>WFB2;-<<k1}o%^cdr)kB>9%1?UOJQGcg|w1lQIUOwna
zMplEKV(>5i2#VPe^i4$UIeG^6B3qqh<WT52MmL0>XK26Le9btr=LJR%hknC2vMr5g
z;1)x_WgOW#jiGn6*c|j7=9Zt4zQoY`njxP6^iF4fVD#@$8rwks0{w|`G`8t_;K+CA
z8sHv*(s{tGfd0z3rBJ#zaO7WfKcW<%dl1w<@(Ccxp4S*pL9a7z88n@7@J+8YL-&iX
z#dzrR1i|26)xy7O!MF#Y`51?OPN>V+B2e@-Vd1L@jX-0hi$j|+_IBvqjJ*SjF-h2R
zP}rWZ6`*YyTM^n0v`2nbXeY+P?g>2@+YQ>2vG+rJf!;WO0CWLki$P&a!j^<?V{C2c
z+l+&cB<uk2i+~h<Km^;NuzkWFq$v+$mI%5-F=i7EAdO=Q7+(qK?||y{1rvM<Jq*qv
zzYmn|0Rmi;@HG>RfWi+G-~$1b0lOu@Ho*xYB7zY)p^~9}o(OD7h&oWsP`p247y+9^
zJceTb5zB~rP@kcFfJi1rzy=Y=P`o}8FamuaiDM}K9?8rI*dqdeAk@9kct&)9W@S_t
zXf{T4gx<oauF&j^fITBQ7}X6*?F0h0i`>dk%sY~c5d)#Q8H#^L@-Si$l==lw96XYj
z5%AkcK8E7rk^GDp0)=xEY9tgLO^7F<QHJ8mkwiw!g(fi+^Nkc>#7oeE48>L>g&46M
zn#@qVHBy)nE1*RfioZsRGGZyT7(;R5NO4B2gqC0^MjI)~2>4&*c1FDc#rP-0ZfI#n
zy$&tINa}BlH-ch?k+O`WzAwj6>@ZTEkz|Jo48;*66&d>OFH(t7-#{xflKQU-qb@=*
zRtZUcS&dQOLaQ^9`n3i_F~3MnMpB>EVkmAGsm)00zdIR<-$lspfuz19Uk4P=i;#Z<
zN$so8X!5}ZjHI?UWHk9>BSuoY8#9{v>Mn-9<BK$5D4rK-%E&g*W{f6VHD~C%vk2xl
zLX+KEFtQ!=9){w1k(La7j}~dgXtHN(Mv_m`J%FaNsazmOL8&aD={|HlkdvSt7~LI8
z;|<8k&`u1+2P2&sIR$zzL-E2$7e+n-?aJt0&~6NUa}=R+0mT+0R2HD`k0NwE&_kef
z4Ulu7y&3%gv=1ZaLhobrP-tI9&V%01=m(+w82YX#(x0IiWMlv%7efa!6pxGyV&oDi
z)elf?GD39%^!-tU>H#QD8KHXvxeZG90~BM63}fV*(BTZl-6A6xxgGitLvgqW*$L3M
zIT5lApqN}_G$Y@Jj$tT17a7aQJ<x|4eF!>^k$a(!Fcfc!jA!IW&_@}HKSd@mazFGj
zhGJ0>>LWnk;6$ijfc_FneF5YrP-;KW$D!m0Kz<4(+XH<9I+c;1L7!ywN$5029)v!{
z=u^<?41Grvd79DRLT51YC+JLuVos4+jQkn;3`23K2>BC`m!afCfZ|dS@*6;VR1xwO
zKr!aXd`720pJj9!^f`vUp@=-sD5}>&2LJlIh%90xolAZO@K>rLLcRqAT}%E1==+Wc
z`4AAfpvxHgrX%tqBXUDuV(8nG$Z|&Hfv#W_wQ(gQZiA9<0Yz;je*z*elza#%2PMA&
zA|G@$qo@zpFd{#c`UTK;G?8@-y}U(UV-zlrtY_$@BC>&@Z)zeN84-oP&d|3tkxh(9
zgucPZbm(SAJOJIos8P_ZjG(c#jiG(!2#qBmFvcR=8QOD>yv2xN(6<>i7P^BG!=djm
z>S5@+j2HoZkD>kQ$oq_V2>Jm-`__@2j2H>s#i;Sn-HbQ{-NVp+VT8sW5MMw)WN7~|
zvX7A+pfnDFE(P7s$d1sD8C@DmV+_bn&`%j%26}*zouM?YfW8BIkfCpjBcC(6ER^a8
z=sV*G)d}cw(8COUcO3bW(dD6EF|r%<2%{@Nk2115^cbTnLXR`D2lNC(`%94&M)riJ
zGPLIuImyUgP#W_<SAm{p<PPW=hV~yKXBkO0Jjc*pMC3d}-z-MHW@t|$a)F_57$e^>
zv_BEK$Vjr$w+!u9MA8`g&N1>GLwgsION=D@f6wR*&>t8{ZT*qablp#kq;~(zP%J-k
znUT~7zc3WvkNnC=>W|+TiuXsZFpg~WJLCF7uQHBobd7QML$5QAY?RKpeu9Rfh+>|g
z_+=FHLNqHf3PQ7iTak}370m+@kpD0=5fnlGL}*b^8u{p-Xc+)|nirt3U$hqT;S15)
zpgwF@1KJ2QgO8z}(H5W`&ff;@z)09F3O^>~dFZ{2gx#WD840^ZyMg;~EyhHY${LI`
z>KYxw7&`s{<BmaxGG;vVLB_!!qr(`A>qUn%?gVrMLvgI=LySv-j$~*bG&+iLuuGKs
z2vE!>I)-tlpko<|b3`9z@VE3LO7)nG^D#!EQ^3<g2-q<?1I$DIQ_%SUeJS3AE(WLz
z#Ymzn!CIsv&~;!V(y(uI6L<sZLD0=$E3Pd8-Np#mDN1DlQ4PAC2_`__VjRX$^lc`1
z6uN^6P`@a~6%kNhVJt;4J}6EZh2KYaAx-t&4fde?$Do+oqL|mj7AWR4Lg1R{M@&He
zL-qr~B<ROXK>hIvIDj&#t)DS26-xbxKA>1(^e{MrGEYOv#vphcN_GVS`Zr3p1i=%~
z6aZUMEG<g50gkREU=xZRMydVhkVbo==K<yg38EJnNjAis5KTjwQ=#860oe;<GK#TH
zai-{H@C(x98^1D=?D88U$xp8^v@aC>ouR#{=v9XHe4^KwU^?_V6QFMs(d@)H#1?*r
zW&^jNKFCbW&UmjwQ5NCBKN53-Takv3B<5m*C^R<{6oBRdx8WSvEio_1hxDh={2+of
z?375?01q}vr28eI4w;~IJ@7U|3o_m|Xdxz``zJGA3KVT4JoHs!5hkGe!bb`FBeV>-
z18J&5Sx_G5AB0u_m5@FRt;__}2US2-<il=>)tG?VTAlG`Lu)YJ^U#`1fPP7=#RSv`
zwV8nW@=hi||0dR9f~?TGjE6CnSdX#rvBdg}w;0-h@s>gxf<~y@d}w3Fn+v^*@n%7r
zFc$uh*c3Fw`53E-&6xnUNxYj0$ZjpbJ+M33swES&f)Z_zPj+j^cwa!fGWI9v5XMsb
z9$+l>{V>L&u8G6J2=qVI@gXn@Y1AokG#HCC?veN~7>6|Kk@yH>%R|RAb|~~w#!}f6
z0Q}dY+{B5DMY)L>w~3RGKL$D(pf4@TO~e>WoQ5=xC1Q*vVjNg1V+Lc}LuWF!GnD!f
z*gnu_7&{m`n{f|9=P;J~gKY3D&hG(zj<NSa$v+k#zaNxr2?A>462>b7CA$KzEOZ&;
zRfWFDcqO1OF<u4ea>gqKUBP%opeq@VeEDU@D-K=7com_qFse87RmLj>UCnsKpliTd
z)TbQuHO4CnUC&U=HE{#jh;vFpUuV2Kpqm-5Fmwy!B}2C|UIFNvj8_S|o$+X_zr}b}
zpl>r?b?6QzXbC;S1a$6ECZO_;f#dk@aUk?O6HpnKnBY|G^Ba*QVT(gZYsOblkFlRa
zEn^Qt9plrvIT-va{30nA<D;yk+>FfzjWF^_Xq1ugyQD;rg!^WPqWy%u1&Tf*4CTX4
zNwBkTps*|9`_QtCfbS+%V{A?+#t&gXgSKGo9w>Y(3H@aELtBB?NTVN;+JKHozX$CE
zx*)w5+Lf{B!=!HD5j@MjhCapw)CU+}gzFD|987`_2hb-N3tJ@3VEjzbnT($oI*akM
zK%Zg!e9+m9PklLu@iAW|%>@`oKK04VU=`BTuj{~TNcV(pVEi7?jf@X}PJ$m2es?JR
zEomFlXmiphj2{O*!1&pq2N^#P^f)+y^ZP<igEL6?fu3Xh7SIcfk3KG-7z^7Lfd3FS
z8EP5&_M|{o#=_nOZec9^pa9xNct1kXM}#c|MLP)_g~AsITM$~2@lHV-G2Smw*o*MK
zhxP)!kxql6KMSBA{l(CEjK2&zpYfOCwOlhke59aZ{5DXugYe-u1<@~r-x7+p5q>);
ze6}Fw8~<J?>PYyVq2n39Ep#&Dw}(E-_#L3|OTtIJ3x3S_@WDc8ClR2Z3*lHH*ukF)
z-2`x+KNyPsCw%x_@?wB?__d&`81F6Udd9B+g`W^U=96TUL->`TZ!kW_Q!@O7h~>jy
zlF4T%ALD`W%R@0o5q@Rp4#uwteTVU@Lf>a%`5zz+V);9f27W#0F2-*F-OE_?W%7rN
zUlWS95`GQnS;pG}{f_bb3xP{w_>G|+us9!cLE-9*4<9Mqo$>F2_GbJh(0%}A1Vy3f
zL&C>(MRG8HS!iy?F9&VQ`1PT^7{4iWJeY!Or$SLTB8Z3n%=iv^nei$A7sjWue`Wm4
z(BBvz<D<wG#=lL7VyF+{=NF<l`knA!#4-eJCH%Xg7(*rKoH|gPNB9Gvg%}@gEjgC4
z=#P?*FcSB<J)Mbz|CGwZcngGB{sI$>6JiC<A>2qIUM|H1n8#8C<2QsV5QmI;P_!qd
z1kx9vCBa>YgB66L-wCxD+LTdmLt!&Q?SwXG)LtmsMkvf%DHsnaosmZWreM4g8sjvj
z3!^(h(N01?1nm#TV;+ESq&x~HBfT67TcylIn(jM`@lHaY0dtVw6*`ykdP1o^%a9NI
zq@dpkOYM6Jpgfxwx&o|3x)t<g@Cwo$ps#|}NK<{+Ft#srEn^2k*MZk?&JZZZY{~|t
zCqglw6Lu=}b;eGEZUS#0e>#-<5m>Y*WeeDfG_?a`H)T80)Q;U?AJWf3k1`hRNjb(?
zYR7SK0_RXWQW(1mnhMZ2mfCR&oI#rEewMM+Z$AR~dK~PRYMJ00DEyuXE<yt)4mM29
z4C0ahEi@|=cMtRykOTRbpt(UFq)~Qi5-5N)?vYxE34VbVXM$g$B|s(kJldXG8B{?U
z?Mkf*Y9I~Uq+(7<ZHx3SXgkmmX|yjDev=9x^3kSL*qg8@EA>6b+XFoS&_8}6l&%4B
zEum=tNtBn#gQB1R7i;GMUq$f+>Y2R_5?V+?=nw)4MQR9L5?TmFdXW~YbOa$(fzUx}
zLN9`V3Mf^GA|OQt><tkR8<xLHRm4Kc-MnvRZ%YX1`@QGSkDHu3J9FloGj(S-KV0Bv
z;`4_u0bA$64mYHQ8nbQ~76N<Ruvtjb->_R4)cFQ^DQua1Vo!zb89rSWL3jAXt_l~v
zx}ov{ahgwTtB}O#jr@R3jRkxbwouRC+z7KU4)7UaVNkalrJw?3E#xyATJSURccZ0+
zV*sB?@Dy!f5T9c$oW#+MaTc!ae5P2qRQ}^FT>s;9f`#h}pA+F}^d~lMOto++TTO%M
z$ZztQ3bXk6Pd;Z`xNh+|$HIl*Z_Kv{?#!pE=Q7gY<ueV|;iE2m68DNACEs8XjK6O@
zYvEG%+z8u9-<MBS2mBp$kI&C7g4^<W7S54o7@zq0#<%=Dl22tj$fJC#{GnoFoDhE#
zKMLn%A<Qg`pnN>STU{fZ1^KK2b<lYipLL-XKWFecTqB%C_#B}T&Tt`bchCq|5TBhi
z!bKa>|Dme@SrTdkI!pYd&aKOpunSJYPmoDmgux@w9C||vEQS~04LA$ehygp4gxb&+
z2EiP77Bb*N_=&kY>Fi-p84`fDruNP3^I#La1|P%EU=l+`;1M9+9GhVu(1skBfbX4@
z>1+hOVJbWeZ@|~^Cw8g<Q(!r~42SVSEVO}vKz!v{!I(uE>RCkf%zfSy_?0*g;yU##
zNf6fsy#*KHE`FN<^fUQrfBE_Yv7L|K^V62{(>C%y3SD6o5R>_dr~F3%9~YpV7bpfb
z0Y4Vt`T~<79bSSr;Y%R43+9DLs1F@s7(4@8;1GNUmxU-Kp%~Nz(iNgUg-*g*xF$ph
zHV-KYwSoGD41%e!8uq|3I0rX`DC~slFc*mT!tV(Y+5-9r5$1w2K))B(9)>_Ftbx7U
zMnlhV$}f@^(7On~7g4_tgPE`nUIE%c5$qL#y&|wz1on!+UJ=+Uf^s8h4@JvDJ?H?m
z)1ueGEkv<!s0!#*44sONhb8bL9EC67H*T$=YjOIm;^<nuJ4}Q%a1hSJKip=E0P0$z
zHQ?_O_`3xDF0liMffBUe62A*kG7q3nN%Sd+J|zdkbijTkv0us4@Gbn!c^>Rnst8nr
zL`a4SuoSidwpM3{N?~h#R;M(db%1>JJ@QF>QeS=ljJl}%AZ2V&0*Ko(#BCYkR_}G=
z=Q2A1d#U}{GPhW}2SXGzgw8MmX2S+J03X1QaF4ZFC{%%FfGs1jrCzUY<P#f3V#jjW
zu^e_P7X$dP96l_E56cl3<-UhItVx<c57-U|fw+qz?#dH)<%zrU#9jF=FcRj#de{e_
zGDoM}3Y1#`A6CGJ6^_D3@C{J+=$6nICc-kHjOgQle$nU`<AO4PZ7br-ii_ZRI0B!;
zRp!OPPy(oHr8aOF=({UjVV-Qj7B~c-!DZ&c5{f}hXa)UYCaeSMUWK|>`5x{tKMsLP
z&;)wGQ}7IIfkW^aTxRYpArk6CM;Hb(VI7dJ>U;1#++l7_p4BQr6X*ftS?w7is#DkM
z)U`VGtd3o(cZVU63fQVfeIV}|<Xz)KA!-t@HItwpT;|oE=|J4Y5~H!iT`X}I+YSc9
zbXX0q!N)?>ZUyKS7X#Qb4qL`y%Q`l|mUUtQTh<u}Ps0j00B;LXw=28>m*BP#^$I~n
zNPx#-3@m{60DbBsuTKorr|sAOM2H6H)d0O3pjQL*YJgr1_P}ZQ7XIcoN&$$5#?TF(
zgn6(DUW1R}XE1qfX%VOfiI5BvU@2^aV{i^`@Jdr``Y7@F=(CU^L}TK%G5uv@`pd@j
zmyK7#E;uPfJm1ChT|D2#^IbgO#lHZ*2$4`1+5^5xz&8nNU@yD_-@!k;4z(cA=QJ4$
z3t=k|mraPvCd6e^;<9ORs0EbMlyaI<PE+jDlroxT3DGP9szXcY3*_C5yqmk=30@hH
z7l^qQ#6=6@q6Kl(;u+Wi__oDoa9M~%38YITT_Wiche0Z=f}Ma*6TgC6LbMEqC};?z
zZAsdeGhrRP0_53}JX@k)681>SfDhpZAzI;+R`{e9K51P5X2S*`Zd!i;SA}R}gAx!6
zZD1fg4Ww&Bx;CV1^CR35qAfOTTLB&gVy^8dAcop*gja#IZAshqo)C|PLKSERJpemC
zh8^3D6rw%4w2y|y&<*H+I>f_CAvz9*>9891z-jmvs6!{N>r@)>eWzVQbnXDRgy=F^
zh^~w&UGZ<%DX<(~hPU7%{2@fQ#lSV)v0e8qLOfm+s=@2<Df}wb5lhjd2q5o~2+1%3
zxV8tj?ePW>FFi=xle9g_qh~!pkDfzeI-qw?^zMn?J--E0h+gR3D;gR>7x++!-cI1U
z-s=Hh^{E6+044h1<37YgAL6*rUU)}{Wc<?i5oiv*AqCK@FM9PwufAu2IPS;w{jh(3
z^zTo){-o=FTZjSpY9M+HoDbAt5PliNHG{4R@q`^pLTzXZgJ3GG1oD64FmTNi<UiPe
z;!q3Fe=zkPJP$TO27CxVL8cHx3Inzrf-Xan0b341=OOrJ2)-F|Q;4B?AqMdOP-1E*
zdJbIyZvbTus|)R62w;<8w2@&ufmj<J0<!=c4&M*&1GXG~SBMexaU;-c1il_|5Qx7K
z|Ks>;Wk?rdloLur9iYymsPic5JnC7X9;2wolMW~WHK8S(0>;TF{}N(!FhoH^=mq0o
z5o`crYD{%FE5uXn;2hi#{OMYt%(25^2GDnmqrNG$m6Qdr7WTora0&3+_(D(-sL%Mv
zVG^L*gji?=ePO&16Ulobc~7K16De~d^_fV0CN2l;JrR3PB+rR|3o)qxl!pe;3D9Q}
z`b=64yMVNlF2Wx|Ob&u_K-$Tqojev6!d5se#1!g0<#~7$K7-3VA}pa8V7I5y@#+3B
z8L<1)+l81~3aSDzI2GGXy#T*+<bqh5hHa;>gIC}^_)>_}j(~i|S|IJrL?E7K;@er+
zXBPFHwFL0ZEYi)!H?t$5J`g*ziJjTR&TRUr*{=#Q2fxng3gkUEjmJBapdVn{dFuBa
zZ~`c69(v8s17#rrIsmb>fOuGNUWjK30(m|2t`G|gK|R1Oi^yxy5g``y{o)uPz88~j
zG5%gW7tm!fx-9-kh$Z-c$voHuuL1sD@)KkVu`~=Gf#$FjUI6l6M*Ws8hW~+Eh_rCP
zrfJwT4V$KogJ%F6r5yrvP9tsFJt5LV0G-m&DZM+4hWUU_=?CBg_z_6E9Nm^zfhN!c
z$Zt9Mt)Q+eDgriH@i>eD>ac?LvtmEI50`*=TbU2aLnG({T)*-&AXZjMC<fJ`1@r-Q
zUxn_gC~FmISE2hVbYDe1S7YDR<AJzaP28;^=GW8#^j?GBYtVZQdap(AwdlPTd#v3C
z$AI>@7Q3$N4R631A=VFpFW|Zm8yrvqVxbKTgr{Kzyaed70lhc;0_gHAWjvb#_~BXn
z@+^5iOBoyS#m449IU6?%v8ga%<4xFj({peTsM99$*_0*3b6tTtJx6^vmw`?|{A|7@
z#1``3f}UI3!XTImD`6L$gs<UGA)d#^&zFZr&;_{edD1<f0cYV)AzlcB+Rz0?0``9q
z-@S<MUR(fo*;{S}6JR-DlkH8RC(uW1N5Ab?h1fxR+p!F&%MR-D68*_b{QlB*xFN*L
z^`RpSgA5^d7KC^p)^_fNcX&h#+wCHrcirUix^aLV_VfaN-m^%Ez4?K9?;8uh>tk2q
zmBxH_1AgB>1<-N-%Rqm%|04XsE3|`v{^~#j=mh9}U?Gt1!257Th>Rep46R`}%!0M>
zI(!P`|Ed$P=c~tscr7mwYX`CIL2P&M8f5a??Ufw)c?5{J!_?<6@phPaJ4`(eQ;);c
z<1p79A)g~-02?169*$7X5z0C8t3L81-YCjv4M>81Fdd$S!*Bs;Lr24)7Ic6oVGe8s
z@;Z7}h+}PGF3^UL9e@wud-z9)<JkXr4B&&~_~7^`m<{XT6?hLwd;E?NCqe+bzF8KC
z$v4pv^NP37@hx<Gix_yDG;b5LZ$AOFkGIp|C3q9Qgqs|H!e%EUfmk@%5r)A`pv;rR
zz{yka72Fcy)KsAC)8u*j65JNzokCC%65w$d0}Eg?Q0I3(h2MpEmvryefDSMQ(qJEa
z3cm~SULGKy_sHkHe(=5!?+=1c;5Q*YC=T_2>pu7yOd&o@1$6w7G#?QMA7Ss0=D~-&
zvb->Kh7o`bKVAVl;Rt*##3w}nyM3|*4#3+&d`j7$z6KuyWqe8*pS6U(FcD}spB)$C
z47#4_4JmM*Z9`)C^G=W<#M#>Lst{k;0sno0F6Z$1c?qrH0$dT|LIpU@Yd4w$v2c;!
zFVfB~VvDcZ0I~9Q5=?_tKtJ{k_4($Y5Z^uq=<*%;efK8!4_d<y?57W8-yEO+&_#$J
zvBi)0>L>L2=_MfD|JuV4pp2il2=PlkK;K_h!yaCN&=h9DZ6PjG?v-$82)Bf|ik+?n
z0kL@vJ6^*+*Rjj>FWIxD4th^|KA&p<-EN@gjduY1-1r6l5#qNL$bge@7Jh<1h4|eG
z_~Z9#K%IXd0Am4NZrXr+Z<6m#^1VsEH_7)V`Q9Yoo8<e43yMJ%K;J*G-ygkT1UwCk
zU<2%gBk%!y1y|vo5V!I}8K?=(peqc4$-uR@@Xsyc>=rh>MeN-AA5iX}l$#Ce^(Q+0
z6$K4pA}nJco4Wl?-TqF5kA(P#`u)T8w@Gt56}AHT-u_#NJ29|Bh`WynaSwg&H38b?
zz5ehN%!G7!9&QMciSIIrx6Dt0Jl*)rT^)!G_dvjpZhYq^*38mC8#0L_a}^MaCic&=
zLl~5Y+JK%}kHc`F&1WqI+H=-^_!zDTDV$Im>Oeaf3R7Se?1uN?dm*KSO3)m7!&F!c
z``|6OA*4|NqM<Q74r5_4Yy#48FH;(S2x%(@HK7$uf}QY-koIzb%sv~C*-yb=LOR&*
zcgz)%XD+349#Ag#<s|#yl5;K6c?rnZWe4sRxGF*eXbZ_O2GZdrxF}?v2xt$Rh0M!s
z0NyhoInybF`v{q@5R4Que;AC0uY@en3n-%?buV~9$U==^0vv)nLWW?w!WD!JEei+W
zu8?8;97f&3UKcW)@55&b$-c2HG73HwGNLwYgdc@0N_j=O-%%7B79;Osq%HQWkj42s
z!Nt1*d9s%)OH73$LY8a@*rVh}LYCqlNU2o7emv_Xc}7R_jDRc?1xdg)WzGs&wi}>t
z*?)wL#P*Tvg)CPF@J~6)j-s5X?}RLm&B|ko@+Sb@Di9wPssVXbz#bLQt-=a;5e~w8
z@D*H#EFq&qfU=|Gpe6JG?%hOBgJrM<s894MI1iWMo{%xrm3>YbgKja+0DWSHz+_ki
z*eYf(ya}Jf|A4ww#HJNXKvjr`jxZ3$1NEr54v3|SN8uCr9!w!CwSpG_{VP#^<;UOy
zA*<8?^sTa0$VbrWk)=RvRV@nml08dV?Ipm6)vgFxo%&YCX4U5a`c)^78pKeI1n2~V
zfLN)q0I+$DU2qJzzQzymr;s(VaZU2CSsCzu&34ca#sc})Tn#(mF#IfJEd#<J8YrjM
z03cnhZSXFjS8P7OZ?PSKd}3F^Yj6RG&)OxSF;GtJS?~gUEMy$%>g*P>UNNW-Jzz4d
zgF}G5>S2%i=up2fl!GOJf9i8xee7KSBlrfcgImZ3`C%wb0_@O$vKpKK(lpEq#7o05
zfF2F;)&DDvs8=K6z0s2}9k5@cJwiTO9%jQ2LN*Qs>el!<$P_Z3pX1Rj9^DhDSHe?(
zkD3sVP11yHS_i%svKe_d+brk?0oyeveT#8m3Ykc}C9Z+(K-)-s2Z-^+Uw~L`>4FG|
zfx6HVy2B8d42xhR5JxS~37JG(B$b5*Kz))%!&*22__!5%w(1G^y>$gZx7LH<xR7ls
zLOQ&{El|pBTOU3X^0C*1Y=^DeWeM4yxNYAX@Ok^cgzQiXl7aj?1wk!9w@%B1?2H{c
z<HODygzQopxTY)mb?pPM3)#&9)nP1bhl@gX4}l~|g@bTI$j55~b$uKk^w<RG(X$|w
z0c_H<Jy2#(uIaf3_QE^x9sDC?FVgmkfq3W+qhUTg2M6I3_yw|r>>UBsp(XT%iLeZ|
z!*MtdzX{pL1!bTvw1**(3Tt35yaV6CKSCxKgcyj2?l2nW!*g&@$iB;9yO8}-U@;Ku
z{oa7Ha81bmb|?whp+ENTKM1D6O4tP_;cNI)$N~AFJT!tXFcRj#vycHF!cUMX<iId^
z1e!x{NP)%h0=xld;TpHX?NAbGLt7XGQ(-0Sf|Kwy{3+xU`Jg;Bf-W!;=D@R%0UyFo
zkSXL~d^$K?$RReMKOPbbZGgUb$kVU_Xxl^HhOgk3kVAtZ3K~LZ7y+|k1H1y*eJFMx
zN^B0J4;e<<VZ<@}l5!Yju`elyM?iIG36wGXTOmi#kB)d1xPAov{YVLsz_lYg!Z4T#
z>wt1b(x;77>Fx+Qsu<LSR?r_N17(eR3EqS+;iiyJ=7mV84;^6`JOf+c5PSxg1%JR7
zNH>~vqe(ZKbfag&I(P-%gYShLBcT}7gjPVhF{B$qx-q01L%K04-5nvH3V}+{1bV<z
z@C<B$L+}|~7ILhFVo(!WL4TMG>F^S~317lZA;*OP>BeElakS}ijGyC{z>9DczJTjO
zrqIq)=xb8&SqeT&!DlJ>ECrvX9DontN4O*8c=8-y3CMH&K%ngLYhW+noALN|e3p<C
z@Zkh}IDvHRugVGdcfu;bzZ2euui%!D6Z1kO)Q65R8s@`uK--)63H&DHBo~x{y6_lK
z_N1pF9kv7YnM8diQJ={+C;_q121q*@JtvcPGHE9thx0(bQ^<Ep473DnG-Vttg6H7~
zd=6Iye>NSWpdoaI5ik?hz+N~7U%^cwr&6b>)M+ZZPHhiEfcj4*?NriEeFwgSe}tS?
z5Ga2d<xlGi_-GnFnnwB44#6kzKe#94^b$awrc<Zs{b3?3gY7{5r=#n1be--NGBp%h
z0Ch?w&s1!mN}3rppef7%#+@1a;Vn1=j6X9CC<%;>Gl#=Q*e&EN^qj@mF{?E&KFy-f
zn8g@1>s`12zX~}!9I684&h8FF03ByP1C%rSXSglooJXKBOat_v^EP}T<Xi_t0P!{V
zad-phkLJ=J&80t@7Y1BAuQ~LF6j%&f;dNkapGO(<Od;o!c0PT^{9b^s=Ff%=@G79|
z{JTOfK-UH6x?m0Lg;PR4QxvKJIz59u7q$oNwh;XmC4&0AF63f#U0e#{0NX9bc1zG}
z$qPa*4F_~uRs;qLnTFre@PFC?_&`YZjAi;eLN0F$)MNQ)Lavwv<gs!-+!Fi|WSA@D
z>O6o>t4Y85OW?aT#PJ&HxOT0O>!M&PV25?T3%R}@d<6d!lKoe?fij=P4$n3P^4myW
z8y5+=2|I5(DCBe0;kiwKO*WIqX19=ACc?);Zhb<?=lTBm+d{r@o<B!Y1scK}A-BcC
z1ega$gxp>oUJ-H!`LdrWU#bY`_tN)5zKk7S#`Z5C7jkDb5L-Jt!Z08<cK#^jF53UD
z%|h-j1f5|Vpy%%Afp)MP8|@~q-8Y5YBOwHclRaFwXA6*KFZJEKO~`$Gw{N|WuVCj_
z{uFY*9ZEuNz~=i00XExDefQ(9{cpgB@DpSTd4SkC@CY=A-jD*MJ+Mp24CEOv!JF_U
zpwFv$ArjE#)sDbi>ox5C+KWOS#6Jgj2>E&^ArILg6wv!n6X*d?!Aw{OufTioJ&^BV
z7nA{F>@amZ+#m46VdC!yc^xSRlz9Zb-pB`}djp#v<>#a2p%JtN>Tq<YkjL=lv3)`w
zZw61oAt6r;fjdIJiS6Gi4d;Y>8(+TN68geKSOV1L?W6DoTowFTYG?qhfqYJ)_eu0V
zC7~El$5TxJoliXjTY&nVBHgLWK$)lW0%=cI0(^Cvcsos;oF>21q&rQzcliFD9)KS2
z%!loO4c_?${t@zB7eqiR+!6A<1P{dJd(`#)xj=sJU*pfjP_GZr>4T0iP{<Eyryq8J
zba-CKk0|S-nm}G3;lqy$LJZV}mM~h#PYghxPlf?`fAXD>pLPL0KO=5FYX#FG1HKaS
z48Ax+%%5ooLtzpu1inAR_n-6q=Z^w;fBp`93Do=ZJ3^i%ud~R{u7Nk;M<KtUu3y9h
z`Fybv-Uj?}j<`D45UAI=6>wI_^Ymlq`T6|oLSCTW7j_BxC2{fPRv|As0b5;M3Ev3$
z71w_C0#NqX#LL&~;G&S<1Ow^5nFZeq`7N>h-2k{L<R$!di9YN5sX+aIhy?Qa0UdsL
z9<ce3<=|x@f3gGp#ZP+yegBsN_k{d~zTlUyf&T1Qbo{kHP}Z-fguI*tJz*rE+hx+R
z?<ueJf~|nASMk@?mxR1VIoHtR+F~KE7lYc+9J;_}_z?aSlC!|_2C^Hw;F6HP<p<*U
zw;}K%P@ms2h5WrZ)C1bd?=xUMyd~sK%DKr{_6I)ugSh$QT@M$9WUo@*>I-Rrez!8<
zW5FMuhcF=4{`^76zg&Qhf06bt{P-8~@Ym10R^$;F3|#;BA@~a1LjKbe@Zs%dfIhdE
z!9HNzxg!8S-@zAmHo|*C-YozvV6Bk%^1&1#GtnWFSjzldNH=A>xAQs<d~2q_mqKRY
zhpd&t5FOzsVaO3M4c-=p(H{E4AuxquD+J}B7Bq!UFd4RhTNw6&kOW(S^p5WEsxX|T
zpgJ^x&M*+h!(8|V?g+z0zAo~0HHU40-1VC<@<<4Umaran!7;cB_k@u*Kaf9v3&!AY
zAsD=;(BQqtMo=&y=iTf^P%G#Kqky^wk$=$Z@V+pD%L3&FQ*LlKm<qe$iZJrULJN3V
z82PCiXJd{0JB3le0o1?1Gw`u63X-NE*A+YfS;8nZ7-qr>cpk7pp-<o+VT4qKF0fY^
zh0(DvIu@=6tzjB0f$hQwCI8TQfGtChz*)E<j4<>Fs}7_O!+v2e0P^r4s0!#3-VfHo
zKEOsr;-Cj)2qOX?Mo{O78jt`Tfb<b#U<RZC{*E{Ye+Z)}_A9y+h>c>EU=n;JjN*AA
z8PK8lCO8O}fNM$=2Yg+kGhnk4lv@HjmH1T{CDEm1f0zOb`3vbuW<T3)SAwvK{31kz
zi%1b8YKl0~P_!h(BSRu(cw}5u-MGl`SX)SBh$|{CR`MAY9vc@M9u*g(z74OSep5-p
zL-=0HtZzJ0+iiCTW1pEvCY(QSp15#9CM29Vk;Sgi34Tc6w=8jDhIwK}Lc$E0Fyn+w
zNJ}$Mj4}J=xpZ43B&0S;kTXb48mX=lGe|Qd;nL<A37ZoV`pL5W5-uh1OF}>Xrx~$b
z@95|_qbnq0Wvq;n(a|xnPNz$TqGWBO)YnG&cg>Tf9;;ivPW$5KM~Q~paprC{TS}+D
zj-9yEHgmDuylq=nmX(of0{ifW5W>a#{-2O3KKU@O+<8MB4UjMN$*;=txyrA|4|0<S
zEte$%<afRK1l^I`-SC#1=Nqp)ILa$G+d5Xcyy;`C^uiU~-^Lvc?{%)0-s_y##g_r)
z`1B20DIc}uDnG{=Z~7eh_|vZl)HjdM9zi$6aDV;*^6T<rzue`^$9YW*2#`PTEjK7j
zmJX0l^vTn`_H+NP9PN`gkXx+!n!U2g)8)r^5`A{?l^e8L9`xs*=e#$c;3~3QuJT77
zAg`KDe!!PcHLqOh<Ew9s<!9n4n_dCsSCmb2Ex*zO<Xy7K_xsAP?3L#zU;8;{`Pk8^
z;@oQ|pIx0ncQ3txbO6mN)se~Lkw!HkoI$h7eC?Bd?UT-q@T7IV=J=Yv#E?(WcAP<T
z3VY=rd*s}OLq69hKkShY)AD&f`CA@2clt;_-zN`uMXCJ7NiAP6;C)LQXSgdgK>o~t
z!`>SCJmB(2y6P%&X&HHy+*!n9NoUZK?|CFe)Xr*(bSXcno{}4NQF)D=y^DR4d+0V}
zZRUX7dKu@^+ZnF5cgE)0+gSEJ<Fn-50?J~Z&Mdoc9$1t6`>FwE;Q+72<o(&mqwVGK
zp8nSBJ^!~JFPeq3d6DmJ@%n0yH~Bu$o9g@S`g@O8`99FA(Ls1sxJcDZ#~Hdg1HG%R
zZ=<jGc$x15y&N5cm(}&$1yymXt`GD!*Q;-c5|7uZT|obk_h)&LZ>86!3=lbnhx><y
z?4Gg)7uP5Tmx3ZxT^$+D5a}VxGrW9gAK<QSY;q4U&S#G6<DNCo*yA{}!wlPD7T)3L
ze)lE0dDAA#v#wD(_8vtmm-D)<g}2osSG|-azhbZJm+Mxl<TjBZg#BGK2^FP?cM%&B
zS*u8q@GyqC@Y06*jH(b>t4>_)=;)}(IDS$;Mnz^Ag`WLjVDr&U5*PIu^7TG*qfFkj
zqV1x7=31H5VOHDu>E?dNnGpv@^_$kZZ~^<{TgQ*d7`9_x|2EUxZjK-KSpRt_t_yal
z?zo9koNjEfRxrctr4$N~uhHFZhPfzE&hYcRmWNpt@TL!Lnsv=QD(s>Wjqef_3l?QW
zB@rt`Xk6_&vCKBgIm5$4|64U1tzX}}SF?m~|Gl>Mo~_re-rlrj(!Fi}sp8rLRNQL_
z@9)Ibl&ouxp^l#g=T;o$${TUD3zv_rRoaM%s%ArXd{VebY^}yd-Pi&)TfyVz7dv;#
zD#xFCZ}W(-V}%|YJ+IZg3)53C%xyJq^kapNg^t+#Uf3bo{n~Ze{czLNSI0e;(xKu4
z^Um>O=AHSK+K+ELHe*IJ;*m0)Eu5=}$2dYe1Vhy-5)qEiF;<BD7cK0ES1ygLU$9W=
z{9W3)xBmx?Y;JbFW;^Vw45MakbI85l{!K%yG{x+!tb&_c>2O(Z*t7mpa%C+Y=UVQ(
zVieV3lta#FIW$17!p_Pk{Q>D$c+;zLefh@(>2hgjx*Tn}rjDVyH?M@hm?l>E7i-B*
z#_DbE;WFYs80wg-?d^=0|IIqY%owbYY{iVMWiK2aX4s?3RWo8@OWR^=)hQfT+rX6t
z3|CZRoAKUpS!L%=^NXA@bDq#qF%vd?^Lvh;51B7ryJqgtLDP0TK_gwqk4vX7XuPJ!
zB~EQhL$zo}TUuPW;K)#<?k%j6)sL1^G9)U*m`g9w`?cRDjQ?e~xlqo&DC1t-X1-+x
z9ow-;+Fv~&<-#5N%>%z&Hebn59Va>3RBLt)(ycjCHH^TvEFV~sr}-LtA5>sKt9?+}
zRs(gk)gjPDhu#Wt((0*HeRU6J$<t+uw+B;pAjG`#8QvZ&P)-lF*dq_kCci8h{#3bU
zQlOj%L(h79JjW1hLH;E$OYp=WJl#m%1C~^2X)_%hOtQ4kdw>UaEp1{fIsNSlCx_bz
z9lU05r7f#Ef8RiqVO#93Wo&d0G|sDGr}z#t-wrD`dn;{=zN!@GRq?&o7TM%i<bvGf
z)Zs#aTun4|J}io?$+Ff)4`){X*Tw39^lCV>(ytVE1LUeXTk>>oxn^7YV(kM<zCk@=
ze!u=fE3)b1%b&$WnSlJ&V#3NNOMGR?&17XYpM1R>@6TUP!gYEc=w9Q`$1mr_?;g3C
zlr5j-;yX`F3<;F8I861(Dc5Izx+7IC-t^gn(KAr5bh*g7PI=jPor^__CswswExNS6
zlrzPr?*PBP!Bxa}K6$GE`6CaISIs6@iy6xv)x2`0r%xXiGs+Ko7J$BVs~K5M?X7gT
zTF}$22E?XpYLtAz{j>R@KSp&=dCV87#PvLCR>F#Fwi@D?U}@|nGE<C?3G0pSN~(9+
zA%ET>|MZ16E_EtZ2^BSy9zX^$qOYVwV?KEIglF~Pc%BuElK0f|S%ts$q~EDm8GR+!
zl76;tmGO%u_slE(tC%d0{5754zlyo)k#E&<|0?E|NB**w>-lZg94hLjfuoOV%ouS=
zR_}+_z|-V?HMJU@KlrmZ>IXGaUwSL}JY7kBES6W#BRyS7hHb99zA@W9O*zNd;bx01
z>ld@DT_r52MhaV85hgTs;zD9W!kkg%qM4g{E-e;PCb)C_v6aip)<5RW#Y}$A#;id`
znO{tu<B-g@tXw^9yT0y^pV4MWmotbdHhM6S!&1v133f;3)5bgQX~t|T3d|kG9MY<3
z!z2b$ros=Nd@%`*Aez)DYYTtJJiB9utayCFM_WgPos4KZY)<>x=ccD#d}jKI5%tX$
zMx#yU^{~UT`&BgsOPqCJWYXA9Rpy&_P8>7uE*NoYUhuZ(51GHOLVs2ETY8Gau~If(
znz7l%hMb<9wRWz=T6O<#CT9U!+K&g!(02S6jcr+SwSS5>{NDBdT!TrvRqGls>9V$D
zv{eJ-E9D&Bn^<zydt2$#jl!1P3{_t6%AJ?xuR5S}=CdOA{F$72@=@N@qlwPnd0mzz
zBD6)dmn#Sk13%QyvEg9_j0(0m)p^+LN6oKt_w}3;LyA`)@v3~hj5*PG^nvbv>a%5w
zdhK7{Jxq>2v&|iv&F5<Zd~OTyd7PU2{P!t2UJukco9Ea3NB#e^^K-9{6#=?FxkP{^
zzdr&j`TY@~<+((FmHz$+u+rZj0hZi~06pt*G^S4oR$UeI9*E-KjAOO}$Bt$G;W*=-
zYRtJ?&DiGdiI=vSeN}4Wk*z^G_VvNi>Tev4byO><i@J97j*;2qE3(N|v|H)Z4QZuk
zW6hsCD`CU#9ka<tb-z~nG_k>xzInFvE9Im++#JyZ)>-Ogqo?3}b7Wj-K+POy?=GF>
zshxf8+O_wF2G&uHxMo*vk%EFrrOeSM%YdA02mIY~<{zFc@9&ng88E{<;rI;IJXHx!
zv_EG}m&_AR;WMl&xP_g<l``0KMnF|!0u^x0aL=2OS<UCF&70LC!C#&liL$Qc>B9A;
zRP&CGj-&NPd8!bmM;p&@<8+Q*@!d3PL1rhC7WC~myZN!FzX}`k_0~7s!^v}`u`)By
zlgpYnU-qOi%RT*tub=e#T~8G73%@hiJG)a@jM$QMqTpPsCkk6~P86J*^+3KQ=S0Ev
zwI$CvQE>g~k>{8wxGs6*IVK9OUp?}GiGtG8)lhGDZjo*s$G+`O<Z8RqE7u!eYGUE|
zLr*NW+&{6%wZ^zjN2XIntg;MSYk?L}TXVy8$(|__-v?SkeLq%z@0mK8g|k_N@9lf^
z_r9&eY?e{qv+ALR`nC?USx9}qUw`kJQjve4rPTL__4mH5!)z8)-{;rgdo0KGftK@s
zZ*3iBuyq*Fve{TH#MQd@k!;`6Qt8>FLgd(E)<V|`F56nZiWa9x>Jq1D{+KfBeVRpY
z-5F?kP@4Ig>I||zLEc|a$SwI*^N8*wiXea1$|n(n1UJ1=l+=HjLyU&Hz3J4>8(E>c
ztDzf|V|7<%$**ROx4If~DHb5VB1-B~&miyOmj^A+8mZ+x|76s0spW(>{{mXh^Ik?p
zJrG;+>sghx{3i0afP7YFEmd+6Znl-L`t)=LZ8)gHX*F7=>j|FDB`Ey?+N|(s!w!!j
z{kc1@nFn;KKOk@JQj0n(pRBCWy3~>6zr&xNzs8+M%h#E`<Vv45bkMxqTiprTly%!+
ziD5X^yZ<cTDYr7OCSQK1!5NEm$8ajJV|b7+b@~r=hjA)rhhd!64f<5h4#Qr^lIQF&
z>=ixo936%|%p=dyVc1K0<T*MF+i2ZkoXXi@AXgoRS8jC}5AbHzgS<}%V?^r?=G6Ti
zOm3D_sRAvWyCrF0tbc4(u)G@H>HF1Woqxl7%e>}4#wX@&nP-Q6){Y(brmKaYPOO{O
z71iW|(z1qVw`;j>T9*8(6;|HN2_Ge=Y4xCKiQeWARisDiqG_GfL1N{u7E3x8c1)uE
zx$9uF<X6N;xye}>mkN-pre&qSk##&ku5Qa(^6OdF4n>Y~S)|2V>CLvbC;fT`ZIEMh
zuv+QW>_q27kms(?3QM1?yUN4?`d`Z$6rhi4Tvk3=f;qR(%04^LxDI*r=@n=<%KcQ^
zjmBgDNH>Nn(h64JGTZ)z4%RF3Wo7?>Wp;=qH-6S~|1!IhM@}I6#|C~3_sEr|PIX(!
zYP8N$9{C?y?z>s&7^54*6{Cfg`$kXXsxf%wR^R_X`)j-1=dY|r$iLH#;fk*@gn7FW
zwU?zzko|SZ)<%RbL3cOk@3XL)FItw@aZF<vly%Ma4cCV-I+tTE#QMO$;5H&p-9EN>
z+}Op({t5f_T!#(|mMvRguXyjmxnIeVEA7XXk7W?$su}Ki?K35RlN>$r;HE~XSY)MF
zB^geYKIiX@c4~eQ!*zK@Awk__9JevpGS{;^TLh;>>PlHB_KD&3<k36sIYDOFF`Lae
z>;B&aW1f8ZgTxtA8p-e7-DD<PlBQuE@8f>o_<LpM1WL+a#YoO*%G{TI$;<M2t${94
z*FejIR>)$y207%;EAl-{&RjeoAMQ$hsH2g)Pl0mwZZGJ4Dx%cM&IWa3WLI-;HBnWk
zMK~_PR`(#cDR&(EO#b|{`wOGl|IEB!I?i~es}qf9+|}H|c){IU>wkh9tXR~}ohsJ;
ziRw@5S~CSlFUM7Vn^5Omr%sUwS2TxED8R*frLfVm;ld@2Th|&?$LwQ_`PmeQnYTt6
zvzo+)J+ioLXah4o^Als&XJ!Reie-QNqpYFlA@=f=>hP?B!ZVH;+_<}Y&buF0UYkzs
zesRac8f}%S)kT=vl3$kXyr#C7cNX=^gR4uPw$)YZ6__5APE;n%GT8zwujT|gpBPI{
zIi9%z<tz%k4wKLJxFRV~P6zpcme-=g=%-Am9@(T@PN}6rm@u=)ThhSIax>YH>9nb|
z)Gfw%$39QhF(}<W-)k7>Jg%y$cd}$@TLgDb>T-}NDx|h`>&=DztJ%~Imhg}aSwN1?
zA6cPX{>lZ)@vj^%3m%a+n=BMwy=uh*=7AT@Jq4nx)+kokuo;HqOlFtJfhpr^R(opv
z;BvNI92x3dZNjX1@hz6keX@M!Zd>Q55wp`<)tfc<>6)3lEw4G}X-AZ|9ARwr#xQbv
zY^mj}8$EKfmr_1J{-VclCtS__^57N@Yon8>(CM8jA8&c2%k_6pOm@aN*i*&2zBOs6
z?K>=@ZaEoP<dTtGw0ZmJ5_$6&$9{1CRH043mQjv8?80TXtdO$2bGMCis@axP^9~KC
z?VLXPjl~r+_gE!6I;-iUWM76*xFNE<HASxaAxnP6$nR;bp$;_h$uG-ayfp|+Ppj{f
zYd%-y-~hR@q|P5pdh_oUm_PDD9!o9?l(Vl?(i@tAa{9|bs+Umvol4HSyb8U1j<q$b
z^jvKixcm74bKbw|ez18xOZ;T78o4a-b5+CkdBAf2%>NHXbibqRK?Ft8qUzM)X0}0#
zB8Jq-gD5>LI65D9<h4h&?AJQl{nHP}j68Wu#I$P>VI*I&b*i}djnUJ0PHULCkBEA*
z+MJEuIxkPDU_0cCAr&h;kWUO{_pwjT;hod~->YuON`KvR98L9=oz<++l5>Y@yC>#O
zIE(05ROw@^eCV-T*lYS@Pq!Yv_v)j6C$`k@X0mIV?s`<L(e*f8O3$Elr#ez&?M=SG
z4s=1zEd=aMTK7+5d^dBgg8;Td+(q8Civs}1Wo2&ao;yDGd}`|Xx$`chre5&f_&;pE
zbp4w7(xH9xrR&%U>6&ky0JysVb<~#X3%Z(3v>ItbuaP`*)fBbdc|!*4>QBi!<9LB1
zULJXH6Y&<;=?zQdTSZ|}PS6v}IF2mD*3y#=HubA<<k)+Z;Q=+t*RaK73sVcf+@)Jg
zvwj<=J)~Za;ZvP?oQ03Q*0pQCLiz5_^4=f+_i8HdTh+PBvv_J&YE|DazhYSPgB)^N
z^00vPDq5_3t}}VbB_E<<QEqbQm$G7Ra(XCF{v4Xb``-M62N>4ue2S9m!BUkQW69NE
znS1%%zuXs44zqDfUk*d+g}PO5b*R!Kzad`tr}xW)qh%q#T#q%n-t>e4cJikWx^CzV
z0#E+uefi%E%qP!tUU_i&Y;s@v;N(C%sWq5K&!b*B^Rxgvp^w!A=k(iZ!{OK8pAUyK
z$K)!1<N@-k+2q{MwDbwC=9Mdbbg!WOW5tVV)%WS8)(-0UNPzwHb(Z}8xYY8XZ1vD1
zq?O*+ELHi=t>|T?_m@j^_3Pznt~tsl-khpFw1)v41RA04fARY}XzIJ^iF}t@jmaj`
zbM();>4`kUN-voK`&VOG*Id6_a-*%5dsbs?%;xdP2Wh!yr;hZ0dgL9n+_M@(p6QW4
zuI1KE&vL5UQb#L2ak0c?J?ia-NN;1t9Oapj|4Yx~$d}2J4iD*XZ1py8&dm5Pz08BG
zr=v2!%2t%BvBhdl**aaFZnXA>|GI$Rb!W}*M3=r!jT!thhk;!kycdz)`m*Oy&U0QY
zGMu{`dJ9BtgV-WYnrApRR_&xLYhFsbIAzMkG+8#ue>eSzZ2#@|vi;#5OHKDHdrbGT
z9f5b&85!++C@n%yjy=Z({ig#t9>|Q?-1GgYQJ40ZYh=F(X-%4>Pc+|moJl=5ckYE5
z+dD3K{P9H{?tY<0LzS0~&xxu=tix96c4^7gj7-Z}93Z!D4Cu0L`YwfJ8RR?3mt6x}
z16ggJd4>m*a?!+g%&gH(ewxWfYYvqtg2jX5G}Q}M0Tg)9$bV=sdr{s~g1MCxaKh-m
zvb@#TlLM-$njbBwrrLav6Xk3j?renXuuf6k9s9u%Yy$`x8xav26%*s~y4rKRD(CdT
zICFYi<=dyXRzCKS@RnyTHZWhiSa1EmMz~VM?CNZSBI-O*9Tee7jVR8Da*stFRIH=V
z4aUaF9McpTu<cMc-05@-&&XH*@|s1z?&#fX$FGamU9OwYOxSX|SO3%N7Q8=t?EAJS
zmafcb)j5CZLIpV{aJSmkrx!f+i7ff@Hd*AuF>_P?clZ5`GXJ*cWxnUunt$(l&HOvf
zeQ3_qojYsSG>p}DhbK;c)iJ79Dc(b^*&P?jI^7?sBjn-<%bGS#BT|j^=Gt?TU9yRv
z&Yk<=xR+X_cJDE})!i?Q=iL20Ui(!C?F>)QuC#)dl`(}9w3hs`TwqQ42=ajR96I{R
z7vuqQ2JI>Vay4k{e1fvXF9CAZC@gup^p@Kzuv{9;E1u;Day@BK>D3AwxtcTx??Q1=
z;C0B4@;%!$=4P%d%C<l$)uBk{7!~S1sG%t%+P-z47;98CPgXQje68SqdpcL%&R5j6
zI(g)6tdxssRnas)ZcvD#qNFHG^Yc2+<zf%lI(@AAmnc<gWR#4}khk}LJEX(<(e=&R
zvP)`u<5~-5nx~K1_L&tvli!==&d5t2InGS`blSLm6H15dZZ)H0;=IRk<TCeD#xlw)
zifistp6XASZ>zI}JfM_opQehGkC@kF*x-lM(Ma6tE}DDoq)5r){uQl<39`B^sn*Jz
ze9@<?V`8{X$x4WWw?!hN^vPQ%`*cMjBG_SIQDmfVxjrxN+j$18>;A-+<c{+?WMsU%
z;McSjKg_lt&i~rne(4?h&#kknQTm*&secq7dSqIcQE^QtwNL8Vph#@&v6a)04jp>n
zsZkT-M<urF8&|MWp?ZCm4V`jwEWxaG(!sohAW=Q=Ivs2|<ZQECw&a|AqYeb2PR|K6
zE68)EU*St18knA)IqRgHm0kt2l~202T(*S*^G}zXbTC`#uX)o4$H?KjacOy;%|3Zq
z@rOrG^3gL^mA?vp@=-G~Z#kAPnE9yh@AFNZ+UKd;m|ji$Laj-aYjB0jRe(d-)?H+^
zZZ*<({gK*rPI{wNb?5Z&kk)_hYxxg5X8o`t?bikGW@NOV-!Xa16OXSQ=z2TP{A<O>
zo}4mtS)Y1^Diw_D+b(fb{KQdD9T+<F==7DxVq=Rm=$X`hQq#CmU8Wu3VPoAE>Jgje
z)HutL?8tCdRo3DBC?1g0r}FthMlj5?<#PUQ;|X)^vhPw;zgu?w`mz^aT=u$LQ`js#
z;wgL6w?Eo!7A`pO(5xA!#%x<MYvzjOM!C+zM%?4sUNz?ECjeN6st4QD9@hZ-V6*Bm
zN97$m?w)g0R^t**e^>Wx8&r_sbc|+=SN3;x@L2K{;x}#l0rZ3c>2dnxfb`1gR{C`L
zoF~2K(7#W<RXcrv_t3v3r-$0(ktYS_PjLRNHd;gib)mg8cJo|C;MlDmJybPI@Sf;*
zQ$gS0{Mq*HcfW8{p{IM73{H^&#*m&%<hzDS?5N^N#6b&=uTeXe=uCms*rxU^)Rwv$
z+q{?AdMsUetX1dWvIPr1n)#zPsM&SSRN2nlU%RSdthYOyUs(1<?*UoW?eFr}uWag$
zRfOtMJ%xX2++FN;-qn|X=1RG}*m2MA6w7f$urem`lJ%=20ky*QzJW(8rIzQggWb5d
z&%Bd%tna=lQ}!kwOEd2kUHJPt+xg6TBewVJw|#`|-ONhseqX3YPjdR3#e9(JgC(Kn
zS;zAvKrY$Z=Vhp6yL)er+#OBR^dkN4w%m$Q<ET<tN6!uwRczIGw&`-nuNZb6B{|Zw
z$m$XxSJP>o57XjJ0dlp-wer6q{tl3<MZ6`yF0JEYIrCpBCj_MD$w*KBcjWulxSm7L
zFJ-8ep2a$j@TLzQXynf=J&XPT{q-W+(*K5d-e0a>v|94350L-y0Qql$@&G$u^ByG9
z`m1?{m4BA(?$N(jp#I99p83R(Ksnp9_dN2XKskQtWyw|k0s7w*_X6srHUX@1fA`rf
zd%5X`%b$;5e-1DI?#t(IEq_VJPhgw`$^+vnK%OHX6(?3czBpk~O*8PyS<Isk+qrkC
z*Pk>rn>xNK)lHvV+lAxLyH1<T(I{;FCQZs*kXwVG1=ptKTF)HwXK-VsnhCHs%1_4Q
z?yujK4NG*aQ=v|W;xhJq_YZ7*E^cccK7OaIE#+=CT9dw5Zw<Vwt>Jr~m|E!P*Hq`G
z2SA=<wF+~oWn2Z8j50P<ZR0cKg$De@Ee_8k&o=qKIsC0_q2<aJh$vXLeCW*!zlBAW
zD_ESL3tv5H4*e!e6suOGVv)+Fvebrbt2G-sb=t6|m2G+8&usVa>;2`@d7lr@>|p8Z
zvX*`yXuXyjt+iLFN1)t!)##k7{EA^c0$`<At>4Ng%`+>u<Z7(3<muk@W-nFm0J&S+
zqdvxOgguxB#>((Oi^w>2vxi$7YLmLY(b9eK>+>}pjV&8lHa5P-SLfYd8BM-2?^SM4
zt4yWRu?-(F@7S6wv6VJYCid%{5Z}9hqHL6TWpU=~a!TVKJsLOc(JS6m55Vd2^aSOM
z$1iW|dRlT-A4{GltX{D`XXxgmpGVFu!mheksc&|1tPhYU*^XIqt3C`5DjzGj8jy}#
ze~}^CqANs&*Vi(p)?=00R%%yWMt|l0+8AIPW0vW-V$9f8kIC;d)7-osK(M3jSj-<?
zSGy}}T);|FHa4sql8mm#*7EML7vu}Fb<LT}Ti2?S9Al;&GcwDSGtRji8&x`Wag|#a
zQ9Qvt*}c&i=n2^dx&dEMCSdM)!s}{BfSeA++J#gh-azkv==5|<Jp<CK4&BP<y6`_D
z-awn!N}ry4{tP_UZd`4e3MTUA!(8!g-2qwUs$F6$pVe|#K)I^pu*$t5_Ul~=Cwg|m
z)Rvv}UE%BocXYa&VRX9B==RN%Cf)0Izv;cELN%u<ir>{v!RHhaBQMBx7|**=_aGCI
z-lfm@kp2gq-uHAuo-umI;ew3?J^A>aLdY}7Bd@IGzGD!sgX*}0ykJbza_hK5P7|$^
zwE|3ZpKDBxXgEGq#~r8-=ep>ZmY7!DKCotts)5egAbWA0dN;DLFU1nf#n^eEzl>l*
zf^}TD<W^D)E2_xwS;qRRgJZ*cAMWk`%bw3YrpAc4@ZJY|8wKXszH2tWX=A5t$AZk7
zEtj@XKVe**rH;$rm1@N05?vWfuDTR0Cq4q@Dn2av3h_-qdcS<RSI!y-m3`^c<w6~2
zQ<&}s$eHf0*3(*cU33)->dha|{X=z*L+!lKJLOtwo6UdY&OPQq7Vz9ce14~Xn&M&h
z@ar2qR=lBu&|`XnQq>z*@YL0FxPoK1vRpO0TAXM{ly<0DsG1$yi#|4ULQ3kY-lJ`0
zGB4WmWnS#Pe8LmGljBNOuM}FWk=ZtW;Fy8&bL}tgn18QRNSnU>JI8VpaC<N>Oc6b^
zezsk*kHiM5i&V#Y)f$Z@nrDrMx78v|-G63Rs(`_6Se>}I0yfWjO`adVdvM#-_3Z{t
zf3)_{b{)pHEWEqQ@_pUvEt}i@m3*OH<|PbTm=xT)Z;#?lo@(A`Xz>o~pX@iOMY*8-
z1<F-&Cibsgt4&P(!Q*O_=&*6NyUf~{&h?&aH?8@G{NaUyZFyqaBs6GOk;u_H>V4^Z
zp2(@IEtNygX)LB1-t?}4M1oEqTv2eoRmsg>woATzxXY;0>%qIejuf3=z;%_p*C`tX
z$h%~dH};iNIZ*B^ho=I?e7{}+^5uTHJtQFiD#CiME~maa{X_J9#Cu&1eXC}Z$NTiH
z7AW`W<#b;A*k?tj;YsZbO8d+&{mUoiucUe{?zDMxrVV>Mq%3Y986Xd^w9}i5E9kmx
zkeh`#*O!)?oJl6z$i8x``|{5c3;lA(=Uy$H*IVe+W;c73Uz^}T2GcZOF3<XM*{9Zi
zxyV-uPI!CeuEpN;!R5SimA})QPfU<b&s}U^Iqu)HS)+l>=g-gKwT9DqqmsI3y(#Mt
zdwKgLt7S^PN5NEyZ4%!;Nkjod-34Z)93IPrp`4S4@EhAa`zywFPs<#b`e^N8k9B-1
zDTJ1}x4XAx&W|6s$ZDBQ$IvqEle|qcU%|-A&K3h|*K8Y8|A`dcG>z}qR_sL6oZ7-_
znt7w!#s@S_OzKok&1)K8D5*y%1Da&^V4`cI!8vcy`E>DjJ+YClI-ZTX?Db^Q9O~(b
z)GZjbk7upIt-T~qKgI0c7FEC|FAU!^xZC0#o$Ot@6ll8ii6@q~>$d)hW+U5&?=3#{
z^^_@ZP7N<pVf=H0dhA-<`Cg0m^E=NTH0YU@u|xbFSd+E0%SMHTbV^yM`>YvlBI8Hx
z89ea0UQbNj)ie6B`c=EmY}ILbKO?Twq$Uk#pWD!;QkR78J?Ok-Uu@^;)}ls?a6ewX
zb9{NrGR|8nBn{@m41d?<VXwuUx0J;^@+-zJzg$^X%MCF!>sNacwo*3<R7b6E4d{(c
zUhovqH+#&XjAtY){9^Ky^NU8#XkNJBf&GOFx19CZ;KfNT7Y`Y}v}MxLqD!TH|0~kA
zxMlCs2kvd%T_!nc%ZOuBryd$Q>d5%<$DcxJU8q)$_NK?|F<QACa@@@H$D3aDWQI;p
z&-;rdXKYUL<)eCDHC<BshGTWltMd!Eu9EjURp|hEmuzx+UQaod1LeMQRL^_DuUCM4
zd4RliK>k(K{aICy9Qx|?57GA#?{zu!t(r|v&+E~*TA<vg7d@}bXGPUmbZUCuAitDe
z!Xv#=&@ZLuwQ|Oy9uKJ+sJ_l853scAc|G#$a$If}qUU`tH#t2oCuF^zcGB~D^2ri!
z`{g>!RRlPl*Qe{$^o)!A+R!6fTb))M(PMgY*(cBXb5T91N4`ojjrNwRdR|K&T+S<Z
z|DLV34b&ZbZ+g|U>h$!i%!5_W`m239Gb(RWijIlmRxZcx^mep*(SuV@a{`;vi^FFn
zhKB9QC=l9w#;C<#OrG?`_F+p}CN3F1WO2)+B}H5HDYKg+qF<Kom9&`KyZg<|rCXjl
zK0f8hlS2<poqB8px&&FJqDxa1`@ti!rW@5+&3Lu3iQ<AqL1+w<Y;_;wUv;|I$JWAp
z>!Er%>aSaOckjO`=TTyU<B~QBrq(x7v;t~mp_j?kC^;XXG@c!yjP%0G+DJ>zO`dda
z>xi^gNy|nJTiUAiGBb7k(#U!R3zo^(r5y$<z001wzf`ZJC8m4dE9SkW>&Lw{al)}N
z!;Vg${^lqnQx5b$D!UQ$X)`&Gdd)|mza-TAqc#!fI5R;0obFOKG3^hKGwt80r~RAQ
zb<g2^7TN#7`2{i_;(Yfju9OFRpP^1gdNsOlW*q*`o9!W&egTcXE2UpR6H&lsJhAqF
zGiLm6ZO62U-6D49tJSi1-7#s2iD_f%CAX@TZ&#7-la?1vllEPEr6a9!`*E#mR!NF0
zHU8L`Cy%C-uG_Y1%{JpZS0T!WQqgKexs5mVh)}huP|iDO<X-Np#`_E1b!7Cvmd;^2
zHqGV2|Dpudp5!RY{zx3lmzZdEE6(!{oQQ~jQ^=OqB7WkUa@F&PR}G1aE}CRE{8!a%
zCEwWfti!g_W^3B~qs&+SO+(d1C^PA<skI)G)~gk;k}HSlu35`ju0ENYoVz5}3foGr
zI$|rI^arG0;Z3i~_2sW#IzhR5hz%%5kN@Q7)yMn0axeNN1$1Ho^8upSzg7$E#F{KR
zH)-;@MWbf4C|n?8PgvoWGdp<Z14|NH`sV{ly-FJ~cdP9#)2EeZLh$5~6#s<aYu(z|
zCsUo6d|!8BLph9F1Z@g>jxglBf8z^1CTO&^-1W2XS-O0GQkQ&X3Kp#A9{W&T^<AHl
z=1R}u1i8XHmwAxxGy^Q=C{G{f)$zVJGI^Va((yraD%(nbC+5EW(D{{ZdbU0+bGTQ>
z2h6uD6}3}6V}V-e`y0u_OlQ05E^2GxzVlF{F&f-0;#J~dhT<UqEu2|~(<q5**MVID
zd}cl1Qad^(nmr&HQ&-<tXS?LTX=s0U?4tOLPIcJbtzNEi-QwoeF_#nfbej77*391@
zs<oM%yy7w0&0L+-CZT5Kc$c$4WO4KQ#4CxdmQR|nTrT{#3R!K(F~?a{L>pGrR<{TF
z+EkJrQ?#5hrM(_g^z_dk<;eS5(^SS3+8k|Mr)NwV;gN@ClVA2uOL!4YKzjO$1K#Ow
z9<|Tt$;W2ef2K9*2+dO$d9ZcfmwO;_daEZqGTc9CJS+_C9~o0J_t>ks*BVpr20hfQ
zvuri;ZC;ppA>U@-I^aPeVOcQG=j<$68uP*<tuYg9$8bw?vz==pnwMi6sTD(9Y2O(P
zwO{3_h3DOOYI0NIzjX+YhxM4zrq9amZFel3Ag8*g+s2xM=AE57>*v)|&MYfpZhL4A
z`!#4^sqxg_9T#<5F0ba>JjZ=2pL4>gX{o25YQJ_w(timXbE@6n*~NG|JD1bNWQ3Pq
z>n=EvF+C>xm>$mFbfnAM?*^`7jg+ldQ>Xs8w#V)zT{54w*}Ak?@Wc~oZM$t4+;n8S
z@IA$+9%NuQIC}0}sn?Wi>pi)%zg~0h?!lU~Mwb~$o{=C?FAoM|dzJ@0foBc(iFm-K
z9*4*|+&@^Qc}C_!w^I)IH^uy8{(sa@t!R~g>UCB}eXT7~k9d~+isZ1WuRgx?w2}<J
zTrVYbJ)PIb=9YS;IOk8TwxFz1X|tZ(**?WdUU~2n>J_QEl)56YRG*eC$?o}6tL2W?
zozr6nty~zz19E2+@9fWAFD$k0!O7!%x%j0)M=dG6L|`7v#Su@hG9*yWonh+^u$r;>
z?WkrBl*!`MX9;G+f%&D&A>Ljm;5zlXst$f#^&-i#^Nnuz>+0fVRY&}(eRXgJKk@*1
z)ogOL^wpLNuI801Eq!)YFRQ}qdWjvNt)B02-TnT`5mjojthHCI;r`T?ZD_KC*i>t3
zpP;w=J*yhMg{Dr1)b+l_B5>>5sH0lO59?HuwGGO2dz<X~A)Y4tx_v^LY3|x--pSEs
zr|r^hwreWy>=(b%L_cN(Dr6ly($ip<=T(ru_FCRCp-Wh;0#&0sx3%BuKdWhY-t~@r
zT|3_6jo|88JL4Qz+VsPnbS<Ik*&a2G_Fm8XRG$1gTOP^l*WcTEUrw9INsWTOoNV{y
z)Wuxi;XmYrPPT=*HvFWHQDxJI?mqkmxs<38S|X@OfzEBsv9<|X8@v5^!%+3Iom|fw
z>jfIw8ayx`bzEnYH=l_7o!j;{n%|!d&ej!ky-ElyutG?*m;05RNvSfrM{dg_U(uoD
zHH6cc_nHcpc*{9lKacC3!Q<kU)RQY$lS&1qCs*wdT^hUkTE0b>7RD*wQo1xPx8*VT
zT6fHe_SSmk7iZ0-V(RMAF;3l1;Z~FXgrb^saw^g0IlahxLiM`P7&!ISNm0v-wwyd*
z-tLgl7BffAJ2zEr>&;9I4cR;En<W8zdS+t$&_|QYwyQg1;ia;VH%t9<@9r#Xe{XKu
z!EVOLK6|H3e09jE*T#(7H&9JD%tS}Do)X6ic1&_E=+(^c|5jVuYX1b;EcV|u&oNuR
z`|f|Q2+mR!sf&@LjpfQIJUsnORvSxhZ>@V7EvJ{km$}GS3hNFq`H)_XB3Alz>FIs6
zoST%M{3pnvx#qJX_xxEs2IQm1G?hQwV<}i&bjrGEuV5b~$_Gv)nCC@RBS5SmV6WTr
zel(7)c3k_*jM+b>PdPQS@av(Ejc(OvWw)+t`p<o?s(D(zG5Pa?i}*vd2c)qudHbmN
zKCyid&Ykmm-;HzgET6gblc$JCRoqtl4|GN<B3YC_U{(HL4Qv^YmMJ>2kM)AuZZ)ff
zm~jtR$+-7&x3up1?X*vAYMlA^Lp7AD?b%B)nJJ=TQti%gWJm3Fa}zRzS0!T;*(oEV
zOzhFrr*`&zb^iDcGg_;+I<o^eZNscSN0z!97zbxAPgEyD7BE_p6`mtgW=rd@EC1)U
z3h+qPX52Krj?K$WVO6kNBUYyHa?vq?cZMIN3_X=`7i$zOo3C@LjFs;9b0}vXH0IG6
z*;lKV^X}xfu)S3-+R85$s)K^6@+Cd%RH1r%|DH*Bh_XOz=zZqc<ZpBtyJazDn3wxz
zXv5@aSeM)b?8)ZMY-XY-ps(~4s#bluRQx}wk<AE29;{O~TR19ZTPNqLAR)m+QJjMk
z6?GfojSE&BXnTajdc(sS!V8CRAHR^{v|k&(YtVv8ooBVl$S7Fxxmja(^=sb0O3!tD
z4levXY`}-lnX}Up=k?Q`xY%=W?<331ThnJ(+rr~~HCL}TUohM9CvvdNVtXljvK5O&
zVhDe(LU-HVC2<|wut0ZrOl>Vs7@K&{+3fYR`@FHlIPGplEY2sZFk*3xwF$^84ZPV{
z6>-I>I;i{X-Wyx7A+|S4*FOF<A>OY=P<UZiXpN}&k)5h77~dha^{ZyG@yf;-<S$?7
z7H=5F8ka5Rv9Ybq5vr`dl#dfBu&aZqpniB%Z^`_7nVvJZ1q}PQOIJR)czp;rsBA^O
z5p(#Viu|KDX$*()pmxW53z$vYOR2*lx|Q-$j4b`yxBKKPEV+1Er&s;4YSn6RwqE<D
zc7y$`UEN?Brslp`dv$uwe|gfUnbvFHHkr+{rC%w&xzh?g)$VaXKCJY|>p8TiW8$tH
zKap-KR-UNGi~YKHNoUa4-IwfSPo`Pv7vXKnuqWT!s&Zw%(-e8Mp;Ehy{pyGZ+U;YW
z&{VJJw46EYvs(Tt@|Jq8ZON~iTeSQf@{)SSuI0`f`tPD=Wqrk)s3LvZM02*1Quy|c
zwt@cEo{SB=S6OmKM59s8tLPCcXAMWUn^dTi9zm_Eu4Y;Lqtr!a`Q%O>zEm}NoxB?O
zq{@$-w8lRnFQCUgE0^n8%!EmQ9(jp?^eeL%5Rw1IyQ)_Cbmd)DYkblGO_9>0Q_EaR
zUg0UZI(q)%FM;<}ak7i_?^1GQeFIBt6qJ?4o(?`jU%Awm-Wjx-_a)$G-c~gwpk!@X
zqRyeCB2|6s(^f?za?JCynJhcwZ*KF4#)cH3@mY@;Y<yL=UOuXPWV<8+qto!U9k%u8
zj7mJkZZy!@a2HbFA*z_Q#Vgl^D>?fRS;$qzrK-pSuF5SmN&SFOqk_q{!RiTm9UNBZ
z@EpDGOcr54V5^z(bSf0Aj)kdRT=fiOY<T?X(?<NMQ|oP&*RRh!x1M5D%_sO&)~a&G
z7pYBfx%F6(ck0X1%X>RtZ!;D!czZ*L%+qsLVy9<1${S|k+6fJ+#n*p1y7h>f)HZQa
z>&}y#Zj}kut2{cWnjC7r96zpSZMoHIWL6=%=ueduamEkY;Rms9eeGCnUDd_pDyNIl
z@?5Hrd&N}4_F3<e@=y-DF}l+IsLgsOr~eCJNd8ij`s*ZAQ@@_4Wu*M}JNLaXb9shQ
z(Cjk92$jpflh@tX-Mp`jfg~!`oy=cfuyRow*hRQkSel^9F*&eh&o^LF5PV+=Ii>|>
zn5RHxMO~n-mUmy1c1lljSu*-!1l3z7>E2q)gS@@6R?si!?Kb{i+1dxS(x=OgR&VOt
zPqp&DF8a`JY@(#O*mjyY@tP}~_x@lo#@<NjlD1NjX1VVSN0@vv!+lfkn&G}~eE6Li
zYJ?hX^h+zhNj0{rDUH%HAeZdMkq<Gt&j#MU9M{p8D+QQ$dS5G;^(UgcdTOb>&bskW
z-5zNp`bedrq-tteQAA+0FOioCNIgCsftq(2yfYi0s?)zY9_h5H0#EoK+g!%`L<1hl
zbWPJQ@;7*_PuQA~iGI9KMtU2To=tcs%<8-hkKsjy*qWKn&d+pAn%gJo$u`li)qk{f
z&63S(%fHXPW^`#XsZ*ONNsn|Gm0&KF3#zv)9b39`W8<P#OcpK3rr!BnMn46vO7TvC
zn2g0l=eR4NbieqZJ%95z8uG*T^<A95cbri%h?Oo;XtZTc$G5VUG1`(#Q^%S%voF??
z%uvZOVMaM6cRDX$#3?$LReEu*Q}Z6B5-O6#G<xnyzSOF-u<5b#N3)laUp?iibBVF!
zw1Deb1=S(ctRKxqMt=WwO0KUvY9<-+emR{?cQq0)d)03>#LepVug`AkSgl+)eOg9^
zdZkL|FJCk<&-}^ui}yM|7H_w&bulK1FfLSY^^P`vqrnqnVd^cpO1j>XCM)TP1?p{i
zO4`$sa+uQ@JpMyTgdw%52-Bwv)QaBwL}WOBBu>vgb!dd!a_W^beq+0OLtD1*8X4B0
zaka+HYs-%Y2dHX1{^*om?Nj30%<5dZQT3M1s#kezxqEX?{Z+*+_x*-DTz>Z<FQMJ1
z<v#Z<pdG8%KT==IeZ{r=NNu@Kr}nvz>0Ur;<-TS<_m$A@Q|Xoako(;yqHy11zEYH1
z+w1GxxG&W&$9>k{$sq`JP&sut=n0;U0pI_QuT2?7MSF5)(l)Eda1OGMRkz)_)u|o;
zQ42WlvyL<i|H{St)26+$K*YegNmJGoDH=9>O^^PY`(`ZY*=AJ3jH!K_j7zj9-|aQA
z(dsE(rZnyH@+@}&<ND;G@lUpNM;lpv#y&c!hdaUQNp!IV)k)s_7q0(J5l2)1D)#Qj
z57#Q&B2Mo74@#<ba1AAsm2K!v)x#ewr92=0W??;BSHwEs=NyC@MF!1jHF-@$(Xe4_
zJ;rG}vSG%w<fdaW&b_U7droS!W^(7Jn|9eb)A++3ig`vS8W-JCo5whz&6BK4wu!2$
z?AVad|5(1`<vsZxt^sqMt!A=Q{JS1BQbNf&NKZq||HImQ0917>f53OoIrm<>B4CSM
z!CnzDHY`+;CdGz`h*+>7N)e=}G!+rBU`1?TZ(xa0G)5D95@Qn0OErl}OyWySc?P+M
z?>BqSEhr}bzwdi_2xrco-PzgM+1Z)dS(*^gn^$s4q`=AY#Np6tRk%EvhSdU&3r-X+
zlUieIXEc$#XcNFv^_(eyY$Pvi{uP|C`A3+PsO6LH@dOB6TAHLk&;r>)h@nhL4*7{p
z@Nq462x+x>wW=z4zWo}j7nwj_Kt^r0jj35n>kC+g8(?1Ss!(9ntzO{plXR;AZn$}_
z+m_+@lFQ3l4b{GnR*lvVGc&$qZL6*GdtbKPRds$5r+-@gq!G1ZS^X|qX^gb7e$F@r
zhOTW$`kH6-`WLWx-X`_JfDm_(1&us0(sCoGO09{5Ik(V34#l=vg!9Qj&IJFFji{|W
zf-<q=G;*CqJwItKSimt8l=`vFG1foXvVP;<9{8=cgq!#3@T*zi1KTe$F)01f^`)&2
zub=W1A`+K23KBeA>daaU8P$TzZ+>8q2U#N(AI#wnWQ8pHo#hUm*rkae31yGv=%JJC
ztwgO9YFIX9Z;;cRMWcmODACKp_Kh32dxjwuOij@`5q#j<)v)o_8dqlw0Nea9E$!jv
zg#~VI1q*oum?`WF$Bd62lB@D|E<Qhh!G%~Q_zPX*&5$8MgjgWga2+Bvhw|yop}NOm
z1P!SEP>PpU8_U-BV$dRa+2z_`*oNC{`hprYQ;v0nl3)xpsvY&|Jp+S+dUV_u7(DUq
z@k+SX3*8X^ij#Cw$B*Cf_I~!n7^3yhT_SEH<jI?i?VGVvoO=|wWqcNwuS$80dWE?>
zSs)bB=zdvROD*sdeq}Cgs$HkMpIlpMb1c_b8eJof^&^ETN-gj`N0{2|qQJ@OUrXEY
zG;7Umz|*YaU#)q|0wa>q%FsS;XfADn*0-NwhSCh;w82a<$CO1-@UII0g)KDKO?D==
z?%&L{=zAEU^*dWYO=atcnki#Z!+8Y?Yn%mLfX6~U0~IzkjVV0QlWM_(e9l*Dh4*|3
zyjKl4e9lTg;d55&A$&}uN<L@s2F-j6yq5F#tvIh)@{}dqk_Ro|N<Xksr~WP1{;5tP
zkN^8Lvc|Cvcscak&d<GtPB0e>uQIuQw{v%Pv~JZ>ND+Pgx{Mm^*s^6SZIT%9>XS~|
z)Urd%{%t13wd&ByzDFqKGogSeNCgm-6UIa^E<;QNwdXQ~76c1+qlJTp;l(Liuaae0
zz}p*#tKM?9y;k@NH9>~LKIZc2n(t~YpJ5z!623Zf`OKG;&#F=0%${r5CUgC!X|Ah3
zMr)LqB--g*Dq`N1qwD`HCB;Wof3b|0NJnAG`t^nduOt><plvOZU%wT&sS`nn6k+7V
zu4NV$haOnsnsZYeUDk^XXV@9?ts(4j<aFeLOSm{3Hogu}m&qGXo_!%;!{<v9{<EI>
z%lkvJJjP_f#MwkhGU!e?2%T}nIcY=XrY4&zHx$o3F}um^6LX7;i%COgkG5}TcZ-WT
zGX>ZA#f+5rP}&2eNZ&+cHsCxgA0|M{&~vDMh={jB4lL!`RMjh5bi~Hm7>}Prk?@V!
zAd9ekQp(FLLh=y^Z#XXWunf#6JCWM1G3XK|ChQMhp>@%Qjaw`qG06Xn1<RDP=d%QZ
z+bbiZH3g}@VBvcu#4HSd2=o0X3O#29to-U<al`;}g7I1JrHV=JmQdle>~J`wgaw@Q
zD#4XdHPcZhB&b#5AdGqi559eVpe2v;MhI7qG6($G9Fc7-f|p_3^+mk0MO0r|RS)Gf
zlM=j4x((u5jgHlUn5oZMPpw}G6EVl^)~xd{NWDPaSHUqz+ZL0+7^G}zl%Yg8X8r3Q
zf|R9G7J<~W|1n7UrGeBh3sUCB58)$eJ{c@w->_ADuWC>~awZiWY0z#*gpE^^IwLy!
zrNRJvC}^g@P6~BK$Bs3)@Od7@zi+IX5ue*vzF4EB2~<8`v-%oaN-{#!XbqOSQ{XsY
z3#JStX61gZKG5=eSN|%^fCwbBD}|$T&#3C`hy6jA!P~JOMBVUDAxF(FrD|4pbexxP
z4jt(&2Z{YrMH33#z{ps1q>%tq>x-3M&&@sJ5s36f@SG;qY`~%;aFy!nKHnTLMo&6Q
zvyly$CwNv;Xd&A_4~!5xmJbOZV&~9A-@aeFDMuFyKTeq3Q4sbsQE)5GQ+72%f%3I6
zV#|0Eg9dHkv5@wC+v}S+*bSaOMEE(c)J+iCenIFsd4i$2BAof4iIft6{4-*0Lw^9a
z63f9?EF<Kad2U#^LG~jqL-?@3{#VY|SeS1uhRbNaMUb)Zv#GSM-Z}~TMD^D+v?i!t
z_j5Jm3*=KG;GdCej}N)7UNt{e2LlUAlXT)O!X~J+2otbHi)2IOCSWoR3m<XioywC9
z5pYu8FHzfM0JdN&#Q;ong41CHXDiSN?w$UW-Au`lNXAz3U^uWMcK-8EKKWeU&%D+q
zr{q-$?d99o*dQtNoo!ny3L`_N%&Kx`m9p-|`Y_>?6lDl8R;m`MzOt&kl;pMYNj9G9
zZO!_>Ctrm*(s|aDkjTP{t=rxaB6xjFGq?H&@k7X$9!eNR7boSONZ9W!bLFX_g*M2P
zr{qQxS}iJDY;&+hMnvpt|A4cb*3W%2e$mbuEq6DMnj4WZDSZE?f(7rk7@Z#0EhIR?
zb+ET}&(4K$Ve0~1m-u!c8Xn>{+^c!l&V`G@H%~yH=3?Fu4pwxHI?Wp^CpGB7$rjE(
zTIydBEtZ?Ret$qfUF&A`>UHQE_X;?2d3Tn{t^@ipfguC1z}CGo+M#B&t@$O;JS_&{
zE5fS(%2>-&m--KB({)UXQSBEFagGS?@i8lS1=Lxc{U0vs(YM*+4kMjrd9s-IUj=VW
z2R`I{n#@#}>;8P2JO{^aNU`tCg_{S%gNee+Bfc2^r5Edg9miPS+Oj;ngvzmYrGA=l
zN<H~ZZ5K%aEbGr_j(k_h%j^3a%hzwma?I`Odz#?wHLDdk)x#$=)sG2E_3+)CMgO?k
zLGPI+60Cm<Y=^imYc*bo5)T@E&rbX}J$H{d;cScI8qp`(Up$oX=G^t0&W;PnSv-4L
zv%}UgWpOLsU9fiR{_sf|5m9rSi&Nq^1*{8;E9~6U+Iz5D#KZ~qQ`221Y?-!jlU>*5
zUc=o&rVT^$kTz1H_94wYlK`g7hqf<fALNE_#WiD9zTiq)%DanGqw-J8y^_9n@8Z>4
zRxF$BG5huGxaf6KK=R3HQw}98J!;pe(UmQ6XXlizidtB3z%zE#%(WSFo*kohaj(oS
zwClhZIz{J!P@;T`N)}A$)~5N^TcrFSO5fR>Q{Ns6I~Ct;U^lm!k#6C~<HAdOx^|p1
zVOE0Mtl4foU+<9?GACNHd-fm6?yIl8ijuv;-ADCw^zodKI4NR{XW#bQZ2ARy4Gta~
zFyCjm*Klv=IWw|>&kxm4gq_-1<O)Mjgc5E<*<~OHekdR2Zspj_uC;ro{9W2v&(3<e
z){!>VtG9V2q=pT?i^X@Q{6EisEd(1X_F2{-Ar6|=v#bT7&vKw}khjivYu1W=xl0#^
z=FNEC7YeX`4y#9q>Wdj~)9iS&_B+qCf1OQvt{Hg>!urOCL`=_pORLj9-y{&1eS}47
zlZv>rXn?j<?D5J2<?dsx?9g)$Su1$TKE=zmPb+%|`ASk@z53cX9xZLda)l|J0D5H!
zrf=UYm-h;uELZ%r%3c_Va$@yeTusyw<;YFjMG^BRhhweAYy?{n7XN#h^;#an8?pH(
zi#6M2!hnYA2i!n8OEX+Es)n`m`G{8IB;#Hnv&9`5ETGe1Zs-Uv$))JKq?B(rC0s~q
zbh6>-xn9%P`TK8(7`edJarop7evT_P1_ZA3EBEc=oHyFDplH&{RSV8Nn<RL)*ubRH
zgG{@ALh)ROiB6Gclhe-6>gw&(vrl-)u*hMqIdh~T&)%6ZI>gO8df3{i@WMdxGfwAj
z@?XL#$O+D9wEY!TmmN=h1jIaqQJl{PG{<;#%-^+Ti~N`5=H;r_D!d9VGw~`VmsV^7
zwQv@3tT5_1b`pLA3(b3ujUaw)u*E6T&Vm?RLSnq$7R_ER2C1!0x-jhVIUK&xwi-Gn
zWCKkK^F=KWO)7+hILA!i&{PYq-DBL(3~k3;nzWz{E|hJc=d3l=LY~rm749LtWro93
zdY|Ccx2Wg(2B!M+<TqG7(qjN0&zYALZqP!sm;^NUg+cO}asM`Zi!giFpcaajfUTvr
z+53FGH=m!q&o%Rpvlj%zW>-k#9fd!RlRb-*ojR1r$<E;*yM~h;UJ&Xi2taU<eK?Ul
ziMr3puGB*DibQsDV4F)5*_G2T?jZX@Q!PaHMV#y%;Go`ZhJ)<<tWfn)UO$mtsh{E-
z>p|F35*amkl{6HS9N->SxQk#^Y>D{NawVqpNQ(g%8d-#_B8(K4o5tJI2ve$wyB5|_
zzmO)5`o*E#wZNe|)pLllH{nF6$1`19raG+^1@YLVj>X7z`oEf(hz}FsBM1trYET<W
z)HxV#N}y}oDdNz0d`AgNaj+$>a&*8#$4~e;SQV9fCV7pGcP;Nbv`y#LtGW-L7S*d)
zRM_yYWF|69nw36m_=;IVN!1Rg9$V9rW-M6i-=Ty5+67gzviN8za*b?6MiXCc)YNL8
z*$7TG`yuRDwaO4sTOW)B<jNTlklY)p6O5CaY>*1v<YcP}hth@(uCX4zTTuoA2Mdf)
zbM0_%+%uP^{2EH_^)}EQO)r#(+as1k;l>D~xJ0$|Rw2BW(v)q*0vGOP;JDO#tTolm
zT?7jBr&^&;YK8unL)X>lI~*nkQ@wn*$0>!Qd2cA#Q7Etl*4PB|DO4oSw1neWU8oB8
zu!NIyK!H=M7I^<Q#ndWyjwrqPRi#wTHuKpWa~&4ru#t^3QSc^*Z{(wIIm(uBORlhh
z!{K0251)oq5AvK$P{wUCO+$<uuN?|9u;D`CXD$?MEtLZ`+5%D;GGWTvtFy|7#7~?U
zKjh@Bt2U9BbA)pS@6Z%y=af*P%;1u9Ig)b=>fzW!x1~@9a@6w40#_EFEG?g(ES9bC
zxsp_)B|cTWU#&R{X0CyT1sm3co2Cl<!U|(>v@y_%Uw9o9Wpj7T>_t!kM5NMYxd$j`
z3I(b%vx()Dnjs_A;jdZR$mBJl3X>y32JMlLPN`X)JkQmv#<fHKQfU$syhRJ~Q3I|p
z3SWkQRwZ+L3{7p4*>Z$b!7LA{F-Ru4tow(7Qn>VrnJ<W6&<TYfIUM}RgY$VOEX$j@
z9mw*|Ddo-FPMshU5!}S>HArEST^vfbAZ18Q(t+SyUUD+iK`bLj^I5GB-#DwsS~5)i
zSwb^)_7agviYj%Rr6|>H8baf2q!uk$MwKHbX~gS*G@=k#MrUv&Ps|}Cxu!(IbQBB8
z9<7nZ<!d?U%42)SHlx}&+C9F4fRIqb?3uU1!fwqJ3ZLz&`6({66k(UZGOrgqF`<YZ
zyz<y?AU+*n|M&`7OA)3}IO}Fu*v(mn*-|Jdz}w}x-&JTknCLPPBL{5IQ-VTGVO|_d
zH;^9zSfq>9z|sQWPNJIRS7e*z!xyq!k7(Df?eI347t>o0YumoPbDQi7^5L@lX5G8m
zcD3o&y;(j&P+CM7iZ{!1*bj1xnTG9K4YSz~&_gP{i}#HW-oMLB)&V8nG@qAP(tuK)
z=12Ty3S2>{M(-`?V9v%Y{mue_l5=|tl-i8|N-Tg->ShC!de{ObH2(u3Wr&hnupbnp
z<Q70xH+H9j6st5LMblA1s(|g_oT4CWf+IKXzFOgr1YZj{nNE~?@{Mo=gMr=_@Nrzg
zDD@L3D&;o_knJGGNN^FUe+YJUfLjZjT!oLE94P%VEPk9d^ds3DOrCmY^+4b5p*`H4
za&OC1*vSv}IC^)R+RbfXiLhdoFynq;fs0E);C;io48y8t<JOEExn|rmbeT87tuQdh
za@H8cyP&{HZW0`F^A0f*hoS>I4yC<us1z&Bf(g9?lsK3&;q2y`8%%0QU=A-hotOaD
z^v;vr31E&b?VbAe>=`)UuiFjzol5zews!sc_v{%I<=68D8*)*0h4m`hu%lnE`Xy}x
z{MiP>e&L4Dad5u|B^@RO$q9l_)eV{>NJvK03)-BuQ}bq+TF3})!L@uxn$z3bX_Cil
z?fHZoz$e_Vmu1_IQ&W8Vy2(-7w2c~$^_wC^7-rKHqWM?(Y~muPM(8K6pL6F!rT5>^
z!U(9=NBb2FpHR1$vduL*PV{>AQbfe`eyyFOLOMD(Yt**EAm{cC2UPj|6K+yyHukiV
zlqU$ydw0mLZ1_@C6{I*RL^@GGJF}M)MCw%4d&oaEEVj+eeCGYq)=Y$<nLvagoxzi{
zi$X9H9E<X1Gn~t5PDtG^;}v;?;p0rlYk@qntcB)*0^dM)^48MoPnun3IG;~yJp%3)
zeX%^2Pe*fkE*%wY9uG0q&Y2p}TE1Sdraa(%d`VwuqVPKF<$d#F9azmK(0u07SyzW|
zLi9Z19v6ICNH%Ub5r3y4a&O(9OM5I7tsU)uz07{<7?upa)&9Os+qe<<_SrVG=+|mh
zz8wI8@gW6HORw|c`9-tEm~k5LI3pa=R=IFpDUWk|YWe%>EeO1;X2RB=Nf*>$_e32~
zPR7;YOB*?oFthcYy5L{-uxyV!@;*zjAKaeB+?Sn&PKM7}lJJco#Mu?Gt8GAm6x8wy
zCT@L5G*e=k4z?-6BEwG6-LON5%@pnHm#(e)rhX}gLM;yB%G96wqcj(*U8$OCTd6Us
zv4#pv)=rC5J23FrigTUD8;Xr}vN>yuej4IF+f?)6v>BK<DUe-9QAb@`{>;e0p<&;}
zEVv-haEA#DoMsfW9m67r4Hz@QYia7tmC>UIIQMSVu2*a4?jgnoPROBs=1lS#)4a6j
z{D`qWt?D;f-n=DmF-W?M78{d5ujz0kTN$inWXH3G&1|wo7_MOKhY)MwWR$e*ps_tO
zskpYqNrjn-!8MYQ&ovImT(gAJj8)+4H0c)Q&F}&v9OinAoT+?1>&NF>ioDtqj_}Q4
z&@BWFR!AuZ=N9;d5U|O1vep_e>OnV+fgm0BUA#D%r4@g+XwhfIavDpET;t)fCQ?qL
zQ##U47JDf!{_Vvj!xxW3qE-xiIcmiL4T{_cp%5`EIU5`*w0G#PnmcF}ebdr=k#4J@
zQ(AT%Sf>F($Lm77XO*HPuV_FOmr713q245jzbqnu{`p2$1U=`lA^&i3ocKEKMJ#)j
zTjSsyk#H7?W6EcP5}!jR(;TU5RS$7RRez~PX{oRsKe?r)O6Rr1@d>&{fz;G}?eL1K
zC+I&;+jPghM0Zds6BQfqmmTM7WCOQ_21nI)fTN%batAV7hD^ki|Eq&-CM)eRVQi~b
zUgLYoNs^c0KuE#xCLO&)2C?DtTf?Fzb!_6kW0nxMj=kB--=(=<ixGakS;4weQQNuo
zh@ipp$<gxB5i@;Tch-ufoT3+W`8sPXklb`_XS|BfLA{F)CkBiIZ%mB9ebJ-dmoJ<?
z%|^bT^*$SU`m}uE{j98=k5W?~?aV6vDK+({?9;=JvH{nwF~=iE<Qvzn$v2PgO?$Mx
z=*P6QAB(m>N|Qg=1^#^q!w>e*1*7jRdAfCMhM@?kIhNt7z_nl0JOeXoi_VPO^XKl&
zU4QNgI5Xw;f$W2~Lkz3WoYCHqQ};hB4G1WGwx2DNSDpWE=FIQTv$)FMpe!8I+N0Ws
z{A38`Dx!+vY~hE#vFX-h-gdAW*c9T3XE?C6Y1-T>g+;~h37mG~k9F(*I1wJSJDx=u
ze%N~^?&Gz2AIF_8DIL>s_fKm!SD%fHJX^ha%}={Kjwxk5d$PJWcK?{1{NwKH^8b3t
zcQJ`!u+b%><t|cF&230R<IM*D1h1g0Nu{RzT6<l+<;vBh`1Bp69tOiU>M`GVASiGl
zfWy_RNi~`}tyFjvhnsIg(5dk89IjqXit>$A_*4!z-;gj(52gS<CpbJi{JPRF{WQ8c
z!35_wCse~Iqw7NX%A}?Vq?N9zM(b2wZmP5FSC_gE#UZ>twSRbT**|(en!i{3DL1WS
z*-!g==%+?s_o0+(tiMKo@x4^YzgPQ>?=AaH?^p2mYX9-xvj6mcHGi+tL2iovn(2V|
z;urkAN)P_tOb_#W<wl7_xhZiV*6XJDN?-S(08NxQ6IZ|P1>bjtK0Kf)F80E7H{Zxc
zEZKzwfGtl1E5WjAFC^k3)9XU>sXM}ui)Qu5iBpTF3eDx~x%&>tAH9|L<is?g;x6kK
z(xCLCt|bpwZvMNV;P1^VAC`3esI<W(`PSXL^4T-9FX7%><+3yb2E9FYkycEJYoR+P
zaB9k0@zgd~0uuDhO7N4fHR;{4VcR;LI}WiM6W#BtZ@NzlwHwmWUe~5k``%XayTUNx
zVCVK)ZHZOGaWRG}L7W=dpwR)XwtZ(qkl}50F3jRQ)|DwdS$XlC0+$S2#{m`ij&d9>
z9-$-(Zdw7fL68sj-=-vXn7blfBgDxBxxk5J^FI6E;0X?+mX2Sx-l~0{p`BUP`-TH{
zj&1sMvG4oZ06XoSXOpteruOlfKR7ME%_#qw>48#7<*uMu-!>il_Uq8rH#Sg_Legop
z*od4*2qJ-8K(q(<h;_2V(#JKHaxu~1!h$z_u_WP(&GG>@ZsV?98|5Qd%H)AFD^_H^
zGq)r!BPmm@&KWXaq_ih=^vQ{@d}7WaJ*|EH*=@OhF<$^d1vp40eu%JcGL#Ja`Y{hM
zmFjz7lF}V*7j->>R}(rL0l^CbSW|2$EhYG)gQyd9;fZ!52X<@dAnq+W{cQIR(aP|y
zeZ$_a@<sN2huJ$H?GhGOek8YKBM2a+%MRP+$M2zPsGIs&R4qdG^TnyIfXgUJDeQz_
z(!h$Uw_y2j{hp;E?S9Hb*_D0usT^ZiFE3Dz<KiBqy23TX9ATruvFdMOy<sl;g4=!c
z*HEdwgrf}5{@iq!i-0G?6cdkGpwnVMiV=p?*LFd<21ITAr!?Eis=VR@_VA(MBVqJ+
za^3sLE)y@TH1sxTggu53g|3JvB%GU|7Lb8xYsA@#{kU_de4~Peu%IvG1h)GldA(dH
zIT&Wjk*FzB*kWjDuoYGqlBp*7E@v?-uGnG6OZU0MC*GymKy1=^y@V73V9$SYjx{QX
z`)sqYVOJgfw`Fqs^Q8<2#lwFWiudHm&rThBno+{OuBf<f2vZQQx@`zkCYhFwpkv<S
z=suP)8afP|*huUY-qkIrZv$U(Q-$HfQT6)-ubx>tXnUb}0ZKuSs(Tr4rwjwpp1(J_
z99Jh<(^<*-B=Gh1-34$L8iEETQF2SLNC#?&@2sIUbQ;){>{nP&nJ{b2q-L!Rf4qO$
zajbJk$38R1oVaN)wDnsVv%im%i<Bz6B;33>Ba?N1gPnWU*<*n-NSs)`PiL>|{(n{t
z8sCsV*}0Q-yRrNx>xvP%cQY|&`@Mw=?`@CSc7Nf*`*9Uf+gRJnms#6w+vEqAFUt?M
z9gTW#!-n^wlz-)1-SWRv(0}T03HoL1ubZ?O{S|3a=(}?+s8760*F7?t6!@VSzz!l#
zxv@{4?W_>KspyD9HcZ>UxVZ8**cP`VK7Gtal*p~X0!1L(LsZj*=XtaA)hWmA9IS-=
ztzRWnoXb!8Y+BeitX_rCGvdR&xI@focm6oHvqQZMcWEjB(;{HHgfNv5Uqx&$xpTHx
zn}G0F;4bX9>J17XOI4<(Ez>MfQX0|}#k$n=n+3dS`L7DGB;rnqJdj=6o$v3CriGq#
zTAPRgVL{W_3Ku4}1UHx}BbCNjn-(OJR&M<)wj!WlTEeFhAz#Z?6>?AMkhq4b^<~HA
zWsUIlJUiH%U92qAdUrG`uev``b$t@UL|x^lyh4!93sS}37Zi#TRXG(fUixg5x0gmK
zRL}+EH-s2aY|oJ;;}1|V-G_@ia8aou$vbrjXIG=xhAm$wC4Rlt@Kps1&)@HzGfj@7
z;gbXBzMH+~b~Kv&usAy?aWwG<>J8!TxlwzXE7BwUR(2e?rkfwsG)eIqEivcX+7UCK
zYeT`k4t6$Rk}ek0*p^RXR(s{)UEPEFH1HEXH@rK#Uax@cNNI9ytrZX2yiUAbTy<?(
zMauBnnnw5PY(mp|G82)Mq*du9ZI+jdF;%(Z-r5?1P&!g<XkS|s(NID{u`t__f~>_6
z7~JJ6LV`dg7QjE)b95SxXOfM$yb>cPTwip(c(zSN6Ym9Co|&Jdq<oU;nYF;XNrg>R
z@wJ!>toy-(^2hQKq1?tL_2j~_v3^~%nC`+wrqAl?x7d5p$<$G2<^8|>B=0{fya67Q
zC{{{OSAx^-Pq`GF>|vMyxQvkE(>ohmf8kQ_BXU?og%t8nJG&9Z#X<qilgd{AzP}R?
zJfrM?>5PV^10=P2<^h{7Y{ZmP{Mef^2PvjPz8;s4Tef3ajvRFucf@~vgvnL=K4bGg
z*7opRF>!pV>;6SIGcw+fM>3He#H-b%(tE_Kb(8tr@Ymes5(4l#G=1%*MhaZQmIZuA
zvY%8Yb!3dRAgRvt*CUp!DI7=GD>~rv6^xA77?e18koCB*@LF*cAEC@K8TV3B?q!V0
zq!F^l2pQ%HWj01qj7mMZ$a^tHNdEic1-TL<6gxJiJZ&@|8B$Px(x(9f%w-;GNqZ-*
zB0?(?bULV{DpIx`bt*QUYn~N>?VDC3MEU8ajz3T^U{=xil+W|>zerhh`EU8R6<^42
zoHzu0Gw-D?`~AR1X7iuavDuSDvc?2#p6!@Ex&Ok^gX|{GwCymWr^mIwR+jvgo%zew
zV!7%{hRd5Q_@`gk__N0d_0#gxHQ~p8%$mDBXwsgAi#{uJ?E0E*n=Mvttw2T_oPKvg
zC%RJNJ*|Q<bpjj>J~QSFu1QQ>NJjfk9?c+LyCC1&7k2#54R5g~`OgZ($FEO4zh>p9
zsVN^X_e-BWw)th7sGYZ--96rPm~)R_JBn=1vI##QXRY3yb5y=@eRoOyjgK<3<w{&!
z|1_(|xEPPQWy{<pM{kc2O-f2Ab3q!0nRbcLe>rv-NMlyi+U6h}#SbpZ|IL@?S6L65
zT9LDg5Lw}yp(1iS?gHyd*xDRrj@0^wpE9$VuHpjIXB%6m`FC7?`0gAqC23_#p-||w
zUR-bv02cFs4NSPWjE$23dB?%<V0qjAOXCMLAJ)5->~r1l#dTKRRC*(K#}OZoXQ5EB
zJE6Al>QY?*u`=7Lu(ALPDke4^9vi9ag}>TTL_OWZ&WzIut5tIch#f>9H?8$}tN5;A
zZy#ZjT(J>a_l>22$-ym}bV&d5fM@a_SL2gDUpFhqW8~`S*{fYgtk!19pUr2T|Nec|
zlWj%6We*PO5pw6f;N)SK<Y)4m7t4{DusFOVGW67vsADt34@H6cz)Z^!cZU1~U~v*R
zU=2($hvwFBqKQU>2cKrv4x%3S90>t=UnHkKC|I~XVo-yTy8Q=MHtgfSd}?^U&)A%)
zQ_?3mG+1(Avu;q6;j?zMSkJWk4>D<;|MEiD)rQ+bf5%nn!86`mp896wgsj|wLVv^U
z4417d$Afkp6EX!#v}EdWP!BdC6TH0%zMMg&s0F@)<<<&M*TBSGOZg1VJGH_yUs68H
zvb=tx37>2R@nEdq0=|;DnBf-vT0^%yQhDr(866Ph{l%V{&Ex$x_3tI`P5peydsBa3
z^4`?%m%KOi|0VBDbfEX9{+jVO(c>lWUq+Ypny=0DB8LU13ywahr+SH6M(!}TR)d-p
zKdx|(LQNBuU;M5Hcad{NZSC<i)7Y4x#@68UpGFH)5p3{&kP)p(qS9eGOc`aPtami+
z)Zyhco*YyXu&HsUlxneA(ZXx#%dRY#`_{6ouQFqAWd>x2S~p|uLb5z_6W93r$BxK}
zPs|&YhNEMT6VJ?=aeVQDe6Ko=`f&$ySKNqkj1M<N2m@VHgVPFk51Bh=PEy)@gU6US
zI_5MGs3{(N><Y9syo)$HV+H57kEI{q`*^vH6l3Aa&y{1?0XY~ok;rl(QAX|)9>z!g
zw53>Wqg+IyU`Prjp8JKni-OmExpe85>jKk)doFoWw&havn$hi$y*g;+v;j-MSRcN6
zjMwUE({jAV<g{4w-Ok-##Wt|&_PUSbgxH}wTMg{dreDvlw#`CU9-F=UyCpllx5dUE
z3Y~H|K5nZwFq?}|<A)GguPF-}X(cdd(qd(ds^<%?2wl#&T&t!W$~oj<D-2lvUVP`t
zdzWp?^jSE3L$cp=r^d%^=bhM@QWV&3-rK2h`{uMf)O>MNbXI(Prj1|zwBF%?0|NU6
z4Db%?9x$wH=ql_y`ua}oHEW&EsHGG8_)HA*9vw&*mvO{6k1kRrm_L4Vgr#;sxRsfd
zMuZ6?vhF%GgLm45Fqo*5Vvv0f<HBXJ+4)NrtaL78QTMNNd@rS@ypc4t%y~`RycO~B
z%S`x2d3%S=zLa%V{xjEv?%4d>%VW!D)WDa{DoBK{fU^oe^J_Uxgf*sNCS1rRt}wT#
z<P+pa1@v9WmQ2jwNDx{im(6W<ys^`CzvK<WVtg{UE!#V}bNubFZJ8kC!l=c~54D`L
zKQ`^symo;_HeRbjyABKJ9_BqDpdZK^-g{cUpU`t*;Aro#i9UTME*<5wZdR|UzI{0>
z{w%e!pr3#MORiUuNvd|daEhH<xmC=@m3%s<%z4%P#Jud-WrZqQh0EgOSImoBGn|zT
zO?o3GRlzHl)jykcX?B>mchqxe%_xsuemj4x5igPGrKPjOR#-i;*`*b|i{8<$t<m|$
z0czguS0kY$j|=J5cptNA*v_eMt6ue5wH{gZzyAYO*=Nr4TxV?A9lUN*BPpSwwcO-Y
z$!ua@T96d>UCw56fvm8#8NPx|tQDTFIbJI~Lz7=CJo6>xvuczl(XHUKhAvkil|}wq
zJPyg!0}o{Xgs()|nK&W1!ATF(5*d;e6Dj69cdcrhIrQ{e_wiz%bu*U_nC#O|>>NCK
zg1!8v*i>E<nl#j}AlzYXuKe}I&fTr19#5Q6a&AS*sHyI)21`1vuydu{Y01_k&k6JT
z$1l4K1W5i<vY=)_0Nb=$lJc0dAX#RLHs!f_wn>_(W{T!@ahb7Pl^JlcVK5Xp5nX{V
zXM1XeuVCwIg{NzNt`(l4xmhbb^Cji8EX(uNUco1ud6?_5fUjg@%y5f-tx<!LisYsU
zUo-a0zV1U<G4)8kVC-FOZ_RzI?X9_|wY@d>x3;(DUf1^4+;_Y+_0fp4nF6)FHPeA=
zCMG7j8NaPT4X(A&TOCn@k9}?5RH`S_IA?I(gny%ZJk#`z397UMePt%?J`%B%r)VER
zPVpp)T+de&eRx)siwBXsx(Pzo1uNSoO)2Suu(as=<mB&*lz)p49V*7p=c1-XIrDtr
z@_>1km&>Q|hkUwxC$3zVGMU6$%HPXXnR1o<y<od>Bh3>^x5py~NP#dN1E?+kpcq;8
zt||Xu^}G16n?4LgQ?^k-@(&7AQH7kC1cy7Z1-g!72v3EP6!xT)Mj~Up1sT(LX<{{{
z^zyz0jeZWgqCM4dwFXpQFTENbJizxo2hXU+hE6T-#Mzi*STEC}d^-zxmRkNU)x%jx
z!6o}H)$%c*tu3G{`Mt&gyiH;mrR<s>#<J$V<KmTSNJZ4~4VC8VGRK6@1atUgz&Ggr
zXQIj~ncHKlKjP&{;Z@2%mVf8v%K>-Ow==@)<x~#>jS>BW4Psp|k39@<3?U|Zz2YTn
z)*N0bC-YfUtbIJ<b09n1ysg{#*PHgX8q>`ud0Iyn)z)popr*Z>xc3^1$KtMzZFwlD
zG;64zXTyflwmJ<5#!RmA@bPNYK-#Krga>vg>PiF;4+R2?A?}|*+&h@XeP?omIoPWD
zl9MgjcGV-5Tn*$}6PNpLw*7m~`$7I|OyatY&OZAJCdHkaD$f&JXFvRH$Hs4;9zAz-
z_aqYhZ*}fw_2HQrtAcx5*;)@?JS}?JP@UFlb6%Z>iOc6KEzVh%lu5E5*BVwom5y+p
zwkAK>^L%YbN;a^OdZa8>^J_M9ty*0UC(JUW*%W&jG(JePS*WXDht4pHS2k~kf<sf9
z6ba>gkrm&AE4N?L(pFmvlB6#R3%^K8_-Hj<eyQXiaakP|nd^z0Eknikk1-)<wJaY$
zCRgUE`A4EJ#4mbt{>(R)CS4#e6>pL=>M;y6Nnm9+{5*UGJEgFhf+E<1mq$i}@l{hW
zI#`UQ?m!*vL5s1v7OO@C%X=odmS`(Z_H~*5k_#0h!q)o9U+)|;I{oR3*G!hrc1an(
zn;L{L`v?PoKoKs;Xg30jk=|&iG=^$W4l#0PA+OoPR9tK+M9a-Gl`Ack<YqDFvc{x6
zY?05zLx<#?&2{FVSunq15#=^JGr!l6xUz&Df9Ik-oLv)3(4MtA*rZ!@FrOe5PUr8E
z^TYzVV3=D|$7Y>dx;NUqQrN$9r(p&^M_RW&5u2j0d8{4`+Qw&^n>>bFr+awF422w1
zpr*r46z>gbpvHSwGFVSdbwIkQ@a1ent?(5rqgHsj=JQ(N8S2GZN|3*~{>+z@&$28}
zvP{J%o58zk#M1)4k_|D#E&8>F<<$x|pB|$4c1ooN8d63CbL_mClJ!=ZDM^c=T2?)o
z!eikf;ZzKBG~2m^qYNz}NSz837-eTsH}ir7UMBM{oR%=(LZpx`X<^;95;9%Wr>4C%
zZ>#*^O3OFoU)TF@o!@8F)B$1Vb6Re`Im2nTSC1iWFl{c*-Q<^3x%aaCTTU+19$Ws)
zp>|uW=j@GI`}Xv(cQ-FO9?^Mp-)Ei4N(e-(wI5=gHlCqX>~WYn+%Wi(KqO=4zT=y}
zOHKW5^YP=+`EKrc(Z>~LKW@t3moHbD^7lno@cexhiwqy>W1p^8WRP|%PC0VRKc86;
zWu{Kk--50a*${+FNB>MK584}79=|8JJnhe8<>fXxtnnqm*6`EDE7PW3*+_p~LT}|5
zeZ8lD@j3get`6o<KeHtPHhZEeC~8VzLb^PhFMQT=xrZWx6n{2qY_#Kb=LDam=&1Qe
zBjzn$>Yp(5x<j;2)VU?omyfmX*wk-%lf~a1Ed1?Qf7cV=<Q;tD;O;;E*o|N7zdt&n
z@1ftf9{O&PN3vhwQdh9!tZJabRS4+8WMveT&5QykWkG>27Z!4Md>+0+fC<P{kGXt0
zd!tr(hSA!`+clTZd`bB%%ko?`Q1Hp7;Cf@b7Vwn<Rv{zYqF-x-xe6SyMRmBGr+Q$?
z68w3;P5pbxds9DO^4`?nm%KOi`z7y9{eQ`O6CLQislR6YP4sxldlOxF{iICQ?0*gV
zP=Kg1?h1W~o-g^X2ETB9n~#s~u^OPtzcay2_$u!)72I&AQwF9&I|v)-#3WtdTQC}~
zFa;<kna=@Xdg_+OEgK2LuF7==yY;oV@9R8Vu6IRnwzk&g%Wlc>Ee8*8BgIvTvCH~)
z=-#tk?-j}7pU+m?jdpArmx2jR3*`jpO`UmoDQ%IV^J9aIObZSa`3KLYgVA`Sd-3k^
z8F>%0x&*I&H^arfRq^oLC57k08f)7o9}Hh|dGWFbxzlsUdaMeM*b?lwzQs!UsQqEa
z%3_Apk=pdP3s~e_x89huWj>h!Yku2QR8>$EdSpq$p(zn37SB6G7l2VnKs(T&3B2_k
z$*&71G9{%@r@krJhyrd&r|3|`uATZME@EW7_r$%6aL9N@aCmqyez%(uvuK9=KnmTR
z6&_<#*L}(O;B22g<J^M73Ijddd_itBB?h7?Ey%6J9|am@+>BCEh2%;k_2|8JK9EwQ
zl=|^f!hr+47;7T`%8P;{>dJvs6*%R4nn}=rk`dL7C?zB+5j0)p3(`g2C(Os%qm;Ua
zbnM@`RXsc5g9Bw%?=2Rr<%||hoa77a`%VFi_by_msyq;*G?D-?OZ<95HlPED71H5)
z4n#IU{U$FIB(Nz|2)V=9NcNWO`VotsSU#T3|3r3U7w*ezg35z%miu+VPPSwJp&!G4
z4DYhf<xcd2zKldn)f&`lFa1Q)puU@SGJZ2nX!Y;nCTWi94T3bTVP;b;*l>ueHa}Ay
z5%zS!8w<oUQpUuHl&r;`o>Nn12L~<}jtEi5=S1(BxO7t5@~CqS-ItGl-DjrvxX8>f
zU$3cwu9LF70&{{QmRi-Z$(c1JKR_8Tes&1)7Vtjf1_q_OQk#<v4UZ3&Hxz6Ri1t;V
zBF)ezVmEXIQ76)uT<krjK~aupqC>7iCGQZi8j-Jo5<Xy}Tv2&6%l%d!#V&s<7jA`N
zrZxN4@QvXDyDRtPi(wV6&kIFVOk0oze5kM{SvzT!vW$&t#ahN)Uh6ac@B#;~#iJ(g
znk`46?$zHLe!Ri%7L82UGd=oDqRl$%ad93&%e@eAqO=t!_f*kO<KytFG7h2-ek*Y~
z>p0p?6vRydUKEpFRL**{A$R0WZ2lejYx&sh9Xo3FKy)!&MlCkz{12#whl)|q2`%3y
z64<c32{ou7-Yh7n8c?$)3<+uxt5Ay?!vzUqjNuYG*>vqUs(W*tjqv28Jm0F$$lRqR
z_TeXT*pp|w#4~c-8-FiFCv7lB6@23S$vf#P+~-RZ!PoN6D{wb)3WsCNw5w5GS65kr
zF~&M?`ktO?Y;kmpYnJF<b6zf5c}9H)sJ^;*CZ-m#hgWVe(Ry(*=n=<5j$M!f(tyWU
zP&k_SHp`Yr8n*T*7nhV1733==CG6HSWDuhtssbk-(G)(WUEgb{;`ub#7S#!Vnv-AG
zRco!0wq6=)S-r{z_jwN$%w2^)fH{|5QZqEG#{=*rT%~5Xe&i$}CY~V~M)bu1VTS^G
z#o#MNjcg9V|Nl~rJgIEYPM(Y|@boN*HvTfHk;a_Kg-b5YkA62L<=yD{mzEg5)GvOT
z1C&R~W5q{6xxGRoQ%Ws+9Ifj_0u2ARR%Vm1we8U6jjTMHjU3(BuG0ni*?TNZ-uWIZ
zNxJvsZC`ck-(qa8JXWtipsP1|g5B$`16dE;Thd$TD?78d4DZWDBj$uVPG9Q{5<s3w
zd>-)=el+x$M=D|W0~`DLV?i2%$D80FEW!vCxI0V3du84+lsCr1nQc~-BaD<^_e<ZG
z=gf{eHev9h<n!e$^wupFDQ`)M>)NiwwtZ8Xvy9sCdTLm!QyUI9@hln;jBpp0CezVC
z;`zT&9&*nz&I~i1|G#n{B%TM2xOhgn)C+TBC9j|2A4!0Z$8UvWngEXFqP8%pP94}l
zHZuKm=+sl`a+h*uH$5$Fx_m*n6;eEN#-3@^$n1de^HkY^NegyrsRXPwuO-r}QwJNC
z?STqUO|4lWO`__WbrMm~NjHu(x=A;YiNxmoW>_hmr)kmC2?&x@WJeKeZ&B16{&%41
zOByX;_2j?g1vQ&CHKCka`TyL+VmaseCeS;CkLe85JLykQU$3n%{DR)`3zT$peoBc>
zMB}g^sCo_lAjOA=0Fu>}<g;jC!)DH#Hxp{W$WwRko_ZEh-b0wty}ZPKtZz`skqw1q
z{9y2RrKK`#t2lct;C|sBxDCb}!sf(7*l4|0LfE=c2%EBrv_|tnuW<zl!Oagf=<gXi
zNZBSjg}C=`aJYGJe4am_|JM!A1Z|5R0kK~FdX05z3$qBejBOk}di3*L<lEgS1K87D
z)I(%m3Wg2H6u?GG3iSt4QrW?(Z9nfME;`VaZDKnVfn%AmeL=pPn{oj93&cIv`^UV*
zAV42*(FY(gH_4IS(2?%2RbtklVmt7NHSq&VSeTN_yyX3qu#lZM^m>mCx+cD5N?1te
zy-5nl75up0YsO467Q6mVCIbN?r4^Nuz2`T1h1<{=Kfi@TTRE>>F!#iq_zyCfBQ!|4
zqS$xi+$qaOjaoJ(<wpGC>&x@LPSX~fv`_hg?kUHcmK4}k`G8@71}c6_qtMqb9*~tW
zeQ&t@h&9{#+p6v%>*YbT3?OW{Q*l)I8t-DZ=;QT+)~uSPoo!qg&=1-H^v1ZTd|@05
z`0OnWa}+?=TnV5vS`z&8;)9zXZqVO7#7W_fL7|@g8yspjKA}J!3$`$hM|a;vp8a}w
zIJQyl0%+?rwpTx|*nl2j3(5(A_H|Zhe>iRXd88Zy2uyZ5Rh3eoje&BYDwb9?(ol`6
zkc2bm<o~Ts`+ie&zI*7I%)qw}&3%1_%cvQHf>wI>kLWr$ve$s&%Ux&P2wt*z=IQu^
zGqch@k)O6$$%K<fnKo}Huv`A-^d8~GvAzkTM<@72ZHs)ZMg3N`E88}6>@)gF@zS>z
zEO;wv&AoMFNKzn<xhuv*ge<ngs9<4dU}uV*RU)f}dxoK`F78Y_$pfpU(Bfj!5){#l
z0|shnHPVr3$D#9j;!fJ?!DsDYo)B09Eu!z##Mcxc4_gyUJ9)Zj+B`u+w}5}MiEaU}
z+9ry|TfnzQs<(ijW`A5P36C~}<uT#VA*OroF7Ty?`CZ_FX_S~NSx%6aV&TzKoSRH5
zHNrZiY;?2{Bob{b=+FyU&yk4weL3<9>)qf7ySykb5C1muo9NzZp)_jx4)3a5FxKK~
zd+CVo5NJfPA)rhbGE>8JV>FP}$m`jOgb?51BD1FwEg}RZ4Bh!lX5F{zgl`@{V`r#;
zreAsa)$AYg);(Auoo#q3BP`!<TE@T)L-W&vQlEUP&wQGAan_s3f%6<kCHQ(w8Vplh
z#rl-<vu2eooEPsr&&_A5W8-d322EKzEAes+aX$K{#D+sE)6fAyRT9<C{X)CAzArIL
zn|Yri-An$B_p#M%i`K_L0V8=x3MWj*)=W=lOPrv=X^Ero^IsO9Cws65Ea8sq&dv+0
z>J8Do>J9Cks;i^K#Hy>}psLJMRZql5_SxC;SJ~O9ZaykrgutWM5Q*JGqj7TVKd_6a
z+@x&0nO)c1x>+Mp&zBh7M~lUUwB7j=y+vDT-tF9&)A3e^tuvygE*&f&5GE)rsFhf!
zxBdR)%qm&zk<ce{ns8{v`%6Mf7q*T{@m}t42p&CoP@8%QrCoXr?~{=s6miF1Tlg3>
zIvYBI%y1VY8Zl>c#OVVElDX!);%$ZETcumuIkjoj#I3;)?~^CXR(GG#rbpv$t%4^>
zgEv>TI#8yqyGtic3l<-4o_FHS#`Skfx+zoVVPy%2$=01yk~FdwXwFJ+#T*cc&0EBL
z5s@EWiy!vC3c=^%2KkS&UUNE~U3hxlG{X?#ieU(iS$*y2Rp%edck{JUNyvZ1+|%;g
zr<$FTFP#RbK>yPcrzl!IUz$}ZObWL#tP8^>jyBX4{+g9JYE<S-`FMrUu=IXZ)cqrd
zCc?y0_Y^<BWKTNGyX1Oe;*I!~i0c+L1AzR0Fj~Y0U4Xj2gOl=ubK0hOVVdzI^VC4%
z{>`M`E>&Y3MYqvaR~@Ao&z>`4MkHQ}j=q#Qa$$Hkudz3y%Vf%G->humb@A=|eEIWr
z>x9EQx(@4<C0D+6LH;|l<KT|lJv@yO&faK#FxUq7%Hl8Ou0BG9b%7GXH}oBxxNC+^
z{$N3~*4sHrZ5*on`m-m7|4OV*<l3>@_sBmwe0$=%1reW~(6aCEIvASumlhsA{A{g|
zoiZeD!io(CV{a^ryBupcfP>11b<}yNyV6zD98k6|D&q@(oEP$+ZIL4JQ})bTDl08z
z?Mmt3e0lW~eLg<2XHe5MdU1&swiQ(7hCylvI34eR0tIQ@zNu9cp+k+~B0i^|`|Lcc
z_s8#01MjoG3E57AvX{tz%SWaA&$>uBP9@85Q-3cTO5FFXUcK9`@+0A1K>_PoPylut
zfOZm9q#MzOSCRf;1g6(x=WNZKm^QKUEZbcng&BG^`euNzxv}9%l#ne(?b|2Jq&WMk
zKdh_RaN%<Vy}zATbr{(9L|5X}T45aGb%GSuBy{<IbkSrdrl0flw!Z(<+b5V~Bkb<k
z>rI%$MS1pR`CJ3}+&glV_$5@K(&A!q>@#2KIQ`(PdBL;!s9AbWGGN7db=g2Pdo}sc
ztLj6s*T2dL_De<v>y@64o)bO&)t*Bq=BJcsl+bJCS|gYt*?8&ZvjO<A654zwbiOKI
zZsYCLd7y7A`IhiSUY>jm+i{%8$5Fe*<NmC;`1jbV9O^IT)=tbVnzrqz9fp${wibpd
zMVVsY5G(x9`a6KnG}Y%o7EmE4aC+ayx7egByH{SE;pBL@vr_`w{_K|IKtG1>KKyg2
zQ^o6jRxFL%a3l6Zt#dC|k5-X~X8UegI4Y^nfL@dO`G*@ScgwwZ8=TAck4o#>%3<2z
zfUs#%X{G+?dvEl;QtdmJlZw>GCKBddoL~@WZ`ldSX1L44N?TbuKzp-tz^1Q+&=xMf
z_OI2gBUC&vd~4?w=H5wLM=PEH9o{J@FyM4imAl>If`H)d>Al4Q(8X^^^1+k^=W@DM
z9f3egthU!C@U<B$gt9gpWeaatw3I!L%|RSG*dn}}(EVNc?!JAj>xH;myP|9^Hy=AY
z-FL;uDXE{XOt~2Ky6h?pEs}rXOYu8r*?4~Vz-@WiT#uM>J?IQVg<P2(btSWY$!@s9
zHh=($)uXhtbUFA-&s}Q@lQYpI>YhgjdMFNZNOuhv!-U~`_`g$LJka5pc`qgPUWTXX
zK!+~p=~=zo)3cJ^?e7Sq*fSpN$d>=UP$B=F)y-Eq*r5_=7AFvNgMTKFf|2k}LZ4T_
zLm|y8A@H*{61;0ef|=<R?MRR1#(4dQlcJu(5vHDRfqHIUA=(Psy2BdwwwsjVBAhtU
zph-~d$eup&=W!efhh6A6l1dxfxy4tbE98%HAf|go^wr|IV!sl7lWFV5$Ohqu^8-T%
zx4a;ZjrHwjdG<wIbTWCQsSC;F7(7csPPQ|3y`}9Px1IfA7>vv22j7$;<z5xi@NM#=
z^)_4NAJ&UQ_w7S&hwi8Xe$9GkzzHKXff|JHQOpG2MX8%q#{qmn)RA=+$5PaoBqTr}
zR#oRK<_aQA;hv?)f`1H+U@41syQc+B%bF9JI(gAH-+oE=_6^&8Ev`rGowNSeSo1?Z
zOMW_#v}?hHkP(h!Mi2CGF7GojS=%7#%Z)D!sIb|R6`bZiE-`UjUgZwI<l7tl8`*c-
z(z%Dt+{^Nx#onLD=gI?<lLK9xhm4#)L_4+e+R)Uf(Q?ecMqz*#i>jCFM#DFu+z*Kv
zf-Q!{O`S%DXl``W@VBH*ODhdGj|+|sPtOY(5#v!_-oPp_!F}dB`+7|$XZnY34mssA
zy-#$KR#UlLn_@U`7%kjOj&ffy$q*rhp6welG$yD|$k6d+s|;O*FM`9nuLUaQ7?_W-
z9cW1AO*)-utDu5GHl7=#LC|$77hFyqKkpwRFFnuV&$IMN{uhp)l0r|E$<Zt?d`gvv
z@VlWbWSa0_gVl-SsCW}9#w`PU@rF^KveeLSfbM}+kG9b^S3Bqp#%7<2UvwtwjZLin
zp)yu)z1;Z1>0^&#;~yP4efl#t^uPi6@@HZxZML|s@IxI%S4iW!!c3_GzqP!%!K&P?
zuWWtEi@<-tvv&4IX^8VrYLGQC8LS0P4tntetg*Kcyiq9?7%rWVf8Vf?)jxcKHQ0E5
z_UZWOGxKKOSSL@=_0S31#DP`U#evuml=NkXS+_UNGuy%<`Li3l?#`Zlr)b^76-}EW
zI_oE>L4m-=Ub7NpMJk}`x8;RczsjrKq^n#wHiwZxmDF|?3TI7U8088w>1)Ec1j8et
z$+jEQT^5XVTRmmwXUF92EcD2_v8%)26Y%g`J~k^~KEZ|JS?!&uvUy?2W12RSChUrh
zE}y+GbDCGm*kb2J-qSK6nazkOdzDU*)lQh^7;E~^`1=)6V>t;&66A3FV_5a?7-}<_
zPOhY%zb_j9`WJ-xsX(a!(z7wSP?ZQEvrKs5gk)yPqov7@_U`>@Y0{(8d7J$FHqGPz
z+LW`P-=DDHQ>WwuPoBsJ%1aRUeZGP<%v~%0QE?tY^VlJW!6du}gQuF`v6HeB*1TB{
zG{(UQ=z1OHKX3jQ<+fmueSs1XLPjPFyN0E)NDsZwb_@G&!2CgDQv8CFT}~z5$;h}B
zJGdZSJ}VquDYTrFo#g5hGt4zPF#YO+1?OV@H($z;_ckEKm|DPz6PS&iiP`JNXnw0k
zHfLi_0i%c4atqD_<IRSv8csXa{+?9uAVYgm7qmJkG(XUP%Yr3K#%GKfnczP*BS<_g
zrQct%`r6!#n5kLr=?`rpPQ<y-bQ&4w?Vsef*Ez;}%=}?ak)E+9BBD>tNjcWBLF4d^
zp@|n4V7|lYBAo=)>XNI)8hLAQkvh80aNmZ5Rf3SS$XjkH#vp6bN!DkpROfM(+@Mtc
zfKBm~aGo1|!g)Z+l}{NO-Wp~F2o8N0Yb-n>zyC+=M&OF~muk=Ge3HE;t?>)Y4|UD$
zd18Xt#E|Dur+1Eb<l!{;WnbCMEQ=X6Ye?Yw(6CM8dv<IlJSdgD?fZ?%IyHCgSIdAk
z?KEegRgrFL0KSe;8UMX)+_LqV(DW7BM}myf%2xk|1Wvr-Fyccv#S!dCo#!?S9+1@B
zXhktD1yEqk=2Rs<NywaXc5{f=+Uu#w@1!(6+cIZy%-#tNx<;?^PP?1B^ueY{d4c}9
zlU!ma^c$CF<5J9;-oC>6eK;@TMC`QXnTE3A6Z@omnYa3ztkOw^Qzmbi;5a3I<b*;B
z@*^DpSwv_eAcrHVjO;3MUP$8GhA3^j2BpU<zXah3`z3rD^wEG#34dDWog8ae^YpgL
zu$hrpOheX|u~m@A!ji)8myJyin3ooJJ7dM|_+@ka(|uNazj1n=Z(u=4XhEP)L4<Fj
zyGxS)xFi?Xr8bBL3f(!kah=v@<6_EYg3@tkTi0nkcW3C5b5VOo#`*@NdU~b?_{NSD
zE;z?{dCea-Y`&LQj5CH_q56+zs&`S`-UA&wHNsk@VBfs0z+<p<BJ8D#U0uOjn4Ah?
zpKG2I7qe#~h`rJ$?c>yxZ#IXV*%acHdwsr3+=TuCYeOcj4fM~ki71bso}MX}51ZI8
z^~<%ZzsnMtYmxlx?RVtcAI=jl44e`_DtN<`iG?8`ze-V(b!x6JyDqG`*@CEOLC;G(
zb|hA?i<Qe>BKLL;mI4P?{`D%-F9p&MCu6yN(2A}pQ4)AyO?a!3_0-jYI-ix1Ep|)a
z)$26Oe*5b)M)Aq39;c<Sju$3xCr6cc9JzTL8?eO82RU^w)fvA!aB@MA*Pg6Iw#1Ms
zCdu7*|GX^ydz;YX$zx^?7@j!EFFUZ1oo-ON+VD*~tNAyQ)81WZA!ziJ)Q<#>B4%h`
zl_2=PX*e$~mY0=tAyd^vl`*WUio!l<$a|r0{MJ8}Q7I0`yn(csT<SOnuKGAJB!T(g
zk{dO(@t!#}`&x9;M=OI@czLY|4$koM%CN!gne)qW_M4$wch_zUZ>?T+Z|UxFxsyZJ
z`1$69OvxKZ4Pz$t!ie&QnPOhz$BQjE&14~0q_+^j8<vmWVo!L(S=XbJKF$tG_wq^)
zqK4D850#eX#=<8`%d0=(El<hy^IbDpX*m~N-i4N5ZQa~d@+fiXk9+q%N=p0@>!z<S
zt(*84>t^ti8tdj7*5LdF)*v@m{^P=V`HwZ|<k#qABA2E0X+<R2Pq7@1c3+E|<>Sf%
zT3l>iLb1S|$0sqsPN#M5M2_2yz&4LRk8DZLOYr^_s?=#mF?v3M_woFBbbop-#Peoe
z-n9)qBWM}2h|0SK((@*~FXZpt+nUS&i1!{aD2W;)b^b3i?V@p})k-PTO#8pki^o`C
zeXB9wKsCdEEv6jqwzQaZ=$vuV@iXjrHWO<sCsqYIzmOBd+l4w0MH$aTY#;tSSKiDD
zH1ES_d87JfrHm4J)xYDuFoqIe{7PT&XQ?~f*?2~|FRFj#;Wv4jW2^}AP+bUuK~&y6
z#1~ZODSXjIsgvGl>hN!><sXG(I18`SZnvYlqw(B<KNmHjp%|yWM?Nu9jICkhM&uf{
zhPL*&GmdtF6!#Ai+=+*HQz$lairbD$4C^*|LsaV2w&M!fcTpQAcMD5gQaG;d)KtT+
zG9h#7jJSu9>!<cEWU;C8gV(3H*i}vMHFf>WZ{s7U+Pj7hlD|!j6Hc5u1q2A8+dxP~
zfHy~*GTt2RM{z$juCm}LK{n9QN2YgdF5IT(LerwwPwqA?(XcBm6qqbY0#@tU@8#t}
zrk%@_*IC<?*uvgZ*GE2#n^7fgh)ZRy2Zg%YPi2vD-_Be=wU_9@PO<80*3m?y9V1jC
zF_{x-=b!XkUF{AcuI5Cf-B2{1JMibCCiFZ`d5^RPkqGKi-rv@(#`8>iW*tr6?--%J
zNBvaa&OhnBkI+s0On48&Rz~c?A?wA@#K9^g3Uyx4^pqAz;rQlfE5fM)&-3~7FCWnJ
z1&u4-$K(Cu-)cVpmp|WSuSp@|BE0|g3BA9o=`Dp|qo~vV#-GbI5z-Q{kWTxAmw%i6
zhNDv3@%+2;tcgbbZSnkv`i%QMk#$I?{gXc{?N7t=U;KHK=8#k<KEU(;_;Vr4lQxPC
z@cfjX84Q9_XG{~luD)hHkJh-Lc~4rP)uPWo!xy-l_whYxK8O5L{Q-wu(0qV0Fmh=h
zSO2ET;r%v3{;NXnGGu9ynxV|E)lc|Wckxw-mI3mc3MprL^!64YPw*AB^|r8Hnk$X~
z<aZ;4S)<2q0rH0tqWKAZegw#$D&&IZGn9D>$X|dIqMl96S1Ob;0QsL<rcmgKp6>(X
zDInWW<{eG7G+X)*arF&E=)Z8?{;bt&zk<oetjAI0D5inYl?Q8u`G7T@w9spnm6CEr
zC?TdelOwpS`*@Mxnu(vkHlo*5|3Sfh93~7Bj@&og@Jscaw0C~=t_cnk2g@Iac)6vF
zo49BB*uyU4+jRE)kIlR{7KP^~j@oTA$Y+3iNN@jvgCgg<R9zHGrfuFhar&m<@%a;7
z7Kiuv+$Gl4bHQ-W?28HOE9STE<?BQ0D%?|uv*SUZ6z(9hKhq6A3fDIxzJ6k9CG;9i
zF$COUjJ3!&DWZcYa-$S%OX$hX1~(f{8070aXpoN&`%?V9s-bM->qG!2U(gEQik0}*
zUb~JqW7>6sH-4i|xsV-};?z2=9jq<ue5+wugPBggyc)TX>Xh#A1_ljM>(t5+$;LVh
z)jG$at>b`q;3ibAPS?Jt!w$gKvOSjS7~wi<(#ZKPL*{uP`(*s3xaAk-%$YXAx09)B
zZ`EJ9VSKl)N#osS4C*&4Am!MU87E?v92(NabJoQAa(|010}cIEj$R?}a-jrA21o(8
z_Ob<h9l=40NI5~gB1NfabLKGe1~vqU>+htf)x=Vc)=Cfz9{^#Kg7$*ZL*{vEIoiuE
z0_~AL3fiEcu)Tiv#^CNi+clEVPCh;*@;IU0)noRA`s}t3C`y#2r3BR5$EjyWXAf{d
z39Y}Jex07<16I_=cgzGI_k|;d%=glr(#2kkU3Pxf@-Tn*CTYzMH5<v>@%3f9bZ)un
z1BPeK@QoVSZ+39fu_<%PqgPxTK49!*FC9`yhs*vzh>-FHQbe0`oHhzl|3V#{F1D^g
zq3AX~UO+0wnIol*yAYRF0i?#c)j&!(r*mDq!f{wOM`}(`($P>OQXyk>hHzZVaMXkp
z(|n5cW;NCqtiVXc*%TMQ3uJz7ifyOx>FC8?N4*ygbzBg9G<AhAbvK*Aypp!dhvbt5
z8S=042Pf{cOPF?HsKZLFV_;Lt-2>l-lG8>XHgUeg&}g5dUa_MxlI0&yvwo~mS^@K7
zf!mYhlk%2bU&_NjLLCoKM>OidPSYC6zQ`v2faN{_Snsm=@5gjl&RB#3H26+kR14yS
z*VSMuEPS$QQ&m&-1ExtropseZ9pQ6<ODO39YL$Q7tZTaYDP5{-EMl%xEyzyES4AqU
z)Tw?TYVuI$W7PS7R8sQ(e^XKj<NIa=URg=G|Nobg0;(m-vHB6(B8{hJB1WQPXT@AW
z>B?wts!Z}O${ok5#b3ET8Y+~!+3(z`qoicck_be>FXD4{0LkV{dEZY7i9a%*ySJIs
zojJ{1S1ulqIHhi#R+$Sk$|gs>86URnwR%OPM|k?Q4cJ$$IebWdaxOgl5^H_dZ*xMM
z9=-GT7EOzH8X7--+~VQ=qvhDdpV;`%K4Rm3NzV92ey}O(ld^g3#|$4aE&b~?nRk=i
z>;nz+hE9rjfA`WK&(52DRsQ<a8Tsogk!|hj<yhOd6g+*l$0cMr1+57T*)<&^@Kb0~
ztGQ;iooiZQc(&rtMf~{zo}>Bm4*r~k=eqoPCx6bv^JD(J+w}fEf8N8N6RU&tBap{k
zuiXpL`W0-)*jr1#@U=^gXYPQ+Ow6f+p5eEM-@?0p75-6msihRsvda07!aqK3DNRB^
zaAj|{b>l`ERxUUVcWm0E(P<K}%m+h%r-P@YZTC?OPqeO+FNQ2NjfCedHLQzMa}hsU
z^|$a~>Al?{A-nG_O}f8l%9K6#lM>!uwCL@G_$#roR}ffpH8JsO+|6g3)IV&(4t|@F
z@$G@BQxD+xcL%5LO1+!9>~3=M-DUVgY`paL(r1~s6K^hEdNWb@;`Y+p5DUGl+Y9Bo
z7LcAA2E9Wlm)n=HuXHW`uA_Sjh)!<LcI!{@*Vt;Z-P`pi{+eI606cn8{(;R_iAABc
zovcyd;(q*(tuqAa9vLPIl%(9E0c6c#LL=V5SGuQvQ?B4VXv1xx4O8<l4T^0IF~WO1
zd6`D&CTYxXBuy2b_?s}nO}Z)kZ2Sfe?)AdY#&7Cad{amBlz#(WLT&U0S~~Wx=$D2y
z71P85(ox79sd&wlOhdwm2?fEy1rsLb2M6b~rpCV}0;&-#K2&1WYkZ3FRP;FPWolG2
z(PzN|AN=s@CghJFpFaWBt(fmiaNqerXaK7geTBWoPKmyT?}WY7DHh5ahza5*P#nGk
zJPNH?10hE~3qXNppVVHggdqvrTRUSvXqU?cyp<4|``&^D@8z;H@-`N6?CidXitMb4
z>BWY}#o{>b)82*}x|?c%Mn^t<H8uy~o({rPL{QDZfuJ|m-deEWmOT5-H}@3_O^c^j
zWMx-Gh~t1?3)Wi<6&G{N@i}WDxEaohiw$Q%_B>&|*j5}2vX^OSW21rMt>Mq*{5ecG
zF5MKz<NZnF`#Q?|Q}hgK?-$dgZkVEHFl<n{Eg)~GkO9I*(N`RbGG|ptDBCS2NPPf#
zQ-Np-*a)e;Q~=01KsEuBZGd#=5Ew`Zf_}UshDr@khTL77z?{Y6R`w3(aE&ztK=HO!
z6U428li^w|?<U;dW_ouA->p}_gW~f;vrEmCcW4*ygdgzEUV9U*=(RUlAlLWMmN<~Z
zuXFfy7X2Lj28Z8J;R*6)u@Ni_WCgfaDWj$v%!6AP667t&<MshT@TMBL`T-v$Oh$w2
zMI2b%s%^IkA)td-0;Q?7#}A=%hpNXXk>Y6<0T|{bbv<&x^`+uz;Wfi|_y+GpDsQj7
z%fGn`9fed@z$K+?1n;8daMXEMOgFyQ9WZ@oe2?Gsp2}$vja0L3j&4MH;#F$AM$`BB
zC-+`xn&4fu9F8jQ@v507S6t7gsolYdTpRM?U~#=L+;9nX;+^Qp(fSXs^FK^UiIE07
zONnZ``3e*UKVWNf1hNC#5iFaK8Oo-Hby3yThDNmywW6$U49dc;!!i0oz_|%v^o6ud
z8CNLKRi^iV(|hGRc0}q9e-wR3wjB+(?G$Tnu_IbZ=)&QjDsLo_zIf>y>cMr@QbawV
z+FC2M3B%YC(F?qe`h_u6i#P@CMkx@H@;AQZYtSJA^ZIRR1nmOt_`wtQr@VmW-<IRp
zsyud&-IKe@T~W>t<&G-l5Eh36Dt>I09Cw@L%L`1!&=9JVCZd?V7K8_qKd_CQ6!=_n
z<?tUl{6~VL+9R-rgi7Ibt`N3qTjpfjh1nhvj~V)7Q+!*flfpi`EFWypx}JQHl;>Yi
ze7jPdA(|2PB>XFFuksV#)9VfW#A8Aox$`9!RIhad7Iaze47qw6_LUUaS46UZ+d(4Y
z3tKJP(b`HWRes_z`Y|j(bNR0OSVb!HK6R%-yM}j9KL0H;@7p44g&i8Tb7Z&aL!khz
z&KHllBCIV^K6&zP!*&hsoRZ7%=>wQ;=D=)2aXsi7th@MmAZAx3h}puek`mbm3xcS5
z0Bg=1Y{ID+SkaCss}^R7?8qK@oP1gNsJGPj+55r{^-DqXHtasxU<lp-9R#881pobp
zYvPp%@tvx{Z2gWMAlV(*gOXqmQdeauscO8i{SaNKaR-*66j+9o8YpNFo)f8F)z!ra
zs-=GxM~j2vs@_?=SR73I^*b65DG8P%vIfwCskr}4Q^#^&O|7sGoqT+poV>lA)ZfB3
zoEJUh<22CQd!Un#@R#?Xfj&M12T|;$GDy=nDj)-qnv((D;)KQs-Q7=A_TINo{#5wW
zP#^f0!ctWNOVw-Sinmq*e3bxsY^aP8@-W0SSA&0ReYcMVz&ViU=jhzU*+bYP24s!(
zNbnyps_S5HVGn<|WZb~v_R70VZ_mVW{YQ2gGFA}QByDsVHM(clN#mDnbRFu}yQ|+c
z*&}Jg=us}c>?Te~D0Fjn>uK*7iV-M*1#K@ZXrNgQEFEiNxlahl8Z#!*-*JTfaQ8hz
zVCI;yOT7m=+YcVg*y*JkM-O-JZ9i#z(#FvvNB6NCHx-lZ2n=tbS}o@J&zMYP4EqI;
z?Hod<Y6x;0CbSf-h%%1>A;X&)@?RD50EV|YQZtnKRsHG#zM7+Dfc&OH-iGNbTe<?s
z6F|12o;z6olf)5#{H~U{1H)U2^cEn07$GpcB}tC}p~H&`KA)k?Q$YR#gbZ(`FuavW
z8G!sxEmH!++g@=WAWs3=1`>Y7hDe=-AGxiHv>Gch$uL87VMAEs9sdt)-vJlZvHibu
z@7-OBqKFh5f(R%oB1MYy-g|EXA|PTzkfLJ8h7Ak$f{G@Z#2C{|PmD3fm_$=d%uCU{
zJYzJ!JYP%{*vtPrbML}}Ym)c*{r>qxcK6&f=bSk+bLPz4GiO9NF0e7#d>fF_%i%J4
z@NJ#h7+;*Ck~H%4^_-HOT;|cASPo?JhV5xvF@!fFxFm-=s>u<vxQ3P%6t4sgZ2=ez
z+nyq{Pil*G{*I!@gmE38p`d?D3waNPIYlyZ!OmA61{ri>_DY|=EyE;5F1Wjk>&S%n
z$b@JAHQ=Ah#29fbSFKqOV`~iQE4e0qGo+*^Da@3P_V%7i6tcHeD%JL8<mLY2Z;@oE
z_+upL*MD<AVjL;{NQOp=_u)DczY`73%}Y-ZKk=OtOPiY;PKfV-AZ@J@Y*b>O$=(c0
z5PNfwRD-4?h<bpkrx_P+>?y8|C!55|L{jBxyx-W1R3##@<)(OXt(S2ZdD;Bl+Dkqk
zueondUKS(F@2~mT=hE7H=17nvD2hq8@GG{Aq!p1L#HMc>{$w@e>F8z&hf?-NrKk()
zUfY>+Pu5;Nn3HqxYHi)sgW1^!uh!LHsHwS7U-y1Z&HMLPEMFzMk%6P)J-w6c-#IYE
z)5~Hu$)?!aQuK2J@TF4t`?M%>R`xMIQ&OC=Cc3!TiS&ws<6S?gjw^pc@QE8sLMWe4
z>W&wnp-sp@E$_KKvPwttM@RNX+ZlUuG>pKS!}*SPYs#LPZ*pqDs?^BZNc^8#J>XRT
zieqIp?^coH2gKW-*3^7TEDjtX7WA8V`@q64j^ySZ`C_5`$=#|wSCzH1FuEY3HY&0v
zVrop`?yTx_n%X|a7^$aq3NiwEYK84(x@8FS*S&W@gF)o?wST8p%H-;EHKk8fn4B6|
zoffqqB4R;Q+A5P%Ci72~)|{&r)BjejfSI+M)~Y5ls+QJjXI9m@&b9w-t>~`N6m%^)
z@quoqG3&dHqOXDWk?3vv5AOKljkLtXw6!IFLv)hMtG8CoZ(b4U;}fn~DsK3DA}cZQ
z&kCzBfK|9xoi5-kAU5wty=@j12(v>!>6FH&+$lPIr0}+Qc`BJ(*g2<A)R3e6S<XtV
zBdayHI4kKNy<e4_OHIXCOXgn?<|;pDI}fh(C=nL9?3ff=pwcr$jt<OwMVua;?T{!N
z|FB<5BZ=H3DOix&(1Nl|H@_*~V_bdXVmOjHGiO@n1n)4oeGX%MlTs?qPd)H+QS0HN
z+xrXn7c!EZ#*7|iZEs-IKhei0KRIdaXeZ0zHfp2(DS=Tbf+S~;%rLOffif66(4OWQ
z!kUh4PHHP}i8qjzR4Q{WjYQqPtx0FqZ~3mN@LyC1sp95TZO#9Yn))wj#WxkC^Ff*}
z!VKAwV=ElckoG;z5jAD*hIa^d*wKM<En#lyDXo0sdF|}ktJgEWn0mC;h)h~XW|xc2
z#8BK^L1r;Vdy_w>RUk*joW-%Ri?wQ(cnS0}1#MG0KGKv_nNo6BX2B5fVWC#jp+|Cc
z+cvjw@*bbqSfBm-iy8^>FAaLMl_}fQSpQuA*wn>^xk1yt(A@cG?&q-@llYH$gnRdD
zMYdg1=r6XSRlV7h(3-}Ey0RLhLgU~m(XsLIuE8c#`&T?Fgs`S@&6=Vdx5>G=Ifc&d
zY11%~E$97sJFF*I7)0Mql}C2EKF!;eo4YG7cV|w{&Rn-tSJzZG_cT}6G~O?JS8m?!
zoSfZxxx2D=P;jc7TdF%yz$1iP&5uROJUfLe>(gxag}v%v{aA`~#@-rqjonek)C1XA
z*c%d3nYK2mbbo5%w27JN8Kr{{+05S(>rp#1w9RnH@~G%C&wi=-BNECBxz$rDlc$zU
zFf=qCHbMxE4IA$mo98qnpfX!?b-rs#qeq%cx$z)l!N}X+#}6{a<BZBi$n^K>{mbH4
zOG{r}y!e$eoVrVy>ET|Hl04JH0|#AZy}fM3I~5i0tXTF=#ioQ62?;9`>HjMdz$25p
zMf$5PVZLePANrE6<6Lwo0gkN0Xb%tW7H`#gi(fo>w4H~Cor61O^#bk|_pQo+rZS-W
zbBKFpX}IJN<WZ`w1G`j1tCQw!I*=X_ktcjE4&tqr`bRe}(fphI7MDfuMVgIWQET+>
ze)Js%LDX{hMiX^(1aonB>VdB-E5ANK&YpfnIli;A{<GDMR~NFYF`QBU49e5J1Xdo)
zn(hhRl!rjCk+V|i)HAQ3blbwKjjKPa=Y@7$e}lsH;uT>Kyas=)CaD#3aP-t>PH}Lw
zmtK>4da@lnjH#Y%)E1UXDH={KC%-Ynt-u(2DC8i$Ftg;`DqE*n92zoXc3!1x<S6mS
zz(NnNl5jpG^itd5)8lrI$}K4<ca5?mLxZQfO(_lLUHq(zo;Deo9X8T;f_TFw)!*9R
zMZ6NdzR)RWW>SJ@w7c06hmr-pe)D1lrFUh*#-pt*V+%{uqda2V&D$JHD}4gyM5@%I
z<1<}prt79bLz08XhWiaUVm3S_XiP-la5Qh3;s>>v&>x|a{)%K&81Y=xIJ1{)s2?@a
z(sYfA;JtA7>%Pg@MWxON5UFiv?~;|1*(Z9xno*(e0Z3QOl9}U2OdM?LFe2djy16e@
zRJ<@Ze$}jTRufE3T`Zkut&E@d@~l}e*AoBoz_11GBPW@gxZ63`MFy7pE8~fOSwL*<
z#4!{5nNPBIuZajK^B4LNr!c2s?n5lc5BHx2V)I^_H6hZ;(!<i+%VKQQgjp}moBLvg
zI1A+iT&;aam<8KT2=Xfn2q^Olp5Pd0GIGiY*8u++Xz5nO($GMqk?e&c+LHQBDmf>n
zluecOJi1qF$>Q842MjSR&K$QO{eahiiv8KKt3ynuY?%M*9}BCm@7n!k)$A)z7B%=z
zSzK7OaEi*On(qqtUw6KIgyoT;j+eyEzx$jOubo`~Ym3E(Z<e-YZ_BhOI$B(PVNs+_
zek58WS-dB_g>Fb!yXgDc^QG8xK*SwFV}!Rle&9dpH0JwjCRcK^HO-Y}ZEY%_wzkeE
zygN_r;J)C#+>J4Kw#!Lr0y0?D(|9e6AXBBu>zXmRr}JT^O3|)R9aoU9AH{LpC6yan
z^64D<>~-K1rv&mx`i>Z65;h<z?Brp`D0{0xG1dujN5pXkMh69TVwy7H)NB0=_6Wk%
z;`V0_(SyV|hbepj?gFMlx}Cw67iN|?7Kho7n@ryQSo8Vn#pmr;i<g#>=--8}@eadO
zbMrUel-?r3<5kIJrM0jT-z@1(B9<&v@^PNK6fS!*UYMJxX|4Tae^%E1Pihx@bRawX
zz()&^vZ(yonaP`H`ptOGHBp!w+i@~`|0gvyA05cbI`C0V%_sY_Un)Ocfm8l|6&sWA
zfnI?@AXqTnQOif%aE98_jvlhariWcJ*|gRS5zZb1*Ey4k;)VW=WV<+T9ZcTs7R^(d
zliRj&sa#5n#zJESQb<w4y@iFR4SVCyHt^_xVF6FHqtW*=7-8LWhldA7jx=?6maYq5
zl$28#9^jKWaF0diqL}#gnTOQF=Z}gmwwPuY7ZSzS<m3b<j8&=4Myegg+Sv?si5fdG
zJ5bEbb@7}R<{4;YA{dObu^$6Ds`+}}N%b^LvJEq7j&{`HF_jE68{wF^sGGpf=x}`g
zjKM}voKO!cElymOl(1@jT2@wCa!w9kA3c6HKVE!qd~!(B>={iFD@&7-ONvvIOVH&~
zQP+E@>qyCHYTs`lJpmn5()`a}3X&IR9mvQyFe`mUO8>nEV*<yg6%?dR2p+56(?59y
zUz4~wf9j@0w`?CfYnNfuGtx^(OtK#3ljnhIq@o&zI@Qp=39*!X9cljUt_E3{(iorA
zm@ut$kox2k#^y8ZQ?j#D(lWF7`iKo>vztPa#}n_)PiH$vt}IDTEiO$;DwV3iBPfZ!
znCs<HV7X4O*Fja-`F?8oaMqW+Hn%k+V_*5y-8q_V+>oT4RIjA*<(a;TraOo4<!fR$
zO+#HGno7n^8xol@CfqqJA<e;hR9F@&W5X}!2CKfs^h%GEBUh!)WMXOtc1IiYCqxe(
z)8A(B#0jn9M4+!PD<7a*B&bG@(9Gm!HqgXysoZAXn2GBw39Oy0s5jC*ZNjwS%03Kb
zL_GJjGkGRsMcSZErkRl`1*T@x^KfuKX>~$jxtZY;S$n6YWM`$OWo2`l?SsdS8ENnB
zTR$$qZ)G|37C*5@vnO$mH(8LEl2Tlnm^2l7tLB&UDzptvRzqifQ#(2NCVnur5t|do
z42IU`$5jQLObLs~5q=e$(U*>gWqOx{VnILKD=-)ps^FKCv8tOG`+EG2>J#Y>US1B4
zUS80~OwD%gHJ4GNT<AXq*Yyx#5KbuBkDe{Z+d(>SNe-}?&enPL$<Vr_p=KWL>5iU^
zlJc%*L3GCGWut7kZ@Q`RtUhYgM{;lxZsKO|MsR&7)=0RtlMJvX2Is{$ox~qb5bL}1
zNr*7%qr2h-B3|alcYaFx*Nb(MQiu(R&|OXF0V+^E-T5g$UV0>~#SWAMZG1P}ZAjbS
z!ctlUcl$~@U#j;Rn^-Q1agU#DYGE2%>Q%bpWR$mGY+JaGZz9#k;hY5f<j~M$`#A+-
z9$Dn(>EkLkk_H#ADQ@B#Z3CgFXd6h&vYQ2@JID)tT8Nw3(x-ti&Us7F8Ne<$);eag
zqac|P2R2FuTaXtj=t!@qIFO!xpdvljDZ$%2(J7CwN!pa3zbQ%jyKH8PSE`FknrCta
zn!lRc&pUxSvs6%w>^y3{5Ts8w)9Jz0PZ$j<k!(~-e)(Ya3E5DANJ6dFNJUQ&pCSd_
zmWqy<{k)-;2hNf`I#P%Z58m*k+PpkhvL#c?&5WK9pO6g+I$X-cNXeMQyVQ!NI(7u(
zfwRKy;ULz&ay2Z?nSW$%T7AsGqAZ~Qi2nV@4~Q+M%{R}_PY`w}m62ZJL9|vftm$QR
z4|;%wPR-2Mf@zbJaWGq<HLUVNT1A?c9I@QjZ$hwBV2rC*!_4BNs~2t^*3xf`*XYS{
zE<P*Erl)M-Yx2@;M~*SG8*Vky$igf$Bxia`^hm3bCblCiMj2U{CI|WF(q)egzkpm)
zEtIVj29pJK^kDJSDhHPFV%Z62oBksVY=(K-POT%8#TlxFnioe}5~Ac58W<6ho<q*V
zLQ%u82nO{o>vy!bU<9$45q4ynrWq$San*q*Qo<v$PaYJ6q4oSC@6r%N^fY@01y3fk
zHQQSv(m}@q2F4zA;85Vrju{;*kO=pIk|^=c3+sm3n2s{F8M5|_c!#P}eARbhM8skr
z5~|sb!mj*sM6ut+Dvs`WQ2&+|_SE^t)5DC8*jZDniSd`uB@Y_ae~`&&^XvnegY8WQ
z^|LWce&PD5vVIokM%ISr7X8X7lXlP5S*dG%+S@(XrKhZ&(yrOwWu1~?Ynzc`O<#ge
z22K~4(tQ9N_K=w27_ujFuM<1EBSMp`t0xm{BL4DHiv7f4A%kokEHlm^H4w3Vq14`a
zSeUJy!*p20b-PIY4Cg{uo6w-)GsMOgv399*fqQV$#HCa-+%7Cp?=m;e6Lq6C>!l&)
zvlqFm?0m)#R~m@_g0_YZv>RkMWXl=xEz9uIh%v$3sd}y-H_+OA6gQjdE;6pp8@fxG
z6zkL<EM}o97r_D>#&`kdfw|BeFILQFk;UQ;&KocNYWd|;$uebQxwuYAZw$^u070Va
zB^1EsE_!hH`xjkDgM9Jadlyche((HqQ%g#wPAx6rYp<U>fBoxs&t2cxw5oCArd2C9
zz;^1=qHlB_LrqQH#J&{$g2;j}J!G9maJfTJv1w55e_)|yN7+v8;Yt4Ul)?3nsG;U|
zE!(*WNJT*UCy;2@lcM?U=q{`&@ia1x${I)F)(zPT1uYcp#tmMd;Me&n%FIP~9RUT<
z#+T0#Qa1>v2r+hPB#xS1*S>(Hx&)5Q4~xiZdvSBi^MfasB<~{6^UD{K{tiAK){_GQ
zCReUqRc0F!o9jDAy&iN+p;&j&oxl{K-9)8Mk2Ke@xmLTEinW{CTw21Bi$w>ga;LcR
zsQ76!b7N!Uiqk{Gr*X$f&aQmi)>D!)voa4c3_df$$GG`VoaDdI&t-zQ=Y;TbU%#@T
z&>Uk`|Dw3C3O`u_FK9z{^c;2bic0r>6YZfOa;f;hRK&cNMI{!^Do+1dOyZV_r)RcJ
zEjYs0de4X$>l*0k7CrB@vZ-F|bTsj<jESA&i{67SkKXe%mJiek=stF+^q`xC)5+f2
z7(~o@i#L?5f<Yr^^OkthU~S_wQ@CKLzNd7rvqajmvyX~<I6v{GYA-9Q`57gj_9dpG
z5>;CW<&FVg+eehEJ*=qi@tMhmf*tAPNiIJmv20f2n8cy`J&?{Y*G4s@EGT_-!a2Uy
zzarGdJ0UPQVZ;yza;WLLt#fd7{KEb6@NhvZj-&}iq_+}U2S8d$>&$!IBZh98k}F{=
zD*|(#tjXJyZupc@a!_dAMD>XEsi`Ys-`XEvR+iwA>dY&P_}VeKyXUQVyCP^-sFO=j
zZHjkT@cigS2Ue!|`6Z7D8Z#w@2~oo<QCkZgXO|k(-Up|8{ORX%_D-Gb(RD(+;N0Io
z-6g#-HfvWwTyb$+?DXk;jemVsP;CHl7Pk(vHAi@8YD4&{L_fbo`VXp2#sIksX7oL?
zY(RF9L*g)QkC=x?dzI@qXy}_&I@tY~X2!9z%d&&<_=AVt^65GT<ii=q3Xm2dsxYG^
zKYvGNVU$;%cVXL%q!}|45@wbqhvw&nh2?>lUumFAs*j=Cq$JqC(A&GnFSx`+ZQzqS
zDX`S9KFr-cG}PTajFbmXoapc8;vB@Zwt#n0z23d1(+)wLFzoTT<<wX-{!!W*!TN`s
z$)#;(oa!Hv>!P+^pOUgNHuK25sAbc<v!9&fmNrSLE{sbkE#nsi&j}qrDY!nxCoH%s
zI%!3$z_}Fcn6doaEONjxWSmc8im#v4e#_B*FU##Gd0=YZj`W0N(_IT`<pnK~XL9$@
z_Ir}JOz!WWHYt5IZNJ#!;#jnw>Sh1Btf0C8@d}wGwO`s|+J3%?iN37;wsOCaFI7LV
z0ZAjT5mXGym`5EPwmQYS?vIWe89aG^N}BLl<{Qt2tq^~%iP+LMV*w)iuwD5J*(MjI
z#}1?{DKJg(p25~}(fi$EoYGRbUuGQJ98p8eSA;$HMrQqkY82dug72Up?K5&*@IK<O
zd^z_E|9gW*MZJq+psbTo<S^gj<;#f!_e%rU-q2};23yO2!~Ij$AAO4%c{fvgI(yCC
zh@{H7cr;P-$)}BtAhljN!Tq50X3jd6U)&FxV@mIhG)3ADVGMUo`Km-g8zr%W3)Z~O
z1uI>en#2c9^p$nE_#XEb3Bl&Cqe9V<2uQVfk#`~@AlSxWkW}E@V>n1yB110nh71S3
zo)(8!F`RKS#74Zr4dxJDrh>VUa5UfX#ta7&0fSVFS5S)b!b*@qD$tl?IX6HiN|3IH
znqP<$gShCFQnON%dLYDxL9pSir7Ym0N6^7ZW-UaP&|QY0Uc4of$3u&w`2}^S+Q7>o
zRw@+`Lk2-4gq99xMZ$sOB}0;-pUaGww+yin&y!2!1K{{{m%0S*et_V;8>8cay4y2|
zuMBa;CT=~0;I%KqnG79vF^Ipml;$UXEQ18dkXgXF$RL3-Bo86uiJSp=1w8@@mLb!i
z=l?K`g~*U1K>o=fp)zDHBpku$gvpRnP<CgKa2<#jD-|I_rlV9MgG4?8iIO1;L1zrZ
ziIyQ$W*0^|rW^7euVgsbnq%5XMosTBNL)A01>TR9itmP;2Oat{BcU5|g;#QhfM9E!
z(b+2clP@`UK$2ugJRsW`1RH4#XCEN%Fi46FDF$R6gQUukwO!8KKS>_wq{)!=T^-yH
zinV~G%a9#iwcIsCqN-IH6rv#FT!cXkVY{U)?V&hVP(0D8pfS-HweeklaBuS-k_+1X
zJ_;^T_k>D~@|vBkhg(_>AKDcg6BCPnhF3qh`1u#_U;K3S=GAMPx2{>U3Bx`Xq%O&%
z;DJ7l81q1zb{;>zbLa76yJF(wV`Adtd_0J+x8WD>z4zr;=g(hT-n_19+xGSAnyrU&
z`4+G`Xd?0gb_AGh!djF%pf4OUeCsgXN8pZZKe!l3XluNF9Zwxl`8cWUfC>i0Cu4#T
zP&0fTcbv2J8nrwH#ZY3JLV=wj4_s48(^#<g5W4OsU3b9!EGGj!ro>Ei4cv2Je*F%c
z?2K{}UO^na)0`)|Po6Yu@ya~=q}qaNqt&2T3>~}yim*VazjoI9OUILJN?DnpJgiP~
z@kxw~OHK6*^PV&=Q`jveFON-|?;GWxo^sM~V#bsqHr~$eVGRN9<2@Yg{Bqp`r+bFy
zn;03D#!p)*bH4x$VE?i=ck1`{^*T4ltw=R!Gftl1oi;Q)B=E3!gmb|8rlrxz8w|&#
z2ijVV^Bv~vRQZ<i>T>bsFcZJI!Qo{-=rK7^+C?y7Zl@=6J9%gcO#-(whlI`ud7oU?
z@GXm%an5gwt;UUu4^QFZna`;$%6v{*RJWk8y`6mA$#0|OG&fi=GJ-jrRbBVFli-Nm
z#@^LJV>z<y7&;E8imZsM3+ML;VdJJGriTplwc6-I&Wo=MQ=3HC$JT_!H5z;7`;HnH
z>*t@Q<ZMX&>KFT4h1bW$FN~Cj!|P~2YnGvg1;X@lIrVy+YLx}q<UFT1FuNrywm!l5
zz<^-4m;z(FlECn)@FPtDX^DXjLF1I_48!3``<Cr^E7!Lq$li7FA`h?7+Jps1SEL8{
zrrQTN`V`3mEI?h&=*ofC7HdN0ZZa|Yj?3b>CDAT{$6G~l^q`_~l`HmDdxwO0`-FuV
z2GynbuPGu5ae>{K`l<!ZOC$Y)!o&RoqR>rXIJqU@fzgDMy=<A<Kr+Ni&PzPT?J;g_
z(iC7gQ_JuoR522&z*Hp5@+ZkH^!u30bJxd>i5Tw_61g}ju^}?l%PD+Z!up)hm}I|z
zr08(>uwYNGpb$g6$D0Hf({R9a-+&@7?;?M{;sJ(mF<pa8r!4k&_X-R1a`z|YQ(RrW
zy<J_WFiri=z0P|}E~ZYuc$|yrIoW{@ZdkLLxcYeGgC;@lu5sgy?92Sa7lbFQ&mKE-
zdPw%R^zp%Ccx75>U`o7^?~GsvcdxlA9=>69@hK~!c``J9-^!hD=aOyXLhU>XGyMJN
zy}_6XxCQ)V`MrUThuQ7v_Hr-_;v1qT1|4rD+~`4t<6~z}*}H%?+LX{xesWM<Dq0QO
zBJ1qNc+QNg-nuN(FEAp)56#Bmko!{ZAa`7HuxOMhbJ60KiYGb8rQ8_JwJ+-Ec4`$#
z<aUuyfyTl*xm}v;<kOWaL7-7_ncK$ERDEc9t%uggnP~2DCgjSJC1U5&r691X>sj&)
ze@dSdyUH<ad~;yz2>(gVQ3+&g#)VfxR*T<Ohcq3lSa2UjeNnVTDr(uwiS>2&8x|AP
zJU(<xTuj2;C)Ng56Wi6nuUyEizF&)SOS^t2nTTe@&WWYY#>Jfp0Ra>6&xrlSH=ve?
z-;-noeE}v#z(*Wi49L6U6g+F_>PN~H7ih?ir6V=x?(|eHHu$?YR-Um72^nBFVysWV
zB+rmpzeU^S6!HQ;%yr5{7vIE)s*NDBvC9EBdY(n>j{-3+*yHrD#HIm8p4~>v(T)S=
zy_y;KRb0Tt2_|Q+W|zW!jpz1pZ!523!d-`s&<02>AeR_qy$p%r+6a<40H;ZYL;-S?
zK{m*cX<Qq(nU&foLyAG?4F=hy13`{a(Ag|Qa!~3bgKT*O(kw%&xINrShO<?MP?=w6
zl(*?Xa25fSx66<SP+r0yJ9KbfWTjfVA$vjRTa?<_4Qb;RD8B||mkg=n9k_$actCc`
zkShLnZkJFG$Q~Ke$X6i(^$$Sy%8*rD26;x64#++k;tNO#gY2ge+H1I_B$Ll%`)xXH
ztnD@2Qr&Jt){|sDQMcOwf^LKMY9M<^8BV*XRfj-%6CfMODH6?7XTBAXb%4MFK?=hw
z3P-60ab$ii2d7YaqSAfhC_MqjM*ee#0ZXdRR9;6})<f{QmLG@!SG8)B04-4(U4N*y
z>rn5Zu}P*e4Ky+s4c0pt4Q%@`8qmEg$6&oQw(xLzfl-Wn{b)awW&MfL;C^K^w(xgl
zIqs`==%ulhzs)eFb={Zi(pQeH!byn>Fue70*(#u~LyjC^lrt`@&$7DMGC8)=ly<T{
zXpopz+dcZ&ChMaL`UqketWUGLv@;spgcTAE)b<^{G<FDBaL8O}wzEgMw8&iG&Z%AW
z)}=+LV>GB7K6>S7k>!X$+lDX<HjbF2FkWc679Q4s$?>~Ne{FZla-e@0Jf}xeNKP?8
zYaNU3Rw{n%x~aO4s3&^!?Ia|n3c)Nuy$J1_W+d-m0a)_eb^NsWtLN-^pz+idA)zbs
z3zh|kESnnZ?;9Tz6d(+ify;w>fSm)_@`4XYS(hB2yf!6eEk4$zte6oJA6#A@93L{H
z)Aq5CFpjV)QPWx&zOPe@B*j$ftpAmyfAyUCFn^+n|E{LIt)A*Xobtb@{))d)j3HG_
zzkPiaGf%NZfiC}7mH(^ff2o|m=tlns%G0aS-%J0$X!I|1jbUli^^59F3_1tnKnyWz
zg8s#Znm2#1vj)#oyV}*wcth%-!Y&nk&P&63iqO>Az@Fb%&)4(ZL&#;%!@K^ao}v61
z<sES#mX@E)=#Ld@I_IK1eIBOgxwriMxbQ2{s4S4d1g078-IKzvd=Y+2TX=RflotEc
zep{<A?B90$eIPrCUl9io-huBwvw}Y}`_qcwt8k?lu9v32$zY{9-=^Yl-88%m1y6q~
zqwt%)rm|xlt=pfn)tPs7zYA9<g@;d?6c*OGTK+=j%U_h{?7<}Yr_LutD^YUXEh?H3
zoEQAQp|s`4DDR_=zp&q*D#JJt7lz_CRQ7wC(7_#J_;6%^-}iStGUZpRkh<RpQw^Rw
z2}e0EI2kG<xH-M}VH#mowG!f0f3T`z4+CRHZ&k4(<N2>#LPK5fPtzcOIWy|55~US`
zQMml?WvX|u+9T$ZhYA<4h989A`C=>)5x%A}f)@mDX0~WXYP!~GJ(Sr=FD;=EaV?%{
zn;IRA2BIHtdjD;yJ@HK2ns`Rz)Jeu$?>EU0>89+je0+DGz++qd<6e34LbYiBkM}8A
z)+xlVKuD`wN{DXliki=rSFyE=92IgaSW=Bh;eRX?gS~I3;mX_^`-lJ!v!O${20kIt
zG1$jr$dIARg?x(Ac8Ki|*AdwZhT0Bw7?)p(de@6Nq`E5#H<6-A9)>GO=RM7*8nJ6O
zb`%iGhaGR~y5laH*qCYukLI}KR|4aw)J7yDQ0|OEVPKBai1dmHTYAd~LYfE*YeIkm
zR<iW^9eq=s6i<Mu4oRtYnY?sHGjpIYh+8PWHFIBD>b~-dy(y`C%2QKGN_u)~n(|7=
z7GVxD%_Cbsc?;)(EYo+F7MAT!Pv1j7(wZx>3Ny;fGYYfm$?4@?cMN_<bfkj{%E8PP
z#ltV6aQyfNQP*1dS{}&^07n&+j_|5g1l}8dyW@9~x}9^t07em`heYbA$k(SlLi3-J
zAPQH0Lw@2afwKnDm@9>NyfL*$%%C}4Vrpal=qt>@IAhM@a0xcA5Yg!1AQ&XQHhtC`
zo0GCyUMX7p{i@C`&!&XjSH)Y=8-2Ku?oH>*-2F56d{8z2gWZ`;zwPDBhKVmt^7H0r
zk&wyABw*v=iw<xRzErEyioQIzMW7$ONfXiC(se_Kwy@?cE%|g!71vaC)osOc_u)<{
zDPsk$LmZou;xybbuQ<=~D%XUkSKQ{#aI`TrF>Es&U|=&MIwi&7ibUS<?0-pKJ@mnk
zf0uk$``{|2wZZ_phV%rd$_SsUnawp<iSC2u-rbBK4z8L0@@Nx1FaR%hwWGS$?4((L
zsgNP(i0<WyLmyH>&3BxQSbkL5zx_W)g)*tQ=7#1wGNP@G<g)-xP(iK!4iy9YKdv8D
zFV#Z@Cy}B0YqD+}J^gu48eEJ$8yW|NP+UhxPa?!tU1drhP8HH23LMq{aM}`AX`5Ve
zNJ)tvVPh}=YBw>oahx&N?MjuV3K1e8Zusk;6IU1O5`XZcdg$LK4z)iitKE^_OMqjk
zgRH8^rMsI4%@y6NxMo!q`Jjz_P^Fm-)2o2euj#1EkpLfqT8)2}LSz+Zt+`RfZEhc<
zG->PDDU`LTDmfd@8ijGSg{*T*1QqJhc`qXB{3^~y^BoxfG0?#N=!2!|rAHqnLJ;^%
zlo>e4i{9>uH)@#ISZt9cBHN&F+%#rx+RpD5KaV`w7U(oOG<XE}`2x+j5gsm9#_E1X
zs&oAAHlu-t#+H-Ztu^BoaGzTThTA#0)GS>*S^ONm{U0DtZ|DShdxZTV)&)sm)QEPG
zzR|{2`n0Kx`l)qD1cli-1-6}x6hG&8pCe9_7cZ@Gak2{!wAMH+;6Af<pJZulIM9f$
zivNKQ>m%e*@;GiKbrgh`IzpSce*lU0JxrB8oh8JHiEkGcq(g#=&+qOmVe(tKc#Pma
zTcB|o5ga;NlAkz%0h|P=hcTc5gpl14l4D#+->6k+m&ET)fr?L@I!mbPB>8*mPL?0G
zhV@CeKDI`u!y_Myb|BEU(Qkj0^}RZ(rb@RTw>Li4cIXZf6zUl~eN9&X$rw5RTPY3R
z{1Ykv2>f43DNsWu4+r^HCL9YVo`$?7HD_v=Gs~Va@vwqfMA@*Z*ByO0?5HZRXMoVB
zu#vrt9OD2z&;j>24n{|`qwaSHT@FScAHDzCQNzYR=fLJ3<qa%((4Wl+QPTi4q$Xwo
znKXvWgjcICK6Y~9^SLJ4^6tx5xJlOWjxd;MT$+{W<b!L=Zoth4eM1aIj1jP40eJNN
z5Biy>@`eWH5|h`wGRJN!DotJ-9`v5|26x=iX*A5(=+8=;euJkw`fk)op}~EOHlo}R
z3kaS(<#|zQt+DQ9p?h_|Hf;3q2AvNWby}aRGH=QBqf)donup38YI-sj)?G^&nLD+b
zLi6`%utx|wdF$=zsGRP!tur<r(rS0J9xIPFNvkN;OX>1xlZ2*H!jGG&Qqb_MUhV_}
zLGThm3eu9#)G*_#e}MDfW^GPQ-JBI0yYAZ+E52RVX{)37-f{ygYjaxLvg>PBUtiX1
z9KQ-t@?=qZSrxWTKyQbWP9?eNPPocXv{k1ZJ8dQYv9Xdo{I|V^w2oevU0=QC`m(k(
zDov`6F00@OUR314=cwjXY6C@{^c&s-{cR}!&VUoM5WkJIzkyGG8*6_9pZ@Mge`9LT
z!*oi^_t*Z0DWJbi<lh;XohkkR?Qh`I-vhP3flq&%(%)1*xx9t;HwHeXXDR>Aknydw
zzww-wAHshBLvcdsqeP5=+6-RDlc4wy#YI3I0T~R)ML^mC$zTxkZpaBhXsJQ86#C9L
zil<alg=b-K6lU-bEXg<3WHE11*Ex^dS1YdL2i0`WM?R>Hil>xog(Dbsc-KMGh$CMZ
zav;?4%j@bo8|wIFPu1}ab)C!EACN8SYE_@YD1{epW=l%c(Vf{i1@tj}0{8nA!bR`|
zVYDUu5v+}!A5yoqs4HBx9s9v}0>4tV{o#iyx3hdJe+19o#It`(&n!*Jo2p5;oT8JS
z+UsFNYhY{0GhUh{+%j$j<)~cO@tP1q5xe;U5uEKI7G?hMOQoP$OhsrDXsA_>6u^TV
zys0e8(T=lBnulL2ISoAq(IXQuElmx1h}B*#gmk>dgwtR@om&o#1%mT$Om>#Qit^SC
z^~SzJApaHrRi}e@LV`E)Q`$Y>@3N}tVbyC1p5BRxfRNLK-V&ibsE-E6ZJ51t<>8Pw
zukT#FrM_d@kiCbNqkd|A&-Cl1-uKkLUT%+`&PQ{?3vXsdoZiJ|ifth|exm0A`Wby>
zkJJcw-2SQ1*ilcB+5{TvtHtX_V_j`W!6Z|Qg6z(A_VjLCdiui_ZzmD;O^)BXB`7Lu
zZ+G&1yYrAC&Yi09Lxuo!ySB1ZajR{}_#QACOG}tud2R!%5AVzDPstl7ecI0-)W<`x
zYVNH6zhl%->D7K=uRcaxY_k~t7)EqhSsAEQXHhqWA#b4SbnhI)U*m3dy6_+K^tfEl
zb2%HJ;Q-|gF;h%N>ZD8fM7SvukS2?X<P`t01XuQ>Q1W!AGsPlLis{lPerJ;7<Y_jH
zv|Q1UhU#v<H#F9o!Q34!|4wJ_mc~jm6pP8ea?rbY>D_FQTIuPimj2osa`cD%!40BP
zk*CGvj*brAjtOyG%)EcUgCEHx#1A|XztDL?d?bkh@91=)(u&C_(1Dafv?3H-PwOT@
zk+k4+SE~9eRRi`&Mq;~8o8-_F`4<qu#db*Kj2ZH)0BO#Z=Q(<GnC1>*ml@Lq7=6!7
zW5(gQ(8~aY@a*kbS=+O7wq<2)%W+MaG%3ZE{Waf6d`gIK@%QAc_>Oq4g!pud8#P76
z#HU!ZmYmHJ&*LjONQ>^s%G!|wGTSC4PjXA1G%48)U$~9rRWbB6hF`RCqoxVu#Pi}?
zAQ%26sNw&O8wq_Zp2tp6PbIZ#*H-nBD*jhhYW?r4!H@bcB<GMP=a#w!+rl&@2JE$i
z!(<#9!CIdEwXnebfQUq*XNBQ?vcD>og{5Gn8Js=EH#7J4Puayq+5h?}C)d|EOJl(;
z@Ub7~@3pzv_w&!aw{G{Ff@5D++@0*ZKWF54`(_jrWcqn$W!?QHOCxf%K6`e1y4sDN
z^6|%BV@COS?cC`FBi$p8USaez*2@ADxJ(R_KHist_*q<U*@~G2J9~tf5nD6Nt!9F=
z=BuwX*SI4eU*TFcUtJ>&VinhjgtLvBda+VdkHOee4s%CONuuQKZF$~S$@it9`HC2n
z5fky18Pmm=iAi~1nq2T}#Ood6E1r8tyg&uR6t_whj)QA-Q2~=}dX_KYr;EXzr?~I<
zlFr>48}2(QNH-q#fn-caif&7~3(O<}H<AdNyFDe>Xso##+#ndMv*Oz_BbrSFZVf?E
zFvJI@3YyoE{pM<r!AKT>Pt-(lBQ@VkL^XGaK%B{GDwG(n*+yO$gIAv>FOxIeAk8nR
zz=N)D)cugjX$k`1G8EGl^A$DdSJDZ5H=Hn}TcX+lk8NG;S2+L3*h7!gQ8U1>FvRf{
zi+Lm|kj;S^Znl+U?GeXpi*Se@YhgwsJgB#hja3V(L(V;8b6VQwjN`|pPbAbN!_zls
zW^PW$-?ldC6Mw}YkZ5ya?1bYJq9@@0<IXV?**D&{%{gYmgcxW1mA|!3h|zpXhKoOp
zBI%nm7{#<LnHihX(>G<bwMm~^iWxLBD1~lLZz1DjC!nnJgxK-?t~TfB@#CYNonyz3
zk9C&5cf3h4C?8-T40Sj<#YNsqxj^|HbuF<QgWVqDTgjz!>6PMe-U{C|Pgar}=oA;p
z5#Z4k9r`tkqhZ(|39TI;XbUJ^4<78S>@FlNGZ%2D7;(DjBTAuC^CTtt19uAFC>xr;
ztpv-_2MDlM;?N^jaY|}~E$!KR2x=()#;IuDS>sj2m2hQ6o!|fE`DiQdVu5BSS5{#B
zx6et_F;T^;Zwy7j-#|BJd#b{#+)J9s4v`Du_K~kOZ)v6}ue7zbf7+%TFApVJj3vjz
zI+ztfQS-Cp8-$|-h@&;r$Xnb?z@}wrgwHK_U1u356||v%DsZ;c*3v^tw+t5&cSORi
zbVCX!mVzJGDw3hq+`>vtA}9Q~hxGq&{`?Qc|LoZ<-n(4YmVE%3rmpPI&N^^KIj&l>
zyb}9iLR(wahvGeoajB~65;56ba|MUu_g?|#fgDK9L{N{$R5}U*{26B+uJ@Hc;Ta>w
zkmpgiKj9~CB4-FqR@jTHZIAD4K1xbhC0{r|ooG|aRlN6MRn>>YWKZoC<lUn6{NzA(
z8|r@Veeyi3)*fQ=AyvVZI;w)~1E18gD)X=KGsGC!si)z#ASM{!Xf^^<wlJ5RSvn9r
zO{q)JtQn5j|Jm)I39CEmG;b<T&D9vpnZrGpOAq!lM_2Qz`1(BVk9nOt>0fI8K$fOh
z5a2KMqh#SCWA8~?juC1J&njngKWc_{zBZftW6m6n;cV_f$1-6x7pQr&1NYg`90A0G
zQp07`^iP+93+6&W5N}e{G`SC5;nBUPZtt57F0eSG`r+Z*%AM_H!XS-mF84rVFqdn`
z<-ttSPKnw)CMOMz`&LziH%oX^$TodV4Y@VS&)dgvzi_{Ni@Qm_;S70&200I~4*o(t
z6m0Q&lqHCwsWz#zL{D>5Cy84^+qqFW;@}a@OI+v|xb*FLO?zuA-_kjQyLa>`So9{L
zOF*Y^uYxFa34Dil^HtcJ5_*#>QoEZgOUd&OPqpq>j`)Hv7h{qrr`A@+N1+~y`beT;
zcZ<qNy&)YoTnp`TxYhS?r%Kq@F^zFjsE79yqsfg?hL-K&#I?|V)A2kl!lN)P2E%o;
zM?fXPG%cw_a28|v8Jc$PSZ6f<f)%tQyx0*X3}Hf^Mec}VVPCh9R6eRl{wUR>#{38p
z8b%T~s>aTpd|BsCQgnna>-&_0luDGMk_vU?`SvChdi@9@jHyPB91-`^qG&#JNWo5J
z($joqhMZiEay<(^XEYqQRh)iUoX%|(vdHsdjAqczo#J-k`;L*^DP$1`m98s-9cGH|
zPJr6d;*>q>1arg~)VPO^Gw7OvNGT)o4Tunhm8Q~IWl$iU{Tz*E!u6mE1x+TeP|%y#
zAgOZmEiqSY6}vWUAT;Cjkz2ROVUkD4h7Dqucv#HSRMH1|<S-r_0fO|PRm{D0OUwg8
z7rmXThY?<xB6FNxR*tTtM@v^2jHWs21&-Z@ApErmw~+dnxP8B9(f8tq;^q&Ky+!=+
z#-c?x&}MW0TD%jBzNd&ET%ts1F-qjp2b9S7iy(WTrq$?@firw3Ybrb4%9Iz*sz+DO
zKJ82E4R+QqU0VM~lEHZ^Yip}Ne1?o1scG#r*ukLX3zt1*ZDnwQJ@T@$hRZ4|2QKSO
z_Ci)>h~E|LxAwUMeGXH@ao6?2gLt?NI`p*oQQQi>@KhR2q6dE}4=bq$&Z0x~z&CIR
zE7Jo%^ceWN!Xkb6#E2iS7e0Xdk6!o?K0z;hG`Xi2KAu~z7aqhd)eFa|OTF+0{rV(J
zv0b1?4`c%;>V@y&+V#SZb5dkTpLWOfkC*h~e?Sn9`l$ZN74B2L@N3*Pz3^XoV|{R?
z9}g$<QTj@M{uRCO0Nze7Jcvdo>7f(MUDgW^;Z5|y!+7l0>Y)>^zdtA=cniJwk&mGh
z#Y=$^ee|!4=0DI&Cx&~V7aq$YFj9}4alEfyc>H7FTZJ;c_$_jvM_)OgdQ5vg$G^l<
z>G#FIgMLDj>Gp-+MV4WG@L!QS_b{d)86PvD8qTRFHo4`w=f5`a{;iq;%0NxwUraTB
zX6K`nf$eW{sXKSJfA&}N(VrT8J$m>Lt1qup-(hrJ#P+2A%c)FIt>pKv)co?lsA$t{
zA#V1AUH{jW{0)<VzQ(@K-O>kF59M(1^HF7~hdl;9oI_}#9()7xC3`v3r}L@%lf!!9
zuAHI5OAj44j#mT#uAMv`=;X;J%PWj;Uw9C%38C`zg-3Dqdf};v_t%F%l{e4}U(4gw
zq8|DixD9&YEnK5s_@T$(zbnkwhmT1#UoU(BcUmue2=A;HKAQZb7d{^EXY|yI1aa8&
zd9=QyhU?S|Z_ux2vXuKnFa8GZzFznq?%#Uh$GIlG@C)2Kdf^`sY0~Y}A25kZM!zro
z8ZMyGSKnWGc+HRM0h6fY9Q2`sNmOsUC<FMRdg%noPD5Wh!Q5wh@k3-MrZ0Y&JlXe!
zhx6fj=|u3@e$-R1$j8u$;#GR_qxo}s;W6C*=!M6^{^;Wy$Ghr<$MZ1FdgR<HOw|i-
zq4$93!GG#8?e!eameHuozIwaE-DGyMFZ}Lf;J;#XmrkNGKAS|@1;ss+=%21Mlpbu(
zd^lMDf}?vn>`?y6%A>Ea|KYxcP<Z_+FL`*R#TuoZ>Hbt4UPC9ghllh_Bh6Xw{}+<{
z#(kq#o%gAPkE$Qjk&C`&#B`(|KAh8Qp4A5AV>a#d(F~@e-Fo4!80~aA>WlA2+Szne
zuUV|Dr9rd`n0<v>{gB*ca`wPmdcn^Cp9beT(BNE#f1Ke1PVY$te25HB(ZZD}3_f0l
zOVb*~N5~KGm&$PPhn!V_Kh1)Awem>Q-G0C$DL(gwj6Z?l*Ju`#1_u8QaFzPux0DL7
zxnT^7K}(?{WvDP5x5YY8lfz^W)6(ER6J`URszakfvzWiiuuElZY1KIxw5ye6z{c?=
zO1n_YF@r(ZO3)Cj#T7dt-GQ!o^t7d!{?nEpImX18I@&r1MNAHeS*Tf@GNxpfpyaK+
zf;}dOWG5~^NNXd0MBYZ^huT2VC3aZJ5OzI|1kqlPgUx`Iz&(X~Qmho%!;tP`WqG35
z5l=S+Khs<*yiUwMnIAACASK){KGMy8oSA*J*Eab|An~ISMVkt;ier3zqWwn+N+D@_
zh&BIj-HU?wD}0Soqi|4nF%5N*=a@bZ;+CZv<qd@cJP+vEKtbWq#zFoHIR|_z{6IV>
z4aL@`v64@qPA03zdqvxujk9-)jQ0yq37DbO<c<iPo&@%z{G+D$#!SyF+*rhDy$D)2
zSc*paI_A-Htg3(XA;rI#YaJq!iuUo1Db6a`)Q8mL6h>C}Q4;^69_2v&+NxWzOu+07
z)1&H_-aI`D=Y9Hc5pDYb^s>#>BMSP+LG*-kigphAN0tlPYXISE(2pD?h}1IdiMyDJ
z5c_qo0x%Z}N26`Tk5u9LO>*&JI7;??-b{w|evY>=N$PO9yxQP~VmhG_TkaHYFrypZ
zt|;$;>)?Zr1gCP)am(cB;eQ4jeHR#h5bIGlaWIwAKO?3J^sujkLJQx@<fTUg${2o>
zgwI(@_>d=-!Rbh+^yh2oC}SBNEqoE9L+M8`y<l>NUYZrx<a)1`o<puEMvp$H^&X|=
z(+hr+tk&`oaA6nZmGA-YrsK`%Q0qbETEg&YJ!%=8Swn-HoT-++(x1T($$a<dh2P{9
zTE0qu##h1zobv7Z7W<qLjLy3f9q|Q<FToAIfSeNiH}Mrl=UI&0Y90KW3iJcC!?R*4
zsb=&ge89E()156)uM1kZ?rcHZfypC6-=ozL@+{&g!Eto+ZkLl(4;b7=%AdfxQ9W^o
zB)FKWYNY&o;1VCScM8L2vk&n5Y4LSuB?@Qw_2_>`XnV6GC1`IlLuzl%N_tL@oG^M)
zf4iZ0j?rUBQD{Gxj-nW}D_-h>>)_u+mLjSz#;51#3i!+PDSuTf=wN1I_0!>Nu)dqV
zNCryvK>vH1(Z}M3^_y+o@LLSNREBSr;LxwmtPA}<CFzO6ncgWr)jQx+?}}DduBz)t
z;c3QS>WB9f_j=%rkK8}WP6-ZrI<q+F?Ph$cD7+h=@&TO5EtM<Mj&rg{mU};=SA=qG
zocF*bx$#0JkkNw|0y;Mo68;$qr~Q{m@ZS`N86AvgWgzP(-S|Cpbnt)I;`gERpckCB
zw?wC13-3e!CdX^_tNfj{>l0GFv~Wg$PB$G5B0y;Wa0eY`2gwCl53(IbB_;h~(MRh`
zr1plL?FGNdJ=D@sKh5eZ;RDX(!Pbb<m+1|g4@_@)48Je@CV5+;1AHHbkDXbDpRE^u
zlf0qji?~%f9wmIh8DIEv!bV1i9jZtBH!*yS2Vo<_*TNem{BHZlyikl2$^PZyAmTVm
zM{!${r>m6FVQ^-*B=~P#6+Lhr{F{nP5?oB>$5FmA9l#miY{0+6aZd-*0s5E^6>_@~
z553Qu6|0#XH?_~Ze&oMn^`Yfe1~)#TK4Lb7s_x5FRR-;!cSE~zVbh4T5yfPn{wI@x
z!X@7OyKV^$swQ~C!7|U|c-cn1#8g~;hPrga_b^$@fbY!U(K7xl=A}`1B%_li!{Zs9
zGSHDcZ7n=Uq62t1)d^Pud^#6mRz_dANv3u431@uhbJSU+wWC~mpbT5$PN~t_F={<j
z24hD0T)h%-S)+=B<TRxth6~Y*db7-RI;GQv#kw$pwk(Ht476wB!dE(icJzVY#LPwE
zR7)cm9SQ#?na-p~{~|dIj_nRee-r1Vy1Fo%aTB_sl=@!AmBH21z?EXF4So|buY!6D
z=D{8+4wMSjkb+PiUH5UE6)7y_QVvFYz*NiWM;v|4X3yS}_%l9d#C(p8BaT8Hjc0a^
z={iKqFmALiQcHcoq_|1qSY1#v<b1}dZ0<V-|B$$H)sSvGq|0JFB>2s)E+*GaF_r62
ztv|zeG+=Nx>kg1~1~G993Z9D+A8w77zp7ZM)P-yL3wRH&U1vcH)3x}z>n{pt__W6r
z)1F1&gRq|Uy2OXflAfavG5+j1dKOkaQqL-;qe+Ig_wR->-jo*YS8{KsJlJZk8{W-(
zxiTG8u$?90_wZC(c2gIpQ|kN0d})mFF*5c+sb<jlXN;@tKPse^5Hzl{vV=5}#%W6c
z|0<|ce67ZDV*72%rK0N=e^osSPfHn>e-mk|P=ZsLB=|kWdd8i>8FvYOlT4D}uwptZ
zSm<IBt6K$ycjJRQg|oV|a$PsN?s3(sufd0|aA~i9nHWK?!F}L271k0Qwdq+Aqn3(g
zjL-hAd(v3rw}KAZP0|&G(y=2$e^W}D#kdsmWhi(`V@APf=wSaYVfUf&pa;r&gv761
zFXfx0M3N3Y;u33l*a}vA8BS@dI=bc4R8#pT13QYz_o<8>!Kh#}QpM~WubmlxVzulG
zzsbc*aCoZWjE+1ra`B7~{7G3?-%Gl>Lb>*aLbJq^QJE~JOX~>!M+y6;B%>~rVn@o@
zTG=T!;9LRY*??ITcgCZp^0+2$48H;W<1Uj?3!lL7+04LZ06Wm3vm#oQX>PXO=go>Y
zdq1Z$4&}$u^5_pnRBCA+!Z?<p?E|`@-MF+abC_&Q1~zX{8Wb+^W|o)AEL&vR<|_7M
zWUgfM32YX{SH!dVWPjHK*+$YGBDI0mM#84*>>N@209v;$Y9og+8%gmUC3ugG>^g_B
zk-^4{w1T7a5FIl+`oLki8JzOz*)O7eq*-)74zIKMi9Z8AJ!1w?HVPzY-!Vg>bj+|-
z9mY&=Z0(ro4b_erK-rj)DEA#R5@oHWrZbK-W-tRX?MoJ%ab#mgq9TnMeDAdimRHA*
zTXiDE*&XF#I+qJca(%Y2`3GL9nyoqo?3L1b;;vvimoG*=Ybd@F<Al|J1cQUGyz29k
z;l~)9t<oqy?Mn<_TD{E$-+ab5N`}v3`0kMZDuY7;hVQ`O=u^Uv433<z3@+_<fUhc7
z9j<T?F!~X?{;nW<r^Jwzdz{x=42y%S1kra_p&Z)0LmvAoHunoZ%Uoa?Q0shLzm1?i
zXz8wmy_Z6%OswAszerGNv}k8e!*?Von>mXCb)poMgCr=kHIxEjP?ZGzO{S}aeZvjc
z#(+9<r}^LTN&DJn#-RwMG)xy`WOy>IE5^eEZakAxTFGHNF#JF1->N@giJ(Jh;G5In
z-L(KT>M2x^XnZTiQ5s$E13pPTvK#(=7uuQXfcASGD&JBnk3bo1d5nMt<ES?HUV$WP
zz&?%pD)z#Tz#_mpF2GJBJUp^jLE|2AG}X=g^zB=>C{+9(21NvjSx*W)99p$IJ>1#F
zY{Tu@1>*k{Cir*{x+OlGw~SJzbOdmul%YXNpWb87C^7iu-f$?w3w$MfM}rUP3_{BZ
z@IkRZb`bQ|p=H?dJu_T(%R{<X`d#XO`8N5M|4(Os(H4@jYp9Sp|3_p4u}29S+)iVp
z<&bsV1pnBPHK#Pl5|84r;OwB;p;Kl>s$N&tyuD!g8|CGNfeCh>-X?Duuic(8cFe+z
z@abNY%2FCm<xM|bS$A@ZV^mp|u^4dc7OfH&OZFluF{>mO3nAo6B1R2ej@V)U8CSB{
zd15!3#@~Cmk-ftUX5Zdm=Hfj3_HFThmdzvTTZ6oP68L{HdQjEvZdHJ)Jei(Wd<m64
z;Gi6+<V#7Z!azuX&P>*zgv#K<JFF9+xuoBhrQh_qFp?@4?;}95>key-{S=SEfu{=x
zr!@jn5K&Bt6FM8^becRz_M)RR8L-g}S{M?yk*#5@(nOemL^)FQEmZG@vjuME_Q*~{
z#-1aK&WYYM8;;32{Pzw`GNY#qRHJ17csF6fxpSH~&z&Ru;*z&mDcod=Q>-!@4x<K2
z;1yexCfq}uZ<eB7Xzw(q{g&68m1fJi@6J8(xWqI}GUC@eJq-?yf+N30+w*9(D1B7v
zyK_=yFg$iBP3Uq4LNEb#uqV)#42Q6o2&wjzRtAl*H%xoT6@X7JUiuXF;uG3b-B!}g
zYhbFp^k4#mVp0q-Q{~kaDA5u#C0h7o7-FWRDkivgTGdL)q>;3b>!P*s(yYa3)w-*v
zt>C$HutHd|@dyWp)&3ZIr!%-@pV9TG$AQ&X;|mg8@;G*2^_AU4tAwgEe@V71PzJh8
z-<G7m;fHNuCD_c4VdN})L2j!@v9_gYju2MuX72pXL-FTb=kRE(_yt*g?i>({g*)7j
zICe}!%JH(r6YX!uBfl})$$az1=kA>N`Rj8k#WT+siuZ}JVG6B~qF7bH{fJFIwZT1<
zse(R6qoJGBG~k(?Na${A+Ji@<xy2R8vLv-R2_l2VI}m!bYB}G8Ef_3{Wh&O7au8Ig
zECY3<G1IE{BS|6^D5|GvWzw9W;{pV&LGU0W`1@nTqA8tZTAUG5JBf{;q)MOyiEqeM
zdc=C5OGS0RyK)$uRGYN1`PrJ!Z77ZVOP7j6dQq5xinUV;P}s|=eY~x~96%8EP8Ftj
zSvi)sRdwjnbks_QTv5Y7Q~Bb?jY}y>Abp}#@!n`9`B0?(#8KT<dt3r3O&2Ar>OD+J
zoFulE2RfO^MqIsSx9$sH!vS=A36<%AV^>0<?uMTMzRn9@z|pIL54i3YKH!B~xbD_E
z;82&0e~S(mvQ(xoIRsUpqq9{Ee0g&LaGlK!z^5=e8#KE~0ULJTfsV>>z+Fmxzh<|N
z+Yaai8LGSC02(P;8am5zEsYAzZr$ZFutzfN!Jyr<yao0gEyo@Q9#HtKc*P0n=64lh
zp3`*;aAwTz;1H*Arc16)%h2r34EJyw_{rT8+K1L*!l_~t)#YoHEPnHWY^uX=*ow>K
z2oqu*|0R!|YlVa1V5Yvo<WeuVqrv5_YnXOe349U-N)URO2%-?0qru$V5mPP=4kuMw
z7e#rcFn$VL6ryG>ina)dFk-!l^q#drL_1^iUv|&ev<BUhS};j1sH8AS@a%+ZOdczC
z5Cv(ty6@Aa2fV3IVrP4XU#~&1d+T>qRo}IWo5|eiO;N2o#m&kq$HXZ!-dw)o!rY^Y
z%Oc8mf)gkjrBa<JQYk0$tMa_mVDSG-CHOFO5#t(|Pfk$_{=1cDpbzl3rAaf`K|e_0
zVauD+ljV3d?k4Qke0uQv>gw+fk#tQ0zxs3W$z7{_8cOC~Sh4)=3bOOr_J`cS9pw>=
zV<7;V;t@tffn|nJ1&7NWPh~E;x6WAFvGi~fJDuzq(10gyT;Ucp|F|+@_0-B$74NTK
z@#RY4MLum+Y*I~d%*u?qy4ib@Qk(PA)~74qRIa=^c+Q*k`8$dR^c!`mq5Orp#iy&I
zN<95$N5@qL91UNX6t^JAvovDC>0*dVci#UEov4HXztN6L*IEq_5?;HKrbolc3|mjC
z0N2TbaI=bo9gb1KIplHFf*!OGxO=O9cyg++spFpa{0ocMUae{PY-Rk)@;J+LgJ-sW
zxZq7P=J-MJ`rxz!->yI0X59Gh%+*Bw`Wr;O#wlrjRK;`4!_SIO-2GX6;w*R<iIGYb
zWU<3JA~%*GPx41`Gpz?215=cR1(?#?#zs37y{(@6Y}w-Hr!Bg^sfyg`{D&|`bN{Gj
zQ~Lhvjfcec10lsb(`qg)*>q+89`c~yiS?TAP1Fa)d(W)?;aKjnA5e3~jlR<}w4uGk
zXe%+th(i)^NMR*OVXva+<mlV_K}g;XA<U@|+5?{SM5ibGltW_2p~ma`(>H65XzmM6
zo!80F^EQ3Gc-jjK%b%U24%zX~rMbs`Sp5tcZ~*zoMy@~6Pc+yw|H`H%muk{>7NY|$
z7h{EHsC+0*>SE?Gd9>8!=`m8Bo00^AJNoD$Q$ejo`St`cJd?M5T~1^4HL~)j?OSdv
zU-LkGhEz>UUl_EZOKkh_BpL8(Q5Z?u>sHy=R=RT2l(Nu8&lgX7W9{nOZ)_yWn&ESv
zs()7VO!e54cKPeyTeom49X(xlR6H9c@3PTjgts8n0s(G-Q;7;Wl7|=xjS?I^2oXM7
zxX~6|VQ@jhH~fLY$4hinYJBo|$C<ARMRm=Q9N!gP&Xl&N1I{9PP`96UG*44ATxKbs
zoi(?k+Mi5M+u8%F_OKWJIbqkkbGF`UP5mP8)eSi<&X+Hb+nurDwSq4)+J0#%e`7mY
z_wld9h9{bHp@r^+FB0xhz0lBhXR*g5j_3MmJ|_Qhom~6V$@%k-5dQh8lZ#e9Xi~Li
zouP?I>9X|#n~g9FDb&W5$gDmHZA8Z`J)y<Z3opzZks!3&M%f~GoaUjRD<|7e_H|y)
zCfj#^zp(!MJ(}-cCq-MHh-)eoXYwy(kasm_D&AYO;qqJ@q`P`>O<H{j?QXCNhoBD3
zDa<N>ntXksbkmxLbbA3!d&I44xwql-r<=E&Oo{71&SYqa?b?^O{Wf^^^`rcQPJ_0+
zd)v4tisCupn1RttCo~yHzD901<i^~kEWm=1NA?U`$?JC1%C1&pSV<NZvYXoB-a}$O
z`>U_Won!y3No*<i5kp8=abt+zs+r<1UkS#V?{9K;%Gnn$7Ega?W66;!Ys(X1HPMMR
z!R`MLckyCpKO?YdL;u+aRUyuvc4!(FXlLdL@o6hdw=>d4o^0=F(Ff+wDL=aWjw(0x
z`EBKgvM+n4Pn@^VMKe2>q`$PS;$X(dxO%K${uHw>gpPJ+@_=jkWo`QVPYXjj{x!eB
zrL;AJ0x~Y1lmU^m>(FkM*qBEyNQi~H(<@Th_!@+xz>=|5n^N_{l+i<D0*Ss>_6`|-
zHrpkCea`%Kkprh3u6~vnZrv(A6b~q`JZMr^J*<1m=J?OVWTjX2lXE;0wiJ=I6TQ}o
zKYix@j`#%33!PBJ0$~q$nzA$N^mbZUO%+Bh>%=(dW@jqwxsuQ_bLJ~i;qO(i`}g+F
z6PLvT<-R#h!TugkxQ5R9@-X>~-Zc-glhHk1W5h<%U0*`S0Xuchw24K#C7r_Qa+!5O
zN2*zLMMn?GSlDUNJdy8`4liz@)xP%T=JtJ7d)v2e>3H61*UK;Ovf6d_>`RV0JF@d~
z=RIHE^03*l`C-e<=jY^S=d|$E)6Z|){lWC<7k6!YujFu3^OjYswr*~EZe(H6)Dnv$
z%JjB|9Z!UZJ-MTyEnRuUvNW%#a3qwFiGiem+`|<%Oln9a?=5t1ElAbyggVIgljhV-
zoLDz!)?(E~Va~bb$F9$sb^Vyjv9HL*vbLOUna3)Yl~kXtX!&Eywk^N!I3rFb7r|pT
zhD;IbX@>OBt)rVEhs()?8gZ(78#h$5O`Lw08*)_m=UrqZ{bvW_{-{+#nbRnvwPHh%
z?g#?n9qb)}Q$7cu0cWLU-Ld(P8XsgC<Y~HZ)^BMwxUqh9XJ^d#aA)o51wKAazrSWv
z_tb3n*t(G9`M$Ar{Mh3ow_jVi>FWHVBkz}ZA0k6;>=|{^s%+m!OP4o1l@+oyXU?u1
zsHXyREzarUo1tO|<Bai#v(Rb`M6DYlH@EJULKfV2<iszUdMoi&a&i1J&40+qf_-^;
z`wGhTr04IQ>YtV6ACxsVoO9(5wtqyj`7b(WhV$3khvx1pn7TK=cz;I0-n_F(@k#j4
zJz_NK4$H3Whqi*9cBA>uXdko032)Xw^m15MaW-Ty70Y(n^vsOQJ7>PQKSDgy{L!ps
zH@AjwjPM;dC%kEQ!kp3}TZqHNhMYO|F8n`E-m3O32^13yD_&W;;arK;u%m-UZd+PB
zXOi&&vccAO`k~xTJ2VX2?#Bkcif#9E*oedHY@q@nl4ufY8KpbL&E1eZ)s?yd9KB~r
zGP`od1+H!8@^G_(r=J^O7P7RW>GS%!&yLU7i2HMAmNrF1Zm^2XANiD!|D1JhM3bm_
z_O#f!@zA_Cs;gg_Rrd0tMX%4K<^r0?0aI%Qc5rEArkg90+A&Soc~~%J$To)&XRnsj
zfEk?*K65$A0QHM3er<4V%8aR<SrKR*=DK->;|Qm`xJeOVE~9*e#HGWh*f>WQ;i?pS
zYx^ZzT_ddhXI0e4WUk{=m-^<$ZFs%XV_kDl>Eb8JI4iq3&#%pz<2F8T>F9BO2e!wq
zC>=dy?30U2gSM>qocDTDTn?HpUkv9TLSSm$=#`<;TuLLJrB<}lwiX@wp#|%aVYBXB
zb=wy+%C8++{`PGCoN7tM?7E50b>f}Ml!Bur+kbB+x10aiG2^*;`D^Drl_OeYKQ$MM
z2^ZH0gTcp!&V&TB22u&qDO={lQsd)dc{`-z<K=PAt}(Zi#tgq!<4#`g7nWq(`oa7!
zckRAjHS_#h(|-NN<>sW=h59TiE?hWeR=C-ip`|MV#5IRZgQJJ7C1y_yZqsbq*m-nt
z{RgWCahzjva`IT-Zt%S4%1WQB99;d(1hum8pfq;*E(iy|5gkR_U1bwbuc5N_7&wS^
z8rq{dW#g6bMPAzyHys!iS{z)y!kEkJ{PfPpTfeSfd~<L`>9pwZ51ts4-%{?qqj})r
z9Kw;&n?>>DnAUrZY<FiIcS+^Op{~qslwr3=RJp;IQ7EN34mtrZOG}#Z6e^+JgJr2=
zP^sIPa~}n)o4>a8@S^mmLVlVj-m#n<VDCIBz-@B!$-@p&_Ex5`BNF3^<F@8EFQ{#f
z3B6rI%q;B&sMG;YlLBKRmHww*>u0b>5T+JmhN#5-mcJlRH9h9*gvRk?{sXo5u>BrH
z+d}dLtYp)KG-q(>ABP2vw6h2szIlr{90p|SzWn@sQ(;U<wq!-JglX9wisEFWBL)U%
zPAU}z`*LALfRn%9KY^N%_@o4kUG}0vSb(v+3QEB)6T+8%L4!CdXy6btqxR-Xc^T0?
z5vXYLQ|(x$2G0@B9drBXJ<wcC)>9i&`QlDZYS^0T(>KQ=m2_}Ly!q2Z7rj*3`ty=S
zH@J1lxf2E)C&T*>b8{Iw!D#64Agd`WKHoE7#qRkfvriOGJCHMd@yRTQIB%D<C6TlZ
zPlyk<5ucd4upv9frLT@R5o-IJLHxyHt+0sh?JHvx3X$Hl$RK#5=_o<y>OgUYwfAB%
zPgsQvv>wnjTN%g$O{unLLrr&<z|CP;Gq8mV65nFo!VOQ|F+VtVLs7xO24`YhEPglT
z@buX9*t)Rg2cwcU=WigDnic#4aaO_pO8=NGABlNm6X(Yy)`t3~I^3zdJ1J|5^Ta^g
z((U014N*JEOZ|?m6Yct`!{%&B&3<N6Iz~c0YElR3Mp5ach3sS2Ep$b>xaHQ$+K-ou
zbNEG?)nr~>V_QsGb58oY4E5UvP2Y*N^Ug0>_->7=ANhLyv3_FY&XhHY*>(ONrBREX
zor+e@7eo0DFjLb*g=Sb8p}Mwath>V!X&pYAq?cv8v9t3;V@p>Pn{drI<Ny9FQmr}P
zQd#IXFIM=l^g{Ep*Jrp+-&K-U=rna^QopdpFO_(fZp|$!brABGiYCiRbjQ2l33lnx
z*+*t1Z!HKaP4Y7z<mfZOEAUA4iuCZ(Xph0>UO`X;wpx|TFtJXATR_zy`P7n=?uf)t
zTC-&-568h6uCiOj4Xizyb|yEIyji_IDdp_WZ56N7%s(`J$YINw6~(Kvi=NooJm<X?
zX-8{?f{vw`xtU=;5oY5@Z&^^VH6^Sr!O6EMH{3tWa?I#0^NY47BhSS)EP38mK8<lI
zrP`n=x3KSGOYagz0wXx2I^TH@&8@-vc;|fs<xeiWp+R$&3#b41GJMB{p!6S|FKOTt
zn=hN$n9B#Fhkx7Q+FLz);Ut&(x%q1i-%-}RU3u(UdHJ=r>My_I9Os_Mo|t`d&fK)Z
zqtmzF-!gH_{q1d<FF8k4LCb^3Jb*x3S`D=6pSpH@xTgN=$1x*rt*yU3mLEK6ynXpW
z86b0WcNSPnS_`sc;@~0e5>OTLW*#YdDIQlmlJk>2X1=jx>-(i2{XgE`11_p#dmP`n
z_wHQ;!~zI5q%Tc6EWP($R6wOl6A%GG=^_GR1yK|1NED5+L`9>CEiuJ3V@!-DCTg0=
zGv%3PqVApjote9f*xq~J&*%U7=RMrLvvX(8%$zy>%&@WZ6~z^H!d_(N65{C<SCI<W
z<6Q|zQn&`?#^$U~E#5UNW`<=do3?QyOsINrU=K)y36<%TO6Cba5HtrM?g281k}Nn~
z2oh@`kc*d7i!_aBt;`q~XF8d?7oRPcp3`b9o8RE<+`wI8Zwx&5cTZ+F;jQy$FR$94
zo;iDe1^NSzM1PQ8)XO)SvT|bn0W=-LQw<w8gyVYXDI{SoE>AG=v5JZ@7Z{6y4S%n7
zfki6<7QU=<U%HF);@TwPD@HDS4*hh%c_NpAG#e4IO5q{yOloQn83hcCQ-Hu{I9ehV
zfBkCTFAe!Q!Fiq+N?vb!<??ZS<a}vm4PJtmz4QD0@CzI5ns#Jo<Ty_ADchFz%9a&B
zz4UIe{pmGWi7&eCaBMtSm)ALrZCX>d36rZ@Aj}4g+6HQZG0+fl9@I#{D6%Plju0^z
z4sS{sWb1`r{_aCvI(Tj_Gmgu8(9dNF-7V<OgMReKVqp!8$P<{&2sq@JrQFZM$`B!t
z(cl2Mhk`7e6->FIwVVYm1D7tySO}E9D>$S5MkWzy-eVod#MmY@<(i{XlZbS$v5uo7
zr^dl!pN)q}$YgixUpepIGn*giaK(N}(IZE4TeL=cR?SjICB*9Ka+_s(@PPJ}zLlTz
zL9s9wKpMnh+<rhAmh2KZ=-Wd2P<0s26ow@1!J|i!)S)FYb4_ycnyfBVDYO$d(Dp`2
z>-W#qydDMy1J_p_+~T|Pa+W`&{Cd@ATi1SG7v&FKMu4JA*42tg@o?rSxlvLr3=;bZ
zL0Y3R@*$%Nh=XLVWn-)uN5`-!7j4VhleT_VR`U6-xTU4?i<4uVOBXqZHZ%CbHKf&J
zY=DY!kxP`#bANZ+^dV-WJjxX-7_@HO_yxyHY-;w*WIwns;qEpgv<zS=2MfSNfMp`d
ztw)Ax>6}PG;PWs5@tNkocv{las3=3QFb7%EO)V@E`H>BO^P6nz*@-C)T_<0jzd6f3
zX+JW2>n&ukKgm98)BJ;{)*w`ynl#%w`)jUjpy89HGhQg!aOC8xzhXRl<FT1_-ySU)
z7$`aVZQaac8)qZt*H=%z+*|U(jHRD65TTjuXn+s6q`t<^_*CT-_F&dIK6qaE+(j<#
zb#rSLX`PdnzTVz{wY2=R&CPFBqgmdwJSz9i^vpX_)l=DYwyam^^@JT>NNyVJ#noIp
zAi-D=gFrge*KB4r?Qmqk+(o1v*n(o`dW=3ST5tU~o40&jSNHXn>Q~#sFIvUSkB%;n
zu?k+A7d=15>dXbk)OeSwyIZx3e55@8(R$-)Yv=j-m93p_Jb$n>U|#owf621`>4#+~
zRQ=4f@I((cP@7?-9wHvX2B-T09k}#9J~Y8@{IvOjBivE=+A0Ij1JacH68<d52UW&Q
zT5`2j8{W4D<f`KhU{HpDU_|r*iVJwH=Jlee39_aIE6ToVwkjisbps*ONaV~N!Sl=|
zw}8nJ3faVkVFioan92{(n|n=z%|;k_PDq{e!3S^dof2%SW#BPkMlR>GaU+sGxHCOy
zgf`kG8<)6t4*r<iefTw*Y(UE9Wk)`kd+1g8&hhz~02v8FER)`Z)2#G~BA|gzz4JW?
z#74x)0iwB~D5;G(xi>0djMX?x<8X^*FQQGt={=j)n0bvFHAQz?0+*%yCM}ucHjU8f
zYhmMhdTydQjZ3B628MBQ$K=eVEY+{9!1(|c5u1T{mnxVFJk^2(L2{s@1na3G5AJLA
zKplgT%zlha%xk?H_RUN?y(w}-Q~Y_<oV}=YetAl^A^sR$(PO3``q9XeVbk~4&V8xC
zCaEE1bmHuVv$Cpv8J|Okpl44IZ!9U%91jD1hB4B@?2T2wzL|%D+m2;tA8W(%L1Z<j
zrDYC2!&JqgK0JSRUs1u%To`B6+|;yr&@5nybiK4#;z-Q0AUFMA#3qn)W$524_6|nI
zqbv0t2{T^X+EsRPQB_~j_?_eC&Y#nfnX_lZhJrK8l=keQ@A_J~hzCDT&q|N*iqN;U
z*ir@3Q&@enjd#K9h@hBp*5<1h7W5>tZ*ANN3p))gGp_>jk!#t4VWveP67ZL@NZ?wJ
zS-?c2z%vbCZeRi1a(`{ly)DL@!4P(D(0J2puWd5!J$1S}qc<~qcEypB=l|}Jul?t_
zlB4Cba%T5tuoZc4t=sfLe*XI#H@r1xOZQs%Z(aAA-FD>#rPUUjxV)oFo;#9|aOAnx
zqq*EBi|W$+a(g&~5VjwGh3<cIpa4D+h_Xkb*Z{gSuvRh-FbYy!l!0f12vYQ1G8&6R
z3AUjgO9nY)7x$o*dHzc2Tg$UIlmzRJE<U!j^NqQekY{cF;uYg2x3$h$=q|WkJR_LQ
zJ=eMPXtAD7Q0a!8&bLY~dMwOe(l*Ip#p3*0PsZI~r)q8Vs`py`_x;(rT6NZ7{*jWs
zP1hRt79YOO;rot^slh(g>efH^`M18eDtfKzxIy{h;=PU68eb|oLWYKO_$xp_rC{Q<
zfzvZVZ9-!dZg5(+hR7K`19Wmp5s-vu&j70!vrk`{{hy$h_Wj4<gC%w9#~1HkV$VK%
z4D+8oe%J`BKo<KDhDY4*68#~$2r!ODbkXf>XasD1RoU65Q`Zs?uk&(TkeO9pR8e#B
zB6DiR*@CMVDqhZCvb>_Ix2yg>_6O;b2s%?h$K<(NAYF1)MaiWig8I-vD?%TL3gu=&
zh$}E>X|D1|R$DMCXMQftP--U(4h#&i_DZJ>?7IU4sG1sxwFvQH7fKJqT4)39GX#)L
zfkp$vLHceo2<`yG0SjNrH<<-1XP;V%*cDmYt5f{4WwTylre|(@X?9K*n!a3X@ae_u
zujtL?IFO0KejVf=^rmo(KA>~U?tg~Pwqt)L3I}zPf6!UsIDJ6p+F@=1T;>c|D+rmE
zm{GSgP-Hd3P>?y;{_(keQ^Ka`=(|mrk$qFx&FwyPT8kgxxcqFtO`BjUBfv6f4pYZ-
zRo7wgk|>x@6FQY*Gzv6AJVivg;!KowsOcDEb5!cu-`_{3j82<q??t?5b^Ragy*3(q
z@1cc0kv(5;j4FAtHi+1JtNdafvG<-Y^4^Xn{P9j)ujljc-0ux(J^=RK+2y^2Mdg8`
z?<~-54#Hgs&(PPGBYh2j0K<V1k@+dQfyEInCvt;pVbJaGXAR;NX9LsI1B1b`o4qY7
zds}v7bGB!z4)Xc|$4{8K6hvZkyx)u)eSeQ=)=fx$HFIk=7<)aln<BklV6Wf56JHbb
z|C8h+y0kXI{(-;@D<a;2uf+q*0AM90<}hMSC6cLFNJSqHu(Fau@*}gXuqnh??kXP}
zyrRx1$Vu)lcdGet+tv?joNe4~oP&((Rs@fQLgUcp9-mor?80lx=6X#`PW0S0(!t3y
zt6<5@n00m0(e>-1XD%to@^o?-xyv&tX`<KMvYK$a{F&q$cDM+P{S4sKA>z3e*lsm$
zDG*3OnI#9xgTF?tKft;2V2qmDaJuY*cdmb6uEN1#lBeZ(=X&3~jPYe>diQ0$zmwS|
z%mN?OzJ1Qk3s6ItueR3qQIlt{iNi~GzMlmh9tV%mOz4oKh8e(1Hx_P3p^S{sLk{|~
zd}tO!ofl7=<>`i$Zz)=FDtF$8_{&$AJxJE;+mJV-I*eU&|B@8r=!B*>S46G6zsq^c
z*E<%v4anOs_c<3Gn48cdZZggS5KVmtfg1>BKyj(wL(bf_Mk{Zko^zj$mQS5%W$icN
zLt`eAs8&p_b8~<Gy329Gc4W3;17IwnT1HgT7}{EdGLfytt`aue53+TG%vzvE9}>lk
z{Hd)kE8!c^An=UpgGm_T1r++^C1MN$%M+nX1RxXEaLhKOr!uyjXryDJJ#M0<u@a3v
ziWmkN7}>d7{kiRLD|dS%W5hBDko-BH!r2*9?bEV~e3=peH_E%JdZAxNcUJ}>G3i}v
zGu*0b>wJad00am#>;M1(K4%)q0Z}EW4R^CWxQ9KpV~3KsUdurj4u`NJVl5l4)YG5`
zwcS<}-Uu?FvsDN4%U_(eaC;In4=1FgXXGr(j7T?MDBprQ=j^XAU3xsX_()~mrV(*-
zTANMF8bjn|-m`&T^{M_qpbav-bRCd>BsmNJ<Vi2W^iq8n<@HN1-glN>gsKqY1bJN-
zA)2S=JlG&c)JU!pAG>PsVfl9u6iM>EkO8q#K;D-%kp40_D^?0j;GvaCVg*Ofy08{-
zYoUccIfj;ea=mK>pRN^Otm3Lxe!7a?)Fb$Hv71+2UcGv?)S~Ntg7h%`yQX;pRLWyk
zu?p!vXc=TpL~g|-{%*BYYvEx;=8bHSyvvs_;~u>6wbiMyp)v1#m)#x_vx-YWGnF@4
zQ=uuyd1}yR6k8V=Q5Qp6MbS(<w5kWp3N#}s{Af&uK=i0&CmQWQlg%@7o0JlToc-rU
zjFU4HC%C#!2#TEin%Ou5dmX0Zl=jH_SrrHKIeb;B#rc#(vkR5a+f32opc}Y=haCf#
zwu~Vf0nv9wUarvqSecr)lV8Z5=TZ2HiQz#L++4?N+Zz~9HgXKApT2PAYf%ASk><RC
zvX)&JUFs{<;`cKA6ajNpFXwmnV-8&@o)%CH{e>{i=oTFoFgNwE$TjLj2_g!)MToKM
zq~sW9|B`S6`PU~_Q|N0m3G~O9YUNEp4p?a}5SW=100x`|78WSDorWl<`;bQl7(#!i
zQ7cV=Ofvp9YNs)WgZM0Y53E<TTqi>E3B{ayVteXxUZ?6E8p{EqzMQnexv5*B`Tf*8
zO3nk|IfxEZ_jZ6hqeb+YWJ(l6emV~arjy_Epmh>1!IS)Jcy@>9PiVVf_y?=`dI_e`
z!IRXF))TGh;Bn+@VU$Dz*Q~Qz-2i?_O6Z))>A%*4r#sRLm!59O$^!q`*+qrh-4uI^
z7QI@6dbpqmXPX-vn}>g{KA9OA6&;az65xSIGwB5A2Qn{`03Mwx)pv;O66jy%3C2=Z
zVoPEah;nEJ*Si4<01p}qqBzhg@cBZV5sCeQb7f5!f<96|rA+$AsnPNCJEGgKHaA~w
zkM5WsKl+qmY2Q1QXYl2{;I=z6|DC>h_mfYvQ3C_V*|?fS+hzFP*)#b5GMl8DIJRoA
zIphRN`}r4?_G)m`QIxIr^TW)M%x-{43>$#nNHm58xLYaVMuc#)Q(hH5VkUpdSf0mk
zPL5YtdL~Z5A4V_&<0O1c{)l+PR;T=R`s}?p<tlU?jtLe|dyb_|%RoLP+n6-|L<gY4
z8KSDwT)_$90%LNG^zqijL@%)qY$~-7WhZ6k@UG(SpLy7ol<*6l1WJ=`OkmT=2@4>b
zj7FS5m$1#~T`h!&urNNEg&h7RU2iM<q!;~b<E66G>z3j1ojvH_$pPWV>*$Ti5r*jO
z=fb~)@7U*1dH1_>=f2yGdr(DZPfsThbRFei%sjS0`9s_^c8qc}^ZL%6K=fgoXsuKO
zLQJaGz>SDE;Mu?c2m}=$1&aAggzDq6Qvj9mvK|4Qp2{97JGoo<*LC#zBm&x1;r7!(
zBlE?q7#I*1J{3q-(u{-HuVpnL342HaU?*t8avtg#X8I7ELRBU}P2yUDO9%lYJxR0&
zwJTWYlNfG56OR+fe)SiPjW?cK*R{2?V>Q0KV%=S2*!aaNx0qnB*h#6OO^GMA+NIS8
zy|Afk-hqSb@o#hSpVCWN`)aBW<TS4=EL$x6`S$C}&J+f^xJNpU?3grbX<BPbNNsX!
zC->pLeYy~jI!0F{3H%I7BF1R8ytJHd`BX|uewI|yEnkmkXcxg2Qy+c7-r`MY{U)#_
zEdmmvPR`QagjUe<dYnp0i!~uFKsq)toa!$^Vt}v>kI0H(W(@U9(x7;9lz>Qjh94~e
zkz4=9o1xqQpXC*#KMp7Wkbp?_;lY3*sEWKVfiO3y2P6uT$p}ew7D*RF6P8H-yf)Oc
z=D_R%?}u|%wEi}L>lR>`H3y*rP#(>KFbVC5$!ZIsK227Gd!UCWtC4cC{q9GS)u3EV
zR)hLtvYMEDM(T_6(Jc{^&xlBNOGe6Rzfga8lG(z?lgzZcNs<}xCN&8L0z<50WUnJb
z<faed4G?6g0KN|9JMdV`iFk$%aC#4#m`LG^FRwWJyP2Aqx&=C4yCPg;g0JBRc0R6C
zY)#yJ9q>KowT=!UoDE*hn&3Aha%Kkw&d!ZMe#+acl*ds$@ge(W%nHOE&_4v4N}a$=
zZ%IN+t*G=b64poJUIDE^4$xzyV83H7)Lq$?y%SA7R(5t{q5f(8${n+s->X^pUeoNp
zO8wZFjzQ$Db!>Uo5mn!3$bGk8^+4&&`oKlE26lhHFt9Ftc7H?oau~x2Sd^#o0Vs#b
zWT%nLRqh9}h;SP?)+{bN4YYN2IdIb>v>f7$9w{$XHL1eIb|AxywDYToJfhr2<>z7L
z{7;fIV*9X&KD7QFv0ns6Rp9=RsV4mlq*g$&$ASTeq5?I%5!eDSNp!DpYx-c>?99@^
z(pj@h2Gche&fA=dJX5zAWWQL>C<SRwWn~WYVCa)8e=$36Z^_)fBzps5Y@}a-UP8o1
zSQTp3C49jgLOV200}DqG$Hdq%AUZ^P=hiFNP90>IZu`Dr@pl^+ovqV5sv9~lE_Z!O
z^13<sYsMYbTX2eL>F-C^sZy|F1LAhSgrw`!`^sE1yb4b=FFsvdJgaaAQHfzsakF5+
z9Iy<Ctc1&jLBIr=TkZi?0pJ@XY7MR&hP)EC7hf*gijE7tei6Yn<`&h#;Q>M~I<~n4
zf6nTo*a!W8g-5cR-4hetH?!f9e{os(sPY$(qhO7tD%u4}G?`3f4zU|T?FrR?YIjm!
z+TDr!+mEH9f3|A+jPMhlN5{65;HzSvMCn0on>XXeVZBF&KkPjRdUu50hjT<iz=75q
zlF(ML=mA3{gM5Pd<oxz23jgG{!La%i{8~ywIGT0j94@_t3Jv|npsdgF9PGs0>HqWH
zcmM3~pI7JNTvy)D1Pf=-IcBr4+|rJz6bjHkaKC_zOo1#GfH0;`OiK`YL>n(?<*b{P
z=hGm0Iy-DitXo=YjQoGSd_;t*F-({@7|CXt188NJP=TS}Xq0soKyzmP-Cf&X=wZOI
z-+w*?ADylf1ARF7sgN>~nGjCX4dx+*Bna?PV-FcpH`HGsrb4ZEP*$n7xQi^(4bpTp
zc}?i;iWf4{`sT%yE?7{i{F(fVdr@)S!JMK)6+bI04i)7btc%IWEy#3i7junpRzzz?
zMr%ZBTzqO@YJ7Z3Urc9aR*i>qa7%Xfs<_aAfY3hKaZN4~+4(q2x*5**<GJ_g&L#-m
zNp`k$66|Q6|M?@r6tZAgy<7><hhLx+n49F^v^GQ!agH==9jwEo9L=KTz_f_=3Q~I&
zDc6ZW8^zY4J~?fG=PDn0wkFR|uT)Z@BwB(2K$Sw;mBOZ?%ru+U2m3iM(w(1Z`FeDM
zmJ?<M8a8C}^0b|3CXkjt64(Rn(r2F0WF%{MKg>ubrD8@hu%xf)+cYDYmXlHQ+TFu4
zlHrUCF(aA(rJBqTpeRsK(gvZRP#6AXX;2`X&H>-3Q-=_!VZ`aFL4fRS<z3X?`+ZBx
z_q`i$wY1#YSlJU1(NkH`9TCyZ)U97H%<o3rzJo~G-Hjg{+=rFjJE~8W&xb(3(-q~X
zNbU^@Ma(C#j5sI4@-RD^l#1EW+TE8la3fkuW)9$fm>tc7we!*JXc!e47bBkE0P{^R
zwiTJN47q{-)5roCpn@`Eh*P1GzpRq2Qf9%eRXF?7O3y^QEc-~snhQ7+9sPKxN4#ye
zZG`6ly4%r#wV9<Wn1auz^@N4>O#56|*DkDhkg_^Bcy-DH=&~4Z<jm<*P6qx9RNm-W
zRG#_hNc7h48=AlGtvyq(rtRxel6&SX$D`4m9U?jB*8w?q%TN@)+O+u8T(#or4e}7M
zNU-{lBp&!1WZMOA<{bfk*o`H-g+>_hAWk5OV^DE4;mZhIA;i=vM}z=^3qelq%0r%R
z1tnhS)IFh18ylQvS*B&fzl84>!ewWB-;Zdi_d{O`GmsMeE11D&GKKeWLJ5ju?ygso
z)NCp{f$T}ysAy;c%JKC4m3OP&?JF@jO?A4CD~p@2c2J$}v_Wa#yOn2<{Yx+5%Lbt>
zgH=?OQzx(3Bvr>RIJ!85B(MC8UnC-iMm1K;uhQ%21~VVZ)vy3EeE>@@gYuoUoFF_z
zJ}~@<6!jL&;>ecg+2^4iqMWgjD+I;?><YL94LmW@SEC5XYm5QjH`>i{yvf`ZQ;u1C
zOb(gsVfF7f@pQJ?!EAHl49pjQkdyOa5%c_merS&7_QUdPrUb5Hhbd8q&w|J&r}jv?
zqnN2FJ+(88_UXDtXL-?WQ=yn0>8iWmXvU)MWV*AA?Ne)FU8cq<OknF&oUWPd5oPZZ
zy&%y}v!w{a!7c*Y23A%VO3De>1Ey!dvqOjn!l$TpQ{6_Rbu)RM@$sJU=O*sr<nBc?
zjP~ogM$T4<(0FA<yXx*6msZ<@_R)$^8T)B=wO!(ZXczk^kICYGHc`Y)b&0J>wFi(i
zlkgOf089SUl$fePvi+}9gLV&r6#QRj2_!z?4DSFXfNi5cv~9Mrw!%uLMpy}{GLjv5
z`VJ6eKw85IG*(6ml}Evp!p&(4YK>zdUIy@C`y9mM3<#4^t{M#6gO*(rzQ+j}C<A@l
zC9I*G_j(_?DYU>u^n*{e3Vf<lC4SJ5hL@6c(a3#N>3rzAC+0D*&x5n|p)5#{hdJJI
zzN-4##%*6zRNp>4YkgYi`ueaJ3IdWE9a16!lczT(SqB`Cj$WMLxhOZU!MBZlspP{A
z&wbt4hkSpE{ue5IFQ9&AP;-j0{YKOA;pTSHS$l4_#%AmeZOzGhe%iF>^SYh`-0c8p
zyJ0(nt%{rvOR~Q-p;6R2Z!u)SC-Q-4%2S8y2Qb{S5#~{m=C9zNHfL-t-2CeNx0bHB
zQ1xNQ!qVobFu$1WW39%nuI{Yv&XJ?Fx|BP|RBoGg?uZc4^I>V#g%v0QzuLaBtBW~V
zJUcPZaNhm`4(^a<Nwxs*PU-h#F~$Yr`9LyO2Y(U+mO8gZZavn@O^jB51WLN`c=!9(
zgYQPfOi&a>WLB<0)B9_x4;4wdL{|BJa$L^f;+p>HU6q+pg^EeQ^mp#8JGDEb<yg+1
zKBR;H-gdpZ;jdSAA&aF;@Gt9L#rIZJU*CoxZ@X_#&aswRdrktF)u2wKQ<`r`O)-Sb
zs=XUD8wI>BV`zBp7%^zrlSB>w!P;I?UYVPjILcy_arlJjMKc_k!_l?V9Y4rU)UzCA
z6hTnQp82*QfrIpI9jBSCslsRfz()$>^qOFpAJ1}q+FH<iKepzop!abQk`w?-X92=4
zL}mew85!~<tezzT9+YSnQw*!4QT<dfrgAYDJvhrfex*_KkG6)tsOylwdU{m*Tz|ZJ
z!O>Q^?qtISUu@d+MNR4XV|k4}K8<;KjlRB(*xJp<T+gWLEHXSklg-$1ZF!u*X!D>N
zbTE7C?8(kkjSY5V2rM5kTzRu~VAh5-!-~Vj#fK{l(>9QM>w;7&b|x$?b^lrc8zbmN
z{c_|xk<|ev5_8DdAXj{00754}-$lO7t9Nm#`$o92Yhdl&UU}~yYX*v5oFmWOUy8oi
zxl@!Yq=;&LGYBitzK=R6>4!WJFpm)Jae=x#d59&5+GDG_96Zy|4mqP}BCQWrSCBdG
z8$+q;9VoSx<v=T>RHic>|43_#(hRgt&qE`<wyRqqr=pN@FojTPz;aAmf8?|j{?<NH
zTCBRmYtcR_8`HkeWWZZ+2Pz(mo>#4)1PMY$NPriKWFUxyLQ>QFjV6v7t25dekIkNS
z`lPKT!xZs6G^c(IxZf>k1|mzDdNz>1K!ZGpt$t|AHGUbA00T%tWPIp>WFVlA3ir&(
z+g&_&AUAhlZqAJKtgM-{QJHWC?og~R{bF~=?#qRRm*L}D$=3BR4DRge+Bx{bdK9t+
zx_{jG1JC5_9555UMdm{CmL}&Bv^OxmtIOf!9#T$z=i=yG!F#erL%+-5rX%<r+INTd
zz?uujDRAS6&-~w{9(gA3OT{&SdL!U;9(6giPs+*fvX?aP>4ZM<JJch;lX@dQ9)g2p
zLaE`0%O6BIyaA3OyF0)E&-@RxJz|H4_oX%TeJCF>a;O~IC*>3l(XJ2Uq)Gie8c*wM
zgdL3^0Dh<EB=aQWTAW{c?k<l+qgVwjX(`Xb*%ycZBpAE)E~(WBvtA^YLT}dEYZ>ru
zF^3Vgi9jCd@3bwbB~5!qExA~Wo<DSxK&-u%{YLW^@BP?YGWJu_HuP)<<MD?r&a<CV
zc^#gmiKI4prmcZdk+${)tq)qA?3VaDlmm?1V)CiImRlk|^Yg{}e5I!Th|m6OeR!YL
zC+%s0en$G!${m7!<P*?;t%e?KMcfz){nr$F(CVa@X>Xu+QRuS7*0>zn8vHJM>xth9
z^zb{W&nJlW`6OB&L{pSPu$Q?>pVg8aJcE`Bvo{+gJHRRl&rH{7JM_Fqo}L4VXvEeT
z>31ZOS$}wZG;Cfm`A^KZgw$$l>uHya)@@z;V$Ae|9b3B%E{$69ZT~5x3wQMWeRANt
z#pvRO7gyb0wP)iGtuL?d`l|UweBr}A7x0BWOTPp{eHiyjCxTocM&OB(0hM6DVMF9(
zF<MG334mS&N)MM-IJIqW(J_2)RX5T(Ht=1G-iPD5wsjnw7Co>sV|n)Fk5TaA;2e)V
z$o0bB50T5>rmwnt4!8c;yBEOlOx~yb1g^&c%RL~mKKNV7-JB$B85u#!9<iJu3(#E*
zm?*dH!W!23Bi3E$dBKHAVZDXgL(D#wzyGP!LHUO;>ku53i6j%yZ(INyOk{jyLEKLu
zh|}D96NU@eX&jQiASStHny=w*)BKKs+`Qe(^3iYRVcr&&K4GRIwb=^K>^f*A3a>`j
z`L|%ZN{ryPQ3c%R81?0sZD=h1^^Y&5Enl?aU+>+<cfk17DQT64N^M{O50eqdwd)V>
z{|35BBCkmtnibq!PU!4^dS+f1-eJ7!a7`%c!r$fLAJNK4T*)$GY4uR)st71$g|``>
z`p4>`iX8kkS|5hX7BF7I`D(NdzOwcY3w?yQ#X_9=uyCj*U_qAf6&s=24r>82G-55l
zsLjg3r*!7P5j3@7&7p`U<beOix6m6n08Q9~1K^!>EMp@8o5@7L>d9%iIixCdE@Wz>
z@wW?*IfImZ414dvDfCt%c7a)r<NEkuxczbrydauHNl*Z}a&nxJ^qaX?zo~Ef`h%SL
zNq3N0Z$GmADT3<@ondD?BP1cMB{E`38tj`s#vdJEV<FGzIv4?BNC|`n96$&{1E2(+
zQ+ONpA7Fzr$dyllPhL_i>Ew=cpHfKmVX5qiyh(2Gq5<+6l?rweBzlSJ6?_-tTtS3?
ztQ@7Zv3g6FDt~WdM=D47`S|<#`g{AMLw-I!0RcWfewt5o5S~a$!1WGxQm673JE2qg
z9ZGTu4Rvu04#G7~At6pqp`q+Xr{G{Gc)*LvPfkHWFt>epBf1SYO|VoZuz&-|XmX?o
z9J;+?%Y{<SO%fX!1rw*aID*VEp3DcUR*AxdC5ap6+*~b52rtKmzk|PhFLr)Da{v8j
z6j_q({}KKSPmXO(Neau&3r&h&N)pkkR4r^b^ETw&=}08XKLMHmXwr=z15HkWh4X~P
zl380?n3IqjPfLB!Bp&I+^=)MHp?_8pK6U2~{-~fl?mU|C{!=>UN28>r2?-(jIS~od
zT4VpweGHB-a0mMj;itS#F%VyXrue~q7+?o89&Y37q&Yw|C4piRfrYr3L2lyiCA;n_
zP28}iGc=`A5gWLzIC=ewW#JJES(7C;v;C6%+-y5+r@^Pku<05N^q-(1_y#p2W5eG<
zb{_>~N1VC0{a5^c(frtV(d6pH)`TR7IH#=0gp?(5uwgnSHS9I^{182mX!bkMGT20b
zWY?7Y+0>VX7Yms*e0v>x2tEtZ<!+q9<P-`!n7!m@<-d!V>_Rw^iN~hQN3z3U^?I4`
z6Y0yyfnv1{W6K<aYo~bWkzRu3k335l6~;O24tPV{jl{+Wf9wurCi{Xi6RWmwM`-(Y
z_%&T}nT>?-3bNCoWr%8oz$ShDhuP9#Ia4R((x^JQ+)d2g<<aGV5Acn}t-Bl-;~S_l
zaHfk)Pd96$%eX0{$Br`^ZEiYsONP!!-enfMjnShKE5GAkS<?r$_Q~F(Ol>D!Yw(J5
z)i*Srpg%b?b<ySV_EuxOlkH&%s(}@6kp_@pM#Mr6AOzW1DWvqz4W5AoAd4vc)v<$L
z;~No3ejeY5Mdl~=eTS^$SR35CuVo)Ti`KvgD%sPz7u3y?z0EK~H`(>*2;s2OYhWEh
zaHK#MI;1)cb0CqDc%DNIr%#9AK9mC(9z@j@Ur}9AkmDTWpi^0>ZRAvsHzOv-Amlo?
zS-~PkQCEyFAXlQdTphp{PBUh^vUlX$<nPEHSpD-_o9<s$qxZpy4lX-YtMm<kVzg*A
z(gY_0YbD1yfVZ56?a@d%s;>e6+daE8I-)ivWI^(%i>)6Xyi<0%J2^h2daCD~o%u=4
zLGvRbYNG?^D7+wy5lxhOBzK)GEqW!Q*r_eLaA3{@a)lFgD)Z+<fG`__pF)CUW27Wa
zg=z$v@Ey`U^^XlNkoos1-|OQR;-E)hcyQv8N3=eO?cb$b6~vwW{@&k@0QAZuPcZ&0
zCX)4+nyNVqIaZA@7k#ubV*erhc^AHN=%pwo5{*OW1Ud6L_Q$v3r5q-e^^>}ZFX;m+
zOCh{LD$QZOq;ayA$QZrJu4zQJNA}|uWY-Y=(&H~7D=UZu_OP-tWc~1M?8AI1SfaPl
zICf3={v-Gbjz08Kbi)(ivBYx*jxv^6wI5iXTrfkn4N)%vd~YH{3g1uI58mpRyaWo;
zWO1_*ydb>3A8p6qZboamy1qqKm}FIz3pbbw)p7OM;UqO93vd#%DDdOPI@c)In#K=>
z8|ZU<Z4lB5upCg-6^%##pce^>LN2J8D|#FIpclJokL#gFA~q3b3sRB{en)3Ew?e16
z%v4;2Hnw#G()R%?JRtoZl5T++qSxr<MG}r2)sw)bArtW7^EzOzg6AM+K8gg}s7xCO
zjqo1y-h;E*ajIqz$0SnX{UH$%C~*C{m+}23tZLo4Qyc$;47CB8R&Fgj0fgZpVk0HQ
zW`a=6^a{m1yL|Z%D_1@~epq@LYX(w<e)-2UT<ef_jq40L{y}^VSq;MY;phP2I#a1S
zp;>pxca~at7)h&;3crc`FggeS>`6IOwczgA1jq8nUqEsz4=Jp<!jP#v2QR2FLVoA)
z9)|^0XYhAb<&FvPhK+ECnWQ=jylf&&5K)oU_)j)DQIJLb7}R6)@T$<zs_^j2u&~N-
z*YI#x*YF78j(<^LK#{+HQ9xjke^rQ+V@Qaj6G<h#E4j<WGLwK${Upgz67~ENcZXd8
zZaDB?`H=}9de(km16@M`KolH{IhzC%NsXX$63t6gb2$Zwax&)SWxjL#-NHP)ZEZc5
z`xFG&1^WcbZGCp?#?JSjXf-i#Dj!=F1Yd|e7RNQAFL^ZwAYnLiK+L%3pGV#B!&2Pz
zXIIzbwTQdG3TmO?&A8&Rde{PesUoNd2uE78(6k0Wbl`fivEh|SV?Z!9jSW>}f%1B@
zma46^Es!Y)XCiup8T>IDae@9uX5VJ~N^|oqyanZxKY+6qTd-3!{gXFH%q%-axS_uh
zztGYGe6k)aKM=SM@ux`=k}F1|YY8HP>qic_t6-Cag+~tKCHd&v!}z0;@RpWea9aYt
zgdC%w191<laaaLx6X&tGhhOUILg{!9RO$p7GfN#4O1B+3W|YagxE;?D<2(ljo>q$*
zwuaTZ|L6Z!4}br^)l-i8-|7i<v|c^e&J^>+Z$#EoE%)9mL@V+Oa6>-o;FcAlmHD_5
zbrs`E2~z!u<}gvLjEL#1{NZT=AP8H_wK!BUa-6G|wz;<1q+s*t4EM2&d~<lpd@pTg
z+eqE8a)OG55Hso`eU<vkC5Wn!#H0loxis>M2-)L+ym+`V3uWmsvy-CpEr4}qWxr6E
zw<8Dte*8GMHXyMgGjrZXl(3}+EVxnavxNr_VAB`?NTv`0V-6l2l3hgwc5sM*H`l_0
z#>rFj7Rjn}Gh|9Gp5E|$R%5`zPw{sH?O*k!Ie3S9%xsx?<Q#MV^vT%gtNQU@ug~3-
zxc+i`R#e6Ufp3|;2|DS;XQiHy!J@`|f*8Fovq1+y%=iF*0jJ5jLr6rw3QIj<yN!o%
z2y*-{;j=UhUQJLQQJpmiOg_mUliv7tb@khgCvJ>9rCVJbT^Srw#aapboK7%Z!UJZS
zu#cIuuI6Irb1OcoK5=qUY09efP3dc<Vdo7S*t!S5b9y*!-8%Fl#FvAQ2&SZuI|Qo>
zwgLs<F``oO5M={loy>{aJ>*%;dMVE{t7`oFvl`y7t9!p8^9BEEhXSwo#j&xA<9+fs
zZ)W@#_=eTIU0e57O_*=Boo!5Gd|XqEEp$)|q^c5x8KMYiER4g*=i}s53bt}&>=12l
zAMHT@WmgY-c<=%zc~L20uV{WHb(9Z=KV2f>e-cLdDYpl|$=?JW-yUXJO`_%2R9OSW
zB2%rP$1qa6sfRdz;w!`Uw)T$h&8Vp$r$MH@Os1n(;pS&&KXtm^=(L#W1+5FDmUrzP
ztxQKm<re0BYZ_`g!Rxna&QnaxJjbV+htG^lOqU?&y&t~;y~Fg<5vms$!c9C#n2p+;
zN({Epv2bJhqQJ1K@cKHOj%+*ve0-xqJc5iO#usw^5%qBfnTtcV);LX<xrff2VGx^Y
zVH#lp)JSOM4&zC(-7v?*D+QzuxWJGqiVZq+ZLKZg)CDUW{tMwMW7BS8XJ=w!YYTI8
z9-zAn(2Z0xG-72ZZvsDi)ZQz6RMXQ_v#6_UQCL7g7(`)k{hOL~TQ+TJ)@|HUo*A#3
zn3<WV8=nbnUWfS}<i7wu4Ev4Hbqf}<U19$Z#TR48jzT>rR8W~#(B|k8<|}nYdxWb<
z!Yq7lUL%UeuLSw0!qj~Lz?}f#Odd`h!1l=2AoB)U6~ad|s}#-c<+WT3<K}7WHEEK<
z&dHN+k#=zX35%l*Dt6W;Pw|@?>uBH<@8Dz_S1DnYXQA~ovhx6@K3yCFsEioU=?p;n
z90M~zj)zn)5%%t=ezCBzzPPMp1n-t*?-nsiJHpF1C{Q|qIiS2fy02EZX=`hJcygt0
zxu0K!PjF7WW<Cz%LFkBtP|(%USKqA&3q=t?$ZM-|%rDO<>acYW_m!Pj-e$*P-Rj<o
zCVU13`-M&iXnnZDsyvtrGO1wEC5!B)Zy_SFrX4ASE|A63JS)$3%o*c|=9JGYY@6yD
z>W5OCQEp{MVW*u-lovk}r!zMAes%BsMtll|2K%MNRc)eO!uNE*st~}cYT6~SxR4Ir
z)OouUe&Kva(fcDU_5A(ZXU~}^HrF&_L~=~kCZH=e+yS_ct`G)27G4HqS3uYtSuHVD
z*#p(!Be|VUx|299+sP@R{LOjuIxwHiF>^USZw6q|2hjTkibcezL?mA@Wat|S2dxX%
zzg7EIcd0pd_&t<G@EP}m0II|=Lma$7WCRdES$zw+40LE=M^?^`y$7}x6mH%BBLBtS
zz4%vrd;fmW8Q@ewAxQWFSExE*S_znBj0(*d>0AnLwiUcT$`l6aiDu{NjaNy4gby%H
zBV-Bj)xChRurPa6F4A&Hq=2Xn1h_~TorfDg4h9R3NA)AkuMo<sP+?AJfuaR@*ju<E
z?@rW|7o6)cANkok*+|Rt^IS6gfS|amzc|9W>v8?6R9J*jz$7A}gU861{2}4e<XHpy
z{ttwvz{Y`)w&wio#(JP?_ICCe+J@r_q6t|;WvL4Z6>3<BXCiCYK!2~uV5ji$krPX$
z$MPJU)C4ctk<vOhn`rlFLhJDU@VbN{3gs4-nQ9Q1GQ~2&CRD=FVGvv*!*G{`{2vA)
z`u(0tl7_~R(;$w)E<<N%45c+ap$ij+5v>0VI}o$!izA+(W@G{OsEp_?m>_WmxCtW4
zA6te0#6$$#zW&>~8Jg+NY0%PHE^-okJHkmaq9`Y+L%G7$sy~Nj_uDC<X2aNtWvH5+
z901~aPWC==Ceu^$sC8kuA|mso1WV*)0H?JOWS_A$FRC^=wmvd)QG{<%a0H5)77`E|
z>K7eXBg-!`YI~!`WqNBgs4Iyz!Cup+YMClBg8h<a&2XLDGaFF+VV{J7l3dOI-m8^V
zZuOsgMqc=c4NCm4063jioPmun$X>-~cygwrIbDZ`kr9yhOtMwvWEMo?4e3RXQ*Yt0
z?_%2^^HiJ22))|4`n1rpz!mx7SspT(YnFXz&?ud#z|fEY_NtTX3|n(Af3&+^_&&AJ
z@nX#4MBT=1!S!hqlN-XzLcA(`gMh9lK$e|y0G8scOiN-4lk$*nXnY>xQ5p&lqWJ)W
zI<aWW=ITWavIcF>fB=XdMT!~jfg>9bqrZmR(^=A7+FqJuZ{-+cn;bITKsTlA_lf>6
z=<`4X-;-ScDmrvHi<Fhg6$*Vw=Mxe-(6wJzjLF_;b~x#t?1J(;cG92tkFNU4L%>X#
znRurJ302%-;Vxx9K%B-{2vu!uguwvmW1#JIG9KCnNtIA&q9fsT_}YXHscCsRx&>n7
zG=L!o=;{cl$3uEE<Rpoi%x)G?necXD@bIGF%J0-nX=BVfrJ-Pmfwvz10rtEN{cPdC
z(})9vZ^<6zTSDAJae(kCk(a1MaR9%9qJ#ZX0gz5;=&TxGLgYz$9YA45!0ye#^NTtd
zuTBofF(V^206_PH@YX?iYa&G4N{H4VYUu=i5&>+$%Xl~iK##Fdh>mWstr@}^0w!4t
zU!2@-?d)#8v;&POUYHOmW5E6~LgwxooovR9kag<uPSTb0oUP=RcmgvmJJl!EfYF0f
zy*MV-Hr&Bwq{S3%Exq8eF19A>>0ZNs4N@osgd#aTeSmBuVtN+IiN0K6WGDpsPY4Jz
zPpS;hw2F%ivo@XLySry?7oQSmXfk?slHbe#gD7i%H%qx8PX1QsX9n=_Rlvgyurt8n
zj392Cita=V5HXQRxHLRh<V%zhVLi`?=!VA3IUP;Bo12Zjr+ZPw@~rrIK8?&Yxs!u5
zYO>|%F>#48X+=>MR+A^2OwyYW9hWjqF>R`gnHeBe8O&*m>?)NuNlG7)%0xZEP`J}p
zlQPC^;%M!0dQ;rE!%R+IzEoPwvi44}gjeCkwZNk__zYP0FykJt#q&@*?u$jmp;K`i
zMZ%fbD-XS04#(&!dtjJXVVI+U(UOd@p)L26-L5`+M8gut2u&qRn&(AkOyy;+>GI(4
zF(adcLjwcftsgg9o6{XT)!5I2+w)wF*3v!E4Y5;Z)CZNNMNN#!DVm`bmkMUIswtDX
zS-R3`DMV&a?qPqyugm%&s>TVxATv$fJl4Yw8?n$AONY=6EHi*`pzR1tVyl-dU+7*O
z?!>3XhJ;3Y1lZ?yw9lDp@8uQZYM0cJP|K%Pr_Wnxl^Qn5Ixf&R$`3tPke-<v<LWup
zQxPwCFz-(<bdqS@H^OhA<I)3EbhibcRJbHnk}Cl(I8uv&5bXn^D+K*eq0oZz1%1tL
z^oi9xscVYjqlh;{?@<AmRg0Qpn;OAWtSKz4LRE9JtL8hpE2c83Rh7AU3#!mmg}cLR
z3lKb1RUrq3tK&Ojt#U^X4=3SF6{^h1TTltVxH|}Es;lzysw&V_Pj`nS6{sp_&VnjO
z_&!hx-*XpKkXrWKpUHFQCfoQ0;5Sp}&P}!T^%K5HDj_9)!o}oyrK$43K>S*2X=$oW
zKoECVtm7+uP2RHg4G=Dgb%J5)9B>}0kiHEhX#|ioeXul;qy)lJ;V2hYD)+E5(zo(Z
zND-@W(}zSDaP`TpjASfW2n`A4l?mm#^*Ir!D+h&#yoq;>LUDN4+c{%52)YrSy7j_>
zNF>h%iS!7XmC_URc0O0Ahf;9g^?bce5kh*zD(!kf8#(0RSN}mddiVg+4tXzM5B1gO
zg{?ySP*e#1EC=>=I*5LDQcTD*YX+GL5aITjaQ$V*;-J*D`A!+sD1+NoiXn)Qc&|z9
zCc#CT(m?#!78c4fyX2O6CBE}pmisx{XIHFDcaUzgbhMm1&w8|n3w(jCoF_HJv-p`b
z+Z8UvkQrgEfiqxpH+;8o%>wwnAAaAY{v8;P+zoFUNb%#&O0T~gwqOmw;5r-zkVZu_
zB!L3Z&V<3|`wqG#Cgepqrgd&;O`M++CEeBmT{|g8Tjy0<I$3~lxE=;dbQ{8ntmzqI
z@H#z}Slr_Te>LQc1|O-lJ}ZcI5{@1*?m)lPtPNQd?^zsL%lX+(^_dtL>gmkZqE`I<
zU0yP89@Tn<^S#Xmsg2>bseyKuHgO*MiRo_k84K>@<*8K4m!)R-uJkW3!2bH+g6J}1
zmmwDpW}p9;>QyN@mOhF50p;<g#IU75w6Vz-LI7$;j&y_ntgIF-T*&<pWobEON@-kt
zQquo7?-61L^GWX{5N%<|f8nA<3$3h3rz5!^l9J-%N~cV*v?Rt!02FSCB!B{9JPE25
zC{n}0Ma$vZqTw))K-TJ3HfUOT5&+W5BS4^7+RQ^p9yW7E)6A2=5XEjdFn8eMrN>}_
z>zBkay`yR7NoYtjk3h4Dw(|%uv>ge|O@u51<_1h|PlBT_;;)PnMruVT=7lrE7PsOV
zcQOqJ8f|;@$`^qDk$#_q|LOgrWy2PE>@z!lILaqFW|4u^m`mXQ2DO+*Q>weBIBO<i
z75z?^v(q^&%o+X|bM+VeGpwo9m==;B)PE=F^;YVZ86KE2kSIwbcaPPB>#ayngfk9n
zeRxk#ze|Vdb%}^@aS0E{cIq$4;aLN|M=QFh>%k{Vd2GHB*dOj79q^xkGYnkRZb*k9
z=N$sKq#r)pA&?TnHtA0PMry{|z~1NiUtt_@@P*Wn9e~skGLC1Cf^~izUa8^ZV8Pz6
zml~oP@O6Q_sy}Q#{&tIradVG}A@309kV^#AEtE3Mj{q`w&_GUw3l0n+HQVUWPcQv^
zWQ~*=0U^hKjX3yNJ>qEt!-xkmQs2}xPLml073XjdnBCAIF$z+ngs2qKti|@^r3q~r
z;o%u=@k_Y}u}c!e($c~bTgZ)YcHAz;i{ApT{Wm9<OH^%SWNlRRB2X-&J))yM+@qtp
zU13!b5yb5k5m6P^9ODjU?(Q)FPCm?gAAm!`wJa1MfKb{wj+dc`&Pbh+1}j$vBwCJ`
z$lY0Ppuf<}JI)T`f|jFQaIxX{pn8CcqLG$8n8Wr-KGjan?Dr>vy4v01V|r)2_J6F5
z>)C6n7o=@uWmso1{lX*DXlm%x8e>Z%U1?kX+Eq63R&mp^y#Vyh;QhY`Y9|=*;BG9n
z1_4tKhlUa1Z}UQhy}csEBs*``d<YbnJK4%=(k<s1TzqnR3cQ^Kw@YL2;S=*8MFJw1
z5;86teNlAoij0)QA%(VflN|MZO)_v?epY0gVzgs!pq1Sioh4(;0BgbF$NZ?8&5(nT
z;gT}oye6tTl^=J4pg0R2t2c$BcBYp*asR9|NP-?TsNPWB;74nIHB%bYvOn{q?~zbL
zqSSq$(&gjfSMgXG(Bw!aCJUd+oXtjP`{<3_2WSaijM(O8ERb)&B`bt7d{{-oY0@5i
zaW71z5)7~ren)i(4n*-$?z`6uLC-$IoAAj963pXnRVVEMENh~xQ22WzaTQ`7Sab95
z-Qb&6x^sOhDQ`nPAuv5pcriVQcT*<UH^SDg!S3F6Hj3rG1%bA~J^|p$?C{P1GVirK
z?vF{<lY*T1*aac*CD>6nwlW|!0L28rNKLtF{F^Kh+P9)<Fwbz7T8UCJmE?y9Z{gzQ
zegy%pAs*f~HoooPPqhp74U*d`@Lqo!pyeIl@8ca9;Nu;@&(({m45WZ)$5sVTvYZt7
z!qhN`(gLy6%^{qAf$`>W*HtcjyP8Id(1<o>(RE7|G&*Rauz>)tcIk?W+a3Z<NJ5yW
z2#i-!l823#rcCZf03>C$3hB#Q-qW2dESxR0JZHF=nLGZiqnPGoZsusod!@NTxkRco
z7p|&OR6S}Wpyz>+GZMjY3Sm4*F10{LR&GWzl~DJ0)1}CjP56E^GrI|mh{6Y(K8?XY
z=I7%(H#~RYe|z3QhMw21dBSwR0S46<;3jkpVu89Z^-vfY86t&ntEdQn`J4X{{F#sN
z1**8)_;J|kMkI{_%qr$osxa9Nh$nDRYBBpj@a*I=aE9~;N-cOQ{TN!)O@lLLG&Ia`
z@bPirW}>pRwCXGr<Y*fRQ`^C<#sA{B!z<twC&><E_C)n(cx)d2*Ur$GxR9L#tJb`L
z(*nGF0{r~E0;H>br_b=I-Lwe{B%}^j4v=_)@GJgBC5C5#av;Y133b`1Iy)Dy$wlSD
z@409}E?$o6a`7_Q54ys2l@7!p$h5tbn+SIi+@ZvcmUt`QASKFb;ku*|O61z!N)Qa7
zt^(`ACz1qlyHF&hyg+6|Dg#;Agv9VcguGHh%k82>wOJ&vKpE<}`>00xBk;4elJ9{o
zTorzUop+oXYZPEpkh{qgMlvIrTqfww-8x~bY^H4UgucSaoY`33<Cx}m?1Xok;~Mwp
zx<M58$7ZSo)tf*Sjls>}0ziqT8oDpk$H$A-3ZrNJpbS8*vu7?@JUgqUWRi!4Yha+O
zd(h9QbyjvuYv!!h5)*eb*N_lbmk|70MtyxodTnj`BzN=hsg9A6jv4h$Gt>nU4o(q3
z<%F@^HoTf|CRz}3lY#M7VIkBs`CTb&47kEKAH|oCz$Ay@V&-jCFA&FLKpfA*Yav`8
z^ERC0L?mD!D&(Xqn%(B6$8t+<9PN<roHBpy?(~^^*Up=?Q{H~`2G{47HqYC{-`&*A
z!+(<Zyfil;qB&A;3EaF3*eoGldGsJ#dWjrW{U8TF53X)!=<pTjFbifqj=RpDlm7G2
zx}(cz2)u>41G%<~SDviUNp72wjiksLS*kLkD#lcedZ~Fn{sVu5fBZW$s)V~fDWELG
z(8R>hJJ712$-u<Kz=sZID-7lW)$<;UQfA)XIjOXJZ)WD+?vlwnZ99*B)x7wtW1ZaA
zi2<JG=AHo){mQ4ix=sfJijW|D%BBu&cWUwjwgFpQDr3IBKaaaMh#KZ#^Fd@+h`-Iu
z#J{2OJ~wW-1BUfUrCPnbzJ$gFLGmqp!d;;B6Jqbik~kr_3zXc_^r_UA!RmV{MYj(K
z<_ui0c!AtU2^TE(ikDH6Ci$4BGzm?SCP}9_mXA?oh@Fy4LrJIP(oj+ZK3OHhZBhBr
zm=#e}fjC4sPfFCsfOrlk>B8!Bhw<H>ARmaa_3{Z~;sU(<`~rNu0(c4B%xU|NYjCKu
zV?aQUYam4B1O-Xh2e+Vcb7)*gEe8#27%T#4c;na^+9kodLHNMAf8c7%Tum6SRLeOu
z)Y(2bm?t-YZg2_-baf1Z^YH~O;Zr<IwVUiPsc3akAHF9Z!bi<%<itMB$$jFUlL=Z5
zMXq51_Fnc*eopZJNZ--fs~r6u;s5ZYKgKd_^6Ci_e638)$LNk2p*?bf@uUelBSy${
zr3o?@$BD+;TJXP-M&pc33`dU`Il^cZP|Z)dW2!m)M3GUmMpC(4A(h>Z#|sl)NkAxu
zpSbj!rDK+^UkW&$#a&U2ggKGIUS!>j%nSvuFTM>yE64?>J+L8^$Du-=x`KxpFcLU~
z<o4MEZPJqG@RfB?p#v(osVk5mHJP&G9J-C$+ej17ks1L|V>#3yUO(tVL0SRAb>ZgB
z0yJ^$&c)CIvhC}`R}LJ2+N+@U6?JWWGvfAx+R9aHkV$U#jSHWwY#CnrK^gaf#7=sR
z2*mnk)Kdp%gOOe8VP+@P+N?-fy=!M+Vtf#zl7{;GJYVaTmIl(_g9vzy5nluOO%9Ix
zAwe2noW8<VXa+}Od|c4LF75+A-(K=oEt!pKZa2GB`YRFW^`(X~aEW+W`La=83DbpX
z*VstuuXl_CFJ26s@GI24%}v59q&KOINENb&c46{O*q*n1xQsYcdQ+4UopLlXB5a6H
z0jt)k)@Yb72~;J2GGZrrHD!GYDouVq<&;o`Z=-SjkSbtYT@8i}<)?VOYB$8Tl2|e~
z8AV5tbb%2`ltE;2Va}>Kwo&7)1N_XVxa(AMV4759PP21NbekP=e}a*zsocTBF)PU0
z+H`^gG}*&7;m?6^TEi+*Mke<Vk7b4i!9q<KGuWlU)k@7o#6pcdCYf0}IZjv1m==*R
zd8Fwi6B9d==)#Pc=oEu7mfV+MQ1N2Zk!_-PXm0d0D@zj-YYQ#|WkrUiC;PcU{G+mu
zYsOb)_0&C1)EzOlgls6tt%jYX?o};y3mg0^qGFq3oAv~kwTH|7m!!`K3rYzOn(S;a
zVSKo>$EhGCzB>4YRTbMygU6N{gsp7IEl3EA3f0n19BTmE<^%R34Ne$E{R(a}Q4^4l
zBgTBWg7mK*nrI{ya~4V8BwS(Bbbg9k`V8LO%E}`8nV|~@Ch}%ZE`CvHjIn_p=l85Y
zhCv8qIPz#9gUkp3fGMZM5X6Uvu^i-_W94AS*xeCXZdy7eB_;Ls?E$`i{w}e4qawJ&
z>^LE%c(iwAYItJ{I74guNN7h=rhh<%0>~DPnK%HJIx|>S&}2y5o2bVScL^-27)K9N
zK|~heVBJEr3tw~h4e$;RbqSjgI<a^fiEpXq`nNBjQ7p5jkBgjcY8GZ25>Xd#Fta5L
zWG)_j1P$O^5W^*?Jo>1M0jJ_4x0f%PHhRhg9bF?GGZzv(AY6LH(;!Hol_HoF67)li
z5k{gXo*<qW978bN@TsLN_{p%N7YdkaVQ)3b(8R~jd6L7_2?kTVke}0IMX$BB@t^2B
zhZz}}8I5s>F*Y`9(Q}M6GO{!n=?G8eXeapESY;La2R=zHoa78`@Sz#8fFf!Pc{12W
zSv62RaE%7sbaxL0+&Cg#e|+~K4ZGRYqT9Twd{*L6*bS>Z!k)&5sh>?9&q9J3fRqpg
z6*e6l@?ZoDBp!23y<3mOvt-+mc$P>7#Ix{aLJB)hjAvO|7oJk_csvVqL>5R)=&*p}
znSteM{6CMMI4|5;juwhbWjNB@dHM2%sbekmN9Y)jG<6>49ddA-D)i;g;khCtwRcg^
z*beF`(xTEl%$Pcqhz@5cl*p6L6$<Pu8tIf@nO@jo>*=A;=ft@}fse%%`GmSegOuw9
zE=^ZxTytVGacVwxQZt;{EEmQUm4p;VDw4-f-^kd+b!<#anlmM|C`#IhvcAJ7Y2XR@
zXDA8<g@KzB7%Fkm?*_@i2pm<Ru-wCB2gR`O<lG~QkfJC}C?XJxr^liRyge);iQ)Rw
z2L7?JvbJ$~7@fvzcaWF@cV9buhZ&maG+DMf&I>51or$SjE_^>MTy1ig`2@x9(_Bo3
zhpTbm>+i>}se!km`ToNI9u7SFpYZpNjg^(PwUw34Z+2D|c6Jt4b`Fn)k39+8oMG`~
z!w{PTC-@%Rrv_;fO*?r8NHoxxRXmCy%AZL01dP9|t>_F|`*diK#nB}=K!gOQ$5b;-
ze>{dYLH>~0B=~U4fu(&7>RN=dm%R=`oDH7K>{V@gs#v~v=j5`rFJ@%yURyq8r|t4r
zzHDmz^4M}bce1~Ssj0iaiGTTY7iSR58D$h6r5dj~qBaOT!w4XIM!E9CcAtEz^2@!K
z`xp3A(|`{eR_K@SADRgE0w4Sh?==H7e@6>#FJc*R`b(ym?qXr#YOW2I0SgNkP)%#O
z&8lg#1{kBg(wK>oa1ZQ+8<IV$SBG3>5^#UHAt}j?fIknZKICH<;lx7&`0|7OkmxWP
z-@$&&r+4t@yI)KZzBz&{u`SzFVV<CCR@rz4|A4OGFOL8xnaSN!`2i6jp=Ao<SQ@6M
z8VPk;pQc{BmU@Zb$zMwS{B!ui-MZVdYEgAp>p%Z2?XF(X-EtRHgirac3?>)QYoCH<
z$iYEFB|2G}5@|StrJsOx7mh%J8Yj6s%owmj^89TB@_ZMbW9joxITFxdrolhYv8zOJ
z*ov?paNIJ_Va4<daQZuQOIZy+Lb3r=tJhT1L{BjFxH9b`GkIVD&8PLi{0>I(0Z@qk
zi}@Y$8`vjJ%Bi3<aZg&iXQ*{3wMh_GOEd{Gs+-(BMw|bODlLx~oQd|TF*@H6J|m5a
zc4wq)X#w*g1(Uw`AH4)*pihE{4vQ^<^?tZfept)@!vsKZ-;*sTy#DU0XH5XC&`zl>
z>nXE`Z=wPS&{<IftEdB-4f{@XQ1tT?Hha)Wmpx&&XC&W9dDaGiR!;^sN<QWjB5^QG
z=QCUs_$#9B@{f8YP&8RL&19>m#1znU7?{IBrU#1><NlNLqAyzepPU+|L}UMlY(N8k
z9y>s{$M521P?yYw4Fj$YvSEhR`AIC%;1HOT=!O|q<KJQp&Fnyp-@t4I4g+4wc**Xo
z7vZ7kO$}F%WW~6Mt^)C2_vk3%FyN&SY8X)&8d@0<4h{ow77&L)G?>HGjv82A3E3b0
z#H9x=9O}p03;8j5ux*K*5o~?nEg>gk`>(4xzis`Vcg1Sd+p`D03*vsK_BaO4$W8<6
z7#uaJoO!Pw2(UHYt_lIIiOMrlwL%Dyn?!7~h7e97DQeD;wpLo_M!JOt<ROnjNTc(H
zpimSL<{FjjH76*h(7j3#7N&?O^A9Ks_Y4nHgqH;bfS+En06aUFc_-*WJnHA6Y0?wz
zOkbYVRvaE)+?KS0cS`D<9+R0FGrcnjNYesr$Xr&1z-ocb{T|$ts9c4^@I_TN?D+Lc
z+k4Sa(t)j1uBzow5~|cw0d@gDnTqeK*3p?EVNzgvC%HT_V%m?|Y>2ju+Ki{7LcHn6
z=H?&CCrm*H_c~ZkyTD{ff|CFrHM0O>JjB(BnhXe%!m%~|I|Jk6Lw3e4&kFJg_VD%h
z<zC;k(0j&opQMKHe+N2v`Gq(-2LfPKI12v>2}&~U9;NQR2w<S5>`m;=8-tI)L)lC0
zok9Y84KD)I1M%(<b&dK(421;9`K)$yVXuLAr^7WqdgF}O2&RgTOwrv)p7AVpKotcY
zbQ6aN%-3_U)IW)&oG!H^EcH^l)ITYEVX46dC1p@Q)OgYbmCzX|x}cJ*v?ocKMTTP+
zn)$?n3rg67<5m8W?cl$WSi#vUqA*R7!qWp+z2DVk95H^ZnVz%%r0svdcvvRu2kTy<
zp9J9#aJ(d2e31%E<X{$pOC$t(Tvyk76a8HDEJjZV!|_M<{Qb9gqAim4%Vf}Fq3}D-
z1fC1%B2}L{N{-<Kbo3AkHyMxDnIIb>pB$4Df$v(`GKHL0I)pF?ecWQ~3-@Ud7mODj
zzbTX)ffC}JISvy}et~p7QWxAdzTmc@b?^1U+<l5yGFSy~6E;a^^TAEtLDj)uf)W{g
zza(KE+>%~UEtSm|_Z+=V2?%bJat^yyIftJINy5zb?a+8No`S<v2cU63!TKJ#h(1Vo
z6Gf^ZpO9n=-kSp0F(6#QgDOa~*WRFPyypri7=Tx*YE_M}G{ozu30k58vL>!w+%|Yr
z@#49q&2z*2{6lf?T+~!r(p((s?;DO+&TDIj9T(_d+R<L-9~c1rtUzz!i_AtC#IFzb
zD0h+)Tm)OlS1b_+iqES$RORA8;gflA6OT|WRqYc83fI@tteYk=8+uxQKUTr1-ryYI
zK8K9!$DIR<3s8Gr9&RW?E!?#N)LDdU=|4axZNM0HTjmPQ!pf3lR(6;m>v--S{%L=J
z!q+drTLDHeVlYIvokGH<f&&R&&gXt+Zpj?Lm_)KFG=AUV><$@<Tmkv3z015r!wdp6
z>>d^)pU+`#Y4tHO9m0F60UGM?l@XDLoNpk}ha7G|Sd9VY2`c{Yo?|Ctp5poCuMQ3h
zA3ojt3!M-qq4m}O+Q}{GB={-ZLdzC9`SR%;gO!{FzMTL9fe|DaIl<_j8qG1>5kH*Y
zK9igCPlyeVb9S%CWeAvOH7pP^3i%qafK;Xc5$iw56g2biSu#bK@Yxd*#lJy#1H9rB
zm=qb%el=dP!xhe7R$u)H@A6mp!hhbrd;*f;d&t=_D8#`r7+hQsByfY-4Z;X@{{iWL
zg!aQ-MJyT~DzKGEq&FUh3!n-r(=d_@XlCm(n;{Vx4asfs>WG6je%%}IayQ~y#HfQM
zv7{La%h$|4SpdKyCyVzeEYAp$X-QfV*ODF{p579-#P1p6825GT;)L+DwD5$*v1s|D
zQW<nx$lYR>0_@~;Vjw;0&<h$;qz=DWMuvS$9fI+yddTn^^T(5~fgr1i+Bi<c*QdM&
z=Ms?KNZ6jHH>+V05i-sDNL$U7Qq#4pA2vjolTVhH2s!hkED+ivds)+#;;Cq_X>`f6
zCP@S6XOB$~lDy4rL-oM9i690y=e#}WP6}`bVEImdE9<GX9b}X{00B|K)OZef55`}z
z5Ae&(7}aM$UT;eb?wtiL+`-O7yWrkF(wv#hq61B78^`(Fgz<Dh8{#h@)sf#I0Mm&6
z-rhd04eBTdzWD}P=wxrA9RLuKZ@{@nPnj@6#$!BPb#=~YX`7g8vo~D_PNgQL<ek{)
z3NJLX*U*ciq(QHN6eW#jhZL_GM-LD*Lb}>r;=_Aqy#_#3L;k5b+*v|$GbQ?>Ih<P2
zXwaYL5HuOY7+X|J_jNV&Cm%a*VU`*{E~+#>Tqpg+3F$A5yULH26`cE_H>D}0pm0r$
zFP@0o9&Z|nmSJcb!~zo9M-76+m_{P?S@WIRA;~3CM)ApJmPd~#_t*ElgcDzTP5O&h
z{F=gokfxO0AI=q&9xLB1?7(d>&v#*-W9d9Y4mq9YVh+MLfd9ihlhh`}Zsy11LPT!x
zdW_w}45>5xpY*pQlj#i&)9t;z?YVUDw`VNKK><$ozR-xqUCk4=4owte1H@9cDUpi(
zO~b_qf<hpP=CG=VTJvPE$4Fe_cpAeE_G4mgg+mj_EfjD)8j(_2GZ|c!1M;9k;i-vd
zC1x^ZJ$fF`E$irD&aJ-_Fjgg5zi({7n5GA)&J4fp)YQ_jvtnhFXVgxgFzJs)D1&B(
z^?4&XzM?pf9PuT_rU(Zn*OwrK^4gP=<6NyF%S~d+7BO&Z2aFp`5x|te-2|p{Fw)Cp
zL~J(w>61SW=l?&>z5_g}qWk;ynnDRhL_|SBl(;QTEF{^z^xgzTT#_YONHc|I!`^%E
z1$*xed#~6v78JpTMl7$!2FdrEnR9n<(Et0q&zC%VXU_CFbLPyMGi~sw0$eMybFx5Q
zh2YD!U(`L}x|#E?9@l;JiWR81(fy8gF;<~~=mFRyaO&||-tmPC^!FCPZ=`aQa+kUf
zCw8PaQaM?<>Ex5)ai(&P+DGl{dz=Z6b51-F9&6;A<lQw91L#<DJr10mynQu%uEQDP
zucVvU`Wr4?!NpM5Eh?AyJP)p8Z|WL^01;Rt6o8$%SC5_~LlVvSuYt8l8q4!UM_%(F
z^IOxkhDV((e=6O;u>ehDiJ0~jf#xCeuHALafV@FPI~_1#%HP*@%{I*|G;Q*{+8a7=
zhAyW^uEW??<!>I4WoZ(U{`w|(KO*0vnaV?)-C-#U^v$JU?12Kw?}?U`jj3afo*8dE
zY_HOJd(YVK$a(R`g`>iU%C{Uav3cKpqhm|vruW@<3{sle{jRoLJA)OU;rWSW>SIes
z<Dy80=c}>B63-K}>0lIC+YP^~A5iiiWY24=kNkaocXv1T1}OV$xYJv?5A@33ZW`6S
z6j2u_5nK|2BPP^O`mNJvZTnosNe5{lChha}JNdvGRfEER(RGi=4XgWw`?xzhkrDcx
z+g>_#tzld#>jz9m*T98sMy*zd>-L7Rteh#@(C#~t-q`M&)xXtCvAY6~JF|JE&;Uc+
z<#++AjbZYdWmi1>$mLf)H2?6Y&%V6llvB1|G5?;sFTUh~CvUjxhn2^Db@4@;jsf9b
zi_+eS!|Z(2kAiU3z(nnt-1~ECN~TRK!9`DM7gowQ;F71QQ%g&yp%4!s^S&T?plUaU
zC;arje_!{cvKcom;+3Plk$P4v7>s;&7>cn8BeQ+a>>(fI1_!Jja)Li-snX}#HnrS5
z{C`o2DR1~2QRk9nB2xlv^EaaUrhFh%3jpu5M;oe%6ZqgmTcH7;n1QjW8SqIN7`u}J
zW9Sj_6>KvGd<utY+b-Z!cYsghFl{r1|5<3~f7|~6ae(Qb-i0WT+5dnxxE3?f-?;vQ
zEpzvklguA`PoW^{;mH&q*D__2?}yEV*fjKiZzi0SJaggH`{PyEOgOsl{zDe9&4d$A
zjP(jHI*>LKV&lqBxc4Hae9H$oMl}b57z^_7G^pP*KS`cG^VGH1pE`5WxVAISY#SHc
znmE2@&cTgWd~(^1TW@ZeQ88}cOtR8gBpa3g#v2EWWc+0De2$;2ym#{SiL1^#Z`H&}
zvrahwgjvC44_Y{B{OtORYfgAz_3Xr?ST@zey5{~5+b1hidyN{hZ!fleaxRv}SC{k(
z%{^%Ns6O_Z-mD`tv>CDn>6?nCl<bkG21<ranEgi-4VC*3o{9Z)ft{Gc$Bmz~*PHWB
zt2=a5rcB)nk({ZFWHsf}34y>sO~)rs-@kgr^6LGM9^ZUi^Y~zb2Oc(U+Mz41t2^g~
z6Xtu9iZY1;eRJh!K}JkX#Clu_j;1kv0XU`HZ}MS#e^oMYaBN7p&zK=Iy5{azec<{F
z#~#$%;q?;*lCS^&E6~A}2Y81bcgT^~r7DUmG6lj6S68~9H&%nifK|w(MA|+`88P5;
zecLg|{3WmK!X=7-d-7}29!fpqpKJ!R$KSgt^_U^EA?^kYafRFivDpxJ!|A7Evft4)
z5Sp30C}A)lxnHzsTL;GX_J_L$$`^Mnl}9}MFlOtYc1636?7k5kv~b&g+fPN*O}OQ0
zb@#J=RN7bi`4x~f&g?n>=f{pb`mD1MZY#o_91O=s^KDx%Jxe|-6Aa3V{ji$+QTOf0
z0INFNZ-Mq@vR2czyRlr{jL$i=m<i+UOeU!@E!gDU_ZT)jc6j+tdko$62(4!I@cuiG
zoiL(s?Cz@v3>Z`~X)io=hEY+uQeC8CPb9E{tRw1Z<;u%1hliwGh6_j7(RishGz+-Y
z^RnyYeXip^1C%Y=@fn{j%77>2yPkm0c;!yzZ1p%nzW=I@-ui!t^~#<95a(~w-jXjh
zRxq_&Kp4Jh)B!{4M~v3qI_{vx1w*|3>&jPBElPs5&{-{daN6TRvg~hxb|9+*{xr7t
zkn9E|t30yrl(i#Z4m3SHJcI=UGd^Kg5PLM)+2sN3=0}#8hT^g(BblAOdOU^f2Be`B
z*-a=g*nrN$SfJUX$<7YXQW<0ic`+%Ag>j)vIi2h|m_%Jo_FObRlU!JsJe22gvge~b
zPm{eDb|}3=_TFfhPsrW}<@tr|eNmp@$v#TTLEa+Gy(LZVPxgHzQ)Z$Y%WJe`$c$Mr
zd!eMuBR~nVhMiE-beYM6%q~lVWp)`4vnx^_#A{(!r9<VL$gTy#=u)wwkh>ubQcB5g
zO0$)jWVa+s@#EUkP=$3&mc9%7da~yP?78w#Wh=SoNijTCD8lcQO&^sQs8tAev~P~K
zfb5E7aoR`vvMLSN8ps_NTWD-6GIQ6ZkVfT^aqL+8fZTCBOxs9yD_eKj4&>`dIl4h%
zTxleBC5kk2q+U9ka<cSurG0dE^(eFFNtV8x?D^7g{TQ<MlKSY^lfAc8s6RmVK9Zwv
zB70w4w8+#hES&<Wzv1WAPa2FJ?ZUl3G+%MD50J(hetogO*0_t@cY^&LvJZm2lk7W7
zgUmr>9}Ihp?7K*P%&BA_BK3kSCGy%8?oDJLD(zz)PxjrUfu^6=?$Yk&i{w5`Dm1?(
z`*3Nn)t~HpNPAilvhNA^gULQZ>SHm5A*=65*iR<=UQ)y&I+RCA1FcudeQ(LKd|d4#
z<ylNvWpPJKIo2O!FO(cxo6yjjY92Z_*_=);u1j&q2c|W(rmK>5LtE0TQ}a^kn%dUc
zwdsZ)K}Iu|#LCv@<YeaG(=Y4(FP_|KW~!#GF4;UKRh@3D?-^OR%}Uj$D;n#nd;0mV
z|MX!lJllVIWt=POl2yxkCdi%q>dr!SXQx)S#?viLb;(r|T9b9@s+o=T$p&!2MyW|!
zg(c{;RD%ngTBV^<1cy_?c(G(C)~{>94~OCnzXtfE5NfD29p6T9#*|dWLzhc!Fl*t~
zEVc9qITuHWS-MF)ELw-~Gx4iI=sNBm!(O)#&uI)?(@0}9E;NteKaB7x{8wYk$QZ<$
z1^zq>wrnYOOnLMUY0pJ$R+=<Q)qpbpZ+ZRS>1Tb0N^?+-p{PLv%GVP!Y2?U!hN3Rb
zFso6DdS2IMaBGy7;LA!?k6&TNHWMM3TN{sE&eIj8Z{ek9ZPJQ1YLWJX8hYPMyh6lD
z0cLF^a`t$5)`GKmZmrS^o;zzn5uy%e6=F3YHHP1z$d%PYv@B~y7IqeDI2q<N<jTSh
zm9i;M?vcVi@Y@mBVbqQN1oiw|zJ6(v(sGn9&FMi<$WWA+Q9><ZGdy}yxio{@TT%O=
za2L1`m}o&=7=1Otm0^^%cO6Vdi8a8?G{m3${}qSTycMZcp%it<m!-TKxR{5Z-%kYI
z8~!U*`e72duT0Pc!=LD9S(^GMHUC@q|1D-V)D)Dp8o9NBPX1e7!Emz>ryg-CfWtb(
z{%`Si4Ew*t@xx^6=ezv3oc<ZQg40ZuwCul@FdHgM$qXZc+q6h=*jv!T_24(mwGDRG
z>WpX1#8>o<q0$ksHNq!_&_l5cc_`?j5wTd`{_m*_l|~}1MovMD>$UJ6#`+zjCdNni
z0tZgRR)rdg9$AGjjBh64CU|ZOdL%0YbN%1K3<dqN(z6tTwF;)wvtH%MU*y(+e3*@K
ztOl4_+%17i8_JM%Vf|ud0B!)x;!H-!6)>B@(^(&4+-4}}DcSzr3U}6DXW?6q^47sz
zf}hWq{;fm|e+&yv9HVn!G7i-<mo)scxv-oWk5~d;z*>NfGOZ{bOM&qjhS3z-APE=7
zc|?C7w?i5Xo6WqW4WJX&Qln8PmQFLqPR6U)ILc}vT5Txu+tH;JyzHMiX4nbl9IW9i
zj@cj|Vz^?IGaEm~Q3M4u+$B+t2~>W@w;260`osz}n*m4?F7P>1*m{25Re)t_IQqa{
z(w)*P(o0g6tl$QH4JV5X+>2x3#aTyo<s3Oz&Xe=yUU-n8kK9)-z=N~>@u<K++!Q=W
z-dP?j?;;P8ca?|AyUDxD!{p)e9ypmaLLMpaC6AK#miLiI%Z2j3a!3x#5nRU@gYx)X
zxfstAluCQZW%7RV7<qsB0BGM1lJ=Cxg8OWj%jF8GTdtJjazgf`5%M^BJaniN<w^2n
zd5Sz$o+eL64|@&Rcv*T?o*~baXUVhWIr3b2o_sK#%32^FA|EO*ln;{^$%o5Hd9hq2
zSIa4RiCiPs%4vD2yiBf>>*WTy5vzu{AVhAFTje%sFL}AVLS8A2l2_qf-y@|z<fG)H
z<zwVy<u&qg^6~Ns@`-q;{bczR`Ba=LK3&>dK0`iJK1)7ZK1V)RK2JVhzCgZEzDT}U
zzC^xMzD&MczCylIzDmAYzDB-QzD~YgUMt@q-w56O&GIest@3U1?YOJsPH7+cE@{1d
zw|tL$uk@z$y7Y#8pM1akfc&8Jm;8|Yu>1(#4SY;qCqFJfAwMZUB|j}cBR`9~h@Y2V
zz?IT3$uG;V$gj$;$*;?A$m``d<+tRw<#*(F<@e<G<qzZ!<#zca`D6JL`BQm=j2G?X
zjq(@rCV8{`rTmrrwfv3zt-MA4PX1o*kVeZt$Xn$f@kB|X{ImRv{2%#O`8T;!{vEeM
z|0(S&|0Vw|Z<DvnU2-=FY?C5mUKmnTTvwz+2Vp9fVnYg8qBx4H<S4mHo|3QhQhF<W
zl)g%V(ogBH3{VCtJ1K*dopDuh1ik8R={($H{jT(u^tLiY*;N^;?56Cl3{!?HdqBxP
zLSfg;k5cwl_EAPFh04B4NC_(uC91@fBBdBF50olp%6`fiWq;)W<v`^iWh`!~u23qK
zxROvjWt=iznV?LR?vbLn9C@-bMVYEhQ>IHXWrkFw%v5G6vz0l@TxFheurgm+pd6wc
zsw~88_b_FV^tbe-a=4OI7AsXswUSbnC^bs0RHCGnrOGm;PN`QKlt!gVIYMbxT9j6)
zRB4kwklvHtmui*e$_izrvPxO49H|_o9IYIq9ILERj#G|TPEbx%PJ$Ba6y;RqH05;V
z4CPGaEahzF9H~q>S2<7GPdQ(?K)F!4NV!<KL>i-93Qf=D$`#6$(*DX-()Y^M(mLfD
z<yz%B<$7hUa)WXs)`o6YZc%PkZc}bo?tqTxF6D0J9_3!?0OdaAe(7uF0p&ql-2brh
zi1MiN7~>tvI^}WY3FS%UDdlP98EKjFtn!@lyz&B`TzE;UQ(jhHQC?MEla?y4D{m<4
zl{b~Qqz2_}<sIc+sa|<cd0+WJ`4G=wv@0JeA1j|IpDG)a&y>%Vjmj6wCS|korSg^X
zwepSft+GY=PWfKxP<~LhDnBYeDL*T}DF0D@Ren=CmEV;=ls~0}@|W_rvJE$hbt&D_
zR>{M4$TE0Xm#V0+sG6#)hBQu=Ra3Q8TXj@d%~5mJJT+hKrS@ivUuuEcPZ}?^;9;yI
zz*C#m0qQ_?Cv}jzvpQJaMIEB<st(1q-@B{B)ZywL>YnNdb)>qNI!fJJ-A5g*7OMNI
zAvG*bP$PKcB8Huk#cGLKs+Otysbi#x>i+5h>VeXq>OtyQwOp-GE7iD~kS3{~I!+z0
zPEaSRlhn!T6m_aPO`WdJP-m*M)Y<ABb*?%OBj1PW!O{wKzPdm?L_Jhpi1DOVTCN@j
zrQYFcQeCW8snu#qU82^gwQ5>jsxDLO)Oxi+ZIq^{O)B0DRa?|nwM|_vO;uN@E7eu%
zYV}C<DD`Od7>p8|)nnB)>T&Av>Iv$J>PhO!>M81}>S^lf>KW>p>RIa9>N)DU>Urw<
z>ILeB>P70s>Lu!>>SgNX(scC-^-A?B^=kDR^;*c<E7j}N>(#aD4eE{RP3q0+E$Xf6
zZR+jn9qOIxUFzK!SB`=v>^k)xj6<uWBh`D=`_%i@2h<1Eht!AFN7P5v$JBM|<LVRY
zlj>9I)9N$ov+8r|^Xd!gi|R}2%jzrYtLkg&>*^codi729E%j~n9ra!HJ@tL{1NB3-
zUHwS?Sh^RlSbQqYQa7ldsh_JG)i0#k>LzuwG)MhX{Yw2>{YL#(-J*V{ey?_@Kd4*P
zAJw1KpVeQ~|ERyJze#h|PW5;75A{!JoAj0X7gor&soT{qwOf-kSvpNqG*z0XX_~GX
znyFcutvQ;j<!HHDo|dom!c$Crw7yz_)(<Oy1MouQPTC-CXKgT^t2j>EMH`~+stuKn
zm5!0tXuIJB)?wOkZ4YfvZG<*b+e;gz?XB&jjmATn`)VOAtVOh_7SoEfVy#3g)ylN}
zv@zQLc&h3^?I3NeR<2cOm0Da&Xr4As8;_@eCu)<l$=Vccsy0oVuFcS9YO}Q2+8k}J
zHcvYk+hXQx3$#O^8$DE8s2!#)(hk>>+G4FrIz+41QrZ%&Mmkh_Osmz>QirxwTc*`%
z^;(10s5NOv;O)K^tyOEon&%2_rM602tsSWyB`wsB){fDR)z)aoL09~Zc7k@Ic9Qgi
zhMTyxQ?=8y)3r0SGqtm{v$b=ybG7rd^R)}K3$=^1i?vI%OSQ|i%e5=CE48b%tF>#i
zYqjgN>$SDo4cd)(`}Ah*7VTE;Htlxp4((3uF70mZ9_?Q3KJ9+(0qsHUA?;y2g!8EO
zn6^%PTzf)$QhQ2!T6;!&R(no+UVA}%QF}>yS$jo$ReMc)U3)`Yuf3_gC4Hy8t-YhY
ztG%bauYI6>sI_Y!X&-B!XrF2uw9mB9wT;>r+9qwY_NDff_O<qn_N}%>`%e2_>(GAC
zwrW3WKWRT}zi9u_e${@{I<?=mKeRu!zqG%#ZQ6FNOY7DpUDg#{)iqt$4c*i&-PRr5
z)pPV*Jx|Zqd+ELPK3MK7(EI8A^#S@oeJ6bo9<3Uz@1hUUch!gLyXm{@!}Q_$9{Qg8
z2z{i!mvn_bO5a=GM<1;h>ig;;J*-Fcs2<ac^kTh4FV)NR{q!+-*6jfOK>Z+ntX{5H
z;8mx%p3psgoIYNkpik5%;W@S``c!?IJ{=Fy&D3Y<v-LUpTz#H?us&a3pdX?isxQ<J
z(--N7>q&jFUZq#-DSe4vqu1(beW|`ouhZ-G2E9>l!mZiOdW+twx9Q9E75YkjmA+a(
zQa?&RT0cfVR$rqZrysAMpr5Fpq@S#xqMxdtrk}2#p`WRrrJt>zqo1pvr=PE1pkJt8
zq+blJ_=(cR(n-=y`X&0M`epj%cs%<`{VM%x{TlsR{W|@6eXV|jexrVqezSgyeye_)
ze!G5$ey4ty^t*nyeh)O-1yVo#UTDY%NCWlzu#saB^!S7I`}GI(2la>ahxJGFNA<__
zb^7D_6L`AsDg9~v89ZY0oc_H2g8riZlK!&(ivFtpn*O@}hQ3~ZQ-4c;TYpD?SAS1`
zU;jY=P;b{i(m&Qe(LdEU=%4AI>l^hi^iBF^{Y(8T{cHUj{abyD{+<54-l6}XZ`FU)
zf6{-}f6@P=|Em9{cj~|Ef9QYee@V9fx1{OYq_z5XX?ML#$Gtze!%~J$J4ZSYxBHC6
ztvrWGhfBi@&Cm_QF!8veZLrmWC!{{uxBIPh5LQ|5GhFF@BS$*L$Tjkee504q+vsET
zH42P=Mt@^~G0@n_7-Z~h3^sO=9+Do$8ikJK^#}2Y;q%52V^?FSv752GG0Yfl>|yL_
zjDS`+A3H2=H};ZtF-94C<7(^YjD3vJ(v#9t(yh{M*nYX2bfI(+<|k}3_K(s}(j(FZ
z(#=xRC^YspLPpq#7*Qi;6dA=viBXCN_V&Y`jSA^_=~>KGa*Z)q&p5-_-#9=z(>TyL
z$QX+kvnr$$q^qQ>jY{aDPc;(QWOcrDsdSlixpbv;qv1)98sm)d#snP4pJYrnrWjL=
zX~uM8hB4EaWz06_7;}wz#=*vXV}Wsqaj3D-ILugN9Bw3y#YUA;ZKRAPMvYNxq>ZJ<
zGNaC@HyVsaqschJXf|4mR-?^WZmcj?8mo-e#*xNR#?i(x#<9j4<2d7Z;{@YG<0Ru`
z;}qjm<22)R;|$|W<1FKB;~e8$<2>Vh;{xMC<09i?;}YXi<1*uN;|k+S<0|87;~L{y
z<2vJdV=c}H-Duoo+-%$;J#O4;+-BTv++o~l+-2Nt++*Bp+-KZxJYYO%JY+m<JYqa*
zJZ7vj9ygvao;02^o;IE_o;98`o;O}FUNl}ZUN&AaUNv4bUN_z_)*EjcZy9eJ?-=hI
z?-}nK9~d7R?Z!vO$Hphpug0gw2IDj7H>uP3+}LP*VQexs8($h<8DAUU7~dLOjPH!^
zv6l3r(P8{xY&Cu~elmWR&XPWtDve*HvyJ~q?b1im$I>UpuhOT|2I&iI3H?mkXmlFC
z8-Eyo8h;so8{3TSl4^7r-KJ#9redn5X6o37ZJL&8n~v$4IcBbzXXcx|%-&`nv#(iT
z_A~qAj*o%nPUawUXLGQ*i#f#H)f{T>X6|kdGl!ddn0uNd%#r3^<|uP-b02fGS!nKS
zhRm=TF{5V8EHaDD60_7SGxsycnERUtm<O5%nPbgzv%;)2<7UG2%yH&;bAmb1oMcWm
zr<haCY36iuhB?!mWzII|m~+i}=E3HCTrYBnd8oP2Jj`5V9&RSh#b%XRZKlj6W{p{E
zrp=}1GPBOCHyg}Gv&lTdY&KiWR<q4qZmuv_nybv!=8@)6=F#Rc=CS4)^EmT(^91um
z^Ca_R^Az(`^EC5x^9=J$^DOgh^BnVB^E~r>^8)ii^CI(N^Aht?^D^^t^9u7y^D6Ud
z^BVJ7^E&f-bFF!Ud82ugd9!(od8>JwdAoUsd8c`odAE6wd9Qh&dB6F9`Jnlb`LOwj
z`KbArxz2pte8POve9C;<e8zm%e9nB{e8GIte93&-e8qg#e9e5_e8XICzG=Q?zHPo^
zzH7c`zHfeDerUFvADJJUpO~MT8_dtl&&`eI7v?5&v-zd@mHD;#jrpy)#r)3v-s~`c
zFt?gNnm?I8o4=U<F@H6GGds=S%|FaP&A-gQ&28p(v&-zp!kla=mTGC1ZW)$oS(c3}
z99%2M%C+*We5;q$+v;QWwF<0$R)1@NHPG708f5Kk4Yqc%hFH5=L#^Gc-K}BPaBB~1
zPiurV(%Q=!W$kV4V~w^7t$nSK6}BQ))QVX}R<TuLm0D%ie%2Ukf9nA2K<glDtW|DR
zSd~`XN?4vX&Khq`uqIlQtjX3CYpONPnr_XoW?HkX+14Cut~Jj(*qU!Gunw^fwH8{3
zS&OX0t)#Wss<NuBl(odFv1+ZfwbWW>)mimcgVks?Sw~pSR*ThYwOPxp71l~?m9^SB
z(mKjI+B(KM)>>m7XB}^yV4Y~4WSwlCVx4N8W}R-GVV!B6Wu0xEW1VZAXPs|dU|nck
zWL<1sVqI!oW?gPwVO?omWnFDuV_j=qXI*ctwQjI(v~IF)wr;U*wQjR+x9+g+wC=L*
zw(ha+weGX-w;r$_v>vh^wjQw_wH~w9S&v&!SWj9{Sx;NfSkGF|S<hQ9ST9;HSub0!
zSg%^IS+84fSnI7ft+%YVt#_<<t@o_=tq-gZt#<1p>tpK^>r-ok^_lg#wbA;*+GK6E
zzO=rwzP7%xzO}Yk-&x;V9o7%lR_jOWC+lbH7wbRPuhwr?r}ew_hxMoRm-V-`&Dw5t
zS>3i|%eG>xwr1<LVVkyP<5~~fwR3QLN1mN;_p*E2eeAw=f!)vUZx65s+B?~U?49kw
z_Ad4idslm?y_>zeJ<J|%?_uw0kC3+5BkjHHQTE>UKK5w4(B9V$*<m|kN9~whWEa~d
zcBx%v?`My(_qPwQ53~=m$J*s~g<WaK?S$>w<LvSF1bd=A$)0Rav8US8?CJIld!{|h
zo^8*u=i2k^gYEhD0{amAP<x?$n7zn8+)mny?JB$4PT5QB8oSm`+e__bcAZ^sH`tAK
zlYNBUY`560cALH2USY4aSJ|uWBkiN?qwQntW9>EearW`{3HFKhN%qP1DfX%MY4+*%
z8TOg>S@zlXIrh2sdG`7C1@?vZMfSz^CHAHEW%lLv750_(Rrb~PHTJdkb@ui4TKfk3
zM*AlFX8RWVR{J*lcKZ(dPWvwVZu=hlUi&`#e)|FYLHi;5VfzvLQTs7_o&C7|g#D!b
zl>M~*jQy<roc+B0g8icXlKry%iv6nnn*F-{hP~c?(|*f-+kVG>*M84_-~Pb<&~CRs
zvOl&zu|Ksp*q_;-+Z*jK>`nG&`%C*P`)m6f`&)a9{hj^2-C_S=Z?%84f3knJf3g2#
z|7!ncciO+(f7pN8f7yTA+wAQ&j-fb`BRh(tI+~+9hGXLX7Ta+g*U52mojfPs>E-lx
z`Z#@^0;iwT-x=TxbarwEIXgRpon4$E&aTc-XE(gIGt3$8?BVR`jBrLedpV<=y`6oW
z(N3YWuM={@PQ-~iF{j8Wc1oO5r_9;U8RP8l9N--29OR63%AE?Q(uq3>$8*Lx<DCi4
zL}!vS*_q-@b*4Gfof*zdXO=VDnd8iL<~avD^PL6GA<m)BLgz4Nk#o3{bQU{RPPLPA
zmN+#|t&?_^I?J3or`~CB8l5KR2&dU;aax@=XSuV&S?R2DRy#*JM>$73$2iA2Yn<bp
z<DC<n6P=TslbutXQ=QYC)15P%Go7=Xvz>FCbDi^?^PLNv3!RIci=9iHOP$M{%bhEn
zE1j#HtDS3{Yn|(y>z%dE4bF|uP0r2EEzYgZZO-k^9nPK3UC!OkJ<h$(ea`*P1I~la
zL(ap_BhI7FW6nC~apwu=N#`l&Y3CW|S?4+DdFKV^Mdu~wW#<*=Rp&M5b>|Idz4NB?
zmh-mrj`Obbp7Xx*f%Bo$?tJ8Y?0n*U>TGa6b3S)AI$t=OoXyUc&R5RY&Nt4t&KBo8
z=X<Ba`N7%h{OJ7T{OtVV{Kxs#`OWEces}(G{&fCw{&u!G+np|_+m&3|Rb188T-`NX
z)3sdNbzIlYadX`~H{b2$_ICTYecb}LpWELZ;0|<gKFr<O9qjJn4smyNhq}ADySu~O
z;qD&pp6&>Dq`Q|p%H7-D#~tk!y8F5zH|$2-s2g*O++w%HEp^M>{oFC`{_X+pf$l->
zShw7*a4X%on{YjMoIBo~;7)WWxs%-~?o@Z0JKde(&U9zFv)wuFTz8&(ush#f;2z>0
z>MnE-a~HXXyGeJkTjf@}DR+rm<JP)qcd5I~t#j+$2Di~|a*uGE-4?giZF85qE8Lat
zDtEPeq<fTmw0n$uth>fN&OP2e!6|P}H`FAn+FDaCw>H)^Hl&uB<@L#`=Eer2d~tJX
zdCDv&=eCA)C|nsgxfxFgGZEruB;=bB0Y{3N8BPfIaH5?1!{q)jW5U0j!j+d2Tux>s
znLM9xqJrXAQ2YvtUs0@=*EQ899sX@?Y-nuZ5xtN|&<m9jEE4uY6$Fb6yb!NY*b9k_
zypSjSD=2;i#joJ;Ly;(@Q^C^-#loWEvAA!F0(zwszm(#aQoK^izm)PXrTj}N|588y
zN@H@eesOh@6(<x<M9lI8Zz>MQ;#B_-;Unb39G{^`EGpuahDG>rM5{=(QevegZe>-v
zxvH&xNnL8CQ(4{EnyjiyHMFv@Xfs}PR8>?lTq@Fxdb}#3aA~;_uS$YKD7dIuB1BC_
zm`n)FgcIS29$%bn76l1=5i7o$$6jP6h|m(8(40iJ90@^lMk13>C?cu|ld2dI7*2$#
z>R}?Ku<uUg3RAhLMH8YWK~laukys^>SS6vflG3g8QCh4gTHBf%%tTX5x~{Pyhs*%c
zQPy6V8a*tE;DxEtsVH8U8oiQ;q*7ou7A_L4MZGB&qSlLxB81C043t7E!iu7e17dlU
za9PwH7iiOQSzL1ZiA0QXSzLxas#_$ajw=isESbWv%|n(&3&XjAqzc2<INm;m;hb!$
ze&|Sq`SX;0Cod*!pxIC%6*yArj?b2kmpBq8yhjM%5x-2-j*)V0ykEUoWr@Iy;2)uw
zk1@eVaB*<4nrKa0_ywASD8!3Ub3~{)BGeoa>Vpw#jtKR^2=&2A3STKYLd<WrGHSLm
zO1F%{l~KB7lx`WNTSn=Y`RP_#6AG&v+psT-)e4B>0Yc$2UQ580#)Q^%U3JQwKwV^l
z;KdVq@M4}EIs`8cOi_#kQB|U{T$_NNZL`m~=2U7Kw{iUBFt_S-syWq?CWaZMN=2zs
zKBE&{AnZk{Qc<c@lqwaaO2sLDoZ`m`DRDv`b=z2|M4eC=b|?6`XNV=?6Hr-6#;p?6
zHKC?Cxje-zod1D3CuB*9Ide=Q3gL=55y7Iud`JW7PRMi!KbuOAY(QYfRxWH|ATeX}
z-Mpyp=0(fM*NbL-D>7~<HtS44T0CQ;>cNfj4SVrSdhtwp@l1MgN-q=(6^m4018Urf
z+3Jg)6cYpxEfE9}BZ3G=iESiA(<GwA;iA;zqP)k2Vq$O(#RMIL3`_M%$)=_xMj$2}
z@Jzzd3S)AHgM<?zZJ2)AM0|owFnDk>fxzJV3vx-ss0=Y)26W`OGNp~@5cPNx7*Z>Z
zsez1RMaI-j#^~vkV2s#BjM#-hLO2mC*QeGtHZD^W4K+O7nBdAlo+wgGaOY4AV=Ci#
zu>_$(4AG%zNwG3j6e(O;p--!A1kayF{cswmtlVj}ZIGOr+v@9*ZLI=7aT?$fq86Ya
z?j8}tB6_Fj;}OAxLJ`4yV3NDvI5E-B5-~zp5h1LI8m*H2E6HC79^pis{C&wlj2Unz
zd{KW)#3{az;BdbTrJsnn(^~41Ewuvm)9TYq2+Scfz*Py+UW__=j5>OZxF1!(ixHy`
z4Hk;hnB$Qc5fl6$=r7i$W%#@xRX7qk6;Ue}2~v&;F)0)-kEt_j8ySYfUZT>Pv8cI~
zHM%h~KsZIk#>_0?L`YJLgb7hagqR{fD?&^WM{ESw?kF=?iZ+Z@8nbx9?yMdAo-b__
z6B>&t^<pY`F_C96&kaN<hWKzfv3fB!gd*W`V>T}=AB6$>LuWA+ub7HgOzmF6GXy3o
za~KuFEL@yyNtv?+CPcxb33Ya|O`pSP*q9@RlsQDob2usMbJ!#xcTNw2o)a8q;v`DO
zspN4n6o&<)4~2=rM}!=Pnox~P2ooiQi4xzP@Loa{6WtGlNd7*z@<~8+B=}RsJyG$9
z&j3mYF(nCiUbc0Nd3@L~=J9s3=lR18Cz*s0X~PMU(i0?|CxlcUiiv4PDCSkFm9=S(
z%Wy^1ou5sg@Jn?pO&Ifeej<5ayz;0@)CD5w({o68B$M~6d;)ru(JP|<RYd)&i273z
z4Y-6SFG1l5UtXfZoKNEO0$zD%L1yd|#VaFPEu+$x@fHFrifIeb6SW02Q;1ZScm^ID
zVzWTj(-P$(>qG?+Zv}~W6`VvMQWJ^zys4bSh$o7k@QJ=$6gg2YWP=FFx#74Nz#<V!
zzuf1klux-J#YiY>CIuCn$t<ac6J_NN_PhIYT5b(`hr)W2OYofS3x*qt5#x^ebe=%s
zsVp0b#f#J=WQrtrVisSxAe7Ju52R#l;fxK!G?xT`8ezkT2uUC}nWZE@L^*|E=*qZd
z(k%BS1R#x40@@%AWW+c>{dh*MiDY9_i7=6b%}SC;C5l!~g~S-eY=l{66UY+@GwgyV
zail_?%HrAgW~H%`B#dc`eU=_BrAEU`NE~BmJYf=Xgaki{kmL|9Ep@B1*m0_MAYL({
z$8f@lHx!G7&FUb_!x2B$ykY9fkx1C6&Wr+>+=||mpm~3S=KHv1O_VAuN((WKCleu(
z3s)BF)vFq7YPIS{k}D#y5;H}-G{tGcNoC8LqAr-q<PG$S?h)~8O!Jb2nD(J*i0o<l
zn4oE6g616w(nTbM?g8D6x>W^r%Sx(4C1JRdFzipBq9Xs85Gg{jBGJ8K@e)17`bEy7
zret$#;gUscAW@g#x~L_EX&pbmiNhc*V@ax^rZB8y23*tPws51hxp7%4kK3~t;Ef#i
zG!|aqvN)vGfGpgaK=ao0h!6@#qDD;?Wnqu15D9BFg)LPMYuZS02v*Tt0)?oG;3P32
zB_RmsyfBFx%8K+_Rz;V8>$tGsa61zlB3dmgS8cXjqQGH7Y=jUR@k>JuMH9(HnaC|x
zQIU`8)TLTl(mm&Qo{<)VFGorw&W3DE^Wue7RrO6;n)Q`5ky4tIk{Ht?9uHuqvs?`0
zEscNF5h6ZCizzYW&I*xwWrc{$Q5G$6mr~LEjv0xS@myeL1IBzos|XwWmTGArI)5ny
z!IqZRWV()rbF#3zbO($<kH#?<rS20GLKc`F=lGafkQt?Rp}{K=CDM%&rlUprGS*(k
zG9lHlN`%YG?YjDOwZLRuu+t0S2(yluR)=aDI0=-UxKtW-8H&P$h1!nhxe1!zCZchp
zuCS#g6mjdg7|iXW8Nm3MM_wlLtY4(Kk^?r&mfKvBcQ!~kDuTG86d4azlps(R1S*0+
zoC6%Ou}V)vF*)^zA|+wHo_AdStxmN-iB~N;22INoV2_;Epb%^j7*jL-F<N9b)GgtC
zfhQg=OBf9S%*Be0h79H~^P*8ZM!f+1PbBTTi#`~xtkfD%M7@#EoN&I1Ym*x}UFSCT
z5HxwSikS<BCW@cnYz^$vH+`u<_(z1g2I302`?Nz7jzo-ltzd8Agg@{I-8DK0`HO)c
zGbExpA>ab0dXXk0Ap~5w6T1~s3ItL@Z6fM624+r;G;<;|ICBzmmq%^li8(NoaiRbo
zNwgjz*ejtqLrGL?^m}bg=v^>FD$yHLJ|)CTM8Ap&^)Y4x)J8?VDf(MXOus`BO!<$X
z4%8g%NU^xy%=sk$3ZI<jCFz!0#wQ^OazcreB&=p4H={W~F-0XtbCzN-hZ4cXpo*3t
zN+FRpK_YFU$kUoxRUo@9XJ$*VNKwyd;aRvXJ8+wbKTsA^OB7Q}7E`SS_YWtE2|EHC
zz)opSO{y6O|Ed?)wLq8=<6bKt_e4*CWZEhU(ThB*+M4UK0V1SZiIkV>tqfsWtKUN5
z;;7LYL;@#U6v8)&jEad2OQ`T=B`R)c<kP=!M#e*8kg7y-<cViq{PDOrYs-j?#lCte
zQ9?o=BsU0xMjPjwdK>SRtmB19T#v9d3hJe8yqD^2d{Wrfv#<6Tgv68~>}#flmH~qk
zpVYzRlQK*Oc}u{gK81VmIL|1d7Ao=Gi84wENeS{#kiS1p2p)mHM@UQ%61}k621K=S
zLh%t*3YpmwHS!S~hjKc%ElWo}CQC?EW+jGD-R4ilGVy#>U82O7mQmM?FDd*`Z&KBv
zgh<C~>mg_-kcr9h?`NCHNcCQ(u@ad^O=KE1fkw^m(HxXD5X)?$_54&zcnZGoZt})t
zg(2BoNc|<5tV>W*eK{jyY8%3BiD$3y@u08ZTwz5PbH)lW!CsN+{+LcvYtf=tf)wQm
zTJ%bY#V*L~MQT-MT1}JBnCGs_rp|j|#FqwWQ7lnbW~>TMvx!JN%GTE`(c)K3XmY?R
zIgwyCFW6Dci|VWV>cW@n72qpGml!4%5cJtfsJ05sNL%f9?1&Kmu(%d7R}1D~tmd_M
zR%7%JE}{7gHDyHZ5I@Hy>+6%eTG6tYKD!okY~|pzGCi%&O4rmU)#<fqb$W}?HAHEG
z?0FT=wE9#{a8W}jlCa<*dW=W<A&=OLM|vW!ShS)?`XZ0mjVH9MVUJc^JwK~*p^ovy
zoE-i_t>V$#-76RB7msuRo>ys++CogkqBM+0X&xPo#|&O)LOP8FF`;|_x&^0*k=iIG
z)J9N3lPn!BffBlERWnCfOf0EDUCa>*9kGxFVnWFTwHh_Ckkmslv6uwYm&^r~#e`-7
z3Lf8`hFDtOjR|2I@yOkuUy#-|CM16N3;q@(Av`A5Uf|BL4wHzAWRw`GSYl$m8|9_)
zh*m&(C_Un%F<MuT3FR5WNAx6L=jPvlOhF6mo=~Ac{uVkNk7n5(Eev~N?g@WhahRgd
zctVW`tvbmjV!;?Nr6XqVfO&yoiazI&2F;@`@6iIiM=BwY7V14x4SBR+?+L_*y^0cT
zF}i?W!@7lDovOp)bc%FiWb#_(5>Qpw*pkAQHxVT4`WA>Jy#sa;EI;7F<QC4?JX(;(
zy`ltD6-herXd&67>9|)C(N?2~Dt;Dz0i;I=SrJN!mM}e<CwjD$>Ct@Aqumf5>9ssk
ziF%}n^N3w|q>%H7ZFqueAb1nfMc)8SjYmt>9!>Z?TC(=Ul6BatEYVvTqtVh}Prcd4
z=jXgKHgn;&oS>h;4y{LcBwc&7Xyg%3_Qc{5^dwX^S`hMRe&vz6*Q50bkECsn)+sz%
zpYY-(n60sm4$8{3+MLnp6S)aF0NNhWKcbZpy@j*O)?}O6CWxVc%pP^i-@!45;6N+V
z%8Ezx1dmo&Jen_fwD#bU4DE@jF;o(M*CCEcD<~e#2RyN^gmnq(YKaoHsWxrlSHo6e
zRg_w9WL(|h-$03I5y2yQ)}zG)kK|g978N{_Z#`OE@JP<}NEPnUZW~YNPr=KH(uFb$
zFkzQw2_Egj@kl@G3Edj5=oQ14msz@@8hIrK@3+L-1&M@Wf<#~vlNMwRR!_{@UvDJY
zIVQ*$;W<KK64Mpp0$>^<1X*KfpmfB#I@T@y{K=hmY83fQmo$nop^ip+#GFZ|7ZcUT
zphEeI^?rn-!Ngyq6!S9FgW?OG1~G;P5uuR>O!W}zaWHk7cF_84Ostq895H*bat4^n
z?~6yGxuMje_+o_$;V6HxGzgf=DcA$>LHP^91x)ct&W{OwAtWBcn-IdGK;n3Y8P^hR
z&3si20FMl_)M!ezfQc}+0FcMUUIShhm}OdBy4m;S4Ua&azTn9b1UQmg)d)=?=1|S4
zhN@MR6z3cW#i<h}A2VU{YQgmV{o--7!JRi3QWaxtLNpg(fsQb3%?ejkI;&I7jfH$}
zZb6`9YLu|qT8mx?QF%#Y8z!A_v0BnAxy5cs`+<1G)+Gju1*3IEBMeJKZCzsWxXesr
zX9E0L3h-~iN=XB=q}Zi7u$Vl>)+M==o+yheQssF%R2&4(p;WoME0W~)97=@)R#hWL
zOa!-^QqAecYL*>GE-V7eg;h}Bvh-ST$&T-p1J!P-p)R$A6)Tqm%~Z&o#hAjUd@m08
zUU>{!mV!!?$IB<s_wJodl=AEoNST~^XOs5>1@a)LzQK&ht)NG4<Y?EfYO3W(&LbOn
zm`v@8x;bF7NnCxz5Wt*LN3<pD0OXUq4_m&)ZD?%u?PgP58%xBhPd9LjTi;gKnr^CF
z1xLF&y*ypbG0TGaLGrLwqPcOUpG0mFY6_w4MI1NTg0iGrmch=8<2R0993SqTEvsMs
z9t9@HT#*eyy)s27ha6shKddOBA2w4Ha>%3V5ZF6gCvxc<tQfiV3Dl09dS$9e4pvJO
z=m{0(+WJs=h^*KoS_-S^{IPO7wXzB$KU6T}LJUW6QEd04ZZ5cXBoQv<ltk3H=!mv-
zU0t6bi3q2>o-~=i13~uMk<k1^1x>RmaH1Fefq|Up(T1!?GuTWD(^-<PX=_eZW6Ol7
zK)A?hY)UmOZmX+HwNjm;d9ApBtD&YY)x()MnPBLVqVjS#K+G<bxJZ;|mY>ap!)~fR
z<L8PbMYwFv9A=7ZpfJjTzCFtj3{V*aupEK<@u(;g2Xc>SL+@ZKz|9c9dvORY<~!(3
z&FT7-EB3N+yQsGq>9OEdVsTf5&kF=%Aj;HKm-2mCv`~Zw%t%Ff4md7fuSiy>njOK!
zIPzJ&pnS8FjP&bLX+H8`&rZVT{hwFB=Ku`I>)Ee*|D#hm*&dbKqdVD|zT{*(Qf`l4
z<OaG>UeEs1Ysb!$zeCRfpCHb_ifOck@t%Yj_`*V2hK(vA6?Nno#r7);RY#!WjHTR2
z7dEujHyaJyAd0K7QuR%(t1x04$-)*$y~bi;R0*S67#Iwh-x6V9ZH+;-!oaEzgO&<o
znJ}>Gz#Qv^0R=yUFt{?KNf<{61EVT)Y!L=lMHtj345)V*v_cpdb{PaU3o}-8!xm#U
z9P%@^;1CXvTt1e=A_hb@II{$3C}q}sF{&~v4?}}Jz&tVRXFb>m&cX>P0G3=X4)_5a
zF{bnM#i-7#Bq_j_Cu9acc!2w`a6#_F;2zwEIrQW{JZVmL%tmC#t%69ImAC3*(W)?5
ztHNNd3WHSz25VIqtW{yKR)xV@6$Wcn7_3!cuvUe^S``LsRTvDNFj%X?V66&+wJHqO
zsxVlq!eFfmgS9FQ)~YaAtHNNd3WK%k;ugPE7iU^^F;ZgN&4gfvAk?bNoe5>4RTpPl
z6;b_Gr7(W0F3z-S#zVB~V!u_9x@c7jkZDz<@3$%nNo|SrGB#eA9<7RU1jZCrxgA<{
z@jqG>NmHvLKfz2`JYqdr{8TqI)(fg<wg7$@$nhiGef%(psGeB~KbbHBKMWL9AMjxK
zVIZe^X5skB1R(q{nDE1_0zb?q@RJEHYR5y1+HtF(Sspw)CNnUIKL)!b$?{l2yyd~N
zR@Ms9{GM=$pee=y1<sf)fHMYioC$XyXAB~oF)QIL6Gq^SfdXd%4~8=aa-1;>$5|!-
z;f%qAGiDVyV>W@aOmKlS9$MgxTLsQ|@GQ<47{nQaeVp-F0x>*T)*8ea^I|ZcAYzGw
z1{$HK2Q21oVKH$8EM{I|q45Ch#}gu1SWHaeE@o!oqL2-i%sWzT4)3JG-r}+e64@~w
z!R&|tF{la63(}z(pim@WC!v^JhJ~^cJ2$C3p-^73x*D6-ThM2grm9+Xt~`MxD|WIM
z^1O4QHHK`Mt`aNGzGp_y62b-GHrLw&S&MDHpulWg28og;IU0)De7%JESP(@Pr|KG4
zV1k9o7q?bX1jx5y<fYL&M92*Z%`AjonlTH_EZ`_ml*aODJ(rX7Fh6N#B9;Jiz^9<I
z6M#sVS`E@O!6YaPoih^T>H{pc7Wb-7LB2_`qdd?xL3GL&4oleFuQru#%@OdjRNeA4
zU+saAAz~L*ChSy8D|Vr@rmF2^b93VgHtFLzmUu-Fqn5Nz#+ILQ<`cp8FBlL617S+B
z_YRI+P^M_b`5el|%k|?0Ly78yg>n;Xx<qVZ@d$94D9+->Rv~DYcqN(q1CHg`n}+<`
znndvG#ucK5W#OoBX=|#cIt#@JHrbZv@i=^X%SA^fUZT2O_U+rV&fKlHUx6K?lydKU
z?wy@0a9O&<E9RaBJ0OEQ_VE+^M<ndZVe%{YXVv5&C0N3NOksBP7P31J3v^~9VrPF4
z5IImVQAVe_p=R--s@hc5vK($*oUE&BY+Z@f@N}{U_~T|<6K~)m9GT*9v!IhAp<s#>
z2?bfCNNh+0ESj{qJmj(^K1_z#RlQ_iQJZeXIcD_ORQ2M<l_F)K+QZC9aE1!8X**I8
zj^<RSll6^k<sM0(=VyUMD}6tnr0>UpMJv^oHqrXU)G>>T!+LEBeNPap(5+%`ncy|W
z#Cs}y9wb(xacZf&FK!R6N;NJ?vm2JtXP}T4DM!VkOC(BZfQRt3qhfI-5*6zKk*HWS
zfk{1=6mX=uLO9_LJ|*Idbpz~>6nr~cnaINi1J)uafWMN7eF4PA#aawt!Fj@@j>Fjq
zo?KWc)gxhX1OTQ;wn8jhM2f_EDUeOmRI%{|`*DPVjuy`%F>2PBI9Uf+^yC;-2ixIz
zezdp+f5FycLU9LJ<Qo$w?;<fGmzY@A04(Yg6Z&7kqG@76&kI<P73psQQ~pAa3z+g3
zM<xJM{z4xNnDQ4prz0_;eupXW78B}sz*G(*k(f}w!(B8FUR4tHEH3RMrYuaZEfkbq
z-HT6FAbt1_BynWm-Wf%tAEFnRRRd9a3vo2yk|&fWnHWd3G3MRa;5+oeh`$(fc95p;
zl+l;*9#~D<C;?=(Q3CeWOagL5RhS6ND;gnI9Vsi#6JGwTn0uE;O9dZnYx46ZP6d|i
zyW}%Y3)bwzB81?oB3Ho~i7k>-mOJ_J3W8k9ceJr#j}5CB$*_@*Y}kcIHteS(TOwog
zGPZHP&Bf73-)@i3*d}Cb6En6+8QbKHZA!*AHDjBWu}#m|W@KzLGqzb7+w6>OPR2Gj
zW1E+;9h|Yv&)63Dwj4p0qS9RZObBrKEK9iO((Fn=LK#iLa=4z`kHe{x;?V4vATHcx
zG8IHCyn-Er(#duVa>#THf&(4HkCN#aevoX(AQ!)5_%SjagB*e#!;eC`Hv&b+ARyB*
z2&RtV2NknAsy$8Y1k`H@H0QiWQrKR8AMx?y>tFqx_&|>?LvWzW_#yl*(<21$GUO8M
zGQLxw%aBvgE<=t?3c&8`2%k0N`2gr26EEQxEe-;FgDUyNiUK}GfnbqvX~0KpclA@_
zn_{EAc}}!LHV`%zNCnf6tPkYDARvmt%Zu@j^;f^V7(6)u<sn-yVeWa^1ra|ObfoC{
z@ayfXHU&Q6(#LlZEQlw-oiZWvIhgepF?`)9Pqtqs5mKRY*S_4f1t(SN*jD?V1<1HC
zv}02&uSSUgaL5bgD9J1LCp8=t?GpzxgC7SXqVj&MP{s!bAb1m#PbkKH^0QX}1Vi#|
z&wfaevnWQTC{tddM=|oV2lxZ2RB#fYRKlW+`GJGvewncyK3G#hi4-j&ikX)^G#rRU
zNd^x1W<4u|Rfq;_E~uH($HCrgoLCTBv0$8-D2Bj+pioKxCwW-{dDD6zgqk8-26oyr
zkW*z4r->dp1%rtmML87(i&~UT8bVz#wc;Qy*?9?~3~WOU=2IL@tvHyP*w<c?H|L)<
z3debWqym*>)5G>h-Z{As0Ny!$fb$57lL#Wx3zn`VScVdTg}lt+y+AcegB2_dR--hC
zhf<MV-u!=51G^Q2NXD%N3`hCdvvPsV%0wM|2gsIlnvz~wiWClv6S4FBf)kbW4p3z<
z0O(SHf|hV}EZaah{l#f1vsWkM2b6MVB~Xe}av2}YN`mR(99K5IkidL?_8?WzGuuXB
z4I*di<0ADuJmEsh6^@_m5vM>Z71?ITDJD_I{Ork|K*%0tjs%Mt5yfO`YSxp|J+c)=
z!f}{vwQ#(J19Ucq15CM1gpOUB!9qnvR+(cOM2KQY@_}H4SP-9BNAuIgBq~VBv0xhz
z_2)JIqwMJTSwypw3xV`1gIG`W$SD|141!eDqF_;rvPpvr1XC*x7PUB7)Z$?Eu*W=G
zz2acfP#y$)g838^m1cKJ`vF0v!S0Ct(gB}r_eQX6M+Fe<&)7Td#|bB}Gdc@kYjXe)
z_{q!cQV#f)21|~O;MrKEK@63O^zv5yqshP@g6M}%h$WGq-RT=h5_hIBPtp0=InV&e
z4s&v_SGGfE{dt!TfUHwzLEfze$OI*Jwu>LZ3M9{t<Owiy0*Qknyr6I5UOWZdT!Eqr
z7g1hzI3SQ9J5vw@GsVxgbk?7@bruZs-SL^&@b&o|m(W;?X9M##&w^sdd?qe$_n<G^
z)XshRsEVs`f<U&hah^9oW3eEO#exzNZhZ(OkO;;}1n3gG!UMr*kPs#C1eNoe@ryYE
z0fR$dES@DelrBqD*oc*-a{yV=1`v!xv`5)yX*q;F);!Z5TRXYSj(Z}x<4#yUWH%T2
zw9Yl+nNs6ElI&0pAd6FMWeoZRd6btB!SXWe@jN|$b%OPZtN_le$exGjDT|lnrl7D#
z=~_f|(r&Qm*nvQ*4F>fUOGQk>jZvvOQ+QvFFX<~b4zR6GZ0i6IfQ2KLEmNn8yfZte
zI4G3**qP!(EHFX6vr`6g=@UqdoOr`Th#va<U)T*aDG(ZvJ-o^QEl06OhE<fO8O41s
zSs)<#K^K=LQUF=f!961)fn2{FJO%8&paTjV?3?kVNk4K7p7Z3W?s=Y<$IJB>LO9eL
zs;$f>4el}k`dA??aN1&PC)~Xcf<a@8Rhx`c0bhZEJ9nw8;^BJnb5n3E{D(uE2(go2
z^2`E`AM{^*c8tSQ59XJNll9p#PG))NANgc`D9#|iY~nahFr$C-@?(k6eq0`_N_3Jz
z|Kdf6*@-Vs^@#L;`%q4trf81O2P;0|4-g-24C2io0!Fh`6$%HWo)Fdrv%zSNF9<dq
z5U4_Q@U?^uMLv+_BS<ok3eE9FDm2IU0Z|OjXESqr>K`;^{FnK3X=Xz2&!@94{sg}C
zpHuu&EXVPUMcD6%PEfkT6rW-Qr}(A+I>qNpb-09pFJIv3Y#3MOH8&>tS_7Obtb}02
zT+@sLiCl9H53Z38g=q&d#zdx31uW8wge#Q^6NOV{i8dJ>g@AHp+5~O3e^M!28nfnN
zvuz7jUzPbYt@^5DlfO)W!f<spq)@(a2~!j@B95g(aOP@u48VMK7baf@fSC{{$I39f
zF|nHo8@O7rzmc0Pb$fAg@hZMA+^TA6#ll2Yt<4X1Fi#C^VL2~s#J>=twAe|t)YdgN
zHf6kM$1~P_L{M=c0!M=dULxXP1n@!lqGLNnbnLJw9=B?!-jqNruLkQ^c<QmGwXq5K
z>D?2=fzusaP?lhn9Rk1?E+Xx4++E5}mw>S$;hbe`>9wH_hf32`wm8xNXT6Ty8o?uk
z%W+Vc?fVypR74_0F?KMZ4)<m>xctm55K4!*aY|RTR9I}bMz#3@2FQfB5d8T91X_?U
zP~iAGk%>6lj+UgBrBnA2|GpJE+m)aT>JoG@T|#Ws2ex@WFvS81$jLuG!3%0G7mY4z
zRpDt#c1{l4jH)zjTB*{|b*h+OB!mMjVki%5P3fkT$v!}rLnhH{d5PyaGZ~d&gHx)R
zCtH*#a`>5J?&NUPWPM|FO-D?uxIu|0FcBkyiP5cFF>!+f&SME$kBJjIfCXk^bSqbk
zj`q<KP>7a(VDcq1n3TSMjgvTa2Y22#V2X|!qg$C`;`B=><{#k}i`m$cF9<s(S^zM`
z6H9hDGC;6c62s91!60bq3ou{OVnQy*669MlDIVQA7855nfEPg#F^~MkN+kByQarKq
z1K|Xv#i)bDh=O9`gf@;M`1Pdnh$S%8o8tK=ti>rrxC=^+iBpHb1H}{PeQ}gSbl@0K
zWQ-_0CieaV4-}sE^wW|c>hIT=;`_G?iX}=WUJHES5+BAmV|0EfCe9BtA)DN(eByo)
z)SuE56c7A}{G)_lT6x7eBoQx4_>6j<zKmU!$5V|~R4NT^!YU3jV`Hi)aI}OXQbD7*
zbA_FM^Rw~IVuL3a)^HMv+~^7vkIspEbcEWYBh(%pq4ww+15aE904~p~3Q?1z0x&ND
zPTmPph|>LA@e0psW{==Pm=hLA&<=OuvZ2kbY>kp^7*j+zEXIg%d=W@k`3jH-$d+a(
z!4!BK%K{sAu?0xjTUTHcN=n39l3vofDu)Nbk#lVDsqQ6mMPB5P%N=l6MOzCvEW<I5
zK8u|<VSyRIyi>#EHHJy+-E__+EIK9JInl!8odYIse3-mb!4&JpVbOMgIp$z;%)#{8
zBIP64F$5vbB(Ncehc7P^hd^;zf(Q?;!^<5KY#LJ*-oh|LbgBX4c}`HKrr;vmkhrOY
z&2-4!PnP_}c{XgiretYXSBQ3Xg^G&uu#KBP{S3wnHf)K7uSJV;g{6Vr(UDx1izdL*
zaaAMQ0lb=z=mFMS8p*-pa;iC5#|FG*`9S~zJ}VpgNij}Nw6IsE*`DgWfE`KlAQ7>e
zABu?8ewd=mM(DIxgzlS*_+vlaI~SoV2Qc3f>Ck!O2%SHU_!lqw*NFJ{#nI{S2wfZ%
z@o#t{Rv95y5TT(Y;)_Yd8X|OHIYOt|B6K7%LM$OdEFnTHBodE_+lnyBuWBGGcHH<@
z?6>i)*p%a2u~~=jCBb=F!C52mgqU8I6=ipMhp`QYZyw{j{%Ow)+lbcESfAOA5~911
zqI8@rN@H1+cz2Y>v?%fLD2;7V;^k2q<D$gVqcqk<iMK~-%!|^=@;F_W8z)8-r<*9_
zbgxRBPJG7cM#?zduM(%5DdTj{N}O(}jMIH9ak{B8PWP_F>AYo}&RfRmyk(piU7Riy
zjME(waXN<?r@JKL{#YO`{{ycl-cNFAOdNHFyO6SCbpLfs?Aj?W7Sd8EO43!-zrKa8
z;qru(hSQV0U*Z%lF<z>VN4Mj7R4<S2qw%PI9^GvL9RVY7#OM7PjGXs(q)X|Mi~x;+
z=yP<fSX68@3`I!>ii#affXj24xSCwtxID#XnIaZRQc=38BT6UhqjXX}N+;o?bmBcq
zhc%-lYewl1WR&PNN{1bzbl5RUha97H$T3QXAER`bF-nISqjZ=tN|%#G1s4lNeJUnN
zB}#`IqjZ-`lrF4_(!Fm{x^XH>Q;8@|C8BggSd=80C`mR^x+Eehwrz%@ViOQd8h&XL
z5EL%FHR7}x2|5=BGj$8O^T7xzPSIL%I-4D*v)OUFj4e)Qv*Tj(62klOITZrt>B98$
z6RjO5s)-Y|#OYjhoX%Cp>0EW3ZZC@a<)UjL<8*UMoUYT16P3k@%Hl*_altOJ(nR&3
zv%qmW3mm7jz;O~w;xs#q6II5E>f<zb2zepK`%s@4aXDBS@8i@Lp?kq1bo4et@@+(v
zIuuD%6!<!hpu#7I>uX4zl!IZDE<mZP>gNaVp@YdJlGWKD=)Y=La=BuKX9kT=CSq1W
z^skO>|C(`IHh#ABZB@N81?I}0K&Wi-+NyeI3qry8AcAgO*j8l=-7V&{IXq>Isw_|*
z2l$Qz1`0ny6LykT)gqjaHNHC<lUWuJXWSr}0qEgL0FF1Lt7`(jxx#_G^Q$0`H76IR
z8>-t_TD{qpF!8iNCIs7p0TBY3un@iQ!9HU#-(wEYneM1IWSYioVRJcRnBIm3&*2ay
z-aEt77QqiE4_kXN7x*?MF<WKfeFvx{nj4ve%dR`1_&IfuQ<+@EJo0^j@R@-raIPR3
z9|9v4auUxa15xC@>=Gqb=GtW45{iO7zzsFLeFBaybEE*!izjPvf{?%*P6W90j^!W#
zKVVi$V}4Mw1%x){Vyy(mnI&IPNJi7@a#{v{LEl+>TU8D#1`i95008>@H)Z3$IJQ;w
z5#{AqzOlTKQqSzG8gS$Z_~!ZW5WY*6_I($g7KQ1brK(`mfO9Z@zienm4F60cm~>xw
z*W-Fuwx}RB^Heqb8*iv;_($zBY>W@hp$Oe28}aXGB!x|cj-*Fu$d1soK2n*me2TL(
zq$M~b&3q#?U5n5rR`6B2uB?0!+hRt5xVpQ)xT}oc*9Z~c?+`oxyYr&v)XLVrJNU7l
zkV|f>n%Sj~lmiY`VCvup=fEPd4AVOsJYBVj;k%~`>jHF(+LAO@Ay(lUwPs3HT%4EJ
zl=9DPFs>j3UhGX_w_`E@H>P5{ECDzs8sPvtQOR_Wix2{+Pvq4lo3SC99n@uo$fxtg
zeA6kGet4=-2o<s{TownC5q@PE9?yB|q6WSZ50fB>US6V*I|>LZ^#KUWdI1Qx`UW7Z
zGzK8NG!THW0vLdBvloYGkSs=r5zNkSyj)K1K4j6YUgf@Jns1roTavyd<y#tk%PNPW
z<F2$Eekz$*L>^iMOa=>IHLR~#J_Y59-GRh%^3iz9*tv=z%vzV=Ud*54pB!?T0~Q^{
zvQIDG=@@}guCAXA1~f6YVfg^{=jQ@ja8F$;Jn|NazRK<(h1gIK?5yniniL#+`w1=b
zV-+lG#O?KITpY+~l$8;|B>dqKZM;Rw|J1i6N$Vvk(lz+q37@;={*o*Y#7p)v-m$+7
z-z(&Hd_Trp@3Q>2GG3CEiOO1hZ&Yr?_ZGYlE-SAo>+yX{c^lsklrQo9TG@tgmx}Os
z5Bp$z4^gY}tx?<XU8%0d_bByfe2-Nx#`jVcvGAfZVzC#RB^j?XTlnIEGJJEi9DMs|
zd*VA%8-*`kR>n7^Me!}x%J3bdO~!YsHWlCL+H8F1YK{0Fp&fy5i`I(oa%}~^tF$%v
z9<QNxc(WL_#(Tu~<NL7oGQO{CoALcd+k)@++E4iYqWyyJuR1V?7lBb8yaAkxZ!f(U
zzIX)~-+uZ4e0S1^;5$Mef$u*0KKK^uVSJ-H%83_#OYz-LKLFo@^m2SB=o9drq))<k
znm!HR8Tw3o=j-$FJw!hQU%cCkFJA1$_Zt0rd~eZjm1OotEWX2xVfc=~Ypk-7Fvj6K
z%Rt@nvg+aZE;d^5U2d$z7jL5Ci`P)`J=-`JU%YdQ@685F?Fr*)e4jO*#TRdv;`^HM
z8oqBDZ{qu|@gcq&j1Bm1F@BO%Q!x!mHs_ji@oh9u!xyh-;(LL40lpWR7vXz{3EE&U
zTjKk+3EIGmmha;Go%sj8f0}<vD&C)5BFT8Y5qaTd!_V;DWPJno@2n2kf3|*>WV}|G
zhi|@}FRAPuLfG*RA-+TH-SHic_XlP6`XIhh8+c}~4dQ!%4LswW!Lj(_r9pfXb^_lC
z_5^&V*i-PGW&`JVX>bO<v+P;;&a>y?dx#Cp;}yYXe2=z|!}kRH6nsy!QB%AOcssri
z*q|1?*9XeC-?rbw_aplwd^gx%;k(5F_2Tuq<&uh*=honRuJaYXe>$kO)9rx5@#>n1
z@2>8y_>Oc(;ycO(&ER#kgCrF%q@m>OJv4l$yVE5Fuc4uYcoA(jd=GOE!x!(Mq0h?b
zyAs|Xme8vK89(CNkG&Tw-il=}MegvP-931b?g_je_a{<2451~dRvL)!E%<G~?^j8Z
zd*N4%-)#KO#_uNlz%7))_+2hZ>f!i31nw~wKbQu>8%rdq;73X7--6#qk~DCfBn@iB
z??Xx2xeKL47aEKI;NR2I(*aQUvaj!+b&*CRAnJPB8E4+Q?u8fMd4I!ao4@{cOUDnt
z|Fx~luxvLczjwiaU54&HtgvXmgg0Z}LR@Z*hmlz%b?v$jH~rS_<P9kdM-np@;<ah!
ztgXHAj&+;9>iD%=$r(0s%mImU(-&6bg=AEb<#et0c=5YK-YeLcw<)r9@YbPQ_v`Hc
zm($g4bUHD-_{=fi-PqkGt&z@?F2U=^*GrE{uSwqmp$wa>Rn&FTy2P_x&q~i8*xuPL
zZ5q<y{AzSbT?%V74G1y*G9{<8pkrivLYi^+yv=w?TjZ{`7j!rs1xgotzptPJuSPR>
zMN-$SIqT=UHb1>#gS&adcX=Hhzij@+{?*+jf0teM+?+@(T!^=xMM!O}a?|>|?)~f?
zJQTS1=Ka3v{A$RzKW<SvI)79CGEjnUrAyo7bmold+tu&;{$0Cl9=dT@_sC5}uO-&a
zxO?V}3)j{@Chf`Uz|+%?R}Vb3U0S<#;aX|ox^;<lKlEKEC7xCf{6HGj-afKjdVW)9
z$JamSf7hk_CguGt>Dyj>ecN_z`^VtsdGeNSS?-pNZsjLcQMwehOEE#wlG3+J?c1%H
zvStp~ztHquw+)cC6iV+TfVIRr=|IX|m9$e=t~{fy?eZl{u6)e7vU<qcg$r*u^w8Vp
zw%^m<aZf?}J<|*BnLhpAY11B>IPsD3<DcJu)B1u<Z?-${x!(be?IYK>kL>(tQ~Rf~
zym4c%jk}NBRN!nHGUTh@Z~opH_<g~^j)L}%0wB9!YmV`A?*YH&eEXY|*V*3Q={UdJ
zcDFoGT9+erbV{9_viqIW*_rd}Uwwc0p`d+JK?j<y0DpsId6%4y;h&Bixv6unPrg0i
zx%R}mb>n~eC4I>ye5}<_6V~MF`kRJ$AME|sPn$ZQFF+CSU}I-zXZsMRb5keCVAG~;
zUFJxs6L}SMc355gwmR!kvLPMq&X9ujy*@1dqoCdE*mKb5U3k+Q9gkAgj_+2+o^#)!
zQ?9wKb@V-*UiE#Kt$gcgxV@UQ=kDtxo1C{l82#n@Kf7}K{a)$U8^Ygwvmx~Dw;RG=
zbvT;}I`2!^osZ1>vh$Jon>t?_7w&BDKt(%;NSj8kmpVpn0#G1z7IaEo-Lll(-3@Z>
zl!m~~>*&-T3afaj-7g8+=~8FR=Z_UcI-W(~XO%ALc~Jc88)G9kZQ6gx=De=IzW=^o
zPDi_R4-f~0I})(Bz7tjN#IvH?|5X2!w|D=h{rUG_4ycKt2BCPcAw$|bMviRnh!i|8
zMbMtoEXox)m9#7Gsa|>GbIuR<Y>EtdWX$;SkF<>+{}{0P*d}j(&??CES^4>P2Q<2W
z<oVA1omb8*8NU9_$e1^O4flV~*#67=CyX5Z;fB3Nx33*pgnSCxodT)7VAJ|fKQ8F{
zRM}Xt@%5pzH*R!>ZrbwYkj;PWvdh;O4jTOR#zEV*oKTS7^7EeGeE<Dk{W{iz7CJ{3
zbo^1^{9@<*j-UL?F6))wzU}^+*KkOI^w)*P!P^T|h&a#6U3P!D8{I;B|HG|Pcfm)J
z4!g0XK+4JaRm$5#k@A0Wq{6-4!S8R0^@bTU?v@rVT&t?v|4_~CzZ<y&e=zrW^cSZS
zHFJh^I-tk@N8X#j*Ldas<L7zq^E`LSDk36CQ<Ts&xw%_zZuUjin?#MOQB_qnMmt80
zng~^6R86bKsH&<ls%q32QlqN&YD#P=K^hW7NCa0zL}b0s|9#F)h_$wv`Og1$&+GY|
z_wzaHbI#{;&Uuz|KN?T}QrFU2U3*uEC#ur%+_{b&>ztZ9HaIo<oU85F-OY9!>{@@{
z!sVvg*b|ngckT=?)zyaAh8ITkE<A-|HnqqrlU5?^NZDSR`_hKba))hLQb=rhrM{)L
zrQx2)LxcVcx79B43`Z~d*Ak7*F7k~ULMuXhx3JU~qNJ-WEDg8il=5ZhFO2^VEg-_Q
zQ{Lj}X{S1YoPNP0dD`hA9?9?L8$Cnkt{d8%GI!nZ=7hONwPMQLqrqazyzS36nm^tU
zcj3v8H^-gzqXeig$o9C?PcAsub4BE*d(u2REn5Dj!hca|o`1rkbN+JVlI6eYaP+er
zrO|WgstL_~mafWb?zwc^gywEbw@tElU$)`bjo!;P4Q}-N!hKWcguic%S6^PaE9si=
zs=cG030(E#sNRA9JRZt5|MOI6bMxv=eZ4NMF10i@t+7jAMQ87h(^#|7(Eiyrn@021
zk7?bvtv&I?Q|JEmt)FYczqWL9P5Ami?<X&O^Y?E;dvEw~vd`fSD>j(@H*6lNGHfUc
z(DeRxeY`6C+p^P7B!7GEbm!!aCB3eR8+~mF;gs~-w7YLp#HPHA9?LhKG%3n9*_z)m
zZa%TLXTaui?=JP5&oA!zG$jF>FV;>sY_7Ikir-wTyI|d1Yq=0dN&Myp%h~wNvNu-`
z;zP-x`pulTT)$cL_N?D>Trc@i^5mA|af;wAr~K^ax17@RPi{HwSL3{;vZMX{*5d){
z07{<OdR(jSz4cUp_{`SwPR<@%olnH3Z2RlrC(5^NGCxtieZ!D00o%WOK@+gOkfKw)
z6am}Mn70RPzs%LwY<E3$t^0TD6QqLg3L@GUe|P!WOHb}tFxlk0<Csq4x}z!fbodUc
z0^eWi?tD4tP=t$j&f(0>J~=-bT+4Dw44P9pWdW-4oU=XLPUh6{;qf_KNYm4l1muVz
zbpbh^wr~uiwZ57kj;ak${cuXJF8!etWakcNoq1<@PgU8jpY%@UyN*8XT)nF(M6KR+
zGDK8S0u%~zI)qc_{ut(YGB-b_Mw@%WQr{uB{K+P5uI&lQmRsGYIw)7tn9aM3dTVNS
zH@h_U+O4VXcyYH=^fl$4<7TmJkIhfGxc8gH%TMk7?!~6Ad-uiq?cZD8(O$K;qPyba
z-b?N4efM5zf3+(mKpjA?wZH7Uw>>@ef3n79U+KxJ9{VaX<Wu`>ovWVNXUk|Tp#-NH
zjTiRWo&~DPxOQq^jla!r|Mz;i*Z$*Ay7t+BqK`+}{u0xr&ihLT*Q@rQcH-LYKiB!%
zllw1rzT!zq2TJ@XVZ2`ZFLnj0OhV+!6p+iEFLj{g$^F*?FSn<}bAMytMbEsoFT0+~
zJN|NIr@YdfQcYfMo-YV&L+3e5mEH1!HeS;GxNnrZ@MC!&<<%drcD&s6$7@3`*Z<f7
z=)ku@(!m3{J-a`3pwLg{exRbWrt`s1L%Qqo&nbFd%|931vpoMwT8$#VCa}^azb?Ge
z<<N!*Ma7|A=KY-x9SQQfbm-{Q{Fy^VUDUpZu7+K9J#;nVvh$&9VV7MF)rVbV#Pv{p
zI7JZ`ohiX-6i{QBgSZ@Oj6i5}*g4lj%@OCE56NNYTn;&VUvxX<>VDbnkcT@`fB<=b
zc)6c*J3Mzp6|}P_$hSefbU3$1O~B!O@oonXw{K_D9QIOFbUCu^sY{)Y{N&rY=18H*
z_4tufXRmZVa;B%!>qyyI1eBcvId}F#=OeYA2yL`n&`{!Z1nO6EM7ErDD)@Y4JJ*7*
z;(1HKF|EC<;6lIi&IQ%pefs?L*S>zee#!~D6hevlry3`_z3@YeZ$#m4t6P2H!DzQS
zO6m&>0xP@=j|HCbE-d}BPg-HAEkTFDK3r3HzI}yXVYN4AMte+!s?c*|w&&5E!52+O
zb6=@<KAIPHw&T$vqwIF{WPqmpXtM@HEnf6Fw$WPdb!@A()azKDPY?Onp+uY>3oQ3N
zRupr#!?B{iXFZOcG+yvJcG`$j5TFoBLJ?3FQr_X%S>tK1V|0u?R+n1tdaN<3+^guj
zUpLiJQeU*=mBwpDJ72k0OUbpOUB3d^^U9TLMf+a|+CK*5$FQ;|iVhhMDvOQ;m31gO
zLQ@>=e6>T-QJM?{r>{~ns;;i+c<0L<ijLC^P9~mdS9Hpy-BU%UjAfohWkF?~Dd|#F
zW<oAyA!Y3;K|uJq4n=1vIva)*XT!?c6;*UP*Qw}S$SKdFbK!`5A*9T!$kw5(Ymu!Z
za<O$P^QNRzk*zbx#rCM*#Xg94$?ZzVqDxO->`+wI=~Snp%k57+QFNv8;!{Oenkjh(
z0oM}B+=?0-5xFrEL}>)+XxiAJD5Ih5cf~uNFY8cT(px1`A{C$NtrCh$`{1-Z<cw$W
zd5<%G#pk;KU39i-imRnFPf+4lTq~9M6<<p@<3fpRah>LjPjTIo`5u(CFK$dIaV>7*
zk<7KE!cgqm8$6GaGlt{eKY!Yjk`BlBrve={pKgD=EaFtV;}<%d?s)u?*J<harH+&Y
zA)pSohLkuRuWygj=JqGsA6HyOJoQBom$RpRDCvA+_ozDMiT$H$BuaorgB%=Hr94q=
zv1?A8NT}yelvo<nlxR+rgi~T|_B?UMQmZ*}-c=G$1g<RgIFWv!)Z-+bj!&Kpt5uvV
zd*-+gNPUNsE@h|Mo$Ph)o8*$6gG)S0N=p19OG@m1UL|L`lxQglE~)5J99(j_ONm#B
zS233G9c%f@68~JFgjpr-r;xAtRH@g=kW)?85_Rdj(H&AtxAyDwOli&{f8Ww3>q*t=
z({;gJPy6^@a6j#PT2__)?brONvgP^;b=mTe3bCwM&y|%GCma>aN{pPcjMHAQmebL!
z{9sUpdwEe;O7#4h@>3mvO8pw0$}jZcY~_Mrx0g#oll?3PGLN$-g5~nFC0e=SY-yLH
z{%1@5j`lixNj%y>N#ofo;*rLR60gF*iZYLex{9-%>fI}<?1c>#9yK`ac(tkK932kN
zseid^*ZEUVH(k6?Agf(3V8#3-CA}_Gd5dngokKJ^w%nIJ^|stsJcDh8%}#E%LQgD{
ziwq?-wzC(XQQNR$_P14fC>m_Fwo;pouB}0Q>6)#u5UXn35_w{&X!Fg+iq#imyRDyR
zsqNws|Eo<Gi!BA!7fbt{>UHsg`cMreS1(>t|9G`BuaAdNdDwdX+sdE%SJqS(N1xw7
z$+wjyrlOk4lIZepE6cj6giG7rj%jykd)%HUE}hpLxpL`(`d~FBS1wg*fIxtpK`yEH
zU%6DR0jX6g)tA~|`_8SZB1t?+NlBG0i7TmUKI{HeRr5Lb?p0iq)Kuj@Z2R^qADc?J
ze756xJ0<dERPFNR%Pv6n61N_g?WJzrsyFzQcvo-sDfX`3GuY!~^~ug9ifZm!Wfw}i
zUZKmfE4I?7FI~A*EP7o*H7;GL@)6J1{9uq9YObk->Z?~TIXPXudKE-tbMm{YsdVzK
z&Cw+I*XGrRgLo$BYHeu9S}gr=muB;<t*uOvPt;x#_f+AI1$QoVzQm%~6SwY*G<2n0
zT8bMeP3g6517!8JpMo#AT|4yz$k~n;Tq$w8c0LsW7doDGyLP3R^SGugcT&}Dj<Boh
z4o2CvbtnB)UUgTlC|&C6JaVtrHQF>+>Mx7Viu%SzkmiQkC+fL|YF|o#nn1*c$|oA=
zVzHs>oaEGS)wfA%px4$=uTflXXgJfYOG86>H=hQ&L<I4vZ=egq#tpBDPL1D=6NSc$
zDzROo$5F9;6J7N+T@rIHG+l8PJe!)D1fi+9T<~dXt`NMNc!j_<xm6;-txE7{{^nQp
zXPS2nsB3C2?B-P2+{_7Ao7JTXb+cO-?pr!b9R&NqAj!#|AHj3>nsdC;F3UVG*Vl6{
za=i;zFE@8pHp;S{<8h~nM+UMRcUe|8$PHX^Pvv>8so_bEYijaiK^%TaE!MfV<5enq
z9q(IM)RWhh9`sO@bv?}s7u#QJ5U!~~>ZQgSRP&6xfVwvcfmfOu#e>#Ohs6A``|HFj
zv6mI1(9o!qPQA46qSR2UvP%thswPQLHq|RDQ}$LVtK;|9C}mk)ui|_+T*ecDnk#Ct
z)3vLb<)u1*&6?+I-jsCGY)P&0!7a5d2fgkOP1DeuSWn1_*x+i@D3$dWnPkx0wNj0X
zvZj&Vv_XpS7)ImiQhh~(yQ^A_Zh2m=MyK0dh#6jIb1HfPvRLNkS?T1|?&?+N-Foh_
zbGU7n%H?3sD{7a6{#TT)bf|Kb8vfPjcJ^2M_Pbqv5yaoMvBLduR8^IG$uI}G>Q0wn
z?w&5Tv+XuS)K!2eD%$xs)E@AVxyJJz-fp(j?Y|3czSLfG>1wklZu$0j{@9n-dKN-@
zA-_3=km!wzJR#h8fP#k-p1v4eJTb6fzzJWT=c%jRnB75XJC*N6ZyCMlJ)@ULaXXJr
z`%^sH`>0$l9q%04p{S@!c|gt)-<-ly+)O^@dC6B(nwRbC>seap>+4%u>es>d<l%1n
zQ#xt7dp}v6k0%G39Dh$;X|_KNeY(f-Cf8?byYJbiE5w5z9U3r4=Woj^)Il@R8MS#f
z^Nyg%%5cwGdb6*|$%~|QiOe1L&m|xmmf)chhZ|A)aE`tR5y<RW?=~37pBeqzpVzqr
zkk96>*YqY|fIdauoqL+=MP@QOZ{7}7NAliBfA{g`qW(I~t{{8=wysG-_AgyuuOtUS
z6~MdeWs<*icLO2Ym+iQAmCRVN$~&HXuxhbFMNY1p^|Tw=^?kNN&1id4@WZFq0!S@r
z7tRTkkhMQ7E>beuj{Nh7-Hk3}4X6{Dx^uQJkj%_oUEhJs-uto7i{!n$xix3VAM%b@
zs>yuNi=_I;AA70EM~9{>D#-C8?>GC9BL#Dt8p+y%h3CD=@`9zH(+ZZI?@9I-e90Y_
z#}t<OcOg@ceP35cmKXimCxWaw{?X~q^5Eln-QCHelkapdlixm>da4~+ex{&W&8UX#
zu9)e1n(PHVMb=mRSm;i^t^F5KldtNw*j40EU3KjhvbUkBrkd;^v(V1(3)}Lpkp<7Z
z?^HoPVHA(@;pn49K^{hyz!7o=$5eSLdz?z-spOCHTk>1vWBJ$eugTYPs+>x;$Z>KU
z$(7Brne3KB<Pg#zOR~g;*mv7^a|`Vw?IXEQ?XTKj<-WH^*dvGzy)3c^4vvyS$q#=V
zp_D_(#Xk;_<#^72hDs$r#XbN2=?-!P_sjQ>c935udq3cRA&=o)KXB8@O3w6Q))R6j
z`Nv0Uh3vt_e0;5|+>=ZA_?o*sh~$5AwWHjg6fdlZl*35zqH1S(Fgd)a+7n*kqH1^f
zH}uRI-qA%@T;vht^j~>BvbOxy?v6Yw{>t~1N0MEOt9bbZ^4q_iHp*6VVR>D(y_$>7
z?vf+x$&q!Pw#vUH-)@w>;BEThvJ$QHY<^`sR986S)=TEO;)3%#WFKy3!Fg|aBH8=X
zxlZzP<oTn0tnv$7$75$ZI6N<TIH^5W?kk%}PEp8{au&%eKI11la|`f1R31u}lw9<X
z-yoC9-P_B*BX6H~_CR?jFQ1o@=Mn0SB!jPVPDt0DKc|D&!KJ9XoJ59pt&fw(%eB7Y
zHWG*4Z1aG}zTEy1*YAyJ=4bxeY(F7CMGmMZ!0*Mi_j=A=Zm%M>69?KW?0dNcd$he$
z?n)}u1L61LqC~y@n!S#k$PB_$>KbzX)gIL6JYMV~>+C;~O_@=0sJ)PTeo6*>8#iQ1
ztZb2|lhMtC;m;ud)P%}mvM;HaoDBa(^5vBXIa2l`=O-pGzj9(Md_B%1nSUuON{*HT
z$noDB<aoIcDXH!uC&*8e-|`u95;~rHyN8@&FX5uz@|RQOXUT%!7?}S_i@*KV0CxTz
z^Cy#O%@&-`AV=#v%2v52IWVc4oGu$k)~m0{8L~gg&wPUU1(}`YXTkqrf{XkMIhK4q
zS;73{;~VAY?8RK_=&sEF-S7_ZtGLYJD)~8F$LyDWAwMs7BgLaSQlArsxyiqjeaN{f
z&GKNm2RZR7gb;q|tM1h2q!%HZ@HH>0;D_K`V7}8(Q63^|$-!56=GVW_AP<u#kadDi
z9wB>?tFKj4pX>U{dH5faKRlH#kCdaio<m2=zmkpQU}h*@fJ`G_J@>pk0sQ`HNpdC>
z?E7(E%)c<&6@CQy_V*t0+lY5O-iQ|`R8Ac4KcJU#6!(q%_O4H${l%y;eq1{{ULp|<
zA@XQaDlg`qm0#)p0hHql`&WZ=aJ6&fQNwHGQQVXA@DbJWXs)~b(yuPT?<Kzge*)(v
zr~UdO9+1=bE7u=5+WX0Uxb|dSC;J3>9Qg<NlivP&j4Yp$;#m7kXzU8|)6@3%?0?~g
zkaxz}Ked0t#gpl&atB#QD#_wlxwG9y8c5D~xx0NW_dMA*Ob&oxmXhz&<Usps?iKRw
za}2ysz5+*1Bg@DiMl$dP1tF03N|GH*0p78%uweX(B;S!aMmY)^JBv(>V&DS`lH>&P
zCHb=}`ou_nBr}ra-=Gn{A@4jX|6W#bK4ktc<(aY*$CHnA@`o6vT*<Uv@^X1O8f`w2
z3*=(?jD5SeTqx&Ys9f1kF5y!NY5oZBkQirLKcYc&Gg;z`6k^+El0EDzx!;og<Xzd<
zewB<M-7zRXBY%Ox_62f?A~Y#Q8<AHb@g;?{qkv20DdZjbZB8XO$uE;RKpMGH?oXD;
zY1}V}Guk{C(O#54Lb0?{2=OBpq}7mqWFcCA5E+KIkYh<EnM&pmAwI!6fQ-W@F|U&e
z_{jb>G67$*jUhQid}ZwK#*!JYy*h3Tnak+*-@H8THL~b8ul?pVv?I-#BO4qOJm=r?
zj%00%zrMxa*y3+(@pq7&NH-pbgg0#**@r_7q#${ufSdrIr)S(?yt<?B#2i;ZsTx>;
zPz5l3!p&al;VqtuY$b}gm;rudYg&dCw0}k#DB?&hv0KvMjS78}$R+heYIn2>m*_np
z8&vx;zQsr=POAbf%>XB%GNBl>HUYIuDCqADTKqydVvc%#9q9bm2cjQjc17&12zcp<
z0_fyK<cd<cJ~Nq5^6~WqJ%0t~iQX)QGGTLDcReS^B8f{LM&eQT-br3bu}Qwk?nxUG
z%M&Y;e3N=6O`$HaHt9_AdYl^)?MVZZq@)E&qnYzU3NP?)xG71ljx^vQgmBgbR)d#Q
zW~B(Js^lHXb#S>Unv|6(xycS!p6qaT=G#-Jr3^~0OC6AGzscEB#wAz7!H3hqc_!y2
zSEsb5E>H1o$){~@hf{Nsk0l>V@lWwbZq+Eenw^EGq$HQ52DYY15vZeeOVQC1*ip?&
z(SeJaqzHtc+=aH&TO0mh!Gsu#7Q5?D-gMU>EPt}7Jl@AIGxBbc<P({+$L{%)&rQ;`
zMvxcWz^%Ny`SPzbQ{?>2es>FR<;$BgA(Qw1$qVitF4N`XfB1(b)_wov&+j|xeMOYB
zGwt^k@n<5*d0AC=iXtaW%DNN(PCQx49C9cA4PNH(RxFduQP**4R*zQvF#f&t;$iZ8
z)HL#%`_JLOQ};=>`>)|+j`?Ed7~-2r=gt4h?{Vwj{agfYP4D~n-;sy=tzPDRj|I2q
zm^t-!-h*&5XFN#kTjOG-d(%&zHQ7rZlzG?LLbhhkmG@1gtFM;dWT6$^>dOl<7swfz
zi*Mz(J(qW9E^B+<iZLgyY{hr-sXWN1GqZ0Go8)sdFB9L?Iesinn>q5jO!;PRmN!nk
z={n>f<Uf=UtlaU-+#wI0xUeM~f}0)sSOvd{8(Mj{`mC&$b&0$vGZ*uBUfVc$DscTL
z_n0{7`U!wMKJ&2SJZpL@ANMi1OUOJX*JhTq@~AKO&n$0yen;$|`QIDY?pUG6#muaJ
zTshsE57rNLZFzVu#eQ;I<|E(-S{tG7Z~e8_=YILO#=F~j+jUc`PPC2@ZRhXnx^uUT
zZsE)3iR|w77WQqYGSj!)*o+}>nuz=E`}@h?PxSh^m~F3z#+9c|>~iZmnV#D#CU&E~
zY@FzSr#u~F!R;Y!=hR#K3-|NvN9901cYE5O<H$!Q2GTe;T|?K2hSqd#`FE>dYh3$@
zR&;Nlj)(Lo51MFkpqr^&Ix+fY&h2MESC`vU{NLlW_NCl^BGXLBjkRqp<?M+qz1x<1
zGrn6p+>L*8>VNN9>-GIyDYwpBx5mf#(IPRohCJFi?#Twz<NkA*IO6`}K6p%wOQUa1
zCFe~X3w@Z-wm;=_6DQMn4?1?<DGl<P)>@{VGjV1sW^orx#6E-j`^m#5&bz;uKOc*(
zkx;KC_J<hHT61qZX14PF@B0sS-`Mt9(SPpR?omg}jdkXKsy+{+1OKVI{a-3aE}dk*
zQJ=ftYtc9uZ<pVQ`?%5M`&z#}?ouB%zkhFAJZ!BT>FE9Ay?+0%>4uy?aTRTkJ3YU~
z9J=;iZFOtd|6<#<T_fCjJ^yc=JD#VsK3{4p5C4sIfoz+YbI11gow(;te7wc|kN<9-
zAO7RT-?c#b{9S_{Fks?=yCuNbP;j@fe+OSaF|qjm^PO0F|8XBaChk2e9zONIKczft
zV&&s1MJ}9J^SJW*U&}{+#CL)JYu9^!^_|#2<K1h{mkYD*FRMGmlC!fUq<3x`bg$==
zZR6dHvpjA-Z#~QMZbknK{=;4S{a#s?@BPO7zY<TrGU=vw1dp>`kD~AQ(uc=c$A3p&
zZP$E{n*Y7pq4oLuBbV_r-!!ycx3*p9->Yu4PV~Lw{j|mX#JSTowwB+vPIrp;@8HS9
zvijU_z7O)A?0)lneDSihk1wwW%L(Iy>24|H{H*Z1h5gU*by@fP_V2%YJy}Wr-SQt#
z>GWHKd(G|g&Yv$w{`BYL{3m0`Cmy^sds9~Wy;8|jvIg8M{87X1^iB)w&tZ?6@8d|1
zdW<9_>-Dzt*`ws!_Wd-?N4|6;H`$go?#9{u&4aD+<?&gWt@z>mtSL9rJ-+uMsMmWp
z^8NQCxi)JK`fL8fl{ATOn~r{aM1OL3hkw7{3pips=xyIsY-$_&m~h|6l+V988_2?<
zM=K(0=|iU<leOZZ)3zkU`eOB?=J7bwqdx2IH$VCNtc~{@w>6%;CTn{u{#n1PBgU=c
z+s~!D|9uKSm(wlbFJ|q#g~Lwo=f0u!9^p>u|Nq954?X%7$;-3yX)dxc>!IHSAdjC}
zxn!Mr^qSr|hdaqE?lT_Sll(iE`t#ho?ZNo@l#f3K)<LxonydU}RufJ0xYkY&TK<13
zzWn*k>xR~H<zG)yQQRtDx2_-LtCL(?<Nlm451r)sb8+r3{MPTp@0Mzk-`zs)#+M5x
z^>l<y3ZVYIzxSDBW^wQwNw!UjbfmjGl}}G9VWE8|#os;F-9jd%v<*Rd{o0=2z>@|t
z>^W&jEAQVq7vLS{a7Q_lM%~Z6)LN$p@!Q^C+?ww0dO2y#ZE=6*+l^b}-|d{XXX|>p
z^_%kB^kM-`J!$-{dB`O<IP#wyxOG3;gFer@^**_^{pHg)%D5}?zdb~rGHL4V+{ed}
zvnRW^%}uVnaVBrOfgc9R7w?=(uDUb-Ca%|wGx^vJ{NF<IqDj^Nt+H<|S6)7eN%F1y
z`#YaB<No5^J(fIo(yY6OK3s@=aZ>qxrSzFJw{5&fYm2ry{cm9T(4@uxiJHnela@Vf
zIdb--mA9t7bzE#44&BObdwwr0Z=AFq`ER~god4It<h)6TAJ;X@wUc%{dR~)qA3cxz
z$zf97t+5`ZEs&PYG_C9ETl4<UpSP?{|MLYua*1u%RF9n5|9A#%*Hr)Gm-1MuFJHLN
zx&E<~_JEmiQ5)!g-e?wr5(lQ%P{8?=aqw?9gx3tx4936Ikf>ES)`O#j^_fdjm9k##
zrdgsv4$=ke+JVK4D9qMTctRYt76)dnsGT?t;5df#0&JmRy-n?)5D}J8<`E^cqT)<k
zqE<$&i`p8M8<ihb9914w71a<eM7u_NN5irVQHsaK6XHo_gKEDjPX+rm4`fxP!}S`F
zC_MX$LJgwo2#I#afoozuR^QQnEk_^t1{}DTj!weSA4e7r+{;Ff#4(ng!zuvb*?$f>
z;h&yV<TLUEnMZb!bL3l2!~KaA!)nv#+z{>yu96$iRdEg6Rz<y{k=re(g#p|?F<y-4
zy<t&D;ybCm)h6B#_HDl4qttuUdHg7}CvCF>)R#9#!Lp6=d3oq)dj28tjLL!kC*m8m
z12%}Z$VZ~K!?zJ)^ame(V5lX$xK>^iwVH9g2`?qfiwxybhJ3|fBMR6(B2f!OyzKx@
zrj#h84RWdBfb=b+8z}|vbNHJjtZfWCBs^a*<Pt%QlTSwt7n9`bs8QmFNIOQl3_6~O
z(x2prsA1Adc|+7l<d$t%g4`(GNGa_@c~g{CJi+KmO7U-^psM|h<}rGZQlb=`P}*Rn
zk<m~_!ztC^juEssrB2b55*HEu6xkr+$pk3Y%25O*?T&IrNtB+XRMLPiNyrtnBc&)C
ze3VUT9-{{-g>3Z}oWvetq!=gm6%)iXF<V^gkUz0ZyeKK9E>fEGC)jNIyR=5yAbl%s
zR2r3`%5Y_rGFlm<j8(=dheA?`Lsm7tVLzxpX$L!AeIv(l?^6n^RFs+-4P!K%(QHPy
zfW9turC7-^8pUWdqcM!eG8)I|P)bn-D3t@eZHE-#nFI$JSi>Y|0q|caMjxF9?nyB?
zQyJaF;!{pfJXN4{0VKvnzACxntv)a2+s}!I?6ZIn4mqUgFY+do@#gi=bC4?VXz!xM
z!yr3z<&DyZ$YTNWkWiCN;vO96W#sUtvKhXN(j>*l^5;nTrua{ppzdK}o%}g+UITgA
zBQHSw1>mlcBv#%gq+5V=3lMq$=?=2EpQ{w|=PE(|T<wmd9j;snDYZdHZK744irha(
z?z50jf~2%>A}U<Ruf+r$YjNyBnR#*;)i2~8hTOx5T3jQqffT)o>v<E`^CoJv021>i
z<mF9B%bTi$xOO$tP8IheMjreh;TNzgn~J~EeG~aiRT0E;qV0*8Un1r##QYL5XCdY+
zl(+^Zeu>z#5c^BSo<-bIr>TgYAnrqJK{JpdK`h7BtI!H+94>M``Xyg#2b?W`PWuD7
zBp`<b719ttR$dV5uf-9JBLdeSDR&oR;K!ouIQV^WB;rWIk&Gh+;i>Sg2v3Lq1=6jR
zhoUBHP=hs+25sPk!xgwA{4Qwu?&Jq$1g;?xhocs2Pz%Trd0Fu>bf`P*uW7|#F``A2
zl3-;mO`InFQJgNmBhD1x6W<p<5dR{6Bz^%6+aP``ZWK3(Tg30h9C44hSKKG=7xTm)
z#e(bFS1w)@E5%D<m3UdK5o^V3Vx!n3Hj8$NlN6F5NzhJ}q?R<2ljJP9NUoB*)K2Os
zb(Q8zE2IN3^X07UuI$mGuMx^fWrMO=X;;e7)_pDd>aWpj3>aH@l0uT1ZJU?KO#D^i
zXRyj=Bx~@$cd^_AZUPy^eE_R`zl2r3rDP;V`M;Afu*Wxmyupv;-yxIv#r$Vv5wp#=
z1h)CI$!Cfr*x*~q?C$-8+1=X+i+gj)7C|TI$U$KMEal}37ln)Dkmw`&ki%kE(U%-y
zHtc?)?MMol^}1usdR>v!Tk1`UrKhE*$#E%A3M40_P{~40N`s}r<dif-8bV5?m!y}-
zX=$|d8acx($Cblc98WGN-%!3mY|7s$e@8AVCnzV7O64Dv)5s;|YUOHjS(&ZOCe_My
z%5~(5a+`8HsZmxb@du&GT3Cy_rgBlakOq~zsy%5`d8xdKtO`;YI9@eSHIP%OeyJM5
zsZ}qjUglg>lU0A@+*O~ezTmu7YgB8v&Z>W@{>61sZBlLGx~jIQws5{`bQbr7+8G9V
z{9rk*H`kroiQ{^xr>o!Lo>G6P{)p?P{+s%5Tp#t<>h;{y>W%7++%xJe>aAR$db@f%
zr=@n^xL|d@`Y>lu*Q#r|5DmJYGjpL~t8aCo5;)Nh<3ioTqC<y;`h@lf4GcAh#)eu$
z2Zj#2o>RB5n_TGV8|R@@LT84~4P6wvJTyCWV`xrjUg-GHDPi4i<$_ZfmU3qoS{gR)
zj;<u^PA(uUAk-EH`cQ68n91QnYg^F`-$KF$+}&9;7SFJuVM8sxl-}Y-h28EZ<Ej>h
z&A?S}u=umy8fVdk?XZMf5-j~JgTwY&Mp(vJGA+|Avn=!BmRMF=)>*b%axM9mVoSND
z%F+-fgt>-!BZmPfZ&aK9b@WJUi_-Qhx!xX*E4*<fj=DPP7acY^Yz}JGn&UW}tw!p}
zEp#FBnE@V+vkbgtVFln60F_|O7>y$gD{wkySg<1e0sq^%i~K}hB}ZXCaRL{Ek>l^&
z6mAMR&aL2fkrP}Yta{pE)$<a;KY#PSTnD~8AH#+6gZM$*AUc+CzvRE-*K!m2b^K0l
z61DKj&88MUxw#52MItv(@e9Q-xSfg*74x}Wu-<uy+Y9TRb-Ys1q-f%OsKrjcvk)SL
z@LhzyLSMcswXVtgQp=gVR%|b}=Y#2Z!|SLWOI{BPmc4i*9angh6eI=lA(Bxt@@6Sa
z3gbhiC@G4!z^3IOK8%hre7H1B8pcORBc+jir1ZM<Iv*vCmB#YXbiCnXl%i7N6R34c
zJ_*(-f6FJ+QHM`a{$BZeK2`aa@-5z~d|UZ8pQiky@{fGF@?GV-d<N`QuHyUAafp9b
z`L*(EzQ1ylaufdx<rd`@et_~j<#+sZ${&<J@B?ABQo}z_M<f14RVP&!{$*7URUiIU
zl~EPJzpjc`CGc;mQdGa-GwI00Pg4z7jpS#j-cbFXe_u6SHH)9C`cU-||EX$$YB9f9
zwOp0Wf1&zX^);WZ`c}1x|4Ow@wT)k=+M(LPf35mKwUb}3+O68lZ%|!OUEnvt;$;th
zGqrNbZ=vHBzYUfuf6H%I&sTrUf2aOL{R#iQdZ~ITpF_tj{s%g4@jKPut8@5V^)B@;
zevi6TeTLtwKBqp%=c#RK8~>xaQeDX(P+wMG<`1f`sITz(>UwoOe@NY=ZsHHC?P@!J
zM1va)zCfeUDEObKbxOX_Da|R3KML8Ki32NT5<`+8hyCH=$N(|~|AhGx=C3r&Uq6sV
zWEW)dUz{5UYjUtKJApJ&iR513rgHD$js@0cxnI$Fje8UGS|RrqwK>au#ia8fq%(=T
zN@qI0GnG-kC;u{BFa8xcf5_|md~f~(eh#0(&*eYoe?ezJ{#DF?YZ11N-^IT{C76GQ
zN-+N?YNHk@V562_2phGD{8x%p#UQ?s+Nf2i>0GI3Pv=TSH)@?$@f5XAtB9cTt$2^h
zx8kqVMy+BowNa~BLS<d?cWRwhu>!VeLlj$t7$HWnjmo`ZyO1m-E4~v_g;d23YMoZ`
zz3{B?tRjcbyow*FjatP{*rlDID4`Z<6{o14DC(&dTER)UD%geYusN#`o}ro}1X7!`
zLJ-v-K}+>V2&VJ3priA(V4yZ<1tV<E1_>rQYYS#rn++F2sg4QZ(6MMCl3Iop2Ej7y
z8^X&<g;EmUpn4*_2|XDrOi+$f{$9vbPE@`nOo4{X6#fXU_^0rJa*gt9;m^u%l$(V4
z(1)GEr__q8@C7u%Sy-oXRrL`zs{&L5g`<%8k)i;Lu3w2Bs&%UM;tN!!#i3ND#h0l}
zi^Hi*i?2|b7GH%-+r&}S#;Z75?W6V)CsOOKVivXQDo&=evpAK?y7&hw>*61&{Z?^0
zwbLrTL+!MRGa&tMi0`W3QNJU;r+!!cuK2$CBlXAPEUF3OpVgnLKNaVw|Em70_!spO
z^%8L|bYq$Lp?bY~y*Qt0i1;zp5OD$35OE<iBv)KSExL+}sYO?DDJ;4k7e7~@RG$==
zL37H)FR12-U#c&vFN!PG)#_^TAL^^>tKus4HFdrCPj$1pS<Ke(8eaTLBWiFLqETs7
z;yS7`;@4DX#P!gZc{p%y&otx(W_Nidv|<Y9!SrDw(}(HQ`Z70{X~F?&eVMC*4h-WX
z`QdQS@gpF`1DV`UVRAo>$^ATPm6`vDN&MGL;=g4Qzlllw9wzapsKhItW)dIDBtDKw
ze19hK&oPPr4YkLt*vMr4Ad~e&)E=|q7?b!SCh^789<$;ywa2Weq4t;+wbUN7q5<}p
z;}mwP1A>z3fS`g7Sn(7BIsnOj7V_^*rC)HTwwZ-K)HbsaKy5P%fm9Qa%csIB#D#5U
zVHnj4VFc5P3Dh>TFq_(D7XCtQGYcOJHPDj<^lz+%&zZI?6D3h2e8F^PCDWOIP&>`S
zD%ff6AgmTUiXDYD&>vqRo9WEg)K0Uop6Sd+YN1)!L@hK6+o*+RVF$I)EPPKbGz&S@
zLbLD#wa_f=q86HkT&7*SsSRdfFSWreoMk$8o?2fPu2AdCqDbv7iz;e&83F;j%c2YJ
z<G&Q$V0U?o=pk*Bwu$Yj^<~kMT3;4BQ0vQLM{0dp^rm)~#ZJ`Xvgku~ReXY4To(PP
z#bq&!T3i+*sKsS5l3H9Aqo~DY@daveS$vUNTo#8?T@_!VwwA>))Yh_ifZAG?^wi3-
zWT3hyg;3p-5~%J;iPW;Pl&tQl?kQQR21;pE1EqATfl@zeO<8)DT2q#OLA6mDK($eN
zj%uSckXlWao~Krmr5C8xWN8@eCI3Zw6|3rxrIFCdWzuWv<?4S(zlR0oZ=|=Nfw|Hj
z=z3b3L$yx&kZPUuF}0&CEufkveMU7+T1qud`W%{8FD;`wCVfeDOj-#YQ%V1zHkG9{
z)Q+;0P3<U4Ur~LN)=_<vzNWU5rS;Tavh)pqOyBgVPTNmASUW;HMw_Xfrk$mo-<qE`
z!GUfMH<%yBX_pwx+A8fz?K<sNZLT(7TdXbDR$b32&j6=wp!Du8c&H&SSO|6v_73hA
z91v^@jt)+tv4aQD5IF14yWmm5<ANs#&j_9qyfAoK@M@YOcth|GmNM4x*qlxkyf3&Q
zxFq;|a80nC=BrcP$X(|FEIo?Tbumo2v(pVSOwsk!X>}G|JdL4CryPU(qdDF1mh{66
zkLG*~KDyTppbzC188r{)bQ25%;j*dIO?CJWPw$z-FhdWA)4kV<9?;)t*r=Ol0DVXo
zXn@l#ru1%3w*nzl%4gnJ8OwER4RdvybvtzjbjNgObd|a~J+F7xd+Gi3ee?!>q><>8
z^!@ci;F=7v`jPsv`Yio){cQaL{ZjoZ{d)a&{T}^c{Rw@AzPfd6q5jR958b_4^KRD-
zhqSk9cw1?1k)#`PaZCTU^h%q)aI{VvIW}tU&>Ch|tC<)X79q#wZDI^W$S}ib@W(S9
z%tLF=#Tku9V`j6sbVSO*QD`Vd{x%%7Mq<>6-<bJFbwT5UrUcClnj5qzXn9a}(8kvM
zf<`;g9mAc?%mw8H<xvz=XxSQ6il+hBUFc}@`iF5rHuHLIcu=jDXf;|-t*_Q!tJ8*G
z&&kUSr%f<d-@!GRZ+Cv?o1C`ajq|oMm39f6O)z_z{cg-(4zAgcJ@1&W-Rkh~OhW@L
z^Mkut=HHl)v<-BAp|R;4Lw)n%pLeZu5uJzV{6bUEIfnY7c&vEC;pxjwj?O~h<lgM?
zZ0nBByuGcXam;%jpTk^*`H;?qbmpS@2AAB(J@~wNPpJFtj?Qj)u6IYLQ-zk^$(j2+
ziqm=EITqZ_%Md)-y6!@4cXqn;P@ArcV{W7|bn%p9j=Y0QGCz{j4RWN%lgmeN=Kj>_
zhCBQ|Gw$R<=jvY9y>1?29-^B->BBgSPWPU9q`5*j)m%Xx&MM3!@x=8ur<<pnho_0m
z;W@5Zx48A}hL7iocX8&i=CN(VbSoTZy0zvL<`b4GJRNT1belta;0fhjU1(tItb}LE
zH#z!T)6#&ss*?Ja23pfrXBpFqZuq)7JR^nE^A7*v>Ai9=XX%~ISq_K!(+iRjOC4rX
zKL@&nTJe<pE{@K<c!EAqA4%ygZWx}l-{Q>E9ZsLriXP0Ty{qqkqmLgHnP=;Vm}kQ+
zFfY)Lq_oxHNi}okrPS%iI{Z6ReHQquZgYFEwwMlg>x$zJYmm@d^B#S*#nYm}3Iwlv
zLQC<4{DGap9Z%IC%(dvuJ=<*-p3*;nbF8033*quw9ojM+>zqJ~f2dENp$4;=H^iE&
zLrV=-I^$y<Ojj-A`;5Y>#j#>3Y+0?etWyj&#~Q`xY4kPv8+FETV}h}taj<bjpK-=9
z#!TZh<1FJ=<9y>1<4WT?pj>0VvDjE{tTHy31e2@D+tkezU^1DaLnW+4_Lx#k1586r
zqfFyWlT9;BcGDcwLenzSYSRYO4%0qUfvLoF-c)0<2MrBTg?NN?3F#T44Y7p8hopxL
z3K<@9Eadf&2_aKM-V2!*vN&W#$l8$2Av;43gd7VR5ppJ^GNcYGiYC0aTZg&OoxWYd
z7}DnbQtPUS`M7?%(rL3QsdlU@TGs|NAIDsL`^?%h@3qcyrJ<#_&tR=H5}k(}^ADR>
zny#-O+Ri8#*Za)4K2~F_bx20*=x82$ee7!)ziu9r%vmjC#f|ZSjRJSjYNm7M1ysvg
zv<e#3c2){=HCMEZpKR2)T}I98(MAMok3IAamHDtmhuVbSh=<X;;@&+GIvQ>~a#_dT
z=ar)TMHXF~cY1}PrD(NM+HRKlp|uu5OF~Qf_L*VvM|reFS|;9W^_h%$aI$6a^><s2
zw_CTp+d@kAc1!v;ake%(XkF0Opxnf<iL<HG1|*J5oE?-;aZqtkc~F&uAJm`~7#gc}
zMJ#V^HyRHpMLR${R69yLPCHpULpvvNByym96X-~7^ljlZY_)cwcA0i{;!^E~#HFA+
zwEL)^F^)QIjkZ8rqCKyz0k(rPIan3!5!@wXvcp*yBpwbv7Thy&d+?cHZE$6<1?Ta>
z>A`~%54XDDN{WJq2frRXf$_HEY$}ce!S4mn3tk+&B6w}^=HQ*d2f#aqd@6(Mg6nj=
z&e__BI-Qr!Pe*-&E>f4|xV6&t*A3B)v>J3{by>RUuzn`#X6qK{mcn0!V?E_KoNkZq
zu<nGeLRYP8(o1@Gy^n6YZV%$z!cCGgQuI9x1T+wbSs$yn>Idpe^@TVarXQ^zub+~U
z0=F9HwFaV}sh_J~q+hPj)^F73==1c2h-=f=W~3NMvc`~~tf9`JF?bq$4gQ98hLt$e
z8Nv+-hJGw$uwjH@j3Lu7%`nR_->}565^=T~a%oyaxuF;boHf!KX{a(ZP~Rv-Pqjv7
zj54}rjG`{dhf<@ru^apu#sH%!V@9j9CK;oRDWC(4Lye=XNv+Pf&^XRG$2i$I19Tzf
zCRt5`jCLBqSYuKpnT;Ea%Yawo*kIgY+{Z!+u4lk9GL{(6GmhD$GS(m_(j%?aly34c
zbuslcX-yVWJdI&Wr};B9$TU1{nCW%X1k+U0dqDG&tk(Xf#W+@&)|xh(c3S%<jmFsl
z(=qE1(-~7GXq|OP2yY!i9rZ(;(`Kg44DrI@M-lu!AqEFZnwvB?WOm5(kjRjvkOd+A
zLxxZecq1J?(AbcyR@@RcJ!Cfc3vevW7!a~5V?a`N$oi1&A$vj&hnz^t&KMd}5mKEo
zl)ALJAx&n<9B3YGb~pQ^%}twY?!o93@XY2|v(-G%JPe`Z%~R6mCfUq0&2!C*%*&H(
ztu8s-oSp1x-k9tOlw-~_7bg3fOL5qe!@;Qy1q~$>hiY(mhWb+6>O%cPb-<pX;h}>=
z6GHoi4z?Z+9g(sxbWF-Vpv=%|p|es7Lg(XHVm%Db%FuP7TN%y;$`383*x^FUllxH@
zS{2$r{frF`XX$1UEUp%BOE-F+Jcc^!VTW%CaQN5he9JP6$+FNAot$Y&v8=WXNS<#Q
zY8ho2mps4KSyoeInQWP1nZtOQI9rHxtJB9=3M?Be`z$+fl;9`;J)ee;?$RVnjl~|O
zN|VAo!n%a@4AX{bTdWf1T1Q$(hFOwx!{Woz!v?`0?g$Ax)6XO9^{`{06Bs@dHZ|<M
zuz6vN!&ZQICTwlk=CGX<;W&WvV>l|q>cV;G^XhOv9M0kW8TO)QZJmRku{x#3!42;d
zZU~PIPeK}&;zmfuzKnh0L*Pb+kImR;9T}cQ>q}jRcldOi&kkP@zO<DWzA7UieP#Ii
z@a-7^5j`S&k{iNLgzw1+2tSPDM0iDbbw&VC6Qws?gcRXU&ypJ=d?I=vWgrgojqsaM
z`pSr55wSR|5d%R-M~p`QkEJeRe8hOrDL7_E%#BzSvD`W~r5i%BsEf#s*a(_~Bd>)6
zKcX<A)H>ZdJ;FvQL$wY+l2~WAx=4)!MS7+Ti1dw|2I?P~8963W7a1OzkTQU}$bJqV
zXmI3+R@@RcCNdLzq{}cxu8W)%(?4>4<PzYOF-aMw8!mDy#gXf907d5G$c-7|2&ZQm
zrj((P#gXMHLsKS4Rz)^M2~n<5-cj9BCZ|kJ&yNa-GNtFItd5$4BRVQ2YCzPCsG-24
zQdWbG!!a2g8oDrQS=8$2_rTvlUDSrC9Z~zD3Mfv)7#AHMRRUKNWsg=xdqj7M?isC(
zwnUx3l@lEwogO_XdU%>O`t|4u(G$|9L{Cjyo@DLUCHg%a^U|`Zi(VYPB6=;{=IEW#
z2N3sI^qE-q=*qO28N&Uz=(-rbO+42O*BIv*uNbckpf=7s<H20F47eCSN^f>CePRp_
zPE4f3(U!ltryP9(ZvWQ)$%uY1m#(2MW@OCB^zfLm>7FrJaMNREQ<r9j3v6}i3F-Oi
zBdCj60Jk(|Rm}RB?MS;Py`Qxr=CE~0%!$O=F%{N6bbXUHGp3rZc4DQNrkJL*DX~(l
zdu(8=PizlRb8Kv^HFjX^u-MVD<7219&WxQKyC`;fY<BEMxSZI$*uvP-SX*pu9EsD!
zdB*w1`N!$v!s8O+`oRs38xc1qE;DXg+^o3yaZBP>#;uFn8kZZF4_6#l9#<9D5HG~L
z#(T$iiw}r5#Ye}d#1Duc8b1ndT>Rwt8S!)C7sfA(Umd?8en<Si_?mcod_jCk{CW5k
z+xx2edi3qmx2H8SadwimuePtHZ+zeMzJvM>@B4b+2?>1PseRw;JFoBJzAO5!?Yp_}
z&b|lw9_xFiZ)M-Q1U_g*f-?>;9DWIX5)28E2}ue46NV&=Oc<Mxl`uVFcA{Uxf`p|B
zs}j~HY){yea4g{rtl`!r@`=ugUWtA|s}uX+FyM$xOiJvZI0P#-16`d!A^KZ~I7Uj0
zbaXtKZpG>oYuYTVLZ{<cfEHhsxISZY;`UUJ#64IOo=B`ntWIo7l2W^5q$Ig#q|ls_
ze3E)(%t#8v8pWK7bp-6-vegHy-40`Gg&|4ftvHgVq|Hp4dGpMkG#7LEqNL?X*-0Cd
za+30r3Na^_VkWLlor={LR%n=oeUtq$qtaP50dwHs<Pn(JGLxqz&%#W#Bza}>y5y~x
zU5b<Q`+0yCJFY3ECb>LgUviaoWO765+Khk{!7<{dxTbis5fr0mN&r1lOexXU=_x5U
zk8U^{nlcL3awn(ENSTweFl8CWl?@n6_N5f0lvod^oVOnC=V4`YP)bdTJym6$om$zd
zL9KqOM{1YUo~hbYOKN;-dg`Fm;i<2uPDq`a`d;e1)WxYQQrD(#PTiS$AoW=4nbgYE
zI;Np)?6mS$XRDXh@811oT>!V#y2`rVy4|`bZ6;=o6X|2D71nBN6J}`lG@rB{&^U8?
zLYg%#7Kb%$VA?RMPidpERvMo+g<-6cGE&kOr7g$EwlOUyEibJwtu)Ps7`5qy>9l9M
zZ@PcFE<HSB12nf^`e118nDor_Y3Z}l=cg~BGi3U@^sVW+(CXrhap}eB<>^(3Tb15`
zQO*^k7#)uSSi3}Hbv^)VwNdmw1uNk>84EL(q1QHK?7+-ikWrFxKBFeX-cQxfqhFVP
zJ^N|#4Kp_tpM(%UP!(}z*p<<4pzg#2)PpEM1)>2}6CTusIDx{dG^mC=4eCZDP$i4$
zLI~q`0d*x$Fq*<>GNVDD8WITVLTFj;9L>#*xP!W~`nVD`<F5sEW^vT4ZYm;xBM=p+
zEAa&7Sh?=}VqkZ!3{=&UHXE3bCqX45f?}@^sEQ~Vb#N$kCuSB(uLXNbKwa3Cx{}^B
zl<y8Iva&S9#5fBmB_W__8&EZ2ZN)zY>`J^qHADbKI#5@V0IFs!=1O$HFh>unVb=?*
z-Hby^cO}t`9{}pk(^gWlnrKJ|V2_s8rscZxi$HnDwUdp&ZloRMbChaYYD?Qt!)hoI
z0k|FM1BzWvplZ^QQQAK4{1#AGc13Qi_1su1x%0EZR}mi?hoiFL%G$@Be}-X4uTiN$
z8#9g-)QJe7*aHRX&VR({C!iV<3<@6<Hq04r&uAx5*s*4O+Wzi5l_;LIo)e=y>wR~w
z7<?yImNUCX!s-Sa;o#$%KwSxyD1pV%u-?}&*(Ssrd=+aALb|e;>7Z^bXQTku5CbS7
z4!Na$=S(_-y7LD?U0KaVLhGzyG9$27!d@G2Bqm+%{9Is>#dK!9rXjSg+=)M>{P&<5
z(v#t>psqyAFzs=P<>SU=!;M`<2ZjmpMW{$zKvk@6ZbV=l+9OWvs$nr5*p*$cJ5S3J
zSZ+Lt$Cr-p!(9BwijN78ub?1%?0b8GeQz&`LHOQYDH=or(Xj9Boy0IPia3igVk~Kg
zT|w!jy*OGNO}dD$i?5Te;usOucf~ivH^>v%;qU==VSFrpOajD(;@`+K;%DM#L@$0W
zE++<Yg}8#4#g*bp5-P3{vxx<JAO1zcvHxKUi4?bq+ekd!0YUm=55z%|h}{nbBm+Aj
zPLh7&De)Bfg?L6RCj-O^@d9}syCLex3u2=rl9AZ?;7Z=0J03_T_B?bXS=g!6l}wUi
zq<-Wr={ad2`9K;c{gM1xnjyVUKEpRqv&rA3zesb*3h5(hK3OR(kUk-+q`yg@k=4={
z(sJ^Zlr3eGe_@x?MzT(+QaY1wlzz${WHWY97|D0o^%P2WVCPdD`5t?ohLXK>-xJxV
zQm6!S2s<hck|U}^sw1RG?XK=fPG~x6I+AjYKlX2(rMoQ1Ir?P~x!{!IltOGy{jrDX
zBINrc);FD5-vqI~QK4_TlBY#q?1*q@J!C`=1(86uFQO~!CwJCQCiGJ{dL;sT+&W<o
zS0r|<MWN@S(Q`4RqZo_+djkEJKtjYsF%cZ>N<qvN>>tz9ugk!(idMu)6VuQu>FDWT
z*3)X%(`we!YV`3t*eNwroC&$XJ{I5)(CZ4;>)z<~g`|i0srV`J78i+&fd4A~m3WAY
z#l?`Dzd<HEm`t>XOneT!Ok4*37vdM#Ewmg`qGnQ}W>SK^Na7k2g<WXbxR$lzTI^ri
zAZ|igo5jtf5BAG!0j3h8fW+(}uGl%V7m|wIGuRuKC+30kqxd5@2Ov)xCQr^xo|H_U
zM99+_B8ugZDi=sq1?eW96VH+E;(75r@CC?OcgWdgTw{$`gHo{X2DnkQW8WAY_IhFO
z4KQ}z5HGs-hP1=(8)xucBp2e3T{y19333T-$8MZ<h(o2b9i+1hc7%3?j2a-Lu|$&M
zq<GQ`U+(oKu~LGR2u_leOrDfdq*P$5WF?XGF#xeh=~4zb{UF&oCfQFxvVV_VYnf6e
z@s%b@S-_K|Nx+k($-r+(Z;=RTiZq3UN^e64c<2DWmBv24KapqXH-W^5=|c?D2S4b;
zM<fiphUOD9v|<55KY?y&nQnM8-RQ}5BY^2f2fDKeJMFNy2$brEis^<5x)BbHokqk7
z`vc>M!1P4GzM}@BR5mJ`h=?6X&BPVEknF@+DJx~-irq*UW0@9dphf$L3*DPUl&T+9
z2Z*RT2)$B5uMQD!)e&fy2<>V|G-?mE2XRxkSGOm<)t+ik;122zz+TWjH>P_cbkCnS
zX?jBg1*U-trhzJ^f$mHLG2@U=nFcEG-S(@*jp?C*>7kP8;WJDR-IyLK*hr~jx~E{e
zhux*ny$($G{MzWAKhr&L?5XUF&>I>UNWbg^hiaf7(?EZwf!=L2@Ci1ua!l)ZafbLV
z<d5o}DE>+O6EM|4UYsS)0;YN>igU3OG?;0lC(}k>rj4FV8-1A`wiD^7+>Ys9JEnW8
zHkzhjn)bB#FO1C`^ldZpq?#7MMre-dn|L4k=F~>t)X=vx*b7-EmLbm@`qqW%TUVxU
zU6{UgW%|a8)#4Szq*^D6SH-KqRQGtX4x_$919?%#1nJO2QQ{>Ym}(<0i4x{srjzZN
zPP#Ll6q!!;U^=N{I@yEiWP7HQ?o212U^=Ogx?_i*o@u6rX=Zn(nK4W=`!LPy%rsMT
zn`Ua5W*VjbQh(A>8Xye-rTQr_&Gcb9Dcq)$0@F!>>7<V7q?a^H`T+X>XK4=U%`~%<
zG*6m`5u~ktek^@Vf|zD{FwN}7G*heOuzOaabWyrNC*76p2+uTA$uv{RG*ihmQ^hn>
zp?qHXJTWo-R51NiGyRnAsh>`5^i$3BQ)2q5X8P%=I;=WOIHskN>L=AtL}I$?#B}v3
zrmMY}u0F+dwHMRXo=jIIHcu*<mWoVEl}t<Bn3gJtqIsP(&(wop5yNQ+G5ImH38)K2
z&AXL8CU1teD@#qDEENAOYI3KD)BriN&@X^6+#nakHer3#k{<waS%h8XO%%~nV;w`+
zBrm)XNJqTIl9y??DV`|!Vc=DpEZ||Uu(8q<4xT7pHs&L51^=R$Z!Aa23Q`ADfRe$J
zc!c_ZcTG|lvrS$|`*-A$V=Qe!8;$uu?|`@7SWc1HU|eNfOH&9#ja4Qcc#DB-CVyH3
zps^-j@Xi6fjw?nDfDW59v|ON}CR_*qBG6!CZA&hjjo1&*{T)0jEB76sBx50X!9bgh
zc|cA;3yqjx$%jDmjT_M}*`l`*d(DCN0L`X|3&yp*$Iw*7n}u)%R{=EHI1{T|{Zy=U
zxl@$#C5#q;VyFl0$X4@ewmw!8x_(u%l{$Q2tocFR`J<ppw%&Cm@xb`Zo>3adm94*B
zi4j=M(u!=QtKj#D$4yyA+Tx?ogRG|&M}b&RD^39s{IL4PZhF?!A{YkN)8dmrkQ9XW
z2CAY+p$D=tv;e4rA})+@hBL;)K)ZoTjC)X8AW*S!JJ4@|3XSW5eh+lmxC*&oR5cth
zE(O{Pw9kltAW(b*l#8}hD7FFR7^eey0BtvBwV=($v8c;Nl)HhJ%g+H?$Iy#F*{oJM
z!cfC11EdKnC1O~?LfZo^qlha4T0#-Igm{bel~|?h1rOH(bOvZ1i<hmKW|(6ff_Qs?
zW*Pe<?MFZ}jY&YkK+}zpK-u<u!ziPH#seB*>_g)L4Kw=DctAspv@Y+;^@c%)q2PU^
zm}Ydv{}w2uK)D)UGz<rF2I_AZ1hh!LY8YUE{9)JnRYN}m<WHnmX{EJN`~$5q!0>tt
zuOH=!e`yUBXCg%(!y@qB1+OPdu@ot~87wV4UzTDfLVYOWIv~``&;>0?+s~Ww$Tc8O
ziukvI+!=zT8`x;UBUb~HA#M#2lOc}Q0MU@*W1s+r(2DwMiWI*Fs${&uK<6pq>JiV8
z^B(!CzF1#@c&<Q&`V+|IRkBrY*B^7V72cf|P-M?X=stu#gItcW{9Xkrph!eb_4(IP
z-gUHxB56HBcQS+!{SJm8L;9@@;arb1#OnZrxGf0MgVvZK=Id8eBz}(2l??p@XgP~_
z7HBC$GSFg%E&wfL=nBw$iiBn$v>|dC4m6u04ic<qqXoYYXa?o+hk>TC6lfj&6o&kP
zvKT_I=qE6Q5nexzBE@fk##~3EDWZL(AIT8zaP=q=HP{a{l%XR)gDJvFoahHK1nt)M
zXNa~zIzt!_^eGgHV}TN`qgaX*C&7!PNSFm=p-5WASLjU)tpn0gq^tr8q)4R#>ce<7
zK&T@^n}E7eB)taY%Xrg~pASW1G}oy2GI*ejI`BMLJS&hZL(xDQ7VkqKi6X@+$Q9ZP
zDIlFXq(Tp3hA^nK5_kqq(4A+}j+WJxvv?zTe}kV6Gmek}-U-Ib;Fju+88DOZ3&AU(
zJg!U_s>=`Bj+zeS{dIYI+y^Oo^PlMUK;9LK*@7A0@=@vhPBBd{1or^CDs<3o)nV4)
z{1nr4+k-LtDLM*Y<6HC{KoWRcwM~fU1hi3GP1D-*b-7yT0)JJ0RX0sHlcoi4x)vj=
z0&|3Js%{2N3*Iy>>cTq#P0?axRnA3CvuI6~zvJ|}3A)KNKSh=<Q#S?I_6nb?%hF<G
zRRtj41Qu^F&^U_3N}#C}se14gNJ&vIAjCj^N4Q4ac-^d)c#s8zc1H>(2g+xGm>ghD
zOLP_%+8Jq04EX{%<X|6i3DhMZ7aEVrfk@LbIiNkQ>!$O^wUvO^gQjJ@<)<411WD9E
z;&DX_f!HV|Bm+Sokl!+t!NwBB)8IL?cqmiHMkyf)h>cQYF%SZgA8H@WW;%rz5R(%8
zTLKBLVfjUKLU2`ZE$V{P;A(^`@U);MRDirVLWQo}Qb(wS5z~>DLwg2S(Oe{q48b;v
zIGVPC<&3KiKEqHpPzgo+LB+3vi-R!>as9z71dkK{%;*djj@*pPucM{c5v~ST(hH$z
z6QC%d`3#{I94iw+4>X(d6v)f5GGWM(GscGCEEf7X&;*Kj)Yv$N@n(THit$DQjbJ>w
zY8c26T{WP-Xc_d4F`Xf-8jL9nVbx$vU<l)i(J@}ox-dCWEC6D1!s8rTLF?xWUI0U@
zfcz;EFgh6>l7NzoevCI5h)IHoYc(=S5LW{^Bmpg9Wci6`C#-mAE?0q6*AbHh?w5pU
zS^M$70YWNV`I|tj{S;pT&80lWZXiedeGT*;<81+A?WaIV+G&hO(G-fXpPy*6DB^K7
zTGpltw4cF|A6nMH@)K49vHXM`KrBB2*I{7!3G0Daeu5f^<;M`qkIw{e94q%JAmoYC
z{*KaI8A4uK4MhT4$1so~KOnRrdJ9r+NM~p~PzpoCfD#x&e;Z;cQv3uI$#@%qEEMry
z5E6u%0eu6smZ3R7s5f|xh{yUv_yoKqlqX&UTEr0KC1?Rd2B3KqDbk>i>^g*g;ITH~
ztw5{|sHS6w2v&efC!nb`1^)uZdDI8(oCF?A%b~tOjyC8EG@8X5Dhv%8*~b%O|2BI_
z(D0y9NbwTVPN$)YQTACugIO-mAq8t8?js=9Lflv&)<QhZkF}5@3y8H4|0m=U&&qfe
z*E=l8j54m-UkWk=tB~_0Ag$Jp(k3GXBmi~x0AljY(e`8V%za?54e|@>iBQ^p-B>*6
zysnBN3y_T>MKn+aLxT_x04Wd}*u;3HKy?hw0;-{ij%<M}7XhO{Aj?Jk6%fmXu95=J
z(0Jl&KqU<Q4yc%=-3e599UZ1f;R)UW#zQ*=?xTqR15hptbwm9eZPgQqwG|(S&}<eD
zbq-v`(msz+9YuJiMgp1U(UI3N&U1m_&7q;(_xvY;vjU2NE@EbN4#)?ZtC$w}UT@5Q
zTprMj-ng^i)&NcGy&Y(^Vp{O|-kASL19;<muL3Wd|1@xH-~{mYfj6%A0-!JXC4uI^
zNQ8a{-iY3iE4r=^9M&6m7W@?Cva&bsEVwP;_3u3r=xgv6^&UcV;g<*Y3rs=0wLq4@
z=$4$rd(-^pA%(fO0muu;(3`IRu?7g#_Vxq%Cvq9m+Y4#?gV(LMGk6QZOYhA)$_@1N
z$Na)_ardXQz+8L&GYkFC0ObMA_ou7iH9&Ly4*;#U=W84MccKOj;7#}63|@Bgg=eNd
zGlSL&ylMU`!21knivMEpa98q7mj66j8q((cf5g2DcvRKd_q|VZ3L%*!lSv36;SfT|
ziGzrUfQTFdhLlpI6qQm`L`%_91VyD3Q4y(Ciin7afJjl1Dxw8NN|7Q`Y9r#|q0}O!
z6j2e8QftZgzkf4Wdw8C&@B4o5^<8uE%b$C#z4lu7y4TwGOm_BE%vI@&vQ4a*DfO&u
z8!GVC-%i$CQ*(ulQffra=yZD{D@Li_0v$2DqCqMt)lku2O4&-ykcysCPpXxv6`gIA
zvh}J^WV?%Hn@~}lI&V#Fg|awWsjSdS37&VH8pVtvtedx^rfr84iphtxbM-Qtz2B)(
z<Vk78*Tm1*I<tE0%3tGQd(d&JPouPYYADsGbx!A0=|+_vqVz7=GSAd&IS-|CbV?oj
zW2wE^v_h+ORH_H*V^yzOD=lT~#QF%`ts__;sMl)tt5iLx-a<X?5!ElC7O37V)HK<~
zql%=)q3%#A`&H0awh`FoOASM*&(-y)+okGIlXXODSJoa|t(`#URr{SfpQ%^04rML3
zMa`8eK`qe{S!YVCGrmyaGb**K=(if_T?KVQp7ulPK~-wsm?`zH9pP<NJ@ySxJ*{dq
zo0})Ko6=J%-G<V2p>~TY|6?iq;>}RKCn&9vT8+{yRINm5&TAK&a)-#a(3ErHbZyoA
zDqG3gZL1bkEmjZ4oGJB``_xXddj3G!=Ag9uRLwT!wU?TSvi%RAT54A%Z|aD+Z1~hw
ze{1onJLPn@s?k>JXdG4A`BX0?HT(<JV9MK~Bk-wR8>{+an=jQ1H9)F|Dfb+yZrCo9
zVz%sEc2zaDj#3rWyHTnPB_C9^rc`lNRg6+;P0DN9y{kB{AIPRNsxRYZlaQL}IF+BH
zt~))b@>Jz%*>t9wsb+JhsPq`6I#bOAl*X!+uTtCZYsO-e-z#^co|D>1X=|zN*gjM}
zyymH-2Cs$wrqZ>PzAd$eBXsSlArd{!N97W;>G@_(<s#~JQfUV2ds1PJ7$oIk)780>
zKHDs$R<}MGaH@|`Do>_XsDG~10kc{BRSuz4(OJC*wNdJ|%3kt;yjID4c;<s{R_Z^X
z(&tU-_l{0wIY*o&8@=~*HLYGnsb;G(iz8-A(Pwv>e^vE@a_#)iU-XN1^SCniP@|~N
z40OJ&kt?gG*KS13t)8l^)@*aDC!bxCQdLX3El;cYXJ?=uteT@3w0hI3$0@IoioRJj
zrDi>9Z`Cz5>(Xj$byulhMkZC)R;v%Hx2C#tb$3&dK~??E+9q`@)Y$PF>$PlCt7^OL
zOWQ8RW~HM{1s$YDpw5>XhN_ZctpsOD)tSxLxH|U#LiIHjs@2(c>Qe+$bE`Hgf0PO}
zR&B6S@7Bn)s;8@-HznKpuDjLBgHr44eX*Y%ncHn!S6$7drd2JkosqV!)8`_TRxQwH
zNP1TiYOHvR^I9vn)AF}<?A`ioL-VR*Z>ZIIz3;0BQ_k9g8dN#1Yf4S48edzMDy?id
z%dS$YSK0q8?IuzWR`#skfx5D)e~qrs-uI(#R+d-OUUY9|adjWrrs%w^R{w4FCAAOy
zUaA2fw2~t3LT5`2#MVZtAF87iYsHr*b-k2d{6$jTP0^RP&f>h0sU6pz)gxu=xKf{O
z==0K0W0$4W)AO<_H`H9JW0!{-E1#y7SY&S3;x4-K`=)ZczJ;1rxwu9VVYV)(yY@|~
z%6VOt7sxh9&vQtrxm^x*8IrEIuj>-jw90F$Po-@;^uC!^DlhFi5jCjG`Yux5smR=l
zLtV1cYF`(Nt5fP<PhIy+O|96`^*S9<5^C%)lAb;xh1Y@{DZCa8m%?koXsMLf7D}bO
zwpI$S>9=={9a1}tM&1Fh1)oZFwU$w}c&J#>x!IKa4JoaA+YusjJ8tN*Hm#oSvNEN*
z_Uk+hb!EquRfVW&9hX&Ur?exwmUWTuQAJ%QqaN%UuUxLNeMc?N;B41RO*iHLRB9^f
z6{*RnXQd{gUX)@D`f;i8*i4NxW#{O!p-XGjpe|47J)GV{suaI?)l&FH^`>^YyGyZ3
zw`oK@I?LmzZk@H$nCdXIlU9$^l^x3~2co8RY^#_}m5%GIxT4;u&dX2_c4+AMntDGz
z)Y$$6y_zJ&l_6Lob<}Kn-cDot!zj&1`-7+rQtzT-Qv1G8tWY~g`H9XAoMTY=kxsqj
zwHs7#i`DbnOTA!9^`@5Z>TK~hL(w#&c8e*kiYZp=ZBZ-h?cJZLit(L}sxQ7uzwlbc
z80BKV`xV(n)1LO6id3vUpd*HN(!T3I5SdodP^o>_4<c7q4Cz>lnp-ij(~^`bAK9sO
z+Sa4f9MrUmZXHjiZJj$!K@F<Cy*8z$*52G{VXCxtvc0eLgHU5FS5ZG6ncMzErxCK5
zI#O%<T0AnS{kygDJ+{4i|7YsK_PZ)l^`>=b>}cnWN8fD!e23krz3ta_*qJ(_!}eP3
ze>&pI4qGd1MXBWun``&W8-=09vKwsVL2D_z7P?gGI<tkeUzJTnjg_K*p$Sr{tNfc%
zW35!}O>N&-nVNp5A{#5zo2PS(t(`94&x=g!aB0P1Q(A9aEBuvGBkb59TWXjo?=Brt
zUt5<_H4AHYrPaLJZm0)qW_7p%HLXKs#UfKWwwz-hl4^^(N3E39dMcHw8CktHt?FxT
zMosGwuDDcczK-xXVxj8otr;WR!pO9i>$S`36T(nq`4LK0ulx||uaUWBy{fI=Un5h?
zy4LJL4JxasUW%GqR#KygQ0d&VL`_y&Whi4Z+k<6J`Kpwye0j~dv|3s-3Uy`q;_|(w
zLXGVTIh(Hg<@3t7%DW#&=C<2ebtt9EXXqUdw({vU#i*(6o~V)6RBu}O#11pn%0{UP
z9qhat)ziY7N~!0x7Dg-UK~*1BMr>+YdA;`0RB2tcdHgw@w|}`-l+@JfZPg!YjvkN?
zdRedZ+}y_U9w=S6l(m?xn^b4|taDV)ueO<aE;6Wkj;^u#d?wUb&0ZG_Q@t$e%~oGB
z@Z@auAY5+el}!(ed@H3YKd(F~RU1yW|FE#yRAgM`hk6g^duN3{YyWP+32fcl@2iQX
z>Q%m0a1`6+mD{U7LyfC^q5AW5>C*-BpW5@=uSp%NmRA*M*ORS7<$~&Urb4e*&MnZI
zk@~p(-38{M5y6=Da|`XfwPCMvV!_iI(TdRP?PnEeANN<NmB|J3OsU?a0*mphWV@!|
z22+u7RVCFHYZKMyOAGp9>)w8p-lb8m$|>l9?efZ#)dNxEDv#=28l{y73c8}a%C`zE
zo4ZQAFD~ewDs5j_kU({)+*qa6?OmnbuPewzecawj%9HMowHiOi<IBP?mYr&E<G3=M
zEIgdtj`GWnB+V~o+mn1ErONgtwd;8Ub;Mg``=u@k#<ZSG%a??cWv?YI#xDuI-lkX5
z;{KAbU$!;543%tCksO~^CCMqM4s8;8$74r)T(&IP&s5~{HuiqV)VS6st42{TSvDtC
z8unTrNLu{qY^~o)cGEZ(h2tHg$+=Ps!|}55$(d3EWgDBEDs_)+qmmQN7J0U8L{ffn
z7fB6EW~i0R!pV*=<nK+Zr}Gb@{IVYTN7J^Y`I=R$S5}$7#Z>6^j&t+1^1QlWOj&Wq
zc~YaK3X_U8$Fi0=_Gt!cM#pm0v@)kGjG9_;jj{&cJrs;-cgoJ|{3Y~pyA%1ERp&3^
zWV>VeiU`!veEG#x<>>tG)O)>hSiVM%ZD79U9Mvm7H?6wnw?=9E>v&p9cO$fWB7ZVA
zuQHLZk?RP*-O_x`wEN9qOvzjA7E8SyjH#%#mfg2iIxlhDj*ZN1ovfIkv2|4|GxDob
z?X~vu+p1nt`w-Uvccc{80J|@t9oGQe6x7&`Yk;-VZmfMS<WE;CmnIZV{!EQ>R6;W&
z<+mG=n2k?AZZ|B^-;_%06E^2k9bQOi<k<S8OZ|2|6Y`69r+VKyu~6zt`L8-5-+NaE
zV@kWWt1uN#mR2MR)2bxz81-H+O(bm2tu!O=1gb-+Q_+a>+aAw5Wh!!c$<d0vsBt9+
z^qznt+8)ibIoGjmU(0*mROsWjyV|CXO}5?Lc8_d}f-!AhOE{)fZ&%(uD8KEFJX;GY
zEuWlsK<Zl6+n8r9hov^;?Uqj;*AY+WjY+BU9eKUdYIB~=%;Vt><?AanHYvaDJ$be(
zchnK{@-#E1%9rHX`ZYCQZ&6M8ZKvcZ{=7_`<GQ?SbZo!SgtimQXG%55HX(1MR5H@M
z?G<gWLuHm<+IAwd-@NU}wibz}BAF#wZAYmU-AU7aWA1BGKhm*7@`|u&pUhokO1s{Y
z+$Yku`MI_WXa?KQ$(@o`GjeC4I<%kCVQk9QHY0aZT7`4%+I^XP>g8(Wc8=nKxf@cY
zt;Xfnrq!t2%Cu_8?V3_;_U780>uhZrb4ySiT6He}+*Ih}HrsNJO7#rJwER4Gywv%!
zZOD=D{efYx?86+b6u+-Z59ZckOP0NpvpuESEXdK!s9v(oJvrM@ew%qYHs_tfew#Tt
zJ5XNnnw;mQ)JmJ_xt=K<F*Rp?N|oJ{GZp2xnUJ$EU3x{1`K7P=GB&3^U2j5;^{;Q}
z^|CQJ<FI*UBXSfGepc9N)2EHCk6V@NbuY6cZdF!Q-QN6HrL$G%l%f1K6*=Y?*~&`d
zr_w4BSG4;FLXB<Ww%_~8wAy5v($i)e+eA@%FWx3F6}n1FLhAdW#@1XRLf@7;h3$J%
zCrky~rH*}}$mRWnY=_O}J*8cM_eVjIZ11FOk*V!gm1+O;?w4(s*?h|r@22!g*?4bd
z@8ipcnJrLXTCX$ZW=TCkz5AqAoATd~T8Yv-j52a`-HFuLGL=W@Gl16fC{-3&l)<qd
zN~JQl->84bv5l9nW@H~xug1&wQ?d_9l?P*5?2mVsYN_j6eZ1P%g5qUDwjx3*SvDqH
zbFMqhUN0Mwy<YY1R=vu2Af=U3v@UxUDp|BD+jar1kD?{n^VH`)+6j+l?=zd!;cSbh
zYVBMnvMrk4kvf*WS!$BhQES;BB6T=>jcgz2h#lF>q;8e%ootJyPO`1GmV>XW&z-Yv
zm0hmVt=TuEODASqlw27q&dDmZ_OyGqNO?%vYw0R{aGlh0)a_DBQ8$Jf+oonlnL_D3
z*i7M5PoFN7&N)-Bbhat?<<PsOGfQum`XKaf;kweBrS1=XP&%Xa6!pLlUsO7s(&s`S
z#II{TR;ANrn^-zoYHjF)!r84A*=}X{?b0hsZNK`Njve2+hy47@@Y>RGrF*1yhTkh4
zQ+kEet5PMUqfu*1N0x5TIcBJp{;k70_C+0ASE^mWeO9*arN^ZX%GR^=u+(O$?xp*s
z21#|bmfiVMwWT}N-rn#{rIn?f)Ag#YW%tR@2L&ffpU^ojR=pB=OTT}R?QrQLsr9nO
zOYfGl@n*^&zWb*794&1v^|Dk@nw0vLlvA21wL84F<nvPP7ViCS?~+SPhnt7o2TMkk
zXl(9tZtv`d(mqntWgAj5Olqy$yI@>trBtQYv7}##_AB>iI<~*Htfy_CF6mqHwA4=T
ztdd?O{md`2^(k3ue$lbjB_HaD7j;DEl7mvu%2rbHj?_Wf+LmZ<cQ;Fwlx&w8Bvn-M
zg4BGeBrWfCUoFWkDNNT(Sj+B{Ztvv&k_F}$)eD!*m2I(Xua(S{TJQF5b*f~llt$U=
zM9D;{H{H{%j+I2EUY0uA>a^6aqz<<_A+=lTV5=iibNuR7hf2(A^P~=xnAfID9V;=f
z&6hgb>Xg)vrFOQmvCRoJwpvdlYKLo;+BX!jt=Kn0!&Gl|D~&BQL26|y8{2f1F5?KT
zg;q;UMQ&8-qE;H4-zn_1TC8$Etap&9(y%@OYPHDf`R9htYPF!%VzsBzeBK4>e(}au
z^GfPvv-VgYq2W@jkI+4;x6O_XX|HR==Q;X2jmB1do@1Zus!u8n>$8zoS5WU69l_ax
zakBB*gTBwCF`u<+N4RaNXDu&4-K%=tP#SsuIFycP#XI59-BPLZ>WK7t?by`WRGL4Q
zBTQY2vR<(lhtytiYLvG~9iUWuaq)iCcU7-1YC)(maSU~>O1HP_qw(G;wG~^A6uW%r
z4%OR@P4D-MnXS-5snl%gyv6MD_DOf~N~;&%C$)?tChORgUoMbsKDJr1%|+=5-3x1f
z#TJ`s-nKKPMy>fNzJ@w;Wt)J~amA^z-X=8)n~o?RaYiKuqEwpb_l4?%vc7dislDP_
zls*?Ju0$yci&K8r=OV>z&1Rp@C!($9r&QkQ;%d~uyc5N?hPFlq<{c^4+V!@E8uQ-e
zh+88ATOMzDR5o1~TOMwyNY`iC16zGqTqN7KrH&NGrSyq&USrFBsDXJqT59j}bOq1D
z+uk&_@_b9}efoTMVDXTa`&D{MXPZ@AoK`oq)ZXWv(h-yFy!t$FV5=D|H=qW!n%;7+
zj(tE!9BsK=Dv-LlrS?AiyeMyMOYK@x1M^0<)ZS;GL*~`f`*}LsjF#7_<-62_{Vm6%
z2DRMN@^-0vWP7cp?R^VXZ&FL`Y5Fu|VD52B^?66`VQWR7UJT4V*m81Oz0<O_DV4s)
zIX3FN!&;8ev8D#L)c&B)7zP%Xwd|W#MMd(OK1CQ<w53RUpEp~1zy?~DH(K^9vb}Gc
z&at$}_P%XunboBC^~s_Ik=;7N)ZEAurgZGg$m+D38d+&77*jMc8kSlXo>w%XXp*T=
zVbPf4aZ*=?8e{V#H%kpv>BypCrc_#A++RxXWOK73=7URg-XPMDQaPVRhL{S*<Q%i}
z>Rs#XqSle_vR$S)2uBn-%FhQD6&Bew&{S5Dc2&Fky(qA;>AhuRadBAtD=IhqnY=br
z$2NwKrCKQ(9X=$bcQrYu!t#OjH0Q%`qm-`iEw+Vs=)8}sy&mDssMm{X!}5@)-!~Lh
z>O0%?{vo`tsJz9Nv?^}#f=boD7I%klH>I3pcG!G>zQ$3jd!Ln0t8{93LRw7>Utvo1
z#?f*o^<Z?^Ms8|Yc%W2Y9Wf+qBRADI+|`th=&rxgP_8Rm*Kmm`*($;_rSv&Vi!I?~
zT5SmF%A(Ie8e2ROvXPrw9@2`E*9PU(7HXv^r`wlPR;cR<s;JP8_<m$ye5RG!S}2-a
zcwDv*Wm{c%SbcsoGO)#-LR&}ErCuxCBb!!5;pRfEBU=mcA%*gbw^Qoo!VOYd$t`Xu
zv>4JlZ?Uq_*3o#WWrbQt7Ju=Q!n;*EO8wia`vH|LN^REP8tQK5P-CQD$VP77T^Fj5
z(rm^1>aP{?l}411`l?EohBBn|X<UoN`jxVBarLUUu$zrdwv~ZKZmq;Kf&*%~cc`(j
zIM6s;T_*|)0~?2YUzi9q4)<-TcwqB8FfzL^Q}>N&2azqBT0K(4nztp?m^~g_AT`dE
zeFCe`-Aw5kqtCxgDIy9E2K&_B<5KSi7Hb`)_5~Je$<Ty?w+hr3^>jk^f&%r$(;i!p
zTIb40v$JUB1=+TyRAg?!^97q#??u@*Vtd(twO~WR3$k6MmY)x7HGW@eeV|zLZj{<k
zu+CICS@48?YUh1VwzYx9n)Po@Adg#Cp0!Hfn&rC#)H1n&S0>w{0?n2;T53TckNXL!
zdjj+L&Fag{f|aIp#Le{ON!e~FxJNc!4GN}UyH&R93T&o-BQ>#LvXn9reO725(lxMv
z>#_Ho)L64A*5(#WD7aK=s%%`N><W=8RZLFJN)%|PQN5`JeN}ETIkliyL4(xJ$kgVa
z7xb6XZ)gi@?bAX<-PD50g3hvO7cHo^bGV<%8x@|-%%}1}ncqXDdRJZ0-`ky5NzeRT
zEnBX)UaFH+mbXSn{3RF@tn|ZDztyph_qom?-#4G@9hd48P9{%zb9BU4Db@ViXJ*O$
zx))t4>?QYjQ>o`AU-Kqfdtoma;o07)cTUNz-f&Z@_q=B#x-#rFuk&m~%FvQ)bibNf
zmRjZ6h(3^7?v-1qdXVK^C-q9GF`3%YHPg)<PoDH@f-(L{YuO(ZjLAIi)yXzqy_&3h
zMtx6znUkF4b(5MXb&XePF)20PYb~2TYs%d2+5Vz<$=vE?s+Du4HhZ3WpQp3+XD&5I
znPfKJMyV(8vz6j;KU=DTdf%2RGvz;^dSo%q2Vp;%bS+}fQp-2HtEJjW-QX@wt>ny9
zG^sCsH+QZ|dxi@0kK`XyEBf1@{G<BL9p7CU?vQ^t|3j&nk#X*&`A1OQ^AFi4obIy7
z<@q1xA4ZMKKS=2`^`N!&#nG(h?{m$k?<pUA%WU@7Sk9jOcT{>ZoXp>u|C;{ZXyHtI
zzQNgIp3?^1S&X}@;bm|sTq0&Tg{GacSRNIV{AGRIX^Ukvyg|%yqNbf%EaT8`p&O0f
zax7nmJ7FEXNYvlsK@ZCy*az0YZE!a%h1T;p&nt+#-!SdoX!NdxQ$?S@nu@#kQ+mqi
zFjDU+=@8EWh<mi=W>b1Dyhltp7r<VkKA?lv!vZIQZYjo{TgCjerJ1z;-WS>^68JX3
zlPeNVH5MC-{^k&7h<V(`8h6)7$DLomd9c{%K7g(=dfyZaXg`N%GQ^#`Wyws9(YXm-
zA|@SOQdQsj7WZ~wu`??Au`D(+y0{m|!Wq3B^af~il;xZ!`i_k&?q*^Cj?wu!maDMb
zg5HjOHu?#)jW_PRFXlOwqK}ud9Ol$z9=(;aXAp;R_t(;K_j02%9sNA|WoT{YI0Y~t
zCdDN2R>15e9rI_B-X`dIB6Tk3Thuqt<S+|K+DSU877At0qi+SYmWOZioC@qAm@6iD
zdPV|oCn!xg9Vs<$=kb?z`FK8$cQFZOIe{g~-{d8oKs6KeHo-jVYJ|liDnD(vGsby7
zNe)b~ni5V6YW9E@rFo1ZFBQ+uVJrzsn?v(?4n4`kGjYe(b%N)X#NDlwc7ta@JGNOm
zx`+zbB027?G<p}I+o4w&-Dj}060@At+OZbm#B(w|BedYYi~Sp-o&kVP?HF&H_FjRH
z8Qpi#ufwmxwQw~Y4~L66PMK-vPguT<h4tcGg0{7p!;HkeP14zE-`d&poYd}drF7i2
z^X51<zd25ON;9G9xc58kJw=}x%uDZtU98moIi*GDV`82Yh&k!Vv6;=`=_PqQlO!*_
z>N{cYAjUn5$+-6xv<S~5KJ!web8XLwJJ%WA_2>|^xJ@`V7YTZvz~>2`7?VRp<**9!
z)A7v8by=t09BaXS0h(vx?oW*A=(3fSa8glWN98eJz7t3%iGTg&rF6nEpJb-u${iye
zcLSsIE41xYaqn``$MbQ|>c_qF#2m+>Hzys3Pf05au~L_v!I_GF4*m#^G&(!P7=Py)
z_w0;0^f~UNBH4VE<JevuPo0q!ouvQC^qRG(NThep)DDb4-5GY2d!Ny}5e^ocrFRnB
zAL8CjqnjGt7U|}+A9rmo;?A}3HKS)MBJNl`#9b`zi&#!$*@m75ZH30&Rd55An~mP1
z=pRB`1({BOo&~dwuI+?z?<TQXYW2BqVz~;AgSWv8AfEAxrJFl(EVh$G9b&_aVYyw*
z!iSm6brum7_wJxHb>6R_I~v^wjZP|l{wD1cZ+<!|>Zm!1nibT%P|QiMplh&vAm%x&
z1=mXBUaCJfQ*n1Q{3WzpCGIi{&R(?5QQW!M=-rFu5;2FJKkhPihn~B%=A>p8uewL6
ze<eK6=sYOqaYcxGYoz`3PTqn#55Wd8nu<Wzd=+<@YnT1R9fajlSSIFh^^ZG0L$?-_
z?8eD-WZFoR%w59iEuC=siE*!wG4<3V$68A|wkng3?XC&ueArhkNcWKa$9YVad_12=
z{W#}}r>|M<Im%)+!PPdwv$=BUNlv;C)}I7>V}f~1H~|)mjRY<0*&%2fOTH7Ji9>YU
zvA9aI>n70&Mv-8C^Jp_Kl^Hr8sb<`H0G7bHVkSq$oma73W%Nd($3XLc+&N%$nRka-
zNX@wOV@hq$i95uD*T%Fr0h-_9-Zx-dXlIOjSHKx!R;q8_Xe<-q6!<-(dl#H#bWWga
z(F@^Ejb4AFd)mmJ6L-yfapw=%e+zHI@)Eiuy2<F-9+;KBUSM~llr9$YQdzFE77Hug
z9c$X{0;{n91+K;th69YAMNZtE2k(To3bMG?#N9lzc=*%BCvFEUDZ5=6<6b6w20kw4
zar1oK-C-7Yr<jv^a+iAtbq2!Jilz_F94x5_w>XSDql~WY0CAUiaQ{jj2g?tP&NtD|
z!XfbM&~kvdJIu%`h&vXC38xHN&lBWD38$-cjuSu|MLz2yFSTb9)$!CGm|EBD`Ei%o
zbTd>x?lc<RRBz8R?WOugZ=F-rIRyU*--8E@?)C6*VrKeT4iPM$!PLCF=<mR9!wF(u
zdIxA}7VjL`4W{~F<BGd0;3M!=F(>_w%wi_)E;2eN;c@sW_SCV}=+3YPRzlm0;%*Pv
z9riSO_=Md%;aEf^9P3FAe#=X(T#u;p0;}&XfcfwqcsHCc>NzE*Q<*>cM%+nxbv$-k
zk8$S~IMe7_Z0Dq|M~+2c+<69`Pw6kvsqx;2z8|LgkV~DZ@Vn5X^jY|vn3>uwUE9Ip
z?gd6~J*BA`X@}kRy|`Nrhr%|ZKAaHq@VrlUlu2}DI(FV1o_&|Yej9f$;wbv>eh)p#
z=<J8Thi|}raGlsZ?W-rTtbtF#S7552snzkZSzKn^{e;pK&q8xX2M;(Sv3!mCKZbo_
z$msnD-5>r2ZWJ?}9MjIba1Z=1_&fMId<Q-aS?@g2G4Av?i%a}F%P3tAm%=6R5z!~2
zLU=Xq48vY8=A_@75TEF{6O}!QpOYMw;B$!t`F1>=35Tr(_xoaAYK?odv9P9`htMk_
zvF9dCd&I4Cn`!5ll(rD_QoEd&S{KFCoJF1OVun+IWtW(l+Lzqp(#_~+-1`=#qhO=a
zeF>eKyO&Kn%%Jl;`Y!5R1CL<&3M6J+^LA!xM9w&LGfHoOtXXFjdJAOd_fjp-$HJbI
zicH?g#+`}SkHV{=&3<O8|E`TI?p+7R8eNNl1d*ReT@gGFyG2EUz0^;y4t(XLM$yaa
z@NO&a{24vm=uL-2i1#z}^{@`U3W-?nQt2#b5SH)4ov<GEg%%reZv<Q@Hc##OUXgS(
zy<g!mmp*ux$)4q;&UJ}&Chsq@Q&$9UvMh1$Imp`gh=1=rEX_sN3DBt+AZ|TYlY6i1
zIb4b2-bSnA&_kC!&^u@rw;wz~>DzDsd>E$ASZLa_NQ--^n4Cr_tJOPT+9k$ZyysjY
zOCIkN<1YPoKcvp*M(=F&a-;KGNF68Tv3q0*rDE74a-0{fjz<K#^u)FK%1O2F*!qgQ
z=W|qme&6T}Mt4JRKtG9|AZDf3i#r87QQ=wy=A^TWPG<KSD7^xni-mc2Y%DpcxOG3J
zG!?PGrp`}bCHC3yRyYt^48+}=jb0bgPwoE>o^gpH=TYjIH*!*+7<hM?#aRKnLRN&^
z-n9EwNPN1lpy$96BN=`yy^gNM{uXxIXR=auZylCAF*E(HIYT;@(r#NTby<B*nQ7-U
z(be7b{q+FTuF=i^f4ua4#Q*Zj*d5(&uZ-RQ?iD>AJsw*dtNeFm|C6on=&X1Cr}BR;
zYt}lt`(Ixf#mW5{#RXFn3sbM$@r79#C;s`^|M>qW{&n>K*DPz>^vkb^tu1__*`em;
z&2N?u*EVmA?v1UDuKMyTmi5JJN9=#?rBM4{dF3Aex3w!{|MJS%ZMGEuwe%k>^)bDY
z(A2+wW$Zp@U%8?odhqWv^`9K~?^{b98QqY2X_0RD`^a*SOIK!g|JRW!YV?Y(Z80p~
zfI4o>y#37ovt|^PWmOcFrRyo`qpA^IoBDsoiDpaAC_Uh9cX7FmBzin^Z*1(}$AoQ$
z9m&!Ew4Ufw<(ZyEt*8Gqe;FrY_0dVuN&o%0|C^HO|Be0M&PQ~^muu^P2Y6XuQtF?0
zW<3Ad&wq%He~GOB_fqYO8}epEH)LEIE6&)R-4H8IWZ2q?@3GxMF)6FoiBUZk>+K(}
z;xpq?8^_P+*ykG6f6@<YgONvPSj%bw+RyaA11Z&PlxAs$+B{QdMs#X)s?DA3Qk>bb
zpQ<HW_U_8M=<U{{j9x{jqD$?SvHHv_x-fcobYZMGZSR#cI%BoQwK{)es~b{va^5{t
zckt<qSsAl5b}{|x73&dO@PFfV=A8D^_Q;H0e}8En<bQiv%vfBsoBZXgnbrUD^@RHA
zBXrC^UV${Xsr`_BFtr0(ES`BWx10+luWm?{+3GyAKDAcQ^e1&(x-N5JIyJMb%l|nV
z)anLnD;4ePYZg7O*Ey{nYdsxJ^2~{U^+c?=w7d4h1JTVEA4Z*9W3(6XyOtK~&0n(V
zZ)`JmYvekQUg>^v7S-VYe?M<(OxA;XU9WeiMw}kEj!rAhl#Z*^Z0&a3*!@kzhaT5o
zvu8Hd4_&XHb&fOiX~zxzpr7j;S5JWW>d?3N`SQ?h`uV!-8&vNPO`C=;bX+&)%p1B{
z_GeYkp38ew<!XoHW?>(oWY_Z-G%XtXmW~=Tbid<yFE|5+F7SRXE>_tsI%d8<LtNx|
z?xRgt4_)o9GU}P_J$2lI(5a@4LucuKo%O%lgZ?_Vp8V{*q9Z29ij2B9v6quSbWXUB
zI4gX<Y5lJJ(WbFOr>iZIk?J#0d#=&Yd%O?Ch2Dqal5j*^?gZ4Xr*^&if7#ICc1-;t
zCkS$y3Wp90dN(~abO>jk8SAM2O>qLorN=$1M`MGikumBU2fSuYONI{j@|qqQI?5|*
zx_0OoZ&TCup;xG6tIn73?{u8{W1*u>Pt~6chjnDs30X<~XO!%vWMBA3l@x}j8=a85
zUq6f8cj52h0b|r@S~s+<^7~hu0re+sg!Sufg!LP3g!NnGBiWs>^|pSv^|t<L>uvqh
z*4z3~I?KHJ!#a!Tgq`+HSJ&@w&K7q&-Nijl5Ahx6T=89}r+CN-yGwNZF83j${4=Kh
zEzM55`t3nionybebbWoJ+Oi&9L66$fqY8RdYd){<M!&9bBHjkoTIu})s^1rV9x7G&
zQhPFK{i0B%X^zmhTj;)*c^B0y-i#aIi*Pgi1>9wfUJkD?I?c?t7cDj4UNk-Q+oqZI
z14H}a@1W-4qM0@i7tN1+W|ru$;BNREqm!v~52%mo+{PE-X1EJl&qr9#FFI*Gzv!6t
z{GyZA^NYr+H##bMh0$s5>D(7>^M4Ny!1v%mWAHvaY7BYMhnlS+yQBA-j?Op6b{O?u
zc&_6NDRH|Sy<fr|@Yk>rYVE3Y4}8PuXBhSTXEAz}G1l9t{%NEamDor{ja1Y~Ma_|@
z@roMnkZTxkCgTk=-b@?skf}D_i%M*~7pXn<@72Mx)jv`FGwy)DhK=xbxCg#rRR2Wv
zPgMUz^-pxN%zr~>TRab*V_uY&7e#qdloyB0HZO|u;*i<qMNwW9<;B5wn-_=7HZKmD
zZC)IrR{hgWn+DJKn~Z@2UFbm{1~3E_FRH2aBx*eko=@97q6<w&?>DCUI(WbJwQisF
zRa$)&)mKq{9lYQADypx8_gh~@^;J|~>ke372k*DO4&HBl9lT%fG3Pp8t=nq*Z(V=+
zRa$;E?ts6Bjqr822fksHUq$&<lwU>pRdlj#-UpZ4yo*|uqGn&z?2B8SDT8}h3`i>m
zM8!beWQ&2p35$WjSr!9>6BYw?Gb{!Mms<=BF4rd)iqX0Qwj<PyvPi8vVEaN{(&ANG
z@hU1_Ma8SAcoh||qT*GwvlZJ8QrFgEx9$Mvsjvu^mlVNu2W(HN8)b2<bLEG=+w|0+
zdqTIvJK&vg9()GA1pfe!!%yI+@Dyw^h8^g^5DXh5&0!YIHb(atoqX@7&VWHDyr<za
z@HzNA+z2;8T@zLFCAbCZ`Y6jb_%hrMUxmLihMF6r<KUHWJX~sYk`^BWOVo?64qT#M
z7@vX9!RO&dxCy=hUxHiU&*3)sGTaVdg}*YY7ovJ$yb_LwON~y_uHplBYcARiJfXQT
z-U07~^WZb^CHMz;9DV{ng{NSXQFCGRU<ihdnhRqV%r<H+MEPPz(~^PH-B;jF_-fO<
zfm7UF@K<m*{55<H{>B(oS^eN#_%&m+4?N#WqkZ88#@M}Pk9`0?gdf3UM)gA1%>fJS
zx+yj`Z5;5K`#RhM-++7Jn?}2~4p^pZt7%<Z2duJd>wv}4erAbY2%k2_?tqKoQn&&h
zho8U`MyJ4it7%jJM)z&_4*V~;5B?S^+fbd~LFF9M$~i>k9O8TMAXGLe%OUtaJPJQD
zMwPFL1K>boO#7p#{jq<e`jX#t^@SVU2jLR<5L^l$hRfh1a5-E7l`ZO6WsBlt#-JCx
z0QQF?jFGP!qi4ZxM$6&E+u(gh`m(A2IQ7M-nG!Wq;!^l9Tm~P3%i#+6C|m^}GpaAf
z3!r&nTrk3@zKH6Jv71qSG2RC6GwK^^zS}hB!l_y>#yjAha2|XHz65oZP@UuO6Zk1S
z1)GdoFGdfBU>M%mRM_tw<$j{pj_PRb7_*I9JEBu)@zQU(#fzwT5fv|@;zd-vh>90c
z@ggc-M8%7!co7vZqT)qVyoibyQSl-wUPQ%9zvY(A_FHXHBdw?r6*c{qThxe(ntscj
zLc5+`aJyZ5FF0h^-U|-NUz_@EmcNX5z&qhQ_zZjr+W9xjU&c@1r|=YPGRj{@UHQcj
z3>)PmV;0Od%15Gnl;1R_?`Mh~;}ZA~TnZnC%itq$Ia~oBg{$CWMqBq6kWF8(OL1hD
z3t)dZ!l(!`b~7r1jJLu2jPz)1U;X`JlW_@r2rh*W!)5RhxE!v4dhev8^xjE)%&1-%
zFM$2w2&1A|R9}qUjOvT=Hh3S@JE^|9=h0%M?`Vq-QPCkPI{J>*+%38wOLJ$u1KtVe
z!Drx0@DK1f`~-dqn~a(@qX$DUY}Bk7vtYK-qO9*&&7E|rU*~VNeu?UrsD7QlRsDLZ
z&oTAOsQf`x{vaxU5S2fO${$4K52Er1QTc<Y{6SRa(C3)?WmM)MDsvE(IrKTEei@ZH
zh{_!L9J79%zeD|!c8bhj=U39NO8QkvzbY-(&p&9fE-KbV#k#0i7ZvNGVqH|Mi;8to
zu`VjsMa8<PSU>-udS_Iui;8tov3~wRi*-@4E-Kc~KS=L7Tg0D#&}nH|c%Rd@68m_T
z*-9(36_weF%525cO`H0Rvz)rmILoO;7wT-%%BjTw>dewQv#50~YF&%Ujr*Lo+_=wa
z%Z)|l#-et;K2gh!`<%AiSkw;DXPo8Tea2ay+~>5@&hq5mi!Bf8U2J)B@5Po4iOPmV
zWkaH}AyL_osBB17HY6$=5|s^!%7#Q`L!z=FQQ45FY)Dk@Eh_gGl^Kc3j6~((qVjN2
zdAO)NTvQ(3d$Hx=y%$^d)O)dI<GmMK4kapw5|u-V%Fjh*QoR>jmfm}@(@rCBdhgK)
zjL$&j?Y(DO-YzO{7nNJ9^m(`uZh|jBW%a6~tX_Nx%NF=^s0?5BZRnTbcK9k(=C9IU
zp_P&M+NBZbT=p)Y_au84(0hWt3+O$`vh!YVX-q1$_X53V+Is=<N-X2yQlrz=Tcw|2
zd&af+GpNsZq<2Dn9wmJYehiPpPmKOI;EixPyb0=)C6(%vCGq=EzhaaA0h|SIg|p#p
z@OF3yoMQ~0f*atU;0a^Mf%@&9bQa8pEucP`lD(xd@@Hdo0_5yb&K~9LG4o$I)(>6?
zFM(s=WVjmItcIN)@>a=t`{ga8Y(00%XQp3)JK-OoW~k?D_MWNdUir`Jd<>7nPmJ=P
z@kTfu>O0kBxdqOE--k2d58y0#E1V5)gSW#w;2fj;XWRh)1Wy>{KVv4$g4wVIEP^fJ
ze51uv&wcWxw0vo#C-S9fdLmy+$BLZ+=N*(sO<xEvfn(rgxEelZbcX2jM5l-TJ`)B|
z-IFB@b!O=(j6uEsl%*L|1W0QZMa6-rI1uA72j;>&n1J~(2@7B$RP^XrMUSZH5sP6f
zSOT@yWN!_%;-uTccCZY#hvl#XtbiS%R;Z4ug4M7F*1}G(GwcGp!n0sEcsA5Kd9`y6
z>;cb(J>hw<7u0)l)$9Y$hkcE{-rI|(j8S~9zvDHH&!hM}iqE6?Ja(;>#_ob^jn3B{
zuW4Qn{Y?}MU<ig`1V&*DX251J6E=rgFdN2U4$OslFah&n5*ENh*a8;8marJMf+esN
zwuWtBTi6bk!S=8mc7PSIBdml~uo~9DTG$D8hFxG+coysi&xYOMIj{#j7xskb!CtU8
z>;v_#SKijU-X8DR)&HCu{5R02jCSol=PkQ-i+I?s)aT65r_5KM)2MeEVuZ6tI9G)B
zqs&*7`HC`MQRXYkd_|eB*tOPv>@K+0n1N3+@JTcJ<6P!F+O(<r9?MO-Pw<s-bl>AE
z;}Cxg7eKwol12G~sC+?O1RsElq22|`u6Kc=-UW(F;lpqld;~6sdKaiVD<OUGSD_z+
ztKm=J8u&PT0zL`X!l&Rm_*3{aR92_<m1k*O%Ckh}S)%eRQF+$cyDZN-dza-|qDCz$
z&k~hqiORD?<yoTgEKzeMYOX}(S=}dCp4EMV<yoTgEK&8l@3D-t`%23=#XF!fPHAPF
zqV;X1Wt`$4pfXNrWt^fiPEi@Bs2+A-X&I-ezKPcUO3OIAue6L)RK_VP<LtgNI$PWm
zy$#yg_eAaNd!loo^<htRF1!m`fA&~b*nNU!g`#Hp>|K@>ippHOue98-`-EooR@1rH
zYuWThw>92r*ktrQ=)(YpU>HVV6vkjPm<gN1ESL@BFbC$sJeYtN!Ft#LzXFHBufY-U
zVmK0xhL^xg;bm|P{3aX=zXiv^%i$Gpy)n2B&VskX+3+@aJG=wVfp@~W@GdwH{t(^`
ze+2J=_rm$`$8Z6>4=#lF!$t4`xDNglJ`JCN&%x*6&)`P53BCYdgqz_@a0~o7+zNjI
zx51a;cKA!U10I5ZgoojW@FRE(ehiPpPv9x|7x)?cEBqY(4H9VqkrpDlLPSw0!%9QM
zQix~?<zdN(Nn_*${L~oz4x9w9h0JF32K0?^I=l(ulPDgDGU_O!j=n<atHv08h|!1G
za4fVLTZMiM{sgXpkHaS+9*)s|3{S@1z`ob$%=eVbbgA=B!zQDzoJ&;BB`W6<b^RB0
z{TFrp7j^v?b^RBWZHdaZL}go|vMo{BmZ)q?RJJ85+Y*&+iORObi(ox$fM0>b;Md>?
zcrhFaM?+=fYT;6N8B}I2%QxXz_$@dNUJkE->y5#6a2C83&W5+a+u<E>4!jf2h01i)
z!aVpxcsKkJya(P3=ffYv1@Jz&5Z(_L!3W?v_*3{ad<N<rh0gdq{2AN`H$lCFROyRw
zGkghdfj@^^;V<Ae_%hrMe+hTML-3FAF#HgH1dqXw;c@s0RJN!-`~`jn{|Y~ce}hC?
zK%|9;t`JeAXLIP-5U~^@T0(hP@}cr^l`^`>3Dc2JjnVJGN$^_8oJMaz-w3C}n;@Qv
z;)f_>k23b?E0n%!jM0-AJ&6s+LYuKw=*Qqs;2QWid=ld4812XKXY38^dyURxw%V$9
z*(U`x@7gB?qUKiA+=`l8QL`#)Rz=OKsF@TslcLTbYW75pK-36C^<DfGl#g{5`M7$Q
zt!7cHS(LxU5Ddcz)M}Pp^B`*6qE@rm9A?367>Al4mF7atl5_%I1htxFX@FmW!{FE8
z2zW8nYF5qB@DixiEQ?mNI0k+bYBkHE)hv#KTFuf|!1YF3&EhPm)hs<5-Ue@ncR;OX
zmEH-pnx*f8TFufwgm=Rq!F%Ana6bGoTmbKbTFp9Et65wGwVI{ZLCv_dW?a;ai<)s!
zGcIa1i<);)^Db)MMa8?Qm=zTRqGCW)42WByR<pF?K~y}5iU(2ACu%i|hu|NfR<kT0
z!jIrF_%S>VKY^#9R<r7V2LB4Rnq|>y7Kt=l&DFbXHH$=%t!8Or$v%gwdDqsoEO{^=
zYE8?+7;Q~g@3J*ry~{qCs(IHwjS|Ph?_i$<uZ7IDt#Z}ZDi^22o8VH8!f&?LRf=b9
ztxLZGUp3lV7wM<1b!l3*wJ!Y_{0Y=rm*sKzBxDwBt;>$LZLLddt?Q}ap0i&6dO40W
zT(9$-5zeLh-*mkOICnbpoPo|G&USsm@rtv{xz72G^SU#|+3URHOmp@*?>RR+hn&OC
zZ0CqxcepWqQaZ=YcKbVbx&z(ootNAh?hNN6_d)kD=a~DdyT|#PyVw0lU%LHQugGoV
z6?-M_1ztOEq}$&c<$c4w!Mns8>rVH^d$+kWy*s=+-DTcg-aL1OcaL|k`>40nd(?f*
zTkZYIeaic_x7U5c+wbjnf9t*Lz31-t{@{J$9`HW(K6gL%PV0}a{-Q@RhTPBnn4h7?
zx@7tZ&-0Uh3w@hrOTW&`_J{bxyx#tBf4JA*AK`!98{mJ#zrq{r-{?>GF7|KnZ}GnF
zf8W2)8>MfzU*}!xKkcvg?)2aA-|*)7hy6c!KlD%er}V7bj3C3iC&&yky?cYKAjg{@
z)C9HO!k}}|Sx*f<E9mAu5OfcEdJhJ@gWle<pl{I6dnD)|4E9zALxZ8-nqWk5vG;gz
zeQ>?^WT2O~Hh3y{#(OGwHrVN{5B?Y&@pc9u1Rr_3gO7ucz2E2?EnKfL6oeAq??TB?
zfxgA1MX1O-9x4fydM83{LT$X0p|Vh!_vcWDPzOB|u3M;^_m@zgP#^EJ(1oE3^(6Xh
zLf3eohbD$5dVdQ|3Qh7(hrS#7uGgfe_1&R|8{8SX)AvI2Li6;cMh}G^(l;199D3Lf
zg;s=C_~Fo_p;dk)v^um}Pm)>_TH|Mg)`iyj%|cIyp7Aq7FN9w3vqCS0Uefb%^ey&!
zmfQ!S5Bwbao_asmzM)=EnbmjG`}y{*^nTL5kKQlTH_?au7U4)Z<`>!b&ik$G8|VF!
zaACOEFAety_wdWYqr%ht_V(@Y{s8-Scz;m%`{7&tI{QX=e`q8c$?%6oT1VRYU(+|X
zU+9mtZ)x{0iyV!7=#PmUk9_KXEAr>aDgR1+ownm&6%9o*{0Y&lXtqBonusR+>!QhM
zq5s`z%V?!PC3;r0n?E~xesrLJd$b{XnSXcmo6!mW(&#nOoBY+$A4KQ*8>5S&5BuAr
zk3=8!cSnC3ecFFLx<2}>|3-9Ebd&$4?!esYzZHEsy50Y6^p)r<{_mo%Mql;cwQqa(
ze;<86`o4c4=EVa4y;wBX%s&)s9?SBN*xjrC(OAb=NB@IZ-&kM&!`Oh>0RN-d*J305
zW3fwOm-xqH*T$~%KZ#9_P4+*H-4dJSpN!oWyUqVRc1P?^|8KFoV)Ftgc3<rNz>7T)
zTO5R955<-Sk=TmZiXawyG`1$lh&>rw8^mK9V$TJ+u@_>SgGB7-v0nxSu~%ZR1|_jS
z#oiCv#6FCj2+CroVyA*C`<D5j+P+ynsBKo?tUl<Z@0b5t(AoK;-KSW##?yU@W$Wxd
z#j*`vyQa(AZ}!Sydsq%TzzWzAR>CS+4QpU6>;yZ*F0d;+3wDEN!|w1L*aMymd&2Wz
zFW4LQf#<`%@B%mlUIgpmP}l&!0*Aq`!r}01a0I*<j)Y%_qu@8-Xm|;{6kZ0$z;D8_
z@LO;kyc}KuuY}{_Rd52l8eRjx4JX3yz)A30cpdyMoD9DQr@-ssR5%UZ0B?lT;Z5*n
zcnh2XzYk}^AHZ4gRyZ5p2Is>c!v*j@xDehC7r_VMV)!7`U9e>@_({`#0W5?qU=eHy
zi(xBR0!v|Q*ao(RM66H5`b4Zx#QH?6PsI8}tWU)HM66H5`b4Zx#QH?6PsI8}tWU)H
zM66H5`b4bXo%5apd%$yHPk0_AVtpdkCt`gf)+b_pBG&Im%?n|FH~<cWgJ2yT42f``
z==F)-fQSu7T50fgI0}9Pj)s>&A~qmm10pscVgn*JAYua|HXvdHA~qmm10pscVgn*J
zAYua|HXvdHA~qmm10pscVuNQn`zvrK{J<D;VJ;*RLPSD{xsEcTC?kq8q9`MZGNLFW
ziZY@oV~MgNqLZz)C@Uh$iilp1Wh$Ho7r_VMV)!6j0w02#;7f3eF~+RLn6=mjEHA>%
z@E33!d>Jy{*l$fYW7gbjoC}-*r7t-B;DxY18~_KxL9h;vfEUA&@au3C{01BiFM*fB
z%itLJO*j^Q3+i4$^+CUl74_R#QTGjsx^Gat3QmAm!)xHT;Y9cyI0;@0uY=!(li~N^
z6nH(H3a7yv;EnJmI2+yuZ-;llIq*(+7kmURhb!Pp_$XWjAA_smPv9E(ID7&=3D?4>
z;5w)~HsuH1u_@|~O;NvF7xlY!QNLRkbq}YgdpO0PLEXtItvflz7odK_F0J3Ni@K{*
z)LosT?&=h`!e78`@MX9i?u5F}Q#JM5cJVi`5xx%h!Z+bt@NIY)9x=MvFb;EIF3f`o
zn1lte5Vn9tuq7;ptzZc(g{@&5*cP^fWw1RghaF%A><BAi6|9CeuoiZLonaT)6`lpV
z!L#8xum?OB_JrrbUa&Xp1J8$j;WT&yyb(@^#H4#O`W847{s7K`w?g99C2n2f)+KIT
z;?^Z@^<+q!3!>MZhhA*-`oaEi02~Mh!8$k?(wav*`X*L8mUg@!qJIRJ!iV89$V%~+
zqgg55N;E6NTZ4WaJ^@(~9xK9QMR=?Tk4W=~G>;hb-l6_~!F}+z@OSWC_<MK&z6TG&
zL-3FAF#Hod0^f&6;Ro<T_z^q-KZPgZpW!L^7x)?cEBxH(4~0`9Gp@e^F+2YB@u!bJ
zef;U)O(|aW??K-S=Nt7M?Zyn41*>5VBt8S;Gax<#A~PTw1EMZq-h&IN&%Eoox7H>z
z9t=U(LwX)!?SyD2L_2yOvFeAIoiM91;+iEwY)3dt<N_?5E5f-VW3b@c$OmYA8^O1c
zkFgwwpFq4CZDu-}2^nuR8y$!2Dp7WoD7#9OT_wt{5-p%kA#4eYA$^XrlSE6gw1#b9
zTi6a(K|CDA!_itSBjCmGn{X`r7Q7l>1HTO?!iV89_y}AMS3p)r^ilLva6QChG0$|&
zhXD-12#i8vBZik^-LbHiWArx0P7<4e{ReOsycM#>W5i@^9+tZyaTt35y%W9){{)Y~
z_hG7^%wvqXYc|~M&Aw)IAGGX4PhIW@FNFP}Vo-L)ps4<eibPSp7Ug4cB>XxY1-}7D
z!%N_$@G_`a(@~lkQ8OcIX2fyua(D&25{`#g!3j`vsQQ{iQFAD24#n@lN$^^D9sDkw
z48I4b!0Vw_zmC=F7jJ+!!kgf1cpJPO-T^fys(&ZE3o2@4Sq@jgmGDux3O)u`!=J!4
z@NxJAd=jpOiZ!*V)hzxLJ`JCNib2_*g&W{=@Ok(%xDjrGFTfY!X801^0)Gy-!e78`
z@MX9iD#~=mSK%)B8`ub6hkN0h@GbZ@JPZ|;1?w#P5VcQ;IWQOI!30dg0$2!Jz#^zU
zL&s{*5VdEB+B3vb*c!HhZDBiD2HV4O*a23+j<6C|!D^`8MJ?CDPOvlV0=vSqU^jR+
zJO}oG=fa-wJlG5NhJE1qurHhjZ-6(#>5!PT>_h#z1<r&&fV1GOkhrz%Lp6z8%RZ!u
zTgyJA=R%^_vJY7n8!h_~`@;cnARGki;9y8=mVKx`?O669{X_U8xD-ANmqAvFWgn`^
zO0n!i`cb$VvN|jik^OP_1Y~tsCL%kl!!i-+t&rHWd_)$a&hioI|APDAZ{hFYyYTn$
zJ$Mivf`5dE;h*3U_&z)eKY$;?kKhUTDLe`P3{Szoz|Y`c;pax*fi4^hr$QpZvJ%z7
z&z6-)<7dlCr0<4!+p-c_?uGN=kKqD%A6y9Uhl}6?klFViL@$94L1xfr27PAGX9j&{
z&}RmHX3%E_{Z$<G7-TkmX47XjeP+{VHhpH(XEuFi(`PpQpK|Qe@EN1!R$>Osg4M7F
zvidByQXN*G<yO+?!M>2Fw%kf~qS|sR={h(B)<gUs3YoSHOQbc+u%vrI`e_+f!8*&Z
zMAolmSkf0j&S)8yEMwqN_yHtlEW=Xi$M87(1QIQlVHK>i3`=CxmSIW9VGhiNc`yN!
zumBdqmarJoXUnkEPAO~++rYN49jt=**)lBEuZ1Jv#qgVOEc_O{8eRjx4JX3c@HTim
zyaUdGM0j*A`Yt#R5_QpK=tm$?7bWVVM4jbj>KpMBU5`F$w7g98VE~!aSOgt~#Fgb`
zs)>IrJChy+8L4Gwvdn-#fV1GOkp5eCraJUFb~pM*kd+nNiGCIS2_Av(!&GmH0n5$`
z)-|h#!{OJAUc_>=tOm=`#0z16H~=b^Wmm67MYO2Ci<%{IB>XxY1-}7D!%N_$@G_`q
z)lr&TQFAM5ZpCr%a(D&25{`#g!3j`Np!(N9MS=80_#HS2UJI{---VOm_uv$GJ)8=)
z7pk2b;EnJmI2+yu6<Mlt2h_|+E3!nzl&A<2m%|lsC43aFf{($~@F#E$d>lRjpM-0n
z;!bU9KM;QkpN7vs#iQ)c!VT~__&od>+z2<p7vPI<Gkghdfj@^^;V<Ae_%hrM6>B=<
zt8f?m4Qzz3!@clL_!fK{9)^m|tOm=`MC~+U4$OslFaeXW02aa)un20`(Xm=pqIMlo
zyN*~2Tf;W6Eo=wNV0%~&JHQIq5mv$~SPiv5spVSO33i5EU{`n+>;}(<=fEEDT-Xzy
z2YbQZun#;R_Jz~n4e&-d9TJn4qp3f)z?tv|a2C8361SG4sU~r2Ihr(aYdM<qJh<4X
z`*sFo)me5X-5(Bs1K}W82M0sivFuFsiGRz^q<;v11ed~x;WEe?vFuDWStFL6Nw0>i
z2+PZ4VMTaPpji=?m&wkGu)Iv#RzyGDWn{D!(NA|78J~w6;U;L2-%ocL8Mi=-_I|p{
z$Y>GXPj?v^Ew=mVE+Zq6Y#E=<MGRZUC;eY=AN(!+9efx59v*=2!GrJ+{3ARJ{{&eP
z-uvjI@B{cE{0N?apTd*y&+rud3;YcJ6@Cs+i*>q7O4MCaMjr++1j8@_qc8@W!A#g3
zX2EP|E7$IMG}_9wdmfFpa_yc+V?7)yHt1d{vwQ^(gI|Lq;Kgtx91Smlm%_{782C*%
z7JdtkgO|fA;8d}}X9ZbqD@~MIZYw<x{t(^`e+2J=_rm#by;x_tVOE3XhN5|(A*hBm
zkX3KFq3o=B%MGQ^gMDE?cp+p>S#GF0b#MqYUo`~yD!5L%E|>*xg|p#p@OEfxxh|Lk
zZH#q+jj>L5c^Petb-K&TXk)AkY>ah*jj=AUG1dh(#=79gZ~?pzE`;~PMeqT*4%&*V
z(_LQ1XW(<tR$QI#@-o`GtJ7UxMq77w&!%xRv^7{4*cz<UU0%km@E33!wDnl0yS$9Q
zggf9NXe+2LI1G<Cmu2<Ry<TSd2p)qU!{hK1_$f6{!aqY>J9aOp(bi5~U~8u?u(eaC
zyT6RAAl>~Xt-HUBVLfQGyY2xqZBb!&bQ+tB{X+V7l&oI56U;1mFdrt3k)vXReFiF8
zpBpSg7p=Dq5$kP3#CqGHyTz>jr_lP@VA;Bu35i3?)@6x9J7a@=9xB>-8|?E?(azgo
zpNEQtuq7;ptzZc(g{@&5*cP^fRj?Y?z*;y0UJPw*HbiZ0HbiZ0Ht0S#`9$}*8OOt`
zv0nqf4JX3yh;`9P@LG5syaC<_r^B1zQn6q3VX?vTckvOp9Ik*X;iK>=xE>ORx@*qP
zNTlhmIn%GeS0OWHIeu1y<@ln_enTt-ZMSTQMWIDPgYL3Z3%bkB$n03AFZ&=k96P?!
z-FH^!7VI<N58y0#E3|dpU|GL758e%b1Z_Pw=>9!x=P~#bxCTBBpM*b$j8ymUS^b@2
zL(In5pnLhuvKRgd%MtiKOnHFFwD%2J4fc7ia=*Cyr<wK*tAVHo0-~cZN6d91VusUO
z40v+3>Plxhm7?Rc5c7Ecy6&Zv&UFG95)05Vp2;0^@?~)yvu8QO(bjU*$rdv>OX^!*
zGk8jO2G4;GIn5}wqcZs34A04ucKGfH-P|PYIn6~EdzRA^ZI&p{{0^KzT2Fa~?ZvqF
zf|%pfqMyWWXUXEZ^#zPE>9oXNCFas{E<MSmom?jqyPZAP35x;aisFGNJ`Auscqz;2
zp*k_AO!O$#Q?Su-F^e;1q|ajh&&R{MQBgWT#~hoB0?rcS*nGU|L5HXB>kO*n(zg))
zY>wSc*R)xS(wc62lg@I^6=V2We={qc!5KY95px1cZFC_lZq4WFjT2mxvH$;%SFHR$
ze9g(}nb9k=t)5QUI@UVpWZvzub<vZtBA$C_&px#0`u@u+b8WME`j?TpC-rK6tXWws
zq1S(U*8jtL8MR-2#maL|W*yBrnR7CGX6d^8UB$CZ7xpOZk#q9z<M_{2=J>1$S(UMq
zUw-K()$}X7G4Wb<W9pT6EW0u9n7z(e{`F^U#=m{dkNtn}YBu?Q_Z3_9pS)Vl={hnt
z$6oP$|4IG-sZK_2>J^)xksF(zdHT!aZ#MbM|4VC&r$pA8=GD0)6p;zVr&)S5uWr5(
zl}HYcB`C2nd#QG+MBMy^S`z#FYrb?p)!Y?5sUuTIwYKvq?$h&;yHWPE{?gAxY*k+C
zyw?BI2>;K^<e4wcON-ZH)x4}XDfLgx81ls!&Wz=M{F#cD*gOBbQPXTx#{OobM7wqS
zOD}A>nRD#tfA`ABwUU_jn^Z*oon@nw`!Y7f%1ai<$}2}_j<?kt-QR4D?K`pZ?8at0
zqWf(o#53Np{bN<;c>e#-&y@WS{-1Ga^hoqzY*qB&zk6kO&zO|a`oDW+_K%H}*V8@8
zZ-`a@C*HLBI_Ll5tNENSML=uCuEnpt<}>d``&SL;H#-ztRWO~kl!{=*Z2C3de#-l+
zqQ~?)sh^+6#zsFEyT-b<on5p>cT{^V7uf%J%}@WF(yUKR|1#!h%ok_!TA8u3@O12&
z*kSwE`bfMY)-^t>e2b2Vrd~OVGB)r!k-3(>R$Fg%td6wSVpB49Sc_l2E~c&=dOEI-
z(NX_!eaNV_i1_FITeHs&ZToU+*JYpm^2$9kdVboj!%Mrw7yCrYrz!hC)Rw<eYmN2v
zZ)P~X22#;(vHayav4qZ+T8ZVEfyJuMZ0+kz8Lh3RMHfHKr}B$YNByJ6<Re{)i*$Wk
zlo&&gmSosUXbr2)EB4YlskLjM&a^64ZeEpd^#AO}=A-TG<{^%@5!qOm#8%llHXCd5
zi@wQ{?xkvIE>vep=6Jo-g8HY}&^le!Y_j9(nIJRuyyBdu6>vDu9=<H~1Y#_k;6Oc_
z_}-?ctbWrXN+-Yp_RQj@?buZsJlS-;sOQG%Da9L{uj)6BUsdj>cO>>)NyoFN^4edj
z>siD)qt1Po)DM~#1&h_H*=E|)`J_6@cBE;Zj?iDj>!_JL+4w0vPwOeEw^dqYt*B(U
z+S3tc^M0dI_;xn$fb&((=%49@p1S$fRGHcBw-|c9v7VEsrxstWR<Cw^oqeD^A(<ZN
zyQZDXG~z`%gUVEErfSWUWs|;5_(hHE7tR3r;yuSdGba5{WmZE^#@!V9UDJ8`UrG(9
zEC}svx<0hK>H5gu^sh<14g&p+{+Et_%CR~#RcEH^%v7D3daknCuqRmA^Q-LXRXk6*
zQ_ve<Eeh$0T|9dk-=sY#i_}xWQ%%<g8=B73^Tg&kA^G$v`T6=_t^Uckp@iBBeYsw!
zylGLYE~EcL(+c(Ndii%zxKwq+p+;F=*T20Qhn_|dZl>8Rkk9|2B%DFXCY3zpg#Y2J
z>(u8nXAaBzGr#cb@0zaGxi-m9WAtp~FU`xBytB!P{8JBB=v*t*ixu=DV!f7MHpwS5
zLpAz&So3#;Ib5V;Uz7Tc#u90ID(W{aiUt~OT>o<9!H7k!YWzR!oe6vv#rel)kJ)!O
z7a=5X4gy3#L~aogxkQABh{y|wC#eTjW33_*YrPt+x6yi&QpF>RcoC{-EwR=rUTDoh
z4tjZ2ts>qRRm=XrGw=H*@0+{{381Kd-+X?vv(L=Vy)(~mcK1m!F^UN-CbXE)VnU0t
zu-rQ3aNCrrwh=D&kSplvO8T5J?N?y|xdQvg74AzwjY(Ix^67qAv`17+OKgG2>3*4R
zahLB%Dy<ySQDg2d%8orW>RwC^rMgu-aw#U4VsdG2D{?9(r($v{CZ}TIVM(Gqu9e=T
zEwI7rI9onz?ysZ{W5u><va)Ea>|!aaSjv{IvUx>ooTSFTvSCZv{;h0NDa%wMSv^S;
zMPiBgCAb%?6ibXTU;>y3t`tj5EQ0bhc!@|hQv4Lvveq100*e#so}u35@;~@D`NQR>
zv}bhmrNoVw&a_2p!qSXRTq10YP1U7J({1wtJx~o=M!f2gmX>T8<5dAHhhW#O3hTeE
z`w+X1kr|*(f6{YR^jsA^S4GcN!Oyu`w?^zJ=u!%uuJ0Q9jvY<DP@bxKqq*)Gx(s=g
z<3zuluS?1qk>wUMtMwnhin*hRxkHWN;r6O6pE0ux*Rx$EJ@$$}TfVMGY!M@(Ok^<P
zD{O4P*vkM`UTkc<*jRY6vF~CtzU}1zn=UpMU2N>R*jRJ1?^iQ`xYAuqn>-7iqg^r+
zmgz?BmL>l1Z7N%q9(OaS_hH~ja4c8=P68JLH72n%q{by*hHQ0g@@+#ImT9qQgssRj
zEJc<vR?Dz?T4vk|ZUeW2J3s}v3oHkBlRCD0Z0z2$=9FREv<xedW!Qk!a{~4s%e)&S
zDVLLSIVqQuaycoNlX5vJmy>ciDVLLSIVqQuaycoNlX5vJtJSQWl*>uEoRro4UQWv8
zq+G7;wN{XF1u0jMas??@ka7hnSCDcADOZqk1u0jMas??@ka7hnSCDcADOX^>vVznr
zNWFs8D@eV9)GKuAm84!t>XoEkN$QoPUP<beq+Uttm84!t>U#Ae^-5B&B=t&CuO#(K
zQm-WSN>Z;R^-5B&B=t&C-@tl^MO9@_RasM2wp5iRRlQ!m!ZBveRMu0CHvrm%@fLU&
zu-+((smfBSvXiQ;q$(S!%0jBh?#!seT2Q5J0PIqB>F&slyHnX8ZJsOHZEZ7OVl~`k
z*AwfAQ?ZBGe8*xBaVpjjr(z3nDwYtZI{m^k7#0twV(D-yRyng63tb#HQQeAuh#Noj
zL*g;C&ABl1sIk<!T=J;Pc8}CpU83Dl+jE;{hxmCq;R@Dz#@Dk(zLDgo7|DRO&`1So
ztchwRXgv$Jn(?-I?DZkXN^-0u$4YXnB*#j#tFz(1nCrtDPi1>6HubG!g{x$Rt7L_%
z)b;J7^(<^*DN9(&4wkaJD$776zzUYKffc9eaK|d^tI86VvV*1cPGtj2S-?{EuaxyG
zbc8Brm6)%rUn$#H%JLPt$7x2&a+TPnQ!UGSuIzx><iOos#ob+HWB*H8|FX%=CN~=`
zPg(uy%3ZJQXeldNSQ_k%mh^k>><7U^fM=8HT>$KjOvTzrc<uf($0vYV!&$Eszfo@i
zsCNL=8vyG0zk2$w)_3(xPw6)5IhJ~grJiA75p}BAtyAsM*;(#i=m0MRr3<{q_)z-5
zzrh<|ldtrG5_)BJ;45bJul3lN&DfajR^zYHV`R45z_H1%Oj6uoxPcW50~;0w7Ay?x
zR~T5YV4EJY2k@8{U~k@Jr{3gwChva<lcy1;2e21mVlBc<0jVGjbOY%C3m0Yvz{Z7{
z39<k-F3fC@19Cwg$OpYZZ_o!6fL%ae9uAO~BrkU+I0VcBA%JZPcMgTzqf>3W1wBT!
zFZPX_R}u@q4X|^}SgT~LRWjB(USYQ0_GNKxe-rJz1pJlu@2C$(VfDWfoBx%@I)FBe
zwfzdC9yEYP&;&NH&Y&f-5|^_Qm$MR=vl5rH5|?AoyquM|+;|PV4*m_^0O<Lw#O18S
z<*dZzti+1bSHi$6_&))a_8dw#5llw2*dL(Buu7M+N|(D2qG4PL*pXnxE@#Cq_m*;w
z_Tr(fc<&*9AAA5l1Ro>&1i&Z6Xk{r^*~wK_a-&S%d>;Qg@Fw^Wd<3wtVq#wf>#hRZ
zuEN4@iG|e?>pXBi_!ZzWk#zyM5d0ck1TF@bfJ?z;JUOZakAQao)>9a)LNY3q#aqdU
zl#DjXXp=p`bwVgc75IWtbP^zKW$9Mgxm8wfvB)a0$11#|KoM93Rsd|&h_S4ZC9L-)
z=vyV|TP5gQCFolv=vyV|TP5gQCFolv=vyUdb0z3oCG>9<{aZ!<R?&|o^kWJASVBLR
z(2phbV+s9OLO+(!k0tbD3H?|?KbFvsCG=wn{a8Xjme7wS^kWISe~H?kp&zSQ;Y-lx
zO3>#@=+i26x)Suc67;ze`d4XRCG=|v{aS*4SAu?5Lcdm_<CW02CG>3x{aHnSR?(kT
z^k<bAM@_q|Sz7h*m`2b97=0F_&-xEwm%w@luv1_$8ZAbn^&WU1Fe<GN!AAg_=@u5#
ztxo|q)2+|J7vO8~KSr<GacQN!M)|(Yh?n_VgVLI;dlmlc!3_XSJXW*yR&)L+_#<Gy
zLhKhilPK$)$||R_$=S@%uE&pEP7AA?$|k3>$f@jcT3F+>u*GR%iBs9(R8}}G_?UGo
zxDCL|EO?m(FSG6hD(&UqZU8s4;AR%w%z~R)a5L)xuoAFVTiDmMeh;v%X|Zm1$i!GR
z+hdB#KBclw>7oxP%aqD4rHf9WY*M;c0(1jqX;MrPSRyyF(2ub~&evE|jhn$OfR)VP
z4GQBna67mIRDinxZx<N6TflpHA@!DB^NPBfbN=U=-W_bax`y<;@HpY|tE}4fi(h52
zTdu5@>(%x}j%vllX1TIhuI!a7YvsyTxw2Glj~7$z{lFB!I}~bFMrRKN4r4Xm6O00C
zg+5+{*i8vFuhdvDSF5$RyVmPN-o+emWc8kE(pM&ZW&ROx51ZV>=9_?f#QX@LH<{>7
z))C;B;B0UXI1ii;eg#Uw1>i#PYe0Wk^oK=%SoDWQf7qupy6JNme~JAL$4}``#vuRo
zu1cbBN%Sq53-Uluz%}wJa2<FQP(HZ^RDs99Q(!H48*BvZ@3PlZ<uIll(hPh-zn=ss
zmrJ=^%H^Tkd6U8Z;3!Z87J(Ju4}MkBo?sN?WajtjZc$cew@cUD&O0lrlj=L{1ZLGD
z){i3Ak0REOBG!*0){i3Ak0REOBG!*0){i3Ak0REOBG!*0){kP=k7Cx3V&etyB49_-
zU`NuZ2JERC>`bCNl%YG6p*xhJJCvb2l%YG6vE~%A<`lB#6td<NvgQ=B<`lB#6td<N
zvgQ=B<`lB#6td<NvgQ=B<`lB#6td<NvgQ=B<`fzqvYY%7_!xWwJ_VnF&%qa9Gx#sy
zztb^O7qUJTvo~F(cl<|l<iGPVdl#`*6|q(o+Xo<<!;$|K!V`*O)~q7dtRmK|Vs~FK
z3GiQX&`-+HPs&)w3R%YrS;q?91N>5V8hB9e<P@={6``+`v91-ft`)Ja6|$}sqO+8t
zvy`E;l(EJYv&I#(#uc;16{EA1p|g~svy_PvdZx>JOY}@BJyS~0l+rVm^h_l^Q%TQM
z(leFxOeH;2Ne>j$1I6?}F+EUB4;0e_#q>ZiJy1*!6w?F6^guB^P)rXL(*woyKruZ~
zOb-;(1I4VbRjjXAegf>xup(4h{{ZaESny-(W$+4k6);P&{#LR6R<Zt8vHn)E{#LR6
zR<Zt8vHn)E{#LR6R<Zt8vHn)E{#LR6R<Zt8vHn)E{#LR6R<Zt8vHn)ktHtzcDLq+A
zPqyr<&EcHAHP+xNna>Q9!)|ykfMGj5(J&)>ZuD#^JzGi7R?@ST^k^|XT1<}?vtC!Z
zSA*YxYrys32EdBT+FeEutKKc8cgyJAVtTijb-apoyoz<aigmn-9xkPaOX=ZKdbm{l
z7OU%(*j(qS4?x=&X!`<fU!d&^55Uv~OkKd#1x#JQ)I~Rt4$wA42Iv7Y0UD7A0>zxD
zp`eC>8VYJC@<A`q8}tDMU>DFA^aK6Du3!Mz4GaYAwTVFhom>n7L%}dG9E<>afRTW`
zIl<nX*b9sXdxJ3m9iIPnSt-T=v?9TO{}kx+f)>W|d1azqh;1C@<&5%jMtM1NKqYfP
zC38R}b3i3?KqYfPC38R}b3i3?KqYfPC38R}7S}5+&atpw$;c^V<didV)V^u#$WeQz
zW%5C^w{;v}0yVzi8IfR*VmNGfIBa(~*4Qht#a@XecC}xrnAUKf-<9$Fu8e0%JpKXn
zFV@*BvCUqIW%f#!{>3VL?C2|J-l$~WP^@gY`x2=2hw}_d@C-`mQFa<!Mvb&9Ir5xH
zkG7Tg(N-B*<&3OyMpiji-7B%_UWrBbN~{weh&vq|1ZIGP!Ax)nm<2*$Hh^)VV?8ad
z;&?Uq4Y&qe3$6p#gB!q&0RAZ8kGjW3i>D3l7h^KmA4~yLK_Q?<1~oD$gFzV#%3x3i
zgEAPD!JrHVWiTj%K^Y9nV9W)Ff_dODa5y*u90`sBM}zsG2>b*b1C9m9f#bmf@KbOC
zI1!u#iowa?XW$g@b8sr4MU92vbg&4V0TzQ2a3(k({0ek&U*A~4HTQsf!F}L<@Bml|
zD#0r7d+;E52&@JVgGaz0z@y-gU=64OkAXjd$HAY$6W}l4N$?a{3!VngfM>yTtjy1Y
zb$$_h$4{f9K8;@bG<xaN=%r7imp+YN`ZRj!)6CmN%-coG+eOUFMa;`Z%*#d0%SFt~
zMa;`Z%*#d0%SFt~Ma;`Z%*#d0%SF~lfd8Auyj;Y*T*SOw#JpU@yj;Y*T*SOwWT$Y4
zrR%$F9CulfJzOm2Kk-%AqdD%4d>>@Y6#CAa;P+z%R?kDq?E?sB+}Mm0R^lQ(ho7$J
z@giG2f6e!c0vowoQb87A7ISw61Hf*8yTIKY3<A+PelPr^0r|RP0C%lR-Y&D0%iZfT
zOR)|Vv4{RNbAA!?d=c|}5%YYJOMkiaktcwf^CyU>y^HXN=l&v(d&J}Z(0Ao699Of_
zKMMW`Y5{G>U0TFlTEtyiB;LkyeieMK%tQ+`*>Qx|mBH)Eu%BOLS-=Kpc$NbKzy%&i
z2I$EaI<bZRZJ~c#>7YBv06jn^I0(!DGr=KX7MKI(f<wVPa3nyVwvGn#0eZFd6L1VT
z790nT2MfUUl<fw<DhJOjgJ+h(Gt1zaW$?^0cxD+qvkabD2G1;mXO_V;%PgLL!86O?
znPt|UfI7o7%ix)1@XRuJW*I!Q44zpA&n$yymccX2;F)Fc%rbap89cMhdI+$pVs*dD
zh8NiI0{bEWU$NmUHhjgt3|tQ2k2d_#E(5IIHmkSI>TR=n+t&iPiOni*-vC&}?VG?7
z0B^Q`3s!<v;P>D`@DPA!*sSO_E4mGzv8%vi;7{Oj@MrJ@_zQRvJO$Q*r@=GeS@0Y{
z`?1k}Y_uO6?Z<u}d;mTK9|1HS`xCGk{1<!)z5-}Ew$gMMFE--^>-SascZo9W-&bM%
zzDhDKuzX*I-TNw;1%hA#n9REkQ#l?8X5gp(?6;Rl%FTL~!g`j%dNz*rY#i&^ICgJK
z*}W}g_qLSX+fsPiGWm|b0j{=8zRMAvn_a5mSktcxe5Uu>$FZwh%C2rH>s<=#T?*Fq
ztK3t;X@LI1s(zLGOK>(g2VBJ3$ejc4FN61&!TZbL{blg}GI)O(yuZw)O|iFMg|+=E
zZ0%QJX}`*S0sPe;$ND(VttP)3P>a8TV-uPc?STFLD%Q;u*3A^G@K<@{j|KiJ?{07p
zxEI_99su+eHutNrxL<|6{VJ~!9+~Zz!iaeL2<v2F%fJWnR>L^HlD(3*i0<R9hPk|D
z^t?D6Tfp_=2qVepCyp{EVfD8}Tm3!T_ytyf@5Sox3h|(Eukjc0gz+r4e>WJ7>?^;e
zt^N+i>hBO^m^sWGZj3SaFy|U$&3V`XF2WA*;l@wQW6cG|G1?CB0&NHQB5eowQf&wL
za`SrgdgDs00pDqqVGZ~R<9hQ+Yy#hpP2eWuQS)!+E5={U*UZ<9=dcO<rt!S_AM<Tv
zow>=}WV~p8h?U^KYWu*o*avoudSxHj_?xm1Z2Uvn2R7bN_JNJJwSC~Awh!D(+XwEg
z?F09<&a}=nhiNOp!?l&*J+zhJk=jb|f!a#&@m9U{H}eGRAJ(hpDb`z930`D<Z5!sr
zwuP18EA4Jr3BJ)DY!Ajh@KCG-|5jTGzQx|#-rKy@-p3xNtpx99R@nR7Q_Q>ULVLP-
zx3(30zdgr34J*N?+l#OXyx6|Le9>NNFE#&e-)!G({=;5oFEjsX-)=8A|7EYhhVZ|!
zA^e8<0XBr+vHIBWNyF-k-C)n!Tc*lx)&!X$Gp$K7TV`AP%RHH9O_BLB-<ql{30sBA
zlCU*R4w8ec1C<S7Yr32uCs+r`LRo0dkkjOW*1_^Jd6{*Hyh>hW&63y3YpsyHQQm0H
zmP_SQYmU5G-fYdqGVp`eq4H7rCu^R3O0Knzmh0pTR*`&3)>_BNM%idBkpGgeSU;7o
z$=9rt<Qv!xE|zc0cdegk>%phVPvxi9LdS3n>vYF)0@flY#YwRiV;{JuRpRt<`dGgV
z>=oF{Iy<mWU?1z8!1%y;>s)OAzGs~m_$cs^^{c?ASO6~77Jx4de2E3%i(Cr}z*oAd
zSOC6WTL8Yv?dA5dmbm@h!PZhN0FSfoa3{FatoyJ4JkR=rdjxiXpTG`qvGuh3bL;@u
zU<ddb?D}4h9pDe#3hV%Xt?dB&?!)fGwxR3*+orMuY+LSH_j%h@7J%(E_pffP-OX)q
z8|+MF2iVTytyRkodI2wB=Xgn8vYo4}0oy&jbg#SJ%ggn0?LJ;lFW)XuZ<N}7m3?5l
zpRx~(g<k9f+q-(Ry}9-PWgpnyUD*e=2YJ{BwufLJ_yT*V_iOKBdnEROFSYmbF2_Fb
zXzyC@T6?T_16G2^c}uYpysx$rJV{##o{W{?`|SO-mEh^#YHzhY16#p=v=7#{f<xL?
z@LX*x_$aT|tF?=~Mz7KSiMPpn&pyWc$otqnE-5=H+g^~gXVNJ9r^%C&C)p=z>%sij
z9IOWy8!NF?5W-GD2rC64_BKQ8=Y_B#6~a0}2-^f9W|$Dq2}4*V2=V{9Ld-QGaRfLL
z90iUB^Fa~#2{;BE3-}L+Sf>nOn=*uD$`E!bLs+E@iIYGvI2rs5oC1ChP6eldh2V6s
z2%G^HgA#Bi_ysr%{1Ti4E&>;WOTeYzGH^LiZ!)ME@^)|sr~r3@yTEdAH&_Ag0r!IY
z!2RF>uoA#Uun`c#LO=)$k|FFzhOizP!ZJVz%aI}MMuxB&8Ddrr3I5Nd;J-{_Eixo{
z9}`QFA?!qk1pj9e8<8O_M25suU@dqWJOkE&7XUl8ScD7-c4?WxLs)YUi6*cC{0+Pf
zHnPjy4WxtaAOrLOnIKEdH-a3qK@P|Td7vlA2faXV&<7NNT|i&Z5A+ASf&pMRFc9nx
z27$p~2p9^6f#F~T*aM6NdxBA5FQDEO*_-1Sun!mu#)0u*0+<N)1(U!pz**pz;A}u2
z^6h<yFYiM}DYyV!2!0LdTfVjr@vVJ`FYQBoXCLA#`;c)3pl|usK7<7%wF5t&9r*d|
zz|Us~em*<!^Vxx)&kp>2cHrl;13#Y~`1$O>&u0gIzB!ql@F`#_C<F(9Y2ZLW9(;ix
z;`{p$U*CuL_C93(1}p=&g4+ONitp`1d~F}%Tl<jS(Ptd-m3@eB>_dEEA2Jz7d|e;n
z+xie+*0<jASMM>Z9sk77(-}kh-NyJG|L}W`vCq|`Z{n!u>%9LM+3}yM-l2<qBZqJ9
zLndR2@9jf;Z6D%W`;hrh@GtNRcon<`UI+gMZ-BSJf56+|9k3C+3pRoG!293>@G1BV
zd=9<<o56p<m*6Y#wSM9-70Znw>r6oZ^96Z`@5e)YJs#rQ@eo##LfAwKS+q0ukV05P
z3R&0jl)?i^APo!wLjmKCZ^J`;86M)h@Q}?o<7vixo3X_cjrmw)3}G`U#FLHrSPcsC
zU3iGE!bA3SFauByo_NexPdp@J9!o(X>;#3d5)_j36BdF(k++vZSO^LQNH?$_AYCj2
zsV5}!u?-aByW<dF9ftz617946_}(}a_!xWwXal}24)JAi2rED#zA6s!O>xNO-sOAZ
z5ML9A_?9@tm&75yBM$Kuamein@&Wl{>nDVzpO9Msb^(1sKQI{34%qeyVc93dlbZQF
zshRK2#eXRH2{;BE3&Kxt^t-SzPj9BW#e|&<eg;kfJk8;o-;jG7xE<U9DgfgeJ3S$+
z^n|d{6LP69-|mL^ayP_xyCJ^X4Ploj#233EkAC6{-4IWO=JSniNWJmJSGpl=C5HGa
zH-sggkaq#N5d0ckOg!#0zQzslEp7<=J0Xw0=Sk9htRsf_qBg|$v?1>uuo1iqRQ|Lv
z-_3@wg&5+?S>EQ~FrM{F{O8VptP|(4nzZ-pUHg7qP*N?=zPs={wf4&{#12P2tBz;k
zJMvf0y8=7#H??l-iOsL(4HSN@+fT`+);a31qkeu>{cN39X8qyOH2n=5c-y7r=g+P$
z@{g%s&>{)@_~xVCpZ|Kj9v6Oj{X!MVud6>(AOBH*E;8O{Ko-qgowW1wUuszCzh14&
z!;?MzW8b{Z&wr=7e>A*J;8q0cI<6n&udN=DC~CA0D$L(h&-)ym_|31sIyP3K_KOYQ
z7Qg>`<KJVi^NSlk_ZK(twp7=DykpSjmq^woQbgcys2(ju_4wFu-n7}FKlYo2|AFd*
zYTkiq`|C=1Tdr<2Tl}QGjqMkk#@77oDyT1Z*hAb9zRz1<Fut+AwP=T(^DbNKpK8~x
z{QT0|Nv-3z9*eERg=kvZR@O=~zj|6LNxP@*^>t_G0DsN;d5IGDSFJxfD)+0_ALl={
z{-o%6^vJcRM*Zp-dref%wTq+vmgD-fl|P!dAG5M_rVlz>w`hL;nCh8Pe|ty&v-UzL
zXTmzPA3q$jzBD#QqV`ka9oM(+4IM}IQSZ8q{)Rf<#|!`Pf6iBPkzd`{dQK=_Z~C*>
zvonr3d3{=VY&1@c#)>_*ZbN_Z`b_GX7mcIR_RH26=yR2KJL4oAfBgV|IPrN4PyP7z
zO8>U#HjUJwsJ?mJtMKsJRsT;Nztw%G%GRcQH&@T~tE!LmPa~{<eSSEHcvsayh)9}?
z*AEdQTz9`P9532_{^!-lw0qw~+b=$8AqG~T&{`BeZ%XnvHKoUgH3dadQ%e~KHuY8E
z#2cuOuQm<Sb=<K2y7=qVSrc#Tw*35e8pb!DWj2i>jY-Yt%G0}PY#Uizgq9Qkr6yXU
z`ji$)*r&%%n>w_P748%N-%X8TYW1SFp@}5bXC;zuy}Yzv>)(6?)ITb2JwBrH@BDGe
zcfN$%SHP(aiP!RNOjXTu+j!}AUlz?fcC1C`xb04SXD84}{-kuY&i|^f=zQEA6!XHm
zJK|HSK0p4vt7p|0b@hrJ7e7J!O|8CWyV5VHUg^JFT_*~vH>h;9zEM#9GV8!i&FL0Y
z-`wnvc(iU_S$&7dtX>fpMtX7QoHXAb1=Smy!wRZbYk&9ZHTpQU`iZEn6JGnnG1dK~
z^LoAd8Or!Fc(FN+h)1tast#NEHK$)*+p_j<<(dwIBW>0kXMRM7(e2kPjd-fxpzO`{
zZ|}ZA$4ao~lSESW*RlHzTDR+6Q-H40tn;<x*mQ&PYaK%AN|n`mj*Qk{$0NO#_+9bU
zm{GmbUtZ%zuhjiiN?sN0iS({X6QTxPtL-ng4sAo@C4Quz;>s;*nsv~Y*!9C&{9W+T
zer;pd42YFAkKI@y{`UG$Me~oZ8R@U8nMhwA=c99L*=aRHV(YP`zBVb^jw)OXtU1~*
zs(symrl}EY7zuy+npV1SY{c06M#)v)x(roy&qU+-{g5*zw)RtX*jgMFuIjL*yk?B{
zqdm4RLo^MwAF;KcZnK+f*fH(IFVqr8w=3<}BI%sZKc<E^Cu++5r)o+yFB)ERr+;$I
zbicS}l}f=ct(m2d#WnLZSBd07_;FgU+cCU<r_RMYHO(A2+QxoG&8a#JN2NiUi}ih3
zT64CRGyCbhRT*OX#ZN&_dxn2CmqdN7kE#w^-mXbFXGGKUxmxv;FKW}(^|~D8;gq6r
zTBjR(9vesbb(>vRvkWeEa$G#xFM6){p86TG=H9T6>muzM=6#$qx2vCjbIl`Be^}BI
z7CqPTV)h*3<gMm&eV;_?8XIrx{@S4L)V1Y5^XkS&uT8Xv5e?f>NB^ao$2v;OFRXd8
z!|()kXfJ+rjtz&`HuI|JSczWezuqt{>fh1FcK7#obVhOMHAe1$7GZmwza_@E<%{1N
z+Ll~n@7b+i-*j1goTjT|&-H#xWX~p6-Wh+Qz3q<5=D%L^T-$VOUW%1{6aCcD`V?P>
zux=Gw9`<BfwVw)&-^Y#adBtD%!#-<I7x*F9I`P=9sgJF**7J&M{vIn+et%8vjMlQ&
z=YDy3zt4|hJAQf1tF7b3p2v^h*pP4EAGcrmEoAT4H8$%XvDqb>Lt^!F6<6uuiP|pF
zwXtdIYtgs#F;=H54a<IXyV3%QpHHxNAIB5?&l{(=PSxMksP*?2dHgjk@&rD$pB#BU
zkRWu2iu}bjZ|%?ow;{3k_G_Hiei9vpwSQGK#4l^;9rf>!<J4_W1unK}+ppd^S8hxD
zMc*;$N{JJ%V_ivM$Hv{3I_%gIbS<@QX+P@tX*ieqFQd8npEpFkZH|6*gCj%(I|W_;
z`7bwQB)m$`dn%-*3<=}4BW$TdI}vuExZOH*DUYtVUsO-<t7<mKW)<!8Xn1Ux^85Yj
zdW(V@zF5M)sn%{CuH(e$3kkzZBhr=OW9u>`x+amVy)q_>8<lmW_xP_zV|9G=$JA_T
zukLYI#_sQJrA^|lOK{TOo=yDT2m4}bPxc$yH%d^f@3p9P+ig!}V!2G>ba<zr)lWYY
zs;KSTO8gC;)(-3_@vYY(e040J=;(e5$KJ;08XXlh64uf4i-ec=t{s+8-U(sC{XLc5
zKWj&I;__{bQaiTwg<Eg$_$v~<zZV~48_$~8*sfk*TNu3}y4FO`g@_4zCM=D8|88sj
z?N`<w9^HRX?bMb#MbhlzyQ;BeXesN~eI33ty{7){XbQ3GSgb!99zFUWhkgEr`un3Y
zb&Q_-ku?2dYG<puN9D0`<NPt}lTL^Biwpn0oD8gsXcCbEk8RxPTy%#vU8{cD-n9J<
z4Wrwp5%UgS+rVat|5@WB%_m*;z;hGl-PMGC`0=B2N9#2??s+@S;8)ca`QvIY^JmvC
z*jlT!o^Sn<#yH(Se0}4{Xgbj{M9*6v{Z+LmN1yLTpZEK-TVh3@kt#_zymnzrXuQua
zjXzgs{*2l)m9F6*1y<Fb+cpOBm^y5Ex%R?noGsDyqb@3G|ESup{m`w4v~Jf#SLk{q
z-~h3@RHEyYtfMudy=#7yZ+i=LRmTeFRD1Qd=lDaovZemp)_yH*!1IpgcQ9I{@jmrT
z#DA)BRlJmYr4#ED*Cu{9L9I`n$h&o(JLA0FI&@f=#<+Jb61884m&XKlX3mR=&K%ax
z_fN5rI_q!VH|p#K+aIs1^-Ywc|5EJ@iR5i$+wnXgnwGz|c5Sntbq8M5=)YRKG%AB@
z-KP9}s~KKbGi#UYbKcz}ERJ6&dF-$G8ZE5-XKa}E_pW^~98`<-q;O~~cT+lpUmB6G
zs(n1{YwM~y_$Sw{Ya0?TQEB;=jYE`l>uY6w7x{W^jZT;LQ^&ZU=D-Q+9~X%-JyYAx
z&SGtZ14fUnE^Ozt{W^A#PG|?-f9;g(+ZA_E*F*)0sek+Jm*~QFWUar~{$76X-cH@N
zRot2H-8)LVlizD}l!RYbmk}2}ur5c4x(=T&`K5KeqdY4*U&W>IO`Pa*B~G|a9TG>2
zlWx7-+qe(gK{=xZQ0*7>clPLG8z36Dh11sckIE7qyP{Way*<J?MDvb)w=Md;MoSs$
z2DSKGe6e+Ck#_9cdbzf-pE}M~hjyj?qRA=y4gQ+Cxk9WzJNm7xUtTvN8m^8$?-sYN
z7jg6+Q+S<k`~H%;CN_<*ziwt!)?C(+b(57WoHu0{7ma~TeFsq5a^9XVYJ;M^@TgqX
z!S7!;O`W&sD|P2b!#j5j*Fm*exZT>;y-hlu-ruV`vdy&-LD+6Z9ab>cFAjerOdZPW
zj){%0-V1NN-$0xbRGjwOQD4*gdyU?87e&*JyAHiP@{RT4xPD>=jy;cF+xn>Lu;uHz
zMXlxP99takN9C%Ywydi=OUuim(k}KBbqJ?Pn{BGQCYnlz$4>N<e{<7X|K_@z+Diw1
zx`}tPK33s=adiK!aZ7vg!}2EEuV_5F<2YRljpiMz3vGG1ll`RY(7F8lqPm+q7jtW|
z!fm#-Sc$`%?8NeRq*1#<Q|s0=$2h6k*S;qjyY=^)(ez@UQ?$f=0$X?qf5zOp)d>S)
zg`F6avC+5LzqRLm(K^JoS!`yB+E2+Ytb3w4TC`1+AlBa;A>!#MtaaQ3=dHifNf6~n
zQ3oyXZM9!(ouY#x#RbK!NpT@Ro^-YaV(ry*bdAq<ncLb=9i{ty2=kw>dr_6sf3dDk
zAJ^1v_$JHk|GSPAI{Mo-yE*!5?B;}1Y45%CXddBXhjw$~qb4|8KOj~Z%d=wT?fGN%
zllJ0tULI>Vr~Rv%xkrL1-}kZpeJ_84E)iI%+{wSjyo3cv_#VpokqP7eDC|-T@ILIA
z=moK3y7j%Q_Xx&CV|MKreYYX@s!r(^rLkAE<4>dyw-fc-61Q%<?a9}#TtCHMyPofv
z8b6M<qyN%+>`8=EjUKlvk4Rb_r4i1XGQ{j*XuAZFZ`(S&mO6A49vkMDwKE6AM(Tt=
z+-9AKsG`K!q3XCj*U#!qitX9Ii+%T8+v4bioy0`>slBPT^7Uu8mHp5p+y5>653NOZ
ze0`c`Y+IV^FWI*1)K%-t{P*H*9r>@XzcV&H=Dg?P&Nr+tk3En2x$p0d`nUDiIxn40
z@Ab<PrKjSmJQL*`twX}FP3s?trbim9qW(n3gyl&P(T}7_zK^M3&YRy;>1-OUlO?T}
zTFW{*_cyGsj}7;qS^xLg^DXK<#J%EWDtv42Na{F|>!R;Xbmp4aykq@-S@=5=Wh1op
zPo*0TZymP1=ZWebn`Z0wiw%qVx0XgUUhGlnTYkg(SJm^FEpM-XOY~a5N%@=C^Iq%2
zd+Eoo=Rdy2UYXdxwK!V~Z=I@-pflHOO}FYy8m;qg@4WRhp7!E(ByVot4kE>tnftBz
z8AiwZgY{k8i|-)+t^{p~(f>NSZb!6TN9phEuvk5@t9vm!vh3~U-JU!)@7OxT%6~|H
ze^q@_v_2g@JLMan^k}?q^SFf_&)9eU+siw4j%Y8=_gT(2SHWoc!#2Cs`-Sy=qcZ%%
zl%H?P2e!zz*B5<9Bzo*jdR=|*u`_A@|BJKLZ|XYPB<O-;qfxh}8${zpkBp^BQUBJC
z|1ajsHTB!b{kGP6+YvspzHmFP{#Gw#4%@EwYyRIpJK_Hdb+w_s3-`me{$HW4)-^W1
z|4u#s*Sdabtn9ns??|_aE#EiWZ}qpu=JoCS>z9XZ%I)C)KbEK>V>|cEH_@fvd)e0B
zVfx-z@P|@?wsvj1TC>>sqBESbtLblV{O@9!wzp0@^ZFg7m+#Cvd|&eZp>z80OFtwk
zr@y#<oqt(<V>HZPTVJEjqcV;Us<7yJG+tMZt*_<$(MXz)cQzf$wYI&ust)aieN*z*
zb&BSr+Ar!)bZqasL~+}f@m^Z*`gXn%4PO<zp2emUwfPe(YweHycA|CIkLPV$z>j&0
zv&9x<i!I5WXV0>2S$~v#hg#sr|9kh1bjG&W3+}KWJHWm|hw1+q_>HxI|4~E#_7iUy
z6b_3X+mHF33K`HaVn>uGv2C?)$FAFsDF2UXeBWE3L4T{gO|=L#T(M2pCA_HNnuOvw
zVdJTBr(HPtCjXCA7mD#?)aDjwn28Pfxy`3PdUkRPG#t5;3-JFm`-Wq7M8(_NYlux-
z?E!Z6y@lB8fAnvE3nc2N)-v_|OROE%Xs+$O-x+&-be}gWQ^yv&DAAO*?HEmS+pg~1
zRb73Tb9>A5|L%Sm)^I}SdLmJ*hEozrzd2dMq8*iX)Mivy)ANsMIIHzF{>csJx0d}-
z&bRk|`k}PLw^NUXi@u$F;&bs|-_XH+OnlrQ&uD?~2+xgvgXDk4njZO<$bYA84@G6|
z{cqXm|D<Sp<@QOUW!k<}zW-PI=QrHMzMi(BwdL!EJKC#}Kd)g$dtpDyzxfvM*EFn-
z%Vm7Snz-}c4J+f$zk?@j>aa7**t-38W?8<4y#2Qto@h6lKm%WP?%1FILc@#Oo1*_h
zlYZ|*WH#_MQ1sW(^7MRkR2Drpyd3p4A2S=?X!f_`VO(x(C+Hg&NAvEiJ*;oMKtF^G
zW;J~HL#W11tHTeV{bKiKe&mTeZ6s|q<Jf-MYUCdyG`E2NdgI@lPw@D~4WIjq8@`T}
zb=IF~Uonxav*~?*;x(GvRo1DEY5Mx9jbpl$PSl=UsL_qPE}CAPFmlpS9#b1L<1gvJ
zR#f!eq)_7keNFUSoh()k_CHoP7KmuL62<(Y{|6;T6z^5v!1Rq5B|K|gpDSDbFI=1W
zD$UsV(e_gjJNo9PgRt-0nh<?f(xz>8lHl8EzxKW*Yn&2WZU6Je>9Oa^-`@XbZ5=P+
zc?aVrVf_C$!p3>ws>a)j*EaBC=aKI~d-yrufkOOPgztO{H19Ed%O&;eHbmYf{gyNC
zVs`#(jmLHIl1@kW?{CuI3dLUF|Gn{~*z*>D*Wah}Uue`CO*oClvt!aKZSk{Kyxw?8
z?78yu{}0PVX5)3O<=c9`L;pWvOd(>w^K5GutL=BLJ3^0W@7<1=Vr|_!zj4{tBXu03
zvpPs;{^urfzLEd;*>MfN@1gPk@ALa!o7nREuf?A2Sik>N+qs|rmHJ%bTpC|WEdOpx
zwGGAc4$3&bvA%=Q?_^NxJ(sqHY+Bk@w(}(Z^2S$pUhY5U+`0vJ$hz4&(H(TY{rj-W
zZfxUQJE%C{nPj&0|EYaj73i#eqi?G`J13u}B!5#=dVJnZL6Ovy-z*#0q<1BWH&Ds^
zSDS`)R)1_xLwPcrMv=y(I9czev2A2=5n4|CmzoM&&bsc~rZRUuo5WZAxG&ZzTg-_Y
zuSL2u*MW}4Pe)-brQf+e|D6u(@Mks6)}_m8I($c!lKr8gglT0pEl4QuNSM`hW^-^>
z)5$UZh0Xr<JnGuyrgKGB(}nFt3Co)<iw|$QI`&-c7sT!v#D;CnpGZgeK8%_6>(z8a
z`(d#m-z~j9wq!pXf75N>g}SKc-qB~@>VG?_U&3);*|a<wFB~heyR|q8!{guVj7zw)
z`kp_m>HfG2Tb(4#w^f|2o%)ft?fh4_7IO!MYt3y3rS%OZ<5#ua({7zrXX3QJ=DT$M
zO+Pd7*EBu8E%jCZ8+%)>`~P~4zp80nqPoLTY7)tJoGko5X5!OJBx{MWBc5Bdq_&fM
zp{9TCq@2I;Z2iq0WYMjIuucT|?=`*NI-37h)7!0O`aG}c{e<!kg#If{pC$}WZTd1+
z?tii&_Eh`*S2j2zb3;m-fFA|n_IY7L#*a<W^%n5|vmvMJSN(X!x7`B%Ya4ohn|bbt
z?_rzYJ;~cJVw=m}&b9v94Q;;4+2%ZU(uF^SI_#vT+wN@rcegu<A4US6FiV9<7klFh
zk%8-pzPRb;uF5r1aC!S&ONQbaVZZSv{%#^&hZ?vkA`RCSHg1}ji7SL%DnybPg=-57
z*AxA<WF)RBl5x{Sj+XSpbwv-{bmJA=R3WuISG&98rilP<y4VfZ(^sX5{guSHRfnov
zT+vHQZqx3|xJhCxZi>jpbwwZCG?9gys`E+`<MAg&YIlS7kJE9&wN|xDHwS2WH{4XA
zYMLaHw5!@JNvN2f@Niwx8#mnyms!P36E<#=aJ0Xt_J>^;f2uB3l1SBZ)fySPjzXx`
zND@IE$Hq<8DcIo_Fl&*dMarOR<mxiGqCm@M;AZGPO%tjlX}ZNy^tGuvX1cKwxvf*k
z(ETFBAS8U#k8223wsiA$?fxBC>K3zgni)DYP2{Oi<1HPk%9*W0g-~r3)V+W<hCfBu
zBB)y?Mdy_!1|t``wCUn8`~ls1Qja~x6cShWZ@O87KS>P4O*hwSw@JGVxSnpM6rER^
zn2bc|(PiqMP1U0-C6dndgeK`aW(XU9n!Ywo$4@uah!SFmmaDv^?ib3A-_>oHE~<2>
zx-ZhizFMwERI09>&^1ldB|(NfUDqYu{D<-zZ{RZCaZ`0mrfGk=C_$2~$GIIDA+wOA
ziGy&HBX`yz_&s6crip`b=^yQ%jvLT@5sdWma3tx58bzr>-HGYOgSbh$HK+%EPv_-@
z$AB3gEo$5fv8xVMqutegly1C@-;VTkCjNBu3EVUh(*BolQ-!)V-CTxiM9SY?NsLv>
z6_4Y(I!>ByjX<PlRr!TbF-4?zet|zt?1!5iZas53{&e#;Ezx(qISjv}b4fSP(sEr#
zu^2zs;ktVCI=YT-#8vlQK!>J_G5FJT3aLWfzv+hVDO25RX+q5~sgd;i<4+QM;!2_F
zo+i|Ml^kvv^Dp?j>6S?nqwy!{`zuZ4Yrl=_>KxPb*htfDD}=i1U0v&R<8}O=PAyFo
z;wK;6fbKO{r;{8mp{ZuDbn{=hsk)cDMcU^zE&rW%|B0Iv87-6Wchl{h93Eq)8Wl-;
zY^UmL1G<%x^f(OYTrzYYB}L|cbzi6HdU=sCd@~Xexy$y(?+6>$)NPfd+b2n<;OhE%
zI(I|2K$1|och~n_x~XRAq{tn2GJaRLNjF^{SI;NibUNL1Yowdy#7Q^)gPW>L;)U--
zvskCIkCv-ZWawH*eQmmVE|L`8hG}9dei3PBH9}0Cj;V7rwLC-TCG?DxrTs}_guY76
z3AVo1q;{z{l5RS$WMSh^H&ski`-L7q%zQ{Z-BwcfNV@qj5;t<!Ptc)iB&3_a(yqEg
zJv~B_A|+8HlOE8nS`7oj#x->9vbF2!nbXxRpKkt@&~)S9$~6b$3O!q<=@gR0E?T1Q
z(=^@tNs((akaQDjeoNE&rbbfxvyQK3Hlf$b6x~PZ=95~YMtHhet^I1QNY!^iy3vT=
z)A2o>Z@Qu8=d{RrG*pMGx+FzfChS)uP3ja(J!X=$){&&|krX{^N$r>6G)*<1B<b}f
zP4`ij?m?kfmJHo5p6+)qyf&Fjh@Wmgt=-dbJ>5I$rW!fv<}F&%8&~LYC3GK2-AYoI
zC*4&2m8@II6ievoCB(g5JST1v>%>O!xRGSki&u<B^HAen^DzDfnMd$9*gVQS-W+0{
zU|wwQWnOAtZXRl0X<lU>ZvMvn9bwDNznUkR)n=1fZvM^u#Jt`7%>3GX%-muH%(a$h
zC7CZ-DORRgV+E~g=HIO8)&kB?w0>djX8qDS#~NduXRWrzS@qW6tTU{CSeuc4ZM)VI
zJIPM7?zGeGbn6~_usy=M*B)t)vsT#?><QKydy+lfs<IEZXIjtLv+Xmi=j;-@#M)@z
zY~O6XYcI2xS)1(J?d8^c_6qwU>l6E7`wh#t-;$a3a2b?&c9G1Nz3t=WZgMyK1UX#p
zVV@{R$x-&na*P~f|4fdP6YW#vesZ$CP!`Gq?M3n+InzE<o-9wc&z7giQ|xo(sq$3&
zTzR@Y-9ArVD6g{5mrLXl`wF>K-fCYdZ<n{**UAdH+`dk(kSpw)<h}A<dx@-+tL$?5
zpnS+)Dj$`9vTv4umVdVIkWb0Ac7<FgYwf#aqinPvkpGge*em60@-_SS@(uZx{h)kX
zzH2`$-<O;1KgzEhX|Hu$C(W*Q(w**hqm%9QvNt#bouT$C&Twa>{id^*Gs%9(+25IB
zf94$Q9BhB#gq)DQ*_q?avH$BF>YQtT>HNz1we0I$;#?+ob5=R4<e-2XNRfjB1%du@
zL}0JLUUIL%K7oDY=)m~E{&MfYVS&TtzJa1Zk=!q^F|bii4r~f+miq_3WSN@fTJAJ?
zm^;(GRo>#>?%pLoa4X#h<)`jy_hGr&t#Yg6m+s^4lkzKft^2$q+!x$h$8p!Y4Nj{2
zuDi)eNBI;^hG%+dP7g2L%XSL9d@tV_=oNSc&h8$6&LD5JH`*EOP4Xr=L%gZpRA;Dn
zfOmj1%$x1ab%uLKc}F=Ty&|v3+0#4CTj-4P7I}-D(cXF9#m?T|rCymc$@`7>8>i5_
z*1Og@z`NdC;!N{?>n(K-_HOZ(Ifr-^UWF6#?(*()W_u5KE1e^})!u67DDM$(jdQg3
znD@AItoIl11!sX*>(x4^d5vD9v(S6T`_wtz+w5(2&P&Qp%686A8kn@Z^Q)vilSVlg
zBu`47<or5$dh&GVqU0ILGn|W)XD82bE)k~jU+%_9%pUuRY0QlWiaE^HbHy+5pTnOa
zE)tjHUcq0!xRO6ZT*cjMbN4=j|5@(gZ0_L~@&8rS;I9?y@z;w6{Egyo`2WFQws=Fl
ziTgHxhIog+Z0`Gw!r;zN6N8LyMkf9&BTIBMg2rC>M;oI>zOlD43IBe^nZh=HVVsBm
zeB)R6OASh8Twz=(vWzmL4F6TeZ$%Gdsj(FQ?~Dr4xy!g4cZKn+@Qmk-b)uK?f>A5_
z8g)jK$TT(>Z;3SHU1JmO2gV1u9~xhZJmV`fPXx@KW=~<6`DS1I{mlJ@X-+mL3&WgZ
z9*8^LT!7@K=1;|*YHq@Rsd=dwVqRumM(E|{<@m2KufqQu^EbHHnAak?&ioxQmzj4W
zxy!suxaM;6ZsC|K%vDH!Z$2cto2$)7L_hNn=A-!kX#SDVHRfaZ|71Rn{LkiJ@IPrj
zDULFqGM_@S)_exZv*vRm-+bO&NBkGe7m&PYzDVd_&A;NWHmeD(GaGOl%_j2toB1!?
zm(7<&AM+LS4g7DKZ*uKh<_GvcG(W-rsrfbjEv7FlOIR=&%e2t6tRyQ*<Xg#BCjOu`
zU6|HE)(rdyTL%lnnrY3#AF^g6pJUC#e}r{}aI7P(1^7?2N<@lvru7SAGXEk!&$<lv
za_c%I*IPG{%MxpeD6-0}hw!hqR&!OoRWFjP2CG3xtI=x0zrp&O*oFD}RovICH$)%n
zP3sHfo2|{n`P%v){w+3Ik?q+@!myL=WYOPFu~UR?r`c&pnA!1X*coC5^ZQ`Y%N}A6
zMLygfE=JiS>=7c98GocW*xu7-G}@!>(a86<_vWfG_827l*!ytRSbHpzarQVQ<L&XH
z8*2k2*51$F5C3F)fBaMIDfp+_h4>G!4<MasHusu+pnV|MPPeDypJCH__Dp*wk~#Jq
zQl4wi<*GyN(}Za+v=<7?KHWZD9APiA7m4xq8TJ_>#a?VL7QNNlga1ss6#oVG1)|u#
z(Ecs)S&c+ctwy-4Mz|~N`*9zz9}xT7m3F0Y>{a$d#9VE!Ce4TKhso;^`w`@Su%AQz
zyuA*|3-$}*82d&0-y+q1!+t{~*>Bo!ibL$T?6-;Yj{OetH`*J;VEbKrljvi=XTQf)
z@7tdc`l<aXp`Y1b5W3lBEJ>ys;YdRo!jz`8L?3BOb~GeE;Yvq3A|wM61|mHPPmn1x
zh4`s5RdknWvK#(%nJxy)?y@_f84`Xjd&nO6Gi9boky$c`KU?M?&y_uipD*)8lI$gW
ziP^HZ>@D_G>#oRB>#o>Ut+@Ed$?>=o<ODHRPLvZxA*=6x;y^iBP8Jj7R5=xSp)3@~
z$php8Vvame9*AVRoKDPx<Uz!oA!iWtV0o}uAZN;%VygU^{F&HI{#^bX_cVDLE~~Xj
zXSKdqWXMb8rT8zCmx)|?xx5_z74k~tWwH$aRq`t2*U9U|JhiTieOT9*iplbK@^|=e
zmN(<SMcyJt%Vlzz*jwHzZ^h55kH11z;J;JeiT^Hn7j?W_-c9cJ$a`?_llS3P%1ZH5
zxk|30)(^@D#Z38-e29D>m5-6{pX8s!ETtJBK{G(IPOcLp<qPr!F;u=N|0;&bm*h)G
zs%15j8d)oLS9$|}^ae2iz2OZ}Am5a4lEPc^E#ki|-xibPJMtZ|pWG-n;(u4Zi~oK3
z5w-qUenQMo<)`HJnfwg@=kg2Wo8@NwU&$@_eFtsRF&snWI;Ladw;Wq!Fk~G3uH%U@
zPLh)>_Ht636yl^hsp0@9&4D+fqom{S?sO+kwv$bq9H*xk;p98{Vye^2=_Rt9eojAe
zG#bo6G2GeR87u}mL!2SvFlVSU6#p=17;^r^k<JKbgqZK_;fzGGr!z|Ifv&R`aYj3%
z@$c>Ijem?Y2LC?JKH^wstTR@e;EZ?1i|Nh;XM#A<ndnRuCpr5%`y!d<94Pj6W;?UR
zIA^Xi7xz$So|xhs<{Tytb&haO7s<{d=NBT!`K5EVnCP7AoQwZ_=X`Oz(x337KjB{P
zTrLh*T9lX@Fan0i3Zw?uRScvDx{C~@ONstUm%<$%7>_$4Fj4Fp*f+30F%JtICVryy
zD*WhG!bY!REeL!V_)zo+d=&Tu|EGb^gcbNa@VQ6{d=dCUIDyT9&B(tDd?^M5z6yLT
z3IhKN{7;MwYzb@;Lj!)m7b9ILn;42_W{cfj>B7z2WH&_^ZmOFqY&Xqi-FLIxEc`(?
z2Y;@cC$in1Za@6}-9g9)yTkAgcSnjI?w;-_(aqh<ogh4SqB~Laa`$!j6Mfyu?*1av
zo#GaXH1_~^n#e;7oFfA6T=!6}o#!4cOn1IJUkq`J+#>uxagRlQoO_(;?jG+h5dGYr
zx+ma2(LGV*yC=CP3CAsVPa)3FUFKf*boUorb(VV${&U#?N^vi6e@&c=+%n<1SGiY-
zB=>6f8nKIet$Us5<6iIHh~y@BiRkH;ySH%dGIts2-|F5)nw4%P?kaZ`HT}K&d+PY0
z`yl0C?XE`tu=_9)v{kNp+<lxJ|Li`2|4H{r{A=B{BIrKtK7;>R_c{E}yU*i)!F>Vu
zMfXK9%>AqTk{IAtyEUS~t#xbhuXoprecXDtUZlGXZUgcrw+VNXyGa;I>lHRyFZ|qd
zJV*5K0-lFI$zulgQoIzA;-z}*>3C@#t0$Uqcd@(I!|NfYd0Ac-E?TlUNa@F-o6?Vo
zGr^l6^3jsfoxI83{#=WejC{5?n>6QmbHx7MTyHKCG-g84m~l_@P7~5w=+Wj%Z$@&S
zcRq10@P3VZk#`a0yx6;#TrTx46`9^;9vYW-g?9z+mEM(HTjrq+dRKesT}s0iy}awZ
z>$vI$?*`l(y&JjqCU1#IL+Ac2ah7^ZN#_>t7DAVK%kZOr<1Y8^rVJ~*6_nu~?>_tw
zcn{#N^j4A!8o5Y9BY%Y2{lWVKaUS*lh~!V+<4FGE(No@2-qZM>^`6E5ocEmQ<2~;^
zk7S+q0{No56TiW0B=le2zmUJ<slIs6`;an!<b8zyWA9T+f=(|CrPGT7rPGW4N~agO
zN~ah7l}<1AR64zI(dlQ4tmHY#bI`F(vp<^sc$V7<==TAw-)EuUheU5Nn?D;(e-8e+
z;%NNyMUe=KpP=^#(E2aKy&PSC6uSORScX}`U$(eU+|Q2H1N^0mmHb&+`|l-`-rq}W
z{JpfU-%IQIy|k9!OY8S8`hAYbF>;N*qL0zf=!Zr=3C-R^v!8-CKh>Bjjy4L768vYP
z>j$*1KNwyAd?dd@<KI<l{MlOLKTvD@*=YRb=<&Zr@6XbDe<phW-69o@e}!<3dyIR;
zeB)l@FZiD{o)LQ(&%y*;%>)K%Ca^n9pdOCV2p`CY4}2g}GzaLXIe@7-z)(0qZ`!gC
zOkgNXU<j;Wm^mDG4_JX^PBt0AYR5wC%6`OA;#l)o^LP=|tiVt^7NS2p7FXhynPsGN
zm3fsoK(m4aU<KD8zZPy_!VRtyyO`IT*CV+Bp0Eo%p#u4xumuaYupG(Vu!UVUTQD_S
z@HAT(qS=BM!xlWv7KXqUo)n(u2}9rsupslfW`^KthA>1k1P_MLNNAJUB=R&j$kW`w
zgd4nq<P8|YuFVYLE&LzA6ZVeq1jP_c7y`S4mH|)L1)ks_30MKKD|;{yYRwr;c3yfQ
z&xAR6Fo#?;{yZyBoMQE~(1zKYnJ)UnC1&9dSs~Jy4U6axi<m<?bKw$6)?wCRq;R-(
zI1<GxOwB8jG_Oe4ydn!;aW*-g1H0H2c5xp5^R4s6Q0rH43<r*JBjvmarg5ZZ8Yjav
zRw4Pl^?M`_HuH_-7`~CL`NlxaHwJ3Hu^W8jP11kM`j1Gq-nQPRobOm);8zT!zh)rG
zFc1T6+q6xwt8KwXg6t~sgi5oK5fL_$YNv`ogpDX3G6)_rL}b}R?P0`JY-C@}M)EZq
znFt#hC35V&;3QcQHllb)N(>L#7Y4$dYwr*D*jIB8!!B&aH;UN1it>%0u!A*QOw_Dn
z5Uhjs(w+zF=%!gmmS!C%YSwX_W*zC8Zy1_g^wjL4r)C#DHM{7k*@d)M+AGC5F&x8y
zT|5GFXyFxx<`t)DUeR6iiewnYTO!^54~!y7Gm5=6qu32b@jf;B!2SR(@uB^p$g@AP
zKSJ^`>>>|#@frTl;TR4aV>AB$+W*D>rTr!Tuk5eze{FwFn*X!^hh&Sr1&I$EF*O@W
z(rm=gY-BghM)uZh#L{fUgpCAX5w7Ivu1u2b?#pC2$r#N^Jk3cAI0>31Y@~-UG!HS^
z=L;gqmf1*hU?W3eBe`6gC-aafPLixS$?=+#Owyd>R5;0SagrPXGdWo82%;q`esa3z
zCkJVMGEMW70h*so)%;|ZW+rE7W-?VygPBazoMfuzB(pRpDbbwdXKDu#t(_f2Ty_v~
z6(`BioTP{5BpI5M6lhM8p*cwp%}Fw(;v@x9v5`W}Mh?|%q)@YwLp2+jtl7x^nvG1>
zY-E4UMkZ@EvcF~{d&%W;Ir*|HiOa4eu3{r+O2tM7NX14*Xf~1o8>u44$KWK#Xiid~
zIZ1}*Bn6t2jMtoGAI(X|YECj<bCP{DC)rbTl6^EM84f3T4Ic6a%w(8mCK;NUjMdC!
zwq_=CG&7m4naLc@OnPW$lA)PNfo3Kdnwj*_%p^lIlOCFxWN2nmpqWXAW+pvgCOnDN
z%w&pYCi`h-QlOd1;hLH3rJ2d$nwd<|%w#{!OvY(uGC(tvpTkLZ7o(j)&LA<<84NQS
zt(nOQnwf;)BqPLJ*vKBD*ck~YnF$*iO&rBTLYjvx)I4O7<{`gu#yR7}S(=R;rP;_Y
zH5)lwvyr2mNzNp3uG+PQ`LJs%7OP!bF+=Uz;wok`PcxIBI)}qd(lj&4b<T3m5{GDh
zlIxt~oP%Gnlw8eEay386)y!l8`@2c7k>mi+CD`Tdi@#r>KYqneMreLALi3XmnxE{Y
z`N;sa?<=NjelkGwlfLkiO(G}oUf?~^C-4DWC0lcqOt{KNA`h<esW1bd!B~<sV@Zdx
zY=*HYt}<M6m0_BzjMrRcAI(+9Yp$}7<|=!}aFs00ReHl!x}le+yFK6)nediTnz!`T
zjHQ>$pU820yM569qr7FX80-##y<}_llBwBCD(qz(oMF5>UhLscfXTR;$qdp=W_QhG
z@->r5(M+bFW-=yBW**$&2$+nanM{ApWOmU^#?(y4(@bUvOy)$`QIx|J!-W)wG2t+0
zaqTbRFiD!jq{na=OLLfH&0z*=4zru)Fv*(31T}}TG>7rvFt>{SZUs!n(M%?wnM|)3
zCX*k-VGPY-OwC~o_b+f5Q*)S}F&w668xAv8bC}_p!wl0LX1L}sg_^@;Xbv-sJ^Od5
zsp2pPXb#gC4r7WOln(ZlJT{O-w&pXL@R@+fgU=+PXD7pIk~FJHht=>LTl1Mcy$mly
zOwg?62rtvi#ILx`5nj;C#;+KTt)2sjEX{LLHP6XZ&jHZXc@99Dis7VdhLfimj?@gt
zjA1zGF$~Al3?~VOQz}wnI2TazU&C_-Yo60v^PE)8bMn2*J@&gb&*=@%DT9IV41tm;
zhBJs~2-k~=n&I@;3@24HoD|J%@?*G7zUDUhJX?T;!f;kl=6k$*X_Nb4IC+}k7%>bd
zSu-3%Gn^#NaFV?>-WoBKrx1^Em0~-FW;>>4JBIfRY{%4WXE)7u4A{;(G0J-Z&Xc1#
zPqKPmL0+4@_bB;C-p3+ebDLpsn}K4lq}^dS12n@a&<tmUW;l~H!?85O8Njnc10;!;
z1iO4w3TMnU9y{gO#itrih$GSOYtZFiHQq*--)u72%ycuyEHDT1H^LlaPO=7?)66H#
zSv*BN#$3ho!&T-&a26;9mw{_QIk*k5J8wQp{O8OXbA$P+-Pe2@&3Ch0U<sZJx>mZC
zV-;8ftr0v;oMcV2bF5itsK;0*SqrVRtWxVT>l$>-+pHDVD(g|}3F|ql27U5Xw8jsu
z%{CJXJJGuzd+aHT?W2!Z?&9N*J>#d=6~`a{^M!Wl@n??M!@34{q;(VSp4QE{qpUk{
z_p(;tj<#0f?rp8c9b>J*-N$<3_%rtyVLgMphxH=vNUIKaPiq72DC^|~rxc%PFIaHu
zX+O8#IAPJT$J^JOa@z5ySR1wbp>{t%wdCiEtgla7wBS_xl!ctw<{7GN?it0Wo?xe)
zamI)}>`dH|b{_7Yb^-1vdjRfU_7L3B_DI~l?J>Ax?1^WT9CwC2<&2VrXV}vhtJG$l
z{nJIKp=FL{+hL@z_TO)Afql`zhs-FjH_Sfd-~u^B_pgyZOwkHqWPct$mq)@sIrq*D
zpSxGXTscpFLv1RfRXq|um-E8MwEH9S`y=wg@Ua_vPC9;iI6YYu2_M#c)Zy$Z==>y4
zY*c)-)988l_(b@eT}XZIu)?T#fgzFOCE+7`Us}%2R`@tOay%tckGk+V<<R-K8zbk7
zBl$*-si#KDcW?M;N9rFvqEYGVQ~u7;r5t_3N1Htob#7n5b?SI;I9@XQYO1`+7lw~%
zk#<e{G<=SJ7_Rqak^Ca@vj>LdZlqsQNJFLLUJ^bgUmZSX@?=BFvv~5MjyaL^qx~z#
zhUIcv<j4xA;>iW!V_;$Um=wv^S`<EK2P_<KcKC=+qR*q{vEGWv*M*PPB;B4SPj04b
zpDl->MV}zg;*1B!@+L>=qif`gDtGqJRQ+eTU*jI^*|;;=0W-uQtO<sg#X4Y!kk=n~
zwx>qw9B&lvTyH$?q23hSdEN}%!_@AUINUoL_XwSG5ACLDH&wed9ihD6hdV*L`)jv*
zU@?*@0afFvx*ZAwsy7Y@s4+7wa5C<Jfs=5j2Ts5}NMAKhyW_PxQM>!%n%bw1qs3T#
zK1odGXp7-ugxHf^9-hc>r%Bx!9`9+W_faz056TgFBA-2?0``FVivePw7$m}DdqUdH
zX{*xKrfo>u#EVp4cFXK`Tl%@(FG@@4Hn7_x={Iy=me#x5_--$z-{1Yw)LCgGy3I<P
zoO(>!+-?iHy`H`{?S!<mx}DW+bNWBK*L5pPPfPzay?^(V?wh*z&v1H}X;-9=?LI!E
zphxdaH+@$3xfx@7jLjU7enR(CGUoP}mpO%Rdwt5HT8uZ3sD&yw@9(jRnMB!BD0`Y<
z-<!9kGDHvRkt1@cM^9?fi@NloHoH)te$;4J(%Fq#sT6nXLW)`6K$@zxcXT<kJCUZ5
zJBzk5av!8MjoecOa|doJ?nGJ`H*hm9GlV+NJsWV>=5pudjt1=3<c<W4#9Z#uT*hK9
zcY7{(K`yfo=VtC?BxdencC)T9ufSKzj@D)Dij~oOD$hY&t=`TGpXKKs!&wsYg~HAq
znL9dnEIFH$$%Yx_DsXm+u)}Gfi<&u)_WUq+OwSLI7xX-wbQl|Xuad$DYM|Z=wS>|0
zIAkxW5HL6r2OTEw^;~st^X8I@mA8Uf>P#I|$%ZOf?iC;yxsp9U&d{T|Dx8**sQlQm
z&buk^rkp2qYCVZ@f^Z8`3eGP$KYvmFy8LxL-x~fU(gniJ&C7LrnmKRhJf8DpPGinL
zDfe+a`#ew{;Y@bUaISRj3|t?mrCwWvizb?dX4=E+j+Ux4Q8RZsai_~8oheR<bCt6^
za6_OD=`^G><k8N7&e_g&&V7NK0`*7>ksd7PJ2RZ~oEx2$fhB<kq*IX2lts=g=K|-q
z&VzySKqJ!0NDq=nIS0Vzu5s=O+!$D|>t<$OokJhzOrxHvu4eW{Ikarfn8>+7-`crL
z)nE2nUHe{<c=NKqRBZ$Hh)AZhmWL&*`^uL)M#$Wv@L%?2I&PnENcKNzRmK^y_C{jl
zGa~{se{tR<WJ*Gx<}6pKG{<2)W{2knA@&KUlhY`ioUfyQgsRxP(7IQPWb<;~J-EWU
z(kipAvaYs%gRXWh`-EoBam*x3M7j8_SSo%eZWgzQW#U$Gn|q+jH+zyWg7<O^mu?L4
z*N7DJLG#h%gV}X`#$1R0S@gwc&1aKmMoKYD1ai)7`3v5r%h4|qI#RefhsXW}FVx|?
z(%N5()I_C(f!zrQ)2*2OvG8(Q{eqKq3cE#O)QF_)&s+Zm3v`^_slhd(8~eH+nje`T
z^CsP=yh-=D`GvXJ{IB_?`4w+d-9bs}v!~>pu-itFn)PV*w8VeJ;+dLL;oRli?W}O_
zb?$c_a4O;czjq#S{^0!4dDMB>dB|B!ys^Z)!YOmEc7Eer>s;^L;N0Xaamt-roMp~!
z&aKYP&QgarW^xvb9!{RqvomStrHfwd54_9nz<YuB*%$bb{eX`HpQvY->;td|5b$}m
z;D3QFF0c8yhHJ7T@Rf7BvnKFgo?i+h6J!DIcOx6*fLxFVdJ3~wKKoGzai1N`{d1H&
zTF&P#I)Hm_2KUlg+<E75M_t4HcO&=JJ<fg3O75;3xfhpkkF5{X2O89!mNT05XQOym
zY!dH@_r(X|L-CRLSbQQr6`zUE#TR0;_^<d<d?mgX{}Wq;&opcpCY$RvuT3~S+I0=j
zo$juo4QqJIr=Qv1+|?Xl?gqozoi`^3^Ty;*^^^j>vxhm-+|wMz+moZsy<tE5m}AXx
z=6G|0InmtLoMi52_H&oIzjJS<e)-%N%|D}8vloxiJMOGc+*v`~*)DNsedEsh#hvw!
zJKHtxOx?rHKSQm}%|C<ny5(o=-r}b{R*KzuYv?hn)_U4{#Cpnl*!rXOSL+XOt{1Fo
z_}5>oKUsf<g;iNET8~@ntu<Di^^*0ZwbptDX7;?b&U)5e?%wULaPM*Nb?<ZUcOP(9
z3bW5kVlew%M>t11M>$73^PM8+C(bd>vCeVM@y-J0r_Kq^iOxw*v2(KXGv^fN=gz6l
zY0g6DbauxUJ7+q-U}x+ccErwSKdjWb(D}7<k#n(g8T(?FlJ+9f-c9ZCvBNi*oxP#F
zYrvkKdcQ!uU7&XJ*vlKk9^P2??#8ocH<7)%NzQ)k(oJ;=d4FKKa}axVGo3@&tDDVE
z-CTC))J~n5_fIiwdq-OPvx3Dl@!o}E<TsgvS{1{qVXsNNxwD*iSyu2S%e}nEazDGl
zPsqQ>C)Iwid|EyupOw$a=jH42zw%3VX1|vIlUvl@EIYHN+L2{HHibRMT>^d8o?~Fw
zz<|JRfq{YD1A7F91%?Mk1O^2L2ZjWOa-WY7qmpNTOSu{SjuR7tX3z;H1=E5V!C){i
z*gM!aI3PGEI4n3aI662sI59XmSQwlhoEe-QoEJPYSQI=ictY^x;Hkky!83zr2hR^)
z7`!BSMeyq2b-|m0OM}aTcLbLQ?+vaD)&(C7J`!9Ld_4GM@R{Jc;7dpvgMSac9DF_a
zR&ZnRePQ%{o&2|!&Q?+hejNNf_+@ZQw#n-?N!e-H8QH<?yzJiDle7C~56B*rJuG`<
z_UP=f*%OfzW>3$anLRsuUiOjMyp4gL#+z3#vVD1~F<I`<`&NZK%}`G<{v}^#-~M%W
z?Qh}PLIuweZsoax8U<<usFCmxqhOPKkKOtY<cIPjwO`L}{by>IUT$`hI~ohlN6yC%
zPlO6qkpCfamJG?+a*muU50&%eVe)Wh_yzK(@+4UdS3HqtCqLtv$!R=2`MF%kbCaLQ
zW8|^&IC;EWB+rnGWr;jf{z9H5e<{zF=g4#AdGdT&Dlg#K%CF@`@?!OLg=Z_5t7j@a
zQTY|mQ?8c3k=L+38~x#ndFamlu4Xplyx;kp!)p6$F1O1QVsiee!HwBdvhU0}HRs%(
z_Xgk3c{%5bywc#uIRkRu&%QtRru^l>&vQm*PtTp1TbHvXKPhKo_N<)p?0LCw=Pb{E
zIrwGv(b=nWR_8p~^Y5yUa?^5qXFrxVB>T9W>AA<yV{3Eo?G?;U%9)paQtqPM$8#^r
zAD?qv_NlqUvKQxW$*IXcTlFX<vq)og@N*VNSI@gja!1Y`!Hq1Lte?8{R?am!*92ci
z@?k_`^n<nLUc&r5s_#l2$LMz?lEwIyHntZjqXYL<nl?IJzp$oh^i_KHEJ9}WW2cBX
z#8xb%pW@!(tBkxfWJ6R)M1l|9%FNjqe6(3+1n(CHyC+8Q&KOxa=d^S1ni$zdoG%3D
z#>mt;r3xyx9Vu(hB|%tyFv_e|`R(kb>MskeHS2xisq)&{m#Dw2myo^MEL)V#U)B@I
z>LN0uFa4i$g0O;_!OUI4W5CLpoilqE_*M>DX5VIAI|nY5GqG<>3-nDV&LHA&Bt2CY
zNpI=DtXbr8TqGA6+#LSPnuK(Av-EXl0{*f_AXWPU;gZ**?bR22O;6VgW0y5rO50}h
zK2rAM*^loM(~^|f$X+4Lta-{uOx>SZlXjv1vajQ6juEL9TpV1SH3~)RIV3I8qF_-L
zb;^7+PC6|(Eh`i0iWsTGj2QXLgb`$3LYOMC!>k$k%cQpmi^@&rR{fVrYY-NeOJ*$n
zSCB_fek_cF4Fu>h7W})gnIZWrc%r$C2D5|_<h`EEg_#SLpV+#dnTHo#LkPR*VP8aU
zWlqYRR6xyxw17HB<aX8~^_MwP7(Jdr)*?SLi@(eQ<o`$Bo5$C5{Qu*xnUj0Y$;lPT
zO-PXBt_h8$sG_R&t+uM7wxX(vlG<vosw$ysiBJtyRn%TfL~IeURzpeE8l<t5h)_k<
za?kHM=jH@$-+gbN_xGRQoyYSvb7tl>XSOqU<~3XL6ZQ>CK!pave$iw0N{QG<Dg@tG
z$XK|F6euNv9;uLyaOr2dgx-0iLK?xPL!k@eQ36ub5*K{RexN8`JY<A@EnE+f6f(kR
z29HR&6w)oEn|%)4))M!b3SBIr(|jtVH8EQ*Y|T_!LWlZPNG-S=dcvi1sG&kILbHkb
z=Hua!%^~%AM;WLLQU)tSl%dMI$}nZPGC~=tj8aA`W0d!lvC8|(IOPLnyz-$kLHS6T
zs7zAgmC4E!<zr>4@`*A{nXb%GW-1BjNhB8a$3Ih&lzGa0sLz!J$`{H)<xAx&W$_=L
z7Aeb=<;oIesq(d9TA^Sq7)iFCww_T*s83j-Zkh{IFNe%9l?^p6_(D-yP)kFGn#zV8
z2!1>V<dBZ0vf*0@e)KKyh!c?ctx{GiYm{%4waPkWy|O_`RyHar$|faM*{p0)wkq3{
z?Mj-mLrGV5DjCWyWw)|N*{keR_AB2i2bAxWOy!_*NcmnltQ=9Y%+ZK)TsfhfR8B#i
zR<e~d%30-{@{^MLho>CnlJc{1Ub&!LG)$M3E25^^mOfI!`2Pwr$NQpwD7N@VDi}2(
z=<%AM*!n$E!PVh<peUbMq?fvt?20~4AM|jBqJJ|k>=ybrQ_;Jbi@wd`k}JYJVGl~K
zMbBm%`ZfDY9t!s>c{JRLZ#D<LntXiOckw^xhn`3f`XLeMgOm%a6y6de>|Wsm!^ecj
zhbM+F3||$V8deQ`l6vTov<yFt|I|w1HPJ8W7}hPUS6IKWfnmeK#)ORzi-!bccX)&F
z(6Get2(<DG!<L4v3eOK)AAYZt8kUOoaCg{&u)|@;!m`71!!CzmwTj(KyZ%ao@Za{8
z{j2}C<2|3;?C*N@e<f}BZ%0*-SefJI&P5~VMnz-icZ){PpA?OsmllnnAAPe$^;Ufm
zBVc3Xiuq_rCw$V7KabtSDA|623RFc^RZW#KuaEV|n9;{<z8b9B)DX<*hpHv~Nqy0u
zsbOk3)*)jJGFBi*U|zeq+Cpuqwo<qFb2ZXm67&12Lv{N5sV>#6Mys)EIn4GyrIz=%
zV5YyKTFGBlE2~w+e7~6O$6S9cwYpkUeNL@`x&G%d>t6@+{PooOYD3KQH&Pp`O~foe
z=J;Py+o&(AZPiyW*Zx^y%03tCm$7>JRkfqqS?!{B#r*#lnD2fKbN@Zm*D?3sQ_T6R
zy~UirdevXSn&p1}s`|FtUtQ?$Z{*7WHO^mC-%$sugVo{cyI2J<Oda7LfOP<))Y1M{
zb*%b6Rs+1Jj`J_3j#ocaKkyF}awX*F1a-3dkvd6@S0}1d)hX)7f04VNV8y_6b%vUN
zH3PHMM0K`UFM#>|y_nrUsh&_zsoCmjH4Ah1hcKgm1oQdF)x(&>&y*L*Th+^Io_a++
z>t9^GrlzX}nAJa{o>OzwpVVCSym~>ss9sWkR&S~I)Vu0K^^W?RdSAV*{;pnEZ>Ybh
zH`QNNuc~97hTC&lLpl7Pl`-nfKP+FY-zY3wQL=KW$II4NvMk~MX~~-9dR3IEuSCuA
z{9|eQ%2JAZRF=|*zOwwkDM@^<e?2<;pN+}Xtbn%a4;bM;KIZzXvHl>`Db%LF8E1WB
z)-v^)Z@l%dNC1r5_@C892<s%Vdy+}R1Qq)cAw6RD!$1~*-n9J~a6-6Z-5aQkwcc1o
zoMZUM?1p`}(f?ws0{me-VZSU~#9RqD@(ubssKjPS{iP3t3o9kK?Q;R~zWKlcVQ;KJ
z7Ck9u%pNjjfZ&6z*pXQHcHxShBaHkkvn;c*z7HW_R*hqA_I;_OF#G&t_XM-Y0Rv%&
zg%#|+&{=)>;r5>PKA?SsJHo}DGJBkT80_FfjL=2gQHQ!2|L|BBO%{7Eduw|KdpCPC
z!NJ#&VjpiGY#(LsZ0~LFVec>AfE9k<VPpFt%MaoSySiSmU_KKvf`%|-r6cD3Ft3g9
zlPxKREGPq#0Fg5)^cxuYKg4P?e^K6s9me>OnGJ@_`787d_ZfC|ENvh~8wx4(67&}L
z8+HvWuRx|Y5;Ex(=sRMqKEi8kX%89O7|5tsqc3^Tuxn=N2#MP`NUYbPXNmHKzxtN8
zkjM>(M0*)}o(Dv{jTOlxeSn>gA{8i&s6~cJtgR<w4Vi{#Q7V(reHZJOnc-W^he?lf
z8|$?+yeIfCzen*k3VF#5W6dIb{iVblvUf<}g)BZ*-i)xUSWCVMtH;y%9_%3f4r{@W
z@T2@kxipn<1UV|%PuOqS7u(b9L+w-T%}`zrd$p(s_Q0sjsO+e<QE5?gqZUVrIvIlf
zM}H;FhYTN*d?C~S0#f~LWQ)8R`5;P;3W_Qn<%y~kRWovZ<d(>c$ODmCk*6YaBl9B1
zMovJ={df*PPh_k+_v1hF0_+^Z{~Bf{Ir3T51ZLC(X4C{G<U^uH<BQ@V7ht|&xdAG6
zmZ64G38Zs9-(aM53*U<L?na8Sb5`t|MY<32LuT4VYWO;AN&Kr;@5x+_v5&D&w9l|7
zA&=JBQ|%e{O#3l=jy(^#=5?qJn<K&z<EZSY<!Iz+?da&}>FDnm<``$MX0L5;WN&G2
zXYYzHp+9oBoV}7rHTE80-hr3GF62n;J&3?+!ZvDKa=^_(d!PurF0hA}va!FyhMr0(
zav1CHoK*ggZ*fd<Bsvy2mO0itwmJ4X4m(acE;tGtcb(j6b(VBGoUzVo&N|L!&bH33
z&fd;}&QZ<@&S}oM4h``x?Ql6_9aYhfEpN}Y=iBc%u>Hgl>WFfbb5wQIb~JIcaddX{
za>O}CIL14sI_5YQI#xK69chmJjx0yE<C5cs<DS#c8R!gmx||i9)t&Y1>+M^RLkH|x
z_EYv%NRedh`6Xkwub;7(N~BZN$aQEFHt|i^eJyrDODHX@wLy99Aq&duTg=>vea?Qy
z-ewgw_6YVb9OXyB`y=)_YnU%8jgS~-{AbbUEQpn1PqXnX0lOQn@H<j5=`|@%`cV2r
zv@mF2z89;7Em@WyP;)MzmTs1>V7Cp&-s$$dGfJZ??}4|!iT&OI_)6pP7BPDrXtbh1
z*f(*8Y}hMtpGq0~6sjA$5}q@@+(!746R3%?hq)tmFQ24N*hla)y=Lqe=x6K{z`uoP
z;q7?<z9f4AfSPNEOu~K(xC7h;?g5a;phTDht%w8ZbNB&h1sy7Ymcd~K0)ZgF20(h^
zKpXA|2TB7GKosBrTmZ(I4ve=Q<$zeA0#FI43_wERs0LIAY67)@+CUwk9?$@Q48hR^
zXa+O~S^}+sHb7gT9nb;j2y_Oz0^NWfKu@3-&>QFj^aJ_>alk-eFfbGt28;kk0b_u%
zz&Kz$Faekd!~;`+slYT~29N+G0&{@5KoT$?SO6>p76FTarNA;^1+WTO1FQws1Ia)N
zkP2)8wgG8CI*<YE2KEB`fdfD$a0oaIWC2HkV^q`ez$rU}oTZ%}XC-G%X9H);h=ma=
zB9bH0BKAjQMPx@@intMRFVZhEFfu&S6<Hy&dSt!G=8^3pyG8bi92_|&a$@9+$fU@{
zk!vDT(N<<g9*fLDOL;5Oi!VCgaVuhA#E6J-5%Cc-BIY_yMD)TN|McxgREnq>(IBE_
zM2CnT5&a^DMvR63goybOOC#1sY>C(%aVX+ML~cZW#GOcr)FMM8qaw>iR*kG3*(9<}
zWar3Uk#UhDBF9Hgbqscla*QwI#n#!th>{Ue5iySbW$xlza~RTlu>(O!(c9zSQOr%X
zz<;Ee{~CjTN-@uyi2qA5FT5K6nnE@+9siv|I&o0^gZ>+J4`&bkxji)gGaSZ$hR68N
zh{mp<VOYn(9VJosIa*^Es0;O-qa8zw>!^e}&K=cIyE)p=dZ6`CqdD5QmY^*~Eylmd
z=LY@CpkEjiwFvg8KcHWdB*H-$lB1@h4!#P>(ZJCRUxFk;K<$?t9UNUnjfd}_42qfs
zGwK#7Y8U>s7FfPEbj)`U7rjD-@DuK+p`fUrppdho_w$maBYHwzEM2g(y*uU*0?6W!
zvD(Du2*>wr5!B&9`&}7kP)BvN*bQI?74gD%X%Q4Hcn^Gk7D4gPG#KBREGSm3Oh65q
zfv0%KH2jMsp><!1rv;A1Xyw;BQt&0nXzjN+((%udiMlR34&Wc=7+U^Z$7MX_;2$90
zano_vf!#KaJNN>)Q^mhQD9QNuvEg4K3SUDkDfo9Nhp(cVvzD`-vk9JS<NIjlZ0&64
z?Ck7;=MMOH>gnv`jB^f!JY2#5)G+55=Xhs4{;Lx4JjFS~ImbEQxyZT9xdzXRohzJc
zohi<3&J5>%<Q7x_W)!fFctk)`Qk`p@$<8g#bmv}YrZdZV0yc*3JnOvR%yZsw-hqvw
zJ0G~XOLYahLJ5OHp}R`E9IhBw1y@z__vx;ht~#zpuI8>bt`4wk=4$O~=j!b0;p*+`
z?;4C541ZTY*Fe`W*BIA$SG;SQE76rin(MBcTvJ^MuDPxSuEnkuuC*@gj&dz^t#Yk*
zrMl8wyIludhh4{9*%aW)cICP*y9!*lT=(3BP3l&+%^i-q;9uDDO)c#E{wfn$T{m2J
zTo14)Ky?SYL*1p_4tI>Zg1ahm!5@93FHmc~w4lCPzOpPqkADMdpn`oiY1oY<_Q%-J
zbH0ndTmbgbJJ5SBg_SZv?mDguuDpK~vK#APPzz^UW+QCz24=j$&v=8yc!O%Z!D_rA
z#CSuf@dl^y27HmIzkll6{G)Ffy|NdugXbm7OW4UVS(%JoBm2;suYyoy%nYtVEOuDF
zMXGY~9oa0u%NC?ZoCx5+NT3SR!>BxZSq*TCOMBiM|K|zVYq<_RiQ{;qSF&JlVhij*
zY=>QiBhf!Oiq+abVW*$>ANB^nKze<B?l6>1s5`>#L5^2*MYvq9a;{3QYOY$Ydafp}
zmaew0j;?O5US^G;us_;7sw1w2f36J_?mpqpabI@daNqUNU)KwF6y6@|uI#SvuI+9B
zj*^Iv%U#Z0$z9D|%U#di#NE=}*4@$F&E3o0&ppsR%ss|E-W~6r=1z1cxffEI=;Y{a
z(YvEFqmM>sM_-7}kG|zz>|Wts>rQcRb7#2syAQdKx=$e<m)!a8o9?@AugA}$f$s^P
z=m#-=G1iz+#Q3cHf;$g!zT<x2;U3i!=n3_d_BcE-o(i6-RK`Od*<<zCJmH=wkH-`1
zsqCrlsqJatY36C|Y3J$e>EY?^>F*ir8Q~f0nc$h?nc<n^nGe2xo`IfWo-v;Bo_NnR
zPogKuv(U5Dv&ysHlj=$H?Dib+9QGXZWP5TwmpuiZTb_H-I0yo}g7UE2ohw)U(dH`o
z*e}ABYuGQsl>)5w<;r#J8sW+f?1JZ5?}7gbtogwDD6IR41?`I6R~+j<Du8ywxey%d
zK=3bubs(sJ$}iYu!m%O*Uz>8%Uj_XY`{+4Vh&%)HEwTFq>qM%9_QBpPj`bq=c9h%L
zkHWEX<T;q{V5Kp~8WQ{)DZgRIJy-5xhYH7<lIKAO-~<VdwIwfrz9VBM5Nk~8f)0}L
zzhyb2o&-Iso&fzxJq4PpVr`-2f_fTsg{3#>O3PcIJ1p1_r07`B%&}~?1k4Yy_k}B7
z?C9sJA9nY1Rq_u4W&Rl5t6Z!*wDiP@0UV?1!JzjnLqP9aupSTVEZzn6T81Mg%rXj;
zTSkLQmNB4ymiIs{ma(8#%ln{T%8Nj^$XoHo-~Ee&KER0t64uw0mBXRGE?345CJC!*
z%HV7b32SSf#hOnE-}CG0_t4)^?&D+wKdiqgEkBJD9Q@=7mSyrQmOe0jWLYk^v-E{2
zRsO=#Lp?|qjQGF8$h1D%3kyd2OEA`NXlVoUFsx9UCO5Xc4D)dGNpL2Yr7g@O(L0$b
zH?zC~^JuJJn<Y25;QtamnAPaLw6L^?c`Vkn&5>JSr-21)de&myT5HRzFptAJx4E+T
zceY>@vCz^TCzBl_8Ebx0<j*Zj<(ILxUB>#KO)~!N<+heL@f45o_<YMl`Blp>JWa&v
zxFoDvX)ji%%abr#pNADJ9V{c!zKL=FA0!}<s<%MvE85)vqumWeyStc*qa|Dk|Ke1a
zFqHQW3O7c@rNn9qDr4+|jI`vVZHz)ojNPnaEd<q)AIcALW&kIboF^CH)PZ(d573?(
z`rz6~Z5-$f?K99XG_>>DR~q&aY0I^hpldaZ*|cO0{TgkXwjDHG+X=c$L!VgtUONl=
zllBwndF?#tMeQQ!uNr!e+I{T-sIKYQi-7IXpmKl;ss(7EK>@*_p#dd8qXMEp9RX;?
z1EK?>LCcC=3;~q`s({uFs0-RIpdD!6fWDxE0tSg*6TLt<%?D>4bjP^{pWy7WJvf)3
zIL;&RunLfK4aZ3X<8Yq9Je(b{A7=w(VF%HTzijVcd~6<L7G!0sA#vD%f3$19e*m%a
zM4pU)wPH$XrHm4xR8^kA+Z!N9i~W;0G{Pwe!;50E{82pcUloe;2Oj-jeNy<3CDxdV
z|E%kU|5~N6pT0%W|JIyG|6G3Mkd~JakEV#n|0*BMbvVX9p|Ju-tipO&wEpVxTybFS
zl`m(S{UJu5{-2i3e-bB-6Dmv@j0-ZD1~}`jEcyu_QFB8=*Uvb^;ccAZu%7zk1cpsC
z12T#<N`#DJ4<(^YzNLjijz(WWE^(HYp@a%31?N&epgkz5cC=UOAa!PuQdemhbD@th
zn!O;-L1XoVG=#Mj(h$}LrFWP0mmd15Y^Gm(OKJAG*fY-GP-I2sy|AA#kiY3)!#|D>
zz&^fj`4a!{{V(Co+>jLE4-P#loTesnlM*2@x<Z>#<0n%#&d&IXb;a3u1#GA|?SiFA
zzf1Sow>T-S9m~Xy^jbU|wWS-cZkcJB$vZ+OJfC+Gd$ai)Vox&fC2y0r^Ec%k@(%u%
zyi?BLedPV}e%?<$ARpv!%ZKIT{2g)r5Ff5oQ)=)L*v(sqk5L*aE&2P(OG-N)kKMf8
z`84d<l=-Lr;h51}fIW~)_;&0SJj5@do_2duYV!|zYbTMjkmeY*zgSVP?KSk<;*hJ5
z?)=l<+oKg+LaHbFacDd7J^xuMWUfN{o0Vp!+=x+B^Qd-F-J<$L4UQTUH8E;NR1##Q
zYob!4G9WcQ7L^l~7j-MjYgg?ydxSm4UfEs?vcT5%j*z1FhtzzWeTqHNzQDc=^0ICA
zz4pV9mR+zH*zY<xMtCJ14vgrkVU*bnBg?KBw++O2d;&&ka~+Eut1vQ4$4Km`<E-N{
zMqhuDJ76@`!`Tlbsj(P8C1BLF6l0|=&fU&K&J)gDXTI}}i(DE;I#KAmR&~`zzqJj<
zGre4Kt`X>+PIb*e&vb<=8Do_Ft}OIHFJWA8&+UiNMmYMJ70~aj=Wgz9hyG<B_h9rb
zC%R{#U%A-5#+{1ZW2XBUdX9PSTj({a=<`LO7g*U-%hL#by^fxq=;sadj6)wU(X+s_
z3_ZDRp1tVBo$_2j5AJR>kG4jajCMrFMpuij6WuJjZFJY@-q8c2M@3JFo)$efdQtSM
z=#=R6=mY4xo{hd7eG|P<IVLEkbc`paQcTU51~DyTI>hvd=@&CJW^7D+OhU~3n58jm
zBV!@ws1?}&5|_4+bo7ku2bs$#$U3G(CP3=4D00Q0WYjk!??v$_Ey@Ndwks+&s%liN
zs0NWXNN=JdJ@^V=z`qQn`}q3ykcRK?IKD?Av5hcJs);pPnDT~{x0xa3^|dW642fb(
z)a&!q+K^(jHKZ7?7*dQbsMVvWt1&mw&5)e-HYBJ0j1wUy3h4_?f;7A_O@<7n8BM{8
z#y0e^kjBtd$Ya{mG^}atNYgRn(U4|9I@5&E&ykx^0;Du8Xci<jFHs`;NJD8hdPKu%
z4*EhP=~MK4#?V~!ZN|}O=siuPB=nW0(>(N&X3~80i4y5^^m^vf0`#ty&==@SEu)3#
zMXjJO(Pvssi_j}tM_*xvWeP18QXg6ZxzBX^8nT}RT80%W`)Rq50?`V{fez9ttWh~k
ztBtvlHHM7)8$$}d*4X*J!I%d~#%#z`N-<>Lki=mfy@Xv~C9u!Sf&bfv)S6zUj`Rlg
zra?4<KBfe;DPkYT5?V@MqeS*o7E0xcu?qhV-Dm!g5{E!e9Lb_s3@ZzHaaHyVYrs0N
zPOLlY#YRGYJdsUe@hpMOVu@@H`;>jb7P8fBBTHeMSSs7fcCd7|mmOf=V-NBX_5(Z0
zve{Xd!)~(MOh>mkfLnPn9*C9tm5Ns7H{ngO7r85cjlad?_((nuvgPTh2cPnld=+1f
zk!dpDDE?cF*@=@p8#UqzzsmEmN8^szpCL(-A0*mAQm_;zm6s|>)uiX7mmuMOUFs>l
zfwu4+>_i?U4aNz_A4(IXkFX=zx7Q^>N|Y8!UrCFlCD@(3N?I*#z{>gUSQjr=$nV6e
z_<dL#e_T2#ot4f>xzc&*XX%=B!_Uu8!MQJ~I0g7o`ziWDV(#f&;cDHBmP<x^m@S`?
z&&!wOEAn;!Jz6MsdRNt^Xdi1+(T|*|twT>SP1~Ve)e5xh+70a{`h&N$+uCmdDmLlc
zML#dVgMMCR%%e8MSM|?Ic>dp%Zb(tdigK<0M9KQfb;keGay3i!h*6@x@-$2Hk7emA
z$^MU(<OhW%DfTS=_vP5)Z&p8xmCs@Yw3vw(E1$&*XtDbFAFp|S|L<nweRJ@IGtEmd
zN_n)NKiRSo^SG&&&De>%6{o&zx1?d@at>#;T>9Hp+-4oS?px1o%=v2Kgc0<@1C`?9
z{6od2geaj(38kbGri3e{jJo(A)kFpJR!W?LQ(2V({AY}NFZ#y_s$jHl*??0QaVoCm
ztl}`91l?ho2l}aHK4_9*Mvn?+NXtMm2EzU#26K@4Y^(#oneqxo-j-{M7<pe)AbTjJ
z_Y_DVU>5YA0{H~!Qy3NBDAXT9$H*N%#QCT<pd%dQ1j0dXARP3)!K=h57;78uxJv~3
z4aoZZgl@Tpn20fxP}n7`;LJ0_pHIJMJU>LZ;#s`SQ^@br9~#dO5uSK{h&lL*X1GPB
zdxa(uiqBPqBTV2cv=b)N&h&@SEceh3KyqWm4bdw!bC|Gh{tqsu4N_saJ<0dT?ooPu
zX~z8ph5n!9c-)pqF7orFuP5!r&Q@Pu`sm{^|D%hz-{5h-Plo$vH*pgGlm4IN_$yaq
zZ|&c5Va)v}CGt1mPqxC}<LUWFK1hKS%#v)-6i`XXB?@(6E1rG!$%XdGhHpu%>@eI@
z3hh%0?NeZ{p}rs-xR|EoB9rMV!t=R`5KWWmDnj+yiEvGm&lQ}7uEOMV6(-Zw3>o1T
zxr*3|P{eu^U&z8_@|tmmTcN8k`CNs`#|!^Ou4c%>&U7_HMrcL6BIIbJB@k`VJtfA-
zQJ<b%_?%Lx?<myM3-t`>WeaoCGzlJ`o#67B1fS0&IDICQSLBP&PUMDZGI^8H2AXyz
zZ!&gm`Rqi>O_Rwh(q`J3yeZi0W!jm%JBoOB6uoyx5ig`(g&bm^n2&cy(R<U2c+-n`
z(~Ef1i+IzEc+-n`Gm3aKig+`Mcr%K4Gm3aK4BpjfcjJ^b2E{rRn6Yvmbe%!h8x%WZ
zVYAVoDF)qS&{TtNHs}_E3i)ZAvdy5|4Vq?9thR!Ex<PjuG{c~~47%H(dknhQp!*EE
z-=L5nfcJnwzcXm2K@S@AkU_sU=wX8%F=&=Su}TZPM-7Ty<}e>K=y8KWDh->H28C=I
z=F<kvHs~3Ho;Bz>gZ^aDT!ZEq^pZjGp9|je2EAa=iw3=H&?^QV2s%I+WKc+}VTQCC
z6w+!?NUK4I8FaWoM;LUZK_S0}>u7_HF(~BMuz~y<6!L4(aR&XspyLhtp+P4Y^do~#
zH0UIQ#v639L8ln>V}njL=qCo9X3*&dong?K22C*NEQ2N*bhbg~81z$v&Nb*~22C<3
z`W%QS`Wc{~8+3s|zcA=RgMMkyuME1_po<K;%%IB+y2PMM4f?e~R~U4qK`}ppe{0N7
z7*w?4;z_jHK0O6G&P;>7aPgUho6lsriq^wtCt45FWV(v>!DlC0LDK|RjH|ge8zVce
z&13<f3G7YGE9CKTVUM#_VUODv1ib;eK&mBNEiVeQrIVmkSJ+S;&}$5JK+a>R0|@O~
zm<t%b0{J>at%eP1wKju0g&*z!y~a`JwFE9)XGyJvz4VgsDWT5G1rqAKd|g8Ag$?Se
zHpA~J;m0pln1wu8n~5<h{7@szPKU5);mTr!Ju55hc@tsgO$~E1;Rh?AxHb<mM&Y^%
zHf1C(xFkvVl>CG}3j)2uf?+d@*@P<#G3-N)xAZV<UI)F(dcw~f_6E!ate4>@!*JbY
zxb8Mw#k&e{cCL8iNzf}CU#>Qb<I6=p;LC+QzTAKi=~-bTRR_H))eyW=O_&R$=Y${W
z8^d+2;kwRnU2nK<5Ux18hHFVUmspfYOW~7R!JL2*yvQYytFx$sL0>g&IvQLk!GI9z
z4D%K00<(p_f@=aTHheBIe4^eWeAHXyIcjwPV`$A#Ptckn2M&SevG0W|J1qROBf>xX
z#jw9=*!&7Qi`@cEV7Cp|JL0`u#4w4Am@nW)>2nd!1l|U8CKqX$#Stseu7=HPf|qwQ
zc)P=Vg`+G2EPg0E)C!cHHq*}{{QJqE34V(3@23j?G(*_XOwdF~F+`rs5+OjY3;%@H
z068`X^cpKI%&d%X6{8ZQ2sKt)z#?IDo!Lcb47E4F!q6I^o}hiuk{H?tq!BFx{4X?o
zqGf>3MZzaX_(&JR*An@s!VjMd`(gYum}l`M_|L<6#o~)Vivgc#A7H=I@VQEa##h5U
zgRcP><ERO!EvJP~Nz|XK66z0X4r-S+Lpm$Cq;rBx%7J+{`#`v|@t{}Ohp?H&CcvD}
zK7v_i6NP^^N%)6s8zJ*N;fG%qT>OgQ5@R&P`6ti?{HpNDuNgiIKrIqV2X7apb45bw
z;9C}@lP{rkG+laK@Jjen5T9N~%n=j#K}_Huanq6{#0P#5ANWChkUGQ%A;-gh2CE4B
z0#*q$k3B88SY;6cs{->?R#ot_XJEe0stI0(?+Co81Ne5Vpm|a;&?{1);F5~Nd{qh(
zTv9O1*Cm_r#t?(6pW**)xF$&bL6f97gLi<z`;Ngi(BK*b|7E4Ypbj=oaIxuvi;0?+
z#8Af&&zXXYp{5~*sA-5H>Og>#p#^~d>#(24jB;csN2FAg+Es>9gHMs$b676S1x%Fh
zHD;77n~mArJcKugByASbfYL$=ABeE9CQ{S@ln`Q%(2>p?px32eL|D>Im<yzQ&}$OP
z54;7Sv-uX`lWzsh<J$x;PX?XAQ-puMUHHe`jHtW2LFeH99Hfe8z&@Yvf?4MqL2uJ{
zu(?W^pm}r<HVL#3bOufsL^$+4=ruYFn?yPSIuEi##DR{1&VdvW@uVMMo<&Dt&Zi$?
z*69H9s|@6fk~RaOqDJ8js8KMZM&S)_fX*P)D}?<f%!!ayicsGIokx8@XF+x;!bVBq
zJwsqFpuV8_gtEpPL|G>hN*S%+JK}9zxL)N(P2fgN;3Bjc9Q6S?A!<S*hktw#@Q;5J
z)Cc6pNVs0-qhOxHN5fpe#~`%w{5{YLd@N{1{yu0WF5;8VMSOIQ_@E6O3VM;h3wnVM
zgC7eY4qAqWBHal{>$`@2m4*o&sTgiN7f^rHg=@%>0fwH(Rv_f7Y$a$OTZPaP*lN%j
zY>kKy`v&wHTML^+whnYQTMv4lZ2+Ce(&2iYiL#x;METERn_-jBP&?2{pmqfKGt`cN
zG7L2W-xu00)UPDaJZT>MK!OH3Lz)en0%<<zHR*HMBuWcFXG>pz-j^1F&XW);)Jnt(
zwem~QS<)iVThdpcx246Pze-C$f0LHNXTJ0`%(}Ep#6emv;vgZVhyzlp-Ib8ifXZwm
z@?-|mmtyF7Y?IKDid5tID#M;@xd8dHL*y0ej0GWIh5SL(B?aN&egl|=1YFc86?8Tv
z13bWuF}tW;R@fwB23pjs60o^WC1IXJcKC^<K$vIYv@}t#Y%uE-0y+~Xr}2Pr)&%xf
zSyRwF)(rLuLK2G-X#n#K_9D#JSaX;YSqsqntP$t})(Q64S!b9rqX{~TwE~^TUV?o-
zYXh^+UICrSgJ5%&Jpj$)NCm#&(l8fr#2ocj#B(-Q#Pa|bN38I!hp<WHh#P7zVvc%?
zn4{hzPf%l#8>q3!0n}KL1C^K;v>e12Jm4wLK-+N+8p}mq&Eg_wZt>!vcesYo^0|=%
zT;$bEUJ5?Lr82O;Dn)?iNs+KmkiuaukPs`>nJAdANytgm76<5k30&xHR)YO?>1mkf
zNR<&zd8rC$1*s}%Md=yPN|F<<vm_VjJjnz9`BF5@x)cL?ODYRLRitt-&y=15y(7hf
z-j&M3K3b{(^F^s5=ml}YnenYbq6ht|ILplV)=C@C1rz~25p@OUazVdJQ9?)g7l)2|
z2ic>f%|zaIfsSvMbv5*>>@}gI1iKl}1?*+$qMqUg57ftNtR0>OU;D!P*+J;26|ahV
zic;-p=y?j#30Z}pDF#h9Xa=ZH66Di`51%B+r|&3y7QThO&%cn4h-V=i@#!K=@$B=T
zZ1MSrgu$>E@)F@Lq$NJx=N~(U3ZH%cQwse<reN4ZqEM*&{6m^h`0Vo!NrLeVIYOcC
z^A8z9;j_;_<OhY%KL3y%7|)O#6zV?zkQx*|`}{*<fb%;|372U~F0xB0GVLfbr5Bk@
zUXfcqUXfp>$>bGzX4;v&BHw&=BIit#$txsHrk%+P$xM-*$t!Zv=TGFLX)<|5UYd3$
zugFiIoybwsWb%q!HSJ7Zk+Y_q$t!Z#XD9O4G?~02k4-z1*UV=z3ia^{laE)Je7wTs
z;}s?!uQ2)EE5@xRubI!n&g3=oS=gDpW<L95g(6lyS)pk%c||=n?Mz-#SABM7J_{L}
z8D~hqid;=zNWhBhOkOje5vL+vGoOW>$!q4burqnhd=_#%^SzLO6~4pFXW?qT*UV=z
zp7-UIF!^|e$;T^9zV`}~k5`y{?-ddNlh@2=VQ2E1`7G>AUNfJCOwr^OZGp%?VQ2E1
z`7G>AUNfKJR>W)Ov#>LH&H60tOkT4-3%RBFUNfJCoylwFv#>LH&3wlDi+Ig^7Ir4D
zna{$`<TdjdF)rj4CSQ7m$;T^9zI+xYAFnX^@)>C?;x+SG*qOX$J_|dO*UV=jfAytT
zn9TQ@`7G?r_nP@E?9BHf4o1lc*{#V7_aZx!*UV?(&*U}pSx9?LUNfJCoylwFv#>LH
z&3r~^MZ9J{3p<n7%x7We<HcJG<19?R_X?9Q&cfv56((O^36sfd=ChDNo4jT|3p<n7
z%x7U|@|yXKG#2ri`7G>AUNfJCoylwFvygL}?=|yT*qOX$J_|dO7x6dB1Nm6QYv!}C
zGkMK?7Ir4Dna{8(;x+SG*qOX$J_|b^FE|U|D@?vP3zILOg~`V&Oul>;CX?69XS}tD
z*UV>OXY!i)EbL5PGoKO9B3?6}g`LT3=CiOfdCh!A%8Gc+d=_>lubI!n&g3=o8F^8}
zYv!}CGkMK?7Ir2t(r%Oya<7Qj%x7U|@|yW9>@qONCuV#JJ%0-Q#V`pX>?%XrN;D9d
zi;2&ZnA9AAiNxEO6g-TnYn8}00>F7+q3DNWd_wi09{;6N`eTniS3yntM>gn{qPGs^
zhd1Hm2U|h-<<gg;aveD_IpuOH<W$P3no}*OW)2hQW#dhVpI8~<H*RMuxzh*RU)9cx
zpWF3j?+;gx@@$%LYgk_M_`O~4wwt`OcgUWpml|EaG=0m^hij)>^nw;MCyh86GxO7T
zueX@Fd34Y-3HM6hX+3N6=)fw8CmIJFp8a(n_xH0mw=0`D`};;p_MAz*>tueqrESci
zxyPzqZZx-K-)kl2R(tiQW}lsWzHHN^Z+ZnLC#9DuNT2ul$lxCH_BDw;Gw)=Li}mM+
zwMc3B`NsMsYc1IPiu2Hdv?isiEy%8wTjz`K#ul%;aQ?8;-z-dT6kc7BnhSRiJyCCA
zZta|U3-c;psJu`E`7*h2SoKAV-!F(>l-{Uhr9}n(&qgh}fAL<+#m?4SYA^ZbwbKDh
zzInsCamo4mr)w<v<=xYfOMV%Cy3Ep)X0|#@Z;m)sdTFSZ{ld~vYxWCYuZs&_^YzA8
zf{%dMj(nXWNVM~0sb#6JL}o49-!iDuvJ2gh)?9v~&9CK`|62Tq8Y^y<%&NY^BWKlK
zIeyrViYvDcD)a2heXkyDx+*g(yXxu%LvQX{z3Aqes;j?i`a}KIKUF*vu;x&!tg35H
z)yr~yGxgma4c1N=CO25SaM<C>YqOhWR$jlN$<Zq7)81TMcD?PyoC+I0AAYdnh7Cgw
zR!sh~pK?6;%R$$wC9m&&vvP83$IRg5y%n;aPCnExvqJLmHzIj*el<Ma4!LdJnA%HD
z-Iz9zFWtDa?sw%k9vKeu!|0Xz#?uj(Ds8+n<h$sN*WZKP?b{$M<h$}I(+1uQOj$hk
zKy1qTVF&i7Z0i8ifw%+ZQVvx=P&MUn93D?pI#503LXQJ6DL+4x{cOsOJBMRae*HD)
z-Ay0$J^$3EuiyLjsZAT-1UW8!Ut!bfXqZlS`nK$*>mlDhyU7}~uSDvyvHQ!VuIdP~
zz8^@kAgML;!&B2cz_hzvkd~TT2Bw0*{o$#1+Q39Nsodt7@9rzRdAS>8wJ@z739_ND
zAOk=)3R8N6gzlSnUD?-v^TGCb{P7u(GZps*Y|gE+ugvD(f5&5qy8Fs*Svz!Z%$99E
zK+?K`917d3Z8=glFL+B<wXD)xPK|)w<<cPc9_)?T`q8_4qPKoI2xPS&8wA<-Hpu3_
zAY0!7+1VXrR~L{ySNHVWy5~)p4%P=bF1-9KT-oz`qPI=$y4$mDZaa|V!65rvgFNWC
zyY;pQonf+_+U?msx&1Ep_StXmvTy%%I84ijfNUB7vh^*Hoo|5bdL86qvBRG24~xU}
zum(ujhagWi2C30%*H7E)*892i_7+d?dOB@x{|r}J@(7S^eL!yTjM%g~^)g&L*8lEu
z@7U2PBYMZq7^UKlZ#(UDrhobJIcIvxsB}mAwr=Uw($o9El+g=hcTbT0JwOh02Fbht
za){>or5|n$)6po9Q}sa3))J(4dQ^H&HJI{95D&<m34)AHSJUs&UPt-^6^|rbZ8ngo
zERYJ_({AtlVE7Ju#tL~a&p2E)&6bf}E~{<E&D&{~jC%xA?QQ$LyH5xH+Ijb{&9`Ol
zxzHDfNYCo-y|?$%A*Ee=lY8yIzISJLZ{YsjRa3ivo94-g`SyCN4W$k&=$XItz^1qz
zEf1XNmy&fL$dw#(a7#}*cyN0UI($f&vbMWIe*Gb9!1>4@PW0azbo5mJRqc+R3IF|-
z6Dc7j>Ex!qJAOWush5k$PK!7ibav%{1NrAZYj>j9x!j234{}!ZTX-QSwQlJ5ImcWJ
z^Kwp<OR1QXT@rTLl@?~^<j@Vuxe>hZz97<1E21Or{^YMs*K?BxE+`NrDtBL`^85L5
zy&~(JKVJ8T66bGPS3bO$RpZu$i?<`@KfILNC@JOAZ-GDCE^iGhe*f~1-B(Cg_E!DQ
zmN#o;Zgl>+*S3_ue#1R8|CclGeRbx}s;F|xZ|C($cK7>w>RtR)_4jp+N}heN@@<>*
z!J(FZeh+i|Z$9ww)y9(Kom!o9Z%+8H5A~nIZ{BB{TLvDpo+<U~y}%7`%(+z}x8b#e
z&wLtn@IHiK?D0Pky<>jKdoA_XtnD_o*1LWG>XoMYTiY7@4b=PYY4v*-z5m*-iT(Bd
zJ6>P<wmx9t@Z2}_xP9+jDXYJe@@h_Feem`+H&lJ-w!UhnKFo47u#-OGK-~N>`p9`t
zE3NdAN9$h=(?^~ji7-be4VGTgM_&*A^%Z?gdf)S0e}DP=<<{%(uX!gY8k0IAPTcrg
z!=IXW?KtnadZ09}9_{$x%*A>1@dte0bXqh%_iO|DU~205TsCZaQqpYtcGl#;Dl~r9
zqKE|AJgZ>OHTr1woCZmB{IfaH7MlLq>0g8CQ&4|{MzV-`>%yv2{DR&4Z_(i;%dbSy
z4bVVl0li7fmrp)kgC;NkEOH^GuShsnosw6679LKER_^?<B7L#)#~(}4H!Dy7_$+<A
zdfyLKX#Sd2C!S?7Yhtt7(#CJ*T`foB*Di{>LHpLt{=O+)UYB{qN&D7+c`=AS-te*K
z3)-;ZQ@`T0X~Q?)SD}p?jvTB=_mbmp+@NX6OEW9bl;r$O2mQG5gWs>y?2R9NSDuz{
zoD6z=<7d~e8`MgBQ>GRa(1etQ2V!YU%3{#HDeDcJWSG~aP5}KTHGY32O-P-(zZ|Vk
zO$42ox@dnn);0C+{*IKAO0fB6^GEy2(&o*RKtI|1Dd@$`HFmY2-CHK?jiCu!rhvw8
zNigU_&~aOqfsQxmlC7WaiKeOBmhSe@gl(%pCko2OZ+igq!flkT(P!Jg*yX0l+n4Wh
zvw>-IGF-GYZ7yhH+9J@2X)8dd7<59~8kn=wycsTia9UfK5AT@rdo9|%Bl)*r+M6Dq
z?x1t&Us5HCPhXK92)YI~<I>lIPD|gCp2KYEXmMzKdUlRO?})CILtkvrEJ3L=XloW|
z*u<rGfNRh6Zm?gwbD{n`eXw)G4m%y*nR44gi96ZuK)phSmKH^syQZDWrcZY*-yTWH
zyBC$aL=$&^UC@y6J;}-&G;MFz<tp^$zNC*CrSJRdw_oXtZ_}=orAwJx@*?O&X2!}=
zbm-v9EA{Eq?@ymYDP-BEO{3&vYff?c_&87ZQtFARq4Bi)^t^~tv^aZB_GR*(ojA%x
zN6#&i+B3?DAK{>hIY;FKl%C@lH%`!r<7m@QGh?<=dhXtzWZHRk`z4Ld&Cf!|HU7qo
z2R-QCtt6|JvhG~cw$hH@vat#Cmj{cxmY`|00$)}KOwACb1vwU`(+9SXmtCNgk|}w4
zw5jy=<prYgM&kxSuhBM$<!$&5^<Y+G!%Mneg^sK{-AZptSySA7^_S@3lI_pw?daoE
zw!M0LnlU}Uw%&=pTvn;P-jyz8EN-N~M$>P9)llz7^Y=g40WImsofy48WhW-K5n57W
zTYUg+S#-UD9!GnRT=di5p`_Gn9(^EfpQdH%LupO&%@ab)zPVO^mv)@_<!gNyoxO2k
zg+7v2Z<=*YA4MDH-pSO*(EKZ9*68oi^trhWp`Dz2s}!_Li_SXq_gLjcH}2@~)85o<
zjvl;7n&>r)HIshclPqRpY(2ECo{5<@y*Hhkcp?*i*9*(i*zot@s9ukLPIz!je}!((
zy4F{3LC0sy%@ObEv(LBCn^Wq7+$(xz7W73xW4$Fi@r8RMQon3rcy+xeZTqU6=DkW^
zEjjJ<=CNtZPSn&pu=&d^EA_YO{_-=mym7qOieuIFa;%!r>QK_kwbk@Dsl`fnD}6W%
zUK#eg9?sreb>X4+4L*AH56|c?kiPoaGI|5rvbwp7k~p~9S;pIwk6)8j)q97{fu^@(
zrPpLt!rS|=$!g|(j=%WLkt*KhOcC0BHVK-}*l3}(XYIfFrIhZVQ)}f0dUeWOd$_V5
zzy_`R{%Jj$1qdyO^;v(Yl3tQ^6<Q@WSZGaHpwNQp;)a72^*(6ME)+*RdnRXAK=I5^
zK2%wMmo?q^T`7GuUD=2>>k72*%6rpTe9D1XU1cMLW@Tf9R+{w^S_RffXuT;b<v=;)
zZcfUr>iSq32utrp_Wq`CpYq;j?+NW8`y3h~ZxPy?^p;QiN@(xX4xx=gtGB<LF0omg
z_m$NxY`V}CHc4oatk~v#VR|iEw7K;i{T=p_upC5Zpn1JCb<5ru-NwcU&BJ;KEtYi@
zS_2j;w4Q9d(0b7{p}k8Dw?q_2qT|KW8`O8}o@hj=z0ms5+^u>vs`T@C@@BCy+je^p
zW^bYOq_?--yNqgUJcXfw+~r1!`U-70eI&GzG)QRgu>nG}v59GD7+q*Yp>?IfLK{f^
zg*Ji?q-DhFZD{I_L9crk@|Njn+=#6bT1hrhXc25_dis96y`Olh!`h{%lTVA%TcgQ@
zWq)Sfd#5U*dt{&AeSDn>`)v}mL;ER0Z$kOsX2j?%so#OafqDnZJ#Z{df0aHz;A$f(
z`+>Hy{ucfEUFj2Gn3)-P4HfhLp}ZKR@8+RhPTfT-zP}QU?|;IPi`!Ae(|!!=t~a9i
zQ+F;QuqtP6^wtNkR%d?S=gp(L=ZZB&loEy3k1m`${s7;~+;casqio;EjjD^P@%Ggc
zFW|NN3p6j<hEEDYZKx>A3cNO2$2t`x+{6ca{^o)o^;Xp4*X<>|zthFr0RgBJTkhQ1
zrnjZV=suwU_TCM=?7czp_X1_);KX~fjM_Sw*|L%I-}qm@hSHqhx%oA{3ybN2xzUzr
zEgl<hd&hcLvs&GUd6T^BSfv(?4823c+TJX^KCL-F3VK8O<whrOw)bb|Inl^_&byJh
z;<|ft_2+2s`OeTAvdD8ayf^hgR;T0%-GZw4_N3Rb4fuIF|7JtInD@G#J!F7h3g3y;
zt-GPO8u+YU#=DJD%Z$;>AXm?Ktq;8+eb*~OkI<{LZtLsmPQ41N@<|uyFS2Jo?4rl$
zb?Nxa!G^BC=&zU4E70xkUOiS1rK_*i)XO7;<?RRQ74%s8u1jhCX(WHr!TNe-gf}ub
zANpH#BB+sG)tgK|y<c9h3i~cOd3rUyJe`v(=+Ejw^jq_aLTB~{(T3i)-F>}=9z(~Q
z6*qLfo}xdeSEDoCj_b7^p5+~z^ww+Z_1Mdqd3rtXWtuyxv)%~dtZ3T=dS$xOB2(xr
zxZ!TSvHmQ5(0HicL~o6QmAdLJklx>-y6dfUjRtq?p}(w4wCs(#`YU<~`e|fyp)>zM
z4fGE1-?DBky^H=n8}Md*y}LJumJDvMcSkEbq+3t@P2Ell2XxSTqsrd69Ip4lw|wwy
zu-;d1#h&pSslTmvV$!Z?=!2MLv(U#dcR?pTPH(Np4Q{Is)Z6F-2e#1%>n}0w$NKtk
zd?eS7R}?y{aYfQcdM8sWrKvtr??T(!SBKt}4*pmidS5zoG)*7nUCXA)P4rRtR^s=!
z)<+{f%c_Uy@98$071t2+)xP>BBtiHS*2`io*hd?;>O-)8?!!gJpyR*n##gAi&(Nfw
z)<7RY6Y`JfA7hopxFx|l)&}aM`F4Fd^vck;>Q`ySo;`X2eXhSZ2?8KmpuZO{`}E0>
zHnDnon<PK{^@}^jisVY(=k&(RO6x7&m-O0L&T+fEw*zX*8M+?o?WKQ6D``@c_q@)T
zn^MYqZ+cT%U)nKJm%QniFHLK!2YR<*B6Vd`!|)M(RabZE-B@$I+X&Q*V7f-1jL~a(
zuOXaG-Sj#r!|gP^ISM-*OS`5F)0^p~u%2XUd%eHzkGCf^*T?BSSYy59PW@vPd=gE1
zNuR3Eqh;PB5&9ziASLSVHTot<?BetxPa)A=*lc~shx#u48kNysh|v#IEkY*S^`m++
z_0q@Y>pA*3Ml{|*4r<F(y+=A#(?_v5y=^wt)6;=^Ip|p#cV!#h26P(kw?PJx-&()5
z-mZEg=B$tDLEf2Oi*eA}bKb4q5m-iZjTQH9)t_T0^_OX~_qgt4ucJkp>Ai>!!TU(>
zMek)jm37rG=smo7`W7};&(&Ld?>*EoB|ecR>i+siSoRi7Gm&HQGzG2aBK>uIEHluH
z`v}$OV{B-jM4zI<^umIe;#dmmLK03Q6YEk{_>LqQORVrAu-ZuM2x^2DK0?pZJJTxt
zEX_gn#bxRNBO$mXT)Fb!s$kg`BnMf7lpxhw$y%)_ypTfEU$}FxPf5iK)ic@z!xSt1
zh2ojon>_Q8l41g}b^}+C{)b9a0xi4@uHVzFRjtoxpK6L35+CkUxZ3p3$|3zp;YjHx
zRard01iXS39r4yC*j!%1TG|?9^;n~E>~e(7W^Kab|7Z*UL;Ng!2p^&i74#pf3VevQ
z0sJazxHa5b%<8ndaG-N(;olZ4T;N{jUr>@&5$6I~nU!1ptg7G$Dq*z<oxcl}C8$>E
zk;2U;1LYX45-!PlQeBsx@+*c-olmMdxMb;HP^v107Akj<$+Y=bbhl(G_|~`|E*`hW
zSi`L4trbLg8h;e3Hjdvn)Jbg!bWJKD*`%_6Ry<oPhwE<d{Ua5~_{1lbT%0#6w0V(t
z;4l80ssng@>a4id9O~&O6fQrPW3`gn2hgi(6~sm7e^9T=Rjm!>s%j}~pw+FG@wo~c
zT*>t(<rjntvHow=)3|6$sEYrU!rpeMdIpWgWnOk}$D$_CCzQ`uMd3@c7W#$Rrm5Vf
z@d>bb%D4hd(Em&wwFPpH4aw~}x7P6s=12X4ZGqP3IZkiW+6wxZdYyO2#bQ2H1J{c+
z<<H6;<UU1qrrWc)V0oY#An3oK26LYhJXY1h2Wx$_K81FJRV#1uCsh=xHi{3_`ipmH
z&lSC?f+nuonxws>h2dhf3ffdb4K<KA!lhe}DWu_%diF81VXG?Gyj`MDxr$7t&A+0%
zxT*fex1TjAOl2s`pC6SlOck+xyiiGsq?qO>^zX4rJn(On6$f~<<1Muhp?YiLI<j{R
z^M~5_LS49g$X^ypi}vY-)F@3H3(#Df{ud?usI32B5(f$R6t1DG242vAq;Q;7k@~YA
zafq8xfqs8fvfZb+TP_AQN)9x1Vg74X7Dr8$m5ZSx^Orw9fH%~tN}(K=jQZKI6@L()
zW36Sa<;VS0Yp^xITEbcqmk9)Fv;Szr=kVE@sxhECAI%#|vh1$~X#tWZdt?_j`8P(W
zW971v6~|h|;Xs+z;!qhJK=-N~%D=F_$P4)U{2KoKgQT)Jns~1ii_6|7N~QT-`E496
z^BM2_AE+L(l}|QiR3#tPG@(DH>i;_>YWV%U=qob6roYhDFzzqUD5}Nfc^7TUpUd^n
zHgcpU%Z{MXe@|)6aRFj0$u5*UQY)jC!sV4Xv{$PvKcfwnqqQ+O+|PmwR!hmHcwf0R
zE`sk1H53ODc(f8YT&*J?%HNaA0OjP8JWhL0^V2$OopI2Dj#k)$Z|fqCUb5qWj4@gV
z9KCQA|BiMX&Tw0MNo$~m@;zF2{*kq~JXmY3)#SJ3N?IeHhaMFAa=2J?qP0GMTPu!>
z{S>*T6e9Y0@_V?T5$A|V8vhMPIMm|(aaDb9-XHc|5&myD&Y`^Y^xrGd5C8k$-}C>y
zt1o0ef`_RgHWk<C$#Oza89{M@;YW{uh`5+HT%K;)_@4MWxe5PJF0a+)<FQeQupAaY
zT*oKCaOCzu&_eqsZE-0_P*6xvkTt?;x0b_|96?sQT-VynTGr<8)A>|uBV6BMvoV_@
zbSQrx)g&mfJ8aE=qNJ+0Xz@AiRrwXZ1s4`yHq>&y5LYnP!f_nm@C;n+`j#YdnYVyC
zjSCwaXpQC8{Gr^RUy-ZeTFp@I0E**yj$oXE2d}(2?(Pf#hYj|jyb}+?5@wl8ewwWL
zg>ojBkW1iV&YoPsb)BVn2oI4}T<ZA-j)w8+FYp&|Y3K8STA+Vm!2kXYwqjCEsWOfg
ziIhB2wB#>UfC`pMNzY3GlGD&@;E<8(I5Pc^>L*Kqa-j0>b69IwD+U#}R<Sm=R<~KL
z&9!3I7D2(*r-A~km94Qs#e%HXn%1YRQ8w8o*?5p&5Cus=EQqVJHByzero4t0D39R7
ztaas?L8Wmu=2&@z=CAeOI0E$1PsXL_IHVERb@HEZ+}|gUT%@N}8x9eC9ji^o1eFZr
z8b*LpsQgl4nfprKq@}q}6+YvT$2WM2+>`HuGX4COZt~5=0a?v(-Azj<9JwQOspKCx
z&vT!8A{@;r6u%&jLx;M|bD@fS$o*hmZz}B>Tnk!HgL;(8|9_g$>N<>ZS{?k4-b0UZ
zApWmvpsy4tdN(*{!Dun84y(hjxKKj3I*P{Zq9&kyM!Svi_M=g;6pk^fP=#aD!jYgD
z^<kX%Xq1KVSSY{m8&wsJpu~9T$x#tTNk!uvF~0GQXfRfh9Omfti7|@k{o9Ry)55+z
z`s&WYf9|3_u+dX)q74xJU(vTUda;jso1)(uUD#(V>M8pAeoyuR<l*Se7xuM`-j&gl
z65XXI#yJBy_w}m_dx=l<?c{;Hnxyg}QfVy+|8XLRV&$@YlJ!N5u%FV(82`^DkS6g@
ztD=Mix9CS0q4>&3P#aT2<pjfow*FC#R&Cn5LIpi>buq7jOLP6SK7PS+HQ@v8#Ed`;
z3UOd-krKILt!u5zFY!zNw5|kO{e{AHQBYQYzDN#|V&q0r40?5)q%d5ojEj}!hJJFO
z#LxLLErw6jEPR^QP^+(1)4FQic#>RQdrNzkchu}g?(OD_wKh29>7hJKE03J0g@60I
z@}Qt_zSa7)+zzF>1S-j(OK{-eL)oc@X~9}qtqxzRx%mg0LmQ^mwl=jsiwl1n%Z+hp
zR4c8b)=_J(_0??J3%na&D!0*|*It$b(AO!2e%CfNM0<n(fLc+TZ|8~pD_n-r(5GY%
z>hyio_KD~f$7&&H(4WP(&>lzo_2r}ZAo*>z1pZWoyQrfRA)yK4jd^QdxxyYLD#uDL
zDbUyZ^7Xnj-15O6$nWByrxCoe>_C6%cZ_PMh(5g5K`Vov7V2?fEqK!yPZ>2qw&T#n
zU$sg;8JO&po8$II-#B=u?9^W2<FrVvg<KyOL3BnR_F1FGln`|$C=}PP@8HXX9LW}7
zeL=2heZd-Pvsi1(vDVtw5dMqtMOWfEYCw>`D)Hl5KdWZ*vpy$xwLWLH;hVAJu->P%
zCh`lK3kw`uYMta3+S7a<A1P{|{H7M6`ty;vV!1O^O+Hc!*Q#i5Yj5)-T08k=NK960
zy{x6IR=ypVg1?A-p2@${TJh<sjh~V#YEKzgjim83c`E-g$QESdUu!*ab#p7NCr_5&
z(q6~WU+)yD`TR?suZ_lg+VY!NWBEV(;m|NB9Pm0wYo?XPVYyTAKk6S8p-slW?4|$N
zYySrUTkG*-{70>Z7K?9vg#0|(f^Om~7hk?GqnFT4q)2Nj`ViPWC*z3U(IguJf7yso
zfacF@2sg1|3pQ2=Syc+O*2Q!LCJC_R3LOeViRXaAwq;yUDbbejOV~g)%TVKO#l=<M
zJk@Arj`0;xYk9gBr^VrtlFhJ1jo_OR*aTaM_P!J$J&VINCu`HRczH68hl|8$WT5t%
z_M$diswQ)6!z8)OA4=(C{FBM(me0~AN>PETR2w2_w=D?iV%WAOmh6h7KvgQHP10t`
zAIq<4U9?ZIH4S2X@l%oPYD0z&eg|d-eF${^Zd@<%EI~J(NA!7XD4u;hR)Z5e`b37+
zgL?dzPU(+5`dkGy?H}17<DOi4l_41Q(?0e^U9n?r>XAx|n!^`vRYJy#HOW>`?0S1=
z;E+))mT34}eTFi)_Z|9rf3eS+!pVbKkJ{7>=lu4<TIDemkL6SgjTjRvk76uLH>-eY
z0%1ljFb=<_*$)#erdftBu|5LpB$$ew(S-fQrkjQn0Zg-%<0gi}umT_R6C^o`>}}X3
zF2X`<#gO@iz2Ff)tX+O0e-!h{dNAOlQb}Q2OmElpXP&9N*vLJ>gB_Dlp(xrwkrzg~
zMA{qx0u}ip(j?++ycb7|A(dqK6ZRO36h0xf%!1LF;U?0HV_QW#gU|#w^Jk(8i6^9&
z1z;A;coHdQ#h7>}Akxf=vmoD-NHq(_*%OAFcs~n)S;X6@GZi0T!Ua#2gn#qrfd>~L
zVz(5y0M9W%9{|tT&rhP#N^!ti;0C6issgB&eks6RECjCwi~(?StmO_qm72gP0I`$3
zSg&3WNCb|d+J^(U*GHWXAS{2p-@hk-u>IjzYX_{t+IBynE3ihi0zd;`Jg}RnST+)f
zI0b?)a4~QRN4DXe#is!ID5TZ^!V5-D1S1{68Dg3V*h>^L705)DMxdc}h)M<lZ2<6=
zMA%_?E;Sc806ZWn1HVy?fQbP3?K02=z%%ZVBWD_sdj^1acn%T8fHwyAWkUhPqij5Y
zaLXcX<&aP1kT2!n_o<q|2p|=>OB9ReSUkt#ITp|5s{um+<Z*fAX$9nYg~7mjAfKpW
zEHDsQ0py`f@m#4Nfagkhej3kDkHO{vq^I&Y0DM&t_bTmx`M@orsx5&<0K$K!836ld
zkcMi30ODS48i2S|Zvc!3@ZOqme@-QOehzSqsCFoTFl!?ZY9A(g0q=XE4N=|xz*3?H
zaljg&fT&?50C8-HI5tEa8zGL3@Xkgjh#H3j9f3sP5K)sr0C8%PL(~j>%@AI*WkfHc
zEShft5SJE+R|~wi#VMkel>wAV%WR@nFt<W{TOB28T@DxvtR;Gh18o7A+XMjvfx|>E
z#{gr1RHC-<)3zRfJZqay^a|qf3gYofJg}droeDGo@UC`yiQ2<|`v$;xAOq{$@Z15<
z9S~lJH2~uOYIR^3fO^mo@9o$d*hbXJ2Eg12@9nGs&4DSvS)wl00JwEoO4Kz5K>E9)
z47=VWdJW;dhVWm*`??`M-C6?)zzL%65kOC18Bjpf1L5>Qo$G--d)*3j2G$bwlmVD~
zB93nm&<;of@a|q!fp{Q|=uJQ10#R=d&;!7GdLtcg!LASN`t$)-0eM7y%K>+Z`qd<Q
z8*zGjJaCMte<*<G{zzN@y+i{_0&Rh5Ko(J4AkYR|T=4#Zr-%lX1`wY?GXSJ<&@H0D
z$b%ts0faXc{6oP%6mb~}{&#IaOJE{^G8>*tGzw`NjXWBSG>rBVjj02S1@Qhch~s;)
zz(At+{eVWm1OU9_InV$Y4`dL1i02RS{2`t{6we520-h(}c><n4!h1fd2aE&2k0{VY
zJWs^)#B|^u(WF`cA~b0WfaiET$4><^i6&bC#C<ZJCnIiCG@v$syqS_s^l=P;bbO3-
zPDTDsMH;3e+-XAr_@9QfOh<lC?+45Wz%vv66JSn&c~%5bVppO$;GNSMScGjvqll6&
z5zVg*AP?rR0`iGIuK@H1@ccR47a-gPgNeSlLG&fkvnZEnNi_iPUXl#lBwAV(hy&ID
zmx;bczJ878uMx+u;l2X-zH&FwDulfXaa^?mK-jBefF3{+aFl3GKG8R=iPlafS{DVh
zAzBaj4Tp)6Z9rQf0mvfSi06%X-iYUoa8C&WS_0rr$t2oj1@OFS3V`QSJf}7RkcQMP
zz&)bPwE(1JGt#m77SWdKz%U>MxIwhd0pt;Fj|F-Y?PvqweLE1>bkx7}jsW7Geu^jq
z;bed>17)!bdA4f=u!?B+R2)LR7Pv{Yw;F)(_rl*^_}ho~@5A%HQ~=NWfp04Sh~u}Y
zR|f)tUI5&`Q-S6H((_#=5te6DW;ddPYXHRcP*nhNIE1hd;a%TXB07S2AL$P)B>KTd
z^ds~iQ6G+l18o7+gJXC;UJ^jsjw7ze_Y<A)1KI&I0KDrY-hHwWfOwtU1|XiN@V--V
zzzP6mdD;c^0OkWHh_XWggqfWH93ncS5uJnIb9i44-k*c;F9ZQCfp}mG(IwRDOG3Xx
z^fSW$c|4E?+#|YN9T*HCy_fTdt|0HO3<K5!1w?tV0Lmy2Y05iGbQSNoig#Q^8m=M@
z`A9=P%0C}r<|E8}gn12NUPGAI5axB*U(X==1-ONH-vZyQ14Orx7k7}JyGca%#t=P}
z0p!I)<i$he#Y4o^i@16b7w<CQ6na;<<qoHfGpQN6ceuq)!Chq<?idqyZ3NT;h61?Z
zE+C(nH3sNIEO0kEaY4jv;IZMRywDy1!YMfh0B^}##KLe6b69_1DUeGn9CvYqcLwGF
zxb3bK_)E0};(-j{0kP8cfKdQ$IxBsHSeXg{-dAQZkV7m2VMg=>5XXp9#3Dm+Kk8ZB
za=4$E;|?(wP9t^0kEabV6*x>R8YiqqHvuL9dx^!U#LC5?i;wq~2VVt@E-K)?6%h9d
zh<gRZy&}S>h`6Iq!m1$tRT1B30)f`Vo<*E%!2Y>4#GX$iRvSEZ#u2M`iCFy@pf>=X
z`gm^O0D1t(qXx%_HN?9cHUg#rhln*od>b_Z#shdq;~)V38zV0ppCHx*>1%?tG(lRL
zAg)c}zbX7Th5x2$z&&EkngdA7iwyvz;l)g1&1C@3&Bp@ZYtalq`dcF3TILXI6#;Yv
z5dT)lqt+#X%f#Bm0gHhP#9sCQ-GI5o+V&&%N<Cl-u$Ndn4%8vmz9z8_i->is1&ji=
z05^$sstO?gI;8`MW9Mqby10OWKpL^GR$|?dwr*{K1OR!_JrF=VyCd!0kykyC7d?=M
z9&qo8xW9?`yrp6Uhj;fyT>6d$@V<VC_uB}&{{v!i$g@Emhz*Gax&ny%|3}@ofJIfU
zVSoF|a7RQ1R2*-3%}h;A%?3nMGczmmc(l~)X4dJLdCbganDJ7XnVFfV%#6&+%)Doa
zM0mqXh=>S?2#A2(@7J0CU3<+0Dkz?Fp8xrO$CthL%>Lf>t#7UMt?OR<jd&6kfNQ}7
zU?mU*SV?#jy1xmIh2bPDf=w5N0?-XByo9%*@7vJz?d<^gmmusVGXdzf1Yx}63(NsF
z11Tgd#r4uBfi=J>65fTLsH25<jR5%Htsub&n;2nV;}1X<2`1=lnh)#%a!CjcBw^Vk
z05)C*otLXXFaRBwBc98_u>u?`z_9`xE5NZ59Phza?<2hT5#IZV!>WD&?pclNHRDNG
z3$9NP|4$JAPr&slI6nj5#%?71doT%KRFUxIP!cwcBw@1~3154Yum#6&@Y^@g?;C{m
z4Z;dTSYgiq8v$^B+Y^{W!d8U&9q#!a*glVhpCSA67y#e@90AmjuoGN6!L@Tc0DJxt
z2rLA)k+6FU340Om{ZmOe06l)4M#68sNeG_;Kt2LIzwaa=>J$ml0RVJ}-UOtQaHI=>
zbUA|SBS?p%dJ>NHCE<8F2`6xV0{5O+4<wKf0~^GQ2P{A|2`3S!Qyl<=a~fQKzC=Q7
zBv41fS?F<g0k8`wAR!L=#JvDO*ErmJ&L4o>xwXI<65?F|#5vvwL;zJJoF4=r&gT*5
z^N4c-;+z0`p&k<wz;OW_i3leV;aogULXr#^fF-~_poE0vo&aQ$w*i?Xq##Zy(}DFs
z90`{^NJxbasj(znb^{Q<%PWCs64D450W1a%0MO|Qbh?7Papea9eCeA>$N+x^bjpBE
zSGNLLBwX786p)bJ55WDX$As)W5^`YM+*Lpf3D<Q1`18P1fOr%vB%x>n2_+uD1mJxD
z_m$$lQrM={0z?8<3=lxB>~#RVWd$UZgSUJx2^F}%(glEgCBmu1brs@TJp}-F4e~)9
z;#*%wf)!z+9uu(6TCl=awtm1o66t*)9%Co7Nn~#um(~K=Bq}A?g%rDZ=?X~1`=vxz
zwztx90Qb6KUnaNtz;P1YaqhkVh$hhkJ4boU1a=W-XaSsiMv#ap1kr0TaE8QIU4Umu
zY>hc&pC}UBK&B0Loop9OqVE*oAb=gK{BhlW5U>!~Mq&s2)^R9_0jo*u6bkGCib(7{
zp2V)$)v7Bvx<UW$9ss`UzLLa13yD2qNbEThSVAKD;$kmw_wgpNFF5<@NbC<i?yDhj
z;A8;Y19AWTz|brbhrdtagNuM4NF2EVh$qnij^I=hM<L8n&}r0K0P#ZIB%*E-LySN;
zP(|Ws=sz0zkA}=>gfV6WuoQ?Stmgtk0NnpD?tj=y;@Dxp5&-v)#r=;wL*j(-Bu<PV
z@o^tu5{Xaj0MbZAA5@&W53f%q0KC%|0kFyR0upER23`QRkofEZ5@+H#GnK?y(0LYg
zo&}v}LFd`fc{X&O9SR_f*$DGFa6PvafR1xS06NZD4jd<}_5d(G`8;g<d<=;%sK8hf
zUyQ?W67GMgj>MOT0toYE==pLMiF3OE&j1^N1QK8I1||aU14l`mCj$lm@t%ixzZOQ~
z>t!U)4<_-ADiRkA0$vAplDP0S5*Ok6t!cn206M*8C2{dE0Crxy3n(D*?cTr(z!o5t
z#3lX!;=Kg%UJ^^<J8r-jAe6*+x07i4fkZRxxNI`81~@}lQ38wymIKiwu7I8^pwkK?
z5J8yJ0l={m@mPub-$T6Kn+kjZq>=c3H()lf6-Xx${XB8i9um=?6W1V&H7O*1JPFu9
z;#%Cl&KH3E`b8vu)&-bD;s(fk4*fpQC2=F}|92dTUmPXzON9NU0ayU+0y0V51es0H
z>#G_PHxC66#^z`ex9lS^Yytp1!yx-DWVgydFaVox#r@ym{%yGD`^^A!`Efdl+Y?Fr
z$p`B^V7HxPNZbV*?nYYgi6?PiZxRpSx8GD?4~Y@ri~z@B7ZQKBkod<O5~E)t@#rEF
zkCl;l0(OmAP2#C}B%UrI@eGb<c98fd(l0iN#JGMW#=k(~dB`Msk$4etN{%G)65@0D
zAc<EH|8&S-3&e0`I*GZ@ka&G6fH>wuHh(dRg|CrV4E;+x064-&isj&}JW65}u4`~l
z9bnBP5f4;J;#iX8tt6?FNOHm+Zn_wfoY#=#I+rB(5hQs;lH`fK+C0|*r%3XW0etU;
zy%)W<1DPbXf}A&gYmL1HTVsbnAM6e9gZ<om)&uz7r-r09kZBVN90kfqYO5#7*Nr5<
zDw6zhzyFhf1=s^55oQ*E{=iIN1Ay;3cmv}B@N_r`l#tZ1H!vI62*i;T-~t2#i-BE0
zHc6fEmWWQ^>GTDVNRl2r`U${tAQGq}sq<i9KCm5tOc(u)Kz~5$jyMNS2G)_(1GejN
zfTUjOB=v^=y<Z@yFYMN@3rY8GA*ny^xo;_e-v=P<0SIRx!azSj8Zw=v;RXO4!*>9%
z;Rt^KX)pphjff`c!BCPO8U%pjq2nYOdIHc7epfP-krXrxfP4_*9fa#(gfpry06jti
zfCQ38Bc7ut0!x5hKpIJ7+5)g4{I4_yVUK~_!}t#U1L@(NB#p&6e6KVX`i_%<u>kBp
zE`_A=BLV0&K9!_L^uTLC3`rBZ0CNC@@hHN4^hp3R6CpcsJ&;J!V;z9mz&4<Uq)9`8
zMF8X<?+2^{Vo93p285IJ#7vT&96-`j(BUb>=_xBoQ>Fo%NqV|BNmB!WwIodg|KAbr
z-?K@Yj_;-;?CI|V5kLt^GhmY$;F^K^W+1F*2p9y+1@-|IBs~io&KwM6ku)onr02Xz
znv+1%3%K{iktDr@?_Z80>6Lhr=D|j<g6ALLcpc~eOeYEBbkduvNm__F{YwOvle9=j
z(%S}--UWvV9HEF~=qi%TxZiS=q-9o;mV;*{@csmnJ^=rR!6dClxF5xl^fB~U3;jRY
zN76dTd<vVahb=zCeH(DkMuhe6gCu=9jHFHdN!kqiehqBF`IZWj!nTm~EyDN?_Shzp
z^!)&met?cY`T{8={REwUhJHH_ko1d@q+K}Q4c@(o<NntGa2$Mwr104!9jYNI0y-W3
zfuu+kz;}^RB>j%G`h5Yg6-Xp0$^{q!Kt5_S0GU6a^B=Gke4+HmdH`|%1ANg)7qrQx
z=rsViqRU7+5(rEKV5cJy0OEfX-yOwwNAca!NC5X8!*|D~0`CLiKmkd|^}u9cIe<7F
z&n4*u>~UfuU<7snnIy%u1&}Xe76UtgbdpZuyOW61Daf9VC+Q4${zP12AsZJ$(m8}1
zkMPe!4sCD=<3&=^7~nWbm->-(88%M?{}qIH1w2;{l9Y~kWxPaECIR^FD!8*|0<b|A
z<gbaqP~bHn41oQzJphE44c)SL0$C*GfHMdB<g5f>lN`h!<3Lg_xN^aj3$E*PfTJYk
z$v`lGu<{Z}%Ex{AOMn=X3cyn^A3$6R5w}9vuW%bsMN$#sS@Z>vM^Z85i#GrWyJRr1
znxygyl4{40EG`5RNS1~I>wzkg<!Qibl9fOJ=L$QIBw39H@VirQU?#8*I7PCKfI$G>
zr0d)hm<~Y3Ig@0U5diLU)dP@mn*`uDcMkwzy3Yny0TBT7a4%>Y9+3BV5?Bgs<3PJx
z_BsGSr&fJ|xj-1n-r)1mk=({YGU_C`Z4t@sB1!f`c>X&{ZXZH&hqgdA$pQ07?vzGy
zXK;6kBe^@Sd#WV&0$=aRB=<=o`JNX@z8Cl3w~6F|xE>7M2P0mC5#Hbpz)_%#<RRD_
za0ucz1Ue4c4&dIQ;2Jsrm<b@>Lt{vO0N*_j4B);8Do7rN<FF`_hvWO<;{n_^0{V}@
z_ak7B2VWw2qzlj+hy@UzhYTbepmPv-gQ0Wq7LrF1fH;RllRO6DkCjOt2j20U0E9a}
zm*hv5lRN=&nUF{FM3Lmj7Xsj$yoTf_5XMvefrBJZfsLM?P4d(!B>!y?$<v_Ev=oy6
zz7wb;c{=W&;RdWH`59keGs(}62eL?>IiKWN-oP%Pg5>9X0LaYI1K^#5Fz0LoV4vr~
z@%%{ObpUaAKAvQ>z2z5>Rxiv2HUg&rE6FcHw-=$)i|c@+Ko!X^^#-N`u-QwIKnck&
zcLSjJ%PRrI<z>WmZU8U|2nF^4(DN1O{R(t`WeKnYNF#Y3^qvPD=RwDL&~YAgd=)yr
zIs%vv;Ja5-Nd8AZ0J^*m{@060{wKo3ypQ}(3$PCW|NOQ9_~#n|*kXPr$#3AhH^u^s
zf$cyl$rzK87X$+ffG{9|<TrJ|Fkl|A35X?mp$H5DUH~=#F+d&3|AH?6nhC50qJavM
z7xe_D0jq!r06M<a1%QrkEe8$&xg;;{089j+Bl;NfV(9obbbK2+z6~AU{sDkpmf*W3
zh|4=mfSn{S%_jL>*!11WKqvs&cOh%^0YZR<0ODuFeWq@}902h!C6OG8dqO7x&@J>h
z$z~Za0N^%5FLM>i7Q}NIbXc|;K=>>0{fZirSB@b0y`?0h?;(E>Px5M9uZEthVV{o>
z&PR)YgFqe0YeoY2Z4Iv1l#%=~I6qzh>>zn90SI%g5y0<jYe@cN7_b<?^(VN09qwO;
z``00E>tMf6Vdqch0{H#Y8j{!J_x1RFJ@`HY-)G?a41AwO0{DFce&2xKH$Z+v3CW-L
z1)%%qQ6z6fT5g2y8xg;ar%3*{3jq86`+Xpq<S$^8FM<Ks_KR=;Y5L`0U_P)1!1bm9
z0QfiU17NeSh5-u!*y^h?k~a?m76Z`dYZVv+tOv44-qHnl2G|HBlKhP?Fd0Cad~=56
zFdZ-zSO>ti-$K7{Cjct}q}f*RZAE<1&yu$yysZfDyAWVGfbh0?0h0j4ZyVzGy&jkj
zd;uW5AH0Ftz$PGx<R9Atxc^7Q|Hq>wZx;ci-*)hChdw_c{GX5?ezE`&B=7J5pzjXE
zXGc8AKjZhG#{fnk9H=6BC*r^JHQ)yzo8(`*0ds&bAf4o0&}kQJunRivf)2Z(!|o@6
zH9#84d-?<OfNek~$$J9;*aUNT^4?gI_aV%Ekl(inNFjN@KY%#whYk1Rcg)?%2cYu-
z3lIU+ko@aVU=eTts3Q5`Fkmro5Ww%h;rchk`8UKNTn9`9-UnhxJ_MT|G64Af5abWR
z<`E--PyqZ9xIPS>4@2j}(D^WQjzk<IrvqOAi1Y7z0E80-o~YF%|KUq=bT-Lor^!bl
zdvrbkU5?_rW3b1uX#nDP3|z<i0{H&KRv?MwlU;xXz)m2Z<WmCx#Pw7H$)|O|2w)cg
zz0QF94ASDv768Bh=?x%VViy71Nj^Ip*g!JcW^&wOlFuQmbNKEY(jndlm;fM*1TO%(
zC%^^?ut7o<$rljr1#n*g--Rra6QNh)Gr&dwVO>O67h%VXi0?(%F$u?{Xp)nmV=}@^
zM*LFd1A9omv>8YtIThhv4ge7Uw3mP|k~46B#z>N{Lboi$Ije}|?8zkO_5<bt2tOC$
zU++dT`t5Q)_zF9aT(phkk|`vY;ob^dR}Ln*I-BHL=v0ev>JW|<akOnCMK}dmNs;17
zQKypPlt+q704c7=ff`agh!oE=q<G=zy$*;WrL`L=ZH%O}8%&Dd7E(HR00)3vQUVr{
z(y5M=&IVvHDP6$bZ6hgxF9Eo>#|xzNT1rYEgmI4-Dfgz5avx*{jwfYMPf`YhcPQ>1
z=1<CS$dBwmieVKgqxO(82D**)1#s`!5>g()a!9l-lnIl7a8f4Xo=H!V@^}F$Pp&0p
z%2-mKjwEF&!uVSVDSv+rNFZfKKVUZS1CU0_GyO?<)`ygt!$_Hhcsv&f#E~)wVb7Tk
zYyjd(c^+Xs56<VI*Yn!}@V=l25ax?Dq`WkSl(|bud1W0b^I}MO4g9Y|?hWkI@CI!4
z2IBb!_}{1?Wx-Hj0k93oB;`%;yg3<I4?t$2H-PJf;97|5fB67U0-H&B3pRXvDi8)h
z|0U3K3G`gD0l>ZQ;NGRMl@a=d29RPtMar@$QdT0~?<1@ad;xHMuoj3VWfjt4RR~}N
zB1!p>00S@|*Z~xfvbr~bbXkowTr&lL?3y#AeCz^%3*&AI#@v*32nThQ@)^S1fb`h_
z9@I(72I%_vK~nw=`+SMxSFpk6*Gc($8YyA0_tur9d>>58k6lRl3A+F64<MYM5zfyD
zXD7nJ*qO336o>$7Ncm+bDZ9J@=)U_kU^9R??}4uHqsks!!;dO^2LP)8@az)-@a$U$
zL<7)ce@_5<>|YNc9tTDO7T^FWzvBL1@!PM*NjV5R9fa(`H2`${EdZDVEC&vfa%d4L
zhhd9I$TR$o>nO-Xw*?@71o1fv`J>=I3htvNq@Z7^VC{l}H4DngrKFsS0P09NT|f%_
zmhxvdDY1dTOkg8WL`qx@Dd!dgJ4lHK|M_52F6c?QI1ET7B?)m&#(6T%Q*cZH&!sK^
z_%9*Omnuj}g^g09NP*8$E*~T%4Z5Wv%yfL8j<C|d01`>bh#@7jKd=Ts*jI7iRm3H$
zF92SwKTxi%1Q1sCP+%<p+vFh4b8+wW`K07`142nD985|P!Y|%TN~wXAvLsT<aeqY`
zDV3W@sY)TG2Kl%aI@Lk0UI!oyE9_&#IsBDMHKa;Oq^daAttHjDgjCmsq`Ge))dRnI
zt_IGK>g5lFk=klHfcsmoB-JOJ)V9Gu45{r5q+)JF^~ZU~X`}`W11zL=nhfARJ>>PV
zq;^>ZYzE>;?RtRJZktH$zJ%1kjimP2Novnir1nZ9wNDhO_aMA}a{%blA3Xgd0O)sL
z7XUg9m=0u<I&cB0gSwG=Kf<^_p47psNF5Ra6p=bKmDC5oH_QWg0oX$7aGVbx49o=%
zk~$)j)REgsH6Y$WOGypZ+c5!0=s7Bn)DY+$0@;vLKn<y*q4#K<k9nWeu>?Sev71R9
zw-10F#zUV+#*jK;3aO9Ez-%Cw)QKa2)ucXFLF(fO{|R3Ja!<Mdivj5S6!e(l1;mj0
zw1w2EkpEjx0AWsp4%6}5jIDUO4K|qxJItO0Aj~;)NPYe&sV@#D^(BP!@>EjiP9$|+
z7^$zlM(RJJ0odf9;F}M9=Of%Vz_-8x`~bv~`lbpD1?B<ANnO~D)PDs4(@9+vNO&<k
zfUp+B?o067I|%C?-1`o=-bo;JDdMrz0K87>yNKtzRiql%0MS4NsiAX7H4g$1zIhjr
zNvdTUsmmb0ERodZ1cU)NU*Q9c1z?wzBT0Qv59E^i{#qasC?WNOZU8txSO-9_RnT!2
zY`tnDsUIRftK9%_tX>2pk@^vIT?4y)jPO6+M(SF8w{8HbpQe$z-iy@FhLO5K2FghN
z9Q^-YOzIa1`%Ca_8bs<>UjSL8ZiY=Z!?v4^064y$3Lt)4@Ov0+^zBk$7f?m&)}cTY
z0M75g|NUH2e|Q0iC-q10{0RMjg#EYs0FXm_S^eoasXJiXpP?Ikw)!*Ty%TZW3A_F>
z9oR_fu2rP&2G?%bVy_2q6hL_U`T{e7bpUww!7lsz1Fr!^q#l?8gp>L!!ubuh3CH=N
zXi_6^U*t+se~0~|5SKru0o#BAQllXg9SUTVdIa$~f^abgs2<%y>M<RF>*EVaJ<$cg
z`H3$KL}buDk=hwiBpD@wjd7`x2nb{})J`&)jRtwA<1ZN%@})rBGk|1>OE?z+fm)~K
zTs(g%Ej2YM_v*DPad~+sPS9SH#m%FQA_z|HJxHvp6U}ZO0j3YS?D*;M#baq@MF!iO
z%EgP3k@UIA5-fNKZnR$*H!hfd6}$xxqckZoagtf6i44LImz3nWj}06B&M111Lg@u6
z6DCax!ahSQj0U=3vIJSr*oI1p>FG&9wvpB|MuTmspsM(5Ze5a7U0+^OR#ugrf4!Kp
zvz?r%5PFqdueI5#ua;0X4!Env+h6DE>FVm~R#hjJm;3sXn|9av3m4AeuJif%=gmC!
zE_xy-#2#-*#!&>=(+Gknxb783l2MFDbe0)~zA(=PoZ#(8h3rrR!ew`0kT^pUXL$7{
zhV)w*)SGn}z!|KJA=IwGNv^;}Ca$GlvoW}jOBeC*?{$P<$_ZR<4gVG!lyin?&fw`_
zxQ8<s8W^0Ahi<l_Q7lBBfvr5ac#cDSHy5w?D+W5Gfle=z4)NFNwcN^*0M^$SaMUO$
z2PP0Y5Uw=}p~4L>{L^fpL-^=%kQ-w_Dq{5n3P52!6j*MQJcdAn<whpYa~Qtc9S1FN
ztT+udmU9+XT9_Uz9he?EJ@Ntm_h4o~sDUgZLG%l90<L~z(ZDhFuXr?@66d%bOSmE2
z9fq)RLwMh6M;CoVZZwK48n7da#WJQ4D=HUEMv+AU-?JFpDKEA-C7X={b{1si;WCdy
z4@Vqiu0v%Dbg(lxaRv_ugAZpYZvn$Nu7j2iMj_R~ki;1ZTfk7l8SFZ^IT&&|!>AT8
z2%G_%4#W0%4XnLbw&DyW4Gc|}iOW1KwIXfAJ09)ge{k`7Ca&dZ?zwrHuzPSVFT#jz
zNpSjH=tkth$^){xPoa=PLb;m|atDu;#&xgbx<B9uynqK@*Pwf|xuAeE9O4W*2g4xF
z@bLfN4ENm<3paQKSNIjSPa@uy2Qa@<Zbc#*v7x5fC`GfZWTI|nqv*-Aw25^1{vMXC
zO_YLD1IyYb3b|8_bB5bC|0dhoOIW)W*!KT@hE@%+Xxg^t8rim_!M2zKV<m;#*4AKK
z?;CBaAiWf%7xUn3i+8pMvk8f1F~O)76QjT>S_~%WVQJ*`A;W5)#wG2ky(mvXRA~Dg
zk3a@l>rmFRNjO?4VAtDtH^IqX))1l#q*={_buR$+(JZ=`zBL)ChgtG^o4&_cj#;ce
zff&T%{G?f`SxY%M^D#@_zf%Ctyc~H0Z0?QNSZhQo>ZGwfWF{{InT;BuU>5z(g0Kj}
z$$t^bW=T9t9*)`o17PG~XG4=sYugyGV`(h*o0K5<klA4CAq0@Y8i^}VE>0kW@VG{4
zpg)B?1Q3BM(2mj5WE1yH4pz+8g5AOTAY-+b*jYPitOqn!1FaPp@5^@HSdI5E=Y3UA
zZ{3#nZ<@9qcHXWUZ@8UzxyC!g&Ks`r{>XWU>*?YDn0JT9yUfnJN8|m5^A6P0Lv~)4
zf883T6-#;XV`keixOa$I#27fNjq~efaU8RN9_LwRX;vOh!kM>Onxv=cIIFa$ev^z}
zGsY>n>!C)BwPx{6#yA1rCx9mpS{cd3EcMgVFq}C#@{|77c9~X<w75m`-?oXgwjHc=
zYuip`HDM54LHVkpAnf9PK`0=!Frt|k7JS?UJuhLsVdn?H@G$ZlR-6F>wM%3Fn(Cvh
zys3{8guQoP@JLE(uB)=L*{+J$0t1~AUusE@Wo7d{7ERM8do3$(>b0~h!oMbaF6_=G
zdM>aF^A)TdHh7-Vny(1ae1*;7E2y8r*4t<h6l9HTc#BBQ{n*S>)<I%L*2%23ITSG7
zt@muUrO@IW)+|Gddtk26`{r6&F3Ms~*aRmmdzCXUY=Re-s{ObdHo*<cHEo$6Ho*_e
z-mRD;Ho*~VmSBv`b2{pM)}H_)bHpYTM8T`v?ukuso08uH+!dSPivJ?TRIP}&-Fu*u
z!Ft)4gaBlK^~-q=B?!AbhuFO_qYbk4z&_mEA2VWFY@m&rFM1roCYyusmh9`AH;TYD
z0vI!zxn+CrrRfkJv<<X-W*$N(n{4;ZEQBChOS|menTHTdd0GgEc?hr0V-ET@Aq3n0
zW{b5wW;EC|A8iS?b)^8C4lh*EytE}4n+zw=R%AZSPvbh=mPd(318JVxA`jOOgR8zx
z2tf$pF?%h*<IokG`!g$rLq`^e9dyR-v3VT!5U*pt;c*x^fH`e@2<}J+R%#q6%UX2O
z$FVCMZrdX54cO@L+ZJhD!pjcFZINf?y~91XMV_R8jJs}&mbwmBmb#91qV)A=+;uah
zrM(+@ZD68WGreh`Pc@AvK*I#HJZT<t;3hb5x!*m^gPZ>H;7#`;DtIsADsL+4QBP}w
z6CIfAG>SIX$kO!ch}iZ-Z2Lhk_PULZh^^<1ev`G1oE+mi7~#2TNXN(;PPh0-OLGG`
zNY`5ja4<g8c-Tg3fH^saY%HEP`aIS!!;jqGaqD6+EMeY{`Xd&2Q#2sByODrRRPhh}
zVeF%tw!h6O=Tk0czB+aOY>WvT9l2Cdax!(%lg?w<CgT?4_quZi+dsvN$M&0C7DtU(
zPLDoH*;9#XM%xz950profqx4wy+_eCa;A^yHIo6aVVE3lpiRag?0@}^QM9fmx03dU
z)D!A)d7xS^95%UBSu1qZy*ptJ)UCwNzf<>4y;>_}wckuIxujBh7y9E5$~t~yugnRt
zxM8Gec#PJwZbkc9;ys6uarh3eBEq4NCOBGi4nKK|{Aezp%;m3e`O93seS^HiyDJF4
zp=}()+QR$UpV!!*!|cxl6Sw>0u=^9R`#&Iowc9v{7fegb%`6J-?BXtptvs>wUU}w~
zgsdw#q0+2`gj$^owy!EIPoT>tv%8C%&BfVTAy(D8wo$DnXS`IZ*v$u$VyIeQUFEFP
z>CC+b4Jtbye&E1?V`pPx&K$wX;j3-J{JnyLg6{M43JdE$X1u{*aH$HTbTE4Pwepj5
zb4v;{Gl~l;Os$tMU;b;MYu{nRh8;hC{Hk-C$%_{+Hn-lsy-WW`XU?2Cef*$76LFk5
zZumF@g$n7P2ism{AMw54QiCw`7%HY6Sr=?u$UefxG~8pP4hY7xeY@`d&Mw&Q(B02d
zHU-m0_Hm#6$o-U*lr(72ptk9MYz?-}Wgl~|w6uiGLR8*y;m40hp3BeA&&$4?n^c37
z#M4Q+xknD1$;->Td@>hB!|YyBCR9|(&Z6opRjW=WW&=ObT5q*lLsiL1R|y-LdwF@O
zZUn}xjDmv8m#$vDTIuHL-_r*tg|1!v{k^S)VD$F(r#di}6bU6owUXkgE5BYNnp%U(
z>FW9Osi~=MZf;&at!nXwy*=n?&FS>Kuj3fu^0~}MxVpi}Y)mT>R#+xDT@cC%SGfr0
z#!(5@ziQl9YIT{7O7uw=y5Z5Z4s1-q<pLX%$gdOZV-k+>jGHANxGdl?rE!|%Q<~(i
z3&Iy9T&NR<H0ojLWwdb`wQ~Y;sorFydb8G=y(e8rBWY44&BJ%Y%u;$P{faZmES>SC
z7@QT@<Nq>p^h%OxE4bz&N56&~?FBn$B&MZZNXpF2Y<cb$Bm1=rRh*oh{QE|>ET_Bs
z`ub*UJ9zNNuhy+w7al&@w!}6AZ=k^5|M)zHT5d8vQ}E6S{>{V4s9)OpI&Il-;>3wx
zzupjpw`cTqI&dZqIejha+rGeDlPFK`9jd(b)?2SUBe$@4NCgE2C=LgO1q(vxd-|3(
zu@A1EAiNnxXe0F0KHUUws-rrgt^K+u_MDM`@$`c{>;C)ie|$8VX{#_EUu>ff<>@0w
zj+`At+l29`12RqG*07||5Zf&6^NMXTZN1A<b$?u3+~wT#^y}Hk$ahh~L_=Ios8U^B
zofU6rS!t7MYHIcxY!mu>d6oJO7%<>23ZFQv?oz07{rdHSvSBSOh+4g@ARn@p_Km*y
zGIPG^>`w>wM;oiCGjU&h_Y#v4##Dqc4|$z=@5e}>9(DQY=r~=;ufuX=owKLAo2y)R
z^<r{za$;tk?BeQ<E!$LyjZ1g0tJAqrc{RK_)s&Z(Rth?JliE^pSIf%EDy^!ktFvUQ
zGj}blboKZ5cdaZGgo1?FXJ^hB=U<qz^P`VG`Z>AKf86w$&&Hn555+iz2?0`7b*NMJ
z`83oPz5gD}{4a&d&-J4Ce+S!^vX4{Ph5Gt>eQ#fjyHb^U>eQ(#bxNn8C#FmavMsPJ
zRl?3us{!u>({A=rmfq)Sjr}Ib_O5NAI{BH`o*zP85lSUSgj_?F%B&N6_in&T18vjr
z5(@TtQ~ZMlkEUg`Q~P{NtCbfYdE}W1-7Gz#&mo7UT|O5b8UE{m{lDzqvo}0C`5L@!
zc1m>kzP-D5?muww(C_rIsk=^BQ%0@|oOHeH>hA7rEr<7z+^MwA3p?pbHRa`%Hd$xx
zkynQ;X+@zbFE2m8urTd%(uLG)o4YIiQEpmN@}*1pSL2SyQyvtq0HJfJe{E$&ZEamu
zDfna$suscL?yM?G`h^^x1Lh+=-$HtRjP#t3^u&{(G^AClRvxaHFICmcmx`U8om-r~
z_m^7hDl04TNT>}Kw^>VDnBD^?O`7DJb?%QNN1_fKh>neoZE5;@O8xz{0AGCmx#ymn
z*k8KK3=xc%;o#%{bD7Ja#~&Zn%a3XDpJfuyy_=FeJw0_~S^nO8@2%go_dm)tLw^4G
z=UsdEL>@eN@Jhy?`}gl}aW1;wU6helGT8)_1VMCfVXhi-?b@}(<ZDt%iM5R?6c!e?
zIG1_Wrd}&9F0P`4__Jrv9y?y!qHM?OUuQj=L*^qm&iaPgxlnisBe|M|&P9SN25`nw
zS4@YXNPmp4%gsV=9$F8Yw`;cLI;>D@`Fg`Wpsjlf<rjxU5a3`%;kap5>z0<UmCI*w
z`R!cZo68SsfxHWs@5|+PaQO-@pVb2S7KZPNlIs|sU?VlG&uJ2eG5ZOwBh5ysGqV6}
zX+f1fR<nbVT3Jk*DPT*BQOafJV5i)oPlItf(&Tmcf~UdATIPM=!qQq?{>?3Q@I5+A
z%i7k`LcZ+ooP4X`G?%&mSs7mTpE!EWL@h3+=9YT<KJe9EEiQ}8TI}&z4gNQz@~e$&
z@KVtozRN=@Exew6Eh{ZOBlCKxOIsfwpLQ;#*RN)#U(U+P$tz+txGYzpYH_No!&(#6
zRXST0YHr1yN@`J)JBzHYsuyH)525C2LPEmT8h8}ZU;pu%PrgeKe1c}pnicFLT=;I?
znveDVQc)3ds7bD_BArvHlV9J?s5BD3wb$D6mx<Kpd3$~CG`$y`T3SN3#XX?!=%=54
zI=E+moF04nToC<C-zx7;>grvBu9N1><*mg&flmaJ5slEF)U!wSM&xOAxU(CTR)i|f
z{zD#l<i*jn8trvnX@4L-NHL@F8Z%y{|J^oU`F!u*EqhWdJx)jL{^gfnb{#r>_I%>S
zq_osaDd$h``(gX`?ceV^eLguQ^-5CGh4@&M?e0}o=v<Z8qT?mjqGeMhx+3}NOUVPV
zEGnyKEgPY(%4}4Na&mKXua}xS+E7QjxqG+qkn=8IxpF0~Ky>wP<>6^_^6%!0a%n=#
ziOMTO{S{{yMNxF_;HxVor+V;}R@T<m2J~uoyH=bwA63Mfd|la}kJ+C*6PNHu9vGy@
z=(k=Xf0Xn=dI9r{B332fgKZ`Sv@<-CFC|||Pfx#;lAM~7kQQN7tEy^kf}&ea?Q=3R
z$~_F|0*?uBzJ9%~=rWS};+3$lL4#O=x}g93O|sbQ8FZUN8JD#l-6Ox8oHl1d&^?)|
zecp0CTzUOExpf~rcyJFtt=lYZ-;U?y(J$7LMSi7i-PKQmd7^~MHfvqIb*0DEjH{Q?
zbkE4Vnx2`P7G+d*Iz_P6Rzazb?c4ix?%1|%+YSNk+PCk}v1`wsJ-h1z1HHVcH<Uuk
zv~5Fq*U`!fm1}Fzx>>2!BO$QGER+X4A4nmv#Y94j7B>E?_l9;=aw@Y#`sGWPV2w)%
zKP5RKAuSE_SdBYu7`S03BG^c$Tf-W#SAPf(|LN=X>(`I6{S&X@d&TyS)B5At+1Y2d
ze*B2-4SX!NMYb1h&uE{Sc!3`}V<J{_8ElJg=z}$B(ndY5aSc5#x`L%7zu+x*>*Wx=
zULX7@mUSG~+P23j9xtu4YM(;7!unVuR$Lp<m%X)Lb=y?vffm}OY)qA8rKF@>&B(Z#
z&eA0HN=63KB?E@ayqcQ}^F)~%_nWjNPy|A1RaLEV^pCpO`$vDJUi&6euW^s4`IKz7
zMNk%@wFqQhBd<m#LsOsw)WhLPWDa|afUWmo>y228fQ@CbdD2jAt`gO$IG#&mTL3JZ
z;<9RkY;z+KH4$tK!>35V7)Crcq$NR(Vq+L?z3()J(ItY7VGPhD7iy9_qSzQlMQ_I#
zhGP`BaSMix(?+m(UFPZz<dGG)!p=-#E!Q`vZ*GKu&0AuMgw7<K5e0>Wz$oDu3D5L)
ztcq$XRP6Xo*`{UE)lPIC)|_FYXK|ICPCwvqu^vxr^H7}|S(uGhI>W+7Ap-fm2h+KT
z4?v?=$*!X4HyniC$f3*Z@-C2PE3&kCKgeUe79&X!Yc&F_yTW2>ZEcpA0t#G53E)_6
zq}~RyU;ts6W4zuIJf7h3MM`^u#}kWR@J18upPJS&!6(5d-YDsuJgZFVps27DVSipS
zN{hn>FE<I>C$lQ)5sdqd_C>>LwlHBI26IhnnrCi#u2^l9s+<L#N%iU)*e9_66Gkbu
z_EHzq9a^l9#%uX=09|77UQ530aDuAYp_ra<<j-dF_XIBAjm!Ve<%_v|mlnu-arr7P
z|23EI!{w*8Kt7Pm>$rRbmshyFcMIf$x%@OPKZ?u$%H=CsAYZ`c1G)THT)v*m_illF
z2QEL7%YVb=J-NI~gM3pt-zW~Jc$Q9!xo`m&PUOOwO!)S_mAkb4EvqT#G`5|=_PX%~
z1)LhRZ#MV1bB5tO0-LyeHjlvH8{{3acW40DfU?(t$DU_hEK;xs@5aPK?;QIe9`@gO
z*ugyPgFNiYhOnE}y@m44c{}HL=Ix3vF>klgmwCGZ)y&&H`-H>W-7M*BU%lxYFZ3Y6
z`4aQ%HNMQRyH*P)Sx5B=^r!~fM}}SP{)&w<vlXPQMlnhq3Scx7u|C=WmS>m4kBkvn
zwuQ@bWBGQuNo4ufKD&6c4p?`s4N&{Vv$|!tro(1U2k&ZDx41vys9Tz~TP?SHe{T1a
z-0peY?mjKBdjOaB;PN&uZ!hsREs%%d*}BhSF29k>58&ZH`~R!_y|?Jk*50r_x+~J(
zF@tNAy!?><_LY8Btk`KQ{iLrq!wh^aS|4vv@pXPv-C>S~b$)C<Uayy_v!2iRdy$}X
zB8697PHFbK%f#z0YSp**uAPGhMMZ^$oj4H|_UE4nY`N3o#o^(D2QOc4aZ>Gq&DClk
z<kgyqS8GmQ_Il0KxL$MArmdT*P0RLMBdw9BO{=PlQ7?Yq{sEr{JW!i14~bc9Qs*6A
ze|r5nRHT?H*fSp0sY&(A#cO>kQIYB@ZK!@n^}na*JzY_ec2T;fnlxXkzy`ODbH|%3
zCPWW^eA%CB_U8$Ee}}aj*vg9=R<-<IM4zIphG4zgYr<GGAs)dMoB2O%TLgu$7Md+<
zarYz@XIR!!=}F^p=43D1jFYX=bIc&IwupqMjz7RXJ<QVa04(cZYxFSNPqT1_6?(pT
z)Cy-lW)bu81~THj@fy9xY|K+g$71Q<xCayckpc82&af<GRsxnzXv_2LY%+Az(@Ybu
zXPRC|w?JFzFjnI-*ha8*4mLlH&p?ORngKN17^i_g(bj3K!WDQ$Jw0_>-sd#lA$HzD
z8ZV2X0H*UAZ@!&(oyPki=k2AZB~9?U**&BI?>%RW9GE9%s|kl{ylw2fCp6wGc3z{H
zr`ZGAR_c*Hw_1UXjWKK9p0${<3eFm<v?!1Mi8F8(>M7XH$=a@tJjB|rEWHi1N}R`R
z&mJZjk0AaIu`07c@DO@}E)Z7*X2}IvgxwM>Zq#y|zEKWxF#fgH>c7mD%H5X@eM7J3
zh7|<=ZL9RZZ56h#Rp(eG(+1wh9qHnZE|$XE@=BVV;Fhq@DC#=(Fe!shhn);7MN2Jy
zBAW3JjY3@w*h-DTw%O!mTWnI&>T*+Z(~M$OagIsx8W=b#@J*wb>RD=UzYm3NhoZz!
zg73wSbbvtZFI-5dqkIgKvLTR5$(Pd7WH}+h%`G8;_L+=oJ;61TU{VBaa6S}61D!hc
z=wWGp@4fd88*v{d{lmh-Qaroh?DXldu#+dl!l)E-AFai7?)S$`%AZ%+pnj;bcyWCE
z#EF*H-h{V;XahCu!2hXVeYO3_h3(tzgJp71eR!kzkuVBxSbrbm04sEF&8OLcB_-8(
zxjK(?`<$HI=*V->AEQ#&GOlJ|w6`udHzg%Em(rkzM40C%n@O>06FZ@pq$)1X$+5I=
z*Uqg%QZObJ7#P^2tFP+iHE>{H;HXi7f%K-y)8^;jv17;X`l6yPejXkkPN7O_s;6fu
zHXglwYq-rmtz9q@Hb9$tGe5XO6I|&)Z11VxF3l5mrTvhGG_SgH(WD#>e5~hVNb}`=
zcbSBT_po7@odD9DHra}3xydMJR>&1dbDd{9lk$A<V*?&Tns+I7x2O42Nb?y;^Vg8O
zuv?)vCf=o>5Q86S*Gg+@tt5$FZCmT=s;^<XGdU@}Air9tbC%^$sj>iS_o%CL!YH0L
z;aOW=TwG>VF-%%hLhcHNO{?o_L_G6mbyn-lz4EKvFk<9hTQ1b+#GRZu_xW+{%1&*@
zl;@^n`Q8srnQ~uzd`wKt#T@kOO|q(^>Y7leyp*egp!9pjk?>FXQto#9_^I=@^4@*=
z?B3nGlbglewK@g!o;j{<x<2sm!w&^vB<d~si{tejhK<57sW$N`FS*w<e_N1kv2C&Q
zih_bMW5x{afZEE0fj6s@Q>a>7di~n9BOire<tra1T__%rQHVa^qjk=2`z2hw_{0-E
z+sKw)ac8meA?@Pnqer454@K<!;im)9$1Y;x^J-RV+__^14(tyPkBp2w5l5R%J#@O-
za{Jt;<m&0^CRFmd%F=q|EoWJ^TJhq#$~r9RsVJ&McCX0EyjEOQS9>WjHK(|s&KZ-R
z9<D-terjrddU{1gg-wLBHOW<#qL+JU2T8J3SJzbV`Omt78pcWW<>fL4o$L5mXmhP=
zuQWj*;Z%`u5iR^yLLU-}HnUaw36fCHbMc$V8%vQlK1beIh`jLz{J{Vh7Z)d4!4reF
z#DrYv+w#0Jq}W!^rho;Jm$~8==bZ;0dE}ASSI$I4MjqO|`|!z=C+{LJc?$Qn*Ft^i
zg*kKPJa(UO*O@EW_ALAOZ_23dYA_7&)pdF3p@;tC3@2Xu=wzr+T^wS2)Alcx8*Pil
z6(3#uPx9dd`}XboHT<_@zyJPwc5XsMM8sX>%OReEgi&0{X5|jtv&H%Jfzr~_%xk5d
zR;x>AZ+DE--$lL^tMe;Dot-?H8%|5OP<=P~xY@p*oTmBIbUq-s6NMVi)D2}12Q1-q
z_|%)_735~Eo0-n#y}0}iE}zQeLz|aoEiO$O#fbIvdUEMqT)K#dp4K4m7+tt=EVC{5
z{AFC&gA3<!;S?r(``Y9`jQL->8@TQsJos21Jo8$x9Jcst&T@ar59abATz)c_-^k@p
zHOM~;KQb47WD)$x9QctLuw6e}Me}vcwF+0)DO08lZ&$B6IVlSKREDX~ZM{WlNolEv
zlMS17Z(%i#rJvQ-d~M@4{OPBsPoMr^o0<onoPPd%ObnLux5z6<TQWR7@nnuTt)pU+
zr?A?`;+~g($ExR@LG7}?3c^&#B9G|k=s%7nrpLt<7LFN%Rl6-M_fBs*{q|eZpBM5?
zax$xjES-LjX}%J=7_)b8Fjn#4<NCq&KMwBw^|#*+AI9SGKDRCAo*wS*CDoFmqbFFk
zWa*chUDb4z<gQkWrOC-C#mR|DMc1xfxl&$^wS|uI?B7Ja<cT$|wMAHdDnG;OCwoh&
z+1e>XtDQ=;+R06;oqp76r+P>2giTUWIm`47a+L+S>K){&kvG>)cbm(G-&GxTbFLeC
zb3Jvpx$r-$teVP}O;%d}T~_@sYpz>z@Vz%zU;j~#9)4F9+08k8<js}Y-RAh_YP6P@
zfSc>3zr3rOVXxOpm_ObLXMuwY3Na3SQP}RZ&L@-0d%?RwVh5K`;qulN$a{17o?Lzx
zmoMP*sSWZ?*KEFU*$B0a3wv<kY%ZL{gl}K7{kL%s=DK_E;A464u{`*S2Hl&r{ZK9+
z!sRD(`3+n?ra|5@GRXSox6ZRAq$j2)9Kd>O6DgQy3mboMd{}`IGnF*LMBA}!UR*VM
z6<ZnLVWf#B+G$eLa#OQYbB`NQcTz1T*#b*+C4s(11W&nqY|!B^Z+`B!=m7JM?F;ai
zJr(G|uDp&jAL`|czqhw`*#Rx56;c69v!B_sux#ezI6H)}vFrbheADyK?0Hu<|9n3W
z{TCK`C=a`$A#6vyZ(a#se}K&q3@8vVPqD*;%~MFn*&IQ&uMlzvtzCGmZ9LplJk}LF
zWb2(nK7D}At@suQdJ?vIU`sur^tf;sY2Yi2;32cI>;Sz?J@ieDWyi)IjXNH9bhC-)
z4`-cYv_sTw4d}3Hz?K24q9xsCo?ROK%7&5?l19@`+d*0b?4$+Kpy@mVIpyV5<d)@D
zB${{*a?<Mui@xGu1AB5CS%~X340;Vi%{c+Nb{J~TVW>GfUc8uS6$`PpAu%yA`SPX9
zY`}+Iq^Dz~2WfQ6NRLooZx$5A(sA_YhbK*bc>MVBSkqb3edxn%$cJ5wACIw~f+og#
zgs3R9Fk*y-Ekb_RbJe%|zgo3w)$G}`J6}5b#rEymQW=GPu}Ui(p+=+(AvNt|JhVc1
zYraWg!#pL`p~A$8W?|<}OUG;1vZEr-VwDD#pIp6?afJ=|u#41GjPx9DVx$MFNX<fR
zt)*jibwT3QYhXiv$XTh$W<x&gqND_4J-$th^$2cmSg4t6Z^1bHpJU#T`ERx!a|bIu
zew2g*hGvaqVAt6c#|}E`f&+WP(II_fzaRq^$8GQMta+Yi%}YFM*0Zds$+G;_8TqSM
zllcn?$o$Vvd;W59ZWvE<jyOJ+yQ380_18^2i#5JMnm>JcV+S=h2n)iene3Sire$vG
zlp~YDV9ZbTw`Vd<x6#mTH1ZgBA;&1P2ngi6ZC@-h7+YDy@)iaZkMG|0<;O_;VAeLa
zEfQCLg)!!-Xhv3C*w?0wS#WnZxksG8jzzoI&qqW@@4HxK>Es+RV#0(8Tel7xv~}x*
z3CMFN3!J-#OrAU$P3v=|SOTWj)fc3tjTm7@J~N4FzpoEw`ONmNZvF3R0Rd^r*Xzwn
z&e1Ostd`XTdzN!vwF(QqLOgS#*4WiiCr*6q!B*53`n2xVZ|6=kGMh>0_xBL`kiODB
zAF6-v7aQBJPa8|8nkoz`revd2lby|u+0}AQF~-VtY|yKoYD}umsg)<y)|!#=OdeIv
zKJD7I^Kq_9PbVKACv&HO0B2-DwwjCOKD1+fI(6;Qr*GfBBSsAG(GE|SsdaU=b(EWH
zM)os#cstp!V9@5|-M>H8RM(k#$!>ad`~aIODqw#+*q`I<59W}xbYe4jH;>Va7^64X
z*ep!QUvo$7iTj4Rqtm$Jb4P4mh0h&%;><C3#8?~8_GnM}WA4ac`v>mgvqu;`w$C0t
zjWa%bgb`V`zr#Ix8jUl@+|kW!S_=ttM<`afi_aeIz!{%CVj*C22h1KZHq3Fj>#4iF
z#CSA{ZNqE~pFQfUaXDs>dTV@+*`t#hCuWZ@8^fkRz>2ve|J$<ixuf=WRz7#s#m>s-
zjxy}5>%hwF3s%e=1>KgF&m1{sr1;Dcn}!iEBgJQq*t{N_>0&cSY(@;Mm^t!ng7xN^
zqo!H4nInvlYgWa~k%4m->dDE@=}4c(vyb9msXfFj#RRY#1UoulK1rM1+K4Oc>Cioo
z*!&sxba2yCH=H%z(}Crm8yFj>xSg>Uj0ZHvqmag)4nBF5f-~&tkgLbau!bCY^X!%f
z3HI5okcQbU_8?rt>{bU{@!2i-Y|L&6><Q;-_|h@I#p3<HFFOiYZ=L<UT^VMx1vk&a
zOZ&I;;-)>ze>^b&vo-8letDd80zHjWJjw6dm6Z|gN&b8Kvm*D`ll(U`qFII6+HhXv
z*pu0EWNZLxIMmB#c~<8H`Ug(&7{7xNPuaVBv0``A6Y8F*4cP7{jE_B>^s+V&+84s?
zIsOs03EE63R<mmP`H+YW8x3?);|`)vXp>g_w1@abg_XZscL``<f6g{lV{dO~AB0^4
z*t~ETjXj9YllC+@`YHVR_jUA@Rt`1#UVT|Xyh(en8?=Ad#{I?+JO5DISdBl>&VPd5
z({d);e~0ZtV5ASU5~=Z5*03V^U-1{yFB-p1<EKT~TLJtAT*3N<C9HVb`5mdrtnXN*
z(I|fmG0QPYtc03)2^A+Wt8c_*mRauJpOsM)%Bbw-$qK0ng;c9Knq<8pk2qMhQYtQD
ztVbb_NB4a?v2v<Cx}TfR3MzYaUt?{$Jyg!yLteZ+6v^8|uDm@Y{nZ{~W!xEF!%Z*Y
z$X8z~+B)WarWJ~|dOOjyLc$Vo5uGn#d%sXcTgDrMU$te_gH0=VJ$myxPOVKR>_hIE
zXF|Iy5q&ir`oU}C5JT(OVKAPfy+f~7$7laaDUk_WqJHd9h4slexY6J{_Ooiayp_u*
za`|#D@7zcpc3^w#I96_GyDQ<*e)deS%`6_25swMlxfD=Hb8*(%EJ^v=K1--W^V-6`
ztVZFsXs+i~vrp(jLRq4Ko>!ZGtmkEo!3r_KI#?LUC7bPC-^=6Ck;mf~9*=MykL!)%
zp(nJD`FiCWX72lOc~35%#^p1)e1{gumvH$EE+5I|1GxO;2KmPQRY&-tY}Q-ruU2#E
z04{A$#j*zJW@F!thd!Fi&*t*mdFVwgkdNi^t+;#ymoMV--5TVZE=l#!AGz%@F5HI;
zM{?mLCajghW_7pnuzPXwC@wB?ak(MvX60LG`DW$E++e$pc=#uI_(BW9FXZxpT>nE{
zKAFou)dKlTT)sV*&*k!$xx7b%d~;<61sJ0hfm)gQO)E1>3>&R*9qbsbP*8Snt^K#K
zCVLqB^Dg_NwdK2;cniL1iGA$8ME0j2`=f1GG1xBAe7ogerp9glF}P}I^Rt#3Z}YPj
zCU5iKgEL2)zu7cvq1SV?A{%=x-imw`q3}M#W}NXAXG~MxXGq5x?=w7yvzz-2jveM2
z`V8;jF5YL@fHUmhHj7nEAK{$$8W<ni%<g&`WiJi4>ou@`0$any*PQuijE-Kzb&Zqv
z8rVKQU`4NC=xtefuYs*yW30T_;AUsldJO{GgO0WDS+C(4&Wc_Go=4D1ZqvH*Uc>!%
zR^Dsyva|ADL#3US^%}-=R`eR~X@d3UUPIHYe7#vGjg_r83+9~YH8}cWj`Y5vjj#0@
zSbFnb!xo%1^coK0iuW1{amITMjQ7sH278*L*T5JXdJS2);=Kkey|nil^f<d?o^GKJ
zZnjLcunuUx*Me1hjx~8xpm0O4WdyExuLaBY9le%C`0~!Zmj9;oD^2>X+j*g8ZPP-3
z;e!zIP80G&tM=xxcd_h?vQf6-wza^$a+QvBRVJ~6)L|6%4tWE3OJ2U17Go89YGUdr
zJX^K{SP_IJQ?s#a(QNj(OHz7LX<q4RSyx3>Sk^1Il^^W;V37S%D`{?Mov_ws<8eQ>
zB7mX|wtLxly6^|uS!|z1?0ShklyM@~&}nw?VV!*5MrxL2zk}tBgM|&EX)KkTrBwq9
zYpFP%8)~$}4E?}JY(#!ggdOX_AhaeS?=+hk=pW>m8E7ou_-XZhOuh%PD7}St9*tu1
zxH%LWF#juvL1^sVAtu)yG0AttB-s&@2p*HthL|*Kk6Z`KWe1CkgC&czbZY_24hPF_
z2TQJlMbBBLwSXnu!Gdk^cnV{A^$jUp*TBMT>!QD9e{4$QB*-UiI7<+%0td!zb}&tF
z#0HPZEo_vyS*xsaXmZ7&Nw!0i5+0wv4VthL*Hn&0mbcw&G9qE^v6<}PIKerJ8#tQP
z<e)>7Y6lBCqueGkXK`x*%l{^QM29YR%Nm7W9lD(6x;VE$mmeK06^<BPbFf_EEHhfb
z^0|ZMx`V~X!E%MOv~6H%Tn-zTW6c?~C91HO!yH}?1*g-j_2?PoXg#tz^_JaLzrnDL
zH4f#qhgrm`eS<9s=h$1f2W$7RaZ|LT+U8*#L~BPqpr^$+Yut`%%&4`ab~DCw+=bm$
zBN^iZI7dtBA;!o?;?R<^GosDor>AN5eB5;FWF{M@v0m2r>@6wlUX9U!&E>!;bkR5s
z^f6i|ui+f59(QW<XuBU;m)cpimX!4;JL_(Zb(o!XEm)uBtoQ3_VH3JGw0U09blqrY
z)ml>4U+k>kX{`M;RtfK8V$WMZQ%O%4W4xtx)-ujNHBMH=!=?-K&?eP5YxS5zw)=+L
zra5-hMXSePV{+J0cP>kzVw|HLh0#B@e+Jr7zIyr_&KkF)SeoC^GHaaXe=)L_)Ot<B
zj*v%7$~zBR*l8`P3Ox<MnWH7utlzjR5B9(CrH!AJVWULsIS1x?jYjr7E~TSP7#lz6
zfX5z$PZ5&>v$%B|Ecu4ktP)p~8DHx8s1+-Bw~Pe;RD@j3Mx#R<vnbYUxMDr3FWD0~
zLN{EYN9D@KF|;0)<cXZpV6(=($iMa;ggZfpjyY=lg@3h};6?B!$Yh_7Y}V3u)h=m=
z81+J}H56lM?O>%odcoC2z|INSpNai<xq9u=rF1sEdU>DG$!e{w##(W!iCR0g8!=)8
zHjqek8uHw8&z(DWu9B`{cY-QR_oYXySg|4^-6W(}SxD}cjR`yZ9)Zf#UbWZ@D44C`
zrxoIhG|*&He0tu0zkW(E#(nV-rgSk0z1vt^a<C;&URG97QDKVFNfZ?)Ma1|awQkim
zARqu6dU&{Cy`X@_`Mz|&$*m6ib9L?N(Y|x%&h6byVqLvsrmWf4Cx*4ydd^nR8ZEUW
z&;*BW7_G!%94PJWwx&l{DkzfOw}`%GhXi_@9g0vSaOg~(abUH%0^8o&$Jg4**H}^x
zWPeiFpZiUB?Bh2h(GOt^K^Y#6)^R_iAC@Xm+r-3+DanbK<Kxe>8Q6;n370R#o}=9+
zqud!gP1c$OSqjBkbipJz2^KZ^)cMr(tPa7pnOLa&rZbz?|1K=dDFMBT87LtynUvSg
zojLNyF_Yk<3l;MY)tH2k7>hb%#uFokPd*fkg?T$^9cEWU&|D0~@;v+%{`ePbb4C~q
z2o;4)&a$={GTS8lcresJ5yIqLd^rpI^|Z~-zLt44`$}HkbvBQGEjRZ{PEkH(LetCG
ztx+)vb@id5vura7)iz68Utj&8{%t)wbZF0JPx}N0w(|4si1BqLc5=}0p6u>?$K9Td
zX6<io3$b^G>_!?1XrCf_I2j0U$-WUKgsmMM^JvYrrG&!WTHF7$gW|k{qBEy>oK3|w
zjE~-|1M5KueK-eeNoi`7J2<X!j`j^4%ttiQ@)xRhW26aN-`idi&~A@MG}s8OE|awv
zR8L2Hp*d;&ZtTs#_P^Go7uuzFX0rVmiaZ_rGq7D&dLobAk37b9S?P{E=AD=r8=IJT
z=FFK3Cr_Nb@aLH`STyyaV6$1Uc}PIO;K5tB<~;Z@p5s>648O8<EB47X3iIcih2zIf
zm?IY+ddQ-*YnPDl(@#NUCbKZ|L@*tqJUT4I^wYjU&e>x^Ck@LH%);Z3YeM_>S-i{2
z^76{ctk!@wox65!(-F_~_##+Auz36V>Ggho_ugCUA6OOWFW!4EelZGJS=f)-%S5V4
zC@#Kjo`|PoEGxJoG5*0$qL3J8S!Tcn3+&*7m0G-9_klg`gFVK>9(|b4ggx4@l9q7k
zQc}V>Y|eW=HZ}#9$Wx)N)zy-Sz090c7aa<m&dK7=Ry1s!F{WeT+1l!QCj&O<OIUIW
zHacqx4YECGd(gR!t+>MW>iqeO|1=2$TrDVD{J|KDm?4aK7_RdWw%~mmJO6wtxKNEy
zw?tdu0F&(n1AR$f%E!_Ksc;mwmz-^T#5M&!F32{)_M8P;;_;}AjI7-J>p3~si;6OF
ziFzf})yb(IE1PV1#-s{`t*YA6#>)#U8d|q*>))}xpI>{u-UpW$C~D$Xp39lHV>_X-
zm0N$+Vz7V(W&I`gS35_>wwREuxxaJF<h0WNHIpM_%QsQP7D**h8167hgSMvB81aCU
zHl0J-s-fP9=_aF;mYWr4B%Mj}3LG%mh?O=CrH#!du-zjaqxo8C>ldYYd@tm`WkyOe
zBTX~;GMz5$^$lFw;qMzu8%2?CJL17bOPHvYi;91}`N1K{;_nET_3ffq<~gcKVz!Nm
z>bR&|L#U1xfD`P{s6QaoN3n6_Q8fbQUhw&Zbb=JeincNtMVo8P+9YgNn2k?3X8nv(
zeK!Pb6xy<f^GA(A=tk;hF$$kdH^XEWqa<yI5=KhFsZs$&(0Z|#j^=df9>w-?ndQ*s
ze(3UJ9CH+fli?`1F3rj2M+vBys%wPKT0B0)t7*H&3CBoydNMXBXpnW);~DdtY>*v=
znuMfuoi^i-*(#~$8R`jz^UXp^99#b=O~zkibE~Y_o-TQOPZ!kBY)_XNd{38yY)=>L
z3}-LZti8xQEL)-V*ITm0s7UyOMQlTZnl2b!$52uldM3Dxi>EKxaq<&*2AI!J&j7<R
zFsuW^4EP21{KLIzX~*K?&L<?Ci;w*?HtuY4R1_XyWB<;djg3o4IFS?^dp0iiOls<-
zRP4%xam!HG-0MZww!M4%No9GtW><Glr|O*a^ecJTWXpt|%7l`uSX@<Lb91){g9aIF
zFSyp!RTW*&w^40bVX=YU>vZto!w)|^CM3u(GWfA+&rS~?xZ%?c-~93`cIy23r=Nbp
ztU~B0n~TjE`{_R^nO3j1jKc1^eejKoIYj6vw4+iwLLUo@7l+WNbQVp)&O%2M`=tx2
zmJ9T`_RITpkgf|pLPzGE3_=IjfkT4Fj(<3?OV?fl24k};ilj(4?4xuoH}85$c|~bq
z{wVs;mQEH5mEK<XuXn~^r{U$mDtIz{jF?mn4H1%r!@_iI?(~tcXi*4u-!Bnn3XwvR
zd6YHZT4L*NdsW&U6SH#^o_82zwOR8`_})ggp|(ZRo|u^Jqu}j2S_`fD7FfNypx}CL
zZhl@-aZy3xRjU<`DYAdp3yTVJb1PZ9vY@CWJv}2GN>VDU-nLCEwFpn&3GO~^&90@z
zm4av6wtlU|vQm?4X{pt<4R+*mvz3)v?)CD*v!L$Y?K;*;E*>79iiZdGfo1<%`?T_K
zacPHVNIl$LUA(<pd$(@g8gEWu<h=|NLPEw3@6O3fDr~Ci<>?@IcEcW}LJi1yK5n+v
z+H;HM!vgpOxu8u&V+ZO~=3_h%Qll0}lQXJSTz)8*&*1VpE??0g?<mL2mo@fB<y)9P
zx?fv`n>LTNG+a}eJE{(Fv@{%E@WyqHr;)Fr;Vd5P5FTtP4_0EqYNb~}`B6}QnD1?<
zL9{tBZ6<6Ut2$EIp8(VC+ROi2i3gw+-nosPBqh9QMFg;lHZASX3+GP#ap>3?>==6X
z*s;X8D_1V%V58vk=g-r3rcmd?aw%X)>ynJiv1VtFiqe8}l2vl^u%LBq{M(E3UVLHx
z+oSOACGCTTiGjXzTm9ij-yZ#C`_^y1`G&f)B0ACb5GwD5!l$2(!eI7;w$8R5=23zl
zHlD7hgILcwihe}9qN~tOD}rQc{oYqUez$FN*q5Jt^2wWTe)al{C*~}Amo>`Y!#YNM
zjOdtzjuT!N#tGfwQ7_^XFSrR$3$L5USz}SY+S)qV+TqjD=4{Qdp0Oa7#X0%qR=E;I
zsIaiQI=kR<YI?%8YdP4{nJyxhtz7HVPvm=a?A+h%T;k&HeNVkuUshu2=;hU_mCfei
zRasPl2S}Z<ZE`F3+QRPL_3hiYCqE{5-_VgW-1`l=hY6-$%*sEXl$=@8MDBO&U#8XI
zRo`j3zZ2|(+|-73v_hc=&U3+fr@SA?rSIp`7qo5~MuaqZ?*{p%b8r<>72&jN6f~>I
zHQ^d2tmWWl%WW<X+nI~+=V1qO@v#kIH!I(R%a7vn+qir*m%q{i`3f%o7?=N*%eypE
zzo8CxwBZ_;`_k`Nxu4KoKs#h#XIAdrFS2r9@8>A@&3TOW-?3K1TupMSCb{<_YcyQ*
zbM!8nlg#*zwHd_j0@@5aI|~X4_grL6hR6KSWYDZV4JGqmD47<N%xNf@(@-++xpg0d
z+m_T@*Sj}YbkViAd8dPx73EtuLAaZ;t<&~IIE;}N`@``{P<>W7>fDwU_+}T>-;E=<
z=hn>?ZtECs-EN^dPjSz!+b`VKbKJTiLvya=h8*&4;~aA6P<VRQxuZvqhKGkA{^R#Q
z?%>PsB8U9*pKmN#`o_YA3$wDa0v@09MoXRjf0sjAtyr<{r^DZ2pN+Y5=k~gKChY%m
z=8z;gH7UQQrUoq_q25-1hg#z<GKZqnWEPiV;|`4Xp><YvhiawenS=WeR<pBxqNg{m
z+0j~$`}5SPh?t{C&i|=(>JyUiQkUfT*u-O~15C~yZm7!76_i$Zn4M!UXOy%a5+Icq
zE~8?5`IO#WwBXqgGSX-4V_WK`ZH*H4!|uZozeb!g(6`tvth>oHN@yo^B^&*y)#L}M
zUho$D%%jjK?~J<s4XxH+i2DB_+r(wAZz6FwY})dD#Odf?v?Yz(*}lK*W5Ix%Nqp<A
zg+XXcY>>Wu6RzDf&U(h0fd+m@tvc^yYiljB#+q4)e_C+E?y0Ey(Vgs$hQRB~I-;SB
zmT-wwSyOwxSQ{U>o}GR^`D$KKb~P#plXFQKYV~`(-Cat|&iy-g^vFMvUhmp!Sx09i
zOm$gV?*Mn_)~&SBg04NgIJ^3{$Ky4qk|3CwoOC`v>tZSsyk|&1_ZcIH-q-5Jn)2pZ
zb)kRbnhsqr)@nh;`x~#T)E3lrXF0<VUe_(-@`YUfp%%z@=kl*``CeT9M=tN$0(oaH
z@5klCxO^p-@6jOdirmNg?T$S_QK@22y|Wp}WLS7;!O|Fvm>5BVPUf-|V8OBQ5@>LI
z=uz<4SN%5KYW|Kjld*Kn1VQ|{$o}}<w$*$)2}j?Ut=Vem8-MpL`o=SuKHVRsava6Z
zY_a`E?3;_p^bI@u`C}@}uIXsR_%XzI23W?Rz78RQTncm2@pO55PGLoTXzTil!s0qb
zQR<2d3o@|}O(xrWrc+&=vpbbl!M$M1Zg=N8yx<($5wSOJI7?JtS!V8BQ0|P;DVOqs
zthlJCsJN^G?-7qa`sfJnf|Flk<C(8cutmtS&V?$g@$!>Oa(4PZ)O`nBlt&u(`)=Q*
zExp6iK~b<1jY_jbP0lovm|S|fB;KW(VsbfNmY7~ojhbd`XVk>r8xjkmNbkM(y0m2%
z_WRE}i-1zrE8q9~SY;RGKQr&lGtWHpRCuMMpoVB~9piuu+p**&TH%bOGo+5XjiSF4
z7xdD8g~N1&yG?gc)c+7^c!s=0Kh!IN-!s<O5WW}82MrmEYM|0YM;Al0K7TB@gSixq
zSSOle=3T*M<_=PrdcWE$Er*oTD9%Ys`UA;h{zytoxp3;#sS7D->4nHFQ<#pl3Z62V
zR>PPhQ8h`%t<lPqN(B-abs?inCz8;bDb-#YEuYUrt7#<KfT~7Kb9r7~UU{>oTYyY5
zf^O*9I8i4WQN-FS&_*YNODU4=w4)7FI*?fzYx#{Tak|l*51rH^avcwfU06wTK2)Ri
z@uY1#iq}!R)iC_^LHx+l_C}g7Lr=lyD0mX>{2>D7Pxlu=Pp^TV$mzZc^z;nq$z7xA
zlsMSqI!(U>hJNjMBv#Fd8b#1Ms)JN25Sd8Sr)eCQ=BBr`wX;fFd31C%N)8ovx1arP
z@3>@G&M_<2GIKcTw7U@p`S>Fb-Ue0rd3)Q~Syya7c<>+++<2R7FCQwn4ML6Pn9tY3
z;aggLZvX!MJHGq;Mp+Nj=+-hhIr-GDzakEgensF;`jpRCSH>mh&78<uukSN_h#XS*
z5}MhJOWo583i6Upox;4*uWKo(S>qD?QI1i4BCRD#9@bVh9`RENU{valqSWh232-YV
zz+IF8FAh@gsQ5^Vx2E_sich8ZE)(z)im#&h0~D{I_+S(8VHCfJ;_s*UjTE0`0=|;s
zZ7F^q#TQb1zX|x4D1IKrCs2GI#aEbsH}UyL<{loDdqmOBYiQ?NY3JKW=REfy=P%Ls
z4nKcA!uU`rUTsch4@X!HnLfO4CG&^(ZDaze#&^{9UpZ|4W9Sf$(IFI=@ccrG52TOq
zJH=n7_>kdvqA?q)ZR0g1Rs<hQ(N`$CjG|4MeM{PV7sV?mzMkSUhxb0BmeGddCsO<&
zif^X)ViWNE=t-_6-WtE3;@c>`%mn;@I{vZnl_vB*i$4ECI{y3U_&3q<U;XdlN7I~O
z`k<`|EM%dr+3!HKHEmmnwx+CdKwC2^-L}z@yVH>u(2-xIBd;}K<OYf_ruf|yZ%y&j
z{(r?=-ZK6Ho7?bw$Pz2?ju>{H18i<pgm^i|7atE00;c(p6@-XsKIC9R$b<QiM_rM~
zYF_7QO=?fZpniQcc}qpu9^Sf0kk5E08O3{2{8ozJMe!F+z_(GnJH;1J{8fstH34r&
z@j8kpj!(QC$&df~AbwO@uI6c(uYkEfny2N>JS`s`pyiSI_{PW^d|XdXVesv9<QT^L
zBytYp{ULG?Q$9ZO9jcUEnt1;l2l8nP`3Cbfe|nG`(apYd!kv63P9|C{_!N%9hUd8$
z-V5v(J`XeTmxC8r*bOf*r4@4x|8~Q34lUjiOaB8rCJpc7w-6Uo=>e}JJ}zcrHuEAr
z!JjkghCk;*8V5b#&q>BdS{oV{BSfh1=fEK<rjSNz!<RFPcnWg(SNI(oTN9~;{wjXG
zh)s25U(QGPm|NlxO5#@@<|AUK<0lrLf<F^aL8P#z@hfMcV>iaHxT=tinx4KRx4M{b
zl^AzPtIPRTgN>~o<6G@Cwt8;RmoriYhqSR;eU@)E+Suv?e5;|xR`>9&))`yfgI0~+
zoCs^a_HVbE!TU;*4ALZmXB%2I`g6)u%mrhs_&6wks0J&?#Rzmneu+ThmqHe<;f65A
zfo*2stCmIh5Iet;Rna}a1ZzxcSU!*Y&r;lf7BehkiMwU#co&{hPCfpm+V9RgckUeb
zMpMWM6H#9HHtsPFjg2c;-p0knffM={7W&`jb;Xa&!?<^oEtrULZzFz4wyGTW`T?=h
zr2973?7z!5#AxwWtLd1$OT|E996@R{@y>tyJ>EWI)br59F)qNYtWb%Vr?EE{U~eqI
z-tdvvlT3zrrJdc~Y<U_?wHb}}EiH9*{{AH;?(XC-xEAWTX+;WIEGe`lmx}a!&1tDj
zCY4%Q_4LF!IWjEq-J^f;0p3dVOIo8*pw_FVCfx9MNzL`0UwyT`W)W(m|AycscS9up
zE;g*-;NH~N&q?2T=iNuVN_WApi7&@vZrhm+l~YcS^J}k#EQy9s+^_sARvPW|^2--5
zzWj0o^F5s8pM92p7e4+tGX*2<?jjZEjJ3r?-!(9{FBq$iA<e?mhNp$gmK{Bccqitk
zIG<zLRe1QC(yLdloGWgD1-B`4Pg+_|jzm%h|I4y6trl+LC_5_EclE@Q3Siw@y@)SD
zF74@&Bdd^17UxqVG{?hQS?QdeH40}~a~=9iyu5sTX3o6hj(PL$xFafxc^-{eSm;|d
zd?Pj0dM6jmq*_{BtkV@0d3)3Ib1K$nDrj&%)@Lf#XDZgmxwN#Wx)!;QD~npTZ|`kv
z!z8yg>ETCrg;U#DyE!P`Cr_Rn5D?&Q=iscAN~Lkm)2BC{+DyJqHXJ?L(Ig8B3X(N<
zZQqXCQED42m49&fz4zXWOjq^h{^8G|4s@K=-o2rL;g3K5_*{1{g(7!1lBTaFFG0+n
zeCkEV_;PA1ePz<VpML)NXB0fPt4KPeHmd*P$PndH*gDK@SvR*XF$23eBkF(?T>?7n
zZ0XQ-ASDp~v7@`Ay%Tko<D8Ys77GXD`EgfC7A=}Q%?I@feWnH@<&-}Vnx=Mb1B#}j
zU?9^6$DW#+8l!wM+8zzL!pnp9v^rKYMhkhWf_j<xpw02*K?B8yQ2aiMH<r~h8^q7V
z`pm=nEW-NC#QMy{`oJH6e2ub3@!Urvu93SaUiEZvaOI(I$=AV(-+yncV!XV(nCj*q
zet=6An;#txYl+jy>*f3{BU*R-_?^?2!MJr-&?E<k%A=oi9QXOL>Ih;0i9yT>;~fEy
zpf@3GkGgIHLmzqV$k0bxJNPk>uTj=d1=OhPN6zLaF@LXP{+3|=?#BH24XwsE>O5ZI
zhSuU6neHv1?Y>cy@AT<qNU;)S@V@bigl=vgUhf-Li@rhK$8VwxZ$aOUqI@x^&@-$e
z-^jB*q$J<)BIrw*9;TI*vHtu^%v3RTOgdg$B(E=?J9qBlHzJv>q#z$WG#j~FtMQG#
zKz>6@@!hn^4A@Tw<0czgh;QT#Cxlt*1cXPGon5yZiZYJ6e*UO3JETDQ=xaIh>2-x%
z2hNgjzT{g1`R30J-VTP!@=^wQbrMN^O<wxG;(>q;A}b3Y$Yw~)E@W><;)z0HeqsbF
zvJLrL#yy~-CqPASgNptHDq4niZ0IgDMauhVd?_#J`Fvkd{`1RLnIP$L?B+y{Rdw8k
zuqU`4X&J$6XLj04x^~}&&^MW5SF8wUwh9Fv9yZ}{{~ai3Ynrk;Xkd;^kN`g#UjpQt
zt8MKm9ajpx#(iRn6!;3(m1Nu}o-40mU0=hxazV%i=P1<mv{qyEHEmj*!NE?U=&ESN
z;nCCB)m9FHrKmw9#gDP_y6jwdR%yk!D#St<5yyH71O}b1pN09N-(X-mI+|MgY;1Az
zO4vSD-+|g2EGK7qqftL2lB>hEZVe2a9N;RJTRVW8IN4iSc=}Hc43za-Pna;lULdL5
z``Kro{aSXm73D{_Zr%F**I#e`@yGA?Fxgxz$<g#r#bR_N=-2fc1cF%RWQ5^4!*g)h
zhgr@1iv)exD<6FD!IS>_!fmjq3FY#t6i%LU;D;Z6*u0VSu6paOjT<-r7=Qi}afQ8>
zns)X4xy_q5ZuG6)gDRs3n!OiB!&<hFf5q8Ex#eu!xDkF8D<kfG`Q3LPn+j*|So4}1
z2}Yo>ko0Oa+E`&PTrF{FV)lz(ch{F7)!;Jn5`CDhpY)G#W<TnJ`#;UepMLS}x8Gj#
zKC5k4hsDPqJ-YYTGZzz6^D*OjDVHyv-@W(f(WIhOWGqh1OiC$+lvI&*`UHN2sV=*|
z_Wb$tmrvmq7Ar6qbg^Fj{YZ={Fu<yTC1A|WZLNjPO^}>=4MKy+9QET3oZP?{K@c$d
zZgp6GetLT9AE`Ap&8U|l=&rA*!B6Swl^wO<ex;3-jr|rD7Q*&Rf4~O;LP2vIQ&&{f
zoQ{N^2-oQ@kM-(q>lRyDh|!^&T#gRyZG}yw5UiH((9+V`o0Esl4habfo?wt#(wMc`
zpf!>O^e)iajVz$0rDj?k3bJVG^!fRy3<U=ZF=LgT-Ox~0#?(PDkz2|H0*F|oYKmB<
zkmDmqqC4D&NL=OR9ZhmbTyi3D-Ln`G43~hkaQ6<H6&@ab@#4i|nfIN~K<YxAk#v~k
zHFIX}Zf-#G;`Zc|8aA;gk?@xAo)yeg$Y1>p>Bs)Hd-v`+bLP0zrJq=9l)pG+iX?7{
zRb3sBl=`F{)zxKf4ampX*j83wpPW^agDhfdo9^}=xF%?|m}ExR)76cS9Aru2msr><
z?C$QCi7ULlojolvkyf70{{Bwk3tSl+Als_zJ6lRhN^ny5bk~=ZfdCMCq#Z{lTT;i%
zWC}b#gt1~g0p98{6ujA>U877kvbDkt^NruDreGHe7E-W|fT_MoHOigMlJ;Fp;b$q_
zm%<kh_C4x->S>B6@w^zt7ZjgH@!cli%_!cB;!jb08O1L(0q;Wbz7!u%@iL0<9mJ2O
zAC%M){h;e57P{_JQ;B|1c9rM{`)vmFgQMtb!!hl~_y|`T%<PL;h*M8u05N=ogzO*&
zK_evkt1*yUBP4G2j-Fgcd>!xL$MR=>Ec>q#U&mUT0bj>(?8PP6iz~4g!@>8%!S{Uz
z&Z;qXWIXrDs5_GB0f+TUSQzRud2;m;I0~&>cetvsu(?L)<KrW&ZT;z|#gSXKAnBL5
z+(}_RxpDLz$|OcGTbRu@=}Bh~9}Wv${QUFJFYpVRH?Q>ICy}_v;wAXxP<a$eFnwx>
z1y^73I1<H*ooWlso14epvNxV_jEzg4akP!=Lk00Mx33EL(Y7zumqlat@5Agrg4vJ8
z>_=nvy-V}+b93M{nw^~kt8-BqzDkSpkxec;C!MGWGMNKhtSwGd{J~vcr_&=&ip4cq
z8Vi0%{;H+Z+t2*GW5<q<QH;v)08$;FIwkHx8L4TavUcRJ?X4nb(Vq=V*$Pd#;Yo<#
zaPPLY^;OwRZKp&=f=}kMUiZ9)b19Z}bc|)4oz=3v{u7tI{PN4s{572U*le|x#r(SM
z-+lMp`s@Bncuu(&krS(#T&98f1)kl%F#BV|Su-wHX=~fn($ZR&n+xnbK|}e^kq809
zE0*>2B!AW3rPbB7b#Ujbudl1Bs;L00D=96nMtZ#Zx@MvjXk=0_IGkqqgNjLFu}FX?
z*Moz`f`gL3YHuatBJc&N!P(y4(H0k4E2RyD2&Id&hbMFbZcNB{ZSXv89@ZlY>#-E;
zF%Ro859{GYcf*)_;iFOag4cDK?7FXS;hs;)*X{zGtwmZ4Ra;!WZr!}F4I7Y3P<ZE^
zNlBw`0_XcWI_|r4X-VYDciwsDp;>d5FK@r_J)DTXzt|DM{J{JmUibB1UPY-qVPax*
z^w?Bye3mh3{-aT8-iy-w7zY-)fR0V^t1!c_V1_@&48MdKei<`7y`?fMEkEV**_4*<
zZj?n(SZSD4#BpA{n3`LVn_F5{k(zq#^5x50w`AA5POyS^V09IyZK^<Ef9J}T(M~us
zdwaC-(_*?1zQ_n5gXxOn<4dq3AZl8>Sg=fIS$@5!uTP-%FY0m%oUne~4=0PXPJVuV
zp<X>AnYXvMMN{FGUEgi?4^)(={SLwoH>@$|jwChLCqR|6^&E8M=uTUcn|pP~#~*+E
z^X0NSS@4`Y!^8aSB{<VXko!X3fB*ew!`wW@CCLegw{AOMS>Gd2izb=pp1p(wnQs4B
z85$rw`N=1r?8``PE`m>3rp|5NGq0@Ly4&C#9fc?@UbGawz4X!We?%a~^XHOPt5&U?
z2j-7zNw$j@AvS3(vw_*c?B-t|o89H9O;0$p`<LIZ<h8|$S}yP0i3p9y_}2%P#|ouW
z=Fh(;+FxnqEoWrv>1jm`E!AyWL0j6DEAX2+dLTI-E|%>&U2AO>Qb!jQwYGL(OL=<L
zXYbf>fJl1<Brj)3<At3&PuF5bNfK$LL|`tJ!tV<+F7^%&_W}ZvWowPbz?gaZJLrX?
zxaqbwzSD!l7u^@(;phdq&x&zXPJ)tb*6eAaQ)kb+bB52H`FBj2GUd@1!o0g$tiY3I
zO+XF|$DW@0)1Q92s}Pzj)akOc67&iCY{UXK*3sO5_G}fld4GRjZFyV2P#GFN-N8=M
zqaMf3I4zNvfuy{B0}3f#1}dTXJg1YiW#izxDZYT>|DbqhihpSkKOjR5^&2I%;`tf|
zwmcYyw-^d%Dcp&`$CjdQv-hF?79^!7-+K)mx*zSkgZ6DRe%~l$Kr#_{QTRm)@1t<H
z!6zS00+J>Y3CQgN3km2FFLh{-6A8%vi2(_S%o&M4C!<!VjMbYVaFS7nGe5-8jyI5w
zagPzODaYAYF`$WqeGf>F1G7%*-SfX%O2_VKocQ;R6JN}a9<hiqgKdl~hk?Em2jnm}
zG6j5`s_+t-1}cYv#~jB;5~*rWrejbJ6XUsVwS4et&o2;d%vAD?PpJF^M<sZ|4_9F(
zJ{-yq^D4@5**fvlZ^i8a0ib++PfvA4ZEH(YYmZ2X4bqdCb>b`}fwZ(dt%A`ucWEjx
zW-zF}K2d#sSto*FT&(+8l(3SP#K#xw$hDa1)9ShyxUp(`da-?-qF1iG(_WySUL*F#
z?OKqZ-D?%KWYVNb4w~|lKm0Ty*iB!Xa}2la)A84~t%Kfq@3k65U`WX3@AoESPS96R
zedYOWTMs8Bmxw*x!kz{93jvo9fg4Kf{ldcUoD(doE4%zNxaE$kxw$o3f!bEwnTsHY
zo&P-4o>Oy5tycfmteh5squ^_cO9?3*4zr$k_0?A&jDGrwr~zw(`8%OzZ0@0btKL}Y
zkI6%+I7aSmrSy-!Xa4*t(!yg=xZLwBPZYaz=jE1Iv$nh|zyGrPOhUTW^R7i`nKH{A
zV4Pr|g2lGrgf+#*2!@b)+m>J7xbfV%a~Bd5^NVs*(=t*MPoKf?5_=k?0>~XLEj5>q
z#$QfPN-n~ZaUmk1-of9~j4^0xT7`yQus*NwaBp(+MX5@u)LbA@T1#a_0Z@B-=gtd_
zanqMg4@4II<*&XtH$W={3-nj{&Y9@r<v%GT*f#(yaO$6;A736C8ai)rgr|j*=d|EC
z_kfz5;9_g%Fg-j}DeP}6ukFK?o@G_DXZxGSI<Nw<4fvwK%2L4gfe;FJefsI?`T<Tj
zTg5Psf|iIZPwv%3nzXgycLly-ABkBBc@tS9Gr&(j{rtnGO`Cqg*ZQBbvyoj!Es`n4
zP!KS^v9PS5Y|QlOVbMSSc$Z<3;Vy`gt7)YKygzNYi#>HJ+;Ep@t57K1iVuqH?C!eg
zj_ojWY{lNG*2K!zv~+fMw6!*M##(^{&bO-WzyJQ`d280J@kx*KMC?$3!`pAqbh+a>
z(9No8nwc{->EC?wO}d6<uapr7Xg-!8h9qxf6RTrUM_T&pvBs%$U77CKNakzulHBdu
z2obj=%J8`1S@L2xX2$tKSgWtcdG77y3$qM7R22&H6aO{Q8$u=wBNp6RaZhWjPQ=Cu
z;FJ520Q!oxM4)$Zx$nN$CoX;Tp@$xN@V@)-(=rryScVVw<q$2AYyby2s(iQpWty%-
zE)&IC01bN-kSZZ*gXidks}Ost4OYPhybW1?#3XqQq=eMkoU-F6zfG*{9y>P$U5F7P
z86XN@et@K!?AZq(h(FE$6^n>kOekvfwGb*1vERdqRQ1YUMU1eRDQ4)oHS)P*Wb)QV
z_V-2%^8k3NAe2#(w@yYe-npZpwP|wr2H@7i!y_nsK7kMKefYU!Jl?7)crpe1P;krm
zeH&=s?i8L*;eHg}HrV%Q=Z>DQ$m7bNJ1Gy4n|Gj+oICA`fpcdxr0;S5p3Ea(<B_RK
za!)Q)4BV4PLpJiYc+xJgUJQHX0anbgi<RtU#JDL2Vge_D9wvbv7O8}I7cimNmG&^n
z6(CtjN;)(}kSVVwC1qx!A~|noA#B?vI3C(9Xt>~vV-MD$J)4?({s`1hsj2_`=i0Rn
z4!8pfM2}5~l|Y&G^5Y^Xw4l^t-c?&!5@RrqOneCm(FstpWGVA6)`>|+ZXF?`$19y(
zh@kehtQ)b1aMAQehRU^TKzvW}f9+9P*wx>|BfuAA@8K~K<v_f>8Apycc1Xbcsx!l(
z!Gacx(W-^udFR3nE3kk1ype;+#l^wF&JJq2nbe*k0XJ>#m|eoLB_$kFVwBqk_6ezN
zPby*z*(bFH`IUQOgi_)YQ2px<!Ixu%?=tT)j0FiP`i?#S(2a45GRw+ylVgNhM$3pM
z2KZSmiV>DDC6q>q#c(EOo>UteuoyZQ6yrXP>vjBZ2eNZ=(sEK$Yio0IpkqAFDTzwD
zvy&zIQGG9z!ZMC9LWs}K=h~oE1iSq9qffqBzy6>9^6=QXbJM1vAW$k$RVjUaDF>hs
z-mng+H5~F0aLgLDDB6J1sFBFNfS2H%Ctiz0;PXaiqxiiCv$H?=AcFj}@a$QTxfxLf
z&z<|yYwx}H9(X~F0NP;i0^~@6$sE~Ao>n`{CE&GC#`?~hhFXcX7LAR*zEI7gz7wY;
zdR>%cAv{AQfnK)<`BHi~q-J$)tive*{^T1l-P6X#r%$D-uU9I2d$F06L^-R`gw2Ks
z9y%Gy*<y|@E=D-JaeeG@ns};2j00xR9(+v6uySlE&=&cUh#4_?7nkx(4VM%!HO9hU
zza?qN+=y%&8f<UOhnRi!CG7yOiyPo|Xo(07sQt)uJCdNJhm*N~n*IXM^5S@w$8*+^
zr7K>X;-#wxh;*eS-xNmaDge(wZ2Hl7hCn<6vFV#5B?-wR#;0!)nPribK`FV##hICV
zdEGe57o#jU<5<;a4IOk`T-=U~sviHvix(e1e*E-xxL{$ltf7ySHK+U-6BF}eN;4<y
zGq3`+xF+Y!U{I{^DYu$KQHED(yp064yzRP?;6x;m2+iF&HuS-0<{RcP|N4e~Fq9Lz
zn+qlCp@U<^W-X|y)z!%-9V;}GNTiI+!crl_ws3THMD8gk9BW?gu1>c6+2!Ky0U1fu
z+pF)>aWXxOAQ))Bo)hZ&^u1K`9)|f?g!y<9^DzzcK_mnlYqF#)pX6p>R;=?g$=8s%
zIT$NIB+AeU@_zPNzbBu3va+(W$99ytvf-GgV-Z{;Bf%x3%-RCpDzbte;R<B5$UHm#
zJmzxD78I}JWYy=kY#Dn-l~$}sFy!G_u~iacIEKvZ2F^mSA3C|-c6LOA#D9%4&%vm5
z@u94?Lp0iS55HRu+){|um6ykY_VPC@2i~KPFVdAx&gV<iOSuW_INt3vkhUP>TR`Gg
z9^Xvygbv2TH&T2d#eYfhM*sE)Ou!2$zLDbhP`rTlZ)pO)m*U$gzHu17%LKd!#m}So
zP>MfF`)@Y^pG5HrivOJAdnumWHExn~hOQtnjqD}M<<EnWOe%)Lf2VK-f%6<|;Fda6
zO5)dlIqiK0?fqv8@1}6GTYDdhk3lFM-}}Q9oIt@Oq7XyM9>4GZbmcqg*t==>J8AcZ
zTgE=>v;RN956junaqIYvaVh45Ge0o;q3h1CTsTEjx+D1r>GNmN=ZEXq0Obs{Fm&zs
z7V2mVo^<{`qj+On)kA~$(Iif6JZM)Mud%)iNq2=KSx`u%T+6BBNx69N0ETViku^M0
zR!Him=%)_UO&P7vs=XxhMb<SIQtn6TM9K{*BvS69QwOBnQJ>a0+fDRoYv|L;=xpf+
zpLSHdJDsh$6dywI$0%Mih#zg_AU4dFC;!Y}@Xu_;&zAhgY>nD;4(-{F_I#Z7Tt|CW
z4)#1MKJXyV<7LETNK$L_rFWW{4df>eCirGLxrNe#DBgj`^JfI#!X?^5)2%JsLTNd)
z1v@%|<8%ad6t6S^-%IiB6yHek0*db%#E&}n2l=_TA(Z+>E}>Mb4TMtV!2^^U1bHMJ
z@(8iFOoTi#3+JN+F3&>*H1pCSQb>F(@m?@WX!6`#+&gj_U=JWV0P^~W#c$`*8AwI&
z>)Wsk6)<JyD^|cibVPYgzHni0ub;gRDuE~l$-(gY*<z(%+wWg~`6c36@0)>=R!lkX
zKO!z4TgVtTW>#!oIz+sPj~OPpAyKGOIf_)F;?!fy6YdOy+>Rn91oP$22=JF>tjbHX
ziwX-XvI~j|E3z_3#zkp+C&`4+*}j%_vJ5x8EpKeei_bW@<5%C$5W5kB)R(c5NWjpH
zs%J-!Mj96NH}~ULlX|0ZH~br_oo-~l6g_hHgRfOYFh#5*G_pBdYy>-%Nf6GNG-+l8
zlfX`0Yt`DW@9gSo(RX)twe%U77IbTAhJ}-wSsMS7F*G&}{ZC6|Z^VD{CnL$HOgz4a
zQhhAOPAeScV~8Kdu&;qQNO%TnPq&b_bn-?es{xuLv64gc0_lzrnv-q<%`tG(${|$e
z*g~kTs%3!c?nd8#Mc-?Hy&JQ*9J3fuTAGP)^}Ia9_~+-B<P;VZ78D@;9a0TvXO|V`
z7vN7`K{mpJV&w=|$4yMw)7Huj`K*>IouoxY28A+?^}wvZuRzw0q^r3(nb(u7;DD{T
zaPH)h!xt_joH=Dfi0V}{X?}iA_VHu;53fZK41A_lhAD=Jh3X%Fgmdr1_^g6M$}Rt<
zj$pPhTZI3(`|h_RkdJOl9NW^n0PFS<*6j=E#ny=*ed>i(uZzQ(^NJOZKK0zo)5B)Z
znSU*UxyIy)njTqpcT_m@p<wlzSHqcntn4Lp%r0kxnRwwNbLT!1$;7k4>~d~|e^W>F
z@9S?BV0e*+_xdaQ_r(RYw-cY1UR`GwT+%hVuI{cLt)`>1v$IvNZ|mym?&$5-cI!!c
zKe^IM)~C_*A<CZ{@>wlKN)I0&wyV|HSRc!_v}kB!y#_;5QyXoptgEw`G4z@ZG!}Yy
zRMg#}w6THDYBr(~*{Ma_wsAcXRJ%UFn}<>ve+C<?L7l<GgU%G7Gv3)Gl%|8@-^P*P
zjg`c@X$!i67OvA4u8_BJS}@iUtD`MU7-*r3w$N)r3&wgS$+U%lfff|Bg?bZOFjmzP
z(iY4ITCk%nln=H*_M2QqW0QyNH&Ry$9sneY%U8|FF_HY1Yv#9HGqxO^g$2M9PX}`I
zT!1~d0DI1>w5X^gBlpU+yxhXVx<>3Y<f$zys;$h&7EHO8n@RWqtH-SqDhzWsHw$ZJ
zFUJb?oLmAAs@mGFj!sFOP~Ol0f0G9+uAVr0=ETK>#6R}?#C`oW^0X*i&s<HuoOI;a
zp<|cA4KK!!m@@Xl6sS{Pl76(|=R=3KeD@JPb8NsFPX5-DEAE*+d+Gg8ycH+x3=LH-
zVC4vR*ungQ<h7f`;q&IqoSGWNBru2YDwXEWnY-lCr(bz13fpcylImz;!kH|ze$P%$
zzUJMBBmVTK$Vc9V-s9*}PO$dlwIo~Kqj<e4h+VrjPT36$j>urC=<C<%nj3mMS<X_>
zrEBfz@54P*-X~<VXiD6R$3%9G+S-nmRtd-Ui7^cdIsD?}=4QQdUhSQo8bhyMhy1u*
z$S~2W*XjD&I+1u2Td}LFw;!xBh82;y5_?Ve^_`{?lSar~wpP}_*jn4(JI)^IKf=o|
z{g^lG5gX7(7Gc897#`j#2YK<RyG%w~NTe-H8fd|aw$M1(!hk(+=sqR&p!SfS#SD%x
z@}Y|fXRS%!wa`T3&4q7gAj|5_`K)6E?TDQLEEM>^k`I2s-%WsxbO3#Pe&wNg(TV?*
z7}O~Sb#kD-I1WRP<H(caqn3PY;o>Mo`+=eZLD8YW_yOYwj5W*;nYkH+e#?-T5OE?$
zu`fiN)F3mPHjQKrXGC!VZ*LqAFInvU_2{Y2Ua4f!_HVys4&wKo<fJW(ZB&%CzJ+6+
zj02<Ujf7tFS7x1L^|Py=o;UG&B)E7MlLczKgx}xJNj;}6c;=a?5KoTT9%l`Eet)ll
z5I|c8I56RrF^ry*vOS&2$t1ZtqvwAKWJ7+bWAK;SIjNV|tVxsZ@bluBc1jmSZ#@Uk
zcNd<I=&dK=`Roz6l3SXci(Kwm>6zKtSs59~5POglqBlK~+zSP<BB?|s6LO4DE!wbQ
z-MaE{L$rLIi@f$=%(vS%ZHh45ZMa(i4DtFG=EBp7lU6=4ThZPB?z<683@mm}aLg0x
zh0IR+GU%CXW+(f=s>RG<s2)`;1N%o6Q^H!YR)V>6v7nZma0R|N@rsKLOm9z=;RVBA
z3=bOaVgBHlKh#9gURzpUi<IsS&5iZ-4NXlI70h*xsH{cMp!fC1inP5wJ$<NEuC|9p
z%}MFvWM}W>>fz?%;_B`W58lZm|8fkWn^7s>$lLXp8xY>V!`qD~R4Q%Z-#MX-r$Z@i
zVT{v(@OGK%mO4SKFDXa>W%N|iLIkrHM2DZw(nCQ&Pr5N@!Fakj&=HJrx{NxH##2^7
zTNvY%9aSFW>mJ%3WFZe)8V@HY{&1=$htt@rXso#?qrFcD|Kg>DHhMZX4xWx9OS5F}
zBW(w?MLZS!WdLtHpVJ5NL0ExM?6o=AYeCp+L1eFimyoaF{3IUi=O%t4*|4FbV<evP
zF(>W{5AV8}uTYnCJG-&ji@4|D!JeC03_qq@*bEudO>73a+LcQD;&4`@!Y|&$YUm1x
z@%+SZVmSZh>rxy9(<SpBXDmL6yt@=LU_TmGD~7KhPpioZ){%(!g;)b*=zfjlZ3|~f
zT^K~X>#T^YEvY1FkIKaOG!XGVDjk}<m&mAYj&c`VCNcAWM?Z*jul8Uz;uGTBZAnZz
ziLgPejiiz3z$e7HPgIeFY&>0#9Fab}PUA{GcHEqAk(6dan>gcWls8IaFt5^97pX`A
zky~0FtOPW?PUGWzt4d?5+xS*Vd_P9|d?V~t{75ZSH|h`E{M4lG@35zC9jJfE*8yTf
z(E@7rV0^9kgqrCHJ@3M&ao53E{ji_zDA~Y{63`vVzftP=PkGwtvGAoNMMMO%({PZF
zh5ri#UOpDyhKzxo-OQ@~cl0^3&EHsAcP^cj4+bWM=PxmWef-=IK0O1pc_((+qu??#
zz-4A&m7I?s51JU@9~c_7w6s*EI(q2H!TmeG{aB?Ui9_TzZuU~vAV$m%Zn}+adIPJ2
zpF^C5lhc!r%nk9Kyl}a{|MBAysME4a^z|=$e}Yl(E#cwAOeV0qo_b_S)GMpuv&zXI
z{_vmsPJQ*sT1dZaWo5YGb=lhUWmVZH_cS*zWwtWN;mrz|OT4&!f~mtH4=ZU539>>k
zWduBYUS&7_7HxPD`R-s3g+-Lv6@g#=hJEq=Xh`2bl5k=K6gz9R4ebhhxv0Cnqr=+T
z)vm9THTMd(w`U|6PghoXuUJUDW;nTGqNlWvf37%ZJG))K{`lRVe{Ejh({uc|liSpY
zNfUzt<4I-W82Q5T^5UYLqGA|E<;O*4&fY;j&@LG{(5T!Zisqa#!#v>hx59#~#RmcS
z8+ofh%O6r28MOsl+JYZ#p>3cAZ`uN1c6gi?q_l+++Cs}f3-f3T&L)h(<Q7IddmU)j
zpG+2KZ!6}2Tns%W<YIU&Y2fS~4Lh%tcw{UjSfb|Ov6m&pC*x?+fKSGQpl6aT^&`;p
zgP`XJLC-;6UaEylX2GRRrBe9>_yvqb-x4?rBOr(6l&lD$NATGhncm&!&yQHLECPx3
z4j(?;=s7jQ1p1eJ^)2Eae!a{oQ>ys3N7)auBS#VnnzG;!97(7i-T@EU>eFv)liZR~
zS^Bg;&R*^9?42Owvu$bUN2W%5dwUy8rR7+ANdgyOxOW&hr9qF_CHP&Bytjf59N78w
zk3Yk01;J|P&m7z`#$J;eoLx{m%TL8Ay;01-Qp$|E_XsB>wJnF=7<);c5?;YGC6iR(
zKyF#%-s_@tpEyYOVzh9p%uz}NjZ9wVSW7-i$T!rmrn@Z)m<6D?he2^9^L{ue&g10C
z^C{(8d*ActFU7|nKYsYgvEwIBoIH8t;L#H&_V32Y|1KxCv9U6jpu|-lIH{FTXYT51
zBSD0HPfJ6O&_->UUQ*vwS6*D~?EJjHKk_3WczliJr$6lbBd0v;@;T(<jAshCj|IPi
zmr5S`X6x_2e*f75!$0`f2Z*VDkL~S`lRvp2(9OY8S6fvDVTWyPT?DVk4NNO8jQc=W
zpP<ae-`A}9M-=W@B>6rkc!qhG`<Pi2VR#8j5b>E;o_YMa*B9d2`<e0eIT)-=6zAF9
z(NvapX3JNtI04$UTAjA5qphXBrWIGno=zbosgDJ4O64s3#2vMby>ifxgOjsF5NG|y
ztFONP%JcVxnVET;n+FF6J@9Tg?ho(00neB9%tq;|xpU^+{~WUj_*b&CIm@pWE{wQi
zN)Vj#{d_%p^z;_`cg*-2%=jmm@imxnc*`+!>gwB&lcBAyx~8@muIlM2*VFUziyIp+
zZQY-vW2@lAnUVsZp8E1?^4}S?y}dPX=WJ=IEoXLejtYgKyS=FfRW>Rs%gd_r(h%yH
zmUt3+q4%X*;2LmXM?yE}(BE$mE8t$E(^nx5r4bP-O>MobP(7zfXAZxR#w(f9Ha$Mr
z^=2mgabVLw?L;M)E>{*DhVj7K+ELb6em%1b|EqAFHp}bUH(z}5#m{FUIH&{yBu%|?
z<a~Zf0TM}vgg^26>#wi=%km((4xFf=OdP>EELq|&7ku;0QRxzRAuhjXX`~mcE!p>t
z+V1kD>$rX=ojQ8%#9nyjZar3G8MZ0{!B6YOxo7^B?)-2xK7WZ@G+s6*PMrCD+kpuk
zr*`h#`OD?LiIe89jwFScm>-4zSjsHsoMkdYXIHykVQ+0_?O<V6{wv~Bc3w<6@>^!C
zup*_#opX>#nmc4Kyf9zhb0YpqN_tv)ZinO42VYRnG4!_}#j8eQ##*c3*y8VQtJK2p
zvQ}f`ZdOq)M~aG|Aip3ti9}?F|MgYsnp)bMFoWITu$+omCc1<YLq}(iK`bq*Yyz*!
zI=nxpgT>iw?T#2X2gCr7NT1fCLPK{;Q&UrYhpxL#D^}03wY5U9v6X|9y{$W<fCGa=
zC;Lwb@m0-#;=yS)5+``dIXc?fSXj8&x|08Pkcw>Wt>HCg=fce6RGpo@2CyweC2M=N
z-5RY99cqPkL5rtA8{j?FDw%UYl95g%W9ig1_w{ynYjrw?HQ<Aq?*9S#YpA6yMlc0b
zg>zj<1j85si^;{CmKx10&@Yv{N5*DQte9d;C{|3d_QSA*R}Js?I>E+LWIjbID3Uxa
z?bQtXhvak~o)<2|04T>es8MUl6AjR`a3vXNgr<cPJEI|*7S0}_Q1}>4J&4Ft{Cgw$
zzlXHD@$@6lc_*Fo96EDlbmpefnTz@#Vw-8dsl!%mHtl!GjebX7vChF2%Nbm;vcVOb
zHn?I@x2)LBxs_rBrj2Ff`TMV9XWcvpBlmk3oxeNi{OzafR!Xt$H|B3-tQp1DP;5WN
zT2O4?IM{xQZKqf*#Ts{7?>JbNV%;gWf?^$MznwR*15z;2e+;#*7<Td&^rI{+=oyQN
z{OoK)<Y(c$0r`34r!|h)h4xxXdv&3`_T1=oWb9NrVrz;`r`R-#EgT11O0iZHYeumh
z6l)j<+fK2@F&9&8E5$Cn1v^~s3!qp^8F12%q3H7zU3Lq4I3H~qiWUS>tkG?wd>m{c
z#pco{o=UNL+ON$x*cOWQqS#XudxB!M{}n9JOCr_)e}`nr7q*ZGUK=CyBJ+j!Q{<8H
zeu6wR-nHbRjT!PsrV-;hJJ69IrXx?JBR3mo<U;z?O%ywyVvReo>IQZVM*eq<{D+}(
z-<i`#kSYAgne*q)CKCVDoSe+$YnM-+EE9F6?AdW1%F>*il+=r-E}SF(opE;W-g769
z;p^;0^m)he<MG#0vkFQ|ONvWMQ5&lba!0#P7O~LVD0d_z5bON$bLSE+T`J1U%*cj2
zKvvq7^XJr|S5EDQz?IZgzVG5mB6^)J?`Rjh`)oaw)7p|=Ab_Z`W5>_?k}_(`<MF?H
zzgNRwN4~z!4_@PrT0AL)9)X#1*3$X@UVd&?7HQ{xft>jHru{kHV%((cJ$2_ehoeXH
zdiq~^Wr_CauX}#qfAGlJ5`)z1-dAAo=NPqU4Pv7{xC?^&w~&Ru!n_zQB+NIGr)FCf
zo;~y`DJA`jbahDU*^`iB7w~25K4UgRQSu$@@xTH=p=rVEUkqoq)ZJB<v1iYoD}9)M
z=bj#cnZi=k)zH$}Qm^UscnFD29-T9D>HWd6LiZ`o6+|Gjw&>ZkDWOZYD16qG$sv=2
z%<EG2Y=S^$=Yt3)PjiVi+un$;PDbD|b!y-Qccx1k5-P`%Kya?<vM{&m$Nx499Q}N}
z$*j1VgIXXBBX>-HFKcEdV|ukd?zXu2O<b}($PBgUBrO%tSwaX!@QhBU^z~)s)+k<Q
zZ!VHsNp<Qu6DNcqLMbHBKWKtC+=d-&td!1nN*9m*l6te?Fn{Qu0|F*aoHEsSq7V7+
zz*(~=PMCzKs|h|JGL@Mb?0m2&iNq4IL~em^_|iA#97};EtN41`G|oXLQz*>ja)qUh
zP$HL0#UcZ8*~sNo4jQ;U4zCQiliU`0we@21$%cHJ$I+Y2$UDh&`R~><+_W?87<SSr
z?4--sNr!QRI*J=q%>3pi+@Q+R3w76WuAGg(l$?oh!mOnDgd{{-CnR1vpKv8B<MOVZ
z2hLwAC?ypvw3X$!K$VqOqlR;4X6kkO!5f#gcV|{<MM;BBjNmU%b8|~kdr@X#O-+ra
zy#l|BVn&TR1Gbn@A)Dc65$glZ!KXi-M2?+fI}fBmxNp{I`%qzn+_dtC+{HxXF19WL
zI=|<{Zf=%hskwT7V=uXT>1$goXRLl<o-M1njF7YKM@pr^%kIDLN>T+Q?JO&6PC0m@
znpKE8P`tuC<40V*_FpeD5E{@q47sayvsp)SYqeH($jHKZ3IzJL+MKJ&xG(m(-T&sB
zZ{8!g5@?->U3%cc-gEUrxUom!@|4rBG0gElio05UZnYU=U4qTpQW3azShOT0V%S~o
z`nG+MtPHBm3xel;1!{SDMj9?}scBV$DC9wVz_8Hpr1_SsU9+FW*BzZ#_N|S8<??X{
zcVGM3^Eu7s7k3`~Bk6LJCGkWLobr<K>Sq4vgpSj@@OAR0tKZw<%m(>W5zp3_7Zj8*
zRh%zwcZeJiI{5nf&M-d(#q052>uk|-q(FM*p6O3TI^n`oyah%H!J=ulv2Km|g($RB
zTCVquc!9t0nN<wA4$97d^jT+TV~bv<o}XLafUBQaWtk^6SU5S@i24zhBDAq%>U&&$
zrcP4o7@4`1-LyMHA*l4pFy{qLZMgaAyBaj;QY3PK!XTGi6%`h`)4!E6J)PS8QzuXj
z)=#f*ZIgKVD0TSiYK2o@V~<&TWd}Hd!0mwuM?~VtI?~UDGcl7M^8oEy1qNEd(+D@Z
zP7I*Ew6LgR*hO;k6Mw#(a^ZTlUM-i|+v3tV>7jR4hcicArp#ZwFmm2ZM7>PAbHRf7
zbLL0gIdkIVxsj0%zCkpN>n6XxXpWb25Z1Qa%MVvaR~K6+<Sp@;V7zM1eRzTEg~Ofp
ziYHdiwC-n?ae*35b6dZwHyL?X18PBcwDh?&wrRoGJL>CBXSRW($gC~z!bAt!PnhJ^
z1}#c&OAi^mrdiW7a0#7GDt*lV>l2F?PgL}125(!p?t20D8E%;Kc=L-O7|V^Hs`+}p
z0u=@{)_v2QVr3M&n_@jEcG(T=$lQ&uVyPoMt%`i>CEu1Ax!VKaGWUYZJOeIsAGplD
z;4*>f8F`?p+|=v;+L@G}oJ<PM=3m;e_j=NG@P*_n*Nck5bczZwBr6o^>Zr^nkr}mJ
zd3gy5oSjCKRUy*rH8tg^Op}&Y*;1ZerB?^G_n09h&8(}rpw-pi-F@RmH#dJ5O=)J8
z82>D+$V~hd+wotQkeHe?Q&=#XE~4ShT)$pz_wvh=h0GUU?5pT^zIXNN)hkr}g};8G
zRvo<pKaK2yYx}?Z=k{Gc|NQ>@Tej@l_Rr11{pZ12;`@S8IqPSXw<fQj1dlV(oJ66}
zY6NZ$u|i8lON&}$X4clFphd3Vn8@U;k2L(1yhNLe8K0NKnIF}GmKNQZhaRQPf=B22
zOq@7#W^l02{FUK0&R*D_KCU*xHbls2#7G8iArf`AGL~|%%k&F%b!s~ci|K(Pb8~@C
zAnOO=v~>&2mFDWe$u3qn;4GX&@4C~;+TGp5!_Cdc@2;ixPR?*)KoS(G)Y{q_(bAJS
zi}rT7GF73RjHp){6r>ilwOPvBIdh>{pznh6wyr_oXgk&k<w7Y&fEfju^<x6?hOjX5
zW{wWVqPEi%E27v!id9mq-8k4|6l<W^9E!E4Smztqk#EbVYXPSE4G~-$@zEEmj>1$l
zLiHO;8#F}q8+Pt!Y?yxI)*WZsSVlhK|5sSznKIVg7t{I6rt?=!=WiaJzsUa~Hi!0`
zGHl%z(0=c_(eKFXRy??F*@Np=Jh*Q22G=dpgmp7*EF-Vme;pfn^Bj!a?^HT}VRZg}
zqwCf{v28czZ)9u-#a2_Sj$)lCRzD85hGN?&wu@qo`%OCzww_|$D7KVhy=lK4H?X5=
zIcoVD&cX34v>d5?MFkrNqUCU(Jhqm@IAUkoYZ2|$kM`Pqqt}sV%9V~-NwFyuTS&15
z<6y5)tR=<DDAqu+{o`N@DAqV;WAO?d#V)u7J6y}5q*zKB5QLC-1ROwcjiO6$K@Zn*
z)KN4-9SF#eV$CTweH`pXip`<e5Q>#jto1n9T#8ju>~V^{K(RglL#%O?d}zN1Xus!a
zzkcKN+epXUNU?WPtZ^Sz-oV~xlzHA9D)Xdt>hdnZNfIeGlJa!g)a#dF`@EE#`bWam
zt5?q_q-LchB_*Y1AZ4dmBr4C+Xw+_bd0ll7e3G&&JK(XaugWfOt%AgpQ(Ru7fy9$m
zmb_#0u3aSO>E`Vz)#+D`z@&5JN~6{Z>6ILN8jDUtP&t{8u_BfGq?cb-yRBcJNusp7
zG>nA;63?%N{az12;<?wkzhd7PaIX9cb-E8i6YvwWi`m5{CNAWa2|qEvFbA05nRUvy
zU;G=s-gBth@zF;gZLf4#7!40^-p2xF!)VNgSfS`_Gc!{QTUr!Wv0?`|fktZ-fnN4u
zO1>Wuf!60R6W<^rke@W?Y(9LMNp_C5ywm9tnJO$S%u6A$^GD8^0DDOvMEWkotUHlu
znJ~k`LhV*pcOeaOkld1K?Su%VG#7NWLIUcSK^TGvB(1Br@N{rcDxI7>-Fh1(9zn1*
z1-SWygpjmep+24-@Br}iLJ|UTd%MC$t5uu(_=vTTgOKf8&O!vTbrjUsLImp43&g^k
zd^(2i9p0c^zXe`UG4Oiiw@)u62?vZ9n<*Hb7(F^xf+ki%4vqm$kP6U`Kn@NrC{0c_
zoi5;yAVJbxQ)nZ&BJkU9O{Wj$We$H#A`;=WM1$eKKq=vd)iA8CzHNdDsw!=7H=StU
ziy$$WMmWJP%83(ACmu$_Ni-%A5bs_0Cf1)+fZU7qe;w;j@+gPp8pIW;<)o@;X=a63
zn4gn^?S4Hw^Wu5D$N!O8kcazFF1afe<mTaSl=0i{v&4CP7v&Kh9o*!Egxp-7OI*#V
z)UYC<us*lExfHA<t+2eVN0_edhBC8TheUWt_Nz@tX5WUKeW=VB7`S)u_TTeb3)9d1
z{`>D|(pz<o$Vud&ZLPR~pA$-<xvW3FW5dRc>puH*15}sDBSi>g)hc!Hx^+Ak>Fz+u
zPG;S@-;4V_?*m&{>eyd(c%An|d%nY`pG4(?yC!;rt88SBFsJe0yTDrxf~zbdsgLo~
z9;ly=gMGw^UV~oot#Bqz?ozWoE-r3cmCG_>vIY~v>l4Wm%!YW$lXt=Yfc(QIY@%17
z?A%FSF}P{+L}YHRHZLsf>VaRkz^b>Iu$}G9cG2HFdoqv{^da&R#a`_RL_gaFNnc%!
zWwmY5NLutZlKJ8#`1q?Nby$D$;nap=QuVa7CgotF-rxi!rZX$B3BY@xouIoJ%F5PW
z{C8Dt4fL8#whjW4IY>#l6UGo+U(a(VnFZ6<DH4m#6oQ^k%)Lk<fHtdGDu>=eE=JZo
zq`Q_DqsNkRi4&L@$+}_NTCTVE^6>ERwDp`6iWQg=;^|EEQ;sA!kQFH>y0`?)4Vi$e
z9L^fTy)0W>)t;&#3D3Q%Su>_xtF?3xHa0=Wpoa#gU+dr06)TroRaIcjSvmejdo_``
zh-bG<1^vJ3MnxZ1x`nl4z|Cw4H^cj%2s^{O72#)W=S+C4^VB?=#MZQh*rnWgiR}O{
zv3WTWiOn!`Kw=vWX}^W|b<N?C_w&drPQ<ILZsvej*C?lIUr`cLp#GOnRg!W1e{iaT
zUjJ{Ms;9HtkSg`RcdE)8nr)EthvdTY^VB!XR1-m;K^}fnrXZcx)Tw@6D)>Ko`7mLW
zF5BAF=0QQy@lMs{phFV<^&Gh3a-()AAUT87zA4B^&MqlRyLjnJN?KZSegQN>1$oJ-
z*Djnrd;VHpK_>Gf$9ea)Rp(uY#`xTxjo&0(x|W)ekx|uBU08$YLoG7QPYv;~hzn?9
z?Vtj(W1F;^+(TRZCQS>FH`SbkHt1wclPqBBB)?w{<+k@As>e?zgMV3{o@jAP70aHF
zoJ*vmr=~~?eqFzQ{lTjV-yiMuSIN|Nu6-q7!zF#L^IrO3&0l~0{bHq=*JIIOWheO8
zPZp1PDay|8-u~k1HGi4QL~uy{2I+-0#7dg4Z~uJlM@Y!|9x3I5q8GonOPp6m^ER2U
zz|%O%d+)vV=V|sLb%3U>4AW3nrzy^EunzLF?X0ZOl#?{yWfhvrYQ3{>pmjrTDdbkp
zySGQj5<$tvv-|Mo91<$oQd6(9AcbdowEoX65$09I1=zcxz>Ct^&E8z0bn~{ex3#fx
zRG7mn%iP@2*3sS5&EL<})|#2kN%Z=j-hPod)>UF@@8D+D-+}f@D)bI6(0ZB)G&PNl
z?cI7KCwagq*Sv%keAp=0Ox%{0wZr69{LrLToM<KAcf{nCj0v1PnK5xSot`YrU3t4J
zs{VJDbYfUZ$xM@%HHJ-3k2Ps&1<(Cq7S8-;`U<N}Tw<QrzlIe?cp8pzA@e3y_zg%d
zvyug~A6mNfu6yrYF)tj(n~Nr{_DarbuSX+N_-15hXTZI#qWv4wHnGqyzi8hQ9MsPl
zv-&-cv}CWq1N=e5Ujnw6NEhLTXSf+FpS8zv+{Zls3=AyG?^$Ldm548Q_(lBvy~U^}
zu><y=AF$asAy3yP<`etBjz>J^!`K1xm~w)D$%IJA-4|_m4I!X!k(Ye^-p~IHHZjZj
znHT>2%(E~2`Ogo(`nPxAd@9I9`dY#<JCTju;sml+9ooPD5DG`^TX)zrRx(SFwPnNB
zOC8N!ovqoeT@r5-SxXbg=)zI`=xnT#71q@tLsa5P2h*4hPl*E>o8j7zDx3tkYk7cy
ze;5;PcrFGE7eBkw8@(6|Z7gl5ilUV~T2M~0?G)=Y4z`kFD=9XCVuLC6o>8%4?4KAx
zE5%Nr*b5ZPYrtbiMUpI0B*2z`-f?;z@bFMz*UGSK;UdJK)+>2jcyf4<=Uq!?i+^PN
ziz|6%yo<?08+|-Rw)Xr;%sYGtYy|nl7aW~!wD#OSVnC`JW*<t+;LDt(r|#NuDLW}C
zJ|3x9FYVZqdMy>lZpzivk`hP*#YNDSz%DXiAF6|WNKLFm<wLAPRjt%I)Y8pchq{~d
z+uV@8aN|ZNCx2H>ab}go&CN|zk$Ht!hjtCO4zWh-&?I(<b?6~4Y8^U4twYKCH~e$k
z&YymI|NS3+*!j!1n<g9nfD$I5fAUk&%od|{=x4zb5TggJLskRUq0W)4L*JJSScj}F
zdFzms&BDjR113)n3xo1v-pWWDXCi8OyV?kdb*LQyJVUKRX-4bNj0r=mL#<uZIut^!
zLr$Sf?sRqZ@bLFnsT?OPTW0I%h)af(ldV_+>yT6mt;G=QkXG#Dqei7c8^sXoP;LDU
z>ySc4Gj`mf8OfxYk#MRR$)%c+XQ^hyZBR4vI?k8ZalU*GO1*J2zLo-mJFa~PfBNNe
zVq!wF=@j8kk~OxpuzUmusUKt-g@m1MhRtoumMxpV{Awd=|NLq?#aNL<k54@{STktQ
zz&I8Oi6&IRU?0iEk(cnrKRt;+=Z~3>y<ZN$ZQ61mX(By62P+2Mutb_jYhl4eNrpS_
z!j%tA2@Rb&(RA8#CrKu)tOkn*4O%M4qQx+U6f}ps?vxo(lT@lH4yMzlJ4sO4);3r@
zXwZ^59<9D<q_t0swDu~vVi@iZmoHpA86SUc(}vw}X))b8?Rm3$Wsug!wpNGX!ApPt
z{_`)t{FICN90@{Aw_aP_tYI0Xwz16Fp~&Z4pqlv<{5)1Hcmm0lZ`-^*g3?3|rO6Fa
zGtuZB1~t=^>C@(gh28PQ)Ayk2o#{q!_bpehLTJ2t`BEYjT!~k<43gSdM)5EZnpEL1
zMWvb)H6s)=Z@Q6OK-4FWgX)t(N*m8+PV~K`;_+WWX*cw}7c(;AP3L6rLNoPz3oe>G
zd86qZi-j@Zh7-hCJj&O4!Gia1n;k`vo9*o%c)`>B{liRWJg8@5>cJQ6W@hGZI)h;~
z8WRsdstx-ZYyAt>dOz0sYsgw(fve0<x`ujb<OsWxbd_+JD~XBFPh_R0T)&oxLOO}#
z(SdAG$l;t>1C$bs0g+(_ngop%Bd0%<eEn(@B_Nwdy9r?NIN&ZdS|e#~U)EXp(EZsk
zeVY8<-D$~%SI?X|bKP_b63Jw>7cWE@mKc_p=O&;G!1;1TNT7H3#&E+Twqt#S!PfAO
z<n-y&spajmK?XGzsficbU4!UkJP*yEzAqd>JCi4dPSjuc9&)PaT4tAObre*_<n^iQ
zwuzGS)w(=<{d&JgL_~zAqOYPbJN4M6^gCwwA}UGI)5_f7V<sM%^Ct%f(law;@+893
zLPA4>1O0pggC+!r!iOw$JW7@g%5R*rffd31k%h+^%jmJJh(&_>7K$hVS>OTJpRo?q
z`ED*miUWIdcXNfl%M;E&E)KTV4vtPP9$sEv9^=u!Y*6|edpv_oaE#-Y?hFzwFTu_r
z@e4%HEK`vT<O1AcY9YLT7y*CB$G8aC1$J@xx7kEC#JeRC4sYn0iJn@a8m^}<G3u!U
zsGb@`$J@Mtjp8-cj^k>oHN2+Uk=Hku@cQOiyr$ar7ESfdndDq~P4x_dBp%p2wuIMJ
z_ubG{58PCT%ETmrHJ&*JH!djGiJKm8rJqU#V&$-B9+<PCF&`CMNUqJ~c-D(y^P-Xc
zh<(V3MXt@~W)9@ql!FfuAEkl&F{ynL!){^14RX?9Jo6#mpokAgbyxiC#E_&(>`dd&
zBon|JXn|O%zQlU{1)S_fv>-llg5%Dei-4u%ZFbu>;*R=4z<AtifO%nMIL<LWDJdc0
zLTgVCGbkX9bzKvemI{SgSqqRq;7L*om_(umn#!CYQ3?0H^ZM(YaOKBeei>`hIVXPe
z&GPcU|9t^d%9OI7v!5fGQ1NZC81@OwVmcSYJQj%x$A2^YjbqkD;!5)^^KHy+-~70#
z_uV&p_R5v^_V?X49v2y4B0d}^fSrl6={JLWpJ^;(x{uHD<@WaX-fM0B$Rp#ihXL+@
zbRR<RF2wcPRLVpm#w2FI?`4t;gv6W-Xe5x=pNV0%Kp_M@gq-Le;@5#f*Tx8<J$RDD
zzc@Vv8eJR1%nWC~jv-`g)J$wdTi>Itc+ly0pwsneYyQ#Sj$BO2LW-^Y>nYHj!@(3^
z1<2Qkx2*K^s|g8XAG&5kGz-T$H>EkL&n&mGbhC$VfaoeJs-8dJD-yy+pb*6>k+IM;
zVz&Ey?dCs<4Q{xzw_ms<5<T@)ef`0Mk<eehZ1~5t^^nVtWTBjkt*fa7jv7O*mHXg<
ze!5NXzXVm|8{dEJHG|>L70tv=L@bVFr83jVUh?|0b1k~EHbo+?952PE8E$@liHUE%
z`OZ6hol_WXzn_3|V^NCs#2+_oxy>^-j1#C9Ah?)Bm46|7@7`dui^zQ78EJTeB)x<9
z7H)V#T3()UsZ^osiIrQrt8V)Y4qtF*=wu(9bRH9eU=?+8f@_D$-QCR{Z$AEr01llz
z<_0nwqDE=tI2Ur@b~m?IHjun!-4MW8R-*6gX>ae+$0||y-n4x+f6jur0Zul~P$*3F
zwGj%FlDxfLTr4duP>#^S!^_FWJ6JX5b~78Ii*e!<tzD?%Ana*uD5{UO2x`@!7!DHh
zi?q$nTD7vj2ld(pJbA}BkZ<h4Tcdt66LB!bu-T337-4uWPA86Oz{lK9oKPGSg^$mA
z<CLOqv2LL_sZc+Bi2dgQ?8HA~C*F^p$miNPdoc^!uQ=m!VQCt?oZ{mXl9Ml<zkEFd
z5^?%vR8zWk<wE?W3un<S=iA>|Ta<Pq>Z7Knu^uHCXmkieqeH?1EaQSYM8t~cB-Q9U
zEAjuwkGnng*i5me>KIb`e!DGM<9tU%`0*3z%_u?4`N}ON2&@_i#z;@^vb$#>bmIyQ
z-AHH@#W^apWl$(qG4^vFeRAc>mAScw@4h?S>>Ry-S!=8iwVP3!&9m-FIk4-om5cqE
zP-4pK>yt=DvF<cB!q<1Q=%_J_LiPX&qquuoh^M(oZPwTVucp%CI&E!LTbz>?&i#Gb
zh8n~#H1{!0*_9GYH^<&;rjiSg$@;tWtRD6|8oQv=3Hmz+;v6(I&S9QCs*MEsOjN;y
zXYcAJ(3yk6Crt2lclQbK@g&aOPF@p({k(hwgF^y5$v9Ez8QJ&xW8G<J0kS}9+KeFx
zO(Y9&M?-yccb|T&cmkum(u*mDxR8TZ@g~EN@n+5cL}Z4C!HdaFm)LNL1#l&J@gzKX
z>1|NKhbB_NB>gIzop!#{XV0D;=5Gtej3>&?z4QI|SNPeAa}MI`k0#qY9(n4?+`M*6
zQW(fYN)SB1zayO4`R@<}u>_h%5msbUj8suS9#yDKCyPn5XP1}X25AuM-+xRSo>Z3g
zrL?h!(#ADP8?85JV`MqlgJK;hHlJcUDAsEnY&pf&Q|w8KolLP0jf1tL*ku&^7{#8Z
z*v=8Lhy{d14LJqEGcUV4QS5Q@+p!cGG$K-Z1KCWGp%i(V_G&}1@^P?VQ0yZVyM$t=
zQLNuM*#BgvW)7RFPiVgdv|q_M{gzPdBs%6}6x%?tD{sLL+*PFfEZ0!1KaV9frzqN)
zqAhMgOTlvnXWEvcm(rderPwnR+x1_;j^@2oz~9X(>RH^)4uz7t*^El|GQ&O|I&e1|
z4GH(r0EX4ov+!}Z4JDEMmX)OTf+2LE_QEhro@&67S3?LA60$#`NMgx*N<fHmEw0x>
z*0~Zwx&<Ljqr5y??+yGdcoN_H3BGsxO5(3&9*S!sFENa~gOlk@d()Y&q%++@XWDky
zOy8Olq?KS}Dbk4|jc1B>81mL=n*!Qv1;rks*cr6f$NzuAPQ7`|BS*cIH{gM3v{F6U
zPBdES<Ow_~jaHg$kA|pN_K-RMuhC;gA#Wk}+IsRWlzgi+ei~z){}V26n)EP~zHX1(
zu7KP@B+tjd16F|B@{(tH!Brw|Udy`>Pw#-m8So~{OHYQ+$@RR-iu}x+!qWW0GE8g$
zR1(SgRU~7SnVWSR+{+5G^C}^Cl~-u85$l|oc<%VgPd6V<PzQBYXT$E0UeVp$DS-$-
zb?WsmzdT&sEuQu;z81N6rytn8d+HP?9a$saZcQ&MfPm!?=+b%N!sN+{#)F@K{`tZF
zS-H(&Nb2;bxev^<L%wDIus=cMTpHrqnMJJH4?jF50^TH>EZ>iGY}^fja_w*Jo?%b@
z169?<nK`uzEE$e%p|H0{AM0-C?`Ne_6&9xVEkWVT#nP4u-FstWW4}3+oL1JMR|oZU
z>2YI~=o|C~4ZJKWD;qSLhUx|_?@V7)*=@-bWhY**H-H2J5aX{9F(L%Qw&mu+cV8^-
zXU%MEZ0uy6mTu<o<?XNBo6v}waX}VhC4^2l2fL6Nz7Rtt5_4Ny3%P}jBauF>#3FMm
zbD0Ri_++Res53=kL9Ba2c6z0il~^pq|C*ay3##qxNHGX=#O2F{B1)|ju#y2-$!S>0
z0IZ}x!!lCHN>>ga|NcW1+?MY>@bjTRFiE(Y#8}p4#-BWSG9|aPASETGzB|rl-n@C<
z`qtF_`!iEh3ku-R!koshd0827hm$MbSpy%wm3PINV+C`x-XW{jy#CVTe<j(@_L5f&
z^EekH`0Q|PEZf%~jZ&uXQpY@Y^B-|G7(;b!X<M(TG{3znk2w000a(}}Dpl0o)mRU|
zIISVhhPc&Dn7L%x@`oRJ>aLl%r7+XcrlXU2tV}4VuR|z%`XL%gIUP?*GHpiUNkj0Y
z)9|EbJ9g-Fs4j6~-=PiQ<Ev%=+PnGpvxxIxNN!l$1nAC~o1d94J|gStBI57Cod^+s
z-tfHW)3s~A`6iMmpA3IPL(g(C?5b7VEfW#Jd<Zp*6w_H`2%PbHINU<sdG*;hqM-DH
ze>QV4hIxsLi6AaX+$i(nAeZAh(bp#w_gOl6^>teby5MQZSfN8`pl+ET%U53&i)YN3
zG4D^0zVh1YzoU-fTJhf=oj-p*v^<{y)7Z$}JX!SYnTpv8!EDVn&KA_4jM?tp<Z?Iy
zZN!c;R}KdcHaEjr)x0|Y<mSz1PoBJZk@&MC+3twbqkQ}AdGoOOQ`%eto_+nLr&l}|
z1vM31$(ilY?u|DyNM+G{E7i1*GBXZKmwI^IN<GhyJSjY%4#k|@fjL=#ISB;?g<wt`
zP>tl$fg`&&uHV1!xBc;Og4OBNYGxl7V@nC=Y(hpFzgZaQVUyGrV0q;ijvqU4@Z7Q8
z+qOlb7$IJ4S64*;=Kjqwq-KMXZl9ixmtW<#53`D6R;gvsq?ND}<~)Un_%D%r^KBSp
zzNW<rp~Y`vnqrvM1G`D5jfPI?4Z52IoBseczlDg8x6}>@hu7qvO-Rc;dMy5r3}krF
z=_XEO&Y@EjF~rU?=o*@_v$_nZ_Xxh@Kmzjbe&mT4|91bQFRel`lDT4WKme%#%u|g*
zEJXoqvc;H2j)4k;+)2qSO~))n4V@)QHNSno@zB8oJUhwASi2UvaYvaY8_<khSAAVY
zWm{cQRu*Wcwl<>wTK}~e=Im$_WKIcZ;=Rv&@YY`j35N|2N5vebD291%{OQ3kbI)!2
z*U=N-|FC`6aWI|cW~GwZKI-&P`nhxA($KJlJomA-e&``4V3g?@OR6(4u^g`UGq5-C
zmIP|YTMIIC<E@{09&coBiIsuWR3J8)8?rZh3G4eZeuMoCAKvFaBxW9@hG%^+4qKXq
zc^>l!G4GHzhRUO2P_Y<P4B~i?ixbo{oAJGed7X<xu>kVzPh8xsqaLgdUrfy@^TG8o
zP969;-#J?z&(`7MW&>ty>~+9CGVIoXbfBc;4~6wJ(DR4Fo+Nb5Kev#)^`raY&pm*q
z)|FnM|Bl~aS$uewAacP!@n#Nwh=2CsnH+6_cuEaec7|EQ*b4x^NbF&c8SchTI?YZa
z_OKvE#M{FjM?y~80`Zl48*@*h$Oe3+W@Y84rc|*#eVVL1xJ8ge3h60`h~V=pY`c_m
z`7(;lo=dzXxx!D}428mO&hxUCc4!wJY%?;Bo`vqbx~?#tq+6)dq^2e$xLYd}85y|<
zKguS#7V2}8k}}k@igebF?#GVjG!zl{xd8X(y!K8x&OJqEb78Bax1-~R4I2(;XO;``
zZ=%Y~%e#nk-DPYW&Rx@@-~Z)@_&G_pbg5+>#4SAvCUrw3Al@sSP;4$^B9OZDee>_r
zI_#E%`K)m5NZkyYQj47RSC3zfK<1*417BO{sDZV3^Ty9M9K8r<Vm?p9x*f>V02SO{
zBS%Zpu#n>%ET^pqo_z0Xuf4X&UZW|ffRNBw+v{Y^+Q2Cm&30zitXb*VmA=jxttj4{
z*X4Ns8ucu3c~O1w#Y@MM#da`F`^<Y{p(V+0S*o?RiT-n>|CA|EOU+Q(xcNZw>+NDA
zYA61ABF2UD6pNi)Max&tfC!`%Pnz^VB&0}TuS_X}f-~)Mdpl>Vv$7VuyE|BzTNp?>
z2fewIr@MMqfSK!5S0`@=+aL!=M@OIO_uf6(gNPd>!NXh^8&_BKG<D`J*&U{1qUAm5
zdKXvZ?PbhDLl?~lGn)}=*U|+3+Q|k6a<<|=JrfmmN07=|XfPN$8P%M{QAVBaI#AgU
zpt3!nvVUTCev92XA0+Wd{Q0A&PoG-<?M_hC?NXi8nA77YZvM?)Q@2ZoVj~^OL43t~
zH+}l~=O0HP=j{h`J_X(V+q8MBW7U5`tdcETwiJ1XJrjYw8e{g_!;9c~^}&CGfJbn{
zBC%`#0bS3B-`|X|S&?_%Iro|8VR)Q<yL2wSLFgejduaWegg+lEYoT<T<?lc3t~oP7
z<hQ*MjCoF`bG!@JkO;W{XlKa4!HErXARptPKSK_461;jU<af50VJ}3nB8I)gjV))u
z$0zVd0Xg@E-ga-Coq|f{CvsvmgF)ggi&;qCCV+3??QU{>@n`19*aV7oqu30J)l;nJ
zIM`N-oldbi6l+Pb2Gg)BD3+yI3B|JGVE>cnRnalK(0)5<zpb=i$8q{~pxEUU`!>ZM
zr`U!Y*yZ4UcVmr7L=%ZgyBplkKf9>1y1KfexF9P%Ed}9e1%)}ekh=4-a;|4(WtWvD
zCnsM|XAZ-f)!)}vmVW8Ng$tK(7$;qW+Tm(?X-hXTy;P7m_p1Lx-G9JEb)|p6__@<(
zXhZJ;B8UhUL?u>0Y_Z0)O>+}dcg-f7wq~>0&D<Fh-I#0=HHnES#;9p(j4{R-D=G@2
zD7{JVedr7@^M21gGbqRi{C5AJ|NC+irpR;8x#xM#bDsXRA!sYOwNLHs?QPfF(bt%r
z{_tZfyxKCp2lM(qt;PTDyQ8YA;3q3=B<(yekxJnO(|Xp|Nu^FpkS2SVm#Oj~N-|%^
zt~hzp)ln92YiB5g|E$`^b?p2V3ut`C-^AZE_{@ug7wf2SX+@Eaxk3Pka#Kggop;_j
zYYcJbd0XU&%4OjGy{*;Nr{bXUEfubpM2X^g3lPTkE4>tRaK1k9fS&^wA8hPwhN!LY
z>=8+23N(xAF&Jr~_a0N96h6t04p<QsB20T6tOz}51dqd&L->QtK#w#D+Ki!UnV2&g
zWinzgN_8kl21|pYr=z>8qf<sWq{#L_H!;bjFhi)?+p%cqdS(m9EPP@rIfj6wB9_}B
zO5I&;YN&2*Ztjxt5)}I~^qFPESAe~jfW2+N-YdW!&9k1lC#}I{LdXO=lnLxLsBMZ<
zM~Y7S<dsW9P^I7A$=MN8zbl#?3rZdtif20bgiVwcUp{f_)bT@yj$ivZePlS#=Iy29
z9J2TC-+$<cueYbCCt@EyBhrx&f^VJNPARt^w{rdZM;1(5weHRZ|0l|LoL5vQ6&s+K
z89U;Ta`if^C@=cDuzK_)Gjqzc@lFZ{doR@In>}};Dnv0d8uI1sRps?|s0caE-!A}V
z)|#SC&jzVRMpx?JKHs9<di>k(cI@~rr>Z!oxpQQcCgRoN#Or-<xw`tc>LHt6-XR_Z
z?NNJ01ZZy=XfFb^7XjMyV9Cj65>6gJ@;l-_VTH;_%goLqdw7zfQ(U`t9)cBOM0wfe
zOz?`VY@G*7KK=zl*6DLeNlB|$uXb-M_;nZ2^JKM7;pa!Y;2P~hc-hRA;0I5x(V^*#
zkXU>t2<0;*$nQWR>25f%51_z5E-9Fabkd3#5>NJO$OaxAc0_u8rdFhH6!F}N_ZC3w
zpw|X+K<B}dhD}D1L<POP2Rp33v96{TZ3ak(PNCP+J}HLoE?(B&fZbVNr-SWJtsXnp
z(R<R2*+CFDF*%u?t)mC==1H?oQD0A6s@d2pP=}!n*2IR|+j*SZuq-(A-0`e<;W1gf
z*kW+JNN~p+demU=fKZF0ZjVrlBb9;IF>qG~KAVCwJ(9*|uLYi71)gYZHuYGCUAc^E
za%r80DqskW0xns>TTxMNE+(m>T|taOjtPgl2omK0T&m2tOv}ql(}hGXx&PjKA9!rt
z{lFxS1d$c|W@pDBEBGH8OkTMA_D?_i?6aRzc`^Eg48Xg}jQ2@tX_Is|Q@rX^Qwuxf
zO~CR(p|Zk3FuoBJgtVyW>8G(!D)a^6UVm-Fh7EsO$BWS?#2S%E4&;s>pQ{UNX{~8$
zYD`MZ1&M$p+N}^yNl8@|5TK&nKt$&5AYya}89+=bGch4?OQH*NQ8b!NE!XQBKuS1J
zU|t@Qz~u5r9sy2ONZB@phN0xmtSDZL79j(OPGu%K;m!>E_W=7e=lpeGe+}kz7qA}!
zEp9-G4T}BT9AVcU2Q~EX+P%Dbu=bL|s}d51*vHVg2A0sEc>nHOVPBsI9rW+(7IZcl
zR5fD&zWevN6r2KeFqREf2csY3+pzs_uz(*KMGRyCuku4E5n?D2)^HBSKv!r$%?pa}
zs%n8zpf|OlpHbxT>cL9D09^Moju7av18Q1OJWpVZWE}9`&q%zO46nM8hA{xe1Nq9!
zz%I=u`wG~#SV*D<@9mLed%!+-#y%e@_M-;x`jJz^fZgwm-9Iww7{Cc)8Qx{D{Le^c
z0E3W%LEKtHWf&5Q8q6|APErHdhcnp6$Ve<|Fe@23$qisDQm_@82{bGT-rz8In>oxq
z;4mm`LPD=nD^*q&nx*98g%&Kil$dbh$O)<?T)uksS_W+Es05arg66io%4Fg$rwj5x
ziq0)L`2^5-;bJn^+XIQ(U@#^m7~4DJLyOB~NI?jKyYfevr)kNOPd@qai_bqtOz9U}
z_GC!?V1L`Xb?a{><aZw3?!_Y0%%zBfdwk96H;GYe)1wM8H6BCw+_k`HUOZ*G56TfQ
zlBZ*=i+v$?E+9I}R0PRlnb0z5EBS!zf`qY?d=2?Rxa9v>xoEx=>@g1QXupHZae{oJ
zAum90Q9HDsc(-4);0}Pd6cjXQCC!bZ_7w|JO@LMR`3V)o!gx_wlz)6^NRS)$y$#fb
zMwq>Y;w5^8_c(tT%iR1zLMFmaF=h7b*|VmC?ei**GqtxsTWGB7(Aig2bz)`udb>;#
zRN9d6M8u1n92D`P{=VL@CHVOIdLY3S3<gC@CQX_$b1K#?I1qKfeDG~h(72#+s3~sS
zi$-=Pxe1)7r$?c4l*t@%FPU7yZYq<Bcrm)Um}BN5&C*`<&C*_K>iP4jspVx=HO+W{
zVx%djrKes=g~Z_2fz-l;egP^Wp<jSnwJIrT)v7tmBBw=!gG+q%)mM3aF0)oqdGDZ3
zQBu+aXR@d@hnFQCg5I}dzmB_hErtqqs{H)ag2wbKNG-Y;OZL!9_Ttje)@xMA3)P7n
z9744s2S+2%EqGyp8Dsw@YjhrZeNT^GUvND)`zkdQ!%W%Opl{JrAy1`KKt-cP&*c!=
zY@A`SbaB;rh{ZNG-Q8$VT2a(N9S)wJuJ#TpF%Uu2I)#f1I#l<zw?Hi9>>xcmyP7SD
zcVUh0!%m>O^eXIxmDma6Yidj;saQo%4THMd(AP)nBUiO_wc`wFu5YNV0rHEAs6!}F
zucslPkT<baPMkP(=IqH|(P{1IsiZ6B)x)C3yE{1%bx%iIGoGW)9(CbqC}n+4(ylnu
zKT$72xKy8?&M`v$d*>Y}>6(C&609j*)O#L8UF&C_`4gelmK6c9_n6oC;9H;+--+}6
zz1>hD#nox-7*{1PR?mL)pNrum%_ptq>lFD&@@kBqpI;2=CB2$xat{6u2ZwO21nYkA
zorSFAFZ<0Id$m%PyyW0b*x=TLzBS&?uCr6$THk^-?5*rGbaeIf82TI}MvkIErL?sJ
z65QQMCnoOTKp1X%2^_G!y->38S;}>{nNg*BYkX6asjWCaqn`d@=+ec3BB|76R>YJb
z4`9aL2L3hFzks{Kk=Hn(OBF+0TRkm1-QF&eXl)wHyZp>(RGZ_6o&_GM-(f58_$=_a
z9(ar_t3(0sk)X2Z;xE4y78T_emXkAl1kKML30^sK2DeDA)OmfI2SdRqu>1~uDbQTy
z@tZbnd}jwr?+4K&?cveRt1M~Ubl7OJ&*^Dw$<YwPGD--zD#>M1M0z+Cry`vsoBR&q
zxXR0DruOLQgI8Jdx_jDNbdk<#RN)y3y|{<R%=K`0_x5mtK_-Z0X%9y{ICumZ9g=!?
zr!Ml}3Gl;?gqS#)(MHzYElK+TmI^m}dsFGKl*Ow&#-kwPSbvk$#-8bfRx1gNP_MHJ
z-?B&OSYN>O!Yrm2j$wM?y*Kp2|DVAd+4y7G_&IER5gT8AWBi-FqBm!LweF!+)u!n=
z#0ZvbpfQ4W`5dD3dc7@CdRAwyU?bPFkz3iwU2J5B;YU8ZhvuAl>N$VH<!|7Sq1czt
zog&;AZ*C5gbu4qfB};A(t><<ZopTHX31Qa1<kO07mEM+$Zc=a+8XqVHSLycx<EV`1
zF<t!HK!4@aU*7!fDv_J}-1^fVjv7%Rd5)P2gip}z%vJ+xKc}4`=}f8jSmn=&MYJ4h
zan=!%z!NEzpKyzf<RUewJf|f{Lqo_9{YFZwiQ-NhH5LyzwLc7qUFD9zhx;rYIhkz3
z3-=s}CIvS>i$ciin`ScDexVV`!KDCA2gFM^dkO>lq#W=Rx5642Y&-kwHU`_tKFNlG
zH8I#`_SdrpjH~a5wZZD$nmN)(d)V+~JW@pb>u>`Wp;&kaZX!e|!htP(dkKHQwc=(x
zna1|Ig>I-PMG0(B>n}nExb7p|c*4~sgKoGxo&&8zK1}8{<dTkS4M9jOqdF_IsTF2p
zqO(y6<Dy-HxX>WX#sP07?!vbmosGXR8~yF9QIpupxBv(kxy)APB>Pm|zcNGnWx^S(
zjQw>lgRNwrJcohRGuS-#*98pLOx>%7femD^a~SNu80-P|sbLt{R0gYHf1Sr*TiB<7
zVPMUBa0UD8RScH)O2*2i^ut<WnFscrLSmKBZ)yd7M#MC)qFWfRrzPxj3f;tJNo45N
z{%=-n;eZwUfzA9fo4K)n=0lI$$Y6chU*|H|>+I8-VPFdwtP}fd8G|ihpKSVJtx!7M
z@GLUepAK%`cSX1fiwu^?g>MUV8dMF&&HDQo+`RAT8KYzw*_`2sP`OjscSUsHaq?uG
zG1z?}*nM$kdEO6PU<^3lc<kCSfF46QVviiE%)&NBX=zVmNeSj9Nk}-J*9lFpx%qmQ
z&VKT@-+uG`#b%MHwQKTZh(NsPKvJVtvT4(%FAwNQQmmk4?oquQBFe}pDM(79&maor
z+O)A492a+QgwDRG7X4*XjusZ4PlIZJ2NuNzE431+B7vbgdq*!X?<w=9*xNg*934q0
z{nuHZS_xFU$R*~P4}NY7zo|V!Pc^5jTrJ^@&rz=9o{R)_&Oa2t1#Uky25OCXQVlW2
zYs5|=cq$F4#am-BX0IXR@YY>~X=;cFZ~dYEv$um|pKd<oho8yNG&u6p@78l;WM>Xt
z0UGgTLwPl&8DL!_?mKc=IPo@WB>u@Qh@IL9Ui;ii;nc%-5?C^};X4TzGJ&iypPVkZ
zlMC+Ti90#qPWB)(89jsPPy3JU3y|-<2mjwIX}^+irJWafDm@p#FR8=-?@6|xd&(AG
zRFGS+06~XG@c;X0_ilO!(W(zYY>-vAR7-j#^%9$QuH6RpN4!)Kfe~|vNsB7b43|T%
zAVnqE6h$LmC<^gH(T5j`I_7n7@F!#)=Kd(=?&2>Z-axBFOnhNiDJ{-At$_>?gW`m5
zNOtVpxpT`h=$<bd(~N0I2VZS+6RzcWvVVy1uM17%glnSd4$~@b=gt_Dm&r>LZ6ZAH
z)KQU_co-#^$Bqp&6rO}}W>-oK8bi$!A3K|`-xNcN$@kKiA78ibu{Z7~2e^8!o)nNq
z;c6f?cz+E>7+l;I;o8dmoeLK}Z{jv-qPcy%cXf3g)I1vEjYxTYml66+Cmgq{qrH2p
zH!9?u6tTR(hP(*P?F)-*Pj6HyrNEIyEJZyEB~(##^0HNX`16Fji6`F@5h&^t;_|rd
zAQEDU2Rw}lP*2WjwzU4d*&{PFUd)X(OBr6wa@`n)msS0E`QO8ij2?y_cVw_C?1P(g
z;lXYZCt}`EIQfMAgiLtzcB0?V-Go<RGnv;N1W7_bkrALsf9xhd+(n(0m5`c}nobRj
zc{x`v!I~(m&B#bdC@G2O%JSmHUwySj7GwI8=|!1_3cQl@F{Wosf6yTGQ#57QE}rvs
zkLMPa#V;ZoaeZOBLVhMKWE;vBGcV(>h-j)I2oe^8dAV0!;kl%wc<$pF@#@-I<Dp;l
z4OD2pay92V3^*dUurQwU^NZ(vgX1AVk9BtQbf==Uy^Dt@3Fk#ddwZVigYUkN?Xd-T
zq9u5uC-6kkc%pfDB7az@2Ki<NKcVMftGxM%NkRfoAKH1a@!k3&I1M(o-@GVh2h8dr
z9WcYL*APw@8o7m-=$n_3KJFk#%iv{o8f^W(d6{X3@F2I!Ez3@A*|s;_DTA>f1r{u4
zg+(vZf{?%t^FSwfi3IwQ!*z=O3ODmd70A&7Wr=MPMEaH=xOt%N0tQ-0L20>80Mqa$
zfHU4~6@C(fS1@=ZgD+?B?l<7Ao$x(BP|3zY%i(O#{2P^Qq^GF%EDpD5&(<IVf1o;S
zxB$69fZTtIYOoFA77cbBRw@+q8g}yz%*?DQC@O$4KQr?hl8>-(qMXJ?URhE?Ex-vy
z)d@OLNl7z8T1B2}QH<$9(}P@bF^aKDPI!glAw^f$t_9iF#B;y<#*3Poa-zw%qO<X(
zF>vS~;I3YcCZ{CM?-tM<NZ#f)Z|1p~Gvm2GCC95XGtbzmu0TS{%+xnkmC_xEoxpSE
zy{~q4wefOyar5<cb@lUfb)h>@gy2&|)x;Aq+kt_2q7m>E<)9t*|5~=fXv-3_ZtH(T
zf{{`$3{L)yQtCRvsj^Wp2OtfcyZD?|N*xgNODXjlKnUJ=I|-tYNe~m+*<{wgOW7x<
zep!C#6N4(P*a`ORuZ>LlaATjw3<KN4U`_0=e`K&y_DR|gOY^HJmEHj=4Fy*X1y^;=
zyADPJPt>V>2jHbh%{Q-xn3`vKC1*CiN|YO2Pd0;n!oRfR{r5lp{PP_@n3oHGS&_;s
zE%s9UrDVAro`~gwK))CL8(u(pq#c4^=p9H-@Fa;ZUc?l|)CS5cEmqC$mW{5JWta@i
z{=~%zHhg`BdGW>6YRM}tHp$-3jjj?7{0)MA*yMTRy}iTmR=|#!)`aAhH)=vMOHB}-
ze6_!X+y}e|<H?u%bIwkL#*vA@nqY5`;vL>QrC%>DDZZYaf!vwv`T2SI>DRBo^@DaA
zyj&zvD8*6<r-LAKmsg*{H#9UfP+FXNWG~8|q4>R|BIhV%y3B6;vxI(wzgx`P!@a+J
z&IDg2{0tKH*zg!~mYlV5pZ}M?{N=$pA#w!TZ^Q}Lqj0UsC@3hX_gk|NA!~W04Yp!j
zHV6)!dDne^eDbL$m&}hPJ@h+~w>O30<*0IS{M^~A^;$0P%NU513somhe7P5XzFjA;
zRJ`rfR8d+|S|Oy+R8&<}S2b1CI)Lq*J)4+#F5%>fvu6^{Cu)f*z&$7cF<IV@hGTJv
zJ9!!+0WK$mncLXdyLo$g`*{Wg1i<YO%=<u4JaHx|{qm_(r!MDbo=r-+kZ|F`h2%@g
z=Mi_vR(c^;`T@|`{h+ahSm}kJv7nqh+DZdNmYtJ}Cq~#)R$gIAS>g49yezD=;0FZ-
z->$yhW~WBCFh+kD8=VolXv#kQQ4C7R%uw6hy)QkrkWT8VnIuP3m2RW-nHh~B*9B&B
zjaR?C4mexAV$F&%l_xefc6h`tLTw>r?cmyXgL-+N+t!iW6jWVV%80q9x(YF)2%f5~
zEG@cTT2@|Ji{MGYvxyygyBceogWOyk8J)YkxdKa`2!e4@+u5icom@OX8-gnn`}?*x
z5wur&woysbVxN_p^?m!(oIMgP)|uvUD`BDih`WcoKsdu`t__HT7)h#!JC%<Jr@Gl#
zWM*6CjP<xv*2CZj%Mx<jT+6stJ^SN1lxtBVADE!2pJ&lX>mhSxM4c3xQovKllu1X?
zEyxy13XWHKKfJXwy+^Qf1PFGH>w=v_O6?q+D8wQS&^lGr(rFJ$wgDyEV8$A8&o~UL
z;oRoIb{H@Z!wFhGxgJe48a#l8D4^&|_X+<{fVZMLOa+D$X1BIBo4_Mf!k912<_%#s
z`;)1JQ6FNFFswn=9if)_>|`zgzn`NO2ZE9*2JZ>6R2&G#b0C9A;QEyJ1>-p!TZ`C+
zEU378DRI{U+I3E>P&9V%%KQrS%xKql8sYeMn80>iacA+#U%&jhne67pvgYHz^5ks<
zxXbx%AARs20}9ee{%C_8wA8$VzJYu2ZP@z%iPx>7*U203mW#Yr^4#JV<5&?W6hzxB
za<CKW9C!TA_Q;7JPNiivmi&wiF|k2C*@jmJM|mq`Huf@P{yFxUH-VGV)oZM6kDdha
zsLAD|;*~+(&{7pjeXG%I-=P|nEuNOzC{%b_6`oe?-9w6i1d~p5xdU8zz3`scLvBL$
zCvn!%KWN4~PA6`ck|yDuuxseuRJfb%fV;_sKQ`&arH$l$;a(!OEqL-K^UWrcUUoCz
zJIJHLJM$hg-;Gift;H_P&DRV0iga#bJC#s5&IEVkXWUW}&9TXGjxIW3YDJ~Q<)*u>
zz};TJ+}_09?#JC|-g_8a==ibmK_%q{3l^|X!tdN%djsAe{<@RYRhFDc>L7`T&QK}4
z+PbuyvF|^(qF?pVv2u9OJKLHno3&EByL<$_YlRA7+{ei=$mx7Za=jDZn-fPR2hJaO
z2YK3m5%DLn%Fps+mM>pAV~mqfKFxbvON-OoXP$XxNw5j6nU)VlMk2MRS}XC2nt$Iv
zVv$dZOA1E6`iYll1wCBcE6*(8CWEd^$h#u^%bi?^a82M`Ia`pv39qii2=j(5Z*%%|
zdSjPrVsv!0^!r%EE+ewlAukJ|G!4D7@JaJdTO-M^qUK&KR8w(Y#<^dA{S|LJOb7$%
zF%*f#N3!q+@z6Pmc@27H?-kO4CG0lH6;iEChI;J&?n<r5V3O)?rQtAu;is!pG1ecB
zTlNVN<#MT~XNwFU@ul3Ta&YIGD@g<|Yi@4rRM;xCDDbsWrBHhW_^X?5A^9OWyTzhu
zzt7CsJ<Oc_NrAJMQ_imL<A&wyyUcujH)Y61>|(r>vkXpmY(O(#A6k|*cc5+q!vIty
z12!^XBLx;_Zk@Mx(_~Z1+oJ{EUPgJloMvqZubF0eYdo<}=odO+H%B$SH>jp3Zlt`O
z3%WgT?;8g;Xy)w`=3(xPw`WFE-u?zYQQj`zhsV$m%G<d*Jj$@VJ!lu@?TdxkY!GJi
zLnGzwbwR`N_J&=Qw-@cEygl^|%G(1QDGu)rvha2(c)+cm(<6L5b+_TybN%l^cy<C=
zG$1>04YLhbBBqvCadB4O_gsR37l-W1YSVz3k&9FZigwc=QJ)tV*H)%!hz!9m9&R%<
zNS0wd?OuNZ?jwPX2$4PhBE08_w-*tlYR>W_6>(w-{R%?1S8;Y$YBpluavB>-E3Ri|
z6e5|Xs0fO3)?tljLV0=CMM$ZaDl5~^B_xmw$%*7bQgYHcf<9B<?A^V4|F6IOo}QkY
zlX2~8&Q)aBfD25Mbzc4X=b!Jm;|`Cu?88t{z)-c0EiK4N>Fw<(FK_I^YpcGOmvf;g
zys_>M7hc{JiFbd9niLO%*4?N9@fFUhj}g+gi+n?Nqo4P$<ZB3f$H-~?e~u)Q1bRtP
zL1XN^M`^D65A;IJbdh7k(gj4rPChKu+q_ntl2X=*D5ACl2lBe{+N{@-FXPap2Kqg&
zm$=Uk@#Nh&6qsONyuj^FiTCmxv}7_A_A{@TXK_ufzN)gewmL1nFu$y>9#VZtNlAHi
zZ3-_2f9}zVksl-Cl|5a(q^G;9+ejv=)uE0--tL|ruHzJeF7|4AfU4DKHm9<&NBEO7
zxQ(NeE3Mc;{IOWJwn_y;?wmtIz3uR7YiG~PQ9o3nP^xS#?`-TD1^pc~_bM=c02u!(
z&Yf3*@!19W6-7nGQbjv##i+`MR)qtxoSBJlf$GA7{M;<)nH1sqc{z~$5r;J(xYixP
zwXoL>qyuU%;pHHN<m99aiI#VX=i+BiioI*qs=FV0_%09v$f0*sR5BpKR)h%K5tEG#
zQj1}`QFwBoi3N;2$j1LUF%1Z|6(QL6|3+Q2%PaCrN{W9!da1Ou6rBsJiU*NYT^+uy
z$3K==RMkTBrsP#oSxq%@gtgxsvoAu>t@b9W+b9Rcb#-<3V0*E5y~g<2UiNJ`>&o=4
zAR*A5@2JReK*+5KA-AKW&-=|B=_Sx7twc#Vl8-mrUN_hhB0dD3B*6jeopHUe;(C5z
z{`m_uW1fk|xiFsP6%-zpCXm9ydIK-%C@5$|u&jwBV4vZCy3Nj=TexV+;`x!&rg(Td
zySRJ%xcV@O`M1h;A21}arSvYBDA1<BlkDwfB3KiUuk3`Hxe_}E2`@Kgp%CR4iS@kP
zF$M3wO-hT8q4eY|s_ATPtSYOlO|L3MMcNDJgy>Eo5?A)j@=yb|P%Ps^^1uHfS_L|U
z2uk@+WTcN0A%8Y&)&$A%s&>$l$KnvOD}a)BxhGcg<fS-pZ1%-_+#`|k6YJ~CO7kl!
z%StPHx*PSiu!7JZ5I}Vm><A^a-&{>qWjRO$6rmNX;0)4AI9po@1aD3&m&$=@xfIWX
zgh0HLh~mM6IvjeWN~OZ4&!f-Q+1|mP@*uDrH&;jSADV^dU=PNFI>nR+wY7D2L6~gJ
z%BpI`Yg=mzFQ*+dyE@z3@UD}-YinUV=waaaA@CrYxkF{&hk)ZTzCfvf;GwbXTU~rR
zJoC3h^yJm6ui~^B1+w3A93is#1>_2@{{rK0{hu&Cnf9O_71rMx3Dzg0#VOqJqrm)I
zqr$vJ-W(8fC7O&=1cD}2rQXzVcEU!$=Q7YLUK~MROyV3G+QgtE8FZ5cnq$!2{m>S9
z(_%xhNZLJzsb^toJqI^HJ+;MC-$DwNIQ#r95~n3f{Fa=+p|gu9+Z{5SNXQBtI(ul?
ztiTba1Pz-NICQel?Xm)gPUabDRv`5}QEL&co4=Q$Q^6|HM3Yyky(o`<RV^fM)2NDj
zAf3>xt_|P}G^=Y3AVZQ;Q1u8&mj`xy4jJL3&?t83b!TR871wX}wuXn03inksU_UA0
z*I&<^JC~3~O^-w4g&D~E1BxXBv-tY6x+M3iQCej=%hiN9`WlQVyM<C*A0o~gyc*KQ
zoiGlMAgzm8*8AgyyR9bi(S)wfHW&q<*E$9TLQWQSSWoC;X88Wl;6cfIHxjx!+mM}&
z6i~mhQ&H{OPi#G*i<#?HH_Y|7$>_3Rmh$|5%qAwDuWK$q-U)4`l9HTaJzq~F>l2VF
zG*5@(EwPH(d+xdK-ajmd2^iSrA{XCh9kUwQds|S-{JRUh48kMsxq8UFTt!MsZgo#7
z5;J2NcE!(yI@jFD)*TT}2{_4SkOXxvZ{+^|A}@nDh-A&%<?0y>J(*X_5q|~rcC~f1
zSx2o#CN?K!${^rD;Iope7a2Ldv(o@|5$N^tunV+~TDb`Vk-Pg?e_jR=4#}BAqn2rr
zw6~}RyY?gC_Id2u=do*}E+k!M+cxpSMWEtb;`#GQm#?N>PPvqH9{Rv}>$tw1BSB}C
zwK}`by_@anCf8Z03lwauI`LMt>5;&Q*U}9g(l!|JJFU~gNPG@*b0?gk$wd0X{7!Iy
z1!fNLuKJ(rAHdIj58XGuDe?VIQ^2xCWGC_o==IC!7y>`$w$6&%@%*Un&Q``CkbXlc
z17^g|*5=06w)Re%k<??IsBY(#&{;V!qLgxY+bH)?DHX8o+Nx}9<e*KlL@KwTc`Mc_
z?)JkCO@4wM%EDRxdNXG!yk1pOQYu%`-iuIE1;6OfXT|{aRmcIia(0K<`cDoIpL)lv
z$xKPevrbI|G}Bu$zx&S&n_zY6`STg|eHBm+7Mcb6Q63fpbj;gjeAC0Cv@Ex%sPMNV
zNlZBq9JE6V1Ov3jTQa?G92R5UdhP5;U3U-D4T7xWcYt1aONMuU`tJ>Y)2)`V(dQHd
zGnr!ylR04RpyEb7lRDJ>QinyZl!JmSF)#h{it#3Sg-S1i#L_hkY%LqNg~67xaf2D`
zqG4diGuSW&o6ca*G1#JEU^^IW6oV~iu&Tjxwn)O3`bQQ?xOK0Pq0$0Lm@9de%E5Md
zR1WU(vdF;}$iXtS_g*1SghJ9h5drp>JZdMc@EXoeTDF(kNo!g-*h%wWrFPQrJPvl!
z6<!uQDfQz}@292b3?>G7a_?@qDITWLbS+*a0k5K0{{Z2?l75p{Kz7qtFK-gZo8#<e
z;x4r2<|<%$8cr!%wbiS*_<VXsR^HFQ{Pz3rzaKi3a_aP{qlMrWS!4^Zv4squ1&d2n
zP3bji!D^~Taf$5grg)TIi#9!HGiKc4hgaQo@BR1RpOywIt12t)&}ZL&Lrs_lUaR2$
zt<!4b-`ULT<ZryP;kDN`{Pm4^2ki6s4|jk4rtq_7&D9u`WqXs`upthjq4}cLS?v-o
zhMU02IR!3PZY(#2i_tAMo<b;Ui?J0~u`%0tDjw4}xGS5>T%8@Dk-NF|l{89ROR=qM
z;oHzEnuvdRc%Y=ANhf#YDzmaGogCx6)ar>7y<Ntjk}ECdI&a*#DKn=a!5HOkR|3T3
zJ#WsODV_?GPR`XNCnXiMaZG1lh}Bz&)uVNq7h&}lV)X+0`-NXPfr7m!E?ho+97p@{
z)0gw|VI|DZg@caw?bBE0UO|MxmE1~wAL;I{x?b5_j<|t}rpkh<Ze2is+wbfI9I$6|
z8d`nh;^KT-8mf+=z~FC{B#YL;vq7RM1Q$cM#72omzI*Z{VQW!V@R5m<ygl#goP3N$
zKw6Q}=Z<^Vu3dZY9X>_dW05+DOT4|v=l(dz-M<Of4$=Ln5rxXeNHFG1S}9t#;cX1c
zB)unj#8=h?Zxh-cnqHB7-zf8aB$~XZ3+V5~ZKP%rSzoJIj+0X%X)UF8mC|xj&HE`7
zX!RyB!SZ23%_I}DZ(Zz+O?61Tt7|seyEy0q{DWXeQ~L(_`;3o_j2!RdKY=DfPnqEF
zNmEl@y+Eia4c*>hRLHfiax@cZ?{#o+wd<{|M7TjkU9Y_>a$l@hA2YCWpKVwzu(%?j
z4wguUso|3g?mbY09?0oh7_5Q8`VWBZ9RN$csT7v_W|>xJVz5nsg&#skeND8~naBx4
zqeK+G;QH_I3~1;n+~Hri1MN%pG-xOyH8tblrj0-0=ezH|+xOl6lwpbL3tpX^l5*)1
z%*lzzjwPI>x%b18Swv%FeM4ho0}NP5t3P!4TJ5lOSHO$ch~U~)Ow7sg4xcr9?($*j
zQ0ePyqjHcpL)3|-UBk#0w>Y)C`>3dM7Eg}8g@)X=!3J!qqobhI2)(}1Wo|U&c6a15
z`}lcw3`@GD{FJs1$b~S^!T3&0DB;yHEG<X)`Au5!@R9%&@Inf?|HR<2!xHyA9`t~n
zf#`%b-ZrNcPUPzUg4zQZ)s0~k`!gfCWJc|+{q#2Ux$e(k)eN?j!L~5ial^otGuUzl
zo4{bh80>??z`8NmMGW={278Rbb`1lYz+jyi>}dvTWUyhwz%F61a~W(pgY99kj>Eu?
z?0KnFpzud@lD`<yK0<E`7;#11TicP9gOhqK9U8AObZkyk&501RBtp-{n{sn3(M>c~
z#}0f!BYul67|YFBOBW5tc??}Oyo%_u30XPODDyxUPxxS+J4Ovy`w!R}<gztT4zmU&
z40b$Qzf%mhhQU5E3~U2~H8I#c1}h%f+SfDKb_VOsU~L&J7Vowky_vy=GT3tr7SUjo
zGusXWYo4?DdCxFdX9nvq4D5e1=i9+L4KuDQd)|fYc^_wU{+-Ra`+ov!k$eZs%njSA
z%sf7egUoy;lFH1^)l_D7h_lGdLvx{2He(+)<9asZ1~y~2VP<@t!Cq&uzcbir4EC}A
zFTqY3JZGAtc58leIVDM!Cs|I(lI2MzP|{?1l3|oQSqGH|DT(qV?sl@0x%#M@C3csR
zSv<By3n`^9<H$U`Smz`GtorB}2KzIEO=hsI!@#C8SRV#k&tMxEtXn_qCs>1zAtn6?
zDd|&i!|mXP^G7WuUA~ff<w|Pm)vM|0XjXkih0v)hmoFzJUBVoO5TB;sUP_1Ko|dP9
zA@2fAwTb6ZObzzD3(30qqZX^`Dw_=5HEH|5H}r{G4Be{M<_<+rSaEh9R^=9XYx?cw
zeoxPFQ|HW?GtI|Gh9V|Kv`=?NX=%5o?!T79yzcKc*aXg)5jAsWc-Xw@(<gXH`Z!~c
zOx^{o{U7BscgR^(&=PfZ*}+IAp*3HWVsU$?ZvLnRx7HSYON(CLj6$x>cn2#`OG|5O
zXJ<R8Y5u4sI$K*iTJXo-&dvccomwHpn>ac;*y`qwTGR^<4IVeve~h=c+R@8zY_KXM
zbYl3F$v_ea9J|zt3>ZGN#)Bj(+IXe9w3Jr2H}yh%>_f6k@vYSdsN7+(V>Emr@Z<u4
zC(jaia;d<R=UI3%&0wc-rqqsM%On;^940CnLcD0AvLTdBs54?C6%g^A6O|BYLm+&I
z`}SKEq`1?qma6T1JPLHuUy<}zHT@OGGfjHv^Pq|G^u>&)Z)7~(d}0rG>Q*pV1%su1
zYrx1dF)Ch$JN?cN1#8D(J%>3<x*6<jHf{|Yw}Qdi4FhY|IVUmLBnE4is)m!ohaA`Z
zyspEH%dt7%H(=ZZHfP^qV9n?5QU+_5s?5);9tO6LjqA){yV&#AvvF1Zuq#1LD?yh}
zfG$^pE@{>3pw!e$mxfh}xAWrS($eB#_23|H?^CCSReiH~@#SgLE)T2ky4Ba;dFQCK
z+en^Pq=oTi#P*jUy}rGDSVgv)4@56wZdlzl$j>h@a9DLU4u$D(w-ITm|0@nKG7Aok
z03Dp4iKf3Wh5n6hcW+c~!pm-wL0>`<C6AX0v}KDR(=7KVsFW%pk3&<V(N**PQQO!Z
zu~dldM1UuYzoDEDaaAIbJKO}tdHK0C&@VeLKd&IaC>v=``B&YWOG?tvTP>@sq`2N-
zAO-}$locjiBoq961Y4qqS3qUu<nF^reBbg*_XHZM5)iO(;h8h__2b6T_c%p)X=j(r
zAeCut5X||=1cNN|D@0K7+<*QPFPU-S!i*Pr@}kb$%Myi(FjqE1Iz9HI>@2{{vaWZn
zog0U!P9bBSyeEBh?%K$iCDG&)Nn}LiOlOUqNvtqRBt)m%TWD0Qje)OHqlqROtz>E<
zjMX9fTAJ!pT+!5;mDSK#2kU8VO<hw~Rt8#`T)UQ=n~||?8-0&8{wL3K9c?@aLrV+a
zwRiB6&R!hjJc_)<OK>#x8F*sQxj19_=!zl;RG6x;oX)WSxgl!P%gxoz#nsUh89}ao
z8Wf2{b-W(b^dd4X8h>LknGeK*=>f4aLL&ZDiqtIf6JEGkFnM32pQ~9ps5r91jBDx_
zqqu$ryo7q(SA&<J{%cN7VrF;u)hic}4wiU1wY~2;0xGVaO+eMkGYMBSufdphH64xh
zG(iaoxw#!Rkg1Zh%F&ZtA}P&mZ6&?E6<MXt6>xQC7nWAF_Uhmb`}W&Ucc)gSCH;bC
zF25vQE4jSq(_OpjyFF0O*S)L$`tjYncOT0`xd5%rhaYCp73pXtb}Fq47ruTyjJe+x
z7z6HyG50P{W7&`I>JTZhNT@6M1^J5ngh<tGvJHQF4nO}`1T*aq2&&jczM$SRrCY_G
zjT<-aE_YiLN3{5kUZ@%ZcB&OOHK`o5wr)P6)^5bawxcH=Toa#@&n4>vNzo2-Qy9sI
z*<|8N(d2VoP;qf}b^G;`X)=X>R8&-eN}hc@OJ7?na|sR)4<GL;6T0r9m6Zpt4Xmj-
zcMa%Q+LPvXtV`&0_`uK;##YqP3}>rRA?gv?>QEWi%`MQ^P%j%Z0c9%3`^anR)nh$8
z0w+%n3JRJsCD3n-KT1~ypb@v$X~G0~H||tlL6jUsIhDO$ueEh{7u8lnX6)z{Ns-$t
z?BIui)dzu9EwK6!u=)V78ipF)Z6n3(X+9L|p+b=Eh_D;hcGPx>zdveWe0HHQ`OJP8
zPxqfm%02)2mQOz|*Q=2^>CjxBc^E~m52Yb-Myx5Hlrl0jOA|w*u*Vh)oyWc>`%!fC
z7}-g5l2_0T@wLSWl-Pkl?vud(_cV@1IadD@vLg>Rk6jaowq<Oyzbjfz6ufBN$w~xn
zjT+|@;FU-jDc(=hXzh-U5h6bfp_Zj1B>;c(tw&A;FM|qbedKRJ1uuaL{t7CH0uLKd
zVPT{cv6G)MxbnhCsUr%TzxL>!kG5~$w)yRk;Q1OkFSw;q&j_go{0P;vmkw3D;eWw6
ztdw^cHEm6&CrWiyOMQKVvzrJ<%1G(VgLfEQ7-EDp7lrd>K+TAe(%+0*+UtynA>GDG
z5`zN-XOfAPh>;8Ot*8dP6JH(&!@He@#gV~!GT0ghD`&8~`(cNcx^_}U>$F+hqP!X(
zXPEV_yRm0zY~kbBGgS5w&coBm$yo_s|8Olm5BSPWyZY@n$$1wqp1ztwySXB6n-*cn
zEWC~>@#9)sGfTmvxwi5wp|x5^Zf-&Xa#N~G3*i^OR?%FVRe|Gh`<OAo-mQgAoi-4K
zY&skB^gh8J9@{f2XqPofSw_-#w2xXMrpb%fuMg+6HYz*P+JRG%qrKA{-hKDSGNb2R
zI1ld+Fcy6GuFn7UFTU9O)s|0wNy416@-H9!XzSN|Kl|+UNv5+nZxf7@9*YCtJRw|P
zivEZN;}L+PZwHs}ZWZ~UCz^w*sR^lA^z?gaBFRP`AZjp~{vz2?L;}~-(=Q}y(xmaR
z563#%(}0;S2d703&Iz0{B??(_WAWqdB+|px*#ff|Y8%<vO%KI7v^NubB~HO>=W1$r
zw1vf?r!eC9Ywi%?DAa`nj~U}K{?6r-y&OQ7b{<pioa5>2?;q^!?v6sx9v;q88Eg%5
zIq<_f>Gk&1guy9EMLllaEuSz!XDdeM8S0y=t`)gEGu@f;J=zzBR<M29!uJrFcRBge
zX;`Gb{Olmu!^m;!FqrR+6v<II(5sJpz3roqw)}h3ww*h7jvVQ?@VyaIfeg4V3z_$)
z81w^rOT1z2il<{qJiSIw9#(kVsHujo!o*48Q4tZ-9(Z^OoY^C%qFZ>}NXaS+#3NU^
zP4)K=Uod^j80@tXli4jj#707POzN_nw;Mrs{rw0MlOR4I-eKSN9cK{ra3L)niBm$q
z#=XgTmoFzIq@>U`j<>XI+{OFR@*GV~Tz{PM4X#oxa24JK%%%+OE-cKYyh&g#QHLwR
zM7D3=zU8fr?{C|-<*Sx1fy;C><~Mr>`}%I*?&A~e)mofUAqDdhmt|a}%;p=)Y#eBz
zkH;RnQRsv3=R34#qt0dh`blC4;}+&~pTEF-Y{p&(dB6Vp>yIt|!wZ7yH1_eRBa9QJ
z9Q=6eZZvCr{q>zYzx{gar`Gy4#_?{nScsqBjbb7FtjQj%Nhblj>QD{Apgt`$GpMMD
z$zfq(GiJ<K{^%n!XUv#0)!t6vRBES%56umnIB~{|u&}`S4@NtA2B4!>ptqBlGOSi9
z{OG=jdNesW+$cYCgLS2Wb?IE}>>@)XH~1IYSW^BKrILfxKwwj+F9=6Mw%a7e$k4NK
zj)$YK@0c;j0}5KY?3T8TlXzcR#ze2b5f^=fvl%F7lYreRTljtkS5rqB9HX>wa5&m6
zc@ZdWA~@VcNOrEp#TgkX$=`kZ!;TL>-1_M!KSE>6A|LP?#{?+hG@ADGspLx_#@vD{
z@vc+^+x5e#D`&TC-u$0)MVAlJfTWLkt=wSfh5eFnG02#FONvH@e_j$nGboqh^q|+5
zNJf7R%JDz(`lk5#KRoi{0x(+WS!6Hm2&_f3=`P%$OTP%U@E$PdKR#pn7kN7#Gpw&~
zYIgT<4VpMHEO@*l;?Qf6im!F3s?x*cZRlxkLL;V<!uohuwc5+e!*g<6+^T!;ee{95
zX9dtS#%1_ZwOWodpjWD<s&#EqrFlhYru=HG2+asvjulys6$u(#_r}T!v4jAh8ygLR
z?JX-7G`KX5l@+|DRF0J;Wd(FB^%Mpa&=IX0@p9i%U*~q~A5>We)<f6aTzba}K5i++
zGX#Qy1{deCg0NeP^;pH=V2d|uHX|CK78DF|&=$0bmtIg9Ufe)5Z^CdQ;>IlFy2y<^
z5djLAdGnt5>8BGX&R?jmsX)sJQ)gG{1qATnj)(*lp^uzaB^J|sw2qp}wgg=a@^_zi
zZfa^rKY?_qt*tWsXmSPW<O|zECZnymh$)7)jhAY*+K-N2K@#77vfml9UsiKZTUT?l
z%-2I)ig<QmAB2V~0ikqQg!U}ounht)9Z&ui?~1MqVq(h4&QCgbE+Oe+VK-_62>Za(
z(*eO_QmGmh8=d^dy2QKAo;`Kyv}rzaC7R{cwstv&qC>W@51O01;foRVG*iox+gLC2
zK3Ii)Kr2^1ja8tw;g#42!6(na6L;*`vEA=)`|a4VBfp)pvMg*P*jP3K%Hj{TPLgej
z*sLqC5cGNx{pg=TPw|&=y@byjt*_#sBpKXZi{!;2)>ZPbJJN_(pzJ5Tc3{!A!lH8w
z*Edl3*IQrpK}j(vqOX-($3w8l1RjFr^O+KciJ<AA6~qimib1`6t-~#-3cjj@o*NMn
zF=u*gOl0JI=Nv1z!<I0W4k(GQb+CfX5P#NXZZ@T9e-Q}>Hf?RFu@kmfF*bn62E4Wp
z%}{#KbuvSvO1gxQH{?H^Pb4mfV4)gQbvzfOY@@%h|LmDVhY;h-i+rc8i=);}Tv`&Z
zP%5PGn)OP(P?Kc0JqRVg!zk-(23;vt_r#J9k)X6&gP!m_*}TZK9`zcY5w539>lA3A
z0?>xM0-c>LHX}8@3g%Z4Vq(vpJAEzz*&Hb;`!qI9X!1_?Sx0*tafyR7cIp@>RYONd
ztF5nk`jWUfau3ftT+Tz6v8LAUzV0@pvm|e$eV_&Hajbb2W?>bA%&VY6VOoqP$9Q5T
zxLQF@4k}J%XcUR(&z-{}BoP;2!_z(7xdx8yOm0leaeBh#@fwAfv=_6MDwJ^~9xEWM
zglOF~-*|hd1=;TF);;yY>#slm)N_AZU`eQ@kFQY_<TU_}GxaV)DJ4qu^!lS|J=q*@
zgEB87YRAPINK}|kd2MxFbxrL)jk2x1qXUoC*hE~Q;n)VmMJ;`F?b@f7#m+!t4RYCd
z4W83sTQVNG4UgW6zpcr;Y~IaNv74t633jm<=e-F3bHo$3$Ip;wef&^oy=O?szI|3s
ztGBG4_c64q)X2~Mw{COpn`b=a+5gt9XTK-b2|q)g|8H44{|BEQEbi2uogU-Z>0xB2
zM-M$cG{`4ih8G&cA;l_Nyd{=QL@k4?XOPhpQp@0a`{9NjGoL|rF~~wT=5z-8<S?+4
z8SH}$c0YqHWw0*8z~(U6*$g(H!L~5iXNG~TVzBcVY%zoNWU%i2u-2lRdOo0@^ni~!
zni24dkQv)VJ?W-p7Eih*VrNjDEjtXWA#NzM5<nlBm12QUMnfe@bD6EPm<21vViIE}
zv=j?F?=7<#oMjOBflz0Q&W2_g2=m$BM6(QPmRYh4rUT<tR-hau0{e<~?*x^0(3t-0
zro6m{^0KnBnvU%3(z5Jql-8s&bV5OPCS)i4Lq>Kka@BaQv@{-jtL)p)KmYvOvb?;;
zM%ucx`RlJ^=6?GPfOPgQeqksOfXqdcU-a|OKhJ|-$2(rUxNP~~|Ni&5IrHYZrlSE=
zwr>o~l$)g=Z~e>5aKY(pnljF!C=n_Tc3#;VYkGlRJZEDQj|m>jL}|U;GnJKRQ_zL@
z!m*l~luPJQnSil6dZ_OKje>;m*=`zE9gm%4aD|HJ$)N>3qBrd122W3WJ5Ns%1c=7g
zcEs0$-*mL<5i-GZ#l_5iG6Sm<iPf2d)rrLFM6%V%&hDte)0a2o<uy@fUw%hfDO(+N
zLIQ43Q`d-k1!!&7P*=r^ixU!xby%LSziw{Ax->TC<(XG%Zp=5|VtKUo@4ffl=@M@0
z)TuahGE3@tV#I&cu_G*qt8X?|C*5`4yg6}LujR|Oe*E%Zut3^a8ir5avw0{&iCHXN
zx^!NcBagl}q+N$4s;N140c(?TwzBd}4lP7@>{5!bL|S{H6cc1Jn%F3oDtRKpe>yCZ
zr>8-V)v*=3xp5v?FIR(|y|74Hd!(m1*rC$ABbc>~9mes;e>z5i)XVZP)`{vIYq3si
zu}<L`S=Z8wuV1;4b_vA_kDkk*9pEmV`1R1~gni$gI(Xzac+M^!`uXP{fBf<AIkJ`K
zL*!oJ5)tjM+R#*6RaRP3m~$0M+Q~29{P6<vAFicmQg3Q`MMX<|cwr;TN_@HVRB<nC
zDykNvE3{a(zWD67yLNlpR~DV1O+-&$`0kTWKKbq<`3?6rb?MWOzW@IF$LkbR@3>?7
zl(Am4XRCvU^VD@HP8s8FyqcVNDWj;eJzg^3tNa2M{sZ!^dfnZgpxLsv>MVHwuJr{k
zrZ%L#<O@krO>g)kv4}Ur#jRhm5Zmh`DvaTJSM)IX2k#=0xJN{<cpANGXE=AKT{?R*
zC9lb-b?z!jK6Cutci%l%Wjk@^%(>As18gKZO;|%&MRi?Or-&AeaF;cdpv!ixNi}Zb
zxZnvPVKxNOS{)AVzBtE&-Qc61s8YFjIE0U*3b(I!caPCjTvnr}D_7l+nuP$M=Ei!3
zR3=BOArF-<+}p+3RXt&1kQDv2+{gOZI$;pspb4|4g-n^?H#1@aES6yrlPAK<7CwPY
z<tKuIo33B2K#OdJq_@v#G<3ALc40sD$((&?$1s!{g3u+EshpJEOfKPpe;)Y%8u-@&
z|61UGehxZ@7w6{Yp8R3o8Q?E9J$IB8;YiIs;bDRh&Y946R<0Zkk<33-4&x7Y&iik^
z`SyDseDMB9dqzn%m_S9UzFDvV?f7Ino4_b2NvI4Pi<QA8dUoAkXc>|(h0?Ge$u>On
zKcTZ=y*}u%==&f0GYD<NYyTjIHvMQQZ+>$F<9sS#A2~F<?)D}!I$E47n2XecxyXbF
zb*KcRqR#pIDj?z@qsO^d<`v}Y8`6Gwl=M0m?cvI<CwhVt1P6@`ATnEr(Npl>K*2O8
z`%6&p22k*8l!D945wOw!gOX3>qoiO+$s+C@A|4gl=9iV^q~~2ZleYK6GX<S~^H-0S
z+o?YJ&*l%|c>ed6!aS|G{P6ay(eOXnA6L$wyKp&rC%#X1k`!{l=G8g&xo6Mi{7>jr
zJ|SZ1qksMDU;h?OG+bn$)+2Py%CV!OSRA|+1AfX!NwH$NTq=4eOgTC-_4W0nYRiqE
zuu+mJI)aNu|3+h)uuG#NPj<pm37f`E%0Ztua&8@QZbBOWjY{#YICb!%U@=Tnz{qds
zHO!=t8c_y=O=qyN4ECvEV2c^71A~ocumKEKIt=W8Gj16hx0H=LosBz=jq5VZxFrnM
zi@|0x*kA_h(GP2pqz7j$6mF$*z58z*<oc|CP`Q4BJ(cU-r&{Ftp*5g0Y*ZIEY7HAz
z#zqb8A9XOS&}l|=lEJDO>^lrrF2F{UH#Pmx7L9_|fW1+<w~#(C(<t2OLkk*(IEy|w
zQzs_ShiB@9J6(YO%8pVqr48&)x0Skvf1|(tL4VoPUsHJ|B~$5-)~9*_Gk6%h^I?J*
zo67SgdFkh2WITG}GD5;KE}Tw0djvK}d@MxuuF}GyWQ0)V<Q1h?L-z^YcmO7cD>;QF
zg+*nRO$`kYK8P&LLoSg>+R7`63-a@`GSja?*+~3R7v|<E&Aa&BhaY~p`}Ye6P?F?C
zUZ<ze=b!IS%GawABjnuDt?>2r?afR3VJGJ7?&?h?U9YiIrr&YLR7KqhxOk3aHh1)C
z9oj33vQiS0uNvKBAO$`)RVT^$&GEi}-HC9S--T-r>}?y7Ua*f|l0SvXi%`|%XZ+J{
z^%Ijl>X0N*-8D^JQc^Nz<-cfd@@@^*hx;&98)R(COF4P=Qd+n3Ot_}+jrhaDF?bdm
z|CzD#X3m^wTXhaX;Lj&?VKw!|GUxHIWlj!Mbwh74+4)QeMAzRSbx%!YWo1)0=Lw}j
zEvu}qB5FRgt{fJ})|#?nv^DPYM*5_UP4GmumkTw01_w=)%Vo;?#%6edvr~0pit$p^
zSViURfbs6=7Uks^8sI)Q(8Jj$$WeiYHc|;EgRrj>8C{Ux&4(`WfjQ04ikw>b)_Wy#
z%%-#Md_gnh0=ctFC6$OIy+#9`LSm8oBZ2uR{3YZc{{8xqrw0*nQrw8zzo=afmLQmd
zP;yi3QCwU^1;J~na6zYK=H%wXR(1V)Zq@-*{N-IZBaqIaa4C|WyE$>6NFtXYy#?97
zzTMTihd=)K<BhRGz4lk^V0G5UZ%j<wcm_`UebJ_e91;`xpAE?3<jPL%+Xr0n8d12P
zN^2u?@|Npcdi7P+b)8xlM86%a^jf)cB@kDjocTDksRyRS6B$4*a#QYFK|UdugsYU)
z;c6ts!j%M>?Gxv9>lOsT#u&0}-MVF=JvfG(@3=P>z9C!)kNgZHHnjC>ZN!}=En-JI
z7YV6r(#C>*aM|8JMFJ%VDzMA-vtPuT9-|lc_U?ErNeSe2eUl#Up2j+qpDVAfE-S05
z%|Vf5-o->0(L}HppnaM8#Kzw4UV_^H@Td6(_yxe*Hpbh--PHx*0nYAT)2+h@)}1(D
z>u<o;zk#hd?9({HL0rNR)L04pNCb?rUm{v2m0>S{c1zC7$;`~ShT`=(`PsR7xw-lI
zg+<q|7ZhAC%+Jd{grsFoi@)YYeZ5Alqgd2SGgo`zJmVlV%faAm_w55BrL`4Dq3dcF
z!A$<RaQz8N{c8aljYj)jQASqQPsggN+5x~B+OQs7av1-)+RT0Ad!9_@x!HEuvXU?_
zk-oCDJpW4K#f)p!S`T-hom+s|Z?9(88n}*%vO3e)IWg3(pd<2EUj=GQL!Mp*%zh<Y
zzmQZ?CS2EGQU44zhUm4)_ddG`(<0~3n&?*pL|ra3!28fiix??G*1k#>@uY$08rtCg
zNy}*@*a%)zX3t-^d|8lIT$=OnpJS=rf^4>XeD(6EG18W%%7*s3v@NmdFMx|2)&(G(
zskpKlg(sU(3ctDn#RaRXDo|>$tPC<{X+>pC27-S~C{1nTX(?2#W1kTvVC1MQNRe;E
zVv+!qB2c@b4!)0{FD!ztp6+h$?yjy*j?T_5F3wJ_Zk|(zy$6#ef<OmB;McT+QV{4M
z2>jZSmVHS{gueaFcZYsIS6oc?^WvPG!g{TutIZ&RgQY%C=Qs{hWnyN^cRToP7fZ$C
z#*s@rZ};=3nvb@BxYa1LQ8s3s(UC+;*X_-=&;I3~FaGnM0Q<7UM6wvMzzd-Q2__3#
z?pmg#-JI2vbdJ;$mzP`AX7aRaE<kWGNylwnk)<S&D@BI(PA4x<og-C^1EXdyUAbWW
zAD5uqB8kBt%?)&LaIm-UB#^Y#7Oq5n!gKL_3-Ns6cs}YYaBXkz>2ZK}sRyq;Sve)O
ztxy|^czHr{a>C%}j4?fDdQQ~Q(GqKVmR_Q5Uw^v5v;oX#m1&*yql4F4S`gg4lGkw0
zKC2!4{4q4FmM4`<P)e6xKcJZRyND&)LOz$h95YE=S&0zjZ9Lky{mt|@t(7Hl<+z@n
zDntjB6j%1h{9QWBYO1P;9Y*Zx(hgo4*TsvaQdh8qkh#$-?_ToPCss^xb;WvXxcYkS
z;3X0`0re3-ffafdE3^VDv;r#>gaSbJjz!0=lxLmZdGLCEm6a89=LBCz{$VGlpD%*_
zN{3oOMP6QEWz~sqkEbobn%!aYG_4gKyIe5Rg>{mD`PJ87f4yas(YWzPki88VVxbks
zk6$WlJGb|z<FQ!Y_sEChRbJxU5iY;l^xCU9m+uZ!D&rjCap**f^=<GG<m&2DUEw|_
z#L0igeTzK39jxHTsi%)}zJMjQwM!%6o$n+=;45hE+$k<&W7plke93*QpSpWVm=*jv
zabc5S6I}D0$rL>atDq#-@Hq+ioCkc;D2S=R=M+lu*I<Wjgs7E;WSIOTN0WPcQc_@T
zL|A=$Ic$?PILizjJyLaYLPD}m@>6naYpXfXO|<#LcNU;z^Lo==rYA(7bacc}J_h&9
zY81q7&$`H~c5T&tvg5N)CALn_^5j{aWO8p+Rn-D=UbuE~|9XRRL=E|ndo~V%bRUzC
zaYDWW24Fjt=cYbxVFI*cg1r=5NocF4vyF@d*9FU;6}{xHhoecn{FUWBJ)xoG1zudq
z1x4|yxET)Jov=!^mLsyfOJ{fAEa?1`CQVxU<TEdBScjNq*?Ot;(MQQ+7|JP}S3NKl
z?7_ySr3b|>Nj<Yw(M}hRSSx3&70qR{Mfpn9#l?@LvAicGQ<5V}NG7Cp0Yd&d@Z3*n
z#J$)kq$--6*U)GAj|N9F=B$w@oO(jtk@H5nh$MKD^wB>eCyvw;#${>!oDKdG@}j>O
zo_G<7A{@)kVD7OSXD!4fI=WYNJw;a)&i{(?^6L5~eSKYRc?q3Ukt2>{qeNs9p%4oS
zhRG!+lwuLFiAsMf>AZnD#n#^nVN6NhwV6s8p(c*Y8WU~Wp#0*~@3z1F_S-vJTVrS_
zBWJ-W*~R0Q<!4UEm=>89*=C&Fv17-HLfOP|V_M;MT);Jd5My#My(~v%jg-PhNiT9a
z1dM}+ZIs+=2dpnNWBqFgI=nrM`_Di7!n1Rw1$*sWXFe8(GnRFRzr<Bl#n3<Pr-uyQ
z-(>3Yy#Mm$K3_C07^Cbh&Cg6dvi(|AWFW|1+1X@52TPNMI=t*vlsLfcogJN=>{W89
z%Es2omEu6`XzVkIdX1dXfTE6lecinrr<EEBMT}SIcuFD@LqjKrPnr}O92gKhK4j8V
zimrRTU{n+X($s^42)h9ZDNNo15(PfF894kLw2}#0c?US$jD0n~ycr^RS9@bMq_v91
zrur&iizZ!`loZ!NRBmf&ZEtC*uc>dOAw1ZBSfkFaHuyae++1H?)FYw$@I224cGXv2
zPs53O{?zHymmnCYXB8Azw}O52aB`#*i4YlK(mF#Z&dD*-E)Bh=9s`}Il;g$1rgbi;
zX@%9drR?g7y*s`L8Yj+6Ir8sVY+GD5Zy(QX_eGFl&JXWvV@z+Do|E%GrDRs!AQkoY
z3)jw7WdFWr*Y;n2`Q`Mrev&xM^AjL{^g#^}iIr;gv`4`yS9uys_Csg+?8t=<#Fe=y
z8tPyP?kqaRJD&U<;@7)pPoF`q^Q8;vjqnkJCoCsv<S4d_ARwby(_wrzqM=0;7sjoB
zX*t&O7m|kMUc{{zu7|lhIByWk&mx3cEkc0EZzPADf;4`Ld@cKPqy!REKdpTVT6>dQ
z`}9&|Hl&hn(#yGX3xq3*lUoRk6VbXw#3Yf5wbGLB<Ks7LEyaqyEF#ViQjb0^^~*DD
z>R{zBw{@|{1KYTH@@oJ4@WiW^-hbb+Wy{tqhzXQfh;Y7>3~W=VSmf>(=;`F(V2jdy
zN~KEe>PDjx&@dF4KPo$wg4R9)D+B*A8AWo`h{jRr<PPM6pUL?kg~Hfn<PgfzVL-SH
zjS6V$hI%E&-`k-ZDaPo7@T{fu$UBN85L_gjR0b(WCB~fv?l=G8yO*N!)1AxWX3tr)
zH0qA|i<U3D6HcIsDsjlFKmPHLYahJtpX=5=v;LVU7cwq6Z|TyfA6~TTsV8a6r$?TY
zN+_#*oR(4Q!$#n=-b%#pDcY!yzC$E!g$t{}BzK0B!9|!#s~%H{m<VryTX%YLety2F
zM=t3V7%ST?^c0$n-4cV{LglV7dJ5InmX}|J_o=)VTumwOYp=h0mG-A`>gpo+w`{l*
zldfDmdHC?*tZE$`Z?UF7;Ck2w`5?!BIGj~ss{a)V(?4lP6C6NP=GwMR%dL1Sn((SW
zKlA6m2=Za*d>uGitWXl{fDMpYqmXxqI{nu?6$?KO8VKU}p&}QR^|jpZTjQ8B5dk`X
zl?k$AbDGZ8*4D`>7#@SL@bS*_27^avP;jsyaw!yAySlP6L$9Gz5OS-kbi8wHYy=#W
zekz%v&6HhXaF2)(BrX>ht=-uI2yU${f_U3p%uXHZXI+Z5S&g-sj<uPNweh49mK7<B
zbn%L=p(HCogc8{I$YfMm*Aq{44JAG?L1~2IlH|%e?_9aPh~!B{A}eAMl8(fRp+q51
zD*9Lve`Mu|9vMpHVblht5<NX6`2S{$r~$NvG{2)bpjXm2ZwtaUES+<KO1#VlmY7|X
z+WKe}9ct^N{fQL*(1P*b<RU=F7}pqUVd0D6ynu-q(nsvLaRgC#(th}%$Dho`Pq2)?
z+A_Wa8~+Bp%Kz5+3lj)0g0T^@yX6)}%Po}b77{uIwg#4G80`5ErMDoRSOYq1J&2#$
zEM4rV%~G-0Vzaacy`~6p1H_d<$AHxe(8uj)<Uq?}OXPqxXs;sFCnWnRbO0fBbZjZ%
zBJDWTD12~ne~m(GPd}4A{SnL4ds?2}#Gc;v#?w<hFB}-0Z{|0Go|l+dU44r#dvIty
z&vp0ih6dW?F**0@{x9F$o>D1CQLlLLm?6}S7|634QCwVq@4R<ypL_m|m*2QAP>p(|
z=u0|`MrSZ&XWyde$}rXt8iH$VEb=1<E4;DzV{00~YODp#UVRK}VbSPRhYtN*RC;jp
zm%n`TLA2=wPyWEZqgIw@L`oe*0T&<N*1{GAx)nWdTIIQ|S?pwG2}h*CIUqUmeAeDg
zTfcbYg$+}CD}En#jYq4tp+-kZp?Z3NjpyW5^POB2R**0<wJj=YqJ!_;N7gJ}aM!ZO
zRxTKC1xX`P+ivhM8gDg_hg~8EDXVG(CBCUaYcbk(8lPtn8GDJv3ys!NVh>rm1<L$U
z&x3I=c;6558gdk2y#F%!gL(BL*biR<8ovR|#+HI&EU{kHql8T=Kw_jWVPsJR8&^Rg
z1wdg`%C~NYqw!?|-!dMgd`mQz0T(l1%!*FhbYon~H~MFdaV=FydMG#-9?y*<T)NPA
z*iJ_Il{ofhel-+i;6d;!ZkYi2iU9eGjPk06*qeFPP>^*8X)V>VcyKE2^4}<*3YSqn
zb#Ls=d}_$2Rj{Y6XHVP1p0<lUt^CH*QVThaucAE45?|#}(@gDwFu0|m*bt<Z^XD&L
zuBfOZdw4Zu>h7+Dg!Tp+%~98ZGOA*|9x3u3(;~tV{sCT<*XKH0DA&Gp>D(1jM9)i%
zMp0`HFHbr|6}<fib>fl|)LoILU!gUKVp+ho?8T)M+hER&q4l<9<poy@TgV24z&bb@
zd2Rumy@+ka^>1!Xs7~bI5FYQ5eU;jMVVP@0$sD1odTVQbekRi9C2%&#73h@Y3@3t%
zt4ar{mB@4+6-6DeQh;l@+S}8JZ)B--D~+|pn@46&drKEuQqi(G2u9I~U0e*kOfsT$
zXz^@HK@XIkv{(v|oSu>nhk4?CJ|iP<GwsvU*Mb)d6eV21X;8;gfQ-EfvI?_cyXH<n
zE(S(uW!8BZFAn1c*485Oiv3taPAcyWSv4Wy*fILs8lD2Zy#wK2K%i2yjWv|z^W;t~
znaC@=r{8&}734)kxS`%bEZIpf`PwDcktt=!j7HcX*`!6}nE1*!n>O7Bvw`{fuuQQZ
zYe+8Q-?oC~!0PG=mLF>f4?&r+Hx>0=3dL>k9tJ!t_lMWeUkptFc<|@kTm_E<q%ed~
zgQsxtNJ!v2axKn6_*X_6x>{UFyn;$ysR#zkI<87E8lWwA8xwlEQJI#i@O?Z95_ZWi
z`Rxu-tiFAIRcUFXFEqJ@3-1^w@2I$VXz$)#yL4K`(bGS`8S(w;qr4>P0CMHEvf@h!
zMR8PUB??F6-NX|_;8}J?yzK5M-zF&Oi|7u*h17eB8@sN0xPtV0MM&JzWskqHK+r*G
zpm;Rd$!j@(WZ!Q>;6A-Ja%=o~^2!33g9Xh~Yd<a~CMJ4TB((I%S<x{u$P21%Xlkf$
zM2CuQLkntF>6;qrY6~<<kqpiNIheFui{{NR4v6_777Ke0i>3B*b+EIQAy87O!a|B<
z_V#XGsv+;ePJ%hWL=1Ms3hankz{D)<2p`xRdTgC(;VrCidq*qEWwlmUH#aL3_9&L@
z(pXv9Xl)ND<KtmF*VjW~H@mv*KRKRZfNHyG6G+0g6SCcFyyAqH*NLI2KZa&F@X{u#
zGL~EVjr~XZ<YF}}DlybSr;&8k8|)z(9^=I`BO+$rhTMfGsV%F){9!!dh?rK~N4p|f
zV`DX*MA6#Q(>gRm^ZE5xsr2_>Qs9QgxOL^_G^Den<U(pu#%Xe#SJ<Yf+YU|O15fvX
zF&pC<j|ycxDwFakjp!WXZ-xC_>Sq3SBi<vJ!TK;*^nIbQ^$gZw7}#0{+st6g8Ei0v
zU3d%ZK#9bM!LAWtQMy~hpbs<XvRj}BKJi5cJ%){3%3!+~totyq<qUQfgFVS$_c7R>
zVPID>*rg1%ox!#<*xq4a>ly6J4E7HU_8NmdH4N<NR(jxCwX$(-*torH+`f^``Tt+A
zEkn)O$mZNP%v#N3u#B=qKeOjeXRvL<z*aHXX>6@Z7;G7XUD6M0P2QC6q4K6l&y7R%
z(G65T?#`$3Cg**#ys5+qH8>imdk;6BKt|E?h^o<X%LHIkK6i<5P2Suz!gjy4aclQb
znX_6?WzM<{ROSrMr!wbCZ;Q-1^xikGGRK~FE_+%Td)kKnr?tQi+`ryzrS1}7h3FxH
zbNs@f%lo0N&DkKVRfMosdf{<p!dmtAua#xofz+JI#tmU}wr6v$VxyvSs#zklzz&>q
zFiEA{%}4laP6A&4G2?dBz$0?#?|D8n^mqmx%AhkX(B}m6jHqxJ=u8G3!l3CnBaB_e
zpiviUh?(Ckg$grgxZz?Mw3fkE^}|}$da&)rkV@$?A|G@~EjJ%i%9IsR%Ixj$)=n+0
zRI8vK?nyYYY1W2&`gK~D3tB~PPI~HPL9IA{HVGKes=FH#5*pfs)|G7y2?>qeZ@PE8
zn%kY9ZRnPv;~(w+bg=-4f;-4meT7$?KlwH4i+z3aJOs*WlSC(-<yQxNVu3k<bDQj`
z*^Z?cWq~>F{cX{`$W?*V=n@plb90}hEgHTRu5H|tb9r%Skc&*`-cVl1w2G?g27Rlb
zR`m3BVx6^|+=*8>+fuu^+}0WXJNcXL4pJG@DC`yX&i0rY!j;@Ti7)z7cC;HLyh7a9
z1u3MfPt1!YC@;n|3JXOHq{V?}r-)_tn9oi}+>&Vr)N4m&p*2`p>b0Y?kT;cuItWb;
zge=tC)6vo_2t(DC^$;M$R1_L&i3Ks}XlC^dG00B4@96nPK@QrqamNiQ$jXYF#i09U
z%OM8E(WZ&G4ic^O{%|8)Nef7laP8$@0Er#r6;u$q{qhS>LOS$J7D5#@33VwzCsV8F
zlTcA;C_H#mL8v0XfC)n7h2=Hnu;@eVZD_K{L8HgVK&il-X=RoQD2f?AhQ{T<6SkD$
z(k#m?{-3~FcIRN;UnX$x8i9M~zam%+829$QJ@+1X&i%w@Y(D2Y`e!T!_1#VvHc>dU
zF3j~q4ZTJKr2zvQ(JV<A`(ddK$#TXi{rjykf(DN8QQeJW&P4Oa@G&2!UV)C|d~r<P
zPR<?K_(RWqphRJwyIG<z_0N51*pZEE4Zp3zNjFV6=~xDz9Xsjh<7%wexgIFhr?b^I
zOZCOW%y{4_Y0F^Er=++ab|Gkk+AXMs_YQC-YPT4Blik7!`%k3px$wix7DMr=u{W74
ztegsIH(M;Ma4YFxlf`i71$Qsl)_=@K3k5Y=+@5)jy~%E2<rt~v-yPx@8GDn-!pey<
zwclc4g^>-!{a{HYk%}ZfBn>Z|NO&qiFB2*XJN8FvTWD_ZiQk$?PyA_V98P@XeEx@?
z_;x~7{N7vQ%Lk4;o(Lm{vXRp*BcEe+a*O*%w(OLF(3uQ6ghAU{psN@(B8dj^U<!S+
zlp~BSW6;qITFYQ-Zh;+m77x_SS{cQgHM1MM$ujGKumh$3A_i-g`tR)DEf&~;PdrGE
zji=eQz?4~!tr!M+kQA*mLz|`ON~_Q;o_{Noh1Z*9@b}Ho?5U%T`I=kc2R`>eP53yQ
zxmgqL8xr<rT-|IJ{eNhC55Oj_C2aJpda)!oxfj{k#x}+dV0v+*mjqI%2}ua)H-+2;
zLfX|z28Z0-G(rL)g(Q?D^xnI{R9A2>a__xLmZkR{tqdlYko&*)KW(Cwh34$;IdkUB
znfYcWmeSf+k=pxG-nBT~yXzRwUDdwpXud<+&)I)oE!*f$iD7Kgbi6J882bjgP4dMy
z$tF$VA|$?$YD2(VzL09ZkZP*iH3b=0QZ5$e<)oh9pG-EfS~=osU1vP?)C^bSg$s$Q
z$jD9ED2^$SDTML6cT??Ayl!hweSOZ>b!(a9*|FrPWbxy3XFoD?N=$JafF!rHs7%G`
z;(!AFod3p@DR0C9II?N2LwinTqtVK*YwRR)AC|PE9dX0aUw=K?AYQ8yOH@)PuYj7S
zZfl>^fjH5BY|SVr$Y>L<wcUH@{q8+^|CuYmNuNG{{(5fBZQMIzl9{W!DV*+k9IKh#
zSMilzwR?BGP$8FQW!%i(6d7rIgjGwz)atM$tJcPmY;s(ZJ91o1LhO{8b7RSVUiL{$
zF!~5Uq`k@i^5jY2vQ}7MT&q?3C`G;PEm9$AugPh*J%Uk9drECwtCC3(57gBX7U%`v
zm(cbIMn|MmjZzucK1iaq;l431dU0EjXmf0r#@`NT9;b3N#A#>!<Njxf*0_mEv{2g~
zrU~~=C7NeD-NSS_^{=BeKg)9%`Ij*AGcfYAF!Dh+bFW{yPBXzIU%tF&&;H%J_V3-f
zd-s-|yAB*Wdi=!Mv*(j9U4h>GE~`~vxR9UK5){;(myb``?Lk4Ex%k9Nt4eQQIC${<
z?eeO`V3CWyvGU5Pj4KCsjXE%CY>@Y`AgT4`ysAZMxwS^7zMb#tyPnpnkGK3`xn`Zl
z{Q7IW^<hhf<qwvAlWLu5`)0N!&GLsnfq8+6LrB1SX8H02pn02sH+mtF*>MaB0VPj7
zGI`AKAwvc?#FCFCv!>06j~N!|ofSvUk(;s#xwCI*<kZ;<o_jf#VA{XS>VQ-fu6*&;
zS6}}SpIG|W>Q`QU^&ju!lYRzps7sMAYOZxSjz{q68SBc#;QBUeOJldOp{b*-xVs!+
z@*+c3MP^A=Wl3p8O<h$j-Ay60u}&N^RC4PU6B5FTL&Ai&Zt+7y^inUiQsv^}sC4m4
z3>pzKV$8TnQ=>+W9yez0qfb2X<g`Z~eQe&+Cmx?QWBRnIut&#C8iN5(q)kP72?Q>K
zX;VYo1p>9LDSvBKXJ@t5w?EHLf8OPOX=RgkOs#E{z$|^XI^!sFW~(J>u_a%ITaI3U
z<00y~rhM??Kt9;HW%s__2aoLCcj&-@Yu8e)-$=QVifEymH!fc~fA-Ar<3|r3+-JK2
zW|z38IrGOKuh-PzQ$yO1Ki;gXVUc#Fu(Xk=R7|6x@Pa<LD(_{hWY9z2LE~bNjN5bQ
zO2)~QiblPQXuYp1zrCI@)#juvvM~ZPpBY7tGfyG7`vAad^VxWOGlCqkeRGHz#?03z
zSiZBIu{r}p`Th3^K#DtCPFuc12BZvfPEs%^EIM}ToQLND?kZ^+IxK3`*s1eT7H=DK
zY$uQq4zInqWbVx2Lj%;R8XF&2R|-Gbv|+<nIy=BjnDott4PURpU-}sUEB%Z#Kl@24
zjsy6#1)0Nwt4cCUD++Tf%Zp0d^P5`hYdhNO8m(>h4Q(xrwbk`Ch^#8L@j-r8Peg<@
zKc5xnXZJ=#^yTL3rBw}WZHP8$YphBPnzwY`?3vRhJ@N4DnX{vZM@5BB95sB{h>)m<
z#*UjXaZ*CU<f&6<+xZ|rv&w8nvI8`AyVh*3w>4GDc**6SOj%VTCrR$l2hd3{Tfqm7
z93PZ&d=SL(!G{C*;QsWE{q%!5`b>`g0!Q!mxAdxhdQXm?;ppo)`e}blU(!!Mf}=0z
z=p`I|)Bt*Hj_&bmL*!AnI4ML2P-*y31N1v4*H-IOo&i}%#$gilOT+s={muTXkLIp^
zlDqmJ+|@@6xcWp~Jpr?5CT7tDNYgk-Q{STE;-ah^l!MR9tIR8;2-Bjxiqg`Yoa;GR
z6eFO@LvD)erHJkCDZPH-LQOR*?ku^IoP4FEGm+nmT%xhorRp<#cJ64dYc3wY{kPwC
z#AH>q_Ut`!;%2OMxfa-AEpu%+E8cvvvZJH&<Ytx`m&1zRc{D(&40!aNM1J<=l&n~?
zUGmHmkIo4VjtnkMfcXNssmU%$L2yK9*qnJY9*ZTvXk&>EEiL?w70;UHEfRT6o5eEw
zpJ&B~Pqj*=t)~tr`U3hZQ=8<jUcl%D$y|ZPmp<g95I9Tu&1&L@9jRC+4wl!ImDS0E
zS*FLxim%r?`uaN7UQhIu^tL)_q$*-^5Y{$lR}ooFR-Z|su4@!q0!a%lyn87t4)&Y6
zc=0qp5I^w~%R71YbDG}lUEb$sPjWGi_tz(TIi!XXJ%M!+G7k>|UXQ>n;Z%Xv@3msw
ztBndd>RgVRS~zXgfgE+i9cm%QmRbd<c13kMA;y*kZ6XWGL@XaV`q7WRwXpWtI0G~k
zZ@3IJGeJYM_YNw^zLAleotBxNo>@>~$jwMIn!1g>MmQUr>zdlKkMBN2eqy!AD#-6@
zhG|ZxHWQhJq+Cp)`Fnu?KYQU+_k{~7`a$ysbu@MhT>||510tu+U#LhK8#>69baZuf
zRHvUkA$>Tx0Fgmj@s=%zfBF35k3ZHq_qI2!CSh|HJpYe>`~#R*i-VhvC1HBi_29+t
zuYTjHM^>$RB*Idh8G|YW(gdE=**{Vwik!=3+t|fStcWH1cyZ(-wE59Tum1CW<k!^k
z90DU_tub1PQvWt7!TLTOFzdTQG~ZAR74Q&?f6))><%@+3PXfE7z-sIzLSePJuNP4o
zy?s1<MJy68qGGkEHEIznDOeY;-cBnSY_;|QOAgSk7<GqOGFYz(_E-`-er$w0lJt*=
zkBb>OtRQm8(75?l>-<UKp%Eh@X2z0rS`veM%*>R#`XDw>C+KeJ^2501IkYtc-QR@f
zR7!CthAdCdNlof|9fNUt4C6Eg<1`-Q<YT%KAg{Q5Dx0do*DfRAF8$p8!zYt7i#tS6
z%)Htg+lbPXt%6Q$)AXoLT;3^!;nbw}F%{n~@0BY@L~hPb%gPXo<-*wA-~W0nzfI%-
zZB8s+|8>&mTebj;vF_)aMMXEatYdjuRi-3KfiPs)Xzz}zcI7!CcI>FpBP%D9^P~jF
zHR#RrCYbRkKp8mEJeQv!E_NO7jd&pdMw`fI{1sECAm8cdxIbQ8jK2<e5TACHM9J?J
zw&#>L8~cQf9o<CX<AB^n^|vdaNQ#X@0m4wjyKz&^7xwSJ&?07ee%6j8AHNQ{pv~m%
zBvC2c!XH946LS~iz>`PLofu4{C@U;>bdjjXw}Gxbt)L*S9dvyql{%ng9;DM6Ii0qh
z(`j97kAg|6<aF9wXqlU<&tODoY}6+h5gN@*bJ;|m&&e%7PL}kvw42+1J)Cm&@~H=n
zQ4Sk%p`)E5EV@ix9XK^t7hQPJs71y-@#J&Uyj`S%W>ooYZq2!P>_Owm1CK>coP>bN
zh{02^lUdItq9Gs49`_@EHNv8*lb34(AAK<aQ4BN`@=M;T7go_E4?iI3#f|@Y{Qu2r
zd7tdB(lI?PQvd>7VM}-THtGhi`Q(3Pj7SG(c}rP?;Z|mKt#^o{%sbHOL9B9))p`h;
zvk@q93!V*}imYDbub3yYv##dW`SYo5H8oudYfn>SYuAI=$%3b8>#^vZC64tp+`6)+
zo%}6-#eqX&!68e*ArrwNvEUF54QYN5Pi$iK51hD~ZQJ7F9yI6$NI<-7ne4BIHxA(y
znX>fs|9u_{j(qXOk^gZnYdk&E(jGKO?I_#*S7V|<fP^&EqE?y(!QRfE?waUvy;iG;
z$lV;&V-`<~f*C>o|8`dUbF*5-&1$L-ev5g`GjX%J;?AtT|N33dQFGQKrmLSinxppm
zFKU@)Al6*XQBR@Qrm9{Xf>w~bjdy_~KSs$PB$1jq`Y`U^d-|{L!I9tiudCmyJrr@&
zLpkd7e(Dn(b^6~>YdC6Oj=H*^I+LS5c!&D0cKDUH9e%EDhriJ7rR=rs@H?gbI_>@Y
zJe9k$H+N-C|CKwrD`(%i^8Kk>Icg(E{dhmMU5cN&Lw$dpX%p3v3T!&lxAbE>eUtX<
zO!vRydG3l%+!Z_euPEZ~x8cqe`>Fr$^2q<XYV}|JULKjo-TMUY-o^d*&gbqu<IcTL
zv1=jo2WTP8Pf+sT_5A#BX3<4z(@M`ebN=kryqb#QTUSnQTaT8-X}8nQAG*?T@V^XP
zqLQ1Zk!AOa-lw!r)MH4$`P=STp<E)nm6evgIWlHUAX9rg4L2n=zV?sRE1rD@VA54j
zj~Fy)#M7%--cT=5QXDx&zT&TV@tODI$*<V{o|hOV#y`Gb>9bESizNp{*~gCGkWO6^
zOEzn58c8z^)?5h_+bZ6dXL?y`Bzueh`N@;e;@`Bs$nwr!D5dIw*1Mv<qQ%%md>jS6
zolPRf(q5HQ-O<`6@l&Bo#Nu9ab5BP$bPS_&%p(Ad8(Cf%<B;T2ueR{rotk<Wlewcf
z&%;%%aFO(ht$D|9PzfV;GPX4K)L&A9PBAPvc$f-we2q6%g1GrlXA!OVOf`6k=5DOX
zphL_g0?f1z`Iuc32X8LQVQG11spgM!+MOLhKjwPi=u(Nph-m{_-Ze_E#k`9}3lM*D
z8zrxvYlwQS2DU)=5ENx=YvBp51sARbYWYD6I*z{PF8%%atBT_<H;%t%_4Aj3<FB{x
z@K+$7KNKrwFrGgUR}aM1Rdscxr3E#4*_D+wt!1_38mo0EFDKYwAjxpwg$vz!+02=j
zE{%`;G|Q+M8cX#2vYW_&f+&mC*40{~X8AR0bs0<4df|Zs|NQ59D6U^hT+~jgZ)d+q
z0$DBp^l3yp^JkwuJDVkE^(xdQDXz$=s?E>ONiE98_CU)Q3So@rBh0>$C9QguNaXL|
zE%6V8rA+KMgoJRvaANtLPENg0dpUH0Kb|E3&k}*Ppx<KcU@+|6d*jBYO=r%mTZcXS
z%dA#v&dta`Y+GGxYob`AnK^URsLh+>V9R@kzik`BKehbdK3ct+<v*=UN=lT%SYU&`
z^7u?g2k3b%OP0hkgjqC4OBTji-?P4>C7Wm|i+^hs85ur4mo7c@P+J><Rg7pz(A<j0
zFgmGJi3&$Y#AdoCB*<j5W|1ZM#}Hr@Sbm8TX)`%qq?|x`QG)v)Pz97|nHt-jQ_dTY
z8>HuYS{;o+4w^E;_%6Y_mhw^*dSDoOU@}ItKfi)2P#rW^T7Neb79jJVtv#N%#iCQ(
z?TuDI!t@Tv4jmYDPq&DII!<HAF0s5}Cbf?19Wm{lq^otq^gwGiRd#iB#L)~e{1$Xi
z9J+@v@yNaLB|WsbRo=zGU>#W)Py5UI4ofyA&>o`)?~$I1dSu;4RiV4xXP^jG^dK)y
zqttP|D5kxrlAF`?YK=w{8GE-ogMv}J3q8u4=q%H5y(*@?Du)hepXIaAFR!3qwCERV
z(VmGL47%GTM^BzPclOkYV}}nOJaFjH;iJco?BDzQj_vyn9pyMi+}}q!<az1s(<=}~
z*kv+yBbXU8-LmEm7fq&Igoxgi)>Zs9Uu?#VScqV&ufKlSI?EbwosK~6p*Ug?|4ma?
zJZ+tiIPi(qSG0Gzj(J+A6L|Xe7FOtZ=wQHcWuKkTI)xNF>p!h%O#~0#?dN#f&*ZFd
zr9UGZ{raPbrmSNWI6@IzT}IN$FTe!6k3=d*krk;8w>k|jp9VS_;M}_-K|!Mko%MeF
zy%-1GY;I66IA0>u(mo)HkRbraUUGyt$l0QIzB@+dp3e3T7%42QBPvW<%!ttz$Q%@?
zZF`sX8KaYqj~H3LUV*`riNsRG$6GB{-kRXM<2Pd5@Q88o4=-7+R=>Pr(dd!U<0g)u
zG-8-0FyihsVM>%bfzn6gD$*%1vd;dY;jU<@tBZ%pKsg_XhdbyXs`*bu*NFe~1+e4m
z)*<lvEp+y?PSoJ>+1+8c3j{8syep(G4@nY<KuY?D8v?@peEX0gL$+<(_T&2XKWy3Z
z<DPqF1}8AMobk%L1xd&N0m4{M#KQuD!(q{)MH7RfAAa)581=wmv`rWOqD2@OE;qdV
zZgr7?0~OCrnMB_pnqCMYCzBqX3%q~Spu1yY6FXccc;($PA!L9U@*N$WkdOe#{nN`<
zEPnXmrxWgugH0@PwGfndD}ImxV#?Oj)E?T8gt_C5WT-XxWx6~;JW(Z|)^6kp!3j78
zVH~*~{GV;9bgk1e298$C^WvxrIqE?iwZq>~-|DBn#Zl*T)G-|O;{Qw3f3_jpW1~m~
z9-G>b6_*&;kjv*#f7(zZ^{0uJVAZ$vSU>Hbd~w8q(#|K$5K0?|S|v8>+eR88)v}~N
zLW=rf$7m3{ja6ZchKCi7aa4g<sqCQ%E2yr(R~fPkXn9j)?gEOhxZnt@K+FY_b|LcD
z%Hs<N@ebd(F}$|?%3f4o+JC*gwzj;-6NPBpy2@+GR#vY@)s^z@u1*K!n%%v7_i2O4
zWduUl^@N;=qbY#|C%paRR@jqjIj)HF_xARe<wKLqm-&0c{HIrs9y4ZyM&1Q0cIk7^
zEnhN9UUurhfdhKtjYuU!Wo2~@0+wiAhRVtciiRvhx?pG)dQ=zXQ3*m*j3Jg@B)~_Q
z_w*_ROVARdNTTKJ=;*8tXBGG*a&F;Q49W?RyM0Szg&iQ-ZLz|H5%AG5Jbqrb;ddCH
z`M0-5x0BU6G8WcYW|u0~`mBy$U1!K5MjhWh#Bnq!(b-1H1^rC@-F|4v1ro#syeT!5
zW!}yz&Ce%?Sv??z5{aHsy2T^6{%h7b{2|9KfcM^K^-NMy9L=VnXH3cQOdx4y6#Rm>
z--gmv%jy$g#QBNVn9)nyT1cN2Rb-GZT#sCrJw5mPihC{^3$+k;^8)T>7Vc&`?nVjA
zZ%cEnt@mo1ktNTiudBJ$j9xRhHaAru?!N+g(OA8|*(_C%jvk;gdpd|hYVPRh=_5Rv
zSWe0(ecc`U;PK;s{<*1Bip+De&ZeqNppY`Fnw%%hnKNgCbJO*o5q$I0Ra(YAW$f4#
zRv?j)Zp85zyNOgxXzb!gf?c)5?Xh?)FgOJBJxLvMy?vy2+qv`AS7jChOhE>V%q@E6
z%$d<{vbyi%xtwBx@9Sg{*f$)c2mk#D)HLD;7Ze1e_G~9=M(Bic2bii!JWcCQKIV-j
zmnXw;JlA%t=B1FaaWHM}(+30FnvSBa;3CwkyLJ&7pf6s_NJ~aa!{oG#%tEkOVJ2dH
z^!^fwv7I=GkQ4+q)^?-B(NV@HmM(N-XCL9q9reM~6xeRGiGE{yLnU$>R5r9Xl|e-+
zYijSNS-5%Kq=H=|=tM&@omz%=I*FsBQbLSvXs5M@NK}rT{^^J@bHtc=W6T^eW{!jr
zizqMRB|3ZQ%%!uJ5=BNLRzk-YNg4#rl7<dZ5;--JtR^IN3i-{NN4~dalPzRrEcr>x
zn|&DU^{iIZ(`IbzX{!^7iIj(w8lup^u)xs3nW6yFTMP@ZjeBLdwhY&%+3RJvHi|tU
zF9p4_Ah#^ra7;@OJ9T2_*61cJc~8eI`_wiYl-gM9GM%8NxXy4zOL`Dp)fVFDp(VvS
zuGPoT>Pob_2CdFRtMkBxA?MDy^rh|o?YG^jy)Ng@ojiFkt)#G_GVS+IPo4VD@0oS=
zg(aB>QNf1J46WQaZ=9Q@Prz%ux=+liY2Gwzb91-LFe@*;QRU&pn1S0(WRyyHWyP!K
zj(F&y5s$3GXDmadrPD2iaON(6Epsij#_3jtrINXJZMvn(s<6(6Cb<^>vcT$QDdd-y
z(hU6a&Eal6RW)ATil)5hSrHP=tz7Zsi_}$dlo*(Lw>Yc6b-Gx)W$WjkK($I_($eCf
zi9Id+<a}D%`A_H$U^zc6ZQQtcB$+8EU-Mpj3dEaGjc`8`8af>;c^(e3ufT$z16bWm
z8u;<?z*}gsyOGL80rAsz?MtsMi?u$-PNqo&aXe>zmbYU|VytyFKgmDywK({OK4w06
zdom;fHSOX^9NgW#^+b&f%2Dm9tw`8x7S!YxT+ggg4nck;W#!Eq1-X@o(Zse*D;Mv*
zT*u>^EiR+y8d)_3JTp#C(#AB#@{mhwO|w;i?oEU)TxD?$jEV|$?JFNVI3gn2!#{BN
z)M>Mq$H%XDbY#SkK!0^~L<D(^Hh7`1N9kSBCK()$29Z^yq|93>>MTTqj@3E20fPbp
z0_=MeYKNE)PIwudFa?}21)LBD0?a|Yqog)w4Bkuf3k^UY8w&GF3TamPyu#w*f&!%a
z{89}#GqN)=2nOuyLo!LEDx-zT^<hH?`#}u(4IX;vWHOvt$tMpDJyaaFaN)wR;zL9E
z#}PSuoIi3TGDnuNgB1#?fS9`gl5X!ZLsL^IzWL^xBUQv}<|}y3^deP9zHw@9cGCM5
zWT!z0rDYe)e{$LL&p*HH$@vBIea`*+-~T@6GrvHMh0InBOuRyU=+K8B0u$#%*A`->
zDP$}b+$N?@Jh9~^6uccyZX@Z|)7&BW^fn29JC^*+Z&j&U^<h}<&<A+0s-$^v@LpO~
zVSq=%P*GJ{QH@2fx&lI_lBA#y?mYUP&cF(7)ra9v%v8L4xO;eddg7h$;Y6KYN+%D#
zOaZ~IkRcT_4au@K!WR)!AAZj7GZ7K;B+*8=8B4v*6ERNHFi!n?u)i&!IW04{xV)+y
zH;Zv8FqGtE(@LS)*#>e1Wj6Uz8EQHSg%X*R&q@U-xI_Pt3X=STzWeUGP2cZ0=p8Z)
zZjI<a{`ezH>T}?dDJUr7mtP`CDu~l6OxUptg?v**8Y@k{LPIv!@4b?oL=MEmTZ2RP
z`rN4ti<>J`ko1vGNF0hMNXi={4F?V!{nx*a(%PBwquajzY6D(heZB1{E8Ugt4FzPf
zclNF%e_OC~Yg0{Gk*!=BI<?YJT3c6z2Y_+`HG-A*b$9h37@)VOtGkbtn!C9_y3I-c
zj>wA>91`f`=A=*}W&wW<88%eN!(!kN65>FHQ(}ZFP-2`w>>B7!`_?_sHOVGhAJq`@
z6#8@}`g9R^e<66^%aa;u7=|ylVF_%XZH3bDm8YS&m~Oc-CGraLii?p+vMirg;3_z-
z^)MFH8!bp5WvnkSk{%P52q~W-rXDiH&F!(r62dSS)bifu@~o>DFJ3&n`IAplQl!%1
zk3atSNO4onZ`jQ2x^;^b!HSWTbSbO613MP0PD)eoca&#cN=jmd+fFqJd>6$d1{Q~K
zk*}cf<hDfbn>UTd+m|pUavLS?A#wAcefHUx7e+@v^9;kBi>E8P^&|fFMvut}&|_>-
zw1U?mB!<GM10U9U@rpMVM7lak1v;@n>gXD|;0<^b@jX0@yT}IKsP@w|Z_f<dv4VH1
zePkR$Om-y>ftpulpfbWxT2@|Rn;_Lt0jsOa%8;S7u(-6MsutA^>ul3Q>n0WltHtO_
zn}e5fHD9a_7K>S>L`1B8G?!X;ACeDC5{K}3|M}0A9=g2o1t_N=fg8hR%10leECC$H
zC=JLHN#wLzhFDDG=qq>kp;5jtDw_LrQshBp#J*8O-Q8KG#?RYH+J~IHeKIF+KTRSx
zha51695CJk)>6XT+kzGCC2XB1>v<ce<1?-P!syAnFvVgCxQV}N^n7;}DaI$Oo*${A
zYXcG6=jH!jZPGPg2EMef`GmI({s!w(TzRmb-{yyCDJ`kh^Lg210X|*V^8*{8lxm5q
zp1)j!ge_X)IN%Nkwq~<K9;U6mj$g&-`E`DfVf2~#UfJXgd@8upnn2H=tRaK#yF4ZO
zPl@}YIyuebM_YoP!O*t6ZEeL`Utr*Uw<g%y<E_kwsti~HS_EVdVYAEe8EuZ$5T8G_
zNyp@FoAYdK%Is|}wY53k)+PmO(^kvvt^SBspXXYAMne)F*y?MxRzvKqF0-`?@Bp5i
zDowQ29DA#upw)R?tC5;J*vtOszxQ4r)aoC$R;~6{b!c@4*J_C7j-{4z5FH=dtN%UP
zqxJj_KY)+4q+ZXPLhtcAe6G^-qi7_QmN@JA2^wlRCEb4-?|a%CINtX5diA^&w7tuq
z&DQh%8b~ERA+<z+h6wPfpTnsgx_{PCy8tv$!Us?Ut~TEHlQ7t;@#7v_7nY;Bz4)t1
z&kyyZ6`c5Ge5CQ!-l<xnKwEM=>%h$E{B7THtW6;wf;J=NZ5F&O;H6XMX2INoz@e18
zS#Y;t`7+AhEZEy7!~fhOw&{d__z#Y~S+KXDu9fmPi%}MM)lde9Kk9Ca0=-~zJY{h^
zI=5ffS70=-8^_+0A#`7uZe5_Yb9rLC^#$T*eGPxx_&kxnGJ7(f+{WmM$c$=jAirrj
zUQZN^)r<zS|EYBqT36azk3-7Osdj#+Hyj5n>hpGvr*{pG=RL`>JiT+8KJ0fJ)1&;0
zUhvFP%Jm#Ny8qtqZT&U-3=P49)7F>4I6>!VjIB?=`MkLt>vOGt0=Z9_-`09$1m*t!
zFRlN<dzZFuMSJw#btu+DCxNZ?kRUn>xYql}k@kCkPW=I#F<LL^=%w?3#XR6oaiMK~
zhd-*22z4Bt2`pxUAR&%U1r}4`9^Sa8&3kyGzs+7fe?<&!^D?Nj^#Z>zIvZHb20?&7
zoenIfgRRYeuS`GomdZdauM?Uu3}Rv|;5emXeZ@%*w!_JSm5Q^H4F~tXtl@IE+cVR6
zxKoW3DI;tKADn4nMVg3%=WZw|GZa9*D1w?%Qk<6qrK1R2<Kyl;AvTN>K2<XK5-Aaj
zVBTcFOoZp>mq20mpCPGWLBYje*029+duqLO*yPDmqMc2q<HzIZLhi8P*zx1Z`Sm?=
z4?l976?zSSe)XzV07!i)eD8%RUQIhVwc%gF-<rH8zW{*rmv9xXTK(JzFSSgE)E4e~
zB27)(zj0$~YE;xLnrp+h?I)i)O!aL19ckis)(8a8Jx6y~n}|;S+;h*(d&pDLn4gM-
z_e|k|1XSv@?V{i_oM@fJ*JbdcCc}VFL5c^6mLJ8-0OWp_bt0R<{m#0Af1t3YN5?a_
zRqEXhrNxHIs`~nJ=ozJD)yUCYT@J%ZiaSb=k#3knpi=bpbQ7Zq+5$|a#NE+JiByr^
z-Y!tLot)i0QIW|7mZ!mgNnso3DHy94A*lxLivrWrQO_}r<`2q9PraU!ay|8CN(xeN
zUP6+Tl$4aqm&pbwC1Q~T*)2q{B<cjnEH32fqztirBN2%c)jXc309v(7<mb?E>*B^Q
zPUPpF+Mu0@hkXRTgJp1}zJl}f*2iGnehV_@HM$c$%*<U$dx;(_NmR;U`|08ZD1tqa
zwa6@*OcL?6?Vp)<5WR3XQDHE&b~M&jrDtbnHJYO67IhtehQN8nY<K{^LAH<MI8MUT
zyA`AKB|HHL9L9A%XSGvt?RPOq@7azId5Hp}PLR9Z@a=6KO;a@$nIXA<dL2J|H8HRO
z#lxB!8xbB`k2ETsovlsHot;p<y1P5Okes!vi>}pDqltzMn@mW#F0jyiu~2S_?VBEx
zF)>i12?z`f2+(LW{+htxu(063L1AGq&<`0B77klDGI-AVQzKCKdM)=fVjDMVFX>;c
z`d3qaMhjVsRR|hhBGvGG@tJ`z+CVitCJ28)!(&wB20lT<t5y+beCl8SsQ2#ASr6$1
zWqLMHPcU-^Exv{s&d4D@KBqHYfG5U@){M4$F&@TUy#a1o1?hIDGOhvOsvOkmxSdx}
z1p5>;>f*w(?EWoxA-0-Dg#~mICu(Y?Wv#6`v8B(_*W1(9#40T|YbwpXYwk7mTJ+@H
zbZZcJXDL#Dd)bZ=*5$IK<1m9&-9Ec>Yr`~H+upJ+w?1W`RVyV)-|XDEbI<nmxPJ$h
zjko&1X|;g=@2x4#I$r*-$k_Q7NFK7fSVgR|=JdB;f4?4nmao2F|7|j0e-F=K=8`-{
z%1mM&wH;xkikudIfNY)~eq&e8BfCf_6G1KmBgIvAs7Kn^)3C4DT!(<|{6-F=^FP3a
z866Wze&COf2y@X10!K#=pB+!WLVDRmRvEqc<pr~6FJ8QO=EDnLeKJ}f0taGEEoHUp
z%5s$H#eS@;qPVVqi%u&iVmm_jjUs22gbG%j7~&KKSC!7J65>^0d(pjxkf#rE^ue|q
zckJ!1c0ousg0h`mm0oUYr1^JuQ@gt0<*Fv(|66O^9s|rmMrz=x)$oZ1LV1{mQ7Iwf
z>6Q{agM-Ic8uBsB1qJ!}*`*Z~#YeS5vCVtN3Q+(Z+(SI0qYoU|y46y79wz&96_%|$
z&vE0%dGfYGLDflDuSOY{>zPFjy{rTya<+hpkB>*TetH#q7ALxc#r1YQisfA}f7Y~_
z^YKCKa6zlpUU1+;sJtlj^$i}3tZCdfUO3;i5EXirhAQ-BWo1=WT}feKS(;X8L_0i&
z1t3>oF_Zo$p{b(iAy7KHp}W*-H#aZ%@>LO9VIy{IA|5MLDv7Cq+`I2`wXf~S|1APS
zn7)LC25Qgexe}yVT3kqN`da3#)w)>gD@?52vQNx$Ftb0a6IK|geV>JaA4v+RiJvE^
zDzRHMsV|253#c!~?k^yMaM)9_*tLR6e;1OA^HT_V`v=Z7W!dB;&Ut-hz&F@+vuF(6
zc(m{YTIjDl>8Qd};)Oa=+!*py=_q89ntCzy^2M~|<ck;9i;O1Z4Te)nWE2xqR}XRY
z^K-;<<LTjh;zWA-qD31w##-MH&YZdF-|MKw5ZW=T6(uG8a5_EX3JVWIqBtpO_3A4-
zf7_;)WM{+JVK()2CqOozq%|`bnT#`=*D|%WlaZPEhAlWH2eKL^hT?73#&7s<Pj@q8
z&rS`GoLd6!YM$9?DRy0YuZ9NOOerp|uFlI#O-04=q9WuxudRb$4Xh^?A?vk{fr$}j
zMpV5J$s~F&jfNV~@#^ipdGo@B@bJFUQlxRhdJ1)37!aUQOF#oFqBtPHU?3<0Zr^<b
zV;pGx&Qa*aVDNu1`o<*#F?@#7w%Zv6IVZ1O&AnEZMSf=!fdpatkUk72p)ipurprWa
zZPG<CpWT`cyG63q)nc~Ju{J}d^}v@NYn>08c9zM`rWH4txpNcaklK2TVEOXS!mODP
zGoQj?cZfO1++=njiAON`kl{hZd=DxW%ZwSr5_gvQ?z==65%Mp0cUAI4X5ynzS{0oF
zBIJI==d<*;y}gMp2E&yrZO09_^U|_XT8?Mtrst5I_)#~DWMI%RZ9lTDI8-B~>%+Y$
zv@5{%V@<dY;W`@|CCnmZ(PDCeRaB8dbaglZ*V7tqehAS5^}GtvXA~(UM4z!Fk4<FB
zQTp~WeLG9vs@X&>^@=0aETjt;!|4VJ8pEly830R=whbo0Y;urY2Rm${C^~xU*6Q(}
zW4AB*Y;4Kat-wp_kYtSo=!l7lNo02IqFT9*nTWiFr%-|C40Cm;?Hh2|LHu;yJlju?
z97)6l>gr^SLZx7&b#+jR*I{NP!t@pr(&psb?CWF<2|@4a7)M8zh*$<*cJBE?aJS*O
z+o5>A5ZrAD?$$XkH#d*oG0IV8WtPCEOb)R8-d=$~$C%A5>9a9~RK9T|$`Nhfo^6eT
zOW+C7#?e=|Zzn&q{G6P}AJ;Jmki!0idG^^v>5QdIXYAVb!3RNS<1tGvkxaqy(I0$(
zB{_xVKmYvp?K)=hVisE^=G$)*ox%Rq^l7S43aF_R#$0Io(8<hZ9de1Ys2)gJz}X#@
zL1`^$Hx&Qzb8`3cg0T3nU)jcE0-kUJo^TGHkj4T{z!UoB<mBdHB(igWW6#MoRM+Mj
z3^_T4<+<6YTziOhg5FMr3oKp8C)rfhC=%)Dd|*VPMBi_}-E&~ari~l-7Bg14CNxU0
zCpvn^4l?WeYk0rRI=uw7k5MZ8qbE(eoKoB|>ZO--Omj2Ky!29{VAZN;URh0RU}9L6
z&uH2^Q}>)m4ti$Su6N#%pxgw^{U7t+d51(GTH{@1F{*#nx8@$&vPBb6b83Sv1_#VA
z5!yLII}&|sYinw2VVA9~EHAIEG34dc&@#6bMKyJ`wTMG^f|^Y|yl~u_c|2z?7n4ax
zCkSIQCHlhP?db`-r>EM*#nZ!4Dn=b8Pfu5chZhRmMm><$)~liD)d=(|l_jC*)ll@R
zD^<QT@c*@Iw{BfYxpM7hdIoA0VWq;WvsDjy)&uy?8mXV3%766asZ&~7;;3RQL^_7k
z*Q!|(gx|tTbfiP37p`9I=Bf~`aljxI=cQ*IU%WUmaW!>|e=J<+S(pMQ)=uI4Ihean
z%vilGxgOcUTc9+paiwZVJ^pV4^1TB^2$~z}(IZr%A_hdI#~n$4ido|drPdoMI(^}k
zcN;f;T+|>Re=@-)MFXsP>3U&FiC88UJWv)G=;SY?Z*KH$3w^7w%YyswNJ}9)AZ0$J
zRv0bsTjD}bCFCkSsmVy3s2mxE9;O*CXzra+cE0s0DJjawyfkEGr)CtDmetf18E)Oq
zMm=MS;1fcx?=d0|kV&bD7%^h3kBLPY2<sZL!EnJ)*KJY8THlnG-#B^nKw<WUU(_5N
zX|+K2%O$`awZb)P)_i^VDw|-*x5}+Etsg)h#{*XtX31xHr_PtJ5xcsMo;buuY?{JI
zp*rS}o3L7M5Iiw4VpwkiL$D&=Am8xbeh>57L<i@n?bt)MK*6WE<`V@^KmN~uK0$~4
z6P7o3uyBo6dwXY(+1%4+H4AuM?I^z5*#>Sk!CQ|=G$GU#iP+3aL~Vv!h;^+Hu{;5f
zp;V16<@GI~YHAdC_J}2arjmh*CmQr3oSMvs9|A1NjIh(%diDto=U00UJv$#g`zS$H
zBQJveJv0fr!N&`GeftTLz^kdkP=Nwm<~HE&IxKt(%5l{c=M~p<Ru_6PaADzvU&H0y
z%cFru5}~EHr^W-$x=t15n5wg+<m%q7Tet4LS^|Krdg#!h>W=E1YrmuP-tX525B~OB
za)up@RIn=2+DI4n##W+&(u?{MM;nRjjDO-a!<951{f}cyi=$qxY`F!e!mSpia>#U~
zs+v9o+HpNfg0G^7aC^N{Ic#M-*+viX%3<5Kty%>umlHOnaNo&bp@&}!4!w?!cy3p!
zSQ0=C+gZG}8%O|P#M-1VFF`#V2=xN56KQo2XLV^OyiVLKM_rHdn<u<Pt=QSOifEos
za*G`-79(YqL_jCGKtj6v#A0}S07nv9;Hz)32#Ja3*y8Beq7OTkOWg-OxyKfc@xVQM
zj9GYW;cz)RPd<F%v0@>rX$y-P2I+Gl%c<yMh1@8xYDh5)&{u&@q`4>uucBt+6d0Ps
ztzrGMY#<(3%gZ6>>4fsajKpG}2(Gl{k*<Zk3ttD5@%DKJ8xjfB2uL8f!C%88?u3!c
zC?{YyKy?Ed6o~%M()5({%NdtbPM%8EL9K)&Wo6PkzvWB)_UsMa7!#%ZZHJb;#gZhJ
z_wmPspB?$`=~xu^`Q?udv_|>6WGxh?#jxu9gn6+Rv*VsiG;}s})pvC=q)CU;7+7&w
zndX%-gT@Aq9Wyy00rq8<1hCB5v6vu`5<~2Aco^<}2zYr2c-gI}nEHPpIrHHfMj@+`
zva;M<a*U-8PX_yPT0R9%9X>C~t<~g;e%-in<InlsF5cem#z~X*?19@?Fk!;jU<Xzz
zZ$5wid`8s^b0#DSEj`6>7RSTLi9-<=7goM&*O8h{o8EW>K2pK;>*-}(tkn0>Wy_Yu
zxmm7VPjW-ma@+@2s4BQ;OG;4Avbd&(T%m(YJ!lLq<iTf1pC!p{h#x93L0bt44AeNP
zRA%^wJv@*d?%toSxoP>+nBQyb%O!j0;40uD#pzQHl~!ZR$$~BaaQle&M{!6s_h5dR
zqGODbFoVk&9>Mxdy(WQrru+)iMi`e+ymQ>v-{T_(_BaKC<>tapP*hw<H4ErW1_SN!
z0Z+=~p0u?l6%a0<bYdm-X(=f;>b7o;j;1}HoSc&1!Ad)wVq#*VyuLe_oFw!eH1V;=
z9-{?6aESBr+s3@{#`7a=Dj*-;dGz|okq`OFSZVp5AAkJuOdW6Z$Rsz4`>LtIzM{OW
zf+`45p>Qwg^#P*~cRL;ZKB*e3AHIiO4EjKXdq@aM$)VTp`RV(^dG=l(hq*EiYtj@v
z`&e)r%?Ib~g!zFvV1I#<$8$o3lM0k=2RJUbpfIO2J^zFg@CS%76#<+Bfk}k$P<fZ;
zp85Uv-%$s0tY1&=h0~`m7k~F%c(|Y6zJ0JJ3oc!{QqalDyQD*6V`C$|Hy^q58q2)4
znkB3CitvYKqNWQxv&X8d&C@w8`Gd(Y8<7p-vuCrj7cPX`K;Y-+DQ;)wH-7&Qw2Ez6
z^?`m!u=E-5Jy5Tn)e8}SikHqAurLQDa9R=t68ttaK$omzY4t})3OO*gcmXL#m|kd}
zM(l9)-mQIfd4LnO4gZ8hc+QY`CX+@ZkwD|6g0QC>_f10`+q%2n8f?s9nT!&al-T!S
z)K`U0!|dfe4PZJku;+L&0+AuR_;yj&K`qaSy|f^Dt6P$hqK|*jVhoaWWY-j;v*wbY
zt({2xyGlzjOZZ<WGSrpTmp9&|c5bmw<QO6e7W)p>@&ZTzhqSxDjHG)#Oq45R9ZnSS
z&i&m8TL!-NC8O;#hUy|?amN(nPIZy77<Zra^xWL6VnZ>K-xZY<=jNuSW*1-vV84)s
z{Cj#a`mNX8XR#(qshhvo41fotM<6ip`pS+}1W?~>SB@IBeY-Mz>eQ*@0+iSnu#lRP
zw}6a0eL26uoG8TrpUSQC96x@%UX`7_e7Sd-G<NCIr7@DSJ$vF{S51_aoram^=c{Gj
zBpQPXp=w=>GMDeZJZEgE68;`)=iVe*Ha^H&TU)F5X=v!^Fg7(bVPKjYn>soymabNa
zr^fa!BQCBNgFS`Ro{%VoWI~Z4y0YtiG#U?&fJlEwFpF>8QV);FNIwMzOXT7gK)m4R
zU?o+U<}mh|@vMN7DEm5UVX3i?HpSn{G=HjUz$9by`JR3A2}l*3!pvfHKMh=gSK<mi
zd60+uccH`328}Toi~gq-?S`TMJqoI7s?gt+)qrF`NiN5ORF@VP5aa;4Z`XTVbZEPA
z<j9fhttc(Gb*n=tkRD_F9WIh|R(#(smwOt-lb(F?$%!I^eJ3h2oLswh?N2ENPYBb$
z?q`q6{M>v9pn^QWUFzz}im(*rm6TON&AERUdw7PpQ<I>2?0mWixWU+FvY_@9jJ@Lf
zcCBsg8;o9Agr0p(!zY8$E01d!7iZ!GHlx#%Zs2TEiSLX!(4vBz{KA6U*Ryg<N(!^H
zVArF4gjGn=&zpp3urKi&HF@gf<;$;KypWt)ZM9C1lz>;nL#My_rok|Mxm{xtzP)6+
zl{jDpMo!SvR!>&=)?0oa4uZevM<T`Z7v-jB9n-=pgg^}Ph09W(!pq%fDt%x(^sYGb
z$tTY|b7oTlOu+Q`P_XSxHx2HYLTrdB6bAEQro#%n*t(eP<t<Slp~GMDxN}2Od1-ld
zMHzB@*H-~uR#Ts%g^dtKRYqq+7*Vb!Bn(?0A5RYt0KpJ_5~lId_=I`M!So&z7P+{D
zg?UP7esHCy4`Pe7LTIr)spnZ?Rh3mF5&p%XaO>kZj0(-YF%P^-^QXsvS2a)rY_GrO
z*`)h3txI(Do;^2i?Ah}})s5|6eDTG$>s3mn4Gt@-f=|uQ*;w@h_Lw?{D_6#iBll%v
zn;GR(Yz2~&<4|YqQ&r=k0%s(dcgjDc)y|)P=<@{Hu{i!I*nFrF8%v$TM;}2?`O7ZW
z&__XC9YbT8p{%N^svH}!nzpvOO0YZ(7L70hB;B9Sog5u~eCYpDH*pUbOBgnlb#QYN
zbz<%|^@^l~hl{tg6c<xK&3_9N8`m#J|1LxSzK8x@jQ*v_s3Ayq10|~j0PngsDXo>@
zCT**$fcLEmrJkGHcof&Bz?6WKr<n~in=O2aTrRToK(`kuNt+31Hwgo<Pp65%3U5RL
zFtJ(C*C)_x!&_PfUYakz_<Bb+afy5O*=OTi$n72LzxYz)#cOUR#!B#ZrSa<3s3`2&
zSh0J!KlmnRn;qXI*nFFWE{lgcg+sg~91t(V?HZlb*aP1v8F}i|NWIXv;p~x18S(Hx
zY==dBLDV3!J05|GI0So`fQTn3^$xOEnRPS0OyD~>e!+qTQ&90X4(^htv@qDQ!a=j2
znl)?bWc=<2_%?9xKa3*Rra)<W+;%)?{Yd!p;lo#}x^+?x?!0^Q<lXuqsp(lzkxPpU
z3$jy>{sEZWA4gNO3*pJl&&$1?k$UF9{{8z8o;`C0&ciR+FoA&A*VEZ)vVpoyNID@x
z@AX&#h?I*6yggz$=`^Bf9p9`U!gvhw6kAc9QBK;+3V>A1FYV+jpkx4t300z_9s^#B
zIwE{NQrWOxbvfliq1+Lri(LgKqCj1vhQ^j|q}lE6)k&pj7fw@=$Y@_tC_<R}KdHy+
zac}@d2s=}rq)O-CW7YW>puYbBupV&hR#OvIPS0G*!|mo@I&<WgufF=~mm_D&98g}@
zq3q0Nia_Hqns4wnq0G2AdDN(6u&(9*0Kd*DZ{x<<&hlNmmOdH{(G>mY(pRYe+P2pq
zA4^|ZI;rL8(W5PsmQKa4HH{I|18ys=mb`+n#xrMTulYX%w1?3Sqnh#m0BWbmME?JP
zY!Aa02FsVD<Nttew;34z4&r`SqQ+vpX|+5mQK{DLD|K<nudM*WvAiZ<rE0Wx;c=Q;
zi=`ISQlxksXIQ!@zLZK5eB|*YN@*gj&U*K+0t3@?PW|x152tc7D=G>c5RnoQ;gJ6o
z&CI0HAf!M`p%%`7az8gAP*MyJI`r?+VS&DiM0g_fh+X6D+qZBkFxmUzHKfOW^09oe
z+3e)n372V`j7N91$C$#3SaM2Bv7Yu&1l8K(nYCU}=74A2aWu2ulE^3&df)oe(z*fz
z>MWKP0+g6@DYc@aA}6b=-qO*~1>g?r427BkO{s>Aj}}W$TX!PWC4G4f4aRmpN-_#M
zj4druDw(&px5|AK&(wW06RHF23>Ce!q^=t^C0j~LN}4<Csu0d+?4L*dI`O@GNCP=d
zwXb~YA=bkA6-7@5a*>{VY=6;x_XBA!+Z1P1jIu>!*=bWrDVm_P{Sy4$ffC$|#l&DJ
zZG?>m&`Ojnkqi1NQCPkpud+`dlPesh5)t3p(b3q*NpOh+l{NwaF?9l>$<RQPJ2DA%
z8Rb$01==L|pyqBlmT!4?Gs84xr$7D7Q!~6;3il!0WM5&6*Ni8hc{=@eBP%?2Zt!3#
z!EtrcW7LUjZX3Y#;Y;kYTd*vY+}>=L>JHm-AVM_Z9-IVM2z!cQkSa9`{o@{+KQ|6Z
zP(Bd;oZ7_;e8(PlB3u<nI&S<N2Z_8=@aWRlpC4^2e#>`pq4K+b;&xYEJ$(4*Dex~n
zXBXTb@~@Go4<~a%9l~8FTM9uxJBV=dI~m&#VBxcp&z(Ac?CAc3hYp{*SU|&_stYcj
zI&%2nzN5!ZoIZc!MphOlzY&>(bq&aV5rC>v>piO<Dra_f_c3<)-C(wDfqNi_8=IRE
z^8zkHo))>>(ZSeIT3k}pSebd{R$U$1g8UYAp<$`czqh-qx3{~6;w=~jF$o~fT^ylP
zmF3h9l;590es9KnPR96uhWVU?`5e>S+}Z(~98ekUZ7od=5V&>qjjbK6P%{i=war|t
zQCVXL0J&Ip+FS7(a5sH5G`BQ2)Cy2y7jDNGJRUS#Gmr<iYCtB6ukNMK%(q1+VV&m@
zb2pmk>NfRKyf3U0NO{$bOuu+_n0ffEKGZ+z(SN+YZ2HKNBS#E>C^7=IJtsZ!?7V0%
zCvXy?m$-1Ho$b+2O+j$R9za&;u|d7yA^G)f+qRuERJHo}L{FUPsZzLOF1VV_Z5XAr
zMpSsk3^tm2T>^a+Isp`(ZX;}9&<zAnc#v{Cyy+v)uMU;=`Yw3?{rBg4cBTLP>8GCq
zy0q?70L;x0KZ)`Wp9*L}=~q7A=dll_!OWRYI&4QbsUsI1-UyYKfgKSHg}|o-I|528
zn-rQbBN`gx@Fzc*i)AH+<k^lwQiO9l3e)R>u0BU@18mYkb~4nA4Vam;V_;asU{5FC
zC|D^*3~~+#@o~@zIy(?L1+hlMq~7ISCc~-jK?A7vk*^iYhdNj6glYE=gM(+>n^O_U
z^BDqy>G31k%HwzSB*tW9q}{l7;|8DtH&fFyZ$X91zMYkJBMn|C8eYZ4Qx#|3xOwv?
zp5$g4egjEQU$-*SGj8Pwa&BcpBE?|-L$enEGGVKTB(mxGR4DWj2UMGadO~AsAsS>-
z5iD)k%@R1turA2J%5nz*#a!rPf`eTYehNo_<Sz>h3JJwvhldRwq>;dD#Opw%pdLPc
ztoGLojSPad$R{8ubSNrPk3@%z85!M2h6sj)hCo`f&aEgNH1KAG0-jD_?Spc}`nR;S
znMkhy3nbJfA=3?c-wofg3Qj0UZEqjDh3PHKjn6PQ{s6zeg}Lzt=Ei72ZwsbFQ(JpW
z2kJP<i;G>HorRq()#aG#m8}Aiv#-Vr(HdewFZjBp@KR^z*^1s?QqP9kqVl>r&3Mj+
z%loM_@Axev`lGjvD1`X2iRXX-ccInH%B~_6S|1JYC_SiG{=WA-kOY^H{r>Z}8xRLh
zai2?teSv|!=YF0Fh}Ar6g6(+R`Y++{H!PlhuCdmC3D*9w?@(7f;8{3iA8-8X+i$<V
z3W(KdXs9CK4|;&BYRSGlapI**m&xP(a`g#!QoYkISH-_%A{CHNu&Yic7F8rCCr_9#
z!Oy6Vhom?`Hu5kZX2R&P0pjok{J{mJiyn-K5%EWbh0U6YN?K<~F*Af&W;>!tEj%*2
z_^W1xdQC>ER{HB|lA)ajK}wIW!I>YDb*OT;V2~~r)^ZkZF&?(eI;p9(IXQXKq`2n9
z1RIafwZ6kUZyq-pUL20gzZ0z(@9C*l2z0XH(c>mfnuMKKj#)oi;TC{ks6qaI0ltpl
z%n>7C#dq)t2#=&XhDIT`cC>a21!9?^7rezN0(^W1!#V^LN~l24-A-h3#9f(P$2~$l
zmeV4{7$G5&+4N$>M3#=$*3Mo=z{-qGT^J?|mQ|%6-Oz4@T}FTq1ve$WYHNdZGV+KD
zeoYrAL8q~`%23J2D%m2$9gG}1EIfShV4;x6@U(4>7KvP>^YNYXcu$X59N`QlqDAN|
z=;)(dipY5}ug{{BH389yBGWxRYF7?tx)412G<ft)@aRJD=o8@4@ZN4(#ZaLD7PP99
zrrE>GSY45qdOf2ANolLATTl*|>BGjSl(J?2GY+voV~2U*GomxvY@MMG_X!SzRs89v
z&u-p)q0cA&Rj6ezO>}KJyY;8vCymi4B(6#`ok~Jiz;#)v<B)L|FODBSj_m5+fbFa$
zp7ZU@CSDo|k4j}>qfTf7m_#B-6kE;ZkU|F!(qGV!<JX7u=Km)iNfK}f*QGZ)#J?T~
zT-Z;l>lZI(R(DzhG1eo46tw@OB9+sG2^TJ$b^3s2vZTkqc`*XSkFK&a%?qN>FI899
zx0`ivyi$iwV))_XspzI(e+4)+^W@>(zXRsB^XSzZS-JT+S1(__a`o!D!+ZDcJ$UpO
z;CkSR{z-e=K4~2U11BwJH_ESJcI(5LHWM6MYPE}}r%EI?wPP*o7C5WGj)4N6SmExi
z7Sq`c3oYQzKIJEOAxzbHtBJa*dYjA+JdAuh(n}!yHBTp0x$t^AO^KZLEyQU5Hv;4`
zb@LvgZ_DZ175di9atM$hP|$ib)LJ(P{4t0y#Hp!?y6K_XmRFS-ZZ#D{d`nxKp()^j
zI@<Ki<;!~Mq~NAqTJ7gMcI>0NI1m2Xclap>P!%8+%hNL5WX@lQ1@8>7;-jpi^t|%s
zr>2pu@Wy6B4Nu3Smd*q+$tHMUc`M(<3U-5KHdpErtPk6c*GZy2j$9-c^-e`aWmN!L
zR9DwDw6s|&I#3jq>Fv`Az~((BJu_~c-l+oa1ME`aL7+cr>w%M-0j#tCCvy3NP}g=X
zIu#ipp*IJUSb7owB!iO}R#Q$Bjz>?uq~TE4@#v{|!f5=do!Dl&<1u#sA7{*C;AQ}R
zf#+XRRZe65@G2=Qud1%7t|)<}5ur_GC515a9rtI1d~C8A+7O_qJcPI7WMxdfG}_(T
zONdGlId7QUTLWz-01Nx9S7V9R|J_%nO`4Bf4ekg_>*<qu&qH3#nJ%*4iwKXqVucwj
zGU^dkBW(3hp~SGKxR`TtoMtST%QW7+P(ZMzeeuQqM(3E9-+AYqCE?=Y-@ecjQXOl3
z#_@A^cX2J2_?u~^mv`>iv*()xV5noPiPrH>Y-`NRFTcEGbYSPX-+ue;bXy=m+bonr
zdVIp0kKXgE|Mz)xiMf|F*Ff1*j+ruL(U|f-nq9`kjS3HSVQd~mhvj2Jy>mBj-h5T;
z8x9ZdTD^a1ei01{#jCWqC_k?-udo!BVnoFu0IagMI>q1G+ebau_|FO?G~iqePK*`L
z0gEUjB>qk^1!O2D2vFJznbbk*;G}kkZOK{b<f`^`8~nE|aP#MRjPVPY4R2#Myo@nk
zj@b}ZLgDg;!knD_Uw?P(dP+fZ>a|nbemb0qN|t!#6kgnS;KI$+<bsq7`!|1g0uzl@
z7#k`IGN280hR%qIDP`5A&VDB3@V#AF+0Y4{GIRIA(hC<#xx63$WHx0cM)CR7`|cv>
ztthN9^<BySk2Ewu+TPezxEI>l?h+JJ=lO+5KhM6_)n0I|0LUd2kG1lwKtZd6)XmL0
zX59O6WDEI12LJn9AAZGN?3rl1$z<y*<djYzm)|&&ov3s%QBP}ehuq!ST3-_shw1nq
z@o8{lOW?fMCficMP$b0n;x`@(GXWZZiRJ~}Dh|piw)zH>6}YI$$diiEp5N#xQ}jH?
z+O0qW(L?ZczIYh6P`2fo_tKzlJ$z!BHQk9(Mb)tR!}eI|K5?w4SYF=O)-4$ns;FzE
zdxEBVgTs(uNmskMT&fJ2J<kugK)FOB6B8?t6+IWBx6Y@4K18QG9{b@!Yinzd)oKF<
z%>L+UeS%F>y-c<<k4f}VQYXp)u08>gb6$Gqt+4YEV~Q)y3L(7jfZ?i4l^s1zB?V(5
zP6xcd>d_Dpd@!s+rm%E$!st+wyiu>8#5!Bg{&t;8V>5DMU_ypJJi*EmD^0zzhPQmU
zlU>T*e?Q%Xk%z!|7-NIe*XS*rq<9{jl(-rvMea{q!O^NX+QA%cDo5M%H?+z3qZM(q
z9)CmI!_mfb*X`o2Tg=fq{0(g@M>~?E&E{y!INCvfLwn!r+Mn0;4lP~H#F&i(Z5}%A
zs!!c>)sx&+eeO`+zn6<RS}RApg}dXc9PPt@Lwkv%6>zl09IcR}9rZV~g&gf%jyB_-
zURK?qy&v*e%kQSFu~y5Ep}c|f&y+cEE}^}Ja~x$4JM#E1TA&PazZNKu&=x3@Jh%lq
zT(kwsCpiC183pGO$|<x3$|?_TfieqifpQCNfwBv2f$|G&fild4TllMc=<f&0HvKJV
z{u{$hmt&@zrjCoDyfg3~DEH8NpzPD%0yyu_C~%AgWgz@AhH?;XfwB<JC6tF~3zUf-
z+yZ4I+5+Vx+5%-H+5+Vy+5%-IdkgpH;qzz!0>u;bINby}PTio!X$XiPBxTeb?HrDF
z1xI_3qwT&!`xjh9nV8-=<zjm0l#S_~_wxW{<Okk)H+S_I?&?2tS1;kN9`|=wr^1z9
zok~}Fbt+!z)v0{NIgSe02VUJStr+g=L%FM4xvTg7-PQZKmr~QKQ*wHBN>8s&8?ayf
zRq)<hkXh@YLA<8nk=LL>3<@MREzxF1r=M*8UYz)h&2mST89^Wx$&%vyoE+1*7hagm
z%gxQpEiB2snq5><N|PFtmSkri(jpr=!%BE+F9$x;TUD(WBl~|<kCEZCLPj7F^pep4
zNO|+y%B~?HUxD9(1%W6NaN+We^qZGX9Qfsz8YW`ev}rxbb#<NMA#rhWj%~Mo!RtZ=
z41?NeR|jfO6T0|>hj}_ymX^2lLD>=rn3|Ld^2sNE6!nHroH!Ans#2+c+{%?JCpdol
z<)@$M#rURxA2j`+@vsfzP<-^<tXYd*gG2Jo*H$ihF#+GL!}k4a=Lk_Mc1tCa`1mkU
z7ThE4Aq%;Z+xSQRzviI}fizpd{Mw*XcNAVflah6<xvB}aK^``=fun{Fg~Cle%pc3=
z4(S3i0IFd1>7ORUz`^DJd7rms(W_Kl*{%-^`0xIv-t~dqEv3q4SygTAwa;u31M0*J
z*kaTaS9aHxmzI=Q0RvWASC@&x^kyq70j#>kY!$hyQAo%mxJx3o_OUR;^q7TYG;|I(
zPgggZm%|Nl2gDh6Cm_B9g^dKM8eC{rLMH$u)h>XFshnH^{|1uT4aRx2EfDHtRseRo
zJNm3bsc?<2u^XWzz+^Ig?Eo;MX$K+S0!7Foup(uF-KR!z@FC!_G2k(ZgAW6bx!f99
zdFgUy=9MeR@Tm|CtiB{jav3(T{L;>0!*=dO0#MS6obvV}O!y;-$wx-cKh<G6#N_40
zQIM>b2B(p&u!P=IkqKWVx!hBf3HE=4PPRjTV(*k@!XHU4%7N9Hz+euvLK8UfPK_p(
z-#~hLxc%vSc-DX7S=ZrNsg3O|JgZ|-ku9$b4c&y_xUB3Ht*A7CId&}0I>EXs-~`}p
z^?jYW$M;>pr@R8>k-+u>8?Jl`qtDF;){Rv<V3dM}4ZD6lr^ZCHR|UfHBofJbn!5y2
z<&fBMzFu--G>X*jo*r=8czC+2;nN&r7Q15jT*c;BUR^qiTD)2c_Uz%8ojr8uP<_Y<
zNnc|b(pHqUm|dql|NQe))#ma8@IoG}Kwz<>MB;$#G-3rb-!7iBw*yZX2wnZDiIKv*
z8(Bq#6|F?9aFA@+aI`@hGy|b((}SdqM>psn3RTtPuIp8yp#eQt>Bh?(BbU#b^3;3p
zz4z|Qf4((;-g10;J~p)LINW3>x<eOFMik~D+p&?igv`aWikv+C0f(roHRKl7l(%4y
zy~1|9uiUWv$mN{smOh_{BHW!sBo3tC3f_(JZ2K*q;`XiY3U;)4#=eVGz4|fb<)w7e
z&@f{7or{Z2Zq5>kv&swr-|dUnYs8Kge5$UjC@aB^*Os~ihR~WS*c(`72jYYZ)6zzc
zjPO%RoaDMd?1HR(i=(^3+}(Ej+~xABP9heY>TB(3;A-nlV*MBwSAY;4o#2|VcJlzj
z9TdcPdNTflF~c-L0Uirqo<irE+SOSFdkS`XZZt~3!wsN7?uq~?7nRhsv^Dc3wkyI(
zEp$ZuK<BA%e=ob=6}ep?wd>L-%hh(CdlNi2de_M;Jbky!TC{g>3N?1$Joei!zwg=h
z{U6(YYLq(~@sGDJ96NUMz>nLHA3lBwyS>buy?cq49ceaqwYE8^B|yAW6L3!({4|X%
z?VTuZVlFSgb@_T}7Lx1TIJIr_wNwOW7gkiGt#bY7vT6Zh3ZthC7oR+tk+L1|oum2P
zt^vV6|9ZAiJS1imOl{6><*B<iexp`&Rh;_?qo0AiTIX4v#@OQE=k4t5JZ8+85Ub%N
zz}Z``mcV~PoSj8|LT@EsrxYnv!<VdBv0_GGcUoGSvwm=hycD9mtj}8g)Kep;z4XyX
zAC2~sv{e@V>x0*(SHr}Mg{0giEdEUjk6$CWRmKaQ6;C%tWR38}kxxAZ{~;S-G6}o`
z)i9=F7PPyCPDlICP8}KM%n+H()YvYU3w6rAhP+z`a7TxVO|YfQ^rM9g0v~E_9!YML
zNL)|>#%N@uGPRGJCcs;D`{;obcth(ge1(6+LxV%ydFHwXIJ{sR6R{&PrJP;iOonL)
z1~Y-9hYxmoUj6}$%1OfKE1U&&opcx3)!v$#jm;)(@UZ0a^`k>Wyueo;;nS8NagzTi
zU|46533rjG<~;WB_(fq7B|I;Iq2U2TVx|pJhYp(r2Z9UCx?~ZaQ0DIG=IjjgH*T}F
z6%cx%km;)FaC3)kqNgG6dSM5;RxVYla6<|!LYN%;GcVm=pUVe_Ky@35VZ&)7=Y<`N
zhr?g)xFV;|tprC>t%9N`-nL7@0UY`1rzxpm$W!~atpDPRq_yid_A}(g<2%-`OG^6U
zi!ZmGyJ};}Pd^2i??rahy-aDg@nr6`jEvldfjpUh`*ub~Rn-8l9Al`LfGdZ^3>BX_
zlX2qHPd`0nXmtz@{^jSLm&M@|qI~`Q6m4ZU5AXQpm*5b`j@pagZdiXj<IEXU8)h};
z&K9YcC&!mk!wE3KrsS5Ey7s$l>Bxuwq$Oh60LF}R<CoYOv!!L^BjC&Nf!5R`N8WgS
z(J(t-mN|HZ&v^EYH;x>+Vvc&`E?2g+kSVzAK(18Um@;0}(ozc(em_$>^7*)I$-V(>
zIY!*q1hz~+b+r*bCqhA?{9dWAZ&0uc|Ms!Nsjx@3SOgZKTTqa%kEE;5*w)e2#}5uh
zJliOV#L>;wSW(9DrL%`GH9$yVz3m;ymQpW2B(Ag$V9YUNB7wNFG3L`xE5gB-(;xB+
zLKdcHr#xim%Ry0N140s>c_unKGBkXgjWeHqn!L%fZUZ^9&c>Kh2S-OSi<n?LV>&tq
z1|o8bx*qyj)8^x+`|SU=8f&SU_&j}^L*GR7Z4t|@%B$_GGR1Y#Rhddi*IR~y+Z6?w
zImNkG4<b?W;o}(@zXIdB(s$jKEn9Xcug}Q%eJ|pWPo`W?$uCR0lyc?tPW(d>P4tc&
z*)~DhEAj1YZ-IDhXzOW(u!P8zs2$o`yTFtXiq#c`V8zsHo41{Uz`UMSdj0aPa=mLw
z1<zOW{g&O=s^ud_jPUAh5s6M9Q1OF+|7_c~?R4G=k*Gxy6ck8`t{>VpBuw32oVpk0
z$A9a-!Q-(=oMA1wx)mdT(qIjNzyy1G`#H22S(URhBx85r3^3!8;VOklC*mu;g?%Dt
zz1v`cAw6})%S)z?aKmpZ#2zgzFFZW=RXgjc{}KN}ON&Pp*p>;N_3G*?7mH*;<6ep9
zk|zsZo;H<A%P__{Y~<8u(fagIw{}QO$W3*iw*a^|8AXSfiVxwg4&2IX=+lXWa(R2B
z3DS}=)>l=v)V0DvfJILwXt!8A<L8cr$Z{1Avsn1Z+36z_G-JPzUv1>eyy4=CdHfMh
zS~{ti0DmtqqmPFp@D_dGPlKV$)!6}T3CUPlUJYi<PHk=PqL%f}I)SqS(sGzaE^(MS
zcWPvS1D4mIF|+5)vA9IV&6qJGCYsEdvvdmGbA%3?GRoOAa$MA~Q2@=%nm3F}%P@Dh
zj+!obPKCVQ)>cSN$W3QwH&1sNq$L=gu_|yEDkah*>O@fb^BQ{krKJuW_6{W8zw8ok
z1vt$4WGXDNIXSm3AN_y0d++$Ds;zzeoasF?$xP~m^biOkp?655il_)GcCp@z?b@&9
znlm#L3+lBZVgUq|E>)2l5JCwM2<c@qnMv<`>iItVoCLv(aNqa+{QmjnFquin+WVZn
z*Is+=Ri3q(fX;naTKaA}`xIj9o);l#{?p9}Qw}OE{pj;gKmGLEAC4ho5+3UOBip|J
z82_7&dVhDb_v4JgNxvpwyq_-OIL-4{j8;>Vmv{N{g{xRCpsZUL7W%~(Th5eGh{_Z+
z`h0u9X>Y~62TtC7VUN$(C>%04-g)WNme0R{_AhNMIkWwnZ@yib^)V5ELpvMV+KzvT
zS>11y^Q;yUDsSudKmcB0wZ+5Q+T0@HAIv67);ARtkfY6q5wFgOkpm&5N4s$0gEMA5
z`qo=-J(2$4!iCz3BS(((1kQeoz_xrSMU<l_EOFwa{UC3mN2X0Bf^cYOeOsF(ontu7
zU-8?HN^~zo_X8X^-Ye*+#1`vT0E!L(YVDPkL6c^U#wHLbPp+(_r5deHAys=wCTt68
z!$|bu;l{DI&E*B5+YN=w4=fiR?9X$Y&F<6(YOm%v7BDJ<LgiQS-1zaSh?<-{`PTWV
z36OC!AJyp$LucIc@WT%;$OzKuUcMiqam<Wa=~E_awZrDzHZFDU{Q2`2KQ#-2&@=>o
zG8Ku57q}b#isdvR1n1BH52oYf;5Xp8pTKj!fag|0s(lHbi~s(YLqBi%c-fYnd$w=<
zdez$Rzh3))lXKrP(@vh;_4Aq13)|oM3R8I``*`+A9CQB%l23X?^Z_wM{LWWjef!1A
zIqX7s`tO9bd_GX*Q`wp9M0ox0{Y%*xc~jY#%BC>7i4%v0M@v_)`SO6xW-Bg<Pn!6@
z6POuPKB{bPq0E9emMkGT_Dz%<R|`HBQZ`zPEX~&clTZ~Bp_)o-87|*gW7*q6Wlr+d
z!?xe&`g8?cl>a+%J5B59Vnuf?68L-~wb2-$4GQ?531ImZ39MwM1qBUD2@H=Nw<r?}
zVvsS^7$lSZPh_(6icl7hkBXTv<#l+^re#i@oH2L7qB~M24EtY6YQYG|23<nJ=)pot
zKjGndQBhIxu>r<}|BLj#zOH+L*L8b%T{n@}b(?rym%gIwUY~Zy^=M;x+Nhh*+IiX`
ze82tJ^9ZaXI=11uv;;kYN8~E!X^lKBhaHdNFobg0bt$hP-V3hVYyZ=R--Nb_?-e!t
zNKgHU^~HR@aW|pO;c3V5w3qo&?tj|gE41Sv>mH5-W@)658i%L7Cz3{5F-&9<Vkx`w
zMM7+lS}GETR**c+YI}9wFI%_o|MmD~TQ!oW08LO{1dKX?$siDmTO3{D9^}$WrO2oC
z`CPy;rIL`iGd40Hc|<&P2b5BN{MN*f;4tGblmwDU4jyc-*bOMypBn=FYEB?>-OdPu
zE|s^N{Y!s6c)~qm%Hqu7$rGOV+p{mgQo>LGq*|_eAtrD4xA2Mn``<sD2ZUHSLI%4V
ztmkv{U?lnNQ`2W(SVyL-H0{S%f7sCQ*kjWn(AOfC?K^UbUZ0?go}W&_h^Tk6sE1&I
zyJYV*t9`W6izva*-~ZyfRV$WdBBt|I-ax`gK95NpI&AEsOgOp$XG$*mnK(<R%?49Q
zd0Ba@L@k#{J&hIR$fc;SudA-h&!T)LgU{`Tg~u%sVi24Zi64?k1sDwImV<^QK=Z*D
z!e-Tqssl$`tTk?pS_da(XkZ|Wh(Y=QSQC*@Iv)2I7^GURVbPq&NhurZTRO3$G3xUj
zeE@Uj!sw)8LBCgWG-i}Ua@>O5s~;7P3MNtZ#YIQ64;|S18-k+&dXRtda$y0rfkC*1
zB0D=T?{_GvIj2rDlHALPA}c5~2d`U~knq!wdo~_AbmaJ{Q>T!%9n@8}ZyoSesN2o5
zhzOEl>{BN&l5z8327Y|LISppnjlcq#13T|m0A%_K<NH0L;<oWfv0~KM6A!<Y<iKsr
zqFyDyc!KtJpn$cv2pIYxQd;iku2-pT=3o-#UR%c^5JDlwnG2yVO)ZUpn1PkD$1H1a
zCrG?5XCEW!ZbmFhQ==IprPU6J)`blpJ1GtUcVw*9DqS!VPN_Dttf`6Eu$3AaBVkFB
zV{^leB0;(^Fj#Q&@T_=Sjhn@rlB<y<aHGW=c~=^ETI9tOq9mU70#EC>3GM0Y(aLyQ
z@l9xbJZ(DPuZQo~%F{Y;LfgyJj^Sy`cv?G8tGx;Bb^GmqUSJg5aI7SJzYko~??Jv_
z`Aul6d0LjI-N@hb8J>31O=!>Xv?89?&eKYH+L)Wr+IZUAdD_Bj#@Ta)_WItlPQo1U
z6nP1E;JuZw2j10Wyzs6f4ASpG`im9_i(Ib-!X=~y!X`IvflL@_fp7}mTM4V+T}^m}
zv_P2U#w`$bAuSMoAuSMwAuSM&AuSM=xp51Bbq@pMKp5x7EfCfr_ds~(>U$vEL+*jF
z&y8Ck3`ANW97I|mEQEJ8;UUrjVWJziK-h@1K=_EXKp2U%KsbrCKv?O<Ef8iREf8)Z
zEf97hEey;BVW|EVuCEVuq5+5*FX-{s3Ua)u(Ldf)Am%02U+@wUbEJ17=Sc5F(2?GW
zq{F+4h`Jm0-Y++3zV}gl?=;_g-OYL*;37gzdMD(hcS28kCk^!XJ`8)>ZO~Hw4lQLE
zw3IoKv_Vf46ak5^gZC7kRPH4pRm`kbq<7=XZZ9F}Wd-*AS!AmM$e{prF@ym7@Cuzi
z?89-j?WD9xsJy+l;&-@icK=>ci}29NlXbNR;jj7l;O5QY;lO2xk;&YB0-s!rqp4W#
z6ZE;^pDBtdPgt^KNkVx{(PyL2o*iwb0+fAaFcO?C>r+NdLg}PiCPgUEWe^wyatY2U
zXV2;{^Sc_=#a2<PNYHf_P{bH<SJlPgkt&l!6*>H3RTuAn5r!R`;z&mxJ*k)Gm~t!(
z-WTDSF=Nh{`G-UnC%($cYDh|0L)i%=VfzF?C4{$)JRo^cq-9fah-l}&5OGg%USu+f
z*n<+=Jsz<d9u+-cOhKVwP_xX3EOG$KAQeuBL@ckc7g|QI&?}eLgof7e`z7%?4uN(-
z;zS3qw{)HT&>dxt3ujKO+g6IA=6*6+OHX!osRK=PxA*#FW}V*<7>M9zw)R>N?fZ6D
z8}&USl(Ze#$58JgXjIC4`uV><a8WX|=piLkk=YdS@@_;HC8<<xM$|WyF2S4B+XUz#
zbRI*`d?6FT<K%iDF}!|ifm!#}Z<u>Hn+|S1e6gUVY8RmKgf4Bel99)c50goh8VP`<
zbzb63g1X=@H-tv3-0f5xfxPesB1K#noPRQTdnfQOIZMFx*IWsn56jDd2f$k`ZV7K=
z(HY+2(Atf(0}oF-ji+7D(+YW7Al%)MR?5>h@w9H9*2&Y#uAwDX+^eIdP$HSons~~w
zJY^0~*?e8fKTbXu|4eD(>D1TI{W(4>OCaIzb`;;InD4WQr=@Q~%ks4GJgtMLE#ql}
zZ$f+Be*2$QeiK>^-|xI@`rX6#tGfwpBTq}%8ho&wzvp8-ZN^P#FY&b9JZ&>i%ks2|
zH=%9dX%WLo`n6s&&ZyUULykJn(<*q{GM=`b?>F*4Xs^X8is5Oea<r*bRu)gam8Wj{
z59(|AQOQ%M@;#UGwB0=I&DKyqcXaTylX=?yb<lQ`e)seJih0@~o_5Bc`&|qvcPG{m
z$#%RG`^}xi>Rgw<`Ir1Y?f$y<(z8c)Z(9HBmX9*oCCK{Q#J<VC;J0+u+O5AFK3h~!
zdg63WUMbvbZ!%efwuf}vJ6NH&8$P54r@BTK1_3QpK>P$sJ5OyQyTjwS{z-2=Wl0!5
z!rz~A6jymwg6@h#KYV-sg3T?X?D?flbo7K&8rdCrr2H-^%n&QO`<^8)J^pxmFZLv_
zHtxp_pR8Q722xih6SkGUdjB}C6t6{DaI(TPC@xG?(wF+c4CG7fh5@bu2Dopicj=db
z4Y3Rv5dT)s85!78aB0MtF%wcV7Tk-VkE~Q`4UV0?x$84<41NjFz0b%|M3km`iVsg&
zoPmax;q{JG2k1+WEIy6Y>wQ-E30JT81@=ixLSZ-6;Z+Kit<^=f9*<L|2vSi}HY{Om
zj85y1dSl(qVz0Bc8e4o;th&<c>q6i&Nm(%{8=|EmrN@KvXMKH*-GNTSB(9FHB|#Q4
zHVjcB?zrS>bJ7R<2LN!&qdWZB_h&9$YM^~oZ%=#5&_J~x;FPjr{r48PcXT;*1PE86
z5T?dx^})JU7mk2#xahP=DDkUy@;)r$<^Kof`VGwWbC~PDVXl=VYc2mW0!zxuex3m%
zKnhDE7evAavkyl9gs_I6EhbZaJwaqd_AtR^EG~pwwXoz;9_;r7^_rrW`q6aBq2uK)
z)cB1W87pi8oMMlZ(Uasi0VyCvVyakD*9x^UEowyIKXF_7c;xyF6`%Vu9i>5EV_%J3
zc1#4jw*ali#<J|WL&!qTxtO0{led2TdPhuZ5FBHa7{-!|W$osGzTV4+elP3s%KgXQ
zdFO=ap|{+>cnM>8;_okH#8P>Ac^MfQGW&r6i^-U^YuEnp!`DCUJaFK^(OfIg6sWTO
zX!WaIcKbKqBqu8;J^AF5!~BwxddI@mI-=v06OInV@MH-Z+(NU))rC~Oda~PA7oIqP
zr22nCnfVvWZ~X(f;l%d(lJbX(0=VIjE7NSeHG}Nl<RWGhQWmwNqn*G&HfS<mCkV6O
zK^=N0=Jo(&ZiLL4o7vNY<k40f)A7BvxfS`NtxcT-1RM($nA%JIST<thkN{F4wB73P
z1_dy*z{%)g5<t-wC_7+EmL_Gch*@L|d}0w1g9r$7P*_w#%BaNffB?ku3?CO26%%7L
zqC#OrgfYwrJ8UGu7m19Hjg3WaAn7Oo{3G)Z4%D>P*EMx@(}M20=5|J3)6#pLj(DA6
z0C$Ms{!RivjRil243CAH3AJO;;9#}7z9oo2#>#=hfQ)b0e*1bZT`FzD-S>3#dSw(+
ze~)HoA2o+~gMfvM0RCKi?&j~`|E5GHGnrTx@NDlf@MRv@7ZnA~=@k`>T_1nwVr5iR
z6t#q*mY79%3&FtC`*Y^7)G3C3{Us8xu|n{CO-&jsGTZ3hUJh9VD;*FRM5StPpSC0u
z>zZ6kDT~BUC7^(oM=IFhWlm*ZlD-QRFr@eqSC`*=->?5|&wB(wthxE{Vd_T=zcx<U
z+8RG1R4P`eB{a$xwo)_$XmnkP9c}}toOP8BnX<bvx2XwXb8K}r41Ic^Po}7?O)?^`
z$4}ed<)dnA0mn;q^ZF)1I=>aG^C^txtr*R@7|l3nd1VC`&K!rc>-V$g+WX2*7ZhB`
zIf<mO-%sRS29)RNynI0DWkuUda-m9|EwZ(e)n+g3>_lE?V?|ZH73-m(yvpA0F~>nG
z4ffXM??b`MJ*O^I<!)HLZe5czI5|1l&{bc&9~g-HOQ<7EmcrNB1K#Rx_sL}@J)N{<
z3AJ+NrgCr8-B`P~2YaiwtuzDDB`3cxY{cEq;_LMpP);|Y3c)&vTj;X#AjbxHAlF&-
z8JS3n;$b2fK_-=nRRv^1lZx$aXmBAlu)AHU#32Al6ryM1=ql7j<dZ8tE20x$NCgNp
z83LpeYl)*eS}7|%S_n)iiC+|88siLdx({RB%TmD%0#zj7E2&!0P0Bnbi~`FcvsQ!+
z35(Dr68c0cGivN=Bjdx2QHUgp3stnX>!K02ICLmVd=49i8nRdwgCbFRD@#|X3_&Z}
zkf2~hICjWX?YL)^hHh=b((G{qg}dJdd40XPj)OH62r-z@R6_CCcx%F4;;j?y-$-xH
zxgKpSPaANBRu)N75^#$wl1IstMG`nA0V-;A5_(#Fg!WMQsgCqbtAoL#_$mGh{q5kk
z`Jg8#o4148ZU?s|AlB~3A9F92V#rG`<rY+y=ly=-)cL%;+>%nPveM$*A2zIqFs0TK
zsc#wNZLcXlhg0C;&8z-RLT<4yI9hAU>WH9s0c|S*;>f6Mrnvw@y4l%TwClULq)~(A
z&9(a>ocGr@D_RbH`|Y=gbQT14c+3$Bjnqrhnj5T&xlg1|A>8)J2x;k$M3Qg1+!kaG
z!5(BU3iBc~xS-M-HudlSdi|N7w*78bM%|wYE+ds0ex<&V-yh`=O<lZrF*TjZqC2E!
z6qCRPWRkR;`~Ll9%MlFt2C2EtzAW0-AqlxJgZP=rC3tgos3id+F*dfdo{Rje@2n_j
z)D4LW=(bmP+NuyMP*vR-H<;8{z+o0*(=y1_=cc`2LjQ=~-Kz^}U<tR@Hn`P(L?okh
zt0e(^o04KM!vCrbF&b0~tub0}K#FvbLIs(pQUxu#?^ZZ>3D*$-4+KN_5F{HY(HH`a
ze!ecWS6S@|42GdsIVdHG-^t1B-G<p)g4r9WLOD41QW-ySn>PnvnXw}W5XE-jNN(<t
zJ$nG^cJL$yn~8QeS6n!b|A4XkRI$CHs1`F;TU=o;I)#+zZon7x`YeN+X#+&Lo^IZ?
ztB{|uUu&8>!{OdAb~HDapE`p5^jHzVrx}q*=;`h=g)Uk0;*0mhdM>VmzklsTPwb)>
zUwr!M1*1a(wNi`P=p&g}l|JKh&%J28I}<i@e!9LA-fgU0Mc{66saI7Rjfoix0VB6?
z0`&xggmub`^gzrRH)EKyjkR9=y#%QfmuQjRTe~rh{GaT{A2)43eAbS1)4`qCt`WCc
z-zgUF=BLeO?-UZOGMT8eQ-o5bFb#OA4hCid<kYF<rZB>@y>5xW9wEzmox}};06<)=
zEl8G<nFmM4ktn5*@Zb?64hF+BkFU_kAy5-iQh?MIVvI%ha*UBmVX)bCchhQxDGY%Y
z%?%y2UjWHP)X*J`&CMkx9hxA8v)j{u=1#&a61>LQn8o2(gTt`~4TV;0>27ytC&W%&
zb%Ues_|fyw1(X_1Q^~1QWXdX<kmcFs5^Bt{!&aiG_N-XZUr<}Pe%DXSNF3`!>~r*b
zY-s;t#PXJcqwpmuUwm=b>a5RKefEh@tTc;;(MWb>=D>IHBbCivKXI`-Um?$Ujo|qy
zR4Vp4WN~YUbE69<Gsc*nj+8lW;7K;JK+by2h8_ZF;YR!f#AR1UuP$U{qMY(E;$HvI
z5O{8sPN%_Wl!&BqfxFvmm=cLF1+f@$JZg3Duu&s3#?6`m%>XEk+Q?=k!ZkNfiNSzr
zG`+O2f0V=+rT>i8+Q3*CSkv(BW%8|*d<$pz)p329EaL5l3wR4&CFmfGJ-h|a09sxq
z5A;UPaAM2}@rjxUrHQ9w37v_j0?yA3C3!dB<DER^4}6abp4M{{+D4vM&(luiY0vYt
zH8-K{xA|X7+i&xi+=Q0p`<==6E9d*I<ok8qgtm{ToygPH^R(4Gt?nkY*X_6ed4bY@
z!*Q1K{Vu+yUm!4$30B;M*3Q%R`$u;1_k5bCoqQA8vplVw@3)<&mGHE&H=*tK=`7@F
z?bnR6_a?MCe7}QuS}RZ6$M+lZAGFunGK@U!e2x}qEm=JEZl2olAJo^{GH$en23?nS
zU=1PlgYQ|w-*qbKw|^bgUzhTaxPo0gWe86h#^3R+{2l+%>w}OJB$N3gtlWpNav#LX
zO~wJXtSCPZ#i!1l_&pCvMc5bILuQ4zE3g+?9p!o1Cy_9bcaBGJAqQ&3nKL<X%;yv}
zvl2^~&!g6MT)I@#0`W~e(N3?sy`}(>$Ed1piAK)Col_Gc1F<&*#ifK11AA!X;K9PG
z?TE)a;0jBb{!%(hM&XjbFd;-%5A6jtak3IoR188M06#Qmrxr<c5qhud$wxARS?dnu
zvwybB=8c&D9MFVk4zY;PXv#llp&(EPokHKvUANGq=s-nOFDWQo%PRl=b|yl%cq?)i
zof(x*2U1W$1xQJniSW36)Fn_~q-w~Ol}g9sDOdkk3V}_zdlf3PN~x9k>r^_k<+}p!
z)amg2BPW8p%)%MU$}gt#IypNX6^%reWMr1uQR@ci{T(>1Ry#<XYExfNXs7_ET)VZp
zwVOn@*Vj5~NhMPP?5_|DSUj-L-PPG=HVXP2<#leKS153HNI5-;?rCX4>8tKum<N($
zVqy|fMvt3<(mXRV#w89RJ8$faMXo^9vKl%#K5<<7RBXGWMh+i65pkE)d^ErEKqHzL
zxEz<N&0%!~Rn6U9t(6rmy)E@UL=9`s&o5~}^OS^_@e9ByOTa1r0;enlrx2UhkSl8M
zi6i?E%)9T%iQE(W_aUk5m;EQMXj8d}*!Tol)B~FD+4IFU?OsL?#;7f?X|+QGzGQE$
zDX()P+|wd!qyjK`daCgj#B9!Ir?L~cYZ{`~o?;vEdQP<Z=+UFA(-5iol)TaLEA-r7
z9F2`>_^+oBw|OVJk}E|{7x8Miog$^2(L=S`P$Eiv5W4Zp4<?FAHm>BlGWs~3*k`;2
zcuBpqfsWuV1J#S4jd*<{T7==cHw|iXF@25xCAiyYOv7Ik<AB^vG%hjGmMvnM`!t|w
zJrFKwfe~*&3)|Ep2}hBf53^{4!7`+?j)O<5>vVBjyGrEhbjekKfl(=3{R&uhXD7mZ
zo0)i-jCK3OEL7$mACUN2nT)7hYF}F;RNdCbHlG?u`!sDC5*ZtgsSl5hoSk{=qD6~t
z&72)M`}T$ST5$X9$Pl7~K?#eTJsVYCh}zZTlS$2C5}6OiG7p+Gs6CA}L<_5F^r-cI
zRAVEr9ZbUPr(yQ*#O#wepmCV}@QNA-xEQMm<+<|<2(TND%}@X<DzIdKW|#n1)yeGa
z^R*;b!`WARK0Etl73y^q6<Kte@WH&d=hu48imm0a;AHl%muK03N>*qzuwr}$6<O4K
zVJjow`YWj`@b8~~-O7lzUg#BxmWy3Ac{od_bD8~X1kc8}(om>qgYZ5aGNuEIn_N9q
z6?G1H_T+!gVVY2tQ_ynpBqKOUKa?@BS_Kc$<Tn>v-U+vrkTV>XBamjB8VKeZh8Dpi
zHd|8@DH1A>L`-1hBSK_kdB{RWFoFpYl6S&G{rxcF(b3T{(V@d)qj4%8H*Va7(ZfPR
zQTcf06|xxk%%oCXOg~u`LCt$IlF!#ziBTmu62!I`6^Rom6jZ$6YlGVo?m7I3U-0iJ
zxfMxbtZcTzVqlS1Akev@%4V|`78Mm16{Cz>S!wCMtRSbo^3sXyQ<q^UZ7OQ&tINg7
z<#?{$$%y-!>@7|zROpmonHgh~)_uPQzRcf!BLG5*xs;B3W_rKv;R~p(ANULXU<?Z!
zI$=b(HZ(zF96~g9sYql9mB?w7d)EvKk(8r>qs2##6d%Qha)}{O&iM7Z#gec<%wXK?
zTW`HJL1dQc<cLo$$S)|J4!OG$6R?R~;uq5W;fzh^E49fU8{vfosn~vb2F!t9VS3>Q
z#br`H^~jjO$Wdu`K9Wv73y-KsDrjn>8Ihx`OOw$bF;Ax=P)LwE5I>)xX}@fPA*rEG
zAQPLYTQaBudJH`V&}#E6BXjc!+DakP5K582*-(D|=$<`$4jnr5^Y@<vq5H$nK3ntk
zmk2rg{M#Q6ojUyM{#`%q!NK4~bnNp|t}Z7dcXs#md2u9S$!Dxb86rr%P~qJ!AJG3z
z;)YVxzpA(BR9b{BYf<YhBrF0<66miq4MK^*@E|?mBBd61#Uz?5WYDl7fvWHTK#L7Q
zFTI^!l$kc^1riaOmeF0|;axO7$VGA#Ru|*2>+S5tQbHZ8Og57?6<)`(0_ffT=tM7H
zo#h{xIcRt5Fn~+5=tAy+@Usv-{-<r_59&^ydL&OhhNoULK;3*3>Py$7&L5yw--KGq
zQ$No4E#mv$GC++TsQ=E%31q;>IB@4Cp7tJ|*3Q%J7@$QdlN&zub$h<@)beYnQBDKB
z3sIMAV8s2nzEdf<y|^*&@BN*D-gVc||M|{|*=rx}P7uvgZ{zR%ivjA4n^5QT)Ps5I
zCZ77z0CnO`s2h3e7kTQ+KaIKQ3iZ`dBc%2vsa>2Ugbj5ciO)zT{DSuu!Z6FS1U7!`
z@EbK@nd`*8T-63)n(MW}^9^Z(FwTwJAQMR1AiRV37Q#H_K6vgSZ4mYuXakaX0LfwC
zJ~#>7xer(n$%KbU8)O<u8$1`0HV7LHv;iLca~l|szq*e<#)B}^Rc(-p)iQ9?z<r<%
z!cNPwsN{Zzy82dlmLj)8c#5xX{1-Drm<oTGOt^|PLD-5s4bNAk3Bp)c-N|*HhOicC
zgYXt<gD@9qgXb>N24Sxow?P<;v_UwGv_V+x+L<9t*5Ag}c8NdMSHDb3MhjRbEocA|
z%{IW{e@K<T7zrW}$sG`hNbZ1$L~;kbOvG>0L@4&(!3|_fEZ_emzW>~T{@XyzOH^WU
z{_`ka#aD!$^iLWf{qrr5{z()4{bzu$h~4r5@I(gISq9M(%FAJjLQ;D*s<}e(LZ&tH
zU#-vvib(Q$K?!hE88NmHB(^dtR7-<Bko)HJ0-M(9WqnJ7_O-&GKm4{=!j^AX3GHh0
zzGFm#J6<!Bz0=pm>Y#Pc<*qlgQsK5^#QCdMZ*$$ws2Vpf`{E;u#qz-y@1JgG#193W
z{NbC+7TL>503EMr^0iNgjq=}sbcD&9S}S||<;BydPoKMZ*i2~E7bq*$2bgOaE#sWX
z<qRX#kDdWMzAs@CRo(jJoGEGZ=FOWh<*qj}0386gk?{37DgKtI>T0-JkxgD+>mUf3
zcya)cTWwa9i^J~SP(zeEF)I+^XvnBwRpTsc_$C!HBDoZb)Y7Pc0KgHdH5xUluR;sf
z2axn!Y|f|}2Sq3}kQ#imCODn#Da^+6n2n{FjVCZ0PhmF3qHYMZ39G%Xxvi~^9G9)O
zy0-S7uBN)Cvco$L6HnAhRC7K9mGxv!&gqLdJ{Mkw%VC*>7Rzx{5_2?)Y)RRGNs~sX
z5zO2L=e7sFD5Rxy5o}y1iWfUQ=CRG)TtM2OxZ&d_j~F>&!pV~*npEvYfVyw^@Z+EM
zqwSnajz&QW#&DR+cJ?QnsJ9oP5D&54dKxAhyKR;A9o<eJ6B7ySfLnr*vRhb#Glk35
z)y>LQt=ePv2F-fni6?H0l~nCmW%di^%+CeqPv`f9L`Q{&r6b;IBemRk*Q7<yzx>MU
zuf6>8YcD^IzrSltQ0s1Vwxd=v?(Ga-v7?p>GEjJqQ3>?JVlRKYrBvakQwW%V-`9Nc
z>8GD;LxScp=vzfSK9>hai+8DaMUO^1^FB^zpC*^+%L+jR&Pwl^0kcW~gRNynmoUsE
zl+0RDbm9EjJluONQi43D0DxS!cVoz$Na7~hxb=;cm02!E&0=U{W_YC|Xh~mrd1*H^
zF%^bFgo*$_4_6_!O(jLKY^lgR78OzOzgmUJi&AY$@-bm_q*4<%eCW_{oi=DNZ?z5#
zfesfQo-lF<65C=20|OA<psIn(XNn0{5%l}es3?N~_X50P50Gj_-d+zBMtpU5xdkHL
zYdIG@G#fm0Poxm<0=#G{){5)|xF(Bgte4<m0E%wmxl0I%zjUs!uz*Al<ex93wlZ02
zcpwl;faTukWIbM#HAH4ZcMI$bz*;CQAg3a8Y(heBD|pOW(^!O~^6^Xd&33=JbLYlr
zH*Z!YJ@n8+iM^YF*=bgU#KtQG?k*R>i_yLN?z?9^I)GuqZKWEu5JCIq&=BtEam_b!
zDgkDp&@ZRfAAcO<o3t1$&JJus>2_h$nl(*O<=GDQZMrteq>%SXojtC$cA2x6k-zfF
zSUG^*k7bdEMfNBhz9rUX;v4MjsPAY-A-d)cKr`0k_}SE6kK*=bh1ctp=yY<{33wG9
zLL-DiQtb`-5l$D22RFxRwNWt;W2qyD5nsG6COSmHAqFc@3Ni$c{>G>fN{NQlYKc!S
zN3|nV+x(*;oT=mrKSbN`^Fpe56KSo&+U~FFE8-4e!jb}OwJ--Je__$OghJ{y6E!Q9
zLNdcN<dT|%HK-FzxlF>qV6B0w;j0q`M)H-xb!bZ;DL|X>f09ES5)WYCBZ;(PoO{r&
zIQt@LS-hZ#v@K{u>w@=Z^|w!lVpDk?X_oyY2<b#;S#+DrB=!JsL~9VhK4s!#3kG&O
zW&iyvIgPBbjH)KP%!pyAfrR(w4qz}6Uu2fh&_W6pX9*+Rq$CPe)qjd0F$!Zb4tJv+
zQX7ejQ6Po}th4qGqyyKswE>YFIr#|4pb8i@PTB6BCTm%Cw#!A+j1)iT<dikK%prRH
zpxBg2sZ(ce+O&FgM8pRlyq}zW?!bX>VKtOWSFBjI|9s94Mz~^y6dCCF`L)+}?AT&v
zBt5R~`jY&UJP0dLO6cb1bPf`96Do8(pN=XDA5vfAOurkE0Mqf)3g8`l0tn$<)a%$c
z@H5>_f&{paLX+wBSBWGE!QIx^*3{J2z`5OCSJ&BzZ!HKQ0aB=xML8LTJ~9?TrxKLu
zBR{)bu?7jkEWBRSJa@ZY#0i6%7*c%0Bnl}3{tCb%tS$E(BMc7asDguQYtL0nczz-^
zj;3QAXJQ-&Y8(ZX+sZE%5mQNi$@w!EO7lsz;-WmVw3U_F+2!T@tCFFstI5kEaKGk7
zeQH6l!!d`eOfj6TU}ySru{Yb;5#%=lhXY{Ek7Aof%_UN+_}DS-MLtfNL|zuEfPgq(
zppFWr^z_U@kXJqiP)&L0d#GO4htK$ppr>b2DrYIlMKcBl^?JD%`S{y!<Yfs`h!qAu
z73#YLsDYxPLY$0B<rhdrfq-VXO01+@F+P&YvR<zxNG6m87!?WxuF3Vm0WyKVzd`}y
z9^$%Sm<B8-_aYxLUwHlDiy~*LYpw7XFh<bwj$uJeAs_TqDnvWfzaXx_s2~8X@><to
zj610(L$bmbgMSxe9VFM4SJpR_mJ~XgU~Ot^ayXjW!O?Y9#T6Cx^)?j!s)P*fY-y>4
z9JSg}FCxk71)gf87=PXfn~>cO#lu=w0(<niW5<r4f;}5f|E4-yT~lLQx65lzu5FV9
zg?_a1w^~2QMY_VzuR;Vsaf$Vpuf8^hiR&wJ4*<{Vw;ek+Y}>Z&U=b4Ul6*cfwxCNe
zG#smzp=J?a3)n~kpE`nUP%xgTgF=idTIB0!?eX}`qNJY7MWt!jg4gP9i|;_(LHDSj
zpiy$9Y<c66IrSa2PICEDnIJLaxeQoX$YmD1^wL`-jt`gcg<Fu#2D9JbhhBd9&2$2{
zMSZHgZ-fd#Y1q~pPpwNwBp)vQSHJvnstMhTeH}e6iPGTbucSTZWS6Th|B}tt>6Kx7
z>?>_-EOkN@E7_jv>f$2cBdJ0Wyx?hS0?<cXs1y#(B!Qsi^4YU(cu1uT%Z7aQb+<y&
z`~3Y?EX>OtZEcM$Ueq)v@%iRtApow0e%de<LDJ}B{ruQoIG}}o@Z^*9ETu|`O#oHG
zHP{7|QcA-liA1dhXU}#K-3|vPfdH#j=y76Gq4jz{RCspx^>j5jSyvCz0EGSfuMx62
z9Q+Xv{s;ko1V_@8ObU}5F|i4y)`m)J!P(1uvLww^c41*QrT!@;W&95$I(_xfpHRmS
zBBqEc0$}k_cIeVnYCBTbN*3qjWMX1A!gi*lwvz-lCe7F4YcZ$M;dJ;?HHwcGLo;k>
zXoq<pB|zx%ax)zjwN#4gf%u|@l2E-CmE04vfU`y7qBw1HK%$fL;6R=EEa3$!s(C|f
zYo5l<;JqrE&y8raqGkLXsihK`{?kJQ)<P_vH4!a@<5{oN?k=j#zmRVwm9PPKD9O&Q
zsL0N)V&LJnh{=;)Xi7(ZcqThn)cgIqby#z+pw#x+vka`!bY`Xnd3=NqH_|Va0n42>
zQb*{E4{*PMR9=HW9X*<%Y8iUlHVaqCyRNFKt;tGCU!TK&lB(Ab5<VZP=Z(xf9ZGd+
zu@B=oWTJzExvJ>+Pks!@`3EoosB6ogf2LzKM^;oc*4s*P(y6Si<_|wGd=g`HkuCo$
zo@p-=ZpT8d@5MG78tP%?G9;*W+3ghnpm<6;J3EzKqFwRLcL0fihyR2Pur1-DU-3(B
z0QMNuNL;HB55JqyXJXk~+r7SCaqRd@M-Ej|kyA1=xd9=g0SND;+y6BKr<m`#Yb!RQ
zt%`VkCk|zO;YnA<sxkv(r6l8qQL-@lZNrBTH*}X*G`5`Iq%+8x%TDdxwv8J*GH{VL
z+vUOv2hKND#pV2wr`isadqYEAMN=1s@-!1}#KH}d`+V-28WG*whsxM0qmi0AH5#bq
zMx%xH_s7l`{>p8`al{dMgH=(HIQ1Cg5YvTW*BF692j`j|nJ)sL+b3zdc)4C4IV4P@
zMrJNI6J(A!P9*2>0h#=Vf3lFP>qi%XKb|Hs`66WUIeeh%%@E8XDALPI<OEQYn(X5v
z`P$lCO?Ga&DleVCR9RF|K<wA30RIOkN-$X!6?VIsn~j}*X^0^mqgWdL(Ykfr7E3p^
z{R%%yGBYW=ef)T{TE&^piMmSG6qQ4Cv^O2;R3$xuDy7Sx$-vORfzX6~S^fMe+C~lE
zK`KpQOsksPo2v*sI1Ui7_h(7?QH)?D7}4lxqtOgYE`Y;y;ZfnbVA#&X!i>}i+=ahC
zVOR-5WFgd4{Sg?0@x-I?#H6O`Kqibo3HfjX<D}Eo+Suv_`ak+nLZL@6$<^zxr{~j8
z^YiC$0OxPAt9(tqHeVmR9uS5AJ;yd5%}|fw-_`4p<fs%B%;50cOl$+{>kWnT!wRTF
zXis3aO$gF_mb|WBnYf?MPPZEsYf<S-O2B{+J1)fLHTCKx>Ms_1y(IiZEYTTsVi9a_
zaSYXkfB(5whvKOd$UNhzuhdY75cc{Ym%W`pq3P=Ez)=lqXO;{Kd}l*75W^S|5XJ0W
zOZ7cHHLT8Gqcv{YG-AY>k3QIXE|0iEB`Apb@poIcnMJR?)=<~Al#%q+6<tKVku+)p
zwE?0i9b4Z9>U+^MQ)g1oFj*O#Mz{i--xE<*h-t(~33`g{OZB)DoDt!V5(@kJ1VSO=
ztf3ocVNa2$1H+9Zj%<)owNx(_W18hS<fzpmR4P&h#;3sD&ix$%=sjG#S#ZEoUOthP
zF<`;{!~gEXBVq|WgZsx@Fm4NPedrBu{~4Qct)|n-7fzR>xFpt8HrCX)giOfekg8#+
z;8&FxJ(DOO2}YZ&NiifNLv1EuJ(ux~koAA0LYO~!2(In1095GVdC;N9IRib`a6cnW
zEaXo;im&N$59tP_0vPHo^6d=ymdN}eH^}H*+uvorzj!Vlfs-2BN&k&}e_>ZD#*>{|
z3+hnx7aS>|!XjxR$@{-#QcBE!l-kOQ3#^wb8>HEeN-i=>*817RgX<Db-ug+F;IT0W
zEosO$|B#MD5Zp#KhuT9I{u2x7S^CHf%T=v(*=rlDja9ZR+9R;YvEh<q8ouCd)dvM@
z!vf-jT~wo(f3m3<eR4|5z`YHelETZ8Z)dHN$a^69agGLre=%1$`SRt;N^IH+AmdOz
zqNia0lhPu2rNdE~&0sHLsBClii0KRF&%f)zhZewP2GAFF;>3doNuK@5legZA0p_Sz
ztzNTc&Cll<$$5wT;FvK7-&2l>XwT2DcB{HjMLeC_LoU(ladG#;Z%uY+vismy!oosK
zkD{Z)Nx%8}tFONLx5bQPaeT*&BS&Vu7ha8ANNeT(eWzhoL;OLF9o0P=kYkV7%__{N
zq8C;S0jawNja$NcdJ#e|crQFI1n^A47LO00`aq&e(CdQ$X{yzRg`o;oBBRh~r0mdP
zh?Jf<o{>a{XvB?;;`grEO|FfUA!^N12&;Fq@UUQq1l%y*h*pC)qSWwwufoVHF!FvF
zd1573P_$UYafJv>VBMR=9o0n#($^-~vv8bFM=s@lA}AiloWE`oVUDe*vv6V;1p?wH
z9tFtxGdo#NBtH1s_0$4(CP9Jtj_^LPwvT-C@8|D3K=Tx6NL<8x+zW{b9)darFjG}m
zmtV|13+4K3?#1$pCr*POPM^3~-r&Hw-%(#)e(@qUv8&=D&T(-OI_zGJWi_qk$M98-
z(BMXTx$H_jFbRrSz^1X2xGN2xpJJQ&poqhV4}ZxAMKsqQ`26$Fe}f}`AShxX9~9x@
zf+7HPhoA@@iU4gwP{e{q@wEU!5u3hPE}J~46*^Vxpvm*;5PCfQ1pPL5J%P_5)MUIG
zaLE3FyY^EJ_?yYd3HXX64B+}ouw?S&H2g9I@iGgq1Vxx7NVXvH5$O<4xI}jZN;-cg
z@x<IE`ngjQcn8u9mJhiSK<txgiE&ou>-1@Kh~f43^L5%PVf(P!$sU69B64mK5h3Ct
zB3Ka@5dnXyR^w~ygdK?OZ1ZWf(&a;BDh?V{1u#(=P^n}}olK_^VT460olH$Cg&SZS
z)#)JMu7pDbOZjjJ0={GL)HrZT>2}n341<D}bG$nfGkzCld_HD;7G``pW<0vQ(qX+=
zekQLFCI)+9?&XW+<z;!73(uZCe!di<pu7wMPmHsYsIA8&sV}%t+KH`JV?&9d>}(s=
z0T94$nZMbus!^z+1Z9`Xuv66^{qBcU_A!B*b>VbR|4=^@;V|=2B;`(I9C1S@`0zI<
zUXL?=BvJR%&!ER{-@dnc_~Jzt>Nk@#MRfVZsamPt>?d-TpFDYb=icoAMBcOS;P6!H
zOF_Yp^{Lbr!SKB=&w#!DD`Xyj0L2KG@UdaYZZRv~d<%&^3r0l+2B^@z1zBGviInQ5
zLR11vv;y@)3<_hQmYmMCq5cMx-wO1{!iN<U23CcViebbpE!`fi0@))$LsR0^i2c?K
znmTpJ)Tx6gjd4(jvaiLQNnuw)+1D&8EBvK5p1mKIyrijf<JB@P$~>gboHlJp1memw
zo&`FMSve>iHrKeJBZum!J1o>bvp9BE#*mcI8}4iQ)Nvv@f+&)bOYg(J#^ItXfc=VJ
zUqY28UZM=_;bfQkL%S`Yj*veKL+n1NcY(SRAE*YR+Xhp^|3v#|S+<wZzKk3eyd9(-
zCT~`#?0C~q@pvN<Aj#mRVc;dAC6dhbVUaWySWH3_unda{CNX>-WmQ#>-TRmTWXXVI
zY*zR}${=EFHmHr3z;-tuO0&DU)X~;fc&2>9gk8I^u?kaC6m5*6Ef*o|2ab&yo|Lj&
z^f-0{XiMarx>51)<H<0hMvqG0wTl!)`gay!e}w1G<&`js67_-w3ua^-JehlLd0;IO
zW;lh^64YLst=e8$3A5iRqH-b^TtTed@VI!rKHqYUn!-7Y*TTu(sSXOjL4#oLB1k-F
zumXw}mqryKmh{^!uO9h7v?pTf#z6VQuY-}_hLL}d{9Ml~RY6d@`SFunC9x$KKMA^r
z@=urTqbn#np_J~XXze1@zoYG^XzaNGgJDqRMm{+5uPfH~pUGk5E2z9&k#F5C%68#m
zL<#ExKN68r%^R}>Ffy8`oas;}?9?W<4#9#SWC3W4yiBNFU)5-9I!n@=C8%8=>=&*#
z4kJk|p*N~spAR)1PgzcVOrE+LPtEaP6HKi5wed<G3b89DgKMUMYm)KQ$&f%nW!3rT
z!88~0F<Yq3?Z8YqAa?dLQf%n0D8%SA0m%nCx6|iA6rwq3)7J04ScR|ewvzMy)_Uae
z)Ne&T5+g-Y-u|-}3z{r4DBe3tD6B!VFgSTGTsz-!SC(*Ya{r-Lo~(wKLY*8;y~0Qz
zdE}9MQWN}XOTWcQeCJ3lc-0(acXV`ugE~66<7=ap*w`BFSPfDlU3*=$&>{nGupLdX
z4Vi=d8=LaMwU?S2$vM@264(nT?fy7xN(nlVwYJsG{drGS9->ZpTk8aj3CRSTgE1M6
zF(DCZVUVKkUSDe?%)O1RfJbU???YyUm+I?<;e<PQU4LwZJw0pI%mzx{B3M}wVAFri
zWf#%;`RUxbY?0_QWbu5KhCjIrTE&CpNG5yidLzf6pke$J;B9}<zfXQ3ymtygYQ)J*
zHYE&eD{M+U=GroFMElEO<erD6a1tZOF__52Vu>5Eb#4iZ!j9(aj%67BRxGtv<p5JP
zr^-qQix2$t(@zJAr6}WvW1Ot(FUNEsUyA5MvPeXDT*;Rzp*~`krr|&u3R~D3S^;yF
zU?k;Xa3m6Jq4N7zXBy^YA?Acs`JIM2nSwcqaJ#Fkv6I)>>Prg18wDlx1f`<75q`VI
zY8&t`{cs-61|)m-_2)+1)3bGJQPC|N7}UK$^}L;(b>+I9eE{)=>D)&7fapsASwSUw
zfV~$pw3t6Mo3G2=c#1qKk3M*iJ5dVNv1u=-!-b7Y^m1A(`8CQ{$zugj$_24%l12&7
z!*26m&J>=KuQR1LL`TE)5*=+Iwu3MPf@!p2ddkHR8}Zbs2?<lLw*Vr<;;5*Ul;Oii
zDpj3u<aMf)ut1I%)xru@D;i1FF>qN>CFbic2VTDY@5WxljXfj#|M%F7xUpws|6h&$
zz@B!sMj+H^h%O?Or=i%vQekgCH3x4f1aSawE)j6n_#JHs*36_x5j8gwAt+cglOkz-
z0B6wRcQ)R%g{?K<U`Hn$r$_sc+S%S`MG&sF;Isnr-3wvY*x2J_MA=kRCk~boxw-kO
z88c?6;A_eU$o8SUd?N7=9vnV=-aHh5C}Oe@Z@Xegl^+tafBWsX!V>FJAt_|PoKpSm
zZ^j<T*dC);Y`nYQWq{nXe&H{^_g;gc|1+stp4Bh+mG?~u!aV>&_Kp<8QsIePZaJ|$
zKzJ_qbnZDe2fNhy94kC3)`q=AArK<$*kDjd8PQZqubztgt*msM$8DZ>WMnkKCzf5=
zM7DvTAU)KG&`@F#(hxdV56t{nK0ZXV2#dSAih2Ef5k~MqNS$XPbrxX+7eVSIUO1I~
z{6bk}WpQ3ElK7wm;m6#w=a8I#_Q;`=7tUlOXg&K3^z}mOYla!D9+W(i_7U0Yti@T(
z0ss4jvnR6uy=wDeNPX_0M%iput2sXB;IVRA|IrHb2U~N_xv^8a&*g0Wz_j8cgP=V7
zK+f*9z>r?MJ2(wsfv-Yo+`|l!$s*%jd%wy)vlB@RKb1;HJc6k7yQic-F;`)2z{GmI
zQjJD7e*E#{W^ufz_~e<QRBEaA?WY%vAL`DA&nMeGbo~6M-bkgg)cGfm6^i0B7XxT$
zapwD+5+`_{N@HY*&mHx^D=)u-GL|NaE4U)MD@4+^Bb^5ulA2bm{NVlX&$XE3{MoFf
zMXNO@#*CesC~4{NhNg^+89fG})MG}+j2Iau1R6tP>iC$XF=NM$9g}1nJlIGDVvwqf
zg>xQ{ccRXyRI7G3)WV%c(}k;d_eS``x9_FheJ+IAqpEpg+>pT$f%>tdMkL3hm?btO
zzmSl)QIn=j4IVT!B`GdE3RwzKg8=p`qb4#&4~jiBH8uB1{lOQ50zHm$c$}O2<oZB^
zMq(0+MLrasWpLi-cmBID-vo{08O%39<Cu^69)evJU)k9QkDb9LaOT*-eOobfTlXE@
zv1RAZom+MsJaq=!-kBU~1<ZQc*_ce5jR_w}QQ#+-%TH({`3WRLx7KL}LeZ8j$B&;l
zQQj^h6<XWNPww2ZWy`Ld@@n<y(W6zi@`6na!~Ap^-b1r+VouIPCLE~<+^O3|G7*pw
zjy!~6BoE;MoVYivG;`J&)EU)0@`%%!8AsABrE!^$47lu+Z#|MJJpxpuBht)&Wuney
z6?YvI{ENCDXS9Q}XCLH_)=1P9^E1f-K#P!g(7Gv|PdpHjw1Wqbc3|!w6&%@|2vuoo
zcM3JI*8~Tug#kg>n1c1f&UR=_9o<wPV~!!`=s!-`ESGk`B^|(a&E*_u^nT_cTx_#;
z-n^8tNl+k@#-<D#hh*1r!%`-slCKFVBu_jpE|FS*`|Xm+01Uxp9heOKF`LUdXdpQU
zjz*8h;K$GD7|iJy%;^lw=>SS)NM&8!sY0j>B^Moz3w7k6eX6p&uC9za%rH8{%oG>q
z!-Weq6V(<WH5l4vGY5QOG@j3c#Vjw+;V26t-jcE}V9gN)2bl<+1_?u{5iEEFuG(P{
zdJADIM6w9ZotvBqT&Z8UYnePVEG*mrj#6vLD$AxF2zNO_4ooOL$W=*EZamiuE{2Eq
zSbnPoHJ!~Nw&G$LVspBC*|IVkUWK}5nXRY3zL&~IzeKbkpT|qmpuO%M3mh%x5M(wd
zhGRxTqy7A1RWN*L6AeKs6~Q#(C=fJ5eAab!-JLBK8sdlF>xo5TCPwQ)j26+eW?}`z
z;AXjsqDU67!ST3Z!;a$@in;J9dmZ9VfcS~ih1uY$FDfjB)vpu|nA}VFP@Ip<W<~%R
zNlcP4lO_p*rrmSTJyU}O&A)Hi^5c)ktTwpZfGgIA>QlrxiK;b&<S-`vTv*2@0`5IY
z+}_?|gDtYmUe`{^<<x7hEmPigSCY|#W$YU~?O_t@Par0qe|{Fi=stmbV(^;{++`Nt
znlx(`XSft%YkGrGpGHm-q|)VWUw--J&MHRbXMkx)?Q5}JJbjwtZ2QY%jvTQf`VoO)
z<uJNgttgXBx7kTK&hp|S1kAvYiD$J4MKZY<b$j&@5m7pmP_CAV%!pK3784ehVk9+S
zJz}jtibLLe?}X6EFj5{_IW!e9Hn3<?GG<UTq+fElR>&P>P-g~}V|_lkzt#{Q9Zl8L
z^!r<<V=huL7nzugiI|Itn2R)4$xie84B?fIb6@Y>`}MDv;OO6%23b5xPA1~=W!&Je
zjNVay;+KY|YAAeghLt%Qc6_wqBG{Op3F(fa4s0*_vv9>CeHq_%>v#XKapUTbzdCRr
zJ$>z3%)}8UV7@)OJ}_Yv!qpBPI#@*OdprH7nP^Nwz$-lm)_%Y7Sbfjm|K1Zm|LLcn
z{`=pbOC#A8^#1+4+KT~CX983U{x-}g%mv=X$dMzajyD>jk_VgkfesI8KeuDYjy=71
zDin80vwz;X^HigTw-e(DK4t=j#?P9hbh%+_lgkwnu{v|fBU4OdjKe!#cxd#9<k7dk
zaMxWgJTULJ+isgVQWF@c(S#t!A5jSbKlW8O=9lz93_(rqEwLBv_;96(#;|gyb+V`5
z+b`qEo_-J6)30QoT?cgG!r9}84jnyPT$+F4L|z`Zrw<7CKOrxWG=8i^dSvn-HH9tR
zW=_0fZM_cqf^6`}q`0-aiaPqf{(9<Eem{qu`+5)zKVg60c_#a-y{`C38MgEBX2Z28
z3`b8Cx5|TNzMT%oF)r2HGlS&Km$MK2?d8{>n!+3HckIA+K9F8!k`ge64_2-)_3z`N
z9c_}3yE6D49!WB9V#|MEltF~uyv3Y&#hiK_JO+D>CnPpO*H~nAxq!n$w)4LLWzb@K
z?{mgKK1WzwO<^}@&573nGkCnLR38<QIA+Y4#Hc8}QZ5z6$AtyxMvfde4%<2Gs(l<f
z!ytmrpqKYGLkyHVJb{C-yZcM~nwy$Bh<8E2dsWPs>31>H$FY9QnCYdM>1ibea8FoE
z^Uj<pDuER}_iUj+)drb;A@|hrqxjmhZQq9NyH6ZGaqP(cUk+a^z67k7GpA4GoP_Fn
z_EHH2?V6b+a&gET+-~0HgrY1DQ1`h><sX;ZDN%S@@TspCNr-rB>2P`pGGTjrw-dkf
zTEaAb9IylGusD7}wDi_$<@mergi;+-dvx`5_Q8IG{B(B7pwCwQdf?ot(%<$SK2q-&
z-Er*LvE#>&9y$nxw%8p&?PnN&t)9~fkc&7>)Upp1n|`if;-eP6^wLWUqi9e5##LX!
zEc5wylm~ZGc0R8gfmJvG2!)i^pt2|)j3;?itzi=;yfhQI)jS}?T38pppf*bXVTA0U
zXTE#~wT`N%b>xD^unonwzs27Y+x_>Dv#t2u7u0h393^c;w%V-6U<6){$Q3Rl3#^z$
zKM5gLLl{q`MqVS2WIz;&5lgN(S4B@HyK*h*?7id?Gue%i4<ZC&8E%9t_k{OP3__pB
z<I#=H2x@osVKALEWsDCJnWxn>kZQjU<geD%;GodiS$}Bv1*jx#ohYh{FQvacOs8_u
z2n>?Q=$6`Ma!T&$?IY9H)m%eS4VX}mBy{k|(W8@+!gQfpRArO&Hh0Q66ibO%>go}p
z?iezr07if}e~nZql`4_qs04(gRA`wdNlro(lSUg5z>2|%v4QnFw^iUb+JGP<5T7E3
zCdZ78FzV%@;UlLe42cXSU`vL;ATC;b>@5h9G!oXf+a)R)Gp4!OS|{pbA-!A;jg*%Z
zBUGsU0I}(hh;xlV<VD7uNb2hY=+wYHNDxuQ$u<KxJ}Oc~4UZI30pR!midM+`9h*4q
z$zitgw70c8YD$H$-(f#+x!?)p++8>=&_a1lPxP88d&e5Ke?`5(z$z&~@}yF6<qz;7
zlG+Ljs_?tFwysL2K1K+{@l^JCxU-g-xLVtc-0hLLB~ppM&WI8|CR!q4<YKq5k47+-
zCWL|2lAbVu;qLZv-0d=~PZC>4;@=;~`W(T<N4opm#nv|HkIoibue%AmU1=%QGi#Zx
zzJ;We+6s%RYEjp`s<N2+jgdArRW>!1)YUPuzV5nmQU-h9#-H<=Asw0;kU*M`c<3fK
zh4~gLWa9^GEYi=9^z<xS_TJ~I><bdp$7F>podw<Nbp$pp<_tc>H!@bVx};>cc{cvz
zQFaWg?Z2W>p8OxeFZLZilz~4Q2b<B;FbO@yNGDG0JbU(7em)Z`*GPbH3LKrH8s+54
z7cchc=V3w46P!xWogz#0_?GM@k%eB6#HgNq_Pzx#JTe<rgj=6_YdW<adO3;U#U)8i
zeUfF3cg=!IvxRD*{rQV(q&ABF`S7?9Edqe>cRM&+@hV1BTFQ<dJ!J4;#EE+mhHeUP
zDk*EXT4Q5}i}o&Cw(J*|u0XZ`ewgQO9hDrR5}8N10dwMZ``l6miEVR=^g>Dn*K1gq
zUZv6p>m>rR^9F~>+S#Zf<3<{2_-m7UdSK5)v;}e$dptA&cSV&zzwU0gTj1-4y|t-N
z*<tS_d}>@U)c}aq5n>6k8p_1Mkp{dgw7T9lq%0dEB2bkp*chxQ;dg3OUJDHj36F|3
z>Y<-%y1MADE(w$<k3fjfcT>1wXp#}N&)nY5c7(sTdPAF<NfGU?#)g(&Z$Ix#!A%1=
zCB*tK1~)M{Jwfv%CN>MP+2I>h(W&?aLJT+_i~&^)cyJ_mFcMUepwiaVl{(6*tcCeS
zMQ8FZUWP7|rOM9k?aj-<SpcVl^A>H~@YS_dDM{ghz;iwN;|6LN1HI-B_72)0Hwj^^
zh_lc;Nli;}M#h<(IyDIyc!y4VEe&y$CrKdy6L-R<e<{ZP3v6EYMe0Y3wz$w<UR7zU
zYpkv90&YBFHcaq*v^!0}*mZVVv=W)06hY-0zvgCxOsGRpu1P2s_xMag4867Ad-W2Y
z=v6!s!C`n2PxK<5X#BZz0J^hZ&MP^8^3eI#-d+TvD*QUB3&3T76}+ev0sfBa3m4A9
zD7o&tf`+i6erU1AfzcZ45s46^Y?yrSy_vy~z^*=LYrBW)aXS%c2}$HeA)rd^>k`_l
z3q>AWcU4IPI8b07s#e44+!LHI^s`Ub>@Rl)<LH(W)hCkS;G{-)+K*qXj!#h7^0q<W
zhbvvh>^a@ikPXM<y2G$;jg7QgBLxCyEv8@tEK1*=tg4p{n>0Cfe4Igor6t0ClKkeI
zZ$38O7$L6A&ECCk{ZV^EpTI1GtsyZ<Rdnb?DrGjleQ(NO;eMpyZohP)1@X|?`EKLX
zN1uCo-6l3VGXuNJc5;bcz2&~tx6`n%y)S_>d+$_gBqJp^fbxK|W|DYUU`TA}-_lkn
zXGb_MW*^+NcH61qc9W>}<i?GFN8&3A{7bX1OgduPw0W8FTEA#H7Qp!K?%dqG^2XMh
zcBh~{?-U94-TQOykv2F^P;H>j0kKwE-qzNIDUOJ0DA@4%&v1g2l%iy)P~`E5nB=D8
z8#f-P!%$0PQk_;JP)Vgiifo4B=+x9Gkhxf4TWu#xDI?+oJwlNM1;u8~3h<8|JuG$R
z{Io$qQ3#vxqr$XF2oW4Naa794iBl(!iJ3HQ0stTHdvbhqPb;z3jT;KK46_@J_P)M`
z1Mj~3V;KadmlkOJ1YV)nUo4<aL8|zP6OmMo1E#mm)(&@VO6ur9y`+!deeMS5-3`wB
zJ2>xdaNgbEyu=eHY_|VSyM|_MjtdP9Qc|6DFzOfozH@V#wWa~$o|RKQGy+2c48dV@
zXOABoYDTT5oSgqow}xJAj+4p$8^zijJOt2U*DBWk32&ypKT1(`bkp~oY7Ldzd_||e
zKEN5=H9Th1I}{^%;|)%$HYW;&wYC49Rt=5X97iMH#3S&*N*NH@x96)OfdCp#9n2g$
z=m$>M;3sYomDph(i;s7?uGOip1v?7}3Xd>yIyLlZa~zUl+^krFDV6#K28C<cZZvB}
z>Q)$JxJuYn2iTQ9Z@+DTV56sCe#c^dIS(`D*HBo7gHBCZX-Nr5tm9uWL}v+I0=On9
zfmw>3knDy&;5z<8pA)O0?)qi@nl*`ud-nzekQanZmauLpJQ4KJjf`yLPL*nB<m<0T
z!gg{@GOvh|ygTn7T=s=>-@d!<`u%tEqUJGKf`64jvs}T@B_dcUhgMV!B`>p~o*dUp
z?2eimlG(_=AW^b}5+5Z&$c-6b<@`OF4Iz3&4J-79z(6%1%J~-+d)>d~?IRCh42VV8
zf-!giJboX>API%4ni_0Xc1LBiv)x+V(_CS<78Y08x|Mnuj!^a4W<%gc6+GTQ|4jYP
z;0)w!^N6HkQ)u0>ZKrD?J=H294hKNkMFn7|%Z<hD1Nt~_)0~7rh4G_fqXPx)jm0_H
zY10jDRlj`o?e-m)1PLSb`mRu5*Bw88yws%!C@CTY;yzlwd`qraN{~rKhM0--iGgsa
zASdtaFKa)d01CPJB90MNjF3Z;S5{XSwKSDoY6}}Y?a4G4cvpxH=SYSx%mf%2iOpG0
zeXn>kRSbv-femUEqMyhmy*<KagYWZiOghd6NX=BeI)76c@!h+s&+q&q9r_Y3!SbIE
zPRH3`DG=3{!T+@m!Ib!0T<?mOJpAzO$&9clA)&~O;cF}^u~l0u9aR-j>#PpM<}|~B
zcmCHM$80u|nrcJ7L^W>WlTTo1lL9qEEAlwqrcjwaOhhc}on2n2;z0F9Nnfc1@j)U1
zBSdMzS~C+OudvqDcX)+}15yf{P9UKv<uvjOBK5HQ(kA403TX^B;AxPA0|Rt_)9&Uf
zpBPP}#-`K|<}d8Ky6Gbt%@JPaC4wIwjT8ZYLx{L|0bX>V0T~EFqzDlI3RV_+A?W}@
zLs2opF<?Tofg!3YN=i$LON)#5XVGFWg9IVBSByj|5tJmFqB4O<^DJj`eMxWH_gl_|
z3m13nzleRWy&WypAKycaC@+XszW?!OK=9>2VW5PjGorpn9$8;#(g+3bzKdP+^YxEB
z(%1LQ2$MjnfXCg0V=ykk^Uw5|sTnj_7usYa0<m^c?`YpzJa66|)8^a@%j2|ZLx(0l
zcMJ5(T-Yp6Q03HR0G}KLMh*G%MucSPu|!s`yd}<(iK$(I)qqR*)GaGlGIUjkNhX%9
z{NTO!-rG}UF`#N`wY3UfdL+YC+G-p%z$L0Zkwv?OK$ew=g>Ha2ilBe8lmTv;0Id#w
zP2kV@`3K^JWC#k1zuuqnYmwxZ-GQ}u2iD?1)MO|OV-Cc)079n3>L@L%gc%Z1lz1WP
z1$n*1XV03{EKAlIC3N*s0#~nDw0ZNSNlpSS{ggcGqoq58CoxAl`bdrMf6#*laqogb
zgQ!&YZL|T0e_jJZ+TFcr?Au6ATz@8&mC+v-q~YWcPjBi<WuG&r5j%=t&mJ}t)#eIt
zSpJw|1W84E5Sylaexy$-4GbhN$S)X<#X1UU%|lJJLYKjT0OHgv=sWmIDz$?aoF$^~
zusPJ>C@n>-46tNstfdZn6$A>xEb&703<H)SY;00Pj$;8(UWttIN#y2GgF&f;g9Hc8
zK&{fCC#B(02MRCbg#RTKKe}NU-Fv~=3&Gi8;Ovx0TCD<S1D6Ql&Pag~sLHJswyGjq
zNl{6Wbu%)2d?Kj{YKmMyVW{qd=u3lI^qA-!xJ%y2U>{@eV`JG^dgspB_%s3t*P+}M
zjL%Q7PY4i$l*&$JQ~?1{0{7O+hdqGMQj0|HCl@ILf;oMe3N};9`ywOfj?_Ro(M-56
zjXF!6MF94FPtSz3x{Tbj%aBM<fM-t#A|o-ps~Hr~NJtnWD>%58#0fr0E{mkM{MgqY
zd|sBu&Sqy*Wo8wGOGRZ}MNM5zoppx@<+D6algQ)h^-+EZqQe>%UU_OwfYx8<r|}Ec
z1O_8%a<l}0P1F3}581|#-F%GQ<KRr936V%n&X0sR6>iSTt>s9vFD-)gsi+hsy((c`
z2iOiK6v2HE5G0m@WrA3MFj1_8NHv*+rhIN<Q|fckX2=x^MN7SAzY2wa_wOD4-JJ=s
z29Y=Kvwles_*tG;sEbNy?;y-hzDS%3W?WI3o?dw<D(aB)=~pvwIO2lzM0W&G%{vJA
zI=S8!zPlQr!y=`c>gq93F0*FhXjM?0zbfc%Rs76_cfOVhsnE+^#|^LDd1q#vYT@k*
z?@WtFh+}-(or@My(;0;4NrEVcgNm?Z;ylf#{?8Rz3VboIP6tRae|<+SqwBi>rP<??
zNKBN*JcMkOWU*FTtC5!PsDm}9&QWczu7V}rUR{lqTvb&KVL}~a5b_*^QNS3v$gbJv
zVkrUA-pNq0W+C~#nG%|Z`1>RHQ>)blXakU?5A885EZ7jB575C>qlamqd?C0(hY-X6
zu0`(5n1R_PUP2O!GJv8GT@IxKyL^=mdPfazxf1`%F|oy$5qwu(0p>o41qWm=N@Nz(
zLX@nNnxwc-g4-!FVZX4XvTqo^={R>!W%a&7X=G$%ZFNU(_4fC0c)|bB%-U4eU$}n#
zd)v}rBpVKC|4+uR`RS*dsZ@06i5j=?jW^yf$pVtbjF^7^{rAJE`PQqJpoO=GMz+Ky
zs+)Fw^wCF!>d-`W=)^njxZ}A@*!tX58xA!a#CPA`(nI}&5m)cnQB8ek5(-;RecBHL
zZIUS@t+tk`Z5ss)ee$3sx*Ez}MO9U01@yfVaBda;!BJ+fMOtHRwXLE8b0Y@U97}o3
z$Yv*dvq_4HB9IXt6G`KY4nXRQMu!!ogx^!`r`6#fRC|3;80rKE_#?If@t!wqf?s2P
zm<4~#LI`HT4{Hp8d4B}k6;%~ki>$w738fmO153V1+-TfrJd#B{o=TO`kH5+wf{Oi(
z%3_OPpDem7D}#N;mk-piCmBgyWu3Lonv*4Tb^tzA66_bO4b~>~|H$_|5GkmDWV|Yt
zDUF@XhQYk~tnUC~nCMtYpI;af#iSwGq<9}gy~*&A86=Y~Gg3s|h87}l?-3O3r-7m%
zf}%hq4f)bkSCmvDlhk1^ww2mSPXhe_Nam~<whf%SDGI>0ZJXhZ+|>HfM>P&9PQ9|4
zI&MdjOC(#jk{7j}LC*2G7vY%1!NE9X+^7Zr{O3QZM_KmK=akCl%p@9w%faWA6r!$>
zFIoiv_oLKN`Q!h%e}uQL&NuSG>Ch1dQG2=95k_`+!-rT&x(2Yxv!tj*mZ+lQyYDDX
zYgb=qS7&Q;i?gk_t+$s^`P^t3iSj-iS1C=m%ja}CyF0ts9&eAg^H2ZHk1fgWB0jG)
zj7$PXCIL!{z62)w!osSm^A}P7u@JHo;qLnxA<2NUhy+q8CW;oamNaZB0NTdBjQ|N+
zEKX->)}IZfKlucUg+7p*&Ib8Tv+-CuLmA<|<m7!8dd{L$s*zT!8TyuT3#NcPe*a)#
zI7ksCf9gEzMuK5Fh9Hl+EO_G9m(%Hq^ep-w`uD$?sFHN{IrdQ;UFqMHK<kGoy1u@$
zvb}|*vqOfpw7>!-BuP&ek<aM_FVbGxq7MXQC88Jnq6UQmu?vz3%0>Kt{v9W6NQCA*
zjL0JJ`9S7(2yyk17qY)A$gALTWoc<)l@&3X3amLNtYlqOXD35<cA9Cec3B!bhn>T1
z$ozXMdzavcZ!1#Sxq_8uXfCtZ48h5N!w&O^pq6aI!x-6bNlCx$A2w`1T#kd;!Qg9r
zH>Uv#uV+~rt;dy;GVp#YWrJ4#E%h*E=gtg|(F!^OuH*H%+=9UqsZ=_XnF;qSe*un!
zTv=Q?E5k+ko6~&TeA||V5C<T6)j1qC@@i<TayaTMNwBj55>txYTor;A8BCd(Zfjcx
zyp{h)-Fv`Ab*1m)=icdk28Lc75Co)%y~PM(NsKYQtQuoX*-bXdX45vsxLgKn{3e^k
zY>KfYvBlU;Vn;+2u^`erL+=c2V1Qxf_nbSRabptAe*gc^?>Cp3fy=$;+;h%*+WS85
z^HMMzFg-8;(YLn`*rB~NTDT(K^aiJtQO)ynsMB?*(`O-NPeaN^-})|Y-@eMqefw^G
zCnvFsME3H!x^m;_Ti?xDt$IE7gSWn;lgzVN<~hFm&SCsxyE+Bk)eYm{|MkvJq7Dd9
z_b3!SMpWyq?(RPQw6gNkPj7vPCt;y>4)F2{xaD0Qlby{85cJ}fcY2b_{{Bh?k?(cx
z_JScdlOZ>AAUDB~8-K`+2dq!dS3_YgR>WmRjWu-@Sx`Hzlc?Q9Sdsgv6T#58aU*@J
z{kiu8_wG4Wm}cr~L$Hf@@&zmh1qD+g&YzD+oWZCWB{|I8efJD<6#9O3B9osV%P4RR
zefK5D;*wHP@eB7&ne|>A^vVek<*xV`Fmgy%W7kKc%O%FzGaQoyh?r3n>$uaNk*J5Z
z(fMlV9k6tCby@3Mnh;*qjEC%K>c@7drXz8crlZfrTdL4t&!Dv0U=HB_o134XjsH4(
z&P%9)4XA<LsDYPI123TlCX}?cSHpd}yrj6KxDZCek|Gc)LFZ8jM|Jux!8XNI0ssX@
z@1l~@iV9#73V~9<M&8ZfN!5u7n2E5?CJ3{_3MKRm%Yp<$OP8(=oCa+McF1<SW5q1T
zGVHpZ;teu#!FT(PZkvNM&%+GkgjPp8#))<ugbMYW7{|TL4?n~@?!ETCO!NgRXXobG
z4j=49y!hi$$1-+zW^o+YVJBi3d;znAfRn!c_VPFH_45nyNC*{rMtO?aj0>6x55Ki=
zVQsBi{lynHL_zHC>UZ<+YdIbtAAg(@84MU7AUTYRnaw=PJjC1&o!?iOMGLS&X<}TN
z5%hq|OPBB^z!n~jCF|kbw0t=~_~Cm7{GoCH6<WS*`Q2C_9|w8tWM(>lXz`D2%+lxM
zm@!N+6T+zCW0+4c9Ah6NUU#a|Z1(g{kXvAsu}OoZ)g?P)9DkNnR76K-X1cj?GQBP^
za#)4Ld*Z?wlo$!Bmj%($zS6`A)mc|c;0+F?Rdr1rU_jNi;QT6s{>5afqwi|0#7)&z
zbrc*`TU}KS#8g8ad?=*7y-lWi2ihqCG&yK6G#jS(UV6rEXBbY4HHCn|X#vlkg9&xT
z1U>6edVA}1dN;irg^B6iH59(A^U!KN=vz-+tMsn0h<bUs>#?%&^z`z8Z|Wb(%qgd_
zkke-%r%ypnV<D%pkkjD7eu}Rv`PrAwoJ`BOidR}%K~_aYX#==ZuqA`BXRXX^5%^DZ
z?WiixG|JT7ovqmdyFjT<lmT%~`8TyuQPg7b&{NMnwdBP&u<m}hsVN3pu+^*9Y)<}u
z`<9IxHxhs7sa||hnlWZf2CM_~9n)bpe3SX~(>NG=ra1yIm&QQ?T*v@92J})Ktm+PC
zIOCBhL-ejj`u^dE7_v_H(T+p=_V3)i4bac`-rMokvkPCGP2!<kSPPgF4=RrbhIQ@T
z%qz^@kPbp=gdv4W<}v0K<K6a5dxyi_G0fqC!_OhJS79jlSuM0Tz>FsBX+!8Eb8l}w
z_)04C>YS|6v=(%Vfy(q2wO>HAQPv?>xkL`I16>`7G>FUKOQ&-<)Y_i5ZY)f(Q5EY{
z{pR3c0~UwGKob}}>CPuqQ4=F+0%e7@ExAR-)k7l*)uhrn_#bGY#b}{LXrU2xbs9~p
znUZwXb)vr$0jqU)mD+mis0FyFvbCj`5|;`S1U;?b<q9{LOa{>CD2SyOyC~8Rltq^v
z-t)@74x$oa4b*Fcn<A8{GO^7VIc!*NZi^Ly=&kCvFar%)7ni*7?A;z+m$o4C(WbN(
zm+6l_Iyxr@%vpsEq>U5M)ZuX<CB1zKlID^ch7m<Ao-w#<e#DbB?w;Y?HOqEdMuvwU
zIy7>aGEoN*#6(3e4bR!2a2q~(&YbD7h~4(K@T>C!zEk4Rc!%gATsBJ6vXh5G$yT+t
z0{t<`m*|G_gfls|hvNQDSOU*}I1}oT`}yNd_N;I^)e!;aN%qU$^}^orp@%}<go%-b
zg$E8~U8US{g_qBrO-VkPw13y0BdKYHP@UG)mStt99XWFN#EInO<n%1Eg$p+s3?>8{
zwGai3H98;wmO#n$K>IILlg<IOuS^IdHWaBnHmNc4`0@7k?lv%Bu-y&Sb?sJLe`!Hk
zLwl=D24taH!3?yNm9_AJmmDk+aDwERm}Dp;dswY1!57Z)P_}h<@`>A8`)J~1z+w>!
zd#$#?d1c{Xe|;U&un^KfZAYU}82)8z!M4*>(PAS)sCf~_Tp_g8P?G2Zgd347R9c9h
zz=6qZRWM@2DF>yY&(hi1!$=_w{hdT5hBWlp#R`Q?;IJ9PFJ0=h(YLur0eMjL0B+ox
zm-*z9C+_w(m+Xf;>?<~V-@RzblbN|K2@r-AlxPIG6Du~f^|>af+eTtYb!t$a4kI}m
z24z9AH6L0R!${9WEb9Gz>04wigEUmwM8jeqdi4HS1i4!-+L}#tV*t(Ng+a7@w8ozK
zE#17mDSmMA%g;{49(awg$3m2f1W`|I`j0<;J_`&Y3kJpD4fYI~Fbj%xUJS5_|3LKT
zd+u30FDUU^m8E7=%wl<VYVwJrM-Cr2^uv!QQi~}Ob$v<diJyKvwEystV<%6Ok5FY&
zX<yf%6hQ5xlG&*ZNT4E}HZ+t{0N81dLnt+l8tn7hW*c?KW30ecx0ubQ@}m5*dWQ;f
zpdgK=qT<rhmYS^dIiwjS=tjb_1n+)?Z0fgJodQ65S)_z0_99VbeuL8rzW}ZO6vl!#
z(E1C|`aCADsmay#mRmlInyGKG@k6B2<m6jz_`y-&wpv~X9s0;W*6M@V{eh+r&&}Pl
z=a!p2jM|oOvE{>$9cyd5<yIF^6Eb%zP4Aqk=b-IZ7=+|=gMiFI+s`4)@IdIrAY;^o
zLOrbcKlop$jsn&c8iqL#uC167iXd?%untv}=H`}G!~YA^o=(+xS!s&ffI!HAuoS`i
z2$myKDGO@t{sAcBVEh2k9m^DQM|xLNMQv%y-u?T>jM=|`=b_}QrFrRDPhcqUYA>Zj
z!T!>A@41VgTAWqXDHgR``2oY)E)sVZA%u}v#ll5c&^@(i=H|^;t`rrOfkNt1ArUYk
z*M^6sp(OX(@UXoAwBJFayb}fo6Sh9P)JWVE8Cj>#wU4}O?%Z9w=FXixdz4PVs)A;~
z;p_>=KZM`rG<m-^gY2P)@HOwI>`fFZ{)ppISA%Y#qot{uW|~{o)M`PjU<>Cl?Z+SC
zn$Q-rfKEnlzWMIsAOxFgKl#l}geF?(RLBaAx%MDvbDhfAuL&o5XkvF)k8MaH3mrde
z46FjOuC}bU7HU`^u*$2NnyN|=?iwaJUQ=69S(W4_7_d2DMH35If@QkZYG)Dm8O-8X
z9l~WJ0aYC+Vp((`(2|P8bUjZAV4xAAhC1YeoM833g=C!aqK3SLKwiQiFCGS#sHxtM
z2$2QLicO}>`uvI`3Gn^^-<1wbYy8XKfBW_?z6cA08CYtXJ=;_i6I1jKA{D;Fk#~$h
z$PH?~kU&&abX0WS@))eolO7hqKjYjvs6&=wSFkjmW<zyz0%X%1q!MU3u&`J;u~utn
z)b_~}1Z4<#%Ij>d;2HafknzEIb_Fth5wqF!-WrU^wbg}JK-+r$bQ*x#n5#2WPoGV{
zc<Ivl)YLPnm-Da!FUvlAGVS8|v+3DI(07~4E&wnB6)S>A3(%%}cYL$)-=N0-Y}1xA
z7xsR&bLY1kzQA(xv(LWS4x{>4-)_g#zRGbv77#lD+F6Q_5Pf}`;NY6Njse))#1aW?
z2jafAhWg+TeS)f|0lKuTqQ)M~S$S~7uBvXeayJiV*j!fG=nQ6PszNYBkCIMIoVu>O
zQ=9*1?I)X#b-|<Fx8uaeAIHMV@}l_tV|m}NTCtXj=}V4(x`WVl{r~*W=iePYm2~|0
zPLR~?P0a-iGY-l#db}h4<Rsi3cD#QdRCiB1W@C3pkC~3gK}z@vj7Z}gVXzX7cDyTI
zy#wgit;RW!<iEgrGnPN@c07+3x{u?$D^CBk0fx_YAAgS8I5sf0#rvUGus(n7?{A4Y
zZ%o<>t*B#cuqQ|k)O>96tTTIHs63(K1ck||mGD6S{m6^%(?O4v*W@vI?vm%9dt`PP
z3#e3UGZP0ag5<Bms!K1sE_mlI*jZo3`yeS9Ja*|`{mbGRBXn||%FoYF?*WEF%R+>P
zp~n$u&0Yh@l^$Qh&RT&8B7V%c!6OFS$yb=Sn7=U3FfTGM!W#R%@ULKX`O95!y)R;9
z*l|9?A9ENv_J(qflerI%o`XSY$={Y!eoGwkCr1U>6dvD<=p`UAdfV|P+h9RJzJZ?B
z`d}TKpc2Z|px^TkiGX9m*n2q2|Mvm&r{Uaf28*1Y2I4eRQAu4pSS}G{q?O8eU7O9(
z-(!K!0kqM!&PHekD%%*D12Bi4)>;_7OqJchqrq5mC0TP4!o25n+T|)#Px<+?pTob#
zZT;RIJ5nx|!5gPCJMGkuhz|3^39$QcJ_>glJaXi4PZcD)y|~!NOD%x7_x1L|{v#G^
zJv@sGn-f$rk6<95Lfk0})5wXOz|Yr3nsC!_l`<h~bB3!FIuNdMy2J-d6&K%-(UT@k
zm^6KIxB;(_=sTuQoj88nxJh^1G3}1ABLQa%jGP)bc~Z<>bEbi3V)~sUMgvZTM%IuK
z1K0|Mj~x*b0jO1Uuv?$aH*)y!h;ifLQ!#N;<VYIGFf5$J-n1+-D@t5jQE@|A#2Qa5
zDgE84$;5ZCEZj|_Wh&I9)fp|5m52sc+0<gb2xI4JjGcoPb6+3KgqT)&i~`0s7zB9I
z1v<|PS)csEl459f%1a9JOnJFb1?A@E;V3UJ&HvFThR#MT79dmw=2sANC5Tv@V8JMG
zV8@72$BxCt%^2Bn<;byP$6{iR9sA+%k)tQF^DdoFKX>+gQ5L);XU&>5e>_ui47N8T
zco-z^QNX9Zyx>8jK(F`KBnZ1IDy)J8wtK)GgRI{}_~(5v>%I51``B3W4G1a=3ya$I
z<KSM6Kgc&sYU)FLw5Roer|-s@E%@HdhjrP9PDan{z>1kCHNvfh!ZG8Yjv?R16IbL8
z%FsM;R)XFO1YZXwV~m2uiysV55JpU!c86aAEAGkT*o>Vk2CpFJjXn)^)iuzcR8-eD
zni`v$8W3!$5eH0^4Hv;vL+pKh11zG80EsGK6GV2LuoE9I54{@{Av(RMx7ORo$IHvd
z#~TOCkY3@xdKW*ZOhMZ{j5YES%qc_OKz^o7%nq0H@^ZoBoNp?|V4jf)mBx8+gI@&0
z5C@-329q#o1H=hHd7*EB{TOFfkP$Ost}-}e^k9L2rrVNxgr9vjqO|lLew)EMA}OHN
z@qj%A$7y@My)!<>4zRq;;qGd&1l$8w=LC=;uU@_8$8wf6H?AP5_b|T9OlC3jB=aO+
z?;Bt&F6W^TsiQ{SLpl&bYaUcsGXA*0Twv0f{mdE+S|4!Wf-0+VbF0}qSj7oEPcKh4
zDw^wOv-u5Q;b&^YI02t21OsbmFx9}i($NOh1z6au7PuaBGFnzdx<)Y*z`Tn>gNz!&
zy~0mx7>*a*f&Bd7B?MPc|3CwP`2Yrl29rs@ai?=W_eI@LK);!Te&dVz+?OzF6?zPo
zr+hcTqCf@HZ+US(WfafLH~kbZ0}Uto2QFa}h|g+Qy&Ge?a%=;vxq7`DF<m+Q`RdiH
zRsjOCh2x}}2}=PGe`b<~qXa@I64B{a!49@x+|by>j-2%vwbpNejpb`G+~xYhXFWO-
zieI|>14xUlt;MB@NTwm_U-9wrA160((yD4`2F;DtRjX96)>hOsP#*cl25?m&YGfbG
z<<Qsw2Lm&#&JAu;E}q_A+L1T>&slO2N<PH7CPK-9QNpJ86WB4?OtJ=F%zR{?&aHq2
zpMDInsYK(xXHjEsp~j+dUo>Gn+?~rT)CiQk7+?62236-?S_-gE0kArz^1_0O^5Q~_
zI@L8t+|g&Si~`UbVQ`=s7BIXTn2=%HJUq6ob2!$C#p~B+)d4>s?k>wZxBJU4!@|5e
zv-V=y@g7zo@35P4TjO}O=NIIYco6r%35>oI3~*~GD=Wy#x|)N5px6Wh`q%}3`qNmp
z?c%1@s}thm6O2SQF(hQ-Gmkv-Om}xI0T-wIE@dModSUqN$Cg2TOV*1@%LL<Q-#3#a
zVwyjI_e#Novp@cr+8T|hla(A36hz+%Ja{qQW6T(XjCGHKbLjZ+pdgJ217L&y$jQ$+
zNvHW~nyfauS5?*2n(6`YF;&#nmscQ)TU~WY@p*R)tpvO@Ec7d=JNtlx*RK+Hpkm#%
zo`CjfbsnA?otp=S7^Ncg*RJQs5;<CjvYyE?mJG6<5y41LsMO+#&?u-GMIHG`j8QON
z3VNe>vc)LKONMPR9%g;P5fh2ze{)I*-MdrN?`uelYHp|=Pg+>WFtFrRw_%=Dv8+ym
zsn=3nkyl%RUr1+dUS7Xc4waqRk_RFrK}k?hiBTn2I^;5YH*4)zxQXqY40@?{r5?Al
zSgG_{DG<gOsRR;#+_<jX6Cia-LjdlKv-ssyjoVglZES4pXfN&7t<kgR#>B+Pty@VY
zw@Rh;(s>EN7h|rjYH#i4Tvx7KdDN_km@)-U)#qzuZV$fm&O1gA8klPL?!f4Kmn>Pb
zXzsXi^YOjp?x}ajkOZa@5Ia69HoN9{SuEB0u%@%HeZNT$=1UW<iH8f%DwW2^BiLIe
zm&&9nFO3l3$S>)kT6zy6MHLmnt=qlw%=Q_M7wBP(G@H}XV8yKl6?$9NiSy@^vjKH(
zt}kya>ccMumx~%3&mPHWhI7lsMi_SlK_w+YMpbtg(`^;XSg{OYw<H{`6ff3}{$WoL
z3nWqshA~FAwPE$66)OpnuB`$QbtyDIJxYyts2;zV72pwZv73=JNDx4^!UN5Xs*X0M
zqpe>c(nu{$eF(3BG$l2;x!96Gho;r*sFSMG4)zq<{57=s5GyvdpXv(=tX7kWg)6V~
z`_|k4lUr)~$<fiZwL;;sV?*D!AqHd|M`>CG;|O?%!9ARKYhp1xB4Xr77%J35-~XkE
zd~$mtGP%C~{CSfpDQW2YHpJzVTapw(b+x-YCyI*Vzr&-VZbNE5xix`tjuJB=F*6}C
z4`4o+jZtDIBqm@`(~nUVAp>n)&8?mA@s^R!)`k)=C6qLf5)OenMN-l?fU#nrkAN?~
zySpD4LtG{T0<+r~P|!vd`U-Qw>2I*d{Q6WuBjsL}H5Q!P2H(nU=MWu$6N)6nHjv;p
zU?YfruzK~5GBW&efD8XLoRsZY&BI`@*oB&jPU&=Bq94MrmP?nG&A{fYfE*UTJ4V>l
zBz$cq*}{8CZYEpfB`{H98f7uoe<OG+I&)Qw<4NJ_%;>jJusYCxTq>w<?Gj=GA?j{z
z2UbPU-`?6(f%&GQ2?ZMlZHSQccB8*`_Y#o=4hlLY=`>@3gKALf)W(3WF3PdkkDXI9
zAYKTni9Hd0b<tH2Vz~e@&jC71gn|S&p^(_<RLOu^6Kf!t<fvWF*;`#v_g<)bFO1NG
zUV%h>_H0&Gab_k*w!w+0yIau%_{_VGcO~#P95W_}r$k;3HOK}cNsPtpc0dBVF4!K)
z6C50!9(Fv;7&VFTCv0tPYHLddMO=aaz|sJEs-vSF<hux!LEV-tGN*=j7M|fQJi{V9
z!>pn9KYqNdkuOU_QTpM1`%a!baW1F08V1KwQ}=h@6&8a1JKj%Sn3t7X(uj~7vfkpe
zXY)EB3Z%UvE2W5q(JIj=C`cDI4ME<+l-AmF2M<n}5+v*_Pl2lBr*j3d6j&+%H!_07
zYd0RLQu+l>ScHaOeCOD)KB5Gf!rL$`Fg%)DwJH(ZGoprz&@JQ>&+$*Z`s&V|$D3SZ
z--)9$J&sk(Q!w6i;dr0C9}iZ;crYJ|<{27Nf7nd1ll=T3TCw}|>7p*oR*gAVP8~W(
zov}goL}Lz_>skQIX(=x$hu3jhT5e@!iwz<n>?|;wVRXdQ>emMx6NPyKswHsq^YfOY
zPk?GosOTw!%THoJRFtN>hhpZuLdVC<oH=>&)bXRdY1|ok=z<wD0O^fGAv=b-yBmUB
zz>nO?Bi2z!p-L}z8#7ymG@N~L2){<TxPH!bSMwE9LzusMFap91yN3xO%=Vv{O2U-H
z;S9fScm=Ka5?YZ)nS2GU_#%4og!YE=vZ})DjN&#c3-o$#D<(9vRY>gt=Bms~`9)O-
zjcO``g@x(Clml2@Z+9mt<i^=-Zn29NO;ONi6{wUF)CXpm{_YM~^c0G|qO)i7yU^HD
zwgYfN=n7>Ti5-!P%DYtl!#`TLC9SgG7yD;<+2!cy%e8v!xxG7!PkpmtQ*fZTI{)<U
z9Xob>ws!6Rd<u=iflP}24ggHoR=x{95Ib_4#1Yu4!_-&G`i`L@@u-1XtrHNC!bOdR
z)<9=#i)A2D7^yK`xI!rnHhV0;Z=5;{)Msh-aBypA>#)zN)s2dSZ_20SbMeKr0#W#^
zcV>`{^bowUbm_Y@AvgSAfZRU_NDU`+n>>I13zWTWGk>g9KRQugcIwnAsAqjzGxjF}
zhsYoA2{#=*db!1@=qNLp;p?W-d#DA86ABQM=gj3SQ%zw>1w7vyDzPKa%ZJ4UTotu#
z)tQ&irI$1{bhYDuWx2VPbhp%E0-k1^P}p>8>(+B!aJ7^UbawSZ+lP@wBv%W2F`kG=
zOr090gtS@hYNi*FJV+0G)ey+YQqUk33<x9xZOs%0&}Bmeg&s>YRI1Ir0uLXJQXmlt
z#L^zDDd3jS*MjfnPEhr80pi}WvYK|<(rxuERJn-kSczH+`4DLWM~(86CMZ~!5h}4<
zs<5{-SOAZt9G1f&UzFQD8uB$9@)clUi0;G*z}dj3CIyW~PY;i%V<wN`q(MQUW5!G-
z6UVKT7z}qdH0VG3j7R=SROl3|R*}y*X4FqmWkIVZ-v852qlhMFrKqH2=K~Me;`r(Z
zJPk1hZ8je57*Af~n4^yaSOJ8b7!i(+lBS52y5?rPUN3KMM&|=+-ot}<bBxBFvLgAo
zyK9I}zY_k_0BvI8z^5#_uhA3!b7o;6l*LMbBN(C6*O?;1A4JLMDw!g}sf8<apuO~J
zCMcj<282>{Y^|HSDJkvJ_KuG4jvTz$B9l``B>-Va83N#H!zN7{L9u-fsRqgeZ||z@
z|Kd~<Nq+tS^(NQr)Dk8!^n5{&M!z<3-S_9K=`<)P&pMTKczD2$9p8WauP?vZ_wBzi
zCw}zxQ8372d50D++=||?y};rf2X*1}h(J#DkAI}3WJ02<nmamr&;jmnEj*bV3;%_6
z%GV#b!_WqZL|5ot^Zo`;2Ik6vSUMaEo_PKB=kLOXbPrr4w*&KseJYL**rz~M4yxMm
z^XEVD_FyPg>5G$m2F`8Wx)uAR<(Qjesi%-4BcmDmEDyiHAP-4mXij#1afzu6fx`<M
z09tA(yHs{EIlm<!ps}Sj{Zc`7CxV&TTT6fm<Xqbd&Yv&pkw_$rwY`>-0k#X(oT?v)
zrcw$YuWRb)btHy1^|%c4bk#|$t+f?c&KBh4IsyWef!*EHCr=Kq+4bFtJgRD|h0W5<
zW@|35tZW^?VC1m2H&YVHVGBlbOmA;2Z1?f<I65VFnnCJdbIz`G|3mpi-bTw(+vO6p
zY(#Q$W@co7k|BT|_(hJJgxyBWtl8Su9$Q{uU}1e_zu)936URU+Ic5y@&GGQsNVv5Y
zj;O5k_s=vrJbXW1xBgIOvkqRhin^k-bEm??_U$|L<>%k*I{f`6@Y{Ux-Dw&FfqDDw
zgj;KAX;)WX-Wb`HLqE~|YJ%p4Ib+;w!F|!_f9H&6|8aIlEL0Gj@Szu8c=DeV*|`M@
zo-g3tMUO=GG4eDQ&$ng5ZMS#C4?i?FZ`r(c$Ijimc5dCWjmFMBy6f{@Yu0^xw58>z
zqsKn|eCz&G=P_0v+e!Y7A^}r=YwaEp9c?glI($M5K3*Eq-3ofhTHw$mVPX1_cKe*z
z*s(1K52Ths#xSaMaq*s*fN#6~Uq<^cL;J5s`@cLmCyp;V{$n~+-?<kvieVtn1CXjV
zKf9nH<NQUeWoWFC>|EgIaRrUISO}#m=-sgh7;Ce+hY#y(@94+8ClUz+YE18-dcfii
zFL29rcG*B)L6I^1ctiTTJ1s`#`E%t2BSPQRBc~4hi+U?PC+%R$PJQ?J`t={6n+dq}
z8$XT%xZrhqC|B({U(|sf)R2C7`&zgbh`En;olYZE1?S?g>qtFboDhPsOfUr-<5`6(
zSAMc5IXOA?YAGlbR;}8cR%$iCs2D6UrEgALWmL=#Xs2u4(q8}3f0}`X!B#{%zmPXD
zdj7re45K6<+pz@N2<_`3avVAmC{l2&RxF+o+yQ0=vtimJ|D1`@7%NO1pR!MrSMVHa
zLwKmC6wY}ysYj1~9ybVkcvW@0yW1whNU8Q5CLaK%3xkj9FQavxNtojg<`LH@;QQY<
zj_-GoHsYDeElhux!`<L6#kRKgN_Ig}x!KOTj~Fpxn6h8&278s8#MV(&lwVX<Writt
ztW?@sR3mrQQUWK&b=WX5w$G&d%9V2P9RNon1C6*wqn67=Fk51=z)%7X<9Ik0$}lL%
zv})`K#B!}t)Y8}2(a|loWSz}uM+2%AQYkf0!skOQ1;Rol5uwv_;@+-4u|^|J2oXrI
zoq=g#(!7~7?-&8wl!omQNPu%zh(#<Aka!VH)+(cOmZU5n?vOZNNF00(@n(n&p}#US
z)6>rZPYSYQ0L`&*mkq!7UVs1N$Jb%C70>?j?YB9M+KJ-4)vNRJo<&vdjVDvN_!)o_
zVi4wH94{rx0>Z<ao2O2VA|be=6To`Xn<yLR<_5b*$Vf5=Cqc48PxABiDm=*wJjvI1
zl2v$;6?l^A#bp#a*w76=GJKoLobsJ~<jCm^$T@<$^G<nG&4=YnE?_*=FRHu@IzYs3
z$;&Tf0G*u<Q;~y+QPnm}hto+$z>rRhO@x}F?j-Q~u~C&E?8k`BXvM<B0hyIRHYAvf
z;p98LfpJHl7#22qbU1W78e2pDS**17eDlrjpN<|qdMc-(KV;6FIT36__D)#E_7yca
zBEUEnHqem&{knDQcI7f4h=$L_K$p3ttIsM_xyadsNP)sdEwJ`kTFqSpELpQ=S7Gx&
z;MA#80|%N5cdbcHtyUYxEQDfw;TVIuI@PF~X22%$Qi(+%XvcS>|FkFRqR=Vq?}JKf
z7OHKFlZ1f$OTK8DzV!6z)0IBco}P)}^(23MBY%EcKsRRO&SBG@plaVO{IQx{2ud?f
zDFXJ%4hJYphqd3H5D7lRb_+Gai$PFE{{HtTrv<WEFs)__0;etcdvvr<XWp^(@$vEN
zkL7jxMjNN+W#PFlUCGJII|)NVMphor7~Vn$Bs5AX0#49I%E?B<;FXPU`a)#b9N2>L
z^H59QbJHQ-umnL1<q)cggF33gol_-*<g(aGh@@C`Vz`3Z8GHf^BL(L$LD<+HjJrK{
z$ACj*obKqhqJ!83Zf;gwW$AV(<X9=n8XNm*6fU8}=}H7&br||Z2u2HBFz+*p80Q!%
z89Q8zP#3*cB4TWe1CHLn2u4yTNQndSH^e|~5s*D%Ys?3afv^aGL6C{W5}G^<mtl#@
zIh)hb{8dQwn!(ZhWk~e+-0Z741(z;lq!*MH6javNfp&)4IV;KwtfU3ifxuCSn@hvy
z7Q-1MALCm7;Aq|tTVxxMXDm2V>>`Shl1sG;Mks2|Ef=a`f)<Hb)Q}30Yy1n$J|d&<
z<uZqV=$9WHfDIJws8RN|_iG@@qVklp`#zZA9K_u|P0Gu!7rLqjsxO~C`@@%DmH8H|
z;T$)bfro1vbetzb-+AYy2cZ(3HX1ZZ1B7X>Zc|U29Zb^Gi>!w6OP9eD=&3t`<rV2h
z;WW>x%UM*(y+QxlG;C>8&*xlCIsQWuB%@Y4;$E;t4n?E-MD^waV}08*p}Q_tMb3kI
zgjaD2{`mmLZEzTQO^u6tE)JtTJ=P7IiFor?>@eEuOx-L>-BX#JSJz{+J@wQ*Ap;GW
z0LAdG%c9RRS`;x)8OIMW*6O0#c9G2C5*BRmcNcZFQy^t-eSdYM6yvtuVd*9sPdM>u
zMAqhVs3gi8odfp(OmV%?wK$}sM+XRC`e<ost2bjatqJn(ZZ_Mb7E7<Kzo*R%>ZrEX
zc1yR#I9{c3K@3-!I@A}W%Kj?9>G#C=K?+%+obbW)B>ad?$9joeB33{Rs1Re|9xD{W
zcHM8sHs}J@D(5J|vZY_#YjxQAS-BL9==~r-foiC~lkUK}x_f~@a!MDC)=HVhpD+mE
z)5GF-ppyG5EBbCh6XxEBFp|Hc4GaFVLwEcZG-870a@~mEQ;T_e@QV!WYyML;CY?9^
z{%3zjJ*E_k?LrI+zoH@wF1HTU+=7~HINNQ9j{A31Wx*C@f5|PV%LFznLayA3&MW{e
z6@ZqCz&H?qmKu(h(pFS7Tq#D>C#AQtxjZKatU~ef4~^TaWOV+wT2{i@RNPVCs#Hqh
z%<o7{g#TZ>{KeN7Jn*MKVSiCxvr-AI=EbAu03QN(DK-@7CGq5OE`Ao`<K5v1cSJZQ
zJ0=TZE2!>XsVy(hZ?8cd<{!5IkW<mz4C1+X`QP7L;MYUr7)li@wN`7h#f+G4?gK5&
zjSP0mpege58i{zqbd3QF@u0qENa~(NS>~ZEb5WL{w$kjPs@%)xa~s-$lkEg+&#qn7
z)&2cBIY~*mSSQyuw7_-E-DdNhyJ%624ws00hK(K@8X7uWht-9wDQwips0f2zXfp;?
zHVV9lf4J(4lyWv8EG*1=?yN-e=RbRR?A^O&&Du}k&3%a06{nL(ZMMoi*m3^Y+#7Tc
z!a_8{ZiyWVCw&%#W_Gqu2sgPgB<nmhF5i-k+GY2QQfGo-K8d}DVSf7Q>Q&zE#{T)w
zFUMhV$x~4X-oBeW1I>yrf_=X<6QFpfW@Vk^>Da)gw6wI)>#LhTODYW`$3+=bOkz+@
zQU0YfR|_kvinB^FSTKD#Iz&I-w+}&_B{twxY)u8AC2^NZYk%6hHMtE2``+5N@(Qd6
zEl@ggGPl02)*7%B0~;OG(Pozm7>QEU)82(iN$qM64Xv%MtLyFts9Ob74nl65IYh=Y
zmtmcW9ei6&RY4vm^t5gyC6#2RCZEplWQQ;s)HjqeQiTmlUI1E4bK=Cf$)`?9rO*xb
zz&d=6qZ$zLkp2T}$A5HC6F&SNLHMi&1^1x#<C@|_P*Sq-nK&%ezDCV{3$k#QjfHCa
z$dKB@sqtutSgC1lK6|FADJqJl1M~EtzGG0^VKOCZqN7E+2@|TTdwUxiFp~!YPax)`
zkVyv-2!~?)J&aONzWx_c3d#laFiH_>ZKDu4D^>#KjZNh>_5lehR>k%VDB(S>9O&r)
z$3byT2V(L_;6f}?X#EVFFD@~Fz-YLei_C#75DTCZf({0Q|6a-V8bezdJtjxX&V}bp
z^_6*9d1p_7-sD0_D;qg??%YVWwderM0tbo^0y=^1s<}ezNW}R@MtV`wGjju7#=Zak
zuHr7)l!XfyPL{M4?t0%Sn?1IVu8Ow*_&NgH2*ypg@7>v$=r)p_gG;x6%b%SQMoG5>
zVKWxb#Il#41<49_F~Ur7qOM-okia?wp}%*=9n+>wi@kG#pBTFpumCAvpB*YG!Wyqo
z6f_fwe`u6vUClsV&6e-J{~zqteAn#1d@;8WYpa~BY{cNcdNn6EJM#*@FK57=7wUO|
zz1Q!q#hmZ9ZAa;Py29MiCy*)>jHRQa9xITBuI?UIVGQl6Yr~+_SW)9LX6~G*fjr6|
zQC!i|RFj82eO^tI8PSI&HZ$r4s}5J!{_ZLh=W8}Mmm;gYQd5@zHWml=#Z@p^RJV0>
zIb?&o58ARcX3?L~vJVfnY%i;%eWb0c#|6}Xs?IL>aGI*keO-Kjs;)i<;{3WRX|yHe
z#`Ig-oVl4Pps=*LwVMH(p&hvaWs1l%9bI;bG1Od=j;3rFpWrcI0jgi(;g5!PCFbJ&
zzz^;(HVf!_J%U9EI02*d8BICX`Z?e1>^g)P6zM#an0wxM<I!Mc_qlD`wxwCMA&<Uc
zWG2p?4P2gc1-=jD9Ot#Nt9Q>C#a5XRUG`F)=hTOx!{zy!6z@Dd)nEnm(mIT9Ri(70
zu*{279y*kiiU&KDa-p&h&avPKQLZ~)U>yN{a!6mv$#tMPGKPXS4sCdNZ=cmY*t;XA
z;K~ImP+6H5F9UCR<#J|r4!#jw6io`AJAtJ7$Tytt!i96jK%+fOtCk|Rt;L}Pk#;~p
zfQM2pb6AX_4VD&EPp8d#@%v9c+iSv&XklAh2iVPBz<%1%T7k7_1>dALTT8P@?(9Bp
z!_j@h0}U#=Yhn=b+%E*Q>soki^f*@~v(ci|HupGMl-lOv&{qR&1Km*8W16xFv4s`%
z*%&n(x73WShc<0v4}h=KHYd5!HfIBjhZ^UEKpEL!of~i)jSetMKTvxf(E!q_2Q*P}
zadA<afu;*T{`ljCCZvL8i1-HU+|Du*NUd{^2a>X#tBo$U?0wJ|?#Z%^pi{=&U|S*9
zjlAt$xS`Nycwz>%$RpU)69$?Z-TgVhJpk1!i#`WjnD8Ye1am#YTf;!N9;v?si=8n*
zIM9M6oY^i!?E0V}Z>3P8LkV>fA!EfjZv~2hH`0l2G}396q>CEq%w0sORU18l2*wUX
zNTJNmZz*)cK-LR6dOiV(V7&pym7m$@lv>i(fsIf{8__BUZFC-J1AnxE0d3%cHo)48
zK#keoUtQha4qDw|DBDV>olfQLeGq*Afq_Bu=G}?Y@yrJw7~w<cG}fth?wmdQ_1EDq
zcJgEz{V!h!#%ne^M4_bp9k4yAv;a@H(rLF-1qWL!E-rB5QmF>`)7NcxH?bEHglMsH
ziEIb|S;2pX;<iM#jDG&Aor$m-{#rl&^CJHl#@|P)`?v1%=C2*if1cz&9sGTLzjL2E
zf9**AGoAnR<nI&z&V2#=wd48ERQ^-J-$yIwx1KYazgEkCmh+!&{C%e1xi65v)|LM}
z#eYWe_X&UJzFT<C`H(HT>!7}nbk{KtvK1_AGfQuwj}PrSe!HIspYoVsx`n<zwD0)M
z4)5OG(5JbrP7kD=U3lv~KiHyn#TM;%d;ieh<F`iuUy-i@0nUGK6d2li{N_;L>^H$^
zuQ0S1<=G2Hd%+M(XuMe(VYi|Mv?=}({`Pj5E6@XP*neOpbnswUn7_P7928`5b@TK1
z>MLAC2MF$leTak(5^L9f0#p7gj`!rBefI75hYsz3`e}MGKVEP*+mYz$&;d6qcR4)2
z3NIG+iUC$cZ@6JsqNf9iMk7#)Z448s7YY!Bn_hI&oyko{ma)9_Pv$?X`A_g@Vq~fO
zou2T^5u%5`@ApOsA)kku|4iaP$ME-ozV<hJ`YqfiL`%YH1n+B>cEBQyiDZfq5MuI~
zkr<4`+X$La62Sk?YgOr8LjDlolf|1sPzKzk#(NvyV!T7}=C6jI3nJoTm_Qy<TrI`b
z%$zyKcv5F%)M_Ju3LA{fwrx0(Xk^4<eAgJ6kPv*AJLi9z!Vntp=P5AbeE1ZII);45
zCqeo_fyO7obma4iFm`w^U3(6i$_>x)?BH`uaY2Fk2l;HXkul&wy!A##iU$dB$KU0H
zX^3u8@)#12qS8t`jCV5L=Z#M7Gp#3DJ3^HFT0KdOiHV7*(?l{E?<TzYr(1+;7vZX>
zaqS}9MNx`aYVohoU@Wre#x*QtL})-jaOlwa5h3(s0CeIbMi|43u$7~L<F@wpZs?E9
za8oWq{O!(8DEKTE_?Gp-+zxx8rKQDU48Q;Whv(xpE4(i&3-|}<Oj`_DK<?6$58r>k
zp@k~D^UAaCzkl*%W4Jjf>Cn*!rue{?{KE53J=|4OUTbzZthH(T?!Is4OjlRGAb<7l
zEuVir3!r&p_{NQ&!Y%E?q+Uc44+frea<neXH?TK}o&?+>OBYQ~2K#Q@h)Cno7Oa}?
zuJRu14`b_VAiVzYVDwmjK?|p;%Bb@@x@Y%pS66#=X4d>y`5lU2&qELGF~XUUe-+S(
zqvcr1<`)(fQ1#}}`69YS$)|ydv$Bj*4-5+eDBu}R3RY>*1<Q0EoEx@;V0^OK8XC+{
zSqNdyqE4E|aO|5<l`YsTSgqJF0`k$*Ztdx6qbKpd_8tl}v<t1Rts;>Ts-J6V_gG=C
zLC|5z^|WCR$BtJB-bOy{UvKN&0_P)BEiD2((-*uL$_9%D&jxx1OclAs#kpwfB2&HD
zZ0YIlhPu$))<GY*9bP^yot=GPWTzl3s@rR~ps|hN`%SK)@Ix7Ch>DWroq&JJq22qV
zq73v@sH<uJ{yp^6i9E^v^XK=Yt<AONHC+!cec=U$k@-w{;OL>GBnM(A?pFH;`MJ8z
zoOS=*`_gKyj+wJgCK<z*Mz&^BFSMfS>M}{(t9ZSzw7R;8p2}>ET)OnH^i-Ur3@4Ww
zB`qxi|FO{rVFU!FG$-{R>s@s>njZ^cY-#kb&d<uMMug?vd-fjntIMb&yZ1cwurWM5
z)G6qJ=mkL`^r=T8`a<Afhk%C)JrfcX5FQyBZj^a=P;-|J8c=Q+THHaGy+j~DC?$K3
zxuF3Yh5?|@?66o0g~o8bR*rTT2nMhzfW8$kSG`O|t?L4if$I^43ongIrnlMjMnII9
z-i{8N7~E0U(?-k)sLCbqA-^$gzO8RMRxU%YUx4>Hyi@T`!u!{+R^Y!w@A3HEGIX`%
zS4JbEG2V1MqO;jA#%+lamnTxfzF&+<L*o|^-58PR!H`6H_2BFJGt*J-x39Ws-pgp-
zH?N7CUa#P<ziD0Ebf%`8l0;U|f41?T0sPF_etqVoa|<ZTZ<rNWdLQvO@^_+USb8ss
zG_v$=QfXxA{h%Inmj9+Xd-AzC^FPP`Zs2paUeEca_l5G;I`<%5KfAB~ckZKG%S6_h
zYuV54<Jb1T@tptNea^j0$!+KNNAL6Cb1J><{Qlp%@Alj8|FiPZcm+RS8?wB-aC`%N
z{GZLhk6=`)hx*eXc9RUsCEu$UBTM@OsW&1mx@!K99`TENulES}8M3rbT)+1}dc`m9
zy)NA_xMSy!d+Ubs{g0mU-`q=A&~#OKt-Q{BuS+>;_?2A$*YCV83AdZ)E!_Dlbwux^
zZA1Iz|IfLW4z{ZK_UiX%WxXbcw<ZsKSp|b-ZTpQ}Z|F7tsF_68sT-m?uS9k@FZ*5B
zNA;EHHy=Wdc0!KUU@l#WxpsP4HMK{irBt>Jv}0LFnOd>FJ)2sXZ>l(T2A*~RrR3$o
z99L0QR8)ecVr5H9a~)Vt^Yc4;i_2@+MhYu-x7j6aWlaK&mqE`^mT;gO6b4_G6SLt{
zd=U2rJmpH6)<ppgp+upkq~ap2qOWh%3<E2WCc0HRJfPU_FRQLn4F_h^oSU)<3xGJd
zuq}72b-WkqbM|Tn&;jDMqElc0```cG{N<|ry;$h)DKH}ttjEajzfLMI?qF491$`8Y
zIrHd|lc&mM{=??H_S$PtOb!Z;7@_AVfOB==^LGY&!!9d!9TpH4HC%shq})=rAAr#H
z|Ndm%%3?oX`G|-_PkTGvuB7hT;^xc3vaJc5{>)o%z4iLv{~kj=bt(C=pc&}mKCh^$
z^AXAKiN%l4j{}5-M>$LWd3T7H9L{NRJkKMgl$h3D(GK9V+GYd7vA5N9#qQ|J+P^N&
zNyF?|CffYdnaepvoO{uCU+h15$qbm4wd_j9nZrLEuJj1I>)lxZ9?;`+q_~246O7nv
zM333?E?3%&(`(8o21DW5aCOH~m@Dh6D&P;=D%XIbqS{@9hXm5I1{lz$Gso)Num@=<
z1$d>ltG%qoT#{K^dX`NhRUFi}B8SC$tY3fQ#e-?)HZ1HBK&&n`qmK*jJFz3rW~GbH
z)|&dXBiY?>jcRZ0M^osA&wJ&~h(1=YY(oGl7o`HggRm&@COKdPp)|JC>pQ~3ORE_j
z2{f0BE8=}o43f&-T@QvcwE)Hyn6bRP>^*KSO2AV<#_cX-d$oaX1MPLDW(SP|&`$&w
zQ?;EF+jGy=IN-kGZS4Y8mjyoby_SxC$XS1zMJ&FWWU@Q@2G_SbNIB)i)kDe$IdO^P
ze0pZ)`E>F*DBIK1Q&Qm0@jm%X1Rrt_ctufw=t@Bb0_g%8#=cA*qcBcT%dM1jbv8F!
zx<~~s>Fr%92_0cDgocp2oPY9jQ7Cc?G&p1D1R7W}0)0w*Hud1aV@av0sY%BUA2@K}
zF!(6m;K%_^c>vxFoo#4`w$5&wQ3f>yMNH!*9dqZFJ=&N{8%u$>VzY%G#W<c~a)6xf
zh^4Ia;wLAddM5xlwPp|~1&3jP+7bI$*=e!pCM*EnYQY4ZWst~&`tAUU-D+kKkca}W
zWPl(rQjNPtN_1B*l;q?9D3@8Ba}oXdBH6)_M>yppGMT@RC*ZiAKK?^?E`Fv(>F7v9
zS$^dPq|C6fjyK>0P2w>eALCZUl2gob`d2%A4OftOW(UeUpL4SOju@<;iAaI!@q$r5
zx-+TAPbQy6{hUrt0*WSyaGWMhC`?OFPfI<Ml9F;JH7)&y+L;#p{bp^<<&C8RTUeM4
zIut>O^{;^Qu(1GCUKTImYiG$!xViGNY{*)^b_5odweW1f?1ocS32fD=4ODfbgJ%XJ
zJ)@%_;xlZ?-3azB75exHdwTl7i!Xq0aF0=UG3(;hi~`hBK}IU9g{fo%Csmw0si>>7
zTG|o>Z5C^tQ*$Ik38{B5WkQyqgc6hxL>yqX{1A13D*BRJ!B-lp=}lk<+v$mTb_e;C
zRu)D4FGUJ3AO#L}v=k{UMGB*U^obfjZVpHiMh$mqFDk8SZK&^e(fi|kppT~y9JdWY
z*pdbr{9rfsgNZuw$~f=-&VHQ-NC)w1xqRx><reHq!Jh6e?eDUxgRa~leQNA&y_C8;
zp(P3IGaXqQ3pSDE{%V=E&XoS+zJ2?Se6w*2Y);i;&|!$HQ($jQ0e!b?@5Abf`Ytbj
z_sGW(;%Sa6d|JB`G!nhvlt-pUkC^Z<Na%77eKZ5?lsE(*9m)|Jfy7YRt3dQ#T-+Nm
zZwVz~+(q__`Yg(c^Zzmzaq>X4jAJ|Ceml{Ch-FIliWiQ7$!*L+YFPfBKUSbk4|8%|
zsE1A~*EVME17kJMWbb%g_|@67b&dpg5Or78RyB3XLUlKEiczq;rC&O+9<ermI+M{N
z6by9qbXR6%rGb?pDYu~r*xuw5u*IE7P6fg`m3+rV7Ji*+>#t7A?gIgSPmjx(Y178I
z0Mlpf>C8{B?zI;kfO9WcLg|R6kTS+mkf!>6A8Ph;46ttg9y&2d*2I!NocE3hQ)5i+
zLzK~Ormr1fyLQsbMNVw2Z5yx^71cH&a#+6{BnSvh2jq2aPd`zqMV-|XZ|IP`q|n_s
z)pJr=lMTrl>y0sNMLcs7-R_+sSv$<Uj8W=4oO+N-TPwWn2BnRr@e6rH8oacgye_SW
zd1?L5DXpzHO6&7@hQvW>eUeHm;C;<Cwb?-UH1$YF#@sP6V)Ph;RBXd}D;TIzz&^^W
zhYp6pZh%T_=Lb8}uB09Oo*w~D=3<bt<O1}5{OHl$$I>z`9NN^0Sd&+1WY_E~m(CeQ
zKrn1QxEuX96bpk5XG%rmW=`Mt!`b}OE_e;9fy)7@fmh*S0Ba5x_Mv0+QDK$rZXf2M
ztgCFy{tl~!qpbr23VDL2x4G)v_h&PU(su)55q|IAW;g*eg1_AxZZqBk*`&u&P>xoD
zxWUO?lSJdSJRYf(!~u_*0(s<A&)?^T2G#j!5OhVhh{gbM%IQk+B3^U}6<3+L06Mhp
zHuvZUW)kq+^2a*iGgGH}G70XMex0AUpI+HrU{)wvFKl1CcJ1~HtqNY6OeHODm;pO$
zi;r*JvHS4BLuZTgD*@AK%1OC`38bL~Rol`)sbgxXyoNkES}697jS`E{-({_r&z!m3
zij@SyCWcM&6|*7tg*Y4tz=;Mz2u_DFK`-vgMkL=xb9-|^W<hCvRZT;ET~~rWC*_<8
z*>*KS)|<L)KnmKZu%^3vYlXt#5N|gH#+Gi7=!rCtbvG}W2=v-Ejc<BSPi0LV?D=&y
zl|6%6iy#95o1N2BF3P}?AOnLyij)b9pG6o}-r5SzR7*!wQ%5BS&>%uFo4ajfED+2H
zOb^1DNg-_Yi4Wsfs-?Y+)fv>?y)Y#s9lcgQ;mEOC1a+Sztxbhwqyi13@qFuz`@%*}
z9^*T5{tGX>5ToK4j7$QhPaquFIq?fGKKqxqJeTtU8b!-7NFDsw4960B2>x}D4pLa8
zxU1~VSWhwI?tg~j9}bcuqP}kRlm}m$OSX{<{E<dZfL*izoE|vj?wLVTmd?ORXU5W*
zu)lxD9|;(!k~ubd9<0%cqDSvEuz9;@0&>G==6Ff?@01h_R^A#_SBHyB$e5|~qN8{2
zjJ8<3CqMq)d+$9y+1p~&YQz!-P<cj#n&J-)JW45fF^%Qa+}YV&u~N!NDRHcHuug|A
zl#9hO5Rn2+qy!>K=H?xOM#CJ%j~}!}-ZTiwCm25lE$n=Q4Bbrs0MHRRVgVtCfHfij
zcsrVwI(sQxfPGL9GWNuY6F=<U{VDLan^P<0lV-;pIeEFH(ke$kY!L#;q*R{xms)8`
z!Uaht7Jhv!ZJzqoYY*h*oy(}sKZq54GI-gQ2oq?jDLaf#E&lhX8$MfI4_h3#XG94$
zTg3cVW{@rP5WF%!!e%7*3<7F*p;=PUH%<I;io7p;<%!X1X&gC+_5uHd^5uto&@X$1
zb@doc<It1aFt4m+7J~+A8$Be;7vG5~^G@_nv{L2|!2B;0eV0;hABl)hL&)+^1kc}j
zr<c*Yy-TTXZ7sZ<`a@>s<Bw-56t!tPjYi|nv|5ExZZ^Xudw{O6DmbabigjI^)j=T0
zP{j9wO;#*VNjbWE$A%3%b{}=t|459zG<sMR#?B#Tf8DWTKknW2^|sxZbN6ijde@<2
z7_{H!v>+JmLGNRF+nXwYf2gcB3iWORb7L&LBVQFJ0I$D>dMm#qY=rZ}22LA3VxXR3
zBthfDT^p)E{NiU6Z{NOc+xBPw7Kf1sp%=*-$?}(;-M)Q08HHsC!cig~tsFW9oeRfw
zbsJs8Vug$QFdseE@2=j%+*M*C!F9csK2B_Dvl6iuJxZf8y3hrP`=|*Nr89QYD0jaR
z<X)Pdh~dN{g@kl9p=sfxdcDLUDDh~NI0Q2mwd3jvGBM3wxSU;Z<>DFmBcxv$EO9w-
z&%F!=ogQ0ndwp%Y(Iv`{awL0&MIG4v8HV<a2T;;@b$OL0VnVQ#WgG0F5rK+C>4oHd
zDA&H^3v*D+wa&ug^L?@=o)%WDlG_QmHaG;~6q7z{qDy@nWTd;ZrM}%l;rKo6w5(zm
z#ND&DSvV|BtVE_rbn*A}1+$fpr~kyU5daKDPNYQ@TRVD*L?Pltj0pD6p?wGC<kO*~
zT9j0Qk}7~{7osD9PwM2h<J-`t!ggz8J0LD`SZQs+dxMa9aXm0PdmjaD8uREV>^j~c
z?{h+dkH|-Y9fyPy4x1c4`QCV@#ntIS>4H2wkcS)c_|JGBqHQMz^AUHo@;Svg-eStH
z=O!M1k<U-?sLxQ2Y;p{7W-9h^W-A;J5M(T#9L#4e?3EB??rck1LJe})AooGWl%W#l
zB;}l-C2T}kV!{sZA5NpOZxF730ql}&;f_M;I5!HLF2@@Q!e+J^^yU&!80Z7_QTH;g
zAeZGwCt5mJq)&Hlh&beAHRNj$enZEu4(5T<@wo_(8iw*g$@rXvy1b#hnB*8|c4D!a
z&yf1?_9uwLJ@`xoy%J>0=eiiV(r9)okSpb2UJMD11g8~!l@(Ll80OgW(h?{<;ML=N
zl_6pgUNjy@NeR3^ZqF`?aCQc0JG^y0=QeHn{u{iu9&O%qu17~t8hm}5k8Y(Wzu)BR
zD-w~@-0fLL;Xw}ya)y~QA4`%{l8)mnqINisGf*SUz?oFCQaXiRg@7D0=HTR+YnPlQ
z>Aa&S;GCGqzTy6m?KF~B4_=iubge=wt*W}Rp`nJx0Hm)<L^Q&S#tA_M=5n`ZJ&i;N
zFZyzE!<sLI8m|4lph<9Zah}$=c=^+lA&4##8VaJGKVUx{k_yW1a!o2OT)skas+Y3i
z-EuVpyTXeXFXZH8(^DB&E?>BCiJr;0nsXsD^8zmww_`z#+?Ff#!?tdi+wkGGiw6)d
zZ0Fb8h7U)S;9<l3q`BL+eM3(jxM<sU^5iyNDsIPy3iN{VDS0`drdLY}3(NhUpG9GT
z{IQjMCo3#0q5mqEKQ)_Q!)zP+FZ;Y-Iqqd-GJNv#@Q3WHk=>o`h`4|i1pt-i4s3_u
z!r9zR7qML(?Va7-Jg-NGxfxs_-H?adv#>_``{*@Tb|@uS#Cdo_f#~Pwuh;XDQZ#xW
z&`;Ad-X3~?q0k@l@CR(HCooE!!YEMyc{q+y;si#C=~dk}GuDgX<hHijJh4^Rcbi3d
zRXV+ow@wMiCLTAc!?IEZ!G!OmcVuLwx1h%k0>~;XtXh2POB!3+8M($y;H9R4%(bq1
z7s?{-6-cz)bi~ThyRdx&GL*_wS-SI!1LaU$hK_f4S7Yrh756eSlo_2>sdN)z*0x{X
zlq1qo_df(jSE;~>L<2~O2&l&?NVdJE3rV}k+bddF<Mbj)Xb6Uz;82}8>uM9yt-GAl
z*ERC_S6^QcIBawn-09Jw!k+u*yYJ#AOSgC?(5UnDW=n6y$*;fu`ed<B4d`i_G(cBZ
zdHT*pfX(>^S0)1zTBIWeZiK_(8synqS=<0uw)Vo^D?d2Vf!u<oJ@_Evtq$~e16Y9S
zIUWl}?^mP6;{2W1qMzBHctSm6(V|6ndfM!4?MbkgZa!8%D@5k__~T>Mb@d~jefHUz
z%DM~NJ~k=>-K?ePc3E}$Df4F|hD|yp*28g*eCYoC-~aT?KbJ3G_P|}SVOZ(;M#aor
z_~eo$aR@<3j}JUvTKLdok3IItBa5C}wD9S_{`IfV{^{=Nad*xFS@9<7$t{26l}BO#
z*`2-cuZY#QdN5)S_)j4JN!)Zm>+@^PUAnO#NO*XzXX)`{g(xIJJ5W`t$z+zoPc&qN
z1TNOffF(<oOzZfev_1p6hvQe<gzl3b@WQ!A9$HdWbn(oB1+!f1PkaUMkYg1Mz0nJd
z)4TG{W<sR0&cbuIvk-cTO0l-rzYqK3)bjkxK(N>3U&$}Okd%^w|Cu_h<v?NQ);APp
zXXV42BEP_=uD_$(Qdf|3vEV{kE*4h^cYQts%IuUQVA-4Q;v(#}N;RN|w^-T-B9{K;
z9)IliDoUVgg))^D>f{1&;=#=eB~k<LVT*oovebrC@HqvoDA8hbDHrzIi5xIlk=$#f
zPXYqldxiMQjMIaZy$AycQZAXuO<0D#d_j9>fyjL9$l)YYRY@*}7gKfKRru$oU%7In
zG%F(+8kgkE@`_FdQi^4Q4?xgf`u3*g4ry8@2!hY2U$}JnDz=noPhzD$T`VU30<FQD
zMI~1@c-+5WA_GIkp|6h~Ek@`LumyTbu|E=kfVZQr3p-owga4dhX#haQ(gVUrV)ugF
z$yN5Ae)uQLr7F)LPpBgL>>i<h^1-z#wbN5;Bzg?qgVEFJS{w)h4hzpjtYPSfgnr!1
z4eFceT~wd)Yj?r8|Eu@?vD|L|E~@hxva?<*8D=QHV5d<WI?<z0x%4A)sAPZqE?OVd
zS~;W-<uII)UetpDI!+^UOX5g3{@lVLgd>O6B|~j6<Z~8)y93Y$0R;PniV9$n%8N^e
zzR7XU2sP4xVDM8nar~uA@STy4$G5cC0<a)17<>8hSg`k9yg1&dE6jgpX`|qgJM#0N
zd8XF!&?NYL8wE$_%sFZl9G^4ixKRf+O0B7)rh4cbfvt>KG71I;KM^(5-Ce75(+_=<
z;2ST9r<z>KPx@DbkSsM^<0tj=W#K&uuXya`q3fq>uAjYFUo3{e){YmtZ%J7h{V74%
z0{T;S0<z=5N0))4J*D-eAA{f6N95#{ATn4@MM+*x&Xw~R2+m*0$>|K3ddD3B9XW@2
z-f8NXvG%7+LGr!wpi6tdY%9QKmn~@f5?}FTI|sKV$A`n#t=mydf*yV4l~*1OBE>t_
z-DfEtud!_WQS;+Q%YEaEEk-hK-kdweMvaOZd&iu4_dovBbANvBsmJf1ch{_$GiT1a
zYu>yEFq%Fv@8!7<zWLzXm*0%>9dXwP-<Z1yVz&(D5FPE0s1YV;(@n6&`$wBKI;gVn
zq0``7r!o4{6=EfQVPZs#X!=uKX)@8D%2Zf>Jy;qT38klXKtBe*3H6O~<q=dgfTD{F
z{m~=5BK>g*`mH<p7NgpGs!>%!-l#?uJm^GJfDj_^TU;gDvPG|l*WRjF%rNT&i0t?R
zPSztd3moHCi99_)I2FpRa_(M+Qc|Jquced=hI6>`uM)lgK1R<K+$zf2&(0vH9699E
z1QDGs$VL3y2PDfRoLj{|6Lc)tMc!;DDa<$Jn-0ULhv8;I4N%X&A7RZz!_9=Qas+)d
zBJkfgaKZ*tgDD-g=HP^0S}$!F|LYB9R{gxph@)4)mszjhw22(#RxxE|e6i#CLL(eq
zJzr?87FcE!nosE_$R@skY<Wd8TUSBYW4<};^fbZ-_xiIRc@egvJeh?nAjmKcEF&S#
zn!`6gf=ci_LnFp20oa`?jH?7`)2FB5%j=_$yzm78oC9BojwQK{+a1CT4B~d3Pk=QU
z3r#cIthKUJQV1K7X=RVc5f%dzi#;x@Z$lsipwIYn{5Ma);^}{ZO&fx*4bBnNjuv8Y
z+R-SAO$^5zjB8ACJOg|QN+aM8CU|KK9O#x7Z=#x=O@qIKo`l^LyfoJFxP3o|TR6rL
z!*~upxi3<lij*fo>IPYP5uq6Ir|^Q+2_MSj<P?kzDW_m*I~5<VK%@f1r4q2jVIwLf
zh9oMHP*UJUf@qdcISMH~`rD$yrVQ6;J6K$q;LW^ZjwuPoU&7JNSKNqN#fm@xf;=#$
z;rm|j)IaWcZ16oDp_ZoO_rEzla{SG{KT$e)is#w0XFaD7JPvR3JB?>LjmJT73WPQr
z0GSIqp~2u!m+k@JDGrFa@qgFkO^(tkASpMr_Q~XUzO`wg56@<%o|yst%6R*JzRAzv
zpR~z`8)E1;pAy9#Du31@m@?2JLdF!&5q8m{wZ<4I&EmlaIG0vB&NA8<rw)eNm&f4F
zNYuCvZK)#+)TTq#$g*;bSrwJ_ILeaZF;1-_?ED3<&%kCJhx+ve^HWk@d@&_u#*8CJ
z$eo-^L`0|?X)3^ua`x<Fh&7p$6JaE5W|cL8wN_=)IJXO!3m5or(S-}3N{WFql|)8k
z@PH{!C|oVaR8d}5fTJ=c9;4zaIf8R()KVNSf&2+)iRp8X#&bvA_}plEv>)1EUYu8)
zhv^59f}|BlCxK|p%a&cex@?)b>H;+H7pnSs<vH8$eC%V#X3xe`7c>#K&<Oh6Mne7;
zOKM3i^Tr$ex9V?;?uv<txogoIYV{lRxdD>}MJpm65t(GQyr!|H5#xMijVWaX>M23)
z=I!Q9!LV-HK>oz_mQv%nsSTR;9cN34Xq({4S=d@>OW^~7w*RxOZq~0ky4>)`sw0Qv
zmuCJHcFCWt#Fv4BF0V<*e<E2EaU;dCCgPSvpfnS&Av8s(UApR_W7zc-7GO9O$j0Y`
zFPabVX#B??$b*)KmY>$d&^QUz9EXVDiHTec3Xi1mXFalsp<jF+^vQm?_KT<2+VOGi
zHvAnkwDP0((6ZAt-1XAno<vNj{4Mkwc{y*ome0`B-FVM0GP!pBFV@Xi7$V6#oi&EX
z;YbSo2;>s~t9x$exwI%d)#JJvu4y5OaR2ttKZla~6^_iu4^X=`2vz-7JlIAEkR5Lr
zg#wHpEF-^@I+ULjP%Kcqa6s-!<g^4N#VD#hQP>6g0s`Db<KTXS=A`~bPWwOq=4UyH
z^oGPkKg))W=tNE#SrcL4WN0=BOZT&EE*1)|Wy9AQ)!Op8pe?nKAH<3wqLQ-Ib6E0|
zY4|aU{GvARCzl6{0-sFk{`3jD)Orp<eaS|naMj9<U*VyKb3mt%Y@;YE3tGFq99)e_
zzf;PnZ2r<RT?P?>W%?7`yM!A=K^$Oaaq&ziPPtRdv@29uE1W%jXa#ixl7dObmC-bn
zo%m(KP%0;wx4C$>fFe%ff%0tr?KDzw>zH4pv58rTH1fdsjWqnxGCz9`CE7)e8XIB;
zXXTfW#vRCBeh|OJa7=o-k#wVu;$xTxFeMv|g60&|JV0JXXKM5u-vV;f4PB#9rg1uJ
zQG^I1M=A)t1LU_Huq62NFx?~uY;|Oqk!>d37$eZZATI&VG={7TIs-zIA`K<d5GH37
z(As&0W9H9af#jHCd5q&_DwP<5SHSIzPKT34vEUs$Nj4^kz!yd(l1WKfA*xO9Wa#5I
zB4z>qlsB*a+p9Uc9&|B4gO8`YVSY9h9gAlKgfL2F3<9t0B8hZQOhy?A<LggZceX>^
zQaOk;Ica1~wddj)tlhNkBj~sD`Q!$Ik<U5$Q7n?wiA5suyo3Pw5bKD*5Ex4?Ad&)!
zXJd$%HYkK+Hrki&&S*Q(cBN~5YN4TCV)1NpJgRUCw-WP5gndDL%s?6a9jTyY*~jra
ziHRZc@knK5yuc7cp2IgyO@-8GzoJq?trf8M&}WH<a3DrRA6CdSXo3SPk))jdMU!L~
z$Hxc)@fV4S#k7U1!I8g;rn`jjzdFlGdlRikItC4n^v-1(>Jgy@@xX5~MW{)PK#5@Z
z9JK;BZ)N;_W5{--n96}EbOo(NGQiPF#Ml3wbvQIO4b>q(HkBh_E&}5cA%2XacEhT}
z0636`@naO_rat)q;sRoSLJk^56$sOcaI9c&2PeNsN2y6e2LHM)({#P~^PL6S2=({&
z;6P$G+1FqY7zuq227wspcKGpR&d^vew8I(dyS!(i6bZZzgsmQ^8rpMfQT-SV4MtWA
zCMNV;z-ji=znxEEKx?|=DT2_N{=^wESviCcgkF&117GJ9Kxa_|M7_BK*gzQ8=!#qj
zOyE}~jPPF=K!FF8NokMf58*_ucH%$cpt0P9@S%I97H^;j9{08oRWB^kt(IP%E*y`e
z08mMZs__8N6Jt~r&@gFv1%+_?FT_JCWHL8TU<5+EJ>7;-e@Z+r9j|CVp}m-nHRv6$
z+v_3Ni)c3}IfA)?_L9BKBJ>hDJ=al9^6*Xe<5A;d99nLrv-EWDBSq<dfgwbC5KFcM
zyUrDSO7yP|QcbI#*^fHGlySqzBpZAl+6D=<%BXv10@?sFzrmP5+kpCaCZN#NzcT^F
ziy!juq@x@4%=|?fj1SAFL6{iwl`|1Ww1!WFVQTqA7;FAuOaAYqLhE;E9J)5YNE=b&
z#e9(j`etmkoxY-MZ7YQ9D@-tnMuAoiQKufG0&fk_pUgF%(IFk=4LUbkL%f0yLK;Vv
zZV=H_BS$5)9bXX8K?LKFjQ{fPQe0PpJ2ws9{x9e4bb*Q6vj%JBf4@9*uR_OGEqV;y
zW6`lya-`tM-i*B%FXII!=)MyZW+0~QUmSmhu>BKpHu(XPG|zx(<^%=@iGdhK%14rs
zxZDsEV@Ra7AwU_i$X&xr70p8jxzzkTkAfow8GAFX=OGdjes`qz(DOjjL@e~^R*%L*
zIfq>0#ReiDDgRk6Fu!0obS)PVl{@4@<!)$IoPhM5iy_AXJ6I{1*GUXBf<}%RNk3wS
z#-9J?UT@?(0yQ`s`Ff)Uy-|aT`ua+2PN_-_8dRCE&nAQ}&C$mi1)-tq*T=yRp0cC9
zB3Qp3t3h@|0VMAOLGJ(~LOeYh^`xU?*|IqB{A|JTrC`}I1nnZ*F>Of}?f3B0cr4E{
zDoltYgE6eWwiX&xnN2K&2Ry@w?MCo_(x}lib~FjT;Xiz9(C0Pac`2XgwdV!;uc)}V
z2oOO2dD%YtxI$Z>@&C~F9)N9CY1;5rZ<ZxXwj_7C#7=^7I%%XhPDp^z!Vt=^ln@9R
z+E9j%nPGP$-@pJfJ1`7&8CpUMBq4-UJ5IM9C+=15lC3UTmL*xe{LhhMhOn^Tzu*7;
zSGKzDJ?A~|d3zCkzH}*i)!egm>E{?Jqa=a>vN()r5Ch&pX=%|db#-6u-u+cw-7Od+
z|BH@)Q%Z7`2kymKX^{~ruR}w~fi)(E7~_%=M%Y|hgiu;VMuvjK(~=?n^OGbcE5sPD
z!Wd^_jD>({Az&)$N3S>hVVoFgKgKC$Fv4M0Ad0l#STq=;d7qV(kiX9=(amo;Zi`r-
zeTGqsGBZE^c<O8GV~wbXyE?vrIz&sh_V<&&t?O>QaoyIf7&_Z(efsIf)znv<^~S|3
z<}XHRS866LF#*g3(y;y-6Ob0eL&J&kS#cP4U~Hx(3aOO*VLF(Q0@L~FHxf{vo>A$K
zXGCU$DFHyREF@<X4l_`43G>0M0yLM*22&z^0Z5ggx7c_CGvZ)EnNx=_7jAdQrN+ms
zU(*sY8%zlebVGQG8F4TnYvW8zgtK`5ip9qDm>ex3lfjHe^?D#EK^-yXgGgEwGDQt)
z7N17pam3ofrkj=q%WiT)SAHY8MuZj-?Tttjm*r%zQexm@>$Ey;4Lit)Vqe`_8Gn(w
zHU46}nZ0jD-)$88;`0}uuRtv-*5ry0DYnj{v(%yDCJT)vq$;UuM)G+AW(sw(lY|mi
zP^g)dO3k<&$WN|<-WrK6oSc!w<#r^m$6hXax8a}H<gYw?c4gwa{O-x8??_ym)p75=
z9n%B&;Vk;ZNOmMI&*LU0f{Wzv5~G44hz#+cGoR)vKbg6{UpG+0_C@^Y$636m=<8<o
z*=y?;Q|ykXtanwgZytW|BE=pt>5O%3AzJ_$8`zUEgY7WcEtk*zV-9hJT;HdwVPXW#
zqv_4em8U7@!~GS^#)l}TSy#sdoS91L4Dy&9;m_9W9n|&r^y>zDuyeR<DimYKLOYQq
zU3<J%B0dhJ;?17fp`ESmm`O7^N0$=&<kF)YJnR52@eYJuoO@vIiy>NI(3xx|oxujw
z;iAI{69rFq3eu&DEQK^Z3+VsDn~60fR?~%QHnmp$BdaNZ%VM%g<^&#7`rv{Y>Kh_=
z12rkk2nwe%VKNQEdMZgJ>yTKB<d;*ArXv>B{O-GEKJM$Ag)7ed+tuP>@y+V|Z^4|H
z-=dyf?!yoF_ZOfskd|4na{Kn}D+^e7&MH`i=c_Q6^t-yc?)v1@OLjg2Ci(VDpN4`Z
zm0K=XjAw1BED6#nX81$K%wy!vSeFuGM<^z-o1$71m7;{lL#~vQyNnrEewKtju{IE|
zf*g2D>;O{IGj<xGK*RcVeKp)LBSeu7F{(qVLxo>9bDP)ipBe3^xFAbg+n%UkJZ)V~
z?O<^i-%N2qflNAc9hVb_WC!sM^hP07&X|6kfO93TsR5k-4REf+H7hAbfttYvy-g^m
z5N2V*V*}g-p2-8x)w<y!bp9IXA4J{cK2TM-!bbFXJpkVriiP*r@K9zn97G9l()0yC
zMXo(k?jv!W208T{7DX*p6)KsLu(R=Wht8>(b$IvQrvA}TeyMm$`|YmeXA>7rwqO42
zQvX=A2vPcd-|hm+F?kJtSp(YeV*HOKFYP&Y`0$~FpS;zbj<S!10Slto&5Zl=jiht}
zJ3Td3oDv+r`iaZ+w|Kw5rQ*gLZ(MUXO)Yhdo2C@$DREE8ZS3s6W7Fn!=+k-Cg6nU)
z^U24PpNV6W!ONemExhXLIg4(%?XD*uCwM(2S&1-+r~Y*<q7VL-xV<#{g%`GzBcMCv
z8f|H5>7T0YMSYv%#n){@3fj%9R?YOmQGWXHo_F7U_p@4Bts5OfBRQkVfS_zMSOi$U
z9t_W9gj;P4Jfn_>O0*o*{AE_5+J6jHq(LB&n@1pt@QiSjQcGp>G^r#*kuJ+nD#1hG
zPJ<IPLy-ahnjB1J#{c#dNxUlo4y*zWtO5>{00&AahAa(hO;(=VCtRW|RvO_rx)I%&
zo>URWGWXZ)kfLw~YAm1*BGwqA!@B0Gid5)ef^}`zO{iua{%n79pOH~mCYjRiCu^5I
zZ}JF2LBH+<mme9tc#^St)23ftr$+JM9Qjo=mFut!jw{geFY0#dwB2{yz2(-c=3Z5P
z?ajCR`Zomf*=PFmQ7hv9`=5H^i6`#6@4j_$1gf4rO*%;*KSN`Tqk5fQH#A~2jOqbM
zQ{4_JjM`}9&L*HkhFT;_r4cSAO_Pcx8R@b#z)CUWXTFu#AE1oTO@C@Nt|2B*nBy1_
zvms#-X}gZRHA8cy74%A5^Z&PB#gf-D|Ie=V-~Ec%oPTzNm<eWO{kbdsPk+M${HA~N
zPm6eshT`Jv%>-sYTnUzX0zpcdw5JisPycdSF4uquB_RLf-{JZH2=4z^=Jns>1<}ed
zuZjNy2>uUo39%aFO0J(?iO2&9YcF^Skq3m}Lhu2C`XbAxhGJE*=9C?3W-Ps+VRgEG
zTfy4D?gGVXzo4z7qG(Glk<5T+b_tcF4`dCe_rMjlt_TH2q+zxo0rCY6b0bQ&y@Gmz
zz^c&nLt+mR%^?f#7J<I}pgD{XcXr=ppY{%z%)k?%?67IkjFl^^t2-46=s+m+mHgz|
z&dzI5WQVu_$s`!R+q@36iA@=)&3L?b2bZXnxqB%QiuzkD=F7hD9WbkLq7)RI2ra^<
z->_jlxg)iVlb>`k7+pzhQ(%mwTR}eHr2xDXu>T^`AbB}d3WBhR(Lz2wwu8^YcUG;9
zA&6i`Vx*&r(LnND_7fe;DGYA?KL>YtfP6B*w9jVOQUXYf7$M}>3p@BxDoUL>!HiPq
z+CWCPLAv3t<hz2w+0%B_T#T&<W6Q;Lb1}AD3RM?LK#Fc;a6mUSJU}Ef!dKDfO#`FU
zPR{wgd(Wo|NMErB*~8zTcpZj|r!+_ty#4mXS8ls)r<n9-ws<z&?#j=(9<esuix<zF
zp_EDu<J760;!zwry}_s(8zm|jm#`eD*&1j}J5icbCX=S6XGrC;4D7rsK1{6lER1&+
z#=9KjorUqv!g%HA5f9mDSf@uDD8$g{hKArt+QDT(K0--;4L1tmEyiT+l+P(NDXvqP
z3g@&As4T}Us)1H`!FF(0%<iGey3T31=eo+Mp4lsQGAcGAdxyEX1hM%$85=7$Aam<=
zR0rKj9l`%yc>ey5)x`9~J=b4C^_Q&Ba95P{QziZ9cFIQ*LmAbLjE(6K$)Xz@gAZuO
z^cXbLquME#KxRwDzeFyVB5*}2m&4QbGha;1`x?yqTFm=e%=>cRYASPhq+?W9Uq3R^
z0cCB(K0NIA4-MEybTFhVg#j0X8DoW_Qohf}mqtUZ7?a@&2x$p3*ybqmcnYm;LFStu
z)FG?xS;nqi(4jed>OOcAsea0}d1be`Y>Je<U85&XjCSo!QP^C!mF2CaB~I3|`8J`@
zQofAkd~w^n6{{(l@!*5Vu;MJ8x9vshF^#fytZ`3q(Qw}#i*x7A%Uyg&-*8d!p2o3O
zI#aKAjpzaa{iqA!KKf4m=%q_zhEBbnI;T<k_>y>x72&cb143b7lEsa%VsQ!IM`y|y
zN-m;W(*z2JEG1W<NX^KQWb$)UsC<nwCS`DZd|zsmk4nETel!&?I1Fj*vSkW1hPp@1
zrtVX-s9V%b{4=t%s0<z=E)oI=dB8zr&%|EL8XOuNXlUx|?%dam!1Tf4rhTKWD6y|=
z)*suEiRdGy-wy(TDreq6I2c4;E5~55Fe&P-nc3IffB*g0WmBdTyLazCVOqM(W|vA$
z;Siz~kwG^$CSAO8<;o?g_4V}MXMOr<jfu)yhaarVqD(cPq8tK;91ON3r)0*A8KF=}
zB*{Q3Hiyp7gG$2Vzz7BL?D9~F$n?XI^8)B}5%5^YVv>#tL11De!l(GLvB)?&k_GH(
zZW^ih(vX$M35UrgVu*@C)l+`l>TqzVOjQPtd-+rZ5ICk!tU{2HTuiZ3%ThulVpm)i
z7lv4@U<##zvmTuYAt}bV;uJp8)DUDD&QYminW`&b`{QA%($W2SraHGUtxPUbq@<N*
zWuwhAFE@SW4kgYP;&3o&v}8s@*2IbNf=coSQVaYptl>tiVLtYIKE;rvQtEV~fL;D$
zrNXFXfOKon4MIy8JgrFyk$STnF6?)aFqNH^5Hc^%55G!0!<`BcQKqIw2HJ=3sVq%B
z^wwL4QcG|DjZ-%kNu^d3ug{LEwCuI_-uw6;{%}vx@Ru*Y{MN2rH6{&XN8(eJ67Wi#
z4D|8xS(%JXa?(Oo%&s5&&rf3Ox2%u#ANbng^2aQHQ9Y;h83#vzGZ+4GEcb@3TbC*n
z*(D{<;S(~2#Nd+?!4#5%Pfmm)rn3~0P=p?|5W&;cKlwO8Aqb=%0i-tlpF;}T*%ikR
zkV?L*z|?Zx9*>)ySD60Z{(g7*O;0{~Q@XqV<QIi=XRz_fWvK0xn`(CL`uoc-zx*Xt
zbPt*+J$CQCYf(ut3Ae0FXnBb<{s6WF^vLNmgMu{0UAL7mt3Rn`mOS`Kaef9fXc;E3
z%Pc8D3HBvhx87hn_K$xwSS$wYQKRqw67-e<dPGmD1oZ9zt$0w)$jQbilYhyFE08XG
zq<3(zSKm5`n8ne_u`4kU@q8JG&WFvJME<*}EASEePXY-E49Mv-Fz?jmgBLFjM;++}
zYu6T}*IkCA1bw5+ue}y#KK|1C?qepwmytfbM&tzKU=qlsv&G}Y^2*3H)<XqqFfAcK
zONX}Dqt)7MNEt9|8}{zKhQKR3i~Nj4o&C(jvN|WdUeEZ59gR&#I<7>^ETqkO{YXqi
zwL(-*xB^G>^T<ib@x!<nS3qn>t`~BWG>e%flVZS<w45uEIu9uU!3gE`A{7GZz&2aT
zl@~~0`3$VnOp2Z8N-={<R+LZ;4fK&hHA6%F{Rm(}Q547lL<p$SR8i5tQcMlSq*J@~
z-*x#K+U@r0YNxZNM#E@s*05Sz6JOf*XBOfbi#1d+%~<ys>~NfWim!j7vN93!#40a;
z>M0GQvQopUtfZd8IamFaYSU0{v}(*~HjIuL$Iy0fbkvAaI^g+);n(3ytiM9GKvgJ}
zJVQwepvdJ41)`fWq+s;qpPKQbFD2&oAm;Wc=Jo`|q8`ND9)xVO1ZuGkb`SCZL&&fJ
z4^9##Ov1iwg9G4Fc!4hrBC%(1pbth8zyPM`Y7N2*U`Pc$1uZ8>loHd#gNQ@OU{rzb
zzDh-3L$@H!!k!*<97V39kO}_5WXU7wyHi-ei7>Ri+VKE+6_`p%85r=!+ox0(cWNpE
zK>9V<#cWNX3-;oP5G6^Ir%4cDk3%3pmS{<~faOHG&t!<fc$wPw8e?{jhP`?7b#tXv
zEO}ueuZn$j*|nQDYb3Jrf4TF{&FijNxDvJugcBzUH8O5~b~W{`;GyzO&tG%R3ok$g
zC`Bu7HaiO^mT`ktqh9az5mRe$a?*zBqbq_SMViLt@?tMjt6p0IMO_D52YG<;V-(QR
zb&#N95}em#Fe17bFYpC}!E81dk+p8X0>YMF52!I<#K)N#5NC0qS3Av*6EMbn@pu(N
z<6fm$uPuR&kJ^oL@&MC_ECmlt5_>F_rpdVJ83;ng3w!|?Ny_vLCCnyRe3;@({$E}o
z$^Ei{5oMrCi$RsLff3mhBUOx+G6|a*3EpHf#X$Og-H?tv^lFc3AoNwijER&7%|E}2
z?~$(p^{c67s`X;E_Vah%(lCqrRT_4&ClhO#nwT^BR`Rq|<r+x3FH<{rFe|Cbb$CW@
z4al)RxP#F)mu9z(%c;2<F=;rd8$<I|lgVnifYe`R6&sDnu;;|UcZF0gB@daZnLqw0
zf$j4#w{l?n3Sj$u%xylfJ&$bL<S{(d4}4CzRnP~se_*JO1SnTwWiUnNOVH>L3eNbm
zCUa=0wRLQ)wN)XpnbV_2k;vtmKQ~6rTg2E|#VIa!xn#1JI18v!fuQuy8o}blm6c1E
zR#q;os6eXl`~17MJ^kQ=fA~ZBU2sG&U);8elm<GoV>LPvR&m<eVzHK%mpJDry+oq_
zGX{t7^u#ebW&+wI+%KaBi^(`<CgIUlFalwkv6rA1k_h!b=aGG$JY;eO@F3xik)^8?
z8FD3wqy8_yNI<3%kXZ}JtOaB)+fAuiP;5qso&x|OGZn`G=pE<+4($EGLHM9>KQNdi
zdasi{!ZA(4w5q{Q2Q7G+Yw^}w1%oDyy0w+TXlo->u&=Leh~z>KwG9roojrRFRe2iP
z669;&>jIq8&t!{XXw-1x2}|osT;|M;N<DYBMqOEHx0jU>(s<*Ix2^&0C|G;z%{Sk=
zWy?cbw?2IDt<=MWPQETc0UK3>vLN;!=Ln;lH{+#QP>b|LO9D8N3yQ-C3X08&0~^v{
zfM*N$MnjT}zMh;!azcPAHt5T<pfIHo{R!|zA}Edw&{u3n9N2QG<p3!u9osNTWPk1y
z2}rL6q;CMEZvv#(0teRu2WS5T(t`<n1ZW4qVj!atK#vgc_a#C7rW9*U#)wE}9Jq_@
z`~lPjNl+UMC?kXZN8R0gUeMMGC^s3xDMEDqqj~|SeScA)2@6gkQz~b`(3};sz&kJo
zWAn}*0A7#;_^nIOdUEyVN1xihaQO|JAAxMO_10TfE`02{M^I%95PvNb_HZ^5PMAKU
zaTr!%J0*iEarMlZLIyqiCy+NJkQtyhf{8(bCV<zI<uE5f|E3gsEQ(1XW*i6Z*gI$c
z1oY_%{06Kuz~dmD63C~K^-v~Z|8wU^z<wrRe;sJsb?P6gA;@KbBFr10K}pe&2q-de
zzJ$vb`aL)xP<*(SP(F<qUjluGD8a!nDFvE9;_C_NgGeA`#5h<PF`h!LR>XYfp&_#`
zHh<mxSkv*QXvU2jD;E~Y_<UK>!pe<Cf7$&{-(Tj(S@6@uuM_uVVH2yH5lJ+C<`$yv
zK_S<7X@IL*xK1U>IDD$LAMJQOhW^%58H)aWAAGRSuApS#J9;7*!VCcZ16&?G#{?iX
z;E$*{Ksxt@fi)CiA89f<@Ky?JmH}a9ML+kwBsX{r5PKZh`Z%!lF<|TCz}AHmsOS<5
zx}6i_@Ss9e&>4+hPjBr7V~jD5?DfGxz0PGHH^UyT^F?hwWZc>jJfa8&{r(_EfyQjn
zIFmG|4p`6D8>&>3rb&_4i&LV@S18VkLfgaF{GkB7Fvyl*Q(1<@Q67q(WINg~e(_Pd
zaI(Kk-*xoE4?k2WvP6@;dImB*)6^x>!^mqqh49Y#kQCj{=K8+j!BMLtV=me(-?S)S
zfYS$@ws@Z3Us}rdfB0cdaMra;7R{eq%9v>RkX|^dC+U<!J;Q_D5Mf&^{F3#z*#}xo
zsdH}FxNhA#5Wn_LRfyCvYjVmnN^#N!;H@aV!v#_Z&<k3YE=e6n8ll0i>nBz9g3hpt
zk1j!>l+~+erLaa#D6~Bh$e6vFo)?R_k)|HzL`Cp*D3wCqgwA1ivs0K>J4dZnXJ=>T
z!vvOs)+h>YFhq)UlPo|5iamwHOvv_8mOzMZn9*qWMcrhqN+pz17Pti<9dkH=@kt&$
z7GZxZ>gUi4c|0!Sy2zannM-Nec?D&KX~l~d7RsgB2*bk1?1)^HLg*NeM|>^mN@V2C
zN7i(r>N@Tw#_bL;9%qP?Me0hi#epu;yw~FJdME8>o7G}>I9zVG_p%M-I<m`vGuHuU
zNN1btfHMXCBP2@0gtokGXnEPz)8F2PSpL@b{xM|0!ES||rF^%03R-v!qmALw=boH&
zOoVts=n(>L$Z4OX3!Ic3Adxeii7rKrgU(Rlnl)<*g3hty@4fflu~BM3lkf9|V?nnE
zYmKVqv54>QfB&XGs9K9gQ<chK|2Kc93sPe!nQfhjrRJBTe|>p=s<RR41{a*E<(nRQ
z=%G#JRE{PeQ8h@~MCT{`3xy)#9d|5KiQ@f8Y3YlJRLkz53%m}K*=#o1(Ps$<752uE
zD-@*SUIf%lOxUcHNt2HPk_;Ayw7X=%2*(wrq@)U2VN%^N6k!P^DRhA<Q-VBL3D!9e
zi;<^LDG7DUP^whfNKDC5QRSL^m&;*CO&lbfLJxA-U0AZPYcvr6GUh_<m&<S`)hvoZ
z-AL45wwj5WgoqO$Gzm%<YF_FFK-J*PY|*d@i3L+jQ>(xE#uUcp37a}lEWHB~JS{3J
zW={-ao`VzIVwy@D9$vRDHHK{-Nu7aRFoW8H@96bmNl`^b#SBSQ4?FhsMR+<Rs1V$J
zV7wq<42mz!0J(wlu35uQypzmmQDLOz7%9mNQ2|3#2-6iYiI<kpQV?U24!aG47*PdZ
z1^2DuK)ho!Vbk8XPpu|}-4A`ce;;|SjvJfzVaroxG)lyCsu)~}hBJEwoS7?VN^$-5
zI$cG@`gN<<-+;EW!^1<Avg`)x5fVwp427aqjL3wBGk9_D-o5p-2xJUHhel;E$|1Z|
zaUjq}Vw6Y<Mh__p!gog9kKRvklyr5n_9Mw`%L2^P6R{bvcqK$y9*XCZh!Q5ZrK7W>
z0|VtEYWgWoQBiSGQMe-hWPBI({Ga&CM;hxJ2S%=QQ&oSWWX;G|zR*arkuNmjc}okz
z=oq2UoBupnK`zP*6waqY$!J9qfuaU9a{$fDaTxHkGr*#lEba)*Qv<qvRTQ@>5zEOU
z;AK$@)}k}@zoXVE?wMaM+_jT>zKW6^J*rgCLNM7ZwGv2(9t9+Huj(}ni>rsR%c$F5
zMTM%kX)p+7NavI1NiOj+MsN^2z70@#8SD8s?D$oBZNr6OYugBExSco>`Xst>*Y)7#
zFlx7I>n&Qu{ru=KdjjDJqHjW}mHp`b<WuC)XxO6sGG_SI6rc*5iT2DwPCOE;Vi~$g
z0igIxVg_D@(Uun;Tr9#nlAt6@Dtu?RZAt}IZ`<0?YU;h52d)Cj&t0=@$s*9apt<+N
z!Mvi_*x9$<dh3m^wH5It@uw8K4;?!6`P+Yg>zl@&o}K~g{^2xefr3-WVihhGTtLx*
zi;B%uiv}eVLTuwc{PLpLW|yom@FXmuS{0fYx7fliY;&)8_OeGGeRL)x>h7slcqc-x
zp+PTK3^g*0W~H{~j?~GpC}-7g82JUfu)X)tU+7io@s6Xl+cqzgOrAb{x?9)gF?Jz<
zR%^DIkD|WSF^lxZB~>5Rn8ep!d+k-F%N6-oFI>3rYPBkR^+S(8{`lrOL8;@^$6xF{
zaqdKV!Mb}k-LP)WavH2ee)aM-kFG)872J5gzjJwxfcXK+IXxf$UyQ0Z*CP4vSMi(T
z*T>fhc6`|df@{&XeX)j=N{BzhdwcKce!J&^=dY*!O1*)qHGhN_vzz*o+J`m&8|RT<
zugPS-fH*hq3+oGIOs{zjx*$A^WWK#E-MT40z3S41OWNVChMHE)B5|}d<3T$zI7}W}
zT53+z_p~=BIwB`O$Ni}zr%zoXKWJ=hlKt@R^b@2nXxOOJ8qa<;C5}ea5O7eq6=5A!
ztb%+ditjUC636ip?d_;YAOLCOomEIdfel{9;*h`tav*#Ycb@(sG|pgxbp}(?g91Kc
zJD4nTM~=9tFdz0XQqzJ7G4Uq{#nxy*v^X(P^%M?d@T%ls*r_r|bQp|~5n?845W-bS
zCk7OnbXp9Pa6ZM~Nl=e{*f*E3Z@RH>_F>=bBl~7x1U3UiBOn-Mu)j}BIzc0Py0^C<
z`c}VoK-*7LE@GM)8PsYKt~jj2#v17(Vk#mRwL|Gc_}M_8R@>E$mdGft+&?&!Z0;R^
z69F+S;6}hqpdT^u!(`1u2|pGOLM>i_X2%hZgMY+8z(+<wtjF8X?kP}t@^uzR!(%a`
zadL{Cl2+}=n5Dn*?8yTk?cI0u^Owou<2LW*&yRld>3e_qu=?ypquZkEYt=EqxY=Xx
zz5C^v*4Ui2^Rwkr_53V%>-n$W^SDROAANHJkY*!1d@rCo@o#{OOXIh4Upjhz#7(`b
zVO?nW{&l3Au&Z8w>#qpJ{$0v{f<9{9RO+l{%a+}_hWZl_@?GW&k3UN+Iq%N@*W2;-
ztW?U~+d#S6V1Z!GDHO)o69&nK4IAdAQEBt=$m?^kW74^+#Q3~zl4dTy<ApWA@HeR)
zynoqr{ldIiw{Ig&3%{pY6SwavTCnX`OG^u9U%%<DKM*S&EqHp<@<Jb0#aCDX%LOfc
z`qt%hGSgFo_6cu#R@w4fQN5W4vA<^Xwm)uwlK&Q5c_)w<^F1Qy|Bi6P=eKRXrU-V|
zJsR%j&FimOxbCUd)Q(k8-@c*}vgNfIl%oN$`p3_mJO0-luN^yASA$m#4l3i?&6H{t
zzEQb+ZUz+?J70_U&s!<$c|6wCnKXRqoaO8A`KnCRYeu;!Fk}<rattQ3#RdV_W-(i>
zCTP4Si_u~tN-uaeyrb~qnvA1~coQ?xAB+&##?r^|Go#sJaX`ki+HGc&VGQ}>t56LF
zo*0DlKv??$Z6I@oq9ObTp>6ztVo5YZE)EJTlc*^~|HLUY%Egm#G_2u8<KRiayq&8u
z(o#|&ETCR9Ojk-(76kq*l`=C^0o_`m%1|kYdQGffY3V8z0%v83uoop!Vh}^Cf-;Vu
z5z#3pJ0~X-C7~7Ra^$%G|1#Lb{@sTC`yBS~AF+S8VgGK!hFLI-I98%Q!kR?vNeT5G
zwj`KM2$-SiW0NK}?ogt**QkCNVpj^ReNc*^S8}0QR<RQ{R2l-2COsZQWGb{$1{Hx+
z9A&Ve8FT2&QC8`qWh+#=iIAHmja@vt3j*+ad(O35BScv8^qhLNGQK5wOL?`X*_yL_
z`Ep55J@tu(Gd_Oq?a8|<f!yS_lliYaQB^^j#3h|{U{SnIw_)5h{_w-MsEnS*_u*0b
z*tTHKBme7RT3TEpmc+#6*WCQfA69LD>gHde&|lI>_b2wVw=ABUUd3jl=52gp9ctPn
zYnpydy(4^NRkjDt*Pg*Np!zEsQFivCO8Hq7K!4|NR+=L(Eh!O3su-c5Mkve4e*2wj
zz0u0M^>X$ycm4RejFjeg=miKTODMQ7gAqem!g64O4JQ#_4uzLsH^E@jSfb+B@W?0(
zt4KD7Qcsl05OiOR4kVmGL;BUEL(W9d84=u}HE~gb8K#sly#OI+3H=zhGh#hU7#CnU
zBib@@oMDFmo+WTko+$m5Dv?no|MSZvrKTca&tf$?&OvS~0`?REdt`lmLqlkZ)Ysn+
zDGBzf9+H?8LV-Yv%SG-UY-&iMCzghUu#Crz@!R5a;wvDv+?Xi%nT3G*5dL%G9APZ>
z^7B-uFZRaRZ#5~R#O#TPjVCuU(x~H%dl>}~2ic69sU7GpyMu8v<Mkb&Z1LxJFmjQ#
zm&Vk{%x2V$vO&)=p#v!}*hbQyxEc<Zg1?jjR{JsxNOE}=oW4-T5o`}{3sw4)uO#Oy
z!hA`N1*ztDWxYc7u%$<LlF8<?HH;G*QOlb#{2p`3AC_nszxjF%f^t?;Uoa2sJfLBZ
zYHhl+O!SI|4Vj-6DP%@YM3BTovg20b>??8hbvXM<KywA4nTtT*(YB$MgsOx#S}hG{
z`<uEu+o8g@by62K*-obk^bu;D#WL6r)5VzGghm6ygMDV3lg>3*Ld+ObZ*h~>WC+|i
z@X1$Scl7mqhT~i6BTY8&3MFQ$s;WNy_P5s%9h>+3?_YfJ#mAo5-xsDc3MIO(Hf=-4
z#q&70m3RE+h3B7o;i<LYRi7qr%=@8BWlv5{jQ{R;&p-eC;}7l`1d_>9UnR$((SKVu
zN#`QOc-S@OPQ=|CEp{lhCa-;b0%khbIC4<4WwNZ|Vl|4=sZ_-!sIQ%yk(CF-XmM$#
zLPqC0ed1IZli}2pQfo)|efr)TZ+=nJ-VKh`@1VZWz*(qJsnsa=CZ=wmS0#!f*Z@b+
zTdPmMtW&B1)kT2nB0yCQsHy=~$*^&(Z+HOY3v>=%nR6QWx*$tHCKIq&$m!a99rdTU
z6^&mn#M9z$BfX>dyR&C2;wkZz9pH7V<4b6&6!#k3Qy-!!9`0$R{4hLMT}K7MfCo?!
z?oAj-Ut&D^Xa#kFy08O|8RGn6G#=7WjjQ7o$c4o{Eg2mcGLIUu<v|+^29nGfqZv_P
zN7NsU`e}(wBv#5Yuvf9EQCKDSC!Z%Vhs<#c_TdfKhnMFlOQVD&OaY4uHI^K3ixQCw
zH>1S}??A7%clh+n!Vr^-T7L-j2_PoSqL>{b1_K`XBggc!^2gRda(<I~BjvGjzT?E(
znyMY28z`BEB^-3;R6)I^7&{a9XcqTE`~~)h160XFYY>Wy8|T@Za;W})AoY??mt!E1
z)(F2$4vM@+$z@zhz!waxj&EVV-p`-?=vovtKY)LzbbmsICZpp|mGQe#9OLfzv+QB2
z{Pz@@3yCWo&<?<vV6|9BF&AzugvJYqUqZ=#!ent1@kMYQWU4Y{>MK4^>^S26F9dEZ
z0B&54lfa2bv?%M)H!`5>AL{Mt9U@*0Ci<9am?4Vy3M(aT|C!bC-=x%hBN<!f2)_T`
z-~H5Q_{P6dFKd`DQ~&x3!z)^gqU`^I+Pc3+sa?UH?#Jh?fy{J)`kpZd45V5E`R`dE
z#10Mqk%{%}D``5t1*IL#dZW%XX0=(zu(PX}K@!TxrGl?u9x4=iP^M)_74poiOgWOC
ze)Mq?2Oc0efVn(~xoiQRZvmb&Y;Jm%-!f8<qjT6e#fUlj`o?U%sBu<Xd!~NONIq#c
z3=mn_L4BpU+G;h7=m#Nncc9EHl(!Q#pYA_#4#)X=i)CnN%xbsmwQXoZ-8DRDu+wu`
zDR4W7{4zGw(X7Bg<KA6T8GoX`{V*(>5=okv)#Jg=&frbe!mfD&t|*kDl=A&H$Hauw
z#m+^+xbo71Oa`n?K_){c%gf7^T)Y^`op;r&nKRO2){BrIB2}~FAunmfVdWGox&7Yo
z<Tx?_?!4!odtj^b2FpYc2+di=*KOOjt&+N3bG6?;6=A1A088bwY^b+qw7Z=Yj32DH
z-0O9@to{WH1a267O;#U2djUO%kJ8U^frPKXKr;ox_;@Jn3o^M;A&3g-&<vRvEl4vJ
zD%eL@EHO6V)hNI1gC#f+qFDX_?EE(5V%Q+qxV_*g5OQGPMD5>bIOGciy<vKe(Sos$
zj*eRp^W*VOIJ^!&OF&IoiTe*Ss=nV$O0HQt?7grT8K@4;)n2dPV@Jp|tO({QIGTbi
zc$kr)8Ve7@z8vy;O(q|zzq5I)sMl#q#!GI%`ftGcZ@~I*!1`~%`WMy?8wLyptg2zy
zZajJF@SZ(;4%IeQqrt}UCN0>67F0=XFf?^^K=iN}jTS6*^{K8g3p~8NUF~PioVnCB
zV5SSdKl;UopL~*?{qe^ieOZ0*_#vF<;4w27Ood~<@ad<YHUO*DVsS=cp-g6kAIgap
zHCW<l>EgqO%~U2Du4hq(!*t<&k3YWs(MN;9?b{#S`q%@v+_-7erkih5$KZpDsVg3N
z<dF($lSUm1jZaK?y+mLkxmZQ{+^NaXh7DQV$%cjoCpUisU6@1pAh*Y25RP22Y<U*k
zKiTPGX+c4OOe}yjB!Wz%hG$4D#=3;y?#I1Q5}ouhV=+&J4RmKmd@;JPuc;fJ28RPV
zROZ%RGbu4?F**IP_ruJN7dBW()Gim;B#g08!%3R(;D9?8cG+xEw;8773AbmuHpR5n
znDFl(tj6`-Cj7?KU4QoE@q>H6J#xCC2h6&s;mr4YzB+Kc_7u2qzR5J&hiYVCvM2U`
z)=+=u<jIqbokOU{XByQp0}c~iU<#$c@SPGe=`J4pI;S8jZftn-%{Lp2vCM+py@xIi
zL&VBQfCQfras%=%>9sd5T!=zr8I%oX(5B`i=O@$TG_yp`s>)``OBQdu<MzqPxN7Fj
z&p!L?%`+7dr}NfZHe7?<lRq^Dsv}GT*d_j<#zdXg2rms`c#9TQl*__XbRHk(DJVg4
zevBbg7bw_qlt6^;!;5oO1$n8k$rfnx0bim?;ot=OE>0j6kHLvffiZh|XhH0b&;>^4
z1oo}V2?yGk9!2#{Ca4?3BPO$R(r&QZO@KSh;9ig0Jps>w#SusePeNiCn~Y;^d^W8;
z81`L>_v?R*_kH~aKz+2g@6f*E-+#Y<|M%b59;s<M1wHvx(=aTgLrJ{1jCP%>2Fer6
z$I;Qz0=!3y7vOzIS1<6M&k_LcT!w&>=jP;m{Bc%Ro|4n$0kLy;9eLx8Hx4K9K3y8O
z7zp5rS5PJ^EK~yT4OCVF?@fo%AC1AO%Hgrx7MI;-yZde{XuNfS3^S80xC4UIuaam#
z>E-4Z0rVtiPv-UFgh2azt`lhQ=4JuyQHd0=Pe~Weyr!tQc;-w9PG!Z3#wNL{44^%U
zlmOcM+);@zf%k)C4a8z8(B79odsf5?v_~@nK;K~YQD(Gc25Ca;+4u;gWZT$C4~S52
z673^#_rM_F=!r%N`a@O(+I!p+KzoxrVoSn*Bk0aX(489r|BawK8$ox9Pqh*Fo4U@Q
zIS5hHWcp(7-XryG!ytI3meVH=?%RLt0J7l=O(wIhtGOPCf2yvty}h?r+XAN3(B9pS
z(t;+7RTMJO#gj3D`=YRYqzxt$gpRIQ!MF7tMApu`r=0SV*)=CeD6OUtFcZc7E&$CF
z7v$y|3=YAnRjW$k_UtImIiNLiq%<>6%Bsp^%L|vRtE{Yqo-{DPDp+(U@>ZT$o6EKt
z*R7gIt<w|&@j~2G5_lktg<P)O+)N76r-he3DT2weR4obl=;By}_;{nJCrf&@Fc^Fk
zN{4+8dx4!29ZyYDNaK_UT5&uWfP0&)LolF`!#R{_T^sboeE2z|AUzVNi|z0)+U*k)
z*8YKnBoEh**XbbXI3reK@UpvYh@C1#LMVKeSg~<mjB;TuCh$X`iQi7VLFOT6bSk+f
z<yaFEB~p$xxf*LyhBe8+s&(~WI<~)OuzS!5PfU9|pAQXFZZWnVJ$kghsqPG^CwtOT
zd+b;(odG>_tm*hWZ+`vFzI~s+^2#e8eS|>8ziZ?&bp#vLWL~-yog|7SGG|4FlSV#N
zL_TxD?f0&&Sh02!s>9xTYeoijzeeuui-Ct`sk*vhgto@L%Jz084Vc7ZE>9?C8nus)
zS8?2Ki3EW+ypT5xLIEhDn=wP22S~AFbd@Z^PvLX(^77M#n1M_NAvvUx2iRe3SQpwV
z1J8z=0zlo%__!5w--@|Egt>3U+_z%xb9;J*Y#uJ<?7aZicjm~kKJ6%>4?Wt$dygGB
z0O!e(3ztqFKYqOS(h#V_Ai}xJA(DtxE++sL2x_&h5I3FU+B1Y&z!Xqh8=kOF*lfmu
zj=H)!?SRfk&((+1vz6af_l$<1Ul(OD1Z+g>rg13&OPZ}xee}^s-?etTAWFEq3FSBf
zl3kvkFK75|V{junMa9J`$Wp3whRp~Zc8rZVoe_3={;5+2X7&v?+>p(*o}y*yY|81o
zW5c3+35cOyZ}L)Xbctho?33s;4FBMbbLOWZd`vo@P?bAS0HoY%bp!<x1r)0^pTS^&
zpkcOAIfaDEq@^j9Jf_#WaG@e<#WcpFl7;kKVI2CC!|W8O;4jFzYL+lfL}*TisCY?n
zDQRq7q)_Im)##x_C{6}6Wf9!+T#<?g`X2Xd)Er#HX!MH&KzYOPFxvaF*<q`7+(U>+
z)MK&Ib0>%Gu_>2-+-(KA`(g~A)dc(>GfiPptyTi+pblKXZqyNK)PtHk<&do6E*s&@
zeikGHTsmDI(G6o2(H+QUV}=7Ep^(FbbQGForU{e#fJ95p2QJJ9E=)&DDTzE}v9$HH
zoISSZlTSWD*yr)OP6KST8OI0{sI4VsK^q#*Ss)C76Q84%AAg*ky?ghkpB~)v6~6sN
zQ4xGC7e0o|E+e0aJ1iClE9Pf%WwN40Xw$ubR&L)O3~t%-#P)mde{dU!3jmlsXZ?1#
z?J_(>un`FOSb!8Z*Xy-uakU}T>I8|7#pEKcKnQOgTy;{BfWxHZnv6u0H-q8D%zQrF
zp)xP_53SVe9S)17Z_qmBx1!|_q!l<v^@u^qAdP4O1_Kd1P}mq=WTI_PODQFQNv4`j
z%}}$bV(gDXHL5BClVM54Vwf$7JJ5d#AYnOl=vd9EvuDqqsyTLuPNcp<2xf7!KX%I+
zzO3dtWzx1IQ)o~_Ofp2vgws$M+&)h&P|sU^*Xk`or8g3p3!kejLJ6XXmmo4Ui>V=D
zNpV^dip4?*{u6_Aa`@u3baY}%oCq#dB>33jurnF0W=pfc7Jy|#tL^QjlDZDbQ6Ra<
zOR%mauVV@Jc$N+59aI*F!;%=xJ%rUDj}!N1WVNYkYx`}aPz;dD>Ljy5HR$B5q!NrB
z+HvA8;q{b!`stD3h=7G&cfO2^Uw>UIaSHSD^HHaMWCHVTpQ5q?&^E5mK@KBV5D3gw
zLwn7iy9yOuS5XgWRA?jPHe(mUGoK@jL}Ud70&@#w5n4q;Mm!_haM+H>2Q)s%kqDAR
zz$;+ka$|LY;cf>)pvA%jRHW&2mJ>7c^Z6#zI9e52h?US{fdFA8OhIL{3DCzJp{7$)
zoHT$5a3YZEovy!93|P&^9+(YSk@YSHtfVGW-|=HTgG4bnHK?tj_GwZF+S_Yu+Y@?#
zrK8zGv%mW4{j}GhopRqLa({XqoEFSiAg-oX9zE)Gs+7QdnQZZ}jAq|^?{>}~S5trE
zCM5gt^#}!KK1V&LNj+CtsZ@?Tf$?5%N0FCCjZMMm7#GogOs3oG_rf`w3ZHi@CL-br
zM09b8mJ(SUeb0zcZW!z9f^jC*2b;gm<sxVun6d@vBo>g2I#P3o)L;>+6Sb*OW&|KL
zSeuzBy~_MJyP7F8Qq1kaEljVB!V=@-7(CHTy`z~KfWaeS1=x)9{0ir}9q0KKAoMFh
zs1yWi)M)8zxzy5fzTxcmpMCPypa1-4(Cznke+_PV;>3wMgfJNl$m4oWQ-ZBBG}Hu)
zs_S(+d+W#(kdH<p(VuUySS~f-5%175v$OZ@`r?Z{Uw-}lk^RRG?fr7kS5Tgi_r)+Z
zBLxP`A!4}j@y8!iCp0B8Cz??Ov2k7KydEdQZy+d><uAGAmRqjLlgZSJ@nn8BOk}~}
z=I!@wedJ*jX5V(#1CKrV*i*m#?Qen2dGppIPriz$y1D|72y`p)DwR`Hq-j%H)L@8_
zI2n-`x?~%4gdUsMs|NzqYA3w(%vdbQrclR$8JLQNVra`ILMRDHE|<&0KejOJMSwF3
zGnQZvyIdrgDmXDR;tb%?2O8`l!Own>tV!|&@6a<H4(9+`R~SaeCq_M166ggwPqw20
z$$>h^G!8T3ll7qWCE(`4AW<RRF_9=jL^_un`8q^kLYJ9<n<(9gg!<pm_;K4W(0I)9
z=V|<&FMff>JDtBk<L`Ok7ihdv`3p2Y6#WGn4`J}<Y5aus7ihc<6z}J0{2E~N8ent<
zFnSFzdJQl-|6;Eh48h!cv3B2=Uw*l-_TsVq`}ZF_d9h~{B%g>pxh9iN+tuC(WNmEk
z(&|hOM_*@KJ)l+J-r4J*^UX;uG;HoV3&wc1%gliRrwA|iLK$tOS~a;+sTh_rqJxrt
zKVoT3jU}F14o$RN5;xb-%pxhHDw82CTC@i5tyxqQgIsMA6)nFXis*W3ttJ;74z=cq
z{+R~zWyrT`m5LY9!)>mQ@)WD+e0DU9#Scf=DXA!{pPIrJ0UP-Oc8r4D9YcUwF8m>}
zXo8x+PaLD-z`t06(89!tc)a{^ACa}azHyTk85uUyxC<xrPmDW^kZbKoPs~M`{|UEu
z5-2(8b))fy$1^pF@UTP-Q^1qNx}UYS5OO+bwM^StYKJXwg#Xmq0$O1<+radbb{2!-
zQfn)i?vJf4+1a0b^5K^?({`5ckAC^l#~=UH+LG@CTOfNQX=j1)rJx}HN^46n_~@hC
zwr-!cv)uRiZ?<jU{!?p<Ly2rI!27bD1;!TytzBtti6Nkk?FvoXS#l^3HvdnpEg%Fi
z$`c}<u(KduLn_64Keo0w9Pr8-E=}86`kML-di_tWE!g}hrwL3=+F4+H@%ixHf3dbq
zufP?0KNS6A-_`!0{Z}8Xf%gAXz29O%GX>D@Y3+Z^Y$j{+W4-_5oSa+*=LhYdot~SO
z_3=;j{`~xc0wr|6Y3(1eu1@C_dO!beo6TXj6763B?H@J|tM%@m>ix*}m~;Vd)7pO;
zx-%=U)cc|67tj5t_Fp)^5ZeDw_5M%@{yi+rwDyk%0Kn`k^nNJ%Hc$Kq?LT0$LHqxy
z-Vb{13jo`vwf`Uk1uy@r-d_e9QwADS1{zZa8bfr<bYkZm)Sftg?)$@sk5_-+NI2vn
zjSM)CcCg@^)hFxE!uWjtgoRGe&fc}_limBP5AXWNKR!Qy@d)92pK4^_dmN4zo6qI_
z_2%1ezkSsL8J!*sKK$_ZZFk>z%U!?z^(`x}y^S!m-)LlDXz{odPWFtn@2hd%_8~8w
zPAWWexEWF|(n<tk^hpMz;%Q{SMN9&GF&6R=Eg>8W(diE8S;HgNh=*jRir7xVfO<7D
z;G54kffp7BHwOEwadcYdxEHg&7qh+}v%VLzz8|wL>+BzKPB{jeFPwlT`Q6zLV&`Z(
zd-BwmyT7eDbG`}Z8EQCw@bk|<KUfbkJKJb<`Fn;*<UWFAu<u)2E|Ctt`#z{Xmaw%q
zG_-bfwD<H4jTz~(Znr}5<yYUIYqmm}q`Wa%Zf<UL=-7Mz;4=M|!IQgo?K)b2Xcy@3
zXJ@G|HM6DCh`qP99;X`(35rTeXXK>8y60p{)Ft!bKF{U*kmfWnY(a7}T{iF9ITEK^
zJ}X}WQB$5T;{z<xk{sFM$F{91n7sxj_BBgyx(lN2<`vYV8l~TV>g|YZCIaJ?qL_Em
z1@=q`$K5FC3e%(!MqDpTuE;K&nJ4E*{B)U^0a+_Zr7Cl9WTwKC5e%}$Ik`Fc`MGi-
z`iMptDH$r*Y_sL4PdS^x;H4I-ghWB$@Q4@3J%x%jVXs?1o>(uxKMIpe3ZD(9ZP|Ez
zb?>k5EMvuxvWpHBdLZ)nxI1U1>Mw7cnVcf}j@L7VY&e_C1HPp6c&>dE9qS-ldncSE
zfW&6AKthL4>h3hX1psn7oa6o}*EquNK;n~fA+e&&#ad5WQOdE_3C#=<45>0VB4Q&M
z$cu&*g`tsOy5w{LBsNqLaC^MA;e-_>JqFk6JKyYn`>h@C)OPA)vA_L|q<hBysFB0q
z*>t3~_QVOXJX4j*vLx*&jHjP|`tIx3ZMylPn`Rc|Fc^2<2|LO&8o5%LIe*o)%T}$9
zOgWsBp^Stbg^E<Ag<&Y468IbjKr;}49Yv;*$6^*w)Q2|B@u0^WoAM{@C>c`#Mwpu-
z5(iS1Vl=>Jv#~b^HFB3LHRSOHJZ_gC@dJzq+3Wv}WYy4)4rJhShW0vAH0F~}{_#om
z;gdvr9vvMX8m+AzMH2$^=s1)|9J*0jnVFq~9g5w3Za4_l`HL@9IR%9>qCHEc{3yEp
z4qk*&rb+K~%4C>@lvW~66sUqde$(Q7P_QSSNa2Oz5~4l(d~qH}sVrCk%jz5`T3#=c
ziF|jZ5RD0lQo-btO72jgvlIv(Alfr>9TEn&D9#x6K!8MVVg_1-v^7J+fQo@8YZj=^
zeSJLxc9WK9&+ro2#|h#<Jn$j^1oA`7Hys&X2%I1u!x`BBh1mavzzIp?q^-HWz79^c
zqwl?WoT4>i5IpM?U!@YbtpEfq$;*7Zv99sbuzpOZc<XhjTVjy8eYL~E;Bd`8Oq@>f
z$DUcgu3}~7>g7vCFQPQS4(bmYG3eXIwX=l6(u$3kD=iU6*+P+6tjtkn6_zTgVvQJ7
zE#S8e4=04;5G^qvyK#8Te5nOdbIm>IrYi<5bB>t<0f)_rxg=NicFbZkW^prSaWiId
zGr{Z;FOm}b2BARqo;dWu2k(9G&fD+3N3V|moA~Ybj~qT)eY~c+`b2FX(DxZl5hmzy
zxi}oF(}QQ@ZVpH1bdxo|*j@kafdl(bHea;RGt}Adb+os3X#0D+r2Fj_gUK=Jo|v`k
z;~eZji&@*-)7`ZTE^ifpQS~23y1I`2tqRXxKi<_<{dYW*$tvIgeu?wjyYIgHt|u!H
z=>vB#J;Ofv@WKW2%ge8tb9L-CFyXxX>};jw{w<T)Ik|cH<>hnc&igfWtELFhd+g?G
zN=vW3=P^9HVQFdUs{8TG>;3CrKCi8=uKoNkfA!Kc#={{h=5zU`#_b^=i;4wdM0R?n
zsK|(M+!L4zFhvp%<<b-Z(#`E-LqpEqW<1lPYQ|Vs3&E$k@XQK@^30;SA$mr{KORS9
zx`&$b@mL7(%1X_UNV3x;Sxh#U$7i99lF$RSsR*kwI^_<B70yvSi@>%XwZi@$2$bYT
z(Eo2-IHTn9TCK)ft;Sld!CI}xTCK)f<+(ar-R}O@OZDx|7tWpf?DK|8pYLwy?CGy>
zZtV1c$K+V{grUnBD6yF37|_C8`3)>v-~O$t>Vxlqk2`V^4XHVG?C4>ATYF!(^sRT^
zeJ8zrV8nFn^vTAZ)H|9S+4*Ho=jm22muqQjJneKYIgiDd!$;$p@(SpjLO}}m*_&>-
z?bfmdix)4E|LgCb`J?QbMKen_-L-DRQyAh)njG)-=akAtSH+;ls>>EBm323Hy+d~O
z+_|%?;L>@D%v`xFRh2g*bJ5cBx#eZ>WR%Y>%t<TBP>AK!8cj~9xC2_AqpP985%VGJ
zuB$i{;$<$l?z-Z1UWm>c?rbs+XgeAk^uyg3>(5rVbe}lY(lKVMJ<{1Zj0W5}fkX2F
zPj>PA`7<OjfP3z@fk1D^XK%jwdYg8dn-kcQh?`2lmPFjF1Z;DJJ$WK?)2TB}leU%%
zEiGqH)*gN9uZNDD9}V$kK>mN%WcTPso&G7O1w_v3<z;3vCb7#qJBbpjqjOoK{k?so
z?r2WtyN&g2Z3eSxEbR^YmH#|7Jjq7zNVclJvF`k(enToKK#kVx9XJLGFcFr)-<(a$
zV`Zi4lJZhnF!s#4wTl)mUO0b|bPc6JGoAn7zIbbKHk-l#f-6>*mzEaF1E3Gc%SkC-
z1^S>;QlQK(I+sx>&n{Fe(}Yo`P{iYB<YnfRUX_=n;JD!MnW@QU1bv|}QcIvo1$+}@
zV{soSoRCA5rWl>;yI>qQ^z=F$HiYQ9JsnzYPuGRErrv;3!axn_Y;ey|JQ@{%xjOAe
zpU>q0U9k>X2&+y~mpnkVP@RnC&rvfG)sN~pcKg14TJ7%L?d|WpLm}+g5`+#}TYCU`
za~3*L43Y$dF<Bgus3K$k{?+k^83$|mvi|k!o#n@mQ$Lj5W2H0+Z(2?5X54ruH~*s2
zu*QpKFenRzU!#hr-=F4Ir9ij{S>rJjv`93HAs;cBJbMI<6faB;@i=hV>YdZpA5tUc
z8sI>Mnnf)H4qO8q$m}9aPS@24&(VdhR>WGhcA=zdAHsSxN}~~!j2NdacH`)%-D1SD
zn=H0bI<t8KQJ&7`uW6dz(`-UgjH&s1NM?tq_caLd<VIYO3nwEy*?|Ltk(}$UyDm2}
zaDYxjVL?cxu%5zrn!K^sV!Xv9CKxyNY(9VX{gprg4Z3Q+D)oj~BAJL4+E`$$sWGZI
zQkkg&h^WF;IkIokQ>8E>NmIqd3x!w(5sa=OFFy97MxllmM@`YGDR1bd%yu+c()F}o
z!~`$3cSG~-Zodej@e+b7A?G2sfv`)ID=?eAfe6f-k-(HWxw_L)YB&67&*c6RynM!E
zbp+>s31$X|9XsZi;8r~}S_9Z2MC|8b$6>fUG;i$;0<E=MFT;z!buA#qpS|{evTbnV
z+;_u*Wt%~iUe#oK6VQ_p_<1*OEMNhIHAa?tW1Jxr(Ye0}NU=)#%fQsI!Z2FUxxWO`
zOQU@!0oLqa0;_v6JWY=jz(rE?Dig51T=R+&oH|uk*VNfL3h|x?kqYHI$c}mC6&Rm|
z=tcdVh6g+B_1AAO8)?EWt9UY*1k`|fQp1DUwYvJWOh%&}rbLpOo*t&s;Aewdo+IF(
z0_d4DNM!5n?M8kMkJw3KOjt+~Hqk<|hcS{ujN}J7r?a!Cu^-+Yxpb(hxfv1pV#{YA
zoU}%xcn=|n7Mh7nLXD7vcrJvKz5Y7leZ;csHr(>7&6|OO*y%D_B7j3ZMIaVavMe=9
z6l{f%bN0-^FFyYq@*AR5A>_coDB+=gj$R*65eN_iB@WHFO6oD2A=D$Z211Tj+j6Pl
zQdd`Kq#H(ga+QE*l8uykI7XaMUN6h<t1*Y^jPM^gr&fEZ?mYa+-94Q>J%fXt-Su$x
zpEx}j?dbUC8#G_bu{Z{MyZUsfYhda;eYy)9-8|5KscW1w2DcHd%F2q$3*gh_P4?B)
z%$t`w*$89WSKnP6tw1U0-?ADSkTjPgt8TON(lblpfL6<7ew->ON=eTzTX^u$AsMX-
z1e7VnvMbD<vvDIVv6-t;Ht~VY^HVAiWA_GY(<WHLa=ewZb2u)e7S^~?j|Yn?<4(Cv
zgZ*RIuU`-T>GSb~V)Xfrc_vJ#!Z6_x!knv+`UZSHR0f*>|BOzKJI0BhAxaui0{dK(
zfuL)+6}6ARKSLpN-v}tzgdf4hs0ti13?XcHAU+!=LNl2|z={eMEFtML=|k8O=s}DD
zFOEFT;dD+zcncs*V$QYzOCAL6+ydG;r{_|)$uct3)X@SkxAY+txCg7$+SaZgGa0ol
zh;xCjv8Ai)0*vVATB*-9SEK3@It2znh4d!ke}V>LG}vI;8tv)nC#2R1JJ-0)=^C?I
zfaP-r?Hq;jz4vPRg78Cnx_P{A7hJAW+LOCrLg!kv^?RXheDTdU|9JoX_rGbRzSUff
z9UpPIx}j%u*}3p*!bRd16;@PK6rv~-0B9NyvpLLgBsk?~h-LJgk^<hO=aH>TiiA)v
z(^vEPtC8C2PAgb=*FBT2m~zH~o3LWHtY3fMgAYEqX)*N>3E5(0&z!jso}Sq`DZqAE
zC%uMVm`SxxXGn<EONn`Wq@xyJ#0+@pIdLIl5)KU>8`-rY4#K#j6tS_h86G5!MmTIi
zD!jpLzh3~BBIQsinoLyiM2zSp;dG>wD~U)7hy0-D;VNku%RA+EdC(Pj3YjnA2tCKt
zF&yxX=v_7wSlMv1-`_ldCuVoh>G1ho)^Ud(J|eg<x{#eSK$2GxIp>>za}@9%Pekit
zU@2nK5Ew>(k{B9{@=~b~QffSQx6hxX6VowIS7gd|Hg_8>!+lMy4TQb)A3eHfkJI_(
zm$+O5R^U_%#It;(F_@-MM6u?!2~rxz0$(PG+oaQKcl&+gM!H~NoU2g2`&LbV9II?;
z^m^ycmB~K&1l#Qstm}8JSXa1T$+~tSZKT&O0{<IXziyq;xSVAjGrEF&5Wa$0nFuv_
z_|cUm$oSODR*1#ei^2QuTd`u*ZCkc%**FgrDBtVl=FObB0Bcv4B?j85Pn<j{lhw)j
z5~Ylbx@GhZH7h#l3Pu<xtB)g;mX?<{KAw*_rx27p6^aI?YVxDe3Gh@GIB$d^8New)
z5ZVw!AWji50+Ulwx&T3VL7#ruVX=W=T6NIVQS-g8PbA_w5CWjL!&H{<N93QuK(buM
zZLl62`jE;M2rw==ETh&y91+1u+k^@`uT-7%;*$K+QZ+iNL4LwtLW~j)ww!D4LT*}P
z(>p>56012W7Kzk?Lf>g=vznVDAAIoAOOc4*|MJV!pEQzr?MCBWceQtS&y!`?37Nip
zF5=Qfm$SH~LjJ^ah{k*25usZ4`R8i8*C>!t!m#410`@fp1tsd0!U#kQW-NrLFI*!M
zF{0k?z`)6q=&#$`)di=H#1abx6bgSRWC?I6;O=EUqrS{%)QG@^tVr}}c!9}v6Y~%Z
zMmTyfn}+6h1QLq{vye*7D4UaZ)4)d`ktz6muf2vTh{+TZ6HvhWEhC;}9Lezu;umH=
z^c>W%=N=J&9Aorj0$!po2)PPE2>D_6c;K3X()^WtB&c8(VJ9VtL^uq$`{c=C)Pv~m
z#tg({28r?WV4k=<{u{6kq!z}nKml*SI^2Nq7oDqXyjXwc+?n$ykl=f+`Pjh|)t`Rx
z#kVJqpF8&5-mh`gAd;p4wO_pPcmVXyj*Mu8b9C+_TL3&AXybv|*hCjK42H$xH~+S`
zVGL;1Ute=%zc~HfcMpF0$=4sf`RCXE@|VASgN{@MNPC}hIC>GkGUAsbmvZsS0;6&5
zS}r$CPVVxsWOUZe%QE?*-~X>IH!Vi8{)$a^Jg`kJeCC<Ew?1<J@7E!&`z<7Q?I1VC
zc1TK9ngXvk1~YUCNTgciK}C$FI-5*(@}$AwO9WO+7+$(ajC>B3fG<i>z&@>(N!%Wu
zXz^lrTRf7og>yh=705#`h(uyR_=7;PLLo?$eybKa^5O8wlNZ5$CIQe0T~vLhYq+oe
z+{qKwU<wBgp6TxC=&i2S4Gs3~|MQ<dKqcYtsW&wRJ~VsrdOfh)xF$&}?34o7yqL`8
z%kyz^AFMUL%e&(NtjYsem4~q^4`5Xuz^atD!aGYyVQ1T=Gu6mRyU^0E1$y?^e)s(m
zn5NIP)*(Ewp}i03Im7)B*vgDXPb^>}^bibaauV_Qs0u2RAzsPt1j~h*4v7E|w!)Zb
zrOPjNf-NZ&Q|-+s{_!W8!L~J3?|%Qici(>VjaOen3evtyqhO^&^@rd8>pP#FMthPn
z!W2Tb{sFKb4@)E}x$U;wmZexpl_vd|b(|}!t{(Q1#u!;qXInL`tXQm01-7adEZey4
z`QNcQxvOs3{`=qm;h8l^X#F$wn*86Nd+xc-t6(h>&R%`j(=R;t<o(q1nsk^4LtK~`
zaWRhDZr8#>eL}CvAfZVpI1=%$UY#fKf(6();_TIQd8$Ir2KQo$#VPXK0;NopCKq5q
zgPB*&F2y2ermA4VQ>OA@v7mTVmZprv#CoEB5~b`%V9FHu<yhybQyl=3FG59$*)2%Q
zWq>eD1?lqMu3l1BYOtrLv!$tN)G*XgbK?B@b8X*#y5}UkGTmDEkotRjnp%2#`<g)E
z%l!T@Hi^%V(}YRQQ<%SH(wv+Oh>Ic5ID{IP$481S`lrGXSCXboM<m{c)&C(Paj<t7
z%jJz+8l0r!mX6L&lAGH(pe4Pv+q5Itcq8C}g^)54<2waG8>`~LBphZW5hC5tLDB~k
zDTH+Kkd=jn<_4EuIypJ6J$>ZB9;8zrY8oQ#+C4*c2r8;aDOH3*X9%YZbq8VZcR9wu
z=?3-oNQ&(E@xe*-IiJOM4<4t5%NAu}QAI-6hMS1KvXgp6@yBi3e)Hs$Pd<3V@=`G0
zlI5F_6@44^TTP+YJMQJnOG;%j7}Vi>Dkv(*<OjSJ6~&SeP9KsKSJ1_Ab{uQL=1ufB
z9;)e&2zWxAgwIGs>I+y1?(#=bXR0s~@k|7`DrG37*IUVEf<qr^0EkjVUTqu#MleJd
z_qKFlv06?J*hSxd^TmNPAZzvY7m<7ffv&x+1=01bNWv+ES)V=S(KQ9&{`cAeIHSSj
z4q?+fUBu$<bvY-JE0fS~)NJTB&~HHPQPUUIcdM(-=0k^u&@G&2!M*~xEi{)y0t^^T
zPU<zX!~fC1k*zgW$`C`O)y85QHatOHr{Q_eoINX(o%WLN5^jNbol<J{?Ae?Ug9<@X
zg&gJeLgJx@pxi*84Fp)za_jS;56^=>Jdbfa5Bl&t#<8@ad5G+2kYXf^jrBD(oIi@q
z@(m)yNYvNCvkkTIm!E|FTd(hEIP>kd-=1zDQGu=0>zc(z<LDTo5m8RYFl2_y58T^f
zMvlR_b8^ChlD&wnzntA?L}?A113n0R!#Y7P9hx8#Ub+<75-3=}9Up2s1PSMxZ@$_8
zH6mvZHVuV=Dv_aDgr1xp3SiCsLuVoWoI~L8Vwp^gtZig5hvKm3Acopx_XMKx5K<2!
z6h|yOe_rq5&zw1v=h2_nYJI|d<P_%#r?m9arDbw}moMV+NR&}}+0yk7JoVI5k3R9l
z_Q#)j=9z~!EX@Un&R=>5a>4FiS_EOHaOv%EO>9C?&tlZMLCqj06P;f<Y+fn|ix@TL
z7;wwrpn~4Ti}S@nID>*>_2T?|o=1lrrt|Rf>7^(!0@MsbSoMI##URF_Ko&$3P7ECY
zc}$YejZ#$*g>fKZ9hU$if_=brv6#FA(>-Cp>@Yl(FlnGlN+3iC1Im{W;}vigv<4`Q
z7(qWVdQABtX)o>TMp0|sFiha2NlR}x62B0P+J5xt#V#0jy8HY35oQbfKSB|@`UbGN
zLwy|}MV)BZv>4}cql%9Yv<p;*oIe^3d4p3Se<0{b1e3#ogmglEyps+Ps6<^QRvbBX
zNh$5e`q38PSwcT*?HU?|zoE0W<-*ys7wSiy4id{{=sMeU=`8rr>86&(+GDlnFSJ9^
zH}-)MU5yMzM924oO1C2#qY=Y3KpC<dt#;$E4xw&Pm@Fix6s!o!6FsL@Pi3e+c<(^#
zC^jZnAW9|G<P;p;xw=CifD?Vy)MMkM^1>tSHAvGTtmx|WbS}tV7syzxT_Q<`h>#%_
zMXY**X>@EVH7_r{sYw^%7bDywn={@-&$)KCBu+j3)aFH{sUYnfkKImc{BkAAtR=q&
z8~T^ZYf6xdC(K)X3uxEP;6qot-IP2ta}HwUHWVXLgOCM}JIocQgQ1Asj&b+AdHF1_
z0rbTjmd>N+h*Obhz!At(__CZVm73+8Br6&gX7kuGFd|ioSe93mhX!p-ED9=@Xs#wQ
z0E+6uArC!mVIjs7#cMy1g$ctB61744f>9RHoRGak&lx~Elcl4rXWUP`%_9s6&jmcO
zxP5V-j<6yi%Rs-jd$1RVf}S3tMIyEd;hPh9rGsWV1g*szWg)D@?-}biz(*NG1tD-M
zU~o7Ta9_rOX>N4OWo~pMXiah7a4*=;>0>tSr9+1rb$UHf(vS*BlwHG659$l`5N-q;
z<bZy(zmdc(S_ub%Vt@!)vl%{5&?qDunCW7DcMaC<Slvr*UQ@d<!b>IP#Ds4BrQN%C
zU(^Q?T^1nR$Y>lLXUOKSBQ=sz(qSdcR-}aO#+55`xD&YE1SfkX&AVpVW^kTI9$8K8
z$S$4jw3|JAK1y%=KkU5+d{kB1KYs3=-ZGO(?>#_BXwne~p(u(C8#Y{pwe73xHrHKu
z-I?4_Ty=ddtFFDHh+v@$8mUsGBq4;<N$&|MlQNl^`};ok&X5EG>$dm*d;gzbZsyLt
zckXG=dCqgrc`9!nHRZ|`D^@I?5{vN~M{|+Y8e#QxR#rfR71&3!eqF0Kz`B2bRWEJC
z482wRg=B?Sfyqa72aTC@-Qske%S{8<#l&9pKHOwsD+MxdPsIL4<!LJ`bGfi0qP;<P
zXGaeiI>E>a3Ft~lK7J+-$WhdIWY<f59%X+WVlHDHkzZH@Qd3x1gt@2?b5Uq-Z*%j2
z$C6B13?3C0Lk5G++tX{;auQjA(q)c3Hc1bbqJ5>JUs5qPQ_(Mhr%oN;yK~oJ_|E#_
zz^<K#PJ!oU?sRb;r&HnWY^rYP>1n7F0;8gW^_tgS$KZMU?bkGxC|C%ZwR{WQ#56-^
z#6^B0%tByCM~|1kYx&BREAP7PF5cAv^BS|(5Sfyc6lKr`L_$m}s)Rtj-e?UAGGViC
z3J3}_>mk53!!J`)XJ=z8U^H;{tji+=wzoHw6_vuNK~+P2X;Ec6J83uf4)l`qU{!BR
zc}-_$hhJ(vV!N6V9}=EUn_Fv&u$C`xrFQi+R5f*SYNyi!tD*YF9w89^sDT%e(VISf
z@AcPTe}5CTD_rGKYqd~}C~t*uH7HyN?CE!6kKEI<^ya(nz4zWbmr}dD*6;wWJ|Zb8
zHOi>fDZD};S^UGESR4?+4%8yv5!%%;zzsMXYoTA%bk^w^=nw*(&BW$uarSjXaiprX
zkJ{B)UD49Z2D-XBdR)-U@{c1U`s*UGn)3D*>|LjHb`10|Wz_p0zQ0B3n7l8XDZ6i2
ze#4E*q|$}Z4ujjO0IRaIr}->Xw!nAkNhJ#CWHK&XBJY~Knp5kP107D}4Q~yvZBg#K
z%z?alCx7>i%7vv#q<N-QssfeGy`7Xd9F3h+c64=}pEucz8-Ztt*Qt`s_<3b-pR>PB
z3Fj1bsOyVt?ONsOIps4LpZxofdF(0nmU3a&0%-U{AA(aW``!I8INZOz{OwHfkIHUu
zw^y#aUklcN{NaX{;!4O`uswZkywl0}HQXA0PC3hh&l@XylW&HgOTnr5))vOS4};r3
z@@CZ_6etc@;Dt5qba%Sjl(4*Vf<ZlB{1pp@kCdmBdlOx^F{YXiNB=5(-csJG7?sDA
z8jl8%G+Uul!4ws5RlG$NR+u!19w_maRp?2IBceh%82|V{7zyjs96MOKINeC67&_(I
zb8KW8KXQs!=#`yxT1ux>Ivu-Yinr*M9dwe)Ncj6H{_!$iqD+hEw2)2)I-R&=tq#yD
zFVg95I#Gmin7CZ3<$tADq;}jySEJ~3^pYu_qF277(|vRbqSO8nQt;>c1CaDV_g;HW
z4z3X!=ED9Pd|wJ3vzrqAM1CKQzVQ9Q{{D<!l{y4rVJX5UPJ1s|BdG+bzt69cdL)b@
z&1~eki%t*HNeUwmFkPxvKNe1d?U4H7IOV^9P8vFuj?j+56#qC*{o^S%Q#IbD(?jQK
zb^4OElG?G3UVea1NpwQ9&W%6y1tXTjE2PVW7k^17E1l5ve=mFm%2h&^-_unxowoVv
zb&-CTY9pcI_4M{xI-&E2*GoN&`be#R884FV0$$Ie(`)`T7b)jY^wKAElCDP6)tCM>
zs*!LKl5e~tRqa-~($lGI2$YE~4zHP%|KIQ)2{7??44vLNzm$I_&2aiFb^RBV`6F}+
zq|?UpYBoH@7J5aZ*emHu?YljPF&EPKXXuqWI!R-t-FJJ56d%$no9MKHPDVPR+)JcD
zr}<JywF;nHjD}03pl$~X87GN0&Y`PIQ_~-lVt9{8<o!M5Ow3i}A5Eth&hN$H@I@!v
zu{p!(F*-%k381({OQat8hTeOWPCT7Hx@3yi>6L?YT12NbI-QS?!)x^%y|R-|5_$E|
z)#sNi<A0(Z683JTx=1s-M2b#cvR40O3JJvjP#J?Mq%n1Vt^9bRX0!@wqb97y3EpJr
zQcaiQAJ1#a2x$m^;f03MsD5l3q9?v`l*7`HpCgJ@MwV4RKSxXn+xc&y|MWZi8k^Gn
z^t0?~`x?9AiYwR^_BF~yi{{OP++dA#dBY93e8s*-rni3m8uGtGwtAD%&Ipdjz7EVD
z>;Oeh3vQ;C8vy$XE)eYjZnvKGVVl{{bndP$(N5b$&W?Zr5oIpyZ2QY{v9bN8tPAY2
zuCjw*%^k#22zubIrV?;S%9{Gcb?bg;(!e)`w&{m;LPV+=+xvjjxd<IJJJkwijWu-^
zY^P?hC3bs=$sB|Ya*)}`X3vg?E7;0Pk2zts5TQo6>K?ee#a7Ow)?gb6AH&$ss37PI
z1G5X7vIB^g!z+zO9U~cR57Qcjh^8j+7@C`4=2X$#1a>i$sK7dIY($iI0}R2L<OqSe
zL_4p7@-BjmDdo}Z*Qp_|{(e2Q7!SlveO?b@rEvouk}Rk^WWn2O9cYCgI(wAct!4v&
z6IgvD24NnUW_cOkH=tH_3o&PUQ1zZOUxQb;^UPT=Mb4ht1BT+>ll3)+p)(Q%seV&A
z;N@s?iW@eZXhJ;VR8`aQ4PBjOWkO7%0oyV|;>??GzIjHX8I3Y0PQB)uYo?424xb3x
zZI6ISG2j+z*0QXuBr`m0l)B7GSvq4_D3k+L*xsx37HCOedkb-qUatd}QP-=36O~YV
z6gYki;2VIa3HY}pH(c21Gqnc(b&T-%)CO=uAsb+8Z)*n!zP(N2r#5)|D_FTbh$Q6@
z4MG&_g*FISgvi<s+5JEtuavpWLBQTnU@vi*gMe{Cz&IT|!&kR7HCeHz$c8e6#hs&j
z<rSq8dKD4mbSdAi95ZI-seD0q#T8%`quK~7#$w^GtEwv|R?vlonaxJ6wgoHaYz1@%
zj5#_O4>dKyT|Dc;Bj~~T`jWKY5>R>qN{>b92`JqRK2%u^Q>jwMD%xO~SOq7-Z@%zV
zv&odr8dsYG0(7oEHPn^^wBC2$1v$1M^0zT2JsoNa-{t4$Ao;-A2G}{bdbPT&EGz+R
zhP=F8TXydT90KFwa?A<^7i{tL_Li3PL7xDNP@8JuHB;g08Va+kVJlwW-VRe(LwkL7
zZ!d7iW>71mlA;iB#{yGa83$*f-g8lJiV-&p^`41(N5e}p2PKmLPg4nrsrm@t22=?J
z1(3wl*=^xk7@5>Nq3h82!w)2)^fsP8+8o~A*OwC-6r_v;PFZ@(b90FW4JFjw-{sXw
zA>kDc2kS-h9ovdqoW!B#J3C7t0<SyU+NF*D;FC{sqRYxSj!JZ^gTZ_(>4|{{|Eb|^
zixy3vjxlHppBruNg(gZ{+kir00V;-YtfTY<g4O3lBl0%+Kke@7?&xT2?Cs$(eDwoW
z9NY}CdL)I%5;e#L9AkuqS%`V-)f>8t4Qh2xba1d6I@$fA6;+RojSmNg4fI&%rlbID
zR=dsE8*T`SR6}~-3*&`st<tCpNSy}$hHq{86Tpz<j>`c<k~@-h$hdY#aaDbB{;9S;
zFa{f&K_L1uQoHI-!fjjinWAb(D++0?udf5Hcd!O~y4xK-cj?kZjKBdk4IHq*`+F7O
z5VhvzRrCPLdL7tUq}mAQu)?^K`T?Est-tLm=?B}kK2NL7bK;`o)YcEyne;v7`QLpB
zDfIe}KYsVa4?o<G=nLs!tph%1AZGZXW&m142lnr&JWCQOcL_Yqp&KA6gK2py#0gGO
z7}q~gee`5<jN01*mgQ-Zj@5$`+1T9~5^?-UUQI`T2!t+yJRgQH3k$Q`$7rI)kDmeE
zr%9vW@4^)yA8!@m5ug@!_b#}2ij6YDk(MdI5E-G%8K<+FM7P>t)#=ed_}lR6MaTk-
z0U=6+-Z2JSz=*b3f)Evo^ctDjo~}@|ff3jUil&68PK1qDYM7e%$;P<2Fb%pBcD<Yj
zW~)5RG=y=1eX6*~(3nUgxLDelkiftY3Zxqlby-S6WNb8C$y-6z5n2aSU1?$iWIw19
z;h6?Gcei%ojOUzA0elKhObk(H8#q&pQKeSvJI;DUncny<(H5fD$@9`8^m<}jaY03W
z;gMqvWJXX`()jh)b#+c>Vd3%PRSjTuHMWCC5bSnGFI>7b13euQF(wVdoj`<Eu<P2x
zW5Qw*qC-?}A+e;kS8aU##Vti12wFOieP2~I1`59)e)!sJZ@&vc<K`1!(#0c6C%oJ`
zFc&&nwd6gobkf+d`T5~}&?)cg^1$99&fQXQ<YYnw>u-kXVQ!IFR0MU_lBA^O<}M3{
zX$bKI?9qn!@#E*9=jM(}i@>xy4Q>--W2-}_%$l7Zu3wd?wU~If-Wp<50BvHUwGaqL
z^z@{rMn(olpqqm<An(CSWy`Sx2OQ|Oc4reD>~|}=`upuV11~Z#EIS93LVSQBG(Ivi
z5rHHyt&PrzoHS`*0G)2U@y5j|ASTu@AsA+yea+1+=m1D&%faj}gypYY$5-S7f_<FQ
z2m2(9xD<@I6u{o^fikeF%A`_Ri;K->0|=>7$$ISE)NytYnuN5psciCu)qy5cdS#{V
zlTY4!Q>Eg0Se|XL2P7WO&!0Q@z|o_L5K4mV>S}7L)6+H6rY%}z2NQGgV$25t4RNut
zCr{$kz+9j^If0^RK<EaoHa#6-2jE&08rEE&XxBn#51KpBms$-s8}QZ9pjMN8AV^vt
z=rgA@*+Hp+l!*9iSS_vT6VMj_%#i>*iUS^*tE#TKsiwwk#tH;dHh)We?GVKrv&nRq
zXZ?D)9hf{e*p1W<Un?3Ka?CX~#c^qAix!EZ$+Tbr+F+zMNG<3?B$yntC>9rr;`#OW
z)xN7M2im0l%GlT%csQ!8gwIU5_G+o_I$z!WQjR6)hjTJ_Xiy(LvTxt1rcUDby9>Vk
z{@}Wrn$N%9a_9`0o{$@~wlas^DvJ7qi4%cHJ<x0h>1zA#UAsvO0Fv(|vr(^t*U;nw
zM~_1F=IdJu+96SBC^_)$PQCKePdB~y&gWl!wf=pW!EHK#y=WrL`}%u&3L&^X)oMsd
zNeNcA=jW%T9Y0<KsZDu969Q`q$z#KN>sn^dn2;6=98aA-cH9(K-4$0vVBB2&n_u1o
zpJYpBvAOm{p0}h<oR~gw;>5(rK&*jEcVRHp*XQQe!s;z5J|;-b3&}dY79Kk+W-Ud!
z2vM2)`?O){>F~4aR)r-b(HhCfg6&q0bHPfd9mwsKZ2J58FzB_yxlj#OJKa4{EknH^
zMB-h&J<X;05XgLgsMhOk^^}!`g@hRL-uvJiECx;$f+YhZsk88y)rU#M(+y+Yj^Hfh
z)z|m%!?Qs-JzY+h2ae<=jJgXLwH%}4F7(QBVAOJ8R7OX^F$Z8>TYlEr)!OJplnR)j
zIN++Agip;49pGJe!BVxp5eqR^X*asvA!+fR)-Di2C7k&NV8}8^YcVpRmeJvMIuY?C
z8}8IPTbx2h-tiiS7dn2(JMigWpL6l8r*>}qY~5QQt$XipFCkK7ek~@mvLid+edCke
zKd|-ovFQ5%SLx1Ov~q_GOb1}YplCOgUcb*PZWTZM^l(`>u)ym${>7(4M!3caKR2zN
z%$zV~#+0fiS47g{#S16hbkE&a!y8dzm<H<sJ}6@B<(Z2{vlPrkx{#PC6D<$S0}$K+
zss}47S}+k9tl@w}M!10^9VEBPnjvHa#6^)Jy)MFH2#QOI4l-Io-J(hnm=K=`0vQ_+
z2KpRnHK{od<c-nxu}WoUb+aN+4?u{(055>oUtiyeZqY%gql6w8h7b>zuqKOM$bf4j
ztj~HmHI(i=oEmm^{f&)ns#AN9Hqv5NQs?w~v<9V!rF<U&W}tUK5e$zRoC+AP#`L%3
z$}2C&@Ca1)YcP~`<VM45u$r_cUvDo$Z!bn~FG6ph^FL>VwFh=GZgYq+B)HpXhLuUU
z)&eCSix!KnPM(F>F=;BaPy}$=AvvU<jCwU@Q7CBxa3;OBPe^F*H&VCP&Mzq+=ss0=
z2rGe#cGdXt<JIkFpwd~46)l!jqO-2xeVB)Z<>z}mZ6v*}?-xJ&tgy+Ak?3wX^_c+8
zX)SeNS$FCbXK(TiSHj8njO0knCXvaLX3Ur|iOsje<gdHm5)lr`<*Zp#Aab5OHo!Y!
zLRy>!aIi#=nII%MA(HRu35cmI&fT^L&KLpMuKodxBnWn~d~>o^cz9R9iMMI|RrZi$
z$EwjcZqEQ5jbc3l9C5kbS|OpSybcMQ+RBt6lg6<VHJ}icHKhj+9xSaPYnBFZypc;F
z=#xih55Zy|yPVoOL_N_XkO{VUolXP>md05KARhwAhXC>+7-tBo#B_*vLO!}05GT&Y
z2PhQa_T}h|85tJKu3fK#!DLg7PfN?s&&bi$A3a)E7ZGt8LJ!(hXIolgV_S0g$b<yD
z5;GR&6B`fvCp+uQ(ZM<vFt7vz|7?6?TbrHr$g6k1M$2zdgL4`!U8I%O!vbSs5S*wR
z!`exUku&f+--sng2PR_xtGA0h9rQ>x(LG&obkNeyYVFhDzt1D8b!w%nw_EbEuY}a9
ztJg)|_C?PCcIE?K(%ulgWL2q9X|N#Es37^9(KtXPA}j(X^ypVZUt{q>s6lVvvSlZ%
zU3cv-YQ$8Nu4+7v)k;AlhsD3xSOA^KeC*7o0qeV4;qs@kwh^x3ia-^xcBVV1HnesR
zh+lk>U)zn1e|K&E7kl^CI@LfdwX=4wFe55NL^FD!4a3kzF(@i|#+6rIIepfwnORp|
zb=Az|D21eOKM{tb)1yqFLQuZH{PN2)*fhI+ipHqd>R}qIM-c4@Abmt|uvKq@<QU3R
z8kUk07pegu5fLjTA|gm7Me<YyM+h^Z&xq&Ua0J#2NYXZzLKEl=1`0=os=$xD^c=<Y
zxM&>W4g4^`y6xfE1uHmsMu)1fmQ=O}ptK`u;ndO&yI+M0oCT;q;VI5Wg#vj=bEsP(
z%;;=v1KxJ_z=san)Z7fOLFn85s;V~X$!=J70o~!a4D5r}PGBHp$!AfGPF6zzhDx$V
zDMEXvAC|F1T~wk+l1;#Qq)XK4Kvhs((aUrJ0f-HOMuF@H$aqfrEcXD<N#Flo;JKvF
zBH7B;RyH&_`?}!mK@D>l{B^Z8o5GYd?!+$WVL{~E4$N-p!i<vP@j#Q$Lp5`P8Y1$g
z4pMr9k|~spCrh|sGlYk56cmDIdaQYb@u#XhLE)dR+m&D63tDSX@fr&-Oj(;>apH5#
zDmzOMiN(O$%L)-?eZx^qEB3Md=##_X6Mg4|qcg0W1C;LOqP&7r`@TNW8x_I!?aOZ!
z<AHmIzN&q~_#j1lW9yvhqjU=R$1UwRv1flVAlcZ|sUI~36U${u(4DNSuIMwxPnj|$
z88b_U+igl1HEJAqA~#+;d-iyc<zSOWZ;4Dui3#AjK%*OGhao{0prYCuGf5b44mOD{
zl`+Vy3rdKK3Rfe<3xMP?1oiitFuPdQ`k<(|_=Iq?8jzvsB?Enq{VR_lq}NAA8qwo$
zMAGB-x(9+r#bG*zA`9&IItkXjE_j(mZ;C)T7KE^wR&!7C)C}U=s9>84&+r`A>x5rh
zr%R#oQnU~krWlkk03&fX`lvpC=g#l3+irC!H3pT}<x#4{mJagL)!z!;g3g|Pk9YW9
zXPB2+eQ*q>mEcG<({qXhorYW{cullTR-3HJ$;m-9$?&|px4+k8u!lA^b->o70g9>c
z{nXplh3yaw(6vHhS3@BtmP*gt8fAUE3BCc)%c`z2sQ;FAX|XcUVw%xle_GMTCf;KY
zJuNx3f$PMQg49%S9-y9A*es?Bi3tg_Ft1#H-*qto*Di_e>~o?sjd5czU5$wYGYY(&
z`F2fQ+?Zrg<z#y(+`NMCSJTpIflrlgku=%@cxRiC*xOA$OC86JLFtpn41mptc0o4<
z;|i)@Xk9POGw3cg-*s}UJ#^y4SS$<!R4OHAPlWgeozkkHbC_7!T8Fu%s_g8cZLhug
zgXe5Ja&2ntz}CK_u?}iywKUVfk5W6QQ1{u<=nw!cJ}Oe_bviK%W8HyS*y)?)gW`wl
zK?KEfK79g}5|Vu^I51!FqOu1%NK6^_y*aN^`EBTa2=-gXcBO<XlRMK|8C2-J-3Zne
zVh&{fWQf9u-7ZIARpiy9U$cO?z@%9KKL@gAfl6cKJub!{4J_ls_b`4`X9V9in(?mw
zF1UqZyw~l*=G&Kx9yDX9-iBdN|G}knDZQXK*~(EnM(uDYH;UyGnX+bb&E#<9<(}9I
z1^{@ST}p#duZJ3hOX2d^VdpQ`E*1F>)!#|MoQqIjMaK^AI|^v$A4N>gas=%&D@-PY
zFEa!v`divPp6)&Y4pvnC&X->SJM{fGUv@$x<4e0)r>M(2bEZb4V;y~n0iYKG^YZcw
zP6da7NW_H%pUTSv-^`534`T@tmbC$hVZamubg0APQ&ST`03z`nV+GsL?CI%)-*s=l
zM;Tzkgsp{*r^TexMkNEYqT-{p0Tzf?1C%PgL8l9~0$V_K74kfOeyb#{q=9zwAPqCY
zu0|kgb04+JQ}5_f1Va0cY4wVZHs}aNTge_QJbL$z&(N~ZcT=k@-A!(t0qz0w8<aY&
z(IN!aRuuu`s%n!{p`|ryR5G=S)9DdF2g;WS%Yp4MCj`2+0Ys7A9*+388V|Kf5gr%d
z>FQA^SU(7t32oP^$uld{MoAIh!lKYBvkvNFN^_7-XEJM*3Ke|mODm)R9~LCUgDV=3
zy{&|`V7(|5pMAORy-e{YrMm-aKT2hC;nrd$_tlG)K$}JBSXHDiy8Fo|pS&9~g{SR?
z-rkUmMNp|)lo0|`7*40o)~ey;1v;qU&l%uC1a`1NK>>OV0y~(hny}Vuf<v03qEdJ|
zg%dLkCz(y*wITJQhz=IucmQx5+Br<Maod(nkkqm{_!m@>)AkiWl%{ZYb~*)Rch{3Q
zOI1-Ej*L7ksMPJS>ON>!6l=A`f=XZawF~;diZrh`%~!%?w0s&$n2Hj}zIX~s2;Z}N
zAGBhjd4A&X{{7hO96Wpk3Ty{qxgYB6>c+yX1M4%au9yp@c6OabWWw--i28$QNfEq0
z_2{rlSG5*y+xTW3s>WW-6mJM#<0vX?#M&Ck8c%G8zxAC3?T3W0y1Lj5`dhMOZukJ`
zt~Wdlh6Y(u8$!#NI*|{VbHfdzf!48;uX^Bt2kyws=oG>`d$F*<A54+peGQ=+nh5n;
z!72}hGdLp*!=SK+wSiZOi0wv0fKe|PU5ZvP2FuG&o;+3S%+?^fCk*{6Au@Wx9y)h&
zMszqljs}Kd_a%y0DRlK}LTC73L_P|W0i!X15&0+_3m92Wp3E;Go9mM&(dgqxAZQOD
zCx^}C-IA&X6Cy-JP*Ly`^`uEq<%NS+-mX6M!H4VjG$`$=ciw3#K6zNMtAZzHWo6xJ
z&w`Z%4*o`y)OPi^z;IPqqFwd7-^De2`>kLpD=R6+*vN-_?!v-~YP2<gjPpW5Xu~Ld
z3A#Odw!8xKZu_1+S>j4M_-A*bg%j)n%Vy4;IW-!#(%*j{JbT$PU&~ZznFcM>pk>l3
z3oWxl%9TU<J1j%6Lkh*J@FmHq3x~-0E=<)=slJd?Es#@%(xdWArplvNAmO00Akv_+
zB<-KBOQx!#R0ri$h&e&2H1r5{kjArW#CFxuE4^~606A4XJ%Tv)5~&*Km9OPgVR9-n
zJsP-3DxMJxB^9f!aw-Hnq#6PmIX+JO$o1=?Y&XbhV&ycF(gvD#iTeF>sT@?+cDby%
za#_Lj==dees-#!e%c)Z2RFbMd-z8IpP^v09)qFWsD?Nh7)Fs+gOs^c3Q^9XLK~RDQ
z3cN(BT1u5Cr<x|G>ZV6EmrV6P*)EZ)Qz_RlT&`g!J-Qe^sTkptq*_uYr;3nMVTcUZ
z#Jg}zdg&F%u(G67P>Z+(48NsRU&^Wa<+2j#5tOd}g;f9G96P!0K=6oj?7@Szo=}((
zhI(obUO2}p6gs2iq1dQXj4;QBgjkK_AyjR&hWv;*R*_O)pE5Ydk`wizbL@7lcKhHQ
z>r6^=4$iT&0|OBtRf3nsM~!Hus=@q$l`4Alujq2%H0DRpK3YAnqqqer)ZrGB60^vA
znvqj~0-Z5A^+aFl-EwLVrJi7C)8*7Ulx+Zo*ZInZGZI)))?re(+rG-ieT56GBQkPq
zd^-CT`WhFf*>e2EA3^Y>RZ{&)|Cm-GM&#jJX~Pz?4q4bT#fA3OHue>A!Sxj6gp}#O
z!W3plW~*$9)5{sXp*V6c6mnL}@Srs}<rjebNavW~VdJ?R)aAb@w;c#jh1_&fZfr>=
z`@)vVzL)Z20e}?lUZXq<uVYvF^Yqt|@*Gyj2a(eazB*osYlWO^IvfHcpO1aDya@_i
zRLce6tPiOr?F@$H$Ok-+TK*32@`iVCb%&f=W+wX(x$Tm3JG6-1Ou6lu#isgmyJY?D
z_SJ8)Ez?V*b(M{weru59hraq<1sz7J-?fyp3`KvA)GGu<XjY?F8ZyP7p_TVgj$dbr
zmm|jpDMvo+mn@V0w+uxy^t_P!dc4ICJc;M4{JHx3W>{bIb+4nXPxxxN6#47rJk!Y>
z*AK%)YOMsrAb)PONAvHl&h?5SU@v>0N;a%VuJ_70W&RO4`QaA~N-x7t@6T!EdNsU>
z9R5i4LR)V~y{x{r-h|v<lwoJS9V&y!ZQ$3~SNmW`_3~r19<al%kJ%JGpJEguuML^v
z)yPZ66h8J2<n@}A7eAUXdkwv#$z(PgyAGEsXn+sxi*xPtkC04yUmhX;zK}-9tG>Qn
z4qs{nw|m*`{`&dz8#Y3i1O5O}ubGtJ_Dpd;`nFYSFPn?-u(nM0socB4ne27kZKGU|
z--pqB9>(a;A0r6&BwjOEOJDCQP|IKX>Nu5hk^1&0=jS#IQ~YgSFeEpN4_63wSUdQr
z!cr-}d!g8OUhVw&EcFTD^F62?-je!w5w0<55|s&Cj{HDGkskv-zl;|Dncf=6WG~pD
zlQ_I*Mug-XdS8a57%~i!Aj6ce50cN}J%Z#pYBMr6YHSRSp(xKifG27iC)YHQM#(#J
z%R7I^9;Vz%e#vebspbC;><IvNTR^$Urb7qp)=88Bx-EB$6H%*4P?2L_%@gN%2Y^8c
z_?EHS#-;xXz_ex3!lY`oO?i6xFQ7FHRk|bh-i!#JYa}e+gnYLm-w%-Q>&SOK@{QZ{
z`Ns$z@z%Ocn?BnLe;T>lHg5V9K5M@FWYZV0Kzj4572;HJ8UiS$_>OV7pDIokFBh-y
z9dpDfcrr=6(sxY2-E=Y8cg&Q6B>z_YE$Uip*T7ZNfWElVm2Gr27VBXlR#VfgFLq@o
zyNdPAH7b=MD$S*fjE|3x)Vb243<$YvNOMW|t~7&kP2`tH5mBkCs^Z9(ujF8-B&>S%
z%N^K;w{83Kla(S$k&aJM{!)a>eZY786d@p|i!q|^++h%7@nkN-K*|S&haB$(<CqR{
zBDdv>d19uRg*rFe=Z+tr5}U|t;V7dI=fv2Q@f6XPpRi=fk_kNG+rkT;n>p$n*w^9A
z+zQk7?FGyc0F9LZ2P@dVCa$q?7ubgzcNaB!BEaz(9pP>~LqI;$=mJkK#0!*H|LLc&
zUcB|btFg3rfqlfjV<&yb9`+%gWGf!R-xYAd^a6XIed9aUsiLD-tUy<5-hO+-o@2*K
zyRy|?rN@rte)_h3EWBiFhZ4t@W5;Tt9A+Iod2-fm_uY5jZCR5irv|F-yAM&EVzIl8
znmqaH`__z^GMWUDsYzp|%wG)m*$b}BnzCd*{;r)8Ppq8S#~xe(U#<7AeCV-jSq`jy
zR{4&#aGdxUdlt{+<2l1)_h6&{z}>gpBB^SAYS%<XMTeRK)gl5ws{>7;6n!?u6xf@c
z+#6_0fkKtLr?sO_ir8G&(b@z5GHz9C$7vYgo$hE=x!1(qaLWylvRrljO*bsL9#P7d
zU4P9DOQ2(U-I5z_g$v&sZ@e20CjN%cv%cd+#8-U@fsS7Sn#;$FaD7BiUhp0C+iUD)
z|Dk;J(I=k3AP0g%F$WSStvVYjJzj7~QJHSsXB!cxq#JUSk$+W6zsfqPh#bl|*l<CA
z3JxEkO-SpbzdO$Ugi-UajWeTY5>?&-`GB21!bysH(F(kmk6_V&Ct6^>e5i3308J+8
z5H0hE4AieLK2YcWsDXNkfvk-DyCeBe|Gtsz-S4gNb`hgjIy$}Oc(UI6^10(x@27Zj
zROIBtdl+}S7I^>cJH8o03LgL0NkQEIAg#Fnd|JUA><7fw{?K=9M%Zo#>*mZ{obRx(
zE<8EGw)>6~xa;7I^1+-+iPmJ2IN?HSGxr~%HX~6Z!+(ezseR<=ZZzssH2o9b@e$jA
zCkFtMgTCVk+m9#5@k~BW;_m%(ftue{`Uo1NG8ZFgbAJ>;y9B{g{z!`VC(y5diQ-}Y
z*o)6L-?1C>%{OcZKKp&gZnjf;vI`N}>7d{Cv0VS*qnMoepQV`p06qN$=;`C2rw=d%
z2R$S1{{I#9bcMIdTkS3Jp7b5XxUcd$ybT~n^3mk2#FKK^+R8^M?rOXzd`I07di?x<
zkRB&X^!O44`+otwUO7mwy-U6S<+XXUeaD}?Kf{x0-lTI!ig!Am+~)m@@3<9ri@jmK
z<LV*wUiGij`?-IQ-v7Pd|BY+MKmEJs18y7_1*u+_e84+g44!0hcX1E<j^*4uJc)%q
znsi)&%W>RX?snfX-#4LfQU8$%W$e%iWuzHr=<ol=^{;=z`P08T;V>6#W%aDtcQmjz
z=Hj%NuXVn|ge9hn3&b<|2ttZl*5W&=eG?Wp{y#WjB})_5C1$k$Efd<^tO3w&V3odu
z;NHNh@oD!R^{hsEQpe<jersb*{=+{b&iK#Fh(CV51mA$+Bl8c;e(o6iLE_4KtHIcf
z5p3*rFh9Xe;Bnh2*ydq1@wF|JOTw)hzovry25!Pu+;ReVCwGF0U}t8TCv8FgCge|2
zZRlfwdj{^?Jn^^Q&#_;gVduxOZ~;n%IpC%&M5;FAHv>`Dk-gE*H^2(Z#`-eZ+sOY*
zJ0C{nDfVW<u8@xePh8?uPzl8KCa%x964>fY?{So{(pQ3_e=~w1Ncr<K?#J%!Q-AJ_
znaqaV*Z6baoCUq~;ko<y*XMGdCqCc>pW1t!ou9)JQUC1%>VLVN*MiM&<LCbd1$=Mk
zn^_R5KRc5Zpa7?xhYTInKYSP9gEtjEi2>Drgc5$@{SGDEGOUEOVI`FLOIVo6j-rHi
ze+hXDq31oM1T{*yz?vKUMUwM;j8mp;o<EN6$NJ<x<kd3<P>lgp{r;b|pML(;XRFqL
zqeM~%&GzlPcF{*re5g--AyfQ0cd9s3Tnt3H-wur<QKXNc_zi3Q8G4XQO37sVP|YH8
z@Ejga9|0;FMU{;Wxd)lWu4!%MpaTu<b6s;?P{f!~w=QQ3NU4cDUG@9@Sp73?QK2p5
zGr(`FssawmPAf9S7-~OfqNX3DQ`iu>*M(N&AJHq41n+UWlEjuUhL-R!8l{l^$HaIj
z%>mP|i|0&6DBleJ8BfB~)~VC^dHJVKp7_vs=2XFH|A);NHR43?QSW=IxWzR)U)-G~
zE)&Ojn~hgi?}+t(81mzJ6%?y{pA}gvGT9cjxy^jfjPM!rpi}U^@vwV*z5m0E?X4Z1
z&5f;Xt<CLcON<_lhX$VfL1iNl2-BmB7y|*@7;PUk)B3a#Q1^-m<e=QZ1tvf_HUTlT
zlQwVOedG*uF3ud;z4>C-@>nEDUw~=kJ4JTMK!X^UfAO7U*@i#OaNF*!^v+p2Niy#f
zbOn=e3DSfE7xZVQ_z2zs-IC69ExUqPYR?&7&TuRUr5C9%B4D^|@|_0LP)Q`sgGvY5
zMwk<C&*A&X(+g*0nVgmqi$9@sxtA_$2fee3UYGp{NC-FT(rKVkVP~tQG?IY#_jC^l
z?O^@>QFzD3%XpfMHigIYEMh30@=(6vVF+u4P8r9m51u}FbjzN%xWdBuU?{J^akp(g
z&QFVJBBx4N-0*EtX_mM|{F8W<abeBZG4%O*-MX(C_nW2j*gAGt71%cazVx&#Yzg6m
z-FVPCv5r1`Vj>UKHK`bds=v|Mp{ug9-x3BtZ5u4!-P+Tk9cWZnRR!qv;B-s9Pxx{{
z??aYKz3@jma}N`Y_R?vn6#K%_{58F@pH9u^t{(E?7)fRP(kzm=(Y&Q_RGcmrpc)S=
zAjP=Z+YbA$U;E^?c!5RPS(Kn~RKi;>)M_vnDlCB!p}uRm?*3f;9+;$DzxZPP20=l@
zR8RybytGMB5bYFTR*dMS?6-n~sHLFrl$`Mj3ZjvMqBdng6P|!F%HwXtd^dgm$tV7N
zm9fvi<<B=Gcpg|4@A~r{wfNd}f4+0;R11gZ8wMzVJISJeE5U$5FrdJ#LL{C)Ds7)q
z_8Q+DuwCHxoSG-j6Yo;=#XkFjpz)D^G-JiX^RPTB;%1=Ouh<qr<0Jlkf<`}ndcdf~
z*N+x7KGNSRXl@%jad}i-YmA`r5q^(vo}^JvF;;2(QjAq-2?ASrZtHe#+m?Ca6JkC$
z;RJW=9q#xTgp}dA88f(qI4*58*VruKO(fD!iC5wSAAM-c*m%weH9ZcRq;S~@LTxB5
zD=jUrEQf7H>1o5^Lx;Zq{?PvY2XL^kjus~q+l#*XoGG+@OziJ*2aKImSLQ%Wsfgr>
z(B8i+I$90Q$cj98nlGrT>W>gun6d9{kE^4hxcG$^PB!#w;F>EmE^6gZM+;#G59T3c
za!c)zBW8r=O^b%2;OL1Hod*R2`E_lA-%k8>K(!5elqLj+#{t?uSXU_GCnqH*C&nd$
zUMHuFF(O3i*|Y6%_2q=ho{Vc6w3oC*{F(@)4Irs{g$hK4STgAnY?4(Apk7sqr=#Ev
z#RqM&Tqiq{a6tQ<<vKL#D&SfUQvudBBCvn84qDQU-1Wp@2PO^}=1-=F5EOLkP8^1L
zCuaCCo?M2VRjLIYgfW%X4hIZYke<WHSPdt})<A@3gvG7@5wj_QXYwc?)Ks&9xC&TW
zEW=s41Qizki8qJNGQNyH7@FlEjX9rQ_}+HV+mnYTu@QCfzinfO>9<?#fTRC8VXO_}
zP}CoD-|(4oczyaP?chmEw{#-8^GGWn0OZ&7PAN{A@R5VdPC9*#lOKx1OCTt+^ICj~
zH}mLqDGk6a!)7ip<B@nJJ_=ar^Z0Oa@Gd}ql1?_T6kgqEWa3{zUmPFnD6TkDQCx(G
z(B%D33JQIO94wP9WMSbpQq?n(=mQ4f90o5h+Vx&sD-<x*g%Wt$<jHyW+;-c^lb5}-
zem&%l+qQpqkp8~kyKD0%Sbcr*`Byuuv5c8q{msks#Rc-g|CN>4v*&q_c#jD4xXZcA
zZAr5W3TA_B1jID;DwObM*WVOlR&Z~<nP+lMdHCV~n&L8@dQ)I&8#YYXy<^9$S>KLM
zPrvD=6)WyswiM<S*W7s9@_XT!_Tfi<w&KqDu<xHXfBA3cv$fK(hJT!;pft9d?H1-?
zN?c+~s#mM)5h*Gxth}@t3aZUz<zW$e*W}BR!pcu!Y@8|&OTJ8qb<|bXBiIB2!NY4R
zER671PcEMk7!ZGlpd(~Ag5*Fa8W3TK&1=^KMlf6Pf)=w_OK4zNU}$(mIAYMj=oiL$
z5n*Jlfbbyr8}oOPOPHncQ3{elkqlYV8{#S4HAL?oSQg-`57XN!8@B;V|JigulcnN|
z@RGES{Mu-w@gzy0x!rj2SM;I>t2lgNZ%JRI4T5ZvFtxpk3rauoeEt<?<V^7aIy1Uv
zQ0l{`(l<N%YdlQTiEoELCX^9?Ks_j<5oMgF`>(Jw!dDOU>f{oKt{-Vt=buStIyf`q
z#8Pev;|_*$`xux14%Y#Esp0Bn+>b(AX%3kdufUwh<HK2y1b=F^hQ8n?T4{!RZ3L_;
zhmf+O(os?V4b}@eOw49nHXC)|!2Toog{75npHf+JD*yOFggV-@r>qQKL-UU07o09D
zJAC-aak$cl_q~^-M9;9)+i$<^hN~CNnKo(Cq^YwPU48u>P&;3_a`x=`S6_X@tyf=}
zH5*#KH(rbOzJz3)FB$B$QHG<c5(K*fL9X}UryQz-m~FNq;&!0L3S)pkvn9})IQWy?
z&KdEH-O7~gcBWvLqn(!n)2xA*RB1GGaHmOM*oy?h?`bLGOhEkVP%8Tn5h&MghF1uq
zGQ^{3cK0A+lN+4G&lY=gy+sfu-YY&X-YH%$&KAdt@%F34czn;s{hfGzzc@owc=NsA
zu?<2tyJ;R|@=sc~HguO2!f<;Zrr61&67)fnm(Rm^`y2aA$Yg76i{P8G8p4My5Zyk_
zUg4g2EDMsFvzX|zIL6Mh4cuc-EP{adFYHywb9Uj)DlA?e2d!KiJ`Uc=`xRr;rp=!}
zAF-DX=I6V3h3Fc{6JpSs>YD1~yT8GNMNM;%9>F)e51y{Bt^qa74tIOpU1u@7Q*aHk
zk}_HKmOuk2iV$PA1O(+*S*J{#o;el<3-}wGIep^fn1SN_Ak10W;jW#BT9`XHi~?i9
ztO-#xm7FDY&O)V+zW$qGzj3kmJMWnv4f~Bh0`?nyuwTon{wdh6{yVU*s;(Ll_EndJ
zJ>p&g*unYLK_kIFSc1KK=V8D;C=_Ol)NkF*t;1nYT#rcLeFE^FVwr>k@Abuw;zBr|
zFDOLuTKEV8>BYPxC|u0-ai$mxG8M}{7U-92_wJoFYcrseZOa1Mm%?}EJg`|yfpbp+
z=WMFcgla{CzRpqC)Z%coG*Ol=rp81EdM@ZgEuoRo7E5#_YCGh)L?;tbw-nSZ9d%1Y
z-4anZGu5rAun3E?vLc5AxgijS3wi`9_zvOVeMYWj76#bI;&PBfb~;mBzKUMDmTkSQ
zy85=bb?f4!3NMf<ycLz+3`0~lEt73t<*T-SG%J2PBI51(d+w<h%vAS=rUtCzsvG1Y
zsR0zQm4k;}l_;3072%QLSk?uFTP$db>AW}of7u@YxV?2a&6G)|pJrl36zHg_DMG|4
zA}hOgov5jC<l5kAtgpMr-K_A0D2;lh(r#lnT?Oe!2J^6kpmuB72W%7jjzLq%zL-Hz
z2-lnNY%P0>RdJ)aOm^cc8~cnnvumx(CkN>hMok9A1l>GRSk~RJb)NX7cptlI)fJ$#
zvEm}Ek8Xy#(=Wvbxm8bPi8qRHp>EH@O3N(X$UU`ck@z4~oqj4_g*Riw-{yc~hUX2y
zOE&L<We{j3DCV@Zv5Nj4Q8^BzG$+PUT2|KBui(qesa5n>Ud}5z%1VKlKuTLUR$GQZ
zi{5II$R#Y&dO$wAKt@-^1e&f{l%i;9Z*Vvza%pio8rqu!=3Ha467JZ-l?&&jS~z7}
zixcD$MAH-&>}D;8cDm%*{ND`sr9U3-qqw<jDd4{GKLGbw@$tV0_tk)V`G{~YFGD{_
zaOW=$cZ+c(xSM8Q1FQa_aF+wOfnXX#g8=u#JKZwe{k(x#;CmS8Q5exmA6cuT(ltJ^
z=E~vJw`amA1Rw5pb&f{8dDg7Gd#`nYi8T+Je_H!IXc{Fm8yftis)*2QG>B!6-bZ$e
zrObR}SDizl$t)J78n(0Xh#)9aW3|i~BpR6t8ksSaMiRNI14>qbTs6=fVj^<oV&`Zi
zr(On;1Gh|_&C)X22dL)<EKM+}x3X(p>>QC?fH9Peg?+O4WHvjTDJ}uwU&0O(ZRd*_
z)!3#Pq>@CIi)kEyEEknip+uJ9Chr`T)T^~<0}MR12tFMkQOV(NoTHK#Z4nXRhU$y8
z=mV)mV=}Rr#D|T!phe7<h1Og}pwDK9{4F~4cUnXfO;OpUT4bUYnJ(5M@-Vmzee@Ib
z(RAPqHe@UYZtn4i5OHNiCyyTe_%p<H+50W7kAR&5h3qJ-k#V(m$5$th?$6DwZrHak
zciUGVz4ysh{2;*PT~E(q?>g@xF;V=D_^kMlco+0br-&K)BMI4me*Wdx{`%i*LEoOF
z!-kq?8y|oC@n78klRK8L{I6f18oPiUlIZEH>}l@)-^~Y?%E?XUuF0{_$K&r9H1(AC
z-}Ufg2ygT*JHu+Y(5;y)NAtU-lc(MH)1Uu=f*#?pVS_|6pe*tCbf}+t^_7E%Hvpx7
z&t2J&B}PIecDd@Awa>r#>gp`<G0@@51tEeHn@g*E;2?}oO#p2(1oRFtc=S@k`DQla
z;kdjiJ;JE)d_^&AjkSij<Y+U`<=CV4?|*+sS7dP7q!@*wsScjXf-Q+jk!CpELF-^F
z8cy5I^778MUZo;B%<HK>QPf<=(w5#iN9H9^A6$<<xCMPc9`<N`A9ED`_>Ujjv%945
z_~FB?oe0?W-R{rV?*NDA=uuxE?AiLsdmnwZEqC9(hU(nh{YOuJwPP>(1$_{37?zE5
zr%xQ4nl^swoVT6x*o*9G<>M=Ex$NpJOj3PZg!1s=!>FBoK6ec_nK{{4-0$vRfK~ge
z(#&?qIQG=9|7+#)JAQKiFVH!w0-|1i`Q^7aY~4~*f9Ty;eyYlX!XrSd{^Y}r-)w&4
zrFr7*;_ZACU_Kw(#g_w|kEvF_`sVX%pUD!J1JsdR!<7KNI%mV-gRi`bIZo=7RWWdR
z*wEP4+3TojI(znq@8My@*=MjS+FPL(44~V?INltc9B0sCqg`BqxE+06dUzplxmLyG
zBB<FHAHDh3=Nq=}-BVn+d-wa#y}aS0AJj1e1G#8d#GE;IE=^-~%|$1wJ>IZrg|fG;
zv%H)({=Rw22lHh<m{Wx37zwyXcdY+>_jiYm9qVj8eE4`_$?iRej-xLC^Xw2L7j<UD
z?BgUPQ0UFk2@%HC3IOwP78k+#;OhSB%WhfmIPuP3G&|p(Gj)7g>ez|X=b}F(RA0Mx
z?Q^fa^WnR1y!6c2QwspbxzKlhK>Q8&w>9&{YeWNtPG9A4QBe{|)i1rV`J0U&enJ2P
z$jz#szVhy&`kF0UH@uDhAQWf&V7|JV4)t#zcyPwlo1TC@0=GRp3zF^<_P*-ZkN<qd
z1HUI1|7+Pk@}b$**4nPH8v2~=h<W@2{Ls`mdOO>|?tnxbSPpFG2YO6;h3HL41>>jR
zSy@uk;T3aYa&rd;V$?r;wBhCF-rv2uuz1hjts6dn>&=h8Kt~Xo@3Ds?aY#~PfK})9
z)HL#Z^n}qN5v*|I2YdW`DIcvNFNla{Amcd&13iL(Yv1lYa^l2iA0Iu6>!!1n5(NUx
zg%D#zLbO>ApA*0U1l;H_>&QjpD%Rs8A$t4T|NiT1FF*h1?1UqW#S9RdD?xA`0^#|M
znCLy^T}N@tBvki)1#MA-cn!DaZwv6_1AzQoahmbe*k@jP<J}M6dF?rL&MNE`BnqPW
z!_R+u-?Yg~e+TNqZ4J$W3c(rnuJV_UJ$%>w^T9w|L(~W|29TwFIM%X1tA78$il0CJ
z>n!#@Kwrm&Z%0?CpSWr2j0Ye1t*?_-*$Be$a@reUz;=^B>~-~2mo|%>AR)Zy?WifK
zboL|25onO8(3^S&cqCb6ivT$>M<yj&g5e9Xu1TSYnUoeB*|p>S{rgGO6|rZ}2OA4n
zM9Am~(LCQ+<MHaO0f|W=lvd^<+!xO<lPcMpfd0<_{YQZD3Gsd|g5<vdt79Kifs^mS
zREQsBD#+{O!3DFQ$6)mF7<{W`L`amE&x0(7jW>?8?Y&^>EG^-(+0vW25f|GRVNeWi
zlFjEB6vJ2A*}g?#;NW6>IR9d!0M&=_3(<>1xfcs%?!~#4_`)G8@yGd-EN>Ag-SFl6
zLV5Yljm+*?D_oY(G75&UI?k=!3o=-K`oNG?{U8e@U6?}arD5A}X+bY7EYDkXo@0$j
z+w+j2tdYTGes<WfmFOVHgcqiawv0+2x@(u#|5%5@^;Tc^ur=yAPD(l!7ne1%upr-l
zo_HxrlW%<*gy{3FS7eT{BJx}-?HRnz)^@~d8k2cNtB)@HKg?YF|1eYDfc{^Gnd2~H
z%>>O{44OF(G;<tiW{A9l@$-7B5r9cr^~38U?PJd4_(;2%57f)>7z`>O>xVl%Z9dy5
zo(2<WBbz1!$$Ojg*g)s@1DuT!4{HcZh?{n3zIZ#lhit}q*bZSN9#M$A`|)#%%8IHR
zq#Z+$yazgu8x$h%g#271lQt+^+C7Z?wzMny{}M{_J`lSmiKq8}Gn6I)mu>?t{T#SN
z{_dp}CkQ)a4^1sK&Nhm(4tKVtCy$gC7EtgqS}($iPI<Pp^l5czX#@Gb|55y41<c*9
zTFg!3;#e{4q-^XBwhk&EN1^O>6)VE`4&1+i=g+fmvAIg&rm?F8+cj)07XT~6XRx$+
z60+&1vGe*8FC3vm1t!yVcigcMY{@_4mo@knxZ9y`6JY0UTH8V~RlF9<sfWcsh`->T
zeLhRPLkt5eAq%X8F!2uV`DYi2zrZ5)QLN0C;LTKts}Bi({)wU!h2+JT8sFO4bhZPY
zWu&P~1AD%}q(rZG4UD-GlSn(tEAf<#hl|}7WAZ3+A_%`mDz`T{Fn;Q_Hxo}8-cI|v
zr=&RZPoMa{3~qr9eSKx$pEzC6Y#KME+c(?z`{9@92io!a`vDL?RZx25WT{-6nl>l;
zr2)Mo^#ferS(1~VRwKfo7T4&94fEJ*Ot3DFFv9RoX73#>s_1Dw`rbS&3+`u21-O;e
zZe5HeXeGe&kZ6Njm}TNZ@iK8Vge{}-y%6^+@%-md)iA)|;1Js?%tI%vwy|Y2+}A+k
z<S$H6-Eqftfd3M?E6^ohqHCUEIZVJC&!9Ut+o&V1WHzx6y;_XlKf{JkV9#;CdL#>r
zz6MCKv#>d7U>|Ug{Av+$T@9<c_rY8Kk`+r`QBz&hcDCVcbCryQWd+9yPaHo51q^Du
z7NX?#vT}%&SLtvnFRSk*mb=8@zvYS)OR(ET;rz&nRZ61K%$o9!7^ySReB+T4L&lg1
z)05!78ZMWUrcW4?9@2&1<(=<*tVw^0F>x>YViEdc5z*IRT7*hM>mln=Rj{M9vZSP|
zstI1Q5%aRRFt4Ea(5_$?b2GO)KHk^|;Z|RtGB`fo&B!<H%$Z<D94aX3tlK;fSh-TU
z6iW~E*(+?d?#@Yp+PIWSGnpISGS{w!a5UP!Sd11&LFlyvee!GUS|h!uyt|d_(bwx2
zdv|+}L)<$Bx>mo&&r9&yD8U}LY*|CYqmMqi;+9*-rzDP@z-~(ymyJptJAPcMD0Vln
zWp*g%LLQCIxzWCiyOEm@x$z-(3~I;atPP6aChQZk*^L-$C7cPuPA@cbD)H+vyd`q;
zg#;oF6&3K8>L|)9&O23JQI6$ZO<i4US7%Fidu;`Fe>Mg96PxYfn>TOWy7h(U-`~1z
zE3^U;xBAo9pML?5HVX+UDPzVYC&Q$5^6Z&Oqk=jrXU-XA34Y}M>t~D|7aAOu%&wJl
z;q2iY7d>%IVyd!WUraa`5wq_|OF&BEn2FKYok*1a4$v^#L%f6j`YHPBA@mm(rx-d#
z1%<w`GlYVjN8QS3Otmy&ND&Xwt_Ezi;mOHQ`H7pK+C8O8PPX9390VGYn7J2U9r;C*
z7hCyL7B^$>kuNIHY4>AblE8Bg2|S1GKK=&AzK6>o7Bco9H)8)W3gWc4(0%7v{nGAZ
zj!!&#uNdn+1L5e#9Bl@>ZS<)03FAlERo&P|H+0(*M~$D5K5F!BEaP@=VtP{Qgk`s`
z1fD#)^44V&Qj^jrf^gmrnZme5(tcwXWTCHOn3KHp{2d4J{(p&$>dlZ5V6(yJv6Bm>
zJ;zlL2>e<S7@WW3SO^S%8UolY*vhPB<7w{z$#ZkZ*{04`qOwECEV^eX39c?L1U1gb
zBdL3I5QFvB)3E1q21#)CIl7#q#V9Q=YX@=2nKA^SqTzZqB|12C+}Ih{-~ULkWz?LR
zl^sE&l4inRFa8FRknm0)9=-Q)vne@Y^n@rOq!t0UOS?j*&aP=-jWx3~JS7!HCu#*<
z)P&IqDT@5P(P2J3yc>A<C*a{~;NjiCLyD&`o|<z`{tdMzNve;p%8KGbIE*bUCOc)n
zWV{qQirH{UFG<G(ln_56dI&t!VZWRW$G+Gfk*2V_!?%Yef<LnCHfVh2a)d@+o;iN(
z*zwUE{Fiaj<1Zph=Qko^u^(lV2RExlJ?ikO@Jb6dQ$>$DjQr1@zdx1b>lcyn28D>n
zKmYvm<6=lxSIFp@bLY;TIXdK`GItv!in7>!b>L93`}|~Q`S-780l#o$TRm;%KYRo6
z(%?okPaqf%*@yzPfH*<8qOz_DuGgCCpx-cL3%VCD9<~JqBM(j>U9N06KBoZH_&X=A
z=Y{dZMaDWc`H;gIF|Y$8;n^+{%6EeT{9q`QB714mDGTtG3eG!#+>!l&3)%qEZu5MJ
zKH-iXxbvhBca{_GltGK`)czeiXn>TJSJz`4*H=Svq`ab(;-i*BvV*@JJAS}>Wo5t}
z8@#Q{Y>o~$VTw}8i(+;#(1${dAili^P99~3h;kL@x$Y{cJf&d|un!BeRp4B2fKld2
zRu*)u(hbL>?#g3%dB=9Y{q)mMzrFj|VpfLVzQH^1;@#I-1((cSuDlKy>H*o1Nn-L4
zR>t@+bx#Fw2N*OpT-{RyLE~`#$11id3pC`9;uGp;-u~pBUAcdr2XZpalxT)S(mszl
zalwMb84qM(HGzYFU`FCRFeVqN|D3z)oloC@Jm`<&&5BLaWVEpklRbX@%@5^mo@^h|
z1it!xxic9{m2+$j2qahMjIRb(w7Au(%1W%Qs>;s5Z{L|RP^GHM8Yo%SR8`?|Wu;2p
zUFpCZ&~&m{hchS;>zm`UgVD2Y^eH2N56UdfLFVfhk5;#LHdprr1zD}S>}V)5!gF|Z
zBzfPAi3|$rt8VUWvt(Xx4hjO&*sQ~Zn1m><0V#LafLHcuElV}eN!L`s8F)s<F{lGc
zTsOFtgAxyPHF0Ujl1G+%{lB;WH^77+p)b*iBlhG!^6q~EM>N2{p;~>i_Ap!{jg@eZ
zHRB5k?*@Fq^?RWF&?&F6FPb(;evK56k=7}vZId4w{)M!@wf#lQO_PflUT3TPutzS}
ziuPJD+QQIBR*XC=Xtc(0rWF5hkEtRL{z{FY3I4Xh`gH?*PpZb`uRA&VHbGPPaAMJe
ziFm?oSqwusZt><!@fU)|QD1|9*c7Qe3XQ_uFK8@b2q6><9c%v+X?^SW*H0Su=lu1b
zag?4y$rN~9jlfEjL5{9=j%9~+PW?_;lBsWF1sS(x6y)gQo+<iS;h&=(!b23x^Vh;R
z)-U+4ujK_@y`!cXb!cKo?CO4|qz2^Z!Ysj2s7560yv{w8>f!gWJk(#55}`QYr)#yc
zdwU^#RjyWqKDq#mq1AZez?OL*zAeF4mhAU!G;$v0rE(sH+vPkKJc2xOD37WdIS*^_
z-^ruQK@;F=<+q*R!uRTG#ftD1$m1zIsdf<YUabtW5Sd*q?-@p}hcAzYhHX+Fsj0v4
z<pD(|DG#VC4dy{sd1U!O`tM}-XOZxswER?gJ(`ovtDS0r2VAnm1hJ4k4M$>FW<8cE
zhOx&49&pNJ9)7`7611{eb|$nGvw;*fRn1jr(CBR5WpDu{f~`?j9U3p+%eAMHDP|mD
z;$X?;rKjqtGw`O%fRYQh&l3~iLY6uvn_Ig!lQp8;1&>m>PszQM&HdpI@Joeat7@9h
zP=BG?YA1@d21n_r-{gC#|H%$C7^PC&2(kl(Rx8s0?p0L<v~J~k^f?6nsZ%pWr40bg
zo+nOV$8wbDikg~CF4;!?kv)$c6DQ<o&@1KTEdXjZr|-$ppmPEOqG|0!w}Y)D_(lwC
zrK7C4v6#w(wys{_(N|gGFWEZrmr{|iIz%zY1Ri~t#ohzQ<2|`pJhb6QwA4{uce;)W
z=Jl)xEwu!NYC@@G>0W9n!FNo&k|oE>@P*fMt%hk7lJ>d=4u;Qmws$yekVj&9#e(TU
zA^g4<p4E*TH%=G--Ifd}VP%_UT^=UZAeuyt7<T!YGpm>ofH*69C38de=XS)!)C$=q
zgV73K-0)8oW;GfNt6=xo*M|@xXKj*Ne70I8mzvFcIZ=9qZ87>>i5e==2THPVVIiC&
z*Dif5@d(NRjHI}J!DxX6Er8}dK3sr_1rra$_pdNvBVSurTjMA#DK06^wHaNA5vf$E
zRjA+q9GC~gyEb5FvoRZIV|1ZZgy5N?;hFGXD}IeLa*)!>`5*^5t(*@tSu93_-e9x@
zhlGX%$DjA>2(3_E&<gUarbjFEXa)J@gHJ;x);i$BIO>XXZM+Mr*_?{!9$U+;eN4K_
z{sZ@iY=xt^4!^1qf!?AIjhC(@s7ynCW0?{k1^CoFKG2Sr_FwX;+)-8yP6mKd4e!eM
zE5XdW8mif5Eb<0C3fhRNlnT#)OZao3mw6PEAA9Vv-%eI|jzUQL)KNitm9B>T@|5)I
z6<@!Sot-Vb^7R!D{^1XQ_~V1}t8_Kwmp?+&fAFu$QC(I_bto;Xu0^HlYNg6>IcBPb
z!b3Zj0k=n?QVX%NR-AOUT7pdQKo7v1f)F7G?)k9<T+K#GCcz{HFqsM%&j5^50FxBP
z1z8aqK~m!;`waPCX_ac`gHWvm9|+h*!GLN=kU^CgQ=FJS{lti{Q8Y9xSu!$!nBvOZ
z+$$;75Man);`Z&EC*CC9Bqh86TymX!fGUx|ggS8oq9dv$0HM#AbtqU25>VnVcuA%>
z|7KVmoj(2O$gtSFIXwJguvqZTHw#9D#XRi2HgK0;{yzf?qA)b}XyrIaX{0gA5Hhu=
z8+Nd3IBW87x<l(LqC26$CbIOvnh^8^91WFZ0FavlI;!AQF#q8-J%|y5cr;CG7~&G(
z&*D39iHYY$UjiudSuFAL9)?z6q<bBSI{8;%I>O5aM-j1ya$wO8Gf1i(G>XJ-aS2b=
z%z;x<5dUR@f{Mu!?*#$f!&^{Dj^xCEeJ)736d@lemp(WS&{4TsOE{?zk}a>+$K{!U
zI?O;FvQP)o7nuPXk|2$ZT1UynzLBfILvJhRyi)>d+TH!rZh=72{h;*S-F;8@Q~rC@
zUf`c+KhNQxWxvS5)z5PH=WwN#fc35=lL=~Sl=VX^E(4^eZ(IH}_{fG<3jD+Dxg4CH
zr4z1x#$L>k>s;cfmFhggw^V0nh2$Xo@6b~M0mfpmP^ilhzX34eyfo6SJjSj9{FVbl
z9tMV71^8XXxa1@jD9uW+1*32JlfH&sC&8$&suEnCaxiuz4jP#m4!_Q|>97;0#3Eu)
z={Qm3;D`-hcKzTrWB(l*y%^Rpi=$c1wm05*V_VJm@h4AKq$HFHhJ=)gGU+Y}cZ!6h
ziZbCj^J}kftzl78k|<WQ^>x93=Lr)}o}8GHP*NcnQYuQMJEW-qnoxOatPRK_D?40d
zU8N^Z953x+#>5E|CL|hLTZ4j3T^%OD(9vZw(H%nOngs<;W)wDVe4>eUl_5kxSr;=U
zju#Ag-i5bXyYM>hOeWtQUQYr`k>DXgMuG;}PU2$7HGl%<4*((pFm{~;4+$D}{oplA
zf`MfK@wBW6V~Bq<xLR~O^g8}W<s|nrMUt3}e!d$0OpzoINjoxv1zxOoBVd6<l^&r_
zvoG3@&uK2%aWDP@-K0f8u1j>wi<jzz2pDlu?MDE8_Qk**VHpb8q1W*jO(V_MO99uL
zK!3>YYAN8l6!d2dpho`{#7qVYt6I9Rsi|#hYsMnNQR65+T~vIgn54IYl7<AI9m<Iw
z1kd3ZL{zSRmjbb?v`USdv-6_YjeRd?S8%Yk%vKQBnQpB&J@orWmoHT8-N2U4=->VE
zi#ac>7yP+t{JDY5YB%f|n6l)dKm6>LO!krXmPej=VCm&---eO$<Ualjlmm<}eR)VR
zcNzQm8`q4RusyMJk1iV_XZEFb*&Nr_xBg=P%SV~wQte02+n)Jgx0tz1K>Nv(4&(ss
z2ZIzQ1-LIQEh)@9g%zEn)KS;iP*-0^Qd0pDhd>>&Lq*tgqlFA1SJfJ|ryrbCcRxit
z=Xj+s2FOqU#M`w57>!uW;@)U9sCktsDA<B<ixJ_WVWA}7{c$<UqhbttFB!d;jNTiA
z-W!7s2pOsOhV+!$2iu$rJ0-^t|9|Km6nG)HhJZ%x15FM{{Dn{$(&BS3N|@>AF#bKh
z)P?&O!v!mU+JU8kdc=cz_;$D&HG?faNkgzlu5)1huNn|}=(n&xXMuzL7&n!_f^Ez4
zelM<t;`CE2C)3-@pSkb8OzuklzWdJLPJlY(=O=8HEG`p7deTziDdpsc0}BhG1*|A6
z418EngPT$8s6);w4t`9T+F}gQTd;%h-OGI#5-;!jX<r%=kNAo49JD8?YVcj}C_0{>
z4`%!(yF$w#UnUns3&fkepLk2e<K9m)*#_*X<PXb(IGvjUcV{7-M)q+}e(tY@J-4F)
z!STR!K519<F{lh+Rl~3rNr;I7uXy6%LkaGofYmg>YC2%$^TVTug)Pm3WNodZDwP$S
zDJj~dLzRH<Zl#tPu$Q7YXo}@+i~Ti(>CZ}N06b0i{(9nDvGn7mOW{!4HY^!~7a?B*
z*kQJwyKDA5+z)Mv;+>n`c_&l6)25>qRkzgFHk{O<MIbs#cOTPHlY*kdLc%8wc`8Gh
zcCbs(sw>c{b30ghWdJ}^wH2l^scHFV3emWNO%Uy)alBdqLwf`&HV2%0TiVPhxZ`Yz
zzn$ofg%l7+ZY$)bpGd1~8_7Bkumjv2R?Efkk4TN?mX45DNFIDA%bkY~yo=m=qWxsj
zcbL=6gEooOm6{EuIfwqrBp7h-FjKVzhSvHf0HWn26hi<A1h5-mpgqhKB!MF)ED`{T
zo_OA`GE^Q1RE`5Gb%4s_pdXJj?($h2MUaP2JSEzRJ_nmX?pN8wo|G1pw6X%>=T$f>
zdAd}nsQ>v{pakVOATz_ffr-OWg#&-p)ipJsq%ct?Zx=8Yg2{4uHN+y2wb2AqRRf+u
zi0E-6{2_#t*oY(GnnLMzBbX%Qv0mmCAxX0%LZF+6AS&C$VIIK~NTJ+rC7Ykcs20>S
zP}=~WVxE!eO*goszQd)2pY#^hnI6*>m;jWL=jYZmBkp!hI=-4q_f41(rSEoI4_MvZ
z`q2~i?JKS64NtFG|ML2p^o)pJT)ez~)Z*pKt=<C%@IC6l!4fY&VPDT&waNjP95B`o
zM=blJIK^j7{r>yBvuba{<ObCnZ+wwIIWGT;qv7e-tz3Csx}x%EWqA6^mFeO1Lqq--
zZ}8twWeetGI7zJ`(98A4H~sk@<C`w2wQ^@Dq()N1HB#fzY;#NHu|0c^RkrMDIkx9m
zpFTJX%1Mukzc;?RHFxW)xv#ztm+D&~41IzgL(?c&-}l3wUX4}LyXTnnmHX^GC^S97
zJu83n&*pB)6d&b+bLR4#F*far8<uX|xTDa?oP}QLykq0ir8iuW7Hi^7v1xo-tP!-5
zH%+;6>5&~9cT~brwYU4o#-&%r@lzC6F5SpxVSXj_fDjv~fmv2U9ekCQN$67rTXHB;
z0DqtnQdI^CB@}^aHb%H+APb~eh}8*cD{zBh^#RmDqq7lg5!eIKwp|Sb@&Y}wO(O6J
zPasrND&1@rW?|YK1_lRXD#l!F3BZ9rlgVfd4i18qIz(&1*y%&WW;GcD@Uw~L>;NMe
zPyc+m@|dGtC-FUp@%>BDCI@j_RhWTzwN}t<WM22RUTE(qm*NSi<p+Z1PL_VVHyw%<
z5N*R-LIEjZT_tF0044`<TUD53ye_!82}T1fwC(jjktjRa&&8u;vNiVG&lxCa*}2jM
z)vRe#rp=lyz+t%8d#(!XQ9Hvz>TCXI5B_W(`<lbH!Rx*A&LP!#6cW@&hgQk}2|3kD
zu9%>zu5YZbt`rQkl{{BFK~;{9Eid)$g-3)8=1^HE;BSiNTDO;NlpwPe25nn2#g&4_
zd;2(c=Qx54TZ>pT>7<mjRbqc*b|=XA!3qYrEJ5%;ksxzFAoCC)^AI5OAn4$OSVw`i
zOMgwB!kFHMiUat|FRyiSUPMW)ZaV$#x8LsG{oR4;TKeUOni8Oyy9JA$RT+(qH5HYm
z1qB6p$B*pI&CT8Q^}8E)!THACeFqvEpqkRy+*}D2l!CkhiaIXXC+311nvjMlb>X2C
z5)pBAdT4+B;oNZ(QcZpB`Or<s$QVC1p*wKev}u>61eI*xzP*?d*>aiLY|-{MwY0al
zomIvlR`j@02@xEE8~5{^)fyWcV?KP?9W!z4n9(VL-bMt2n-~p!pNe91co}r9$eT&E
z7&>w0nd3()#Tbh9diwO~ywmzd#OB-I$0sjbxG;ed&5UM<zv@;7h6Y;$w2CGK>#K#R
znISZQLJaEeK6|#Y_p-}$ou!W2y2c)D)Mb(`KR~C|AuP5oKpRRfLUeku6;W9Gd9_E6
zfT@Xzi76Ob_#rghM8a;91U!V%?&<IE>jST~w+|@TRO~2i0!y&7n;~{D*4G0AXZsj9
zragWA-2=iD8nqTnE%`91s%mY3W=dCgdrNmquR_P1jn%~FtgWjou5ZK-4SCI{OG-*=
zSUh^E8$nE)9po{ix}HLt_AA_42FoGuKsicByy3dK9w*3!M&aphtCJ;mw2F+zY#D>u
z^4uztT+d)0QG;qZsvWsD6=^}MnN}msHTXq?DA?PYCc2v_Y=~klq7krF+!ef?+vXLZ
zJo*?NFxrO_9ftK|STrJ=GRjEOv&N#)5@a!1;{Ep$zEVy84}0GoA7z#Gf1hW1Cdo|N
zq{9FKLg<J{QB0w@7I3lcx^~y~b#>RaDz0rx5Eoh7tLs_;m&LkD5e1}4?;s_lXVN?A
zZIaCM`<{De(#Qn&-S_kR<M;W^lRVFqd+t5=oO91T=iC-M5EI@J$SN&|ckPw|Z<pMJ
z3AzdDMr_)ysa4-&mlqA@13r!Nm|gOGZ<pkS%WVRIlwM@gwY);e2NkkQS|AbxOw3l_
zXQ9m~#yJz1Tnn0b<Gt9ngL)>QgY~%7LxDgc`C0izaGdbU&dDz<D=FTs)yW<in`_Z*
zD=Z38V~-Tom@}D4pu!Vx1g}`};r4PCJ@0o*mo9x^UbIs+IX5$rpD^_F8$spUKR|^1
zgB=wtdj11XI}veC#?-QDC+zI@H&QTpcZK#(ixG_3_?malhWyu!B~Bb&q&hO~#5$t#
z8*<zYPo@&h*(=&77sa!ZO@AfghZL0;<-@<ltE{xBAUij2x3<HBGhLY*{R(2^QkNUy
z#mLZLb2tf}B_h-m5Ex{=IFX>va8PFgsFMQf42NDB&Lk6d4eg-|$Rh{$AxdFc;cieQ
zz)KOG%EK_ug7jpgz)C@Sr(s1osPe!(X_|zQKMlwLA|$iFN-523(Auj|`${+^7_akF
zbz=Ly(%u9o$HiOog6x9bsCIz2+8y0EAhb`NO#vqBfS*O3qfzInsPmPmb2RE4&9Lj4
z8j_&GU=P*72!Ambei7me*}Ls3I6H2;O6O5A_G)nX_77Kp^*g}&`CxrICLEn|t_Xhm
z>EF(aVih|$+qYLNqv|%NID>;^^!A_(WeWq;!EWH}m*a??OKnnQBn=*;*78agkFG)W
z<PGr*XZ}bDdx1q^3H&~I`DMVu-HFzs>cHkfMr=_NZZTtfl@N=y?+?7?jX~{3F*O^*
zRQQ+iFR?J<pewJeEbn|_X+d^&L1`hBS$d$`twq~W;7q$EtutNq)6-A?giTO&x?2{@
z^5R=`&h)@nUU~Xyc6M}9&gio_NzQb3RT{NGtWf?z*YIxa(@)2~+kjNhKksm`=i?p4
z@y{1KoT9km?Cj#of}Fy#vcjAKUYu6zMw6G^ilkNCPBc}#!U6)qqD{sSizUQpg5paL
z?4Rlqb;>CyD=b4HD5^M{7eZA*ji8d57IiXw*~T`owl6oVn3~K!m8Px$wxct0CXAkt
zlR--6X=l3bp`aC|D}o*>oyS%vdvPkyUPh^?DyR|0Wf(@XM4d_tvkS68LJ%^qj2A~$
zL5(l~1O4x<Q$$FBDIg@mWC_v*S$LiLr{Z-Q<>k{P@M#qIGzxse-a$o0*%cMpWv<*J
z1aXS6ppyoiw7f=~Ng>mxXJqVLv}os~BqT|iRKx<1gt$aCqMA9?Uwvh>C8psB6E#az
z#;Cv2I<z>`YYe0>S($*;#4V~BXBNuL&o9f&EX#J4<RfsF&vqgSF@dVZIR$GpIM|}s
zTLR4C!Qp0XJ2`A%64A0~-zyqJ(W7N~PhP_KB|;b~h~I9+;q365Wb`H9VB4-0s@mx2
z+Ly&o3c_!Y1}j2!c99o(`84KFvkm%t`P|De<hXM3h)B8H4T#rc+=~Wa3@6#i?v?Uu
zY~@PB4Q#{ySs1Q(iWwedkEYy_c^A9m4&5qt@BFP;dy%X>WiynzN{gw|CHo8*tiX6)
zH|t=A2y;Xj)iXSy&$pasWdG5Om{1hv9go5I4w^Q-bY6_M>w56<VzW}`!$s%Cq!$mJ
z7l(a19|k&a`3XJW^ecNfXnS$lg@w7$6b0KQO{X0j=YSSFcC5s*gf~}8H*B!0W`Pn+
zuC2WTw8t`KyDB!8-C<X)x)&39)LXaCpTE_qD<~*|$}8L_b!zO$p_}PUrf{>x9FoxU
zjo=K<=i!{OfC|_E3;#4*U?3GVU<;<#+jTx7;8ZsG1{MY-ha+x#2!XxR<W;N`VN^Oj
z$VUtf7X2&jioJ&xzApp@#0QcMib(mV1x^dsz)9El(t-|#Q{528k+7*i4j8sC+oae#
zfQ3!9s+8kl>!F0Mjdj9tYwx8*&o{kzBtqVk2IWb1{<*viSH@<WwzCtG1@mEnG($>f
zmD1zVle7{I%)lM-u}ZrtFek@gmkdu}i(V(fR@^>;P>~5R1`sJ}w4rqhmJL<fG><=?
z#?m0cOKrNcqUz!*SJhFQR-*wi+)QT)jSY)2$Bgg!rbl|Lz?5cq^rsliL*2RTb1sa$
zZzIX=<m1}3c4#Gzchs#|v2x`K7%cXH#cb2nKmK_2oc;UfID7e>ifs#CW-YcfmX2pS
zHi1A3yLZ+6ADFJXtl9<p_5jJThFYjD))H&R2>qCzZ+dWx0&Z~waHBy}87H1Wcen_*
zPKKEX2)as>C%>%n;<SkoK7<#x&V2p#ms1D@P&C~h0O9^&{`?<S0UM_-hYwW}E*eZ@
zKvp^<x>49iz{UFw$Az@cFi2J$h&h<napj!P%Pz>w%l;nXt&wyR^Qaj=-tYnW_}^>6
z6Y2QhaSEP6b5?Wm3W=SX$)wYl;cPi=^rG6O(Tg5bz0O{5fbvn-vMJv(gR2xiKw(93
z*<t9KPNhR(au>pc5z%3mkf<=rxIW+hEc|j@KKyKYoGKt=UsjBHY=W>1z;9S>?Us>^
z4O`LeTz0w-ek5JjpQ0A>Di*^)L;CQu;q+HE#u`y&Xh<J^eZIBPo|#6_&j3Cep%)BR
zjD>44iA0St78)D0!#_g65KTaO^8@M%;4axEg}$TR0N?yTv?}Tur$Zj5As^})7g(hb
zGtUQBl!`)sWNF%ik*5b+-5_JK;E|g>2<*T|v>WooJZ4igwIlpS|MW0L%>MP`FFgM1
z*%1fUz2SUg-2n_hetMvK_U(_o@YwCMs}FqoI^WU{mYNPGEy7d?(n&H$)nVAX_i(Fm
z!qqb;7+(&!inWwryUKvL30K*JQ8bJ^6^iTzIzY=F1U?c57=t8yycK-SQccA=so-iB
zKI`^JpL_1PM{l1M?tB-4WaiL6b?229R=w|&SG~I`=wJP0Ulp@ldFNADd+Lor#Dh8%
z{hk8q#DhBVwBI5&Amp78>PVHB(*rnF)M6w>wqsmY-;Gf)AgOdSCz0Kw&=LzzWcd{@
zyzs({SCmH{24c>`P8*Y#VMAk+)9E-8T|NUpzA&Ra`Ur}D6=0^2x?GAB<kp3ZhC@Gh
zbWeJG8XZ=fO>u<m+OW}AInx6;LAu1?ipP#k7WF8eI3}rv{E<t#jC#_1FB)Azd<mDt
z(tBP)QhrVv8l^#i9RIzu#%(OpxeUh;&@G*A{9`oU(Oj~@A;Kt~mTp~i3!+;mZvG(*
zlq8sLMRdD@Zb`WLhnPW0y6L8;TPWQK)<1-Xl6dIG-<j!M@sJQaiJH<$bhFZ}c}NIe
zRi3?z5?@9)%a9NWl!RBmgWko_ZRj#aQ<8AHRnje%Zl$>SulY<$GMsL0bgQS^QQZ7P
z@T&5Hc2eSzbj#@jLDJS=N&vA8iCQQnhi-H(6OuQ$j7+A4yxvFXT?pM8aPyDTL`rgj
zZoC3q$eM<P;QZr~!O@yRuq0&u%ix&DQ@RSe@sC4ugLB+OiF4`3IX)KeE>Q+GAXZ2>
zUItamKLi(wVU)O>Zd_ze4GF=MaEJ_oXs6rIEs$Cpi=i8D;GAkynt!auP~z!ydxvhk
z8Pd%^1Q)2;l=vgMaqiR2KLjr$nG*kvZYsL{j53G;Kf4SrCDcf<^)hZ;r%<Evj}<4*
zI7<9A-T24AAtAWvxhXNVI~-brn=&K>SAq4E?kwF#(5+xdhzXP=k#6Vd)}tZ(*F&as
zT>cKxI}&uRvHe4EtT@jPP+~6pL$@f-^I4Rbm!YF~L$`BIE6x<EuW0Npyz`G0FN1S%
z4?&El8)@uIKn%cYXb9pj8%4Lb=*DS4#P(kXr>=$)e@wTzbR#wAA7Tb2xsq<Yo%0@a
z=$dnp;+lO6fpIlAv?Ou{aBce|L2xxp0_-2Fe;;B2<;+{f8hXbwAnEj9Mk}QoLAOun
z#+4CO-#-KwTi#al34(uY^g^g%$I$H5KJ!z_fVRS2iGXq4z$W5-5jJ>siylgA?M<(>
zVn=T)naJ=}&`uF4k+6?J1wMh@xM%zNHNQ}lZY-dhI27f9ef51%zTQv=n^Xf!4W2)K
z=K4Cuxr~Z+!EY6IK#jLP6sJtKs_`%4l($)>@Gz#9_2e*+x$ZOc(+3**Fd|hK+4|vO
zWckJnu=m4eA8>02+WcW!_tDD-+WnRYVL8K)?q~a}zPhnle~|;AGPW$<(9a7<ALs?B
z6sh|nM<5P6q+>iBQ}?M9;mDv|U`_vUH{1c-S8|xV{t4qw0(=Bjo32}W8E$|UP6D|I
zm`A1~_kg^E{x(T}F7W2vmkaSETD4v-Oz6Xf3E<p~Rw)7}ngF|jY(TgIe*<};mOUQ%
zB4#kv@re_U|J}kV{{r{7SWS=XQ{z-6o<E=XZlselfrXR%^#VCy;f!1`rxSDdiIHA1
z^*UmzncKF_yqFnBr%ylHj~R%R<8L5G)Ywzfa}i5$dWkISg$L^2K~oXzzu~3%ZAVb+
z2rfuysg-CV=#p`-{u%8EDXAS5Ueu1L?UCiG?dRV>b-;2>R-Pqhb3H=cu21v)yXi0X
zpGH!?yfZjU@3>W#HK2q+Y-uEwoV^J3%B>&U+i!ZpsK1<}hehgICsFAF8*O8}x838#
z$uB>~fc6?}`JrVa!3nez+^Yuiqkm1fEqN7H`(?WEk96}<_hM@4DO~{F$R-w^hk8f|
zZbp(3!b<4IO_ZT~X3hfMGgFTt%4i?544%D*5_2$K4|D`W)B|eY#t3m?v~syRIV1#U
z0xzhIz`!Jtfqz=@?D_2sCFV8>=`jBg36zc#tb^YDFL;|5OCyXz60Z|f09T;RL(2%7
zxsA=ITPEEm(#_ZN`FhL#QpH_AVi=Bz#Eq-%QoQqDZ*J!BdLJPOZvPBzg>p15P~v*J
z@gkdsEQ9lpTRs22w~1!tZR$Q7X7HMWw%$r}tLHNMNc8hxb1rz%l&+X={NvEn{r}$P
z|2y91apE~wMPw@bmlCctxu9qCNJ-w15L}bYq{P&hi568iBm@^iE`QY1h)CSfEsAH)
zwb}uK2&5ae0RQ#ix?~omJ483`c?{jor&2oJbh)=lRk(zo&CB?Yz0D33<i8%gs$8$V
zO$c!sp!*#Hf)iFni9e<r{}?eO#J}%t@=9}DICUwY#CvJ~_29iZ*NL3xlL&&8uYZXD
zYu@Ha!sQ=yOQM^0NUS(HsR=O`-S|gpE>sUStja;W&EZ~evmV~&2-vU<m-IG~E2Co&
z^0?nfpLpkU2_JPxC|@tq-~Qumx38bWRlcuRu%bTKSj9XiE9~VtR$BF|#?+kt11HP-
z4xEsqIdJSmH+%Mh12iLJ$UzhX61Xovdh~L?gDJYNF%`MBH6UQ{Q58dr(b%$K@!}2M
z3@#d7S>AVag?!Bc11#{R`NZ=6)w4_O`hG(%YH}+Ffc9GD7hBn!%6@&3nV|C3keiwC
zMQB$?41O~1H}XpI@h7<TSc`{ovTntxA?MLsL3}~$^)QkL{}_WrPVPbuNn{Oqk^Ts*
zn!SDd?7?ZPA%D>yUAgP{D#j8`e5k6s3s}+kqDpdV$OmMeWlULS@}cQN+xb6*<E_oF
zcLKHi|Gh<@V(OL4i|uoy;RgEP-sQy}8KoCd5SW?+be~^tptE9reMKE)f8g#wHaP?v
zW8k2@I&tEkfrW@qtLah5RCtiK9UL}{6^qo3^f2(V`s7+1(~eIC*oCYY)_^wG|J=WJ
zoDjIoCS_pY|G((XBt~Zj0#MIN#KVL~-?GUY@vdNJbVT7EN@hUo_0maJ;m~S)rNb%D
z{UPa$#9qiI_9-O`Wuxg~W+Uhk#Ioq2uxLE`mg<A$5kpMet)ygy>;OF?*fe_Rv0KkF
z2Mfjf!5}G=Nmw1Cv^0|*537LeU|Z-@B)fY^*iJ#xbId`hCu0&c9vZewJSJWO_B%>e
zjw4R-xPtvr0P#<leK#a*H%_4eP#s%KkIC#MdZ@5>6n_x;{MWaMt)pZeINKDDIczCC
zf^hme9^EVk5C5>8>`h8m&fcZR9QG7FG~z@^iCs4&Y(D#MN}Y#!V|Ywq&(UKX3#Laj
zR_gVZd$CL=u>$-q(J`2d=*@MI$+rnGoCVP%fGxyhD7@EGvL;OK!DFJ}QxFs{K51C0
z7j_!j;WV^|X^_fk=!2#~J}h~;IoR$lGcym{obat&^RbfPe3sJ^7ZVd56J?2rh{Ud#
zi6dg8qM~AOPN>sz)m%9Plb6bBYn8y!*Is+ARm%VNtB=~9mIdxnccso-v}DO|o_Xe(
zUrse+lfuZWAA8hk`C)G<_9ZMV#C|q8$FQv8SY{SBV{|($kqN^`)OHV_JUIkQFm%BY
zBSwrEmoUZZw3L)!nJ!*fxLj6*MQ4S@INh|e+-bQ`U)NCA*wozIgryKg6&D&B8tR%F
z>YSD<uevIQURPdu`K&oO+x5yhsdyzjEv4n<B^8y`wYAkJPo6xLO?z196y%kA=Zw(4
zGQ^L*J6TEH;KQGAy1P@Z#$mb1%I}?07dY~@o&DK~vq>B67;S?%uD4@6g>%JsqIMuC
z>)oA($=y{v8>y<?sj99)Mk&hg*#}O!>jKY9`g6KdWePxUQh2FTr7|HuX)<jZKz#nC
zm9aa3*OSO`u@%v0@G3fr$9^gNOM!8$rK1Tg6bzOlf7tmW_7mQ_ZPTWmJAc5!m9yE|
zr;cNF3n~)T*jQg%Q-9$?qoP({sIIRs&dNA>G9#~;joH;S?~!|M8z&dwP~7ZRO;nT>
zuL;AdcghJj-+Xg|?82^{E?}-XRi~~!^kFKtdc_s|&elAf_EDLamwoc6>%{x1%JXa$
zTcv;WhVh-9o#StKG?}e(rm&ODp}y`HzxV~t)O-UIjkEdnEqg<M&*H^T(d)Sswwj&P
zKJ*JLDEY-h^Kd%ndVc-IMzq$PEelJ&5nDH5`VVuM?o1hticfpsfg55~!(ug3it?=T
ztp4L2x%f7B$Hx@U9fUqa8@i%utI8p=r59RSs;X)$Dr&HecXgB7-P9Nr7#JLaH38;8
z9NR)$PnFfSbal1Vma#EwKK|hS_uqf-lhvPp{`s19U#wY!4I)1L@S|0$4<FpIW5>b6
zN3d(_5pXSG>{x3|Y$Sv?+Jc>%jN>OwnlOIc=rQBQVYl734oraVXlt$zk`e&E`p%=*
zgRgok(8Dw+oAd*uWx9P?igKGW9@8H`hDw0;j-^J7X9SzzZN>k24znTiGa*|GAzMCM
zG<wI*T_iz!_UzcPd-o5UH*em$eLwc;+`AiSJ!_9@$HoAi?k>#X>INOF8n9JBR|mFA
z?Qq6?vgU+DR-dY~vm$H9+i$<Ur!;VO+TyVp?5sU1cS>mfvBLZ_Cr|GC=Rf~>vMF-j
zym_XQU7ziA#@uz+WE@_ISAKro@U({>dMJ5#02EPn2urbR%eHP__0jjMQn6+GEy^wG
zzu**~w-<utcPcaabqzKwe^&bRoHM4Sxv7D+-KuYCX>4qR)!ETX=QGtcvTA#j9_#rv
zV$cld8(U0R;jh+V-MG#fV+=6pz#6UAXbd+Sai)4eAXXTvHF_4w;S2@=mw;Ea1v|M%
zhg(cK!NmknFx9HYt`;f;$FcK^m7na3^{;4|G+u?59K8L9@3(K?x^LeOP;>KlTR}&Y
zUW?@*F%h)U09N~8>$#X|m+8(P_zAD9tlG|~<mBYAy2J0k`SQOMP%q$jp;LbQ%)Jjh
z_T-Z<rLvFc(mlC&Jm$_#yDJrQ)!t{zoGhleIP?lQL04UM|NS?O^nilW$eEz#gHu7r
zWaW0t@>kca{mYs&)zw>;FJJ!U!D4KC-j;FTy=3JPr>V8A6YHlgTxbE^y1P26O;|sr
zbd^=pP7t1McRLUa3<}0_3cLaXB^{2^Q3nyR!a_|%CnRrc<zmqVEuB|h)!5jG#?{a+
z=tLu#X`mCWCrJ==3c=oZ;?<+XOgnb(g{bY{zIpTR-8=T|*$GOS^?I#J)?z1$h?p2P
z4on6npJa?(oHjeKbPr@~M^;5=CkdTNI<W?%V!xwvk+9*t?yhN|&-leyBE$)1c<IR}
zAA8{5XMQ^+6tuc4BpU<@7@iCQr46sk&qsZ*$MWR6Kr1@Z>JiI(2Qu0~q2hyIf?8Xu
ztIw?Y%i1-sE_a$+8tdqEs@CrA#>STV`sQjg7Mpc@+}JFlx~!}V+5;#W^>iYFDlh;P
zGMdAUwEYwgdo~1cVzoC^*HnN)RpnSDo7;u9)a7n%!{P{`^KS#S-Uqc-f?D%Ht%t4B
z2<t#<d5PEC1uVuw(&uni-AnwkDbMhQ!q4HmrPvtv1qj{6<ehFENZx^;A>W=3oL2Rs
zyzc!smtbT0E0t(ZHC;-$GKHTCwuDYq<Ja%7>HKI<d$fNBB}1qAWl=yci+&atQ?RH0
zH>#!BaP1oQ8Qa0~G4mD|E5!T1VjIJS?314BGj^PHMf+!aGSuvlj34qxr_~%3U@#c;
zAyH9SjBGTT21<$6I#5amerD`4YkUkAQ$~##o|u?u9X-x!jip!IFq|ysPn;&$r?&eO
zC%-><<;=I^rO(44KLMKJS+aQSXiHdahi8hNJ%>lN9fKiuh%cMeYwMWMdthx_kFDeD
zy`&0sbIHnW_(vb6JdBLcmw$}^0=x9*KRZQ#hNWG2M?IP}b*dL9vY?FKTxo{1k$e}`
z85x_J+N8M_r%lyp#7XUTOr3x=9|8;NJU;00y<&oWZpU;yn<}&so}iu08#2$9K6&oz
z&C}F3&xyTxCil;idSCKo`}&mJ1T${NP7yY&?B>VGPv8i``ql~O!A&lzXytx$(25*R
ziX6uJatIVT)cuScWRU|^3QmNm5OAQ%;6WAf;s9;Rtq?tUh>a8R&#e#%8CaNPd{06L
z7XlJvg@|OTlX98V7%0sX_!F$&DpoQPtk;5(A__nNP+&AG;ugzp7H3~3Y0gV6^lcSZ
z!wV0_S2m5x_bnUnD0^}d%9g&1qmluOlB>FWCHpAXS8fIE>p1NvicrGWY!p?uS@?2g
ztj1Sszwpvd4u741e*^2V0PkUY=%HmvK6rnadv+4$QT2rRd6_Vm_7LWVBp>EJ={BOy
zz0z%tM`QC!cl*^W&(5V=wdNlz3U5ia#|L4nU?JPT3Sc+ktxvZ7)@96DUKc&G1NJ+S
z6&@O7gGVT`7$Aig(K24Z6FPt(RPZ1)@E{ZhNYFqo0vxosI*(}ak0_!=PzTW>;3gj}
z{9<nTj$?i`YofANi-$o(iS*=(_isNJVIJb*@Z$s*H;RDL1;ztPE($1J0zP01hgU?H
z;h6B;TSfH5Lv*+Vyd>af2>1;G-Xq{!d*S^_5x_yY85f9h8-j^)o<l^r)~HKTPA@3e
zgaed7xjZ(B9_=FV63Av;67x<0?-B5s0=`AS8wQ7`xop&L@b;$&_#^?phv2dK4I!cK
zh3;E#gSA)Z02uX7%A|VloP>JA-8*8Z`PGts2CCji>o91Y0a~ML6QEf*VtIhadG$Cb
z7L-$!5anPS_R(47b<wy;U!8+?in15F0W0D98`Ddk(*!Cn=_%RQc1h#+wp~E%LEE*=
zMJrvn0I@(!>Pxptf4jqp8O!N5mFFwO1W^gR#qPvQ@OEDMCFG~$6E1(Vg!~k<M~Hx0
zmQRmXtSh}l%L6#-GK<Sk@gqb9Z9bQuVLmGOZFy~<@{(_4JTSRc1Sa(&FzKeiWG@eV
zzH4790vsjZIGU)qbp(~H&!Upu(Y}&>H0-bcv|(u6Uj0`(0bvHA|2Ax57Q7|>7f^%d
zEA-!le1vCzhW?8aTA&5lfo>;|6&@u*3zQ*?OSR%i0beiR4-5E80iW|T;KKwwRR;xA
zRq&u{;6YWm1T6s$T29C%T5hrsEo)X2E%Qr!wCvlC`f?$xj6?GNbJIKy`96pI&Ijq2
z|G@(1R)KSXz`07`T+)j(*^L9^_&5q2vW-@Ni04kK<2NjU9*XEajckms#(qnWt>n@-
zT7<TDivYEjLfhEZnS$FxOJ6`G)qD5>qS(%9RBzQ$s&{9ouik@8UjQvG^|oN_0(U^P
zVAalhfPiSjs*ONGwBgP&AaZdV_E~`jpC)u2;&qAS!S-b3d7G$BJ`cBJ({mdI+%KUA
z)FO|OB4EE?<j^Ss_Hn)N{^Y=Ti0EP6NAx(%>CwD}=n;DN(DX2>(N%frVWq;kMpGRo
z1Oz>r2?;@uP(q}a9)n8;B__!jCTen;-ApVU#mw|*!0LQ2B@EWym{=c)Mn6C~Se(*u
zUYXN36LUwIsWNo|sLUnkD1XIyQNxZ=d0&b#8d=DAFj4gq@GSzqO~9`c@QQ#p_QLz)
z1BwS9YK{>fzC2B+%ejPl@H8JE{I-anS#n?ae*JOt#h5z;-hsV%_l4H=?ajLdba}se
z>jXRo4t#X;SMLs9?@_$oZ}55t@Oo=|>g^YDBT;NrC{gT<Orlu8--u$`374c;yukS?
zf%9a+tM3KQO&8-l(27v{_&pI`zbBOYJw<f`%l5T-ov+P%t*_&3CFD#ZzwH1CT!84u
ztLV{R(k{xuYd<0KLpcQcatIYU6!qrdqufRKa~n#%5|m?sD4%E-dVy$Hbm7wY3$O7I
zvs394QTjQ;-z04Q8gd>lg}=x_5jlkVa)=Z;l>Cewyfk#NjfBI0K*LCp!~d9uksFDI
z@O?QA!#E9#FHOU6(SweGLkIjDK!KNuhE_2Ica)4_K|_BWj1m3*St`8=(8R$QEphPh
zk%1h%$nyy+=9+Gt81mdmem>b8d^kLxhQmeKfzY!9#~#UkXZw<s$&`b%mk0Y%108Cx
zoN{rq<MaqeIOtNjeDBNUgfAD_mrI+-g(CZx$^}Q#2wdF0Txxu|$Rd}(-dw2P(X)%Z
z0>(3eU*JYmizr%y+HehgoG2QY;-jb$@Dz3GZ<n4?VF=ldj>o3bjAGy6Z35mFWUy=S
zmdsL3IIIC~ma+&tn~S&eL~LyE{91bRJKvjMVQ+qy_2!q>FTcTOKN!UbcR5f4Ydk;;
zk03q`03+OU@yY*4u~xtq3D^z+8!BKMF99nH*kJ;;SinXI*p?nxpM?7&0|qg|C8^eN
z?fxD3A!S@c+z1Z^H_*$^B}>BD+dh2JB^n>odLvW%)lxV^94Q=I3qgeB#cUpb29aYe
zwak!`df^B2Q5sfL=_7Vi>ECkeI4+80p^IG1LFuJ|ekU{KBckqj#3Aw6N1|twgULd6
zu-RTpQ;iAd0C<;uadvreP82vND+^Iij&%yhI`WcOw{fgvIo3rS>uDToa}U;oOI%SM
zjCUcyRa0?rfRNyA+u0PnB?+EnhFLEhtJ@6xTdxEUE^+O`7jPphRR25x@bJ!;3E`jo
zOB|ts)Px2egaRH^JRVf^&{4rUPJyXa#JBBJNNUX7w>M1j@r`y?BCV!_e@=D`+2S^-
z6WZei<PGhHO(v<VO!j+v1TdQ3BaMPmc@=N`<K4hMru3H!x8^)sK%WBn1QK{R7^&s3
zeyu3|KfTsx1Hm=1XXw$+a_C{gfo5Jk*cZN^4W|hBQH;Z961+n|>w2LFwl!aCY5ONh
z`xOmDwUTFuYWf_K_KsK|)duIYM>OpbB6yQ8=IqGglXQtWJ30YdB~o_?Shx6OxCE?Q
zz<NVY%>uSfz-oJ72bXp1AxkQnwDkx=T*!KU5i$|7E>i`BtYc<JBHnssy>IWKhva}v
z7<1^R{9eXpNR%0#i-`<)?xt+;JVu0g`C^^n;~x3GTrrPhr|e+1i)uq5ExeZ~n9Sv-
zZ(RbQ=frqN6@g-|JfcRS1dat)c<Z4o$Qwgvt&$>-K&EXfE9HfSX5Oe$UrC_on!&4e
zl`lyW!W<+CnNLF!pl^2p4*Rw`*hIYX(t_(Sw4#BQW$<p;qbbUL%3Nt7OJRSLZkE19
zWM{Y3fr!sAsrh29dvR=U^bsoE^+!><H@2rFLKFqG&p*fRihM*#&_YQdT8IeS=((UD
z_eYs4nb~Zd9{O~<{1yM6qHIbv*wX8fYM>Pcj?*}B5H*-^IgJR|q&jGT74%sVPD2N_
zqwBAWh!*{7^DWWx@*32J)d5)4=NL*wtkP}msn6hTt4;KtvxJdWBIc#(#k{oko_T3~
z`Pj!7mfCplc|{{pvScZ5(b?3Z+hcq!y01j_#wkl0*x&7<b(D-}8F-t3hO%cL6qslo
z6M|U<-qP^d?Sbf?dRoWewQwUl(5x9*;ZeZ#AcB+?^eLQrH!j_S!?p<6Isuz4V2uLS
za0ytd28y66;6do)L8#+FX!qxw&-U=?!-l^T=f-Cc_4Z9C>IGL2^#bSlsOOLF4Igtz
z9*^5Mn?n|H$hkhq!RuNh@NE(J#tM7`1-_v@_zn&mDtgQqG8=4iB~OhZ92hz_c`XIh
zhoEtV81=eZ%wTkh8H|x)05Gy=24mma_LJ~8skWov<x=*PkncJn-(A=B$hS|@2DH~8
z6pe5V+T!TjQM_obCCSuWpTZ|<u6u!q2q1N-fDAR)A?os@m{A!nW>i*+8I@Wwu9DPm
zMrGfqB=7$*@Wp3ing#4i0juM%$qe&$`_9Mg3r$`<O_t@*u>$&>fKCu4NA<w=rDET<
zTJ+yU#n`Px#jNK@W)gx)X2PfXWX4Cq{(eUh6)Px+O$fK*Z32jyMa7E%TmqpW=oe0C
z^w2NBI=E*iT|tAYHt9PUL5m<aQZ$s_+ayPdm{=M}6HA2__M68fkw>jB505VooyY?d
z$$WVbMF#Q5B%TH91QMVLYX%NP6;lvVMYGUH6%C;Ix(euBUvKJQ|D@iN8$nVZBS;}5
zXb9P9A~>6D6p&rQ{OT44R96qIKMv}+{iJaF$;9oa4sJh5m$09HUa5n(`o_U9_6Ur-
zdoUgxwo|}%_N%Q%z&7{5`m3#n*LDW4Z8NW}G{9Q)K@PMIJSR!gXXJRf`Yv%*Dj=?Q
zQ1{-CKYgQKG!KOH=a(E~-XghyyjkFkBeuNU^;dGkdsOlSUUEY+d!0%SZ=#Z$LVP8Y
zXVAB83(ueua=eseqnq0S@Spi74^CJ?1Gxgio$f7raCnywe!74!7VugDKe-P)*_VBN
zQJ~1fEiT#%5!g>BOG3)wy}9-$;Lff<;XdqrobFFI4d$By_e?%PUQ(kp2Ynt%<AW6Q
zsrTYOICPhQHVJ4@LO>@8=#oo7ckp>7@MXw}k-`A|E)^OqM(WQp!;ody3+N;P-R^_7
z2<T%y(Ed1H$vK|OIsO~kGaTe><s5G`_-HneV_cg{h2YpjglR0>Pmf%713gBF@MIwS
zjTi5M{PJ24tODS~uaN!3ud*Ac<U~HJLG>G7$%AY3?KPmZu)fq&(47nGEB6e#bYXp&
zgAhs()>n88#?5=Iufg-fF}c3{GJ5mN@6B&+Z+@x$^7F}q&r25lTr(F0xlC9Zox;+H
z661eed>Vj%|F}-T(stP(W~+dW7qAVNfUOp=@dDN*V66hSxd+xK2?MRU8a~oJg-1os
z@Tf?Tg<5{hBp)~YL3((cd<6GLipU?4<Rb*x-J`9j59+Hkh)$S(PF0*COu8f39vGi$
zg&pr<zr!b@5|uev-xvIq*Mo}kdQcB=52}QFP~C%hP<?F)iPv@FT9UlXmk47Ik4bw*
z`|8@)d+N3Ok^U2(_cU=XTMJtuAst&TB$GMz5<cn4vHS`{3&Ni8RAcbJpFJ^<3Vf!A
zemxoj=^4_IIKlF1dbEouw~iK?^x6_WcwbM>;S~WtO2E4a-XWlsUg&|`Gg!s!G!86H
zO($ApkS{CgDMAkZq!Q{*QMLwr7|M!J$R_rNQY04d<=)`!qkn(y7S^=aitzNn8mzFs
ztYV*;KGrnw`X}(Rkf+^%HwjKj@!Hfm_z0g-iU$+>_mchF=g%vDaNPUb6JFfC_Jq=d
z`{1zs?Flce*PdwYfgQ*vpSRU7`b0JMMW3j;J#B@0#)0-k+X2$ESDXfiSxGW`jl*(J
zt)s_w_F>$=UmRdhILYULXnO65vL2kt%JoTRzfsTsbl#kI1nYl12P>|S#|vY4KPdk|
zqvJH2^mTg3*k0D#vWVuik38wbKI=y$)#m_bHfcTjx?8b|guN+!Xh%y8XBq;P5Ax9<
z(o=pZ5Szs@C}-bOnQq3r%nM?%UpXuHVc-|uAZ8Ioi&;c##Vn#WF^gzy?<^v}@c-$|
zo#A2@s7}oPD-^Rp3xz-2a`7zCzVgF$lkQty|06hD1?J5>7$~&D6D|bVR9Fdy$Hm&M
zp9~qq48R7O0c(?8+=!Li#0)?k!c$&&(%6BJ{=RF@Y-}IqUH{pR;UA|hS$R~VL9~U4
zH_Eru(z916@`yO#A$mpyvPHfK<p0i?p07>y*FF<P9HLu9?z2VYK8%%6<(hgT_XIm|
zRFM{I{tL;ZFL*8RCJB|`BZ&z@E~Fj{fAF$H#UOe)`;kiP;OkT&%pUsW=8kw@%cTDb
zUA-8rsV9rv;S0R;=|p-q9vSq7>|f*mB)a7mBSj^m@KP~SG(y-k@jYWjgV$Cs+FY~n
zelD<IQ#IQ$wF(bC8|%fH>{F5(T4ktbzIb(ZCwl`@k*wS(y$5Q?(0lfww1_230VFNc
zbeMXL=U3-3IPHyFQyUz}Gu{T;-=Q`j?L<a@K&g@uY~w0OEmmAdQ3z?M9!n=IyBb&=
zz`awf-0ct(8T4E;5cM^v$^TX#-6}lEMZ)(zBJ{pnP;zXK-XEOqwF2AO0^0-q))~+3
z!FF)iZ30#!U?T<W0#Vb^mw+uB4CerW^A(rC`9G=eCQ)v*pjE7()eWNDVLj!NoRKBl
zS3^QMVMXj|tOUV=SoWF|x3BTtf8h%(hjrtD)v)zq6r8*;f+zjv)sM8Zqb%*+fLx$Q
z<r(X8aZ;4smcqVfUnj$^mRq_TVF$`*^44Q|7;mAYkjoh4G6A`afV9&oFs8kG_w1zC
z-o03{`t3G|>7VR293|LQSMN|^4Pe7Eb5xYN18b}<%$Tum-MRt|@U^KA9y)%m-jSj_
zp**3gZ_`UoyC(X|B}<n4!JbMOu&?F+qSX>#+qK^W1qEs1ldu5u@9giYu|?l}<1|-S
z*VNb4)L?-j7RkArQDGac8VfNyR9dasw9I_w%-MZdIeChXd(As@7NpRa<Kp7RM>#Y&
zNFmB>?xhR0y1shf!E1m`a%h4U8tzJ`gYZCeeiC1yB<#@ZK!!H#`7PQVQTIR3h58`k
zkx!QdQrt5|`ID!@mh8EM^hNF#L<(Of7D;#5l4Y(-8cPt*e%Z#>CoA^=MYB(zn2=kv
zRn3N3Rah4!GmDj<gG-Ac)%*8t+_w?OIH@+U4fS?rn6vQn?~;?(uZJA4Gj{0=Mwh^r
zbe!ocVJ-@!Bn*9T9**;fVh310q61RXGj>fyW#@&~5*1Dm&?1jB$MQ2yoyyK;U)b3#
zcGWFx>eO^WonHcz+fc7RKx%#oOn!-ajU6*)%%sbwFT|1SlShR%U<vqz%8Jg=@L~9V
zWNcI{j<lOHW!Nx`!6clV9@E*>84`(uv+$}tzH8U<TCiGcFj(}R&F#SnCs}=cdhob$
z<DvsY=FXZmYoyz?Wd)t(_@X7)&|dC3y!o4NzS;80N2}MaU3=MO|M&;nVGrxLIk>Q*
zIeM67;%$#V{`kT$m8zxHVbq1k&%R~Olrb}I?(mWTq8H>TK9`Au?m8x1e@`k-L;HfQ
z*SK2(uUPb7*J4HRkNjH4KE$%OZ-n4VMq>)YsXY*#@9hC0iIE{V{i^EJH?}n8L4N&7
z{o(%o<%%OHKwDQ_R$Sd=NDN`mJd-{arxPANw*76a@cwS^iCVR)yRogc=)~!R+qP}n
zd9E^h_wL=BH}BZNKDQ@itvS`zS+ettyUX3y))qSLs;j1jw&T^-bpCKjhbMbO7Sn3e
z$6|G4MQ1FnuvNO{h+&Z-TBAXw)w%I~%!F~lEiEk-So{bDnQ%o_S$%g`c6M2H3l@wA
zM90Q<HlPjHl;LcfpkPf?$rZ#<t_4UJk-biyg3s0xx+swAB9<&v5&KqXq86cvnnjBn
z59n!tz8cWuAPwUo4PhI$?Z!zA8#a7LuZ<fv;62wP4i&8<cIfNtfJ;aSj%y3wcfK2k
z!LD0(0lN<rXYN~v_tZ>PlD@5;i>*UlfA099gDE&qXr<)wVAcEASa!O=!4;c21?Ox&
zk;>j7R*}L4lfJgAAs|I#xqh*0lHxUBdW!O-@+3Iv4A*(uL8tC+8LLKRt*#sIp#&T%
zlUb{E=*=M@ZdaEqJHv6JD$a7m!K<Kd4Gv(%duRz9I7sTo?9fMzhXN`sZE5jp4e}fG
zXrVs8Awc-lyv38BkW2H6d0VGXjb!9`y@`9!kyD>ddM5z1q%jMh^})55q?oz(Vls6M
z4yq%C`v1uFm!x!Z{UvFuy_l$xkD6a9+-3Y@C!_^9KP?phpW`2At6}eDZ+rHedW1K1
zVBgdvEk3)(hoiJ$fs=M2!?~JHu3)9lKgS#BSL`#4U%H%9Vj`YC{W@eGBSs9&BQVfU
z9z?6Ynx60=QV||Z!YO!8LPSuiFDAW|`nM?FLY*=77&xvRPwXXOtoKqp!HN?nflVwp
zH{6Po46TwuFBTBf?7yIzn*4nFKbO7t6voq;+KvO7@kmqd#=_tGmAjpC+OBt#l`tv4
zC{<aaEK_dPABsK{{lll9{=nplrN4)#Bu$%=%6382i}d$o-;*tm90~iB&e4QfiNho-
zYb$Hpnv5ChE%{sWpGm=iDX(I0zk&j+uRep*wF+7*G0n#K_UhGd(|>S4K(H70QNTSO
zxX1g!og)t9Tim*O;7*9sKcUW%cQTH6+AfN@|D=Yz19{+n=m%hrgJTKxilxbHy>!E<
z6t)rQ1N(bq;O|2pmJ3I};AnA%8rW~?MIX3VqYl~U4i#|pz4!+Mf1!WK&h?D|P#jDH
zS+@htbf~af=?+gZ-HtvLx1DyO@eul83$1E)omK4qolIx^5Ft4w`2%O0nx~I3%dv5>
zvGLY;S}bfyHt*cCbI&(lfBmn2ef`B3U*ckH#O0T7*f4tZnl**FrS)|MhyJm;zNx*U
zzOJ&Y#uGa-<M=7WUx(9HVe~(D?k{e=_uhMdm69?Zn;odzYHMpdbh=@4oh<I)!TIwW
z8XkRgLX_DO6QXy!H*RduM~_WR7(L_aIVmiiEt9Wd$@by-BS+@be^5|Z^sr&WMwrdB
z($dnBXXE%=?8RaYa+=<J=biUH`tYNVKKT0wAK~>$vXX4B4XX{?v2*9HT|4*e`4JZr
z8<vaeLO^NKi!7<a4tCa!s;$93E)^Bn&84>XLSv&V%zD~-Iy5{gE;7tIaUxF39XkQ%
zc5;11JG)RD?6W5eHctorR5kgBw%M>WO|44Xb=fy65@osKccD0;R7J9@s;sSTP?4aj
z3c_@ARIA@!{Wj0h7w;MvwJJVmV>nCQCLM}q^~r3fbWgTaTrO?NmrSve7gh!~r0Znn
z|I8k;qR789Ax$7snjkH<RI<rDcQ{qp?<U^~MZM*1r)nWyP8)1j=?*!-sX`yV9zQjf
zWH?pW{J;Z^v_3_-2g*i;v&*uDERx07mma+qpHt>pOSxN|GS8Uz15TOeDm9j1%bKn(
z$`e+fQ>F|Bg@?)!TPQefJjX?g7CD6#>6Ec`2)?Bpai(uijyP@Fn<KRs@(cU!|7*v*
z88nYZx-F$!Hr-;pt;GjH{aSAe+d@gwaih)%Z>hy$x|Fw1F{2bSN{IkWpR<6eiOE_L
zj<tVt*fgS#(vpabT2-VaDFJ^;P|~oU&6N!PpO(bso@}NiiD_ub*OJg|$!A)Uo5}a5
zYDsifzb&YxL#f<uxAs~xG<%nZPq^pK?8_kQathlmePyShA0JqeXj+oUf#h#s>=Hfj
zbM|Gbsu}EkJlc=2Cy*TmCusjPWWLx3OQm0AN1@M0c$z4M;54TdCWjKW5S%7@v3Xv;
zP|3uXepDvU1(3PDWad0t--k2*uI}?;**7Xf{O4H0&jgl`0ghz0Kr*Ih#Ej0Tqh4+#
z=<7Y74wj74-eFh4>TI_&$&T$=u&pBIYK0^#OEk`4oKy_UZ;2gKLe-|mHESB3y<SK_
z<UF>Py{lxgPw}j@vr0O+R>y359O;N{N%TyQbGz(nCAOs{*2%w>q@W<*w_SQYnhe=Z
z!+_Ul;58n2S<$M;Fo|h9I^d(W(t(sJm}r6fPwd}+{QUXj`*&>Jy2A;Us`iKc?Qd|J
z^bxJCM&t73;BH`ead>#7*&G?J-n2>W48UkM=|(ylVIKQ{y~o~@rm<7<{cK4JE0>ZD
zK?y-2t*s%~hcj)U!4Mi6*Jg)HV}J<S12qjAjoi^8Ypia!)hX}&@&j(o>c3l4Q}fYB
z+sLoJ(H_{<ioH!rOWV6j;^IoYl0f!YUrB)12K_%5e0iVbKuRW&P}5uF;B9YlRt74F
z6BdVo0wVw;Yy*;aT}Sn~gZbyPcI&7ETeWHp3z|9e+iw#S*RCBtVbwOsmvLNX<~aJt
z_Lw+Bxz}`&Yafop0e!0I&IP~5P_}+#{>c0g89NKYq@f*wnwu{~#<gRSsWG&sCY1iM
zW2NFW6ct%40ReO8>K1{g@))!*<7un)H2s^VPBjU>ku3JDsRmfv(I$Cih0r^wvM##e
zbY9U$V*nL{x{|#TgSy6Gk{RYR`Zy)a#;mNY(-}D~s`YN;%gbJV?Uh$vqnb10hh@{g
ze|JXY%x@Fd<{Fg~irm>LXO7Dp#|$@4i+JRQs5VqL1tylmC{K{JAt73-FEhd^V*#ZX
zP~&Eo5$9V*4jUF(6Iv6>jMk{=h$+&jB1^zrtMS_8YZoLYE}#yR^=hPlzlJ_;QadAV
z4&&TJ6(NW?l(N8;#jB=UvuYKuR?x7SUvBYnl(<P;^l{XCpeI4f+W0AdzSCDlJ@Jv(
zFR145i8dcUiI>DfA3vQz0c(qseEcLv5(9nA^vdl2jFY}zA`G02w#w)!B%PMqVL&w_
zv!VF-u65eApYS?re;RkqzM0=PYBifU!_>Ep^HyZ3HtYso4QLkHbr!Idl_l7KEL+>%
z$+@JBiK-eFx*$dyK4B2v4D1QH^!e!v$#c0#<H8Z+B1;p%s8#-v#PtcfE%C{0DBvO?
zv(z6Btf}U^E&IM({TAS~Kkh26ET!2q&q-&x)36s;t@4nvNIT`!+LpB~OggbTS-D%z
z`-_g!o|*XQ_(#XH-b&A!HTCk#XFY-Qv_IVQ;U1<<N*p;YcKi};OWWDc&VDB3(P#P2
zhh!x{vaaHmuTXK&6tH@Ue&$?ko|Iphj~$e9&r@%`+x+dOO&d3E`sSPUxVG-tx&xMP
zLrn`)>M}R2#~~)|IO?;tD|r00vOL$4B_~d#rtaK{v7O;jQKP2JnKNfvY^(-b4d(xJ
z@ZiBS*rYH@^X<19`ggM7f$jCJ?uLr&?6=<fsiH%tS8FW8V}JWV;+J2J8+Y#9O*c7*
zA31Waq^_>6;>3wigbF4O$04rcr%!J`V!G)j6a72QHPtmWRpnKPAl5YGx?Cj(%z;5c
z!NEZxA!b~sT2HmIuu#+z4T$RrIuo5L8X9N}3=Gie0s`?03Nb}0I%{ZLTy%77d{kIi
zcyx4lRJ1x;EokSngUG(@wS#sOpWXKKbUY5w`yM?tSWiofG+e@N;6q+|v4uv4Zy1Pd
z3jbp#mx&Pq4=gp99(u6|?W|aYhC_b)!1_FNUp&VqM~OXIOCenUg@k+&;wH+bPK-7s
z@I@Pa%kDqo6E9YqNAVFmewqX}oH<PyjJm|0tYKnL))8zpr8bGdsb(=~8S8gXRvm+7
zj*g>}fa=9iRX8m(C5-t<QygCw)feNwHjPalD@Fwy*ggUpE?`|0gt5t&@zE~-u(5)u
zC1P62Bryr2Mhw)Bz@+}6xD+eaCbYuHLrF7eZ30c_;Ge8CL^%Y9<Hd-Fhw-tUNn*r<
zuWzLq5CQ$;90n^6CFzB9%ocOzn#Jt*=$_f{gG*(s7{hH9)6Hg!Q478<)h5UH%xNAR
z)+1)})`*$Blf_J4vzW<ydCyE<g1uNOuNAwp9)nc!$+Ooo@8nrTDXB7JF0m_XETS+-
zCd0nQV}jsQvzYEOf~LE0dX2O)HWJ!*Bw8-*B{&kY6<{EJKs~A?84e%bw}1cPty_Qi
z(Lh@f#w6k|G1y{JyWvFDPn}BfL>RM=Uo|)Ny897eZfLmwp`}kagY)t#X*<NAyu7hv
z#|9QVgIfV^4oB#A`t%sq+Ug936WxgTVM8l6wd?L|aRwKcmzOs-V29Mo$_6}~!8J9t
zC2-H6!4UbauX6^|2uDTkp+kqxpU=oWbEc1f(6{FytB^-&(;-{mLh*S0FmzlP#Le`2
z2;@}+T6<%XdS6WPMGtI!EZS5S*piiCic7vB&84_x0u84!RXF7#sOR&^eQ`}~-#lpV
zwqOk9^n-Tvzy_gw@&n1=_U+n=0$;=k2*PL>wdqA6g}sK@Cc=kr*ph)t3T=Z5kDKt3
zuz#PxNUHZm+(seiG01reavlMmlErJ<uwf$)Ia9=W?{44N6(YKb*QyY-H7_%-U%&5U
zMn(pD8*GVMxfi6fsb|fco@91#1XSjLcEu@%tlm*Sf#`Ay4>UX2f@Jm)u*1NS?vqbG
z`TVVA-+YszL@JTeE610aabPo#CwC*9+|o`8nh%*F)~#~8>+6@98ye~vI-KT)2I7A`
z2xQYWH#e8JQz)6W2}<{ki<0KXv>w4@9H+s#JlL=x=eBQLa5Shg5mcE2s!;zfsM0?g
zkGA$FJ5fV&=x}EW`aY+5{oYCt<gK@|L7bEO)`Ko-V94v(uxA;25o35@4tq`g;{Ct5
z^%f^lWIza>jAjvhPa~q>x)!6_oQcv~%hIsN=u>n#%>%;kpp@F}b{hihIy?f56k0Ji
z)Hi}k4Gqnp7^`mpu^deA(81l%#}cxlKmJeTG9GlIbF3Fxd(N>A4nk=XPTZy!&SnV8
z%5W8A=N7m!Tty|WZ8jAU^f)wdD?Ny&$4sAo=FGZvGeT=|K73vHjCC{S-}T5NkIcvD
zh1>2hJoC&apZsI};Vf69-SC&ctayEWjtUV(CsTd()vQ_Kxa}|Ybz^X>d*2sutE4Yp
zTcA9k+{mw&lrNYAL32AsQ}0#o)h%7R^ug<AC7Qqlc%bY(?X%a<iLb1zbOx1IxeCil
z3SCvM{9M-on+p5j$_@?o4W_jRkul~FOL&Mm#vB}I9@GEFe!WQFF=*P(jIYV8=e?#R
zLm$&z9eI!FOp{o%S1SzG7pRg{wERX@I-K@5V0YT7msM31VGMDZDyy4EOsM~g1NBot
z{a=FmagfqDEEWm^)kW-(s4oX)=j6Ncvx^Fgva>R?w>bj3x;ix;Nn)KHjD>#j*`W)N
zl=`EeEm>kPe6eK7XYZvcH}mTW)%%~Z&+HCeqbuw1*9d^7(8kHeVZ-e4@$ssh^{?9P
zPL{%K%%*){B8Gq_{w^6y{Z5^#!*Vm5bn4VX{PYE))O4-KFrW=>-eGqb%}KMa{q2)a
zKKao{Nl94Os;#cBiJx=*6FkoD3@R%vaut>37vz_fSCk!aVAEYqr;O9rHCVu5i3l}^
zT7pf%mdGf}n0~+Y<3nHT<>ylJF;MakOwHazdw&d+d;}U}MnzdMgt8o6Pce34t?KMh
zsobrK9As#%&OCAA#M#2C%F3#0*V(gY&$}uWqlUG1cGSZjo8Hys(U}auy^AT0G7U2}
zpWnYf+l>vEbzO+1faHj#=mLXO?dTVcv!NU#x|}mIE40}8cjWkq6RprE#x~cP^?!RS
zIxeCkcmId5i$D3PYWec2tbeUsx$=YU=jx-zk9qsO&-Y<0)gIX0QhTAP8*W>0s3p)b
zf(~o9-in>g@0b=R=N&n6<m#)ho}jHh_bK*?{i2|&OOnz<u8b->cI?=>3p!mhp7jZH
zf18Thf5JZ2{B*W`%<Ny!V-A{EfXlA=_1rt}ocr)R{JNcA?`m$pJhuAqzEtdDyNbOc
z-;N1*cB3jdGCWADmg`*kjZSs#@vU1wPQ#|If1oQkef^0GvD2na+qG*~e)tu)&SNi=
zIN^Ft{rg3WW<{jWD9=9)L{8>aRk=Xz6Gt=7m9%s;*5#bc%5kAzFRiG=w(5Bq_$|Mr
zEIYrpv8%1F0+!@-wOa0IXk*y-yh951&~DFx<L1m6qeTzWp$-nvKpnwm=xA>0)?)y(
z`M}z>yQ<aB8I8@I_{Cj|kw-l13kpk$TqQY~$4-^hc7Z!xjrEn4_0>(_mD1f-;VP{v
zDM0sI4iRptto0c60otH3p|WFyK7R7#ktQ00*9Ys66BX80TT$N%4cAbbpWmVN##_km
zA<Khe^8NfCOrQF~p3XN@d4)V5?g|BaEf3mh_ijKv0jOU=GH-!oj;gM%Akoxl&Sz#8
z*HpL3RD64R@%iINe<~;_gl%-8!=Y-af{&DlL0G-cLqoCdt`2mS+91}{3GJ`xYC<5m
zlR-K=S{MY=nWWZ*#zU7TChmIw{S5``@k=nsa$`bQ=DJsxzd6RLZ?5lZDMq(e;>Lss
zdw?!<WYVTh<Hskpe3pt$eQ~M(RmGxjO@-v((%m@$oj_@BjYIA3V0vx3R%y)t>FCj;
z^OQd-f5e1=ciFq@2jV(&-bz*OqD%8mL3iw;r76(Op9Y^fdNix9TRU$4{P|Nu;oR8+
zWJ65iO*ds_Wkf%h28}}3O8IK_fqB?QSSb7lw13@KUS8eQ=}_x*U|V|9xpSF$pwkaO
zV2A#^v*!-)#7u%84rS$4Hnr3h78c|ozI70@2ab~8n5b5J+B;<2JzBL61addAAPorC
zsSYxk(7GX5IwONjIg`STx&X*hU7cn0=wX%+eLK3;&fv(<s8LCyb((;Xm|-z`u-_QX
zI_>s&kGs7?t)}sD1KM?SWmgc*|7mXT?C4NbDu+7AEVs3%a~(F@%Gm8z%n5-;PXf1-
zuv93F_oNzcJO_q0&efGeL!jjcd>3-y=!tWukDfet>d3((M~<EN>D0Qw?)G-3QY$({
z)D@2%F=fU~!&W#yIxolF{Oq&O-W*mL9i759v&|}t#pU8V)dzia5_1TenNDK}ieTY(
z$ac{>hr{viuH1(B)N8NJOJ@I&o_o$7{6KzLX+c(Yy-XuHOzmVWBLzBto%*Q>+Viia
z@&VcV)$ey--O!LiN&vmXqD7=--eiuz`!U#(Iyu_ZmVF8nh~@e7?@hx{E8h)S|6<z6
z?meqluZ~aUW21M&K7TOC<7w%NNE~JYe>|bnonfu5O$`^ys~T#{YZ|egdi{m!n%rQO
zT8D6VcbC+`u<Bd3qdBs$q@=N<N5&2tJtEdRX55%D2_uJFuNpL^u!sE4`Yl~2(Z0DV
z&;&jCzr?)fv4|7m({I>S=&3mm6VPJs0uLVn56N~+z;YZj3?dwhgnweA3YR$}J3BY8
zAUETu%$zenA<DWAGe(0v3K*qR)GAMVdpBH;Rz+tt1%+Fal9J|OF!uxYfoeLsmlUE)
zU{}{TW#<PUe6YJM>`MIjCR>5C)xj<`rgwN$a(#AIerZ|$19mVAEDO%N_S)3=hTL86
zf|u*yhOxjIb1n<-Y|K5hef#!L|B`}jxSvyP-#&9@3T;QOj)^%O_*g3YoG$f?mud3f
zNr7o~j}6h1;Q7<TP=wkvEHR?9#p3~c>|R#s<5#a<v!{Dx+KXv|ne0{R-uX^5W~Jd!
zjH>#U3)M|6_0?s$*ts@HmcXSBsjFMo>oL9+9~~WO36G4&L?`P=1dgt{IE|q2m7ws$
zpztzK_)1XtN+!j__QCMCATLFy=tU0|S)y`W0n}nqUT&t#m7AS;J`2-}^0KpYatqM2
zxVFVfom~nh$f03j(TYbw=&xIWNW1YZw01ykZA<tSH(Y<6I&T{ekie-2zp@W+E6Y3e
z-P*Nl*YC@Z&ph@mCh%nkN7dF&yyNa0Z@h6lEGONl&EMyRT$u)aXroJW_c)_b>2gF%
zq2p#I&q}(!qo%N;ZN#<LCb0Cc3fo)CRdbvyAUgW;aT3NYO_u>~1tw2@rtRv~kGSmD
z&r_F4*FV@7(xaPcj=-MTUR4|T?0vJMqYZWWP|inSY1-_%!iS%@V^Zzmf2Ar<)1`U$
z1R{U!4y~%Iy0%;2h4C6gX>ek~@XJRd43x@VfyQ>KmtG&OtaZi}LN(?WmsB7CSXNP4
zo`+dzIFF*F5JRu7191xEtK03y@d`|Vq3?#V0hwl6eA~(5u=&0zI4m49d%`VI(UCy`
zL17k4M0g0s>CIz?h84V}nIr>84#leAN2r};irCR4b}xN8B0@DY*u(fl7O@Z77jqNq
zDEGis<0~iKtdQneUq-N};esx+NlQSl<z8s&p?z~<d_A;-#x_;%0Bmk*W5=8-eKRIV
z+t{x#aRom(7=}FimE70*v`L?$<U6Uf(IUt=LToIUC1zenV{*KJz7Hikn3}!KRO~)T
z^nK{%r(^gfD<?0n06m!N{P|3%i=6zz!mKRt2cn#Xvv25^f`a_q?5tC#U>D_QAdI7G
zlbGU+QZRG@G46yn*wNLd7z}C%IElEOTE#1JV2CE&Xtyu>=lK@%sFAQcQ<cYYJz@H+
zxVqCiVuam3Vnjr1Y36G2{o{HhiH+zkIrw+#>~U7T>XT1);`oER5QdmxSA|s8yB%Q~
zy{hB$e|8jo2^I6tZ6Tw7{PFtxz2dK5=qcA~%kzsH9a3PtBblv}ZYxNaUU&g+f&Qr*
z#zu5jp)#pt6|ldXp15jUMCngIz3>7Ko6wD&{*d_oT|JVNH|s5_kIjRVF+-Zc-ePY_
zdOc<`z`ZC!>}J1Qs}FMMp`47R#m3n<lVt^6($lx5vHdJenWJ1Ttw$AjtI)l1sD;Tb
zZpA6Jb~#c!?Vk78yXn*6GnbbZ7Z(zBD=RC?N{UO13JS{0p+nFt%HcB7FJMARS$TbZ
zMMY6j6*fRo85AZtqd;6xUZnx8b!vmu*4Bl_Ld^w7!Yj%va&uj0`t(S=BErH#U=EnE
zo4zGHEF#ooii|XwsPRN%hkg1bBqTK45^1$YMTLgOU=hQ=QG#eoeLefWEA`5@NE#-M
z+ei1No269@lfAGFkyI9dJD28JkjKT4$D1LKvmlSNAdhk9U8Ol+ez)bjjT<*^{{Fl5
z>({OOdK0E#e!t=CFWFmmNw49tht4jX0hn&UY{|~fE{wHFPStzC2`hi0Tn5#79}Z_2
z!>>8;$)A_ju1&=u4dKf3n!kVh?YE!3o`N)&L86lF(%3S)4l|W^9LTQeN{93Rm+hHV
z(HH}9%1^p4Tno*30-=)atVs%?i#4(z*gMj__ohl$U}f|>n#Yjz=I1G#asr}JZkP7!
z?Gyrd=!RK|!Rfvbz<qNP6bb>vbvD+vjf%2FVJc#DWYn->INcyN9D~^L)=`KcNbQ|=
zI)O!_M%R*VfU&L7s2TX_j59X2D4qI_s*;kDw%D1Cje321Ifi>&we6ko@uha79j2(K
zy9+%`x&e$0?ryFuEiLuNUeZA4MWFL<K<6~jISq6k0kZ(|m6@59o0~^%o%*gqXy1Zd
z(g>N^2oRGndF&<+HSbQ3MvGX54i=t6t<s?XO4pn?*MMm)shC)UE9!$2`o(zNym0Qk
zIdiTU7S{3)ytbdgx)&AtUX4?C#AdS{XAl1=4M8fp?D7k0wL^2|!%U~{c53EY6--l4
z6&<?ywz*@VdNR6{mJ4}#4IQf6=CS4cdW9{Qf6tx;a^|s<?9!y)dmEqX_mftwm`4*w
zaY4yoD<FsZ<f=(yL()f-@Mcy~QC?C~Ozn&Mo&xmBg(cJqE6UhGWQPviZjz}<Y2;2f
z4C@XUcMf$o95^X`L^y9pQBjfM;bGK(s0%WgLPJBsshLGt*w{;DA!L3&cyTXy@mug>
zK6o*oJT2mb3!xJ_Y3zJPHqMdC%_ltba5#&r&;|dC213Fi=8VwP5cv_H#IZd(9cEmR
zGH@b%hnNcHTzx!W`7_tD(6bQ!SH4S89#tOIdoFYX(Z*wkyy=DqlQD&`EgHg~?J6AG
z;zsz>6R5Wb>7%1R{`lj~<-t?$f9a){?CK^-s%vs0nwtVw{C&Cpk*5|we`5MNzqYai
z#y`)x;*o`sz|TDQ5jv{rW4S)7ITdrV-)3*4VWit(b~2B{ta!R|&bl%wERz&ic;dUi
zriw@-rkhk&MwpzSL`8)QVHq?RggwfNi_1!iNIHwl@O^;`9u|eR!qF(02f~R70Wj}8
zbna3|hh0rdQF4yLoL@}Li;O};h>ni2goRncL&2}mFblpnnWLkkXkcgPOa!-R_WVoW
z*5lxoZ}$A;f`aqsVWkj<3Pc;q%*xI_E4~Ag^vc9nIXTA;pUy|<gmu3P(%5ydUC@#m
zn_j`x8@>2YnOo)r);xA-bYIxGZSyguqYK`0n(|wIJ!x8(z2jJ2{kPk`|4F4#*xL8Y
zQ`#>Ic5XXUkIw%AJI;kpL3i^f-G})|64JccuGxIxU$4CKN*ca>xc3)xW6v+t<=&y(
z=|mVO1)TcEm@qOa$zq5wl3}05*79qG>G8*|8$T*0ajYdEq@w|o+|v+dqbptehd(SB
z85zT1_1oFPSEbfcyIeXI)4OeSNjF8>CCrkOTKa$e>oMt*3kxeNVG<K#3#tFZU~_p{
zS&jG(@=h;&RbE=!+;*V|tG<}(RS?OpgQ1Mt1qZ!?iAH+yAu=JxIXNUGIyw|DFd2i$
z#QvyAizQBche2g}(N_@>31f$avT>KnkoQgt!23tQdy0uHKucXfEfww21(!<jK0hZr
zE8{%u=)63%U6{og8RyPpJkc2{x!XGxxMEs8DRk23vO@<#t7K0%CdDgpN}P1yK$`Lh
zu0JX-Y2Tp9pKl|C{99$Q<a}olTJEh%vT_}|uU{$)lo(H|xRe;>8s%Y($LzE_115gG
zbNi0M=(gC!kIffEXIrHa(r+b=)~W4ki;YT}o9s-H0&v}PPa4a_^&KK%&mu1R<jn}V
z9c8Vo8vx;~iWT8H&8k@^?Ce-+62B%&bET`La18Lgf+%cD3fzJ<n&&5EA3nTt9{Skd
z3iC$2?8{??)ec?d$-{^1r(8GDISMV+RVLakT5f4sc~vFmITjbARm0`4s;aKU@TxOZ
z(dsplryGZAb)Z#Hf9`SU=(t}G99QQkG*z=jG+Z>@2uoy4G^P@Sg`ru)NQ9XfjR|>|
z%0;wdTJ<m=oTPD<@!%w_dWg&`EiEf?<>t9ygXQJqV95aS7RyuYhHj<?*Nh>0720O^
z@?>SA8Yd-gf8z$6vGy<=*q1QR<M(jTZo-0+8*wJoL}ih(NWOq$43$Xgh_?pc_u`8$
zrm(-V|Hhu44p}bUygcwh9FbQ(<BvComX?}+M;61o@=Fgsn1XdZ$7HJ&t>`ayyCzNf
z0x{TBCD`+>vV?u*kX6IdmPZ!n<Yec%N{U@D(~C<>ONxt$#B486Rk1D*ucfZN+X*jp
zd1RQ;7!YU<4>Jb^nZhC>!o$Ldj#&D8QBp4BH-R#rTh(l>RmGmO%Iqc>Y>9k81#&=<
zA7qLPN*3J?-RR|gBdZb%par4u3JcGlFDQVw>w>zbh*utri+pOxc$;_reD)56D?Rpb
zGEvBw=wO)11u10;oCt@J{9y$vW;C!1S=jeK9^3fF8*hBE>-)W1k3lmW{OZT==OHF=
zHNXB8`s4TNnKNgG?EIlR5<_6_+S-#Jq*72pc`jh}k6U+se;yIE({C-HJ`Wep%ENV+
zv;w?&#;!Yj_{i~du3EPfy0$3u#F4pk=NgK>OM^YguYk=i-Q2BPx0ObZ#Y{Ly^z(Y=
zF^^52I|;A3bH@fWwXi3ix@K%t$u=hoTR8vj2k*M;u6utqf8jJlGZU@j=P#Ux=u!c{
zR*qaaUxB}_Tt90>{#RdpRTdq6^_}<MfB&QR&ANV66p|-h^Z4WQ*gw6=KbP)@2rRSf
z5Q@BV>Xa!_PGjWcNmH(z5AD)E=|Qhj4SeZ=DP7t3-h1yYW1DuQ!@ahd^-5!t(Lk$@
z3;|6|2>aq&&C9!+M&Ep|GjZ(DtVEDVFjO_RkU|uNaPulF3k%_kyI_J)jJFu3QxViL
z-eC;9Y%g@0Y!BzrC8%N@^Jp|mr<?dEIdC327z$HS(Xhl2sAFhelPNknBm@pR&IJoJ
znL;p6CoCisov;~i!=j@tqlU`SNbbKcOVO4SA+fhXVsC-OCZa80Wu?>EA*iSdmr_(2
z2j$73g}Ft*xiB|33(Yz|J1^6<Ewrl(_JNxE5JbrU#JaHEamT63#M|(iqVC#BL!iG4
zMlUOMXKnfV>#x7rxG$%JR<kWtB_zP@)$ZBz<M&59V2nBt2}`F-ee2k<2_X){_*-x5
zXpO(-nrrsh*&Zh|7A%O!*^5`Hb-@D^>slA=ZVsAu)x7)ujMx41=M<z+2dipsW`DBl
z@4D;m$&G~#`w`FNKBM~M!-vbd90r}Lq3|@E?##RF>@H_$K}kLuR6$8eIof|wS#gEy
zK&YCmo-Q&ha85eHuh4V-2m-PQf|$aC5luG1-GC7kY6*)nkLd^8Er7XRhyayo*5+_%
z%m`390vgi@T4rSCo_7_}+9(^-Ihby_X4dJ}mu=gVmBs1+-CNkN9oF7qM>0FQTs}E(
zUK-niekPUuOI3F8O2~IQepVjD6zvC>8&Qj@ijqoKK?y868|!eej^##R7ZVj8Z8nAT
z%`5qrg6|q&<lC9LU(|#hzz8{d#MSm??4D#+gQc0*+YvJ97dIh0jz->|M}2&DTw>Pg
zbJS&LqKRSP7_aPer_Y@`bLJe3aKu5-C6JYugAQGzK|5hedLTqh@!;f755=eKfhw#m
zg5e3j8$##22EFwZT+@^p{JK)P$MD+P?TC^eIdWp#b#P0@Vx)b9lBkTsJGv5;>B`;u
z*Wcd`G=BUmnl8M@Th14_N@}~+j@XvAVZZ#<FGhOGN*}!A7nfP2>q56ITej?9C7s=)
z7CWzFb<z{k5^1_LfnO?i23^TPwo3gtV&02xWM4|r(yh|vxNb(WDUyj_*k>5-?2m}=
z+2kjlz<}s#mV*v{sa^X~OL3`Yc#t!+^i1{e#Ov<6bz1DZpBya8*;+d4k0PA@rsk=+
z5$E1s;Y=*QP)!|q1-f+%Xya8@eW9986o%1`NCtW+GVe;!&1*WzRF~2N6^|le0iRZ;
zC@97fVamdJL8M6Oayt_vhs9E#9)%trgWz~sVuxWVPkby4cmyuckCAy7fgb<oWhi83
z3b_6dbj9zXE2cn-r!XlJ+o|-tREXrFcY`vJWlMI>nR8iZ&{^eVlZki!Tt*HAV-qF_
zXwa@YVZR%3k}75f!Rdg;V~NdIFDvbE{^N(Fl+dI__uY5jqNLE4(|h;s%khLx{q=3P
zO$~LQK7G1G#!S9skIT+<$(~v)UXhep%0wH63ojhmgpteVgqg3guiJE_R>d`qVcn*k
z7!BUJ>C4y9XJKjF?65Spm#tw7+2P<9{*V+uA@D4MBWH{g(w<MlWPG}on-)zNKYH}&
z@e?NEsOPB@{||fb85mWyy$|nmre-E(QYO8TkU|YXAav5DNE4AJA_&sNf+$7AoS6wt
zkgJGFQ9;0h1XMtJODG8?B#>SwWs;EI>txRV*=K?m@6~&~zfbRncQ%}v%*;76v-jF-
zul1~FtxetmN)^LNqU_15MMWCcbK0tCEKS#lUTAm8Ue&7UUS#73>)u(4<z(qQYv2Ds
z>sV%}sVc95nm3eD3+{1Mr2!*+9|SE4)TIO#xKbojC=?<Z36v5*t{!eqz|$Soju<gV
z7dKZm25`V%y<gBQ^D!px^~}Wi7?TCiECV4y1$nvoIcX^=j}YiiOUua2&IN*=nUxEa
z15R)bFv{G#+-%H~3`**u>Ruz}c>ojuDNMY^iN}7Un2J#FbTnBWi<3+yf#)tmhXjfX
zFYcNMTl)pRKc<{{$K2sCtyl9OTJ64`_wx^*Z~qaW)L8dJDF2-D_HEntI}dUauzX`q
zE}}Y3%S=&gdfD|I@*u0Sqf2fF)W(Y0x&v{Mdktk>KH=fvsV}^ZP*)g0?(Jl)PKG5v
zL*eGOVggCWDr1E0eTsZ1G;C7qw04nS;EM~FPV<Mc67c-&Az@)|jw1WX@Ap9MG1%)0
zrPhn9H5SczchnZ`CbgSN!&uow;_^D0EJ!|*kGCzndJ9W~G7@XXCNuEC9?EObp*xF8
zN)07tV8GW<mMsm67yz<At}p;Vf+t-@eXCMKIi19yg(52iU5F3{C>xy6wQ%Ky4#e65
z%gtm0rwg6i1<+?8Ca0D6m}yY~-rgR-vE1EVU7XZF;a!~7=oEO^jzAdwM~)4k6B;G)
zV-&nV*0E5~t9xM4g+}<-%iD`VQ84j!=J+Jl^%BSk#n+$cdJbGmT~E|Hl0I^zhk=~=
zj2CdmbeypUXFLz7qFL^NDQ(@ki5VGseR_H#tirU1cYyRIrKH`ydH??X8#mLk(<#3q
z6Bov&q9y4~O`K<Ze0FwgMPg#&os80E2C2n{jN-adY(|_}P+Z<*)CMN&?|--N$dSOn
z!-w}BO(}brbOu6lCaJp9B`7G!sjWKyGXB1pi`9n{i3YA*sdeA8CyjE+S`p_}kexe!
z%rkkv`0l&!PIobtoZP9622txLz$k~{QNtWy5)-3g6CTB1-{9F3<TKUU6>s47zH`}k
z;8h$gbsirH2{<S;EgMZDIf+8i+JIbXQC*$FS|f3EXPY_{=IGi=Us8bG$OUqQcuywj
z_YP=r+CX{6rOYNUAoNvLO*t1+#8OW%wY}tGTVL#K@8=-yY61|4K(Zt4n7|=cR$BMR
zk8eDLiD6+)>RZH?mMTlO4Li*@nB;61i-g~RB7=oH3_hUA9!`y=CP#0iJ9;^|`1^y$
z6A<X4c7S3~J7K&ejg1!84Gmh$K7C}JVzIc|KrEO>&eGnAt$GYjWvh{uh;(NC{X9nX
zOK&mR2K`M(b)z>!O<L-Kz;cE577V@~8x~Isba+9#<MjaO6p)foJD{LY4~Bdpe38N;
z=ow&}`2~f=C4d0&Ou^+CfC;|cSf@<H$V(L#z+aIGDUpb<m9fc4OayCu7mkEDW)15r
zs<`v*u1^l6mqLarEG-9NY&O7E@Z9jcuTs{UpFd_qFKc;AY3ccIu}ONFrR9K$6DK|s
z2EDMEY>~b*p`UFvwvM&l<lPHj(SPEUffu;A6ay#M#U4()dL}_XgpRJTPcwW+?@f^i
zJ(&O6C4c7?a_LIq5m47H4JmP&3;icg@W(~GwPaA@w?~fOxO)9jtICtc#xmpMPki<D
zR|ihs`DO2+^YPaU&tATABfVVGUs(yjB_%%oXq2!g@>~3C@MJ%b@BaD9wTo$aM9Z<?
zK@rH^hXq--6E|-Y=P_;in1Mdh8!`X*^rMeH`oi?x=eYa2Vzj4iuYqHyO#_PM?aDHq
zBS&~>h)IhsF9x#;z;khtzN8ecAPn$A5b^-AmJ}Bip#SMJ#R)M0z<fn8s#xTS(jA|H
z;TyZVx{&5CX2lq37zYv@$zKjPwe|lv+$t61&rYpY+u5q@9UN@oU)b8<IbgH)cDB}5
zHo`M@zJK-EUH|&oW*MX?5RFmHfoAy~1)}1Uo0AJM66{9m2IuAEmK5s+#1_j{9=XU#
z;R(Sc=XD~%&9z1_OGI%6EJ`$Drgh8V`;Yj3-;Z~5Iw`5LlW9sjzwe8qAp!Ln_x}-r
z9i)XO+LcTWanh|@ze!KOSFCYrXWR<A<QR7=&pv&o!j)JaSm>6uZ>!dIh;#b=<!>&V
zHagfDsJz^1;K*kezPbE<y6vEuQAp4<ljMFSpRlvZ+Z>h0Skd$`V_dY74x_R~ECZ@v
zla%yRIKX2x$==i!WzbS=yrcD{BWEZxU<3tQkGhJbWrq9$y@1MMH7P|IQToH+R53bO
zbnpeO8Pbi-ywL@)`+(YMed!pe9n}~M!N8;bp@X9ud#MYsES3!i;`d*#Vjh!FjL9D8
zg~QMbp^%bLY<K5LB?3376ycs8sEz<ijw8c*nmycNMCNmIvmQRm0H~gojjWlh?Cd;!
z(S;arMU5r|(2$v7hZPFyfH%>y6BMF?2@6ADy`-utT9y16wu83#xC}S_om2ZYQ_LL(
zOYS|S0O|18cs>X|z$l=1ukq`pV3M}pJoQa9tdHoPHiBOu<xXBmY;_aN3r@UiXM)YF
zFoZW^`n}lK(+jCytc|;ypLJW8m5sBP6JK!tXrO2G8yM}^qdfZ#cDjH2>eZ_cc`XTL
zoRlk9jt`%+eBSFDH*Wl32HA#~RRYNa;X&Hd#Ed%=$;@P;nP-{dOfX!5K*oukKmX+^
zNZ<PzZ_Z(4jDJs4A)~XKl#>i{iv8eaTwlX+;ex>tE1nq?;%3P~`D$!beM3S#6mpq`
zQt9F2=|6^J9)8gyIm}l%oLn9lGIGqAF@Z|0rx_zEK$PELsHm-}1cYBvURYcTe796z
zcq;}BSnzilK(d^W^n+0Y)u*$Q!l!V$JZ)%D-^Ln|ezn@!6B~n5aMuPY?oLh)DjWa*
zcD`9+CPHGUeXt0#cp@ZbBJ2Y{NHA6axPDNIfIjdLW@Zkoe=HYxL~pq?3MS)09)T!#
zb5a3+mWnh$a)Dey#5g$LI@_YsTIS608|A7=xCJW<?|(*vV%Y6lC6|Na)sl7Vm+x^q
zeIL#M=dH58a16-&UH4Agaf>mgveVbD4IL_EadtM;J4j7B+X2cZCa8~xMHBrJO^!i9
zFHi&sR-f#RH)?C^+(*9_iNP~Bjp&^zWEJcUS;=e!!?w~U9>$WJAJLpNVK&Qd$Q6p)
zx8-t;qzTM+wMyp)Wd&Uf?@b6|(1$PzA<}v%Zaktl0}YGG81RHBV8S6kkE*F|ji|dD
zGn@kQ=m4FcJ#ZetIuz@%u@N4^0(68&05yz9^rj{Of8$Cqlv^ReNd3F*C*-StO)b7f
z^iWL?-*IN!Z!XSQhOu3Tv7L*torAF*053i(m$LHmv+*zmK7BU)d2}Y|IDk;{b23x!
z+{{nTN>6+A2zB^a_zkf>Fm$1{Sc$N(hzZ4_vAtmq;DC~<vSO;_v$e=th>NdMz_zvQ
zl8FXvet__Y`?_(CZ1%2QyKYt4qO?Ou@AACMac6!jG?e`E3sRGmH*QuyAvYGMfC3eU
z5wU0XG^3cI>;871z#v8O^>4oUCO+$}VGt^r?7j7v$17K9!vV%uk(;s)CduIQxW7#!
zZWqW+ra!^nVPv=UqL*J=1UPZ}xFCQ!R#PXU;LbPXG>M0gcMivMB$ZwOo=Y;v&UWq4
z_|>;7z>M`DI^yBp3#l1-CEW_Iu&^*s(~o&{q^uG8-nQ*@v33BhCt)a|asW<pRXu$A
za`^KQ2at0BsFjpGu50ZoX{@M1<q70_LA~;^K2TU#-Ar9ZbRlde8tGt2Z-119@=&{a
z0;laApdH}m=IX4rr=R8o&mLtu;5azgLp(s;0T^iCQCFOu`l!Na?}%#uVdg74{^^xx
z1Z(8oEUd-0wvL|4M*SfLo3SSB!J5z?QqZ3;Y6t4;Q!N6G!a~PTZ(kyH$fF+SLx@CP
zK~8#FdR~D(H|JLerKGzPUOvNg0~v&3Q^?@rBI#x#{~X#RK7x<rC*Xf1KN%sL_3~e-
zW0iU8z!n+{nIydFRm&|0PGwXbxB%1g!U0V<vTe{94Yd3~_~SdBrXTte2#&U+8y|D`
z(Bu%xZ?g}Xyoj={%x2ye$s#N3aT8{R;~6y3tO?_+w1ljl#JCF02YPxKGYxGNGk|d-
znUdA3eSE?<jEBc?g|wUBMcVQB0J|~DcM>^>7r-|`+lR+r3m)iE@-;A@)gU~2IPRLX
zY~{+8%gZU@#B<WFpYrjQ@_*VD4FhpB?<KS`{F~yvd-v?z+C#t<ZQi+OuhyZIc0euU
zqqMlJs=5lqW<y!BLra%P3Z#JNMF1l^+FDvW0G2p7P)E@dBko}5h$1Zxb}F^wz(0TQ
zf6xL4>9nt;he7mE+Ve;_<2{U3479+f&;lDU{_CLyMrGf)_5hL$PvFs`Tz&S#`*8S@
zvr9`5tj*Ks<P{a?-UTr?{@%q0sn;$(&cAp)@z&+jC(m6xeGZ@>*IVuH*40JitiGfc
z_<D6sw?6eAFrB3M8=oDy0vdU8W@%lQMpj)ZwqQw)UL)%0>IUzot+qu9cc*XP<c~i-
zUDhUfW;SlmdbB<K<=C;o!OmT+WvJDb^04ICt@MW(zV6#&ckSJ?EgU3v9lw^1`2x}c
zZ64y>*S)Rw@yyAVwWmMEb;yXE`jKnateHOU#ZX5RW<^JfQ6wfym(B=(_Jyj4SuIe$
zQrV2TOSKkmE$J!H8M9{xQ<n2y>y6<~)yFpD7T4%CeBp=45mBaPRw(?3Pn|n=?xdhF
zIG%^ZAI_Te>Z=o>Vs4NJhzwqVz4$%;>q$1b3N51NJjG(?zJ2V2qL{V}W(wk4&ncS*
zcKwXY?m3&9ZfMsyfevjX;!i*Q{CYPTKhs$P9ckxq;@eNPqpFO26OadhN=;2wWmO&B
zz|mUEOWUkTenw()CEwmkL*7zjhoPjoBe%Sxsk*j}NQ@o8O`5q8a(P`wMqNXFMWvCa
z+-5szlclQy<Yr^>v1^qkTnb}kV&!#pthlngrcP}G7Gi62V{@H$lta+a-Z(`nwY0al
zvao_TfE&oGmNu4hF=JtCB~f{Md%HXKu~YX87TJs&F?h(BsEOgheLb+RjHl69{xDe&
z#(NGgS3-qbnTl1&i87hwc6QbhpiZ3#eVB}GZA?dgmZ4T{jpV_WrsAr$KUPe5!V{E0
zCTZR=iAQ+|ngvJ}(?g=UghE}<diI1}NI8Bq3(uTeD;Cbv#juZXCa8WzI2U&|IGY(e
z7O8jr{<*8@YRrZAF&DPu3afF2)%e_y*4Fw88pNrqMeo#>Kdx(PtgQzAQ`gemhA57t
zHUC}-$T6U<Vu37t+zgbny|o1<z)-3bfqvs>gJEREHM^-&29*PEX#?S$<}fjjl9J-%
z6FWrk=NjwkTa1j>DqG)f>+9?5Y1NT>^!o(FrR*+{%<P6-fR`sPK6s#rj*j-cLBn#A
zMT^vGnxOX@|C)k3d>VAGUw^rd0vZ84-`!G<BsbXV6@{0wf?Ov7+g7B<e+?|;P?5{X
zIamTaK3u<^Q!Z}nW~|gs_Tml@?W~56a&LI>;6b&=$e_SMBg25f9TmGc`h+hDr-kXr
z4%M2M=Js#I!rmGX&M-+yrKQmV*PlW!M?hN9N&(TVd7aWW4{^OwprEu-Z0i9@89V1i
z@pZWvwtz`JWZs)^zWJ<+P3^h8d-qyVm<1Ler;LG%oBJ>^;X-`oV{ORKalc+d6zIyi
zbLY<fcJAusv!_m<y9_(v>@UBb`svW2L%)_dBqZFvee2epJ4s15&;R_>Pe1*9`ZTuU
z!*9p(g&-AfVyPJT10}$-G7+uBD1|r@AaZ;YXfMi6fMjwT5R{Z+Uh7|9-%1mIy4%{Z
zJhmgPq^Y?b>>guVLt|Y9EZu6ct6D9QaMsjg9y-LPs;a6MX?qO)MBL1uC=!d|2MCmV
z#E<Zau=Ii48;#8{6**;nXJ>OkMz#491^xRRWR6<c%OM|AAafHSbG?gz0|1OHr9s8a
z%v-loQ`3s|DASjg|F~Nr?r!KH&8WfabLC2W;=Sa=_=NM2p`@fo*HL&NJ^Ri*6kI%$
z!h3pJ<XzEPrRo_dlz{L#b7V5)iSbc<ltWxxZS^G}61z{O*Sq%j`(*FWw=p|7xkO@=
zidyPQmvGGb^$0uJR=xP*i_iIW)|`Rd94|tOg;b{ucB_I8KlE9A{PpV*WH%akOQL!6
zoL`B=DtS?8pGjUE>QsK~I;~l_AFlI4%sNE)8AWkoT1knSkxnbZEtOe81`?HhXGdbz
znRAZ*A%1<zlu$RF@7+6h@j*#9u3o)+H$DCF<NW-GH<DnAW<5wa`RxxUFP=Jn4my7m
zrw9)pJABCCk>O#JIyiMlN8LEo)9e>8Y)B})ia|_qaa-?jZSU@;b}A7Vn(l6y%-h?_
zN?~lL>n+<>W2mTkT+%9oeGFu#tG2ogo^J<dk3=2@bG5vnro0Y9QwvkJ(aZ>5iBa3u
zqbXKk)K+5DhJt30S5#D~hx=0i><sq^gwO~2E?Y^#-4r}1#vAf-sFRd|G0o1&25-VH
zKK>TU%qAwn0yI)O2X0z7q)~XP#ip+Ms`>_6g|@b~g8&yXQ8Cj=GUDQPR8@ge#Anbz
zy+m`aK%#c0@%+{NTdEx=uH-_^m)!sL$h|iBAm>B*mzYnsMT54q8hAJD_*eP0qMcv<
zLq`L*Gh>ht{|rl>8#1JL-MXS*kivG#(AHK_hyJR|N`H`;a6SG(X{)I>A_6Fxo7*jM
z9U2}nW|*HyD{-AXd0AUqBp-^fC-PLtZt-g~20GY<lS62`)f<*g4FtMvul5YImck+J
zw^-7#80g$y;q^l(F8|@W2-qKA0p&jvgA&`E=y*;}Uux`c=x5Up>;J?+D=S+CzKPt<
z#S?~cptpn6Sc8rQ6VAT9p&~muDJi*3q#X)AN@-zXh93SG7*cxN18ETE(an<=i(Bfc
zHG?;lmQgRQvaYVWysVs3K~zR-YrD=)h=!Q*jd0VtA<9%-1wd7$h6jz8?d)U(Fb!4S
zCf!gKyfzpOD)?styAgLPg*8B2m0Ry#_PyNkz#4CW;|&{K)NFF^>*qw7Br0QTD;z=o
z$tM}RweDgIROUeZ0CZ##7G%8K(%ey1Qq|TCVuyJ()IioYL)LWA5U)bkUWKe#Ubvcy
z9|UXV+NFKFX_6IfZ-J@1;}cjt+KHeCz6q|)I&|b>gjd&MnBU;v7HKq^m}r5Gv+_w<
zS9Zq%%%Vvg$JRW&#rYQ$Q5yp>jtWDOzNjE81yk_KH?b#gL;a*aN>4}6W1XvwReYKt
z0UP7nZ@)coAe3Jr-i#t|KzKGvwtj>7|Gp@Q;tE*&gAq6y$Q=H1D!$xu{@LH@#S;-k
zdWQEE+A}BxN!gSU9LMDE$Hh4R?b|_R`Nz3(aldDt2^!?%s)PX8INJv=TD59bn3L(w
zjcYeka*LZ{C93*VL><DRc+i;jQ^H_{?N>hc+;gwIwRrmI(W57?r-_jXSPy&{S9ac#
zbyJWrlg&8NM#^Ed@r)hQM`-<!@O%*_TN}E<!oitSxke$<yLxOdi^`(ZoA+|+Od7lP
zqC3|w?c9k>HcP+Y;E?bD4`u8?C=ZMUOoE0oR)szZaO`eCAhOfOb;zh8!$u4r?WThE
zka`6S00C#9BZp0rIM&M5o%0u~5EWF|SX&|vF431fZa_j?bw$mC44htHTWzhhv_fdt
zGB$XkCpF-p$GshV`-18+ed5Sam;sY!%v!ea#g}JIUh>K;B(}_bW&WHQGiC&PjX+8=
z$I9&;Ie$wR%s&TDdnLr1X>Dn0hjZR7wRaaV36oJSl`Dv&ojlfz_h4&e(hIWY2U&A~
zticnsLh$~nn<Yq9`hpVk@d^>^h&UD;EYaNuW8K4`6aV?>c`{8Wo`#FCaF`Z|Y;C?y
z3FGHK^=P%_uN13he-<0jh$Wb1`r>@^F`gK8#29O7rB<u#tjtFr^K<5JD#17Xcf3P@
zI#2+UBhmDL;(i=<Of=&iQ8?py{5Hy(kHY6hVIKJu<O7X`<|r;i&PKK#sWk=pd5C>b
zw4;Esvj9k|ppb!&B3X&zIU*ofIvK``-T-^@TBYjn126RZi~(#{9Hk;IvF=2Isxj-r
zDcs_Ij8oCyJs%(iINdU6pVUIT85;o+%ieqMy^yvxxk6*n=lL0S%E7NJTv*PLa;<W7
zgncG>Z&wQ4B3`12Wk;>$ti0Foh`Gy`FJJM}gox2$<SMx;^78{EEr*sV`tjSA0<iT3
z)Jhz8^JXOr5{$Uz+fR1v-o4w2BTibM;u65@SfUCL<SZ}OBjc(V(N5d|PZU#218B4g
z>W?=Xc>#ikpn!oO14)M77!C;(K6dsh%7(GDwnZj{lgb8gw7mm@2Na30qm(7$_g^m}
z*gb<W8uPrx<P~obDl4=2&p10l(#&u)^f3Mj>X?E`PFWZyVVE#V7$oox5uVB{yl4$H
zjqe#6Ixw7+4h-^Nh|TuxrKSJNz$kBz8g={c3=Ro{w|4=x<^GpJvQ*d9(B<H743tv^
zMoJhcj1z_l%teEt_;JxqYlMG64HgE64h<)zLjx&xa>lR-qk=)fn1H~DaE^<u-(Q|#
zo<n{ZgBLLdGcX2z7z01T*x3sGPS-(^lumm9K(;VPi(#~&p(tCfKDY1!{ct4VQLvvA
zL0}{tahW`MQgqnpkt0Wb{`u#7zy9`zW5<sDawVz6L^B<hf{3`n;<LM5larEQod3-A
z?zV7radmO?YHM?qH<T3U%d6^X#&<V3tu0q!f!uDMKfhT^TnvVif~<!Rl9S(iZ|&L*
z8vyccTs3ikJKNkG2A@!)SP>nfC|kZ9b88J}@1$t2YZCj7v9THC<K*P#;iyzfHI_;{
zg(6@)EZIJYBkODn3sAtI46A=xk-prZHx%8Xas#p^l{rp?ncl@AO%9a|9G%c?RZeP^
z+SdQy-z3N}#k!tUta&<%r{*GpbWCs@gVe|Fx0wv=oqUsl_2%Y>qi|*f&ZH5t8PG>h
zvP*pOi;I6(Km`SeyJpioRQL{1QDD~;7egP(8ETax_Q%JnfVEOh-qlTKEmk>3r#gJ^
z-iaUMsOq_pWu(C*ni;yp;$oL*098_+$zhasizH`gBd>sfxVRJfGII4=C6);(0&h2w
z!m$0bt0Z_#APET2sUr0H;SuvzK<~_p8a>dCm50$VyTz*!UPV+x6?>s94hr5P!QgF9
zQBs2Ut$ynjWmg9>K<q+7fWHgCy2Y{}<tt;QrKF@p=TlNp@Vn}PtyZWnF9Tf?fdnWg
z@Mj7Npo!!>5B-XmG83x;7Ad5c(6K?343PsLdst;p6c708HY((%B5o;60#ItKt)Ykh
z^Cg5api#;h7=xEF2LFswW@rCZfKp#kR*b1Y2Z4S+#O}n5&hGaJCB9(&<3`~ds?is$
z6#Ne)E~KCSIqu}C3C}j2{wWHKlb#4Aze#q!`K6aGUBWmhs;ZVOSv<_jVaD@)G%`!X
zXr^Fo0ODk^X@*12rTbN+yj(|ygi%1!?oR@h(N6^`za!h(*#!k*G_x*-4vL4z7hinw
zk53NPF$h+&HMej7*t1Y5_CBaP_<eGh2XS%H`4*R#|5c<?pOsU9IYWnq${yqm`BHYj
zhbkd_DknrPA$`7fPELOnsZ_}o)|gauWd6%lgt3{1v3Ut&vkYTH&4_8xbb*i&nr?*^
zAe++8X{ryLsoa8M1Kh1_sy6A%B?v!RiJ_d#KDZcDJJt@ugTjBv9mev2<bER-b*;i+
zsPUZeY@~hpoln95L%fd4I~MJQw~rn@dhF()a@>Fa&|v89i)zMWF-+bgQ!m|@^o;^x
zX#wH~N~$51E^4)3|I!DKa?=b1DRL;EAo})xxs6r<QivE|NEti@oOUDtN#Mgd1ucsp
zTA_W+ypb3Q^s>|Zw_;Ymel9d_MR%UDIp!ARR+V-hi}$g#y1F)OyCANqs7m`TS=rY%
zG?=WSqq{{k#YKK!8wlk<)3UHolv92?P5Qw)W+*Pmg%eax*G>9zJ|HP8BUGFjfHFdP
z$J#+_bQ?_o_|dmCporC98;Fns&C$X#0@M%G6a<>Fa;fdCm2i2S;Qa_MTakdjcRjPV
z`zt+ZxWkCCgYVbazk}&q!~{S?R-;%5Q}7**f*kaM9QZ;G20#uxAO{}!t~QjOlzJ;8
zqaeQ^Jt>v^0&I}8h>uT8tF4VEX(c-Gx8DW^!ZCSQl9+fdB=RV7wb&o9Kf6veXiz}`
z#|*uu3lm(1#KcI(k{N{xP@j_@z~l-imzkd#0zaSvZ$5Tx$`p<{lcTetw4b{6%1XrW
zTd?JODqgg-Y(#l4cPpKZt1HM|KH;u*Zgy?~UZfXZ6pLG1ImWWvY<sT2Z<vSQKz+D*
z_zm;$8yxQ)I9Xhg_S3nvcGZQ7hTMDCP9Hmb{`fy4A%`#U$H1&#Z4>+Dp}2Eb?`37=
z-nx^RnhQs5Bj;P1S=2yIy0nxw@}h3+g;7!2VO1t~vt~^q1yEW?SyR$6TH6I$pI^_!
zCF%M*J0CwjFxbwH7_y7HE!mcWE8l<fAf>oVPD;~qs~MjW*y2elOMUbpV?RPuedadT
z%_ibmvsbQJvZSF65PrAH?}wwicOE!k129)Es?S~fQi!kbGYi)0n5wEUr0(8SX520?
zdiuGEbJ|1aM}y^knxtXVmE*vMwlnW8reT?%$tPA52RqhgJfammLnB_8i>*e`&j&bJ
z!qE#wr0xFU2x!MOz$jK()OElDY0bVmW>Ew#wi*Ao$!w*-N96utVK67&5beHr5wmSI
zzf{-1(xNpjvxPKvD@Dq>lB{y0u|uwKvP7u{x4>b(wkpuI+goZR-5qr$*e$G&%u>{e
zJp;N;%_5PF1%8lPS?MDaD~(2)r`2B7;@F`cHFfGZyAECd(C63=xyvv&vDmW9FKFDv
z@Blmes@4{x?bSU;?ml`{iN(CFwP8?SM=KlfEBn;Tn=^^sZ`lov%^kKf*rrm2DAZTw
z;A~q*Nn2g5-5sg{etyAL9cH<pOxva2h{1Y4#k8fC2y797j|qdAKBjiDW2XK=%EO15
zS&uTZvyva&y?g(D^23abA7j))79SErc%T%}c;+>d5K-v)^P%Agz&(dTsxgOdAb9c%
ztsycKHA!n~%E~4RgiaUUh4%paI!tJD_;q64o}Ye&q^;yQ5dVMJ2k7ruVTacXs0b+g
zVC`B?zF21E;BE`UQ^OcLXtl4EE00GqUW^qnAno^<_-(kN@6hPTdC7(i5fO9eP6l(L
zFZQVPU?zZ69fstnF-$K~Pf`FFZDlr+P=Z1%%#<mSm>-{*ks<k}P?!3%PvgT@F(oB=
zi78EOG>Bv6qIG<%Z>X=u20S&D<rR$$EiFv|<|`}nW7I-=C(<iWW~39!&TJPEM;BEu
zu<Kl%JzSlfeR}!%`TF{Jy1I`1tM?1Khh|#GV0=Eo`1E92ySoW~iNKZ-(-<j6iXN%;
z$cWtv3K1~}900V5x{rkglrEE3kP0yH7gWjXGJya9O0>+_i3~UDY;|^WU{DbvzL(J^
z5=8*4S%|>sCgm^bb)A3%nvJ#h;%K4`eSRU_&z78riQAq9WJ22vkZ0m(Av)37v**sC
zjsjp5B`4Y(yW_Jk@YOGQ#l@Fl(zKauYY^*US?ADs7tXx{J9@)weQIp$Pj1$PVV2&5
zn@7YWhYtw|hy;G}0F?M7@(;!25KoF7cn^yNUpk)T(w8Iw0fR=5TsRpB-npKpA(6}i
zW&seqQ$oVOC1Rv+b5Vlbw*|`->_2wpOdpM;tyADjk*i_AqgFAqH$-A0zisweC5Llc
zl+o|Q;z5?f2Il7~om+7cBIrU-3f^f^F(ts17S{pTdjMvIgw>$?IAw=e3ZH>`=u#<%
zDoVu7&K3c3z$L)xsYhySN0~1Uc3udW2mPlLg%Mwa5kCk`eF>WSEpHagScZ(qrPc<<
z5d=tlA!=~I&Y-|9rLR$bHO+hgAqokN`N(I?h0TsgM?oHPSYvD`!3)uG7=kp)Z!~FO
z{otD;6Ilum4mJvI8f&~@GSP%S#JFMYA}QiSv>1LW?}_FCa@0ogwqFp2rBw!L+hp;@
znY&2{!zSJS;W=pg53pzq14(;~(1rkcdlvft0~Yj(ND!+ABHL~<zeW;s3J^ye))AzB
zbaNr>h7D^bJLwOBSCd^<UEN3l=H@D++puBo>;{%~A2!U*Sk;VF;qJ!j>aq;H?U3GS
z@|q3WiGrXsFiOT6&4!U+tF2SyD|W?-716YA4BCBUOMF3eqIXxl{`$+vXSsu1Nh)2J
zNCsnp1dM0U`hjF6CtYA&9Hk9e7xZ~CsfNJqqmBjIXXFG#>MJfrfQ7|7FO{@L^|%$1
zx&D3ozSvhIYbwz{RtGvmZEfJB&VlO3`jRG%1TXdV2PeSH?TKnFxwI2+(DwGFKm+tE
z3?E_IJ~;}+H##2h21ULG2wVwFDA-THlPPx(uqepjAY~#U(*RGPI7x=AEgoi|m~(-)
zhYBEwY{JGuJP5!ArZ~@ckr8TYNzp`FaDG(Oh@#~sD4mZ|`P2?-T2lfq<8|bAxgs0D
zoVVeCjN2F+!MmdcaKQ1z2eBHs9z7ogxI_3XUSo|HgwK<T5c>m5(ri0X|At~-FF~50
z_&2?2U;>%AW~UNfR}LT*YDwn`w|q)Bg@a=c_(yOp1uGh#PSZVf&~dyD|Fr~e<x+l)
z)uGhVx&UN>&F)*5e}iTy*>zgkwiVnsbDrMrmUi1JK;H7m&c1d4!t=#FNz;h8p?;Pi
z=fWA^*iO|X!6s%*ZH|@*p5@n;o2HL+(Nov5tk<|@VW43gwUe{zLBpe8qTttpsDZv#
zEZiE=h!NvgJrRSK`?|C|K;e)c{3|J`PNb2@B`q#Y2lTC4+na_1O5ti^f>Hns7BbDh
zEEcd8Kn#@C4DSXzs+m1a^eS@W>1^ya>5weJ=%BT=y)kq&v)1fpg1qGjw1wKo6mL<3
zq6x#8`2Dx5m`COrjLdqhEIY8WJOhjH8EiZ5f>oZ%q_E~w>7*+QeU4>a^!b^o4<4i<
zv!g(tm60K69K?5XADxt%x(RZBS<Vt*4e5pgp~528qTpuL=?PFG&+(36mCz=}qv!Y!
zMc-w$kY~+x-JnT6z(!0T@*AYO&*AnQ-4TVT!H0P2128XNW>Qnb_+UO5>k5N4y1iY)
zbarqkV6S1N3K=IazkFcZ)~)+5S8y_)+3VJ=eJ#p$3!&`M;gi77zf7u`aAti^3&*U+
zK5*>H0qhH~3~9THiJwBB1pD#=6b5a{<Sbsfj8`6#Yveeya%C8;Ap#ZfKEA>5ff{Du
zaE?iQs9|$2-R0PNhbI^V`+~ZGW2}>U#DG0fWwXTvsCr#PLmg5$iuDzhm6Wc7y9z^1
zs+1Mso0?3VC9-RY2or}YX`|LfW$)tEtCtrNGwf8(uCBu5bOi;=BlxdQ5mpW-jOZ|o
z=qQY+6GqgDV&_O<U<4}xV=A)LXBC1sNY}JN{W*fV5$#=FypA{y8S?3;L!F&1`IdGY
z4+p~6*YYBFa-8xTh$#}|u*%Fkx7d6<;rri8Fc(c)xJdBvHAG`qla-Uv-PTf_mr{`b
z@L@@wp3DYoYBNraLPuiDIH7$me*ax3Ob61TwbWN2wqqtG>l2AoBSPdCxn?S7)R8x{
zj8%cZKW&!Rarkw=;MbkNuN#M7H;yp9ys5Yf0xBp_s!Z`8@=FDnWs$7qouSXo&B@8l
z0B;CEgS7Othbh4F5L3E$A5@;Sw3Bk6wRCOl<TWB5pr)20Jzz~}*-oIiVWwlIW9)?s
zUrjc3p>@L4@#h^)<)$Q4s;SUaiiK@1zlq)V)mIBlvytlGhIZ4m&9vF{p=rHoo#`FZ
z+om<9*YO&Cl^*AqwwrF4Zkg_xvP>zabW@%w6Bk060IY{2I0Z!=TUst3i-|$b*#_7t
z8<>_x4O^XjIgHL1W>p`ZblnE9cvip#KTS?EdoobZ$hbLHr_+70M@zye$BbRGX3TS>
z2u%-@xDq>q*}(!1MpGl=bWrq0)R-{~Sa)Uxvl4ATbCF45N*M!F&or`91Vj|9JAIWN
zSvRJVxyPJmj-Y+X>}IsgN6aRixgsW%oxsINckU!MHc`u>5JaU-12Xh>#!IbX9fm}4
zRwYfCik<B`9q2~Cm2ixgtwt`BZ`_C<Fx5-zU8y%9Q_WEMxReH7u)hEZ4ULV|>TIe<
z{HZ!s4lAFoJW@sj8X!hRLPrXt1ZazRyQ<VkTvNNcIM5i4yPLbGcP~&Dar5=|_H=g-
z{*R}d<!TD#ie{LuCn7Qlay1q9mLI}jH3g4QO6&5)JCAZ|Y92l6>cUeMhO%6U?S-><
zfoUK~(idB$mf#DuHg<{-rfn)ko>Kh7jyA;0+q#UM@Z~x?9%@NrPjWE3d;g~qP;GAm
zfm<rxd+JVOqX5@PTU&9)Y0X50OkaWRy$B;c6V}u#n0RPVeY2o=_H2de;Q5bFcYk7%
zC@pFqB#_06iBCVZ@L`KyK}P$8em+`KHXaI$wqtN+V&TqgCI=*MMg|+p%7g+hoCINM
z-({O7K<C{;I|~naCn#e#XoENW6+SBPCCY}N4b`Y+mb7N6#ULVlS5#Hobyvf5G(;l8
z3+bed-MZ_J*3SYrkh#>}BZ93vSqlqa->xn^Wo@f+!zhg&*AKP@@!>ctUq2s9g@uys
zYH72xx6#@Z$Slx#780=(uCP>AptT4<Mr7E6MX$d-57pOPSH3VZAYjfM2~7V0XSaax
z;NY<@M28`5i%jD<hegBTBA{+2rOv1a5~OAO*R&$`WFv54(=+{hERlg2=Z(-G8=yZ1
zVw?w>b4nqebh*RIh4qf&bab_I%+kY{M$#g(N()gE2Bt|CH0N0u&O}1rKy4r>0|3Mf
zA`d7?#oRhS4HoZUJ_OmpL8y2z4Uc-kZ1#Zh><+8=C4LUShTZ$yZ;|-Z5r*<h{00%o
z44+W`;QRcu;@!LN+##VR1E8UPTo{GqEE4jY8yjj{n6`F}N-XKDd3+VK=yF@%B}<o1
zLl6jW(UDLj3%v5qRH_6?6DY>*q#1CMJ>$vv3C)hwV1fHlv|-`w*^!K#u_0yn`yh)j
zMg)AQ>!gshi{E)??p$2yLyoDd;goy!)Rcidor}`o9a^!(#?2{=!Y61JV{LN*<=!WI
z_UIfd^vDE2CL+>Ki%|6irc4F2dJ>F7(j{=t;Adc#B2vJ2agNR^n3qnju1GqyMM)Q!
zEY48&eg6F2=9xJPBQ_Z`a~fu52u3UfGt;%K;z7bU-+i$gp84)CzB_z)@7{wyz-aj4
z;5Qfs(8(%m<Ksb$s%vg-?$9XW<1srsOh(KRt?16c=Wk4a6T27{K&JlQX7P)e!oqM2
z&m4ZS_#hmqgEWM?5VLMM$FyDNWMFn(xc4xlS|^7A`Ew3|deMqUX54=B!|}lEPLXn?
zVW5$6JpP;s3JPbe07ZN*UIP};novCTApnMapm-&mY$5g~3=OnnbUi&PnK4*}{8g=6
zcIMTjTI|<K9d2VC3amD_R8nNEr4~dhW?)}VhJwW{ZJmrrCx<%Z8>_*{(Yg)7_EYkr
z;v`TWl8TE^V#hk?GU8sBbL7~Dk#QNt$!^}fnW8U8Svh)IYf<X0Teo^<#8&h#+-^j7
zMPx1dmvV@#Q*v-!P(Cy6?cE7!gP$h*=)iXf$?OJIXA@SVZQE$AuDAKknE#u^F`s_=
z>CR_?>Aa5@%_NZ3PzWD)by1*aIXZD3$MrR&Wo2DUr9Ysk$WUHdQj%}xbzJ^t%gH+e
zuOl-H*}^EGRmX`al}szXT8zZfo(xFaBR?HY#Gu|gdxNqZGJZP>*6o|H{+EjjAN_b#
z6Cvo#Mf@5jc4s6IIl5!!0)8dz$=23GJmlg-=(NfL&j07bpWt@BTsm;rh++NBtPX2u
zb?_2_)j?A4+_;^bSJuj*U?f?o6-V+If#rghyan{|YbFfH{dJ+GVqMLFt!PfpN+7k2
z6Y_L+F~^uafG%=L72v2T%nqT=WkxXXV%7XcXzP&EGYAvhNOr-Z1YwvF4dzsRA}Q4)
z*s3M{Uc#kBf$H)2!k)`#1*(U2zmO53!v}j=fXDDI{jYWNcZaS7Ey%m?{N-=G_11=!
zbEko;^y=z$8&|E0fM$qAopMgO?!Co}7cc+d{dFIH2==f}ym47q*9YLU$B-o$6}SF@
zfuTXDI<EBca&vL_@bL8s90ZD0#KQH{hYc7oAPCz~_Vy3#>+fsJi9*JX4bct>3xQ_F
zOQWJ(z%vOPHo)BjcLRov9Mji-R9Mi&@R3MW7#A^a_|Tz4BP04tBx9dNLIB6O_2>M}
zALZxctgy1S>@*WWEC-DDM&XgpPE#lL2T^%?^>*M$4gQ&#M>GPnA3B@ni}gfc0{o$(
zMGQqW=#3_cQI$;}QRPjIKYCz9{(!y;VCzzYH!mxzxQrILDJ!J}3+j0x!30Ixa`Ue^
znxL#;0@9-EsBzHQg)A8`q@)}zl@B)zD2W)1JzC(Vjg*1wQ`AzEaN#}{(OW0lP~c`2
zA1<`@p4V$a06v71!Si2x?X?NP!5)uc4U|btCx1u;;r{Y?%n^#Ay#OeMw(0yv7JFZF
zGGHnxxn*sPb|}+Uk(Y9R#E6lqimT8yTd$T`jY>$U_Ub?J{S~CO-M)YLICTEN(D44&
zHC64etcvLGQI(LOB@R(xlb(O!g%@T{4vQKdgqk-&Bf_FS3@5a5RF=<&QDN4|YPT64
zSPlknwpu-C65cy++VIK4`r*C9rmb2P32Q-kGdaXAm<)BL<79&d4GJ03+uKH~wCUwP
zBqRumq|AS5gc-{qTNO)t8*WXS6z$uZ1lrZQ7?sr8lC)BuYVl+6x|LGQyLHmfl3KkZ
zCr#4&<7pb)L-JA)HVs2r7Zj?=$)g+)>iZ*U1%=`aCGn2b+l0x7Ks<<u2)}kC4FsMr
zX9dWCLRF}`3t*b~168A8KI$(xI6GSlb!t$k2G7#sHAq!K%{aBa&)>bCdBxcTc}s>y
zyakQ82^w(|G~zf4N|?z9xTg=1Fbcv-AuS>X91hu($d^Uv@2MMpEc(G*OfKIN^&0Wp
zk(-vC1z2MniovnWW@`!;N?D1Kdij9fwo|W#-)1Fv{opeQa0@*CxVX4quRm<>6#zKI
zwV(LjrJv)bPoFkODRxf%@yC0PCdq*5Zf;=^t@mYi(2W(jcXrci+MCz|2V%qEw5<~#
zyq#5E86k+=1pal4&-QBX)z{yS+4C`_UXG{KOL@Dzix$Rz1Wl?mU1lOlzQtr}<(TB{
z{g*}eSoSB$ZGI#_T>{T!Z(6-pCU2)eI6FCl<TH_`%e>M`^9UDd?`oH)?Zum-A>kv*
zZ79wd+L&eiwa-(27TQj*at~nFlaBzd?Z#j9@0}2=&xGf;Nzr#5{hkLg^Dx1V@Z>A$
z+9|<&QFnJ3t(jqut;0~h!p_sh*45R)(alL|=jstb5{34I#o9T+irQK>XeO$A#*y2w
zXpcexAv;=X*SoiER&uF^Ccw$dXc5|jyXVdcH-A0$75~Apcts;EP0q6I-P;atGjWXn
zD?P8v=gi%G2&ep1rX5H5FlGV=?&(7$)q<@hluScu*kYivv>@zL0s$QaT?8?w1@lTQ
zOOVbEUM}c06##v<LBdV^W@`$?cbdAyR4@RhZ5Kf?G25)5i}1I&O8{_r?Kq0`n3*BC
zrw@^gi*4A1Qft8V?646DEf!1R=O;HCut|{OCzR5&w*=qZ+S&$5eooHB?|=Ms^E}}&
zPaa~P+`&BIFi*hDBI7V<m=I6>=s(PYrzXK)Oem|TXA~w1^1c6jQuNFqt3S>lt;oyE
zaeEl7=?|p;mx=IqW*X)SHv8r*6y$#te#Nr>|H~W`3v)~h9q1X3U;u>v@5=lORObJW
zvrHn)GARF}_?3pgHyQrM%wk^g*N%higA?$SaQtCHJT)KwVs2SIJ-IMvQ2XJ}=SR<E
zvijp>(vE}pgGBITLg4-nbK<Ef@fXv}>goA~Y4g8+0Rf@&!@LRe7L%#4Xa31|Gvlp-
z8!GsgtgW7w^3BOEqEr%n4zk_Pizz{Z;h64jPApV8<A~bQrYrk)9HOJ!k7x6Ib|c*5
z%A_OIOJ5-gh>Z=vW^*n|D;jl^INRDnPb4J7*ZIr__&r&fkPu5i2QfMim>CYl28~(s
zW+>q-GBZ00F+oK`=SL!9@+F^%$<48upoE~zN3%v$*WS>kkwip9SQ{Vo;GClPs)&eK
zTRpAGTUK63xgPp5q>A4bQ>F`&jYT3(OcTRJoUMvh-F0-bq5KY&Bl5um{{2m69V0<s
z{X4%ljuL8%=wSdo<kN$a(+RyxYoB>REA@s}>ZyIER0z&JwI^6s@hJ0AN>)x<UWWcu
zjHDCkP(-SYhPS>D*^=Y=gNXdU!QT7aJ(RbNk!+n0@Ay4!1TZu$F)+@|y3j~+3wtPi
z$0rg4R+X)yi-^b~IZCUjd0bOpQC3}AslOj1ks|wsbZQkIE*{>_j_wYwDpZZ?dD8sL
zXzj)rd{1P~gZm}aZX^Q=3#loA9YLuzl$Q%Oa4sSwfBr1FB$VY9p>zlS=}@AV7127q
zPd!0II!3!Y8eZ-k7@Rr;+TZ3^Fo%Aa$j{?HNBOcKcu!;aiO7H50B`R7|K+{FDId}#
zZZbkczQaEq9<w3j2uDIR<Ou%hgvYuSlr{{^E*rp-4w1KP6gS`iD1C)xz8Vp?!-(?c
z0kJrTfcv|D|Gmt+Kq@v0n|dc{$RG_FtV32Qn}8By<mQtn=wsagIGb3EOOciV8?)3v
zYbzlF^XJcEBQEg7Nw)^orwOaWW48NWo*>=20k*bug>^vw1<XtbHAu)PTY?HDfA%ct
z{dX>DmWjTQiEzloFvvvD&Mria#gqn&sLcs&KyP|I7Df(^iB18d01+{SY9%6VC_e|d
zXxIHuwoC+fX8{r)mSR*lK%gnAv7BFy9W)@SaQduQ^+lMMAsgNY0JMCSAKe$^6XK^0
zCA*b?a$G|uE?D@+>JK*1dQ~*D3bq;DbbKbq*%r~wj@nyeI9NevijsEiO46#K(P<d3
z#~i}^#}m-b91JO)0@e)TR|p1nb!*j7y|jpAkLdy>fG40v|NWi+oc(h22i-MIf;l1~
z420(zr(^cvhoFR1DER^I^JY5#@hnHYIi2}TOZ22Y&ZN5?Bl>~=2o{<3Dl5ICPcOWi
zaSR@XF52`tp9OBpUDGf8aMK%%^*&uR>jNsmP%?|@Vm#T!%%HhCX{)}fsHHLk?xjxZ
zuX3~Xa~(z>n?GwhK8s?<oA6n`S0~Iti4xpU_bk_3oiINuJ^fMY!*m+J&!rVsu?(U*
z;o0A-6S`5;ABI0DffB?Z;O6vHZl`6V5s06Qx`TZXK1Ub~Z5ThtV#`-&uHV4z+?SJp
zCHtCMOkKQ!cjkS1+5mpGeCzJtK)5*{3sAA;kJSmirq7-^#<inn{)~y^qr)cIo!`89
z^9e(j$#1ImIa1HO1LUHQz?Shqq2Xj9CKg9xMeu50n}%uI2L8+>W-THCOHoZ<Wp2Pj
zE|Yk?8p8sQpjE80F+Lw~GIM!CC9gq!!fLO;=hkkR=JmyiY@?mM!DI0g6zuhp>g+F3
zpRf#NMsP!sGlRK4VMztb6V}yMQR;<()-*-m6&p}l`bjxKH)<rqL<V)Rs~dWr;aP#I
z%c8;~>JvJm?g(y9Sk=w-3GJQT+&sKI-DosiO>3IM6hM8#K7aFq=5Y_gxYHeG-t!ib
zAjnwI@AU~KGK?j~4SI^%080j03QWkHTnu{ws*Pu4=cb{?#c9OVC5;3*_NK0m_SV*}
zwsu4}J1Lm#8t}yq)x*4wUcJ2A^WyjI+m}$-;tFrvrMV#a=Y2ar?yQ^n^+&tEy^0DE
zG2y0aX!MaW=3Va(#+}C$JQsH`lz$tZWqCr}m$b&*D?(evYQIKy$h)R?PIN5cakmzh
z-p9=J7m&f|RN6nl*VngC{{a*`@D-;5CrFj`9k(I^4jML@Av$J~eK>d%cgYbE26qKM
zm~7^EGecsO8$VdR>NUWcudQ1B0mphxTQw1G-8BTBXnTPA<eM=?60k;ul3$sbmO4kU
zrNEXgLv|M`p_XAoX+t$CSKI?nrOTQ~Kw+22Q1nD%A?Fymlyd}G${JOq)fgx{lm>To
zQp5Xm?*A8WH;+#=#^?WM9sGZhb+8U2L-SVmL1V7N%vlG$J_bt&5a&|5KQDY|dP9mT
zpcVk*;4x8}1icCG5IhLFV>(?F@t%CZ+?3UZbsMP@NJao53sD)QO0tx{$iylr%?6L@
zlX!zrD2marP_SCt%p5WRY3ZYSA^g<4pZM0TeGve)Y0PbvXUyk69{VZo%<aswR_GUz
zy5E?w<3jAp%6{Os0t`omo_EaCO3a;jg#G#4w{DHu{7b2Yw|BspDPi6$yMFy^FU*`U
zW=MdWos8AEu~J*NfFWZh%zWXs_3K%-SNN1M0p8vgrN3;6*{ZdTa&IicuYTNyZ`ynE
z;@Pw3O~CqV#+JW>xg^ksh{j>f+^B&L7FhRNi&4(P1oX~7boqpyP~C3WQOAV#BiYBi
ziP^mwFf*by$|WJTiq6^wk^Sg!UrxDm=k{-t($kXSZ|mE2%C^GW@k!YG?%VA<cXCSK
zh|%_<hT2Yr?eHZuf<FfK2OWhxIw(M~=rB;YgO;O2tytKq^aWuDdrC~BB&AZMbm1*!
zh7uCb0mYKQDn*VCh5@X@F5GBYN(%19D$FG+VIOpL;SDU_fZ9y(R;1c7ptzv^lBFd^
z28G7xO(;Z2D^-G;1cZ;iU@g2u@abq>PXP--p)%t0fBsy-j~EXbT>=?>1u{AwGCCeI
z>JMq8zmRh9XnG!{*Fm9!%!7YD^-VLgQG5iX3Ycd|K?7Vvk?n2<T|jS}>ADc>o{*5i
zczb)phT8sJLP8<X9^{L$U0E6BRo9P2A%yZ$PcUN<%bmbtu!+OIsBCvrIcHIxd{9FG
zS|yi9!Dv1Rtc<o8={tm`Cx?Y081)-l-e}Z$4jt-X0K)<M*}OD*=+OQue2)(OJ-wv2
z)6n3)&%7Q<6Xu1c0}<veXyzCY7wZfh-39`G#Dq~yj9ndUpml9GAjH4(i*Ja9Mq=5O
zVyNrX`D6Tx(HRuXq6vJoXfU*S3D##!WOH@W$K{BRgTg_<HWlRqA)Ocu7fe-p+ssn-
zzdsgb%15KbG@8RlYXw8i+hbWqAwV^vg@_kAQN#W}Uq=|VJ{YxC-eR&4YjPiqS|7SM
z;*%%=2yz$|=mUtEy&gNffldjdT0n16H9hMBCzjxw^4LcbW<)oZA&D5SI;{rHWMqV4
zM~C_19}|nxzL^B?n&va3;DylE@)|6#bNG3dH|e~TR$M)C{S2bA{9<@0@E#w*Qewz9
zhhU75!{E^H=~F^nZTH@i1c!z%K^i)`8SPtgSBrQq_((7wqOja12~`Vr6CJyL!=`A=
zVWIW~jvtecEH}LwHGt5WC>r_F@-RGk8s6x~oKE~j5vU3pH7i%JrkaARqJ?AqomoZM
z_mH&%$F%l(Y}SVS3;>q`M2WKh6}LEX7o~r43SjL()w^gtM|%}^W&>Ri7^8qD+5k!S
z|Fbum*V_K*_fbR)cHi&yn}~xUC+YOn`*-dpCue15rDv3uo;gGIaxqMNJSZX6#doe<
zORX#+*f->{mQi>k$f(%idG_4(l$;x>MWu)vNV2l7Tp^$142%h_s8vGFvag4Pgu@xn
zLv<|C<kHf~TBiM481_XilxD4XF)AV&8LctQnx&zrrZjCDEy}kA9g}IkMwsa$A1K~`
zKPTsA7$0Clnl+qWr4mQ2L#NcKpSQiUqsrC-`?gw`Oo4&$Ok!xiSUt`uMpj^J@nc#r
z-=uYDB{Ca@%u#J2x01JYpsX~!7)j52*$469-=^2IL|<2@H%G8k=p9S+jxBoU-@K7L
z?0ubHct&a{gykGhq$4kX8+dzi9W(T@j`5otE<g=un9L8DYtcGsX?Z1Fk-LnM)k$e3
zcsKigOqIlpe9XtE(Avx&<5T89_Gdw34M2WMX+E|%&3TlWll|~c!QH#a*3U>!OVj73
z+`IoMx40z#5&A>ey9mY3Vr=5$FQqgndk-4qZ_|`|2}7kw&da!Rc>n%i;}cUjMM_e_
zulx7!`{jO4vW`LIkYCW(SYL|8xv8bCsXTW>TpVJD&kPP8)XN{6IG^qH$>CqlUi{(v
zqel)OK8%g3H4!Ew*br0r_eA?oocJmN?&&n%(`3|!!^z0QCX(-r_VSua%e*9!c8qyD
z(B+-tsa{^syhbt59MY;ok=;<HxAOIcFTMQo?C}xNlcGnWvK7fBnM#F1VQq_*!C7ju
zolJfN=XE!s#dvq%ei!<Ml6ZyviXjr;;JY9ZU<xMY4w1K1+AD(Wg2g_SnV^lpCU51u
zlAkL2<lw<A;k-BKS@<$|wuJ8|+IjFGw&e-uS(Cxku0sdcWEWMUM)Tvc((=0Y(v}wB
z&h%DNRzsgHFGV5e3iFOgv;&lpgKXQ2($fo@ZGs}TisrIvG14DZe0x2osBgo56#;>^
zEfvkW0V<WH*a|qlJu+as8E|DRpupQ&n_Fbq!C9iPvXd&+Hobg$d7(BJalwVllMB_8
zX3d&tS8%^vYr#4pXghdt-w{Dti@<@s2M>N`XpjqQmJ}r<#Tt@g2T4&vQtZ7MWDr6*
zv0@{t2iLMm@kt!Zv~Hy#rA_QRs7KC}0-5*$@`)1L?_%D(i>>6lL}C*QiZur{iE~9*
z!>p|AVnhbGfr2)sY@6r3#pF5f-`O^f*o#0=!@w-i-7wEE!{92ZX;wJ?q1Z1y0Q11V
zqRTPxppa>aFf844lZKkWfMp0#m6fF5#;vf<&|(C`%E>95mhVBy#tR0U=bwLmdhc5O
zx#P%rB|maLVzH>LtWzYx*<Ed&=gtKN2A6}ekltR_7vc6dXYf{HE$I!^W5R?96Bo@6
z2&A<$X3av`mI?g=1QWxdzdh>hc%UC-NaATS5w)#`ZD}-eb|zDu7}4(j#8iw3Zex{=
zOsrMYWPbcZ6<vA&I)Z<N2{EX6j^soHG3ln5pnSr`$1|ubfTVRWv4xa2d@@2bHa5P0
z@ou4CrRZ0Rib^qlzvCiwOmt>2G!z?P;$Z_leBXnM%5e_efr0KUEytM4X?&HAd4c{)
z48s!2POIQwib19@J27x|4046pVtsrJQj0*3_M!K}XG?IMCwp%``D_i)msk;sk^hD}
ze;=}eixr;I0FW_Ps-d4wHK1kBr&~ieiA};8o5iD$Cwm9#)1g_5Y)KP&1CMu~(u!GR
zY2M*Bixr-pbU%qOuq&K;SSvob-auS01lRMyukpe4)Hy|kKv!U%fwGs2$JyD%MM%M9
zAwgTshkb50!-W{=c&53Y21efzJE;@G%0v0LB)j&E4k24O_AHsc6&v@?+ZqZ3S`r*C
zL=>+v4z6Law@xyQ40R@$4!>~x^*#B9t#2Wr^g|59W2<mbmlYNPsDNRF%^(eUTwY#K
zh^$8zgTGZcs2y!=fjq$E!DfzXJa%%jwjlvey+i0}TAN@je&Y!I#-7>)#H|1!WV6Xh
zP3}TkBU3QE^9xYJ2g4aF0Zk8Pl|}*!8-li3x?{wmq|20Jh(tWQ3}a|$sIzFtj{3|i
zzx{UR*E0a1M65fqf9yLu!HT(7<As7As2Ehy+*H$q0zi=x$60-xooCKmF#%;mLT7k-
zIu4wTSu=kWik4dC<j4_Okjp_<=<NnlXUOp3{ao$ktVrutjL4?h9HdrCQ3<}N;JlR-
zqudSVax6>@2q2@OUK(ciW;Z)TBh7{%we)RisYz<kL!T4hKRrX}rEqVvmp>J~G}fCX
z5s(B&HB<_{EX82V2l|Hu6B84W>J|{!v$K&r1E(hYycl)Skj1Wm=|^}Y>4FIQ*xAWz
z^YY{_bp^TgB1_lH59(CCh71o54nA_^=!Hl3FJ4C3QJK%4{iqlJDYiup;n&-i_U_%=
zx48`&y}Tjex6aNVKZ-=c6m8fPMr%`AicZLFZE0z(FG$TWyh&}7SjD^V&h}_)Yr~>B
z726buH>`LQFsrwG(o_@*a97$|(=|;gr~4J!%Dkq@<*&X1Z4)#|EA03U2FxFSpuHaZ
zHqlIWtUKk%7l9vEep`$zP%)B>(Gi3Z6R1JrgW5o}+B<H7z5%%$^>~pCVoN)m;<6CO
z7&$!=r!vfDDeXp_&B2X<&S2S|dFT%rUF>bH-QbUTI7ZmdN9cGc7y9L7A{Jq6J3&wZ
zU(?_)jcOF+UlfUn2*XcJPe#Vk_z-Mu<P^y<8Xb?*ZhnV~l^f7jGcmE@G#!)w&}Pq`
z<0n7c92*-80Vzwqx)-dj7!u1#US`=D5gr;=ELYN<Cb!`~nt1&it6%M}Q80s8cII;^
z_qJ$(mPjKa;EWAeF&-B6CYS{Khz@N7@TyPL^TWoB867rx_R=-)zB_E#(5TTPMvO+#
z%l226z1^uoUtn9Yk_tFG7q&v~Z(hL)lv%H}E1|-T$R-VL((poY$xV@wbYl`ycY;Tz
z0wQ(}_T=e)k$`84j<FZSoR-|BIn8zmB-q*e{o!N{J=v^#ZP436=<R{tB4UHywjm6d
ze*iv3032nMLQ|Aicu53tMrI6W-(kq8v9amy7K=NKQa`_a`*`vtN3b#YoBVsSn3$Mf
zJ36WwG$K=IXJ;(l-ri>FL=3~xx*IzKSXoV(Vvmi8?d6lELlixqh$1FC2499Ht*EfH
z=!OU)!f0hQ|HQ_@wzv6DVO~;=PqF(a8XxNoG7um+BG|h>5}8Jneq=}!S+5}@P=KE~
zZWGEc)QDi-KEh@~A}4=U2r1MES5kQYbH$P2SJR4$=t-6d`cc?x-HS9~m0^>J4ZSNN
zkLaBf3E^VRy(Ysqd9q?XIX{NYfMtO9iOeT|V?Mdke6l}1S@`TfKR4Ta?nv{wht219
zn$PY1`?*iPH;rCA`CQ?94?HD&ZzG5Vu`x_B){j&4t27fay>q6Q`{!Cq*Lex9@MNv!
zuzQn^BenEkO%I9m;M}vy)7AOk&q$(g5$X~3rjO$3!T&#=fohf<siy~DdiaDMP_|j<
zlRy6q;alCH?|XqBRP><eIpZ&T;=yU5Co0HR+7o{0iB8%DB7F3dyFd2CA1oehkc|)F
za0rEEjfWldfUj;oX8`)*CCnC@)jR-l^Q<=m>ys`7V0q&R%hQa{i(q}yT&A3q6qLim
zc2AGe(y@z_{+OzhAQuuAE<JR1!4TEZP3{y!h8#I^<lFPffPf+qJf&?R|AA;HvM-`c
z&9otw{1U(3V#~JOhvF{h*bV^}5Xd2wMtXcZ9Pz#M!CpN0=s3q7zfq}SEyq|PPwEEJ
zX^tNcCmPx$&o5a3y#IL!IvN<-22yKA1DUNtTgW)!xpbt}>?a>f)+`CmKTblKA?S=4
zE*gNsjvh#Gd(YoyE<ZiS(DyL&eKo9&3pS?loez_hCMA{C*P|jG3a`~vS79?KeTGU(
zkUS_eAEXjkuNp=|unW_l^djcABWi;=xj1@zdwIG0`}=#iyI}_?wQAVEUq*||m`6#0
zQF^kUI<1$gAPf<CFr<)+A>CS0k`;vv=p!E!BrArD)QVgiNERN6w4yE^M4T8>-?JLg
zTH+gtd53gbOMEV_6-4>_4|9<mi>#mIyLay<KTM<L#B+h2KEifI)E&-9!+@tDi(RkB
z>~b}U#mK}$l}?(8z+wXtI2av3moffY2o22&f>z%mL|d3MXF~a95;(sFCpSj}4}P|1
zbFgRmcO;un7BscBP=?)G)?4@Q-Td(pgj9}vym|ju+o{F*-FHKVK=S1oQ>J8KDGZp`
zGxFj^fg~N<B5tBh_FWb->wE{eXv8u(Y46am<qz|>2xV26<;z1!fyl*a(7cI=(H<db
zC@Q@~Xai99;0W0+ni*(qGXswG19A;H9&vc?Yeag@Nb)Cmd<6L)zoJ}l3Y9qaI0T5C
z<fMHM9_(wnd?XUy-+ZAo_H$xgrl~imcxE*Epmfvpkk$??aN_n>lT@mKT4%Qe(JX*k
z1Cmpb!P5wuH!9T9^5X_@$!oBak>C|qL$a!oAdj9-<Xl;!5xIh0w1e9_;b_n<mjNt>
zplOjoN;7<59Bc`q83Ue3Uv)upj}OSlKA!Hh{J0w1)OdKfyHkkJ)g992j#PSJF&=;W
z%4Qj)k-TA$n+WLHCvkTtBzzR;A7`iMBN&lWX(%sxSY4fz1f2us2`SQ9TB{|nTimP(
zK+s~XYReXTduvbbBcBs-SF>;Ho9p3^Nsw=P4f4A+9LdR+<Sa8`LO3~(G%V{F(a2l3
zMry-=`hAO9Af4AJgq1JJT`_fJ)CUo;Uo_-3<ZwKVU~LUECG*2YS*ZLI#*Z~6$B2qO
zJ&Uy{V%*%^__(9H1sPNA6*W~2q@qG5gBsjw*;v&D>%-89@`A{fby6xtqQ*`;SGm$g
zskE_dH;P(XoSliK@J=YaM|fwWwRL09Y#M@Ip=^Xn=#`#a8RACgNHJ>kR5q3rmOnO>
zmp0cmRDtM-I{a5T?USx?gT45B*NBcB88XDY3!_NHThnQ?QEvbB{*!mkr5cJt`PU@n
z<*2m3o!ddX$&Q@+lWu}^LNn4Dbo)htflcSapg%GsX^Wx;k41eV4fFnjNTj&LqQ#Jy
zm{5|!?V#N?R+RlO-Q`9_PYh4o*et?!wFne9wzYIA^m^2c>)>`+HX1sg>M}Qff0b&)
zh{1!s`-F}kHZpYNh%qDm`vzNEM@N&9!n@O+>Na6@d=b6&B6{sj^xBKiK`%lF^?`j@
zR+^iW@*o|+PhnwJZcYKTj<6H8KK(Ivn$814hgcV+E5<@B;2gjQ#GH)fsS@H@Y!4v=
z#3(|t5vWuWF-OGOJ|Nw@i`%M;?q9!tefsq2$aqTl^2;wrk3Mmt|10NyeW3E|zwKw1
z1##msu4?K;$%69ox=s@(Gd{Bbw;@JO^!PE&VP5j~+w(c*?e{ovounYQ->wUaj0DJf
z9GhFANx?Z$3>^znJIV*aDK0G))Q_w(es<u{XU4mR;w>8|O&U28_(+V!iAyC^9h6)G
zsr_EucHH9baa0E`iy^x?k;m@cZXDT-T_2IdutrO}CI|b|)Hfit14K6@*A+ui2zyNH
zt1_{NbZHgPYJ-8?#kGwBYyud_NXz(At-+W$5q5f~p`$Jo2Skx$Sh(6g@Etu+B~UC!
zKmn-@PImTIP!SB%r%$J9l2WbimF70c!$YVOh^so$y=_enPPl4v8h(FbTJpbKHIE~C
zW-RwrjPI)$-&l<AlRBuu`0fpLWrkej1r`a=Ul|G+!uzFbPkufv*Hc-gZz(IwET?t!
zP{Qi^UyQR(@TbYY4|edlapRtGw-&V<Fc{00EgK`Y&N+GVB(+4&o}D;x#*CXcBiBB-
zQx-5f;?Qju7YhqSLjQcwb@Bz}<qOE4j69`R*i2m<3I4`?y0J02hh23#`p#Ss0h<BE
z2FV3s4pQ4>>C#!V#Nsd-Xp||7*G-r?W7$Z$8S(+~yYEh$hE?RVzmNo-csoeVaP<B{
z9)c0iP0J{RIRf7m_Ej-_bUdPkO#!DPjTbdPa||hkg|!7V`h?1uH~vB{bYSP2+EHfv
zUxgzWII7Ij*j?LzLB}$MVuo#S?Py_BwR+U3sw#W?lFp&cJg>YWcJ1guAjq12#GeR>
zPJYK|yz|G8_@|^qLsGVSBg*ald({J<Ua;j51r=N&8V!Xx0do|KoKW-^_lOD?V1#o(
z0mP1qnVH~#f;0kA0-HQ93%guq<QJWdu>su$ZlM^?AIO!c>yFq>H^#~&Mqx212;?mH
zdeB*$eD>_wtMQi%hD+_Jjo{w-z;NUI-o5)yBqY>d)^eDC>(w!zr{<f$3T>;nQRy{$
z%oy1%!-)%b!;l;|OR}}f*B2T|<D_);a-)fRNlA(AgXgVXySAgFy}@Ly)OuClyMOKY
z*Thu+===e2P`CV$*Xjs_N%<I)&cOlO+7ZVnMZ^m1QSth$;l94Z8WR!{Dil$^eIZkn
za|T<)b>-xdFD_lWbV}&+lT}3+{z~yc$9BvpWq)6)+80NK3w1nBh&^uJBuhArm7SYa
zXC-tQ_G&Ta{6E&-12BqeeIGuvJKM5Jc2hRJ_t1odDgr44q>6|gka8_3wyR>fdfC|x
zps3e+?FA7P6%Z*FI-!?@5=bwb-aAP)$!7O^-kA+W@Luol|IH*jv*pa3Ip;m+y!Cl^
zIK#t~0N&}gLi42cj=1^uyXUe_#jvT%C1h~;uxX!}6xO(I-8yY5mOg>gY0cqS#o&ft
zi99dWfQZL=6*MPMQXw=2sWj^=N>3PdaLIDW<+dK;MHn>PFb!fRR>^E6JqT$1a3IYA
zFvDAC@bdBZhw21ADp25hdLtkO2{r?~bn$=TD*r*Q`h{egEP5GDFJda41VNI-{#34-
za!8b`!e9}ETvd$mc$x&NVpc$hQdTq|VQN65BpY8XqZ&C2#FZE6mjoSy3;5syo9X>J
z%-}dwB0B3@`S_ahvPPCqKkE@oCpn%lvSsu>2rPnlsBxCogfS7dl62CVFd5D<JRs|s
zz`Yom*35;sa$3w4x3WmigW=<M@NuV^t8e5wCC=@}@_8<}c-+W}xdDftAvfUQ2ALEG
zJ)}~p?g~8nby{?&u+hrf@REd-4LB7AZM;bLQ=$yvY*LNkq%=@tuId+P*0_jm9F(?+
zD9P<-TuU?8&A7s5uJPKs4tO(4nISw_166A%)VFBqd(hGcNqb&RA6l-f>$REyv95Vk
z%VG2)(gvtRq$Z*b%^!M}8kajIYE8H-^zmJE%fCZt{EY7A3I+p*QkVh3Mo~5=YF)Yp
z<+2#iU>Ic=;pwu<2&ILQMNt9DFpEPCQjy{i&Thfs&rA0p*o{hWFoLS_`&Dcf9gaz*
zLs^2e^Z;#NeQ&Y;L1iLs2QUql+buSc>;ij>-pSx(;;cLMluMXoBT<94)PRYg$CuON
zL;Bq+JwIGu@$~R>@TRB7@fbb+<re&--blPeV7^#`8j-wZy%KRZOT=BnK-^O6{pk~g
zwut3bl9r<kDi&0|48)B?C)6zet-R(pv3wgVrxF%`$>Goqc?t&=EG5qJ<O54K7Z>!N
z)8Yf}_%NpZmjuG}FeW*k6v<$!u-YiQ&j!+a6=!lgiDo$Zxw6^9YUx>K;ad0MTFY^*
znV|bwjAPLNi7kP-t~5LE#OeIJqN2LS;&L!N7t4xkD+}P6b>?*51*{*+9)$wAV0b~(
z3!7$8kei3TSK#C}L8I*I?y0SXNmH4wYQ*fUX=tz}Ip(>Y`u&%^zaPmserRiC`rB{A
z6Tl^K@2SjVCwKn3{nw+2$TmXhql`RpB9a{*fya4NwdR8_w{Ktf;Tl41=VJE?niY%g
zntk)lGwyg`MLO5onhcb;R(a>};rcXA1Bv$=_7z-HKUO4796vhYETM`KYM4cpH-5tO
z`<FbqA{ENxe*-kC19W;(P*w*8RkPXO3YwQ*yeIj#+fwd*@g;%#WriSI{pxCR0lOdj
zQ!>-))#-v~b8~lZua$SWyHKX-=7!!*PH>lX^|fB2>?=x5zZ_zQQq|W7cD@%a(Ao;<
z#7ix$O6Z6cXdxsp_4d}dYJ1b8-Q03>Ax3vNdTo6@y<J@$9i6Q}TJCS_?6p~ehX|a0
zJ0?oyC0AFd4yid6;UlA>62la9F>3DC${MS+zP7#BIeU?8LRh9N(2FFS5dPz!AXzPz
zJxdw#`j8*FR;A#2D#>p-ucAk$Qo9ZhHUx$1R0;*F5>!?zTtsXg-KHR0cY8-iFD-^W
z?KU+-HrXyX_W=0VibMJ!Pqm7G;<eo^c3a(rGYc2ai)ktP2}uFA6t=|N`M|=P;s+0l
ze&FsiXIQ7;4`@ebx3;!}pRdZTfR;V!#TQ?^KiryyM0{d6xy#Q;dn0p^TUkp>y8D^j
zyz_8uve*=1Y4_ZBI|<t9`};i-UP+Pk6N*<x=(>J2rofF4T&C=;{ScT}BGbgQX)Flo
z4{Tj+9X7QJR)&s}z2AIeo(xr;q{Mq#w%?XG8SBhuaerU)w@H)6M!4G8q)F+6Htfp-
z8)hj*0^)-Q_U`#**WLriipWQ~w)oiI-+tTq`Hw$+w{F`m0O<lsQmy7}{k*H%6eLr^
zKaID6Ia9jxR-mNlG$0HYZyoT)`qD$&<Zk4*CF`N=>kX}CB{_xl%njU=E7xc#vRDY^
z`)l>R`r7JdKqdDJ;m}R>_VezpqG3kq=BDlk3#;<rfu;{LGA<7(k;iSEs{qY{&N<-!
zRl9cMwRSkGpm`?<J~lWMut{_%mvrGi%z$?TYr!AqQqsYTWjU$rA*rlW2k&>etU3&q
zgs>|!`2d$-l))p2COg>(x&YTS3H%t|8R+H!pW(``tYX*S8>o*|Q+Hsf;!uX9A2_r^
z%ETdz4aVWm>wS|{Hb5$SK`INsXewKCP1!%Lz_id)0x06i94qL=3)8N+`~tO-%KIaZ
zMY{J)^c`hJq|tgSR<M~Et+6nrf(W5J$b}1HQ4y4wP+h|64d(;k8D$>bf1tU!+JZIK
z<ZHKOWDs;3yzQ<!vDwolduO_P=_LbH2<z9c-|^c?#HOc6-fW6BAAJEeWg1du&^`$s
zuFvsXigWiOr1(Y0Gu$_*`8+|8)m<zSl!c!nK>de8oKQ~8&k6-u(ZyO5J4CrFAI1Ix
z%SczG`IbSZPGK8pSG>G*dPGD-8gd8Go(b^H&t)rCteDEp758!IL?p>#?{Y6amJCVs
zJ=w}7;7|f^M~^Xg3EYFv!s(oL?%4<b@J@Eu7!Q*|8GqMZaf)<5fL~#QkR|E*MPsDM
z0{Fsbv%bE%vbnjTp%$1RmpXbmcD}%JUeJQbBp*facxKU<CB(x06xsyLW#H#wmxi|u
zK=NQEh3+vlA|l)`a1ih9=ME0c1VbF`qvQanR9rcMoiAN7!8&K*yV0+-mcHVgh3}+U
z7(UL$q+2@=fa~h&^1=%jfrtU)G-5__(9gN&v#WEE3p4W+^s_uPaFz_R;{;n9tBYwa
zJhK15fzwEanVkc)Wn`7=!K~xLrw1Ur`A)(h-hKkwrNWCxcdlP+TIK3edtk@slMxJd
zhqyoC^68F?Zmw%qt$}(?kRQGI=A)~E<w_pOG~p5CqSq%rfP7kW{Oz?n-~@UaUP!&^
z@}#5@NKl6k)f_**^5JRY$B$2g=0Jd}e<`r0iusV}n;(GJ;t#-H)6ov~+$Q-y=MN1*
zq&TZX9N2eQTz3j`pZa<qGa{RrgNKu_qU?wC^f%LK>c-B0S;C?oN^|<SzDB(+yC;M<
z52}QZDJk-5i*m^SyR^EgtIyHd($rXkY?qalwe>Z{ZPtEkPbZjbIc%_;IZO?RFFS|a
zH(fp5WahwTmGMl08I$@;r8W<;*}S|+e~fIXh^038dMMR;Z%*#!M~G5@VhagUX?S=b
zdx6K2t_mn%<R4(1$w%W85~6IU+-%)4E#;<Y2R~%BNjf9Kut`RbPe6|kVAurJHB^?C
zVflc1qoTO79`$Y%t6l|fkrM(KQTX1uXP-HL{@l5<^)O7GKcAT`$TBjHr3cMDmhk<-
z(W6JpySw}Qk;%QgyZ-mze;+pG;Lvp>IVEvAGq(f|1|PEbm9eq9a9wO{GF;z2<Q`vQ
z#+T``UH-$9*oTJa;e|3ZCMJGJOlVY0Oeo+wa<+w!23U;|Ou3PLVs<}YxOW$FTYCUO
ze%Ic7pjdsF9+aJ3fK;k*u0hL}6(D_7!FhB-Zccu=1%^x`>oWrtp90N2y2-mh=k0E0
zed$3Ob(a^VM()R&rFGMziGv_ItCf)k54f)xS&Z4;N5k_NVha58yw=Ce;-yt=2HNjl
zwBItc-(>JDlQCkVnp$crpclGu0RY5V2p1wp<g!{I@z%CMuy1UxEvtakE48Cf2H?11
z+hf<X=NV^v%3?lMCOKXSem^d5-MV7rK7h|f?x|Df&Ye1P<kTrj10f4|AG6-GMhrP>
z-PO=<aj~&@HQu<LpOo5}O-Ti>xrd9yymS1xsO;w^Oqh!)Z>KaF0@i>mDm&pzv<;fp
zt>U{)>;UcDl8GtMz#ilxFi^<e^~q|l42L6wUDGFpVxL5vJbCWo1&gJzv8}DH4gp{J
zpqIRJr$9Exu|#BLo-4>D?@rdY+RF_f;q00Y@)SELO0DW7$LpY={{GXap_a0_x~c%C
zp?7r+Ku4(*kp{igQLDXr-Q0TFHNB;|(p&S;Tg%Z~&!D&Fp|?l_Zt|4%+rYC@@-rEd
z#rJf<=|%A9?zV^fA}?KkS#D2A2r?R21*6J-mImipyP&aG!kx0Sv!cQ-=sP=EXGTU#
zXJ<=BMrUS5My6Q_edV6txBTD?KsNEVf-S$lnTkk9F|`<n+#K+9c#?AugqH~a*4nHi
z#mT^~xQ*YiVeMLU=MvnjG6xE&Lpha#rjj3oIc$8qtWuDdm9bbs9v&MT2x;Oufjws?
zk{r7Lkx*|E+#cJZ#Jb@>=TU@58_{?9v~w;l$q0=)#f@|%v3&l;haS08l??aQFS(>7
zQD2U3Jc?V!_+iS?!I@eU)9~|`*naDX5##{S`%;j5eEFq^z<qg4V8_fRPggnL5BEcG
zdXOmOa7@-{1iZ*<+7xhU^bJ?l*TXXo%1Ko_Lw|9sUC;n>jy79QyC6qamMePkP63*e
z_}13ex{gZ>9RZ_UbL*v!?p`bwt*t#h?PpF@UAiO>_3u7^9)5SVxN14R!d5P5>Ujl#
zm^u`SdO_aN0k;QvPe%vbS~{u(Rwd1GkD=F1==Jx|>&wvV%h2m1u^=7avt!q>tSvCS
zig|m17=8j9u`s2jNEVn4%I&DjLbk{4KLC+r^JZ{Sc#7Iu^mJQu!?i@<hhf|a+F;ic
z0}o)neXGgI?Pb}{ZSSRk;l~bdO`er(+xt!`JoX=^T|*2HymoSXdXf<t`>e_<)cpQi
z*(b`9!RgH7H*S3EEs(~;g3+a`AY%{G86L@KyM{W_)d1re#jYn2e!_$a6K|i2C9s4W
zgeZ*9SsCp-7>3C&Pr(PTVKi5Ar2UnPvjH(f`T5J1jT)5<=jSf&fx%N@)%q4X(f4qX
zL<B{j<d!c_hTWF%={r!R&ir4#`sm;P_Ha)Wsb`y$deYTj>U19?tIQusXe2}r|G43C
zeh63%2!MB&O5vdo4u-my^yzhVzP_%m27~)0JBGbJYN%It_n<+@R%LW)ZR_an>FaaI
zs;(iabafw*+4Xca5-xt-ZbAC4DmM(uGMGNfsw$CVy0MWsr`fZ~0@Bb>d0^MY>gr2+
zP2HhGV6!l%x%3$#{P_-0VTnj(I2EZZUEKlLId(m%NgVwvptV(?wa>%ku=kU`kYkfB
zmcj9=yr#N1@66%DhtK5I)j3bB);#3=J$(3NHhq?T5~oMA@`_9G>q2l@Fv(?QozE?T
zvU7tV5W(1N=5T8pS#YowUO1H@ZpY4?%gH);@E|1Jwo5&I_O<FgyZ7ulyl>y(J?2S;
zt?u9l-C7F#CxKO(1pABM#Aly<cA}q~8+bzuH<hoSM&s|N#(3g%{so7?bss4#E#0lS
zJtyavJ4ee#vv5K1ZO=cp^D_v^|Jq-vMhYWv%{{@%@U}GR<Qg|`ils)A)>JpP_nCF2
z$F|~!%#r1A$ol$Z4)d^~Gz&mOg%=){1>$?9O>%RQ&c&cq`bHj*7}1@V*By}<xh~Sn
zX!PpyikgAo-dn@GhAnmS*!&}jUWv~n!$Dx5{MpeXM<%gM`D6A^XA4?g^n^Q>ELoE9
z&4`?Du`-%GT{JzV1y#5;5DH5npX8|KC$TqFeqfNRs{`4jwpz4zc|~3O1!CE9E@Wk8
zUj!48n|=Cpc1bCnUC7SLx<Gc&f}(;8?XCEAb6ZCT3_!KD?U^|c7I&e00RP0eRT|N+
z4iB!BuhMb6M&TA17>Iu9BsT&x(!tBj>HtulZ%Bx5fO!%RKF-_QUC9rTw#LRGV<u0Y
zJZ1>b2PMtM+4yk2vC(zdIDDO$5ao&`4;hASwzQ$amoANsd_wjFl$wHfN1H>7zz}TY
z)kj-D+(v!6Tf6#PutJ80hHBsk(oH`A+P_&1$01thx_YD;QUR*HUf=vPX>R|Gmn8TI
z<Ma%@Ocm1qlk9pc`CA)h6WI_tY-bP9;TSx;aOi<T<yzVGTHSm<79sr1gVfAM(S1@Z
z9S`UTeB6!Y<Uf_J0x~Fm79tA3z!EUBWO^USeCVKnQT$5j>t)||XwxC`7GQ?`C!Lfs
z1n^Tq<j19h8}r10<n9}{)yLE}g<@O1MW-F~;xW)xf2Nx+`j|r|7egV3a0FcvqCD~$
z7vDkpdJhl0iuW7PbYI(6GT<zrnj28xN9g1P>iZE@bR_ASN!=Wc!+@UP`sY0*T1~j)
zC_k0TYf(Ov3I<`c<KQo<ZvVWzRV<&xzBht4Q2slVf1L^*m-H(kYy{q2-Coz)2i8&h
z{7J_38*6ihvUPO*ew4zYK-5LZyjUf@>$t3$xN&RArKkO2;Asa9JZ+TpwA?jMd%Z@+
zQ=-fokupKYB3*h*l+pWN=rT&u$fSrGnIyJ~lDMMEn<Sk~<25=Nx-+%Y6^n*iD&0z@
zO;Sm#R8oDpBq0RPM#;aSBxOhzHQ;9`{|R!_!!VtlNm{_)_8!YTfT*dAJqI!i3bC{l
z=7VD7B(Mv?{cY9x1Uj9SU)|P^xuK@Gy0sE4QdLWJQB99IIxukm{w4$(0MLwU%FWob
zXV0O$rjB6DPeJWXHM<D3vYO=x^324<Od(jK<tbmRtha~PYOwf!Q@{^dh{b2YV7}m+
zH_bkcjnk(G*=Z^+wFiy66Ue}KjteRsK&O{~R2p>mWcbq%wA%0NQ`y~Yq~N0H>jP_v
zKMuajlx<SMCzJHeF9=q)fYFwu@*kR&!3!{u%+Z)}J3Hz~BUM({VTaaJt?ciRiz(Lm
zj`A`Xamy>gN=A|h4mXxQ*ry?YI}`w_P(v_uv$r&Wooi^dBU7z8Iy5vgGAufnd^e)Q
zf@0wl9~%@F4<E?k!{ft{-wIm*n=H7{)oixTF1uP~GN{ycB*H-)g`2Iu8cbkSgU#Kb
zlV;o-(|E5mhA*KhK_aDiZXA@TCJx@X{*@7ZJ&pEC^IxSzFjdm*7cR|y!Pm@w*OygG
z_M%Ie!EmQ$b}t>Qko9p;L*S6^`^QKb_)RmTyr7T0Evz;sIp%O5V|)eBIs1&8&5$w)
z=kf#<v(a%=E`Va4Hk&k1><m!sU7%Q!ny2AP;gyx}NP+i#cJApjXY%u_@{2%#*~R%l
zFU-w7m79&Eh~9-YHH9qSl96$$40&3uWnh46YXCi4di?O=<E5SHs_5u7Yx=OVB{>!v
z_HFs`yO#QvlJVbe-1yz3?CLh_PrvNSMChxLtrwKTb8?2WlL><A)7_9Rs&;=Wa5v`)
zs^{h++CF^lbLm`DQ!@LKeJRg5dMrDMeXCw{=iFIw(Ziz4QU|1Abz$_7xcFJOPrD<D
zt;bWF1SQ3suzNNNsu@!QmCAsrGX(DE2L;v6J#89I+n$~2;q~?L@h)n$i=kKR9pLKe
z8Rde=VsFjxAUEDqBX2Pv_bqHvJqoy?tD?2!o}-Nh@J5fII#mY-SzmW5J=|uit5f&2
zd4y?ntk+dh*OF7sTxzrXd)*B6O)7f?tar++goG@%d7+?+4w-V_eN#hlkvqQ>WV`nx
zC)5j$7hrnWEom@P&==%OcMtj^1$~i>z6j0BD=W)Hyb>bFFP=G*m6@57lYJ)h6gi0@
zHWNPP@}B7E9>JHCeCM1>K4g1>lCQ{8)85l#4qdk{I=VxRTpa-hMQ7Q`gNJ8Ki*<Aq
z{)DMwQ$YtfZ26nP!EXw_q|Afwl&H*0ph;p*fW3D6n{S%kpL=f0mOxo0W{EOK@N{Ip
zS*3j8_XGK|@L7|QMn{?)-jm-J4wP+LI^Epx>eSZBByHUr=7D+P%TgBgpg3QcL(9wa
z^P9?Hz_3`V8aj{_s;{%7y$KGXKxJ-i!pa@2tEfO8FH*|&JC$;xTF#0kS*g>RL-l%<
z%HRu7Z@q7Tm&V1*msh%a`63+x`GNXkUUqQ{4tA3ia59sQ6mY5z%qGoUGA&YLNHc&N
z+T9K9Za}-cq21jWr&NG5#-_0FIegAxm`uZB1;xnB4VfDXjk4!2BGcNYNtEtu68_y`
zMOw@}U@=u#Z1uMK4x_BEwN6mz6Jru%?!)Zi-XTaF#6Ywbc}osNYx(6N=~7`{>4ggy
zN#F&P_}To@+_TxFCgZ~mN_(FG#~+ir+XgqDUZ&#Gm4&A-mXucqr9kWcyyH0~`FDM{
zVFP6@KC8-Eg$Q)a0gniZC$h7S96Ba&-fEM&ac?h^Z)cNFrYjdLxZ{@bbN8k|Z@v{O
zs!f~H@C+tsn&~w|HoWlpWXNy(Fp9RrZhAjoZ8wZrB5*(MG9|Hnin;a7emiED#jG>k
z58AZKs@gL6>yoSpgzxs+vO4r!C8}Q9&?{32uyC2w8X&jH)vU*n4qal{$l*S^prAm#
zJ|<>xOw1Uqi@#qm!Wk52=O&MjqY_Of8A=Fp4eN1QsOF-FNVoSm+HEd+h>-VVJ6ap-
zs;f)OD?vLhzTn+`Tsj&6H39g*+J=@6IRRO^$)M|uw%HtV4f3nnyMdXlbYmTT;N8_+
zH;kpd48j~#z^-bWITlu6c|h1ZZ@>RtF6W)Hc=6(7Z!YJ%_uhUdEI`)M!u3{R1XT56
zObaT%L1BoY%S9ez(E*$P^a6{AKtxSwQr$lYPFoh(IQSkbQ>)SyA&vWX9yyl+gW)&K
z$lnp;-S%yYlqN&*ZM$dWoR!J=;wSg)%(LZuNL&j1u+oOW;x8zoW-gpD<KZ-fC4Ym?
zqJ0&lz(Z+RWao(ceU85?KH9nSM0K}`*SfOK?)2Eqvlns;3d%}~3NL2<@;%^ufA}Ty
zBG6HQxtVwIT;|?wKmYvm_I>aqh*qn4M|WpuuiO;_$kxH!kZHBG)2>0fNWLHPs6xvw
z^{UOrK)<K}l|u*MP_3*Pv14VWjl8?T)6EqiDga3BXn;FoT`Qatgn+u-a)m;vf&Nf0
z>tXIZF4$p(LAtBE&%|qRy)J348{oq!R^w_PnQ1K?!ag;vShctVk=!xHWxT^(Vw|Fp
ztChykpOqXVmUI_Ot`|#|iY0HkT=K^9f+$-d+ajheq)`;W-r*&DKwh9SGEm;NF(rEh
zL~)>i$U7HNfq^KN5%@jDoRXI~`9nk8X1*5?-dPPig{sn$v&W8R6z1h*?%#R{9EQ<r
z|9)r-c40fv<2`M`f@$7885!xm%f{V&69AUtxKsN*pa)M)yEW-$WUckVuzK++Ads6h
zp((F@liSdcyWzFf>i4pX+tiSy7Z8@#CiTc+gJR;NLj8YDhK^_pxmCfZmTYZe?6Zj-
zg)S6`g>T89OiP3Q|6lCm)xJ%X6Aa;w1tn!zH2M*w-mCQKg$I|B??VF89+Sq=t7`i7
z>#u)pRIT>ay1Kf#W98H$mxduE8kz>V%uNqltn=4qb+4-9Tw&q4cGYT8@|c5GA(W+u
z(JF+_eLGqu_AC@GXW<o|e=hUv;S8uT@HX>w)`i@>(+Bn)J9{bviIp-=QI?4aw~(6>
zfOLk6^wbnpw^U(yJA3+Q#ycPVxPO3EPLDml_fRqC{r0Qoe{DXV)rUCCzO3V$|7Cjh
zZG)^hW6$v&Uw!)Nr(f*=QwF*Zi|PI4(~MKw{{8QNe_yB?u^6k}-4jwCn(1Px$E<Jb
zSGl{Z&59U4|JbR#6twDx%;>ggOjy;|FkpUN6*hVSAcNmyAGu#Rb|{yRnY;wPi%TYh
z(St70khoyQKmI{huGb`+6n~$;vV9BT1=0QwrD@ITH#TH75Ae?B*vQcn2P>P~`vZn2
zM2;MVRIH;$Mvh1bmm?44;H0sULr1}iGioS$Ux=v4mrs8%rpF483cXujeGQf}j?4XI
zM|Y?v*2jLX&)S<F8yz1T>f;>}7#tZJdDAdNLI9{MHZC?g#xG>h@S)Mc;e!SZ3J(Dz
z8U&|S<VvgQkZECz3h=R2l;VPy?7AQygS*nCP{54<<|%31EkhqZiasQZ<bdur@hlXy
zr8#F$f{0IEmT_`Qi_aZ7dg9Eva|7Z{=GoKGfgL;zKr{5GwzajUj6!P)%W7JMhyjUb
z|BoNNlX3L)S#+)>?4Y;%>|DZ4A#Ul3T|SU-e7bTrZrqr2S^Vkg$lJaydT3&-Mv{DX
z)ikMN6NW~AwLP!hijE#Jdv+MJz)o#pVYAh0cXyS@;M7}OW<HcM;cj&L;t{IC??D9H
zPGx-hOK(h=+8h=V3?*G~2=Xt6ga!7CqEUa~#7F=6(&OK6IZ~+&N5YdYoIKALZu7%k
z$`1apVcBypJu(5^?+I5>5rY6rHIiFOGLo`6Yr`9>*O*cfDI>{7TiTWW_f5WRu@sd5
z_{WL`i3Z-B*hwDlZJlr>b@W`8nM!gRJmSN>Ix8zAajC4Lqq5rO9~I}(kY@o|XuG;>
zjE6l6TFEXUqSx9da!a0}-8(+X<v4U{O?{smI3<;}C+5NF^8AYQ!~hbNz!O3r6<`SR
z$8_x<WN>xS2Ss=jxQ?$2biM{xS6?sRV1#K!2YPvcUOanx@OZcm9<K-Z-Mw~RVG2~b
z8+?Lv_Di@=X@$)v0Hmaqb<`k3U-utrhtLl%(@t>(^pq9Fxo}Fz{mXNKwzIRb+5*r-
zOLb%CUz->bbGtDHx^sVh?X}l_{mYZYh&%3xR#d?^x=Im!$6uT<Jg%ml|9$cRCxWO$
zlNJ&0IQ^gJkwgzSbd8&b0cuXeU!GI6unhM(6bKpV>u&pN6HH=o5coJ`fq;uf@L!&6
z;$Vjcb`Wl4@9+L=6OXudxMSWigz+pW>?-b@5pynAkdI3a@INw6oXcaEdG@#?>yNCj
zGRmGgIu0Hd5+lzYAD0TV$vFJGfjfSV8^0CYIz^kEg#@LrGX=1v{QRN>c~g5SlV-da
z-1#QVc%wkIkyy1Nv1)nj`Z*g}oJH@NoSfowS;*&XlxtaKg`m#JV3j2$85x!4WQWc%
zmm5W?oHZNCm~{O3)-g!&{E89QX7&r6aA^n9Wl33C0!uQdaU)^+@nK>*XPAAaqL$y{
zlMmQBXzN|MRPf@pP-{=tA1Q!ce&R%d?J|4JosWb+2zQ`|s4s6J#T0+rWajFYE`u0H
z5iTAJBYgv7AtVI^qyz*6x&?r*;W>|1TYtLjl2R$KOU}9dB|Pbec+$;y(wFe0FX2fi
z0`&@Nb~q48P%A*BL^40*@hhM#qSy+7!~)1!`VBbC;v&MG1<YOv8AL45!^5Be>%uC;
zufq?*tmX*Qg?dd0#_UGDhYjD@q4WVdt%$-6jX1A1%hr7i=MLZ@I9Bk&R|hP8CU?%>
zQC)dz+t#1H_~^TL1PIQH9rIn^JJ^SaCIeUT+b7U;IG&fiacuo$u+<1lz`jzw?a&!3
z5Iu_^t*j8V-PY#1HV~f8R=qwMP^iyy8_G=ac9#%WUug7G(h4#$*vn$>dH(qo_r{cL
zKW}~NsXImtwr*LydiA<9Z4pnI*^0@C|9?wzEaG2&Y~chi6UQY_W$F0nH~1q-$+R}f
zUViwA6fFNR(P<x9uyjINTH2I{pL%I!D$Kw}uv;eC`04N-{aD=JQ9qFu(t#FJGV-id
zR#fJkFY8g56xO<;W8GR)Kx0)`HDtn^?BDGK@Q|N#^7GF>->|ne(7iGRK8f>@B5`+_
z>pf0ejQk$gvhR`{^UV{ht82(f2!11?Ln81qkxLL+AF3%cD7GqK&s0>1_<N9-Dk=d>
zfZzrstH5S~k`>W!Fk!4hoLN7aDFAvwCJW?Y4dyr?bBIuU_(tZiT7ldv0_;N}XtSCp
z0u2ntLmzJmF;xdBPGlw&J);2BhRpyR8!s=)Mu1=Xd3giW009xATcS?SV*c-UmPYMz
z&@#pMz6x4i4q9FgS{?<@V`L2#Gu=WiDxj2<2=A3Bn@CwCaYE9Dms}oly#OJj81VtF
zHlC;y8{$o6CV(-ZO-uwNi?oK6gQ3qZQ;<Sa&J&^}ZRWtQzSy2!Q`g!7>wkyk=&r9<
zVS9h`zMLKioz6HE&AR>dad9!x%?E%IC8bB6t2P}ev*aHC8O9FR--eBul$x44{-!~}
z-YOFxoU-jgr^&79<hFb6*|r`b;XiJ>`Suh^*mRj>h*RXjKOtlPZgVnR58igYH5BVz
zAe<4r;%<K`4L&_E4vYIcUiVHM1T6RFl`H=_e}or=;Y;DOpPr0a<_q>2)VxO3%;*^2
zI)eREaGksDJF*;q^yca>f2lC>C*U9EZBlwf$E{r(hfEk^oVfhKxB^(wi3;bt2z%Eb
z^O`z!YD&@+^QfBIN@Of0w7+u5=hc+T5<$KaEfVpGL<uZU%3E8DY%YLYsenT{d|*Y-
zgg(H__1jIn9TOR6BG6-Ku_?KQ0&tuVOndun@Iw|i^C(|GZ{#&4L_k148hj`RCc=It
z>LYR!fqMyln<jW<dhyij$T{o(axaO(o&kk@3<~=R6!r`#>={tlxU4M1D1vpxb^(5u
z<Vbh%Voq+}namtOv=;!?`TTj9k#i|q9G&IllCxb=A-ph+Snf?a7-a$Q3!1Vay^syL
zmwA0ew68+ofq{jPdY#>7lgph%hahu@IT=`ER)KAqicFJ3fIlc<K2LW%&9B**nVBgi
zUtaE5p?>Y7&wluA@4;P`TM>9ZLCmB+7C42s1OEF7x$yeyfS?&9?sFVZsa9=1dgKVi
zt|WUGD)#KNCf(q%Vcw0KA^04H>O90tY2pp>(UD#P56hTZY0@dZLXe{UD1NZH(K}>R
zyg8YB7rRn99T5};ZV=+l!^K?%5175|0~vDTN_m&9tPROQpoHR|SoHAYugpUrmx1%=
zhG8GU1p?Qth8<<VPoiD?bSM;41-Qmr3h?gB0bI&`fJ$!JVp4c&?aGAZ&K$eSyJJqA
zxNCYi2#D9ITm)X-*-+79Qie~z>%@u6NtPAM6O=Z!-aM|o9g(-N3Ses_GOelt6JB3e
z+tyKERR)B%7L1rCU>#5rJ36bcL#QdHQADE{VPi1q$lfesN%P3V!6WT4-&#^w*C+7(
z2(5OQbPxsLCMnS`7Ie-$E&|{>KEdJ^1mH^W+F;rO{Qbfs1Ar9o1K4TEAOJ?7fI2!0
z@JId@WM4+)%m49~A}=)ylxqg%E&%1u0_Bo@D!vp*J7s0%1a}WbEag^)n`tp-L|Wgm
zq~~M4EWpB!CEX0pUq;g*pAJ?P^eVU#PA-HVxU0iOYc-d-E!pAa80NZt`}PJ*iM_oY
z7tj1K1x~{w@G<Q}9dr2)PM{^HJEmcu?(nep(87WRhB;J@SmX?_3uYEP1zo=Zt0?Ve
zmX4HB82(ZBQ(m77{J&(fN&r+Zag5?tR3$qmJ04Uau5fia5=WSW0_XqZ7I+@@1^c+W
zDBZ`-dT!-Iz-&wQR7PSYme$=**c#c>&;C=yyp{cfLQ&rk%$f@8DVp-uLEFl=mRDJ$
z1b4roaoVClmz$R^UAlOY&5<5oR#}B5Qp~r2#wtgkF1$=DFrCqIiWRg5lU+5|QLLb5
zmDDVKwsg@W0a=g1-gAJ|rzYh2)$txc@}cA+NO1uH42cdgYhm*sus1I(ioTf5d<dpC
z=D%M|>|X)>yB7Vs0sSkWe+BgKq@r>_C5!2^C^WX9xU8}QT~4sbKv)u^I?&Tt6vd5J
zJ`e+aQh=2Z{^N{XD!hQfCkM&}t@NA?*q?A|<xDWKU?w6iPsC({F3<x@BAi`05m=qG
zi|M^XHbz9;6y=b+d3&hYnm51RvFA+9rK-alzuvSzyP&L#7m(_={M61b-ly&3Q>7kb
zuz6Tc{ff95%5aKZzWP`8u3(%X(?(62F>7dlPPSJstRd&l96z*k=LO_A<n*o{L1B6w
zY9v!?T|*68<-gwA(iH4E@^46D^0$$$p)EhXWmYdND(Vk3Xb7U^x#yCgihXR#kP*+o
zMN_kK;nL?;F1>k#w?j~HZiCYny*wFQowS>^&!!FTr)H5Sq%BAT6DWZv{{T?*MIzf4
zVY8K=$T)JUu+1&BY(ts*O~Ye{MD^t4@_cc&jqfhX$|~tJDYc<P0zK6*mcGhfQ#>{<
za7f#Fr(2?8qjgB&&5r>z&O8Ysgav~Uuds?#Rim%aW0-BKz_OK#yc}o^YpS@>!U=LD
zLWF`5AiGrzlqYxrHW`VciSf2Mcp%gQRmp+mzwkl^!)<q%F?!+NBY0p%g%6N}mK`{9
zA+$$np5#q9${v7C22BDe*-Pi@2112xj9lBv2}}q2#6l}>w3>p1=@TEUu0ZEypw|DV
z3W$^(1xlV0hK!zJaux+jj)EhGo}l31lO%a6ku0GX=@%&y0MeV6UtDl;AAQF-ggGJf
z7L$_P0T{@7qp`lN4U>3FM?0M#OM~0rZ0EjGdE(u70Zj3c;PU$GAoB9uON#ISliP|F
z&#$;uacT3a*N;t@aLmkf$eK6z)|)Udhuk!k&SzkB?GSPQD4*CS;FAOXp3`s|BU>)G
zJpMTG(@kAaq?(+a?6M)RrYqvE$3st?2sP`)uC$a_0cW?irlPtb0}MB2Km=q#r;Zt-
zpJV6+v^H`M0AknA*UKj`;`-l69LbGs*v(=TiEK9eimb=)1H=IbjTn}TkQTCN4|tVa
zZ-*{mM*8(Ac90GqN%5DlQV^%FXqEo+vX|I5RA@G^C2{yf@|Dm^7VW<O;@@F|K^TQ5
zu?=+inysXRTyzP-;c8Es8`W7XYmmy;NM%P$WuyN~*%ry(KUK2#uaWHiddc3e`!DwX
zPU(5?ke>HDV8NlzF4FVbfHU)-+L@Qi&XdZPN@Z<QS;Gy>YA_n4sNjCdSKw*M0cSlR
zF;^M6Tu8gmNR1ZnymKVRQVdpw!B`ate=i2Bf=9O%goin#p|!coYK6LVuOI-pTdl{!
z1D^R(Z@NdW0}39bi{0__#vi`h`fDa=L3i`bf$bq7t$;J`>h2mj_GYs>!3SdL%9Sf$
zNJ3_)7qF%xZJ+$56t+|lIE745>%)+LdDu{yJl&%p8^aXKOi5Yg#q%f5<pAVS=jo~O
zsI7%^pLl*hZ%?xaM;Ll=Y4&1zxHb2yU<i{B88RwW&`h3)=!4N?2E`9?>May_G6kOO
zT92l^Lb`yu;$<nl9HN&<L9#nhTg=0}l8kx9snhZFfTBVU<X21?m|Zx;;>bKi_NS2e
zAW_R<Dcp@TUg?OfqlHkA5qLsCac%=mLXG*wmMnx;{GMeg25w;LWOeb+sm=_yFDQTN
zEHCc__NNNQWH@qkSxtV{E@qV}W$(S0)61e@If!DtIq!`cb>f7Xg^d|uAQgr8@We6m
zVCZ@L&hcZ$CnhE)j7b~;$Mc)VKP<=|hDAqUj(^F<j2$lUxp0)u6%^rPtEz&7%^o5r
zQbjC@DBoMEju;u2&QN8n2!hOko)`HG12Gz+Ag(t=|M4f{yl~^T{ZG;412_R!M`Ihg
zUqFz{i6HafHiE-2HlGeBf&PKRXiS#U_@GE+!UCj7<bfzeBk9VP8<QLn<hPQyRg68B
z4V#ZecP&1Vour71g>*K0IX+u2IK5h^Cf9k|i8Xl)cjNL<iY7xi`z3J-s>Vt5kXW06
z8D`+=ueJM$SaRfGNNC}pDiHziGM3!HU0pz1m;J`Low%8JSMtfhU9pDAl36b9Ym~J}
zw{2m#tu&Jl#A9EDhzO+-;KLp>CON|KqzrJDPvd+V&c(|Zlek2j%UgbDX7L!!?jL9e
z(w(}aP2JI^gyF1Z99=CLroeD8+PT6STrU|hUem;@uQ8@j#kfRVb1}ZdHO;8>Eb%n@
zezfpA!WyZb1J8PmFXXi?Os-2}3(KVzKJ=GcSP)zI255Z)cm0zVhA!2CyGkv5k&~l^
zdocXbvHw#G!|UN*w8sdsg>f0Q2A#`$4zV}?*un#JB0~!+(83C|uoFD7S0E!Xghaf|
z71E`48~FXTGnPn4{}Ym;2-GN+kkR!;w8lY#G{@ce9_#6MB2dM0IxC@<5NC-S^AG(Z
zVzbo`zg;DFtrsyH;DvjD8k9p>Y20d^V@-<|ptT90LhwcF|7ANmV>u{?4?9_pu?}h~
zd159=sE9t}PiBdq@myRyyoT0@GY%o(lOK*AS0X<gky>TAQZn+aEJKe(2(K9xxZL|Y
zaP5V7Bf}+=fn2u>T{NA(#C6~Q$oZub*Pe4bdx1WOw=iJ{4$Lo?kq&Tm{Q5TP)v%LT
ziZPRvJb_B~(<l5%EQ&aCactbch@!S7Y>#W_g#!W<>Of6MmwB=!)UfzKU}0CaE<KkU
zo{Q!M^46oAaR+cwKp8CJjHp8p-nb@nqd9Lp%eTU6L2PN<{f8e3X+feM!geLJ25O<p
zb0qii2g%6ZH`AEpPzbLY`NF<$j^Kh%;v8`G@R{jng}CNpc(3T_-g}U(p)(K9aW}KY
zbcVL^!gW1xU2k019W^B6Z6mImO4oHL95PH6yM?tzIbE9&At?T396q41OYsKWV;trX
zE+3yM=_YGl$1iTDcXXr0OVFmT2>_KG=!t=N^FQ>&L(~K42_l_=zG$UBKws3-5q;q|
z&>91MK{zW{#vb*B6*6l&!1Baw7tY?WID2CNOY)i-R<?CB?kV1VeTMVyge$ZNmk{qC
z5+U8cwe8CNsW)`j^~P2xCLVGuHBy(pYUI{u;90mgaLv(pOD<!J05p+>wpvJy9}-d9
z2qYPtwYK^Bvn1iw|1?jCtFMUQ@&pl>coye;E^3YId7;ngcjB^@OlLmya`ROs25@Sw
zZNE$GF0`LFDlOjU8fqT6&$T092VEH8uUHw^(kVIA&;XF0W(w-|09xu<^wbp4*A&LF
zNMy)?rk&Ic<f{Y`PEtNWKZ;Gnv%>1=1yh5l69t|dDHXt*LE8YC6+$d>^O@PM6i0wV
z@0h0%UfV|+yyG7VDad2#<p|(+?fm9#^He}W-|3j;-0yNM=Y@B_qxnN61l89chSu_}
zGciRm%b+Hhj6e{=S#Wg}Me$Y>*HL3;FQjo{oE9Nh`Ou)RmP2*9jJ&ZjkV?YJxp6_<
zv(L?f%H>ylUki<xmvdJEhBcoZWAAZKu_SJdAd8Ee>{L!F=0(JmoL%P>3f+Fo%PVTd
zP3<j3G2XnH>CKS{QiV#K1bcFBgM=t4njlb;Oj!j0DtP*P!Gb2Whux_)Cb=GItI#|M
z?J-A^J=5St(zy<5ambL8h6&s~HW7e|#s1f;h~xEk^xi$_z30(;mva{uU(6BhB+yb=
zka@BgCP52S6{6NC4@N^Iv4#^GLF>!At$lV<5Mf<5c|o>CszP+69N>jyLV?C#Ksc~p
zaDL{AbGeo-`tnlI#oxdF{Ns@m8Z)=SZ{ly#u6^TRPC<=)_3GGIpd!n+>*f6>h21Tt
z;F8?r<qn9?+mOcSfuMqzybsW=#<zbL82A@tf+<F#kZ)a|7$2b^u|*L!YSv2>_xvH8
z%3O!0zDNcT+P`9Ee*WwchR|d%Nk&<IJ_i4rLNeRWHgM0xn-oezOhHq>iEoEf$Zsj+
zyNmQQUz{n5iI_)8Flm1py2{4|_P9B&qM=^2Yf$?j?_~vyZWd_XDoIUK3$t8#Ss9!c
z3G-jBQ7dGmks(BWFK8{0ju6e#4~iG_c`FnGQ<&qt0s}<j1*rs(9@7i9G(GZ|h-w!<
zSlf`}-p5BrDFXi51*MT0fxaDuz8#Iejljr^z{u1U6y+8nX1cKOOm<%OMSux#eVu{=
zA-M>V5xCAiGq={1<e0?m>q>SEa}49ooSBS8VvJ)KoXo(R!ef=e2)RH|1hMzuXI|i^
z7O*ePl(6Mdc7~hpo{S{9e%v$9Oy*wXVgcnD%{nn3t`QhiaZQ4vfX$rADln5Yv1iP>
z>dLxG#4J};wKV~_6h>}Np%q}T=Ya+wa9V{~=i}|~jfi9bHU|3z2O`|%kG~M9n0#-^
zyLuX)binu4w*X`c0T0@?Vt~&>?<v}|v3eK~8%L^o=*gU#PsmS*7)x>_$+vv>9*!&J
zuYL0IDq^J<E6$fzoZa|ZDzGe)DEX!_$>Av&;^W6APZ~FFTvF=I@$o}_E@4*dFbp-%
z<Ya6MJHV;|Scfnc_B9N2UxUU@f#jaM|K2nx9S^czgoB51E@+jP1;e33yD~1q;*fKA
z&!IyX`oo|e4Yge``&NU7Amt(FT}1^3VTnaF=R*HyKvl^^1XZ6?4~S>r>}Fpd5DA1n
z510l4DG#-sXoiKt?$1hyE$4%l3r5R@q2++;jDL=4C|U)W6Gd!~pyK5H4g`fL%yNs}
zZb?Nl0|d=FUPd!S391@hi~sMxPn&8^V(Hw%g_Bu2V28`GU%=BnB&e$PrUpO$*oXf%
zYk;9^0lGmY7%8BxB5wgAP0Si(pr^n*Z-#4K{#2~jBGhXU>P2`{i%_pcsMiQ6v;jL`
zQe0M6T#Pgr&~THs-ub>1(tK$tWcy+`ofj3+gasB4qB%h&!lb4}wiWdF4d2P>JM)Nh
zm6hkJJ5TTJ?EL-r&g#9VkLKncEw0Ph-q7&#&vnJyGj^Xjv-_gu*Nqm-#*LPX8-GQ(
zttu#}wpQoW(qz`wws^t!xw=~C(S&!^O&)mX{7z2anPX-pB+MFOn7hnic<eF5kY#h{
zr>4%I5WVR6*w`0ejGplPqQ`E({jnJ%pN6vl2f$n`J!`p<Gw9vZn5{k*R5>|uadj2J
zp=NDVa7A5CPE1T)MJT-srFYKn<n*0+1hmOW2T)#7T3S(oOdL=zlNreQz6=_KvNGrs
zDk?4L7Mi>uOCf9rK5o<!S|~w4U^jdRMJ-x$1k{(vzvt<t(|LIzZwIu;9#AYh-+Ms)
z;6cg=FSze}d(&J7EzSROeQ5>@02M@o3SvM70ic2aP=PkT(1KiTfTy|u9jJ!Jv9!T6
z=RtUWTsj2KMz((U&&iI3ju_CXpP*4G6e<<|R0?x4+YQ9GVb7;Q!FvIA@vjk*JrdNq
zM9>h_fV7#lHB}a5Mgz7}BiJ1n6$Uo5*4Lm%Dl~(^F9^|>SATPPJo%u;L06Bbf;?#b
zp~%MEqjEU<5S`j%Gi#2Y5A%y1e&QmHGKX)~S%a*n+RUCvV(+S2k5_r$y^<{w6xz_G
zb3)H2!6Ef7v!=Qh#vZ7ZF%1CtQ^9j~6>rw~`03qsP$XlhU-?vOzc{qtP}C*?wTVOf
z#i9MYpr(U$8e@eP_d?421zn?2LwYjwEd!?kBCwlv8MzHr*@yQWJ`)hHEy_OdDmCjG
z_MPAnGjZwj&%dyAVpOdI`KEh$M=e_QZT5ld-_s_HQdc$<l-i;v%uj)`a6S9V$X*dV
ztR+X_@Oz}x8Wp66FQYCf%Irlx(^YU5AVMVz2k>ZtdZK~Nk@D9tusS5`o4t^N4(3si
z6D^GfA3uM87Jq}^iLFnuQ=~g4sbN4%gB9vof$7Wwq*In^7Ls6<XNU2&9SM?f*eb9Z
zDON;@(!^z7!~Ig}bSj%Jmc(g0z27Qak;exl&ujVY(QF|(VR7FwLYiRSxYaeh_DtMu
zYZ%XVhe?QfGZ_~ROUS?mjU}ER8*qzYyg~2a1bz`<C!=x-@(?DSbJ0>(1P-&f3}XRt
z?74Y#$j!^ScsA?&#VttxhXITic=sRx2#~YXp5U`#5F#@KEO}T4*;I!&c%4NE$Xke`
zr@c?MWBa>PkacAV@DQ*f;`kEx_Ku~ZhxrUgq9e%OjlIVag!5?--pTX)MxRGHB4Hz~
zwP)Km+qYoP#<{~01r}n7FlJ;{R>H`HtSt9V<aq6LkA(g+YHYYhr3xQA8{o#XPw)8b
zv(I*%E{Ep0-1(a*`i+@QMf5-~7lHKD5jf7q@t-RnhtF;SyTlEr9Z(7daM@Z3jG+en
zE|puteJt)va2|mqf`9Tkz^CruUgtJ(r_pNIxYIa)ox8)BBr^$tMNtu05F?_jZZR=2
zZq^czbLqyz5N{4|eAme?%HEyxnA3U2^RYSO;C(yJ`Rh{pwK=N3x)xB@0D>;9tgVHi
z7PCu3Q&U|n9qMZ98(Q0&8_v6+)9lo9aH$h~vDn+tY9s}q=g95_iyjz&r~n_oKtG>=
zK)uczU{qc@%twL2!3d7R!QU?+Ff1Y@FyXIVOB^{gQ$&CoM}Zm#><IdAckKIi*S^Dt
z5AWOc>(;GXe+4Bk6u8-l{;#Mg&d&j6M^1img;@io2S^Lkhg`jm8~(mN>GWsE<r5|#
zPagvN2KPP5T(uG*6ER~?uqUxi{20A{%=4*mPx=DV$7iy=VPOEBReVvzaYbL?%;?cr
zTHf2!3EN(04?HjUendFxPM%b&tE-#ZI-yAKY-_4Ed+c9-8qSLd70AiU2ZNCh7*3sw
zOIR3C6}x*NZ}fCus+Gof44#pEK8LU?&*)KD1aM_A4TYtJm<jVKA-hg&W=w=w3n9^9
zJ#@|1jvf|prlBMIx6K*I`|zM+sq8aMg-C|f-RF}Bl)`1SE8flX>1<b+H50~YEd>p&
zi4*3gB8cv7NFQIypPP!AP>1Y*#d*vd#No^Git9Vg9#xeP`mhpLl~rL5tf8#tI&pYn
z3IyW<kpauC2lAF9#SVBn4+CaEUrJSe{jbEHRNQD5lajyK#Ys$zX%Ur*5d$(jNecI(
z_wPpUJ0%6Zj=^>!cAI$MWIBt~R0Az_!01loNbMvw6JuP~hsg+B`<w6T0~>$JYAidd
zj~uEv<`@*=eyFtO*ru<3Nr9jIy^gzOZ(|Y`crShHkY}8r@~%$~X?1af5Alr}lyP(5
zQ@@t|f`R=l`^IzeoXPgy+NOYMv!({N*7vd0SxY8kv02A{hU3;M?ryM4uL_|`rAKH~
zZzYUUmAz5HdgXO(ud_&PKhX4eBAOSe;iYzGI=$5H1I-?G-7hY;IcdE}?=-Lqm@wV1
zLfj=efngnxS?yx2j93Z8uS`&(NLtoFwEk$cekxi&5UX?`<J?>^q~JyigB1q7%(W2S
z8jxa;>8+sPHzUx>$Wb4j4lq^uXMXVZ52rIJnLuk>jh{z<al!elGZ&5@g2}|abw=9a
z#fz8y{iPRQeBnu*0j{S=MOj;GW(?joU$C`?r~iKc)JY>_6QUv;t%DLrO`3Mw%vp0$
z(bcH*zo)~}1pp=NPho#r+@Eqh$;w_u3KZ8WxFkS0K~lHs>f=VG7{LR_5eyzz1DpjQ
zg&=#Ik5Ak+UrBrkjl|(-ud7F*XCd?pxujkwL}E6Kh++&y<Vpl<4l1Mh5b+7=T=wV5
z&=@@Az9wVGPY1GFYR?1=8{>+hDDa-{O@r^J)EOUBk^+8te3J{1&L&KGE)|6F6-MDZ
z+NW-vFrulUpqNj<SQOk`d;&YGbAXmr+!E-mPWP;W1Ybu2d=+x1VN$5TSQOkaVG&i(
zLdwBT=xKmh?oU#=!517Zcwdag>wb0RISKbI?dlmP(_+cYwiILnMy;^GlAQ_E1f2p|
z`!xOCyj7#IYWVJcbCUf>Zr84v_8;Mvv&->_{d;>q&K^ZqJmT1e^Y5{aE*0ddsoB}E
z&B`yXy5)^jwu-HCyaD&8TUK2(C&^UYiWM{Q`X*F!%{acpy~7$ImNv6zxi@7htZV-e
z<X?U{b?S7-c$Uh3b^O3KImS80;dMODe+9GT(P6Q4G+C-U-~?DzZE5NN?1ZkbPcHA4
zYi#Q7ZUnAs<YtdZy*@Hn?-L1RA%l-TIFcpa;8#+MDA4m{y(23RjTEwWo1ny8W#n41
zyuiGU!6!>*+qkKMNrGT#2I!d6f<~o@+ak-<z&I1xD(+PjjuO&=umxWJQR2`Bn5`@K
z{lAqY8wlmiBpZm+&IZn#I0U{FG_v1_$wJ^uYfEcS$X?PsE%1p^iBb0&xfZR!mw}8A
zB6~3hhf2)e;o_+{W6Z}@U%*u##8u~`9p<AQh834$H7W$qKV(~Y>``fp<giD!YH`Ca
zL~ky*?CnOD@pL2_k099us{}A-h)%&h(*|;Zn!rZy@U@xyu_qNip?`NAaXhTw@mY&(
zcUBeQ<+wyNule@vR5;DNLc8Xh-RB4!?0kzk1=fMTIbK%4(DnBBXx*h?q?Z73A||F6
zC($_c^|f2hW|xOO<Zw)PIkSKNmJdGoVAKAC-BTQnXK!kPuX{(Id03k2@p-<Bqvq*)
z$Boh>jHnBd`%7<~F*P|kdEB_MKz10K;IUxtg5>~9x_1Js-%0S?5_4eSBpPA<TCLhM
zDt65DIe~%9Gj8OV(cr&^k4f;e1qR-gc2iW8r&?<sRspmrpg&b&8HJDw$p*4bmFT=j
z#&U7PFGRnpstR@lnZ(nX(i9;sZ(vB^ScEA?<gK9+lF2dm0zZjXe$G71i`HHP@cbd<
z!kJG;=~*RTKC-fl8-5|WOu?Hk`hU5$NC{-0yD3bHfpN+#3SPle+C;c%mh4MshTq=W
zQG4*qfM9!8jc@OvGWP1Lo63Q~&d+YYFl4%*@*Z+wk55A0K0(%%1Mdm%*~xQeP8tI+
zqhS-KjUGQ^?tOC>N>=p`L6GI;8R;NKPtS<-D<k8^R<B!NoJt3uv*_yKB-VMr_DuP#
z2W(1;!aPd}h>|1}nOX7uTD=uI1$kINK$w|546q7$?+{q8<!1{D&YBffwU%;pgq%p#
ztT6cLJ<)X1JMj+0k4{6Y(3<F!T)jN0LueyO1{=Cc=2=@)4&kw}7CJI)rIyONed<15
z?cjQBlqm;e6WTEujE~K$H@5|ahDBI^THV|Xptye`VVe<KGE`cxC|5UIEMI;JGJi@4
zq*&79-Kuem9(?e@rlw{We^qyNH#&Rb$&(Y!%s(WoW8cOfH*Gm93knGdic6U{Z{D4$
zgTg|xvXTj4j$Fh7;oUJkSlfC0s}Dc?5T3w3e5baz7POc*e0ZMOGcUgca`%NiC?&C#
zS&DKq)C!xGbEtSqVT0*Hj_lIRQ>{VzPc^`+pwuJxJXcl3jeaNf<Kt+t#b~iR(I*3%
zeAhiE3!tNJ?CC4tx8)}>xhA*vr+MO7Ujl*ePB_X*$k(^QWqbjA{qGm|g<#^AP%2Ji
zl4CGI4mz4Dz@=I&F4G>ZZDX1^lU}azFa(4}1_mPLLx<>xT62Iu@hr|hqJvCHy#&!!
zCUe<cpa}4mwN+$%|4p(Z&@r3)=uL7G=8$FEfL40~DC&>keV`-I_u+@<c#6^ZRu(kl
zVKtlk$lnKznEk+`LU2cCIr#j;`w##6#anM%t-Qi$Ja#%eACqHF!5eVJdy#hKTicFV
ztpLyP$jv=_z7)BIs;V5(V_8piZjwo7qY%TK+(3i1`pggTNllOCyQ=YE7mgn*RY%0%
zamQ$n)YOGb9{W3-(4T&C>EA#COBOA>;|?Tc1z08L6&xB778cfb@)tiH>&`Rj`@35j
zsx7!jT|;vlVlMp5vD%()Jh9SEA3l1*gjutOxlfpI&-@3MBm3xM%N8s|-lh5X-7{+z
zJoY@?-9r;cr_H(Tw%Zb2IzxSQ?xojXFjSIVo<r|G$9Uid%Nb=IqRe)ap^r|+j(*|<
zAsO#p)~x+x-MV#~e&4;`m?pApL-FZ!$CFnP!hx;OjG>5Z?N1<gH^Jzc6zE?Y$IHUQ
zeHDE@gwYwX81_-4m&Pyrx}G;rw(rIzhf+^*Z@!s=clSG9Qhl>)*RCDw-!V@C*-Ue!
z*>_`ac8qnUZU>r?)bS})h`OF7*@05)sa|qFQ&;Une-HBHq#hUC(dE~CAj1dd!NY(1
z&1y9ohYuba07=l+ZEMLnc6|8oTP9pb642DB;+L(0^N{OcA+)DYEmy+dEN=GV_y`@l
zjv}DAeowJ-<sElSnuIgg$)jV?yWVP5=#)hdQxy1n-YaguLLkbpSRxS0aus)=s>UzR
zW-l$R>r<!zHKVTB_66&%ExnFN%!3z9n>K6KxN!>tH7X2a-{7zjsWWCQSTHf<3Z;x3
zKb|NB_NDmT54qsb($StrkLETs_p8C^H)L$i%{q4UI%<(9gLI^kpo{=e#$_ETmOvyB
zA{9Aw;2I80fEd`tnUy^kr=QxSX@sF)Ubzn(HgijIq$#XcH#aN%71EfSS$k8w_ub1m
zp9iK)M13@EsR;>fZ3zjfZDuW466DJvZ8D~IjRW(q80`n;I@EK>fkS#=D0;8{Mx4#5
zj$x?dHF{jq(nC*=S7<<uYCC+CIXM^@vpgcg#U;scpUfp9LOek5*MyvJd7@7@*rIvY
zJPk7SyOhxZIMc1-IgViaOoGNbT$|O@bcAV#o3*6bhHe|LFgh63GPtZe`mxTNwWO1V
zRvND?>Y8t)ne>LWMMVjYf1tKd!`N{_<e+3ON$fn2Dx<ROyxhe_tZm;DE$4ObYAl0M
z+g4bCq#D!f`&4shZJV;R!<&X{*%7lA6}5=}Qf+Z{85#t6FSUe#BmPUZz4FbK+FsZH
zFfbRv{9aN*HW28@rTzyyqn>`TXVa-h&Av)dfKlpyws)Za5q^XI_m015`Q1L;#3>Jm
z{a+^ae;N882K`DHuVIuD`yY{>)c<5$K`v=;7^Go*68rzkH)8)^?fK@4*$dL`01s`!
zT8ISP3_j7k>yMt_?Bp+wyl7y2>nr;Em+`6g)H23fu*M^cHG{`DulMyd#7gH^o<HD^
z^j`)=Iq`vb{(S-rn{rq+95^v+`&z#}l-brFaP|nOj;REB0|ppQ%v!gQITOZ>h!2^4
zKYIjNxq>{jvon-HbG4;V-xE8I$IcL7nS{eV)@aDUTDZ%@LzaR%Sj08oNOdE9^nmQ(
z^oAidu1r>7*(Jjhr(n7~;E0kPie@R$TQ27o$;LD>S+(V;49|*msxfqwuJs?<u&^ZG
z@;lG>Q5$~a`J?N0KIR}U$=|PkrF9wq!*jSMUsYaXImX)*)P@F6Uwy1}E?t{^??`_^
za+R~53|8Q01#W~Nv=vaC%aYjVW)tboIr$oV)Gly*9gbUp0Sp9cv6o3YyWUGhl*2@q
zk;?1%$bk~%ReD99>!#mT&<nau4!wCWopXYuaW~*DA*gFO${?FB{yFB7pPzUBJfQC_
z@V7BCy9s;;u#%qVRv`)_3j0F&W@OJua_I5xJ`<<WtV%<|m!0eYH<O#m+T|+)0$39F
zh@iH`AUv-HIZMngH8r)(&Gl8dW)@1xplm^kcwb+?kdOcaa*PhU{NaD?pAt)nWgq<J
zI9Rr`>a*&1@KGm5<S>5bpqYbS;H?wNq8MLp0i?eX`7wb=<Ei)5M@Z+=wP{AWj>avJ
zbV@MLi%Xm|j`>q2(zsuL=9#SKj?QBnoHQPwQU!=K9^y7`!km!!5%<q_(s)5<XMsrL
z76_c>7~d7;P8!E-X%}f+uY+k1<J-&AN#g_G{HMAhEf87Vi)sEb!utWk1$DEVwe9Uk
zj+{8s-hSc;WCe}Bx;WTpkau%qEzQbz-Z|?|y?)l6>|xBxQMxjFSCQH!ie_@K&M<>l
z(6nO&iwU|w-Ncz3d^ybBUNr4o{f$&N|Et=~AG87vm1!vxz4%Xc6A;*JcV6sBGb-2K
z-h4!=non?X^`P3uW^c3hPRzfknfIMi)$C=usIDj%b&*+%T3N(@sv5$Zp%0awlhV42
z|5UT9z7R)B80wW0CTZIzgvr>XFiz)=-cx{EhA>LZGjDX`m9`!vD*#41g34^}upYFv
z)YmpPPzK!w=H*G;H8yf>heRY6QdPS}Mn<|-zwKm(RRG|~I+K;P!E^ELqawY!s=K@*
zM*%x#(4g2z<_<?p+T>(bB75QskN)k^7s!?AP4=q%*(YCkB^kPzHf?Xe+{Mj>>vv_n
zy#n2qZbfQI(IkbV%rhY&F)<-w1Z~5ICyW?5GGV@FYkhI<nG<Jnk^Zt6wt}4Edbk>B
zHE!rIH;vW}mU)@VO{<1>LalX0z>yn3h5{242gk(5MSy9Hh>MLGoH%OKpx6im{YJzN
z8YS^N3bfsgJ=>;`&PVnyqHNnAt!-r68z@DdtV&P<+|}Pe0X=eFq;n-udTxXQ$uR+%
zHQ+?a8j&kVnsKf!OS9uuWuwHh?NV7T9gOYeq7nrL;lAV1)8oVBunEiX58W>KCh9Wu
zG=w8pXn3$rOY-Y(SMU_jJp)*{-)3hlQ2*=ihc8-+^0H4K{rT%}n4`1&Vp(l%UAx*7
zN;ChA(-*2cIyzjUZ@J}`K%QAE5TU&1D`Z^VWM+X8%N~8`{yBHdOd35lb=owUT<sa?
zA92%|k%Pn8V}gG|!sr<EgiZ~9IxH$Ce0XYV>XaF?XU|T6W*10n<rR{2dc+l62-*sv
zS#lmLH&h>3<RytT`r7ZLC#H3Z{7p$W@W-_t8f?si$nVYAfmGl)9DodpiEaX0%*auz
z0sp7Dr;PGCFd{t0RXJuv2Yg(43?)zekj}5%g}h~NaF;Snx6ZrpijR6f`e5J&YmlGx
z>Kl||&K<ac4s)*a2I2@ESZ!}`eM}xD`*;}Uu#)z^gX{CYcX!==^#kx@f)~N5MtlJ1
z?|CfC;sZ$Mm#_aPtt8f8x;{IViWU-EY2YT8AHsPP@gbZy5g$T2ms*LuuJvdo@+sDX
z`t*!bDT)8Uri6$9i_RXUqYoCvex__XeqyAlWrwok>yE;XLZ%G#zT5q8!GBlkmg&am
z#xNy#f7nY7D-lG18G|Xo@xwY2HSqpQzYN^*54{g@#Bz|QyD?Ug?6}YIFn4x4-|~4&
zKI0PSrNC)#HWT>Z=Yq#DXuc{e`+2$(;~`b(L#1=+9^|t$2u~G-ryB5Ca-*0^C`T=Y
zrIsSBhw^^8y#MuEMFhWF9k)8(bOb}E@qr_ld-DUNFM?jfQ;_Gz#^ws_7Bf3*p22dk
z|Au`(+&q=gKYPJ%Ya6Eor@mT{k2!X1%<FD&iy~ZmOI4Yr600Qc&@X@8&C?T}2?lSy
z!9(wj6;k^2N^206l3nNzts(KfcCOFK_ipER7=TOa<a=YvmR;t1W$?cn;Csb$>DmLn
z&N^J%=`TLOQ|FXiwEO}^q`-eLc4rLO+!X?>Y>syJBX{^NsBu>ae0_O?<s=ly0w3TR
zs2@aUB3=HstD3l8CSBD8o%@xmnqYA=N>??Z`J}7TnRwL!9Xi$Z4?1+It};0Wxl~zM
z>Zz-)3oO-C=B%x(AJiaKmrnopD^ECf&6W2i|NnO7Nq@NVf2=dnFZl@hTt&Z{5=&75
zCYA#75kh1ygiD*ltjP(gUf&Q>@GU4>6<)ZtHMD(GzF8C2p7PX$=8)xxwo<i)E=p)g
zSQu#5lv^sRF=bYhcMw9kAwKe)S>vhq_QB-o!{8ls`BSOwVx8k?5b6<&*&!D5yq6@E
ziy`E|1)z{|)Ch6m@LEa-0v@8<RSM4R6%dkjvalw<thDU(g~lGw@R$+sq4yYba{F(G
zPMth?^!UWdQ>WfKcJK(Z*VzkkLx(4h8aHy>^hpuA=A5h}$S~niHuIUek#Gg-w{QC%
zI?``WwU}{h64)smy1E)+ZU}$Iqwq)z#dGP%)(2mZo<4^eOchD*V$d?;=P5`T&vxC<
zMCu5~6V3>ew8-Ij!f=W-CjLd#AdCD9W<td4f>$ku$&U;!K)^g`#0o8Qm>}U{v4Q}`
zkG-kq*rzFyu2lc&uCKoOb@wT_xMv<ddU(tF%_M1X99}6erKcw4i6@?z?0*TlcW$|5
z{P^KPI=Kmf>l%SOch1Z-dcTo(ynvX>XOcvuTu+^0_>?JACXSmpWm3Y3rSb7g5mW2Z
zQVqVXxQ=0kHt~Kzi0w8hyP8^LGA}PP0;9nUSHMO}W{%R*vi(Te2?5^(@fIs2VvF73
zlc)D`gQ0@{bRMC9_<`6qlhHQ!feI;0&t$aCWR#5R10*C;Q}%Us(NWxp`Bb3$VJ&K-
z4<HQ*Obs_E6W3#1B?n-O9bgzxfc2PU&>g08|H?DV^4FUuBMZ+x;{K%TCl|W98bpy`
z`}$8(;anu{+^7E{u&2eCj9(UnP_A`R7%sqqZVq;F_xInt`Il^$o73R-eb1uybMHe{
z3nx>>IDn3}&YlV$bu;VXhKPGCGNrsIu=&Yw=liz|1*S7I@U?cbqt1OhOGk30AB{;6
zTLms=4m{b|_a^s}jceCuHgjBfc(_N=cdt8PspKDK%vqTN%pC0LQGM<7%q^Iu=_qd2
zOK6GSzFss7oLJEyVEmD{h`F0Mm3oyNh(R)eN4r>6CK;L~JxXCCbA69O>q14ujkDo<
zheAXC`t$({zxo<bCwlsMur~arU%H0aV*@-1&7yx?O$ti#elyB#=ttgVt=~uMjq>%R
z4Q&2fNHY6~tv1SMvI53is>^GSBjAQX5Y_v5`o&4-;?+lj9+qLOyc8y9BXOOPj0^A=
z#R|NTi~*ii)LjtsAd~qM{gojspJD-kxRh6LHs@Tyxty~(Tfr&HIg^&7+@RnTV2JDy
zWC->Zn15H7@6Dk0sfl{)$qio(8?Lg}oZ5};ToZX~F67>LgPg7(<GSE|4qFPh8ipEt
zj<^7}PEco$9pl^CGH!&ADaiGvo06fMUpjYu%f(aKpUPyPLY86KW5;H*haXO7t}ZV5
zU%&PC+i$JUQzrq`TF@T&y-Dpca^9VH&Ks#uX7Eww9(pL5oq^A~T8&ss#75G4d@g_J
zA*`3`v>$%>dGDd7_CAx`vUl&=6!`pLSFSx;cc?0C3LKljM&Z>6F^0|f;fEP4nX*o$
z`@;qayrb#{3IPBxQf+l>eM@yqeQW($IgGImlh#3b+QD$a%%~D%HhGWW4>tnf7Wo8{
zmp^13KcBFGP@m9%uz=xzT1J||r=!nq!x+8|6fqrrmKw&fNCJ;&X=|;ott^3`X9<$w
zwY0%VQCkg!kU|TN4d7kifGq^)=I5L{cP_88q1{e2*pI1Jp|H0%ROI2~^XAB~xVW&D
zg9k<Zf8@PqTvS)r2YSwQW`Lm#y$uK`prF_*-QH27j~X>mW4bBERKu`AY_XT9(Wr@<
zYK$g%G_h-JNzm9uM4BKVy-1z8|FzFxPu}<a-4FM}J%?e=^u5<wd#$xs4e+I++wQ&r
zfgxcZzZo6Sd;~7CBh3N*-ay`<xN4QjBki$o8aV|`;zv1_oJb|FGo5o;8w6GqoNQ^V
zDCXaPEw8wuvE}5SdBx419XfRIY%b3I1Lg{G*f5jF+-^M)?boe+Tcazs(M~Rx{ycKz
z$PJseakFDlp@YtkS)1D#8MpsFcmB$?%v`v5ax<@8`TN}8mk}9^(i*q3Z(Pf`4F9Ew
z3>2S`wxP&VZ|Ch|k48C7f*jHe4Rh>WeA-d^I&(1)ZPQ+i_QJTv6|N1%+MBnFM0*$e
zhTFG_8Z0g@mWDfKgO||MP~Xtdh(am#mF4A)0G&d@h9j^MiWT$%R*-dls#Ssm1P-hM
z1@NSSj2ADCwm2pUMJaZ+R0xs|zP40e{TtJNy^RFmR}}__&$sSX_bfeX-!5}^ONyZF
z6D&hHO<8cC#CIss0;l*+;s~KhxGfwd#)k7KuA4+Bv8y<QpIveN?z=J2VGl!t?QZh>
z`s>4a4Gx`AEvK_XL*C)9w`}<(qe2}T9UUF2uE_XhOPZ=`a%gB!(1;|#Ek$KpjetWm
zfY>)BMVebj%xyB}X2RS$g3>w)qMNG{GlT6w0v%mrUyIxyR~V)sMd6UmLHZYYWwXe6
zcnfcY70=Ehmt%uVu?lp9iAf0i=%Wv3j_Tv@_r_b(NA`vRqfMZ3&b#yG&W(x;3=Hf!
z;F*^`dh3<3(`SG9;fGVAm}7Bc0I0)Hr6#eb(*PAFH%nQbTCGu5<(@iq>fAMDGvF%L
zm*(X$A%Ry691l0uG|QVJ6~r2W>e^G`a-5?~O-)VtWNAEJAxSj_*&d4*ZP>73^-#n^
zF#b8Itm{j7_bdFIEi7h^0h$&>GME*$O^7elXmn-wOinF6&S=`JR-vqli><=h4ns4^
z)DYLM92PLHQTaXY@6AQTVRnw3&)!aKY2kr>@SPHL1kn}dHppzad?~w&{Ju_lihcg4
z_e=O00Q?LECzuLOFaY=&0BP<|7I1zLE~w@VDK~Tpy^gBT+{$K2*xi$xTudg_K{R2j
zLEPP>u?9RL3|rrG;CM6-nKEufVn5g!di0QJ@DuwPiCrPz)P7z1PMqE+EQlqkP@~u^
zG&Cl=Ix0LoYHC^xATJNWjJlb}{=T8B6PdsUAp-E#)~qi$oM!^mAIlIqG5|PfJ!j#`
zdCHY5SFTvOG}`ikA~j{@G8272`fmzlmC3GpMIPEj+cjfKHwA@jKtO<pOLeu#{6TSi
z#+WH!O_xNAxP(4Qb&_&u%9ts<?3QFw?x-dZVl06z4XuAfnIQn)pKSX4AUt4y$JHph
zgubcAy`#hb=4-fIB@2*0FcSjISS>(;o?`>JAY|Zw4r3~;209k#Jw0d7o;hQDLKpPr
z?J{7(490W~<(OA_12rL3GI7h6I0W+0`GzJrZQ0gsTbC_ls2qSd+PR|En88ktuzWew
za{yraG=KcRg<k=t=~w{DqDf(%L}8$~hhCE?syoJw4H7ox4|<k*5#@3s!l3COaN`cM
z$hyUn;A2UJriy?In2vdj6yOYS>YsTY1oZ5TX9j}(3>^5(8*wPRP3LCy8xwkC4XJw3
zhZ|v{P8M_~eZ6?>XuetI3+i!`nTwCI0SH8#jsSs~IA`H%u5xi&YHHeIdY)21=^Tfv
zxk|Qn_3E{Zz6~mBT{84Cg^d{C?_pAqm%qRyy81IO9?HN6kMZNc3@|BzQf>}DY7tWf
z5C`0EP~>PGV1ZyAcp(B;q65H-4hjas9RTR$_|G4cph=dP4&a}C!9T5*7#mJ-#6J}p
zI0&#*0mKy0B-{kNdYMyr_}gzkKkeD+&mbfoKjITJ>1`%7rea>AyxOF+$v|j!7K7#i
zxQH7z41!H%CITtmf>&u4Vg-3>rF`w$H7jBf@iEsjlL?wsL5?karAb+-18enUnrs;T
zk%O9>lL7`{k!j$10O?~!(qn1#AsBruMn4*(4*_=x5kzG4z=lbJ6Mtkr=2Fv{KnZ%d
z1rSrn8i?iAE$|q`s-i#|!~+%_;uyi4e8Zw)Y#cs(M0XE^+sm{1bqPc~;k|m5v17k!
zGn`c(F!qWycWdfwk`3ODj-5dYot^7yZk_=vIfo`cU?sAJiy7sk(fN^L;ld?rm&HP9
ze97{TO-ky9AAa~@_s03W*6eJ{3$kVFR?s&#HLDsG$%ZC$4+c5p-fdJl8^JuVYUJ3|
zf(D3hU{ecM11%oVH@F3YT2TrQWPlk%K@coRMnO0q<vYO!26HH1NKbpC1iffLuRm52
z@#bhiFPeBWQJs}lVc(18nTw17?q)=04lSo_CYVzMalYOxgI58|2w_ZIRp3j?|AP<O
zw3#z-Bp^6!^uX?8pLu3nLf^K%UU>cWsolc7uyLq&W3oF61+pp4b!NCXoxF2uEapRp
zGqVHQMMXsg3g#P!8AY<s5ZAA#(xvk(bLGi61|o=N9(c=ZpqRM``GuSmSFI*MBWT1j
zSG{c2XFuWC$Ye$^O{Ge$Qpps_&KX&LAztcsZM$|$&xHO}Ayav`W&X6ttTG6O1+cm-
zq^oe(EE0ccxnY*F6u~lIFEbP8g=<F!`T&veCFf6qkX9W(Y|-_@9tF#&`G+1jpmpc)
zub-FT?*#Zqf_f>p!3pqp5=1T1oj{EQP#H`wS(y^4rodDSTepCo88c@Fbm`KgTU2;>
zcr3P$DMG6J&BR^-Oi-9K3YEeEAD4MRTy~6&jSXXhxE6&Pu;4VyKmGKF4XdF<Byesu
z6ZAL-JsFk(n{ZmCicMI!)inrwC?tzbZoWijs3J&ae^_gr3=%zApOIz|j2R5W3}#{m
z*6a+fw9+7G`H{H-_xLkpA?SlIJa7{--_UL(E0uq}ELlar0=J70XfV9;N?34@9=*fc
z!}apYD=$wU)hC!9hlSzsYp=aNV?=aYCa9QNnybp+WY-dgxwca&PzhhAZevpN$KgoH
z;a1k6h!<UktJf^E#rbd^e;@-f4dRv9Mu0iLjL_wImLw3?TVfid)km`AB*Z9<!8sPX
z*Nc|7gk&bvFBFw_CZ!z#s328Tp>+&3(#|YqhFpZ5@I?t`h1H3P<=o6o<p?t;s|asq
zbA!PNAt-!Bf`yT72#S-P)8p^ra+xYTv;j;50aHD2t`|g&8XyEOQ^?c=MtD|lB~x09
zNpNg#9y3M{ol@`SsZs?5c-bfcoD}7-fiW>LPA0)=zTkM_!j>(!jvP7u$6@L)dgAhL
z2QVL|G9N#H`cVZYK{j7abAX36Cz)4lQqy4JR&|sf@=>{ARACrZ2u6hl_Ci}!DA0mV
zX;VT6>P~`zno;x#6Q;NZFeMm%1o7ZOlf4d=Ie*%<bI+b1emh&C(=qv-prAV@+hfp)
zPo7dx!g=;dkg85+vd;qxGqywjdV@lvf|`tY<?>`*Bm8d2ucI=&RViwGD}EUDQb05m
z^Z?EWlNc6{)?}}N?M`Ql=v*6>jg3Y_;?KfJlFP+1h+T{1IiuPmo`U47cgAcWGXxtR
zmcauw7+m$K;Bw-`7ovsDs$QL6pQY_R2%6PCsPrfcybtVqE=1RKaml)PkjYfb5@JDk
zL!d@uf^j7<#Re=JNv+x7ocK0bD!7RakH_GV8LdxAtB4{8;AuxZ>4V4t9RwD*Eo2tN
zAdLqsH%&}<4?P!U(S2g!6BOqr#G)wVkHU9M-gvCB5q+VOg+?|6fp<L-2Nw(49*7#f
zosljVfLO+0rqBeSe+o6H6tx<Lm?>g(kSmbzG#+rfG=xhL_ks+8g|78Uj(^e<2>$`V
z|3i8L#VBLdX*gM8VRO2aB@0ew^XSp&U$3-x@lYrN1H5z^NJfQ8kNOLP;=$*!55cv$
zg$Yhqu58<ucjCmEKaT!+^5p4L*A5>(VkOXnIBqY}aO%Y3;^b*g)^PH~GUD`UPUhq5
zit!}?hGPK3uE1zlVAKb!20R@rlI{!Xj@S+XmLjoPD%Z8a)K&MdT9|Tn`wmePko~hx
zKy5|C`0<mby!cwjE0=}9?qi;RKEU6{=oij>E?uHsa^vkwm;V0!_un%vUAl*d!d>a%
z-(Vx}DmHBTbYUu0+<-!?`0Cp=3l~!BwU=a{u3r!fq4f@JA5y>iia(fbd5QTnHj*&c
zXc`;sVP183^r4#hfWLs6Fax^3PItKGScG;!v!Trr{x#mek~1H$8>rD>H*{}9cf@)K
z%M|$k^bbi?xd;$l4T!D=L>B>~ivZCm{2UIFo)RQ+4cG#nu*c&WevqowIxd2?^cfEL
zTWSCwS6Nw11KTkjf|zO#6yTtJH?a*dm2(e<7w>QWh{)t76cfdPY!{J54H+_|i@&bC
zJSryAh<*~42?=&+tX`vbY1eyHZ0Dek{RR&n+`-PReGF9lK~bGM+G7{orp?5Ole&ic
z;_X#xwX<tjBr0FB4zgy-^Sr-rudYO`5<TCsU&&}`;yd<+%1Qw>Xdi4MtEyUDp!<0X
z=3CJGF5l2KVN9?-ZTjNpbLUp9+PZr`nA_Iv=h6Y3tH)1nSh3@){onnFWW~LI9Ne=7
zo`rSGHvaN6nvbtqwPwxQjeCB^+fS*_9RKhBeZQaD&y4N0i1vA~m3MxyiFYv9QXfl`
z7Mpm82HhhY&lX@HOHjB$cl2_puE&^w033ufyd>cc^aBcl8$-eufBOEqklsU|;m_x&
z!6tB(o69sZD~2qohzX&?ib2F5aVE?j-n$Ylx0t9lE;In(mPL_v#PudpoIrxO22p|#
z;VHp0{J_(+l|dm`JjLHbpW&B|YEUh%oSgpOjzpsGB+&OV(Dx3|H`pI;kI}akZW4V<
z6mO+(;_6Vx?^8Tqk$COaEg8V}ucVD?s@Te#K*3MjkamN0a&khboo@1!k?~y+p#R1j
zos0lXaL>dSK6rb|h;fs#;~Ls&>Rd#D&zU=WY629W*#1*rkAp3p&UNb7pBs*k`3z_6
z{*9`Yl(&kul0?;wu(>LpzP+XG*+-Unilnqpe?)Nh9LqcU)YTim{r20`v>$gLIdWwG
z_HSZfHu*riVDV?mSHmo__Qxgt!Q}81&JQ6YKU6Q;44rf1rX^JW_9g2%Pqk<*zU7-W
z|3>GIf<)&^iOx+TiMTqGLWOO!t4V<ZMYL`9@PCxViP?bMB@&m2o+Ay&BK2Mp2mBc>
z6mXT3Bg2dTN>d1kL5>~N4feGC_alT2ntednxU$kUNmSY%;MV#KYK#z(;}scR{D1NL
zT>kY2HP3~7UIh8v8`Rue5Pe|Pv8Fm;d6E@bTDAO6A@k0@iQO>g46uVr22t>FdJ2?G
zIvg!<Wb?{oLaSL6>lj)cy#75Ba_XaE1=!7mWXG4EiESG+_q`X##e~oi_`y7Q#IzrM
zl+XiBzxoZEJUbdij^2B7@=LH1C(|j;NPsI2Jj}89QPv9&#1ke{GbdGUGDYO4eA$0@
ztV$r426i<wp>=&Mu3HxeBkCk*^6#rmXfV3s(@*2^fUFEJTV7SKTf1Y&jxCGPzXczX
zr6scj$lmusrF4EItYflTmCEE8@F>I8mDW9BJ0*ohvYmQoBke?zgE_6{Q*cyz3Is(;
zDTy;AY$G|7z|9#Y);%<0ZwF^=&xuCB&Oi}X7AWl}9sl*C65pZ>q=~@v6kxg?Fpb(7
zh=9beVDm$0mLnVrJ4n$9Nx2m3C>g@Ac}K-8JWUabl=TiB8Vs6{>mM63AT|uHj)=}Z
zVn>b}H*R>pNN+p8p6?Cw=+hNb4(pK^&oK>L!^S^{Y2wva4_&Qvx0RtSiPFgpU738k
z$9L8b`_F&=)7R+^<YA>-`SmO(grINv{^&8ZxcTp{&z1}UE17MzR>Qf9Vm*X}IhKzc
z7N*VLyk+y|%^Q|3Lq+|x6`PsnY+<q4#j9JeeX4t7Eh5R9?%l2~04Ht`^bl?Rx_c>a
zpJPr)@um1n$w-Ecdrn@S2%{Jx9d%rvK(zwc{LE<4K{f6nWeDbEByo0r+WRE<h6BFO
z1HR-fp>B%dFnuGQ_X+p{hAvM5F*uAB$|NN3Lm8L<M?fp)*bf@z{xGop{teiUA+BIg
z|0{qSo&fl#3)9v<40P{*1bSX|V+nJ43g96QtuQ5Z4x2#<_P9ij;uGM9PWlh;=G<%=
za4-|HISI0P8gMWTvbiHHf{?BV|D%J1GvQrg<)j!(&+%8ePI~huL)8{!a#7wXjOwtL
zSxjW;OLd@>X*6@8lvEhjalq={!a9!bKQPKGtncWlAK>tB6WD9SxM!Z7K7IQ0&rbah
zx<3yaJ#1)HuZgd|I-y5YXJnSyc3~YG;XS|p=YazUvPv7x=5h-*hfTF*ckfof&@I^5
z7v8OHI&|>VHDf!}<kH<OzIu?U7c5(~{_73N3*tflWVw13#U-|G-TLK*`Ka%uU`ue2
zkz)Sx`SGxL!3lx?@5|W66;$7u-u{+))y7?i4jnqUn{`A+YPBv17SnJ)>>ONtT{SAW
zn>4iHRW(-D+qpQZ+qaMGl70iGuNsxc*q(KSNf%&4Tqhj_HewL160!9;{wkNEv<F9`
zh6VNq5+KRAi6-(?q{7rBz^!JX1XTc(zzhDvIy%^sw6o(?0Ex@tL95h*#KU2I%Bugt
z74?7n0Zt)(Kq2H;qRMK0Kp}lVAx7&o2>nD3r6pu)0)M7CLfqeiD*(G_tV=?=gOgdL
zE+7`#E-`IfEd2ldV-g}Gd!g5~?S~^{x;vupb6I#?{A)2nnvkZ9jSUZX^k+#3`LoZh
zPj=JV*|mx4+o!W@T}vVCD(ADq!x765XODLM@<j_4ELyT^)i=9iVP1L@`ERR!I)325
zZ@(Q`kD44Gl6s_Ey7a5BHtePm&3ACBth|ds))<0|R7RswuVpeBHWWrHc@rWCSr;#p
zi3xMV1KR&_+kzzx3y#2FQ6{s%>n{^&H_MEzjv@#cg1H<{8fRy;^TGpeM~7<wJN~DB
zmP42<K3;&Z7a&X)A2&dlM>CR8!P0{jioqxWt!RN=W8>)2wJo(;$Npn|3hP;l+^+HT
z8I#yWm11}4(wASB+$`O(f5-a0rI+whsiw{aEzRpwc-SKGZxA4iPxvy@ix=>?MPk<=
z8yKNlpXOuI7^P@w6~?47qN=SCycSMuIc@D(nyC1Xs1U@{tKq4@bJ!rWG(k>#UY5o`
zPx&ORHM(suC)5pwn;S5bBPAyrRu+@oxv_3|5(2j6N58rDO_E?V$zjOBOEQxj=`;>>
zA;}3eoj?^^siKwv-(>)N?6ETdrAZD3V2KGWD>U)1gc#obk5_1D4ER}+e99ChY;=FE
z5D;WE-tw|~<)Yoc|N85K1ya7``t?kRT44`m6$qAW{UBc^$XD1yfdt|tvp&`kJtvKX
z>__C^4>jJmA4#@3DVj{w@=?*A4|=ZE)Qa(*K5aB+WR#Rv6yHN+20W-8?W!_hJxmp}
z$zltvo%bkwyA2Yz-QDx^1Ko8xZ&w2haR~FiE2`XKqk)YKp_H(N>bYH%Y5B0R`aqs=
z=>Z^EUs^tHQg&fdYJHMpgRF4QfS?Dk*=mK;W#`iJC4Pi0Cpe5{iB3CmBDn4J>Gky^
zM>1Kq;ITyb3ZYr*-w~C!XU})vQKs~VOqMBlEzxCX(PE*G!^Qx%Bref8pocU!dqCrs
zp5njW1HV2MP@4^?^#J~QKsWOu76;oR-I2hjJE+0%C*hG7$(CGjPtuT40g--#^GkXj
zG2rlqFiHi#|5=C`@<a*Y{asyqC!*;7%R^MEXP+I?1Jv!@zJ0HO2}5H0^hfIx&Lpuq
z-+Bx0dFeT(jfkkIsI>9w8XX;-;_6~BxcLVJg@m>55FXJichWcOEKrK!K`GZY`@qgE
zTd;g-e+Y;7xR32E=vi~+Cr+$fiNHU1_Qe-pY*@Kw5nH@?)#@b+w(kD^`|o#s`}Nmf
z$KcH$DNH6)ax$e9!C_usN;%mnu8s8-$S%KIQhK*Azc4fN^2N+*nY;-umB!}k%xeYA
zi-bcKgfaLK_7H?CN&M3DNdOm8C7mE~Y12Sf0MaoLlx{{%C~SbR*#{4DutOn8P&3UO
zl?(LxfBD>fY;^;z^Z~6{u_bu&dJ4qjtqujk231)k`;xmP*?~BSeCPns#0Z~4i#gT3
z&CuZq-8;4i7COdu89(afS6`plwMXyq<7-ph;~gBxQlzzW^LEh}Wr{9=0|yQqDiqyK
z)on~#oVIAo*RV<cu?Ge|yZNb~eDcZiHJ^SnfByRKzGEKgb=6f+Rg3fPs@z?=d+VyR
zQNiW1&^=O{;z<@d5Hz@*<RJjXpc9>BS8<nwCqWBx35IO~8l`Z`Qa#B?2mVC_V>R4C
zc}3C>Swa5ga}r;O1BFuu?9qT(94I^v3o@95KONj~he2>%33@C*$5$QJ4X8SYB@@j<
zFk(-E99<lwJ0Y}MObd>VX{V|HBd`(g<>qz@H;4rge`kx$h$@q7UA#O!|4h%YxJI+!
zI<s?7mk4L-qGfAi6C4%QudRo3b7^LF4V4jYX_CqA0Yv#M_|tV??^uc*z-N0;oj$#I
z<@UWt@r~b~J$?A_;p5+Y`T3SD=l|OI?dEkXDX8pjQE^e;O*jG?D=SM-oA^$-xv@#v
zY_`QyO@JKi|5_OfZq;eHDF9R<Sp@R)X$kZBb9Q(O(<HcC&^HSm#pod2#<BpCF}PK0
z;btnm-cGVs84Ms<!Uf?4^sE1uui%tR(UJb(Gi|_U?ng($iUHF(mlQmv7e&1l*geH`
z?c6!IoxguDTsq7o+N)Dk{i6Ey>la{;W<Y1xu3fkG`(KXlJNxG!XOEsei#N!clQk_u
zCeW8zf^xoGV(^$+gi(^Dkgg?aAPc?|sKE);V71_LzY_SBT&6~xF>=qi3}j$g>bBkd
z+y)Qr(?3adBogT<(SrK71;>9&PTsR5NrlNY3fY1h!M=H*Y7&kN5?77bUIamN8A*@%
z?0ex?srth^n0+tMU@zjb0x?zWR5@Mopf-94JrZN_0(pYJLRj$yLu;8^>!EVw<|es9
zwGrfs7KEWAsTAv(mNsIH;d@3LL(IUTLx&DY9MUgpKz#h5zFk9u;t~_%+JyR}1aqD5
zOIS8Gw)U>}&Ou$rzVy;dtOJ5&8(OFjm7TlpPGKcf^<8^M4(ipbmrKjNTL;bN0|!Bd
zCu->zE^KK;l)|!4Hh=cn=H<&$$cFGXw;;^1d?;JE4ZZH);o*d{)oZu?7exIxSj5{p
zSiaV5Si5rd+8y7oi^bj-1~8V?9;Jfql&BL|c{{IJrxT4vv0PCL6yCMd1sKid$Z!PM
z1lKm<SKT|xm=`nwFj|5F{$W2)luPUc7Oku#S0oS%EzNR7)gw*<Y=bxmV#Glkf*14!
za93_-vbVS6xlx><z!qiyub-4~7Y*D^2kuBhMgw=zg6QYVSriFI1%8MlkOUrllXNGF
zz8ED?c1x-g1l-XjVUlDz7N0MM3x*7q2g?YqaN+=S=9l;%k?83c7!(xNt>>^YF}^(p
zMkl`i!3UEf5~Cy01*>al_wKP{fV*+AZr~t@-5J`4DIq@GY;2Q*?`0e~x$o@Rvv*Za
z=&p;DB0G1iRa8!Oc5Bz8M-LtBY(iZFEU)^l8#Zm<zWwJz`@jBd)9#&{5Jm8@R7T7;
ziEUlI9cKD{KW*K*G7g?$sxUTN`^l%9jvP6%eEIVE^O+LivkkRP$-%b1@Yun`<=t3}
zX1SP3xj>!NE2~P1sC(`;JQB*PMCMD#0@9=sKtLZ|5;93q0pIl{{T(2nKLCbK9DoqN
zG+TTj1HgPJt^+z08H{iVIb}~;4W9a+J}+UDVr3eD%{*Y!8Y|=Hi`+RViKyp>e`>Wt
zj;69G46Y=F2UMi?g(`a!1=dNz!kUDHK)9Z<5;16Eu(#3(ZJ$t+BB5UltV5=*Gluu^
z_kV6$;_zYp!d`!UOjM}7{pgV~QN6<gUz|0(7u=&m2lwt385Hr>8{?unI5><P85h+%
zqEEDtWc%@q(S7{<o_j8F^w7Ses8sq|-3K#9cJ4gqomn%cjv60B#nW^jzdW{Q&ksI)
z?d2Dq!FyH<tF`aV7}d4woVhQ|m^P9{IXTG@hA($=@<6bFm%$)Ikw%%p;EA&IUJed&
zdgS0hor2vA2I@&GHyC(Zaf5+glN%xoUU<>R!NH8S#b&h2L_!B5efihm5e^S0Ck4g4
zIyrgbkv9{Dfj-Et{TjA;?{RxM*%jX*ub*Xh$YRD8FI$Dk%~h+GEm^#J+0wNeHgDUu
z<@1dj)~rIP*rHGPYb!okvScp*o)@uQB<m#E-QUMHaV{Rcg;x?$24^HZ%@bhfB-<z1
zJ161MScEAIwe-h181JCh>A7)ub`&q6lZgK#`14b&pPP)&qSB!yku8As4&6~`Nv04G
zal4@4*Dd@%b~$k4!V4~AzSxK4p^7{yFEF^}Q@8^$AgpFmCUVk9Vt#@ec)k!h&ZrJg
z+6qiQNXSGC0TdW4Lb3=r-hU&P3>5t`2K3k-^k|KKLB@<47CZQqmBbYw5%d!IAwmaS
zg(z;B&^Eq*m%7~BAz{Wk#3q_meqlw0_1y;FDX71$^0;&{Bp{$|+nzx!l|8Y)H75rI
zXJ+5^4Cr$He6DL?R^}bB-R9<SMP0vMJ%S4^baT~YpEod}?b);EubeNunNv|`hVE-F
zLJic4vwvQ>^5^&8?LT&S@3w7w_wN6G?{E9rw|WT{h>XITrs*$3acP<?is56G(ma>(
z`6)0zSIo~A^HYG=VPlHbA``Q+O$f~9TZ=CvqlKTuHbJP;0Y)jP&+gv6<E!I`&$7j0
zZnjBuLRA3jT|$wXUGRCTO4u5y=>nF@nFn!L0u4zC>~~?EUxS)f&L6%xbyQ4u9oSGr
zM91D;JN6m##)o*Gxm>z*>F@JM;wg0v4Q(F`%TaJUurMYpiRH0*AJ{G5y8UY~Kx`3q
zZ2tnCmghlk%@UT-H^XOz-Ns@UurAKbiIWi!z|5dL;vM1|7qBI8E2v1M9Fcwx7G>|i
zUwfd3v}R&j^$<Y`l?=#bi1H=d98;E!9&`M}UZ(7uefo5n9(GNWOsCZ`rA`PAMkx?_
zKS0kAB8$z1$du5=0QmclrC*|)K}TS~5g4#$A}Zv-fJ{yrAcfnS1?8n)Z$CHv627so
zzU=gACMbW}_02cCeu9}tXNMnS*7xFv<fQW@5e_+4sMc6_e0wK+yS3IB3eH0Ks!6fY
zaFh^cU?52qY+bKh@el9PEn)IA^XAQq<4K)Yg-;YCI(xag5mJDIc7%<<_MxG!^}x^h
z3zrzGZIUG)f|a5y#GzmW?}I_S1joljEaCBB3Di*e1<NZy4pwW5h9iS;f(4zb;ov7M
z&?5;Z5g7FhjGAH85unNlL3DR(-RUAmo<up8AitBjU57>po)6}apd<84xq1C2bj^$`
zfE?RAlP$PE-U+R{0g4AYMkFLW`z*9rVUMuKcH#>tHul;p(<e_I(GS95fv{Nn&g79D
zDUW2}#OX0Ys<22E-FsMU?7QzWc|lN60Sf@`8`1CqicgcM*L%S!ALb~#mk(R##p2>J
zb8uBvFi3FKs#zAK)mb8O()|ESSH!qTXAhK!90JZbm2=2IbeJB9$3yX$!cX4<PacK$
zce8|`_6Bj#@gVPc)K7xRW##2Eh9CfEt<cZ{<)RK%Zz*ChBVVTL0F5lnXw<3^ysKeu
zg;09I1;GvxHHEamyuv)HHku2{r6Osz;D_K$fT|h_stG+ac=Q*TBBH9$7RA}knJSPv
zJ^k$xo@Bt20;dvd9;F*_ib6_?@GMJ-woGR!blm4MNNYvz|9vha2u2vqQ2e9|6J|1m
z2l2-hc#eM}6yHo)%0ZxjP<(GFzS*X}si__<8F4eI>&tObjtFJP{ris|J$h*WPe1<n
zBSOXY?mxbt+31j0;0$m$>r850E=n!u3g=8%<_MD2dxSuDMwxWM#?_JOw315C8M)Tp
z+11-V0QL-HG}_%%mjndZ${H&Kv>{Pys7jSqV^V7zap8y@KF6vm$lubcdq4w-p}y))
z6|<?Yt<}J6STDmn>l<;=Ohcq^2h6$dDWaZKizroN`2WW&$rl&`TvDu{)fWgGqfN5X
zMnJ-%ELn*txfThN$AQ27`+>=y_8$UP_cQUt-DLZ_C(fNaad79(od-{xIwc{})drtw
z0U|>@^gt>hk^>nqhHFvqOIG<rMhAvQMr$h?WwrqUB_-7qJaI2sc~8)2Aac<sMGo^U
zVew8?J@5xC-m5AFMynu_o9XrX`ii<_WnBf{$8kt_;|JCY-Ag#6?kPPnyY84>Bq$ZR
zJ&#bTPNLL5FXf*`GX$3>srAPnj~;!5VwDobQg^K1QB`bK67~FYd6IaYonaEt+dm*+
z8kEfDAtFYvhN0a^OI>0AfSl{=gMuC*X`MvU_Ck%LU~h7HlB{cLn$dCLA=1`Kq+MEc
zqY7<loauKTCGVytD<|&===1<|x&b;J0Uh`$AHls1;r{gb>=Vc~18g40KZgy`fbAnR
z@C0ZcCkHEN_`o<xaA5(mP+G}CSSb$cPRX4s?H>>bhs?u7VnamYq^Nfh(6#1CLg8?E
zm{@FxSmc&UNLYf(;{<abDnv7=)4*e@iDn|7PBVXB-hT#dqMk-GN00va2+dfz+{v>s
zmR`K@WUr@EjK$*oB*o|+P|SenSYaCy1h+j*FF`@|PotMEorcE>!=Fko&CNAWqnG^b
zx*`O}NTqikVTVoB=t|=JL@{JT?P8@ET2Bvi3r;b=pZWeEDnCDsVhA!%a*gy0F$gxD
zgQXNpfO&#mB)~jLFKUTiri_mjeignDetno)2rf@hOUDj_`w4@eN-YGHC#a>aO49^3
z1eiQQEe~Ka-Y8|8&l2RqSff<G5(X-gCtMfe<EBTFQve*$>t5r%+I#r3+$#frENep2
zCd$M$;i#+g;t~@A(<(1FtY81>r|S{nhf@ec?QvJ%&Ye5^y6SYUrKta2T6wotu#{ih
zyIYWJ>IF+fU9){yWWmjBp}-XKBwMnvG5Eu>(Z<%c4vn489ox5W--!zsifowOGdLzq
znKI?M8G{Br^D?zK!D;j2`!k=NK5NRjfdfsdsBtgMdFRcy5`+{~QCcWm5H1R9lTaAY
z6jDL0;F_w-VY@(V1&L)xM~^m8NJCs)22P$ldHe`OP>!E8DZ-I?A$9vcWUTPH4;W8`
zT<dJ`C)zmK*f^nBuu?9_DT`dI_2dE_@*Ls-Qo+{F4hAXOD>*m{o=DR!&ZBDh#ksi|
zC?ubeb^dZ@Zeh{giVBl`&E3LV*Dqc8>n!rIPop$f2*=1HBu@Ks>Q;{3IkL>?=H=n(
z>Fz2?kyZ@9@F<4)*Koao=J6<oExh=X<sO0u@P`@$k6>70r6frqNcTUA;dA%kJh*o*
zBjeoZJ$v??K6l~5zhn6E)$)%RR(&uFSeW?%Z*}eX>g>1PdTTDC6#kb8=7JiMx}>}s
zMt9l2BADa170Zvn#Z#;o@n=Ia8YMd(Lom=PiF!!-#}J$gOBZrVGBPe)!^O1=w{QPD
zf*)V6|A=6TulZsP2ZOH#0>kcD!yZP|vVyY04?YvMO0c!1iK(uhx|&&ZVY7JUij)8j
zV@i_Tf6$%7R2E_}_6s7CasM#Kz@9VMHX;8vAG-ba+s>VW(y=UV=A6;7!cO5V5}iXV
zG3d#-&-Rp4rvkdkWB~z!N{QdW21;4fP<p*G*Cfo1p{($v2ftt1TwRt^U!=;-wYNt}
zPOgzF!IxWgcqL?(5`5VtY({axXv<*wFYLpAA(#FYnIyfxJw8LW*;z&@N@==LMCOfk
z&LooWFH3`y!9kCf08U=sUS2*%A6g!+(T3xP4;`i354(23BlyiX-{KUEeyv|YVB@QU
z?jIboB;U~AH#+vd@?B2m?TYf#Uu>zUuD?@JUQ}?`>=kh3uk%Oz2IlSerCYy#gT_sp
zHa;dM48C8*J+#SeP^*3W(Qn9PN(@iQe}lgJ{ssRbnU`Cg+lys?l|{FAcX0J|L_qwW
zN{vU`c7Z|NqI$=Gfu)KAqy5r_&LwoSvvc-<Y1rSPXIxxdbT2fji;ayn+6m5^Kijf(
z<N8gTH+{Bg)5cFXZo;t*je`s=*s;>>;Gsi@4<9;q>?lqe6^8NXNkHU-gB~c#{c^8d
z$(7mJ$*%qN*R=+PqM^2?wzj&WqMBNB)ipL|`{kCX^?G$lZtK01!QI=<+1Q~&NV}l6
z?fnD^+hjK|fLaa0eY=66EUQNQpE8qt-@XF}7(55!Ujj;gL#Doshy+qb(G^k*g#~^Y
zc=jhIRPk_kXG((&tV0HqytEW5v(m{9F&d~I)q+9}R*C;~%GysfWufAg(V`s@)hYVt
zW~D6pj1uERR0Zx^sqqNC#oAr^BwZU#*8L>e@yM^_XO!%CU5u2kWTiy)g-hqpUA}tp
zg8KU9OIPWpw(oKAYrjGHzp7gag}hK!g6QGa1HD}3`ZE1A_1Wf#Lb|ET?p9Qm6qS~#
zTM_4gMmUdRN-wLclLd6>5Kv!QTJI4U=%N4V;PsrG>j!^oy_aB5V|6wvz$K)y`p{U(
zE=S)7A6P*__VtSw)z`0IxpeX3rK_-x!zU#=eh~v_&lmFCeZB*+!pXd&P(0JazQ;2t
zw4wa%H@CihbJTg+85!AyrKM`hn@2>HMbH_@$)hv`BD504A`c!seC7h`;9WR#_@E@2
zTI(%QgiUL`FilZKMM*(!Zc!1_96I#NfdjvQN^#k<=lK2CuaD6%4g9evh9QcPOg{0*
zkv6etAW|h%i4!I;G$6`zch4&*xQST4Lx+COIDh`sDW-w#+hFi=cMo8i8w$n#^hJyI
z9%o2uZA7t%d-p2-Z7fAaxw!=;6%|Z#;I{(@P8>RP;sC~?8FT&m{_#C~GL0o2Zc~)3
zKx?*%6DGvcK!oM8Hb;)&SN-w31qEJ+U_5*3)cNxnKOZ{8G@cHgo^EJ)iv-^r$M-H;
zl#cSSOw%AVG}PU@SJxnog;q!autf1J9^mKRMo|TWFmVi}t-XV-R;4_A7y~+}MGTJ>
zd7{mY@_Spio+@`aeAuSxUTML(ojcDJlnT0uee7#%6B5Quoc8+bvBFWDJB9a{{^rdR
zxB@(lMx!U}`^7hrPe{Lj*bh}rRYeUJw93Q7+sDt_3*?CxIDz1m=Gxk_Ms;0XLv3AM
zZG%Kr?ig=t{7pNIw=d6)qs=2cD~K=B)+iJ;*%{e6wavBK%SV6PwfDF4M}InXj)HXX
zi_)9q8UFqmlvXww(Hr}Y{eDavtGKx4yNh8Zx67({S}49rPV3~o7hjBp^=yr>M*R5g
z7)0hSw9z`b`5B!2+_mnuC}V~IV6a#C=R{phkFN2<2FLV|>DRX(iUPZNx}gpPid4A>
zUPxDkonCM6=z?B}dNgpN4tTI&!$9Z6yh=;&6yB{U$ELl!;%?!c((3BcyTypNDZX1;
zEn&%sSsStLji6p5_=HhFe3*z1KsG2np+dI`VAgKmK9D_-b>P6E!$%G=<@f43N2e^4
zGV8*jT|2&FsJU6}0lfz1GPwrPIm%~j3_90flQMY3?Ag;MGSvRQSAZfu(C!o^H*=Yt
z%+gR*bho(pZh2)@eG9WIEfrL-R&coiE@`K4s;n%ps;@^%10p?`T}unv`4to(uDq_g
ztklXCscLOUjGQX<LZQVCm3l!5Mx%e50GMDAr38Efh9=yz!A<|+=Y*zbaQ@izM^g=*
zY_QlM^M-{_A=ANOmLX<}buxFcfhC|D6rDSTEyA~oH>Sd^j{uwWlZTF;Nk4e#d?C|r
zq2u#Sa3z0+a4a*-r!7b;Mm+*89LML+pZhBv-2@(eh3g6b$8opx=VwAo9L`NG|82>p
z^Z$c!6W49c9kqITXi?z+Cso6-NF~8@)OGh7nxSkr2+GQe7WZg$rTqoPv_3;=@+HD2
zjH+Puvc#)aSE|qd{>^gAJ9!7z`mewK<<L)?5)kV@6~^4r)N-3e3+bAXDwmEP#;yqy
zVuTe!I#a`Qm5)gATWYP1S^?b^>0j{eQLF0v&u|zAV60>v?FZVRjOHNF23kTE=At`Q
zZXqY8jN537TYyDCRBLHU6YA2Ob92+LBKGI%sjNFlL0^ePu&@4NNe;*j%&QXo{r&Uu
zg!0PbYI$lR3V^KzZET?Ri*p06*9cpMQ#cP`!hiDflmHO{R_W>Cq{FI&Ew9;Dt}>^h
zN9Oe`)OX9ee(f6eNd+jJRGfj40F*7FG8x;IWI>w-M}??JwpEA@4sLD%;aKIaPI!}z
zjSaSBsR{=LoKjMUFVZ4=VYXqIZF|fXPIJNeat4g6im>Y^;pe<tk$d&;wd;Oj2qv+!
zb@vJpvhON1c6N5nmD!a}O!dibkm~L0L*Zf^Zb{%LHRYNC2jp;=*gL{j?X1;S<dxMn
z2_>fv??j;U+T{fmT9)LPiR8CEE1v0xUF*0Z(UIXj!cy>7-_Q^ro!}JOH+H~)0nz<*
z3N3T)O94dX#i0T4Db=I=Zb;(9(agE7PS;eJRV?V8<PO+-t86_T>X`F$(O_n(+e2SV
zOiY~k?2EJKygd75dT&it&gH9ui<^eP;NVo-Tqkic1t36nb_F0{_0mDX42QA2EpAHO
zj^Y+!<s46`bSB6_y;&%5hdmLKYy4gs$K<s(Hnp&nd;triuz<<+)zx|?2l?ePUZI`I
zL3mEqYfg1)j6#jyS7Q`v-~l>`An)AC%ZH`OTW<RH!`-h1hgRZFuJrQ2U0Fp|rZuLO
zq@_JR>x|D@{ZNpW5G;_F<h;3+N#1?jl(Vp}vaF^@qeK~cCCR>ByD<j-q+gUJ=_Sib
z(v{@Y$jMiNB_WbZNg3;o2J0h9(#alz)<a&2V1OuHa!NdSpB7`%Voa^?OHGZ&Lhi>z
zjS3pBL0HSgiaLf$M^<|#dFxs~bKhIX1tb-om7^H8O#YEmq?5e3xp=UAMdq$dxlv}!
zmQ$fwIex?}r!uqrio?{1?~6Aogi%IGK80CpSwoCMI&t<R+Gl3+3dhvFid<YgWdr;e
z!72D<xT6fiM~@s7-6zb!X8OxBMkfqMJ&W<v;7CnVM+61;avC`!i21Z_8__ccN56jl
z)mWS7Pr_ey;ONn8`?jIlYxRg4`fk_ubxW6jx^-)R%YWdPnhHlN^{#tQK7ZK~Qw*X8
z-cueucIc;H5cfYv*vNcpYpd=e#zd~rDxD#Y+I8&Gr3<Pzd1>piG9jJp^Ye2NG@VPG
zqsRfp^DQu3M2}$TGMSw%gugUNnx?IRmqkV;SaLtvQjj5kFYo2aAw^tZ4j{D!kg{?C
z7eq9}=ZM%41-=UUENy{gazoY)31W!<MBm_BxmlUluirA<y9WVV4+XBSy0Q`_8lhMs
z;L>BZo2`9dx1K#BLjs(dst1o6+B>30RCHAIz!?-PlB{_y$_KLBCu$nHy6E~3Xs67B
zV<K1Cb^!DG@BXVw^rCFr33(GeyG6R(fk*V@uP~|X+4E_v6sqI2c27EjJ<@v_@#8+d
z#-YCAICMe!uCl74AS3hgnZt+9T)n*HlNFzB|ML5NhY$U{D+Z42S2f#@-$uI9?c-lk
zZ4r86+wpw<#8#9zV>3|T`M7WbHTbvka}zB5=(d9M2Vpndn%{#-r}OiIa81bM=MhmO
z`injJ=_hIs1$3UD<>L4^V_|H=sd{644AhGlRExMRVGn`CXqcRnm78B!m}9U(hgr48
z#zw2P)9X==QLP4v8qm>?<Id5^9&MBz?VSv6ZjMiXFUKQQN_+`;Tn;>T!Ma1GL=Si1
zk<e(}$x>_uFiF+{ci@tUpZb$iK|VY{1Ry;``7(riIzcOeBet=z8F?}&5lC@z*nlo_
zjqq>NqyO*`alJx4?4En|g~S1g6UL67ipm5Jy%h4$OH<xs5hssjHDQWQfV8ityG;qq
zmwzEo?2qqvoyrFi={5AiuD*2S$dO;Z`|i7+7`DGtRXcZnv3}`th<*yD`9NH_a0u`G
zOO?_ngyjY7%HBkUj%km-^?kf`@KfG8%QB6%4R0T$hB2ZXN#Lj(FZYANpi5+AWV<=<
zzBUXCtw-O!eFw!27zQ0XiB82lRCjxwxdU;u>Zn6GmG#2|#6HqPfD%!oPBPq67h~w&
zv}?qb${h%#wTCPQXD2LRJV1OTJ^bg-Nc=MlnCvPj;NOu$Hp_5>T)ujh_XpsSnpdu0
zyMh?AYp8D_gPV`<P*5aIx@QVMzqj8W5eIg=5-n_(h{N8X=G}^zKp_sjZkW6#G_(dm
z`z7AqVF=!@Mn8CcTPB`5HOOL*a}+u++gjrApM2%E>g?^i?`+S$vzy5k=g%YTyr}Tf
zrP3mkvasmVrJ_>iTvU{u4OsAK(Bi^7#f8PicQ7t9Jc00nn*ki_J#+T(;LQhkps1&t
zyQdq>v`>Gl1P3p`fpSp10S6f6aYLU39(4--mzRgc2$K!CG=dMnu+jF!d+b>6;NYIF
zLxzm)iI)rp-`rANuCFut-XBX#J9gyA_RR|ye!ZRP%;vyAZAYK-j@oh`^l>1{M+nPJ
zWJ%&<2q}Rd65JGRSsd)_5cQ$Ax5L7G^rZ)qj%;@%xmzV&N{WDhnleZ^S0-d~xyaWi
zbzSi{Duf8EPir?5Z0JO_466<_WESiaCnGv!a$;hCh?D+_%+AwGR&n#U-%5&WDhkWW
zDA+8@(gj)-on3gyLqDL1&VH6CX4k$$`#^6G4;N>@z~IP8q)H&SnMeXONB7c*eK88E
z*)s&A@Wq%B(Mb&#sPr(!UeO!vu7b^@nLYKhzjouM9n9Z|lx=81Xa)j41oe+?+lEIc
zjz>%$c%l5`X!DO0-?32hLM&By@`!yQT3E<zpx>eH%b$Pzu_cy=#!k^}8Q&MC+`hyX
zH}Vr@!_+0qmM&kEmV%Nh;V4@&O}1!naV#d++47QV$+w6$`wpd7U$S&&Hq)k!#a0nE
z#dl*Ro^1PWaP*`}lcIyM!>@H<c17T=*?9%{yL0Duo*mo|r~;+NJ`||5*m;1PIyk%H
z&)wa{`LS0yekh}-mD(Wxct($!;#r9;qRJm6Cr(5`jflt6+AX{ReSN8z_#R$5T;E;Q
zz5Wav0Hn0H1fv2=Fz%x)eVJN@h<8<q*_o*kCPjZaR4|Z-c_O-=LOY2kJoFqN3u#(p
zg?lvq13Z=?0L1fgUF&J@Jb`zb4?O-(HNNv<T1`!j5snC}S!#^=kVVDSF{?i2fDw3u
zPCP&-WQ7SbqDDW$t-!nFDjRu|jl8B&b@|-UpLYFr9!4~J0dhs{?&9d)a{ia|>e#B1
z+ho6>4}rL#kdzhWmBAFE(!x*ybA|N<d|O?8Q(c41qC&TD11uDRzNQA9T}!KLYU=B%
zs;cVhnZDHk(Q1$QH|;$H>Sz>ha@<7Rs;t_(5i<(F`~$F7TP+s$9J|?B6lP8#TMUz+
zqz4LYqAUB6qXzd&7#Y~MORzB@u4e~kuXOgRs6*yLnU{;wE5w7@FIcx=`KFcMZU1J^
zS9?DHd?T~R&}A?PSIcmbQ<%f-vpMDw^~(e1au{VAAmf0C`Qi%sl0*fF>g7Rmj*q`C
zt=mA1{x#s^4d5dX)EQ{487@;n@K6^Fxl*Q*J5XFPLg|QPDGvMAEeF1)v8wrrIU(dH
zvUA6f_5lF_Z9*bD->cX7hV(`#b?*?b`pM5u9Gi&BDZ|H3d^Vs><e;%H#0toL6w>4`
zjE!%@Iyr)4d%Cz#ij19Jc^7JfMc)<~GVS;a?hn6U)(7K-woITJIPY6NRHdzj!DDqA
zb+~*#2=TBB)6$ZYlhe``uS`u%TeT53kxi@8Qa}4_-Ktfq79(A0)yj>mQ{D~ib8qC8
zLRy#R<(FWOU6_}H7{(m_Le|4C6y#;$g)9aTATE)^9FcGo5$C|g5I8J90epn^B95Be
zk63yXS`Am^6Yt^ckam0&#pwyC-_PD4tD{VDEA#rzY|8rrQ&7F^>+RC%BUE%wL0ZO*
z8zwO*h;*1C^5o>BTd58E%a-<d#mC1a=H)R(PJUq?J_}}QQ8*ghoE@a=M`a4dbUh?f
zkm+S)!X74^<%?Q+FZuMzmPL6{6a_*)eV0rs*hgLLvY?+|%eaww?JDUCE<`BM=>Pya
za0NvVJyBi4N4)X=8#Aj^ZMt*`_4n;CbY@jyX1)z`iH(i)gfduFd>7y^xl@5HgL|h~
zChUqwh_SoHA3?|C#9d!gPoJ@tSGBwD%CdKVBeUz+!@^wB(+f1A-MaPd8iZ2fft`DI
z>(*A0pUzzJb3l|-P(K%{@126%`FDy)UvQyu(fFhTS5T|af)zb(DRB_C8Yif~?ns7n
zC*STrzF&fh*7(4qrUmcP8cFFz3>`|<B;glQM2oFxw@tL%6>kf))bXqZQSA4x?(^VQ
z+rR@nqzLigDM(kvA^jTJj0S*427^WdfP(-*L?ko53mlQ0T=<iV`b^TTuV20V_r;4S
zN`50#Pf`gxHV_k#0PZOW^Af;|4{+<y7GZ_{?QvbS73jYG^G~-5od?Z)F9utQP2wxB
zGtb!e-nCd4SO5Ow^y$;-$8MNWcB4b*o={!8Q`x(Ca~ZlcXi)Vl&=O`DWtY6`)QQU%
z{|;*FAeJ0l9uME96ek|fJTuL%_K?}4od?)~ldAj*QmV2qpFMv3_!XwlCk3~#sHD8K
z6a~X?=j*xn2OL2{z*mb|Zy<Hn&BM#j#|P!XT?|jWLxK=RokoC4dx1)=QKy2-H8fPe
zb{$QnZ$a6BI+vY!<>Dp$s#2*^D(Jwy5?V<z)|!&JRLvY3>gf~Ovrm|&YUb;6UmX^1
zTa<l=>0#TSG-34U(Gw<(Nl54$?2s&TY!}5;vTt_ZY`KF?-<y`nvZQZ0$qoX^x?9F6
zcFCi<+B5yejq5)98YLsY{%qaGjXO>iCCiFV?O-l<@^2U3DMY>W9H<je3bXTzVf$w2
zFOJgMbl|?J*^G(;=H@2m;*Ngn?rvzq><Ik=ilT$T)5qKMpWZIPgCe?(fCt&mTO+!4
zfB&7GeeU9ga~IE@y9j#{=>NV#kE-Y~!VY1F`ezS^?>&D0-kIrY0|RT#=Avro@DWVx
z)G5YXY%W%hXt1BwFk+gH>2&GoI+d!h6uNpfL!GSb?8?%zO7PKAMl~_0qB7@rOy}q4
z;Nb7$>+j?5@AKGe(rBq7p)E$+THhbEEhNQS-ZtMcPl8<w2TPJ=?pw{|R5+C-#R|K`
zNir>ygNlyhrK<cZ*mK}OjLz;D*gqVY9BDddB^mB)lxp$00T!fnQJ%Sy$2*IPU-tdH
zYq#R);m<$c$_ow2FJ8<nib34&T&6zXvEz9xT9GNz)3<C{L%lAJU1sVI7cX{jl*t^K
znoI{hpL-z=(wxFL$Udh;lyy6==c2K<@5R)pl3r<vjI>DOAWl#ACtHkz>`&+gDI~%1
zXTHN^e2QY`J|^Q6jG+lK8K0e4mCt0>xna-BWHd1eZvXa;h;+rq=kafZs{+r`H$u=6
zwD>ndYp{MJRr#Te&Y>8iwaSm+^*2h*qvm8LboFZ)C}Voz!nyRnFp59Z&t1T`VJq)o
zft`ihePl?<rfU=N*A$sP{n?>Hy4X>S5OqR6Y#*EXd05C7bz+44?%gwA#>3D~k<yb;
z8S~3CcbQju*RJWV_fUwx!L<{XU8lQ$Aywe~T{QxR)J!~lei)+C!_D(>{%F2nu90>t
zsP%dQkLT%j|4^U_g0c~+DfodUc@`B3T3@g&qqYj3k17pa`)ev7$19juIeG=4N@zaR
z`8x&qdAG{SDyyoI$yZZVS%!&WW9dMCX2?(y9^`eEizZm@%qd=eMo)LNE-+ABkgLI2
zkNALqHt5hE7~t>w?;quypQ=kF0?vtmb8B@8uL~E?rT;0x^<oCx#Mq6u!aSQLDL9Nx
zsJ#O*V<H6~a7H}=JQh)uaUL?vCSqG-N6XY)Y_Y@jL=-QI7UQwiJ_x>lMA)KwcXW7o
z_~>_I;5s_Oyj&YNl*0k#@UH3UUGJU;r2pcORx!D^*T}cykpguF;V5T>)v~uodXby@
zV^QBi{J+%F7UKCu8Puvcs2_tZZOx_3R%_(IE(fs7i%hmf8h<?Y<p3{dUS*|~RW%ZT
zOAFx3#-_d%_%uTfY?A^2Mx_SY4FTXNi$K6<UcNs50f7>PeO%pqkVADJ`luxNub-7x
z3srEWJ|CptS}QoBb2p>_$xrYD5HcN<HVRj*=#h<jM*PUUg_LiodtBwi|68c~0^Y_m
zLz7W5kS=kUplk`9`VZ;dH3U{D7t}NnwXU!+x>B%L+la0S$Q>Ow4GH+u#^Gut0^TMK
z?-Lu<fpvl!Us_t%QeRyGL0F8fC9)!Nv(XhvXf7%!yq%L<SX@?()(h2@E%r_zI8RhQ
z@>%l9wyoPvpE-TzkH7x<>&(ex$B&&ngR39D-D+Yf=toUuUEbmOT`2Nmi>K0-qJY}s
zwV!^rk#(dP9WNg{15_O^A3vk7SKIIo?ZYF20|j+(psz775aJfmZs=F2k`esH6p!p2
z<Rj3LpF{0>X$yc&0B$)nQ?7%+QiOVZR!Evql+VKfm5}&haHLMY$i(NR_)sY6pFbpF
zi}uQHSRoX<aDT6yc>|fd@Hj9vVjw7=TE=99UB)6}MLx5m&se7ZqS^bX`_bdxO#JGP
z1W@Gw`0PHktg*bv)O}S~>@uD0t}u1}ZKS)x5y8}Q0eQZNcVKFR3ldr3j(F%fX&mJJ
zpc)d7MAKwuL(jU5R1y9+J6iZg-qIa)X9YWxY{w2g42sd_Z1A(ssqs;fNv2X2F=c)>
zG@TMuc%wh1!2w#0m-P|n3A7)kyd~<6^-$gtoN*|1E;Er9$CUHt*&gaOi=ow{Os}8C
zVkoslypYdJFf$>`Br7V)V#r>CGZ8!;)x<!kl)dEcj)eZ!$I{HmA7a3IFkn60_lJ<}
zUY>pHdIq>2cscFeH_3y7q6Z?W)g+rW3#n2uFx>gcfB0ebr+jW%Sw&2qol{sq>A@Dc
zgQJ@(zv6SE$|2OVmUhIbam9Pq+EAyhn^&&h$hZdZrC^UD7g@YeAv&NW(<0%FV&CPs
z*g*O{bX=0_^_}(Ty<TUov&4hR#E2&k#sIPJ3LEIx1(iu&RCK0@;Y;)L^NNdZ7u*3%
zQNkUq{TRxT!UgN;;o|E4;K}>r@_TYz88;9r3M<`%am5JDqOU?b<fWr|vBGyS3$1x%
zV1vxRnD;;eg#ZsosWe|RS3_ZVY+wbq(GUmL#0O)*z+7F>@dozV2Twkr`w(Cy5?Ha)
zJ?iBHMA(9hG7a3bwC}oc4NL_R0Lo&EpmY_SI`={sD0DAXJGn>p>)L;UE7PM_6JEY{
z{ra~scrQpxV}ktj*<+s##$I`}#T)0F;O4Y*o<~C$PBT5?_Fz@^@7Xg3T1X7V-@q?T
zTdCW3Fa)q;=*)7ByBk`oA;iP|!E+p@RBa^!BPZ*lwb}~u)xa8HH$c7`RB*^MnEOmB
zGy!Ucx*&*CUnU#!W^&djV#dyV_Eny>C3CXx$MnrD^_7)rX$vs;Z?9j!){Ha}`ZCyg
zK%(M6IDyB&oEM1N!{iV~=}7VXMg;B{yn15rJ^hs$=++P~u+*7Qn;GT{QP4nthSY$0
z?*3DJ<kY{0sx?!c7)Ma4BQ!HjUP%dY;_O0}Orl}FO#Si4v0{6ntEH!`px}Af(~vka
zq&w9$&Wo`OvJ6rt{kJkSbTM9N7H(JGrfj*JmoLM-nVo$d-vJ>oUjwV4MhAnhjr9o$
z=k4+Parpgc{66imxtF};Hnv^|))Y2ESGjclR&jY~h>kgzl~vc=xqVgeGc?yjg;VH_
z`ZAV?2BN1xopi23gQhlOsMwjGHgFvo#2`E#BMuaiK%mtIb_(|MFti&!_BDj~&VxNc
z79OZY)3P4Wz<9YZF>U8ibB?*ue4U?p=2CNmMP<=~-s~(rnDdn@$A9@Rdb9rZ%NLv1
zuV24q+vUtF%z^#<>#x85eP!+EyLRn5y?O0Alp}Z*Zu-~BJzuBv2yhjuN?XbitKC>b
z?s?}!*|3Rt_P(?SGV8>#pMUuF=O2He_v-A8p&`QE;`(O9zE_lyf1cxr_6W42p*?~g
zFrqzzj?zStFfQ3omx=9q#2}nwiTYf2LigdrVfadt2L^&EDzXBzvJfG+YsdVh$A4P?
z#q#B!f6kWaa&w`7kRgLirpt7c?2de5$y&Nh!VF?65pAUqVnEY=_*Fjv{fdbU5my3I
z1TBi9J<nXknuLc7_4Kn%wp7R;!^3OX6acF$+`0$4S(-I|$h{2jSdxFM%E3Rfd$-tu
zgQJC|486h59)cnJyY1Vz|M1Px^ct(kbak#K3(xb;n|6G=dGnSXU+wsO+n1+~|FU!2
zmNltV+$|aFHrX<od1$o(0r(JEnUq3p)>T-f=qS!BXZAdQ5G(jL*+X(MI9fnb1pp|x
z_B>yZ;<d>9fqdXcU*?dH1Pl@ZgG9i<n(^Z9hA+X+8BB>x`qq<x;l}NPw_t-I`yk{j
z*A##vH)u&M0Eei6CXMnM_;I-WpgRe{V<)}x$}5ASqT>4^b)ok&v)`INq-WPKgo$+>
zHEQ_Cks}j&dfNu~7{P+CW#pH(2$stiFJ+ZfA<Uww%m%?2P1VI0E?F%1s_#HsYq*mG
zsS><u+2SROKY^X^voE)Q`N_J)$xA;;TlX2FW<Zz==FgwM_46&;zudB!AtTn$uZ_K3
zTx{?5er6b<S_CxRaCC4phJ=?CH@QW|#l^+8GX^rui$Dsy7u{0@Q&I;(JjiVYW5(ic
zhPaetm4n|A!;`sj)1RZBtbnNE0<wZNkP?>v@e>@{0|4!jpz~)y=L0}-13*ZD04079
zprk@9H!@(-z$G0h1eQfTN9c~3&`tt8nReZ<{FvZ~#lh>(P~kHRb4(nTh@H{+Q6qX8
zjmBPMCJmWNGGm1UJlm58M_|X;Wyp}{-<du>fteI`4%E-c(?;Gdwx^qLINLK=?uWAK
z_Vs0OyZn8%u^DPiYJcqAUcKM$;ayGY7x1rszbeT@oA8$%O{iz_$=c26arAj=>cT~f
zmMme==Al<GePdyMaUB#yA0KUX3$)*4HSp~P7o3F!0>FH>=nMkFEr6i}kfsCW%3yAl
zitl2!;(Q1}5(Zdl=vPBWGEExWBWPxUghx6Ykqc{ZafJZ|mvkW12o_nXIQ0McH4-1_
z46Mw+8u$Qfpfj-2xz+Pc^>6v!0gD0FIQ#=WxWnJa=^tx=u=8j~7_Q1a(H6#Qct}tf
zl=8N{`;J0H-_+r8<7eWS@xqAi?ITd%*74)<gL@f4?s}i@{U^NlQHXCh=BiNC*3{VO
z-Q61zmH|_%(Aqi1)zPtIw6$~0Y52h}VqXEhB---6&EB8EYxaJzX8po=NPap~sKU(u
zv89Zw*<5?Cs<tRI6Oz2~UUQ@H?=5EB;Z)^I2g~QlJ~LcTeZ1L>JF5NgwS)EZWXGAO
zeuS?es!BBsD`*&2P#ka-hZW>cUJG910e4s~SWvAc2B4MDOQ_TY^;n5IofergxwUq7
zGKCSMGYdALF3&!zP-uI`^@bfHY*5c|@T$(?|Ct#_`4>1Bsh=Mc=ZA71Xyc%To`gCB
zVqK26IoU}iKzluO_=Z{V#{vor$i8}*xvX4y;>52%{CwcoUw%3G%eOxwL3Zb!PnX3(
zkKw0!$?Bzhjvf19J-*CrHVP`WPnciUwPZN<RVp-_@l(l45G3$-dbf^k874>TLRutP
z9aujk+Gvi@faoPu+rkb4ZS7#0Yf5gdF`bN>RMcDt>(QUw6}-L#?yxejc1Rq8+E5da
z)(aen|HD_@=UxQ+0S|F6f6lya0?Oq6<|~^92M)%uKuiplDA7dr7Qi37O|wZ&<|D9G
zl>fupCa%hCdk(|4IWZABZD7waailZiWDc{&3~b+K=)@@_Vmbjcp^?2Aia1p$%F7J~
zT{%d<P>=;<DTMjlQzffZXrrc7V!rFwCnY8A-w)&Lu1)LUC1S}7R<B%@oU(kyhOa3I
zX#bD&HRX*y=$cTigz37C&|HGC-!8IKC#xFk&1g1@ui>034=|=!0qfLoVZ{M)EKH3o
z17r>btCGn~R9hbkf+$O-34>+uu4~{^5a8GkSeX_H4=yb@%R-gP|HapE47B!Q3<IaK
z>ax^ti<+_H*EQI#qtYjEft?o~V{aP~(W8d~F_Q7!x^@q1*CsI7QK4W`1C>YXgE@cy
z{kCl<R;^mS`m4Ri_rlt6;=qX$uyvt-3Q9dcTqjHe8wrYt0xZ~yQIwkor8ZH75EHaM
zA#v3<SgBMA`BjXy4OVI!sk;_<I3j2fR76S!zi@`!<AngJI)rp_>n42_2-w7xFoaO{
z@O1MwhIZ`})4O+%@&6e&a#&Qy4qdz8S<fe*ouboCVI4~9ZIL=ehmC`>7E-7TEfH#K
znvpn&GR}ylakg!Odl+uwnnr~pRnUEz{%88x(?6_P_34%^@z_1R#cSz&;IQi3@4xv1
zFP?qMiyFN6)fZ{M{g%d5&Kj7^Rq_-!1bd(|H$rw?HFft8Tu=jDzN!)l^(y2tYC$5Y
z&JcdQ1|(H}kS=oa2x&x1*xtgML`5E)sZ`v93rBQpc=#<6oXOfa2&-}kR%NTT(U1Fa
ziDseBfB|wINRn4tl(4awfCo6V7AU|YxH<uP!72qSbbdD0>>W1(Zrnj5<2oa@sdJaO
zNpVt6sIX8yIRS+<s;YvRs_sI$2Q>f?)X9R4N#7_QJ6iB?dpn!tMf-NGN`gX`8f}@U
zS+(=aFTea^`>M1!z?S&n+v-KDKF1o}y9uK~u`6qDyBd>1BL?`pn-tieS&Q^zKBODq
zG1N}d6Nv3$E~KvE8rB|C5fE~-Kmmph7(UeC4*m&J2(SjNC4-6I0YRj=f%m~G^v|D_
zAWSl6fR*pvmpK>+9}wpYi2lU7lX`$rIZGN}HtaemN=woPmE1)v6d4H{>>gU%fc^1D
zn>K%&@4<oAP;1tcKS8wdv%PioYN6gM4Ex;S5lrUZ+-y?HWLlZfknC*9_tS~8*qA_L
z*0rNYk7f$8pcv-grcHUdm(~%qr_yVY@djtQb8U^SmzQIGEqcmax>SZ(9`Gh*BYKLO
zo0FY`0&=e2ZoGE=&$E$%P)Z!kjrrG!+hIz4Hu#6gP%Lq&bz3$jM+AfkQ6C|aFevL!
zbvY?=iq^4+TnA7N`bz@Dq?OTucu_C~XQ;?vcJRVtA)<uq|L_%@%aMPJVsGQXIlRF+
zyvZYqUm^7inIU{bqSBMX0ia`OBzJOhQeixYt_a2}3VwB?Mvm|^IBG0)Rdvnfb#<d)
zmu}msTWtKOvBL&U7&Qt8aBq8cvb!ks>D#AIp8)j1uBBE13dNa|XU?1{kTb#W#5&|%
zf4BF@-V>)!o<J?Xbtg`oIQio@Uu;{qdgYqU>(;>`56<Xrt)N&e!%9aEH|n5xP`hLM
zTBav85nu#4ko>rHD;3snDDMz^7SJDH<%ksy_z-D6^qNF<;ebMCP+bDnwY8GG;KA25
zD2;XqAURHT5WZKgVMPN#i*O_F0fbOZHS?I-r{4Fy_x${(&lsIJJaN#32@_y)cZuwi
zID;wbPTuyCnl9?>Oe&iznB4IjjG8XKCT>7+;SUfp`R%t9_4*$ARVRQOQUg6i8zbKM
z>#x7sxg77sH8aUdN;C_p`J$>)85kI7kTZ;uW}HW1#zaS)lpsfo?_ixmE-oV32oC^Q
zj;$R-P#?j7N;cCy9kfSw@^r__eB#{_Y+CEHbOCHytI)Ur!~hEDl<Gf{`I^KbtwJ;{
zfO><!6n>rJ^2Ve9r(UC)T?W27^6htwAtMdW{U^*G!-N2n@MW^#n=Euo5xSU!-6<Nj
zeC57f>-T++8h;;HmI4?vmCLs;TC!;oMZV7xU?e?j5;`Uee<lmpQs}yUiVJ=j(*^^e
zvWplD{;0kc6i^xjhJsZ@*C{SiDQ#$GRAx~M<DqI-Prg%{bze}#msl6aurB&yUGx=1
zUmuV>0;FKEP>KlP#2UeRl;Z$9SIA{P;El9U@+e1!vn&7z-8yhd0J83@fD7!|p{3c7
zWrOyYd`}4j@ls)_dfw}k;X|7IdJNKvm+GcJKQ6vgP*6~(_;JrmEj&^jU!4%&w(Z>a
zUmhPD78VxTKIEg1Q3PH4@y7|hP;Vf5#8d>3GQ|gPO@3vr)O0XKoSDEv9&Z0?y;g%E
zs~>NKe6Jo|J<6#Ovg#>~kcYvx)g2Y=h9QWA8mZ32{V-VUx|5XAq%Bzm!^^5AY5gH^
zq>ic+5b--3A-+<_<SB>_d{c=uf|Ld5p*$IJ!DD&H<b?}2@Q%qJSxo$M@8R=r;>#)O
zo6gq|qZsmVUs^i@SgEU>5^>JT$2%$4H=`Sf3pHU<@lMLxhdU|zz~w=V;wB{+Nl2nn
zk61Xwj&o?w3$BJm4Sfh`u^|KjSA;G>^s$Gs0q$W(xk#M-(r$`)F7K}V?;n<^synFa
zO;FW`peh(VakJJ~MZZ9zDAGyrA9tWE;`Uy|&2n-uY8oHkZxKCV^q2`(USN+fiJ~P%
zhe5(zfe%Ae2yJK2etuL`w{G2{Mm;}!z`&mE++gK#Yu9t&ePsiit}ahkHa!1{SXvbj
zYk%EG6c8Z}Eo0Fh+cH;?1n(Gv4ya7xG_S2&_v||a=jhRWd$w*$L&t>0X`6najzT|d
zLYo9IKAi8XS8Un=qvx+XnCByCrdGsOG`DIj)^5CBk96ZDsdVcWRv)c1zHcLp0$x~=
zBr*wmU~giI4p@bi16v~~2woJf#M^*^H;}$UyJILXq_R5x^T#AilE(cXU~&d9Y1O!$
zom9Xf_6MZiVbewaPtge$yqi>(6Xnh^Ixx-LY}C%P;Fzx@l$nvqF=x)qaq)<5j~_R4
z&cH$aI(R^SdvxeG=-qdX#u+mc$BY;=7?upU3>-U;oWa~5Uce7u-xo1Tn@orpxUHmc
zws%!YX=r1%D2dwIy{zA{^VfqXuU)xz^5CyKQ&RTri?+O{PhPRoG=CA|r1tFDyKDXW
z6z2Z$8nYsWueZng|N1f~*z)oa{fne2B2uv9tZbSYj`=iGnXCoN1iJuKn{?of$RT>{
z9Ugm&1XXOKczp#mWQ~lUyp|f=bm=VGGMoux7{-{wHJ8?SI*L@fA5V8J6Jd1MDM5lq
zD&=NpUb{^3bP|^aVhArXDGUK#K$nc+-P~++PTt<OWf{YtnKUZWP<!c*3(O@VqEA8`
z$~niy_l}4N);A!#w!xt-Q@2aMtO(MdM@#W{WE=jx5D$R9f|@!#Ebl1Jx0^AkD?>G&
zy}zBga^=dY|L#U9r`sB%(WuTpMzKl=qAR3i1RkrDm7Ra5grezMa6pBi0~fS@p}HcP
z&K<Sn5v)XTqhKX_2ZOs8MbrJm`z82Ml`*oe5mi3uI3%YXE2fP*ex(qde2l(6zP?`G
zzCK3j%Evd!kt_z_Ae3@K*uzJJh*Q2HfqJ<f#Uj1C#FyO6u9a!E=DLE5k3D~@TCm~I
zvk263%}3C}Nn{eAJbd{2J%HX0fraiN?cAG?D|PGg<;xkDFP7S1&t`-O>%fGFi;EU5
z{q&2iKOQ>p(>LE#R+i;o%lPZSf!{Aa_IzpXmFxU@7ICk+*&dLk9N_<_wJ(8hs>=Sq
z?`3V8v`yM{U(&roK`1*2v``jBKv5I~6%|(ym(dx2E@NI_5k?er7PoOmQNRTi97aTC
zDNy!J3X}p}(tTg)-Zc4t&wELlg8G~Jeg1hgF9~nE=bn4+xo7zvb7+W}M`lVBKvVhv
zxLu4D6Yw57$|@?$&)^|`0>IA+(UcUQn3R~9lAM?nFMmo(v>GL9V=$rzXhfn1Ozo{#
zv4-sIxZ2(-e`>$_OUL~tzam(^6a0FU$btv>l`=)r81SyZubxa1=q{u^k$o11riu#6
zTY;N~yd9ha`3>L)nt~wT)nk3;U9P|L&UAJhWlOc#Y3{sJJA0vRSiczPcptuZ!vTA5
zXn=91qZJCq`*6j7_3e9kwWm*Sp@dv){Fc+FGw|V$iocxvZjXox*|oLm);OiTu)FoV
zGDKZl8>SWmq1BNdMfP#{gkU6qM8y+9ImA##4hO|SLV`k=2KqsPf<Ensk`F)<)$6H{
z%r74*Q!5b^7zqjhiy7Iva>lL^YBeYzE7ycu44*O9V6?i(RudWUSwt2e|LUaQr?Va0
zA2UcbTB9|FEDSG?UL0Z+jiD=VtpU!-E}q|Yc7n0$)|H{6@w<KdKL2*hzWv|T78P~Y
zcb62^ibh*uUT<Tij<?&@zLm|r`Gq#o2z42)m6hfS5@O{d%3agKAzMvN#%GbVWb!yj
zx-#L%!q<G=L2?TzN0snnd9=_YzmQ2uLW^Gi%~5Jx>pH9%K#c&>Bi(tM^iH3d^oH;9
zwN*IFonvqfCddIgdO5vG5FvmCk>n_yaov6B5Pqigz8)bG*PcTW5B_Lp0NUw_cu+}Z
zF<zN}rNFk+%6hXh5oWLslCi)UZe?q;GP!8>13)Kca?7ph_^zz0tg#)pGIf?R+#DJ(
zgg!~n<GwceC$G779<Kc_PSKBRr#LqPEVRiP%w-(IwKL(aJ<crLQtrFSS;{6{`ZU+C
z$Wlh*(!=SKOq~=9G9~cbBP{Z2ciMIMLwa9Hqo?@-642KTic);>QjV`1hzBu_Oz#Fq
ziAnwF$3nduAq6}GYy~P*@4?OCc^NB3Ls%(ceKQv$hf?o`#G&{{rg!6}G=)TV+w^Ym
z6mUOW`(Y*^rgZWqV5SU<L*);^rf7kik`ShuhiDx>iCKgQ;Mnv4(8gcW14tXM&;BDv
zBFsdhss=r#LCb;4hrOJ)EC5ps3Dl@PEwE%!NN4{NkVlP$hrssBJ9joU;bu^VNdoAW
zXmQn)hHL_f$V|ZN+<+{_wjXo{59aLMvuE%AO`kB7{stXsN;7^+B>_Kuzjd{`4B#xP
z9YE7V90cr=INbx$!aXxRoo&<Z+ZU0MQ5iUwQKW)=6HH(_H*ia7=@Fe9yQRMm$id$5
zEo5zH$%21<ePb6XA*`#hJ~b#P)kOzt3Dp8haka#S07CtZ7h2-!aoZN1yTj2Eox8vH
zhqdY4y^U5#$RJW*<78J)tEs2&zTpL(yO*VwxcQ1&;_mR)*2_9~ccUeNK)?e*y*Hkx
z{vU*xV+sg2xq*w^`yfO<Nd0^*hfn<t4yR>?hr>&3UL3yhqmKqSJbL`rUH>_UM~!&#
z-e2eNhGVC@uI2EkU*mAyrt%@g-sR;Dy;@kgw7m@w&;y?(_Lf>rcpDb<D&f!&f6Bc|
zN{{^V*}3b>uRj0m>up=VOn0u*?ccZe#~*gnA435*#kr$xZz4Q^zohsl#bwUZjrciX
z-`{%aPwrpWXjZ6Cf4pt|HV)<A9_C&vpevml<{0r%1pN`OdhVytAs2e|_z9y%jv4!`
zj&qh)R+ZBq^)M|C25+VzDF)1*SnNc=1e}(E*8)>VS9N78;%F<Y-FsILkG259A8n;P
zl5uidnagBH0}X73l_>9zxwNpjl&0~*i?&Nwa{T|jV+WM`ZQHhEBMBDuYj}6VCVqVs
z08+pqiXSm)(xkMA2o=J5i_ac8a^zfTX?G~eI59#GVA$T)n#-5}{O7YZJsPc26&w?>
z{Na?MeYz+y;`s3k6>tF{8Qg?L=&%?h6Am3cy8E~k?`;eq^^(R5JuR)Y_<)A`h6d!L
z5|Bk}g~8NxIKUfuP!feE2}0O)nzTCRc)x`BgoL;l(gPC`Z}7Pduv=V;#fUnW(Fk*m
zwZz9+Vu?*$w2K3uP+r*t@JSq`;LR4YcDk5E5;S-sf42xg>T_QH6<dzKTMoRo`nC0I
z*RE&&Zej3YRoeIOjtwdFcS{7oED_2Qb;!UJfD5Cw@+_bu*>GE$dF9;DE({ZYw}{|V
zd9~4~X8vx`0Kg}vt8B9QyX6A_nFx;w4fwV3VhIg1n@4c*@fb7~?|H!c^DXJO+%hvI
zW#%n%G!V@Tq%TkglefMArA1(cnE3IKH2vG?4JyOHY;wJpu|<&1YNJD6ptsBP7VgqB
z{%?13>obF&k8si0YP?~#ppQrBE&1A~8+=ZV{B*zCCik64ck`wMuKbH=YC|y&Q!U6P
z!tsP9g*v`8^Mjq~ALbHHq3=*C9ksxdsw->mu<Mh9{M5YKFD}+!qX`H66Ngx9il@Vo
z%6(U2HJdUBR7$z$hkXYQ`QCL`&Hk<XL)8vszH487=CQ{gfBdm$UY!Xm;X5usns;C?
zeD&35pMCa^h^IsJA8oIS5gHBOZ|{?`G5hTOJj{HYoyx{_**TLa-&Ktp<E8+enmlIw
z+>B{6B+x1Ft&)}+P<y!uV=y341A~K&dOZ{iz24{xEnkmc@e=)8TCUoadNY=FX1&sW
zwMEcUJfl{NxJDO;xTAf&uuhoDR(bjguzVGO&f6t&`Ij>ghx&?@0PYk(&I=T|`w)9s
z&-Pmh?M?yUylzodbg8ul{i^_QUZbco>f?iff2RO&Ucc9j9t94LLO*!0*|u)q@%8F8
zYpjs(BLvMZx*_59DK_hpP;Bif?!x7C=gqkDqXKGH<JJV+r+A(<t^iIP$~>gATqvmp
zfG?+qz@Lcl?Sj(Unw%pnKmaHK9)^(oeCn$L!){2v`#zQ_08S1MHGt?x`ulYwE8V%6
zSoL#>bvM$-;q*4tHAZ-xL%O&djYS2X$|fv%WX7gDAF*NtvQVrhr15B_iW6j~rZ|Cl
zXg%4fr{atlET?EyN!BK5PquNauq4kCt+ymE9Qs+1ZI&V;$?y_MPOYAXv^E4`_`Ljw
z2bL~PNgjLmGn7~Q1>56~Z?V3buCCnNi#`5BZ(SnB0CWPUp!`wjcwhjHM77pl`Fp@f
zd><ErXMR!f?mKV2o$h=^o1Oj1#y|h*?bku|7mfJ5aUE(1fBEG{Z?F67dXYs7F-oNY
zz8nKMsT)&A7q3+6<?no#^j(a>LXFm@WMh){_&{qn$puI&IkXG+mt2xkgD9{Ly+qFK
z)v;0>0JI2LpJ>%eA81WSeo5K|urlE{PM76g5~v+#8PJ21KyBZKT3Z3^PMEpiKg6?x
zZ~QlI{2VBH-@(vHyU#a@z=gw*!-ju8-~YY6aQl0$)#u;v$>n^aqI|gXxw1Yi9irlv
zK8Llg@_`2zE>r<hRIAZcT|9pLVijp4m@Mgqoz4&(9ir9ucRDmdx-r9JLx&9ujU7IQ
z8FP>PTu^ZGBus$2ccVViezsQd4+=7{t}Z1Ei%Lu^h9Ft`6V8EqRX{ig8nj2i^QW_Q
z5dUuo>`7V{?2?xSL0EUbh@aOAFl)&4aIaB`Uy(eH)dh#pdl8EYHeN&yEZE(Ou4N7p
zY|HkEyaH5au!~5%`|I4U#hJ^km^#4s#O+nC@j+6Ba(sg=gAkNx4MGS?#XwL(Xb$uf
zSYjnIsh(A-wVDs{D;yOAzwYX{l^xQlBCbXpi?~W)N@W03Lc|iJAAu>Eu%eK^NzY07
z+%s@jirY*;D<@hwQemhMs3SO9`JzfK#gi9ZxpMK+<tq{#!(~e5LXb^AMwcC!J3W1N
z6Z9WCk#rt9pXLf+p!qCXeAlq#Z!ZLAtjb`ovDcIjriXS0>xXbGG?a^;x1z1}ySJ!3
zEjI3SE29c9k5ayZZ??GhjW;)JsI58s*@jGj6;Yv$H0N^7`fa6UrC)>ch=oa=HERKa
z74MieYf^mRefQ4-{=@t1Q+7z&wz9u)uiP&NP;h#AWo2!3Riy;VP(}G#@X&&1IVIq3
zG%6*jU-a-^P393ZfyfE7IV>dDEWtGdml>}+kqzb*vh5PDsEJp=DEJ2ta4dR!2~grh
zcDKlmh-@Uxf-;X1myjG);yjN{B|DwHh1_0XEYM5pC0YYe>^Ws>5>_BQ*-S?cK}tV@
z7A)$V=m^+YDZ4_{y@+CEFTWD6g*Xv)nu=a~dtXw#u115D6DkY!KR#>Li+fJNqYnwK
z3rm|cZR)tRY12l8p>!(ARCrurvlD>}Ns~Q%3W)vE!;OG&BeK{AL17y7e=-e7$GG0s
z^4s{qq&LwRCAtl)+@Wg)V=T4_ECIV0sMrbVTL3X3jf-W<wEO=!2R$v%LDQ`4x;ZEg
zPv}N#AgwwMlvmlwMu_+`M_*rGzn$3y!^MmF7m)Y}`|rhqOBY4eW~YQOsVUCe^VR0h
z*;c{8adn|Cj7cBDn4Hf^7?YZ$`A@A{wuG$^3{Yb#T_}?cK$%o&oQ6P{B{jUt*A!%g
zA;UmMI}ADuEg&LMdJqsxyLttUkHJ@~RI^wCm66Z<j97Vee9`3#=e@Lu@fNwp6_A*q
z(Q&e{mB*?=cjd}uxHmA5+6r~3q2qL-U44BH#(Jm0m5ELNc^5xy%9POwF(#N8Med`I
zV5U=j2!l;s^(^=@pOyzOM(I7y+eBuXy<)}65rGQd-d;{;_CfJdAmC@P4Qzv7YBE-W
zVNs8-gwA)z*i=zhSy=_=5#~Bug${*kI3yY4#lu$R5he=W7co$jdWFd?sN2`;FedXJ
zVc1d&DW1)xCjpg}M3*EfeFz*6HM|ggkE}eD2}0{YOMQ+%Tu*y<@BaSt5B`=dhbpZ9
zUIbvq-_blYau$+E@230&X?xoFBwt+z_|AaQAxL|7IGphrV>4#Votr*QR76B3rAjT-
zrH;NGZCm+xR9K|wQvuHrN_8Q!9;s}A=|s~w&WC{aP_7FB^<KZqEus9bM6`sgQIy{W
z)LDWxk$v(Sq_t7da4}-LV5t_E|0>u4v<lYOqtX}?X0BQ#LY-}a0|6L0W5**PC9z#(
z#;kw;`@8S<=jI$dxZ|@;A7*8-Gy%M8u;3M^6gf^UYLMwhp|@oMEL!9o#)K)~Ql&-0
z8->`KZ1VrPtc@hONN$nMjU<;#n|n~qPIum8W#a{it^rMsj;3+$<8?G4@nvCAg`loD
z{yml?z<Hhp(Xv{Scyz`uXp4^k$PUu<F1iClF(I#e(0s3TJ&{M2z>XoXyD-r^=Sk8;
z`cC5HSpj9p1hzn6z$zGY$7@<NQ)EAis844S*zcwLHM!<%vgJ~yHla9^EjQ2tdmr%|
zs(6>!6b`4oUomRwsHKYF&HP_n7G#Ft-4~r3oG-FarNz7mp?0L~LBuK*ZW}Wxa5Yfw
zlnOTRTtw+>{D!Eml<vG0F&=oRY<ZUWWog<au*qm?xxnUNhZz4n?4ktr9d=-$@dMJ7
z=sjo#gNYOnQkb-WW(p7?)-19UBHJOd5|JT-mUQ$aP=Rt^rh^JepaQH@CPb8C>Y%YK
zDXBEi8m|-~lkW-u4r#`^f=R2$DAi1*d5e5=(vC&=WK4_oX*zw{2lKLzHsj@&mS&{*
z;Kz&%46=xjklwt!ygn?=@CpqHvCH4^DI`Q>ekGr6Ia$&a99#mQc}ekS84ydW^zVH3
zeF^?!%V(RnKxe=uVv!ykM`uWvpmc0}lP_VcEJtc!B@hj14y+{4FQ$Cb3aBw8N@y1d
z^w?|L$D7Q7NFYRpjF~1$GkJu|OxK_5>QkD#h}y(!9^G;ZnjkW>h*^){Lz*R22PhB)
zB7dGV%Xk-`{^Ge)Q9Tf_gVMP<bgoup@IIap`LlHHsNd#su#s9sOc8jz`xkjU@RxZU
z<^)bL>cLSDDrV;|sdjVlhO7-)p~`&zhiVslJ6ONd{hu;>(=Rf2yV0&<KncoZ495Hl
zv@2Tip!~Cj#2ma1(6R5%1WN7KYz6z4eaJ0&O4Rrqt{dimW8HC}T}^_*7zk7if9xka
zW35nYG%+cijWMm=NumZ<!n&{&`M@OG;CJ9fAB0L#<fcF5&A_kn6A?!bMc>?rCnAof
zb&!>JcJ~Nc_@@z;WAE<=ooMjrISG%jkF;R;wYgqnx^sa+G?`jXY{H=2a-zk=@C)R$
zp!Yw!bN%}DyUsS^#*HGU3&~)c*t-HhZ2F>U%t{-7&-9^Kk!+&!3i{eP%U^u)#Yg6h
z#xilVXyq{r2wGTP5S$6O1NxVSvfe2n{J}&|eEA<9CAV@oS~<d^M0}(iVK5f0R0F~i
zI9GjwZ$HC*Sbq-!j(fzQL#GcNI(6~lsY84B!sCo`FF*XWd#_|}k;a7@W=;UPzQi9g
zzJu5Sg}E~nmgtwbFF)`NDi1=2Q^?-G_9nn=2m_4tpssgiCeYX3XYX@q>}T#FmcjnP
z{=_}~bS6TC|G|#3qg=YbA;Dnm>@-G1j2J&-#`qD83V54LkzIm81wF*ht0=Y0hbe_1
zRV$Q+o*o{N(Rzavq-)UYME>AbV9NrxF<|G$hK4Uc0HD(cU+zY35*f#D6N2oWc6)ba
zWw$*yH@~(YMxg%M{9M;qQG!C=HV)G1vn3<o2QX`-bLn`;o$--8mNHc-;`Am^b&3VC
zmKL7PBo75sfj$^0Dw-bjjb1S9HvKnVK<qMwBr)SYnyWvR?z~<3rWY!^l2F;#`fp#m
zcDoleJIuD^5Q2olO|W1@m&~7^!A`MlgMr#9((X?j^Gm(&zSIG@b_VD@1k&Rl&WBRS
z8#25h+g~t54+3ouHZy23=t}oLSse0a3C!K!kD%NG%>Z%_0F1lIVy*^?JAt@2w-AJT
zBLLj%8m}^$Vk0fE_=95iFz_K!3{*y2Kr&KJWmBWVuWOL8(dOqj$lS<a;6URs-QXPA
z=BVJhVFkNS^}&GcQ6<?PtpVR}*zmo#0g`b9A(#(S#D8ju<X&azuqDLgc6R0hb}~Qj
z)Ir2z96XhmZ>w!=yp(r*=gytS^DZ@tL{>bM+a$^B$9fwjq5c?9uxY?B$zmz?`nRl;
zSf9ic<F#*J?#Xk76|j6(6rMYoyAN1B=gz~Vk9rYj<awF0g_nb_4}cR1P4@w*G7D(r
z@-cu+u2+z^H^uE9$O-axsdzj}mKcf9G>QkmJl>%g$@6l3DXFMgWxIwix_YcPMs~ei
z=XvpXrKIBC^3@05hnO4jXUgaS_sk&gOjmx_&8NRUZHe|cXa@UdVx~SYmHvXf{V}CL
zb}2^I`QadMpNz++6%$QQLh=>=z+4y`gSTisjK?~SMn@)OgR!l>y$yZZk6`*(<ng9j
zq9Xx?84(o<g&-^}DAZ<aX>M-8^31h&jRIObldQpniv9my?L-<iIG+4uBQa`F?F6Gn
zepFIYVBg?*Kktq$w&nPFcj=~2e%(n%`2@e^B-^1<?f7*kS!ifo-LE^z<^~4NMTI)=
zM@1;UpLdtk)*klr?hH7O2l)UI>BaN@gPdb=7K{HNznI5oOg{0E7zea6q_uA-!`fF8
zl_Znlt_GlR4?<z=u<z=Cp3;qJ1rt0&%;%HN^^O*&O5lrsL;>RGXygC#qfJP6v<Utw
zBS)tAwIdd+)9;4)^XI3CjC<<E4A`GG2-@f&qmYn1YKR51In0x(F)^tp^RQw(fAY|t
zJ$rIR9m<X&JDr;02QUH^K_{Zqm=18gSh>*eYF&6(7}fR;Mv)9zQpQ124o9C;j8!uF
z97y5}mRHDp6@)e{uX0fmEvK;fpkC^pz5A@zEM~q^-rPkcNv<@TQIzEHIseEFUn2G;
zu#d`<P<;{<D5+}f?2|m7zf`A0^*@uM9(#$U(@Dj}4GN<%A~rTQ!e~^~7fUWrTB@S~
zlu>~XzOKS0QoIM0c+AFd%<#Mb{}B$O(L;u8Uhghr(ls>GZi6GnM7bTN==AhxxxI<5
z_D(>1hoZg1(Oz_&QmWWQ15#%W4+ipEP*hB)MJF|Q|Nbnim6<CWVXEJ{^=xHNOw6%k
zKNo)+JaUuV<W8?9cfr07$AIs{GsB$D+i$=B;gv7Fl*vwD`xf*3YHr4&boQy$)$Dq&
zW;YZA$d;$F$ml3Z^^)3CUsYF+S|tr_HMz%Z8oAv*J_0BsPp{N+JT@I`sIO|Pudl$t
zwG|(JXEV6k?hk;d^mMuP!_oS?(A&$=`q60p0<<2}3Au?q65J4=LtO^FzaH6OI+ewc
z^VWt9>(_5shphHD*0CFG)vaA!n>U}dwMRr8J9g%BrLDI8YWc~}Hnn%z8vt!u*TTmn
zT|Rprq(QBEKeeE&J8<AYoe-|}GsVOVp#oMDP>B!ziOK>1pI@%2amI+g%hCfnI&Qvs
z@v=vre}1||uI<cf`rZ9^-}}I#`575KJ>%yuTlLh6m9J#7*RZ}nfl3loEh<MyuBd49
z4G&L5Tx4Q+xNloUQ&W2{^k%-bH5?x9Soq{a<KyGGCNaQYp;i);cv=dlTuUcv-L$t7
zFjQxs&A+9sg+_};t<(8nW8q<L?jjbWQ}G=;yeY!!+WJrquBN52t_MTBtG%6&;(K}>
z4jYn20wBPBu^TyR+@!H-Q*XU>_N>gAbEddP9l8NlS43Z+A3SKSp6W<tWmk%@gwW^Y
z?Ap6`S56K>iv&^h^VCU79{t$?%-MQ4lTh5y;kZ#6WeTr~Ns7gbUqGqq&1{!MBz<*t
zMOYZn*yW++=P97HyRz;uvkH2w0Gv)}+y)985dA!*l(t;Hx|RN)^8A4I9pDo+b!wDL
zlXbTt6>T6JW-<dWdD_s_TvLOLm0xYc=z053|8^Tt^=UfGVduCgtd!E(CE=P@7(A`m
z_u<Cl(7dNy+m3;fP*mxCtn+p$4Snjh&5<k)gfv01rZdqRcWu=WPirb_s;g@O)mBwj
zR#}0rF%NW&2xotGwjc=Et3@%y(?`354JkKtgoJcd9{Xt@8VU?hcV~G_wi;M$y?YHU
zzLkB#UIl}{0AcYrAe{dh@7u9`>=GJ513hWfv{zPELJ(YS&JOX=;?$vYmku30eE8_e
z{L2^7b%^73cdf_FOIF?xPap5x{L#n%_;~Z?ufF}}i!bSnfzFOXji|^-WR8!D1zeOw
zry-!z%@!rQ(<0|KAs!?Mh&v>ITqDG#DFoJ1t*_eJ`Ub?6wKO8sxW393D0B3F2$VP9
zT>tv(>#)HR?xC8G(hwS=X*qE;G{O=Pin0JfNz-p}baaD&77qcVqi-0Sfu%%jtZ!3O
zQ^iGCrY}`jJEGwg@frfbix;n4blY9`+&+8a#J0APvll=5*z$*e|LRNAST6iHYo&2v
z@lX?h%sns{aV;%jkQSD3m~rCb;usL%Pwn4TbPmb2M~)sneDE-EagLsPEl{SZVUVm~
zaUPN$K9qatP;M^5`f?896TJ=}#x+1)i-)=+Ni<A?a3JYG;vo|PV$PJ2vZn0=I%5gS
z4B$sp0>d9X1QcD&b_;7%Q>N^#fL&#cYS*qH6Py@UPN&Ppe^*qnT>MJdQ!GJPBlQ?r
zFt78VNES;3tdIpW8}F-V+4(HJEpV?o|6A?ReY^@!e2upGD{-_2JQ>z9QX7HNjy<&z
zW;~Qa6;PZ*RB3-IDQElfW&C(i)%NJH8`%B$^369Q0wc=H*&%#^<3JSv%NR?PzesH+
z`;WU0p&P-?hpr4bj4O0?IO>?)p6x?7(3Y3{L^n~6AJ2{-&-S7FwB0c5QM#A%n{U`{
zw`Kd#?EoWDNw-wm?SSsf_MyANTWF>`yMB|$2>I3ASnKW@Tn6&1mDpgbEGm?q03!x&
zc07Y2I5>ISn6%AXckJA;gH;Pwh017z0bQxiHgtCZ)wJ```xoBxFg=b{(OFUB0G?A<
zXErWKm#nNr5VrJKq;|l-tIRgQ0tIs~tcHO>(!+WFN1_c`6DXoL68+@LUuAk+3lR@R
zfW|Lmdj$CXP#Cr!4h{JIPzF5?@Q25~S-W;EJ1D^O*WG)yFDXU^&mVHw{i6~>Z(j}+
z9rl2ri%Pp``jl~LQ!+<HiF8dw8<YdMzJkt!h6Y;&d=;|akAevT0b3u$;s^hqOhby&
zxD`+7j?zFjA)+)uLFok-B{DW~VZ6!!v0DgWfih?Va6toE!r@d?K)isJm0BY}okBRn
z8fBZkDQ^p9&fh0*e(#=dZOuQDS5sG4d+5||VY>5Wrlh1%PKn86p1_-f;3i91{CHL9
z6Hh#m<zqWj`t%=Hty+~~UK5ge)6Mf{W58xk&%Cw2Kdz&aD&{5Lu`&YzMIR{r?!DKK
zVI3}Ld?UeVF+<G=1JHg9wI1J&VzfPpj1VNe)cMlN6G0m2N9l#uAzc>D!K)Yuy%j(*
zD5hp{3ZQ}TTrVbjz-~JGdwV3PN{(BD{Bc)KGt5({JWLBlBo_d$HwdT)eh{3$ak9h@
zH-XX%LFt9yhk*=z(3R4#ieOU5PJTXk$nmHEF~K7NVHb1-o{UD#X8|&UQ(>AxI=OQV
z3?$0)r#A?%-wYoYZI1#5aSa?4<nwz)y_53u3%{HJkjMv|cQ`K~py?Lwf<$qh*_;Ui
z|MBV4Go@LYC!SalTJ`unDFVj_uTf>zv>Qe)nJwX+5a!7T2<uu7vy<pQZX$KW=+tpz
zXC*%SY@&<szE?qDyAHJ03P(Y95dUNJg3cUi!nbG_;X!6f#VUtM9y^)2VCM&)m6erH
zE8!C*lJijOvH*?X?4xj<EJkz(l_^JyZ1UKVaS+aIB#{UB1I7e&|Mhca4kvkeom|E}
ze=Cc?+Z#pEClnA)3jn^zwg*X2jNj1vC*IJ=_&K_Td}9pb%WVgFSi1SZfOy)=clN%@
z|HY?8cxbT};A2`mcxW0mharb2QG<4nBsl_-nNhfeSy_J;T-nOX+}zwsft?h<F-l~C
zr;P|zHs$4sQcOFk)PU?&_*qzm7IMe_^O=Al43|Qj5?u-v1QGopVJHQ_mo9ykc=wm*
zoGzNj%IVEXZ&VBxW_8({<=yt{D5!+bktjGC`YciKo6|A{Q5r;|Aoel^?*;|dG9_%v
z3ZP~2_~Y0xj9r%$y@c8U_=9Ws5<*)FFJHoVJ_C0+UNoTSe=kWH@oVs0z$^gWvcOk@
z#@WFk2mp_b0t)y6T`I0%->@QV-*7tAX!;l4``AVdfc@+&eqD{)P5anYR)>wsj(pB8
zuudRZzJlD2<5(o^fv)otj{G-mWNHE-tMSVr6!&=L6;V-F7azYG1~6Yi<%21)xHyZO
zFhS6CwAI(u)>e1mlOOb<cxQ+Bq+_;Y4Yt{inU3eM&BW*L92Wt6yu-20QR4Uk-`;lo
z727#%yB(i7K6ISM@1J1Xh$FsseDB!nI3R7S9jhJLIP!b^x*x}si10wv*RSRQcq6D<
zQH#lD%i`+m1&ujC15<{|j89nGLWMMo!yx)yGfOoTVEn-oUX3uEimGae%+|_E7%;17
zNYnpTOIiAB$U_Na1Jv!oWC-UB(pq5}0mX^lm@qhT7^ZS5!Y$Aof<!y~!Id6@D4n3-
z5D3#)#0ua=qn-XY<UhTv%rB%hQ_Z6h;Flrbmm%PnK%T2EX~WX9gVv4>{r#9GODV9?
zZ|Km3Fh_T{Ix1mkxXBbQa{5p}lmx6+?><p*X@BnVg7sIf?A*!T7NFyC2?-hCi?xc;
z5fSNRDf*W(VX<DnSmYu`WH7j+{T41?bo=d#moA$3(4<K(zYOvCy}*hDzoMeeKh!xK
zU3)hd<()sDCqk!<ibq5U!7iDM!FnKcup|LP*UxURZc=Ksea+Q&r%D9~mi*H#m1pbf
zE)~_*oj+Gyg83IJ74s7iDp%d+?Cx%^t@aB|PDb@3^5qgXrytr*nNNhx39C9oENBMS
zb~(_(zY-K(z9=cEvfZTo9Ds?6*wT_1Q8_K{&gbx~?+6N8d$d;MMhwqzhB+gw<Q7rr
z+B@~4^2@BZc46Ka4P3Y3%6xG^wvqpw;_JM}x0SnmnOFBRYX*|6GWm1E@Cnpf%Xj!P
zD~EiMUN!brRlKf~4P43X`S-pO-`-TltGgMmP5n220eOk-FF(yU!aIF3@1J}xj?|l?
zY5&_-v4R)*eg*FN#vA<EVYu4xvHXlZ_zr2V=$H3bp&?5&bjJpJBLUL{)6vDg6SBD8
z-fYD`_6mT$i*$xrq044*Yu9Eg-u+mBt#CCzk4+V_q%gT`nzwy@*a;k=R=d9qmA^@M
zBH2!PYG%;Sjde*wM$z8E+T~kuv9W^UgTJ#6<lAs&Goo;MSvfkh*L@$7W(rv7^zx;>
zzfPDiAc+GkO7MoKr<kDV=wuzj8U+Ngg5_j5CpdbnTme$qSq7_Q#kfVKutre8V&^-s
zmuW;}jB+JM;(DGj)@4_)wzgK%IoeR&7{(z~B8Oc|Veg^Bx<-?rY;U(abfV$Rm3G!!
zbLKGOQVaL&nI@saFXi3?gDn++gVxviC%F06eX?CpzW(|L$5DQF>ImreeHva3)9$fj
z)8Jd&gKW#+gK3WnsA}5P{kz{i^UO0(EE1H97A;He76U1cPVK8x`@kKeP>^wr=>#1N
ztvUm+7kt~A1f^cDRPkaU2N~|rIDy`VWOs$bCs2nuPp8%TXk%hvCAH&7t@c72yz!ns
zGlG&7<LT}*O^1`UOMNDQJyt6bPs1yaw{GP=_yEa;f=USih+kMG7XsS$qU)F%3M<F-
zQnv}<kJa8^jmFjT-Dv$V3U?ciyHVY;QBuAX++<_~z)r#IPoIX@D*wWT{EI)I+N_70
zycjvM!1O4!0a*L3+`VUx9X@igzCS9lrMtSJsiE-ru6HqCn`3!9l(q|qAiPpyR}<D9
z06G#yHXU+o1<PVtfsf8jRy15Vdi=_XqeY#uw=8?=RhA)`8~P%Vy{rS?c|f418HDYC
zHeDyetE<Bpfm*^ex+{nS1_@|N<uDh7#Eu*p84(^9V)iqk{Fe!JF2ciO<JdUC?4u=*
zJddJ%4jhcW!V=T2mSq`@Ly~30v#xriOjTI4Zy)<R)N=0Neo<wg&VGckN)c098Y8Ou
z+2l#MsDdyOMHL|NO2NPYm&1gE$ov~e;qeuArPA)|Nnc!_q!-CbivEF5!5!jY%P-B}
z$sg!FAShElnZCOMotVXrPG?)3Ke6}NGK`GZvXr*ElDgworp{6Zgc^dA5DzS8h^ld2
zx2{Q%A@Dk*w|K5@CzM7`cbvNlq>5D>eCZ*_X<oFXaIJE0lfLAOC-TJ;4U&S;I8mkm
zcnJ?7r*xr}>tWN_Irbj+xE19VNbj@~!J&83UcOcmt~CtTB3vAI41}@h(&bC#6eK7q
zj#&HuAoycOCVW7OJ;e(N#jKACV?OJAM*q*k8U#xqim<7#4`cHw0R?E+|A_8yZ5FJs
z!dcggGZ4_x$eQr?342}j;`0waxB@oiY%tN+>}zW}H(x+;@B}TU@xVY-2$(#1Qi5nK
zudb>tqIf|`>4a_JhyYM0zDMF|$)|~x8p^>0hZrbcP|`(VbU@nVbw^2Kk|^$;J-jL2
zavYRpn;=y<2=~-<_Bq#wB6SOh_C_`OK{}iKOPLlWOSgFZOL||x5rBb7g@aQ>i7-(C
zIn}5S-mmQCU>*`NaUhp^$&w|R2v)9^wtp&?n9rOM^kM0X?z!jgyYIg5fhFv2K|L)e
zC#N}bF1hV#n<j7_ompzFIWiIEdC?dkxgVrAYCc`}%M2=WXV_Z%JLVgi6hCUljN!F2
zu*BtRH%b81R<5ZvOV!(4Tad>fTX~g$<$yxrR4CQXF5tfs65p@=F10ujEv7tyH1I|u
zI5Y`bg7IMPPkVCqW96`)@?-bxWrCn}PMzvRJx!F(0U=ZxX#s&}q%P7<9<lYKfb>)U
zD6;Y}-lem@E0VicFs_x)fXaJHy=*M{ZS1m4=*Qcn4Ve{epJ4UV>DZbzpB|}4K2H6S
zPuGaXmgerxt8JJrP?G~#(482xT2#H_y1IJ%omsR1?-GqC@=lyRU4VsU!RcHCf8;_2
z_;b5<aU~@!jWvKxt7&XOM4Qw)9a=}@n&gIOTtgh8A1`8HLnFh2{-@EK<}@QyU*I17
zib(r*AZG861Z6Eo^)cYs3ChHPB>yo2ixuRnPPE8*jni<|$rc_tjvSL>&f&}=uNlZ9
zy&Gj8o)1zc{d^6+a4Y*5WnZ2sS+8Z|b>y`^y=^`$BC<xOt0~z1&A-IR>s)(-?AX8L
z<1_rv<1=rbI%nzP#Y_M2hew|fBd&AwdE2n1R9;YI(4(7Ne!upHUe?gu*nAaGbtael
zPmWtg3t`WW?7)F7b~^+?QxklzU0qeMRFuL8+16ZFFGeDu2Wczt1;QCfh*qeQ;bq#E
z#~i4cj6RA3HG@ITFlk<Mg)<N#Vd}u-NFM~GZnZjc)HyltefZ&fjQ_C=Mx8|}%k1jC
zeJIWP6!*!$G!L+g6X<U`5bvj8TVUnxfJVNWeXfb<p8NEe)EAIBW!0Yu9#cnuNh(zm
zQ>&yKC{)|GZ`*n>M-?1AWx)cZgu8C5Zfq+n4Rctq5)MvFLv*tA+`qgA?xscW8G4f<
zinR0zzj@AZ&jtgQ+LJgW-MNz9v9!S9e)QJ(o97($I_J-HxQX5rzj+R2BBnbh(mVTv
z4krsV>-^1gzLw6JCY|#m9exYFp;4apP@Kcy>_uErN`t{|^5~<E-hL9Y2UG38J;%Ma
zAi8N7he@SL$mY5sY`&#1M-GNRZZUpD7_3B)Hi21O>mcwKWm}LA@3u+P<PL_ST2MQ;
zDfjO~7P-3?R6$z?Y-i7k1GS(uR150k9sRaz3qg%HhkF--Lball6vJm#!$b}6J-Y^~
zKv5JpX)oRxhRSW*zxV<Z>0&{FvLeVa=nY!)S7h7CItmxB%Rn&QyO5I`1w~b8XqBjn
zXR6@{g@n2T>x61*m1+jotO_8X07{qEd%t*>?c2ZD>V21>*uQQYxQkAk&fcZ?C(m81
z${U932JTXoG^2j-U52AAlhGE^_TBh{=5qxQyDhZ^M*u!l*JR88`LBQ50eu3#OM~95
zGP3eUrPg3D*jsI_CQ-fao0BI`mR`CQ#T@3NP7!TSqI}##uu9HFX@}v?hpez$qb@*8
zd3{?SYdX5`vyB@!zVjB<5KuK8|Mb&Ov(lXp_}w-2-h1!8^X4fdhmF0V89|na6--J?
z3J`qFLnlu|QeXNMDkNZ@>PKpS>d;si6M7SdqzqYj?;TJw0y{f>`|8?JlFO(FKmvhU
zA0E&tnwL+5Hk&$b?vo1_F1&Zyif4ZR<g+W;N;<l#uDYd_nS!+{gh2$DI_#aUIc6Ft
zG9MJ7*<c#Da}KyO=Fo9cXei$g_Hsac!In$LWn12n{jaUr#L5I6(IzOwsP1d;5(3mZ
zWNkV*FDm&SYrw4NXe`Lx@x>RJFxt{)b-wCD%9gP8tBr2~Y;c)#CHFD9_f=Y2wbfVK
zVErn;Dg^X*x3|=m<Q@6KL${d7?&|95tEz~R)925B=%GiRc<Q+qUV7=JXCGZU_m(?n
zMY4zJ3eiK-#-$~P`J%X&LT3z*PaW??$e8;lj~Fpx*pTFS3#F{b#t*r1<Y?4(%)I61
zInTfH9HNwUot>(_*2Z>b2s8)*z1@9Il~%3LdWZ|Szu*VP<27;8O#rN#I(5dpdmdi(
z+;h*p{OSy-27gAn@Eh!H_J$S9W?ZYit+ukETWQc``SWUo!|1M~d^#vk6}4uA^68*_
zIw&7qQUN`+tF56526GtDs~g%V#-O*M^vcH@_hPjZNrVrCeXGB_2flZWvcIR_o9-KP
z(R2AnzWemAufIMU6kY}e>^_v$x<{&SxEQrxXTVwU7%=3<!=mwm6~4ttVpSyERMubZ
zg<k0BtiE`}i)Xnp#w?wdAnk6uZTa#Qzn_UE)te}?McX=N)ja>mLr*Rn!<N%^qK8bH
zyI^icT6|PgTvE!AVPm~|AbNrpon$bDMkCBUIXONm)C9{<dvrp4;{3bk!Q2{2Jl)lW
zd}n`yMuW^EL!h4*b4TBPBZh(@BoWS{>6w|+@j_6@EprzwTYk^|_pm8+etTQhm4d>`
z=I*|}mX>ZfG`)x}Nf{ddlR$HdKA=d%;h?$s!exyAhVn~C2^68lcK+-;@BSMiUxhSl
zUfnPFmX!BlJ*{Z1$*<Om>NmGz{8wW9FU0ttA#GI7<sp;?pNHZuBb>{v<n9Zox>V88
z#~SzU{0AW6)~zY5%C;H{q453d?YpPmfB*e=&6#rJ@bN<hRxb#OAWM`<&;`XxrPjxc
z;d-;pll5q=CT)lXX|vsNLx$XN$C3rob<L_Cdmsyl(1*jqX*4H<X9qo)4h<z{^sOuJ
zxZ{o`_pSKd^DCZS0e1QlS9aJt+67&(#fZgAU_^vdEzf;pL5EqO!&uN^Ea*TH*I{N|
zN=iy{e0ad9Y3ak^!H*gd7h=r6*v>`?AtsYfqxbW%w~n8lk!tkfIITpF3%0u2d0@3g
zpvlc%RCyRu(nFPZg%D!3>JC+)`9Miyi8q&pmF_{=oGt(O^Ey-HunFnu>Elvk1N_7E
zr5KqwD|$#uly67%jgvDbj+1z5sw5u6`U|o2Z#0d+rM9NB46mbQEzD=s=x}yQ2<hyE
z-W)sgv1g`40teTNlfp*EKu2$G@7HSjm0>U#j7%Ic@uswK6Imaf)z#HfTi2;*D$1|4
zOZ;P$#HGYP>7d)4pc~b_p)q?ujoF!#07ARyu7!6lxc&CDw6Ql$zj^N5x$_>FKWa#G
zXAJV2FlKd{fRK;?b#G%$O-moyRJ<tYyX6>6&ZPxs4)6KlhuLmF<G`L<`==QQM0pY(
zvB@AV<?-Jq58A>4ARcr$l}fFutMcptuR$Aqe)~rsee}hy6UB{PT~Se%#GxaALpdZS
zP|53^=V`DJO~+1|I6T@Pjx8;TOK-wPH=IR$#LpLt%Ig{%)oN!)oedGad(M_C1165~
zhsg(n&5vocTz7MQo88{h?C_5W@*?q4Za5bSgaO*RIe#vNo5n5X9>JD|Z3O;zD0c&w
zEN#QNIQ%w;yPccG&EzIysST1*H#AjM)wgvcvlm2$-|*VLAiF>U`hs#JC|fuIhw+wh
zUqN3~R^jmHTAFt3Z(}<Ie=WigO)LNvCXB3;#;~!Wy`@wC!RxEPzjFG=@7BG0kgXF0
zeNSsEJGujd^$i-V+#EpWzC25Uf!K(GPwz;kfOY&I=b+>1@PxT{vA8tY0mjmJH5L>%
zc6Y}I2lUo9x3@)x^uoxFz@q*p)>4P1Ag{qV<=;EeCFuY5&-YhnzyA3bAHDkxmT7|C
z_S3g4LW{AiH@HXVY_yDK25&CoRy{NgY9qFQmw)&8{dW<oO}gdYmCrx_Jn-87r1`^=
z1tHP1Jlqx@6BFv&+tlRnGx`B7VnBcK-FXSCo#yh3C-%9yZ5f2u;{^Xo8~@(>>!+hk
z&mW-8Eau+C^z34`>V}q<hKh@)PnY#LdumSq*UUD4*4$e&C*C+@$f%npPZ~eLYZONp
z?#D9yz=;bbHN<R=*5b2(tNwcbxpp=r5ynrM+1e_KZMEIVxKMXCH@4XaF<UUFgcXUl
za@Nm9ayM~zd6;b&m&8S&q?Et31#>zs9EGMPpuXpDE^&a_8j8=KIbVv<{?4lM>Ne)Z
zY_jH0ku?-`Le^4>tTB2r?BMk+wlbwK9kr|uu>%bGfVaU=N(K-<(@}w%z<ZraX0fs@
zSqiK!%dGH@xc*xiVDvND@WX(;jjTTbxCdE(3>MkmcEtvznboGV9B%F<$#ct)P&S^a
z`BH$JRN7#ilz!#S0lm<}nEb?KgLB)G2HD`q6QQ)jcktD}`8;UB<cUbWBzq$4i2FVn
z*TiElU&U>MxIVLx9G6xeQR0dPF~$dBJF#WBnuWw0Zr=|Xh>S?JDvs;+GX*){tUNNU
zJPn82%w|Pt9Yi-vl9k8Px>uJl<6}dHOEyatDeG?&<vnKOHTapRFUT%3knITEx&kY&
zf;su2?x&Rs`vXY3kb8pL(Vgy`$+e^?yVq5I%oISbtFiKZPP_Yw0ALr2C&DkTCvvx(
zd_pek3nk4!c-sm~Tz8pre$-*<E(+_(H`5e!X@#w#RKBtzAjlXh-D6M->3Y;YmE6L|
zM3x{Ta>UA#1a?@;c(b`ys1y<8wwY5z5TdLpz8OXu7_#U|d~L`sL_d&vUg8VOCo-}f
zNK=FDI(X@Qi>PwvqD6~tNz!N(h@7RIqEs>1c;r-mc}?jhBy0Sf9~YtQZSPa@CPeCG
zAll-^;P;UFDrRM6eYpG3p&dW{^wR;<cYP1Y;lYg|!9fN?;>-mP-hbO|Ny%ZBfd2Zz
zyav(Nh7|%j7{1erQYlj!VG<mnBU6<1z{B$T004l%UkYz%kkKZYMBGOXa4fBqDHG9~
zW36!NO5Uvu%z{ty$H&6YwPFQ-<5}#@X5v*VH+eG5?yjDr2(dt1hgPia2r)qc|8TFM
zIC1E}Q4uaLU=Ls-eF4k--TXYZ3O^x4_%$o+;V?5y;CCrkqw*8-&eVdUv!C^NzFh6W
z(n;!1x(oTd2HypsA6<gt?1{rCaSB|Vg}B37E7$NG-C-Zwhdb=U9UkVJ?>&bje0)%5
zLUH4miK9JVoGP7Cz61G8##vCC#v;dDA?ln+3ZkO#@vcznz0)dk^v91KJ9_jO!UnMc
z(XgnXw4we=?nfUsG`CkY)K`|(^oB&|9XkojMo3s#!bs#~kBW>09w}B^h)_IVR@Q^8
z%?!XtzU%w)@19sPd*sOPcZJV+;%2ODK4hC9-;S^Xc7dDE&1cOJohBjV*s=5FP^PL+
zoidIYGbS|}=J6q;Ms*z%_1;+&IY>uAo&l<qzzA+c?6_AW5a4A<Nlr;gicf<2nR3H0
zivdMVT3VV>Uj*hkcWxHZg0K$;#h-!k%gZkoQtT4~9Cfym*4~cRqJml*j2%?^Iscdy
z5FU@whR%Lj&?VM4l%77^qEodeih8WH+PZx1d=z>2>=AhD{F5e5o-}FEP@O~6Q_w(V
zYXjk=AvRLi*;QFsTG``h?CccvU|@qGEQpG9VV2j~O3xfVai+ZHBJTRX@$uEGE<T>?
ioGbJ3oH;Td@7W{sG5FcT$11d$EL4MIBY(w4_x}JI{^pzj

literal 0
HcmV?d00001

diff --git a/client/ui/frontend/src/assets/fonts/jetbrains-mono-variable.ttf b/client/ui/frontend/src/assets/fonts/jetbrains-mono-variable.ttf
new file mode 100644
index 0000000000000000000000000000000000000000..b60e77f5dbf5505436c1904cb7a9ac4111ee76d0
GIT binary patch
literal 303144
zcmc${2Y6M*_wPM>@0k+_Ng#wI)I)Mk8U#W}g(QR&dZ?j=P($y%3sP02hTfEp6cs^0
zks=66uYwJbE>aXxDI$=(-?i5{A>=3i?!EtepI4uc-#N2qPg!ft?3sO%C^R8N3H(Qj
zq`I|g*Et!I(M#yvdJ17ws@t?l^9zXwo(jF^JRvHE)otD~CFH`9DMFv~r4XG<)N7TT
z{!PTWB%wd}9_6PtX<j9wcyy7;LTHCkYp3Qdl3V=p)rDI^|EnuLZ_FB=HQ4p6pC<Gt
z#qhaemws6TGXpZt3sDZ&Q+jvD^*OhDEx`2zT<_W=Ysf%oG4!Vsv`~+}qq<)joVZem
zej|mp#@YkrJG>vi6XjP3?Y${IyJdAPQ@-O_wBHcrV|pS(M7y-cXY@$~^z1iuWQ#`)
ziVC5J2vH`X?|?2@mA1~iFGNT5-+e{DtdRp<n(Nb1em%<j_0Q_pty7gUWrXgzNC=lX
z0|yKl+CFoM6nd#jLNtsVIJn!uo|frv;QrGn?;^;SdZV+~#ITVaizYl2hH(oy;_|KT
zqgZ>Kds01Tp#EHT!e@)nDHs3XKI2)=IozD_q<U^!{kd5aUo-z}IYl{^Q`!#EUwkc!
z7r1WVv(z)RY@txcR6PSXrLk%qM1+=vTp<c`g)5|<TU<POiX5`CXpn;c>=W*}x!eci
znO4b9Xv;5uhr5Dwct`jN3+l`S5&sXdqHdx+X!kF;I<Ap+{l7qpqmGWyjDLapMQxJy
z`ro87$`j6UO+<PaAazm#>3V?d{7?K_-~K1p>}ZdmIzj;Tk=kzxXsr36{{0iqdt!0D
zApbO$|I<8*KeAInsNc?U{F}B!x%`yE=YlxLOZG_pe@J=MO_1$g<-gXrRtMAsWV06k
zL#Q39gX$tby{cWxr+#5Y$~_0oZ?pf?bQbC%dI0BKCx1HAG`A?70H|${`{+elba15q
zr#5)i{WNB0>`)m>Q$NTD#K3&ewO84J?pX_}`~&}|asR)1UkuuG##MeLJJYrQM!|My
zEXl9HX{-GDZ_kH(b>}{XZ~p<)_cpXwko@aB^@rv}e*W9I=z6~P|Ho+>GxdY!&`01i
zKx3yErS-$Prjye8;_N>?N27qVFJxb$1fX@5?xi?%#yVZ2Hk@`1Lz>pQG(cq%98emN
zO)1aRXr!r5s-rP*KC|dKgn4b=Tg{QSLYsj$!0AsKUq?W5A%DNAf7E~KgY$Xl?6<R@
zRDUXH1*rYE9FRTA0IHKH3doOChM={9Ae%Y+PUW1}sco`{)8FApQ=2qCDwE)V(llPG
zhw>Ci1T<%9F4MCu|NM2@gVtF}Q=L>tTi~p-KGNjJg8in?WDn{CX~BJov#-v2o$*0!
zP<_-7r~RnU)Gl44@l$=&*ZeU-b|)K<pPcbPZO}bvJ9kDtHX}U=KuvqlJybunM^M}J
znZ`)tpt_xXaN3&uL3LAkYKQKjvSeF|JL)6l(RxQ|XJ4G-roK9%>rSW+XMNNz^@9ip
z6c=Qh(tzqE+tFC5Tmy$vn^c$cGueq^i^|Zw)Mtuc=XIx2T+=oBOm$M-6#pdv#Uk~I
z>L8qJ4JqNwb6%%<sIT;y?sZ<LIYwz3H}%Uo=cpY@Q(4NV{x@`dcHW<a&*>lqP@2k-
zFKE0JgOpF{x4{B17fb`Q0DLdr1oHsRIm-Y4tK1T_oed^~|CKcLH$PMHIX^Uq^F!lu
zG8<{K<9YBk_yL>%6xUZB(AqNuP?>EY08kmS;aJcMQ2R7TP{!PQkPiu0@PiP!rNJnq
zKLb=3U85Lt*5mx#A9++S)k*%L>jc$L`NT-D0#H5E9gwdn9_cgn{UV?`oY2@PkCgH#
zo&o{2K~M}+96Zr8a-#H%rzrcR5%fKLZl`BFe~$Fp7n<XVd^eOC$2=>H&#8QG&MxRo
zkO<D{8PDL$XM>Q29jUIIGx&T2)IxeIv=S6?n=`?|SIFCgG-*$?`4_jHgL+I*$J4)&
z#ywBp!S$cOad7Mv+(tS0`APK`*Pp_6&;LaJQq+U7JcT`Td;t1PbwBe$x;yjChO#%1
zM!U~EU?cK*SK#yktp#LLiVyM?`Qat#w2Zv=faYT;aIVp4$GjE+C7)0nR0b4FRF=xo
z{4NKU0jh`EAw}QKYa!5FKx^1?M_NItpA-+M%Zy2?b1k?DD25gSS`Vl_s*hrb`aw$f
zY=%<&Qr%RBl**Ah!P;ilO=}!oBPf>8XEUG1O3?kzG>wP)LgS@;>Vq?n@|}5<pC7vB
zypP(Wv60=$7x~NOPg6Ono63+n$My*61P9K3QQv9&WKUXusehS({6@BRj@hZyPXaMv
z?wiP_D}eKvMM{170XX_?+7z*8)<sHfQhn4vf<Dtd+W_^~*+<IHPkviaKdC(3NBNF1
z=8eI5Un;Iq9Fa{hPSZbh4Q){R-!N@L&r|X(DcOknM)5)SQ>;)Pef}r<JMu}XO=lSz
zJJQa+<SErh<)}SJdGi|GN3rd=KlgjwOE}9@+5Z6=)*{`V>!5VOx~LB?<&zB@?a{UW
z2Kgy}8PkT&{w_dWg!6MgrF$s<rF-*zc3#U<XI-Q;PYQg_{RMRa%6F!npY!LvDs7fM
zjQc_U`^|i;p9S*;<)v|c{%iTu=DnpHWvG1MKbNO_^52&~U9d0tKT{u^{d*~&<{7o;
zxc-l2s9%mUX1|>2eB*asch;T1K4;#mG{2plWeSe-rTka)HGe(%?UKJQW<M#mYB~6q
z`ESM!t%*)(y>qS|6#KN+<cm}DGp$3;HPHDC!Wu>W&&$t$&;QLd#d-%vpD0az+z6;2
z&S$|t^_%*Tfj&NB%yoz2kM_*vK`<x^oNGSC1J&0kUmjhjdG<A+=aTa|K{j$eduXku
z_Nkr_K<k^I16sQe0J@i;w6nbeYOV)Sxc*NhBA=joai3YX8PaGA-w|Zw9swKhnby#J
z&mGf0>3ol~U1!Xh*B;`U1yDbo^^%QVMJBG*=dz~lC?>W6_$7z-S1#CVVg5Wn55?Z_
z`DO48IEc@9Hc~og9n!F;xu@I(y^cND8gNL@_#5Le)87^-M|ETDPho$mJEtPjD;Vcq
zGXGwd(oa{SoEvm2Gz+{9PB}i){m3Vt^+TP1B8~k(eyIG@6WC*>;`%+LG0vPtC_e)I
zd>x-};xmo+^8#h44M$ycuQN@1@SM6YK0k%+>6+O#>ZY_gF67hxmD(h7TH_jGFsC{`
z|AjQhZO&neRgBY&O;Yj&&5yN0<OG5lpaIAR@i?n=f|hp>1#JgNiP1tl$9G?(xh0`=
zFJ12rhJh?xp9+p4?SnRG?)?N-fm>iMfL%<e5002H`vV(_&m49AL%;rOpB(+mErU9!
zUsOlFe(@O4#{W*AXg*)1dr%kEUoju_*{=Xq@Hsy(T}M4MFM5Fp%tP#5URpm};&V$J
z7X;<w9|;T)!0DpJ@d@AP;j<xJg}`U&agV-tM5c>aFWf~HQC+;QRn^96+1ea!skTzv
ztew<OYhP>Uv~RWVwe#9V?Pu+-_E5{!%jl7Mtlmc7sqfYg=|}V*^*{B;hBVxaqDFC}
zjA1uIjB3U(<8@=IG2O^ERvH_O&BhVql<}Q(lcl9y#>rIKM7EP1<y^T`u9jQmr*fD4
zL0*=(<wMsy);FxntWW$jzaoCc{7U%w_}Tmd{DS<#{i6Kh{A&8u@f+wj%5Sva7{9mu
zKJeS*x6N;l-(G*+-`(HK-^ahSe>s1fe}I3Of0F++|Hb~x{8#v|_Fw0}(f>pL&;5`1
zpYy-qf7$;h|6BfdY;HC$o42jB&1ws@h1#my5^RaKR9kIZeOsEXk*$TTwXK_Nh;5AR
zZQEkoTH7|;4%;5vm$rkpqqdW_)3$52-|fm?#9q=~-X3HRv4`46+o##*+ds6QwC4o)
z2LuGp3tS$!GVuMt<AJ9FzX`k<csKC3z(+y-f(8V=6|^$gE7&{OH#jDEQ1HCqWx)r7
zF9zQYeq6z)LW2rZDvFAh(2Ogqu58WeoRgc|Hn)B5^W0o`&>i27hKo3{LW|O7nVwpq
zeWaZz;HjJ19qobkOfRWNn4bC!o;nCmeQ$b77?wOw1sXBNP<U!GJT=ppZLBsn8e5E`
z#y3)v9<q!KknysXY$iL%Y`H|PlAGiwa;N-WUX(ZF19)mYJhj5%DKB`cq{CAYe%1XF
z{A$5dLrqVO_j|v9r@Z}3<@3~3|7`zv;i*;rYyCGkJarnLx&%-C3{MH02Rv00p0eA5
zZBcois+;Gjj<(*m(YA@UnYN{-r*_%)!&8SHp1Nn(?S<f}vi1PeQ!)0p;i;wY)YAYF
zU=I|5^8;4|ZVdc5@MPdQc<SeTo?4OTss8ZPJHcPUQ#XSjnx1+Ko>K7CiYuG*d&<~~
zxwr=YGXK$Ia<S^sKe>^)&2z`+PR<>d`+6=`h8O?je3!EXlXkta*LW9N%y6e`Mt7sD
z(avaTv@q)G_e2e>5m&*!oW1z(m(IJN@5Z`$#rf$!^{+%BuHF{n`mXCAUr)PU=ej@A
zzSmuD;5+*3VO0LwoNIHge{sF{wXWC8T(@5LzV3eAxVqx%k{g?F=Yp&AZY;Vw|Hgvr
zR<8TnrE5Q4yNG{JT|06OJ-LR_UR!=`{q?`-`c?ci#x)BR@p`TJ)sL>uxH<=^QdgH=
zopALb*TDb1+Tv<0^NzVF?RK@;)o{+gc82uYo@+bIt9WW$E6Z2#(+$3tLoWN#r%Sgl
z{dno8OD8TJx%}tlKQ0GccDuCn(vnMyFTEzj#oUYN%SA7+>O$r7YkoNSL(UI>pI;ml
z5ag@Am-~%-#;@uLt%=%uV87nL=qt^ikC6D$1}UAbu^N9Fe;dz?94RGMPb{y6IG@W&
zS6Q4tzxc28K&g`Snf@znvXTs!b&$dnPrfPNksr%#m`A(i=kiN=P#%^?<!N~y*NAH`
z>QQ(i(m!euSfW-?`k()CmgK8yyqc)yy<AdFK^-$4*Qcsg__Psx0N`au{^q>Y2Wp2p
zs!pnl>JQ4Z=oa|Y;uyKbVsW!z)D|C$=^0B|3!>cuTUriVPP!Cxaag2KRH2^E8vj!Z
zHKn{l>CAs#f01K+ZiE@VjX2{gSxs#>`WUH3Eh9>L8x@V#Mg^mW5o%PDWo0Q@#t2v2
z;MdZkjPMtMq8grSNg`D=5zRz%(MDv7PGYnegQxNY@wS*LR*F?(9iD(&jJigmQBT^9
zc9w}^kN8%6Cw>%H#RKtBJQKN^yH-r|(n@P(G@DjKtEnYvwX}v>Gp(1_TN|Ja)J7S#
z)#pYXX~X=jVjM7z8DAPF)L!+eWxU#<9W=U0e<MSEW|^vX$?|wsD$67pu0Am$EYl1_
zJA`>|GyL)7tcstu(eaG-#m^!6h?2r8B1Dj=fah}qQA^Yjb%jlI6n#XN=psgnUeZ?#
z7xTm{F<Z<L8^mi`194J(E)I&b;y8YC=bSh%?ul#SCvjIRq-mPel(?k%YhjvQ3)14X
zO0uL@U2CVMYb~`_+8`}a8zM@G)7T~K72e{EC@a1f<;4X&b1sT<cq45Wm$8SqBBI27
z5iG9bN%V_|7Qc%SaRY196A>>Si<;u8NECmI6p<s6#dFbEa}y0US5aHjMI)_<sE0|{
zR4XddHBYU$XrYx5tu$ZJQu7h5wUQ!3D<#@$Wkq|fylAIcwQ{0^<|l?~v7)mUAckl$
zVw9GEol3G8uceA{T8fyc)fR7P^~7YYu9&3N5!1CMVw%=iOw}6UDcMuJt929ET63{n
z>mlCJx{765cd<t6D>iC_#rxu8ZM4{?jS*Y5*R(V-MZ}1HTDVw%pJOU4zQRu|{UwHJ
z)$qK1Bua^I#0V`;ys6a}Gqk4SBW;AGhozh4Ez1PU6w7qW+m^|e-j+U={+7X(A(nxb
zUY4Ggp_W0GzLo)&&6bb#UdB$nx86tZtM}Ij=-K)}eUQFDU#KtAXX<nHS^6A(o<3Wj
zuMgIj=u7p*c%nbjj%)X{U$y(%@7f>Od;OyQiM`kr?86RgN3^5bG3?MzX=kuUJBwY~
zH`-P0ns!6GuKlFl)NW%3a7+6QyMTwf8{SQM=tcG7x|i;)`{=&d7nITi@zYizdazzW
zuc%kn!}Lnn)m780>m~F!y%_clRrM%6T947I=;7Eyl-2|EQ0;{7sXf-?wZHTP?TKDP
z`&&=cp6WHR(@4^u>&aS<o`U^hsxI_ex~A9Gb-j*m=yi3e*Awq){l#jnk65eq6Q1IP
z@Dis)5pf7Rnj^wP92G^yG2tc-WAC~TKdZJM`_coVkoXcmWA=rpDt;A_;x`d1{ty+#
zO;JhQ5|zbm5hm`4Q1P=!(+Z3Fnv3YIRTh1<Dx#|vEV^qIL=UZ^=&6N@Zd!=wuT>QT
zwMa2YixPviXfZ&G5OcM*V!qa1EYv!R#afnFqIDKawJu_j)=7M*4HF+|L&YX-xY(?X
zG_s7&Mth@+(b4E+bTGQAeQLiEsdlS9MlbAks~ZVMO~cQKHe&P-)d7{Oa^wg(NDh(1
z<S02>j+BGtP&r(_CdbO@@@+X)PLng#E%mePW_&BF7<Xi687M=IyT&zH#JDcoOIPD3
zS;_cbR+c`-6WPc(C&P@3#wA%*b}`P#B$;SjHg4mI<R=TunzFR<vn(nzrB#+Qp5kfs
zHFny?q`UN#9>!zi7ny+Fb`9AUJ8myoLMF=;siehtE?dghvX#uhZoH`+DErC&vacK<
zd&xesw`?xcWee>6(qxwGBzwr7*b}<o>1Y@ijI+j{vaWH%_)B&-uBxl*sGO}H7)^|H
zqp8sxPmL4mm^v=!sGI7B>ZVqxS!%kPre>?RR6o^6Emu9&LiMJatFrN&dRNU+3sf&P
zN)1*s)l@Z7ZBUEUdNoKbR&T3yYP6c6mZ~9Y7@lhV)ml6U`>HAGJvC6RRO3`{H9}2L
ztJN4aKn+zJ)he}2%~SK$aJ5E_Rqv=ts)u?_y{;y!?&^yAMjet-GD1emSQ#y2j7P=;
z<DqOI>&g1YAI9&-ed7mNN7k0L)Nks(`a}Jx?y0}kQ}vztUY%DTtFP2nby?lDXzE9G
zME#{6t5fQ0bxxgCXVfq1x%xpJR^O^;>H?mdm()XxP*2opbx{4P!c-v@ue?>1@=(#L
zsH&=ps0ihzD$8f`k#bR$<lpjvvZy%KQZ-Q}RCU!{HB!Y@qRLW@<zv-BK36SNNmWC2
zQVr!p)m}bT>B?7ys?sV+K9PT_R8>wXRZW#q$*P%3Q?-;;d8!0eR;8$ps)77VwNrko
zjw+>U${f{H)mG(|j|x$`s-O&cOa7uX`G@>j3HiIcsWMc3c~`Yo_2eDZRkfABsV*v0
z-jliVzWhnGQg!8R)mgQXzbc#ZS9TSkf>n?TR8>@ric}R<VO31IE2+X&ta4ReI6ExC
zS??YBu3RRU%N25^+$cB5^>UqjPp*|~<oh@S?vS71G<ZgSBY%`v<=66Cc}ZTwx$uHK
zE5F0(@VY#Qv&R*jJ<j6<@}>L=d#5ktA)Foe$^CMt(a>mYq#2EjX4o%(Vti(7Gd?x8
z8#}PB;Gf70-cQgz46BZbu@CCU7@tG^86ym8V~pNVJ7dH_0~q5gDBcthvKlmqQQM)x
zjL`=g0xDoHp9-zW7<dDKmCHnWL-7;7ghAIUGX{Q=7%QBKf%~xsFfninz>`;CXCw4;
zQ0f!jz8F+r0wZZxM&*Dk1x;im-f-XvZDLRzNeuQ(0#9oO4`@8S1$IpW`zV2Z2Sc{0
z?SRHjcB~6%?DZTZLF+r9`x`iD0!?$!4BF5^b7&*b7_<RYj_3qvcSwu|bPx84*trSp
z<CqE177pHq(i;$BCTIo7ek%d_o$6i(G97Gzwq*<&Lp#PGJGEyF8dC>G+Myj8gUWVd
zuvZk=i!pnkok17yE$HgtM`$+(SE1cO5AXoc?wEK6dO5(kNl?rIjpCGI2x!HieHjfW
z8_^H+M?U#z0HfKU0~rmz7lXiHlp&uFVKnmRP{#bp^<hW@jchy|j6j<DG7^kJn(8JW
z01cl7&R2v%u|WO+issH(#-O-(osra^6^yYLO8x*w73eC)H~?ME7{{P%7~@OmTE;j5
zeUDL85BU<PPoe7>%XsJpM(u!ZWVD0O_Zfry@Bt(Jp&v2^#mFW`eFpuAu}p<-X4Eby
z#SM_<p&x^-7>k6``~j9p(Cv&2hkn8+QtB%(BB0biV3`J`_JCnPcQV=`D76O+ikIDt
zLH49L0|xb<><$b&l<Wd<hM=FYXNp6=aG*o?J8*>_aNr9iTN4yxUperBlI@6+fcivO
z!C?n9mLm>=phq24fRZl>^7U~C4WQ&pq82y_PJue$v;!LB83!GqUpwdnJ?kI~dd@)?
z=r;~VLceuDG5j5abCSSWh8Yh1!NEM}c?Ywg7r;d@8~o^iV(OBE*PxdfoVA3w;(*3+
z)dBhBngg=kbqCb<8xF`GKRKZB-E=@>`q=^X>z0Fi(Ay5E?mG^sj=TBz1!<rag8s^A
z8kFw;4fzs!-vN#3cSiGv{=sNr&_5ZC;_3mTk$)dDT0Ha-qg8@FX3TdUe<2OD>d+^Q
z)(-kNqoqTif@dhx68fCc20?QeEfJc_;7m#{YD{oC6*L}mOo$hpDNS%<6`BK@12j%^
ztlm(?P)unS1}9sA^MVP*1=-8AS$Sw-hGGHdRuka|Ey7TI;7n_RQ?a>5o9i@UO7mc7
zzkoBY3B?Po-RAlo0QF=jc5nhV!HHVXnr^P^@DEPKCbW;xXbgbj2&ZHddj8|oY-0Mm
zB+>w<ae))G3Hg?u4d(M91X_ln7{m$Ng!TtGW1En#G%G{<37o)9$hVpwLwg5`6*FGo
zLweqr&m8!RV#SOX_!(z)6WT{;feiVUV#ti6WGIadkpFQ$GogI|&TS0YxFSRQ1)Sp;
z@(E(jjJw*<$_^+N5W8mlHiA}hKz<{80oteF9LV4!&VnYi&%l|GA-}~iwCBLP2Z470
z?6>MrK>H573t-4sWG_Jb4!oaW$UkIXK>HGkX%q4x*%8nlMN4u(J|w#U+Oy!@21EW#
zWoXYr&u<g*A&no<o(1nd81h?PhW0ghH^Pu_>pLh1ZNShT2k$-@KPcH6&>jKrP#CfS
z`3BG)2k%%I@-x{E(Eft<5GG_lvK`I!QPAcN$Tnm<Kzjt5|0XnUvK<iPp=1|=#!a>W
zVjQ%M1F}sfBPK%0E(F<w#tg(8P_hd_HlT3=F&Wy?0okb&BPKz!9FQ$(oIp&6c5y)C
z?#hU1&~6UMHr*L9723lA*{>%fRzQ0>puFCUco*8o0oB)+5!ujw4#<A}8L=EXzyY;0
zkP+`d2RWcV4ratMDEWq<K9XMn?X&QXgP}HuGqi8gMmV54Ml!UAqWzz_2mBa1Iv=kg
z4QLO9w`ngJi!`8pl1Ba}s4V%CptzgG;O(2h?-ZKgJ)F?yFvel%QU~5pvLm4VueQ=b
zIP@b%EP!ry0Do&I82XJw?Ic5c9PP9N1NyatK<GIKEuh~zpji9f0mbEc2NatZ9Z+oE
zWau2G{mhup!aGO<bDw<|X`&i<z|a{^d&tmpReQ$Zt)tMMGqlIiau{=uo{Kbrd-alx
zcoT|y2%779X-3R|mSJeF>Jbd>bM;7ue6Ghb^c>SM9)k7)`e%#<@uu%&EQnQoH)BD(
z=?B3f>}lVC9$_qqHyw5(EN?-7U@Q}$=NSw9u3um*m}@%hNm$;7{>WG+L#ZFY0)Od`
z8H>bz7hN<o<YPV=I%C0Hq5U-N%`JnW7RE9V>cUuhK?^aKp3uUKWhm5@v0y$KMHma_
zh~dUqF#n9Aj0JPZD9%`hLt$sa0(;WFoUn|9BDRbWq(?zxKsBT>Hw<bIby%?07?>X>
zyPy~|VL>b#uqk2r7z!T~I`tnmHGxkI*wL7Ze6j=VNa&a&#!N5^X|hQ+qm#}Cm_It!
zY-2UpfHd`CBX}QavegG*6VeNyh!sMo`lwGpp9|drjv!5TILhc~kIr(0J_mZ7(dR)i
z9|@h>KgsCxp{E#~{Phj^7G;(|zhm^pICsI%1kGLgzK+lyLE&pcLp$`X9HHHVDn|Pi
ziWs18?zH<*_?o`Uqj@NcFdAY@x-m5G&F}C$Q05BKMH!mYvKa6}{$Xed;EgoKA$>q;
zq|ZR%e|l%2q3<#P!1vl!Xb_{_fCe+#btvLORzR7bpcO$V(zl_N80{9cGNb(l4FgqB
z<^ePuM8a0o_b3pJG~!XlfH<VlKN$~Fk*0pt0=1DwpXgl}p;P;H8J+r757b9K`Xn2G
zG^DBhhKx@AYQ)g`Asd4xD1(@mh$liP+oUr(`XQS$I@zxUL+g-i$>>#~tw09urE#<Y
znMh-tvModFlWfP(+9t8S6FS+rBcsE1GMk~bU(RN9Pv{&*dkme+=wzEEjP@6FDWfMq
zS25ZX=xRo<0o}xCe?vcF^hD@pMtcg~!ss=jpD?tp%TF0S3A&S^HD2yw^knGw46XO_
z2S!hUVqGL?-IrJ!2_1fwml#Y3AulsJ`I+Jj=rnIAwtx=b%bSdj8zjXv&?y!u&VX(}
zDgJ;?aq)oBCG;VK?{tLg9fsC5>v)FV(^w}kv}dtSWau4_brM7S9qVL<-tk!9U}(Q%
zUB-yFpeq;w-&t2O^zOjAiov%?!b<f5aSFPI!8c37O7#MIXJMs20ebIiUB}RS3+s9Y
z-#`iL28P~YST{2GR!UgkXT&k+2MoPYwtmRayAUhlfe^5d74blbeNe;$AuLeD13~X#
ztRFMN1-g|H2cX*+eDfu&+ZlQ<V@3QBLO~Hf1ija>?qKi@nXrDw(7E4=xFYbanXn?R
z2s-~;cQg1VO<4CZbndr)&d~d5>t2T5Nm%zW^lsWp?E!ixVWlwudRJ|wegk?xVWqwT
z5eEH=p?4M5gABd%wvs;pz2~r!?Et+Swvs;poxiQ*13>SRtz>sV=XL9GhTe@@PcU@;
zvz}x`U+5`@&VSa^jOYqI!_b-2`ZYuEVy$NxI(J&nF`@_b8-~uH)^8cn6Z#!P=TR%>
zDIvN+F;59P%UaJf^nTWQfuVD!6?2ym1EH9^1iq6LR?J^Q41!|*5_C4TUSY&w=v9W!
zsn%-@z4x_VXYhTdu-;(AT<A{>or|pGOCaV$$?ky8Mb=x4SO~q%(Amg(hY^dRcNsbx
zS$|=~5-7zPpfi&79wU}QDb4_$nXLC2u?YG*qjiE(%mI4;YW<U;vxpVz3_<T`tq&PG
zt5_c~^p4j0n4$BE^)E(Xj#-~DbYAh(7z6R{SA;PT?|#J?12*yV0wu7wXan_O49p9^
zlAsjwF<!sYi~(Eum0=8w%dadbhcd90pOrB>K+7`*;?2*GQTw3&jKZApvoQwz?iauq
z@z5Z~Ks@_}GqO4qe)U6HMPrF#j9yT>7Kc6{R{at{4Wz3<6B&c@YBC0CEykdJ)dqD?
z9<k&%kfFV^A8hS63i%f3XomI<eq$H|G2}NMyp89=4e0v-zA_F%;TwYXdVbp&+86qf
z-2v?l{q`~j?BI{~2z?dQozd4p;TJ-E0rh5d#ECzAM5qH$_{Sf<(LaL14}`u2YGc$+
zC~Qm6*~LGMQC~un7}_`ZPi0gtbQ+^_pxKNZ0iDfA%uW9}j2r@;%Sgnn|2!}s%Rg-A
zzkrd5Lx0RGLJo#5VkB(rznGE3q3<&CHRv)%j)ksZ<m*tf(Q4E)4!Rb=PI3Zt1K5c4
z8&I+lknolN=Zt&{3Lg-13iLE1r$f(xv&erNdXAAZpcfc96MBhJSSS21GwNq3))qoe
zhSFzTm$RT)Hwbl22)M#Tc7tjR?dfegL;F{o!5Fy5CK=fosu<cg+YpNc?TKwJjByuQ
zh%u<G!VK-@ZLW-Q9ZH{pY!7u~Xy0%1U<{1GR+OQ=wyhXrd=K?xXy0us&d?s;hS(&G
zCs4#EVf+X!$<V&oR*ErTR~zD#pgp_I%Fvm>W@n6xQ2GoE*xN>92C^zN7=$7n1dU>3
z7ictNz=yUNMk20lSicCF2(88#@SCkVW88*fT_9-BZliL*_!XMU7>E&DZHCTXwz>?R
zsciKa=?AUP&{@is#>lQv8b2@)6Sfu%o#$+=89GDQIx?~*v=c*TCtDU{Af{{-2Y}9A
zHX1Xa^MH-o0MZKW#>jHe-i+}S+J`azhW2HQuc7@II_KH?GjyJ_4Pc}@bRZ+i|AQDh
z3)(P;3F9$z2xI&L9nDCxE9NjkXB68QM%I8%Wau1Yo5aw0#Woqdf$|hnZ-TdwPKHha
zZzHXsGa2JKbQVKrCR;Wm$*!{*IzQRwFm#Tx%?0yNPZQ{TM$-5efQ85>dn{rk*$L|s
zA;}&~8QBZ^4kO8~?=q6?y^Nu=oozWoXFl5shR%7ml?<H;ZL1hMPuf;9l6<~~krWGS
z8QBB6jiGb9Z3kmKgYIHvPv~xj-V50FFwzCO9~{6~bm*6iaRGXeq4TBfFk_sB9$}0>
zp+^}y6WdNQ#(C&z#<&8##?Vjy+U_yN4d`!-@fY+yBfCR?XN;@(aT4^2P?R<pg*NSy
zp);!;z9-ZJD8^41@S`2`jWA$myDMWfg%)89_`+V2QMaLG8HI7!%Q5N%6!XVk9`zrC
z1~7C!wg)omCNzjq7?(YSQ9nUL8Fd|s^@mX1ps|dC|LxTnH4BRMhfvd@ag3S<jb{{%
zH-S-aL2EDy@oC5UM5sPctQUkrtl5(o)f1Y`D8#fqg;8%pQyDcET8mNH(Atce2(7~?
z#I+s%CKTDB9-}Z<?DZMd3)+BDqo8Sw8Vqg7D9l%TBSuYyHfGdFDESYl4N&qKP>Z0L
z8-!X9CBFhS2ui*LYB3aZiBNAtG5-m*4%&)QScmLb3kWp>n!zZ{V|yD$4S{AdY8bRF
zqsBwqF{(ebJ)_n_J1}Yqv?HUiR@gf+Y6>)qQSU)JGio5T3!_#-yE1AVlwt*_-q7xh
z8UgLWs0mQ=D^RPUWOty(K<OT!20$q$fEo&=J^{56N^t|!DkzNysAW*P2mMm>pk!a5
zhC|7JK&^q2jer^prFwyS2TJw=Y7&(00gC!d{RZkaDESzu*P#?2Kuv~{Z-An)lK+6Z
z0-egJZ=ll{bqG42QEx!We}LZY*{L6hQyBrJ@c<bMrTMS|>1Zg~8W@kDG=A96cmSob
z0oedbeub}OJt)NxF#dq9XN=#W8yMq0lxzx&AE56u^xn|^0V8WeKV)Pr=t)N1fj$M#
zFy7yw&p{5-Xe&T4>K;@BI`aR98bBib9aJ&uJk-LdkD)G%`U+ZzQCp#f8Fd-z%BZ{0
zB8-LFabwhvP<KWhfqF3NFKAIlJ%$!z)G4SZqrQd~XVf{U7o*NXOEBsT)SFSiKz$em
z8wB_=3ib>r$*9B7QjGc*TAER?T|gO77B;y6Eyt)!P%EPzLd!ESlL+u*)Dx&bqfSHZ
zj5-K~0|@nN-j6W~6^1lyL@3xb5I!MPJQRK*6vh+?{}2i>83-Q{3ib;`<Ag#S2Es>#
zf-M87E}*JH;Uhx9CxP%0p(3F487TNC(1EIqG<-xz*ddVG01~ksNc93m?Z8Kbssx3P
z2#Ht<gpUY%e;EiL5sLZ<9}y}JO5*{lB@{j)R1+wCL?|i?9}%iL6h0zUb0~a7s76ru
zh)~ofd_|~4DEvjJEGYa%sK!wEi;#%1K=_ML9iZ?RArU8mHb%98!gqwCz63C;1~iaS
zouEOCY6uNx=zVQq2&39VD=_jYv?8O@p`nbTag!Z^qCD~eP&C#sMkPV3FcL8q7|zH)
zq2yzrQlSxy!uSIt8Ab6D#i(k~XhxC!Vi=VSjb&6bD3t>$4N5)$suq;|2Nc;go>B09
zU;?8^$woktPZAlG0<FoYj!+s8Pz|8eHjsZosT@%4pfnz!{Gik}P<5cS8HJb#q|ZQ6
z-E|q61FgrXrqKF~qWh>lpb!UvG&Z0p2FZUwk>4n`fYPB9H$agODMo=Zpj0oAx1eM%
zAb)|9UxCt~6t6)30i}2X^xi*^;vT>)BCr)Be}}ea=(~cz3`UW*VHAxclaY6!Z5c)P
zk-dPTaZ}6zc?U}I4OCYs*&QgluM;DGgJv<R3$!z%s2%zY<UJ_e4`eR18zb*SyEF19
zXb(own0hjbeA0`d?=}K^Gm6^j!zdbGUq=24?Z+q^v_GT#p##7`^xqC0#He8CU`7Q&
zhcGG-I+RgWpu-qN@jjeUG(Sc#sv>kGqY6VuF{&7JG^5<1uQ5tO$1o}!I+js1hhArt
zD|8&AyrAP5xe7V~Oo2U@K;LHMM(9*VZh%f><a+3IMy`X-VB~wynT%WuoyEvC&}>G&
z51kF>qODJ%^BB1rIv*@Y{s+(%U?tLrq0|rDCyzouX5<;@Rz`jU-Nw-OVS(Ejc@_Ez
zBfo}Hdq92*-NDF9(9alo4Z4$&KR|ae@&a@>BhNzjF!DR-=Zw4z-OI@9(0z<N2mOMP
z-$VB^@(T0-BX2;zWaN41R}6j67kCiB29mBHVI<W@wgB=F^cW+lzsDI#?Vn^MwRwt>
zG(PGRY$j<OHyKHN`5D|rKGpFXBWc`^7>V%(VJ;AsPS632B@6l%qu{5Y6<{Ui1^gI{
zI3v_1s5hfNg8DLQGc<-#TcDU<gwYU+`U#^kbRc7-K{3||qY)JGL&&+%cfc~FDGxRz
zjAl^SkT6<6VN=5R4T`Z724W-_V<!y6Lhvod*ap4L7>JwTJB)$&3Wl8s1924m5Ijb^
z3x%lQ!^l)<1ID-qg?%baLHU+>zXBqR9HbSnAU_ws3X;L7--WmW8(vujJHzi+V52Kr
zkv@bUkL}FJI4JHR48%ijTgIplZO<5JKleGK9^psNikS#~xzN6;2CC!T_zGw|NJM%y
zGzru~dOfs`iO@Ge8-S+B{}`GM`XG&1+M(sXu~}jP5Tdk*7j;E*(GlNCy(ZogbH#G;
zzW7ue5@*F_aaTOn46P`Be>Pa_sP)lCXp6Kp+6CPezmI6sd+EdU3HloSlzst!o1h$i
zqc_?}#_#d8!SB`$GbR`_jK#)U{9S@Q_$w0MNW=W=5nbd0{7%s({1){={HD+){O(k7
z{JvA9s)^rxYK`Aj8i3#WdJDf{wj95S_8oqcE5}mO5@3n6)U>2oT3fnUMq8F!KDQjT
zd~3Pp;^tD)rIt%mmv$~aU52_$cFA^m$7Q|CHkW-a$6dZJ<W;DAq0mCHg;EPODb%)5
zk3yRZ-6`~_uwFQ&aJRx!3hys`yYNF-&DGttp=*X~SJz#xhg{DVkwxN)q!sB>WI&O{
zMb;KMP~=pR3q^h|@@J7;w<2!7ZnfQ-xwUue<u=T1g4+zY#cpTZessI-F5Q#e8@ab}
z@8&+p{T=t6?g!n!cE99)$NiCq?&0B4+9TW}!K0o>3y(KF=6Edg*y!<z$4QU#MN1TI
zQnYQ+9z}-~om6yI(WOP#72R5NZ_#5#FBJW`=$}P%ixny6Tg+apO0oE2(~B)Cwx-xK
z&qAIxJbQZ%_nhc?$n&h{<>DoZXBJ;j{EU~2mzP(0uTZa8uT-z*ULC#qc#ZIy<TcA{
zsn<HMtzLUexRoebqEU(7CDxbNR$^a?<0ZZ?aihe2Z!hmM-of6H-gUgwy*qgK_8#s%
z(R-%%GVhJvpLp;0e&$oir-V;spXxr%eA@eT^BLze&1bXEZlA+G=X@UeR`zY;+t#;-
z?-1W{z90DR@V({xprk12R<dNtfRa%qlS(!$nNhN9$$=%ul$=uXP|33;FPFSq@^LAn
zRMAppN@bN=TxxBpEu{;Uu336i=}o0imA+8==hA<ci7ZpIOj?;$Wj2-BS>|C`*RmmH
z8<x!|JG1PPvOCItS@v|<i)C+>eNax8D^V_>TvWNFat+I6lp9}edbvgA)|A^^Zg;uE
z<<41Mtv*(pwT5+=b%J$<b+L7=^|bY#_3!eQ^2N(r%U3KPQ$D49<MLh04=g{X{FL(9
z<yV*gsQj+-hsvKVf6vd$FVU}o-&=lj{r>RF@pr{vB(dRdk;M7e@$cn7%zwWBO8j+;
z&-`!OirVVfhS?_AW|)6lWRLBL?TqaYdvUwfUeO+7Z*T8qA7-CmpJ88YUu)lD-($ZL
z;2KafpkKg80oMZE0#gD91ilvdR^VLxg^~9IF9xZg#Gvs(Uj_XV>>gY(xLfe7;Dy1v
zgTD+u8+<wVen`m>zmQ5H%|qsfYz^5Pawz0%$o-JNDu@b&DwM8Zt5C5*M1>|5+E!Rn
zVO51a70y+-ThXOrxr#{@yH%W7aeu{o6(5C$hPDsw7CI<&ROqtMv!PEbg;q+b)TPq+
zN>eI*Sm|V?JC(~<4y_zpIkj?=$`dNjsJyxIj>=zFz82;h<`dQ^tYuhs*cV}^!!CyX
zTBSslvQ<K=q*a+-WkZ$iRZdj-p~~a%a^Y3OtB0qBHxF+c-Zy+``1tUh;rqichW}aB
zwQ5k+gsN?;j;Xr3>bDUhqEJNjh~5#yBPK@7jMx!zC(<J_B{Cy&cw~0uqR8Em7b71<
zRf?(>RV%7#RJ*9zQSU}=h&mp1BkF#%N3>70ExL7d$LJo>1ERB|7e%j#ULSoq`se81
zVv59g#gvJOiAjv96Vo`RN6dhj5i#Rp-ip~0b2sL3tPxu@woGhrY-DWB*tFQzu@hq7
zj@=x4qgrUS`qjo)`=Z*zYR{`jRc~CqRrMj&msVe0{Z92i;)=)Bi5nfaDeiFG>3G-p
z;_-3uqv9vWXU8v%e=q*y_&xE5<Ig5|B(zG%N|>3jAmPV^pK7?*pntm6*k0pSV%fyF
z#FmNk6L%z@P5is2f6bVhJ!{UWd7|diq?Dv_Nk1k%NG_e6kUTZ{!{l$0AEeYs8JDsp
z<&V^e)HbQBQcu@%tyQnqfLhaPovD>mJE8X2+Iwr?sZ+ns;5v)y?5yivw{qQfbw}0R
zS@&e!$MtOW;_7v&x2)dB_4WD*^@rErQ2&<(l^cv}u(iSN246Ke+2FedR~p=I@JEBE
zX)?_{%_psVT1Z;ew79g?w1#Od(>kQ}NE?tgB5hpSTWPb>7N#vvTbK4x+NWt((;hV}
z->`neP7S9t{H)=LM&6C;G-}c)qfu6)-i?Md8q;WUqv?(2HQL+g@5a%M6C2lU+@$fc
z#_Jk?)cDiJKR15Zq(+neO*S?8w8`EkhnxJ-v|`hwrj45pYr3H6nWn!t^K6#dY<RPA
z&E}_T=|1V9>51v}(<i2HN&hVUVEQ-dH=1kBLz-7@9@o50^AXLrH~+nb-omRznHKgI
zQ7!7UXx*Y`ixDl}Y_YG!sTP-7mTXzQWt*1WTlR1HTFbXu&T6@|<&KsIT0U+iTiIHL
zwyM|awN~?6ebj1it5dD6w7T2s@7C_E16wa|y{Gl5*1u+0GomxvWW1Fzw@tA&L)%Pl
z^HrNOZSJ&rlo^qknAte9V`iVs5t)-R=Vh+V+|sse+a_(>w(Z$=Xxlg1&ThN1?Vh$*
z+y2`2NjuffyIn@Rp6!OV8{h6|`^feK+wbd8q(k2hyE}$=Jk&{citRM9)2vP_I_>Fn
zzEe(?YgU!4npv&024qdhnwhmL>tW}@ohx;&-MLNY(VgdZey8)Am;SxkrF55`T|VjZ
zxNAh$%&wcdUhG!7TVl7~-Bx$I*WKE^MfX|VH+BEC`<))XJsS7u+G9|U`8_uF_@u|@
zJ<j&H-?LKBte(?*Zt8iX=kL8_FKe$xy+-xQ?zO4co!<7|F}=I=9@TqU?`^%$_P)~l
zx86B@;`<EfGo{ZbeQx$G-Z!c5gue6ozSs9i-&_3(^{d-&biWV!o$B{z|N8yM^#7>;
zPXh`Kh#1gvz~}*M2OJvk$G~y}s}8I_Fn!?b17{EXaNyyAHwLLeL4#@xsy`@W(8NK@
z2K_m>^5FV|yA7T^c+KE12Ol4NZSeCUWrwsGk~L)LkO@N;57{#0vmvL4+!~rRbobEH
zLw_3PGAwM^uwk2r?HG1tc%k9x!+Q>&F?{v#FNPl({{8Tuhd&(=HloFdb|d<am@s19
zhyx>j8|gXHJ~ClslaW0~jvcvd<QF5ajdB|mJ}P}ww^5@;Egp4hblm86qvwu(Z}j2U
zI=;5>weQDxjY%7mJ?6~VVq>d}Z9KN`*lA-oj6FQ|=IfT%qhIgx`kdDfzy9+$%Q*jW
zHO93Z*MHoUaUYDkG``q)zwt@q+l(JJe%AQ+$A3Nk$%Jwfk|s2p(0{`G31=o;oABqv
z(i4*>PMkP%;?jxhCvKm(f8wc$7bo7H_-K+ospzD#lPXM#nUp%I>7@3P`b-)%>CH*=
zCas*bWztuZzL|7$(u2valS{u*^R4kyHca_y%Hy{yyxsoox8D9@YRuHJQ_oKm(~3<C
znO1k&h-s6jEt<A=+Ky=_rd^%(V0xkH_UTop*O=a5ddBp=)5lGpJAM81ZPUM)es22B
z>3>eoo#8g4)Qr#>HD)xKku_t&jHNTS%{VmU=8T+~J~J!MY&mo2%y~24pSf@5H#2{p
z`FNJwtg^GJ&Z;-7?W{ht#?Q*0wRYC-S>MjOn=P`7X9s0RX4lScncXdWaQ3+D+1Vdv
zAItte`?uMyvwdfW%#NL1e|E;~ZnIyTJ!AIr**j*Rn0;;b-*Y_X_|J)*({xU+ITPnB
zowI$;cXMvdc`~=i-12iP&8<1N$=r@}`_3ITciP-_bHAGV_1xR@<UG%L_Ic6sYR_vq
zuk*ao^JdIjG4Hc^C+A(C_jG>I`L_Ah<~N()WBzONXU%_a{-^Vg&%ZGL{`}kpJ_|w?
z)L77HLFWa77ff5Qe8JWQXBXUEC>NGqSZQJ6!d44=EgZ9O*}_j2o?LiiQTauk77brC
zVbRx%?TfoEerNHy#kZFPE~&eu=aOkljxM>i<iXN1OPen3v2^^>!%NRCy}0z*JIU|#
zduQ=GAHQ?|-Kcl#z1#iWweMb7=CUkuS-WM6mz`Snbh&kT{pBr|Pg}lY`Lz}H6>U}w
zU-7|;Z&y5A>AEs;W$Tq=SI%Ae-pcc<Tvz$5vaRZ{YUZl_tA1GZ$LboZXRY3~`sC^>
ztDmeXz9w`{`!z?_`mXJ|cHG)K?<K!C|GjhX{k_guS8QFmbye5ZSvPUr@^!zh4_cqK
ze$e_g>u+s{+E8ahiw#{i4Bjwd!^aygZgk&RW8;L42i`C8e(m?iy}$DP>mOA4pw9<8
zKKTB_ln=Xnxb4GZA3oU>xT)!;cQ<X{^v$M+AC3HI%}4t_`h9b$%}qA1+I)LU`7PD9
zblNg%%MTw1e?08t^IIdgPS|>5Ta#_;ww>LUv%UHD(c8Cf-@X0DCrO{Y^J$S!hwbp(
z(QL=E&%$=<JKOB+yK~mg(>rhPe7MVFSIDl`yN2z0ch|OEmv?KsJMSL1d+qL%dyGA)
zd&cgWz2}2HXZAe$JnZu}pAY?f_UC&)Klb@|pFiCjx;J)j#@_LJv-fV=dwlQBea1e&
zeU<hl>>IOh%DzSWKHGQY3y&}Af3abIx&2-C&)9!_|NR5S4}=|Pd0@<e)dx-<IDg>j
zm-a6szkKh@XJ7UE>aT-k54Jow>ENS7X@_PXE_yiXaErs^55Ir-#Ni8vuOI&Xh|7^;
zN32Iuk7OR{d1UyJsYezb*>Ggnk#k4>K59E!<!Jq*?T_|8I_~KFqq~kCKKk=9dCc>e
z-?1vksvS!{*5Fw4W9^Q0JJ$c$h-2fAy?t!Xv8Bh>9Q)wdnPaz(JvuIrmpoqac*60P
z$6q_X`uOJKM~`1R{`iDEQR+mM6D>|;ofv=O-4okS>_2hr#JLkcp1679w-bMz)K0pd
z^g3DgWZ=n&lQmEFIXU^{>XZ9V{(h?BsgzThrzW1-cIul`k4^`k&N@Bn^z750p1yO&
z_e_H`v(KzJv+c}RXMXtF__`?lD-4k-@Y^H$d890&Fn%!9-_zeq^9=O#&(zlBw5y|4
z%Grm%QGEV+h93X?t9U&g2Rsph|Iq)F%S9B!9bS=M_F%h<S7dNdP_V_~67l({J#E8(
z3{TlntypngFJ26H2kqald0b6u<?i09rodmUGixwD(SwABGop)SwvH3*KjhEXar({6
ze<p%0yD3Mv(0!Dj8>$E4q#kTBOXk%#^5y&T^7p(VAAd<Re>-{Q_r8?>qQCQAkxze(
z(%Ii0#<RS7_Br$O`fHZVyZ);Fe&M{2ES|5v{jbPB@KXMky!vN4^QnFPd|v)CXTDkg
zi}7Xac)OBk_j7sW7r#_~ZeIQ(%0~=E<VNfD5gElqN#T$8JGP+csF>JD7mLNagimCo
zcVNL_(VoVp231KbVzXLHB|N`fFm#SZhm?!+FI={=w@=xGV+8^!uYcF_`hmYzny=q4
z#=p?)pDwHzXB_%hRN(DXq?f<99Y<8VXQa1(G)1td-8x&F_Q|{Nev<QGMo7%KYWn%~
z8|k?s{n#<hM;lBQF>5d*x8#e+#mMn?1%FBDJnAhg0#UbTWQ328cL~e~Z>vsf4~~q8
ziH-`g+oPR{_NP)iM*77Cg(e3^bxM76OwIcBYmONnmzokcLO)-*Wqe>tSRq42Gzv>>
zSG8GcTtZso#OP?elF>vv{2g9b{e~!S+BhiMGb$#=Y|xGdY!+`%SR1WHqFpU2B`Z2Q
zD<!2<RAzE~d}?ZZd~#+~C)bFM$y$Sy4iS+Zk`q%?6LUVH|0Z>e#2C%m%`uj7jIoDl
z)q?r+bc`D7K|6SzdQ+U{wXbt{aJxBjd#o+!Uwim<9iK9>5%%idrK<&{#JK-scaO#T
zx_g%HSi>k0P})}Yi&u4?JXElkbE%hk`I`|dJgQmF-qR4^xgr8@A{~D7%yXD0d92-@
zx;?5_?@_l)mz1=$lrH-Dn9iv=Kc;qxY1$w~vnMxz|6Lum7>KP>LU={{dm9`B1?qCu
zN*;W<I;}}sTF#dLtd#mpwVIy5Y{EKet~>v4T0>NIMQepjOTZ5P-sZp1u6Pn`*Fti>
z*U~T_t~JehmQMCGOPhT|yqjxyU(?P7^XEI(_JaBIUXedHU;ZF-&Exv_IrFiG70PQj
z*s_fB(SH8>c&+67zHr`$(S_%$Z-2i0LizF!yp&IC2-h?7rF@Db&Y$JXr+%4hE9aa2
z`Ug8@JJu++2d%AKezCJ2@`6EYE9Wnwe1t()%rbX)rx;e4e^^=bIZWG|Z&A%@{la|(
zms5u`HIah#BmgtGvSU5Lq8*J%TVPc&mvCBM%+)0}(nHsx>-9@)oEViHo0XK(ty*S-
z_-b|PR&U)ZwR!W@<Q7_{R-=z=bce*cJ&G9aZ4;`s43F+mGp=58bWE+LX$c8w_2Lpc
zM!$%q7q(t#j#<N7V_}Y&b|!fP?5J(Z*{CJt97Ht!k)E>~kxPG<+=Bkw|9w4-#@b73
zu@?THi_E-x1sBDX#GLJkwQ41HP5*?~MY9z%^6-v4->#)#zH`@7FyFarD46fuHDu%#
zqfx-~T>lCk^B)n!<tgGgf0p?))99Ilzq3ax7p+_7zjjZ%XZy@MnVEO=^ErpLYR`kT
zra7AtJ+wYGMp;^)%+*QDcZaK9E2k*m<(`&?zYCu4UbJtvV~#t?G1KU2uZdpx&u@<Q
zqw(;>nn%ylUi0T`Z_b~euE(UOKR;@&6=q4Z27CjO&vFIxot7(@@3au-Q=D);&V3E%
zlZ80nv=DmUD>sySn3wO|?-Z=xx!>V@nv-0QbHBs+G$%Qq_d7c3k2WpviaD9jC|YFx
zIeCjs^zwXk8jSi)mNj0CllL#0sGR%AY!5!9y;USX=HbZ_7R{sA$jrJ)Np&+vxeo81
zTEBj(Ug-H>-G`$#+@+5&t>47qKYaHD|IyPW9R722#E(~`;bk}Mp6xRGuIjvfZ;y?=
z5C{jgxSSO^Z)(kQKH{fnF}eqqz;|fy<O)YDPDEXFCQw|LzxTvUtpPS{BTfGgqpM~Q
znzR44pUlX1+=bdWzn}Jm^Dz^6pUU|w^zr{x-l%}T8|j7UF5zh1pfgNtbf7myx4(A@
zZE(&r^y6mJznkK(_?x}Kxa*-bP9<~~W{nr^`)C6di$AoA9gAnZH`-^t(b}-c;f)7b
zEIMrPrIvt+)TZjViBUOkX?RmLIwfZvS<rcU^5mMr^k}rpwPcRGtSh7S$V>Rkh-i6M
zsrt<Vv?b4j^g$)-Hw(<^4!@Xpn^r+8->fK@?_4)BbBobg4c6lFqaC)-%x!3%;YvGq
zU*<3{6}`Aaw3)e|9G&<KU1`nTifos-ExksR-kCdt4qhl#KRrNe^gKE~BRsEf6oK59
za|cap5&e#jJME$<24OkuJh9`n1Y^fZ+a=zAYLz+<9^9FTuURubE-A@%aBnT9_u#?3
za*p&K+$=RwYv9~>I@dVf>2!L@7G`^<jX2-ALKMt*t`L;ZCoeAVJb7i{>HMO8+BMJ`
zM!N<+G0=Tw&0PTB=RA2)KJO+t-+A)l_UVMj`OcFU=abzy-?>7W?VD>m=Q~#-E>9;f
z&UdavoKGte=bI}LR&UBLZdAmYUrGcc1kK&H`BbwT|K^SC62-jIs)vs);1vC}WUpdr
zO+%xezxGP^AR4$;>LtGAHzU<)wNUC!UcU1jTd;h#UMufOR@|UbaXpJ2=S(h7R^$AI
z`SOe9^ZuNC-V){>iLK*Yk2A1GqUa2ulL((aV`6Ri<M8=UAP7~Lyc4PMa?rjOo9bSw
zxZz@?bc~Gbn1cU?2AA_Mjl=1?jxffW?cpEb={$i%bV$zG9-mpdB%e{W;x7fZA?*0S
zGDPe5;5l#Fo%m{z+RNu5Iv%_{bL`sZEpk$}=k);naI_s__&mE~eW~f>juHPcm&`Uz
zs||N}3p+@M7lrv$VXHakbO>UqCahMT_J6+lZRHzD&vZH?1DugP^q0GOAiPdsV4ZM#
zSZPCPg|{qPv?b@UGD?TJRtyiX2wcNj#c6}%TZWaZP@-x2&Gek~rd}1xHI0wd21mxn
zN9N3ojK}It&mnqtxaB*6(VAuV#0iSe%<b;h>KYr{wbty}@pbFQ&(_aJcS=dliq1Kw
zjjdlJkrs4Xr_5U11%BEB>$<n&1a7x`=T(!Lxi}>&W_Xvyi{nyKt1s5iFNnxYXxnd_
zCX-{UB~dL+a~tBXBHs|cwEI@UzBbE$29NK{M$q2t<0{<?;W!x6CAC)Pn7HU+*Ql3Z
z+ZKx!ot3O5rF4o$k8}2=b}jYA-wkSLNs0CAC+6&{fgi@u&36a>7{3QvrJnPf0~hmI
zoY(dCSCc!(G^{zl%dAmTs@1AhZ3=AAp=N{L-Z@`rF*!%Ix9Y~l*C8)sx2F4>-XHst
z_Y3AbpDOL~tVQdXdtBc6RH=ukC<aS}nlmYHvk?^(j2C_Xc{K3#<@X(0c%5F=GaDx*
zHmFi*K<y?`9cm<YjLEDO9i0*yJh*<d*lzUZp+@a`ag~zY%9rR-CoZFE)z;M`YSxSh
zsb0jd#DIoL9ilJ_vvqS66J8oc!F)au>nI;>_O`gd3zAp7gK%t@{@Vyny!1Z8<G&2&
zKi^FJm%)*b3Xa106siYbz~=A;kJ{-AnjvKoAvTH+I+aCwyF|yZ!SlUPijFlOzU`tq
z*1W#8daEiiosv_lC)BBvP<hSd*ks);v3+F5A6SAqBqe3Vq}QvFP^a<Ll(^>)X!c-d
znFDW^#@b0MXHaysKfSHO!`$vX20E9jXnQP<fLf*G4v|`e8u4+7nGqdQQrnxalHwk_
z#Ji&X!;=zIYbBxtF6Deuvtv|Ro#csyrY7U3heRwzC`RK#qv2CS?qTiDVSNe?3?peq
zI7=9Gw&8avT&}-1<}MZ0g7MDe2fhLJG|QXO^0pZ*&Zvk*R8ULBF|K@3;p=!a73^sJ
zFZOu2oB0N+F*V?DYiT>baXRMc8?}`;U$`x&kJy6e1@?mGz6hIg^CcYb&MS5An;Bmt
zAtAGm>!2*X`15<@7ShfGQKxyY+5ed@MSH<~=kBLqzB7I}pPr*!k8}5tiE|L|968_l
zoGw_8bN9jd^ql7My!$YtL~m}?gICJ^!`|cN5pRt!cO0MR4P0OB+-tNiXabrOXcKkQ
z9%DfP8-!AudHK$rQ^E52`i}C{cdo~IhU4;N8_qYMevWo|kHKSg?lIT~bmrrH-eX|T
zk24>AV-m!Erh|iXhw+jDUhFZn7rTlM_?dvX_!^lN9J`7ay9tT~+7Oez*iYoe2EF6v
zemLK8bN^oW+IdEFemg^_IwR7{$Hx~v#L@2F?sj9{J*D(=AK88n4mCxiGJJj8L}~Y*
z)3-2mf~tj4VfNEqI0q%_xC;qiGl8>Fm>%q*yBK|1H?M9OhHfaMURH{sl%^R<k8jdu
zPzuf$_#lnCI8WU0sZ!Cyqhb{wz3fZrAU(*pQjnWlP$l2z=gIG8%ckE~z2x_T`OX;U
zd>S{GcgA?Z@@70>WFZ(CopR~f>SaXYF+~Q6rL(T%8!MNPuMhPcRM^X+yb2HLa_H+G
zV+(sJq+iztYdydB3@%b6*z^0GWjRxBc?P57p0`me_Hx+Q(K8!sSbj5m=3eYH)6GNI
zi@MEhe-ZyTiz7MbO4$n)vX{blX|XxKVZ`RW=7`t7G~$B!&JlAyjhM?jM{LKL27SoO
zcg~E0^*Cn+=hMvKdYm(Z^C{9f-;DIUe!ghe8DaQoRs8=O&YRyCMr;1qB5MBLEw%bN
zyS3#xpK8rB^|18J=U<yAf3vJP)-5lMwP3z;H^TY!CWp&A-*uHjn>Ep9*;mJ>(Yb!}
zaC8jeC>wUKjsKB>rs4lF5z!=VNb@#kL{<#+@CXR?(Xw*}`c@3^@Cd9((HW#Y$Z?}c
zG}|!yy8WfT7R-10h4aZiT;A!Ig5^09d7np-sK|2u2EA_a$J0UE`{YTF`+w(D&eX<e
z9dcIXOh#ve&>z~F@w=9tW`Foy3!MQQnx`Dc8IYbfbONL=*n<D<3^=V;dZvGw{wE5Y
z0k<_tY2Li7J$>UVPk?wLr(%EbOb^HRUlq(Vg1G^V<Q;;G-Td~+8&6Yvtm8Nn&F_hy
zwd@*}9=$OxJ}ODiR0G;|?bD{HM@R!}O5+ukVr#f|Y!ulrG&CkU$d=r)Q>&aeyOs!v
z^J|zC+bFtHSTrnPwrY67!h1{$^wIg7sDk+e9pCYA{^-2&+w$^5wP$(t1Y1U$-~G5)
zUUlF0y!$X}V^v;#pS+a6A}{~bm-1iqcfc$1`@hK7hZ~dg>e-Q(|Ihu+e_v3(`##IN
z?~xvwufIEA<YOE!`n&6;{K9$d_sq*j`-nZK-A#M_gFkxfct4kyUp=q<(7bvmYHsJ{
z521XVg;TLFtBPnUD#GZUHbpSLa`4Ujn%Mk|UG9I4FYP+LR!uU$KF&GzuffJITV2am
zqVJNw_+N{>T6sMmlz&8qTVDQP$B4>f_Y#c}RTkAmvU7$w2S8hBoa*r0p;u)%O!LkV
zU(e!jiJzIE^Q2?Kcsa)G{c&=7i_~TTe&vIjq$O0XrBrfQa??wJetv;1nkI)P7b;Z8
z?jPKwd{Bj5Qv*@RwL@BiwrLeA2m2*As~QqgwN2gZ-XWDk{F2inLP8?a!h(B8RSJ#L
zjE2EsVZrd2*<W);oO8@9yd%Ior*BU+tWiFWb3nAO-F&I<66wM(`tbdU*<C&x&^e%C
zt@QtoviAUNtGfQjeV=U0Bi<`^ykyyuEXz}p<sr+Ghdg5|UP%<kj_nMbMM6RbA!(tI
z011!={(%N4fkMk@3$*@r&;q5DmQqGbnJI0dj8gjT7icLZB!2#X&b{wxI1c3(kStxj
zckj99o_)_fFE!Qgm(tURTL&j6x7WMf^$w3GuB$l%0pyeWGhE$U$L|>1+UION+1BWF
z9d~&tc1kgycwh{cB-S4yOt=|YdIR@51dbe5zJopGa7?v~U##(KTI$HPu4}=^i^-Eb
zjxFr<E9~{HuA5wK4Ym~&SLHqPxxJ#yZDSz*5g*cip|pn2nW9DnNoqt@sFx77e|=u)
zei!a7wk!<lxnANqfD<3hhkPqR7-%Ox6*HPvAYaa<a>!}{Od>I()yVfANF2{wtwjS<
zlY?zT>FJW+pPD*gsB^pPuwrpr$L<*4+U?5Ne{$9^ozdLY#}}%x?PRNy=)#NDN|pYM
ztd0t0y%eu7%Zjugqt@;)TC*G(S|tiVgWAMGf<nsLE~vMUH|JFpY7-+1b3NbK(|LjA
z#*KXzd&35=d#S#;%(ZlBT;2NC)+tA7&Z0Pb$*Nvo-ITlCSH0bRo!dLz;PZJbo?@TJ
z<Ad~Q1}virjhY0n{r7nz9pUZXl`DH)U8!Q~U4=CcM@@BI9Wx~jEsoo~>i*Hqf%&_-
z`&ykRovr+h{bgo`q!xJ)D}v*a)cUXElJm+I4Xha-Z1X7t`wVq1S6zKmQ!E<;+SduR
zzaBul-{oy{``vBqlb#-6eh8yRf;zLwZVcrVND^#ukdH}RlBRg;89F%T6ScJy9=yx<
zcpGXwT7T@$($=P?R;G=!Pqkg%K54g&xhHK+9Y$UIGS*t+>FDs}5}om}IETEca1Nxx
z0`1$BIPCoEFFa5C){yq?TyKf~e-vmhgYQ6kliEo?i|BmleY%kQejK>(6GZ1pKa2hz
z4r!0%`cAa}B&?nINVH#Yo_2bou9!FA;(AbA&*54C9~+f;wZI4IL2>=gKtHsGqz6U&
z4r<5Rig<NZge9VuuPw+)btdtVSUG%=gFdAuxZD>zTJ!U;aqJnl*~UG1mmh3yvNdV_
zQ8mV7t{IoOTusfa5E?McnuFlXam3g_0TXsldr3)|J1s#8UccS$@p?UZ!4)SxCm_B^
zftY)p;nb+ai4-dk00&IKV3?@a>9RG%_+z&%M@WcLj+|$-O%x{*FtjfNILAelC@-eO
zqeh8DMiq||K`+7}$RM+l;?XIuoIE+udB+_Ex;NisR}bv)^bF+X?HG`EbFB7aUz}`J
ziz?3%8G|T<wheMD1SDE0{;#4kJ@bxRDr=?G6kqG`<m7OxFC}H=hLtH?LN+(g4A{$S
z{MpXd&0{;qwtAh}<Fls*Cs>KsHSO}Y)a|cpA-ushXJ<Gi|6Ac8<S;DIzD<Isvq1ZW
z=V{*>*1iqvBKqGI)=rcy+NY@<S{9K*9<9hEKh+A<DQcXyJh`65Zf{yzU;E&szqz)~
zBb}O=&hT`sUm;(|rd+LFw|pl-NnKI=C|W|KZEkK3HUpD2PhzyQe3o0;|3u8-I*bYX
z6HqX^MH@X$_Bx>8?YJ6#k5z1n1D4?@9$>LQ9$=Rb$d-VwSVp*0?%pJA=Qt9*2HUqO
zUcmhJ3(wQOHLN`d-38}q=TOsZ;9m!4V^n6Ng>({L$o%m)DmJ2MhZIoeu`~2~k^)Nm
z4r+&98HW9Vagf=Q6O1Z_W=#fArs0M$X?Se-w}fUCJjs#yq0V5?;U#QcHE&Wuv2=A&
zUcO$RpH~!EDe$)f%S9@Tpx-C>3L>(>SCC=?SV6RZA1j!ka#RZZeqtd1rLK1QEF0Ui
zZf2mZiT%&O?CFV%h-PqyRLxgY^t2VHN2#X?&`2e;sG4;kA~E`m3IFto4G;Zf`s5}A
zr>5VMKa=11_rKB41iWBe4@i-142XEV745(sEN%m668<*&rOZs)MZ#!0zK4Z~F@<2Q
z8SK)kPSc}ov7zujgSV3XV_^32A|t0beh+#4$RZH?nuzK_f`}N}+gKY!bJHlFAkAoH
zdJRk+Y#wUhsLP|zbgyBlYrc}OC@N;r0rs-*QQz!lDen=46V~Z#lagxn@-2W;fhsV<
z7O8>LbUtRqGaQtWFOfF$cFNPa7_$IG{|kta;qV`x;h@e=11pthIDize`5u_#T6U2?
zFiVl|5IR@jhs?NKNJXQN1gan~TD7Y8u1bV}XmIwWr&-NabxX`y%vNS^9xBXTf>Vr3
zatkFxSBj;sv%!{GQQO}vkFjs)j0T-Ns{X}zLh@8aWQ31*KEVT{Q;|E9%>lW?``|Pr
zayAwJf9?}3xU9(pRz>?I?5O5qV0-@cs{cL8GbiBBs@HRE#v;Z*)gr2)><$D`fc-;N
zRMKALhs}0ZQ*B+dAJVe7eQ=GEK*3fvdPqo0D)_e{eS)Z8KtlW_AQXNgS#zJl5~u)O
z6`W(usd_W$T3JM%S}S%BCt4_Xx1p^q#x~V{z&mNPO?nTsPuYAe?qlv2{zl{S{yD~q
zI7M$#vI^(72Q4_j6LNjff(vgCT4J9{+=64G|8p!j-oB6p_bGNIuK+&8eL)NEQ(?g=
z?LiBU#z(|LX%AX()J`&7^b@q;$Wp5av<EG<@OcC+HEJgrE&Ab>8u*>?l#6U5+Tp;?
z=e+!ifR`F#<pfvjNKr~^PebLQ1s09{&Xbx#c^0zqyvwJoUM^n^c%qPXn*#P@89@bT
zMSJM%La*Pb<XP}p@Y#v$cLwZJ%#NZLN<SBcv?qs9!RElYz!KM30!#Dl){s04hgpJo
z6^@_~b2ZG&VmlqJ*+mSS2!SMrin7JrR6QO{v&gJ0P#k<DS={7Wm6NWRsVOb)<3#d!
z!;0zW{sKMFhfm=d7C{609KO=CAFh%+9|#PN3=4Ag@XD7q&)%3GGA!~deC<ugDG&5`
zQ#)}OACKb-kt@DNlU#BO4kO$OTnUSr;1iJ{6KwqEP;WIe%j%Ls1487+5e|(?o<-0u
z4Mc@zTKoE1P1YP1DP>ztt$lwgF32f~9FFU)Gg-5xNS0&GFDNc9C^Q&;e6^vlpg3-M
z*Js@$IVCA6B{?JA$JZLl3v*mu;``Ea!)Jza{>CDf(x(WD|MVjMQx&n8ERihAq7YJ0
z5ImqmKqxE25w@J86i8@uEGxGxt7{#Em%B#^0nJFKD3nk=+I&azXbpF+KMe^2X(E=-
zjX?fVR%#CI(_r5|!@-C6FEOX({^JV=o$h<*os*v%cakuskoh9QwXkC_FJ^M5l#U4w
zPEHN*QD0DECNpYmYkUihIcxZo$4naB_qn0uS;RJI+*IIlo(9a&D+`;l4a%h7JF?pE
ztZ#Hdg)DaWY#6VsY-(&%>~7uzr!}`iYr8nD&2PU@u^#lWDlj5wP+WfrqqsR)Z=Ygg
zq=Nh*9zmc?2$5Q&By-?fCXc*{u)UJZp=X&*%gg<>)s`AZq3-57*VJ;0Z(Zan$y#cu
zur0~C&g)$_8dK6?HI!LQ#iq#2n5E5~1O4tigSj}jC^9{6pmXW4umv$bp9k{5LU@M5
z71GYN52%nVVuCl7bIds>O0dfz@=?CX99{_v(0zdkg~#fi_%G9gM3_GdRaXvUH82aT
zhM2XQDFE95&su*w!c3Nt>gL0)%s4lpL&<-ll*&;=(3;2W9-FJLZmOlB%C)q!p}xZ2
z+G?+Dl`@-F+bRbfjs65p`~{uPQQJUgLqn&p1!*_ly4m-M2JXfi?OXF~@qjO#a`)=q
z2Ord1q{faFK1=cJFL7lh;ERzSr!!Kpq{+yH)5e`{VNOrA4SfCU{x{#$EjiiW!deGz
zxn)3p1RF@WEpV@f_FEkYerXrzVVE7<6YS%Io}LfF`vFcl3>qD9*UKqpi<F8wGUy+a
zL9nHAPw5=WAn9=qys=>v5EUFbe5HRA1_Z%?^}|>J7%q`+<lH1;Acpf~dX$Y{<aayj
zJpP@?^q~DbXGe#V{!VO1pJLaZeA#7ToG`y#wa@0atM=Lac9rHtJK0B~f7Lz`?H?=c
z#%SKIaN=75xX%5Z#{0bA$({=S{>(Z3lf@u@rwkNq{wr{)7R>y4sP>s?C;LpyL)d4O
zeL*qU8!4a1L76oa{zTF>=_5MYp(mHL$l&KI;DtF>R=IP0{Gz7_|E~6S7aLQ|u(u|*
zZzsvb`{NR5Y~Fg5(Kr}iwC|CYbICjZ`Ve@f72M(y*Q=2~aXncDqMcg>%DBSf67y3n
zE?f^hQH(&e3yVw5I^k!6DDI3nA-A_E-(1B3rXDo7f+p7FHj#2-Q7kOP24Gojn<SKw
z6~$2#Fs>Awz`JS-z_4Ah203ipdK9n;3x`qcQYu1hU=ie5Xez`<KbhDQpBx#L7`JEq
zCz3(FPS=!@(xhV-A@PHe|07|2>2K&=!Gsm=Zd1m|UVmSmCYni6k?sEWNG+41H4WWk
zQ_YcDiD8$&1zlg7X-`S9XR<4TpJq?7OLLo3;!8@?<ST%2J|16b>;{GCp!w}8Cy93A
zByqjUN%ODg6oC1Nn1SK*@=R);_~FJa+Js0=f_BTsAO3vfE^R_oWKzs7)W3?qFFq$G
zCMW(r`D6LrnfSce*u3}|^jZshjBrbF7e@$k+4q(`J8^kTqDGUb-8(M--^|NWr2Or4
zOLDR$oej+zXdU^ze8#XBLS{U_U7fLLrx}au)fv|!4h9$k?R%t8IWNrbN96_4PP{An
zQF(#4bJ`Z|oVEjS5|4;>m9G3;V<}NXHP6J)Y{>fkD$b>}``IM}e)%Ae<nU|xT=#~}
zb$)w5ep27uj}+Id5r5Ln$h5=>^F!!|(O#}p2CW$ux%50W!xEpO^E%4;7Je0vBOTzQ
ze^uERSMJ8lMEe#c%I1M)p<a!MW?@HMil*Oz3A+AU)UGLIr7TUfL+hzfXowE@`IbOP
za6itt3~+cv)JKI1u#@Le3|)!%7|D!qy{Jk|wryzY_;G0SnzFL$6%%ojL(IfA`m2==
zN2NwHG>P%mo;0*uyRcSQ`-5)Z6xJiu`{@Nb#cX-6T*qI*v8L*HJ#;+5oyzUiFQDVq
zv01pLPYr`3T-iT<E=U}rWEvUkB_I+SKN{!STO=<md5YTTBdoAWTe&AE@}T)P4F!n;
zN4#OLrDr-6Z${ZS=f<7b7ZpY}c1$z=V)d0*_^fx?`YS5>ZFhguP+e{KW=Ty=^wN~E
zty{<3mQw5HQF1rxT3U{l{PWS$uBz&8v$?yvs;jiG%4n>j*V~s|GBw)o8!IkZ6jff;
zv%I6WqN0{wk9KzxRdMJ!Z(JS58}r*$n`3^v$}{uZRk<PBw*hOS|6Pi{5bY#SM7zpk
z{<#)~_rA*EnU>zdU(#_c?EfI^;4g76g*3X*?;_S5&5E6?tp4We8khVpw!ymU(V7(v
z-Q6~~+s2+7n0=#RMGa<)UZl-@wxai~qW8Ho;D!S57OYx@8+dp)Ks#$zZ1^VRZDnPx
ze|_Bg<tS)4`&zZrS>4mKd_Axz?&myy1Bd#npoc&^=jAOlZ}2RB=hr9m@q#=~_es2;
zr5p}ul7%2i<N93*@=vU|08lw9D;@p~o|5wN61)P?H8fP0mM&k<^cH<dMMa4o?w#nL
z=BZfVB^esQ`(d-yvy1E@^W~x=bN-~~$BeVoh$v#lf~W(*+@MeETqdQaR-3Bomzc9{
z7Q1^SFK0=iuOKI<fMUiKwVe%>cn`*mpM6F|j<NoTn@F`-f5<DvA`m&KffQD~Mzgtl
zpi&dfSX6Xm`-;}6MPv+A^!035?uQj{MP_}xwxA@5CCMLUIu<Q*WU@<P28_#hfG&9N
zoGwoA^;09G^V?Ob7VSj6;(ApZ&c9yhf1J+-^bX*Ces<r_KY4fiJEtkTuZTs;v+^I6
z?7p?o0dzglhoGC=xegHh(7r|w=L(YjvA7QYl-N6)zY}WB@Z16ytn-E&3Ut5!{qF}@
zz3*aAmoG2xVxRmgROO67x{ailj64p(^@fP*I2`J3s`smhPNgp%Zd*ImvK04UK5&&|
z<O0T4wKmKS0CW6)O$s30Bq9C)3jYR&G}zAL55acKjK-sx<*L^M4x#@!e`mpBcZAwA
z8i-GQ%lhn+_*B?6+9YAu{2{Hk`r?WFY@9HYuThMfU9%?~O@JzBeS9lyJ?FQp>nYl4
zJ;n9vdIqf<(SELVBihfkZbbXJ){SUC*SZny0qch6?r>}{sAhG4I%v?dvwUZEU`p)F
z8fFnpb9b&^0fql{+9H8RA<k_evk_|xu35Mr6e`q)_x0e$i3_C#`WruT1j|J}5oJrl
z*3hF*NDt-U4D!{o7KYT)xuT=WR9fA!;;Jy1zwGmnit_mU3jiN7QZ(iDra7!xdZRXK
z!69}Z9y~HN;A4eh{a<<HNM9fJ;m<(~q@S2YEaDwmbgqr&A%qt95CfkV9**6Tr`PA<
zbw>HiioymCY^ADOs#6O9L71dGN&{ff30bc~khb6?nMEh|ZyyL9>?L&!>C6IygkVv_
zX#jax=UJur9c#B93+-6~{uacZN(1!~iIfM(9LVP4=ZvuNtks^Ud#NU|&^K+UOflUZ
zK1g#~Lb}JOFU+(pG+5B5&sX$e(4|$CGs+rp24P7GH*~_aFR!Fw;y6Rx+~95lLnzMu
z5~2sPd_V*6$|>6Nqc9nPby2)~(SELXFWOa}7yXb&BidD-7wzP^h<3r-B2x_BJ*ZGi
z7Bd3}>hL-bt$DYO?vOvh8%qsG+!6d+2xaP;OMk-%;Co6kTX<29Fn3j0pI`6k*>gTB
zvP*@a)#L?p5Ht%D><b||2*sfTg=HW}A1yGX%AsuwacHQWyztDJrM9J|mR?JAx+Qr1
zJ#=_!O|#Y7OfS1GH@B!LH&=Jz0x+m_z6ht;t4T&wU=s@oMu^ZO`6?f~GfG_PJTP38
zZ^&7kl91x5G4W4{$)4(oFgUKs$jwMe&Cf5d34B<)03gtgkhO>vzs-4=^1hT(PCV{P
z^iOKPmR(#oSh1qEtjzJ|oBrd+D~F}GEdzDrsa-!Hf1fQKxV~-xR-o`(|KF^JD|}{d
zHJE+!rDQcA(?_Xj^<VR^UK}v-{3{bOc|e;Fu%ENLFq0HIE5J~6g>R9nrv!LJ80Zzb
zT*AP|XXN=_tkLJ^6l-dtnyT%tW97AV)$7*f<Q3%_E%EVjR`x5$k*p<|sRnbE`H84X
zqp`xYI3qKsxS%|@5THi<m_5R7M}{h|OhD3J5%K3HEL&{N%{F@F6&L5>#U5#>^i?+S
zH&bz*kDBoY`5|ID6b)dIA5z4af)nMWE>%c6*ZCV`$K_w__0oA|@7}#Guh+E~m1<rU
z8JPogTp2x+*N^Nr^qhm9S;Xb|P7wiKKLh=yT+Z&LqELu1;A;LW_dR~Y<=9ur4pZ;a
z)QgjpI`~U;-_S7KIQ|fhQc4lob36IDnIy6wvA;$ZH4dGC!gU!As#O8MHM=~1aVpcY
zU0$DjN#mJcMkQw+c`dzdq>?>2yW_PZM_!Yf<dfDF9+IeJol=#fXgVLQe&=V(@f|TH
zUL^^TMdP{w%!l^AaOw&*Ht?TXU<Bl>i9UGg*v5+9std;UA6k7eKI~-sV5vXOn)!=L
zjx3k&r5Ad$L5^pFqM*mgGc;N=xnBsn3RF`A+XfD*2KQ2!-n*%Z`K3V*l_VNjUf<!Z
zYwY&duWfNpIA|-SX=|K)+||%Y<%oQ3wRTTu12$QzhU=WGu$8i*!!>5d_&kb)*`#1L
zWT2s}Td-<~f4L@7`qQ4}I0g4-q%N&5Ue=W@ZATu^iIQbqi)XI~miYaA{eI7}q@LrX
zXcL|AiKc2QxQ>6P>y+v$ye=ZfPoF!(KEwE^`@+vQ(;9LlM(fj4Ek+i@_V}OFO3Ox~
zhWghqq!LS4$-55jM~|HtA(@Y`l8*qoqnbe&(apb8#yKh`;QJathKv}z(MVdFDIX+d
zjNR&gkDM0iDv*={CFL$fM_eMHMjxpEhVRIA!S5tFaOxJ{$?sPqqo*i#Wev6Y*<;<W
zOnxOHS&|atcTCEsACdCpTZ)>JlA4OxI(`C*^B>3CpV5<6RC$EXtC;(%WY$QaX&q&0
zWZ46m2jBsoG)v)_3}Z?Wj+7vXK-9wXJPrCe=a{2*-05!`t96VyM@kxXy2jmx2A!_K
zknOXrZvKO3+}_h;ANTyBd9}@VD|=7ZRQ89`#=^qJ(m#|n>1ck~sa95vEP56JKaHIh
zs{@RYx6LgWq7-)fk+F^b=6Y1aNm?_+vgE&2+1NgWXDRn+C!OAd_QP|r=o}dTFN3`!
z@Abdx?>TY=DBmSrGrQ|`8pDY(=>#~ghHtE1o#K*)cX#g^!lgT<Bm8CHSEKJi0Z~Zb
zbXSI?k?WW3@$OmH%tugf+j)xa8=LzIUww>{Wk&%S{+~W$?hgNZ{yX;X$1r<91cv<p
zhRedxsts!0f{-xSnE#kK4{_|;#;&f$Yr!2a;!HXnKJRimyU@$r8N7+CJ@Ri!%`MQ+
zp(F23i;kw(Qb%iX8hc((nh*?eUx>p_r)^;F^SB&oAwAUvat>AaH*WM-R9KsutQD*d
z*ppvezrwnFeZSLMV|B`R5V7+}${C5y#4e`TftKQsTy`p*68{mEm2e}0I*&@t%VAM0
z-`TlhMdy)yk%i4wY|L3~G8H?ceDyAAvHaq&caL{ix?Z+=mz%NOx~G`*r5!k+ani_E
z6gcNt;ILzu6h~kPyYB{{vwLKu`^XJ%ISppB!AZd5Wa*1T9eX;4*pz%*Pg%(xgPG`5
zso(%UybN?I&h}89M&zWxW`qtvqzS~T?m(YgJ96gDH@|#tr8HEJWZxK&??#r)f)yk|
zM}6G4<@MMcit`9F02T~SIS$Ba5~Sc4L!ZB;p|SPPe@1>=i{Cckp?tSBt)2<nQ*<Kw
z>VXUCk6KFr89CN*%x)S4OSQeCDHf}K52=}Tof3sqYG&a&s(wX!JVMF>wiSA#`X&w-
zdnjQf@*cI?l&xEtdrxxj@{VDDxw*Q*Djn|c|14!-VnBY3l{Yms)ymHkKAn(z4ZtVQ
zJEBM)ScWr=VtHVCWXGyGg*XUvv}eWG;NaMbp1#r1zS4?{QoQ2U4&Nz1fMxvEH6v3~
zBk~o)Yr7ll>{5F}gI&JD-asSO0dSHq!tO}Js?nl>T|k4Rh<LoY?s!XY?WE@o|IWjE
z4<2;1w=sA6#%^dcs3NKma*#!KG&VpX00-DrA{-Qw>>=XfFk<HD5QaejBeXs&(rb5d
zH24E(QL`WO1u}y8d5+Q_MV(c$W_Ud=QNMv~ntV3)8JRWA>+{JEbK{0)w+zy%i(j40
z;mIf=xuY5j?6gmg2~;FI^7`u#jA2#D(8EgfKvINPx5JD?59oy!1i87gl~=b@ZhlIw
ziwCL!Cy*2db=*UQp?*hCsme}A`04KbZ0z;W1Kz*v>G|ckhrFpL4`9mYFr|rEq1r^a
zZg|djwW=KmvU4=VIJ%*VkI?#QBo!43r8)gry%D(hXw8uPH<ndpldr_Z7#XKfu!l^w
zJTN=5mp-?a2h<}g^{lZmUrT*G*l&%eg$|Om)VF-n5@#KE|L&4Tl&TQNHe{-V=<_<i
z^d%>+HN&ku;yLy^V2`Z76`U8jy~f*L2y6F)_+;KL>>%}eZiR5(T@$<>Yd|p^nhDW;
zA)gD0D~<|~CNY<t4pVAW$%3L|+qO+kZo>(aM%O=^oB!!*Y;?tKpJZLsF8|OoZtZV#
zUwI`CSFPOXZf$jg0=V|(FufHvb{tSi6%(VNbFl)-d2O;~x&CDz9X>pG)v?*19=mGj
zn!~sEs%N*^0X7<Xh8w*I3-4i$8M6DUc*SaN+kx)Tj+w3iwV-SQKE;xqL^Ny+o)G_!
z?^^YYIH#15bK>A;#Y^FJkGPf!HL^5`lD=hQwjnM(#MU~MP*$fK%*(NcSzISdY)eRz
z2CObAmScoltDvh0`9(xi&H_fzRSK*_Mpl(x#M6{@v5HfFyaaKkv_gJ;Uftmqu219_
zqfDQ@%8Ec<B-%wOxDWwPP_%L#QUwe>0w|=25lCB!Q#I@_E^UznffI*h;i)<7Q1<iB
zJ6fi8Y}xpOdwTm4)1=|9@eQ^$Ee$O#4S2=voSNNxFfL_flGeYhKF8C$b7Hb(!shF8
zO;U9xykVwfkte_&Pl6So<JuW~81OHGJAPb>k`XZa(cqfq8fVM;<+t8iX}4G2`ZcPB
z^)<=R?XGB!jEwAcb`14fOh!w$saS8q>K(!esTd*P`5j`1<>w^>d}&~T|4I=o2{Z@}
z+a!G%e}%u8AYC8s`PB~7jnhBjUicDFR0D@R;Q2X1JwI)tw8V^JXDpI!>G8>z**<wx
zV#!%YUSCwbqVu$De*MUi*V$Fy=~z)stHDpUfs&)?Jec~O_Rp2`VLX}+xBw+&Ige`d
zY8yOrOg-X(Af7g9-;R-W_HOG1!#nn^oUZMz-N<rT+&}P7J}tj_2LI5DckVQ>UQStH
zw9>(J#h||joyQ{zivJx*o?~(TjsE&-yUppe?YX$pfek&2UGhuohbx^cDrseEM%~)s
zF1@+jSX$X<F4mV8<$0Fs+!f05)O6FTVBLA-7V{yC3@ffUd=Aa%h$iNpZS;m+iC4=;
z^Vl=kWGc0c=E=1G$nWGU2E1d%_^v8?+yKnryoz$}CBv#BWrKgy%^SY=)9KqcONO`J
zl0TLI^3g|xVSYXD2N6EL^6U7@XV0DHkU>|5`hr+aeRfhs35#Zz_<t28>AM=WL!GOc
z4Y0lV?()rGYPIsEL8*|&D_`1eFeOCk%k+$l&Rv_g>>WW-mx~9sMxk(}0UNCev!{kT
z_DwI>%YS5P1$~qIdWNYl6+`5aP@XW~S<+{W`v2GO|6iKQ?5U4F;*>%;<Q3Q*f)yQd
zpO)?u9_A=JNw*NBAYH;C>=R@m<DMo?ZTws`r@mKs9}eIWxq*WExy6#gD@d^y2Pg!E
z9+bT%^stTh5Zo2Q_rR)XBC0Tw334|JJNrh$C`x9MaYdW=D1t)*Ma%t2awAnUe6ESk
zPd52ot8KQ`u0dye`&D>3XJ(|@@un}svt%<ftac0^$7`jTGwfz><BgOBc%!J$Cge4C
z_}GPfHhn<L$CwRh4K?=2juh2AKzHoK4Z~~w_VT0t$NasIKW?mGnMj@@EGpa$?1y-G
z8SH)eBLAPc_h^vK>}9YqUF`(Eaxns})dJq5K{l{c^b&nL(f6Q$C!}w($%OZ~%e!k?
zE4;_RZL;B20n=BM-HveY@f#qCZ@_yr$QJhE?5X_#hOBqs-GI8pu#PzWaJd>3sMG%2
zR&UxodfRO_hr@Q8WO#b@GT+!hWqEle?gmG2*``zsglmyOMuF<;ksQAJ$h$kJgB?4l
zgB>seLwZoXMKM13bRh_Yujp90VZ%!F0CD0VU(xXNn9n!XNjvf~r&*d!)Z7`V1+$@e
zM1U(fNCXoMHrn0{briGnA$C(-<R~8Au3<|(%;zdL8jD>~!!8?J`_yo|xqX<uCjV{K
z=6*}D8Ezs*ap8?dQT;^XxzIsE{6yE_;jSj?{ovsjn~F<Ii<>0FQ%^lL>@|6ZS(^Nh
z9!s&QnDmR184g-(<Fts10*LQb(L99ZD7?c!RR(yCf)RLShME>Cde}0)6Xh5@b&cL1
z{?OZ4=fRhqYHfyfL)CR{u6$o<Q(JxY@H)_<4<pbC12KXc$_u)OVdsdMf%o0w5PdtS
z?!(UU*2&u1$+&gH)%9&nrM`SuTV3_gIux2a4&RXG1Uv=LZ7Qcw7ibTh|HO%ah0Z(@
zLMUT857rKxSKu0x&#<0*TyE5V&pk}r+pHX-^-B#s!^1tkX@?UBX`g16Mi0)2{Rt=k
zgwI%o*@yUy{Hz1t)CUQJUbtB+JY}-Y4|fbs4&wg~R4?c;l$9Au%;vb!zQKP<hQD(^
z^4-2sZ*9f9l=6c&jL{6ZY1dIy!gO$Nk(@>Tj0*@DN=|CNw!yo3^gaL1%P+X@y6VQp
zmlIbu`9^0?{r0yk|HsvqvTCdpyhQZFE1hvo6Yyj~&>{Fxb3s7qpOv`U`6;=vG5<He
zDNf4aVCZ0L6H8E$AW$O?`~3|^Ma5}LlIBYFW?e=U)p}2<VO!+?kS+B0fq}nsdkEL6
za&Hm#sRY-mdX!A&QUB!04L|<r^vNk^^Ko^`Pm#iACjMCkxrQu8Vb6!^EV^|SLR|j$
zm=3qS^Umz44?e(6pcyCh10*N1F?NF-X#Mziz?w>&j{J6eNLHpMgZ#rM#xGqIr_sd5
z?;U-jr>AFn29ocFB1%v#Vq0cUp_YUc(FIsYB5Qa)62>>qm;BH84ym%AZ2o!jpW^Uw
zxF0$rO~?Sg%|gE6qc@C9ag`w%9$UGTl!p91uAEm%f(62)p$;N3pGMVmp_L@qiuT5k
zN)qyEsmeatetFxJ9f$bUQWEkbqLc*i2DqdyvJWNf06^cW*%sWg<L#MY?cAE+?U2SH
z*NanCl(j+DgVGPMCOkvR$P4jug{%rWn@6(B7<3Ndyu#xU#Sa>rKX$u6rpnZCay|ba
zoDbV-oG2T&!9g?{-EE)fo7>u&F%zzxIb^U8R0z<%a2A_*5=bBLeLlbOKQ|p3Ja}UE
zrzZ{$9=hr7UY5fa$^Vw$p&Ve!{UtL9Yennp;Jv^H3#k<r%qCLqqw4_;zn)u*@Mi%f
z&u#*q)+%<w!hYrZzCCJo689^^`wZGp-<oGb;XB3<mTjnC2$`<<g$``!aZ`r7>r^BL
za!17C$tygkmd`kk@2Y;``W3c@HdOR!t+%gOuLyRs>V)M)(HfFY^LEkj{c>OpaVKcA
z-vC1O95<acCuu<sAEG1NFzGa8H1a1^?Mq0FLQTX=bnGC7ec1=LRhgN7o1E<P(Flas
z(ETpbEvS752p&=)2=1o<-^zZ9k|`>5XduE$@y_swAj<S)FiYq`MCJTr;Y{EOJ-oy;
zG+S7mXL*1!v*yP@!9}o=2|Da20Y?hH5I<37Um;aj(e%aC<5OZ{k{4Yf=3UiYR@Pl9
zC)2DEBn;a%;&B_^FFs+GK7kc{(vnTdi`)RA3@;!1k=%*bdUmO(nL04Qx(0ZTcGzAM
zMp5>fuv&lMxFqNi#RK%0aOgqF^qpI+_B0JT*QIH689nd4$NnH+|M&l87x|c;Wg(XM
z5BW8|TEZ`&9<Js+hDG-<qOxy<5#Qv$Ba)!tizr$>$#9DHv8;9;9H*U}Oz4Uf3UzQt
z5c^7VPQP_1zpkXu;K(1US>?PB`$lYye6qBmfc-_zFK8&GZ`eP&Pgw&a;ufXUr<MGR
zFnZ8t&}OU}f)$T$%BcD3;@T2XO}fOMeeCz98Y(AUWAa65^zC-GSScs{p1lp0rEhCj
zJ<H<-rQfRW+Dhw3u`9wP?K2UlJ~W5Xk&}8Y+KHOgXUjY!e_L%QDn`a0Zvp<?fp)~$
zL)u$;`-8CIsLncF|2+ESyNBriEBH)%TGW0gZ%0%W?GNHJZ~&Mt5b)4lfRod&<{@0q
zBZ26L_b;NbVeRM#{7il!?UckL8lyz6!9XxP!Xw6;^UCW+#z*Df2g1fP{f>%`juoRg
zks1~|1`MmwaUenmie4QUgR<(vMsWlqa>@|3YFI8XfEouBdq}XasRCZ8y(i+AsL;hN
zvV{tCty?>YbEaVhx)7~W3v^9W`iNSes|_lvO~p(ORwS2rJ}W?B6sh7*;o`zrJ-SQ&
zk)51bVP%5EN8!#kt+KhT<*f$$n&#I2%q-2phR)7Lhmq2&ZJwSP>B;7Cd-*bZ-AIBa
zx^~d&nR0YBFTUjD+5YC{{$5J8>1>prZ0;vMQmrJ&ovd*CXfD(^g2O!DGGa=kiCdjP
z4+NQkl$Rr1a9f4ONWy?mj90s=UeVB-KjQGV*VnhEn!7glu&d?QC$8?=6=$1hnZOoE
zPmgoL-LY)Uy0o=@ux_BIb<e?-m+uFpJ%}`=Dv>7WD}J&{ee@Ar%8)a$!GsmU9C9I9
zpS^i?O^dUpxoWwya%4RocT{VstUxZ##e2wIv{%>rH)>7YHO^kd{hBK(+`6TnyrNQl
zvAM6Z)L3rTcMSuA>A4P~zlcK6nvoLilq0zg2eRIIcr!gyIghJlZ+k1^imq5UIl1Ma
z{4o3e!~TI*?`4%W35h>8cO@t0#2fM^yIQXu-9F&|rtiW^Q+;|#g42*znhrWA3rogG
z(Yzvss;MZaA!tDb=tk94^TX@mnkryH(N>@vmH0?iJqA_fYjN-2?`~mBFLt-IxQQZ2
zGL!8MiqLVv3I$9j*P#ARpl-<%EYDDQgesQQ56BlQ)mb*+p3n*}sy3rMg0OllHDR?_
z<`rR~(ZSP@ZwAV>!I}2piMe3fEwKj9VLMRaV?}zZt*x~Z3`o-APD<cmW5jf>ZhnLv
zxKvKO0hf?q=zkb%SOD&;#24;fsl-AHr`2Lv16A`wAFM^x#o8ThZH{BtwG8gOzB}Js
z>Mcu*%RM}{O7AYkW3?t>t=3BZNVjyXrKY;x=dJ70Te8-*wHUpNi(@VMW9^o%YON+=
zS-pL*vb@h)O3&}(HgibCEgR7ZJok}%8ngpNPJ#%U@dc0;_pbWR@*yc@s#L!?YE3_O
zlMy+BR(-D2GDNb4s-%E&gwGn3Es(omQbmy_VA3&EnD>m<l=auOE(02Oq1Ih}eN*#{
zw77Y+x_Xs6SPg*7FTA<Dz@i^mq&kd+-~<(8e4|t0Lm>eKO4&-n)2{A;(C|Zb*(HR+
zV}zTMEL6G+6o>puNkgK6@J922Oy<!e)d%OPVzpM<_cRI@e7+A}>K?b-$K5RD-lX~#
ze5m($>hZ#}&6<y(YS}<?Vq3!zh#72+9ihVRc*A@^4bZkCuE+5Xe#QY+PV`&a2JT_6
zy`o!koS!-t2dJ@j!mpv&AX#vd62~k<9U&vhQtqo!crpXVv^JV7lYk!w;CYUVUO(5k
z%39<yW#%#Ft@Alo*{ptNOkI16J$hyag8rCoq+UB7)o8f2p^N>wW<}#M#4~5kbT!;s
z+eTVh@L4cEsrUgDbrTQ>7UD)x&?ahHRXyZt>T7ZhRr_5tGu5kH*a*9;sg3<n)}t^K
zKD$;`!}q0g0H5GIA=OHyr;Sj!l}|@?JJnM^peLi93gAJ%qf9CsivMY7@AYICAe*zW
zuP`@Hr^{{YYiq3bL`jkExY7QfEZ-3~9_6g~RcTdK>7$R*`>)FCqsQa64gaKnwApUw
z&z|Lyh<i#1L`FnMKbTE(7Omv3QY-nHgWN(9?N=!6(b3=It$dZJ557w1BcJ*Zt>mlH
z+68@H(T+Zpt3@Bev!y<Y1RT5%jvEdgY&C)|T~r7Y8Tmx9pabYdHM{Y=c7%qq{ud1_
zXiI1}uD$Sc><P&u&H-@Us7V1GTQTPUqju!ue-RD&BLMSXw4{VQXyBJ?FphQD=Y$(F
z@3~DVqB>|rB!`$FU=xP!+ps>xEc__2ffKOWV27N$lcVenAofGKjZ#Ds=(Y>|oEu>a
zP_9*r$YqG+AWBvCAVcU_uUIet)6h29(eh=f;ma)@gRPC#t{AN=KTp@K%gZY)%=;zY
z;zoLY+O{-1c3>bjduiKGdq(POYU+C}rYD{-SuCdaOUuei-#76c4kbbmI46_?yHzKd
zX>TXW4mX#Zc$rzj^VAtE_HaybPJVvFvgE$_SdAt=e&^_;*s1u|;_QK1yZl*bhzimR
zTB8m5w7Hz#$S4txbDA-vYv?&Cx51avsg2iY7RBtJcv_!Y<?N~PrrwL8Oi>Qo``Kl5
zCRzTr6uGK=&~BGwF&fcy1yE{+-9t~229a~`9M6$PI8Tg({11J_efQjVbIpr2jgPld
zN&VzSe{|j4M3(hSFU_)2hc_X<t5%kzYd{UOkI!>j5`lpnM3>7*j&b=20ixxnFKKtd
zkpl3s2cl<i=;%=}AQ-fvF-<h|{Bv}()9z~DIkj$Mc3N8Y#`R7oD=}Iu#>X}!ERKs?
zoUq}sf}$cEv0FRRx*{=Qv}4s~QzWxS%1<I&?@(H2O-)ByJ<8DMA=U1KR8Lu%JC&%X
z8`MKj7Rpv4-)bfUPrK5l@XaMymBtiEb|?vE*|2ZlhUvZL$&rfU;);<;^WJxIK_9!<
zvD$UJcdr|qNSgg}(!}7p-TjhpaYu#xbVWx*B*#J`uu543w5O$D0QMXvpQ29-n=P__
zj6HwYw15Amhn&v!J=vDDG)s2Rvv~ytdD5xf>*PPJ+iju@#8|DgF(zjA_N<O_R#e`R
zh1pOXgsOA$+z9?`P9C$>Wt3o)VfKjp5{r>PWo7bKCsNc*@}EueV<vP)m_Q7HuN2R8
z2;NKZ`PDl&1a7;D-=zuQFBd0L%$z3A#h`-%(^zg5iBVWmyM7)jD~f$@T=F(>$<p%*
zobwQx#PUohLvgwoxZOkaO7un9I5cCiX9WcakntZu&hY9vdgsxjcM`qS5cqg%ZVw_#
z8|1HXEMoF_z7%?a2d>~voZ{vi0Mv&MkA?iv4L6*2I&p)^G`ma1*b**z=s7m<dr4>V
zq&k`{w<w|=m}iQ9ZhD`2-EdX$9qgv{`!dAbKqk_aCX-yaZnrP1qk_Gm%%mMKP*jXK
zkLHnP70;UzQ_*O9jyAkyz2he*5A@P>d@Wxq#eBZQ20xTD={zN$5WBevGa@-eQ5t^k
zk@^xeu=XgckuM-L%=YnV;OXGXmFbuTqzbOhq7-y;I@D(`ra6oplQrM*_1|+;lGs%>
zhmrMhd*O07b5du2{xdN8BkQ`6CGr*Q(j_D7tcW&Uu<|2Hl|}dT#8@R4SF91`%F!xm
zAOKQIP{VQj($gBreBeLmJGoVUy9Mz5s?fKDeHZ!74Z8kZdB7;)6kKG0-V$K<^1Wfw
zx`3578o^E~iDhw#QUnI(ivW&dmJ2Sq<N~~i#%?C&#p^y|ssOFYPjeE>>Lj-9bR|h&
zP9knLqJh;`bY{``YV<1(K2s)-NTuk+9;YBUurilrY2-5Yu-G*h?HJ#S#ah2NKQl9b
z?<*~s+Sbw0t@6WIEcvHeR;!g?wv3LM`P{@)&gi*F#r%}Lk(=_t>1ne{6hXAW1Rvj+
zwwR>ThJCHB?eh2LPjluw8dXZkPxoxhdiXP`541-Ts#%??iHNbb0<t8E&$Iy)L^CDI
zC??vNKUXfCA*8XGS_gE4BTe7KB5Be)Y0^8Zdn{w!JHKuImF1S!8!g{O6@`$=<Jf%H
zN;u42@(+_G?8uc$@^^?@Jm9M=iepiQ1vOKZl!DkZ1G<%@*nkTT{hk*1g36g(g@~|0
zbhO7jG0@OfUAD#5b=j8DP3Gm@4tGu2R!{H29qV`78?9SvoAm|N_09Ipbsl43rQ>Ja
z%X{6$?zHOM4NYsduN!IWZ>}w<Ppi(m$h%?h7WO~Y!&x=igOz37>8WF`hViVb>^^g8
zQ+)go!LD)>kHCV$xhNp^edqh^<A;C~>3a|%eOP?DT4*17dNkPwM9Eg6a`2aknfwxx
zlSjF#x#VppX&O91b`UCt9wbZjx<xL8j*$YITSV1Ex4(?g*?)ZC<}W2AGASwHOO^-r
zHJxyQ!`^nZq@=Xg(!*9bJQ~<j5xkZ<)l+~UfUJaop%VC@p$GKXVfVv>M#oIG474j(
z9&3-J$Gk+2)QuxeB~sG3&8x37#Uw~ld`#7}bD5KkyH;vrBO~LZAZ=&gUQ$w2RI-E~
zMHKjCc&TEY&a~d}68L>~C;Pk6o1fchq~{Ul12&>Zq1!0qPvoL%NPZOk=J|WCytDd|
zSMR;<AvWrjf6&fa*-i2p79~HAXKf?HU%@yeE00ws3K<(RK@Aj!U87HX_k}x;#o?rL
zYTU8P=hi!CS{_DHz{~Q(ndZ27OD1cT+vPV+|6w=CYiI?%cq5G~w5DCHhf;zNxR+JP
zuS0Xbz^w8~R^^d@Ymp9`EVGx8;GNw?(uDj9JWU4tUVun6Xos{2gqgBArXJ1$8NqtB
zV~044>}Y)v@~R-C!4i<4e;pVf8#vL{Sl^{FYcANZWAD*q-xbbl+LxV3NlN*>v%Ae;
ziSsY*Szg!H-QLi>X524dJy=##|7u}(Uv+o$HqE~@ajf6f7ni)uPV$ZO9>t%?s}UOA
zNUAVJY_LO(lP!^^m}kQIM|_Mpj%{`HCLcYT-0SFDwMzc6)A>PcYD`ROY;$+_5hvtq
zmDvY%b=F+9dG!8On`?lC&5-whk))CC`@2RmOV`|A*^v&M5)28zO28%~l&D-k&nAO=
z$||S#?VDb|$2>7uSyECtIAPvHGCpqmnwwBgYNBs6QLaf`)wgE*Qg(Z0YuQa@Etn_C
z7_u8uAlnQyPsQh@=prV|5l*63K{*e}VrW9U{(VfZPnqf^xrJ9_e$9NQKXp3A6AP-$
zEOOT1GgrCTqv;)$_pfOl>AJsrM3Uru2^+-V{Yd564HUo03))V~Ofz&DWO-6H2iItr
zrNe4BVBzuXPr`HsnTON+<X;$S2G?TU_q~T1d%s;$Sz~yaP_4|}|4PzG*Q(8Z?6%An
zn)nOPB_=&vQ`VXZEJL<(%1x*Eo5&O6=?;`mffv$>u+YGO=h|zpZEAXY2LI%Dop}W&
z_Oi***kU?jlFgvxt0OCQ9G|^`H7n<o44<#Y0lI~3R@`EwD{zZf;5C!eG9eat%_2)_
z%WPC!WOBEoe{{6p(VcvBMb8tM)h2gGhdU!V`Ik=TjETKkTEU+QQBk^d_BXvN|Hgir
z?ybDPvb~HWI8x4!yfuHBl%UvC$yni3RZpuV45^AiVa_WCBJ}jplup~yRY#N3n!FIv
z%+BpZ*<7)CRK8h)JnNQk<~+;XYp`Vl>H+Qynrz4-$}NH)$^_qXOMn7CB7~0|XkkkV
zWa?RCX*Ftt;FYyxNfusjeg6bA-zk5J@%EdGi_P@XFHTF(%1TdLJiCTaElVc+!I(XW
z_dS9!7lCH;Xy1ymKe(|;NCgX~=pE;QqUZM9%tzSL^`oOsXWl#zW=zr26{gv@SFUp#
zR<Mu1bPgD*m0bf|hT5ixWbkL925nQv%dW58eb0tYLSb#&<!~eAWoI6cuVxx~R-n&J
z!MA{pjN`d=fSJ@JP{j2e+t}LmZPxU|H=P}B$xuE!SY9RVpFPzH3?$*^F35#k#3Bu3
zAHi15;9^O6h7VSj+%)k{a3MPs+#=qSj%aPAhPt@u`tn-$b;ah(i_L4D&Qmo@vVQ9<
zMAAo#zLe(fZIqWu+Q=G{yc{lptyEqP^dt0onXV!Z$#|FPtF<adNOA|MOF%-Se*x+;
z^psjciHi?G#1)haVHU0`7ZeK@@*vy*<U+x+@zP5-;`Khb=GN+xlIkjh;X!WUD&pX#
zHQW2x*M$spCb4Idl4M(wfr|!+1VLl4yeNM|k^WR`HX!&Zio%&@zVs*Y4<-_VpCltF
zAVl`V=RwRK(s0u#p5{_zmd}D3@Z@(c`-dU>muGSzNwfDLUP7`zAeW=Cq~Rh2CNS+e
z1;j@*$>l7pHrpSB;HZ4USvVaknejMbu6af`K@ZIu-eZq)g=1b0$viA1^L@f9gXM!A
z8PY#_0m-OhK{+;^LF9@d%g4t*NOD*9b(-zXjg5Q$1RoJR+i5J@JgV2zi7@$RoP9&I
znqt*r|C-B*pjE48^92mq&$ViM%u%a4ZO)>+>#dEu*Nt2lXO8W!w>k5(4>q=4x@pa>
zva*t+Wz~6E7Ms2NN@ImCr=tFPo3q@IYmO~T8gTeVdpwo)a>L@17-Pz4Q{SpV)>76S
zUxtmTf|^CKEtOSW3C4Iwah@$9t_{+ZBCe^Z{zaB5^o34vt&)DH@-7|ufRJl$yylvt
zk3as?cbx?VPN%zxU1qxF7Sa}GWD<X=$in`!1NfkfLyE(HuI*dCe)rMh(t&aFuGhKk
z%ZB9W#EC)t`S!Zqee7ZR#fmQUMJq;oDGS@auRrj$T`B33l#zU~<-3=;Zfr(e@j82F
ze0-OUsveSf#SDe*YvA&{Dq#DD)H*WMl7|y`JY~@M<+kwT<gu>ED2ZvJBYSP*QPGly
z;Y(Y^#LdN#@e+%TD!jO9xQY3ie9`gnofk#L1B&gLx{So+EdK1n%)*TH<k-X%cKz(B
zJ5xRRnXQZO6ryK*No!_i>yidcQn7;7Y&je$fwK-dY}Aq!-0;2UzIWiT{oa?pcg2mY
zs#|`h^B=7KvB%z$A9?C2K1*N<{6&~b68i>ZWYD>kG%Ev}!B>XMkEe_FmsK{U<-dRX
z*KV$mKUzFgI}?>0_w|<RV$#!QOx0y=QmTA6TQz%2ZS(0xmc?vZ{vnP#6Li8FrrLlB
z#5n<L7_fO+zWjIg1Nm)MDo=K>JZ~v`$z+x-oIQ}c!l{9(6BGoVZGFzZCqECz<8Yyx
zj#&Z^`L3O6b#~Dq)-I<~e<CjILEm^d`O>9$&UX{u@tp6a|H{u@l9#t6H=p*oFo9g?
zxH!S{cy<=47ymDRdH23M2c(7@H|(Rbf-IsJ*CoL_<yMo3PLegD=T*b`DHN?PW8`0U
zOM7EehhM6jY{ApV>)W4Xy@M>WZiU&|(dEK{7CaQlwzKm&UI~hyr{Wo{<OA|361S)k
zEEe0%b{H10yqRv@F2C1Fds+S8#{tu0Pp!LnH|p6^Lk%7q{pi5ZOG~y-)J$v#oLCF?
zKIRio`Rh769&t~Z$tifu<_}ohdinhi{U@(w-;tY*-;*hX&#i8HekjH3=RrY1MAU{7
zFc=gV+8TbvuEfcfUF){0FqAvJY--@K3)htc0x80cHC>DzGx$^6m2G^mkkHnID%#N_
zV~I2-<-caKa_=T*alyT7XEX`60?&lQIo)CLl$3ZZWi2HoEpd(0?N#d>tWy4!l#+^i
z0l3;{^j1`Ojp7~i7{K}zVbmC`Bc6at9yogxHNM{Wv){_Hbk(k>hGs7TzqbH7s$M|!
z2I+=5^YfdbJHdcZP1FcA>Y)At1|GAtZ)_~~SnAtqCz{=BYTN4ZM6||fuiNKy(~BMo
z?`Ut2!><*+R_qC{Y^YyO&sJ|(nV`{Hdn=kJYM1pmn|gYhoIPxuN<-6&u!nh2J?c!t
z9(LAol0*R!E5YeZgY>6R<UKK?(dHR4o5yRN8{0cJ5*|IvRMfG0DK0q{D8ml|i}LT-
z*hqU2b-;<rg-X?a2Z#oK5f8AD2gXBe^K#`@v%wzuJ69~gf+yJtdHsE#%YQ_7D=^PA
z%oF=<<bOaOiJ;Ovo+4jNm$9;}yL_#wlFDfNrTWR{mbG==?)7DDY|WQ#%UjaQQaVeW
z$SQHKaX8kv+b+trr1jcM2Y^l5T~5I$h05tAHE4)j5~aF~T0IYou5Q^XxslA)zP5JP
zx~5S_q+g@67d5u0FCOe1+p>E@Q%6UW$ywMz2`$V$wX?LdGOIYF%k?e2r)TF>+0;%P
zTPt&Q>6~V~1Bxy{p#c>6^J``V3XLg-9!z>X14{@2;bSwCb9HT$KdRM=;j@-?j&0tx
ze#7ov8%i4ry-iJCZ(M0lbxBp1>nHi{-knpqQ#*G~$v>Og$#&|RN^>a<4R3%zQ2jgL
z@*vHJU_4-Za2&vP7BM%m_}~UQ*GC~K@5Y9eT@#fJv=DXW6FsXMraM}Ewbg3|2C*v5
zQ*}c_YpQI%I1qZvw%n4`R#SD8tE#jmr8swcD;U7nUT5h@D=D08a12#d4LR!97M7%S
zl-0EpMbKK2BmzZ%D~(oRDhZa;>V+_($K%urfn;8_15Z_JMQ&<agRwrr&!tjYw$$fd
zwf17<<d;@^ogGfEDW6?GFq>7=z%HEX;8nk`p4-KqXKvIomLei%XR()gd~P3mgEgWB
z_5g3W0WH7g*F-8UhjG_){F*4G<$7H62ycm2TCU|iQ$KJPcs~cx@&dmGa*4Oxh`U5T
zu}aIKxy|f%tQL1c2hIKq@Epc9&+^eB#ra)Vqvpu->`4K$d^y1kl)b@zCSc|*H=yO$
z{2IW_TMpx{=lC^%nYUbzYaZb(fSI>k%X_AN05fknh?W=lHGrA7+=#nGKY*FH9Ktof
z<6{A4-f|e%Jj+`EGjF+?Ww7T_g(VtzzLg+GcJ&*SQ3@>6_Z#s2*ZlWL{{1kne~$ki
z#lK&V-yh-Mqxtu1d4F`jmVZBp?=SG*WBB(QalN=dmVZBl-+#yZkK^AD<M(Iz_xOlg
z!4p@rz3h2SD{L0%KJw&4ye&vrMb>k=@ACV*=v8X9mg2?sj&@zvwQ3dKM%{Jgms#rS
zESHtnfrgLc#PJ&%7g-Z&(7K8>as24DJJ;-B2Ry88xT{0H%!4a$z?Hwo=&&c!><i02
zYsRfVOkZ57FRJd4%<ZL?c6h2d26|xW*HcO|^<|dgGIxo-*<9=@*iAhi#(bW`*vf1a
zdjcT|m=mN9wGJMqV3rO)vR6$tHKx)XFR{F@#dWOkv%Lc?C6$PyRkW}0bneOTceg;H
zvWV*e<s;}5Yf81Fupca}iCusFuJ1>8bg%={t3Q)JNw`RUhpxVsW7I`+B7BBIK)do}
zN<jIu%C42(8ndaY%7i6(rL%j))XDbx+Dw+p5<|rwn<x8PEUhI_4-p5^-wPN$4ceOb
zNQaEAc>1mIO@+i(V=k<`XEZhSz|zYKN@6SX-F>Ti%r=|3)NW&Yhg);(xj%n0J*S|r
zxpmlGZ8TQX3lQIk`4P@Q>1k<rxGvD7dG(<OysY6K{PN|#>w0DEKWQQk0g~TgwX&g=
zs{^oz+(a=g<;-iS!9WjY2|#D*8f~aBTZh}dBQ{HA!>Vp`ZLOJJRFlzAS;_WxHB>Z3
zM#k8R>>iK3$QBbB*;LWc)l{m}mD20E;=H_)5|qdy%p3-E&jKEfnKV34QFzNDU`hfz
z6pp_hC^W>FOPafvcXhAG%-j-VuvV2KA%`7!GJUbG-_<rW)TVRlzw=T6G2qS<Tuzac
zMBXizK}R9WUgS~<K?B}$1zMisE!ZUEEhm7R=eQKWU0ezrg`{|qx8N?`as^tR;w`v~
zx18XdOOhgkbLvrW?u(pLGx_%`@ck+NJqw)6B2MsCYbCEJ&2Do=Dp(c|cFssoj6@{!
zq|V-8*OluH6`dpA*5M+X(^m9XcA&np(Xb?^IJeMPu6O&on@Vj(Ik|W;GjMtoYy2W`
znoBi>g7QH1&((+TD275{VQacpj`X&TM7Bp(7nju}XVuqx23K~K*3_8IHINiTtv7ZL
zw>y^TZRNh^wvK*J>rit5&lvRzjQUi_r~$pF)*uyYI)79{>+;C<sH$R1wK^ie=)s6)
zjLi17*%s?;mf@zh_C9d(K+8>CBX3k14OIvY@h74Mbq=Hj*EvCnjuyTuhgdS?C&}9-
z5jO!+l?RqkjU3>Ir{@MG*LiFRg*#LW0tK^8h1aBHRT@gFa?-9SGNOETnLRuGiURXU
zTiZxU-r@9YJKL*kG!~R6Hpb+p<?8jhsY_y=N#*&*MxCo9KRrLTDY0@%ZEI_7eno;a
z1`P(#>ouUoXSk+?tl+eG4XEZB4u1isqH8dpXQY=fp90K>MO*{SKLg$uvPH!^UsrB!
zKpd!YhMC<fwVhGbMI<$sl*W5l?rZU^smj#{$=PbpF0hsuYI0H;bKkG48g#de06|nk
zfY*J3O<{#a9mP%$%UbMz(K$2qw_NN&AooTWssYqNwOWckAtx6H6=>T{c%}?pvBo`m
zJ;Xt=Q);iRYcDTd9dFLuGW+(f$kce3cX$&vRcS1DdwOXml}xp{Tr~yGEL)ruUBmvr
zn*Y^i#MOG6<bTx2o94ljAfjK;T_HoJamlYG$&UvbTUov`&cp)`9B4nZ!#VpmKHR*X
zy}kz?NnQy8!h}O+9FP6oGMX`I6Vc~<T>))n#Zf-4Ei^RUH^eydfd;R$q#z$sFn`&t
zuWWL(d7tAWD?_oP4VBsX`Ptd|_02Vo!PJJz$_9BG0RZ|q*XmRBKj;B=Aiv^m*jV3H
zY^+V7_^-0V>{pu3FJd8d4i0wG%T!)&!iyd5_ukmv-`{?tx4*f<bR#w2XsQ5J^uo$r
zgn*+i;Cqt0CEQ?yWk_Qf(ZF53XddGzD`K(h<!3Xq3mZ(PhQjPD`MC>NtlorEw>2ZS
zie)BNE#H>y$SbrL6xa)M9XTjG^<3#Pi*2L^<DEj3;XuUAq`}F*S2YB)sP)SO<;q#a
z3v+AO#SzD_S`k@r*k5pL_MSxI$aAD|UPC`$LUfe&KDcyLd(wpUT52|zhP>FVrlKMf
zy=1@oiF$h$BVC5x5)k=OdlQm^YA9(~k<MIJm|j?B)=dKlcEYSHEGsM2nP-0~;K7-3
z;4wGiKE5{C6`{EW?KfT6H*458_I_q=ZYFkN<SojFZz+G{^0U1}Kj(QPxZi~C+6^Ct
zKZ~?PW7TNI>=oFVX3@q)bvZ>vIr(`7MLDlXn%UXci*j;`bU8VCaepuFFBA6z$7u@o
zl>7g)Xkbwrzdfg@Aa90lmp0J-`kZXIMN-7&82=rNpH5y9$|490gU*i#g3$&FdUEd3
zKUd@K>GAB}@7++3GKx(>$nK*vOvCmyE%mEvHREA0?!b=I%Yc!O5sZ&ua}X{mPnZq|
znynPQ`!QCpd;g)_LQJ1Vnn4ht!H@36V3<jEj-F;i+;$4v>j&63!EIPQmIz9niTF3W
zi@igXS|YHj*sHd-HX9zT^>6-ex3wX^usC9aWRo^?YShEGua9WQUB(K@=*X9{vT$|-
z5!@_1uf~BUqa%wNL;5857BYt7JVspT$U?ym_AO6r&SI@4QLl^j$WOL=;tKVN7VYBf
zI9*yzRnn&1%}M1INeB$(XW&(-jU9@ONlh*<PuiTjDXFSv!&qWjWlG*6gCTKsb@l2*
zW67etlnP7YAt^2)%G7U)%2*uV&u_);-rTON{rj`Ja*b8-i!=Do32+%0_~ID*Idl?m
zKzlH>9ZRog|Ba&Z$G2*}?UNt!$v60L<#AkjSX>!}^~YWsf3d?K9>=x+-s)ppe5~IG
zn%R#l|9~s$d>}t@fdFU9e*b-b^mlfMUbG(5pe#CFX3$hzg$z!O$g?A>fTD@1eD95X
znt2qb4W|VoouSlzlpdhE?Q2Q{L|2*MPhhn@D&_gNM#)dA%<;m%*RK6HQ8=*)omyK$
zdf7^<fWKh%ljWbG=P$iOj}kBr{h)FAWYNTCqt|#6ui)pJlSL<A@XUB#z(4VarOj}v
z6VebeA5<5?AVdC7n&h~N(7^VOlQv8LhqI=@Z_nH@DM9>_1$o@VrpD#lIL7Av8buoF
zyYg-0Y)bshBH|Ej??eBPZ9I-fju0UZ8Ku$s8C$Q}UtRioX|><nYn!nwb5OAW$1-ee
zLdr&XA!X@_r=Kfj=>Ze;j7a4#d%v`(sFYsvsQL-Boy%ddbC0t7>B+^io28*;FN=-H
zQ(A7vvy559kLRvp??A@^)+pi%%KuNKS}WLGWA9vl+ilm2gW7uvpE)se;+ewbNkjYl
zXZj8dVOy3(?7-c(i@USzE~?god|~CBzz$KS3|;KOO$YjB`u7hdEf?J=IAo`RVIjQ@
z2uG2t3OphD#0?+F8=Nlz%3uoM;0_L0z!-X_ak(WbDaz#8vBP7+2g~wClp(Q2CPfx4
zZFcn);e)NRe5<j?c9$K6gzb0PyN$lGvb)M$I!%cOf6It_#+B8DrO&G=h#@nIf=~oT
z3_vknUg^+gM;A1k-Mw+yS_jIXG_EX<$&M+5fOT8&p?qcIRz6m%A*$0uLm9gP00+a?
zW5l>Be+y0w@HTPw*^fEhseDaWC~OUe20v>S`2?qeG6`>>VaPmit}+*V_YzG<Y{eUK
zGHgsMKO_0CE3Z6z<&|s`yHLJCz5!QI?C42xg*eU5@(vxk=g^_RCAel9*AVBU7oDEc
zuGl(sa`sBL1(hJaO5;$x>E~frG@_4t4h64JXNx|BG=m)DQ@xAs5C4^<oS%L@dl$#U
zA<Xi9P!?7QJ|0CPDR!WRpcXnv&&7FY*f`_IL*Dj*<i&}5i;YPh$Du>xJ7RSuSL)L9
z3v!F4TbH!-_j&T_Y?)6xSGcpC?Y?c}$*mKOFWbA)a*V}!O9(HDOa;7D9Ui+T)xf-F
zln@{GE3J$*<@harEXyc<#IJj}l;!X;b+?#YB7QDX&^2cc=qP16>|Vb<uOL5NcV&q#
zcE|XkLk>@pv3PGncJe^GcL)II6&rKXy6i7EPP8VEZ}YV~v)wD4PiNZd@;rV0v{!Ia
z;oVryy=t)}jgn}?-kH3?=euEY7zG~pByYNV{mh2DHYK0^zVxT!V-qvuSVM{P?~j0G
z-a}T3Qe?>}LeRz?Q^$P1V~M!myGQf0<V|;Nm|1`KrYZeb$7d#vAr8SJj^H^e&#;Tg
zVx)8DsBq7U#94ji7f|JLPL)1ZB*g@;#L0AiCHjcKFL;gy^^t-;@EKizuIKmQoV!)Z
zo%<_YN3}kj?2WZOJ-GjM*pde$zDju_S;8G9UyhW!_Vv2hxZLb@nc0c)<tO*0o0IbD
z)6(nm((AIPgw9(dMd40^X7#nC^HzU}a5ByAW&Z$OCvneEIIa`~AkhfD!%g+TclM8v
zA$Em)mQL+UE92wU=hArL-}vb40r2S?c)r-`xof3<Na@uP)A$QJ91vW}A&6k}$Gh}%
z#-Ltb$Gr#P^-^!ho0-=ePvXQpkYNTk%3_zUEssyk&RmzB8yCy&oyx9D&#OyMtIta^
zQ$`+Pf+UH+#Jqd8^S-kWLi)NZ<nz3K_st(AKf)wgr5H#Wvi#@)DOo!H&Yt<%V;B75
z7xMi-du-z`eqs9X!~gpyy=aX}a8E<v9z47&3(s_*cb59I$ESbx818v|!_OWwee}VH
zAJU6x^@a!&`z60e8HKHW`swx0JkL80|J}j+I{wV_(@#HbqEQL6>FgU)oAeUa%Z#U5
zwbI{+Sp3!E@AFbCuDG6k7ZGi;p*BIpMr$^0q;XH9bsVjrTLzDTv6%H*G@(o|W+K}H
z90Z9^JcM1_jB<AS*$de1#0X@KXwJMIauu+oUT4L%N$io&lG!8Uf}!{gn$t_?cCwE(
zg&5O9r$ZR7(*#xP=j%C?u2*&N=U;ewY1Fgtei5a}-uXgTVYc$X=jhMR`3X}z^UVl7
za)`Fmsb+Glcv=IH34`RP8~^&=^rM<M&1bn$ZzBs?+AhB)zxF|7oaDnd+$)dH-OpA^
z|0gVD+yv=9H@jN;hJTpt_OVOPJ`%xZXa8IOTFu#Anrk9s0{zEC`l8~{zjWsAz`cl#
z;{<XoZSVs!Bh_W3ugd3bk7~4<Gu@FtKrasi>L(se%ZZB0&7jZv4<bc}f9KF=<wiyo
zWb@CM0YQhlb=zs@p~Q&J!A9DwEOyOPvyIY|zn*@yqUK@!oNw*}N7LU0Jj&In@FRoQ
zlfgjujXiZXN%N7o?dOENklUG&8F@FrTMFdO2YB8JY<1*jP(P%dYg`)ckRqN=;j~1}
z+RBbJxmHRr7UUT9rS;~@cH^+2aEY<FwC?rdB41QdabB4v5Bup(XQ6>Ug5Tst(5Muj
zGiusrABPTsz4LqU!s#!eijIcUc6kJJ3&WTcjr?NvBO(J|@XE6nMBVb~>=&{&*?V8?
zGEU&1XPJK9ZxK-;GpBO~*;Jo{W=~kpIwuxEp8FTW$!uHXW1lv&i|z;uUdTJX@T7dc
zp0G&Aq0gJg+}zn%tgKtC?3qWgvPMnC?7#R5SNxh}Vk>@cr{5`3hzQI1=RvN4;u(-d
z=4>3cfXxk_ty?_?e6S2R?$}XTBgI8}-OU}~_nOKbGyZd(1JBZ^K5nlo-mq)~1Rrw<
zy|XWI$h?0g$bO<g#?N_(%4m4%2u7BF!Y-3vW5x%_t0r4s?ddw)aXas+Lr`&K?yX4?
z8rcO8#Ey3IbB*NbVioyoVNVx9U~Z8P8s$UmiXz$19$L`rom~cJ;T+d@_BX<P09U;T
z54ZyHKs?oS_A@@S(g(q9XOE&iN3@^$0bi5S*?YzBx6<$1@q0VYVH+cJ=UT+?XKun@
z_?ELv$q&Jv!6%66q23Hy?%{V<(Va*$x(``#@1xy1d(Ye-rRYeUT}S)xaD63WfJRN(
z?5F(tG7ibF=RS$}vuHm9#m#@G{<NC1xixg>*|vysjI@D%IkO2F4b(#={%Rw$=MM0`
zzpubz&;SOylZt6ZM4h#u{kwp15%wre5lwX3$!;$Z^0&kuMS_H^b0r)X9@`MdnIX`~
zNnJSH#%j}aF|kD{2*7{$vtI{dnCXE}?7(>fa-QWk$Kt?DLhRT4udJ2-WLDyx>@M}w
z6X%WCMalyaYZ0-lg0@c*aTAJVC{qzp^pMyW+0Lk|clMcLi={Z^g|c+)1T^r|mXhMK
zvf>g8vy_$4?<HmLl07b82CUx>tQ#ViC^)?*!lAV97OR1Er&Y+E+sRkqNm%C9d?hW)
z3S0OJKZ139Q)#D_HEJxhvREeztvLF85^<+SPD>TDZ{rulqkcgve?fqoD$X3@cUH{8
z&c*NEW6%vW3bIST225}cCFzK&sTom-DbIcynSAEM$mH2IAA3KhnSSW=-6wr*b^|h?
z&)f}e)PNhseH7Xt4B}Nne-Yt1b9eOE={v>iY%W5c^0(O8-d@?)+xsg1kl#84xQUC(
zIowq;>=3|J`T)&`+Lwm4mpw=AqnPK9L_4R@Xie4c(SGJLv?KQcn5jCmhtIQ0<*8Qz
zuRMU?vA2atXdL7R@?ed2vMD&YUw}@Jq%V$?OgOChqq8rZhajIVj>}v`IC}Ryga;^Z
zMHF_CW)YyYDNxz~<w?xi_9|vE`%Z)h*~6QOVt`Vu#zqnl?awID7u*Ml@F0A|Cd^SY
z`y0idC7D=_xWl~YA2c0uEOlBn`p4$St7gxH!~nfUwoX1;#E!{RTvAd@P~!^*w9XZh
zkDnXjBA5ha5KNt40H)8=RtPr-!b<aD{k>dNBt^{rI|!>sRc46blQJtCp-7h%pR(;H
zXM={cS^2rM_zjfry*%c0y9j;VUffh7MM(pWdnxwCXT)R7ist#RSXN@t^8x;fd{Gg5
zP;L(ZEY%@Oy#PFFY%6m1H{dJsYbm;Eg`|i$pNxu{xAODjzRVILxJZbdy+3T_!z01$
zyQ(0QUsQ$L<>vqz0r<dGhXEh$?vxV+Iv_V-f51Q|l>k><U-Dld`}K;A+op1sL`9jf
z1(Y2XRhlzf@;RV|?+`_u3lv|kGmvR-W7oYtqT^f&<k^!!g~TJM-0Y^z$*^d7xN@7f
zo_98F?&#XwSUJ?-ukm#H+S-@Nr`6Cpv5s_rp2U_;Zz_}wRmYHe-85Dgx%PqX77yq&
z5Nwxi1-VO#ik2)X1YZ9JsZ38eDdW{ku<r9|j>q=r#rKKJRZh=BtUn4bIXeuOAD&|Z
zd5xltApXUNMIW+sd{E&H?gr2&><G|5$mlZ^3M2R$`Lo13U={SA3nO_{1gH8plqU5K
zA(hm>v^S9jbB<tE|DJg~40e{N03Y}eBwDXg{-^S*@`2BXB^Js5Wb;0TPA+_cA(P}2
zjX7Pf%#-Ff2;XTHPUufjZTtD_q0Vvs-_M)#=gnQk!RhI694uCGaL$J?WW1*$W8MdW
zip53pd(24-&KCMOA3^6LX&#~kRd8tqz9VU%#jcc5L|wQw@n2+sQg!ppzrrRPoDqS|
ze(v*q=JP$JLKk2hED_`oBApmHk7o&_aXwgZ9}Kn$am8~D;oD!zR+vTl?Cf%kwU*VY
z+h8=@-+S2Z8N>i~%-xE8!PbZ>s-P3~d84S2<-o=eANK67^9&og!{RRLIy8#fzBQ|x
zKWke6gk1m5mis1e-<ma?G<=}{zTQiRk_jr<2LFP-wQ+x`i7Xz(F##R+z30x{68z;1
zf?{NK;EK!DE8tV5z&d<CV8um{?WWpq^3$5a*(&L`XN`O#?>=t+&3?+gG{o0Vp8w9X
zLs7>+dpOE_`UeZ#$>dDj`7*{#1`ZjjJi*>n{R#YtTRc*;JixePp!@&HdlUG!ifeyd
zb7fh!6FZh=S>A0~mgU%z7s;}`$h+e;u@z@?l-+R_C&7?}5Vo{H*xH6Y1WHnx7ATOG
zJ<ygV^brb%QsAXPTDG#4(o)tES`zE}_dRp(m9D%b;l1~Jzt89Yw=L;fckaxYGiT16
zZO$Z#S>kcXiuZ^g4;~HN6pJlE(_;S??1m%=eUPup1=_lYNmi=k8gUdPL8<<bWUB5J
zMdOHTwP%gKqs=|>R}NqB?FnE?vgxQ1HQgv-_QVLsAIC7HwYn>@6pL$d{}$Yj;XT1l
zcDo*5!mCLYzG+So-{exRHm<dG^y|p-dca|(I2JGYLG!V*DSxHpE&aN+RU5}WB%^tt
zx636P8)gx7W{YVwPq-`~TsGLP)sKDyTYm6^u#F#OOu-MLs>sL>iI*hhYvtKUwh!*F
zr7{zvFb3II;&k@a=%*3(3|ZuNMp!Dq{YMibYNmWL7D@i6+P!#9-b%0srvqlNznm+5
z9N#}#YmlGuH@-~<pZrzux|TwI*XXn!Y{O#gywTCMU}V`_*^TET&45!Zhn;&6G+%@<
ziAJ0Y=!>@V;E#W>ZQ^Il;1%Cv+3lgLVfMHixd)1{b5*%OEkxa)p%%$%VWCiZ0~RcU
zn|+4!zk0>@S=N0n7e?1PdT*TeEZD5K0=_pS_{?b0Xwq)QMy`+6j*f0cjMN{*GtL(`
zVsavfuVg3T@R_XyoC%aeAMbnd#Cu+55H~AV!|XNecx`cut?~tG7(xxdQecB_YJeTY
zU<Y*!u`B@AyWchJ)b=??=UYMM*Ft+h<VY+cM}96xj=-y}L=!=efD;}3dKoN)N!oRY
z54D54!CQo`A})bmvfj?Ua(dV&k!4U7(!k?&tq(0+=xg(}&Q3447FOjfnC)w;xv-(L
zv*E&XYFe6Ww$o9K*c`t*ad}5!eR140S9hs@eZqCScD>b7<LmCJ_ju~jFFHeNn(!c?
z0X6B+A3HPya<7vsGZa%w#!~K$VFq8CbgJTnY}~uF^`lQ+f~=l<LKzfqs&B2S=wC}C
zP^{UE?2;EC9>_(OUmgc+N0Lj)Uxm;YYS4@b7s(}NwvFF<_1U5nZ+4E?yr6zwq9G}9
zVMD*UGP|K{e%-toiG~>q#4%fKUS6%u=CfLTn-?X_n31rce!jUTC$~BkWfKx|P%^bD
zC#O1fL8H}IP(bDA9X;;=4idF%v3eHstaXT&wj&n8Y>>8>AbttsVMbOLy9uc|c{mQ#
zSO~AB0{Jk>L1kRNQ3%vlW^~V8J>NHPkOj(}g`NJP{_@IF$8?{gywSI7XUx#T@_Ids
zjxlfQ^skS(bZ5-^zS3I#zvIorU45HkcfJziD|0j@M0K%vePwY)do1_~@&n$_bDq$?
z)<W7<PBBNaXBK(<xVeo&aP?pS6ils%)X6F2d_gk5l`H18`sKvH{;%2XuT<67S0TA(
zEpxbrm(N@=O!-OQ3=U9!;7k1em)q*I>)TozvvJ(nqhM)TjS<l&(g~1y&?)(JvIK0{
zBQgnXfs`}eP@YOTe#FT9;{D9hyvpNQ)jaMzFLp~)(_mAR_?wfQ2C1Ajn5og2$k9W)
z@JWS`lcbs;;$at3v~|c+zkmPS&Y%1wH}~Cll_Lg=`krp?^k-)u?h{|5!v%py7kW_u
z?ZnJ2Pmt~9h%pM(=VQnLM|c&mW}_FBDH)gQy^}1zc5!*0#l5C4C8HLnlq_Zy%f;VI
zj9mP>&y-nJUe&aixtBHi7M0qv-EoB-W!5TlzAw?4YI8M|S1l}K(QR$lx3%TAB^9S4
z2n7jRi>)nXd7g|CnkSS;hB9MGCx;>W6nmD*i!WR9tUUV#_ICp#Wa1n4<LA%Kt12s3
zHDC7OhnH2iv{YZV*T2Bex`2$jW$p$3z3kf7>grb1jRgw&!v|7E5jVxbAS<#w)j56h
z$hmBs<$wqV5D(DMo$9hCXJsYh1T+jHb^v;78tH$lJC$vLQ*iyD(NmpP+)z<gT~IyG
z>0E%Fp4Fb5QirRhthm#Y;AiDhoDyt5lx3gdg)AP#2=f>1W5BtQCOv;K&HecK0~7y1
zpT8{YE*r$__1@m6<ja>pjaJk{aaSZ~q^M-w$P*XgbQg2+dS89)B1`D*-h-p;CpmhN
zG8@kZAC&5~fjThfwe&hUHxvSaK;abp@ZjT*3ojo!6nuSBmPlM@Hn`5EyeDp~<V4YU
z!9S(ik`l4QO`c^Gt|6@tOo#RZ#ce~?fu6?tu2RRDvwD%MwSGlqpcUIRi|t!F=X%#@
zFFh3O894wj>SlG+IGU#CB(H0$>8EX;u7(CzVfD1!<TGbO3I=MiFZTd!Vby>N>j6m>
zHqLCa;VA=i;W;w%O0+~MrZ)D1SkX~qbLC}ZC!13jwAV_PDQOT}pKYscPq*9CGc(%S
zYC7aA)S88PSPPpf*;X)?I89b&X35bO)wOKW=2qcBcpxo!u`}h1zbRkbpO=+wwPt7K
zDW77Saz%Z)b?iBK(w9L}0^d@_eaYb?<_Y@3T}###6|GycX@|$N<F1Y0@p!(oQToQ~
zH1?j^oZNh-KgpT2WT!v5_tJpT7`U`I*}roMzVh>%y+&HqH5wN<_FlvZ#89Mw$G|{v
zdas=s^bE#o@ekj;`YQYCHJ30%;!yA=X8h^XPl*?@%MWv@LGwAJhU+D%L313OOQRV?
zeJZOtXY5npimc|xk$L*x;|x!iv*ohY9CmUtGeua<AxZ6p<@Z^%0uL!Tqmr{u_KfmP
z?I8kS<*j{vt*w0lONO+KJ<u1|*UA#;+d>z8CB9AXuEN$n;G<158x(abuJp85SfZ&@
z($$o-HJe+qADooD(2qjQsxr)DU|x!TBCnU*RM-?a5@<Tur}d3KO|L#oI1Ri^Y%xEZ
zlFmvsj0L2lL~sXtO9UVCqMA^Qq72DF3|@`!Tr37&!PmOhI|!4K|J+%Epl!Rr&t8sM
z{nMd9VCbi-V*;_uZXOu8d08wd@W+}%?APp%yzdmvVFn$53LutUHGls6L(<254h!BE
zbN<6~D~<)^{Q%^a$En<q8FN7ih>}IQH)KAg;X9xK`3{!aCVu1#>|#%e^$`28l|j(#
z(i}j{)8By!@)M}&g+v9!)l0FN&ma_Pz7mXyc}s0rHErOr-v@s!;_`+p4?-N5w;Utw
zHN-?NhJa&9JAf(ZF}3SVpYO~rl89YhGXvc$>#M59#;ULWP6>tn-saoXG1$4$*M@k~
z!8yy?_SRJvR@Sv;n6u3p2np1}pOz*J2s<a^4Tw(-@d@>HU9R1pn_E!uvi$jy{K@`h
z&%xKZIrh&cTwr{uhc)OS#u@U|xc;G^km*v;Nfui_)X*?gkDUuI*&A)pSXyk2c2?e2
zy}JI|`qkBbe3|Xf#&^IQ)7+tX1iMz>qcu*E(q#1Dg8~kKqV&p!hRWM+%gO)n!~C4v
z9%-m-u557T=NO6%Ir&b|$%mRWwl$1{h;dWl0M_0RKA2PPbndv%lOh4|!efKIxguJn
z+=+&B*?NW)1VjNhVQ1~rTr1Fr*VvnwQ~U$mM(0;m-BneErxsvlYlRL@-I#BjFYy(_
zVp@Pu<38!7@;{+wr)DeU0E-l>MciK%bZlj^Pm>lpBCBIdHw9|l!|vJuvJpMMY3Z=?
zKif_lr^{#dEEPxjvDmnlc<&H+CGA@v4<nD$Q&Wq2Rbk5yjN_3M#`J4tDlms~MI%eY
z`<291+>-8xoD~)Wq%3l#BW1<yeN5<kuaEW+g)>NL;lI@wEn4gqf&Ku;m(j((dg6lF
zL-B?v93QlXCMr@5t*GcXn-^EG{q(FK8I)s$mjQhtMnzhCg%Int=E>;*>>=w7yutqV
zT5DN>H6<ktYp}K4mTyW)^Gl{2$;X>q+n$=6nwF9ox;P~HaT8+5k4rtYY91CU*q>>o
zgajhd7Ks_MpegNgvLbc{IuQ*GsQH1G?yeTk9AnC~!nE8xYi?^-XRFtrWRA0?=2)${
z5BIdSBj-<DR&H@&K~d|R_V(VIisp<g2mV8gINxQnaF>veRY7C(k_FeIXWxAyc=q2K
zpAdHaZS&#J4}XqvjMIE9w6eQ77sH5#V1tZm!w~2sIhX@9ROs~<&aA9t4~iSvjUu4P
zNyY19{^iU<Z&%T5{sq3I9*;qz{|mT3D3`Bz{D=q4&|meh3X~x<dr`0U=~15)hwYSC
z3e0RH(!78=Nhg6)!c)c(atvb$#l^$Jj-rG>b7MmbPCbsvcO?6homR?($pbgw^_A9~
zzrc<_^Mx{}N({m<wyGaavoi4&?bE%B5I{ES11%_$gg~Vc>&Nsqh!Qrl&h_f6LO~u*
z0DBb@#Waif@7o|j%r5v^{Dg#xFY`a={hM-iqn>|-o?~sHY=Umn7$TaZHk|m7b1_;K
zDW(K>u_{6+9XqyHd?jjw|HOxYsR=}CJ~e&XY#y6Q2Q>nOuWJHTR=XTBeb$saL7#}u
zCjRie6o|koXVkWvGEHeI=Fr8Vqk~67(FU|Suoz*0?FKF;NRG5~3b^FbqWXHu)geY%
z6vlsIgqp_wfgbV`7>s;7ICwV<Fr<h<;(heVC;Oj#@=>9n?Op%j!~S<^&T8O4?nlhY
zbh7u^Xpbb1lf%r^ssCXKM+}y@IE&#3>k8f#zHXYgXF3={^0aFfzSHx8`kx7P6IP+F
z5?0MR^*=Zt?Ge^>Br%WIFMg^1ujzxHcNShVEjcR6Fn!NF^*@+j$(Ua~;rT`DmV!xA
zgDH&}#m3QuXP?OvEI7(;Y@0Z{it<9!OOSIdksOA}X5;9S&cZ|*by^8guQYkUQ*b!d
zx#t$1d+u@9+%8wwT-W;5m8;h;IIrM5{0Wx@Kkb@3w@XM0e!6Pix>b^#;DVfRD_=v3
z`C3ar)A;k?dze88Xo8x+PKn&#-hb8HxmWcs-ZgjbuEkyFw6>npCB3KS=BDE13f)9O
zSLiOvyuk0H3}^(c3KTy<t0Nspj90NB1jGlq*d|;Vq@`6|3bPD_+=k)+>!C8|q6}Xv
zoEksYL*jIasEZ^s^@(#%EXan3&VOj>HlmQEX<LLly1Rov=k|ui+=j%&hFtMCs+ORD
zAg3U>3UMSP$(EK;L-DpVYtGyj=xD8M?O@`@&6_uh0ux(1I$E*ZhvCH2NJcnebc&@1
z1H2MsO%&)sk`$;SvaPhi8lHss3d#15g_w3C(P>NEkizL{GX3#fHnTxIx|t;XDW&~E
zvZmgD5|JMk0oa~vz^}BJeOXf5463ABsH1H{Zf>$&D}}^dExt5sT}{opStQxDbau9|
z^5DOP816Vgj{nt7j^=^NzK-U?<__^g=n7g*Hd>)LI8`f%ULu_sNX9}$v`2OmD_P;C
zR<35{RJHgLE0-EWIx3|JsqVhYfo4b3>dFzEb%(h=krvbmfQc5K4pYLCheEXQo7{SX
zp+1*2iZlj@qlQ%WGOp;91PyUwvgBwDGULDr1F~c``|lF>B~BYG^ZQu?Gj55UE(i%R
zc)D%uX?avFbUG}JDH)60uF1wyKjj^Hlqa<lESU6LpSEN4SM0}=X?Vvb`x2P50@fN%
zf#5bW^$`~!DUGuN^$1B2?PleL4K}fbJz;Aoq%mq(-+({f_$4aAUKaIfd?vI4X+%wC
zJO`AbJ4mhcO|C#ltxTpxXemkx9D!oPjAS7}mVNE1<m77+Dwd<j#^YsWiXEF=UKWtc
z=uw`_h;ttaZ;DqCtJk^A)F6I5pq3=tw7H}2ToEBWg5oeYaFPe7xa1K2G5aIxqRBqM
zRRUG?;js4n(aVSX`ksua5<F!AMpP^OiPy<BSc(25t0eK2U5qt|NTv|dGkjXp=*L1;
zDA<igY(oDc<PxcWY<8q1B6TrB_y82+`Uow+#CKHEBCN<cr1Wg#Ol^FfeSN&6%n?zo
zns<f!D7n43H*XE+R#ysUBGcgC1hdSb*gJjV(|t162va4b55m$os+5=?29pM$Z#>)M
zlz1?L<8fY;4g7ofn98++pHIT=q*{MCp3_OSMlv~C5t}qCAX|Azo>j{POv9zB6^BWr
zIt)+Q_&rrank(6-LIRhA?OxbXU`a9S?fcwUUFE*|I`?%~S6p>v#Z_0kuez?{x~nR#
z#&`|FIP#S+fGe&E(#lFE3q`h3Yl4I9+L7@)Rqfr~cPI*=xKX(xijt#*iM#Ukn)tn}
z?aHoOPA#C`(26MYPRT<nVN99`_i{YZxoPme5`GpylGJiZ5_U4x>{+0mgK`XRSa(xB
z6+z!Jrw_^4O%c>beNk2ltP@1h5i?fmlxnW}{o}O8Now$npAQj2K5B>nfl~zO6Ezqm
zK)`(+Ffx<5#BFMmWo=o~ZUbGkVdq&AxMM+79!6M?cg@(DsAW*|YxWiU0qHE@4d@B`
zvG`kd?XNHKAHm%=&2b@#JxkJocgl6DZPK-9Y|;e>b^6(S9(6++zFK1QKQ#Y=xo5@1
zYoiikx3c-{a`Aj7B-`TRY{?>7TCAG=f`@$rSR5Lkq|Zu3X?F7zog_q%nr%%G>@L_E
z?OgbV{G!ahJY)-iUjDP%j@fnYHiK4|<<76|=&q;hsBBkeR=z2Y<)k=r>~@w$Ca_E!
zeKF0lzpJjhuFGAP;>?w=OeMKKb8cqz{EC@*-Lx?qZ~XuCbZ(8)K+2YO)nOgtcCwR5
z*%VvB9BS#hVRcQ-YGm8P`=8j~+C_7OZ0+|AH8ta`m-Wp}L%vJ6%@SvT!gfw4oCB*~
zHCBCU85l+s#7%_7UyO$OIkn96nOa_==hUJSo>S!b{}*yI1MSWR?NgQv#m7maJ2$8*
zzD>!qDf=~rM())N{s;LqF&kW%zjR`6v;Y$_dZV^|!(9sH6*_>`Fx)1@v;{^EYJGiu
zlJy&9y=a?ax4?<b9!3J9g&`lQml?%R5GnFKmL&dzop-R0ZDZT|`otfIKcHN&<elu~
zG=cNQp%TNcrFTo2huQS+o_XKum}o>j=wtWKe+67kydcj#ZCZszsFrjcex@Cs&LX_S
z<|0{;5oSQgts?=3y9~ZZ(0`;K8%JF)cdc5~I)^1Bl=lRRt|)G7EIw<XroOJWroKL|
zVr7ee;H>7_<h06xzItOuWzV{Xk-@G0wkCh`EW9-l-;mGp1g0(mrUcDipo`+xITz<K
zKG4nB>VWvRq`;8{{bc@uv9T+KV%c^CFA{08P|1bjWtVpb+{>HJH4pD!C43r8>e(?5
ztd-Y<@*RY2viel=+y#cQ&dZk}`2cK1pHhrjKT;O-1e0iFWzPimpkR#gyb}@U<f-7J
z1-~sd7#;1z!-0+~&h1Z}x1)!eTeY7y)oUbc6>p7^639IlCbpPBTXsbUwbz3j2mR*Z
z9}i$4G>9w`x^QY6#S>GMel2)0W;0pEJO$jWGHy_!Q(%`yDq6Z{9(OM}C4qg}B_^=7
zjooZ^BQk6>!bg{rWo1_JIKE=t_zrL6xWkJkzOJ*riE@DAZI(5sDJMT4Z&rrvq{`Q=
z^bP+yUlToc0`P8;;VtIT##qU$fEYm|VDJ*hj7~8VjC{f8!6jTjBi0%n4U2%P9QtA(
z*B8mg39hSSkF<zgEZ3aDGR@{pmT7d=vfA>35<y#PbJf(ia1~X0Y3R1N+uO)klh@nC
z8mrQCSay1P4o-aw7L-|Ys;CE5IaW`jx2meK0B(!MswywP@PzNOE9*T?o_hXPo0Har
zv-i?*ekF~oWUpUCR6u#Dc&rdsN~XW&nyzcExuNm;>l<&Na{F01c58G}Im(6@Di<|4
z=pP(p<wI>l_@k0ujTfs}KQs-E4VGmbDUK)~EHLEhV)w?ZzHMmeHkC)qJ8KR1d-a~v
z0>4-Lh4W}GA(jGlyb9`pb(EwCqz;Iz$;)0?FrhBL|KP;hqQIBF7INW}kgR;A08%Bj
zsjn?le9vCwXJ?g^h&Ra>%rfDdrOy0(C%wd5lq=<vtyQi_3n34O)(rem+z4#rMjneo
zb`{!OMQgPcaRQR1LoHv9b*5%zrCxr8yROb{d{<IZ{+47iCE+Dl7G$NSW_fE|rBzn3
zm>V~~pPXng8V!lbH2dWoR`B^1b8dyz7v8G7fMLkuTuzJBJ7o#qCB#fLYxMPvj1%sq
z7!yxKeUr-e*<`sMFWIBMabi7L^1Fq**c-GH0m8YPa&em}hAQ$BQSzWJI&y^qg+rJA
zAOCp6jw=m?@%ps*MH_acDp&jVZCDhS9vfe1NZp}aUAd!sWMscqh>cE5JVW^$85xdG
z)5kLHe&v%Wdn;_*3df|elFg0#$;uvBN$F3>y5GBq%7WW+ZVvh-ep%_pesY<oOUrRI
zG0&EU#^wMw@)s8;;E9-~9^ITK!jaVpL%$=RTIDu(DG#Y+e&b|<r{Pg>E?!CYeRvcW
z^<v&A*8Lcorv|SMrhT2=rZecRSV9pdApR?l=~>QeLci^wQk=jS*3X|pn1FhH(0;|&
z2gG0U-a`K6S(e;v@iEH!5ru8skd9@ja2NdpHUQ7wW3cI`Q{E*av3~FXz7|qu3x?H2
z=nvi%V6oU|_b<96E1%@;`%hj@%IAr)r2VLMDO$QE2ArHCYeh#Zo0}`?CFi_n`JCd}
zPw4n}dU-6FnRz&$*8)J0UF!(4Ydyv1Klh?48k@Ri=8$u3d8|&S6|W;o&aFcJFTSFA
zB+LC+MWH7E50JMZ^O#9<BWo;~ZGG$=c>M)4as&QWtc@%KTPPO|d;#VN;6M<wSj&D(
zn?&F*)no%_=KxB6t|L?R8oO-`HrN`OL$)Z3{{RMG=Q3-OVnY6kkP3NJT^HdWlwjl|
zAk~39C1OSBY1)=OsyrBmft~~9dgOMEb`KO}9K2vA71?T69-lVzz4v0u-}>v!q|ZK!
zFZvkpa|nWePbhougW@;-YE1j=6Za>ozEQnc7ee)_RuZMo7vFlT|E;$|RsHj0|GV${
zKL!@9ngBRf4Pn|V+cT_^6(b<oE-=yxSL3}_N)bKDCCT0~qOx?5^cg^00<V>Pe-wf%
zcrbEs%M0c}AM;6;3yd;xH>qB!n1SlemJ0HEsj!&KEhv=H?RC)H%g8Q6UN*PajMN_X
z_p|3L$;w(XC%g0Y)s@SZA=-n_f%(wS8~GgI78^cVs2f@*f5|kjSXhN9pHKAreAn_n
zqCu<XTwtc3B1^bN1p$Rl5l3W&%*9#kcoWUJ;}|$<@nhY#Nb5FbkTa3+oGpNF!8hbr
z;!gsx1GIh*#Cqpl*sc|XmUDWM2Y=AJW)_Dd6aj&VoGERk*2%4;ZIc*CAqj+Z3Ik~s
zMp_sxMlCQyc`l6J<Hw;{9K`!<v8^c>Y#Kf2V!PQMSBW?vZYn8ZH&aS}z?Kahc_bWh
z*e2N6v&XMW=Z;&G#&I?BzL1K82%kHN*9GqqVqkC?SBeo$AqJ1%?++0BqvFJsXs18<
zM9G?@*q4d?=-1G~t#sAlSO9LN8xBVVOo)0@%Q0&186nd+#z(s;;cx7ICFD(PQ?8Ux
zK-i=yfL3`X<P|S=Pbn6UNn;3zw}NcQt|v$K;S>iDqFu6*Ome5G%~w!eQk;rV1G*|L
zHp^G1@m=wZ`c8x)q?)or7e_-^p^Hhrq7jgFU04RlR;AYQiON2EV#x*Z#wcA<{P{}{
zJ&Ta7*F{4`fJaq)j<a8%o;@3!c6@x1dK5_4QC1rDwSWxFJiti&Lb>={zBqYw%{bb^
zT4J?hHjD)VV-kG@@8T3Ftx1nd{i3sO<VX>>mRMGV{Q?U4y(5t}j1klkgMKB$Qgab#
zQ#viA1^ea}Yu23FX5;<uWulC*_NaWRzx{7zs7#*H1Do_ekh_woAdD@nL7WSp#I8kt
z%t*VIs;4gsWmALuCfRhO#<d3>;#4hay%uB!MKsJ*`27PU^W@+M*+Nb7)UC5hXjlZn
zx9>5-UYe=e9%j`Q;!{&MTf$z+6m9>NR!@fKg{*PvCOMuXdkMYiR9Hs3)sP=y%HD2p
zKX7l^gZETDc%SE<sR78Yc;LRu2kt3-@Lu=5QqRe9x=EgobQ;<JTztZmlOr6SFmA+8
z0~gqN6t)sfHS*bCe9`~K7gJ*)?U?@<{;+-{at$%KA5exXhHx=DI1zG*-ec1VWd{>e
zkj*MN;Sr`qs_`H0Psr2<_XrzeGpGM_<9mpvVc2{93Aaq*X`|O-&_f~fB9{~N#@W5>
z;(0oqcw;pij>}ILe$XpkFps4t=1miK<10PIG9<%-+ylQ4o~A7vs{B<f?$+s<)5R)w
zczRmgtwV3T>3S~FB=~j7@z0BY6aUIvhJL_4p=Z5t=$o0BVdM;EgJm|Gk(?hVUSG{N
z>U8tO@Ae9MHe4<4o|c!$(&vd65Zr~ZTu|gO_1c8s92n^-x(YA|W#S1j_((!>lwU|m
zWKA31eQ)DWr)S0r8-jacGAO4otpYQpmTh{A!3*o29<valp)kEy{4P4pHdc$*PqQZX
z_Oi?7i65fRY!klWeU3w)Tjf4eUTSjmW355^tY`h3Zw%cUmo}Xp7OT*G7fWO2=i`%g
zew;T)Q2T&w9MjIB2B9LxjB<KoXPZTsE`E`0oksn<5uHXRn;!^zLcu2VTKsSxyA01m
z_je(RZ-6Wlv~-z6?Q{KKPH&cnmTy%c5#nV0ucz@qQbkkZa|%?-V9>}&I9(`|VUGlA
z_euzr3CYCi3b^$mEiqwMAt|CSAo-wpqKe~KTO*U!1|qf5XMpeh8#tZC!4uQNo{;uA
za7hSz9FRHD<2IYD9zDD;@;-;S*)>*2mdR|$%3QGP_ig?;?)E%KW=d*Oa?Ty)b=_u*
z#cWyG({}VHE1T##H=R!Gh=ZrI2R<jTLN7Ej?8%2Whf7;-m_<yKGJwZ&CJ0um`Kp~e
zm)~4r$j&Ry$tljuHniV7bl!REhqLpGGc!!4jEtGq_~8}TwOw~dZgDRD?!e{QxifR|
zcQ#>3X$w-f*KCzqqj*Xji)OVCU9x=V&J{Z^zIfG@EKWRj<;sgc-i7CP?b_wvwQJnd
zHnPk>q$R_R1SR|I;)_>aDIQ~SSFXDFV$`#9`N#Z8szd!W%^A6EiscM9j7_BL_w8G^
zLvHn<hj*zUrddiU3D6id3bbIW=h%*Q`}VEh!8CGn4?na^X>AxyA^{NXGKE!>pIc+b
z!K`l6@b%a4YrEz8>-}uQrE7lh{k1#An<#&-f*F+eqLkbQ641o;u^V{xmxyPqVC#7U
zK!=o-R&If!{|wli1dN&u)?s$x_1E9hw(t7ug#y2L)6TWu|G}C|*#?qLHQ3#aQwJe?
zC!s&kAaoGj$@+z!5epJp7c2-q&KBuR)7Grozkk)*nB*Ao?n~IU`-SBA9U~(b#U){z
z2SGaw-u1dBmuLn^1g-NZQ;KCH8<rH_W<{W{*?a)?tcgp}{mwPJsA#q;JA2OAO-*Od
z`5mfWJ3KP7BR*NkZ!IZlvH20d-nPCfDk<)wac$T*bg+m^s}pxT@qjtETLPcm%R&9!
z>}^d=+h%8HOHKVw>c%iZUA4Xq0WN-9OG!y<KJN^*F^0_SUuoN=_);35v15l1YEOLH
z^u*|P4#U`=(9b@e4VIIeOmikZD1iN7K+IzA56JJU@MGWZ-+s1#`;ON0ceL)%2xDJE
z&m7?O!(O5@PzzR~1p_<d*x?TkA5+@We(#B<Pe*lt2<`#seVd7H5NnJKW|RVuk{UAo
z2Jsqpe?x=lXPY++ee_rB6||%73QAqbTWUs2b?6CNVs4@a#4my#*cmRg<2rU&TQ|BL
zt!Ph->d-&xow_Z~4KWXqDir>;xs=~=1KTY68yb+3<{B%dDCF&dioi*&;G_g2tS(++
z;~YXvNVA;)*5AaRE+Qy5Y!F}Da5uXPaQ8Pz)o_rnxZ)_FCu^Mog$`B?etLn8k|S$j
zr_eJG<V%va^dEhMy3qe;eTZAR(Ir;1Z+K<Y`vpBcY++B&&wF}6;mH87Rht4W1+c+}
zNOo_sky@G2t|#qUXx(ecxFo}}m!<yZ$tTa+2StAo+53>0wOst_rI$ntV#{f!(B7y`
zQay+OK^>%a;Ve#_*KQ&l**~VoKE_igo_!Vv)aScyw`823VYyv=|FOp&-Ly}lpRd7N
z7ZQD8oz>Y)tXTXraG4eN_0TuRhe-ZG_B8TclMM@Fu7!GQ!3<(JJjt$)JIH=@@L=%O
zW5-tP*&}=(2!nkTX-<FrYd#0h1#M>1-a=`9kii<n5;keGTW?&5h09nl4axMH(hH(>
zsfmlOyZ_wvGcseMn0A;6QMxqa&=G=EhrL@p*i|J-{hkUWI+RS{vZf!ZR?<FUvWsTh
z%y|hhsMc6$5Rau<t!Yf3UNk+<nrw*AGiMp@y(e)n&y2HJv+Yr6F4t_%6@;i*tI3#{
zY|c&l{Yz%viy^dIjQ#jhJOl{#8u0>l*^@(u+78L9-&7?I3?HBpV}FEI{~~yifC+^g
z(Lpa5B!~&LA=-TBOE0dwoNV+n6KTI?;!LvPe-BwA?wFpgj};*2vDoPJ8MlwCjmu>d
z(5h$Mye{+_J2xdS!1sn;da;{V#<YGi`=c`0b!CqOU_-2F1Z?3^l2|WqMFID_Dsb0_
z8<4tyW^bO*fl!k&4B`IZ?4ehL{;~5wVRANT@s&I7pxIB~!-7TM!y=2g>{nnIdL(q`
zaKxR@keO6|hOJlM5q1YRDR=mJ@uAwZ)uYdb?$Eyd@SV3u^OQT<Md~|IJ5THg-5FKi
z(G?#5Bi&)^g?{*#L$%?583OI1&>ip$TrX1ksp(dpa2vYit#eW<nmyq=dm`_Qgzt<*
z++hyoj>SN;QGpEj+pfB^J>t$&syk1q@8C>?aBt$3J5;aI8-~&0`!VH~1e6Nj14oOG
z>=Vj{Mu^wL@gvnJ-3iyI;0_zAB6=0Zs@xVh7*R<WlHewcJNRS>7Ff_xB2AErNEHM(
z@di{Q8mforje5)L!MPFPb_hC-+2@4;e7jrNO(Rde3in#w$apAt?_@}Wck$<d0T~pT
zhJo`CBoc1rcDy(TCsA&P?DFI_k#^!!#v&!(mO8JMI`7j)&6%35n(dkkG~d<i)LfzY
zf#w=y$-W6u96#3Frnyt|bIpC4hcv&`Jf?Y4b6E4N=69NxG=I<>)w}_^CeDu+_kqiw
z*cbZ$iSL9=U+@E;^7FrWsr`-8s?T@s|LP^38ljpS|9h15XU+SXziK|#e5U!Q=3kl<
znlacf^lTcN!HiJUGguBKB4Wj?lmc*BEkfyASUZkm>1FfSBDRFBV5`|WhO;f$R<@m8
zz`o0NvMX?I*EQ@0b`#r+B<i=ZJK4{XYyTnkONnlYcIliN<iFrA^|kUHl~Jz8f1d1~
zQucJpP}%=Kl{;BqC%dN}7n+lI@fmTDzl*QP(?eV;U-;CMRw>Ny$q%0Xb$IfJYM0xi
z#%YqCNLEeI&qEOK3x?p!i9hU}iQg&T2>r^{q@Tj>NxxRU{C|4;B#=+u<MG%DA&+EE
znFH0q*EUPjshOjhi|B~Onq`_*@VX3X&d_YuY}1^Fz4{kxF4KHZa~00+xKZ;%&5txc
z!5;CuHTP&9&^)a9wdM)Ue`tQIc~0|t&3|fM#hFTPVXcQ97K+Mgy&_jNvWM8@2hI3I
zOr@1R>7`X&)Bo)M^8f1g6ga3;3MowfDdy7mSWiNKKzis}y!n6fA9c-W0$zG$qS8N;
z{2c!yeR)v+We(-y_W#m_@;J>?(vH4{UM%fsoZz>J@J&QSP?LQk^c?N7R4h4D?1PM`
zNxk<mqSlB#k7Sql-)$p*ihdLcR-e`*@93P+6X)8+soX6$p(`_*=XRw^+c+cog21Tp
z_+mAJyP|^Hh^Sw@t$lHG9%_%Mn^hKE?QcDY`&yK-%OPv;_*%#BMuj(lVm7DpvXry(
zv51Bu#$yJOb{*#)U#ZP$u%Xdz=u%|et);BH+6u2(N=c?KFnd$X`T}hwzR`Q(>Bm15
z8mrfO`L=$1ZOt=Al%d!yyBA@N`nb5VDEySg*&Wupw62*myVB~c*V`NpTYO?(Qj*0G
zA8)WECFLc?<GcG%0LAL8j+tF6rN`pf`fyR(S$NnnlU>4#-7VK0{G;52kcQ{d>cnNd
zrQe0?wT;6rqCroEUB358<;|TE&t2Zd9?xQL^<uYY@znTkKoJylFRsQr_vMDix|DWB
zep`6PQ^RS&=Phov+gpqI`)R^js+6av$VMGLwGy#nfI1ZIaMHNC&{>w@xVjLx`Y~Ax
zY_S4V;OAK-t90SbD?S&RWpp3fD@wq&2WPfaN__sKk3N!%e)Q4bD4I^@Fj9HgSt(DB
zR(Xn2<*1%~L-`ji@y7)@s_$jAl|hjq$Wn<kkajouhCJjYvXaZl1aI8u2M>Pd-g{f3
z^cgb-24-aFqx6|GR<BOXV6E+JmiSn^__!~jGV8IN$FnLEaPfG~W7!_ku{A!}EO%3H
zDHaYw5Cw1$PQ!Q5PbE$cH+irhFGV4KbdKE-_LP)o1#xbMJ<M^0>;|YId<QkqJz6bs
z|M<uVFX9@R&<@2GYB?N;V(NE^qtp;@@uUz%Nd<Y(p&D{n2xZ8nYC>Q~)P_=||Ldsx
zXtqF{4hsZto_2kz@qqDDFoEn5RGh>1u1l#n_<_(Ge4JB}kFR-v#?DwAkr2KJ-ioHU
zotV}`+(Z5>VZbG95}yxI-fsHd#t>pDJ}+#-jO2I9F-rUi8)InpR$-tVnph>LN2MiL
zC(xG7qUFs6|H__upSS5^PxAgsvs)l52HMrxYyjwG_8YO01MvR)?}w<HU_dE?!YBhG
zKL5U0gBrvcR2!#i2_jyOX$?9FEElSy-ty+9-X1|_3sLH=P8h(@?~$Z}BRFM_fA18e
zXOHZ`9U4F72@a`Ff%Ix|3q8DW;X;%G1j_R$<rMUu5CB_H&p&>#P@zpBhU)YhjeGX&
zIl?M|YWdC!QtMuWZV!?(6IeveBb=J?1ajMeSodIKI)7r9Oy{`63^wGVdLDOP*@L<{
zo%2=z3EDyCN;Cxscx#0ZQlF@d)E<>F=)g75sQBfB4=P=vGD_PhW7AsnUMsba9{*y5
zRld&a2}2?GTF)V=EPPPzG&s&baNhPNz(al=MD&5S;p#*1AENo-9WfzUTEYSGl>;n6
z{8G3GWnUf)?iMx;2FtV+gM+{<o@Y<V&(qTsWhy<rT)Y~&WBH?Jq44N>{uu9{s!i+y
zf*l?6gWBDL2d*BZ7SGb&JUIFSZ;i(9ADTBgl$?)Jm>YR*l7)+c7YP@!+Xn|n01Ns;
zrJ`1%FR@Zz;E&-YZIn0Cz?Kglpa+5%9T;S{3y%lyqUT1CQ!a>{kn}Wria(8+i&!T-
zAw8GOwhW3z2L|69#Fp<1mGT$?r8Sg?PZd3|;oWW8Gl+zcUk)C4Q+w&?JA)&<AsSV}
z6zb=FpvZD+0WgWL42oyzK0lsFFRZM5L}WNfrWrRT)D!+2F*XMV2M2+*h~c4rNsUY6
zEccG%#>mHr>VY1Q_dOWlLEcLm8w@W2gHhwS(Gu*Dn3br+Z7>on3M48Rq{rpfnbaqC
zJCEw7mgW6;dkzQ~3v?fFqfO!EU>UkA(G*G}3R!}a_U-|~*W{u^7`&temr^oRD|?Ms
z3h*Q96gHuxUak`mjJzpa^rq6b((bh=gV`drJMt#GofjB=A#@*>-4I-aIh08lbn#L^
z)?K`$W(5CJYrH0cYlPj7rZ_~XNxF|Q<~30*yo?K^&r1Pst$<x_lVct<ri>XcORe(K
zK%G)t!SicUFEJM}vyStL`y~Lnbz~$sp!8!odrgK8l#VhWSt>Dli;Vwk73eISKCD#c
z%@OM7ts}zsNAKk|X^!)LDm77SMEdCHT54)sKM@W<kq3t3u8}vXkZ`NEFL+KErf@%{
zHhEcURW6NorQ)3HaDKoe+l|C^P%rT-rMFjeX0-`awHrtu4D}kEisKwl@Q7vVIanL-
zJxYU10czf>P)QT&R(eKdId7thF{ir`U>griN^=_4K|pR|+xLj|dsxB<eo$s)>`Zp8
z7QR>-6^et>64l`6I&95eB`jk<5?9MK!HD`GMHqPrq8E_UxKWj6k3zc<V|uMJro_Ev
z+T}y4jD&JuMUi}<s15XF6YmMn(+=KB9pHFl30MWFkJ25sMRkWigMJZDreE+%j?aV<
z*Px5M?`f#Ffj=#IJ0|!c*c*ev*9TD=<V;whA3QfQRtK!z$+5;)ChRwp^3ckkQpu4K
z;pL-8N6$EVl$A>_8ozK~XjcMgQi50uAtga@hoFgog+2V8;FsU&`i=qxS{@m*0fqxI
z44lW)*eT;TGV%xxEZQrc$=bw6wGH&n#}RoXY4(K15hv#%RfvLP+~N45S&vY2P&ZoS
zlr5Fu&w_8jQ;!n3&u@?3D~%z)i|4@$a2K=E#pmS9)B+d=W*qe$ZE(&*EsRhDe4?pp
z2*D<;JPM8BIhoH$&=HRWfW#ze)=RTb;?LAW2@Vb?m6J<h5tCZtaPTq&2kPQA={}z@
z=Mk5n@HU?DK<25cc3o<2i1AbAFwvaEy`-55FnLj#o&h6Df;NFGi8_gC(v+v(v=W8N
zvkN78&%qU>vb<KQw9<RdlI8LW3}m5{_%W6WX)$pr98Dexf|ab8s28I__+$w#;@Rhn
zjBi~jrNTSs?wm=6A?5f|cqCG?Nxb>ZHx=$oJyUb~+bQw`yRE~)Q-<R;LmgJ@+CB3i
zl)Qsega+sTaGjWoag#W@@&uwB<X|Yn@p(6`v0B?V)X)>_emH-yc2g%k0nX9LmIHrM
zbP4UBK~E|FQ?j*VsAh29p0%uz3R7k)JV$M?Mot@ef{~?;%EJ)jHVK_;Zkjh(v!UI}
z8UYYJL9p>r8e1uB!bt~^QT4P--;G=oCdN!wtu~p(i~sb0{<&ZLCyU4D{zCQ+d#6xb
z#O^K>bH&_3cDJ}lT?gg{PG-P~2SR4>Wxr6iU;9zvXlfz#MQ#Np&<Ywz7Rvm=m-iR)
z5+u8}0rn)$r9s)KMB?~c_KOw!(M|lI%<-`$Y`Jy^=Nlo8e;oJjV9$!x;P|w`PQo=f
zYl!0?haeQe@nvZRG$~Oz)-+l+xva$dgQ1}3`CKQ;Ro3yBAv>$aQo2ud$g496M$*V}
zDMjJz;Q8nRubIYFf{ZvjarMw0X`Mjt!CUE<)?6$R;IUxhSTTs_H-hI=zfR5bInFrV
zqJXzL;O!(lpKwS&lk$Afl#EM)Nr9Mnej|9k0!?Vl$PXUk`7#uM_&9j}@-WXgf;JVN
zFSQOmv`@Tu^!IG8cpuxxdc+4Miso}b=BvjC6`oI$UYKWd9$=uQkw%)tHfepA=L2x6
z@Tz1k-T~=cwo}bAjHOhDm!SJtT2yn2k2P^Sz>q*tfEk2n4YM=^;pCj3sEG5*Nd7lY
z#^ik^3gG&lTQ18<Q+QnB|D2DYJzh$#k@H?^cY<`w`4jO{!jQ~QWoa1X?oyT>!UI|%
zIYn6kl(|6^D9;YgfQc_jD<S8<O20U*5@tdySg8}Ro@@n}z=stWtbl;8ZnOYMD`jZ4
z3PYfk`9G2$(}EgafaD%2txvK7@Re7+_MohcFQqie)U>cjQnkFe$SZ(MTj-k%127D^
zgDZ?OeW_`TG*rH3O0){jOeI4FNsiI%k?Z7RAeV#I3k_5vxKMpGR!Yy5^@?*T1=a|<
zQqKZjt0Wz%=72nx<guqRD!qj2;zE!-TS!9TvxUl$93@YdQ)wlTr4;&vG$pN6@~o1i
zDS1*&7&&R?(Api+%_5{GnHu!U3?{xx5{6p-Q}+;*MPnsPL%^j}8&ovjLrCRH52>6~
z7vvg<iWnoVf#QB>jQFflG|aW(86`=}QcXtGBXbT}WK?V~xX*Phg+Foo3x{4d!I19D
z%`gNTEGYyV+J+s4ekJ&5oq!bu{JVejLgHDn1qJ0K`w7Wt#J8v*tS6`u%TXB5h`1#=
zk#NF)A^Av_0Zz<Z=a;o%PJy!W&$UHv`;fK8a1DD7(32s)#SJi6zZGi-FVCngv_yR%
z3lgkhctYl3(i33_r;?r{=v=)bNU+G#GnG2E^vqd-3M(h$S`qYzc4<`flkjaScRGA~
zytd9qgpaVYZeRo@IfM_QJeHg<k$TOkWRP@cjx!FA0>4ZribkG5<03s12^lZXR}`r&
zRT~%;A{kT<>cS7~;5@HWIiLfSfD9H*q;*1U;3v%J6fSZ)gBLk5;;m!Hgc3w2r%`+|
zvgOFRERoj)o8Xak(rTxZg~p|0`o_~&Qqt$?Tq0;I=dIbaz$XYroeoDu1-+(~E~t63
zW<lwIKWPurQ~%{>=GrB$9$&?i6+Zq3CV*C#@K&)an({!=i51+729FfaHFT1;yAfvm
z;>p@acHCP|1p+)q$XA)kcXJa}pnWZZwvY*8m`;UTO=;jEsNkSvY-GS*gX^&apk63I
zd7Q!)^%&l1PbcjB+6N$)OFM2)=?A0?p344Wih5VBr}Y2*I?HO!!s~?mIkn$U_`P!G
ziSikO5dIL#qhqHWJyZGo__(V)rV~Asm7SfH^s<(eSo2Ct^VB)sRC{6nCY7q}EGf;C
zivDHF&5ED{+3P1|ah}QHBeW0+OrFI#l$l{loUu^KhN-c2qms;lAdtqEkD~R|5ResX
z%C^g0Q@4496BD(!gnPWSh<-(TA<92Vuc3*FA5DR95c|=SV3<w-S&!4V3%EwY=^VMG
zwUkrjPyS0TVQ+MIi&t@vEl$S**C+rz(}@MCntbx3TC{e!P>mMs>eH$S)~&k!^l=<#
z;G>fa#DCySgH1B2{)hZYX|LM&!3K21f$)k#p2{a$b72H%W=+HXL+oDD@lYjLL$t`M
zgp3hJ>@TrB{;uoYC-R+9TYkD_%kZ%9IyhayFx+lO#hL8rq;(ic%W)g&%sc~n%#80I
zvbyr0c=xs~Wm~s~syKx60iEm!YH(s)=xi#|++fB*#$6+=^l%fxeGKoh>(F^mh&W_Y
z+|Eqv;*)gfG4&1jKgNEHGy^Gt3W7t0!@_YGH1fTE$gF^aWFm7ejKg7Pc0qcoA>PpB
zD&$uQiB09>@OT7y@(oGZ*-lsJg3~h5R>+6WX-o2<a}rXy(1~m$S3P&2V?PDYo``Iv
z_UJ7<-9>a1)&s01evD2GMhD&)9r8Iz77LmMinT+JbtN$5>S=Mc^tgrs!_UQRTMqJi
ztUVATJQD1R36Nv`H_NxhJO}*X2P;!QaBL##M@9s0M!=>^DUTK>EHlzi$O*`iMrbTB
zhJ)92gPxWa&mg7zp>#ik^oAw%-$+=!y~QJC0#d~%!25{tlrkD&)ilva%6bSb#HbS(
zxWiA0oBVvm#J*ixF%!^Ba=(Xk7B_P~w|5NX$M(kE{WCws2>5@7P5>`UkYR&PYjI1n
z*e<bjWW<wL7`nudPLwmyOV%X0UtV`~^Z>i{;ff`jn%Zh=o%3r;=535!p{pt`$)1@~
zR&v2kx5ryvQBoVVBJK=8dTW1YeY-9ys;0cOC4Y8v7FP4L{Gy(+LR(o*dSfT$IpX<W
z5ix=D>w#o_G$Q)x{Cb|5tpFJ!qlF!WeB@_Yg8zsgB*}1dI}}OWgmaUR{r!rvj=~X`
zr*f|#Bo(xkvg$r@Tb{j-EF3%Fp?yQRkFO~dbEHAR&`PFW)zqt9M109!nKdY@THm-l
zPC}`|9F$M-wuz~ow3=P8HNAi=QF3-)qINZtQnv|yw|`tK=o;HTv07k=vb<9+`DDl@
z*jXs|iL(<3!z2)6`yZu9!D$FZWox!?UsL9K8$atjp4p2R53{Ik0|VQRA9sqsaEhbI
z!Z&|uPtQ`W8%R<aXv_lP-DLNgWLX}mxVG=xw;e>rX6;9EGfrigdz1&y0@=)okph;1
zX0Hi>T|`83x)$jI0b3p{n3RbQ#oWo!57)GIH>GFgW@TBrELmB(Ia#f9T57ABqMG6s
zcE2?5jJOrL8pq3p4oBhP!}R|0OmFmxxD9h(>R#B{(9o&SiPU!aw{2aIk(e5SN7&y_
z3y8gRmM+cX>#%2pvhF}mGeH-j*cZ%U9#L|p_MXvsPVGG0RhPqzr@Y)s7A_$*_|Hlq
zKKP*WSOD(n3r)(iQK4t!G2#|Ee$NgDM^hMC3&u-BdKn7lSaxlG{<X`NUTd{pyR>6-
zQ`6>-_RY=BoByITRJ&|8i<z@@Nw@fA_Y!yW=5~IY-rt(oI!S36kR>B#l$xTI{)Eo$
zDv&c)i}xxGvd@$>)#6g+>QSXB%-%4TD2EPqbVjW4N&}yd2r<uA>t-aJCI0Emgk*|z
zmhdgDLV*gn?^aeUenF{tvU;(8hSp9dBdl=byl2HBW<QJ8&!hzL-|Bk(SVotmU>Obm
zWMaMH9jrJ|7?~9iOh)lfQjRt8Z`gg2Bz}sZvR0)=7c<whRPmFJrx9N!&QxlIHAAK+
z1>0DK)ErEWZyV@X0evFQpArg!&nV5YzbM!aCkp=(vQ@9ru!=(I6j$WX)nNxQHc(=l
zwd6I>^JukjgU;txq+~_Kv8aGnh|^`HtVFz(JPdJn5BZa_^zqIVVN-B-iZebsD{1bK
z_@&ZVcs9tRtkZgxoI+-;GRiDInEB4Mq$r&+?%mX&_^?v@G~wae;J(ZngP}G<7_1F;
z4=VMl$62;-ljcNnl7go+VC8kZ{zIva{fZ|x7oSrqQDH)cPL<^x11S${2D?Ezm_j@g
zJTUkhr9Ri9XJX^&bc$yJ;^*Ds9JyMobn?hz1)PKIBhk9cu-=6+A!8kJg?vx_xLvGD
zt1OyQP9l{gZD)lZkKLfL>2Zt1YnA4~p3g{3i;fkr7nQ|gtLw1%#ne5sA^0qGGJt}2
zp+5LWL6|8H$;Te;4nC#SUdEC;S@NP0sfQ!qglZ1ct>RgL{lN>l7FMYU{L?8APmCXf
zY<~R1E#n3vJetXxJn1}GoN|nXMagW+RWQ9tFD>x0h^F-7Sr@YUHtpEawywHtK~-IP
zUS4{3R!&|zj)ak^^!EqbYirvVcvd!7FR9cH9mz{i&$FbbTQ`JyHDPqZTcg#Rt@X<2
zd?Y6WB_mllMQE7&Dak+iHeqB39T^D^PPi=zgBm&|LE+@nh4_l#KN}UuBiD!UlQIpN
zDH{!sDD`-ecYwl6vHBVm%#1~`xTvg@70*4pG9^P7hXnjcASdz9VPO+yt3E5qKXmuq
zLvxd|qA`bqyV)cdq0>0PpZSUhUaFVX5Utt5m%m>H>x1d<#u>p!r@a$Hi6!}3xLbHQ
z*j+0OX4D!CHJQPEj)=8U;-VTH%i~6l1%-dcOkX)oyiWm<-Ma@r!S@xAph1$H#Wf>X
zE4h@#pNCBKG@gVUCCsBouvRZe&Ib|l3YYB(OSFQ@N8*5p%vQ6B&S6rrGbg7kcQ0>j
zTIwq9t!kNz<EhWVk<``IbqxoF)P|+y<x3iW(y-J;M^o?rcWdLG##X%5x5@UcO_H<@
zNlcQ}J!ZWJ$CN=-CsB&c;-WeUQ{rRb0#YA7z!hm8eCCjpB6E8{NwU)cXvD*;@qneM
zI5#=BxX6-Bn(?pE!G9K6a*K;|Ekz`eOt2i$5%RDciKT4y3h_rO(~+P#Fm@fgSCL*2
z^^e$IgY^K5I<kMiN_N?S+><0z#{xDBpbJ?!)H1YHnuZ+Ia9+wY#|hI)o=TRa2+ztV
zAa8<XYv#~E%Aj-J*?3JfbhaQfBC2?jJb%*RBWHy&^@T1-*WkHUh5NvP^AsIq>}U9X
zqHbBhc{5ZmAqMnffZPS^4?ndE{ex*+N*`<Rs`{*!=l$E)tl91&x%$93v7XH*fn59r
zTTDknig$iEQN+i5M!WsmSkMB`VM{bbK7y&RJ%((3W6k3bP01s1T-5gz^eUfx&7u0k
zTCP&RJ%W+i6;{hN3EsvE>Wrl5as`*(q;{^G*bS16c{@Q+H6&gbc<Glr1~8csm<_E}
z2zCbu%$Sf>Sjxy{=0}K=4}rF1G3T?gjw^fsB^N0zW<klN^RT}bG|1sawqXy+Nl5CQ
zr?y{sz(|s#X%<n&WEwgtalbNt(2xextvDIFP-n}NFY=cRY}qnEuiA!&+M32jmXl@6
zauycW)=8f=_2SVj8(8IrEn9}f=QeDa+fvWE>RVds#YgIqe>G$?3|TeR@|#6PF&NL2
zS`*phN_O56`QqFutZdAqB<)o`#o$S-Ze-V_>~DnY6ip^5I}d3;jKGlD2u@?QyF3*@
zWU|+d@EB9=EaR7n7E9t6$+Nz6I2_64ajjM9B|?2cLGY=P^s2fd{QQ8K+uJdQ$(X^d
z+79yWF)fcef9)X43x0Y`{6yO!o`qHBc9gQ=eANnJm`6u=%|<h`HC%gQmiQd&Xug_l
zDHCZ&L$hX3ND-=ta*#bElm+jCs{0?PdEkEjzD9M8Cvr4Pglb{i_$L-u|KXLISB~)a
zrPW7p{RjSzC+yfYQHEU;)P~pWHQT*<yWVcL|Iz6@`tt)v9nPZ%j&%O{&z*brbi9ps
zP#j`hkQw)No(U7$w^6da>8)4+v6<0iHA4S}TY^$cSxxW9Bnd)N%)++aUAt%f;qk|J
zHTSOU+I&IJ+FoI?u_!*i$oL}b6(6{;7H7-#UViyc?!D$3vS2vJMuk$eF+-CIZaas3
zLec_Y_f+zAAT%>W(hw-j?xr{$E*;6|vC{#2iiHO%xqKeG)%ldW!CP9{)L3!NE^}6v
zdDq3s>1oNAFjHfnu31}>pJpr0OzSVN?rKP@>(Mty6<g9Q1sN&*?%JMK>;>;FDJUpm
z(}c3ZnH4o@Mx(jZY&50?m)4Z0WTYl1rfB1IE}PTib{LY4h8f91Ty#Z2c{R|6e$lDd
zAK<*^DsXph)lpVp%GHC3A=_zS;F9?(xA<rymSi?-!FOggoi~5>aP7jb&P8pFuA0Pz
z1^&R`#%06Sf})}VybiYS>}T@>m$cOm&lbPvS<>HrcGujJ!t}NUfwR|(zZl%w%}UCP
zw>e779A_89d?0Aj#{MO&18jxFM`T-uTMy9*AW1@k>Rfwie3AJIEFWtjnOcC~qy1}F
z_QmF;XF7V^-g%|{9*3=TM#AAGgV$WQdR1}Wyn;-Zv0_Jdskb(EU4QkwRZ)f3hRo8A
z!m<T8;l8B6Xipm5a{m(-RTj;ho1WIZzt&ytuH|duZ1xSPA&zW+W`m3+ZkREQEf^X?
z*Zl|C-<Qw!&sjFQMSJz=7V6KOv9-c9^v9<`Qd!_Sbb>KVG03M%mKqQLn4C!TCLBMH
zF)^mVib{_ZNc;7eammINRi!RhwcE9{q_v>7!djNLc9E-ht$sz6%kC=i<maB-KDV{h
z<Sp8;RF~~cb6C6ZUYvK!y!O1plEQp<%#4_duELrQy%1yf*}4|>v}9Wy1(uR%bNoPE
z%`BvVwlukWmaql746oH%86B@nugEK?!sZ@2b#53o@DH#aTSNQWLIVVNB})hZF5pH@
z3`z>E&@x%cBPd&^V1;6i*;^YMx6YokrLl3#9ACiY3i$YYQ`M|lRaLD`mUPPVlx}Hi
z9mcWXdpb7x<PTTr!s<QM3(7Edd#V?fE@-H@q@tmrf=VO5lqI90f#$Ia+Hy^e?7NA8
z*G9p0Jg>C^Gc4C!f|58$c!H}z6+c!0C2#{<DjRY$n;UB@E9n@H%5k864*0^*9%sv|
z%ks+N_w3qrC@Vc3EKJbMU|W#Mn$8J@N5Ck{8Xz#z{%M06i3gYkUfQB&C2az<VcI&#
zq6V+<=jo6_Nw2f?c!ekyouJKjTeJz$IF15AUX?BvEc)x$CKM;&Z>@OqTgI8T>B;Wc
zb?akY$<u8!jc=j#J=mx76vmWROO1M^RLfJ$(K2sd3%v?TOABmeW$dZBjZJ=kQ{&vK
z^1?!wtFW*fa@-N*r`RUED(JN&2)E#yA>>T|On6OW*A|W4B(!Si&iVMH{BLv`0om<%
z9N<`hOOAw(@E!8JLJFlQGvq`L0MZM^OR?7q@2ElXJYe-e>OG2(GLi9h?7sT~_uV%v
zoa6uSLx1r5=oI8mI+>fei<D<o7Dhm^dc7UlwiJznEZm?5uQ@?rbKTuD`#U-p^|pPH
z{m&w2exAiPGv92>)VIbuo9!Lt?C!P&^V=7+Y)W4`cX484@d7KTUR-3GnVcD4WGaQ2
z9)=LQIM1G{f)bFL04awR&>r_gEuc8fxBbUyrosLL3GoBi`(~1b9@JpOX)7gKG6h++
z$mEVgkPI|h^4vmKXuQIjQ}&8&(TRp=Au38}Td_rFFz7)P0=rQ@op)w}$&?VEl7bxA
zwWijttdz={3M2a!(qKPhZtcu8RaSdUVh3~7lzv!R!{59~DaVsiQj(6RB%x<MNPd}s
zFJE3s!m|p&1bVnQzyS0HX$vvVieZlSGkm@?+B-M;#I>wWKfR;M+c|xDr?++>*_GJ3
zB(CY4IUn{QgW%b{=ec73Vsbc4!B0(&y7H1XJD<tYsxPg`@H>Gj_$-}zMJBp&o2FQ6
zf8PA|)GO&q$ONDG&_{k!7DQ-Jp^^=#Fo0$4;K9McgP_x7%|hf)`yQm<T$#7vn0kqw
z5I4br-`qfAx9dF+NLX#pj*cF8pbEQ*u~oSD!j6s$J@2mkX3cvG+b^6`9q@Pp)zwQX
z+S||XnR8+LQ-8#rKhkVK-Qc-@1|`7Cuaa1~WFa}iunNLogjr(5k^*hlswEEblB>6*
zq}Np)NNk<v$tkI;E6MRpYfTIo{SWG*g(m-l(K>-$?(8Xd^*HNYso71g@}}(6@&=qm
z*DL-jyP(W5BtF1mGYiU{Ll^^sqk+Rw00{y<ty93l#|H=BP>xWWqRLDO(=%1AtyP!)
z>WrQ<#eZLxmXn=!`Bb3Qm6lXoeAQJCWtdVRIOD7Y_8Pe72V9nA44M1rWR%$9TW)2q
zk%8`~KSi0t;5DCV4pA8|F$v4zz!CA4LvK>{&mr8qQMzYCBn+|)-YC9u<dFD^|4q6p
zB(WR8rAVHp^Sv$X#sGF23Q7Fg!?^pIbk|6+nWn?owTtf@cvd>26(_Gja*$3!A)4hB
z0ZEn1iB>D)aW`DoGCB8112%uYv%cOrpZ!vNjTL?L{PRSq#oey*?&9jY^76XiEj6sS
zW?|_<xdoDjsRhcdJ4p-jJcz7Yrhj#<GSy2^BQ^d>p#~x#gPDlqj)!{1?{DjQ@ao3#
zK(B0GeDK-0)$dAD1Z94fS^%G$6l#nEa&_`490~gFo#(GwvVKDKzCSMNZl`HWSi#9(
zCb@q2A1AAyI435nG7KI{=xfqr#)6NI?~$Roui0s{l{jtL3m-kct#R(W@vSfEs<F(>
zO-sx6RQuZexwU1kCZ(TwG8~S{;V^n=^^t^aD;IS6nlu5edv7sk7FcbLX05-msmqZ+
z|DN$MtgK&>kZZ`c7Uef|HCI_{lAXXsSQi$szGqM*741bPp~6Da#i{h)BJr4zDju7j
z5r3uly({C>r%$2&Rw8)+8gpsNM<1n>Za#_LD`+afMTlajkrz!({TQW4dB+P`hu9cf
zF3*FrmU!c)MMX`I^8^~B;uf~_>-16VxAJ7bsXM(Fq+}Qj>8a<753FciRq*_?X`Z%<
z72u%ZHm&2@q?E#nkVOKYtWAcS{LYS^=J*)BE_Qn3oE<xQo8sf5b<y$7s%G#0*}}xs
zgoM<@g?HV#z>ppvpJrGnw@GIpPQ%O`*H6io6l&v}o7t9|RTVNL^2~ffdT1E#46L)@
z{^Rg<iWM-_!gr@oIMukDRH?*Vsu+7lXyg4Tq1Y8Q1eil%?F^C>B7tN|<`aujjF^Gn
z5Ev|7;%|62Bsz7vdMEL@#LVe=#*)6PyRQ!8pi)|toIS2APfF#q^!W0ort<QpSiO7N
zbk8q;NvmQ7=D0*hkOroJYQhQ`2E{VP+Bg9Q^}<N)*2}hmSkhA^o==h-aB<rDf4#)j
zqfS%ZuUS}gnYj7X+I>C1Bd!`t6c>gpd?mGed1y`H6>p=pq~<d8ESLA}&sgW7u^MHq
zI}(M&Bx&~&2L9W0I2Te#L33GL>$D0khU8YpufEgKU4}7WgQtN7!37B=vn)F~vk4+f
zuDv?JJ;&kf37$9wQeg1_PC~N~9EMgb$lw?+ypt)^+5BL0^Mg#o=OEVEOD`24xaJz<
zIhH1&PGw7^Y?M}#du-Y;)6fAUkQr$F)pKD&L;x%L5AWiHwCUiaiz~#eUCgmde0xe}
z+Idq-sTu6_CMW%f@0^sQ&P5;fu#rbmOgWNIo5|^I*Ux?94e>(OclX_F$*Zr5cet40
zjyq5W9wVNkIU4&UD4GCL4Z_V3L5B>@z>X2)%ab;H%=i!anvWw_^P`U<rE)3PtV@xz
z`L)-Oclp@wfB)KR;=!GyZ0{`CycyMwEy20e*9f;ka!3J|=%iS1C^GoMe5kkMoH1DV
zgc5P7_@D5H?00xP=3Do+?7gL9-w$WqytfIdKr1U9;y|%?&%S*vd-t~Q`(f)3_foyj
zq28cUFWD1FeM9v&)JLXCs=KJTva*=%XKwL7#rBT9H_!UvzK&Z^dy}`A-ReNH3Z$55
z--{aeweQ{AvQHB`b~kFh549>;Mk%giCMX8xs8Aac{5%sH1xb6!6b=G1xvjWT=Pyex
z^;H%Nt>}{@_~T8R*oR{J&G<Nf(<5E)ZQAtVrcL+{e@(tpcB6y3xvIF5-FlH&c+np(
zqP)@<;r$}|L4Sci4fG1K2SBs6Xff-spHE9vHuU&ye|h4kFT8+!)WLK7l$9C-s2Lo4
z58CY;gmnZpqBx2YQ{pc@MXL?paKjA?@w(whPrdk~8`$o}{#$SLFZO@ugAcyLpC7~X
z|K`u*VJlMfhn^>y*X<d;;YTk%^&_ePwXin+AfBg6G%*^DrUSa_KFkj(OKXc}k!Fcz
z1wg}5p^9)Lng3z)!T8}ChmeKsK(xaFyCF<;qGDJolcX`ZJVqj90CZEdo*vJzw=!+E
z%uHKNdxfX1O&o&qR3U%UHofKoHc-)CL-%c&q1&D|`5QKHK@IzbSGrAZm5NqzAH9dZ
zI+qQK`*29>uUq9xy>y!m(tGGDulFBRjPC_;!GifZY-8ypWiiYj^pn(7GOj`=M(z)A
z9X-nuUt;C6Eg6^7+!4QYu=f3T{?^5^Sk@g!`B&#;SQ<C71LCKfeg$ekP#x#%I<kF(
zhk=VBvPB-=zUH?#g%~=-UvMskpA+w+71BVq1Uwg^8**N#n8}?gh46}yiJSyXsDZX}
zl^RIZD|T{;yGkv<ax_T`q<^cb{)MD;PgW-h?qr|-nn&1@b#X#{L<gX2NoJ>uXm#Bz
zZ`Q(Q7^2FX7fuTI#(C{eKIw3|98W&kJ`ae&Zq~1nCE-=cx}t;M3WEhv+?)~(vohH&
z$qoeCg-GbFOo5PSO2%31GVhVb6gIK5`^#NLCU;_@J~=I`VwumktRgc#S)XWdnTpHH
z`_FDku~<^fxw&y=i?%d3Z7ELC8xqURnca@M6_u4M>Kxsf=CVYCKBZ`DQ}dQZWgjDr
z`-POuUA#06C_vU04&^4k@_;W%a7rhHaCjsbC1WdKR@qvC9|=B!g5ac2-#~TsfX}z8
zre>8-4H>mf5Yp$0+QGWI!CL9P&6;+Q;K5r6XA(50gyp2Ib9_wMD)F>qV<*^ZVIA$}
zBkOtCd&nFz<T@bhD~_z`fR5qB=YI)ng+<(ZUr+!QhYY4Pa`@CI2nB<srL3&XUYxBf
zDJi|=do?NcvTYY`TTqI(GJ8t(_b(|aEzxBc+hN;;(uk8MSr@m;YH3}iD5h8e#sx3?
zyC}#82I9ZsZ)76_)>g%DM4ke(riIfmNQG9^NGk|v`Lv})=OmVq)AbaoO(myv5Yf(q
zW85c6(LRuFb$NCzc(vk|L`U@6=#b@t^KYyzlF*M1$~|QctM!%4j90Drc{L$E^OZbL
zQi8#dkQ8q)M0*_WdQU?`rp1zJnO4NKR%?D9n^s&b9y8<{tX45t^sq5LAt@;#-nh{t
zR5@KWuH39l&>m@vLW%G;G+0<eVR<@j{26IQBUuki+T*7oY-a7)!F+gKadP2OJkNL3
zhd<KuZO}y;IBYz-;<tisqTCqLp-u<d$3iL<WNcEW@H!>vXNT0Q@*ZamG^^%jXji-^
ze9a&%SCW6{TlGY?$b!~GPLtE=LD7?B`P=awviW`Yl%Su-dK*eh>bKpOWlA9vIj4)_
z{}NrOw1LxsGgs0SPDvJu4k5!<!(k&{@NH;z3cJMVz-gGuWN}K!C$(fmaSThnsMWM`
zZ}_+A$tmshr_-n0DGV5=?9vp@@(8-A`<7!fPLet;_*GKS>5%vY>pRl~K<r7da>HTB
zz-d*kRM;&o&_TT<JVS_K-Zke0+I+sYHec^U$bC3GGI-8*;e*Yq=o^=>t>;kR{8uwJ
zuX3$|&c-yIkT9l0N`%bHOj<7bkWmya8`APgD8fldg7D7@=d9Yg_JB||(2V1Ot7rXI
zJSe<APaO3wF7mZ^);F*8RIF(7Z0&fF#MRJBXwXR59VfYco4GI&670602KUC%e=0#w
zyx`<a9FRh$<`#nKq#4U0(Ad=q<xVjX+(SVmiTXty6hy)@$WkCoH_l8*m}z_w{*hj|
z%w&rl_RgTTdBA2iG@;Omj<Ta4x`0XA6oS)ntUS(-uc6F5YfYuCskopf*R{0ao_jp?
z4VBEd_4%{T^0l|Smo=1hm+7=Ia5>h@FX^lERMh*$U-U7dt+uue{?&tH(d_oI7qOq`
zJlfBL5#2Rb!d@7=pLBbY7kO~RgbihE%OqRKCfze88WFSkjrLNkb9&06ip(#3kBbqp
zEeKuq*dS@aY|2Ooh1@I$xo{g%SeHZm0ymF{FT;x)$agL+5qiW`%x=t$iM1HSnAx44
z=3@Jn_Ichlt!+cqfu6?tuJWQYXZ2Pr*Is%k*fXNNIW0|me(-4ErZ~iQ$HlU^q6SxC
z^|ajN&2#FPyIm`q>Snc9Ia{XZB(H0$=`Yu4MLnWj7~uA3s)-6AMcQp1TPWC?OZX(<
z%b;=JOi0C4x&hCfq<P2J;2g;WcCYw61!Y^3*xvRF$~)%EK-Sf-s0_4v<WAHM51^NE
z`FU>+9$j=ZLbbJVF%RYB%&G~)SH1`_C!roREOQ?i8PT49=#WNxVg&ep2XHq)f^0u6
zxFg45+(0Nj5MP|E2XlIr9!waMg4tHNKh<ZfnXEr*e5a>Ij!tq)sB;(|rE{97;Om$n
zbmkV#kTP0LEV2YN*({NwVL4q{V0MuROlC`=U3BV6B|bW9&>Nad2M&1Zn<@mCc;Ky_
zJ29Dr-Tb2t^KI3<?taX+g9oVu^PlZn))<;+zWEM+ZB=C*=9!;Gwbs|SO7DIY>R1sI
z9Xr2HRYVhg;*xQFT8MLK{wMo|Z7iqN`_X~Z>iwWMqW40j_%n9F{{_s*$eRLf8g1~;
zz*`JxK?{8Yo+&S+bRLyPu`W_@R0PjdQG=7cG5Sk&XC=0&?F?Qd@y$WMfAHkIQzHal
z9oxra7<hyQZy9Q4B`Gqbvq{S-{TC4qhn*}DaTekyQaIeUi^9=x3wtRVPFotxER=o*
zDIP8g@o+n~zSpy4VW$)gXPq+-(Qu;_4VPHz+~zDPb)M~n?im$)2D&Uohf*|LK(h|<
z2QoDJDY(_-5pkqBlM!l)r^s0z9T`J+<g{bxf^SV)lwJB?j<uURMO2;`J1!<K`ovb?
zXPF8=yKrvC>Ep<zjv71#W+fc`H=p?Zq^Jr<CZ4Ddg(enHT2#iWQ24FOoqnj}>7xI1
z%R!&S4Eq<KVMUOPYWZ4rGI})Q$W<JIIgu)9pPhKaq?kGUBs(D%9ULFw$^OLNn6m4i
z`QI8B<~aaEIuq|4`#EwSe@gK_wD$qP7{ogR!fnB23$!ibrGD{y5Pwb_!3mu4IDs<>
zR$l0k(jl($5ylqNi6a5slBgKnqjZYrA+26}{0^(oGp38veN5+NeijuIH3qgPK8C21
zClEP87IWm&gUk&<gv{av*y2<mALOdnM<b+|7C6WwbiyQ{@@_4432{;F4UKJ4ae}LK
z>(<%@4sD#aplNux(T)qpf?Dyrfnk4f@$F4Lx;ag^7Z>~OU7p)LrT$XS?G@d2o@YXW
zU=|?YUIwyG!@+_5CvJm}*~LGxi-YH&676*V=zKZLiTFNX&cYJ~x<gL`Xx*XU2aq_0
z(c6KyEgWy~S16dHn#8_<@Jz5K`0s#%KyAzD6B_O4vt!q5-bGEyPAkH;{JJ7=;==&D
zT#5#ymU-)%sN>I#{T!LfKjqKFldpoeBt6A&^b|!kkRUp`J%9$aLO_@oyoWuJVvmcn
zr-&_pVDt&;g*@8g4eMD#f+<R8j%OIia36R+Rk;r)PylEk)DKl(M*aK!W4try&1>j?
zIfpEks6vJ-0;bm}ZfsJ3CIAzr!!R~EBr+{3^vFTb2qAi$PVt*IqDVTj76-z@OX8Jq
zVz+=SqfTrjn%sCor>iv@({;K`Q{wSwK%7@7hr*_sGoy4lY2+dVeg2%SN1t>&<ADJQ
zA;TCJADh^f3EhAMZX7!sn!{R639L!*PE&RWJKQ^FgS3cYFCiTe8lglK*iGEl9<4V?
zmc>#5`>RQ>5Z_+DQ3%vlW^~V8J>Qo*+ZLfg#20wd3OoHn{pFRVj_E!}d82RF&X}Qv
z<@I_N9b?|q>0cjn>7`Mr$q`~|OmedD?|AcYSKp@Cov+0B${fw{QC%!vUs+ty9t)0;
zt69O`5j^Bk$2qjHBud_1a;%X}QT+3hPxiCx`|&OguQ=>Kj30Ufml(s7cjHNDVd^Kz
zSFAiuHH;pTYEUW(*CW-0x&+9~PU!yY;0;U-*G9EKpOFR_=i8dZ-+l2#{}*4dCRQo$
zi+!Hm>pbQ^hQDO4hG0+Z4+BRBHBn-bW)NrJmSHZ<0E9Wvd@=dMo;GR64g?2o)79ag
zpZ4ssgnWl1U-c4S<X_+77teRt@{5b}Z4TxrwowUN@rUqDMxWS^T_m)FOPc9)3Jo-4
zEqcy#r{Hs{R%st04z&E{X2BBtvw)o}s&)y6&+whJVfAxZ;h(1#sbzKherg}KSxLtH
zKg_*(d{)KvKYnNC&V8OIdmx1D342(5)+~scg~SL5VN;|k1QJLfn^_>@hC8msr52Z3
zO4U+oEh<H8)lyenOD$FER<u=dDW%p0fjs%XXSvV4Nzk^R*YA&C@_Oc;duHa$nKNh3
zoI7{!jIeX!UGIqg<x4(Ti1q)7)m1V!!x(YwrwOYPN@Aa|It8Qb$&~f>zHNWIioVl(
z*w{wB<P%wEyaQEr?LBO!96e;F=)7R!=)J})%4m(2jZ7(0i_z}rz1F$kY*9aQY}Tx3
z?W|e*W?^9lK`u4^KqtlAjMK-}S=EoPK5{XCD%QbI;g^YSj{~di-mQ<VHb`&pf1-5k
zb+*c;bnJ(0!naVOE}o!E<Br2s$hJf<P3^0XZZmJQ=^kBeo+0Qy{iL!<V&ELa?LU=e
zl0zsYEXu<h>+{f_uzBj3Zdqu^;~732dy>g($Eu@0GRK^9%F(yX`c+L&P6<BtfEbf;
z)yH@Lv-qS>#o^lGD%#^GAnl{K+wCy|Ur&p+5WndBFKWK%wXDW(HeutG+k01Tliy0C
zJ)#MaA_Fh@Iz*mX3?qkCPr{RlCdBHrn?Bon;tQkfdi2%eeBz@IYx!g4raPx3U^^6^
zqYq0WxoMBB+HL;C^f;cy(Q`GyysS_AI~aX^(K?LPVs-sEGaDQx8y2g16$|U(!b~QY
zz?KNSSYKu_@kWJ4|IoJ+W7y+(-<B$DjIb-hTnocOFl&NW)}N&2dp!B6(R6YA3SD;F
z;;lFW3)a>8#iIA>qo*u>PfSt9>Xazfql(kShug!Er`S=|;YT0-^wU+V%*}d8TC(cr
z=9ZX7EWu&rV@ctlaj6#kPcX{J8+5*bU2OKk2QjnZWA^ECMJsq^JIHd;0wd&c=Eweu
z!gjOIk0rejT@4TlCg`IP#6=$B?xG-1R#%)48!=qWt-8sqGHZ_>JmnN~$kAV|auZVr
z!pG?K^&M-$`Vt0CA?ahV+qxwnak>8v>HW9XVWBrdWASwd%EEv+Jo={g9oYrPu7bn(
z*eI!`fNITn{wXx)PM6O0&wK1LotM9VB#XycPTrY3(WCQX#q@djf({l(tcDsfTpmDA
zE?m6$$bBzDI!!N;j=tW9u-Obc2fS5Pp743`HdgX#x9M<M+)I4LOETM$J71KnqMhLD
zqFrQ8*;8XV)s}%HbWZapFEoAh(W>1?m&S6w8Qq7EwB4GT<7jGM-_ci~!9SN8oO85C
z$dygRK}*HhbuS0|F7a<FVeuJe6_m9fF5X|*@)g1ry%|<>7$0Qwk4zAv8#>%HGlxAE
z?Zf!8(fr+!+J2T_wZ!mjZsw!Y;ZXS6nf=UvUtjM*w0i+guODaT^x~-$Jumzjdfw3;
zMmZ!Q@kf^c4-NhoG?<0OF;VD&o8WO(*&f$$cw1N#lZx);0oR}Q{*umLyf|8^yxE1M
z1?Q+7d!muHM-L_r=jJdd5j(av<{?WzRP4buqCcG;xW)rW2`BbA<jf-%gWA<@e_PTU
zOmnhuw~tHqTS&vwehBOI6!sEJfR(@-4eTebo%aa*Ot3sm*PDnkZz4~m2`4@+T1n?0
zTPygFRt_B-A3t^|d7^dk8LLT30zCQj1d_f|xS=<ZHb`f6^wWfN&WFWE4_?gH9lJ`-
z2zOydxW7Nze@b|OYl`XMZ}mrsc~X0%_XF3A@UxT7DbAiT58mngda^h$S^J~@iMBsV
zvxXnEXM_{H&kP+#iN`y9^$g*gUhZw2cfyGtc%v;dkME7Lqff%0{sjD&;zZHYv_Jiw
z{QtME^>4quDx+%0(C<a(**<0O;eyhv|E^-`%`<9Odau0F%p4khNmrXDV&*<|sM)`o
z<w-85+c3Yu+fvzsz0i+B11sm1&4D!*otKEU`tld@h%bHN2+QB7;!&QVh>+d*CDIh#
z^dg&PhQ8T6?#yK)>zc<^kK2r&0|z&c+^nn>#ud1b@4i;Pqx?1esS6pp18kr-Plf}i
zeeYuZ3?O}Px8&cEu6J}L1f|~)j7%j(w)6dlQ+pT$21_s*mO#-I*6G`*@_z39R#nEb
z{$<d=+f9Q{{bKIEyTrx)eE)$Xy<Ll8c%8#>s1qjvF}g?7Q}evuyj1du9P8h!e@_kf
z8119azrW~xjF%XL^f)3s1~CfZ;YJQ8<6vJsa%5O-9$mcnC||vePd)PNNmANZU)}rA
z)mOi<d5%4<h*3K>I$*FBu9F%aR`bh_oP5&B{P#yLUaj)h&Y4?#wLzgF$_G|swJcjd
z^bQ|40{);!D#2<is{D&@=<02ri^?kwUvBdt#wTzwXYL$T6FH;vt<-c~?$h4NV$^3$
zdBu^pPS!OVNKKD;;;B*cW{-K}M!+|=C9`=|(}4r4RvoQdz0KSVFLg<bH;jPbt+p1t
zVdN{s-YU&_4j*P15wsQ`#_fkbt_BBuy#6wdgD4@h(=c{rq(*-cePjrp@3V#!9;!cd
zsQ#vHaS7s`+4lQ=@suR^Ft(nGvFLT_o8<I<F2*P`=TE|Wv;7L?MM>U=jllVB@Pvo<
z3h((PbLY|OKSaf7|H&t+_sql|cJLFT;96_NTe3xCwYS^UMP{`*<><|)l$k9@Ut2AS
zef+Vjfn($_YJLe$pHQ6QSyFgWIlaGB96u)dlHhm<$`fa_%~$efnqjQ`3Fcwr$dmDN
zU-6ZsSU!lIOxUQAN%*<0vXY;CqIsI$IyNveCvVuWyquB2F=N7`bMw=N<>!tLjTsXh
ziA^hpXDmGR#4*7U*+`O~H##(SObAJ2^1xV?RaQ&L#;z2ZJ~M0FxU7M{oa{n;lRXeC
z?$J+#uPAF-rfZ00rT=BEJj$E=l*a#$l^Bwnl`|@1r{e!F!}9ZoxtYrq?4IVvq-12J
zTOUg6Cj6ZFcym!<pp%c0;&nDPbv4L<hTyg>g2Ti6+rDlk@AS-tHB-j~Ao^j$a<fOE
zNd`3o(1Gal-(@2|5L^p!pLnX9|Naed&v#hRn9eORR_pp<MCzwv|7GLYs^<|sO?Bqs
z$6iOJpmUj-ZryXk|0g{ZtshwDa&V;>j;o5cRQgNA#@g4XghKyQd&1Ds=mhw5pWulz
z1#e=C#WSNePhz9R!il|ah><Zh$K%OKC9jYi?1R*L9vLRy==)%u5_})hL)c3jPYhpz
z&cmPszmN~0<8e7OW6&!GQ$2~E=r}7l;O6T=h5R)7o--UD>a76hso0bM3-YL#2OH<s
zR?L41y8$)DkYri)<4eYm9+#azZsEA<DHBS^j~bU%FqRI9o-nlf?c9lza>wFi@=4{R
z1z4EJYe!&cXT1mYo*TJFjd8}e(Z^N@VqLsk<|-!L)ROUUc>#$93H@F`E(=rz$4|)0
zD_mGuJ#o^sDHB4YD{3eE&mgV;d7q9WqBY0lOq*7C$`}F8EibPxiO%~UckdwZlGJz%
z`&3*!#q4iZW9zp2_lgrK!(`CoJ2OV*WaSPKW;Hk#s+}k7Cpz)isWl5T)6?>@h2@oI
zH4RC^V^mLwvkqbm8ufuSJS!u`R!MQKnOazwo#Vy`(<R<$ME@eR^i1PJ@&I{QtZ(ht
z*8ThM0L!%Ge=<KGiqij+ff1U1o0i%#NNwo2B#6y567?IIzD0ztQGjB}Af$P4h?bbN
zA+pntRrcgN1w1w=#x1vi)o7uFot~FFI_GCX-ehbV$rwE<!!2JoJXref*sL*Q;{GHX
zf<{Y?ZRE%J<|IkHF~N@GL(#?XT3{TkpogQsMN4-txRd-Un!PqIp3=nl3(08m0l5QT
z@O@tUURs{Vlb7}$CSUQc+&$YW-`<EhR6#<nC&0D$usAG>yxgNM{U&ea47D>`YtI?T
z_1=Ppc;FB-(e`y3c^ThpN^;l7sP>}>rUYMNSG=#}u6SaGUG8uZ@~9bg_#XW>ow$B+
zT3X4Jsnv6;=SId)88c$Um^k|P=&m&XRJFat)HHi{39K>4GF|K{t#%=owH*peOYoFD
z4p;F_3>>@YEz|BLuirb3%q#!8y!R1ts%tHve+U4=HtvNS*U~>?p3}fdVeDS9&-)!>
zCp*m8yw<mrbQ?EgUJyHY$h3bXYniuS+CQojyp3XVJKpZ@k@KaZ4VjoRB{M)S`XfQ}
zc9Blgy`J6;X?%=zYMpwW+P886uXhZ+rtfm>zb5x2VK9XDy9lu=!-k(2xZ&F1t=35N
z22jeDlnnQqhUi|rw;h3>vp*YZ8=XO~?8{-PqP7H+xX~v%>s#rS*IzH<HX`nOIu4JW
z(T%I>+Eg5ko`|?dWgOle6U2@XDGs)t-5LD~fk*}-1ShDC?R#3bp23h}bMk@=I(Ekn
zP|pX2Yd`_p>>$5*2OiD8ZvOSl=hceLvu6tq+-bm_DB>3)MZ<MSGkdn=GECR^b%73^
zs6>7B*Hjo_qI+u=or*o90;evbPzQYGFs@u|uNOU=F72DerYl*yWhC|!QD3H~rAPM`
zRa6v-pZG!vKf3gkQ0Nr#i;T$0896d1X9PG5(`!+Bg3x&Ot!ocIJkHWXdTnf*`WPVT
z-QCv(tr6{kUWi^?M(@V9&m_7I@+x7aVz!qQgHQFw9G@t7qT7N=1+`6MPe?7KSDrF7
zF|B;usDkt`p5+fAPfM(oun7alFZ$S-ooAB~2xKb>ISbmSvUX7_^NcF~P3=XOvGz|f
zciNXhKIq%5_A6s@mAiV9IFOY(WaiWp$Oq*^QfJmq41>lEeG~h#F@q-F;ktA-rgwji
zZ3l=J=(GA}VGXC$c6aLIwm@;th=Sa#5hIQiPo7*XexdC2tc>j8=@2@JuINkYo6`3a
z!8;cUvSLY7)1jMgLQHpGq^|<&e8n4T$vfH>Dbzkw(eCQ>?Bd|4(qUO8V=IbYDjuGg
znziI4mNq(TWI)iZL+<hTG7;XL;t*NYYT?kZ=v&3u7HDSt$h^GFX)i?zbEl5*<xIx*
z9Add>@3my4kw+TsHtfBY-bzMRW0%g}m-^oCdxy@JyuwNBeTh8sy=YCI*s>TUruW^9
zz3gtaW25Qhq*J0#w=#Mx3OjWXy@tFcc4&<4WB&m#of6X|EDX|Yp;r>o7d+M~jX40!
z!xFPvV{V~W(iDkl)|j<O^Pa@C4#Ko)%=L6Vd0D1u*O(o2DY*x|$YY%sOLHyKBmg7N
zO8`FuY#=bN^hL-WXcLchfzI_CU@nE6J=TQ^W49=^taY%+u#GGL+xX!BW*b?+);IeK
z3E#l{u#MY=j=KAOOh=ht9xj6eW`qXJzz$A1Y^Q8T+cvTZ+BPEYdpb^Nov@864z>|-
zkIJ~?+D4H~*v4o+(p`gegDs#)qAj2+O@9lBG`0m~V_<`Jey0UwWBOabC@kRnN}_H_
z9Jl|)EMWAw7Lc8Q(jWZaEg(A~X82+Nq!MN|pm&SidxQmKHOd0Ag1!*jdt3`RIjLY~
z?Fmz{5m3P?X$fiN<45LXN(%`2wZz(DkOh=&A=*0ZlA#)I^~&gIcu@_;k-+#uKN}<V
z{}SVf$gvKTOK|?Twwb%jFY08+UV9BTGn?MtcOR<}TIRNyALOPComuLqx0er1`9Ijq
zF|e<fOZ$p9!1~?2T&?h39zx9M#ySBw|NouEjD}&uyI{jHh6`JJ+%f!6Oo7o_eJ3IP
z25BkvDETy0L|91{fR%g@*5pQQUp`=dSjp|cd|zX>unDk|JAuI-=F)B+0Onzd!O02|
za|@dQD=E_4tTAhm<~@nIWf108jk%tUfdv$~exNZsXcSiRePC{jr8xm<1cyJ2VQPT6
z1(;0&10VD?Sme#Hw$QDiur9Bys#lH|G2Ww7;mHbbSjN0pa&8%&x_LA1)%YO3T9E#?
z@X5qVPuq8NYYAbqYZuKM;7l@d`Q<&fn%Gy-GyZ4)Y65cL4HQ}v^W^<~GO^WsbnmQl
ztHm&0ea`irOMB@0nyLBY#^q0~>ACDOSo`nFEv&GUyQybs=karILD~3NZeZEcyAv~4
z;uBT)O%ACGC;O5Ti_0g5eBMzmk|!l3#wSi2SCE()9~2`|7=BV0+YIX1S8o9I!QP*m
zbro)Cd3eIaNckcwe@sStD$XtnPbe5O94{QOR{u)WzOWFr|Jl&Yp~=aaX@!0OdEzQc
zETC5!netl{?2#ZmX!tn7SAMdyz9)LgwF|CmsGUm>Uw?h4957`1z87NYAupZ&w#(`-
zik^A=^slll@N!^PnD8t0QcNi!o%zAZzSQJk@suL3Z&dUuo5)E?aS4gj3P;5cOAM;w
z6~7qMHe-YrtB$@+CYtUigXIz3ugJ4WgT(POH73&N2`r)Sd}(<x<1X}ESVLhm<ab<{
z=Z^lMX=!VuY*zKyg20He)w9ak6+JyY)zb>bV#cZ(T-p@G>Zn*d+PTGImgsL?xx@8K
zm#_poJ1F&|fH|~&{<xJ)2eNbD37)vq>audZ-hv_*UDjUW^?Ije4o}R9FRZuei&l5|
zn>d)i;=xkYvp4;?j^t0s%N9pw1;!VQ&&?8Q2eQ+q73Ab#+V1+Kp-Cx89?#gx08$eL
zAX*RJTe6gFe{I{<w4&A4HYrP6+t3ov#L_$3c4tq0XY_2{l0x>b^sgd)vRKV3watEt
z5tATFvv>Ht$rTF=#(KS@ZCzvSCwSvirjE=>9PS-i@1nH<w6gIn#ql&v%S2QC>v5zJ
zeZ6aaSHqmSY|~(2T;JMy+G&{6SRDNv`=Y-He(_oYr>5iUKz#qLb_@|V1WyEVv(Ckn
z#@v*d+q!LAYhl5inK?Z@IFR9@NoQp@51Bl4+qP{x#>~v<92(Az-bmNcb9;}1a#LRg
zcG6pCWC%-zxBlW&yiia~iQ=82INCs-pddB^4Gp{ZoJ$ji@i^l3&OCd4!f-2&$6sCh
z&Xf2u|E-);hx^O3agJp=83Q<bZUIiToQ;^enGg$3lG~1x<W__G@nSbCF(Qba1;kDr
zYTk92u!ds4j@Xy&>Z2p<^`ahyTg8q8asIiX$lNJ$0{--@A!CL49y6qPx470~TY`r&
zM|~7JeZr(!!H=+)!|cpamu>bGjw}oW5O|31L-E`O&uE`GHwSHILYDZZj>H9nSk$_g
z7xp$|)H8G}$Ik8I00BbYkB)9fkcWty>21BuNT$=RS5$m7luBpg7^B%iq`8&edSsuS
zLX-naNFfR3k@wr9qd`n2>s{5`iZ)o-7s37;V`2T!x`Uqb#PMiYECl(J3fJ>q^x3C>
zMSQ>M_t^K+JaXB*=%jh@Ko<5*6g07T6hk@2^d7wTR(}&|oZwzEn5Hg(32acB##30~
zaT*po*q^Ln6VC{zX_!NLb2Mz>xoN(JJ*e$D8unt1`!Wstkhe+0aab+Zrr~(dS*zg$
z?D%j2w1t@1`N4SH5MG3UiIGFfG)#>oa<+z<F^#O!uxU&pVrP7jo*P;6<Uj#i#su=2
z#)BK0u3@h+g!X9IXUw42YB(NehwjyIf(uS0BblY~Nk)-bsNqZ_%RE=X5Ne^RX+oZ3
z&CME5jVb1H8fHei`Gtl}BZ0?hm>XWMc_WsQ#`84ZV_;ix4dd;wU3cO`-f0?-*#Tao
z;dszlq~Qc(2w$q<M5OP~a1v-<T-jXL+1a$bV0l|>XIDq}@~)<~*2?C#&W8GasEUrZ
z)eWr$4d->&HFp*?H?6Ge>h5UhoL46jF01P(SaD`U)5^xK1&vLuRXtrDb+g2s4CXbg
z>~5~>IK831sk>!<LrYUdTXVhm$#eq1mzHftyK%nJ0o_<>G#Xt-0qlcc{tAo*z%&3e
z17R25YIYcPNY{$5{0i^|V;i70K()ZP8LN<Hxy)Z~bmQ6xT!&0qDCu^goKEaTeFFYh
zf{IAd4egwQTx~`Ru!BoE9?mXz{BhDdT+IVFD?z^*9Cx5LQ?P%TANvZPh+Gvi99Scp
z?quvc<jy;oE2or#0cp=bPEqG3)TmWT(k^!}mH%6LO;VzDpxuR%>Wq4n*dpt=8n`xN
z1;W8)6(H9Xq@RKmQ;ri~i?(QjteVh9?VvCllIxJt6S!8aL@F?5$~twT+&W;oB)$N$
z6f$lAW;Np13~K4Muq|s*<|?G=LTfu3WVgG}F;%N-S%T2O`G8g+{aRTwp@Axe;AXij
ztrKBA@ZBg`$e;tT&?u31K5XPHT<4%Jg0lkbf-TxZP@dI~f~eQPHVc4T@l)D=ymD=B
z>QG<NAB2uAlTs)E$4avcfD`4G8*_23L)lYt75&TI4?0mB(ev7Y6)hw*rx{n#b5^29
z%mIa2|HoW|wZPW6O387jENwZs68%r~X`xZwxD#zFFd|(W@JiC(mP%NKHnhHybc1mo
zXw)I6uo0rYR?6B7eQE%19`0<4%K(dZTY+8E8e~c#AEghiMwQVcIjWOwrfidFJq4XE
zxoSdLEog7i2b!RZZ78umc6BJ&F{go|;7w@JJfs#qrxhceJTC^%`whZ3Qez>mu|Mk%
z07n}y5G<l3CgDUZ|MnWsV>hHY5>FCHqOpu58NVdSB!#4c_5;R7G6d^y#~QsxAHFyl
zO42Z%e~i_g>3Cvnz)@})#%_{HvPd?`A-TqjB#-19FOdR*Z&Ao7G8$gm1Tw}rjAhm1
zNFf<-Oe7P?MD)X#$t2?y<5lAbnQZ)lOd;6Wi3G5!4i=7tj1x#$e5^!@jrU>g0;GhL
zlBwiGNH}QhA=8XMl9R~E<P=gy%8iwz!uS)ZB-2S1sV1kA8gd$$L1vO!#!cjO<5$LZ
zSj>OGVn)bpGKbU}MP#n=cjG9TN9L0SWFg*xok7kdi^y3xQ)4e#Z2TFgDSyv+ot#b1
zA?K1MWGSg5%gAz4Pa4PyvJz`Ir;<j}L{^d2u)oucPf4@!Thc;WNgHV==NTuF4!oi6
zBweJNtRZVj4>_N#BNt%jl_qi_xrkg$E+Om5rQ|YWHMyKzL9QfMk*kenvcXtIt|8Zw
z>(G)d#%6LoG^g5#62oXCH;@~#lfWnB`|t*8jCQh-++=i+n+Y}oBtIax8J*;ZWRr0o
z-q+nh?j(1SAHj0WAa@(zkRM}5#h;KZ#!T$%e-AY94Wo<P3;$+~v6lRdY&E*c&&f9O
z3v$14I{77ez?e;bMYbDr$b;k|@-W#!er@~><KkShlRQEmCBGq$L7V3p=ab)($Bhff
z6XZ$qJF<)X-nbB_w5}shlV`}Y<T>&@*-c&`FOrwY%f?U0D>za1L1_0u^ofP!Rq_Y2
z$2f!h(fGhPMqVR-GOi(ejWfxgvD^0>WS_CfxESAlzG<vCE+ub~x5+!?UGi7s60)DX
zN8TrYBY!6!kPpd6<N*1Yd_q1o&N3F0&&WT>LF^CyJ>zWSGjhmyjQopyPX3KGAzvEj
zkgtr7$k*gB`Gy=JN69hLOQNI?rydbXu}amX94F`EEDd})5{DB%a8MjgqRBLcreej`
zP@0CFsMGPrHiKr;ESin?rMWbZ=3|BU2s)CEqNC{;c*o;tAstUAz*C+?C(|i7ea24%
zG)O}@r6)p*XfZ9p$vRW%iF6u0iJpwzrpk;T8F$liT0tx6bXtWydQYV_*vVuDok?fW
z)3JZ#99m1~(s|gAWC2}B&!A^wkH)j`Rpj^R+4y$)T)KoVrFHnqd^xSB4Ri(eE^MSt
zbQN8VeeqgoD{Z6g^gP-@J82i~rfcY0+C$IB^V$XULV6Lsm|jBH(@W`P^m2Ly-l1GY
zucjO5HS}6~9lf63KySoOpd0B;cu=_o4<bLHx6vQcP4sqp2fdTtMSn!^raz{e=}+hu
z`crxjy_eoce@3^`pVMvh7xaGmOZouz=G;ynqz}=D=??m9x|2RaAEm#ckI~=K$LSOF
zN%}jwi~gQIMW3e6&}Zp$^m)3QzCd53FVUCjEA&<R2fBy;k-kR%MEBxEir48IbRYc-
zeUrXL-=^=-cj;g0e)=ALpZ<;hoqj++q#w}(^ke!7{gi%2|3MGZf6_zrU-WbOZ~6uO
zl72<MribY_^awplj~RDjKhh}eV+JD($0{(Bac1FTUoZ3F3*2~?z!F&!OJ;bp#D=h;
zER79g>1;U5V3{n7WwRWX%ko%0D_|qoNNhGUnvG#&**I3n#<K}*BAdh}vnlKZ=4SyG
z#D@xD7GXuKnBk2lo61gP)7VMuWOfQGW96)ZRkG=<idC~ySq(dl&0sU-Gt@9Vr4PsR
zG@cAFE0DuxvD4XXHV4O2&Smr1e71lsWM{B5*&=opTg<-4&SvMZbJ-HMl-03iY&olE
z4QvHl$r@P`Tg6thX4b-5SsQC-=dljf$+}oKTf^3}9(F!k$1Y$OvWwWo>=L$~UCJ(F
zm$NI_mFy~ZHQT_hVb`+j*!AoNJWG9Hd}(~eZe-tQ8`(|lX3U8uW2IM~@e4eE{S<Q-
zTa2fTtBpi<3%iy5fZfJ^i0>yhvD@+1@)ULlyOZ6;euO8%1mj#|DV_(**xl^MY%}`_
z+roaz?qT<```FLeR`zqYjs3z%VfPyk84t5xVk~^dc-Giq{My)QJi;DezcPMqY{Q=a
zzr##8H{#fX>>>6r+rfU#cCts<qwF{AG4@;bID3LU$$rOnvEQ?&*wgG8_AGmjJ<oQt
z7ubvJCH69Vg}uuD!1k~|ve($3*k1N$_Bwlm?PGsoZ?d=8+w2|oF8eFn&)#G2v%j&w
zvk%yZ>?3x7eat>#pR&)`KiEO`Pj-m?i+#@i&Awn?vai_J>@fR=9bre=G1kkXtj{z|
zVp0Q2W|}59Ej*7tfiIstrq{U7^qFzSm1ewgo0(uHnn`A|nPR4zL(HLOnmNo&H;0=U
zW~P~CW}7)?u9;`%n+4_wbEG-S9Bqy<$C~5JLUX)1!JKGLGAEl;%o9w%88Cxp$PAki
zv&bwqOUzPps(GS0%{<9G**wK8Gt12iv(lVyR+-i2sb-CNnmNOqY0ffFH)or3@Qu=3
za~|GG{nI#PJPN<&`^E^Ytowm+t8t6*Gvglk8s)~#=6rL3xzIerJkz+#Tx8sV{TuEz
zHkoIci_PzuXPf7k=bB5*rFcGn&a5++naj<3v%y?pt~49XCUcd!+H5vk%vQ6_Y&Xv{
zJIqeA%j`DSm}|`*^L%rid4YMMd69Xsd5O8+ywtqRyxhFPywbeNyxQDgUSnQsUT0o!
z-eBHne&5_^-elfv-eTTr{=mG={GqwYyxqLRywkkP{E>OL`D1f4zPa0C{?xq3yw|+X
z{F%Ac{JFW!{DpbH`AhQw^H=6}^Fi|=^I>y``D=5h`H1<b`5W^w^S9>X<`d?V=I_j1
z=I_m?%%{y~%xBH#%;(MB<_qSF=1b<w<}2o_<{!*G<{!=1%s-iX%|Dy3n{Sx=%)gj#
zns1qJo9~$KntwI-o9~(Ln}0L^Zhl~XXntfKFh4dwF+VjwGyh@y#yn{L(>!GU%lzE@
zxA}$nrTLZlwRzb5#ynykHIJFSX4LHC1}B_y#!b$-#Xa21eb|j4o+t1`p2U-R3Qy%j
z_)wmPmF4MtIM3jjJd0=Z9G=Vbcs?)SBlt)@ijU@F_*g!U7xM9Z0-wky@yUD&KY{ys
zfCqVqhk1k-@nT-WOZilOBA>=j;wSS{co{F}6}*y9=T*F#pUP|aX?zBs$!GD?`D{Li
z*Ydf19-q$_@P+&gekNbU&*IoafuGIK;pg%td?~Nv%lL9$&l~s(zLGccCccWV=FPl?
zxAHdL&d=i=ypwnFZoY=E<vsj-zK&nOFXR{Ti}@vdJ-?J+#xLhr@GJRM{A#{|U&F8E
z*YWH54g5y_eZG<3#Bb)e@LTy0_-*`$d=tN&-@)(Xckv(byZMj#X8seth5wY_!|&zy
z@t^Un{O5cd{{_FF|B^qzf5o@+2l+$%VZMX^n(yR~@JIP?_+$LH{BiySf0F->@8ZAb
zPw}VuGyGZp9Dkng<}dIU`Ahs|{tADU|AFt}f8?+6Kk>c%&-``%2H(g3g0G}~#s=dm
z<2vJ7<9g$A{w9A5`zaqVF5_<-Pw{v7yZo<wKYx$E&;Q2%&OhKE@{jld{xScAf671O
z|KJDtKlvg4FaA0IH~)fv$-m-X^TYfbeuN+8$9OM~@;=M3h(#@CnK;qFvOJd8@>y|K
zyp>=jT1i&2m13n@L#&}znl;Qyw}x98R;HC@Wm`E`u9auyTLsn#Yos;G8f}fS##-a7
zLTkJ=!J24IvL;(otP?E16|jO<$O>B#tH>(0N~}_As&%3@%{s|C**e84v&yXstJ0co
zRaw>6saB13nl;0kY0a`uw`N;&tXgZXHP4!FEwC0^XIN)ii>$M(#n$(%v#oQibFC%T
zQmf8dW-Yhstp;m_wbE*|nygjUYOC35v0AM*tKB-!>aaSkF00#GW39D%tn;mP)&<su
z)<xFE)+N?@>r(47>vHP~>q_e?>uPI*b&Ykcb)9v+b%S-I^?hrjb(3|ob&GYY^#kiR
z>xb4R>vrQt<83?--eCOI*k`<Fyk)#&{Ka_Fc-Po(-C^Bn-DUmAy4(7(wb}ZKwZ;0W
zb&qwgb)WS!YpeBhYn$~8>wfE()&thBtnJo=)<f3A)(-2})=ujY>rv}B)??Oht;ek=
ztS7DCS-Y&?TTfX}ThCa}TF+U}Tf40ntQW19te34<tXHi+SbMBLTCZ7uvi4ekwqCd1
zu=ZJhvEH=avdWirG^}axbhkDIs>-X>wW3I0{rVcz*RZ(y1C`U&eYw0xzDj+s^OcwA
z`*MBNbjpLC@|L>g9c`_i^0t+2tqrR^<yCddySp0VE0;HQEbnev(cI7zS6ScIRkwV3
zLu;2ceR&;H<I>Sq*JV{nUacyLRHQ33%ayw5N?lZ?X1OvPR}~|tvuN%r$~{$@n<~wX
ztX-*HYgsFQpgL@wDocz%)nQVQ@&|&!xKm@)%^FN8#@9G$tkYbwt<<upEb*MCOFd1M
zYMs{A)Lh>XKf}qXsE3NISyDRItXPfxfl!4x3uRifRn%-(R5-$_T31?gT*Xe;m6@(9
zJzdLXx^BAZw%l|RR#x#jjcpyRN>tM|(^YmZooc$4dX+zMPGfiL%DRs3mgc(dF3%iY
zH7T8{^7uKOn5k`4oX*o17sHVvYre$B&mU0vU_dimDvR<5N~+BTkgv7CmAy!^<;VFB
z)<RdEt90F}iugjOE>)UfwU$VgT{m5)s;b0={pzw%*JYt<Ccdzv3Bp|{8_POVv3;h)
zw(rdPrUuL|H+5QPuI#8=(-41_6RE@rO*%_P>02p#e=ww_TU}x;mSp1=$CS!CbIS5H
z{^EF5o`h3eg-S$HtYn>5mLXwlrnr<O$o2>o$s21fE`cJe&Ly()YQ<7TvAzcMHKeZ*
zaYfJ94PP$r(erIfp!1cNs`TX*`l{)ahdgy!oOQad)io#)E_b99x7?|By=-TzK{9DI
z#9BR2RiSyU)MZxcGAcE%m65oH7#+>NW~-vY)1cXCaJoE5%4+z75t$BMK4PtuCC0CG
zxKk1chT>MnsGE(V%Qre{tfrVy{ekIzU(=N4w&l$W=FL=mRBEwQmU@~rA5Gc_G)cXZ
zWduXT@v9t~s@za<!s?YB4Gpc$b*=SH%dKW9Jr!44VKv7D1Pf7VHiJd0RSCGYuDuO!
zN!r>Q8?07WvTzY=fI_#qIkx+`7U^^?x9M86({-~?w?(g;zp|RQIX!K<u4R>-OQ)Ky
z8?Gvl*w(M7wP{%>t5Ff(=CT?cvJzH@i}6UY)v2o1IY3ImKq+r-Yh4M~Uf7B*S0-#|
zC&&i_6;`*q#(GFo_7QC+tpcvv_}lieO4q!qn0Grht<v(T*7B;dYp!ctRh`(~ucqC0
zO|?zwmNunZ*_5@aQfr+``PRm4%35Vp&UYe3eF9Zb)$`ppMYarVik5wKskKg$jawJf
z+T@iD9WBtJWzC&ame)0RS<S*O1mcxSX;_L*!rFLL${U~1ES*HQl7uaZ3i^c91tJ))
zL@!~LzbNF~pb_MawNhL{DnWHb-o&qzt)t->7oikaPjux9O0uD3r%%dAYn8Z!C1rFc
zd6VMmQxc)-9dXqgaID0LyWWvly^$nV?}*hR2o+gt#icl2HK2r3T&*Y(NwKEXX<bHo
zwLsZMS~6Rb>hA0^+FBtlrIrwIz#p&rg@$dW1AfJHL=Xx1t@Fht5P!bZ012nK6i6bH
z&bL)e-irJ}sdPr0$v{9yNW$_)=$Jc8sl2he#U&Wu9V-&B-J*eDO1GoGGGS7;yZE3g
zrAii$jIrYF2w8kEPIf_=UuTeo>qON7cZ|@qfSrB1`=(mn4C&WFb-e1O`bKqCc@ro5
zs|4d!r<Jg5nm}>9YN08eok2fP;v#KMIAC9;nec}L%5Mn=luZiz^;LPEh*w4_98jZf
z*l*`k4nsJgI(b<6NJy`St#CjYudrVkuW&$`BgEVHYM2WLlus27NQ3MT+k6IfIYG@|
z(B@C44{E-Gny;YdBdGZbN*4?CG(UcuzAitg`3q{k{B}B<Z@a#BIhtR;rtjC~`E@yd
zO($scr_1we{!8tvrjO?jF$RRybB;e;q1#10@8Dji(}O`+4+3H3?)t;ZvBXvLqg+aV
zxLO&Sa6ma&LMI{ga_ENc)o2mdO{qIZ8Zgzp{9%8U&?nWs!a<?OrCLNG&1y(Dk@6Y+
zVP)t2VH_4KOD(nIwFq${ro=~Vyk<S5MH$kf4B6#q5kz#8g|vu6_PuVBkQRAJi#)9P
z3+r;iTGV09S45`|YrevoudwDLtoaISe!`lch)rLYAJ+VZHDB6e3rB3e?fTl~XnrG_
zengiS(d9%mov_WHE-zxMjxAT64vwr+A)T&5*H<~tP$8X8c}{*D`lQk;-v_Fr`K!`=
zC=UWEq=uVtq(mr+)+g<-D}4&NwI<R}pX6w&#*c8=G0M;iw?2iHKJoJA_QpE1qM@sf
zpIX<_QYRS<m4-c4?VU~Vp3KFFVpWJ<&<Myp4Nv2IW?g%G9UezpmetqM)4S>HZn~%m
zk9$qxX`a?Lv3ZSce16l)mO8eeuG_Ovkz%!tO{@~X+Ri3bOnGUXEWfL*wXHKjmnd(%
zC{Y4FQJ{*~^wo`~DR1KDv@~Efk0c_J+k;55PGsM!LMyA|B>zqy3{?v2?=RtXQW(on
zPrgzJgV#4Schz|sv?$ggf{Dm3DT*c`iq%pS%~BMKenlm1?WR3Vo;D>9*3sCeOAhi*
zDU>b<rCST79RgX7A8vV@sE1F`Rh1Et&3vl+Mn!89@+Mi|*vZod+^Za#C3zDkOH-h%
zxJsfcD{s80tOOMQ%F*|Sl;e+UQJk#46keQ^7(lofN*oflx&uX}a6Y;N(<7l0b&<U}
z81M(xEqrhhS*b45)kXF|q*1qFMIaoIkztiF98!0(a|Z)~h`N=18@IX?H4NfjQz}=f
zRH0#2XjsQpskmx+iAW<B3<SgKRuvjig+??|m5G@PQ3X7T$cw6Gq*UFh0wb!xh$=9m
z3XG@%BdWk6Rmmb%$s$!=kt(l9l~<(7D^lg*SSnFokt(l9l~<(7E2{9VYv^d3A_8yM
z+BVS`CEm`a9trqbn_3$r6erib39!_+qG^plDhD9wFHr*Umq@FIduau6l~xZ|C3t^{
zv|_kdlJ}QLYleGiRdFp<tkk!*wRkblH$?)1CjrEDHR3^5g1!}P-5nYdtjKhNWtpxM
zGn1_fR6Gl;s)&SSbz8ezI%F9V5M>BJmmxq^hJr*HGMy+xrc-4|P?aGQN?{2|bc3M3
zSdDJ}3N<SEE7a)Vuh4QS)^aJ<aw*nwDb{i+)^aH>6}BAm3CfnxH^OTONb@ZuCvOsM
zS*bf)BJwUtGA9J!Bo(YWNn>{^Y3x=GBw${qRD~D23ollMYqrEl6evx0B=5erY3d3U
ztHe5|aNmReB&l4QPy1Hq3(5x-2v#N4`TSCMlVr2Xd;(IpGM~8BY^$WwNR_LZydZ`<
z)mqAz2>Js>zJ{LVuuOQ;RWYIINzg_-!D1Svp{~9`H?MMLg8oo--10VzfOsnIY{+hJ
z=xA!I7t_#~)~lBjIhExLWL*03<3u6V)yk#7RSx~ZVx>I6;v!|>ii=g}DlU>PL@=bh
zSzM(H6D+P&)d(r?7<lPY0I!s)RCl&g)!F=hH3x_4`V-IVM%Bc8eg{^#swyiVA9V{4
zX*?fOK&?yEWr|o1o7oTLjw$RPvkZ@$5C>MrE^$CfBCCHwOi|T=1sRpBqr{|uC~c^|
zcc;njk6Yr7OVM%74V|5mz%UnLNer8=v2~aYQnP3>afW2HxnYH7SwJ#k>~SJ=)!h;p
z<s?&DbeuFfgVLy^vYa7Kq%DCgi8`(v(?rzjhAzdhme?>iGFD+(Dv~NX=o!n<-c2i8
zRjEofm#B+GW%fh4V}|#SiItG1@#l3nbc(grl1!>b%H`A&lOlV|64hr!3#Ypf--dRw
z4^^rA6_VW_*Iyr0oI_xULb!D%S)pPz$>_w|ZH0?LlJ}9Z+a<?=WRfAe-Cb>(+YdFc
zFQnSBV!^p2G2D$=;&7g3SK8egLt{wEuq2Qk!`XmD=i7Hn1_3hOA?1{rU)PDA+0?mu
z$sj=H85Tpk1v)f_RnuP5Y&bf%q`j^~7*pN1GF>q-^_SGM2gGPqS0%gRTvc~rT}_bT
zLfe&>RI*$V4k)9>IQL7A3(8df<3@c)hGDJ@j-1_mbhl!V>0I8{(I870?aJUp4Upkb
zDd<=u$&5Muas4AxRHVZ}x(ne_x*-bfZe5*KM#zG6Ru_T6XeV`=O1BJ_%Y}^HE^&}~
zuIj=XE^%%p{VeBxU{t!h3(3ToSqqfrxY4dk%1Al%6|3o)V6pZOiq*6Y?$vWbv6`*N
zeX*~u6$58;Lz8|OF0QhwPDdxMPg-0xZ_b&gO<zzmzqVYx{KA0ir<L>MSYK7G#&CZ{
zwONn%4rWz%hkWu2`YW_cs9r4v{pD3Y;YtV}DjZ+m){Ku!BrI7Cs%es7P)*kagGF+>
zBN)WnV&O32y@t9*6jcoNK79MKvZEU$bqeLWhsu=~5md~Ag3h7l@<2&>7eO_bhZ1!O
z>P2xdh*ud9L`#gW_DX_P%6kd=)zx2I84rbPT2t5D(7L=q*Ft$b!BA;@Lr)W|O>0+E
zU9%UnxOhgj8O6t@vP#<NDpfN&!D2Pp77VFZh`1`oLgmVb4&t4e$QM$Rc(^J$p>pL;
z1&gIm9t>8gCJCy^Rftl#Pr)KBm<nCt5>=6MzY<)zUkRpMO*RID6?PM7y6W{J<fi%2
z&pN>p-88zPgSz2^Y6dG9^jF3y<#J?Nq~)YNz@YXBgX(=YSk|)Eo@1~o=mUw)?q!_~
zy0uFp-iDU;uJeJ2Yi?WFgx5HDq2tqFTSr2Z@LD??<d;z#a>J4fDRn)S>aVcXKs%eI
zs<xq0#agITNi9^Woz!xzUg~vxb(Ln-U#z7XyK1Sa`Nd#R&EG-IiV`{+#Oe-JizNF7
zK80PW(tvVsL)xJYsbwW-Y2AWq2?g#o&*gS{t>RiUf@+Qrs$SyhY-(vjPg8X-)tZN?
zE-4FJb95bps&2ucu4}MFYm%B%4F=WpJg&AzsPcnFp@eq4UPVn@EmU0L?d)FO*wt94
znk*3ZC)uf7l@6*kG$>Rv=MVcZ*97rk%usBGD|}#A`1Ez^F(#;%Fd&a^L^bIM#<ZYx
zBL;P&21~Wdmlh?7*DvVa-OXK1?ak+Fxs=8!bbE7mr>Cx?qit<>yNn8y7RSkZ>1t|J
ziBF>H+tw<b3Y3;AjPL?<nj(c+*4EXipzij1JGIiVfNtf0mU=)-J)m1Lpal}pl?>?C
z4rqH2P&27m`=R<@KpVb*S`icsRF*2%@$lE(o~T$})+{TMVBd*4#BK!pu^Yj;s*8G?
z9So=$TU@nW@+&P0X+v79wW?SPy;wIwv94cnwQ8*5YNa*B)yj@U^ju3s&$UD_*HYiQ
z49f;q%km?7t|g-9S|TOIT*tP%Qt8qoT4y8Lx<yK+dzx3c(v>I`iIk{*8-exe=yJuE
zDlQ|Xipxl;=2ELrM7@u|LJ6H;t6W6aI-+YG(Y21CZ#8#e1yFqhm!YSAwYrKP7^$qb
zl;)|bYSSH2i<5#8HR}i)qM4~w#wDVMf=Fdm9J*cWvhL<)Z5Si^AvvNJhoFQK%yA*Q
zepy?ODn$4Ch}M^gwk{Ffz7gHN5$z>JwD%B!w}2<Ex|O<XMDWr`-fO*%sFi2Ih@KOQ
zs5b(*SNa~oG8LJ=qf1?zS15jT=Z)yc{)iqwB6^&PXnl^T6>XrWTS(1C;a*v(h#sGC
z0+OPutsu@$)A!1PM~YN`iRkHxh<bApjHow6!H9M}B5J_|?(KZKT=gae>6O8Xs5eu=
zh<d3RjHs7_!H9MgB6<QMqTUQ4Uh^AJ<90;7EJS)OC-o9Ch%@9B-$ge6cKOQsM#4IM
zSko)knyuc5fgjDEdI<^ox;#A>7b#YQY(!79MD#REM2}<<?GHrMOGgYUT5jr%80hQr
zitYMne$~rd@UP?5%TCl=^P^{}B0<f+cKIS9`(D>Cq<fh5k0RPdjA-W|qMe9{b|NC$
zS%_%=Dx&?Nh;}X_VcmJun=aHx^BdH7^^zKL()Zdgis-q`NU@Dq_AjCx!-$^ijA(lp
z(f(6J&xJ;c?Rx2UR4=U|KYg!W)&}u5K()8FrxEqi8gkV7tX}dWoxa!pV?@0X1zxw0
z_PZkLO(XPI^Q+!yLT~MKTCcSO98oW^!Izf1dP$CZU7mU~iE?bY+37Sr_0k;awVoE~
zbZR;f<!U~(KN`^<R78775%tCtdZN?mIr)fs!wS5n8_@F9{%oX3>$Q5ribWZU-;ma0
z9HJ!U8d7g)gCQ-SP?4e+(sB%GK0;a#Lt0)TT~0{z8&YpZK}YF#NXs*%>lM=WB&78&
zr0r2i>s?6eb4c5fkk-SHwoBr41~E2-bUzL0{vXnE3~9NBbUzAdJqzjn8PX$INXs*%
z^(v(88204Q@=$UN>3$Z{`V-Q2Go<@VNb5&P>r+Vg|B$v%A>A)S_H?f9has&mA#L|U
z`sEUigHz?(?WOf1r2AP&>w8G|^N?=;kk-49w#y;i|3g~8L%P3*v|SHry$D5gJ8SzM
z()Kc>?R=4*PA<~^SCJkci?#hM*7{tm7M%o(Lq$XIxZm2g7K7@_20VpgX<>7UeCBV*
zB(X+VElsUh*KOeuq^-4H);ORk2E@EPrWIQ-QCuIttf9GC=aH$x+D?W_DiW91;nC8L
z9fn0tV*G8G*MMCdTHSd<+UACIpAG3TC#3sIC{Q`9zOD<~JG8E@>ReveZgZK4x4jKr
z_FYDO!<we$4V9`&)p#?d3mM)oVos}_A+sNTfq1KR+#Czmw)JDTq<lz2YyF%RYIg}8
zl_F6K8hW}kB10iM>RLNnny}qPn_cJJK@k<gUDVl<8d~vO-f_OZO>A&iI1SEF!~6zJ
z+Tks)UA<&HYqV51G}P-X!&Y{*b+->pm5pVOP3s_=y5<FSaJlNl#IVkxG`ggeH@0<m
zs>c?r4OUn^{$Xn<eXs0WNZYf3S{V@xs6{rxkRBgGl~u{jcxCD0E2~w!^T(4=`5^sE
zYHe66Qfq$VTj3J+<E>g-t7<jMRM@?)T3dl?<qd@Vk@OBw>8KxA{rHZCb}W#TGb2fz
zjZG`MPP1#DEN|y@+YOh{>FNl>I=kvRy5_8?!TTnxAJ<F`(O6e=r;4Y?uBI;Z8l5P;
z^ZeH3jaXj+p`KRXY@?+Z1KN=fl$58zTy_m)Hxti`U1C~bP+KL{wTS0WOc#jxCutn~
z!D?xga4pVIb5s2$-sMEqFfpgTM9*A_Szw9HbzukR$&Hn@BnGJ|JW=$x7|w}xASYd>
zlg^prl*|vQ>l!#+nBgRjL6X$S*sW8B1IZ+5P7<e}WHDW-UNOl;!=3wn6&@<^&ifsi
zc9@N`-_}TMg2dV{#q^E42v}2)Qa_m^!-eQq=ny-?;Wy1jx#xM41ky>99=q*FO_uA<
zHuN~kkR)aamWV*IHZ*qY;8G>dO(;c{?S3WXLbw<kuF&qeU0I6G@2Y`LDBiTV@@Kfw
zZU%;^2sbLLAF7`q(o~ex?bxfNbcIw?-V#;<&@|l*nB5=Ok9MXVr{C?#83{>gh#lj+
z1Bs!W^0MqyiXD9?38dLkZe)xXJJO}gF<N$<Q%sJH8gNz3AtmD?G~9)73nI;phtkR1
z8E&K|FC&zR(XVqwB8g3w$sL&}n)2Rx37jVrX}!@DT>K4@(e|q>Nj9q=s$UZ&$|#%N
zRQpbJNf)1@59!|kth-JrGPlcYs@fl?V~vz4U2lj6S0hO#iS@no*lj=dmB5^)94eD3
zb?ILPg>zCWYwp7KqpKQO#k#Ag8bskmQBoR8YVKr;`B(zg*pf9@Ln&Gg!;+S&fJDZ!
zXU1;vGOXW=e??*dGDjwNko_u_KQPisC(Bm?bzWvEK`2Auu3@^9&)o@zxX^WK4Z?62
z%1t55g?B*7#7O7fRpWm3Q01!?_AaA1%+;Whlzc~)?ZUbeJMYhm^b<yrdb08BClp+@
z)1cmv_=9@cw0=W_d-+7{*9%*4E%wQU{L9-~migp&0Rj?k4B{%{)wOa8zC_VDIRk<?
z>8s%?Jx5&2eey#YSMG3PV_Vzmx@B!^;2p(i${87dNH4Pw1u7D-<OdHLZEKxGdJVgF
zOZ_3emOZ4`u<OTYzkck(wL~!*EE0^0RY+h6tDdk@NZ;Vw1l%OWs;X{d^>ru3f?X#c
zmSZ_LSl8>^U~QIjgXO=tNs39p9T%22L;A_W9goGXF+u?>19ooQg^RCp5R>W_mMd*g
zm7;13F*sDPudVCGEtDV@Ajb*|sge`z1*<YD38krzedTSO{^SFh;`ApZf+hDyR5D$%
z(sJ=eN#)a@z=(YMa}$6*@p+YsmvWO}y!~|t5^%K`R)#V%#+*dOOHx8<mY=Wnv<S@}
zaKU~TT<U^D8pg`2Sb725=>=@37jP&=sg$HIS#cr!0})uL2ku=du<F}E$T9~a`q7Z3
z4@{wGh(1__cij3aXP0m<`(%}0eKLWo#;cW(xDO@iFB#FE!knfw*=nQ_=In*DX0iFT
zl?HYRBiQ9L8CNDwmJomB@7PLg3U(7a9aymk=MwDtM2vO#C&q=?)qoh+;LCaJ-feu2
z@C)M@!YK9zBP1RBe-SbQdvy`)(S<!e$t-dq!i%v#6cM{aA>2)NBYY8iLlNu+^*X|R
z*zbv8uc!S8-zR@V_%TjjC)m{q^yMy2gnUhU0rydA5bW7xBD5&>AH{x62?&#E3c{f@
z3t=A3Ls&pZBOFVy|0wojnu0Juix8I3QiLZ`aEP6lPC{5ls}a^vaErZ{<{+F)u?s2o
zTsjlsS#&W%?6`z*30;D)j@BVuPU{h_peqnI(N=`*v>W01^n8RD&<hY^mnDRk(n}Fu
zPA^Az4ZQ~8b@V!fH{xszf_;^4M|c;#3*mOU9pTFqlEH2@Pa}MuJ&*7e_6LKA-7pYt
z<J%BE%OOeZJh2Dir{Y9u>>2S7gNU6Va6omVb&0{S3&K4JAGV%Gh`k5UMxu=kaRP`T
z&IT&OeSB<Jg&Sf!A7I}Dv^@irHHLwm6z(#TB^5{&*cR->@FPG5c6k-lM&nn4-wfdB
zE@Kx!LAuPq9zR06jE}xL+Ka=OndON~!~U)UM?U+<S2*xIIW4o$SO|>Rw~pL=^ZTPe
zP5sO~n0zqp^8=rg&l5gR{Njr*Qoc05O#14puM)q?`>OD(X<sLOoqYJ<Vb9@&Z@k|m
zev|yokZ%f(q#k|e=toD79_2@UN7IfCJvRARsQ1I(PkN)htk=_9&^sZ@qj5No<g-2w
zJtEloE>rIW#i$4S^ib1-9X5_)e-)2)%yZNe^?u_0%-idw*ba*Nym2%xF7aR@P4pzO
zw9hg>lC@7q&Ev55&?M|FHw`<r;l!xv)w32DIhc%T#ok7=rLJSOQP#4$Wi|F}>p=}o
zS@(<e^)l=z3!O!8f{-P&0e1?zR!T%l1+ffw47tLFw|sF`ff2^aR}sz=;mq>I2v46g
z3*o#urz2b-WAT|YV7d3dqC<=d0$nv0&=(P&VLoSYw##Y+d?Wq|_E%aXVh!jaIbeJU
zc!-gMa5UPH=H}%V0(M%TN-aS9=VGVfT<AcquopsSE<tsK=4D8o@oVfrO^VMQk`v9%
z$@Stl1phg?V{`qvQ&GmZYorP4*f1G;gRC*Q)XOC7!0|M8pTfx$IbRL<9qWIeYsKy-
z=O*AkJ+~m|{hR~hKX*cIIQQh-nw*2V^K#G5U6I?KyDsO8ToA_p6}dO&Zpz(~a|H1H
zxjXT{EBD3Ry}9q^9?1PX_n7?0b}D%(d08lfVyCX9*qzZpi}&Ef*Bi0RTe|UMV>9+p
zd>sFUu$%7~<H<<uZ8(9P2s>E@3waLCNUbLg#(c68=j<%Ru7De`Bi?q{%(Kaxu#Iil
zsg4@$(z2b0o#LvE4rz-zvCmtJ(Ist5x3n#5uw&b;##(75E|6B@LTM!~l2+nkX(cYf
zj+_Q$t$rhMt=2G30f^!4_~Tu1>{M<UepB#+j!9VD|2Mzm(Hn^SZaV98w)}toe^<``
z_P-;?{{PSUp3JfT|8rWALe$QEwR3IBc>w=ga~=?9$Yrn7zh$_>hRFLy7v7E^d?neh
z88i#J>iRLjX7=0oJ%``Rh=cXc-iY6N{IIuZHgsCT;{HGXNcM;Q=+i9hN$o1n;eRlH
zPTY5wL$O1q@J|fspPVE8leN-6>5=})<<dXdC;gL8q<`{n;h$iyQ}`z&P539+cNG2!
znI`-b?BNOj1p8jXKf%tI@K4CEg@1y5FX5k%UBW-X4wvvx5D)(ZDd3+V)fePT>|+W4
zgzOdm33*HSC*-ffKOy^te?mSG{t5X|_$TCm=*8ra*gul|OY9#>{w=%|@}=-n$k)P4
zA%}&RLZZS;!9JB`=<(7&!5)?HPq0fR{1Z@we}Ww<;h$iKO86((qZ0lJcBzDaf}JYi
zpJ2C2_$Sz}68;HFg@1zGD&e1CpGx>A*sBu$3HGame}b~%pJ3NY_$S!868;JJfPaD=
zEa9JE=Suh|@Rs18VDC!!C-fBIpU^VlpU`sQpU?{7pU^5{dFZLa-+)IoBg<<TS!wxy
zH;jDfse&>ev!Sf9HY9L)7m9Qa&Ve!)xYG@!l6|r}R#C~Wv2oe+Y{;Qf0Nqwp1b;fm
zE*qD<DF$t^A*UYMSJ=4h`)x?YLJxH<1?1o|4;e-#MknC>Hk1ke6wZlta9LCBSer^#
zmIEpIftm}Ke-LFKE}+0pk3oyR6PoRg&AL|RMH^`<7-uzvky}CecskIy^)@8R)p>8V
zaaniApshCK;tvwfN|Vxf$d0w^hL}D0fhNMoW6*Qo35gtU${a#_R9;<%TS5b+miZb=
zmpUmR726+DS|V`SJ3%>3K!Ve}3ngxsjZ^v}aZ+FGbSj6^5`oLl5jiBMhhvZ<4MBN^
zh|Nw1KWLq-tZcNWh8!HAY@xqdu5<;!!K2R(yCfN-tZFGJ+cH3Ir!=X>A~wsLm6VlM
zaCTN!{xTcNd~7h3eX<*uccI9UU1Q_2=h;x^0vjqwupv=~&aunJWpA>f%&j(*eYOn=
zoX)Yr#$~t1pmjEsx!8uXx7d&<P1H=(E%Rk1`}}1#lzqRG4k=X2#H8j(^1J2tpVKMI
z$CJIC_q+5IoXLJJbVESdH;OhAx@$w3j}3+j5^S8vA>;?`*k$9gH`&nf=zVvN?ECG!
znTu^Gdy5T;yh`HPSJ*fwhh1OM9=61fCtcO^1fA?%b~-1A1ATX1kuLAT{!~<7l{nc~
zCFJS>sx;99Y{+gm=(w~3z{l*aZ9xPTJDp+tXYN%$clulAyU71lK5T9-v`|5r9X6Ex
zq74aLPL@dL;IjAHvDq;yPF@GfK47PFQTg1)WgoMl94iK;*pT2)m76o##^p?jK_xci
z)FY?D#^Je9*C-3tO#S6cdo5t6EemQOxp@MYGb;w2VMDIi7%pe29cxp`+$YM={R3qv
zC{v6dvd<h3$_=_>RZq#CX5++@k;<D}YeNOFv<l}yqFj|X?<zYsZ(|JFZ$pj@^1g`S
zpr_hKphlV3LIg(6DjUjN@m)|(mmQmPaSYm^=w)T)+-yVnpqiDIRRD>#<F`UUId{dN
z`@Rbjc~y=9&^k$FyB(YJSPXi`hMXKZuf}k<qTk#tYq>85y>CNyTY_K6MfH>djCtxW
zHx9LY4RKjHpV^Ru6Ofn($jZt^av{^qW+ztZhM*(#R7qU)H!XYMa`R+tha0Cj5L&F#
zWzm9@MeAqo%YV~`GN1b{C^zVi6<U(HFL#=a%dL(<wKh~R!G=U>Do5T`HZE_Y4Q2M&
zQ0`(I5;$E(y^YIljX|*-nRnT^y!|#LN)r-5U1co=q-rUkyf2(|wls1tgVe4Uu`cP}
z1{{9KvA~8h(H9ghQ^al-u}%(Q4|FR$XG2b`>a}(b)gGA_qZO~fZ{L50au11gs8Lw;
zTGU8GXt(cx&<Z*>cUuhF5rdwLLAz~8lp$n~nqOt(&{~>G-aWv-F6xnYM+_3U2PE#%
z81AVU^s)`1wQMT;ZAg?Raw5$qHV$p1(>d~UpySC|*)T~(S}p-OIUMM_^NMtN=r;&s
zRFwUbxczpkDyt`OHf7O|R4m$3w|?e6n=AB`x1lc|iX6G<_Zo6=fbu5E*nT*bPT+->
z<R1CYkkFFcBZ8|;*gK*3HYB)GxZ^>2rX4GI)_IX5e~+M&mlT6CVo(wAWiobT403P+
zk~PZfkCQoUsX6jfoDS?gw){ZrDqHr)v#f%i`g3AM56wGQU`78`km$b}60waU*5So&
zLDU~LSG+hJh;;v}ZU`;Ti;BA0km{=f=Rm553Y_YB0#ZFsLbB&c=pOXT*JZ!FBL)fF
z0}}UW4EIzFdfA3l&y!SS&l8ZcB@!olo`hu2ld%}L^jI+flJgreTqb(A`pXAS{bg=J
zo#k_U{tz1yEu;RNHga&n?;IFwd#~UlR+<e7?{)BVk24G5PG?g-UKtJt-v()&6xR1E
zK`9e<E^~)~R2gC%cb>6bPsjc0E7C&}W7QRqAHS&*HyzMy{1(|f+muCY=2kn0;zQht
z($t^hqq}joTpXN3*^z1gdMJ91gd86@bC)j6$X{bas?P|mQ~g6gu0DvKqBSShFGY`1
ze~uTFzuv|{6SX(u^hU>5c5qI=ba4I4RTRHF*74?C(5+~JyG8Ef(aVpuLjFTBp3~e=
z7R`TLNkd^ByCEPOXV=of<wGvY#yaH+JEZ;`oKqv03}mnP*4}s!l+|3COoy7qp7?A?
z`k*=%@yCU1Z5kYFQxUulj1^oBo-MO;sB#BWR{HGpsN+!{fa|Agy05+qeq`%p9uuj>
zpQCk-B;8s!*xzvFEs!J-I5=fHRS$6Tx}ZV&?3C;H?fu(Vl_Dgm{xTuM%ufXD^o79|
z&K>Ktf}2xK4sB#h+<AJEkbD9%Sl<qMt55U+*7q2z@!cVzxpb@#V<m7VpqnM+p>O(b
z6i{?;pM|qraaL&bt-grwD#QyMPDl1_2J~WIiVq{Mj&1dI$=DRcwoB+FK+QPIe6LLN
zBJP$cs(|VNk?1!#Z5{D4d_acZ;2d`neL#kLb$CorV>lz#w-3<6EY-J3()kjQ=&vFc
zR@QfygkU`p4;=j%&}D%B!b*M3KAZ*`-Ot*6wK~UxI(9G4<}rK;h{aj-zLPcOoxVjn
z-TQ{&eOu7O>G1~Q1#}B=djY-9_IjW36#@DSJLZ*gMC>}mJ|)v_0raGVHUoMLQqEyl
zcy~(5UjTwk5c@UT;@#?fAeL^MgpPS<iP*m3pj;!<eGUlqlsS%h%K(w+yL2qVoj99b
zz#@E6hI=J`FJQD29qZjH^WokrWJhq87xE!Q4m#az!0L?zk(Ml{E#AvSS_xe&%h-$a
z^Uz9UC}@2KTCIu}sY0Dr30^^Ug-A&PqQ%Gp2~WaFz=X_|nDL@CGG4SW$sjEV0}>u7
z@Wv7Pdte$>uBcc`Qzm1}WUjdqE)txQkun^oLS2d|afVDeN#_zN%Tz3QMp-hpP=yj7
zkQ4$E9;fo^Q0AqNBiAHNL2x?*Fe9ju^{9l-W;;D45()_Iv0g=N9dJSljNp`XkJNNh
z#CCe21Hdf+PRNCkvjAN$p(3>B6&l*^U1x1TY*F7tZ@X0iC?50*Wo!xC>ltnB5wYwR
z?>uX<gdX(PSla=eiFD9;K$8F^DTu!5F(ov%FU9&o$8NU{S)-B8j{}l1dH{L~Ii%Ja
zZ?c`%K8c&rm%<+tknt<}rX@90LKw-A19h;TlF%g5qNUNsj`90cUO=k8a{x(OLrw=}
z$)E8x+sWUR=|;1?I2R`hdLu=z;s*dtV($Y&FC~|v+<KXA3ewf{*JUjF9A7FSkz=QX
zAbUO!5CLT+$$;p6d^&Ie22OaHgf;`h>A`53E4XU6xqxQLG8V8cIA_QoOE*bEur?gJ
zO#;H&nGXT7SSl}&If_^*PAwWKVug(nXBVTi>435TEkU~bWx6m+wUi9P%xB#yV;2Co
zRK`YFyZMZS#tYkK!pa%f&^P%SfitdQ&+=v&y8`q?-(ciK<XtQwocG2RR0dwoFmDsF
z^kZw9d9zHHU<J)v0bNMP@;7CU3z1`wgt8&42@)#mOJNdcyp3{m1kN}FXo!qG8#$z<
zG8WS-nY16MC0f#)3d&tLcTMTgEOv!SWsW&G9c@4R5V4ckW)OQH(CMJkE-8PFGwSxs
zbmMTk+}kpCq@c$>K|1tl6L|!L5|mEfgxf;`XI$NvVs4PJXR<GN0k{@rK(86jnMUh>
zffL{!m$;Xadj+5xw$ofDbL4{Zxe_WuoRZqPeJS*Hi5p6WnzJNSf)nS$5_*J=HD%4o
zBP`XtU*g7qo|4))<h?`SV7K06UKv{k%1UY@5qqJ;tw!E8GToO*d_+PYB3AM8a^FPu
z8P@Ef9zw%tt*l2XeNyHPuu_~rxC^*5AvM_t$t0X8|C)@Qh`g_2^`NMEDw881TBeje
zKyMWEa4O(7Dl`Ignd+C5gr3qhG8TGDMK41-K&^mYLAom><<)E_T`Hj>oK?4mE<@~7
zsAY%5l>w5rpNs&sO5#Q!?@|dB0(Z88fSacv(!y#a1S>@?3H=eVQzg_5?qN?*#$rH|
zBy=K9He5pv0e2ywJR-DdT=a96C1dA628uGQw%}j3!dRkY@CcT{Mad4G!!L6{epKoZ
zfws`kBo1SV%1fXTOzAG{I?h2Cyi8&b(mfcB7&!qe9$uEXaiWJ3*;*13t#uD#cgWaT
zfVN904CsCZfgbD+(xJWS-4Z$xkklOX)v<J=!r|Qdt8i8+HO8(-v@t}6^JO?ph6yq}
zMTQwN%#>lZ45!I(fecTS;i(AmhmablA;fw(31`W0xD02>&?m#GGBjm46d^GbevHIS
zlA%~iLyZa<j+WtM8P1U5C>f4N2oosbkup>;1&kGg5_6IaN60W)hVcl|dDbH^2ts0b
zBrNb$=L$(!)uKkiC&+N342xx0CBvCAJQ*Qe6A9<aFinO<GMtSNj+}(&$#9Ac=gM$`
z41+SvkztAq%Vn4@L%}CC5@o1LDF94#iGIL{M@V%mq)K>>3=3r#KuBaPR+&o7I2ley
zh{0KgaR{kVDZ>&OiU(?}c1B1HCEJL^l*&-#qDHL@^AKX4D?$v{GE~w_0!$4>IV|Ba
zgv2lrN{+BrG=t<Aa*e2YzgQz`ZZ{^@;qwK)L!A4;|1Q>yo3Afl-qOyWk>NgUiXAZD
zMi?~TM;I~>APk!a5k|}}5Ehw75EgR-VF|YomhuFA&FSYu5C(V#!XVE>80Mo9M)(AT
zMcj|Dm=_@|;nNV7@(Qs@EUyuJ-1FHhu=^!{RUDSX7szn2442Aqg$$cz*dfCn8D5O<
zbX)o3olUJP_!XU<{s6xgVUTYW8^rP3!~qQaF7a6{-_nWAvH4c9fh>Q3yo__{3UKzE
zALq-J;lBpw#x26xaE&<stp{hkZNNEhn{XoAR%?6QMx3;^3*l~SPr_21nzr9M0MF~N
z$M6(-yq*+<g`NygfxH%a{GJj|nWx56>sjPk>S^?}dwNp0d)B8u=Goxc=-K4i<Js)l
zig1r-yXR5QF3)a2`#k#-+dT(7hdhV9hPTk`^`>|;yaj*?y?$?rx7J(ctwC7pUF2Qr
zZS=N#H+g%!>k)49Zt!kIxY@fkVX1e!_tB&>?=J6d?;h_y-0$}u@E-CW_8C5JQkgHs
zmw~XrSC~|WtKV0Gu*_HEtMx7NE%h}f6ebk<+I>9;*ZVg3Hu^UCHv6_F?(=Q;J({r8
zx68NNx5u{+_xpVZ62<k9?{J(E=Z#B=%ZMw8D~$8Ufnr=)TuowoTy5N<xTSH8i5YS2
zaXoSC<2J-?jN25q88KVqwj+ErZdcsyxIKXO#i8!F9*8@H@Nm2l?~PB1&xkLGFO2uc
zZ;mgCFN<FkUlU)8a8dly_(tG1$G6A##IKLv5Wg{g6YjRgZx`IhKN`Oa;qLf7@%!TU
z13D0Y2;t!bBf*=Hl8}*5fK>j3l7yuRWeGJ1YZDeBT$<3B(4Md%p(kNI!VL)<6E-Dm
zPS~2TJ>k)WT?xAr4kheK*q5+B;Q*jR35OGnL~mkBVn$*?Vj(#9Czd3YC6*=DAgoPX
z1kBRJMua_y>mj8Li5n4aO5BWaYvOi<k0$O)+?}`w(Eh{&iH8yoCq0^EBzcokk}{GC
zl0@71lRz=4CaE@QQPR?+#-#S7o}~3j8<I96<));~Nn4Y)1KO3eJ84hSzNGz02a*mY
z9Zoiqy~!!b8Oa67g~|TplH{`Fn&jH#MafH(8<X3Udy>~DZ%E#lyeWBe^48?-$&V)g
zKlZ*nFp47kzq)&-=boM`lY26`Lk`Yx$R!{mAYwpNL_|bH77<Yq(M8N;BC?2xh%6#1
zi^w9YhzN*?hzN+_BI~uvC4?gol8|$9C%;cs*W|)$SAXB%?~iXLU0v_htLxRPS5>d7
zyLT%Glq1Ub$|>c7QleDbh)r*^*}`mITZ*l-t(R?pZKy5FHrD>VZ6bbCZ8PzkW6N&-
zEwC-HEwQb(t-!U~wjRGtw(Yjv_Pw?PwgdLVwj;LhZKrG(Y$dj8JF)BSHhY-eYfrIv
zw)e6Run)Co*~i)^+NauQ+UMA_?F;Nn>?`c6?dz>02(d0z&zxJ2(=+Ev3O#eK%%W$`
zmEH8rxy?+^oZH6IGv~Io^vt=fgz7ssZxDp-%>My%cQE%u=I&(fN6g*D+>e>No4KDb
zcMo$vW$s?)?qlwL=6=T91I+!Lxd)khh`BE_cMWq_G4~bb{*Ae-nM-F5g76x1*W1Rx
zzr{8h?p9kC+-<gzaNlR4e`oHS%zY0oMjvQ)-0`jScX5~S752Xh>ilB^`<6P!T@}Z$
zD-lCObQl3FIOp#qZhX->3SUh2;wz!acz&QGzH#3bXZ3sFIf~w-A5QmPLx$iB?$?u%
zc&cCwxfS0vzk^I9lgYhg8omwx0C@-}%x9CwaMm@O_{mfF-tsdzX}*Lk#aDV)kd-)d
z{x^J!`3-!n_f7H^c?Vx#--7QZe}MDnACpgT(*FQCME*&>B>y7c;EV9b@HNcS_|E%z
zQb3CE)!#CF;kk;`;HjP_K@?=cAXo%NunSI{p2Zj@c!XFXK}Z%-g$$vy&`szeT!j;~
z{e^+THNp^Ks4!f(LC6wD3uA;^gt5Zy!X3gyVG_=_PZ6dH(}d~53}L45kT6S_EzA)f
z$LZU7Lbi~DGw<_-1;RpMk+2xww_nOQEO^0Pa9D``g2?n98Bp=o9UPv>;Y})R>&@YH
z{JxgsQ#rhn-&d%3dxQ$x>5~pf-|pdfFNfp!J%Qt?RfW=}aG0lSPgmhE`jidA!;bK9
z`pgWa_j0&hdP=Z7RyADV^|op_yikpAspa=-6>lq6Ve~e}7aMFlG#^_9hdG~YL3$qF
zR?ov5ReC$(u=0ug9?X~X#j;qXR~%}%C6~uPufnzq94_E+A*Y-4t8{9)f2AJQH9S4o
z$!Iw(ZZ%!#B^5SvILIen4+~~zj32OJvHNyTH%*1j=Q%uy!^b&2Zx7oljz6g4L(M82
zYU6bCRoJ#bg~RF7F_i!GsUF<j6)Nlw@_!Z&pUvab=jkZ@;~bvL;dv@-`AUV&SsXsd
z;US!UBB$qkcJuPOSF7RfwQ9I~J*OYc>4Wiya(FloAHm^~9EJ{L<r~dm=tl<M!r`$T
z9>?MF9G;-UmN*qQt>Q43C(}|+KY-H@;_x3_zL1@2`XRe{`oB_NbB;=HtmgLskJpQr
zvp0wPa=1T-+ttH7h{xZlhMRkHcr&L@;PI0<9F&_>4yW_*jvVgH;jSud;{Dt>mBYN>
z89Cogc|1SfUPj)2CN59Lp=vyZ_fw@<g<V`;TwGq1Q))U&Fg@Pyl;a$KlBd%`$K+l)
z%fos9QZ8_~;HUFdN_cn~59j?x;rutnso~gxVDg8(6_$_5!Qmx5-VvV8S1N3*<>9mW
zeHO=aei^25nAguRk<)QLD$96!%X#`MILz}`czKjpc{*!&d_GPnOE~>f9=?!=8~I(&
z)1Axd=5e}dDy-*vQD4aErgA!7Ze==$XYlZu9DYcJ9lU)Ve0)$Q^YAI^T_3CmueZYW
zNGm$EJ^#aem03I=&UbyUpDrJEzF2$eJ-obJUL9jOJ%^QBIL!5pGLFOJc|H@=yN>H`
z2k&2w6rL{cPmazU&Q$3gyj+gH93H^a4ddxXa5##?yqt=c!(1+P!S?uhI+c&STng{^
z3h(zys+y1e3pHK)kzdW1rDxy5>9=!w7cW<^pSG)qeHEwY<AY-6^j03<#$g99PcEll
zz{52>T;{Nz!$uDON_xt#lu!Ac{IeCR<q6J*TBXP2%=JC5*8r8y6@?i&!T8Jhu3gXL
zA5`gNu4lE&RlIf?zb{qq4nF>C7jS$K=6tg)QPY<<tKlx>Mf1bXhgzPu)Vp(#dbiC`
z@76gSE>Q1UUS4f~jvvGC$9Z_Vdbb}??~c(N&&OLWmjgSm5Be9&-!_!r9qL^Z;P(pk
zZa>e%JM()l^=`>y{1I&jZKt@e&@OV{3>fsNbc$Gys`^D^tF;fen=z{<c*j5-<p9<~
z5}ultu^!SB1J*<)V#d12N))V(?0DwbiRa2guto|cVOS@{VU3hP67lqGGM=67KvLVJ
zr1{+`#s3#&iujpQ{Wobv{()&l{efvk|AA?F{=l?i{=l@ne_&d%Kb02iYH$Qt3<QY?
zjzN%Y!O??s!-{Y>=>m6$g!e(%caZLIw@A<?(Ciqa?HjSy7wqfFRJdy-Xdj1}Ku0)a
zf|1@qr00QOLhgpUP+Cb{Q4cp)G{BuFen4Gv3*0%d9tie_q&KK5c7;1#q<KvjQ4;$U
z5&FSC1-1pjK2cgtUHVQ9`#8}AcNw`2?idz2lH3LVQ0)8)_PJyn+}YCWaQou@4T8Og
zfbqlLgVxU88GTo<r%I1f7d8vQo<ML4!tRk?r7kN^7=a$LJA`oRvJ}kN2@`C2;#Rmv
z#P@(F^gSK6UE*fA71;X`Y%`%V1gw1Vt`e*}k)tz<y0)^WGw=_Fo)DawP0(bv5zs3F
z#(ZckM<xOHYy-%XaEFkMz@$^Y*)quh=Hks7@C#08LL2zwbm86^chtg`f|cBC+`U-Q
zV@8J6p5UhC%;tD2?vDdDBh?bzF-kIeQN=5@xX&YkQVq)m+K0||DLrQ0LL^G4K+95k
zI%^KY2u)|(5yNpmihDiMLz&!@03Sj6D{(&n7&9K0F2(OcJd{V-3HmtPw*a1r`)1J3
z!hHkihv2>*@C@A1!tO!1qa_?uaYvqEBXLLC4x|^0e3TXNPbZ>dykj!lNqC#cVYH=)
zkpn*YFhXyEh7Y*)z>OfHGy^yhk{t{kiqMme0l@V~=wmEKUm}K_!dy;tbY<y12mT_y
zG9=_X;2MGRGP(rddN{C4;)npw#Bg5Vk{n^cxq-7YoC|qmD}WtFmfl>Hil!&q9wMTh
zrstq^_If;no?;CESH|d`0InKPi4{+$+lv|Qarg>R(svL;wC6G0Mx=KHWgcMNgFN;#
z9OdCoB8H}0Hv@+Ye1TLt)+5$-8%90Hs|@!h@_37g*2Q6K5Q0lu$I7w-<vWR17VV3H
z`#Zzs5;1JKbsBIe1=4#7>Gc9M$2tz_b!504q=)u!?XnI>$RvjIfqy8UwYO^v5uLPr
zH`3BOQ9e17r3_lD*FFd_&=T?u42OKJHrFEHkgt3d!y#WQapeFv6S%{2Z{!C4x#n0(
zfU97*(ZD$XiFR<?4nBi!0Hl-Bje})Kgw=`St_H3ExGc+d;7&1If5hzp+z<=pQ#!>-
zkWf2vv>mh_2W}3-L5l4&!11H7Fp2ib4EF$V;6s?kG7GpYhI<gW{zSA)4%r1<CU6~T
zJ!~6*8w2Z$Xj=_j2E)w;Zg5y%;J`mQoz*u2xXjS5h-(AxI);;hOK@%iT|IDFEN&V2
zGALvUa2J3Z#&Bp4=TcafL|Xz{a1+DD5z&pk2;jm%cUW42vRF}%9#%7O8is?eMvoQE
zUxXk9=m5$q^i~_n7kb2uHe=;GEGK~u`I_Gf0Z*}VrgX8uokYF~=2gIb!_vcuq3i&(
z*^IVSP;TVA5V(z?lg)F1Tgz~G$B^<B<fz_^`a^e6x~G9#3|yIcJaD-THy^l#$ajQm
z9dOyexoO=Ll+WDP^(t_be_;$a3Al8u!bD{(aFGmm3vf}6w}2Y~oQvUx17~)u0d4?r
zp$v!Go9Z1afCK+zh2g+IQ=tPTQYinzDb5x^+^=Zw#;jhHyE8f?=ngn$f)4zbUZ6N@
zBX~c<v>h$Q<WE`-9QbTnZ>6mVK1)j(T`_Pgs5Y{mMS50-D*%*dS^)PHaEB#7;)2hn
zIZkla%J?jIKv|{%Hx*;AXq!msWQ-`*?|>WY1YfLQFx&{>HlWR?n}!0nn&A?GTMj8Z
zYPJElh~bif%R$@(tnx(6^l5sXfSUoF%Z^@boeW%8RzC3Aq_IObtYd-e!f+#rXsmE{
z1#U2KsSMW}xU+Uzmd-4_G^B@`+Lswo2Wuw7;aye=TEZzB_kw>bC{B7<l>@76nhjho
z!(qgLof$gDG!;Dp{6qOtfCK;RV@>0LJIinw@fqDnBkG{iNsj;rz8I(4Q8o+Z%XnHo
z%O2pyTEJ7P6XbCWw+pzTmTkao0d6eAQHssRUT`<DJTUX16vh<GM&RB8?hZz`8MrVD
zxJ~tmJc!{a#X6%N?phW%3UNVUsJ5Wi7TO-yGCD}N<yFH4xado$8{Sk#DX^2e5;)42
zzKjmsv@ACqfV+&+Nf;3+g<-p8DR4`GyM@s$2ejCLa#&dVN*HY!#X<wpvMgY6Uj}Y5
zp!o*CRJS2LjJlSEfN~6T;AS%%MqtZ)<T2GU4><H;={1(e<7k~)oR}3YGa21l(9H(j
zP|FP9ri1QPM)weKy)4s!n+n`33`Z%Z7*gO)W^plJqZEcP%Ov0+&(b{5iIxf2$=WCE
zg%3JGG>KV|`;$a6Ojj0J#zFGG!h4-C@=J4oKMMR<%TU`9;Bht+_&zi*tfM8vU`r3!
zk3`#Uh9AuEIB$gg?Mxfm+;*1XuV?s8z<Uh|N?+jDGJH>lUjw{NNjJEF$4M)BAk7)+
z<IJ5Bh23)v@HoxM%Ci9YB}6js)tA`7J6kTp4`=i_MA9F(R_IRwkJDN57@p27;J>h*
z)zk9hBof8SJ&?{!;CI@l=ywA@nd657k8@i3xAdE=JAuE2;Uif3V}M_!Uu}hCVl7S6
zu`&D*;1}taSXTj$(|o{R!|=U;pR3QNn!tv0kiZXN_*CGh>t|Z$0*`ZN!1rVLDB#EI
zCtA_MHXFm=%J5bqS;y-~=(B*wN*b;52E}{zL}Qzc9pQ!Gl!!U92JaPn7Vo#AbcNWB
z+%J4aFF*xEBW;%6lPAb`0=j^(CBpN<QoQ|6w4Em!S(Np%K{gUmyVx<pHk{7!OtTf#
z)3L>|$T8W08knX~eS&$tRyr(wN#8jq>j1|Qt(Yf;N#Rn26baZ1_>2@KMN1wj2C+Q$
zO#5IvB*>IxpR7PmF+Y*9`}ZXF|9sd1^aBGso$vzoPG1z3V^0;Q%`qcd47-U{y<@d5
zQJf94WZg)%b|=Ey46_HAz8tfWVsx3T{Rp*O2#_~m=%_oE(@+d#40RSX+kwX&Aw5}I
zm<Lmd(yW1;2eG1Unr#R0GjZV#+N&5XdL&LGinei(;~*9pQp=LMizK{A=`hcsms%PX
zgL+}@rDC8<Ag4yM75lXBlkMaKVWsf0uu6DEconf}dQ?KDV`YOp1WG-Zm?Tk>B#oq%
zWJxFCRdte4GHLpNi?0$z_`9%PcvE2e(ZbupM&TXNfHwz?#QTF@!KpbB7C}Y)Q9LD{
z#;Hb&WR(;NXI~|U<dj@eh~$<+L9-I;s~zM+;Wc5k@HbJ5HyY{i4x-_B3(*Mi2JvBW
z7T#JYVh`1cca^=1Hz&P^_a<!>wh8a!ok<@EJA@B~ox(@LF5zQgx9|zxW+phlBMJ8E
z;0Xi!Ci`~#Zu<fI5r^oQXaC+|c8s=9ceovKjv4lca2ny1qoaME{eokUqqjZRF~pJQ
z9PU`}m}p;UFL6K@!+Ms~iesO)mK@<F>?l8lJ>{pdtK7`XU*if^TFH2`+;cc{^t`-O
zenDO)zbG%4|B4exFUc$ARq`u%OX6zzZ}J-X4SAjXcbrOkQ{Eu|Lw-wsTiz(YBfl%}
zls}Sp$sfzR<xk{2@~7xGaioJZKpOamr~4i0gyVl-$cF?gdN2ll;rTy2kAtKSlYlj<
z47Bd8!t26X;SFKkZ)^LX;JhkNR4RiqMWyow$mc35p^m+zAJbV>lkLYjgwLSQo)EIc
zV)3$AB9@9}V!2o$R*C_!3fw*X2iF}8B~7>loL+@1L{JweE~r~UUFllp4q<L@=0f8@
z8^8*JP|P0T$6N$%B*S!Me%L$^noeCU*6;AcLIbxm!@&Ll|9I+ZpsnEV3eCsD@T>%d
zF~ft4_m+lW{G<CFSSQj|BegCG(AIQ)E;uIQng*I#xI<$(9><ld!Xer4W6tkb0+`}(
zM{g1wn3ses!+i~|w{UI4wHwz#T;Cv!=696SpTd0wU}#Nh`Eb;tZ)?=};d^mMT22x7
zwYWB^VNU39XBaNj%Zd6sG447CAbd40<QK9X7ma%a*Ku4I5RSTqAblq|>%>~pi7}bM
zBjF#5YZ9*MxMt(Z#<dU^>VVm~;9QSuGp?Pu_TxgjPL$ty7FRK@Y9hE$Mwc0v8+K{>
zuG%c<TKI4RrcU(<1B7d+&wI*ShP7yII7UWiAY>lg`Vfo};rj3}xN+fK;r0#3Xc>M>
z_!PJ^ahO;PUl@*=WB6J;_bP_(3dd{<Pq|-!TZSjt@Q%HRC?a?_;6mNKC}Ttft|VM&
z^$66LT7x3co)M^L#0*@I<C>2P?S=Pj2@!}Jfp&`6gX=IZ)Gy*Zt}<MWs+9@vi4r2?
zaCOAh8`ltAqj62Zh4~;Pyjr3o7xjH3o`6r|+V0vLIVo}`eEVHrMb3)Mf$tml7m@QL
zm%;a)+lqGxt%L7-*V)Jok=x-r@7^D|Gx8vO7hDyQhv~ZnT><yO$WxJ+jl|S@&E6<4
zW<K7oNo$j~;oduGchXnjv?yK6dVnYm!Ci_x5c!?AE5mnWJxr83N|;r-wz=owy@Zs0
zycQ?XU7KCIkQ;@Euzn;;*YW$%AdKE8xz@NRL_z{-J{;dq>W_TZc>;J|l;Shdn<UqK
zw;Ty+1>Awf%W;=QuA#6dlEN`NVh$!{5-F*FQdZI=hL1veQse>;iP?kr6GFbiyN_u6
zp{&2ta_(YqM@=}whr8EA&Sh{K4^Ly-L6p*HxO=uc2d%;K<MD1)@0xIy&)DeiV_3M9
z#&m@!b*Ay0jUj^~N3wJ~sCdwC1-{H35jj}JgN~M~pL*AX^ZakcU5ZSN9vKtI@(owZ
zqltp%k(|3i$|AiCAIabyA#sr&md>pV-sapB3F!rY;%Iw-enVsgPbVJm4(I;JFh;+R
z^3S;^WDS)>lw%*w*SX7iFw({7Luh!&gpiy_2Zw3+Hngve(Py&wn?oi=S~*O^H@Y_9
zJ!opZXnY6wVB|0jU+G*&ZLY|#H{?iiu5oURlsSAI;0?}gks1zP19-Db#{1SNeP=vH
zp~f2z{5qE-0-6H&j=<A&3L*jwPGj(^uFVk@Dm`lt<V$-W%NN=Ty{bZBawMD(V~LoM
znJ@(I=me~k5@sgkz+IdG4G8*MQBR!nk6s<UF=0)@=7c>&8<p<d8?iZhQ}iz2cSj#i
z*pYBB;V99@N5!WmoJ=TAXas(5^jC>uq9YOW?})|D%!rkEJ8d5DXQRs!BN9^+d&6H5
zIW@6=;>g4a@CPDCCQeFxC@}~0vz<|pfNGD7hpqG;cjDuT3lmquALdC)d^K@nBJ%a5
zczPu6N&G4iX?l8jh9sU(3?$)gp-IN1h_u>tGtqeZdqyOAlR6VkL|4Zb5l1~)@MT8M
zbFRc2Bs89}o+(LjNnPQa=9!b!D`_Y~<03jb*5d748c()oanj%<O1IRrI%!<eH2Btf
zc6&A_LHk6cdbUM4JbU58+lw5_JqHl_h39C}q@;)7JLxG*nv=8uZ!EP%Se@yf642Qq
z9g*pH&xj_%;mC~ec&b5HAG<nfW>PlFJU@mcEl+~xN_s0sle9DG3($#<p%I(#4hBtx
zCStSWd<<$7Av+L1#s;6u@m0jDF)rw^u$ZKz4M{uTOHJAxVNN;%U&q)3N#7-5-4xR`
zW<XM5QayZwV@4;7$qx8#iM1w&C8r>jl!(lT0Wsr%n~<Ckelj@|zDY4NW9B9ICK|k*
z#vKtC105SPKjvt1kK`f19kDMCKaS_@rQ|^!rldk+CJ#>@mx{G@%slV*<Vnz=-+Rv|
z<4L-hxiJfq@!V0&l9*SMAIE)d%;w}A+_%T3CnJ8$F7JZmrMT~n`6_uO?%&6pPhNw2
zVN7lE2Bbs0*5u8&yS#D9JBXY*E%ot?lNlv=9jS}R-iYKasdMd)<UPqao8S$z+syUe
zgybX1CqX$g`DFOu)a=wHsW?~Qb%hTO&k7%(d@{L^Xp;+5#-~h6U6#6*Xgj!*i@kE{
z`qb@2>($$H!bf`NC6@rdD#IN9P=^hvn?Qd)gJf(9pOU%-{tKzwlLM&-Qoo14I`w$W
z+0??+dZJAuX|{}4Gd5-H0lqlqXv~E)R~lBK$t7ti$&G2f(uNXk3P~H0Voe*LHl1i=
zzOu~-`!42WiVgWX!fInqhPzUzj*-xp>8PVg8<~-lV$8sdf#GNmq`uy)FKUwO(-*`P
zqzzy=XiGJe-kD~Ws3wLk)1;+jOib&Q@erk>+O>ranv$l6bP+?7yd%w<d?2ker{k&6
z7(6}X!F|w?Je823Ps(ie^=tO^maf5UQA|CbjP+r1F4|c@8|%VIhM4w{Eh_Xv>iN_P
zqDx-ZQA}Qwyiu8)T9!tLoV+1<n=%n?dN{Qa?bzr!>^YuhPK!w2i?Cgx+mjC}S;^m}
z;S`MLaPl|Fr_xfCuPBs!5;Pk^*DHI|Ak|7&oNn*042ExjGDI1njD~NdGDaDvOoVT|
zG6^T%XJB4695u#MJfX8ai&LvZm!u6%)1=Q$Ur6+6<CH~dQ&Jn#Mk?de=cg|t`t&8K
z)yWG&CnPV=n3nN)#zLY?^P~pSdLXr_%HZ@xM3=rWeMQER)H2VQj5!$#kgkU0l10LG
z!i~%?V88Msf%07=Es>s=<K+bE#~Eg;pol%FU%OQ{%NCiACIZA?pFYN2ojx&rditF7
z+|*4OLx7owT$ZP=N#B^h!|2Tz1k4ue!Hnq{b2AoYtjg%0F#>VvXz>xdPegu()Y+*y
zsf(>!GS+1*OkHW+ov{L8TD&KBpBx2C<uw!%kBfz3045ANQfb8>#EV$NG)S<XVD42c
zRzd%xOw^)-lJy5x#Apne#OelfNBWa)h1_y1sAQbVcHvxhC{AXF6GKK<lx;@F!i<#}
z!!vHln3O?h99pS^)K%&x?b7b2DYSlzI!kj6S%++=2{Uk-f`&gTKL!!`GyR4DV(W1V
zTql^oza?U(*n`@MU?pVpL`?|RI+zcmCf|rBQDRy)39^Yk!OAUacR`+Ms&wSt2}w90
zG@_<3T)@?`?>CGRXTiUk?paehRyqOic%Oq>KQ5#Ea<;q>?j{+tIK1!uLr%9?UI};=
zo&y%JB3}dd4f!3o@5=AO-HDZVOM3L3@pFilrDtR5IazuhmL6<VynKX}Zzn5XIV)cU
z-nBdn&!eJzf(LZifkr)kg^qGV=mly?7$w{U>YD}F4sjBGDtIBlHZxOr5GUXt#u@lW
za0>oWoP+;SI7QzDEj}t@pBk2#@5H0x3GuvGAQoY*TOn47wPK?rz}lmius098%qTKi
zu;Em`L-?2QE#6XHjkiFD<Gs&)#c|?8BGxC;Kxq)%jZ|`^l{f()N~@@!S<OZHHuxp+
zoLD149FbG4q`^I3tdq33Ul8jh8TX4!Iwh2&5l`ew;w7;O&uL0xA(LTAEJB$~&~S^S
zXK8xUZ0Tis$NnqbZ<AO*J4`g<N%1UJ8F&stdQ!?}`!X8oF=;WgUTdYlO6#yAO0Dl&
zX`ZxN`kS<d`DaLfmY!pKzFKLmv`KoG?Fnl&edK7oa-UlDWhqB`T3RN($n52^^oTrK
zzDd4Wz8zsY$t%4i{X=>id%M(PZ;%Gy+3KgH7hoUvVvmsSfEw{^^5fE6*(vvs`^#6$
z^!c;H#4J55&61vwe9|*`GOd@~TOJ{glt&>%k)})cOOHx(uz%&k9!wYPw|0jOd@y!k
z=}tzt<i``!f1#R3S}wgVt(V@E-ol<!DE78u<v6O1<PO-g?25g|Vc2V=yBZ?VV<drE
zmIk541l9vYCb2puu?{A&AxvVuOk#1`M0!AaP<lvOAT5+uNE={%c4LPw0y}b1a*UiP
zC&|fjn%oIb)pe75!lpbBcIYAUaQS-d1&@($#ZC;}pAm8TiuHb2G%ARe>Jn%aH*6hx
zwidQ9t>A#X&LN>xMv0e7DT#xeK1veACn2ra>4NVY@mt93zs2vN(~gSApyy6N>!eBP
z7->60`($EF#kvcl)wNjXT_+8Nt{9J%K!`eC(lvy3D|CfOtgyN?q0i_9^fl-m6Lu#o
zf(89&iLeBclqqIH-}Hbcm&IYwMmokXJ>!>!@hgn+E0XamiSa8L={jkTfqtbm7148C
zNYM?QsTT%dg>Pm()y8_Nll9aPR_l25u78nq+QUc&<3J~&TBs&n(Az>tSK8x9H^!6h
z=y`ofPsW*Ec(3}Cun*H*>BvVgCQZaW7eA3K!cW4;@exKYT34+QC&Yp8*9q4V9iE;U
zjxybd(agZs<whnIE={~9o`kTvx>;Q#SzVJ@T|2P4X0p0=*M5qc#i{luG7j=YM-wm<
zS9BW)`(LfXGTK1cmuwZ*r47`r4b;62MCG?7KaBgWAdJtgpz&=W>_@f=!){_L=(#o!
zcGFvhz0?Mxqd-gUSk1SB*0q6P8)_A{p$!BZT&u9%Z6H`6T7@C6R?v|)(5W_1aT^Hh
z$5!#Mx@>_2Ya0kF;8tOnyS9Qt+dysFR)Br56=j=N5r(x1Yts(GU2VedZUf!Z2D-Nm
zbYB|?Z+2;w`-5$uHZ3jSlvpdu$J#(ow1F@#wxaa4f&6Wtr`kYIw}EhWqE#x-w1J*&
z1GSMl;RVcYu0tQ9He33Kxdn9CQ24N;+ma$qt+s^+w}bC#2M774T8at5Nvk&L`P#wD
zc^Oq3F(I3SFthCtIv-`F5jgyLyZC3@!I#>>CGFtyw&_7n1=EkB8byHi=lQ8HcAHz5
zU+CBzPHo^s$ZQwhvmFe}3r|m_zq(!c1jc*Sa!%-XY-pRH9jJDLmf|+~YXPZkL|1w6
z!GcKXhA_WsZ&&@)(j!Q{DPFbP!=?1;44)3anoc@<iw3vS!_EdQtZY;swgzc1eo;TS
z-eXlpX|}L*RR1pKr}?rpwYzwEu4U;^x#GJ9YWi&bNB0hZhfB+eIRbOxSMki^M`Ja|
zMY~gav{R5q^{aeP{U{avgA8NTrG5cp3#C`%(v}n?`m`;hk@hh^#k8c!Xc(^;4O<D&
zbkw++G$!8p(vBW>R*F}7-nxybKZw5$en9A7*P+L?;Hec}#a|;)e~_NF1y8eME4<1p
zmX}&DCM9ZHtLgM+?XLPeFdnM@&W!)6pUum7zT;V&s`!o)&5QZj8i)JY3MlB$1P6lt
zezfj*tCJ|-Cw~BUn!E$<EUack`5_s*1Hf-(_-zdTKEv;Z`@H-K+$HiJxG!N<BVspl
zC&Pcl@R&0J|1rgbYZ}ZAW@6v+Meqk>K(h>lH2YbZG3#P&&8!WoEU9?9cEd!J_F>i!
zDHfk_L+Y(zSFo3Y3p6~WT{tu)@5R*eOvuo7;aEMZ;Y>ydxuIS7qF^{HA0f}S3x_st
zttD{6w{7{}ZVp%T-`FmEN4s#^3a#pgA_vPybp@uO?ZTmHTIVld@25@t>zl(>t%zNr
zHsK@Nh2PjN{I=$B+K=h`aoXfZXOXSb1Kc)ze!KAYFkML>M#`#QA*4N=*DiiL81Fx7
zlRxIIZPIIj)%FucwWA*ur03x`wF|!~7|!$_*3a$2Z*CWUYrAl?TI>1=e`**0r*`2F
zv<rWrUHBvI!XIfD{^xe#?cwKx^w3<iJ%cd3=pA}oXbU!W;r%(BRt+=pFgkwGFDk0_
zQo~|-7}arv1V?5y>}EBLjcJ5F3BdTFhJDN9(J_vY?^=gp%|&U{agGT3HeoI`jE#HP
zhHVoT!{d#oX$oFm8@gu_)RWZa+5!dVFTr?f{W5qCbfhHonFyxCM6Rt`m5i_vwOM{2
z1|{vObgz!;FO@QlrLtCqR7oO-+d##9#8Rzl!FU~59UPpJX%Hd0IR|Qw<CI)F?@}pQ
z35amF3bB!&;G2G|EYP-;FZXgvI+7CMJ|3pdbnfR6_=>Ox+k`#L<Ixe7V9pFDSa$)o
zItnpP5#fn8VNdcfI>R7>k3)1GOK{psji*ZFQyl8d!k*?3)9%7E9Af+wo>d`Uqvv=S
zlR?aqX`1RzBYf%_wAIK;cUCE$ro?A6ES=!YMjf$Q&qC-ZuBJ(MOSxaWi?uR8IRPC4
z3U%h8`qlK+5sv#?=Syb{YMRt~4<FM)G___wk4w3smQAInJGGQ%E5$QE#WRa1OG$+w
zA-tYcCh1%Zcs@fJ4?m^C?l7Chuo!gKz~^V`yo$zPRGK&zJLnI}Hr*?1_EQTArB=s#
zxbUNF!4d|~pai)`cPP}+UrkjlYx@x&kKgbSMx8qoJejBJ5VfyBf=I*_n5kD_W@7Mk
z(y}m@2(QBr?ao~yV2v)!W8u^#!W)2JU@&!wfK@xwixS<hVLZZa3j9=})fQv5V48)N
zN!3xR#-K1{ok@m7XK742D7{97nqgIMQ2L+*)4XW@K*0&x+lhdYowX$0Ri>*38cO$z
zRH(I<?Zd)&za)Km`=D>I7E<HE&)bXkdXdkfSs3-JYmru(o3DOYzoK6~RC^dsEHw8q
ziTW9&)>|z(QiP1q98~?-x}0C}a;n<$YotlX1re6J;Oa-Be!l*pR5-DKUPb?C-Qj1D
zI%d$_^I-pys9#;nupT4w6%va_{lLP{=8*LChq@x8I!8V8q2{1!3u?Qf@q+8xK`nJ}
z)(fb6u;;NhN8Opku>7dM849NP2$v3e2BW!uP(OoOI2i1Y5<=7-$-`R76qB&#UfEXO
zg6mbTEt$R{<aw2YNR!XTgQe!$hmNJ#L1|ufAWdkEpauzY;tS3fsyPTbqC#w4NXRL0
ziMLpbwxVTj=7d^ms?`{GRjDTd6=GV1kZK;rBn0-UR_!2!Hgixty})=)_d7WUsUB*U
zIxd4;Uo}f)Fn6j)gPh>f+EPwUWV4QBVXZWvy4ocIWP+8rMdm3_#8x^~qW)%$szO0M
z8cYRTXRBlyuQ?1{r`iD4Bejiq?m_OV<A_>!_*uN5^t7Zx^J^0((Gx!OkM<+@8KlYz
z)nH7kGg%4h`(W<$1Whm=-6>|2Tzary91Md7X%j|wkb_}tH@Q_joDOOUqx;J&jO)7A
zV-@^-{Y`r+?Y$^JD<yU5pDMM~Hl}itx+<RTga=DRTamU`Fa%>OgPMC*OL^#cua*aH
zTfMJJovPhvOytSdl=M_raP=)we=|fmtJ0~Xb929^99MH;8n<PfQzbq)0?}TkT(Ls7
zwi++l$N?J4iJ%^!vG{Wft@QbVmRO8~1mCUYqb!pK8Ve^l=t$fuRzyoI-d}OvsU6MK
zD`@_71<lMWXdZ0AFisP!^muugJkmap-b_R5N9a?xtZeGINJt{9w>m!3@T7M1{hR6O
zY>$wuIXxW-DLkMZee+t8+Y0C&4kV1VD5Y<=cBD@htL5QqpW9S=Hkwj;JkipIn|B52
z`KUUHr%y*wN`H4d`X_?)tiKU5kEc&H9;JV>9sR4#^i*~Uz6H+8&t#3ltJ~3kAEamF
zFd;vv^lSvC^hev#A8)2-`WasrSNTInWlDdtExmw~2fV%1xxR_h(~%nVg1H?%G`LF7
z*L@KxJsZ6#J!-|Ikj~50F`VYFQ6Y6q=lQ8?yilGWJ=ICe7ZyyP^G{tdsi!b$_>^Ec
zm-YM9_-t&a;nUle7Z!A0f1ci)V0@<43GoHvb2vwZoBLa{?TL?m8=C3a8jk#<U4EN`
z@zpVcyw{wcN`F=j$E-qy&v9)@M{_>w=loIiMoDveDqPw^AJmX4Jx{MZNY7#HZnl<h
zSm;%LP)!Mb3FwcQmC;pSa9n2LL3tFqw2M!*D5a(25slxyZT*CvJRD;;3-1*SSKCWq
zwso2phx@ckKiL22iiW0-{@+|abrzxK&-<4!lIKUqaY}z%Fh3q&og=HGHw~w=WV%|Q
z_6N>y#tC-H3uU5zR9<oBi-)uP*a(mKc#ev}Y|TmGO)AVzeo;72h1qO@=64+rS5NN}
z*uGf&X8x&`8FfUb^t1$2pV2X$!hhoQbR4Jf13a9L-4uR=!*sl+@SizM$7l*a-^@Qg
zHZy5K0O;OlwCaqTknNmvYFMor#>b&L-mBG75ELz`2!mBh&VTThY3`O)Kb70yjD@Bh
zoT;t>C7ay`<(Nqf=K8qPKh{R=!h$RAT{O+$x}V3R=b3}?;Ac>9)}@Z|EKP*8$dRh6
z2=+(SlBs=S7=tvbgfN+CNvG8uiJipeIZ}V~d<S*J4+efURTUCeusg-mc6kY|NPX;@
z0bWo$Ops4%xzrV{nm6||-qJY@;;|7>_0v?;lj{iJesvd!?YgL|N;ZPg)(O(|Yds5M
zrRRC6yko7S&dFNp-^^pmVaObEW3r&G*l2z16h~*UO#f4iYC8+|IEqn6jbNXn7+40_
z?6PI`OjDu#Fu0n=YKv<EF3F5zG#}Oa(N@n%K|R3rjE0p;m0#p1XoKNQdI(XaICv_a
z5XdpttE^v<<-z!BKO=utVJ2s^{BO5|v7ZyvTU?^sln*<zw0^3z)A-o8X{J}Dye<9b
zoIW^i9Bdf}ct2qLqEgsq-Ws&&UsB^Y>#f38`KdjpO@7$fRm-P7B|wDu7JAx)5ZabL
zMWtt9l)soQalIPUvn)L(Gqk?gqfo;s2bmnP@~aSooB7eIpJCilH4@Iz(cYu>Gn!to
zJ!vY0>|vz|YMM`ZTdH9VYM3e)q>)3+mP&9!g=?>t6@t262=*EkqJ4{|7PRNws6t$p
z);II2WknM#3v7jqiq>9DgRW00w`qFnxCq_`Wr6a8hOpAowrm?lVKpAC2Gqy;gi068
zN7YzVid8(%htaoRC!{pDYH<FJcI5q=+O#Nd@y;#WgZ-3Z(qQup_Dwo7pd|@PM^OIq
zgXuI&-~}}uRbpAn7n|!H)D<9Md8sl)^TJAo^G3B?200LfK!a5Zt7G$;U_`6(sV&lK
z{34GtYE>Eu`Ewgtd6|c)I$#xVyI>t@F2VXipQ{?2OS8&-b)Ez|-Y%`%JOpX8a)Nik
zwJEhx?Q4anQm5uXPc=|KwG47U*Z&N!?#8P$e2h@(=`1WrPiORM{V}#Rx0pJz1lx<2
zh>(4p3u-M0*-!Ikvp$+0A)hseGtLNX)z89JxD%rf^0b=@u^o4U)5QXxZ?^P%o)6v|
z)mD<2>@sS!FPk%?9L=ygQ)q^RR;K1~uGhG{v`Bxj&G7U@3l~`50)N;~LWx<8aWb#9
zUu=cfw(`@_h0;@Mj9MI`Fy+<^7KZb*EbU+@&ebwlrKfbNy_(LD)jx{E9v@sfFA;Z>
z-3&i~3_$;a7a>i!Nh5^+{rg`I{4WRo01mL;Ms<Lm^)MIq-wAA5;-mLYoh6{>{%O`-
z({cJ(z?{~Dk+28e%s-k;Ak)Zf7L(2^C#yXZ-BZS!^;s{4ql2XkT@{yz^TtbX+u0mu
zpx;d5@r@#XBLxtqRy1bG3mU31L}qj6^lB`)da511z4?cg1^+0%3`#r_U|8uT&TgGa
z;)6_Ms4;BFU%<W?K4(JfL`zFc!&1lKfbtWDqiYwGUeMt}$+7p(=mhYCmKJs+LQ9JC
z*sLb76RBxXZG|!tV%Z{p2|vM`e&}Bc&g1pQmkdUbo58PpG2efT<ls96%kXuAby!7z
zfH~VC@{JH9qzGMval+krZ$ty$FrkP~i1Wqg#82_$fh-M>#!8cMMt?3&x-Y|X0dGqm
z;5^#Dq!ZFbsZt|oESfCM+nNtFUuvVZ$=WX3KH6)wH)?OwKB#?GyIi|b`@VL!_H*sm
z+T+@D+G1@LUSB&HC*Wt})btv>wP7c|B=e1YLcXZe=rZw*m_O+r(*0TYk#4_Uhwr|G
z>*Mrk`b>R4{Sf_)`rGuA^!Mp!=@03@(Vx(t*I&lhTm*yBFvqah@K3{c_~yzT#%0C}
z_*zN_Q&&?T(@N9prnk&p&3(*+%}dSa%+>f(Nx0=U%OuNl_zKD2EE_CaEFW3+TfVe9
ztdZ6PYlgLl^=f=;WR&$y>t^eR)}#1(NEfBIGFZ7md0Ke~-wF9dIi!4}oKVgym+_Sl
zn=RZHXG^pF$@Y-#&$g#*i*4&{@7Q(rN%raXNAT8+r}37Jm+Wio|FCbde`Mcp|I+@w
z{j|NnUT&{<XdPC^LdOe^RZfpH#W~0Mq4P86*RFo9VXm89Z-kgb#)oWnOKywX?T&G$
zxVyM}yRUJNaNq2n;J(*A)BTt`$NfyG7-|X~ANp))acFgz5M~T>hDC)XhK&uoEA0NT
zN5h^CdnxSou(!kB5BntSP}p~2r@{)tD#EW1zd8KQ@Z9jl;Tyx>58oZ0A6_028Ic^(
zIihdGw1|%*N+arEg11DvBgaPG75P@=w#bk1JovvNk4Bz}ER3v-Y>d)H*`mUu;-dUf
z&qghedM#>w)VonTqCSo868%K<)6q*jF3(iYCoztgYh!MV8H*<@Ka2Snz9D{(cZT;-
z@0Z?^*yz~Nu@ho9$9@=lA+{{G4n`zPoI5T)u2Wo}xa;Dw;%<wZ6!%)(KjOB=eH{0B
z+}Cl(<IctRi60z)L;U^m@5O%<zd!!V`0o>Jc#5}w!gUE*3F8y)NtluFXhL?v3Ouv>
zkAy7=A0>R9@MFTIgo=cw#OTCPiHj1KCzd7FCFLe9PWo%o>ZCW5HYa_U^jT6>vXtB<
zxnJ^i$yv$IB!8OXPRU9cmvVQ?^pr<Z7NxwH@@mRg9kd;k4q+W)JKWmgt`5^WJlx^Q
z4huRw-(h8k*E@WhYDyi8rz;E7x~JWj_F-C6x+y&*Jtn<FdbjlZ)7PgrWZaOkIpcE2
z#E!Rg+|coK$AV7rozgq?>ola(*iK72z0~QAPRBZT>^!dX-JPd*ex&oN&Tn+y*!lg=
zpLhPM^RdonyXd;uy3FYEXqVTze9+~qF2!A?uD!ZG-1V)lb=|J+HniJcyPfZLxmyh$
z#ORZ`Aai$jV|Q=&;oa};KC}Dk?nk;;_ZZY;M2}l~OzbhO$JQPn_sHvUsYgXmSI^-+
zZ|b?S=j%P2dJXF}uGi#VvwLmq^?tA2y#iO=ewFX4g;%|G)wZjC?CtK|v3Jkj!+MYI
zeS7Z*dq3XW-}`9qGkr{b68rS;Gp^4AeO~Kxq_4K`=)TMQzSg&(U-y1j_Z!ylrhd!%
zo#`Lme|rC%{%`gFy#H7I8?Mf{`sS<GUH#70+pqrQ>VpF!2E-5OG+^|AX#-{rST^95
z0qX`73@9H^KTta`ZD8iWeglULTt4u%f$Ikz9QgIX;{z)OHVl#nDT6u>x@yp%LDvr&
zGw6jurw0`cs<}pUjdD%IHHp`Bxu(xG*Ix6)HS@38I#?R~(BNf*FJ3$H+Ly0gdu_##
z$RP<st{dVTvT#VnkcR8hubX?_XG6n=4jejs=$fJb7<zozfMLUj-85|cuqneH7&d2E
z&ag$pP7WVFe9Z9Yhp)Wea=rWdVb?GE+24!T|Ixp)5tb3xk9c;(-$$Ikq3;d1-mrP3
ze&lT<*WYNp@xdD}W%bUwCTm32%~=z&?#-H+^;lL;)-zelvR=trm-SB8_N-5`4rYCw
zbv)}_R&iF<C^E`0$}uW(RKlo?Q9VXoJ!<GE|EO0-ofvH&-F5WL(eID``lfz2<=*t{
zP0Me3?WXlNy?fJ+n?Akii<`b36E$Y$m_uW}8FOOHg`01`dGgIOZhrLUk8l3xEuC(8
z;FdkN9J=M3TTa~Sx%IwV7v8$!)-P|Z9-BON%-HO)U)&aUTl{U;-ge@)nsN4V@#8v;
z%N=)c+}GnykGnjs;r4{v$KHPT?K5s)b^F2b$>VdzuNc2^{QKiSY5sjPKL3tEcieo(
z)H^=CqijOVgp3J2CR{t=rU~OGOq;N5!s-bH6RPfvy)*UBF?YUt=axH<+<E5Cz(i@H
zGBJ8$r-|22thp=Zt}b`ode^eMw%m1kQre`<Nkw<hz5D6A&)!`$S(<E_eAndZlOLO$
zJ9+WszfN8~`OV4iP2P3S?f1NN&zgJwanF`}KDy_#d;WFL#VPtJt|>87(x&v7vU1AW
zDep|#esA2pJEmHv=1wj8)02NHownq@+wa?OU*+_Brq7uE==9~&w@g1VJ^y~={m%Q-
z?!V^#TkpT;{+I9nq0KMv{!6WYGltDrGNbN+`yTjwX3WfqGrxZ@=E2zyZhG+aLsvbt
z`k{*tL!IE4`S2qTzxi<eEZ3~KSvTT$$E+!{=FD0(tKyN&M;^uRef$nSk~ceL_Fc2*
z%zkNh<)b&U--C~Cc=Ql{KRkNr(Z)Gr=d75sbx!ePDg4*_u@R3w^4J@XefxN)#~*%t
z+v6wyZ2I%_fBs=^?A#f1Uz&SxZs8N5PYiov>Jw|9`0<IVd1PMvyz%oMnD>`?8|Quf
zBzZF9$>C4l^5m2!*FSk6``YZ8*-NtD$^Ox&_y+if`R?+~^R3I#=h$=NbGqc*l=Dc=
zyqwiJd;A^!C;XMUn%vCX`*L?aWqiu{)aa*{;J5jyOY_b6h0ITy-*f)3`E&5|&0jYE
z@Az$<pEtkuY0J}zPxpE{3%~oHUi<Ws1y1~iEx2RB0}EbQ@bzC7{N>%hlrEGOc3gO1
z;lCGFJY#q!<eA?1jeh3wXVyG(@R`etLKj`V=-x$(79Dz4{}aDn&(3>x&(Hi$J$vbY
z=C|1TzrWwXfqNH!zWBuA^UvA&FXp+P&-tHw{kcz{D_k;g$&E|K;`hjsXYi|kUi-ZD
z`F_t&eSS9k9bI}I|J}Lt&ZSfE^ReGEOJ7^M9>1MS4=pWk{x!W2@xnCxR=%(izaN%G
zFH2h13BM`J{L5Zh_R5QP_6vKl(~F~Cd>FrXmJeF~{$DfxdhK5?uE<z1XT?8PRK7%B
zGQSk@Qu<4SUwZAOPgeF^dG*SimCIHhdAZZeD_?%+<=rp;>*c(c%UAVW^}wplt14d^
z`^wf=w!SL7I{eiKU;XH{*w^N~c7C;f_3G6J_^;@1_P=@m*6(lk{_XiSDfkUv^OrRr
zzOHTcOL%?5>l@ZatzG>_>>JOo3t6}R@9}@X=kIIR$F3i-e(n0V*B88b_nSX%nE4Oq
zTf$p+zV+?f?`$l5XWBbYyz?d==Z@TzxT(*kQJb<iy}W7vrjzf6zT5xZz3-mi?AUzc
z=4Uq_f6x0~*Y}3MH}}1b?^SQ<v}NR$*;_Vm*|}xkmdjf+w)Wh5$JS@JF5mj$)>GTa
zw%BchwvE_!^R{){Hf{T0+v)c$@ArE@d%L{-^$*AgeLr~NgO5Hqzr(Pj=Z<@Jys+c5
z9Y=PQd>HXz{D+5k-ujXF(V1Q5U88or{PD<-f7pHFCo!Ll_+-i_3qCpcNx>(zd!#+~
zJ@I?e_w?O!?;ii2=l8s}=iNOY@A-O9{-=gd(?9*wr;mR6+NbY+`theHKCRiCytn(_
zd-g8fyL#`&y*u~r+k1HLzxSTndvR~s-nxC7eU^RheKGq|_I26Ud*40#a`!FWw|d{^
zef#$v-B-UqX8-v8)Am2V|MmT!@BjDyz-Nxn`h9l&XMg@|{bvV1`~I`jpA~#o{#pG2
z?E&k7&;#BB9S(Fo(C5Ig1GgP`?!dbTj(x8Ee8lH(eE!kr-ySp_yy;->!EFZ{4vjzb
z*rDZzKK~+={qVvR{+sZ{RQlUZ29RtKmL@OOX>nM+nH<r1#UYlG3k9x*CO;AVxhA}I
zvb3~khS%fG=;62JACC<`b|Eyub2`u@l19k{iZf@3qMY3O!6zT=JLy-`!zvIfL4iDl
zzyBOFAAkROtp6^rD`WlM-03=+);$~SL+XsbzmFd+WxNJyV}FW7Rm<Vw;W6%#l0bQR
zdCBGS^7aj<)$1GU8nixr6A1(=1A&0PT~o$>`{fs3e35s)^!OztQB+V~er4O*3JS{V
z1hXI%Rf$G>XlQ7`f8E;Do(l`H1y)Uw{lR1-3T92Grn41ioAj5C73eKKV`8!M7%`hk
zablu5@2D{fze>H^R9Wvcerx+Nog6(%s=xjA=VW69^0)!qNwnJ=tIJC9R~`tI(|c)Y
z*`<0TSZ1uhbg9W478Yh~yyW+5o0<fnsmZ5ls;_To%(0(1aiXwBV>X*FUAk1G3yF`9
z_a~k^C+I?AVq(1UiHY&C@VKNp4=Fo+`g9rbsGia$kKb=;Y!Vt8M6ImT8}vGj&z_Q!
z5^ia_c=4j$ZWk*re*gXVekKd_oWnqrGDg%{5oEXO#Kzj{YOmKSR)P9rm8f{V)z!6)
z{v1tRz^KIwQBg#bl8}(#G6o8dA3t7}LxkLHPfg)j{1w&^eTc`CmsdutUi?`}SzeyU
z6QcL~v|58PP*s=Xtgj9P&VKpjmuCaU=q_ElL>rBIP43Te@k&{pf)e9IH|gr}q@-qK
zWW;;DcEzICYPGiTU#)~*Ur|v}RV!$<KAj+GwW3C^|HX=R4FqsPO_oVroyp>eL?eVL
z<k#vd7u3|$)Ydfl41qv>Lw$95NkPFMR)6|5N(Sm5;&4=!m0ZSONm*q<rHBp@DpVFw
zIcjXed3B%R<jIreq{$o?7v~Q-bH*7K2O&s_3v<Re8w>H*=!^kzePyX)*7^)Rd-hCJ
zN{@g3`R80~(%q77$jAS48A-O%Qrl1F_OsbZ0i!YS3wd7I+W#*~VMWcYFq>*s<)C#1
zitx+UBox_>6K$apuNX6CYmQj+I;&Dkbu9LMp<}iFr?N?%pN}&CxAD|AD${%+&i?t?
zLS3Dok5qqr&bt56n*Ch)`=Z8uQRApOLsV2$TzGkT4F;3)vOvJ)3IvLZ)XRV6aFe4;
zNGK|@*^VF2jk<I$FE6jUURNd<3<il9426Y8V^WfO`L7&ha&$+ISgm<^ojY?a)f1%{
z=N0IC1u<&SOREtjDlCGA!t^gfkj+r14x3d7cq-4IZz{q|Y;2zB%0O+CPj0HKu4$;N
z^C`9jXB~=Fc;dumDE%f9jU6_gCT>Vflr*i9&5o?STu_jI?tFfJQH@RsIWESN1|dl(
zJ8?Y3ZTIO#y+p)@sz9SpX{Zi-Be*VHi0a%q(rDC4Oxyn)Utu-JybIM}60dQQ;;O=I
zDWS|wH2F%r5}z&YcONIJwA20EAzp#R|B|xx>U7mtj2bpNYB&u6)b>OfaX5;LeHc32
zAu7jcy+yp^NDyg_MIj`pWig=SVKA}g8R<Zh&Bqa+xgMiPrLn8AAk?VgWux^|XFGE9
zZ0C=`walJ=D!uj^!+tUJa_GfuQsTn{iQ03qKSur-n@ys8LcYpFdN#?9%?uq*5wQ7(
zPpd|e@F5Ns$rp?zx?07%Qa`rOS#c|+g{9i#2_yl!D*sG=cyze7`yq0u`)?m%ugs;T
z&MkbnlIoAb(9;I=)b*9UTv6O^MJX*UEG#W;?&X%|NhLXcJR!j+B_z;pUU?Z~96rrc
zZ*n@F7NgUdpMT~|etvj(baZ&QKjezZB<bG$&>^36=ur3WKRX+7qh#@3!DwKely*<S
zU=1%VZLoyH&DPga*)FWadwR32f&BdVcn2wluw$xc_WSfYlgZn)YgdoKCm6Imj~32K
z%@WIJr^M`V6cmJp7FHI9g%=d~bA-}TACY{5)0t~NcP=)z?rUdf<*TOHSOi5y`H0RZ
zT)6PFWyj7LcH0En!9>xRSC=guCt_)aF&k%R+mB;aRNE_8j$>`{SGG5;jXDxy5X>gw
z!4#ap(-R|pt;<zdh|x+imIjm@0qx||8I5&yJ$t%bn2`1*dvk<l{?pS<^t8Ln<@!!a
zEi8069GK}<D`l69ii?Z=IpmPvbmv{eqBTuTrr17NcjmhC@?1iJ$AgA1tF3nzN*Xib
zf>7f(ef;mUr+zFc`SIL|gCBDqr6B!yq;Ge*PFbvWh)H2#Ohx(SqM{;yj&%6*O-~PK
zn&ua~4!n0Db_kc}+Vk?ltJoCY<H<LgEQ+FFR@`^!#F;bvn!P*UUb`;$cdW0d)L(_t
zM3k3{N=Qg~Suv{Nbe^&*4pahVs%#Sd*}7xLj-4qD7RfKXxoS|;<4w0Ujr577<+V>m
z7>(LMUY=UGR>k$WG<E)L!_`+`of^SP>KC)d&l-r&wEKLb(V+R+bum2!LeE=eM;Phy
zz(}g-jI)Xu>2%XT0(6Z~>Gw%>g)VK5L+dQ8Bgc*v1dQ&)#6-6-P;ktj9Z^A71{K7N
zAv?-U%1+_0oS5nIz=D{V5mx0msw#~}LKg!qOM^dT_1>~t4NB|(KPzhb%*aUaHrZ%Y
zoX`=N%HX|)zr<(a$q@{SPjZEOJio;A<f0;z*<>>H>eVaOMt+I^<ivbQTYloi|9m@K
z*)qR`X<qdOG!VS7h)B1V1Xrx2ri=<@{*UEVSX&ntm6o;>Pdzn1G)b7H<!G8}v5L)&
z(i#Gw6(nwsXeYB>^H0;olQTZa-D<Jtq5^Euls00m*;KF9wi9JN9a6NRu`yveY>pDB
z%ZaWFR2p@S^~JT4iCHXuQo;vA4(L-S@k&VPrS`Qdt8G`Ar+5{ds6uU1``#8`Smv^}
zFSAQe%Fp2sy)F`eX8%*c0=j4c4ch;{=h5c~Zt>F7AR5V^BxwXeqc<9jwY3*7UcP+s
zVr?w|y+$an!`)a{ehH)DiAyjB2#qy5v1x(M>n$m<*-o9BZ^_HMT%)slJRU_?Q<~?G
zibR_950gPmtMMlZ0{&GevakZZB~VdVTvVtH!LP8WxcWT)Lb1ffcVA3ORb7+c_N_BN
z9WU>cyTvF~`CsQ(DNH|yqRbt<g2{-4>4cr;V01K=HWm~#qJbNIdUF`5tQ11y<1H{Z
z(QrzFBACxtG`L)*inzFnW5+6T4CR;3oP@cNocK~5K|3R5db$yll>B^BR|XAUP4eNT
z>e58={W(rZU7&%;7&{1bdKEFy5z1Xyn3AHiIN?`xs6lZ))cl3w6wrgvswY&iVc_wY
zNd*=!Tr-YDZX=LeVq{o!xL(jx9TM);3pK^aGQX&-L@*+@ViaiX(khIvcu{ALwjofe
z7&SQ|f=(%|tZN`APMj-MB4F8wR7%gC@Fy0WtF3KN3tw1PM>JNH$`u;sAr-J1eP2p!
z)Qn*9XA@nnR@7?i>Kk)H8tdw`I!tG~bqm$jT|9jF@I~~5ZoHgbP|hwWXQ<uY&_EY#
z7mt;Oi3J4(4c6G$SZf2dS!i^6NwWA%E*B{&DQPsiQ67KjxpT#JK)E7gT;CL7yePiF
z_~NBTj+%<9(juSfBy9ktw&*l0O22Ewpy!=#Ln+g+a<f>@o~;y&5fKq4(PTyX7K2XH
zR9Baf5F*!HxNxCLs4Rn>va;Uq6C}xJt$<XYFRZnps1B=9^4psl8*NzZgxj<wmo8nr
zbUDzFo7PxWl%F3HV{R;kZn;>duY%R?e0h^8G%D)s*+7#4J=0~a*3vfA`F#%Bk35(z
zhRZb<&mB9KUs~Om<7liZDLH%O$dPjuO|H<mcqeQWzkSZ}Bx;zA8utGQ%h`Wa>7TNq
z{dPw5{|S@Yf5e-gG_U<%;1_*n>N@ZXuWWZ%by5Z7|HpiE>Ee>oK%h>KhSJyhv|gzi
zqKwYvv}$wosf{I<ORMVY8gr}=)xsJX9lru|p$KPg9Ogae%WCcRrm_aQCNVdZ2}0E+
zkQG!_Ru<HV77KcnSYF+bqd$}nZG$hpH04;+($b>L4H(~)Z@>NaY&oC1QtLA9`w2}N
z6XX+RF*cRu=cBhv=oz%XSJpMrB4WvtU*-218*2gu1qLU&mEwa5H^(Muje(j*a{6>}
zK&zDlmrwf>gqlmxF8C`Ku;4y>wy0LnyP<VFp+=z+=ty{NexFs+8Ev-8Gw9}L0|6A*
zR#z2(iGie~gc&bfC@_Yk@Scd%dGwpN8fF}kLbP>7QX)wtQeLUzk+3LLwPyP@tT8|-
zwWSKB)dq}|TI<SdrVq~KTILH^As;q(rfLWS4QXg7DlDLOo}xfV2y|2(ru40())=(?
zlEg%xkeHYoA<H%=4wl(WCQo!+TDNZ9QeyJ*N=p^R<MB7kn>j#&=3IicqHyTY&#tzT
zP@*KXk6ln8JrIyOu+r_ux}_94qdwr10~et*E(Ux8bVIhS3S|X%v0hX?FqjKEt4~&<
zp#q}OWLCq^=5-}MuEeygGk@<2zCUV4R|L^Io!N#eK@T?QexjCb=BiiJI2yClmKo}m
zwQru6{-IpBk}v-qhR%BM1UN}*Jsaf>T}g~;L${ibLiU<xpdx0VX#E1(?*l$_n`x*&
zsrAH@c1FmAh3=s+Ps`NP-)gccVq?W8^Su<Gxy^j@KNu0iP$&9Sg~sE!Bnmm2#)gRE
zGyWX;&^JHk{rL64`Q}skNmf~-(KJ;47#@#+gaIS3A9;1cd^V@L7O{sRc0#D@a&2ur
z>{>db!Cq2_*#QxC27|e<z-ctdk^s|ZRiWQ6Yw9lLU8>VGdvf)Kmm6)Nwx-L4xd~?i
z5i}=_MwT@JT|+(g!x|gvYEK&@E+Y>Nt_=;1SbOU;`}RtUPwUk;)7Rql>p%Wr@6mHd
z_kIvu=l_;A{%!puxEm2_aoJB76jV2A9L}iAh2?Qr3yXEd#iuYULR(<=dkRxuACY~s
z%bAdo;Be-K7M?6lll2<XP+jwlBhK|*U2OwClOlDX6DgnEt6Pt&dUWdrgQ!pb;$KG&
zA2|}#EwSKiENYEum~ytRwh<4DND;7rsqym8<()cxE)T|^T$rc}J5<%+fmDO>TNm_J
zHYxYXSwmwTu|u<bBsg;XaoqSVDg73j7X8nr+FEVArusyk_WJ}93mazOgBruNMs3C+
z^7ZesVN$C-o&qOPVM=jzbsa2Wu*bOyYib%Kjn-f`SxPUtg^PZ_T~mGb*qItF4jK?m
z)tO^wt2MdAlWWT>4Z(<vWdPO;<%Xt4jM4&WJg?wGQZ~%fGy7%6hR1gAm#HY3{W^sz
zp`H3=`bp_;pPl_S38a=Z8){*QK5sj}wa{+AcoFT4m#B#g4Btn6tz55A%b?#+Gz)&l
z78TT8$y&Mvjfp~ymM)lo$-1L2ExdTK@H8}5&Mz2xk^|IYg(<KJbJ$-rI{5SrLMZwW
zX8$?AYX2F78jnGZJ6P!kH8y&oT@6z8r2>cDq^ZGx8WIv26BBNetq7>a94NoWpJT#0
z13SHhE-)-Gn)*qD&t^8e?J_1jMb%cTRcb6h?eB205UY(UV-#lOMU=ScQb06e+Mk#A
z0~V9{`bq?Zgk$~|f<1LD_KOTc0Tw~0&Yi2w5$dabHiH41CL}#Q(pXtpDcNGuxyEg2
zO=GiN_qX(gAkFW!QU%j#nIrutnE$uA|5BOhdj=kXG+f0--e^}bo$FGQ&wn5t!R<kv
zz^y;ORa~xWqN`W4Eg~X1Iy%%99sM7OkHR+`NCQ8-@}J4mZ)rWczMJC}$kp{C1ht_8
z4`XPXstOBDCcRc{Y{FI(maugYcw%yTz4i5iEHyQe#%g@a*H%^t`%q~KPL$Ym4MItY
z-)Cy9uSOR#*|F}nJ|)8Tl7kQMS}a&8;Izq8p^bHo<mAc109Gwx-Q|-N6-Ear9Y%jj
zGTpeug;_s#8|WW3pEN@hM>qI1Vlu{YovpCY5?S8V(9i(os>Njaa-LQL1B56ST3tBX
zk(Z}+_;jKy<8Z^}G9PKk4XGt2x6Ohtz%&szsjU?hw@eCJ_At~Pz?ObD41B>8)g+<l
z;;B>l1qF0IURaQqccF;xBNP`2CTI?~NvOayy?`3C4c0)wufaN^tlDqa)-}OIQc<fl
zVeRBLRu-J_CwO4s=@=b-{(M|qOh>yt#6!($k&$BAkN7JStvGTKXGKDB1B^x_6bS4-
zmE))hm~<pFGg&G90cV{~mnt!tSngrpmF{ZO{jO+1XUAcnFuP7@C@%?%v<lT|tdeTM
z8W~nn-r&c{AZony6M6s#Ik>Qu3jKslAt5(fpgY3_1((5%sOWR&$^<0|e~M6c?p$<~
z0*f0zeq*mLE&UNIw=<PSy0nN<6umk|QH`bU-I(a!jS$?sX~6^43V%1~??$OR!)`;T
zzBqvss3<F<ENuLhinLmZ>4Gb<U#gr`Qc~NH)1kJqQmZqEpzk>hzf#@iCEHJ(!1*Z_
zv`CN2gSK`3IUY1imeUCiI9$$9kH_tz%RC5_*BjcTN>)=PZ5l`xI-u6CsV;+P`5l3P
z)d0yVsAR@2leV@3l9fm8wCB#}UAlbvE7+hTBF>!os<iYHvl*Q%ZKUH_ER`&sDNvK6
zIkh_wKuSjAfH+82j8b|UlJ!HWlFTLRPPEY^w2@tqs8v?4H`rs+I>9bw(fFirXHkRC
zb@3EVPXuZk1v6#?c3CLL09uaiFM5P1$5?s(#~;tsn%u6!YG3H3LYE;-tO?XK5FGGQ
zO#=#nt+u03h3=Gh>cr7g1?7R_^3u~qm6bmnkF<HcNtPHaVZuy8IS2}>1Pfiz_+3V$
z#U6sGg3D#bv6aezp<L%R_(I+0a*`eu9Tj3R_Usw&GSou3YhCd@)qX-x9$fDgNJ?A`
z?QJn}X_=X+DXFQVn40R%%uKUJq~b5aDq=~BJ+$zeV*dh7O_|377UktxbzpXJt=5ii
zY}eKnpLm*nA{BaxsVHh)hPr|^j~SW6^0BX#fAZu%kN;pg`OlLln|}DADKfIS(CNnc
z15*`t9DKx>qqFK#jaA=O8P)R9nHAm7NpVuEtpaI?iwkpyg_V?qg+V1i8ffn}HC2Me
z`PlD*l4+I*T1Ynv*-9c@#>&DIwz4uCR)y!my*$J^ckY`rr%pvh;ePI1ep3nEODk!z
zf~g+ptfzdEOyxqTqs4p5Zj~Vw*it(~^-aJSlL=K(s+M&)%1U)&JU(I`f<LQPXeh%$
zL)e)r1)alr=|UA|TLz&Th!ALx`tm}TS;`3$b#w^0MCVI&upO5fsm0!5EGzTJ3pGVB
zjb13K5e!b$6GMqnxP0=M%OYXGs1z(foP||G6nz4YH-_PWN?DoFi53gR`4pn5rYqtL
z0j=&2nnC^2EFw6X{{K7A36`*>7BkUecsmX0A=zPBj!%g(3tD=_$Zkf{RiK&Bdewr~
z9#&FRC)Wv$jg43=Hlk_uLN$UUzmD1<>YB843!obIIx!~>t!Xv~E<=b)>*^$vvH2v0
z)@Vm_IgI7y{vJ4vTTo!>(k&e3LAsNB2@M>AoiKDktAyR$a93z_tpNow>FstXuL{9}
zpwIj|I^)qrCu2Jd#sF$3j6=TV<;KwD<Ya7AD-NakByU1>!O^2fF9bC5&sr>+C04a~
z!mg@osxLfmbs3s)h7o_%;0f$GdTQ10v%uhqISHM;C|cCnM$5qMofeCg+B@T$nA$?O
zDs8Yvd(IU%G^yrJx4wz0K{qs_2`M2aWd7n0Km2e$fZk<e+*7Tc_4SR$u%NXw6)lvC
z7Q!};(FoP1tFNf2uf&?DqJl2hwFwDLO^P8$kL5&|($tiYkc%@Zl~fxv!Ww3yhf7VE
zWcagTSo8^b#W@;S`oB5R%FZ|rIoysM(k&KAL0v;I7>3xKR0^Cn_#@nI2tt#ldE8OA
z=d%@btuv)KcoA-=8);1%zfe)=7fQ=~bla_#4M6xZXnCGL9TN^_1pZf5Rq@&Lw7t)t
zEv~Bi*O@bDR9&E{1YQ3mR1Wy+wfeJdm}Epc1L5HVaZ0$FXe*(8j_vRZR-Mn%sZ*Gi
z>7E}8m8edt-ub=jqL%(}We>R$(-Hil?;CV86YPaEXNpSbjE~Ot2+ZL)Q={=HN*UI2
zjSW6oYscW~H0HYLye_&&Sh&{{iM1fDZzG-3`JWQXDsqHCsZTCFdGO%D(}A|D`&|6B
zpGP#(ITMbBs(4yLI=^^IMY7pnyR&yjn{uI0b1ab@Bbw5)rCzNDr?;*=p@Z4&ucZ4^
zdHr4-J#9LFzIxvD=WFy^bIAlZMtcPe!)%d2R}J*P`A-tUg6BN3?!qZg#v7eQS5sc|
zf7pA|AV<>lJS<NnGI1pCqfkJh3U&0|Gu?A=XPYy#2f0g;CRfz1Me~puAu_B`DC{2!
zN60@MLIUXSwN^4EN~HP25q5+aODg0r!?eg)?Q(-$Zj-w+v)el}Jw4M`U8n<9017t}
zN8<4FCV)bnbC9${VH-U)Rh0!~e);A1z2Eyj@AE!iXjD-E;Ss7Qu$uj488jN4Wd<N7
zooDhoJRN=rcM&d1wgBtG0_9OdW(W6ceMiUvhE?rIaY5ef^#<>9@r{pnr}RX~n~&kH
zV(2Fad>cP3h|dSx#M{$J3npQ<KnaIJ{kEf8_4mp0R59xlas2hg7hg;`Y2qJa<4i`&
z<m`mfqH<xx4dcAK>$_k)5jU(>%b3J48oT1!><j+)IgHp8j%iFsW4E@BkJZ!jXgYf1
zxJDe;aOxePGq7ajy1_|A0Me-xaRWjzi+jm9RgtWlVIUuzz&yg=ZP5$31>x!q+|8-E
zpwpO*P38h!WdT=7J3O(dUJ6BK-Kw>v=hIAF<KoO9BMe*t*Wh;Akt-cs3O^GRo6}}d
zU~F?5mjk8Ca_<}8`OEM8$9o@f9U6@k5l-)T>dl*c?ZBi(l(V@&Ejo4MCSC2s-D@r^
zVJAAkWU!st3xphh$sFq@m0&VBF;EdF!vz(%kb1CQDpd-_nviQYnh4W;KCzC4r>JoQ
zme)k@T&F{{e%ZlTBBJ@VLi|7s<zUe5@r0CMAQ<q#xWVe{LkT~?#C2HW9>Ae*G!R3H
zqEaq*dnwEi%~II~l(kbn{9!aguArr~ih=f@&u?e5g_9-|W1?6eSxn2=V)}P?qh}e+
z%%Q=ojSc41KGHJ*TK-o;$EMGcV&_leOfgX`bLfeX!su{9U9P>o;^t<tQlbdDQYojC
zJcevZ6IIj3gMg?MYbk!vXNGrT77O1nJ?Xv!tJ?N<B=Q2ni&%vCJ|3=<PTEZ3T=AJ{
z^sx%GQi5J3+MGG#PmeHS^n9M~FDALjyLL%T8$^IYp#nA!Qomj>=fM6rXr|}jrq%KR
z2Qgd(M*tqv;K`GG!ydr88n8F=Ptqu@DUn}Y>M)Xr?$Bdps;IkpR%M7!y{OVTSav`N
z562Dh9lt#HT-4eoqQG|B8h!5ngC6xS;R*aAp1|d9*C4(YOxS_WeALsRoTZ{_3F6m%
z<bzQ*Hvy-a*3YAT<U?XsQw*C*5ZCS_AD20*{-5=fPLJV3#vMyo)5_AE*K(4Z*6ejq
ztJdqZd%Y7RH8bDY7m)Zr%DBUU!wBQqv!br}Fn-N4vh)oz%J9DQazZ}IUJK215m=bf
z1yiMIih)nwr#ec4S`!!Jj^m6wmqR&dk6~6oT#B9r;FU!Hd}BNl4jFeL&tCcDU4d~Y
z6PjaX+T<*P^L(6f_w3m|_^oI;_^tcT(h0q$94!emS%Oo>9mPTs$7#kLvigVZicZ?~
z@t*mAkFgECZ-(vm(>5ZBpkhLlt?27ZFm<eB_R19*OC{?50BH1$jz}g*?3BoJFIC`f
z_?00cynMH5MKCz%Az?d6$pm=n2LxaOP)tQxL8R2i`uc&cc*$s5o5giRZ|2WHJWx<-
z<Cs1Yyc`xVW{|o>S(UE7zr#CZ<bQc?&@=kdpoZ7LB=*JJNKs}hUEWCuR!;{B4F!0(
z3YTI9MYHNWf+iOzEU73yN||Gy4;5ontkzfXM@bt0JbsGAfg!wQ+4Sx=HpX}^vQP)P
zjSWD&`3bT+#@{H}RBNSqPBaE-FQL3Xf_4py9i0-i>40{ZX(hXcI)fO+w~@$9B<2U!
zJGZcK0^Ci3I{Ig;DX|Lzr6Q)h3$M$veiGgtt#-uo{du(WLNHh^*GfA(#d4W`td@zT
zM?|uE&Ele~xhx&TZ{=>9(KY<{kwEl?LSbPc5%KwME-VxZD=UjP1A!S7MAA!YQSjE1
zyok0}ya*~=trY)}fb^)vglqmZTD%wlnh6}!>!S(b^#<c{JE5D0@g*D#;F?JRoO7o&
z%>v!zTL9cr4zN6R8wivM4A2&E&9${n!ZEYECcc?1RIBf9ZOzP_z%_9qU4I=(K}l)0
zQ~Vm>&6ML1*nCv<T|`dRw2tJZTtN!~A{L7~o7vs{5}HD@wog7O{2fKvgO>uw$-=wL
zF`pTGDWSQAIrI-Yr^b3<+VEaoFEmq13t@Wx5wNnS`6E8%NBb$$Sql&M_Q)q7z3;z=
z_FZXlc12v>X|#M{TuT)apd*QFhaa?!#kk6M2z)VoeH{yl=u2M#Y|}vm4r<V9zSi;j
z98Os>ON2mcqI@Z)p;0bY>!l7@5a}z!HdsV~fHEBFxa+;`!2v$F+v&L%<9m6%*AXzI
zW*6-AAbdkQyMWA)7Y$kP2p}?UW-CnwUIT|=mp9FWfx0YERV^IO{z-hb4DL6B`+ZFm
zRn$}X6cm8z4JyHDF`ujpjwA<Om?Q^2S+BfStr~EGSVPw>RtFK-yvir*sKfNZOVa}0
zze?YoUR6&Yxq+VhyKy!YG^1cMYi7p4M0&>XWrZL{wJHxg%{nY;y=~=YI#$6Ib>)+s
zEODB9*w))E@IszG<=j}W{8&LRVNmV2Svd$0FFrp%2S3)Y2u`Q0o6D!u$utP4GfOgn
z%jB!wl+p)?rgsg{A-J^nx#ymnb8#?5$nNzkTMr&Q*qF?T8MGIbj||Zcd!=gipnxzI
z<|U-21PrriIAepA@4CWa*iK@hu<!1t1T4VsJQ&Za2{$h3K{=2QKslx`)pQjb;9Ov3
zs3OL^ZCP3}83&o9r-Jhpi$sC)fz}f9;RAS=JMq?Aw=HkIb>Z4H)+D{xYjH4*VT*O<
zth4h0T@ReRgwrts3^=nIkL4UymBB@eSqQh`YOMc2<8V1mc<aK8V-CtRhAdK4dtnko
z{%2?bRsFk9&janu+dVSerO9wV*}mm71~fJBRIeP4+oNf(GkfavI6QnRE(-=6*>z-D
zO~#@@jKwZ!O$7TFx*GhBjGL{3AOSn#WNSDIm<+_wF;@@lNt3Z?`9xOqbc;UD5dr;e
ziL)$1e1&N+cQlZ3rgn?a6C7%!{~E_XPAg8oXA$jsInKJFb2*yLgh`R5WnJjoCLk!m
zX4~5Xzun>yyG(a&t*eRfBYiQ@#(MY|@==)nct5N^{pdnx3lIPJkFh`|1lWPxu0yuW
z+`KtMn4GvO^I*9g#tow!ril?^c#ism+BiXz4#rs3(PK1@3BURz$ByGFr+eY&aLu1X
z`<9Nx5Xxk9jcJlcf`}1KauhbOePT(Hz(kQ)l1D>_^wN=Fp)neU$U}~X;gM+JXnX)o
zOmHOUDC4bwBY8AJ7>}3Jtv`K)6vc@nX`h`bb8x)-!-2ZH4KC!PHO$7fM|bRN*;$m7
zAS&u^#1`>~AOGy<UisW-Z;k8nNp0gbe10zAZ7{T~TV!9U(;E(ly`g+?;Ivw?Y{B<!
z;**7Eo2#2o^O_~UwzZmFFQg@#;`F-giY>#h@7hqMf?**x9mZg&NdvYqvsgtbf&gy!
z(2I}%!WUN}D_{Ht4L>Z;EPwGA($Y7-^@E2$`txso^KX1slGP=p2q8QZ&T}c1<CtJ>
zH-`lcZ5c3oh!s%tp4}-F3%l8jB{u8#`e$Pq-`>{#a(@5{3d=nXL_<$Or-QZ#vqZ6l
zX1Vps3pZYP<rY=ETCjG!_u!rT<CaHpy(q5d@cRP?bsdaI+3qC@J|kktl(Jjda{G=0
z*j2Ql<NUm3BStLCj%N9_U-{e%pZk?xJED^C(cazZQ82arCZc(0`%k~~uXf}lAJP$Z
zR(I>-drQpar_i7He#!T$PrUFp^XQ2F#9!q;Cas$yzbA4LhRe5Co#Y~(<O1j9B5Je(
zqNwb+-Ayvbk58^P#qP*<3wVx<n7Pfg@nzZ{H;(!kRz|Hd*+0C}g4qx&)eM_JKX_Z3
zP^AVXC6o-CP`&wC@=b2WS-TB$i~b|~$=Os<%@uQf3mIOvv7|{$sMl#I4a{XLW#5WL
zD%B2$;l22*J@_Gr?L+V|Bo90c`&(~$79ftY;8|MoNaGPm82_y}OMU~qw8JYoWc}#1
zcs+3JYEh~u_>e2|2Yz@OXI}P{W%iA&^-E~UFUHxKFs%`zFMK1>h{INeML0}w$VdJ-
zbF_uxNDODJg=0O|+AC)`9Us#8vt5s~y72H`j;|hH!kzr{IJ>e8!)UIRM8v?;$Cr7)
zto_5i(Sj)A=rV|)Zh@^G96&7E51EBh$yXkDy@LW+YfWISf?cTP+B-=<SX0fW4t0(7
z^$M^Mv0~R1tEf5TP;A!abd<zsHwuID8e%e#I9q*gz{^O;%KX4p$sy~TtGGglp+mi1
zG}>yy32zUovFAA}ap4DLtWf2F1D=qBZ{~R(`C^h?LSEetD!xVJw7?b6LmgD@cfdFz
zR{*D1>h)^9m-1DLj~=h*3U#~PsPDb^-g|p>!~TKBd~n2r`RmN<=}bF4_f8*~S~YXt
z9`e5^<8*ygElJ)8bw7t#0zP{WQ)_EKDR&D70@fv_&}IBaZD+I&D+Y1XayfX09ub`)
zs3AoOEs@Mn2q_|@JA_fb;k@h8T)seanHEYK2{b5dqMtfaj6^UxlS*}ospeL5)n1jE
zywCKTI2-?r0aOlp@TE(>q%!vwGk5Xji*wiJPTD9_rvQ^_>LZawf=--oVvkPu)Dl|u
ze4O<_!Gp#p#c5_4DH`b(Y}7z!80A`E0f{UtYAUtzX_cu83?fn#RI1J+pTikAXN6kZ
zMhz&0oJ5zHbWnp|oMYy?u7w3x*PJm_TWabt38Ec%o@PfsbVU`Y5%P=1NKrxK+g0S}
z6m-febxW_>&X~rMr;LF{QezIDIMZO=_z?KPcp{LR!}CzkKQB`cU7K@{o(o+M87su4
zxWDn_BNKziz|({jf@<;EKC&8BephdGP{-o;b1-mHL1PE3CU_|=kvfsB@_7K*_)!Sz
z4$7fWI7l^D$Za%x1XRHC8XOLXM%gNZvQ@}heQ367QjrmkxeibyGC&f9^_0l%z>ls<
z*3FjFDc9E4`s3B@-E6s>&2K+i-P%esvzhSbp3*hoesC74;_5(tXUKBR(A++Q2DrZT
zYC?`Y|GA&>dcXAAqIL1rFQu8?zj4pWg+6v+yvc$6X!+Ya)CJ@$eNBEmvp4_cAT3Lv
z@^fFEj?UvYb22ukD>$u8h=83Af^{a`HjZ=1s;sK5cB_)hwR7#H{prHc!C=7)IED*P
z$M2>YW|~(=b+fv;*;nkcFKUn4ll+VKnO%5c_wPSo?!Rb`#@W$zprA(sn1%(BeeH-~
zio3bJV#S)vJxJQHT89G;K-5>&@kPvQ(EB-uu~WV9+@<)EBhSvy*OT@a-)3Ofnc*96
zJj{-xZ1NE3ju|BbWA;(KFtvB2k@h@3=XdlB)NclgdY9!b4wpCo{?n}kM_L5g=;_l%
z%@T5<)$SRvZR&UYC6qQ*_OsDWABEDgZ6mg{C^SlG@r4&&xUv}0UT5wI|Mb`Y^I!j`
z_(5as%75Zs<Y69{_%5@MPI4hfOmRI#CNS$v)YE5AVKO7KF9Y^J&@+DGo4&c1+stl{
z!YUU>(S16@I&EfV%;H>l>7|$El<`a;8*vT&96tLR@pu=t7(iD~T<5Fdv#*ogoR6Ho
z)_C-P0oVG8IC82BqN+BVUB+Uw!SJ1Z<uq<9B_M}hZKoLij3z*KimW#oZ_~EHRU8fC
zq)*Rzm4on%*$*bfL7iYR48|5hmIEXN2BX~U2W2!O$p@o-yJqL?%}p-@Qu&!3o?+(F
zr~4u^ySE(;H3q0UIlJqb_U&_epZGIhHaP`6YQiuLY3(y_!<=RKE!4O6D~d}Qv<Icp
z7%)cwp1%yT3^yXoXdIr8Ch<IjVQ`>FW@vSqyhfJ)uy<y7gZD<f2RjFSv45hAY$LYJ
z=>KQ+6OG8v##z6QE^w-?z7etKL_0+*6hj5;i8hW-K?aT<+F|Q_?Sr<}Ydz5}v1nMW
zM)9l`9gbg@x43uCW4m+4GYe-o=4a1&U|&7wX%T<%ix?$~F5(sX;PbVS_^B4pxopzz
z@VN0t<OMjzWjkx+ELJNR-~fd5AyRiD<O<FlK}oyOCC8SEm->c&-e`Ii?IUfy*l{~S
zI2C{@AXOOE9?%T|^I>j@6?hm2x@i=~ax|Fcj!f)Fk4BcmQvTo@-}nYKPRBB1X*9n5
z?ce?OxBmj4hJcO5mw-{7Q&LDYn({Ls3{L8sr~csoz4#T)o*TH|s4Q;nM#HV{IS=BW
zo$>smz1F2m@4q7m=XCi$KW7Yp$7lL*Aca9j;A}I&J4+?!Sr#iy#dYUgkOx_)dY+Xg
z6pk?I<*pUp;(Q1J42DCk+H9WFgh_$aRIc}|_AIY{fS4s;>TK6BNSigoIHz%^B^A$W
zDb2^f6=#D1%xRJSgQ1`qKCx#3t7@%s;=njzB_yd{7&hA|$UAP!!Xb=RQ2NaX^0=+w
zTSeJ-+j+uP$SuV^utJ$ekj}Cfzl!$#3VKo&B@5RxssImC3S7-0FDo=zQvu<eF4Zg+
zh<f=IQDa3eW$9KCpz4OkA`yMY_)3D9)E}TEn$l;KO3z@#_~di?7Xd&ikEZPI!y5FF
zmhq5<33^Bj;*3FI`fmx`$q1h|yO(Szz3_{xua}TWmB3BRsU#p{)11VmNCe%@8GWYd
zRyZassk4iVhyW!Llpy3}grejs1B80rTB$@rvd>D2^6;T%dH7IKO1170>;%!%M|-FV
zCa6H)Hy&gXPgU$>kJg#vfEGE<IdM@{)Z$HjR0)}?2hZT7j#lQ6U}Qu2L1V$l7EDIA
zDFpFJ8QC<qNQdJhEU*F{N^rw5Hb9GjzrazZ7s5wI7e>%vkddYrpH2%zwGcIU6U;CT
zCOBZvA*?e$M0}|C(kSP$;mH?^AS`)(dPj@UNA(u|*k_7GhPdSlLuu|}u~12;CDiy8
z8@Qr*I`j^JiEg*c2sXr7^8a8yZ;A_Epk7BGB3Q+LW`8=MZQSp6MKp(E)1;jMEL;bV
z9p79k#=|JK9WU1^U5X@&uqwlkBnG6*uZz0hmGJA8Tt)YrS34b-P?nRdZ4jk~wY@#I
z+W?Nz=(2mPf_g56-AkwBr6odc+TH$8vl3aaOS0nW;P&<`xEO*$iQIr9M#Ls^mrXH(
zPrUUOxO5)XZiBQqQkGG>ftBh6o<EI^jw>MQ*(AFJ1w`>G`1Z_sv4xCw%ZCakN?6Zg
zm@s_x4e_eR{^jUX&*ME5ZGdNKR|Anq45c|a1)=Mf!_jRvO303i8yjnDTX~J$*vLp5
z8;L|dx4oGT_Mz(na$*T|e*Syk`_!ivpFUl{gj&Q0o_p@vrHhv|7OJz-bI(0^aQV5L
z6PD2F-kq+Q$8~xMnZJ&f`Q@N>4G*<kwk)*vT60#w6KZ?YM9c{vpf89OuquQ`R5jyo
zKCRk2)vC?L*KILdg}1r%YR7}O4<KmjH@^VUvk-8_*LYr2B>pqxjnbH*7obs?6_{`y
zLdrC0L!3piZEaQt;enT(nW<$VSyL$?$!sJYLx?<-p`GbEIFP)HDY)DHPP@+#`Y=8h
zMl77%5f+3)$v`<@SX>xB8S>2PV6nhJ{c0u>4g`_`ut${0bG<#Ek9|*XGXouv9>ZJB
zk$I^3NMeu0QmsCBaDd_LQJov<)MtkOaQNSHzw@W})2}nX&Hr~l_tFj0e8g06*pyr>
z24}0Tx56kI_{CrTJD<Om7Jl<z{x9FSH$qD$&tw{dPL52+-{i>jJ#q9|9M1<8DsGyr
zR4JC<&)2~g7Z7*7{q;1&OuxQ<TQv-+32xWy?8e5W%U4|VcVt;-_tMZS-Q!L~#;33N
zVMmUSa91U?XO8gg*^M|VPma%v4?EA~?xyb{9aA$;<MDd-E0xZGw>xG^1q>tT@UePD
zXYV?)Te%eo-uL@meJwnPKlPCL`N^Mn{U^RK$(c>gJMFcv;Jp6@dhIgUVh)hboDP#h
zP$7Oq4IXvT<wE8Vua;Elkg@V9ok|*2Pe#|N2)9K+adwS<%DWklhh5IDo=1IJUhg_x
z;dnfK8Hqd+c`EMVhgd913$JemrUy5m5Rp#lxFnspyt;&xw*=;$tqZPN8Zv*~u1yBu
z>%H*!@n*Se^Us4AKkv77%bSlMpKF!oaX0fc29P}i`3=HxxeoN4z=TK&2-rQdnlLM3
zlH5^OR}H{7z=RS$fkb8T1~j9A9Rp-k8ZM0S2nWvRiBHwbRo7myT-EqhW|f%;JioIY
zf5)M5FEcNXp6@v0goTTi1*9b%YTjP+S2Yfw(ky%Vz`lP!pmCR&OWNoYl%)awX_ZDF
z;5f;rmh8H(u4^J)X_b*4<lWoc!=9*#_!$0~^AGzpGPWby>K@mDw^G)ajg*+(j&IDy
zH0G6*`A(|cA#A~Ka=DB9xbuBHl`4yQ!d9_fNLYf}T}W-2t3}aJ;M}JD+uQMYu|uM9
zwoWl#H3j3Ual9KqbU?KuPj0Rhwl0v6@iU=Ffa3QcI2-8X;^bPZ<7=&g!xE2cXI_uZ
z<uv#}hgVFDub9ARo;=YcJWwaf?^*MzVMzzhGQR3$MGUJd5(Dr6@L~=aV${#OnFBAB
z0+GhWJvMZZ^-0XX!srsv(Yq*BLGc@~WtJ7CpwvVpw%U|}`}>6Ikg}k|&Y?~KSu7W8
zA7Y5y9rZoc&yq%u7Dow806Mb<0VLJ7;dXbh@D7x^VIgw5#i(OwVfgPnLp~M7!Qf(|
zP%8GUI?!YsE*XXu{hMBZkv0&1heBI*xB^Ojt5&;y?P|=Sgtj)QQ5#z!oCxDJW`mNI
zs&bW>BZZ-B^Vl?*4$qY;m}#TRFw(#MakMTf%Y}m5U9XQe%c$#accD<%u`a19tD`iT
z7AtC22bWJl;1|Wn*|K3+s7Xk%EiBY(Xc5&|D>bwTHMl^3@mfP`QfxS^kz1j3V`|C{
z9|p~c&$Y27g?{b~HTx~jG6_`c<UUOG+*Ca0%VnSML-&+GcryxX@BqmVqrij~OE#b!
zZlf_4J%{Q!G|#P(U1n6iuh~fT96M(`4^_?4Q~d(^&8+0Lq7-;Q#U3h^2Fe3)rL9&A
zi_J%1J<3R0u@<O`sWp>Q;q#TtCjEM(1}BgjoI##v0!9ytQ{ai|L>8+tsMtmkNSl#H
z#AZ}76tZc*GS-{g-Hk-XlD&Gnml8<{P8L&80UbTniS?eY3goMdvRbE=$foZiZ-V?q
z*5}hO6Ch$CTe=u4c*q{FRiHt`E-Yx)g@siVwHh`&)x>N(9*>G<!oz#v!i^ix%?D#E
zD;J8`K1Fmvc^e=3?sql*yWb7@p`{H#yGcR_lPW%X%0GcC0$;?dSX5O~s)ovIhn5u-
zUy$*am=2Xxc90#`k?%-DnE>&FM^>vkv$a*Mst^T<`XIr+l}^Yq{BW%2`A`Ty$g)Mk
z%fgpwESC8oLYu3o%i$o%k>)%eONO-=nqzTMsk(GLBHdM0;0F>T=g_}&ErbBZSVf^)
z1u&Eq!eN0P6lSYv=XvnGGo+tsmXrmQK{XvbSldOGNSD0PXg2Fw_GYu*FbYd%@PT5b
z)#wZ}q@U?>Q8yfPC(NnOp(j3vo=_#JK;qlu9><e#noq(i(v!doOSz34b!Oc48a)za
zVPTDQMr>h})?gt+M&R%XVCFiHJednIr#LCD89xhc`iO+;?o^rj1T#SabGs<i{LB)Q
zL~)jQRR|RzCpelB6x$}yewQfba#VgFjn<4>Yz`frWLH;F_j;(K?t1h{K^+J3x<68{
z*zOzADBg1GR{E5lx(Da<99!?ys<#lXh6`9AN0R-LeqlZG*#9`ffV48z`aeAbF5+Al
z(LU%l(8d+VRlUR|Nm^o{2zEr-%L8sODp-!Idx_ii`u3R$Uz77gg#ZKPlvjZ+(2jc+
z-g0?<{<L?2j?m8XFb+KykbGzXfjN}`g`fa13HYN_+SY_^tSRn0Y9fJ6dBR~V1;rj=
z1b71`ksaB=7SWBz9t-*8KSj7OLkTPFL17w1m_`D2IUmd0VzI`S4Ydp?1MT!<v8}B}
ziZ96tcUtBY@P7)rmsy2X9hp@!sq{hfA5Iu(?QdX-sM}^Y_FEEmC-O`6?Ch*9iHe7r
z=I;IbyLwNPsT_g15!s2{Fz4J^R_d>F?DM$C&y#hT8)@>IioVr`!6;bKDFeEP?=sUu
z_=?hqroyL!ywXIyI*9a5h;0^D4-OO`7Aqf0FXo8*nXND`xTVnMWLj9`(XUoNzC%$M
zb_sIcPLwqVn>DB10#)7>@7|tw<)+_XeEh>7{_t^eyw;s{M{{T?aomIpd*SZ)H0vw2
zLg<mxNt4Ia8G`~3>O;P&R-Hxn6?ge*+1GJai|zmtmAr=B<!BC`9`%zWQ$L>K1JwR9
zj$UtV?Wmp^jnI*%nd8Y5yZwl+8BNa2MB9u!#OLt&0Ct5N3c}GK<LUZV9u73+`JO$U
zL>nm%uFLHJSmDD~{b<~=yc}e8yc?MG)x~K5qHzEgPQ+Hz*1wLce+E}i&y9D?QYSlR
zp*Eg8fkRIL>;g7r8?C#i*4*2f*x5T~9hO0*Z+l4#c(hm6>9zKF{5f4gDN6bZ+IN99
zojS>=*PAV>HGxCfZem$DX!KbdEowHF=rRR}CM<UiH&bshE77nQT=H@aIB~xXr9uqD
zqS3ZujEZfe2#0v337CJkfQZ!eNkb7xvPa=!&v;Rth^f7XA}z!u3$O`Dv5Jt`<Cr(!
zx}WE9ok7aW4Mc$%-nbDG2ZeXud8aTCLlbo4vuHQ1!}ET>(V$j#yR>^+dsrUQ^{qqT
z1;p$YjdJ>qr4MOHaQrkkE?H_(Yyb?2Q>ertJ-@r#kzjsMz(c%ok9FRt0y?T1^Ye`Y
z*3Ci#LV0q}X!oFH1!O^Uqx~M4!{%LBsRw!)cQ{&st!NYYXheGe`DKh86~zllKtQAM
zKAlO^iq_+iwHh;WBkbtDat3zfaJU0Lr&Dd9Lfz-f=S#D*MQG{5&k<KwH}_V*t6^4T
zq}A2=`M-FST~7x)9oqb>R0;;I)*t-f#TPH{>;O4hTEPddU%z(Q-_+Ra*E7=f>p%Qq
zJ9Pc|bG_Ts^YRci@_BtVphnfI;wT;zT@vxvS}3I@?5EW-zvxH1oxU>uVzw9(Yc;2H
zPzG<l+;ci>H33m7p++NQ36Q789vslu7&W4-)33(aSd<}TXM{qN**9P4?$J`fM!WXy
zF2=D<@HmZLZr`m6JtLRR8jw0K_bk!=?#AQCO%?!(Nc&Dej2P+6K8nbwexuJ^Z-JnM
zA=6Sic%~ht*OS_aC!1W~8bmIy)aN9E?@^23A&crz(pm&+e}05esPZ!qDgtF->ih7^
zo^2Nj&9tr81I2_x<((w)Bi=OG%{h!)XklRuEH`ILB?{kdJIH{)`J;Cqr1=-GU%8x7
zcX!F7Qs1AMfd^G8U&5bnJ~!`6^FO%%_WR>rIsHt?R+@GHcKh~r-?p*7;plCHd5pS$
zV#q>HF=OA_nwuNG>$%~1r$0A`Kh4aLt!8(2#%G<5QJ{pkN3CAKc^A-XAP*kE8$n86
zR3N6`gA_GEP*49T4RriJKI`0eA?hQsJrcyYeC2AC#HtB|3a+Jvx88bGW5<?~Jol?O
zW5DOz=OaZ(RJuKGhuriut7QWFupP_0>CZ5K!2FN$ufDnf6fSY?Gr#;9=ASWtkbwZw
zBD)rgku@q558O2;6xCs%@DW$qq3*x;ERSctxA*AnJ#~CfQ?4xG7M$qG`%C_Ok|}Gf
zj}dnl)@Ifgk_-qQJLj!S$7iXh6aY#Kgm)Jo)Yv!A`_$wKP3^6M`*y`y0XuLZq@x61
zl8ZC(vGz5pPmd^GpZ@gZ$aH=AJ2)R@?N$ioA~vA|olz{7>o9QGqz0;ajse9YgSxr(
zA6HLn-a)6SD>e%Y>MSr8o1(*m&~Pg=c1<9nd;?3`%uIR(5LcO^nlic*>RfID(cB@z
zxJ1M+QPE{=;bpj>v)?xaZa9SAKE}GyPpcOnJt}m?z{QIf17f#;Z6wd@p+hfmCL$5G
zNnw)(sBaC!22l*x(}W%}0eg2;_-6a4#zXYxLxCuj3<)^i5H&%Cw-!4O*Ye~~;aWe~
zUHAdG0=JOJHods<=r{w{T4&ae;94up%7@`v&UUB;TnnGUKf<+kg~#BUi})D+nO8c6
zYkA7<(iqpGQ8>l5C?|CxZmI+oi*RW>odH{9ov<`c7IllD<Tmtf|7ZrpZW|dy(;en)
z*;wD|@eE>6Z)hYHq^=@v=GwIdzBOtIai8e?ejU2*4<48(N?m`T^8f{S{Q=^eSS-VV
zbguz0*k~{$d5{Ks5~CJI7v49=*>Xk#)Iv2;efY4NRPHf!jpv?Q;G5>XlHWzh9DoK?
z<{C&f_4>uW4F=TKM}SVal}Nk4^?=M_y{+`D0F~|r3AO5Vq4U`31$zaE*%x|a%nEeQ
zh+B~~D`Hbf#lh(qBUV3&D}4c1(&jjnjra_sO`M5(yB!Ku4-O2`Xj|YCge+}rZUkIu
zbt7jYLq@k}r1*F|SJ7mQ<8rS{ElAIU+)G&2;-YK{XE{(d2|vLtEXp0SI2{=QH*l^P
z;3>k0LcU%<#jmehcoR%>_WhtSG)5i)#VoJJS+9rs3;l+5ioVm2oX3&(cH8i^+HG&X
z+XmSx&`w%(N||BLKWl&_XbnRSFj1;l?RFE1QG4vzHpSyf$RmhBhQ>CbAB1apUD!~-
z4w+sA0FIuAhZ#P1-ch7M{*w<PjCkZh57Z<Z)$lCTBw>9u=zo-<C^;LhHl~V_w0{SU
zKtF`s{Qj1?tt(`XGxLyHBpXAjl2O{#l~pm`M69t(P?p48jUG{!#OI1@KoYifrxSP$
zsY}M8bTRTzC#|v#dApk1t`4cBUnAuz>#(|=Q|<h)T{15PY{icZrs*!X{C;S}(K74=
z&YKnhQgw%!`C)a7P^w`S;Dce{e^rve%WhSN7W0<f7Mw%&dTF<{C{n3Tr@oDbtsx^Y
zL8zu)vxvUBeH*nSV@5q$;txAUtQ10JR`9-8XavyAp<t69{Wx;<$euiE&JS8`u)Rra
z3J+Rx)tH)#3ENXrpHb%_G{rDlga~E|Ad@I6%n#M3`a~y(@5xke1FJw*cO*JB)*m_4
z@FT>E7)6Or7b*-R#0o!jI}HM78f}gsQ?5-V{p$w^2?s!W2(d!?1#X)#z|J%cO(5Mz
zIB*RF=L;Q7t`TB|A3BVMFjUKcwy;|*51q6$IOse*tm3??LRHPfizw5-aKYUZs}Pf^
ziaqy44Q=8@2K*ieP9reX6WJ^i2$(7kh|UC`8v&MySv9bw&VmmTtm!~~bsIyp?;t<J
zbv>}Q7KkE^GK;qts-=QX)urfhTx{z==f<;uvhY8Jo><1X^N~e>ycd=b7vz~Kd(dp+
z7s$at{foq4I2%AGM26V{JqJ7p4Kh#gqpZ+cbj8A91kT`JK%_}?I6JVB8<nvxjOL?N
zN>SqRBLXqA@NjLP`qZZq&dKw^Gc%tX>BImgJk)bKiD6X{NeG=7Ff5^{Aes>5_n1jM
zafo3NVb30dQf<VR&l8|E_W4-a2hfZOTr`Fp8}ZlU>$ZgjY=MUz@20X(ni(;hBla|g
z<=zifL;Gr#{3RY*2#mBE27(oCuF!6ke0H*qPP~(;x3h>IUqp|OF)Y_^y8+s)EQSH-
zrx~nv*fwLeP~0jOR_~hd6)4ydY|8<D_HY{;S7U6`IJW%QtIuD1{?(Vq_WlsLqU~H~
zqp|~L8;04i&d!qIHIb`hzJu2=u3m+#=Qf5o77<k*<;6_o>I@&^&?nj5>5yb1%%iot
zy9+&vq(Gsrpb3H#!{-jR{cr?OHI0W~gq{JmTuK7U4cQFT9g#fV*eCg0=misdANEK*
zvrsdJ0?BE@tSQ58>A)Y7ah2AP)DdadE9^&DZ1hthXcIz7!;dlVg*G9Cw#qnX33d~j
zgjN#I40)}?7RhOnbmq{LSSr@x)6dz44IG#Si4J;oSa4Dy<ho(q4&HzN{e56#OwURi
z?}Zejb7Fm%`jwMs`N@tDGwY{KW)>_R7)fvx%+-zz9=!shT~+M{Dai-1s_&y`&D{Z$
z{y|d#VG2pALet$W;I6TT`4zzI$Rpr|%)(f75$G2>i&g|TbsB>eg1XEqw^}_@E)+@#
zq_mFOW;t?2QChp8pY77NR^zHw$|_9nilQB|<KsHC!+I8~;iNcCSU9+(+}Erx>JPoE
zE|-aK4ev6;uc~`uBXUKpKHTvcb9E?inGq~3CaM^j!I+Kg!dbjH3z++{^O*Z4UdE4f
z_@}Yg6d#yqxjATBA3cwWe+|C|ZAPE(NF@M)UmD?J<8w})<aAa}j!b)jvTCoQo$2VA
zn$qwQXtcQz5aPr(LT-w>?8CrRal4ZR7au-LRQgbZIepu0RaGjkjVk80K<mW29_NCl
zD=j^r({25*Bg9&o$EPGuG+XkcKqJL-d*$-&jOFF)^RfABFO3Xf?%90!Nxg&W4?#)X
zyors#GM2UPf8(3q_}-ev-njACX#uUVG{ch%Cw3b=xi23<^b>{dOz^C|`69X=p*6OM
zSZBM~VXPCSAj;t!?ubd58Vq|%_hAFU(3$)5K}4`{Vt#*EFH$8H@h~i-UL0gFgZI)I
z>&w>{;p{G6e<|Y}^<dj9pg|wvk85v!>zm*F=AXQ|_VIh~WGpViLC4x6#5b6V3)?x-
zzohV&uQ1WAV{`Vy+CCZ4)AtY(Lin^zQ6L;FijQ_5qvw;{1|Qdig@wV|S_UdI-$$y6
z`>f;h@YQZ`_ch^-H<*`SK7p=G&w2VPALj_|DDo+^1o}JJH_B#%*=vXddKq?@KddJW
z+NLGNAw<#y2qUepYr^{azTVY1@K5eUvZ%6viN|^&gHQry3E}vdjbT)4z|9h5hYebS
z{`r*^O;}k0kwoKds>3qISqLAv6-R6Ypd~;`8?;MTYoBcDPQF+~CAFQl!crvCK|vD#
zb`pzYZfA3K)gkjKnU|r_v$4GksNK1{yP0)R`D@sb-OS}O<kNz)WyUka!9{kO<u&lu
z_8BWAfHVts6m87TBK3CbR;#bs`mI~Hn16Dsb-#7%pO{Z}YI_s#ma*^QxXsh!D4I?(
zD4!n1tOD+Z>h72encIwxFY_!PaWsMVRZqP)h9i$AN2k{_+fhAwJ+ej&H?1q8tDQVX
z91UXjfz#&pVV4BB)dN(~P$WCql{sl8lnkVi)pF)YV$rg_&6MAL_uZ6JP<D2X?$w;M
zUb}Y9!$hNcFLNZ#Xx{PZQAcROGFsqowIl^QS>ow7q@%f#>E%<Sl*!?hZGv(%b27c`
zZ6r`eJ^Tfn-Haf-wDlz7OgvpEK9Q%6{duSI^%PG`<m>r193oRt{iIfTI*|qO5j^Cv
zdOgvV--Ryqp~w?PSmIE;p5OShkqZ9n^N`INYuA%V+Y6%={U4xh{{VM>10bqXWO|gl
zKr~gZAqH=D`hc_cAWRLlv)Ngtk2JlBKQJv|wRz-nIKL{U?AWCTBoRoUVZIGh5qFq}
zm;3Z-p-l+{oQJd1K9doDbN^}j28{4NybjXLS-Ns%WdYyk6N#B{czI@awqFB~P=ikM
zuz?>MLmMtTOS<ok7Dy;Y{h->zRvM@wL~TUG;^cXqdF7SG078lyBy@U}ZSazJ8-c}F
z#&&yx=VDi<<G%CMZFZh?nNNDlKZ73n+vuTXmWLDqUI?vp#Cw!9VX5ZZWw&9&bjYDq
zO0X<LsLl7g#%)seb~DK0kn~x5Xv4(UEYL_A>IRodE_KVWNqhT+VxD6`M?mP!&@MPT
z#ad+#Ny=AlCdgxeU@gif#UYg3-Ec|!PH_gyf5IaIbgyk|;9<9Hc8@q1J<BP|4_A@Q
z3c)3#kQvYkvGW0-@Lbf=<vroBM+7D*3YBs&<P^kOsfQZxu4T3n1$NXU3<ZcjPb5$B
zb;SzkU`<GKSDEXwUL*SlQ6g0I=StlHYFlHuy*59ft&Xf60h@^-#Utsm0oXYKT-nA;
zP{|uYz7CQd=?L;*+l2A&*BKz97)gdH^tb58Hb0|vkPxY#M4!iXY>A53J^@AH&<xec
za0IaIJ+k)j0IGUgbq_@=HZXGnrs~Q*aLt`pUWjw8;@19Jwm#rhUpn4+<9m3$vs;FR
zZk4~)=_rb05fyf!4g_40gKDN#!)+0`UaN9YHJkwsrMk`!b_R;#ieJ36va&E^X`kx}
ze3b8k^{RR3sGsy*NOuL)p5ilX;X9IPJkxgp$!H@UkE?NfH+30L`z|E8QYb)sWoBk9
z#5ito9DNx_Upje<3kxRElglksL!c?gb%up5Q8cSn;13}$j0RT4k<Rdi>r?Hg)3%f5
z82LRX1%{E3nurUZ)D}*j))k)A3C)-gc3W^^;x`&IGqcOf7LnHT0=D1+Q7@1A1k1zI
zCJre<29oW|%#i7y_li1T(E0hTy~n_Wpno!ZHHJO9QrNQ(8Rw{iiY!ZtwKyU9cdm!>
z_i-<OANO)yXyIHf@ca7>JU`Li)P>$md_FqoArl^iBM?Fe<+KU|;IhC4(hC4@U0@6$
ztLP({+r7FJb8|MELt#6}CA5tGpr>J4rbMfEW@c_FeZ9gU>>gCGIjI$1g)XXI%i#T|
z*!3z$RVMTz4>nh<=)A-6&O2-A<%bUsdbG7PT4X4pi`Q>pyLr_uGe$YrLa<0XZ*!RQ
z(3<Q(@BZPrBbHXXl{m2RgCPb)q2PkXa?4CwW0MlNM7s}Qt5~vEiNxcl;8A4&T$4!|
zzp%~7&Q5%{>O(5Q2c=}++YJ6)x;a|yehOzdqjjw0PVm_3=#**+Vv%cWdwJ9(&<YZk
z*e=;Wh#JBL8bZC4IVKia)NLrqUvQaXk%^HbZ=ozjY!+r961ftM#|arFtQ6ayU}oS%
zO$4xF4?>YvK85`@G?j!RNtP5^gIMvR;}!4oXx~rZ8OO1$rq|z+@W6adJjZG&5Vj4>
zdXIxVS15LCX$23^uGockW3(TTbF?2&qmaw*Rq=e&@jNm_4YNWichDX>B7ia~LkF$E
zemT6bGUG|x@Pr0N+fe*^%ScT(#qr0kJb(Qfp5VxKA7UK5mDUuWOXlz2=g<sFAhm|P
zN?HFX-zFac6aul=*3s%zXnA?@+O?PutU%`3vpwCnfTd)?r|&&WC-^RQLWcHb7eIC(
zpvzd0=E4qM$I7~;L#_-j3jMJ=1?WDh(8Gt{e*F0R-^7j;%#9lnMXvzM-PM)IgfXyy
zep^7lC7mP1HzKJW)soYuT5`^jYT8L1Iqigw+-Y0#C0yg@aSdeS+zxW~k&km2yQp>V
zIUJQ*1Kxg<l5%yB^1@-R0-mZ0MLp313DxJXco`kCpHMsH#cC592V!4qok1qfOvUZc
zc-yOC`(O00KQJg10_M^Z3W0X+7YSElT%h#0pz6Yu+JhnU;N9(g(Rbwv$|UL~24xYN
z^~x2WxW5i3<J`IB!yUX7XB8Qno}0csc0Kgja-3QngquZ8tmc3R1C$FRIf&UnVF}1z
zet&Nilmw6-#0=ymD5vmZ@X{rX$IdPEvvraI{}o)}SI|dSk*cIA2I)X*e7%QM5=aD9
z>@Y%J3UWgYf?;coTDvdGa0nCaN>m*%&tHrL^&%FMqQ0~={vjB<{*uVMqZP=3f<q}}
zu6E6d0H%j2hHc|$;9*!=2My}RN~3|K32NnperL!_EV@k;u%$BkY~x_)MuN#b)Li2q
z4z?aW61i?&5L3Jw3Qcm#XJIvy5ivzpP9OQ3{@f%B(I00Vej5EtwPq_H$6NRNOThfi
z4X4ic*zc}<9FKi{Z7z&QZ*DntzSn-&j9@;8HvU?iT>xtHVV)jkOXfe^+l$9L?T_&I
z(#*|I>hfhb7iK?^+c%Ds&U&^~_x}=}N91U1c8dLRG(bE`1c`85%z<furDNg3DN@MM
zDDixL$P~f&M`+7GLR&(1+OA$@>lO=bd)?_EOGd9oR|^lt9^eV!6E%Z}j4xt5zGv=v
z*GOwtqxsU+<>kxpQn5eH<>lq8FEx!+q*ZA#kW!}kn8(D->uLl(_fkZ~ujv;?^#j;5
z6Fxb#S`@#z@0G-JeTMDv0E597Qbp5I*>CiD2iEi;5=d6X`Dbsu_ulv3eOI%-`!0TZ
z<IkK*Dq^);nZ-p9S1fWKtQ8)vv4sHo-K_?GJ=dyHw)+b18z6`zL3c?~jNNRf0UX{c
z_zHkuG}qD+W<AE6V|J2|2yAYyZPuWH-DMn31Z^;>{oEqBznZZ5!CP;=m9py1Nn*kr
z)wIh1)yB_q?&V7%ztbjj!xnb*3V30XjM{;Snok2Vnb!J_qRz$UTvp9Fh`{v&4_fp+
zdxjKcCK+khn?7uUY#sI&_X`L#+ihp;xf?5sUere5vxC9^`ftDegKz)a|5<ZN#L`5Q
zjb{Av$irp9KO?5fzeoXi$J`p_Ab$Zzz7j_z6f2S(t7;S3@m@%McJzd?X(C=t22V#p
z5REXShwK4>REDMhK<j`iRtbDyG}fazO6xY8W%M@aYowtCK~WmjCQQOLnz{6w$j@|X
zou%}&D%B~+Sa;wg^Uj_wD#<W3whab%&oM8CL}L$SYK9nkvDK4%W{(nn4&@ukVn%_e
zI8v~K-eN(wJe^N8u=kBc--GneqR;Z;AK&8-_rIC!;fru<ZU%0cV^~L#1LC7$7lea$
zlY831ZVmP)#ofL{V+g^5n3hnCz_mm?f|)|WQADaF-*+!9?dM7cCsKxKX603nC!KWM
z{A|oPc!I*^C&ePx8wuQude?!COw1Nj3`=NV6gvc<NDDk$TIp@jOTOUqwc9y^$Wc{z
zKrSTHDP>wRYymhnJxnQSanS1tHe-;9N<C6v3R<9;oz1o^)#_TiJu}l4OfIh{opA&a
zM+X^e6JaR#_S>5HbOVo09__NNq7CY#*WmM7d}^YR^A!bUb2!}5EZI`yW;`2XcTuJl
z&_-VGEBMUIXm{jTyX`$t`C5hj)}+;r!&VQd1c|Hwa>;!#BQp^JjD)2nACJ8YR#$7o
z{rymAae<-4aac`f6l!r;w6*a^&HC0`z&nuE1(ZN}8OqH59In1J1S1)hde)ip`yV_m
zVLy17ArwVRP&AnF!5Kfu?e65se*|XJYZSCdb~6ja2Otd!S5{ZI%K88bMyd>2=GJO@
zY1k?w$}U&emf$6=TwRIaIl7@0vV*C%gUVzwQxQapA_vKU;H(y@R@&$=QN#`z%+;&&
zPOi0$_+h)nIp?pAt&10J^`os;_X3s9G@D?5qC`B+Br?`F-zWZhD1^#O{_VH#-`ALl
zn(?Rbsh^Ltvk~HenA1fXeWRKlQs4)E%11<Ui0mrmnJU#rty-zrLd`v}zZGULX=%4w
z-9D<BT=-uXKR>HG>xF`4aS^*2;gsg|<9WDk_yvG0u7vZ7;Z7yLzq64mR4svUd^Q-U
zZD3~vwYpKAPlj0Fsr;ZjWPpMo*>wr7Soo5f`(VshJ$x?i8#k^eT!>fEK!=4j$TjQs
zvy43yrsra!K@g-*+G2B2Oee((Gs~s?&{Yr}ex_0}EUsDj>$9pjY*x}ss~<dhwBOMU
zA{c{bBD?9is0$E4JN8_XwkinPc({6Rz~Xd+cD1v=&8)1bgF1P!>-B*=yE1+*6t|HY
zeZuW2mp;nUrFj-xz?^U5*wT7B(e7ArYh=EPRR{^0ag8c5BP+&?%vhTDDUhC}9SXob
zN%=585XLeuj?LM~o{d{LVPY(x6Rn+!%>iV{hD|Z^9+yqPZj4kF(cM^se_AS~lkV-@
z&c=GJ**BRjD5aA4lnrRV=tWf@pvb401-w7E_RPqC@WBUF&b_iy*ayp10RhlAAMaR6
zz0HU7xCAV73sJGP1)~LaOU+2x1{gm~=gC^jf4BqFucH4*i~f2Sf_-?2y&kse_W6BE
zpA;;B_?JplUYV;HV0EY}Z!kLj3PvH1x@;D@{#{M65LD^~-?Y+5c}>~}Ok7VS0f^;@
z*ek83uXlAbuB-OtU?lWxE#Dqcz`3-tvNRt6D1ohX_dxr4xMx^ra6F*`j^|QK9h8DR
zd4QO%z_{HrlsgYZu&>wEs~#gF5JqK-7@o--{d>5VU&6gy9S)Fj&g~Qiq=pdi`yEcw
zk_*^@ui>S$W<8)!W=ZX?1Wu99f(>fPL>&O>v+!7$+q%G~p!7A=oR1zo+|UKO6|bQ0
zJxX8YTl+hEi}QAlOy1KcPoA#l0Zx?-i^DW}VjFpr)zzvPx{MdJLVXenzm{PK18|p~
zZ2+R#c*=0MT|>s<VDnGK62^2%d|E>;nXKYJ#$Ehl+(q&w3uFSlR<DD0n@|{Y_lHi^
zAONw;5NS<p4@vFMWo5AYEmW^WTOWVK{k+&~cUn8uwqUgfuo8yt65lRw=-7(|T>Wgm
zHne$s4m*@gplWBaJN+IzSpKk_$(On{bkOcruSj)h3|7LWfOS5BUIfZs04-*t`o=oK
zHf)!p(Cl6Kv}XYh6avs7<ce(_!zQ)LS=`T7xns3;>Y^-Y5lYJ&rG2(nhcAdrBIQ)>
zartsziA;7xKb#|+=u~sNRn}>CC5T6;9HOPDP}pzu%!<@57Ex^YTtgREgrOU^=LT_3
zTv|f?WfdC*vqOQ;EU@KlE)lme^tRPHV~@pYVOmIBzpy+v3)ns!Mra8_PmG>RSQKlR
zOoe7sgQ6?Um@vdvNmvffMcgLw-PFha|Brmq{QdtsdW={IpB`(cz=yypjARARI;=4E
z*rB@(9TadolPoIat$}@JZ$A*ix8#h0^$itXB9XU6EH`-3VuKg>iM-L4gp@~++6II}
z#I|G*cq+BU;CM|r<sqv;x2#y}b0Ke^$uX8rqtj`qk|nsa*=K^|b^XWC)*pjqfro5!
z!j#$t((!;Q0dffB{PPU}sY%Cbxhe7_2WlhdA|<iBVCOAJ{muZKAzZYFf_`78g_Mv)
zXqSbZk!5@?0I`@(4K0P_Q*W4(2H?4tDt`ZX7Ew=KrJjNY4P|xc<mfJkyJb~*$z|;-
zOt;Z+40?NgZz~L-6B(T$lz_~)j^EEa_=YO?nu6GDsB?Z*vw=~h42%L(9q`}{k^M9|
z0C8{tKwEdKRRmH_lbDO$@-&Dz!uiOIA`9}7EA5iiT>-6F)gU@K?x({@!hp68)xa|l
z;9(4lWgkiv=7LSGyq$J{qPy)0cxsvy3<6Z|^ai(+VU$y;Dy%X+VxE46vJW|^HUS?S
zwA)rJMow{vKWo-}9tFTCCFVyy@n_LXuaWhS(LPhyF1%AIG+Qmb4%Z7?sG_??#%O`{
zgm|>ygA^483j!$sioHGqq_8Kz%^>nT_J-?WQP3MLSHS5Dc)Wy63ght2)EG*qIb(>5
zHWY%Bcbc}*wpO$xf_{RKhx*cw)|g(eNQFL1yN%PLq+gOWW<Fyr6{&mdc2FjH?CpG@
zF~#w-ejT6t^*9@!Gb1>h94~s@qZfW6Cslxo*PH}Bj^Pmh$8^CW+Tpmad84w}Ygv0O
z1cbw`p>c3&)0kSk<}l#40tJAC&d@j1ndEa_L;}d_K{vTRnol^F2XTglLG^S6hwwY1
zTXc30sz>MpgwqI<`)JF61&bM?uq-eM6z8ZiB$*6@6=hU6gME)Eq|;}m@tm7HnK>j>
ztrkWBgz2!FrJA+oE+b(cL&KNw6Z8h)m0pU*dCJWRveikxut1KVLoh1oxniyYp9<SM
z)oN%H)mH>XW(c-FenVzYNGByw<Y}!$m9$+ABaS@zWd75)o-_tt$4HJLFt7o6!efv)
zXc{44<qh&zAaIC{nUPGfmx1@T(C@Sdx?KbGAhV)~;uw-N$;8kvkYH%w`C{`mND~3&
zCe16mgNlcc@k^?HpI21?>NYTV!BZNhWb8ZF>I^7#I3AJ2i1`An!iBzRawY6pUKB0Z
zx&-5*+wKi(ReZMDW3f3M+oywYqd@ev@hLk9=Y*GF*EGvZAxyOXfB~7OZ-E810KZC;
zWW!`&o9Sw*l)zZ!1ASOkhLhmIa8Bsl%y`@q*WsOzIpk6@XX%z?{*oJH93H};W83p(
zwDZf<PQl^#865_K&UU-SDzHw}j(Kdnxo&iL3yw;{5V!_1_uw9?O<1C8v(tGik3j>|
znsPy}xCdS}{CYIr#$m(z$P6>et((n78z(Ou6|miwEDu_>(m`prRBjJ2!?1MqThNA(
zlD5G>@_Jjw`(=1WP_-Mh`p5&q09r>j_v4Jl31cS%Ha&ffKKb9^e*YovH~E5<qRhY?
z)bfZBPQ0W>dlLq?0(}Kj!?N!+#}ESpQ7P`QB%H>kSI{7%)05<`fph`9VW({A8Tjg8
z?+X~`?!ap64|pu6iXd4AJ)3oiH7dO@KMI|xY;#mPgC9mO0<`GG&-XyYrTvqzhlFTR
z912El7gYLs-QsYF9g74sY^W&?Tc6g1R@dgx+^S8sinQq=gSyeSXpvRZj-KwH31*ym
zeE>${$o8Lp*Jsf?pTQiOW3i0|Pzp>DEC6i3)g`F5-EIwfh`A7yL%RbtiIknJBItHe
zFsPw=96KWtP-FBmbF5LXVI<)j>?CV-fYk1EV)2GDgbWKL;S4ZaSOYw8e`(wbAUqce
z{XUn%1Yk!kl+Ydt?cr5-wVb}oR|~2?J?3Zs68`qf_#39EVyD4l6*Q;nkgXiWQ#E9V
z*qY|HTCtYOGQM@YR;ziMq+G|wQdaZ1V=UuA!9W1nA)kawc4V-JRZ@2O>NUeK>stm^
zXh#?w)=D9(1N^s@`4Gg#QP|01b`JRYd6&y<T2c-#Mijn-pr%EVdWuCBWefIhMF60o
z{C7XMwOx=j2)~S&xU}+r8uy@$CWppR2_;r<bPP-o)cTOQ#*L$3XWA;-kB_#dlccXk
zk2YZjh$5^UqNGAWmd)n4hp6Y@&2Htf<b^`C-KC<@Qrzo}GYOPQ{9+tP{n1MjJ`0oq
zxjX?uDQ**sL%&ZlojtQPslx``wo{)Cv3>#NS7=ik3C2L=zZwdfCW<G|%jE2l`(=*v
zAlir)$}NAp$g-uD&7&$7YAlPku}V)<WZys^RvE|*h<~kkh_J?2(6`AM@PWxa8VL+B
z)B%|AWGi)49q~rZVM%!`j+y~8Tdp~%YRB!UmG{%h8M-|ki{$7d;}eWdhfi|sV36`a
zS)M~7iH#jl{-QC!K96HtGvVhX;}T5}r!!n^U_(eiBa8^HmCs@G<!T2wP-z1k#H_)Z
zqdBo2w8~pRT(`=tfmPAO29=QYGs!ruA=rBC1D`K~DwH`C0dG?2NuhXU5xbH39N6zc
z1nrpV^)+XyA^Rg25o}(J`0cH-Cc=UWgTc5*iG>@$b5AOm#q!9*qm;p**Mg7G>J2g$
z;#}e-j%19JLg2!Mz<A9#oRx}mFNayV`XpeV%u1@qBdwfd05SmzIvpJdR{iwnG>>7$
zW#Fs`DcDDP!G#T=jHir_#u|tAPk&AeNc2=ty3(rTH;}AxffN`Ix+a?63%D9(+ug8y
zxDSA1xLnsT+l7ZFfs6}Z7woLNNr7UXjwX`|mW45!3|Xl{wVj4EH`xEMDwNmwGR}5!
zh&Tmr9**Lp5Bn_*EJ`uQhrlQn%=dGC8Tb1#+Di;dw=cL~bh)v7xLqxhiql);Z8jkR
zKnslymf&r9e|IKm4%;?J*ffTRX~w7FKUp;KH=io=V}2@~d5O*(^cD9fXC_>`j-mu~
z0OCS0gwPun6jG&KyZgbJ(V3Ycjb|{*B&c};f<#V6=(mV0Y_254%KSXeOHz<mFr1dL
zw|XoD6GdK?F%v;j0f`w1CiWOMjcN!8WUDkfQxdPJHoM!WL(XJ+OAFamm4L4nvKH7n
z0%p-~7sciQ>VXfi+F@w)8)?~x?H|I-9)QH#Lbug6j^FU{c4hZTb-D%CB~JSukh{m(
zY8Cat0yG_VcR<zJ*#%nE*8%XB5kKJ7uhL%Q)FBoO5A+B+WWi|C)`0~mm&OuR(gU+X
zO2!6svM1PW;3Ca<ZRv~;JKI8y3GK=;VYHF@tJO~nJ^ir1j(Z&wJ{(m$&BjTg4tA0L
zNl4hp05)}L^i2)}1cnnp-T@$Z1c3+-pm9Lon6`Px{|e{$S9lVyxl5HkG6J>iJ3p#b
z)En35RC}i*xV(~W;gwhA{`1#@?2xem!$aX2z(3vQ#F_x0uC903!Ty6EiG1tN|8h-F
z-*mtFO2RJphn}U2hTFKf<R12AJI;ZsZD!~$JzL$Y>uBb{WSI`+Fk^i1KvN$)f>4ZJ
z-&=iFat|pn_gWM2MX$%p7DjZ~>c-G$^##!t^7Y%SB6MNu<UVV{i3s#C!Ql~McF}O=
z_#xLisELN9*BV;WH`|P52v~r1VqfvL)e~~C*qL`=fe|U^i)EV?DOKzPIX(-{$Vd%~
zrdk?E*>I9%vD(VTe0idsMil`5_z~?vBWL6oNWfKntBgf7D<wG*(uLu0Oylpxvd8PR
zCk8MngvGFk%7Im1HNl8kjFMa;Dcs7&?u|UkakVugfu4pX8x<2@lO8>y^7soE(qjc0
z^1g^c!4A9W+gRx)+;7T!{49<y`y8<qb9O<9&YWG6=nr7j1^hkaV_HTJTsjy9OpWOb
z6EVY_D(1#?et|lIS7y1G3v*~E8=lNEuk-jE!?q*vG19VuQ5+G=Ku~XUU1&fbF)SJ&
z9<zYY9DT$GBTt2u5l+DKloVC3+FY%g#y0Dkj2-CJW~F9#qB0I(4Il!{6OF|e%nI4%
zQSmS(VZ}77Lv^EG(xgUF@z56}JKUOV^XUgRpSxZ{UJF^aG;!<3UupbK<uxO(>9pTE
zS&{BC35`i$ExM;M_r|O6<Zrys50S9Dd~P*N?=bJ`@Na(P=kd2^y9=So-<EL4n6r#q
zL3IZnYg06!{X`ZH>_1>snm7_W)F88P8#{#2);mBMIIFJTP^;Pd@Q2LJen$$DwBp{R
z9fasTlmEbqSFmD@{%^yGV_3xH1|o5+p9D`p=?)VH!+ZL3dbDb#u)9tnt66324h<<{
zb)r~5u|JHF&M<C#nfG~kltQ7v<md|8w1Q^}#WtD+*mt30(h%#NOj1Br6td9r#pOA#
zq8B%xd;l$%5tmSt<RFm@gD9tViB^t*yz_Uy`yR+&zU!}lX58zOb8C|1pfTx?;K<P2
z!2ppzc(REN*S&Mg7d0xQMpj3YM%5zwElotdV=M-$qU$rSU-yA!_TG2DLzm#JlNjzR
zX!qYmyD#QyLrICwN2975omq&&`>c^H;@(=e*=E8oy@VyMnO)n%F+>~KPsQy<sDik=
zSaLzsic%~ASE&K*#^F$~yDP++&0Nf8w{~;6ogy@+)gsjpY-h7rKRru$dwdBiU>rXz
zy0Lzw5lc&|XGnx#(1HEKTD_a{-Me@1{#v0nI;+Dw|NN&v{b{V*=5rua;45hP1r-#p
zSTqnoMBlds1JM{5Uuwt!xUh6k1G-c~Sd1D_2e|DXv?^b5+c{KIcUvVFrM^-suefj<
zr4nukQoYUoZLGaa`SEHlU+!qLdNH^9s04pM77GW%i3>4O{*GQqgoB{*rM*Km>G^rD
z!#t&4Si6rlr`+9oZRp2+;BN9mj|x|Q+-e1_R^u4v<P!2K>}ZlptTJPD5wf5fdv9z#
zi5FrjkC^Wz%gL@LwDDWfnF(z4bZ_iOo}R~(D3u@v<T}hgv*L{QI0eqQIxe1M6ToQ6
zeB;WP=A)iH{w}nTT{Yjuj@~tHor!i(|KGZGYsC+C4=P~U)jAPU=5H2@H(`Qr++1=j
z!khNFu{#tpn;i0RDW^Aa{k1QC@lPJr4N`_)O}U0WY4G?@Ze5v6EaQ3LmA>$YfB1**
z99WTqdv001v={(l(k@=Uy!|$KL)(?yCIs=T#RJfQifQiNz0H(!<Imsv{vZ5y?x1g#
z6KGG$C9?6W{=u7Xe&^oz@j(9K-cbwYnDhX86h>~;0o0xBq&LZy9llEpSD^)X<XvD5
znZ0?~1NYF7LIEt%;=!}}vme57y8lC;?}zI!Z-z55<RE718x|g;5he!~cetFGyK?JK
z9uFjd?M`$;xo6ZL{mB=<_}X>!5bH$`{4DjD7s^Fya4zhcMQzdZvkxEotbn)j&)%;-
zc^e7Ww)gta{%qPkx<TCNciwz+;0I1Grkv=6glz2}<bL}PzW>&rZ=~4GNe^7Wy<H$n
z<>C>EgXzID5UN0jR*?vBStSz8>$I64UA+QI?)JNBx6;~13s<*W0E}rD0=19#DK>t{
z7!93y{afGOVTPes$K#uPXR?E^5tM_@Rr~Ny@xos5n%eFNuuziqNAE)EG;-x?+KpJ8
zSO$q%Stap{Di6Yxsw25F<Za69uOiOg`S!O)-t%OAxyyUXWe*k@NJV7FS3N!Y>D@}4
zW$yCOEy2hmchC^oSk`=U({p(%74OG6mxOz|JF0)b%lxUv{OS10lX`x5m^RoCr+q7j
z9P4ftstaOC$M!ue!VQaH8R!``pMx=k3G@ch?WhLCTM+dkkE@A1ps*o3USSSB9Ay9x
zr;7iL#v5@kKZkbAZ5Q{zsNTuB?0`HSZhMy-0BAM(%L}mfiIoMM*dtTXk|qLQ>v9Nu
zkN=*TizmniFJEZUDg^-5uDbD*Jie`UJnFU8CpZOmO=DS{0suS5;rsF5$89BBVR~a~
zE6sMhX|_Jm(KzgxYKJ7wYmI0aG1^QFvI-|#qXxnebjfV&fanT)x$RR|A7AbCbDmx$
z9Gk)U!_fwTYE3}EBHUfUB5EQW3|=p#)xb8+4Ylb5;`HN+cneE=H1PC&2<&0}Ob`1x
zi?9o|d5Uvq3x<3*-(6TqpobThQF+$s47gL*ICagrM77bxl-0YJFCy7~VcGr!y}P=)
zz6Gf;6@7lH4d=8;ML&Zf#@M3vxq7a?<Xh>0E$|z*js8~PM&P~b2i8Sv`Zq@7WRm%@
zS^Uz|;$wTnvDKhG0f1Nx?%G;w?JMfV{kQXR9-^qsFvFla-kcR<9ScSb1pRvldk}tP
zGvedMWBHN|KjV$Z-xc%(_xJL2io2rzu(51g#?S2dTo$y~g7$J@rJ25iguIj<YbzX%
zZVUPE#lt-sC47Qr8SnO#2%p^DiOfv=$4Ol9HHl`kIitTO(fmJR113H68@9=N%=i5U
zbd^T$JM!ND4cGeLaV-McUi;Yo!#QtspW$f)$wq;&@iDxO)W>v6klsRUFm+6pKh!Zf
z^2U$wV1m>yXL>P9r@fdn-*>*ZGmn0bp`V?>eSJR|OI*4p%U3TY=8*S*koiz>c+gJ(
zhtkeBT%zlZuYdjbzTWNr?(hEIze{K2%}o#~A=HmiV2(TThGb^qIr$i0k@bz_@55|1
zrkU?KdA-Zm73D*&_xr#9dtWz<-~IZ(`}ers)|Pp_*)aS>%AXSd?<U$lbNR;0uYFEY
zKJ)6!H!t^<elRu{i^k^W=$7DrPj7<m3E(i02ionL&CLAKzxg-+`Zo>ZU;gHA{ZD_?
ztM=ab{r~W-Z+`2K{yp6)J~+Kz#<JC9hJ9;jJa<URf-2#ai@=6l7f}mBL_MDRO2Z!H
zY)1L+mSJptSGgR%fD{@k(_%4=i!yuT89G76JU^aLl*J!cC60GqoIT?_=E*$2^9{rJ
z#_y~%rT+SN@1JqfBWM0RT1G1nYN(t(Ee!t#NT@5iyc~0lMZ6=icvuw%={b_w!UU|g
zkmu@jA<tz9KEk_DB{v(HnF*)oR>7#EHNOfVe>V>b1!8bg9-}R9I?d8{+D9eFxHpBO
z9=D%XP5478iO|O~#QaCkX|g6vD>(iSwDSK%D_?u`NY_7pTyy%J!E-|((+ByuaS&Au
zeXMxtHIjDw_%YMzcLvW5ul(jLKOJH%pBZ9((pc;^di-nXaoTVu{b`Rsmv<8XO?5Uw
zh^;i5r@Qvtp0$$Yq%Z7Ta}4iHf81U~rKu=_U7{R;e6Non-_t#IZiiW^!|3ZINUVM0
zNR`$?j%E!xNO$gx*TG5TJ-b&&(Vt3Ngg|M>r9win4mV|Qe{(CBt7-OnF1NM0k0S(w
z!8`698%s7JMKJ|p?-rRJc@%kn_3~;KJnQV{I#lDCb+V+{%~fDWkW&L5Ad19FpHl%K
znYv22Ba8EB?A<U@9t?~JYlSAART)R#WBYV^#*ICP3C<__^rG%7BD!2ni4PzTQoV}U
z>edLop-+>?c>8t|LQ$i7hrf+uKZRqe?9_Fe1K8hDM9e)!#Iji(1pE8<&qu~cDW8xr
zEWU}v9aTTj^?C{U=%etMdkT-iAH)kG=Xo&MZD?WKyElGjhuF^mN)+^Et`vv9&hqdP
ze4YHzH}Q4oUdao(b0-PAee~$02PWR~={`OG2!_zOJ(Iq?a|c*=W>iaX*hbRZ!2Y_U
zHvSG;@>^)hYv4;ZI4iH$2uVDi>N)-!M%7tK3fr+Pg<S<#zsFkK-avIHqREhDAW#pb
z{FEG}oRQPa8PUNHO=i4SEWY{951-!u(VInN77VHd#4<oc2KYV4ek<&TSfn@@=>I$Y
zF>pv@ekc>`Ho$s1^2fv;>Zk3Mc}_qQU@%;F`tzt5HlaPj_Ox-P%4ue*K1OzgYJ_gY
z!H^74wvA^XK5RgzVEXgjIfb?bQ$*}XkBr%n5D*ZUs2iZPhea}+cBu@|Oq2}}H-S<U
zoMxka3Mad+X=*M}9r}lbMpsaUZeuk(dTQs7f$3^@{(Gk5gvJC}AR4o`$0LILa5@HW
zC4+aGBiW5(ZXCOd9i5tuv;^@38{NR&yL?jzS4_f80p=TC9a{pbtnk8%mI+T9C8eQn
zME~seMninkwJcX$K*mWiNYrsq{Fy-hKSXv$EB9d}04~UF)_SPqbvT0C7`@iX2%f$h
z@-lGTCs8ro|7ebJ*gIk}$9@?{i5pL>Vr(R%EoQUl4CrIyIq5BKVN(Gnd+#1B%}0z`
z?$>_pzy1u9Vlo$AetBl*<(K!j14C4f51_MR_tK^%vtGNsXKJ1IdMwe`jI__Uvi#bY
zzT}Jj;xEQNeDF<20NIK=cSyJE#0)pkH}qvbyVK*~zd|4Um-K|kd4|};sv=8R7saVn
z9hLkX!>rFsJOIiXnb*^p_9PV%o7mb|%<hiGrnZ(jjd`Dwo49>07XDkfr+;zeo?e^W
z6X<AwGN$)b?b!i3LOTH>@oqqA*fJc+%_?yO3I{EgHH$=Q*xm)S+4F7|HE`z5nv3rL
zMctb~xpAL&f>kIK3MkxnqYw1OCYz)v(iACLifl?g<iz$QlVp=9aqP|PWb=|qCNtU0
z+j)D;P8SL!ZOgOrOm^O6Uy@NKaU3~L^7d`wB$gA?wrE?jBvKM3v3WGfMjz+{K;taj
zsQrEas_Jg^K~noX``&^?H@X|B`k&wbJAU8q3xyCqfRM>=Aon9Bu|pTU7K+nm3x^DU
zH==jCUe4=!W!)8|Cy31h;jkR8<>YXnoOfrK17dj*0UdD>&Y)!=O5hI<AHdZHkl^X`
z;njf%`NQ`+kJ8p*&8(Fq9OXEyCF8JOtEp0?-%I{e7%w_mtu=r$6-KNHEa}iJw#Lhk
zT6Ebgk{$0m8Yy9N63+cYJ3FiE?trdub(T~MdhFYk3&N#KDEq)x@4rGje;w_d8Q3OS
zw@cak#>&RFOWp0#7^QCR9YdQLAUTZ0KP(fF6>h!0Z)^=PA(GgBlG*EoazKras0%S!
zXdnB>+-P5tYzo7HvKFAl8GxdUhgQFDFQF6ntHr7NEnYR8UmhId8s$p0gK|ZoAfONT
z?bt48L~5U%YD5t!o_>DYDvMdG41Mzg5J;PC<@W5X;?e9tG<rBH<A+#hd~5xcHQ)oZ
zGArqIXJO|mL}4go<fa?~&@aAdLIG(#0Nxb7LFLf?kSP2L9R~XVPc`DhMtF3}l1Y>A
zzI!X*mMGAdfOVbCXd4jOfO?~)2%N^Zq*ZYpTE=>@g$g8g9oeVb2LQFt+R*2MJl6s4
zHxhxjeUMwmCR|SAZ4_NS?{c~cs00Q%hoR%r3je3u#t1cdjh$$HXVKq;F(S}|H>1E6
zx3{)eG?*g7{ZV0}m8K^EQA}>pvZtqdX6IhD1l0CDOG3&LR3xnE+23t5f=rQQD~e2g
zrRNvfF8&hw_=RnKj9Y!%`JMIkaDQL->ht~jzW*3lV}S(nzOmRGlU>5v8WZdLUSqR;
zjQrLhS>N{^tev5EYtXFkziXV}Z)5cSdfVu2%Ick?XZ_4Z@v*%}@m{0(prd;K(X~by
zn7KVid26&?03AC(Uo7b(Q}lFl$%FLl*1|*d+<Vj`Bf3V<(dk1nKRPY*$wMwKdFX(H
zA3Y%1MyDj(*i@%JHrT002g~{BJ(sLC3)c6YOW2wX>-!%Xv+|EHD}>s*U>%|R!!-h=
zE0ZyB-y`ROC7AZdZOE1b;+|*8kD_&i)E5K5jO=-ONE-AWCO>SLC1t<k!k%Q3Vtk!R
zfqpf{+6nMRl1#8&H1_<i6OOxR+6Dg{t@@RFwrWr-J${^mDai=TC4w0PChGt)nqV*Y
zYG^7ZhLRDY3p;k?;0Wr`05oAV{nWjh{=KV<IC64jpwUC4z|^6BtIv1u-h>-#@4O^S
zKvlf*gSn>s(p8``E*fkoyLD~rH(NH>0LFl-U{P61dK#D+iIxbNRTp?<5Yf{B(MWRx
z19RDliL5z-^yxT#y4zLgx$Dy>PAI4$ow8{spHR0x%%m{I#K!SiArj84Dj42+Q}Q}n
z_3DC}@`RR#{A>9Q*zDoxiF6=`RYoK}SKeI8FTZugKaGm2-RN2|2`g3I%!S{w6=9^o
zaYO#`VccbyT4=WewqwV_0w##zf;Rj3EWd`LD|kxt*TN(8+-j<c=Gr}OmJRAm3@&E_
zz`K^zwC#iAA51&*nPm7H06a(Wi{E|mcTI2i=KBW|MPOu+f(mNZ@7(#$d1oen82Gk#
z!b$w%SD*e>(`VvEyS->Ph7=C9b6gVt0YD~S-#P9g{+m%iD;{-$12Q6kNYu8d?{Qp%
z>Th4z3w-Ldtmd7n+PMpRp-`QcO}*36XxepzYd?c~J-64r0@l5(@4N2#++Oz#SogHP
z?{jZ!c7Pw*Hv;?fXy4DGeJ4=qD(LmrVOy=Q=b+7^{y8f~lV4v4<y?KeLu8FIXs2{a
zP?US?>gRnn5y0<8O>2Pr5h;V|Ah6oGrX6?>MA4fPRftee^m<E6@a*8>bcSHAd#kGz
z4<tv(>7-vK_0nCC6za(&S4Nl?FVuhMwzW`%PXs_xf@3U*{hsh5rDPQ*oUOJB$g1Ii
zcoJ=Y3T+?vdYjEn&g?xIwbgTW_;(CeHn+jbrsZy<9-4ws&p7HNgJ5ohI9aHs#_-6}
z5^8E7;(HMFG?tb|hLID`xS#tN*<`AvF$%NKuz@~=*8IvCGVc&@r`S7t7~c)w3cM`5
z1BmZYk6+|KHsSSq5S{jVOT{wh@s^9VPN!T9wTtc1Alz=iBM=QBhpdglMzvk3qJFRl
z$c7l`6ghVf!_6UUL?8xLFZ_1ozu};RgA4)XAM6gU$&kb-kjfytl4?VKM#>B3Raj^|
z*KIYL5D|ldy^VAo@CrNZtVo>oDUc2tWBkw1E8=^71ZiJx@6r<BQ)sdmrPslPtyRi{
zgYXQk=aJe{!_N}1w$3)NpDn;`7jCJFkE(s;ZrqASBWS;!PkB*wP6$mM03%ohCXM31
zbv;`X28M=%2M)$uQn#i)Qmbt&VP$)2HIefCSAm9Zx#F=KH`ZINyognZ1eO-@q<;6W
zkbO_Thyo|+<#|{aqo+^J&0foFG|qY8!drO#_2J0_qX7wNS|^VWx#jNqRPXiI@8p}_
zgefPi_5Tp!9e99i7nO-)RGxHTzy~fN>ZVTFaRY9>M$Trq)Cu;;D7@@Mx+|*)`uJSj
z0VQ+*5#t)OYa((jH-|)@fO>?YV3`a7>6YGJxO;ba7~hwcvLvx|#xY*jQOp;W4K(eX
zf|&#12;V~aF!`L|lenDX&z(Az5ZhU>5-zpHp;N3v1C!yDv+@&TU><Y3$=ij{gT;n!
z);<KC3U<wE-R3uHAF7g6C`ipvsCmyy$cX{w5ZqkCHsCbj^`!KyfjXT>CRci2HDno4
z19|^?$W{)DGFT@=T_%1ACsIQ@WJ^}5G|EO5_<R|JB&+RkxKQv(DK`wnxW7<9(d}yc
zoH7^@$;#I7g@bQr@E}U{CKC8E8HU3}K701;k-^2qNaWU9$_)(H+bAu!xVTlT_O~!v
zzlD{2rpprDB!|3|xs91Yg>A4tYc=$YP|KP&m?X`{V*~La@+X}_r;fpeQ3|j}ucei1
z4KU-uS+xT3u~w^r#12SgkdmPHNYoLrXeK<!Ywe-3eTNgez4RHON9igxt>aIChjJ|9
zD9+uDprWC1J7n@^7a;<3t-$11uAm|Bix6i>t0Z)ZC^^G!Wm1wO(If~);N}6NF%p7H
zr~n8w!CGd17Su`b{4_yk*(z`3@2qc&Bmd|a9|{_iNqoLc4na5tBO?A0wmt{ei3aL;
zG=yZ^KCd9}+}=*264JaaG|7zv)DPRAo`p8G$=fMR1F#8sT*zXgvW00_`k4$NoKajm
z3Vw+qCGk)c6gqUormbzt>Yv2u|6`24;<0=2C*$Eqx)IMm{BR7_tF6cK-MP=rcrL$s
z<u*>9Jkmj0y%dGyqamyYPrH`Ab?xTj^3vV8IS$cgzj}VSRa^qi)k>Wc{fXhF`C^wS
z97o2d(99thWv`u^@jUU!IB<;49u^Ncq!JAzAKj!3i9%I(k)c2K2)NSG2{YH@5ww=j
z195mB;fJIrsae3H=8Y#10MiEraUfQyp}4YZVj@=v`a8Yx(R6%yS<|eiEDsJ^PkiL9
zS*~>}Bim8$+V#>)0Xehc;AU@|^F=JHM{v&zu>bpu56=i$WLYS-#Et^Q7r<uQUwzo6
zp+pNJFu6S|5L3*OF!obJLzN0W?{j8;%=SIoTln|A?g`@`-0}M!qEl3aho1L2NN0qf
z`YG=JQt<!2C+aVuz5fL5eFT~wX?qb+rg*)Ji!~m@I_S2!iB!+)LN;!@jVf7==E}-S
zov)SYFzTqEqoj3T73ah<wif0%<dX#em3zGa^pZqCEP~o(eM9S}AF*t;UL8z1qoW>1
zjlNoT)(JOO(cSUk;l)Kwcj0u4_!@NLgeCQJA*%nHgbt8!G*`iJl`S<W39eo&F23=`
z8%xNNk55d75mhzx1G4o#FvfFOh>RK&C$9#kO%Kr=Vbk=Gs*NC2lSG9&PIiVULqdRl
zAO{g%LQqcY(Af(;5~R$~WXvLG$djQ|8A3<`l^n_@G8=8D8)=KlWKe`|))7OAIY33@
z5x=8dLTb+{Hnhmj4?>!tR+b?l7^Im1`FIF?Q1Su-55r^YYcS~2btsAKD~Al^4rj_1
z`pD)ZXr#$)|H>~`6rr++uM%ow`-g}9hHY*|ij2Hut9BaIMtMKRNsT)wG1cWD9ZJ~#
z`od@%WwGHT=2*y%vFL4u?51UTS`7s$WJlw&EokS3EC?r)_)6cBN)TZ?)Ma*YTY)<^
zF2tAdu*ob!xePe?=$jV@R~-uxE@l^IY{s)P029$S;Va)Rb1ObCW?<{xHg92eHZ)Cd
z#RsORXFSuh+-xp$Ig>n@JQ>?OzkdupoibL$eOJZQL5JgDpjZrKbBhqH@4R&xtcX`<
z=jLX?GKCV98eom!SZ8VRB<e{GC9pWgk6!V%ST=$6v9&;~6~dx=$zx~EoIZK%Kq3h?
z24o7N&>(B&&iWy8Bp1nP;!V&2-sHqwc5*He5g$i_>Ep(%T9y|x&<LE1-39xLU5l)}
z6U26l91$8UJZ5Yd(sQoE$jdw2X(GRen{hGfW*p7yEk$yGxYEXV+G+ds8_Q*6g;t87
zh~sVTr7KsK+BOUId9S<fwu3B0qI4wpF57;{RQlWGkKvYRt7+R(TgS~zHMT88BRfTr
zI_)~RnG>MEkhi6yT)^3Em#JWFP`0-z%xY-R@5gnZrGWx~=7fv@_F$7^>|Mb&*d{69
zZ)2BJnke@Ax~{Kl5I^(UpkG|~@Ng3%A}`4RMEG$~akvc~3eeQ(k^m}GCXIDv5aHMc
zC^Nb(QwF!ZUV+Bks;tXZueS;nN4Iw*xzw>c{ff{m`H_%<L%SU@=7{ohP*V!|Ib@!h
z4|kI*tcadgH8|kl+;{@ETov)VCda#_)S%?{lUUM;B%uxTx7#gLi;!EzY9qxp)JagR
zRqCi?Q?C?I_pNQvfpG1b%?1QCl<T0^X;qD*i2W0g`ZI%FCk7?r>=Fv5Mv4V#BDs7G
zKdVE?UG2a*PG~Z`DHar|ux}gLaikOsiFHtuLwGj8?;?7~pd^YSzKo%$lc)k>RIQ^F
zA?3<rA7xumR>0=$NI+w-a^`3hKDlcYXauZh-zXSq-fS-D3(bl7J&qv(#WLfM==&aD
zp%JN9R%$dFcCKclkqCORBjBH*OcQw%FDW&prm*2`hJ+6O35ku+%HDgEMeohXJqz1o
zh>V~;dp}A1kCMbkMhF%QX@n#qsHs7D8h8hdo7JXeZI;sjf(RnSf#KA6KiFzzTA?yG
zD(A0W1tuOPAF0S&M7w%5FKdxw$J$73MPjW8j+LAMoFJJr_#z-ryGzs9&18^1L|;tH
zYYJ^awgZ#Y7_sgD6hCm?J*eFv95KEJBPCIwsv%_a8s9-sL`xom#Q3VX^O+1BgvM8I
zCRuH9A+A-ZwlHa|_onY?6XzsH@GmFa4CSW){hr0Yh;U*)_=bT-r4=xQb?68c7Lp4#
zK4t55QJLI1`RdzuGIy^2U{dvD6O(rz_Q9qHyV1M&)8zwC{`e<;{Okb$oM;Yz7FS?7
zPFQs9Qc=@AK`Q4%!7qQvYpZQ!p`7#~deoUi?J|ta<t2o*3NVdIm_P96B2l2HaVA<P
zz|cDCG*-S2_H~qCp;^K{w`on?E>l5bKsT?var5r2x2{lnDR^4ia2!VlC$PW|K>tYi
zQW3^CSE_J;+R#!kpf*OkDKqA$(epzc(7id3cv?n<=(e3IP5RMQh>{LCQsS|w*eM~C
zq0~`ffuf)h(lc9Jozex`JVL4X2|N+>7dutjllW#nug**niDAR$9vT=KkogAkvf+pz
zea@*ja`{!FKtflX=|e>3N<OD>u*MsNKgA+!e@23sE7)83WP?K?Nu$j)TjbAlmk`t-
zeX3j{>R-NIRP080-#xd$<a?5Ub1G6cydg#G%Sju<HBOE3ejj;7F(x!F^dyFYV2E8+
z6LI>_c!PmLK3CuhHNflKK@Pyp%$+q7Q>%B(dl(=+5OnIrMM!ZB-Jn-jBny#e>ipE|
zL25Pbz@xz>A^}7oDu7xQSShgp)z!=_SlB=OrL3jwmk8TuUg2Kn9-VT?7lS7m19FaH
zz-h{Z;%zwP6z&POMkxaX?;$n8MhKj(oHF*NOU9W%D}s3T!Kn)wpm$JIk_>n>w#tEf
z-rgfC9>a=ywP4xm%03Lek3#V)3oy-AnG{JyK&I*Sg2vK6v{VB9D2$1X{F<7QeTkS;
zTUpFtH>Bc~>{?S!43DDwu(<sG_nnv;JMi%PkZN&|ax;f1=WuiwH+NwlHLBzhXmG{V
zh;Ocgn(`<{H)_fk8r%DvW80)TP&yBCj%`1?_IqvKe^*`48OK_CEhq-L8Al@LhxM9}
z!~^~V%kAa%jN{s5mdj3FV{=0OX<{%}9IYO5SnREH){6@Xe{nU};;^B7#e%o*2NkDT
zF~7L9SSSL3;#gj|ar4IFGQ;%ZyZ~cpx7Tbedc(_oKN!1*?nwM}X@{d-D`_^zIqO9_
z;rAAbzM#v_wQ{S)z8|n0k%8eH96C64FgZxT22BeDhlhqE0ZmP8EQh^|jV5@5kyqdM
zgK^Kzi~vet6o!_(6;|Q>oueB;h5w$h?l#{;t5X=Nc$a3ln~LyGaO3C<_qZXaC(!l@
zv>g!KQYnzk6bG26isx5UfxI$l$Modr*yw@jbRe5eB<|cE8_&RNiaqWaQHAA^k>#}G
zrHkMB-nTDaGWXPBT=6ij7>2#)v-RKsUc$n)_iP<lmgscEt@3V)#WB9r!ALrcY`(Rw
z5J$!%AVw{rOS#H;W2U6?rHmqFu2WLs^~|p8<9Z!i&yK6(9_60RH#CF<;2fhdT_${h
zh7|Ff8h(f5XIE(9>bOT-=&rr<4&IoYrZmmzq{1fyDj!IiE065_pBh6}u;fD35A0Io
ziP|CiTb$~H8W+%GNi5<)!f}UzF<7ejz55s$>OHLtvid%NF&`o5VTm)GL;#;arji^1
zzK5j_sVazhL8SmygBWQrK_OY&z~CwT&70~-tp<`NXy2s!K^ccPZk$GF4E}V$%2kyL
z?$l81+fMXFG--+u!+<LM<5mSQOZ#N)0OJHXD*-FQE5<pKt90-hGFlx#0lB3OO%9<A
zxEpwYwH6En)G<r5X0+SoyEN-}%4E44HJdxo?6Eh|4BQm7l$gbL&=9v>p>0<}Z8CF(
zjGJp3Mp&to46O91$fj+em@$@g$}x-di@S5P=h>3JdnXA(KZxbl!uW)-q*IO$JoSOc
zKls!W2Ii3TzJs(!NJf*G9vn0UHNdTq#t2e#Hzz}2E^Za`_!R^%$=-b4l)h?!BrNK@
zaMN#7sHY1wqp?G0aOHoCwRTpPv?hk?9&7C0e^t{*#4e_%u%3nP1NIfIREO^4^bq?R
zOnuoek-)DJTO8;ayloyM7m6j2kOE(+dITGm9=nz#{bI)|J=|Uuab$1$Nh~vXk6)=%
zGE}zlB-}-SHJ3^i%%C5&m;7EC%8!<vM=~IYFpvfgeeWrZ#ZwsNQ5p-tpdI9&k|{05
z=b*InE+Bj0Z|=5Lm@in<Ya4B<OCbh<a-n3K7G|bHRR>0?fml>|@=<CUzTAY}r)dJn
zlHoNIG;9M6x?IA+t*-;S(aOS%!M^ag6roO3qQ>0xwTHWxHFY0zinZsSCe;JkR7WvB
zA0OjmQ8rb(ERZOnmUmkr>Rx8ZBmtW5Yl=LuEkZGOwm+P%23FlRjJ>K_AbC^m4pb1h
z>sPOlIp*c}(4#GnZp64MAvCsMIqkoBbB9hJA^Ax=um1*V|KpGEP}GeX1`ib%<H(;v
zOP@VlvRG{zC~g<3bjb#a+m-Dm1Ov$Jx_tQX<!v@$U*G$6IP|?wRbzc;l3`OTGy2}A
zezCnkbA1$hAwtrI`rm)$8Hnrjj;mt}pyL>T{yWS-IHx^(X?UCX^=-ZPdTX^vDOZY=
zR8bpRl5e8OH4X($JSpM;5dH5QEt!6*(`eyov@k)tb?*a*oi=+MHnN(a9lG~HqpHY-
z?>}VhbjVo#%~R%m2k5?go-k<~a(f;w#%=dLS@t?r!1f7O37e0dUOd2>^IBevl(-V6
zXkMEil}E))QcPwHS+?6}W+6u0btxp(d1tfS@qoHk(s*~fSa<T86ja><i&qv0Y^x)u
z$MQDSeaqik95@!4Z~1S1-;_xs=smo<hVf4BX5+uoM*!pX)eIk-8y*FROfCX?K#sFj
zPTy0$4UirYBaHbyIG04(Z@^(t|8yBV$WWq;J<{(<p`9VDxHV%p2$R{w92*}$+Jy{l
zr(~@qi3xGMTV-zt5wsYm4Ww>;hWx~o9}C{D?fZI%!0`0%Wy)=#ewYTg(Z<ay_3x4$
z8^qJUG4|XOn<qW(yZ&~~_$g*)Wc*mdY`3hL@#B==tBrkE?r*1Y<$h5?SMG1GapgWy
zVf20vO9^HYj3rLWvIUyuBp6A{FqTB=FtTeBbBB#jT3IFMzz#uaCDzGjTE)z&1xJW2
zTyy~dWLp@$ZG7%Y%-oqVXq)%ZNk;Ayg9(D`)zB`;`AVKBTVPACFyk+Qy`wKyp0Fnp
zEa$+@hahLW(?yMRn+=SoHe1@0n;(r_Yqh#P-Y!n#4{uzBzIgQwQ%C%t(TCs0>YD-k
z6&^Ol4qnQ72aFG-Dj<UkgccrA8L2loPXJXP4JJR6>6~*qxoUBv3^Hr3r=Z>gd5as}
z6lWu{PSkfqQABXMEicyy4H-e+6=~sh;-rKhY0#}fD_5V;$owufIh)JvbvvCb(-)M2
zdc9VuH5#0T?C=W0)dqQ>)d2W{z#PhhegVZw+U*plpNB_J6jMOrBtd9m=fnckq;gxN
zQUoZ|N)EA7higOGGh`XrXQP<CFNWMnXhBIgSIa;F%G8kkw4pwSWu8Tq1ah?{Kmnhf
zyCAzl2!At$gLmD$T%J1V=jORlajJazrq8NZxH%vFHsqH1=;=2dcUp~v`J=pVN1wjF
zrK)@S)$|=2`v2c;PD|HOLJZ%rh3znK9S(-;0H#C2ti=5c&k<sHjx8*Qf#Yy690xEQ
z64c(e=eF=0yHBK@XPRHuN{OsE1^UM+PR!&YNgQb3<LDog@us%KDck|ocBOU&NXR(>
zluT1o0<;l@dq=f>IPp>Z_L1J}iv87B_03u>WRHzwZh4Soy9+&#D(avm8ECA*$Oku@
zbm#7BE{96;=lz%7L0ASkN*lStM*gix6mNLt6-9dN$<xP<oj&`RiDLW(T<;fgy`$jM
zhM0uP6J@0_67Yi#-tC3S;f~6Tx>3wZXLVnIKe5B}&Dm4VRuz@3ONB~XiEUha?aBg-
z5?F8>V9N)*#Ebf_2t6HXg36N~OBtlZ(PMso;sc-j@Nsg?dyHf*lm@1s;2;KnAz~@8
zGW8xZHsw|>-(c5%?N$zmGSv4JTZ<@uw$u_g>wE5=kIkr><#Rw(jky1a1JH`9-OFD|
z8U}gX-EH0jF#~~9s1c{T-l!7MZ|?5wy8uzNK>P~dWOBfro)PRr?|)jcKmGKFp8Sv@
z8>j{Wy9O@cq2yDdnZ>67<gsx_4vj_RG*U=2xfZGwqjqKze|qudr4IMaZ+-I{FPf5d
zch9V=!lU4UBbb_2Nzd5dokdYhMF3qkxWHYt6{BGhhdN_NgPwj`5uSekkloaLtZTU8
zj){bzGjIs?<70AU?9dT#y14-)L(Y0;rKSju2wJANUi=1{#dVfme$l+f$I-iA7~>C4
z8CnX9`H@(olZU>taEKA{rXQxffl5&h24$^Yw<EX7BUUO^@Qb@#5Y6Ou>Y%jtdM!QH
z76B$~FG1!4&(|(5aS+I;u)A#iVwq5lJP#&ZI2uR?!xwtkfzLF599`)Q*qcbFqT{FQ
zLEX48IFU<I6^NOd9dN-5yx*zVh<TQG`c)oLNA?5TnJ=JUFJR_Jq(EbXa}c@^`MA|8
z&NE)3pQukfubc)EI3?z?pYRtCXtWVU1Ol}Swq+4sdmZ5k9HY7u34bA}rvb3D(NI+{
zu#^p#3}mVdTLiG}P6G)^)QuDhm^L~f$WeB^2SY-Dj<zVk%x;Qp2}3Bg#pb$tw$uzb
z!C{Y}7a(uooeOz-Y*0GA4v*Ta4uSIEBye5>Agg!4AyjGh2zCYvalQ>lb+pUdB(Sd9
z`L2dz8y;OCTf7n)3W9TxfWk4@bF@Wo%GR}`oq|J9ZT4<A73{ToC|)EOZ|TrmaC*}L
zj$_>3;}B<5V6ea+rGT;ATs1r8WWW_D){COM*eSX>aka4;cg96{qZ2uOhM0fxeuEVh
zT_L8H_1ug-P~?gMHdo|Ve~2QZ6iJ|e^l(oO`T%{K)GDQ#He>f=hqM%d97S9>vydkQ
z9k#6uYXP-{B`ozBiR2S1=}L;!#n{<wqTRsBkS>fU48v1wyMtGhx8DPtZhd!wyTtF`
z`%e55Pk_&HpS%4N<8It>!AV@~f{q{-IHjNf2|6Qe7o=^!hl5WB+6c4LR*?!9K*#_E
zSOak7wQ41xhfB3q%D4FvT-clMfK!bSl-vLLbD54qY)40}@BZ819VS2tJ?S+Y?~`cZ
zhsStCnDM}hwe}v38G$J5ahKhWg7$W>tt0f-6dGjXV6V1ed6WQ!sv-Wgg0sR|l@6AJ
z&1$6{jUe_*$}#O-<AGoBk$PjJp<#J>IV`NUh$<!>mkZ%I37qME=#sALU&r3XGWNpZ
zz}mK3QWDyMA_)odXzgQF&kVrvv8NXohBeWD>|<EZIN%1kr)_Q3j{$`wMMU@T-lmP4
z?`K|<n{H3XEfy@@e5c=bn}tpLf<+)f&;cMZJ0yBIvk}!=D=K`ko^~VjE0&ByVps*)
z5F?*dY$31ZO&!BESOn6XYh$wQc8Wl{+6cMPnTQh&5lA=eg&IPTxqKmj2qc{x2q039
zHcqvP7<sH?6LgA5VVO9MYU_$y_YNAYmWxH}j?`)vfuvIj?AM~dN2ikAAlKww0o6^H
zu0T_t9HGnEZ(l|H5wOa#DP4B20g5R)IU}ZsXbED9bDRzBn&IJHXX|GBJFKXq@s3O8
zJ1kw|91pa=;9XnuUO0!1tTNs}6HP>IKg=*1w1x#9XOjrxL9BjMmn_-DUfW#`N(ZIN
zx?XE^8YEHZeR$yD1oJelapG|}=Z(Ev{p-3M>^V`H%`WY?ws(3Gk{JOV<Ajp`>M_C3
zy<>c?|6Q4+CJS>nLBV<KsviW2kDJ&xOAmUEaS=WH9P5{fJhCk93;v2-59y8?AMn~x
zUnt0{7f=SUz=LVOsQZF^%_#)&tM~hQR~ohhws$%HbgS{Y4ZrGi54Wzgy~lX_rPe85
z$MU{xo&+u$37Z(!!g-mzKysfK$e+xJY@Yi2LVh)YoN5BO(**LRv3G4=)sQB*9Qof&
z_Z!@9<a*ogdF#KbKjO~`^3sqdv@f@1p>*^e|DIQ+_xW=o-Uz3jNbhaSBHnEI^LBX=
zP^aGbC(YN~qut<!z-F9gUHa)0SN^;`d&ti2bOP(>1Z37sWY4e@g`D<u0!H_dQ}_1&
zMQ}HqpDvU_qGgD>5Kb9LR(Y;nnL}YmWQze2hhtN#HQgg4?q&_twNa=*a(D#VDiYdg
z=6YSw2}g<JXuWA_tybh}=$?^>dj}pUlC^)(;Xz^!6iKGBge=)h`tIl0jP4_KcSp*$
zNn9%zjNuzDs0QOT!yDp<OIy6xmMls0)6;2C%&e_lNb{F2rH!{5yO#WtBWSmu9LSWN
zU_2oU)6&hGp-?_QHFe(Kgu_<Th?tC?uxirMi4*hl!QdNjn3f&w-NzZG7D5J(ZD04m
z)XG8NP^2J-DmJii=<9=HYD<cvw8(jfhrNoOz8d}bOWgl2(T}qb=WgV;w{#1sQQ;h@
z2*Z#X5AwJ0ULRD?PE5q8hzxXBM{p3D(GW_&Odm#O!f0&5<?2EK*#JmB-{7Iu+VFQj
zlw(jky8wztp~rXM3BUdJ+jmxwCx*11nnv_;`Ng7o7A_uC!v>POOUf(!K5nj!(li3a
zO&{cM;k`bno_%F@9w+AN5>7B;M!o#q7hinwAHI$A>-(>~qA~wcjEFo52*}(_YapC1
zA%He{@<*P2`soj!4TBosF%ZK~k7CH;V4hEoBYEB!Y4Qn7Vx;ZK&^l_QNxgx>0w}EA
zYRd7-TMQwV61;_iR}I|B9`s7k)jHZ-;y|s2l6@)1#QQ(?^v52XNC_K5LmTE5={(zw
zSRuqEVGap_*@rm<=f4H9^fk64FQJv9L=ppJz9;0RwNC`78IcQ=V13RwZdIJTW<KKq
zv=P?lmY2(cs5JSSRcs9H@>L|GTt&!IgFhl2=<|3H_(G+y=iy_A4<0!NXmpOV_(OgN
zSN$Da_4yxKNr&fuST!A<|DhFic>af5)q&9S@)$J4F&k(jN;ZCcJ4dqR>v~?2xjMX|
zD68_klxVjT1c|{*Ed)w6P0rz^l||ZbEppEbx~o%FpBEZhm&doJ=84m{5MMLjNiDE*
zW(z_a3Wz+}d1^&7o_BZMp)SySt#TWoqUYV-79Z^vJ1)MCSkd$DsoIsbDckDc>G+}z
zKNhC+g}}+gf<ChLT7O#{;yB4t=qvqED|vntUffKwZRsntCkYEQ<60{e2@s42n3vM_
z<4=9?^l3#p{r<COPv~4v_4!994osk+_&o57aD%D#zy6~?{L%}G^e12XFMsrZm$|ax
zO&T+=#~nz?Q&UruqczW|Gf#d*Wj{atu_qt%RFVgf<jTLIDKZlDE?*g3dEu*H{WIiV
zEAHC2|I_dP@gJ>5-+JfjRkJ@<`|QU*_{6E>iv7_ip8Vhm1@&TPT+vW~zyPSvji1x@
zi+}UAzxkRX{q5KP_HVvf1Iv-Gg#1C;Lh)D(N2?jtBahh_`s+UMktffb^3+Br(aQ5~
zh}XG{xBC5WfBnUq=iRUT*;l{%!ph*4%V;3zXH*Y>&_^F$kALPfzx-=w-R8cwT1I^H
zRR5CNQY@^g&Npow|Hik!{qn1d@an5CUBt-Y?tp#H-@QA5AskhmpM<^o<DdC&fALd_
z@XV)v=`%Y<?pBI&`fks=tFOKMt-n_}`uWALfBXAYZ)Wb+EtNkbEApvRr%t|adElA<
z=4XCZ<&G(C_t{_j<<ER3zW(shV^)P}t9|^Nx?+FhJKwtW14VfA^-JF|xM)#zo@P4`
zimJ}1WX}DekAM7QKc)zu`1mJ2j*-Ls`eQK=kWvn&$ve6^a<~5eTQ9#>b<f{ME6=+z
znFo>;&tp%1?CGiVzU-$y{pnASte-ml*kg~0;-jhu)j{5VE4uonFa7?18hhOwIm_Y|
zsX1t!i?z;}S&_#?KXObJsA-s2MPe;ACRq_^&eg=Dryo5%UCNaYpFVx^)azGXf9;wt
z;-7u()z@BC6V%|X_M3ChmV&vW9>oe^SV4(R8otmBN^JRK{_ul3V9cMj_SsgTseIFx
z9x!Lp+y%y_z@(yb%78Ja)_!2ygQoYBK2zVcA{Ie{mvN7rI(_<tv*$c<`q5L5q(hWP
z2?4*J!$|;5iW2D5pa|qR_mwZd@Rh%M^X8j>^%XqQA<BWIO5xDAP^2M8D1WnOA3@K4
z1Zz70lCR6Jy!`5`!()`vH#Ih_*oMQ1BuL@mSAX#GE0@7>Pamav0=b$XhsN-(lw0yL
z#5&ztR{h8>nLhc*>62WQMT)A=+8J^V6!z4-7y)p6K-%3w7%Anp=~|5-t7r}A#R%E+
zA++T&w8bf(JoElXPcP=0DI2n272o3gO?>3${Nm|H&zw0ar=dx(&cc?Ky;6!&CC5Ut
zKop2<Fw(%8Bd&4zS+9qMt~}i3S6{n4tED|==X3C%=_o3TtKI?fo(zAqPL>Vd7}*X(
zXvYQk<&X}yPCBn`a&qz<cRWoj6&zKb!=EnlPmu;}gQjzi`*wPUyn3)WMLW>Cf`lrm
z@b(+OrA&*V8@b#KRC+kj)lsK@b`~j@utRupdRpYV2w<$llvr$?gYq*vaP7#-JmLw+
zw>)xfU}D^ytDi!<7-GC_qZUVewsvJ@Wo;>;-K`~-*H>2ZHCBKe8KP`pQH4b8RC8dL
zg8S9^7k@!(HvEZCz?k9g+*!^=2FJ(82P3)VJL;iMbq#p1#kDHYLftN9hbG3>$_ofq
zwq%re>-9t#dmA!QMMWtGpd;W@L%~Co1%_KRys@#6Yw<^qCPT$VXeNurQ1YlTqhu}p
z;ut?NjN^-Z*vyqq-{}EejrleCVesOx{<ODsCQn@<Qmh#{$+1pwW*6M(Li5g@Tx5J4
zTjJ>KY%=-4%}0FNdGSHJU}&J0{i6!3Xb-EEa6vUn_iXo*SRR^lco?4~?O>Ynu*Tr1
zrYsPFcXgfJq8yNWjUGz)Xm&jD#p5<kUUvN2ki;T{hr;=#d{^wcOYjsDK9jz(U1Iq(
z{*+Z(_~SoioEv{^+>x@Wh?`Os5|JFBFiFJ@Z5j?G70Ino4Dnw3MS7SkiloaY$M|T3
z`T7l?r_oS&F2O~Oqzn%E7z;MuXfw554P=m(f&2`k?bHkIz+EJ1u>1^4)Trg*_{-N&
zA`R_F)ixyL5Xd*Is$(o~gAzC>pp7!4sA5bJ^R3s$y0N0ffZT>uzOX<Hl?y1z{H%Cu
za`GmO1BJhvRr$oEVz)US=HA60e)95V{5ShWpC^Bt!iPpwK2uQacXgc`!Q1BM4$jRT
z!soL%6~_~bc!cLWZ*|mX#gixh?&Qg@8~2~U=gI2ughnz20$AJ~A#5mT1IK?-aV6*G
z&K#dejz9dU8pz%n$BCCn9C-^>KEc2N;3-Dgb@AlM+pm26#lQRhZR3hRfh+zaTv4Dg
zRRYGK!WMJbI&CTff}*n=>i)V|YFmo4BhQ7Uzfc~G;&Av86hV0;9+j{itrEgX0B7>;
zUOLz}@R%!P!aE@a>l{Vm)3DhiE>%6SZP*KIxZ5&{!)R2e1krvdJFw2+5;DimT3^qx
z_4Vv?Y<=xuqS;#Gef}WCiik_W9vRJyW@a37+#G!P6<UQEf-BEBp5UG!F~ZjICLc1I
ziiMxDVKa+K4j<xDwoH-}FCszBtfTWA7`<P`=sgmPt*y1|RCNqxuXvOSb?Bgq$gaf$
ze!W&+x^d$M3KDIUH(-jE>uqOXV12boQ+6T=mru8`0XmGb4sQUtCsCy^M(iUAr@aff
zE3Vn8uHy<f@<{*hs*|g$@p!jUz@<8H?82~JEY<6rH+W}m9p63R?iMx0+o0?jXQNxV
zlZgZog(L=?l#J~o*{a1BhoVNqfL6>y@40z*y`sZdM+BoIN1#GZjU#(_M>KS6WG#8J
z#VbR*74n2*=e|J2pW}W%!0L6R+EFKIpqs_q)Rbb+WpKYVvJ1`d14&zVNw%YOR0+=M
zuskDQM4gQ3SGnoqr*}vzZcl0D=v8fa;tO4M>(MW*szM+jRE@8F(&~BEzTbPEjnD5H
zcl<Q^^J&cLF;vgS1Ja;N<S^Bah*3h~QCpz8)G@IEJTg71O(NQsRAsVV8}RnH_Z?0S
zXlsCIuW3_L=8J*x<B!5=I#9y_1>TZY`dFKlQFVkuF^pFnK|NdvcN0<C8V_))bm-=i
z02>Pj4lXYHR?A)P>YH<`wh$E65c0##7pr%#&5E|_s!zs&iibIOzk+`J3i|QB_tp=R
zD-YTik@~`hP<`Kf>kxJJK|6)euHDXN2(o~*8Td*t+jMH1|N8)heHG-``xy%_r+@Kx
z*-!BHAsS$Pl=<lTKCgJYs5aQ>c-+W8c6+PFJ;^`vI}$O(4b*A_&$26#t?NNGGUDiJ
z*Ilko>sb$fw@^f3TYo4~TN>C?K2Z<YCp}@R%Zw!ZhUoG<>(N7beT-#B74tXoNqQgY
ze2mcfcidE#e)IOmU!TTb;dpa}uy=weC+(uORV%N~&vQIZIiAZ>*4uLS*%^o>i^SVu
zRwPBW_RWH%|IWA`;UGm+Y(V7j*%?SoF82ktTc{N{i#gT&BkgKilD#3ViYv>@gM$Mk
zVr&-~$EmsgeiWbjI6gHAESeh`L<}#6kX82f?Ul8a72XXAm2mU*ESMW=IF1kxR|Olw
z?rPWta*GJONIA_Ng@zk(Yio1rBs9Ssj%0YgkzI-+6+=T0fl`GxsEPRi;4fo9v)F(e
zNQoV-1{7P07kwy7#hp4eDr*^-z!^;*Ic1(GB)5*BeL}>a&8gmg3Uzj(iplN8b5$=L
zs1#!3j3T;rRzx>VJr^&+8NXRX*En0ZG&Dx7W@%`w@Zxq2ZBrkU?<?Uz(X#otkA#~>
z@6L|#;SfLv^uWPuyg;xQC>G`(#@UuLJ;S+><-g@OUAJ9M9lDqQ6`2h8@}nA~V4WAc
zPmrzOY>WCs``#P{FxkqvEzQ(B3FT)?-cwAy|G{MxPjb7K>c7NY;&#dYKHUJ^UlQ(P
z&yj8*(H$V~y||J+NxFeVS0L%n_JN5x=guRsITA_pD00dh)j8GkNPEs?()?3TsfaG1
z5a1<qmHi9M!*5`fosNe+LaRc;ogVpW*Wo3}j|T^o4sbeL9f#%y@?Pn8NOh&RffX8+
zA&BxeqWF`3h=BSUwlq|!Oo>O)?p#Dng~V{KjntzxO^)I8j>+2EP4)Cz6@?)pv?s>K
z24g@&m2)_f@L1xi*hq_2&V%fkVSvHtmlfoJ;^Bp9R$GBik%2$2m=fIs*nN~?=1&0?
zq198NI^rYT``$N#`f^vUTtO|kk@vw!grpLntD~#>3>&EcUIx%>QCe^Ki&a&0t=-Z*
zgQ~b5D&GxsR52Gg5v|RdV?_QKvTWT|PuyM6J=JW*t*dTNRd-jiRgYeA$5lDD_V!wg
zTZ=suTT8pGR~&w8tTPK?C70a;?h5Ctt<=0}x4X=F@d`D<-2<vTkbgUmg395C!r8Pt
z7uT0VM?+bCAZK~#$e%)40V7VBg}SY+xdX+Thj^jLrNMc$qUI(7FkoDKL0{lJ6dYM5
zlA$zmA;|_$L3uNXq*U1Sh%0C^0+E#VH6sx7$OVidP_L9Z2@91z$VTfK-1m!P{E6eF
z50Onu*bJ82jvw(57?BA(v5Y-TZ=m-Mdiip>CA7+X6D0h2I(Y}kQZxq&0V*CUVBbJ1
z_%_;r#exPXKqP^UF<-WKIxb&04Tv7WT4Y<=P2gU5i$QLobBy_t2w2RA0`X})sC(=o
zuNBclSA8ui;pet8L@9Y2t1-ZbwWce!iX13e=rVd1e^h-gOj+zbs&$7K*tUrM0Dk3>
zXtzlmv24}Blu2h?%F`tET<cH;2{JA~RmVo@w=qh;HU|Ih83u`n_)xH&ohgkTI27D&
zmjrS;63KS1Nlk3w0O`@seg*~0=QY|)jATtu*}Dy`+)N3bjx45<?Ru%C34mWBZ>x^1
zb`W1yIxdvB0&P&IvZhXqlcyVaE}9GD0lfkL*aH$4w!+L<13?YSzh@Q2L017T#axqe
z?;{QZP|Fd;fr<v*p6F0wjsS=L0oz@gn=5g=Z*n*qXjV=91IdhkfpvJgN|q8b5GNv0
z@MMH!2Wo6<!^0tv`2Y&j^h~uH+_Yz<h}1NWp9oZoxJ_<D_33)E+HRs?vd2Y9{3$FI
zICkMzi8#e>V@2TvB`{p+>9=m(zRjbTjy5V&s;9j?jr_*?+jEPsJjzgGJb?gIbIt=h
zIUeXNgroA+=ERX<+2?ZIEx6){{~e0a?LZ+Bjz+^Su0@nx-X11k6(K)h2qix(fTj|7
zLvZK^4<0!JP+p!3+QJ9Ty-%m4Z;Y257+Es79Dd6E_LpX;z8q8n#LjHU-1N5-#$NdY
zy#Eg{HfOuucwk|@(e)9>VPY&u4T#30(XkP92!|u6m_~+NZJ`OXv=`tT=ou&ydksV>
zb)V=6lK6{wyq*ra+LF~_T?cqE5AXS{Y(W#HAl8=y5SWl(c6uD@QEU^clsg&sA^Egg
zhOJiL$geJgT}9W6g<=&%f&OqTAPG=()U&Sk+THj_%vCGm?5OL#$})s(0d_d1d#)&!
zoI@ih^<ENb(*+{}DLErx$fU{>o?3Au@4-BlYfeuHhK5I^#sMZ50D<Oc%&q6Zj8;UM
zp@mEqH0PD3dQ@*V*GY`$8n%GX4_*Y6vjjDkV7KXdBn*678Sc!y#@n62kU8!rF^&(9
z@rePb&{)6@TFz`uOCsT8z|S)vN)n1C0tbj1mqfb(F^J`dO2rCPOP;GX6q^fKhg?J9
zCAi#5iqAVm8v>Ux7=FAg7Z-&?A&F3%bjCw@vfyn()#C^#M%b?Y0NQbMj2}%J?ZC~=
zmSA%k(vQ8cC5_g!yH<N3*6P)A6%_SA410J56qxwZFk7YC1V~sQ8G()#W!5nBYPi1O
z)ljj_>qA9TDm)Dl-quqh>bW~wn$fDCK&yx?ZQA3Jq-L{PwcFQ<rDhk5oCtMN5FGeT
zMA*Rusnx1fh!dw^IIQ5AMjmaw1wK?6P9WLs0xXl0J+i}Q#}R=-fJjFM+PcMKF?Qi|
zZ7N~NDpUZ~yG>hD=yl<4fw_arl}ZYpsPTv_iL~&|Z@z_}D@Z7xFL&C-Yu~+O><5Y)
z4;wfr8hH9|<K2QJb(>9ivRajjTNZ7cO=`heCL+fP`jub@T1q1HQ$_TO(rk@eDBmsD
z*?gFBJuZ#F6g`dcuySp{27|g!oY$)0VtHj43S$S~lNC{h1T?bHfe0t<nVuFRd>48M
z1XEhh$V}tJjFw5tNpTi9)LEk)KaJl049!cu!z4TA7h?}LBh4O+kUb%DjHt6%=fTr~
z;+=JX)_R?`>`aZ|B(^7p2T-a3hoYe=wKw38m|x#;*!lFdlOv}J3Y;@se8jst2QM`q
zO;&O%8Fup6@d>DLsskWrIg;5(B?}p?S+6cjv525$u7mmQdL}XkoZ!LHp$5)0bM#2V
zk5Q&3R<!wW5&aDHRl_Wl!T{KYOA*e69<x5nNmm953>=;rqvzyn`XA8q1IWw<XaP_l
zryGdoVlh-IqIP!^X*ZP$u~Y%C1d0=^G7sb+pypj1wT-Tta((41e}8@X#>FrH$N!+Z
zKJjCZO$<za@aO*7Z&C$yzbh4T`AZF?(*dMN+Ng}6{)P%>%t<U3hh(ee;5&`S*9iLI
zaL0*D2GIdq7p_O2&6oouC(v1I2fpEn#}3E+C;rWcxbI<4`c%iIAKX|gURFM&pMeTc
zh6e;0{HYKV2Jo15>>W0R9U#LEJ5)kH|G?I5wJ*HD)+E_7kCQ)`iG+Ur$i_!@D?w0F
zc4#`VWg}t8CcA?q6iots!GQydmDDj0(`yXnM&{0=IxmzJ(o`B`gR@q+&<f<*f^LgG
z366JdhKfsTCoju02*t4XJdF2zU<_Oupl(^Kb57FSW6sa=E^txS>*_goV--tm72GxW
z%LVr9W}Vpla7{V@v3GHK{KWI2Zc~f+TcsSrHnN0-5Tr?kkgN)=-q+5_&Mr!;6WEm9
zmo&&{Flxt;F$s+dnUg4dff}`<j>*?WydriWxdeX$76{<d4O*U*Ric9cm`BlVkPhQ4
zLNE<0z6R$wz?O5_X4;+{9}Xe_^$=*!NH^p>va?$6L3~2J<9hX~Q--D+H7*D4NvA|N
z*t#wp5)|}laHI#JK%NK^1JIhL?GSl3+4L0rGFt!3X#FGiZhf-~`=|=lLUutvB!rNF
zG1|J<u0EteH!NVurJc-eM;%mW2Jg`mCE6sqAs%D~q`pU>uF@m2b&p;BNsHZP4TpT%
z34z{f5`&w$>&cVMY@j%|n$WZGC_I!FLEDz;jj8ya&3-RyzOxSz3%(zQnLX2P?}M2I
zn;CnDD891KJAgGtZW3pEg|2nUT)%yHLHR)Tj&}RZ);nmQeQ=Ct8-*4mdl+gNDkX(m
z%^H->mfnK4&}xJlUE~bn)J1)1=yY`yC=eoT(b#6zr=cyAQio4#L=Wr&l>?`1$O`N@
z0*-+BX-o_BV@0SsS{}BVNjD)JVZyj4sk-d04%`<cUl?MLAaFd+MFqA@-YEZ*LdlDC
z9A+Bs1LjEMPT+3_`~_2a&U!y?W)uoafh)>ff24y@EOd0Q`w>&Qr&z+)snx8zdN%LM
zA)Q9CAq(aF=-#(RTjgk!nqYmHmZ8xEMA=eg<(y}|wpx+gs}(SB&@IrTY<1nY)reef
zAOI~41CZRe71V^SMi39L*$6tG*<i3%P;B(mV|;SNkdxLLAdyF=4~b3sAL(BWyt4u+
zYF8X~U%iVxV$5vRSQlKqROkSD>4<QHA-&V(#`kKZ9qKpgK#_%`IR_N?TBj2XMq~oN
zI;^21PC%p8X%DH+E`;r2bWt^(9+W>=kLHY$JS05<%-*zW`&W?N9sndEBJtg7)rF%U
zJaf9edlgETxkzGLBU{_psP!BOsv!G|PdR#etJ%ab?>X7cCI=G`tXKdwC^%WLJCIjl
ztvu8-+Z=JfOJIT)LHiyq%IkJ96f*QV^67pAEuU&MLLnU7IKI1G2v+E`P!`)vE`b-d
z<ZXAz%2iP}4}92k6y#D496F`7#SAL)A=}F7w4a}HI657NBM_jcrp4VZWJ%R)s~~A_
zwHh_K?sgNch{{2!sa741R?DM;>j+5r^Ej^*8%#(O+e(OxC(*9SzIJ(Jq&H#Qu{gD=
z=JvSZH>p(nT6NCe;@Umr8S^R8kOk?<zE<fP(w+cLg{ms^as_mix*&SJ+uM`|dsx`(
zI&ZI+^TnDO$Bv>!;}plndc=dix(umAA_5Fe5JphDV%8hzO}H@$9tM_>NZwG=4O{ng
za(|d*+R*!qMc$`r#Eon3RyGW=w?p5E$Bb4%i1w=-n=K%%1EWUrfxZ~x54ESZ6c5&}
z{|@b<ll{>4aff>!ZWLHydYiPnmgHn^6mpz26({&nJ9@&8yu@vb!#e4)g_Uqu&p|tZ
zT#6b8J}hMYvq!ei3fF`Cpx(qmFTvVzI2x3x)-kC&ySyUW*mm7MNneOKbS~%>*(QL7
zgY^zy2>)4Qe2K6AAMfnPz0Ui+8oygjNgwKK^*zq^?M<}?Be458H(L8o(OUA_#<%t$
zbF9^MhlUdfk}gcOLg8R*nI1NB@3j??S-hH>5)BRF93#TZX+5Tx!+~_($Hv8FxV&KX
zor{;tv_<Lpo?L1v=h_<8>ww?&z4_7hvPRfp&c4jpBASdPt;w9L+`)EXUuJA;{JJ9G
zi!na`9^>;LFg_1Uk{!Y1PQ42LA-xGTtEv0qa0n4kWKZXi21)+N2OYK<oG+<>;E<#(
zWz-oC69+t=z4ZM@6DKW5`FTtZrHaxVfhfAPp~UbCtOoG<y{ADw51)bu0^cezhyxo<
zOyeMY?_)l(Lsr3^LjTav8Lp;qZpF4!SQ&31VKoDAm#9HjnbOKa*?t~Gy*3>o;x0Uk
zx{4n;9fuBddcE7DAMf#3V<ty1lOveP&%5agus(3LURV9RjIX+l>(Ld`_xz(_v$;8B
zwQvErE{GEKvrcm5vImo5=9=U9xTNr_jn6^%oKyr*l1wTb3ewG^p3;~HzeVT-MVq(h
zZ%}MtnB%=3&XCKH%n)IoL<CTxEd4{ap(iJ!?yC%HY77v5g0Cx#`k`Tf;qs`P;^I)o
z78M>ixo-4%^O|I5nR433uF0`W=5TQjB0NZcjc72!HFiyoT{4V|d%$(bX>?Jp4!6;!
zoc`a*hY#EcjyXe7qOSz8qH~Y#M6XRZoACpFf7~v)`7WH`fOqJkh=gHXs0bAle3ZOh
z34zmgn||G>2u&1;v3tA6{XM6LIkupaa9RmIFRb)7a^A=x-m{@FDj<*K_wv|!J-^s~
z7@1(K1y*mVfyOUbi|}i-3csP><8h2HIfE4*BFm0whwkt<HoO~NU>qvJR*C%@Qcm}7
zI1rD*?~c)LvC~iuNb3kr`gMobof}$5$0wb72TZ=A%(rmSV1w7$Xb~a|UMn!}m{j0!
z&S*^jfQ}k9HDnHsD%KdAO~Oxx5JI4ii6CRdDc|#PtXu?XciOeIskXv3DVVY=mMIHP
zMI&4TO?ju;N($&!$Oa)VoU*2+s_u;0JcPR+p%Y^7yF)YEaa(AO5KepD^4yL)ZQ3Ot
z#XX+FJtlYGgNZgAIXIFb+2}?8{Zhy+R~)FF4t*3J4iq|=+<kM7bZsUg>DZzdxX89n
zr#L~ilO#qmxnOG618CC#+5~F^`lMmmVi!9m>G2bjs*8{vrj?6*?6`Ds_Tt6=Y$5yp
zS9}^uHa8{9dt3AG>9|mL+xHJ}L@1Mc8~N|)U{EcyU*0tP-|Lz1VT{FZj`0U3ae~84
z-Y>>yYy<e4_lfJd%(=r1ZVTrzt{yX-r`QoLjjeIs_tHbg9g9VO4sCm&vks0mjuHnH
zfzbHoYWX<&cy5e02^#nBBjOEkG_no9e@{V?k8LeDg;v9;O|egZ&yxs&?BCVlGqm3K
zi&1WAybkEr4pfT=oxQ2?st-B{c;9o_Fs@A<*!1xHYmCGHhIQ|Kp!J=gj?#uSOVQ&s
z+vav8a6G^QM<O>VKJYGRU6BlZb?3|<zt=$EV?BJlM*;z_=^?+D0Z>Jqso|<<0E~?2
z?SD_J{eedyXpI1kg7JKSo~My`2zFj~dS`zR-MhcmE#Mw`4--vce0G|!6YYON|7ISz
ze<No9_OqYwKg$<(o7Fpe{m4Cgy`S0r9!6k?S<c4c=P(Zcp6Nlj(Ed`56b@(|1Y|Ig
z4*T!>C=J$byL+GApX!G=>=FVa_Z$`QSYz3n4+Z2o#^e9pPIwOZzMZHCV>kRujMD$~
zz^f&0?S`Ft&V%fUK0p4>C35WEgRxUvc~9G;&(Y7;#s|^s_m2TzqoWiT(fQW_FGKEc
zp)i}vIh_fSn3?@9RS6*GOwsnRSOYY8-hT6@BHgmt?VXw^q*(zAS~!N<N{h@EY=+)-
zBi7<-`6ryqj!q`Cp?Fs>a}6YQ^-ge8V_ID?w8r;S8!+;Nphj7`efxHW_o6-?j8*1R
zae8`Fl7xbS2O|lgSpXOS+`9-4OM0i#b+xCa(u2`xC4!Xan1I+}JP`uXL<R1`?Dg*y
z3i#aX-^_^NgUA{_h`>Jbln{vZNR?M#HP6F;WzPFdk|Z?N)|USEKqrIcUqE5me)aAF
z91Sx`nrz$_W`g<Ry(k1ow%gPO1>rq=9S))A6BzeMgW0N1z#IZ@)T1$W79drn(nhIt
zfse%$JPA;hay6R`CYqs4ldM(9SN>UextXV%ttj#;QEh@lHkqioB1jo9zPnL&-rj-s
z+qPx1C`uBE2rWcuS^&7|Jwz6DfQ?{#qzUjIcJ(lWfdDXc08YR$ds7|MS?qTW*wz)w
zEvxhh1rY@-Kf)_=D8${m#ZgVVkg9kEfFOYQ7s1Pbf2jy^jaKR+@HzmxJoFH*ta}m<
znR<YQhTKBWlNCdlGuJ(mF7A<OF$2WFUda_6q-jxh+O->*Otz46P+9>TAP7}dtr{%9
zg**Q??(Bvol%!|S+1gMasyCfJSF7H(2L!ltcsGU%I0XlYj^gn`L3c+0K975%0|>Uq
z!|LaTY!WL=TmZ*aFnkDqG^?xS%XJj*6U;Jf*^Q1>hAsUBDq>JojQL)*TuCHyx$8IX
z%-_9rJyY#Df#nH%>kdLYIl3A+D3eKdw+PV8T1nD?a9Jwjmb{(H9CO5%(bI2l)mw|A
zURY|gGTWf5ZB=I5w)_4^^jMGrqYo=*0OTO>wZk<Q^-69yL!Dh#Y0L@O4D!uJM+1Bn
zV6burv<84fAu%PJrKhS4cj^}5X-})(yp8s)Zgp^How<Cu(fh&&ys^iBDVr6=LkEXq
zg9i@%%a6vr6gO+}aR(qt0NoBAJbDx%eBS`1%jAd@LyY}EqEtF|jGnk>;g&_8+Us<j
zRC{iCtB0xZj@olk7o7M&ky8fa=P}ctN59Yd;s;Ly8PW~-xR&k>92$=JP?2reZ}$>Y
zgCAg(a+Vy*8z5%n%Nv!Z&DqATX$p06|270E7Aq9!x#tjUo8#25(6=lO_OFXCoE3d1
zpSg3V+Z|1YeWBseU;ThzYye_VZu)zGgXde0POCjWUaih&va2hL^J`V!5tx{m7>epX
zV5A0p((3Be6g~GGm~B&^8n*SVmf8O0@&#jrejg+B2Q)&S2oXIHyxb^a6!kTmKHxnx
z!Q*oEdftNvy>{3Ic42tf5GaP=L41W+pF(c0eQAlwohAtGs#P^btQL?qB1xNGFExUJ
z2udA8-ptLBys71}e9RZ1LKaYxx812V0TfKh+uof%>%xve^{R5QSOyWE)^!4)=p8+A
z;>57qhx$B}959UZ?qT2_4dG-6v9{CMCO3fYLM)ugun<o`C5SGYv?aQFdTIpx91As5
zbUpkq8rk)ZJiPfraXSEKm0bZB2i#;z#=93a+N$}y5xdG_6jx{zgNZS62OyDXoP8e*
z_j+MBPzBDQ&xaDgM~{Xe+?y`v__$L?P+yn)l<^gHy9vY-4?N;pTXO;YRO(59VKny}
z>>uh_lU&<9Ge7JJsnC(M*Mv-l!~4zK4|m!k+op|s@VWh2%q_*C)IpmZ-0!FbUVqzB
zi?Xuq<b$2Jbl}p^Jivh~<dVtUdpmXMr2FS+`^?lPa+nb!*LxBmR6zK-4dAe30*3)$
zHE4@_H3<F!K={ez*!U!s+a7cV*iQEaq9I_8ktd0w4GcIu8A<t)y&fvc#*vOQ7!5dj
zD0tOiklYfOB5BOv7r>&XN_GIHqPs-{9_&;-EJ?h^dFWjT!6Fy-o8LM&=!ldzXzO-R
z8d%dx`C?HnLs*o!Z{14yE&`d*S*Pm3OF8&mO%3BJ`g)c2V3p!j!01f)0=u!pg~~4M
zFaeV?Ydsd8^2!elI0qqbQO(EaP=*g491Z{x)<$)wld*EE-Q{HWLxZfcajt5@jS((v
zhy956^udjh3CZBbqub%e0>O<LMtR4FoCZc2AL_>^vk$0eorKjbtSw)ey+bJ!2=GX5
z@LlBEIG17}cm1|6AYQJHOvOd8BHmoJhtPwGV8}s7TD5pRb7&O-Qj`jogV89e^ol_o
zCBsqwZ12$Vaevt7TdMemAHrkkfgsJJyCBUwanPPV9Q3{zXdcxF_%oO@eyygSZE6E{
z2Qm$vT!+fEg+k5_W#TTb+J=e+Eor;Gob4O_tr;^W3<zL{a(3s8nE-KPlJB!L2vY7V
zmR56GeZa9sv<S0z|LaWh4`o&G4Dq>e=jAtNv4WR@5aaCjcivg5g82jGb&A&{SMU4z
zSTYcb1%oSEaP&AH$taZ&Yu78cmd=8wLTd?5Z)9L#b+ze?;K&*s2;Jn5oIK!!aJZe5
zqLdaJaWi7({OVgbDFLSlg;)0Z?%df(^eEXj>T|wXADbTR*}C1gGhH_z^F#7~orUy6
zTX`J$CI2;6-q`&z4Pr{fzE`fng*|f(e8xVeT!WPrqNR;&-~KGyAOWT?b?kl_2VEu7
z-7DvSZrh)85bE1&$;ruVwy8vRZBbU5)zJC+nFx{Q4a!wuaFLqFfy&6j-ICpU03(F#
z=1k`3;fc}ss<s+WP9Av(*<UGGtw;a>wgrd+RCD$dr^(5afAJSz{pu?LG4RR@U-|RD
zIC&CpOC|>g2GaJ0MX-?>x)Rmt`Z-+JiA2VM(UC;LtBis3eq?k2mKD;7!9r3r@{5aL
z1?hPQ2&M(DZZd_6K^L)l)(Zwvr{C@l6hIAHfD#!D7Hgf)9fiX<hj$`@QX}nht^j9n
zaxej&@xc+IIUS}~i9rL49WuB`Evit1<1^Ssl0(#B3|-ShJ}{PEFviWqb#JeviO4HI
zH;D=>B|n%h`6n(JUM@n7+eofafrfMEm@Pu6NDs$vema`x@(E;nlp-mRIT7G_hEHZv
z?7e=x*N@M`qi!I`*%&<M&gTywCSGwkVB+d?Mym+BIF0v$&1LJo*rvILH{?YGAHndI
z828q40o*2$k>hI2f}+E^N+gaQTUkb~?DFa{ybqz0A8|Vo_tvW4HBVJDpKV)EGMc}Q
ze`q<Y5R#HINgn^udR8LDX#WAUiLD*0P21aZzP~*oY7Yq0Ba!Lpg?U(%^NZ8!`MuiW
z!&OnGa&rV}<znsHsjvw!^B6;{Upo~yF-C^alqWGVh*V}W$Jz2d0YMo{jwVNvqoYwQ
zV}1pPGzu9d5?CkLS+u%9X6K{D`~q9aUxB$9eNz9o(tm#O#jpQiDuP9g5PsSVQzMc1
z^Xte@nfysu#>O4TaK|y+5p*!r<E=SJ_4gU<O#Ne@+N;0+23JGtIB1=*XnbRXG$~4v
z1cnc}cN?n9^jK&}auREG@>ZmLK?v-Sh%k^H=EeFlDpGbq*qys^3zR^9ugA_S392i;
z&2@2fYI3p&uI@^;qxf%K&(?(a&~R{aDh9KwrhZV<ic26%1K3%tU_-6KE!b|>w!1Ip
z@<3$gsX#m(Ewt^v`!zV)9PDgB19++!fBMwi?6u5B1EZb5KyNoq?_Rrnd3f@`Xuzo}
z{*%Xt-R}0vf!^z{-^n+8;7DORVlV8@fPbLuTPdyh%E%<(SWTaZ=%T7VRM%&I6qy7f
ztL<Y}_c5^}CL^vHWVhM8#IHvGH1^eNT#G6M(Lb+oJ>!b=qo}Y;*QAO;^pCaeQOpyu
zQGvKLnH(9Z127H<p(DT16?&ySizg1iNJgd|yuZXZ+*gf;pPyHR`T5aN#W#v7!asQR
z-J925{{gb*D0h<fh7zRIkv*%^Jb^o(90Te;1}`0Wj=Gdv15*3V*B3^KNfMq<^6O|V
zot&>*MdK4Vix@>WGR<s6HZRcArno6XhBEg^CszC@7_Ue5t#a{OyX)y~xIqI<L4XR1
zaNx;_N~F!Tk<=q#1$M3PA{R#)`)NF>kbMg+a$vEb3bQ;NiyARsd>$>?Y7m!ILa2X(
z7NJ2_yRuxAw)$kYznZ;S*@(Q0AHkeF7mUPLa{=hR(O{rnfnyJuF##GAI)|<AKpG+b
zu|*4Tj>nef6A48i`ZUG0x;z+X7ED8-%mcqu2hj{pS~^s%?-2zk4VNgBw=V*mt0DER
zT%czqHxvSP_CLE1_u!^nGw@OS*Rwu~z8yv1!toQJOtGYyEHe?O&fqZJCd-(BOWR-h
zO1n*B%xj9VcAJSeyn7Cv*py?Fljd3X|HVBB2k>F^WAx}pWckR+M^3))<Rgz9mgNs0
z?aJM_*)I~?d-h4e!OY|}L}c3jwf~50xF_{rw}1Z2U;dLXJgNWYOsL)dKfcx}bzXVl
zufOr)H@?R7lHJ`+I~Hp2r#c7BexE>_2!S6zj2ecAhS3`T;dZ64(K<YAd{<|nxM01y
zF`tT!*ZDO2692sy+wCuY`HSuLi@%o<N?hip%P+}C6VuqlP8wlkJplM+8{t;c?2EC7
z=$ub5G!S}1YhUtsL5PEgN<c&;l@LUNB$bp|sB72sYxo1Lc_w$p@#%52)h8mG(~VLJ
z;x&kv;x%<<b7+K(4L}lnuYL7zzxfZ}{JXz=EnE@BN*Hf2d#xDR`$lVM&z!>b5|YpF
z^ZEjQ>3Zeiqm!26cl3Dqx^-zJAmDr{HBAlB4u@Pi(Yn3_y0`4D)>Gqu@~2-h6~Pz&
z^vmN<SvPbI5CPV3f;2*6=rA-wiVYA`$+>g9KY=Ve^4wbSf-SBD(sM@fE=a?LEE08U
z*#*)Y=&1%lO;YE8vhezxD{Jw?4*mcr;J<b0#^U15OW%5SCV&KUc)xMDzrn><TBB0N
z(9<X;M)qeyqQ06cLgo66%}sS<Sw(DHG1Ua@tnF$7ulif-t*0hTMPcHpPtp!^nmg>1
zkK&`cvWK!@^xD!9&*2785;td*YODDgT;m6enzrx*PsDS39h_BY1e;6JR<PcEbmMVR
z9Dj;lJc<Fvt=L>DoPL2_i*_*Sh2e&dYt`$oUVF7(U;Ke5ym>(<nJ7SoLCzUh4YTfu
z;wK;dq$o~ozqFIg3Mf2tbDP(<X6QT~#`>|anZCFjU!9+O=M7Q3{O0W3imJN!PNh%?
z27MBrmWu7-nP;B)`Cm}%pZfWq{h2fPE1jD-;uf+iX1t>RO1IvAQ`4@#eciZHyS%aC
z^`fLm+Gkx!6o2W{&um=@)k&AED_P8C9v0|HUS6TLy{V#N7Sg}d_~yBMS(Yzf{?r+|
z*e`(K1^i^0G`<;qBE)0@qv&OyJI0jA<CoDTeuF4WL1-3Ad)Y_7#MH$ve+nJqlS$&p
zFy^`c3W3AzeCx1(^9ooXn^#zPNlwTwE$q4ijkFzY0FPZeZRP;%9{nG~yFNiJ9gmDx
z*4MMk%P1#?V+>igdmMpkfK*)wP%cCw0?%D%;0PPuPk!X-kAC83&Kx^N5mZs!<0MoA
zBc2||*H<_*$2GI-C^W{>juw(t#EEHaYvXsj`>`q2=o}@BCgQ9VDo!M@@v)VZ^R43}
z5s~i}mQ~-?Z1$?(fAwm75Ng-Z0N$_`OF4h!yGTg~y}VTiW(s#D?q-BX+12{4nci_t
zW{m8-ZhFt_9>#SK<GS1IuKxCZcE`0h4X>To|LmUEC*6*6vyh7#0R?I-jtm$U#YRrd
z>I(jWR{?!dX9nJEc7R`Y%7?hzAV09m9Y<`#VehqXT)@7%e*O9l{7(Wbn$fgO=FlPH
zSUU*ei)7>k|D@0Bl<b}M%fQLmfR_6<(onjb!|}Lz9x7-B;kS@l8yP#iEp!-*hM;Cj
zgcuV=cy<f<XcWAN%PTO)%lH{(U}AQyB#Kq|X>a398U!}Ju^BvUXt!?OBAX;YHc84W
z0MQtlIsiMQT&ckffCX>ZAqNh|T@u+L>+2OEwk?i0<*%==x3X`&_15k6bx<34+*hvL
zEfzB^xDa~?EN1YRZ~R$teZ7re$by<0XcRW%h`rv>!ILLpkt~o!qI#f#F1+>{jF9Bs
zMhKIr|0l-ccQ6)bMKOBdVWR(L<)q!dp@A@fXH?6`MPpI8dxO%F%<7mcG#u;THLDP3
zhYij#m#d9&sUzyQaEpygyKh{8y@*9)0WZ?%m4waiM3o5BVhDy0ADo&jS1aX8r3+i_
z<~og0GEBCb)Tyb%pmq!&B#Qn=Pal~&{K%uHM^Qdnu4A$bNWc%YD<v!*%fwj7cNMWL
zL-hJmKH`#k^+kZE2~08=-g~sJW3*7hFfND)Lywb|56IE&**C~~+ct2W6~}PD_4X-@
z9HABLB%5w3{A?NN!<x&d@NTan$$qWm4%EvEU#loCtt9(v#j?j&Rn;KLCMKa^(6Ur7
z27y4a_#6#Cj1#1Qq0va>vNIv9@Si%P!2Z!-c2x?BR0ZERJr&*)R9x<emUl;jm4Zh_
zffq8WNMa%SWU(31X-y393Z9>3b58Yg$+m;ARAgPhetmZK`gO49Dvoea=-T|@biZk5
zE%4Sxehu*cZKfT_#r*!w3c~%SowY7OYB_3XCWP;xtf8qe(&xhAJSc+mdGym<bFy!1
zfiWKXsXha9dn@{_&8hWuSzcd148`{F;l3vI7i=}#$IfN0uMF|##NY8n*UVFLQ#WJk
z*rCa&-yfYk#FR7WX7RNZ+3Nu<MXy%T4o}*gC?N6V6H~*(Q%^kkS-6qn+*^t)fB-`j
zPqgNp<HiV3g=WId1nJ~`!#KWQU&$tuAZ$^gkf{>W#@rxG3ew#FoN<spbLRNv%MX79
zZ^2YLn3pD--8zYpQDL0rZ)n=ut*oZKj<cL8LO}c{62@8nbE0_s=@X*(49@Z`&BxSD
zNbb{l5~j6$!_*nCl}oXaXmy#jjPwE+2~ZUQ$<);_Yn`biK6B>8n=ig`{At#{w8Yw{
zqk+b0xOr{XXY<<VbaW&N9ysdt{jU9u2fQ|{nga9?TpLD?IigVQ%yz@NvD%$^Nsh}e
zWiYINclqxg{_ys8!=^FYO;!_Gq%#JgbuR)i!B8Y(gV*<NW@%BK!AXS#l^cyF(sd-~
zLAWY(kW;AV{EhE?=jx5CFMW%D^z^~8gQp)=UAeVrB)WzyLSAw4$a(-#EZ%FZ2}@hp
zvI>a(Y5;fk37YWEKWN&;w`u5ZV^X0md%YkLN&D=6`zL-=6#vyHXd<4*oI+8aoBKT5
z-=rPTDht!+|2~;~_vNd}<k#6nZuPGWTq#Uf`t@VSKJ?6oj~)9BcDaxCEfM3IRx7tO
z;}>w3|AM=mrMtXrUOk(gefQnjTMOA-rO|3?wQ{+J)D<8By|Po32#<ky3><3S#2^kB
zFIZ7qtuVYh4oT=}<+Y`S#q4@+efjn*vUm0LS)Cg|P_bId1GkbdRrh>duJe2y)jHh1
z5b-KSL%yxouB{)`6V%aX%nqJBISDw!fyrbd9*6Hd8VX0lewhd{z*5w0lnd*K(xpaQ
zS__^=9f}vuK|guqqlx6$SaLXt=kVyH`s~?7_@``cRMH)cxDh|z<8>JReIOE1F0i}`
z1k!4`z5O*<tc*Vxt09F^rJRbhH03w*$h>Q#3SAL4XbBNgpibJ28sH=n0aS4Gc0>oz
z?LDMl6gDbUJF#0YtuFpQ<y~2G+tw8Z2!aFwkO22hA|+AYV=J-axN(zFoQJe8eaQ5o
zo&Jjc1d))E&h#-)oxHXWealQ|GHo)=v`yPdYQ^yqFKT2*q9jwIxrmEMO5FM#fS^cf
zagw@|PV1E-LEMXT?>+nZ&icmcm&~R%KSpHRK7wquWVF`VC)GZsLLP^u%gxWy&U!B7
zoP6Qpg|p|MJCzuR2MF%1a%sEpWOMDSB|zvydCR2N*3)ZSD6HlkAdxQ=J9Ylzt8e`1
z%{Lirqwz<+X*b*DF^*FuOee4E?7x<+m;$-4w)23H+{9G(UqdqF4G#AkP~_L32$0BH
ztwt%kiU?+EwwimAeNw14+R!Bg9!1L>P>qefWm8m->J+$6y;7<iC0+pDqs^LoMg{(;
zg!1S^c3OpY7u@FqyG!XyA_W3*L=<5?B&Rn(c}Ljh7E$pBeNH>Ohob<x<+6|0seMiA
zWWAK%Twe#-S`5n_BeP~r>J%DCPH^;TH%Lc?#~iEsv;!UYr5nn+;=|%i=Mi6ms!O!b
z?%e-s?eRvsTuQGj-CF$Y&V%KL%S+$j5TEOv;=>N{?ZtmA-lUDZx{3}F4`J(q<PIwX
z6c0f4JX*^fbF2rC`@j*8A2{O!8<)<$hSC+?2%Nui5v>fq_v*F8)U{WxUcGwd;st1$
zIPy<F_s>7=+@F4K=K1I8eEhU$N@}y_@jjFVd=1tRKZG}!tU>1)nyqJ&_T<wPRuI)j
z43IC92xK_;@{=;}5d66(T2jIm4S3zi4KC(a-cr-+<+7??oQa3yGZ!lld@*fKc0fN{
z!9oyT!X*Q<f-<^iaYyu0*OfA{zFikxxMOZW^>2*cJ}I*U%KYT~cm}}V&<ZcaLa_@k
zG#-WlAl=u)9Eri9G4>@?<n|TsZuf?9<_VvGyr>c04p4~4nJicxA}`WT2JH%VklYP_
zb<$GVWwkg$pV27N9?|?*iTSKJbO3cgiU`4YA+!|M;)yYjWH%6T@Lmm;pc06Tjia+9
z+@U8ElbVppY$1G6D($7b==X?$f<8Asb-<2Dr#E_iM&84memg;&84@F?>S=gj!m5NO
zybjqD3=-93Khw`jIttG)uuDeoA%KP_M9~S?elRHLT#GKNZ0C?1vt2CiqUiG5!5v<C
z3B|V9NfZU4fAH7%`Dqx4FV!HuYnV!Uv((sa>^8RxioHq2P{#u!`Z8NYOnj3_NrWsH
zvzg>m;SzPev;Zm_@-GpO#V3%{D%b=W81lh@TSgLWyTcG}2;w*pH~=(+USZ{+VE9Rj
z1Cxl-q&zXWv>15UukseF<Q-KCbcWF-zFs+o|D@oNoc;8@_kQ=m$2aaQr8jfM642f)
zk~=sK(H{$89HeKSnv6l?P!$&<Q1w!7?cvfFckbT)>~plYxC!4GqiS>CM=PKw2jrVB
z>#CRp?;Mee2509Pi+jrRsOPaD49TD4JPgUeQ^PWl5a$n<ff}k{jE$v;$&g6k2FAY1
zZCCoQ%eACSFBLPc^tqj)cG>3-M#iR2oW+ykdEMdI^vT3nKy^S#LV$rnrqq-hD{N!h
z^-6`XJ0X0vX{7(>wxB`f>);%Sl!{nEteQvf&t|-KSuq|RQsc@k(AUs_uH#uh!L!Z=
zW1(Ou5<h)@=Eav@yl{Fd;`ar@W8=|)B3j$K@aS+zPir@-`AxLeDZ_CC!MeJUBm6YF
z@y=9>u_2dMf?6jyp|?$+K6~c$$?3%One&$+40@5JS=24t>?BwZ(H}=-izKya+mwg4
z&G^x(X$}G(#trt-2k-ykqd)!mFCYK)Z-4*v#_jt{OZV^Ie{lcq-3QC7>l+*Ej{%#V
zEtKnkoB}oyva{jd0pued4oX9@SeSb9cx@%UwzB+BV0<p$zjN!0`}c0&y!rX!Cm(<G
z;fEjop4_zB+$@_flpAdv@Iy7tk@wNxnspG|=Du(mAN*nXwO@4zh7X?XVzL#vtBDSJ
zWjUh}kK(lP2mvnu*8myy$Vlk`)~wUi!;u<SYQ}|>9V_8-xqXPmWs*Pz&19e)T))0}
zTaPyyD{mq)zoVFOMe~2{9RzHLLz6u#ooppS8-6!vUOW1~_HJ<WyXMcmdyrR>YR{uo
z5AYCu+jU_89KsCLef&c4C1pd@lc8Mh7WKvZa%J(K#qu8)KfAHGl7+;{u4qvTh^gUl
zY;p=(Xu>Ci>qQ&@)I$Lo9iAtk@OhDcBX_;Qp!>B;GZWq}fv460>!R~L)2FXtQzO%y
zlL1AqagKW3Vf_0x*?xkcagB!Cjn_V3QR8xMcdo}F?05!b;`H#(-{$mIEII`5u$8%A
zt3uyEC~o*0y}L>H3>XkFGsJX8M^yhMK<g3-`fH*+nik>k9gmv><vW}v+zbZg!GumQ
z+^c3E4g4E*f1nJSz(g;D2JojwH8F4Wk?6;t8~KLd75GECMsTV(w@GN1E0bf|05x^m
z1OnSd`fPPFYJS$Ije}o%JRYv^0SU8JKYRAxEnrUdYBc(^6@Aq$e7}(M2F&l9Nb<J0
zytC?M^4dHTpSNwUkB6!q2|qM?`d$AzDPFV$R#APxtiEMi+mtOkp)vd*3`D5H6Yx{W
zh~iTR2b&}TU{FJ~PRdFd$_=Xgx7!#J`&P>wU(0yKeAos|2`R*M^xfwH4aX^F3-v(n
zy=*u8F5AtX%K%;i{vN9Hpha+cuVu$*pJj@*l3(!|S3gDJea_-29o|qzpT7+w(*r`a
zL6>T_-~!$-Iw|U(^<yt8RVDajxk>23B?K8{r^k)AbURIz=3ONK!y(v=L<2}H9#L)?
zfIwiz(C^rGv({Ue{`%LEeYa+FWU&6$d-oh?TdkP`>t9O86s$khMVafbVy=Fj)?mn(
zFK2J~L-Ba4rKYT+!uVp?v-CE{7vPS#Bqcc@ulKUQj@au)m!#3XZj>hIG$35rQ#!7!
zzJ?eVYM^9Sb_r*Mr}jxaN*^sdtt2O*RvzaM*Wq~T7s4~cizt0z@LPiVyt~_kEed!<
zgLC!wIxt-DkZ744^O?^|zCXg%a3jNn>I_7?y-}-D7JPkP5Kwwk-$QSUB(@z7RSoRT
zgPp6pN|0(LI0<mmD{8hZ%1ibTmj_Zy3++5Az+pDH+DY91B<`;^9WVi=!a&R-g{F)Y
zAfSD8nr%KQbm6n43L8OFcW7jb&E1lK0p}D^HKS&;aL33jo3Eo10;;#^{WYKJZBB*l
zL@Yp(%vwA1GcN4TY~!O^S;QibP(!rWcJWzriw~Ng9psq*Kkqz+_fv;2V;3LC`w#Rf
zqw@gd8SH#wOnu((Xw~ahv^J)5M8E9~^f3nXlwdFK+FdUDZdpGS{dN2gNPs@~{tmc2
zL@T)brmyk!xx8zyY-^!u)gfHIVsq|UxlR*JA#|$!mvMOoiQdqBh|9+z1zjq+-omo%
z6W|1>>0I93<MLL?Da`}d3iKiV#|p4fYq}ReXjKut+^d#b#xs5$9v|<Gh!#8Wvy@7x
zA7Y@o>v9(;qnxB8*J~Kh*oGX7kW5Vq=kuZuZPkEe-7Kw@Mz}^f9V2ElC@)CEg?__G
zJ3ERO;tH&c5s}l8VjT*g-NFcY18<+Kdkbr`Dys6z37=+xF{IPw+e(aQa$bAIae9f|
z@QHgSvI2yFwv5!zrsVWQp>>Cp??hHmX3xK?fsJS|yJ6B`L?b8ee?v<2xosd&ERaB5
zo$Bk`R7YUgBEDQfBb4V3teb+*qZu|Qoq-o8SeKJh2cetvtOuv!LDE3K+ok5%Hz8D%
z8sOXw{8BO-!SGN+p=cx$9c(CMoW*Ccnq<l9mJVh>h7P9UaQK=QKIc~{%#VhY09$9~
zRPYUCn0Eo40kHK>XCkU46=V-1A28-7YzMTKHM6#kxu?H$<UKc5ES971c^310UB`&-
z&(rV{5}Ccmj8#7xRdBKuI#^}9=r!ifSXHmr-)eE9z_x*vGd}bn<q9rt?qxCpl|Z^(
zZq#)TJyl>Vf)W@X+)C52sMigDH1TlCIsfql8wnfhM!C|og!+Fvdt=!!8dk7k%`Vt1
z2t|Q+BU;zuMd<C_Ik8#ISDT#fZ%QJLhuVQA!8x}exV)e+K!TaQTn_XG>N}9q*%WoL
z1PosX`5)AqMb_K|w8zVEipYe&hll8-yloU}>(zy^DA;e1jC=HZ)Mre{chn0NeSq%V
zh{@GeKU2_t0ecQ9wy#{wtdE6I1&TLJo34L7Z+rA$==yN@jcW(5pTYfSaQ|S}3h#+5
zmdiYzAh)rWHorXQg1?ypYtYE8F0tEQ!02-U!jW^q?Vgwh@BnHd%v;a7+AJuCpsUv_
z3vebZ^yl_E#=3^FCapc{0$ARlFA#ijJEE~UsvXt|x%K!IT!BPqLP}2&sdZ!a5c(po
z%O{(&h`3x%^3>W<fUZP=kZ|ri3e!=md1f3vsT)QNfc7TY4qpApAcPFNjBf!t1U6br
zW130)k-Es41wjbpzPsSvZA1b)Tg%HkJCz*?10)gwWX$nN{E=W`81=ZYcY1kx=P-hv
zb4~&3!Mle8+W<uvx;c%;G&S$&?MpS66_*a)orYt8!mRI**LqZqD@e2r0}!}Sg|$^J
zl}E?a=J>Wq*TB*ON=Gv_H2gxmiJtM9wM-^!^jwOJPDHbb+m$k`)f8VVWT9jXPs+%}
z{Rw9CGtl(h=;$5RYNZpUuepN<ZYalNacI#Sz>2Y<$up6;g_oKQjha!5DI{5ePod5M
z*Pu@e+i1<7E5PwDijB<(EH!|)_&I3ifG>rOiHmAYKoA2+8_$pL3!qvDVJqwlAFl3D
z468zMemH_l#d=Bt5{rzaKjh<ed%e3!CkbHoV!OS6+VpjyT_?)&mHv^_mtfzQVt#YZ
z!7kk~H}U>A2M_DWHwhW?JjM(t)Zk6FT7lV6t>&{u^Dc9|%}X(xlvQxbHkOWGz+;8W
z09%vypE+}8da^$&TWza=_V$Gok08p%Iy?%!z5WA?@<WU=b=*3{rXHmO;4k29M=U@R
zxj9M3J3n<C-7~i@gn_3?J<SH`?HZ&vI7E`M%+FCTI3DwQmtlYPzP_Jd#!O$vJCOqx
zw<xNrqHJ!$31HgZ&c5vpG@cVDk}UegM)cN^b}7K>mF!9go$J@vOQnekB)s_#nB&al
Z%h#_b*~^!E-WSq^XhsVQb2wuQ{{qd0QA+>-

literal 0
HcmV?d00001

diff --git a/client/ui/frontend/src/assets/img/tray-darwin.png b/client/ui/frontend/src/assets/img/tray-darwin.png
new file mode 100644
index 0000000000000000000000000000000000000000..75df803d82744a9b328bb5ff1985bec49932c968
GIT binary patch
literal 196162
zcmV(~K+nI4P)<h;3K|Lk000e1NJLTq00FK500D9c1^@s6tqDHP00009a7bBm000XU
z000XU0RWnu7ytkO0drDELIAGL9O(c600d`2O+f$vv5yP<VFdsH01k9TSaefwW^{L9
za%BKUX=iO=p0So=00RBJNkl<ZcmeGFceG~Nbsq-qbHf*2s+>Ah=ZHolH6jrRfD}nE
z0H7#J)-21WJZr46*Q^=Nn&9!8z&~a!d)XRGvOTlL9@C>Smqs*gk(4P&00@9YjszOr
zK<8Z5T{*n?g&U6dZ-;ZgS6x-_y{hU4DEX3w>iWL>-Fxo2=j`y?zrA<(4?lP?<{42&
zk?J;5FUzPUqB;f|mVw$BY19z)L!gS!8BH2$_`eJO)6XJhMNYk(Xj(V4UbnPV1R7*H
zP5B}dzTULr|HuO6e12BoZ`@0dNyXP{TI!WK4S5g+e=(|~Tq_11QD~{<zXyD7#pjiL
zPQO>scv4f&<I2i{7J7kJ`DPdo@n;2}KW+KCk*`~n#Q#ZSz8;<`lV{^G@OUEsJ+5l`
zJC~nE8B@XE&EbLCn!h1h;6E4n8d<MLSyRb)s<x#;pRdKw*7AJ{jGg~rUM4(0xK!ke
zmVAW)f7bGaTAmBsgQtk5{49$lQG@Su9s!@TYraP>o!X#sX-MtHh|0ME-y6@LQ^w;T
z^mD2L-b_o8=V;7-@EyimHyDRZGhrHfJdq{lhyPsUU+`<9UHnKrK4IEooRRkT`5p7K
zoLQOD{Gg<%oZr&iprDMOWo_KZJPylD=4-v;XKL`QxDkKGfAz~Kb6QV%ELcN)E<YBZ
z7pdXjw)`Q+gLg9K2OkVFe&@QD1|{BaBkK<9uWd4&Bm98JR~A@1L>p7QA^ta?)8}_x
zU|#Xtn9G{rAJK&80&Azw7b^K4qm4%1JKjOR$M1g<X%08Zbxt-WEe6Hs=e$k=k1@&`
zz*@&8@%&{^UK&O030|KK|DE$mP1DF+=X?&vmGd5nJobXeyD@6z{m(DvG~hK<^L=?M
z$ZxT_B5s@O8Vf=9S>$`*OZ<h6QS!Lzil4dE>qnk9oI4ogw6-?o`Q|y`b<ZQC2J4Ui
z&Unr+-g=DjVEjSG#S<xW+G4FVLDn<IgL~j_%q8wM#b)I%^8(l5y*tr;+3y!L9o777
zLGFv|_WE)a8uR+du}ye!#}MT`V;$GEJSpEJlfQAzz;oP)ENJ-M@EV)r{m##WXU05E
zr@Ytr^uYJP@5X$8tU0`ood1paUt6v89y!^2(EIf;|9l?a6aJ04z`Ms}L*C#=kUiK0
z_&f4E@DAnoRP)-%WdCEm;n{Ev%n9Z+M*TOAEU3i7Gc=9vW6Xj)8?H^ZzxjFk{9Kqj
z%r@p3*T5bbjVieZ<V2tM@@S;bC}Il>0L!hBttAI!NQODgNv?rEvNr8|+_fmNXIlAP
z!}E^0!F$q+>G`s@3#?B)SDq)cbs^7Z@-XT%$aIiiPfyl$n-@B!+};n~A<mrgI>5Cf
zpVZj+F-Q1pI&NjoGTDcjJi~<7tmp#$xtxbJlgWL8-6zVL-&ohR*JD|WG2^;E_WTpK
zFZ~XSA%3qxHf+DI!Uhi+qAs>ZHV+mA4@71Sibe-i*A)w^NGlV6Q2vZ(avBQxEf!<W
zHzZzQp~5v=S&&$%_`e)NFsQ(TfUV`Tf=X5@ve3vj85Ef<7(65tYmZ;blo#OQT#qKx
zMrIa@VZ;ws^S%2SgcC0yzVMJIuFp~f0xIX<6%<w3kuLH*!%{wL`2tz5B*?aL&3||-
zS%|W#mUw<Pc#~ty6jTX9+4Iij&DT%`g)6E>7eWqW0Dt81`5Ey7`zm~^$U+<&j^}d3
z^E%?+w&j4TjVUb+da{`DlB>3nmp9?>E17)0D&HT<0Rph$YYh1N`F<t~q2kZicuvNA
zzjc0xyI@%GVvzU2&o*L(3^|2sKsC4gecfV#wPH}@{8=@H;BWLfYrgkX6$ds7p0&VY
zBoz?&Gve=IC_s?K3ag&a>1Xl`*uZC5>#+?X&oRJz>&cC%nd<xMK}Z++S;ZeT5Zt5+
zbTF6E+%OlT1q!0#$;3j(c=@I@KP*I{)eVHUZUStE5w9Pt8LWZ1#Y_a_wBq+-0y035
z7pm-`%<$|zQ+}cV`M;}5H+oCDVS@>%=?H?kko7y-;8~3NH`Zy+?{~beV-w{ORA|U%
z6$25%lf(d=HoAu(x<u#}Dl}qiLWE!(1ersu%Yr9Zjf7T(1?k_Si1^%+AD|I~#*{Fx
z-zgM7_5lma;09W&%0&cHrgH<~fceEcS=d$3It!$>B2f&Yqyr3xoP`N1XKaj!_pkR7
zL(TrkGeUu3?xMaE2(PMEAvrf!i14X+5#n7z3E}=O(DB?@C%87|1iv4%A=2w*@_Z1o
z_`SSCQspIc6-g8v6!DnHSBfwtSr<VRmKq2o%8f*pVeTOBu!b>~GFN3PioV7BkKHrn
zq{>y4g0AJB?S}wE0ZNJI3hyV1F{Vm9nzEDeL+Fq3+^q`gsP9Qc5S)dYOo8fnOrolg
zH)SG9nV$j11r%oiqskOU&)zYv=IaW>#XE$2BDsgkCd^YCb#82_$+#PvFEM_g_@gRk
zJTKM(6mH3e6AZN0o=uHry{;=p+**taGe)8-V;EUHW?V~tXYW&9VQcTll#>`~{9Ek9
z!ro_NdnW&tJLi9=Vas>IZv(OqzlAV_G73B!8A}}8B<IaCWXl{s?n8rPhUDcJA_O5k
zp-dp0vB_Fq1Z7k~0D&}MX;r~m4Z0Cwg+;eEqHeCh3I@Ww&kJISg;h=ZpnZOG@Mds+
z4YdHl&0BQ=N(m-4EMq<wW2m4^Sm>23kfDh1EE6aRC?cMWk!{+7@71se1L42O=T3Rn
zDluaq94fVP_%m!)sHh<;uM2!dOkl&3r-EYSXREP@VkTn~#hB%yte_k-v0zxK@S=qg
zP(`&Y`usf<Dr~zRUqjxr>?^h|;bp=TD@Zmkyotb?XTa7kgnC)(CK2mal%rYBq{3yM
zueZeao8xi9DB^uYV}4J&uyL?RaX-HP8Wt4{l2$j`knaJ7mh<yQes@^s5CnsP3fwY}
zB8>1HP&`n;*o^S9T+qNWg*O*kT|<#QE_jMq|7&d6zyrz~^=P0NL!sWz7&b>EhOY>!
z7}Qb}!H0Db;nk`4lbKa18vySg3w=g#j`>By3&8h15llgp2tJ1y1c8KiIvDa?7dn?c
zJhRM`db05N8?#h#FIa*3jAbp)%NK$&#-=O>w#k7?)Fi?X3RRR;h$fbzD0IjZyh8}P
zCQ|amu*Z7lQ9|0lO2-O;uoBBYQ}1X9C0^?ODRX@XbrSMwmEv7M$QOkQ0u}Ho+zL}d
zxO&mkXTq9>Q353gBOl8a_o${SJaPXi<}cIp;dO~%G=T<7nL_toT<D265_PP&7v@C_
z)hw7*t#c2<3D1r3i9KQ#yUc-j!BGq~5%hRJm3nxhbj?H10hlL}>o|gWiI_vIIWa6s
z6{NTqlqu$u%)6WLGm61!`wL^l=g|agp6m0-*mG5yB1kd!xxRNOB^iZzFvCHn3b5@I
z`(Rk8fosp&w7NVnm%*M!42+;-G22?66+%Cn;&c>1_MRy>TxVA4K@JM~V9z0QlbbW(
zo^+<qtKM8l-W{1?kY)OB7(!9T+=|Dnb4BJ|`x*<TY(rAcu0TW9jl*A=7z&M@FGhu)
z3#HfCI>x->zwv&=`+}#|h?WJ4lF6oP#l;q2O|%%G2UxcdB!I>OpWK5GW046_0Ktk)
zJ<N3^bGRyd3~MZC=2_S_qTcb)l?b-l+)-TI7kOhI2R1LBX~NLKMytvUdT$-x7w^Jc
z%o0FS3b6nx3_%~}V81W$4B!DM)!crY1>d|17m(@_TORs1=Bgo8+9Ck$#WjZCj98J4
z+4@|VPFbh{HiLyfm4!11>Q%MoU9{pWbQ>9CXiPYiO|&_VBDmU^nJcaSxXf*#UKHjO
z%DT_b*aI}fmd*eh4we$%6EJL<sj;wD1Ab~nK~x5pKxtwQcJ(pVT*d+q4%cY0fmt&F
zhQhsjBDmOE<LAxcePO<$LXz+d1vasbktqtna9b3}u2-mEIajJ-0a$s;=k5li3q`>9
zT!ixCcQdLK>ck|M{am2Q2F8&(wBoVmf{l;~Gldr_7!^?K1(sGJhD2Mbr8lagD3;-z
zdiWT}%0+l$9ZU$}(Jx8XUM5x_ZoqTT*TMRR62dE(8)Whx0jt4t%>3QOAf69kOoisu
z^2XYMV#FSR^}VuOQ*RhV;i<=<^M!XT=fl(BIj;p0C3$~hfZ%x`z;I8#kHEjJA{U}4
zhUOLU;t_$Fn@4YgGgli@6ogyHSc6bLycO9)QcE3zL*}(m2@gS3lrE4-;6|(ocnvxK
z_duQ{7XuCgABv>cH>=!)x%kGpJ*!#h(IBW`f=iSDj7DA@syuU34!YNZ3H8ZDm2O_B
zTu|?V)IbWIU@pWk>O2}KXi=21Mg&sPHDn49;}eLFR2h%imBiY`JWgvh+(a>CdjG%|
z#Mp<dU;x86_B^ftvfPaCpq{F}J6@+S{`tCqjLX72uv*s$_K?h5rrr`{EM%7}4h>bP
zSEK)}e~YKs27^x3Qw%28^59A<BnVMt3mM#O2B0bwedi*Mr*@6Zm5aiLu6VG{WgS!`
z#+kfFSXr%r*NPZTWAg0A_Fl`rdi<_vU<_eSRk@SQfrDH)Tq&#aa%03HLEQ^jGXqnS
z_#69vig#WDPKfYSbdcDowFy0J09;j!EB>-+)SAGe86mEesc;uT&x^4q9+AedAUsF>
z@DOYAP*84sLdEB<8HAYG!fhoG0+FWHGA0L>Iu=!f_zpaZwpBsNi+IA<y=4!_fOui;
zStvw!Lh$&cWND4hOq2;5U;O^P|5ur&Q|~X~B*C_Mam=e*OKo4`Q_GCKo?c_`lLI!0
zdGrB$;bmeI@Jf~EEpokjRBLep#bhR7WiO}5)N+UN!?T@>YC-Mhf3IdeeigNBx|08%
zS}X(44~0-f^@yQhe5_+03l{nuOKefb0(X$ay8uVdi%{fiR|@?`mgdt|VKQnI!p%t`
zVR%~*Sd&^!uOf3RK&KDqth0eJ;gtgq92OYXcEPR_U`xcG6wFd>2c;c&qIU6Mp=_|R
zFkgLshdeo~bX)QCnyA)efR`WD2q|-gT4kg2^%0YSqQztaB8Fqp0Q$q;g5^6PvCc5x
zQyYJug)mQ|Vf!Q_%S-`4zyTr?%eiOxd+zU!WPL``wO&nHS&MT#ZgFT3=NW4}Vrh3l
zE2|P<kr=4MM47}PNl*(cNZgOqVUd^@lp<omFlvD9PsSQ^f+B`OUR$Zv^EUy7xr5Tl
zS<ymZ!t*Hmie9Ky&-cz0#+Ep2tKVTQK(Hfr><VRLL#=a(kzm{dTr23>!F$PC4I2Pi
z0Fn|_Xanlg_=(90^ID?CdIa(zM-p0@CkT173~eu(r_lJmjB;JM2V%)4I6eO1N<&~x
zBJsT1+V*>`3LT4JYVjHT4v-cEJmwnj4etVL8`o_tHY72YT<;k(g{vk061y;kMF)89
zd2S>o2xvT)aX>+-+UdM3{0pc|F7GUtaflMh4Ek-_<jINgk&}6WYS6n9!THhR<FZY$
zo=TN);}HysC<aP2=r)S-R!>#nI9q=hyTg~ZB@K?&e~ZTs8D{V}JUcw2C_(%N@imU)
z_DB^iKEpaitjj%cd82p+o*y6_kX3@#<!->}b&~hhTKIwV`J2Wai(n|6?h(Xt#gK^(
zIrI4+xoz%u>ZlJ_%8OSlSe$^U@QNra{BNr_sKp|WvYGG_qrhPxX$09wIx-ayx%rE^
z1a5Tzjk$=W1wAJQvX)t<0Z1q!enJt1e8YZWo?Fw1Vmz>`Pq*&v)9!_mhFFAxlV>6*
zGkaRKh-Uu8O*)HcMroOSXqwLixw~aSgR{9=E!d>6s^)qc8-PbqiN}^DygC=MhTcOI
zF}xVJrud<zW&pGX^@U75To4j)uk~71sE}V^bx!~xf}GI^>Luq(d<#YcpgZyG6oM%Q
zdW_<o3hV?3*I+dWgf$k>1A%fh+6s6R3kWbSHZ-8iNu&OwSaq<dgI*I$Lt-fq9)$@5
zJTiNQP*fmth$YX@+!xO*$k?zhMzV2P(KHIz6nx)_#IsuQ3i4d>@Ya-f!IBPM3Fc~2
znMVtcU7Zjkbp(SFv3V^HC4oAf^OC(Y;QPtSO;)CEfYwnRgK%4mIlzd(yM~e?gF__d
z0cFu6!T4RcU_9;2!jfl4oVZc!axzsITjDsOi-kn9mZJ?q1R4ZQtzH8l5(psdLo(=7
ztldI|6!sC6T?(q3876|VAhC#D8B?pmpy*{H^hKbxGy@0e@CO2$sBnc))a5TLAwgxW
zDRWU+xn3`b@C^zj*%-u{R?AHxuAah#>ZPe%aB_gdRPb~KawUhHV!Bocoe>JfFS5lv
z+T3Cx(V*Z~VnnKZO7Uz$QcieweCMQqs#fxZ@F4Qcphn&AF`*{<4>exZbIXiaA@DiY
z)Qmv)v3i_R<v?q3(r%3YJUTxi#kWj{r|+Y^6I>5oO*B|j3?G}*(v&CG6y$OYdJ!>5
zY>w0;_C1g#Sh@3#W4f<DLnHCHJb8ucfvZxKIHt)(g?VG=l{$>;3OGG$uvodiqpVQ0
z#lLgJORsC!1_WQ3L2K*1K>P?+EMV#q?jmDCO<G*KING4WdkN6<g;u7G1_b$>ITolB
z{6l?h4jju)6V_h^(n8&+LKApQEoun!TwcFUK7^xN3>jE5JlX4{)^@`d-&)m*2Qy?`
zXE$s3TMrDA;t2YN>`#_9N|Gfy2fD43n;LCp*n~y%B#itK^+P+=KMAhKMA&0-&l!aA
z(z&S!ZhTi}xd?VB0+1X8?t*33XuJ(EroI{$LKuNnjf=pVEn(5)T!T=Dz_qH9<8pld
zB#Nh-=emGK?Abv{fx+335l-wy2YDThdQYu+v3#wO#Vjfo5G{gOnKDTM3BXc{rNtD>
zOq7KXF|t|VV?rf#3bfaEB9B>2SQ9ueW=bf4#m-~w_jLi{T^9UZR!4y?@s5Qsk&8*J
z?5s-HoM74FO1B!5fq)c)NFhBaW_V>7mjwHxdN?)MjJzXcqr;)&AQ}|EJB@%Ku+|`C
zS`U1;s)Qkwv$_>82=6i45~yWUX9B4QwhC64D~2O;fm*RQ0H3!8iQqXgwx-qbx3<P&
zP(!7*n2oPdRmwrWgV9#>qQJ<oP(@jl>bpv8w^4%v%+_eucqxHyh4_LQTv*<SnTeHM
znGnSu6T#Rf#UKih=WfVwq_8zja6;ir9LtCz@*Zr5wIbwmxlUy<9f9p&2(jl4<ytr9
zeMMDdD)YrMNbnVe5n{c#^mL-{KDSs$ZLvKU;zB0CT8(Nw6{hThK9&i0Ww(`P={r=0
z_?obZb2Xj|d$z36d(*6^XnQ})I<ey3c2Y#9=rONis8#MkhXlC^Tw6F<2!dPLhO)QK
zc=9-(JY#D_66)epF#Hm8A~>|FUODz%bZ@?nN%2VRt1<EismB;>egrP|^=H@BxTPBl
z)P+(^HfFhbKQc%)HZproC`&;8SnKe<a)Ab0c_Gfylsm_0idrvP8|kGeGK0{gtua+l
zWQsAiCcDKoRT(Ts9UOx;=tu#T^^Cb8&|{|VEQ07$ab*Dos%77Y)h8^ZT3#|X$6Y`B
zNxJW&pEOTU-*#g=GtWBV-x@X8AXhm~KL0em`0X#!*(bhBElZkO6sS%XtgynMyFI&d
zx^4eJVp)MYH`mr$`nSU%{*MF+MvX0`JDbI)zw88wS{F0lnDt`oNB$dA4gr6NAxp#~
zURxds)jKmKq)e_t=0lZ7E4Y#>7?2ivG<WD`I{5I1X#ZUgP;X(6%=>8NJY9VL2|Dwm
zuh6MikFk(%X*UalRlp9hF$fPZhDwo!)cb(<B5@PERJ>rLOp5~&k!HY(Qt<fJJQ5Yg
zt$5R|z<sdNR~erv4Bo()g=ms>1PlnDX|l}JlO1O2;eg<R4G9`MEM35oP`V>_A&15q
zTmaK9H!n_LPF7~4N@7G==om>7NDm=Vcx7Yqrhwpvz=kIlrwT<^QxZlReh1G=Vl}en
z0CR(SU8wbl`<d`^xFRzt55p}l)x#-rN`wiFxfa%0Bb!oUYdlZzG(a6!rLCJ!Vi7#q
z({U|y_STdWwh1gt+)b?9))=9NJh(BEnZUp^inR=gq}0VN)O+*DVC>{QQzRyB5KC!H
zDHOK3<$akotBOPCL-&;`agF8VCIEFl#i}kF6|9*mwz5Y;q?j6exKfI%LR`7U$D%^W
zBQtt}2m2!#WTi3P(kSe6^Mweix{XO#3d_%8fRGyk9R`iVlj=Q#bQNKNM*+pr8qr5c
zJ6NkmD2Qg+7v^aNlUES#SS#31;tiVua3zq0lL@gD|A{VBY^}Q7x8D@T>}-q`Cr0K*
zqmW~%a!UyrUCMwn^KkSmjiEB`fJ0=;vNI3Qh$cOxmrOcpzFJ;}kp(pr@XU~xl;T(x
zQwvJ@4{3FfLCU)J?bV5wD3Es@4IxrFK&A`ab8?m@j30PuZg5c&ozXlsO=VDJr1zA0
zw09+5eXHLK3~q>t>;?0Rajjxvm?o^=RRr8Zw0EGwsTS9gE#{y~Z9`mRRV)yOGS7Um
zcl_r6k`@o#MDEzQ%b8r>IICt%+1UT=z5RYU=d~w(ATb&dU|_Z(7Dmc=+r7}E!>lC0
zu5+aZ3)nOe89|$T0MQ*L(gm$-pqVf1-q8l;aEUr&CYa3{lgZI5>Cb~HXHxI$5JQ(B
z51hR?VWm~e#^_tLw6z!#o(DE61j@p}o9Uj9|2i$+dM}-R`Z0R;Tc4xV(<?Mw;8@Yz
z9y)OJPI~xX|M%$lQ$L_nU-?5?J$IfJlP<E{Vq?Id0bPMHsaAd~P%B0@5${-y5usK$
zN(jg~rqu`rKTn5#_Lu13L+__zZc!dy>8vri`B~_wy7J%CF|EAv44r=L&uHa^Cq-yr
z9n_6_0$5c|RAmTy;<QHojjj*Ly;8YNYa6Y^V+6*rg&Qm$lN&tg@CV*=;ZU!^d}?P!
zWk|Lmy`J&36|7xIAE3Fn8g~Nh2^d@G;UJD!d}&&%)gH|I5J*kp7%ClQL**(&11S{b
z<HNf~KB2_7nwa7k*{;1bzqF5q=1^R>Fj=N%?KG9ssS0k9^yYooo^X1#h%13YTQN$6
z@zv8DKxN@7%!KrSdR=K~nFa8Xt{^!=1trFy$M0Mi;Ms+~+_vP*xM*xNVI$VI-=UO{
ze`Dj-7?XOBKn$8z1yVCnCZGq{@nS?dKoLz^5u~{xEfVKo7a?CdM0GZo;^(r*@J{Mh
z1@>f}rst38e&Iipk*1djv&<NiFko}b2PF&k3+gT2NGotU)}!V%sWz1S!y*ccRUFS+
zbK8b}b+_>z4KdRgC)lxuqsqI&TogU=+#<VKFp4sDI8D*1%$YW-Ad%-J9xT!-N~O6&
zStGYmSe@oE1`DU?JF-P#LNm|I10sWab4oCJZpM`4`h`ZwNdl)es^oNT^;{?tC#4BP
zH8)5-1cNMNif@T5MEVc^smEivH;k6t!Y}<nmjZ$3Z>eM1N(iWRk6NE0&d6F_g9^>c
zel~&&-d%0z2MocwRtrUxU{B$2g)1}j$SstBvBJWH_N+uv07}WzLIp_EHcB6tq)9QD
zbrWH&NsNSF9F$fh^L)$-!E>ygJI#}@A;b%uu&`%8_2(CDvFoBA@V|Tfr*577qO@x<
z&U3YhcF*UufINldHBs`Qg0oeGmL8J^N<LY1P3r$P?}=AKZ|@-*9KMIjrTvMm1rvGW
zr61Dh)QcuG)Z&svOS`CBHTVvm%>KEOR@bMpaf-~{>!1nUZ8V`swCkp$bnAP6LDB`D
z`}Uu*Alglb?td5E{FXVf*6Q^&nX{8$`V8Ir@FO(;@xMloedZt0aCupj6gELGZzWGk
z=&(&IUYt;iu~5MttknY&c4$<k06`6JVbCAYkq>-=ZvXgi(r9&sHdZdGAOT#{wk8hM
zi)&0#7ZO+>(7w04hl&M$Pa6|jJ^q|*2nY#f>zOhM>QQY}jl6Rt`C2NiGQV<Vyyck+
z+`*m$bnw6}lnod7TDe%6Dh!=6twL<Na)yQFDzBeg7&cv}X2gpA(Cr%glyh6TX0<V<
z>4oDoI{BI?9telVyfzW?<1W5|U~}C#?rxmWNJjinNV~0q?vFx+2}mdxR@6&Ce0Q+#
z2rb<CZd$nYe#+<fQa<44$V(YdtjE-DT%^hA7ii=7(=<NuG>>mpEyqH0on(ywL9lh}
za4Y7lF)u|4zUrw9tv_gdNn;8o95NN~stnm^*n1O|2kxLSSOm+0re|KF(b?nd!Hi{|
zlpe0{MRL;sRf|CDpiS|(+f12<g~qRQgN`IOO|^%vZ~Q3NI1b=K8IsVhOX}TpKMn8x
z5Ec85^83n+s&4TLd*)n&y;PrliPj(e6RIyBGppW+OeP$IvG8yR+nJIL+QD9Kv_?(g
z=o?Dm^l`*4OSY;85C1Avt7oZs<vYAzrYWW+v6uOMJnjdn9j~zQagKUN-$mv8E}A_1
z=QKV0iW*!LY#uwxJe~{QKjsxiNbksf)LXiZs#hPSY~!pb#QebBRP4Ql*GXRufz}iO
zZ|>&wlSC^g%nNsq#MVKp$}8Gq3UUDNslSKfZSSV+wZ|!}o%E<pl958>$rUwGqdr<e
z1nN96T(?}H@^&_6_ufYI!q=%j^<;7`6h%`ASV9HPEX_qoQ~&lycpST^dgXf*s%7;O
z#Rx9>dGDe8;C(Efd(^C)lxJ*KPn+TlWI|jOC|kAJ;(jU)y@kR8%VaiWniG#x94{*(
zaNsV=_uK{<3yi!FK_`BU;T1h27a&Ph*kcexxhVrncuN?q!#Oj5Fe&5JW%}yx{in2X
z@oZw0-2dTUqPyS!F&5ZMn>-x|%6_JKRlex*Lb2*aj%yuQEJT2$v>3fh2N5Rau5K_k
zZ$4n_jyJ9f5`KZKKpS3&Z9Qe{t55T{KTNwH`2-CP9Ho4?M8?^q$+_2P`KfPd>??~Y
z%oR2}YvyX}i(F*5W%ry`>S&CN0jnUlBvJf(;qYyA^E*DwN^&n<IQBdpyz4D==$^OJ
z{DC9XpPQHYpRO&_@~Pu=^2dKcCm#JO-SV!F(LEpeB)$0M|ADgA3uYMxu{@E-ix{9M
zWr|BrYEen%yHLs10tGc3&(`D3cgqKVjjif2J^6?KFIqmoEKp3pP&fhOEG40e(&p6c
z^*-J5zE9Au+a93dZ4c7fm!DBc(y()EE``}tph0Ps!g^GL56snk)QFdu@elfoCC|eF
z8XUQk#v2^bTs|WLRpK@V+f<Da8;IooyWjF*nmc$Ko&DbDXtH{dV)3e4qolC51kzc-
zE*^c0#Mfy34Btx$F}7S(Ne~HJGb_}KmG~<>)?AZ=B^DqSd^CtnpG$;aql~M3VK?o5
z@FTSMtskUv|LxS@eTdgokDM+Q3`Rk$v01-J3+Ip1`YS)8bB}(JrYE0eB`}e3DdWl%
zbgs$RQJpZQb4R6nlT@Dwf<ic?sEM(ecnQG}g0|d6^Y?s!79aQ^#oioy$`er@^RcGE
z@h52Y@h?)ld`u=Id6Y)%Q8<!Jh*+|!ZMTG?n1Tql8QNqg2BX|Z@zNab>Fv9XhWGzG
z75nd`mW>VUNg3yOji$#R<+)jrlms#OSSIxE`xu4cZd(50f68;TEb<_l5*H8BghotW
zs`C@|J!0%I?m`v~VX;_CuJ0aaDu1k?{=5Drd&3*Fw)`5!^Dp6Pj9tmz#qIBA#r7$h
zzWPH7ER2gix3VDJ$AkPfIlbQnLg)m7dQVanXO7ByKS=$z{whBYd*NSQXGm$44W|tn
zKndRQ0XEilCFP{Ksewk{_%CRB@ildl+<OTfD-Z&pHe*G02R}#Hbu0DW^{?|L`!A?s
z#nrT}k>S*%1G}${jv%?XHm`^@FH00J443%>l<m70@RxZwO0KKwF8-+KlX_d_;$AB5
z`veuYe}HeaNO2X4X+_Z~DCIlfPrbMNDrIx~)V1XR_Vk6X()h{GQ+44rymZQVZ^!Af
z7)kk|2Wb9Xf1N#*qiWPOyiZO)LF-@n2kZp!^={$0yYr(U?OCM^BFnfZAxISB&YI9L
zW=Cy-D<}pe-$H1D@?K^!DWGU89shpr8(*Mf-}@@9T{tTXsRwo-zqmyf)VDtT9)(Fv
z8RS-3Lg7heU4d$jxEk`o=K6{UM6(!zFJM=GqFq|U4ETEUOSJ3ZkJ9{I?_v+KuT};N
zi+b%mEkE%!T7UTo+1R~<cZl%xqnV88;<NvZY8Irf7{jbWv@s-C&K?}`!Np-o7dL8I
zSfzO*nuyy7B)9*bhiT#HeRT3i-=muzdW3Fy<Rjwo{P^?#gvJ7q1e!a12i^67zd{fE
zmA^`_es>Q&_qET_+dlcX=)&<A=^`uBDZ@@#p`KS0JrOjDXC(kq6O%9|XW#`e50N&Y
z$;@-?9l!k5e@^F~_zRly_%}Glw8Ucvby|oHQHeQqrU7fbmks`GZvQQ`i{Z_|u6-g<
z!05!Bj9{5ZBLK9TE7pKK(`f7r#1IJJs?xFbhe}gly6Il_09I-K(5<xlj<--boU<fE
zGTcAX#;I56;?v)wa?cUk|F(~@7yJ@KXahR>ssEL{bB_-J`hjIUy>Nmd&1Y%pu7~J6
zD~Vj_?3U|7R_=(5*+=Rrh8eqEEnl*v`zQ)nH>@f&B<T*>Lp=Dgf0I3}cTt}`n|l2M
ztv>TjYR|vSy7COK*|AEm!IF3xbGN>Q`ta%x+|Ekw4qATf3p9G>s}xy~JF{?NkP}Md
zXhj0eu@lH@0@zSf48SH^+*KsnvQ|FOswactJk7oPH`qIP8?B#ynbuzXA~hQ<M9LwL
z;eJ-=Z>OA<!|J#Hfa;Y~N_LREDK$Do7=raW)e>W&R3@rJf>TMih_cp+q7fYgn6xBc
zN&*Y-5kOzQ`xaJOcc{|Zb(n?Jydo9lJXKkr)_?q2A<nF>RJ3dVJS*A_nt$KFMWekp
zvoKo|=t$`A$ukQH>XfjCZTr>?I#ImQl4kK)p~~GErCx<WnAE#(R%GX{pJ5~CB#qbC
zmH9Zgm&#k-NhNy;_4!v=)=p^h<mXt93|KIqFc>`~;;|UsAsA5wWUL+y-}dV?c*`%b
z(%QueisRQD0+={E^u!Nn!k$OK^&ql}0rl_y1@<J47%S90XG$?O^^iLFS6Q$c3!7u;
zzub2_O?htNCF?Wh>e-qBntQxaV<BpgwF&`dnc|hrWQ{$_uTXXJDT)_gF_MgWwH`~Q
z*j3zscQp9Gzf0lB!<6w_4<#EVy?I>&n47^aDsFo}WebO?e(npr-p^BU_s1!}<-L@h
zd6}}&2KDa!Fck;yrTE0>d2UZpdGy_s-~3Lhp8qqdPW+g^|2P%*{ygQ+@LE3pefH?S
zPjT%m6%s@Y#_kLLXhAG*dDcebC1mt#x3aL{ds%MzI+S8RCeG=?iDUHq*FQ%!FW8>d
zvcmN*y!;fMe(pzf;LiJLu&^sxEK(N6vd{&Jus91WP%mdhGairXyzZvDenX0<HBBYf
z&C>3}G<VZo$#))~IYy&1$E6lxx$6*Jc<S5Ykqr;t$^xt6?~c*M$G@!7%aoEsla~%b
zpH;_z??49!)x0$!Db`KYxWybpk@Fne8nZ`L4obTD?LR}K<qPzqKlz7r@r5Vo*7to}
zl;o42`^T)rPSRUH`M2rFJ3d6me(-f#K6{cC#yxZ%v8Cxb4Z7N9?O9wyEL`yrlq{gI
zyXDeY?54GM2gcoGw64wp3x@qS-9o$f?W2{~USvT(mUj*aO>ksbs=1cpp=!j}W^ajO
zWvEgj`^yLpAyegmX+uSlX_E=@0*SwFmm*~VYYj?+5i9EL+E1%5y+V86^GkH-5#G4N
z#Z7Ztv!`<UyPso$`vC2I=mV55?xxX`C#cwcg!aAT=fxliDf5yy?Ais6k({8D-}!fF
z&;4(gO@|ymskau?6O|=hx2Y77#Bnl>akQ<%qM@*T5LH=u3`LkuEM)e-_fxd%p^vhs
zGe_&sew+V%i#CouMeW)N8l6AS%CXkkfUHO|7S@BqchUSUZ=uC|-$zS#zmp37{32VJ
z8_#@0;0uSoBo<OoqMZjz5kL-;kQ9iFB9C%iO-Deowbna)Kh53oPFg$hJe~W_AJO#m
zOZ*PR{h;Q|vlLhnEZqGb8r<<NT7C4NtJh}xP3{%dyN2MCF;rFql<eKw;>Y~euBd{0
zVV#%i@Rl6xg~H=&80snS`>;Tf5=vo9Iy?JvDjS5WRFg4V*U!-cUIM>cVN(WY-o;dQ
z$>A<fb!pA>$xS&Wm`##k%`Ayp!b?0NgB|_ov-eXy^;s5(8(OX5(7migZk4gi%Ede}
zA`@9KNA_0L3y&#3%*P|1Kc0O!<ZIkdG`hfw;L9|8@4unOmBVajo}=dEGbuN%xcMPM
zurHqZ5i8IWmbXSmE<uT}V9aZ+_CXeN#JX%vk-1`rcQ<_N&lA1+O$rxY6#`v2{5Dn|
zdnulJ6v=;7-t;h561C#(@SYo;qx!WUP-JBa$R0|zUU^lQl|5I22Qx)`#1KUN)}!yE
z_5>@G&=+sW$wva4vNFTMs!u%1Ue=#eV5l@(x{1QA>}@U_5CgQ>&#>uj@1yb*!{{6e
zD0vOH8y9H&_#aVy?qz=9b)KJhP=5Gfs*inN*YU;YS#iPgFhPf-w3i{NM6J4F0h@(i
z*Bn02HL=)(JWv4R*uGA%Kk>ysrc=*7&fZ&1a|;U$aa6o9YFV(ae*dd<<lcwr$OG@-
z3D5#<3JSGS-boVEK*5)KU_?uUe3LsK{2wu<Md^TsqloQzotA(6RbJF39s1yJa6IHT
zIe(2~4GmA`{tx^*TM3JF{;@C9neTs|Zu;53A=c@+zxXUQyrFW3ENwo*OrWtNc+8A}
zk3p$P))3mhP-R2$94+p@S*+c2FFj57eBkF9d!NwrU;bzG^q2mSjvT&;9{$w-Tol)1
zfAA0J+0Xwz4cYp-|6`w|+u8ei@jG9jn;&`~74s~(SI)Asv3G^oR8WO2grXQN24E0f
zh6)#2a}f0Nsd(xTQU%A_Zlm6yPy6nAgzo&AzrtSrZaVY$*XY%6eTIe1NTFI%i(cyX
zQMb{>0xvc2-prKW5qQFAzJU9XtcU`~Ql~IztW@dQ%Id=X>(Q774FAn4EfG2lC9OR5
zO&Xtkf%ZP|epW>9W(EHkoqPUA68Aju#s7we9ADbaUbXxdNw`ZKm%yJeVWl#VYYiFN
zMBHSwwr)fRWk{8oTJe-SxkZhTXz>OY1S;^HRc1Lqtaw^@=Il9L{O&(v%kW8lhC69+
z%R@AG-vJ)a9LK*ZK4*pFO2=sZ>95n|W!}7JUZCCY_=FHS7}Hec1YrvnU^BCMf_YNN
z$r%({J*3i{u(^di)v44RB;BJ@XY{TQ@O-Y)##3LR_T2N57_TrBpTBW}HlF@6dp$QX
zRP_#8fAY(`CN@$ztIU{oQeb$dwp{D$+t`W{1FCeO&H&XCUETIjqf((qc$I)fGmigF
zUi_|D=`zo3-8aYof(7TC7(a7MtXx?!EZqHJiDA;@q96s)6sDHIQfptlgT_2%$sy2Z
zQ0P!)fxur@N=V*pRD~@0eh{jKLSQX>o`^ZouDhw^_;P3~8r=B-3jGE4_|{dX@VhE*
zdoK@iFV!4BrH$qEeu8;(UZzUwX!8CUJ^dx>w<}bwToA=2?=;i;oLQlAMLadWPw&nT
z^8I$v^y$x1%gRQ8qn485XiZU&trZ-tl}Rh5LbbjR`OU&1TKpOISpV!aqf4jw_cbeK
zmL2?zlNI)&7z*q?^eHy_h78lPB4Muxp5LT5WUuH;tkm8{#jWq*m=cF2)=x|Nhukm5
zq_A8zW?4hiAO5#gz4$dzU<G?#l5)^0B8K%<KmR3(Php<L(98?b11OBww*39^Z&O@n
z@Bb_-r2de{x1ZXJFH=1CoK*6uUj7!ZA%=`OPByhQDl$ll;sV1bt)eVOsnm~C*sZ5#
zlvsPn8Nz@jQG>W3b08Q$F+uL~{Ol{w(Tm^ug1Fw8=R^0uLj=j`XMVu(u5)zqnIF^3
zkA9uz_aCA?M~>=RH)~0V0fh=)u;U<phP{j~Jz|3Jy3LXlm{t4^3_Gm+_{&oDWB()U
zwwFEHIPn4vSc%Nv{x+$@ShKP^|D&%897XknE<E-nuNY%lVcq5B1=1|0Ju@ECyabOG
zM8ixo+tEYzE(<J><#V*>_6KSG>}&M$cRtI3%$gFjlaz`)VqyODXa8HOSI^LN#AAB;
zhjbgq#+DX`Ec`6y67=0<jwz7EDheeeXriZ8h&HH8veVhDpKh$tf&1P;_kHqzLHi$k
zAH#GH%KaCP+(GAGWIXx!bJPz~{g90kQtz(ua!Kl$ObtKBt-W5EQplsY?ma$#&||2t
z@;tp(60AMxyy$D}qP;|5%j;ur`N9)lr?uyQNJ|VM?!NyKS@b=QiS2oitu+p$Hw^in
zee}!JWB6_H&WC5#U+l_!K_K4sZdzmISua1!!!oKok$AzG2|W=`8bGn?50rw|uCTNa
zeJg9~^w<7?1}{BH8!vr_y}}XgfA^<p>Av^ySXcos9^myh5UB!qY<&6^8Xte0))-1$
zXT?z?IL+SJ=-3k)s5kO~(4}n+v`t6^1|cuBQ46S&RgbrvCy)DxSH@qK`){KWysVAW
znz9nf%9z=?7tc_2<|Uec@MkzSv7Z`-gFHXW6Ldjlh(Tj{NgG9_^!Kb9xhVQxX1PKl
z)smnUc4P4Q<Y!}}Vf@nfsek9Y*{P^H1qbN*@V&Ha?;QsD@meTZh#$CvVY$yUjC4-l
zlRal{3_xeWNt_AsDqn++irC+oTAN~6X_+Z60cS;dP1x5QXDg1rllu33m}vDF@6kS6
z{SUC9eO0k1kp+OeOId?3IyBWH8m*gB#6U_sp;8IM3GIttrZM8Yd+(H!JdrvTB{oG?
z^1X|j-!6i?di6)Fv`5`F&1)5+ogo@v3D)irgV9@b(n$;n_7VXN!$7Ew=#;a8C<X#{
zG{^R_KAYuNSyBF}K-&EWe}$i!<HBd3=W+1``THR3Lfr>ZeTuFgB3UjLp77D%=k-|8
z@RoPW=kCo4DQf*ZE6;DK;m;6aehY_(4nD+?`U})@+zQ4^&5Ef#_FYN4%2@Gn5T3{O
zn&=#?^`;&PGdEj0k{lL6L9|>@w4}+*l1rP!<9AB97L!%@Nv!5ZvFvEH&{;YD+&8~K
z>*r31uqp;ay6xQ`rQJ6jrSD!m#W5Y$<dY3L_UJe1z#aF~?nAeT62#<8E#TP?76in^
zqq=sM@PSLTm5X~-7EV#O_pTP$c!idK^c8Vgb5Ote8Vg4s<c%<tbK!~2oq2`M{^0Yx
zDA*cgfk-pfTeLV=7YWfZB=TaqBUyC=9j4H`jTI%izN{pXM4dNNVO6f2n9}6J8A)8#
zJVwovm`;_kHes*tnScI!vOs`ApZFoiw>H+r%fdXlmsOB%Vqq2%rN4!J$^SJ3vk);Z
zsdx^|dPJ}N;45_VBOjx?KJi-#X26ez2XCQ6Z~F+nc=8nW;<5^gu@)cpN+bgL8I4v1
z7->l+sRtK~Kmd;!)>5X_-@HXkp;6eT(m5?Mtx_OliL8Tr@jp{uC#&pTfiSal?|a$9
zS&;9cSQn1m&YsMemY@4RjhB~Go{}3ZLTWI!9-yzB@&A00V{+vSLX?5{mkL9zAq}L8
zp|+ZDQqjRYtvq*NLC*`Bmdu)-et|vr=corl&Lh7;`#<(?Fzk7dQH={!oqdHZ?lpnO
za#jv=x4)G)_5D=ry_GI}?H>xPh)tTx=olQWaR{qSVL}K{5{w!po@nbFY&T1xG8%qY
zT$fB?pbVJM_G{Z8tyTRfLB|#xPYMMHt1DBZ1l|bB_jr<Rus!8$LT$C86**-6&+fpe
zYZuV4Fznip<}GfVq49GZ&*OF1zv)3<-=)^(#EY6c$QHluc`;hq+Zl0;rGEMgsAptJ
z%=%2V#cl%`f2`=j0;&jNTE|-SHnV4M6PWLYNa9sM)*;q(@<}QguB)CsMA`nkL`gNL
zpOz4U<_=k9lc20v%~CQJp~aVH1)#D%y#l*WQb^w^%n59FLE>wHA?Jz}D6!|E*YWGx
z`62P&$i$+-rpog6m*HNSAEM-w$lP2N0}8u-<(s0Yii7uaJnt^qCth_Q!%j5=jjibk
z{Iyl%keZf7W$>+ef_6WDP8l;B>_V!z=i_qW=?h=yee!~#XNAnSmH|^a>n)&=?&OgG
zzkX&Pu)Jv{hJjd#wztrHr(U7e2?YGdxi)dgMTo)rYq1ry4wegbP~q8Q&(jNE|16Jg
z#GX=4cRch?y6J(3Y42_Ku{Hm5RI$f#@#JfC@z`_p8b}KFy`2{JA6BalSbk8Ji}ae2
zSdIq%%h<gjg##^t&NYZJCLAhEiwOV8!Mux)exAa@9y<KqUlnMoW$SNz_5@8=&(UDt
zEj0OajxDiS3Ce44j@|Zi$5PpS*MiX&Qo4`BlTKxBRj2?;m14VQt!Rx9v;k-&pR3|c
znX_e7@_p*HRc+bQ>dTR88>|U-9XiZ&_JFw7E3ZAv-WdlkCleajvk6hguy3gX0joSq
zLsF_Ra>nK|THnwLtGOV&8}#&_{8zNjO7kci6npr+Bv+ZgzxBhP;yC1U9DjkZnMjua
zi3?=Pb`!FRRU;6ZgDqmM=B$?Bv=vULRt={{;-I~LkL|OH4Ip4|sQ1>$@A}s7OC^vF
zzv4Jx%}_6%Z}r7TY3&uZ&KWvgxb*>cWTqSjc#gf$???hS$S&#S_)E`~Wrz81tFf^9
zN-UrzSotVRSumrgYNFLm^ZX~xaq<AX)CO!k)}rONU|^t@-aIR&f&=i&&wQ7?sPEI{
zr60-t3gj*AyOp7@_tG5y>FvFRas7il)aRt&u&jqVrb_A2l9WABR_Y8&r3fwIBi41$
znv9j@&IC)|6oLo;8J|5)#h#mmTtMfKE9ziSH;nh*uD#UbG1coUG-U&ljCty;Mm!U|
zOQcOu8B_ii;3<4on*~lLJbkU@79@0UM{@g&C?W9U>Pf1O{g4IoS&pmBD>0_&6rRL+
zunqt%aa^NjD6XxvCZ!a^HMXw^&LT_lNbT7yRcH|Cx>jZ_6sYt)vnuu4=0)oZN>Sck
zXADoC`T{L{^nXLWyFbY9>~8k9PEvjPS<3d@p1gQhIw3u~CG#2-865hvntOGv)qZM&
zwo+bLt4XymxN?r&WCtH$L+ClGUi&e7^J96|+!)=80GN^@_ndkCu|bq0eTc^ifrD6+
z#w(+XY4N%Q)<w0PtS|GFWnTRU)oIp+bP`bol~Du_Qo8)~&{4GaBTkp)TzYb`wu8}_
zb=rF^84{ptAY%`&xcObwd&{SIP0i8d$N!XLRo_9m5%B`^gAY=+`xc5Pf53ZoDqdK=
z>j?i|DuMEP8OXkgryjF+pm1@KWyQ=YjHzlxVOC3Pfns2#up$~v00a@96FFQAJ+*b4
zypI>Z`xS<#&&X3sFneJ)J<s04v1gy4@p!_Ue9?r#l+JRz=i>1fY2m<O`K&a7)0%}<
z+lxjos<L0CiR`etPDjNV|Hr+h*4~0Bw|Xpb4bX!p=XoPBM0n!sf5>po8qME)x3b7M
zfVu0w_tJoc%&E`+muxw&Q>QO4)tsu3{C{zv%u_8S6B2qglvhRSJ#MV5uma)haljH(
z_=N*U=;(WXmY(>`9|+@42d+t+U?d{XYOwc+Kp+QK9;C+@I-H(8rLK5m35Yh3B2!9w
zYgV1I=d`F+Q2oXbS*!jAzpLrFll1H#{eNh5{299SgTG1#9(aUGj@#gugWdb-j*t8@
zy?EgnS~>o*zH`#&@d`A;7^_VvMU98_jD!K9y1<JX{hW3UGKLDHRX|XKC*{HgWtYf)
z)_mGTf*BmRh34;gE3F@Ul1_c+U&wpd`|!{5d%BlK4E3%&{VgHS9Qc_}3;e4^V5#$j
zgHwfBQN8kGhR0sErk|?tTl2J}l0!5$7}#ZvbqQ$I3)8YzA@y7GXRa;A2y6b#m;Qh3
z)vt0a{C}Wq?HKiW)8)h6LJk@|{WV&D{x4|$l_xoVdXYAGEFi;ZsV0S%A^1SNkhq$?
zQP05<Z?^5qL_tARR)qzOu$Y)_S_)_Vxo^|HkNg(VJ@02|l!e;G(-OmycQ)8V^Y?NP
z{K$Q@%1XapyC_MyfZ&2%yQvzZMO%6SN+*%^L_$I}yj885Yo)k!f40etQ$rv((uOot
z<o!N>?*};k_CaBfIpIOhMI3PLq(G_y$nhn6cTPDL_Z6DH_&qkXHZ<SODC)Cis-iJo
z@jtosijpcEQ%kCL10)(lwo#!jZE-?K2B=i*XQkR)c$xYfUkklO+W5xra;)iik|#8)
zyzqbhMJf;7sdDA~Ga^$ofmZAAMT3=_*rw_lS|B+~q$yq~RNVcuLY}B!`8Ku7$JMJh
zq=a_gN(IAXaf6lpxfc>DQAhRy58O)ydoS^&uk&}WQ17OP6y*V0G+9;T<=}mkz4n9@
z3Jyz$waBJ>XCY<&khgv@A(}+1K%aT&a!|1^YOSX4OlA%5P+Ehcw_-O>@TBr1Z=>?9
zzb?vW`oh<!IscO6I|js{8HEz!1$$!?j%(H@e?-L!8(#<Rr~KAOIJR|`dPm;EhS)BK
z+aDF<SSt9GOK7K+iDE#@i9xQgoC=Vr-Cjw9qXT$lNK%eLsuAFObiX7^8g|zZOhMqN
zx=<oL{-w`Q`18*wgNwgk>{<C8yq*HMu}VC|!q6BpO5?pe)iuMN(7bV>KckggN4Yy~
zA4%<uIIF_!CGh|CSqTgnvKg_`ntboGG+jQ!afk1UB3*yw2^w%feb<8@qJtm$O<I5T
zY2N7bLJt)|X!#%>__chwbYC5V2Fs-mSf(X+O3O#W2Hs!~XS95gmTtb2j{oR8^wv-O
zYjoTDev!^S{}g*sQ#$qZ_a#TC$MaJ%G<eU){~CSvKl*K6&}Zpm|GU3S^K1~nLqzYh
zz7Pu<nRn32H3v{vm&P<qpvY>r_meApHW@`}m4a1p{)b<o)mNXR2R{9GX!o5D(%gO|
zk(adl?su?v^ALN+Y<aSGn3+Kll>wq2U!|3-!5R#?=1xE;Y~cE#kt!BaDk^A+pY_#>
z<61rO&VgM|rkKxKg6|XFa1DD#pc{(;GrvSfKJZEQ%6^f~eE*BI!5-(_O?R^=c9G6K
z_U8<v9;2In{<o;l(1z@{)>v<BK{g1SORo~G+`s(vca?o5$+Wsry_0}fGneZ1K?@^0
z86i(GBGk_eLLextu&j_ZvZy7!&b>sZKJ)izv_7RhcfFPNzW3KSPIIRuuC71x4W8pK
z(V4IQW2^ohX6p5kjl<b_!K`(SdwGh3q=i_uim8z^$lx=ye1Hm8N;=D|<B!qk)u*U;
z=sp_U|50k$`^(}6f8V14!*ojz|2(yW{lYZt@f;(*i{VJscGAS_=|~G<Yk4FUxFL_U
ziNS08K=QV7hXpm~r)e#(&nnROkq+?oUuP)pt-f@~L5$|&aT>qKO7#3OaS0IzAKv>>
zT71{9)5SB-@ktXc?wpa8J)%v;Ts6TpbX8uWRhu`3DvBNrS`Es}jp!lJqconiCt_p)
zUO=|{)4ZqvRY0o0H>f@Hv?vTWfXU*Xn%~CnV%IHHzT>Yk?7dEt@37(>pEd$bBViAq
z9nut&*PrL5YMG}dkvj4tcQZV9FV)BsJNq={>}^OqQv?>v+FRd4{ri8O>KDF3BZk%5
zx~rPe=IqTMeu%;%$9+yeL;0OQL+$DbR=zK>+sxx%Il-}{w^Hx^4GN(4@4JhQgNxKL
z+G8^I1gVZHD<p?JTBV<0?V6&-sO7!3+I|PmCdu5HrfCGnYm*_Z>m1~_@}7@Uansu+
zu9eO2q5i!L7jlfcJ@*VX$G%7PiN~qov9;%(mGuZEo^jlB@UFj3?Zwx4-8{^{eT8FT
z-!_kv<pay6Vp=PdLwRPoTWpb|9YmvE7d)$Rs}%+|Fz`&{2$c<RjyLnhw2QFc_u*fp
zCqDn*QMGze6ymVdPQ}=4=<Ot|Mc}{L0v&qrJ+%L>2RlV$f<n9Rl2ix>lWJw1t?Pxd
zQ(R^(q#{rD?>6bR&B_bfeUUw>eLwRXwEX0^=+!^_M-qqF|ImkcW8F-v&;12MPH&-o
z@BI|5z4kmE|J;Ago9R?XOAfZcqj&o>1I4@#-;ika(l(mcMy<Qp7UyCZXUZ_?{<poK
zp8Lk<=<M@P$g{uqxBidx{8#^ke)z|~OHY62E7An=;9U<fT)9B=!y$XPd!)L=E>?Jx
zV^7nFy*A7#QUuWb0<9eYHTK-tXeqIf9P-Xgqe(uscuTb?*Ey7<Irl1k|G)Yjy6JtN
zpxZw5Nm{)5Hc3)OV)kn<JWG*19JuwefYGN&CcDvOVcSSjC7@Cm5q-d5&mc8mgV)7G
zND#S{rx~*GF{v{#U<UkeFs}OS<(~V|*F`Y&m-dkNaPkF#iW3D3+2Mg(>GbzLLl>X>
z0WIC}Ht`rPu;D=-yWlZR_*tf>kJGNhw^I$TU%aVCP=nD#6~fYduJm_nwkMl4BTM)U
zUA;Ck2#qW*(x@`Qym`^t(iEW7G34Lueb2Aa!b2bDxbA|C3)L&u+1qN@m!<ip2+b-j
zCX2Nw%;c3J;LS}Ys_eC@Iq!%<dyeHzW|ciMDN2jK0dt1J;F)@jPJQL~Xz#mzg%<An
zkU*5kJID~vWtav;26*SY-}Z6J#usUwJwj?$H787jzPd`aC38y>JL)q|RY7H@+_WgL
zrVeDe8ZqLC<<^RwIwg}Y-6Yix9F|B3Nj0MB^IxU4@BU+X#<^i82upkN3EK6W|4(Xr
zd-<8q^1EqLP+ov%>yPCzSBWE;C0;jOS+>SHF9KSWTC172iPz?^c)wGIcEMl^Y&h1>
zeOaj5k>iwc?S!m(C{`3KK<tuOcxKhAC<b_CaqW!cC864dB<c6GB8Pj9LagBRhvfRX
zS0AM~J}+##VBTnt4QX0_nW|?#&kE<b$}4BH!VqH*y<7%^@vQY-)2#TM$J(Cw5mirq
zhVt9qFLA^6+;gnpzD9xLiC915@BA+1cYTz-u6y~utPD;+#m{wCnATLRQhn+vBIKiG
zDk+gP+#*?h^^Dd6W!Ms4u;dZemXw|Ax<kFt)*4Ed1C0mEysw?&clS8Y%SDqhSg7-Y
zbb*K=hT1Nzu7m~CV*Yq8tCu+D+kR8hQ=ptDFMLB{e#O!EP{HxWmfykj$v+XYOj&67
zDBsWC?%(_Hp{O-6gY<<etihwu;ccOfrO;(&4G*=uFW7IB^$9}(JrNH7>pyzjBR&jk
z{S$ie+keWFpk)X$WAg~>O{}Gs4!q^P>~VaQ4&HH}{O;L5|EKij|Lp%_rFb&y5G-K{
zT4Kxg{#)i{!38I1v@@n#AY+0#WZ{W+x)6r9u_gS0Ptn3%?_wqO13L4yKi~lW2JK<t
zyzBn=>)6=ZUp@8|onWO_9e+}3rex5sD?&9bQwb;!p5k*rWGBv#=s5qG*4`E*h{xfz
z@OIt)0NwW9kMT<y(1jO%Ot*lva@+m1uxlUXgCYGlfAif84b}8(fB%n#gpjavzTd{V
zQ}mtx?EgR~pZyU5H5IR=F$-4G8D{ddqO~pwl&UZ^m0FC_bB%JV4@XiESKFFI_6F~u
z2S5E=wD-=3Xl~yTI`+lirxQQ;D&PCGc)_=D{A<sB@1zso{1ZC%=l?`5F8Fq<6;DK2
zQYLXpN$w?GS9l4iq%X0hLh0okuA`+}ZlR@H@8UQk!)TKKWb^8Af$^AOw_SAj!+({P
z=>nbn%J0);WmPvpP<psj`Y1If+eqd1p<Hu(;z?F|FG<Zf@Cl%}FjQ1w@rnW|&>hUH
zcB6=_M^~lRJ{ma+NhW5J#EmK-^|Yq>`9f;|Mos$MclQId|L6Z*8r;mnWVB2dzxn&L
z^7t1drX;ywtp=O{msXb8S$g#j%i9sA8fi}_dB@{M%Hougi=q~%)b$Ix{y{*&Ik|m?
zcR6Mlad`M1n&+4xsxu&|cjMJ3SpZ+8U2pja?S15v6c{33ee^Rl`tj%Zx*IkI?LH0z
zq(8_~{laL;uRsJm<|Li4Eit&Z7@K=&3Hj!K5AXXJE&kkZYuwF*ItGeD1l6-&pp~!x
ze`PO9=nC;C7E1HK_<yAffAsHDxbUpNv07L*q?nj@@r_ojHqU1AvLab~6;oUpS&?9^
z=n|}w2Cjib>%yr26kX}Xq-2eKL|UBB<iL#5w7`?zR^mggwM|j41lO1LO+`qCuZLv>
zYK=;CaBs)cFl22;C3tun`!=y2O#P$m9ves{QcC!}HXLxx{amT7Sg<$LmvUby4lS*f
zj0Gu|aoE)eD}G-m=SX=d^1|9AhLgms8-t21HKH;YSH3r|SSayLOgVR+SLZBPor*3$
zPZ}9#>iJjF;ed4w3#XXRi_wq;l?S;gQf=!bLQSebN;{LOw42a3hZhb3xSL=4I;jPX
zO#@34E#^mTePKT>^z-E5;O~cj@i*j;FW%XOJnIR0;8UQPOj~L<2BSzLv<&2rnjyP}
zE-=(|Xm4g!RxC}rwL7YDLy4dfW^RIsV;6ON@hnXq|C+)iO9yD>+3(Sr?|zmo!h^Ky
z?swAo^viVWtA9Y#SD#GnEClYLEDhSZ4>5`5HnH;7d5kL?Q?2=CO%A2a0~RtMS5%{B
z@8LCuKkon3-w~_zu|N4eI>=t<9dCaRmAen|yth&)bN<L}b{C&fhHCd7qA5eL5(nhZ
z#?l8ZO7T_1Jy4-yu26;4WYRM+)q6yB=rz>1D|I8IhgdJ7k~)b;eV*rJX_(W-sTb(c
z-}?{f*7yA~-SN@CO1FOOH))RJO5=0KSa2@V((Mn?%88d~_4xBDH*>P)bfOEj=U1zN
zSu8RrMUs52LKKbEqO(|6pZC=G?5nb&mTtR`_8z)hsJUKI99A^m2|THd*Ep`l)*woy
z?|$fmvak!Q-hg|cXPJ0#$Q5J@Z|#+*Xng7w^;(F;63*P>mOQpFLrT!aBA$cMx^v4_
zL0BM~TZZ@rEJ8RZHLuCMuSJCwq6#ADC#RmJbAS4u)1IIGw;6{19&J4FXEbJbSl7C)
z*%rSobo`AF5R5>Pso+zn*D5=xi<}y2g4j|^|FY6L5OhMui@idz%)`@X_-Xm{)2T{1
zJS{L#*B}3^(4h~!|F6^1yFN+Psb^@)7IrS(IMrh>2SGe}lu&`vMh9h#aWqncY&Z-;
zOrc5@0>)XJl9NKK(OGXiXDhF9?1J~y(MR~-r5ZB03Zoz>do;Ivn$d`tWPKoCs`tQO
zp~=bTD4(3yXEX)fm>1ZyLb+Xs-;k1@#pn&n`jaGlQv^LD04aMC^*W6qXk?4rNGL9c
zs!EX(*=v~<UAM4B=FuFBUy0XiEmshSj~aN>V#BrecEjHT-UC9svh}TWa$_boDhz|{
z3srd9#>L=JvXWyI4YGrG+$t<SHN+vGQ9zKLApfvI5JD#irMkSus4`;$&MK`KU16E>
z^vWcp2D}o2vSi38>>gdr%KwyQ*BCP<#bk=t(Gg>S3SyOMuRmGeQ~eMrHO&ag1Y^5*
zml!YakHcf(Kl#u>nL%tO<V{I?_fkC`l%avgfIO;=3A$R=YzdYUyMe`s{!MM8mhRvF
zy{`z(J5Z;b+#xdEk{-@K^MBWqF}?8Te?s5*FaPhXsPs#uZRBEJiQg@j@?D4KXrY%U
zuP2%&lr10B^GGnE4MgbC#=3KAs=x-BCeRiK?x3Z6-%aZb!%bg#jI679x`5Y0n^lBr
zwIn}Gy6~R5IHt2JQ&td-(s8Y6T;JMr)K>K#a9h6bCVK0y{ua$0I!e!e=S#Hu@{{!H
ziBq(|ZZW*dPyg<>H2&vGQrK}7ef2;3cNiY~zCJgs<3bB(q8c^+4fs&XB(c_tg>E`H
zSh-EK#51c#D`N0q(5MwlW4s=PXoFz=2qpjdzjv`Rxs&5;2kw4YSWDOh7oLBNPJZw6
zwD#N&C7`c{pXPTJ#`Z!<qTJ#gfS1`IRF9U_E5+~7bIMzKOPh>L6RESz*h;Nc0?#$2
zKwyW6Qc<}q^zpb7dcRP>bM1nR*+R{}oHg?51y+W01;<;}<y>EFwK8|9a97_t@%s96
z_Gp%O&GiDQRStn5ZQ?C|X*!OwS*81QuIp%#;m6grN|YWLhmxS%dLJ!H*gOS=&$_Z@
zDhRW}1faxYbT3w8^^P+WZv7s*6*Hu^Scta=c&<0dIkwh_cZTA-zUDQZCv+CJS-xeV
z)aq%zm*yX4wBfF|(M5(9K~8WXuQYfqF9k1gf$xW=k~pN4Q0d9a(W+yF4gm>X!A19&
zz?*31dEj2^Kky4Qxcw1KP|Bt9eHDxxfEZ=P@ZIWn|9i?eUZsuoN;)zNNx<gM1-IAD
zOJsnc#bmXQ7bz3d1y5^Aj0|u@|FoVm{zSPHS%UCV@mbOog4&p}F5tzx3mrUJSYDMt
z&TOzw#<jwx)_g6RA&!pNStmSZoiCLlmLbsAuFy#NOD43WKBgu2Cgo)U-Ma}#lWns#
z3gLX<8~1vgB}jIUNFf;jt~~u&6)rc0R_c7Cu(UI+8!s;hr7iAZn-bI|2ANr3Ey#En
z+HKd<uQo<4V#%#}&6@h4YpkAX&pB_Bsoknu+2fK*^Y?!CaLl6GdRX5TX|1%Ll!20-
z!UBZ|3>S10H@v~XF2r6zUBfw6ulN4Szeex+wZCP)$ZSTHX>j}87i;%Tq~lLLMo)d|
zpVG-6eqAk{GB<A_nxYA!Oy^k`9o;`iJqu>50<>B7z@xceo!8YZL|2$Ie<{>quu*BW
z)7BH1bw`*mh#l!aCZA6Nu@_e+bar_{%axJ<aKfO}rcP4{w&(KnXlq|vOswU=#O|Z_
z(w!gqWjcJv{Z#JSPygb7|4E?<|IBayC$#J6-J0;5YrfXTnOEu2|NlSWVD3{gi`d7A
zr3sv4)xN!ETNAwrV~}90^jFGs@rWy5kklDe0jcpWU9?Kn!Q23Xn_2~E98y{eRB(9P
zxiuur#8EdYbS_?Jnd^p;z5-gRf~rx&v8;mnpts|kELa<PQ+#=r=;^xY^rnuEXyZMD
zAZk@Ci+nvW1)~@sB$Zuo9T;AK_!j3gF<5{g45jgBlz9Z>6Hu$ez4#v}RHwT`;0Z~?
z7ljGtsa1;^@^zssq|E}U(q3ZWzQzh4_l1S64H?_6TvM&gH&1?6x^%Rv{2>Vuz%E*P
zs+F}a3OfWT1BKHz)>+^#s)a64Q>Hm<qAaHh!H2AyGogUDl&YpnH3KcRqPbw1cF)F5
zVHCi#s`-n#p~bpdjco`d2d|;8=)-v0kxLvJ%<``JpTt=WI@Bc6*a?3#Y9LU1CUm7M
z0^VgClK1FrwdjHCU^!i_3T4R&3>~UB+nz&eh4!?14WK89G1uCLMT!_VsvOEvg)H6=
z=CHMD>n_02y+B|+DcWl9DNxcj9-G8jMX3aa(T3hf8agHct%hB+wkNI-aLK6|9GOw%
zqsImf8g<&gD45J8rmi#hWW1*pyi$1n-l)-An>ez7xe&uBw-k!lc~Y4nIW8zeaO1?x
zcq7G7Ln&$A`|*vZjUs0KEEy13?^2kzw9hIs7|<$*n4<OTYXK!T!pBB7E45Cij|0Z0
ztZ}0ahyU;+hh(=Psdc_|*N&1!ij6#~wKFk#5NQL#Hn~es=&%&gGixjvk5-PRHFrKU
zi`6LfbA1gc*U4vz<bATxH)$6Fr+lw*qaIPk_nIrT2N#0B2bM~@<G`FS98*ESsP)Q3
zcUi2$tqNCAbcy2Hq&#OWAXkRLgqu;9U2&%$My(f!9$e>F$FeA6t}MSg`X-L4=^8f4
zE>M;$?b{=5+M8B$h+sINxg;xrU3}g$TN@WP5T|NrFAI@VBeib#@C0Ix<o)Cp531Va
z`uk##uEtir2aF&v`GiJa2Z4HJV}mSFMp|3fvNenBolIBJE``M7sco`kQ^aTmJC!k|
zaUm5V@TeM5PTFy|%+)(lSTIW53eg;R>;r2{1J6!~5Sd!SP>O79Yul5c>rX0tBaTvr
zq+C4d8LdU&L7{Lkth!b#?OKEf3OTQ@HPZMn*6OKX9nLRi;@wHEW6+w4;{6$9;_D^1
zBz)n-#?00QHck-5j)KI?qego~<(iy3MBEH>g!mKI0IB8ND|IcYfQTZTwAYg|O%az9
zy<w%BV(7Y2L)gLF5QSE0pR*9H2_^yl%`BFo(3m8m7rF>AcLIIZsz9*z3R76#Sy+n*
zs8=Yd4ptIrZlHyer8RsEGLItkCb~{Di!YVdMLL*AjJ`?IJ-e^8Z&5`2e^Qye)wq+E
zK+_mD{)Wd`36oX>^Wp{7tyMnhj7^V^;QPj!fcl<wCbw2`nelSXTPe(o21MPT%e6v@
zm1cq=rvw-^d^68`BhNvz!oG#Za=iqYrz<GL7Nr?wW-<rD+2J<ruweOKnU|c(EY`ER
zsiJ#2E}+~)atJmhLYo4Uj`XG++@lm@pw}rh*{2r6@&smO7Iw`k<uiv4BPDs|UYJ9L
ziu6V6_K<DzMA0fp8<Hw)s-3@e?073>PaT%J>EvNzf2Mh~g#Xs{PcX)>?gPn(YgPGT
z?d89G$I|bVX07HXj68r5jcOW$wc<v1(<Y{@bSOJmx_v-AXju<o$Rmcb>+_B0*lL8}
zL@v|ZKw|{xjUz9bqM?A92%9;0S;iPbeLYyR(nklWnhcFVAfWofI;eEwa^^~)2-JCb
zK`j#sv0L;8er#4&T4!U^;Z1I4{x>N?ie04)bLG%+`0VP0PMjObriIED)+Jy89@hW?
zL{eHm^1C2}Q9fyf1wzFq4TO=EiT65S$&GjiEZN~8h}8=r-^;X{D>gHfcwH$D1B)&i
zr498F)omy8K08|F-<s_eFcyMzK^9Aebe>Vc9UWk&V#T&<74}OO%&iF~V(T#qa}gU5
z{k*^stfCqknuDa9rM8ZzT1+{pOW!4UD5M5O%Y&I(r_?|y{6ud^`x1o+S}O(6pUVX9
z62WS%KhXC~J0<gT&*zlt#RXmceb)R)6WUm>#ftYJdSM>t)G%_5m1qei7Z4QGi}Xfz
zUF=IOX$TAHWXpq@9~Khlo$G1;Fv&+F6QY1sKq4}73`tw^%sc=krr>b0fJ0NB?}JJf
z*yviii({wjjWyp>V*%b5nn^kyF2QPJAO>5T&K?!e&&u>@H3{|VgcuU60!po)$vbSj
zL~IfEl?L=-?aEx0+M7#A!nGzWYg-hO)PUULPniq8OkqIxO7ODh=1NssJV#PExKUx{
zO37QiD;Yueo>b%?6s9zc6awRBN{Q5vo1%sX<CPuCp5lW-{WgU)=68sGVK8ExTqRwQ
zgTmZdrtiipRwU@mJU@wl778m1)MfqlT=18c@I0B$<Q4{1P%7wkKKwZgYq;rEP;~4@
zbb^Oy(3%_8wHXUVo@-LGqcRd(w{XD3NGG;#llN+dxED+=3a>Dt#*?;#QKE%Do67yh
z3=Ub_xiTm*R*-@yW@gxBDUY;QX36jn(oEZ>D~Qr6y7UH*t!3sQ_*|$ruf5G`>+UXy
zMqlMl{wsGa{*H8k#UgL5^i#hla1*Rp+2k>ZM->sD!GmOqx9;Nw0FuBe2nBHW`Fv>y
zKdFU~kTvQ_6uin&6=R+S3zC<|QhmJ9_U&1&Rp;?<e$WcnW}zZg)&bAKLgiHl0!a-a
z%P(wYeJVr|&y_+0LS@r+UX>?vx=R(4V$#hJO*wVyOBG(H-9l1YM4h9CW{c<7rgVZm
ztqZGDhR146j+QKWlFAl{A>kQEl7wjaIy3HmnQKnOgtfttm4#sO_;Fu1BS!_qAV6ST
zcr$nh_}!o<Z7;;ageAsvHaD*uNLhmp+hj^x7GpyN8s4oacpmCJdST@nbE<MRFtA}(
z88&QH`>V3BrjnT3;hZjVFu%kLY86^U*&{cdB(8yX0cyNiRVcbUVnwnv*BAVH9T+)c
zGQ8+Do}}YeeWB?OWA<o333owIn5Btl#?wRikJprah>e9g0vm2_$WY`8EB(1r=Gmb_
zSYL?G%6JC_b$KV9P<Pl+l9O@IUY0CG2y5v$4M9G`pcJCZRO<+W@RE^wP@oB86Ap%@
zK1VRmD5|CG1V*n!07Fmeb7o!p6udtOQthv%LJANb=3#A3VaUbBTob5`JOQCC@4s+w
z%M_L|0Uh4OO<EI%t-<UN3R-?E=UAF~lzkQaMPCh)+RBktMm%uOC@Zq$v64g8&Pv04
zp_yo=f>Wx@1dS_cGfGuDQz1>{nhY*Ns#PJC>HEjr*9LE?C9i7~H_R=MR68qcUYmDV
z7RD(&t=PpcC7uZH1bJ&Pyebv+@P>0M`$eH+LOZ0Er(z70pf*{%l_^~EJTa}^sZ}$)
zQ79z>i7Qr*6-tE^Gael76lKzMWFcX4W+54;lTj^3UTzih1)h#dcIe>2EP01r<Ij-p
z@615)+>syJw_2;_`FUb_X1~LlKrE}8s*<e5OV)egy~%hf&cq(gaLu|9fb_siN#Le5
z8zOI;lA65QyM$3CjZ8Crf1Y!g|Ll?B@8IP)1fZ?JYZbV;TK$^S(MW}dDd_F|mPQZ+
zyhA{r2i1AhMDrk`D7b=6c6e-s#LqH;z((k;qm?d207^yY#;hDmey+`Lgs>ICD#D2c
z9xpEBHK7ihkVts)PMuq4B~sCawORxsAkArOxlGY>nu5Imvl=Wml@wB-6yR0%P^<TB
z^$%hu7g?aMY}9o6%vk8|%aaN@i(<h~Yb7(x@im8h?^XWiMPO&}K6~Z?l0tT9KfcRK
z%|Q8=0%O#yIQk+OGbouJ6g>KZvC$A=8CF7w!LMLIN(Ku0LRF<MvRYe^1QQOzF3NOq
zVf;e~J0#5tjG>P`u0gZ`jM5Wfu+EzRj4||Oa_d;*4PL}FiU(F0w?4M6%r(DHs&E$?
zD~t|JW;U-T01%(SLqJGZf?em7O8u1RFBJrWM(|ZA*D+c!+k(w%^NaP}1kGIvR$d3n
z6A&%R5@BIa_*sVY1#K{77z#B=piBoq0D^iB8n3l@iM2a%dUQ|56GagSGm>-<z|zF#
z!(6txc7Co5dV_*O3<zUiS#Pvonh7IpYGC)eY1I?-3fmCK_|9{XGNVavjFedhMyNE8
zG;3XwSJ4(`s=osSS6LI-zU9>j9XuLzY%vgjU;4ai2tc9argRDuMA&PZJZq4m#T6Uz
zW)v#ynL-nV6+#khbu&X(w^)%FkWq8JymV8EvS(G?WCY-Of_a@1X9VlAQI9?$^bvDh
z%JuP1#T&88CmoR>OLnLj79&knz}yW6xk9nCMoZSk!`1sRN_nJ?L}Sm`SbQ~P?sb{K
zjjA~CH<*K&ds0Og)5LQ)Qsu|&I1)6Mb*NADN;p{uWoxyRkO~gye${<eTP#uG<e3~)
zn?Q^~+O`zh5gOjSuX$MqR;nr(4PQ!~wZV*xAjT&41fCD@Ac_pgI<fbSzrCUg){7%9
zt&xP(sBi|YPDSCJnUjazr2u&0Yk1BuX0a}@x5co7EUTuqSa@ZoBtGZoOZ{A4WKt;}
z56lA_&JB2zj%gQr8GV*mWA-c8_~8-9Tw>2^$eVt|pnMZGo&k$1N5uq*yRd+a+K^JZ
z0|#CB-oba=DC`K!b)#100tj&=iO(A6nsAI^z=8Q5UvFJX^yFg6o;|xxYdq-?@&z_Z
zhO$GIY#i}G0BHu@NNWbY!AcK~K?j9)uyJDml&KpS*!Wsou;OKyvV|byco2GRN01D7
z9K*iEsV-LfcJOj`OFk2@UlM|YkO6YA{dn=i+lmUW!J5XU>Z!0gq&f-e98MbDpc9Rx
z(isl;4mg0az+)UyCUKj^ekJk0QI#2qqm~7UB{3RLRgm$!z^mKfv7tsETE@)7iV526
za(7Q@wc^RJ(1TGS5F;kA3ZhJ4J>&h1M-W(~38}SNg;}euH2@bhmIorSp;jOSv9Qq9
z6i^H+zR74x3q1Bgs}R=^8Tc@USUI=U#U8MCGwY;`7z^$J;sEXkg*6^4DWYezW~uxF
zcw{b@ntu{IK$QuG)K)ecNp97cPa|<41mQ!W-Yl^AX=|3QFwIyQjjL3W3D1l%Lb+$=
z9f8FeE5-Fi0ijxVNk(l~Mjv2BK<gz^MQT;RP;MHVAc^mZw@@g>Tgpj+1ci+XMI2SJ
zia<4{7-GrNuZt8$&9whCwdnF$sPKZPI2kKJs7wq%k}4bG6<e%JL`2>i!;h5BRVbSf
zh6fA)5mI?qsba8T4IRPu>S;ciz;oj^6=Rj^AFbA~^YTiqArDwLU`nFui`<@+kWf$5
z11rl8o?Tt5#p7~MLaU!B0YTb>)Ee*?W?x}(BeCdPqfeVMD)gDPu3i)piBsX-V3AJZ
zt$NcQd6)QJsh*z1Als0XTh{@?yht+&GBM1odPwvbv&G`_8HMD~qg~G{xcE6v9e0|)
z!?6Msv@=kmL8$^)MxDdy)R}l)L(+6T3kAUt!Y_NJdX#QtXb(6emee}h(ux^l4#Y#V
zrlE4*piIKlf6HRUxCgv5C*=TriIy^eLd;$?81h_<GE-!pJEpmJ)^83WmQlw7)#@cY
zufK3~@pnYfv}!$zcVL<i7n{~v+DGyrGQAn{N-9Y-CAl$~3k@ZgDNd&hJW)(q_D9)G
z3;_b8M@grkf#*33rotPOo;GM&7+X<j@Sdck5psk`TdvF%ni#zzNzvLSK#K#bWie$H
zwLDgjF$Q&kvsN?ir%{9BvM`M*u9L3b-ozM`bA?hkSE11PoC6EFzyYg#<3$!knBNtv
z6k)iez<J0Ik;Z#bYZK!?hdo_f8?`QEKv$S<C}hN5rUH{S)E27fQPL^bU9FZ>PLfyG
zv%WipG5Xdd8P(xXg*;mW)xkD|Q2=LQQfponJTF)~8!Tz?$|~Co@RSjo8XDadh72Go
zNzyDdrqs(6b5{19#Zt@~#atA|QVIr%Lio?KaiNKqc=y^(7+#wi2)g+I_l_o(R~15n
zMzn+&33gr>L?Z1nEQyz*dkqT7klGO%+c8VCHqXQJdRik0;ks3$&{R8<f0TtT0n=d=
zeMa>pYxDfXQ_&W3a{Uk$@_-`FL>X$^^s?xzXLv}_2x|hfy2o#EC^!j~S@O~f#NtqG
z(=i*R5OcJWH#4y$&DGZYAN+1K)@0qx=1gEgwSNq*?63zI1k!I#mzEl@#^!>xjkpy&
zafwTqQuH~ISQ+Al!AMe>mmLd62d4yED@>?tQ)N3UREhZpEGa#}ES7`V8L0iLu)4ND
zPS6Olw)NS)Ted3%@Am6O0R*NK`O*<cyyLqk5=&C6-N)mVPR{T&jx4x`tb$*1w5Aqb
zu`!5XH&0&jsIrb+(O6GfC09^FE$~i#H58_xT?u$REFlg?SaQ^;ZH(|@_Y!4p6n!Dn
zSe~2Cdq{a%G;?i_o4HpeYd#t=ie{Lp2H!etDdZYsS<5-3<+XfSXI}os9?s!Ut*~!I
zFZ05EZIBrgjm50R<EkA}j42gGbLaSazr-;vKs5r_Wok`GIh$NxI0g>EsY$uUu#0*_
z5T~=!R*P?VgAj5yt@>h(PJ{^u%J#JBN+u~(q)C_2U?EV*HCa;W#CYmFD0^kVV+@Fc
zX`55^R(OI|*DFy-Q$81^sUX1AOCSx(2b5w`MTP|HI;vGwu`u0ef(faNy~e2bY%LC<
zz>O@3)rl&-#h~>Rg+S8gavxCk0dHc=fYrue4Ms{ZCqAo41r*>`c$Em=&+$a9@yTv=
zO6v$IO;c#iKOVDW`9qO3g)sZTVjF={kHy;RT!Wh4GyJ+SfsHxFTnl@VRQR`Id_?Wc
z%ab$D_n1T_LqIWA!YWhgA50LzXi(v#0#NDXAZXaSj7px+`v&Va>^T=I*rJR@<;dbf
zNo(tk&1)w04Uy*q;n>F51+OzF+Nd%Ds}7KDWlBaEnI_Y{p&%^0s@B|_%oL$qBU46W
z22zJbsqqUK5DHI`<)Bz%tJT1hN)gjGRY57OOpvsaXh=NR%94IH*sR!8V`ZbNMoA7b
z2d%cB$g<E;(+!%}xfAKA&l^pNn{bCU4Tuh&CdM!4WV)dxhpkfU7VjPZEgp|4Tdl@n
zROd_$J|$Xt(y9s;eQveND<g~GdDg(51VPH?QlPtu?n_}VW}&N1m}y#qc2qY(ZQhWq
z{Z>J9XYs*s$gFCG#07iG7!w1GuQxX=Ho;tCr1Ub&_c6s~<Q6YlKxRbcQW{8qQ<-<r
zPo7(5-6vGhPc2^K3QDijtwm*1QmQrSQHRVPvQsu4g<WGj&ej7>Jf!wJZQad7Yv@4h
z@n?&trJJ}n*XX=rZD?vprZA+%>|~u7$tabn)7yzrpd=;p7G-Z(>mKS97*P`AW-O={
z^4Z68mEN(#*1b&{b<H|;<aMitn0lr<7p?Ipg2mKa37Tf>Sd%uzSa-E`tj<hE<NagZ
zU@aCkVkw5z3hkLRW4|%oj*NRzC=d`3hKQGNz+eteBiue-!GJn?{mg_U2Y1EVRkB3^
zn!I^V^0Lh0f)^kj6RAfAcuHR&N!&;hhS|@Drv=J4s#D7%wCWJ6Y+0V*xD!}<>#Vu~
zSB@J?&WlPP#<i-pbG;2XPA}CIy=BhNEGT2+$SaG+KFTO{1lD#ddX3!NY{zGtIGeQG
zS&Y62gSrLcsnqtSQ@um|O6JiQP_%{PITj+UTS{$rJV0)@n1zbX^X*z^q(w;G82$6$
zo6YXwmN~gqMjo@WXLExpSxgH3cwB(GVQFU^*)M9bW+5bxjSQ;tC)MZa=FjJQW{MMp
z;8tLkb(_yA+rHUk-1a_wJZW&zuV?>b53GMVXk_CurIB0?`Mu^k`m=<YLW^EHC|UnA
zWAElCB&f;X0R{K|EaxVuA*CIFXU0AA&V30|W`qG3IyR3pOE9tHbZy0MK4LcoKD{!R
zwhzRX$rSZ~v4p>eQhzd|1zyZZ+c>n8)6u;>x@A{EOMRudBa2po|74ysEPm@GAO<R1
zU<(UInMb@EId_8~o>)=Fq#Q6N^>|}yRM{Hit+qIe7e@BRoIWp_3~T$-DsXu2lPEqR
z_k_fBbI(Pf;X#%XdNU($g*?*cBieciR<6usT&+e0pzXq9iSpdmCZ^4l$tTI;m&~_{
z27NA+`w}mA+O><3@f2je3e##zzm>OZ`_>_BubS_<rVj5Vl9a88tn9|nm{FqCeXG15
zl<nul5-kuAQzr$fnj&d5ridCZ^+joYYP?nFRg|_}zch40(-1WI9Pusb_ZKy9R7yVe
zjQZ(>I<0V|3k?IDM$J1aqguxTg^~4I!RQKwk<>fW9yAfPgfNi>N;U<F*}#eh?OrP`
z<YpCWI(*c)rfklMD7_#`O%pKDkEo|mA3x=>b7OjS1F&62hnME)j$J+4$D3we%DQm;
zCukq0*)ZsgY`^>wF8Mod{^#Y6NS8my7t2nLaJ4Vu<`Yc!CgBn;`SImGn-$Vm`YhdQ
zr-PsQ{pB7cUg6xh>4%qn)UEG#rF(=<DQq%QW`F#;7e`y)a7LlNe#B;Z%w8<r=SnvV
zSNQj(pKYF*ZOu`jEhgzQM@E|;jcC*R(Of4=u@~{Og64Iuu~0q7hUB+jozOR5UZ<nG
zGrD_UpKjfyOf>h7ML{}*EY)PPl&~zGN~0cID{(O8@{7=H+oX8w&=CTBa9Z`GP4TeI
zpjBreBK1SqjHSj(BpKTTtQZo~$v_QiCzQBgP72PUvdk0*S>=aDzf%&3PMsLJEO<B8
zm7$r8MJqU-iO1A-kYL-U{pa_~3}O?ns-+q4NUsBDLAn)Kay-a7BG2XK>PUz@$ds9h
zpZaxt?pm8yZ<Og_qLkyM09PVQ1e;f#Powr5%G0`+<!hsIqnOgQQe_fB8&!x2N)bCn
zsT!t(TMLWV$+*N8Vtpd?P{Vz})<Zl<;L4y_Jzgx7Nh`3&L;}NoD|VP$o>jDRIOx69
z&l~k7f+{TdRAr{{Pha3dhVCpNhshK&PV0;`_4r!LGWU2{HLW<N)zI@CWV+bo^o}EY
z>Gs7QtyNPxGj3>|gZmpCJP*P~R98s*+Qdy>#nq12$(NY^r#ojG65~n&d@HHE9bpu%
z@Q<+RCR_aOk}twe&cEb@?JAio{eFv&(ic0vPuPJX+{sw3a<3i!<dXl`=K0tAyX!eI
zQ1S?a{zD*J#IO;UMKpMxHO9>c<^+;|>EeXG{L+-}+LO`SkMudFt6jJSVK5;j@r?$l
z4VoAZucS3=8+U0eE=ajTORn5Jshg5FtZzFvk_MT;i}szAsw$M0F5Ypg6+v<<Cl}S-
zQHE?(kHY;I_0YTqqAP7L`xLF!j}?Gz8ll*0{I2bqlV<J(DioNPs(8#lN=eG9Sh`9W
zIJ~BzA%}@2s@`R^F43Cnmb^}p{5CdIJbEqtTdGu;*Xo3tXsDD(O?gm#MkylgO3Pr{
zXs}L#>TPYvNI}f7;tCGcxU%xZYh6wb8`?TBi`<nOCJ`hkCm5+U(?Pa{CaP(bZO`SB
ztY^N$ShCo2D<|IwJw6wem>Irqc}P(`vxuB53K}!O-*~W^Jt0&&fU+_R3h^#53xjEJ
zEFvlI)Sy38p~<pMZrRl>oncGvsS7n7+OtF-IXtA}9M^jF{CURUM+_6TO6HJ>kCZSY
z^0$52J-GEI_22LGx3lMMODM*xe;>B`{guAo>`sL(&)>%9I~>ba_rBz`EBs^o_u0w$
zVH+ogZGLer3SuY9Zl{WF_J=$D$;?kL|KW`Fmf}xA^TZG%-x&0$H#bkWF3uA%8uHSG
z5v{zqPVc>KNC)SG*0L-WYSJ##YE%L;>kWe#%)*kj9G_q>%6yh2Xq}ki@vYpRRjSCh
zlvsG8_efd3PNSzHvplw#Vso{V0;1I+EL-x1lO|JDtXsU+V_P9jO|-;i5^UV-F+!1n
z&Dtw9t^{%pl(bei$vQ$%f`~TnU=N=-B#wJ13(=q5i~W-1*=c(h^P+MqH|F7qJj`@!
z*K_i$^Wr2O3bA?f9FewAyOU99F<gzMn*kHFfHj$CsG)If8ta~!R;Hm%Yo;}2==~Ih
zV1@E^<mjDwZ>FU3BBZMDUM~~zeJwj=RWhgYM&RB{-3P@gO(BRPH%%*(2j&_|w&Yso
zM|!i=!K@mNOTh|?s+2H^ZN(1<+AZ#u>0+#m-YV=>bN6d0os)~(ewrudx#gM;?_Q+0
z?eEj_#)vMQU*XA_YLA*t8*2+CFtZ@8dXDS6*-e_hidX+_cZm)$3YUDo>9>KdisM}3
zHf-fZbl-O)p4H#4gBI!9gxeOQ?#`P<(5`SDAIGK-uH)G1nYJ4H>&A4I8*FzTc5?sA
z-EQ``+r3A(j%mlo>(?oD65BrP@{n3#et`5g=6zX=rqbd30PoqG<_Gl3a!cPkHl`2V
zF{D8Vg1|t4wgyi@(4oMAz<Oq#yQh#@WeWGugn?}Y1c@hSnN_&yNFnxf(PmJ9A*vu2
z;b-hNq)RAuJd+Y)I2tRH=Hw)Ssf_gCO3vZB*?5!|xm8b3I%gYXCY})~QK}6}A`+2h
zV#|x=s)Dt6r%kC8o-IPkv-8q$;w9GpZbD+<0X3_GUf9bfmB!*!2(qK92P0p&r<6D+
zZA`=$eYZ-nC-d|~p^!2@5qA<2OV-ish1&0sZd83BL?X-WO7Nt4)M7^%dwN!Mw{<k{
zJ8tsQT5AO)%Ip`8&i@Vw47r&tQhTsf$W9X?RU?YR5_h~1uT0#*Rz0ScRcMtfMhta|
zGp9B|+J-=D6E+4z;*hixW2&i_irLF7fmkPGgMV-wg+&KLdhg+RI=#BaF|K9CS0@zX
z<+i@9+)H-q_Pvy?zqD{SU8;I^a)d1`?<-onTb*;+pIl}>c5toh_JnAA-p!^{!WQ3e
zae-|;&$Zs;GAHin{cmH8m;KESe;2m=VB5F6@(EWsAB|v<OE_i-fA6rQxgnGn<U&KY
z?kO#vV(Tz!g&KkOqX|m8Vj?*iOeHL|*pYSQ93$ftc}MdW16!pmb(JWTM9{^MNK$V)
zG7pinsB`l?eE&37FgeS+<k`lmO%z5A7v&Q|s*#8z%QAx+GZVO!Sb4KFaKEl!!&4cY
z6ya<}XVRv012QI}axKg&2}xOL0gzxhV@_}iiOi(=*2ZeIaW@7-dJn<U6NV#Ml@5Ie
z@SLS0idF9L+KV1jl$i^iqW3val@-!>9CA#*u`zp%Me$`LC8I$+G*-xk)iV^O1;e99
zpq2B$+*^WG5VVp-W8N1a#9k18OsLqn0cf(hCB-#1p&krfA2%BB;tA=K=1%m4(vI$`
zwIrxH3kOfuvlc6-N1Ay2fm;^o^u<+r?ZUE@mAdL)x{PZP)3Ut$5wCPDqRV<b-8uFG
zF8$3_2Y9)AcZ{I!v&){?F~qKZ*-ht!OU_D+x67V)m22$K``hVx*Zza;|2%zng_ExH
z);I3B&OvN?jyK|gwwS2M2JG7UIvwZ#zV+}vy8FO9J$`zHZr#o3$wF?m{<N+hDsjLw
z@v=}!Nt@sjC1-Igt&*XYDx@fDG{J8@p4!&EFQckkWgf3)E-^M?zG=d>Fr%Z<_$?RB
znSmkesNqS`l0lPs=k2&hBfkym?@6LGDU275AsTvGIRe*j4U!R$(5~(9r5E~bo32=H
zV&k=4+{xSXh@zAt2cAPlDS28A0iDn+>yoBD*;(&rUaBz`1)8(CU-a}CO^i)UPE;ZB
z?$@n(TewJJ6-2s4qOhoYllIt~l&E`rWb^4UPCq=2L_F(Ei$r8%y^y)BlHRVYJga`9
z6WFR-Bnhgmy6C<*Bq5nJ0ar?$STe6C2}*CKs2*J|gbgi%38f{tbEdH{{I{mFXpnD%
z-_8YAhKCmCB$oEt#T98ef9*%Oyh6C{<5C5=^%1wY&Q6cG<L_tf;~m~3Ug7f_eZ*~j
zbi?m)m5;mQ1}K7f-6!0DdtA>Ew!Rl+#2Q2UXV~aO{^P=+PfwhhD*Qz=$=_MDeor$*
z0HPG|PqcmtRw={09;-ecW-Kr#FGzk~FH5x_L+J9^TnR|=*4U93T<NJ$rSzSQZKkS)
z_t+9foQ=VmfPpq&Be#M9P8(Of+%W}x?p$Dd(OE5WtW^D^j5EEcKZ6VV;Ig;SY8A$I
zPjIDrH_mFb*B53Oeu0w0@-{V+AZ+8+O6`<bonCA}bN^hqn{sxAKg0S=iZ^ugOg6XP
zE6$$@xqSZo>TRiq>M=d7ziP-`VR<i=DJ4nxib_c&tK<-glFNn)86FT7Hcq8wlC+3s
zkoG11Vkedm3Qr3OyP_M>>b$1ZO3Np+32K3We!q-bdwl1+Il%kG>GKlP+OB}UvRvtM
zSGJNpTVLz)M(0(3H}iu_f7^LpmtN_TOU!(H_1M`JZ=F7fSGdNNu5%@CWvk!GIgz%-
z%G~O>+?-$Oyeo}o(>1Q*dC^s_aU+f`*Vtvoww-l(J?CHL*4OkKcwQG))>x?a=#D*0
z^ut#{sA7v<1d!!7kqPd~>d=)QM_1wLl}e-*o*AI>n`q{!u?)dPZki4vBO?cByeO9h
z{Kg9?gc(I+-UV#>)+qa}<sLZ~Es-evK`%jDgw#=6K9cP%@g}UDkPs52oDPxaCZ?7n
z7JHhlNl11Jzn?QFae(NNsP3Utyf|v>J^;@oHIj^akJ+40hco?l(uRq&xUq+7vIJl1
zn0;==TWdp_Bk|B$FQA|UmT?8mIZaB-3=8*q74~#?h0ZmOVn*4+vzAIe(c)b;A(ED<
z-jG=r;<G#MOsS*{42!X*#%r0MpzIZVj^JbCFP{HhM$Oy8GgP(G=_khe>lIps0GAS)
zJ-OBf{HTLMRfF{@(cGZN3Uo@7jrAQ_kMRbbvz_y<qz2<Qe;cp(*%o3W(2nNBuf4qw
zw{eZQ#rHe>&cBb__(8nd1-5zarh9Givf>sWZ0B8H?TFX#<&N$buWfu+e6Dcy-&}e$
zRYlX$I^_~;DCxzsQ!6)R`97#bGKx~g#Ra>pZwMflM?no~bs$tgYKt4P!opS*AW-V{
zw7Hj6r&uM{)oQ)VT(puV@`}*4gj*N#AVo~8Xcbk+q<EK%FU?R*$vQbBvqIvn3F_R+
zFr|V5K^3-oBB~5si8<jy`i7Okeyih#QSaCA{4x2=ygje_?%r7AWCpV00IoEG!>_Y(
zu#VavOmVxy^A5#+<d$UYaH+@tl;Wq#Ikugr<nW|Z?n5?HFo67feMZkWlbV_aRhDIz
zs@qEmI6Q-toM|2U)7o<wbZT%Y3agdkuZ>w6UPEBgYQ7d~r!AIRM+{KlYNLIeP#0C|
zutm*<K-nfQWQ!IhpjDy`MrmGMX%!`)<j^N--$I{`uTHKBBJ|04{ju4n*_P0W+xa?N
z%TG6rgSL6iH_Qdt=5fu+>w2X78+WOniUC}&@_Qq1u<d;^bN;4(^F~}BPic8HrNg@h
z^vZ?GgrBzlXw-Gmg2Vl+WAKqy5BHjY!L2oSK1>)oQ%<_@T8}9&`s?jLWE^eBR;y+j
zQsR*2gqB?Fio{714qs+YrziJ9y7u!a)+B;FT3eSH8Dy<(94hRpy?2VnOFwnj?~;Zk
zcIEXmO#%7f9m2!d5qpyMB&8=YcS*zwwPu<!V807iaKgzbI6u!qr<7>cQ|wAgdFA;I
zCe(BQi5q67+}o~STkdhHtV3Q}%Lz;KCPqpZ>y*-6*0?q?3+=UKQt5(PgZ_M?T02pJ
z$GWw08yRW_YQ<*M2E=^^x%Ewv$<(xG<hhBP->L>hITbI|s+w17x@#_mv@g+GdD1^Q
zXqyID348kmT|jGjy7uE*H`{i<+kDP8l-CxPecaxuS3GB{-`t4#xSsFhHU@B`#`tDk
z<Bho1PwjDyMpG@7ZyMS)Ea>!VV{K}pRZ6ffxq(t+!z3_WAw-RBC|ozI6s+PyK}jeo
z1Qn7MFMwj}%~mP(>gtG2UV4a3;pm&psB2H+?73hurflZFL!d;152lE^3M1hXNN<*G
z(H*hvl$B4kdr_%yFd5;*eyi=KV%HmtLZZ-%XXRShG|+6!Nq<j?u;SxM^I$QvFr$Pz
z7}Msnwr=H>m&8&7gUoZ*Qi9Q%LUyodAevENol&7=4H7TQy)}P7LdwyAn^porjoe!5
zN=0oxXx%1}e1<xOV8@g`A({5G_F{{}oS{EbZ|oxDxVw4rE%daq`V<NWmEmPTxi<9E
zr%SzSurAT6K}Z?7R=~zsQB4GYALs`<(NuJ$<4S@eTyjz>!xYqC)Q{WkNzs{mg&T0r
zP7mFtm#*^7H@cqtUiWXW;R4&8OQLI-^UGZPjd(A#-SPai-Rn9BxZU^iy5GTqZfja#
zBlhe%OjMTz8XJdV1Dm+2RD#!5JT^07CW2g~w#r2nwp}IlOp0C4coA)D9!yBe0N2c{
zOGB@x%`qLGtE)D7X38w=ipdsMvdWt{N@G@^fT%^AwYq~0n7Wcp+VVvdUzn}vuil%$
zmW?GrH(kuj@8vmFP|DKN3++gPPF*Oqb&Nx6o~JdPlGJ^bP8;Thwy}GAjU`ZbbaR!D
zDEKQ~&5XoR$C)^lm0_Z+D@BEQ_7+4+pVw9-QqGFZW6QOipXtVKzRUyjLpnM%9bF$v
z3R8*1ZP7dWLV2we!jHgU3Y1@J%njG-?ZMg{L`f=^guF%}#FFDs(?&b3svBNN6?0St
zA7-ue+RDjVfb&8^GIQCwTWkx7m0uk*sc+V;G}6UDG1VJ`7luWCDNHzv6kKtW&?OrS
zFJgX<#`_njT3FD<Ia;IP*$paJ*U0HTSKZT5+*4NWeQA;@8>y*zVQxs?N_X026wRgA
z-a>d>ukgFv?|t)b&VRf5OwL{hzaK8_mJcQyYy4iSE8goy9@`;xyb<#?d+b<9(;GV{
z*Ltrvb6l^xH<Ex^I`+}gLCO<pfdOR~n;^8f3S?Ss7PxpZM%EDFA5<u3q4Q=UbrkW|
zlo6R=E-bgG4P7!Zlq2A@y6Fmg%Q|a2S%iB?T2BnA(!4@)y2C@BG?x@<5aDf#iA(^u
zMpy_Y+@<QnOlugLQBqD%7v>-lrHV=B?WhOU5mKU&Bif*`CFLh*M+1B(*A3D79a2)@
z+Ga(SDP=RzTV_?|L$KB;=ApK#Ao0Em(z(`o)%h!p*r!R*nldHc7^#u5*|RmT)AG!m
zS}!eKNL@+kERtznUSmDtq>4(APJfykhX$nDCrdAcJ~%k1XSocxVINjd)I2PBP;JoS
zm%U6arg5v@6DqcYl!3Y!TC6cjlSHZE#hO#<nVGxUwq0{G@694{HG>lI7&x~u%PB4X
zOa8v<Mj`i-15NfU(AoQMr_*n_nbr>Ok?-fvU7-C>ouUIzy-0JXm(zW&w7HRZJ->S&
z%`GfZe>gAa)zb;BT{ue{D;GtH&AQT;Q?WZyUYnog`n)cwrp(H=9L&>b^`boM?77=f
z4(O$}bnq}6G6kJ~?PY4#D%yJ7R~XX{CFq+WaIbccYq|fmdM4L$?BrfIYA$!GFlCI0
zb+aNENhe;dMJl<UnOf;mF`=hK31KSZ9@2&=OKz6LyNZN<rTC5}D3f|*q*WF)zcw>=
zpjPsS?16A}7MzkNjN}p3!;&()f&fw47~c6<8d^5)DUl`nYLBq!@ZMA#o|e{U%;P(y
z)fc4DRmpJiR@is`@642&*D;g^inzZFM&+}_qHH2cX&~ANYBfb?4vY19l?r7sx{~VP
z*vyir9SYQDk@~IVeUY`N@mx5BfBHeaA&W`1{NI>UDPg7XomRv!C5HFqG<!1T?@HTS
zqA0sGTIX$Jbz1o@6l0emN9A6~c#sH;JSqv26}})n5J{qRP?jkdGojUZ7paSy3)=)e
zv>K@#-&D0!$e3^-78)9?pUO&OfR5Voc~f!qBMmZr2<Sa&YzQ`w^qa|9Nj9>u`j^r}
zcX(hSRl67HxnFn(J@?2RbYb6O_vJnNXzBhVbpJQz>8>yTnEIzK(A8Ap!k+zf==OVf
zLcx&Q5aB;$C5As|UU`8wSRuF<l5olB|F}eXg^u<fuXNAL0paPZ8Sm-!u9bc?^IP;r
zTikb;b{#lE$DaIwDBPJJ*xtO#IEWIYayfCe9mV&$-=w>5|NJ-7t9qj@dPAObn}dHd
zmE}&4=)oEOdkoJbvzmhXtyDHg_h4zHDeX<P5JBU)r4a0`uSH$=p4{t}ym$|}2}IK3
zxzfbZ=;Goj6xug0SZ8GP+X|Vs{(zE6`B=Fce6C=!R2ANoh;0R>nJZ!?%|tWHr;4q4
zAS$gTcZ&>Cv+mhic|*Huh$M(UPE(exCp!~)qBZF1(P|;a;Fa@dN;v`LlCVzpy84SE
z*R#;g2btnGB_*w`P~TAc)Wt-ykm~kg4Ro=*#tQfnb;W@t=4B}X!E&|G!91TKssK_z
zt-rL*j3HxV&?X^mf*?a1QeQXE?MnrYjT}-)%W8N?WW_Gsd*aDLn|HJlfii-k0ZpRC
zgw!P6Yo*yFy6b|+KbA<9td0z&K!RnXN3EVwSsxrMvy#v0qkv<pj6<Pc1TDHNWDW7$
zEK@qRbj=6f@7N>v(bMm_hgS9sU-$LO?s<CV-S?owBt7`YUrUJumkIzZh&_jIk<wP@
zPaLP^vnNGy?cRTw_8hr|J+VFfvPbfL!EdVQ^~Ac1e7$-)R)q!^yw?{cLgE5zQ=*EM
z$aJzH_ZiGDCX6{}4@rMNk-BfVUje8R*U0r6_#A(5U-hbb@+Y%KoDF}6KPCUB?CbMG
z(IUN|Vu%y(37_L$SUrGcF<!ZzjThIGrjJ;sY;InM9r1=9*Xqq~y2e!$@C{RZ+f;UM
zsPcKkZ*Zmi>f+G|mwH<Q|ESR~g0|P!9G)nxjkFP@n@jMPn#L<bSe(4+kd4eFu{Zea
z+M&dx5TTIJm^3$bA+EEr*3e*1m54O{Y+{N-73L9$_h9k1Jj+rwj#eeV$Te384!L=c
zKMV}@7#${*>Jnr<r_3{<oKh@Le`}K8;L;eowlH}9#`3<rqqH=9&6HfCWQiz!zP$cm
z=h5jqaB8|MCwmN4fc6~j$?DT-K3$BRAr3<V_kbOY{$jxzU5eKv$}T2COfX`K%MbN%
zEj1xn@!-~t5-qkYy&XrjR)`O3=wN+}C(-+msT<uhoVG%Mj6YqAnwuq%9fF^%X+Vwd
zv*3i#lLaM;td>Da`;wp!3r}s(Ls=(#Nv$$2V6jL`ci`JKnIf}N`w>)l_3WB9SNA(!
z%@5k*81(4WT?c4w*YJv`Ebp76*X}t;4-Wc7>l>TC^DU8~oAYpv)-Rr?m2;=r9oD$p
zGXHmvVM7RX%u|n*!0tmg(Qt8>K#TQc!b<KGt(`w3P#u)q+~OX|X_@15U}>%LHBKLY
zLCnQNx7{P3!RsvheK932o;=2XUKOZrVfTJo*n5!ra|~6YdFI7)w8Gbi;wyUtT4F`I
zz)BQxxTc=+crWnxCuxo$&V@aD`JI)t@0L4g<;)4XaB{>-Y!~gl`8F9hl+|eMB3)n@
za5^6Gf*kO(+)Q)3_R6zV>}3}Hfq0ucIc^kOxTE7buDj!5?Z6xQY4n74bX+IA8;x86
zq85@$=TJ6?LKplG&Z5(NPoYAa@b>ESc^+pVCQ7WhU;@9IC_*%x%SGV1sa{(}2B(dC
zy})Xwww@Hl%{4DIvwR`QC^Cg5a3Lx5)h2G23Vw`F$t6*YZB&K#<l0g(OC=zf!1h{&
zh<kZ_tF~^<&i)g2peao}=5(qaYtdK8v+T2sX_`%J!MfIyi&7PFV_j!eDRn@Oc#fX8
z8`Ne;|E%cMCK3ZYcGdRHV-?TRYD1=kXLwhAiwBybijA)YRchX{Mk>;qhnzW79D;Ew
zRQ`L#_{=JLpe`Z^Jldj$pKXD^nYN0pj`*e5wiw`nNsP*R)}XvSTG01+vKBCjZEJ2H
z!+r}axTlpeOro*`7lu8C1Zu@l<$-hU=*s7hqBeE|(F5~`7YkTW3MaSLtc=u3x(>BP
z&F)32=X=y%Wy8UWs)i-i`*u;W{(7N|yAN1V;8?wIPKX%3DG}E?_42c}$VxhR^iG;v
z+RZVqWfAcB?>#L10jF-PUXXJXifHKE$yaE8X%8!+{i58)8>^xKd+g;bvtn5}Hx@;-
z``}HY+@P#>AG$>p((>68eBOW-_aBmLA<nkM|Gl{H5KY!s`L}0y<1W(to_+HDcx{<R
ztayiuyXgXZjN|oX@um*l^#Cj3ioM8J#PeD@a7d~TT;Q?oK76w%%JIe;|9*vId#sG}
zf^OImy7}Ew9=^%S;d0k`qptgtINq#rY}&cTk`wy0#fR!fDS~MAfn-}LOfXd@SyXK#
z9+6g*(8}%-3#*hkq5Y>UP84D)VU%0D5D3-WVk1Ic=&A5S41dfB5!h;xWA?-O%o2h%
z;kC%arU%F@;TDWN#NNC@MrJf`D7UO<r$?>ZCz31EwjUBs$+bpdv@pVKB@X8pP=fM0
z7&S8?FI6j0qyckOTmG1m?F8D(O`(VvB??8TCFwnTfnh1x6fIm~dR@kB&mx{LVvXeY
z)iI(J6W)baJMyFLD2sBg=HXd6E*IaX$P@y#?(VUp<BLMGb|u<BO`BpCW_Up1BR_b`
z?+nTjO(Tm{_8u_NXbQQ6m=OPa-61<;@4&eSvqK)v8c3pPT%9-4hiheA(;TSuJS&rF
zE2Zyi%XJXCdmV(zD6I_m+PzE*?m82uFgoaDs+82mf|pv><k}S%W+=4X{9Wz{I{P%k
z8GYT61E?jf0N`)!(#;Q#tQ-tkxt*m8r(R<yZbTFItoE@-)1RMbWw9dXO($cHi9Ijy
z;dpJ0j@*4eE0iTsT(~B@ozpKrm#(}2rlX=%=6CIrajacDOOv%#s*4S&n%^5P(2#dd
zIhYgT#Rc}zChKdo#)@sQu&B&OR-$A6tk249edRoF{EFsTVS;F}a^@s|Kaz76_U>cY
zb1y#wD@wlZgg?7*;+QHvh8XwfchHSKwktq?(u(6Ju5|t-aM>jI?s=h&mW(ShRX(G2
z^AxPggqQajAn0GHz>NlBIkY7)rdF?;DxMc)g%b3RQ;T8shdDX>4#uY#^!)oFe-8S!
z(%)MnV05fHiQ6FD0n!>^v390*Yp%^Dq0~f#G_AEAX;YGJVQ{D`l&0;vZWyvD*J@JT
zKYK)V<cvU}_drK^cwIVYnT$*80jn&nP;Cg$Q)zc%qY<dFY}X+3pmOuH$YO*7NhU>Y
zP%h+frlgt7$S+Wm+7<eeZqUxyoLUQ+#^QRh%O8_ynq%=Ml%3Uyf56bltWbMC$kYQ3
zIyT%}JZN)Sivi+PVE*yLE~9F(k@qt@2d;F#l;|MMqj@B+f@QXfmikr!8P*M-IOKDe
z;l8p@mG?`2VZg348r4Q0ZM9%aKUbF@qaCqQ8^Ki;OQ2P^8dc}jgre)+sl~-r_M*mD
z?FohNO2$!(b1QTu6$fR41Mr<CiP%(kBUEoH7kE$<9FZs|cr^GNaHIUjVpBLOjwk7R
zF;{=)UN~x2a;~@GaRIX1cjV}%u{8o23`Ge|CL^}+Ch6MM`LWJJufO@JLJ)Wm2V!^l
zql-$v2J9$J+gS0oO`XPq4Idl;-@$QNnfosVcDD25x*q!m&DooA|1k5D&0i?A2j_sJ
zu_9kUiWm%)*(Y9^S?SbAiVk}YwbtE3OeMc$81BV+b&1wcqM$qvj<u+gXkwSp+D!DG
z5Qb1p)i{dBq=Hy6yy$T=gUITs!f+bv38~w%{I@XcqM%XZQBBEnib`wGTFtG>QFm{o
z)#`;&S$G*H&21Gjg&FMLVx*2i6sDF~QdzM+YG~J7sjyi;OG(JXVJ1yF6&=(W!a0~b
zT*GtYDvyB`St`loWRs9QLM^=~)ku2U3{xS-mQuy|&{6f_X?ax<q3Jhdj7_pwB+b-k
zbmgV*O9?7EhsY;GRd$WNMX3NnnZvP8RN>zM9IGZ3%|Y;GN(fjocyEFi&q}Kl&VD0*
z5ELspb~J+JP^%JZ@M5Dl@3h7mw{O~g%AfUkkn?==jW&}elKAhs(R?kj9CCHh>lQRl
zO?>mTsO#OMaWbWwpFBZl?>t23jx1gFoIR&j=+4KEBNyO`*FoMAj$H>1)B5sxfjMPy
z@|+zydY4k}M{8=y^)%0G$^u`M8UFzh0ubNTj<CgNV}<|`yE^sKQyhz0F|55%>jUJA
zo0LcaBF2Q3B|ZafAIj4erC4D>lgBGlkgq-SxG*9~pqIih@Rni2!@L*=qAYRXdWdVr
zD|x0n6{<Ud3V%wD*(bl&F>m*Gafj#c<oefo?eyd8d13PVkjfXOoTQ4R5hCJVlTjmr
zu-8**ir5R-f1*%ekt?r>#%BEs^N!Ra$LCN$fC5{y`q4I}ZgkHMhXrLU(>(qY%|=eJ
zoD~8u3$xr4G!{j<3gH9Ez!USMtY8DiFd0{(C^D04h%-UpkN9~OmI|vR@68d7$tSTL
zqvcC+SxttPSWuxPkcqX7Qtyc*2W>po=Yi}5MCc4mbgGwFo+oE#nm-0oT{Q4;IJA5#
z&!Khpwn2!QDad{=s8?5aakSj}FnYX7W+pmwQLiuak$bfaTP&c~*ZLbFTL=uP#)Bt&
zJJ|$>$Nm~ipOPZLrW+7HEP!41q<CXPd-7J45ahBjXz-v69ZuU!x(y>vMGo~bd^o>n
zK<CyfiH%_)^npj`t;D&884?TyIHeVMT`b639>}T{zKlpTYqT43MVeGrnp5p8pzA*P
zI=6oNNowZ{dg3Dw(CM3Y)2uDH=lmKy{N=~#jz9a6QBsL6XDh-RJooA=4Er6WBX`|T
zD`(H}WY)B_?|=|7&b@YwA-Id|6)kYw>7WRCD7*PxdqnWBqeyUb9qdRxMytylGuuP^
zZn~Y;md}Y7x48F!e7<__lz3{OyMutS!O9in4~%X3^lNm1|3HC3@qlmv!p4T>a~-(t
z9)<&7k;S|B@KIhcBRa!SCE!NH&GsC=RY)B3yY@2lxFk7imz`?bfjkR4`|VEPM7h?R
zi3z?5TKA1o?r)^g5U=)KtAf8jr$P=%vxsxWHWNW7LcVFc7Vku2c}tw8w762G)ff7`
z4mQlpgAze!Nvv6}`xlB&EcHzDyV_QJfx*+6o6ALcpqQ@E)XDl$nL;D;oFFShU%jm|
zS{yEF%x=(Aj{}r`<TK&<szCBwU?FPmS698>g>bY|Qt*N#w2>*b-r0E}>x$VnRv@CV
zI)tqy2V>4;4vop@`A>=YXfP(`1LgG8(^96O+$(5X86}J8r;z6$OGNW#L$J0enKl;o
zxzTu^qHn-*g*D%*H`!WTE!A4gLs$B#?cS{?XiJ$Vf&t>O!!GRr${*zhC*#(jUVFi9
zrq++-Ipo^zdd@mwu8yW^t)u%fSS*-OB%-cO=^|ShWv|DcR3=q4cCj}GdImIQ&JVJ@
zG38hpdtJy>CtX;JsE=5&LIgz>FO`MrAZWh8c-m~S?02|<rWGCi;$yV`sWWu?oww1&
zTMx<Si>J@fq3^#+OE136*51{N_+m6?Uwuj7vqg>r9XNW21{HZO&Yyf$$P}QRpL^{U
zg;Y6C1kwe(n)4hZ0=WX-3pq<C&S1SW$7}@-Srkr*<#(}u@tk;gP&|8CdExgXRw9T|
zA%0ddl!wn2_Z<|4iSevnIKxWoRbfGnRxSvP2to&z2b9xm&;E!N*WGmR_Iu@?6OOZ;
zIrh9%13{88lp_cpNW4b8u7=kb6P;?)v6TS4E+M(iAKnl_yweNp@TS)?#+{u1m%)S0
ztn8ci;o?2N(TIQ-ihD3YO{&DE60}z~n<xnc)k`v%t!q1yTgI-#cbX@q9tYw|1CIR+
z*z;Ojozh^CNqM6A`BFR=SohKfq%@Di5_F|Lp5;fmH`f?#4qlJI=_niDs8@p%=GaIc
zF<dB}<9k`EtPbySG%}J&Z~{gr2fRIq_MNg=o7Zg&4r6w`5S@sksW0Ar*vT8}vGv${
z71*?;RPDZ*YSnn9<Xa^TZ&y<2JJCL1>J{RecrQ||B3GpiC7C=qAzElb1H{%mkIfaM
znCorV(b@Yu;{2lMN?qlWtQ{?Z+*ffU&m*~8aC};Qw=ySx_alcR1|=A6sj!{rTp|9|
zXC*UXa{+k>J$|#9EsnJsoscW>!ceGpH(&47wK46PpC_at7dVe^j&8}I$v4u&fdAiG
zq4)v=)HrUH3{qGU+GA%YbdF#0Z$EN`{`<$DyFN<1z4^%AM#C6%>Ltc+E1%Tt2{xAz
z#GC)^f&j1|tS5L>Qa%NFQtWvN)3DXCL!lRd*RU`Vq(z*I%@(P-1}F}TeKJnt0<;J3
z4ax;jAYNNtRR&#TLdfuhVJ#+FC`5=e>sqhh+GgO-3%&;|Ac+|wk(<Boa>IJ+>hos9
z*frs>l>9J-WcYcSX?kW*@R8#M1tzgBv5;EvzEee$8LM<Fi5Xt^AD8*=a=+VwB)-}`
zuJZAw6Si}^*WG8E8Y9s5&f9eUwm#hE*E^j1D_!GSl<(o)i*)4R&GdJ__7eT)pFT`O
z7XD&1*IFe<I{I47!{<|~IT(Bdq6L%&U_>Yd5p7;3D%amhfZw1mY;7^b(c7<WMZQ63
zOQN$qfhQ0*rcg5L1yx(zs3<IEW-rbwt$TezoF}m-^SrbZuwGMg)Pj0yP!u=^hWQ-B
zmALlQ+K%*lx%T9;SW`PA@U)e^dno#yCLU`(nO9&h4Z?#0+hFem^IG<^RH8~LELO&;
z=^(-^DNdCUUL!G8)Q?8IXk+r4@IAa!iJR5>cT;suFrk384_HjJe1|W!7g-k@)0_D7
zwentbE7K+MxqfcBX^q@NjT+V!5Uv>G99topAIFvfuL3}*aDK|H7V4rTu#1LmIrbH#
z4&fXtf<cR7yC~yQv!W|Bm?_2wD#D|-U#-n4qiRyT2v8r%v}{X?HA|}#i_XgTQse&e
z$EC4`EoBBK42r?>uS6(^?Oc8HAxeU%iy4tG2fs~}{Hm!X9EaGw84VmyUpFrClx$FS
zWeUpg2j$~R&d#sF$u;r^#dh;J_`VhY@ddc~R#6mS<B1%8{dU67HT6+$lEV>J4*&67
znJdkWg)QE&BL$DQb1uy&Qld=@<3<i~(|rQn*o$9sAKJm?w>)pB7re@4t{sgHDXs#0
zD9^hgWnx1atS8jEAc{tqeL!uDSb)+(YKf}=6b2k%E7F4Dl7X5lEQyfEpi~-PZ<t$d
z7rs}oVlq)BH@BD>^UiX;DqVOnI(6Ohkq}SGwSQG?bk|^iqooLF+>)DGkX4b;IF))J
z!Gv@aPg1M6N0F()$sCDY*v+oiC{)<2UuLP#m)t*gq^fA2&kvR8AvGT*>_akF;^j!&
z`5?+P3*PZqDe6+@FNRd<g6w_3umG*UH_Q@SFt-XN_^z?>fqa5;S5e|<N{g?Jq~VFw
zP21IFR5VGwS&(!xV{`i06)shSLW*59noO?VXJI%jv|Lmwx?C5@UM%Rx&~z3RY>)`X
z%1Rdlx+JsPC;>E{Og2px_&X2-<{Ejg)WaZ28H-J@2j%}6f=<s?2HJU}C@+!?y(yds
z{5)K;(66=$c6OvGyABsFn!7%$w8HC8qU{{%cQdDN`Ag5FeBDL5@m+e4BwH`@-KEd+
z`rC;byW;md@=)Z0m$?UB{n*ZIzD|E!qh!7M(_Y^Xu4UQn6e_%qrM>kLHs9-7ehviy
zp^kV(Ej0x@?<vnRi_ZjKoEH37&qX`~B2hLFnq^-Ftr|BvIJHls#bsiG8KGogQ+kqf
zwEKDgDcm3T7>$%34{sqifv@8UMtX<}OSVzHxv4TdJWt6zF7c$=nBw+c3(#BMH+5@y
zRl&SOTfw+b&_d-zl)M$MbEx9k>M6<?IrdX&A>mLeub{TrlqWH}k>!cQWlv#15Y5EH
zit2q8rB~xuFIEfmMkQB7YYu7h0DqSj8&i1I3}SIa)HB5QjaBwgHew*Jpr31j$FB5O
zR6_(FHe!T;bm4_#orw1a&zFLx1W1=mNdjm!`4|rskUxP5%?0~KV@H%>LZQKoUq&IW
zag>C(0snS|y@DRcxhD7=y|tvpfOb6&M$mu~uPtOF5SdMW6}8|c;H$z|C}o~qHU>1i
z_^$-+?P!z7OD*|$*?YZ_$0p153TEtfpr5eCJ+{2gn|<umWZ%a5KhfuWvu=8$?(-9z
zEP<$CFy|J>30?|FTZDLJbPQ4m1*wTGky^lH-V`cjsBq0Kk4ThM9xchXBLFxv4gc;V
z#)a4!;=~NA36Z0hrMh@h=g$~`-jB-RM<*+|aF;H{@(h92*R?zm*m7R!z7heP3+x4%
zhX3};^H8u-DWVMmgNo9KR_@6ReeV?pp$?@dY(}f4m|Nm9ln>-Ko@--W<K&r_g`%07
zj_x_yvlJ=eScxz)r^ZHXTd#m;Idx<WI)la7qP81B$v$Z!S!Q;g6F!pNp>meY!?xOu
z>gibmc{C$~f>rhR2A)b5@k;*gUE)sxH@7nU5;X<k5lw1M&=a;xqfI2engv|+9{Y)H
z&Pt3g*bfD*j5&@X6^YrEZ9wi|O^f1|>@PP#7Z?!VhBRSM7H81z$(5F;r{REOEj)O%
zS<zg9o#zW}=eSh<?F5Fp(s85r{-xKuyv)9w`rh94eiFxa^wdsu*&8v2onDW2c+Km&
z{|<h<t!EA0xkPW?bBKi=jFm^GWK1Yc#<dD;mFL<XgG@+Ag^nOYiWzHNa+6wZhm@P#
zl6aMEY$XAN4pxgK9*4(ryfCkK;`Oe*o>c2q+r=O9Di@*iOgt{-o}b6TqOt2z+ESpI
zSWl*KV#-;C_ZHH5>cNpJb<HQX+J=Fw?7ildMT-d*B%UA8GaOPq11;){u3b!Sj)4O<
zUZ7ZO1(H><XcJuN1BOxqK?Vv^idA4f;c1#QPt`MmdS1>NY>e?J&tY?ww;{o$!5~T@
zZiJA^Z%JqAqN~19*VbTE%Hd^JWS2BxR%F(U4PKD3P=Z`sHMUgIkYHn`<O*DoUFuOb
zr9rRMVwNpye6SIDB~*FC=ha%J*^(sy2_hhgT(M{|EGZKeGzKR53?Wz<61wVfC9!=i
z0`h9VxmIC!T^sv4e}C=A<!AM(W4Tt#{Td!{yYq4*-sc-N|Iz+uC&toGZarM)u)$o{
zn4;!oNzFZqsnn0N&4jTRO#wyg2W1lm=qq=bm0MD6ljNeY0+pl@Gqdc;irE_MDBe^~
zsd~K7-=pVIwaJqaug9+0jok?hRx>f{+R-<$BQhxKSg+-T5$(gP9#doIn2u7fio8i<
z$2`tLw<p!xh)Fq0^$|;AhH`^9*6SH88q~}2+$g8V<4P!*6%!SGrizCV%!m>&X8p}#
zihD`fs=9+_vr@+wjXY8$W#6rF(Ir{1IKO$<(P{R&n54uasYl!xIZ$GRP|%I_7|V3r
zxL)BjNpCWSYnE1uN!-{<Ql6=gggVona1W8|B?}0&%lQGVtc=);(sCbJqnbT4yjLJd
zA#AjgD2Ru^+NoNriHK_w3A`v2)NO7FKkHIado7zve{&^uc-0@>xZ_%`b;G6F4(H$o
z-}!1^-l)gC;*^DLoO7k?T?_O{bc5gB>u+(z%ZJOKPqd98-GH%Y7E^*DEsX>LSG6QT
zeX+s~Zc@ux3v)LD6RPp7w}&xI(k3bG-l%Odgj~_8z{}e%Cko88a@bYVz;6KKl|8lS
zRZ;0RY9UZ~C3%m*S(0r_mc-ji=lIHEKc0;2)jT8yWHk_zyfUTYW0JCWrT|(a@8;H4
zs;atb6WRkSq?j4T1*IqsO-{mA1U+AJbK&`9TELjhvnfnVIuz@Lij^_gDd;%ka4D=u
zmLHZGn^NiYQZtdv3k{}?g1?8Z4kHfr!1UpjjAIaPqx5@;*X3HMS76nsR*STrX(+|g
zd|rxO{T_`$k2a7q7lqT>WvzUF+m-u}_RVs~u3l9&tu>#(ED-#<7c}VE#9*}SMrN*W
zFQIKT?;-E}XUk&G5-aF>j%!t3x}>%#xNm^a39tK)%O7vJ=eNm{zVXWI4V2H9J$|aZ
zl&c-v9O$(?&l~#u*K=`$*^;8MT77xwT6(zfmso!KnR*t{x&(VGk(8utRB3l(vXFOi
z7x#qB@|VixLG!CX-4=K+XkM1&P-TX11sCKo6@?8mQ_zZ1)PJY^%wY8lt?;iT<C<rv
z%_>RYNzK!;^Q<mn$h}p)N#KlT$Y8FRZ8fxw^gYzPEv2+e94}YWN3PigNfA1A-dnyT
zIhU$Z#N<f@dpVLu<IG4w?z&P@IK088#GR~hrM#0!Nk^DUOVs|{QVy&OmXr<DRxPb6
z?nc><UM(XxWvPlw6?w7Ft`qW%JQ)mC-+NYMv8r3UTc$S`Tv|tkb9zW5MoHZU7E2)z
zpj#{$DqcXpkIM0Z#?+*ux>!J3@x@+Z5c5d1w_v)hwprQsKA8FM8zHdbjPiP;Hvf$l
zLRWh39nHrTPX0@y1ZIvKG2R_}UG&Bt*W%P|<yr3Nch`8{rN40&D{A1il_mhAH3WJs
zk-<Rfk+cFKd7ml~wz&#dsjMNwGfVLw{GDq`q8z2eYz7}v=Ja`uG2t3gytNlnKA1p(
zMt(s2qN@quy|@HFv%<2JNCXgzQa#-mg_?7jDb!WzJw-8D^GG2h*mFt3Z)>v&1(z8e
z-k?Evi4uphF2Q+XH)=w&SCm(XO=Wdql}5aRy~hnTw=E<r&tq;5d1`AHhcG+XGRE$|
zo$R6G&yqnP3QLeU>zGW`L59IpNub1fcEXDrG0n6yK#(^atYEHJ<^XAC>P;@8P*4H5
zm*s}ps^*k}u~s2I+9JwKv%*#Gab!_Q6f<lOD7EpV608#OD!A(Kv`W%oo7fkUJJiZO
z22geZg)}wDhkKXexm`Ok<3<RNF!R4#oOI)aReas0-;`sMUv-T)j_H54IOlqf8|wfj
zEAS_ET+_X;;YU0DiOHB9U4N(dNO2tMgqFaCM3QLQ8qFNaMS}gL@DYR=*nkLWAYg9*
zP>M%MT|M(mltiK4Okp+uT)}y}cuB-HfvgaeL1kp;nX)8{75O!xV^RY|Q&#GMc+<x&
zM&*KA6hom(Pb#cOYms8fzycQ*dJpeX?AM*G;U`{)75NQe#*;C^h9@CsNl8%hrqX;t
zF1z<-9-@|`@)(rn>(+Hlu%Yz%lKU&OQLA8(D)AUo(spJJiTq#G@5K3PI;EG!<>xeB
zao&CjbXdq3>K)^~XXaVUT*44Rmq{q5%0{T96-!PFSsJ)fAxW4Z!r-)|IqA;=-aX*P
zMsmgZ--=Tsj)gq1sS!TVpbeD#iPibSwGdoYt4iHPf64JDBvp2@X|HzfPh$Aja?h~M
zZ??MjoAJDF#6A8pDX(iaXnvB<c)7#j=%!Mkt?5f$zLq*4Awhu-VT-~r4=6Vo(X=sL
zlPtca)zT@I6UwZxLTh#W<a#Y7fhs>W1>-1PGzZ9`I>liwc@8UU<Zz-2{b2DeLu^bR
zO5D!U0KE8YoVo8T9O(j`qCP`{<=Sox8l&nedbD*%_DGc~sCyO}Te=SU4edUig3<~W
zo%y0lBqW*a&yxrkMv@RROiC>csftEsmc{Hi^t)({E%kjUq^e5Up~o!m^nqM8>(IQc
zXHN%w(dnH~Fz|vJ3swq?g9DJLmN9LWL?Ic?3ie6nc-3feOH^L26%3VLT_`jO1(umv
zq^0_`3u@K0$t7*<TFOA|(qZ3B@8d=(t?N1anw~da_CMeB<9dyaxQ!Ebbc>yi=Q_s!
zX0Fp~Io{}Xv9s$(B3BS(L<q!b!00Px5@0if{zxtP+>&P<dUBSacq>M!&Yc`!F?1KW
zG0avo4@O_lbR0qJ5^DU(T6SbKqgcA?85B1wBhTr|@)?CkS|d^Z%XNS)5O2AH1Eum3
zA!1h1kt$k0+Ss95-ibNIxu~Pt`}0bkn0b~i>_g{Js!X@<JnrSUD`vbke?jSaP0<Jp
zIg=OW6P0N2jmq!LN=o@0x<b?EoEbNDxm&r<f272rD6K?SmUZVBpr|*sf}0_z#{|Vv
zTjBze1c6z~LTEK{PF+r|9xPNzzT%*;q&3_O?7_^apXBauCb2Xm9=G-~8eP9a#;B1@
z7^&;GGxIX8^*|3R)B?QR5w`rGyLq_Msar^^tNAS93O@+jy4LHjx7GP!JLiT=&y80;
zcZ-Yd<bFFo!qz|C$vwgq|FQichMk;z9lyKYxx3!qPgXBl@#pI~g2gU$5K^yDl#5D8
zuk+`Smp4LJFG#(b<k66RCvl&=gQSGrW(^*r<^LooFlf_6<UBb^Ose(FDx28JAhr0-
zQ_vw;{6$%ck_RTGqKuku3I?PJL6cA!sFw-k1&JpW)yvL2_r{X$SyJe{8dqcvX9D?x
zlGoz6$}-fZl_cp)($U>&`W2;D1nC?Q@<eL$Y*p48d}oTm;YBCmMXNBE&rsc?c}+ID
z<dr3*<(}Y-LQZdgMv>N*l7RVXZJgo|`SX)Ps`~z7f<g;bRV3^bjX&vZiASB01;+Rs
z{(Qi*TZLBWr&2UGD#Rx*7SvDVRe((>y}5!E*R6%pVx2!Vsa;4LXb?ABOw!+$<b%b|
zCEiMJ`P5zR5csjUe7pJWDXz<Zy<K6mW5s1(Y^}U@uFbc;CS9U*;*PF!>6ibqD6T7f
zbmi;p@R_dVH?P0I_D{L)xxdP9ueKLApJ>$}awRE%98p=rS#2apDQ_s4To7o{XzpGO
zzBV{8M*lo?wf=IcR%k>HEz{(%A<dLhs%vA}6$VY3;?%NGWQDWsv4eSVc8}JS6x!UQ
zexWy=6y<7<3MJArIL%{MP*R$=X357k9*^-zL&c;#gDJF_ygTDgs^W`E!hizk_wy7}
z(mbeEI?YRcMKXmN^qR_~wAh&uO4KXW_!l?`MXqxP7*O9w&=8S5n-@wK7&K7w2>pa;
z-W<l0doXfFu)9G*GhVHq;;<`NgcBa?pr552Gsze8%x$3_f@u>~p=dvwOuQf{nW3eF
zqooN-%|j`zjZkVNm+xz~CbY`2YI1x(m69Ww!2pf0h^V0yv=d7Mt}`aUXfNZ&+EL$t
zW3;v^e=a>PySc*FUQL+&dk2c{a@X7b7_M}FyzB{KTfe=+cUvf~8=<r|eIKrPi7kJ;
zt$S=!INvD6wH<}J>GW$*9$Ss|dVaT)=e*LfmGbiU60$Z~@2)(M%Z2*UIVpsPZbO;1
zI+33RkCTweCo*p%inpUwZL5bzR(!~mP42~HTg^+tAtZ^0x@6~|Pasz^_)<KHHl+BM
z#Ml~2iL_4Ms4HzLl3SH}j2Ru^kt&2klBjdbyYl;(YiGWK#nV)QIBCNZs&Pnh-l+;l
zRkU4cCXWfhf#{W99V6--Qb@6;hLm*TUY7bC&Y_+upqsgJB`Hjy-?pjvtq?6zb4&B=
zd`>KFpqYuQDVi8ld{dkgQ^JK&^`*%zYUEmBU2g${qp^pC4w25!sCEIUx0+Ub!<_m^
zrfZe;BGD$~3IweN52$aBSBumY?B_CARE0<UD=%^(U?3k14ZkGY3)K2vsgoVFO}BWX
zQ41-;YpX3bCNCE?yBf{b-pR3TOK*$wH-8>?{ChvHK^|>+Z08wws<i%PKDN6iwsX!-
z*4Iwg;+uZF34@DU+zP@9-T}iiBIL+QFJ)2;x6umXNqMQvaG{rH=5+*1yj6E((+xeY
z)EE;^^MO>Mj7L$t5a}I7A(eL0-vudKC%vdhbE-l%o7k+HHV@S0bY)Idi)x%3JF+!p
zA_}&&s^`L()O#qKuCu~~)DgQJD}2`ayckU#$<*!@ieNVj-wWqD(F7x&K)5@T+hbLk
zL8HMGU+kEE$_~_qoj5@ftn03vlazqWyEZBszcN)9X7ayg!YiWSRNyCgQlHDbWK-bc
z#8_QKAbbclX-8xYcJ;~*^-GmAYRP5DwYQ7YCaI%xO2J$HJ?a;>ywKX7E|eA26w3-$
zJQFF|guY#ZOY;qflH?bp?a8=RE#K#R;D%#<0~1-8wrGsKh=rsTkMorNyxk45oy~G1
zj!i=83KHr~yZ=wqeRkk&-H78~Rb~9TV+Sv4JEy)G>r0U#g`WVeKzT?N2K#UH+KNWQ
z4l2>D<wi6ZDx}!QrF*`y%0GocjS#kN(25g<$uWT(jh%;HPl=N6UYfP_5cw`%kKW9Y
zu58w*_SjIX#eHFbqof_~1*IuyXhBKwsq$1|-<rW*6dhx)oq4V<uBKycS|_XIsaKeL
zWH~u>splYNpe(evqI@1T;aUiC(d!jj<&K~n1CQT{$~I-?6C8}Ff_c+wB35pz(r55A
z1F8NYS{t>Hb&QhY7CPlirmU##h%-?2A#+A!Yt{UflHbOz?3E;Yqlsl{#hJk##N=0|
z%@o(w$`|Oz1jtV?N~s1MB)c5YUWSSqxh{rrUDE<QFLbO#J~1jJtIL*{LQ=&URzp1#
z2n@dbGAZAJ29#xpTQ2_VIl>M<-|qJ~e(EjmH~6@o=YKPdkJ%$!X%J!CA7A#Qf7RCj
zjw>M={vQx}J!|pNkCc*jMW9*pN63UcSRAEQFGOkVYOZ^GdoQga9!}mtYa;KgB8S-S
zwRQjPDK4lUgt3@g^90PZ2o|UExLWF}ObTl?RuDEfVu=cWjmf0qy6xs?p3SprL&uU-
zntx1eIy+SbIXn>;_?bg<res=IiWZv_S)8%g*QVH$CkGShG_^6Ld@b?3a?>?NUzZA7
zHm=yZg3)qKP>@n)s%}%elT>-0C>a!@m#i|0)yB0Zo9e+<78{I}>YbwJu%}h<HyBZR
zk0q#4jRbh9Fm8%oQ3w?j5MPg@km!{KmvsXT1S5zRnbaT@s5vv2jW00dmtXQs0S4>^
z4V+FIbmBy1ColI@iwlT*Pf?wtQOg1AW@ru3M#zrGh$M)pL-f|!*P@`VN%(~;eYgc&
zcpVaIdvN8|zQ1IAH(Xj?{rRtUY<nm>9rOR>YF+=a#hh<z|7_#EU3$u;=!n$llg5Kh
z3SLQRB;%Mv@It79tO0?DW|AVbP1xev?aW}sD$hge=@(59BQ~Oq3I+O+|JD{EnUtc#
z$NhoDv`i7y#^3{_*i2>$&q5e`e_Qjm+UTB-=TAjr0A`yMk^f%0JehY@WZJHyb!f6x
zSxH7d$uli{-c6=@F<LXx;m0=RJ4wPYKhr?!J!<?;AWI{(Olxh1i9_OWS+~bsfpygP
zXdZ8yAWipX(bLQmnx&((btz^~MiqOll|af;y{bA=s<<Coy@{8Qg3^-SVDJ)4Wp)S)
z(#DZxUNyr=8P?jR7**;~p?nh_s)~&;0UN_}TXEaa5KUX$;}LSi!DLlL#gSS0Mbo@k
zJd;T!FI#$=m8hoCN*fad)`B&TYYiXn16L+p0F^DAtpxX*cWgs>(X}6&e*Y5^$~Q#c
z-C(78!*%dwj-3kTf7Nv6mI`bK%FF-u(;>{tzG?tr!dX>vh%Lw-2q#$8sLq|2Dy(Yj
zXO$Id{d-N+Fe3zAc!#WOF)v<@!H%s7ekWo`T28H=UEMe&r-gLkJt-uI_8mc(gX*F<
z<1td0$=UJyD^*`vjZlyvN=P+&^Qxp!IjQGX)orSj;ZBvu=RDWTJwewhh2^m|wZ_)u
zvm!HvPl-k8lMe3)^%#Zy9jMElBlQTq5`JSD+0mfX#-Lfy)a$BaTSjAA;^LmOR#jG&
zp7h>OERuT_%qt9PFl0t#aVXMTzIc0<*-}s%wo;f^bd1j%Ut_$1c|=S}+RZl%^YL^R
zs!>C<dSSS!nG~SQ7nycS9wFu>0o6QlA<?I6I<4&`1YsZ|Hw>MWWkRyt7%h<o{5wn#
z5CJGbFcZaX%srEfHf@Z{tB-KSZ@2AvU8h9y1-rfD>WVO3ldjS0x`u1*<ajd_%1_O4
z$;0mS*?+3%Y6pY6;y&8p?`MA|opeFRmhS5c2Z=(OYHSAL1pl2|xu>Rbm`Nc<O**Dd
z0kwK3r;cY9l!3fbhFz4{5cMLB#ztrm9!TusSwZ1JPt29d=g1ct7G!~#OCBmF>b)xt
z2ynDykz%)qF||gpAWd*~FUMnSCdM^^d4^%=^Mva`L8X#T5;HO=R9w!ESkl<Dc;WS?
zrBr#}6OElvf@iBHjnz!-6p$;+A}GEGQ7o*=NU5!iLz-}8YI`sEZEZ2i*>)^#t=OY8
zBh`?I20f}*rgam^;)JS4gw1KB7<tTAuUnc&jx|yMo9&g_p;)UTqPrw7tXy*+aDz4e
ze3<J~O-0$D(PS=)O4WZWe(*pN?Q*G@F`hQ!BKD=+ekn5_t47&0e5nmqW@7!Y64aI{
z+Rvtm!6s>YJ45&2l?C`t1jyyj-G;K+wwB!D8b4`C_tUPKc4Q>%)Tp@p{dPPb*T3Ml
z{D~ibS&ayxK!fDfXzZiRyE+kK?Hgsh-;YKJU_+OUYU$gB-#gL55>lnWEtrB+ExarF
zM^c4Dy#=xStpK<xkC>Vi$`LJbxz&6qjLn6;tf52=kExii#=f%DHP{n`p=>f^*TG9H
ztipMgD+y&hR)wI9!DvNs^{vK4Ua(SDc5g4?1j55~+9b+<G;eD>(RfTTu*6-9CrLuD
z<&dRL&{Y&A1A`&6=gMX($BPmPmQ<aE)OSpaNqGL8KF?sF_ZF^Ws%Rg?+iVPKY>h!K
z#z@pur_53Y(31^{SqLfxC54{bn2^7Pf5V&eT7@`JjJd$W4NC1kjDomQsX0>(n?-9i
zz!N;-RkpyB)aTFU^8!p(KEIN<SH%PG^JrGkrn=0#046_u$!`NynxT|xd5Mh_@U0r9
z&I^^)1WW@GEXT!KeXHAWPP#ho+w)K^|8LsHciR#YTMDABy{)Z|8!fED75}jVL*QCr
zwQG2o8>L&ftpH|jc%${YT<<!Jo}ZYVagEA6QujwJ?nb+=V;4`R%KYo$U!{>CEMKZr
zyH^C-v{CpjYskDShuyk56m{+GM56R}nvBGkQA@qhSeAP#=v|ePW-T{NZ1`GbQpi2&
zck^SHM%I`uZ=`US7Qht`B%@TS3BQKYO7#%%TOeCSOk@%vELt|N!(y5JO$ND5YlSgE
zg%2pb<d@6UL+eR1MfYOtx}?fO;!K5AsW1^sF(zoyyCOS$sc>Ot3D@osb{>_?zs1S4
zEs4%c=Lw3o6{Y7@{>1=5YMc5x(%TUOanDP^J$`5A8GGGA^{7?hPounlR!a3m$P@5{
z@X+O;px&U6h#jgyjahMpS}i0vgv&gT32UC3M>3i=!c@tFQ(8$PstY|RxkjsI@XaTz
z<R(?c5MxWD$&{5@D;ecIe&W)+xe(P_K`WH)%lK%o=0>Q6?uu9X*H7*7Q(}Jqw0QwH
z`t9xHdT++c`Af1oFF9iJa3J@3J%juB&v@Ku<#h@v*;U%MQxKso9s+d=D?wa<A8Qq?
ziCGvsXmUDk6>6;8bUp;(a4xqdg*uk9=!Ckn@+7CJiI(WAh!CoFOeU?Jo26pFn!FoR
zCtx9i5NQ)g+@BRCgz|K(Do2urU2#fWjcByduxDjZW#Rc!S~wW7BYf6p`Rq(g>8ep?
z;?cn`+E{P2y@-)T<mmK*6*0EDg00ckjlI{#kaDc>42{iss$>$(TdI`v0I#bw?+xd|
z15AuWqEx1e$mdf#HLq{fGS;%xx7ga;dIfmNLCeUz)7UXDgF&FRWRin|j*|;^C2MI-
z0$dY8F|;pP;4@eAmR49XEfporvtPHyv8)DeB7ZlTR;;K>+F<KxZOs4OSBlDj{~n9$
zU(o=IsaMcAD&Ff!YpP+jlzs^|BJ#a5TgBUyg4;Q5r`GAEainYU(q4bojXt_-UW>x`
zNhz7F=Ie%z>nG-x{PZ2yGZpE#H()Nk%7aweVPQ03$f(Bxu#bLIH6?`wDTh)&npmqi
zn!;KnFqx7etU?BbR3H|kRj)!TO$>**bx@9)7u0I5({NB~i8+h4K)FG2;{0Hc7<sa-
zRg2JTbYu*~(}WpG<`t%1R^H}AJvxw3lvEKV%#sz#By4A3O8H%@Xjf{sNSzV|oaRj&
zq4@B1#j;f(RCtmCtz}(I&7eg0lv2wO(zu?^oX)k+r7Qht#zoy2)gPUsOTC`AIFaF6
zQZS0F4|v|j<66Bp>ROoKa1U2JVURw=VCb$@*WEl%pjS*G3v}Ensm0@n8S98*_uLTW
zGXy)W#CK)vQj`b3xE{&kffAb&3#gC@VBd=7`2jXUv@V{uXez}qM~#;6sO-hh4+b2l
zY$X4S4Evn0MIkUVtd(FT{w=9)JetC}r8n|O8_~v4u-T`bnk(Ar5w3LY*PZnS*~f3P
zV1A=@!Bwvx$y%SkN%y<L`LoCMjAeEm{-sc`*E?DASr96?bh6DsZ*GKv?59ip)DTTD
zD@#yH5kV$RDaDlxRg*ZmRK;Ln4lk(JvzmS8QA|nWLbzvDSzSNLH;vN&56VmO$_D(|
zR2go#I20J-W`GmRUiUy?JW4*2u;E%AuZ%B~X8{vi>I6Dv-eP4?diYJh*A=UEf(Mdn
zMdl*D6uVlD;(bPob2UnT*Roep7>@3d%5{R)5(K^6OD$EE#`<tb(s12Xz94JDspHde
zXu5%Vl#-r6t@SNah*DUW*4WXjk>G%0ORZImUnkyLPU$^}e{5c&l!LPB9&#NciQxTs
z|1|LuMJ1@g&|}9(P(65}7sq3QlAPn0u~=jlplrn|0cm0l^|o4#bxGi}20^2uA>UE*
z2E@Y1X@g(z0t)c5Wq}e<YrKFqSQ!EiTv;EB-&Y7fo?jd^KD1`kCX#Z$5K@AMFo3FV
z(O;{$heCSWM?XPF?|rM4J89_RnUi$v$sf|`S6-y?+OkaIZ4bVk{>K05Kc;8C_ci*%
zzyE)uogSCl%dh|J4N_Wm>8lBI8H-q7rLcioYie}0@XEEy(W_naU&Uib^LQ<jzQf=A
zH0Vc+0Y+_ua0APaVP6@>7?|Ypv|8od!vM-WRN<)}mqJll9#YUA@EYV36q0%pN_x<I
zFt3}Z!rk*PtE#Jor)8E{p$)TCVZNEEf-fWkKw?p2@9^Zjnnh+bb*G&}$o5$YI!U6c
zqInk$?b_WFZ%JtXR`Fcoa#d8M$tqg}!#Q2BPaT#dRVaP-Sa1#82hR>=2rm-xBP3Xt
zLzVhSL#n5(B|c{<PNcD{u9je)Q;Nv}%5+c3p+a#`kP9}}Bw>8*J-CEOGtlD0@N_XZ
zqWnxSL6H`%L6oj^VT$BYVw0q_3K@58u}{Pb!GVxszeq^uXPfZ6!86D2izS}W`2xwq
zY+3Mv09=RU;0Z&9D-8SLxk`<U^7l0lGN*age28WtuvT&u6G_M8#ve`>$uMYTVpu<`
z6Hr@QOFmO7rS{{BLZ=^~N=MK>T_`05g%_l6a<|dq%%b;Ws||=nbobldLl1xW7o`G-
z{~plgtIs__U-^UIr57Lj9!)mZ>GaFb(=scy8+mLN5|{V5Zipb+;sU6Uf8gld^y&ZY
ze?Z^(!~dEd`_i9m;~LgMmaeSWuJoOMf3;y<@Ao@8-fU_8mr$AP=(uj{BzCn2y^df|
zs7_*DMKI-|t5B@)+*@5J)jTs=cWM@CRT;FiujUm=f^!wcV}g*DzJR%QB8GsJn3J`)
zM{G$HXJO^;U|dhEB$CB!YVpQ&AA5~MiRV<ByVP1tOY+fhT?pT(Fr7eLndYNOJ1Ejh
z5t;@I5{V{Q11e3DB2sFMi30+>u{JEygfmkwN4-wVcO!%D#@3ZSD8V5!cvfLdFKQcv
ztTF5T3A~q^GJ%4!@u(f)wGyL*h-y&kjYv`}SSKE;7zv~-N@-hCsn=NBb0C>qTFx{|
zxPdZCURkE+Ml(XHsr8AB>Xk+vhT?J7yOBL1sUu7yKDn0Uxk4?JpsbWKFR5?1210AF
zloolyd+fuW9pf|pHxFo?CwDz&ve-7jq=Cf*=7_zJN)id#S}4_G%FHLkONDpW&InDS
zEBh*2?H_G=)}vS0!}^QQ|1q6>=~=q@?g!{yzwl|g<E@X-`tn8byiUCEH2rt~@xQN0
z)-%7&;i2#waW{Haz~DQ931++(n;L6ImzjIrzHWS4oHG-4WnE1-KaibV^as>Trxd%k
zqUp%<LfDy35B1-<XQl1Vt)g<eXGXgZ-o%#LBE4D18zzvq@GxhOKyUP5Zp`s!4)2ED
z>pCtZNvTMwDYd-Qpr@stBwYz{4FvvCOVIY7cZ_i1pJ?h~R?yD~crR&G%H2{@D_O3V
zGZx!Mp{ah~DCe~e&f-{_up4J!F(opT9<#CEOG~Im(}kd1<g*wPaYAa2Q%n^pyi`&T
z=LL&nHBMWPiLl@vjR<vPDr(yi-S8EPJMb7bOv%E#@tiL4-eOGU^}G#9X0bN!Kjy`V
zg&aZVeR__ZPFbpI0y!eH+^Q!Gh3)Yu%?Z=09)MHvyi&|U>Nn;Ri;MPN0(A-#hKY|)
z`m`a=#ol<RRH1oHF*8F00}^sZC0EL6!X6jMgnbOMQk)Z)ETJufVvB4135XU=WfkNL
zZ2&3MdA{(4sd-ZT5F>MyGrrImLCJoQ2iMdKb><P+l;ZJ7NG7$w#0oRI>voQ<6j)tN
zX!XKbI`#5%bndlRXyx1)dhaLx8XdUhHac?GeYAe@JbmDk|1)~=@$b=NU;Y;i9lnD;
z@|%B~_TPFZO*hu)iEn+0zVwg&-~7x|+IQ1Y`oO3E7Tx*QcZ-60`H4sA>;L2*(zz4I
zMBP60kzb?-Kk##O@YcI%W95Qe@2PM9IgQpX(p&iRcmCWbX>Iue9Xxs$TUmX2>G8jy
zKmCV)pT}^H{>K0LAMipP)7;W-I(XaNG+w<(U*l^(`OPn|1vR2Qhi|6${>tB^+aG#_
zva+OCe)Jdg-GBc3bmo=kMG@Zh&JWOAKl00T(>-rtVKAl_e()`N^iThg_8vJ(AOAOh
zoBH#M^ugcwx9FDp9;QF~fBbv2^${+a;mgnc8zpeBc<ndfhS&2Pf9X7?YdmiBb3zz8
zQ7d?vx2VcQ$qcsc%+u1?j^+6TRc6T>us?a$wJ*sF@2qQat7yX2m}}}4nD915CZ1R9
z*lW=+vsBq3#w4J@5R|@yr5DN7kcyKN#7ijDqZDt^Au@X|uPl#yqWej(dpKj#y*+7Z
z-&(E}9E!fEV&M!p=^;AV&BodlCDum2Izc)Qu2_6dyg{VbI~03YABYAFMb<`0fxMG+
z0@NxLFGO>>>c))=^`xc5R;Avg+`Dk{htI!O{g*XhaBpp-oW|y*m+BOHJW%IJykEpL
z>r@S1vBOma*?9Dz#!LGW#sTZt8moh(gK;Beza)EEtRL{|aj^><mE>iJy$}4A-~13k
zQy$Gy9yM1C8QJ6>O(xhXeE8beXw-UI;TpEcmhcrn02IUVrypm<aVNd+m;XBLJ#;gT
zR+s6(t#{D!*^{hH2K3Rt`ES#%1BdAGFMpQyv!Z(E&wYws{_*!YHue~Q_jl-jB=0|<
zZMm-NKy>Y@I_IXB5gsx?1Ofy>5(GhjAPELhB*iF^w6bJd?Vwi6sfRuM`+NNU-`{Qj
z?;h<AZV$J=v)uBRB{peMq8P=TKoBHIfXEp{jxXMD&Z(;1YtFTHopbL!`Q8W8?jkSV
zz2{Wz+O?}{&%M@~Yp#o5eVsg}ZQu^P?A6zDP;dFn$7J83GvxaB{SsYsPdsp^>^toY
zx%NFD;pew}=A-)eVL4wx@yN4J$P@S6E_)B2As4^)26_3N-;?kE=_eFOUnYC?m`CpT
zuDUR9mWy8bI(h9oepbQlJ6s4{|G{6E%dUBo_VX#}te%wfUU9YF%$|bNAIkFngL3@`
zepSKke0k=Pd(~gOC|BI@4q05@BR}}!C*%q3?->fjFDk%3cFzyCjoYcvU7Yw`l!*z#
zLytd2NO7v%lhd|4?|qo3-#bpup6Vo{zVNVu*hF3U<en(-;&CI+olsFIEaqcs3c+dM
zLTRSN%%gT+o|u1rnmXlKS#mNbZGb>KG`fOjMc8BtAfhYLb^8(!rb*WT!M;fDu-t(o
zPYMcR<PDzQEjnzNbm{VhgjMeJahGW<oDy&GC$o|gtC0DywW~;YDgXc@kxy8(lJP62
zn@4v6x=$_Lf&^+wK_gk9(OrW4F4oQ1)pef)lN9Vz%`B#sp>`SoESRWzYr(8hl*VF-
zmn1tC4X|nT1uGO>C$E%)65NbUf^;nnc?9f2YBnPOjttbg09`<$zprtK-xf2gRJ@LC
zb8T!1^-#1Q8}MW5=X-P_hV&H5k*q-@3xy>W5tjjKBvz=YjjG0KuC5eGVZ-&WYQIrv
zI|W=BgS7fwWo<VJgbh|Y$juVl$vYLd{F{DHf3K?*by6)be6m+TMcgfjpZ3zSob|HH
z<b+yfkKcc%{P63alY@uPQLE-*S}K>SRRb&PdkRzljmzKgHhoYRX^mZS^&2!uxh%JS
z;S+MVT4|@Bdy(Amv%fCqzWkN);O!UcgHUKZ?IZ#52VeLj1*tRTBY*QBsHOBK0#{bp
z_prc91=u%y@Ym#3Z+kEM2shtFSG`W2d;CGU=cX^q`thUkhM)a4?a!O!xkv9;EA61{
zKm9EI?hA73=RPKT6co?Z{=!vy{JE#(j<0=Mt-<%m!?)cmcWVDf4qTY}<EeMpDR|A(
z?!4Qi#m`UVHs?U>%J|LMh}GO;nx|PnuHHa*lFI>QE?Jahgwk=Ke#e0od@7HWRL==A
zaNAWDRL7*+a?$|c29tB1OG9x_|MrVXN|O}KMYPXboa8+l*?=I$y85mxN%BnTI#b+8
ztiU5Q8mWI+x)lklF;9gmgP7`3kfa7=pqZqUtW8eno?}&4PW*5SE7k+KP}-3W`2{Wq
zMHwm=$F2J1T$1ZGkzLRyT2w)tL0DP%rZ#H}7FDP+&hK1M<o()R(HSJR0I>1NlZ;bv
z>&|r{nP1njxE2%9c|T)Q)f&%20yGL^xMGKaeV&$uRv-<&NW`PMVEjN?x$uVqovH#W
z8$<jMgbfPjf`vj8ww9F^_=S~gRJlqp{LPSm0)155htdo3HF~a5NCTEAZ1h)S+U(x6
zF>KLiVx4We+tyAV-?VSp?Z|gO`-gJXjqjA7{<Ysy7vFJtT4P{8QkUR4mt3KN#6_|X
zpL^mF0{Hj;^pACbTXc2oJN>X6dFBau@`1b6vUyxK)GC5&@&dJt_MLV%&w+}}PuzRE
z9C`Y2p6l4NPs#G$15F>Ed+Z^){;)l%R@>F@_@IL6iX1%iTv^<+PtI4cJ9O3sjK={O
z6Y&DM4Qt1b$>aCjMyu-h^Uts?^o^CE)vAQ-&HBk>{F!a@1;-AyAG<5=6e7{cre7lK
zY3}3Pg*D4@Q=ezT<C1%fhf3^iYcb2EsrN+JR1~kFWr?vc3;;kO4v;c}3v@eWTY_6t
zNx#s&WVJKiYPZO8PjH2W!%49gFTIr}R%15yD)S~4Mc>Vs+?k1H-sl>-U~Q;_$F^OV
zHl}kMeZHZ<XMN#cT1z3tu1x!n0N{!oX7L!KuT>axGUZB<iHAA2W#fSf--s)f*S1Oo
zlv)zIVUSsvG#>e-rzl{IOo@X?%6)oe-8?kBS8I_mwb}utaGE?es}tt;RisHA=NKpI
zKfHUv^W~&!l9e-0HOSoJ1yFX^BFmhRO$vtkLhiEj1eJ{LJP;DF8UlzdxDaLslum85
ztKTi46Nrsrm4qrSS>@&}DDtKLZT?A<_U~tJuXar(ex=Rj1??(cC~ivV18DM@o~rGf
zORtp6U;ic@j5Rr;ll<TYhT#vs{7Je0d*74;htF0k>Uw$2+utY0o_j`PQ!i2$YiZA3
zBW~#3-E-g&!EF7+aS|=sOZ!Qzzy^06;#d`Gnr)o4%L9{00jv4F*CR<IZC#CJHNSW4
z_rUy+H8Labx#>&tsJar@)Z%KXvm1bQRKfC<H@=(aLLAGE$z^5#Az4^nA^4_k@LapO
zO`6cgeRnF|R!zT7g?aW9w#{WNI(W@|+?F<GJt^{?K<>&D!!0u%KS~Cr%D(D`O71jl
zmi${YXUK>M(pV4u_?GQ!aTo`-G@k^E&F3w1O=7}lUQ=npt)!$ob4_9@0n#TPSk0=~
zkf2Pv(5o^R(od%LD#+|Z+bqVemmi5$-#uBz6zd93#)u@RB`Xit2rDtTrDFR^qbrE`
zQ&PT2L=`L2DHgj*`CM+zNiz=p+F#;I8C5jPDPvz9%*ckU%u01|B>AH@Hz4JuLcc<B
zqTJ{1`b_R#RAVN%6)rIB?>pmnXsGI|-UGbRe}G_FnFeE7x)^Urzaz^Rnd4MuG9W>v
zV**E(F*y%cjvTFu{!F|1m=u|aOppg7sF1ad9tCyRD$5nvLw&=@V-cWRXj#buTyqzR
zY+^U5i;@OplH|<s3Lf0t&22^FKj&Qf3VmQ(azNuu0Hed|4ulm2!Up0)d{K17R}_fe
z@@Ia7Y{MU^^#YpwHEQ)>pZjk8rgYZV<aO`-u)6X(Ts>W-fB|5*{mY+{W6wM#XJ34|
zTygzd`68Zi!6kCeWmhV&JVmPgVYQ6r-JXB^5n6DFQ$79AJtTgdr550VT4QT!O~G<&
zYdq`n*T0pZw&&pKa?z_^FRSVjeeSUb397ii=UjG`oTirA3u-ZL+cr%;gR{|u8?qaK
zFlO=#WA>kBvfeRx{a*m|u<htFXF1qreolyp2VtU0$_c?uK$A*}4Dh!+Z%90L-c01R
z#Z1gK=PP%Q^CSg}(ybu^k-G(Ht%>!4)`*h_a*w6i|HP}ayF8V<?}!7I9b}+Unozir
zI)v@j(W}bmZZ-LFDNdGWE*k3(FujtYPc{+1*4o`}3B(v%E2A3)!7WLfUsFZo%&oqZ
z_eK|8Zq`q--nK3hD`zhb#_{0hOX9l(=@ehmF*l*#jAF#JnxYeJy0+lZwYX^~*8Qs0
zi2%Z__Pn(`HUh$>Tg*kuL>G(I#mrcbsV|APUu^h5;CX@BiWLw*#+WZrHhPh&#I2Ci
z)f6+!jK)9!yg=N5PkIqZtaopt&Zs|_DoA#9pFKD}3aRuJtOr*b4!%k%#2yel9Mzbm
zcX~Ib#kJ_nnA6XDnOyfXAEq^hEAMQq$pg3E#8}l)o$#0T?$^QSnST}!tXhuOzWYNO
zKe|B{)OvdI!Fx1j^<{bfv4`bbpZHz<?!)p^zxrGDc<HsmU3mP3XXP%9FYP_;bh-x5
zRe(Tz>BuvW%N<|;Jb^1Zji>hWFtDs+7F;A`6E$8e-;Dd~n|<`zC*`}J{sVdadw)r;
zdDn;8S6EZ`-STzDyB^Zm)oJHlC@<4E+uMHixA~Icnx44t4z{zgdO{w%`&PN=)vwoM
zEBVC#{CBpG?WP%i@ZX)!-D8g*)9^gUj6MG;0HL`ooeAyD<MvAjoobw&D&{$<joMsn
ziIjnf3j*DID|{lwEWxB-osVMAD<Ok2?u3NWV_%&7fC1eBa46C_L{j21C-7h<X6=-9
za1j`@ad%u2mZkE1OqP$uXy_^o?oRYYQ|1y$Npu!uHgnNgyv`Df6Y0QXYq>O<ighAb
zh`TP68!>lAWYQ3Huu61!x)W24GF+DvF*0{?nyz1H(gvtFk@b_S(><~rI8RCP7bMI2
zU~1TDvu@#)shJ$yGXdjdSt3T26g&(x`(&9^1QLsk6z^*aeU_&FZ`T-^#2siM)lT3G
zW_3n;>T(CdqGD0UzHXqohJ)`|({$^x;%3cYUl}bSur!vV6aDS;jgC;Vq}wZHRsUVW
zsw1<91<V-4uV``kg9MOl@u`fA*+gf{WQi9!-#gK4csOtQ{C|`ObW*p2BVBQzzaM|$
z8I3bNK@fRft&cDN-al8%<+z;G@4oiYe?yCGQC)&Py(qZi9=qpuy7<2T#ZRg=_8^H6
zu+Uc3efZ@4cgl$upO=$IULdd?I_CmeRF@t0N82xIoU5x~31EBSiANdt!Ul@_xBlpN
zC8e)_@pt~Qg6eA1|EC|iTR!<u|2yvAU0;>Ezx4%e>oGZS*12l3t9w$dF2unAns6iD
z{3riG0qi?!H6G+51D4kl_x+GER_iB@%GZAXpA*D8tH+0rZF+V`EDwfGSi3Mo&eg=0
z&P+2|?+Cnhhz7G99(H)HbiSrNd5N|eUe4qmgKKSRA!`T_Mw|!@^&QpMS@%yYMaG;y
zPG(4RRvnx2AE{nc?u0YOxkA>sm@s!Cw~O&9=5%FNqQqlO23q11zPk<Gl1c7JbDN1<
zLrFa&5e`iAwQ>uE#|D#?GE2(<k>?ticg?~w#fYql>$$M3KRwAAm0WN(4hAT6D?<2I
zERNSA3$G&Z=czqcD2g$SucLg{ujWkhi+k2GFUi93EVAbI!kuf2ZtFku)S~6yrG*6D
zq++0%^4A*8N6UvYkd8@x-&IHSyUu!Lg(-uRR~YlESnRm;K8OGDEr(<62wb^|oRb<~
z8#05I2<8g7|H$=1YIkL|VA{ca!}L4n<|A&Sj!I>6DEnYa0wrq_?%8%vf8TH-#sb`t
zc&KV)`&bp^Aa}jkl@~if{>HUu%g1kfK<e4wi|sGUguj~wNBR?>s@4{)pxSHs3~m4|
z7E9A7xKUtE-%%|(qbo7i^^m^AA)jsiW%Pu@bF<t))mU$~dC7r1H?M`Og>3GdiG9}9
zkd?uvF&IAD<A7_@1Q|wsHjl+M$N4wyGsVtf>JO*ee`?^GW#?@NPW|!Foo4Fe3>)@8
z>%d+)=gf2EAAR#t`CmVDm~wDfye==B>x`s`I?yVyx=%Lww_Cvr+nU~<m3|6M{ixsw
zmSmea=>}<3&+#pQ10fC62~5nitZAp_qPk?Ftg-JnfrEfR>o1l1uxkNrK9NI6ug?dq
z2xG{tuUnleT4cc_i%8&bC3>;|B{YCbS79%DQA_We_%&2Ec^7V}iQ`Qoq9hh$&!v{E
z#C=AWUb3jt>rC*g`w88RPN7?jDdQ`(S(OgPEpsVSB-j&_X&DDo)Tc6uyL-t#?754w
z6&ev?GfW)h6O&VHAB-ut%#x~+d`?_&x_;R;_Dpif6%GAUjG9`xFE}RCH#5QpQCd*+
zG03W~WSD%-C&!YMmz)g*3l4s1N<twX23LSsRyjstAvaP6%9u16TPY)3`brZ!0jiyD
z(XF#l8z%lZqK9M@4N<%pdp_B24UAfN<J`l*l*f=YWq>vGSXT$xwN?0(*1@iwZ_GB6
z)paUQGGhOk4xQI3OxsIrQBHjhKM$vu+~l2T4dvn%lvzmFP~g^lhSo7mlGOMMeWiAZ
z{p!edOqGRg61CO8G2P(OuUsFncJ&5MM^3jc+UAB#w0o%siaCmy^&nxJI(+U57K1}y
zHRLjz+u-g3048@`gA<|I&44JQij&QuF*NjX^GMk+B&GONK$Bq5ivz_j`<jE9pTKI4
z^?}ze*~t=JO9lpOl8N1Zjj@UY`D=l(Ewk=IQzMJFE0c!pnCGsZU-grrEru7^_oQYb
zd2pAgg`Lc*^+BwyUYHGppTD*RK&mj!Ma4$Xkx&dNu{uDcg?SeGJ61(YZatK0Z7smk
z%FXu(@<uQxHE$6Tj-$)90QlA`vn?!vO(e;Iz|ykn$;LWlr*tCjc!lH;#!dRC=<S*V
zB}X0-CN&qP_~ggEy)-?FJN$mG?Z@~C&2&9K&XwDQZKqx1oFIKUpX9Yj6MCAkum-CK
zi35n6_hO@a7u<!1%@Tga$sW?U5$Q$pcuRC}Bkekb=J(PILZ;w<I*!&)>XTb1DXtU}
zK_YHZt%$L4;ZcY@T7t0ku@A7hlS0a#ktmY&L#%d7ixWR%KCwx9PW7omx@PZlx;|SU
z^ucU^u-)XJrSTG%q++6Va}93gx%-YeV-843wS-bvtu&^x>DZLSO)p*<Wl-}J)*4)m
zbVGVqs-DF%6DS*Sin~oyb>`ZM8=fA(6N&wFSgA5J8de-@Uv)?_IdxmqgO{L&T$mXL
z&OMURHcHoJ#>HZ_<7^*uYk7bz8Y{C0W%wFN&9&)SrJ!L*>y&X@kXdG*Y4?1o=867o
zd@0T|!*{1}0A}vXPr$Zo{n|-G^B$XALo(a;QrrvH-vcACbk<*zW)f*)U6zPiOMe=c
z#!^eJGArp38c+$cS>+<wWYSm$Ni8Bx<SBn?kTPGpdkUMWW`u3ijh)v)(XGLz^t}vt
zPQ+q(y>8u*JW|cBW<MuV)UJ|lz$UJxXp=V+Zd?6XF{LM)n=~|ln?hE>LCwZ0HnK{R
z76>6Ja-^b-eG5v00eP|lt$?Q81I8R3xC!*k1+&G2r6oAo&RwF(B|A8ule!PZcyb)P
zPjwR3wZ%-b@+2m5h=FsFR7!A;1^2I7Y8lFmzy+0&M~`EBF`47Al9IUx!ACE?27hW+
zNLH6}qC|1FHaPZl4g(-rDH-LPaTowBSkN?jk{!%HUPO`i6P@cYWrSt$@9AH;kuP(U
zkqMbmrkn(3nkoFwZEb(xkEzc)$2P3(xz6VYovOah((b7oum9w>IR|6f!_pf!&+~#{
zdkb-7r@C{oE9OpXIXMHBCDKf67K`f)dX5mA^2s~+Y;6<0Pqgmg!JoC4yw9B=P*;8H
z1*Mr<6#MmeG1^3#2x5(EFY}2~-0N9ee^Zh)>GFwO7W&o=kBcEyZDLyh?XGw^Cr6Al
zo{6krg%b_f;mWI>&_caF5syRlU4r<s3;n{7H}{0ZlLoXsIoPe1WF@iBVZhoAv7y!5
zb;PDJw7utE8?8+Fb_V!1e<s?ygO>kY4bb&Tp|4G9Fo7w+oiQ?Je?}8-bYWm4gm9c|
zV{{goC5<;GAqz+1W@5#|_*Re&h5x|7sajSFQg8{@J)`)L3Xeo(eaJQ(-7R+@vzS(G
z1O=9K&a6gG%?q|-mC+-Sv95jP5Znj5<yoKjHiiCMvGrKl4sqkaYnC_hCwZcrw_pFc
zPyRpYK=@-De?Rd&R@yAbm;<LTFGS@ESD|1$Bsz0Wq?x$#EHo2mvRINBto?1VvNZkE
z1y{ONfDZ;i1~XsgajVSTa4zbdiY@ldHYZ+0BU3a&up)gqBg$7<A5sbXMEY1-wkpq6
zOwv+D9S69AkN_%vvKlKVlUQ<YiZR)0+AK^PzoufcbJlTP`G9r9!j^sv=i)3`QK7NI
zNc0dVd-#AQuxxl+F*44GMMhG!=lSWj>+3(F-$v52*qGlYj!Uwl6Wb6s1Edktop8$x
zOii%PTXA5a;&r!zEe4>XpDJM^{#W$GlJROPUKj%=I@qvMrN^sGIM?*4Amg;W*wR0d
zJX|S|MJ6X?8UyQgOBPHk+AUgZEvJ`OJV$K-#Ux+C^W_cmhc`^JW(BipoBGYL2XWH2
zo0G$+w#J=f?D^;J*mT!^D%+d)nkU_l|5U(q8Y^U)YiZi~&vFG}6K-0~;}=#FM$tfz
zk-$1BORx3|Vnb#wCPI_TKd~NF9h$`5EKBYs2ad{!Vzk^m=0vxngMlgVd0tpU@(2wm
z<V9#ekL@;Eh#u#PeL>h%e#D3rE_9n&vN3X9IS0B7l!zG$Szb5PbMZP<S(JWk%F|)Z
zdUSzZ=~LiqHw@^uMEt2`mZOuwt(IcT$rg3LVzea7DvI+Otjr5p(6Jv=B<(!2d0IS|
zjiM9ntZ`}LddQe`MUSMMkJF^2XtF|iYiz7QzUVoXJ|$9zWPOQQqj_^L1MeM6#ZYzL
zuAykGt>8gMjw;M+`>d6lEX#Vg;&+87yH&N>p!5N2D{C8elPX`CK!GDvX5tf!+<e3;
zXQQgwp_YqEqGSs4!m5}vAIxe{jgTgqW@eZHye2j^@#y|vr+THj+sE%}+f%wXhkiHU
zYLr=zopZlg?)|J|@t-BuOxR{wypayB9-Acv6zJ}m+s<5jS=)m5oMbUC6)Aqy7ihJZ
zx+l)2<X%5dHITrI$*<F`8UleO_$JqxGz>h>fnrtxtfi!H*c>AsYw`G0=Af8dVde&N
z6%P@w$LH2rlCOeA7;W;kaEJq~yZf5>n0rTScY$WP^oc5PgSudDMj5!OF$~H4bC6@6
zZ7@oF0@cDnI1Z3iD7RJBu6S>EDp`4$w~H*d{(Jqh;MZNc%oQ1%rRgwkCf8)_H&}*c
zlDNw3-c^$F!d&6Q(aQ4G*n+tZ%c_5W>H*~qPqZ#N2$W@J9vV`5I5e1KM;)yw7vfQf
zd$nNN>t|4RhnzbrVe+bS#<W_5L%mHsQ`vxIN7p4*GItkZz&h(CDdVYvCMfrSS_t@7
z^>)~qeeJ&k>to_fHD|j+w|+m9)j3Odwtu&!J^Ar$I|06#b{lcr*ygr?tjLT&w+jP1
z3kb{LxnF{9-piYIENLBi-X|rMz--pV>(WY#lQHr{@%^F;xDq5hg@y{}NU|;Kf%6W!
zr0laKZ`5AMoEeyHB2ZvU+JnjRGxC|oRa$*QL+vrIwkPCr@-E$)Sg;rxV{@n>MasLC
z`beU-$;F53;)LzY>pYbcsbasjSms#f3C#r6TwL|S+^Wo_f^LIY+$xsVSLz`KQ}Gyd
z9kP^&Q{rnwY0nii4_k%#yp{$e8<(SN50Z!xjq*+-ueA6St-g?AWc^fvK~PVN1WQEr
z%G055*)|Wvz&VSe?}kj|5iTCwN~4Pr1C5HrL6<fet85Jr2@yEe2MU%`TOG|1l0^BD
zPOmh{j{s$jLVC<R2c2C9R*!^OZyikOw?~C}v&2x}tITaV0ZWUCeso6?hk0=ejJ4$~
z8U3HbHtQrXizP7f9MR0{q2En9cH1`p0$`R^_$=S={DAqJnAVyL^Bi~zwjal7(>de7
z-<!5zz=XLWZqzJX3#EtPt~W57k-`PbfsC>`#Zhpq%NzxFCxyNOL`u8C#y~&vN!=P?
z4ps2FS+QTLBu_F=g;yCCY1Aex@wZ>>FuB*T6)wDxS$xA7bkXKKlRz?S1hM~;R!VJF
z&p?hBD-}B!<oQ5qfL$iR!Txr6Jy#V;jKhMmR+$5>?U(59MkeX^HBsy-g(W^_!K^J4
zGWMiwFC<B2__ilAGuJBPH6Z4dq_7&r5_dJG8e;^?ULwi3<r;0gw=T?+HBE6~SD8=b
zjpPnZ<xM!&?ug4+?O04HqX-QXo~Bx-(=%G4$EgaiT$~9*HFs3QbUHir#%lLlw(};9
z80ZSJ2NmVT@)ZC~sBl_1>eg6Apde*!Zp5k{Gf{?7Z^PDYzR9*Za_r%|Hx<NTAI#D9
zIOliMd_V8LGjCHiK5ZX<68gI1CgP0y4>^9G<92#^aniRsleTjsge7rYh^e-l`dh+P
ze(mH8PJ6DKmkqprW*taF=t>hKCS3p!6dY*vgnqrP(4_VlCA^n%ro`QJNj1JUMRcQm
z$EI#oGsy>co%KwpJQP0vxiD->piQwigjqW4wZ&;NFIgWg24pM;yNJT`WR3XH2UL@#
z5_hATg2%>2Wki(9Kzd;@5X6Fm2~|Ew&@gSm;1(IJw~n>Du&Bo^*g$r>sScX4`@~(P
zDct~WS^!v5%O}upDhg^O3;=hkX@+YkEA#55TSstnYnqJ0o_M=9UQ5e`6{z$W-R1`h
z<Py|6=@@n0YE|1m30Yy0Q6r)@Q@Nvmweyy2pfq!@rXRH9I)n>tXQ|Yc-8^VzVW6NS
zO!HZX9zN&V%AlAlS^tOCiCC}`@=&cI<cv-Ip3(>~>7~3mWZV{p{T;^bGrR-CTz%uu
z9fy8DDkwkQb;O}Nhl$4xJ0_0be~K@{^t;Z~=V=-YQ|>>@dBVs)#_Ts@->J?!=d&=l
z<1G6Q`L)?<*38)1#?^nc)iZ@vTS=2WlT@L%+o@%F(TXlo`C-8A#C|xC&{`?_q=e+2
zLg$l+Z}j?8;tCA#0QLM>Q19EWM4zbcgDx}n*WZCu!zxQw9vvG7Fev}g)uCBJsr%9Z
z23{t74tFKy!_rmeQ@^ahqFH+eydD?Bc`Cc+qOcw$AzA<s0i>INen6O5k6r83P3^JF
zYmSw@;AQXar}pIR-1FLSY~eAaWN~r~T>v<NdLnjIwBG7wABf<>@G%da-2;}4sZ1U!
z_eFvv_oGN-J!QsmXWQM<l9G!BJ6GniUYWZXjcJLvCBjy2ZEZvY9~Nl?8j1}B>Ss}T
zIG8wY4S#A82`=>cYD3G>Of{H?dtl=0pQ}9~!Gk7q4FTS66SPEEdOg$l!-Io+g5>8#
z?M?bU4v;hKmTiBH(m;=z0a2o4acM<H?y_m`A)n1OYYwzC^W+<cPI5#0BvYK<+ni+^
zHI6SSaLqfh&)deF=bNVAQ+zekK07+c+^D?$&|}X%v19NeW3OeuFSLCk&s`d+Q&X9z
zK)I9B%nNh(nQkB^h{A~%blZ7c!^+q9ds|k0I(e!HZ1nI*F$CrUc?N8vl_zx{TYE<*
z2lVv_8x?o_UIvf*m{2b&`HH(Wd0b(NL$DS$)+=Lc>n=;nnTsu0MGOLilMq<CgUv*<
zVxq8Jx*i9lmZ*8C;|B2t0uJ8N%$S4x+v97&l_v-WMIVq$kKq+`3wo&(w{$>`>ul7G
zLcFDZg(eS-nvo9Hbkn-^XZ#LdfJ8r^TX#Zcy5E>64dtKAa=Q6Uc8amDXj+A>g#>~&
zRvT)m?%8V^tW0pu;J3sIL>qs8twX?CS!fBKD^OFHAk(iMUR6t}2eHU#x?4*W-PJ)*
zxbEq9vY2yVR|)M3YMEE*)W1==lJ#{w0h!Fh1@RmU4Z`Y3x6w{j>VOtx8p*I2mk(C@
zwfQ#=2bmKuz91*$g^`nQ^CFG<eBz2cZf|F1&>Gw~jy(V7{l>L1_(z=W*s&9NoZQBY
zKrjgab_+yKh1Iof|5@(UJm;L_Ss1s|sTz}MHpVk_)x5Bj)ABLmK~3;VRgFW4{g{cz
zU=oWk#X@Kqz}3{V9MBYBBAd?7g}JH-b)!+p+EuY0aBtar$2gE%F3DYQ>^B>QR8GFZ
z$`}W7P7O43&r?cqv8uEZAS6Dttlza;H@%*hO-ZzGSYVhVo#BU=Tw*vP7cBMFstwyd
zl*%iO?G3&FEXk86dOEI_Qe@X?>LXQYbas*iohn&-qH{JN4b>>@J3yB187tbs<+ozf
ze^_<F^UVU?ft49B?5M50(KlL<wbT1EFYUqv=8V=_T2Sm+WF<>lo6#2m>4|~+6YT-i
zcx||B09S^Fk(&jy59WWyytk@xt_rodK#i<js=k6bmCJ@+$bR*YKGSVUw$V{Dd5P-p
zxxp!mz-0=2rI?AF>+dH{bQKg)hPjZgeun+4Sds?XQrmVz-Ig_&MO*3c1E4kZW!U25
z-h8Ni7@CIq+qBlegwv1QXPV<=#6EG%=M#?!)Aw<@FQ?dT$QR?9-1gnHgXP<_yH4Be
zjHlm~Z71hEWqsYUK-~57L?>q;M3KApoz5jkPj=+s!M0f-ARY9)EC+LS+@0p)vlc$7
z8J~i6lS*ySCD*gMPevv%%dL_)P%p|VVdPmqHe-pp{c<6&@<=G7ctQe=1O`^=IOT((
ze{GKu83=72v9`wZ>DFsIaU%KHLZ4AscrI4TjfxJYtQ7_@(1{(&_H@l{Sh3%gm4X0|
z`5l<Cs%|cpiBaHMTn=Oz!j3?DiKLQ8cM&=|V@|i^YghINeMu{Ej~2#Jdd5m@xrI!{
zqgLk9SK`Hj%>`TJF7p>H2ABJB6iJ3%gG(pT#@wa2W>g5k^|ex-SI=CHaE0Ou7nidB
zI1A|TrQHz%2mF6^5}riPRnGcaD7_5x9mOPbeZtymk)g8y$mcpi_AWpvzL3?mH3g|m
zmX}(RN^!61!wF&rRs-ugu()X`by7jU3sU%SQ|iFrqHVvN8i+E?8!^ROluX#syZO^K
zY1_rOb$Za7vTsvw!`qu>GV1TUxviZ5^6>V5Oxu<Y%r`bK?e>zK^ORnk#itPaA>kso
z$sK<qCd3>fXW3zu&w_&P+B2t~GYa*$rA1erP;lz?QmK*9l-R(zOsT@G1;n6Eu6q8H
zI0-}lScLTlnt5i&q90a;*+>*gn#q!)JtCJ`36$Jrj8ZJDavi^v;{_rb+N+cPUe^c}
zw6OFVa<^nGb`uE1=5jQE1a1JBnO8;S4G5J>qYgsl5x17$PQ&jfPLy^I7pW~tsxUFz
zCM|%uSh+DMy;4VJ+UE|`M#2CtG)zVJZovwyyao&AdE7fFVz5Z3SWQM?0NMxel*vD+
z8}<(!Q-R05a)Etf0CvGOn-(I3-K|eOEJ8$_VOk5R8+9R`PhloBc0RU_PMh6KD~**$
zGm`*usf*(ZF6-+(iTf7iknVHZ{zX~Ul~PBouSNKGbFc(0p=>d?WfE2~>he`<%c59&
z6{Yq9$iyBb4iuI+y*TQbpFFkuK4FH{|E6soYbEUyWru190|2q($zwM`aCqydauS`{
zQVLV-GfR83?E4ZT-b)6Uexg%xKBj@{e6zfeH91ra?u(Hh@Hf(Gpd4-rt3guTD63Uv
zpp#-AU@@l{7vo!=ABxEowVhHG<27A)!y-w!q5v$@@H6%u6)JLD^{28XgNhoo%(N}g
z+}R6Q6`i^ffJKimM|QggjsS|3D4a+gC28rV(b!j;=!?j9yPh-UlQ)0^pQYECF3H-!
zn(;1Is>gV=7o5eo5lM>cITI4DHkJz!X{s_?oX`@M%`I0uMc>9U6|5AuoC;5T25>C8
z`x5&t0<@9}d~Nbindiu5g)PWoX{Bn^No&$XiX%O7uqc!MA;0Iit1+}%%F3RcmUAMB
z0HX?aRyz*29TosE)zGDOZl<+Kf{06YAeq?EZvlB<+S2~Tf;9RUI;AYC&$7L^DC<}y
z>Ba2PK@^&Nm0p;}uTbC+51u-bO*0dvPfQ6q-PAR`fRkNZVR99QP4n+CH`%c1`Bcpz
z{rzVHg?V58nOtqVv5j>1omvpwa<Wl>ZrgR-u`_=Clf4Z*_`7ipKhCkhqy_M3aW3fV
z(wPXYO~jx`Gw%u$Xv_7`fg`nR;dv~KjJ~erY_(mAD67rY2H<Hg+A6+uv0B8|!eU0o
zGl30>!)<FDZmZ~X9nOo-(RPYwQI&kr&cO*bnARQ(09VpX`U#9omBMbE<&sIGno)$l
zTold$YY%y9g){TSU3N^`^<1WuyiDd{*{ABK@ngSuoknf|p@G-YvXp}aepI55!s{E1
zDWZR5SuSK=&&>M)3u`Ik7_5W1k=x<`AQdYIUl9ktKt?F7QQ)MPi%DwmEKF%WU(>FI
z3X@)cx3ut7<{XGrXcE^^`9cK$q90r+q{QE3qNo*3x8MqB@_G`)v6c!OXqbB$fh?C*
z{c?rzEA_1^QmGSAO}U`K!Brio!X`QdTuZB{Y<h?_Y44B(0h_2dQ1`|Hho&T-5}?yh
z+P40lUc9j7yGg6>iQ5Q^ZS%JEtWz~RMYnbi5IoNuGt)fQ!){D~FJ&9U7CxiET4aWP
z&1$8;l*qA@bDe^lgLfWmITmlk2c;=vPz@b<M=dXJAx13-P4aBk1nez)$L0z|7D$J8
zD<tJ=QHn@BUrN#h9hy8OzQNIz9-Km-oRKVU8O*vNwY{`F(?$s*gr@Q_i6ezH3`SZs
zUUehYlS%`?7+G!r1FNs?BD3w5ICbBiyreKsPgm@-B9q!j5(mzlxkySq#t10{t}|<*
zwstLuaV0%Lh~V3`hepb((C^`jv*crQ<yvZi&g6OYs>x=lL4UU5_nEA%n~KKDa_+fW
z27t8#G->~ylNLNbtn7*rFk1F-P))<NCr#F?pL|X0xCGPD&J8d|?@87`vB=fRe7!Zv
z66yjJV}qdV08qbESw~r_S^s6GHt3-0)`L0A0R{ElD}1KMYjME_9v6fXCn#UCpmzyA
zQ1OJbq~5ZqfCrOsSz~4=*5gc5czQ45gqO@7q3J+p=Wf60x3KBAT>>xJ!L}0<QToTu
z3;;Xm%BYewJ2}Zt$ML1Gh)?NpB7Jh|Ze0u}{fz2>T+D_%ILoYVN?7!Kb|o(Z3KR>4
z#aA+;QDe~?^U#R8no>r;<`qA8^$Dt_i-AGmaVt!aYwCugtF6cy>&HN=ZdSiWkq-pV
zR^hWp=(`V-=q|9S^n!?R*P;K2Z5dM$mO^fT=E@NCW}$}RMrlP9w+s;$@rAqWaBik1
zRW^Cs{jhUMbSqE1RES%6bT<}u4l0s>rC3=VtjzThvq8(QP6@*OIAOA;sz#Z_<hB}c
zEnMT#jIZYW(XhoCh)Fl!ewgTl^nwMW`$Ki9a7sMR-K$*8qBPOrf|GD0v8Af}C1W!9
zm2=S5X`*Iy7ove~bajmAl{Z1QaB)lcgje*KMIyS%L?O|*TbdKnZlpdK^cf?oydn_;
zW*_Uy)OEw2q1rHNeYK45SXGq_@F1t&W`DP)+cVD5#?D}8=b*J~XP>ewn|4c2=(v4O
z)fRVno;eSWbAC7PHg}sly}qq3kR5Enwe?cW3UMH)xF`L-Sf>fl9wtc7!BWD0wF|N)
zuSjr9DJgESx^b4QlVHRzDD@OsQxZh#ekEkIlX=OdMjFcfWT~n!&NirpSi6i=V_B$s
z5;Szi-g-g_D^q;vR|&>kST@Bm4KS=<eVsqEP>kB1EWdg{F{B=-Yh~;|FDFu)Y*w;*
z(n2L!h$*Kk#o7`L-q?fI&)fk&xoyQQPF5`Ta{)w1#}9qCWwKOg{T6+BtR$;takQE)
zK8#Ise{e5K!<Whz9+rUZF}L74g`Vt<G4Up)C@b?jmaacl(9dWpz8pCH?^4VB$}MVM
zmCT8Vl?4zf0TM0!;9$EjcOR8~gR^MNHCV^~phLK~iY}H2e>PkMdPQ`b>b~7-y5(Wo
zD-QlW#i3hwneJ?(TAJbnJKW}8WbdNIICUT9T%B)ff0xH^;`w%A-<P1vyK^!>_9eH*
zx4bHhRe>EATm-kUiPJHnQMf?d2d=9omy45^7l?Grf$qQ*b82Et=|p`o+tP(_X@d<U
zCSzAvK_MiS2WPLbu3*ye8z^1kNy9i-m0XvZ=V-a=1oDj%koLjA%hhM**&;BsEbS<I
zo|w4m1h&HS!3M>FQ%s81skg_UXyseLCum%Jwdb*Ut*oLgt|0HD=HP6uNb4&kqS!Sr
zUTNT`_n|E&%T$}2673_F1$!g78!?eR()kiQkt|DJV9?59MQ8&{CSBLgc+3lPiF(N^
z><$KE5@Uw-XlV{sZ>%XM2GtB`X7oJM&KN%CV=m10BiOXv9PhB+O=i+cxF9HG)JEVa
zT`pt;AQoV)*-9V*;6iSh<F;C;`4H3mHK*~^3%fYs?`gM}#3Gn#+hVdz=-5wAzqf30
zs*h$me%j-H99Gv$c_YFuoNv~{w;5Y;%g?w22e;7wx81T8Jg1x5+-r$-hLt`_l2Gxy
zFfhQObO(wB>Z>x9&7eJGDiu1JuB}x~VMtDt9mGf~rr>a8FJ|Gi9W=U51Q9U;hdG*(
zT@+ZBiIZ$5P0`B1<m0OD_hD_l_Nv37nZRkaIQ5&?m&Odh;u1|p2JtvuH#XImWxzVa
zuOQNGY*;K1-z36?l}o7`a7Z_%$P;VRbQLk49eBdTJZdl+DjRmM5^a4+`EI6$UwcoY
z-Lq&552O|(JwmvAbC0XBig7x^!5irf?Ut#Km@7AHM0(NY%5vf0>GE9?8>`H6_xcr;
z5xXo<(xmM=Rb9FQvp%msTFn+J_?ISr8}gj$8OvCSAP}l2fK(Gom>`RLK|9xpxh!U0
zcP5x53Ay?n|6&zTUtS?cj5>vR65S2v*WAIHaBd65{|!?$Hu`Nn6)W#?*EH{UyWIzo
zX~%BL_6I(gsVRHbclAE(f{`=B7jw4v5^Qt44x9JkLO*(uM<XjF*Pkt*jc#rGg(ioq
zHl<fd=3<)2QfvhTu$IR`QgsB%DtRKTt%r?mhyZ^}U33eJxdVy2>SD^picNt-is;tn
z5@dl(??&{v6XRd$@}jGKuv5|yDiF`3m63U2Nw*G@RcP9cMzBbPkEG&GcN{Ck$A+y)
zvYvQ6i|5Q;ygb`fN+l_8q;r)?VZ;Hn>q*pfvj#I%%p+EdB<QIveipsYWHDy;d2+4t
znWzmo^E8gpV`qNPQ(u!+$^N-T)>MF&#I!V>#o#fs!bRCT-M&zAhPV{mdmOmTVq7#$
z-L^wxFtLGwi|rO&itAYE@EJ4o1*MfDy+BMI@dXds;rM05&Jbu6V-8_tK>Z}65JQ$*
zO&4aV`!d9C=nh`ZIPEUeox}Xjh0L@~^CFMk!Y(v9`ub*BBu{E<>#?)9y_*N@!l82>
z7~`%tIpKsd-xfFh^U`kqfSAlr-Nb(~SBZz4tlP24G;f(_Cs|j~wfDqV-V)5s#91Y?
z*bCLkTcIgMl4lk>vC7F}6MdeWK40CZqz4BfPWA~DooJ8+FPIzq7eVFv+GAHvV4$kH
zCqE}JPH8^DU3W1`^Ld)Elh><1xm!+|ozLo!m9C_o2qvsEmL*aPx!QJYmB1x)IVm?F
zV$u~1O%9b1RC5mx8ORsz5>3}eH!Udam04^^q_$$6eW|VB*N8TH-P+x(4r-O>$5l4I
z9KG7SZ|3ebaH|}oI-QE=z@GR$shy<HYNyv1T}6$x%KWJ-Z8M##vNY2>+JGiD52f*g
z!TCCJzjVM7Bc-k@(&R(0q-nY2{@)t#oYh_>G>Td9UhK>tz%KK=jQf)lEE5@a2k%Fe
zq4AxAhtH8K-|#l+Zmi1>zWgcm>2}7pgZ<z5!C#R*hfb64ef|^j=$*If%B3f>s$Asi
z48Hi)*UJT$zgq72#^>a@#~!kkM{q*Q6x%rH7`+m<)#u#XriO$6IYWCRJ2rZE8F9$0
zR@ZKtCA-noDY1UX4cJr-Y~J9)S=_r{U056HVp|`3=uWPut}Ibi23>MlaMf{-38mP~
z;ENnQcPP{bZXlO=K2OR$vVOTG#F&W9Q)Dp;5^+UNo~%4M*cfXK6+4>XE3eOMNO|PM
zKm#tfkn{?j+z=deT@BrGk<9ua@QE~u%MH21<7>&10w;i?xJ44b?dOHX*pL4qmX|xN
z9Q~oP2>O+oibmT7iSZvM?YjGcv8P1js9dkmR}m=@xLFi<d<p+yEvy)um=*4c(fzG|
zh^x_>a|x?t6nDX}tZjU9Csi1mG4mpkwZ#M7`sRIvo6(t!X7w7Vu6HY!o66|!HP@l9
zHbMd@vHS?&%!aRs;0sk3v4WLNuuHAJRDI?vAG@&`i$$itVX3WEPF)3+zIIbyq8Ea*
zNsx9HRt6Fp0n6RkhBdRY@1R_E%?<p?Tdj$0y!`by%In|r5!ti<ko#-1fo~_gwgczK
zD({T*FP2xm?LBhftaGKkv?3Q>^*XuXLw`<xUzSt3{a9Ak{|RifjLRt-!}ybRe->8u
z$m>7&8}i!s{HiQ0?~zln+57H)r1`_v!;MuyZ(EtH5b+|5Ht7Z*wDk6+0*rOvli0+p
zl66;C(pW8owagR&o0wIdRLd>V*z&w$)5W|=cup{D|4nmD=6Z_gU*<%&R9CR}zL7mw
z)qY&Rq<!vyXl}4*Nar!VSog0pF$A0Zt6=9%dVy(lo3bvR|Ar0970vZWx9r&8K7HM;
zH8g?~!5M@}UBeQtv!>P->G7ej`q8(7-St};2)0_GX(ur;6Y$q=6qPBNIx__oBYC9j
z3(h?BSX%<w1q9BrNOcRA6bYvEPC<9ELFrPM(pDR&fXuPg5zB%H-n3_neiEo}z?HZJ
z{X_9G1-X?>aZo375Gom9so?vig}f=uwwo#q&HF*qIhofve+EIw)Ti@p$6tE&^>jyk
z;otvn^2B|2(Ax3?yp0JiJ^urqX`G*9rpGNPSOK`+_;bH5ODp?!<er;miz7apXQbm4
z{n}M`;k?IA0Sdbg8gn+d<9^I}Gq)a+<t;gM-o<j=hyJ2m^WI-q@Y?I5u;Y)LW$Ocr
z{eeW}C`o!KHf2PrD!KU#v`Wu4wPJ;Rfn2)nJj9SR46W(Vum+QL<8vz~(-gOYn=xHg
z0;V$6%*y-qz0AEiz;YDnGyVp&2~$64ZMk7!EWg-XO9C@`hBDXeOC{<(#&19n8<3;o
z1}zf<wB&AU1~oW?uL0LSaN8I}FI5t~Fr;m{GdPnO-B9zTpGa(ahmlM|kpYX*sqV?m
zDjxUBvgD=nk*)h=kL1#2ZLwf;BMW+#E{!GP1v6a}GVg0S!U%?PQ$f~?*gylE@FAcY
zM2VJbXStT5yY^tZDZruZb1bA(+ip2p#bYKf^I=kRHfAJaP@+)(?ZP+elu0~{AkM%&
zxTw8cER2;1!QYsWE$+<2mA2)52js#lUM+_&yhLw!O9!ka%li+|RcPNIl(R2>xtw#!
z71CZ@lB3T)DUbZ{dvfyF5qZ^(?~-#aeFgWs@XBjs?f5Y{{=zf*`)lPaJ!WBPk8GSc
zDi8ng7J2@OM`hpXhvmG>u96p?{E<9<@9hMr3$DDHpFj2B-A$ihVV!ryYxKKobYfVM
z>)!W^@}s+dAoqUft2=@!d)$8lx1ZRK+4fR)Z|J%F!&$w4L-*g|#dOwA$antmU+KHj
zmTN!w=Q;D-@umMLCtrMq?B8L1nE7<U+(&2+g(gx=3W^FOXnCWFqFvY0R6kCxEKbW+
zS{3#y5~r2Bd-<9Z+5{S$q8({9Bx{a&U14)FvwPTV^7a^8?)g?J{u4Y`tkK<*K2Swh
z1xgx=jq5FuQDR>jilsc94`H!2x0G^m-NxXq!<sQWh!WGIRl0Q*rC~#g^sTJa7rI}Q
zWn1@&6TE*8a?xvSH8H=WBoYi@aF1{-435HS?_hhf9$6w`g#Ng+3cp9ulthw+on`$o
z#P`61WX+MdQdMS!aePAGisp5CRp>~Hf6}jyvH;X4cvTJZ(xURr^4tj=7-5h!pf%Qs
zMq6zuAXM(J?!k{)8DWD=!qN*<im!U|0rT5`H(Gpjwc<=RJ$G|%t@eVv@`j(1Yv1`n
zf>LK~RTkA1a!_4$N1u60f8Qq;zv>#f<{j^+TLkg0_R^A^d&!mZtv~)fIpe&G)Ee4L
zz&rbr%jKclZ;=ZQpDl0w#lN68vaK&&Pxc%<P0qROO1Vk*KXB&R3PQgici;3Sc?`g%
z$6b2O8wqq@|M>4T{lcWMy!U|YKjSP4NuI9fIr7XCa>};EvJ#mub~JQ{8Sl`RHYS~O
zx4<OK+t85XrUsUI&N(Y;?Z)|s>{s==^5nfgkZ*nTpUMq?=C|b95BynuPxi`pKl$&*
zf|tk)U5{zP^q7*ynOcihA_FlGP`ukMBMg*Dt_hQK%g$m13R~TqJB{+(tPN#usy--K
z<y_%AkSr_AO?e_<_(V?dFuZDFJ+$y#@HX>0Rq33$yT%x!8OR%BnozIi9F~OyY$;*b
z(4dYfXDn<UGzSjLeeJtHEkQZ<CvdkKv6)(hjVI-lJfU~f9r5e3B;P)0C5w;lSxML6
zpcfqc-TxKbY-RCaoO7TpOB%Lou0nKyUN0e&ET_8fN24wxi&vs!c_Wd<g+MRW>v9XX
zsy#PPJXB-xzRcG#G|v|Flf_nM=4ftyOhY)I^tcGfn1I~Y6Jg&a4}OCFj_(%=V;VwX
zqX?D<CS)B3=58g6G$V!8E~MuSmozx`uk3i+d+2m|#kDu;4Q<KYH-ANL{`5!X=|>-+
zC4_DN8E49sH@sa=Klehp|9jt(+rR!fwWyw#SH1P!1fko%`dI~(C*|ak=jG;4eN<k2
z>M;#QF3O1)o|7Mb{qyquFaL?G9(h47fBjnsKCOi%wZc~P1#A05tYfA7FDx%_il=qg
zSLMkE?vf|(zf(H;`)yzOlsx$TZ>48!<TedV#GM>GZugz8BIelQwqIU?b4~bg(qs8!
z7^a<VBRc%leYYuC{f<shrCj-zpOwRxT*U>~98C?~ukz}*S)!fCK|MZq5!Pn%AQX|i
zRFg5%-2K(WqWacD-;!`QUoP$r6rLxABNAXGWefvAr;v-scqD;{Sq6<xVb%v7#+y=q
z2Eqm;6L<_L%UoL#3^~2-SoiyyIT0dNDi%L?HgIiCLNeV~(y$X_pLl41RmEm<H?Zo*
zrII3hmi1kq!7VDg-oB-q4M=9ix_?(|PYh1hYtx2Xo+<Y$I5;QEkAHi7t&xNh8#gjb
zJ@!WdWRX7YKS-mQn4XQ~>MeSel^Slj^aqtN%8HgxaLWow#4Wc;fy@Lp93v%jxL%C<
zudY~*B3m5hqedtJQkI0wEV4!`41Y6dh$v>XdMhabn!1Rw;s8a-WZIWt)MRq#?DJ&b
z8E44--@jRI`P?Ve4fvG$XghM&g_rUB(+-~}=U@J6vRBZ~-UFx0y1E0~i_2<ty+XdG
zR?_P6qddzacihTjo__cNbu}K8r9Jx<7|-BcZY?S}Evm)V>rB<>s_d!7_k_9>AC*hW
zH^@^D+)aR-=9;G2h95t>4LhzM_TA2`u6egvnn??;xz9Ur>~0uCvz+gx+J-T3>CS<c
z-r7lhwwLI!@EK=U&X;-YC{eswx612KNfjL2qSc{lg~oEJt3K%=Ev(b3KY4A^wV2v`
z)=c~a#bBTaE2is~QFK#__LPexuyjV@v6o)mB+4d|0l~^+RxM}pVZuf2uU26bb<FHL
zFA8tktYSnA9GBd3X7%*R8s^@M4VYD~_>s9MiVVh{#R6&lIrx!P=rz82Db*lzRrV-U
zzhETDRY(jB>c+C`yAZ9)JsICf&Zb_i`Rr1Xb7K*e{Tw-SvD(4{8`@+c%rF?wvmX|)
z2?>17?TdW51s4fUpkA}oiuIAamR|Jg&d6y{uqZ=t?meF>vizv4Ra*j>1s5wT5~g5R
z&_AibqZg%-BaK<rvIbZ~F|<G`0#_VhB!U`=#nXaVrgmA|U|Sh&fTb`|xpWhsKF;)z
z%jBtX)VmHBAA-$2P<x&B4tHPz7ywSI-IfitdQMZ2Gm|)zd(=8RdGy7h=X%8rZ<9BD
z_}A%bJn`alvZyY`WWiyxKr7B$F!zfh#4=_JGL+yk>H=qW%WOGWZ2r4j+w6dtwwdPW
z9ZcxEg#|xp?ac1p9kcrYc;R_G|Ef30jlcTW)r+twKm5`k%0u7#icU;D*^SNOQC_Y>
z+=aygv$3Ds6ceM(CR%!N#3nr_G;=kc*j}7ZLe?bWR$PF4`>yx{wTYz0o+fKnICd7B
zgd{kN`O(<XsRmRgE&}Z1!@R9vv~tU(GUP)YF0!({W?@z)d8XXsOp)>a!U4wIX$A|l
z?tJo#jdF#ZAN@d|T16^hQj-t|0AY!d5S$a>O6+bCSpv0#tt1V{zHly$k<9v)6h-<(
z7B?y?lfFtqz9{y~@u`g5VwPQ&(t6zzwVT8RM-iID;le?kg(YjdpGLsQERGhPFe66X
z!@2Ax3U64xVB<z5r)2<5oymG_0F$P+%+1^-S3-t$WS1IPwYaU5GOHu&ck3m3rZ=sw
zI9b;&iNZo?nI$sQ2MQn*dqCi;Y;#Q%Wfc`ntK?gqZE79$ey%F`te-e0ht4@)&bjz<
z5-85R;1aqJk3IK{oKQF4QxDxoH{Mr2_V1*#dR!Lw?2|Ljy@(9LVcX@`-Kb!<DBn@H
z<Fh|{NUnbS`xvXj#uqyZ|32-U3m6;NfBNC!ox{q66G0$7e)aef#^9Q-Wy^JK`CzWe
zZ^+7eCtJS{rw+U}eZK|3XS$SKvbv^eX2%xuF5jo=Pb}>CX%}23Z~Xb+l7nYoBtQJ(
z$K{qk`q#2?@`TKCkH?LHftA&YVz{7Ac~3eKFAM;KFJwuKNZ{fnJIqKj0vRn2^P;J-
z=GK`fG#j}gV_R8aEHlna9v8A&R&`SunDd*5MpE){QcF(?>P%`D1B%2DG^(~u;#O13
zXzG>o)>AuOmueC(-(iW!nVCdxjnIu2`-#gSvQ(}q%h*@F*(I6=8`d5=g=AfVrZX=q
zZ>#E>d$uTy>`{7BcSvqWfCeu-HaD@K7v`1`V{N8A$eg%V;Jl4RMB$*HNFixa5febU
zg=PuYX3?|cl?(G)^0qN+U|o^DseM`AQ)v4Y_e0_}i&~b*PHtO*7!qMke#x`SqqwGE
zUnRNrQY0-{YEX4Yo)&|sm9$y4v@mKV%cGbzwP(oyZmj^FKw`gJ+7nipE3k|%mMC@(
z4svCx8Zl1y=7upZ%JUkNdg_t;<%(<HBnK5hj;O2fYz44=r=6+$-zi6)eo`L2=XQDZ
zjqj9q{`!BVuDi$N+{><%<-PmllmG1hD=+BreRXKt;BJJg@w}H`CFfu9YK?EbS>1+v
z?K`!?jy?aBTzKWxlK<jg)cDo{S%t@*f7<W7yCfn4&>a#o@PJ?U-d~X0m-otD-}=I)
z{_oOUdrJ2IakaUl_FqEqIz|58Q`!c0U)gs^-tw#ewVbZtb^8}SCg1!I|CoXVvx3&(
zzhT(-&6lCcMJg;&%JYIU>2$2ji5=wbK7gEGSe_-|=&On+-*8i=B=e+Q@tHOl$)mfW
zZmBjZ1lt1Lm~GO;mlzw%LgNl+_#!%u-?X0SNg_}co^)Ir$snm{@H&$FQ<5vutsZv`
zvKAHa#wYniDJM%1Zp;uHjl{4}Q0PHY>8KzM&R#6jIr{9iTQa8M*jKoq@NV>2RF>+V
zSzw0gIwFmt2uXBVKgA%p1+}_XGL(cw;>AUi!NNVk;v?ZG2_Lxj(p;UH7YQYKQkz>`
zhUH~#kQ(B2d8%~8q?wozLr@W5VKJlNZqjDV-*(>8-;ENSA(DCWmzmJwS<f|dDC&lW
z%GHb06AK;4lcaA}vb<Or;yMrof1qHgb+NjMUe1IyS^^0iNDDycQi31u+q3Hx%c{KL
zoV{}QGe<VPGI7L<Fzo#-yInc*+*72$?>Tt7>^X3Vzyr(ciTm%8dv5u<9M$ik5OCVr
z=W9&td|g={m+yS`<8t43zQzGOeBq_Crg5%&^>1v)pMOT<W{2g_S?9}&#=4F?{Wu97
z_uld~c}zhNHy`d5kUQ{@9eeI+wagxr$L{_CNgJ(&1$p@P@5qaK97r0V$}jCXpf{{5
zkNohv+pZyu{A2Q*6oz~-%9b6sIv%%E826=&>EpcDGPVy>v=OG*XNn!B>Tj6X%#PaF
zw(m?|4Br;iOK{HRSIeWfe_L+)gMXrvPANOy+=AS@xFCC1_Q_3;AC;fEe2;ltT(p%F
ze`)zY7LeD;ZOOt7$-2l~F(O$B68bK`bRH|=A>79*A}9SklbTDQz}i{bHY}jzwrk|4
zvaE66r&ye+bOe`Ck|s`<5^otpLSJ*U9@)nr18zxs@1W9AJEyz$nqrl^_JRv+HkA5?
zq~Kv3x9WluBob>csivn8O9E0dHoK<gk;<f`_)}tY2M4;OxfmNCih+0K!n<XPxgmsv
zT4Qaq?oxd-Q$2}|0b<fjPW*^{?;Uj##n^+v#|R4vvJRahk2ogkJr+f1^3;;zN5iiC
z2R9y$AY*{#7a-?>y{cemLmmaaiCD2<^<&D9XdlVS0H^|q%L>i7>HG9->-ssRpo-kY
z8g=KrZMC@cd$<KlTwqywi4y=<ZKgUd6JnA2@f|O8<e0i1|N6CO%YVH6K^Y*nY@2q2
zOt-KsG?qm_dat{U(u-qJ;1Z;a?)n;E)^Y8zVyW&6U>a;M9fKreFtBQE2Y|HoT!W3%
zrJ&=+_~8iYr%hlJhW<L@xUC<==>TfncM}08PWXP7wuXEcrfO>PK09b<H^6Hqu$|(7
zS;l!c&pXxTz;(`k1;sPZmH*+UN92Eb|6vMpuc$W$1s#{#CIz&zH%G+5Tv{zxuZSjz
zRJeOBiP@TEAWi9c7FG<HtSxtGc`^5dU<E66qxGn{Y9&lC884~@vyMWJ%tx|3R9>>P
z1}%OgJby~EZMi^gU!@~>S^3)CdiGh*<65<o8O(!aZbK469GrXZqFY=vxx18vomi2%
zQ^8ADjlgw5AQ-o$Q4A?#19%{Vq&QZmXC#iIxenoVz|v&(X`cpDOc6PCxCh2M3{Fn5
zSYeM<lzm)+DY)Yr>(VSylY*+7<nUF!r!dsv+ABQc$_;9Z$z|qdtSYwxtJuW92wqY*
zx{A58LSca~ESPm!blj&1Mo-6A5>(89D^NS#)rpsx)vhZN(h4VQDG*h%t_Q5>S4TRf
z9CtIe1~O}pP-_PY!0VnD)(w`AQ8GT3(R`;bS0AdtWHU7h^(uM(F!cE!`PnG9MA~3|
z*@HH`4Y)(r)!Le7!%YT_ebfd3s;hOGX0r#TD^qW?x~zW8+t@zNa{(icc}d4&mXqyP
z$0j`ByFJd$A-g!RanmnmxvZ{MRL+6d1+fgeqkOrX^0BZ2Pr85gzyxT_v)E9_6Ga?J
zu?*_x=H`OcQF;w1c$C@;?h(@OmO^d<uT5Ob2pI$wvI*VN@Hh?U5KN}QNn}1Y?M2h@
zLy38unuR8%a=~4<6iNCZpHLu=xKx-nA>3c6-^GY`W9gZq2yxq$C~UJ*_Ngc)%f19@
zWRVJb$AklAWQ*u(@X}b55~N80=9qbmise{xX*3(t9RnC*;wIf*|F^toeMrv+uFGn3
z^&b=-gLoT6cOf#-PPw^Ww@aiEG>&E?aU2M;o+^MbL2=Ap&s@f^R-5sxJ(h&2ldeLi
zvOu1R$;p|WsA!qIQ*RwMUT%JG9gu?yEz;*#T7?dp`XQkN&%v+hpIt^makQWwgcuQY
zYinCTYFKT-1E(<ZBE@?v%NvU_*EaV3jxu$*i&HugZfX3bn{@5b8MaN`hu!Y`lt4Vq
zc_!_%>HA45ohi2e6c!H6wv+4KjbjHkOjZjEffm=sTGcSp(0ocRE=x<;#ex>ve;xwj
zsvJOssjt0gxn7vO@m<R&$BIe220|o{E#{4th3^)YGpl(;nY+l?mz9Qhc4BVvGIMho
zkg<raNF(FK1vjiY&X2-aj_r_Ub7KNBZs!tB_y&N?IL(3;%ry%}nwV2^%^4ZQ)YTjJ
zVJ2SC(n2?dyZ?IKipRnl+0ftN#;ZIvfVp1|T2{Q#l{FmwYj-zR?uG-wBNfa{L<@o=
z`q?rv46U%9B^6t(F_-7^v<B2eV|C}YDI}%GhSs6<^M=JK?{EuNWg@>=IBBt!^Ilk7
z&=~G;FVZ^3cob?Mw#3|2Ww+PJ=|eqZz0+xOBRZ=c>8^E+E(t3tmeNru(vXdU9*!yH
z<VJ@#2i6n-3+akvxYQQ>TkG^>qtoR;mym?YTh90aNu#DKv8aL*Hcs6(eCi(V^crgA
z%>=4Dzm_>M{M0oxV>`Rn|6SO2yDw9<x0@%8<G&jBGwJw=r`o0Ku(BPx8rPuvih>B;
zKLWx;WwJ&J9B`c#xv7xD8o-<plMbLK|Mq%r5wH@lu?YD;S^$0NCh8l)T~*sTF<ouw
zzW~j}1&`qyXS{LKVM1M6>Wj!GW*zg$T&FPU5rXB`*|5|hPPV0)hE3Ju+V-a+KEe!M
z?U~oWYVom&%~c+#f-5e?cZ|<ga~wz{Nt%K99AOz>j{;z%PD)2U)|CM`iUDt|)v~^x
z^Z=a@=Kz~(pIJImO*bG&dWb=`GE?nOBEpDqVXR@f!jhzmFFLs;v)>8yRo`<~xp~^e
zz(D5cnI)W5F>IX7v^3YO0V>lTqIiW7lL{=#kkPV=?6?Ioxzh2KL!>Vf)>MlSTm}>4
zJ)khTsQYzJ_GCdVFi^^itYST`pgmaBr*A{giWt^$1;+(lYqXKugn%hrX<5Hxg+~cH
z(85v&cja`;t=njOVaUrNqphx4Tur;_ei;`x7{90uoA;dK+|AKZc86-cgFfuItug!0
z)YJ^m!93eI3vb%<4Bc<ePR?`K;QJN^KbW@jzU$WA>AEWrKF|rT?LqsHRK~$5jC7Ha
zZJ1l)FO@d1TY;&_5`&WBd6Gy<)pCt`uE4ZdI6XXYk&GA=tSv@~g2jLUUH}FFAqgP4
zP2ipAa!(ExENa-Yi4_3AShrd?`9kJo33InGR<|ctS6@bOOfEXo&{0IUZD0w&MPAbS
zTE%lOEQ&0zSX?d@n<O)@lD>PbHc-I)iFq{l_!R)T4bcd_ruDU+S&yLQ>wcY1>2gnI
z){?Z*Gm8yzxJbc=xGBGlvB92^^txq|<1>pFZDW2%zge~f?pG8O7PFXIg~@ASoKrRA
z+L1qZGD@n4MxDwmH050YikVt!R^(IIcd!bVR}^2`u;xncQ-IlLl`)MxL5_arnt|G@
zPT7;S8dh0m>=iZP%Gzc5Ve-T0sz05Lp89MvIk~#7E`Z!}2#^C-EU5dhOR#Ixq}BkN
zjsX0y9jF0o|2hOiqf)lpg)A02Ak&qon)u%A)MYqx+do0u@IIyl#klRunXjqu74eqS
zf8(fKcW;}s!LSQ$jBIb3ZA#bZh(k7iI9CT`N5Gf1FzNhp_;Kmfm>)2oz;eLCm9h5P
z@`ge%Pyk^p)0K0b!%ft8l_9**^WwI-Q|V)pX5xz6CP}&qb<zV+U~=pr|EI7@?d=7)
z56vSKoVCYEv<M9VS)HiL)G!!d5r##Q$EB()nV9^!=(K*!ai&Jj{cxTW$9l57?CeP=
zfz&?#<qa{!EJ!HB(JJxeYXEg?!4j(zRo>p=*r;jHRfunxN+f1Q0&sNFUsM1<{~51?
zTd`L+H!ihF7iN(;4c#?l7t9?B9a@s`T2`xZW8J_K5?sqV@T(^c6kA?j3+KZ)V?lv2
zV_#wEc1`^s<ICX-p^^MzVd0)xUY*iq0yS2MiXpIib5}aqApJh)^HA);4a5V$g}hPS
z(R8=l<=+s2-OxL>s>r>dmKPNFS_^IU9e3qqcSDMm1zFwbTIM%Q<E2IIL{9=3Ckk+#
zYC}(CPwRr({aBf-Vs(S_C^#<Ykt=$)H}uTM)r}a_s$j@_Fz-8Rw`rPf`=mSeyj#AU
zx{nhq1{v~o|B$d{&!3EK?g@CymowexZRWuAhfEy{+tE(DXEDv{L72IndADKrAdcUU
zzv?8pwA3bv3lrD!ipG34bdFfcN#Fv5EO*%@5HMJIg5&{@$sop(nM<u`o0WpxtjZ((
zu+n<2%z??4u^zGFlqZi=1R;xKVFI;<I$d@S7RX^L7IJfAN$j&12g-k7eq%h0i|)Q)
zc*_YCwJUy5_Ng{k7!#(MKh`f-Vk+;hOW2K`By2G?v<<f=LuIX`U04&0=;BnQqF}IB
z3U0UTd$<ijP=N~*q_<QC1t8eUO=2k#Qt0knH^q;o<-*dE2(AW>rMvAczs*>FYpYfX
z8P|rs(gmsiGXqDh-SxT=2gaOFz^P+OfwQW}aCLfK7S2nVs?023EGnwp+^{*@FZF&X
zo_Iftlf9DcKSZa{;6i2zWl%P!DXt&Ff`Tt~W4$XU^xr+&5Zs5boC<vamQlGFbVbOl
zFsC55Dxrd+lL|^bOIV{U{st_sOb)7Lh2UgIZ^W^(CgSdch^GewX^M?`M^4=~++vt^
z8)fBeYjchj^RTw(pNRYk@?U2?@76DOWIar|osx6R=sMoI6Zd<Gte#y5ogHjrt-vXc
z#bmvvF>?mtbKyi~>g|!%)Y7ufIbgcQ%CrUP=}BS$L9L3ssndixWw7<6@wdc;U4TQ`
zFay_DjdIV4xbBx%v4V;<NdoD*V2v>mSQ5L@tsqYb_Us@9jbN@vmn%ZuD9nc-VJs|J
z;YI9NiO0PhT(Hr?%xr>Z+|L2c7?NIfIG2WPNQm_FuMv>5ehn_mCU(oQ-~?O;%e{ij
zQJj^@d@HnB*?EJz2r=%px*1z8%3FC7H{7jEnR2#aRZAmYj13?JvJKk7JPzY$X^D2V
z#|%wkD%JL?{4-Xbj>afmSL@J7J2^v5EPVxW46;Bo0<h<kb1M$z3mov{>JF^LRw!f-
zBA(@9ho%OvW?LH;RKdhyBowdc1)}g|t{{e-CDhegW0~xhu9!AtSs$E&k{&q+jrF(+
zqst#b{!=iTYoL~xKFIoHv{0sci#ui4w-Ii_K9)=eUb9UkuIV*pBeS$U--H%-v8}Dg
zjvv2C*27$V*ooz_!+S6;ZWtzXVy7<aS+`Bsyy=74x4EB{XfY3jB0?6Me4(X9mz(gS
zgh{c7+Ny9Vwk(&ca#tA@Bl3P;7A=Az#hZj~LV#cJ!i6lKk(rfcT7yQp#x<xD$*ea_
zm}M$)(x=8VAvf#iR;2=pr4u#8Y2;N`m=CqIAIM<2T1avxOAqYCc0X4M8_tFE8e0*r
zMd26#j5uFLbJL~Ug>j*>Ty5Z(xmrB_0C<?~=Y=^bujIAI29jYjm;Y<CfTvN+sgh9}
zV-x)bSP&#EuE74TZ`2LBB6E;p4p(MzD%LIQdErNok2M17u!FLGZL%PJ9Y}lt1(Q}{
zUoxjy8Wj@87NMlFUi0BWo?r2z0!&NM87R8c&Lzou@Lpu8Y_bL0m~T)U*WOEY(h`Ho
zP79jq#qj&~m}Cdgsv&$Ct40|En^h|?pERtmR<wb~OMFz3cU7EjDwCf7&96;pUZvfD
zyM8;fzM!M`w+BjO{#eVXU1y&}2F7WMgQu~&X4xiz*UZOFaqK+XZh+Tronto|I0ZvA
z^TrTPVXJzI82~(Tn~>2rOjNK$NR0;_y-cbaCfIG2bImgoUAr&2<>=U}jj~P2rIw#7
z7(oIPINV(3x=O5Yu=K=)U|Y6qrR%XYLPGAAg^?D-a>w#MyRl!sLtKt3GN~FMMQ!h3
z6Fnr0Kn|(9fh<QP2&ZC}Rz1Tecaj!dRRpmj#EkL*bq~aSI39V{D6%sK=N4M(zX|Jw
zz5;)YjVebfMUvD#Xt1DS{X!TJ4K^#Xc8jj%DoWrf)X|uWw3?i}k~`x(iRW4s9PeXD
zWnoOW766Cq#(2Qh+cHdIye{)TS<$U%)>dxdM(Yni7F?md%>bzl0$4qj-4UK7izbne
z1UV>7EF$^Ns~dwsQgM}1n>Zr^u6jj#mKK=(yxK7p3P_ufQmMz1U8u*ST*}E<@gjS=
zOkr_K?cp-a-~kzzt=lMA>dTevY@5j?H}gzjfDyNR@{_WS>&vVb=A;G0yp!m(u1k>_
zu4hc6J8@A?(~nWdj@oaU_C{^fTKuPSi~fT+77|k}{ABJk61&<~T+(7yHVJ|jPcU*<
zUdt;BS3PreF>fogg(1L<v9aJ)*<qz57a8JWMeb=n?(!0g$t*4voPf~^CscRM^c-9o
zi6mcvHx&6~%@8$e#;_Q}ahmzUQlJLk(qc~67l4S?RolRfiuRc|9t}v*i*9KwJunv&
zsRUi=IW4|+_givVx0n}KQ`Zl)ea`)E9abqfELB%d${*470c#_=B$i+9EJ^IdzQwFD
zzOZ<p&~Ve`*o;%2bQs~it?U{p3+3m@-Nl$HRpT?3(qi7QH1)q|advG{f;bv1z;3t4
z1x^5Pm010RS}bSX0&Q@IcEPL(mQ$7SZ!<X;tY?(Ur%V(8NWrP)8eZ_NE;DJ`E-bp5
zMx&A};wuBa37J`NWc6fLsu`eHhoo{f{Gs=!L`J_DTaS+0CaGCnG-2eqWN5voS>^*@
zC~jM^kDs6&7(##NVb`>K*5ZWkhXTfA@S6ENr}E$(f>)U5_<=8GerD2nXFd2QU^B5*
zlldv!8$%@sQrI(74$n<}AyKulrT>=oK%qjPJS$g&Fj9aiS>UChRM4VXU!0C|b8}%b
zqyVh$OQ|HfxZKN<yiOj!YKj{=0mG7jtv`jk`UohHU2;9e%KHbai&9HGpP7bS!&eqR
zN>Xg*2DEF%9GG&S7{}|@jXN=k3BwBpD+oY{vDoM(aEfjfW^|Y4o*0~jggKUVbU7>=
z4@*Zd>$a?oeTi%Dc8%P@dxpGekUI+3VRXfQj(Tv-lg!lYQ(`k*v6z<%XA`nEncsKb
zOS{ElwYzc$e6ti8y7H8V&`p4B;iha^PqeHzuALPwPY7m+ep#FKMK+6mvDmW2GMMLR
z96&^qukHsDGoU0)yI!eiSu)oG!Pli$-uRV!^xamxaFjz?f`z3H%_Zo7X?rar{clS0
zooDLXd`xIQivv5vsgIxHTr*gPv&=AY(r0n=2h;XDj`?6x8`GR)ngzzRZJo+(%kb@J
z-%-!Ow8zi8#VO7`xbLYr_e||ZR`qaqpVek!tcoruo8W5K!vm;L=g&caxl^ss)a|0&
zk-MNQ{$dldNf=fA0*$_^VmwUhCfODMS9|%B+RFD@2`AS?WN8goxM16^Y#|=%NL2f>
zicKQ1II!h~&B~<%T3XmqcB*ZGrqUCTlVnp8-oQ`p^m<yF;<;{KPsGYXdD#*tJ){ya
zmG_0o+<snL1X#maNGGtIEXKHe@etJmX2mn3mpyUor!ty);wiuahE<v@C+rAUVM_Xj
zD;APfEJe~bOE1MOgZJBTIW$7T^vH=c<z-A&!{VNZz2yVXLPkYm@gi=S`7+l!_5dxm
zie@FVpa<<yJC8M2GK)>w0KwePo%U$f8X1LoU;;7<qoFcEJEWkTc(SvZpjhCnDbPWZ
zpNp#6YPIafHtL0%7QALXS89yqvUPb!@mv{ojxfB9nYJM&+K9eQ(>D5yAC^;)Ir<Yv
zoi}Xy;R~-z;Pe2G0@2-CSWL6+>T@vbK092b4IVp<s>`VW&sjFZ7xUI&A>1pi8ZL64
zOe4^!+E$*V_F{qt9JX=~u2SJufs+;C20p-!ns}~6j+J^vbqur2g1@YZ%~$sN;<}JE
zs+<#_gI(t_v~mCtk~J2b;uc*sA^{ylZ$W6Yq+QErtvyGIF)IbD(uoT>t7U>ASX-GC
zw3!F5QDs(1?n1K|BT66DUj5j`bYZmxCrALSx+IMxeMXCwIq|*eXY&joNjVkX?3${G
zsl^*Wum+fzx_s~$Aub;nv%Zm3FHFX-pf}E}*4h)pbEo-J7`Nq#$?mapff2j4F2}|F
z+NM6za#fS0&@UdBWAZez!;^~xaV}(Xbr9ilsi({Xg7kOtIdButbxbz2bBmdo^*tTT
zR+Y;>J@H9>N-*GcFs2Jm+R~ARCC9X`%4@)g#m<=U?9`iVSEL<m!-IX+MVHDs7r$Kg
z95_wQ_H}vkfqUecM;~YkH>O3-_O0*g8of_{OZ%Lq=ep{KpOzP%eoXHC<`<;1zBbkI
zliHODeVl#k`x)_2zU^243P1YJCx1_lzwnHIGyL3RU0++8-@5NB-u!O4<eE3jO&|X^
zazw|d8dh1?4;pvvOZyJWIWK>;#wJ$e=|}FB7an_X+wtdKakX6aw)e}oKKjq)<k1(l
zRR$P!-koeaRVNuTguA|Ny3BZrPquBdm=BZ?tUx3t&5ZQ*p2jg2oCQ~wX|{<?3@A~*
zO@^rtI0o4Lxr%PT$}KG>BA3+gOX9R4fdL2xi@C>LY)&&qVQfewR$j#9o=TU*tGyN&
zeqni&RELYwQvE?qMJ?%Zs=WSI(Pt4_goP9ei_1|--3nHE1rP6&JyfYbbs}0g1wIwU
zq;=#)I?Zk8q>S9%t0szQRQBlBYB17C?TbpfEvwo!3qzw@n2Zwu2UR(c81AGCko3x4
zUjVuG96F1`*<FuS^e~aBn50V1cI(We$8smZmG3*2e?YPb4WMX=;}GM8GP7lxTYW49
z7puZbkHiv%By&z`9T?aUcFZ8%WRg%lCc-%tJ~J78pm$3<vjQ0@0a3#qJ~Cz~I+-~o
z(u1lno1>M)#$fmA;E8eDD@Vnle~o|JUjDi_${XJE5jpLg^P75NCy%@!cYN!M^4-t>
z5zClN8<&`NLRnndCud)Bxy78aTxQv(oj1qrH!axoN6=pQGcLSDA1HO(?mf@|*SPj(
z>EvJ=dk&r<=U?$!xpmLpO;*<|=RjGR3$A*dyy@qElgEAUGk>rdxV+KR&U=}>@-6R^
zAAIg(vU==@#4%jeY3J{$7BK^p&QxuTIQd*-Kkp6OA!1HCZEXIHZYkAd%f-q7gvDsv
zuBcE2N+*FLO<g{Ru*%(DrVKBAYb&Pwq<-moo6JL#XltUbk>^A1mBqju0P@&q_vKC=
zNJ<qJ+wx<*vU@AV>j9F{z>%bm%ybjsj-*;gw{m?&o5T}!T-=kzSX4;oab{jf^!4cf
zPvDWton#(kOT~S~#eQQWL)B2xLtlkGIJm>j2RSY17p59wfGsN8yJbjMWXoK5xJI}%
zsh(jd+2oipU92)!9^Ic3rC&)}yd+CMwq|a@K4^1s63p@ip(7D!aE$;cb8&j|H^IN+
zy(?-a57$ixd#PX~z=|hUP(lW~PH3RDV?cUAjEtfGU%(*fNB|9c+Tjg_T?p(hMdWlj
zKn1HK!^MiTSy1jI$M=ckfm32%r<exW{2s-LuS3}K`hbnHC|6$pRyp^wSIB+eyGb7S
z!Oe2UxfjZ--|{ZG>W%M^NAJE(p1AKWKio7Lx7Wn-6`#7$0MMx#^59F_)YI~%#j}q-
zC|~>dzhhC#?#4iQ6S_xp%VZzs(}`9$Y}zs>EXc_Rt=iPaxY@(LhVK~VuzUT_^grMH
z=)Y#0Cti4V(=kv_k%9AM4#xO<>#6u)4qoFB@Vft&ugQx~J}O6_dQ2bIa`0d)yAXY4
zIL7MQcgERr<(uE53xq4Bx3MP6YJCmcGQ@6!O(s}GWU1{fPgHQ<dnyk<Y2qH%r;KlL
zf1HA85jB><G;It6uvu})Jz*2AzO7GSnAo}L&K)LvX#Fx^$O`+?tSGzLm9yS#Vv7yq
zEjZiF1Zw*hP1W-XzpTCy_+4^w5e#xu1j=)BL*~hXh^~vMfC<ZiO75<C2ybBuS){(D
zVvH=U5nUKJ%NlJzx&`$(D6|uv^S*E`=;|$JU$YOn5k(-cSNnMMwE`{KHZ;W|t%ORl
z<U#&`h;W*!&_A9#gl1eq%2D&A?%?wcV`)|NR0H9J-13Ub2E-=Ix9DzLUMJoSN>h1Z
zPM3#DRf{c$t9Ayc<$_ht4y3G<r#HY=h-=4B5eKi=Njf>}Yc?*@;3WgNkP)NYTLLtX
zcVDl#wIo(+263pK^pUfw`bmDaQpkw#D7uIOlPE(_@~KngMlG*kBi%L{OvCtz&JHrh
zOq7%k&1V(BS^Fy#rhRX=LR^1a(iQ!_)6S4%&pjjee)k({WqnBwoN*QhWdG@B>Oi#_
zYdLiI9C_Jmu9dy&N?bpAOrE&^Zh7>sAMobvKmD*=e%+0F+}W&@{On^7$phd2Hr;<`
zUU0Eo_=>A#zqZ-ycI2rC?vlsvyMqbWdk&uFE0db%uzg=6%WBQ6tsd8X?~%vuv8u?g
zdds_M;kK8Sw5_uVc=vwitMbB=KN{*rJ9yT)a{lG7Rx9#C_UV~N?pOEcopR{x3)FRX
zl{~L~eB_Q>^j!Ppve&(tC1@V{!A)}c^=~Io;5_?IKTFos0{PKhw<>tw!FKnYcBX!B
z=ez9Mx3Fq-q5VUp=ST1Ot~{sho~FQm?#o}rYdZ15bMnN!x65-sdVtq)x>`3Ez3TM}
zB8OyS?Swr2kdEUIZ`lm2B0TosS?BAqx2ff{B$sKw0CuRpyR>JYbk&9X$Zg-2=O2HF
zg*vx_S8HKO&b;X5a+ZSDvya{<2M?boleU*#{RVYUzKM&BBTxNE9@g<#KXHV!!{Ljs
zQ1|XDXbE-|1fSRIdFuWjvIyv*b1srIUv`B&^u4dC#r7i4eaW?Nl~Tw3!S8-m&Q@3D
zMX!E?K4VYHp|dW~`+A3t|ATVYrLUCJ&%cDv<`D(yC-1vWjz9nOWLIU{<^+ySO-un^
zKbFn&p{O{KW$u=;37*qIurf&4*!^Uc`vp}_g2=qEWaY#JOz6h=GqOaHg-sw{x}tg=
zLsK8iM0JgRpTvF>kt}+mS8Y^iAtl@q#1f+u%h2YaJ}q9newXJ*x#`UX%pmpGt*K=7
zB{v%}riq{RhpkUQF+iZ(GkUr)#vn5*40{yL$OOo?3a9KxXDd46kG;Y|z^&E6^%biw
zS9N1GVNGV~02W_l0<otQB-UW%_b*|F__0a!*sg7J-d%DhHdOh{EOIbGd96j}Lds^{
zno$gpi$=sKeLQi&g?ZEz)$D=73Cp@P=@6hZ*eWnH^{%ZWx1ciFsG4$5S%bFX{!zyK
z>OkLha6h%NhobvPEy9Nffvb%z&-uV3yy=tvXM^AMfeigBdmRGU`8uJm9y=;Wo_$ho
z`|9U(@?O@-=4m<i(pSiJ@BWaSed!ehj20%+*WMss{Jno6kKOx2dDGARs$6-)+jY`@
zSSREI{Jp!eL96Pz_x`+GaK)<>>`thAaIajdljGMu_HWh1-H_M)^v@E+o=`A5@3L3Q
z4IlVrIe7MY(pfzz#lnKT{F*n)_dfp#`O)1!kT?G9ugik==S7Y8pmOq=7hFPc`ojPI
zPh{=*(dLSAWd{{xulebplS}km3|y;)cG>IRBtQ7lCutF0ah*=8`W?o7&w<nB25tL+
zTfeE`^h5pq*Yt&5pvw$>1bAJd*ZP@%@eeiD^n|?T?H?de0x++9<2x11uVcYX0Ne{Y
z*&kA%e7UxdcCjBU3{3jp{geMd%lr*`E`SLp=p_Zsi?tuCM_-g@AGvSSEjm{x`#1mm
zUzP`N{RaE|x_AGAT2N<cA08)A?mcv-tSIo`_Juzr2oFx;u$m5@bAep-*7vE)_j!5X
zJ71AE|I&XcleSmh_&&YA$7ET-SUfNB;U9ccf%sy1-TQu-*Va?(xKL1q`}mHp{INWG
z`^|FB<*$)fzvDxC4fhhb@Z7vc|6V(OL>^G!y71N4%Z<PM+w$~-cj?5qq5Hfb=e^<@
zehy0zV|3~3-_G{#{`#k7U60%PY>&j2fyaDq@81mIHTYH~D}1NmIjT>lTW96iQynK*
zOQe#EP%O4^cap_W%zDo}rXvy>fn7_G?Yj%b0fknKyWLo@v13wFEd7z0uy3fXonEvG
z#~~)lx#=Eec3O)84R{#R(3CwVN(7r&i{SCDo;1J+a881@xua8X0M0!*m>`oT^8o<s
zJ1s(U473aR87^hRz(+E>*34s0_`Yy*N{Z#-vy||h*oK)Gy~IfiE5E3oHH(W$e;T)Y
z79FtM0*13B)y%@KjNgg5P`h2TY%@QHxT}*ab&p}PURhxnUAjPUHBf&n$wO6cUDBc!
zOON1TZAv)R^#8-k>VfqIohjU~*k1*?<b_)j6<5gwHCR@<T50R|8{#<$y^@6?A>&_#
zoDZqVe0b&1%zVX?GRK3{JEJc)V*dfzzJ>8_4*zTI#BsUn=C7*7a7eDW{w->yTqQ@I
zc~Y&Whvm_GZsUV+>DAZk#Q#RQ`#WEghkp27x)R^|^S{CU09>zq$NLEo06PHTIU2iy
zEAPOWXUWB{x>f<8BX?=M3~skWXPw6td#k-bs|Kt4J$mkoUvs@2zUWf<{+B)_KhpCa
z)>zVY@A(C}{{6qC*4-VnIu@2!<mOL(RIPwx@|K_f3u=Y^jNJSuzt5`7gR69a!7J3w
z`J#f$J=*7eht7~I-tabg`L#F7Eua1<Ew$IZ`@`~9oy-9Wm~4Oewa>BwbbE1y3FP1V
z{Kw_RCmxY=)oOe9U;JBg`E75PTQvrRNjujYiTerw0m$9+?JvuH3Jx8;t{Z>;FVa%F
z=cX?bWYCw(uYVgYqh}tvS1x_sjdTIt@zqZeU`{*xLP;8HgKj@84gdfaATRiLXYHii
z{-r-6&|Ul9Ut$dG$@}jx;2M}L4xD+mTyeuY6>wfAH~rzim7~u*A=7M6KXjKoaLZRo
z=y;QY=7nk*KL6MQa@lonlf!CJ!2$yiAtrYD8-7|Yzu~7z9Kkr?{?H95w&FzJdr*WG
zi?tPczaRR(E)MR#RbEtp|Hyyyk7Y%{{rjK&eO&}RLU3F=`ohS*O^XjZ0xx!c%Kf(<
zJL5@*^>f>MoLR$k8?{WokLSv*EC?8O#iGZH2J*G|%oL$9MWXB8WnSJRx^(~$O7*ca
zXAjbn^S)Wx5HD3P$vW~vj$weRjX1m`dB~Dw<?~^%cCtD&6RtFKoc`Uj+%Z1)m9ZVI
zNM+r`$^dq`E6dj|ca)N%2Z;?NHH7Hb7hFlh==7#`k$EgFxU1dcd)`I^hL!cFXeVnl
z#mL0mq)xCvzgl_l{JGFDCi8)Z!K|N@eqhPR^sXlNXv-@<`$7fR>m*AvT%swXu+75U
zm(h(T<k&HFA=sjUrC@4PGU0-N3zgtwt_?$~szX`-no>`-TTOf@aPtxH)KhOn%h_UF
zMq7gk3JVOD7+i+k5WQo<_*cuBA-%eG0p8e{iueV9iR5Fh!Wufw=oe$yXK~ASnDFoZ
z&Nt*6pZNFs@7HC0^#m=f>)-eDa_u{RPA*W_-J!G3r?msHIbDBm`|syp{wlWd)I;~N
z9qha3z#)0|M-QuI^f)Kl7oK`t0cVfK&|WD^YH>aJ;JrGLKFK&)TCl*~cA5ejth*n6
z<MZ;+ZQqf5Z~3}B_r$~M>brnM4zqF|l{>%jr~Lk*+rJ|#I>BO+4I$ffjTc<`T6JHZ
z#mN$GPgr_*iC{e;rt+{J`;1yRFMIXt38eSwx$rkO0ND!~SGxVnf1)nJ@5}c-`!O;r
z;dX?pZ|nG?&kuh8CUrC3%y=OzEr8n6p8a%bF0AY!Qxh)24RwDWRcm%ht<rNZdo?Hf
zC)I5R7uq!2kM8`QJfarP1L~4{>cKmuwX{OF>R_jE&9Hzje(js&m;%-lcYmLsVT|Cy
z!_TPg?r(mc;B@ylJ}W0*e2&)um*&1R&(Xi1QQ-N8e*Z1G@1`%v<J#`ZfirZR&mOgM
z+O`3t9=ZM7+ONmyDuksE7vq65&!cM+?#J%>s_b-|vOB|%o8#a#FU)m5|7Gy^WKo2y
zpTA>sh)>+EHj!58AxL9I(3KSW044)g3Hq5kyDxJqpvNlfb;CF`qJ}X7sgMDBb%<_J
znF~wY?P!cW12Ym8JZ~(<RF=bzDJ#ou_4T}q*ow#U4bYNSVJb?Q`JCFse%*zZ;#v&N
zG<u1Bx0@;1TRK2u`sH2*h1XE`U3(#&AetMrs*=lMz>=$NU!(ZP#wz2rr*RzsDv~g~
z{1mO8md7R~(s<#yOB)2_+L6qW^%oS)`1r%fg@bD{!rR7_2ow-)Tih_X#ohAqCzZ27
zk*HjB)ZSZz$zAsc1VPA_n0yIiPtj<XT!G-hYQaUQdqd3_D}b1pvM`x6xdNZYQ50^m
zl0XeEmKZ}-&C23wR7n;$QL*X}lhKb3w|x%Lm=|J-mj*GO)6Y3y!RLOt|NA%VB)>;p
zhOd%0ec%`6($~CRZ|H^&LW|ZC_RY?{h}ZbTum7o9Ysc8emp}TiN#r<yIM}OR*Z8gP
zR!i=d&wiY4#naEfh`@&SzW%Y_X;$OdP+&7}xAe0vzfTV;T!vUBVX_4<o_OK;=9ol|
zpa|)f<t_jLRtf+XF)m!~i|XbBXly8$!eTk`;tO`1{s0h@#fEW#8;rn;F;~m6(!RFT
zYS_9`!1n;7bS*`(KyU+4?9=$*qPkzZYinwaeN`vr2h~0JjC|u`|5{^XZ<a&nT_`V8
zS7=w`T%CWnMnIZ$uV7i0PD<I(1xBS4|5ipOte6Y0x>nthSI86h+%A{D>0NXy!b&{v
zir2^`uYarDqrfz5TUCn(?E}1f-F1!)?~S@<VU4D9<6nRd7GpV=%SP~k^~nu|R~5vE
zwVwn;Z~gS|>6qLvXKLK+@;ARr7MJ(QU0?kZ`TplWDklfnnp?+VtjjP=x$mSc4fqrd
zY&y>zCyk?C)?gL|8U<+qa;_}mh_FIuK)$KASUc6q9YI+U*O_OT$I6n&rf?Z3GW{~M
zZm9fFM2~ybR39h3TH_Z`f`_$d`BgfJ>TJDG7;}!6QDw)sT2@}Z?DlhwQqphkNP|AI
zc2(W4(oAd2Et%j11~bZRlIDc$pbYDRV37Bf<4t3+Z&7AG2eZ6=ZTgL1@-Yw1V^-$0
z>em#bN33T8#fT{;38+N(PXK7Neer~6@dB37>X~u;Gh-0C(vhVdxEm7VpPQwa6f$U4
z^%9^NC!&dei7#Ag`yTjGbyLAj4=?H8%s=x*4wU*yov$r%+e49JK}ZY)Zn&OyT}J}e
zQ&!mur4<S?Q{egwoCv`>tXL(qrIW!Py{J|FSEn}u76uL#lHnE3{6Qsat0uN`a3CoK
zS7h{j3xb-P&r!0`AT{Mnw6gzzT>qYrF!lgf;B!wrN(%t_Jg1*~0b@PA&Kf5xSY(gf
z@jY5!XY0gx<e8^*LR?U{-lb$CVq&^XC*vDG@@F+JbR9_=a6#U8>$l`Cb*EkVhPTVr
zZ+{PI@Xx7LmbMc|UXT~n3ZqN%nj1)jI9=Ubrz=PvKk^*=VwV($Ugy?Ne{|Pv8UwqO
z?cDa|Pf=nERwKwE9gVfY(z-|i7K9BvV6S`EM>HPyfT>CA+j#o<7t2Mu55VyZ{T)`_
zQxDxek;!=M`KL6l^P*a4C*=08ewr>kSX&1)76;(kt1ipsef#CkuYZoQfXlD@DS6$`
zd_-Mx*Y<&H+kFet_X)>MGu_a8uOA*&Yxf}?a~yikWmgfnc(2v6J$&KIX;DozzeXX@
zAAjL#9k1)uZTcF<pAPB0LA$H^`;n)A#J?B!?Bn+vCywg%o-cd!oTDsBfcyTlE}$#-
z(K~Ko%<uXS{{`lgJ@DPH>9{{LvVS`Qq$##}+MgS|;^@yw>Gp}+h!JK1LAMZSP&u2=
z7;8=n^IWK!W`al}X)tb-WSB%6h99W*h37nBE($TY!h`1+d8mTbj!}KsD;tZ)q<UrT
za!_!k>EFJnCak$TFK;E+rMa;HikNWC>dV~S=<zHU=Ov+{7FWm58jlk#OOH)u4lv0&
z%{;#=#iuL}Dp02}Nh{@fY*Zxx!YxWTS&nW<?I!0<vlupan-!Jq6Y;D+R<IM8AcYsu
zl;BG9R>2wz2wXD`LXKR88fptx(h6YdVk0z2SimwE3zOj|F$+4?I!hFPV@leCR=SX|
zu`I1dSz=2TEmvoU)f3=5)vLrgPM{DO)G~BcTIc}OT`$H)ie`^RA;qc7%qWH?n7bU8
z5%AJrJ?g5I(URgw#lQm*Efd^=k+$+@UWOQm<zhE<d%BI~b`5zCnr-X1CyySH<1aoh
zSHJaLa@NZ(mFFINR9$z6)C#*m9=-c^x%a!@lzpe2uGZ4ka>ECHK`v1DV0&?q@u=^9
z{uA=ZUAM|LZ+{<|ZU87yu3;HG@xa}*H~>^&+&%f=J&a`?eeM~xa2}^il6}+b0YE&a
zaV@lc-FyCw998fGdk!&^A85=AfU}i?UsXvPtlGA0eekxM*+0b1;I0E0;opaEzlH9~
zD-=L0wIIIoNB>?9sQd8x5B`c={f?iNAAaRiJbsV%_wB#@TO?zg^YSYdWFL~dzx^d$
z>26p*{GpC@z3J4))S`Rn``?x;)yjGOdwx-l>4bmajB_~VH-GZ~&(-AhANVzW*m`6d
z0@RP{Ii6Jj9d^@Fx$q_}AP&rm4q{uu{DhwK`=9+k<c_cWNwe$uS6n0S`)hwsU7}x>
zoB#NKPt9+B78>XN<_*{T$oIdc&&K79Yk^s~qF}tRyjRchNd^4-d0lV|zvibtq(FbE
z>^bc)-Lr!f_rd#z`}&GE{|sYgPd{)c7X$#j=d`W$lSiAy$f&r{NNm_8tE)L~h6c8Q
zSK7jm&!*XeD@jxqBT6-#Fxf5c$t}JU6K&n{oKjq=NU}%%jASmti|_)nJ1Wmf&2pPO
z>lEw{4pOyM>Ww|KT2O)>6?Ki-Cygdz?fIv<6A5}vE>djPTeZ8!>e@k2_eDWOf=O+q
zJdm`ED#@I5^Q?KyP3+d<Y-H>?mE5GK+!FITWh^uqQiWn8nm}wAo-qJyuk7bLmF{|r
zU6Z5ANF1r%HS4#_U6H|)sFUi3xiO7dNg_rtuMefTYMYm9w|EoSz!G8_ix?cFv?sD2
zQN5TbW)D5ps-m@(@;5{BUDgI<Wva;BN=e&x9;?x)ZdZTT^0%M6=kL<eadWY905PP_
zj9>3p8yx)>i`?T~M!95c3ROSFR#NyLwCm_r6a^?_UyLziiM^w)#N6oj9)D#(@R%a%
zn%?l&pR-r)e&&eX>1I;f^v|}JZ}3kLC)SQ1V*q{cq0`97L#zhC^MkK^MjpBI`*QNw
zQO0sWayWSSY`xw#sq;5~`r`zt)#FFiqB&1a(;t8usPMOZ?hnbl!@%x4bh^ed&f#_4
z_ua3{-QW5$EjU;sU?M(#|D9aD!%etfCq1fnsQc}%Z+%I=_xV568`RQR)cGWXAU=f+
zK#BO&Z5oR*mt}uufaM4Ek0qU4LD2^Z<f(`5l^=ffGbA~{n!D%bFU##;`80_c`_DM6
zFF>yQ+#|1g>wD?`!}Wr$50>4nU-*RFck@>WBxhfIxmt+N%i{{Ph*fphPs(F=-^O-u
zKUdXy1oLkHnP=;DpULsL<LjSM(D<58?#DUa2M?di@A16ct?{Bezy8^6l>P%}o=est
zNE~>c4ypACfP3z-2RL^7bvyw8&uE{Y*H~aPKf(<J%TnWVU^{{~54S0R`@!#hgUr6I
z8}hvXMt7=}2$mn(I8%Y@#EZ|$6ZhXH&pmvfJ<}Sigw@v3MaTW$`HI~0&ChbIkxBqy
z+N00M!V0MRCuxa2rT6vmyKhw&^7*9q|M1Iy%=6(|F&1rg0UtPgo`T$djoIC$=l`U<
z`1nJ8qD`0%H^PJu=e5wnwqNEve%k%@fW3?AX4Yr>rpJ%U&s@I3{3}+MC?nlMEiYqV
z<hHuThMb_nY0k7-LO-Sx-7-tZ0004AsmLR9Q@eecBe>N<(lyMCpJuGXx+$JW0*2>;
zF>aJJ_H^#ci$u4#$-7zPMNei99;=Jy#zU+I8xm_FTa{dg$ude_CSwcQ{B7a=e(aA{
zW!+B-c3&gGJgKac%#k@WA{c<0uyED@Z05m1Ci$khwv{)o!o=WX{7uX)8eA)|bR`Z0
zv5F!RwOBqG=lsIP9*p$h0_(NoN9k+tA~VZ0<o(#Dxexnj8a!7IH@R|!k(38k$A0{c
z<MiL%a5w@GH~b9AZOFkC>jY2}jj*a`uT+!1#g`e>&t7JgLM=xC6^{!B347``Y^h_o
z<?{Djg?JykU1SFq%;~bM@!BYusQaZOc;Aa1Ia=oOUtN2)eB!o;8o#Jr;FbkmnC``b
z3vh9Hg_AyFGfk4He@~xy%P2r)XJcDKpw#y^HaL-`9+)q@V2lMT>uMmGHVo+uhz+>;
z^bZeA=E+?!Y8$pX$43BUusdPp3^ETl?{4kxJN>ZyxxfD})P40m`P4uA`;1jt%%>W0
z-0*YqI`kUgqQn^DItGu!cZl18Za;E7hI}~s+;RB#VbXC!cOUtM6*bH)k$j5<Z0yGt
zudSzktu)qQY{SsVTedOM*>qbHa@b+tcLBUM9lMi8Mzy)+v$GHEm2-8`@{ewMME<7_
z9F`m|EmxGl#J0R-<=x>jOtBoySO#t>zYDFongtsUMn@O3d?fVA1`8?vGth}52^@Hw
z1`|If+&Z!5vVOfPY-YiEeplwy`($#7G(-?Q>K0?O_!`M15GF69=USPJ650Xi<$it`
z1HF#*5&WoFn+0Nt%U*ofwGOF)+OoViXamBDfaGZwi*!F@dm)fZP`VO4IRx&ej1Ewl
zGY<#J7)gBuAV`(^(yBLGvUKLTymmh_A1_#Rz0xdKPw^MimyDdtff-<j;@$wmVJX6Z
zf#^ixEJ|+CYKJ8@BCCX;N<iDRC_5Xa2^NdjXVd))D!q&N4a*ug72S8y>6ic?lo^QT
zZ<V@ke7&TwFKGO$hdNuiT1q`xS!m0mT1*?Yslf-2*6~I_4H;%{VV!Iv76wq%_D)9A
z$13a1PNLZSXUOzE!sW5mqk)8B{0x3JxKSdd)7k!=w~t({?WZvbl4_vcEr)IX3?Nfi
zL-)0H)(G$#(ilDhMLkTnJGW=mEqL_Vr+BTK6g?&!w{^qB4w8d+d((0F4z9I%+upv}
z+qd2Q*FU$&<hCcBpU-_&4IfWVa9#7K&#;ZUKT~yR%dR5BuYado)Ala4m)Z;yzNeUL
zu!4jvrR3D>q?TdHsFtT?u^^{-XJ(C2y`r)lDl+h-ud2by#&vWx3uoL_Mi8J#Es}Bv
z%5x;`zkI-gX*r`1m3SG4fs3nWRg#(a)wAm$HNQgDc8kMQv9I#Z<5K-AvF8ZD!+z$L
z3J^;pe<XIF(Y-?x>p}7`pYzK0q5BgH-(UdAp#+J9F{DWG0}@M0Y2FWjnNj@>2oo*6
zS$>Csaw>Eqda6J#u?Q2r-8^h80x3>|@0#c>#<R%$di^HXB$2olE?lzd*+@)7Uo4n#
zujvrdaHvvj%Uzdw*2K6rJcd|U=5}qMrC)Yx%h75}nl6O8gJin^yg={7rO;R0A_8|6
zj26^M+tK5e5F^u7IB2HGD1-K0Vhpl1JUse$*(+(WF@H<!A;rT2ia-oAzCjaauW>KZ
zP=Jx?-r;E{&A~}_{J#B_+>pb^H9h8YYZFA2um0ZukBqrV?a9P8`|VDDZQ~o<y3m;C
z_-VjvTl-rMoaH*wf@<93I(Dol96PbC8Nqu}+o`=>!mlwW3v|&Hu6)7CN$141HJx`b
zDKRs{+;1`WNwPLD>(jlxspuAjSUYfqrF}MZ{z36ZvF4n;XH|X?%LikSqz8#M`L;55
zdsXZoYEO~%R@!8rHI<N~v*{x9z-s0h1y=73SwBA2DA)&I7`w%TR;aw5<dqf+l2kb3
zx*O80GGER{&vR{=C1TP^MsiEJWkxqZVakexiIn7PmX+OD03^qt?8{Rn)e#ax+|o>y
zJ1ReKihJSrbyz}b8E>4_#VgLWXhkkdCPqUl%G5kys8G4Yg@4g+dRMtfF$=QldAtkm
zNeh5&inoPev9f4fKt2PIqT&J|YnzxMT!6GU5Z6LMFX!cBSk~bm4%W~Kz0#$k;6B)T
z(Mp$8E#!YiIi@!Ao~0HUiHl2%bQ@-gLh7$XtIisE5b*s0a_ikLi&cW@k%eK?_cSkr
z%(RLPV-DN&*@VeCxelfQz{#L7#`2nR8$1_WnNUz~wq2Q>!ltuLv(gSze7OB12gwPI
z?#2W@Pdjsgb~<*aV6jv1AK&DzZmEBmtk%~`2}^+$k73Qg*+CJ5mK8rNmZDoQsDx`4
zfQ2iZCNCDNiK(z4nH=c2Awy1W!M^(ot~pu{E`0=GSkuXOaoI=>tvu^b+;Dus4M%ly
zaa9htnjBafQC<m+n^9ulooV`k!E(67EJIjkDEer`0|V>mRBv-LS}qnkLS006=SfI%
zNp(|A7{Ir<WZH?a{?MnDJuO*Rw;EFhI_7GF3$v<B4hxnN+AlXEl|2&pCMhX=hj9WJ
z0o;1)m05zp+=94Ih}EIWG9{V{OY8>NY^+vZKr=R~7xdJL=kq4zju>4?H(Ab>BG7W6
z#l9)=ndB8;+?eGTi6J?vDz9n03Bw3CUn|5W;g$7l=-bacSD{o-NyeMl@km)un<=6d
z3F~C$N6kHv5ZalD7@bgS42C`yQ7D&!{Fn{T%7*c{p&jagl~b8Hiwg#0ans}-X8^Jh
zv(BW+a9WTVJ*k<5)oxg7v9Xl~`Zs2EKG`B0gy_k~jQf5x_}F;v7I@9H&1f}^vRrm@
z{$>b<f6XmSI9|rIG1%77@!N8Oxi4wLB5lTIHvOG8Oea)<C#~CLpMuAbz^=o@2`eY$
zDUBvH@=p>Rusrr-z#+_IiteHd9(Tg-U6yS^9Lro)NN^?LqZMWE!9oGlW8K02lN2_X
zYwDVOF{NtMPHfPhV!`G;%ysR>Krpc4jxMesUb&a%mR%bwJ$ubVONI`{Zj7;Ue`aYJ
zT&H4+E<we7wa_Fg!?FZ{0^^6dv{PED5-le&{Y6j-Aaljss51KTnE2C;Nb#<eWNj5a
z&@Nn$WF$J^(3M!2^;Wp$hI62f*vd*F2M!dxk4(mP3$Jv8C0S5~8^6(#cpFPH6^pdI
zUayo~TL~0eolWjsAp3896`njD{l!+sgS!EeO-RJk;qz>?nuw|<pgu)y0G>c$zrFYs
zR3*(SMZm5cEEd%4R(M*@1u2<rSW+w_Epk!;>-kQ%IeA-qUD(-~<cHw^fUQ?%i2)!N
z3Nt(59tdMzn>gfW=uW3_8{YhEw$iL!jJtVFJ7_CT@%_xr$9WGNIDYh>lXl;gEl%kF
zZk;nu`NiDl+og_<yrt3NB1|xK>mgCbS-IF%BUlkP+RDDjLsMy29KaCl2Y|pmwX~EC
zls7R|^j>9vlW6yGph__&R|NeHK#huxc1R)5ELm6lbY$F>?jkI_(4osD!L3Qkc1x&$
z-s#p(hp)||s?AEGj-V4iPMoL=)S{CVqBN{RQtUk!jq+1fpDfYT*%GsgEJw^@K+DSo
zEyRU|tZ5HGf%sNZxBytEzv(Khjb+I3B+cK(zO!CxJg;`yDFYsWDqXke*Sh6ssgsQE
zKgP~_k*-&!6*waj_YKlb$;FDcv1p)88~W}*9EY}BMZs&sb-?WkylA=QMQhmiUtUIv
z76=uc9?O=rX?j;2aIOxbtvpbnxTD|K3c*MS+=B^P&3q6spro<jX8cLrZ)v&B70#lU
z+(?<)NK__`l5wv{ao#Q{^k8x^C~lfywOV#Kp9w|H_L7L~Y$ZLkjWKOaW0f?&Pi+ZK
z_-@1jliIOUZ?Q7{pqb7;>bof3*kr42;%%AZ8i(yLjpZdWaDT#>@2A|@%$O5T?32Ho
zQ=Mnj7b2V7hx1xqsSx>2EU#f3EiR2!fDuOtpWK8A04Ci|#kkNS!xc#=79e9TG={u9
zhX@<21I!;qk(Ro4#TdiIMYHN)RkeIoZ}Bfvl~`KJ8}$fSCL3;@;CBE3lVwZGfyzAT
zmq6^2PFX8iBQ@JfwEEHod7HBHy~<)nPBz%PCwJjpOO7rER4S~{q!UBL%88ivqP4@~
zinYbiuph?-f=L94+<->`8RQ0pah8@^M(7YH+PRh!K`5HL5DC~_wIGZrp}??`TPc{_
z#=E4Dy4ZtIiYuHbc(n`Zsmu4c8ZrBpa*sFW?nd>>(lNIJoV8h%?cC-FrYzLf{~|L>
zEyWHIFQkH#*Z;~o2JjRZ)_$S@Y0*QYaN5BVauX2bjOaS{S(VXLJFZd9jY>P%T96ek
zcWPNv5L?k>_iATf>~2U&f24w!LVX+5@95P{bx=3-$^ne6g~Ej^Gg;l}k%iU@PPZ(K
z*_aQgX3V<y+w|T}0EwA^XWRjsw!tGuG(Nc7*k(5aO|$Qu6T83CGPF(Et!=UkcHHNq
zcbLu<xuc7jV{tJ<Gjq2mJ8Wks;I$iW!)?v_Lu}<RtRgXDI-O3{(9t1IK$cy*a1{m%
z;8$Lsi!5i?4}^umviF{cl)LH#C+ETz&xkcqB55ITW#1~y>MCoGv9xm@iwTq<(-ft&
zm|ClyIn%Cgv;cb><`l$aO_yA-Yuo6QjYw?Esr_Zo;$@`+Ko21lpQOw{F;?C3idiB6
za7sJD{pPxhiCIT2K%GZvF)kQjqKY$ew+JY?u_xjBJAS+;3vG8my32+Yn~i;EBoSJn
zdhTT-a4-&r#QUy+8^{<bp_^_}T@X|o#>9mMwy4$~60cX+N*X1lj~ze`F+H>aFoJ9r
z$S45kuFpilJe9Uk$TROx%^Wi(rUSsRD1gPNZ7e~=q662jcpii2J}~kGM6Im&7!Yq+
zZ|YwCZ5`wb?d(yk8nl6BNTKNOFZ4Q0ItF@%+|s~LD$qeSV;^oRtgG52q|jTS_Xf)W
z6!0=qEn`F5K8adUp{1Z#jRdS|fo!^$ZTloXe_LCR>60ubO=RQSnPbI2!~T;dr@1V`
zEtZ$ea{LtE&C>8R?F_dbWhU!wSfhibmt@j82fv%r>YCKfJo}A0aO>Ti=NTLP8>E3f
z>hf7zElo-;GYb0hvROe`VXtk}1QN2)I_8#R%qSnErPr=Z9_Z1bTpTHYeHR&N?g|8S
zTV<9UyrJ$eOz`-Ol=hHR=uOojcNOx&zl-%ibz#hn$StdaTSykC<7MWS01V3j3^)Ky
zqT-txO(emAwDhue_Myq&F(1tH{m@R^ldv&Xj03g|bZWPPFsQWlR!mu9W34jMT(H88
z0B0~3DFob2=MJ=3&Ehiaj%8Tjio~gt7;kNbHJL;VT71{Y7l>PJAV#<#)Oy^z$D{ze
z?jmJBGs|B~gp=fMg`1GEG^<PN3F2n`g6WChO&c+n)sq!-+#pWTtIfp=fp&QE;Pori
z=8*+~OE8n;PzX@O++X1L9>HrxBYCSmmWVV{PprJNdO_uco@hx2=$H=L{&q|DF4~06
z3bSAp>IqK5dMnLM$g0PlIJn3xb(gW%V;1Rh%~+eus&<A=&;2~xu$OiFJ2afdH`Wz1
z=Y+P+dK1|+!HNuPYmC(;!w;I=r|AHD`u65OXzXr7tu9-gPHcJ(@Y;M98G5g`?K5S&
zvn~ow#Ww7YPj&tw9UXUF6SrV`q{okS8Rw$qRGZssb;HC};reM8Hdk0OZOw@?_c#`-
zOtg(<2(ket^G?s%hnaX1abQkV53a-o^WwlAxIh&QV=q@px3D(r32GOhxYHe%x{HfU
z+J>a-n`LH7<>HDP#_a1NFIBCdR&EK@y`IszjnomjqgC>?T(ZLRxib5z5#6n-Bs*n4
znKSLIy0C#8K(xCKBrzfbEEdG<0QexQ;978f>uYtB7ngFu3fEF>gk0Qur8VSCNU#<w
z7#yh4xRM(&gSZ$7tZ*+b?*%K}33+XcnI(BC#QUh(=oO=bvoo`VjnM`dBj53g%;+=5
zCG&!qxLz(G@SKnhYF4WPbc>H64hDc>0K25W7evM$l4ive;-kjGGG`jDWKbwaV<=(b
zb!~8FHSLj1+|JESXvt{CSV2$LyCn-zE-ke9U56z=OuTXl=3!ZyD5m5?UzC})39H^_
zr!n7bb^Og{{cH!tomy`rc9^=+q1Q3N>KfQ(>d&Wbcj7km;3*lLGlJLPVItGGU8g_)
zth>zeyp6Pcce-%cy5o=zO}zg@HcrHu$pgVf#0hZOTwu)o@q&U7K!`pGa`g^ZP}1{@
zo{VdHPCOR?&)DOh9P4f>CKv~!#b?1ZFv)(d%&ito+m~As;7z$haMe)?HyD*0RWM>N
zdWB<8ijG!UV`IbGjxBp*d5yf_jEX?4Di0T7W}>+%$r$_8DgGAye9<W2_!lw2l=H@l
z#jFZ!Y{&(5qfrc4ERndQZZue6j8{=2Epm)$UFlR`bqyfOf!Lk7E*%V8xicR<S-G-A
zWPHY?>>@Nmw*Y8ZNtBTib2+k2PgX1P%%!%3A)sCYu#n2Km|h~>h-5|fEZ!HAYdDy(
zl!S|6;r7%$$~?4|%WZ%xisWHDYpY0#Q`CZ`x~`U277Nzc0$Bq>MMzm_Q);L*okHDl
z9Rj`hveRpx*(H6D7HAXN1)NaO$`z`qC>%`J5I4Q&bS#*vAm?vXa{|?<muKwDW|N@E
z43oqRR@X$UZ;0hJZ9hcDTL<GO-oaqD{8+(jV!OKtUj3tYzRdz&GhhEK$Tg{r8QPiZ
zL?b?$_PNCm=A5E!^Nm#uj+QpF#3|q0Z>0fB%TsI;cr=9(L!b3#RenwN0`V@>i^c*u
zr|Lw~;al318Nj4DhPW3SrHJ6_@WG}3SO~ZDcvo#e0E>tu3@0;G!RIfXH^J_!N~;`?
z@qqOJatMw`tO?1oaOah79d@)YAa)p2!eU{t+AQNJFeXO^9<C?1d@&<dnq>$V8{%l|
zAT8vUYt>ozlqR>{X!$tUGiKy$&Z;)+G)epox*#*R{#akjV`H#d$##rZGjVmjCg|`U
z1_OQM<pxi3#@)p|C7GjF_jA0Wcutwct?1IlHRi^(=wZR(D)h`jYn#Lr?i<=)UNmBd
z(a|$w0Wu#uA_i3wxBy_b3dmXBgj7owT`T3#%8I<W-lJMPq+43*RK<z{cMMEJBCtfF
zIEqsizIvj$D4r#a%xYI6#{eLS*>b{n4qhw!4p5_Tl-A$)Z8VsL5nqIP+8OfYsJ>0=
zbC{v6{`Ya@&hzwR^LKIb0W#ycwwa2P+ZeXPEc196bHLQ?>|hKg^<mmJrrBxI@u+rC
zZxKyS+c*G==|BFHdsH5=5qNFLGz7(4A}4Rui>L@(wU?xqM!PS$&4MHlv;q~dL_mxP
zZqejk6}WU|bIdcCr*bc8Z>~I(G6G4X@cLJ*W#yL`EOV!c2eosv!Vpgap#!eD$}Jcw
zQv`Em)h=IGlrBaK%cX19R38ii!GJPU0OQ)Mprm6+K*=n@*$P~lHA%28%oylyr1CAc
z7)V-<IF^JEF&Atiz3{qYKU35su6!=`n^(J~C2pDGt`sf1SF{ds4C7}R)jUYo@0#^W
z3p8X6Thr<SnvqgD(S`UC&E*ISkd*w!O$y#b&HG%ICIn0tXc_}wa2J`y^7w$P)9ILz
zEP;cu%O2!rWfmCYL*lF*kTI%Gmkl8=3oOkF4;*Ok`W>vOWvCCQGMnNFg+y!A^3n?c
zUq4#mNcJi7Iz4*6jaqgLUeM!1*^o^y(v*|epfxgV@|=EB9}QgFjtMex->rQc`rR&p
z*Yp52>AT4QHdA{ez-!h?dz$^j$UjDYG`6vM$8^&^Q=T-;{bhfbtza|?v<A00sjVPh
z(bg;h%pa_xTRS5ynyy|$*T#fiICv!maWR4JB;1XBQ%tPPU!uFw%5C(@U^N7Fzx8!f
z8sD?0O-5er?mp`8VKQ!+)zs}6bvs`$c46hBxZKrF?UG7$b3?LhK=mA-Il+T{bBhHa
z!AZAmR%KP&x%*@s&sU4ltsnh20Rr>7jMkrGK1P@@CHTzs53Np_fqA0e!xAgIW*h)$
z;ZjYt%o<hr%m^;HODW&Xz@sKWoA|H&4s{6%s~a<4-G-LCyMRRO(&iJo8L27-)eNse
zR@IXHJf=`0rsf|_B$%<qAWcjWEJTnsNR3b9>f=&$9hEIH93Z4SAfOoyq{?8cl|oE!
z5L)20#MFE{sjD0816A!MFj@5X<2_izJ^(mDu=osBgp)rbx=^H;PZ|T(B89aga%BVM
z>PNi@lU@>R0IjW`ZT(~XL^5VloM{r861--ZRKu3GH+?qa<ZSy*4_-4*_yfSTlZiVF
z-7(JG&fMS?rrdABPSY=XM(j83j^o;&v5h%TIdZFemdu;^YCO6-EHU4xs3A5t__~(@
z-+5*1XD*{NOMs0gs^_jKn;_XnW)&_lOKz-3r*ubITPqoV&%LTJEQ*$E3bx1uw26u;
z=e<;i%a@C_B`iaH7uK3dAK5(tR-Qc8mF1Pf5@v%}D~@&@;<R`ZZ8i`v*QdGP3NNx~
z3~w=Y36K$@6<)N0Ru;=Mu_uegvEPfC0THZ0Xb3J@I3}jRnONy4O!r94=J9z_^00@}
z;)90FmL`y{*;t?J8wOZN_C_oXa#^tWU`4|6f=dr98xlwuD|A|XtlfeOWILi+#wT4&
znTrz_BBstF2qx<#tzN|EI^B}RJc(zBbygtA=%{bhrXsi;`pWMuJ`m;v?I_aY=JH{Q
zNDU4w4whVs7%TwUT5UkZEOp$7B@{fXxC&__E1HSbH3yAB*JyV;aBy9NEE)?)q!|0)
zPXe<r?z3S#OxU&^68k>#FmeCE_2zUZnbgIJ*Er_0srxb4!JC_~%^Qm{HmP-<YaTYX
z6T3abIBz>nMjtR$TXBcSi|kzAFr7?f>PBYVeSBNdm~nZPaZZ7iRd~5vOEk6E3+p=t
zJ3F=WdRELfw^^G-9>r@l*&;pb7e^Ff+y~R|3W`&5^2z9y>bf{AVos#fmwh2xf}c~=
zB?KphSRZ2TVzar4-I`RAeFrNL@hA!>1S>olNzSlXY)*Dv?Z9Bx7=?G8*g;VBYR0Kj
zadPjGxPdvjotvbTC*oTFEq=y{Kg9!EPTBX>Fym>N<y4`P2jWDWYipB;ihhpZa~dtj
zEHs*e1T}ZJ)^2n_g+4JEle&K81P`*$Tc+|JTrobCpfOQha|_Zp8EiazZdJq0T0xMv
zWIX_L(PpkuNuV}C_yUR+=q!@*@C4wYsj}z=ByHfcm>v#`Sz&;{B&<-900Ze_k#1+H
z^@S{I&^h$M$*ia(^9!OqAXO7o6>{~>_pGLVv;bjK6?Z2uhyNS4d=|ERIBv3tLyi}j
z9~>s0D{TKvMx1l(Ikuc=nn`CEF!P@{ykE0VV14i!ckoo;wQZ+U3trpCZ_I#BGd3}9
ze-39kKJ7S}F)NeXp7CaGeKThQ{Q+O06`9RwSy=^Nn;$5j<kpSJ9GPW?IC&~Ll9Fl3
z9PHUb7$C;UE?P(e0F?(TC>fkFh*%TW!&xtH1YXgml@-zBAYGL8JDewkbh^9I+TD8+
zGS}9#Sem%C2k?S5!ZIXcpRupC#ev8v=vaDDVm4+j<3zGTVdDd9gd*#SB;n7D6>7A1
zGWrT8b7p1AnId>ai?aofHv#&P(?v_vfweMI(Abl`+G9+iA;9E~8a}KoljLH3vfw&`
zUWcpn>d;*$u27Xe3FUg9_`KG2qhE-vQQPOUZ1*#BcPlCN;;crf?gtZN4!$TU$Xtx3
z@(z=<q+=AMjD9gUqyq;}!b7kOX5{f6uguUB$Xltq5DFQ(_eO1lvaAmh=<Zg=rM40Q
zyk$m}4^D@S?harky(bb%HTwDA{@TQ`@5}6y>|pzGe4GBqSfHG88<%)G^K}e4V0;^6
zSbB2~;w+1TX}_E1`&sv!cHf}@7N*#5)cM97KQ(xX%<VcHY=_%U+nKbbg+ffFG>kqD
z7a$80=9#<1%=##tWI?qBkGV6KsWeV(?rAicTMU&G6c97()s>`x6s#j+Pz+8dH)RgE
zw2~+|-G;%yqpWS>E^3paODx955^(^lDnpatb0|OvJuBU12e7q7W{WQwVK2H4V#*6M
zIy-An`Hf6*C(MWJUo@9n?LxUNuVqN!E*<!S0RU*~h<^ok$gCa|)Qr4#ODLl;>DF9Q
zT~A`hN&SQ1BTm#vu3Eo2RG;_w7}6MUPO6-cN*{b5xIzn(FL3?Hn?r%f=wMG22+lC9
z+?u0ehuuF)e-&0L24jTh0ECRp`&59=j-X@ZflgRRu;Ab~-UzO9oY{>k{UGy8n}0O8
ztkW83i^wB@?=mwht*Q%NM3H5ZNasM@7FaAmSl*;S#v!SnxB<~bd53Lr>l?7;yJ;rE
zQ5MOpljx>*ec+GLZP^WtLq476e6#i~jM!oP95o!gW*xJM+s;-KL)zGShd1vgB2xkK
zT!1*@psCxL0DjZ7HEzK(s@>gMpv-$KA@P(}&tZTq#)-^hADEa(RtQ;R?POJdVx_eL
zgMn(cVuA*VOp#}e6ch*vnOaqyb*t)Id7KP=r-w;uo`;%%XsToJs^F8g?Q8D9vSa;#
z)Do2DdAzH2p#LPD)K<nG)ba(Lyw|Dh;mR8e7UM~7JdxPsjwJ>m)FKD~nE?!QkQ|tB
z%@&UF^LcEq=OVzcuwtlb1%f<@*q4QFERI*Y@Nlr^&1iwrJYs&93n1imJ9{zZx8Xc+
zPqvwNH=wqpZ7nPsu_C#3sYBQ*8ijsV7-<P50AY2~I11vfNPC8A=jtP-SUTy&o{i9u
zT*yGxUPD18Gbw*4S7d5s>A#Q~apc9b)5;A+xyA`b8^wlXVdQ-=e*!*Vy-6Ks^ekp3
zP>J+otfGRu2y^F1V!$jI8ax@z0n4ty_M2%713#0u*!<@|{Vh)V{1jg2sT{&M)AwP^
z?=w6<aqOQj&GutB>298K+O`_d4E<6ai2+BpoWzE#kX&b_$5|3lpiFhI+<ljH2`dlo
z(^cgv>ZTT9kXShbuJrOCAXNl+vDNN}BS=JR56#;AWO-(JVE|FN`x2Ywj@1p|lEs+x
z2@9j0msK3FF#Q}N?po{vVq@jR0V~@5Y=!YGEbo<8l52KS0mNiN%!Ao44OM&WFPf2N
zV3pgLQPJI9p2j+qM$H0ST_-THI3oqu&EMGMdo|bZF}bWTw`%Rym|aM0SeWTvn&7`_
zKr(Naya!wU*jU>_A$O}ZWc|JvLEY{_2Czc-X<0kCsC%_MX|2hP5SJLC_^qxOGBYbl
z*R0IHyhqyri3KZxm6kb!5wC*AROSyO)$=`5yJ`^MMhhw%D0_nI?L_DMZ+Y1JTiEt8
z%<~e)EeDToW2dIU6#dxp!9+0Hw1u(z&(@Z;H*)_t;`4d7xbt1cheEeMC)1v2nrn(%
z{}|H7Ozp(+`^*O9(`|9ylkM;@+?mRY117=R<c$E>AgPsq*EWf9vaM2`D&Z`~iQL_G
zlm)81O0dVG7$2+Br0>NGb1STv;$w(y(b8gk%~^t#d6X7h6qafmjb5Pv0|_F*@|l<z
z>|l{Bha~iysO?QYlUq!NmsYQf6LPf4yYHs!drTSy4|ms5vdMu9BhoExXE6OpB!Tr;
zN<*}uTQz14ctoGuV=y3N{uHg6%qjSFQ%)t_S(5c&+&EJ)^V(^~2+ZhOwVX3)iU6;>
z(tY&%%919uri7s(n1hV>xw|0u*j?^1J)6}meneeGaTaQhglg{N{#J=xjX;SQ8ifFn
z%1!i)189EY<sz3<PI^Nlpj~|e7oyNKWX81nh-vBSSs;;8y0u1Mr$63kzjSsH&3^nH
zgz>Sp-gc4Q*gW#%U!GAb?l^M)@%xBBAX9A<C-y0=fjH~jF=1ThMwcz^H2)d$`M6`6
zZ3~#}7I;m0eY*`_J3i+O`%K&~_Q7M8zQ>urn6tfst@agvvMdr)t}1Os&T6=+CAVTq
zmkS~}!&Tz>)ARBf5*v~O{$IK*lj#;(9uf1rDr4AL9LTMy%;?#rE5FlSm`UGaacc(0
zwD@C-d&=DTHPmi7fSggeD6VxsB;&&@3Af$|BxP(;go0a5cta>^+q3Jhq7f+w&^|s!
z#*PiS1Y64~@>C;nFk}^uJc$we7`hs~g_=C)E2jJ6${e-v3>agoOeF&|a^~QK7+c}@
z3|P^1AZ6Rh5Wsi?tg8NlQ8dc`wo~pz6n<7ZC_9+bQWdl2%5tDKS#5nTx*k}BZ@3pN
zaF;m+G4mxri#ZlnaTIPmW{P8w)E-{dGj6zwFnq;q4+5Ef!*Jm&2qr1f*!-}S&p5f?
z99Ag}GL@Tfw<eWM4Tf#Mo{Hvu3o>{Wap2SOACCN3Cg~ZDW3p}EHurDq`NIsKPy8;*
z#Q4mldy)Wkdpo1AW1169bKWragZ{^ZJsR286c691`#<k~&ACT?F>NCg+KWTJFI<_N
z<c2olM>ZKVftZv!+uL)A`GjK<CiA<txJ~A{SmLA&i^*85HuKn7?RiY%>}a4;;iLz1
z8&(aYuJlPCi|F80mC2ARWT5zA=0H_9uD{^1uzbOMTZw5$4L>&FF@3k1Y8Q*e=V0rh
z?<AzOolS@KosePl@yrPjM!Ya9q;3+Qkx#`jbvY--)ZA=~(su>2YI9}GZmDZ&q~Dyp
zQq|5ea7(Oa`5F9Mn+R@lYq~44>*ZPs^vT(XwungJ8adv^e2*SGGjQbMpfU?EQSSj@
zRPqQ$LZRTVyKTv~^u<fjt<qCvS?mRKu5xxT#j{Xb3x&}nnw&?e%L&wK*<T=MA(sv=
zs?yK(*7WL}0EC2P6pKXfGPml|jZZJB`H@X>iVurk(1L!j<VqaF9{PD+npqDV_2NxC
zVNdtj<VkhbYncdMTiP3cO=G}o1lUXmUR!%0Q(fpZV=)alPi$w)WIYvV4(=1@KmWAg
zHL{%{2s!ODG<LuA<qQvG-15iP=Y<oH$HEh{O*{v*)2rRhW(VcTr4<rITc7mGR_csn
zk(n2nc#AD_?IJFYE31SIR@>sDxyx|AHl>7wv3X9CZ95l~e;8w{JYFPL%{Yr@1tu_n
zRh6u^(lrjva)@NX)peiuUDqaE6nkYuCr|H?xy3fWQ=s-2=`%O!SkRKknUV(MWj3vv
z0)EfRfS^z>3oyD^aans!E2tP{X1$TKP#YlSnFF=Q;?Q0%n${vjb+HfJk(p-(07y5w
zc7Fh-sqk=gOECI#!W4x(G}W7fTf?O5x2!5MEY`$c433_eV?we_>kYe?$YD!XBi*|p
zdggO(RuD~7r*BqnZuVS15N-D=TXC#pH35tl-OFS{+u4&lO%wSHJe`@TMKJOPSc6!}
z^gJt^$#0q66s&Y8Sru%+M$zF%zb0YCU-NCV0L?7mC7V8<3|`|_@x!liQk#Kw(5kXG
zww+T8Uj4qL&-;_x^uRl69~sfNP5W%>!T6I+d*0mwuSxx%rkz>)pZ43jg{@ysHF)D2
zO_Q3j-F&fMTMaH6Pi`JyUO*g#G<i<2p~)4>J$_`Xf13c4R1wDxF2%|$Igrh4^353Y
z;(A(YPtrBYI0_3g=2i43SYb2lor8;6fdsS4tOhDMz>4Tu!9`509rusXdciqcmMEM%
zIiqsTL6A67m1V}#awCy+J*NuHOHXeT<2wZYQM!tHO$*5-k@VcKx=8geE#H>3cX7)u
z>z5PBy;^j-PS3S&?iCF#j$>f4$dGx?8WsUy59Y>0C{mm&*!3hOU#ne~QDnUvEY?VG
zTd<p*dy;qpvFNT#NyR}qcp4}3#A&2WQC3QV7n#&CH7!M5fq-VHSKTAA!hnPoH=Sew
zA17|&s;dX%uMkkZ*hm^n$m(`-2Sy)e?s5jpsnm7~>V?(Jm;~*<V%*HkcxM;+>LT-}
zeY@>2_EjJIS+3W$xUxr<_wJW=dqE$fj&#;mW&Ol)eF(an4+|szoEZ?e1C>1t#lnK@
zJ8-&`-Hsf8@wsMC{P*CQXA@LTy!d?ooTE-0Li4eSfVOyzr=4@YUfVGyepiS?uC2-X
z>Ty<^UefQ+zv4CW?4$R~(Py6=+0XvxfkMRx51&Kr$76a-?UwjF;5BaRGo#W)4{zJ{
zn%veP<#^<N@{<Q%{C*1Sabi1jfY-1l(l*w@8{A>^a1ZPk8tJ1&Ux6Fn+rtrDwwqD|
zY4NO-Y}O4YZ9fUXhG2z>lzBX{@#@4ZHcUYTGO`3l4sM(@F<otllNn5#(4!otIv?D%
zCq~?WR22kggBP)ct|E&~dW;SmwFC1=X{P8*L2-S-(v=?=%L|?kfL&@U;R3G{DEutH
z5{>8)#oVPh|DvmjaN-wZdmF9KfG^D?A=+`Jy9TpGV{o!FNf|#gcV9+jilo?XyO6yZ
zyzEOb>zAUv!Ky{Co+u@@{rKE&UD-9CE)|iS<Y!i6B8M1*g-RQ4X;pRK^5l8J2rWWW
znR;QNkP>|>%{|QGnwaa}aNf$_h51=I+XJyCvi)=r+G-vzW(9996*izL7{EYm5zlj2
zYdTp%oVVZ##;muDHEyUUPwNd8y1KYYREW31ThOa5Qr32K|F7Yi9MzS>s;*|PJ!h}n
z`^*u02*<Afo3~-xUq!1e=U#G!y!y@Wkn7*|L3!=le@0$*<<+wP^uuiH#L*Wy!H;Qb
zGw_Iv??D*zofvQ(zTgsh$FKZlg29sy-J=ggU%2#LfA+8N^GEOc!Nj)ropy$te%?jA
z@c`m|r=2Np_`omAyMN=a%Q=_4LN2`O8oB7I*U7#!&f<f<dhA8H>~(LFpZ%-<PuWl)
zd+hGpM)q@XyWq;#$b0_M-_{4aN5HGLj+YDvuu)?*%>-&e_Ap_e32lVIJtv<vO!>uh
z{h$7T>91pscIN2&T<4i|j2^UC7i|0Y?2~W)=&1bEMN2+miL5La)@JQ0=6)7Xqw!-}
zcKyXj?coj1b+v(CuQY&2?}@Sb%mWl%us1RKGDog7m!!#>zgITd)8&<9pky#EWs|iD
z+V-jL2~267c<vK43t>ef{|T;0S}=(v>HV#%zTyQWqPiWMuoo9B#FA+K)F*Uu1loiU
zFkGrh^*#|UOew=i7RDpUc<$U4>Lp5}51191tF@b-k41oEqW_!k6V@PEo6$%eZRBUg
z=+%*3gjn5ZtgBYWre34DP@Spi17dMO7bB*HnKvscQ^<&x=a!ii*J8V1|4^1Csi~m2
zB`YZxV8W>Fx2OO_R*AL%|LPw48!H8n4w-{XdV&L)SyUjm!-9$|{~4%^fiZz>3qFTi
zu-oa8>|uFeLiEOfv@npNU{ay!kJZj#^l}0*HaP}Uz7n$iRcgek<gAM>l@I=<zaj7V
z#ov%aXP+yb^))%56ZsAA{fK_{U&sY7ziRu!F&GOnZE;h(X$7(U^^Kd34@1AhaeEG(
zF4w%{1M-IV|Ds%Z!`tl!`ZZi}-CN{k3O3uWGC7%Jzp>Z;)cfUwzx8+I^6TEpznAwO
zkUa+usfDy6ZMBk?bdostvRBI6e&N56cm4Ult{~o0E9)t_^BbR+Cm+0f+c~l=*Tq73
ze8>t~tr=#KER&&Ioa&>opKskKSzz;S+aIH_<!AdjM|Wn5{YJGFr#xt?#>Vd!hn;)O
zKJ#=d%7}AKbF6z-$j-xjfa0;JLB-lqHZjrK$<2bI#Z$R!PRtrY4JuO9vjl3P(Gg^_
zYp}#5E6!+S4snZ$R#kMBiC$7n&n#bQ;G7m?3QgJjE{j&$)e=M{x=63lwPA&|)H<Lp
zpIbYyyvTq<UKewVLL<{<X+d7BQ4CDG9Yfd!)G=&j1S?pSNeme3>uK?xNE8GKfKhGb
zM{qnXzLtSAia46^uv?562hu46fdv3qIg5{N;=+BZ!3F?By|Canp2l5tYJ4<6U0O7t
zNiq{qDggj@OLHq`xmn9(edeCu2F=Kh6|f44>K`q9RJtWgt20S=<t7YFg@1r+>Fhqb
z>M&@*6bb=gJs@{*{U{Wc)QJn$35XgvsskUi{>?fvYT1zWlNpLb?xXf31qL@g!<!(b
z`*rHNSrvKd7poGA8yW^)tT_Km2JpG^`nSlL7hEhqy6;Z;;_v?(dF1Zf<-(W0Qr`If
zpO?#D_eQzwwb#p|_uMWE%PS^?sUW?$XD|D<v363{jvtkzow%s`U_ZFd0Dy4E^*S4z
z&=>WyqP@Ty+*(*-`oP-B<GSA}(*TBT0GT)a?61f}w|!TRKKE4r<sR6F=Ud*R5A70N
zbvS3Gc5_R|duh*pX=%iHdEb8hIp6>&^5AVZ%OCyIzb|XYj>x6g+#v7y3x7*aKj#A7
z=b$|Kz}<3E-H@v%%#z)wAj+}VV;A*2FFy4cpIWrpUR>7kDAm1qfR=T7nxhPND^5!+
z7`(>mTz)}@-TkRfH+HA(?T+o&KwC3h>d@n7K5WKgH|;)niDC0TyRpsEwKM_3N)lJf
z!Rni=x}Gp*ljVKa7mL?=se4#tJ&$FHPqrDY37brt$+d_qG`J4s^31?#Y0>I?VIu{+
zwo1fYjI!QSO%hrp>BIdyPT4P7sZy}++e$!cz?b4`R79_95<ftKAU5c}Yimwwb0rPL
z`w4uNyUS8|B==G&ZjE5h?3T%uX9aep>Z@76GO69wDy~V+R3wjo;rB}8cC~x78Vfaw
zCn#GU9rkN`%!_WiJZti%AmU3vixz9joje0DL4c)BK<DG0Q-~t^J?JNpTdg&h>+04`
zo?6B{tH9!%U}G*XSb<HJtASEShm|4?)aVk`_7v>ex<Dv4P@hJZ86eekC2MHyCB21;
z{1xMta#HX5@wJ}pS5vX%Go;8~!{?gI@?uMlcj&aGSfd3zBUvY?pq#6_u?1$LuB_Hw
z_z}d80xG|xIGT7Ofibvfu<U$m>12PFg4U`|;NSh?r{#g$zso!K&>gpupm5fOm&)Pu
zUnXaqd!bzS?w^xaz3J`p)I$%*1+RFO0@AuXasNH?hyUy!%F*YaVOs#1SH9t`YPp>!
zt4EK>?O*>>x#?4XKuhyy{`_Cl_Ab_T+XN&4;I}{XaryS2{DGWQ7v0tku{FfF4xN3z
zyiF~?PyNgPksvs@we_6WzU$}YHE(|(t;ACM^n)*bT5kL5XX)~L)mwf>4xV+6y!p_X
z1hGf%yp_ix)&<ak`|#Lv&&bmc->cVjH39cLwZJ~|xBh{A{@?yDa_6_cAiwh8{;$lp
zYw6N#<-lq32mk%w=6SDq#|P!SD_+G#$jKuw$bLQlz|=E(+sOnwcAxpcD@y;cFw&Pc
zL%XK{yrv$5Y0-XMyF<`wR<Yhu=Mov+&M>cr<$BsAiZUEA8a<7b*VnAX5iFoq%VeJr
zgDISuj0v-7ndmE+ZdiaPx;#plu+m9pthR+kt3OrOw$jhk%3EF4xcm}k^2(EFb^co|
zE$_+u6<m8R<wYf@2j*J<6<lSlwk_06tI#d4w)G3=XweGHDN>6Gd}Wy^B&)sJU7Gzo
zDkHe-aT^x<N`)zdQ`gN!X~2RqP}FyX3(!S#QD%hTS_(m@Y8(FmRu#&H<hk_`fScF3
zse!nAaDkPS3#a6p{vh+dT*abtatkG{NLS2lj>q-2y&W-Sc#H*e@p@K6tfFO=lOW>8
zp6fPR5;AauKo*RI0t>fxkz$>)WJB9oDD5F7C^LOQC-9yQ1`xE=C#VClT|Hz06^$zZ
zkEy&bDX1;0op)S2pw^n~K{B%6wDq28w-6z9bifMicDr01<xZ<VfufP<C99c&%%PwN
zc`0<R$jG2!B63-KiGfXzxy-X2)X5fPg~#r@OP+c3A%A<!-S?up%pOxKY-!&<Ieg(I
zva<hxEURm6<=_GN((nIkx%YcFsoU<&@`2y{TWss<8{Z}G{f)mS>nBghS3mYUa_og?
z<SifmHM#1IKSjdBq8@wJMK4#dyGy?D$NxcIc=~a<T&<mRE`7z&mlt4g%jf?{o_Y8I
zd6l;P>bJbxSAhNP3UvX#<5&Jm*-$I%=1+fAo_zQ|dGm*UU9P(Eo$BhlOCI^*_Y|0(
zmb<?FWd+gCDL^0PaUf^B?wvm;H)y=;?Z5n+a?z`<mFFINkk%9ccttHQxDwH!Wd*!*
zF1|vZe&l}n;_v<wp6g9N_v><4ujRHce@4Fd`9CDh7Qi^T4O^|pAzx0js*h9b5O;EX
z+Aq%L-Ws{@l-C!xv=hf1G;N<YH8|z2)9f_U`Nuc4>GwG7v*_`nZvPu#M7te*<qx6N
zoD4$7oEoh_VLnx2&aJQ2t{88C1yTcLiWYLG%G-Pc_Y&Mvd10<^C<X0Z$<-Zat9eYQ
zDgO)q0L0dHvR_}1RC-6d6lXv^Dz9*hejrj}<Pih8MYSrH76Z$2z;Xasz-<Sx0ac$=
z{GM4bP`X%N&Ko766r5wbD4Ho&qYy4bs}!u~>gcJF=T_Lh7{9Kk0AP$d8^%v)x9$2<
zjuk*Du?mgM5?HA|sj-s`<B8l=6`fk|#FpBGdy@b#tjRt5TjVa_Yn|qG-j6&Nmw>)N
zfJiPZSxNvdm=h5e9`9-0e=-1~3G_EsYm!9Ze#F>84-#P~JQc8>OJ5kEE%^Ru9%Gra
zs27}R;~Q!%ths=09SpEodKn$po+7In`CAC7Mwr)n<|TdT)}rMNERyC~=*=$$b;ICO
z1z_qfvM46dh`Ze-mD5}R%#IezE2!fL-^Pd+WYnIB@xYQ;Q?P-{ZgA`Ab*!zPkTcc2
zw`c!Be)jy+Psk_!xBr2z!+nQNBl+PKuYWTE<(hZApZnbL?XSp@XP%U`6DMT<X@})}
zjgdY3*u(tpuJ3$RzWN`3SDsRUSywmV4e$L0Iqj@-WoZBP8jrv5to-n6pO;_$Z~mdY
z|1bSbc}&kcczsvC@$CedyKep}8Gy&0eOk^u|6)1&;>+dko4zd1J^qlKdC|r4_<eWC
z<M-Y{0K&HS;2CnYT4}KQ;7Uy7jg|eU4ebjovd{dhf5fuvue|ZyviHy#^4-sUTy9m+
zT0MS*ZpF8J_&2tV^hiP8O}|WDjZd{tl(7v=_<D{Vr$1!e_i=`Ura4dA!r%wHVFbtB
zvAn#gksl_PC*n1!qA*m$@q2f@=G+3yA)?&Kis_s(DcIE`TAu%tqLd}eo>;t$jAb!_
zZ-7~6!zgP6s9=>Zm{jZ1PRw1+?fi=#hl1d2Vh7TN*)vc<qOg@p5py91mx2;2=TUpn
zT=n3SmcFoD*qnyqlE+J0eTbQ@u2v=|m3dJ~Nn>twd<;|xmsl_+9r{9pK=;RSjHzJ)
zFOoH9bp6WJ^Wm<<*aECmO)e_SW30RiG7AHHO)jxva9)AADI<Z+6!{rn%FG=L4jBMA
zcTX9ts||o1LUSl7(~3TSizQ_De4K)v3**GNTWiqbHUdrV;dK@#$;=Cf^RAw(E!NjI
za}4*C?%O4G{pHckR6Pnx?dupvB<%sJv~wqQfR{7NE7((*RMWGHv_*w_$dw#eUSzRJ
zmcZ75L+oook6zIpc4|=OGdZBX<`q^@7Lq;EKo!gujLz-1(kIlt@{H;@?TaDXUr<;z
z8*6Lox;v;=(Y}Fi^dV4J+Ftz}6Z(s4wOnw;Rr<hf$TN>U#65a?m!5j~esvALO(*<A
z^73omz|a58U;Te<I_J^np46DuqMc9OhlqV)1J!<G?SzvmhHqf!fmQe|wb0(D!1Zo*
zHx6zWz4Ene`$K>Azuolt+VNuwXe&lO7!p3S7}r0L6E8j|ht4`r-thikl52nF!*b1!
z9+ZdSF5R-d_{<ZGo1r<lBoU)KqMs$O2Vla|+`ie1wsqSCUTHU(3o~Zg<_E9g*D*^Q
zr~2B4onChPoUw6AoRVva1K^m7Dw5GxL7+R3>Rh{w6aIzuBDJ}R5vu_^4}`Bhds}P_
z?XXG(T#AUtD6*hjN!2mt9Y`0g!rW3lGTbUwI0j%ac~}gXkVM;N-7e3aa+#q7OjN4}
zC@oryr`z+f>e|bPg*ZqMq{LTnZxtRYNpUhuAxavFJ)Pv+OO|R>IqOl9HCCA#N9OU8
zMxM&Yk5qXlTfptvQR9FvK!gl)Be5Jm*0nq^Bpn9>Pc+c!ny@d*k0i^t$jv1OOEP*=
z9l-;(Ok13MQj_>$gqe)vTDse`?RjvBHKIW>5OMs1r3v&r7KsH5ig$`Q(IzHICo5;N
z=8Fu(ukZ!N0l>JdH*jseC%qyGv!f0DuI`qWM}QlxJGJx+<~x8HhlfCST7*vzK46%q
zF))a^s1M1aqINd|bt_rbn|rXG(@%<u%4^6WVrc<O=!0pwq}C1fwVb9&=_noeBJ<KG
zRo|Cek9zoJ!pq_R;zl2N?kPE;@vWD?_By%?pLpP2eJQ$R*PV08%jMG7Tqh5zyY2ZW
z9_2BJ?VNeuMe-xHUcjOQBN3DLiK8#b-QW3|T=<Gt%Rl)We@@+umj47dB;r(i_U-S#
znG<@rbq@gDEua5{oU1OytKa@!e)i0x5Axp!fAAf7`L%D7fBConf*ct*Cur&GYApiT
zQtH9hb6|tTbyTgxhc%{m{ri4FLFw%A9mAL@VD-8ia^UbebSokj2bw(yE5i>PuGX<>
zBA>zf8f(2o3!IPJrUj7gIcRf$*PQ1bcfhQG#3rUV@l1V-10xYO{j)0@R@iXCEia4b
zH|hM)G0C@f+sF=ZnQdsCYk8?K4MFYD(u%qEk{E4t#dR*Y*Id3Rdh$@r$wVVlxvZIc
z1cDjcUNoiI^$n{RlDi6oU3+Y5P}Qt$g_0;1SHc)9>f~D%W_=}>TjudL6W+C)uMTQ}
z<yOXo;G;WjprEcZDVZc3r2)5+^{X<fZloGqlsgg|6B1V{yPjoFAE1R&dKr_#K<vQ&
z1vzoD$F~wLLgrU>EDZo{!mCCSiMv(H%m8L#B{$*Yu9YsqmU*%>`j5C1rJMBkRc#-A
zV_sTSyHbZxodg9QVIe|OFnFwRVWGvjXdUB;P*TeafaaNdZOr4x?BK$H4P$`#824{`
zIT(HaVey%2Jraf04m=LcK?R^iT(DOeMSd3JRFMX_Y-s$e_PQ-tU?3T}P>bLM!N<7!
z9TS_PdIq(vurktPR@DX%2&83R<V<hxTGv=MZSeJ@F-c&i#xQ&$-t<;a;W~mv0|Ldl
zFS|_M{%8KIoTafWSW#yyAYFF#>(vEzOm6$ypEjfj5IKJFZ~ng(Nd8z|au>-}H@sbL
z|Hc>Cw;z7%%kqlr-Xb6R?f<*n`sGi{d6!-xuhv-8tzZ0<+<DWNw)b_04HneL|MB0G
zD_(!&06+w}@79~-721an{`TKt9P7a8XUR1`{Q<f6mT$<H|KMNgi@nPD+U3{YC{I6h
zzrHk<4|e*w7s~72^&#eMA!iKW*HeJ~(cQO=@1K4Nm*YtV>Ki}u=VhO|95)oWuX^)4
zX}OI)Yzpw&t?#x0&hX<0w=iM9ux-!Tu4R_}W@$%e*>{F<nHgMXK4|h*!Nt_IQuKvd
zGAJGh*Ainh-M%$t>;yZ#r52eLX7#zGsRoR#u1wjS<=@qVQ0OGxaTZ%j$LVw`0!QYF
z%lI9WGQC6#rgYBO4_EhAYtSeYk%R%MO%4x=5R7Z-@f(O~Z5U;dG;Y?PQty-k%#ou#
zeNWZfw9goLwa$U-C%cUO!vdiN+OmR}6b%lMaU-g_2P@6Ol23*AcOmyWSf(seRe_ck
ztr`7nb+zYJh}}h40&FcmY!7JdnYjTO11y|D8H{iO>#DU_nD;O#VB{`}8%<m{^EbU)
z8W5u1*vg)q9=El%o-IHMQv^xXpaG}^C2hZ>2hv@MJF1v~cpS#0=ZWQX1y)9V$ATPG
zd3fchc(3<$&x$SpbgT<_Sv%_TBO?UNKRz5*?28%8YJr_ZL$Tt3EFv-p#70pt{cdfw
z%fKIMa6zI27ed(&JqF4dQ4zGIcV{JEL}nN*9*{E-16u(S>%JS%@Pe5c%|}~T&hMP`
zGEJDF@bw)xe~p9@Bp+X`Ky$-;KCITtNqPMKyX5Pi_zwgmi$fugVx2C&pZ(3hrEbGD
z0>|(FPya8rb<?LmCI`+uORoK?_sK8(*MFBY=p71JH-Gj&5)>j;?(4<`2CcVZ>Oj4{
zQ{1;A)tnz;m9lnH{^j5KP5JHr`F9&RrXMIk?$dbF8$bBV^8Ua4x4Ak4NZ#_9kI9Qq
z{zx9y`*q1{Ua!FPW({nfl)G>K3XeNe!RnoV_OI{(>FISm@xWd3?N9!`eD_a3As1Z!
zYIXui&wKzo>zld<vd5qP&OerS{Mv6bnHl5q;?s{2%vds^9%T#9<~H2)-H>hccS%J%
zPCc29Y|Fpc{{58JSKM;QmXD{pwh?X2v&F$7nXssv^;9YB9Kw9ZZ`$Y*%Dv!YP_IZO
zOQ3gSaw;tM6X6R~mRLiaJU162)f~LkMT_N=+zpk;8zImll3=8XE{hwQYl(S8EpzGN
zn4Vg5OUqV$n4t<3n(W#{z0onSVt!ZKQ+(j?)7KIcD>VbrD(6WfPQd!0atGAQqlxx{
zut2sR6p8eAfMuK3UPkK*%*ob*xdAC}RT;Pe9@;HKYpWFo05ZS;2wFNN+?oKfk};;v
zdX=UYONQ3tR@X|C$D%TZ#iUa1T1d3~(66@4P)%v>Nh?8R!;M5`NG|2IB~rulv9JJ;
zESYAodZMT2sw`m~vRQ4bw!FS!?oZZ6^R$7YmHDCo7Ok<+3A(wtWHD}a=IH~pFiQd~
zVuW2i2YDB0>u+3hMqGr6r+w_;1~c2-7$;m{h;_7w+#zax<+Q-`eo+151S~2=(dEU0
z5+>_Fc$khlf+uT}eOgzi@C$k~_o`)gAh+@+Wh#}eH}p6jBt8Ek9y}ea2afd^L;KBZ
z&z3*_!NYyG;k4$=mba><F3P3l6^&ILl*N@5o#a<#_4rXv_Hgw9xZd;Uep`X*u>9`-
z=l{l-R@CcVRZ9p|_UL6mLH1bE<B`|Y+gP_;u9L@g@Vm5>aI-f~o+R)f?+S^)00y`l
z!>0E(=()~j+-O5xe(5`?eC$1RI*(b?c$uAZFXgJ1R`wEXItp+&XRp&?-d6g)x31^e
zSk)ENvQ7#Mo30-Vfv$d!m>a0?`%gcU))?}__NyBZ569}!K4qVIY1-zV1E-naTKB^k
z@LIIbaYTanIDy|V@{jS8;Kc93v=7CYw!*lN;<Sg%bX_ucf2P}lOg?BgjHqo^-U!sj
zpJ(siE9W0RSN{8NJ}iIl#?xeF$r5Zic|k<A6Uo#AU@WU8gUKAEfU;|`7+6Kdwv$E?
z-h%&LzC@%^*x<yN8Sz4DbHx>fxq%Sl>8+bMY@xuhs$j6ZM?FewR(W{?bo4B_1`B%!
zN+X0=X+i+6T~%}$B~!n!ARhW=OvEUA_ZY(ugb-85uzWQP6F>@}2XO23Tre13tF9@5
zSfNVs--S%OR5h6Tvb-MkW*s*`F?pz@<0xLaUYZpR`VS!Kk(rn~8N%x;I{0Jku@4i6
z{l=NFPvp2`{-+dGVJQJvOfcUI#EH@t?x6ppzv~!ds-NTo@2ZUt*_2&ZkIyWpi?UA9
zbtQohwGsJnFEGpizqL+nL>R2QF>x&c1)~K_p>9!SR{zGVM75sUEz;xzQ`Gh5Mnh<L
z|4^f=3#&~hymbZ}Q3?es2z@AYMSuX_A-&QCF?LA@<}h;!jK`0BFlIyRF&$VwwG}`a
z`a%r<bMw2hWl0E&2tOwktdin$vK+R)cgJ6RUQQf&!J0|dh3^Ewz)$|%GmT}HmZEU?
z4fd*|lRbc;=~5VQMCmbLCT{I6;z@&_2cGi;&v`WXo0;@sL};-gM-55R-Z0O(DkH|l
zj~P72u@|1*zK<@u){Y%zvU6j541m=<6W*rzY|H(bWO>Pm@2y|f!!SjsCRtv?KWau`
zy0&K62HO~Eg{6=D%W2O!P3&uuWjNJ&2KpMdbzu1K_!VjlCQx7{kzncU-B-v7UA@EO
zqh2SjvcZJIRDd8qChja4AaEi^c%f?=f1%|H?1;<Ym^}0PSC%Ziywp|;tY>i&U0st1
z0t$A=(r;K1St7wJw9GmoVWM00uQ8Z=4C7i2#N+9%ObN=-t-NTiFR<dE^x?b*T93i4
zN%R+%;YQaija1!Pg1P_NEn^LKyDrw?ZJ0+#Et-=h6)f6LdZ3(CFcL=U3rQ*@q!=&(
z5TKMac<)(tSVALbm8M?06+31H=DAzMxupew;g@^W5QKMNDZ^mt_Pk1T&s>ASU7E(h
z3;jfLxOIER0-?>x6sn4rFI={WWtlXWFBWnGN*Gub8I8Dzlv1AM#>(*}OYJ8DdXl8U
z94zwzue*843x^z#e!g0oD=9z?85vsYn1orqPpywNT{hM3OI>6QX?tK0W?T-I>8&`;
z3rdB_w!I`W;UyaQeb`G|yKv*yV~#6Oef^VvAj@iHm}>F((vj7OcE+kH#w`=Y$cb{;
zW)ER%VB5L<&6<7kAJboaGjNZmX>U?lm2~VV@EX?UbX&jD?4)hvdB(aj!<L;Uw6*Q{
z$^DtQzwbB;fK3BlX}_)8P8KIk8*#{Y!8{Ijv&?OTXB#<Fb<3#Yw31+HA?A)akoZJg
z8_+N|<E3_~yT|Z`xxq>&9ng}<jY^L>D662kCj>H(9oF=G$fXLN8}xq?_n*PmWZ88f
zwohhW^WOVhePy~#ceShb7H9`Fy9Yo6ARHYqgy@DCQV~PVP@|EFn2?E3#Qac53hBov
z6da9)3I!#aAwd!ZK@bE8qG5>cMx)VaZ_yUjUB2qG&s>w4M`x|I^S)~`@6G$FFv{*%
z-+O7!Ie9X3@3Z$_du?bIxbOHD=V4I^xfwHKO(8TT!o)~l8Ox)<T4>@x=Hnn=;LPJg
zS>{Y>s+9$>1eNhzAP*t}2U2uMo~A_-M3aOtOu_LuA$h67j?k-^o6M7VS&D@SJy#@A
zrCadA+`c)taSF@8UCBb1EdHoGG;$yYE#`s#CIuAYW`pzGIk-omL=MS7ufAX<!V-kV
zdYoK_xg#NoJRHi6iL?cP@fabj1<7}EAAxd)0*@f)E34%G#XUoT4ZQ#+p3MaPdp$Db
zwUw~qkZ?R`Xz)O8$oN&wcoefD+^i!75`4A;Q8}UEEJpW>)<k_Aq_*yc6g)!^Eyy=H
zjk(<bT|lD00ZRnji%|v4rdSn$*591z7cWTAgMmMGl-fS6+CPT9KB8zF!mRB(o~Q9W
z_02!p;1}F>QD33dWhtz9xI+8+tAC#>nXLkI%fa^XsNHSWNLPMO+cjPQV(Z-OvatI0
zwYv3JUj5o@JFi{QuP9@)7p0JQj;rs$*RR=U5EtyGtqp7IItcEZMdd0LPNLh8x8fl}
z*4%TX1#z>G1z2O~e1CPN7n39o2BBY3b}){T3m^e^7D~v&-2{~1*-2$bmvhn!LBP+-
zhQ`QQ%}u<7aKZ6i%EN*P*cJ;0y=PU`xZdQOjP8re97zaa%-D{@>q*;`6k77|FPPK^
zK1mEEIU2F>>dMjGn+>#I>sDDsL_y|K+=!E9O?(Je+E@t4+!@&!GlP<3PG`m(Dv<hR
zbImE^;7;`v$Sz+gIk{H6u#V@c1Er%HMR8?x=?xEb9SdG&nWH^x#i2ar*Pztl5?1*d
zjmg|?2r^=VZE7jVoajX*i*s&O6Ggm~888zO=tX}(n6~JU&Y;c_ry7vuJ(4SH8XbUO
zdg(H!=bw`pac)Ox1`h{XL1EH~5=6^PWKNnp)1(EOq)9>Y4US@-H<3gJcZD@1xi5O_
zv*H9V*ut%MF34?ZPaoxVZgn+(Z5PC5ZGyj_^0JOLLsvsfyEprNX_c3pE`Ku0%glDR
zyX%~-{k#;5l$St(y;R#uznz+-``VXsyiNDfA?Ij&hIE{vTzn9ea38@v$CQ`@$sHuq
zVkCznfeaP^s46bXn>2){uv(NWRWg1=*@s-Dq>#XuN2VVnIuFFEPTHiRfzC&w_NMMW
zB!v^IG!F!yCyXPi%zVyLCa!=6LhFe~FnY}}xj$L9<)9#V0-S(I1&VZ!DRu)Offlk-
zPGUkgT1Exg+hyUDjkhIhEX+U}DJ1^Fa*ECx4|!TRYdgQ{rtF5vAF_zT1pi8-##{%@
zF*dqn3ulB!du~Zp^K*86DybBhgM|p|6G`3xqZD<v$TOQ&wO4;u%Q@YFHDixVwst2H
ztCKX$@}3Gn2!DP)r!b@7m23DKvthHsf$x{~n`-9@1Ux;Nd#I@ujc`XODwv>Spgg4T
zS+O{CQxFK7X?oQLPLg=5RK-syB)9}|6K9~w_k=Xi@(uy`05gYbWAo*hR;$Rh_#!k|
zT>NKk-=1y6jtgVw-!I)KzuL$7@-KFryKTJd=dHH8<&wRhLD-?XS_iRmXxnAGw!XuS
zT{|!E&TU*4*M96m&9-)Qk#~4wN7qlwX)k(<=l?<&S58nnXW0x@*hStJj$s9Ul!PbT
zf^-c6TI~fMxx@|Upa?*;hlMOHucNFGhrfFy#C4$vR~M`y^bPRyA>5F(Y(&Q-s<~R+
zh|R*;U6krm5?CCG>IX>Zm^pxL8r>2KO+^&SF2vNz^4!9K)j~HIVB?M3lZ7RXu2RN@
z=K6`X+@P_H3#EjusufFuMMWzGG*8J7cX}qPrCegvhw>#f9&#LT{L`9LQEF3tpsMld
zX{l<(S#+x?5;UWli2_QnJW4INIuM0GbP@&1${~vFMOVW7sq8$_JQGuX^zrj$;2Z^l
z0`a?ui!(BnC}!_@VrIJc(yeLIZq&8sOsGm_8Y`94AV(foX=gAO)87Z!hZTy`fMD=|
ztrnPcKqk$ZgVWDE6D<g1VniWkoFu#?wJSE9KX>S8<|byAX<%LN{fqf#`kxcJ&*`DO
z*4x?Hf86?K$37{rZOUPn^4dJywApd)g_O*W@vZ#QaeSX+arM`}&%X8C*mlnD1xaVW
zJ(X9lcm1VMUVEIlL%;2{HLG?&!4ZhZ>RxQ;>WR5UnJWu|H@xnZ$9Wmk4RN6u$fDur
z0vs@}8de58t87s&L#*(M>v)4=d9dJUJ3-z>EGt+!>rRE>C749#Q#5YFOo+NBF&J{2
zmY8W(&(a>GgK{!nQ@l-7OU_o|Xg<0s9eKf9ViVCz-#7Osmmv8Y!Jtt{ku+~5@|#pr
z$*4?3Dy;U|R;@A0Y7+{PMIS9J{+9(?RHTkg75b?DXic&Xn2?E7W<}<-S&;w+C{Lmp
zA<NxOSvzRNSTz|XTf(Ap%Airiw4@s4D$oY51H(vGI64wAdEh62ip1r0W6H6nOIqE4
ziwclWw|qiU>zBccg@;j#4MQPQkuT1YWi?LDQ^v+pOzR9mxlq{^*TQ5ZPNwJ}7gI6{
zR92Z@L|T8~EW}OuCsH`MW1r0zHvLXC>x?IDo)WC>^X%$xd4E^iTd!L?VZS!IK@q%W
z?cO`buwx(h>l^FUM(^=$X<&Q1-LB2`xistVK3qAsrIWtzT<dvD%BycYZd(U&sf~T^
zZ|C_vZnF2cw|-qTuZAADx*j9YKNpG&e*+9~;ED{^SU!{x6M|1Dv<5m(rD0mtQ`pyX
zanb6k73;~p67g)R7|WH*1!a$bXHra|R)R5sABY)c8mMxb#Ig=y3}`;UXRJZ!*V8SR
zxl7TZ=ZtX`O2TE?4#?S3?k~_#DIOEKi06Djo|bZx1y`CzK!dDNhFzS|Lq#iPsnIi5
z%3{OZDA`yET8vEvxi(pjgbGb1QJO_4`3wQnKug*Aq67*Y{fHJSCpeD^4(GTFP&rz<
z<zYklR96e@C^IFE%PlF?B(M%rp25qT)QbX>h&5JGmMFOutC}%6xEJRs&UBcb8{Ei1
zq!&0*Cn<rA))?6`8a^rclxIy`Dk$6f2na*^Mx}7D;(*%^K56)jtMr76QNhWiFPA_J
zF=gOp@>(@!kk3V8DNsTM1q03VAv$E8ty=}rw%G~G=j`6MyuXtXBKmcqPk-kMa9`!s
z)vj6Fz3fKx^_Mgn^GmI~n*X+4$6h;bZkys+6~yOr{bCf(#<?38hP8fo%zK|cT8^3Z
z81GWo7lF(#Z>>tU=lf{Zzh5p^!TFag1T1F35eUm<Jd}WiRWZ+MvQjvSDJ=vjD7gLL
zPHSeJsJf^Ew5<M{i=9FQu9<|qOKE~63c;@FPAhA#GA!jlB~Ym(N9C1?n}l6)0g6py
zQHF&1t&)?>M}y!E=5@cEu(nn`LV!5{z-Wpsx}hjgMs(KmC`%Mu!`zNZtzF>2f^66>
z;Fes7NmzSD0~)EBtBJT1+^7IhVD3<vgZG12RwXMmWDOr|Ts%O5UVJVye^^00gSZc-
zAEa|m=cQs&CNyT_{sc)ep9x5jgOpzbWzVSWF=sB~agTLVjt2M#R+*&2YElepveRpf
zGg3*_tX9E_ELet!)KQQ_K++jNWM*Grd`rL$*;!c>6+g{8_$^UKD~%ZCZSE#Z3oqQD
zOu;%LLefhTz3x`fW1Cc}dK`V(2?PtsGe;pVkU`By5x0CO%X_2G{5B!7ukzBr?E-gU
z$!xKbE~LEH_L=P?h#F`}T-(3YPH)R5m~ETO*si>{k9j+2V?}{?w7qREHr|1kKzW(%
zUQ~3=`;N<GF_~?(y!KKI-r2tI&GO~8Pk(z{zkEytuKD5vCn%zj3kc<oGDp^lHC#b?
z#&JBHQ8*(yizu2GoXpI@7LMR6mDH@fD=Dug8JFn1dF{$W@NzVays_G2XBa!Iw$h1H
zo9fFz?%^QZiWKrLT)7|CU@aIwffez*96hW#vdvds6*=<{D5!o`^m%C9Zmg<YWL{1r
zE?D8|T7$=`tQ;gEB~dvIlzA+xa%;8nI9Kj$8ik`A>$%fPxhu4)yuf4d>g_>ouyQi?
zM-|&7O0vwn@^tOceIs=fv#7{;ABmHYY!{vZlPzWG-)B^^vtoi8J3$=4TM$rEI|GPO
ziJ~$#U8IOtvQAk#0kF(*rZOe9BX(d#<<ZL~n_1&09r;ZFHeZ6?BwaJ9MNyQdQkGiK
zqn|q>Mhw83fC*4Nm;`^bn>bnS=3>=U2Hk55*7q}Oi_`4xZQoCLd)xcoUEg-M?SHBJ
zSsdHD!|l&%S934*{q@=6#xGsl#om+nCv;Q)|Cp<`{x=j_FkkI^o}ddpDgu)dqq~T*
zL@^t>pIkw~t*E$<Ef_1ZCT?SaiMxfP4=V>n%*pBy$cjN-1llN)f~zksc!ERGqb+Jg
zQGOvzGSG6Us^o5L>Qg}p(B0_w1<MMqN&G=8!+`|2c0y+Pb5aBBFPsGgmKTM4=|a2^
zI<L9M(qmh)++=}5Ap%3Nh+8?IAru@4ZSgOGFs>NMGUBe!=>O)fc;wHMv65wWjtrc~
z1(OG4JuJiFP%Qe~vam?PwmL2p8J}&Ycok5Z&B8(PuIS*DK#&akcNTfoaFhbmBBHUF
zqnB|BRB#1W6a!W!6K2Oe*9wCq)ZJt@LNyTu1kD_U2CQo#1;Gd$!@!OakfZjj()k$`
z9_y<3!$Esf=4$0U&l<Cj7M$FSwD_8p<C5jIef_`kS?oNsZ56z0mD=Wt>ubSnSOT_X
zCEli3mriV3#fBbZT{*wA^ZmDdEXd_!&9?R0E!JVzwK~3JC3jd|UE8iPhu#)zzhjGY
zyn{a0*VeYyPI@tqx>=Ysa_u7KYV4RRs)`^hgDe+xx8?4Z(;~NY3q-5?NHABC2WM)R
z;%Y2}+AHcRQP@Ee(R04sJ%D&q?c}`ZckBRw;OCUpxdlc=#C$5<Gu>G()M<G|q4jbH
z7c}j_>Kl_4L<MxS{QRb2ZQ#$`<ss)FDzB+NN29ZY29;P8icvuciZQ-sd@aj^BO+si
zcBjB6c*7~8G;k+W06f1oud^kOS?1POGxkQ=D_YasmuR#A%0R*}-L+A^6UG0eV9DAZ
z{aG1|7_Uq{H-?HZ_n6DsTv|>{A<m6xZgF~kT;>VtO?<8x>Y0yOr8yAfSJZ^NgB=+G
zI`>^zAOyaueHDZ1nQ-MLRdj4%kk4s}k?^U`?JzIw%wIx6A)~Ke8d@ck#|~Oukc+DF
zAe}#OC7o+BV+gHvxX%9$JHMCajPc=7y6Mr@^V<Z)HhUoSXrt@;Hf7S<o^>|RqYrFx
z>p6>a!?rfg+v&4~)eAR|b#6UydSTc7Zo9PqJ)B?D<D78ueqYS}?$zGTG48)j?%p~l
zj_$KE>Cm?LbJ!3Y0G&oQ28VqI)p+8fI+r|Q&8OgGwuJ)~VqBCsnU`9XQ#s_apacca
zDIlTn7>A-lF|X2FyM^VPdFCtn+&TX;33q}HW>SW*yymVP3QtgG4wf?tQ3-nPk&0I;
zjsyjEkSlkL7Epbz)F~TLmc)xzGGQ3>MnP;AnJciWY&ZpjD}AS&GMBCH*2De48Ux4$
z;|<06`^flP*35CFf+5`Bm2&M?9b<|O>e3ZBa;xfG{SF2~AO?4bR{q@Ns*W!I#V9`*
z=pK;6#;_TzKzQ9UC6ME}b4<02qY&llJvb=n?xf<HDNa~=ei~BK<#(l)%0=bxDi8w(
z+7g`*%~PvbBwxHBSSZeAsg~sL8!MWZEH*tLa2pDina+vIFF;K%6qh98B$qp&ba-eZ
z{JLEyJJ+p?|7yjQT$e>*ySBcHN5{4(pRoP<Wu?-3edjfsJNjJ{cb|75Wz%s@*wI((
z)^kY`_ME4d_P3w6-xfB0+3feC%9iKsG0<J}cA@L~Y#Tm6>)~6Lpk-1i;y^(F2M9tH
zUzEku5Xm;yRB-q<S>8>;JvV1ouVp1rF#2jfWCA19O<W|`>OG1EeF4D87aW5U;6>5!
z16J&-7&)s)C5S%rw<;IR*|{4tI5R}<3DC^JVlGlf<p91yL{z9af{X$X?&hHxr@$f&
zQwQ~BC8ZF&s3csLnWH5ekVg|A1jHOQ5EV<y7G%RjJ(lV(G;y$~`70fG!Wbd_pm7O!
zVhirW+$}s(R8{r)S|k%NhDu-4NO_+7esq%i*i}!gsih|4gglkO7UN@VEYq{AO1Vb^
zQnE@ZV_I@ReuDBUH1I_*jf3_-P4pD20`YVZl~VcZ2Bian##7MSr}Hi+r2tag=aad1
zFA7iwy_B+gV`?uaf@IeCgln0a4N}P5+^2czNp1Mt8;t*p`HJw@DG6%t?!L4|DDGo5
zEzaN5BHDHC#<3pluOI7DmWyLy`}ODB76sEonf5u}^wZV;+OHStV^<-{zU_scCoV4{
zdS0@6yyu6o*Z0!%d9_@!ed{^3)Nc@2uE2==j!H@%I2dfiG9eksS}itwf)ciji|4k8
z9kETa@<=JMhE}D8D_m<pOhe$GO^ivzcn1K)h>ai*iWjkTh+8c30Ht=O5>?KiBsXOU
z3kG(^ZfY+TVhz)St^r7mi0$;B(^D<}=cNip#w<Fz(&xijJeqjfAQ$AF0={;NEO$H7
zwdYJ9<xIrrb<By_s~u>9tg-PS`8jA9)b1M8^);<sAi}F4Ym03;QwSz{HdlR<2FVD8
z0+I;SGZSd05H(bECXiqYON|NDwVo}G!#!AdQulQ3P^O&2WKJ;7V{R5*x60vSDV3^T
z#5uDjZNX%DX0WhuF<ggahtKMTUYR@4V#ItbJiVHfPN>Z_MYee*K^}7Dcwyh19n^e@
zV1W_DLARigFR1Af{6Xu%JK6;If{BV7yzq<H-4_dMk)qW-7yOp?*tUrE-kpV&pIwX8
zxctYSn=cQ#kHxNQwzt`~W7qKd4L@w{zfT`q#~#C8V2IeapN>~?n?2cUzIu*zuUDhz
z^IE^;#e7RE*K&29*$EP6-4!>TRE&Mo8feT-5F_LY$~VmD%`7%b12Uy_GeIu3MyaT1
zWbLstTn&p0>=1DEF=kWb6wFPj5F;;QDZawo1oLL%aV_g9G<7Y-8eci!1Ma}GR*Z&)
z5UFlzmNMb30FZW4FD$cpB^MdG%sg2aic@7*%q<sLAn2EI|56}{=oRIagdGTjM?3SG
zEzp3>>2kh9CM7rX=5!V;3zN(33g-CCmGA<b5!~InSOiG%nY(7`Iwduij2l+9FWq_z
zs=Pr^3D3=Bg+hUq?%K@Vf+|He936I;7vd)bDzmB`)mY20vBiEpo1(5A{+K3Oh`-3H
zlX!uupqHnHyU%^1C+WZ_8*pGaKTFqNPRFNn5ml0~5-TMT?v{eBjN*BFUQ0C1ZBB?i
z+=(#p3%D19DC>8tqjPs)yCR7l=f3!@Z(CjGweR1}?bo;c?(?^#3UoBKx;xnVk|DI5
zylY%>skL3(qOG+?``r8XbNs_M>t%gxYpeBG=S{B8VV{ld_k7rKt*1UGzu4TbKG$}=
z^N?b+sIYm0Eq~>TTQKioAqEI{<1}eS+!}%%y7CZD$y82WR*o1n298hz5)lfl7^nsp
zsD$tijE2gfW$oH%i<(vxn266L7atOIMU)#BR$A657<U_%l_VR)-w|PPk%`APlk&QH
zMc8aufz!EitO^&%_}_r=d6C;9rw!vNvUB$vQGA)dKX8>HDL5(yNZvoIl^a{Bwv{OO
zgeedMh~`{0P{0{D;=7Jbk!hYws}1d-x_utVTiDEZ!#sj|W{8_*C||{5!8zgmlZl>n
z?ekcBoG&QA#bczOa_dZ#U+3|~%9)e$)IRh145eKPDy-bE9jE7oXIl_z3FYLpP3Gj1
zKpG-zi?Jyt-PH?s9^eiKD1j1{ILuW`n!GFNiaWEp%`j*bkOXg`WzJO<$*ckM{}7YT
zIyZvK!#c}d>eY;qDOR`glDB>kq2r9Oa@P5O`wO6L=Wj#pEen}_l~?<jYuBu`-*)x(
zem8|@v$796mDi4~r}A1lwQrNH%FFEH3TOSKJ_>g)<<;5t>XYg{S9?8(J)YaL_0`D5
zJ^EQ{Vq;r*)8hHRB*C2{`8abSr{rF&m?^N4I6D;$-Q=v2U>_;xrx*wb&{z@CEi{NO
zFvrU>3$!f6MJQJqN|?aP7$+AO<kiGoZ-8nenfKDAj2<RfJ*DSol@o<g1lCZoM;0;6
z<f`=gvZN#$1eJjr9%Y`C?73u43|u=@9K^GLlM^vli?yBQOlGBX0_s^0i}OjuJTz#*
zfiu@D2B)H!4Z^VUbb^C}ft{VH`f=fP$(q;|V|1Z*K1c1x{m?Z@<_skgm*u%tD+FNh
z^Z-Xe!uY7<x(yDAhb*r|gTa0W&fEdQV^$gQyf}vWpitey0|nQFbColW#%j=hZbe|9
zT#ysiUW4_C=S?VPMoS2O&4StIIb%^U6IrQ}u01ir=QMRIqJUJ6ITz_7l+rlR0z<Jv
ztdtJSI7lcvSW>jM>C+Aih<#O6j=J%iu4HP)kT1Rd`+q#WErrgVtL=vVm-IR>cC@+L
zSI5{}E^br2?UvpC0(jNB?J<|uZzbQYd^Y>x-j4fjZ)3|CJ5G8rZS7KC?VIj%FXh$N
z#FlHe_1twq^a1Uuzq*>+=okVOwW1=6Wr=^VDUD=Jp-5{&;c=0>1-BDd>t$2^#1@D^
zxZWzy4MH0vaV<UhwN_~kfgX|oJQa^#<+)&xTb6}IsTIP^!LEU(GARmB8KFQUgy_J7
zO^mA{36|wmMC-&P=vwZ*ruG$-GWv(IDV!?3T;x^-rUaoPGb#dSg)fO?@bWD3QkjcG
z#n{|Jp_5B&83dRF<-?s#O6NorU`0hU9aQ0UuFxE=Z_t2DGbp2z;hrZZqi7_I6Sz%L
zEV8Jb{wj_C@K6cfGbS&m#laz}NxSLFawz$NEkthF=n(iw<77g4??e|cPA5`u!BZYk
z{TlajI3A=hl&(EUeHI1ktCg~R7^lh$Dk7o)eP$0*hhTsQNp9}ha9J8qidouO?WMF+
zr-#Y5x^XtMk|c^nI$s)f6omZ28>CoPuqMTzCZVqU+S6IdPk2B&k8D9z7`J@{J3gAY
z{I#qdYr7!sXm54XDy+}R(c0UNTl(5L_GmjNrMvyG_Z(~+Puy}rk70Hk5AEm0?lyMK
z=jOb&m~gi5d(h)pv;~@La|_$AU28wK?YzJidz{ec*<Ez28j{w5@<mw>DtN)gD4zzE
z%24jKSUJ~Ssgf82@&X3s37K=~1tq=CYL!VU9Xc*ncYUvC6UB*$TARyqg7Q(k#$@3*
zi!RZ2g#Ze$NRAFNf<{zqR+EG?0ofKYZ^p4<(GK$6f;mo+RwD&=b^cL6+0YVkcO5LV
z(P5Ax1Pp(m;*wQUpwhxZA?8kH)hzFVvucpd!_kq1+?(bV^MIOW_@Q^r0U=D(2GV<8
zGyWuHmC@><oG+Y@FjJgLs2HIQPbW34p{C$4EZ4K7m{B1_wbjJeNB{@obBH&V0^f{t
znVXY|lqvPDD`LgOGNRPs4jmS<SmC<F!shh2k|G=qhnz$zu;3HqpbSD#E3e6w9tOY{
zWt!|PDY!9wsHut5k|}9KmYhtJqC%PH^a4%NkdBkezk&cDGQ>l(Vw8CbUdS0Wu2E6t
zbW^5>i`A7aSr+!<KAwH8g&6i*Rj<1ZSF9ql4cQoaw7J*Vmj!Ovr~Qt&+Lk%!8c%0G
zOFLVpWB2u4{cM@EZS&cF&Qc$JF1GFWvg>)`KVjqIbIZ%D-}qOq?m6zRcEXMm_Kkz}
z*&wn84lEFaJnd;LrYJ$C|BLI639KH|$sLKtN)|&CuO7yiiK${($*omNB3g8~S0%&)
zgZ?0+&2!~<!BvO@0(E#IvPlt^$qPlRA#>8%{Je%$h?ye{6<Z>SE#fn0bMggZ+;{J)
z9v74mT!b8Vo~wk3yU$oPql_#0t1Kc3YsfhUrJ&rx^Rc36B$OkL0f`wLHHg|+sMY0$
zj3;0>(0ykVN%tJw3JsZ9j@U*tRyT$MB02B?=S3+Qpe`}Th<haq`1n+`OxZw)MOeio
zmw@pya@V4}O$(15A})7|`iFH*D-3%9<tNAFJg1A3<`5L*OofZd)=@hZVEX;`Y4Qv<
zt~%7lf@xlQu#N)(Mjv@y=mbAl0Wnxs+B_+*m<D;06xk(QpGI{$kT`5CCg5n`ew?Mh
zr^z8&dcs-mjL1MDE>JpA=Yywe9ydRpKZ)(7QeHb1%S-abZwm2^t$D%2#_s);*Y+;<
zS6*f-3T&%j-#Fghk45W@#q?EP=RGX1E_7tuJFsip)qlJ44U41uzA|yC(~FFGXMan2
z-Cl$eTc7g<3kEzhh;txrlZ4~pVYav_coHGlU@c5pE(r_@#^=PcA#;?zNS>h~3P46*
zST_l|)Cozr*R<HM!R^KPh?B{log~4T`lH3=@6^DRCj>W?#ds|61gxL4d0eo2K>22A
zr43<=d@pFYn>Q*Jqs&ksH(3Y6gPfCfe77W{hVET(^oB=}L&^O;tfj1)!DP8CzeUC8
zbOf|W)2X2AbtQ5K=A30h_+io*M+5lH-KupaBw>>zJ*$O`gk?BJvhqv@1+5zwz{R3^
za~dm{F`#6U5=K1kAU|huhf5OeP$AYLQm^KLAe1cFf*81(%YAv2t~)Hm3t9OOwn+*i
z0wsx6z;H<+-<=^gsn8VqVWsF3&*MU(FzabK12Pm5ZWx*oCSj3lRa7P$^m1C}jMFRe
zOnF8YjV!6h=hGw{6z+sVO%~jYi3XlI3+dq=q-Dl19gCt*=4xT!ery($!-}eu5}aiA
zC$RMp{$@LsSIg-Z`nKJ9{r<<cHfXlf+Uq>l`~EwWify;P_TSp)Hoi#ZwNGC!Z6CX>
zuZuQ%QH9(4UM`}<)*9!k8y3M)&bSXD-iTiSOySJ$g6>5MSdetHY=(mdPEVCtim(Ed
zSoAIsQ<+R=HcE@?+|h$bSjED7o`fxqU%fiA)03IF0X<iBaz+AHS_;kmu{KpMflE|k
zDb78lH|2R)01puN$woi|8r^$GM>z?^XUB6DS_~rHg{4SJrKQ_rY%ZOExqu~xyekq2
z*Unx6mzpzJKtZ!^VK6FoRB?vlhLV_76~_bR3b!9{2CzQiAv;ShI`oTsUoe|Thr<(0
zA!S)O*J0(Hv9$jxB}Nmxkrc)>$?)oAE?!6|yy3u3&ZcZ5COJPn6A3S9nN&dXTsG38
zti!^ffeWyR(W?Q}o*15UzOP&x5XOIetK#z>T~dy4>dEqXpl&JhC}#F~vWS50o6cv{
zXqVHIFPng$-ZmQ#21LSuBsZp2&|z8dC3zu~NkgWW0=`Z|5ObD-XonV4%nPW(aZ+@n
zagj9V+>XPXnsc1mM?P2SI8?e4(=rJaJrC1^Jgcmg`pIm4<+giU6{ex%=;rR-F0=LR
zT<E-%R#%&q(@PPpoz$sRY(M4I*P>}vUS>OMNVPxT&~ntaa{O((-|goGw_f8;gk9HM
z?A3Q%I&Y!LUWD@UCiZ>h`i^=1g7uMx%~Mu(K#*NJf_tV)R>;7PkJF+y$p=>R%~a($
zYZ%?@hR08_ah6u9WH6yt6I_L`KF&_7bG|<a?MY<qKVaAp=c&jfQQN7_Xq^Cg2PFsh
z)^MCNenW&bm@aD1U-Fwl+71@(4e>2$j1X^0g8Jt3r79pJsd-SaEEDA0)hnYUE9K1^
z9l#})QPETla3nf7#4XP`yi-$zNh-EQFiGa+UrHtNinlO@ZYJU#WI;w+mQw6zNvXh9
z$y#HzEGJm9!Kt+{E>s|{E4d<}$4JuatVM*P=Z^d<Wlf=W7|w-qhYX+B(UYt*q7#Ae
z0~!#09$wB^G6j|@6d#`-Vr`Z3x(J%7WC@FAN-jpk&=CI`W-3B_>(-R<tfQ+LEicT`
zN$P)EjqGTEXH*iPk*uHr^Qp)cl@B?&W%`*$1?EP00cr)>Xo{wNcavtHqz1320S^JM
z%s{L=AR-Y;==k<syD}Q4IG5SY<5SYJj7DR^Y0jpzq+I7D=aqrxFN6h}nse&p+_rox
z-5-YSVOiJ(KGvOWZ&zLy6?CiZYfmpl)Y9SVt}QOAUJAEc$Zoa1nqR|ix7unO|HE2e
zF`iSAZ5!i@eSg*)i;Jfn*AMk>=fzlG%iBd2VCyEsiAk_$XMk=eA)f^MtX2_0z^oCD
z0Q4E$cyReK3{;68DH~=)__5pt1dZU&E)?T==a~xB!nrf4O2Mv^fIYrb(oK7CDF0NU
zs*XhCWkD7ffCNqPMF`M_<d^P2ud9V5WgrL-kECc3dm%D#E}$EdS78Ye9nJC~rQJPA
zih3jz_IQ}FZ2>9}!;?bC^H#OyDC@~&-HmcV;t>ag@&L0vo(pAi6&GJc<up}@+o6w~
z@P081LouHwfn0bYNkQ2?9U<slgXBdUL~+7etW=!x%C*97-kA|FkrDh|+U+|H&yk{t
zh?@;Zo(Jr7T$bs+YEP>gWTK=367epQ&RGtnvP&p&;yjW}pF&J6bBh*_wW#grAT1K0
zjK`>CQYhet>c_Jj6P()t1C*tg1*q)=MIPO!N#qPsKGMifS980Ze!qhvU&9pd8YJgo
zI{*G_m(mJinif?;s#MIjK4UDc&YN=DIZL6O;>AigGR|t6|9RYPY3=%O`YW&C`{UXk
zV}O<W8&c67eRL_WMVmX6S692s$E>9fyFgp*XKpI5E`_kqShkL%r-0p5w)-nDv)xK^
z^SH+WcTDEC1xcT0(0%>tz3!z{maMOx=i2^byHG<O(>O-C3(zs4j^9v+A<PCLd1jJw
z$yp*PPm5in^>Fv3ri%=@T5vNV0s=;I(8)moRL*AycO%)#r*bjoMU+?#QaXo6nVqEe
z;norlqWA^pglSh^J4!EQG0Ya+gW?esI0HArx`D7@kSB%0ib*LUZw#aivt$N9VIg)j
zbIK?vzXz@llklHYnG~Kg%d#k;K~_4sZImJaqLB#8;EWZSmuN}%F-fk-!vlflVh|5(
z3B{SGh5uC4NdR1oi^e@Cw<Ka|Re8=#PqbzL>ya2K#>{t<9%ypE%2L#S$=<NTOL8e9
zPgjU^xh(ITCdG1Ca2^ICxaG4RCbJlpRdCol;Q41~bI#kPWc8j-=6nXM3}R}FrDg_l
z)e^*qcLh0Yh_eCVnPQGKdgc`|rQ#8U5;2u6LELLbmgc0X0ojZy*^Ic?fys;;rk4te
zZJ6AM6?jKdfC|AoAQ8t!!Owm|tp7})i{uD~X*@}N9wR%OJii%lXvT8Z8BOChE1{S4
zSvnst+O>P{w}VSpHjabC@b(MOp0B8v8fD$FWF5ZxE$>Wb@65jO#ZN7$_T!QgTmGO2
zX~}f?`h8Z<=XQGccJirD^@1n=$KmBG$sKWMcW*wQUaE<%-6BlZ1;s<Jd3}12LwoK!
z-?GW+$%ca5sR&!<ZBr3+Z`<;ER>#up*>l@Nd6{ijmfMuqW*hCt+m)9sUc!AXyS~b%
z`#FZSvo`<QrNH=4k2z*CZ+e$261JB6^|ND(J_a&dB)Ky3TrQy0zzPq+Ps%q4Cr@UD
zMZ(&RP)3Zg2fFG;Sp34xRSEu0FX2E!8cGRZ1i-O}aH$<;<hNt>+%$^er9$xVBoHrO
z$r<Z`Tdkf|1W=F_Xd*d?>bt=Nbw`W~?-!u!nR6!s+y=47{8uvMrZx)2o1hG{yk_!l
z#TZXTrVdzhXSBWot8TEKmM2}$>n4XvlO5eP2UlQ2m`f`2G?Ay^DFkdBHVv&mv2wr)
zGiR;{Wa%iJ_*b#8+F2~bR$^QP3|vvv4%-KN#T*t9YG=XXOLKJJ)d6EsVD^B*Il5f%
zTEwqL2hMAl_RJ?W-I{QDo+fRlgz9{eBZmssxaY}PNox!)NZb#=IV9155>4*}=5Tsi
z61E@eg4SFKt2|>qneg(+qJm%fAc#<Ln#nYVD-nvN$W&h|vRr2%13X-a2T)uwSzY6T
z*~ZM(LWg+5Fgc;*(z2;2y=+M>+LK|egtVsmW>cSsZo(pWb93#j-*-z59$mR+SCT@Z
zfRC$I)$JS4QPQ=!qj2xj$r%+Fwk!ADZ!de~RrcMle>uH$$181NE7Cn)zIL4o?8Y-s
z+O21wk`M(F=HSQ<uU<>a^7cY;Erf}!34<2NkP%{<uSn#5l~-HSdszvwSq!wFZ?;3B
zSP$!<r)98y?;FQ=D6iEv_B*y}GPmES*+ne7Ehoga{=?>hoo)I_yW)#^S|C02y0=ns
zJ^hU@X)(Im#MbL~ZIs7BjwF2Zh;apG54(Jza6>Y2NsFhPs8a60k%ec7x6H(+2Wa@v
zk#Y?xa6+OW<F#R+@t&PVf+nW3ioIeX4jLzG7|%218Wj##k4_V%1m)-@<Q0!mrT9qF
zT)5f>?(&0GSi7=8f-_=EWRvhhk|8Ou)3b^eGz2-3i$P<6BEU}E<DBbV5!*J*76gaX
zjtHzGnI;eegRE55WGS@h%=qwz!9oJ+@bqq#+@ev{>x0u{m2zh?)aKWla|c2p*GbXN
zPEbxH^<8CrHqaAP;<=OHru%}$3koKTZ&=`X$+<u&7N!-Llpg-aq-Ce>BHA;J^=zV)
z1uO)>6fziPi%*(GEGu^vS5S|YolI04vN~mj>0D(?_*O^3-|<)Jm59Mtm2MgVyvS5-
zr-gE&L?BiUleMK(a3dU*)>E>mCQ&pX<z&iL69611$w6Eu>+4c_>!5*wYOGTqppXJ^
z2>$CpE|q-aV`&u%%@^DC<)-n0CI0sFPut1ebEfzTuFw`2V6)BB2m76`eQ6<|pg5qM
zLYAAYxdQbu1}fyicx+dal{Y&(O)iOB#!r-qh?>{M2i!>3B`a=Kfvs71p;e>lxws|J
zOL(nq`(D#WDZJRe`kdEGd715W?{%HB>)0-m`986`t^LORFYc?n)It0CfL9+U&%pJE
z9<>Kw`(`Syx}0w;)RvpF^Co+3l-Eg&&}wqF3f5#oyd1*Y5qj1LZ7jp{#_}=7I4Vc^
z<!Pl4B{c?Jl(UeN(kZR_;Zm~FQ+wu0{HUE}B7LTImb5`l0@a$|XdpO1NWIKi+5s4W
zJFQV-7E}gmJ_}Uxa7Drub^^5BT!k=+z(c{uLT$oAK+LLPr#L(uh(!qLM_vt{6_=;y
zg)?bgfe2zQj~6UDrYeyXLPaWp(4K(ps1VaT+;&K+hVq57uRS3a7AU|B#Xzo2-16Kp
z=u|Xxl{y!pmqTeta1W4}8;yy-sO@!-&WFM&Sdyk*6#cBsneAN`(d7vicaIw~HyHbi
zd_jkmk6}rPmoTeDJP{gd!7Mm8qN*-uLDin~AmyhVab#2DArXaRMEcErAN<5+QbKr`
zL&l~mnvq4ViK;!A7Tu@HxMcEcqKyz$8UTnHfIk*>Wh`4DYiKG5O;q%Ke7UmR;;t`X
zO`~-R1B@X(nT54u8uO*A_t?D;J(B#zckS6Hzmq<Q1H13RN0M*3uxB3smOb$DSEc~*
zBt7_(wEq>n?xEMbE`8WH?71f%PY-6k`B8!w?b2mhXtQ)}Tq$kJ6O!xV(C&TNBX)3f
zg@;b>+_sy^LYtl*^OWl^d&sWc_h1^wfPKTwSl88}iNi}*?dk&$q<*fZ1qNWFH<H`)
z8Q$Nv6>*o#?_8E`Dr9S&Pusz3*icLDX?ZOj+@?6%`s=jvdNg!Vh2PBB>gwtIg#Cdh
zo5yUe<<)aH@4L^uEuXls!2EAmS~s8iE`Nvedg!sY*z=Eno$qFw^0Eu`9o(Z4ozCcJ
zB;r&oGN*G9#FA7Masl876Act7hKOL#R3ZfNj=FTDTCGKL;Y{bGR*G8A!D2c)6*uAN
zK<pVn&0#fPPHM)Eu=WnMyi2g8#1Jp4BL168S*WH|vJl3B00k<@;5DRR4Z=NH6hiAA
z%FPEQCRbn1>KjmWv=E_G$;9EpS|mb>b>%9K8I>VSYY~<ftj_0CoD5iiAtor#c|R;_
znVWmDB4dGbDColTp2+c(422VMBSP`u+sK^)3JSDFdHOPwf*FYCFnCpE%o}2B$fX0q
zkOe9;DJ;@dRnhaf&YwRP1#n@)l0-~!?kG_bAkU*Gq2~n69E`+Y3)ntcl%ncF0$4M0
zOY&f>@-Pw4Ig%zmCjw^zA1wL60#J?qCI%vYAgK-tK@%Cs6E_P3e$(`_4`{k7XbH<~
zMAi*sy)Fg^)BXuK4oxe93CJ9S{Ivs6x1@h3(Y0)gR9yaKwtYWsf;&$NV2r3@lUxe8
zXIj=l@l;8nAvQIi&H3^jUArf_`JSf2874)BxqxDT5*j3n>+JYAncsI-6v=X*$G30t
z1A>bZ=bog$mp8NlrFD4us!dN$(nBom@XFQnVjLzn<d>2%yJXjsl0<yrG`SWB!!hGq
zjZ(sWTzlX_D#vNE>Hu)LoGd)N{I{Naih^f(T>H5ET28%?@;d*0IkmT^TWjs$E~T=n
zbeH$6UB9EDofgoR>vTN!Z*<QsUZBa|UAGJy@80dSkb;-t>H`nk^@m?+FFf%rdJ%Rh
zujM9JyqzmLJ!*xYtcAlAQ-V@DPVo*}U9}g(g*y=J7MX-0dHYP%Mod~pL(W%7`NFks
zl-tdWE-Ds~bn9t2RD5i5mSog0Fn<(agPgg@dU~*Km~dNoeXd$`PP9@gFUwSjsDbcw
zkk8gq0L*!<L=;;)8c{i1=XJ1H`Xh@}G_||@02QZu5>^%5Zkeny2=*xvhqAty_XL@W
zdWmx}hSc+l%I%<#MLA+w5V_tOrgggIi2RUYqI@{7n-!H8)>us;*ZdRNn8~VzwTQWd
zn-Ge-gknzjI0G;vwG9Bud{(>C6tONWUlyJ;S(D@oW?;@?`6fbSx<M<YAVkCip{byF
z(*<WpLI!EE=dM9<gYW|S1yoc;j7>GqoW!|!3JjzHWjGgA@ljeq0J2E!msIf}7lS*H
zB2ZR`Nf^WZM|W7Qa?nK-w;?^*@Ij|I7;Xk7QH-=7b58657&xLH9FqLXwO4-kXVU$}
zME`+Oxc;(-scdklOkd62n=jbS=bpAZ>0h|_?tA#<JPu`WBYm`NCTO*DmR6f5cWx$S
zbk*+Ocs?noTN`f1rt3+Hf6b>;yLSHrbQ!|+vbYBZzQ<HrP-rha^@Io|?|H!Pd*l^V
zMwhPLn-tZ+9{=W72=EvV4+zd^?&&DS%6R?VTO7+^AW+D`<trRxRUU7QtKAB<4eLw0
zR#)*CQC{uaX1mSa&4z6+<+ZJ!mA-nLBRhw*(Pv!xZ*L|2l5Fh?dwI`A`Y+SFck}7*
zrbX3t8z;+teCZnB>$n8i*tNASBDp`x1%y1TVxW>BEFl82SueCG2Dr+avP-ZeW;2nw
z5_n+pqyRn*c}q@16Sp4omMkuy-qCBJpm=0O_nF-4x;D}SWG?7qrZ&hm=!n9_-9%L$
z7LQ`hxDqIi;D&<&30_DM(0Ev0P-<A552=t;Dum4OWuV|T#?w%2vUKGp3$mfA60d8m
zs?UW}Hf7=%!~`Iv06+-*0y#oACvG)Yc@kK5=1dv2d$+{h2&Jf0Bo^_kgiC-G2C|8v
zqZuorIV)PDECvaAK2#NE{5=@x$zriEIzs*y{#Fhd;O_)zR07UekYa}tC2bchRIgWt
zRDik`BRttP<h^C`ITO7tV?NpBv^0S_fw#cRQad9vS1nE9FmZ%r<QYts66$A}=;t}O
zpcP4Uzax<^xt?#Gj?FkzM#YA~T}lcMB~k<&R9|sHb1y&l0113pwWK?qlyTz=xTp}A
zP0s9g67o<gYACq^CKD=^(-ikA2G80<uX>D1>-i_YOF%|394@ZMd5t9lrAK8H+hZtD
zXizFx-M}&eFr-Ol<l=xn3B}!}(=)mqPV$>}|H~guF2qYVK1!BU8rxYK7wh|^v6N}K
z6P%HHoRn6co-~x#_}~(Ql|_;Ou*hJUwQajxQen&A`(AHbuWeT<FNN~j)z8W~9gX$3
zuG)@-rGA(C@98q!=e_3nduXNgnds9Ogyxmxt_H#o@89I)&f*(5XGGY4i~b+PX5m7@
z_s%l+wS*jk{jds<OQk9uvRJrkuNAN2V#!(0(U_`B1Zye~1N96v9WtGeH#M(h!GOVn
zaUrl9pdWxLumbnCKpYEALzuf);RWOywFZUq3kwTwHWP$C#8Q?-5c53aX_fM=NYEQ)
z(I`9yh(83K*z8$aq!w$2WnM=M?+R;T1u8vEGD||ujS8aXMET4oMR9alB}^b!QE|Qo
zWIQ$ye<&u!z~{VA6>_AT4_0I;lsJ?k!6GJdVj=@UB?ZFsvA`S%9gPuNL_39&jitmJ
zaEBHPT)ss;k3keEGWsN{k{pmZElL*ZOzn|VvQ*rVuzwJ}!wU$H+)zkO+#4*nG6pAO
zPR|FEj0|XY21QlKZAhwm6Z1PvML<t^GooQuS!tN1F(b<{{JLbbg4IQ&V8xC=D>lz+
zLfz}&(96`%Ja>~m=;pW(a;l7qZn$jATC(M1u%!=a?W+RN;_T#ZvPf?0yd@+d&@uQp
zIhJ$}2bV56sA9SOrN%<&l8cM22EW#=n@JHJ(G7^xXN<2o-~}H=mU-Ke{qi~jMi4_B
zDd(br#%AYp0hAYl<!8xVd3t<D;*vQPB~g%@YH0PZuyx1cCap{GU)1$@e(mN{?UccL
zDzD9cV)r>)8rxqehsAY`&1%bI_!ClItG}Gj>*}-Ed>?k{JO~E32%)&<vq_41eJ8mI
z&(2$Ebn?<Y^#Q{)E)a~5pa&+LR-zTkgOkC^r6&p?U7+q%kBfzB8S}`5`15{ikFBr@
zG8umqcZZB(?5j}H?X)Zx?zr4<g7G$!;=o3?WY8is^8$>j)GYE@bBKE8aWr#K0`r?{
z!O_WlVYX1tFqI%5Vd0SpJ&%O!lL`t+y<Re-cJv($+dR4}GdjnhlqM~sQeX=*;Cp<H
zxP?rN`AwqMLWvB5%U3B)6`PDK7gD(O$5JRJCBkwtcuuBRlZs_3EdU&cL?xOm=7Z$!
zJ)72y>&;7%=Zc5Xb%*oc9?->Tp1-CA2SG1QZdtDHg^AJL)*x3kO;Cdg)hRwk!r_%~
z7pR;t5p?h6GO;T+;Y4DrikDfbYM;mt7=rvVC_p(ch0e({l@gd$qA9@>n!@aZl@>sv
ztCA^$pm^FWDAAdSks$4EwwtUlcKjXI4i=1Y9WCW-$#O!B>*(5b#-kXUO5?e5{eD_I
z)5+;d+f}8Q)}`dCLtG4?3APv82Qy38-+unt6w?|rj|+;6FJ(35gS&*dTC%P25?{Oj
zLAC{$JzRg+A9{I;gFT#9h9`v5V_)e&5agf1D#P<C)Abnh!RQh{&a(}vv4@4z^PH|@
zeIe*(ds<&>Qnv5-bxHTqCoVO%uO-<}$%KuI)`1XV^OUZu_t?S~C9*o_%lFajh3o4|
zdLQq3*~|IPKc8Y-le@Q9a=Mlqh^v2g-rM?dxPUS;4JfaOail1Vry;<=YCLn`17X|{
zY9fK4;A3L1)6yaT2yKvUo?0YZR1+?8EdYV?15pA5D6AT~`x-^zGf~fln4Y<Nkyewt
z2MG!Hx>lTHGIx0FE0gf&HBcS^WCXb$$<^n~8-*t=Prcq(?sdHAxq|`W_nQ?CzaPl0
z7CruUzKnKR9b|Pvz)w;55@8;z-DN8BTPV|+mlT0g2a$2(uH`(_Tr?_MD4dxCWRw^j
zX~}_{0&VjCOQT$e(n79W5W3ED096*HsUThYa}=w;s#MP_xj&)A$jO)t8;leEPU})$
zw_(AOFHMp*0Wjpi)%+KNWeRJrD#t>>HPcfe=$Q5o+=Qg|&s`G(`W}=F2pD^1qNzuu
zPXWG+zScPlLn?rYPDyERxssVHQGw6|#3Y45y21H^%D?U9-xPT*ABfpvX$X)7l*5(l
z<>EuVn-mq4z}4&5dC$*1`JLpV7}@<P)^z=$N9>u$zeyKgvq7nV2?UA_FXFRLJWhZA
zx)4*X9{s=~y7R)bOhPu_H%sop8_ztI#`Cfi*LtP95Q07b^b<BcJ+WJ9PRB==?4Ac6
zB4l4uAX}_*k8j^#t{4>Vy$?Q0ixF?hog2@k7qTt>&@H^1-R<R2+JP0ze{EdTLwPmV
zZ&O}oTNIet1*nX+yfMvt);b5<m6ur`rMG4>E-Q{L^R=!0K3mgO*cis9@><>?94=jd
zfD5G;p7^$%rnsr~0A#fF-|7Jgx@Rb)Iam_NPbywJ2x<T(u-e7~861Rg8&U|HgB%=^
z9z0iw5#%70GS6{kl7*Uzh1OI&UxWu|d53`mtAm1eA{aR275+tCso+fHKpm>qR&ckS
zEFfBFb5Hk~DK1271Y8b4U(aPRpuO=J!Jv}vxRUVvn$$<kR|{@=h;h#gPpZ7joG~#Y
zs{|JI0AH{wH0CG@1OX~3c(6uDU`8BpF0MqVGxT2p%~z^z#I-O6rr4Isr_G%*i~A}^
z{3!+`OAd1!l`qD)6g9I#K4g41Q~p=bvysgaREQI`z+j^|@*L+;fx|QkQsmJUDNu{>
z&@ll$SNag%38qH{kSQmZ=&W`?4wJ6WA-!R-DpWx-JSkGtN0D1{Wf4^Z8zz1ZdXt<k
zPu>92``o<eszKRvB;Fkc<!Q|Q;|NhfSt>CE95eY#mBV%M_2$aQle)k2!V8RNt#8xQ
zQ^t?(-n@}a-x-mDvlM><N{>ly>7}^=bfM=vz+!qnDL2Hv=5WcyRd5DkOt+qUn(?Uy
zambvQ<T8}Ch7WMceRp1Xp8qP278&$D<*HWTkQb5?J4jX)KMJ?Ba7^*88I=^q3~P?a
zrPMdvn{Dv?^KFL$+q$(2{x-qBA7Ep@wwDiHOnEge_iuCSI4-oUDUQA8YrkzV{>8W5
zSfcIofOq%q3(xRfx~S4x?fCr9<==tei-fXQR8F)mf>42ZCIVev9~6U;aMa&HiAEl4
zlThb<F<I5!W0{lmMvvbIW8POL<3JE`FPi9Hdz~NTx@xQ{#$M2N6klPp$T5d?!-7z(
zN_DHINlWC;)Q;34Y*ke32n+WrDb$&lAc4F^3K0^ip-6#1tUQN_4DC*jC2|N?zT{w(
zTaZ?&JEvsqg+=Zy+1^cFFd8FSaLdo@lEF&DedLn6=xgfMBX2O8b07vW=|{N<CzXno
zfiX!*(PDeYmc`(8$pm$u&!h*KkLo&wp((WG_m}x1hOS;%(eprSjx{1JdN~)ww}hY^
z4&=ry=%>{9X<bzzccmp#%RDS)aPyvow8{L1f@um(sK8>a0cFbH8m8+|+N8=H$_lq2
z^1x~pmdv@b(oGj8*WuIz)`)Aa!r1Zq_Kzpp?VHc@XIVBZ{|*YJW`i<#Az4Gs@ta9;
zHRt1{0opLQqF;suM_xO%o6kM7(FYXXY`UsAXNVglCD*uf))9(#Z{48llB>!k*ga3j
z2bh!_ewx@<^bfgh>#_(|j%^Xz=jU|`yN&kaTK^qxqgJb=!<E(6K$oSo{rW8mEVi6x
z7gJu_ui3PEw%x<>RTtUfT1Wb){dr=6bnDqCUv!`BZv8!I`lzK43g&H9B)Vlqk<!b}
zLm1|$Mj<PP)>xrLS*9aJ319O4ndqakMiDeI8{B85A1iz;wTdK8JTVu7kmD!>U9VlZ
zqAUj)C}=4t&#H2QUCbF=YQd9$8L!JcmKA07QEnDmptIg#Y~-hsaN(lMT=@~CR!afH
zf<a7+22Ul$#9SvD5X$o+m_nRSsn1A0$9XglwHQC-xeNQ;K_;;fgdR}xhQR{km33!s
z-I=rEn=c~FtyqCe20o|cxi6GBP86jz3jrh01@7PGevorUDyiVsaugh%Zp7d`kF`<+
zqyXiH3|`8GbJ-ANxE_LW1pY-;q{)I4JW4q=LOD2wo}3R+N~TdX4S0fyW$s=aW~%E_
zxT&hr)hT!fBuSJ%c4*F76*ZA?6V}wIkuJ&DK$e=9-*#<b>8I`MS@~z<_x_u%YTSVB
zN4x*tIKOcz*6m_T54dXCf8I8O&wR_fd)qwHJx{UQ81Z&O>#=QHvvTb^W_`!ErGsro
z!TH$x^%FZTjC;4gYi?FGW1n|2?)d4owR{iz_W9yBDG0`3MncQN@`0d(wE}5~WK}32
z%9~mik6`GYbl}3Z3HlE`K0^dr`k9b%!YPnUt}$9Dr88)xeLzTq$)R>sb?zVzuHqaV
z(g0#WoxjxMGVhaR>`hQ}D!Wq584aD1SmpygHjGJm0WK(@s#Xpf>5!lZ9q3h(!9zs3
zw6<J<5YF#$E&QJfy9z``l4{9hsgOxxpry#bc@nWTpp)kM+6f*=8RfM5;;MD)Dk!O#
z))gu?7oG?mrHF6|7ZZ#j3XUI`*A@v{5g+6E_t;QL`9Iu1g*Eb=v_Y;|S?vn4sW(<m
z<-LOz0Rob)+E56XQOmL`z!QerDwQV`Ynr2@ddzc~<j*8J2PQb-lC|jk9V(h}^)K@d
z_eF)2_Dp@?Y%|4dU{y7JVQ^4-P+EMj@f_I`7Ngnr`mY`j9V_>?CGAVGlHD9nyY0}=
zB4}R$cU`!G=(6qi&~?0R|E{=8+e&>`|BH6bI-kS(leF_suGjNvK8#&4qt(9J=X|Bl
zr2%dm%eFagws!09T$9A5lP>a3_MNM9%WIkWW50gPE@p);E_8uA9u;C`_Y<<r88F}m
z@)}tby0KZ6M-kBy%;5wEOyo7Xs6yt&jop%AdRHxXAUO@;?n6?om*0pEWj9wAP;PUQ
z`8q)YtPHQ#TRX2`^qN}CfAYDc3$79qMOo=4L7Lm#Hy5I|?5&X{0wr5Iskne%QeX|V
zoYn_HZ>p~aw_QFouZ*0L7#MAWu$UI0D|*86ORtM1kT&aN5mb=}X9>~wq6BEgoA_Q(
zvFaR*kL(z3iD7c5B<mI1N#@j4l_Liwn*=DSqZDBbaRGs+HEgzENz$UA=JVwL@|snq
zgCo=%Nd4Wr$Q1)fC524pnOm$;S<%E3W_l2!+t);jlQ5@Gn0W~tT;>n2CY%#b7B_%Y
zh)E^FUam0U*9_)<+sZQq^a|INVE8m?p>0hMU1w~uqOAQ>TU{0Qw+{MP4Li5keQvbf
zEB3B2Z|g6v>E<1$FKuD#bzQ)i^Yi=9?fN;pth%@|#;|g%&(<d-v)NDkIc+=Qj&}R>
z+x0A#PijAR_tyKGmHSzp>pzKY<+=Db-z<o+1Kybt%YamrF+|#>pGm3M6gDW3X1XAQ
zfI?%*k-5-;1=-1iHLyg;#F>{PY1l8gYEOPKC_1t{G^OwBrKNHm7D(&h0k8&rC{KtM
z_OMz8!$MvskAF#c*Q_%Iph?+~*j937j>iRMBQ1+cF2t(V0=^=plo&0d1156MTVvH>
zr^o^TV>(yTv$@qp)(_U+s)$%5(?=zbSd0sEL{^$pQ$axke1YrmQ`KIy5>^;WnbeMT
zs5OStb8F{Opbk)3K`&q|u%3noF2BiiqVh5&$Kj;qvq)eGUBOF>3q7aG&WMV{bEy~B
zS9G`PEX7=#zsX-1z>47zQwMs=B<Gt}(Q<;qMj|nDj66Pt7*x@aYr!0cFBid1WL}4y
ziU{Z!JWv#+q@UI?`FuC(^FU{);{tAf3OFWTnw9r_<zH>Ptg-g9;?66(+6xPXyQ__D
ztM7fU+d1B)6ZUI=hgGxm4Em0#@7(SJBy5gTdta*dH~R@od)kh#9$vh+Tie{-w{1Ij
zkLSAM@|`EGD)G2`Y)hAK+qyggbV-GV{8rp~5O8pJ;amtr7G=ow5&~h!U__8RDbV^7
z(#@PD0@oFpVl{K8Tr!7wlk&)dEQg@NjD)yXa+}Rnz3`ly55N(4m^^OP#L%KEo8ay{
z8H0+60YwKz2Kpl+^oU@TVgk1xDVv<hK6hkabaY~*RhQFPh^5b06et2QBg_xx4{;{t
zbLAW#loh4`N&^T?vfM`jI%btKhy?XnHI`g#kdd_;zDgNDfApqRLK{+9RANBFe8Xr#
zJ0ykxPz-4}Njakw$-rHl7{_Un|5@GCDhtk9qVXgDiXkIYLU}%rLdAb)rI?x+PC|mW
z(@8N=y8v-R%{pWFA9xhA24#W=1i0jcRX3HnP$^Pp^fj6i<uJ%`8sSwSXRI+hHGxb^
zu0)H1i4n)46q8nws(cCUTGh%nZp5eR^vGq{{m}*M{|U#fM_$az`K4;3?{)k1(`VIx
zzJ+~GUOUunsq|j)?=?yLSp<E-aJ%NCbC}WgjNM(}+@;R<eJ|RMx8BQ!X%`khaq0Jq
zEcecv-Ml_H`77CTC}(OaF}R?b<XJ?&z%&6c1onX;g8YLXvKS6T5KCniM9>RaMu@#v
zv1mXWkWX`3HWJ=sJ#Rn^xnlgxVS>^G`@19TswI>n-Fvx!7>o_gRWA%<0wg`ehRt1M
z4Pfnnu{DL+7?dnrTReYvyoMKX0p|HtK2<neR%#2svr=*;#3jNh14mF2)=wcC9b97K
zSw$=f01Uc9Gm!%qBG4s06%<WUJRG;lHP^83lc60X>CO~Sdp8eGp;g=AF!xY}+=du0
ztYlhVSQHeheFjTd3p}y@69i+TtU_!I`i4XnCi39m)h-x!#Iu-+Q3)-O`YH8|7#rP^
z@Sn19WXKkitI5*sELhxu4y+tj$(2IMmkX;PB)^SDL#+y&0)CoQ<w+GiK&pJMGMY1P
z1R@P%L!m-C`=k)lzlU&1wtfbo<M*ylX6d({tMB!{H}`FR#4F!@+}>u_zSXT;A#`oM
z1k{fH;+Do^=b?4M)?c{AjbA#BuWb7(ufB_r)jq<Gb5{H4YP0t^`z#>h`TZ=n-Dd%{
ze$F;!+<L)c3mreZwx#be%DclHqq(5ulhcasGbEi7)D;3(+n2{VtK^bohg@;)^T^!t
zGFt#N+=O9YM7-6ak21GvrV}xqldKiU#aZRTP!?WRd$<DNi(w{Kc5f2vZzL2G!jB$2
zrlY)D0TUntv498j5cx-IRZSLGVaDH^gj-rXmGZpiGgS;84HTv!KqHsM!*U*lVE0W7
zt#CyR7a)KRM!rS~b`)PEmtmm<X2i3Ql+0LHt^27Q*~qsJ?oU=R*1nLr5=U-s;q3E4
z)satU6)j9yzq}{6ib%%m=}-*z1d$K}VF<;8ISbAII5rg^#zq>aT9vRH77iM8pt~wW
zFU5+-BuMs@fixE<DBQ`?0x%oX3<0e|lMa9lygZo@H+VwyIpYR!vn+B}+bAz&@<BPJ
zr#sKYc03C5ecqYXB-0(y4-7k7zHF|9OfXj_-DSck!ktKR#vt<E{=&EKXQQplg%Q_|
zZ)>X)q_EcLdLMnZWw+$&{*Jby?UjSH_n11`_e0#)U3+n9t-YmL9q)KR?ayP?owa#<
zvlI5yLpQ9p7dDP`&S$h<ppez}+t1tiTsltdddDx&)XE91_q=sS+|pmL#b*PWr=cnb
zBOX)>QQ)~zp7ROVbS@+wKo5hFl98*KKoMl3aAX=Tfy)k=C!_=-NkSBefZ&gsReVvb
za11sHk4ZIxa+2CSIt=WW?C+J3j)+MSbvT#c22cQmz9CZ^85Lz^v$}ziOKD+z5Xwvs
z@*FVarj@l~Pw1U-D=#>CG8JPy-Xkcdp%d6PN{8;sAj@nzsfioFy_68Zo@ZsX*e%GY
zUrA=8YOuK_O12^>xac`+o;y{0f--R(Wy1!P)4j-0PuUO<i`TZ62IQiHaY?-YP-OFx
zO1Q{GRB=W+K-Cb-hB8=Gz9lZIIahS8%B47)D9IUBoI(4C(k7>8bHVlDBCIP{fpYnB
z#B|*uDR$v+&9t(JO@f&!C6h`8nm=h9u)`DS1L8^qIcpc(F)RQaqhi3MWr}*%eW~b6
z2HOT)oOrnk0zi_R5+-U^yH7W4`2cpUG`D}YvE%o?$M@YIdz`a*P4~*bYqi{`@AmyY
zESb1_Wp5j8hMo5sd+cm)dq*4VP3pVtwY6Jd&HaSdXVACp&GuLOSp_C_{n*ZrV2|PS
zdPd7##g#wS8(4p5SKnibo6M7Lu^=8O{)CbqrzaJKHw0QORyY=H1Y10-M^HjKP@xdp
z`*5rZ#ANBAM=mT}i{`XW03M+DWSkqr92B0&Z7Q|ehp;_35)U4E{7hDhs(eJolL}TH
zmIq4A?+SHLb`pS*DZi-}NjWSqC|DeW#U;K$@d#q<GS>u(5X@iJR*~!e>L}2KN-%kz
zrzh%C412Lk6^pFc@AM27k1W3V)N`<)97-V)MWil81mz&hE>mAovRuznq!VE7fb|NO
zr{aedmC!h?6p(v|{-@5Uae%oijaF9j=-Mq(LBX|`;$BJV&)_aCMJI?j;Mpl*pnP^?
zl&{Hc!Pkg|2CPW9TWQh3ZCI)n8aaN`$;H_7BltoD#imHO=x)L$<^(zsyl5F#7Ij?Y
zKadUtpBfN0FqH=b1>n#rRwy~@ca<zW$zqhIzmfKfNrUpjF-+9dbHuVOc~bp9$ThR4
z`DN+5@3OqQ_HB--!!nBfSNOYE#=)$w^|fU+-q-TlI<B~QuY0$*v(2vKYdbgFZl9N3
z+b-Dra`)Y*bUc%#T`%_eZ@1LetidhMy=8Z2e|^te{M*dsMrYj%3;a%m*=Z8!ha$VB
zOK7Sj+TkEqW!-cp*xH8!5E&Grhnv+4PzQuRsg0uYe#pYWq+jraqTpa!AYY+O7yCp6
z^_#)R#B%nedjep>;(1LfE^aj1CY`kObRQ}KfB(6VZz^JtRb2oN(BL&OHw^6Pa6l${
z653!<KUQ8E?gM?7rIL}G*=mw}>5_~BCs3f50=b=?VyCI9vX@n%k~~nDXLKlZ9y7cO
zS*iqsz<SFH%Bs>6yutlfz*z9QUo1XJm!$wEgyqwvSFy~MH4DFBi!vn)F-2LuDE?S@
z+>#{e&VYo9$stqD*}#=DNtE#}#6VC9sk@?bytu%`T)|z4`dew=$?-f{Yy;KdVqdAx
zX)U-Yo*t`Zd+^eH^5H%t5+y2lH^>V<xRbOrVRg&&H_X^URK?;+dP;+AKvTNNm4iX9
zK8L-Mk+4<<H@biZrMYb)%0%)UtD!Ev=y8YjwZ3f^IPF(%`*1IEY+ZTnqdYc`?V-Fn
z4(#rKRTwV!)}|o)BM!sTvDn?FZBbxh^|)<}`Mm8u!k6dwP++@+`POF_myW%NKGx4|
z+ZJ=NqB+~I+jT#?&e?h0(&A?21b>BTf5Flk$|ZCFkQW7OZAar=^iC-Fh}aLThfD~<
z+G|VE)g@2j0-3z1y@drZ5X?!q530=bnM}+Ki1nZd<3s{^<}s$xKpd%OcatS?Boc5I
zP>c>GXU>?EOXUg$XgE?j0omtPObAWgE3XLb-Y0-0a53&ROf?<z6r(vnG0UOR!fU{B
zvr6d3(iuAF&V*8*i-b0eq6$wk0XJEiL%88YpNG_d;kag*jgu1;oDHPYGl$y2Jx2z1
zSHf_*O*|#wC>@*3)pvtw5Ku!_BoX7dZ(tBeq6@1k^*3tVhc(%gm?R$M61~FwJe6Z%
z1#9vfdh)gz6*yR$!1|7PB>fhi2ik;-@b-)`%K5}u@lg-57BMh<$Oz-5Se7gYtvIxT
zz{`Ne#5fZS@&x84;gmI3FGW&D!%XogEOXGp4A-U`I|LjPL02wMA`4U=@B!*3CqV5W
zcnWk(5PGpO@lkeQzOt+ftshDsfx@KdEMGl0ET6TutL3z=ewIaMXFFl-l+dTW-Tmyk
zZkxb-$@&S~kGJ>J{~lKMhaJaT+U+fTL%;L8ZHTUO){gZU(7p;|QzgY-%5slWHqPC~
zhZ#HnSlaE%i@B`nLkCp+Fs;h(Bsbx;O9Qd)<i4PdE^G^N`i%#Q+dv%8mGvrSb3Zn8
zD-5g~=9ES=rsJHmVE}TCs>`!V<v`F5*e-^LIjQC#+fW~BAdHz%)25J#lxA3<52?IJ
z8Vi)8XrZ7WCKDA?EQ^Zeo>(=5k4NQ4a6g1YM7bernQ^W-Tz(<eQwnGjbAc9$T7U>L
z(w8c}ONM$21UkUOg}EFT?kNLS0I|D5n1QL+C@Z`uC9kX1&ajZuCXp@9N%MY^WHDTs
zP{Nnobvi8<*<gwVy0vyGP1qffCTE$~B{LPztaUGNS<bO<;5?Fa|CO}(ayOFd3KcGJ
z_mv%thtxGwSZ!$xXJ=sbAJDrO$5h;kZw&+mNe{hdRnFj=w4Txtm`==z>X<?Mreg<Y
zOWcJe31f#yN=qX=W6(7DLDQ%&r3ZJGZt@r<>S3*ADk_OM7sw+g)m)V>)8D9uOxl*@
zjIO;(Y4e}hB06>{FH{CTymWc%S-XU0KSdM!34yRfxb58EPe6wq9qb<K9)daSEA-p@
z*m)m&DB%ljdq0~$8RfNao89L}dnvbO3^$(q;~iwqySHX!*+9^C#9mO_agc=O$#G@(
z92Rzf*hV2XbATtpDOT+QMlc3e3jxP)R-u?Wgzg|0*nuv?T1m?pNo|das&;oET!=?k
zu%cJtMcg4QAuiZ+#k-_zq-paY28+^TIwP&u(_%g;i!l`3kk-S=@r<#f;XpMB={iJ`
z?o6?<fyc^Nrloc=a!)LVbpr4QJWjA?P`DAU%_$L>H8}^NbWcuI1p=^tj0eh(7MUTQ
zB)&$-=}T!IA=^*pLKu?FnCVNh&gmj`S1K7bfYi(dn1MnY2F2IVCt_K1xL@;zQ3F<5
zWtWeRlFpekQ5@zDszIMjKn5Hg9UgQq!^}BVHP<9<pNUn84!OEXN$_@{V3LJ;DaF4|
zk_mdxJwp*9*GiBss1j)7ra)R&5Rq~U<>bCn04#v501{=Gsq_hX#0a6xn0qlAjnZVE
z@?Y{wMX^jn)7`R}udp)Gb%@?WCj2M@ftcD%{Q`11nN8VW1E1XdZ1(#cZ$1Akf5Mhe
z$QK?P+rEmc>)bX=rC*y}$NO6sVaJZ`<NY5(d7byu>mGV3uiXl<YwN36+Ma#)@$LpL
zrjYt>YxDXNSYQ{_yNhkbJ_NEXrnp5Y(@$X|<oZC^T^TrXtx7Q+xDq9Uh-WBV5H&>=
zGu3!v(B7?=a$2e;7Z7&_svv|hDmwylk(3SsIE<2;t~`?qtc2@uHfJSq^XkK}s32qy
z4+a$0^SO9K;XcHBf<F--8x`WuJ3X7J9#|$Gz%pr9#OrR}Jfng^`4kqH1o1A)l@Ms6
z<YItNh(<*2*OBo>#PPGa>Ko2VFV+j%r?bfVh9S8LhX;a%pPh+0gmzFG*rkKQ(T!=G
zY3!4;NJa{JwQ70N@GuZ36UlByR3*`vMaKNw0aFr&91}q#Afq72B(vkRa6u9@#$KdV
z0s1ExC7HZu>3mi;o(X0|>$sGQwQ-wL0mYoIPAF_LqNH)1CGA(Ffkxg_$>&t0*x4lY
zIYM4pvV`l@&v6tnd>TN(7hr<=TD71hFmcJ=ix+~VVA9$n6WkG1h4DfSld_uQAps^-
zdy%k#bS<>wBclVmofJ|DFh>THf6n0DB>glw8w0!qFyoT~<MlBvf}?TAhtTI^>N@Ym
zT-(-CY_YsH;s#q9>|;fmZSu=)^wHH`kDEDfE0}e})pUGyXP*kc8`mxE>55UU$4~lc
zh0VFK9+$4frM6tKdM{yZZ;xTdrStaC23_Am=-j&$RgAm)+BH|PSHHWj!$br6d@!z<
zbUR0_sv%7xv0#*1(dSNnfCcXi))lN0)^}2@9E<DV_3g1>9v@_cUBj&eHx&vXW~{J0
z5NT@^yuF0wQ$&I(W**OqMXsWSu+TCg@EZ2=%I7X~s5ZkNfO8|ICkg+lBjnIGtf{lp
znH?OWWKr@sCHE(&j7YCktAH&m81fA|K%?~fUu04rsv0n4V4Nur49fA+SZ-7(5>^!i
z6;@J6F|X+;97N@xO{bM79eY{;Y!bx6g6?lNQ99ECL?Yu$`EZ#S-3tQhU~$z%4}u~K
zF!@O-b`UHA8u};Z)TQTgobC%TG05?0S_Hr=cln43ca9=V`ekCYzEIc`I)fmM0%%W7
zFxd1NQ%v)6b%d(Q75C+{nVn^Nwz&T+J>LT6EG#H6tiUM<B*#GzTmt-1d`Vz_`-&i|
zJy~ru<SOL&?2L-+ASteCQ^YKYGYb=QyPDYyC?U@!fYmmQ#)`;9F{T%EYC<QHXv5=D
z^%kMIYhTw#*JUl(KId;e-Y)Fd&)?Q|AK84az~atpw+WkWWwQNPYhSLstjBe>qu;IL
zSv#S<y<lzepT2XuvdA#&`HrkAuwFXWtT)PWYa6yrc{OKPZz`<qZML7Y>$xot2|{|9
zR^^i<&<_rTWV>@*=?Ntve*LHrKi<$33r_-hl8&J~JgN$hJa;Q39}`e?L>uC3K>Q__
zOE8J0By;9Tc@=gGNylm5VRAd&zB6IpM}q-fdGLCkC2I*n774;bQ;7@+@!^Qn<ph$M
zTXrmR38Y+<C6U7oHY!XduVi6dIvNleSeJ5(jSmJah**0`dhjuh59L|HdS4|##QZ)x
zj#P$<5s88dUNE>3XSGmuxE>xY^m~|oPQZACcwn+p!ceGfxZWUh$Cq<L=EYkm_ha)8
zK-mMi$%mASeFWeOm>rPIOptC$SS6);&v-<IHA^dtgR}scBX28NTvNDj&%iSYWS~(=
zX2@Ba%dJSOa%?n!1iS<5JKS!S3J`;LG3`D&C<y#0lfRSsa_MI8A_j>ersoJn_Cm7m
zE*G?3hfFlX{|26bJoPg58C-|%*29B>8Ax*z2TN9=w9<W-q!q(Min*hGl7^022_4`@
zK>d#(8*{~cl^rC0StG`T;}>csZhQq@tIb^>)XwvENod>tQHCD-Hjc&J{p}c%pVv=$
ztsHL=UKdrQZOUuqSdSI{UW*J{dS+qQb?YZ=x9ry2S-EP5m2B3oH2c1XJa-SJ(lw6m
z%a_K~d|ExUOrK(%vHSA&^P^%aO72yytJ5<i2OGl%2up~tHmXW`k{3XM(<;EQAx9X0
z4`j1AgYrm1_wrbP3MIUXWdSHRxDXF=a~?vJ1W9f*2;W+8^5if|3azlyX=H9z!(t9)
zah4Y1vB_<UF5fdRB@!G@Q3@kam6g}uN|wP$R87+gz=9xaWiCV@S=K>Yl!W>`Sq@hY
za>kw@;o-`Jf*>KU>3x78uaJ-o_Klft43-(<ErTSVD^wch|6ov+0$EgGE)rrA02h`y
zsZ_@0@>t)`?K64220^Y*AseN9$&R0{gJp#f4%pfY#=K;WM&~bt>V5iFMMXZ$gj__t
z>g3pH(N0nz5hNDiA%x`$)INSE(K;0W+&rfa^Jui7Vc3M^a)d_?R{3}wXuZwA&YS*y
zFvTUIYl<q}EEN_4Zb&f8vc_)Y%%L$li+wdAGz@Ypj9UFtn!pp7eMx)fNh?;Rl8LF{
zaD965P)2c72sTd(GZQ+IaWk9)liB&I5H&qaecxSLzVD;7mao~ZRL*I0!#+}G?|xdY
zTa$Pfv3hjQOQ*ax`#Kl)+Z4&>b?5z9=%*w?&;8A@ZOY5GT)U6;wbI@W#j-lyb30`B
zc$V5&8q`H}*t!L@+RoaTqV4t=ELqVnLZ>d;I&VkBwbK~93`nJFyl@9a2~D`{?!r<k
zRZis6VOkU`Bbeubx(OB-88aYkr!`mYSo|_>lY}-P;s6)G#Rjm#<Yuz)js~=B0JpE^
zs$zkBDIgMunM#@z9;XQIwi3lty~w+=tRc%aLiwOn2<)hlx0DnF`2K)$gi-_P>|7I>
zr-2=gq)bm!Ebb7NWjYs%0X%;-LwKS_;`?38)rYC6r!~`$V2Pjv2*x-mXG$8blJbKk
zHV=NkIgyS5tQNDHq!0B>pptqnPDk9wFez+u9+uHTak8@D8;wP9MeRt<NxBv+9BB-P
znNW^+b`PYO<Z)6eRq#?(Ue^r$VP09X3c4d#X_)ai(i#K&9*9sN+GlW!X7czU)`)be
zTq_UigrkuFJY+cmhJOggrcA8wET0?-PBaS?CS@dEE4^GJV(`6kCA_LZ1J9G<0%ZP9
zvbjgeCJnhOz9^~>jlh(nkY!#vTE5#NdL+eTUVzXerDHBGl4havqP~@WADmPEuYK*?
z1wmIo+Xdsk`*$5%?sK1Ox>ooX8DDeU+Ro`M{5J2wc8#Zp<=U;h&h4UotfEB=p--P-
z?O5zMvetmD%|x)>*R5XOF`m^H+UF;<4rJxr3u>`uY*?uu4w9#*ELqw2D8+%WS}!Lm
zHv+#8EdZ~9b>%3hLL)gWbC{H%jIa$*XQM)LWm>A72Vz%nla)$iV%{lSTf<6eJ`j>9
zK6xj_rbdUk$i&_AGjMi{dL|@dWlj|9g)4I}ZkWTWayUPD2EhP<%F1xtT}#^FHe7>)
zB<ISEv`gbc3v=8XtUT0|LcD1X%~Yxyd@@o9>L9oz6Gc)C&e$H<Ips8BP=q4X!3}|$
ziO}Pr5~|H<ng*HBmy8o0L_+CBekHKPB)R0~LEMPZT?@=Z%W^6-QavHI2>3kRiYktY
zb5AC7Lf?n%N2N_NmLvgeKh5|+bWd22Fs%V-b3?+iSovWw0|3I>YMGuj_-pgjKt#WV
zmotHX6h33CNG(_-#ea&}U6zS6u=HH2U`??|vAz=q&(&EVe0}DY5=_j~YLfhrBbvE0
zKt!W44~vOwCg25p(0u54`jv{Fg<5DCCb!iJgf=uX)cUc036^-<KOVD-Szr4I_Wp`<
z_xTq&woTdccyHx(u8g;}*Ic`CjyJel`L8b%wr>mNwLa9fb6R$<T(EEQGTUt|h&`15
zs?zA8#9A8c^9;6J-g<0#9Ovf-Yg-JhU$jrmY`G&Qoerd2W+xSsRL3dc10Vp9Z9oVP
zqFhB_B%i01^4Scav83oSQPK_bNC7^BC=P;=2Q}``r=}+<BySLMtEklG;{Jn|2i6$`
zE|@w7elt~+<p67{B3ngG3kb2HA(44PF9OO<XH+c^MG4-%^mCm4zIzr)e|M7hU%ON=
zICYxjBCD%F39z=IC;dV)vU0K}X6PBhaG@dT8iJkf%5+kQ0#smJKt;m+d3Nk&?b9G9
zXY-`I3R<9;@Z(u@7b4-~s;}sBp6*G=;V5M|XYIs5BqYYh=K`>b^U59^U=dMJ$%B&V
z@Nj5xt{P=Th!(Z54Ngy0PHIB`;hv=Xc7Xgc>4eF=sc%+`!YPXHc9=D+9dcdf1GyN_
z(gj0!^MK4jN)_}H>z$+%&uVelk8=$iRu!O$d@q+w5$5)#4vql42x8NqX_svJ+9$A7
z5t!urM5djuXo9k(0qz(N#J+(Q5|NNu&i(L#;#yd7rM)!UE@9brEUw=2e%CFI#I=2!
z*PB@<*kFG}v?*xTuWP$@U(0J(d+X<fmL0p5|LVPL9sl~Vj+3`9BKj-l^{p>MMpvI^
zJ(bZGZ$O`IpGC($Z7;jLLrYtBet6}Ym;`w&B9niCgkv#Txcx|9RI75tPzl1tJfkH<
zw6TeJmdL(Lt~~rn^4&^FvH*G^?gd$fzY$+z%_+z$u=*@md^9lB$Aa~60u<X+ee)az
zeZ=Y$l_*^$p*xw@o_`g^DDU@v<`hs6-mpBN9A>3R7HIhZ$p^~|F3#KwSwg9dy(ZN>
zdIb%U&{APlVpJz@Biwlc6A-?h50nx>3#x=NDhLP(W5MfrJrqiw^Zr>oEY}B!+Zz$S
zZ`5dU2EtpFfPwBlWl51hnko`Gl}IP3l<t&{AJLRbR%=o!3%2;VAox)FPyu%*vig7|
z%-l+(ThP=8Yj;A4r9UnoD)v><ve9A^F~KHRtxAgzEFR91@(Od2{&HdgbBDP~?0v%|
z9ON1VSYn!95|k<_GF3r7AzAKVVTFZSgt}PG;O6O$PS=e<lW%Ua20`h^Ad`%Gb)cv?
zd6^2Aq3t5<DFb?J(Jr>dJ&(1mqj$Cux3$xLEViB>Y}d@Sjyd)@H>~}1x7Xdq>i)j-
z*M7W5n`=Ab*6YK@d41oR#knng#XZ{VbzW@!wfENdzE<C--S3q}TM!w?EuBy)LU!gr
z{)s%bsZLA^qg({DSPTm=AWsOH(Osai?iAcemGYe+FOI<2GnQLx;Dr|<b571GUz~xy
zE+Y#=<&}q#TLp`55X5<S2w9cY1Rjv*57%Yqt}G~vStZJGI2|DyfjoqZ5y-j2kx+@S
zKxR?#GceLaXak7C#Sy9u1CRo3=!wpv)H5;)fr5`D!n^^wIceoovaCo@#ZV0R9mP(6
zgxXt$+?%+bG8H7|x#C)|CZQw;UTGdmg~&_?nj9w=E$$1}Y!OtW1Z`eDP&MY+Ozyc!
zEmtQ9aG$?Z+A#qsnQ#p-bP5O91to9emd8V{w>7QLDY~NE^JCU_46?i{S+F8Uj<gzI
zm?%NH^b#^mI>($NS1vGp8pxZRlSJfB5K;yj7RN)Tl;+^{^PuGbgdRA5Rk+lOWR8Sn
zCa*clq?R(Ir50piWj+wV@8QiI!t8_JHD=@#LjblgW#-4F)#c))x7B@J+rF#OuyJKv
z{L_4FyRTi}ciz^v6>lT-`T-`o`#wLv+xlv|u4~`6{eACkdmHWdxa&Ul?r&{Jhf!v2
zZ&&xZeLLSgeBM^~+uZf^!dfG->zo~1pZnUpm0eG<N2gI#N62j=J3P6c#GnDIsqm!Y
zz$E10#bpDTCkRn5f|ms`0=#CGz8kn2W7IiN28ho<*w6w9vNW<rqh_khh1ERdS7fqo
zO*vOhqW``)l^q0UPiNRZQvt}DM1v}Z2@7S&T2+DZnWTf+4!(|QI#!Hw|IPvLAE=UW
zbl?a|dj!4jBPtr907ESoDuQ{$gg9Y2ORyxx0ykt}(si_xq<BC`TTWGtKC7hs@yO1Q
zCzi{yL~~dW9GA*#Lv9?bO)nO$`e>z)g;0J({#7b3qk3o<YfdW^P<qw`tCizB11^G=
zo`fclqVrNNQOJD6A`yq9ob%EzAZtfVi)hl?WPJm@m=**fdGUa%%!`807H!=jnK6im
zK_L&Ngq49Wo2c2L$TB4a!lyV$rz2O3H2zUBDeOl)3%7$@4BR1CC@>3ydEhP3j0~)E
zqZc1s8mO-lqJn)`Vz35hts5*Yc7Bxp>h=0Y`t0kw`8U_Q-A!wy``pE`EvwXM`}G}n
ztde8Pj%eHaZ{N=Q*?Mobee1rrJ?>%Kv5uQ)-`#EP_3E?7i?-U<_Gh(zUHc!lyw=)l
z+jd|5+FBpK{~enj?Q5QA<@|L@@Qq|tpwOx$yk;KrR${E=0^LVY26GiZ1h9h$I1}&-
z!jYL^!R1#F^E|5#v+Rf$CuHqGol`cYG7!s}c{Sfmh(yHMV7V<w7);hntX18(jLI~H
zqJl6cXf0U}r^%HCMFdwL*7P&4XGkv=TwZhMAFKrKsA`|*Alkb@kRd_L0c%Wo4J%k-
zs40dLEyIj+#$@A4yp1$E+?@$l3xYa8tP4~h>!f5Xrg<`xvR5I@pk!ux!ootnY5p>@
zgOEHpmr`XKR3_#RNNmR2;0jHOCDa0SWWL(T1V{A5Yk~ZDtC`T1SQ(Inw^k|?p#D%`
zm;=y8!ChRWxL(OcjKDZ>yTZL`w7#><i=I^~;AY0$39<x(YK1Qs)xV)OF@2oOke0cO
z@+C!cv(U21eF*C-!h}Rpajh4SaWlNbeE6asX-aD2C72V{s64NkzbN~EK(=vBn`L3P
zTTFPE*H)xK*!Wd#Vda<?Tmjae183H@x{fRR&H7tD+m3f#(+G;Ls#tB7$u<Pw_Oa>y
zw#_fE-_l6;y`9fp+cn$z+c?%S`J3l<x43N{7VWGLH*7y&r*vCj>(>P9IJJ3QLtj<c
z(eB!Qvp((ZSY(L&PgT<gT4F~>4x)SrFx>=8K#mMufH##Qf)ZuPV1X5R5I})+K_22D
zn})jq1B=>5#^YI)BMNp61vALSK#%%T<|UdkCtYBCCJMk2oG4ZmGQ?6(ZrAAKvQP@O
z>_T%nhe2Y&j`$8sc>pv~&yy#qu)H+49^Ded7`%+saHKr5#&SgNSB$F24CRKf%{bTn
zMOTC+iE4#WK;5e{1=)(D-0q$#CyZY{7(j-(*p4RZckId-#)PVM)Ksult$5lY;&j1l
zZRN^C1B{+TxPsZKibv%s1&0H2DZ)~okp;tuxR^UKlxWP{<By1KHj5X`+)Rqm*`S1Q
zguAqc`**-x;2aADCNJ{|3qZ1XS)*!YQDp!PXwue<Ib}itmC(;XyGJb(Jl#Qn3=m2J
zuO9|{8R;s_3X$>#@r23z7lVdsfaSb7^f5rTI9330_v(G04KMH`uX@a0{+id@<$JCt
zU+cua^R=(olYjgTo1UJmd|095dKIZF7bj(|;A5?Mc+2}fXs><i_t>|;{CWGzAAZbc
z;5J#>&OiK30o<xQ%=Rv~(MOnCpX+=_+;V<bTdVFv7gBB4N89RpU2nUO;M`k*Egx7q
zxV^9C``dP2OFKPo;`~{(-F?@&Eu%yn;P5aB;bC$eouxR?lu{M0u;KV135Vp2pPVIS
zG2N@(p1QbgM9YJd++a$KDnc9|mvr0V`^Ul+0vomca+QM;%XuZ?jSb$MBJ(j-0y;4D
zH2AsYxsroGgwVvwpJd)Z$Ysh;1rH%P2%$J~RVp?jp=-L;1OySYJL6={w-LPzlUtTx
zH3t#yrDWk;N-nPBsjNS6FS2Y$^mZ~?kdWFgLOH7=G5{lnR+F?h4?0hDds^IA(Mf1)
zl{FD1RiFZg<u*vJ$Y~~p2Nb44MUbZ%`y(-}scJ`X*C{aGv(k-(AihV?PtkjZB;%lY
zsYn@;adClpL{jyzkn#l06czyU(&wg@OB2>p=^i)6`GR6<`1cH6zEY^jn9I79J64t;
zi+Sc6FA~g0dF1=S8f59=BQd-v{Jjbu_^kY)urj7aT0=0AaT8TM53b?gVQ_P>R+$n^
zBvdR{5m1Eb*wp>3g~!rJ+wX4yltNx>@^z^`jpl{WV|{VkYv1xt`@SFfDSP-;uT2kk
z#1+!>?|8R;?)Uz^edZ&-v7uzvw^zRYE%vtW{{j1VKmYe^awbLhjt_juj;>s@FZ|x`
z*zFgdv&+}6+iTwZ4!iZ-Gijc(&bD@05BqHUDzBHapWVk^>QSi8ZHdq?dRx1h-PYy$
z#TV;m_u>8fI=FPj4%0iC4~9uWo!aru=aT}P*!b{LTD;xI?{13yH=awvXl8%XTkGP;
zg&MgDJx7VL5|H7}D_TT(er}<$u9nw|$|U=h7+eX^!7?Nc6Krz8h&*%P7+j1oYZ6&A
z${4!Ff>4U1Ov=EVDZ|B;02)qD$6Trq7dQaMv$)VV#fUP=I$B2gxm9*B6gfFvowee4
zkd?*!T&7wr@CjvLCV-ksrifP<?$A?m`H9?@AaF0af__;7B^Z?$6d~!aLiF-3#*!@_
zwv(~o3y54d<Ha)NKAo2S#Dc;?Mx28}Lg*V74~Lnlf-{qzkzj1i{Od8RyooH-td3sY
zIWQLvh|ny^1qw`j=?Z$BofqnK&#f$I(Lr*nd=3`c_9SYhLZC#H|CTosg(hh-$XQ^`
z6nuoBZU7oX(2%74cT7o!w6I`~a^)k~DkcaTcxJ93t*N3cC_MA(RxrlfzJTo(z#x6N
z-}AvAwl}@|`|R;Q`m%lVOP{m*9(>r|^setuAMuer@y$Q7@1~#NFQVKFtFFFRy#CGh
zlmF3wVjug}f3Z+p@BF|I+sj`5s?_F}sJOoU<<BJrcxKOh=i4M7UW_Lwh#RBRSlN>M
z&R=x7CF+gwD|b7We}9ivcl*MA)l%4b&DxIkHg_MBve8)^eKsDTEtXekZ7;rP%d6{n
z+kNj+l#A!N(a4rQ_f}rk(#rX>T)*eTtJl+tbVx$i;rPhLM^ig3!90G&iqY6+r^o5{
z%d)y|-)QZBxxH=UY#-V7t8hFglY$s82431eBLX4PT?JMi%9Z+jsRzpixm20g(W;$h
zPoIwva&;7YL-S&R6R#p%O`#0Lmr635=LAjEL^IohF3N&4OjIJ*Wtb_KEVST-BAxMr
zIj6PIhp0Emk|$Bhh(x)SS1}HfsnfX##A|;1qF2J(d<Ima$xDSaCbYwXmQk@Muwqc*
zvYwVIH-qh+{a2c8=l&HkoSv-8mATM*V){sJ`8`bGs*6${jirQp%?c_0rY_h#Z;<7+
zTS5B0sxull(}^rfK;B`!LczlI%9vQDZxwSi(bT$&FK{f3H`c2BJgNO{#=MlG5X9d{
zndYwayf_%ABe3mH9byR1VWM(Oh!GO*nqcdtYfDuGm6?ubj0XsChv1bt(IB7~A<Hln
z63l+9S$ULM@8*-`F){>Um8zhub)yej0lqr4z4HA&q{Rn(<%-?=vWHmO<P*R7tM-|X
z{+3<8|3N#xbIY#X_W<1{!}KBFo0Qq>-~KMT5>M~mNv^~%Qz<>1T#Rq}-tS{uKlm5^
zihcDnpRmKUntkxm*VvVN?zQ**=$}<Rp`@%D<jeI39<oQ1vO7qt+bm5Qtg(~Zx9l5V
z__TfZ8(*bzMBi`xp7+^34?M_gpMUbZc0G;Zk3Rhg`|j7il#aj5-kjWz*Y3TaF3P9B
z^9}pf7d~Uhw{I>K;PO59S164Y8(WU;7FfHK!Zu;Mt<ROX*HS0jl$V+9RA7A+Tx&aP
zW3X-KZd}qWzE}F}s~tKwiSyXfK1&MuqO(Ygx1+1~CQD{)2T5^p^~`wexrd``iygi0
zbAIc{xk!`+Qz>zYSL54YamY;cKoHWSVea7tCEhYcv=+h)rx%{%WL|4a1s0vWHa2eo
zN{0l3FER>EQ)!e;3=>ST4Qi`$`D7k@YLJha_e;f6t0WWllLjgc>X0;4rJV#vLVCOi
z%BQT|YXu-1>RQdU;D<YojPG!@)k@$cV4@O|5&}K<f|g*Vpw(hR0|K}KIXUxC3rQh}
zqI6EgpyeVg7Q_oDQ+c&yg^D_h5hJ3#l>&hAI?<8hdnQFU$Q8RfaphMrPpu#~Vp+*@
zMm+3vTIroDK!H`-lm?GclVF@6Rc1AiObUvxsR`r<T`;6Y41h|-g#lucRP-EY^ip1W
z4~oh^HA3Aj5Qt9FT&Hb<wbhW~Hs)n;a~T#E6b|ckG1I!{U@>c_ra>b(D)ZcP3YZg7
zsaRQ56;f74c0fiEd_^65ejObOj=O0gRyIr@?fnnG!XAG0V|MrE4Jxps%UA8@b5Gj?
zk34Gc{-GbYH@@>dq#MEgJ^6;W*oXhwKd|db={@wS*Rajkyy@-f{AZ|it|n!4aOtwW
z;;}c{H^2B9D!}hcO6>Rk?Jp(8cbf|Bz6T$%JGXAw)uiAs`A1i;*>g{Rhwd7<8sGCn
zKS7~_BAiuP89)5$*W2{$G%3w5*}FdUllHzJ`*Ue!d`fiZ>yF>U#6rZ++FU!^g!C>2
zwp9srNcS$8+ea3+S$A>yz;fSV*ZAB1+S1pKF>RdNa-hF*-)?`zwO_*GKj*u5>$DXc
z-5O<fnigh=V~x^#iFYi^eFY4927LIlxlK>*+AMhx7S4^H3UsT&@3}#~0C@+c#A?8x
z_{n66Tsq9{_NlW(P}sZ7fkG-}J>Xtga1f=IoV37{x6JXePE;;oSGhu9vM`w^3NdlO
zdKtOP(F7EuC0BZlD1tRAvdu$T5!q+R&oXhUngl(BDBuP;X_A87nu#`w$~i|}sd<ts
z#(T?iSH6{$+rW7c$=B-a>|}siSWjB$GmkhIj6BdHlQlTV6qnN?fJ36<&I+NuD^C@G
zH3T8uFcgt}53u}!03i_iL~@$EYIF&Dn^3e^fTLq7RFb-@Gzq~Qg_xDlUhQ!+45SWP
zoM~;OxSXi`pk#BpWOEN%g8E8;6C?c<SWR%*S(AQ%lhS=%f@NL@l~>8di9$<Ds)K4R
z1xF*bZk-8QT03H{>44eb@YN#R34TL7WSEcXM#h*V)QHJF;SKy-O?o*L872n7zg(+B
zCY6OoX&QaedNr0lmQF?HpHJAdMDE_XX<zx&C+z;8e7U{%hkw#u{l>T2Q^}q8^dEoI
zo=QJZ0&jiqpR)IU=*N>A@w4gN-%kqUb@suZ`Wd@(<9Yk-fBEzF<v;wmJ@|@O*>C>K
ze{A3S^5<=QaF`U<n`otd{MUcUzV*e=+8f{f{b@COi3!<*;mAhmoM{pYpZ(~E`NF^T
zy&q((?Q<Xd?WE+!_WmFLX}16Szy8Y{>j(bK&m`B)QF`G?JYzrjGk=Z$e&m<`c~WXq
zd-Yr2Nks_-*%g!MV`1!Ly=(}m7Ky#h+H31;x#eBTHmser`}}S-x(}sOXFq+l;KsJD
zT>5vupOOfRf6tEZ5`=V++<{l_eINzgr)l4vw0OGCvu-@~INgY}%xuZ(-E)hfeFQ7#
zwEWFHt}~IWLh6l!Akb$JPGeOB&b%@^N_aHYh@0qf<u0uOErg6L@wBwKu&$L93&j9I
zcP8bP7jo}`QiyRAlLrX_f4JbnNOBF<Q8hKj=aH{8i}D;ncmlK#=Ry)<=B8wH$n0!d
z+G!y+2b8!Mf1p9bh}tOF0t#N_8i%OxG!}*Ca^C;Ev8v47p6;3?oIFZ-!eI#OYcluT
zGe`f;K(|Md^vsjA0|6C~%OMM1DoSm#I&`fn$1oNE24t#%2^fJ>LoHVODZw$af`EvG
zlmeG6Yj%OT-UPNg7!^v;#)4v?Tr}E06`pZ&rv}x1tV@LwS@{_5)a0$2dqvQQIZN|A
zIhm7~7eJZA<R8YuWt`>~l>+cC6a$A~R{j=}ZV3#{;O`<-UO4=mtBb$~;Y$JH>&2Z_
zr$G-m@nuHeqF~{9L9}7P#5}<~xoXN3H>*9LBQ|*jnY$58;->TM-}M!_)WZw+$>08U
zyOrWlkG=UF_Q1;@wYR<R1NNRD{L}We&wa|i@cSRJmp%GwDjm4wt|n^=77$jck0saP
zzxccVH!3)6h>^YU^ppJkZnC5fE?u%GzVSzPBUx?op|1}0>&Z3vd%yNebbk~{A-y+Q
zQTHe74i6kk=p(=K3-$-U`ER%ihG2c{?eAH%@zl4zW)Hsdwf6999<!&v^$q*#CqJHC
zjelroC&ycbSs!blU7^ICiotACnQR=}+1Gi0+s|pS`oeZ&dvjjG#-6?kZ0kI3wFGx<
z-Ab%YSzE{1yZVH+1s8ZR8gbR1p-^mEP-XOyC4oLZOpQ#^O80c5{k`6)wFk1EN)gx3
zjpxrs@<f$;5$s2)jA>E;v-CST>!!wBPcEg?b%(Ida_8=Y`>GHbZ|%a7Ko3`5bT3s>
zkd?>DShFklT+vu?AhdowZxyb$yj0jkh(Tk#yYd{cf?*PY)R^Gx)(b@85t-<X=r;)O
z6OaW5CF>%V25(YmP=uM{Y#39W2`LGe-PDtQW0YkExsL^Y^q2{)EK_kyfHoNGGf_;P
z0=YOdf-)e@Q75bRLXm+AjcQOiS@I!L{=%Y}RpM~uT-4?YJ{K^gRxTJ~O9artqDsLk
z)Ek2(HW+$}Q=KtR$4uZLV+AO2SdN%ijDbY@@=%h45tby@;BaPQ5fVt~E4LtGV{<Sp
z0cnaH;-I>X$P+`wWfCoG5^}*REs!IyG6yrm`l;o6uA^dIOh6;SVJ1jwQlCXG;wh})
zpv@;nf1;fzDoBkw$W>bhtBl+U9p#5l`vG$#KcX#u=B?jGu(nUQ-8u-Y&I}L+;#FV%
z!{4*ZSMRaczvDgjAN<sRXs>(Q_om?Vgy*0f3*uS#Cifn;Z-4a*_Iy%O%NAc)LlFpc
zvAS=09Fyes!w=jPXUE6%X%~Z$)Bl@Fzhuf;2wAo?`e48Pi~qfS-%tFsJ^aeYQta(L
zc6xG$WBlyz{sxs-bLuvW$M!nbPp~hpZRxmeEZxF(Re7297;B5x+I9bC-S^o?;dCm>
z7UkVvaWA(Pw|BgsR$OeuWbt3U|7A899T1EW(+_^nhXcNcml2#lJ+}IVIW4cYuG@yR
zb2w{Cy=x;P4>?#-sNy=);uw@obeYv+uYeZ@Y!F<8I)I5rn$s9Dlu>(~u3%*2!5;&m
zA;>FOXC7k;Dq8|YQk9}lLhJ^VbT|l0g6_FY6^H?PfP5ReB13-JSuKEqLmb7_4rNk^
zkM(dMD1F^5zH_1cN?IL($+ILCFU3a)F$${?2+GrWO>jnZs=OwC2J7w8K(tf^u?P*A
zEu;0uk}&B;U=g7Y&^)0~FBIvev1(prPVZz6sYj7ZP*V*uaV5g+$r@Ck7x%zJoS=lt
z5EM(M!jwoS7>G=wEM@S3XA#*JWNXS*QwzWinUPZ1gvTSz0A`(O-awknFcfAY7jp_I
zyqFuD=6USw@aE46N6tL1Y0LvoyC$Frfu+<K4!j^^eirkXqO#Ai0epdX>2OiW*vNnZ
z*Wf`h6b*{ug(z6%7>R}m7S6$rOh>X?RZ-P3V^mf=Ry2cJv9pH$#8zr@g~h+EE4r3_
z*OMapfj{#X?e6Ut?90h&dEuES36gm2Ti$N>Jn(_!t~g2Kny1*+v-a!%?C+;|)#td{
zcqGNb0N}vJ{H?Uz`_LnHJGu7&pNCZjm*3^<_a=cb-kEdNj0rKUJ2#(CtI4Uo`Q7ig
zr@#FTy8qt&gFm)77a$MBB!1)P{~jOaV{d=A{per*oA%c4`vLpr7d~TGuHVN#fo7Z}
z;d3nss3Ohvt>>TNbpV4P8T#2L9$&Z>_fueTr;u8>mU<|!<zvgetXm(wtgoFrdtPf{
zi*AVh+G>RKlCTcFTRJ})y4qiEAhcb%d2O>@O7951-;-N6ZIrwT^XZvfh5l|#PEUj?
zOz+{{o6oJZ1EmK`gSlVU-fzp0w%o+(A%a4p$DX3t&<lbwN-9;zHn@@?k5EAu{~meO
z-kkZAD!W9BCJN=;;BLuoQR`uFvF$(wESkBRhqXl?S;m@GK*1rFRZ-bwv;^pmV~9hL
zZM^8^OlUw=2^PZ;Euc*CGz9oDzIjya2UgpB>bXh>Ng$s}QK5217GYsTr+PA49TT{1
zE%18E<+|bLlhDSqY^=q~0X1T|P!ct)BvkRh5(KW*B3XR^kAPy2AdobnOrkE7&^%&(
zS498?t-(x+4F&^kkXivF09wSkD5(onWENz_5{;RZ7wD##U`$X+Nkn7q%HKJPMd!u5
zF4bd{H#5k9sa1xiL6D9{DxWn~FjL4;C#zu9=OQP;Z-D_K-b52QuSFhN%X}<7cR^-e
z#uZDJ%+MjVX+^6EIT0vFFpMR|0o$o7=O8QPpAB*gVr5c$2D%VG(c$#sJgjmR9>a<P
z{^fJ8_W6t7_IuZMl9W%8ES2|tNb#-jB-h^c<PLn*8{T41eDiDe#ZP{WD8M%)E9{4V
z`mfq6U-u@ve9yf^82)Z@<$eA0pR#A4{7(ANPwhh~?gaM>;$Y7|`GmdsUGKN|{m7r8
zK!9s;eN=Rd#<-%?prmg+{e*qu!@pwRo0Qeh{?GomyaWNxW*a1h_!s`x|B6cIvmgB}
zJ4`OgD*X;%N12rDPyXD0X7@k*sQubM`tR(<Gf&x1{l|Zs*Zt-{`~NV1=T9X?jTpzj
z{(JxT6i0i(cF2;JV|ywuvkmLR`dquwXVYu@^{qlP+Fn(9`&nn(mPIYfYiVasUAlE^
zwemU|?)nDmvZNp`l6#P~?oRI7B)t=Oe{(?M)BD=g+%r3m0U~|m{#U$)@AQo)AGdwR
zxiaQ$6A|3ChX6eYZ3m4@FVH15uEqF38mLO8>T5^NfdHXeAkEIxbt;bq!P0_kg6x{P
zOA%H<4gy*#!{lljHVo}>uhn+>av{D#STdE0I*v&9q)N!sY4GtFQHc<~$jb_&+`Q&u
z5~7NlAzoHw$%aS@Vb-7oD<P$4)0vc>!@tWZo)cVbCC8JyR*zn~#GfRM2@(+(vQR2_
zC#rI=UVh5X+L`5HRG89?kO+NvIIwZlHw`{Ty5WfS253VJ6ip5;aSLT+((fdV>uT~x
zV!UO@bfb7Sg{-s+m6p?eqNds5LBYCcC&xldmX7{p!Zl?6TudHHGmx@22jP*SKK<N2
zn@hjcfl&UEzYFAnv<18)VEh0z7mJ0y{=S3%3NbBMUF7%;!SVe<t3-bjGxyVCr2<oN
z7M$gx0Ion$zZUEAH~@=Z(=<oCjOCvJTcsN?oUe*%wcliG)2oPw4>R7s{ySK$q`Q8{
z!&mL=Pv1O$<M-UAlQX;V?9&8P-21?T_RuR|O*s4GU;naw^w<BDeeJV<nBrg0+Vf9+
zH(6j0*@KV1%0@|XeCA`nW54su|17<1X9Q7PyZ-^Zde8l70?+IlU;J!ZrM{5jVfWdk
z<a)gE%+rh&zyd>i$m1G~j~E+6o)|P2a>syJ{N@)wZ8x8PmKGb(jn6#s$M$$~OTO^b
zllHo#EI<9bA12u2X0o0hc;uD#vRAw+Sy1=dmp<`P`^0bjvfX_4DSPC#Z%7ZZvafyS
zlMK2)kYaSF$Aa)<itf4p!DK-`mD>GcTJ=rZ<VNQfR(=cnT^F_-+p%4w->~JRe)qV2
z3tP?%I}YsoruLqro(%(~IyyK?EAIi75EgJ%TJ&JyME7BetDdGf?dhG{=aBLAy^Rhp
z*}Z8|1Vwjt_qOeSC*9-4uUEz+yPg(ezx$nA_WqY2(1PIV+hD1P@ODlioi#GsvSf1P
z)^H0Ng|?U^9OZ0Ec!diK#UY`Kr*mmXCmI(?Q6`cER^5f05;;gy#7-&-Llk-xN9)4N
zMRyiUffQnqKt2(a);Pu6=;o(D)3~7YW`Nt9>P|r{kJ5NRvjk{9?g`__gukLfD2B;8
zI-;Xf`AnJUl$495cwH8nSe3i*Q2Up$EWz|ehAv=9<(3Z_DN1qs#ko15L?FAxlo*Aa
z<z!gG1o5r1UgT}fN`-L**VhD2@qE%#03sYoWdKxENonQjMyF?WQd+s_wF=Uu(@hy&
zi89eVh<!*2-O?#dJ{A<(SyF7^ubowb?B@;$#KHjY1-y0`D{>L(mPN?vXWn?P%D!YO
zV?ql2OeBjUM+8+r?m^^?xM}#HiK)jmg->i0F8>UbDgg~m$EWF<ah5IYCMqx72$T0J
zT2^@Qw8(=J`q0i3$EBU58~M3+y~2L=GvBZ#-K39|)%pRY4FC*SFHmNuY4r)KaQU;u
z#A1bteK=?RlO1rCS}7qoMyG<x>Eej>($af}5Pj&;*VteBFaCE_I=}Uc|CqpyANUJ@
z*&ch#JMHiMZ~ik{dCdj@NSWROSX}28s#_<X&&6zgx9%u^l&{caW$v7pe*5FrYgUe3
zP=Rf8+4UZ4uodg%rBGlxH+Jmryr4(>v0q#3$1ko+Hrra>m);|=YTW<mYwf9Td?hKh
zo1N$O{Swy~7cakd*<SnLL-v3A$T#hO{?2PQNdje<R_lm$9pvKs!+FCb2(kLVi}LmZ
zF*6*pilg$b$YmM<ipYs-o6H;fD6qb(yTc<<6v5+3VVK$hRS@J0VAazSt~qev2{wQA
zV3^vHD-LBl;0i>HX*iI(4zVf-Rw}L{5N&rnli~%e9LyVMuo#oF!oH{Pq_L;_$kKSh
zLx{K!^1RSC+5>IgC@n0Gos<^~e^da5>lAVrZa;uCAR7sqKpY71a#T%5&Q+#+V!Y0Y
z3Sel=Pis2@c!K<iwVl)+H!>;h!YzeNr0xr)$A3`}*indJeGg<rs^x8iKCqhdewZfu
z+0%&~rGG<m6%LOYLq|#7WW9g|3&{^cURZPrRPkBOJRb|8sDfzqG?#8^AEo)b;x)(a
zu)1<!xtZg1-Dy-wtRYKkfsq)Km`q$U9(yu`%x}4GPJ<>8vz0mBJ*=sNAy9*JauME5
z4qFiHj?xP;31zzRWIl#`!A+>7X0iOT7FSifyUD3X%={eWO;pObYxxlNRbGu81E}Hb
z^mu9Sstbupa7kgUU)OA~q*gve`kU*WBV2FiPO{cM|MB0kAO4F!XaDj4`v1Uvh*f>!
z!~ceG`{fOwj^&mqLZhwpQ7^M@`15LLDYnVDF85jc{@w1w#dWPdz1=RvZ7#dsV~wl-
zZgV4c4720hcB10W`EVEJ`qnn5%WZ9*V;jep*GBCB0yo%ph=7T-h=P?qIl0q%?)f#L
zqqQDGaHTUXwfcsoGdWITdaPCcQCh`AIfW!7u8ndc+lql|_Mttx15NotqGgJF=_(er
z%?YcAMNp&Su}QEXW(DN{1Rhv>8u}oCqlH+TCiw-o6q(DT7=MZe`RHS%H3HWw%mtwK
z2C7X6nMH&iWZiV0+E*NGfcL;F%vV#zcrqfj70*Kc5=)+7A)ooP^zt6jT~ttB2Zb1R
zpv-VDN6z|@gQ^NjGzn_d@+xNO{txoxa-GvWyH;R9kX(Orr7zLqbJrmB`$}GJ6iIPN
zavMb_0oT8po<;7oQ#FcFPCe})-SKt88U-qW7Y)zmAcJu;C;A*-IONcR;UjnUkA{j1
zZ$m~)EX`Gt^C)L^I1p$CF3`IyAX(V8<bFJzly-~xV#(4>4`LK$6&B3i;tNoTf+#qM
zKk8$Jf+;-99e0pN3CrZ3O@p4RzE)Z_<Vk6fZ8(kaQkFaV!_&+|Lv17xKu$@*Rs&h&
z$qrvvE_n4)#kgBZZ4;!e=WU4<ggx8ulnXJ~wxpPo<bwH~U;26b!pDD?@O;E05UYCT
zyWd_|QM<>oML{l|*k^wBz4u*ht_a|kllLFf`Mqu%leHa-E!XVv{8!Hji~shzw&UJc
zhY;3|^q-%_?`=09*WbyObJh;wo4%W3qKJhpS2)<!|Ed~`JFnw+4HDh72rjUSo>X@2
z3S@^@p<q>GV|jO=;sARW@X?uf1T|wrlS+%U!mI0oy!C)eMFO7*!t*BSmO{>sOA#Xg
zzI~YDT|n%G6u>&2shT^h3|F$G<oXNF<En5*lMhAm+*$&64%cL*oUHNDFtwffJc&dq
z5^OR9C6wHnklQTxWX3q!VC?=Vw}6_yh|oqqa7E546;uQxzN$wNxya;gSW4-69fVx@
zZ2+?z70IiV#y*td6-vSuj6_g0h_NANHXe##Ld83c3Y&TA0I%R&lj1FtLdJYS`P@zq
z=Tfp3SrsIW=gvgT7gvXo)*n-!g7Z9@ygy?vN1|0lBzhfb4+n+7I5$zE1&-FJoVwFA
z?h&vTh)V)IScAkkS>fsOyRhIuh&w6@zPM93K|{t>4U`b%@8MuTA2Vxqd5tbW9)abA
zsW(a5eUP*-&`NpIwr~|*u5wn#EWEx<<KE(<%QPv?TU<NzmB0>%i>e^p>ZcG}K7zLW
z+Z0V7fxF(u@^!leXWR8{8-N#3RQTCP5cgJIEp4^6chUa#YV##lUc0U_+hLh?Jgh!r
zGHd5b+@?6&4{Wx(uDsTd?%ZOJuD9GISM;+<5|Z0Vr@OjtzVKbosUfO`&6Fo8JaokJ
zXk?VCr>Cf`RWb-t%mpDwn^Zi(Irp;MlZ}<*h5ZL(mfoe}VVx>iH=gT6-~j^qP;yE5
z-kF)p8&M>cr!#_CB4tx@M-7zc6;ix|3CqC?Ci>0RwPI0WAnANW0zi~6NeXdND(nCd
zgo)t;ie`8z{nSIdbv8>fF$wHpWHK`?bCw9Hr3^Ebd|^J7$$C6HH7505xomVr-Z(Z{
zf&-7=rJpO8a(n)TnN@c&8R`GSK*M6@MLIe3G+ze?1+C8s-KNSDL#`HJ@8l!|w0$Nk
z7FG&c$9&{LZdUTHrt^-IA{)|Gn_^Y9szU>)aVaUyCNy-K?hlE>hiUA0PiA&j3)P56
z2DdFn&*Wl|_97M-<SV{?Qc^+RsS7R^U=0FEIB^o>15jlVe^R+$G6b(F<w3smf=sAf
zN-CXst>Q0}BzO;#f0O)PF!AuBr5EK4tjo>_uOw!fjJ206%?c@|lbIaRpo1C(@O%xZ
zz)q`@nwUt#*!_|0`iPoOsO?x-@vp?a+vu~c%ZF`3ao=OBW9v{}TP#bn{rh_{7DDv@
zgqK8lneD@Z(bnE-YqqzADv@_Snzr_LDX{kQy5GsxarfLduHE(lg^TwU*REQgpEgB|
zgyYLdXeB5s$(*zRhSde=`e+mwgTi7N=t9vg`MXY6Q%z-rCqepLAkipnWz7hEmn^O%
z$Sxlia`7R46LUen%Q+PQVnyKB1K0u}fGJt&E2jA{wlzvZco@7Em(YwD1t9sfc=F7-
z6E&;>d0CU-O$z7=kc)6nj)5{vN+Fi4x?I9#7=X6U2_^xsgQz*MO%$?DN~d3%mpOCC
z!T~I^<i>?!zX{_&tQU8ak~+AodRn)VyEPvpgacP0thtiP8!-8XC>`;$+qY-TE5m(3
z!H_&Sjb(P$qym7z7nD&784(o@@E+q`Fk}i=z8|IWoSjT;kj!Gl-=+q>MH1R3SMyAW
zN-PxM;-ghnHxFJMkl-Z*k~H}-$7znnhZ(^yhqROnyK!2k@Kc({w4k|^;*WP3V+7q)
zvd~8?^qDiTIIHJEvbYAXNCue{7PzSLoRE1eAJ8F`*4Pu}#sD-R8!TC1ci{pchSls!
zKtkCpwTt#L&qNno9-xLfBZE?yQc@}fS9z{N%r~v7T}o^HL)yoh>DyMn>o-^CyA<la
z$F{9<7s{)n(HEyImw$^p+w0TrdaJvx+jVW9XS91>w{MO5>{4K%t*v#dXsx4Vk-uwE
zwS3KfW8U1_l=%Aj7gLz+z6$&XBjt8d8kffzU29qTxqKwB0pjcs=txK=7y}A`S+JQ<
z%Sd8n6=B7L25x!GrX?ZbP)dV?0U__FQJx%tJOF=3&8wT~qKA^O47pf;4pZB=j%P|J
zPUm8=4IMH`LRC=tz*rRv>r&chN#G(&xuj4=z8MpSL(OM;U%Dr_Iu8!AWSOKvCgJ<k
z^Cg+;;UWbX1s$Biw}%Bj7}cS);Z7`~STyF!k2-*HkYZ+|xmZI6$P1f;LaDI3r_<Co
z(3(Y3x=8`Xxs-Mq&p}c!lVoTd9g4kZnzZr3rJVD5R(cGIRD6+a6i68$j)ADnoM=Ie
zb>JL@P|nN|GoUf&iU*F9LID>e#+f{BQ0Qg4an#Pjd|k_xkd0*JVWw1tSuJ)97%Yg(
zK_ML@c9ovbrGaRHp?l!M1ThA@aWCAN+F^R8*OIk3sWKuZip+Buau!%q%@rt;i7BTF
z6^;=gg-elW!wkf@IRlY6J~=+2lziEEoF-0z#@sW@p*f+S;LB_h1^N0S?;u1kwe55&
z$i1lij4Z5u0Q)Jez8}^;wXxc)D6`$daUa3B>zH+pVT&cyA$=|~j?Mk&^S4uYM%$Tl
z)lZph7wp~FZ8>LcWwOB@wsUJ=JnY=IT4Md~v+eu1n38FEUlu#tN728Z)wdRH%>tB3
zO_ba;egBuB0A_+k!zwyV68rQFrRWRs`?<|EkIK=?Jl+IWRK>=Ui*KBZaXbm`x-fCA
z5+`2S%`zhkMv+`ohp>vEP?AgPo+NzloRpsI8`ypUlpCxnR+x9<S+G@rCTXq^$fcwZ
zPUot4ILt-<JAf+-xkmFOOOvv?m3)$;6!V(TRBIz2NKpbtev&MT(J(UB1n>zxS9QIJ
zb-}d>D-fU$R7#GslGY`>lZS+yC*giLO8YAt90I6P8oay*V8=Ls+p^+|eRo=M{1E!b
z?h-v1A;u-9cJwzPMW3D#A#?CgrvC3H#SCT;Aj6T6efcOEIfgjf&?c$v({y~CshS6g
zl3Cd!>4`&eK7wuJ_6#LTQjBVpd#o|ia)h3_g8Z-a+l|vXK_9354rQ6a^M=LD*%@5Q
zMe^n)i!Y7;ka=HezAzp0sH9=I?uN|IQqeP(R1VpqswE4QrSm|8PlDZaLQG31n2(B6
z8I#*catVWKk(FL5=fH$)Av_f~>*$?^gtE#6-sr5ywdb}=aP_I}6t?``>@#cYCoEml
zz9R3_XP@I;3T$I+YtpTI?E5OO=2&dmyLxe4I(QMQ@BF$=Vc0cZvmSFATP`x&;NR<R
zzkLzZp$EDe*|=sG%Y0XJ7x{czuiK&#`^@di$^QHaLh{7h;ZV?Wz}PPz=5{m1fUYKM
z2}r&>lZpipN4XHm{E{G>;0*#|4N&wDSPKhniI%RSTN<$|ruiV}D2d<8K<h=J))>1_
z$^)^cDw#~#bSmnoB)8Dlkd=hf>V77Ll}R5Fq&7xeC%DJU1mGYO2lB#dA+G0yl*_Yp
zmMk+=>%DwAqj0YXj1cV+xfTaPZ^MEl&6H5%iv61t+CsU^l=}n*3@q%Ap#b4NL!K4E
zG)h3D-^!~ZLm^!riJ%w2l{(5|EWAt=3=g0?X#tN!Fu^)xa0{Ba6!Th0OOgUZv8H)r
zb>pd?2$UD}LYe0*&q6srubIe=`5g^{$c&?0jZCf%A}9u8aFBVrLXg6S@dBU-`4iK=
zYnMiLmO@KI675Ryoh4;ml%(DecNGktGIN#;tC?p-4{1>H9AK!-U4qF62xAZk1DVlx
zgA^AuHt3yL_s3wl;i(U(3^l>3$AVliOcZPKSj|bqN@~>M+S>YY?f72yRRp`*Gutj$
zxoBCjZbGZ_vMp`x8gtvVT|%^V%uAj0S5n*eub*SKT~II1*;C4PDbH>3uf2q9%Z2PS
z>^iL-HgA2$(K4~?OMzYOcQv)`eY1}9+77N<+p1`{Zw-Yu+)oINXHivk;qHTcfNZE7
zbaDUHA!AOXO!GRcrTxHjD7rY~Lm?s#K!8wtrFH=vj*}&oA|Q7CP_Zx3BW095$4EL(
z=N=X*W;AmJm*f^=Y5<xsw+V#XL_muZk;%qM>6`{xLly14nl7&fEl8Ib*+4SJZKe}<
zH)aAR<U=I}XM?aPG>HW0xTH*Qx2g#iRT3(-KX!1)ZNTS!m4z4*=IhpJWs{@?0CE^x
z#RTh7A(r{GB&?6}+N*8|{ywjSE^LyyFkiPP%<fkHRuD7CkoChvu|>W?7KDsMU>=}c
zPMXgX6OB{hv{-o(;3xAzI=7_dmXVrCbX811MhuhgSkZNXoMM~_>W^m)%j@W9OrsCU
z(p(r=;FzuSFFYAa1vD%XHmtk`vvJON6^I)LPMKfP&uL61gZmHfUPcW%w^5pyQ&62m
zWqyy7ja*lAedM(!7N(*iSW!wUQx&m6%sn`0#ODuk5&Gk0u543bt^eLv2<^6t;@%d}
zehP69_Vu-WX8S8%?b~c^n+4WbLVcBJ`}j7kgI*R--0XY5`CaY5j{;ji-e<lWz|eLD
zwp)4Wyv=Rls@u`N&b?S4J-X=KW?Rl)uTk-n&&jSch9E1zpQi-dtI6Gm6*aj20E@qJ
zc|_zMXwl|~IYlY0%x6Gcc$$^k%YPt>0uK@x9jXILXkg`2ENe(B4l)TSwRsZwcaj9Z
zoXo7-$Ei`c(2^26%^Z=)0*Q*lGhr5|6snm8_J#wd{tRf1u)Y|{f1|T?)I>L8A&*4n
z!Y2$$Vn&x5TyTM9MWTv<iQpWD0J9M?LdBW4n-!wI0+KRG@UeTpu$?4#D%_vpK#+6f
zi`8L3*CIqZP<@PB1+NA@uL;heS2FYJ#-^gdQ0f53L{Bj=r`AHMRLGTA%Xc4PAjoqp
zGQ4^<6wURcK~h@tq*O|lH5m<%W>5;bNsve+1=gfi377-NNu1EmLB3i}1m`5h?hw-?
z$%83D8dO>(a2V9*q`(5PWodV-8Bv5_FVEdts>wN(d7@v<#9$C`BJjrC>{_d%z-(q=
z{AVDHOgD;($QWGaAPnSG#PlZ4orG5_C9PCQ_mnx6OC`d}J|EV$k7Vnrd*jR9T@t>l
z|FGrY`6^u&&@LgqOG)f|-T4-5U72*P_|L~|z1!a$-)etmJrqMr-xpI}=RI5$fw;5Z
z7Dc;yec1SIuYP-I(d9n2oVK;Ei(J>%M)SwwRo}WPi5@Fy0vhl)WD20^xyT9d4qUpN
zVlpT5WC^GiR-DyTB9KKu&XcdssesB#Z0b;46HpNq;@ktA97<{Ku_s9X%RoO@C^4Ut
z&=mq2bix29KunXRJjuhM12tqFnh0~D2nb{|#^Rt{head+4U7^H?I)<^1pvY*5bekc
z!9%&|N@N=3g7E_+F=w)vTYK|LOc~ZxPBtY;1G$)#4P2?Q08~FvLEbupY_3$k1RlI}
zE#gmSX=3iAxX@7{AjIV~Pq64tDu6gl)?aY8cErbmTZxd>xqN0oR|c<Qfv^t?f2Msn
z2bDB22d9%c6(PK4C+XN_fJV~X$1)>D7OZHLsS!y=P(3r}TRes_24o>pFq&eKURw>o
zloPlghXRsdNJvtjPNvB^F6fS}ow?sg3WAC9ENN`e{xVZba!RoT36LXDL`}9jOgU(O
z%jh2DB%5**re5Wk<q1%i3pH^_rfZylJSj1<F}q8WJY{|@YkYNmAU(HjA0`DvtMby(
zzE;PsV>}-BQv@&OnAxVy)A#(9V;y5&-}ad&+o$iPgMF1|dwbg#4BM{lt7v(=bAX$6
zQKM43wvF?5PU>chVQY)F^Juf|xR5f8-SZI_|BZAX0kQyECh*UdWPhksR}1UxO27;X
zd0`-u%PX*P0{m(zGsaB{CH8^{LHw#(Y!93V@pe*xumAw1#+hJG4<4Gps=k_uWC7I`
z0RKjr`;t^nkxHU2MVc_o<Y_|V2N*}43*E@oH;p<j=ucA{hb2HKM&S!qB3O@LwLlCF
zuEI$rw;f>rss|?JgSnYig4oMNDr%%0$iGbduSh#0Q--G#oSv3;PqKF4dj%2?pb><C
zSmGWuQ0bfluQCQj6udk!oM&LGuV}UgXT3-JQgB5OWS%b0ps*2LhyY|9=q-T@6*0Xk
z#V7Mj@*i>@tRqvAJ_!Wkz6d3F8?9B$|4Gst2oHg+V_wP<yLL3>{W04ws#<pCOeUJs
z^v+be9r`izOqx=(EE&zqN{a#oDT9&$2hNX&Nn{bYT8i!xD~byF1ENM~&oPSHB{T6P
z4eEs4g)--Hexn1chHKC3Q)MeJ`itAP39YWx`bDg-tz(F`RL?6e{dc>C)pmSefpUI+
zBaSwYo3->4ZD;JM?b`Ew?ftcnt!4iOBxn1)ozMGAwJ6v)zSMEQIqT<6T%6zIS!`Tm
z%g=pzZ~yCeD(|lA<7%&AZGp%Ycu=4nzaW?D+JTfnnH6-8%~;-E?zfEK2U#kJg|G~U
z894^YtWk-%0l*2k;O1o{&<pbG*2FzQr7SyGX^>yYshUiZTMGGNNqC}MMov0&v@Z@-
z^3meG$(756+km266v1^14GI9s%$f6vqHG8d?{F1@z5xP1i$dK2kdQmSA%rv*>tNRa
zkYY%^EGq<kpXFX~7wqa#9;N7$Adg{r93|O0M}fyd?v;zhq5)UpU84DbMF^z2%H0)7
zwhL4B57zgh4vPd~h_E*js$RL`Qw=S|0=>jZnx~QTQIWMC0loCRPT`7ms|lnOp#k*;
zy#vS*25lB|#V8sODiWO)%ei>L;xV}imAi*?AGk8GXOfAA;-9#Kk}H*5luz(;PW*+U
zcJu%tZW3-kSWP2V)QqGZA)QK4RpUS;3@ox-rJ}u3r?~=z5~{rJ7R=It=>g*fq|y|1
zF;^9^k4a17X0o@^>qFbMN^BLfJ64Bn0@>QyvE3i`d0(pny^lrlVlBXK0dzi=*6Vr-
z%<eH>TzM@HHvcT0)JKSJKJUgdi5FK;wtEcg6inT1g~fmSY<-`_Y9GsE*k6IQwPh=9
z_B%hWJY=!u5YC;n4pSt6tb;W08h{YKaMJ-;a3=|>QF4hLKq)bhAGqS4co+liDkLFR
z4g5{p0t_179|~w@9@OFDJ1MG?z=(n<=<#Sk;msT}`nGbe{$~Uzm{ZlMxFi?(G4l!+
zftJEx#K=6|jU*LH<2{{ZtcDzu7CIO!$7!DS15L+r^#dtf3o3NU0*iD_qV`s7ip&e1
z4x-^&po&XDOKVuEXUwaWMFZw`A{J}8_j1JGk^o0CG>LVg@S=(Y!!3utSY8H;2=Q>)
zG>AO|_dKaX<5;88MvQTSB9Swd98qOz!Ri_IfuhClEJP{m7Gs0boX5=Tj48&)*cs*^
z4-4jcB%ecx1G$(ywW>T)VPT;p=DM8Iep4+<SjZOWr<@Y?SJHH5!8Wh(IizZ<h1UlI
zGAnpiq-~0Bx~m>%O@689lf=f0KsY^K9+>*0pc@FLdNH!Hg6hb)DG3OrfS{Wn!Zt<H
zwo1hKU;T!++8_mGpZd<XNpRb=bMMO@vIk%ODtqqf@3Q7rn?P^Qef>M$ZQu7JKV?7v
z-~3-}Hl2uf(Yh>+%?)*s9(nca?A3328()AYzx6fy+UGyTLVgz7g*QkgU-$NRv$V;0
zd}w!Wy<p$?!l&%U(@!yRa9`!sjP9aJuaBS#O$i39uDs??qrO&K+ug^;zPNU5Z9x5%
zQCL#d+b!N*3yQ7h_+)NBFRUzK`Ye80n%GN;tUiyH=8#`?`KrxlXDph!>zS#={Wd7z
zky}Ts3|uH@ltl(ht+YouR{p*(lfZ&S0+${52GIy<fB=y$Rp8L;dZ^5M5Imm119#bB
z%y0!lc@S1^vPueZD=_9x`8O~EDk_FIq!jR^N*0O?MD^9pvjZ$0v3{^~m{$_cWC6tz
zoQ#5!pPfb)as-Be1>|QQ<BLMuQBGoiF1B5iE<$M%Vj`eCOEDVFpxDxQE+H(FE2Ki!
z4kY_ldW$f&gFMixgH;LzJa7dB8BS{knkM&RzO*WHDk6X>234@!q4kF&SWt@Vm6Y#d
z9La*0rt)$uQ0^!}12-tff;lUkpAcxy+7r1;%RHYmve58+t_sLwCqSMg<p(DCxyelm
z1S5-3;;&lOM)3R!6by^WJSW<P@OQCSOzV;b(8fgioqy)w2~(BhYQZ~&_?9YY<}@W)
z7!pbd#F;_WGFflN8Hz=`IF~8r`*1gf^x$Gu+@+j)e<0~$yz>J;WQRvb_OXBauc^42
zb{>56)%L-k_-Xs}M}L!wYx6@qS6;7p&Fk$0Kk*mr7yj;l&C0M18E)Ih+a{<UechYv
zM}PL`?Am?z6LR~`KlMZQTmSN(*dPA(uP=N->&dx4^0R-#-uj;RQ;0CfZZNdxKKLW{
zumApkYfpXq8yZJTU$!)k{S{mHv2E8h+u@aK_SW}(&>nsLTkK!|y}!e{PR+F%=k`^9
zmjVktPTr+RHrokH*R?CLUKZAl<Ne!ORjAv~U2S+*u35_^o!j{6lKtf0`Y&0J>%;&3
z|I<!cm#eG&*xKH%xuWHSWL&J?VF*=Pc^B^T5)|5~44|wKtD@kBAd5;s9k}o#$+yXK
zGbqGh0ihf#Sz@eT4&{OxRB(5t?+*#j2V%6PykSyolrrN}NCOyq-7J=uFM{fT&0uk8
zfu<4{frT(Z!8CB!)-adb3w>2cyk$9)NLODIE*KJ$Z(NDYAh@AqNn##(pHQZ-dXOuN
z1mujyg2scy?E=Lt;hr-QM*ti#D248W`;J_*um+RD;G&>H4p~J|%YbdF{ubS?QOd57
z+4#ZS<My#{Fp#Tr!Z=_?fJMDT+f=jOV#eHF@kXeqCn|<O*`R82<tR{s?*Q;~<Aw%+
zgKC(<5L9fKrDf7wgA!{}X9TXqG>*H|nOzwc1P5k-MxI4Y9u!prajk=1CP5-oz%F%o
zcRr_Ym6j1!CNX+)ULh1pP#NgT1oD9CSGxI1(-N!jDmse>^1-y6s7YDuT0AUUGyAUP
z);^$g57+O1S^9a<Mh6Eg$HoUo_P`@AXEDg-^P!Bhys1d6{xcLv>+sVc=c8eCUf!C&
z2g8v)l$7K{uY8St^)r89AODSCVKK|Mz3)F*9;y39)dz&fhkp96*yVe!+rR(ipSOSW
z5C5)x^|OCquYTj(>}}uoAJ|otW^d`sI>tbEKv8s@rQE#pd-kC${lVkDNNM{aBXluH
zFWtZ%e$5;0?SJY+=^l<c$D?`eezt9Mx&E{5+OBiDuhn?YuiYHquKrt(#oc3!tz+3d
zckAXS#g?C5leV<!J&E?NAO9Kq(VzRz)57T*tq^N%DwuW5Rp(HnTu?&#84+mm(3tZ9
z3TX^x^)o@zk|)O~1X;{B3R(`g*<F;rFBO6q4&=)LB93f40DP2+!xPwyG@R5Psw_h&
zqcl9B<{^;b!D=n55bFV`Y{+EfAf;K=98Xnxk~3ND0y+DjfKEuqBpC_|0#bN16w46M
zfT(ml9?O~>kO93S7a}YYLL!0+SYjSnfY-#JL7`3soe^2bT2#4eUqPXQX#(;Ua`SYi
z#9cVS8p<UQK-^|25^*cCzu<I!;0XlX66#~cjQ0e~6|t<tT+bF(59z0v)UDKoEd9>s
z01J&Zx^gKduvOH;KOjHvG_{42C#Q2~z0VZ?8ZJOCdP_1#u+s{yM44q&U{ahU6OM9A
zCSl4j)r_v>AZ{q!eC{g{LNd*(Z)U1RQ@Ul)1fXQ5)(g-^qvV)f?F_<5$OB;|Vqvlx
zRj0-m8;c+=-rJ_CX=uJc+v|JVxovMJ*p;Lt-t;~1Wwm1b{p25i-M;*(PuLXH%uCzB
z(Pex05B_O8xqHVhU%SUHU%4l_@ow0+zw(82%{Nx64o5Y;P<$^u{iHqdjXz4((v0rI
z^)WR6Ub}ujmD4xB_!;~3@BSv;gwG|b5Z6rMzDX1IhBVgk;U)Xlmp{iU%~#U-uX)Qm
zS?Ts`pZ#RAC|_f*e8XE<9r^nG53%a)v&mih)zADs>wLZZwXe6=z2iM;-?vm%IX$;$
zzx&7br9b!x?-{G1m%ZZEJa+#hk0v27qow!6H@|APpMTa~{@5G&1EqG9tU|;vZ@=(-
zvbNrw#&u-x|EZs~uYLOC_O+y}x6S*~Ol>@`U9P&&=fu6Xu-1N?-T%^WUDn|F(U++0
z9&<H0Ikw;bm49kS*Y34<{LoL?aeBA^@YjDaJ=<sbj&yIUbG6=8T>L9V0^xQr$~;F0
z?yp*4u3=O4SJprP-BIBS!(8$Kx`7}Gi-fJi%3;W%lA_9SO|H@<Y~KXojxMKg&3xdL
zc5t~RK?v)ks2ng7JXfn$ITTtL(aSMK-9vCTA(W+p>xz)>Osp9Yz_3%mR|r`;NcW^d
zlr^oo%9E~9urc?7y=YKO_CoHn>Qxmzr%Ev?hG;55)n`<k85KTiW#Qhl+Upu-N-Gjr
zFmr24mMJg^!E2JKfUg&t3=YyWG3H~81gqd)9JR?|A{IsRUL}mr6yj20%UslbnOm`?
zsRT?(iY_sh;GN*yn&iD|Cd1Ups7$LU%R0+c^AS0~h(*rG&@o8;l~m{j;E;o$U?BJh
zm0g|oRjxSV`6sMW*>Rz4JVZr1y;dkogpnpcE4C@kT2)kL_H|UsduUAK7#HQKvk=Z#
ziY+gF*S70>gareI1gobx@A?BTqqT(Xa<aPK|D%64DWo4wis6(EzVrP*VD~@#sQtTt
z_V-u%!MQ*B7ymlrOeeQ*(e%Z>C*Scd`|vOPBm34@KELvTm&r=K@!ZoaWcj^6@T2zX
zH@}@v`j0;Uhe`2WXFI2N?=0Hq9HwjF3cQjO*qh(;{YhDT-EQA_&VJ`#{XCV*-CH;9
zgMa3KWcNMv2n7lh*R}f|u=jlECvBFFLpeV7_IKHz{!4#@wZ2e5GfVgSjt_ju?tS>>
z_R)X+3-<bVzSn-@um4Z%@jv<!`+^1f&JPZ4l$6frKlWS6LOrw({`tRTuXyZDbX8)m
z-u#{q*cU$j@9mSn`78FyWc~f%PybbZ(07w!ec|aR_(5E`_dcHcvJ^jjD#h};1Xv$I
zy_fQ8X{zh`j?+8N+fJn0eVw=8v$O8@n%;NWX4~6d|Dy}&fs#9a{N>NuhyUUK!#?y^
z|5N+GPyhAw{am(>{^CDK@7gnqcRRL@W%W6B-8$=8Azo2y1&=&Xy3!D1kC`eBCt;P(
z1&<!*D!)-iSzWbTD1%xsc8<Feg9CsE%r`>3%5M^`yWBlOi2IPC2YF5&^MR1QGzzTy
zHK_zn03pJJIi(qy9;#ddI67znN(gO&8C~woKno2qyAl@6Oi*xGbzlWKokZ5RLNE<h
zV^%dDs>ouEp_X-bI8vfB+@xCMM^+7nMKYx!mN97=F3|xixkQc;l{;W9At*NUn9?vR
z{)8j|%*Cuy+7Zcu;qxk#KTCIO?aHQ-f+GXJDM1-H2e<+!j7df+9so*U$>na{!o?X`
zky$AXxW}n0xGKmMC<U1*FV7UWBJ+O`T2jCZFE^70G4e$PiQWPAM{+VPuN*NhpidMS
z!-FUM(o_bTLbTQkSeq;-45V=MAzz^2(0J-iHyLq*(DLc+%46_Ask33ka|Zg{Gs*EH
za8+T(7rNT<NyZ)f)~|l>6|c1S|LH%=m{GIAeK<_^JKpX49(uWb@F)Mg-A#(<qrdjA
z2<G_V<f{9zpZ)9hkzf7Am9_~79Uml1=C=L8Z~t3+>hW*cJHG!1?5*#8zdiQ0?@51u
zGg&lu7w1E19;6?%`N}uEmn+&&{?5OnrS$$3H#@$4(?0rdesN{IH=cVYDXD*MuTRS7
zLqGE$QTaeYJ&_c_7e4V30z`^rHbc2IE<h*^^iey&1{N0FlrKE<q<!>Peu33(Kk!q3
z(cYI7^jALld%PAF9IU8M{?@N1_vK~#@xS)B(mDU3efR5Mwntv`27A-H-*4ai!l&&s
zANg=P_rN~*=l+ttHMuIEOjZ~A9Sm{(*X$!n5#CD58GXL|wQsb8cV4pJ`_+G8-~Gmy
z7tf}D{Akq*>!Z9@+F0Ast|+%$-*HZ8xq}`COsmpZY+<`?wM)78Rlu#|ifh-dHSqXX
zK9`i&e`|m3fB#?GyZ`i0+Y?{^l6~PLztLH*YjZ4{*6Qk9!*!QY=#w%j9RzCz&bgZe
z^^rr}C#bY;5_<IXcmqRv27|0OV_qzUFXdAvRtUz?Pzx&wa|&!oHW#9B{SnB)b|DKh
z!sz)-TrsF-rD8h(Mxd=hE|v$t=+Ok+e<&?KV)+$8x(QE5NfyX77)3Mj`H{O8v`#bh
zpXA?2mdK#ey+ESVVuF$h`liRh=zgpmf)8a20e=LoWEE>Ej;6|GI~W*if;I6lv`JTL
zA!Grw*n(S(eD@UBs-3_XN8rMR<&@{{Z-^@731wO&B|Xm^q!NvJb}&+aiJ4%`K2FGc
z#06>fIVeL_kQFP0ZU|1aTSb-6B2S?w91~fH{ifI;(2T?MGC;A{1h}MQK;TS*YY)eu
zGnXng#@J1xaNNYV=7p(c9@jp>(PLqZg(U6R5anj{gGOpnOga@ForZ3hdhIP(Vu*<W
za^RGa9Un-rO>xuyfi(XD5K)$My6Bp1mOen{t|fsEH{pE`zC2kbr^ym~kO~0TT)X#v
zyXXD~*80-+wa<UXzW4_pBe0`P77G9zKq|tOc$ySfbM`Bes||_`^Y`UH{CGO&;iPm1
zv`F6bLqDD@v@dKZF7*B3U-$?1baLap@(piJ<9NW{{I2h}H>DrU@27tE!yEV7wjJNO
zWncN!$L&j>{Fn`rlDeAi=g<Ak|2)O^9$j4bv48Um_W0MNVBYY~@3VJ*=*I{Mfr}9N
zExi5@KFSyWm2Z42U6j|7(nkZ+(-ZsFmp*4-{QckI^%y7Ig>Y9s^WAUR-J3U7#<`#J
zIDgLjD2Oh%*mkARK9AciMUAhI;_KYvxjVVbGTdf`ty`yN7aK=o=`UYPw)C{Hg9Qd_
zT}ZdOcYB-4E1d5QVta?R03ZN}2%xeCh3fJR0fDQv3P;^35blzK$dvF3*)oV)I71j0
zjD2a9&n(PZ0uKT>b64BUYYBSl7;}e;THy?A$J3gY78C`nrfF0{GU`adHCB0SPV?k3
zsao=g1iuD`ikiv4aDO3|1;{?EKg5nMC#`}w5t3*DHHYgE1skCtDt`co<IJX!NI)nD
zqz++SIvy&V1L(?xIcgcvhD|&O6ny|qKnWt58sZ#^0~QTXi_F(5r6fwutIKIO9BTJ~
z!O(#6Wev&N7KJuhz%kv=D646~ox&Q7QqY9y)AEW$5;Kjekoz$bkYaQ<22X~Ddw1@+
z9aKA+JZ(%hhzeDaZNx2MV$JDO%&55TmVvI=0<0J~sbraItu%lfq&{@mw|Q;_lKMzC
z8KmTxc^(DUph}3!eim(uGNWtdi<#puWKBi$B4!Q(A*!SlgN6lnulO3EQ!<B^-(%}X
z^xb5s{Kmid$M)q<e`2x!T_5~m`^mrjH|W+H@dKSR2n&cjntS^3Z`-p^e3zzgTc1!)
z^SKn^Y&zxdMKNT~LDMfjL|9?3N&^4){_QW@XOo-lok@wk_lJKXDXv%2Rru@^k8cPl
zD1ZkZd8K_ex$Hjv>%VOGKKM{lU~jX(@HhXqz4K4~2wjJmm|;?|0LJjOLIvt#uy*s2
z<7|GP`0s-ypi1MW#CCRiH+_TxSqxE<7AU23Zw=z8bR=Wb4=le)azk#;d61y9P2s<n
z^|bU{cPW<jHh6qXhkdM-E=zG;dG&3tb6ZkiOaEBc7<M$(x%E;0l!fWpz2=?ovmg5#
z{{<I3fB5VF(!P=wC-_E|Puy*#HoczDk&<2nwkT@9aadI;-gTTT6R<K|^3oL$w1*(y
zovBJXlpVkeOvR#iNQ>TK5~x%-Ft^B>A;1L`z%Z8p#QB8HBMxOX-Ct0OQ?hkrgt$|z
zRl2dc5{_J`DvSc9qcZnVB;k~2O6(=%+f)%_K3CmBfJ1`(d0eJrc(b|2fU+mBjApQA
zvM4uW6ea*JJu2cXQppX9=q^4_bjEliXq*ChWOL@vru{=f`myY1+Q3}o<z=M>2dqKl
zw*?d29mu~q_tjFwCf8svS7yX3$S`4S(OKIu23V)ZGsULhJ_Mo@pgU4xQBjfqgt0lu
zdFI|hhGfb~qh;kbpE+y%P(DOjwNTE~A5^>*U6^2Qnv|lmFPPO`3mI6uM$sI_1?;<V
z3+iojUn%^WA@=~E@j(KRA=hKU>$y}43c%KGeMK)5U~Y+#zTXjrr24M|H8WqEu=z1;
z|CHO-$VP<(E2di5&_b|agJ8b-+_QFae8-+hZoc3A#ec$>&MRK?x@3vnYcD+eRBKPK
zed{~y+kf;$T3ByME=YnYzVz91MS;<v04G+Fl_HpDsgKVmSKljN|0bdXp)~H^y0LLr
za9#ez|MY)pzyIN1rL_e2;*DpXAP5AOBhH;BrEw`KzK7E|VOc%;x;NYPmpw@Ma&zZL
zSFYOY-|-%M`j5Yn6w#r*;d{R?#qiDu!nppxLp<kuf9NOdb4fuCM?-tfo8Q4;{7Jfp
zC%^R#p8uLRzte6$`!wB(55Dp-n@=W;x50932Hy0Cd4shDi}j&&?%CbD1c&S^h`SZo
z^3k4((BIGf`m?QlY$~tiR<<jT^{X}-Hrq&z=vIos`t`Qi&SqQM2FVTniZ{O9e&T=p
zzp%?G#`=+8{D<}jzxvPJ{T){ti!BYbTdASZTGlK=Am|`O;o?H>&Ztm~BO_6*;O$e?
zpvo09icb4P4-nCFnTIA+wHIy9nY60KGu=*wST+>v3aopDnqPxa?j9o1&&7fAvu0q@
zNb(7VD4CZ80bB&-tb&;we61$8q1B3y5prLt<`oEP!8ngH_V8pK4wZWZ%L52I2z-|E
zC?X3Z5-7n{r<4|4j}d4_p&J%u2~m2axnC%75YZypw*m^>b7`S8&YVZEu4QSFTCWzs
z4l;h81$UXsfSAvO+ACmz@ud@U$WW`7G#9FQHV)!6oTr1wguNHM*UGI#%r^pgpm-WJ
z1Qt0+baPLx4t$REu~i;+GLci@)xdqRa<yBim@g15lN|){tW4aE&rd2^zvE$H1+;Nd
z2&Oo53Vo97My*&Gd^4eMDyOC=;-!`_25Sa*#iG-6Ab<y`DQe`59g<mjjTOFRCWIj=
z?!~O)^^x_I^5%_iRa&8CU)P5d&IN(BZ%o8X%JtTb=k4oX_>4W41b3BIm9zQO-tpcK
z5VY{`Q>=z<#OUZEUHht}D84_%&2ByatUdPD@1bk;@o#+9PEXDi7c3IQ!0sfM84!zn
zsVXr9Af5&#@R~QhExF@<KPk^=7UR76{4<Ofz5mDlJQX6^d^E+5;KKWSvf6Gu^EAN_
z;AVpYM3VBuuYN2ku7~YAU;D~p!7)ri=#Ag|KCYOcc;4_m@3XIc?vwWXliy7mOMSif
zM}I205bv`~SFYJ3kG;V@o#J+PZ$592|IrtC-fQ3fy>@i<T2g{n?7>H0OH|@>-+i2l
zZvjH_fx{JhE8Pc_*L#2D&u|=H{QZC5YI$`(x6SjymNWYh>8@MtVTTpAT~V!`dp@dN
zXY6is`QSDSY<s_38r`y|X=Q*|=Fj|`-Sglh_6NWAiv(q8!54Qo8FtTAv-o7W5|*l$
z;sKd1TzW<FydXsfIXw`1U=`<6t`+CXd?5_QM75p%1DPWfTP~J)gL^G`4f5I-%hH-K
zrb-|IYbc<cpbv;K)B}TsQxotYq#ww@Spp>!VQ-O%e0(;Q6*DS?$^#yNWaOrtr93EP
z0woGqI+PRKZ+FuaUO5zr!;D2IWz`6==P>vvv?P2sg#*<fqbv)a9G#OvggI}y;&eH)
zlWT$}U_p-3z%E4xYy=7UDW(~$7f#K`{Ig0RnS)^<tNgrfsQr}Agn1kIBB4SovJh$!
zvWsy$pZ@_$reqBkLIww{M_AMox9}QEJM+wk%B|snlL=2f2ae1dA#={$$PX75F{(p@
zO!$mkw?atfkKH@|uX2CkP&Kn&upjsf=<dQgo(l;0j%5;x+P6TN=w$Pb^2QAqm<e4|
z>*ri`6oN1=Rw-`0Z7dow9e1$ANY}mX;j8wIr*5o#8GYB6jmzWZuYR4~df{0rmD@L7
zSbS87UyTkA?OR{{VzQjR#CQ_WfpFnnNtVpxU;m2z+CTmO(q)La*U{x`%)tWC0zi*H
zPH`ca>~QP7kSvnl`Q?9VU-|SOq*dG5$~d6dPVU@ER@B4x$g3VpZoh}^^v>;MN&Oxz
zm&?hjyOFL3+`ZXgwZSU7cHhg0gnaN7uO=7*v8Ipx+h3vubo+(pXhp$|h<gD%|JkHa
zzWtTY^Il)^x;HWI_W0MnMCAvF`d2^w`}W~~{`cAcYu@q>d)?dLWgq{wU!p4$d2V0%
z<j3t-|Iz=;?xZ*s#&nV_xr4(?cK^e#pz;Hv@Ke9}Yxd-~zm`_x_YxrTov(kHW5osm
z2h<}h!NW^elLCApDZno-o=2Z&w*NU{>8D>CD_3vPnCr*-wtYU5epiH^C+s>eyojUC
zHokP(9(~h0>}%;=`Hg?@-w^e>Z)>5$61y@U+VxA9?05h8roHRFF%xCM&_2op4ro{%
zWF-d~0Ga9pX1Tx;gS^QD(kh+SM#u<CfJ6ss5HTT;%)-Y9M)_mU2_sT3YZx^G1#_PI
zpL2DetKW!tS4H6pWd%wofFqzN&@LTG&Q2cOMW>iO9gED*0vZl|Oy&wR0DLk`775CD
z(B&26B!k|@J(GALb55aJ3jLtaBvL(qr@@O%4w{M^NIVAYKeY`O5&%lZ^mqjtBFNvW
zqmr?q5m_}DK_VCua3R*JT{akq6+TEm%8l#pO3rbmLXtQD{zzCu<Zr|n(tx0x;r`5#
zDC|gd#0Te|n!s9)A-F46X;s2Z=$t0TI0$mPRvxFse3i8ls#%RB^>dK9vIBDQC*F8p
z962A?+>_Z@*v%7h8yr40T@)Gxb+ZtU0_z4`gokN0f0C?}dy~8A%qd%jnGlKtS6q&p
z=OE8YRr}05mc~^})Jg-l@x+}JOGz%azw+)!?bko`b-${=(pvsl&bQdHf9ZVqj?=xd
zv;p$5S_B3dH~!22>wjmz@{j-D_Nm|fO}fL7<HQ%lx@mg=$bi*@^Ozgf61;1>7Vb(s
z2gcM8Z;JKGxj;tZF9gwL%_SG%<tz3BfBrAody^aRpZuNwGm(L~w<gC73D7_Cvp;7)
z@z?$n`=9>kJ5!ABP;L;Xvsxbu`dD|hYHPQ4=<)@Ui^Q4L*86MQUfg*XBS;R-e`3e}
zu4}B%v3_rE=y~uW_ji76n_ao@m(|wp+TSfo|K-;%*=rwsnf)I>@=g2O@4QADImici
zI7$z)kUKS#6+o-1R&m4H-Har^H3_hWjhq5*uI~Z}KeTj`PCZJ(|JGzqt~?;uin?NK
zYf=fSj&^|qIR#w4&Pgnrr*qC+Tn#1X75Dd>ApKD7Jd2eCdr5&`+dT&b<6ER<q9WCp
z5E+J5i7~<xReSu5Nz-&C3IY$8=^$B12aw`vKP;9hNr1&L1pNWUh_Qo|_r?V5^)dB3
zpmN4{hteif6F36vf3OvuB{_XHwR`6Auo^jK7Mwj_AUo(updj(JB6fuh>>&i<rEj?)
zYOvxhVGa=n0<aB=XEsIrDl<?H#5AF>JO>^MDuU*&_IIp|4a(3fiQv}U6E$}PdJ%-q
zEFI7Xyg8Kq(KsVFB=g`hr(6QhRtS}H6TB7+P-UfCT*0j{=4gRd9uz86U=`6M1x-k-
zj^=z24EiCkNtBHss)S^gq5zR)rx&`BZAGpU&kW37=+n22YgSx`3r9tVYYHW+>)GP$
zwhb##xc=Z4!(`9a;K5yOBe1;)ZZC~!*R>5zm9?CUO?+~z2dErRPwXtY7~!^SKqSj;
zBVP^qU)UyRC#~&=u0B@oU=tROg-a~wt!?tE9g?@j1J!xn|Btyp0hTOF&%>~D&b>GD
zy;rZQdYJ`-8O#7P07wu!0T2K;kN^pSlpLfa!W2c(vgMF%Q3`JgMc9^?c7)}SZ8;=w
zVcH?ul!7uPSrSQ+6eW=Y7Z4Ol2p|X!mH`Ia%wYEJuC97pX5M>_&bOSK`Ch#xUv&>c
z3Dk5|E_XfmU%vnQzyFqm>Dt$=+bXxbAFu!HrtOw%_j<ciz3I63Stt9xwu30I?&0k@
zudD8`T;m_xTd+5%k-$)2u$M}GSSZe;4g{5PKz&o;pd+a+6lD;rtbvgOksW15u=DVH
zt1Q9VNHzIDt-!+~M*ub()PKfND(!F@O3E~5{upCJDyjkhr(i`2?~<b<xJfd_#i-B7
zg0q|vJODKMPR};XQZDL-A6n`TP}^}mr_Y^l!owt|MP_3sAzzX$LQqrhQu2C)0Br*&
zL0B~OaHP0qsgG8im`Id5tsZIv$tO%4hDKm55tM3c5Hvy!A9fn;0$^|+wOS000kuLL
zuj(}-xJW;uUjL4)##7kDRi*<uL=!YKLMiQ>U95QiC-u4?B~67M*&`>`=-RrrNQ4&s
zR#2CAzleH|&w=1EXh;$-#`nNvlwyBjMvVGje<4y2XGVVYyN+H1GY}ogyy2ZW{ct{1
zzsPJbYp;W05D&kI?#Ki=`etH?WK<-Cf+Z(*BF1x3aB}loNX-cr%j_#X91I~oVas_>
zsPN;Tc{9Ad81t44E9~)`D_Pg-{5<^1&;2YR#?xnSi9UMiS266nj~6|*yS|Ie2yo&r
z{M1iS0pzN~EOqhW^N;?Wzs{bq+qQMndsjbwJLeJiJlXyBvERn_y7yP#kGDIGyZ0O~
z{n@`hb;GvfEuY<cyYZS&^rzf&U0=I~BKouz;nfNi{>Uevgl~CuNvD)hXNm)<-qgiI
zovBw#4YG)J7I6!i2#gj<7eS)302ruv(MONZkX>N|bEn4FHDD@8EY;5*u<oT=JP06D
zlw-<P)W|i+KFe~1YwASFcv7Ik3~78fnl+(d-lIfn29{$_D2yXOvVwJ}TOi{C3vjgT
z64uc9YE;`#=c|>PgN*KNl@f@yt!py4K8AI(B$S%iuw6)4s1B;`;~Y?7%~+nDPb8U8
zQZWlf!%Im*PlnzAG6gO~-8PUi)XY)R={nWs8u4W1tPID><YH2-2_sEVTRT2r$5nM+
z(k@&Z0wnpSUW4PB5hCM~%9r}M*wQd`JTJhK=ac&7LY6Yf#iYOl*AGI)^dt4SAO>Hg
zYn#Q>uTcmFLZ&QAC8><QI1MV~_>)luPh@B8PEX?c!&yD8n|WL}09N72s2ehf`$H#K
zxG1u8s#0<jTHtUsWW(%K4;mvqmaU0+`#{F^uj@bnVL+b0lbgQO7*xn$e(`62@{a9n
zBkbFv^7h-C-oNd4w`~LW>djhPLw)VK4Iq>L;%9%Af9~2=d++vRxp{`!KIc(xs44Ap
zZ0-Ha+mBa1x%oGje|OXN{Jsz1rr++ho}T-DbNuDb@5US6yzhRmZsPK9Z+qtA&hKu9
z-fz86MF`qR*selA9H^DU(@FA85LAV*ESg;#NepTg>zeAwAXekI=;mM;+asxA!VId3
z5Y+?Bgd+95ga;^jpx<aE^1)c)wMR!ig=(K-0Al_8<yz-D#ds2AVI>fLOQ>;Wv5y($
z7mQRX9C`@Dxv91fbaSfdQwu7SIPq3J_NN;&<m&OgT;Z+hLN;*9K7U*XFbqMp9wDz+
zW_t%!b$6o)1`Qeo1vPnwpGotp`bjDlu+_-SUd9+0WH-Y=g8m`19;P<xr7eZWk3a$R
zd$1=jAQ;T)^GYCAm}W`6!W<xUr-tlAn|*L7O~R9UA9`t0kvOresqO*hcGY|L%xwa=
zMz!d`rt2ffQ(+QvlB6IrQuNQ&?H^m*7#Y{0C9f#;$eCi~gAy*CJbMgmN*wRg4b@Oo
zu<YDK%+%Bk#v9J9QGWu`%^`t=v96KOnhkQr#mt6dF6!q?2qBKjx2X*8rA^(e<j5`c
zbX3T?n=F4JrE^jpEorp$T@LF@<<PF(cDdpG+kW#xrsVqV?*6&|2I6xYxNTc6`q`a_
z5$?EtC2WOZ-^TW@`*YXtZrk3CI|<?1KEoHeS0(JX-k<xk^N&V)eX;$&z5BZVJ|gW4
z3@nTsXwPq)t5&eO*s$IWhcj*@RWT%~OEk7NAgLqB6-|xNS~HrJ)E$sb9UNf(R-hs}
zcqNnd3JV7VPNd<(X@Zn-cr-90IIngNjlCFQ0{H4;rJ6e?2cOn$pPr!EzSfFRZ!&2F
zgoxt`?LEMDFyE@4*I7L-)OiNz>s1Hwu-Z(V-!Kd&Bw*m;ijqt`bWHzE8V7>xay6+E
zG!;RRhjp8eSS#*o%`VZoqds@O+HguSP_LH{6WNqcCNaOCV&Zb$24;Zun${^vC(AW$
za!0tcpl6OE!WKQY<P*j&QDMV9RGU%3!r4mo?HJ2UlIf8VA-iNFb3OM2ShOc(`{u<&
z=ZzMJ6&<JA5|A;SqHU(F8Za!gRN?2uo;Ax2>u^29AU7J#0ulI=^@dKc2mO<IjvWOG
z>J+`~)jQE1DL53|aE>jB8XVTU5Q^TSv{<qs@BI9tp8SG>mW9n1S}2(Z?z$J~o2Y#u
zqDn2g5bmow*?6OLM!DnPytp@f=e};_xybRkH}?2VxVwJvVv+ju(f;1&z4O6s`@Y|2
zch9-n{q0?!@9yBP^St>LFa6GD^X7eqyR+X*Ti<bB@rEDYWz?^(l^4+@ymU>joJhIX
zw(diKiZ>j??kafxrGk8B4F>iDZ1-`=k+lq58}xN}FwjPD;9<23>$L*t;jm|BvBume
zG_6`<4!^JdszPJEYe<@ij2g+avo)cykqo>@mf%y*^dc$E6O{p}_h}%ENM#AC$4@od
zkIW9&W)Py;czrg~uu}P_S8cu@Bb%EsmLB~`F#6Osqzrwg*e;AZL<$Z%IRn)E*&4*Q
zBTWs)bv#2xSkw;&+u7G`9i#SF9nu$T`Uo40TGQv>T2a?AWx=OkHgN6+A;Js8lw^LV
z<k?w)?Mq-Dj!`NYfcucmc9w|Zwa8L{M_T}#J*sb~sIS$nKd$)VSRDvpRP@?W9Jd>)
zGacCs4xjS4!ia0D!M}_QukPm=nyrEC^&+K!|FDUoh_X4l?s!puH{#$cY<XVyv8e&b
z!+Ovdv-Q@gYJOm^6Z*u087C1g;9Mrcf})3VY)Mdh$@i&r9w@0o2Lo*S;2@mVyc3Rx
zxMx<UGpBOm=7ODQYACK8YAjt;noTDdT+ok#DJk`FC6wL&fx5}K-K;Hln=!o3dGT0c
zxQ7vpx9<Py?{;7JaR9fS-!6PMtDf)tpxm<0dtIMP=4*F<mw&NO|5f|?{tdZzz2dz0
zTXuJ^03z=Ey=^w$<DhQ3e!Jhe&8gnFof|IFeXrepzTfWXKCmY<qFyTNdD>Ki)oHln
zB#l!D%l4kbg}TmYLGJN<BdI6$cd3ba9Yj}$ZNli0RW*7CNIR+#J;hj$YE)t04ysea
zbYVFkH3;LRPR5B0$KzUq19Szj?O9Drri&O3tD{6e7z}CLXp9GmWy26Wy-UL6u$474
zczv@D@9Ga(OM0vReOdQ?QBy){_SN@ZI$nk^oNU;T``~Cv<sle;WN<LX9Fl0l28wVC
z4x3a@*}7h=O*Q5~$BwFPMQ>QH_7)fMS#_jesL8`u4O94d#reMM;V_Hz0;+?PFN;J~
zBskM^PLMWJyeL~$nGFLkdkz<dqr$xaAqEb#t4<$T6{Z_!5Lqr(^}U|i@e#<)W5+Rz
zs~RNW-20k!6*{6s$$C)Y7oLy|l@o0DwBF|hd{2-{K8}gGG$7v^ys*EGqh$(3FW!Av
zea#vHMyD=x^*0DA9Cow^mw^8;e2fB>n!(ir<3)nniK7oD&pGw0HjDx&dxELSA<a#6
z%BGyAQw~^^&5jVESVed+I(LG{`#k+OJRJAQeC}hg+7EV>1MYT+m*dg<7{{BoAMV`e
zb+2Z;pLbrjZR0NI6>j`IUNL@g=iB=U)$U&F>yGR4-tK;t8;>-EeI3PiTh|=Zl?~i0
zW4hs}+V?L1qFnmcof-BWZ^vua!M?%G<=<VesNY^-1)f67j|Npk7ZV_^qXo$bC^b+;
z+^`&LIWB47#m3|!GS~4E)7yKhM!>)?`dZ&POd7CQ9mI%eeXTw)4m+&Q>>Qmgos8+K
z2HYTr<gTz671`H>QV*DX3&CaQYaB-(j*bE$O0W=N=z*c328P-g&h!NJ{ox=yUCEIi
zf-a70g_<4ec|nx&mZ7ibd118{w^RVXiM<+=qh?aU0}e?<9w=6nihn{);)@rVa#*|`
zU<*E2ux50Q#_F2+JUv~LK?vEoo~*}FGP6a;b~<UyN|&S%56F@enX6Mn7RB4%>6k#2
zftWpb3X21&e0=UAv(4!-KCc@*Ior5_8`GCdc<-{Sjy17H*Hg_RsZl(tr<bfkjCILy
z&V%~Q>N+@EiAaVl8*|IB@7L?~eE0D&r*c0-;DW3*XUX&9!r&*9X^f;W21)1RA})%=
z4&e_$N5lnRNXnR5+Cw&jRm>LB9~)(2r=?>NlsI+Jw9cN}M`2Hx>9TlC3Wpg=BBd*3
z#)NNP{&&AF8-#Mrd(VHrz4pmuu6wBWGx+z&IBwm}{;=WozjJhagYyd4Z1?Kx#rE62
zw{>2-TfEljHCXNrXK>S6+209mUBJE$>_&rLcK)+RkaOGTmtXO@Z<ZU*eBbrOZ9JDk
zUi0^BoY>CWmws}UHCg<J17i`IcVf$d4fk}a`Af|j(3sIx8}Odv$oi5-x(8-m6mICm
zr~`EySsIvy<3>R*nS8V{9h-<TfU+-{&hhbb8K!EG5#^(oYEd(U!)idEY+`uaO+=PX
zbE2&p-Mkxn^|h7?)tz5tHv57m4hL{{F%foKpaxTvDIw^`cfbW0>iN;}Rs;MN>O_#X
zs-GX!KaVl~BLdADrJYzhW?h^lPqh!#bdp)#=bKD*3D{pwG3G$Y3iDNG0VNPH8W%;%
z8IbOS%KpZExzrY{4gdraG*iERQ7BQ*L72%>OHm3*n@!;ivC(}>j}}%<LUvWXBb4x;
z*5AK0)Ur@su_^e2_3xjZRsof@H>Wk5n>qTVQ=ituPEP6s^!yk-;zZPUjA9vrq_V(n
zM3y=NLao=~UG<!B4<FWpd{j$M(`LnNcv=5G)(joI$m)G1>5{V2IAlhhr9CL`1lyML
zJn0vaS#Q~UPRAq`s^weUsCuwiFe>VZibnPcz}sq?W+%!#DfJpA2HZ76I}6`4W%RlS
z<i4-%vv}Dc-RFV6^*2{Ocqg)z+nnHa?_al%`$Wg>2l1Llrn|1yi|_a9eYqN9+yFWG
ztM|Q!_i;iuUH9GBeeUPg4c~PvFXnu&U*C5<Ki3}TZLb>+e&0X`FG@0Dv^!-P0?P*x
zwGtRqXayb~czno)&8!gM9f}k#h};a)yo1A9F_=!Qt1P0zT?nxrR^#1ad`R5~hze|^
zjUoZSz@Jwr@GR<xCDyAN%Sp`=jy?2t4WrfvY6~W0MAbN*ooB&psS};O{tw6*)bcAG
zdzhBhK|GywroCzPU{Is316`e*G^v=qPHs7x2vMSbqw)%R#-<BZ-xk$zAgE`OQGW|I
zAF28WJu?|NJRDD~Mjjf5)NYKLw}mng90IZwN?XAv6*)ER7Z4&6g}h00dIt+Zhai|V
z@*T2MAhTc}QkKaKN+|9>8ArmdD+D4zf)gubRV7jB0(C|@tLpepkyW#n7bISeX5&F>
z8a?!6agBzK^V2w!ton!(Y^Sb`u_i?4Ao0|FQi%i1kBOQp=s)P$NQ@JLV5**gM1kDK
z{6hyi91~ULi$DQ10pen!Yx<yAH6g3tf~>*l#$`K3PN_!6Jo2~9)@eGji|R=euu$|c
z+`}r}Wi0ROOm6$lZTks#Z13{#E}NFJ=P_Krt^K|qZus5yd)GUQeGKh=j`R87#d{sk
zuJhV`?VD9y_lmdf_jz-?&zgJgvny}z>rAiy{OT)S^EX|hyS&i-1At3EyyhTo4e(m(
zX$TO}E-CFBWKjx`U+Dt-LC=Z$fW8+=PB=P9a&WLKXmqWH^$gCgh|UeCHL}kM%r*tq
zV6dTw2=LhX*@~G4vJY6}4T5Jtj`g1?&zxFb2(Qyl^Sp=*ooQqTpuPh$?l=v8qTUZF
z_VB-`k%86@!&;!K!NHJ;wXKIWoxr#gj(r-s(5Azr;{I0mFh$E(;d9vEQtM+Vophca
z3<5>T8r%rSa$(hWlv!}SMvx^?-|Lr55EcVq%nGAcc&)3MVa(E-MW%H?Rgj*wL^upE
zz|ZoEcK#6OS+B(+cQyN|3Co7e4^q=n>&pwx^%`pS^Q)^1wo&n#MAO>|O-^)haV-r-
zBrDV~gl;1sN1nf@hZH!p3hj;?Ix9e>=Wtf_em$s}7@*yU^*mpxS@XKWxlu%xx{;Eo
zDaZm|kV<<K!HpI|1ooT=f@gk50fgw2xR}vR#jCnudhtb1is+gJz{!&@C2hh2U{Qlx
zNg5M?RQ*9ME`k!e&YL@hQ15!4ZiX((mG^Gn)?UVXkF0C=v&+YKdu)7HmUZ>BeT?C4
z2LHbM+x_gWbG~k$cRPUi+~1!2p?`eae(ribpE+LV4%)xUt-rnc*>l^u!GT@+&OKf?
zuld_+O?UnN9XW_=zF5rLUo3kXI@G-}uj;gB8K`|>BnHG{ks={W*wotj(Fh$tLtv|s
zv!L+%@j^00D~=P9z&Et=Kn!4W>w4tqcj&1Owb*|F%6-x}5sCU%L%M;~QX&}yklG1|
zWoUZFROA&Tsgj&i4a^5*M4kfNk+qoEe~Qw{F@AG&5IzsxR-jd>xOq3y0U;OQd@xGl
zY1{{Tw9uDz0CjpmYLI;jfg}p}i}ST=N23uD^f8@oHc~s<*w#i3YFtlpj&K?*{&4aJ
z#{$>--K3`9DD?^uFCf|r`KBR=$_Tp2x@g)m*p<kXK%zJUi}HM3>u?J-J;OoaT9=KK
z+v!LHYkn8iwI9~&m8q!P(RrbF43bR;IF3<0yP9^7dq0vC$l79*vdE%3>`l?gtaZ(D
zQ8R->MnZISxRB%%XokHdMT!}H)CJ3$i8ER=Dmn8KOI<r4lZG(gB&SrwI^?+K06G4V
ztQdB}dnV2pwP=Y-WsfI7Ityk{RvJse$+#1wU3oV4eU2VJdQ5TI-FL5hu5NqQ_Ia4&
zEpOca_xqjYm*PCGJBGV{7w`D@U9bE7{`upY?d99Dy7xJT-S3pQ@!S1=@FJ&mQ~vs5
zzq|Z;`uZ2xgn#3!gy&eGJ0I~6S;Q1cD9j!}tv<<`5)AwEcxj^8C<Y+XvvJZC2_P{*
z@CIZ8MZ^y5jU<U^9lc;!jl(LnAC@LI6Q!PzwV^qfaAN)T>!a%Vps}+Bb<)fyPW^@b
z8mt6S6#OnZS5x&P%n=NPDkbj(Ckp5dBRw!CWo<i#?IMFagq%`RhNGEcy7H5Q_dd9l
zAELRPoGV(3DB6H}9VcsOv<eg@KxSB?$F`G#2OLK69Ieq@fk?H#!tW%X7ZM2&C*nBG
zwi#J!U$Zc5JlDF>8CwuU4C!55MosOwUbUxj&F?OY<o!tJXi6eJUfyR@?3L~mb0ZQP
z#e)epxUOh%h?cd&5uXMr-><8~q91}|CWU_Fe$a6xA>1Gt4%V~mX?fU4<C1Dl$*RV<
z=)id&K!&Bld#xYhK`*JN7&XS4691mMNtqAapb%z<$4=^?&S?d*g*sxfXy(-Jvvwb+
z)n2QM3yvna`nu@>eIX~c&u`-%-<iL9zcY<D{Qa))-u=b@Iy$fN-1lw`^y6M{-S~QY
z>*2)%kQ={q&kK8fK(u?+uKV8YuW`p|-T1p}QqW6TWt1Kt;J5X~Ivg#ebP;Q$4Vw2E
zDDkjQFsdXKc+QkP-!g5(28!7Rp*NdJ#*y`Ru$`mz@R}p34)O>TYd9BZ1_8c<@<S(w
zfUM-aBsC&O)nTw52{Z^{Y64hfC_2dI_>P>ZB7r7qWKZXUmRNcLJU5{}H%NVALSNb>
z>4i*j08N6%MO#8i1O{?ci!SPKw7w<Gi3GAaIPc?n&PNc~rSPwuEC?%S=OZ0G#@!?1
z>6&U$*SYm5Q((B8Bv=c(Oc4*O$!iL-+m*6lQ=C5>+A%ZIiAwLAdasVMYGkLN>{mx7
zwM98A_UK{Xl+-Fz@bB7Z_1{Oxpi7q1llYeAdqG91{(02vnw-HAPR7iN#-sESkp!c#
z1m!(}nUF;GrNV5V!Ue%WU{P>it{D|QCS*NA!~V6pBGciH;*P*Kxib{`oL1vITnJH7
zOl$kkbqBbq1KQuOdo)Ve`$=2dY2BTjlpDWy`|tMuEX4a7%@>Q1_ua>x4!GU)J)Q2C
z^7H-9sV$5v4)<+lG;eoJyqy4Gug~wXsGk4o{_Fm_*S-+&?)&^qV&_sPAJoHy?BXd|
zX6O?Nv`3iP#Ccs&0tt{_qO_iSjzOm`!L2qyGEyZ;2$oE8lso9OqE&%v-3!%`gkT%Y
z!%a2r-ae<hN5X6@fz*Rr*1&wjS%R4vS<luTPg72+k>Pkz-q<9`)b;c`s*zGW7IqLd
zFPus*A>b#q=7gqRzUQk0Uz|xA*+{t_g1b<{hpI;s6Z2r|`Cps|M1?N^pVebT=0_MY
zh*}Skh-Ig#8^wtTE;yVck`CB$Kyeovt6?Nfq1PbKK)c;;ntmEtD<e4`+k+z`aV3(B
zf<|VDPZTtar=AVaqwU?4m21JlFN+){?hyh8v`j_IK-J1wIIibHmH)9YIBCOvW6?S&
zeIc=inL2oX>q#dZ9jUY)F7{XzYZtmXC21R6n!sVZ7EzRmOqJq!H>n7iLrMrWc|;3k
z6wXSfim@H0^0qgutyvTC+6UxC(ynm5ue<!74&c`4{g!R*eiq)w=a;`5@Az)H@!kEl
zfBmt{zc+-@Qs1i)^S;}=`uR=YDSLc&)905z*_uut`mHeHzQ=Xj9&bPQtuuY6uF*|z
z-sPw-uZ?ouCbrwT^4Y%5?ehA${NvL8#K7Jj4u-TQU8<JoA+rRJmEBAlk{I;^QmBjc
z1Sbc%up`KJK$+;HC#QFkFM@pmB)6=dge<_3#*Rb)Kw$Vk2Fh8sE=`g->WT%wi$~OZ
z&X>dz1o>@>8f8_BO00cp5M+fLt3!lgosyt1*6`503~D{K`~=NG_Ky0x%&dg3vR)K4
z(qlDh;4Te*P$1jr_UOohttKQ31~=eDfA<8nD9An413g2%h-I3{8q#Lc^kgO)RJ#yV
z%2H90hGcJt!vFx89QwZ?AdF)h<p?=w5?N?HPSmv4ZcrW!Q{uPLW2{P%$~`izg=8s7
z^+#C=P8bdkD}c<(92u;z&v!KJ$x$%Nnju%GUXi%S2_op@Dy@bU89hX+7$b9C6Dkz@
zMRN2aVc-UIPHn+xnH=@xSuItm;Rf4-OjO)r+s$c3Yh>X?1`U6wiORj1CC@(%H$N;_
zU-5?T+->;E4G;4D4N$z{&3&EAjoZ3%JlFl^-iGGZ_pSsI{KECo`aVwP?Kr91jO_ED
z_<s3>?z$!~Y^1OJe)kA2|82kZb9GzyS}QvTb<_2W&mGhC$M@W}U*MRo?xGzdYg=F<
zgP6crUNs)f>SK+Z@;rgYkgEJeH0n*3O=9f_Z>%NZ6x`dCJ>Q8o2m!c-4X`~p7LFq#
zp#emNj+F6L&Ac$C9><1Eiw-HOhl`@RnEe&SfP-~FEe*z%wHl~cOgM~=a2#moW0W%@
zWgf=fBIHea2~Ij%m=n&6aA6c&mpHW1jtl$mWG~xy*d#nk@ggT>D}#EWtAo~5df4ZK
zUN#)>gB-`E<|KJP47l8|zS#4=Xu^e?y;H|p85QN>IB=h!gv1(LB7ug}jO#X!7ihL#
zD;olwH%O58=~}FFv?z>G;u7>RNm=Vyap0VNPqG{-SdkDCjwbCT*5Eu{gs^MzC>J?k
z<fHVsP3}X|OJ3SVKZLhb_qNhBT%4s9hcONXKOVBk8_CVdWVUn?WJEDE<uE(H<kTH|
ziG~443oR`s+b;6!vaJ&C^{m|EJJ*|w%MW{b?%VfvVDbKj;CctMJ)YZ~&t3bv?l|wf
zeteM1UQXy<M(&=!zx~{Hu0YxOZoGS&Z^!ZPes=k2u3taf&u`z(-q+DTD7X9|Uh}ux
z-SD-$c<xsr+`jghDFqQGFoFYYy>}gGL<y`o=-IC<RQsSvw`uA<*bkvlZ30GYa$lC5
zU~i~Tr4EX_S`{7H9L9V=-U$HWGeB`kHVtNu4YM|o&6)6nq$~?XG~|Zs$+T_^q>NI7
zK%EPd>fji<7_AbKsQR9e(Ih!dKzFc*12Y^e!55v|qSIo;gbsc;O4JsY1AdwHym}Z<
zsK(LJAz(}k+X#Y&H3DWEIgDNk`#29|HB^3&a&)~XEo1f;^dM_#Oyawfa9hH*{x1@a
z^HJAj$-$ehg%vR<AJpqjG975^li)*$ALH)>uMuuER7INAR2>b?-)MV4+ZE3?S=m2Z
zO(TfV!K|)m2qm&TkTOJ+(UfI<)|^uFe!lp)EMsYaRq=o|KmA$s$;c+W;tgiWMn&y;
zaMq^&FNrF~M#uCv)rFvg$H8`URF+@d+FgD|Zhfep|MxySy=;75=s50U8TUM%o6hx1
z`m*zC`+CPt>FRFY_O|yo$nV@f@4wA=e4jUL@HVG&`I8sFR=55V4r3CdtTS7Tq_9zC
zh>M*FV{B}`(iF@!Re~%y6B{V@9b0yxI@HDkX^}kvR)feZ2y@8PP#RHdkNU`9R2L>%
zL@Kjq*3aNM+OXTTO&?LGDDS(P=SYR{pi{3Gn~jSCcr*qR_M)wm9xG~hV-vIu`YyIR
zd3IH+p#`H-Bu$JuP6!8=B3s-@5TLtra<KUWkS;`~gQ>(D%*LW{FAqrb5Q~llP7vcm
z_>o(Z$O=zev26L*Ceft(ao|i8nIW3Hm)=g`oGi5~Xr`lwVA4OxzpS&e%ca|{crQzt
z<-2rb@(~5uY!OKYg2P8q>K$E?*XUPh!t><G&|;4mJZ@QP$hfr|XG|=5M)fAZyZ46o
zka=}QOhk>|?s#L6zS5zEWM*OT#nZ{?MitNa5^j52QR1C2#xG(Z_Q@>59pAaldF^9N
zZa(g<^SbT#yW6?$d)GPjJGZx^!PFM~ZAL8a@&2{Dx##z8{;rH&x#mmz9`|+o+&@E$
zS91C1x3$mlTz$oxcX<8Vx19I$pWOY_-6uO{!N1yvqs0D~aI!A!=R_?BhVN{hSr4JH
zh2;QS*{o#ahSK%(e5-yEx>H&$3>vE5U!ksHr`mb-jJ-$7X9wRL4q1Z85>d=N*rL_O
zHL)1C0ld|Nm?<<CUlFxGSZ!$SvIjCWj%osI7bVBLVI~or@r&58wxa{I$MQ%LRU8gu
z;fo1_ACe?<sV<SMYUF{K$nHc(m!oCck<`a^F<B%%i?O$`ZATV6PP!x5{MuuxHs(7}
zlcE=YfzT_msXmZ7NvLs@6x1+fYBHjwiH}wcRw+s7_vSv}NL%d?K}oc;&wy${-0LPf
zYmU8|<P&ghaqZ6Wn=D9G0>qjfhSn*nUL*=F>PkV~y*VY|j5vs;FCyjVqef%LBJYam
zf$G9!2|AC8n$xu`ZMKW%#fVa0c<~rTxo?cj6MQF%@_1dx)r&Z-eT>R=+r7W@xcfWL
zJ=`}~sdC5uLwGSmdV98c`+K{uc+*b#Vca>!>kM-YcR9Bk_Yv;vByQT?jzQk}(rr43
zcR8{9t|5JX`<axT|9z1)eA{at$+FkQj5qx2X2*Nm{cYuI8Y%~^!L@Tt4|ekn?NJ}p
zd`nm@>52`6$bulGAZQCKYGe3qnN+Xo9J#|8Vl)Y0F)-QicVtT(HIF?ZL&J9|ofMcw
zP?<g^X9jYbG0Gugr(*IY_FZvQNKrPFNp92VCWzruS1$?P!n1*izVJ3U_C@TKnMBRZ
zlBlo(ctC$tH7ae=aUk0okSJk45=YkI7!-Wc=`)iBDj#h|W?_xFiIZYhMKzK*I~Uq$
zjvmoeXk5RQTG)cv<}Dk{lJuM8Y>}9tf2?0D*kZ7(|K%63VT>@brfqPB3>E|lAw|9=
zGDuNtRTo7bA<|bg*b}2xmKc2n$TKRt1P|iC1Q{|*7xwPZxmYqn$XWnV2VWd@ETWps
znBGDuqq8%LN+UV%B}`U(*Y`MFGIqQ%YJ?N*Q~0zFR_bE9s5r&m<5YCfZhJ)bf9-3a
zuYMlF{zfWX`Tjn?kJr8F5B5F2?RMg&cT2cFUM|-h=ZjvOtFL(F$7Sc=myPtz6O*so
z$6ZeDy6@byz2{AEdG1S>z8m-5*7e_e;p=$iU$?o4`}Y1_`n8SIeHysSm1Dc^2+Nfa
zX?MM`hJj2dbd+lv%w9&8^72u~sDCBqn9h!67}dD=`y{vu!7}GY1v!)qxuv444X`76
znxOwj=!wOC9RbN7X!Efo6QIP?QNcR3__72QCf9a~i3OZK%zC}<?2681BC8L!v5TrB
z!LZ|qdJ_u3xR%2!K`K_-&I*GVEqFU-DYchrn+Z~y56;4K4@K{nuIm^(Ds4b<o;EZk
z_r*rmu}ET>OFqHOL^VD)NUoUd(Z%f;sp8D1OY#LxpEgjEZ=w^!tTd5CMxt+P3!^9Z
z+BM~+P^1t-HGfNb^+A$<ng*?*p^ZI7wR#X?QgofK-n%RZ%mBh_BV<3)gE_nE)P2lh
zU%9B>g&Tr&n5ywO1>nY6@F5$^+5rSN{*_423azZ8j`F&UY)UZ`#@Sa6#SO`dxH{sZ
zV&3FyNE$aiK)a^rzFEj!hNXSy`E6e@c(-ixJ`V6|CU)m}#jD%73`6Z}&aT_fjmLJM
z4elJ^bNh&QJFnZ0@22mBJHGq;wr;<dq3j-Wc+N4$JG|&^4mjL#jJN-0_fE&>{<iO{
z?Mne_c%j#BPI&z$;-&uzZIiw!5FJdJptfnXA19mQ5<(77FsrFIy5rglYeYpuBL|L<
zSDVcw)KN8dXIW@d>avv4FFMFVMXIO+7UKkW5FyNfW0_{rGlLqZQ5i-Q;||BlekEi9
zP`^di0fGWY$p;cNa2$D*lWeC8Lkz)i5K%zT7&o$dfZJg0&a(pgV-L_(n^Bwt`{+J4
z3OG0q>PQ$Vl&Qkb-!dbxn9P9Qv<tg(I5~_nIVah$QPj76xnSpsMJ{L7+c6M`h2xr(
z1-Dhj+7;!b5*12N+luBl4DMM|?yD66*8r#9dCD{}Rn7fM%n&h?QN3<~Y!twVP&9!*
zI`NSn)oX<jGZ2Dbk^0{=py`t}2Jr{o-Z+7zz(C%a?`fDA98!<DWhnZwCm}EzLBv9N
z{wz8pqM!*Uj`KBJunG0@l@uXGJ4#aQLyIV+hM3|$Fv|1U#EUqu-PisGZ}(p%?7N?R
zjPGs781MMOcHh?@+w<Rhesf{Z&-TgQuG=qv<1l|;=e6(lcfY&)y8XVlD|U+m3p-A#
zT)&-5fyWJ*+KW1t{eE}X8SH-Z`4`cnJrD4H&&l?)`Ew&Ls(DwKt2zQ0IMig|Mc`~W
zC=pCFPcqi^w|tRD$fH+wZ0bBlj0hzqnb5V>8afOsEMhUjAfC16T@%T`laowQrh&$_
z;JEls#(X8OQtLdu3@sg6;6O>jY?OM+w0r1@8Zn%*w-#ePxT8K$DLqh&HLzhhmCpUK
zg>@)mR<ZTXVq8gLT?ddMY%dynfqZdhA?F$<YBU}~at}22BsL*7g7ZHo;Y8<)_5)lb
z*7n?h9382wbD}+mlSkun=Z0TW^e07bpvYr{3j`@}Ze)k!?<H=hN)(HzCvhUqt-yg%
zF{M*B3%GOB$uYAOHHn=G#Uz|Rt}_xOtPf^txWQTVOO!+};uId%Yo5@UhvUSTRwhaa
z|4izFM)nodmqp#dELnaO2_v-$BU5m&cF+rPhR`K7mQT~C%5&3TF&4~Jx|hb5RDyj`
zZ+j}*15j@HEZk(Ox1Wa>_#7;n$O7r*=yCh^7%oS_FLrz(+<pAdZR5%h2!V9n&avJ9
zRl*JXy5_yR&gZ7>YeT9D+_bNoj_XDCclWmAz0Ui^_Hq4p?mGXn=X=+`F0akq{XMtM
zJvVyWbqd$LxAR5pV@)Sw;zdz*GI0Ksf>@43BBige)&UweqI4L^rR~qTgCFwI%v__=
zhDit54kCOFs<q?klvQyY$Vys#s>$Fj5dk)m4WjMB9I#b}B-O+Li&JQWSY_K$PXgUO
zv7uJO5CbKZdNupv+%_UwVDkIM=P%;N4oNKpD$TF5U@|zR<eC~YP6v5w<yWkqAuEJK
zSyC2j!)t^~c05G#364PYsD}SxCptb8i==gqV_mxUjdKv0hKVXqST-x$+}Ib;M@$+^
zMNQjD86SumVExg_1VNdY{6W4%{X0I}SY?7FjZRSEGALkB=}3tX4g!qNDU0^bjB;EP
zq68W^Ab{~b?^$ayJlDAg053Xb+*WpqPxROa>~hD=9eH7ZUxGz5MW^Y+qUE6}kK!Hy
zt*4^7T%DLIqa&7}>m}O!6{m2M@tFT|72Ar>e~-vPU95)>9)#mZkHfH7vI+6x{4|_C
zeOlA^bqF`@qiv&}z_0tJ-^ky6>X$wqR_ABICl#)HZ2Ov)KB)V`S5BV36{d~!-QZ9T
z4v)fv<A>qtTW^N-#l_|QTyqS`jf)L~e)Q7I;qfc)CiHM|cFK%*v$_apC(ml3^dc;l
z2jP8R@s%|*UWQNn!q4!SF9T!c+DrE8``*uE`@*L`RgddD+;&a&$!c%2f7fPcvoh=T
z5a)|#%GVv=?Z3Nx^u_PRoqv@Zf4lunEaBFJ+WolP^4Zn*_j!*pI)tClOghTQ1kc)o
zp-QGgPvecwOZ}E+`j(xb@|N@AzOQ-jx$m^+y;Jml)T88|DWQ}ZD97+@QeB2}Kv^OP
zFy;e?&C0PsY5d4k?Lwi0j?f}Tj1b}3Omf+v+-tTivm(HL2h{?em^cOsdGX|7k~ti_
zv(?9FRPLnbO1gUpG{7Wt@Pul<l(KXIH_Bw7tO3EfQyfDL(6M_^=P^kGv%Qi<%BNH;
zw-m|1W_wa6D2;Wm4&zi3Yjsj+Qo}B6$(nXWlzB=k#f6R!!zVGNgABltqo_bi0p%Rd
z0t5+)+(sc>k^NPA{@7Qg<)VJu80b_`%Nl62#Z4G$)^i5Pw*I-O4q&Xucs@zd9mfwi
zbOGJT*>TBMV#p@LgyN=UOeGl#$EV=Fiz`v&Jc}5bxf7}7q8|4HK&}|L2}d=#hoR?B
z>IRxrl`%`w;(-lsOk;HS`cyQM08L`OWk<&Knh0yhfnb3bjo<O2CN0xxccZq>iu6TT
zuon3qq2C@)d_OG0hd%P_!mt14Zwnv!x^JjP|JCsH$s6GlAOE@Vv48O6;TM1Aqv4_&
z>RSz8J<fmnU-(~zH(&o^_`kpQFV>WK8Q%MW4~5VD>aT=nZ#|J3bJzk-k6wN?{HEXe
z{o%pGN8v~R`d<#8`o*7@2xoOFAO7`UAHMm!zbE|gU;4A*lfUqDw;n!>&xgL|>%!{d
ztU8omrC{*4{?_jczxyBiC&KyZNqFN6pQBTJ^2Qg#&;G=ZhL3;rC&HK2<NAmH=s&~H
z|AYVc|D_)D=dbMJ`a0M@{73$o@Y1{96aGK{hyQim-}%n@+<n<&xZMz6_xtOe*Y4Jy
z|4oSdA5+`XU9amM+3qpKo#VXDsa^f;_OqGzaKo3%9>=w>L*9M$b$vd3{4)Q$Iy+(T
z1Si$iVCGR>|1cIS25wInv0r@+i$z!*9EN561G|90XtTLspw+(rB2Xbe=OeEg)?!%=
z>-mN<NskUA$CW^E_ZdhBooZVY&xI^f4L&g-64?*hZm7u@<XomADIz!^u=+4*7)tQT
za&&>2ND@o0o)1>{gKF%aR)Y&`^_YY-4Yo{hGNbBBP_2Mkx$0VyIf4Ue3hQvP?hh7<
zgxbxRnHiv_16u~N#e=1l&`AQRwsYz%`y>_hi*ZB6ibXxgP2SY=QR6goEY!)Eyog~4
zJBc}D9ii1|JFHA{qPAh?HqIbYOQ)x1wBptQz=>#tMwZ#iGZ#)U7M&C^I1z+$OtQrw
zt3X5o&I+}yCtwtUlre6&mR>=SMEFw@T&Sx-aRbf<>Lkc6yM^kGtR(`%rS#TDFfIe6
z%zFnG`UM72g4qtaDo${=Ffi2PqZIgi>aa&qF+-7A>#S}e=rX(6%`)})yJ@Nv&n>!%
ziJj8GqX+dnOsyL_So_c{#h^ZmIa`UXYuy@!r5T8L<3sWMYsa8mu@vwBs*i*p{O|qq
z;e%iGwc(4O|4exH<jwHPd%i4u<kx>g_}Xvy=I|f=+kYbb%-{d9TOT+$rvLJXe<(bA
z_EtEr5Bzsj=kZ7W`F}C|TmSn1KK%HP{58^2caQJEqnE<he8abf-|!p1gE#i<<RpCY
zv%gvm#}HoqvM&$c@a^9n{{DaQH^Q#@jxIEE(zM@2miW)T_OFH?{j2|J_$z<*-wCgO
z?la*-U;B08s5(S^@8Ix3IC{@<_zmCwoppcT68_x3`Nyj>{bcyqPyCnFah+D9aCYf>
zq?Bf;mTyICQzGg-I0(y{am5=9>pof5eLla=(e37imp|G5^ES%*b^G0Y-RC#)nqOS!
zy!P2vx#rC{|IdAnXTR6uSKkwkj<rUXhle!kr_Y{*hc%#jRI_zt)Qftr!H7Gn&TDu3
z7z6auyT2?vdiC9Oc9bQm#&1=#``17Fsc>F1`{|lY?Y8@S?F+S=wI<?%0e6;b1YZj|
zM@eHW;4s)S6D18aIUA9kNM<Gb3!LSoc~^K3I0g#+2gnvip+%&S2a&=+HAgliLD`-o
zJOBft&P0J&81E1`ATg2osBYHY>_-@Oz=MaVVbwP-)}v}_QSww!_n;_4R<^Wg<rk{A
zAB6LY@+>+TY@|DjY#0vy&FZwQ2?g2C(W?$eK|Me?T=bdM8W>P8)X<=6abA;#LmU7c
z<_cPcBfGWpAO|Q&K9OXC?V_!qI7mPiszfA`Z;lN20_&$=RA-`5DjW9#fUI`{`(Cru
z8p?!+QHt%*hD4Sth5kTz@Vr8pm^5+#LF7qwO{$XgiOw#Vp-CD)NH#IgI<^Qj7A6XY
z&Q7|14qAMlQ<x#b$;%BogcBJ*GN@8smPf3sSo3Y7=D!5bRp~@_p*NpQlP8SD7D9DQ
zkMklgmdW1|LnJMw6Jw-t1#G`NI+a0*J6}f1{>|U{Tf_T5_>u67AN#5B7yk603?KiQ
ze-J)gjsN%lH~wJw#_#ye)wz6U`1sHMR5+{;_@*u>7<~OUg;(D7Zo-MkK>pJI|4&h=
z8IA~!1Fu)#`@V2op}RM0=5yWa@aQ;v({K7M;ftU9bod+p@t^Ur#`!Afxr>A_VK7p?
zw&$nM!pU1t`1woK0O3VrQnMjAuG1Plzxl<_hrduA?oa&4Uk&g7%8!Ka|AYTz`1<M$
z-(BH8WL|&kFaHH*Vt@%Bz5EKd3nK<ci0J#I8mq$x$Kjy<0knwh3~=hsrMux8KmU3z
z%edh;<(}W)e!E=ySNqY6WLWq6O}u3ryKe3J3~aAsDPeCi#D1<)FZ9=79RW(l`W&j0
zTGm>@uw2&nY6eze>f@S`E$a8qcD4@(_40eaygIJ;at*%q`sYZ;2DJUSzW1IFemH#U
z=YN{d!KGK+@BVJz*SArF8IyXYPR>@8WWsn8xF}H3G5wY$h)Ko_btBjz7&$Nz0bOyF
zNqr`v0H3PidyA9XySZr=><vWqRJ8yJ<e(2vPFIv=V*FgQ29QAdYM?Q&kd=<2;1M+>
z)Ua@m7K5BAGQKtYp(YYK3P+8IkO8pk40bFFrh^6|8fJ$jCJl%1Y=d5_F+2`|&gise
z9B?M<dM=Nlj9#(NlSxkRLEYzrLHmLz@Z9qjGP6X?uR7{f8+%qWRS29zef|KMQ5q;b
z97jp>ZTP#+tw$0N22+o6Q$>Aq33Vo@(+6dZ%T5v$n|gg3G>L05A{*+^XVtU5HPqtW
zX+2-m>$)+K?%rgZln`~irprl#GN-Pok61N>M7|u3>b*Uvf&D484<R>Iug7V<eh&u?
zjzpkxh~wBOlSSYVG=f@Bk+Ln#jRC|LqdLL|Ha`?nJ`<Tf^#s|=MQUL^P|+HTazVaG
zT47d}d0~>h6g|6TS2&=usF5%St0M<b$n>L7Zi0@Udn~r!#V3p9Vfes@K3w6vH^blh
zD}O2cEHbOQ?~nb1pQsP%P_wbGuJxb~g)gr)q3`*9|44=Qj>G@+U;dYP&Zrap&;QT=
zuki2u@qaD+$Y1%7!yo%!{wv{gpZXO#z~A-z|C{w;eiVM-2mfgJK+Wj>qd)a;gwKBJ
z6VDwZ=7GKE{T~e9{eAyX_{7hDtY$->n2%l1R}3Hc@YjZa?7#cR!dHCcYgrrn<S+hQ
z_;>&Kzg{!LH^M*pKm4DCm#f42_V4-K6=M8`@F)MZ{~dpW%n3#ZP6u!yvaGNDrf;Jf
z!Mm#S`aOT}k1{I$PyfAtD}3KS@`w5RFMQ^c)e*io{H1^QPlk{FogWUr>mU6m!gu_R
z@2?U0gYfBJ{&;w~M%mAvyzXnbe}vz@yZhgLzQ6nL?cLk+x0il&8Th<UX0p4fduI$`
zHv@bAliRMtrSred;+HGG+4JN80lr)v&GAdGFv~xx&)&nAUZz9C{+2ZmTGwp+?Ag<u
z9Yn%|a8Ph~pZvL>nuV^PzWF-maJ~EeAF2-T)mkwB9H;NjKP}H6dOOzLQz`9yi)!F_
z>JO?zI9~_CKvOkJsCR+3zMMqrqMTDF!BzIS!dZo~m42d4+E54=1PJKptu})0;Zzva
z*Y{4U=YW!WN23QLUo(|zB##dd!qfWM`D(=`<imqS=nn>dm&d;7goIQ>c~La85SiOa
z{qNZdqd2;7e9%!`_lqYRskBE7&-FmdpbU&P$4UBw{Se7cth=lZRM1^JpT)pDh*RL<
zU0Rz0Y2%YMU_tz-4(AjThob`Y!E#dv)oDSGu_+L(Qr4K4ZcyTotse`>u{uiF*#kID
z%vf|y=@9Kp_52^y^@6(6SrH`#EO1=E6|$?E9iN+32t|_32I}tvt@kQgwLgLtXodVJ
zr6my-rG62z8n%&iVVuhW#=jtQ?N#H8m?sv+?gWB&Qhm-bpkAJjG1Az@8L9(z$pk!V
z@EBMf#GFZ6&%Dq@*q_8D>(*B;wzc9VUK=VSPmGk*i{Vac*SMI8<zo2C(jy_v(?G9d
zI9-XquX*V)!S`OR#`vgaGjKM)`YXRUKZy9o7i;$NOF#S5;XPme{_y?}eT1ZkgPL{e
z8Lkgbh0b1j<y|CM;C1}yQMh>ZUEx!|{0rfuKlZl?H~tqt^q+(u`<p*hYfP_Sdn7;k
zcm8IrpPhwo`Oe=KzW4Y4VEFSjOWHk7)FJ-xANv=o^ZT0c*Z$&v5YB5f{15%%|4#Vt
z|4aXJ_*ec%|8)54f8jr@pM7mT&W~0|@~?(B>M_H)J$m_Fgd1O~a1I>oSAXNTvX=Fk
zU->20^o}3DRBIUL%(RXxY&q2T;6(r8|L;$PPyf;{gx~xFe;|DS5B|5p-}{jt3O`lP
z<y*e%x7TgGtHMcd&Bu1t3A_mGw)?wy$9uc)U;ZrKzP+nxV%-1OZryHp-YM_<yBFEl
za~HT=^Ut#Ln_G7HwAMT?Y8HL;@G;@R2}r`(iIIX>A-`HLt?L27&Ad4~E}$rHeEzeS
zr!&;oTXl`U`epC0PVXqBCzww$wxfFPe6D7bSFaxeuY={HI-C`2OM!~&HG`@}B@B@S
z-TPwFNcUxw<Pn(6#Y1XAK45?>p*{W=wq}++>Jw)LhT`ZRNC^lF5LqC^78!W2(}LuM
zBTPjenqKQfhBOR2G9HWu!M}qug_cdgZXSZ(zJUPlNT}^-X+li>!c%l7*Nwb+k@<d3
z(+pLfLE*d_YCwgLd%>V@*(M&643I>$h{cLV&W6}m6~lYcESAyp7Fn}<c@d~+@vLSj
z=UJ5cUP`x40Mz0Xq8N*0<-@7=k<cRA2i9yBR<=n|;c7chYDS1a0KHgeWwHQ8by~<x
z5E0~>O`++VG{K%EK1_tBC`D$vRh@MWn!w~tLg<9t3HI!|=<!#9%JQhsVN)w6I^s;Q
z;Tv*X^`yS=tX{ce%o3=+Xrf@Eh#9>X8&A|tfGRTfqDB_=HQ)d#{Sm}Y0yT9NGy<SY
zVz?l}K*12HCAs>O8kX6ujgx0%p^B&3&44VV2H~&tfsPuQ2fHnbz3z4VxI%C>D><of
z-`VNOrO(#2;CxaI^#_*KX}$8wy#2fAz@Pi{C&MrN%tvb$^?SoF|J+Z9U;5Zjb6X)i
zZ%aS|`RI@Str`t2!q<M|Zw%l5+kb`c1+C3mhj_@^)X)6A9}R!E*0J#VstRL%$M<|c
zVZ5LE@xM)C#wUO2<KZX&?vI2gHS&E>9q6J$KHpWdIJONY!6I+`*ypaD_KepTKJ%&Y
zr)oX!i=X{;b<nSbulf3KB9!ze{*V6~M%O?3*Z#BczxcoYo8jsezVG$E`nn1g-Y2WM
zD-*lXk(Qm$ZZYonb-eo=&pVav?em-KQrF#of=EFYYh6cVomPk#a2Slr#g%7)$AIUu
z21OjWcn#AQ85a$9zmQ?Q@3GU1xyBta+%bozjQUH3$)qxYZ_t&3@mOua;|B|V|7cMS
zJ2Ixa){hqout6I~fD8MBV>!U^#9lo`$V%20HNb#M2+jh^dU-iihq2cDr|L*Bl^8Yo
zv$aU(oG^^v!Y9`A6fJwyQ5P9|pc)XG1>A=E&XZ|PMk0H5QEUO_J&T3-fYX9A$qy5V
z8}*zX0agTI&Z-|&sX(0ywL3h~_4lhR*(9_d9d@FwQx`E#mTuC3$pu9lCT4PIU4jF;
zsIm9ah5R{)AhhP>URb>dHMRO72r)R$RdqDaY8@&XUe)wy^_xXbgO&>X%jjRL2L8=@
zy-(|Vuhgvc2qMEP5%3;B0ff!n1M7{a)tSTb9oGz&6PxSrklbX>>QYIFtn)6->Pv+^
zU$qoN1XGRJWRl|EK+6%*^I1*ROla91oi&+~l-X!62&}bRss}4imK0G>7iM*Jlhm7W
z0BF2p#8bqFLBxZF1HOJ=y)jtXQi_+>nCS8&of@^clA8?GP(csE=H_dQ0M|$1+fVer
zZ@&J8a9SVImul4cux1{B)Y|t^e*(i0H1aQg_A}wDzwR5i+bb_-w6FWkFVvbECNZNH
z^<BU7_s|L91!m&AzU+N9`WwPG{-)o|Kf5nvbf5R}?!KP9{>AY5>O4{7`th3W9oH!O
z+kX4+Vx8-^{J`(8FyP<3bUgTj{UgKVJ*^86+y2Zaf0<4TuhR+{eW5zF2gk?ZzUTUO
zV8W~0*=Jw3Z#!Q8#f{$W?L&k&{dV`0eWjSL%~-Cyck2(Y{1cheE2zIdZt!3UuYB2;
zGswXUnb(t=p}$pYrCX_=!kQ>yt{UuJeGQ8PVpbbEu<a3FUI$x5L)*M^{4tt+2Wt38
zH6AKXRM>Iie6Gv}<iifn=Y#N!5r3R}n~-Q+ApI(%pf}8X%4LS1G&``&tvMT$%{I0x
z8&K8jd5kqnfG}-z%?yF_IrR)XI+X>pyqbx@=-21v>4@pfl0k~><tl<UVN8=CLC7qX
zdc22+9e<x#ADU{ds_tXqT2fYRiS~sV$aqNu5gE_2LXQzhRg&Wh)(On*O4t2<5rTr%
zQ6WRYb%3e_2x6~*YF?f6OEoM0RL!ta?pxH%b_quaNvk9#0Tevms8A%_H5}DpzvQN&
zW>1N!q-%E`Cc=iW&984(q|hg;cz}UfII&s^9dBaoAh}6uX6F2~eqfS9hfF~V$y-I1
zlOkb9tS3<Q&x5G+X;gg?*Og7*^<E!<1X2U|ql$<{!_57IYB-CTJ%9{1JN+8i07nnF
zpMbpsXk>#oMs(798fN`-NP)$~gTcg4w(8n*LW#I|(P|Ql*ek#{sbQ5{K{Q*^Kg<u)
z4bSL}CSmve*FXQc@a)Yu!`FY?cZ6U3`JZ9N^1FZkA0nIZv^uO0RA=(BpZsyvrx4xL
zhXoXNkTD*=^y(IuzhPgo>#nsdS2K-|{p8;ZfBDb+>F|&L5B{gMru8-9)1UYy8i_Z)
z@Od)-e(2Brd*RRg$v@8TBb!1d1{UJ6Ng#;Gu5;kHJ|J6s@)tf<v#MX^u^+$ua=7h<
zU;z&OgCF^IjKIfQv<I8;)#}WUIbJrtcbn+@zHV|1`#OxfomU7qy3uPK*?lv?>o#|D
z))=4r+dkX7?Y(`r^U8bP$L#4zt$!lpLOlu@Heh2!)vL3!`uA5DwWEH;c(WP_^e1AS
z!O6Yxh0k&uAN~#BOqhA91_lHk(Cc?ug}cr+?zpeZ@9&<FuEnzvY_>i;0z}jcdR$aU
z8)gg{%A!6WV9TWn=fRd7A1=8ez<!YLL1u>b96Bqj|E#C2gfr^ueJ6dxg9_ChR9Ne*
z+OB7CJfm2Ei$S#|*vH3xM|-p>VwnL7d}EXNUzCpyE6N0MUSL~qZ8V2#QL~Ff*u0wZ
zuwSZXbQtx48Vw*nk}^@_ug_S?g6>vOA*zAoqnfe2Tr<k2r)#28h1~z3rZr?+*%LaV
zG!ao!8ItVjMNJ7ox$hT4IIRW3{;2M^9^XklS2)Ti8w|^=E}|yK4>llwWR-Pr&4OBv
zhRI`AVE1bl3Nl9GAkNI5DnNp81!o8^z&h?06^dL@#pFFT!2Qe@-wF>Nbc9R6a9q?H
z8iN`*HHhRQC5jrNxoY#gD7B>CJlxC`vRN|`$=a+=`#}xp;T)e~y}7q+0&BCb5!5}O
zY@`C*b6}h0oaj8Tuu#LoNn-M4y|eJgWcx*VPUc<pJ15n^qvzwW?yRqi;v8M>7b{WX
zL!r1N+bAaKX~C&UK{=RKnw4GQWFg5CCDj5}P2@hKg(CB%M_^yGiAJ@*`#1jc@D(5V
zn(+HTq^Py5m*4%K3eSBrKmV1V{}?}iR*TthR44cAzv<h;AE`AbK!M*^Yf?A8@O>1C
zzx#WC4`G*|{_($CYY3+|ejgAX>Rn&<6(0(}?+^V`d=IcFoX#gc{xK3m;4D8^9q8}-
z$N#CCoqcuqAOGO*s>RzCjm9^A$8TYV1V|6p{c)|meE@Dik-yV-{#H7;cU2?vwYA0t
z^2T5L^Z$PM+$Vk|e8abW_l?K0uG{?i>a6jdf9`+#uZExe+kZ3s#^3h6;XUvBK&=D*
z!hC&qGuP)|&pU>Fjs0!kz0Wr8yX_ml+<p_U{b+B8bNlx$w|!r}w)YDH_Q}RLF?X`e
zcYWSKWd~FUD)vE*#$mWikqGM+3q>RQiuEltqks78zcsvGA?C4W5m;x~=BfrZ&)$54
z&(-en?Bl%n->7+goG8(YZ5As`1;chk&AUx_r5a-d$4iU;fjx%Ig-YzzaX>8`isZSt
zH79`Z&=Ia$k!3isUkWf9MQ*{=t>@L%?WQ<VdZ|=ri2BNTwN+ry9X&V*k7}Ldq#8xA
z{}6*8E&A|k&6HO4z4ZiXrJ-hCQ~h3bO4Sj*UXA^F1qJvD(bcTraYdB?)K@n`cn#|b
z>^`tIAE9Q%L5>}_cXYT2pfS*`4iXj47o3yAx(@1DEVTsLPL^&uN#kucVA>^0CvhAL
zeqU=_ss8)CIxyJp(~93cS{$-ggqd71OZXS=q2GXLnZs#-6Q3A791p!3u8Ds29MghT
zx~N_onvmGnNp-&6!7_~Xn!Qy^FS%Y%*zAp`6XT+7Jbnf}Th$#`=iQOmN9T)d&RJhz
zrfV(*5{82V&f9uxbso;@8bea_tY&k4ky6nD<q*zRlgd4P#ZzQQvDfs=;9jcW$(X_m
zweX^xj|Py{xTroDhZRyNd_biBn~E?=!j45kjm2qo@(Ad*q>CRg{X3JjNQ~QJnWacF
zN_txNcUtZB(I5Leq?>=&@BH22o4@n7Fe_=VH)|35lfU@$;jQ{G{>0z@;cCpkGkp7R
z{hi?(zx}&e%$|2x#1L!{A{^T<SBLZAU;mBFQm~Ed92e_<ZrFV5$(!Nt*L?soM0PXQ
z)EjKafB)b3zlA^a&;C!s_x*uCR1FHpn1+A*|M7pS@ZB>y`5*loe>r^5@BIVeAN_Ct
zv*DLN2HO4+Q}FNl-rpO(wH_-9o)<Nm{^9@R&yfbtYg?pnO#=dzlFb(00X+D({<FUr
z-c=pdw|v)c3t#;kzKNOWS=~m?Q@HPI|14<#_d~cXi@E*t?Y84Jzq;i&{>qCwu>Boo
zyt2(3vco-IH#xDl>beHI6vU#_x84e8wU!Hon6s0oY=d~Y!iaD{aAvzNWKwT@?$d;e
z05!h%E51rnXTB)U-gsS3>xNd9?UVYv^U|}f(gL*xkwMgF{@F&8CC)Hi7y5xU);|jB
z8(M-%N1aqqziXy*QONQ;Scrj0Iies28f!6~W?A9*b2W|-oJCCweMTqe$mK@O#!6^(
zUb1iO;AmMhsA@oS(m4BWupoG?!Cj~Y2+t7q2lWW3KtN*Y<(eHnDG1hU=2f9KH~};g
zZvb-wHq7eldITA%g7F**zM<RKfoK7VJ^X&7+CPnXk>TsP&xx=pNeuW6ODC$^QKYvQ
zB_1Re&=ruuZOkJ8Gm}(*^s9l<hhDZMr3{MUGI4;@6_j`01_KvCq-S<w$4F6zjt)?A
zP=)X=N=ipT|31%RZc@>m(>+jsE2>ovg>xDq@0DA>9hijmS|Sr&f<am{>vi4gI@L@&
z!B-6RXNiOk3T#EmZN(ZDOoMz3vb^{^zWU_?Jad6g>?qa?`>Q685a?9!q>F)6NH=&0
zTP>ObX54HTMQt!ACM(sR*tD3`FJQw@<6m?E8B95k!gn{5uxRvJAewsf9F)&R_#I#O
zf$&qm_-SSyS0B{-ydd**_~0l!s+j*#eQ*JJe8abYXZX$E`vc*x{>48V{`{Z*|MJ0l
z>D5=mQLTN!S)yqeeJx<xp|=aHJDm5^`oP1<qdtbFUA%WvoziMYCJA*bM5!<Y=XE<x
zSp$7E3m(fc>F#ibs3Sgn=@q^Q3N1(^=+#<T4vO&K!^eba;ph-aW80L1@<oAjT-Rs?
zup`7a4+#&g*`Iaz;350B&;z#nf>Ap@epI2P2Q*^QtRK|Snzgyf^j|j6*Q+<){+qks
zf4kqgdhGGizwX#hyydfd9>@K@|Dr4W^7crysB1iO&eFvD%Gwe&EPH9=IqNFdu#xbc
z9+^bV(2{3Tz4t>O=Gywi$3DunepBng<+ZT=4&d(hzWgY>=h4IPAO7U8hTr>@M|3n#
zFD8;I9#m%p_-gFYTr0M6DH3x9s)J#XCmZ2sAS@IUz>sO3)ieoN!N9C4vfl``A`%ST
z|8!O@>ES}7P}UU!Jgq3mQHAzEo<O$o>Z0d4QK<qmy@rkrv+E?iyg-7&Kw373G;(f~
zv<E?s0E~B3oglI}Jefn?HV7pk8a!J=b)rJB2NiCswk;<)2sowcPnoqm9HfK+=htQ-
zYLc><jI7y3N<@LO0@mHRg9BtSk0H5K@9AXH2M7{z5^4t09b}W1QN3AbW_CYLqNAhM
zg?$3T1C+Qz(WXQT8AoQZFku6ZF{`ibVZC2x8{Oa2Q96YneqbM96mIM@IA#STkf4E@
z=siRBh0N@5=(#Nl1lRYFO#^1+lxk4(sjhO!emII&Oq%7z+T{=Yx_1|)lX4zFuQNIL
z8rsE~DDe70-VPZT)AU$4g>q4MzDBx_F06VYz;_|Uhy?{`b)piyqM%Kb0jF4R6vm3Q
z7>NcJ>av$de&ei0E;VKS_OJf(@Tt$fJ~IN}ZViAWkRaMCnkrG#I;~OYDf?NpB{Ezb
zW!<<P|4)lVX&B2M2JyDfz2Cf}oU!{^dzBqZzuyU0L79Dx=WYAc=et|I^4ZS*_i<d;
zeSX*bUyASOb$iX}Hs|%+_wMoj-P?Klj%&aD?D_qs4gg517WvU01C}d~(#(sS0*0&W
z12u|w)%xp86>j?LAOBqVZSOk>=e2gho}~JP_bo*-=<0J%CNorcmJ1p^H05Nn+b5PP
zz#vS!;H%0)bRsS4r_e6oMa*|Xj}n#91K~z|{{YZr2N<<Fkm_V0;tDyWwp}_*!hMPT
zTMz+;Q65XM+5|>+2;Ja>WY|V1X>25BI~?>J3$j|NwzG;-s93pPgJxR<4{t%vs&4a$
zR70^ELFY$+pGP@rWJzffJp&GaiXYWEoY9bXL|32=f_-z`3LMZ%%)0>!_;&IfBQr@#
zidhS3hHyHW<EW@M52z7M*QCu$(E<=3<*9HSxEA#)y;6gKrz6OBHJD%Pnqvqk94Bmg
zX7*>{2|FV>vaFT?T<LMG=4Z-XC6Buj-=bJF85urW9hNnbLH73ea0t&%SMWVq;<p?g
z*70IyG@SYAwPr49ik(L}XIr#&oVc-2M2RfRq+%Uu*>Tnp!`G8lf$?QHKL$dS4Z#R#
zM~dkBMzb>qiPb_}bzt!FH@$9hWH-W0dFJM@PIY3rn@iu>l|;JZbsc%+Hi#?Uv8{50
z^DDPH#dz($uK(obeO`Bbx9xQwi163?wLe^U`!(8kJNJb_Z`)1?F9x~Z^tv3%yx2C1
zp)0&l8;#-0S~PUN>%iJRw)=89fGQbXcw;ruz%5W3sI?{zVyqd}7wh{4(A8SX5UFNQ
zh2pR3<H9!3OucX~>C`5x2i45kds+AK2sNf^XiqvgkTE<eeMNApA+9OW0=2N3eq3xI
zfICtXaO^ad_aP7;$RNRBc4~^9f>htdoC_3;rGh<49MwsT(bI?%>qjSW7WKF{6@rW_
z5YX1u5eyt>f?Cn0?)Q~iUV)U-#b(7!3Jh=P`88lFQ_rE$E-vKD)RPuFtFMdR4kM54
zLfQ)Sc$^a_(I=24COU%UvSX%lQqTXqW-Sv-H$4?UCe~znJ1mctGPz|zG3LS{m#8nI
z_QsGuOVtE)^fQYRpCiFZ$`EnU&g*%NNg@_ZNN`?kU&y4zbI`E;f}E_B|Ih0&fucXL
z9iaM!O=M<@<3EN|&Kh9cm5%qh2Z5q5x+tr9p-C%6(_7bTJ_^!Lq;Qb32QE8l3^Rl-
zIe;un9wd!OPe-NfQ8lfz;_iAzZH-_N=)v<&hSU3V((aShmFw4^R($%sM~m>*lkm>J
zN_io}eBY?`*X~uWedkMcyz$cC_H$F$9nY`*_1yDVOV~?}>78(1@wva1TfVd3tK9Ma
zy|4Ri&&wSri;plu<57i|KK{l9d$HI^tTc+kwP(musv{VyRfal3swvkRjJP1h9jfUR
z9S5?4&TTsz69ZZg6nd))XJRRW2P+UzWEvm|6$u|MIYC*p^>N@pFR9MYO7oi53rhEi
zvjl8^fKFbJk_Cn}o}wWb@a9Ix2m_qY*R-V|WI)~KrTX`0S(yYfzq3gUYaAc4s#O>0
z$b|58bfjQ0(rKoxf_vv4GuC^kMlThL6{Xy(!=_@$TB`q^-a&?=d&qL9=>SLr8vXwu
zN*SrKG1+{KOfTx1!UtgINIF&=J(4NmbZj*Va68YTVOZ__KoKlJnH~3mY)-wqom4!E
zRPd*$NyjQrcAk8Vx*y<0!Kgs}QYRu`<j~2H&^H|GDHL1iXrrbS=c1-R{EJFgMK=!@
zkDUsg8vdj^sDW!ss{g8I3!g7=b5c*;EJ#2dF#Q!Habu|sq=+C*GTM*AE7z0ezTg&Q
zH|62loSd)1E5`@KxNmwOUgQ<;@$NhMYEjkOeZ}XtSf2YlhIinM%3b?^$2R$2%U2`g
zyy!8%__@9#ckkBMJ9!`Obnxg0tq|d(nnHZ;X?0xHSv*}&)#ybv+hVe94{CJ@$AF`#
zJkW2)*(2KT!W@mGCJrJ(_K9TIQQoTcGC+A0jRh<iYn=(UrfzOANeC8YG9)lhC<5No
ze!(MR_#vFf$*8{6)^LpbK&Cq8fWf1n{_Ww8u!4ZuNGmTQMj#_RMy+iS%z6TYkFD@r
zojFEGAf@mosrhme>X6laLGZ7M8JW%skmE_cUT2dg6?Y!Jf<$5&<Zy9qfQaR&tcc@D
zLYavxl8VzgpkEC2E5M7Hqp76JSUdrl3L7O5GMwhpQH28WhaXGf<gJ<|L&z99ktio^
zNFveD;j<!{C!7>i_R){G;BiMX*m+&EdUYW;1xKy%DN*R11t?f!h4aE$bs}nT<`?l{
zuRi=>K}TjbNEYq2k6KLVq)tVO7wq^B@XCWybwo*vo;MJMwbisHGZEPoE(T#jG~BuQ
ztZ-s-pp#>R9au!Er$}Q*crn*P=0&}^^`sx%+!!0L`E%EI_xVP=>uYc0_0AZLcit@C
zwZ$*JIla7}`|R&aeQf2%f867Dd;daz^uJ%avwFvZs5>?U8M3%I3ZHpaBWKhpV9Bx?
zT_04NafsRoYAqRXVqcB@L{b6gI&rY1rd5nZjkpgXRfI%|1b~i)m03#!LNtYEt2K>d
zVaBD}4Fp@kz(bw>5!5%}=+4$0t$}Q5q)LPuoq;G3&dO@?8mWnq81WZ6#EzvC$WW02
zpCq$%$Ud){S;9%6ZVZ(N7-x{D)@udl^(&_w#;6%nB`T9?uq?8jj>5pn!sL;T2Xy%3
zBt6FBEE5hf(Me6=Y5gXs_F(0~mY;J%vg&k9Jm82cJh&cB6vK?JQLP3X*oou<Lm@Z*
z4xrI#Q!_whLax18tppkGn{|J9A8_k&T8g0O@m1JdPuMcD4k(B)NEsuj^<mL#k~8ir
z;91lUyXcx)R)U1UWy7Ak#J=CNH8Q%M&B++5tY{&~yR{X~87ZAgm4FHHhb+J*$>fEB
zn;TtN+iWCxGT5m_YZqcG@V5MuH1)DUF<op0(L65}q^8W^>&5!~v-9x2R~}G1@NGX}
z@4$CU`=4t<@%tFr7x`>^1ZA&p-1W`7oW9_L{hh*X`@C)+@s91>^}QE+?HQb0^Q-Is
zardj->+^W;-~U>^u3ay;To14b-~I3?JY4qSSKhjy(}3|k7&NvXLaZn?z~MlR0of2>
zEPMv1MPh)}+EXJia2|bPv=6E{91k@0j+cYTV?ok#2*A+`6_bRiS(^$P7TI?aa2+^!
z(*05}wgibX4eFv-pBoH0DBaZe3koT~wA;`LfW0RT!DM+N*70F%qb9wpxwjhU>ZFmW
zosG)aG~qeSGrba2(t8>E=;_EMh`x@!gGztcYtSaeX(tVh>^bwQ?xWTK;qZZ+DFFzy
zzsuf}A25>)Ha1GZeVo*OBS=nYSz(<?>LyDI18-`!2U5rx`3SvgiS>FN)r)nOH`Ni3
zJXYB5GxW+uC@%GKs$^~Ip0QS$BWq^}InKeXBs3dH+~cvC{fhgsD#?zu@Ln%<LKJW4
zKKRPPYj7BFGL(M`aaLy6;#5kEe`r#%ydf7QQ_7KEa<Hd_0I#T=x)@`WQ`20Z&JD$3
z9t78SN|48#-CZqX$$6vo#=LdDp@Q>!9v{^VY&G{q-S=VJ=R56u_xbLv@5TH5cAw97
z&DTx)k718vyXC#RwsYN=_i+LD+5dgNxA(DL^SfI&=s){p@$cBauRVzEzvKPx&b3>M
z;ePk{&hN*Y{|Tq{uIjX2Iz9?-oK4|#Pfo%I9>T$NA~a-)9Z(HDDyl{eiVezSG$sYL
zQOXz_LrV&#H4+2QMORwSX_I=Ang*i$OhQ2>0Roip?17S-EMbGbkD`l5&HXB4wt%=u
z3k=Su?DG*30o%i|VD}i*2ttIIjjW4=(hI&k13MCq3uH5^Mi4R#h0VDjU<{4e5anQd
z+CAAqj!KCd2h|r@c&fw)WR``Q)}vZRK~F74QT3qPuP%7)pb~#!2$K^z%)A_1t<rLO
zU9WROb_YA&dEz?k_dsT4nkPf^_%ThoI>-0cESeI1QInmqFI<PCr0I<yyikVO847|4
zWVF*HUPShNl?)g%ZaJ)G`}rR0lRb~6aQbmCFNZw){Vy+HLnP5sJWA-N<bJNqCcwed
zNIR#gfCU-R6h$?Nat5ca?7c{4j<mvGuimb}h$VBuwWx^d@K(>jS45i(^Nj>K<jtDW
zzx41yjoc2yY4!fk%>%mQq1)$sH~s7CwqC?(?PDnJV?^%y?QO>9wr%Wf4!vOSa-jPj
z?~S{8o1b6*n{u-OzQqXdzx|sxefKpkFYIJq^mlh{^UfXK@O?DNzx#20W*;4g&z_Fq
z6R$rD?_Of=lpGZt5Y>%1RWPYpw*E`dk|@=iEO*`R*v5^ngN3|lZ`=?ICj!<R`4{Lx
z>NIBx4rC(Y({q|G%pNi&7+F+s)(rWRn{RVC#H8LB=edB|p9VzIQ6k_jGPrOeu;*iS
z9H*mdI$+DCBB?3ZKGc+uC0$tF2zHW0jQ~fOS&t(tkQs)0TG40>ht(!_P|G3Nh9+WJ
z8q5obEr?l(CSsI&(A<lF0q1g7$~><Z{~>EUd)ht8D1pvvlNAKOIW8%>uI#e;13;qK
zNA&qml({POgzOirDdA~7$fMkxaCO=x6J6`vk2d-bhfJn8w?y@Z2bo=x@*kZQs^tIy
z$2qca2O}HT!RRHLs4lJxPGDu-LM#_}RVH@)g63zn;GgpJMHi76HRzG!B&m_0o$&Wo
z-=M>?(r)xpSLBpEKPKp6L^&^9+@nEKGavullj_yG@D=ZQIUF4yvlrqnBeBmbhTEUZ
zyA1u?F%0k2>(>%Wy6bwp6WhLRTQ7Ru@BGabeDXel#9iy;OZj>`*FA<8ba=OX2m`x3
zI1KN7`C)jaW?P@Hnbv2XoP`G!b9&c7rz|E&nFmG+br+7FkAje3(CM(8QE~WSQByE)
zkb`2_#{-un2&$P_&^eNyc2we8m|JXkF@8Q~v7cdhR<m(el%Jv<>sYL2WL?!_@>moq
zh3`T#itM={N7s|xz+#+W${^Ai6z4~cyD&*X6XWSfnBhb_@<3*t2q(&zdQlyTR^jvW
zBCXg1!fz8%F4)_%&02_8Py=ueW}vgC*1yUm#5Jer9z8N6NvIG(qO%BkM;<~Zfd()i
z;m#1Kj{jz@4X(TnSexQ`i2%YrEdM^W>*f|CIC}J#B}-cYA~vFFGE7jm8+0FVWjF0}
zXP=tWmgMd50cUENfdc0tHjQLjC`S@?Ajro!mDF@bq~24K?x08)aqba1NYWmmPFc}{
zq$8u#Q`)y3TVmR47G#NwOO{S`UMFW~;irBzhY!Ab93DP?9Nz!RaX2}>2v06HO0B65
zkY~)6zI`r8-S-)cA%s1eRQG(n{qL4rKD+C;;nv9b&fo6&y%%vL`@DDUcV56!@2k|l
z{r<1rcP@Q9-o6H|`Na#r?*H59=_GMBgl(`XqWlLnn|kT6mfyQ2rGS3<$vS-g=~+0g
zb&vNw7=)%o1+6ebF!Ix8Vo3nb<S3vAY0ZH6AiCZWRq0U%BzO^yh7GSKl3hS$!3%?p
ztf<R?HVzmNwH{0njuQ<wB4_H|c42P)fw~A3e>&>mi9v_<Q8ExG%h%yJ>?lT0Rt5|S
z6^jMs?1J_5f*mv9Ph>zPJfnP5t-}S-=*N0J7U2o<ii#=XTtU#t(fWqIKFFA`O=NM%
zs*-Indcj6!g4JQ6c7&`fO9ydN>rF>cJ>hSZv0;P>yaYzLAjKf!R~p<J=rDr`bhyIE
zVi$Js<T~1JBX~gegE}1MGlI;rqCd?{bmU-UGhxFa+eC5oB6Ll*Tp2X(>$<2Z9G7z0
ziciT192$;69tqj>el<gfEPY2334=2$3KQ$zD~&Aja+q*QW=s)X6DcBZPE_h9e<sy<
z$eKX+kWI>VhLS50Z@<whix;KlNqOj45dJDiu}w=Bt_&I`ik@$so`#QqdKF%I^dPK`
zmedG)_~?)elBp-?n7+Yj$JjSx7oU3!uQvyxsFYhC-`ijDhVPUc>QuKo$om<r{fue3
z*D>6@o!wWNuW`I%zuRxTNKkS8cisud`J%b&ZRdQ`_wVze-rDcj-l@Ri>Z`4ob`+>V
z;88_1d;zE{D`R*HX{OUvc%#;)(I)e9pDA@TbS)V4Xp^vodsNs*a6HPP*>)WEg5t1W
zFwip5pu$W9<^i=P7%)=9xvfN1b=s#sTJ;AC7kxdhwV2OQ^zq!_v!LjHRUOBnofi|P
zWL>|psJ52eu0u$&um^33YCuk%YEfd=Ype(UT+}xXi=fG9IFlox+$Y8!wX9$rCXmM(
zHHdOWrlIeAl*E*3RFl*{itIHIuQThCqTa^$N%hzHOIA<BH#QrGz`9$@f+q71dfVk(
zq&~uAwPlw<(~t3Yur<#~py;V;u|~h0dvGtR?JpZmt!A;QSiC(s+X}APxgMxFjJmIy
z1EwA>5;CaxVK!sk7lNbn%>_v{gcr3ebQ2-gNDjSIvg}ltH;dimnQWQDDW$@3yQo2E
zD`*yy0n#ZOqdLaUgrp*A6J}+`B_(AP=Lb{iw>@bT#>!*!UtT^MxWJ)K{JA${c=^F$
zE&Lu3V!((3HX6FvnJz_#;nH|<oo~5hKHYOSJMrx|pMQLVkNQO%Q8CQ1d)-@|vSHD2
zn}m{G)F6-fTKU7aopR~i;*LWum$ubDnB{VIHV}8VaM?)i{ySbelgr-;yok4DQt`_5
z+aBf3zX@0Nc-!{d7r5ne{ZaGtvi<t}cKgxJyCsGz$AA6t+;oL*dtLXNn_N?h;YEGw
zrR`t0nRv^#pL;t-tICKLj?V!hVGIUn)F<mPJgfESFmA{meEF!WXvsoztnhO%hNECL
zGTdO4On8tnM~Oj=#W1W0Ms*Lw(xam)h{kRBt>RN`gh>xajVX#Phya@Mb5PtEJ3?4g
z8b_eL+E7M_5F7_NYMeZd6iv)9dK9;fa)=ziMEh6hSSc0@V~y*uDKqH|YwMy}24qc1
zqPrW~v&=rH69)E)2K>pSUaY~{V=6j^&QA#F<3hev*W>y%zX0_-H5f~;6mzvk$~r-X
zy`LQ|2Ww_A6&tI2G_uy#03cRoR)8lvWm@a3Qcp25hW+KX4kjUI7hn{Eo<3zsf)(|(
z;ankO)g?(&jYTIxXK8ss*4WDSft7oZYR42c(~I>uFexXYc7<&b2w0*sqZS2O(S0_K
zMej}4?xUA1!YvUYsL(o5AQp4D97m~>Jt)=Bc8F{!3#~7sb2GEj%(>AyN`W4bB2sZU
z5l~M7K|;d+puT@xA&GN94C8rt>&*+MoEMxSBYZX(6Q9a9%4-i|lXId*AJa-L6huD@
zM^H+o)p(e*yb2vTQdL72!qE*O1ox@!+<?wq_-kLs&elU1dhk`Ugi8=+9_&n$3#M{%
zTW8hz#uq<eDHJoGTH#YpH%3KvWauO}j@u*3(CWN}K?mQd;@YE%v)R`#7h%ndwjCFW
z$u%wQNSdMBDuSoDHQ{b?=fjQd0t=sVHhf&%8nL4(9?dKYW$szw>Pyni430MWz?Eo+
zDG$y26b&(Pt?FTK_YvDevAvY+273oNKL5$*C8#=H(rd(8O>VXn6I#ZA>nf{eqY1xy
zE@(J{#=LVLT_~5FtCx|ZTHUiz8m?O%OsW;kD}$ragC~?{2Y(vQ7^xtxW>j56)eVXb
zpx~NpV>T(I_PMud4cp^tYcK1eR}>w?+$5{xP7V$Wvm?x_dfzgImmUq0PV(=^?8y==
zEvRpZ26D>o(b01b<9)*5H!<_NnDXpw`;_@SvKGe4>7FeG!-g76kaQ3-G!Q%{*U-39
zN44_6c|c+bK{lIX!Rm7`j&by{6Wn#Sk!>R*4|=TVZ_UcyV7EjfQ<gNE*noQsCq*Yw
z|8W2+cNTFC*KhDOI^%d{DPJ^aglG4_y<itveXcF=PQD?WgIHvL7oMdB(WoVe99>Z&
zQ4i?U5>2YbrP=8zfR$aJ%;2V$V^lUfILk%0wbmm;rwOF7E3%c@^*9JkoWoHbE<&n-
z3TAP!O`)#MoRldd^K1*eL<I)4JT6D6Jwd?;P&LA@LHl8llDAV!VwosdzE}?1<3^TL
ze1&j(SAGa$5G6Hv<1)UYYNB(RBQOvx0Rx`=FmVKeFkdl+CPpbCL>rP|Rp-P`@2MGK
zrl`|4#H$BgY#5S@e8Jp)I1fZqM`-lw)X9E~n;#Ulfdxq|E<6}>CxnmP&PR?b$*ZHG
zuzmycX^s+_;|9LJqHbbjeJ*xA7Y!oBf%5_sjn5Ym50?H)Lqp~a`bn~Ap&>>q;*0S_
z=4Ozmo9sx*#tGRNw?<}9HdthQ7O`=1@d)l9oR`-oN|-W-EzCI?3xNnSWUfcEiK49z
zA~iNZc5-UH=I7aQ$)RWfT%=yygQ25=S&b6OjE+DB_h<lJj4gvSBxED5o{~x9%Ii}K
zWof8jqmhvG+!D9<h|H-#RhH~Ef?$NyTEID^IYq)1*u#>nrb*5;3MN54<G5RJyS)Am
z9(4bU6<u=JxKPh1*Ab`+!G(^K4|ULtI25~a|6w4O9vKnMOal{a2*nt^?j?@x+yT%b
zVIJML-oeI3K|L9Ao#)Tt+bfRIn)p!T*r16=Rct&z6$%<@bQ9}EXlw;^vZArq8bobi
z6|x<Zu1938xuX%Id|MW=AQshql4m9{n4lxjI_6wH1OZvlJt3+|&zfq~%6v%I4sx7_
z^@K34q%`%3Qrve`c+D7{N3A!v7qKS3fZZ6-yo);5hC?h{KM$Naf>+e9h}g7%5zkQ+
zrG1*jwG%6C`+VYgh4S1PvK`F*I$W~R8Ed<YQciCH#3rk`mIm6$%^0>*GIHx>#d$=*
ze=w-f+@snM1QwF|%?2vQPjwwH!s)bPgDqx#p&v}^XX3qh;5wn6<1&k!OGPLKrzL#$
zkhS1B?|KOh4`X4k*%U3nOSW~r4)rr+l!qP8QP0&;lH5{jFMtTKOMP2eC<m&zshglR
zg%c9<TlKXesgy*ekx2tNH=N`g*jU_6EduHUnX*^Q0nj8R6kIPb81c+S`v6Xo#yLVV
z&^9gFHmZgy!Cex002i|6l;j`=hTnn)J6oZR3!lAjWVC0Nk;xo^08A3tEA^{5w@Vl*
zAC3&g=VA7=(P7<gRNm@YFlvbIbxa-x8m!h{6rBuxFYj9oGR9?(9>0Q{+XwZA6<<6>
zzRC{Rqfzp#ji~h+XEx)ZaUntgNySwR#(d<9*c$mV`xD&UsBnk|LCKa3HZ!9Ti2X(%
zhyEMsfGA^PNVK1}*&nff8Wcr=xEAB2hp4j?4-NoYCb==*-#eP-BFJtgkJ1I}Y3O8(
z5%I#{3aTw8<Up{q=g4qqjjg9L*DeQV48e{w^upSC9fR@xpbUK3DceORwH}KlTlA3P
zVS?kq0+e%ziY$xP79BVq`qDZF%M43&U33N>=k?RsfU&P8s~&*|7sY5qgekXTv924U
zT^PTWT|1$ePL6|}`aafWbjBW(t>FLL7@j^UcSLde5dA7NG?8!=1|N1#Nf<Qnq1R{$
zj?#d0#X3t02+tg?50<uBGYF8OU9s3+Xxs}6@SW~K(D)$+f@S3Og3*TJcjwHRC_>OQ
z1{_20wS)Dxu~=;JbYRq$4|>5dxEH5@bS$%k|HCn3cW4BL!Ho4e&Q1xNb7$;G^hG2M
znvhAy9Sqq6a$}u_K3FU<1Vf~(!y&9ygW-f<==H5PGEi{ntS_n7e(w5->hu%OjRP(n
z<dJ?|<g9a&HXxbKMwBQ`6g3|UK?scghVW!&nPhEybJ*!#!Vzzxn0-@LfW>1>Qn%o5
zv!-M$s|P$H@uMTr11|2U??iDgFzSKMlKO*wzEY>=WCT~7BwwT|0Z0x^#mu%71^#r%
zQ=S>u$o$cii~GN<Cx21YuXecT*vK7wp;qc7+cq>Kz%0FLd2n8=j>U#nC=g|~nbbTz
zG59VFXfXJ3v5-<df*LSFvn81%UzjYM9{Kc+7@IOF@Z3ZNI9)amfdaY;0<w{j6w@5w
zV;T2R!9DI(_M9~a3s435;Cl{VBZDv#IZz6hx)}h<&I(#n^4utFLrwgb^836jii(_B
z-~f+f&j$zIcas&Z14itFl{JE4q9{shjIE1YY{pi=D_M}qa_G5V(jtQz=XT+#At{;;
zj=CB&5@UlpWDr<XHGYgJQBauVt>BP#fz(t-Bi15=BFF-Y#UO()(?|{Iv6C`;#^{xt
zTN1fN9c%KI4Tga;#?}|E1@L>F8zg;AldpI31G)5+R|XGJ#no2mrbBfxob48lTm?VM
z_%bu?lo=D&1jW?F-Ruzx10h>MxmbivF@>2)i==&$g4MK7oKG|q(|dN(x@6DUk+L@?
ztp?u<j)w@I%T|0Z{SYxjaEc3Kp|&5xC=L*^9X`fl0B6Tq8lBZ*+lQ8&!PQ-51q6s%
z7g4i|a@x{=b5g+?e;*t?L{Akc%p64H4Rl!2=<K~lE;iCrWA@^QbTIu_lfCu(2Dwm7
zI_TUPc_M&8Zw{WvM*GgX=L6LxMw6RbFJwnY(qOp;Ir@1wgs8P&e6NZj=SEP74sMz=
zUs8D@v#Att+99t&GNH=PAZreVPHVyEw&R*d<d6Hegvm={#HAf5vp9<-<OT}2`?wG|
zVTJdG!q6Lp<G5I_6?)Lw>ls^iaqcPA<0B-2U}F|!HkEDTFzn6b=2<?QsFBxe2DJyQ
zK#1HTIK=e@yag@1bqjd0_M;@8qMKx!{DGia*~`>WgBTsONxW9sr~*Sm`Uv(cLB&bU
z11n22oXcRbW|~mPNAO4*dlUo;E6=IUDZBT|`~y+7=^QyP3r=TphMXj(JC*Dqm=hfc
zgU}*IBJB(_qlxQ-wE7}w7ukD*quHFySQF21;`)G?@1kGu+2r*u;yz$)Q3WMy@Fdxw
zzHTkRVuBD<%UigtLP2DcFNk;umZH<dHNX&*rHpInzT(xx*9K#qli@VgALNu81BOmH
z3;JLOxuJq$15B8ZMhk=5B;~Pi^Bz-1xhO79N`W}4W+VZ_#!=KV4>I<?7(w0jmH|`#
z6oIh{o+RG9=;wvW!YmeHQf-a#Mv-Aq<6CkwUznv$?4z09GQx{(aVq;^G=zzqUXXaG
znr0Yv%wpIYx+F2rXb07BYCg765M@zN%<GJ6$(mM;X4vdq3(0UsU9wC|tGPLi-`Eo#
z@UBYdQJJG6>%mcPXIOw)OmK?>APf%QOFS>aBa=+$;J|?qS%V;b%!u-r438XS@S|<7
z24FH=`zg3kZjCoYT9DAey<ZkV(VA>4))6mx5`47I#mhK2ljvM$N^`wu@LEGXGLME>
zS$omC!L@`T1<ZkHlm&G=29D2B5mg=kbS#mz5vpGMeviH`%@HFj0L*p)NGj?{x(G6m
zi=^=uAxQ0eo)+v31h8-F(!9QK4>xxFeH5a=C^V_pW-`LDY;{@&B!kD@%ZSi0XCWP7
zr)Jok1Mi<9yw1T89Bbl2&xYv~N&5~cAmzuI&9aO71_mrHmKr;PZDLyO0qfBEK4pmP
zJ@D*;*+#>Yh8gx`AP}`4K%fGWvE(x-&A!z}nGXU$H4zsY-wmJ5QR)d<b|M;yQSdq_
zP#6nI2SS(SNK-Nl*$MS&wc-Z-(uv2;bz0w33WAHGj|;SHwNcy#JRe!>evFMMlU0{P
zhR`X{2)WE;G{X4N^=;UTp=U6dI6b-Z*pjFT&)n9;rfaN&74-t8n!iYfV_otXlGfBX
zsSefZbXXItv*BA=*PR*Sq*+(YW^LcGE->CjjlCN?cNJ7LUd3gS(DWhAFbv9$@eggM
zW|W5m9UwkuAj^ke*Maq`s3Da-4aTJNHsNNZd+D{N+|$Lx072O#L_h+}(;P?w+Rm2v
z>OS=H(QAb181Xg0SKZ0@;l@8oEroODHTmWNE8-5(8Ez<%(KJO9VH8FgS2r#r0~ljd
z*$@#RdgD$15XQZC7E(%UUTYNn7PSUP$&us`^<$K|hL!DvnN2$NZ;PryTcV*R(=%H{
z5D5kJG~}ugjn*;K11X9={>H#NNk5HO0V0z&ii{wll$^UbUpyD=O^2Xi>}M~@Ib`Ud
zA1A|p%0xvWEiUj&1_kUX92cjehT!^^VYZ^;Cm-mjxjK9%i)Q@rA>`0L1r=#_j>`7f
z+>K0n66=djZItsX&RjY}UX2W*8mSA;&RD4@XJ^(`Blx(J!CAO%A-FLeixxc}glCw9
zt8gESit)%=C_U5S3p13|NLn~(5C#Dc1sGZw1&&OA&Dv>l#;&Nhmz`q7I{~Ij0+U<D
zo(ykAJA=S1+(d;eiLyprCiI=;ZU+Zxg~R>i5V*fy{XPuxQk-Sgf+N#n7FKrl-{gNL
zN4J6XJt>!CTNCSAX7nb(DTILAn&WlpdCo_Jf&@OFVGHrcyq%K=Xa>*VXw6Y(SV;=%
zG~`7?1Yw|vKDZ9HrgI7NvE$s~;FpXZi<?qg9a!}<3BD@Agdi;BhN95{LcegVMU;2K
zfL%9>u=2VGReULuu$c(Mg`~ignWXDpjqM8?19<eHXu5ijS%H)2kc*&fhJ+A6a3#?B
zVvY4)3vl{S+`zevMYa$}37C^ZpB#YToaEHx7}X#v0ovp&5m_Lh$v#M7L)Tt4t<G77
z#2*T65`&Gvh-Dj)<kpC*0Fwc@>*0fIM1W|E?E(AJc)yz>Q6xI1WPljC5SmVbzecOb
z!J~zsk><F5oxP~0MSPEBHaw@S-8RIc2>NyosUEJN(K5kVcVkZq!q&K~(aqKPqdvJr
zS*}SDpXQ4VDq}F9{mPdgyf)V8W{iTx2H$|<PVQ2SWBZ|Q1v9b{qu~d$hGuLmsgO^6
z-B5!Ja1dr};(!*nV8eM7{ha=U8J6M$=j}8?#9-*HvzMSPtA;VUHnTD5B)a<=(H<{M
zEHlHVH8?WrY`!I^XM+){i~gf)RXM9pfeYA&JUdNhN`|gd=W`CN#-=Dm(4R>ZSZJLb
zK2b1_7^hL`3{7T_T2C@GxN$?TV)<Z}pBQ*1x64Zjo<kJW$<Pl$@CAAzI>WiXtRdOJ
z1w%?5VbaO4j;;;P5ir6zqa8=AuKc%2(VHxsJR71-z3xBZ#<~sEPN-^70w)JJhOv23
zT_-pbQ1sUhP?`3UfOwMPbx_TS529frJgidFp2QMGk4co%Lk(wRhGevZJ`8G1MI8a_
zXwkArN6yhpnQGTX8P~>9Yv+0uqHNsvWbL>fS;?~JagQa>&=9tF5H;fnw&mFH_^D~2
z%dW{DMG}sXZJn{mpDa-%I&$(gX+aqkwNtQgtfFHQc!oqn#X5kQm1{HKu*QLiP&_s&
z5QITtj};32!=f6fHP7iSQ>q_&NFs?Ac-niN)8slbPVo@rg!$RbYI^0mD{eDUwsJfS
zG}I@#1${Es2)^JjkNU(Q1x|7444!g9eC|Bn#4sxjT1xYCurlQw^((0NWII=E|3Rk#
zg$(ov1y12%4Wys~@uXhslcJmq5zXX!8J>aTqyT~FOpx=zaUKqhExCnDF>-{n3X_6C
z1%-BkbTU1Io#2e7?`6L<=P<BO7Vz8J8hynjnN2QpFwD|OYkcmcnW%C~ay>K)P3Xkn
zX5A|a-HO2hC7?bh1P|;mvr#4L1x5u|Lnj6(p2?ohy9=$>1_wT*1&`w_i$6ehr6h6^
z>f36QQp>^-?PE(qw&jqP2;`8=0v7@YM@mG*NDd}KkG3<o@d#4855IEwT5vQNXVcv>
z21OKow{7PIlrXS>+ihzBhNwClK^jOiaOk9b!;;~HWs)&s-&U5vXv5+f24C#C@q&>!
z@WV+8Z!3gEIRa&j77TH*9!4jp=H*Sgh#DZ*2T7kaVup%<g;`=Um74Vt_YdF>OlHJz
zLNlYT$cSCFDmiW}2zGh<mQa;CwmM9i(|AhTv_;}<6WPPyY`2Sw?Au5fLQb*KSOZy|
zJn-bAt0N)oWpdOG1BizPi)Z7Av5(VSFh}NrMNe{se-ERkCdB4e8lk1ZABG{*7OM_3
z#28%H;Kin~KrLo98B#Lo0YaI~c66(l{jiwZvT74Y`VcL^tOt(4hsijT>q8Ba;yD54
zstbM{#44leIGG{Nd_2QQWEMxZp(7f=`V(s;$|5#KA0AYA3=em-bE05ta(|(XPYgPq
z6B=_h>TCF+jvWlX+$oD9TP(}*6lZ13D*X`SA-_<lOsMlA+CMzU2#i9Elm+Z0H5%0j
z@XOO|qYy+WY4y@Wub(b8!i#DjsmK9~0Ho;ng4uhfIBT|pdXxl@4?)i&{xm&3V`d84
zjD~Vhpo-s&^dYJZqlM8S8Ojdzd*|zsB%96|4PmZHlZ6+YMl9B%<l*$31=dMbyD5gK
zb4qi~igjv0oH5Rs?IJ6HWp**C)`_4Jbo<3(2#5GyC%bXvOcK}Ts7o`M3I-j65-(JY
z<|%J%qk6X_kitGGP$4?wfOx3aZk@A(7tqv44Uxos0mIX<G2l+s!<gT2Epxg?YNZt2
zA71mK97cM5!H{%unLuh4rPg8|fp(v>d(E7o1tlF!PEwL6Ff&7C_E|IqJ89J{alL_r
zfK`p49q1XJ1$;&lNlkbTJ7twv?^GH|B6DDQ9}LRi6~yZKTZg<w7DAYHY7sm&8wuyi
zrt*Zgr;XZR$U*4l8gciP?>>5M=(|f$pzzEz*ExzIJhH=z29Uw%W8<s|fg%mqrqgem
z2<~JUVKSRg$&rj@u)zs&+pj|=N!w=#&X{DhVZ4F=69&VgL(~h(tW(>;#X~w!)<}|t
zEW6nmH!t5ZN7{(sG&kx3H)VS|(<1C0{{-RSaOh_u#M+B#@-^$6`5;<gvep2>;u=&5
zJ4NcSZRT?{)CeIBr*3po4tFc6amYa_(+H*Yqq+9iV6K*dviD7k0p0(CauOFV&&!U0
zHLuR&4scBqjO8Ne5z)*XJcK;EoostDTqkP1g9a8(>oTq@cv0^SCd1P17?x-h<)dmi
zP%{(5NKRH+vnlQgV=6>bSMQi2Wda*Xbl;0nY}bv?6YwTQIPGjZi+tjc7&jM9v4y%o
zXJ@qxtsZFy-3i)@hJxvwlh->&%mY%vG2>5lDlZMoa0&uJ^3c>=wy<;*8)|m2QOe|m
zVv+(vM9r<vK^Ug<WLvD!qHGZBn&a*3_t3wH+Un=)!+bW{(IeBDw0@RJaNVN8-$}AO
znE!+f=GagvqGvSCW;V#CSpYU!;Fe?@WSBPYFd8_&!|K$IJU1yPx3a((nyrZQfCIs}
z3m6wR7)JqoC?#+*dVT-28pH!;emw&Ypgj^laG;BGf}yf=l}dSMSS>N5^Ms3<Jw>xW
zGw%_5yr3pg_xG^=hQp9L!DtG;dfGL#F%UiJ211H5++z75usEyNm{}$=G`GQ|xvZcd
zl}<d%nd8{tkRV&t@!z9sem(EQX_>YpAi$xc6xEZT=S7sN{c2JP2I9O+*4)D!<T0}?
za&*bh4o10*qKZ;=KDoaQ4+n*Xg8~3%W5K<*QD^`NR}8j^^z{4<pg7i>vjR>8Ie5m-
zFjl47g|v~?+C-x+CRVVaoLN4|P_ii$MXn17j{nqcQGIC&AZlfyiidp!%T8IfKs?*1
z!5vi;;3eEMOn-JZ$!GKZFD+hUQ)Up{(%_$LrjcqTZuG-K>yp!3F>dG~i_$p;t;Qf@
zrw(;Snx)J=VXdjNO;~Oooa>9wLU#9b??oKUFwp}JBY=f_uviFQbT2@I(LnKK)a8N*
zn}$<U({Pj<T63f*sH{8SCiN1EWQR8TV^(VxH#wn|<P&9kz@$%$FEAc<KyL0?Ydtv>
z4>lC(TRhj2Oo>x=Sp=04(!-=sQjRCdZ3U4FKo3SX#H<Q5U_a1w3eH@CantD|Qx1aC
zSVXl$W7``RRj;PLjbYGW=yG(8@BmB61=*6?hyfK#5mAz{SM)Hk2d)|WdVD8n6bveA
zGfIwu2DdMQXsK=xMYsV25D)x$QKXOh0}L5!1Ea`2gjE6eRamDdX(jsnYGhm;Bb{tg
zp_!Uy^&Bo%8)cjrH_?mip{z<#F8iy3DAq9I7eTcWAy;yo8XuuygD?<mtdDvYEbz(R
z75sah1-}GNLD2C{in_RsM-^T;j4~X-@H5sp+7HNdB*d$lF!~oqNAHvy0?cwSFv>>|
zz-V@p>F8tZdHgHWxgQ@cNHAy_7Mwc`eGy_ph|q?Y=ZixD^?oyoRhLu)8RQRG3&OQ!
zUzR7CV@yY{yq@)`!Sxh=4mb(&Y`tsMe*QKziUWIhI@jr7BnK#`FW^9R9bs3%B0Q+~
z8T54=*Lu|2OrzUif*?@B=Ox<cMUrb4y(SN5p~Z9x8oQLkX;eQEA<VihK+b4&>DJ1e
z;MgDFo^q&Ua>YY+psqRw!Q*N%VPKxkpmhBZ4jpTrweb4A6K9PN(3o5I^JI0wHHb!D
zlo<qr$>`&p;H20)i86|7euGgJNnA~H@1|^(NJ1MX2-yLy+Du-JOAdhCOlqB&Ox9uV
z>)}%8mKy=jHWCcM%|;`mlAU4;VDOpO^+6Du6oKs1yrG>rFDAGoBWlRB;QS#6H45_P
zv3Eizg#4(z<7`^X#uUsbQ_t&sZj*zBBuEvcor^3MB}Z_5Rn54}sN}+HO`5Iiow6$O
zK5CpC)oj+N$fT+I!iCb5;0vR~NuXwE#r(;2kH`b+w#Dxxqa2-vvmjUmyD5d2tsgKF
zJIG>!=6SNdVB`|)gf_ZD!i=#EdqhAPge82;?S(TVe(Q@XNf$LwQeUiBB(Wq7I})m)
ztO@bftOmNM=1XN+!PHPuxD&G^IWk;$=9X3&p(e4UOJr1e-8YJ|>*8)~!(c~3BOHCb
zou`ey!HjP0Y~aAyKyA@Zh+&4J=u#wzYJ3)*XBlNOv}Phpr^&8V#*Tst=qRG<aigO_
ztbU!99*X3^2V>V!!(oBHe(wP$-v$RC%m4%hCeq#oPoN&Pj6Dre9tF3tP7w8d<tQ>>
z8`Ja&*<~rQMc15I%&jog(ZPZP`_3<F&{5Y5GqVYOB<dwWutCR$jHig`(M3()X10O{
zFKH0olF@n3UKykVfVwV%GIeC%Z<USUUu>s$M2?5oHNOqUOKhYBfXN1@lb}5YS)moG
z>%&i>=qVh+LBnCWCU{iOqpuDU)MDJ5v(?BziA}-1A?pwbzaA2rt^q+^LldBQM7HQ_
zg8@xF_5Ds*S4#|#u)Q7)xitWUFsmezCK~csjrB#nmZ(X=6Ns3QRp%Tc&lOH<Q53KU
zJ{;Lw#)je08kz;Ifn}_Lvz;{w1x3dC{xi_h>oK5D>v*9EJec(HQhz`wZ&Oe5t!h}|
zu<?9=MA6hZ=Bhza#DM#=3TkyYW8hP-+o*9V$Ad^FXr%4o<nWv_E1d{^vFVuoNt=2v
z20E8CD!@LU<m};GN>FVO(BuIhe8JRs7QYx#_o>%-M5a|Vbs3Jk9{WqfVdy|+V4W?}
zNuiygFDkWg*rJ~SiOY_NoCvwH@5=Rh!r`n-MLNu`K4(WT{+mgn3J_ALXaG?Pz;+<@
zKzW1rL0J}Ss`a>rB7zg{V_$=$gMKi<C4@)A0U5fmg%7#~GrCnOEZuMhSbbhj0Ogql
zD;wul5SNcuq#{E}M5Tn}veU*vJtYLuFzvurXcMw+Jf8||pG+I|Sx(|RFthvcE61;m
zW=(O#z?2*I#Auz<k)sM?#B?pqL9TulB!m}~5T+J=#yCq1!JEQ3I<u6QXGE$dJ{mwk
z6-B9Hw1<sR>JxNg9v+DckIx`6g7Mr1(Kel#GZ2DFip~T;PP*wubZ^z0)E7d;-xm)?
z928V!T@<QxlVxvg9gE?(K3tGFSsQ=H!!8V;+$q&MqOuIeRCeHvQN||CF1bHV%>Z3*
zUC5%I8C;K3jLY`Jo<j1t2ai$6lD?YEa9TO@!M>=`7@C5CqL|+80)TEfN};|(Hs}aV
z8+H0GnAwW8mfWke!UNMQyAole%)vo$L{B!AWq_igN*ET@3$Uo!WXz)TBpI%#LN%-s
z6}9VqBcrSuJE(F1`yP`dX4LDG=m3~O7*5q3Ax+Z8`v<u9(S2`0EJGD^Q+Nu6iL8ds
zvog6?NDZ4H0W8=SAO-40P}|2T<uDX<;13+#N!Hp!paCO;tsL>1O(ZlN93C)YeTgH}
z)gSk;8oh^XB%Y|N_qa<A1T)9f<9eQMwlrt5%_u4=g9W^wRQvkxPhuERT<~5WR0Acs
z9MxP2<syr%pFKr}LP#zWI$XO(a2B+-*ih_ed2ovazf%qENnH;KP+n4b0D&2ZJHUE!
zFJcwe)I-qFQID#|4q3~S>Ldf<xx#D)&)xZiV-X{9ktQlOEIQ9=Dstkm7!Q+zGh{2L
zHOP3vvG0Y?IBmdyXkLAC4`Ey<E2cZxW$D6MeR5#D;!LYBtCYNYFmQdXEmCk%|N9i{
z0OYC(EW(lZ2#y^<8VEBWibNNCASE|O6SG2R$XN~4AlxjYg4A=?87CUoNA*}CRx|YV
zSfGd4FRKA|n^FB=z+b~ssvwyvG%7V9n=RP}A6eOuR8M0QI|w&Yrk8x1df!l%fW2DR
zOz{Dnay>!>tjAF4Kr?w%ut^)(ssFVk3mBj-Td&Ot0;3>$`uVyZAF24L0S7A3Ah^Ii
z!tYKmE|?Lc*2VfKdmgn<G+VDX(j)|7<IT-Fyi{!_lb^cr^W>WPMu`aRp6j$=I3v*D
zXcStDG}p0#G#tVj;NH@%${KWE@$&LDKsl7zNW%0<F^%emKCtt_0|Pu*Y!eOkqT3lo
z%N!O;f%{3@YDLQACRuv^&?an}QI=F=AjzTxE-*wbYdf(%DccbpRBW4^n(Rpz9$;a@
z2<OR>y=odT#)vScAhydvCwAPXs5_jPxJd=YeFsD9!3nB=02af81dosCa^<KI#*zA8
zSy*sRVoT1g0EX|V-IYb(l^&QfQ(Po!F7|Q?=tc)F?lKPzX<+1EVJ1>i1&>5S1;N=N
zkC|9qFitLGhwZlJZ8%~S=vk9nZ@3MNOwX(jE}4C_R)gMDXvI(6EN<GkHG>;JQ*&HF
z&~M_zYelVyE)fJ}H{qgTR>o}PIZ4w_k>jekmm?Iz#)a1<*(narNv7!0<@j8;0hc*w
z#*M#$V?$(Ic)xm)OyCsQ6l@0ELIDg^E*>Aj=vy)-s9_VLus9CRE=nRJ;I6NuVA@4d
z-%(+Ptigb&;XLYsl`T4wPw?*(sE_wr>+slsAYq`PSh6IH7CEYe)acL%CnGP5YG)H2
z3dWNIl0U1*mg*Wj27F5HJ^G}^@X7+m*E8zGGqwPe5o-sq5NnHS>_*_X>?IpT^aFvA
ze8=2#hAaVEcVH7DQvrMlhYU8|v(-7H?^Sh9izw(42!m!|;a(+Xdy8c1b|=wXuxp_r
zLh=eB%}m2ML^0Ta%$#l{?}kR#H>!aH8}mJYeLKN&iS^G+r3pfprDsi%L?qUlJM|?^
zjY=(Y35+274eQ?yNJ8nz)B~(}gdhfWR|Y*jjp;hC!@D0G)_YeovQ$VkfNcO_;$m{I
zUqgZ1e9TcG0Sv}^jobum>H}q-q{1Oo1R2$8H4-)?Bf1fKI;nk}tR_N&ol6&Z2FRcc
z%9w46nNh<@=1u|$c+Qyh@nNWrV&#d<^`5*@oeKy-u$z(hPm*VYjqYfe9M9>aLF6Mc
zVU0pT7#A5kS+F3QbqoIPwB9E?2N2bTiaypRobY=Vht=V&+%G1&J=V+d!9b*d^;g)3
z?7Casr&MnY&*Od+)l(1a`yfQcECqbn>tkkt9oK?d3`7j<KJ;pZ3LQ<i2EFWbwn2YP
zk~&@RHk+&UO%QM1feD%Sz!3%aW5uS15JOXgX9RDxgy4qP$(VG@vIrvr5@I$MB$}C&
zm0&v;HKK-d0UXi~y7+87rc)X1h!yQElIg#p3BJnsX$og#qhFKNk0wyGJ}PE-^}nd8
zT{x;*SoIi=4}zVH^o6EgQkT%&95H5)dBA{dCN&**rYED<1B(~Nv%#q$yG{|6?X^r5
z=ii3b;d*P~I<pPtx(I1eIvoTl<*=1$O03Uh=?r?CtR<ni---6E;;7aG9YQJ6Mq`G&
z?H6MN=;M*`>X|XbNp(B50!U{Ki#M4Zf$W_qBx-7dpt{a*v>LU=NF$_bU{rM!h_Fge
z6UVc3CWqS3*?R5CsI39A8u#_22PUevR9sBQcG<u>37;qXuw*M)sG%0{=K*INO*Bpz
z*)x{n-k<0;0rj8sic_lLTM#x904V4O$@^QY4If~Ql8}L*N=2(nntg_Vg86$EMVQYW
z3<UxTI8m#a=V}n3bOYsetnFoyPTk<=p|w_!RhG3d5ELvK7&Lmi3<r$M%52ocgR8~@
zq!R}nV3UCa#XhV-(JrR#c4V6A85h;w;sgvfRkH;gS*&D{4C^5a;LIm)Ya%4rbDf{&
zOcoi{Nmdf<0=;0p&Sv2T5{+1Q31N05%(&POD%rP}Y9@|a8rm=*#tqx`XgScXks@B#
zMOU3Av=N6<FyIB&d4_WPsG3a_otxT<e%@Q3BC=>0*IY#XKSZ`%6qpx?A!K1N*{scl
zMZ?JgM(wGH#Iy>U`n;-^;)o62)zNmygt8Sxbf3no)*iHy0Jis&#owIOY!&rIPHm<d
zM-9-Dc&b2l5O9;s($J=$Da?ATv~ARzN2{XXJi#nYC0NogDL5~xtsT`h_O7}<U<+48
zEai1j3F9azv4Haj44q7jV_QRK25V8<z<SE&H^?7kqe$dR7}>!yuwJdyzl#8=6lRia
zM*rZ;hp!bwJ*}yfjl5>BY$E|td0~99(IfZ#lrGMM05++0QG?x*7$nf>>TM88l*bJI
zHw{uuGj&)Ef1T;ZTLv2qS-oIGCvjgj#z~f{(I<0m{a%{-DQTP*-RdT_4*1@rgBZ5c
zOpRX(PD11fD(ECyI>mOQaalNWOR5n1!1i*JiVA|#+P<ThX$zK_6h1X|1rj5oV3~7f
zDyn(3Sw)<h8jHnmTiq|PuMYh+=+~ih4#AM8Tr!*qV7C@jWERz@8OAKdQTHOvb*r3w
zJg#juXVLU28ypv$Rd(JMGa)z~I1vahhZf9)nd(o`)<NU-I=_eLa3kKdd;HYMsDiL(
zGfk?6ustE^+Kej1na-aG6|JpL$gHyHezDH#;DMP4Xw|42M%OV)qwNZ+L48Y&zg`0{
z^lX67G<sx~P8#39SOEcq2}-ygXQP;Lto_&bk+EGAN%c_I(h^vMl_uisxRiCH0d_OX
z(?r5F1EIrFq>3Whp^IvS;AFZ%K^ZmlK+Z_PYqgv8`?3S6DTkT8yBV`vSY#}KZeUwf
zIj44CPvsVnkyNh@ZW0!Bqh39sBjcoPMc+T#0)-7?uO%rwJmtiQ;O6o&H|A4$CKSVA
zlWNmN10Z26QTIA9#eKOPW|bK#aFo`QDf@e1f)WCbg@YaZU2t`t*CHG{3_0poZ5lG4
zK_X7Bc}=Pb#hlHm4)X|;_LG5`T_JOoB&?tS1=k5so5niT%(7<9aB4jUJT9aJvElyQ
zH&v9;Eo_6}2ynjum+@M#kI*to&WK>_*^ib*AVLOIhJozO1%j`vdp{L5Mnu=fDX{Fo
zx=F~b4SQk@KdjF0(BoZD5?Mv@id~4-0MBuh-Xr!)a+L&-muaD%-#GG~Ay8S_Nj3Cl
zEYsZA%FEuVltLa?60HMdp>+{44cXpm67OQk`r#NJ*ZMV|P1v9hRL8YIZ&Tb+PjEKD
zQ)1TC&2)CkLv_t4<~f4IXE|=C8&9MSO9&F5@&fgpC4pp&q8(ImHqf;3rpfeqEW*B<
z7p*8mRvL&_O^;jA+SSzb1l6&PNNTR%Wi1wR6^d!ZL9DPfyT4rn0|@|BSdvE~i<8lg
z2<Lj#sc0)HCb8|hUIv%F6@G|H5FA8GzB3)UO5xTNr^K<;eHFuPZEzc-y@fF8L>A8=
z*%V}Arev=sDM8~gE$y@74*AxX5nGYG7^*XMm6^_<{vqqRQN<&=3qNWGjzAZ|uUdSH
zbg?;&RQH{CrZ8GQhB7ji00RrIbC9uKi8>CwK%v2+%uc0^6jv-M1p?8UHx3Hgydvz2
z4z7_RqF~?!>o8IYn4)@)*bI)kPF**EP^pNIjL!}uS{7(@05#C7i@vkUdVr*yK+2ej
zJc7YC&f)>Z0)E11je)|ZB0hldrH6QAgj*Ud-|KUp1WZjp8NFnJ0G;=k-7nW!;UICJ
z3>va)dQoZ+lh=J$vIU>xEF3UvhdS`Y`b6DtVNwci>_I2mJ!_qldesI$|C@~+a{WDw
zGS&$kJ%F<ZbjV&1!BBqId9u0KYq@uO0Rw4B`Jnz1l%XKHr*`QSnTbGV3W3c@T`LPk
zAJmnEVZ7Mn8C{@eXb3c<sTYGbPaU6o)UG0l933G>u|Y?zuPoGJk;HBrL$adB#DMoK
zSYf^>!f$F7El^cIsM=mQ0Y1qgQL+xBmXcY5_50_ekRQ}NDTBvnzEh*Tk)6)Z9iYL$
z%vI08%IEj6ULUGofV@&_hE>-Sz6&_{(7m)&ZAahX(9K8<&QH$PWTeGlHY5$w+$$AX
zS5g3dK}RVTZb(wkU@g^ws-8)yD>49r!}Rclspy)*Dy=5j*xpE7cF?PHb%Svfd!6L8
z5NAJ9rlxzE*o+PP&bk`bChFG7NY)2lIeaZDX<}_Dm&Vewhc<kmLa_Rys4ZC3be4*o
z9BW#!SmmLgi>B%c(Za{W*xSemG~DS6BJ|{1SdvkhrpcY*(qn6Ifyfn+Qa@^*6?Ibu
zGZlafZ@!!&6V}oim}P5|V;E`xMmHk|IW7=Bm=!rHCSzzE)m*FRPYr{mou3Ecxh~V>
zrLv=mT}5Y{8=}e;>GYX6GZxaJ;S_9x!|#F`k2!#?5hRrM=%xnIvT-n*DO=rK%8_u4
z8$-ICYi@+WNF@gQdeHT#|Hh0PDp5O<!~+QDObRMzrs*!J8C_X99;DF$2cd;dWS7CR
z&**#6e>tN=P_dzh;&Xaf9rL1d5aYn7ILl7Wz=tMFr2C6VFt_t*+YDhAVP?kB%Soc8
z;J|eF>`Wn-;y#>7*;0dr6-|UT9k*q~tp{uLd9J)qP~1-^>8L%T2A^uM(GOoTbrqLG
z!n)Bl-)7h)W5xB{iHM@}HVzTnm=}$jh<3!t7LGs{$K@?n9LZAT#5u60Wy8hm=XH=x
ziV#Ucl;uS)1{iuH5or%F(7jYQ09%8uJ}i6nZL%Lo#%!o-htG&h2y(){2f-@!QP3L<
zI-&Rw=Gj&3)eLHZSx<U~Hk}-6vBO+#)`Xo|@GpYEIBq0J?~oIEi)uWJUPP6ZYuX4V
zu|H0VNXqImZ(!4>6#X4W7NiHDLzsninx!3i-s-wV&(p>b7L_iN+IYCWJZgqlzib=-
zk!dwHEg>^b#!!~Z>@-L>Qv)62JPiRA=+R`SWPTh2t0)u&YX;c}v&f);JQPhpz<KxX
zeQK>8ORsqax|uMrKnNjYc-A*=at^kYxRFidHf7uFs5T_r=OvG464V(ae2ZZ5V$iih
z;&Cxqf3rPXE{Qbq7y|9dWd^DMx%7i}1tKXJ-IJwlOVh`4l4_24wtZ6p6&}3SoE0Mg
z_Y;%`qlGZ{SqV`SWI!Rzpl016Nt!?Uz<h;_Q*I%!=xx#P`(flFuyMeviNI2YJ_vHa
z1IbLSNbHs>?!?%|Vr*J;y(x=ybSMJi0S%hD)D$WhiTVMX3|B1Jr!uJr4G%av;Oi=W
z21+-m;7D7+wCh4><E>>dTQ;Y$1bDAcjR7dbt`2+G?21Kwi;NjyK*FC<g=|K1y&|qY
zh^e(9TWWNBKsIGpkw|C9NM(~w*O2u1D48Ba&=1%fmDDU<G|Mcye#i{l=Nb(Agifsq
zoC{`&oRkz<w{h*GyYfTvIRtCql`{9<X)s2hvBx!ixLnSKZbZ1~ISQ7#N?uEXg=NfV
z)sz{oQ6wCTYHhrKNfI+^b`@b~!)E1?aOz;TAfeNw0y%5Bb9UE8J}C1EornP~sxO9Y
zv9=C-IrCWbz^x`l!3(7vOlaA6hx<B65LZJh`+4m)4M%DK202AeWGHGjZ>sWZ!$1vI
z8*LaF<OF$k37}4M_LdbA^J8YkLA8e|hZ*jL!90k{`=PdRMtsYGBaCA&2gRid_zP+@
zMNX3aI7Jde>zx3iQUA}22rr^R>)A(kO&O*v2$=&lolye@Pm{KBQlYeDCGs%}no_1I
zgH9Kl)sC>Sp5W3b#pGxKiX{^M73!ekUYciE@m^xBM6pS+1{rYpc|PA16BmSx2+CAY
z4zk6N6}8NzhiL80qPbOA6GyRk4;)%Btj`Ez4&sgL(U2Q^IP_}Y@Q9Zd)R6UQgRgZU
zxSVTgUhnd15?A&VX+Cfk8*t0W0R!U1+Ir&{geZhTnwuTr@&<p30qo!(-xHu9@Yl`t
z0$388f~hAMorxyRg2VZYxv{F_3`?^oF=W?nRX=CYKUpx_#H3`zXYFG_%L))T1g!Y8
zw1NkbtPj14jLR^Vn^Bc1+Q28v5;affg@?s3d4ej805bsVXsLRk{|i2NW)N<oRe-zg
z!{FYrkDRTNtT{QPKL>eTP5-p?PEiN_<cEdOA_YEs8INM3hifD<y4wYyUZ}`IA9g#K
z-PpT{5|M4eu(_y6d!4k94wC5ds=o+}UvwH75*;mdZgLgvxK}n<)OQper3ME8I0_Dk
zn_AqHNHs-tbXYO|X{Nu5PyolwB6?@Z6i0CsMV^YAo3-K?;h^3VBoTAMCT1yrkURkj
zdY)()0%5L!krImgO?GQ8lH#Enh3E6Zi7Ff?)AT!Mr`d*6`>hY@^1wQVQmw!y;e>~U
z#;I(IPKL)Z8KQKsq&ll0WM)2{AT$O3f_^fgK*6}B7u~!Wo8~x1lWqX3fR#vQm+xmI
zTc~s<N3tg4O~#W`4NCT8fkeoPL;Zr`&?uOgS%&-DXzrZpmu?%a4qcj|64p_ZjC`wQ
zt`LYggXdFK^c^UjY|QYL0Id`v(h%pGXK*$=IOuHmO;cyJ&hQ!Qd_m6S)HOx0BsYc;
zs07b|srSgBiHt+IGr;iZh1!feu(J(09b{~*+Bi$U!A787Cs;6&wFsky%%LgA;Ceia
zgGSc`2_L{IAtN}Aawcs(Z`?P?N##)}4@bpEDUQIX9dxRJkY#ANpNCxcf$77X)5WIu
zKx2sD1HD`%9(5uj;rUy*M4|~0S;0a(N5jN?4thJfAbW|+{}wVMXWjVDd0nd-^&+{s
z6KhdYQ!y)hBpC|*bj}(H<0U!S>@`m~*!qcsncuWA2uy1xbl5K#KrcLP0S<J%R{b1n
z=ptvcB4s8R^qD<b;<mK_`%#~k%Q;c&u?6Ew4zzwi9-_$eq<cj>=rR&XQpNtlkYS2V
z45BqJiD-r3b#1$>-$;Ur$W2zcfutzc?z^ve<><B6@Y~oceQYy$9L2Q<AT@~38App7
z0fmG-<NK{v#Ge<{y)??+jIp+rvNd{iU@;ix+cwlj-L25(f{m_mVDHmTfsNxMih6EZ
z&j=eeT{|ew0Hqz)BH%5VKod`uv2c_&@Y}ACp|~n4@^X|l89|c&$M2-dY#EkfVci(R
zw#z=dux)!-6v4E*Uhp+zU&g}X#37PFHY!Bn)#5yylxBGwIs2_3uaew2-yf3=l@SJI
zG>tZo*Fl8{fx9<&IGV2B`~KtPvipzZ5UmgB8eZhWYQrf*n5S6>oe#V5r!tH0N=-#l
zK23*Cnux)2FVU<%ZDk6{*-oC<O-^C{9iWAl!7|$ezHV8eE+&hHHh3nIUVUI`Gi-Nb
zwqe&;nMp<~Mz5Em;e~9boLd=MzndTKQf65kYR*yW#s;CZi3`r0D76*s;IgEsl7c?g
z2!afDEL#CuvK50OP*8;-W7I8{bv=&G=ClqWDYP&%ve>AED4M!5A5BKay%8Hsf#qR>
zQcIj8Y2M@D)|f7th}97aLq-Q0`l$s74x>iXpJzenY{m_GmNqdv3(|sMEy)Tgjk)>2
zBVsm13w#}{<LMgD<SdVD$>!{1Cl((yMLYfm4q|Pw1JKz)@5ZxqkyVo%N3{*WX`n|;
zN(~b7W&O$-|3Ic-X68UPYZA2GCb2mj5Ifg4rv)o)6(ZrJry~VnA{ut<n3~#=2Q>|Y
zNOQradBK64cI|+jD2{Fg9asxIW^rphigEy~rA{*nLN;U8^&~111(OHYrdqb!2w!Zg
zNu8&2_{8StO-_XOVbVnI&aF1Q9<f;(BObQFeD*CG(bQNrwofFgMcL;Z1*I;T0ShfE
zwwGAjcvjc8op9z0n*2$sM%dO@)Ebuxw@n5o&6(5W+t!MbcDFJzU9|GFNDnQ_q7zA5
zM-<Hh0;7o@*0McxLPgOAi3?_#L>uC%8NgEJ%%T_u>{1h;buUqF##((JP3giDsYIM;
zhSHHZAr`}8*$)pJAV)P{E(z~#i2VmLj*7B2-+bQVvX$rOWlCxT-~*o}cuF}I!)D1@
zR<J`S5ur<SaNy0%13fuM$8tLw@+bv^7ReEVHXDu1%%mV9?=ap>gVUl4YUU<sA$n2L
zKq-Tj{FS0gLKv<&X(U1jP0+UlIr8YtSGAPj`zIKa+GT+_6P*?6YYWdi+vGBL)+e);
z4m`0{V;QzE*>*Z~py8(gtKq!lH3C9Uqw4pub2OfXqZ@Vr>41awk_!Fof$EY4N6Re1
z(;f_s`A`r>!|D6e*$}{};$BNRByt)zAzZA{D20fwMTmxqg;JEciJYgNn*xp4r|LYD
zQVGMgPPB1O%8i-VTGk@Xj9f&=jS$5-%1I1LDSr#1q})|0jJn|ndm4F=N~T%mVsS87
z(@p`zIg8<)>OoNwW6!dN**}1)h@Ve58#ognFqH2qmiO^lkgeLO&Ihs)GJ;1@V>18~
zu9*cTLZ<B=pZYmXHj2Sn0k(S(t*mbLEFHg%Ij+N+X3CCRe|69x`veC(b?TGC<41yr
z9y-+@-9yweJqA~$l?dWo*W=nR(j9DdOgdl$hBf=)x~soHU6KK6R9%l$8=P})*>`gQ
zvJrTV{_kM2Rhu3!Vp?&a7c^`$NhK&d(@!3@OTv)}Jx#}zcE-V>1fyDwIofuoIp~!h
zsgi_+`{UT!Vv^X%3E3Wh65}i(*T?o;sfTa!{c0n9@P8|3l~gPVg>Z5Rmf<tJctKlO
zSc64<c0Fy3l+^Qi|0|Mw!mGDY&i2NNn0%U1C+F?Uh=ooA&2Xclqq~x~QNLMY(Kmul
z#M>DO7ZkJef}=iVVQnr84P@(!>BI`duRAxbF(sYU0395GHbv#8#LaBL5J+eVWKfSl
zqj@8<S<%pRPEjK}wJ|)9@M8{6X`4capu*POEnhCk>Vjag3ht16nS3o&I8UDC73Kkh
z3K|TXW{un)TtMA8;v(t8i;9X3cGDY2?|p0(cKfv8f_|2B6b;qX=@tkCMRB7a_=Sx#
zp{gjjOIfX;LDtcHtaN8d{TaBnT<D$0dqk}vjjJdud}|P3bX`K%f7z?fP_pI^wGjrC
z7xFm^xA)rYl&LrM1k?n{MoL=T%cNdDDu1wFPO#~cgAt>fDz(NXD4b_la&7h^;H8ym
z`o(=tl=UiM#_I9?(^2(T!NNLsIIQDA=W{X!tFQ<{iOzPpHnE-1c}#`_H7idnQ=IEl
zGB!n-@0e#21z>E#h(l-eA=(-1UW%%rCgIW$j+o|5r`4@x7`1A~AXqdz%I_TTu+|Mj
z-xY7Sgk))~$s=Uiz|8hs86c4{w(--{aP_SXu1gXU??mpR6Go%-T20&y#^to&t}|?>
zK#<T~7J-Sdf3J**YjZ|)TrWlj-lbV+xi_jHC@eEzL-6vzHT1KM)Hn#qdTfh;xfYPM
zbsg+*lAV{}((}^hTger$*AWB+aFjY_q!d9&x^B^dZ0GNbBJUA2K|QNo+6Kx@s#6SY
zT$7Y10{ggD6uK7Mxsf6obh|~54ZkO~sj$Rpa+E}%y`D{KAQEHLg+Y+*GRwhe83Oy-
z4r^fuvk~AlRat?%vUtO`p^bLpN)d$YF)W1T4bifE;2L3Pw2YZsQu5P%@Rfttf<58F
zZ~~o1w9_g(bq1eMBO35}^deITI+z+hC6-rA?h4n+VP<2aIkkF3aK>ckIr(I1bffUz
zu4{8w?cDIaX*5B?%qFu_gt@nVl{7ovHruM0krYGINK8(pg9om4R)UT+XlfePD1>E_
z{E#3Zh>s3Rxt#?OCL{fIA?MTTg&~DD=ce_WY#bfsQG)?lj2wD9ec}0IEVF9;W<8Nr
zL*|~L&Jvs<yMDrDTs)A`#*{V5UXGo`@hFE4mQ-<2fgph6A(CX1_yuH0o((qc^l~IW
z093N?I+J(ItSUB&qhf8`|79m>skx=Vk2Kkhl!u!5JI>we`#F;gHdK=ZV3UjC=An`n
zzif@6rtqU?(V$2W4Wi*AKJZZxhlE#)Y7<cq1)#IlB;(u~#>Kkx+K-K-RN=a@W(d|C
zY`Sh#>BwSLYT9=s?8twQhSW_sn5_4R^{Ih<a;|`=*6tmI0a+wX%jLt1Yg%s$q>oM+
zFsa_k8m}X1W&cGr9At07Z6VI=8xxpA{gPTJsI2cbL8Z6g+NMQ|5k#SZ7fzM1FC4-s
zhVLdiT5l}B7#x@iMv|bhbPVCd7j2!nmyJ=p2^j0x0v-<~9E{i`H`aT-seaj+Jf`im
zXR+184_%f3Sq%M{(Lr%%yTsl#sFK6ccVZ^u+^Dx$%w(k<igVV}2i0s5%uLNWCDF>7
zV$V3q=#l_cqE-D(G)Y1Lm{D{sdy-9p6=T4Vw?iFOw@#j-5w=-&Fsr(l)mS_?YZ@I$
z=~+B*PbXNfo7if($-^4UcHnN&q;b{F;v7UvIVsL?B?%v1CrZpj@Pgwn{;mimstHf}
zvTalJGz$@9L~dz;K*xG#@%<e=f3B6SI+tW9;T46H@L3LQG&c<61;0~bo=;90ObRWP
zYF?TBRndjEX_`~@)S|VZFhL_xT1_L_$lJl~KrotaT;|U^7bc5q8_C}<j^MW#tCY?a
ztvKb6nrp=#jMP*JoDCYv)O@ARY(P1W$@}5OEuy)1y=Fx5!7t5tN(!raEcsJG8?m#j
zl+TvJn7*)y#13Vi%-zi76N^*MA2%&JLhXEBVo!-}$p7;-ONK+HEQVPNHd-C5n_-qD
zwpU|E6*awfzKpqSH3$W%$mzqGF>-QnF|>#-$k2J&iF)7eX^ft)q#`jEV0I))MySvS
zW)i_Q4Q0U%LX{H<C4^a3rGzaM5@_iNNs^IhqX|e!T6lt38I`vT(ZAD(hd|W?)}eMt
zAY?m6$AQI{D(Dzm*1aZ^O#lndol~L_7r?1ajX=_1o!|#iN+w~~nZ!myku%AS@nr{_
z4S#L?UG%Y?su63ZWpg5NfbQYQ=kak}r*BTWQ6MQyX8gq#fCfd?+3=_1&)^W5*PZfR
zV;e)n5JTCAqjuINax`ipa*M{?r&$#q&nxN7xlM%#E+a&eeBfZHky)hFpAAEzxx9>;
zu8ZipQTsX8eRlTAnwL7HQH#c^Kf!Wtv4uy>42fs3mue%{Y;+SXv=%YKKD!>8!W{fI
zx>R<C-uXe_9TJOm#h#~J*z>e88n8)n(j$AZOyQ?fkVv;5W!VR(s#DlX>*@KjmGK%-
zOM~lES?dkIYh{X#vS-ThXb*zz7*VNh|5+Q6GB|@QcGzuwkh(v43P&`0L#SWq79|0T
zY}jNbW9vU<a1_d1>nG(uM2a(O)QW0f%*u-F5dH&3YCn~^5*6%2hEBm1`{7)tTNu4y
zjcaBCg)(=E&+fwpGB_RI4)+UY0v4Xo#;Fu>V{g1^>Is((Go4zQNp!p~?6);uwn)7<
z{kDWwlagVZ%vR|f$%NdX7+s9){xWm>>^$OZNJ`59)0Q}~Dcj;}w&TNMW&cJ}L|iQK
z!mDHw0UTy$Ts-VV6WNPIm#{I|vKl3e4Ee%1cQ&}09Jxz;MD>ehN}-J<kIs~0yEn02
zzhWn>2Ua+<q9O$q>QUpcz9b#HVB!mm_Ofduvjta0>qUmtISLn9Ls74Ls9Xoixz$w^
zNc1Mbpk*QXKCdlt)u5J^g%-mZyx%Dq+O&vj5Tt+)6^R@6@Nw!lifYMrDk{D+TbUrA
z<C#l@PqdaKfh0(Ha$_T2qm44okCUYhmu##GPKR6E$R6}SJ?NvMO=ZtqYhCBYU}f5^
zz8a0wq_E9s*v}VRmMl1&0U9IJ&i!RNuM4ZUU_o7EtzY#Q30}kZKn#J?dw>x<Q}N0d
zl$&h)8cUeO6bA%z7LxVc3}#jWqNV`!q`;KHfP3|l9#-~bDv%M|t04u!_qJVAIui#0
zISSsM97ISbQuYNyOW^p2UYQz>=`adW8N)XFA<~oOU}kiO%ulT|oZDt9E?M|GWI<l5
zQDZXz$uF#-nH;zduI03beX@+r2xc%HJ&VgOlN!s>{aHo5hR8gT!L6c*7p+&6@VxCA
zGp|n1HRp9j)g#9_fGqR$@YsTwW?Q>7lj7#%Y_<PZo5k-Y!TtFA!h=~k2_q?siw-QY
z9>n}q`9V|Y<E$#O7`mBQ(xl1gkXSwu`GaIA2PLDq39+<6k;TNL?U3Nc5~tPkI_dnh
zuve@fW^xq~DhKYZ{Ye1|9M`*!Uvu8#sJC@GE8-S?F}aDi%ypL5`OdU8Xs}u`cDr=J
z^gO%%VyLl&8B{QLrWX9WVu&Z2X-FBMtR}w}k?UrrSvn;6CXkiqdQfK;p_+0V)+~d^
zCP*8j_S+^|GdUY;vR5I>Ng{eb@c9qUTH5qeCg@2j5Nfm&WYKQ);G!hYG;30;=7S|>
zPHfl?5|2Gdy&bhkFI|$eR6th@C#r^_bJjyOPY#YIsu&(^L2iTBvN~U7WV2?9F{<k0
z&Zv?GDa84_uz$8F1ozAp_uU26FIuU$$xor5id*t^p6pPYolzF-?K|Wb0wLp&opp>^
z0f^*$bg$Y2iv#b9J2YrVyLn_z)7FFY)wJVY&LdjlCbqg+@w(81Nk}@%aZqd1Mk?C@
zY@ESE7w~1M-cFvC7ChP>M1fo^9VMzi>u4sODAN~eQEY%iXy>I2UqRMvkKGjSUcan%
zlhHCeB??Yq^Jx$i1?ZZcM2ym-`@&i;P`hW185d`nvNoWx^|XODkMp2XIN{?qxKV3d
z6QaXb{U%uMER>l*pphTR$0;bEtuj%t5H4=?8UU<#*mO`sa^0@2Ri{F@4xvqLj&l&#
zrB=7YzB``xXy?r_8x8<k-&J-kY;piL8NtE%f{?UvO>)__U}y6FEi%yV<s1mhCZW$0
zHf|Xu5r^4T>rkxvBPcF7vuPRVU<xWT`Z-n5eHTec=ZzqVP9&fST^Zy!Cm7bGjAnLw
zElHsUv)crxm(H{Ce9!fW+Y!$9(X~5g<bo-@F0;xD$~M)mG_fyGnO<|8jNyIcWKd@J
z`#QU8B_R<*tcp`K;FKa4cC;Hpr)5r1k~7O_L55zil5UpjS{BL;VIDTtd0}+M(t}Tq
z{Uk}lB{l9+>@}vK)F{(-O4(AS8<C(zXQ^c-dG<_lQeGgW=BF^TYDAqcv+3Eg4a2N-
zz#HHiKr@;xi%ed;%pQyd^Fb-a5vrop;_mX!(knC&N!g2hKqN-b>qJFLrN_FCvZxJ-
zXAc{wv1Kw`mC3Sd%%6p8MPOrr5w&uyCYX4_Z3uG|GfS>2G&TDcWBV)0O!8J53vdM`
zUOYF5qq>_j31yDLc(-D^A-Xqei%_=QK51|*Yf(w#OvHvt^PDkXj1XENRMcnFw}+%?
zJE@awjj|>eoTKi+;Ot~_uNLQl1ve1;T=CEjNstiE4Wkw|7V(^tf*cSoT8&ECao`=D
zT0rEifH-;)sVAo`d7`s+Tx&Q#<wRI%9X4f)zTKl3=ID}FEL#E!q>-ZLSt$r?RRx+;
zrreI_wT*^22d`<=xi(P`KIDiF5H=yR$mkUm<jZ^L>yEkz;{rR%Vx(d&*!ww<8ovk)
zn)Dl};6HioP;?p33*n>A&ZUt)M3y1JV6Mq*Grp3-mTDf<Y@27aME9|bYX1nNx=$pw
zK%D`vO=zk((ozIll8W?QW41O=AS2%hV50JC-^rOoaaltQ$5i(-a-7MAZ55e4n<2!R
ztsLD`N9niVtTAXka<*TPR^-M3FHwLX0uG<%iVsf2w<l#(6mHh+J&qM>0flQZ#SljC
z8GaIYPzJ*W?8y$gh*-vSAw^GZPtHISo4VJy?hgFO@-(Bkv4o=`zPUt{9XJ|M>N`0P
zP8Fa@?j7tq37AGc$D3k^HEe^SZf7kM>JCC0k`ah0Zc9Eh66UpwtZ<`o-m=#YhRGwC
zB>1a0K!<<%;I&Y8SWiWZyTNF|p0}Hgh>GfmHaJ`hLDDX4X0zv@A?>!qBSSE=C&oD{
zQ!kWdPfD2|U|lS+d)foZ1>mUAB@!6~&+5_%>0!+~y*4dc51~a8X3Qi%WLXatZmyVB
zs*g}qHL6#F`f4yz&NeYSCwqY}8s#>|Eu*o7xd7h^j}+@oI(J3aTHtJ?u75wH(5^BX
zIMmUsDN;YX<l58ZKCWVzO&5E1C@~mT&2talWH=WMwj0ie(r?&PlQVH_$`z%ZdRT)e
zoec*cGi^kWPipN9Vtr{JO{kfXBr~)|pKoIg+yEQ|!-UWPKp7oUg^M1jCY;Otgfhd5
z2pZV;f@_s5+MHEX$H<oARE3cqzL#7Rv{8|Iyr4L-vYd64<_IS<DV@;<jiy&&S}H7<
z-L@9fhLPX0WMwIxR52KR0|vrqoHEg|_8uS5Ib!V`OzFDrAPPYdyy}5TtU^2olhh^%
zy+qY|sE!cD!X)dfS?f*=u8{NWsH5T9rpzFCDbK+bj$>^vmkeo*K?aOY7DfnbXwpcT
z=A`f%9ZB~VA?6y*$_xp&n~k}ilu<<ogUR!>U?)%4>Yrq00io#0*;~uBon7^Ix>3av
zvD89i?<y*W`DK6CXgwRQ35_?wxo`{$NH3Ez5$R)gmgq7uYn<kKIc<vJ+~%-}2o(`+
zWPrQ5pX=Oc6V4^6A485Vl&$!22qtgD`B`l}r@W?s@JgOZBRGa8;=o{`GrT_O8Kj*}
z8ixW{d*N<bjuf&}B|V)p{leUXMs3e*vASd-@2D&e+ue*R8xX#ql<oB#{}Ut+mbGeI
zQjuKJARRu%dAda`TVZ6{?kGE_*=ZgbgMExncz7AI5iHpxmJb}rbzk|e2d~XhadR+H
z-cf~J*C#~hVDvkZfmUX07(0VXLW4V^AC}UfzMXVWq>HHRJ8h}&4dQEkSE`wqhV9IX
z5tJQi>o?${=*&Jbb-OqQO0EAV8sm2)uT;Ejd(9jH2ujQ|RXr;d;KIRl(c-$8AgIp6
z302U{ZsZ-Eb#V}4FLn^FTj%TpI6IwVi{!Et#8-K8W+4>^s%P}Q2@83Ko46HIS+gBx
zurccGlv<{M)IJ-&LJGdNk>|1a!Jiy7Koz_}kD!)oPNJOGOoS<dJ7ep~361vLU_3EL
zyG{^L^ei=;6dEq6OI9$QRr}@Om15<PBtRJI3JVwdSr;{2gY7RYyOeCG!;Vwt{X^C;
z!C`1kZhY<72w8M3V&`aX5)6@Tlv_Z>aTL5~lcp6ojhajXz$+Cum}k#=>!Q`rrGx;s
zVVSeot!xjDA?`i{4L*qtev(1fm>Fe=q(-BTmI4(mSSJA+&?*a9As1Qoi#18TWv&Cw
zdW%tt_<~*xv)Oq|8D4ZP!sJwf8ADU;hoM211JeaYBgefYDNSseQ4Ja&v`ktPe9tvs
zk$!p;Pl9v<3mCFPJzgkC6xs=@kw7T|gBzV;AF{48F|%A)bz&fOUBcLOPC3jpcw9uv
zBu%zwxr8R(-8(>p92k4<P{YH_GwU$YV&pBfK54nn!pOxo2Z3HwJlWW};<|xgfHe-1
z1{^YmQ0ATCoTCXE!Av~XkV|w8In2(v)m7D0A8b3~Og>THq@GP&O7>Vz+kQ4enn93m
z@nfr?!ipBQA~Qillv}R(bqVvxDv4Kj9$ll~#3Yp!q7fLXTF(`VJQ&Q0k&&bOM}yb(
z+DSyC_-6;*3Z69jW@;#k6AA`So!0GYZ0Mevq|ZD#fXY4}s2Nwwh~_>n_isc$q|)az
zoLGW8nzPs~(Krj`ZAKdOwOJ`l^I5czfp4S-vHEo3$I{p&mJ<qFXj0BY5leJoHzwZ+
z!vGWjZP5emm{Lz>L!B8hPGj3>5Jq1%e!X#aDQ~#TyXZnP5{@FsQj(}2#8`{nT%Vif
zC`1qa#?8k|*1ME}GIR8z;i80AS<zgf5(N#A`9q`7QKh^oIuyc-GUPMmzic5v<tuT<
z`o-{T0Z5o5A$-3zN5in=*}*Wqiyd-B2$K0Bl^6Hf2DT|<^Nbrt9vU^IIhQ85q<WG1
zcLWo)l$$fqdYOXrEXXvaVpvMTs7pgv)WghWCTn!Daoj9-lN1#yF3@!z(ZHGkgO1kv
z)4;_84pY?H*^W-pxs2{xIxt+z;&xJWyNq&BQ&LMpXDg5l(P$=Jr-tgF-b9=qaDUZU
zZGb$Jilft=)vM<{8nTw!M|+LF-<<<W&Y4TjpqTYX5>S-YsMm#SH0qq%7?@`HI8EGa
zI4YlXTSz>)E=vbbh)4(trj}#)B(gj-?BarLOo+juAShUw3D&boIZ`y4I-^0V2aPC2
z0@S3MPOo%{8BWV+qNC~JoVdva@jOynJ6q#U2k7UZ5g7zOwMKZ!y%AC-qct-_2UJTT
z-APT;*_q3fv(HJi_}yk^1{bNZ^yIYr6z4G}RQf;$7h13osAtJBMQrzwA&+({gKZxJ
z-y(Q987Y}s@JD!2u%gh1xSihN_(={fJIjqk7pPl^d&Lnr6R-85Yh!IHbaNVwjp&4F
zb}sDc?9yES3brw9+ZlQ%2xZ&aLi>_6g`i8bRw?c=AbQHB^@5l~5LpC{k1S+6DUQI3
z>gA-pgj4qj9v}sSk$?+dV3LMD`05cImuBdwiFkD6J(x{4&BgoX&1B>lNfGkugrzz{
zlU|_I3{cyVK&(2q#<EqQ4=t*36pDp6&}d}W3Y6Z00Rt^JWGfmv*v)+rG;sBOHu!Z)
zJ$X!UUJ6@Px0pm9Biv|4V{0C62AGUD-_$-RV~7cm7aoEkG|I4Gb=}}n)Z@T9SrDr%
z8CH_Or5rw@VLc$(4T{MQd7Jq`7&zo@ok>t(nBfD#SH+Gu&dt7r{<3uJHqJcSOH52T
z<IWEPb_Ruz;-d37X*%+PePUKRacVEr#|^06AhHGSN#DjrWJhHt-6ZwImC~Xm84MJw
zFW?rsM0Im~e~6P6<pmc5TH|b{<Opyw1mxsua9;@P13~O76szGFV$ygDWCw&;sCl<g
zuTm6yjcl$O1(S7Fk9IU<J=hrqLdMD}>BNHrt)LnOv(dh{GuM4N&#I*<!&lV1CaFQs
z!RTv1#fV<@;Krs>`$8}g#sQrClh4;puThdx7d5)YEGY(;wNAo}x08r3v$Wvx=sx}h
zAserQEGH;b!5M094kC%*k+Xw=`rAdvVXf$g>&(0a>`X(f2S7_Qx;9#rQ8b1l1DYbW
zay<D5gm+v2S0GHCbE_MwrX%<~%#N27@?v<pgt<05d0m$VmpiLu{Vi)7ha7yG*guB-
zBf4L)5YzdND#%(cdN~f)Yp1fUQLZf-tGcxSX9gHK%mGy^H{je*^XAm+D3$YUr#-Pz
zybH66iG{8isCo8RFtXL^k8}_*&b0i{f((~+<R_f@S-Ga8%?*BjBb8B<t#28T*=Rv_
zR=;ubzyKn6az~LO{f4$}%W#bTFV}D9daC;=i>I8=wcXGJm&?pV?)~2tv*pP$dvXGE
zkl-v5c7Ne9K^SL3(o`^)0c-MuuL3FzGbNhMoJ9j2*|Xtnr#K?)d@<DzQXh;Oj%>tU
zU}P{_PfA#M2s3Tfj4GjT#*Kp_o<{nRI=$$v8;oU-x<RRnRw+;HZBnf#%mseJYblvT
zVOgly<ZxVLbE;h&Q5AnCEWMu#)qoubv*;*;<IZhTzl+9%YnbGuG~J7bb(m;YV{8;(
z!$C<8OL4eF`Jm!Ltg|ahoUF%LF#?byv$y74TBKQ&Zc{fbrfvV49VqK*W;P02*Se<;
z+$iTXW(5f(Ky;$xh9o75q#;{o0$H0ZDzjyFnWbB{b&YCFZkm)dD7Z$wr?3_+R8a9R
zJWUubZkenqpUBY^rM5-TNl|c%?24^mi%hfMpKP@FAQC5&qDhwsf=JzgH(gjcWuJOE
zj-CStiycIZO0C?%h&F|$!Pt~bSPunTtFBG5vx3wTxG!sH;(QQM#!g1QC{3_nwc#6|
ziwr@To&Cn3R0~`(hyziLnViJyn&D`NN3^0--xY$SoLUW7@SAF?Av7%;M$W<di@t}<
zl&9@ApPv)<97)*%sv{7h?Xo;ZV+aO5OIvkvxYAAY#X4<|+i~Ammar{reuV2Z#1cW&
z5!C#%YzU5p8H~00*iM1}_OcV2*QY>R8Dnct$uyo@Ay;M2*<^~fgNxAEo*~SQzg*vh
zkX8OrpPN{CGoh?Br=WnODP3^zWm2YS${^PUpJzbF%Z0DK)))k?IRlI>GGeg;uFVaZ
zNP6xFy_GG&q%93P0N9Ia&{?|iVB3SGvT!&}tj8%zeFFccj9(3?l7sGOCtbR3hauP4
z$ez1LXW7lqKcBft=g2{%8wF25qOd)VGwP(sPxf?~s2CI-Pzj+@!U5P{b?hyRo9#wX
zWsT_IL2I%)_~nxQT>LdNu2+s;Lp?ypot(yNAxt)g!O@J+yAoOlT^E}~l#pT61Cn93
zmc>kFs_5A4UF~ojY;GBUUVsvW?cC(23kZ3g!$C?FLP63DSB;)0)r29tT}UmLS@NV9
zVkkbB;)j&;x3bO)r$U*SEd4Q!m~P`9e4M7MOA}DpNcIUUdUDp8)u@Nx^z*qTZj%`-
zXB%m?79S&Y5~V$-^J~Niu%G7X$aa=E=?2l^|2g|8C67CarYlFv*syRM#QH={gn^2k
zFAm{sBeTgYd!goCd3;4(Ije(;6Q)5rNMgl}hV$koZ9*f0oKP!44T8|#ph1tikRVdX
z$YQhxqE*U0Wd#e2noVeFxVWM=Lwq38jN9{$Hdwe1fCbO3WZ$_axoi(!u>K<;-wA5k
ziH-w?6K)JyWQ#zXzFW(3IV7?LZGe~7ieyjoMoI~tNHpu!NCT-%F3zmXrdVKLGi-Zw
z!WO~~lHQWvvPd;%qXFvb;;fb(9H5A8r?u32sXEIl4W^T;w?<D&YDTG;2*sLT+}19N
zSek-kw+-D`o1@kHF=%m0syl;je%MLbn@a6j&+_2kYifDVfsn|0)<uk47_);Yr#;z8
zPmZwh2gu4v4Gu7m3j~LahOYltO<h@X8Zi)UNds|~N>wh9v*ysL3XYN5dP~pXPlEw7
znqJ>>q7#=VG<T2PmPh~L-Pl~$#vVa?*cJIfHJF3%4?*Vge!{ChrW^_mOOf5(jZ-0i
zl<>C-t>*Z60xLo&#4=!{1Q(Ux!{(xS#tG60Qe$Y^7G+Sl7-O*6OX|)A8_xPt!Gr6K
z{hX%1lfGBv`1yL{^b<@m#jleAgZNgW6$qh>VqqNJJK<}mB{77?onx(Lq6*`w9WzA^
znj7xa*qQ5|Wf*(2dpRE8=N6O#6oq&klac9|E2Ve6E|qhZM~a>vP$_8Yp5}-aLI(T$
zMBIV|ANJtm_ph&i+UOo5Dag`3ImCdzHE}UYNRg|c^gbhHMEBNZ&rHGEnP+!F4L8en
z=w@q%uqv=dH0zJWxxC9+No-ttXH(T~I2l&5D-v^|6Ng*rWm|E2FLhaVm#cHS3mKJJ
zdDl!Mh4c#sOhQu+sug^=QbSj8<C3_)RR1Q}_T~dKt}&4-c8xVOYQi6;lTlqr!t3{I
zym1^U<j-ND)KYt{;Mt>0303~pf$1;%hp_C<azJ@{!HT4X!~*;GLWE9NeW?iupZ_SA
z02c=2qFBX)V~UVQA#c<%&H|vmH$mBlp}i>;0a$Otbs4~pCa2_o>`2s!!z&7bguBwY
ztYT)eu6cTE3i^w~Mi%`}Ku5~um(n)-@t=LjE`o-B;sg=l^wb`Ol0QHJGPnjiPkLx^
zy1V4G8YURWrEdqj7Zz4aqOa^=_viY%3kn!-e!Caxx-$q-4l9K=>(1AzRO19JRh64B
z1(v#%W(d6?_qVu!6tJm47xCX7Pox9D{11r@ff!Y(M}Q>7r#c#rYKBpN9#QM|5}LL;
zSrksRK-od>9q-j`Ilr&pk1ub$+Zu`u-h@KFO`{8llG{JDtM?9)*UTM)M2{8JkNq6*
z#BhcVcS8*NHC>^Vd}o&+p4$@LK%XE=LM>W5&t>y>EHrQDnf_pxuYgO`GttQ!g9_Oy
zFSK_jix%ZjvFLv81-TQV-><1tE1JmDMD5`MBvTWHyCvMT^K~+EKoeA56oG=0lP4Mi
zEsTP$AKp*#+9;OZs97l&Zmh7r_ipsBI`=-j6HLWJCLOWG`M+SQl0&;dZ-EpyO*vwG
zbZ1sZq$(UeO(}3j^pi40OoI2uQ1r(KkrwGwg^uG!iK%0R`RvU!BgMKZ2snvj0b_W4
fvks?6@<`I3J33Bf@Z<P&00000NkvXXu0mjfDQYNw

literal 0
HcmV?d00001

diff --git a/client/ui/frontend/src/assets/img/tray-linux.png b/client/ui/frontend/src/assets/img/tray-linux.png
new file mode 100644
index 0000000000000000000000000000000000000000..08cea81af1854959ce806dcf86411e406468a280
GIT binary patch
literal 177484
zcmV(?K-a&CP)<h;3K|Lk000e1NJLTq00FK500D9c1^@s6tqDHP00009a7bBm000XU
z000XU0RWnu7ytkO0drDELIAGL9O(c600d`2O+f$vv5yP<VFdsH01k9TSaefwW^{L9
za%BKUX=iO=p0So=00OkfNkl<ZcmeGF3AAn5RUHVfz4y8Iz4!l*P6|bYLM>{MP-A)!
zNHRz?7ML!<S>VicW|f^TR}PnPWjZUXaS>Hi<*4*<jjXbVE1eWoWjmov*<jPS!A)XX
zfsFtG5~x=wLJBD&6zy-`yZ4;4ckVUkT>Cy@fh-grLqWbHKJov1w>iz;tC?%AxzcN%
zds8bVn<cYm)ly1UtJzwcmHxB-Pg`66W7dD`N9#Z9zw7_&@8Tc4H`%hTmZxIX|C_Qk
z|EyN~Yf`+^TH|;4vFZPw`d|0`lkwTDzo)I1`uVK=BnnTe|2SD{31`4}R-1A^gZ>@4
z;UzZrpUwR}t^Z?_{Bsjt>*s*;ul~Yno1CroUo6$n8?V4Qmi}}9U+W*R`uX(#;<os`
z@N4Ox-7l?wb?g7l{oI=6{+_uuyw<PD?}eXd?XRu={kSm=pV|L`Gv_z@o#u&W+?9m;
zoOI6Her<mJGtR4jY3+Bve^=}Gb<<Cx{}}gc_1_o&eZ{pT-5r0gf3N?p;q!T|OXYR>
zUBtaJy|4diet(kTx#2a9PkZwF<=>BI*{`|qnfi5Z@`UG!*ZTG0Uf1zizOL|maPJCU
z+aE5@Bd3OE)%^SVzqfvp{rzWtP5qqxInDkoD({-#^M?D{?|ofxU$|CREWna@ul+e!
z-RI1OiF44e&6kniAHOdDv-bC|{fE20AWk-XX1<Q6{ylyUzSd{m@1>uNpRYgn)Zf?t
zgYTUZR%-u@{#l9p0qd{veb@v2eEl=mb?M)cxmWyi`itlOGyg6>xyA2i|Fk3j9quj9
zxi;=KU)z<JHSRO_74MlJ3!aysV_)ySh<z34eapP|*Ct+D<~j4(nAUyLeQnsAQ}OHI
z-~E02%1w{Qh3_o*&g=ec`u#cf``Ryj!Jdqp?(1pAp7ooyF20VZv7h~!`7>zR2NRyB
zVZH79YyIbbPdAy@jr*i)PFUf*H`|hNpDgxm|NU8i|90B)b^W}mY=nP?-!AS^?H622
z!s~pk`QNdg{9gKV_4|Np=YC%B9lAzqu!y;EkEOm4uJ!Bl=jfm6`)%L9XZ5}3R|LDl
z-RbtxuhRec9y!Wo+!uUq;tgN1e>2v#f9|}@ursh-jdrEMruF-?EH=3<_C49xn(xKb
zKW_s&l(eS${jJ>VumQfm`#HJ&$!^E8KkthBQ}CX?PjLS-*2UVNDb`6zxW<Ni)bES0
zrT)8(>{->5_G_hG;dA!u_BG`H^L3SUEq*1iVTsSZU{7-YolLx6lYdN;ap8y2p!nbX
zzEyodH5zFDr0h4n|9inn_lxZRb!Wqc;YOSr2u20gP;0|48qb-=9L6T|M*617GQh3L
z@c2XSpTF-L8;dlXZZM5#>jsR*KEvP^{}O%P!pEr1onUZ%=fW}hNhG>cd~Tu>XmZr0
z8=^^zruL7U{QTr>;Xh&AD>s2Z41WOl>db9KFQkRQ&E^KuueZsGz;7ik_SCpIE4QT_
zOvQhFGx;Xp?Poe7EHXM-zjpuJjE$X!(Q5imoL&FRksGhZzx%oSfBgQy5bAj+83(_w
zvm0)AI*HHU7c7l+-*|oT;JL}+WPUB5N7MZ@8uZ+_xRPGv=j)r-9rBUBEBPkD;><8K
zejQj-W@9tDV=n&r{k7FM<Yt0nXu8$D$Xm_|1hgUK$QuHTgg?7^(Q9<C7Oo%PtS9|5
z-AVa9f`R4Zmt&dfn6s`=*N83H=$P6F&FE-b<NaswMnmjDnP2m!UtdvR;Co{0hR1`I
zzB~Pz-2l7sH#oQkhm&+~@ErKbBUoAd9R0arjnNsl2&U3G2k4*C|9;#JxnGY5jHwg_
zby_c27ks{cU)<2S5%Txe%C*NGXIkgH2U|BTaPWPNq(XZFhwX-pHX+HOX9S7-PG4t9
z0drfqR<ib^FJw2kjiwIkqsa!vHgn@RSN`n$-mBd<M38~~hrLi~WMQ?rm)$73Yw<uL
zo?@>2FZZYxxS7^EZ4cH!OS<2*b-5b>zn2Y8HkrH22|>4lJBG#zh`2ZW-Yl{sbSNIM
zaqSn`A_Sdb+gb#}3xB>gTmv2geoh+$`(r%MN%v;4LqN)H#rrkkc_^^yzu4jX`<|<A
zQ;n|G?Pg|FhQP1Ud9D%sB0<SWaQxb~M*D#vZDv51^z40YxMQ4h1Z9bFJ);r@`bj>C
z@3A;<t%C^>P-WCo7)x-0q$Vd}y4h*m6l7=~JtSTP7YF@nK}3<@b^Wa17}vw5Yg~nN
za{ceKPI7V+p15?F9PuWF1G9*X<f)r72fSis)ab^^A22?$(LALR#+MGG(n}A6>t~o1
z^@P)~SgZ8l+FUj=D`Z)fj@KiNNs$4JOJ-(cx}QbYnfr-g6T;CLBTroq9Fd>fTDdU%
zZYpweW4bB>D9DZ!P<Uo)S({56Gcq?tM@^>N-w%Ub`275P(%4jV+;|>|QC?COhVRhA
zj&se8S=eH9G=6?q^p!^17ixw>rZcTFCWz`}+VSM#`RM1fj5?y;zFvHxFKc9db}(iU
zWHhd;u@+ZeE$<NxD1t>qZ<*hR43N)z(YiaDV0F4PNp`v@(^mF3`*mQ0O%|3C*NjY9
zfsAJhiN8b8V?qZK*AAm(H?UeyDa*)d@5qVG`r{jZ3ZvQTa1yXrRTfP~AK6sXy3{!p
zWeG$`6sX~SZk%UC;bmg>?)wJ!J8_*M3(@|X<(zSSD+ALc<A}gy$_QfC?jVqzGA2^c
zMMJjr{ZSIu{<1D3h?{yK=4%UUO@Xm#KP5RsU7`Y6UUS%{Kp3)&B#m7HGJ|!f-&aMz
z{>-;i#_!xId62XuI{B?Wf5rV_KrrbZR6Xyij3bB9FkOhz+2c8yUvEZ6wIH);aOMc^
z3T-Uzn>(cbo>|t*pY@WM#UXeNC#8Kn#X4(E`~Eyi<M+2QAPVHf_kw?iXIp)pB?U?q
zmabym;~Bu-GO*6dj3TI85!|~|UGe=@w$Kv=|9v1@Ky8Xp50meNBkSuSAqN`))2a-&
z<fI_^5D={Lqzvf!th2I0d{5<Pdyre@-^#OYKDq~XRM|#5cauzO2vHc<7Cv~AhmDQw
z5o*=OBm~6=S|e6!T!q~1eBu#tM5M|^m~?|pkypaMJgZQ!gPWqij)*dhA{}BH5kf=6
zmvjw!K!UW2GCu$3gvc#x(<t*mNM^$zC3%0pc}?H9DU&vpF^Wz+?;4IPC2cT%?$QX6
zA;Qr!iZne5H1Pj}A(9b}>*afN|Hj7V{jG^%!>a5lFtMa-fxE~`!)17U@ogRZtZhWj
z0X-Id#+qpywu*w8VHIW=+R%vVbdG?BwNT}eM;4B?Qkg~g_j3(#y)am5i2mobj`sqt
z&I~luh{Twk#dn#dVZ`D=N5+XwnIn>o0IUq?HVb}?4da{L<k&nAS`iaftc^*KTgilp
z)47d@pK0?)#(<~e(etW2Mz<M|muJp``LJ=7)iNPI+z(u%f=VDA#=rn?ZGv_EwF)x)
zIRTDr%_2Vav&O#>9CnAKRFWBtX}#;*5qK5e!*;mFrt^g1H14rltBjB`IXy3b-rIhC
zn?y(}E9kREc+er)E%r)<VXQjKdJcw*|D|*H8T)r+?hWg=Fv8&d$bzE60SZ3xbGy{D
z>1_(T#<jVI&FOzU$nH6HM|SwE@~}<XVZ*R<ouqUAD@p`S*(eYvWt4tT90H5)(T&CX
z7iD!t>$J(XO$t8G<?gUIvDQsxjc@>AQ{y>|`=!hn&M5I59MW!bPCzy?_r0G=Brjtv
zgl#NY&Z1(?6+!H@TZd%86OE(*7vHVK0>Ory36m8i3Xw4Rno{7mQDoDMfnG8Bq(;<2
z4~FnOp8#(%YA@}uq0+gFKvb{VRT!y72FanN$Y|DPpOCR2B96P0;&JG|k@CyIj1|!o
zm-}K+SjAL7-oo_QYiY46@QKxs;oxQ_W&mMClm35_hvTL&IafxL;b>tnjA=YhuwT@+
zKXjf0mow^I{XKhaWOquF7I&3nS>&*@uxvo2DN=YX%A^d}A690Kttg!?IgLeI2Nb}C
z8`nW25;02~hA18*VKYIPl}>Y(W37m)<ZOlW$NtLN6iF~rJGb##cuqxBrhDl@2F|%A
zWjg%bM(d|0)>c>}<8@Zzm#h<Yqj}mP(X@g09yQdY+M{PhUS~+EGbXKtsO?pu1XYky
zlEd1R_)b$cr8TYfp0&O<ieke+)`gDQBDg>%+28BghH5BqnyrmGl#OS=Gxs`RKwN&?
zr_5*Xu%Hz_7mt1cI~Bqss|?U;;e=zqWZSI^&TUGpjUj`xr1cbQK$%}Sp3LkG*_e!M
zE}MS8`t>>VJC)c(e2$G#wViVsKm!1a$=TZ>I>#0<Lfsz3y7Tjl&cjX5ioLE^6yzZ+
z1;kHBR7`6#rvY(htzlo+aXs$91KoggDRg#=GJRMjWRN`|D+$??XLgM>3PXaK+Q_1C
zM+?yrcjhyYh63Zck)cnrXRDqsN*!Unv^TR1dIa&v)UdBAo~tZ~DgQWlF*(<wXH}7v
zs8+1t4*^UXaV3I*;299I<~my%>+OD&fQFUH`t$bR`<YBK_*_$mYw<rTkdub%A+(r<
zTp8_JV!b>kI;Y5ieO-9gzGxp0TT*S*+cIkb@E;7wu?TG-vMDN+_6chs_5eWK{+_An
z!MOdu>(=9Yk|Iu16qog8(?%@1QGS7l{OPup2HJ?Aw<vB_rhZMZQBEUrYH~_N-(M6J
za1oQt;Sp|9G+{E%Fa()VD$`99yh8}WBU=XQ#GBnw;0E9(^BhqyS2Wxjof7N*{QM*=
z9(AQuR8*&9WBn|R$kX8#oc}pP71@W$&;ato11RSrAEwyhQkap*328CM{h7vVRgaRP
z2Ydj>L~xMg3}v)h^id3MGX9gUISd<@NQNQhdGr3Fmgk1k9nd-Ai+{>q3v?P;X+Gf3
z#^59Vjm%TeFRr617@2gbMZ^cdH^reQZWLyHhx%BK>`GZT>radU{eC)GCCTAtWpj2e
z;6eo4k}~mtTDh@f&3P7v+Mu7y#EgstBYr+0;lvD@*(<?$W;V(={WB0@*l>meQIPS8
zj2C-GwHwoUGD3!_LPi3o00Ic%Xa=P;e@S~3*=SOY)p&lmpNV9ar1gw?Zv-;<IZ=sK
zYvO3y@P3s;X37k*>7368E?i5jff5#j`A&?lClQ(af2hfNnV=Na3VYVI;kw(ebQB<f
zWE#cUxE_LdRaJKf@k=RdQQ$nQX3VUE_YTf23zF~q1J{bR#QGbIU^Ng&{MjG--f4tE
zBa$z$cdCWy9)u&+Lm1Duh`0ntF!n@Y&}@7*xOQb(OmNz{pf(IN*TH<wnb>#+CIiNR
zAjz?0{dm>$Uxk2$4VZ%XBeGH!;!@i=3y=x-#`PfZv^J6hlC*621^G<vasGQ1dO`0{
zc`qBE1B10DQ<q?~QO^ytn?-(Urn+&%zVi2Gt+luhQLZWq%FCS{Dy*@=WE_hYQv7=o
zt_7A@W+a47r05h*t4CD4nH8R82?N!HpTo)W^@NvfY>1K3iJ>>i;SD_99fzWM8U$XP
z{|>lx=EVft36Vo)M##E}Otw62lELx^>QNC><y8gsL&lY4@L~Kj$tS?kTNJSc+oV_!
zT$o7z{ckl2th^Z|SYIp21lV-OXfhZzG%9jlnb`DR&UB+lc4UPu9Hm9LjrY1kk3b<X
z>_g2fAipS-o_qF8wTS0yGgK{@fY1oZ>7HUy2O}#DLtGS$M20yw`jiJjWYINeE#y^<
zM>lqpvKW$41Sd3QJ|<(JFf=xHM79x_z_<#+u8~O&$HooePjFrNPGn_TBm6!xP|22R
zW8KZ3LBtKuheEjN8ca@z4u;PsY5gIf(sL@^SvVnpHI#s#f*g{E<3+t7Gx%A9Xq3zX
zl~`pwkRdhJ^+q7oSl>!zVr@i*+MUaOCcBZ$U1q@k@0}A?bV&n)XoqW!XO<L*#kzyD
zD}u068e}itp2mRGf>_01DE3UP!-ZQqEM=}G?d_HJ5y5d28}Xz}<SSG<$yKjgR=HWR
zlYP~K$*LL&oT^0@B-<gDaaPT*$#yWO(&JVQZ6A&~5h;L~tpV9G3ryjD{90w86Dd`=
z4w4u$&)*KvE*!6(e*{a+Vz_V9xxH579-iAPaUacs$roWNZR}Fdv2JCzOwPY3>-G16
z6lCcTfHm5_*gL)e$Odhr4j9>RpdCnHQm`tyr$?eN0(SmAk{NOq=v<2(P^wAJ5^KRC
zfaaE0bQ?yBH$4jY;f0fK5*))kE1Jx#2_-S9^dJH+ErGkIk=Tt*iiewovsz?ZMyN;&
zC<mJhEUSve9}K`W6&VCN3fkTvGDNg=-m>SB4P-4^K09Kt=M5p8fQ*+f+IgYFA&ZR;
zrlmu4)Y2jQ#Jh7O_PSmZja_Ebv^Y_`^##AmL3z{yCZ(L5s3TF#2g{CJ-chHhf-xqY
z&nnt)6f^N$n%W4&e)Oo6&R)hV5pv4PP}+d?svQ*(ZK{ph2H{mc2oN?<7_JBBpGeX{
zLAs<tvT5~PB-dyF)}+kOBW{PTz*1EmOIes9$Y`HH6Hk?!B*%h17bOQIn^`0qEH^~O
zjrX(Yb-qTI#LWyye41#Cb>G)SaIA`&j15(7ux)*l0sA*bk2G`{A%4~VAsi}*Z&`2y
zHr;`3S=Am9?$Y?V5gd@67;7kLH8IAG77)K*8`R|p(Kd@Hx`_<L)#o(+X|uIO&lCGp
zlx7el6trYGE3Qj-NHqctBMhJAoU>|>9+a+Y><_YySFLf>t>s+&m@<C~CuSr;AXsZj
zuzHgn(I#(nG@HcwBB}jNgdW4XODmBUzs!AOM%)%cjcp>d2&hf#tfWKhfdYMeM_tLn
z3xp?Hfd*`!_*u+I=tyu5Sbh<hd0;YOZLXE53u`|?T5@N%Y7byxBH+kzeJTe4@esSx
zl#$aJGCa3f_g*S!bW^Oc6_s%s>+n@=2WyLnWCVgVg=z2?{MRIK<PqfOEb9BPS#&~N
z&xQc3;P08`8`+~I2kY1DnU*t(_l-BZIaw#?L-5=P<s#EwNw8^InO-BS+fkngrYB|=
zym>jOlu8YAS;@ju3R(rx)Ex9t-gs<YMK(>5smQ{^qc5Vc6Xr?-M#5{X4JeB@vC6v=
z+vM*J7fVM`ScIJjA%$Up<8(+M%NaF0^io+slg#WEMARFl`VBBygnRx_2#wk32ixI#
z#bnBi?lRzz$ht&AF&5>S-fDrQ1N+M#)Q0=_U&|I)uRoANB9h9=vd~-NH7aF4B`aEO
z5e-KaET?T;r~!MXk<!y!BL+?Zld%5cfZV+DN^4_;SxZ(AiyI8DW)$|pDf{%-<rdMV
zY9VGL0!(HjGGx})?07?x3nEcB6wXxlsBs|<z6OOjk>w?9VPu@hHDvg3Z&$9BvZ}6^
znf3X5{d$67*R<9ME3P9mB>g%b3Lz-p{Qi6=8B&l5ntI04AseSBA)AU0n^Ap>kWd+r
z8xByulZ<RLRY4AYV(h7G*k5o4{?AH$zX-kx@`XRMEgXcLofwQkpO5~m>b*>v0TOJS
z0uQVoKPNXHxq-0cZ2=|{(Qv|I;Ra!7iS^UyP*DTXT8!0P1^rIQI1KekZ_79ZyO73d
z5;PgLl7O8FVQWo`QC9RU>G1e1iyU|o1e=8bVL!}O1b`JVaA`KOBtsvYjo=Bvh-t0$
z_iVGsU4DM5--nGVa^4K2`C0zleAOPS?w%Fw)1I_ZuMMO03BkJp1;0T4JdL--zrpr(
zlF*b1yRV198f$kIi792(#M~iN+Q=pd*-YgV*^v=k6Q1{N<<DqCW}0e&VTu%336!pJ
z0qA#2!@*VUnJCM^9t$yvOpmcx9ZoRN6zr2GvWf@tiT9O3C|i=?$c$|{<*r+f?`dIV
z;$CxCvW|n)oK0+WP}*c-(ZFjKF49^f2|c9W{+h+2R%B{wCY+FjpR<{@2)|TRV8rsd
zK-BAFOwCo&8IFytvP=v&oPmt|c>`J$c{e#+0x)%CX2pVFQk9-^0WHR~7qtg}$i_uG
zB^y}pfHl=?71<7mg39hp*BvQwoPPugSnL7IsfH8=-xt(zDQfc0%2vs?VPkMs9Zb$T
z1)LDjY#J;zXLkiTg7=P1hyEJSnPv2u*-aKPaLK%fdquiVg-!kUz}T%0W9eC4iu;tJ
zp2hD@BWF0*(3?z|4;@anHjGoC6X<g~cVB!XGoT_K9z>U%%5dWNZeu1J>of~uCQPEt
z*YDwKBY?w(l;Po8H8P^?0E2{sLtP{@B6pT1H@N~lb~g-&8<B8hhas}c#uf-hxDlw(
zqPoG^PLs@=KhriEvq7>+QQPE&BC?ku1+<<SlOufT=X4a$#l%{ygp~2G+|I#u#t1!g
zKLx2Iwq=%MiufPdY7Y0S8k=#Q&vJN8#3hIJECMraM9&EPT5}~_3n)I>SWmdsx_>1d
zYFt=<=>Unh*l_-_Acpkw+HQER+E)I%P0Ax+M26~)O%U$X4lGH(4m1TvtAqXr#%UHA
zMyLzPG}%rRNYi|A4OM+V(Gs42Fh~*TSOl1IRLREmMA?Dvnu|L6JMp=UqRG@tv^|kg
znUV=I9#>?jt3E%RFS9g03qSv0F0XPnStTPU*F-DOB$zI`2?rjmb96$J+ZWG<H*(<4
z&Yc^5h6i8gnWE<*XWk11gy~R6M_t<vK_YC|oi`uf6Q6>@ziM3g(18gvYIP%Jpz@{z
z4qLeS!pKJbA?tsD#=OW}808G6leN+N6P*6JnTp*J5z^{|QXHwN5gJ(aAP0PDiY&C)
zS=?R64bH-F{aEG5@K03=M>BAL->xy^*qVCVDvj5%BDw$oxA|bm;<~CLETq5MbOY~i
zHke698>5<DA@k0&3>aJWjX5)FJ9X4>fx`z8A=zjIjbOoF8)^gi{aD-qKgn^+V1={7
zYZcX`U=kVM@1N<0Q(IZr$LFggnpr_2i~u;N#r@%WfFZX-kTHo3=@G6Mjb|AYQk%t6
zMK&p85K*KyY7&gcj44rlA^sl0Q$&)gQ3Q0enYj3)snHF|q71%lHpn8KQts?G`fOUk
z6p^F9&uc}ihz^3Vf~wE;FM|_KSlQVmf`$KglVi!H(KCnqnby<->O7t%vHuFv4&Oi9
z!eYALyH%bU1cVe#?5tl^^&&RGDrh7w>{FW8=(}txcq<D)6E62oO{y!cVtxs-L?Ej&
zLDX1@baA~U)opW5gIM6-F=ghg40hW<Ay#F;XwIKhPi%bl?%1IcqFz4voslNh9ORZN
z)F2%KZx3FIAX%eB+7_Z9-gG^sqP-tIN<>-cAlW5Vb3poL=b~LQNY%c84OdO~!_beH
z1mRCnhdOuP;?riqU~r9%0d`PxWSVJ@k`N!+wQ;T%Eg`y(eNSxr8g2?Gxq|8l8lzRF
z%7#YscQki5{XZmIfnubnrS|)^DHfYP)M~ISvI0RsoxB#<ZV;x39<k}2SCxZE)$9-m
zq(B|mf`T=qU@`34Tp8?PZ|Zs{JP3L2SR8;gJaWhpff$U0Kd@y{r0Y)27ltmF8I+h%
zkxm0XTVYftL4Rm!iwM~cj)XO^10f=51FkAESJY6{=#~gisk4R6m!dpJXSP4MO%(SP
z)ko+^kDe7-tN%hqkIlLbjmt|4D(H$Ev#-2)4UNJ|fngle$mXmG4i)v*B5JgAH3d6g
zz?OS&WHLpji@-Ybd@`6)X*ddpT_M-x(NBp?Y2ltu5j~wVqH-=QtowDWb`-{_uo;wD
zH9#OZ7(5qWjO(Fq#GS!1FX}I&1M=7SJwk(YPNScX)oQ<WBq@-cMo48<HasayDR6>w
ze>@1g#FV1F+*dYFPmRwVk#W&RUq}HOL>^^3!GOZG6t>kjkw`{Q8ACn7xlUBDbm-96
zdWwe5mK5Byb1<Lp7dSaG5YfC_*ocqIj{r)NNg+w)-#5D~j#>t=Ho|b2MM(!|KL@Q?
zQ7My(gmvj_-J55#*pL>#Z``+TBvg1|T`{?G2-R1LQ}XMf@gB7QOft$Lh~e6cBD#wM
zkjA_Mnqq)T=V(dwJy%pHV)*s7bdtA-wn6bXDtw%D1M4_54Jm`ERo9udUqPx_2sv+I
ztkjF9dS1%Bet+ARDMg1=v+NC>X<gYj=Fsz|!=JOOrj!gd3zz=!>)$P`Qy%#qNMss|
zoNuG&t1+Xj;T8S<S)fiUi8BhUs_Y<O&%&S$3}m-&Q1YM&VgoNB<)+4Yl9golj6Ww-
zLsSaHN53W~q{yDY^)(yF3G3QvG-4M)ok{kO?!ATo96^Gg_eP|ewONoSabJVA3qo5D
zKs*>&<+IyLI6sgKw|i%v-NC-l9)>U2uOUSz7|~R*bM~i#20s@tPgO%?%v4}kAdjW;
z6noGF3z4^9MQ=2*=MD|Ld4w}I(%YtJAS+sAAvZ<M5AX(P@ub8k1IeRFc|oM62-c05
zcs{0nmPil1=Y-$jhMxTq%gm?+>9pv!)p6}Y2NX~m9D)oP&)JP29cgywQ$?lE369Zk
z=28DXUzBTN7IO^nbpkmf>PeHb!KQ*|)O&RLaBy?2!im#4RELoUNGD16BB^len_#8P
z&H@9Jq19$u*jVJHs4pYfnvAY+w-Pr#br*Thb2Jdjm^PE{WIFUy`N9sFCpuFyxBR>P
z*@oWQoNO!{z^ndqhj`#58Myf3I*RDh10K&9+iHinK^w$3eIZ^C2YoI>A|%Ibi?T3^
za;pmGCfaq$QYoo;4Wm)%>g6;tODw;DKe{nP*5ZcW;nzfV!S(%&b43j;9pDOnW(M>T
zjqo%Sp1sfjknuzh6bw<5@rYi;XfSme_)dlZFi2q`Jqt!zWc;D-p?i1)OKpH?{pVW+
z78_%oao5(t`Xek}5d=g~M91x#eH+%AJcHX7)n>TXAT`CliBa=|!o*7TgzYAv{Hj(G
zLO@u7LNeSTF_7$Q0vSLB1Mdi}7R7eHr}hiA?EL4G!)qI|@f1Y*4JI_@*RL8!!0jne
zg*;jjj%DP|Jg9Dp_<Y?g3E#Ws2Fal;Qq__TK^w^#{ktY!e_fj$*u>nUP`)Y5EayZg
z2O@$XRAC8lPA(tj_HbUJhDT?Nz^<tF@9S~O3PKh-s(hfbGqa-efevVLG6VN6&qYME
zgEh2+&R_-6r_Gcx1EeZP7j`L_-mA_#+6mmrSC^4&w9DwXRe&&j0u09@qSeOM{yp#!
z@`6A~%;DgT?E1<YYGZC+mBCL_1U$4{6WHjKfLhnUvf3yqp+;J$0>Zt52*+z&NB5Y#
zD<i-*I-Sh|M$dzlb`;uSf=1-YxbXxnMiCb&YBL#CW+6CT^}qyGx`{Ow492k_+-RZ`
zpNk9dQEfwFiaKL;&{R#4OgPc1heLh1tmeF^CrOP1Mw1)ks2jCSM2{xQEb0<;J|!H0
z7n_5i((KT0p=%GREQ(DkvPfowPHuwf0!}pcTY!nQaPuyeL<!s*ceZ(wurF(C(|}?K
zZ7z)w6<@`y!L&g9HAn7@5;u`==oy84Mx$9NJ;)E0kRHT**E$%G)KZi(LrtTGGMJgh
z;%?|M`p@<RL&iqK`N%0uDQX6E1nxMGkG6nYj%1i4+so$+eY6);F~YF8Q)nIXekYxC
zPGo}mT5zKr&Ch<0N1KARv{hrQlN0t!9pb&L-SD$LdOoO`Fk%d~i|8FAF(Ddq33JX;
z8rh4T7OF5ND8v+G0Me;WSYbUe0pZASaGukl&q+<}X*fzo;r`i6%7ZZAC!D;H??zi|
zKY+oK&q0bnL<(45?!a-aB}CtpEv7V_GTD_4?Et=4wk6saOg)rIaE)Qz?q@djj%Il`
zT7FL&jqTAUOYSKP)|QZgUvJ+BlX|h>pjCfiZ84xP5_AxNrZl9U+z>9ydVtOg`?8Aq
zshWbU8eE**C|9LDTVy{h0^h{7guc<tprKYe?<jHL*;YzE`Kz}Zwg&myaj7XZ{WcnH
zHyBRzigH9qBjtP$4uI{;!jqb*EI{bb-?#JosvfuySctZgfSF+-6EjJF-eo#`w#lAj
z?~TVsJB3WL1-wat0t7YL0|5p~d)Eu~``aDmuGZnWSpG@a_sV{T8VUAsW{oz2)Ig~a
z2(?2J6q0NHDIWMNs*Sf6kbQSt&+!K2Jh)LtNh7(f6e%5<9v0P|+T>?ha0Z;!4vekv
z)>)W4>JpK$Rb?Hi4Sls}c&<tr4{Wmop3dGQXZ&mq&`L_9F&7VCtS%(;`tBsAO_O7$
zYCBWs=m3ubR7Cac^NJ$yVUgz8FtH(nwyI4Yl>MgY2Fy4Sc*-a+M>d*=fy9PO)HOU3
zJ7+Z;6jg^ZkW$0>2hl}rMq_rtv^otaZL6Bkq8E9MWYR(<J(k(AM>K52mBH19Yl@gq
z_nfF7xa)8p8GCK0BQPbQ#+pBdr3TqRRN%(?W0m119#6`Ds3TBglCat~hjdUr^tvcB
ziH7RX*NZGN>IroAyw<E|c9fH-&g#`_Y|eG2og2t~jl#2@5gg{iNM^12+?D-ca^P%4
zR@5(+ATkBjc^F7l_BJ*~?YQ=ZT5sHLEWWz~Im+CyzDxG2Aaq2aO$4I@9h|#Pbpg}~
z)o){R4sP_#)O<|X4MBofm$S$bXXZ}G^%+;dwXQUdb`KLQ#|=JIGEjd`2d5hZ29Lh+
ze6$x#8EymsNxesa&PuFP1}@ZR<bCy^XA6VN%yradQyxK@-)paT>?%<L=={|>An=w0
z%_9O6Wst3cE*it6{hq}WX~_Iw7zK-tNX*xBQeT!zDY(}TU*<!=7PevwO+d0ob7&vd
zDyU0}?XY2Nk_M4Mwug*LQJ1u@5sZNX&OH+Jaknc}URSmQT|!OA5Lz?W89_-4XCPh6
zAl@a}>7qIn?=_KvB9#mXZhQMnDhd#|Zhe3I9$vuMY(k|N7=gmKwqX|oUQe-ajYu2I
zGOVEjB5cuLCLdyU2vp>7*+<OqzubA#<{oPYN5s`?dPF8K9Za~$IEsh`2Udz_1XLZU
z$Xqy<M14xhw4o1*;$F|0l>Q$Y?8JBxiG#$BfD(n7%9sb{oGj{9VH}&%-ztbWYIiDx
zhqc!g<Mt#PNYe&E^BsbQW+6v{hu^PzXX<kZhK%ubSqmFLO`{Ss7K7RN{wX5I)P^Jr
zS$NDG%jiQP#0b_@Ya<H8XX8(n=%*sZaV30Juzq6EFleB{`d0llj{oOuLx4Bv<9If~
zyc0wS!{AY>#*{=~Uo4j>vLmpT!gr7oAkzfwoCbqR(hagY0~!jawydIfPf%p1f`Tz(
z)-^>-0mv8b1Y<MH*+b(jG5ST6nh#kS^$;h(H>N-dswAZx`u<er@_WANMwta+UM$z9
zBx_^<qo+slyM+cEYg%N>B{{!g+-eo8Z-UcurF_pe)*KDd8MTzq;dGk=Vn(B?Mnu|#
zY9iY$stqk;56xQZ9`*a_%&Mub%RyJq6zGt3ISFzM%Dw7-rj9lwblP8)`wjP8NQo<O
z_(!Bv1%vWtrtlToq-0`J$8pAb;>Z%}^bw|XO+$ytTtl#m<ypc=XBxeuiOT8N0Y%Qj
z*To`Ax<20>zGn$!KXR;!Mae?z3nPlo*^jJ!LeXW`VuP5G6r@HYe~_gn)V&XyoJ6L?
zj@C_xj5aa{^t;tM8p(r2+~icS8ggXz?9Yt$fM{=l15HF5R_!tDZGA>$rBt7hsKg*n
z(V=DSecoq&2JU_1wT6d4-P7-#AXL9!go1gv`pH%-aL=$j1CD?X?-x=LP%CVIPJ=|2
zMq*J0!!fDGsBi;zphJb*dsxiQ`jw*3lEwpSx-d|^2SjKpB-2o$MkMwh1DZ5UX^C`R
z^SXkO6$YUV$7w7$NA#MKj8BHd3vP3x;}}q&pv$0e5=KyM?)>|P2S3~-6WuZ%6s}2l
zeJso=D9Omg)Tflw&{qs8tb^+?RZ<&_Y7q>R2pAteJ029EnrS$2YJn-6h)mAEp)f*>
zjBb;|QC72a-yRTBQ}h)PGVyT*2y$=?3Ici+?9dLBeiX~)h{fMwOF~h0609N<3p6oW
za|5%LQB6e@>{ygZnTCq#mNix*abx;DgR~1vPpI$EAdpGtjwB3*YtkVYI+r1w^zQ@l
z#29pVB)6=TC^8st8r;z`px}$&PRPok9ybn{cT@>2hw?hRd)o-Kl=cZt;7Nq?3n6MX
z)n=aiRz?H&H$~ucfX>5!tirFUwBH5{<ZF9rb!<Sa%gAuTz@(-umiwxgvwD^?BW1e0
z-Qv8ippF}}^7>ktSHa4mP(wsvBg+s>P7rBim?;Qg65P$QAXUUH5_dLJ5fVanaAfrx
z^`CjuF2}e?ktPRa1Su|zATku$8_r8(ptvFQ!gEXpXO{wc6*<D4wb%9{>J}x2<6Km~
zqZN|Uj?x1L7i74OAUm4`mI)0P1x+)?<K#gMa|a&i6O)DLRiz!Fj%r5G1g8arL9dnV
zEK+g_L$C<j1f-h@*)JkF4F;@i3~Ym*Ng_6H@lj2|a!!XS7U8g>LNqC9i3tIwb|JrK
zrkQ2SDhW0P?C9f)xq&T-rOnS>C8iL`i^(~L)k+c2CY4iCT$8ddm3ShV0w3V+XPn#<
z4=tb5fx~ka)D}`Ph}zaLlw35^!~(igiy=5$BHc{~g@~q60hyX%iyA_6CchB-phQnY
z6|Nq0nhs7b>MupTLlZFz!YB?|SQ_t}5<UGwY;s7V)bI$30EtD5FflU7PzK;tPI9!9
zZvd|g^`Bkp#b?Z_33gCqrHw|+qiHmbrh}te1w+OkW=DtNZeC+y&k@@Ra8{7AS=D67
zdJOumq(Z<k5{g2Uz0m}>k&0t+tqw!2h$>rSbVhiOu<9~kO;l77Y5Atw>z<HqUIjtc
zu>@Q?2#~1A8tB|N)+PPE+?ZE9b3%g=fwIo&YbiF5e-<KkWuo}q(niMQpX%pNXvjuw
zY{=ZCAgd7Ca-Ja67n|_>#NYVf#P|%<y81eCBY}u_CBE+;38tj8(lQOii~*4RS&Z7q
zC75BW;Nq-)M8i6ngG`brs!O=34)*5B@v)tq?YmR4!OEHv>&R{*eeGh{s!7c}F)PW+
z{>;<|B`1-Tfg>0~AjHr0m2%mKDS9^Fo$)c^R8e}Ab#AsBT+23B)(owQWJITZR3ri|
zgJ#M`u<i@*tDm1kMqXpN;f&8!Jw5X>iuer<L&m)+Saf6Cg9WU?)<hJU2wy8Gh&6|`
z=)wVw$`u~G`1e)y1OnFc=i&qp5feBTh)lwxUPr~=5Yc8^R1-G!n+oCaD{}@U>cMLp
zVzNoW76S4dM&AZJObR>UM^fDjYyb5?BI7j&LQp8tW=-%mojPil3z@)FZqGtO8k@;|
zO{6U5vU(-^HTiQ76k^ek)s|RmVi_n@b`HTv1Y%$-C+`<!@auy>H%0xdM$#R#Yz4b|
zzW!vPYLVFIb-L^cQ7ec*aH{|lNR>&EC`HIi7(b-WVsDxJ2Ww<vHx@zXcl3-a8r7I>
zMYE_KG9xtADMIuwY^+cD-vJSNk-IO%Nxc$PESaE6GCfTL{xcIxM(HFwx9h0SSQs@E
z!J+a7Z<R8xg3egztGMAy%UED0PoGjyRuw@uLI7m3X!FZ?d_uoQq}3{>uA-m^Nq|Mm
zLTIO*tM#3`e{hcVpcDopY0A7x41cuYd}fg=K()6DB7wh$3?@^5POnQWti4P!VrOE7
zq3)u&IBPiOaAwF}njElaBzzu=W|&1^*`mM%^NRdAI#bG@Ut`qk-{CrTv$8=77}wDp
zYAH)Hr{X&No`MnCB=Iw{wu#QUlu<XTSU;0p${e8R&vzD~0new=w4fn39e&;-0#h{0
zIt8DDzb5+sP*C^t*VN%F8?IG1!0rqkB6F6M8&42ZG6?|ac}f-VBh~`4FdBOjCt0vR
z?w=PU9pH$irsBcn<cwI=S#iH~fA&mt`aRvrX;oyFS>NNP{!%8}Znu&K&h`OP@RRB$
zbJfhWqSj&sN3)`EK*ZU#2|54DVMFwDB?gLHi3%qekI?yJ_EX9s^Y`_6eN9p#XJG34
z&YkS#ZR%^Y*FW<HM#k4EGA%uKs59t!!l3(;a~tC|H4rrl$SKY`1bfd8!xdxJUC{2G
z$%#5(j@f7l!5Aj_+5y5#exF1dqmgU~Hhrz0uI{`ikPR5*QTUfqS4P7aeWw-pjl~oO
z+Qh{BoT?a+44NFebaD}ly;#C~)Ok5bv0zx}G6Ih=P1*N+|J_MHXQ;g?FxZHC?~^Gw
zL7DxM?(F<I?8RD!+tnU21^!?&da4~guudow3`@EeZD<GpBS6ej(SY;LgPD!I1)sY?
z2sQWzLSKNS^?U1U(HX@@vg4t$&!C;plRkmYN}Jb$mXBb)u@BU*<EW6nwSa77Vkt6#
zDR<p==^jEAOgsI{XBigsvS^`39FI-gB)60a|GCZ_9EwlrZHxl<n3qw2r!zWMx||N(
z&{>Jki82L!Jfj&DKqXnznug}FHc$}_Z?FhBXR5H525J4F5jpT)s1Ot{T4&WK%tB)j
zY)U-{(qM(93dYG<`0+}}A!;muiqvxu>3cY;tb+1JkWtjB7zfl*WW^bXSp@^0P4R__
z{FV<;R!UOv$aD;i5pKXUZuE)@ysacbZiP@?Bc$Z?aS&B9n|A|#V!ckv8xxsr+@yl@
zloh4uvk_d^Oihe(lreBK)YbhvJZjybUX)dYU9q-+yI1P!xx#_hW}pgD4uYr-*)iK(
zjr|;ABpI9J!Ni+*jk6pa>QhDc-5qs@#=;mR1q$dtObq4;wJiO08{6%fRS{yLy7<<i
zwUxx6Rdp(4`%W!)!?aQ!%tXduPo2i?G#aI4rf{uOp^y6aEISfHZt70$QqQ`A=}7WG
zwj2HYP8W*c&PhfhiCt-go4{zr+9}8eb2{ArsIf%9<$~;^Fz7-3a7A5VfwNc`#sT)D
zejI1nwXse|k>1x$V%SF*n9lpCa@WL&k>=3kyvK0HvxN=6SB{SCO8>Xh*WJdP*<mb<
zNA{-*!l3-o2#5Rq4)$UMVOS!_JP8pp*fWfp@z)(Gh`=nY{frD5SxaIIgtvOEvrmEE
zuvuG<4q23EjQu~y6YUNZ?2)x`e?VbSSqA#EJRn&3-pKqtu<KvT^9S1FnH#eu|E?oA
zqy8EpElzuPRAZ5dg9jWt^{Y*?!5#!mi3%|OUHi85TDub@dKO&?+Z`QmX%AZ)_1+``
zisv|Pe@@ik3*s1Tu_5R>C|3wIDrIE3z6aTBcW9XjX)pH93h|I1+6szv63uGN=1H=m
zv)&>|<33!2$fb1}<AlPV5c#1!Ng{S2pmaa;tSj4l@Zc5M7daMc7t)h}%>~+ULY6=n
zh|OX-=))eVyUtn4gV4av|D>A5frUj+Ps2w)#V7?PI0eIy8H=en&3REuCi-`r`N^v}
zj;XPf9t0^MBcR&oh{8k82RBrk6Qepxv=rJ{fN>3V(9#77ftJUt#hv7~9D3eyYty;G
zmd5XbeN>c@^biqMBWk0h7G9%f?a&CEO0dWhhT$P=QfeP`Z@>>?5HibU^yLO0ncTVx
zKAD8gAL<O@L`x~7KIH+76C*h4f^0v)xPmjb6N|Z2Lf3+f2t+j=r`~Q0JL=u(gh6a}
zkf&;E8!Rw5YSk)HL}wVs5#iWGybmT=D&R;a=cE^7Z6+FcULT*mJE>*eGvcF&pVkA5
z{vOGB<n3#8*0X8esGE4-_uZK>i{aWBBoT8%xCl{5Fg~b#x--oTl3G>6=oFGQ2@SC)
z+oNtsSKK4dRHDag)mrm4dC3i{XAAurZbIF#i9BF~L;-S0WMPR>F{1TcwC<yiOo}LO
z9Q*xXKtSK>*S)J$w>WBCr$AjYBVC5$Y;)Nr)nq&h_6!k*xIYg;_j$m~O+zEqo0u5c
zdz1MNRO)_hVxFxsP<~F)VC?-%Eh_*~e91u64$3cr<7q=0U@Hg%SlFu~0t8W+%M<&H
zpnT%a)2b9-gt(+MRA_?E#U&>sBC&U`h#11tCfWnELHnu+S_HE-ONz_)%UqFVvIgzW
zgYbXT^{{c7VXLqCO=fw<o%|x@oY({I$lL*VZLKPc#>#P+xjQr8L+Hb^1fm>C6znIg
zl1ghbhov<I37Qz8`ch4jcvIE|=W1kxZd5zBb9Kqst1B|pDnu<Sn{A`1S#D1Ek9B?2
z-y7lECWm?$nUvH@Wfl_;Hr_UKXNL;OQc0BTF&hvXGmi8LUl!PKh^hJykA(TIjfQRk
z#hG|y7VSOY8)gz@tW_Cy79S4=B?|R12PX&#VaQvGF8!iGhoOkjMm>aT)@@{r)ecR5
zNzfKyki*;^OR-qf7*P>UWh06?u;o!~WF`a_R`A}fY9V+A#m{W%z!Zw+MkScoJmG}E
zu0p?+>Oq0iq$IIev4V_6|4>;+{|k07voY^U%F1dDJzMKJEki=VV~ohe30a`iuGCor
z^fmSg*?w3+f|SQ|u&7~1QI(4<>F0xjEU1hHcVhi9(u2`6VTxF2?o51RdZyA8G|-kX
zljB-Q!&rkdt&L9BQyZ|f8)Wp=loC8yG8!wP7-ZZ;#2GvoeZoeh9N$<T#rrdd^H((L
zpRuun(b=RTWp%=Q^9aUToVuw5hv35ve?w2ss#-vjJXMoC6rmwE*6!f^GyUI0AfnzQ
z^?De%I@o$m5p;?9U0Kjpf7_MrG#L<<At{9*MH%v{y%Y>DSIVhIm<F{kHG#T?I8hDh
z2AWZM@5YeN#wp`agAx3P=rTuhbwxJm@jL?0AX;SZA+D*+CVE}dJesQcyq0=yPiI=i
ztgK}yd$_}2>S*$HfD0MFwremmaZL&U1G+-ClS5d5&OMs%SE)F#?Xr<5<ZyitM2@yn
zvjI%k?Z(jtLB~!_yS|n@)1o>{KD5$U)cO?!iu}X?<&f1~>gRt9h%!qLG{JGk^aG$G
zuG6TD_B`AUq($o=+0;~ogqf~ifi|>355%)oGJi*Epw30?NfEEynfiS?t26eMw=H2m
zR+T9V?Vz_8?6t<YZ!*>l>_8+hT6-ZY$RvUCZlS1D?!NWt9^#yJ$Oo<37%?;u_Gd(3
zeDGvJi9nFJaWIfr%IVsp7DBmPyir{;MKOdQSfo7+>r0BP0wOaD+|w)sJp*3ZCZ^P;
z2Uc{$t#QLoITRGkq8B3yy|G|I)@O*?$}FRhsgyYht_<~!G>mr|{S)Dku?e#{FikZ0
zMCu8M8LAC!6lomh%rq8=n+=(uTv%j{@e1b&C^2U&=fk~ZcB8wTh!JzsB|tl?h%p=@
zs70xar6rEGC!L=Ccg%K!wWfO{tukbnD;F8i^<W43eO(Fn1z$TF#M$B?dV9_sH=j)f
zd)6OQz*OZx*-i>vG?tSj9sjR!$fqw&hasERgWEI?5v8$OL<I5gJ<gHI(wW8_C)5)P
zn|&1z!Ei>jOL(rG)4D7ov1ogX3Cl+AU}S|e&Y=r4g0Q1TgH$UCG_xl778w?g=0Vt5
zNV3@!j^;qmpDEx{!96A)NJao(?4$@nJ8U-vE07Tm$^jm<pzjFTf+FU2kf(wlb%-4X
zMuAs<tvf8wD!rEF_Z><vH6+Cj^l7iHVi2dPCr#v^NmOSb7c2KH<gFAqLnyhW;fM#j
zxw1~Wk&Q6ffiW}6GgPDr9ZvI+OO1{zgUa4vW0f8pYJ;F|%ER%&C^o``{$j#uu?E_J
zv9ca1vS<aZQLb=1aO@-(hrlWcsOS;vw)L#B8NCSB_RrX;>2{VJ8=j2TTUA*khCS}3
z*n#WLRW>Y*o=MkL_3w6)40@v6QC6w2YYhON_bfA!Ohc$vV|#|(Q?`R^&uAvrYVQtt
z3kDO0t_qgN^(XeAA|y%b39W<)cZxbUg1R|Omx+o0W>Ge{QImhLYuTTvI$Z1{1+XXw
zJp0z;dq@DFbEqoLqrlfBRb(b|MK~m84S{dg6p8?*u5Er#6h-|X;mjg~AsbNHiYaYO
z2PXs5SYoaWofTr7mZcxaMMW5ri-#0?-MADKXFUvrV>H%;L&Nykq2THpaODk~;#>x;
znGuhaT)0`H0xx)i->F7E3ptcDHV5lnVF=q`G{PvhU=v!9fklPq&+&|W<JChjKtm-0
zOaubwj0X%-t#%ma5y6C5agCXqDGPM`9gfl?r)3o#n??VC&P-7l^)1tYZaj9_=$<uQ
z9jCEY_3PQlWP>>t|Av!Xnu4CyMgv0)^?%uaTr=T7)KmnAL@j0`24B-X^_mlBsbymB
zm36_5>R4_ZJR6;+BQQ3T2~iNWH=L^_sj_RW5TidprPw2KHpq@k(NI0JScTDBN6eqs
z#?43)K(IXZ5qdu}5YV4J;};BS%Hz=Q)Yu&C2uDdoJxtJzpRyYpHb#?=*p_{-+f85q
zhqI14E|qbL6k}8}FdK|XKiq(N#Eg1TX4^wdIp6BuuG*iBwi6UOIMkJjH!dA^W50+Y
zY?OjR03s+#y?={T7fdYyCmV^hW~O&+JSU$w_BrcQE3<GBfY4)>D54#0G-1P%h)+~T
z=RH^ic}KvVwXTQ^)e&e+3VQK53aF1V2@8JfTufji885F9IbL!q2I^D@lZK>I9!N|Z
z?Fc4R3PC_pD}p<@#^saY@afzpV|GTh6scA8*ZVzdVjc%F!Q@1eZN_~~J50FJpQ&{9
zabB<y#;i3mSKkjFXu&DE4QdK7!k$*{JO90BgU1;9DfGnHV{74yh7IJ?9F6u0N@l@Z
zNx|B-FS72qj_zTXv-G6ed4p~Pf-|uVVfb1b(2yT74rEf4#DQRG&_!YI#zGN3Ejnb?
z(u*q*H)y21iz4?NuxblK#fMuG>tP(r&0T+}MZ|K}%}M7ZrXtdkTO%Ew4rl|l@VE~L
zrR%Cx6&tBYUMifBE;OLZh_pdM(UmciuyM^z?4)qs>`4=|(}=AX)wKNY9<{E-Lsa%j
zhj=KZK>(>5UKr<tdo3tsvI7HhlFSy_eu5})uLuW4<b#N+kmj9Li=v-SVl3r>Vf*^o
z%USxubNoH}*xbMpj!a-+MN=)I-)0=D-PB&dBV>vuVER?ChH5*7;=_BfDPt3|9v8t?
z1uW%G|41qi^_*a_XC0ub3(h87P52Q#L&g9L#wRP=jcheB;-#T33i#O2>SUQIg|p?=
z#I+(*bp}?)>b-{M4r^A8Bu1_i-P64{!rollf|ylzi^lhj9nc9xs><pkb3*V}7dS#^
z@nM8LnsTK|V(J}3P{NJdv<5?|Ch0linrWM;$e^`-yq%;q$(4lqiw~__I1&k&iP4^r
zs4$Jd5X{)A4CouaBSmkNqFyJur~%rI@iwW3q(BCNscZ(GE6@itMX(9mKN8{yyeFZn
zO2Ess$GLwAQ}Ox{wCElT@nspwW!RoN+7N8ilF05%uG^>y&_Nnv;9I4BPX^t26`>Hn
zWxI&%nVz-pR9};>^LV4zZ^H>-nuO7&<Oo1omC+9(m&z7$=sB{O%nTUnC5gngH4(mc
zsko%|72?i;5`p~EWVa)5UA2GYa6(QH&ELkx_y}x$-5z6K(t*3R3^pZ5adF*^_4%Oh
zm%DG?+!OLGG$2an^T8-uJFtd0rsJRy21;Z;q;}lk+GtG~kTB~*5lfAH)<%y)7}Ib7
zU_hV0CXrqETSDmbNEkdK?WBfBWm?SmvPJ!9QiO5<{<z4<Xq*o4gCf{?_`#xzYzEPC
zGm9o&lM_p3gLZ1|pou8j!^k){iryhXm8s~#=0!^M$F^Y<Xv48b)21nsC)JzZOabDE
z`11$|sMppkMk~<jP>RK52$eT6nlEJ-4w{7~##&?p)I<X{UNd<>w@rdsnu%qpmQg7e
z_^U8RLXd@@{l030IGp2>Pgz=YNei+ZdSjfJp}{&L>u~WRkTGcpX2Mp3@u-ayMl{Ai
zz{$zz01~Y0aJaZP6RGe;QC4i`thJ0{xv^PvkPj4GEH!2^B}p>z+>uo@Jv*(LQ7iRq
z2j9mHUco90LICgkQNYl8UZYu?2n@->E!N3l&s6;vO~8p#T~!Rd7#B3zs?3rQq4#0N
z)ZCcTuvec?5yWk66>1P<iKKP~5u8j8G?DG-jA8^`9+<3TRFbtyG3iNUAY5YvImZ6Z
zSsBbECx>ibb+U;H+7y}AJ_&+HP`xNTqS<X)>+FxCcrV&C^b8Rut`tjV0Cp%_BxPTL
zz9c=z{0Vj=ak_%a{W1L3hMl1P;+Q&N3}y<PK|`P)Z38hN5)JcV2byY&$}}+6No#Xb
zz<lJ*@)4-IlXd3vN;nXW#zFqDtjwAjdDt-SduBU<zjE|Q)TntbsfC)1T8M<0LGRRv
zz<4b<;M{1DVTLB8ClgVa1><A=8kwS|_i#NhtMm7qdd*CZ+F;fS6?ULiXe_!0&5_W6
z4aP{2BdC~-U4w#d^gD%tH5teltkxnz6k}y%BN6o{vv|(=926OU0;XBCF`Qx5A`+}s
znU;#jiRQQ}@`>SNiop-enVf_h)8XKAC#A7+&f(1bGri~zhLCadpr#X&ChY)A6&V}c
zJ8815indXJ#W(_LAYyaK@IVJp(Mn949aF5b*oA1;l!H%9>?4yMQO<yMn@Arr+~|>8
znTD$nodvB%=G5$v`N<`!6+%(FHi<=+RVknvf$$-#Zptu>sv(IH7MjkR#-pS>HaJY0
zvKQ1>2TaDu4|BU3>q^<82v3JN(Xw;RAj?#PuE-~TE{j-dfR9YH+$={H{X&{g<rgz4
zV>N|R>?!2y65nDR5z|K9%lC~tEMJd+^s<ZN%2CrYGq8|GBBpPz2YAFGGW3#x6-$B%
zMh7W?3ImAXtk&^-NHRKvA&k(o1(5F|y<YTo_ARpRLKYhOYYJI~3527fbL3h{i7dbz
z_ad2$h@7v^fwdhPP=s{;tQNBD>d5l*Xm)i75o8#z;b?;+f7YHXTK^1$Y1|?Ho7z}@
z*+$8fj8tU}zP6??z)6#PD}{<J0zpA`O?4R82}FP7rl{GK0au96M!*{^QU*ITxUt3=
zv+|y7#F{RaM{R#<Nx?OLm$hgnp&x87U=Z)070<Scz0JC45;38Q&C2VCx_x4uY?4Yy
z1cp^N%UQHg{up!XifZL@x<Zq3)cUlRd`2555YYY}<vao}KL?U42zN5OCquX@Fbt`t
zns}{VTLevBkz9<+g3T?=u+0wkhp`bQ(FQ>+ABJQiD0==gF5RP-;({m9!<QDl?&pe^
zG7RiVIE+^J*UX6&^O8e?r>Wqt)L4u2e33qeNQUTbHHDKV!T|1DG#c^&NBwFN&OHPo
zO^wls&}GWMLor@jc~N)_xt7Q{LhdMpa^1LwN<>mU#G$5H8wLAW*IL4HHAeeo;H-QK
zv!dAj8k=4_7cW^yooFNNwT)y|R_5TumbDl#bPsfBV-{eCNSuz0MyC#VMcK%3;e?r%
zb|4@G0}tALm9j#}7L$z#Gio_m5N`|)w19){kj;fml|N6g-Ez!pT1gP8l!b+XO>}bp
z+C5qvHWC&kEE@1fi6}Y(!y+id2wTM9Nsd6##tfp4v0L9qs~3@7Sej&1Syku`h<a53
z6fGQF6C6T_=c5RC)w99IO=>3yAh_|m4$(T{8_u{Yg2JP@-WVh(SPY{!BZ$csqlQd@
zMmX?re#}@7J#@(Mlvz@zSG{FgmNdX^WZ~3J%+lO5)t>q65P(%@#MOhb(YYQ8neh+W
z2Sr@|+OHc;uu~cL;GFu90!SMw5DZ-EsO1zHH;2caNK&=NYV;hgO`_3x===pC364vS
zEk?2IMXVtsRyH7oU@`-orP;{hA`2|Yz!<z^kE96Vl_hBp#&FIck41<MHToRuv?#!#
zU1R;0qgir3{3$B6#6zF!swoQ%b>v_Yx?S-ZYbG>kqo5DZIG1s+uot!814Z}*yO-$9
zFhxPZ0{(4H!8t9K?>B$Wr3rd0<QsVX*!LPFx5Bm??+p+u3p8#a8fQtWcuny++XSc%
z!v|LzksT=OCyEC+D;CIxuc@`hf*Vu<3*D-us0#Zob3r4@a4N4<z2RMD3`6EA%viQz
z898b_H)V2)l9M)Ft-}iwVaaf?{_xxzZ{_?rp*5>;Eyuc00U}0UC>G=cs==HRrfX?z
z)*RoRqzM-E`J~0$NWJ#!Il_&tBYK=vbMw9wN<&e(JgB5$3|NLrBU+CPNjB(E3>EQX
z5hd9)<ICYWhc&~I$FQ|Y1|9cWuqm2@HFOc`+oJ|1GKsNi(_ycfTa2$ye9fZF=ZLDd
zG;~c2!e+y%dL%rlH_z{>t7D{a2pU5YqsdzhGsbg)yOJTD=gKh&MLli0J`*`3pxlT8
zedPTt^>d<$9J#>2svQVEG9;-<)!nZ(ALeYWVZag%SV(N4uP|?jziaKEiSoQLD)4c(
zl2OAkbU8~BeL1E9)KSbQVo`(%a2y1jzZiJP++9Pk<x%tC{i8w$YHTtz8>~4xMAT@N
zSpi~BENB-{jY-;Is{=_hs~q#F55OVM903BOm?%EHvd@Xv*gtRO{%~d^rz-H-nZw*5
z)lj)1q=JrApYcop{XDu>hmg*?f%VUEb%?ey+s<D1DPqvANzz9L0uO=;usj(Y5H@Ad
zu%P~UsM}0Ma!*1z76d$E@j61#l8q4_GPH1d-r6EvR^Rg*IiAP>O-|8jz;T4(DdgO3
z18hq{12y(!wh<7MGM}*aim}%1>%|e7GuWq$dLkRf6|nevD-3SurH)`@Go<WzUT9JE
zb-bA*Tq~xYtLse4RD9(%)q0I(n;17W`+&`y#Uxemb%>9Q7MA-khD#nYUP|*7Imf2`
z21Sobbsq*f3Z@i<Va4VsY4Dqp0?t|4>=gS~0f{Nd*;KM>>#R{ycieV#57~swT4=+`
z<}zghF!q5(`=YMw0JnTl+*p--<&+NfCZ)O}-0`MGAyo@(Ft<z@mz+{uc;K^S31xJL
zhezJzG9u8BngVj&4mF{o3=7khgMiT5z^Nl@)vYE~yG)Wh;X=hZR7#yNTT_O5?qTES
zMYSq9=1^7#6lP4Dg9wwt=@|9@azux&T%vTp%JIcy+2|o5hMdJtn)F$WM$d~NhtrG%
z5STgB-w|CzL>3XGM|9AQgF|AU4hz*%)wbwevcb@bOpebki^|Jq5m^hg%o-inM(0He
zENd;OV@?!tMn+g^EGG4x1mqL5kLa+NVKS0W%1#d?9XGac;ORhW*vG>WY)i&n8BQKq
zT`pq{;j2}m<pxgUx$BZGv?wF+3p!5J4i9xyN?Ap3WQ?*eqY0fvgrcz-2e{BE=T)2Z
zB}E*lYSNF)%X{(g`3!crOu5dHeXfMjD-;ltl4M5fZDq4-5>bQc#V{R;XxD=>LsI}~
zHUgHUAS#}rpXFv0=Mzwes&k=cU6So+LvpN*`dL*=LqJrT%O!zW1VY#^$zs+YG7MvV
z6%b^Sv#_k$U`24PrevpPpE&0%4fKFa-q6#uf!2gk_xnfkLl}4M1))({1{)+AuVt02
zQ9%how%I{vGuW4T1n+6oV{y)zfs*OFn(C95qt0KXCtC-xBcH2dW!YPNpEBmiTukIP
zurD*SwXF;W<-h14L$ekEa0K8fvgfQaQWD{l!F`OJK`^o^xU30(n${I-pXz&Uf#{`y
z@HE-UO%YHk8Tu(YrcwN}17rj_lvGDn5+{m`$=GB`MdUO_S>&o4Q<cp~*N%%p21y1#
zB#{_F%1F1Ub*TVYDHju>sEGIoX!5d^Rd_V#3>z%w$Ux$uY4a}X#o8)_SuG%zgCRy_
z3&=58F#H)YbZ!(XPqFwJEFt!hNT%tWK?6M2n5nw;BOKiHkSbKWld?6fEsIXvCdw`T
zbwCX?G9alDw~3`?1I8Fs-|58i=47ZgB(1Vl*-%ylg;Q$>7ABsB7tfE{=pBkhS;Y>U
z{eGdr>rk&q+URZE*8^005N=it)Hv{OCRWDx`Z}C68XQtPG~#WFS}C1Xv6$Dz>?{E7
zFu*V?{c~q!`$JX4(tu1*k1&(2VtigP4wxqdS%;S6s;o)2I~>xehcVC#k_Oj_fBtGQ
z(K!|bp*uc%E?x#{Rr?Opq5bzV9IZt~LnsBXB|^k>kTgoMPLY{nJ+p4w(xE053kdIR
zByvPH?$<HXLcm!x)p9MVM^aTEI1@8vx6%(aN@neI(cHSYw=}w^R!5=U8Xc==N*=WA
zD&@Zx6?o248nAY4bzB#WbE4?$UdEo{1$iig1ebA@GjxqYh~tU{h`QnA=fh`AsiAXO
z2B4^&P0JbYyMEzPQf;BZohGeiJePud=m8hhgb<`>-PbIKS&_|UH`HEV)F=`E?I!c7
z0If3G39sQpSF$n_%oaf>opTjwDgsrKu2{p)m4WACM9DnBFY0@w$uD4J)^sSRKo>No
zdM9S`tqOg~(F($K#}dMfj2ZBto)6*3LP@_>aD8n$7cxs1TtmR_vNK6YKs8RsFxCJu
zDM00lo$O(Xj1UN#!-hbeXccpc+QkCz8<9j9A}oDDD0vcn7ZFZGXe+eXz`APc{`XLo
zn8}dz3B9#RL0rgqWMTH9zgR7(#)R;i7G;{K0*`=Pw96RA24`Wao0%e+DyOI@*rEoc
zO+N~+zVI7`bpdhZi2PTbf6@bF^yt3>Ms9~pXIZKobs7cAwMK-ZI+Wm`T%-OMnT(%X
zk?aXGGsfYRt)YG&_5Ffaf$xm;sxi_*hI4$Y?KU@e!!VHy5?)XL`ILXJpXBfDa0_KQ
z4zEeS<7dC~bCdn+$9nE}k*dVcivF8F$!FTR^ZC909iRQl-v7H@-}%ov|GWBc@cqBr
z&wjVx)!*Z_zu(_|I>)Cv*ZgUo%kR98>D=Ex*>}aWUVg{-w%_BNKG~5z$?wi3isLgs
z*;<mbCc4w?a#`$hdfcYn<GnnffC92a?0K{`W{Xi7eV-`aoP-WE)s6hSTu;yS10zO>
z8YBV$Yode)45%4^Vpt<HHj^MYp-seTxsC0%DM@VHfZ^!WLV><1!>68W8H8>$31?;J
z9$XZn2uNlW(4pDc*!B?0C9FqP1Oz*kc8cnLc#L(GKti@q!^drxEd)x<)RmcOlk<dw
zbZIjMbgMFD7vlzbrwu>Ep~Xa<rr`B6w#&M;Z7hh<{{-r;V7y97c?`d6DdzETEg)T&
z6N3RyG^k57btcA|t7<INJG6nLj<u#tC`ODRqd@jk$vP7p5!8HZk(#!Vy#-Z1D>fzk
z#%wUse>yp4HcZLI>e5Xpe7dTGaks>5u_$V?zemc<t&OR<K}%0LjlwyKx`}h5T3+dx
z5yY!c3lE`=9u_ip7_lb(jw^w+!x#dIO!N3AyS};A9=oyF>DiMbGrKr0j*H`yA0TY?
z;PC49$ewZe7Q3~h4M)pW2Bcosv@}R4p)f%udJagPm0?tojzWbb2>}Y$GcudZU^8;*
zEVf{LK1~E8r^sw4Aw5+rzaW4W1;<eBkS1w{n7Hav0XHWy{9s2{Y9@Mp7)|lbM!QXr
zB_c2<QHaQfpW_iqC}{-!RdBI-s92-VbnN^**>Ew>>7<xplW8l*X0&0rJ~=Sl2W5Uu
z-vgwtc{6kWtfSC}s)W<B(n!{71P8W&-3~oJtf@35>?Y|VgOkGKTRAGE<GLunP>075
zMYMD-AQOITrnVg3#9%ss+2#*G{Rt#LF#Ds@!6Bq)b6q+IA*oIgkPEI=cE6F7k}VH7
zWyld(5`032okc&2A_x>&xejpn=Y<-4T@SF9>7GGU)|zJOC|Y3(hSzY!OXzg5pDrBu
zUidF1piCNQQ2;f;ef_o5k?l9Pz-e8(cFiu1i{s+>)Cb`Ej(S{QZuI?h#ZE5YYL|Mv
zpLf@#HgO1si4vJ0lqwQLAXA3Mdenm}*^v868|nwJsiyKl7VKP2b!o8^TN6UVHVG2O
zNVbTwO|UboCV6Zy!Jr+WZ9g^4d?P9pYA_omA^eT%X)Tz1CU{eJC$ZKQ)cGXm7Mi03
zB!q||+svBX#n(1nN7UEDE{AMg{45fdAmgC6#VQ0LOC?VfJ8#MysZN4g1MffU0*6Vt
z(ZZ)MFxG@3dq6*?r<E>Ziia2l^om}UpgmVPgqYmv_adgVvaX`69o{(!T4KKtsJ!bs
z9&EBhS9uoxYCJ;=zTOxXDJPqCvp)gZh{&lac~wdZC^QPx?r20|r4wnxp+YmTh$1V;
z32M6{mS~_IAbPWbe6RXWuA?-5@85b!4ULWqFLKJz3=Bd?ibA>i?J@;xalfWx+vO8G
zJA2G7j*H{s`1Fs{vopJPa<kpExojuhars_DJ-@MXl~a+=TG_uf71f<oa;Wta+C#_&
zY><ayE6R#`8A}gp-OwZj9I7=%?Fqe1jP%JnFl97NMjWM>6(YZ2O%~Q16T8A$*Vi~7
z^u8u03RBdOEm()=ZKcV+9EfgUxT+U3$}uiKHK}~D1c6MBW)%@dARm(;KQ|#-kwsZ!
z2?=u--O)BwOonq^R9Zp8vaUkWoFGUON(Nv#6rAJa4{)LXfPFMh?_A~C(ZFX1F-Qt6
zvN_HvwoUji5wlSD4w%lAX=JG`q%j7>zi*Yh7#UTiBWcPGsT<Zt$N%{vbgQHb2Q=AK
zi?T?)jhST;Et+Z*Z49V$9CsB-gR`<S#$G`EUXFH#ngkMh{BN#wARM8d1S3*417DLl
zoX}?=?ZxErqH2-A?aoJBILxRnip@m*Kp(KURc&t3P{DjI$_owzSb!MRxZ1^Waa<gq
z{()wFpSxA2L7PDa5t&hHQl)1M=~;$P35bc)?vVEDB6ey*@8E={+$QA+|8HeaqexNi
zXqx(B*IGxA%|@G~`ZgU?)W5RG4pmu<TYJ>W8rv+K8C(?O7TMWJtmhbMGf6?;?ad<D
zG!VX;R6tC#6l=4XpaF{iO8rsKPF&5%=M=(@s(k{kiqj`8v{H#Wtzc1?AbyB78~TPx
z3OObzJd|m&n7=7%g@z1t8uM7h+G4$u>=KHkuKc^OwV*jR_3^ChL2d~-k=QQCoS0@1
zMihQq#ZV+uh>Vd{JxNst+>#C1`%&XDQrgkSgc&o$MagzfgG!H65z`4XX+*h(+H~gk
zW>rihRbG=EuTrvA4k(LOn}WUM5P&aSrLH7e1k_rU>KmgbIq69JBEw^oHt!eczR?6(
zNozgRm<zHh{T*a2A&YIC;RS_-%HeZ9Iwh2=N!LAOnit2#adCY5N7S%<N;MSCTTtN{
zG={tz8<ovszEu&`JlYuYpv4!!eh}u>_>Vw}=pNE23p9}+0JC|YojbIpLyqUlA!w(V
z*TKm4>BAM$QW<@fCmS|9&&t}M#hKaP8H`-mp>|+M5h-d?^Prub1vBP}E$Ks8H)Tm#
zskNXTxB%!8TUU!o92g-Kpb}W;(lrI7D7LXOyEc$NBkw^Z5F%fk@XQfT6=P`_S>!Y*
z?NGE(Q{Jjiq6B`i5Sb0S?&#l1Y|KQ~QdbLk5--XiYjqZjk&cOCUoZ(hN6SsU6?Tw`
zNlK+ntRH1mK8Vhz$ofFOz)B-a90MpvzRR1y0fNF*<piT+oP1?9Z069!V;0Jh(S>5P
zjle5L3@o8Oop4=M87Gtzge_++0uVbIQ)f8c%=#JCmm3@QoQmz=<qJ^#CK(Q$km#94
z8i3`v_yg4Sn2j+M2f^Tr<KnnDKGOpYwT)x}){4Tpkba+51&N9MY0jC?npx%Ap3zhf
zBu~x5rm5n93|mmYOzkzA033UHZHGw;qS#m2R&O3oYCh%&9A=7Hs2RBjM5Dq<)D$fh
zMt(xp#0iVKdK)A%Tv=70ZJ8{jDS!+$G8WV5b6eT=WRYN1l}A);N$1-|l#OK))+R}S
zxnpH@M*+KJ*e3Ou5+<zZ;mLwhCpP$HF=Wg_5{XpqHiTW3V4yocA_KBQ$OA<4VLq>4
z=RYHRC5np7-o%Wv6ri9{YKPy$shR3V8nw1&(PZqT%T@R?<YCHTq&j9sRb^l)Xo4IK
zu`0S))x6r|s7#+teKYp;`1$N-svDpS%Eu(IBU=rOB6Z}ftW5VRhw!keIh%`Wl9OZy
z8pm&J6SFY5G3|j>5Fb<?N|K0ggZg=>a!hLf_Z}5?G8~3jo>#-aI4+Kh<M)3=#=wT%
z258T-0H{MmjlB_7$=ZjQOJ;415kUZ)nR&S)f2{}6>1gpmkEung5HqkK&a(t#nkqr1
zn5MQO&!r}bk9%KbnaC8|PTTGXX4S4p&TtzQeXFRwE3pVYN=TSxdbS1V7mausP@WU*
z=58A|xK3BRaftA`PYO55Vbyi8#>*7SLX{22W)_py(WfY=6+wK-(DlSXR3T3ofSP#i
z(U{C$N_Sj@4JY#bNq?LdN(Ip%=5v{hYDPI>jt@pl8*4nRux1p)2u;o`xO`PQTc&g{
z8g}8f5+C9sowFEWL09TWe-N%X?5|oQt)?(-wKgEJ7EZ7oV8xJfg5a*jWMMgzCa6;n
zlZh80KP=RR-kp^G6}30Y2vs&H_lM?L*S?beuBsXpE|dZy2~HeEPbgI|thDqNEl7nL
zc&MzyNjJow)=Cu*m(B47xu1QO(gq7;seD!}_!`Dc9Ma5-<KnnDKC`2ZIy^`gg&BYc
zu-=I8GFJ%`*jEIaA(m}wo(DuHvVs53r+E{ZqV(4!J^{5VNj?Zdgddpjjng1Xgsf=^
zXf2_!c@?CHF(PViwl-J-l(jMvNmj|RQw4_(!)hDao@4f4HPQ7cffZe#{ykoscl&lC
z!Dd<UZpT)zDbH3W8_?+NAAeSx+P&4^y9!kkAeKc~p;CuPf=LQODfBfZ`Ng>=MwK7>
z9Hyd4<OYThBN_-(=yLfGN%WqqMiK_->dG+KOnaC;6#|Yd=bV!SNr&_sOCnWdAS^gG
zHONs8pQ4n6|BB?JkX@`SY;Jw7kN{Lt+$kN?S^$jn^nTt$O(W5HLZb^ZI%-C4B4LR3
z33cW|GR4v}$K%b!MbaM_Nfgvt!^ju(k!ie%#?t%c`OWouRAA96-{E`QIZjhK^r$&Q
z$)%RGkkLwDK0I$jCKA3=nuW<my$)!_6l1;r?Kv+0<fG&MJ=;sT|F*l)?}J?&7snsS
z!)?ylI)e;GiL#9GCudHi5c}AtEIZ1SLbzA$Dv+Z?ZG9yl08Y#3D1f?9s5yotq6SXQ
z3kJ^0;Fi&R3(6hr42LXMsrXEosYau|a@>ax+l*<#XfUQs7L30i5PQ~i2GQ6Za^yH8
zPCVaYn5<@R74gCw)iOA4YN1MschtJJsP|TN|KKBYT8%z81KgA;Mrk34Mro^zQBfqT
zR8aRr-fu~o__0vO27!LlAXj(he$D;9PpIjDSU{ml($DF{#(WfGXE{v2%l>HIR*V84
zBgEr9jm@<#I63K|W5#I|;gpI-W<~a&arD4SrhmyrUE3Uq4JJ!2icSa{8U#~KL<<o*
z6BkT0-J)yC<%Ozr29q7?M^%R3sLVdAoBRkOl@(HLK2l`vH_9W7)9#$MnS;(i@2?z1
zvBwx}L+y#|AhBv797~uKnq$VMYdCR9(X4CK@fsFk+?!B$5B8D!2ukc_)ezYW0_BZ0
z!hok9DntZz<u=>A_8E3`XFs2ln|k)!&-2M^mOr@I{JuwQ+262><Kp;(bVScljC$Ea
z=aCM{=cPGwaI@vlecSEZDm%C#O0z70_BN9b(ws@@&MJ9WXiZuVh&P=6U~1<PLmGrN
z$&Fdcs)<q5Y6Do$8O<Vkh!^0~u211il>|(LCxM0;gL6}oVuB$-!iW-uHT8!!FbUm$
zM{_ksJoWG2?H4#lXH)JXLtKfPae7A{Q@)Gl9y%J7rK~|VxPMz>GqjkCg!MRuxoKt_
zcmOGc7nt}!6x$%iTh&7#{4gZzO*(4>`&=pZsF4gyC|uVA<VS5bNrZ_0p2fNe4YXhZ
zHj7$RQWi+kMr0(R9O29uj;AiVh*cu1LGvV|2Ta2nI)y>8G>(gCN&ONMs%_HlE72Wp
zgPOXkIO@)2KO0n_F(9q4LRU0D-f;W^vPxIut{hI6NAa_bf+T#bny4{4A}37)J}lB`
z=)=HC4<51<K{ET@=Dz5W!W#>r1rBv3jw~e+Fzr3ldx{gTvdMPyEAO!SwVz|@=Kfun
zb3#bdmYZ$+n!b@gc$3wizu#_r<l3P*{o=Sdp6*9&W1>5e4T)R3q3zrMrilzX3{l9`
z>7y|2j9}h_UjvbXutXEY7Yt`G<u)AQvz#L{M8B$|Npq#q#=D^fX_RKd*r^q@ciLic
z2$JeZOv><gukFWN#i_7#L;N$#X`~VOMy(%8Aw{i8;ySqPY!Z?1RvwpVI_kD+Cq}qu
zW5}Wk8=M_Z-6kd!5G8h0Xl>CdJTj>uYmlTO*(U=XaQGPx4dx6*ceIZ5mFL`ce9!r@
z^U*TKc}V<k3(B@pdykxkhD>MS3<@^sS;Bxx_Bk}vm7=eX53Z@0r|)ag-Yl#)k(?pO
zlT%BLOg=;`$O=6@T}IQg7x+S5Jsy06+J%XgB9AZGDOaJ`2~JGsXd<TX#Pui2xUg15
zNRppPeAmCPik_ZyQ|b84Vt8gK&j+51zK&8fM2?W6FPQzx^Sz8&5)2@$rqPw|PR#LR
zuRm@z+!5npGL;PXjRn|U$1&FJWt*ofcJ=C2dn%4+eCgfRzW(`Ucc1jo(3@5=ABz9!
z(Pp}-*WaFbWYbMYRvz2g{)wIakN!wk>^0x^AKQ1n{M7FM=p%M@cj3&RPKWQ=OP4O$
zZJWg|FTRi3fUzvl5Ys+Ayo<rG%Pl$7mRQzk+AeOtHf6H&f(Sv-m>YYqNVyMUo3Ts-
z7WZKiG{^54;LA00f(IOr8RVFd@qwimnN>_XU@bf&In0`~=A&UWEyJX=-$GQ|hPnp^
zK!%K6B8T88GfDA`Fs=($OpVbT7|Fq@L33X<xnO)x|C~#kj2hfx<UqIwaYXCNhBMs!
zeY-}LB+TQp82+0;k00Z*+elTZ7EQt+6I4hQ0pel-uBgYrz5kRHFf<z4F-pXv0%Se~
zY&y*GvY2nv#-Kf5rxT$@%w;OfyR4GvajB=ki1Yo1uXKK{*5R~Ja2OghLXPm(AT(uh
zF=Bj+6RN=n#Zy^DGY{<51dT2;6)VEY%)6Zmt{Ht+8x4M&@VV?MYocs!3b9yUtPsW2
zVx+qBg6~aY5c<8@6y8f$xL*swQ@F_{2(>@NopA=2FHR>%&I|G4Rb%4)fI72?DNn_5
zborT9zxhShj_H(tx1*i(rT405_LJ)8{lNQdolif>tCC%Q{ukNTeEpm3^?&H4cGs=_
z**)=~z3*p!$o^kH@tgM0_4(fd$ocy{IuvyI4*Q%JZS4Mc+-KK6?Gx+S^QD{Y=6n<S
zX)cbZ=Ml!6thN>KU{0D5=FnlSHby1prbc8<P*-5?LGn%AZXO>^P{O~QCcELaESMis
z*=t&nt#xxI*0das+aaGD=3IhJp_sPY---1pw}Ytr08Ls!$M@WB@2o%6$`=vT#BQvb
zPLVhW7_;_fk<c>b?LasIDUZ$2xPIg8J&@Z#@>p57O6)BK3S@@1p?xC?2I)J$H>$DK
zri5gz`g}UGYjY?zO6Ebx+^P{&OQj!hk&AiWlQ|hl%`i%d=9?r4WAj&wLK_(@Zg97W
z9+{0`e*QcO$bs}1oIy@MiGnVgc2XMZLhG55^)crQ(LjxHDop31cY)2$P0<HaN-_}H
z0E~0=lsrj3HwB|nGii8PD6SqADP?HbC5e++>dlO%FsH_^aT6Wxh6Uoq%ULzCN#eoi
zIRLwF0ka4-t40=M(i|F!=nAtmQ!{dt{J*B18l#wbVlP+B;Y!K~(L7lEoFwI<ERekv
z84*!YpO}OmpORzyx@TLvg!!Yt_Y3{rAN6N^_Z2J8zuDIJ|4zr%v()Fm!T!vj{U*Eh
zzF)F`^!-0#?|)>r<7YnKZr|T;Pwv;xBB#}l&57Oe(l^>$UjK3X|G)G1<G3!4KL|&y
ztb>Dum1$G3Pn!(_LQb?#kW$LDg)wOu{hJ-;pKSq3gpn@B`FE=~6gyK`6S~V*bLp0<
zkvQ6QDTrrOpJ*$^#TSW*&nv|WZgw(;Gngx9=<T`_3+}-p=X>1kmaBO90LvLNAX0H}
z^I<&AIUDGov-dJZ&q{V^V6K{)ohY{M2-)O)r!#G-oN3Y+B|{6qM3>aa32+BoWh1Sn
zG20Hp!zxW7t917I%$~QCUNdytigTzOTv|AJncRN=a*h<?z&fwBY$tYKgMFeK$cdzE
zNG4LcvToFWx7{9hZ^@~#JJg#FLk|7@tV0RQO;nKxL0U6A$nZ~WJOkZcGDkI}`2}ar
z`#q)wJF}<dLo=IaUME}DyKob##)_P)zknepS|}W;3Y0Oq*8li|*soOz^$GGzNrTnA
z4(K=2dx!mQdqZ^4L%c!yc&jYTq^~HfHx{BN$6l~aC2N8Qp@`$Mq0n*v`8-nwrr=x)
z*o{<%HWXcF&D$}h-`F_$sfq9}ADNxJq{En>hD#|oH@p0-{`wDj3&6Qw<Y(Czece~t
z^B(*u`+xt)zp!^aaDzGGhweSR_x8`X|LA}9pV&9N=1x0apRl+8<lnIG|6BjPz5m9>
zZoc!2>`(l!zro6{KWs00^H<tSZeHz!Z~Za*p}+n2?dR`1wlDqmZ?-Rd@m+Rhxoj{0
zl2_TC_A&eAAOAu7!GHX(?0t{yE#3MG`}*(tF8j7OzS8cTp0Hp4vA=Hr&%gI;_OWYy
z-5fo~-t-^;FYQmf`8D>Olf~|R+Yi})`{R>+*MIuQ?A5m{_WCdV7JK)<{CoCS|C?X1
z`tmp0H+|=~+nalK*&cj{{n!uuclHl|@%{FAJ+|k3{+sMi{6~MxzT|l)cJ;l#WbdBu
zvh8o%#ql&g5LDt%j1X#K0KyPzDm$TisFu4jdf%;=yOVmd8~G=9ryc&^0@in<dud|U
zMS=t~6d+UTJDo-7qCz@JWnSNgE^MKtwIMWaL-_pE<)z9rGzlGzI#s5VA(Aj5Iq+Fx
z$DS4S%*B)~R%D4q<S(yLRj?L=ik>DpR?o;5*2WweL*2>Wv)kLr@z$uc)Ie65`_DMO
zzQ7jl)&B<c3WymsYe@=VsRdb8QWoP*xe`kCz`-+F&)l|~2|u4b9@x(|tx1E%8ehyF
zCq@$cb%*{T&S5bT2Ug03Ohux%Vtn|!`-yH*uv<uF^g^1i0x86=P|T3}yr-g><<6!q
zZ7?27@C>Qm5wcaYvJpUQ{rrwjj&VUPO?0e{pRt+9)(b)e>TgkxYl+UtA7rLenpGU-
zAaZ6+%Uq?@ZiMzUlO}_VL0HhOb4>bN!64#@gK1MnvonWcGD35Q;}3$@SjOBOC&ZM*
z@#uM-+0TW7>WWM+J8d4byPRgfD0{`j7)4iPzfY0V@}pk9t^c|8(|S+a9N|4})9V7u
zA?r#vztCR%>}K!%mmjc)9zC^xEhj9`vv2-S|D1i<eg6;pli%}e_UQC{`(yvb|K9$K
zKXuLiv%m7I{kk{ytY^K@o^|^#*#GU%{55;vrdQZ^{0HA*U-Py1+k5`M@8~!Ac6-Ik
z@34FS!4KH~_OJb)Er0PJw?FfiFSjqf??HR;7ap}Q{ty4B_Ep<owD0>1f60FH^mFZh
z@qhW#_8&a>z4q6C`XRgfyZ$r#?$7;A`#=7v@3CKf;@IwZMzTj9t@h#XztjHnFL<Z@
z<-ha~?fx~}<-1>L-~Nqnu)E&>H|)Frt9RJZYro$9_#3|7-hAWl*iSzB8hgvveW{)O
z)L*qf`%iz<u08+j>`(sb*V<i|FJQu_^ASW0u=1o-zV*xrbaESNw5fZXlWrp}_u$nX
z)Xp7C|L-kjJNmS|rKK!31ZZc_<Y$yn9G&vnT@Hg))bkf2MEyOk$;XjXVt0G6FSyU!
zbDU=H6|f!3E(Nyxdfk%@2NvXl|2jMH+Rp#W@7n^(D|Wp*#&wfn16^GRQ-(7$I|x!N
zZA`s5_DpZBV-!iz6p&*hImE|Xxg9(@?m>LhXQr$Sinhw_m)rNHaE2M~k8zMD>UdS9
z7E5AeXJwZxTR~x?+fZj>dWnw%yF8+(tieDFD_3Bqa5Vk_nd$K?jVyw56{+Wwb0yo*
zsp0D$Uv!jdV58|5lyOh>k~sdBhT<_O^Ql>|{o9yp)4yf!Q#T79lo##1Fjx}jT{-oW
z<HWm1Mh&O{hTD0{-BV1breaQ3N~2hr)ORtjEVN<-ccz*}>x;?ZI9x~b37qU}@Xy?<
z=ts@PzEHgGmRQSLTLx|ZQeV6$PT60Zq*O!-N{3-;q1=JmTI1)QElU0U{#Gs;-z05j
zp>=1Jad9dxpwy@%HY#ZBA-J6EvvKZLI=R%J-C{SM+^aVCiAQ<<m)lo9?*sO?|GT%_
zBmOu~@3Wu!@n5vlFL<MU;Z1~apZxeo>{oyKU)cMv&UX6P!*=g|AG6&px7sc64XZuy
zuHUe?zx^Hd;OWjj_U`xE{Wp35)eG#G?|6lM$%`Jh-~8FP+xs54YNrqXs{ONHneCOY
zd8u8x@=ANdm)~qZ_qTq)e)*v@TX&D!M?d-)p1~(xz-4>JvtDA)y7aKU?Pvd$edOws
z_Ms2F*FJo9WY2x!i|myze6HO*KV-l1j`!F{uASLq@A{Ya%kTW4J$6CLcv>H*#%K0W
zIr?(E*^*t@$e82A_>N3W&Qoe)JI@Gkoo!c+x+8OXmGA4_40{55?7?*|QtdH7e<!^L
zc1zDzI?w?dcWE;*@Lq*xxlQ(97vnfc1bOoG%&tm)&Yi&ZIVPfKqGA?hj|tApg>Y9v
zfxa?tcxge(?qGiR@3<iyLe!Fs4jTEU_ra>S*6rPHW-r^??c}xYjLy2f@;{!;>^k(n
z^V-!a!Qdomz<x3(ZXaEJBl^0;jqn7-du4BQ=kUaCMNOX~!%_$G>+&S1*LyrMaR)fz
z`IrrwI%lbHR6QDujpNZdlD_sr<B{-R(iMH&v_p2ad)u{!IDQ+cEN5-8M~qnLq2A;F
zZ@11;%rHrtWD*_ppr`GIbp3UenlO6{){xQf3*hMJ7~bB$ZCg0U#w%$U!5$2rrHyeX
z%d(R0DK-qGu5iAY8Bzc4%Y6aez(ixpK)G}Y9z<Uh&?oHY9ldXUK4*|WF+6nO*zGXp
z#c#BUor6wrGo{|f{<q5SVXDu})Fq+Zfi6=5<=#E0M`o9fC(3TML$^Dy;(q=4DYBL6
z+GCcUc%uL9_J8yD?005YAMX*$C)T*y={38)pX`ojopAK|?{r>QZnDc~SM9O=;Yam}
zC++I=BD?7lSJ1NDuqUq)xJ1AtrYl#{-cC<X?Z)ZC-&Zzg;@)1mVpmRHVsH7M|8MLM
z&xEjZkA#=s@+sc8^xs{xkAM7A)CHYbw7u0{_}Z_uFZzqGuy1wG=E2r{zrFQ6-JtaV
zrmbhT+wHja+cmp-{S1)C#qsn#JWjplOkP(a2cB0s#IPe!9;7<e9U89_;XB{AH}`Dg
zh7XqP2Ke;)DFq8kcPvh>XoScdfvOrl2_jme;P;KnM4^D((T1%cNuiE11re8Qx1DT3
zA_D@3>CF^KIO{gz=FPF~`rkdHnw)H;T9d<ud-Q*?4##;}jVc}ezbA>kr~5=E^>HKP
zFLl&|q&HIPOJDP6t{l{wSdJAoY*M4F*V~;7Fs&xtMCU*(>^DoCqRdexgx_j7H*#7;
zn$vhGQRKac+gkuOPzaGaJ)K$`O1v-#A(ANXSAu#ef`AE{JA$%9Kk<HZP#g2+-AYzU
zd@iY^{A@N&!9|SErbgg&kU&yB2<hr@hE#3O-r(0r2M4jiQ`J4ki@2ku;zc2;L0#g=
za`e$8fe?(u_-r||7%`1JvT>9F<ed^TC#YKVx|&B;vncA*CW~pAd&F_jK+GbMK;A?|
zKN!`RLt`c~3?n+ow@7Y_Q3^u|FeUrzc51o<3#n4y5Nh>cYZ^9>zj;Yd4Lo(DUuL<t
zFVI)VGy7CWKmV&e>iT$sy1@CPUA^D#{m5!x{OVWPi{E*_J^I0`Y$Je^?$7P92kqhM
zbL{!gJhHcc><rNF<>%gIw_bnP9=h6Jc#}TIKK-Lzf6_kw`1|br|M2hHkNy06?U99w
z+y1?CdWAjm_$7PZ^KP>32OkF`3M$wjGO^AG*Vy)UcH<HI;M;%B{>cx1pZ%lv??_(;
z<8-p;z2U|7Mdh~ce=qk(&|~cBCcF8jOI9vA1D@806GD$O*~pV>%pP;!=mD#vK2G+U
z6l^!uyW9zR@^#k#93O2th;d%PF7$o9?Y3)*z9_K=lUUKHdpSef>+R}i^(8h7GCS^0
zk;1#`rE&+9Dvg5on0Ci7iyeJq-YGa|8D-Ph?3`gN)c@MlJK89EFv&*ugb8BbZol?M
z-T|DhQMe&#()-r3W@Q;|u!PaQ9>2*f9qlHfRiL&*bXHkjq0*0+WUA0G|9pytvrlw^
z1mPYf5YKkqX@y9yCkJp<?!$_jbFIZdMfE^6c6vL5W;T&DOv=QCH7}W85DMzNe8QZo
z(BK-4SHuFTFabsQgGl2#YE^V>>QoaYl@SQ^s|1PhJZ(_UakG2G5o#YbQHcZ2DciuM
z{lY`qpF9F(E{U&WYCa(o^RyQkX1|F?n~YW_PrqXf3+h(hj91do^}-ZoiDAb5-R3l4
zNuGO_gAy?XDKHnc{{-`K2q@!z`up8kB6HU`6i!*C%>Pq8gKPiR2P}2S&FZIc8NTOw
zdS4&7X3PCg{_DSAAF{Xq!rSa4&v>1E`*(bceeIXL!d~=(=i7^3{%U*0bFNr<=xz2d
ze&g8Q{Ow<EFMH0NcIWdx&))QhUt*`f^mF!`H$JlzvOe-|`=#GD`<yTP3j6Xee5pPE
z?z`-{FMg%H_>QB#nLlX1_|}iwEB@%W+LylM*>=}m&$E}jtiyheG4#x_-SJ|3#pgWJ
zZob?T$%o!$_dRx-ec_w_u)XF5ciCNcKi6LJInTAbZkz0(4}HiUTCUjVzT)%jWzW02
zXJ%h!U+|K<?6%{J8rReL@O^#)sBA^e#~X?{;oK~e1#klt6wjcFSF+!{Zr+1jc3L*6
zZKyZN+F%8{J#eUyv#1(t+o@{AJqa29@s7^iINPC}CfR{$xG7}dZM%~M@&mfGdcPd!
z<HTABC3rH`ptah6=ZZf-11VVtJ6D-yx^48Vu*fN+oRTE}<fR&nV`6{m<t=MdsZvp7
zS?W+>0z-P$q>iS0Fl{)`QR7UCl8k}&Ws1FH5U<bpaxx!m_=4xLNmLR76Y=@aIKGGE
z3}rSFx<wZ_-2xddjzcEX7;8H;mNj}>45Eb2)dZS28r+OcbfOl@4`mB!e~kS|X=E5m
z^;lz*v&;JIRRjrlQdj_~>g*b#cYd^Vx=d4;C8YxBu}X$Y=T3Ev5d39774yr4=jjh2
zsqrvLs%26Q&OZ|>%7Q}!0`RPds>>!(7m`VMb-ZrQ8;dkd*N@viX?|CNJ{XFTX3AXC
z7$1(N;~0044`Rjc*z3_{+n38vNdvO?V_m-9&)}|0zCwSOSM~4j5MBDMN3H(c{dV@~
zwNLu0{Ui6<Z{K^>j$iNv_Emr68|;t%kvG}vU-Nt`ANwu)?GHa-@A=Jp?c|HT&A#*B
z{bu`yH@wQO|Jo1R|L5=gvOPSrr|QM8y4$Y)`Y+nMAM<CuwcDTj0=whn348Ca-q#oK
zi|iTGllI|W+xqDB{`-?>+si-qRy)1-gZ6<B-EZ%E-+i`w#^>1^-||iN&ENR7_WD=d
zVfzog!`}Pglf54H9((jTZ?td!&hM~qeajo{1^GVv^?&sNd+ho(+rH!t_D8?r4fdM5
zPVJq)@Ei8thi=%FSAMm9%eQ@teZ!l+++K3inLT*_hwOtNyw4uGR_s-8>Yx9XKWv|W
zTd%=AxY)G^-e>RYwYW!bJasJ!7stQ-BN~veq`ghMt6;>fiD*fX&?X@%6KYi^^dn2l
zZ;MEJyDgA?T2m53Zc$$p5f|8zMmsgjIY11&(5kruL`^DZN!^j@I9g#ms|$6Vo_&GT
zpqf2LDD}_UGQ)Gnn<Y%Xfd}I>;y~FbxL_EWbUY<a_Hdp;QKNAq445>90*)n-<A9Ql
z2lD7ell)x*+n!~SHAXp^vO1G&UmGlLzuuadwPF5PJ4_%cvZoWyl|P4+)K|RdmIlU0
zB~RZU6x8BZGU)t`enRLID!f_lm<no14T`|fu?kfOWBOC0oRKIMg1T2GPKu$9NzfRe
zGp3`V)8)qoY?dTuj*Sb!DC;KOtIA^JBqa-?kZIJ`nw(l{Z3x|>UKh?~BIK6!ouQTi
zXWN*f=PIQN&xmGrz@Mq!=FZL68DyZ=kSO8eO9}*XYHFk|h<t(x2*S#|TA-*|3kr~d
z9;P!5fklJT+5~?x%JQg%WRzYUT^ble_44g@<M>W{;DHD1sW>*h@_hO8o@Mp*&$oO_
zkCu)Nj8hbBT?F&AU(0VlYO_l|J$TJN3%MZ|$Hnn!9lpPAzx{T5-sZa9^yK}c$8*vI
zavI<U5|6X2odLM-@Sz)j-x;S4+ZlUUFLh|p>s2MnE@B9>-I4=%7pVtrGi`<mn1U!o
znTCBzau`nX*e24;p-iuu{-$go{_SG7&Kuy!k^;yui<m~@7v~=m=3_t%6i;ZF_j{c#
z75%zXUI3vx`3xvhN@J?>yilN*)CaPwfi^YvxKc0H5S)ilFZczOeu1N^U?Djs%I(~w
zrlQ6GoqGETKISq4h!wD_dEL>CBc$Xr4JQ?i8!~`R&Vt=musJ-<TcZza6+ge_fdqma
zuM>wjrRqnartEnU#!vH#n5niHE{Sevungm(ywME`6t!s(n>Xtv^iMf<n#D#m$?ZF|
z=FSvk58=*jWu(NWIzpewbo{3a7u80N#M5*?wIXH-XJ)du0Pw8ChoXd5H74SB5~75H
zhd(0s@yHe<qG9ILLI8MXop2JfXw~()0>AfJ1c2zD!39C4p_4EcXl|K>YBZK}ve7vB
zR33BBrk?oKhiv=)y=`87s~z3Zzxeoy^HL$QyMNE#_V+&eyQpPc92dva_n;1H8^*YW
zCSap_1=?)gHfj6_Y^Xb{Ui`YgquTi-W_9jP<*Y-869fk;vao$+#0vS(Y!VzW2@J4q
zM0?7%Am8MtdlK2aj`ZYw2KhM>>KM#=>Eo>1mK<7!HTc_sYWcM+uy>)lfoqdf%0<Es
ziDI}834%-=cC7K7HfqP={Kkx)QaD3n`NCB^%0%Q0GEeoOAT&#5C<|?37P_i6h)C5e
z_Bm&VQIXzUN^n*w$?vTtjSuk)lwKfumyBr|`UWJ%SeoidNt#)nk@(G8H6T)FmsNPm
zs)sRwNK8>%RZl`81J4YUdN>O2gVN`lZbD`{g15sFNZc0}iRr=w@8ox>Y%vse2_<^Q
z7}{69*s30kA$8`%Lj$w1__-~lz0b<@kYM0_#B<$&jZ`)z^>YyhSme+>gDOEOXw)5a
zm3cU%tka8`)_w)vP+W=sdgGrfJ?FGoOa=9Vt+VpV%KBCnrtTEerEip0ZBT5V%EPnk
z-D8i~{^uUC<>=g4ll_fe|FetZ;`jr4q%jwd^>B@E!XMV(fl`@Z{grhdk9plGoL2QM
zb^CfYudr1ybe8OC8v(Be?6cG`XcuG_>MA;TWMC33Xc}z<MTvza19v*kX6)y2#feW<
zq>8C%syvl0k~cLc@)nlX4t02(N0N3T1LoN{ePfb2m6Q-iLanU*d)eK;1NAAtUL^-h
z<xt8kw5$SAlPG#lL(>p*1by<m*WV~tkBkh-hqw=ps9ig~0p$%SGWocfBK8ytUK4TB
z;PIiJWa>xK&4W&#XCY7vZXBYfj12-oEykAcGbrc5A(Ktc#Ob6}o)zh5;vh<INN#e5
zZs>DU(=(izH>j}zx5;VJ0dfYHzb^IP9~TP$f|MbwcAeEDrpT%3+PwIOc{c7WJf$xr
zfDlM6a5UckP*v~p^YspRKz;pp4ja~mvuToQbi5w*CYTN3-Kq?!l!J(HY>+Go760LO
zdjt=B){C*oqzkiAWL6T{+ys7XB4wn1`_qs8o}ZohK%%Ec!1v;~I6j*XWCB2MOy!C?
zf=)nlE^NIvDDZ6LaNLP`52rUA19tHb@t&^AvV}V^YZU9oXcDpY78#_Z9!+Fig=8(v
zBea9aINNttd`C#)HT1OZpysjHXeC!Yg59gEfdL&_DFwCcd(c~0bNBBz*`!rHq#5!}
zOa;+8*2tEeGKnfnB58y{J!dRBImPco#*kg2P_T2A4cBmni7i31+J9Pqt!G{fmD;Hq
zgr?;}f8%|+eqR<JAv1wT;E?L6-?v!<7?b2aYKjpfO<a4zZ7b(Wqv+-uR-TGcY*ASf
zMgN!~CDz2CDBn0<dR6E^CTQchd%vK}baSJW38|tw)~SH8CuRydDQi2Z8EL$R!-;97
zrXTQUqmhsF8bpm~*hL=!uL*eaqGsw$rc4El>7S)WYyUt@H=WR!eBxMbqs+c*B+iI9
zm_qMY(%@4*P~w$%nrJ}$?kEHacSZ*3X>&PHMi=$baSQ^r!Ti~l8hpzH`517XR>n+`
z?Oq%g$Hnm!9GUY0Qy5cgYHvwGU+7%Qxj-8zm6I|Y?#DhSX#vuC-uJZDQ48}LlFQ9`
zNd_?CO0iwYw>1*kyp{&JC)wFe;}|4&Xs)O;XG$fp--*M0msT~;%HTw!9jTyQC_&-E
zlr)6kL#iZ<O&!wo1j!vTX5qFr$P?~p-Tv-!h0yq_+T5v2^r5~&=rgTE)F2}WQ3;oa
z@_t`treH%xKQ0I>nI)9U=H@0H+akhVFfQGPG!6Cjn=my^x{N8Gt=7@!R7GZJ!eIR(
z_xlA<8ak(|Zk*sY3>`Bj*)dNGOmy+@X|vOaT*$N|K?Bn*EBXC&ev$d<A`%H7RKZ}6
z6jI&Fv=V|%i8!?P5o|KmF+vy;PFK#d=|L2UXF|kMjjL2_-(b=y6C3vS`13x7REddt
z&e=AgbSA<IkZp4DO4ZYtzOvSZh$aXs#$b#yFwaYF^+k?bq<k#1kn2u#3c?2<PQs9D
zI%rHfZoI$nTo=d1@su2EZG$+5Y{O(g3xmW}ss(NXU6=I;L3PqFT9z>!#@lFku3Lzs
z4g0~;IaYEN(ToY0#Ksd1{G=dw!OtsdZdByqWMQzKD}!Y3IX!JGQ-o^8wy>3m#5ocp
zU_CO4bR*bJY&5P=q#$I75hjhbHk9MszB}<mqU1+~eWsR8sv2Z$`*&lU$tu}AQ`Q=$
zshNTR&&1N`{~8MPy7x)!O(=+15^=90sX&4P*vUwh+)44>j42(xpNX(QujnXiR#7bw
zU$FZeHuDSLOd7?U#=uA9K&@&)=x5GoNi^b38eKU6FGUe}C?+RrtO+@*O*)honFfds
zg~Gb{PEqb_5c(6Di36ZhCS%h7V*QQjE}TFiOyED>8ynxE-ge1TaL+go>69p%nfixT
z0JK0$zsKw{KQ<-w9VvSP>bzs-3t5ygXUC7FQnkx30jl`MQE%>Wd!`IH73W^b{tOo7
zqE?0Vf_Z&$TpUlyAr(~`(smftWDq7uqP1rXn`Eh44y9(mhnRbnSi5%=#nmgEDqd3?
zuzpyHq<<GM*I2(wpup2{VOo2OvJFcpo=jlEa$+AA1-(rq3+f&wp=V8SpF(juN8>pI
zRBE)rrcwrS#TL?XwAq~NHCa{SQ5*Yry}kuosViy+%9#4eGWydf?qK*1&lo55a3$j)
z%B`{8XjN9Dfh@ZJL2jcX1c|T3L`?NaWo0$)P{;@gZ^;_WUN_Pk#A;88x5rzge0+?Q
ziz3mY$w6=-KpkEwV(|29i-$(X=9f@#a~h02#zI%qv`?~AR@3Y$+$TD?J(~TB#he#p
zicpGYZK^1%%OZ$0d|u3|iC!^Jr#antUs-_MHm0q_oF^1pZ#eAf>_cxuuX3DNP%9er
zk`zNiMk=VC$nzS9xuF(jbUIi{l^GglfHh7#^`h?V(kozBnldi3gHHDd>4;k^Lk@?3
zaa<f1$7g;-9cpQZsqId!!bl?YHRVA_yE3t#a@T0bytLp-I5fJNO{ieg>+}iHdf)3+
zT6{)>98jbma13HU7iBF)L@kbtqMg%dKJpPNvlO@KuKK>08-cy7gxy*Yz?|{t>|j^A
zNI__0sP6%M6H#shTgN_8PE%${<5&Xdpt!rZt_T*W(Ixh3c`{NYT%I*!3;Y0`a5f@i
z7*`UG7Iu@Q5@c~}9fX(|j0sjDD?_AqZUmi$`J+It9unTH)D^^sEC$R<MjaS5%oaGm
zD|!#4hn1KX5(%Y)36E^b=%O1v9^_i<fhdxxY8*{nm|s(y{6DihzgSDeZda)jlZNj_
zJ*j&b@nfjHTN?`o@>QAap`{Y?b8Olho&9<zn;>Sp`arYH`7%__aOTX0S*9_~#aU?q
z&Ps*-w2vqDK&>jqu8Gr6c}+>IB*K|!+Jgc|Ux0=5f55tO)+`?De&#Gp`NDBs92dt^
zarjn3A1QG%2E}T?rO*Pchwtg!7VPV@{@VQr+8O9aldsp{3s`|9U2rxaU+4Q7x~NVr
z%SCl^wgI_K^YX!3BLk_Dw5t&GhMZKQ{c|z$7~VKqmlB=o)Y!qgC}?&eVAjc<S<RVv
zF}o|t3;5~P#GYH|qf(!5_yb6xuWU}vkmEC@k#ySIDUH5W<aDZ~L8w?zVkAvfP16|z
zDh)OmNsl8-HEMMkD)?^ur-eKWQaxL!Fod#%iEGar;13SWkyO-dD*;|T?3P$lic~bm
z0+47f`XDkR0L-;%BxaxhDn~YIQc)CB!*eiF+=)~XDmLX@8lQ>dV$yQ6p&wSI4@gJC
ztc6J)7ZxyGv3ZaxqZXPOS&6a8W&!UI->AtNSF4AlBsph6b?R?uRMQAH<0LisRfShl
z{?%*7zj6jnf1P9I+g6Z8`T|99IO+bb%(m*v^JOn1C8nkezjbk398bvsh%IXNiQ|&W
zD&+<{Fq5H&3R6I#a1XT?5XmM4o^HHtt%IzEt{Z=KrsiJ`rHH0pr$n2!tE|aSOEeU*
zltHIPh_EQ|cBgifsNge)qg>f~l!bCp@H?R>1Y3&0nRa;+1UHMOKaCokH~-R6ANAKb
zIW4UudDJ+cAid$78U|19Ym%<)0cmQ2QXwjACdU^@kw8SrJ-KgNqz>ezCrs^V0fkbD
z3F%I2hk=P<`@->TRAYfrO@!SxAS4i0^is{*k}@)3kuvHj@W950y;bv^<C(beB6z?t
zNz0Gj)J!e6lZXx}9Jw5*t{RuwVqzzoo+pta5cQyD#G3*&=FyO6($ye*2+XuZy3S%O
z=Tg!!L!-?5-TZMW_1|hFfS&_~SynpypnBTKE=kIWe-MskN{>{$zxKp6z|@Lh%0hD@
z19H|mvpKH`_co-~rm-<}(y<&aj*H{s_{<Nr(4;ovT!_cY$nLAAxO)cVQyfxEZBJk;
z8;ENS<DEDkgf(^F=FZN8mY<m0ZZBL5F-C_3+b>`{7dD49lu9?VL=Zy8!fEiwiM_3O
zAJj5z=p(L}*T*TzS3H9g!i14l$m|G1B1w@QD^c1pG7M*-JFeGSa@c7@FpeC+Q6Sea
zbo#$LM<>X+eKQlXB~^_;)e@VN{oG)~bJXVA&^v_Kt|n_l*2bpr#z_+vg-1W+B%o4}
zIV{pi2azoWJ#j{F6LkTroD)2y5z;Cu{NchK`br$c2!>#b8V@ffE1P15N9-1us8Nl6
zQo6VfBd%t^Wfc*_R1+h1o0aB5aX2fh5e=Qm9F093fJ2`uf|7!-p_s-xS+EKxWuCyi
zU3SWt>4mdSn$=a)iiibxHOL*xvXu6hkib&Gl4>DztSsqv=N=7?elHTsp)Hz~{lPaj
zPLtNpp94B=zqjMM`R1E20_NhlI4%xn>+bFG$DjD5zw^C`>AR^7V;<!ZKURq~xao5N
z1!voBIcE|^wRJnNRWuKf2gaEtlYM+%V`k>2JX(>w?&NjwV;40~WC@1dDN>h6LT=p3
z7NJHS<a&RZXF8bMXOwBG3YMMtQO5bGohGvp*-0c`6Wi#!F#8X!P#NtyWR7P{sX*({
zD&9dNV|*j__?eQ4qoQ&Q6GhV3F*(`J%_(eyT((hZ1rk_^>KMUPwBTF_ftxblH%)TW
zw2Az}ByZ~<K;cMsOb1yGH5+f-mEy)^0mF%Ane$+{Bz;a4A?HvAwn#8YcX!Xrkuyot
zhlR0vt;wjDIO8>xh$<bnYkPX-C<M}x%OO?bpIJ@2>l#yxDIysxNB_#X@^Ac4#RHtO
zl;b_hDF@QZ4*eF(VX`NBxe6j8zmB66IUez7|GcenOt;U^K~r*;<WwUpxu}~DwKLs6
zZ|?SP_~ZV{lO+8yUs&jr_eiRszBmgCwM?ed?{)Y+MpNI#adBK6unE800R#wt%LpJB
zW5(3fa|tOYBjV&n*fj(%8G}ln@H<%>HD^pU?x;#>2cu1*8X4J`0xSpNj%*M0or=t;
zCME(|qmA&Vr)~S)jJ;emv&s{O-AWsT?8a>@1Qup0UqEy`+2fez!IH|cBRXl}n4v@^
ziy|D3Ej(+_7&$sBxr9?CBzi-(bCW0l3{hV>k!9Iq3ViMM$u(5{95BmlSvBprv1S!M
z1Gkt&j79pcAOTipl`YfrXW4fD93NPTKCYp67dT;KwgYybig}=2T9ZmdQR+qr(2cX7
z;3~FC9gd3GRp=IyA|DO9gb6XSMCo`<d5i*J4Xv>;x5bPq1MS|6nogDX3k7|%vS5h(
z$FXH7d<;@1Wv8;{f7Ld!uuu#^P9qtmCd}4ZeNF721$1`mGp<<FhE%^ul^&8Rt!ma6
zDWQ{~R9DMiE4#wie8@x<Zr}m6dQia!8`4%{>q~`72HG33Aj!yysiK!%#iO5xOS2&Q
z`xKH-*RS8`|Nn+v92dvM@hOhPNy4bT+oAmiwWz-Lj%DXu#eEByErvyI>{QK0+aR|o
znBI$GzEMA@+b$mv$wp^V(yFo$Ynno_Fn}#;qcPRPe3XfkJV<!ph?6aGAlRR^QlZ1i
zBSrRe5uwa&rw<}_JGxT$4>st`m^`3=%xL$wm}*ZOwZ$wh+U+cLc}LUy<b(F^Lxl-*
zDty;a$Qnse%NF&hEcg#FsL@Z5>Mz=VJ}|SV%@(jJW%&9z*MPi~Qp%pv38-s48k9Zb
zah8coc(_B^Lh`7BsS><*A;WM`OA$<HDi&7h8>&};-<b!?Fd_;L@=L&o{o&RgHN*{y
zIbKUueJXKY3mlr7{a6^Ju2&MJ5+kV-)rU#XEaN(pYGO?{&x@)1L}CbTdW&q$X_&ev
ziRV!OE!M%BoJBa{xRRi%Q<Y<)ehQ&QF>@GzsOw%DU!H|+0eQ0cxs&?y^<^D**hwlr
z<rLCck-^rB8rQ{faXb}=XD?@SMU84IF=x+^dBhl855AAxxuMUKa{>o*TE>(NJj&wD
zs(}}wK4j1FbKvBpSd<&t#<d+<e-2aO2?1^<mKLf?HxyH-kaN1c?P%0eq1)=Usa5W5
zqrevMr`P6<g6Lo%iewV!l$5CCOoR;f-0h_XS;9Q3UbPw>jtAvHpDJfEN;d+TqdP-a
zd0(u8kx3$p>TH$0T+HCuY;7RORovgCgk!&OGIIm#S{@uydo9QrJn<~gk7>is;#--S
zIBex74~Cz3g?{re6UM!B#%c2el+6J?M6Vc~Pr!NTU&5CYRx21RmIqxPzfH_k&~e^G
zI80Plj;1w0Y(~-DtcYP&Jt#{b%Rd*)#9Aqj-}rE|3Y$sUPld|7h!~Yl%bhmseJXY;
z>&eOpA>UZ&pm6O<@$oO{ESg9tHag1LW6W%e6Ll-=fNJy0aLN?N^vtU)%xuB(^vI^M
zVYx)DY?JNcxHvA3&-_TrtlW6csA&|`X&iMq$qYu9MnxO94M);$Mf2=_h3;#RzCeXf
z9C<{=c(IpRJVyZRJz)OYji5KTA;pz8dTHQvo+;qnL=uxq2WnZUgY@s7*+082hAHqj
zmYo%`{=8=uRCgDM0GA+osj`r?MdZ7f4@ikVx9-P{Y(e&rCcu=J{r8zo%5JtOkEfp0
ztXYK0RMAr8y=#p;1}CmeDi7^NWIKjU<9*yg0<TehBWs*WF-*-MiDUysr0IBK5iID3
z@W5a@sOIC@gsVz4c6=dQ5c`dor4iP0hu|lrq8^2I3GK0QZAEsrW*f3jNRNY&*g`<E
zjshqejw@$y0b*8!0K;CSvr$=-TEMzlfXBv^;i~=#`3Dgg3{IwnLzNC0PlENTCWcC=
zaA4uVQBckVPPQIK9r!&s(nAL?#&33aHUJ?ToB4n%i*>~2Ki$vFV8I=1*-&L8s}OvK
zvDd&QJ6=qtqE8Wp#+UKoT5T$rF3h-!T^tw3#qk*)$WRgk+g6L(SZE{97L6@|O=uud
zxUJlX<wu#LjC%Bb@7d87d)nE<b0Y&7l=FI+1?Z%%rDiEtumvbrzSd`K&0sk5^PPcc
zf*6-NgCyqy3F~fW{(>9(GqYd_R@zfa<4qulG$jEp-{+omBaPKX4b=$x=M}sHSmoNr
zOvWlvbqvvL3c?%T?@5QFUy!Jiz4WW`8D%c03rAK|6SP%rJ}eJGtI!=;PD88Ezk3Jb
zO9lj4Dq9WQM^6+pZ0ai#TzF2d$#05t`e$IAnUeG}m?llG(A%mKR0PzQ89m_BQ#2xr
z-kmjGTG>gfZS-34eCp^OTP3mL#(Jji6E0%)BA^THCQ?g_CVZk7pfzb++4$a;s%YlS
z1(PyNziB9_R@R9KTT%rd8DXK+mG>`fx6|lPNP!zS4Y!mNJ#wtO-v@N18#T-dTj%lM
z7B$mhW*2H{p*KdMOz%RUbls?F_3ZZKXoEqKB<VC{nKR&BcW$$oH$~)@i{s+BI6l(@
z&SfGiYgIGw+zrr8N1PUcpxA5QPETJ9YC5@aukYJpN9)A$ga`+VbW+*RTv;<m-I_M&
z1X%~k7>n$2RnQIQohubp&PqJ%4(C##4RL|miSU(}#*--fQV=ro5SXcPs<D4J)Q%ik
z@_JVzO`=5c$!%Ju7OaQguFO8~SssGeK`BaN9GO~Z*Zl9@ah@C<*^=8J=q+GvYiyHj
zehUB6s%9ZJ2&-?WtQy+d@8POC+k|mXo<%PGakwM%OcSZhsz_pzsyk%t{URZo?`bTl
z@7}QH>F0*lAGj!3eJM!>MP7GVal$cwD;kP91B=<*YHi@aIWcPky*p8sgb_m<T81P|
zu!EeC9~;qD-RvS~359nHhs6RQh3T7!A89zW=+JhD><(%pXwMz7!;lMT|C}-74ruZl
z3cbJyH*&5a2^Ez+j(%Blh$R!BWrSj4`<TYC*cc+W2<Ihbme;k(n&uS_O}EjV;*m%p
z`<3eYWMxYJ<>I(FE{@Oma3``~*v7L-BwRt6y|QoAjXg+In+?#DG8G{^tiw1eQ>A8}
zvyFD60)kdSmg3*xlzfsiL`rK!Zw8tpbqlX89c8}%Y;Ir(f|!w2D(L~N6CAvJvvEnL
zElCyVdv&|$48LL!0EV_{lWI|l8vEhe+-?F1N+iCmi%_J^7E{|HuHIj`M=fgV-^UWn
zuAWKlB9q0Pl0?rZB2lLHr)q=N@BV8=l9R<6WY*>G!<FYf9dQ!cS(_2?A7d6+PaZsC
zr`knBR&v~3?a9Q<WWRFkhZ}8Ytk9!WD*w9iOr(6H6G8o0P2>ds<0<tFwp_u#gRTvd
zgxGSJxGZ`lva`zBEqEq9$_NL>#sKz}l`6H4bYL)obz`J`lKddOtp3{FywC}xL3#)L
znQ9y3Lrjn*aa=A!cP^Lu1G>B^Ac}1JVu)<h|Kmd(kr^5V9en|kM%p+b8k%2~S*F;E
zcz6=?rD}4sOIsgpKw9d)hB|*Gl{J$%bBvTe;d2q?ASx;->YDT+FDhIY$Hno~97KuK
zl<S#-+r^D$MY&DuHo>Pw+}ii<rEOLnsKGXF)!&-RhNDTu5Oh)+XyGgOcI~z|l!?wN
zr&IV5!V3Q0lPRGu3RBrDn|gcFXV=h<lwq6Qs2pvMG#e~~j*dym0ri31xS|~gwf)Q_
zz#Vcp42u46Af*p~ynJ#*!36@BwmoKv0%(!(8aLpr&!}OY)fv}#wwpCak#hr4hFa8m
zB)0mL>FC^FcpHI3iyq>y-Y!%%QNBC7lkE}2iJcG=B_uL9sa$V7=MY28V)l^*<G1qI
zhqNSiI(rpo_VLitwA$+RVA^CtT<CoEFWHbHzr)NH8;!fD<Cq;N;4K=~XoL%&1&2Hu
z;kzm}Aw44@%0&a+$Qkb`q<`PMQpH}5D8zWFdnhQ-NJcp>CZ!Fg@-;C{g@colhc`J_
z<mCN+WOjZtlT7F+$Hdbr>Z|bIOO8o*N92p7>H(owLVY8cPm?!*JN*Mw&!sQ*bN5Af
z4c&<b)}lKmuqqvkP{VSOGe_iORYg-%zITywT^tw3Q*l5w2<7^Qpw`I)*w4oL&FOAI
z26WsS=lZ!FOCE%FbMF(6*~!%%UN`2IQgum)3T2ttv<pI3VTR^T#51{F<?Ox<EuUoV
zD3su}tlU4}1KGK9|9c${b0k)SD7QPuePf#El2gv|b3N6|-4Wb4JEKC8(PpEOno_Bw
zwgf@ob>EW}3Vef;;OF1J?|8cfQR37cuLtu--EMh(ZJuq1?2fEO^rj~En1RmkfqU3a
zm4_gf>(|unqLW)NIiof~kb5}Pt)_l#)Z^;orch1^1&OG2%^Jw)es*ijW{`QAYDt;0
z{ka?*9TnLt9$3Lc(2Yc*q=}afmo+l;grwrX=&5Rl$)AwAZ<GSrM)$Un9=g+TN?@Xn
z(Xw0yX9EFD3N4ZVA<+;w>Yj=DV%zAO-5rL50^M|B#^RAf3!a81fCBDonq7mU=>o=3
z%o;-h)34oA`=H26Dk>&E&y52zO~eh<#!Qf6<Go(J$m;%7g;21Nj7l2BJqu~^N$j1(
z^Tz#3RQy;!MIYD2adBK6|7HgaDj+Ln8BLjqA#PrQO!;oRb~eLIM8A`xEGONVU*A({
z-Rm<+Y(9^4Ge}zuGEu)r4O}fcYUA<X_j(UjeM+&TUk3P$PHho-<mS#Dt0xC;f0lVi
zPC-A9>xnhFlPqd_CSCt*zk_TQ23Csb;Y`COq8$}NDw>YH-sBv#eP#U|y|PK95o0EW
z+Fzri3_@O@R-OpBgWRe&RnoA6Cu!@c!X#*NT})g`AXXdoiB;L@5Rh=^?)5&@^~jdt
z1FNEX7I=L60<dTj*>Iq3S3zOkW7G?Bbt>vjU>zn#O>=;x>Od*_wA!d;K@Mt(*`dZ}
zWyfb77V8lLbgUAUgz>O^RQ3^R;Cpq6J88nBA~;eR^(Iyi=8IKgyFv5E|8JUi<;BT)
zIZRXb=ml9~8`3Aviu7*qjT)WN^R}`$%dBgW*l-1$ibax$JBxe5^Y8CFLHB&oU04x)
zQ8i<s4p~o+r^0O24=-p|&#(~9C8=ZdbKcL$#5l-qrGqXPK;gx4aXeKA2RL&7LmYdh
zF$J4f^{6&^Q|wH}o0m=&wg#Q<Nxs<iEM(hZ#3Rfk>7^563Bbi_y>WS?UR9JhjKmBK
zgRK&LNC#cQ-CSYk&`{iMc{h)&x%o&Zr{4F^cUrl#7EzN+)GR!n*j#g#*nZ>+9)7s5
zadjZ5(fjYZjqyII8xH*yW{c76>_Ik=A5Ck|5We-P&2l>M!z7{<N&9VjX6CYhrIaDg
zPy}lNf()chGJ6h2p_-S7>M`agTazRf+HQvy8<dOs2b^>))|<pAU`WI7qy+bYq5TJJ
zwpC<3esfQOm-d@~azZtYOo2te3dcXa?uFrylQUU*JxB#jdRVFfE^6l8dcA1!E^pR|
zyx8gA?>9e07TtKG`OM+Ceq$%mE75%C7q-X=rX;}*Hs1N@YpA^&W&5226Hc1bpP6Fq
z7Ai7(Jh5nW3R)!O@oS?NqDNM`|NUnjE^rLGpNmH$p4Pg=BpR&~BPU<vE}-ktn=e-X
zj_W-QK0{+R7b2o84OYwQ^Jx7&KI7(zvomIGb&pPWA90YS{NW5IU(B<duG!Ny<H~mX
zTfWzR_%DBp-F-plzc@Y{4xv4+T(R4;L~(@u*M@@o(lZ!jQl6RY_8>@rAXO$1sBSsl
zaK_$-@S77Nb}Q>upqDqQtmlc2V&9F!?rg!#L;von(K(qQ!nGDV>vs3Ff8`A)j`ZK(
zd^Ay8)yoInX1eKe_M<oXdIomd1LM<`gf?V9{dc=P1q|FRIJ|e(?fQ)l|9N@CYg^7{
zbmpR?O@J$1kYUf!E#&2~R?miJf4{*mFoa$axSw?gcw@l?Gb)5As{!{Qv3lnHakG#q
zzeh<_cyc9}{5WfJ?oP24%Jq8S?<J=RvP+3QMi`d1YJelkMjcaJcX+eolpIwLI)h!h
zblmaM)9x&Gh$!$SVBnGU;ZaCZ#4xGHi9K(56zR6!;jR9y=<UjrSR<wjHP&$aJ9bXV
z%u1IlM-8~P7Z5`4M>96>LW;#xPcIS{soO)EMJnov-|Y`_?h%V;Hb}GGY3|OtbD~}t
zV9!Rl(OHB}hsPrB_uzD1Ko33cH`L+E8$DG&>zUc*X`=?Z0xXvDQBib_tcU|o>dHPZ
zkA7Cjns5R&y2<;4pIejOW5KK){}~mgsq{>(HIhCSVbGs-eO&3XeZl|ayX`Oh@vpY$
zT=Cnvx9bnzXTSDSKWabt!#{2BdGr)n=VNdCVf(8eeb63S?GL~)*|T5!hwSEuK42ey
z=+Pdi*v0WQJDf0p9?{8bNZW2ZD$tOX3IiA;lDj>)wyT)Ib-8CD&+Nwc<GuE^al6*-
zL2evK>p{LlghzRWZQHK}4lJf7Up-ra7)>rTkeF4l7nLLqFpIqghAHR<$5KE#oBQV<
zk@%KqQ}(B)cI9Xbdvb<aN~T641jDH(8|t^9s7s~~Tmn)29Zm9jUR$Yv;r9UDu9c+_
zh);C8x$RjM>g*QtlM}9C?&s{+a|N1$3)_pD<}DUBQafXFRn`eH_eMbppR|$t=T2#&
z{;VTPb5*q@gIXWNIdbitukSqoC5`bPnEKmK0)@MNQk!1fbI0ay-Srz()I6J%7DFVm
zpR9XuCldgs%d7!4MFq^Y$ed}=*-NCfEB!{6QrMwR_8|!sz4`|a??ewj4>aX=N7f{H
zoK*ls<6q^!k%DWm+NM8D=4i|mJv!R2gg*VJ8*nr|!=q$B2EE1T<ir$z?hzJv5`OnH
zr+Myrq~cERN?+WNfAR$dYU-k5SrcQ?B};Z-`V=W~%*I+=b&R_*b6j(U8b%dU(67P6
zDB$ZJK`9f3)Jh|{C7n|l`RqKZz5hqQ*S_b+-)irDY-6{-@bm54{`8-=@4e?v`@eqg
z-?g_tblv8Me%*fNA^U@IY@TCp{MI+y^v{089)0Ao?zk>UGf%f82n<le=sUGcpax=+
zFe=X|u`DdBct+Cq{4F<Mwy7K0)6+9#RnNS1;s(gB-dN~3`m3EKw^U{^myh`!*UwgD
zA7Cp^36SL6GaS!$j?1J`ADnenr2=%*<s&2o7?I@3MgQC<Zk*b2w{xc}l`1wM&SfZk
zK$gxkoWxm!4ikc|HaXJPEo05<U7KKQU2^WSGBzQB<QIAaaR2<1lVcGkdf<J!M`_1@
zo)+n>W~v%F5$(7;a<^5xg%%IZ#r}C4CIz!p?2*8DuNE5P9M&Y0+Tm8T64jW};VMC<
zZ}CG?Op|o6&iq6qtjJ7&>^a9`li)Fj?tJp6J2@{xuHCq^v6!9Z7&cZi@lvy)<y9mB
z<*LUAc_;W)1B7Ve^c#D(oY~01Vp}X0PZx8~wyF=NOkx+RNpKN0pA>bH96U=iiS~NW
zMPAi^W@@_DHT&P)X&oO;niu9!-<H{?D_-=diz8i7h8&{?K;y^!nu5{X9O7o9sn9>z
zA1-tTD;Y%o_Z$8GUG@Q$eX;E7o{J+(fYZNwlhH@v-wBzk5V2JK4;kw@IhN1%qs`at
z;rIT$ec$&yY3;xI&+Xs+nqRi}|H!+nzWKkjzx(E2wD0=!KW6n+-)#T0fB(()vS%Jy
zUT)a^zwyuP@BGc5wD+dl?FFCr74{w9_Eq+>J1^V%;5+Q^{r`T@{`q^%UiM{QZD0H5
zFR@qNdCBI-@3Xi6^gp$K{)_Lh_dR--{X74=f6qSW;~($1%ANMomp#uewa4r?f9(71
z`~S(i?a}q~?9ctJ|HR7Qf2-Z{x-Yfo-O{t|NAI<N@;Cpw{rEecuyWJ0?D?;FoqhYa
zf3>~jw#m*OdbhpxCx6_2;;kRFYw3zT@71rfH-Ft%+gH5&PTTB1V!!aCKVuI+>(%!4
zU;Jfu<%KV>*MH}S?Pq@AZ`+Ul@(22}wu|Fwa*$zXLrDT;i2j318?OgV$fErBTQC)R
z#?|-h)vIT{24BcF>{-L<epXo`fx+yV7T~wM*mRUMaiUoFL4d<*4YGsCUhR;{m?+?E
zPR=MhAc^RRkM~#QUTeGc*r&8Fnk<~rKecoO>EzfIGqxQqqWJG7GlRNh6oS|}i_d#k
zjdlz!#1XE<1q-1dDbV}*I8EK1;iJ2rOn4UMYVhbYW0qLbxw(%0FOHPK@%YcZ9Mcx$
zX)fB^MDU2I%HD{KbgGd20ogs3t8(VV5l5P)fUzJ?lx$=;D^-o?WQ+>wUZBjGjFAjl
zBR{yVq&|j1I~rxd^<4S6Zj2KZEja3aV$p3`2jL@&A_;g+nO0T9a*BQ}qw4WND3@e;
z|A{XoE;1@#ILRUj{!A;ckMbm>uWpoSL7UK+wg;iS>D<^%NRmj?YgPX0f6s8%EiHp3
zM3LPUp@GxeA)H(IxsDMR^_H=IM!hm9Iyau1kJENM+SHJ^y0~zjK-@rKxRPB2396jb
z5l?20FXD!f#GV#MyZ$cwmES(KuYTe4?b6Zv?b`TFwwJ!{tL>#9{k!%Tzvr#?@%7kl
zdFF|oot@YnuXwF}{kOf&9{I`t+W!16K49~vJGP$b-|_k1WMA{T7ufZm`9AyZpZcI(
zdet}DfB3CmWpC_3)Pp~DwSVNZ?Nu*(%zpT9{I~X3{_<n??6>>{`!B!otL=0D<^A^7
zNBUQm7u#2T>A$c){}=z9eJI~$U-0kzS^M|D@yqRP@A_G*&wsUj&9{8HJ^T}Y$^P1}
z?CeEf^)2>IZ~7+t!u!6@-Zp)Sz4^^wX3u%#pWFZGyMMtR$wyXpr*_&tW_P~!vh9BC
zhwLYQ@xAu&{vzXgx*b4<Bn{`m>r%=XVmNn$4aFTW!5Az$^p|^0%kAPWRn(+GsrS+c
z)Nx2%Uo>FS?Z7EC45hAP(pasmp}CSq6O6Z@k-6GQX0`#_3OkZ}iDDtEF<5v@MX6&&
zZEH{c)NXrnq14lqDN62EeQjhBdQA=D;EjD<XahjT(`^rYZ35>Ysq9m`lY|10U!PRl
zAw(`wU-ZYSR^^D$UUS7<+i;O?{6^!SFoZZH@R&i6<mNuavWVhsh#DIcU#I?aR0$lF
zvEOK~ek1<?w}VXv7){AlVIvrjg_O@kc+IncEP>sjLsd9y3*Fk1!^c9<g$H|&^~ih}
zmS!=9^H6_lEv6A`Q3-lHN=da;Zz!&)T@{5%6;yupMCGDBwKV$3yapEYv}Rp5YE){*
zJKOE3m$gzO3$iDTQ;Tu+V)ad-KJQac`|o_gCM_m+D3}_(VGowm9Q~pAB6RI8u$1JW
z3VJ3g7P?0^ev>vuUF_uBuvZRe+L*~!Lb0D}kmP6A(KptOv!1zcM-7liv&SBIz;@61
z0(<=zz1*I2+s3Xv{BgUny~%EU?n~@>_D=h`UwFSg)?txrPdsi<?ryOcyzp68u71FN
z<JaG9SNEs(;IF^ce&wTEd**ZQvS(iLCq3H--u6rOTOWF`!?maO;otae``AhUyiIud
zGyC;_{1f*6Ym3dNkK4WPe6L-*^_h0trJL=x7req=aqCCzefRF|(v`j*9{ZR*w!6)q
z``o+i+1=^hRv)o<zU^1+zQ=FawMQSbC$67Sl=b3xdLM~&^Pa4r7Ygk<mCR<h8%L82
zyr|xe2xV#Mh2pwmR6t&-!(}cZ<q(|9E^U;RG-<y!saAMq=GmLq$L5a0+}Q1VMug^>
zp>naTRSn99rsyfN-kn4cgY|3%au<UB#QOind(fapR6yjo0o^%X=aminvAni-z5o2Q
zf8&$$4((A(MFSBW?v>*$YF>Wy>Ke`wHcHNtwKBF5?HYT54YGkGVfcNy;*w3#mrFJp
z)sspVbhrXZOF_#v-haT9>c^cRxuG!|yLnYlSO3M94<fROA->osu$a^k>$My}Z;f5k
zl=qU16jHj$27)D63xHs<L5bvS7YX<prSV%EB>ABxpH$0o@kv(*Zn47pjYWo&NDy&{
zie_o`2&_cvxJb-&V|hwJ=bV(S`8j(^3;jXN88bLzcYJ3(13L0L;KWfTS>pk4KSY=H
z{x6TZyvR6LY95N{h<e+i0i2%6Az^P!&8xJ${0#lOs}G6WqDc+k!3WmxOx!X0eXY=M
zTm&a%dpaReDPOibZa=YWk3EiObvSxG?4N$0{go%b&i?4v{V99Xw?1tD>L2~E{r$IH
zx6*O-<I@N2#&Z6Hdf|NI8-Lf=U(iKwn2#Qtj*rls*;l4rbBCf1ey@+NDW4-@-mu3X
z-*Y`hdx)Uybmf`$?7LrXfAatEa%@D0cI@#F*gse%VD~+owX@TmT^xV#4#a^Ad#$_$
z$4L%O2wSBY=PW_b2sT<c?id_RI+Z%cmCMJd!|%Z+PEglC(y)>_j9GmPYvBl#HT@Uk
zlM-3QS@RO>vIkwg<8u9bXDAg-3V!$Ac<i+xhZDC3=x^C^B+HF`w<vBK9qsYVO{6oo
zY2J3^q?4BUIlG=o?VM_#3Z#`>3&Z`xg4u%`w(azqz7yBHKlf5Uzte@Ak=Y?@@9xYo
zuGY0_`+rWHG1=ei@FrTLDqEl?1>^h1sTmF^B6;vOBYXf84)n*l4fVvxNiE3ye1l3N
zX=9|cCrLX&!8bEMffMRp=~!MBa!c!sFZL608n`<Z3`>+WN$V9fjFNUoXsS1@nr@ku
z^~iY<uG1VC7n5B16Hiw$%q>xd%9JJ}R$f(;>#spU&zOz1m0Xu8g}$NKjF|q}2DIix
z5-ba4Dn})2m}AdgX5ztcbd@8qkCZKXZ7o$YXR1VfL#Y`^WK-ENv#5w3H>}u%#mIHe
zp>3E$<LpI|Nc@LT@$eMCJ0^z!j&p|}c2u_CX7<T7O+xn6+Zm6gro$l6&)Op)v)uM<
z=k}L;t-bk`JA239e0MJ@?@2<5*Q7JM@8^HW{_nr=5A4~m{Ui1#|M<UWZ+Yauv0r}t
z348L=-S*r&F55>wcG{hfXVKT~vB$gPxcwP+#~oK}`}j3$SDtNmKdT#sk3H5S));B`
zdmo?dHO>q>eehoUt#>_WKlxw(EqmKTH#|&J0eiK(zU&Kao$j{V?|hbBdS8bKYXKbW
z46wCLw(&Y?PO3%P#ql&dB7+EKo!g^Xqo2?lx)OeK&A#JC`n=m1Z!MbpGrxYiM}Xuk
zI#-%crk*VjELex}ey4Sz;r2i7g!U^)<;Zk))upB;KyoCCurKy>=PDM4g^Mh%r%lc}
zZf?^&(B3o<(0r-|EV$b!|9fJO8R1FR&&cfNkV(I;<BVn{1aP}0p`EG8QBNXpxD)pY
z%<jm+VM95|?2;SY{(G<8yG?d-MlBqOo2)3Iq2qR8Vz1jB2dQt76y8K6gcG4NGQHW8
zmHv5jwmuiJg@|K9F%Qwd8gSw1S9V1s)oVVBCc~pcswnY23p&FIvF#zCTY%j<CX6$Y
zaz>R{Z?xb>rlpx9I9ZqXFXv>EoJHvH8HP&w8O;^Va_I2xQ2>Ubxd+dTgi1KLwT+wV
zsi#R7EUUX0Vz#ZRc9srJ(F?;VjMjGeEs+^{=FNm?YTlzq1I_{+=ahr;MdnmlO764c
z86yi4l|KA@k{mBm<|I0-H!zF*Qrbi|rZ@Acwzth35a;yUozy!Z0^IMnlV>o|v`PQa
zK6{Vj+h1Ux`+3*x%GF{w-|+(bvakLMJN~sFu^;{AM|yp-opW5-ZhP@-?WHFj3fyPA
z>6u%5^5KW<@h6|Kk3aD)d(Y#4#9s6IFSYr7PxiI6+JpChz&`Zb@3D{G{fF#jU-Ei;
z^wP)d<RxEjufF^-d;4#F$R5A(85I3?PuRov{+7M-;jg#Xe&rWieg9*&pH6JEUbFk(
z``h-=2j62KeC6Ht%GZ3QeesRovTJ2)%f~-t_kQ@QeeA(xuX)kS?Nv|o&H0`W*@I7<
za=O9A@mYVUbqeYczPI!Exz~Caq;8Xhddx<XENsNl1_ss<k^REKiD)REq)d^hxIsHq
z0k`cl>*HP(cY=eb10*F(g2)(%8^|C9V^r4uo)a;^y|rgu6WGaU7izRgCUS`f+wR1U
z!0sbY0JXGAG4BxP@iTHqlGWeJ`GZ*uOL7a)knNI7uF$cN>u_?kwX0|In6eS=O>TcZ
zY4Ng+k8JXuICsiNDWitxjtkSI0V{fTw?Nn(0>zDTdT0G!dfDX&3L=gDY)*`M&MnhD
zBvsJyV7`<8y-=``PmIhw^aMcKWWmMYx0*Et1>`L6E%jeCl7Y!rEOc^B>J}x~I;(0k
ziA=f@0*rc4R48t$J8{gwLYIw2!EWwK?Y~M&J9;1#;?_{7H~P?~ZtWZypX0xcGEmiG
zlnb4YXJzgTz1X>^7UwLP4F<|BDw-Ncz3AE!2pefgqu{HhxUnhhaNkHC#s7V*5dpbS
zKp4}V(R58xOw}Uv&vkgTh|J-m24YgFNyXWYuGqDF#jakxYM(vFWVbx$bL_>hc(uLy
zRj;<!zOvV;ZmIUZpZ#I`fgk-9d*B8cM$_#tvR52`$bR~lKWw-Ep|7`Z_?oY<FMjn)
z?Rn2!?0rA?kL{;^^Fe#^>ZA722Y1~;y}`cXOI~9yenzv0?|;9&?|t{$gV&nf_R=r3
zH@@z*_QIo&+pqq!e`-JX&in1j<=F0c!5vmV@-BP-M;^E9J_Y9FE_>OF%--{}zhMvT
zj_rA`xZAG%>d)FcAMrK5wad5OZg<@Dq`l`?yF+~PF?;Z1*X?t@=neL|o?*S_rO&p@
z`;XgwAG+Tje)wT~=&@7VJo}aQ#@BzDz4k>n*^Li>!0!9#N9=(ow)X6ozt%qgHP5s3
zv3u=34?b!2BJ29BKYTx3x^&6z*vxjke}elklRgf3Zc0L-3`8tIdZnOm)WrzUXX$mL
zZfHTsDj78`57;3G=eEK{8oWOYC>NC@T4uvA5&#x0@c$i|I-1BZcDq4#G3!BYm%Qfh
z>OW4>aO*_^JR)S4Y%0lW?u0ox-Dt-%&zs#kX$UlcAm_ckjqGbLQ7oAJ(O7G5JpTpr
zy((&3t`suS(Ahq*9t9^{s9(D+MAp1{x+$>$dlCbAO&W$Q5xJ2*$$5|fIkt*@yP)>Z
z3lY25zxd`x;aeLtMic-|3_R6_+|#m2m>8rhU3iMSf(Flw$K<7z!-$x%aAw!&MWTWR
z>SK+XS#U0*u$ST3$nS4Zeb-3mB;gO264^|^KK*n3#w0ydcc}io{yXL;SdF>{sa{mF
z3^$@@`h!`diRd>1cya&yYx}*TrBJu8RK?JB`F+TxNbQ{uYqrSfH1Sg`%Pa-_HR%7!
z_)aDcsoSe~33iT{g2?@prP86TcEzCuWM#Z}Sy?Xb%q`EhkJz*9fd?M2i{s+BI6nQu
zZPe|z-)^rwxo)>#y%#^D79nRvHP!FgM#J9AMeyOa5YCz~HNw!qd%STLUpLy7Qb!zb
zM8t)GG&3>Z|CoTBqzl_W^G2mKlN$p!_$L_Y(NKd&OHSf=B$P`glHt(6TZr7a@pmfv
zG*OYqKMOV^Y@OS^m4dI)rsFot?VQ)y3tFO>Sa>bWdr;AmTr2BNg*{-)!dm`*nS1u=
zBJ4~uAPWeQ2BKCs=89{bO8A;{&J}i&1Az-Xa6+=+_uJ7dcj_LvR|Wl3j3O~I4QVvN
zXAhk}&c5;#)oVwK40D2P2bI(Pfzh)EU7`&ZU=7xr)H1A&o?MM2IY{2a^A<W8L<L29
zR)Q;=#BMQ!(jR`UW02*f{sb`8B)YrQ!w3~W>bz*es4}FY6d5%pP824Gh35&i;zE|B
z!*YHzPh6=(B#xp%nL&z!+OZr@R;|nzP*N(6YY6>D(Oynh>3K~Jg<2GCGi9KzpY4J7
zq8{ik#wx8OVI=mz0TWhcS|i`TI4+Kh<M(|;gAnZjGop}?Es1sUMWdbem6?bKmN)ja
zm(B!qwIQ^-RF*}&KIN4duTi@JhrPw*cJcuxp;c~+a-)_i_kD{-QwHOWPSlYqh+s7K
zjFv_@x^)qvB+^-+U9}S7LXU0byhJDz750TfL^qR$4g@G#k*pyDg8pG;pO<UE!oIES
z$vV>LC6t=n$(DxTe-`OvmF*|OMKz!aPMaAVB-v#|fjSYsBJ5eEKIGY9U5EBzjsoOp
zq7_t_0d1)X&kVH3Mg3C-mK(=_B-NHYTJTgE>Jd2|R5emQ^oM2s8=8SJqsk~+xz&40
z;;bwGj-mo0%TfoWbbs!v)R89?^D-XBrW{gajHxah;wC@DCf%g^S|Y{YQz$AAQ>)Sc
zU`%%+_1<eQaN3y*0__9q0)=8UGaFxrNChhJhMF9dK=kiLLmrueWAr8-<aYGTt#Hm;
zd><+FOtE$Uouo0vb+7@Cjx~?$7JZQGMG@uVxHz85BNfizN;F;^vYXVzt8zmD`;B&y
zfqpo@0*R*MZ3fhqT*jy+5U$XwTZLeuPF^Mcoy52!)OK8G<WHtF==I)H<zx}6`>;g^
zOzc&PI!=}=8x5i)tmnfg=_qLH_Lzfc906tQD^saoY8ygw+#_kE%8F_cvrJ0|Wp_v0
zoHh?mcz@9)uWfa2ae0$K`17C75KJHn2Rm5FP(NK)`2n~!l|E=^XQ}0TJ&_|`G7^D}
zY&hOBsi%qPY8u&BQAW1tBAD?I-UEFDaGvl=BTN@+75*t(oJSH|N4ypFo=i!m4X{v>
z9g=hgo9Z@r__e9Gi=XR}Mp9vuBT+=yN6pKIJpY8gE%kTVq1ejdX-$JNt1`%nkt^H8
z3~Q1SvS~6j=WHD`2eU{X;^L4Isoo8DMVLq`XwT1Q)%A0DBp;BUv}4yN6Nk_pCDzsa
z8}^Zk`$TFlgr*qh#?M7&>Ahf$Y@UjKI*tLqI4+Kh<1;@PbhG6JAWm(gHXnhw|ITYw
zBsz3RY{L;q8`PdOST}K!a`d_;5f^B)C@r_4@+{>V8qpeb&sM4(_-B)X-+(STt$a-!
zALS>ruO>+)LW*A2iP?!&B^Z?7WM4t@aAl1`R0{)}jY*3i_^L`2Y@3;By1>Jd$r(T+
zv{>IHDo`xFsxs#Uk8R;Km;@LW!9lehh;N+YLAzI!*@|VrdyZ4(WHX>%GfPAMze%GO
z`Ta(<UX$!cu+-ow6>Zd<^`J-;n9z7Os}{x!gA+jyR~hrOn1LLiL}XH#nMXX(=oM>7
zC?q_oVUHde?Dy<B$mp~toJdd4&%tEmLcv-_5=vF$W;E$;>AIA-us6puuezvln(&~B
zc!8oS2Fb0+G7;4XzlG=|GB)*SAn6mFxhWcu+4x}E%Cf1mb~2muR{ep)t0a546w1^W
z>pl@iJo5;uM{ASoi4`^}dkT#~a{fO5tmQ&a=;F9Io{A$7ci5<^@<fPb%b<D#ueae8
z2wpdm7EF4h8g+kioKRQVspqsnlaE2JiyKS`juUERm<#CU+*LPPmU6rS%5#Qx)d&$x
znlOrLlW&lfSP0@n?Aq&N`#pkiuhn}yPYO#<Mw}f>z`-4%_nrnDn`4$(%K;+QBrKe0
zW6|2=H9vRMM{fJ~sQdfqt8Mh(CM7EVWeECdqkuk%WKos*m1fFDsV?N-1>M;ieO^S^
zmbM2m2JK2t4ou1-T1~=m;p>O81YAiXEQM^xsFww@hNM0qwkWS_($7orkmV+_Q@rJ|
z`JGLQ#RWJnE;7kk)R6aRz)c%emV5E9$q6ZQL+?O?Iv}$a%${j>rtb1%L5(Kq7N?o7
zl`a}$x1#;mBq^1|#fm6J*RW{eB6uhwl9&c>HZuP(ex;G@!N)^~f{u72uDr#)Kyq)4
zt&*KCl)&-@hG<0@6d(b2R+6Yf(e-~|??1q8%dYZ3bj-Qd+TomYLsi|%C6!cJm6S?3
zgCs;22rzA9V;XSNbOX(MHr;;qYwLA?&1*N<-Ay;Pu>pe#1_J_t2m+KPN?9e9R5^!R
zRkv=wC+xk~T66aN|9`A~N=QgpRlpVODT;gV345=!$CzV`KV&6OEL{^_3qE5h`3_|T
zTU)KwdMZ{7yR&P{-j+vP$>KXjA9LigX-5|Y00qPZ2m(+cBSjxOB+k2XaEZJig>=$i
zqTum}12Ku~#0rX(oN5VLGw-ta0A8F}?|Ahtw?}YCP~1X18-QrR5rH_~g~uZtzu^2?
zXzJi?xU>rxL1JZG^XUU2?OB{t&f0ja*{MKzx7!o6AqQ<~(4Vaa7fBbJ?uVS>$&vti
zj$s6Tkz7<-cKS$`j*8FpNHkO8>Ks5pD7uBECX`CMr0i(BaB_+8W@cfc-Pi^U%K+-t
zsFG05PSeU9W>U4nY&lCKp2b^oa^;k4(vZY-;M(OZTbD`I&Y+7p%;cyJU;e&uGqc_I
z){{6$TGcMdi$v2=wnYMx>;YHO0!)su86f_;$iamlwOa|^)5d#|U5-i#7dHxVIXw53
zi(Y!Q&j%v=2VkHg3`wW*oeGDmJO)XrkOIJ`qWoWNuGk?#Vrm##u+@ZXwN~q?S%bZu
z8!L%8>l;gaLP3Px1zjmvBboFARb_5IZpbzrS9Fyym&+UEqfkxtK3`h4%GmHqOV<j^
zPS24x!4gPUc?|A-&ejAUwIo$x?0iLy8iFz+W6MB%7Sw!57QV4JR~w2xXG%WT3c?a#
ztV5Apce0=fuO}N67b&~Hy(g+chHmh!$j)8Gs=XHoe?pE2{b$kbqKp<CGthDKmSxD|
zuaW=_!(BDL5?^%a;i`Nc01dmQk7Gv`QaDzro0+{2_5|dh@fR!0uBfiI8(zQlc46gn
zGFE4%D-(6~%nM9^a3Up=D2?J^j^yZ<I(WHU4YQw8uBKKh^~>`p$5hGR%eNX&s3iRX
z3Q8CwFNK8`RDYJ&1Ck@{f+W8oNyK`@9ac+S#7d~3s?u-tt<>-bD5K8|0nn(t0_B4i
zHG~xaMMG2#f29shDgowh4i6f*U+uC@>wV=U^b?gvRwJ&}TCFF&)XvweoQe<C@VV7S
zz41iDv=;MnQ%$5CAn5as-JCv(x{_Q1iX7QWV~(6vFeG;kHn#h{rAVM!_KHW_(Qe?^
z2B8bF=_NnR6H$z0H`5Ob0FUHzv_7L4sXgdNs>d^N>5UkxIopbZ{GF_&mYud*$!>7l
zShxqE9H0E$OAH)W9lwv*HVWCbhod&}S)C=s>dJeqyjDTV^r}-hfDyPa2-7fh?Qp$1
zkJE_FtS+-DXb=5Qf*Z12b%S%LD1G0SfK1~?hszUtud1T<tW7gSczESbWU{<FQDTJ!
z1dPg!Wo3r`W#hK<!PPO64-&}=cUAPZSB23?ky1Qvhl&pIx+Qwgo54P{Lt?HxA*g&-
zq8PYq(fa{}bY`8ysN8%=EDcKYgUKcP!Mskp{cH(d21n$OmB%3|<x}Dls?Q+8u??IB
z_bJ1Jz_w-3wc_=xCD;oYt+~&=1pX*De^faHR?v`LBDG5C)mp99dh$zMyTCTu$VU#z
z6Aj_;h%5NPUeI=-v$bL6$ilTsbCf0wJ+{mUo*;bQyp!dv{x125#zhul6!aUKgY2?-
zpAc~R@lfR?7xFD}2jB@*dO&CsU7Z!LV9d)6Jdn%fuW*s?((vB9AUwj=J@M2*rCs)z
zn7xQ0#W@TeC}|k>QS_xzmdq81*Mnei@Gj5*NMYheu3_aT{_UPdh(pR^fmH49y<k;W
z6Fb1XQC?>U<B?9qPaG;GN)!34rgtHeDv2LZ59pYZkU9^f%*=E-mV`ZrY(Bdh>;Qt3
zk_o{CLMIFUISe}~sOuNa0W!KFrgAj<kWUXq=I&-_0Y<OW2VNHz966(NFDjqQg`pH>
z+p#C_fbh;F>*{*gDS0Bmf|xFDxOOa(rdsrB)zL$Y+Kk@L3rfDQuih-BGY#Rq?5|w;
z*u28bOJri8U?%2@99TjcCX1zR{y`b~$88pzm3}<ID3`)(Ho*6zBwQ#y99EfYwN~q?
zSQJ9=M1^W0VIJLii>}wEI{A2E08z9)!x>jn!T>NK43c`m!DwLsYq=+3rIsT^4n#i^
zsaWuEah&kA>>x0<2W=Onw}87cH9OHhQ=6@(fNv%}Y1$|unU6LGv)+lv?4gB7Gg|*1
zJ6e?tFL#_wESWw*@5#f8qA)=fpJEP`2-*ayqp&C^wcRI5_Az`_(YdXi(3+Lvpc+jQ
zNGEvDH|4Z(>Sd(`wruB;c4{Y*fb0f}<WN=Y!!qzYdQgy1?IKuK2F<dDwp|Ri9KKPU
zwwL@q-jHCupqt?xK_0xI;x1N6EJOA|rCw8LIUssG%R9%*Jb{6uK;kp}Vg|1)zbTEw
z)1$ZQdLLHy*)KdEhNJ|^<<(4|)3So&tgcdWWl5dmQYs3XW8hbzqH2>4iJ<ttBKRUv
z&ZY7;Z)T}H$WKvl*whL@>rn9ff#)D0Ry?S1W`-VPaKsIGecTDb2Aql=*^MZb;BmhA
z_fSr+)@rTRm%g-N)#tMIjkahy=Cl?^2{T9yia(iZKJ8*rf~<sLG1eMU<e)EYK=pZo
z!|R!RAoAeUnmS4<4@;GuI!4vtk7er4(6}iLiV^}zKza%MsV*py4m?%KCM5@KsB_l$
zQjG_6f5s{(_<UXkNaw_6Y>1=J`8nT0g3Tf>4_;-6bHqnLy=YR#Ckr7RtAP#`2KtYa
zrn8T~!Z6Q@u8A8sZW$2UxDXP&=u{C_>TTAI3M0hdnk^=CWSY<vJkXfK6M*t+;aS`@
zbi|AX$qD7}$V<XLcm<RlH|GaV14-yqIkC9UyGe_6P6+O06$tkRd~?Z_a#<2wXg*M#
zU<jGjlI#0v^5<wnWpJSZv#T0sA22Ez48ZZ_14&4_EeD4b>&?>DV*AjXMFkE6%GV&n
zG(N;psK&}0rv&GxVV-5nYf8>llGr4EXOwNpZr3<3Q0Tb#q}sdC<%o$kFK2?$2dn0r
zjOY~|fhYna{h4e3{{7TpTdmbvt<oi#&FtvWqo4PC9GUQM!CPhe?2-H$g9~G47hl)~
zFo4sF&o0{fm^Tg9NAe4d6cfN_of4|UpB{gr^P`{;j{uxNW513eVDHgkeo%jpkb{D{
zyA5qjw?hFS1mVDy-{+m$nbvuwMxk6KSP0!Beo<Ink{Ucl@>fk_3A1txup$|Up#oH*
zMjP<hEOFkBpQGFz1aHgF0`gxuu&oWQ%Zi4oS93^!=rU<U<QM~9-XN<LCTMlbAZfK|
zlfy3)sXp0fdyW5YO*IUcQ|dj4GLb|{Y?z~5Shi)O&4`F`+KC`@f@ehAkgSSIT6{q!
zjzs@eY!wdKcPLqdBNMS&N74{JKg@+Zvk$F4ya5J<(~)$rn2odBTW2xTQ3)mQO%KA4
zae&tcRVXqn8?uI2;&_#jS7F$l)J;X^Hg+=LPC(odU#q<PM*&_4Rl08z;T%cG8kEO_
z57(e@!5%SYS}8BxkD07OT<(gRQA4W$2~Z}7#yVk-;vn6!a^?IkI2_-vP5vTq_}OfS
zembkQTC4Sim1dA2C=NT!(y_9{XU9;0U$`SfNls00g$k#(08j?g*x5p@MSw177?Bqx
z9+vi5uX#?FgjPfXnWe}|f{yIvcP6!B9LURve~4MIM8el5PW#EUa5BQ@S+ztJ6thK%
z*KUq0qujuaIOa!F!k)`W!^L=~WoU-vgZQ!Ci;smko!D_w_12iA=GZQz>b+dwbGP73
z4&H)@hZr3t=d%)B01G4dmzB{=a2Jb;4jY2$t15GXvJcXR+|V@23k0=6J!4c!pOJm7
za!#E~ek|46&77s(DXW_&5!dBoMHXdtNOkmH)*r~$9QJwZ3YP`LMS=)&$Fh=nDkWE)
z7%&vc+igAv^4$k|zHAG6r5A~+lV??;yb~@~$2KR(xkCOV_j}2Hth!KuR+6WccGWic
zpU<4gA#eZ&NW+1>WGNR@EEf+>xj73slBPgHps{pL>@DMcn7o5*3255wuS?)WbVzN=
zOQ@^V^&Pnrbxy%6S#ad~MbFA=;x3%?uJwdlX~$)bR!m}&k3vHN;1^o6*~;*6wN~qk
zEuoT)RZR4ap~9(AF&!%Bh$rI`^ml+DtVD%@!RfSiC#S4g7KHLZzQt%AK39{;*fx_s
z!9v!#xUTtZ3w9-N8?NLaJP4ArE6D*_>2PHsv_XL0>K7%^iTDdm!EKoNa>OBC7%DBw
zEA;?<l}&h5n^9FvO-U*u%Ci)DCZiGCgySfY1AtJ7WJb3NQcbO#L4Y<CQcxWq#G=_k
zdae_8g<3+`ajl3z>|6~9A`0$CzpH86@ih?hK|)5{g$s1&Nt<~fgeCf&9l1JGOP?wg
z9Kn%=&VMphGd8GPI3iHyGHJ<`V*9XE3<P^H8S2mE2j?%nENzFm57BZ^*zhDrX@BQT
zai<a0dQ1+<tlh&4v$PCaI&DHK4Na4>vy3avZB?|RVG;|w<UP*1%zUoIno!8VEFzyc
z6FxoTU=+3m4JD!$?w>Vk)UJcq&0xKPa~lQC<kY{`ZUq;;aY(6JuEz7qo=iJ$a|(vv
zbGHX&X;_Ezcq^G|vSXN%ZwO?>f`=-_up%I@)@nUf3(3L35S-I{rv)(v_V&mIedj{8
zX6(jvuHu818aATq<+D32zqAeulSXsvna2wGU3IoGt@%4cyy$=>hPu0hDF`qNqUQi0
zhK^F_wo;>r>T77VsT)LqM-=CZ-Lfu8Z3C4c3DV%MmS|UE88-BYHK^cfR%kl!k%Qz?
z)C@kC7A0&`u#ujY^Bj9@rtqz0R+v3OA|;tOqAsC>G#cjj7AZ>=%6nQ=qRQFH*dh3g
z&^XfyB9f8cMT~VR3}D_V&KO|uM6y^d<%=PR`*06GU+uE%KrTb?GCCob@JwDT0Ji%j
z+#D59^kLq>d}bBLBp`UX3>ej#+-(WERFuz=XaGs1itjX@AiHF)%1l1lsAh#lr_V~7
zCThVMvwEM0DU-@x^rsu|RrgFlnNGr?lB!3aG(QWWrxihTihJwmLnN8T5sO$r1ESPJ
zJG9B#F|h)Snt=sJ5viIAOXYn^#-!weoPvYuYq&AK!%LntT__myFMKctmU==-Pbue$
zjCgX)Y?ZiHYqg$=h0hp4QkZKuj`2&`y{V#0H1$;eVOy+JCwnH*+xMBG3}_l5V3QXW
zR8=5dp<1c3Ml{sl<0vD$!0s>$>X&HmxCAZuv>mGQeR2z^OkXYt@3Ixgy>y@mZx3V3
zQLVYrAP>j(R>f*;M6PJ|7MzkEtI7df=g}Erzw?D+DWj>JO*F6S<WpEVr3ogJsEVeI
zl$9_KoAtY`RtgX&pYM~1-3b5}q@1tV*%L)Lt~BEsl;O=mA03ip<Gd^i)0W>}bK%$E
zO6K#V;4IUzj@W)ImU^yo%w*-QGt8fA_o)d^4jv9VIAU<{SwV@Lf+`)ojtfVck{XiX
zPAMIcy(d1TjNW(6Lv;ojCr8-mVN#+TTt1US`B?>-tGoN}<9G&iAu6<H`9P{AC+2r@
zS(eh9_L7-Z9V<OkBCbS8WD<4G89jPXrMXZikBLB$xCCT)s`eIX6q`ND*s_khLX$Wr
zzSpSMPHlkE28mOSgVOU#u5h(h>#14z`~glrs$5Mdn7c`ogj7C<5qu@gyQ0+J8wTq@
zQQAR(*Bdt63{Og2TpQKyCSeli6)cO13A6F+(mHf39@>*h^PmN1S%?QPsvU7=CD?Jz
z?#o6@ia9y53Nx3LTXe!9Ad%HR;{sG3n`sJ+du7Bpl$Ee{T9JhbU(Y&9y=E-uplgAj
zVVp#4Zi1WI3W5(HiF9C<$XOUU=#QqlCMA%eLLAq%XhDwLl+%XVp*Ze_^rcJy2z3jg
zgR28}rCyeR&Q}W2)i9K}<e?IIVgpiyZl8o$b{yJqM*{R<Rxg;42bYqnoPbLmuHcnc
z+EoayszF{#0iHanB+dd76rF%svWxgvGA_%<AVentC<9Vu;4=-?oPZ0xOPiRBH_FYJ
zj>b~PWzM9}4s8rHslzZ94=%`kLJ`5`v*PYx5=XYxb?&L-3ij?jK)yp(TM*Tfb`Fi&
zoGH8RS?LRRf}+yGB<evJjMX@_bg|+(s85YKVx?0Ox52A6s%g~0R%^9Z>&dUq!A`Ze
z@iAhc2m(4H?m|2nxuIX~mr4?qNTFU)NkWdi*A^YF>{Oe~w%y!gBck?>E9;EBWi*2U
zWR#qRv`}Sxg#J&PdWWt{)nZZ^4QaPJZFHgDPM<KEFG{Qd@ejv~xY7EIZoACqroaq%
zmx}W|bbv}sTP%F0j@Bp;h9gO%Z|*D@SdmbuyC6Q((m4aM8;C%-Z8V+(;*xi&K+T`b
zLR%}QXSM?^<)u^=TAi4S^<FKayEkA6+Ss90xH}gb27o*{=MW5YnCx;LT~Icp@MBep
zcornUi;GM<>q<_Rt)t*1Qk$2pvdSw2meoNbPe>GOIl82g=1LeqO4>>HGqOd<;b|kn
zE=u((yKTS|9=s~-!p-|wxxL9S8yXy+qu0Db7Y;lwUhpn?iR-)wZw0aiz+q!=TS>`u
zc+iQy>4nhI+|0OB!uw!Xk}NxVvLfPU(BM*Qc~>GU(~&gkLqfZOazAi$iKNsGr}awj
zk}y06@$Rg$)mp99dXkHx3YEGe2+fOROB?`a^d{&xP<hD-N|=++=B=$wCZ#(f6(5jy
z7Yjk>5eI;lLtAjxxr`GMN{MB)S0$pg=H=#_mP(Z>wBQhYYNnc0Bq~Sowcff*l-5IH
zE3u;d&faOo_?dbE-w;05CS#$&7ivASWoH_5;I%pPic&1XFbl=Q9Jq^;Fq)C(PH5fD
zN^%3L5`RZU2JppPF1MWN)tI4S94O}UlAz5M@*p;-;wbHUg5lrfySg4NP>b6O8S(<^
zkLxF`L)XI^V2s1xIY9GZ&OnOcV%KvpX#Bm7!Lp7|kTP;~qC+oiD2P!-04AQ@n@UBp
zE#dDf!vaAGa^j4<0Tk5bTrE=bD^^N$13Hfnhrb~SzT{5m*j(CCLXS_-DQtc4HbMKd
zlJa`z)gh0m+>rh2Yu0Yfm}nY+Fknf7$}>xM3lGuycqFUr;6`cX_yC~b9w+H|__L1A
zBsitg5Y}9EzTvTpSRHF8RQCgUP`2B_)k3OqBPf0+w=;DLYMbF)b6zE`)mp8mYzbrC
zdgAIS7=R6E<YyZ3tO1m~che*vjaX8UWm|4i+xAu`{ZtTtE9YAFsvOK``9LYxP98Sr
zvo_>cm4skY)<6;ktiElPm;g7Nlu|2p;+rCFi2G_(<bfapgc<@i{aKtZ&xPC|6B&-A
z1hgM&sal<)dD{sDmUdM%fNsP*AMsbAR=hF%T;D74&`Xfx5jn#T=DvjNn=lGX$B@1!
zjzQ61Nf=2E$!JD>NCDYUX(4It5SSrLm!TU~PcWe43(JU+dU&{)s5*KL5Qm{ZT4v+m
z{0GlGQ0m2nAC;iGGhfIfs~2K~ePTFqVsIEmbVkx0`@m7dx!`K|D#rzI0K{G;uKq7c
zc^MB&GbsbjIZuKY#zcgs<Vg)V$=;RQb))D!4DQ2--oozHHHZTb+GDB!!T!dL#O&+T
z<`xqJc0)*lc<-$RF63Y%T`IE0oG^cs@G-YS9g;978*KnaCQ<XY<W(vwN_BrrFBmP)
zY}*)cLes4L-g>!dxqL$iLHT~+nnJX5wl(Lqot7O_>B*K|9i*r_&c86&t?E_QTCLT3
zDi$i3omR+R%&{<vn03<71Dd!OqMcQQREE$2X*t72`)<9&iIdwVf^7l<*{D<zV(prM
z$-M?6QG$yk;KC@Vn=&GbvEp2(D+jZ)$V3DJ)fck^BU&0e*-lB8faB+W;gw>|N{E~+
z2hVj5Lx+wmrIR|5gVQ)t<e(wwqQoXoMu>|bBBOE&KEGKX3mMrb*E?i#6IX0b53<0@
z5Hqy4BpZm~Vl;%<D?2MmT}>*V+hw_m5WE6@7~(WdCCfD`uhC%i)Gavw$LNS45^!5f
zSy$ttU{^8tTv19W4)}YCI<gO&L=uJoEg4h202E!%=B=IDo=Y6od}dgw#kW%edT^x)
zyeWVmB%zf`1*Ii2s-#V-rOL%PYS6dc2clL+5Ms=dR6!EmaCqld7AS&T@~n&7l9ON#
zmdHzOEAzG?+(VHxz;8g}8+mIEH#u}dJz_@_%6oxR5X<?omt7KYRf7<?u>C<Q9(74D
zHMUSCi8Rfa6_Oz8<=7W8R!f}kIYAoG&eSc3yd->=_gMqi1KWq%-QJKWTeWAon`)i)
zUS4<4+PGZb^4eqZ=#U@@lMPapx5id$wN~p%F2slt_4jr`Pitd|zRqR~c0@qKK}TeJ
zRsv}W>Qm>Nu0b)L00+d!ib*SYS7}yeM6niK2bl}w6l|Q=8c9OUOU&Eq9QoX<G8$8G
zp~T2mogN$)=18YH#OqNx29SnJEE-Q3(`HF?IKbr<9c!u<b=lRC=<ioCxlASkh0N6S
zu{~pv&Z4=Xgh?DYG~&JPEP(dwIaAx5D|-_H-}YW)AnA&}gX5e5cu`4TwRX`2zNQm~
zS$HH>frJ8JoPrM6qIa&Bx>`B3KBG&vXJc&DC1*|EOu2cOb@`ybH%UB^p$(K=d5=`7
zbx5?HiI|J|QgB{X@-mPh3{)G=gMy89b{HLD_NaJzDQy7ILG7ub^6}R&uYxcOYFx9*
zeBhWIX3p30LUTmbdJQ?}E{8-?wW9+$PwG{jp?X1rjl<B8me-vW4s#|`U2VtC)<$DO
zL8$^?de<AJA|nbXdYPMDSp@9^GY(Csv{ey*tMbw|I8Sa^q64^?Ft3GBBkFmpm(CM(
zOBuFm-D;)p(^7(li20P9b60jxqjlSi8+Pi{DLb8481J=n&Kg@=HalMw2wASd-ZRg#
zeS6o4*rHe3mxB5aBinn<SvKyry$`=yf1MUSW9OZB9+hW?_T88II_qm|cFt&Fd%NT6
zH92~^it0v9#!i(nZRTrM1Lczn@q!XJ5YGoRHfTZ9k$_s+tvy2dc_0vtq~BeUf=F_$
z>`L%&sr*z+mvsb3I$T5{jOhprY(O(2p%`Kih@5McI#lz7(Ssa?Qy%8%LpMx75IM7J
zgn>e3d)BdHqk3FOMDzvkuF-g-sg?o`b*;`*$h%b{QIT2Kf2|SRpEN7plgMruj59k=
zlsPMzX^s~q!fwXAQM(fe;`O+a_&8%G@Cna6qki+?v^maVQKN;nR;#s!V2aWg7k(X?
zf0$umW>ibwq;mKoRVIQDHc{zR0w_=h%7pc2B632r*yCa8Hp~m^>hA1|iqJ%<6SIK`
zEn&yhi{~YRU|bIN`sAKkl@qFi!^|}qbBL-$g(=&VCEqXBx*JWFM2E_d!jIXduAuMb
zsvTj_Uo@T^kG1n{86l(&W6l1sM6bATlfk(dI1f3RGsgve9iggoj$88AqVyB)O{HW_
zSrv16Cs!KjTy!&yO45q!r+wn8F8zA@7ytBScI>0K*&|zDD0!8c!hx&pYyQjs*1qrC
zUvDpX)){v4=1<v!J6}TPsxG##`-eYhUy(m;pE<ZycAO&ylrJRvvszz13(gS#;CsKD
zTAYtQ`Y3nlU&<O1*9DW-&devJL>?r5&3Kc{Es4s^ehyNt1Zk_J7GX02BCc#;(e6(|
z9uClWwE9{Kkq7dv(DjkCyo7Y=NabFLR2QQ4N2QIe1xG0gH-N4T5^3#Rr{2j>NJfms
zv~Y4YddnPnv?YlE&JIO)MxY@3rD3!}MT|1HS8_-!K#)v=cd)>l?OMfkgxl>_aSCyN
z;iyPin4k))1i--YgZAWcu+KtYavo-3=>h^6eG>=lLs&YC^sbIh0E_1qRBJU6fYMyz
zt{&blP^6eA1%6zBF%^Y5ND(}HBs-IS2-Xh3&|%xMg_T?>esD%6EZusSd~)-|sG%l>
zdfhQJdoU+dq|${$!oykfq`gv`vj+-A2^?E51$$gX=MSL$h8-C8Np+O%v<@RXC#+)7
zjM*ix{LePEZV;*2R2w8WqOx8)7!FEJ0E}@Ed=u9X=p)#oP?5x>st@F4@4AhH4q+?6
z4j+2lBwB;F3kC5iEY(KF-d2P`CAG?M<$70#CUB(TL&YR)UrH%*8n0&E_FwgCd(qjq
z+rRyP|Ezs@vt0Z3sYx`|xzDk$y!4R${`>E<RRQ+pzZQ#y{l;(nrv1IY`yKr3yyG43
z{F0Lw7Cv@V1Pt!XP)oZMvt*EQE3bxt66~ppYgC*V1K~V^e_=@$rB#O+*sN4B88M^G
zq7>_rx5+Ba;K{d2>~O)liOA$+E@a+{Y7|`CH7VF5t{}NgON(-IyO**@^rVFtR$|Z;
zU@!7eOIxoT!=x4-fX29(l?9={i3LDRqLF2*SQsk4&&)l)7?)G;aZ**$##rsf5#iRV
z9BCNrw5dEGFtZ~E%{f~b%M3*Z@(c;pq7_MvL;8y@2O)n%;0c2MO*3KP^&(Zx+n}rs
zzES5gNn=xXofC2{c_t(fman*>E;Ukl`-)(7>`J_vi5^S&K6?2jBV1;V?pMP^p};=(
z3S>}Ao|!ZYi6(LXnw>?<<7yf~Hw8maKJ=`4p$L(8{C^b%Jn_TR>?kYXH+)Dd5q*8~
ziDBt9s45(gkgUeazj3qBW^CMDS-Xjz)^an-7z$iL-og_g?1N&4)FIW+9R*vqKLNJD
zFcz;%K7$*w;ogi&J7CtU9iV2ie8Rf&5Q5t^iLR1=8m>^T$KEscQ+E*q<arZ6tKAo>
zv2E<#L-IQ2ck`{2Ww2eY@%kBd&eP7e{fk>{JFJ!av15zT)b^~eaR-Kb-OhGwYkP;n
zrIYnF_VwqR+uYRPbq|!5<jKcR+7ne8>*;>G<YixH-+1{)?c;Zp>TBnO9XYl5>z4Na
z#;tqqz1RN3FZ?2t*U6J7?IR!g=$D+ldXHZgqAgL}SrB;GDY06rN&v<Tr99tT+W?G7
zur2gzBXaCgK9rNOB$X&kfSGwE@de@Ypr&3CWUyEyCN6H1llvJ4RX@=yE+CKL!PR=J
zZP6-TjY_2iK5e^Dg;E3T#ZiTd2_&uTzA1RUtwm<M8db7d$w3t%HuHJ;o{HZ{F8H*e
z{W*>`V^C{@KcQEVVW0#Ft=$2`z~tAlEajFT=fpT2%>k55dgA-40%Ia~cjz$C0y@pR
z&<Sjl2-dacRmR?G>hn?=Loy{Iu3@JE-V_LL$cz)ORPad9F**(sPb}MbA>#7)-6%2)
zL^M~8$Hk1hh(#jrOhUUuD^CxN?3_9Cs+49ihpJ$Z)(ZisdMHsrL*gjf9k6<ax`rjf
zPYGkio8f|XdO!3{*WFhp`5;aLScy_f+*x373Ph0;idm__kE?I_a1u`ek1!YaZH5+L
zO3TWUt-LIEWuhB92~^4q(wNxb@VV%9u3b)U31gC#NzS>*9n0!A`Om49E;jn<n7GPp
zY5(Ofv%mFCueM9h99g$@*d9K<&-P4@YG7Tyf96%MvA_E*FSGO4BIf{)-u@nY``bTZ
z?Uk>#uYU0rcJ8@n+qeJyy>`?4f7jlA-@3i(o4&<faM2nOp84>t_Rc?eyS?YOslDi%
zztNtPK52jOJMXvKPn7F({>$zAfA~84)PML5`{U0H2NZ4JRj;)-y{5eGnP=O7{a-)Z
zPJQA(+Q0biyH=IgUxS6@_3wZF=k2?`^E>T~vRQi9yWeYDTU+*@yMiO11+XwC1XMTX
zK|F?z8&iDl=Dlb-;GDL-HmKAX1=5)vl1iMb^6LOYbiKM%vtC|@6#-k-vQ0)Mp7IaO
zf{>&})G5{XFpuxE$hq8%Ge-0TWsq7^;^KDs9c;Si<<Fk_g5tjthfsc=Nb>vy4zPK`
z4MI9nkQW$-@}|AVFvgiAJq~WsNd^|`97xKJT_&7=Ro-`A=KCWz&h5))z2~Sycmh`p
za^}teqSGEhK8E1s4i+cm*8<GZ&xlSWX}iSGTF`ZrL1I-A`WO`cE6<`x4&xGFwtLUB
z(dRI@VRb{e_$Uah(fhn-041<M#04?+aHA(O{+*zMT`^x8SrWj}xj?Uj8nS>IXv@ug
z*RU3A26H)&cAQJ$&6t2ZY1Z<!mRhs(2&yE@6Ab@GCWOl%7R=r?ZM0je->X-Q8EPw4
z3^Pw4f$ur;Au1h=O>lRTs7V?e=5DGLsU;Tl0Kq~VABf679Jp)qUJvAmY<IGjS)Gks
zmu!&*SH(fJ1Av2I7VYlHQ#%b4R~TPpFaD}m+XY8IU_bY>@3T8k?YA5L_7B=unv*#v
z&$KuE{co~!KJ+i`M}PBn+dAWg_Wl3#JM9}DxXFI(#^1JI-t#nj+SMPn|Lgz!BYPAY
zY|{<<@bCP*z5mD|o1gO>``dr#E9{zUF0q^Mc;wG{M9GeP;w|=;D_&-opYvAx|NZ#8
zNYhxYzdq~!`ya61c*|StpZtIRvE6sy{r2h4++zQ^i=3=Zh&RsQE6vL5QRT5Ix^;cx
z&jeSgAc@#z>A-vHvo>Sc<cmf_B}0xOCQ*n#%bHE0idrm`fC%bf3=v|lUx;62K5OIV
zn3<;&C#ppJtyWO|8u4o^5CvL=^DfFcf<)im=U&DHgqWjZrDw(1RBDroX4EmkVUvt=
zrx|34^(jRrQf#bwO;B~UKz$p>A%w=k8w~JvsKo<x5%O{#7Lv%$6u1bkLyO-*d(ctr
zl?|OSM}I?g2=9SY?x`BDK;C*APP%$hJeKW7<}k13P_5UH4w_ULVm7KCylQnQyk}5<
z<KRh9epH!cUzC-7P!Q(tn267<&$y}qtr-04CITQ*2Y)|xw6I6eMg~TJ?_K8$Z9?T<
zH!Djj`4`^9WdTe;Lr<#^><0SaG-+?|jlqM6>a~J9keu9$9R>Yuf=QbUyDZa<0~lq5
z-wR62Y-4x*a-N1(0Uj!r=2`EzaD-sx?axUW=)#&{6dlyz6aidK`f_=z5*Ln1H_H`S
zjQi8G(G||T*q(9Lw%vNuop$i>j<q|F+Q&Y6tDT&?yXghbE!ERWyZgbBJ^kuy?OEr~
zZD(uEF2C|=pUb884OT)6@ZwAC=?C_y|303SmiB6`mezDKv5PLc$nJmO{?fwRwl8%d
zZj}8dEsbjTDuEGW4(iURg&6&Foo#J|1Oe1x%?&)NuW_k3Hr8Y~OTWIh<=ltW7174}
zy&+*#jpp>=WYYB=0Uj;CC_AG8GXNed5!?We)Plz&ZX>c_7T);RutBGyeTqz?QkPfz
zkCPL}6ND&NVN_?6TFGMY|1<g%Has4J?Lu}mv@tm^W^)z}m`hD7xwa#`lh)*55shnf
zK7&M-z!yD7Pn51}WcO5)_M{P3$%y2lN!?yEf2rLscj+q2P{CA5t-8ThnM7Cy=!z8p
zr1J5L^m(BvSrS}3>fe&7AEZ!J9WbB=N$@8doQHeKCn2k6$#~#GbZ+~R@_;gQ8I<fG
z5&nG7-2_Q#l@uF$)5F1x92Cmsj-1GP=j_S{u0RQrz3!D*j(Q-7#4-I2FLZKil3rCC
z3GYFCjfSnv#7dBT+U#Cpw3gllf&@nhLB9)$mOSvF2a_|ts`kOFl#+?g^tJ%1G;FjM
zQ3P>{5(DXo=4ke|s*|~g@z?3J0zO3jybM=6sfXY?&1Pk8xlcbZU9+|NJbU3ceVbkC
zy}H=lVYeLo)9syd&By!f!s}jU-}u^VZQ3o$hGWexzGSaG{IFj4b8>f#pCbjfT7SJ4
zlGY1f_yT*;3twnI^;17>_uhM-eM!q_%<Q~iE>%lJmvd@2)~!dXYC!XZA0I?;*G3p4
zbZV$oQXIle2xvo8C3F*x=&+CmTw;SdID;!kT}z-AeAAZgEr~L)j9}GM0=NS)Ao^g=
z;Y7^Xm_)vJ>wGI5&jxn5wYp%m>+?jFDBLPqP;$8?>KD!y66D29ERNXXq?{kRKO=>g
z3dFSX`P*()wXM}ER4{L&S0Th6dZnK2UK;?!PkLA;cW!nbD~^C_NkQWj$WTGp5wRIu
zv5uZ*-jNFGETxt*Sh7f~P<z6?w-;Cf*?i$BmgLZJ1%|NOTB$@Vt{v_;^eSr~JR+#0
zeaN3rj+&_ig6Mrlg8+|Gx_96N65e2}$eB$B!p~)t%D>l8-j<g~+Y-qGC>3*%hX{6p
zRZ`C@i>ZyDkwC5w8++*!Viy6cZ9a(R2`LS#AVS6r94kIv!Qt?ghNcTw^H8tbXL&x4
zq5??}WS(>ccbFz{q*KM0qgeNn+=@%{x$M`na&8298&POP+%K@x`!saKWlPXzwGdCY
zD4k9`ZjUcE>=_pyusydQw9Rg67d`U=+wUKO{MdbV_v823p<n(9`_)?x(~NI4UAHD}
zm4|lUXT8?ifeY>WSA2!-ec+euCx7iG+uDDP{jKl*8as#IE!8uW4)#n**n}JQfeX&H
zebbRupXZv;(R#98TFz#tTmx>kzP#7Iy?gDIuY84Fe%WRA(?9dG_K<coU(zBV0iSnh
z{-K4}sv9*1hYKyBT5*$T!?tH-({|a%4w5JmtUC||jQ$vAvYg2yATPu}O@xvwMg-}^
zv3-Yj9Ky`NIYrb&yc^7DWqnc!l}u+36$F?!iChXEsbU?K*c)|;ICEz_H+L;o<Wgs;
z9BZWtjgX0Dd(e|>FZB*;A?BKKlNA^^S42yz<+%f{WeTppD9u5{cnTNe^?P;5kgTzt
z9aSD95wnBDE&x(NXN{u2y+qxqp2QX{iyZft8g}evgMgv;P(8qSPZhmOGMs~6$Q<vV
zVzrd47r4T+strbx;yEPeQu$jFjDQ<587e#?6h(UDoXV5pGWOtgDXY?ZesP$fS3GFL
zK{<YCSH>s6@##7ogtX~d`3OMXhv1+JmF}pypxQnIFCz%~veWmnI6%1_2K~dq6}53y
zeN}n{czA1}Uk*SA&$HeWbnxM%@eyb0@}Gr}Z*q11s@7Z#?Mr#;h=!1(bPKZ^;{*}Z
z>~vfC)P45Jn;y1HpZ7}p>hT5kz|q#$FW4yOc}i9Fk(=xtA9$|4@wKnF*I#(3TxV&S
z9lrIwcGJ<%eyw(A%TArzw#A;O+p}LVvAp+bcJAJ?D}1PYGo7+WA9~dKmtJ8vyu7u&
zhdSH$jPq<f9ev)ba`gT??eKFhw>P~0E9}riH`{wY{rG9xY+bEC&qBrUl9#-gN$YLD
z`+H9+X<_lx6r{SNc$ZxHycZXh8%8BH?CAl_V3ieQ>qHztdBE2iT2%2Bqxx*iSVP2M
z_XN=aU$j1{2G1&OO3{iO_^nYHiAfOcBLw-$s4mq?W@QDgr)*ecdlUu$Tptx=g5nW?
z7!9j2ZOV~AsO}{8G2=T>){CIc{g`H%+2fAdchDHz!d$LWv9LYw1#)8Ysr@yPtOKu8
zbfh$6A%mZk<LTF!gM-=}bBz%X=V8&^Np##ucGYEPj^0d=glF^KTTcXMWD&szcqD=-
z6G@W!Bx)TDCF@3HG4t$hF)p1g5!^!+maup}WQ3B7YbEOd0X~Q@B!skIa;ijFmNGqq
zde--{S4DCu?VV8`ne?h46io8D)gTZ|#<y2aLQ-b8Qc;<TB;FAMs-dG2mtG?|SVg_n
zAn{!c483|Iswj$}xSSD2!Cw0TkmA)9&M6KAyPW*``h!r36_<RrHFA_Asx1zP`$6X4
zxC4@cwFaDRy~j?SZps;XW=9Vlu~~DLUGVga?EEvL9lrApyZ_{4cH2$&+R@pjJ#z0u
zwsXcMcEx2E+lA+yV;gbP9=)f`#5T*77;o7A?qU1%9go@eVs6Keov^bmy4Wr_YmZes
z$L!!k_u4%VJYtU=e8e6<zG?0F3_IuCbL_zWvCSTP*dBWHA-nhPhwRYtnN@4G?c9H>
z-F<jwTSt%CZ2dgD;?j%k%=!KH@w<<$64#gULa=_$v!8A6de3{<9{f@(=z)NI;dpNQ
z(+O5x1C^4%D-Ybg1Hoz{lO@GOs!GswAMpsFt)|krCHrO+pJj;cN)g8x0}u-(HXg_m
zLl=shY!(iQ8*Pc;W;$YIckE!r7qme}3z0(LdFVLF!>>(gDZWdgf<C)KkzzXmc>N%Q
zXG=T+FJI8>m?H;+r6tK2-=HpGNoJ?E7d9OaAi2OeruaPoNaR5#SNrTJ@#G3Yj%bXo
zAmVYdcGY{tw%)G;$lQ%n1j1Kcx{-w`QMS#_;2v>CBltK^q+EcF(U_SR!iTIFs>-cE
z1Y!VC0hxc%Czp+ilnLqmAnLG7tmVyLRz(h+$SRH5TlSV=&O+4Hjx!m2!zhrO2>hWU
zF_Hl;RO2cgb8l<Lq}@O@^i_LRjO^8Vv8EfPB!TwdxV+n(Nm0F4POy5}QiEsIdGZU{
zcS%7#S`1ye8{&oT2_5XSCq75fu+@m&g9Blp2}vEVDC7?0RsaG)#Ydu{Ltb%|BwS|=
zII)wF(B}ZbEw8nHu00sfwSxx_+G?%V-?RlXen$t2FMSJw&*s?&4%qYdp0a1Q_YtHu
z?Eb4Dfn1Jwd~$;1Fc~G=+0kq|K}WFktf@N+BU!WxqeKGet3{tIB{L>Jn%P#2nQ`dE
zIL8&7&fq9TbLE_cTagTuBLsGmmm9SWQB@%cuxi2li>*Kb-e&VoC}qSE6K<e(fJmpZ
zl5s`SQ6?aW{+}v6j8{y?x-D&?`lU!Z9ptkTXv=w8?J`xi+=M58o#1s2@=Tkh1&Jc4
zb}<GjC1wc`r$I@?<dBSrOXZ9~zGRub{Qw9ipb~Jmw4k523%=o$Eb>ghssU}o*-|a&
zcgk`e#?AqS<Cty4&SyE^_r+oHpLq#;k6C7wf<YP)e^dj;$syZkNtZN02ttKEBu`3$
zj1N1DIpO%?gb4~SBv8#AkG?)wPzOR-jSkOrKt_UbC@3rpX6z{klWn%iD-1`7%CO8y
zDEyn{*QFU`?{3SH4<pXEp`EtcgiGF6FCG_mTRElWtc!YLB{|Zegrd8hdgvnw3R8U_
z{ElA9Q}l%Leo!lkwpy$8H+Hp8LMh|(t?UM~1K}w~SB@YePe`InNO(m;E~}ST=B}dg
zxY;5A8vZ+#yA1<4VGclpcsIucsE#Uu<k0pr$|VW7o?68m^1^~(<7nFfg(xq@M9>_5
zADdewv7AM0mQ0i=MRcGC3fp9h)Jjg5ah#SZZE}!aq*oYPbu_9q`6F7T%BhN~5a%sG
z8&ZE4+}<28mIwxMeF<~o5i6F?H`<8Fl`D4)&hoT~0>RolaT<dd^F;5U61HY3)@qtF
zQ2^Jyxsomy|GsN*mc(^3m9ISwBo+9n*O%2&>>WvmITUYjbgX~!QqUcUD;Jm)(X6uI
zJzdV7ygVGiZJ3Ek*;p#`%dr-vSCAN4k~$zmtZemYM}z(JQ0AdEm<E?;Tk@!oJm-Gw
z;-I<kB_vy@ml&5mHh6>H6L4_zHJ%faEMTP0MZkm4wxJZYw4-9}tt|&DFI;764*GFs
z-w8#*@sZpB5}EU^;jMe`bq{8lLn&<olW?_GYqg%_VsLg{K*~P(xCHSpx#XJ6;Y-|@
z_Y%lO9O@SI1Z)?rHl^k>BhP;%4O?cLv3F^@HNe2hdvZVse%!fWgpo6eNZ_1ud7V0v
zY{ezTxZtA^DH_%6EREf4Rx|#d?Yg-my&JFYsF1{**t7MAcGQBwKXaxJl%Vhk8c{&v
zN^#QlTVc(FIasH{1L6=!klM`KQU<Ee(J>2|{}Cq;1bJum<ukGX3PCk!6$-==mqhDC
z`xKfNBN3olNzRZqPb@u4RdJl~Zy@^`w|Sl+?pK16Gnksn){c64!2_~;&Ulv5uu~5O
ztDWq9&M<t%RVK10KC>m1xe2=}#^hv~P<gm4T?)&dEtdSQq9Em!c05vERv(#!Hj{Ri
z3?T(2#e)P%B~&~u6H{fIZRbcoA6i0C7(&6U&crvU$-6>JQuDCJXM57~avK5f@v<eG
zlJ7|J@_SUD=Yy<7j-Lb>5IY{uzX*4&mPrZkG2(x|V{t@gmsVM8wN~q?Se$8L#1XaG
zjCJJP9RJDe9jHC8sDeON`1DOi;#cWK#2F=@t439$c{*G!Dp!W!TqzElcM~BvD}Ess
za2B5<W3OmQ<uy5?F)HY=(~~keTWC4XTNOSEtD3)~$Y7Pzi{?a)#Sop7m6pJ_VT2)$
z73s-rYii6B$qnl`vll8H6%~>UJj)Qzpjc0w1R`Ir<PTUqD=+sXL`8_$R)wKMHQ+A=
z(6At6^(e}#jHpT9I0XO6h62SwrEBdwfdS!`d^oq90jV%y#e)k41!NB5kX;$(W!gvy
zkkqQ|i=r1ZnPh#RRft!V+|Ri9;*iwzFI^}lKk=`+AdfE0vQla#`|q&vg~RC`x2F@#
z>PydqfFDC;2jcQ%d0wt~k$vZ(#w)*GE!{}VaiEGyvS{gAIY5i)uA`+Po26y7n!Un<
zByIv|#B`(ZV31be${d}yAn-Vnb41v?%K4lK6OkHn)I2O#yZVhw8*xBVLv+5Hopx~e
z)mp7D$E8XsyK_Yp^0{%b?JkgdgMVWKn;YXeA?JRHibDeEeRIvOOGSG`#w*Tf%x6F4
zb3I>VB`lwN4Y3NJc?4;+1m(0LQgf(>Zk6;>@ilg5;;uCa6CS{3juMoxxnle<OJjOX
z{D<Oln_am={8@6@{9=%k8!O64ab_mex(S!3bEb+04Riw)E-L57(rvjGR3F7c?R+wG
zFkl_Ci$Vm>$a)B)XT`VV1qlhy=Hz1}(%RD*Gg=lwI8YK_Lo_1as4gKLDU^dT$_9jp
zz~EqsUN?;et3%Ff+D+4jOi~{>0t8?b9o{}11SPrQ2r?hb4t3`WX_;6pC;_CP8-V#%
zm%L=oLgTTAJn*7$g60*LnTz}G!c0+)v-j-fpo(*$g4XFEDq=Ob9DFa_)LzG*LiXXN
zvGOE-0uLvSJ-hsp_h*S*bkGY0bd!#o40+D~oM2tK+!GRE)=-olG%&9#H<J$qfH0ok
zJ6DP(V}5CWuv)9NT2FQjpCoR^QC%chYrsB5W`^8UMz!4JSfQ3m3-j6XnFd7&#APGd
zI1*HW-vu1JO_H_)uaybK(b#EWOiop;Zj?6pN)kApDL7=E6zAE?iAt83g@*xfX4!EA
zk%G6X+$2)lX4n7Ay-QdL*j2~f3UlF(9V64`8>He<Wscr93IyXn&{k%1j72j4<8+^u
zrCjJyWg$Vg{qWj4z(iEEL>iD^sEZhcvIHn&(K<eXy;+~<W#JPzr9qxS@=C)6@_L1J
zkk6O+!#M3Af-kCpkq_s{(8A0K0EJpfgJVSSoqXPvvs!^l9pYy(S=C+~dPWakQuF66
zE)^CCL`b~|cu_N?-hm8A6f+O<-OzS(KnTghNrODx!lfy26f!2Ol`C*a)=oxqzNF+_
zNyBU5eP!?$nj{1aw8NtBhC*^)1<^4MPpxF<!ug<sPY6Z{IzPxlp(VJ31MKzj5N0ql
z`S94Bl7N2noaEw6r)Ug3@sL+83OvYl4LmUk6x(X8)@nV;#f}DIiJMYlwoI?$LA)Sj
z_s)urV$_HN;{$eJ`cCf2N%LxX8;UXmF#(P<LgHt?HO<Xql>~Z-nXNoT1{yIsx~_7N
z1-WA->8wwp5~YbwL&^?+t@Z?w9r%SaNCcJ0T|+ad&czdIho*DH!6Ff}rj8JIsV*h9
zN@H-TrR@DGhOo#a1dPI@Qtm*7IPiBtu!hA8tXxJ^<PdWe$JY8W(!`Q@0;BM7?Q?rp
zen3HTZl=~DJ)N_w!-oN;p7kP<;~!#RaODRf2cwg0vy14G(`2d`kkvuN<!~<P0CE&u
zQkGxpwc;R$o~`CiyJ(BS@DUwYnnk+vFE4`kbE|Pf)Ze1h1A`NpR=coOT7tMJZtsau
zW@zTgS!H$}l4{b!Q4e5;a)WoWc23-#B=Iyt@}$u#!41mu(UUe5lIfijy;mIu0EIcq
z(N*xBqt*@EBqT)Kz;aIO&B%68=@Ay2SjDA&!PaE*YlkKxc4BFesM3^{$#j*tR%^AM
z{GyO9rQ?hNm%0K5)L<e|K&Zh)&;b%sbl?|7W(Oq*qWTgmHN+NFAYHGvKVk4mNWtKg
z7IUf#ff0>M#@QggkUfV&@yBOs+`M|st%cG?$A+S|1feO}k(69%ZsZPx%NZG=Vi>7(
zy*Rn-z=_yQqBL5gL3AR__@O@s`8KF!5DlpT76BrdhhdbGqmB#bH_@C#T_hwclVAeW
z?H4%;vFL`DY>l$?bODMaJ{$xkkZ@C{k_P;^ngg_;#1oQ!k^U^v`9U5GSs<AAH?vx2
z>~^_mEX@+L%+ZF#U|tE-%R(T!v{Q7lo+|-6Kp{)_gzxWVh;E)IEyCGrxBAFH<GAdI
z4;=fh8=gAtAS#vSozKzq1USD;ja&6<@lf`HWDZ(`=*2SSMG5@2QA~6t9+kc$!c*f?
z>#HG9LhN|~{Zu*OdbbW*5kuU|dT%LGHQL`7Q_b20X{CX7(nGT#OFv0m*u3|S_ie(`
z);q7j8LPEgPsyr$9HOR<&~S7vUvAiaT!G39P7bg=p=M!er%|sJ9)@v=Of+(wU@GY-
zVpAL;y(T(<p%Z}^9W1;<n}oJD2WcUUVIyC&eKu_TE28?4WEWk<4S&1n)x`>evZsNN
zTsGa%0;I45;$WQ^t5RP{wZi3<7<Zje?euBBS0o2az;+3ntHPr|Fnq<Jre6*c29{L7
z3F=O*H<_cRSxI=6qp))rMA<c8o4eIjgOOCN?iwUV(6R(TaIuhK<<R9~;!0U8aJ<RF
z0S2+s#iez;Bjr%ZNQwkJgM~Gti6o7@e5Bfj<Ns6buUmd#N@q_K5-^I-(0lae0WuJ)
zgrx0<-;&4#*OMm@JSc;mjml$<&cZ4mY2etlJl-h~IJGQK`fkot8^hqy<yu|NGplGg
z*)ai$ES$U@spE{^8l>|n5=ARmeB{gv$xgju%&it#I~MH7kSH@B`XuF$uq$R+Rl6$5
zs#kSPNPJrmqIIHS=l6j~#!<uTLS9=VutyUF#btLn+L8#qs<>8bwVwPEuT>hZ_(*jg
zJLJgjV+Cx)OE+X~t!ymarC}q;n@Y4FN!Ug0zPTYEm-btiG_wy5cB7_g)+SlbPT96+
z(m6%krCwmxjGc4)THrHo)YGsDMrAj0h4?^i!;W%!!Oa>muj&|QdXGiZjE#6}68W`V
z6UrcOF&2^V{UVvTBi9w}Op2=u*}<v^NI|+86U|+*LgUq9OcX!0bFiP0fGwQFC<l6u
zp+Fi%<qi}ENUq~%%w&$Dp$|&7L|;Z(Z`G_!eLfW2c~^4tQomro6`%rSxshBpm#(0l
z_)tOqBkb?a7cJ*txR3+zfzns(aiT)%T@qxlNzr2>ZN(sHj5FT}@}TRb)FpZcL5#}<
zUjuleJT&xB%PP64eV7EupbV1lXsABy1m_{!?>GfuuvKvojgto>{j(b9f_1bUz_I&|
zA&PHcQD{V{X%M3kH3!4}8Iw>~%iMA>!gM|ytzoLc`zv$D1Y=AfaiB>CZ7%41)j@+)
z+zWtKnke%Qs3Y@XW66ywGcMb)w!&wu)@nWJ)jRZET_M@X&*mi-HvLji8!Pv<&9*vj
zv^#>vh&*E}jh}hw{LRYdxIr~iG3F(Qj8_AA3l&-=l^w(^ifGq8D-pQ;g7z}&dLNrG
zBxtllSBbJ&Z{%K#w$X|5Ui&7M%yz30+m1|FIFDM%1)FOolcd+_dlze{HKqYq3o)wo
z*z&}{vbEjWp0yE`lJKJIV-+f>sIa+4D{<ityzHc9xnB@I?`{`DLCRQo%w&{#Zpm#>
z)(}_W{!rd`TKcRV>bXuNZFb$FkcwtDKqDmp3k7ooM9qOjeq&-u%n}r*#YKx%bbERQ
zWJsOhR4Lzqp&cQZJ?*NU0W9TnhcqCt1LQ%}ougqa45VQ59<UM_WbzU0p_YMkd1^jW
z=^h>1ACz1u-|yV4lpu@m%xu1%=5zc#Pa@H0Xq~tF1m90IUaLX&1xTfQZQ`b9L=~c~
zha_DRNOF=M;jKy65)PxN1W_UJScWScY^hA2l7JlatAU7a`T4bp>`k^?`P2+@GZf~h
z&4RII$%Nh~C+6AGCuc#A7+bB?TCFF!sMlI)ZlrJ&82Dq5LPq7z4n*B??%flmM<Q|g
zeIy!a>!IB@8Ve2F6D_S7S+$&z<>kKzX9(Yi8$bI=5_J;>xbl8;j{^WfK;@@wbhmbr
z>$;llom8S5q00l+BT|txM`8rV<~zC?Mjo6gkdW1pqU(gyf;gh-z0xsxgvF8<cG!x{
zKE^Rpd$Pwx#7oYp*hQ26;lfloA$P=j&|&3OX6H&{{>+LGSBP%Or2ojpSz;WjOp#X>
zJv&%J4~pb#jK0Bd+>lHf&U50@9T{)ctDK=0U<WF<^J8gAlEuD8WrFLCpp0bLvR^4%
z`gysiJG~MeN>M7MqXNoaa5;y{sN$aJ(ZxP*FJxY%iKNKLI3&dE5i1=*$SLCMZ9vW2
zbkej0Xr1Ur(MbIrEz(3Haxa8mbc4-gvdivT-yNx1Qk!#^$lNlq!dz48&?v~)%0W$I
zrlA_)pSV#plF^J0nqI;VsinG8-fXASgwTRqmeq0qbhdUxk?s$97`jld|Cn7NezjI>
zwVv#fU!c+H7s0*n6yTAh*2aQ)K_V%HuC(s(S+9xO8`a`Zt&KDnBNz>$y52Ra;y}1n
z;D^--^;xOJF8d;a(xB|l5eHDnHMw5xBC)bU1%l1DEKSs1TClK@WD*qTg+A9jZXzi7
zG7duIcRE&AEO>m8YlXP7W{v^}{ie<|$HZ|h7IPju<XBM^j>my>EAGY3@e$?q;a!Ff
zo79ug_Ustz0F{p}bP-)F7m7f$UaduJ42Y*Faj$eemry;4B1INa6!qZDky1-Ss4bi*
ztn8*Fq^z2m;d78mIn{evbY`kDcdh1Qm4g~M$FV^mQh){|u;{Y&ymirKjR<xSshMrX
zY8M_}nJO7no{25P%)bNtUzw^JRC7&97PG!{IC}Y-!}JGW$bja+J;B3)MA&!^=1w9&
zf6);*8Z9}YnO1MMRyCCGpZ6l>p&Ffa64b2;)Tns8cu%1Juu}sXXC$dGqAojsXoQ?~
zFo!eBYifO!a(mti{)rDoFFqI=+8gD)XRd+9W?>AzgYi;7X{NSn6Ry^3JvED6j69Hu
z1sGtDE)U#Mws^!(#pb_GwlN8|*}7;#mg3E{$pmmACPCX3MBFOd64i`2fU1JAaF~Tf
zIYyx2($14~Un`AW5bw7jmRk$lFz`J?NsR4W=)$Iv+#V_uBuyf;Q>5_ks3h4|<WkPc
zgj)+sWI2Ioz1-HL$3@JiAmlqP2|KoG(?OmJZBygqsLZP78neJinBKUis;<jQ<~6IU
z?9R*C$=T}8F-9hVJaB%{aqJh`>|;fjCfQkNOta2wYJ)bPN<yLslW_Ww>!4$0*8FKG
z4R=ht2lO0)2B}J54>V6xr6Ru-^|3J2!`CqT0(6vcaW8|18P-6?t!t@NG?YN<8Pug&
zWlK0EA)js|Fk(W%iMCXa?`%kbLMa0A2&7K7K__rmIt3C|0Cdn|JB#GT_FEmfI~ZDS
zIJPP6q$gH)^RjDzW(ekA;#Kh(@ErtqJ1(9}=TIUUH5k?P(v!#5Xt{1JuV+cRGbLTT
zw)tGHiMsYo#O<Oyydx&=n%6@QSrrGT=*+(R3Yf84tM$|@wD3CLI8)5F5`u2YsdC98
z)=nwN#<9e=jj_~q5J2V&X!%LK0&!)`j!{P#bMi`pyjQ2Q2ot8wcNW07R7+&UC^4Y=
zD~WM^49=9Sr7%{QVJ_BGKFU$-Mq=DsMh|mOM2NZb`J5FbT_wC5Hepc`T}eoKuo%k-
zNnI)`Lfxgyi1;#@mY6dixUQK9Mu0O=`E{j@x>yJ`h=Qm~st{?&>pw$1M?ohv<^Z8N
zptUMN1r!!_6MS<oY7zl;NsiAzL(&A6^7wIA2y&SDNDS7M-c3E)L?<vK=ZLDvjuIhz
z+u`EfKnh0NuXkh}b^#?QGg!l(J_<m=4GgLaPc%J*DQmI8>19*u#g^cNUK)V7aN|+A
z84Ff{vyw>2z$#x~=Qv25GU_14L2z;)Op9j~@X!EW89JWB45&TROm2{-!iA+y7C94;
zIqCRwm`5$jd!rf~m#3)fo%`jpyUx*>5{j%HO_Q16(8ipThTk(;q2AWWSG`eKrs(My
zR6!!=StL4^BwJ-y)aV4BAv0eR9<~z9SgqB1Y8Sy7fX;#2#67rl1;^0i>tN%gIMbQC
zQ}`?f-ds&dDkm1IG$t-f(Mrr`Y0nhF?X4uCL}ds{!zp2qQe&Fw1GGh%IodsGwuZK2
zQ-V0CKnrYQOP~c>ace6PPL5y=X(Yzv5*tpTnn5z?<ZB2Skl-M-MG~?RmN1+%5y;`f
z-J!P4IbKs<Sg=Kzmbf=7KQr$;77op1!sFSq21t9k7Lx%hZA?T%GM-RkNH_ty(3@s~
z)PMA<5ec>mvVFmq008M+w-KVnXeFZfm?g>qs)`v}b-io+A<>YHO~*<FQYcg)iA>{&
zRwJm)*6Z^3j+9uhTD-T4cAd$5GC81Qt&(#nDiVmq&PyTzjC|_DI3sYP=DZ0vbpacd
zC}j&|a2l00DsvI&N9E@+f8q?N{NAZ{P9H96V`W?VztldXbA$=YU|jeb#AQgM;Cll^
z-=U$wjofN<l*<lhp4GdCDoCirOeaxrG-3q>AjX(vjNrt;?C46B%XoP45aK%1X9uz{
z*j)i3gUtg8&yuTxbqmPV)9AZBwk?D#1i}%OD#wkv;vf^(1(pt}POEm|YOU5&uo}+E
z5hwx84ok=KcD7*kB$Bb>9Rv}!7lG}%T#{X>YnZ_B8Qm(;dH-6p?UQpkAbS#_C4ET%
zxs#Gm=R77PsNStWP|0lXD4?UwhQx`gr7f}W=*gCvh4{cDek{tEVKkCA7tLxbDNpon
zT$_><>?68k<$sh`iZwUeQ0D>U4KaQKa7QP>C?LSk+%s0H#krMCyuARmKuW*8;EWF-
zwU(Ipj<J{u7^&k-Y|&T5GGMlaYq#bkWuPV&E_#auouPf$OV$Et>WxvPMk|HS>&itb
zD%&aVxiM*o$duzfJ5f^mmByfEIJkglm*K^yC5VorhIeeum7q;%CaW_9*aedl65SkJ
zD!ncb6vMa#lSpCK%MHz{$V!IaTdFB=q-q9aA#9NSfeK6%UaSe9M}>l9Hs>s;UYa|`
zs1_eC5L#^8{aol16F-Z|vlmgi_SPiMsrE89)FL(aRFFpnr9P}o)G8%jqH%h*6oF8j
zBDs#E#C1_sqLfCJ7?dx1?6w*isKKYEXPMg4vkMPfgG$oeH!E}l$69kO*bsR236aUF
zk_#$!eT4Lr)CY#U&IRbE<Rm|SB7#&sR;a?&TCFF)Dpm=KCv+Nz`UNprLJ~HO0B5Lx
zc6NGps@6(yMa)6$LWgE8wges|#?lgJ(UA&583Sm6>SH{TE-9)ObYh4GqzzxI79-Kw
z4L{!<O?>g6mG=rHG}9Z*ZJ#KBj*$slnLvJPQ%$M42#`i&JFO)2rlX2;^(oygBrVl?
z(Sf$(yu8*Lz#=7T6UrXO1WoLjs?b3q2UKHyY^;W8P{RE=qS%7Rg$+2Ww*`)|B<N;T
zx#?{w7{=P9qjlP{Xo?JD6=HmgxT-M`Fbq)KXKpg7JCXBs_1Tj*OXtdX0wZUKBlr%U
z!;S})Lb9o~Xe`-SyV^L5&!sA(k~yREmpI%EV%w<^7U-WvaZ0=o`B9oL<!pYl%+-Ru
zdSfvrO)wnO2vGE{(?G9$9hUA0^g!N4uNbitkjbRT$0X=FvJj|7f=o;bA4C~O$&X+r
zH=T@FSwh-G46R`MOQNkRX%}XnT_vj0yJ|<078wgWSAr+h)rE1fE25jR|F3og&zRhb
znqZHygIzXZ&W2_*zE(?b5wpP^?DkMS;-O1wO}0Mc!q<1IbvtGocIwnA`<u4n{%h@P
z|L&XY<>z+x*!_>OJ#zZ4slDuf_&NJ$mwwuQ_mfBdLPnGEyw}+O^y7ca_S|xd-G5>x
z0_an^YP;ea|2zAyUU#t_dGKyKyxG}bhlS7W`r4XZI9}M9`IzP`y%Z$~6%W!%CC9SF
zO>86~a=UL@v2vNU>O_r40;OS7K6kNM1#;JCB|_0SMxgUVQ#oxXsd59Lql-S9H+FXb
z4nxq!91TBvcuV?$xbm2R$ps@5@we7Q^0&wuE$_c0@mRS_klvI$W@+YMRRT{i7i5iB
zI4Z#gx*XefInm)~Q81+JAUYgtU#`bUx#QS&M+=v=X~l641spmbF>%b~)GBjf@+<@5
zir~BGbN$RV;n-s*rYJ~uxVEU<;LlitR9n04J+f?WRe4d#7`e0W9hTnH4Y_AoSWX(6
zUCCkIQB_7A1#GAZ-3~1Kh~2Ny$`f8*RZOBeBig@JYMDg|r8Fr7%ji*3PQ4TDfU=`~
zM-rSJ8GeF)1LnymAi8CAwFGBm59)0m5^10?uRt1V)e!-R%#Qh38l?Zr@s^#`w3N*|
zI5vE*%(mzR4Kf^+lEKrc31RP8%Il$I$?rBQy7@}_DTu7RaFPbT4)I^H3ffYEifb_|
z$?3opedO|f4PGC~Z_I(@bUIR!rSo)6ge9%OkxG+ViFUfhk2tn-u6eb6^Vhw~uD|>O
zJ9Cn3^Y9(^TR-_z_Q!V}C(`PvSn1UL_R&Awv})(59q#@jQo&QX=63UM{Dl4AI}h4l
zRDR7zK54)7QxDmZ$2Nt;{m)%xL%DX|)%L14eusVa*`KlB{Doh%cisCpr<})QiAn*p
z_{ms`IB{^z!0eiP^@<w;j6IHT&TX<*Q}zw5G_>!r=_MEqF{I3)*2g9AE?|Zzlw8iW
z%ynbps35qm>dc>Cxu%!R?I?0~PaiArJWE>;qm1=Zt(7h%e|~LbjG>X}@I=4`454Fr
z-_%L*NLsIf<A)lexRaU!x+)yx&Wz3(K^1NYxhM(CP41nCDzY-6`v7{BbLcC9SP*ab
zOhI~XNkXRHZJyi4v|Pnb9*T&!h@vnJ=}qlS{I}?ZUI$SdID~1rhH{@b;t8s9eLyiV
z(`KMf&dx>YN9A&dRyG3~t`aB%NeWd!+d4@ZI|Nq=hEj2$C}YWlbzWL?a2ywdgAi1`
zp$d_mi6i~6Gw8h<%kqQigOW$Z<gjKZw`WooF6A$FGT;u7{9L})&KHEJ2=xPZPVE>t
z0c2&AIXum-M4w&aiX4Voema!Zhtw1mL3$!w@UWpm+S@ofrWY|=<#^D}$+;I&GLEh>
zrm75ylqA2D-OEfnuN^mYn>hMXom1SDn&==5e<hx)el>N{%J)z8PGt7kT}u|afFZ;-
zRZ@ID-B#GR+Fth!FSoPq{{#DppZU1mzf%&~)6cT>@Rn3Zs<CbC-NV)ekg4;nljVN5
z+*vi#y|%aXA_!1f?3Cg2cDaV7b-lK3>!m7YbD*2scKP~Fsk%=dJ6f*QLKO@?T;r+j
z-@C!yerjj7dGZuL<T;FN?}0s*x8_!t-8Ea)Wn;2^>I8?;pM4d}y>7-fU0>rp3T2Zq
z+u1I&ht}d`ogb#f_GWqia(^b}XD}m}?N~QC!`8Y@>&o+sc6-?o+Rn+7c52qKGqHI5
zetW3bE+f?IcGmuAo15i>zfrmgc>P&<wubX8&)Q<PZCmAYfDd?G&TDOL${jrI)ywy`
zw|3-`J**Ni4j+8nHhC?}`JVmfJzwKzw_ZQbuDbqud&%?9w)WO9@LZJyxA%+#b`Cr_
za4cIV>;&GEjhfoVd-m9#at@z+4<@#EPpMKix5>xEbFfzKb%o>FF6F~`O%)1)+jwGC
zw^Ocpxwqwd4)?yFpR(g8cI+==pCYc2sv?TWHkx@2YV5HZI!xuWJQn2z5w3|2vT{!@
z*cIpA{ir&1b|8^gJGTqJPXpedb45IXs4P*34cdZ1vU{eAk0`&9c(*OF0HxAN(vTG}
zE^@qq898wp&=MR6(vP~{F$ht@2dcm%#E^qZBFQYdDJ3|wB>{|?OoGq#d&255%iBSr
z08(-gqHT)`AyG*1;K~_jk9HCrPb4>Y{954q1iw~_spu||S1WuVJ59m4YM9A2lgN=t
z-_lM>IDPBVt~3!YO6NSHN*+?wyYRG&M6jU76<?jqY0P&(C>{`e6zz5BH?k3SEL4eb
z)p)rZi=ak6d3N2atoacyC-ta0CIIwjL3T!UxKkc(rg#(K7`vL`apT{x^XNsW>z$@u
zleCbRj>xrN?ActVm*@${N`g!Xn(~n;7ryK``bx=nf!R}32~2`uRB6phez9;*FmvX(
z#3MPyLe<x0C)w35?(5Q(8FR#%Hx3YbSP4Ks5d>=tHTepq`a+A7q+=&N<AZ?rnYT)k
z+(7iFUw<r2OW>|f+0jGC?8J%fa=kb0{?8ooZ<e6<j2GD(zv*@M%4^QEI6rCk{mHM{
zzx_`iu_Mie_R_!gU)q~)IKK>S%Z}{O9d_gI{Hp!>t<j$Ux;NR^yy6Nwr?ew>9=*xl
z@wVTyKe}zNeZ}8-m7RUh`|NlB;FES}?E-twYrods@Um;|;xosVHV@iOfAkjn<+p#@
zj;BlPTmHY_ZTmldyG^fsj$L+Oy|f-4vv>Ua|HFRigO9on+i-|eJL9}d>{Z|RCVTaD
z7us4rVGn%#o%WyJ`Z0^o`C9wh=dRiP@A^&qotw7pvak6r`_`+D+56x62X^@RKVaW*
z*28wP*>C4R;~94Dc*pL3_kXmX{mqZsgPXx__<^6c?|Jx#?7RQNV|L~>-(>&zd(X7@
zzsu~!uerqR?mw`9_sh50-Wy(T-|~j%mf!8{=sh2`x4-pm_U?PkE`7;s?Q38EQoH(`
zHOsRj_US+VHGAv3Z?b!j?N&tLz)S5P{>vBI2mbq?v_E>}Je}|RZno)*UdZ#Em#X)J
zzwz%s=X{l@H|)ZzuC=Q#JKMHC@h5ip&)g7Ui~US{#W!4R-*n;A?A$%kPTlhR_P_ts
z+w8s*rB#2{RrVF%RIbsBuCVo3TDW(9*xvKDx7s^DvuTqHUTxp^BhRtV{P>UA?>vA$
z+5vmvH+-|b?94mtm;Tis+4hw$wXc8qvu&e4YU@|rVEZ0;x4q@YLw3o_UuQ47^6WBy
z>1^}<_u4Q0!XMfv?mtTK)Kj_8o+^)>&&M5z(Ms%=Q1V)ue~4N5^rAWgRDI#`i=CW2
zcuxs!jaC>o#<XfGpKp+WDO%nJ-U9-LX$*@fRJkLD=se9x{$FM9qPU4lB<5WReO+;G
z1`ZTQ5(K}M*BZ-xBf7YGBzIO9t94OwHGzb}rg^4mX3veXD{m;d^*j!2<RdOlsyK^6
zlHS;8q=ASSIf`yWBJLFuADoi0r6h18OOp^`8|Y{P^Ev_5IJ#jq8)d`7c4J4>Bw`;n
z^VkRoRT$*QRlEN*B<^wXM{$@BC6db)RLLkE`Y7f%vOW?50(z>X?p}F-rL!fot<Qnj
z7mn1^LMH90`B%AAh;|yNSjOCe7<bmt-Nk+pRoG5xl}${2(m`$>$QJ4!qCd)6oRYP6
zJI=<AnkiAGeb8TY=pAQjK_x5urau3|!?KPGigX<%`Lx}26n;#dcxiY5T{&`DB}u+Z
z2_Mx2<z9e53UTR0ro<nq64Gm9!YXPpJR~j)!*@?fj-%+i^Ck!G!0@5iL_+nsARI(%
zYL>-e>v!6$bmT6(`R*6nn_m4@_J(r(-v5ca?U5rVZ3_+i@x}Jl-}_(K)p!50{mA#c
z&rTkArTwG-{fF(_@BShCg-4!kuX*LjKKP?QV!w9R%$kieY;Qbe>u29!*I&7AxBlY)
zXm9@5DVy$DD>KznjfB0sZ(0V#7r*?C_Vv%L?F0YeN9|wUcHH(p|J&>b{`MQ~6}LTL
ze|UfSnfP>j@%6Xbo8SCHcFX42F8}r)wSV@lueSGn_*d-iW&AInfqm!MWiS0&d*0}i
z_V515kJ$tJo@Zb8&0k@!eaS)lm3P12K7Rh!+6^ywr9FSWB%SM`-SyrZ?PGTwwhNwL
z+taSO&_3{sKX1SA6Zctv<+s^C{zre;zW%QJ>|ft_<g+hQwPyRD{z7}z(|*PN)ti6X
z?r+bqOP>9e_6@H+VDJ8ke{AnPa-O~Xjo)amc;jpB;BP);&$;$Oi?{r`{nP*XgLZtp
z-_|p#(J#`*E9d)~7k$+J`~OMj`=amsXZ8c1bH0cdjqSbYYP;^5XWE`eK45=%=;`+I
zXRrNPFKP!aKHF~j)t|JVyYX(@I`?(<gFo^rd*#LNv&U|k+m&zn9{Z;AKV<*>hkxAe
z+Me1C-||ED55D(X?ePEjb9RS)u@&v?l046U@b~RE{`Ehzk3P`ab>IGdcJcg^_ACF}
z+wH>-CfmQivCR{wzO+{8pJU-=7rhf`0~su(T2w-zu_D22)iO~*VFK+rw7<s$Y$dm`
zm$O6QhS|Yk<;7<^8t4PM9$MLu&;yK}1Y=i+6}$&}ZmY}xLzPbeS2?I-rMg|42!w&;
zwAL8WfipOe06_@)O_oRks<1wE94Qc%PL&KP{Sd8>jXe@b?H-IiFQc!Rb4Rg!&(8#l
zwkVQif(lZJT~omKOCJ!G8mh{v>%F4b0aQOb{i<^s54o*G^rfXLM(?-=aLh2W0z4jS
z^W?J8R;v*O2p44J_<F3tunbBXy$Tk#;ASpm&sH1Xz#KqPb|56GRqU1GN=;E6K(Z)^
z4+S_prJ+nvNScrlVBn^V!QB2i$Rsf@q{NYgB8jd6w$nLT7o_HL9LGADt=LkAKQ0px
zb`g_G{x?WQ$aid$V8_xWH?I_YUGFc%4Vl{Jwl4k%PfO4pnb_t?u4_Zj*yOF#W|6U7
zcbFwEs;He-z>|&2S>nBV#@Gl*{6u9mr)N>u6bPHv`yX|bQ5%NCTdlD?pS3Pq%$8`a
zIbPBX?X+9nWA>q6`}g)UzjvqA*L<yg*Y|zD{a4@qdb{Ghy|z|@^-C_^wEOOv+l5zO
zYtK68gxz&-W7l5)bj#Zh+ikZl?BbWb+Ftp*OYQu%)=r(8+t$fL_UPktJNvqq*(+Y~
ztTHnz&*|(>W$Wq!yZWj#?9_dqv|H|dtX#Jpd*mbUvJV|P!=8O*d0#{oo7pYzd57J4
z641<TyXV87wBu(UuruQmUZ;G}*7u!l&${kX+kEVZh4U}5r=L+0Wx1#OF1X0fOLyCi
z@A`;6SY2=5_1&+s(H%G1`#yG;9pT|*J9X<v?4x%bw8Ld?dGzMrw|CyL$1c0_+|Ok!
zl;E<xeV6_5fBb#B{qRm{hi%yT<$7GS`GB36Tx6GBxZlS3V6R_n7fg=W1CN|4$8xQ`
z@P*H@E6$$MkE#2j<ENQ@;&*>%dA|33=FZP^zU5ilbH2UsWzVyV+fUo?{~@Z=FZ7z(
zHt+g`edLaZ?eI=#+YjAk_dFhK{~4uT7+-2He*V;Meb0OBu2blTZ`vL2eTUstKi^*Z
ztjXtRZG_K$?f#L^*hg;sfc?pxkC%<kmL0tBA=@0CYgaw*g?7U=PqR@!m;aMJ^$WXw
z>%Dd6g1d9{`dzK2rW3Gnle{RKFc5P&ZUG7!9#(L%u;2<rMyNWu$4TQC1lxchpRfrP
z=l}s-?i<56z(_l4si1Cd{3t?ktOTgoza}M*&FvDKMuA+>Q!{mbCZ$rxF=94`gn^dk
zS?iIBud?L6i69ZXC<tcx*{z*o(oD^(H(IBFe&onzT%Yks02Oy*vi+0bKd*;s5Sjq*
ziX5-XH`$d0e}i8eLFF?!Tk|APALeJsUVz-Q;sZ^nmM{Yz^_nbgqWjEbKNTDWC|J9W
zK^lTnxbV7Pa0L8)vEYGKG&}4BZ$x_z-Yh2NasVrK8M2ars(ika+##9mH+3}02}4CP
z9gR5SLgw9ZL?ECW+_jK@p#Cd~e{3OYfVo|EB9l-_6AVa{P9$KK$#{oeOhEiRsx>|&
zE-tL>B^9xg*fms|`{6<9)bV8XhH6ZX#lA~P8cw1j0zOj=@W`@yLESMS15?(87dbk!
zHOLzsT{>nQ2*Oxc?I_4{-OH1_Q`(vMC#1pz4OROVyP)|(<Zs;E{xr;6T#KW2`}^N&
zxBtl>+BsLf!v2fz{sw!~q1)}>9p13D`aFBl8^6__esabijny4?%frX*<e_`*Z9liL
z7r*)y_R?=C!S1o!?ZfZ<1AFJKciJDn?d^8M%U@<Uy!JYK@v+<N1MhmDedysQykDsr
zMomY%^nRJl=cP?quHRbY@o`oX;bJ%FCHW+Mc0h$L+t}924ClG8{5sovHS6N?%*^b*
zj~q2@nA;Oa?C7a&8_j0+@Z+1@>1vf{X3_FK>z_Mp^GwF$&kfoj*|#U`=rQejuzMfx
zIn&O*^u_kg-+m=GY#4}dJ$REHKYE{i@()ki(dWF_zUq~4u;+G%?3NGyiGA><+w6hk
zU#Q%k*~yc;=ZkjppFZDEt=l=5J;$DZ`93>*<4)-UKFcn;^l5hBKxI#VT4@Cyebf$}
zn0;2Fn3wbJ`hI!N%dTQIDbH$|Kkn>iK3LheZEbtTarp7w_Yd;VtDbN`v+Ytzml>E|
zy|o8E@LTqlBhRy!z5K;xZu$b-y6;2w`+x9ZyZy0Kf2!U2<QG1pfh1(K>7Fo;rfNgQ
zB+*l-B63r`b1K=s4aB?>GbR;n?SUBVz0(8oFPJNU(ZebPGc$3nTv95C{7V!x0cpm{
zh(I)g8Uo`pQ3X8L^1ba6_ew>A=d7VXx3M~8hb%~}7hEseuRxp@CxaGTuY!bHhe#gv
zU{?wK!OXD^72^Q_ky#@vKs={NrVtI@f!Yr$vy`1zn%G@Ja;F!fOZ{;ZA0#k5mm<0Z
zD=NiW%JNmg&3Ba;DH#PGt-H+wGa=7S<SBV9LK#x(7&L>dS#=Dq#JF&2P%uW@1c`;(
zf*lhRvvnywf#)B&1QBj(mGwcBr;A#QoIeG*S@HoNe7^?q-Y5=J=3H!0N0*-sJFH3N
z`WWO~C+GoSu|}(uIjcj|b~=uVl2JkxnoFK!eox|+g0K^)L1q;av%n1)6hoDm^DdWV
zlB`mqEdfgBO)79?CUT0qfHVhA27o3DDS4;`n3g^A&UPiWT9=^$*o8PE_K`b2oS5Zp
z@}bx74Q<-WZ#cESf?L8+yx06%20IP08Rg*~v6WgrUFCx_w`2F-WS_eKtL&T4-)Hg8
zN9~cLB~ktK&)IK%`XR!7tI@PPXAl)D?T-_;+dF^tR{QYNo@Zb6E#GWk^ZGKUy7T>Z
z{PElEUH|D8yYbxX>|6hSY1O^xs6F(%kMF)|Ujln66)suZSAxmd9xD}Dv;XOK;r@jk
zIkZ)Fj17P6i(amBjpsWj?cuxcwD;Wcv-Zn>e3zY=CvL_F7%A<^OG<Te#hG*a<UJER
z|I*9t%10lwleeK2ST;CkpKk~DuG#3(9ZMS*+cVBD8=`xU{~1Wa-JsvjXLjttJMGSV
zv;E{x{c)LzwNh{ZN04Z*!*=JN{FdGJu@Bjczva8^>tAraJ^sjp_Tcg3U+|p1==qK&
zC1IXr`}Uq?2VV0gyS#j!CVS4X^GjKKVPEdm@jtS6d}{VtR6&vLKhNq8+rdL4yZnMP
zOYkdIZ<%fEDYL?h)(+VnkAl$&i2m57Yc)TcO__zBb@qOnEI#YSpK#RJY%c8aQq}(Y
zEg!V~SH9l<yB~U`-EhafcJOeSp+3cET0F8SC}2C^wSk&{sG2H@XiG^0Nrmk$5P?ge
z$2<qY9)3~)P)Lj+xQ7-Uvg9RICsr(M2eQqjc{~^}(v6j-D%FM1jUsn62)T#K&z+DX
zc}|c*3fdGT#avZwnTcT0>h-Do5hQ4UiU^4_dkc_~O~Pt0CL+d$rf1x2d%0f#bdhqS
zIXZx1Bf<Z1UYPyieDT_NO%w!eD+PIM;3=z0(FM)_dX776sgMub8041ik`-y8RSS8T
ztLznFCcs2Rh0#^HW?FDPz}hXAfmT6iZOL%8B}xQJ7bL?rstCrVDhj>G#jL}!T7URp
zGBhAlqr?PCF$#bnnGXF7MQ+i;3j$&wVbTP$>-~8ZQg0+JNAav$A?+qnt-YSg^CKmL
zEP4NqfC#lBk@L`2lnTAe=p&gqcP;zODn*%AqLORM*-WGOVmk}ji&SjKCH9RYOXWpL
zVA?qh)no5G2l{md2X_n`Zf}7CX~k5Dr0Xq8R-(hDA?!cdAQOYl1Izj(apR=olMe&!
zW1@)Qrz-+Hl!S5hW#`+Oqs~t5Ac0(F&p&6=KJ(Fs?c@Uo?VX=`fqmsGo^OvdXW9wu
zZr9JS#l1J$ZKuw&tDk$W<x^#cKiywS>7#aNXJ+-rId;jV7ukBdZQb~63!BI7*vTy-
zHkYe^+&)ugY1h2$LVNxVFR+c0IM%OtsXcRko4xhZCrVYc|Ic~!$+k+Bao1<=u*<G^
zfxYzk8+LH3JpZL7a^lg0c4~69z4Y1VT6f=j>{tJ!w^x13tL&QVj@hxJA2W6$&b`8(
z`|Rh~eC>$USG>+%G`+?C;1iF2kpxmcL#K||gSUUi?z`%Gd)Z5l+HHqs7SZR~IbwG|
zv~6ddf4-f&)|U-VWBba71L!~?`JU{`<@N8o@mK7B`MB$ehKXH#!|Uwz*R9#DZ~rZO
z&z(Deetvs*zx~NO@37~-;3f8ohZ{RMAK5jpzQ)G4z0+<it>JF}<96uq#Gd)w=h-!O
z+?um5w=2$FxBh`Y<Mqm1<E*D&V(08zv$|}8tjspI4<EMUv-U59bB}6)=CHOKn@}xg
z&h>kWCD4L{>h21#DQMFTFRq@b<KE{t<&VnCr7Z3gpdCw6EloNqNz`Q*B?$5k1SWt8
zK`O#)u12obgs?mY|DA=pJ-OAUcsdb1NualiQ2AI2jNToYX-b(j;s{=K_YS@1>jV*k
zkpyL?Td~b|V%9UM3=YmU0TeA;QILV651DJ;GSp`!8_GQmhMb+Q70cPA>I{H2B>M%e
z=w(F(iVv>`a10Z5#=2I5>L?Vd%gz|Rd8n``D-<+uA+9g#B*}`7f|gTLE2tWYesM!o
z_DoJZt{f#ny{Q2zP7kSmSvqn^XXXeRue=6*!6Z9tRC@D4B-aGMNDe`bR1s1C6J;na
zG|@9rpbQ<g_m`;#qN;_>Tz^Fg^+vw`piwv>fx2}|>fk^Op^OG%G!hG1rG#cAH#PHQ
zBEDAdXi907afjvrnATgD($&<B<HLw5PaRFS+m3GU0_3E6*Juln%sl8wx+xon#pV06
zdfkqN(~E!{M*B*;=_<Sa`m61#%b#f%>{-|YAO2(etq<N`c37MCz^!-LsXdq2^PYE|
zU3ppg{@&gW-g&znN@ce6(wEo^uD;BkeohH!kABkL@s5w%Bi)8w^TL<g^RB(Zo^jr~
zox0}}cH;+cw)-|qD|=e<+o6N@&|^pK$fNg`3MAP1S6*w^T=fh)&_84!{G)f-M;|&-
zu76{D4@~X&tvA_SN3_KUlJ2aHQ+CJ4?zUr3$Sk?tvZIgOZ(Gx+*_GE^W6!#*w9GcL
z9ewPC#r<d6+V=hS@eh97?kkDxp(DZeoiQzm=cwhUy~v)ib*tSwo7x4JU1gU{9<%qq
z<u~k|cOGXed2&Wcx(7dIH{HKog4)FPPVnA$*-^ZAn%m~lhwa{nJG<oi=i0Sbl}hET
ziM7WbwTBOPcGe}=l<Re^U3tj`wtnhP`{0cqwc8#z{@KYpj_knx-tPWrxt5Dy8|8eD
z-B!-`xK1vV^W8f>`KQhow2-#6q~{c5ozJn8K*Bt158QK~J-YeXDWaZ~Br-c}4?lF!
zPGEX&pej_hegAEC_mP<$y|*Oa_8fcm4bQV@U3x)DN*}hjz4hI8*JkP1%ud>&QYM{I
z+L2dWbe3&2xbL^xT@OEO_uu!pEyf!*F74GvAG+Tj!Hxz9)C;e)XFvBjcKwxQ)_5S;
z{U3Ut-FVA`c68^dn{y2W<cp?rJ1ZYwl5y+W$0t;K$ZQd!Wd;--g&P_dIbiUWD6PZ@
zyldhp`Kq?15<5P}Y?B3jp3&B;YuyLN(ddrLP}BgJq3Q{E5cg9$rGb8jN+Nh|g6v#6
z4%L`kIMjX?7C_V<3VdfFpINvhi73F~crf?XMNMq~k$eqQAi*1%twhAZF<U;BPCF}x
z=PVOU^gFW+qQ9yF%{|1}`lN`1$3}L>lr-52jJBLFvThyF>b(Su!#7;HH%omt^9I!3
z&N2_SGyEi^pK6sVG+cBzJ9meDTH1r4jTVw1pn-g20VXOZ+_v6BYrI5kJOGo0;2%0E
zwcD;$vtMAAm?qYB#Zom;#MdY(lBvf<c<1t=Fo$&t;fP1Oc4DxEQG9oh#TB61MhHts
zWFVD@0D?luqN7qiy<{9|iQh#T+`7gXMJxS&_pVTn-^Uy-XC=2j%YUZtbz|^-Ac_`g
z5bHIUQv}$f;(&AqJ#$oOXqAo|CjYL_{(wYExKKg9%otBi&$GMiJUe*spsm(l<*Mzv
zzxO}e-(Gu{{lag(&u%Rh-|0GjT&>Su_#B^o;DEjCtdn-7-6!;%0}f&o7|YlRsnps-
z<$;k(FT}Md%Tl!=V%h`;mp*ya+$*VdhKhz(N}XWnS%H*uc)H4C^UoyYx_xj;c9TZt
z$WCf+opZD5s5WCt8nJK|=Hd==t<Os+JdzwJu#3)py*$NC8h=tLep`vRI&|Z}aRrYO
z7EfInn>0zFxP?)pQ1jV}d_BnAp|aeb_xyRtNcAS5oT9$$OK?1EBiUu41&TzC>xQ4J
zqCje({7fg2m;jo_5JjEyQjB)lCUhe+7oU<8UI=ap(z|4mH1=?yJWp^2DDN>Z*|%af
zfioUC$11th2LYHtvi(dlS*<_37n#*j+JXXc82Jvk;6yNX+F3v|(dhdHn0!l%5+ujY
zcQ|YUIs{)x83lSXK`n{Ci;fqJwnSu&SYdWlrH8^hhvG@nB$X>);4&e>k2Q9a6xGs-
zMM#~&<PlekGr{tNA<20Eg%3K}@<FdVtpu;dY^_Uz-(wSyJ6*Sqg2Ek>qyQLtZ6GD9
zpob3V$(ge9YMm}Cn0<cu+-jZfi?d{WR%?M6lx=+GPWyPN$74ea_XvFMRS|SHnwH?b
zQ1asIGy*CJDB&F{-<V6B+`BCP*{v#Vf>Gu4op*YI_mR@j;mVX*qIFV|D+N{8lYILE
z<4|H;M&Ktx+eAQSrDwqv=#vk(yjn4LsYffZceuaFZxO%C`4`~+jT4HKs}EHY>jgy$
z$rkk;!Mjb=rBm<Fk?7fF@YpM59HZ$l<Gg#35wIsTqXXoXFHGd^nz)BvRYDt7)|o>N
z$yIRqB<v`9#}rZ@&qPulNhVoCNVarkS4|kY3EUy86t7BBa=Q`1+oR8TFjq2fJt9H&
z4(JfMIup55d;1LNoa~-4bWHaDVXlS?J#%46Btkr7RUE2bB}utG>qhgkWVszzj%@5S
zP2}%#_k@SBnXvYcMD9d6KX)CA;M%2NvV%a_x+H`@@&bo}{G0_efxUOkx@Mf4MOz+Y
z?-2Z&qQ^CTcObhpo-~~A0jY^TuWqY*nz_5`Dn_0zE7_6TKWHCWf84egtDVG`;}R%L
zaYd4>kyVGfB^sMh0i~6C1qB8Az?cx`-gb+EtRub%xG-=r1&J3}%Y_JHa3!KaCp&w^
z6#ZCA<QNNOmwTa4<p<~jv_4a3V=RhXjHDVW&8ZYy)V&heOlXWM3RO-pS_%SlWF=K3
zh*9H8L?{#*0O3031kCx6xFKkc7Z%YetLm$q8<tdjP&^p(IFlkgtG?)HbVozi8gB`I
z;IGAvKuVn1W$$v~TnVdRr0hLc&1i<dbJ%FUfe)HNr66ezWZJ6CctY&OQz&1XkrAF8
z#yxa32P<gJ#yXQgW$?@%oUx66MP(6rv~>D8CZAGIPR6xlr-Has(ZLG~mcb(;?C|$`
znRGHs>f{ezaC8zUT|sPZb4@R%55MtpBo0(zZ<ydRd!A@}qFp$u1brQnIz4Pm2^71l
zYOrky*&pOyJB>=cTZzgi-pnx-@1-+F6cLWsfhu^=A#s9ax_4T>zSDCy#@U`<GjZXv
z2-P&?ToqfV&q{XiLvOXW*lK;bE}|vfED~KMb(=J|&RJCo3=gA9FcvIOt{^`%MY>#|
zy+!DGFT^mC7Q0SB2lt9!M06+V|5e^56L>*0CTJ0c2<!X6@qDP%<v~2g>mn|$LBkaD
z$f)Fl_8K`?UC#=saoIk;q|YPpJ}%<J*g;RiN(G4$P7om&#et)&DXIWPr6}!2i8}O5
zB)CSk^L~fwk@O*sOyvC0QW{Xz8pR#5hBml%3rC_$#Un|A&y0l<3Cy*Ebl=G=xE|g}
za7alJMK6U1d~P1pHCXvL8Zb#+JyZ_fs6C6C96?)GIc|I=MA4)y4izDuO6=14v)z7d
zOV`YDa#ndVsi+S&2-i}~mPU;gIa*ZANRmNX__6XF{N8td6UdV?ReVxk4$jRIKqBPe
z!n{2Zgwd^5l8F?JBnGH@3o?~yR}{S0EbD2_si>&z*RYE{&xK;d{`2M)AX<XicT03l
zj(TX+O4W|1^U27hiE2CaLIL5ISRqz5&yN~nLshw2tF>BBdLbCge%?Dah=H&ysm)P%
z!G&^7EktaKIW@^_zg1ZVyQq5FSt7VYU^lfFeNw`%R1U)?KiMv$N}hd{^FCWg6=Tk$
z0H1g)MCy43qpnV(C;|Nwv2mu}pwGljL~6P%yEPNt*ilgqeqZE!spXi0v|I;JTJ*Wz
zqTA(e)r|Y_%<9>R0v!k*W;wfERuG{$Qr#$!!?wnbnvjjyiF1>XG)H7bg`aN*vbJLc
z+{-XWVJPZ4r~+b}3A+MXD+|3xpD9mRyqsAV*oImLWnCNSF%v5tAQC`uM4f;U1A364
zPgk2Tf1SX&P<Hs-Af;~(+F(Bufj!o&ssMDLZakUn0!2_F35ki2(_NiJse2f+J&}SI
zTt{r+WtpRZME1kCq(~vA`EDA~Gl4b%AfHU1Y!_65oF-LugV=4K9G<RAz>AKr4d)-c
z1whbBt@BHMgSnev<&<<i%P&G236)j`gtk_tMWM?OmJj%luvX2&)mp8mW(@!|CM~Dc
znE#uT4{xbyUK3pXCoL<p;q!@#sar&kS)Lpm0hS25P)vveC)+>5^0xJMVHyazZe^dP
z>o?e~V5~u&Rhu0AmKiT$GK)=d=hYR^f3%Xqc!Ge9yllM@0p1VaQ;g*-4f8VR`qI^&
zz&CZrDhI(O*JB0reoDu9%=0QLx?l-87%85h#LL9PN^=lRsJzuVATG^2VFYpXPA|&J
zFYZR|tu>i!Jz>|LJWC6%&5LOcvf$Z9wXGme6a=HkQS`2Rg_#SIB7<=7@|drYT+48m
zuTZ&pCH-r-!x418@*M$tp`8#X2=1NF*GO=yD`#)3vck!2m)~6g1=L69mzmp^csBRl
z$H)l>L{U1L5jzZgU1}PF)DJCEkdxP<m&=t<I#fEwg9Fe;Js=wscS|wr;m3I;uZXZy
zs+=+255mT5B`V1?@$)8$EIms)E<$V_#3D6+IVnr$F?h>xRdcP@YCRPT!M=+QJNGfb
zpz4vi<5w)?Jje|l`MHh41FTJ4ktj)^+p7dtHd0dwzKzxA7OlhVWMD}@Rn#)Yh+q&j
zsC`pUi~Eu>I<zJcV@WN7nve_~5j&aSVsuot0BA$p<6Oz4n>cPHDTNrcaCBqnQFTe9
zaMla*PM}CHB_lXFEIN<oy$TQ5kaV8lHM`5g5qR=r(yzQN8MC(=O)m0db>)WckrJ(_
zK9virci!p@R6K%XhKVac)JxLAU^P)t1$u9JFlGCTo>-lXCPQ38)+?gwdX<zE!PV>5
z><1>Fzi6nbk{QD9s+L%GChr{*Y3S9OsqO)*dJ@D$mr$;DM2$Ic!*7tF`QjxEvoySR
zYuYU!kxpEE7j3vo!!;$7TIU<Rb;mp$guH>>MqN!Yd?OfzY8f^N3P%>AR95Z<H&q3u
znH-UWqnedf+YOc{&fiG#6?2LRcWWc?!%(K9Edl!jlKMn+roN)-eCIT=)CY-k#6B%i
zNvpM5tM%ko^iAy`G|MrGlaT|}E;NG|vnQ}U)+6Az3ht3^=z@8p%>~z&ihu;S7BO){
z!P{k<F`K&;=iRs(1QxSiQhd}XH&uA>(PA62lm6c@79(kyNlVEEv4!*Vq{N_ckT3;I
zE&w_-;(O6b2^5=7@5AHkB_0ky7zZaL1uNE(+iPeaDmH<P4RA{1oi7D_y=Sn2YUG|^
zNy8R$y39GS-q~ZPjKGafj>nZY>A~q*3)z}zSHX+zZNubm1eo~@13;f`A#=`pS;j-g
z2g5<`A{;)Mf)XC3JZK{6EiD*JI<Xj&u{Nm{iCIwNNIkqGtF^4861_whT2a>6Gg_@^
zmV_!a)zSfrKG-843L1e?$xdc)<)pKC5%ALzurt%f1d<|D(8%I};T$+51S*n>@0o)^
zNneS0yy#V`H%<cp;*dl-6C|~waa{7sQbv~p_`|%i#1Q~aPtHQ}#1Eo$tZ4bo_9}KQ
zZbc9rNyMbggzs%kM@721>9V!CTC25MPj;yu;=J6H!ib7?;93+liZKd`@Y9XTe=CzP
zoP86|PSD8MWib!VRXvCy2wg4My>_{1{}D$}5+6`|a2F=ow{br$aL5|Pqs)S$XJv%%
z6A&H;UabPWlrfSUYG_8pF-cN|7hI*C@Pn*bmH-q0kPY-DbAVpW%{^LesZ(M@T!Q)J
zAXZ)nxwy;UP&4`7WA36CAb@;0k6Ez_?g^$gVV86b7LYc30_Te@R!^LChDN{!&_RHL
z0dg35ky@{ansOHOlc82#$D2kNd{P^aL@_GCD=4EyMqNT5T;g?lzuBt21W6y1+le}i
zuAsrWlaM3iZ{g;a7v5|a;#I}SnboA6$tVi@$^B2%AQ9P~g0~KWK>H4Qh9e5#_O?}?
zGJ1k#{T$si!Nm4{FJ5fajF><IB%R8!PN(B?e1rC3qNZaK(~nSgA%%iVPN|XuOux2W
zg$zCrCU|IYo>y=Rg$gAJ@`}7{Uh;c?ous>(Jh|+my_NTTiCpvqFGBZft=4Ki*`+q0
zR~0cVxt;)C)WZxs$cm}NZQI#N{ER|(oZKsbBTC|E=ULpV?3}4E%x)5u&#A#!$)phm
zi6{y%ZJ>RTk5PsgDWtU$4>VuVq6}HugNVzN5loVvgG?Qg2!I)pGc08@dUq*n3jG|E
zTxql$q@y^UAjV{;_^8dO>at(zrp6FG$*KxP9KuYCRHlBIS?TzJ8Q|Ql3lvs}5DKq^
zT4a|9QdHh~q8=f;caohFcQ$h#C<l9q@75&x4iP&zk`6LU*xkFy7v2J;BAt6{LB4yo
z&myf$l2=f?x0pdufHW+XF|zLfI&t{C0&x-_GrV-XXjtiFIQ~%*MDzq9&9E%HsSLJt
zLvcr>@Cy2Y0B<-v5k1kZzU7<Z!p*ZwqM!uFg^3W;?Zl-butN`FOnL}f?u6t6LsE7p
z6HN>j*VifnKDK)i?ofFyO1(aXrXn6zK-q!hiGGnQBvB<alJA0&5Ttd|KswA|qIc}+
z*7Zm`E=aAE*TuD)WA;~RcLH6n&fAhQhEvJrGu+i$t<`!87HKn4NM4}pQ00tWC0<Sy
z6=&JKQ);LvRHD;_HamiJr{KD-=-@PxLuv)<lSExq!XcbIs?+62dnQ2Gh79fz+Q6!9
zxmXA+F_~nV=+f3`p-Qjf>>cBjg$fazOj4Y|ENjvPM`tTRG6ut{WD$6N<Eb1s0OUY?
zBjOo8Wb?qdH(g7dP2qJqM=^2(UH&(jR%)B#^%$rdQky0X)r39amG8~Xr38)Ulqq{0
zbb)nf64sSQN0|L>EqYd-h<`v=PHU+Waj6P$NW44v3PPSai(>NWC1FGjLCE`iy&OxH
z2J3kgYX0ubW$5V+9D);z%?3;&s)|J(N?Q{T3DEfgA?HAaK^7mcF>>E}%0rcGuuaUS
zAnKeGVaH*S0E#Yn;`LrID$2%5d9B4I$^~U7h{WsQq?Ma8_bF%``mIs?f=EVqNtR{n
z&?XHQ;ljLL{@rkD8a?@|8iF8b%c`-=smcXMDb2;6t*#6H3(nsfWTwQMfWoxUJ<(zB
zr~o@UEKAKqLrN*^H-gttjoH2ks_?9{&aypwHf*(4Yqd%+p3UviM<4yX-xJW+Ra>*r
zfYJz51;jR&cTc<^DzE3Cf9qZGrzE9DNI-7xX<=WnI)VB;+Iv0Ku`BvdN!m`8o{W@*
z)FuM2bNG3Q4dYs3+qLj?YzcNm>-9^t9|sJzzK_udIArkJB0;)R_0|!HAv)7Y4K!LO
zQQpewLY3<&0=A7!KaK;(HXfA(w%wIPS7KesQh>_OW)+dr*ytmX*5lSC>?B$dhGf*q
z!JVi^AD0jXZo8<>x&ie_V;mF#ZB~mBDnq%S%fX&OHcNA>_HvX-gHj?&9s^=8G3c73
z4W0GOssKmUJ89Rb`d+!GM{=}@NWIZ#M=D`K8pa$d<zf1hT^u(ocQZh<j9guqI#yX3
z8}Q2cq9yDz)4N4G338_fxVXO#P>)Dpt)mEu7IGgjR9~Ea`M-570(V2SXF<7J4aShA
zEzl20Ng*V$Yv9qrPo_<**l>k72TMjE1qES(<fpKr3uh9rVVbGo7(f~%Ew9q7Zo8Zx
z2ceZvHk4kmU8@t!|KL&6RBDZWA*t-Gt<Caq?bvFq)@o^!_-8F*9DJTWm?=v902|=Q
zjU{52H2jnpV&%VFx*!PN6qNwLtrJ~_4Xs{sZev*AXW1PoN)AdBZeHnLUGAgd>K#UX
zL#qS=0auD(kn-wlYv}we7$;?3We&NQDWkw8<(MaesrNa%5{TwfJOZzLI4?shv_iGy
zVz=&-1rgqzx%5#t)+J>HP)c@)JI)wiYf7aV$x%w0>t~UaQ3OrKfpC7L1?m-|eaP;U
zC{9#@??fY_)f0RdJ8^>9xk~7IIploc4-6TbkaXef_{AoOfz99<C1=k$O{L6CB3+V~
zRSR|X+Qn$exb8S~!+n*(W8y2<&YDe5ZbNm$VP6z1J^KTL_Ztxy;yi^Q%`h7*u>sHQ
z1u)@Gh)Gq6w>G^_XWp*tB##7y51^SyDqR>5GQ%*?=Uq;&Ks5t>#08bzON9miNUmgF
znN+UR>xSF3#5q*r98ZWJGkpMp?{ac}!k{+?M<n+0JgX$^%YOstK~{cGWao%pWNKR`
zw>Y5@U6g`G_eGo}vBO-g)mp7DzCsvgOaso^b@Q@%BLf;*@v@irLUgaZRI%citk*UJ
zasv|_aJ(ARyvgLG!I^jEbe$wrFy-eQxq!_nl0n(KGM*yV%}dL!84W=_IUh=d;>wkE
z3As1poC+1<pu0F3v46&MW2?;p6^!!3{49BbLYzgTs56&=f}y4o505$N`0+guk9(5S
zRPkX3h-8WHp%|#E5}g3%z;zo%xjFYvO!lPM_QDfTtJXIFFeV5-(?eW^eG8C_jJHCX
z=)?pwm!70F_oRkS-xbQ?2VP)7+RYUk)R*mp4xmddq2;Osgc7WSI7m<nPQ89#9#%%r
z8!TRYT&$7UZ}XnmLf6bH$2RZ1tn8(t!D_80Y_f$3BcH9vDsQKqv#ka&11qmAPFPE%
zi_SN?p(I;<rsEWUN{-B}w<#A%V!fwkrTmR9Z<X}Gq1{<g&r!mXmR0FZ8;Sl_KJd&z
z8jC<*t`D{a<r=|4iR0N^Ig4IB?71TiyWs(@C2Yyx%!2B|Zrh@el60ib-mh4#)mp75
zy*O*HBoGU998to(P{9byeM;`0F5>a1j1BrWac+c|SX1%5<z^I{{akyp0y4SPMsr*{
zPc{z%2DVHhoQ-wEEZc10x{wm%8i<^4XTkAl5J|fy&D{GAGr69dcAUd(AvB{BqELiH
z>+x$+tRUeT=w<kckv^m<vYokVBgA?GDydFHV4w=ypmSYxQmSwD+H)#|8)*X6nZ<kx
zF!l;?`(C0Bb#%f(PeV%OJ#EBibBuh<)+g{8>&v-F;}9tFrhF};bp=qu$dpOilwHnf
zpmIBSB5;3T5;t*wm2w3D96-_<hbX&xsw5{@+z<=8ak(a4ssRjAPF9Zt+jmF~Yn2in
zD_2*A$FAlS?RZAzJu2}JvJ5L{<-y1zfNR&n0G@2`Xhg)KfFWwHP0K?v9Ywa(pyP$=
z4N(6@?}*2sRw%_Y9bK87u#AUzj0}q1Q+CZkl&whSXdPg-hD7aBPBPQfEn(d$6sT<h
z=7~BpHbfrvuArY&axX8bJ*!1(Ea3%>QPs(Ac+^8Ssf~64faoKc<G;#QYqeJEDOo|S
zL?i^NJtWPQY3<axMN+V(yqi`cKw^8_WaE(rzLRl;&`Ie)BaARAv8N#qYf?%ZU<brM
z4U9RM%@5A>0m?zHm_aGHg&dRTv&=YxB4cAs_9P@B14-DlY*iv;1y)Oes74BZmv2b)
zA&FbYK3-;Q1-L|TXC0}yUcEFEO@+o{rmh?CZ<x`eS5%1<%hwo}I6H+PFsn->a8+3p
z9V(e^ii(T{PbbuPFR4I40qUrTHyKA(a?CijKz2xe8)InF_QQOSY$*-PP)1_l@5E!4
zoF-2zIvP8yyN(T$90d<6mBK{BVK##cj#3&KwWr^&cvO}hT%h30OGCj&)5#-HCkfMH
z9yJ|}ZL8FWct^GZF`SE1te9u9(ko&rGZiMFUYw)(9L;IM6sFvrmt{vNBEfd(Fb9|J
z_hiwTS2<aNw%7<@XT+Z`4;zNBV^)$q2ZkdjG~?l>dPX@03_+=eOro$5f>LkRhhZnn
zq;g6~DeMUvIxS1kQqWaAFdL=%L{)~l*R*Mvl<|A>UNgz2a;p`fF9+wk6|``*R_jSG
z>6)6%5=Wxh;Pboar6USZ6qMn^U=j&o+rD&hN*nL2>4@|p%$v{}t09B5z@~h`Bm$Ay
z1uB$UZW}P{tQ`CydYAk8p*s^)WdNoQv2lqbG;|COjjEfqNoH)MxNcJIHZQNge_GzB
zkwQ<(GMFTo%ezbHNa1_UNJ$uGwdgh_Zyyq(Uhi5o4f1{HAOUCr$K^%IUf{Aafky#5
zP-Wp{MwOHmNMPng5_gP-BDD~NZ6_)e&T}>w?~B*XIblE*GRb1DN7W?!xj<ZwnyWAv
zE6am-)I*oA65fqTD=XmR#4s$IFC<i(dx=Woz`>DPbN?;!kxE7#^C?jF?49h3MORTO
z5QC?MDzD=O-&c~=4(e?X<+|31Z-TUsP#M808!f>3+~rTodydQPUq}@hdWAa>w=J&-
z{+0|Z6Xl*z8Pb9vBQXN5E(_|RUyI~4tzaYFa_*H}!wXGR`emVZD-YxxAP%=M;mDH&
zKrzeFAV&YTii5><cA2w8Kn6BTlve3Q@Dp+~k?SyPd#^%`fD>HfG0=li1J|ZD?}?Y2
zhyJpE$fEbkF@xkVZ?#rywVu?HPGE+SG-pOw0#W;1s&AJXe~4pL*RaeMeh)yEp~}kS
zL~U=UT?P2^8sjl&Ek24^WLMtt@rxr12fHV{$7md=3ELw{(3Cn5p@?}4WbGDZj8QfE
zd7uM1o5DuBtNeX4fovS#xLwqEEE%UcT5?^dN-WCO1mBZ-Mf76{+L)IrXlo{J7^)~#
zk+55ebICFB92#xBXH?49?4JcsP_@U-R`eEGR-CjZG1igy<!T)$p4LXD@eYV&PzWjS
zJAoHs`CdI3E27|IR&?FFNJR^gf5)XFU}l}GD#L9YX{cnvb!Gw*&KONgJIuBEkd?EN
z2IA?w>^6wg_xag?8blVKRPtLvvVz|WP<bG$H8e!)ZQuI39pBt4Co&?W{6wk3&<@1=
zEQq=*iLv|}{DHRIQIy$6M`WRE@Q3Oz4J9E!i45NQ3=ROFfm4>d&Q06oNDA)4PKw-d
zp`zN_>Fw-2Bik(3VpOh6>gE)~U8I`r$Gwd?I<WlyBC$6+AqTEvPq&&am=tltz>V9Q
z%j^vXbTukQB*7%q5h^XbZ(GiBIvz=#gV5KWL(i>N?=^0;DVTSw8P{s9)>E-$_Gr#6
z5=W-@DgZ=b>5UIMp~;S(C~;&2eklmH0*h6pLj&|2VjYlp5TPZUJPRoe*Wgiu<k6F#
z$(dCrk}o!=sOH)ovu%1|X_MPf1CiV$TPr;`1a($LC5Avlu%%~T<%mYPGH*--<U+ep
z$VmJghjE&p+b+DHXve<eF+i4yv@^`$aXm`VpP(dYDYoaZ`Kr9G@qE@MQ+X7!^Ojf$
zp@5<8Anc+_JY1VpjtYksqc-O#oW^71ugEI4uH;9Ee3hJl43NpZR1$Na@z>dTR(O+H
zr|o(y0Tk^kwC<1?(qh5EUNaq+7jCI;j5c1kJ!g`^3~NE+*iH$eAkfxI0?3xgg;mW&
zM3{G!N_y>p5VZ0r<%Ahjs1<-I?AT~X2^plFZC<EZ*>2QHH+ws^Y}GYUW@MZ51?NN{
zCf8Bomn})i!Rv3FnG)(cxL@qy$^dc{e7;u>W+xBu^2WyaJG24;<19CGUfyHR+K5S<
z$VTuq@TzW^67ler^PT9qqQnVE%&k{pi|y8#@R1J=sxM3nk(_clUnxPCU0S2oC`xE3
z<4;D~A8aiWUlR$l?X@A`(6Ssy?>=6uwOXt7<X3cl7KLm_`h1U?;6})5VKqM5s>;^4
zZaQ+T5Rm6vkdp&+y>}F`VismT08VJ`uer@)-nqXXWpcP#7bZ&;2$BMJ`vj;tLJ-v;
zUJn6qUN*kX9+8>Z-BImf^Gy{sfX`zVh9tR|3&AK|!dfQ3zIm^r!`8vm?G!eFBAjmn
z10XNL*>-1}rFz`Ici}W4<cHbPU4DCOhsQ~y+mhsFJHn;6S#x?;rCm>#j^3g0IGzz+
zs{!snMG<u(gD6udIVpd~UoaLc9pLa00G~i$zZ@o1JTM*$j%q0htRwtdGDA|a2kCfD
z<%+r_p_6%GbJ#OiBckl^!fTK}F(g3EhAP76jUWonwg}V__i0dwmos$5-mPFE08&&O
z-c=+i3+*Vyb|C`CQ2{@7+2Ndml8pHNw&XeGD5VVCs4*3WJI>;8Oh{^DIC^^j7alPa
zhq>?c>Zii1YaG=Uz#60KDc|1!lCdPtow;$xf)g7D<wkgfO_1bqjiIGT&9dMY0AZ<Q
zzdm-p9CmF%H@EAZ_*jl}IvEqGg9ap;sK+o6g$7tjf;;5`13igeIrS64#e-*AZL76f
ztMwEtQcuDC9OtDURdToDdZZs9@2aT;-^MJu#DmG6ilc?TPc8~xF#*sdHY!2P3CKX3
zP%?5OM;8VMU<p7Nr16)`=`R9iVH`nTR*QLh$7+U5t`eu)vayG2I;yS`K5V*Ps<lm^
zpCxKL8mYn=xMJW+H7pQFFk>=;V>e<HiM}wRq#eqxrOI@Sic{{(0F)rsEwVUgXj4*6
zDXS|4@!jAG7gV|L(Dtm@?E<tN@cgkGW3rm9E4E>SD>x#K)Ab!xsRfFFj^mQ96chCX
zre;|zCqdNJYmE+MU?^q3R6B!7boaC*Y=4)fpaFXm;`)=^H_0;yD!0iA%bn|VmA?<5
z0;2c=cN!A}<)FUrq+I+u^@7Tmq&iAc9tMD+E=^~_!Alib{?|o08LyQafHoj_6X@fT
zHEzL`H`L$Nk|=Nkk^ozWtrCj&mFMMk+gx)Nh6g8!?odt_;E0Ypqa&Mbc?fF4{Q*X&
zUSSsDxHSP>aE?f<5~h?d7}b`uk{7DFkX<a-RZEoEjCS0;D`CW(U7e%0ZL|nYyCN~{
z1BbK?6g-+<+_n`sW3^W6NiX_ml|SoVgxu_+2l(7mcwmGd2qY9+BV9f4sxTi%=$)=t
ze2tx%T6^22<(H>w6L#pf;I&;2ir|Y%A6yn*_|F|K5Pwj)AxzG8I(3hn?2K+1P<^O`
zq_tYJBSv+N()K~4s&VCa{OryafM7~OfuIw0ev&t(@U@zw3Zo2Oa(WMb7u})lGE19I
zC#8UCZDWddBi^fYistzGh;eU@?2WiuH*9^*Ay3s;L|c=8h8WcaiSbshZ)Jm8Q7h&A
zATC<Ou&&DF0gpzqdBWGbQuWoaj<2cGP_khbmLv(<;)>|fz6vhjn%tjdu(n3k)Ho{|
zSG+SP2n4AKcg{axD=oP6Nm5xlC@-Tb!X{?nWp(9Qm;eZKiF?4kfrvrLii)uOdu`mX
zJqEtSyzDkQLd6BRV3PFYNDmk%6cU<FG)w1jR->8)5Ry}p<r-FGcwe9+vAd93`<#iR
zDch|*D6eo+$`9h<qvjzMJ9-UuD=ECw{TYCaB==7qOO})j=22=#paQM<utooRA}zt(
z%SIA0)Rc_6$&`&M=MB9?v{EUd5^V*}I9*q0Y|mNyESx%GC+B~TIV7khWxEX6aJ#c<
zJMC(A`Io(-3wAe6X3#VjgGKB@MKhfQ$~naW^;ZeBflVji<B8Hx;AeIv;RIXXkX><K
zGQj>lifx(Ql+4*vP9pUp5mJ<()jT`6<{{=-lZoPI&t&H+@~F3ft{xFy&G-hAGO9at
z%x2q}?KRBCCQ~7&MZDGAKUOL@9RIGpej|ycff`yhY6~KXBW?mQIolQleonP^T&GUm
zIwY-<+;M!sfgrxp>csW_y17*43D9u6td61z#($5;a*9TB2S5;s3Y!87_ge1=`10OY
z9hkmZNkxN3^*}|4#Y!&u#CC3_Qni)}2`iCiU=M{|L&!E~7gUt|5^oNNkGAaZ0%A^J
zLHRmeG#xz%Bnl+$`=Ii<r30E0SEw5)%@aVuQm!OCwFe1hCj{N+O^|6qB5K@bMd^$S
z$Bn8>24%(sBSavEinXBj0qsMTz7?UIi2#st|4U1>;%tqlokjW+=wFwWd<F^zLkg=G
zsg4ZeTB5!|KosWHUZ}?G*9^jzBZ4$K?(XLEj$j#x_@?3EGO1`FM@?Zb1I7DteA{ua
zJ)Sr0)TvW;daZJ=C+oI%-#**7caQDevr&e$qjC=hwB}#tp-k+Ia}U_QQTg!AyWRIL
z$ztt{b8I8-5DoSPU!rVo8sc#WR)3j8ZtS)FXYRLs8|${QzEJ{O`DEmlNLQ;aw6FU|
zKWHzU-(q(@wnd7>7k-1<&U)qz_QrqkeRk=w_t|G2ZEdywau(v#`r4X3eLAxX>SLTO
z%gtDD?*#>DC6yGC5WNIPFeb{LB=s60be+0P7)hwHB(2imjjS$7;FjT_axA<F2`Ka0
z#EOYtSV@8qL=zHJAq9C2#MHP#h0`u7Rfvp5EN`^=b!CpWRSOhC57`yZhsiie*KRgh
z%SVI<+Al<VLL8j$^lVk4Dnb_wmxDmFTGSpk=*$Q<qq}oZ90Zh~vQ7%y;;&{=l}zvu
zZ>c7A=(<d`C6KD6z0eTRzCDu{R~?<88=S!%1_CTA0ax*L-c@jFGJ2Xo@DcOxg18}d
zOCW@l*wuDK(Cz6X)0UtwkzUTDIHywO(-E$om<*`NSAsTn9(8DVfuO+!Km`zggk@qL
z1t}D8Ac&mtY6*!5V!iHngZWSIu5EeXNT?`g50gY*pn7`WD<ElN2Z0I)<Z4ux055he
z`^Y0aY!u^ludl3DXxlABOh!@%0;h5=MxSNfV%j;iDY*xkI<06=QbvUn$*^SOhqT~q
z3pa3FZuq<mK$FiLw`PiZKpKv@UFitW*coiTPrFqT_4G`;_EleHuXxVocF}>o<=&Nh
zTB?sn?z+j|``(Y(tq&h1@Z>LL)z{m1{`fz%SDbi<{h$Bx*X@1x9P#9}$G-ai_0R2!
zcl<Z@zrK6RzR>xM&brvHzj&{0-glGT`ZzwR7ur{U|9@lOaKm|)AAj6Vm4t|v^YOdi
zXTS5d8|}8o4%v;r@{3kIeAqS@tLo{?VO2h(*JMO#0H1Hf1H=*}jX`Y(&^^qQD3aX@
zAOSEJKC@KU=sR{p0O!u+e@Rveo7cKla1H~4ED8xtz1Dh=dJ?j(a(}Gg(o!{@)3sd&
z7y_#9YipVA#Y{MPQL41cZAskJw-)b=Gp)*1l1$(S=`rfx$wxyJ=VjXqSEanrRG<>X
zG*p_Ycg3L+tKgimxg%6LH|`V+HyUbg&yp8J$}PM$HV6;voB*NM*rX>24QE#M5`jRw
zbUp+8zT$?ru3a)8=s+k1W7wBn`JoAN?L_iHyN-d?q|Q#}cHb{0I_UiZkOu^9YgHbA
zapJ<t#BA`EQQM9!yCi)-f;8Bss|C#`s?U=pZW!i2m2Tb)C3r10S(c?ilTjMC*{(Mi
z=23D2$V){Edd`?yl;c|DY78iG{^LP^3u^Izv~pgF)?FYUY^Nj&BoiualzG<zb_9@j
z0@M=~7I|Wkgg#y?Y7H81oVh0Bbfg^#4b@<{NvRY4?yQxd?>G+0H4}l9omN2IM{lkA
z=uQr+tuxQrnzYkz#uY|(;JP>1x4-@}d-wxyx1agh&)5T}vh9E73+(Iv&bQg$+t=Fv
z^~*QfokxOQ^sMtOAKJ9Z*=O21%<^U@?2!i_vLic*>H(wm{dVqoXWQOV_V)8lJ9g+X
zJ9K<*qy6XD85<KDp(V1u*QT%|KXud&J$}TFZMC0U(e=me_{K}^>tBA8efq(pcJ%X9
zSfLu(+P<^xymR-L%Dde6?GyI+qa`V&4ZHk?SKC)!zsDZ=SZPn+R*vB)9+u<wso!~<
z{oZfC-|pOAv-6+#Ci`!{=hgO-+wZYQjy!DLY;JXldZRLr=+1biUAcD59+>a9r=7dk
z;<0<|GY`#d&v{R?ryW=;8>O-tIcvjKSew7Pg(pJ(Rzu;TY6?VPjB!xKjGA8YC9C^}
z1Oc&ZDzFobCVfMx;|$G`;dAW1UO{TOoON}Qf@>P-nWEaNq6`@E-jtu>Fi7qjhz&{r
zLNNn;fqgoViCyo4z<`lMsohb7ARFU-QXX_tZE355N+|p2XaHFR9|x5jSbn!uJxx#5
zcEtR(X~ofz;%y`vv8sG-=bL&awya`7Djk|1B8lUBU2m?kWCVX8QBpkwNgEX#D!sAL
z-}MCO@zU{XTp6E6X{;tP+fEditcJFiW<}Jz@-h$=Nvc$GA}kPC(aCO}2$-eXu-SS5
zfTDNUxvH?a8#D%Q;i0m?Yzfs8cwBTG?j-Ahi!y>rM=K^e`D5S&Bw0G+0T@xUuVUhX
z$_LUoJHCVl0U_wAAe%!!WtCm|;1TUalBEIqz|9T1m@|M#It*MpR(!FX-+Ck71Cw+X
zU#s_o(qwTk2-Kkci*^?a9#^^eDK0q^Kpi!WxEi>=Q|D92b1bUYjU7uZJwg!i$h|<-
z)~Kz@7Gv=1ID9ZpvlW{2?71(#%G#UXZol`gkJ&v(l}H}F<=yrRzjTrPum8iV?S^-J
z((XKdp1tXx{;=(P`+IHvj7#kd_!?~;vAf>)oAzt(d(irgbM4BPzRuq8l1uHZvH{pW
z@{ry2nUC7r-}xz9d-hk_*S+Lfc3|<a*}e;HPkFKzk9^AB^^W)2`)+=S+K->L@<Ds=
zTOYUQzU~e7wKv^i|MBKypEDX<Kl>7U;cLIjUU}8oHZ9NDv4`%kTR!n2yZPu@cI~y-
z*!9=%vuBj#viHpQ+q>U)|7ZPf>UQkt0}t6_r=DRwHgWX@_VxepM{NIF-fTbpfgPK?
z<R94o^5UEA-`#btz4X#Gd;G><u?Nb}eCyx)I(yc7sn#}++o`g<oRr<|ZMIr}6^kOX
zKK~gY<U|e6gU^_ImwpOM<R6mI&RpOODr+n{3f&sHvb)X`sJ^uM&fMVoXh{`LC5jNc
zFcee}EPQY%mcmBV>?a6FK_PE<OkQ+mgA;nS)PVCbiPU_RXfaP}28Bc?5MwIis`W#%
zO+MN{!rLwx8*Oq_lzdNkAc8yAi8G69LTy>Ff&mu6v!A56gbg~}Hgfj&bOB=?XY}d{
ziMYi1Hc5VOuyfhkmYXyHAxP%aX;Z4llw2cA_R=AG+tA2*;trt?vZ%*yfJ){;QcY}C
zfs51$#!keb_b>tRtXk<33PI<P(wto2RzZ70O)pe$tw?f}+KJhbCp1|^^+InP@Vw@n
z8-YFD5n`&Dl0<yfY8yZpAoby4shChIUJSzS*_!OxTEsD{iW(FsBp5j=wSSGd77Wvp
zW?DG65r(ne5~MMtX?UmvEORyK9I8j1{dqwWgI`(e^EvLhyxPppr$D)l-ZFfB*apbz
zadIa_W_y-|mFp@Fnufupp89+mrmj8b+XZK~_VCSz?9}EHW=i1Y-Sru}qkXMC<7ws7
za(nqwb&*~F^hfLme(aa*$mo1~&R73^``&N+YWu_|e$kFy@?3lES6*%>-}Z0p|NiLQ
zE`Q}4?6uE*r9J1)yX?-gDLC`IGc0`KkL}<5>z}ccXTHS#PN{aTzT!T+`SyqHvDu%#
zE~O28``heS_I{6j|KI*9`}jZqb-U&G6Te+%9M`|fUjOW1@BOzwX74z-ZZCi1o9sm|
ze~~@@^KZ3}eBeeqZ#K1?-}X!Pj(f1pyx1-)&*u7B7ucm&UuSEJshxAp^X#0XciYDv
zIBKWby?^TcgYCKQm3I9n{+0b7KYELutk1CPzU>F>)zc5#|NlpS&F)I)*|WduJM6oz
ztX7HZuV_(=p%%KDF!m~YFpVaQd9NNipABIX-wEQ4N@6x^8F+&WlrP+aDmZ$$8!&7R
zT3~gCxY4W2gs-)13CRhAuJcj)ujZXAk(7E>JaC>s;_!|ZgFaySt%?T0?WHXkLUi<a
zBu9%zz1cw_?p`q{cyJcSv0i4<fB*!goDw)(YL_y8jU-Kk&32FKE>#jJ4{8Z2Ob54m
z67Y{PHwwj0c`f*cjddOSEF>c<Er698Z>47N(OPl5I=2L=hAAE4<39Te8pNTZ!B7mp
z4+V=6ucl1RSaH;qi^e)cA!&w%mRfWG!d$W$BHWo+Td1&h$_xwrWB7HgvFuE|$m}0`
zIgA^B0%llI5>*WBM*0Ma!>!wSW+aCc-EBE9VelzSm@-yMtf9<{0L@&u1PYG{4@V_4
zG^pIex2E=F204EqFeUvV-We@df-G2gS$)RGinCU0l!MDCf*s5^@hno69_NV`EfPNn
zSWynCAS41&<CjW1pI$r(erTe!B-v7^WEErn!1bqN$%X3~(^5j`vsRhqwQVI2A+Bxv
z)Vtqfk8HQLIC04Cyz%4q;GV1O@~59+XIy-hU435pk+sY1B`?0#E-5X%Gd9j-D-X}<
z&ck=x?YG@#kC$g;=dt_jp`)dhI~^0j^tlTk{4Klrw|>EXuYa|D_qUWJGwd`8B-yYF
zuDIGRE^U#~#m}>szxX=4;EesYvG4rS+8cfT^9&O^=gQ~V%f9mU_J-Ggg}vm`b(<kk
z!~SPLIz3_KqaU`ny!Dgz_%`HvO7-@PGwk7yyvJ@kz9{p*$LxWdKVmmO{>4xntMwPP
z7+XpZS<DmLZWsYja5qUa6{54Wq=y@Cqj5_E5nFgzft-}0w*=*$JaT&!Ao0jg3XD4B
zuzItPpY23GRq{X`oKI#;C3<qCT7kK!8H;g2at>(LJc!dcY|MS+Kq)5gBAIEd!}$_`
zV`$eo5xA<&?OIHNw>1w^v$iPfDnuN-KYj?KeRQOz6ZsBy9cW6ij6L+3A61<T{|0%V
zC3W;zU_@XV<UGGfvYSH5*Dj={#7#ofF(Q@%OCc*5@z`p4YbD2Zh+~9kNM;vy`=(${
zd8W4axr!|17s$Rr)srCM6-z@TkwD~KO?#5yRTd%MGOTeGjmQ>S?dFff<wX~|&nmwm
zZA73&xp+JH{l0f$Taovy69){y2mXF`12~`Eu{~(ng?zKSiW(v0cpW@4bT#HgQlvqY
z`LK%~)$(MP$Yr@sIB%R&i&m%jS(KFOmHaxwKeZ#17-pclF{`OyA`t=w>A(@zWJ!E4
z^04t5Xam$D2;#1^ZuExV126^e2?8>%CwLnnY8cA?@#hJUf8}fIxE<SU?27aDkT;@j
zBvwffXI^OMubs5Vj|@IxKI}EmAykjnMgoY^Qq$P^S6yQhM{pgv`;&Ih;hEWaKueW?
zzgR5aHt$kIzQD2FWxw-F@3iZG=uP(ZH~kwsnU{ygXP^w*?6PaF)n_4`wEJ(q-R?cn
z1IO{XD{tDpfAW6LxNbjHl|u9R_P2iUJM48YxyK&(z2l$z<0p^Wv1MMWh+b<;E5@7b
z<=7YYgwt8AzvP8@L2szq69zW!&VR~JFlr1OWk@Hq<G@~0OTkAePyzyPDGX>jwg>Th
ziAhWX3}``mymdQtY=y_8ES{KutXZK2X`k}Hpl%Q1PfX%x4YnxkfYs8wqdL6i9|Vug
zI#p>F^;r`E*~cA3D|)hYa&a{PF|tU~L@<`ut9#{(oo&d~Ay#)F29y4y>PVftOpdGQ
z0==taXg;TSE8dri0N9x@ftp&c5c7o^Jdxo^6&^McHTsg3OLp*$H~|!ymAi{d<S>+y
z(3T1gvY2(^RmqSnQ|B-R@w|e=Uy!gcyUA{nI9z=KByb~fQJCy@VUhzHF*q4l<l&Bb
zi6k*c0UpLa<)giHCD=Ue1%eU<MIr@vk>O-;^<|$&fnZl<$)r%P60^EEXe&z99j$_t
zRl2h(H6akO<A~#O4N7Fe1JQeXupVUi!*FBdrA5_yZyTa|iiFEYs$JwD&`8f~qFI(G
zBVx|OdS%+^LB_6csJN)?;V@miC!Tl6OWA3*NzXeE+iiCowU<2a1@_##AGfW~94xJ~
z%EtT7vuj@a5_{UwPuM%}9Z-CwMfa>rZO=z;v#ol=4qWm~JEwiv-gjuzPVG5p4;<RI
z5B}EA+dJ+*Wo>9EeP!*;&P65mCACSDZQb^}_KWYj)_(X~U(aqOR^QI;@q=YXwRXF`
z?H7LE?mRZ9Tmr2s%3m+I0LmpJ8;{52>3ojT7BuE&TkOqO<B3hj@$+1myi8JEd&&+y
zzGJVt<Z?T6e8i52y>`ag7utDygWYYb^;fYttBJ#GMja%g@q(%lf*TzE%|O0n|EuL+
zMO8#HNY)gK@a`b@UlN8*z=b~Vwi^dS$JR9qaUfmi11?k2fJ|%cmL=qiHtxseydr`g
z(25F5762DyCuMPd)bF+^Nk_?QAI5>k<W-vW8vih_brLGCqvI1Sioo0{ZsT=grJmoU
zmL{znoP#=bUcKQpS}#g!`if;HZJ;707$P+LbfV7;Of;G7vP64hABcCT`>eoAGH`Hr
zW51xa>QgxgqiSLj670Qpbq&sVP&W1&pw*u3nfX0=D3N8B)t&2BH9>7I&Vu+9@Tgf9
znnN=wiG*?%$VQ0JVz&}qUO&m&J`G&2pprXzf{-{Sel9umUSNJ!ms!X^AZO$ttU)Ff
zFrXb6w0i+#yY|WudWJP|Ub;aPVhT!r8?YO2vNPTtemQ#ZE6(SD_+xt$$AoquDm({_
zL`Oa1;his_bU#v2Qr>%ktq<mJjf#FE5TgdGiN0ZpNE{-I2#q}rdxhzQ-SwgO+DD%L
z27B&nzRu3R^kF-)UGB-5PqVA9O7_v;eusVX$c}!tY)sZJev!TAH5b@ywAU`W_Ix|}
z;kVnZhfbDi`{VYJ`@Yd`_}Z_r>dqt9!jj?CA-nD7PuY`NY0GYX+ppL=ulpf;<1?b&
zglBiLZTEfhBX-M`FR`!rx@5OKwnf*0t-}x6?Vq~awoV+e&3J`f_2RFvQ=?n#&IfSA
z&?<bcz3eNd_RLwd$-ZaUGx9@r$GwN_#P%2BVU=LAbKGwI(1-2FH@?Qc@vArNfm6x$
zJmcxMKc0@g-@h3P$*M~Nrm?u<|5Lk=BLW+emmJpF`ma^dkPhYZFrolirOCa5-d+}b
z-k&-07@)$@(RG9Ei23)~q{?221UG#&iKA1Hmd?!4d4*9`8D{luNiLI2$RT1eH~Hmd
z#}g$92--F-H-%OmO)*v0DV8NC?3%k+I8qUC{(uV6U$>&Rs+$pehp6ubAj4P3gi4DR
z<zAKo$axhLd`^~<xN__o=HO}|K#|K65&*i!E8psx1EV(!zwbyCVz?#$R7V~5Fw7H4
z*5&>U<>#oh%@(d!;nh}9D{$;e8~l3k-9!!y<h^so#Dh@w#@AR*SFRv$Y8j%3Tl?Qp
z0Z!=nD-l{rk?7(EA9z-NE^)B7?<K5TEg?3N*2hDT{0NcI(y~F-7^qUSa-sH=9rnnF
zovZ-8*POF@vlAc<edi?2#7N?FKO}7qOqCqDc?xL&_ULOt<Y#UHD*tdq8AuLWxyeYp
zH}1T8kqBi-r(GV|`ju>CPK6CSd>RsvyUoY!o_im$<E7GC+q>WP?wOdKddO~i*YDXM
zed1x;Vh{OTd+|5F(2oD^Z`(s_7utdKXeaNw(SGj_KV}Dax)R(^*uncAwo~<fJNN7|
zZz?xtR_0(2A1qbeBHR4LWA^aF2kr1?=Y7Vx9Xt4dJ@nYI&nEnG=6uQ?y6s+jY+HaJ
zTO2OOcgoWC1NP}p-)avYZ*5kR;(ZSsx3Kqs9XNBZO~S%XKK`gZT3+wi$&+?!Clh)<
z>Q36x!-vcKwP#zinSg-2W_5eWZvW7`?fsv;-wqQMHM7U=yu%(kwh#s6$UXL{yAE?k
zi%rVTp?mF~W5Lck`%K%Y7IyrBPuWL5^`JfS;JtQebEV_;m$e20@-z1=?A&<V&1JPw
zuPc#yquW3ULhg|AC=WnH5up3X&+OeL*=#wsP#e!N_P*h)o8b5YcQ&pBq!|1umqkTT
z!XYoVmyTiMo?M8HRD|zUBmlNg>Aonu0$PrANDe|l25)=fxFrFlBuIgT$^iyJ2?Wmd
zeTid0Ard4~DUMYhv#7b)Yvg2u@opo>V$1`9>ZaFVEieY%szP?erG$V9WHGfZ`vC=>
z5&<CQ9W>gY2nTQB+n%+-PDdwOUnYs6AImK02}kWaC-rI*LB$BPvM7LS*+D3oz>Uvh
zM?0qhC(^raR`8)C4HhZ;rJE(fo(O-Pzh~oBVDiMp>ZD8tLC6h&m_x-K2pK4*`y?~D
zx;havNDx)!<+9oU+EMUXVX{H6!;Ep(3(bObw!c>Iny%33t%6?`CDVk&1NJ$pGNeT9
zz$&)-@S2qaJ_bpZ;K?jIkb)1Sv&K_W4;qP$GEyd%TIYT1=q(5AigHwM7_&c86H?Eg
z1uXw)bH3f4&$WXG589XAs;{#j`lWwj_5b!A_AfrR(ydypznX=_b@qV+_L}of+ViIO
z^0STDHSmiRCbL%!qT_&Ai^^*>>Pt`-pn_vCax}#+B|t(*D&{TBZCT-%x!Oi1sX2$R
zBt2&*BsEe0?tRXL|Hz+pG#x7-st%R-F_ZKgROMB*>Am3-R*zhP12M*1bC|COe^2th
z93_c!l{B6s6qA%fh^~Y_Y#W^<9c87$SRb4`otLwIY_bKEbM4ybGPeU-I)!DD%#LL2
z+ztxoh?$oFby<KHr%FWzMxXzwV%5cB8_&x)B2l8UH6ZY7K#G|U0)00^l5qKR9m0`5
z(ZOpVI4`_MiL#l>5#{T69sJ2kF6d`*Y(nm2XRE9I7W{kszDr<C0GvpA5F+s;VL7l=
z;i5{YaksbHD;cK1G(32MrjDJf(DyoSB$;U?8|oZfwKxU`mcV*i)miIE8ItspIY%S1
zJzD!NNyKd1RhZ7Z1JMxu;lX)g0}$l=jQ7Kb0YB5a4T22pl&qq+IK!|L>2(d_mwjs~
z*lMlT>9F`DdZEke2XRcDd+DuGBUQo%_*{0JKV#<O$lpfUi}QREf=xoa4xkGDKg7Gm
zT(6fL9H)(`Ht<A!CvJN+FM@tzEn`SQ39>76NaUcA+5;06<)N|zw_FXL-;8R5B2o5z
zaHO}+)%WzvO+6Aa#lk(_4PzKyo~)TY<5|#kU<LOCxu_836v8m&l2h4_H+pw3i(spY
zEomOcP7;+nM3EvXy7qY@=>R^P8PQoX>P<L5F`W?KzvnEA9#L?$G+{eg)@HS-SRGjy
zHWachi9@-m>VrbJCVrA*ONK|pd{)Sd!ro}qjv{0q6#6imEyk`}&eBkukT{L^s0O9L
zA<+(1oqVxshpi`1euFnyaQ;K*!%39Hlw}HPH}Yadfh_o7#ISt0C(f@Jrkyn}vL{JL
z5n<KAld88v<!UW*VeP-KA+1XPNT0Jz5DJcI(Tm#<oN2G)&O{e7K~`>o{pGsSA^Xs;
z|GM4y$f_;2T7UJ6b0pZ9<Y>zwmp*z@aM!M$)l|ne7^p19uW^>c;HqlI^6of+%Qvv9
zo(A3zzaj8gkY`_2>+79cFL4ynd&>|Yg<g<)fkToF@_nk#Y!^rGv5B3mxGVfHY@o9X
zp${8>f-O2FBzlbX?%?c)x{PIRHN|-3${Ur>u!d_z-dU~~ud8Lk6ORicd?s|SJO_}V
zu6<ha%b2)oTOM<$l&5^47nT@eA5-xtS>jQONeaH(kQg#uTna>*q@fmYP!6^2!0a*B
zJjgkP76TI^l0fB%LiTB)0KsZR5PItS`EXCIv9Khm;g{&tNf^D>f?y3Llx{gMlcHF3
zHG5n%BwJKLeG+L9sub$u?#`;143c}vn0^<1S-5VZb&BM)pi(hz9%f*G%1hpg@cmvh
zGCee!so{Q+pqykCQ0pn7YIN|2m%^1%#A&HOiAb$oQgGO;D#$4)3AwWw+6fueSTAoc
zbL9`;`Fz=~^q76{*M7}bYqd^?rJcRHA!w1|vq*7S1l>0H=6paecT~9P3FZ(~9y1}#
zhDI*Y1c%?~gkBrET$P*zIV%di&#G)W#|mDxpglK?#V9zQv(NU8oAptnq%~g%^hTs{
ztyy>jw_|p(hFN&;GF0M5DW_3C%8Le}mnV&I4dYTd_SLSS!(yQ>8+cmT&!q+(2}(zm
z2+_2AapJU)kkV>p*+6~U<Xx|{#5gpKiiDUnkk&{ma{dR*b(M!!s=U5x2JJw#Kgker
zcA~Z*OG?1Avm}myPC?n(QWCggQi93hm=#(Sda!HtrgXVf891SEu2)4_T7<+DLc70C
zKHpKKC#s}VMy6klBXCGyi)x9njTnURgT~)@GGcPT&!9RU1-0oyr9Q0eKzyzgH1u<}
zok<Ku{oHIrX7xk@lSW4XR(Lq$h;aBUkw>2U7Lp5o-dcXmsKk-DOE5E+ol@@?{o^+8
zqLQGPj}}DiTN~uHddi{<@X?;tA4_~B=Q=LYM%ugR=0i<<PzzbD)mp75zu56<G`A6M
zqIZS#5<1418D(!L2G=7^?8b0rQzdupg>RQvHT2;Us&Hs|vAY5sbe7>Q3la|hhpNtr
zzdpWMLe344c$bdrlr*u1**(#XJl2MOSOP|9Q?Dqat`;%aDKB5Ma|Hu-#L#&n+<id&
z8I^>Fagvg)x$dDFnTUBib9rW=1xdh1R0mJmh~jDXu8&w(4k`(nZBZ`JzlURHtR(0m
z(^>_jZy+H#_7Mlk2>VVJZD3sCq}rjhgf5^X0C@nxxRc=h3d-ydyWQ><)CvUqyCcA)
zA|DBW1$a)e-y2m`P-TPU=V+a`4MpRXy^5rcn8ozFATk5~*~pb8`FxFiU6$fK%W)vc
zQsqd!B#$g=61uZy6XYgJMGZ$t60K6ncdVx>ezf(Gq*_qUO7OSl^?{k?`bedBPvr}#
z)sGyw0!tQIrPyHj;!5@EPm_x^JS<VWF6>S~c+G9k?+xt*JZzH4ikx|!-09To4cZ}*
zy5LA7&b%61t<_qsr(i_~7icr68F;2Noq!4)V+1*^<L9uMr&z7IQ*xG)c>n^h*UX49
zG3*kBs~9|aWg9RG)F@2@kBr5d4J=S~d<3nRux&4rv1wk;WH!v4%J+9>B{oe2%Fyv^
zrp7a>9Kqf7^2TzsA>unlz{|nH-C513D1bpmGE=n_yz*&T8TRa+?aTs47uaY=pQz+Y
zT_JLH9o@@z<KT2W%;vL*)3SL{d~A{u9V*w>5s^@dXX@>;N<Ik80$5>g>!BH!+;@2Z
zIDFUXLLf$f#SQ~N1)&6!>`c(hTy7_lw5o!LxuXGgX=zE!lPQ|tRCDQ~pfrTt$;|m-
zXg5wrQX|d|r-wl0w4~v{Hm1nTV^=k1tIvDKGjJ#z0vesvhxbMH)<Y1b_F+mgxS*5r
z=UNqgXC$*ny!XgwTwPYuto?zD{;<~}c(o*+1(M1DZ&eb~;E})A0|nISx@CbcfTn5u
zMM1cueqp7-W$^YY6Rx8UTcUR41@^g2*wtFC)%sEv0z4`t>g-uwCNPdtvWy>xnUi>|
zno&~~9ai&mZN{nC)9rGa2nnyWVaKW~wGey7<0aBqcmd~inF<ETFrjq^=U}Pm$OdYt
z<~TJ+ysb4~gUURegegVk0E$?tGYIP@jA}+2Ty;*SZiX3sEfhEs2lQG6n8>tALCZ9{
zUCDS9T*YUYoAt}Yn@uVlP^WL{9i}l&!`~OFOlIzC7uFtccjk(BY{S-q{Bwllh(y8t
z-SDtY-fv85$x(>h1Qn-TQ#nzn9kWx3>>OcRqH3nIp(N}L^GV#KwNj?)rs{PEnUv(5
z1Dxi_jVFbMRHmJ}x;j<0ndmk15rR$$hdx%71SyfcU{ba<o6B~EaPi*VmwUGD2;0Q2
z2y?kki3rID$_IS7I?b#=az<k6oqWfBFKt>XJ;bOqYca@$x^!l`b3I7Xt0V0-up7Zc
zf}KX=AQgczk_dM}Z3WnMz%&x~qb)5%*sY+C94L{cd0nohkGN+l+wh)Ri~?`q!!zpy
zIqg?I7^}5fPsz%8`LX6oy|nX)lt$MlYwm<CV@pjiqawz_WMv|k2yIl6QzqUG;k>8n
z=mZR6C`KmadsRvlNJ_PDuo3H`gE%nP21;-~msONRwxf>G9GB4VLeinGftFKU`)q%a
znLyJpD-+J2i8ecw9SNlERFEJ^k!<Z8QI6Cc@u<WUB$-#@7m_rTHNeNBD>Ozuy{ac9
z(yH++hJs?@2t`LNHm>1FZ^n5mYm-K?U+xzI)79h>sFO$V-N@8aCA!6eS0$m$r4%?3
z%*|n(A<A#6A#7Xl5e(%fB}q*<0&6*kVbd;2(~B20%TaT|*V7GwHXGHB9ZH8;58G*(
zZ^wf}+YaCeK*U4zX%wrP$YfJHWODAlRfMT}<uxfulqQ#zv<`6r$5gl108}HSPGvll
z+u@j8syEK`$`34H+=#)cNqP#eJ))Nl5SFDfg4S3q_8-hBtEI1qtW0<<v-A-0Ky^cP
zmSy`AJeg&8Z3b6t2PT>2helH+N_f`H=h4Z1>Rk&+qStGa%3(a@)AHp_-P_e#t<`#x
zYk*@@yR<P^w9p(1v530Ry#NTL!PEkSO(((yAl{*SGB2}>$s{O_I=U~rcNSwg=3qWA
z3Ipny8m&oOSg2AgG?!<qY#La-Ah^%Laf(Wy(QQ{4H)7=o<`T;~wb)p#L|aNzk+<8q
zTpo>aBfB~EC@fhinytCq63-JszSD+2N45!(NCAHzl>~tIX647(S0#~$EJI!D6ebiI
zieXGEj)2TQ14Dr{sl*lI*WtKKgISH2I7tf*>`M-s;5Pv}sPrc;^q4B-4Xdr7<JraK
z%U^?1P_ur)>R}Ho=W!##E*Js{MMZJ&R+e@nI9LuFlX|)AALCfWauzWT4~W(5nesh>
zp39nWRn-7VRe5V(MR7Lda#e{*PdAl`#VbTql(InaIg`t*h&&vakTQt90HpvuSoJmz
zvN3^V6I9~S+KWKklti}OX`o1Nuc#hx$4V_wXqdnX(;?R0O6{^L({a`Fp@3RPRX!mU
zCGLebqU?!@z(|Bs*DotnCOcP4PTmI1D|E(ct=3brma<Exwjnw{_1L>6LE^CN>d{_a
z<Cdz@XE6JWOEPc*X0)y5VhHSf-AZ#J_*|vrRa-0FL3#_i7%kC-h<6a79jR5ugywQo
zY!JHm0{)IR9;+9Zo}ySVyHgs=jGMGn&JYydRXbc($zcQDy2STuNlGF5c{PZuur)U+
z2{EDd1j|9Ub2JI!YPrEAesjL)i3mh)k(O&FpahV9a>=AKwG`LQ?!Ynlno%{0!B_3f
zR9Z{*!tre88J$Rx^7nDoxHGcq<xpwYua;IKcM1U&Ci7_F!5(DOZ9jlU;l**OW8Op;
z!40)kF@V;am5aH?IS%ewCq)h(8Cr%llOk^7+zk_3cL}BwX@Id=OHy;o9ZW;@b_9Fe
z*v&RMa!+%&$eEKG$pW8L-iK9b3|t?86-Y7EG30rw3dBEv?%Ujk6*k(Sy5SHS9(&sW
zRo7ewIy6@s=jc2JB}iV6VOIqRX%ae7;<~a(Ak3oEu0mqN9WBA3rZK46Yp7Y7xm*j{
z0Kug@@PS&b)mp75zr@|lP8gPuH4%eYQBfq)<TaaYplX37Dr~kPz@15bY3Fd|HYJXw
zYP`BobYdF1O|XS>0fg+puPP3DeR|)n_1Ed;`!#rdAs%av76gWf5<Q>M21@Nd>abQ4
zT#)vw@AYkPDmJgQq|Cu2%*K%tiM+FtQ>3!TO?U^E8U46sV#7>rzU^LSm7@`R&Br9h
z8|h3h|3U|4@O>*+y5CKjnQqCVIBBLOV@sF^Q^<nq!pqw=aG^?407}L!PskN0?*N#2
zhruJQshtdmmYSD!6otjf6CNm)_BIU=d$$^KCKn7tSh}Kw3?iD1k;G8>z+a11ACkvh
zzzFOX&~I&fmaGd@F%-X*tbYoE&@+ak|GG?2BGciJfShcCNV_x0`?t8rnY$lWK|-Jl
z_K#$yai1;P(mEaIrI{H8uFzTxUOje7`WvN@jXtfMp-omVKG>B2CahqL$Bc()0eceM
z@-}f}u-ys#vA>+?_6#(EN-$Fgb^wS1OBq}*wrm^m*yd<$qFq{lVQ|KI=bdMJ_H5W{
zt=4LpZEbD;+45-KydW?NF|Lt9JS!bHedP?M#E*WFshW<6v$Nw`uEFEb)PYt_aCIGX
zvTincI0h#V3qV2J6mGtw!^8EN7G<dXWt^AJ$ZVb^8SWy{V6Ie;aa^tK%!Qi9+-aDD
zjcd*1x`i+dajEDNmvVb~0HOqQj#cRfbwlekvppH=;D8c1AgfSl*)sGtCwJpcS&I_0
zsG=n6FvC(SP}i8P$t>h0=5UB<qlsMWHQTB+%4q;((=TxjXjuoy>c9l2ggOS9&CaOq
z9sUU4tH@zu=jasYD}ZlA-9A(fV{!{>{%nvdr^87hLJ0zJLs&Z6Zk2clNE{6AJ&DDH
zu1EQFG4#8(Uky*Dv~XlkCa-|3GZ)nLF{RJcR378s&=l-ht<~OlO^)o5oDyNFj%tKB
zW+*p=s8Om{xCUbR-defHTd<Zk=_kU9de*h%rJ)=Kuph}cCAY_R6c3LQJD)NG#JO~3
zCxnU-HW{4j4zojEOyhP8O+Y++8{^1h0jg5sx<X9iZ?q^d!F1P3n|3>XVd;!RhYs11
zBS&ntR%^As@IrhT=qTnY593AzSQ%st3K@!@+2{IIr6d;}Sq(&8JyAS@aV-9gaRUHf
zVU%c*)FlyjM<d}2G$$%?xXgnX?$WLSu6ZC=HzzaTudSErYK}~l?BvPb)}}&MSF!N~
z*mIuWx%v+0Sxw~3Nt%l4_E61-6r=&17CB?0AD&53Lol*3%bV6Ty=C$%UmveY3l_%@
z5TCktQC*;{WQPO^JE`O)XYvw@oZDK76jh~E;xmmYS<y9;o(lY-#A>b{vkj;VA3Y5M
zAt~P|WNeu!<`Q%(O^QmTA;n=TM1YB1Y4`{~t2$_A12kXd+*?&aK)-b^Ia0a5RW4P^
zh){G?OlZ$FCGoYmh~A=HxRgG24<H-k0os_BM1bVkOiCNEV**(pP0Gz%&~bT=zAV_^
zQG>q!hrK@ywk*5O#IUvZIp^N{hRn*$nrEPjm;sU)NU#C2NstYK1SgQ)>Q;wZ(d~|I
zS?zGx4oAoiwf#eK*a}DZmqQ9iIP8$y(NdFbaS#WQFhOtvMS=h^gD3zs&sCX~^Ly_O
z=bXK@zwcZ7yeteHP|4^d>mD#!IlOo8Ip?0Y*Z$V}hJH}21RgAk0FzjWxcLe!Q-Q=M
zu(9msnSpK<XfNV}J1RHsC~K|+a>~Xv96NBZV7y3;zxGj{n`?5HMNx5LTamM>Ai)It
z(pgk_IRB&ligqL1()&@fFix?Y$+JO_C+PBE8kX1E^qQr~Wh6P3_M0CpsA=0y+#cKG
z&pWE=L2VD#OfAL}71WdZ<d$w>O1l6OSd@ZvRN7@b`?7%AU8s#y6+&{0bJv_UIBU<W
zTEXLInn(m|H0C_~-m)&O<oFJdfEm(k4&7F({6y2ate0R)YqPvFA6dkJihyDow`ZEq
zRJ_>6^rGa|!!7d~wVf&?0;ge?N#sCu%FeFY(K7j3t^#?ql;zxPt|A5&A<!S^?tDGj
zH#Oz_G4=_g?y0Puj3hcBz#0RCVoBrinUT<kdpfYIG_o`00aMxMPey7sE)<L5ZfQ#a
zr69tdZtLaTudX%}*^+PHM79QHO(aMOYmi}3JUzwArjr5>4-01N!%N&4x}BHbFUzOf
zhE8)Jv<J&YZotZcy;J!BjzAFwqL_J`&e0*RdbL@RmOm@SZ&`ki7GT%Rh+a5P^8y4%
z`E}ouIKi7$s`d&6cjMXsb2&iyKzGZh43^}DO-~9vb}MrjTarLBlHmxHM5Z7=n3fdw
zrVp-%=vlaT%FGS-qH8p~h3=wpF*fc+*R|Yjk^0G-H!y&$<JTx#2gUFJJC3q*n#}=@
z(E`{gd~+Dc%7n+{=q@FzeoHCb9^2!392EGXt3=MbbXA^I$o5rOj4W(GS1mTQ8;l(m
zr46@X;aCF!<-l0`VbpvcMQT>NTj)MjGDd7Ur%w|z*+?6=fCLQbGn2O%@tc-;TG+Vu
zw2~U=mR^e0zS@3cE?fTrOuw>OE@KB2D9oR@e@AW>*6TRf{+<8}{%=)A6J-fy*9ayL
zI1!mIG@i7fLN~IglsW%SV4Mlu@VlAFeLz}dA2I~9CBnn{itC(rtzYMgh|hep4G^)r
z+mSnfz+jrJ<NG?<MC}%EK~f9Yoil6(kOVTaCX^SQP4lOrEZPl4$y%hdrvxu{XViEt
z!Fp>VLl1M5o~SL~e^CD1j8bC*xy^~bO1mpb1F=K(cHja#^93AjM;PW_C>Jv;uW<@9
zt~8KpkM<t)ObAw_r&W31J){nokL=3fn(wnHUxWT`U*3B#<#?g6qL3`2b~C8beXn-j
z=&U=$q3rmsM{4zgaKH$hqadJf-Pk-eiY6%!&TiY1AYtATSdmJarxq(_OlYH`Ejo~v
zT8d0BVRh@hUb#4rqQVyJJ98K372I=SZVZ89`SVUUC%g_VHW00Z*yX(s4%X$voe^EK
z-;F4fp8qPi?mD>bu|2lOD?e)V5M6aT%$LoDt@=3zqDWltM$TUL_sfiWwJr!t$>s+u
z&Cf4i?b-4|yQ_K|VjWTEBv6ypZ!`iRQNqm!)N0dw4QQ?_o9%T$a6oY=6j09sY^|1J
zJ?@sGg|;GMmf#~XFNJk^gkm+iLr3SHh9K6-7ZK|*HoFYWgs!y>5(`5cyMTx~F)D>k
zsZuQF3sK^M3aP8bhP|wHM`d%30*L}mXCGSiN&kA~D&1kNZ-G)b<=^HMQKP=lLlJX-
z%$QapcYqIpwG;ORb)$)+vlJuG3n&ahy^PlF%L@)6I0-`nF%S|)M%J%HkuP%@*lx_g
zHp~Ne0-%MDj?!9E+mhVQoi)=}lUujZA4#`wY}u<_g_a!JX91M+f{<v?OEboX5dw^7
z8CHa-J(z+U(ef8_MU`|xbD_gtx+wH)*DR8)^0PMlbm)~xyoQ@Zqu`O>J2^KK-_D2x
zkr#GQkY!8Hv8KFdd9c84#KVDyvRu!Ja=ur}1JY;3U=M)Iqlh0T_jU_p-w1WK(OE(=
z-6eUXMeDRD^hUd3zaTU0C_pv=9A1?tF>zMds1PNQGEm^LOGBhJ1>>XW|JZHKTosRd
zYrSoc?Xf*x;gQ{$r;;L2d{7`r8F$ev)*&FH`CNJ?{E#19fz493Jt&SFX^`4xnA(a!
zF(hh*N}HEHOzc4wOuYBtwD;)RtKh<B*g6^YWoi#HjJB)^hX+ZH7G7^L64~9Gm$v0V
z&&8(Ej0;7AzJv4?MEgy|5873gA`B;_zV~&dbt)aH?%IBXNY;7h3}lK~nbYmeA|*|j
z3j$rCm`g8Q*2CRKey?E^f@>3z6o&bj`{Df8C|YyT-<NB-YT$K~TU5bl7nxs8=Pg?$
zhop(7&G}3t7vPNkCl$)AdZT5_upCNTFZHsYFI9DBa;BI^+4%R_eF+)GfyzD5NR~NN
z<xOTlJxQbmcT6Jc*)XO=iCW3^UdwVvL3Eh6a{LR{dJz~XdY-WrH+peUrKd`L5TaT2
zYu@MuaGgVJnMEn^5)gH-6J%ZE6AfT8%06W*AJpC~k-E7P<!n#WO^B$64GUT4Mwp=f
zcR9O2x$HWQ4(X+67>xSJN#Z)Wc3|kbw`kPsE}sNwv!fF^P||R}FxM-aC+>jSa!yAe
zew34*qp+3-ZON8q=1dS0a-0W9En~YyT-#%NT+buAu>k@NyQT&wdNA(j-41FuMKvEf
z*S(Y-<bWSy8d(HV$*XNs>kdL(Z<BJSNEUPL7LXhePj(Yr`S&R)cz`<xMjRL`v@&nN
zH|_6go{mL+aDD>)U`-ZP@KTg4M+E|CX;unui;ekO`CYg+6k)1uuvQQ1GBJm1BSbhO
ztFC~L<;Zi;^_72T_E%;%3o|gZ{$!3TQVOjc8s%%z?-r@b-WD_x{!A>$(hh|CJ~-f*
z8RCl%4^f00&i|u#^4ivCQ8kfx%>>}yMZF$&26hb4kX0YPa^gt*EFV}YALR3+#YUn>
zbUgt{9@?QW&SMn%iLMKvULerapAZpNPq-i@F$d0wBGZL+4r4hd&Z7vkI~JQ0or)3$
zj|;%lJdi#zlqV*7mR6rN0qj_vr82KfLf*41k=u|3Qz0H^fq*zJG-UkH5uf%_D(?8~
z@Hvs<Z&IaW28A9iO*BWFG-605X8cNU(nf5^3Iv0a#TzvDPOV5Z{v3?5eQ8Z}adD#`
z6wv<*Tp!jW)$>*B#W`ZmlY!>;*dE*Cl^xO14n_@;_HgDIfaWxAZO)m#KFZ)5{-ukB
zHncl?v9$LS2^BzMj57j@8awMwS|=QnZp%ZzqoX-SlDPdG*O85!dzih~%Aq1hdAmY3
zvs#VLpl-y1q&v{)ql!%146ylV!dupr)pFo`9R+i~V{8lJ`*<Efg%M=0<;vI<OJUHN
z(mbK8v$Np&UM8I{YS<_wh33`h*TPvH*60qbYDZDNK1!aZWOzC#fe3=H>vWIF&%?c6
zC=)F3+!d1*#g&N)l7!wWtC-LP-)&9;5`Z!HA?qWM$u}lZ*Kw+w(Wc=c+H`6fqFsl+
z=fKt>Z-N`bwn3V$)}0|3@JRMy;*2V?<v0>;QFu)6LZLLAXD+MzEVdJ@#;@ga#nxIA
zs*Q>?Xh3Cv@pPH+^Qg(kqr-98ksu<a=Yz4+dMG2r)F_H>T1mWy0V9fCDK=yYhLKSu
ziLJwISIbbe4;nP0)j&N*P<x!>Z88Q;wpc;5RI&z5N^<PB@LqfKmOh1GF?DWs%uNi8
zfk#>UH;ofjT&Uf4(YD9-*dDL^;2tx0defk&C5%Wor_NePmD=Em8A)9qwEs}JR!b+6
zWf|Bqy&)@YgUfreDeYKE#s0NJc55kl{f(1hVsPDOL-Gd@4Tv9DL22mA(O4O`9Q7=E
z^F>GZA)5F`=|<twF<&UZi*)!=9)q;5vI;na_?D%`h*ltFPor`>9B&9Ax=et$1mfx5
z(>$^)>d+Z7<_0Q0g==#oyR4LDi-*F7c5CM*zO$|)fnzoYqLK-4B)Ls()t#M&fC_7S
zJGd5T?d>mlakVn4ZDl<IaqCDbs8Nv(|3*l9J5$&gA+)I%yy_JTvH;(Hrz_tpy?}bO
zLP&z!qL8D=l^LR~A&^5m5m?gXfk+RlpaMfDk6}%{1J0{riw#+f+Rdy7X$=+&!BXha
zC|EYZ>NY6nib==*3pW}B2~=<l7x4`2l=s{%Hx$|kgixaWiOeq?Xjp=bffk-<tc{)C
zMefa}yi_>{uyV>Lgux_Glx&|g?<3o0rk#vXyjlRbR)%>3VU>HmkvU?SsWl!2Aoh|p
zTSi+frjR!JetNHD*<x*v?Xf*x`N5*$9(y1PM9ff<G(>cAXnf`~RNJLSV+gK=D0a%S
z0zI7@)<H8Jwema`r4^YCg$js=$PP3A@(oKOD9`0X_o~Zc1cH(60^Sux#%47Po<Wy5
z`Ix6vV|m49lHv%%l4oNjwF61ZpGg8`*{(4R*0~-WO5UVo_aJV=N=OdtK4M!K%ha{}
zJxF^nAyyju!1rUEN-rHMTBWnOjNOCp=Bp%0_g5^+>;}R>YDWhEL@JiC0*@}rk|{Y1
z#4aH@l7jw-(aJzat!R$8Sr8jHWl>%LLV{iBE*Olk?q(A9vKPBi-?a(O5YaI5Xw~bz
z8Vwy=dLfo#MQ03EW)v{*tXV`Kw!F`*k;MrL9EcpW@5k&2;^Hh)33nza#+$Y8ZUS#2
zJ`m~EjDLsXHH$(w3lD{)Z9kAy9PFS>30u0t4{Xuly5U&Aivb~Mq2=*}Q+z59!*VmQ
zjff%Sp8KaPSF)*Mi`2W6t<Tzczuc+`twj(_I#Y~EU*3DUY51U{pmr34JGq4#iBiOR
z=)L>{=0;5qM;f=S!tL?uJ(QnyeSQYoCirf@ksJo|bF{rc{#v;3*yQ|xHF6E7n-;Y4
zvWU+?4G+{>q4fnC_bMt}(cG{WKe$X2j-J+Ta>9^xllkU00F*#$zi|O)Cu=V2qfMX1
zXvBAna%Z=)W<(O5MPO*6&ySKe*osKeeZgA7wYU`tg3dk8{H|mWxX$BVf<E81a^T25
zk2^Y2=q*MgXg6YGj+s2#rI_gfEGP(A_Ydzw)@05ev{~kbhq~I1mQ6aZj@=^ZwIT_F
zfrK_&B^k1JrueJDNq({M`Cba1J}Dvs7v01WBdO?YAO>%5K@f+EU!XI{2`CgpR$v(B
zLx6(l_i_&8UR$x1?;nN7gpU#}W6_>>nt^dKXEs)H7K{7?8AshzQwcdI<CE&MdbT7>
zm`Ej@r)^|c6@5kovP88r(X2_1?MKjIG&1RhC=S=w)0QNWBtdh^s1JMW1(z$z!ULF7
za#Bbn3hNp%3sE33V9XxMxp7M<*_CLZ$%iz{XEBpjS{`l`%UMeT3Q%cs<6-p2p=-d&
z@3it*Y&|kY%p^JYdnW7OjH7HvcTVhDSYEZG{@+1CMn+mYV@sw#JR%!)d)&AO)|lPB
zy|PGdD1UjS1xzR^xWTv9LUe8D7wS$Dpr+TaUCbgk>uu}SOW4%sP1%HIN?$tHV_6mC
znhF}X+dv|oid<(3{P`b6Pj6ftoIDN+Cg3ntU}0)ywFEsCoIap)0t;KNM&5z}6B6CA
zA^W(*NW$RS=(DxpIf0yy!PuY&r9P?)#{gU*MHDKM%rIWs30&bY-x@rpL`=spIf{&f
zTA-0b!$dg{izaIVtfDf{Q>h&T+pH8Kvz@5+Bkj$7<^>c;O)xX8f;+6Em<-C?%2A8{
zqI0$j+jh#BS*=z?Dfk>#h@DT04%wT}NZH1^t}H1H4>uU*T{GB}ltJ?-&41MU#r%q7
zcqfG<F)1_`OKPR@CFp?JvdZK8cj&Mz>U|)>^S-JH{fs8REZlD@-+2<5I}{e@9NpF`
zx`^0_CWSaNioX2DFf(J}RQq#P9#Giu&qgp5MFOFl2wDlWDRDA<(BPJ$Wm9xFSUoVs
z${b+Iv^bV+#b&djBEF5j!|+9$tRNKAtiNNr2_6Ec*2e3&+q}L<xz5?bc6S$cZ0u1s
z0P7<n?;(Aob1pwH^OJV#J-6BT^jGP=4;@~E&C2i%DoBKYaZ#S1q3nFurDg12Q@&@h
zx1jiCLjz{}OB^Vix7mHK*|qZzeZ^i}Zqe+Gd|;8h`>s3f>eZ`u@#4j@My>6Y96(3V
zO~K?kdipWJjVDpy3Df4%E%K6(6WjJ>E!y4596b;r)NWG{Q6mP$Bc-fXjBE@<>L9Ox
zohKnP<Z6LRo|0Zieujg-D9cOnuppS-y-4{FzX!gE(Q~|fP6k4Uksu;BT@)<N*iv<&
zHzEU&P9SNDt=geDyS}fQRk`$V?HqdLg25c2Q<rYmIibQ#kt$4cZd});v}AlgIdTjL
z_VquF-j#~X7$h5fQ6sN}IM=<4zk{~tErwxQ<UNv^*;kPZG#we7-GU(=W1^!hlK?WC
z45L}THbr+Mx%VTT9q^jiWn}pHu}|kj3e%>daU)6$|H!9vO%<zk^gOSi8P28=y9Q>y
zu$v0hF3B}Mx~sD0VzNCVkPaFI($Lb87pGxaR#c56!Qcg&NDT1;Nkj*rL2AQbEtS0i
zjC;i!E2a_Hnqt%|Qh?ShC{|2@mgBob%b5=>i=%(Njna1^G60(}<}ahYiF=YI`lBX}
zepww+)lu0^k!gf;jE%cTM~V(pzQ(=!hB_MCzvDIb`a4gSYgX$R$I<g&wTD;VOmqgl
z$W=S{beS72@xw8<o&A$`vN^C9E-dY9OGucVwA=2x&+gh=*%OaFVJ}@?nrhds-TA<M
zW-mTv&%bn)(J|ZOZ{~r*@$9qD+P(MQ%Riqx_Y$3JzSV=sCJG$EGmtic+#p7`tCNO`
zZWdmA7}GI|sdiLahRB{0TFX9zuGVa#pVR)XQ4zr#fZd#Z&1Hd#)xpE2HA*CmL{h`y
zkUjV@kl>+nN&GbtJd_m4^QM`($*G5oK=V;U&XZl-*pE(1Y3Yo?QH^?=1u(fCdz3uq
z=%|2=eQn|`iRwRkP%p8CrzwxA*ZJq@_JEa4;$1NQL`N|>T_aZ6its9op`&jr3M53`
z94{S}q5`ncHhy#9p9L)zHBhoO8eJ$CY1I^&8?^zHD`&Zbvqjk}13uU@Npq**Ns4B9
z&3ZHH2>iot*mhG}jyhYk7#sCzTT;~B)fncpD5kJz@&dsguF07lh!DGMB{jEvC~!TX
zocE&>7RKK7V;(BWL1yFOXeM`Mz--u=G-_R<cxaf|ao3_K7?}l+zEgq@48uyE7y8db
znw&v+eNOvqqNhFwN)JU)35q0Pq9<4~<4Dp4lVD7{5@^e4y2))=nqYp{_>RrJBKbp;
zvkUuf%wu`(aeMN)^LBMz`Tphd=KFT@iN;n}uG%5Q<=vj0IkT|Ug^RW<JIdL7UfRAZ
zi+gA6wma^$Tf+Hrk1pHl=)kTlU%n`16vcMeZn@>OZAwABxE#K&z@hy(-`ltSojKdO
zV_7{8E?;JVCyv-HZ12Q=nPWE0K8u}iSopn7L4oDp_jZ|5F!W11I$UxNxy52P#sRnY
zC!c((Ag{ZuyR)+wUVM>r_HXUTzJNM&H@Wk<j~mqNm***ezOxF=?ru|_3(fmibd4AJ
z0>|=DofcBsyWp(oV|H-z;N9q(U1^;HTZ-KHn=5*lRoGKTL}?E^{Wihsqzv*M3aIJ!
zBZnTc%^M*=Fu5@UQ&IG_9d1RfiZf<Xkl6@Pnk=uPM~l?BCJ^T4GSqEnLUQBKs8x#b
zMvmU{)ZOHm$v4(CKu=t?Cd#{Jh5}FeTCJT*a4vOb(X!r{Ni5wmYo%3`$p{j=n=2}|
zUPJ;`Y%KOPot39n;|u8qf@Bl~4gifV85<95jGh-&3zh|M@1j^m^>^{9qfpWpEQ&Qp
z-#~Xl=U&ELBJhE3vihAczulc{hXOVqb_m&NmoZ4>H;$DQp<b_tEwhD(MuIe8>L0_g
zBeg0{ps{mv4zyXYdK%VpgEuMGWvYqyO>76?MiR!8WFfOn#l8%Dy&>ztY_qPDAB+jA
z)3a+-D`IChXP=j1M)a-AT}3=g&ON_}FgiJ8=k*C<)5~kfcH=uf<!joR(01(EEqC8y
zWAl_fcJ|12Z@brCbK77~T)A96=Y6~VwfEWZ@E7dde9unq&8!)A?c`16HTt8n3Vh8=
zk1M-+X;aYGO{MrPZTaFQTfPiomHW4U#_qc7W-?yuJoVJB*;CJ4Dzn7W-Z^!<-F^Fh
znRWLh!(i||lYf8Nb?@7m+i$ZodyTX(;U+t}_>!GHe_Z&s$G`hyxm?<_&pl`N736j2
zop;#t&%f|36|Xuk9(+DMYt)@Nwqw$kh8xpXvZ31g!p|;96p<Uz^8FqB0*@a?N;EMp
zm^=uhx6Isz&h@hRI<g!4noO*eWm3sy)j*Wi4`OX62MD1u4Qp1(AQWfr@Pp;B?ZPy&
zp%*RF=`$IBAPlfc=59(=*0UjZAS(njtE0sNNmijoBx-&|2P1MXs`GkeF(&6F1V?(D
z&zq1~biuVUz$E@|8*@_MpixU{(ggTBqR?>E=(Dc5M;${kz>|m?=s^Ixc7s?jH0Pb1
zfiZ$X2a}`<6q8vL;UG(Co&7Z^AmeMR#l@Ck*5XYa7u#cjubr6^tj9+&(TZ3}VMcNE
zJbIrQdMG-qN2?Ljwb->Tpqm0RO~H~>KD4d@OXeCXW4_jAlywQv9~gosIz<TJ_q%xA
z#=jQ3Z*#U})@w3i#2;pu<Ys{+whQHn7#QDTew|$Ea&^9sEQV`dkZ7^yLtFHkyQEZ6
zXz2p&{?%7!WIz-<6GgEhebR2o14ZMu+gjV_%x<uwOBe0R;aPj;#S`{zx7}*DmBMrS
zj=5ca@^QOR+JlIKzybR2^3pkbX@A#lUO#J(K6T|AA{^ZN{^+t@PABZPo6gwjqowti
zul<Ud-E`Y+cDkUpM;|+DS76n1>OOnxo9?$;O7VGixv(>L-DZockJ^`?yl8!U!fw6q
z0lOETUZqvBd+LmxIT7sY(~sNp2WB_jd7s^J>a^Wd(BJavx89Q49@qas@p|FK7wpY%
zev@6gbm?0vTqr*CxqhG<CsdJf$Dc|4JvPas7YgMVs$JN+)f2igN=zO_tMAl$W8*RF
zwb)%Di6J>i;9qfsVnJ(W^wGoMExl@L&dqO@sCW8{YYZT;nQdClyfCLqb(9jr^xmMZ
zOJ*~Q=?Iz9AYH2%kI{oAMLtp6Qtdn%-*z>=#CX0vy<ro@(zwoA08xzkK^-$n0k8~?
zy3be_horO+vG}!q4(<vPvKZg!fH0b6AR*4*G)s%s`k=pe?2BCi+JkuW*58!Fy~LC)
zu}XrQ<^~V6%<5d4r&pqg(-609<PdMiLp<#S8WyW*H)F}Gw~!f!h2?J#)<fBe2hQQ5
z>$?a`@gcFdJhA{M5;|<^vyT2|!9P&E@4QL;r981f)>xlaq-mTV5LOxaLCnd*L1?9D
zo;07LPoeY@YnOu45kF~)#~EKE^V}NgJthh2)ZYzc=-?B=+zg13XwG9!*muSdG^u|b
zqR+1!x#IJI9Dw@4QJW9Dftyybo!jooo9xu7Q{~r9rNxZDO?G(pSvxzNwAVa%kL@2k
zV^5!7f6G@93NpR&(o1$})7edDPTT$>9=}%HvHdc@zIx#jy(+QES(So#F`cy2`)K6v
z+1_HXOXn{!nR_fP%EPkg0oVl!J{R1qwL3SJcH}ABEv<`LLF3T(-H4OLSM$-8_Wn)f
zS-W)UG8u;7%2Ay&WLOX;uR-$}5f@T-hJe8VHkD|@!2s6zb=>3wd4VV5eJpOWqZ6yD
z=vc@@ug^{RG@sYpNQoz64fh`TF}TczEx#ZXR<%!>`O99Z&hmkXKr3%N{g_PYY@XJk
zb77d{AVUeR-!3u2Yp*%8Yy9igjYIbcw-+uxLnT-Qwf7V}slo=tMyUeaJ9>5HfGB1D
zfT)!^3k=ehITwPPfe@!+Tkm`JP+}gm@+kjZXF)!oD>!BBG#cQcIKZrS>3Sk8)-98b
z%Z&ot3%4~j+<{aV<jtTKS1W@f6}B`I&E-mXK#>}i)1?ZVStw=w)Q}VcvIlZm$PR=f
z2kefJ+f`m4;bI&-GF&Z6DCaa*JhUj5^aV2&i{wQ(c~2SFhQhW>k#9rfS08olr!w6$
z<o+e5A_yL1?5qzXH4IpT;bNSltLII)56{-dYG9f^6ncLR(lx|br3jg>A<!pK3BOTm
zpjyFThu3+r69x8IE5X7&$^rUD&e~dEdcMrKUa~8zm!D&B8yX<;(Kj2fr2gj36+3r!
zVT-#?+s$V>h10$43%=&-v%jag8}~J*mwo=~C(36Fb1v>p`a`=|P~GLDemmp3fsXln
z#-wko8IM2y__xe1Wcqp^#H@3lL9A=$8*T>Dj%tx%<GBWjfB}TEno}XEt`FJG7sTRY
z%}PQ>)V?yy%9(zgO$Gm+EVG7D4C~-O9KpR|lh4qTTUsb0NkuDh+#r8KcDtfxXJ8wO
zjp)eD$zsw~tC&&99L&?;1MekC9-&uT6UYmmhgkRfYC#pI>%ukm9xauVgxt_<A&8T9
zSI&53N30QoBeOEp`>H6EJUW5J-AOqA2VkO|mH*fUAGnQ9VFx*)aVVCvCk{uY7t^HH
zM81IDiCQnbW4RG4_yn3hObUB(Gw2^ECwL${S{{Lf0V|{0_Os}1H?egrDsVC-f8Ug3
zVw)x0UG;LX3|Wkx?4FC}uo|C4B7araQ+ujaw2K|l;I<`g(9Idun3bgn+M>Z7K}?03
z4jeGMg?hZ8zs6lLT7RGjQiE7Fc*t4QeK1??UK&TG$~<kH4JhjA!eKW*bdNkhnkixf
znkIPsfv2gqLd8OeDxPxazmbpNKYYgfj+X1*t#{gO^D<O_;w3wC@7;FK%}4gwxtA|C
z+G82z0C>3nY*|<Np}Bg|&RyEGyHB5>v;GzQbz0fMQL?*l+PC?Y4dctZ6Q$MH9N76o
z{Ing}(Ymt}H|<$>cu?lPGh3V}UrViAX@9H^?eM6vg9|U%*@M138&2*?+cx2ia$H-q
zo-1>%S3-$rXT}K;byHJ!{6rgrS|1ScvfJSsVQeay6fqAj*UCgbTrt52_AyFubRthv
za~+dA>V!NIxo9mFeH7wRBKmg~LoIAz8H#N@4k`*{bdMUlWM5;HEG!}fi%r$o@<eo9
zVoK_&u@UbFeII6ZAd7IbZ^wu<bSly;Fy?}3*MvpgIcGQqlKX(bAo=3#&=c-4I}?^Q
z&I0v4Vqnv01X*UGB17|hFjQpxIXSQ1-C%h^Syi-8impGxkdKV~C|eU>gvEj>Clmx@
zHAi&rfBEw|2^ln_9s;3m7uE&8NhwbkXif;hA!H|}Aap!rn0w+U^R8m>R!!9-NLbuZ
z*xb-0Gv%rm&_ELlK4w~7lrBxAA$bM@!or&iJDQDYcN82pQ)mbHKhnsMUW}DeN)6a3
z53a^P1bUif6-D#HiT9c{(pD@-p-VoCQL{RH4SM7KTJnQ2*PJak+~kNz=yJ?b>!Wu~
z`u7d&4nI42tKHS?6QSbRTztV^N~i3u+ZJ|o_DMT;erbo@348tB_t@!!$L-2Bmy!yy
zULCD0-+Zgxdrz5zT|95+5B`j~Mc$MGQ`&&L_u8qlkZ4}IwkzjevQu}Swma_L6Pt6s
zW9t{6v2#b*z%1>;*-N&6`YyY#TXC1$%{3gi(t<p^e8n!$Z?=<n++*`z1fdOPYL_qD
z;bx1u{#_rK#oShAm?&B=zWCxR)^V|IXWkL<xl^k1@-U5}+!e@?PmazM)cS-Lnk@8$
zpfo6R?PWSPnq|7VYnEh7D1rhD2$r59c_*S0Dn#gF98zyS(}#~~p5}0x=xbdi*{jn@
z=TvjPoPLtEc4PIF>xQxYCsd{zz-E@!080IS^j4*UE6MTZ>#)V?`)3ql7VeHKGuL6B
zuT$Lz=c_QMan!O##^6lZVl0kc3&fh%`$N#(yyN!8f0i9B5Egn5mmi(?QLtEJfhIWv
z1!^=OIv)2)HQy0yj>~$^)2s<EgLw~_Ic)i*V~>a6GqvQ1j{@G5rk%N3fP$+j%c&wU
z)?~&awTl@8=#sOBMG))vX4HcW<Wz64=;R)M62vg<YX4f#6K`PhS=Z<{HfO<dMyN!c
zAN&!41{s7F_25(iFx~XWd<_FBPY*xd16Ee*n<sBP2A^@2`)bk2Cd{dHW+Ga!+JOzZ
z#(W3aK-CA@@72|~Z_f`WD8jsv4sUQ=)21swOa;L#Q)lgP*<O0-Dw(K#8LE#U&VcX$
zmSky&FAolw-!}FN3&l38UoCC9`5IAH9&BB{f4O!V{Md8TGH#Z3aQVO>`{>u@-v@bE
z;<+1_SM0?X&X*0DwsQSyRpy$S!=_<nM^`S{mBW=S50A?GZOYD2NQ>?#FjdBRta}@7
z+z#!l=D^SPVrO9&&Y!2@_A7avz1>}V@Z`qsXfMf}q4hN)3O$&wcj};M1OVrV#?3;R
zj0}<*<~j3*#Eal*73}cHj+H;Q6@h8KWkORi`^Mil|2b4(CDa!knVB|LWHYzkp0qHn
zp&DJOFxC0fI9837&)G~ofJ(!UF}iR#i?(j&OvT`Zx@uZ={p+=2St_eq8njBY*ELku
z^(gMy^j;j{BuND7oUaCH4z5p=b)gEIx5`8m`NwbF&ttU`DOV3SrI3%^)yXh)`}!DK
zvb^XXQBGzDtvJ%xM;G#r66!S?7DBK)xWTR*)~nBBmIHi{wMXZD;ogN$Ks-A$snKx}
z5E>(;8G)BGI$C%-X49}=x+#mtiJg{hITW3ZVq_Q>O%Wpf!J2D^n1bIdIF=Qjmh??Z
zH5Ka+9)#%2c8#-%5WzBQq(2+AYoc5si`3FG{kSRZQX#g^8JTI6cB>2e0l@bx+DwOs
z^&o9T$6>Ehmk-w3VNeC%8sk=wZ8nV2A51+6=)LO)s3Bs0p}oWYWO*msB->+qyxNZI
z;Z=y&xb>D>>;v~+v9~Xt&|I?>831jr)iO;wF8*8RbFZL{Gd8$D4B5#JSp3IPqT{J$
z#`d!|vp^+{6F+q7-lB9s5Uc9gNgY^p`a#t7jzN|xig0|#YPQ;>i5OwID}`l{0Ylb*
znW`dZyt2{r@kR9v%+>T)jKpJ#eNF$U#jR0W(v66L=8*G+{uEm9BxrQnr`96N?vso|
zN{xw}{bBRn4?>p{*}}VYxMl=WQd+P<QnNa8O;fW+f-E(3PsCzi5lf<CqR1@}pjdX8
z^H$LtEs7CsOAz*0b{jzmtaXGFNCS_gk&82t`Te;DisfTfH3G=!0O8P<#<-2DZVi5f
z&TEX?N%tvxc3AM?rZ6{bfpBMN(CY*V^ERNdUz|zx#P6zTkUNqjo?-BTYUi0<qlvbU
z4+vVc&NU5|^bmtg!CeajGkuQ6^B--u)AtENs!fTR7p_;LW6bOt*Dxf~*rOLC#%{w6
zgvC}48MqIvdnW=#=;1OFO{CwFW3+AgZQJ8jd|X${GjG{dB#?cZOJrl&+0?E}%nF%B
z=VZAQb2x(nALUD!T(8-9XD6xCtU};gCgoB&5n=R>RjP$J6TM-M<r8xvlg3ex=<TA6
zqoXs9?p_q#?cI(&3bj%vciPZAi}N-U<$X+5cwG^hzP@cWv67RL8>+X#xBk7D(5}JK
zdTZ0f2dgDE`&0#wx_>#<`Mgl4MA-OZk+iC730jMkOf{7)nb>hdW5y}!KsMRorCM%{
z_hy3+#_}lNKM0YT(wk)t8>mxgHH?fZIFvqQQ6_;z@C$#xafTmTXUS((U>Z91CG|as
z<_&EWJOk&g#`D2%Ec?hog19!+8Jiw7?N6jXaC(o5pzm-*iLb03r<A7T%*4zc0Yf8`
z9HGZ7sb4<~98i*&f?jX=o<%`lpv0r;m!gOxZIT;3P?|S{T_YFV12Rzg4jZf?EA^Rd
zLA1)s`|i#<qA>zi2p7wZfC3-yMc4gMeHE+Em|Cc5%q~gX9@}GkywZc)z~~Vgjr$d5
zndlDepkyarxEu(if<~c^6**;Rse-UzuAR!Y)fKAYx6f~)7c2MVqp9xXZXtw1m!YIZ
zK37m+TI4lnYq-$k>#<4iI>m^P$L1|g9MMq_B10Mn5Mc3DwzGSPtHo$SR5)-xD0r!>
zZ9#a@wl>?D(J3C+33epie1bXh^CFc)rFLsn(nwO2Dhn}b1D|TPqj`5OiCKv?4z&52
zW7cvZ&Uu1zxU^X%JV1lh`kaT*ceJ(BVPte1NJN-9m7OiX;2~)!YEJLQ0X;)@uRdnI
z#41EfoZUF?Aqx?0FBTC%-*WalU@oF?M7gii#v^Dx1ZYm-bgW)ox;PaSx6;ol#P|Sa
zjUYMZbYzxkBQf=G^~Y#?GkQf)M+Md(a>mdqO+loP5p+;6CD9V}!KtNV_loGcuHK#U
z8A?f?GYwWZ{=lLY8JRH_xI;r>pL1t~52K}+Pi<Rdd$lBDkUmf4edKxRBWaz)u|2lO
z_IRZSZJ8P^rqWSW^cCs;9-M(i+ClO;k$HkIJ0n_W(B7wz7mYNEm&GhZ^hr`~y~Z9s
zL*uqP3Ej~(qRygNXacjdG@fxekD~yr0VtlL#ACiTOmi@-n-C!b0FJ8~haz7=j&HIk
z={1Eo`b<p7NLgCkA~&Md169uELRhJEnEFlRYhxW;uO%TOE8N?Usj^o%3sn1Y?qd^(
zyqO-4)cGMzbFbVwPa%q=(zy_NxlV48hZ6_%f=DgW=Aod5<fIJwMnxa~!)l`&MHJ|P
z`QXzw7d?3(`Jol-Fli9CC|3u|k71Oa05_hy78Wj1&!b;}^FRqa*$+lGi|O2Qkc)=~
zbZYelhv@h(+|+r|F5HdISfrS`oG0c;Fsc;*65j@|-A;^3BU<Y`51I@YKvon*SByh&
z3N|8;6mq<vb(lB0nV73Z7G=S9`fIq3V{|4DtXcRkl&4jys9ZWwfM7Xwh@N<9IKzjJ
zdbBKRKId*-BS+>GIOlT{F<n2r_3#v?t&8mT*dEvC5D|mK3eK93r5rV~!<+~aDhVMf
z5OUsVV{Yz#f%!Ez#?s`7`tGU78m+56D3p_Z51id(7w?!Ezf@;qAvj|&*Qk~1rE1Cy
zGZiqb;fOsM%-_prY>X8F)ji0%F6866R5fW(Jc){Ol@ZZQR@B649wsB-V=**F8tA|U
z=Wt9UkKpU16HkCNLCL3HZgitzcgWDWXO5iclF^C@o}B53D6O`M9>3^J85F8nZKpZC
zQxPOWH!~m_(~F!ag=vY5W=BUPkJok^{<IksG2u`<_)Vg-QI@fzY@gE9{=%G0G0)Ns
zkSR#szKR#8Wc216m|cZHOP-N`m@*5_^e?2N2H1e~Skz9X4YC(Olu31xr>|jljYZ5J
zIGI>1q=886VFL|yrHG+@$=TN+Ldjq*pmW1r{5>9P(Nd-TXoHN0896YSYsTrJ8Ayd4
zW%r*%9UWmE15HMOVC!`+ihiG1^c!!BE~q_7WZX^e8rx%gY>!uT1fNZF_T#P%Is2kI
zYHmL|GZ2hInCoHzpU>q>SebP6Lv^<yw7js1=Z1Auj|s6QT$)DnZdDLzuMM7A=o?fo
znyevpt?WpwSAiH+6nrvb*Lo2kop@x7ie~Qg`y-Le1@|a$U3TMJ^Y_<l^30<k1?TDI
z{pLH)u!KPb<4N){>k`*7J4T9F<LKq+K7?TweB&+~JG=o!+$NK7254rDtVr=^H!q21
zPt)N<F>_npc-3M918<zv-vjfbjE)(kzMFe*k%=cQla!&V_Q`$rXqm+JR^U!ybb&43
zrfGZ*l?73GqayW8AS7U6-suz_Ag_#|fg{k5w;DOPBQ1V#nA}>m!N(0kk%Hwe&U+2o
za@Lc<A|2HFTTs^!sJ)oz|BW6R?sSlGOvj8yxmXOH6zh+V626au>OsR*v<rA6#)-zt
zbZOUV#hjcHpQU3+dWad+hQdQ;p^{B^W;K~q#=|`mrCaVo_(0|CqQu0$vu1k==iDCK
zV|!eO!{-JvqBz!cp-81<6B-(82&6L+Xj5nA$?S=U!5k@6dnO4BHD6*88!FX4F}9-;
z=FI0z_{pwL9TFJ3%~O)S6pRUA20n5QZ(P^7a%MSbjA3*lgc63uGRzc8s|9M4T~w%}
zu&mZ(aH0qyL*p&YMzsO6GZYc5MRbJ+MnSM}sYt>795FYeCX%BNtx<};ib@_Cv+IX-
zKV+(|^>$~c{Ju|<^}Y(2X?(*!WRu;7fw?jlD)NOM$-c;#0!t8!@nQMeGw3mvi@01$
z_o7>r7us-8x9HUP9kbel6uvbgYk(b>9jTFi@5Qbk^}cur=8Y^uM8e4=e(Wq}L`|a?
zL6nX4pq-Gs5mAg#rZ(0jQOaAobBxOJa%jCbSJ9=vA&3;C7>kMGYN55Nae#1nhegV$
zA%X}R4h*yMDXzzIR!B7sYHhB15m1yKI=VZupfUT-gEV1y_jwzqC>I1H?kviO0o@Vf
zon<uz)CC{NY-%ykert*OR%UDqu4z?n+74YsoOzjb&r`JRu|2lObvdfrgKx-99kRjM
z(-oPtPPCxjGRStVo5?*Quuvs=jt*iKGJPV|cL*#*C|0A7P0U9k6}8YGI4b+E#uxGZ
zE3v`S<b{gATQ23c!yGMqYvU-)^!}lfp)SdDu9>Rm!WkIeyH$ru`~jKp0uAB1tj_sT
zb~~#`p+1?FNXzK^X+{@(9s*=Fx(J#!dP!Y59OBP;(GvXQjYS<;Eg>tKv17Gdj+2oC
zd=uL`#{x3I8}(D1NG1XxOits(*4y(B4MwD0`5#c)qTJ!#Rz+x)v-?VED4E@G77W3D
z$eu@|*$-2X8!!z=<)1Mwy&)k3m24h016r{NHP&TSS0JVgM-03N%xTM=0qG(+zTa_}
z50pjQ|8nNbDO4^@G|V=Po-{ma@|D%pU86Xbhi%teZ(VhV4!F)ly8YEM<YeqLt~K}c
z7Xz|GKA1AbB6kM-7*MRBM;j$Mp0z5KbY5h{x5Ut36oCwLR6f9&GdaPW+}|nlweo-<
z1r#BdZ8OR;#bpe5@QHHcwsLKc?QvZW=s`E~&zp5(_jO&JMLBD_F&gZ)wKzmEen}AL
z2qR7{x#YG;WFd~nS}hvkB7kx2Y~`RCQp}1=TFjI!SS=gaJ{vVgVen)U3Y*Ob-#n`o
z*exK=Dr+a{`QBA>M~^hM8^v}Wy+xP@A;~mMenFg(31VD>&QRRgVhSX<0c`>GNysdK
zFmM+hx#7mphOJ01;OvIFehr$p!BJfV%Q|F=x5q)GlISiX%r6_WO9INDce|NF98Dh%
z;3e2=n_ei22-ph^zp;}&J}#|uOAz!vdpLaqnG^&z&+2=Q<@FX|hLlfdSza$ikt)y@
z1gnHe$AKmXTzGjQ5yrG;2dgqA!_6;<WH#%{_X(M-R~uvcSErd&D&LGkKngyXIN5_H
zgU=I56cNXA-YEJW1%$0eiym1JNX^IlBpUOU!qtnwfu8la-te5WoA4sLsf(hr%Edx(
zS=<}#AVwCJ#xuX<Nr(q)-syTlhaWd`&>;K`x_-RQ?hFM?sh|71Gxie1WhwW56WA-=
z5Cs}3xb^+Fox<(0J+9A@T+b95X{%_kfPZjD3&~tuNSibx62-k?#|CTXdgFeA+4Wma
z<z}0Z4CCx}P>LQI2K@ljY`6RyzMsCSt+%J}eXSPv$VBy#ZN!m;HMq!9%*sve!PT{$
zI3dWx;+89oUd~4_5I%82&ORgCQciK_v?zFHm%s`M8l!j0u=;}Bk@YnoN?@ipU${)5
z89CZPp&o`Rv{oU**h4vGnR-`>uY-q0_TKS|D&+HpiR}##vCiH~ZHT@$aO>ztU95S_
ziBPQ9FmM)hV{x<Bz3AB3No24`$|B#m{%H*sOSuYYkY=viB7M>w%h|(3n~Nu=HX0V;
zKIwhuwbu(ie-@pR#dDAamD24;ijPrfb6K=EK?no89@<RtLDD=6`Y7yPx;#+KOR=E$
zp-GCcW1ZEeAKb2_+`LjKV4yn(OR>CG8$<%>Jhc=SL}<C<UhI~y+be&6&?mMd+sa}r
z=Yhx$J}5CymRH$Z4t)|j!h<_QVa~%OLx5qYT&Pt7XFKJ7lnOeIIQgDCut>AU#uhs*
zNh5>nIV5S=dJk=n?QuPhz%&3ACJrdvS%*3*9|Ocm?<54l^`vaHYx|4VNkQJDSYx?p
zdzyTWS|TCO+ioN#xQG`Fz?~f>5T~&w1sl&rI;Oxic(oddqApzMZD$X~CY7}zdT!Uq
zLPsXI6Ua2v$H^zgt)SzDV#|4*Cos2jSpuzB1@SGS*nj2k_ZDsW9udYcyF<eAVAWYe
z8aAwz>%)QTG735xU6q7aorz{_Eoz@#orUBh5r_g=z*Cr9_UC1tgkuT1Qb$Xp;X<3E
z5`yP&yN0^C+_YscC*wBzaI&1#Zh;E;Fjj!GrK0xKJwbFkvi-N)h)sjPUuTgvPGDeI
zZp?}kLbcU6T!h<%4-er;u~Q~|h-c=q%Y@)^vZ(YSOoO|SXVR3xvScCJCmtrW8Ih+n
z!i&zS`VwI$I!l1nNaI?x3=vu4Dt8o5pq8d=E3~r^J$|!VIsKxs<)*jY-8tVEyAlos
z%h&EY%3PKf;W{bYF=n*^fz;--gHBGOP{<_Nnz*NI1<37~NVl5s=8@-!hz~FquN=W-
z7ig<AIw95@&_->!lbh7`?xBKnK>-`*fA$aKU3cBZEUfLZJ+?<_$sZlr6Hh$(P5!mA
zsk8r4?7()e4fcA8Xi^yitesSL@`Rj)Kzg9n6TeYeh1DIRarC5iqt-tPll7%SS6Xy^
z(bq_!X<a@uN)7|PR4i))3KdWpiUDRxLqQ`E8Zn0JYCKW}$29hBv<^ex3Py5r`>5(x
zL<V#xCN~AY<iBZVcX%{%or+HGXgIb&F<X1f5E`*YYg!T!tpkg&?6%j)DI0*yB8wth
zs8Cduc@;p#Vy7d5RhQ3Eo{y8(M+0jBTDRQ-Yc$AzPEzRI>uFX_WXB>=1Po+*w|9a7
zxHD1Z8*=hTXNNRYPa}H^7k^M%c_2vOq%SXz<ot^dig3YaG9W6r-iZzz*rlLN*1~IR
zB*|mZqVOcnb#Nmv_u7vgt)DKJ`O-dIC2+p8mbqIChE$q+9S)^fMistsn8Ghxr#}YI
zx{2&1mz#znh8Ch*Hn-(rTpp+eiSwcO7x33KI|E4si0$IC5p=ig5O!c8q-z+nZRFqq
z2u;HiD9fP<!|<+6WZ!J)FfZmJ3M3gjr5NG-7v^D=QO28OI?nXa26wP;{r)yx6)=AD
z10IH3AH(gjJ^uVdEH`icR|_ILcB@z{gce4pqj!yBh%kdv!O3C*mrW{*3p+nzM{_jL
z3uVQq0!1IbmitggUY^T0YTBeWWAe_@sMx8pp<S2J!D6n~TsPC)9UEd}=xuUuKbzuH
zXeMDIlAuUNte?y-R9ml4LVYnNj}i*59rLy#&!;KtE)d%&^wSDpFyPX}YoJ?*X)e{T
z2X6SgraBfWcWdJ`difFdmVNS%iqEAO(JW+Ak1W>oirkpb`P;@VLk61D0{PUm$(n`L
z(&A}DPr{=DDQeIdsMsWKZ1lo&H*;K&*=PKqhU(!F?AS>@iXqoVl#;>Ofoc~nD5@&x
zCTcL*L72M&GMc$Nz04#bdd7!*R6g9B%hw&QA>hrnH-nQ!<V_-?3fUL;Jbn0hFqY6@
zm79xpCrBPB)VTKDRz|}&EgBX+8sxTMR~ie=UikzrA8hy_wwy<yNQo`DUm)!m6s01C
zfjj0`)8d?_`)W>znRoJcL?J|xG!`fjQ}B@VB8`-DJ-yp{ui7!T=ca82P4|Fg^9>wp
zvOTuPU#~*~<Pe;&VA3TGSx8~>=^Ld7!kPxNg&Gl(gEXiJz3n%RW@N5MlBH8cQDVx?
zX4j;;v#(Y*@bkdV5~=slG9#&dC6REPY4(HSvs?~bL-xx|3-(J0wPZcT9BL7!&JPOY
zIN*H-3YXDlT%%ox1Y+ezv0FuL>L}j9rWd*bc-Wm+)}y=wG0T&ieG)97cPzSf^K#w;
z^|AmBczt%r*fqk%43i%r+of~{(R#+3!{m6SOD}e1vb!$zsiW}%>IiB_8eIQVZW?AQ
zAUc3t!FgS#zzlyT6S3U<{l&cW8CMK#qd*rG(<15PSZGhoB8wm(C|X;=Kgd|l6h(>A
zAw*KW)wubT9UhMo2UAszn_i019taWTy^yX0dM28u9OjuUrS?iYG6jf{%Q>v&9+Bzm
z6`ejl$|N_63B-anYWJ`|!vm_krchdqGZtJ?%rSpkkFtnbG=l#(o!Ya_a#`91bIzAg
zv~z)_+&M56Sx>hdsTw}<_)vG|t;{6dd+T7M*&q-m=4y+bhHe}vK6p4YV+w*CKWHD5
z3AItQ=Cg(b4{kDs#&>TceH{5vY>(}+J+8~428O#zM6r&ON0x|)k?HY=&1r`ihspV&
z<<B}cq9_p3Tq%(Prnh7P$6BBw1-NOHCQI%+#@7NG14#h|ry6T_^TY+5(J2d`W0Ano
zv9p6YJZbeoh6q?=!9GOrE!%cj4<XS(5y3h$J7zeN#_lfmWFh)I4qc>KGZ1w26j^ut
zFVGgu5$N#lM!_V!r(Q&~wi*B{9fQW<U7dXiz`#C>v&2p#9RLEhPRn{bi_)G&xw4mQ
znw524?b{Yiz24az*iFEtk^KL1=DXzs2ub0H+ynTK53RgTF~v^4NCo-G>I94UE@_eN
zq;nu0bF4<QiL^%=P)3{5dq-!@QLO7?I((2sFu2hsED9|Fp)Fi2F#9P_!iu!Xf`(=_
z%09`Ry<F@9AATD=M@&OT3XPM1DLzOP3!uu_C_Q<->iO`%uW;VT@dG#L;IJog1xWD3
zB60_Dn2sGV7W0Nh1h0V)hF}v9ZBzT@(2zy$#&D}qD1pkBW#`j366oRK*@;Pvq0mm@
zmS{W7!NhUuzI!|?Gc3sZY8<!ZjP0>KuGb+#fj02N;O-EPsibX+BwplJtwpef0Up{;
zf2QRdmkt#MwBy=NZ7>GbGS<WRGhWFTC@#!Lr0K1U&S&$;)*>n9W<)bI0r$dG$?|kl
z#~i4U&njI#P}oc~e9fV>{%zJ-^Yl)yNoV&YNztHD7Fo++JFa|9BT;TQu-z%=d>2W9
ztI$@Dr|7^ZbNsVjseOtf3hB>!BierJ-64KgR!C)L+6B(Dl3#>8XY-C=VhtinBeF*X
z8lkIrkfTL*R|Ztd71VF+g*KWUp$9s+Lpjh9GNRlniMO!a1<qu2EAY{C0fyltg8Ys=
zf&^%Wrnf<&T;_j)U5K_Nda30`F-D~P`3UVY3=E?@0%5Yd=#<rk8Pu#vL`AVI>?Hm)
znmf(Qxin5)VE|(m%G!a~pb5r~{((|>7cg%dWB@s9SjgtY#fkJ$=E$I!Ejnh;45=ki
zg|zsB9<l3yfi5ksOiUuM3K?8NS7n@c$0Ch6;hcJm4K-kUEev>#?<FglOvFaIJ<NIW
z0j7awy_g@u^@F~Ru6dx~nQ73iZIA7-Jzn`yEuW~5ENcYKU^}-m$|7E|gW_I;pspt`
zKG0r5*TfMF&1=QvLs4pLSH!iya@kS0gtIM-NqSN28xN~p9*xZ15~7og2Y{ewn5tON
zSalZ*{ropGoUdM6d0@sCV;kjWgrx>Z4ixs*Bc536AeL_Rce0ODfi`Nz%o98kZK`lB
z-AoKWjER=ZjT_>Y8nIS!X2J!)%HUQ~2#X4`dg6V_4m8SZ;8IYWfDF;4n#~+#CK(2!
z$A-BYXqY|Ik(=NFVMa(<XE9`SfbEC2S*fs{CkNBAiI6vQt^|Z|Vy83rLt*ceB#9s$
z6bnRFD{Bm*a<brHQ7`|tT=gU)#DXDFaRIqohvF2;l@kX;1&kDYFiqADsFk9Q#b`l~
ztWtQQ^iiBkh2-Kl6@t-4)XC{PJ8lbqxY3{I<ssqbgT)nOhe(u%VdZL!9{DoT`WOF(
zodYl%3u>uCC{#!54X<USWlLsDPcb%;MG`v~rxfwp5DSCXAFc7sE*Ko^2ZElHbc7F{
zL@L$#P_7THLtVR(k_rSY&$Gd{$M)DBul#TqJQ1Eq4VMN<^m0cU9_PDpufo~<m<ZAM
z8o09~N;lhMz3iDNF&gVylqut>YXV-f-voE3$Imv9Pw8?k(E8)5Acpcnog0}HNN)>N
zh*=qCS0Kz`jb@Hl`C93sJOPAYqj3hKr((q548}4#DjVsYU7P$FK}10d6l*C(*hymz
zazHo>Eay4PQ@CV1^Q36hl$j$Z)BqH=Hgm0t9B@Sy%9)sj_<tzEP4%1QXhk3j49Be6
z&GQ3v5gTN5JNhikkJ`dx-Xtj9<1hs`B0LfXu&DYw5lp~=g-MK&NIE?Yn<%^;<T{U`
zUly?fg{1MDwI~HEBnjXU-wqAahPgHJv6>UbjT8)D1v`ZmHK?asKJcA_zSh0$smSu-
zfRl|y7Po5sk7COntrH{UktNq<5k}lOnMH84!=t`@U^5O-;h?cu^*r|_c25N*u~=cQ
z1y}m4{2aU=4J3mou-pg)X{{{A$=x0gO5+Sm%+XNKAk|_qE^SoG5hBoGATmYpB=8}2
z9(d^RA!GMMhGRFfg^L0hwj-|Xu|2NKQMHvJ)PA8DyAahfBE&}>(6z!j13#OVE3?;Q
zlo~hGHsiv}36Mh(#+wW^uS;<y)OYnBa+^hcA8N{QYc71!%x!tpD-GU_4bU;7pc#y3
zpuV+IH1J{|aWwTs&2*kVpKIJy+?;GjJ*r6z+*87&Y{WcjBM#&T{s8@LqtN2OI2GAW
zf#lJVMjt#OStFw8)>xH*p$&l>45J0gq9jHlk(|3fDWRiW?^*;I*h}F~wnQOLaj(t~
z?2Cf2UH*rb-PMB4@;s87N#k8_&n<Ah<y|R=o6qDF3`A94eThYObZr%?D$oS`ytK*S
zO$8;si`AB2p^(Y-4JdjfJe03zUo&W-N1L!8CAOuP)?#k`YM>_=la0CQY26so_&U|h
z(oOk2J1o%zS7DJxq(yE;)}XN|1(W7hgRG_2DfmsqtSONgf`<<<*c|dQ?!ct4s;z|M
zFiClNu}D@(8Z;M-S%enQKOuPD-<jFfqeLO#!OBQYrJ6vR0nX*3zgL}?RWac9*dE*C
zl^@C5fPK;;-_@UOlVH{wHPSe{QJTCPH;7FbVx^vG&W{a$Y@C*!qY4;0Jqt$?+D~)l
z#8o&Q&&kOutVX{$0d$#QK<jNZ%!PmrxIxYuO#sEkPDb2rfk<#c&Vr{cqw->01+oL)
z7v8CC364T$A;>co?ii%EXW6VfYsC@gNZtX7Wv;zd`?K+sX01<L11&l6<k;Ap#=}IY
z$<ydn%;D_OR!td;xR4i6A3*|&1@!?)vUF6$xQ`$M$Bl^&Plid7Pag!uuyO)zd~KpH
zj*K^vgG6@Mb1eNLoCw}xcC;Fl8BKO!7Rf^P{ra%ch6_n;L`DOo-~&=E@VuF7o@zHh
zM`XgL3B~n3XBxf7T0e5SB1JJ;&?-c`Qix0`T_A3Brj{l?c)T8NJ}jaZ*lxghvKI9y
zrXdnXvGY)*w+?4{%K9mJ(PHqUv<XT>l}}>bpXE>kDvhR(Ae3NW31Z5L{XpS0+J@AI
z!4-Oxw<LBpoYwi~V|#3m?eWTw$tB$nhCjC2RFjm(xF#S9k6|LXX=oO}fZIM#i!+hK
zXj5A*c<x{0J83n6wBScIy)=`La!HRha>+#aKo>}Ju%55UFvvmF_#UB;m{rZh@B@1}
zF&Zkf$TY1^svqRiV@cv-AV<!)V219aqlR%%BHy8_)Oz~5&{}mwQo&;2rdS28))Aq_
zTs%#W$I4bTn~WurTSpNQj@}}4;tRf}?G*8Z0LsS4EI1-&SNJ9BVWKMo7DoCtmN#F)
z<)QrBj)}a{c{(p3Ajkrn<au7WL16P`iOf0^p(2yxFLYDw_#<=zWyJ^V1~q+&;a#KN
zF%eI)DK-E%AE;!fmC8JO*cBO$jHn(p_?%cRj<h&u((EWYyk-w}P!FJ5L2(}yWJARS
zV^CX3;7Fw0E4-|+6HX;Px!bX5;e$u|Fmk*|zHnGfGtE|T9~V+7_{`&iJfP8ewK4h+
zfk-a0Taj%F4xlsaR+^doBc-JGJTpEp)!Wb?g2uLaT-#%NT&II8LpYvSb*^1ijFOKQ
zLbYVdL@5v&vlb-x`3u=oh7}9N9Ks<?hyyP-cnWdjqlz4=evD2DEJg}=%)UMv7e_{j
z_=df0j}e<T$%>VtX*$^1gl#I0?9O=JZ1fpcqWQN>ezC4KO`alKxE3cRvCt92c?Cd<
zXbHyX=MvSe!t1XUb0L9qYwldH)+eu@%T$`$oH6>^9W*i;lK=(pX6OiBs$n}5n$gaL
zGY0#PL1N=BxY@30R?~W_?mG8ebW!p4AReYOu^<AQcr1hs7iH=i_+3I{I0;bhlcP+`
zv5cvhvgv0Vj|;n;jzdsyn5u0PGw%pG1eoNSbOA&%BrdeHeF9u+{L{d93~rLSKU43O
z8wwu+>1HRXy8Q#^Mg&@~R{2?Jrj}$NnMAa6MyO<I#Xu$*vXevRE$N-;|7w?!Smt9R
zB-uFXYyCm4O}!yUw|<EpdZ~5-bZy*SMD5<7D(Ac~2>mj`#Iwn`3Ca3_8pl^x0&-~g
z?C#gzYbVkrd*+E3?CPuQ^0&ud;XxG8`a<29ccC(o4h|MIs{x2M5!|p2MQ`nq67LDc
zG_8ehvzOIEO10xw>4l;sYKvM)6z)jRB}F>a=*7t#?a0U=kuttnOLGeY1_6_x&3og~
zM`Lm%BP2!>@Su4*i{9w()vM5;1*$!>Y5_xRoh`i**dzV^*mPKB0N(=Fe5|F(gE4te
zTe&7_?iU<nXwAo3$3ho{V51j)kl-}JQOmLtPFm`$OqpED$~ta&sSs#U&Hmwlz(Rj5
zWMl>9UBQf(uySNbG!Yguuf{C;BuEO$Pm+v4QSBz!ncac7cYGeQQi(&BPNBk8xNu;|
zxr2&3Y8SwIlT@X35#_vaF3vvW0QA}i(%qd?W$sn%>V=N;sTlmhGqy<a;UX~^E)}zg
zS)5Rj^F&N&DDZs20vg%8llwD@duZhnubjy=kwGxz99$_r<A7DksVuq-PRne$%JN0j
z)M1nW5wE=&RD?q~P9VMUj$pHsci8LS@POTZdKW=Bw!He1J^7Wd+OwBdY!!dwZ)>dE
zIcaAWOFMgEB~(A#vE7{=>(&?T(yIJTchc^A!yD}O%@cO%scqrf9@qEK&#BxY@N>r*
zwr5{i)lYd#&BDNyyz>P&IavxD_+dysdzV873I)g$Z0|P$3CY)miMSA)y+?@Th|0q#
zYsaj0WH$7XW)N89!5}1(!CKu5ed*<dtTdUcg;oAlLUUPqQP}(SDw^hno16BmO*O7}
zMLn5{Ek_`r=J(0p2TZ}_=umWh7UUpG;AY4+4gWABZ2Z~;f8=Zw)d{QqgmfD5j$Lpz
zbsI*_t*AZD66wy`;~5k`qo^EaI%&XQ62`BdCQNo-<3hPcL&xYi82^SAUUZ);p_}ac
z6p4;mII|sFo#dJd?DL)}x20h**mzzxNhK7z1@{R9%f}03DWHw-EZFH)%@CZ$_qmQt
z@mr$SQy?65{b*&joh+6(Ae}XY(6|=5dVtBe9!V_WZOwriE+RId)ue|TR|$ruVhQvi
z;C%2P;DMfF@VHSihnomv!TEtE3XVZOf!luaPa28HRM>kIi+bf^FY!EX#KJYZ#oq8e
z-)}$o<~z%#qvJK^;hd#sAG7B!ee-XN-L9Q^-S^rDZu^}5Hy?S5a)6yvciMw*dz<Y&
z{A>0{PnFMpeZju`iI3Z(d1)87N`UQg9gk{Co2KN9?0P5W5qs=On)FF*`}GQiq@Xq*
zyQZ^6hwXW3+rdx)nNqDM!;7S06O*pacCsX|Qyb2lBvNy!vffsS==fif^^{tN$3?{)
z)hYN<0hB?SBF(+b#n8#u5Y}L41Sa#>GQKVm9vv`{v!!uPcGe{Hr0N36O+LDinJySP
zdY4N@m#x52MGJtejrv;HLRkePjTgbF-Kc|3UJJWoqs;S62q^iGQ0BVp<n&0O9i|#L
zL|dWU<#qWGfOPiYu0dtFda3f6Y9`i9pX6W2$Y-=3L!;ovDa$I;<B%11l<j}br9$Mh
zqM6|d*7Njnujic>XjpQM{l@lo7v=pox;a@MT2!hBX%9qAjj~}Gr6FkPOc6MHi{gh$
zgO$~~!yBOx<2=`cNFdlvQ9!pDCk7$VB(zn{OaYj^=Wvl-Ig<gec`N}x<mj%^11PfQ
z_gXuey~WH94hMIYmhB01qp@kg;1}msi<>iuWckv_Wn{eZScT!l1NN@(dA)_t{F?pj
z?|#u<=sP=cde72@B~fwQxx?P{&hNCh-GAER=BhpWrysYEKYVDX-u$=ir~m#>+Yj!%
z##W23*!dTpwX663fc@m(d8gTz=63U+K5k$A^5YioeT|*kyl9&Xquut#*V$crJGLlD
z?Up;v*iO1?PkjE9_W8%p*;NQa_wTZ|zx!SG;O)B>m*?$~uUxcS-xTdrzw`-vF`Os`
z_PzGDdry-!diBM}?V-<n+8(~Jt%$G2gS+}h#X@#>ni0`K!!%Ohnl=;mQjv+A(?qvz
z;#%PID-smk@@;UV-QXm%N{QEeEKekc))|H@0)x<3*ZSrg@7?IVn8{bb#O_W<b~Sak
zj+RiIwDGO&Llr_gC8cA71d$~)N@3_Dn^z;9G=h&kDm!{-u2IW4dSY@G5(Tns+kyJ7
z!IPPJcaqcMIV*(g1yn!cB@jfomo4e^Zp14cmt2=dCz8;iC;*i}YQK6~H1mnw_KBG)
zjoNkcJ(Tu9Ej@WgwRE~rdyX0_a~Nrvju2F5ds~w`4(P+Y-54G5K=VuDANsag)+1o)
zB$uAYpq&9US16$PFEn1+%^q>Lu(%*n0KbAK9n-EqhKUW-dh1a;Ae%H5Q_q#Z7d0Mf
z$Y2?gNa3tXehru}jIdVQPM&3n4_$Pkgqovn>l6idLF}Nze$oTaorD-06Z?;XM%<gA
z2Ma$Gn-s3;Z_h+wZKT)0jEn@CR>J4TKaV;P_U+Y;b@YdJ`EazITW+)4N~^FLmUiL!
zvvvvn_;Au*|ARkiKl(kdwOw3KDRS@o`+v{gb!W#P$eq1io1|&jeKm92*=dfia(3F@
z@ZH~S@BYqGyyCvy^OpD6PyW>V?ClTSY&+$7*uVen_G2G-x4rJx{qot}WUu?)AF&U9
z_x*NyUY?c3E%ui8{j~j)zxQ2sJKp=A@3o))k?*iuXZ)aSv46sLJKG+w(u2K}?BfIP
z#;~B^->QDoJ49;j>1UlY?BsO#>OK+7i3NGmGRdVvIx3p&di$&*Ir#@B{<|HIiJTs<
z*XA0X<s>hjKyq=g$vSDQ$R)cwJo(EW3T$qso+qtX@{x<!d~$79`!6{g+gXDl`<zU~
z6$Vs-Hb0k8xz5b$Sy$qSq-3JRcb(>1<bOEBu&%k>8aQfY3v;HNFMb9zGzRy=MZ=h>
zkcJ-eL~g(mF$*FJMAs$Ir59$jbu?sJh^dE4TEug0=MgYD0VC;#FGn#(W-&U2RK*P<
zTOy69Tr9Ng7!*k(+d(KOivc)#u^@F6wkV?@DvL=lPZo8%5w!7q{MAyMmL2|!#4)<&
ziVGwLgdAA<E+xyuF}q(N{SSi@KuH44ku*|1sEALA5+V2gbyb(ZT@^kAu!O4dFCLf_
zr*ODXp>>Aid`l!X^1RfCR(G(`4kerS*|jUAt~uEadE|p9?NcB7jNS6?Z?pIO_+9p<
z7oM_*zxW0F?4#$bzv<2P{vUm#<zN4Q+s}RYOSay7o&CfA^Z&&@@a?~5|Hbcp(mwg{
z2klLp-?d-()i0D5%iM0idYgUaJMOUazx_-0YhNnu>iq}pP1n9z*s+~lkkqF>V!!>R
zi`KpV$L(MKM-SS4Hy7k|bi2Lh`yRBbzyIIZFZ}*j?Ls<jZ~gb*VgJZ0V>o%gecPR8
zzx=ZwwcmZ@f(>P!7S~&}^{PF5eRJM{&zPNEm}^>ZnEVKFDB38~TW}0obhx&<VGh$G
zylBW-qaqSxbdgYx7dyVU&<@ys__xX;7PC-3hod7pmc}&jYa91Lv|Qg;=O_E8JZVhH
zWNbXE%e=*CHnG1&!53|x)O=?^vdDPr55<k^yNizpCvEUGvj}JP9Ei?BaJHb<@~I^A
zf}_W#9RD?co9n#MCRD1ZDwDDrwn!MBF{5x)1rJSdk_8miDiW}_N2hlMG6qmiBex5*
z9nn_BS}<g1(*?!Mw=SULN0C+RBHLs_Q3S1C-O1Ze$=%M?^G#knTQ96fL+1P9YM>3H
zSk14)NLU~TkoHUFL=9(}%S_n!^7yb)YE)p*W(51E{QYv&42<U%g1Z}QxQNdeNT-Q%
z(oeDOV4`}wPTlNKobkc?L(GSx(L>eLPef74dQimnWP$Ce4;#czEcawJNVu##Ak7-<
zOHfAvU0uEb5m#x~J^AV1vtPS%*53Sv*V%n{z180L+WT$qmw(>=c>X$j!>v1Z>9y~+
z5B-C;8Ls}$c4l|qdt3S4v-X!idOP>z<Mzyp7i?Lcx%Epg*`@G0T8wpP?zQ`NFWDb`
z>3O@l!lvLQd*};~+0h5}9HeLd(0=PP@3RN~_K(}G-*MI+`rN1Ni(kEB+vC-F@aL(~
z$RIh1tp0RyL++*q-t*&s7Hy{9h{$QwSLfE(y|K0(ouuXDjk*x?Yc040$X(Twc~+Nk
zXPUiW9k<f5);h9_RRqAy<|Z5Dxltq$d>dPgN$f^4vz;WtO>orTX=Y`vD)LTM5_^#-
z%w6s4J&29g>~W(an4CmH-a`_>B>L=K#1ltk*}WKP59kKQQCtLxv016a7YMb!HzI;~
zM~$wGLr!&uryT+XW%>*3`dNg=>^_D;K7Hj22BHjEf+Uef6#NB^5z>MQk~D|}%E)dg
z8Cb$qoRU*EgUiP|8fHZzj!X)Et6~w2SzEGTQ8A<^VF$*ZYo5$^1j+l-K@S05m!f1h
zspJNQM3RvX7%fR1-qWrFSAKAjg-eXdQSF0(#M6e>Q`CiJpPUB2o+PR%(OS@8viA=Z
z#SXq=<0zd)%IbAbP`UgW^E<pQ3i^q%LD*a^v#<TejyA;qPQ%qbra7>`HfW-$u^aOk
z4(+)w|4I4vS=+t&etZ8v|KHe;z59>ti(d@<xAQN&XfIw|@=MSD(tl-t@br_2%(TD!
zG5Y=W?HW<8cD3A*hGTaa{j(3W%aJaA-hSohF57D#xX<pp|F!o0KmH-R`!|2ie(|#x
z>;?t1+vBhBsMbVWDopG@C9A77rp5UhGDZsg8JsaHDY-02uI^ZD;f$UtWxIB(l1;RA
zu?{N=sSG+96VT$Q)jDQQqsMpyOl0U}vGGPrkz*V$EQ$JDtU)d3^XLkR{1Ci*W0Pkh
zV?(ms>s|7t^<^^rwh6s~GSBr1BuWPeHW5mq=NGEgNH!&7N-}@UrViU6D=UUjI_e{M
za_055?L)E)Q8%y#!&$x+Ii>Ag4@4Nu8H^l!vmN_vF)_H4>&4Ezp)&?rUPBydF1vQ8
z2h;`@h+4seyr$@K5%d78M}@5gAI_mAc|6AmlTa88G|qHLT4>8cK5%9P2Io8?jTv*K
zmaghJ+pdwWLX>`4Gid<l*8_S!D|#~BC&z!B`swZ2X7o9maNSs6LcLWMj3ieJJVPL;
zG-?^*ro(8`lAyTgIcm9TK&w{gF@;{k#<qMo%U&8ch@$B;HtH#%msqR&YaY}lQ!l?)
z^=XQ&dfPW39X#yaY`356tUtJ9R|<>`-Co&%jC6rcFFs_SfAJl5i@ji<`h(BfrLuFI
z-*lVpj~B~T-cs5wy)ACO+4jr*zJmVyuz@$Vow(^lc{VQcp8Z9SbnY>G{OWt{?Qg%^
z{^Z<MJD*P3+rINb+qEb8@A2dvcGK{@J@lz(?a61ZmU-EKU~hiSDf^8lckDH<d%(K0
zpSLeQAMB0?9<Y1&kL=;kKVq9(UT3erYu65*{fd3{xr1$i`<rxl)JD_#j4C^WkDU;w
zewz_FVBRHWuUddAMv|?tEeE55AxxW8*+Ho&%1|RrBMFOglb6RIPegNe^R^?|hRKNv
z+L$w$B8`*gi$Y(J!{~iJPA$SZYtP=c%<kh_=U>6k?U;<BQIDwfSpPcB^dR4vY1O9o
z)Kusg+2T9|+SsMz_FmNm_q`L%OqNl(wm(tiv(`48YxMH~*pXH&OlXW^Z`mAW&a%u0
zlGBznh(@{F%FpP?FN7MaBn&%@eL)E=kxFY$xui9SqDt^TAR5i8gxdIFg7DC47o%IC
z-Y0Mk&{S9MI>f$`R;dIR>_UVm$csfj5j8Qox*zy=I8m5jR%Z<b2p^L&DrI~W$}YvT
z6<m*=BZD^O80b>WolaK%6|9|RZaxeM)y_N006dzeoXe<enIL*RWdX3q8s(nBwnKIW
zxHB$UxZv3s6b8B6jNa-M-8B0LpBOf0d}tU7w;3if##pUf9Esg%N7%pHzWw{Y+urs1
zTg%V;NJdq@^e6WJ|ICYaaQ<og@Gty<{rLC%p#8J|)%WY6-CVU#|H}W@KK8=Op8wKk
z?3thWA^R8q^mhBgpM1=I=gH^nv8RsggFp7q?4READf{H-p8bo{Q4Sxq-}~^V>>s`V
z@7jO##w&L9>Q%c^2E@zSV!!p<?Wcd@&9;kyah%z3?oaL04_~%fnSH(Ky+359zWA(t
z<wCZ5-t^t}{r8-=%a1&12lv0l-u+#-*oz;3(H?#NpqjR9kG}zj7J54t7F)F~%F4p>
z0>!yikOPFdi8y7RS?xM7{u-}xEIjTk#1$Y^HloG{Rlg<I3K@h`JWPnC^?+uz?y6oB
z)-n5DEuHe-s^dfF_E{8zQLD;?>ge(6gRg2kRo#mG#7OWEojyAoG6`Lo+I}c9xMT>D
z5i>&Lxk1QO;KBV49hsUg!Dn?@ZXl-nIHoYs>KiY{W)&4i1qTnwXLZUUBPUJlJM%eL
zB0NNyAU&S!74>*=z(^9ARv=7Z(M^t$fbY1#4>~FHVnKq11s}X=*3;Gx!o2E7`FxG#
zHN%jYrkqAC{F@~D>6}KD<22AiTW^z&-6IGo?Re)P!jH0IGA*V?cdM^$MAug2x=V0o
z4Olwf`z2D%Dyx_?kwFvS5Fh9}DE)-1-SJ_j+S?9Ja<R$xF(>(bu?5>!k_lLq!CSMD
z9}b8e%<L+aYBR1ynyEC&toffj;}tJ+EZU1aryK3a2QS!TU;ezU&)-DbuCzI@3(r4g
z4?T66&(hPM{4M*{3lG?Xcb_Rpx}eOXOZM2svRT+1+1Wq+sQp}e+-{u>cIC>_R+nC~
zPyXt^w)GqCuy}ONE?#)v&VTf`?5q7nJ2zgjgHL?au7(Tt^cCHRbnvMC^1r%l!}FJH
zm5%Jnr+>?Se)+WBeR^(TQ(Bb!r|qY{tEav&oqxnW^O@fEvFRCBcJ=Jj_V6PY?VuU$
zQ@{J0cH-g%nmIrAnUC4<#9%Kh%lAG0S^L=0jvc*l$!<U;!uEIthh{69wUEWuI8noq
zRj4hkQKST-jcc?>v(A}!+1w&ZuN$3)Uft38_oMRqvRf??z2ru1ym$@!Z>XWZS_3r-
zl9N!|X*{7BkZ9w<H_SnUaA#ZR2~Fub^*W)xPjn(gs4Pmto@qX1t{p|8fv+vXb8A6S
zQnQLrH5De)x)HmP-L6K)zBE&>Jxga?Hm2GjeVhK<L`A~Lyf{g6g_`mof5)C?e-_-O
zK}3e^AJRlo%$o05^4@AnY-vTOc=yyANvr?_My(c{F4`*A6VXBJL|G!CSoC>NXrudX
zrO~ww28Rw6)AdFvnw@_LSlkD1i@|zo)Ax)wNq(L{Y{9n=t!pX-B(;laU9m20Lz+kv
zvZIp0<-oRROOiwcRel~>WV93N`MwO(%tDQ`MjE)mO@X5;)pNNg{Coh}8}*dg`}I69
zWuIl&ekn?T&iMs$U4`8VXz`3j2^x~}s$uP-*9EfV9CB>z#qM_d<AXcxx#ym<?eR57
z=<M_zw_A7gl3lpEwlu%p-u;jN_x8WL<5%o|_MiWbUD_6&?P1!`-g?U|_Tvv+vA=cd
zaiNOF9WI>8O#+qcvMk$_c;2)^DnMcka&%I{ICyJMfJ%<+9;Y-8+H%+KiaIPoLM?BL
ziOo@4gjPqkT#K;IEz2fqcdvC<dd%~+&T^fJlIU<e6XoKLxf{D(jh{D{a3_a_I@=3A
z%TqyPgU3k|Sfl3iXw`!d-6(X`U_y*_6Z0sv1fvXZ>*@M6)cKZ8O!ew<DCI%+K*~m}
zYB0<PQT(fg$b8W#=TJo{JDbGFhBK$J4^{ibMSoy%OIawRLO7h@ENJ1?f<6dc#OAoK
zis75dy1w%wF;amZIFmv{4%dmkF!d0lJe|l!!G~RbEdZmFK1dYIwI>$i4N%Nj*kC}}
zhyt%IO*p1gI@01V7R{0GPd5vEf0WY&A5frA76oGw;cXj~_{^P1Qt)Q#U3U>>xngGS
z<0#}8z1<r9sU_PGz38YRqbU4=JBu~@j;+qS+-tOvHw>~&@+eH&JU~A-UbFMksLS)z
zw#PR)8awmG@3#+q-y7`K-ImX0lb*N#`d@v@u554H_V}8EYof_XB39CqkCbW6n!~ig
zulg<{GAKXai{sc1b5fSX%bJ2>l)!F_$8+S-B`w#CX@oZ5ND-!vl4$Y18hZ<`#*y&v
zV{Kmw3E~%xfb%g|fd$jd3#>N7B2qXh!)Hq*n+@LXbIW?QP6a(#%F4}QJ{QL!n#o~p
zTWzxHK$3Hk<WSBk!T(Kuj<r1)CYEF+YRG8>0&l0jI|{@-pySfa&yp#@<{E)0SeD(L
z0R;)k#E7KMc3dq%dKiM@IglVs=XMw{!bS=X=s+?_p^$99xgYz?`>Lb663@f|)oZ(>
zMV(9GgMhhiDzmgBxL33?T5Maf5bKbXjK-{R%O;8OCwrDmk+M|cdFt)bMcI3`feFQt
zH-zl;;PKULB`WU*MXGnUA9gJJJ3^A^(e~xdL9j4)%V<Ky-o_6UvD7OPFlZLT6K=fd
zQ2W*DL97;F<hKmTgDw5@j*0U)A+|6LjM3l5c{U!Wusy!XkvI0-=YP+B{oLod`NC?k
zzWS0q^UReksbYJ4-NCt2swodD0<E|El*H?En5g10MiDBoaGST^s_$U^FB#R0O!D^_
zEAhj1Ta#qS+?hwes7s}BZlK;vS}M7(Yn{_VPZC*jbKekrrp6a0ib+0qs>MzDVAnDv
zW1TKJBU{9daLuxU{I8vzmYZhGw&dj+$fm>^h4g04$1utmMd{zTAUhnlV50}_a(u)h
zo|XH=^DPB&EoY9_&j)TEc&%A00$xk_$hMyR@vw;Yq+Ms)J3$iwS70~=&Rf})NK}g!
z-QX;_h5?a;nS(^OOET^>yj%5hr$D=FHuI22-(Ad{aR>CISFSoNd05fXC@AMzqF=Fl
zfDl2J;2e!Xl@)pqgx<)mqDT%xUb@LwcApXIst?`JFA)EBb)A{AOmaq&_g8R5Ivyf8
zi@?4rw6k(EM|a8c`J4&vc8i&kL;G>kdaVbEpo7zENFc#x06lHcO)>KW#eSX0gp95a
zL5W+@jTu+d%15!+xl;d-)r0QcK86qLjjBSvA&z9r^Uv5r<=6Ju9)I3Z7i+cBwBZ%w
zIdc=6ox}j-QMFc8JiJ+%DB*3K+HM+^B$_v16J15f)g>qRd(zi5)M8?MJ+vT)jmLnX
z2>Hk$d6}cwIHalYRphhY<hslXWu@#0&{3H=0nEEnZ1mtiZn1<K&^no}w)8Zs6TyrU
zpU$Re7ye7~wTJ+u&babq$5%CL-kqE{3(@Cfqu&qIiQZeEwQiziINL32;JU1d%W{%O
z<lDE@5Y3(0P|4sJT#vD(pI%eWa#j}S8s@k=o3ri54+pj!<=-SERyA!bPIe@8oM;*r
zL3sLYSb(BP=2?tAI&#2CJ<BU;WScNj*qnmAy694Y^BdJROQTwlINLca_gmTSQ!`*r
z&Zr-pBP!C=QD6q?0vc)_PzcHBka#Z%6YcEG^w8h~Dc6thY2(O;aCGXYtf?}K8;CCO
zO5_k1JCW!@?hsj=RvXR!&{P};uoXr27#q2YtP$T*&L5kEk@~Z2hvoa$8$HB~#qKp2
zW-%QlK?u~#eJk3h?Xf+!$JZV;tyrxfWd%+GS!lN4pg!iQ-~=aNsfg4<AS5$-d#}>l
zD_J2<n`@6yiJ|tHOyRO4srT%*%<`1+#r9?NA{Mb`XikQe7KJAJ{{S)?PlXS`Chx!+
zN;&y3dS&Q+>|s%BIJ#TZ)4GW-Q!Hk>2Ar#$@RPTGFx`k0I%ACrZf}KqD3b?m_8THG
zX;8)BR^mv-mn6s0Cr|fbwbXTNHtNt}G(*cfUQj7oFx15<V(G)2spsrPD}8j=b!exq
ztl<-AL{A|MlaOp-(i_dZr8X;zC@hYSc=Pmc^pS|tHsN|<d(<%XQz|L){D+>iss-$!
z;ErC-tuOBh14#;o8?gk}u&Wr>@-B=sTg(HCf`ZA!aO8!rd(tO6Z{G>YseRb^{0VU-
zi&9}2RvAHIZ|%Y%ybDV~$8I8Mb~luBgB{gw`P!rMUT6WLFwq|oGpJHzmS9_!*9IF9
zsA}O4WGwe&f4}7oKiZ^;sf15+tUS?jO*2QRh(|fO2)s@pysp(uE0w~(*omahGvT1|
zo_YD6q21<sY>(}6J&x*==bB%xSCr5+K2kv2pYjw@wpVMBIJizas~SttVkWj-@+_>;
zXE|*1jh?|5HL9T}V(?^%Cb;%Xks#DNr79S<sq-`rinnKbZYHD_gIL)>UHCH=eH4oM
z+_j%MOa{5!48xajrc+L1>HhRJTvGET%JjkT-Xs<!rM{Q($7&==L!#isjk!o0LYyd=
zEQX$is5C3h_Kw3P6N@kf+UyppJ`8<w1nMnCpshJNUMTb+^r4XSa&<?wh2uI}baNn(
zF0x&Q{w=ga=x<_yrvS_l;MlY12|}xAaW<7jb_h<mfF~b{;jDb&nu*2r@hFQh7>G`J
z&zvne3lT-dM1gOZIn(oD0UFvXXk@3H-`WC=eRG-OT{y@T1}8Sw*p)U$kOfm=0^D|2
zj5&8XrO*McL^;Q!fM6Fj1hoeD=YdQ|wESj^Na}mPQ7i6fh*R$x2N2{5#1f#b8aqk_
zFu28oLi?&g{$U_gFg4j!$YyhLD{Xa@=@dUNh3CXh!v_N&+(41XpzA_WFKCQRptXe4
z3q)>v$Q!A!O|<Q?J+{XyKS)w&g;LsBXI*ABUIZqw+<dzR32P#LhNa8Ooc+);F1dYE
zFXLPakKJj#>Z+2@oSJJG&`fH#Kwd#bbeJh&O`%pQB}Y?Q)Hh3scWEWn)S%qP=W8}4
z8n^!SI8fN?EKY&H<|7L^#0!@Nu9a9hySb-6H#M^Ac-D?{MJjT1euOl@<$M>Wg!ok5
zNQCBCOaUNvbUrA87>k&XK$thy1^1gx-ZE6J(r1#An<j!#QHl}1aFiniNC?_Zj8n2@
z9%KXy7z^4s)Y&09Tr>%b1KWalQ%TK9Psc6-$R{c;L_Jf%Yk6voDqNj(0ok1)SVT(;
z5-GsFN0M*|h#f(}&YXdnK9I&gp<$HX0Xw6G=Yb^`*Kz)bHXDc;!IO`Jb}<{q5HyTz
z*`0|QI7EGLKuGAj;xZ3G&VVz0x%TC%r*2}|>ve)VYO)0x<fy?gwxr}vpgt5<Mj(_E
z+~38{t>J@uls4sFyG2&n5TJO0<R4rEr-7=Nnt2HBND?^5!`&Z-E#lf9+vB<&*%x`R
z>YOaWIeAlE<Aq#;&z<ON>i&RHo(*MvNL(Xh;~W0=n4nNc{nfaZZ0ejRxz4Z=QLO2t
z4`uLU`S*1n#3kr_23OXH*#aYxk<LC13KDp7P4c##JAB~#f-L=Jb7yRiFP~BE>;#|L
zIRg+HwOqS_BE|(LhoHhGCyroIZEIq^vm0yZ<tRRyJ87ufRHjVybwn{1p+#R$ado57
z5Q@}nUfuL-KBT8dbMcD``oi}|a1hy>R8kla42lC5^5C-}d;qaiRYboE(Ik6|Io&Hr
z_Q+LytG+9~cjjA`)(yXaV3;ae3d^FEIW7CWeec4(p|r|czV^YYEa-zHy3)`E5d>@W
zstkTG6Uua&h;-V(`IBDBxtT*!Xv=_bd{9XyAqq8A?X7#BAgFNOm0eTAS>Fm4B(Y)J
zE(Q%_4~{kzSl_hM(g}oc9N#l<JWV;%V0UNMu%Mt2LS&2UY@EDqr0tvSE*ch6WP8n8
z{T;SoBy)IjGR_~x5!e+P2|S!bxxS-PEGzk)*OT0<aLdiu9^2!(95N=*@1rxXqtAXs
zrf6N@Ys}*dl-9VGtG514>i|L`@%OW`p2gN@{=U(VoL`waCym8&7$wo^W+G|;oiKW-
z)qE>E-+)H7L=(xGdgggwzHx5UPUQS4N%92ZSaQ+_b+b-}kX$JHEX=qz$!qc0=(p+g
z9{nb&jTz*1ROeH8Ul2k_E^p=Hp;2F;T&Tvs41*Fm80*p;$FfAfw|H~7AI)d7xB{EH
zRiDvz_rzdqDGD|jEOu^Bf*VhWTK<f=(Y#>bG;ZLQXQiwtxwqWhy;3!6tTd-eo(+ZB
z6=qeSg7dOm5WFHY&vy|Hi`Qiag<_8o#j$+&n{~?@H*27?QM(M~ujPMB0WB-JX#M3P
zprkHWarv;PmVu1QSq(l@n@<k&neO%20F3_7%o-&V52fToP#m~Jip&PvFc)jI{YB#l
zN`|~=PR#89L&8nZ*5}~&2{Nx;($zI}4Q|KO2Xj4JWda4#ML|#*MZd9Oh26(MI6X6^
zhblKEdBUj(Ee#DXM;1|tmx(HqT|>dOEggP)Y>(@7xcrpA*by=rg6}Lei$P~e!Lr7=
z4y7~X36zca!WaEPCeHm@t+Ul~;G&z85D-v@W?e#U>U??hi0fn9R=Q1WW|@#~vW~)r
zopY^9BEiPIJ$CAmk!M+l*X;k$t_h-OIeU1(Wb#>=Uo1yH?vaQV-eyo*y@(RQu3lA2
zJDB1a&!BRkJ<2#0tjVP{Icw#aI5^=#bGF2;5IhIv4AQt8J!%Z@YD1zL^T((SmbSOH
zD#dy?chhLp@?4L{VP!{2es>-1H>8FR1r0!`yDs0fTTs(p`MUwyCL4U#73~O)@$1Y4
zV<L(2q3)E6o8f{;(s02sgv*VSF?`U;_!8JRm0b&wT9ErN(axxC4^WUYUy{j%1&E|C
z?Z3_r26)T)j-ZjzFLn;Qt<WL7vT%!YP!g9V?N0E%_*x)0IMN62O=BL1&#DW`4O`4-
z6b2J@aR)Y*b88Fw8uS5oMms7Ldpw_s6d4u8>=D~MztI^((3Zhq80|yftTgUDwrEi_
zgB_ICEVXXsCS55H-cI@O(HhO6<D8Ji)R{U>WpHwMn{9h+kL_`Nj_jxl?KUjnoDU_X
z5W_?kBa+ZM1%4CUU>ABS%=ATHhZ*g12{IVg5+NXZ9<oJ)cS(+j)KY6b$ab8DN29U?
zTg}v~g9MY?-2j;TT&{~MGFVHND^Akg;X@05>ZQqTycWrvJbF}8a6iPrc?wb4DBneI
z0G2gTOlu~-V?$lmI-)|;3<`yDaQROSrX)utia@rr8yx6`No+04D%All&q$YV<7A<h
z1_f=RVCFV)!$3KZdXF+Yq!*ymDKTpr#~SfrL<0*TpHi3(mIG6PXDGL%fNL-qoL;$@
zb*#eKEuc_zAV@}PF<yV%$hej<*RI#{&!4**BA$)HBUz+8J_RUed9>tf>@5V9@j338
z@$Y)qYT<#x)TeRw<BB#)17}O4doE(ZU&FS_^J<2be7<03MKlv+O(JW3eK;F8$V3rg
zOR*Jh$L^rdjcdcA?-mBKV1$*!G*_crewKJ}){3!%^M>w#Sg{JsLw&F*DkyEtnJvqX
zWkY0Keh7fpkdHQ``i0wLdu)&EcnAg685I6TKWCaNH6$topHJ=VsI#*M>w2zvmlA}J
zNgIt;TmEo!BkzbOI9sh|U5%r;!ESJOqCC;-8*iC$)tYGdb&ixNy)l|{v-xIK?M(ie
z$w`BZznE2IQk^{=2T}%~`EzXp8f-+i2SV&eY1*(U$BYU~ywH=k3z2Bi9ZLyn((>eS
z=(%B4KSm2ECU%tdc+gm9HunI{Ay2Y|Agg!<6C)OC(Zy+c78+S8;r>F{3SAJzY*FNa
z)MPHoEtr7#UoZXCPQkzIp^kD_KPs~)Lf#<1DG)QDQ|cIvQqWsjaKRYuLhU7&VwELo
z(+n)~Waq82urOO{*h&OTrDIEu7ER@1cS1p4^eM#qNob7X6P$6Ad!Zr?Pvx2{Q{6;_
za$?>{+>2n!*8RRl_!KTUPhwjDsn4^948GmHol;acEM=Q=oj`#-n2<TKCmY=oi&<rj
zLwsC&DPkR3i%re*8BKX#BC^b9j_^t!93tutubW%j>m=kuA?HI3p>x?7pk!})v6*Ns
z<*0dkY>(~n$`2r$k@FQddu_BS?%aE|U%7v3r_D7v%y0{uMYhD6R*N!Cy;1yHaRY$B
zP)cTQ){CN4(}+W;?iP7s8IDe#kdD+fv!?Y68+S7C%$$vwz3Vh`Yy-MNB~x@hxKh*4
zi=NVKRj{(ezK#0}qCgF!+Lw*f*pHT4<LIAQK*))cEemxsGbTR+M$#dJA}u9dVBMsU
zr>xCbuX3ud7aSoP3q24TBu$zndSGQzpe}26QW`z}OjO#ret^~-N!X$f$&GPGzA0_+
zGZyn5yK)3}-{{B+i*7474aydx^k31n4r-v50uwdh3kpWtZB>Z}-<1G0$St@LdlBfV
z{2eIyBh4BcqAuJD%-rOMHQGrqX+pippw^3x0?fGFB*#f0os4pyACl*7NpuW>GG2e)
z=_~t9?_$Bs`I`B_a^7ic)0P{3cyJ^`UWnipji9?zBzvfY@c?00)99L0(6AIJ4UW+u
zgbZZMN*aI@ZcBf+nJbrUS&AYQ;&@r~tkI%v8Nz9{Uv_nC2o6aJRWt&14sCR?;g$}+
zJ+{a7IKa%44r$~ZsZ!R#1;Ee$%r#M<kMn1+k+Y2m5v6#oRn$Tp=r_oWEUZ648DE2&
z24Jn^dJ^5uB8lo=8Ha;gA~7M@Ny8Q0$dgbghOETV2^q2Wh@9FUgCiVs$Bn>QKEA4r
z75V9UBvR(fTf5s3oM@D!aReyu^05t^bqz_rsdNd!ynUuF6a$u{*7lsM<4<r?cEz<Y
z?INkYDr+hgHPnLY`Z4QNC{grqA6u6YwA3~QSrVaj1+A7f(nD>sT6i<Y!nbr`r#F{V
zRd63ihpBiI<YF<J1a|jKNX~3?u|l#X*pl>+sqoGe@R4`{FTp`-Z{6AC!_Mfb%ZUM$
z5C;S8p@j(+A!Jp3n3eWgFHxRpfJsrCr&E!l>OqS*FIq$4148&CkQ;Uqm~(N^7{vla
zYB7ofn1`i$;QXP#!iUJZ*XThV8AKzeVlTNYy66UyOhSr1u{Q4&QjDvs2=3QTK~8um
z;PEILX~SIz&Kx_lky&FJ&R$)X??2E3&{Oo?c)YjZwMDfQw#W9^9@pXUO{=-plRQI3
zw8%|z?WCiJtQi<xF1$1diK#fPRw7WL;}mQ6F1w>eR1xc4TU8^MfY>Nhc7oTn)=X-#
z2|?8m%5hNfBE6k2<d?y5iX$ptUu9RNmSeqEye^1iRgf%g?!dO9_z5G4B?F~WLUZfY
zK;8fl+j>YWEXZesD*}<GzfE>eS)#2@o~jiX#h?N>5gpmN)AbL%jNWnYm^7VaEWvfW
z^WZPIT?8!VjczWqOl)ak2SBohP}1CKo27)=;YKF8JVE+z4P@W#K<`vRX_iM7K9`y&
zL#K1t86^)N9wo)bx{L4Jo4L*lOqOzU;G|BWan=U~5ws<xe#Q{Jh-DQWZ#N<e1iP8u
zGi?<378%9DLK9t!VcOw<y@*{1qXklMjg-(AU@Wbs$~SgH;Jl9UEzndoVicLPF)2v&
z9yZ=%L1KjvDRxS8A3RFuAQQ{%G||pC4!Gw;Yn%^85;E|bN9ErzOjTm3bZWSs;Jxy^
zb$r?$+vEBi)uxG~i{yxF^o%K+9Mn;Gl!C4zC(Ap{r##@|I0(`=w{)y<>Uk|<p;8#9
zHRo7MRdWKFXu=xgdM3IXwPfrm5gBYm$(t-x5=3Cf2%4_!MUCYtA0s)gfw{6BGqqb(
zLy-)Uxu&JjnU>}C77L*>IWy_|Ay_6~p$lx4$~<1Q4#qEyvVl^;3X@SV-jm=d$B9o-
zozs~QISQT0;#GEc09b8h;lrH*3vA~X)itu*016=cE@_tmjS?5)8tBE+Jd{OT(evxl
z!s{K<_M;CX&6v~DxEB}MI3_QwCdj_tytiuZ_r;5d(q_?_xwgT|mn_TIF90<|@<@P@
zBD~fE#hAWHCw9TwO}S~C(Ggt;u16c|h?7K=HRNk!Wd@CICRvcyx@sgMTbpPDGEXPU
z5gLY+be(sdLNui^uX=?}2LB<zZY#5msNp8_m2)N$1^rSm1=kx<|7T9KU8mNT%hIl$
zi;hp{d2{WBN%&V?NW^H}4!O3+tM`bN%$2W0=fTm9Xv`WFjNW={WRKyg4Q`|x<X<?O
zX(OxnB%dYG$-O07ksqMiUeYvaArD??YI;>{j^miv{xh`-tH771m?ev0O2;57xwhi|
zy^fx8jc*!sE~7KKgLj`a(P?;@%=+VCUxiHeOf_j;^QFPhgEmblZ0<uPL341OnG7Mw
z>}I=?XY6DYQSb>?qYCpl3Vrb!vTX2}QJ9t349Ad)eo<80P3@8Lg+|_B-JHlOj~fCK
zM22slCkWShnC3OA^ki>Cu<T;pomr$O;E+@lgFjSogb1V4BrSV7r&nfu8tlzZ&d8mJ
z93cxSja2*<xLQ7u4BPybU^$UraE(HcFc5!7G{)klD&G=pYTC(uDV#FKN)Jt>xq{_~
ziaww)5Ec(Sw>1iT)I3SPQhH2Kdt&wi<}UDR4+gn<FfJf5;7w80VqpU9Zv6fXi~<mX
zM2nPxrZcy9aeU97cT%8T<F5VKSa3s-Jcj0P;IVi5F1!6qvU88WU{|*y>+SIk4iv5X
z@4w%!T)u3V%CB*}J}xqqHHf2g7P0>1n_jnm3zK2($hO_+1*aAVtQkaLP2<QbDPPN3
z%|b|G`cdfYMGM^*d78Q-g_)x<%ztK<dvumY6>U?%E_lejqlehZ$z$9chgs^q^`^nm
z4Nzi8qSoVp@VJVOsp9bfOQk|<?F1O<2hIPwMz&Vjj-Boi303`JkF&;tOPd`1#X3K%
zEzb%r+-1b%jX1jg7q0~;Cy$uXLfSexf@maZH-YOC14bPFO+Ru$?j{<e<~b;P%XQB)
zA&V|zQT8EYP&FpXNan3HX|6#lmHV*#3TKT3y9}_*DrTKq8_|$<6w(9haSXD{2h_yt
zV4eiUbsNQ4RJYl8IQo1Poe~76;blk&3|~QzEr2dbqG(uL+Mr_AdcT=-N0WUM%zqhx
z*$?i>?7Og86(I|$Q6Lz+U+r)g$H-ox?gJ^TXfME^SbPn&Zlf}IPy+WB(mHJDdl>mW
zWF=ADXP$m)H{j9PE#LMQdyPG9UwZOlX?J?%3A=XRcfP}JzW4=u=-DfDDEWp*yJz=(
z*9YxC{NcfV{y+U!_UXS=;VNyCn_pvZc-_5r%YJ8Jb<v*u%9riQ^Git(zV6FQTXy$m
zyYKZ6+I_d2C}&=f^X0Sl?2}K}V=o@uV7XnTWpnDZ&HJStEtl56$_qLQ!ux*UZ`<L)
zq5Z)h{-Hhl>~%;1*Xlcsf~xUs6(^goXG-~%KcEVg7GY!tk~;6%er)+UgS$`1^!JL8
zxP9lwU9H91LJY1`rJ=Z+)G9uy7QpPWRB_UKEfyl9(PAkahc&Xh)(9m^zja)!YA|h1
zHhCr<ccsM0?gtgEP{Bb$(5}u0dN=BM8#ik2tDLB!$Ex2_@(5Q=pZP0?K1>KzEk(6x
zTet1wT9@3sq9JRpAu<V8J-C$eYt@gd{2u1JOYf1Y1t-muhH#>MbJsy}ob&WeHugX~
zSdg>lYoUcW_<*jyhtPsLu*2v#t5Hz_DI~KHin`eo^9u6jq-N(v*itz*?l5fb&_M@h
zx0p)4TLHOYRLmD!fc$z-ZKT`%Oub>Vy5m4`Yl(KcMxs8v80Kv(T*=WF9+o7fcyMH=
zd#d*XVP){I6=lCAOvf$@_h|GFckmfljvf=9wF@(!*Woj2e3sTW$4(?S+!1D_@cgKK
z=m*|r_nf|F2p7-TyZ*ud+<xXAXXwiRSM%O`_TYPd*#6FY-)Zmoj<?(Q|I|OUpL+Le
zXeIWI-m#hQ+g;!OckDwy{)6`Jcf7;i_1*8b_k7QH*>}G7CcEKoZ7KW@yz`y*)^EGp
zPW@HgzrRKYY~X(5!@p@~&YZFDeeZkh%<0qiiVmM+g^9XtUX0?zYrv18ex4Jl>fKCV
z!;QbQ_0;<EHXsK(KBKB{;xE)V;fuN`4~wjNFK*y#hSsRpV=Jy57$6I#UpBkunN}N<
zjKXW5jf#BC+nsi7YsGn&>uUK&JLU$kXePA`+ot9K>Ly657AET`Sm@z3;p|b}GvtRT
zWAbW~HATBb%@NzKT2#4FgHMhuT$76I7s;p;(%(nVuZoq_7yQE#VxmiOWw3?7BGsqk
zTg5S#`6p|lepAo}1ksO^B0Tt;n(q*Zu6UE9x7cK!n`NQs3%+h1GpC}^l=;PxTIrP;
z6D`cyP(;A~%R#$}8Ph=3Dx?mq3v`MHS{gXu^fqHWHgg2>gtsCPoQyLQsqnR*Ocs#~
z>7b85F|LAPnhxjW>_RzxG(J!be)HQXMLSA6W?bw#LR6RK(S@zS;N%$SBXX+{wbr3N
z+LHKsyxzRgTrW*f{IBUzhRi4LeuKUF!P{&v4t8+<X?ygmPufev%f6_fjN9zad+xJS
z>57HZciNfxXjjiYZI3_xterdPUw#Y1zCG}^Z?nCpe$oEhUw_E<Kls13|KzQA+u~!7
ze#28}=O^v;-~WDl^ZLKF|KtDT_wC%cV<&GqX}jY^v;AA_{(J7W)0?O4^N(Ewm#Uoa
z19s0%!LB^_n7z>4Z*RW6%rTl>+dX-conDM~`T57}%a6Wb2W3v$-1%mE=Phe{$xhil
zx7}njTif}kzHDE3<R!9q<80S%x$kxMhI`N0JoI*W{&{=yiKp!O%bQZ8&e$Dy-eI@T
zmbTiv+iq`{b};VSJAdGPcK4Onme)IDpZn6o_UQ8$U)9L#`RAXv|Nd8g)jsr-KVk2G
z{}0(mKJrn!aPgvjD+l+mO+F@0m^7JV&XYxw7FaQW0X-P;6l8Ox2EU7S{cD9>G{;J#
z^02TV(%joLd)K^N9<M#yfHt+x;8)5e&$Xe69Vm=+MvhAmVA*zJFjhw*^VS_{^<q~z
z(ZW-So$4>-Xj5Upax!Y+G)<$Fq*2>?>$Q@fY4l5yUc6>5<pd08P!5$K7qi<}CDjTq
z&bm+fTCU|GOvMTZz(~{7*Hg?(J0l{}fDMc_=1u`#g?bUr=qulJSmsHgz?XIJy~`Hv
z5%Q|yA`DlDvT}p%Hw&^nicZ-?F~ls1u>kNP<g<{dbIOiNDDW#=i+;@hJ(zKI43_LS
zoATPNibxbw55Dkwb40H6v{b=Igq=icg@90GP*gz9FdzH{uli&TiWf?)01i<}6Fm<{
z($WWdhRr}*FITu8<$XA;2mgQ?G8y5Y#hV%hnelh?S<6IeswKj)sE|?DWIam%073CE
z3JT-TD2U5)|2xt@BMBaY$B6>(#!;X26MERELGfSXjdyq3x7&~Yy${&8mBo3Ty7EKu
z4txDgzi7Yk@e42ey7^6a+7Eo_AK9DwKefjX=C)so#9lgQfBHZEw*B@e9<lSAYf4u>
zEUm%k>>Urj-oE`^CvE5CMf=j1pDBf8_=Yu}Nd@Iuf~6N-VJ=>=^DmTN<r&#~@H_22
zf9G%8{V)8AeW?_#P3Y{7w|t+y|4ofO{E=tv;{2WV!5@FUEskEYXAT=Xb?TPVp8PKR
z^soF|`}NN}Z}H7PVgKTTqka65Lu+O;+uJ*3r{DWVYyMyV+WzERv{U!J-QNFW@3Fhu
zb$N~!WrMY`vtRsu`?cTtw4J~C0ei>$e%OBSuFLkNi=CZ3e9oRbT-ZH#-EOz<ZfyC+
zL%V$boIQ8;(l>5_zKV`oy#C=o`1|&wKl%at_22lgUA%b7{<25)#;cp{;H^8(h8ho$
z^a6vQQ>=OVSrmdGsUdifBy6Hs+_DoGk{kAlNX8|auYGKsO(%G;8FM%`pUru4xyVzq
zO7Gt^$1zLfAq@Jy!Mju}!d^UqYRK}#xFH2^DrpubLPnlsNI2JqzOE`Tq|DO<0iLo$
zwK1fV64uw&yHp|v))3+BuW#lR-|uUbXQC59q*cqTHEFn}4eRE?$LY$YPA%Q3x8`OJ
zqKxp(lOvv<&^B@IvdFMWiniNfksWyh2%o)eMyrx?XP1Lh<ztu@R0cPaQKv9R-(T<p
zuBpo`ETh_b%DloNGm3JGug$%@1%b+vT9p(8LbMDs#xXnlhR|d}Ax!(kE@+IjfTFV9
zv$L`2ld4ZkeR(vZ^}uk+C>CK38bIP9?&gggL@2&iw6$~=aFj<^P?^j`uilT8Yrcw;
zd4><(cXtuREDT}|q2&o1D)@pSFAN0?n+aG#4HN6A;Vx@P=H6rap-6V4R<2;DUiY``
zM}F!qd)Gl#QJ%85-o5KNN1Z+Rfq!a0edq7nfBt{{C3|>v%3k+F|HS^+|KLaLOJDd|
zJNlZ}LiEDw*)Q5J|JzU4OS9M7_y66Ww(ow|ciHn#K4pLK^!l1FEvV=06<fUTyX_~x
zW5=$1;=i~5@^>GztD91E-uPDAzwlLi<m__#@_u>IKL4A)WDoxETkJ!B?=E|(Ah|~#
z`jY+WBhUYZ=3Cv#9b0|%bM{-m{wMZKzQex%AOA1y$KUgId+3?V_Eh=z`RzB^)qnGE
z>}NmqT)F($+u!?_|0nzR-}f>5;;&w|H~iqw*!S&z#Qux_@+0=_X3y?_=MULWeefsk
zy^lX)zj_I;eaiN`7wn6__Otf+@_Os`0ka2gx97h4`}Q0E!zb*C)vLQ;U3;K-edM=(
z%l;4l@;|lDeeUz$QsKf6Z*nFb>`SG~^_jFol91(GL&qOC^Co%1H>s6XXx{xX@0KuH
zB&(H3rd}J}x=m<JGMG9yJDwA9oY1?TY|7)3F)mDMVadeT?e*R=we=0IUlX5_Mz57!
zOXgFL<1eUdCR?KouMeaV`~x~gbbmLY(PL*2NdeO6ku2^AQXPGG23biXB9h>cY(VRz
zNGD+uVw;;<7{LR{dqEK|BMpelU+mKHx8aA-dquB=2of5yM6Z0qBmx9J$gWQ5vZ^|*
zL+HZc#W1KKQa9zlZz>!%XVJK7I(obcNEg|+IRv2Is|7Mya;Gc`K9$%`orjiS?b$C4
zzh1?pcdBWvoSCi2u^^|wxM+?xvp#tClcRP6C`!;s^h0v5GKFHMp!wTaU6XwmG$(}5
z`WionvBnE{dlR6pb3FpvqIh_bvy~McQ_mF$Ym91ZQjna)x75xl`XE^5n6T^8N05An
zb3?K-c*F)N)jOr=)L(NlG_@Y=*z4Z*pzY3XwRil;&)DDp=?~a@AH2!B)A!mvC%^uh
z`pXyWg{Pjh7mo(pTz=Y~dgi>XyVG{_nVoA&ceI-xc$a<PU8n8E&-|f%?Bidt3$r`y
z_4l4C$m{j?gCBaIz4g}Jm%VNtmiE#^ziU7LiyyTwKEJfZ9dEMty#IstBj0te?feDy
z1nJ6i_QW$UvSm3OJZpdY@LB6l-E1d!7d)@@(j)e#PhVnNeYo_9ef$d-?e^E+XD8<;
z?B4rtw)0>5j6HKO6x4Us&OP&}J$Z50?z#Jnepc2O?Zqd*YF~Zwf*noK6x-t)9k<+k
zvwhFI-)+DDv5(o=bLZ?^IVznzdy7zWp6u&|>n2U>7TbUBfy#Ak8eP@dkJbWNHPtup
z*BPfV|FprcVU%pkIk5rXF#1|KjJ2&6ys!ngfAZznd>+>w&*b>LR7;Jl*d!IH@UnTE
zbZdky6Vf9Zgh6lCde0Q-<XSUFQ1$z(S@7`~N#|ehS-nPD{rSDABO(1a6CDzev_h?u
z1i=w4iYKm(ZMzh_V!AyC7RDx2R-QT0!6-_b!**yhQpco3mPkt`48yefPtG(Hw1u!X
zW(A~;L>rnNRZ>Lfwj{|^AV~lT67V+6+7g3rE}6QB5pcTb+^yL?5W{r8@-$@BM#pys
zWH9P~6juAcwLv#M`$RA?)2s1p8@b5u;^9p0G7{C(-Oy|^yW6tl0}MM$Hn|%|f1vTw
zM4Y|}tB&q8-Ax=)3DWz6it~fqK*DY&%2{<5!G}5ekXE}sH}Je3`jx+uBip5i|HwZ4
z8-HvMzqHX`#k=gM-uT`2*7}eK(QEbPy&awXg8k+%p0lqWe*HC7_Ywb-W&nDdYrbg5
z?)mobvNv>3+RuOVH|-0DciOvu_yhL7pZF=e`NiApZ{7TY{hQ01uRqgqWfz|KoPG4^
zFWXJ`euw?QkNv29-}~NfU-<9N`McHkZ73aS+n1e~g=_n@;p<NP<$o2g`OLiS^Rh3m
z|A1rY%M7EmQLpWUexvtzl^-ZtANb+-^Y_2-3%_J%&wgu#i>A1f>8z6<a{ax24$&QA
z5^|J&NqJVs>uAU_5~!9@$M#I$pjg${H7^DZeH<4|zjSWLRC~<0LU4nGs;_DVAi%U9
zllNhwUb%6%cmDr$O@R#NK7}@sPgq>MuvVS|3J~L<hBUe1PiGyf=c~vUl>wM?o}4lo
zchZ>VhF*ZhH`94FK@xyk@PI;V;(T(Zc?1i2IjGeI1l3M-ZGEE??Rc>*x%Fx)qUvIi
z1v#Pjc?%X>Tyy8p8pVr3V1`t>*2qL%#p|y*?DU<9c?C9`ET7oZHO+!Bi-V_NY{YmR
zXaOY_Bfg7vQ|0@SMBF=@Cp!I{E*3#I9_-1PYZ5ptbwrh{j!*M+?m7h-{Wgx6<lb@3
zIh#<^Fe>XS)?ES%lc=RV=6i$aw9$7MjBZI%#P`YVqN0%EE*Ol=MoV-JIU16Gh(fQ>
zgVBFJ`x6&cFjKy9x8W$htFrLI-JidfYZry%II>5+_?R87UbIht<d^N|e)j)o|Mus9
z)js??pRh--eEl_bCvUbp?|-e`vDew`)V=nadvCURf6-pLuzXqVYFe3n;=XKN`l|iW
z?|s59-0{8kp`UoC?LG4qd+N&SWv|<`dv@#HciEW}3nm`)>!UK)9XQuTz$uXWtjyGI
zLdRk6HoN1FJM7l|YcSr)yX}E{ZnxV`bk^?QV{d)^ZML~|&aND-v^&4~b@uJ|pXSe4
zd+K%ex88QzUU>W|yRyD&Pd$FlPQU3Lc5nIKW_H4Ex#vN<|ICp+^X$cI+LXsvhdiWy
z>};{K@I0vPQH$2@?ymjHul}07c=oJ)%ZH<;x<L{nP8;W@siwHcdeOEGuBXi2J+f&*
zXG*ZuxtVWV8`021b?^z^a`Uc_c?+)Y$g=-gD9XRL@p*le-m0?hc>4aR2$9v?uIxs5
z`jxJIU$>v)*v8*CU$Z7!6rnC9t$J|EXlTmrs1xy3=~(<-H|V1?$Fpm<h!V~1w63B1
z$7@=Il*x8}kG%FU(xoEbvfj3vG&yV-Y-|Y&y#>Ys<Tm^Zu;h3Fay~~PX+83TZMyPK
za5V?bz0$U^*uzk_pR7jW#L=hoa--b>OF)oeBY&v7NOmDIX@-LA8q$}ut+4w0{D_(=
z^%xl!(vf7*IvSI(54mByX+fHSFzA|)p_6*$+@OKYmkEkmfjb2RZ){;=u2*(6C?xPI
zOkV96<krh`v6+eKhp$H)amLrwgGYHlClg>iuyPtP-(7oyyOB{Z=Zp9=GtTs(a=7ZD
zT`ldZdZJqvIra)<7K|deEHjRAVShc3g0LR_jsMzy_22tJ`-y+@TKh5nY%J~kV}EGB
z{Nb->0QO^RC+>TPedwRQ-FElE`g_s7_&<Ka9y)u?d@C>Q$xnaWzI5OB*^mB*ueJAF
zT9sQ{7W;=jYQOlITkY*{`2qXjyPvmz^;?fjD5l-H#oqG%pRsq}u_zm@(uOP#!g}?*
z{n1B0X-}8e?jC*C-tfIYWdHb|y}`~M4tC<sT^o;%nT&ar?Bs**v>*9L@38$7CvC?b
zw%_^fhwS-_DyX@%5YN2lr|n<7w=L&=%1&STu>I`sJW+~xw6FZmFWB$?=zHux_>W)D
zXKftTcIETGX@B_W70Wk&gL^i-ROWAI?SXIqUi<g{`GfYkkNv*=_NN}P!@*va2hi_N
z{^XBS$Mx$U{_ra+THol%6@|%6pm9W?7NAYtp2`fw+J_uJtS7<g@6|^z)mq>vhmxE@
zrVc_h$^bL}+UWA6$}Hr@mnIE>`^mdpI!U!BHOt3HL!*RapF<$SIEjgE>ZEB_r9#4M
zayUp*$5_^Sga(@|ujJAZN$AV8WNN0{MCnn~x-P?9ZM#}eI*!+LB~Xae(hSphO?B?L
z0M2)sNt7J3bgSq>wKPyf;A0Z{fb&IgDm?RM%2&7E`ohfR5MD+Anm}d0rnXild7u<0
z1VN56kcE&GB!(u)`wwQi^wVpd20AD(64ygliAF87=+Pi-$JPF(yT@myjdpZKXH`$K
zOaaR;m%9TJ!y2r^&aHJZ-|DrsVGRa-wCqafjVzg}j>=+i!Je^Qhx-YrOE>%|Pr_w+
zlYw6o`5^AkyUCd&X3<!g6B9-1pm8K-fe5Zl16zeVvs!HQfk=QaA4hr~wtDJw8vJ36
zREN)U%bm<DB(@|{->@(<RdfJS8-0ftsRz3uEuZqnp8Di(*niiYxATYBxEZ7i_9y@L
z|7nk3yg<aidGWLM>%VklZ+hSkJ5@fb)F0aU=bpEtQmmi)?C;qx9W?f|50LwVbN0kz
ze{6sJ!op5<qg^@ols*2$b9Uinoxfz4pZK)>55IW9?!W7d?Lk0UW>^=Wf5M);Ftaaw
z`F`8Icrdkeag6;Hd*ZVnw{XiopOv&Zv<qjSw#OfRx;zJsJ@$#;vR^#^8oPbB%t)7)
z?eOzoG+SM@3oooKzZQk*d3)rsui8V;Z^&{zdg*C<q!hag%VhgFqsx!kr$70y+0L%b
zY-Q)4e8|4=;)c)p<)=$~^4AaTsrzoRJ^aj+Ykd0AN9_3{ER2uYCx2&UPo)=*TZQ?+
z9{Ko3Ex&k=-MZJ?i_cxKSMz}d@^hd2f<61(vv%&>OZG|+Cmc`RT!A2O&ueC)pW&ny
zBH3<;HY)1_E$6&NCqF@1Hd!4F<ak_2>Y9KBWT<nYYiymom4;%1_h?=9%S~+-F97QS
zWJe%S&?hmdlCeY6sf(kF@&v1>_lQkR?Z}RH^mS@wiY$i0722vRQ~n={<l(_skZr?t
zof3g&r1U7c9#`|XN`+VJk5=NL&hE5^5}8GHxzu=)xh{!lbiCJn)_pQ}#?Nl==PW%!
zGBXX$gMaa;YKhqCc0MDKqkb?c3K4)Vk2V;SD@`W4*(s24r|8<`Hzv6bK|{j&;f(G#
z$a@<k;*HMQ>q){Z3v(K#K68enM`@!i%fN6(QhXgyrm1gC%|LWDd!wQ`)QPG^hoC->
z@&&QB<LJ%|B*SyhM2wiPr8xLbM6~%63pri%$vw;pYC{_j^$5a10w{m5<)EPlQalnN
zOctFeFGvav*;>VWbhg}#e27l&G%WIPir?@WC3s{iSkO#yr~DfbtS#*ZJ9>NRk<Z%K
zEhYKLp8CumkZq@9w5!iPWS=O%zV0~tuzivn=wLVTrmpSki=_zs!P!5X?Kd3Qi;sP=
z{QCNTy7Wg+fBl!QE|$XeNA|=welc5Kdd|M`sq*XV{w<hj9&5Ys)R*l~{`e_-ImxeX
zDAsoNtDm(my>#?7-;Yhnk-hZz=gY6Jf9HI3!JhqU`Sms5b9C-;`@*?z@C~oR13%}V
z`Rr%y`gs*vbz3-|Gu8H5uB|X1Ei~q{q3GYFHKcRe`I^xv$!YQ~#0^TZ2o4T1*N`}^
zL7I7c0kQ0}ROwG+jrM4gr)mWE`x7B9I|l=YX!PPLcw=jF(5Of(y0b@}qcuJTvBuGz
z0}qk#G=rn7{V09{yINKYkmm0wqMS|nx?kI%*&OlZ<THI^AqQYc&XNwno%Ky?bHB;g
zv}Co`x5<66w2-UpHCYSlx{?%3HwV8%xFbjjnW(~@eS>ZcXM!#4m9pB0K_mta{(NDs
zH)`4i1n+aoK@bKe)1UoODHXlUw~``DV!4pRLC)x{TT981N<w44jw+lpa@3xzZWMBy
zP-{?gsxY}xP!!1DH~e1Q7r5c4=#d1Wb#F!afmI4US(HILmmV4eFf3VI<QOtm)p;w2
z=RA5a9d{^0L5`Z%&ZF|gTHg^R{=_7SxUsniqkl#!Sn4PSZ^0h#n6}6Ecr_mBI#Mm`
zR%3ESZ}P+(1ofP)zNR9w;E1b63uUHZXt9p2fpRqEB#ByR8ar;wsYvKG>CR3)lXs__
zS+_~jTQNC!9DODxuhXu*M!4(fa4NR?TNcMUGpdCuI+JbO_}@p@OIh_ytoK)IFoq;M
zWi#Dxl5G20&AO-qtHNftaN;#=!lXG%V|DBBS)L;>v^G`n<+*sRh#Bu`PJofFti0#D
zZkzpQIPvb7ZD`PNuF6fBhhUSBmJceG94*b%=px^i;#(nwxfcVV6?zVi#}5L1A16oi
z34cqhXNt9_*o{NKhTltM=Qn+H9n*5Cuansr&XZ}aqZOx(bFdoa48lhzS4ycKa0XU7
zt42NN%tD?02S5;i<oST6A4p$MwAJSocwadA6F~8^&o)W>cNb|E&Y<3KB@xP^Daf;o
zpPw8(V$2hpjBX`^2C;q8ra~>%`Y_d&u699J!oEGT*|)1#uiD?#V_YBD*~cHUFFx@S
zV|8wnBP|Oedh{#y#YfMUPC&A+-9n64p0kI)^pJh!*~>SW=i&Ca_Q2x0x4Ua^xOr{&
z?p~S*8eOYRWMu?$iyY-hfrS-_NNL5{^;N;e!7|kb`p7=N(HLH{EwTZl5DW?cH@9t=
z3L?-8j+(XAbUK0RCn%w?2q2B0WA!3zDnQ89y(4(wW2UILhDIs@*-=)ld%ip~?6PrL
zlsh7Adh_{v^-VM;ePkDHv!CRo4e2zsac8>}t`}|g@Jyd=jg^?<oicyV=;RarG<k=P
z#W%23h*^#<s)iCaPDw-y5DhvEi|6t{A!RwcT$(l<L4DPxobaYx?Scho^qUJ5)|k6F
z=?16lvoqCX+*l?8kK<I`kp+gC7Fv8AoFX9bL#q#kBMpS7Kqni1dJWl*sp<*}DnVWh
zM7+%A>QqDq@1I7`^kR+{T7u~Hw)(fm+oRRri$;)9bEWzr(y2JBP{JJ}dk|+A;^eT8
z>mK?*8>)oBM-#O_nV5$tQb_bf5h4>a3*v*`j~Er=)K)fEjR(d>H!o(<O&<2f9&%(K
zdT>I>-}GZx9oRF^9N3L^jF-!N>+(1M_u>3w_PO)6J^q>;`g!+FXyX%xte?Lo+GIf#
z9TiZN+bHFjLx@zft}++(=rnM>j1w&|e@g1EsNI(;Nq8bp1Sc~HWqF&AUnImNBU`iC
zT$^SEO8Q!BHqFwMGNCIwF1{)*w8+cH*PQ)*>n6GigX5I2u5~-O$vKWqFKavoKhDB6
zU+1ks%RZ;``C4U9`Z@9|ysbHUA;Tu0#j%w`3F-LG>TWfy2@^%Tb-#GD;#NuX8_<g3
z1BikGYm?-SUwtl$)1VDhqf}xX5XbVolHAV|=2Eb40vm;c#BpM^Pzj9!iovFv&_>uB
zc~n5ld0NAyU?9Q0S?l_;QW|ER9W9TTCJcf|>qfh{a1<8xSCi&)*#&u4nT_dKPcRA@
z!BPq0WPDm<DY}dT;7+UM2e;FWbjFC|IK^JKSuMk1tT0(04m}L(N0_vw2;Ljd?l*}0
zkAO<tuX&jTUR~<}p2t~vjlq@b9u1J>Ux=cMd&ZV+&=8b4Xtq7J$M(1$$5cS-BJG-_
zI{FCS;)0b^^cGmvCnayc)s9T1o13E)niNE>54mcchTv_x?1fF=ldoOK`$|g4T$52K
zF#o9pBRFM1(v+q-kxi{fil{@~bh}$cmIf{OxClpV{Ci^XYt(3j%)wFJt@(`Z=T@Us
zMDj>ecgXLcRR{X$Xemzp*C5TSy9ae1KFOljUgJ~S<jK?`d1p?q3nn65jm=?Xz3Wnz
z2^FC@WaYQCS$SAsux$`q505NEf#@u?Guy1!^y`!6E6|N&wcL1tD>oL}lNCQ5^+x%g
zevv?4{osU!#wq&h<Kle!JTHi3u$?H_zAV)R=XO|LA56&QaBNO_v_b5MSbu`=dXJiT
zta(?GP#Pb!JFlZSZPq>S1&ZFtPri3eMzW)IA`L&5?*$5FmZhE}N(1m=a|-3x3;HHp
z=F#GW&m&n!@c3e|o6qSwMWCQ>UTRi(UAatehMxMe*=)v{+-eX~#M4MysEsJ8#@$}f
z+%0ZrT-#%NT#rKt#8VeS_Q{5HT5Vg!|1$KB-OJl@+>Sbv8UCW<(6IQdH;Mqkuj)dS
z{bx3NG0Q%GQm03(zS&Gn!tC=Q{@lZEFUx#^_IM<9r3n!Z)O<#s+gL*(J2y+G$+<`(
zqjL{xp{giI#nR_;CU&2Sv9ZH8Rv$-<jU45rs5MEHd#A&D8%@{Z?NoD3Z_>Y$i!!Rc
z$Q2r+nYD-^4BX7}Fa)}!=o&PCpq4dTVdZ~~b`BW4R9AJ1e6#rT9QC0kW}@N&n1Dfe
zb-ChQ>9F%J3oOwVEtA|iqx>6Mj>Bfq4KfTLh3w?8tPidq^Q3FQoUP@~qv4I~3Z4*|
zCUBs+Q!egGKeC8Ym5$zN_KRf04sADHAm0T>y3#!9=3v(V-!Hr#gw1#W@!_D5R41)m
z3MqmtE2=@kAsYyvMdP8GFcua!p2$+#1kp@si-I7|848$(vjM3s=4!Y0qQ5T|D3~Kz
zlI&4a1Sd-tXxGLhT5XzXSd3j;=LxCGv?+hzNTaqrw#W8(<;SGaYNa!h7pZomEDBBI
zY{N{JbUf~&Nf2D;(-;TziAZTSv*~+)o`UldD;>P?LXj&6z*KN*C}g!pO1;{VSiom(
zB1*&8fE~`9u0d`^YODFVHJZ->*~lnDvLGV3?6!AyT(D4_87>)Qc7WxY5}mTq7pn3u
z7Ux=J%&~AQzR}!GLs2Yp!PiVo0^&Sr;BbW~bbU3`39`7WhQ$n$49O9piX!C)IPa#~
zHo?ik)6F;&DtCPk^P_^M`m*ApZPu0*cv%)(5(3KbC^&0oQIHC<x|*4Wg`7u~?`fRg
ziFpnZxC*@Eg)^_l=Uq(GqzJ0z?}su(YD-HIer#}`k6G3!cxW&S!!9F0=v%)01P~HD
zx~vM~GD!?%<z=xOL1(8Qpj#@@kzV2fk~wHlnFgXRv<T;m&Y`x%gV{v+r^Ro%AFJ}g
z@6DU3-3WOAWdSHy*@c4mTI_Djk)yXfyIBo?968JCI{k!PJt{~N1KzS@SuB!bSI{#q
z4;wZDfd43lYy*_@T?B>3$<8Hk!_kxeWZPqVY>(@3XwH;nWYFiy?nvpx+1po1v;17!
zgfdp(pQDgUKUTr5j27Vc*Z2B*v>8z#M)yP&aZE&wV4jBTM!Lay1u3VA5WzGG(|jB=
zE}|kJlGO0e?0{uyzf>l*%tl9UQz}MsCy=N)UF9PXU3Qw$ua-W$%kpw%%u?yHrBWx5
z!39Lv_;4=KS);Z}O@HV2q3e=bRM~+GxB_kj3hiwT#jPX}Z@AffuCF=bysgwCz<^wS
zLxfYVYVKr&Qa<c}Tm8NuDBZAr+%ThxNy!n`MDh?sM8~4VjHa{;;n1GNGQ?dBofwK-
z{JqfOY*j9e_z`aHsoV(=652+vI&jc9aDkpJbc0%n4EO<+wccia<+N7{elG-1)R*N4
z(F%H-lNf`uQ?wnDuEO+wPy)mAki?WATPd<w7#>+#bSPrw_pqu8<@>u**bdifOHwFD
z53$B)T~QBj)(+>WJpB8MhWf64Gq6QTaUqJXGm3z^XdgwCn79MsLs{VR;gOs=@Yyut
z?-Oz(&<&zz&~?Xg+bY~1+v9p1A=WvMkQWx=#XP#Xwu%LbT+Z?nu{qKxfQ^*wQk$%q
z77D^JiWh)In1lx>EJ#mvypWr3)WN>Xc8vbai5kNuyIp<ou-!0OJE0wkat36T8O`KH
z$XxDJug!#ZD!(8)O~2{Xb;DN<Alz;A@9nG_<Cfym`^aJ~gN4|t!^FHYFM5p(e>83y
zRm9{!7$$@080+jlO}0-HP2R^xI3G#}*7~P5VuUkVWFAy`*F|}QT@;}5j-+-X7!7^U
zvO`#w`AjDTG23+eJ2Rd@c5e5Kw*8}BEG@&%hlwNgO<tkPd+rn@b8-hSO!`eh33Cqo
zcFV)Chn)vbDofCYHrS$|v%OMC@cXM*4+(`~d9+(z;?jC#j}`%Zob`0d#RBsNE)=uI
zX`<yy57%jesGCwSu-m}{)Dp+)h62g#@3cf{^G1l1!_4X>Sc-TzU)W8HKv##3#=oT?
zZv<nJL$<$=@PavDQK%Ci-q8l<F!Fs+WX6r$>^o2Y?92T<>?KBqM(zXx;YQ4{S_Tlt
z@`Xob?gl$6v>K0=5=5`jT3i+6R_+O=a;tT71IL<dkL~f->~Iw2V=E^r$Z%WRL(RV!
zgVgxABY8K+q^nYLaa2OFBN)np`YaoxeC+H#_@)!HArveuPgNL<MIC;W2&qL2FgRVl
z21OFVk%k`KpjH%ly10)Rnds|MKGu_>;0zqKWSWMvxtBH07^`u-JA+^oJ)5hz;aX65
zz}#+UqhdyS@~?>)+eZ3YT%#BuLa*3-XD8#;G-y)Yvo_q-Uz=AEm2U`FCi>kbjf}*a
z?A4_M?AmFZxWG1=T6_4-?kviN2u80-t-ZZc0guX^XfVGi6#_KyRY7HdpJ2j4k_PjJ
zkTfYm+YX2=W>Mbp`qY5sffu>Vf<{9S@|mL@w&_L5#|Kd^c(+-UBB1oqWjVJ~J00PB
z=Mn7Ce*wX;t(IlPOSHxi%Z3k!Y^Y?DlB%O|qnQ|r#!-QAczBu^UEyt<ec{F;RB&Ck
zGJ_LC_R5ETc^!zL*61%%l$~f1g$H7ZP|hd|sQp$sT&qF7Xfb9Q<<^v&w$p&*5$))(
z+>a9-5p7dGG0e*b*!@ssjXv;5SCUv>SbtZFe|g}#a;6}owDZQP^V?&4Y>(@4NVh6_
z;jEMQDlL!9HB3<mB4?k2H9|E+HjOY22~*fK_iB$Nr=y#rIiiTxuCZLI5h`lmX<0rl
zdVFb*v&Uk;>D`sb4S=zUX6#gS$Bo8Kc^kDK&F4#`*;j4UpqU#hOFVYRkT+vl(>l@I
zH@&PxpcfmQEWi;Ajn_9cT(5iu6V8#hVedo_7g=NGPf*}&$%Jd!h>_T|BIyaP$$+Bz
zEs}i@g;HCz#?XglW)v!Mxk{8Dv@L-^a^q0A{My}{mqoHHu*l>pi}}^ndTI%BK}C8m
zxct5O#o%6)#l0Yg&NTp3S({pDbg+oJ33F<ORRC~*pwr?|(g&fdQBf(vumk5nv$F8x
zVZq`(qU|^0?=zE!fn<i<7PK-L{UOP8bn0plV!=bzHley*x_%30yd&GEXh*_os%?7i
zVy-NE7W1*dEx>5pZ0O7gk;{FVElhJNYbBsV{L84>VaW3Ik`o4)GaV_dT|2M<A08#z
zYMCh(0QAxmCp)Un@j>nHHWXfKCzp7xK*VT4cA*sdk<5=j^9S*+yY8}6r*5+Cu|2j&
z>0TTi*%MDZ`Hlb4J62ea<Z0kxkf35O8h5=>LNFHm*+L|YG<r3{def;u5M9B*d!e>|
za-lNq^_nn6gT(40gxuI(g^8^+lM}nzZjSe`K5i;v%O?Lqv%S5RV;P_(%+YsuMQFgh
zj5LBQM+*voEl(Yy(1}bUA#j#Rs=VF?=9q(8i}OyJT+FocD8Ez*uQASO`L(0RoiMS&
z3m3kI1iG?b^%x1&bv)`;fou_*TD+}Zv|6l=909bJV0AB)h1h~h-Z%@Mo`GedmdUKj
zvDhC9bzHAJ3b-Jv`Zc(z8)y*9D`Vyb+u6<)do36*S&M$}%IvWh6@AtS1+_`0jVLMr
zoJd!u;{;f8UB_7zVxdvk2DWw^_K5L7VbKO7av#vRRD+x5a&Arq&5?2$BK2puIP_t&
z?-20W571&oX{dnB@IKttlsmX69}ozKS69gVn$d4@QxMOYlZ#Ra*F<(GETQxQ17>Y-
z%7-(3mho@OC?bt^7ic|p!F#~&yGT>#L9x~4Jy+vO=9#>=Bk7=ch|#ZxDKYhG_`6Lt
ztSoKQwW3&dT8N;*@)&Cm<C`AOJ@*`cZIA7-J^uWIAfXAq!4|uk$r9d6qx}#T^WYhQ
zE~J%MQ=;O{+AZNLDGYe5akn9pTn8ix>buNaesvgcLROXBp|x1!ivhEBuoR<2%t%DX
z-nH!ts6acfj2}AcSO*po7!{;c!+=FCpLt@vW?-7d^^Sb1mDGG8!Wl0DW2H?#CQxLh
z*Y|_8V~s~TWiQrz-`;JpoS?P~xA&y^9(@&)*2S8pOd+*X-|;&AM#T{XzMYUX+Xv7(
z(RvDTs4pmMCY~yoA`VExXrA9vT7OZjz!8-+OK;F|H5O4~-fCt=tyEc%v8>KAiVP54
znQJ+75q^fSQo`H{3pUOH!Bt?@z-4}Dl(~gsMc=<(I~?jAg5m=9Tm_D~&^(LUiNd+=
zGsV+Vr;il-HJ$(pgw_SwQLTu)Fu7}#bR3Vft!~<z*>VYiogTVN2bwjlRs&men2oKD
zWd3^ui>xlX?_()`KxKmraVt5bH%SSSCpY5*8t~!3)wv7@OI_qS9YN358?B{ax*OV&
z{pe7BND!le@HqS%*-cRp|FE<b$8J00+8*2EdK}eDaMsoNmLsV_h=@x`8{9*Wa!)rA
zS0RaBY^VcsR29RqM=J}?p!Jkqre>njhhyugajX=0weKo<p%wxlI*`J^PUMWJQ;Tn;
zwVYDfg~o)g(B=dQq3zVg>4(9Sg;g-IcLuq{Ttl0(bY7e>nL0=)ipxXIvDRhtyeR*j
z&vouVebA_(j@06(K*<`72?lqZ=<>WT{;f*3ADwZImSW3JT<bG9eIB~MD7Y=HgvvjF
z4X7DYTNdPw^lI!1YT;t!NIPS+2fWy@z;-D41*u?8!z>w4LWw+#TzuR(h;^HSoJg-{
z6iFg|U7=)xzaStG1(ny`DRZ;YwF>KzR+VLjRu=V{Ah8T9)f?ppgjjo=L%DlRL0aq7
za1KV&O(%i|bY-!|44{?iJEPvsYI~>L@6R;UEa1u(^G=LE)Y6Tp@F;E&D3eJ8B5Ds~
z+>r^*p;do3u|R^b(NAG>diVl|n5gI|tev+dxk-pBZtGQfFm_r=xT2il6}N&JpnB9T
zY^J7YfQ|$Wgt{p&XX}EuJ+{a7Il?4)!2;X5#gojpReb8tw`N7!VAD~;BrqO(X<x@w
zoio(`qJ2{}(S`W{v$O123uYo-)OZp6d~59zd4u7$t}P{bY?)Y429UY<P0@V}<#i|%
zTcJA<HnLku3BeKNC7qxCt%66PzvuyrRdcqp8)Zn5NaI$acE7`Z%-663Wm~5}%y4{t
zAxx$aRw?sA-8}qnOo~aNwyn(*6H$Wbgl3hsKq6Yw<&Ou@LY9bYooWJdLhjXO!vPsu
zd;<&5$VLA&<2}GQ?Cc0)W@d9K6&bBVpdW^zB?-wAX!PLkw-WsxZF=gj02mslfv2dO
zi548l7j$B$5CJSaT!ob6`1dXjEQn)Ju-YWx%QcRAoCcw__sWpVPIgs_842ENjV!_|
zZ_B~U5%l*3RNowSM)r%*@`TO`hz^Jq&t)@n8x{~OIOB`jiTRLre^+FZp%gW`A>+Yk
zrk1o|oAMpYt0UW**iE62jKSz?1GRnT!_7ROPX2`n!^EgI09ukDwrr2>u{~b-;aq}=
zo{pnxiije-Gnj|u;#za}bJ54gAZZU~TEnOXzgjkhtjs^Q|Giyi&IslVDqn-HyjWI3
zg;Iun{xcz?>H(;8#|&LF@PTVM&J~(btSM9WV3gNvwccxIo&n|;%}lI8q!Wsz<KWbL
zh5Q-?!ZM5)dY%5@K8+%*2r1U<KnqfFQQ4E9kGn(FlhNE7t6FMd;)1tAD;2)9Z6oF)
z+KBBsEB3oGX1LRD1$S{Cj4O%Nir(l&2+dZ6=4sVaolPS}NQ?pVV)O+*F#a4LB#=>V
z6(`d2#tznVu4OzKTrOr<T^MO$0_8WZYlpT=LqWHKm>gbacY~+?EArf+J)09wjvn)2
zY)LX?7_+OOXc90CM|yb3dr-$<HGfOpP8B+|4XI&hBF_n4j4jC^4Jn|r(D~pt@xLIk
zq)iQWbT<!IiMK(H^J94pv=^zWcd95pR8U0;gYh}c<@-fwPSf3ip_G93pv(7BI}+Jd
z8O?mNJ9eZ$Z^*Shw#WAPiygsS2<)f?o6pvL_uLv!c~sSOz_pjy>@pR-Av;ct!Qggq
zsgmWmzV#a|^b->#s)gvL?UO}Ps5-G+$!tz!$cjf=%(HU}#7n@utDB2v51&4o891Q}
zMRMIc0VDbAnBr4fcXa2e#Nb6lEy;S_AcXXNq?!5533yGb_o6$!xs?<;c)_L_9Sf=J
z;nMi>kw$iHoN~#WfD&ckj^&u4z`{||pUpkKr9wEMi#aH5*>koW=GNI4FEUCwjS@hE
z$p)g`KqepGA7-;A>bmEGaF>C?0NotTa^3bR_%;EzY8GTjOUk9w^HCJ(USCah>57p_
z>;Nk4fOyJztUwC|YSET~6xNwrIfYmsDW`4*8QQk4Y;WAMAH@W-Cd}RD<+`8+qg8*o
zi94ODKI~Q6#(lexN{sJKvMLFrz@sPL_@nMI0NizWk2XiPAqn-PtKThnN@{X9eJSXv
zb<1Mp?9L>l1|cK3*BGt=?)?q>4UsL!A#V%U_ShcR<<J@|WKa=A(gL3+7F?LVl)Ng=
z>NUy;ab%l|9KLH188f@Q2=ROC{Hn>5$7waT1#2&*<2)`PoQlk_E`U}}u)$WJv{NWd
zj8Gxz;To$da}tL+H9nf_)Y3!-sWB^+K*Du1`L98&L+Qoj=A+m2;9qxmpc9eXN2OFp
zCE^UIGpKtZvxFLd!kiFxn1IYipC^vVB}CpLWTJD_wY8e>nA&viZ$&8R?X8&AljYZe
zXc0WqDyZevmAO|>CwGw`0tTA=5E?GhVbq6Dh=+b_Ja)0L;3gN^Fic6C&^7H4c?@(w
zmzbEMg3>nA45{;AH8S@ciABFLaJpc1uf!6!K8DvINF4M#gwQ%BzbVZz1W$=ygZ?dV
zGM(==*o?DQ<QmM?%C?7&_n_Xhh^oI$kmoy@=(J81u%Ik0a3|RYtr6Q|ErHsOdv<j>
z5{<!&F^%J-Xy=32=mDbk!QV$op+bxy*!I{S+v9p1+4WA|f|KcOo{R}l9H!2ER?z{4
z9b^u4YVhw3i5BYMFdZK3xlwa^j2g^aWXY0`H1hHLnr7c!u!#n*$fZm&gub+)qfd79
zB~L|>DVUTTG#@9Cqmd<^W>&%7Jg!ApDo{Az?D@&^6wI6{ne134^D%Yk<nZp!8|6Ka
z&W`VG+)9t*9Md{g$tBt0r0o9en%R{QZd>PLM2=~?x3s?U%rmwy6^>Rz&Z63FZq7($
zxakB3`YDyR8JHubSGM-H9A-ML$54}MSp{t6YJs8Vtr9m`9A^^y(tI}S!z1$r4}+(7
z((=e5HfZob8ibx`+Z8kj_lt!K?BIsnJBk8z9^W_ePRM#`L#zE`QE}&fT0mwSG7ejQ
zFsoj+PI7|Qher4May~mj>>46bli6@^b`Y+)4{BQiosk9~#C+j=P9RjnSk47|7F=9A
z?O&XA1O_E^X}H<g7<6bgjvG?s*Bdc2A&wJ`zU9M9`fNE5v<WtYiu2YSetT?>>vPma
z9Bn#H6-IA+NqaR}Ie9!p?VixMJ4I=?8rdM#d_T>?5@+ek^V0V+62&c&h<BV$-+EEO
z!Iqp;)QMHxF})(R*ot_jd6)-0_Eau8kxg&F4pV&{fAL($8f}=`k)v<$@jhMWK%<=K
z;8}q9Lae_cjL7+e+yr;RNX$@iQMPwO2~7Bof|l3DsVGkCIGGun_Ktriom}f_(|wX*
zaXWL=f}>|KGWqCP_0LlK3f~W=A&SP3Bn-v@*a?)j*QuD%sv{zXM7XpX+YU6t70F>^
zItlZWB&{@PaTg6V6JB(4MSw)7*{@a`S}g(X?6CdVk>yC6eZ<>m*`2`t2`s|FGqz|7
zjE5?D77p5cGoc=e__D;;EYcynD&7;6LHq38s->J4+IH|>+?k<0#|m8@#GYsg=D&k$
zBG6jw+*i?@EYe0VxcC~hCf$Bzr;!Uk;!WUoFE@G=q=BEox);@c<u)<==shKrJD#99
zV{IdBkL|HNUg4o7NpchumD`u^YK1zvPh=7ZL~P4d>gt^mjY1;Dxj<pj6F6#AQt(1i
zg|`#%N*c?^%TI->3U-O;np#}kKG*5?>_CCcuulGcny*)9`Pw2(Zi5${q)`zNh~jVq
zB5SZcHWP=(DvD6_n-gPg^?A~BR!cMnFHS6`T9fF8@AIwfy#Lk<nhL)DM|5Qsor!f$
z{zOz^Y_je*t)TR&WX_(@7PK+B-;_{PKMHwlvP5>6B}Ebn8q&e(6av9mlS!&Tp=kXC
zvCtox+K@V5epH-Oq3{7QkZ1tV;)IY$icR9+5@9B@D9saxph?zFA-iHb>HU~G+Q^w=
zhO0*9hpkl7+^%&93hF$IhX<sgR588TB+O%5vAjR*nL318Ca2FQ!Bz&UV5gCiGmTWJ
z7mMh-qcV2_R1Yeec?j%t%QQsJB4{h>8H|(#K)eki3s6(Ur4x@E=WQ(NO%l5k@O!h-
z141?uinBz@^LZnWvAiu@+hcoNk7H_W`P_-KovCeTK3b^$ewjayL^Q1zCey;rd@4^E
z=HDipP!Sd!5*o4`A{0hxlVuW)I;)yyMNa5a302|AwWdaO%|b;qAx`x6Iwuoavx$gS
zV@Ysm1f*6V2-?9Uds0D^|0|6rxE^UOj7c;9>`BnlfMs^#WEQNM9|41J+y~DV^hwHb
z%t<~zzu+xW8;?<#Uoy!WapqP}bm%qZJn=<yo;;$GUm%KENXl^mIzy(_jQue6O!0lQ
zrlqcm5ZiYgBT;j9m<xo4`B$I=1!<Yr=oiSU@dyuQdL<P=oXd$tHL(rMwMt3M712pE
zeG{>h0CFNd9A1j<FF0g5Zy<yb$OWjZS3i)gxW0z8HO&+r$D&nUZKo75%&^cyj@~Lz
zzuP>7GK;eB>Tz5SW2cQgqe+LrR&jYR6xY_tAM`QXjGPB<_^9v>O(>Y<5VN>O_ZH$i
z7J9?yp*fj$Gxj%k#ua9E;<ne=8^7aCcF&1uH{uZ%x7q8y{Vn$3ou_Q)FM5jc4*QPp
z{Z6}Yce~-Z(GIoj^t<5b;`o1Iim@j`aONP$6m|7Y*{hzn8bPF>^eD+)g5O)`*QTG}
zG1U-B5i#nz$a9I&O>e{Wb6!V0Itihh=+$Ft8Aj)sL=UeV%?q(j=MbEPLgeR+MXdG8
z<uX4Hmk~7*7z6du0m}<c+Xjz=($`j>MF0cNr+gz&De~Ewk|4XaE_zNC<~lUgtyCUZ
z<KHv(YT>q(>CrU`Zp2Ll5doBT6pxu(BJBpvzp&5~838SfVuQe>ca!9%5%WL~zTS&T
z$P&)t#v?lm<c%gM=&Z?&id59s0lf_#M242ztP?2%dZj3gOGFmx@DS}bA11<fDOY}H
zmaS9G&PmSX!OW`(J^&2TWsN=~Yoib)JPOg4BP!EdmiOp+j(BK#J(V8g?WBxUBT&jc
zF$GNuK}ulU1U;;354c*~863>s8jndD+z^!S1)UWL7KXb}s4uVaC8I@Gxz;rm_deJ)
zB|6`jN4d_M@3Gh3e~;a9X1~lx%Y8YzY-gW-+#Y@Q0tM~)&-wmtajU)Yd){JKE`HUX
zIVhje&W`Oa%&uNM;D+R7U%h{~z4^_ru~W-u>@#0}+Kzg^FY#u3<GWvD!^02RQx}dX
z?f7O#yV$keow*HHF4_@(Q1)-Od%x|?_QpGR)j1f}c68+>d-kcP?YXm;Z9O|<uYL0y
zt$ku+m(N|Y<zM8ZXy0f*^}l$(ec?a(f<1LK+V;3{4iUBVdol5j8}UPbjTv{=f;^0x
zX{%Uyhbf3u!DeA2X$=7aJXtq-;nawluHqtem69DJDzX)`*FYhuCb;`Mq(@m~HR_#a
zft%pyP8YOX8np3k+U6Q<Rk$YD(Wcp2C4pH~r>T<6ShPlIu%eHaMh~=QktFjkPX$qA
zG}r&8=){lOnsj5`<a56!Oq=e`M@H<Rd2$ElS&}7rJF?OFwhT&4vZc3JL8c0WUOY2S
zgqc^>JP~f}U38|47R`-JAsqH;uGIL=iPbgO=Vh(?S@HbRNCVv{_eP$}LfO-FMMs1^
z9ugGO-O>`<afaeBs$xSswzoSkJ>8XrzO9H6THw8KI^0E(;e$|Hg(0}dn9<X4g_~{~
z1Tv}EhnQdvj>D!lwx<siZOd`+SzuJ$2^g6eG|n9o6S&uwgVmv^=t?YRynBiNl>u;s
z>y?DqXxC!UTQ&m`RC>k`pm>VJ!XA8+NOGa4T5}`r+zV2?^^NxapZGiWhEwGpA01J0
z5N9Xs-QW9ed*pY1*?!~G&)U^LtBT~_uAF_ye*c%Bvf+IBgyy%~18;kaecPFr?DszW
zdAstp?|A0T_Jcq5ckMklKVkp+zxw~!?|u12J0#q_(|-7${{y@HfB(PP^Ou&TaD9_<
zS$;Zhy5n{BUGIIZJ^w4eY@fSY+QE0c(cb%`KV$DZ{fzz5m(G<1XKtr%{T_Sw*)Q1d
ze&l!TQ_nqVpZw@K%d0~>*w&!G_D774q{hllcAC3s(NEs;LtH&wH5^4{-+YfQ`VCrE
zeXf)y2A$?g$HlRkgty)*^CDFlf0NrqbW%o8XJ!&gCvTxuf=4vZ1{}GL)OKMlhSOBR
zp{2(pUPC|k_xEC_A{SY_>QRdm4izQ^+}1gjycv_?t&&=e(Tk#5i;k+?6<^zWp}(AT
z-CQ4Q`!s9qW<jeBsS5k}q4@$muuYdHq5=>ZnSNGZSWQz3k4^r0GujjR0v&83D~J@K
z2Y?x1mE3_3<$r4LJ-{tHsx#5Q_Bl7-&QaY`cT25|a?TMU2_Yc_BFT&~Hj}`^1ilH3
z=Z(k1*q)i^Y>W*y86klXC?F(I4k)KqXsKHr)j5Zo&pEqZRjpN3t7`At;OF;!BfqaV
zwC*|k>|M2L)vA?imCa^!NG+YPD7k;f;2d$dlo^)_?+QcOgbXW$Y*l8ff!N*YPDm?o
zEy!S+HhE(F{s}9{daStCRI#GzEk01f!}vsp3v2SGL6-d1iD&m{X+{ujS~i4Xw=|P_
z6)a2V`|hy2ub`~~)<Ux8bb~XExX?6h;8wJQzTlXjy>F98Y{q4WkG^)B|7>=mEs53k
z+7P*Rop#9CM(?;wO~K)3T#O5rlz9Gu2k`hy>#$=~qkqm)oO#_R@WJaY!kV=|#<SaJ
z;o^^;hT;3}#B)0=mG@w9;mNr4q&A+s=T%HhTY#faT7aQt!`QRnY+Ui)3vtZg4$Lx^
z&MU9Kj@RGXhEah4J+v9y<}Ac{=bnW1+kb&Kwhp76!`3jcopvrxTRIE9Y64r|d=Aen
z+laCL#W?56YjO3tv$4sL-oo|kuwt8Ob9gIOuDl1|x@|ei-WfRd@(<%fryYf37QKiU
zcQ$bNyAB05uEEMxThV{grC8e8fZ-_%u=ucf7=7hFJie}h!%jLKryV&Pjq&~1xU%Vv
z13GxULoc>Qil7fFj+>JUjP+1vs0fxt!y5oTXyel6DbdYaDP#!Hek#Y<oePhI1f514
zk4}M#RtcqtYfjUretfcs=3D`HIHZad=iPoNw%AAj)3JzP9@K!3DZwWrz!$xxgbU`=
zWptl<;pW_g4N}q_j|aD-{E$WVBJ)ZAFStsz4z5j~<UyH*yx*%N<G{Hh3*zwwZD8ZQ
zS!~WxtdBMkHwvFs!(v*qOUuS(+N?6@f{q6PZHV(5=xjQ7vml19OG2jGlVCR~Gf~*L
zY-tqdQ`J;J*Ja{_y;-!O*dHrEo9GJO!=&71WL35~xk9_WSvK>~?r(4wnRRh0D#hZS
zqq^~=If3F;1q*J<<}0agq9zxl+a6GMxPP+HTxl#&?9Ls|R%%~{%=K#t$DWMbv6VWk
zkhU&J>w@i+ZeN<S#yO7GP-Oa-wq99jk9VQdq}`Dx4GP{m;w<U76XygdNlCEZZ22j-
zER+sG)_2mS`WE2$cg@GX*Pg-CFTRCMdyS<tF@`-GU&q6DJ&7HMo{3Wr8!!}q7%u+!
z`*Hd#<`Ru=3@$ng*S_yG%rc*+&N~|Cyyp_UYnI#5Zd`}GM%YZ=uO8ooWlz0=u|;R#
zoRbz|W`AA|tH7)iufWHyJ`uC+sRGUEIQfd}aMg)396dC;O#9uFcR)V+7Dh)$%|By}
z_aBN=E;d5&sQDN)%XjX{m*bin-j6FzJsfkV^qRTs!h$oe!42;@)d*Y53Hq_{jFYhN
zV3n?S<Q0-6+@;v|p*3hdCBBwm*n`9jUDNIuI&+F$YB8o1lOcRncK23?vi!)6M}N!G
zCoqr+<t&(v7Reo?xE4X`=&%<{^X6D>Ps!kHK^l+dENk9Oti4bsp5=rmNQi3hrc}h&
z><P$zOkMzaoRsXsD|m00$49}!%boDv09Tav2_;lks$`y}cu$#+-zgvK(v-1DCzmkH
zwki_}%GPtG=<SYZ?F%r{o-B&X6)us&DGv(H@)&i8Hk!s<5?|9Wk&gS_ZQ$jk3lx+!
zZ<8OWIt01W+}<=cpC>wOVK5O`0cT@8ZH`RZU+sBb6vKjZmnpXoOS|eFb|5wu*V_fE
zcC0n~f+^ixb-XE0wHSMvRG!Liw{U`oGigT0bx6Fh_;T*kl8zs+Y4qI<O2c;=O^Y@k
zcg9O96=mI!oR&(aJ(=d+-nwE9%UYJMVm%9KmmH$0E}^xs?EkDl8nb0p#({A~$G>!Q
z(PQN@FlpS@v(|AHI0_%Wgils|CtYfAHfB$4W9z0p7#Wr3g&E_PRaiH2BNoi>0bc&q
z+SBb}Y+Ab#uP$GN!LH|V*IkcdXN{N9E`*`g&*ApB&&ID^`fi-HX$Kx$B?M7p0nWeS
z-I(>ppW?4>TZuiL0i5;8|AK%1-c#_%A3l!PpI?qsj+}uf?z|I^?A91O@_eYNi*U;E
zzlMKz#BLNlCI;3$hPR)81TU`Ijj}6;pn;iFI(Yv6$MD#)x3Oz{AwKv&F2K}Rzk)A+
z?|JO)^kB}J^Ki+#=i%V>PP{a4?I}1xio7*sU6J<htL`Y}tsfF3A@v-TOyLe`1U=K>
z%tXpqMrhj$HciQi?(&HhJ_6+mG1$1dJ7<yJn{csjIxM$fq2m)RD5m5sDW8Gu6S)eu
z_^550SfZeU>yi$BjOpv-q9m`8;!q2n??pJFY)gXA@wo{qwBW2mn?ulGkC2l1VO(l1
zu)wZGCwow`=S;ETOR4u>cF+c78+)?nU$Kv|Rg#6$V8^ISP`6Ce7RR-jF%2%?Z!H`}
z5NKa2#45z9>0E2jRHnXJ(8e^dORk|PplBbS;5||epAN6OTs!UrU`@qp-D%70Kc!PS
zsZZsy4k>sy#c0i)2HR6CnRPfLhN{xradvZBsH<Jb6^}bUwbf-+HYf|m9u;6Di#rOS
zL7TD1YzZpcPJ@bwSvRA#k`%k^?A|O}vdY!wY5+d+Nd(1$AG}x15vUc=Hqc*E&=FLJ
z%vx!7FUIJEqC+y>?s`Ru9(FUJ^;x^)t4k&_)<)ie+Pm9BQX*`^OfEww_E0((jIF!=
zK_NSveK~};pS~9l9rYWy^s+OtX4iHEf2xUh9lm%5W;d_KC+A%0ZcSZ06a9_3nBJfb
z=#^`HAGWMtfmfDoHd@IbW-K@qa}QaJrH8G?rmfY-M>f8NRc~*>&Y^LXJ#(;d?gTcz
zwE=q_BOAl^*WSRE&OyQTPP|-}pUq}w>&nHdG<i5|>U*=nd<L9w(WKIC-cn!|<<=_+
zurgR6_Hte=c7?f&Lm(VNsW^e5!zWr$RUGZwcRZxwtr2oJw%aAAs#78El7$qw4lQ}t
zbg+V)wZ&(FQKbrU^J%U(NVO3ubm90psJN{=1lT7}C@MAODt7RmvZ5d!r3D_GJZZ;G
z*bX)jKPcGxgZ3q{D5cTmDYV%FRbKWGt{Tj1o6ZfVy4Vk@9P@PrUllWc=c=Q9O!VEB
zeKN6~qU{)Hmn)Ifq6S?$C2v~h7*oqzSK#Cfw{yG84S*`XD_3*R<;RuYkxOaeHV$U{
zpb%Fl#Bwb2w?f4R9c>n#jUn0CluISI(p^!>5z=Nj1IHqZcdEM#Kt6xQA+w~7z+@Iv
z*?c=rm;F;JSANO1Wsf?s7M!c9sEc4~yVFSdC~LQaoHk^+v5}9L@aXByrO+3gX#^6A
z_K;4S*=cK*HLQSCw0F*GQ?^=&O$4Eh+T;%CYJiJmvc_chxOKntvI_Okc5L0-z?q9?
zVW59Cw(s?kCS&~`b`*~2+Kg8>+Y~G9Qi!>532CQ&J?K$m_=jAb{p<16y^rGPPhEt|
z&Ug{sg?HoIO_pQWw(?cHvX1bkUR{QV_PvcQ=Ib1w5;N4}d$48AGx*uPucOuM#f;<M
zjgMY;0!}z?6<(|eE^9T9J1gDy*Df2Bd4@Q~|KDz5_(y&z#Q2fsZ~z(<qjo9f?3Qy@
zM~A#IE<2mEiS5<k?L@jm)`GwM=@j;kJA13c)hf7HZzGhF@?Ix|BD;#+X^M>ms(VUd
z0^c9Fl2MZr<>;6YD&6GXFKFMG^VTR<w7WRYR)U3|JtdypgOr)5oUpP<cvKXeu;e!{
zJ5N)CHU@k5q<g{|8=T|dDsYs%>6lGRpIvA#Tgr*5cW_y(5KmIUtxEl}OO=z(Nmyua
z(rVh!rpT<bY4MK18eubLE3VtdN!*Y{2HGQKPZVysqoYf=sg~kJl#kQoxRvgd!A0jZ
z0?r<3xGEKGjJDdY3WwcjYpszMpKYaC*!fZ`6K!&9TACQQRVx??R?D$SayzWataOJ}
z_SroNTx&6up5mgA!SAfd3M<(_wHbm|7}*0SyLi7EoqpWl{@C9P+Jx9^56X1=$27<E
z=w#;>MM~X-Sp}er_j@_R%)&vk&=H!A`B}}yR_Sm_A=VmhQsmLH!A2KB=i+N9IXj67
z@11s;Skr4SZ$SUam*L%KABzRky3O45VaDNS;MyC{L;o93;DwDNW&nGzd*2`y9y;9}
zozv`{iQ`UMih&x&t__9T&E#E!Q!wBvajOFuXC3Tc_cZQ#WHaWSa}JIg?50?G`)$1P
z>OKtik7DIBkKus_AHpL~zKoTtwqRd}=nP#`Fk^a?8AW<oWvQ>fAA@~ej;8BS&-DQ4
zYHz@b)dh|`?F7uVM<Fx@u;|>=aoE8a*E{m^dz(tOyqsmgS$Vdo0Q?>)O?3&~9#5AV
ztX=wgP$=8vmZNPxG4`X_lI!kb%S7>!DSS?si}w_q{>{k{9FF2WUkDj_;mj>f?>D*s
zg5yp;H-QpOlsM~)-tDl<vf+~|Tt`&?uI+_thYPNE=(v-D4IEOQ$@=VYL0^}d=+h%X
zCp9<NvU3F)Y_W23tT}<|_Nf+BsMlG99g2UE!-}eAP!_l1@fDydT-ItTDFMSBpRA|?
zg=Oyc<mpbk?Ka`s#oXW9;Iv0tnC_U9?k*#6T9iDY?Fq@GJ?kcw_O}AWY9bRPF8Ner
za^bZcx9#F&kdlNIWrI**OY4)hn{x|$II_aj-loe4bbHJ=5^5i}Ld4drcQpvxB~L(;
zgPx?xI3eW}k|vp>;ChG!C6d^88*DW-6uAW5shrNzq}Ub-Z{>uun_im{*`h+kJ>5iE
zw2y(b9y_UBg)a?5aWG4)lyE^YK|AK&?t;=q*ov~6kgdpJ_j@!OwE55~54IdjUk{C`
zt=X!zg4g1q=)ybh(!*H)%un&%u1j&jX&=Jpt{6mLZx4DKW7uqj*3EZ5gyq|Z&3M+}
zzMFr6e|Gi1#qXTD1N*HY9^HUV?Ybtn8JF8?Y`gMeeC|ISiYM-W01rO-7WPbLaCY`%
z-4l1>XN&(OK6~O+cX9yqPCWm^o3Zc%m*dl4xR&<Q4R6I858R4xKfVpSH?P3!Yfi(v
zfBOqK`pp;c@Uy!q#&z0f@W0L*bzG>^8p6iqPvPOGS71n=cwjt~JMi>vKg40zo{j(b
z#mg}<vIiShY{u%HOL6deXI{j2sgzUc%p_mZNCk_`GI7iIY_>C+C0j*0WbY|XFV`I(
zTWUByt0|3;)89#W6a^=9w8_d)9D;G#e4It-N-WtmKjBl=RfuD`1PkX0DjnRmnvUXA
z-P?R@iDmq{rMYUnPx4T_J;;qZD8TMnHwbT?nXz<{VA5=vITvA*aw2S8-W{LPMduJY
zUEP^liYz`3C)q0S9Zvpm#TmFpmQ4V$hi_VUtUI@>0Ov+%ng_;L*)sio{<MB~++$nQ
zz9hF{PFn%xDk);b4ALDTZ}(~$A!LuPw}>CJ7152I+~H^*?dUe|+26~KOF*zE5mV9|
zxf<PpXI3ckMp~$tvDhj#X9c?1;wlyt5VY2fJHyL7-|qvKMT0f%(g{WT*KS6(R+uYf
z+o5ApY$AypY^TG-#0eDEWytCA%B94^5y6Dt1Lh`xT$XM#bDNG5X*sK`%Vm^VJoR=p
zI2FBc0;=UselDEgE7_gc?aIK=ft^KzH%w?sUDd9RBNfL~tf6?J*EeVc)fg=r>*j20
z(rWCXl9srv8@A2I5m;i{q!!@Gq50UfX%pUAml56rGcae)OiUl_$H1Xy;iiwDjeS4;
zD}3pWSFmlQ?dGI8I1h^sorPZAG6K4Vw)uzd32a}x3!Q=Km@{t*#y79S_EBT)Oq+$d
zb7x{oa~!+3ZNs*mLuh&Prf)V5pWlVOTX$m5$OJeNi2gZ?aP-1%Y+k++TgNTZx-o6u
zLL4%4&?VAzM)zXpwk^iBY38=87t`l1!2B6KD2<TWymJCm=FG$F!6v&w%)E^aWB1PO
z*s*&*#v3zm*y1Ue*s{&Vw0h<pj(H8^THL+|BYuxsa{zM>HF2@2-NxlSj{Vzrq1E4u
zkxd)1dqU&j^?&}dJY~-8*|`3=eYjxO8ZHAzW#fEt*^<K_*3yFCht;G62bb``DedDE
z#N-=%<_B3{inHg+Xvra3S(dgatB-`9V)q~vf(tSfB4|)TM5j#~emMn%vJXLm%bkwi
z^cER~YWxOg?@1t@$W~&>$1Q0cezO-@R(2fmP+kkCYfn>>h(FaG&T69b4ath54yl+g
zIJZEDBo*4A%^nI)Qt`aqpUvgUJ#@%ma^a?bf98O8S#X>NZyCRfX&I=ji>k%(6#LRZ
zf1f+bWUNJniL6y-kF2+@J$npDFUMf~X`JKZbns%!rJ|R?%4xt`ca(Kv+wSUVxUx_#
zUS(Z_irjQId850>SWadZY_^>vpe7|JxWcxkEenr5L#xd~&K(nCH%VJlyh%dO36p}X
z6wN_T8$4^XfNQuE%hFkxT@9+QIMJren8FC?w&`QQT0mR{xvS{7>9#Sj2G5rdrrOFI
zRv=mTr7P*L=y(F_hE(h$r?h@@Gn8&~G5O1F#-J^<J2uin|Db_)f=-*ZXP-IC&yIsD
zCflS9t5_&^BuWPx8}p6eTJR1OT<KNx&caDoeF7i9Xgb#1cPnmtY$djjv~ln{c>SNg
zyx@BOv3qghoYhVNw`<TUw(d|!FNjJVTymj?yK00DvOYn~g&P_iB49V4);^V<T>Q@U
z)?h`Q)6HW%AAB~J?@KxN9>vzl)8pKB?J~r-{Dx&$<B;LDmlp0tm&x5E_}CDly;^O}
zuESXLyx_Pxd9ipa5er${UW<=taY<NwVzL`w(;ZmvvLJo=s!ozv%v-uShUL#BE8Php
z6r+<HwK>;~T!p3YQBy-MDZ|B5C}YlM8(KG6+nsUMcFf%Qc^ln^iQ7m+%eV#`Y)vU=
zkxaOpdn)#5answRh`2uv#Jf>x!!DmwRdVWm;Q^%BlV##onA&`YrrXy<oZk|H&AM|!
z*TPa#S!P=meypVQaOd`G)A1_S?br##Ls^TeC_~)L3Kmz>&~Dzd?mtaOqgWv|HsMS&
zCxq;z4D_0bcU3GJPO!SO!9bgZn_Uf#mmye{U=!cI-)fhvxwx5g3xEpgH=LD4fk=z@
zrh$X1ZrbeuHVLJhi(J}N{w8M{p`*ht{{sIwBK_sqPQ3cyZTR}?X&B$Q20H*zK(4<J
z3ax|JJM1F&9a~g(Ju4kzslmEYwErqrSmzK0bf^?zc|hBxuY<Gcs3e>_6<)_`7?f3~
zLwdQ(9xOO+#%!eE`hCu=XN?QHL77iwb~{BiRp(G$l=MKJrPA>}SI@Mhg5i$;HKGOM
ztAcnzTaaY|_!w=W11v5>drXJzOC4ueP$EUCqHED-fLn#!X9oHh9;Xjb79|VPw$E_X
zD(ux#-X*CxtJ1+wHJ{uW^98%foVCy-Gp^%nN%@&{XF_#c(uOtlT*U{F@78UkHIuY|
zeB7O%MbgKg)?3mclub(4w3FW3AS=R7V7G0JC!_6zDD8}MDWG<rm-F#<ObiGvt~545
zrKW7b-6?%=r!U)$c2<DVu_YFPuHL(|z^o*;R^!Cjgk$#hR!>8R(j(Tg>+SD$gf`;*
z%%&~l6R-&(wrrEF*5USD734m&cp0~wkYU}BUFZj8y;(u0oggD?)YS%4WE-m@7WnPu
z1L)i-s5YC?wAo|EQjXK+>n8Zn&L(Ye*0eza{pP#f2i0rhL)K;MT$&xl2gy;@eqFrt
z_Hj*iwfAkn@?{%v@H%+CBd?O;*Df)w8*B-Psu=tqyKTjlV=5@k*Jr;qx)dK-qC*0M
ziw%K~8v)146ldFUL0-;pb(wq4<<??hsA)?K+&O|Ab8`g|XxmPAcfqlFFBLS!$XntZ
ztO8u;6d^uF?mF*e<fM^;54}Xmg(YHzcPexMDwqJ?C+7G+hd(S2<AgSc2UqQnGNYYq
zvB@WGaN>(IHf%Oxp+k`g+i!Qbk0ENVCSTe!xUhf7DDsMo7^)j+$H7dNiqG2W?_G|=
zcG!Aoxy%pipKrq!A{cS*F|uU3dYc%umch7j^VztMd8XM#`@WpuXi@f|O)%(aD&^$L
zGNEv1YB``mNVT;Jtw0=e$nP>S4<j($Cg}$6M=0FD?a?aM`Wl_+xMGt9r(Rku!xf+{
z6z}V58$s7#)0PBp=~6%qd`3Wx7`L3Y%KCe|ou=Y6BZHVRN}s`~jhk6yb#palO$Sl7
z#wSeog)8qgrLS<Q^2#1^Ry3TzbDCJ;_f(j%u#3S8<HE(&8qT`22^amYN<+iB5gl&a
zaVu7+HC>X-wta>;?S|yiW?gpp1Xk0Jm7DC^Mb|qo9sb~T@cPGiQQ0CLO2>tGOi3BX
zT!bCo$g=!y!mP!fKH8f^@gHaNaEUr%%B~nf16&b@yjoP}kGIGuiaWTl2Yk|n4(>F2
zdADMV1y$i<SPcrFumI_DysG2efqq|?qKvvw?W4`bY`s<IQ~zBehI!YWe!()qZ(4Q*
zB6?!nt7wp*Y<GC8fHi~~WX0KTtN?41?~yi8a~izQgrtqd4d)tk>1ozNY?d)i-kyZ1
zX@8fs%=-IiYm$pJx7r*4v&jk81=dt<FH~!+Lz=%LMECdfIi}fQNo`|I?QwfDv0?6`
zV=f87cGohDxM+}@4xr;rY^<qG8Qrvj7`(a83O&wHWPDQPcw2CH%((d`#vP&9OuTVz
zV@st&hE2pMM<<+rwZVCuUENJLdDexejH+Q7dzaIA41+hIbQgRmrlN`+?e;ilev(kL
z=Uv%AX3M<W+e?)wTv;i1W=_Ki%5Ed*bf@968trge4&EkdI}M6EjTu61*b4KY#0;D9
zXkCOh8N(8@eU?f=DKe=Wl%=SQ<)~P=brc0vEpc|-W@qvfTUV`(wK;9X-gikbrK_Z0
zz5`1>9lQ=+{}?YH3!>9W=&ZgbZ`*OzaN1M`sq`t}u)-p`+wA3zm}l>fJ9*uQ6S&ww
zspER}Y4TLx)UhZ&XUp%`vI45XY2t=289vbMGQHdEB5VhDq(7gFTzF*dIqR*>yfP$u
zs94>i@UeI8WPppva7urp$tOB<Oo}R9XqT5@Eka+@5Fks<7KCW{Q=bdPu`A_{e)7pF
z?t~3KQQ8VvU+=JBX&v^c+Oky|LFO=mt#MF<GDFk}!l|70gDs<EVYVsqy4j`@BOpO%
zGv(+gjd(t@i{-SvKbTEaXCc`^wL|B&v{FwOpJO>e617=SHlQnr+qM>8(;&0$82v<t
z+>S1_+zPQ4m4-r-Oxx0>!nA2zB?UD*E-qxeq2|6lt+<;5iY-lULW^+gdTUS6CJUQr
zVv*(CaO1q;86+&Ng*GwH`x6*91$@dTFl;1PX)|jYnlc$d8;>X2oJnKe88x`<=30;B
z6SnS!b`qPiZpoHzakYsqjE>uE$R?)tTcx7qG!aYueYV(chq7*5y+!taAG{7;2d{tl
zMR8-cf&f0A#8-YW-jeQyvkp|#D(3~)`lFQY*0?5DpXF7SX_w>{bJc;AI7&oQB80Dm
zK?xbkC9?U%2jzt&sKSnQTUx<j|F&B`-vFGRPOdp;foY$i2f*hWvNZ>v9O8Hxk4+(-
zX3YD|d_o0nj;45;vkp6C(b=+2_RtKMVCIBY!3K@yKp>xHuXtaYjZAeoB;sOSItXf;
z;!dK(x?j7DC#l0}{f0;Pb-OKD6cZ$cqN#b;v({7*!cL2|M(n}6_Ux&tW`YKKda!3`
z1j9C^-1O+G#FupJM|WS-rF~lKX2Mu1UG50$!dV7gPPHhxcrOuxjXqgdnoH!c2RfQI
z>AV#>Mc5r>!pEF690R9hhT+nt!k6yo5u2*NXWs}WRF^xB#Mi!R8rZDmGTx!h#co5i
z8I_GIb$Iu?W^Ja+%>1~S_|egEkQY|FNwB4!`npUktxd@#E<o5}pEFaF9lI5rZckr>
zHmKT7b=JnR@VY}O!I?QMu&rO(W*fTAbcKzN!R<Tq&suBHCbn32#DH;Gb~wpp)Zk{I
zk56=VsqYQvdT12!_!JuxvkRy3k0-=+@H%+Cqc1+Gh=fZ?m4IAg1N#RHu8`xmzPq@N
zjbo3}{!4dkk(WLoMb|NLO$Q+sR5jOmOkCmwsJe#F;8RM6{Z-DGP=3R2!EV6P#nEC3
zCfXw7lz8sbZQAXk^mym_;xonkiNdN8vMFMLb*=`|VXMuZ{LEW}r~(Hm<%+ZWG}oSO
zxbwzJw<W;-wXQ?km#w_vEX_8jB^EI=(pAb((W0b;5xAn&)`R3u=HR`q_M!uMOBc^;
zb~owa0X~h_Rc0{Q>oo#v*u-!~jWBYRCQP3_E>WW8#JY{^G>ob0EFD*?tD9nCnhN&X
z0=MNv$C;)!LvGx(<q9=6$P)7hs@Y+<>>Jh!$U1H~;p3DRgKg{jE6w}kygzDqgf=}}
zSLK-T0rvJ#X5z#+ojFWJ9jWb>JwwJu(rk$zm+($Dv5jrnbozqoqL2w}+PCTO4c^de
z&%Lr+H%il2+X&INiQid4Wr?oKXaU0`<E|3DBQAGriKZHe%DIkRri?w6xiFTK4Q1Lm
zUE2`~^=Vy$v_ZObhgMqgX@x26W>*f^QwItMwSA_iyVnTUw$t=RTBK$<tFIZ)A@kbR
z!Rz34@cMs$d1YJiJ}b@Hf-Y{=(40j`>(nZ@J$zI_lWU5#*(z!CiM`HJvT5R+WvsYV
zhD#N9fiz;yZB8w>8n)$qHeI9TTyM7RhRf))O0rLguxD_Qu%QEIeaONWgK#PP<bR_$
z7Dy0NL4-1#=LJ{fz~w`d;N&`jt#;uoC`#BP%g%0orjzQ85a}nF?R~p(*p7L^W*zn@
zPK_iSHk#feM8{pZ9EC<aX2orpa^W6?jK|gl9ACEluf+){%`Vyo&>U}ZL!7D6tx3DE
zZYj6H*dBGyhe6tG5F6|pYm=YVR)@DSn8H@hut7eX{nsQZ+U537b*LJ8lgf42%p0e(
znD<6IB-BV!*??cunaMU$!A^*CkrsUFvbL_VrX!SbBb;ouo+SV)?gsn2u+K<nD=h6k
zGCTh^gR!C7&WdrFinjRegq@PM+oNU$vvtW){Y5fsU8bSU&g1x0%UCvrv6OmjMxp7?
zy6o)OY~awIp)}N{Y{@=w#;l?w6<g!5-D!t(|F*+p;e?=d`B`PmT7_-R)u+3g&LVSJ
zmhSiyQuVCw+FDxOg%wy0?A&Mi@98){u(eFB_10l!Ze-lTsoX)EE?C>34a^6xgV(|9
z?{^giW$L=^GK$u4$)~b6`4n_#ErBXQXqUKLIN{<f2nv@|vc|YVUr$V*j}}!K-1;ud
z&U|-OE`VUc(SJLfh{4$tI=Thv46hg`vI4Bx<ReQ;s`}FzbB8Z+LO8{sC>%t>)?0rR
z_MrWwE^)&0F_3`h?y;wHsNk}6iFi(Ulun2$MOl?jX}5dQCfe?v6<+SBl8)S;#(U5j
zl*v9kObo2AA6(y+T%{A^e9Arf1!*su>C}c-TDIteVZ=?FLT-~ITv68+ozQ6o*@Q%l
zy}^YMn?`l8)`f19-&Qq@Ke9!Y4=jT1=3!UTsI(^*H=XG^!JB+-HX_v=v_+m8Bn+*&
zZGml(<JDRxmOv~cw^moL5y3q!IM{MlPfr(FXg21x&j=G+e{f2F55|l|)^dd|8{{K4
zZ4LA`T=fOFiP;F@fo|I5Y&RrZx0^e&%kE1s1lP8e@9lmr(_hm%O^pk&#|VNEV>KGX
z(wVNVYQAmDeD1dUFie{xHlWxk`GjRSpLRnv-A+5JRk(m|gVO3-yh*#+)#LVMjf|2I
z?&_i#p(}$`S|LfoyU}b?t;UiH1X}^uO^0%s_S#M>v&kS0Gv*09ADz9J)fm7wgTwL8
zI1XM1uY=d$@3Qfg1%u<5+dC4{!!5(Myvmhn;?sjD1FvvOu2m9SwtzrE;SZ&vuxWD<
z0(UCA6$}Nt<}?Y!Hh4P{5G*72oAst>-W^nO{sE`|`Msz<E6-Q7C^gvnDqQji+|!Lv
z&dKufwl8v6(zc>T7h7l6L{zjz$@1fpg)Q7Ol#5{bPr=!h%?1@kaA6{sp3jHu`u)Eg
z=ePg2g3l#h@aZ759}MX0qcK=PMH&3cxhY+VJME9eQY>IQe6);pB^uvZI0&&Ilg(ws
zIV-3^yTmC0#0i`xZ^m``bbQv7eW1zvvL<Xz!|o;-QO;a8jJc#F0_&2SZ~_HRin_8S
zt+)$Yan_vXlo;hQ37f_h*uog7exfxu?LB*(2UYK&SX;Z}1Dzz12YQ-L(`dJ-3PnTH
zMnT(F!=E&45o*r?u_^a%12MT7$89E~MV7H5N8Aa_bZm+RuCJ-wz6fXPTOXpWBWM8c
zww8{~035eTAT37}c9OaaQjbb|PMCS$!fZDU_V*DE?0b%k$#du?##&87BV;za)0nMB
z)TNx6><GuX&l~9DBW9>FJrVE>gQ=xm`>=iLbZp(#4&}HGUI(v(*Dt^98l5+zAE(V9
z!eKqTseT|AO=v3e%ve6sU9b=+eOV<+6L)d;uENERY+cjB?^UvE)G+71e&yU>u5hj5
zqka_aRk8xmK5BUlDZIYcA=s)RK3p`IUvm<jRaku?U02zo;SXJ;3=0>ZYtkOi7E3di
z3((>{V<neW0;RKeaYZvLh&68pwpLVEm*(&bdAeFH66!YgW%sg;jgz%$1$TE3Sz$iA
z(Fx%OWiL`rh0Tg2ccqKma6HcK-BOgM&)`!b2W4y7ww;w%w!KT1vq##_?bmVGum>0V
z{CzSz$;5Pna-}#5mxVZP5pFnn-+<lkMN-t(I~*QuJHgPj!L_EQba7Yz4=&Nc{R3BC
zcLjbm=lpjlW075#whFl0YgO7kU8Y}~!d|wWf7oXAG+iovmot+)#)h*dD4pG91VDpQ
z&PPT|&S-Jc*Nl@g5Z!J7-l^`g{fw})vA70jHoB9Etv2N1Qw_Hvc@)lgH`Z3$O@eiY
zI#;T}MWaImX^DdNHW<NJQrfI_<5|Ju4!U%N)gc$9B_{jc7@g@w!PB-4JQ@M2TsCB{
z+jLjDeO{$*x_KJg-*UuKaCTycElex)XJI=|nA&aR?hNeMKjPfA2h-#aUI(wqFUudS
z7iIR;UR-wg2u_)~$t6y>GpMLm8<#v%p&Et_m$)q{RsbmCG2o+y;EQ=X!NP~cHnb}s
zVAp@qq%?IG=N6$17dq&oDi<Xs+i@j!@V+w6P`0uCk<wWxJv~(H!RD`bK-q{+pmY;#
zPN_$S__(v|{0aB;$?ehAT-{y!>K2r`Uvf;#r?$KIIwfypq8ML`%SUy5?u9J`KHlNu
zq{tN+PIp#RTXBM|LB;OaMt6fsM|oieuKMB5LDVjfp~E2^+l@<b`}D~Jx`+LwRuFY@
zX%82>QdCvg9Y14DyPm=cA3I4yE$yD^D`;<k+e>6?2wFj8fv_o~micpGN7}nY6AvzF
z<n|VH+H9dw#t8XK3%6&=3YAuec6Pgc5G|^o=t?cQgBdMDZ#oIx;SGFl1D#93C@Dcg
z`_qW2h%G1fIHKuplGS1bXH!w-XS-?HmJzltIJ*hjxls*KjBsqp6_c`lS4)%@M_rWE
z;to|~?WT*%FS$e2l(pzcW3v<1CL@*GA|Gy9l1Ac>E@*LfkkaIWw3FvDJ#ArOo4GT=
zRwGZQ{k`QD30YWnQ~2KQ+1TEki&53@_Mrf%=527IWaaNa^il`ttM0q(-(Pj#k=;9Z
z9lZWOxLmBfIf|wI+j0EVt?28bW9;2#Sf$uiSWsFz$ETWH!p&t-yTmLyp`yu&1+I!b
zEpNxnDS@G+OzVOYx;oBnr+AMS!@^ctqd_qvaFq>rMi-};mu!7Cnkr-}S|QWz3naiN
zUlcBp!WP=4q&3R&cAI(qfsaMORuS=$MuUW<Uw$2z<UwJKqCw@Wy1Q7AYl?%pvvw67
zg4<vr>-bokV4-bWlsiF(2ZM_bgA-N!0hqi6L6OjOR$!BgR8Z!BC%8$~QHL+lz^~4;
zYWa`*4{HxTYrOKNW@P+ooJWPX_<PRi{Er7<y765PkP3lP201pTknV#L?I!$FGb{k_
zWLM!k^_e%~^@sR9gAS<aHW`feprqWK@>;m6GZVFkN%o<A1IfJTIC&l!VKV7=B_L1W
z36Jmxl})(Hk%<&X0YoZ`L+)dyA3xG$s0XIZ$!J%F|4ede2*UdNNo`4wwd*0n-emm;
z5Gwcne()syi_gI1xT(`EDqm_|PTE(Ibbe)}LZCZY-@oeXy6*X3f-nD$QsL>eUzMzN
zCB7)pS)dj%;5s~n&y$0bv|0C?$~(=UQ?&Fdm*8=e&7YbCj>>%eJxFk}cJsFDt~$E)
zS6MUPO@I7*-Zk-__`TqgBhF9ho7P<6Sktq<l!*8_3Woq$tfuT@RQz~C5JF&3eJpCo
zmGcVlr2UXUsu{Y9#H1u6msARgJ&yOuS?~lRaKbS|KgwjsJbluE0jco2>{jvH-n@@g
zsQBy|>W@}|&v5eXXhkqmMkpUlpmne&14Rqw5VWxXU3i3Cv``#l<mZ%Ny>gLwymQdk
zFI4xFLaGtu<F?P1NaiChbS)tAf0bxz64IVzRVexBq|b1xEPSO>qVm-;*~&^du<R@<
zbAGlpbCq0;bN+nDY17G=C1q8{qq6aMddh%~*c6kcso%oimz+1bM2E6ziR479L%^xm
zsy$qO{*wt&fe4TcsAkS`sOUregF%Oq%iYhd(g~iF7+Abdu=}=X?o_~|r+@dYL{*>)
ze#Wna4?5ul;`#g%f?hu7a}$vK>={-1Y*>~x>!4l{Ky?hVeU-!KnUQZZReTjZ@ATiQ
zefkZ?vQxj8jk*k66-}f~WrI;+O**qOaH-gt52C>{IkDimL|;hOh=>Rjz(NTKM4){;
z^q5=Ff>^?<3I3P~C>|Kkg#3*@abZjGi~lvlSLKqlM=<#!nV#`^ropW%u?(bTg0Pke
zM^Nl@rj%68{|gVokHrg?*p5=-9#TG{1%t~iHJTfhTAVpC>4;C-%c4`BM2&c;QX*8M
z&5WTaId6>X(j&z0j1LP*W%F}@)un1bR$s}Ot`fHs{AqRIc9Q$5de1Xy4WW#wxW2_A
z_f4pp?$j?CbA9(&!$4e5$jDoXLfQ!uGmP`v^q)N)MnNCp@!M;7MFjp3=22{vm*N6-
zR;Hji36Es90=-PPf=O!c5z%63erzgh)l*z-P@*<kQDQx*_}#BZ)V_nsh9;j*n1dS*
z?=e-n`eN$o$>vsm35pWp9EP`$DLMJ?kuPW|ytK-mS4<aDtP9@jd5!Yl1@mE^FBL_G
zOz>QVz-Tp{Y%d<HpBN<s2UqX_?<|Ong$I_5O)>|KObLhr3KB>apY<l9>_apVA!Pz9
znOQ(3WEueSVk5dVQ$k@3g@%(wDSp;D3_1?dvs#H)cfcpV5TMYJXuL06D`bi;Te*cl
za7|n~)#hn|#9md>UnIT&l%E07rxO2V*LT=}sglJl7>Bn8RZ5_tKP@QATQv~wRmM#a
zl9Ji`M=~KZ`6bBR1L-?a$ski8wNMU%(xo8=frOCjF6AAaI?}PAAL;rFG|CHrXexbQ
z3-AI#bN`XT>Zn|0>qI4MuPPhr#+CMm1Qz*@K&Oh|RB~U1IR(!zv=%cZ1(yy=UP^6p
zI65rZlrl5dwh%fL?~!X%5R;B;NX~!4kLb0aNJB?h5=ezIh+GKh?7KvuWQ2m@X*rHs
zvq)9Dk_wT+q*hjXBXHQXX%CmjQJ`6s_Ai?7I8$K&@lmZ)T+y&}>{-H@$XQhxc2gtK
zd8z<$D^W|);lB}}>}d_*N}IgZWD%;$REM?_l<Ekv&gNRSQE?9-6($r9LLKgbtS$eW
zE_EoYq?K4MDizua!kwCQQDu5kb9L@kQ2Ajma-?PCajhVTNN1f0B}4uo-LurC4*01k
z1_H0i+T@45prXRaIb+E_3z(gKnF|m>E1nrCF>gYTs1S$*SJe`@eAy@Olo2Okj-!<<
z-;K<^hT-_Wv*E;bk_xP(eTBrTgvT>K<LNzFn*m2E&H)spJ3n7LN-UhnbTXzPxkkol
zP-!&|R`#gs7A_+v;uf9@A&(jPmV;XzxmZruaiQwR9NrN`9p)tv8RK3sV}dCTOjVds
zv>KDn6jCU?1}Zv^OD8I1RGFd%a8*TO#E+z9*?)LIhNttF<Bf2yZo<;`B4F%EQnJw+
zK((IycR*Oa*&6aQu4|t6>qPK<`=4es!6X3Opct_4$`y#!Q7@F*i)N<TP?e_AOAG(5
zN^bM|VRoVfK5`JXTyJrK*hfnpX-e<|R9aDyG01w9a*-!(E3Vh&H?l)$%Yv?a979f2
z&{QN~$_o*J1BS=9Q8c`(lo`BBVvH^rx3ga(F$|<NTnOBzxQIlMtjQq71fwg&edq*I
z-<J0HK<)bDzI38EN`=GWOVUJKGwv#~XCYt@?}RyvV+q1DJQtZ#E{{SJI&Dv3a$5F+
zsdmXK2&SEmS!I1D<B)5s+N3lJDhoc$RiN)cY8l)TK(Ur4V|oe|cs#E1vB&YL?0amh
zK$Y!yz{Fz}#UQ|;1k*vh=eN^{?o%8nm8@_1ockQ;KNpV5G5hE(6;jauoM_7`K}=XR
zTK1;}Q6nYX$|se~g&Y?NR<FbWxs}b#OSGs0ED4RK9fl5~p-`prRDAe$bI*wwv=Ep&
zOiFeABs_rImcKXsn3QZA>0mt2ni*|s;^+$3(-n%8u7PCO3A2#*H4n_!(xM&Rgv3z(
z-**sbNC(19uG~sf32^c;RG1-DWiqu8BoSJ2iFgU9Az{pWBY(J`vWOeaf|o2AUwkq;
zL-N+5+a#y|Fz-5IKRm)nmkV0e0~$1YD48app=zX4p{nj)-$rhMr<yJVBNvQCbWsYI
zWNbI1D&dNBc*y#o^&<z%?j^stkh=>beo`XMXiRFa0u*V{X-QZ7N@%~bYJHo6#@!T%
z{xJ#X^=)ZxLq+Bh+|pWSW5|Qz87zM0-McET5ve^^K+%ZtB_Ipahf$<`=?Wi^eM8bl
z&ZGjEgc~IYu1cv0!bl|oO2@^Z)92*k%F#VpAMpvM$AneZO*#(n9b#UQ(C`7f=6Oip
z%_ZQ0M<LgA1s2&?;43PFQ3<aLYKG)_S(FDVYc?5{-F74yn4Sa&dJ+@R4@gUw05nQT
zlDf(iX%O{o+AGkUj(=6YjsuYjYbi%q;NX#P;-KOyz9S{IF`>OEg$m-8_^-dxLKQlL
zmF~s(i{e8u;Y-N}kV4^0ra7Oz=b2!b>TD6ou}d^4fo;DoOP-i0E)n6aX*;yVlb(}`
zlm~U%td@*CYd7LnrT67up;ZM~MEoq^M#U)&E&4gg*Hds^!M`04;FXgw5B_;o;cb<%
z#*PK~`SI)YS)Z&S8KMpdh>a-!QXRw2`?YNqaqXmy@K}|Y6CEfsxnJLbq=l$eSKiYq
zW9n%e`4#C(tQ*Jysan>a)01X_tppDVbD<DjUO7%fi}7<xjR<f^{0CM$IXjDhO-3M6
zW7eo|D7i(?Yw?4g?D<;GuTpXV$I>y$B^SRILs1CEf`3e=t|tm(U9%De{GiTcN4;hT
zcT#+fz{($#nwtDw*O0VM7HhoEZ|batysN~Qgh&(eh0H%2;tG7*A8h8|OBe!Do*>((
zGM2a+B^{)fTp7s5tR;=d4`FSx*kDeZEOf!>sehd`;bHbix`dwvgXUMO@IYn4LnR=}
zxSIn->zZ+=uoQ9u)mfS<!W`I>U$42}NT)C7na--R5F@>*{5=K4$cgw3RT+@4^$d(G
z8!m$p*(KYoEaup{v@R0`N!7QP3^;oa$lsMoIw}82|K{sS^f?*sGn^&uWj`eH7GSHb
zUiqSDRR(K4d{qWnGZ7+{-8Ut;5n@K0cqd`B$q1|SEC*P*Uu9>LUl}6|3q<t6KP1~!
zVpkM**EPTBNxDlut7?N15t#yjsw}C+WBzi&<3wLdXL%E4y;sLS(43qjRXa;S;75FX
zC!~i%xJ49#=8C8j3ux1kB%XrMQS_HmH4t_qLM+4tb}gW;61;;)P?Ptw=52UbBQm|j
z^{s2ckgCt88A>tMkYfS--6uN8!_xfr1Nv{xK$Lu2^i*S)E4i;r@i;8=sGWbHf;<1R
zhgj9W;u&RNs^Yzv6p*gu08SV~{19;}2{{6-MZ1wnMN7bSrBp^M@i}6i!VRe-JbtT2
z#pPJP{CI3thMJ;S3qhj<jy%mEwq4hs$~lN915a55K=6Wy#j0c*UcpHu3aUa&{;kZA
zLN!mD;ZP9cjG`#O%FI5^w)9U%?~PAz$zwwie>p7(Xyo)%q&xgVKoVOO!wU*r-S4t(
zjXGo{T}?s^QD`X9FCej%y_9#H(O}dzBacHJr2-W#7n3wyCne?m@HftDRnj3{&jC!G
z3a#*}P$)9Rz<zD!eJlA{M?KXqXz5*75?-YKXX&C($wR;<I}e1OAyW9srE5dtBPW`m
z;W0hrGe=)#e1oo#)ZrH%2p)>HWttfeQ0qKaAgmw{G*G1+0dfG3@fgRM0v_Blp!2>I
z1a1Ruq*k!B6~h{lZ7U6Fk#w|wM=YOOsz+733c^aEcH>DHBLZPY%FvJ}v{so=ghdO=
zPeH2+R4&gJ+ta8DPG-u9ixbt)k{#8pb=O~9qv3;+iwcoplM*H4f0JnRNq_av1Q)bu
zKkYwR+1YOytIU>Qj#FKO9sgdA7&%LkL{xoyx;m-=XZiwE7-!^36|2ebbM!Q26_spa
z5?@MUv8kYxdIy$n^kdGkXW^uy7NC3MlX&L!_1HDiN%ch4g}(Vm;fTW*W8vJH?p(v7
zJ&JwX)?vfyH?d~(UU$TiYgy9UWWs^JH0GRyGfzJr3wpQVwI`m#Tif@AV~x-|3k!}s
z28$NX$E+y>=qfsB4e!COO{?+d8!NDLv;+b_;}(^`yF$GJD}`#frBj?q{)E)s90{y$
zXr2=4)^QyuI^m5?Nrt6pL<{Eae)ARNb!-4qLq(KUg<q+jAs`)tYauYXlwJ$LRA~>B
z%Cy30i3Dv<sEIM1R!3`3#l@n;XPE_8vLulEt9&+}XZng^^7a!6Gs$RGV9MbVT91$I
zkrjZ9YZ1(r7z@6q#Uk^#m((5v7WZF>uIc<69%Hr$pmkW35xR)~-1PNxRA=$zyf7|!
z@smpNMwXCHt3+@jipW+EF2q!GMy*iK!O;SyRM?eaXMAwE=&Hc;3RqI1Mb`^+8KOub
ziS*%^r0rIuuPP<6ufrCL0J@)B!EEX-$xQs3C>T*b`Ny5)t%Y(a=Ez$|k`Dy|mOTrk
z<MjRMOkgI86t7o5xe*4rCylN`B0x(x#5(tyDSwu0HheB3q)ITFkcM836>vxCm^}|v
z-LtUh%qwusHSfiVOXs2W@K&r^y9v97>D+kxV2ME-e&w&@ednHlMf0YiF}e>!_Tbm<
zDVQ;+uxG_%c<d*)<H6-S-B}b$@HB~dUYZf_%{e&vs*m8>%TCAA#&h`Yn??Xy!DYdn
zeFm=o=m&7(5sNUpw}oL_SlbBC-oa_;Yi-4A5B~u7-TMUAjmYGxY+khxMtM9*NB&lL
zLg6|0pX0iaeWXMq(97?rxVG!?5atD8G5d93|2Cz&A=&7uGv=VA))#kkdvN`uMOcg~
z@MTYYrKJ2iy3vToP9q8e??wxPBn&_&3?W$rs@|O?aZZdS-i&TeT3I?QM86=oKTslu
z_6;e4`^cWNK2z79pJ3MqOMhDoSLrhJ9oL%*j8xUB^!#7<sm!c_upYz)Y=z)5bvU*{
z(eEq=f+wfLRr`tAXd&<r30S&n+<Q7QLGC|h!)Zh%BEk`#*C`YAN>Q@gUNA>FNF`Q#
zbn!&M;<f<AML;8ibu=duHG<m~5(YVDIo}96h-AY)?LMtgA{VAg#_KKnWMtXGmS|1z
z%QQ*!5phuX84qhp2k(e%Gp|qSI|@QA>oZp*02L7BmD;e4Bx+ItCkTvEh1Zdd8yT;t
z_-n+A$#~>E1$vExjeFM=l7+(7mb|4Hx5bpjIQG1&@$Pq@i7D;Uon+qPF$Eaim|AEJ
zEW(ohZFu#*ALI44+cDfS=0M*}9C`M&xb)oj;IfHrShwy@yg3rNuoh@k0vx)Um~zzl
zxaeK8(W4vgGzduv+5j?Z$vmjl_v0rot-zMOBSt9ppl|l!IR5ev;nK^m!RW@faPu=;
zT!HX_Uk|@hk<aR+<Dl5d!T|1D*d(sQa}g1~1C?5L2~+Z>g=8VR=Jz;OKgXW7nw~(z
zkN#QNnddG#LgB@e4#XK#xs`_&-u)H@jDRh0C^`SZg#y+Z1A`;x66jfZ=HLfVT?D0;
z3okMiqG|pv7_r=kVLwqFM(Q^z8ahr!4bnAZ(tmcP{1Fo{!WdLs+#aYh5qdg~&v#p6
z@km^|w-l;ozw1^oW)HI}5K3ePG^oI2BDQr(R{{?SD-JwLGD4&aQb!tL-jclUwZGDX
z=;yxLbrf)dhCHAODKqe6R*WAfu*wLpuW0R&7=$S|RO%Y$61z+0Ap#j0rfe@PN<mWz
z^FVwxM|)^SiEbeId}P`>Ae9AKur#av)O8wvO4mv<=l+hO+0J20+6Zac3b`Db^wJrK
z5-=Utu~ZC^;KX~0Jg$9^ARCJkO>;AjM$`-(e%4jE@~U$%YwNSPXT=n}cg9p>Tg8D=
zc`)1R1hzf#ZG7j=QR5a|V_b9{YN+VK+xxpQ^@z{lg2PY6F>~+6n`=mnNS7`mD~n^F
zaSTqo-~!Csy9(>OXJG1}h8&>U_a^TD_FtoC+e)n4yvLo)VH+s=R$(g+$622~5l6l2
za7=x63wDQf@5k!lhx35s!aS}sl~`p;SU8&ZDdo>3G>=IpFed{YXGE#U|Kd{e_hhX?
z6$jxLsXs(5-E|%XK*YETi3JicB>+t{SID*kOvu+#+{hLYr9x~8Q43I!#mWu0st#Fk
z!10b3%%U%1B7y<)Z@%AfkDpGMfnQK!uwf1Zokro{8H~5Qf~Lqa#hpscl$}~3x{7NZ
z8C%qnJj2t`RYkrz<m!+Pf|80R`!N?q6_+x0KzHN2QefmvR(YaEO4(sf5y48{7c57h
zT25a!4o|n9hS`y<gj~_Fre@4d&rqXN{4$?J+!Lk~m;#QJNSX=$VV(z_y1vAkjs0iM
zL1lu<FAE-r_h`^~JR|Y*DCQQS+eoKckU_9k#bQOZ--P}u>q7`SIaVFpkn>fM`3W|a
zxGx#5aJTAsFZNyV_aZbLLJvvH5Cx-EGS}9M8Xw+{)sNqW=U;siFAZFUi&~llmllG~
zjjKd^%d2>4OE!093lsY`Vbjhw)VzN5_c7h{&BvmX&c!)L_hG~HkKm=(H)5!axY3R2
zSbX}WIOq5tyz!IQu>b6%ar9t>+|jb$kM%D<Cnt}(oEXL4O<S-Zr=Y8U3cBM=g*i{r
zta1Vt{8tQ;Tlpuy`P=B9GKi{KrI1W+*5>3_eDH_g`v$gc-5hwM<g*^8W<oFmKCcxk
zAkk_NUPfp%VLwvx1}0oF^!=lZAkn<m6{hP*&oeS`3{A(jAr}Ua5T+D}@Z-xCT>@vJ
zf@>?r?II3>E0AGP(G+7sW&z9XstAS{xWp^sq$|GwMeI$-jLp!10z}#jgaRfkOo)Y*
zQI8)$_)bAm&rs<QIEDu*k#T@9;idFosHFhOx=8*e?a8T7;DayY+-N^UK}SmTt5oJK
zh))RA2FFG!5Cf4%hUgork?V0>$-2pyGW<L!hM%oSF^~3CTP52=6hIz_k`-x0Au5KK
z2%NZHJ={?d^YiKtDD>@VMldN~Q5n<8icQ;3QB8L}V*%oC!GaEmPTLCWR-qz@CC+_p
zPGunF^hh!B0_<(C(7jRupE{>WRcW7^7{Zp9AHV}Ijbe1n2%r<o2tWL`4jtQtn3|9T
z)I|UEC0M#pVcZI^ZB&@FYx+VQarSk%>iizO-r0i9t2SYHjN3Bw(SP)XxcJi3F@4>A
z`0>kc;gA#CKD9coe=l4_=k5%!MmJ_2_b$vDAIAF48?aYrJSZJyf*=1J%?-cknF}{?
z#yJ<@umAiHVv%*E^H#TRkTwx}7kIzwx({K_y!qI^Z8QAh_ha+&#@-GVmlP6l8p1Gw
zuyThjdM1a+fWz>;^b16&MElu_&kzL$ENFs|k~aPxOn+Y85=p*$$rPk)iCs%F<MEWN
zog!jBEI=k~dHjR>Ef9pNGP8)Fz$A(JC}t2kwH7?i_`x!n2^QF%v1=N?5_40zyyYVV
zy)Wb&l>?8<)Wv(q!b34SGJ-vOc1Gsn83-T*XHB;e$>Fb@2g&?A5<R{&Q}SfmI6~hl
z;)**>g+}Z<C_$PMAQI(7`#4k?o-MUX-mklA@h$t+DRXz93niF+x)x-6B0nYK$ba!^
z?}DEEylI|aN&EhAQskB_gCLcMkXQlXk{4Y|h*k1y6i}Wv{F*{CUf+5|SSgiU0lS1t
zUOJO-v~E;<H}C^y=<=u$#!;ctn5aN*GT#)|HS2I>FNVT1NG6L$<{7+_Et&alpwT}a
zbB;Izm%aZwoKU=tHy*to%XagDuM;B}+OY|{_szoY-McZ=)?onUlw)z~1()EY-c@+&
z7r(&z-38`lL>GA@6M-F9qZb2n7h$Q1slD&L$6$EX9eDWZH5gBZs}Qs=sqj}mMY>4c
z_4Ll`uf8PKY(fp;8PESb|BQ1eTZ-33mtD;*M7j;DMZDik;yOAVn|obF3oB@2a)B^M
zDwv@<#xE*8_+f}f6Adwp4T9jLm7_9?E>*>l?Ad{QFkSSXzNLFoMJ|jGr_<i86rtDt
zuZ|1Jj?)UUj+mo#k)@LtO64dbPOBLnd-O5bv~d&m@7qU0Sm}g7yzkuJI_0!e@#?Z=
zXmenuQ0XEI+DLd;CrW@4M5++2HUEZB!m=kXA9unjxZ%c+V(;F)`0)?EhjnXLA!oK?
zI^%b!M4%;FZ4rsz-DfK<Fifd<AY&={8uNklI+aeR0xYzpAQn#~Km|Z&D^D(_WKE>q
zWFKUEa*+u^120TsyB=Uql}h#%h?bvI%&1T^My(<DL}^Kv0P5VV@>m>+tE79NX5@K0
zmUIgi3h@VT>BiQoZRCoFpDUR><6V$Zp~(oJpOc9N-o5VK-4*7`&r2mPPJ|FliLi+C
zqaf%}2tA9^Qq9CEzx6w~?(ilWT|MX>7(i>&3wZcD_u|QAE3t=}M!9!ARy_E(_|h}L
z(Dtp^#i@o`4dSpfF2(sL4q(eK?!dFJZpLV5LAGucgG&SGEd4M(|H<<)wb?{h?*ImR
zTG;*KxAEPdK8!cEj7B&;<4!afq<9HTk;a3BC)VL!%a>8Zn22gK+@^g(C?ye8uWWlo
z-{Zas)M+1#9F<Obw1QOFui`J4E)UNng(FKcBu^y#oIAiyYS$U_k~Cv2Ju*vUqJ+;f
z(^b%;*6KA)o%*nqfX(C1XB2uypJs{qwpFMyt`YZld3ZhY<rJ1o2ugd>(>U?OQ*hR~
z=i!0-?!oZTkkLHpyt5lV@-fVqF%v($^=9nZy~{n_-P41!&$|fo7aWTF?!L=0{gPL?
z%K9Q<pao&l4_b0`F~1&K`%bgb#A#=pgOA+wPq1jo5f~jE!PIHfaL=7T!b{IR?T#%+
zCYaKB(h1|1ny$S$edbJ@c+zP&`q+12?)-U9NbcKbeDrHp;TMlR!tR046jZ*ZbpDxV
zQsv`{ZT$K_{S1~IaU>?Y{@Z{0*RGAipTev%My^Of(cv(=*tY+&v}*wUMH8!ALm07V
zqN_OUQ%*k{7hQfOZu#a{v3utZD0g)E1oi2e1oH_X69!5qJJDQ+?pfe__77ge_Rq<u
zor$T_XX3f1pTOwwer``iCX#KY_ew#eUr5;=K3sg6iSJx?CFJ$fyMBn{PdFKiEsi}-
z5;}|57k}s9#KtQ8CSEFn6=4^b77Ww#6{%2q_@nTPR*A~Tmoy!}`1K-{+sX^N>UkoH
zw7jxo){C*Y%zQU{1~F&pNyc*9jlH|JW7qQSWC68@uy@Na_9opcbT2pw=bnEmW^aB1
zcRl?QHjTD|P}c&^kn+#Mr7TUK+9ry3qi4zt9CF+RIBmm5?A*2k>qnv+*sm>}DF^UM
zjPFBO1gR2|qRd&fMYL{{P?F?MD#x<Nqt3V(M0i5bXh`nS(N!1(n3fQUN$1Qf1jejF
z>blhagXZUF)AuXCOM(c%$4QB?BOUq+u@+7)kQSimCc45P;Q?|b!2eST@(^&~+mQu*
zWiZ}PR3utS(<;n+@-9C+eby{oaLHwO=E=u!*?X?W8?U{BwQE-6;>+KSYp%Niy}f<t
z>+8c0ZvGbL%$|cQue~1k{p2na5dEik`T6Itb?cU>9At}H31(OrgiV`10}Bs53{z)J
zM^AUJW5E0N?#7l)hM>(NYK>1gKzn<8al=P%GCuVyj8K{H;vrpKT{!jhGjWI!nD^Yd
z5I?`?PP7fvjf+Re@d|DgG+0fQ>#cyg{Ob4OBGdNjw^rblm!8G8EnCp(bTG}pb@VaE
z<9ELJ2TpkX(2Tib7NC~2RI^^Rm`Pc)FnvJbaKliKH%h{!msciq4BRIuExpDEx%P-r
z^0WJO3ukxFzzie2o*&<XVcl`hoqPVJxc<hEW5HpIaLc#8>J*T}mmcL5k_~Tf03ETS
zBcsScljzN!RJpL`=Pj($X3WCux%1i8MQ?<aqEpIGx`><+F`Yg3V%uD2l#F}ty3Kw6
z#BY5D0|SF5nEp-lo4>gNA=%cSef4`0w+fi7FmVJ*CydqKfxM@DLX(Pc3xO*YtHd*t
z5Q+dpXhwb+$vr}q8B&qS2WIVXxCgI)?~7R5bc+y0*EB3X`vzQd{ReQv>{;mj+Lv(8
zs!=4)b}u;kmf(bQFT?4BZ{dj_K7yCu-j5b(_=t0+g+V~`)L8!$eC_}KIe~2ATRk(E
z;-ss79UuA7r!Z$K@U@$Nfo)-UF{M3pol{|CjN(gl>4)ER<e5RnC{<}9;k9`mDuz7#
zEQj&QMW7>{JHb`zTHXLjJpN$8C{3e)D#N5PX?YVU&Us`sj3lN_F$n6(TUFi{9gr&A
zIqAE)qLC%ME?)!?LQ66tw+OtjqPv{n!!#3v`l4ZYt*e5;Y=Dv>zU%lCuz&9!6NEej
z(+!ic4E&}~{uZ_yf%Lz=_`4<uJci@VGync~eh+{4zkeU|<{x67orgD<zmBucy8w6G
z{sV+)f)vtzggmaI(ZETko{k$n^ij;1J=+No3v0XG#@O%(ZoBonc=Cxyjm5Vgzy9fe
zfeS9a6a#}(&}rLElijX0`}vRs3vj(@qct&MEX2Ew@GE0)%<-hvt9ZcnR-;ki%J&)n
z{>i7}?jPNTRV&}X(Efdxm~c8LwrtsiwX0X*wO3!khd=%aeD?ESz?c5$_t9#%D>&5^
zT-H<VCqMmJoO$jA?(^W_V1+*9^`)=h5<Y+SQy)deZKzTJ5}wEFU`MBgUySa=MSXMJ
zO)I=kzThG!v=$z^2weu3w%O6qQ6sqD!s5dZ$I>JFux9lNPDDXeh;+8-MZb|&<4>1d
zewD#h3$MQT9QN+p8)4K!fiTx;XP%3Nhb_ikx8E9FwWSmaxj>A9O$l6#j10K|`f?NB
z7#SXRkJ)>}=3gSz`R%~OlnVG#T2id4(Ku9OW`LkAA)vy4fauDqTj_#9Bf3j-!7s<0
zye<}4y}+Xfz3Yy?m9BEdK6u`+8+#tR%V?~N@YyR*z^SJmi3e6K!<gukl+a$xJ?UJW
zdB!4adFDHKWyRar-zjroQ}}%{S8EtUtr7T%*L!y3$vYI5yz6&x#);?PU2~r_3a`#y
zM#5Ja5W%p$dMx7KWx}*0zU}Z!>8?(3nFuj&Oi1F=QO)rpS_)JeR%9?@e>rN9qbdtX
zaq04kmdo04*j=qMfc+v;DxuSo|ItorB@QNJ_hb-xGDe~y1Cqf9jyUM>&tV{o9aI)d
zd^XHY7zR%rBRq^rGfZMJ04XB~jnHV|9SesUH{9MmdvNs8$2x24#8Xbk#<$nwZsU@B
zW!Xzu`Q{t=`Mp2EOD{Z&_g()%V{P4uGtWL3uP=KUC!Tyt&`kX?A_3(AFv3r1nE#8<
zJ%d+YdC3W_!6{QPb?P+CoH+}JEL?~y-uphxnLF40w(P~{F=QCg3&th*t*`x!a|>=W
zg7nLO`KL}`j*g8QM!SkOUTcUsii|+w+^_kw&%4mL29L+xM%cdc^7GieYX`=RV7BhF
ztFQYYdW{ugU8QfWSdK6K$^SHN(iwQq`#u24IFqRof;x^F2@ww%VRg?Pw_)Atx5yGW
zz%_T?eEgnq7uvshL!o_1JSy$WRrxmqUEdkQBct1~q}h+td!}R1Shu$CE>-}Xf@hF7
zIx>tkt5%@5uNQ|Mwj>>!P|UP|AwVUTmVao?s+CSCoqyRCrp-S0?30f?=&YjQ;UV|%
zX=j{+>u&fsUNLiwWRzNVp7x8BfoSogwX*vA2g3`rEVS@00DdF77WXA{@&gKjDT555
zPn{~5=6~}KS%{;ImELDO6G4y#fvvIu=m38mpVP_1l^>8#NJ@`lubg;{EL9dL?3&f1
zd$D`tX6$S9V8D1>dKG2zO0v>jhhWjtV{ydNBXHV>K9A4;@pp`+dMp0i{QJwV{BL~x
zv_+UY^E`a$cfN!_{+lo2`Xgr<7qytNAVDmzX<=gj+t{+pD35)!F>`7RDkq~&w0u+s
znJ9fhcql*oh&wF}2$eRJ(NAbYFiV|x>>kwlV?4)+t1yFHdEmTI&;ltnMB;<UDkYL!
zxe74xf1(h`MF8NnF6xs;P)Y<bBHj5_1rpal9Aw(3w+iFZRTb_i6A5HmevApx`%23_
zGSqhAONH=veloUg{yW{ouy$_Wj+w>^+WF+;IOCjiO|0M!?Ao!zX)X4xk&zMn^v)mS
zPrm$jxb?f=!VMq(IKIE>n`Y4-N^ut!u!WNDtvLPOjk?cRcDH=zn`pIKc=wg>HLk<y
z?iu^;^4DI)xN#LWySk0r@^NGRY{s@t8*qZL(wyKkmf-6~=sj($vU$cjTxA%p+$R_5
zM1=`f3V}vu88_$I=U<2wuP--(=}iN}gnRdrcVC51{nO7n0W){*A^84xzizbmAtTgw
z;jfJF`ob6gw-LBcW7CGWlZ7pKT41PhZprE=c&spVjQdx(wr+{BHSg{TBo-E{4$LX1
zW&2EN{<p3@iu*>l;L5)FSoOryxZAw<zK?w(5sEVm)3ULym2bR;Q_naTn~clWxnBjn
z`R=l1oU;S>-1>E^aQm&_G8Wv?SYR0Xnde??aDI`CO>W+}0XKi^Z?VX@OTYQmKR52^
zm5@xQq8$t7EXVKr^3(j~Kl?*>@Awl=iHt=sIQvTQmLyV1CpfEGKRSa=z{CF*7_0Hd
zkA2D|5Z!*uH}J$GKc{)tQs}Cn2xuJ-ew7#XF}a&Ie@-$L9pEBju{2lsv-1Q_!+*{1
zjoyCr&zXm5?Fno!9*5D=3q1q`TVXS@V;$DKHi&&i28gl7rXMzdfpQ4DHgCk9{oAm2
ztOcK(pSsm8TqeHOH4k%Vn^2nRZ)m9MnF@nZIb%*A@e}VkbU<a2iL3%UC`EyA#Nmnd
zq5y*2>Y!ByK$Sje8k8-vTQ#3ud+a}?aixvv$eYPLM9f~(x@x5*fI?OAlr7YZjv@Wi
z-rA5u3I{r}c179ZDIDY$@m8VG0K$T_9Tem$gtxltIaSQqO9$cwW7HDl;?rS4e)-S;
z*fn{dv8wuddvNXhKZp^-Xsyf8KWiJ<wQHx*ZU>x}{@G9ey2I^no4;O2D>0eDrWDnz
zJ=55~e=qL1?fWjqa_QyoaROug`n5(NJ#LuKi8$iOqj2lDzkxMxtxO1y(uqq0+kUJu
z|0K>;?ONA}8*Md?Kj{=~H?gecufObsmc4uF6<6WIzxEr>`m@)yH+;y!{Pn;2OV_52
z-#zu{L%8VT%Z$MOX27*Z{S}0amSUT5|D`|qL-)_mS-_HDWZ_f;6;rd*tWrdaK}t~p
z(1&mOq#M(h{`e0K6WxzDcI?I(Tbp?Kv8V78)9$rKc-av&OuL5~#@jZoy`g=3jKJK4
z`STZG<A$}-auu*9ik{*%$@g_cxe@T|jq7<gKJ#zB;DqpB{mJj+H~#tOaLn;1;tRj~
zhxqUR`Cl6Ww>mOw6=O0L=76fuiv20vXvTWuO}`PIef_nU0vuA}%kYDzC0WQIFE1An
z%Ys6@>mONQ+^#o%{8QLyX!rh~{unoW>^Iyizj)++!<dJ{TJQh`mn5%Y9f(&he549c
zM%T$YuF!nsXReLDBTZa$3f4Zg44a2LvF%1L<{y6<-uIppfITnZtyflH+)~6;6Nh^D
z$MDfhX5x(>e-(E>yd2Aa_IKu=1b}-g7USZ7{h#oW<G10#zxxV)wtNF7%=o6Ca4}99
zeg!YC+2yKc5G(~6QxC;4*L@1-&)AP0%U{N;TT32)I@hTJrn4airj{skDo_I;H9hH-
zk}Rl>RRlqm(;8AaprNX=)qHOH&AcVQOrAiQ>8BHhK#bj|<TAjpY2lt>M#M;FBZe9U
zSn`Yte#@9bOpK6f=Bb2<#kd+mTlTNNUkLa;jNZD6tTjq}+7m@j$-~g({uGy~XwB4y
za?IUZJjh3@BMw8{PelTk%yx>2DcKlByVHr!@rdkm`;E3_U3(jiC8Tto=^3$|Gj=6$
zZa(bZvkO1^{`Xwc$GOG|dhqA>y12x77ha5$Pdx+Mw{64EesYJ2!;BFVFH45ANZQZP
z3J8Jh8H30Dq9sd=6}1yPwr_LKI-zBlUbH~yy7mJ%I<5H!-~EPbXSs=Yz5l}>qqZOz
zp-L422al>?KR#n_{@(xmGra4h$&)iaboIp*zT~r2l}g*HTYz$r+Uv}7FLbW7pMULd
zao+xEc=^#^;7-%nh*3T|2B+2~yztP)#@gL$6q6lT0Sqwn&#+(-B{@kC2U6uOSKy$L
zX7!ry=Ui|ZR<C*s58Qh<cJJP9tT<Oq&sozq{@QQiFHPLg3O6r=t!ID=XCtf$o#Rra
zW4`TsU&n1Xe;xng-~2}`f8}L7^1x4#3q1!OD?VCPwfqE+b(7{h7SG$SbLP$uLhFHh
z?=)lFX=r8`pZKlMy5}DH`8~m+5A>K=KAsJN_(3UXT20cu7QBpwpUQ9|2UB)0!Fiwk
zzwoa<vkyCrb-QlsE)&P<$CP<XaMTg=(cJqMmOXSc?tW#+@wJ{A^RVE^cVWrm9*ml`
zGOzCq>>jD5WcR!dA|tNG{&(Go-@fU0(cZZZYuCPw9s65oPMM4OM;wjArWM%r%AL6P
zhYw(*PqR+;n`UAvGSq;Vz>5onZB9zb2O^B24G*Oc&t>?e*J|X1&i=B{OiTR{E}Dre
zKqGMhc@0!DZxyPiP{&0gJTzh+V=TWE<Il1)Kz=263kwoYW-L?+UO}Fj+smiD`eW`r
z8XCeH2@+e!V4jAYo0LI#!2w7xGlpz#wo9;<9+M*qq*g%`DzT4}3-B?&cd;d#w6N7!
zC1ax_K?u5xO`fFJO$_Yp3ogX%-@nx{0xjH=k<PULe}Y;`<o3C3MmXJKEUR^E)?nF7
z&*MDfQnD_l9%G4p^w&O#X0zMGhJNUn(!c-QXIuh>6*_*SbLa#J0#uHd=17McfJM=8
zg3B@(`}>1GyB80bfB*e|{;3<czyA5Jf5gSp{ADf888c?_{HmaV=Nqlvyk>5oM0+;>
ze)m6qF5o2>K3eCRT%;ppbb&hNrjdEV=*C&+Uf|w&?3SBx%$7E`KK?AqG1^PBZ{I!~
zdGs+3?lB|GdW<3=-7kr!K*)sPao}-SSDDY2eD0~ov0&jMylP^IdyRsk<20esXqf(v
zL$?uNH+=My04r#>eeWA#j}wC0SH0x;Zv6Of@N-hI@VhFmoya42-I{+k@d$PJ_LEZK
z*UVoG{D&=Cg3GSF*2I2a$Kwy(=iJ}6p|z`5;_trvM^2#G%UfPjp$$!mXuix$uC)xj
z=ScDb{;wY2W0brt=&=@+q&o}i@Uyt(kG_Nrr=N_ahaO^thY?n~h0%TM@xooV<HaW)
z!Lx5}huaLHN=)p08*7&R0xwUUja6^Hh0P;6W7-gaPGDr$7VOwDgqDs1Y}<o>jjyVA
z<HTc*#QZr&VCe$$?ASi+dgJH#$+9Q#*rU(j?fso9j>WvEgA7t8;!uhCLM5OR1elj&
zGOOJE(MbnvjT1o9#`B7>ip)FhU;MY3O1l`pqIXr$P`qICLQqyCkb6WtrKhH4{h~n9
zcMyF6-e8?T3IYViuYK#>ce3eLyp!~!V%v4RD1|F(2(`~803n{w=K=PQ=p6Zkzd3W~
zxU9d`D_3C8?%kpNQuOr5{rBUh-}n?Bd-x&jFoH*j3P`t{nBNRAk0ttST}eN_?G`LK
zVyOw*pXK(9xjv1wDU8&&%xu4L3l6PZ&MhhDuI%sa#ZDto#CGg#am9J@-@o;De?197
zACMZ{&*O&CM`PBjApDivENYt3+2^??HYeZnaN1gEm3KWI7AfsyifCMn3SvJQ5?VOh
z2rv8bQ762BQ@f|(#fiP>xXjKXShFZom=o0G!ZUOZXI+eN4A1ThvwL`Y%p7^;A&yDA
zY*5>ueO_wB)L)t{n~qg15-o&!eyQpWs|*cJnd&|d8CUhc`t(OCucdM1ssOV>_s~U$
zJE3JQ*2f;a5BvA+5sS#UNsR^jgPXsG-~1Q<*4=vi;rq=v_oKq_q=5GP!G6xXKdOE}
z9vdj${1LwT-)^scPIdNS<Ky4QEsx(Ctd~Idp#>J6Rxl2|jTQI(IsVsuqAdm_=TAks
z3D1B1zv6lMyCJ^zj@R($t*_w`vF^BogqU){Tt7fD!-+K&F`(**vX;q;{uC;0B{YvX
zA07;?V^gZ8?PlJlWOM!{;=_c9xR`~u7MPQlqAC88p=2FOfD^>3NMz75C@5kcT9jZC
zZ3dT|Y*$tI>}2>B4^#;_)|-pZ2kS=?CQ@dbbYpH>CiC9+f52H;Hj{AAp55?qmH?~i
z|EXU*hVw4E7&rZsPvPrd`72k=BHg|qdeyOy^b!lxd}ubi(ACv+8;os#<L0m3L-oLY
zKQY$P2tCc#<jh&Kan&{N!(0>i|HfCo>@<3Bz9ZT9;yIs(owEA|2d6NOG`4TwihQoD
zz;p|{XAtP_b-%ZYZan|&QxRh-n;Io>iF(HG@7?(EPu98$|C_PItfiZ+Z`3Y4$-hxS
zZT2PJIEz#AAHC(fIDKo=jq}Z}j=|whcfY@X0ORAsX?wbcXXHwOxmLdMy8GvUU%z&>
z+Yk4)aiwkExIR2*<EF2@{Gt<dKfUudR7RQ+Xd<+H;|I7V(?L!>>pZ;Y>gzCN>NMQ_
zqg#zz@xICu3-iY=ndpvF#v9QzLTgD7TKE6-M@|4rE6BU_t?>Hx-~Od>8~(Oy!&+WG
zF(;ol8ncLhRglesETJQgeKL><^JW56b)5m2Y%7LJxO&!oepgo?i|2|7HkB`uV5Vny
z*MRyZ^IGZH6N`>C5|dFxw}Ll@wN=M-HEQ0Ce?2~R4mZ1>o54kxyefbLvRPqPnbCDT
zz9ecfTGv1Y!Ca~wmgR*?q`%X2R02$FCqs&^5TXC55~j+$IWUT<gh|cVU?OKkB(-=M
zgP<YgfyD^yg_m50V~;x#KfU`7!@S1bUM>HGbAgGm-G1xM_}qW^0zUYWkK=Fu=F3pY
z@$Ebg<$e07!mI$9;dt2MBd~AJ9@nnb`giQyhVOspYZ%(MFG0f$6I;9H{U5}2ANU}~
zjoWa=8_RL;oj>A!bfB9$;cTzp{Aa(7ORl)mF&>-c_m_Y42YBV>my&0<Y<wGK-vF8?
zU610(bKJe{uicLy-tprD>@TdjGC+KC=a>HY4<d8P1YW+Nb7e)wN+hWzeF9Fyx2{f`
zn9(wLvO=P(i_+jpcxl}67k`F#cTIzy*n<~MEXvNqtU2?H1+lkk(FvN$1(@vDUse%$
z{goGS?C~ey%4@F2i_bo7td*vL!?=2P?7*WB{mfXfV`7Y`MPA_HT0EGoCmsIFY4HP7
z#G-<8qgh&e{|z6*4{!OVagFZA=l}EXJHeIDWzJ_qzvk}@qcC0a?rYp$v7Z~EwQI-r
z%J}`VwNtis^;;yoe)F^FnE2j<KmSQe6Uq8lmHyN3%)d~@(ckNmb6Cd<HR`pmy8ddU
ze&A5ri`M*MRpHZMp_SjRe3Nixumw-rfjlQV{i{RYwH;5sD80cH7%2hNgkWfxtSxTO
zGt`(uo=}G1&{?b?8N6h#2N<|g$<BX!`4n*J)_@lf5*{7fSF+deUKEJptvGH*QnIiR
z-}T8+DYFrAKs5;+3Yccknd>$JUvbqn?w{|Y@*ZEKL&L`PGL01|k;%jYR@HF0FiL?h
z>%RH$O`mX8HSYM~E%>H!=h^Hwt8AQp_PH(=VY3UTOq+&}-1O@%h2D<sg=e0^b5A}2
z9gZm0k;Zgn^0^9R<5joc`d!1geimF?Yu3CKl$`tSxf4T6FF|o)EG48)yxQ&l$Af<t
z7uY1EqH7kGyp}9I%2|H)nYF7{x`dQ~lB~@@syfc0FS$f9N8c$Dh2$qczRmr!mle=<
zyThrcpB?saoptVo_~uvs5<l9x5m)!khdqVxrJ{r0{(e^nGUG?_L*1A&j?>%QZ|3bh
z9CFA4++!>%yT8e%!`nE}{rBEw{@so9FS;Bv=gh&=k3CG|&zkeG<T72tNY_#hhQ=p8
z{aIXc`PIq&-}}Pn@R|{#mR9Z9EImz~HUpDgzTdo`Y13z7<%-wv`mz^|H)2;UE@UXe
zzHVb)-}uU(;*7H|5JD=QHz`aa&!AT7=0PPrpq8)2ITLR&fyfx*qy(4rDsD=+#b2EO
z!DGq^H*Y@|J^<ui*vdSM_CvE8HO4|3^-8kTG5MA9<paxsx;L9z&g3MGPu7OFKvc~k
zWRbCY0Ml04f~_zSE$2)K%VbeySDbE@yeGO7yY;JY`=k#Clb9gIT8+en5<<(HuGyA8
zF%Bknsp0Ya-~0C01Jqt)TC!w`bFJ94VVf29#_O+!XDkjnC7@Cth8RT@7`kRMT}-HG
z;1m<rI_l_SjWsnBtKNDO_Zo}Ors7|4@#XmBKl_Z^(0Z$Z%`(Hw-*dHV>8U3k!}q@R
zHKR>$4ZT$s736~Azvkbv=btl7bs<hX`Bc1WTvpcl`ubo0MdD`Yy6Nf^d&Xs`4mmb~
zUF%edO2>}M4EXuCd&Uko@jUzM*T3=?7&e-DT^q8mXz4}WG|($B883I2-S=i6wAP5N
z$rv^un`=vF9QTfH#r6FQ-1j$)<z?qNz^@L_xUT<xq?yZ;PdOdWKJ~aO<MsBswRpj}
zS#7_zwA94-1fIYH_{gvQ7Iqu!>&54uO2#S~dt&+NDvGQ%W$(|LJ=guUdl6qV<F&OQ
z2gFA2B}W{EexocbKKw`%$0bj~aVMOL<*&XN8{=x~TGvm-sujzzisP)gew?7e!_T;T
zd)*prSieRnn!Ev7GFQQ_6vTcj<DTrFaR_G5?uXv9-HdlP#@xFFdS}dcG3hB?DhNOB
z!POa^*s%ticJ9Y$O9;5Y*pzvH0p`q}fq`xl-)xOwc+U>w>DYs@a6X>>*JV8B(=lzv
z3{2_kMOU*xXK1^LZEwZyk&c*{==v|Z2QhQrd`uhcL$}R#ZjWJf&sJ>Pw%5TP_YXDD
z?3sdTGiRG;`_XNJM0#Qv+cvJnp3x2+B&n+lEAe2lFiy4PT)~gRv|cC!Nwl<%FW0Ss
zOiVSa(g{%*K_%Kml8_+|r}K;2ro<;jbG=I|696h5hx?*L22yNSC44YZ5E6kX5=4Mn
z?LrE(RH#J+)SYr0wGI`V_5ocLCqgcQT$77Uc^I|mBjWg9e(vAlnB$IjnN*f3eCnnf
zk&MFoHbsxW>SbZF?w51y=G5uaTq&o)!Ktn!(*C{saQKl&q3pDA>S<@VgpETNEp`>`
zpM2sGeD|Awi>;eCA&Lhk@-UHz6C~!vCP2LY%F8ZJcJBEXyS`SgcmsQErs2p4e7rzS
z3|9dj*%MGEh>|osja2iE@;_SP48u46<}VTy%8y#$#{ZRjyksQ^d8uE5_Sa0z@<&}a
z;{!L|<f?{v;bj$v{R7>&du%J-*E0{8*ozkoLmAbb1R@_lPLw#HcE;_q_x<F@F1BU2
zRoG`vI_)f%K7OyUz^vffV3_$W-}x#QE;uZXGv`q{L1k*C@b&Qh_qyM0?aKba0X$^f
zaW+N%zkKmel6sJz|HA)pg6#AE`G16a|Md_46d%3z;+zXqu0(&=VioE7CsSOYhUwAG
zT;EIP+>&ym2fcHT#hF)q2v=Nq2=+dB3vRpR0j##W3RE8sIr|2@@8Z+2XfWFu+&dj}
zW^`fQw|*Oc^0Of)xGG>wU5eA*`(a#o(xI4Qgi$%Z4;x;40xvxI7?!Q2{Z}Y@F*yHd
z9A_-`la4zQ3ujJ2S5adBOSj{$`*)FWVL=$?rZE-sPJR!ry5tNTGJ7ieo5npnvJ?9@
zyo9HJb}yb;vlngqtP#lFQy1d!lg`71=bnan(+1FE1lRc6&*H(mx8kWaL#WjTAvZNw
ze#}uk`6G^X#l$-`$wJhEHy-fPsIQz6nMG_@ORGe(b)gQ+jiSWIRH6;#OV0x;d6Q6;
zQfZG&&M0OqEZmZkZ>k=bVbs1?owdm@#X~Do946Wwq(CH*mBLF9$aqEUJ=OmF?^Z*$
z4BZyI-L-os{~nW33i!gts0r?>WONB6Jf6i%4#(Ko2wq+Gvb#TP?pz$Qa1pj_*@|1g
z^GyeptygH%wQW$}CTx8BYhQKl9xd7l?P{G^J2}2>>b+Yxjl#L8F1YA29C75)ShsF9
zc5d75+>SQBw{Gq8n3!=W&`(u8uxAs><&TP3sL)6vxy4&zPCO8Huh_dzI<>k6QW;nq
zU-FdiwRJ@OD>M;=Wj4S5^UKda<M4U?jURKCm%Z!;a9g`@{n|D7@$hC`KX3?!jNkC(
z@xAUv4+rh9QsK-n33`6L^3wAuGAc1T`n+N7T5L4dn0>ZTl1_dV=AZU&&tW>{jI(jd
z>1Vm>95(CpSG^>tzvKyKcy-Uz+!TYA<EHsk$(y-nOcy;ETy!=rzUI9+>G1g&&?8i_
zJ<!z{wmx?!?ppmYdYk?S+d?;{p8Zeo$%~s<wbocq6I?V|iA>F|={WR)U&D3hPQ%)t
z--5f|+=Ir#Q*hBm7vSRF3GDg)eRyj~qignYIQ>2E#|1|=u=T}<aQp2muzRdyl)Amx
zwTCLJq+2D-_ueCL=H+K&&dz7>=+9rn#{FhZAAcDxdCv!ML+>uE{)_vu#a8X;n}<bb
zUyl!5aWwWle=mOi@=9#pH*T!6Q4H-JtMJ)`nClb<oqQ8j+q1dwJXGf`WL!(tlY<l)
z3URI3wwpp4A&5jEaf$iX3CJ{)Bw9#<cL;$J2dQcSPcBtufEo!9)fe1aO@)w@le*@e
zd~pV0#h<<9mADP1uo9gFtvC_1k)5kVDC*={Uv=D@&fopk*Kx^)w~eQ)7mq*uV0c!x
zN_d@g)hE3Nc=>TFuvWae9CA~!wX)2Ai~woj`!|0Rd-v|fd#}3zZyC$zTYvXAoHick
zGNgcLT{*N+pg3w#pv=MNo_f;6E0$rY5sKEebgE%|mN{=SjBl0E4m<mI8~5Nb^v>I_
zptJgU_&tO??9h)A-#yJrW@O_c$Deqr5nfltcXbAv5Q?^+hkt&rP)t-9kpI{a%8c(<
z168sNuqeFr!ZR*m!){8pS#B*Oq*tw6;nLG>In*DHY{cTOe)pOzTc(s4sIFfx@g5P9
z3TqVDykR}{=QiZhlX;wn#xB+|Tbk0!OOzB9*VL;ozu?-pH8#(?=u#K6T(f4Cd(IZz
zwQfu6DkSh@StY?r68gw~O$UkU_<2MD*B(I0%KVdr%P7$N;35d-zlO0dT(Sgn#$Lkx
z_b42D?x~m`q?UcEgOMHUv2I5SoSu3T-v9Brn0V=1c+6NW6MVE&85n05`lc_z=@%Z4
z@nv7e?RP(lZPvJ6wE>-hd3gU>r{naapTVk^+c^Bp3vlY8<5>BVTkz9o)?j~IAb^3+
zX`mQ>8TbG78r-*cFUFZp)^FQ|u|rS8zdGp@9NB9G*Tf)ZEI9>dpK~PIPk$3P-~KH2
zv;|gc8F4z!!1W{z3AirK;+(lH9M_CzqH*!i`qEhb+Do+8FKL<nQ&B_|pU0Ii{K%LD
z320d&CR?;h`Fe;#07d~P)*$3-%o^YebSi;J$)J1;D*Pq}pk=@QM}?{ukzIi|sd|AM
z9|V&9VLFY8$;BRDIk0GnMMqTvtBp^5>+4??t;FZ!h5)HFXu(WVx2hkbWUv$CqnL0T
zVU-v+A<#ZMHad!*-E)^=cx_kUcdHRvDzp=4FpUGD!eEp65SNW_z4Fovc*QWjgeh6v
zzWF%x8&3d`t`^2~k@g)FB?Z*Eylhnv`!B4`ocIL22fE|mbixejkK8Yo$vwFm;5`f^
zOKBV{Y})#p%Om{u$P<2Mn~8bZe^KzH{pvFPo(?qP4jD{#qplRf{s~>fz{AS`5*K{R
zGlS5wmsLb;mH*Y|UwAg6(8NjqBEhl8f88)5jT1d9!6Xw!K|HK#3ZTj<PH(70bC(Y(
z5BtbwtTz_b)|XlsoqZ9Oo);!DURsRBed@;a<Il%A^LAm`9WP-UpP7|VhH=p~`j=qw
zJdIrsuD}isQ|b0Fc5mH?y~SCWyWkM?y)}Wwi{_$dpYcSD4r0mamtbm-#`xZ?*!=c-
zY}+$}maf5^0e)of-emrijb#;PuG{0r1!;chnTn|kkHyj{`|#$PVJtZHA{^h}K*tvS
z-Mk*_H|@Y!CmAO3Zf-D3{)Zf*=8UD|PB<B;7gYzi(#hDdeG3aNK}fm5B6wEQzh8>M
z({Cxbl1b!3g!Uhm2-$98Ifnzv1h_fqTCn;=5M@k7C2i8pKu7LttmN)tuG1QI1reUc
z<)FM4tm1;z`3Q16Ae%EC7LCgMSt)~@EJ&@xycD7{9fZ9~+YzE8*;nO-YpRacUbf1`
zy?6iEx$*KxV>jeRlRYLOuSt{#IUkbo3pB*a{ERpUvLK3>)*nY)4`hTP5pqoHe*a(I
zjuPJ@z18=VR|E)x5B1~D6*!&YA$NhwHH@16lgqZB#ie!fm`a}oka`1<(NfxW-gnNX
z{CvrEq%p}=(^ry_nl-KtFxgS1<FRYG4pof;n_`6~%?Pahdti4kcFm5rv#w$bwuyno
zIQgvOFm?T-cxt6_6Lz92Px)r8XJg82OmB4X_U_#XNmHi3@zH%4YWHCN)M=P9WdhS@
z7y;8<h{Y%L<M5f&(cjmP{@xCDzy1gwdgv*v+%a5_&wzXauz${RIAL)Qb{lu@T4Qh*
z)B7-Z$YGd2*usXx&cb<zEkJKiH@cffFm8VnzxdgGcy0Y|inBqkE0vy)rmCnQeyZ`;
zfA)uQ{dgvz>$sU8zY5P$)AdX#a{nqN^9JPjdSHnDdBg?fv-@h=f?qIFOAJD6G76T=
z4$-0sZbp90SA_Sz|FHaZHgxIwH~``0mmi9cZTW=n0x6@ZYett5-h7;TQqH3)@F~RF
zhyEyt$XrwyQ{rFFg)$XWjLS#*PCWPZ1mhd$xuszco^5=K_CYaqXt^JZV3i552y%tV
zEO%<F@MQd&AU4jWnBAK3>dO1+g2AMV%>Ne9fz*9g%dfov7VlQ+zUDp1c_aKKYe}3w
zP)l2yts^ygR|za(Y9pfUcRJLW%NKD62_sKnLj5{bn0)<;M}qbu`d6Y|Io0`~0>1QQ
z4D6Sp93e3ZwKl?mUJM<Gr8YSb?)N4JkG=q>9j372o~N;4WWv=`txTBl{i?2R^K^;M
zM9X=wX#JS)Wy@Gm1sYvFMnE;t+iwJ1|B#9AK8`0JUy1FV893~m>v8SbSK|C##`1dj
zRqXFXK>RqPp`e^FJ@LXTa6-8Zk3H}_c9gWoZ(#aNbT{^6`jowR;O+;od8`++j=caE
zUUUx5KWl@rcAju2B+KD@mVw%JMISD{{Hj2A(R-Dwa)Cab;!->kLIR3vQdT?kM6Q^g
zw69f|CJRJDO8cs{WO!94QdlEsRr#f}FKV*ixG|4T;=zI>nd`{FVBU6~p;X7vWWieb
z-S0CZe5kk>S-6I}f<gj$lqJGc;4uhhs2b}`fG*r}o?+@_JUSf&BBOKP<T!OkG>E~~
zh+9wknOj9stw1l(y*t=1on+vmMR|EEH$0}QkLtRn5{OZuMTJbDOmfNCOk5~&>>fK|
zj7re|B<)pi@*j;V@6`!9#k>nYgUZQM$+dc5Hms}oajypwiG6tZtJV%G>qE9*?NCY2
zF+%g6{xlNWm-AnfaUI^N+{A(BmYz*F`3D_caNSe^QdNcwOloZg1}>lNU5r!CKOGB3
zUd6YUZO3S<MD1o=^I~Z?q#JHqG)+{-SXzV^TUyPy5fvRBWG%BsF@i0xK8dFuehjZW
z3AGVh$7W&4Q6I)}M=ZjOXI{t9{*r2UiWR8*sHY!?bFTjcu3WMWzqsYQcwp5q?>#Kg
z)i5r_9V_tsPwv9YJ6wPZTlbmJ-kc@4X7LeNH0x=+J<_U<U7;$$7*RjH>o&~htqzri
zn79sV7JPC)y=>wSZM#qj96BK!m1Y(C2P*z{ox(?b3QaD%bo$z_c8P{`4U;Ldg{HI5
z`oK*F<{)8&(0U~;dt%U1K-6`hQB_20nXnK-h)RG8zopSDzsXzcDnChan{WN&e)*v!
zJzoicA!rO>%}uOM?mur|4(~vGP8Rmi8Q?)+Xq_<8@QTU_uF6!Bc~X9?)p@LAMv-oG
zb$yAs(>W1m^amV(=9DKb9bgN?4sRx6Dhijp-%J>)N&3tMLd6ZIbY(0-5uME1O0I0i
zMRUbuK*>I`^-T1tDgrmWBk&d#H!$5)JFHWZ6M>b@Z-s!B;BWb3O43q+fuqjD=}Wt@
z<M9`<erOEs$#7?cQaQ8}ds+>*p})W=pQ_%4o}MWf>@qIH{rj+Yq7SX{A&iZWnSZ_l
zu))vB5Jrp-Pjwq1*AS|r_mp_JW*mp}uD=QIJ$@X|{@^w|uxtzO;etDLVsvD``8#UD
z0PQ$zBT&ai#-O{6+pw$1kfJat&ts(Bd)E&V1z5$O(sfn$dQOT874OkxSMdIMI6VOQ
zJZm|dT0WyDB{T`6{OsK{;j`#FGSrkSP=Aw9hGcBAuY?;R=|jtZ0Ft!$wAo}~scaz;
zvUS2RrB;_*F_@M9rg*$!?8zKRREXE)>DfB(F96RjsxY|9Y#<;+<u3z%9}&3)(_h2f
zA&%SsOYVtg!?<)d<=Nbzj+3bjCmA|b`e=Mxb~M>yP*GND9(VqG929@l)$t+w9_T#p
zPse5}u3mvhg|vZ6TRE5#Cw0FC#;Ye;D{*Y~m&*R8FzM`X1sRaMCEcT0=_Q9r{{Bl$
zFe$7i8;i$7+QWf)jBl^(UV!7zJ`IPqR^a93>y2P3BVVx(72Oz^F$Fz^9Y!1Np|x1M
zS!1@bY^FE3q2>Ul&0dI^Y7cg9-GaUQ_hQ%XHu{YPGjC2G>zE3S8M830A873#MXRNq
z!0R0xKyOzg#JttCV{qR4Z^G5bjN+9$zK#2zUx#5qi=EM7?Ag2>;{%6c$&#sP&}%3L
z1~E8&iVbRGc%;okRT-hh8Ow2!;x=K{IPeT1u30?^*7N&8R_L&noBl!fM+yR!zL_Y(
zV)02r;SfvwQGO5oNKGr{DALv9fANdhGZiJ&L%9%KoJlm7Gk+<7v=9^#=e~252;!u2
zH9r~s=~4t#z3Y)tYY%1ZB`ZlMFIOl)#plIy<W7<tOV_*=FdAHzGHz7`TvcOLzLi?o
zVqX&X?t8{e<6)Z&S*bG%koy;H#&@%>B`MWBpTi{3Fo|Zzm{b|iwNF;B3e1(U*D+^y
z^$LcNTS2u`Bw^7t?S=luN~syQ{aWTQPBOoh7j;H;at+!_FNHer`w%Z5fUYpfPl;6}
z?j`#=^XL7Cq-75PQlJthuF$*W9GrRVGz`6b2Uc#`?W`>=+U+^^8hqg5h1mc2cW~D$
zd(j@*fY+Z}f%DG26c?Yl7td`NMlt(XoN>xwXl{QF%UAD2Xa5-9TCpC-oqr<ExNs|m
zo_P~H^mH70&e=G!cPG}a+lYO}gz7%*99(?<F&NzN818#|C5HQs!kO>=2yVDwE;inO
z3trg_%v!V*GcC|IhPKbd#`f*T&Xq6WjWe&s$yZ#BHJzuiX{;MFjy(sb9?^%LFR#Xi
z-5ud!&=ne{d8G%Edr0X#_add3<o9*WTnHX7*Qa0GN~g1A|I?I&m+-@!8wB>Ol0zCT
zVa8fxg5&!}7&@O|Q7Fk`)ubyjSU4(TMIlnD&-e?agLK+d5UPkS&8TT9IY<&XLWmWf
zu`7Xe=DvP{?O)eFAC{Kx<4Uh&CyQs+8i`foT!W=;lLey^ClMpo%<~$AlA3{c9e6>6
zDv>EUkD)EibK^~KDcrOePde_TJ+W|u7A+7V$;jgje(Zu?a*HESh)PI6Ty>+<p`Qw0
zlB3g}`sjahQ@5`5IeGYr4wS0@J;90ZtVGrF3(V7xNhOwK!~p_a&`59)x0<9DadONG
z-wlybw!o!O^SI6}naOZi<yfY@Ql)}c%ZdvGc=T{E-t+m)=16uGvZeT@67=HFxbtW7
zg;T5%@|0<9>9~z0VNo^hN}#-o>XO46b8+&e=i-Rgay<0XYU~&q4}8tfV=?bkoPYT#
z*t+(IxNF%Sl;eA`@rm!_p?M#{S=W6E$BwrR%x#SCdJ#`N`Vd~<J^@uuVBIr6#r?(Q
zIOoJmam`VenZBCn?(D(F$M3;ormrDm6m`u!5+|N>8D_oo79M_XHQL8siT7P`4i@z9
z#rP@L<3p!J1nTj9*!AS!;>-80#hz7<;^%h_0+*hND?fG`+IGR0BiQ%W!+7|~*RXY5
zjN2IiDUyi2M7|~G!hIFzx=ofGL%c~yBXAcwSr*V?Z3qK_i7_OL*`H0|Ps;@xm}6Wa
z@W}{)(K1mwMx;O)HA*l)B{r-wAfmZIi$O@qF11ef?En!e3i72?AOdOo{_-%0wO{$&
z-Y)_UROZu8`;hLzhMLTZ@{^bf()2@o*7ND06y!__v3dq+M2g3xMQ;!|P!(u=wr9Z^
z7JeQpXCfsR&wY`$1&vy*9fHvOoB|bc%9yfOKDd2J)Us2B$*q7Y*l}%np_wcw%V;&z
zb%B_sD{#qeRJMs!y9)h8;iDWwr7TT2i_$4MKv)+VX;P5SCQT?`AS=$XnC(m;N=2hk
zN+=uE{ZX=|N%1Pjnaz(%ge<RFvEC6uiHk3%)O;9~$@e@-Rr;2=jId~?6CtRg*bWL-
z0z)<)HFY7D9DWD}hBjgC>P^@$6c1fY#r$KA!=k=@*sy91w(d1CE3Y&&9L4Mtar*Hy
zF}C7qyt0L=Qm953`erT0;w6V-=0G=8dl)-6uENHRTd;4!1JXdxw7HnO@G#7uITgLd
z1crBR#K!d-vC~*&HeI8bx(G{`E=2#(dc3)23)*wug;S24hk@=!f@b%(J%Zu4m*Iug
zdz|;6=o-X~g-2lVA+yonrO_JRfo&VsW5d=xE)~8)0y)FfDUB!D)M5VUK~<!}Nxok*
z{Xo9<#pDEK196_*+#YWPR}g}NxFoYoV>x+lePn!Yp@)?9bitJTTp_HZ6qu9<r7)|E
zNA$0<1*^i_`ID$D^z<PXHaTBV>F;(N1uuxEw>GoBVw1TqKc$59Q?^K%`S@eqJ$t3C
z3Zf>YmdrKPcB1(7;46XG$T(@Py)qGnVkcOWV5SrkRw7+Tc(r&R+$Qx$TN(U|;TV>L
zDSPEWP#UZ8T4!^ST{>TQDt<4uWMr{7ImcdciCaB*-qZmWTY_W$EuqDTE3e>b@l2S9
zAax?HHL^vVE!@hbs?SlsDHG91Z2yFDOoG~ETylLTyuVCgj|u==DuNFrYy1G6Cj0>h
zzT&Ci>H3Ni$Nwj0AXbH*>?oa+v@e90<+*?eiilWOybgl0U*YE2*P20lT1ko{sC0`%
zd{7}*ViNdk+ZTLCg6L^itn_G9kl<46aUw(^;H=6&brf6-l&Tq{{GP%a$L?vmnLgm(
z7B{q*aCjyrED#SD<IQW90(5A^=aoQ-7d+YH{ETpEAexP0NpP(^mE5Ce1q3QC7_j9C
zRrP^;B2*QM_9GzXQ}_v#LS0&X5acOvMD0q}Df@$5D}+alVCi-=v$sM8mtkVXAinFZ
z7Zq5A#32wz!xprE(PKS~O=cR>XBmalNm~+*I3uNJXadm4tdUs5^_ExGpGGPu5;&?1
zkpxC+$plLzxtI~~d!>vwIrw9zl~*MUTEeAyy$L8KGtqubk?5mK8j}u`V9Er6fJ9nx
zO3D3O>_Srr%8I7}#X#knEwXV1hUjr3o|W$DFb;0B5bK~2bbFxw(o=)8Ph$N^+VL>b
z60TZZ9(R898HsuR=m#X1W!2Jz5K_Fhb*AOSiaSExlkF(f6BILh5(+9T@Ti2U(0=lg
zmiVE2TDVywEg(*$;K7MvqNQ?^@hZjhqakFaLRvdEenzq<QP&R_s3>cmt~_4}>q+aF
z4llJOl~87kNjbvPqB@20&my`ExM3|25&-u5KV0)sTM3gG#uXC>d}$$%6fH|M@H<7K
z`6&N~A7hf?P6FK7x(FM7SpXJ@f;0MebzCeSCa5X_iI1V1QV2Lr<+S{Q2$Sy@phh5c
z&ul#-^+Wf>=iQ5e=?kJlBEac;(BS;27=V&-ZewizxqvqZZ#qSCiK=|)l5xs@bzF22
zR!=*K^J70b69{nu`k4@Lct9fVfHXG8<5Xg<kO>Ia7vnGN3G$RcZO2L*NTxT80}yj2
zn4Rw{f=cg*IZxYDwI9QGPrQB|K{C>md4z@U>AgsqW{i6wDwTPkemvY(>`P|=>Qop9
z0VxL>-<0>nPjRR!yCF~@9uQ1aGV{E_sIYljk`q<8=Q&oILG~_?RPCuKK`BlmJx{_D
zxDz5bfh(Op7@P3(3!q}zp)xD}ndH)9O-X`9<Sp`jB=IXH<~en}dphzouTnI`4zyU~
z{y%ZCg!v2tR`6aaG@Gd@$z2A)A{Lz|a0^_iQ5O^OT5>ve!c@U9$lt<7UjcuK=!=dq
zCly?cQLD~~Uq?h}fdoj4i*FVQypiw|{Q6Wlx$qQOdEP`W3i(EQ<wPVkNEt7S+(ka;
ziC%|sxgl|uR@6dd&|Scxb7)ldF~%$d)6&Gi-5lh^D?iGG#}i7fOE{ubzA+#O$Xv75
z40B|d0v4WkUFBO6{O~29E3(YkK0l*15~kq$CAW4#{g*mn5dPgH2}aVDSWwJIf&f*X
zu@t^t5{jN2qkBa#o@@%UVFf%TbCEqSg}i(>*JR_zl=(>}C?+}lkvP#>qJd+fDJfT(
zrXU_E@FA9(e6$XJxm*(Ah}3FU(G;lQ7J;vza;1zPsOH!q2#yGsr(*~>q}wnRAdwYi
z1J*f=i1aGP8u)=w#{4^^5G%nuk<OJytgs^$>3}olFDfG6zgy;Uk(wR%iupjI=(5$P
z<TD8}vikw=p1-6xa$y>s;E6Z^xue)6C8#R6?-ZiM^^4Ram+BUUi6x}zBrzx;n==Mf
zg<=ChfjFaUEi!d0fJzUeO5P3(ODFf@q$}AK7*U=vOJZaA6Bms8k7jF7CH+b=4}=!c
z6vnQ2+*$$)9}@toj!$1bT!&-nqvhZiZiGRp6fXgv;j3Vrj2oQ^P;X&MB_QyD0IwW-
z1i<4|YU=KOSR@6aYf#7cb#)Gv%7iCkd-9`wFFp1pWvGQ9E&Ei#ij!uct-W9?L|<Br
zQAxPyJ)gKD*^<^d&ME882{B)YSGapTqp1^2D(P5<1zpE<%QDv1RFR|tc7010_qI@O
z#C@b~sf9-&;2EVHC%+ligsK-P8BNLsnIv5)$Yp@a@FZJMvdsvjUt{v{NI%&Uk7;bm
zx9=B!I(Cm6|J|)k4Z#m|9E*w$`dsmn{jq!y^dA|ttbfTeAmL#Nr&Q5}7ie1IMdDK8
z4@ea0DA0IK7m@Qz*p+-wd)k%lGwll*5nPTs1wK)dkir(=L0q#X1L3`EiK|co<0sLR
zyIZ7UQWA|_DX~EONIgMCh&>>I4<?fw{lMXqiZLDSf6<<u$HWC{Ls%gy{qDi=F&&jn
zV!&46@gFS`4@X2Q-7iHY@apB6iwX-~;#tZPKiWbhw0H|aflofxj4LreS}^;-qypYD
zQ2h8Hc!}*t1o{dVm?=}?pNoWq8HXwot%OIZfJ51@76L^j4366+&W^x563|tOL_h6e
zEGl?fJiP_xiMU9lvQ<RT!nT6|pZF~dK`bVeNEk+(4^>eNfT#ckCRoHiLZReBWlTv9
z*Q;l#+dfr@V*8$9h^2{SI|nl--<DsHL9m1|L^v`YBj6YF!O&{2ObICyU=7c314=lS
z%E%j1i`=&y0a2nICGJFpML^19D|L){(aQ787~#85G?~o(uM&C|_f?ua;Nw#j;hf-4
zC?Gm2s>t|-N1RIfWrT`F8w!GJPwPl<>*;~J6XOv^i1<x1^uXtXFp5A%w_#imVNS$+
zY1yWd-?bQ$iu_L_;96xA*wk7~o@hM;AH(o`f`a0hiw+A=bK~~Fz_LsiU0}HUy%ZCf
z^3*tCDq#hDfFiFBs<G&aR0Yk2(HojmnN*Pii;#ir(tKP(4E$=}2gB@>C450zt;I;Z
z0A=_l(<YK}hY8n$(E-sC<EH&WR}g#GxIOI|j9f&bQ!jM26mY_xQy$kT>-CvhZo#uA
zACfKNMCI}%94;B|m60(Ok*-N_Mu`2}Ld#b{u<9}{hFmBIXLAih%VcNJ)|5u3Ok@H9
zks(8%G6y$I880&VO7K8PCaMsuWiPZyC(xcBWXsdP7Gno~+yVuGHvAe6$A0LT)DsrJ
z;4hwTNhy^LM<Ec}M%pJBk8!?`C?{GlFf9?Qko1ux0Vs&jy11XbL4wh*P3hhyzO99X
zlWutk94iSyMX^laljF`9d00z<AE-)u0a2p8X!ZE-LA)RY0+fU=3ZX=ZBVG5<abBZ0
zEHoV77yKhxJaw0+b%rf|M#66coT}QdC-Evz^t@K!M)axpMdf)9qBrCJ0pN7)+%}6y
Q4gdfE07*qoM6N<$f~bi~tpET3

literal 0
HcmV?d00001

diff --git a/client/ui/frontend/src/assets/img/tray-windows.png b/client/ui/frontend/src/assets/img/tray-windows.png
new file mode 100644
index 0000000000000000000000000000000000000000..cebbf6153eebb82e315352a7e019e2339da3e292
GIT binary patch
literal 159312
zcmV(+K;6HIP)<h;3K|Lk000e1NJLTq00FK500D9c1^@s6tqDHP00009a7bBm000XU
z000XU0RWnu7ytkO0drDELIAGL9O(c600d`2O+f$vv5yP<VFdsH01k9TSaefwW^{L9
za%BKUX=iO=p0So=00M2xNkl<ZcmeGF39znfdX|U1-}sMft-bfzr%!jQ2cdz%iU?o^
zDMCgPaztc;Y|1!^O)7-|rvk=FT%=+uO662YDlW=ZB*9dflt~IZBUm_P5)wi|fP^5I
zNF*c%DJ|5aPWS1v_t|Us$8XGY-S_+NCRny{y9JH4K5;mw_g?G&zwiCt_ZjZze(tCE
zeZO)$r>aUtRi?4;(`M16zVA{h%G8f@I>etXSL@WD`?P4=RMtg0#-C07km^*V<)ThQ
zcS?19#%2+pGgj$1j%jX+`1>jG|Ej7<@tf&9oYPRuX&zI$y1Gv1(=pBQd)+vthy6Ll
zSEpy2DwT7Q`k~Nw5A&R!Ke<X%*Tv6|X)5CH$~r!4if<p&W?809Q>W8$AKwtqFvs^b
z%eehAb*EEmtCY$jZX^DDh<}Rs{YAr_PpR+DX}eyhV|;eASfnxTqwl9Q4rBa&k(#EB
zf5&%?aUcCD9d})N_GA@*A0Jqz`1_Q`_~0q-H$FI?Yfk4_mnOcaUezgeL)>qb`ZT9?
z9sfHXobQdLiRYWsDgJ5eIo7^PLwqOip`Q6(?r)A~nNl6U7atw>7|%Wqsp5C%GR0d;
zZQSD!@9Ap2NpsxC`FxI_8TEUy%BgA>af3q|Pv=y`vvf1}FsGYUlZLU2-x*U=vi|W5
z@ww}GAl_YBHtE&NeY&}7;=RuNO8i+F>sqBIZlH+I@A@$v<Cm(cj-{C6&trY#&xVn|
zo3-eRSp1sBkDqz}_MA5BIz8Q#>Gst=t(I+CuX)Zg9gnduhAu5)1I*PTJskVgoyT~t
zIxUJ=v-r+^y!$zxb+cN=Z^U=Rvlj8WDenJpj%SHASud;jIrc@ogEHxTu#O9EE`IlR
zAMciT5PNvj#_o*0*~A`dVvUFRA1Bs$F0^*6`DU|9Rs8vRihJz(bhTjb#&^fhJ-Ldt
zjqg0ff5(TUQ+zL*?-^?rpFhTbALBWe3pQXKXDNPf=wsi;{vG2T$GTo`nzZYtbckOq
zW8ZLA`12~(dSW}oGc01W6me$w{AKLXZW{Fbytn&U=Q{q)zCFkN@n^Ah^eoLX*71Iq
zZnlf~Y0gEV_f(dJ&b8O3N~gZi+JE!|i+E*IdU-d*zF-f=d5(7!J0tEn-fQfyk-g0x
zjdQ$;dpX6%ILDv&aUZPxI-YfoKRfX(iT%>1{cacQ(WGUZvp)X(bd2|0$4QO%$|9fQ
zyLP7`t>QV?%Q_w6zx$$2%W@9867RKa(>d087<i|1TE*{j=FYKh{NF0x;~e{OjNfUi
zDRGQ=uPuvLmb&-4nDzeohtFvj%XB=P(l*X$JWhN^5$86geb}H?Jogm8SHya;-{YZW
z^G5c@#F=V!);NpU5$w?^>}4N+wpgyxBEGkX|K?|guu+5VE&e;66Z>^@y-KJ3KK5U$
zeR%3(U1OEIxUaa&cz+dJI+gMBbNv2(9@2KPiqjs?6weZtSMOpO`(zP6i0K)y13k7R
zY;*j<{qC%H*I)x;y|l06nN~ILu1}}fFC(kRCTHC^Pht14#ZBCQ%lqN)2k$f9Bj=)y
zwLXT;K7~CQvn`zqY(V@>{9GUR$60*3itlb4+4XsfvmEaVo5ge1@eZ+DW#RXDir>+m
zTC}k)U0R22(s@qYT6~7qGHepoKJ3fYW+DGn{o`MM_4bVMh=uFo4;FEAY=%R;$!4{Z
zA!-&&{UXLrn>U`9&Bt?NjN7>B1x7w@?i3#$dna}AvMTIXxUVvdH-?XeIrV2P=*&W}
zY49lXEQ8+GHe_tRQ42A}_k`1nL(-q^T#}3=FSXb2#V^R=Vr<%FqXUd17^g`_YuWm{
zCpOT;_Y_)i7P}9}a*XFJ+t|qX*!bd#mm8m1$7k0pUVO%R#K70-Nf{ey(8J3JZDO&<
z!7rG5;b8LftJu&uk3|^PcxU10!`Q_AEHVCZ?>Gt$?7*5#Hpn>sI=-6&vk3>n+8*NI
z%I<TpIB*dFjC@ag==CaoJ~mldHG0Wo{CzRo;If(77@Rvc)N$ZYEoHcP##$S*(9^|!
zjc17+5TA93!^mdgIpWc@7pe*)8b73Kl7qzvKODnx#lPz?c8mDE-O*0EjOVV{obh|u
zj#=;825yu=>r>qn`rIx82kxD}$Dr~&IK6YM503rm%{tb-)H~)7V4$aLi1Z8?qS$k1
zIZ7OGd^*N1`Te$h4+|Lg6}wRfhrQ6p{VwC(G_lSLHeu!anI;_0sQ+Gt6Xl)t=Rrnk
z6-K$4&S}ZJ#W2R_PSYqy7)z!-d9{w;i9I~V=VPSWSU=t=Mwb1^GvdU!R}90l#F@q3
z3TNEL=iG#&-nKmNq&-0ZQ#GX=*%145mQx*cZU`jX_>YNwKF|7ZK0f?MtTo0sz9II+
zd5UM(GZk9v6KjN#!ZYfmPC6UQI6D);V*GL$>w=L!hCRRu4eU|wKh~A+;T+=}hd4jm
zFj5$13>)`Rv8!UeV+q1wPBO$@oKHFLnR7VHhwvUR_j5eQ`nHAMAI@eSYY?wjfhPCC
zNyfP0D3-Cl%M}51spn$9uVb@T@%d{uT>JsXj$nt~hf~GL#skD>gnbA*vJT@HHyb}X
z%IV=)x&JQS_03f{roy&oi1)ON`^P2_0Jrg(`Z?B*FRnO0qkeV{M?{d<VSm^YeD^>w
zGRhe=vESNwmpF?d))nVg#{sPgQg!|d*$(cr^uHARvDVwFjUeTu=PV*{VNWkHQaRAZ
zmSAJ=kG+DqVI*K8Rq)0BQJ{hyD_E0J-`T_-$Dvh&ZTO)3D0AR6I|(SgZ(i*Vx^J$1
z1Rw39(ckla*q0;01r{dOiCf#m_we4aE9c&OiU5q~#5VBmuqA}@huBN&u)(WEoc}mu
z1iL)`VZatlN;=rTjSR{p`&ND1M;33B)g(Ps5s`2u@6RDF*rY6C{4!s<<e<kd*YR@`
zH#U#jh}($l+t@g_u_^W#P&{`mL>-Z8g~7<4bu30j0z*8=vh_=xm4$e5b%;20{D};<
zqbVYQE({V*bjd+Zv2dmAuA)bb{lvo(?Zxijte0{ob3`k%{h~7lPPUw>qiPHZu4ahC
zeLVFtSe&>v3<rzHJrQ{xj;GkvefmHc()V{KJCZoGi|ph$EU}+r{pxhJT{>#vnTkS@
zWgl;ody|pY2JxEk2-mAc-0vpt8|N15S=BOz7&M$zqjYi73*5v395}}DLf?3{k<*QD
ziFFy}$T?U<NBxX(4dYum%H};{2rxPw8->U~n<JhbgTq^jwI+*N6a+1?c}ORH_G9x^
zas)+o<Q(jSqS`uLlaXP#$V_{kB^ecMP<(u)$U?tAMs)e)$wHnLXJ|)7c33L2<N)l$
z0glRexTi_)ZWwL62#jzBEzTpJnd}zBRAk4^Pkr!>4K_&u1<4M3QPFgKF7Ig-ksybh
zfQHDe??$h2QRiI|#y39yDl#gJ&^dmYY=wivJDclPnIW07qUza3qrzy%pS^fLvd59<
zne}tZ3~~@9SCNepYtA!b7|W^CU$95`9h|Z<huM3m4Z}({i-TXaIF86*!YPxb2ziLl
zAxL8Tt|DvcF=V_5qW{uswFslc-edQ3&J_?~kmDt-!Vz>~j0m`J(u!{}q(t;&0rBru
z?5nbH#5@o{#h+ir@8Q7NyW9uC7fX30Ya+noKH|REo1ix5SZ{(4&SFs*r63!}+2iyM
zXWNc?Jj>u=4DoVuPy~{S%7$#n0%ai!-mH~@^h2-p86CAbsOGy;Qs&Qnfus;rDM%R{
zNRT~qPyFtLQ;4(QkN(+H*s~=8ogDb2y-g6rMX*dDwhVNKeRxe)M8FsKic_gezYisP
z$@@n(&ACJlI*qho;7JCSI5I+$(Sg8N77Bo`n?<@i?Uhh)_6ZJoeVecyZ8)g?XnQmW
zb4uw+1VTwp-DpXXoeu#I&%?8BH?0sJ>`EJJ5~m{GJy}?plZip^lXLwL??o9e{(uw%
zn;glEg8$LyPDnvr==(RZS9oVT>}b2y{salS*m?!nvX5ay;ykWn&v*BS$h7lWO0_a&
zY*$^B`Df#~<NX*>3S0hbzNUVg=!-}ar+~L^BRa>JjIlAWc)Y+yM!L|c<A&?_0(|;S
z{47z&DI$UoJ$oZIXc)lwj4cpW{2c}f!+ICdbs3+(j6;YA#)09vSy&<yA`c8RW^61b
zIY}HQaq@~(8*@g=7^x>-q9)aj7dn@<B5$JiE*A0ndL7?UD&;4_Xv33N@ts7lbB-~`
z!UlwB^e{SVdh2={pKBPSkdukcL3Y&p(2!b}@tMyeBC888Y#rXSsqGMDn8*T^o+m*}
z9E?S5iZS4?p&aFODy7M>apU_VX$ogQ=-}RkbDT)2V*_F^mNKw&b~v$NYeRBmxbnYo
zPkUuKrHoaTH#0%VE}*w6HeMeFWX9<egkackibTIe^xP@;Q8{yCt=I9sa8D21iw<(q
z-*Noe3OED7R2aN~X!(2~B6cegm^OBXWiZaXy9neJl`Z0V`gkAPm7~8pj9(L(>$wA#
zwXxps4>Ar!qGK2f0vsUBJ&~l0|D?@N_JR|U0jLYXHaN>N5P_>WG+~7UBC7-$9|8)C
z-%g8Fqy0@>_~z9rjN~!aEdrca3!t9!WH^kECAwb3V&a%zL@Hj!z67S)pPW?!E#X*z
zdNFcy>><|s2xNA(cC;R6pqIf-j{eJ(_eq?mQ>V4>WyS^>c7e#TZVv&G9(re-7$Xh{
zj;#uZxsCM#(g#W%b9RIsZJJUBpLiH3XA?hn9sBe!MG#el(*W|Da0-r+n+OQrxNg()
z>t*b-cn8OWGQ{ON;J*kEvCpglP&)5>L$FvlLt2GV<m>_GeDMoML!qDyZT&h6;5kYh
zY>iW_)5{3<;(!JW)C$TRr(SM+nw`l3ck(H#2sr!LpBP*PHVyY?NV}~Jg-!9Z`v@l9
ze>f^~CrEAWqtiati=cyj$T`3e#!*ez0h_k*-^ViuK_CT(PR8%%dZX`Qf0kvXceRXz
zX|y7s%ND~O`#ts%@ANzy(ks}cJY)RMlW+hd&}u-MRea7KR3TnUhn<SGFBMuQ1q)<4
zr^7KmCn-Q^NysYpQP^A{{CH15;oJ!J%65nM&t5pnz^`KML2z^i3H;)|uzRx0kw6fv
z50nSu9=Dr?0u;_I=UOo4+$+c<tHWTte-|i1*rr8fb;LEmqsrj1RX~_M&%ZEw5oZkh
zgoEOlfSC2(;?HBt#b;pq77^^lTE%;O8Ko8O{U+WK0YgKnsmurt@3+kFFV^}P>ovq4
z>Ttlo_BhI>k`1Qpv*rspC!ik@1XbVlvE|!1ByJdZ;S`z25XSUAY7#9NuncWdO-mj;
zx!wXghEu}m7eyStg7o+t2Ox}pIFmL$>oA<st2juzIK*TjR~XI?41N%7KvaeEQnamw
za1DnC!Z2gBaR8gmQitf-lk2#TQE6v~(>Xd7UzRy5j78&jtN45jv{GKOz4+Z@)Vqj?
zz_b-v3ql*Uh`<oLhrQ|^%h(*s4&tZ4);TB`%%>57FXP}p0ND^JgYkzoXC0a_Dss>%
z8TO>UhSQA)xb1+0s2`Q-BY|&kNu4nWB`<W5-iWBFjLmja6{`O|d)mtI^sy<%9Odxx
zfPL7I+-m`Tj3*&@h}uCcj*K!<EQYjRuES6-6NxyP<MVZ_)#03Ok7sS16-Jrp4@iYI
zm{nX+jjY3YFAXykLI{m9lbeG5_Or9F4+O0Bd;{FtD>xv-1E!U;Eix1Yln@7SAHVbv
zrxoYZ)Q%?ky=m$NSrB#d&ms&AwUCBjBP@=f<aw46VlONfUiTu5#5h-akHCh@%_i**
z5q-y65)n|dqK<TT90hp~3MfWpe`K}S+m#|&9Fd?Rj6M$*_eBIa$9Dt4uureAwrTh3
zHVjm}hd6jR6C7kD)^U#pW7aF2Z9M<ENH1<#KOmrmG8OKf$eML07+VU48@2Zrai52H
zC!27p>-gR`Vt)|r9#5kJ4WL2{CaVujL}tT2;PbRs<2$e8y9kbka3riJb+b0^`*0Wq
zXJ3(p<D99%0iD+o2m%MhyV!+cImJESKXmDhn<9R<(EV|SiZMe{abHbdw^2rNO1BRW
zLPu_HuC)JgKutAiEqghPcn0be)X1Z5^nvSzAZ5-XL2OFiBdj}nmLPx{Y(w2Sf~MF2
z%KrFHocJoTDzZXqS_C>E7}S%9&WAYXWJE$)%1RmXA?jCTEv)a7v#c6*r#ku7l|PFt
zl;0&=;=YK<7rCxSW(W-W>WJOqd$Da%*NppU*#p?1*qiG(SH~!Q^bu?j`0UA)VoUJ+
z)Nsqvun>VL@TFkS_-{eHu~yHX+{pe7u{PK7Je#^vfZQv~Z58|-rcSlTuX*|`YNiJn
z|30}Cg6%8f*$CXa!H$+a{xrUO8~cJifg_kyk1}+xKs)SJqio6bH%btTaC!<&sQ2S6
zbT8aH(4rxIJF++vQ8xuXRdSIsl2l;tBY224jn$2MaFIUvWF!6nnJEYi>&+T0DLp9*
ziv%UgQSZFC5C7Aor?J-r$;ZA{9W3sPQox+c1M7IlTQc|XPt~`7uzVY@NLGT!#-p()
z+b~Smn{7P&QJV}5yqGck6uTQm<Y4(2Msfk_Q0sb?UhX?#r9cN51`61%GKj$M!zsLb
zyOVKvvI0}@wZYo$b<}eV2jL{~)(UFk;a2NbIqvPlA?+hl!oKXoqvLoQMaGf#E-(Ux
z4$&?)E>OvR??be%8@(*xGK>M6i3pG4Jzqi;^WN=Ahk~qtA}93&VYfsm;#BazYi;Hk
z_=>{&d2|t<+SzP)h5IK0I*~;crJi$lHra!hwu?=Aq9z6mfI*@L5l(E^4T?H$aa8f0
zOJ!{?ykeZ$xa<zHTwwEA>As_!4FTG4R)$ElNfg*c@znLUWW0EE4eNTl$!YqeAVKxS
z*%3U>aT_(7WjUm0;ZPw(Jc;a;6dlZdv228i3)hZC;oTliWIm(dio1xaIS9i0Q<>|G
zIfJSF?i)qzqt<v6-^J#<ip_|lVJ+k*%UZDQNHjMCyQFjz##mTA4kp%$AZ8T@V-tau
z>gVzNWZ4|*eK@dPJU@^r5&9z6+sKN51eJA#kv&A@TNbgm<|qcAVxMfUR3JXa?*a?6
z&vAA|7!F|V^|ICBq3#7qN#(i>-BB*u9VTT%WC_$VKr7g1M2-*rqys+^u*B~y*VKiY
zShH|6>xee@y%2@t;9Av!mmP3fQ982UA7>T$Rf{BYZtZNwqEda2NFF2C4{`2hlW=%%
zWLp^iH=aLLHtw=Xp`e0wl;c-zE+XHh>t**R*AmFMFyg#Jh*Jb1lo3S4SwiHf^>;XT
z92bUh!pIbrYKKJn+c@Lf#=++zoW)@_G|YQEiN6thAZ(6m9brqJZfZGSXkWm=eGbmZ
zzzNj4FvK`h?(b%^inU7V?iK<{qm1?;f`Ep1-rD&BQS%YotEHg#4UlNquvY;~0e>kl
z2AzrLp{6-!5*N<w!*5<kO|w(oh0i&Su`lD^3GP<0PuLG*7-ja@N}o|GBjCIdw4cI0
z^aOJO8&m(qCMa}}9h%dJHl@gCd){4HtB!b_47mbd4yqfUl@(U;cMw-7nVcd31?}14
z4C1>9ewWQE_UI~tirDwz);6ry`INTUL~2iED+h{$6ETN6Yn+cGdtf%fY?y6xuwjRI
zPVOt|T`rWZw}M(h<KkQuqt_{ZA76ppg?z$$S*Ye-D#*i5^E@YrED=;rWNQ;O_9O>?
zjs<@|-UTiZ8x3rEAA4;dYsEbri1_1vS1LV`3;=movN_eS`{?3r<GXW)UuI=qEF^}I
z2#G=;Si9^eH`zOSgE>MpuIRZ0b8m!o77>vyBRT<6;D#C%;wKsH1x&5d^?@Se?&sJ5
zG71<~3?Y#ci`bpwMoHsq!7CWB7Um*_=8V5%NKbt)NDsJZRK3ouHpM#_&P6Ln%jO4q
zBAVuT>trIp2cBPx0ZD`hBtpaibft|Am=g=RyYJJpo23pu_$>#FXjHW;;H%i&_hImk
z)2wHPA*qNS+XIBTT`L3R_p8#xmNpFHW?N+^QV2)yB2u0PW68=o8yAb&_?zv*nINPR
zz0`=FAuncl5hHfO=n9J-<y5c2vz<?86C}>SY=a;f!;O=iD^a9aQo^Xoe&T0wg>$L(
zBLFxKlj=b_0zf@s0Gim0I4h#9MLp}#ve5-I0yjlu<<A}k2NS#y=@TudWJrc*xnS#Z
z@YE_OXg8&z^pzNplQOy9(TrdNoDe~Rphkip@c+v79KM%#jPou9>F_RHE5!nH;Q4uH
zDc;KkuueSFCM-70CDxYjBD%i0*`^bjz-%U-j){;KL+7et@or<?*O7i54tqHY7<9mM
zrmiJLwis%h>m3ZLb)ovgn@?6cU)_09Hdd=fQn<Dh5oxV8jp(0eR3tj9zB=f<m^BML
zU5Lapt3G)XhIAV>S?Y$c{klLt$VU3ed@C|_u~lc)U|SG}9S(UNMq`w5u7IYAc!AN#
z{#yUHh)rYy@iQ1LYK1qT20~-ZMx=(M8sy2aBLpGN=Bsefur0|(<mfm@5zX`7=f)Yd
ziO6vl!hk(_dL70)_C%L-&%n!K^#LCrcCp5NT5U@?LGFu;gL4ETr24Q3JZ6iY3oz?A
z8?g^xbTDyOdM(^b66}5!D^8gugr(R&Z$5jP8P-0JMgC0Q_hEl@Kp5-9-yXV2^;6(@
z?FmQ(v+Gzu@SsMe>RN^1(QBO0$+i{8Sd+CXx|kIRtOHVCgnig@{>g$O(|8dMa1VMg
znSopujz)l$b-u{HA=-o^8%y&BsQIxzCnW<zuAdIFg`Bl@ARIysD+imZ*K_|MMukfj
zyh~tppz}inxzy#cN34mS8FCA(@vf6EVE<lfcR<USWA+XK4eK#w)^lCj#=iCZi5TD}
zZ$u^=_JQ|;9mWn2T-1I8=`Io}9C!8Wzi$0DkOanO%G5)Q5^N%j4j0CdNRLCsgO#wI
zfUpQgMiVqx5dB@wJ=lEEfd$WHSOE45^hhEi=+2^30__#)HB%9TM1+R#rv}8rokdq)
zt7ZUWio-c&T$_iZJ}34Ihn>PX)XCX~g$PzgC9{I6OpC>dcC%S#(3f;T3;*mSDs3g_
z3WJZ-7Cbj@B~c<`^Ac67J%B7uMb|>~)D~t=n#3j}m8SNj^t>?DwaV-vR?2b0s5HG)
z`abD-6!}bZCPK`LT7bp`Bb-N7HC5Cv94YaMM5wI)I2LC2k&0l57mbS3Q>L&tV)qnE
zw?$d5%8ZGRD!gwNr3@t-6oVu9K+tW{p;|}grM3rUcu-yoIl4xrj!Ey33<da^A~H}0
z5gVizqDD9$UFTvt@En0188U}Y^^T^H0oiW6$1o0sn0U!>1&f`Mn3+SaPl$jp*g2BH
z<8#zrP&i8~3zLu3+A#Rv>{k<bOcEe)YRgfztYWrjV!b$Gz`*<cDF+@&4p2UDa`8L4
zw4<y_Bp>!iIM=n{B4^EVj&tF5fq32;>Np2G3_{rGbblOma@ZdV&dQ_+lgGGZq?^`E
zNA7VhCKETBQgtIO3%?}vvJi9&sC4SwUQv!?CPb8ac7A83rGlDHeBRw|5W+EMB92Kh
zUgvQ#SxKJ^<P^^hcaypY5O|$Zh5;ud39lJx&dvx<U;^@4b#q}O&kAJLy7>rf=gP(t
zdlL?i+L=ler8AT=N9ih4jNXgn;ndL&XGhf70l&9FdudVny{gk7zVBHCes!D)B6||4
zEm@45>>!c>=n#RW;p-#^<$XFSP-qlT*hV#?>{cS@jQylD!*@-CGZ*$@N@YHGow5Y>
z6)@!~kfZBGZNd}m>*P$^b)(U&SXx;M)*{d#>ZP#0M}lu7QPiGS1Yp!#CzlaGLbUh0
z%%G0%rb>B|(;%yEa!Zbb;&mh!AT-!$f*ljW41tq@5|r?{pcUh6hIXemfJ$v3b>(&m
z_NgpdY4)e=x*+mGd-t3JbMD#Y47bhjv)7R^!daMSvzBm}WV9qZ1Q905C6`Gc{IzCm
zSHJ!jtlpNxsod8BSAGWHt{WXR&OtAVxv8uo?Zkf*(Xt`=0^kOggTLdjvhjF`(x*v>
zznD|*14{a0QXky_SyyZhQb;`jn~naTx)4-C##cwwN#Rv=+R2BH=%f)GGAZl800YYa
z5iKG$-bX|PT!O=xE3>Fzeu>Rj*a~jqbGI;#C}^rCHb<Sr2Z?89V?bji?Jw&|#%P{v
zEiwlYSc$$Xuymp_!6-0kG83wVh7Qa`)DjNc4zH3y<mVRwuO28|v(D8*xG+YW>;{-h
zPK>A*0AMth%$k!W;WVgSP;gbo3j>R|L=lsFeJG@sVksH}A!6cp$-GQ?Z}pDULI8!e
zt;N!VG1??Eu8QnvF_?wky(4?Fo44M2GY;XsqPL3Q6<N`}JbWg5u>o@;vM2hD_q$jC
zCz<Ylq~|I=a4Ig4Vq>-y`)JcD>W0QY&UO$Ke^vJ&+M7)YR-hEcbEwFr4oy-N%PZ~$
zL5)t2R1lv;|5dw1rc$dn2j^CqNj1xWCDl>qvXMvNXLk?ItVnSb$yYA6cY=CK5g_<`
z4j5}pro``^w6>Fs5?DQZb{%WAP!QDXS@)5N&@<=2r4oBmfgImGj0!T?V(v3DEY~(-
zz3A+*w$${-$@_&&^m;=rV6Q$c95*y@nJjveAnpvkvy{j@L}jNZiC|IWq%oP}JIkQ+
za~KeeYFWCkOnpwJnYoKLGfrm*U1i~{guO#V-^DrK-Jca4lFee^*~inA1BLi}&<dPw
zGY=W6ENv&)zmtDfK_$D9419LY^1~l|9<|#}^=_DpWh%1sDRd7U3v2*RY7hh*_f*Xy
z4MBte<)Aci$)It5>;YJrt1H)!r)<c9eoGyKQqEj~4H-@BW5`PU&OqOiGJOXhtd;5T
zNr4>b$iuGF9(8+BWLInVke+k@5-=>8I{S)DaIq+aMyXd6_>OEOY~!{r1q)6hERj|E
znQ^ooXQOnGA#XIArN`MFm4HN$8tbK?6|^loEzX)&8I)vn0KhZTnxiu{n%#MTfTX*f
z+(ttGDf=1-mHyk_^<mEBX%7*~K|Ie%opi{3YYOD4k40VbQV$f9mCSV#-`>0gf(UAl
za%M13xnaSCmj*bZlvWLWDvS@VVep_7@<ah9gqgiTaAtftbuLoR-7$%d4TP}}>B10?
zvXa@3Nvx9D&IXr9(T!AwBA^$y6pTfL(dHr|ba)E$V#*hJbIwKXpR!>b)x<kwwwbdV
zeGzcxWJn3a4veNI$OHqAqJ9_};KP(Dn?!$^ws}ddaomINPEi(c$%%|1{<OU?#|kqR
zYf+rzn;~+Hr3`=>Jw&8At7SdodrTu9wEm>#f>6k2jCPty2pqs+fGDbrsg$F|2$m^j
z*w5+sg&8LbDKOQXsn?YW6Koj4mGN!_2@HiDjGA<vP2zOOiXpkAY%q$<oK%LCVZ|xZ
z_C-AC9mJT17KD=xT}n9%PlC^;ev&a9_1^8^`SazX(EX;_6lGDMM<0al=qO(swi^}M
zQEa6?#(q^lci}9Q!a47C5Zzfk69r*iu33!vA0j<5l_Gq<-<`y8#A#M}FU+(pWH{X1
zXJ;OKU!(quQBV-ZDCPEs(J_Xc9}5V%$AMihW3#R=Z62^oi;EA{-i6cyOO0*4XlFeq
z&PQ~1*n)ymMiEZN*-i7*x)x=l`=!3Zc~w?KcFUPaW?iz!AQ!Pg_CUp)joQeA&ZJ&#
z7?rLGNHdIn)Es-&oF_&9gSp=_x)>~??aCpjYS@$n^gY0O*_a6tWe-(8Ct^;L1rH`(
zsRS`Ns>bLOcn!*^8f7s+i;zN}ZdyUW>>)MLs%I`K08qV)9Tv68Fk?}xI?Ey8(8S`5
z?;-XCk=UJG*Q?{O(y;sL1eHIa&Dz1Y96_%8>3`NnSul=dg2QZkQ5B}Gt5LQxl0Y!r
z(F(wsDqNdq4~td~T%8-imAjW;YX3l-U>o+19>_V@EJxN!eD&HaUPvBMU$dw~)YBF&
z4>+cB?<BN#^@Q@=>{M!_a_kZK_DS!L|Gg-km62$$S+!3qL(Y9>AKHfYLVaYr_!OK3
z4aiNE2`RmpkTZlL-YGVNV4c0vJ3t&&KXbxzfnXi<Bn6z<bdC<^8Uhpn0fEEKVikXP
zREA16Nw%th4<{w$1{ADvV|U!|O$3G2cYW>ZZK+D&*~%m+sK^_;6<MLzzeQ2KGz*vR
zyU`6moutP@1-{WurWsn&CY{_vrRFh64!QM}><4<R9a5VOY|_TyU{Q!xx=r>n`v3@f
zn%xtF@m5qdUmz9tZ_pbi24rm*Y#~<BAVwBOVbz$nD}=B=#Q`b=S-97MnpaX3rA}~Q
zNsO+bfkyQX$$pf^r`Z6oi8@$frRlMzkk496HseyTi&Nf|?>Ci>W;vLx8U@`9Ngo&m
z-9CT+LeG$!cyj}g2qeHDe1{4gZYFjbp0Y8?uw+?eC+~ZLWFm6=MJWX`1&5vHPTukC
z=0T$O)94qX44||kiK`gy!QfpSqn0BE8YCK;v4I>)?<0(X>YJj@!d|o^LTQD@)Hxd@
z*`UH%99D+b3uVRgl!*`SzhXau)hpu55V0XK^@9s$gTV$&iL<4C!oe2|F4BxMFR}xm
z-?Ms#W;t{P2!*NY>RF?Gf?(l1C_)CF5Z+#sZ8a(}xM9MEQP2pE@=To}ps~}Ss2c;c
zTo|j@?xKH<@3763GdjrdWtb1Ako&p#zd?s5rR(d3YExv)%19?0S_LjrAg}}F&scxF
z)A3~HBRyqe@zwde34ds0o^%T3B&mI=u3I?r#yMbQI8#&dKGIoN6S!;N{28TyQOXf!
z85>J9<g09lbBkI=oE0Ewt#jqRL(Yb5NbM|{y$-R5TAEZdChs<!P*b{}O+8rU^g6iZ
zD`Bmv)+7XGQmvURjt_-&T&fSwdty(Cp=gwWu^T8kxOO$=ma@hT?(uxoQ3+VNSJh%6
z*CfM-b!I**$WgX#lF%CBmf-s;?<YG(cTA?&tu1q|Q;UKx=Ql~HfbS)<s}%JP3Va~K
z4Y_95O?HZ${cU3yeMf`*Jc(SRy(>nqYxirF3#^JG2UK6W$Xv?;DREFZs|j1gm)e=4
zVEd|4AjUpp?K@Q$YMpc5JMXTpTsKzpxxTyCIU+FLAC9uqN{liD*<`p-|5TY-m~D^V
zMYc64<8V%@$~N<y>HBqIk&5bjzJBwzd1ihYD*A%e5ALIwGd2r)T&WgNDw0>X^k8Pv
z5|&kOX_S?4=2=m5pN(ysvk}(}-1pR0UQ8U<l*u9dIfk15JxKDz(J72Z9ArPa2$?Ge
z#>&|grAZi-R1g{&5M^fb;MAX}1fl^Xg3>)YWmXI*vup~KWF6MY22l{>oSW_FQK%Pj
zNX|CQwUq%B&=x625tcV1vmjECIzns)3YkElMd|E7hWb+9qAnJOj(#XeA;oJ*(6T?&
zFR1xk;Ind`b5>$Fh0TPaltfiwr!QEp^riyJQnp)7CYn&kSyY0|M5@RKt5Wn<>+>NF
z&@*;YEx|BauD1Dbmy@6_^@L^Paz!(vHmqsk(|l=stegc;ephYnjj4W`$_Km5&5>@?
zv|$jOv$QdoMFO%cm4cfr7o(sAjGv-@ZFLPrwHLy~?95jOVY;kIA$&gjd)0QdzRCMY
zun6nk+5qsO=Mzk-g_*RyDdKaEB#9XLN5mzUx`ZCw-5;ekLp_FPQBdQuj()0bbASd!
z0_|<i(0A$2;s$kp9Q4}F(hxUz4q&BYyrWtOtTXs2Gg`?O>dNpob(QNSEL)=!YPO$p
zPmzLqAbHwgT#KsZJj`~zG?^Ywqk<?IA7xHHYc!bhJ`{l`2YO>Bi2&c}91TW3fRJ#6
z%Q_#HWT&mx;KG@%BJ0vlO{9^r&yF1Ux=?gahQj~(j7_eaXQC792nl0Z8tyY;%g)a&
z1Fg^?^{_z@pnjO4Q@;_{aZ_$^#(@C^gE%OlkLMLTZ_3Iom2DW1Y?TeZ+H#6PbuTq=
z8&TAz;NJvHs*#Fu=r$U9-`LculU<O9tUkiJdVP^ZJL%l2eW0@Jn)GtCCUb^EXDN>?
zvP#C7i4%f78$-B!N1tn!BF2qQ0I(Sib@pVvtV>X~5GvBDHAj7D)MyC?rulUi+2nEz
z=b_1}8?HU)`ZG>{bbzPeqbhTwx|NvpbG_Ak3@**DZ4E&s`N%oj6S79$6_oqxJ3qF3
zyB9q+91qQQrBh?-MQjpvX|sHV2>?V%-H`SCGI>CTO--PMoY*YGSm+SZpU5HOg`JPR
z3W-fD2Hg=vSaOEKFT9DRHc=Wg=R0l!tDn%Z!z)*9u8UPF`hndmn!#z*ei1w^@=yij
zi89BSFn=g;6H$(4<>0J3sH#W=#X<j?r)w2KhuoPCv>*aTZ39TDWS*_YAT~^0<-W5*
zS(OeE)u>FSDC(s*W_GrVFl1eJ7#IhPfEb#cqp?cZ^Q6N;?}X^>l_MtA7Gf<|l~pTv
zZgka%PARymrz^j7Vd}sflY8>Ozo8`)d|-^^IAC}l4X-(Kw%d@54{%!RtiZ6Ap-QuR
zYy>ZXi=$eMX=`1%*$zZS`pL!=6$K)4sK~%e=iU@;K?y*8ncQPoDi?TLHzooBN*N{B
zSF|3bwf}gZ1bfs?50cy(-PbdkY+$6mG<CLgVcGAI8ypO8S8j|3dP&no=Wfo~LJ~t#
zh(O#s>wMS`qM|RgK9;$evYZ(K-D({NeYq5|2~vU>l%;#kDg{VJ4yGJj(6hoB_|TJ8
zDtL#$&P`TXpeeU<EfAR>2rU@Z7AB|qVI1A74=Tf!*q~$Y_ev`P-A5-iGP}`tl*6_9
z3@8eOhe{2$VH^&F-tj@QOAfN63Y81_1hDkc)j-G*_3pwNK{R0P%EG-j%7n=(5HgtE
zyuJ%W<LUJ}=ccaF4x<@m&E@<i_Y9KRa-V#b4A^Y;q_XK8NUb2Flx73M*3}-B+Cncl
zo_p^{qcvpwK(z!SqoBG*urTW=CtO(v)EbV4H(?8d_6WWsE02J6DjO+CP=|-W!#kR@
zAqVPh=>;t9{3;re%kp)<=#c5+LYhj~n3b&o^{Uy|D2nVI8D4KaR%}%U`O{RJS+^=}
z_r}rG^g=`)f8P!gN9@O?&dQ|Vv#lN6x_xO<3y<a9a>*ghQs1EcgFr+iraAZ7mE~)8
zXe!*q3>%ot^TGitFR-5y71u=xq}A9&?Xzx;93&H&#<_PQ0?Nd`&5~~*Fe0av)__#A
zer;*Bp>RE&m4Fzcpb-@3*M6vZyUM9xnX`;aKQ@U}fTx!tLZ&dvsT3}pR$7>RASX8l
z*M&8|U{`I!pk1$;9IsCjSuHMledj?hU@7LJ6%lCCqqas3LTnbI)4+F6XRB5WkN_Y?
z#EsKL%F8~U%@Sf`64jk^u@ytL&Ks7f&k*mZO>b&%(gqQPsrsH_5}b0WVyqVuV@B$q
zawE1Nx@0LOMfGHkVs*KYD25x-MPaZX0<IxTBPxeASBrem2n*)Lsy9f~*T%IVHtuAB
zRj2C~<^<+aO^BxM&Y6K6emFzZQq$}7zQ~y?R8)H7!WzgZ&>g>Al!6do^O5mh^!_aM
zRg03!0^Ohm2cZDc0hIsIQaEHQ)Dw4cPsh&9lymOO0FuI(VYJkk2ppwoyO4pzc{atM
z$Ti+VIQv*5GLqU9U>yt=6POR<6-MmU?Ow(Jvck<uIE0K6^-S_WY9bGZUd%>X3y4W@
z@aq-EypDTJ8Rjk3Xbo(IL!yR4Jr(Dw($tK8;!@w~%)*EJ;pB$urS4^yZmyR)oMwr-
ze@eBWc!v;@uC6%P=iH2ZwxUO2nJSo-^aqxO>&Vn}F}y{)3g<TJP||=dp<MN<_+6jW
z&|gaHk&FnUP}R8q4(PiS^kg_4L$~jobxFFZx6*{*_GF0L3|s!JmQ$VwvnF4?>{5l?
z+vJQHh)7Bo3SO<UqJ4~t1J5y8g36Hf-vLVjF~xnJZU55y59jnGKIdV7$k1SXKH|XG
zm)LVx>sHLhl+hDO5kLXYVgx|C<>eW~S}k-I>cv)pro@+Ln!p$O?z0Skmb&6zQL7jn
zFur=|g~F7oo4aZD0_je(gB;$CvIMfW2vjiaw^1w;k)<**hr0xZ+`%R!=!|!{-85>n
zr)FN~EM&;Y5E&`3q<Xmq*S8f`iCLEfYqzzf=s2&{(mk#>G^_)y#Tk4V`wz==?kwa@
zopCHo5)wKt?ZaBO6(ZYGWeLA;Aqkn>A$dO+I@3VgLuJAe0goiZq}Wqreb-Wm1CC~o
zZfe`)#Ks^fXSc`*M9NNVlt6?7(pu185_48jdg(w|*|_S|k%*Lj4oVWJQ!E6PR_Q+0
zUfDW(R=w8lIU{*OguVK;A8FoxUCYRk!9EU46*s%vAN4_cNFXN!SO<C-PGZeT1zRys
zDTs*!-elG7TFq>eUVsYRVgm9Vu_yyw<|*A=Ez^Bx5mT{UREwCE?GcA9SMGVCS@SlE
z>5kInzEyj>5DgqP&w?q`;)+uEdZo`@x8Bec8>^gt-^FGxqaaAX&s#UE)E)O}PnK3V
z^BdH+F{_}B@z`e?IjQj+jtFKH6j(_+)wS4h^r=bwGhw8c;Y3?0!qc=2^orY;cHnH;
zl3C25BE507c3%U{$nidDc;qu1(e0~D?Y4|m&wGg{eB;Sd4y03WhM8_Dvps=jsFMNn
zXaj*4AHsNCuN1X&h@hZ~9hTg{UCo_pOZ54k1UFRa`IUu@r=rSGk{u$Oi3t8GKCd5+
z=_=On{(h7ZnYDa2sB^i{AuNk5Y%8tFIlb}pI^N|mB4>y#WwuwNvZUp*6r6k(QN|e_
z|HVPu=-s=xPc!5d0aa;M6YvSebTZ6QV#)E&j*}eTg{g!9GwUqj+PPEckyN*=<jmE~
zT(~h8(u}zvlNv_#zQXa~_}Smoxg?>5ypTPg8G#7u9y-J05vljN;S0thLcH6^$dK%z
z#e%H*jHYDl-}he~!$7&83fU-}IIvff42uGVQp>>T?6csl6|XE<ibGd}GmKCq#^M>!
z)!fH!p+=;Jda38H6@?q(pVUyyzdK1wku6%{j7*>r96q?<USt;C;9~w&+}u^&rI&kg
z_0<?(7Ot~N`x2uW8~0V5-R(9Ead%dxC{j(XbCNlL(vaZ@K09^FhMOkiYtxwPLT0OR
z$9-NK$`D9X;T)tcUONi!a*2ceqKuLn=G-e7JVYV!ji;zd#Lpvb7Jql#cV=jU0O6!*
ztd9G>jX?P!0?%c9)cUG&qi$I`8xa6u(vFA+ac6J6vC^|0a>K3lCMz@a)HBzr&crX%
z(y)*H&sk+U0zt;<WcHqFu}od)tkAzmOxkek2>a72CY2eWvkZga>t1ZtB;wL6_54ar
z+1=#cO<G%E8X7KljR{sV_lN-ToFPz3H_G5u+aG1S$u6<0z`3xn4-wp|$2T{E6I750
zuwN|TU0YkyPDNQXd+a2H$*lxr{in%mg`GU_4npgUEDQ?N7x7LO(ryf!SX5TiSHGtf
zc&hLG1?#typame1r5qLqdd~PY*rzb#Q*QE=hFc}ir_6<p^y{r4IEk&EJ3$0QgjM0*
zFJ&=V0CE$D=OBrcN&R5EaDp!ITgIP;<ExhFCMhaks`p@sKWk*9R+)C}MYG{UoDvmz
zdP;;t7tXZ0Os3#xXqv_dECPa}uK=fvvzU*^*B*Y+SX@*}-bPwoG^NiZjP=d3kiaQT
zs@>ok8RDi_%asa`cku#<OkpP-&-*YKVc6q$w%fItg6e9INE7A`5gvOlB6Mi5XM{+X
zZi<9I$O|6hFjI7;d6@`&3vIS?kDKsv73#B&WbI97wF*BgwZ#v{p;|2l-4}-)owYU#
zsJeDGYqLnuGHW6(<2%0iYOiO+z^uSaD`WZ`SbA2<c;6d(G$u1Qo4U$Og-Y-sb*v({
zI!L)cxgPh$_fP2*277RGO+<_SOfm=HL?EWS<0NYQ)9q4DGO39<Dcj&cP=qh$&T8A0
z)w>t5chTIt3PV|!nY55cl#t^|r6s;{v95GbU+lu@$G*DWtP~tg!&y>IZJRSxzO#pl
zT+5M)wj1B|>Y=kl7LrL35FDiAS*ytxmL<;Zq^Q$TB=EcM!cji^lg513hY1L@8Qg4Y
zWnD$R(z#LO8jE?4QNnRS0-7zzd)N(HCye|B!c)IgmX*>OTM%v6%HpodQAU&2heCL_
zdj-?v@i$@%#shDzuNB;pnOqb#8bL&}_R0#TN8#Eu&COKHKv>EgFiFsMbhGhXn)Jb*
zd?NzGFWh$FG*(HyvxDD<vQG8wxNgY01Di`xJk>H<WMu25gB~&+BLCxYbWj`4=XTfY
zo}?bbv;`?u6oR`&DvQrW^cpxD=X%pplW7zHk>Su-Ux?XUsP04y4I~jD&{We>&<eJG
z*q^fMh~di%4<$_wHU#;yKLZh3Uu|4InSI{Xokx@Q76MwQhHo_^Cue*@kx&+jK$~Dz
zff-0h1U{YYVcg216uhod2q9fD>DjPDoMEYXRdz(Y3fkKGoM;ey0p-^Vix(gnHmdJy
zlG4m@IvVy?BGM?q=tZ<J{Ehtt;=77>{pw*SRD^Jc-#v96e?{^@kON7CUOO1ks3q+g
zD+TF>wbd9b*KtJ#&%yxBWYrf$5y<ej+pPj1Wt9UB%nOwR?hgn3_eT39*6bhqSo`*<
zl(ki4aQm>Aw=HtVJl+qTyGFe!t&ARqqiKAQF}l21((gk=5}Nfic@#<^>U=NL(Pov6
zcV0bc<jK=5stacol12NB?_SC{xX1_;g*U&y-$|Q}(IU*yQSTJW6gb$)28mSvbUsP<
zO}%3X`O*nLS2ALSm~on+qB_*N_4tj|!XyK5>?hZ)*>F{xXJBPT@>I&GeB=Yy=^?Nu
z=JK3GGD(8WSad;*IPTW6{$MK*5!T?nkU9c)SQZxkU4?VHi}UvRShKOVl*#SG=usb9
zv!v`&^^AqbM-XulA&%!m7}GGWG)xZe`FQL3Q?ZUja>>y+8}17EoVc(19cln!VB$SU
zre>0mktL}1oi_Xj-h8U>*%M%J5Ke=l&^P0=4-v4ij=R$&C5Tn+#=?HA;y%Ohuei5P
z(cU7rD<}&RbrmVAQKKk`*l<=~2-rosWwU$!h$1PZ6Rirrj^DdRoVntl9M!Ysx<e;8
znSF;dnc{>XvjjXi0#m-ax4M6P|8Xd@@`-1kDRQgT-s!@5{P~JZ6Xy{3vse|P?C<xU
zf^f5ut5fEP(c6Y|yGEC<?*)w!8=po;u*mxW10M!!wT+Q!A`DBWkI`3!CKEU?+CZDf
z*{UMcSLo9Lvc75E*9Hu>SXwr!R)at9|Ez$cR(-(p<k(*rHbKL+)hd8cW+@Yt>Af)O
z#C$ztO=2&-zw6`x`8~CKs5uv@szI>!M?Z)IKg$tNn+5WbplWp)K@-q(z<rz@f?4LK
zQL`jV1(Myd2RSo^`;o|6pM<f#i|2iFiSBVP5&@Zln1O}WPAZLk>6Jwh@t>u*V0!<I
zWJatX5cIxtpOGgoMCN|Ii4VPxz-%ds`IuRx1YS%bARt&H1s9)ycHXM)!}&*WGoOT{
z2>u_eP9c(yYI7jvW&k6_CfCyuXe`38u7!X|WVdv!ZI)AaOUmv3thy}O2=l5|t%HbR
zGy_s|t!B@~f|W<_UR&fbM70%%R#{q1w58181XUQNh*AjEVZ8*`N)4$L+Vmu#l6p9~
z9f=7Hkr}}Ym=T7pEbT;axm{HG{addPVF&6=*mW|qvs7zL(?6>YT&6c7XclQ_vUqT5
zmRFv(;S!RhxilKZLK6!q*hHXMm-_Be$~uiQZ80<<6veYKh6Z7EI1ha!5U7!`c7+g{
zQNap&oBQKQfsPz*8kICjWLFVyZmR30${QPeO+k7YQO8ET5g6f%YBSB2=zEccQT$cS
zJQn+dH`~~pqj=y4hK)^@9nz&TkyYWl*j!hwNgmJ9sw+%`*4(SuBz*sv#Y9h830}qf
z+7T2O{5ib&XzE%n=vDH_*iFq7i-WS-Y!!7JfFXui-S`W0Ha$F0%*jZpN&h4A0B&Lf
zPMV!%l>_kdHAW&l{;R{JaR9KzuF(Bcv_mgSY~F<r{I+4HQaHihv#-!2qqe7pU>r{G
zA~V$HEwv9KsFI<BgXRROG55Y#kB<o|gBtf7NjaOOf23BHH>KPAv&Coi?1uj^HV_0h
zo7Q6*(EW?|$vRYdZj-eZ9Tl@SnoTClGP!X({uAYVY97$iw=@s}2UJ#u-lP1?=mRo~
z)^!2VtZ}$%ux+H@21JPi0b<_X+@#OFcTV5%p=+)C7hj$g9AK~nkt!>6fsg3x;nhw~
zvSu{KlxG8}53Z1|Apa=3rMWxS|JgI~zs;V+5Nr?{t^yjK)YC+U)kd8SWB=k5&lT@*
zlA1wdxv`Y8jvmI`Z5~8-)H7bbzmt*IKu;p!#=~*g1AGoAU<dmvvehR~uEm5DOb6w7
zN`jlwtg8ikQU^T?wq2kF7tU+DUAa$<Ee*k<vs{=YgyI}MF!?0D@1EvylnN#*p;Jc&
z?!_5ZB2P6kjO#Es&(=8!X1}+Ej1~&>p#QKAq3yH2Po8Y!9?=4vMS#MQU_jYd7;d!$
zK=*E~?(j19C)p8%fI1URkYXz4OoyWuLo*RIs&HJ--`u8mU!A0_=wNZyx>75<ME*eB
zJUbcuTM<a%AlQUYBVZV_f=!ugHo#ZFgM0;SU#27!qJo38RDzPMCU4b^UNf<hq&K!<
z)R930v0ygfq~I#a=!*2Ua=XSG&)<kWZn0kA$%ltSu309pc~gqKQ7;#6&YnHMw7j&S
zK%h{)5H@O3rh_EjiGY<FZ=5HxJnB*qt<+Rq*#>L;3U)2t<6UR83b{MpmFD4{ZI7{K
zy-EyTc(N6;zGqK1>HXVdICRS{iJU=+C*GITj({LzFRvF!b@i_UpD|}o*bmA+(r?6R
z#-6(m2)xWl+UaQ4=Qz3{T})}5aOGKR*w$mz&md=@cPpigI2&u}c(!hz0AYe0C5Us-
zNSWtv+$f-$@@zuQUu!Jbt~D(^q2fM1tNL|sRdQU?@*DhONb@F?lci@hsvF#_Ez{zO
zq{(iGj@WcsXc3TR9Spb0&3XJup_`F9!8GPx5)Ztq)eti~#mxOYrl4OGwF`A&W4J_1
zC(0pe$@7^~;U1z3AAS~-#r<O4<i3oZ7<b;tb!JBraRAk*??EuqpwBHc0fP;1IAs>b
zPpbM5FM7h66jlzvnDD4L-6q!~n3Xd!e@QS{FYPeq64et~p8L9XgPR&DX2Ysdqu|2C
zjB1`UG-oG$(h$#D!}<yhx%9;0DKd=vQzvS)obqJ&LcK4uwH?)a6Dj_>Gy!5RJoIvv
zGZ8@_<%P*tnqFO3I!rRkvlZLtG3!{49z3W<ON5QrjpU@L4_#et^iKF(mcJWZEY?(H
z(OrQQ8ts!s7=~@-S^?2*nY?$@50b2^0`rufv#WKX>;q9y^zft@olIFb`)?HVvXaKC
z_W;J{VQ(l8r)njSq=UlnO*KOFOtP(HtVAx!d(XoM$E*~eMEdE*%Z#Ey697&?vA>zw
zKV*rmq_Sq!A2m=?$|Oae`IKao`TbL_xv13yW@zq{)XcZSH7&$tIoznVyQLu0hLv^A
zVpn45poXKIkE35Y#(3RgKpV%Dl|gW>HyhW4*k9{#iVSBg1kKHITvFi<qc1H*>aX!W
zce~!wXQlhZ%1mJvVl-#Q?&N;1?Hb0QNgJwbQM<wcNEpDAn~DBWoaZ~v(y(hJRi$};
zxpt=PjYd={txQshf#4#7OzBZ1WaMP&>Wx$zjQ8QgV20r+%~RLal+o25!l_<4kQ!!b
ziM4DoX*KVc-k((-ZpcG2OgBlvf~nLId>=<a;3DHx_3M#DjU>c+1!Dvy&cu@7bG0M@
z_2p#1EdW!V@#pe_YUuRhi9cXS-SfJp*E)U-nJpkT#RJM#%-*N6!C4wlEX3R>-p^LU
zNVDxT0U+5V>qDYp(wJLRQtpARw2syqJ!>3`TLP%?Ym!2;PvDdi=<*&wVhB2iOmqSv
zD3aF_L}~6l0*WJ4m5tsjXXOGBo<=_h0X{)oZkkXAEA@{oLN3t^_3dVI%gMD+v|GjC
z{`J3L`?jW~magwmYmnn9J;TLK1*WMla$|yq+Hv4v?kz3zPvnWx`h=k6XdOF^!Jf?e
zSxSJi)M)M-dNacDUB_W$Y&U_vGWW@|XN2+czEO+F3%|%sgwju(GuA8#r<7%3d>FU~
zmA1-UFdjW=c1!apMs@OhD&W9IqytZZ)jgN?^i!tPj#A8Uu~LH-2a_X!i+npCGlDa)
zs-xA}aXLU7b89+s2YEx;U8|^1<3H5w=Z<nVkyJ*gtx;oY-A6;=nL>G8ID@i?YUM+o
z%(lW<mdmvjBIs2?rJ#32E(&|QkRgNg()Xt3lbV-#7~#5}l@(xsq~;&b!w45fiW`<0
zU1v&e58z-dvO{`5;0~Ha&*$`7cBT<g#v>HOatnC399)cDV=#eGCX*-_glGw{q=si1
zV&EqrzPLyA?<KO)P6`rDlk)JoNsx@>hAKDh0@!q!(vDGR+v0VjW6}ZamBAP+UPRQ^
z$xvP`Jt<(y^UP)x877moPl5?+O~cldf@xGeijfg&_QkmruGs*Ezk)$`9T1>k%|UQ?
zkqsYf!Mk0@A~YD#JY;cFy~2sgk%r&Ntk2V>hDyV93sLH<b0H}lL|H4-jO!dAD&Fr#
z5fYe@_G~$)cO$#S5$_M9#?-fJ1|OC6zn*&*UwnH{_S|W$mhB=3W`h`b4sdFn^<E6p
zO6uU~+|l^IJ383X(9Y7$t|_z9IDfoj-s}Bcr)=UXf~{79z#bGyKnQZPU0K%X*gJDU
z(#qp*I_s#akIL;geC~!(HV>Twl4Gvjb<`?z04+s`Tn`emKtHGYpO`ln-zoKLzh`s&
z((56Y>>~oQnf{{6P_ud+3)jkdKhWOmur<fd16--C!I0E+c6yFrzKI}`q>Qs&x+eMR
zII5)r2>123t0~uxTyxlZ2VH!&Gqqawq?P?0R99o4oM*p#$W)gp)<CqqWXDWcg6Ks!
zM21OIwNzwaDHoRW6Osm<p5DNPr_C?2PGFj>c!W)%Sz~jx_0;ClEhT)1bUO>%R^UMD
z`ONbhRU@kuP%TAmkG-PyoID&?eYp@cm`J^JWAo^2kbNQT$ZStEYfiAKo2b<f_UpcO
z{WfVXKR9JAKUgXj(w=f-T9$Uwo-Fgm%mTOSvxpi96m-&k6fb70ZlEV7##mK-NyVTv
znH*JYUKkCMzyp>kDvWJRmV|=V4)YLo3K(vUq+u%cv7|Zcw3Vg;D~&I`X~^n&^_kfy
zw8|)IAMULBU6xtPEZO-{GaID8W#(KrTI#1rZv5RUS}!yzpqQ=S1^pE=y2Lu0N={f!
zfFeq`pkG-QLToRvV$$Pf<vt*h@QXrIa@&9~WUPupb)8EcZP~cXU1SGQQEN5kvEhLx
zhr!G>clbMlQXh6@jSEdBrgte*`m5UN1R}JKxud@^#rKpC4DRA#A8_chmUA<l=g1oc
zdPQUe2<+z44YU-XITdcQ&9YaS0g8cFO_GxW^h?cTvV7DfTO<QoHYt;0tl7kd)#PH^
z7{_LXds^J{=>P_|N^o-*h74#}uo=-YkZCum9)Ol&nY;K^M=DJpS6M7agBn{pIe^oA
zvv?K;hr*a_GR?n`YPPApYFkLThi7&pyLyZm)iGP7Rt@?&_)~crBQ?5NTL`#dU{7C8
z7d<-8M{T1p46cz3IT#eFrAWC(W!P5Z%rhjfMou|<4>e_U$dD{hKg!`-+A7VKa)Oq_
zJS&VY?@y$k**|M1R0{^x@MJ))+!%~N^&m~YT7iaomT~}5R#tu|Bd;}__Uw$MwlFVe
zgLlWiAG6$-Xzp3^tWefudc7wKnDxApxbvW3LA_9eZPr{~nwgUVXzi3-+ipZ8Yb5(b
zfD6PqiJ(!uR=<FF#dj^*j8s%6F>v(i!m1&c&lXE}Dy{pN<?cjUEBv0+f0U)=Gy-V!
zv$}b^G65qqLiNs2&!HC1&yQAD;j<Q5yqEwQmhw)AWzPMTRwg2llt{MV{ZT<N8K8q?
zkCTF<&}Su@dbT5)F7}+Wn5pfW`=@tmb)vR5bsnMxdajp2r$ug8k$^<zJ4k6ME2Siz
z*>jd3^Ild!J-bz?uCf$gS>zTAZ+o5{$WxiNP`&AOPdI0ccd=9=G^i=L`o})nzAY_>
zEXUDErr+`}DnxP^FCAwZJ(9B6s^xt6LSQ*)sGG(ZEE$XI<bGLJUvS!vQ_uuYrkhfD
z<|Rnr*K}fwj8Ad|Nr&5dhY&L~i%4VP%iN`%)fU8o9(CwQc~LL0T0*Hv(Ainao$;nz
zv{~V!u52(=kQV$@3KF@f9H?(0sp&&m+N$+tkOMERxzH9i*1O(@p)PF9dZ`^`gEN>3
zS^2Tt`!?om<2>20R+p6A^$IXviDnMguq&0m7b=L?nrLhT4m2=iyT@jd=xOEqoQ63w
z>x$e%WN9Eqwe<aEmRKRk)zfHa_t?!=K~VE%j=WgI!`TpyjFaB=l&+!FmTpwOIHEGw
z$*P>eN@<10_EYcPmZE$;5<;pUwc$!?Z7JW2#w?^VLz*df{!e)@UXfKSMjzx<Xzf<(
zRbsH|MH)yEELmvs^k5u3wLgq5PD*3llMl_9?C@o{d((sUr)ownGQ@R(bJFWQB?0Qm
zu#<$1OAki%6nR5vQdba!TPj-R`J`be#czTd*A|-$kz1J6MofKMqxV3k3AFCDDraYH
za!8#US0%kvc-l9yf@FR!j=ylflqmMIdu~`yS_L-iwTMTWbgUMO^0lb7N9>FlK6kcF
z7VqYMH|a~AW-9XJUMrw1SC%^?SXoj>l=fnl8p{D!SsNA=g}p9K&(Fc{d31C0_*&bv
z5ZuP2NU}>jERX&1D5Tj_d`s7j1$E|NfHO(3b=ddL8j>fR^U-|{PzkoWtoEbP8MQMM
zi8iN{M=|C5%`=`*)nMN_P_*M9h+fvtTBMp!T`0>-U08`lR?(n_Efp2%OIknxD6Pt1
zmj+_u99d6ly|aVI`Z7Kymouo}7Fi^M5hm=t_HsWduSGV2WtoMLMapxXU3S07&nSm6
zd5^_CK3RK+De#}?`OOY6^WUr9HGiq``y%san?GdPx!FBfa%e{LbbM0QtevKuEj#Go
zJue$irIyTC<&jm~!ypy^$sf{ImiK5iORCK9RU;;u)S2^*j%pOPffnY?%`#6*k(#l7
zMTmp-wJ=b_Y^}J{*-RJ7EtNoerD_z{3quNRS-e(I=a6_bb$nhwi44Mh0GYAj7P(`b
z7b5s6H&GWF+k3&p9W^MMoCf`@sw(*)FY{OcWsNw~vdA;IlHe{k+Zo^P^Twkwkr50i
zhih0~6xWN9c}JsGz0f9$8sIRiIhrx!+AKu!lj-$1Zk)!Pd!nehNis{iiXKzK&ZAx<
zR_CdI{X9}NPlh#te5B_$ySE`_V`|MWGbvrKVB-vqjI&yYd!8n3aHiF2+A=>oc`OKZ
z7R}KSabwP79-Ki;QZg8%LJw07`s{e=zsea`pPN4Aux9H??&0kM2^3|9ppqJ&SFN*H
z$N@O<InNv7U}<be9);mRWl}WEd!aTsXI)2FYl!9wvS|Dsxd&nPb!L=`U0UmR550%r
zsik7J+PP%IDrfxXvn7r0=*vo0&eu__EMcSCr(^ptN`8;a#zwE7x?Df-2$U*k!V9%B
zIGdOX4^tdreGM6!no~aDj>a$bGKGEWftp`u$-p^NGF&L#Z(Ag1;B%GbgtD9yl5H4Z
zsNSt-phy5#%EN;uVl%p;Gatf6U(T_}#>kpIZDnJ5F<x!u(MD>^$SoNXdzq{tBgR>t
ziAI}1l^Kr=yd-J{`sLj7f4qA)PUJ+fu$CcgQ)Mp6;<u)J*RFBSxn*VWFI3coU<Fnl
z{Q{{8jm$YKF0|PJ@*Wqp$u$?qx5(`^++UZoBh}fn79r2AsTmq>YGoZcoY@K;gY;DW
zylN@9)X>TcY+A~(OErB}sotz$O(l`uQgq00B{y_ypUXDSI-5~mm9!f7iqLJUETW(u
zF1^=AEJ|vbi_G>UXt+qPsoe-in5ptY*9bB|$>PrrS=5-iSSuBxWVQcX?8L6BbkG>B
zxybUNkc1;40l}$QOEklmqakPZh}h_tnj#sVkT5&iYvu!{Jmp;V-N|;LF`15iM#v7s
zmjD!kWA$AhU%p-B$dE(PN5R75wPDFE#e}LF&upRoG*^DHI4H%clgBeOS@mG9FS1bH
zEEqdM2&26;HzTSqBe9tn${6&<V@EC;b1BO?QD6ioK0X}M^|Nbj4kDooET)FWECfkc
zx&&QI4^}I4w?&r;2HX=)ROOmn$W;U_iJ2yhYVTgCG-nB&Sz|cVXs7zzB;nycGy9Zn
zhQVjTa;q`dN%y9dI7<taMhS&cL*fu`Br6WIISV1XLfBZDnaCnGP(yEaowFAkDiwKg
zU`>{%=|}e&b^c7Aqt-w^M<{Y)lZPhqTwwLA9ekBhaBiiIQs$y=$+!`iL3t#D=TFVr
zC>IgfB2##Q6;^@U_hqfMBVr_~tS?dV>|P?+Ol@TfJw1CLe74rJh#l1#US?gaY+vfR
z6_t@1<~d=Pd0U2?ocgtuWri4Y55$9kT5`H43;pta=d*x3{SN93o8`ip(cnOA-DK7J
z$qd4}a>u{cduhT1vP-Ns69lYgP0x=N=v}-{a$L}NpKLw9Ok*bspAiXz5>O@A01cg1
z8jX%iESi;i{JPE&x3Otw&wUn}cJJ#XJ<Wb}FD1mBDX&jic#c^uMG*%VRc#3C6gAO8
zI(P2<NrHrvj2i7qynl2MhuqW)yHgG0lSf?4g$?PVcA%j8gfRo5Ce)5BeC_=$;a|{?
z${>x-V(p)Uokn&Egj!1IdJ^={T^|Ep8goBaMc+`QsaKK7OL&)dnPrnBa5vk#vY6Bp
zs=6lDsIZbrU3e_UJQ?N$qEzl42l&8PqI{+~1FF|dCX7%6vVNwsF9jTwHzcBv6<v!d
zLy;!M(15HKlHLvmG2tl(5mJvKE1fTEQY(15j+)N<cSi|R^AvpdQi>57D6gzKL!C?{
zAQ;n1!`#e^P0aXOmPe|@luTkS8y0M{HsldPloWfMHFNi5m6RngDa0}C69FC6+b7GQ
zUnWA-c?y6jCP_?04gRe&Bs+V}rK?yN&8l;c)*)xb1m=_hYC(;&*0$07z|uXKFhloy
zl@H|P=gGnm87*q_w2h0lq*U&|J8E1Q-jr#WMXnRo8tohoDezTk#f^jO76!ZJRq^CR
z()3Q;ES*8AftH9v2HJXSf=*^@bK%`dPEM+cmGZcwMx2ipf6W-J(7)uAbG>xrS7q%#
zjhY_)Gei$;UePdfL$sPlXJ-gyhHNf^u<F@J&bCw+!|5n2xd^8gx%fY*aSxRYq)}i|
zp3W8wRn1J2NNxaS&MV{tHgT&UpiWPr{nAI)&d#=S@u!lwY3(SE4U2&9g2=E)8=P<x
zj;ysL(>QuwS-V_XdoXs_%`yw9G7VW8M~;M*5f)Zy_9S7?iV|MW7!rsxlclkUbeqP}
z@04p2^kJzxe=)v>&`$B(u!yd=)`-M0qgb)5T~m8{y-W|MIep;CA_AOA_q58jA$m4^
zzGgM5lCkl7jFh0yNAfdl)Lc9VVv^HqGlZyycGqIabzJ=S)L*i0vOtY^NMFLr6_gaS
zqxf7i_29aTUf*bzYI4)?({-ad%TW|4A0&daM)Fq9#+K`i#-JZ|XK6g{4x{S_b(Xp*
zUBBZT;vA=`@}vT^^2ok3w3zb2pL4qbft{e*{w#-ewW*YOHkawKgN>hR$+h1dkf)Rn
zs5L4B9z}Q&+g8lm!p+ig%HMptPOly&)sGeZhf#;51UU+MAF@-TbJe^W5BpQ2`RqZL
zr}Lb%*$i_Mhzxx$=vP`#NIa6!f}TIxXwCVYapQa@3_8k`A{unIF;YcX*pQBck()(i
ztJEDA($<44QmghvJyF?qW!4!@-vmgz4(dD&=#8Y%#_psuqp>m~kR=6}IH?2Vv9eLq
za$lH;BSs!sk1IZgFMC7eZJwN98zWFy`(6D*r5)O$axF~r>&V3N$P?AMjLTYgG4~7d
zCuC_fl)v2dB9TdVi28Ns>|Z3f(m^86*yMgajVU>GYBa{K(zDs?UCcSSEyZZu_ugx5
zS?0;!CVNz6nOVCgz9BI;=Ng{%5=S9gZRxB>oQFAO2t4-F<XY-wS^-Fp^&N}Xit;#T
z`r}ru2V`P97*Yi~L7NYKbwf^gL`2E9TZ%8qlL5}a^VIuhtA%KuL9YEto-C7?G#Aaa
z7Gy!XJkO}eDO)Y6nJ&W1Md2c+@p0pzqiRwZwQbriR~i<!zVgsGy-0esw(GRrtQAFJ
z97Ve<AVGxjpCYQ-UP+e>;sNZW1N}A-6Eql3T$uD^vyuav!g$b2aeq8##pX)ch8T!>
z))NokuC|^BG`lyf&O(&sg^u4j>Z9oxQV9?c5CB5Cec$KVOCIw<8ooOmv>uxVN;WLJ
zPEF8ai4k!#Jr>F>a4WqP624st4p}Xhsfm~IB(PBAjHr{K3s??TP99=0`@)DX>LZ`~
z;(eAn@-$<Kk;c8Fmxk70F<OLIFZy_tQG_`}!>gd&$xdrd+4<`|c>DwocX#Mq1RgYN
zSH|=l8~&_4PH)Fq>%#^no4oW9LAht9lN1MNKt;YNB1@><bC>iUlufs}@t5LC?J*$F
zo|uX&$*ist3k+R1=+{E3CeH@~;<~>zeW@Hh?e)z!HtFdNQ>}YtF%zsi`oY4%UT<q<
za-(LHm4Y%}ymv}>@fo*wopst^Y64Bfd*8;tpRa&IJEaCsBrnBU6cODwnt#;wCm9nD
z+e608BLLd)xDThuoVN?X=$g!`&qiItMRbflw0#aNZ4iTM4i2!CP0m(PXD}wcfNiYJ
zn>S^^<a7Lk>c%977uh#iz?AE5w^5V%!i$59&Su@ZF(2m<P7=romf|v?7GVCRrZZe>
z5Wv@+#=es=s6iL)J7wRfJfyVmN|9Hb1=M1@vYzZa<jd$+V(-IZy*ms-9H1)$4Y97r
z)6qjrfxrgOd?Fy)VyKdpVdx=~Toz5XG@LJ`Qz7Ucx-<b9T7bYnV)Du($ImR>h<nwz
zhKtC-(Qt_sHqM@iuwZa(Y&Y(g;hkkci%5~~58<Taeh>|Ywoh;MFx3iNaE|H^N>;Jg
zEG!tJ8AipiTN^Y2tylwOy6A<X6#=Nb%hGsY8}#;(Jwv#{K)>1z9xgf<z9-v84B+M_
zg1q>mhY0X?@iRAZ-s#7J@I!#Z7#f5J&=)PE{D4Bxl^U8+LJ1plG;%^h0qgE6o^_*P
zrSX}&gP43ma6BSe!L798VOT<Li|3|^+#=qMV0-B*(ia!|?%h}Wbf3v)b26-4)6Q`)
zXW=1A9!K@vxu38foM|niHoA$ra+B-4Q)ZjfCPg4Z9~ZJt@}r<$B9o}FrGOSmt1j+g
z&z!BRO`L_WnWfcDG;%5aZbLiAwo#Ads&ZgieJ89!hJ+1<rk2ta!wH;li8g*rC54t=
zT9#?ZBb7;O9!`uj7d=dirBuDN2&zaGC=Z`IMb`Y@LpYwM9MT(+Syb~`8i5q;)u4>S
zY#q%4SJ8Q2jwfXi)WOOsH!zZ}k6A4|c_C2h5O@<C@%GhDI&2<UpGS`5`COH>yoRiH
zybL3^*XP{aJWHNzH9HDShA-)#A}agf^VoO?<eDaBOGGK6=8G{@2tjDaPT$Wo*K_>t
zyYD|}2pkdBgQgUFN-dicmJlxs?KBP)T5a2n)xytt{tlT#%6&PkAv$DjhMkT_M@Q<>
zD2)G4vta`q%5qifX^0RHhyL|O*j%q|U_1Bhty>E!^9*flz>~7&-YV6(R#_>xX)W(0
zZ8<}G$1x5PqOR$nXmk<pbstU?Lq~lIWs8@0o(OOzV;8Jx1ODCv5H#?eGZ!FTT8gf3
zmde&p&Nv@{E<ByEm-;*u<3jsDz%$QmQe(P}XIzJY*kCm0%j~McSu6N@M7S>=2CY}K
zdLj{A&;rf~P$y0iqYhPB+HLWBt60PCcyN|Cy7ois15!lPFNa*z@1-1rz8$IqMS9~|
z70+!sFd6l+5E?=3t?Af<2eC?x0wX-uo>8SyAz=COce8u;Ft9YRqcyi&U!_;~9=2Le
zd8i_-25|-z@O92efo)!eGkAVesCMGvmyH_Osik53$T%%JT#D&-I-HaVJ{&#EjJnJ5
z(5Z3xjoACh6y5Dy`$7lQ@7N<bl+BlpuFsPrc8nW!tKB|~^mZBloig!b6#P_c_FTZs
zy(e&2xi)=ZT~ZV0auEEfz`8Vx4~I=F!c92-n^==ZOp#++s?ULm37tM?8wdt6NiznM
z{0~T4>`GX^r^seX!KG7%*EN1;G?F8EI^bMn+m2Aa7b1KC<x1&&aQ_l#t&><orPcuS
zUHRP&5bm7G7Z7K{j@`$;K%VL<GF0y9`KFa!g~&7Ic9S_vWnJj%Navw`v5x!0F)ivG
zSYuzqu^m)P!wy^Az?5`PCcdIQW^_=@XI?GV%3gYuG-i{po<3Py;5T_1H9=9T%GYA*
zY7Ht~vz;nuLEUI1j%PY#0RysdvAhe{zd*fko`e`pCcceBr+f8ObgR7sRcexX-2cP<
z&MaOS)d3l{WgbRaSgd)cru#zWm9uni2b44Fw~2m;q*odtJ?0*qDZTalnIc&Z)iTpO
zlM3q1>rvhqIx-sc`lPhZf#}@TPvilOUGhhZQo3|RaogAoXry_(#af-vI7a%qMC&Ab
zK@x{vrZ9|${U|x1JEWjubBag;HbW%YT^a!`G^wga7%Dcmblhr7HZ}6}#?sN^Ba)gU
zi$L*v(hQ<e8<cmoDD1%KO_Fj$T`EGo?dGgv@6>iGF49vTo(D|f!Fq^dR_Z0ffU5l|
z&%V)U14X`-BwwzwgpbC&pHbx4n$@M=w^D+*INtry&8gQ*XRb{|TSVAOsb{|fjYm*c
zc@~>WaMO&6g6oN7zzFp+%UNGBxJX*p4l`EmSx$YqyrN$?EjMOoj-6SVrIT(QV6vV2
z!0FZcu&u3>z(@x{pqXx+%u0N7Tje=x5xDGA?ys6OU{FlOli63Ba6B*WM;Uz%#wK7(
zasZ3F4rcQK_YD^X5=(M5WPWOK2xle6+oY&jjLpFV1B=oM+{#DdVA1qTK)`5uCSIHD
zW4H*TLx!wF9Ttvp4)l@%X91Nz+;?u5z&OP_*o0vQ65E~40IPfV_IRjeuTdbW%)+c9
zyo_2GB7i4XPtwZ>aO&C$G|K2)#L2a>DYulA5@^2NcZ%#eYU~$5@U_``WT_f_8f#CM
zuKM6alxirh%7le9WyV;QRNp$qxuAA;6AlTP9;DY$6M3?+T+-eBl->(RvQVvZ5-M{D
ztWI)B*n_p}fa74bk8(0I`TDAHGxbnvonvFFN6~$nh2A@L?6opzvawo@Relq}>6Ool
zhGZ5dQOu*Ivw-MU5k#&c04^4_GCG3Y9zw^M6=x=^oDl4;Bg-EdPKX)<!x0y?+ezfi
z?QmJIo0Tc~*b?3!8N?n2Zt|pQk-sIGgaqC)oaM>tGpLQI1k+2UWy~}th(sd7!~?*(
zUWd~ex|1CHLe0FbdM$x5+uTB;9#b^=FwhW#uCE1~OUF`7(@7H%_&Uk&MUZ#%<VvUo
zSv#ng=A$Lg{u0zl<MV748X)a@>hvtV#KLPeb&p6uO{MDMy#$M6o#pVWblo}|dv$k+
z0DCD2R8!<B^FYjETcJ{vg}IqAxXCnp$#<CwY+cndw-jON!!A8V6$I$B$fc-;`m)au
z0V*~|tqO%}`>@=@akX!ov1LOuW{s-xJS&~AOZQT+$QOxxck{c5NxFxw7m5A3JGqAj
zVa3tow5!I7#xR>O1weocjQi+*0<qFYi^8(-M3z-%^mT)=V?6ft6F1pjvMd!=DGs+*
zQfIi~Ed9aOIO=S@Gk?ycx(J(4G}X8#vYtNf8^O||y1-S*BhGo%wZ~~Q+J4=xwD6#1
z$_f`N_qGv<sZq+=3nN*$$zsgo#`{4F4$tD@Y<)9Cb2*%3qU+lIV`a{2i6$2d&#{6Y
z%@`2Y78s$(1>co2f>9e5*_LfU4(E*3YyMa+hI-ymB{+!<-xhW{D2S^kNsX-@J2K5K
zy)r_E-mO9RXVw`qKUY^6kXg)2dcEet1{O!jGvDnp#hq^b+L01Zv64clCr6{ThCzIS
zh^C6QvP6pXRP?W`=cd{1x#yydjJ#A2TT*nc8A2t7td_I!m~RAhDl3D>KTlRZ+;i^J
zQb#|vBQ-HrnQDL17!2T~RwB$8RI9<mKovFKct#l4$oAK*XNHw-6Tw;0-!#px^-bz)
z7+qtLQb|(HiM3f|O8b~)huEiGRyH6TGx27UJl0%#51Ue8I9_BDk)jM=ud}i2bAOy5
z>%tS5Ro~5%hJmGtVsWasfpdyA#|V<jEV!aJTk~qWP`1nZab{?DfT4DpJhq0K?}>Au
zdaP@@lDt}5$wbuk-Vii<i8UzZ3j#1nVMXc=5Ox%-c*F*KNQ}kFV~1doiK305E_;CH
zek9^(ke{r}M?h5NHVW3_Hk@a>*?7{i#A%&Xh|QT9jG9dbIUzoibz@?}+|9X%%5XXc
za=Ww>DQ7$2Wo<?%(LN9#nN$+wW{pbzzLuWlD9HZmdLvmRKEq>qr#$i4bH`BZC-fAQ
zR!q6ZJW0rzsSL=cDbOz5S4z-NkiS3nvO~bK?WMl1nrD&astPIVJkYNQiV#85Eh9)W
zHGY^KjFZ)|O$owrN>X!=KYy~_XnfD%oV84ok%3F?3MVRYhS@<7dW;BrukvUiL6btX
z8tsErxNTvpT2=fN5Pz<Pz3#~1|0`X4qgCVv9sy|3)i&1q<d%}zBcp~~2g^(|E8_DV
z-~Dy#x22RZ`X!3gR2G_{;u%MgW*5FeVYam=c~+8cnLUq+k<(49lv75lGU=kdbXm`)
zb~-bflv!B;V^CC4<O3+OKvtD+O<EDGaL$n<nu&}raI>p5+s53N)s(gA&!pg_qw)E`
zYJ+fl7nfz83->TcnJSFSLu@w0Zr_iZ5r(3LYAeD=C)VVa+E*;58ZIMx1}3p6n;|o$
z)Rk45MZm~(@ax7+q{pnChpIeTA&jYc_Aosuw)bX|!4jh;2LvT}v$6o_%B*G)2*?zz
zmDXs@>dO5*haN=$Ga#qZ1K42rz&;ewPTO%3Ts9SX!suv2B7g?RrUj{`767h2PyR<T
zMx94dw+q*>G~R{v?+Zok6xyXi67L*ZtzaFgeB=yfR>{kZFa%>8(|ASw&uZl&S@a&w
z-U0XEgyp=glnt@5pRN4SPj12$IcDrN9)j6c>#WB&*H-Rm<~dLGu5~{Lvf8*GVvV7*
zX8Weil<20)%v!T~T1EGU?{M0%X*tAcoHB#6Rt8sR))TD5RfTrspbX$LB9Sw}$P-{+
zm|?0vPL}^tht!<MSz!F)0Mk}+&duhk&q`(9gE`3{kbUCpRSQSGg0*L}^eoI<YF5*^
zH}eZ+ZZ-TzeTF@U!{ocgRMvbt>*FDJMA05duc-U<dcb2bX9(Z$qGhd2ci-GB-B1eY
z0R)0F!dT|O#BCD5L)}#SGXf<r87|YYGvsy|{)h%1nFPU{N+JZ4dCGvr13X`ga>M<}
zG;q)e_8f+kHFm&Ms}=<jMcS&BI>F@xio$h0Q_<(#-0o?~k|UzZH``bed{DRLbJ;5(
z99LnswzU=}e%=$?VG`cop9D=V)+^PNXOYAzEB@rBUzpT5q*XwRcOXCQLgWd~tcVYj
zo2FG0%?J%!4wQ)BUpKR*stT*i7{w?wVWQzoGz`6LB}fgjBRf)?;V1GF0tlJ{UZ{Qs
zER2BgPG~~y_7EWUtOmn7Py&L;H!SkX0i%Nr2gXgH5fYV{9B}b|HfqQWM_Qo<a~7Ml
z&J1PwtTN9Dn;jgZe~P^Y@e-6@`^<6{0YclxnP`(mBRH_tcYl2Gw)%PIDa#PmGGuHH
zH336S41?EYihPj`qqC!w+@LuLGrj}z!)cX<WKdv6X<Tp%qe?WQWRzSBrieoJA|hXU
zHIPwJN4BQl)*coa#X1zL7pp75KvPyl2j7PQ$ALW_t*=%T&b}^epv%xX4#Z-$78QD3
zoBnz1tm=Mqb0x#d2$hE@f&(2q4LFTxsGB@A?xHQn!Gw-WG$0I?ja*S6Z}rkWJ=M*C
zS8;HT9EjM+LvCJv63`{e>WWaOLPD#XwiNM!qA&eCXM^KmfbDb(iP*;XH%mu(ZJGOO
zeDK7^lF{@Gu6^erZDb25y7$LHu)+tQKh>Y@b&x%2S`1M&karr!M-wH3?G}wkiSS<7
ze>A*`eMRAa<!P|H-C6YrAOmIHvuVu~c?l-SLf2uWkaD4G9$6^04`|j?n@2$8u^N$S
zz($1PfUFV31~&h-bOCEk9i9ZMIAhd^bb3`<H!~6?!agG_Qa_q(k?Gy+DL2c{>N%S<
zxjWYPW)tsx$W5$qPmD9cSk4~Qr`C^@RUjgR8j>mFWSNJfYc^yyKwqE_MEp2IGRN~g
zh^(@y9dVx~2V_fSJ5zcUYkeQk_o^_J9_A_#9N%@fvsg6b6<}4(Fq(blsG(@?md~x$
zSPk~Ao0BhN%|RQe4Qu{fIe1J<)2N3?4wIIHv9{_5^{IL(D!*#Jv5%jwAf9;OY75c;
z=*QlloLPGExq~5$jMVNitRv^qP4mcPp`O4qt?Nx9*Py<MtPtn{FfVpS!q8-yv1e&=
zWzH8ThRpFg;4y+)AX+XAHijE%D4Z$~`cmbHUXUV&4d_xmjXC2ckYjyr)^2{r9k&&*
z?xc|*K!zgHmmW^Z8K;ks+P4IYE1$Plu`ijwx2)Y_!X6NVj!6Zv=Xw7RGQ6IvM;XEs
zH!MERJ|pmgRI*Srd7=Gl@>o(3KIFNC*g%@eL4Te+S!!AZh!JHL^_^1ZXKq-Taxa@R
zZTiF5rwB`P9;gwEw8p^FY`+jy=2;1l5Z65&21#mh-XN@Xd87(XQCfr`U&?+*1zpsZ
zQ85CosIqn}kRB~mMQ#@`Fywj{YV#skPL(n+iL_g8#^enGo>&9M3W1b$@i}CpMeaoI
zN7pCtL(DQ<hE1tJy8y_(<D>1{>VD46kIEeIoKWF&b89Caf2Bxnm_032xmj^(iVZkN
z>J47lr0gxzVvF1jp6R1X8Krz|c!`>j)!&`<)wyv`jcbz0akCo-SujK%;m$~Bt82H~
zz{Bj~?s;$@4iPXLsn2yBiR@}>?PLMU+O-yC6}f4bx&ww@tg*_*TKa%pegU~hOy!Bf
z<dj*>wJt{IZcIT+G-?Zi<@xfxxgukdh%-?l@7(F0JR)J9tR1LGR`0=UDLuvB5u!e>
zu!;iD&CAwA;@MsIQkVu8uB~8zBo$GQit#BcPUJeK6c6${ZFBFJlrb8^YHT!mnzU(q
zvmwh|e1<(FT~gG;OQ-hbl;;Jh+0dgIFksrG;wVF9_IL)X6wE5}E8v)Is3D$Q#E?gI
zLPpjC)}JF-&2OVo6r~brFD1cZz+;foQkh4H&z9Oz!J7a~fk-&YIJi@H5&=RoK9iNa
zl~_s{$WU5U8_JtYlZ8B^DAzvHDD0hjry7Z;**$TU5d&m$2+|<*jCoD_+0IG~H1sGl
z$*0IQ38G)Cfw(U5rRLaLwGz%2L5pize&24d%PIsQA$bb<l=~}Z)kPM9Hr=n|`e|{2
zA*o#toq{!@Ysf?l*Cf~iH3!<G_eMs$ut30OZ6z24U^yEBNT>!aQWY(txt_Qbd4y;2
zD3J5fh7<D51v<LS?6cVHq$Xm5s$upR3(K6%SyjYJ9Y96HWcjuQ>@?soDBy*aE>zFS
zT6?uv(sNdQ>7{s%yqM-vjUG1-6bS?_iMqlJL-k^f7CT6_)qkjIy;e4n6Pe7$l}(7f
zMG#b3QVdlY%z=oI$-%gZ3AxGs(hi41?JbVX-MDWrH$128lo$aLnT@nt3loltEDEkM
zJ%uwX^|b=??oOHHHmkmA=(sUcJh{1FZAk>-$rOH%`>{&CXzsP&ktZ!A2R|Z;o#k{~
zGAb4D5R41H%QNUCj*IF~z|Kvwo}%iS<pu5Yna~B9B(hY>2y-sE$j*{=;y&;hh4<@4
zOhRJX-|^Aq+n3bsOPeXl(9W;nJr~J}+J#F|A#rB4%&;)zb5<&b1tXoq!jxV?9#EsR
z0)ToPL|@N6HpvPRYSJt6Sm@a*9qMVOcV|3nbOpvqtgMJ8z@8_m0n}<ZRZmmOx_8MV
z7&J(d&!p~lG18O!VkGY}WG^s!7wKQZ*4=|M7f#txi6)y!atg(lG!mygH>fmoOp{XG
z&28laX#2BkTW}XHn67}vxyU_jv)~*u3{qi?jcR#Be0mMjYXhZ*#=@KX0y9ZDVam$=
zWo}k2+-pKsAlf}7mZ`}7YO-)LFtetsx{zGu9zB?$i-l#j`qAC=RcVK&0|%r9G>6<(
zWkKIE%fyVr=rcS~Smk37X{E{#vU}?oBhx5?YyESXT8pC?<$PP|&&hdVz=2IGI}NMD
zJD{+Ve9D9&M!2{J*Va}|pQbs#3$NJ~y-St%A@7QzslwZn`=7eOV#0iWHyK}V6>zy9
zhUmIZS>JNL2sRt8l?p%>Uk04$MiV(CfiqjChCRYNX5cC7Jt)tdRBO`E%elyE2R5ih
zR(Sy~I*%sN(4$yL?#xm2l>E7(o>!icbP5L{RsGr2XPi&38t;@W?~|QuUF4v2kXnZ+
z`!tSP=1VNP$<4N!t^yofTes4EPex(Deywh9cv(sb5*Ox7O<5GyP%)^>W@&)|S(Vaf
z_N1D)d*^tzvt~%;nr$jxD?fCZ$%wO<M`tiN5PttGGNhZ&391x050(jHy~*~<%Jo1I
zb_xf@d=?G{7Mvx{9F&Zmr<_w$o94^VAlF}I+>;rc*hezzn}zGEn#@z!roKi<B#~Dt
z3*mWLA4@$sxGF2Fw&Mh(TvHc$QnmM|&i!EB*Neb3`-{)ARGG<h5)McXT&QP4Nf)K0
zv4E~>^@CwR)@QqL*+F`b$xLQ7VrPk^c{Flx9*pP!smtzVCt8+`*^qfHn?eG4+Lvm)
zn5;P{QS!-ZHWsumv-DW3Tfmlc?>fHDLE(f(l4&`>7eX`IUK1Ep-}$k{+mcASXbKX=
z(6baNrzZ1`^Xnp~JDA-o<mhphYJ^yCr(Om3EzGvUU+yJ$B#tpzWho~$%BI{f37$$*
zVrdDODjQ!piDXT?DMyH<v<OokiS5jgXwA)Pv*_=uJj<)jdWo6@K07iupU#8#P&?p2
zLP?$j7e3^X(UN_VtV)?Y!Pl}T6vvCg&#X}<Vt*N4QDHI*X{rvA+@#0ni>g{%RF+JH
zn?Cf8Qq&<&&&<M8dzHNoxzSNDgL{FpuCb+Mii-ef`I_RdVt0<bT$AwVb)LPSogEID
zrFJRGs$Wm{Z3nK=Cn<@f0Itvf2CC5*?s<Mq0;pB^PHHaK0g_sNHpHs^RIfE0*;gE5
zNE+bire#~5glr7Rqp7XNq1wk}$t4^khfeE-3{CBJiPPYoC`G|8z^K;L_m;#$zl6O9
zBwP$u5#V`=hA&iV;KKnb_Ta<6s$GOG-1Xx1(-6^0@X*z&w&WG?wEC0WRDG1vg==cd
zJV}8pRl!-Aq;gJhBKB+6%fr+Wq+|H0kKp`h2LMJNM@xiNs%sUmi}YmKj>sF;My=gw
zNHArV)v0qPS8H_Fs4ShJrOqO(KzTH9q8A99*=o?K1Dw<7fVC|(tJn9*zsgB))<unm
z$oE3l;>>7P-od?L8VkaoXHkGE3l5NJU0<)1l><HTyBepGHS6Zt4YShytQtYd%i2A8
z_(Zjj%s%H$ZOuwMOV4~NwT}mVre?<h^ObJMrqP(7VxH?fx!r9aHior~H?nQ)1MidC
zb@wa^V57cL(8s<W^HgPJ@wuN;(~}FqL$1k}R?uJ_O34&udV8*Yt27UM-6RPKB+0Cq
zbbzB$tIlYBO$ilL?hgd6+aC`)<BiBYvjR~CU9%Gl$_%KBoCQDDCY<FFGDEWHgXTR>
z&M;FBysuG&NhT%nXY^+h44g0P!mPA;6vV7~Wlf%cnAc$<1Ev<4^)f|TqjjW$wcDvC
z&GvAgm+ShHb4&i;$^i3tB25!w?^M?G)EJ)0=Rg9!g<EGN;NZwT({AS+@u=`$Ng`;K
zXSy_%b+-6Nb*#!-R92I>fxB8aHolqusOURWaNXr?floH$n49<{%A0J^r7>3L>B{kc
zd-Z@3bu`)pntFTkScX-Vvg&powLp_|d^UBX<}#2^Bof1KL|D-8og#OF4Ro|{%tTd<
zi<shb<;0|%Jq`eeh;jzm#YM}FL)Ts?nxoYaVE4#yX9%LrvM|yBQ$cr@!`J6$!U^gH
zVD!{5hQdP?Ws@h5wD0mpn{yx5BsrAobyg#mjYc8Na>k?X-7$~)kwmI6rMQtHG6`W2
zqs>w*i(KSZ{i1fnt8odLbW-L+gt4<09nH|4PJ$r8+P!yDw9a(^47=2&8Od-oE-*@E
z!K^ZFbPU)5SuIiWiyS&i8qB?Z7(O{I-rw08iGwl>uMe*uI0|ERjQT25nSlsZ#hWkL
zyR$SIBi2dM(jH7Y%a~@J%gO`v$_#5$A6-kI&^=UDmiU_To+*=C0%!zQ{YqI_X;EpM
zdsF9(&ke&0%rK_?lrGBPb<XyBkAcdfy4J^J?KiDQ%tKKI@-k`Qtg$9VR>^O(oK@Qx
zria`@07#ufiuYMHWiG1MV@6cuCbI86oRJc^iC&ZH8_Sj<gUQfpZ8Zx~m1my~GQ4TD
z?qfd|IUw`1$_Vy`g4C=$Wim_Q00h{JS!EY-SZM8pcPq{AGi&bBQZW~1j*|7V4%|0E
z66c=AWNKa(AD$($E4A{!!@<#eWhvlU^-U?gS9us^?N$*vl+t@w$}CKGQ1(o{$U(St
zA}gOa(bWqxC&zRN9LGHAV#+qg5O~Tc5&^)nv2Zj{C40dl0EU8@bdKZV9a|(jsWo7g
z8~bORM(HW?7g@Y+v_LXDNNP}VH`}G10YM7;RV5UuSCm=JWzrec-k%+SDKVMM3*cV)
zYg$nxl{Y&}5^J!{N;so4cmB8Jqk7xpSxParGflP2*j~-~Y>Cj7tf9)2qpCuE5@?Zt
z3}_aIKTGz?Eg=dgN87Q>)B^$triRp)jAY7+(2aDr#&jFl);bR4lO_FDma9<#AN(FH
zvoO3Q_D$XhYz{<dMM161ezF5|Ulc`uxc;!FrmR<HT79LPwqkSXx=BvWdAJQLHkyjO
zsIm}hVeP|ZRpfC5l^B9ssb18A5|LU`v|U<<QR!=CYWOr>=&Fqjf_m5{%a#ak1O^(N
z87X=p!kSD_z}N!4kg?!^^em+9lQ#xI6n!wjmy*58_-;8HHd4*2bOZtX!ZTi2f(WES
z!B?YWtnWTxv%}no&2yG8ETg$wPo<5+y6aAc19iybvqwwT2$4luJ~q@{*NQQ<nH&j=
zod<&oZ9$wXhbrnIyXlnP+YRa!gI_gIttY#V7h~s$XQ`2BQ>LOfdVY$>QW76awHnZ)
zvszbbrC>nfc2j1E*fV;>EbBa8T?Yn3hGB?*zki;Eu}cZ1j^{rd9oVR~!0P+1GsPdC
zOF1Hj76zi6p1rXYEm!g}WX`$%#NL^qV$&!+HX7(j0s9L(ul+C>S69$BxZVo8?cJ!~
zoXV()0YRQEqAca@g&oY8NkuAvpD6e{z$+!gKc@RJtDMjN4j}dS&w1_}3wJEsq&z$0
zrk+%tlNf0jr6bVcqV~ktW+j&GJyKrf!UC(@dqqYTpRF3$pnB`j7rI9Ts{3)3?uT<)
zL;!Im^RY0zn8)`((%4iMKPFQ(^wh|F5QGWh!6_FjDSQY<>TLWt)0@I;EF?r3e(d?t
zY~oM9C`4e2MU{O)`iWKx>Re(LBA6N(a48sIllG(KfI8KiDt+dXy7TDlE9ESs8eL9)
zKla&E_5GBpvqP?H%T^h>8eZd_Z6qFEDY%JG3;Pyuc)N9tXwKSvs+nRJ77_=*kiNHv
z8F{T?u$8p`e6|UQW(}7pRmbUi>|rC4Mk+0p6?uwTpULP34(TK!SS^GI7CDZ{aPH)J
zf@Ij)h;Ir{Sw2ct#C?W~EK@hsmZYjw7IAHgKEN*qoOfG^Td((XjpEB_xh>8iXXadp
zE~b7*SipBZEgM7FnO<X2>MYr%5+CO~g0*K$&knplpOsXkT(e!au65GhLBK5?OZJbd
z2z~gD+N~F4TjxA8O~IqllD09qsG2GvQf9o*Mo<dF$cxJ?I|zVq4=!ldzxEs6nvch$
zjN*V`V(y~?`+oCgsb9Q(=yj-*bORT9A(G*zE1a>@m7|)rGGx+FsKwiNRvj0lMS~=V
zZ@Ec#_YbDJhGAbWRvA*nnRRNIBYuUR?d-79{30n1=Mg0s-6f;zG4zvJPP^SPjnG%C
zNl+1R5K0e%gm6Vf*%2YaW`t~e&-iPxiehu9R*~eW!NEsK-Ygxl_9r(PkA_MVm5EaA
zD02%98d3*N0(K40--L6E`@fBQ!Vz9=C0`&XF?J@MEH&}7u$EhFLKtz&%7tl~mXRB}
zpWF25`DyyhcoQ3InYt{~^msj9kJsb%b9s>=ufzE~FLvo4sb8e$Ri9<K`q!ucLI1<P
zbHGy1f>P7$_6nRL<fp5vm4X8y5@IMP%|lc08o?9@8~vZpZx-pktK32n0S1nf-Z@d>
zXX~Hdfi`sF_@|mVS2!e`4aRr5Oirt5<g1C)!${-TMdxkg>Ca)@t*Y*MJ5w$kGa=cX
z+GqD@^`@mu<#%!oVgK?jT_etUwpRt3&=`TjgXEwB17VR-v{`iZxR?7^!FkI4J}{0{
zn4fZ8Nqu3Z7+E+%!INszbD`bBx~2Y13fr>_>0M59QP*I8R-KiVDV<B<JiZSqFsSSS
zg$3XcQN=q^Sb4#u&;4kI5kF5OEK_hRG{v4Qt-9ZN1O?JcL>Wa^9?|Tz!gYrIeoQw{
zYW2De%XRv(^M}(XPnOr|`@JHd$LsNWydJNg>r1oK!mhqtT%|A0+w^VYr_(m=!(O+l
zoe{({j;9WrTupiSWCZ)tPtCvkx%*Q(zj{#n6L4xZnSD7GW>A;8_w{PKQdtOF2n^5X
zXfi}UW;w7z1C0?apXe<{hL2*Nn#@Y8me&~n!NcER*E~c<HALF_Bs>~*AyUR?n>Ib1
z2I-8U4$uTf^TFrq^x5|gkwGm4XQ+-cx<5oi&q!}IG8}KyNOO)X=^PnN(|SPK5`}_r
zCU<v7!4!!0CaA&nXgGl;(tY=umRm|oFYe=XQo(htqVFQT`~E(C;H{f91jJ-fWN_cJ
zoG3~XunOtq7sd;0akC09zc+23;v)@_b5aILhyEe%^J_l#JiU8&O2_-1*e1)`EV=Mu
zRznU5?A3mBPtkUnjt~3v;Sa20&GxQy!3x5ulSP&u-X`2(=p^(?ZxEU>s0E;U{ps^{
zdiNaPeR5&_@p`--ugB}}*QEirAZADau9xX2n`h~lm;3bY{XxBtQimDyP)n4RsBMQW
zgVw()n{*9%hUV;WIH!k`YIxXkgb|YFx&?gOEX7_(=bg#~)ZmtyLNN(_g7LV>gE8OV
z?ZRJ1nJG8G*RyH|9)w1taJj4`ze2b4?d`#{r2+!$nM4<9Vi%5WFZyd4*zzoT=Poe&
z&%WHJo2Z!510})A&c(FiBE6%=wrzUv;gtk@Z?3ih)mgudVrHkNPqL{=IPeMwIJ#RK
zxgZ*4hsXd?fu>pb3^X{IA;iSvX&{X}q?d<qI9J!{Ghe)q!g8ISY^drc>5U<ubT`d^
z2VFF3TibOwm$Rf=o-TCDa>{%*iWCp$V``%2^KR5>P}e{Mj-D0N*@-&tcZN2J9-eFh
zT74Ec{cfM0J-?1RVJ958J9z_;F<PO)x?k?YDAX@^%1w>$pLz+K-jyE+tlbU8fA^(=
z@#FP)JzkI3&%tFzs4pBCWsLiFE#!>;*s@w?!HO!asevZfAG_okjEJ%C4tMIgr9}d^
z?I<-QL>MaDbUrr{j$3MI*PAr#AHt4bMWB9CQh<d+@qTy66QeK6HI<p(wbT$&Qqij_
zdllHkf?97<vu;GuZAy5Qqtp;6m}^cK%D)9nlSL{{hj2726BY{7&BdJ4To@PMHJ>ZI
z!IP^t>xA{{&FXuLuaYP3<3^=^EEVA1nH6IOq5%5r*-fOO@$(1QoED6fP(iP7FA*6M
zV-pfoWaizpqE!PqN(rH9qDYGr#L1L-&2;he&aqfmH)}CzfH#5v#L(e|Y%G;?_x^)E
z52f>CI4dFybOJjyIghzHYtY*8pS#HR=>IC!)$eCMpGHx3)!;g3)*WP+lZQ{jI9gU_
zF`<0XP5=L!=<#~I9<Rsi@8@-)|DU7YjyQFN7UOgg@hxPl)$@s&l8mhT{L)Zqazr_p
zaY=JB>K9USgl$M$1DcSFQoW-~2~j7NTlkmzwoAi@lX4~)CHg%Y;Oh%rbud|8!~l8{
z4&fkX2GpTb#Y`C*dTCX}^CkB#z}JwXGD4k^&8Sh4)bMzA-w~648%wmzg9j5_U2W1K
zoQH<Cbr$4hwhlME)VT2?548-Z5(a;N-)HTvWSN?(k+Tx}Z+5Q^_aQkR^vf2@)b9_X
zxXv^LN7`Dn3&Dd{DmHx-2H$Z<li@*h;axb*A=5A|o@w?S1Kn<-NC=z>{r}LJcFc6u
z(*w%e?v|%cw~KONy{t@0g_YS@h?qJc^+4)?(pLndEzPEyvjZ!0zk+(TG_|>Sy>T9|
z$LsNWy#7I5^K7Oet<wx7)gV)8z)rbk#M9zwp%~N(F+`oJjsLw=pC=6UCQCVGHC)->
zYn1VeQTAK{*y_J6RHD+P3&?+mPO3o6#G^fn{Of!^F)Pe8+_o-qU22ecDp)0OA#@H5
zE#jA_u@jY%YyoN|UJ`m{k>~F;^<{9lN12l*s;?=TLW$=&hIQ{4qq1(rJjAdgN{UyV
z3U``oBz<ZAzhrLOQL;3A2a71x^-Po0!X^({BU1wQyJ-ti*hS|=e3mikdEzMqj)4rP
zu>4S2xL*y8I-Vcr#Is9DV)7Ub&w&c(d^iYm<$Fn=Ar{svubo737g_#^Sx&LgP`&wH
zeI|^>&eVTtwQ2<WEY**zrS%vPb3Gp?y`=hFrpN2?db}R5uZ9cT_$10Iq(ihbXiSeX
zq)9|L{#(de@;Ie|VVKFiba(&)ax`M4p3)fAJiTRG9Kg~v90(TN-QC^Y-QC?oa0n1!
zA$V{P?(QMD1$RhrcUxQ*TiE60oO3_#AD9m_J$+SoS68K~QhbL&8_>)n+KHfRrG>BG
z`lSr%apI0q-<#RRJyX-MEwdL0F0w?2Pey1TtTOoeif3J2ebAna-AcBawd&P_JC$54
zl$;mg)s^x3{eJfk_hFp8#7f#PsEOwtWz|7ao*CD-41MK{DMVt~9M$<uhcp8Gd<vOu
zLQgSP!e;rstG3<CS(s-okNcx>V{Hf{Ng+3?|6V9LY%~@KarfVyw`qE;=nnzC%G^{t
zb^OdSA)j=;0pJls%>dO6OP#QE?Oq|2`7|Knn_CD*nP%R3AQqn;a&16n67uKTO*tQ&
z<92fbY#RFYbp&seL3>gPp1S|uQm-<*lW!-7!2}=Ywv|hPsGXT{W_EopEA9;@UV~>E
z>}azdo!L-vdt46FMnDAl7w2EDMRFKP;9@-G0Z20g2WKw!ml68OD5ev)pC1P+k!WMt
zQ#gjtKMj6=VP^S^+i{bc;1aKIDe6;!p`bowgZ;kZmAX5OQlimPIUWYpyz||3*35kF
zRUjLPPbvxcMH@?5nJ}V8?9i5zj>qDTBJ_ps<2eG!*MO!X+wy;8>!;h&A?Zzj{gZ#B
zEsD^e6(~JhCOaG#GPIBF!#WFG4g9A4wrBTOF-}Hy?g#Ks^}dqzM1Z*{;w`t*#B&59
zqP?0zu4pycNgf+V3mZxsQ-EQua|?yyebX3PMrzkE#s9umFERW5tn-SEHVyBaX2BJv
z{Lgb++Qy_>M_n`qI)qqO3w>MeHIT4>QzshiCtAspmiAhYoKb?ZS_2a^*)<gu?pT%3
z#~e>G_*RlFWH!-h6lUj7rPL;g#oY3l6j)!nXTDdR^!{TqPlDB_woT$%*iW((&c!!=
zh~%0}hQ!6CN_;+Lh@?Okj*};3UDUM&G9}90OqCm9>k>E-U`mKK2Ou&c6jN0mSxgRa
z_J-jhxNR08ZFbU_h<ot+mnMGSv2STnbQY|f_Nmj_UjY9={q~DFMcV2g@uRyFsC_7O
z5SXtZM4~}|zd>fsX)|MGU_SI+PCj(fP<VZ)$|Q@t)sE!RZ;7-dAQbbYGQZ=NLb%T-
zy?56nSPlF{VlsYHdN&E$Iu_3gJ{XnAL<dT!El14>K&ulg?k^bTMGArhdcG?E2M*uu
zWwTXLQ~dqGbdt}i%YmO+N=1ZB+SqY=k;h9*;NeXOL^5JM980-)nF?&yelX24&BtJX
zFP`9I<JBq?VabzysqSnb$QJrdSSRr=*k5a~;<Q#*>cXd>#LR9LE)dVRK|YgTGiZpp
zBkioyrdUOFAiMO}U$f{;IGvk-Hn6l>D=|ehnOcDyhB`fSRR$vO8gLyQ^73L6(AqLs
zZ67&lq}o!Qi#D<AtgBF!{7;iM`Q~vYP8;lC95VNd2a`=VEcW=2{L<~wiOUa};jWeU
z4~NPvs&lK2sdQQSaqDe6E`G~;!L<89@V7+5WM`cCf##@-y#3jH7lNCYo+TW$ndu1{
z?!o}^a|X0F+3;3V-3-H&r%M3r#5XILU25@$u~bHflLrSLk-oj<qY~hmI8<f6;f*6u
z0gOihpy9*j`X&H*dfVqH?V1f_hun98^nArIj_-;Vf=(;u3Cu6?xS%~276rl6Zs2L)
z+1B$sa2C3rm~eIje)doj@Ntzbt*O(mFov-Dc9i{PZ*IRP<1EFXrK&`enqqVwcb;yX
ztJwPOTS-DI7^}B3SMuE_CC_M{UfIF_*u1kjn=z!`QBV#cd`T5U?#fE;qo=Yndr8$#
z7~6`FJN_Cv$=uSopIjwP2#qJD0w-Fxn3%pcIOf-w7VW>E?6*~FFcIhNo0ix~hhH!h
zs`QpGv@wax3STyj&`YJXtQ*g9lrM9JwO5z#?Nd*mX@@V(7Jgg)X3fYiudb~e+o#&&
zvFH&ln_iL`r_~K;(YGOum9p8Gg4H&Rd+AE7O)N@`V{#jRlCS8pm7c>)MP00oDc0HL
zC5+s^a8(vCSUk%T6=dI{{<!a$A2#&s_SGk5zxUY%N8P#L(m?<_)ki9)52sGNaM_N=
zFat!mcnX$KD#$2T9YTTb(ChVG8!=1#UZO}WSS<tMTvY&j!uU17Khpp51537_IZ7#>
zzECI?fZG57u)*73jZ%&7Xo=oug}G&bZL&DH>FJ6>!$OYW?B)y5;?)8=1IpTltj|+C
zv%Gnbz5fb7$ZHo;_@}2`F->u+a#CwN7PMU!zL-~U@iH!#bN_1DHIYI3xZ0x-N8XK)
zYrd5S9s0+`EUReW(h=+;At6+tbQcbmD<{n+L6%Vke-ZIXEb3<@hp?4XV00KEZ=KG<
zL;qa_ZOeA2#F?vv@uJzC&Hxi%4yaLt(^g0-g_P)^&54H2WokU?h0<|0%`;q<!CvzV
zO4aNmv4nMt3lh4XVCom!(CF)4(KujTtHDREbjn}&LtiTV1KE5uR3wMtmY)(a`aH-0
zUsW3hh%d7EyVt+bPuq@pu-`_XwBn259HPnw8fhYt>#d&BRidXmJGtJ3Vd|Q1P|UqV
zi3gnwx|IWer-szXYI%ekX%gNd>|=)@x0!&^sHLN~i$3`);m7=S6rEJkQP!!Ivi%H0
z=1Me-Uc-Y=T6TUqIn^GmJAn~34_?A30~!D*(O8;sCM_Q1tKXEn3;ICMY3Ag8o>>NW
zv2$(^f?k%OUBFEc5b&6})il4?`H};4Qz*Z0vv}L^2{@a+_}nslcOl}8Um+40)RPV?
z@ir<-Tkr8`9`Kld6z>zTKWI?3jb@#2`{?ym@e$*(iJ`pUuz42vkoPVywO=5}nRDjt
z)05H29S<68vi$90JkqrpyfX;=yyd6(Xc0}qL;yoz;grJdvvhY!MYbPA0j-~<`067I
zNQ|2uJv&}LEUKLeW^|L}wOM+%towrRm_K1`gah;XQXxGswk}y3V4F{CLNNXZcEBXp
zrpPKnlO9uSjDUsSb$&m>#%99vby|A@gp%&!yNg8CB}H1>7Aq|q-sLXJiDGcm51-2T
zIdPfsuGAE_jR-=e*3bHG8jTiwv&hx*nOV?GI9g1hK=+D>JsU5T^|*f5vY8=Cnoofl
z&S!5>%7=!sN9M}K20mO6e?VR!E;*sE*ZAEEGM1KVScp=g-_u_ocXi!qW0d;KLimOw
z>O@jKNsZy>C6v3Mp)R+%L92zQs|9o?5(JNP<M_Bj3>1b0>#m9oV?)AXB=JJCA=t-;
zJ)@FJB-L@!52S8iRs-y*xU8*bbR45D3DrG73tN8b-iTU%9n#)w7dc}Nc|NNWd*~^o
znK0^vCAj0lL=F!1P#}m>t&bUM6g2)vy|Ouqr)Dem@1DYz+8x9IX&)SEk=c9kIhYZ0
z1vtqy?|H&_B0_y@g9^-3KnCAb!G6#Z3P{Oz0W|9Ei~?QZaT+KB?YL6eh9<rh>joEV
zY`^sMv3`$#oSS{U+0F~zr+77qIX`)PZRnNA19)c!FA4;I0gt%7T6RK`C6b{BZ%5mT
zfa}@ryXL?Lj4}x@1V9NHr+~_WRl$~EyzNJkIl%o_Xa?wFR;Lqkz%ZW(-N7gaeFM0G
z@q<BtYq#?4SD80wFjV3ipf1t<rZE2qNdT}zX0~r9KPtXTgAXv?sz6b_Z-9JgZT?ML
zg#>uCPa;U|^*B}nQZawr8=NZsp8Ma6sNgNrl|zgOH^1TYK}HTV;?}jY{S$wWJx<Ll
z>uzi&)s?0iJg)(H8Pzl&YDo(fqXJnceNS8jp7S%|P5Gn%Ms)m!pSRabjWO6_nLp*q
zZc|SsQ44#zNalA1YmEGG)X$&qZ?As7?2YFsGF$yDa=Ahe^Lwq7)}&v1-)R3s$?T$^
zFW>E`DqG0j8guT1^LLMrMtf%taiNVdOIEm?L;gVH!5eZ=<t)EG)~i`T=yj!o^_L>c
ztb%FEYwhBjP|9%1n*L61GLbnOaz)-Q#7$qV(}^{-?+5YPbY#QXEulNhuuO{!LB0Py
zyz-ToZBmmX3?g^J?d1?*Xn)$hA&$Mp1$tg-X8yKmS<adE^uIWniW}me8h$R_zYkLa
z^lih8V0vvlz3lg+Hw^<8hVbru3vUwzH}t@-1T-q`S7}=OAV%2(t#0y>CyFcP2AcJk
zF=n+h06;(Fu3Ee`rod_500ahUR1_qz-aj=%5AQ(d(*S13pSP#wat-JofeJV1(bI7O
zxS)JC=&bK&@Y&ZuFK{`->r^TT&EObxH2Zo6%;~!mr~vF)ypaI+x8J(v9_c=QV+x`T
zx{7*}2ipL4+TIUgd)ox{1>M_&?fM?N2Fh+$`<Nh;Zh$XfuQyfbIRNM|XVQ1O4<rbl
z=TO?d+lB@K`>@GRao#2#Pp*0)0+9FMg02)O_8sTEM`8pB2y%m7Ua4<CbU_WlyBe>1
zAd@$e?bKioa9=s#@Y@~_G=@U)tw*9+>FsbEs<PkJ#{nsFH{N*p`j+jc-nZW%e~>AT
z%YO5p2!onxVqFT)QU}_YIqlFs<l&RMT&k@=wbFbsQ0gYB#Cm?LEo#R8l=@?CK0!@s
zyPMWn7Y7KqTb&2Jj?>rev|u=(QPaVMd~QT5RT&cf8LmddO;J`123Ox!-maEZj_TN&
z??(T84M4U5ysrnXvVIH;+#j+1vF>gjM(>lhxA#sRo!>1&LFIAvZ9#VM(3kllf#FF#
z!T*zg%>;&=dsGMpBcZzF;=utA9D??YN}EgFqhkZ|Y{u8xgRJKfr!9v*a}Mi;ZO9r>
zh-GIFSlX&{TqeLQXT?Xq!6%Z?j`OnI+#%f=Y3{<cBC{f@;?;CqP5iDC{gEG292Z!D
z|9kFw=#PGvYW1;P?hLVi{ebQMZm4ztU&<&;_U4L{`N`A>25!T`p@<lk(fQJ2*%{{+
z;|lv-rs4&RuU%%cJad9dZ<?kScTJ#w)k+5nFMTgpNCDzdRxz<xN3afn|82G6O%~iN
z@tOzh8Vs#(tDOk~PcdvO0U)z)ilw|~-rz|98|3d5Bpzt9jmdKD6ugT9oP}6G3vPH|
zym|q7!AEY}<+A`tGbq%}u)HAPt^`Q3{fY-PfnFCV^+}EGHUEAlxhj8Kc92NxeXw~1
zURDH)Lel%LBi^oG-o{LTtM>}?ZNZZb>f6wZw-yjbdW~NaN9nG@o4u{cjf=$H==>Y)
zrC8D+=yV&>3{(It`hX4p+rd@HJSUNP=ky$IvQG%*BO2Hakjr+SMPx+=Ews<PQ1#qd
zQ?zoWBu14O|IC=O7M)H(v&G*M)vx~C<9EX?7QPvbP7q>MrwaXxDl+R!tMieZ)`;o$
ze2f^{ZEvP#f6T?|nS`%LP-T(6G?nwcp8SzqDFfkQGZsNyDLx3*uP#T-3Hvab_Hf4t
zM<Rzl*RV8MfmF*48%Y3y$+&1Tn~@Ki^xm;6TASmi6#5x8zY$C9|8lDS_n?k`oj;C$
z;h3zPwx?eXNaf7iaY3ZviL8juun@vP{dZ;ZhO<khN6-Izd6dcAr(V^oo^G|E*NunH
zx!ij0xxdV$CjqUvcs}UdqVk?p6I~MiKaK-rwh4@*$rsJwB3FkndIDNfQ?F)9+sFgu
zO}Wo8fMB407ON2@?4X`3CI^k&mYln0K62Trn`k_$4_-kK^tN$;$ysXnSflERt|<#z
zZ>&m$A^@GDQsbQsDyuI5#{xO}UKHj44<`7)?H4br6#zeiRhZ%m)Az#HzL#%I8W`E<
zr%uymwd0qe6w#zCOZ%nZy~B^JNgGA=+s7V4mfNpEJf%@zp>9Bp*VZ?q&Zpt%-nqdC
ziOk^9N7=%D=xd_2MPZqKFgFAMJ?Kk?zV_V{^bXO%Wcz`Av??~noq&mZ;<H#k#n6BH
zcL$rB2_`o-cL{2w9_{e|>QYkFfh%<8I^8VBh3+w@<gN>T{pw*}up|#+6iAliI=l4~
zw<_M3IQ52vwv0F>Uo$#MmFV-3djWpZKFO<L_94qUr}Mh=?^JXCJ+|3Nuha}5^vBP~
zsH|qJVp;U~*i4+pp(BvR-R){3#IL)-Amy&M(3x=q?<yV{^mw|P`|zSpGgmW^Dw%l`
zGW)X)*5Ar3M_+sgvqT<0i8xjYf25Y>B+(I5zq&?GTdQvsc6*vwD;VAH3hIvgC1?^g
zV5Fcp-sfwID;4gm-sEiNT)!~lfq?wda)EW|i+PV}AT-2iI@Qr?`h3v+K`ST47|}NN
zsm~`6DwMmGG-|nT=!AWg^^}lem88XBst~~M&A|6=V@_qB<%F|+gE=f$nH$$iJ1FLO
z>rue3ij02j*HeF>8`ZC4*;fl0Udb#7Os=K?5Y1exP-v46GQEv`a{>=dR=VZQ8=Rj4
zs39hAqXmi<Z$T1C?@tBY1F1-)y}gbLlqEt_+|;&j;+u{Nz9nzD^)kKVn~b;1!R^%E
z!<@^xNsWs+0*Qj&*RzA!UbEK$(C5B7rK|3{gg5_32<W<_K)JxbLd}5UO%9j|ILmq4
zEx3!w1VVS2#a>QKfHV|WeITK$3u=)-h9GF&mD-!_#*5F>LR;^?$sEUXWFn&C^Lqna
zqM+Vr0`F{*x^C%n)2smur0#QKhP5#FT?ggug;WVOqaEiJGt|nGBbTK-Nz#D<tG&ax
z{7lkxjX&2!HbOGl;MM3)ERu|5{f8<U&rGEUN}E__7ooX;RLjA&?=43C2HL8-_Zc^n
zFI#UpTofks*z+B#M{v!h%tMsB3_oh&0H;*MQ`N)qDWGe=FF_Nuvt_?AM)?OgnWmN%
zW|2uTS~s~Tqo#;Cmk?-|fg)Jtje)(fq1lKZQ4*O3rWTAlXiTQW>9GZfQ;Of}7O?pe
zqAy|aceN-x!X@saGmP%bxq~r+<nO)WmAt=>%vOl{l0^;Ari>?3@3R7#_J@^j%*0TY
zN(@361a7`pp=e{cVC9D2FaQC~+>>KF{J5MV`E0Q8yeKbRB0C(3deH&5pw%ed*RrQ@
z0yAgv_PGL$WT$w*zFf9BY2QGPX%whK0@6?>;rUuI4*)K|)q~c97tJL5HpZABQ`@gK
zz&8kiMH%F#p`7Bi-%b7PRpRYs{^||w=IgQ>9O`4mT*31~7Z3%qEdK>K*<Jp0E+YPt
zS@yOh@v^Pd_m<gvTL3tH%ZG0Efpp$;hy=tv;DH1n2VQ);-_GoP`1TkIh1i0JEWi?_
z6t6cFN`O0tEycdeHs~a<?=Aj45c>hg6>}D^cM=)-L9+n*AOomT;Xste>$?w4@O48e
zU|-{H9tgmFgo<L0zI=^j)TWptnEP+_+d;dGtBy!nIaZ7fw?Z&(D7`C;O*BNA6eta6
z-Ha^3ot>@@z_&%U{h&Z84F>EN6cZm*V)BdvIJc0+5otTgYcX};yF+QhdIVJ`Myj_#
zXp?PKSS?n=ZONaKwUk^LEo)!qpNzqu+A+szVknQ8`WNy~GWSA_iG!Q%DYlwZ)?|UM
zj!LUtOLAUZ2T{hG^J>s;W)zURwzGxY(TKHX)LKa+%xa1IJpQkauK8NyR8m{PCY%Mx
z#6rNyt(~Rf<h`<u^3%&N&Up+W2EuQ(_sUtOa2J>YBUHsedNN^rI;OmfTQA%cMx|`I
zR9=|Q#9D3*tsL&bxsp-1mXuG_YTC+nL)hw`)>=FV&G$|^`1vlZ9K$7fHVO+3az83S
zSvN`nZJ&F){Y`CMFkotW2#ofRADy5FLAJ(iPGD=ny36Aa2c0ijpz+z>zrWALi|Yml
zWdi)3$3a;dud?8O1%6o917_g8uF$We(9`EG0)PmlrSB<oJ~5aXsy^uJ3p^AlP?dnh
z%$7Z-p~_#o2Ma(JEFd?a4zUULhPjI1bGI^$zP7~L+yaTCg7<Ri^^(2kB?7TU_oVsx
zxM#M!;1zT{r}4HR0;Hmh`4~k9eZ5?q1U+j&ra@H(g3J7Q6tE_5dkpg$!AH%&`GRNb
z*Gq9SnmdUbqOT2ele2H$;3kbAX2=x5gVVaELy)4y>v&&A@OcG*8*<+VeN!t4IM(ZY
zLoTlWPZM#`&&n;ob{)jh;QEos26?13w1d$uEmdx&>Lpc|b)EDiF+W?Ym4ps?Wr&75
zusOM|s_hgjsQZJAqTYE4`%*+tDn0xI*}J=%#N;34iH~rQN+CSJQ&-!<BCEaOqP_(N
zk}JVT7HV`8{W9UEDA`YoEtr-v+Rgr;QvWlblC{6$zi7w@u*u5ez`1A2DYY1hrhibG
zBE#jaO}-3i19ho$7IPL6KuGB+=FFUG<+N@Bbw^*5r_qwBq+BSwjOGf;i404AvNCFK
zP@K@j3jg!PlX#a(86sq|FKt)($*#6h^4T;;HMK8xwv^(+CbYTtWlJiF(Kg+D-@KHt
zN{)`rb<h8WJ=oq57#w2c#(ybxs#T^~f<z^mS=v4-BS<q1N5V&!_CcDNs+pu&?8p`~
z_6X7#qGBI1?Q06?c<Th&JZjO1<^?as|NkTf56EUon&c00;=>Za1K6#Mpi61s)5)Ot
zHmj^H&6or8r?>Lb?-wFGD*`SK&Hlu8X*z;cN>g68`HHZZA%zs4c)f>rZ3-TQ>RJU3
z(XOk%JL;V0u8M?EJQA!@Fu{_Y&f(5{>TqG?Gq7%vGn6#xOvPw+WldzZXd){_i;OF%
zH4?l%*ArUb+md6FgxO)kWZA18|8k7sH16csmAIU<cb`t{<)Ke0#B4L1B~^=ZT8na`
z4syHtt{V<sJNG2v6vaH1c9>Uqhy5s_&1WvlLP4W%wh1%Wp!Zo38w%3!tOsfA9%`gI
z_;D$v`r4nQ%Pf>R6LOc36kBu`f5;L|$Y!mlz7P|#7R=YPwJpcj^@k@w6+Tl~1i5=_
zia!VU|4c$Jt{)EC>ncm>KLO@jWg3MgZ-?1Z`q~KABOx0n!;|OD|99YPK}Jx2?y8_h
zlO(j}?`&M43g}Z^{a|HNJyPu&&zsClhOz4{4D99}BZw&37pzJ=LsDWtr>2z{qRco`
zc2<BpGNa`WD=k1))7%Odt6wPAD>X}tbcSko4457@(ZKXY+_*Uo#B-QBe<)T6dxsl5
z!(XR<U~fh*j8b|c0Lktv0~qxvOpv`u`Lf9|7|r^hEOOMCVi<NrWG@_fkG^r89;3&l
zo>z^9;X826{t?yi2Bz4tArtxT$Q>jf&D~c+*sJ6X2#kz^{=5)muk(4=$HvR)H;vv=
z8_ls6qvH{+H>q%#&v+Im(GF}^U42l+>)+saH%#NYbQ8NLs%@$rlYTe4bR@WZNQI|H
z=^U<M<#gGU37CymT|<@0r#m|P$M)fCrSlZeHl86zl5?OhpJ+9Y=zobaiylgUy3I;q
zO=fLToxxhMQCeuKiVcft4Bo0Ohj$BSdNLLb;R9xH%X%~{n~tP~=Ee<c*KT=AexJ6?
z8}M22_<m?B->Rxb0-~;j!nWw*S(_YLXHc?A?Z~#=`w~%YFPuhBhpUU(7pnEWOLzU<
z<y%Zc;`8pmdO?NMieZtb{1|TK!<<=cj7!cjlgKzNaU!7)yh_M1+eCv(^=XHy+EsmG
zbpI{{lKIf=SY~4x6o6q+E-;cKrM`aK2WghWz=tj)qW$7)LR>Xp`=V;&zZ--Y!O?hU
zlQw^HTLP28)zl@Xtznd7$Zix_J5+@VKa)Jg>+rb!K1B^`rOk3DX0o41m3+tRYuhd;
zJ(SzTWGXR$A)-E%ZC#|2Ck=&ZtlF91aG*b;xpS)i*U|w@c8C0zUtlmQXYDCF%a@p5
zO_@nm{edbhyoi<(<HgYOafgI;ky~zcUuos&0}9Q*pR(sNw$et6{z>RAUDBLISm7%w
z+SU3tUQ}#`lyzFD=Vq^V6n5pz*hQTY`BCyzaz_ITAyJ&&Co&#lo9xAf+cDJUoHsuU
zkiyhY74%zC2ZK1ar1SI-nNh(>pOAbxRjGTYv_hdX$7#Dvr%M8IzUd2N`V*749bd?^
zRq4Jk(ZvY&boOZMC&0w3@B!Hg%Iw?YcHJe{mIRs$r-N+8(P&BsU#|A03hMlO(_AUk
zf6K;t#*{CSUT>EZ9}bysMSYAp?u*g&Y0iabgEix4#HN7_%$?7fZJ2+zFu0FmGLz`}
zWRVvevCwiN_XDYPIX6qlToc}n<}xVjeTXVIXSG$o*ENG(AS;g@xmSFRd+^0_m|=)z
zHq{&B6LK)S?8g6_^yN-^wnwC;ZUwgf^2DlK;Y48)k*Nsr(=smIWvrK~2!}Cjil%kQ
zHL-I9_Vb`2&I`{CUdRwv%Ta3Bbarl)%KV9KAN^7FFkY7V%L$Hzdv}jiy*Bca&4w6A
zG)P3C$Q!W>2<TDf*y_`0iyIBuCu2ebU2_Nfc7fn52;J^h%6uf9Hg~Dm>Rq+p8Z(tg
zG$X>YX#MM@$({Bqfy3`TXlJaJ`et3WB!DzePukiw>!!G~o#qu^hhXjrP>@k4EbsOd
zp0#Prv;K2Dq0#S!40X@IVI;jgc#~3__P3fE`rKuuL5en(RIYZ5Q+*`a-j!vrm?2J=
zJN_3>`jc9R3}t8v{h52~Rp3p!?rvL-`;Vx+Nb6nz#j54Pp0yI32lX-U(ul|Qw>}j&
zT$IHXM|bwBzl$uuK($Sw;!GXkQI#P4&jBy)m@L0?*{n^6)|}Z_|C<{Vmks*iQ@r~`
zh`4er0|cA}?S&zpP1=99WGRC$f9kB1F`Q8cK@Cd<+{BaAv94p6(TjDH0#&VjFp_!6
zn&QiR_8#r1Iz^Q}(v%{|BHJqx#Y5HH3wXJL)2rWJ6@IjZ-u>b5P#s_zS3EJYo(d}U
zT=0+d`1_P1G*A4#JemNH*y>#6G!1-Sb6>3uSSjSNJ|AB!#~m8^s%ctNj-Ds0b4+8@
z0XP|+?F0Go+0hB!kaF(wxtp>gaVw!xuFE4R77%RZ2V^i}@;vG&pfQ&TG_=9o$m!!I
zc=iy={w4%2rc8XZpQ2=dXBT<Y0>wsf%={oOZ@<#U++tj!`7!)r)9~B3*_966AIBVW
zC~j^jSxV7vH68NFrbqV<1(9U-{#+?9-%UkJfTHqw_j>TtyPARzZ3(T7srHnt`5Blw
z-vM>QkBOM6$Ekq4p#1CXeWpSb;GHM;KC=fSo2}&Jgxm%LZzIYX#v&QwYYpbPkg)hF
z*`c9x;yg>tE*sCf<pf<`E3L+%LQ~!;2$kg5IE}!kL_6D$$6f`-VDl2VF#oV!_Jx{T
zmws_CPRcsGg+IOfGQ;bylpj$o<l>{a=obuS=j$iW1DW}-=G_sRLd=;KrU`bVACiTF
zuBRDpvmd+6$QRmm@4hfG45{%Fb7@K5GJeL}%NOraw%KsOLYLGDTNccwT_R7gLv@SA
zF|6eW4x44>H)M~22)TV{eyNS<t+O5*3>EY=#eb8gXfL)RLKNj<;XYOAId%G?Rpn?X
z7as#{Y|WSJTyYVoPDR_TJxCfHH%BZ*GV$!AkkjlRG~afi$vL(0P!OVV2K@c<q^g#k
zFY1jWZ>ML(N??caTY!HG*M^_yuCF#EJ>Oi;6@QgdmcaQtM%&FTZ2r5`Ve|YvX!tEe
zy#D|AB7GJF2`Ewbu{j3Wqke#|%2xS<GXmD7JR%;_PTzmw#GO3l5qy>DjM;g8*kv_`
zMLqQ?{EQcYt(!@E#c=q;``b6&J`P{91LtO!TE~TZ>=?@Z_D!EpMBDti_<<p(eNXR|
z%D<_P=;6Q649I=H#yt-HOO5=jL6_V%`0-Za#Ah#Z=O=HnytpiXQ#1+QAm(lO$&DhZ
z8W?fy;AfPI_DPs`s8*!1I{%1+&QqAQ(l(Bm#u$Av4100C5ArMoRIN9QFQa?Xxm0Qe
zmxlQ%;Z0r%IYW%DU-`sI@P~A>254KA5(@=kv&IkR-m|JdT@<m$(bioSQ5Hs1>|1<H
zzU&U6I<K)tHQ*n4l5CT}!=%8C!kHe`5+&JA;5M!%Rjo>)dcF+W8ZW!fXbA@@_Ebz|
z$v>|@j<tpJ3K`&4pi$}CeaZfRT7jcy6eo0}cyx&tf8SK=&(<}jvb9B>mZ-<$cr6F<
zOZ*meb>N<43Kg4W|D6rowH*yq6TJ#RjHcveZ{50F7ZDLi$V!#r;-BhcH7d{ad9bv|
zt=S9y40EM2I+Ek0$zief-_|e*M&ywV6T^LFrN=?)?7%e@7?Rnf5nWT5SYG>3;@Ph-
zi;DS~p)7z=c}ME%=Z{ZreYt!TD2TK(66kU%>Je13!HA>%vQxwj<mgtce993}b~_=a
zGb8vkq_E_Amq?2}(XWqYtdzPSBjF!oNuaqxX4wtH@a2jO{eRwK)cGodUWZO2DRfzK
zdB-n~L-ab-az}LR_@$G{&s6eLvUc9x)k-+I3S2itnR5!h0g3`sL&&4NnwMwxeD*Tw
z3}J^39_6a{;d$fPxe2KYr?DU;MDhPYBQGl51Pnqg*fn15*WI;x;%PI|wC6(Gg-^uY
zz2?ZP#cAP{@U{2k$BQ|C>4%&rn!Bm}L)+Vs5hG>hy|Ij2#?&l(X*NDg=o{P`@a3ab
zst0NR2`tMZw?)$=ULPaI%w?lfbWBw8l}e6Rt&;R^Ri#%yr-$UyCJ_oomLf9d45J>>
zq8D>?9#>I{{2(#rxKQE~`P>+6RrP(NG8-p}8n(;A&nIJEnYdf<1SZEFTTw;}ai6LN
zflXTUp%js{{3&;<R{oWl$1*9}I@!QhbXN<1SJ&;UOaOL-0)qA)(&y*+0b-L~(>23D
zOPSoo#a3N1<?aMOm_||(CvJK>eTX4*Jo`S~$7b%CQiBHLGWE#havM7*y){>T=U4G}
zEYk7IOON;NP(3B^|I(qd#p+SmcP9TrR31asJk;uZF>Yj!wI-fo-Uu=UK~larF}2?-
z_d=6f{jwTLj`LL5*)OiGV=^BsRc9ozVuZ{oH3cVrdDHV-^kT@cbV$0Q$0RiVIo{Bf
z*G7u;N0r%F%bJK*nQ0|VzjuKp@79sv@F@$qrIs<N>}RcNm3h#v#$Pxs3K{)b_uZ<z
zz9eQsbeeOrahX_$o8(P)x{;Fv-V+{~n3p^?i0j+uve~?YaVPVf@sx5cW<r$gpH^_>
zsfMYd%i2BqJ=u9q&LnAi(-RXDoqEREv;!uFyTQ49ia31e<%Fqt(tDQ3zjln|h)z7x
ztBd+&asNfEk*I$gywbkQ-uz?mY($iTkZUXlYDzf2XuP7GQGql#>E7X@K0kW0W#V52
z{oi$YvfCb(zcGf<DD&5;*Oi^puk(I-RZYpl-2RhMi8&7z&7T*>fx5e|@V~2Nw&UdL
z{3=@Zspa*zDa+UQf~P#w;{OQRSDA<{2=RzVXXjM_)`yAN4+_6Oli*UMmoRDsr64KV
zw4G8=vn}gQ!JQ++-`P%}kY)dV6DAzvG}DnlLL_pB;|5*H;I5W}^j`E8ZTygS31NRC
zbrtWdI*t`u%0Ju)J~$J;kFx>pqWs(%mFvycW*ZvE#+HH$j34-$djU<qDLE~xhNuQ(
z{<)*U2QOCIP_iw@XK~x6#Gl2{x!d|4aa<(;kIGX*8ggv}nPk6p5P(}p6h&fJpUzSo
z;-aluywkXpy}6kJB-KiF^-Zb?KdCBafDi2R$RAQKFA5KzzJ(#zuqNOB7j^%K*H7gf
zD@sO3+;TB>grcZP3RlN%8jaz?qVaTc{gpvwj}2KwBwdBl2Gu`c)bRjWq*YqeEE_9g
zWltJL?pNi4dPLZtszpM(;N;uH(WzN#T*u#If+$DEy3Gffnjvny1{2-Eq^nR|BHdjs
z#<t@UdrhYSI<)pO@0_%js{Md)I_>huD|MjEtiBW0jI|)y;Qnm(;`i@x&HaD7ttn{>
z273&stu@C~fIn1`$!aP^^1R59kH>p3ZdOMti^NPg_O{k^L5Lb|TlEJU>d8^Rko;bo
zbuTi%KPfuB)GvSEyNSV+?WyG@&><p?l}m0iYM6&?vIhra+j*_d5Pw+3hzriT-?Oh;
zks*-V_sB{><sk*))PR0@`~U^s-)y{?W!AU3;tBS)t4zZp8kY4LSp43;`d^8hxI7Dl
z$3+^*VDBx&242#Nt!baCsM-`uDRqWfjb<1BJ1M^`M3sGwX;E}KBBFFfcSec`hLq}k
z;3z}&woOiAW^n5DU6D!Rj~54mg80;9Px7a1Gm>z5ALWe$8_22ori@m4?~;ap5sEG}
zdHBl4pF4Avz3f+7{Q%LE9k_=F4Nt38b8roNh9X$cm)AV!5^Be_QpLOAC7?%flkl*y
z)Hp7vQ6UStZ+S?*`~Wq3;p0BGgwJd2qKnIIaHPH~)?nW3K6V8K9y!AQ2*89!rqW>l
zp}Id66Lgy5C0cs^5My)w+Bl&}y`V9qa1`U}agRDQnmZiVy@ortAibJDD<|WD<;RZp
zx5hrDRO0sw0SCo`@CSI^VHG)o4vT~=^X0k#Lf@CL+*Qu|IlaJIkN+)_EPC!rP7HIO
z+ZSZS{g$REvG>+tqoW2}$J%?xAc9!VpY8`7&ANW;vru=?!ntDzGhIhcoAUwd1auZ!
z&wr2Xmh#tX%}XP%Px2z!lpcJ<l8uRQT<>V5ajch24st^FH&T@9$u)Bum{&5g27xTG
zNQr5a5&Q@5J@Kwr=6F5q+*5UVCw!|&l543z&tv5YwqCr<UtM?PMo<5u4XDeR?u=Mf
z;HGDPZK&s;cuG<>UW$FHZ6AGlRQ-aCm)sSyF|Z@kTRF(J6)w~6|4S+8_43%_0l2H%
ze)S<@_bDNVfhCcns6W6+r8s;FeKZzFB2qybDCp#9uX`~fCw!rxrV+`F;k17=u1#ZM
ziGIsH8|7{|`P32p!JKRj^gYWEi;tC{B|MZUWTcyzyNkEe=p`X$SX1VHqfGbsY-IoZ
z{}p${?AS#NTFBVPg`Bnu`U`1VDKImG=J!W%e?<G7nXy*ZME8{X<g1i8ZKzC^qu6@8
z#3rs>{#CHqf71UW*WPO$ZSuk4+AnwRS(eD&Dir19M$%sUiv^E$KGuVR8t&0qJ-?4J
zEe|kqbxM+xHSRNy$!$!40U-bW<@l-3ey!qIKxyT$iDekQ$QMp0yy*ea&M1<;0!GeH
zcMY-%Z?tjHi4B)-EM}M*04GoXLd}I2>mgbEBiqnc|Li)K7fAvoF#!1|rqueOPda}i
zl7awZ+hqKyR*+;=Me~`a%}zaUf1VB2_>uTisB+pv34(BjD{f?xM*>ozQRyax>3UPi
zD0wxk8H}NRENzP--_+h#s1b{ob$G(Xp{CusI@L4emsuy$N9nKm($!Ht*D9AzQ)U)u
znT}}qKP2K8q-SQ8`1QE-12hclw*}jHaHsd_#%E-rg!~;FTE3M&I%}L!r8qCgsH8FS
zzZnr~)42oVHovzdI>~@P^y$%%>eJfOY>tx+bCl<K9mR^Lqpf=RaAHCy(IK<}f(y4i
zG--n&=F<^Xu{S)rZMqfNV$R|6&5EUaZivr3+G8G~h%Wk0g4dYrz8$VKW#L4L`&lLY
zyyXlU%RthZrpPtJ7VK3$9oG#;&-*|Qfgt&k>M!9H<yFfEdk)LqrVV^mPwt>X?q3pP
zfjyCY{6PB47CFGp`BtOcp9qXm#QPjAk&o53*%wfE)o)edL$gEMbp|Rt2%lwgqQdl|
zw7x3*vw3M^0NO1SCh<7Y+=gHWkj%KCCN{?t6Qlo<c+5T_>M&T#n*fChES;*XU#VBs
z_n>!eB_vmdRpnQDrR`3ccT>zN(i{0^@2C6cOT0k+X>I=3{qpjLxY!|st9>`Q%n*r}
zBO#kt)crtbtV{m0#)42|t_CcJ1zAe<UsCg2$kGmINvPiFd}VrpGdD>yU0ZgAjj;xy
z!JEC3rEUBLmb^}3+Gu<{nu33Opn-9osF1eZmCj;LoiHNZ<apMxfD|eoIA;MX4*?h$
zaoNc4HbpowwXP`-xChZvMk})NRMob&lF3y?*j!3dunM|W^m2D=T;1@~69&6ZL`d@e
ziL8<2H8q?YPqF(>n#9Npe)dNOT}zFMr~sY(`4mzv?pzw%l(9ccjF@i5Qt_N*HGV%|
zf+z|)6wjV=j|Ch*M9M@fT7LRH<`A*}bfPm-{nLJXq<}1;!Y^1vkZ&2rXT<sX*b87E
zY5XcQJ!^ORbHKC^5s<+xFEEc`Zyh7tKe*dN!SU$qRd&BCB<B|z!0~IBmCH;v{_65;
zN~kewctbgc_;&e4jr%jkfA~-TEj^y(zMR^3CEOwg)LKPZSt%g2FcZvq1>FZ{*6WvH
zqy1$7!KnloGBx9d87@ZMQN7BhF5S!5X&zs56guaOg*>QT&T5Bj*Ju!YC$}qhWgI$?
z5BhXiTv1~zeRR59Y(QjZ&Wj>Yqpu#(L}wQt20Tz5`!$A-%!g~Us&tk;COz`hF_t<r
zCX!e7rZA0|GJLS)@NWP{nJDd@58%5x5i4UVIC`Afe5@6p$E7tVSea(y2g3`$zT_fF
zDUBeI!X!2I;R^0tHXO@tPmj-;t94y|bzR2qp^6A@^``VsPKpaRauvK5g3gq(i3ja(
zgxo!$b~h!hVPO}6GsPH+gTjiA^gAsz%!tH+Ad|C*dwc@Ee~7VL6(5shA{+kA;>`qW
zseH1<XR%NC-Nl3E{jVA=G@o;1Ec&!6l<hzBmUqZw0Z-t3-8eF+6;I2?$jaAqkh4&Z
z+Zw>UE6hs$m&0~D5{P+{-GQiAXo+YTItD7*HVy#G6L9Vpmu+y%Dj{^Kpy-sPpszKV
zDoRT|mq)|1_4dm96nioorqvOWO!YZCs$Q~PNo`SO(fRib>~&39u1?=Xv}C*YQ)3<V
zbar5eD};G+rQT1?<qF@E3uz;Gx1rCzx{FW7rfPSFw*H300ovGVA>D8%of86&@7h{-
z>D0mM0o@_2%gMjgn<I#F0wn}hbJ2Lc7*BaWa}?L(2OE~6c8d$Lx=8kVX*kQi83#UI
z1QjTh;#xOMjSqALZrhtw%m(@vxaKc-dV?Zh;<*6`w`0P&Si(_?#`kJf_rL)nf{W4s
za-32f`|+LMg)^!Cb+8!rnheZTk`;B}(SfYtHBQ>Q|BJwyJ?fZfmrq3z>DW11c16Y5
zSHhOvT6-sz7NAWdWnxuvgrFL&Rl#^|)av2WdbUShwOfV;^NRsD%1#luspuf`bWTp9
zUTv}3WH&1iK3rSPJ^$i@?Z%_15`T>9&PJAng%f?oIAM<>VF@>krJTEBl{{+muTTA7
zV%G*wJ|4?TmHeC<Wsn*CyG(qh7i$}8<~pIIo-9WdhD~CzFd_X*r4yLW(^P*ZXPks@
z<;GDP7u#FK%;3HIA)z9yaZxRjWj%nX{j9J+j_t>66Y5Uwa7n8VGJ}wvX*v-Prn>vi
z7rzu?(Ko_buOPkgj>IPZ%_2?x$5($gM8yj%LNCiEJ|Tb2Y}F==?AK6z7`T`+c9&`i
zT3k{+lIs(hg%QIJD(aNYai0;R0`ULg>qU>2P|AO!aD;GOfi1NWOBapD9m(y^dEvPq
zgG{0>awY!_?2uz>VCdG~xqn-1qgBT`AyGeTlsNnqT&PhKVVp#1wKLXuvC!_QBdrPv
zCg_K1P4q4#rXb;#h4UgTW=^QWh8%pT*U!9^(w5<wf$x_gg*7biR%iPT`<E~aWhjCj
z*$LwK&pe=nb79bOP@{ZTep^~s>C^d)@6X6hX0(=}qSLBUwe&-W;X{gH!&0xVcM%B<
zE-62_x!gn07~x}u)b@5YVB%4I_5(N!MQk>=zTQ|4R+<k*CFQ!7m3Vv9p=kwsl#K46
z;f?(+gjYD-N-nZyVGP?UCRqr5(@`!cv8c&&!dA}z^1|D5L}}EoCd=*%v0?20o7pXT
zBnMLV=@Nt)=jdDIWc5c^!ZpK5W&9AOR}P3s0%6K8+r~-Hs5oDxeY<64uX6lLzi8}j
z`o&0)7wR^nm`)$#2aB|~A2{==67&8Ou``R0gn;rg{W!0hrz-F0%xaQKr_v#%PG=R$
zjY2x^Vrsyz4DRvtI4%s48m)L@O_~+A>>tZMRQ=w=KgqP6(!u`vp{`n)#*7P1@&WmK
zMMNLbMC5L@J4b0ram|K-qLr)u%|>NiUF_U7O1%D_!f5UYk&_=Q%hDrCm_D;nJ3q2~
z5}6@V_qHJ6v<KwFMI|hZ_|ZFS$~8F1R{c=LF0%9q9p!1&1{BcUODGBr8Zn@4#@geW
z8h%zcsyaFh`csjUqn{l)%w1LF1~`XOIZM8?8u{K18Wd;eGnqY)Gv9~X&o~lU!Qh_g
z;_S2E{&xhW7SC!mpuH#nBP4$Pf0rs@OJMmg$PI*I5ek-*h_}W|fnzlmAmLdIyCxqN
z4)}(p)}W+Gs5jT%^wYyY&x-sbU`wGR+<f_CwUSSrtP)&nbsFJEMLgq{vfhg1i!uvU
zqS13*8S)Flk$|pN9YU)JgTpfy1*6E3EZXHv-VLn_m7f7txwa-^7UsqY<WVqGd%FFm
z=Z98NI8_DBSc?TIcpLB<-28`c@0xxeOnvqB2Cl{L^0u3_mF)77Xmvx7XpxjdENM&8
zY-HnfG)=BY@lDp`rL0RH945D)sw721ibIgOSH~<V;ixbb6{UZu(pIVR8T8DP%?9@N
zEQ#Yuqhb>MX3if~*U`J`InMWTU2L9N`*zWy88C_bP+I;em)4Z%H<?X%=icw)!jG(F
z-Uq?Hgg~`Z*-vC^FtuqHFBue(R{Vrd`cvRJ3kIQ0Axm&hIg?&W`Y4tFEbBznNtc{z
z#X^3L0rrO0_TpMTh&oXl>g3Wenu>T1USBhaWe^I*TFxGFuZ|jTNXpt(k)EMbj&2`a
zo16QVJl}^UAAvM%i}uuLsF9?yb^ZC5oRrfGc_od&xVD4bOy>pibA?8bQGJKWzn*V#
zE<t<v9guPbSa&kI3UQzxuy&iS>vEmt&yhXfS#ob<MZ@gx_##=$zxQJS)t%0fz1XVb
zGKhO3qxMbj1^{+uG{RDObrHXl!ap$BS}MkK?3^i6eTP>nrVA76C<J#=tH=m8G>jrV
z>E$b3lqKBIby_{ul-zf4HbS*50Al&{xvbxdF;zo<o+35>c84Joi%Hh*lR|2VX1cVz
z()#OzRo+uJlrB{D@xz*w>=$Tv@v$n2zb1Y_85L(J20_x#7F=E0rwyjp`r?#YMN%(q
z2B$Dsc*W|`N>R!{)hlUK8kWWV;}X%I2N~0H|KPDRcL%f%Ns$uL!L)>olB>y-C!wNB
z(G@U5Ws3IYe~g>!IIr|O;jU^IQi_7@`*1WhVTY+N9f&^;fy8|^gBQ-`3p5-wIXiU)
z@O@yp^C|yK(XXu|8zVFtp1^lTE!HmmFok5kCB9x{K1>9qDon0&1Qfl#-f<*Rc<?-*
zzCAmvwnHcm6W=OCrI*G%9}>GI)z|K^I$p0xcAS?0aS<1liI&?ds-9B5jq5Ve8UI+j
z_j*yHP;}e>u1Af*B45BY89MF`8CQ9-B$#q}VeRX6QWXoxBQk6@G*Q^=NnIIx?f#u@
zJi!+B-8t@U)d@`N5BV`w|9wpj<L^ID5<;Ab$kd_p-0x$>86GLo76^oYn8@NVltqTv
z9vNk?+2{<7;3twK|0<v5Nug*xFeT$iCyKTZF^z5GbXH`#tO?yKJ#@loV3xJRDQ<rc
z`-TFgu#YoQ_@Ud8N70RyjK#AYW9xH}vMwyg*62PR40q0mRJ7&A*bwz7ju4|$X6<A}
zdGe30&w3j*4pY9L+>H0y;S2nwZiB$mh%Mu{C7uB6y-#prRYY~r`<8%SuQ2v_-<t^7
zjqe#66-m7P?mkWs9$UxL=dbs<hygwGH{tk3jjgx82KlNF^q&XtC^GjoAR4!6`|2qS
za0Qtx&5{|dAiDKFgGsbdRDQP<^Exr6l%}{ynXJ=$`OQ!eBH5?UQ|e1!$0u|RT{pU`
z9QN`WzG37)oZ2LM0sE)0B`B^KSn_GX*PJIF(WGyqSKZL(Eh~G9Tc6QLZC~2KU0n*j
zYlf}mywAVty*+~Sk5|kKQp?Kdh*TrFbM5D9?Zt`-CUlV{ovL1RzYFPY0vz;Ll~KIj
z6(2sTs2SUH(dLi(F)`13O(A8nGJKD=Y~CguwY5<}@%r`cO8C)EVTuCZC<5~%tQTx~
zG!oi2OtyDal<^?7UK-voJlzS&Al5fy&4fSj?Y6io>^f`!D;!CtIQbYxj86Kik-j_b
zP+;vKV~RQ<7SnSmx_txoaBf<0;*7S*5w0pJg&j}PQ2!JG+cC26gKpv>*Y_d2g1Ys4
z#s;@G*d^)yLdsu~y#%~|Kvc<-@y>^~o%&E(8yt<0Q#xe0HBH%#=!Yz9u~ELDx6^F%
zZ|gQcJQez3l{4V1adHLjEToYY1nKHW)fGM&QBU}BB9)g|+I>hAryNS)FEyR$d^aJv
zc<iEb7$;4G<+6=>jv9btiAG~1inB)_zrjsCf@c`PIQww0`0b$g8?w+v48vrWMt&;E
z71+xELZpD|ou@f@pw^a4%>msMm{ghBpj9~a8mqhdR`)u*9jqwsc_zu9=bhhutJaW-
z!oO}+A9$hPaqfBOWn#|S_bS4X?4=>09RNQ5YH@@A-1W6vZ_9r(m(}&3P2ZKA=he5%
zR22@f%&Yag<n5I0ml};R23KLF8OTlS0b+hoc6*zHXFq&mrm58D<8Q%Q?1A%a4^*QP
z*DGHqeJEZ<o&gq*>K*E_)M3*aX_-A2)1JVahq;>VC;1qQCux6B48uh7t!~Hl2FpPh
z;1S(_Q=}pFe@T{)!<Be!WJL3EEQLl>o$Lj!`$NfhsgKp(n2n)-ORGkE$kORIx!Go9
z-$<=`9ZMt;lks_sOr4Yc?-j$jtGmQzRX5CLFf!xZCkp)<(&8w;qVVW^Sa_ByElg6X
z3favN-vpq*lW6j%wS0F~6oV)hxK`!P$G1mhm;EXjj*z66X&*P)M~mqV!5+$!to<;u
z?{8*@*OW1rri?HWZLAe#9d5*?gSb=ZO&CD+51+Sr{zg&hvDO}!U(*+ZGQt{zJUYO9
z2<D*WkF_m#MlM3q00TTH4<Vew^-?vmyvkRab^?RkJ87Z?rfKzXrWwrI9RwS3H5jyy
z!|d@?K|chjAtTpuXqxairK&ukbMmW0l%)WI5G0)KF@`YXru7zalPsevj4}nuz}f->
z?rh<mk5Uzz$?1zfo0t;EeEzW<>@7+pTL6FzhuP~G3xIZ|8Nn;L+Y$+%`ZR!NkxS5(
z7>3_q^WiUnx8ERfFw1SVfd!4hY(6zd&~xH=hr}JTl0MW}Jj;LXF7se66)N588dTQ%
z%I*KcQoybuViy&7PY=nYzVlR;Nd7k?kzO~u!eEmBqH=p<5fotxDmR!o3^;##IJ&ca
za_FO$c!~MqIiE~0=D+>5SQPR)I@W9EFs9KB#k*b5FlRNv_)fYca=DPd)vvwFaB%lh
zW;6}PXsU#XR?vmTcRYhDN15_$M##O2@}6e&emi?W_~rE&>7ACnYenWPa|!S!XBI*a
zZ)f?i1%>Dk=Y2#JrV`^~jV9!2`yjz4fe+@~ruZ|j7s?(pocAZsG)ul>|Fcj{U5+QM
zP!DX2YBYC2#@WDS?(d_Fv^?*jPaxUfs*$X0!$K2_GzvMNG3h~FtW45;KefNQxuDd3
zzdTvnHZ~+qVlHk=AJVaN<gxoA6oi3Qq^;KroBFWw0qI>?SEiWqFPiW#|E3ax6Ri$z
z7P9~{1mw7OfO}5}Z8O2?s!U_DgKaF)v=lS!rJ;)OjVe*bcKUQq=0P+~SMKun?;LZz
zBs9P0Qc7SL!Bi6VyxEPqt4j=F5x&D)YnxptMw{1m-Q_zSp@oy08JWU!ZY(yr>SYUv
zq0*u4>juQ#M0U#XZ`EZDiyRJ)r`TUaJPTc|q^>&514%VjJ`d&+)kk=P8_mzSw+z!a
zMaV&;7MtuMy;qrs_Y&XgUBp^H16qN&LZ=IMLd;#t;;%l1WoK#o2P-?q9l&azRi6fE
z@Z0fW=V!O%v#)FuTBAGg5pfC@>1}<7G7sR%h7=O?llk@cb%^5&(aZLGgy)l}dTgOa
z`kO<GB$mVf57$5_zeG9dG5QbVF*x=K@`BgDTmJSl+hp5&e^1`@(@&PgQ_hlw(@vE$
z`=60Ndmv~vt6Bd+mqUYaPxrJA2Z})o_Uc}C$DUXwv9?aMk`;0`R`<ARE_)8F%Hnc|
zZ5=oxZH$yfY0Jo`I?$)R6Z9CKg9@1v9wkY~AJx}#zbDJ{jtqJ*Zr6&H{vKoi%Ix*E
z8QU%k3lXYhKGk!mQO1g<!WpW7!V4fJB!jcjnz&Psb4j>>wt^Yt>5@&+Xj1U<jM>1`
zPcJeq%$DBGO?UwH$%5`tVcV6p$vS2Bi*qeD@(M+3xXU9?3uQz&u){!iLuu!r7qI`f
zumCWb=?wrADv8FO&}OnA<!90+;zsJkVbnI;QA-iLG=*Z})&{!)=L$eYSJt5V%bDis
z>NVtEEvRU*xF}u#HU?G|(vd!LD~dJ}eQj^PrR>Pp`;=2nIUXsCq(xTA;o;e=Ry)Fx
zV<l(fE-l9rc3e)BqntX0i@h?wnclNF@d=b&{gP&JN+V$RaK^2r<K@`n7v<=1y8?`W
zP<?IP@izJOOa4xd`QcZ|ul>Q#$i}Dt|MK21%;ev1-5~G&FMlDQxpjx&RN>Gva*vY}
zo_d@#t69ymg%-~KSOLXVvVqJ)ZJ9)ojR>_7y;v)}H{yi;v2eB+O=IqlAT9@|UZ*qY
z8xo2)Ado<L5Eg?V2eTN7A1!^*pRq~>1M(b$$V@qQST-Dwz~(SwrJHxez(kuZYAYhb
z-GXks5G+8>u0OXx$%3I?Y`ztVzTRP(EYY&!3Yy)pqYr%!DuX?Y6%0$)y!m3SSz<s9
zc1dA~@?<8kp@P(WfD%~<Knz%BEa9R75353GnGZ`PcmO&aZmZ}>;ZnGtGb^m4KnfM$
z+9Z?pDN;GvKBC|Q#=(xGS67-16MAZcfzSREY@tw}grx{nFBq+Zv12>3(je4<8$%OV
z3`e<aq<S4W6p3)YP-dj>i#k4M#b)|}L#@BA=@&DtT&iMb+Qsa&;r-~zc!tQ7oaVp;
zMc;<KDeHv8hSEi4z<ORDbHIwjHrwQ6Ir|ys%j1^TWcw#SEZ09+w~!5G@2*|)mH+!z
zdE2M&lQnOX9N~>+ZN~vw@gFNsIrqq~fBmj~av(cdPIzojHXWtEpFcxRJ#9%&?B64|
ze?`8twHwDiT24P}QQDoc?9%hvwRcrU2lmSNz8!Mw#+h>Ai;tIPHS0h6a;SIkDW=0i
ze4te}<PbvJz?2Q_xwQ#9W^g+QBNkx-GUjs8--j(8qNC8;qM1ciQUlOyw`pz;v!IE#
zaS&RZ<~Eju&x0!wFbJbf0hH!YXG2_JSm-i^5^}}1mg8oVSZP~}+Igq|oq84vGgEPv
zQ-~lmp!JwuoXiRi48swg=18!Eat!P!Yt+qrGAT_84i*H46x0%O{Y=Q<;eKIiMe93(
zVnVK7c^>8M1yEQ415!*3yoCTc{q<;Owj!aHI%oPG7+H9nx#AGF$;<1(xWF}k!C6uA
z$pAu%VO;TsJ8nUh3unsc&4rs)Qe?s;XAByX&54W@gl4HjfNO^)&4&ULPbQ96@&<>r
zDAenRXBVJWf1TF#;J~X0-~dn#b}PWc<QOw_-Hv;hi8GeuoS**ha_n=*3hr$wNB7Fj
zAN{y|@y1ozkY!nX;7iZCM1Ji#r$|r#j&+YsWcsN!*>U@Qa{HY($Ukp+lwAA^uaP%A
zYsi=0_JP;Q`?g&x@A}K9$jhGfGjhq+7s&I9p7>fCyyc2d%MBa)qON@VYhuU##S32~
zFFx)W@<SWi6I;JquKnzl^0BX6D<A*s6Xic&`f7Q@nQMIcoge*u`G*^BmEC(|dD7#4
zRDOD}S&q2!GxDJ?+$+s$)+2cVgt`hoh%)g*hX&>#O;JRnTb2Z2G=X_7kcoB&<_;O<
z?hxfdXn}bxU;>QBQOUy|4-Z?+_CnwR;LB3Onu4lCp}P@s4v{P(z!J2f62+JwIW@XW
z=(;Z4L{UQoG6KwyL`jzlF*9Aip8mx=65fN7AIfxKV<<O*1wo<bQDotAU>6&7P?x<R
zp1^*b7s&rAv?m0Kcx7(ssExrj15G(!XpfI3U;v4vUi><gd9KfMacb9kGr}#!l#wQa
zaBEi%I(;yP8Ng+3_MGWe@PNPqzl4+%OfNyuu_7jHrsxJ=`xoQacsc<4fr2rEKm)G}
z>Va*}eK`bXQx%pJx!_yEIXIqKp-^HEP7Av#JZU&K#0}~TODs;96Y&Cm`8e0RvIW^4
z2L$#9uR|-33wM4f`*y9!>iS4~g1h978$KtW`@+p~_r}53WRfTQ<jxy!lO4e^a^gIc
zwG&z0`4ze5vtO25?%k(sc_gcQ_DZ5RtQz4sBiVENwQ~2`Sa#mG%6?;}Wr*q8F1hX6
ztK}N)bKRRh=-5*`ACXnrdFxl@?p<p#Eyl94>n_=T`wrQk9DMy=x#QYxvSXqwYv-!|
z!_hLd_9mzJ+_n9(YsX!3$Bw<SvipEcwTbK1=d<swZF29*nyif~8Y++1c9W&uwRbGd
zYStrlVZWJc2lBXJ7scw8W8}hh%#jEcJMPy|0Y>Jt3UL}#-l6Bw!3frPoXrJ3z)2py
zu-LmxbJjqG4tq8T5B5ce=JFL?nc$#N<R-8~I|%|0=Uo@hRimV!$!*Isc{z{~<ullI
zfE7TFj=3dD;F0>9Tip_yI>Zf*=b251ZnFJBk9`|3m7q4i<p6L-6GA$$udX{X)5|+*
zfMMN$R`@s}IRA187f~a0qPJmPh%M5}K(5MD@p&=k_XqYx)`l{r7fGn#GZ`ml<_lS+
z{)|x~FnWTz&^dVi%D8xAb3P?tmTRsLisTT$ZCKiT6A`5X^(1<CaQX<L;s7vm;Mp;c
zE!qn^6nLOa*@k(sf~2;?*yD>ckM0_v%mDCNY$_X^x2NDdjTKN+Pv#bdrP9mCC(5;J
zZS6b85BV3VS<Pxzv%VMW!FF>1o8uNc@}uFGWUkxM_DM$3gv$ZooVIz`BLO%;yCtJ>
zN`Xed3!A&D9x$#L)C(*K;4Ur>XMACz+aL7hz8(8yX%2NMBSYAa%ep)XasZtHexIP9
zg1w$~NNDmsE5EsANoNWC2d0r0U<3sRJV}b^>Pydh0twg_00#k*IWM@*^-7`c^Vw7@
zX<_d&e#D3CyK4^Uo|AFYN9hs#3CfWeIWC2%5OGsbVuZ<J7=@DRXU2JH&hd4Lk}+PT
zne^g*_<UPVCk<S1SQ`M_T$W3)L*nriLJzTF=zcG-QYrGVtZYkqi|dEG6Y8rRj^jK6
z>bw=ph)(J7CVP$n-2H8-(wHOe^i-RUeuO87l4V7d1+_iMIW7-hwq8r5wZ{^Gt4|#`
zCS5w*2ArDJtY#fL3&X!4EPOr(QNbozn(LBNkMN_62hi#FA*?I7-@?8RUV|RI3YB%C
zY6b8@<;kgy%t3-cUZ8oHX=SA-DZnr@cYOhX5t@V&`(~h(J#5xA6mV>##$+=#_!)+g
z^^FNn(Bto+4Z#2z-P83%@avpOmk|LCmK@{pM8O2E5Fux`ptb|eX?4t*BA)6+MID)9
za93GWl0z`z(m5W02ev~Ob}}#5z)AmiGMduvKGSn4oPr<*#R_Jk;9rGVEA+qe%ppsJ
z{y(SVhsU`Aq&I^>wLxo1X%%QG*03-$ln^J%f^q~(qU6ZF7W#G`1sN!%vLsjsPx1?d
z&sOddG|9Ly(G4pq&|!EU>gUX+`uZFX1`d4?nF*~Qr~OE2p_ivmAplx{+T0w3DR7xT
z+@<i%YF4uzN$a2-9=U}<+eB(viD1c!Bm$%ayk(+{2>UOqVOpWWUJdsQ&Z?rn6&RU8
zY6id$qe_05a5mOLhl@Io3mS=%b79zwQB_N(R>6b%+GlyooalLAfQjqmQX=hA8$ifD
z!KMrK2V~`F6uDJS8;-65$#C6<ktfrU3}Eww3a8_77Awh8suf8d&?iCyi1_S(Masxl
z$CdQ7?03Xmq`;s(gITV?;?a2+8@Lyk`cLtJLJl<Y92z_7O{>iBuM=303Ga1z8**v2
zJ4`SJ5W9$dE=sz|V>YT}3Q0u|!i=sO3NA2nRB%C=(t(nrge!5uIj~kQl6a)&rpN2F
zP^xs;w<{DNBhO{oah4UF00)a~>9wV>&MLL+H$TuXbEcm+mD$+kteT77ADroZh&*hN
z8T1S+uGP^p>Y833GtVBO1IW#4R<jPfg<?`tJH2BN8RocnK%b?Si`b$vpdtZ-`8iyc
zI@(_9^dZd4S?V((njMEZxwPU_GNY{}ha0oQL=Du!kmXfX1>KCmvN-yL=oF@UILLvl
zbmJDf`l4o87O8BoJ_cE%C%smW@g37yrZvh~PYkBG4r$<YIwpVs=t5;FaQ#I}Nu?k#
z9*#{_66wAiR?Kl>hE{<Lsu@ATugsZ#eN@QWMx_@koU_WZoa}C<p9huWRH4?_UBA+U
zkMulZWpPI>&dYqiuZ++m7(z-21_)l)>V|Z|XzTyxbu@|CePUi0{CZsl=7BaGL8bCZ
zLO}#(*Wefew{|E7r+O~2GQGJ7ElH8S(nc^ms4wBvQ7KRj<^x%t_hg}4$$Y2KK3OG;
zbFh!fWIEn2Wjx{tK<<>BVaO)R;wpfiPq7FF`et#)awo(YolYca>PnVNvzpbcW*rg>
zz%iMix}`lWeTZLZDZs$pM~RLD8$8|Puot$w7P#xcht-42h3<t}NVD_mU|2BJ;9}J$
zh&;SN!BF>iRJ>9I4r4o~ry*<sbuV;~wA_|%r^m9PuLt)b@vhibaw!n#v|7q23K{BV
zj$~exzc6D2Q9_zgmPPUWOivo~O^fp_1)7w7pq5@htN;>XBD!kH24=OCS+zr#Ac&L4
zY!_ynz`o|Rw}d+a6h(guAdC>mN;ht(Rq$t==|V_kj@hwNmJ}e+Q=5#(5~JCN+$&`_
z?La|Fk)Yjyg~*80-I$+h^?e0I3ziHNK;gR4?)7D3Wu%{zkkt+5911mt8!=0baL4F&
ztbQ6R0Ck{tRGK`?X1D}eQbnM?l;->F&9R-QOlchx;(8&l<=+@46sSx_IrF+qJt>^~
zVkQ{uQc^Q0#?#CCY9ifkAV(}JfNkg-N7AfjHLF?w?hB;gsKt&%&O{P@$VQGJ)P0!g
zMTHGWwNJ~4NItF#kL?&dkXL>JkpR;`;Ff`w5)9T+0rTjxP{?dF(fzSa7o-`orx+IO
zaX$rPC?Jqi64O(Vgh;T`r+U9d{w3@OCDT+(VpE#DVpeIYz=JYd3wBI;1m7HSxiKTg
z1HGpMy4iNRXuzd3(Zz=E29b<LDXi!9<sn&9i*~}P9J_f=0b(e_;f#tASWJQG#WN^T
zEUFpxQl~Hg0W<4uhMysFLCo&Sk~S4U0H~oy)&`W1k>ABMWMwt<7}lEy;Da;0XD;?b
z+*}3VuClEla%i_S9*<;k`3U+5=DB{3qrEb{wj^`e!#XG^!4NWT0ZhUNb1kw%-^&P2
zSyh)YDXb`|d|X`A8z-j9#Fu~uWJ<t?Lx_UEmK2BMT$YzTvcgpFHOj4{QKGK_<%*<P
z&1zP&{=FAe);kZ3WwDESStU0eB`OfFO=8L5h7r5w?FvVYK0IM(TI$QF3NN)G6`}OT
zv8$?{S5<-oA)5a2f|e79<5VKuYxia_h|mg^;z@~MV-)IgL}9tQ*E__81l2V-uDhIz
zQlRMDEER^qT&G2q;7ChlQieS7f~t;^EDSSJU>OiEFaQzEqn&Z;d8{V^Cg*C2uM=7%
zJ%9?bNhDl)iq7-8@uLn}5Ohj{*QVtT8Cag=jIalyPo`R$EPPt$x7$i5$5Vn)x93vA
zKbzHASqO^+6O4tdDK8@}305p=&a^ZMQ3iYtA;h4`Ej$ku)r&kPTN|ye(K5>M%?ZPS
zO_cr`|Hn8NC}k9UA@fA3v}ANkz&}SB5w7_rDl`SmWE#t)fU&P*GjND@@f=etV)$9F
zCsIIN)Gs>86E-&63iJRhYj1sHRpH^2j@+zfHS3YEXs4@ygCzTSqOA>(3lM}3%p@v4
zki)mOtTOI#NV}h(3(-%Zv3lke78j)~tJe-W--UgWeX;_Tx|nQiuB!l5T2g(5P+qiu
z5FV-6k<O;d)EwzAw9sp-<3uo*)v_=}EC?$w5Y}qD=2iiLLuqmMVaqXXerYi+P{$8?
zZ5a&}u#`FYx}o>`EzW}_amoZ>08<<Og6WiM5j5ZmZQ40yVBwIJ%`{o^Z%I2Rd>$l{
zQ)F8C5wpMmh!8G>kmI9g=2TRqpd^W#5c;LeEf16}CJI8192nZ*TF|!WXPY*zXthLV
z52d<rIz~?nCCdudf)Hn<E@!Q9KcHGfS20nbgsVu&3@<HFDkG!0Z*9*%i*vehaL!p7
z>=8?mjJ06~p@-|4YLn^9`X1O&p^i&sj44c+ffm+d2GwC}`P8gtHS3YK%%fIlGJ(A?
z)fPt^DaDnUqt7WzYB?#ROWGmww>*aDLLMI>;>ri<$*34)V!dmTQ#cN4W6%u5x=%0Y
z-k8lYR`c4dhzYR)bH6aT@O2-@JeXfqW@K9xkQ)~4-+)D+e}m!LmNFkm;vGykCpOE3
zDQPmU(4(71<RWo6p;01gn{eI$6N0S0%|T$(>w^=G)>G;9%&{FaQP`dVK8P)WOGcSF
zgia4LWnL)b^+Zc^7=X4^O(;_6ok)iaWmo#&G%gud7U^psZWwLMI4c0%f56FZ_*N8T
zbNGx<Z#V{fQ63$%9fl18Ad%Eu7CybO@YK+b%z~<_v>DkCIY>Ow@?ZiPzW%y92r2Og
zFv0A%14W^-EHG6BN5(v!0#d51uuro^{nBzWrb2smV6m7FgUl3_L9kPZV-PCYt~_a0
zvzpbcLt^2{TKDq8p5c{!Iqc12CJD+1v`KO#d%&YLHf7m-w<R08pFz!C(VoxYz6nAE
z6`yBrgv6VU?$KSBVNtq=!{i~SmESCLsgdv$f0*5c$dp!>ay&NPa1aOuI3$Z1smf-F
zXr}~0f*<hbXsqR~St?mcQ7FzRQlPG{A0+iGSj7*bqlNE~q4<iPbK3XGnHyrpi5N};
zXkeSpwD$z*qpP(|P*3#k(2Se3^fg|_(p`jtAl|1tec+f)6U8n1zLsbGBpwZ=Mg^yC
z;L?VQliR{MXsTUsBOQ8Qd7Kf*(!{KwFnhq1XW`U0o-}YSF#CnWJOSGU)6y=QS8}+T
z_D!{ARjx>dUqjB1z-F+?(nSroV4uyaeHpC~h<dNbrxF~G_n)&~jU2vN&1%-6v#?`9
z4-omW6mdZ}_(}l>c25pQmGXk50>ZhReyjx*=jcZj8JjQ6;3AmhHWLi~hLNKl_C5u`
zHs-{%6@zgnRO6tmMjMD@%uvfiKsXiZ3Va|RQ+RbV?e}bW7U{!2gAPm1YrzDO`uVzx
zBW94nau^zIfnQR(h##Pzh0PkJI1HVQ<B~{A3n)xS*FcF9BBbf~3~v1Jqbh0^2LPJJ
zyj{rkI^u|)Y>d`OH`|cxi_lG@gaIz(lsFxL6AW;>0WFnKQf$#lqvW|H%5LD`j`_E+
zvZQ4U3FBB8uHIOOls&qC5DsNXSTfR)nA6;u1h9MxJ+eFeXFa?6IABqQrF4d^NRNk-
zsF^~dJcu%*gTZFrmx6O`CC{lar;#$Jcmqhuco%tirNWjrO5MXc1EpEbYSzE!LiMS9
z7!S&xf(a^15a4C&mb?)J5%)gCJwb@UhyL1A5I@KKE%wS#%Y`s?z#d7`;#pEW-m|iv
zOS^}3dXMEq3^YTS*K66(GTve$!In%WiQ-cN#^tcL0?O8Iw+SW(ff1WNQht*ZWCByb
z^{}#I*;QOsNjZ3_%xXGK*}rLdW~T(3MF<;E5@YEPibTB_3?NekLNi?Rvcd{{^X((N
zf)?iHaoB4)L|P6M!-SVI411aNjY^gp0Y=E&YDJlTPD+<{ptNXt&L=ApT1yd0D(i7&
zw71f8Pqg%>jlnLh<RQkWDB(oUs@D#94eUMHOgI@B7$ww)8Jdo8f!F(k1ZVsQAHtj_
zkq&(vA<g#)?j_5z2elXYqT#DZPerAqN?v&_=Em`@7l5+yE^Jn_n)SV0*y|8!1s3G_
zmZb$_^nxn$iU#6lG@<<|?cbv!2dh9ZGQ>==Wt1P(Nm%6zdoaiW=6L<KC1M1A!H6l$
zcfrkw9`cN+H%mh3B!C%ym0Ldth%ik`&O({#wjLDhW>T={1IHvVA@NF<6(LygJlI7A
zb}<48WJ;x9M>lEox6ptZw49oe2qln9eWd+P6@ddb?I7ESeF)Ta*ubID2jhVxKFhVY
zwAhwhp9s7P?&>DqptK!Ggd0RPVL|qS8;PK?Hd2_YoNgHKIs~x6+Nq;A2gZ)nL;$!%
z2rdwU3<h-7(uSgeB3LNE3Jfs|DrRrNzADcO6KLedj9{n>c{{EVY!lA;W3WXBU>e!X
zf$!4R3PKM6l}ljr=wDcAJs3|g6)nGVJ}~@iGEF9vi8QNO&1%;7cIiGFgxZQx@Y3EB
z2mwTCNNqrCsRb~rIDMu2c}}eaN{0|%!1@XMX2lebvNp{XR_;IwmKQBS#LexYy>yH;
zIHgtY;1faER2+b20X~O5<cqLa0^32xN(^S9C)J6p*ECJ7XOpEBoz20h&<g@U>Ap(`
zh!Pf1e#u-d08UZ(GA(k>KecKH^td#(hG_Z%fCyHn7l;dEJPI}bg`u`%iOQ`uGF>na
z1|SNg-!asNd|cen5I@hz+|U#RC}G}gV<WbCGKfAxA+SzU>!p=si!Rw*7*+Jl^0X<q
z*tRmA9JDPF`(oggHJ#{FM5td*TW@$Cay|h=)@f2%(2Qf=hzWAN+}uDEH##@5N=a5&
zu<z&9zK|fS0s4PAD0RZ8391yq?n+Y{Hmh09YSy8!ASlC_5`<{*8!Quh2#47?0SgA|
zzNOEHs4D5++vUDqka?l!54n5cSY(KSS4nJeohcJK;+adeHI&-egR{)iM~rDW6meiV
zjDJ!Hn<;x(*D@c32kpRNnJ=AXWCqxf6(jT{Gh;i<lRD_O?rSMeKV17W(>OJGx1PX^
zy&nZX-=)#+By(uIJKyza=LDVzQHJZ)N<zrq3(EjQX%cl&^np<41cXe-Q?jhG(AuV-
zbMv2Q-)%CB=?e&Em8E9+<j}gw`b_{b8aDbq!4_&4fFo{r0w&~SEc=DTNoxX*6?}%1
zf)|O|EVy=nStg8wwkjje4dqohztiKe_DiJj20c31`v*2`jQT8wk?{ppH6Af*rpze{
z32W0yczKP+_9WAQR<oMbtV3yG&q6DNEC{o^p|5*g$SM;OkGm1tECstsU5p38Y+S2z
zaMN>xI;8`JKLwvEv)C%97NIdz*R%b%-3~}*#-q&a|3GfA*DHAdW&mG+A^yCwn6Wa4
z^|8ptv=FW236$F--MnYxF|CPMdV?e$AFP``)Nkl51xja7vjhu*-_&fRU;(9`Ug)Md
z%eI0A5{z#*VS`5bOhEujzjUn3X_7Lj7z+;cHqTXYcFd1Za!VOw((l7qw_x82jXU(Y
z!q6^)!IhW?!!)*n4lI-6bjBMM)d7{R>(!kp;h*tl2L=01ICsGN((*tKtW7AnuP~uq
z8MVdvftpVB8-R!d3D0dU8)i@f_I!fUK?R`ehHN(CMniA`Y5r8Nabck?MV8TF9>d$1
z0H;-dD*UoK?TB^TBR1ilWgNV7oCdv`)vRV6DhuOBE~`l?Qs&u2ak&>`V@(wYVy&_v
zs2F=_p1K@ZUK*Gs;BcgSvhIgoWM&p%RH#UyZ?>>7&<<2AYvY(n_fCb`SW8s)xyRS`
zc!jAGeUu8<hZEKjmpTrG8IZGcplkspKqY;p0!r+27;HF<IV&|-=vdDSvseN-y3#z|
zppQ6qLDmioY3;N&)QwsxU7k7uw<k~gLZdX5aR$R)*mk&b+z|tblqQabGnt#~(En=R
z`iNqKb}NuUKa_ZN%2FSMBPc1(4LY=za?^w}RbVyqy+9E=($b|uWR_Xqt5yTzhEHK(
ztl&22`!eWQ4h%pJxsgM?=DAKNJ9mwwJ?F~$I#iAUzp4Xc?U!k}a$_}>V~^>`?me+K
z2NPOO!E|tbuFrci(HrhDg+;;D6_)w{MmTSXMKZl^gj>$dwI%2Z?X408K`^$V-nY#P
zSgn>h(mQTsGjHESaM6e{n$@gkeXrI-JM&ajNu%@?(fO~XEt!<c!R4iv%<KL&o1(lF
zvOk5r`N+*3S=~RBV~*%)B`;>~A_k3s0niJ~b%pc7o|1qy1-iD6Ou~YRAE{R9QmsPG
zEAXM<xVnyg7a^51J#J6Di%xMabG<s0kxmvy1(U>LNMJATR0)L=j$;e~8!~`4G)<y1
zkcjhM8>3X4bS2T!gY4Y1Fh`sKu%pm&UI@wwhl{|qlws}rY)nMfbOW#alJ6@DLs~TH
zP_n~&M&p7CztxqQWO2^E5p{Rk_)BJ}sg?v&%t`gS0ofg9teBA%Sl!gO78Y%*V)UmF
zEUCvwbPE^~N`9~{>4b1_*FKiApl-_oDnV<()&>YjbBKdvT_|s&bP0(Ilz@=@LsE~M
z73+CI$bs|3pK;!;%sCVBHT7v_y}^(vofNB}u6ujBAUkIP%ZU$O4RAH9S<U*lTG(&q
zw1oHgXt$Y9=q3#}BZwB}l}KQZ$HRMBm`H7^l{3uW9$1eVHHG#J*_o0HsLat8f+L0l
z+);871R+(1v!c#c)D53zyj39k*K^swmeJJ-RX)6bI@8t>{5QPN=g=-nStzm5F<#HB
z)op93YeF}7Y^>R|v|6VN-$E^&<rN3SFgUz1s%pjo1zkrse;{z8n|H~~scr`#7%58U
zil`=?@AVWkrox<-C@48lTm=?n2_{7&#+Jj{DyD}4Bz|DP1EBDce-*h_Vk{X9V{R1?
zi+Gq%sFeBmoVTL;2Z75F!%<)yClFvj<)YV)D3=yI3`^cbD)t?-W||eTR35UnU<)<X
zFC~&uoJptaauAy1d9;UzXQKIUq1_khuh-VV+8nA9;ZF#P9r$*Q5VS<>e^s0ZqXGv&
zh<fm>nayfevzm2iEU>VN5|bc88U{w0GPX%7-5YHV*SUXx1Dl#nb5ovIHU<T0JNye7
z*Tl4V3?y4B{K{Ia`!E2}Wmymw>6mMU<IqCSqxr=|-<uaUcD1}b2M<|z23DLc!iEY}
zoKyMQpE2k4l{H5O2!%{y_PE-5vIr6bu(`Bp3fYTVn2RWLN11Utji~~}1|GFbmhb{9
z5-M3<h?tS(>hZyF;z`b0D1;TW%xa$yh~T2p@Wba!wS?B`n<dhEY_1oDV=>VfSi=)R
zga)933(m3A?MghJ3a0?_uc=>r$A+X!eqKeHKRzH*AS#_ytF1_2)?;IiD>vCDN_d@4
z$Qvp8C6#cAkCoXegCl66Cl}SO8F~*nt3?GR7+jz|H=lW8X_^u^52_9E`C%7S4N=!{
z*wE|i>Ajhn(h{>@&1zP&nsq2FREc0r&MZdXvbm7n?$)G+MhpsE>*IoztUgAFknpbi
z9a=V-wvQ-;3j?Oovxg5b)BSFKsV9jNB#6b)|BpGmY=g=Osf2+AJ_E;ZQPBvop3*na
zKUi*HFpPt<P~hpN949tU1qMd-TVP?6hM0)rs94rQ84QEA8)H2%(vOu%U{j}EZe_`q
zaJAsDvDP$`T&bl3M7y$+gH$nBwu0sxt|!BM8$hQt%O!vk%5ylMT$vKeg1#40nP*l~
z9sv_W!I<pMk+TI=pq_J18z#q`GT;gyn1wIed?;@wU|Ra2y>=nBaF9;{G(mK02jS8L
z98f?4*fPBzusMN8qGxEtrw*Ji^1*z5VFjNmz$Q`l1Q><EL4Yebw2dLXs9jO;0v||N
z{No(G+NP>m&1zP&4vB@~V2(n$wDijgOQMGi9yWC}v8yb%3v;pEj>CkFnLe<${g5-b
ztyaZ75<)e+7q3M%Eh|#924sh&Bpz|d7zy;D#|juCs}i^wDbq`pIJh_v?1(s9<ko#B
z%pBDqgV`hWS@3)GgUZ_B9KQwwq#>`C)4+ZplSdpqvQq$b#r;vtj!jnUpVdb20()AN
z=peaocUvso!3n7nOUFdt2cCj3rA5!I$V@^%n!;+ydPo3T5F9i9_3LvKmK=k?r1kVI
z#4r~`{-yPjP%q{Ac*edENtQb{4L(ya9*rxT6>ycJYVR#aQxPsrp2v6<n0r8&QlJJ3
ztEbWuJ2B%1>nevJW-%+tEFtjWO94>f!N9d)HM^G(xbRx_+Qt@p?bH6hVO-5>R<jPB
z6=!Bb4rYYCwcT;(k2KXX-dOkLWR^2NsvVgNMqU;57*oo=7L?y08=h+l#T=Rk-KVoS
z<{a(->T$;cc>}-Vdj<O-_I1bS+!t~pA)NP-b_`a4Xpa<*<TVQ-@W3-LE?Kt1iP96V
zc6OjM5@e4Ax{?xbC=W5y1u$^5E(y^G04@Tux;C^7_{8v<U%Bj$!ALkOjIFqi8S|pf
ziBcf|1B@nTtbIX>3Uq_G9iJ1`{iL)I1BRBF+hQR)1-4Cazvp~eeQem})5$ou8G`wK
zz*6aOhS6n*U<3;)Qd1WOA|-zg;Pdr79M8lQIIqQ?XJ(O(&9;%P(F)7X5mr*TWwb~s
z%)1eb<wAfo{0<AakLYLXy<1(?|Lr(5m_!ru@LWg9sZV;e9Md@<_g%M5?)YXY&c~fC
z&-}he$!QB?x##9>a@Ey$$cFrDS0L^FW8@i^JXY5J{@rrj3XDDF-+l#c>7Vgzx#THF
zi)`E=ANh>P>1Q7$@y%DsSGKz{zxB~_+@_h_^O>u^`8{b?vkuY4Vq0mEOCfqvg1)@5
zC~Gs>UWi0wn6Y~fT!M6uhbb?TG0@+F)n8<`fwT{FEBo_SNw9)JFHC%?M{sOT76yVK
zIf3HIpsSU(Y=#o00t@DxpvBLj$5-~G=mxnqHgOD^(bJDE?ye1hLCas5TQ8Uhya2<N
z(35JS??cLEQfE-Xt18q!PEd!4vE)cCqHZvXS{Ozv($rkm;q~Vmi^9G=qjJS3V}lwG
zwjoOkx=}@NvCp~Tx9ANBAkC>n0Z>kn=K|dcqD?UE4d24bnuQE{%uH?$P=@0>UgMS4
z18Xa5>UUvhrN`5=Y+=@mw)~zcVrW@X@Js7;9F`9cs{HT;;g}@Oq_?m>acN}*=7|Al
zWPG8g1(u6)DtcQO){`QjPZuW5%hDLx;kgvJo_MZ2<LO)F<o-8*-I+i1JUQ>&v*gLA
zEz4Xllu*8%1>ibUp7V;A$~nt$a?#^H^9SW|r*4)(Apb_Iqvvp%oc;V4$qUZeB3m{O
z^zZpV`tysjIN#NOUv^K<d(Kn7#XV_Ov%dWW-_qq}{kJqX_gy#M#va$x(pQ<ofW6{8
zEl2?NDa^%U-)yxU?vIF*^0it8!3Jkn>;Iy5sILjgx+(`TR7P%K-HMDY_}GeTmA{g4
zTRzi5X5*5k>U3oS4(aFmIpx;{-6JyH=tr|k+HDrO^njIgd;OYmm<t81KXNb%mm57;
zO%RoqakYl56g_!NL7PE_9=C)cqHgxS_^p;n$y+7OY2#TeeaOXim(LI^rZ<D-y-I55
zVMS@*QWjIXedx{Wm~5Oqw8CT0&G$=6=gZuuZ4ydxCFZ&Uz2K=i5#ypc&<1J-MipRq
zxFA!6;=BvB45CoLgT>08OlOAJ(5=HZ1!DrDe=%HsA>)}jXt)GhU%cF-wUh66WTwqX
zlv>ft!aV}JgWv<;@71ggiPCiaa9g~up|W3?OBS`6?<0GiEa!gzsnWjlFXi2T`(e5K
zPWdja$I7{vTrBg~{GGh-Z}!Sf>+)}~6u4TClZ&1?kQ?6cI(gkc*`MCN{ov2fk~5`Q
z&HCOhIQE=z#u>7(uppoR{O4u={{0Wj_5I<lBr|OQL~t!7G_Z04iJ?OuDp~+Bi~%VK
zwUimfDME;g`<YX(Z}xc8xK?6wpxI0ra@{-K(4iJUXnSFMJ46~2eSN2u%N&g#G6od;
z4w_#KwJceO3?XhvF!AimcmmPDOgddfKP~+w)08YM!h9BTR`jOK>0|9IEm#H{=u<P)
zBLJNZ?bpopN@Xu%>JnyBO?l#Al$@AW0GQ2OB6O!M`gGdi#=pKc(sQxq9A?SZC#5Ve
zM&_M3jR~M=>fuX)oj#ZpnuX(WO2yt0n>zaYoaMq^uadqV92QU`J^#|5nUxbudM>>U
z3k9pGHvPgXBPiofL46^!$CuT{ESH;8fKtv}HX1P~Hyom`g&Z<iJwaB38$aa}1$-J|
zUji$vnLZ4(x(@xgXs!!JnU%E<mqh}!TY9gD*0d{;#4Lx=Qg*R<Q;%lNRXV4C$sX{u
z=R$E3-T!mUHLUNNNqft@v}C9(RUa_Cd3|sgO6v8r&fU|$U-f&Fb=kF|e`gdJmbUbz
zoQ`EWoM<U9VEAX`>fgu71Mif+?&t-<$YQ%QCre99GDwFqoMsPk(ss;jUC(8{XETBN
z-3>=WnIs;M-^S#8f*HJA&v`|r^>x~FrhbRXn8Wi*xAb%S;%6H&Ot#48!G7604D9&(
z_exSc=%XL<p6KzVS<U+P7t9XucmCxse>s2usZV`MHa7nC#rKC=C<ns$VR0#xojVh)
zMb$onj<rv)QDbkTC54BWl*BR<TaoUssl}Tx{n(;R=oGINrpd%o<2{&1<SwQ3t`dq~
zKjOSD9`Y9#eD24nu%VRL8|bcGW;Qs6J`il1x^0IWzVCpl!Qx0i$ce?(H$+hW!F8fQ
z|EHy!ZOIaz>ltf9_$25c29F1wT>rsp<1ROF2pqF>Lb(iuwqxg8vZ3?^??<B!H(-N+
zl~dGFlv>lQd=4$obzBYr=L!PoLqSM^i-!jx1rf@)5KB_(g+*Gnbm71bhJ)c`2rDpP
zTvUumiQpLs!AO?!wNN}R&IkOt!#EYsnungvdbK*ZX}Up9E8R3p)>z?W51cx3Q%iec
z1;Z=XSEn2k$l-*qKkw?(z`TCRY1U$4)cS-zRfAY4A7WS!RC#@<U$Q=N4CX!Bp1=<3
zuyTAl<z@1_Z@yU0)Qx!jna{|MUM_dtQU9#9Nj5+6XXG9F^P~9(SIQgD|E!$++dnSP
zc+!b7|D-3$(;jz*oc69im%rYAv|RF=Z<m)nzJBkOua)yJyIjHRsq*8$Z7k~YzyE}M
ze*ej`^%)n+i(a}UxBkW(<OBEb_|KMKdiyKoiJRtm+zZcnpS<NS{#M@lky{_)q@OLX
z{EL^!<lQ&QnJ;{%oO0rkl3)K`dB2{=n?CN#(WhM?zx0+1MXnY(_uRYWwOd~)mmmLP
z`Q_hviJW`-k<!y6+<nDc<nP|`kMafYBKdD`f0>+v!~XHd<?Od#EH8W8N%Et={XFS@
z<PYT^KJlQBuJ6g)^qw4l|2?@({!zi}fHbRF-`*OJ$MXL7zh5?Q-Yl<p#Vhz{|MXA)
zq!0Vw`6CgkSiPP;a0zm;EP^Ua;Vl@lZ8MwBBxM9{&V9Be*5(;)q|)hBO!62*sgCxK
z?zw&7j1|9>OrRtdDmEn2Yr7o9$_oqj#b=;p)Cyrklu5teQbL6m58T~ReRHjsG{gLp
zf>hkjC|KwX+Ek7Nx>LhwHy-Co-7>mUboD~k*AmjaLf_v~AQ>r0I1$tzC7t671)oHL
zWI9UNs9T;7WygWc6pVTeT?K-*^;9OKijgUpnx5-;(nCbaG?%rRCtZ{XF><U-q@zHB
z7!(-cf&row7bqJXO%i2>Ed{zn#_M{Vp353)gaKs5quETaL2qzN>0X&sEXj3xIA$Uq
z7}Tt!y%VkrAf70&!7aqqavy*f_h)HY*mQLDxMTgisXlSH#ngz9z(Wa$Qsly>fed%A
zN<K@p9vkRQSBeW3#s((Zge4o9Ssmxn>v?Q)R!(j`L4DBoQ#nl5Me;}Qxm2caJYQb=
zkGo{@eXo+A{qbkXDZ1ldCCACBXIvn!xa<UZ@AJ3H+W=-4{gJ%wg?Gyzy#9~nz;C_y
z0bqn<?UFzEiLLSn%7y?ef3)rA<j2prTK?qo5BFR?B(FbzDnI=v2TO&Y_!gzYW8~r=
zyIFqk)tAaAR!)}-e)hR??u9=p=WlzTY}bE!e%_H|xBsGSedR5@&dc8X)6)CsugI%j
zeT`h5>-FOGKhu)rjejk_cK!i*-8-Kl_x|F`<W0BOu^)PU?Vfz{;;r^t-jh@0x(~*3
z;JzlNrdi+Fdh1)?s@0&O{M1kV6o3ESVP5E4<+T4>Ug{|TWh5b(qwTaX%H!8=NfosS
zlZ}$eB8x{X$}EXl3Bz6onZclK(NT$#jdr&$%ZNZ3jkL{Qk<_eD#r$NWf+J3B6JcZu
zNgCMmeYhY&cVG9gP;=~Sxeib_)e_;-{G6g)LcRTTJmE=ov_S`yMI!Qej7D9=2$O88
z<*s=j9<fqlR!W;|n2{=~nEf+=NYI82QYxDieD<zSWPUDU=$PwQ%ydCs7UYf)cR)ps
z6NUZK@_b*`Hil$Dh=|5eTbg?87eRgwOTuto7$BMZ2V<V~X3T_&#{di}x0n{de4(J!
zQ-FlbeqGCRDHxxY^=6gH`vYZ~kac!E>o=7gEUvWFh`>nYeCSJM!bT${@t8db&|`BM
zb#m{WE3(it6{X`CNYBA=SDz@*6YGR{ABL}?l+5U2?*&labU6%QKJ$l3kLxif$%*&8
zU4HjtW7(y2Ve;`$%e5!Xi@!;KHrJQd@h8e-Ha%I+`@lB&<%93J`dVpy>>&_k`BZt*
zCBG?ezn^m5Bkz&#aBX^uocE%ikpKRQACS$mt|hrEl-;~uAr5PYyytiSRKBo%ua=|l
zlk2WMN#-86MK&EN3S2P!yh}d$v0LuH&SQgX<(jLse0eYa;N$nd{wQG7T@Uko9(YgQ
zvrR5N_~*PQX!JF})vWJ)z3W}?lB174S}wixQfBsDe);9{oh%wbOb~&Ui<3o?DrjLY
z3tE6UEzJf{_ssd8LqO_wVW{B9+P<MIELR+Zg24h9)<{c^PEpY{sEU=T>HgY^S`udt
z+fL)yDrAfOKzs$YuKu?$XkphUS(%~o24x>pgwcEQUB)7#T-QeG@F=E-AIt*h=Q?!H
zu)3y41jVl*+@L9LA5IvVqNMprVbexg%y-P*2w>!v=->E!FC_3uk}7kVk>PZqIDu>&
zqKnLuGZ%UR^R`?CKjxG{_KsOF-Td1jz{2D3u`6bkFSXZI29Scet)6d6mkVWHEsp{S
z^uByF0WkuAYtw$iOxY7yP*)ij&J|Wsnd^{&F+K)ONW`}|Hv5I%9@tY`duPZO%d>=K
zRR`k%Gnc{@05_N_SRw|C^BfNVcw*3A8vwZl-~;V$>-m^K1m}UF?p7E+f}|PivbO6Z
z^7fzkf910W|44gRqv@07DGz*E{}kE!{XZlZ9e0hq;r!R?Yfq4uz5UfP&gDB>E7!^A
z|K@i2@ehSx>nA<r3y;)Z<&yRY^dFXdub17EztMYg|8~NAl1a0g_1##{d*1Wp@sEGJ
zyz`y!lx^F#$#=RSoDM_V%b_yw=!1TudtayBqB%pQPx9~|Owp@?p#>D_BrHfShM|Jb
zkX`J#ZriEdh0JtfO#utA)PrCSEUn{Hm_gkI)ZF^B$z)8CoJs0kIv=t}1wFmXSzVW#
zJnWvt%h+2AbVHuaVoDaJmVP5Y3YJZ@<R~ik#U{!i0s;z>feSiZpkITOWyrxNx(n@F
zRq6-u3tBAWp}g5qV1d^}0$Dt6P&*)qj<k0)En(6t1SClFeS}$tLID66V2StWc>%q_
zR7yH<Sl$(6@~sHoe-%LvURW&Exk4kzL;~KpmcH(Y<-T5%^}p~r#r>*5VF?q_(~x+&
zo_z+u3!o21hhxGR7$sK7`4Pg2oHEpUVV{NaB7`20xqBQw22f=jv_s>v-|OrB6&@R<
zMnAOg;;>lv?2_G^FOa7{sVB>GB1>m!zv_%fDGUf=03_X$%6jxDdEygY*|lqz{kJmJ
zr>+MfQg2?uO~=TI)r#D_cfafkPLM|}LD+*I?v<6bj^3BH^auLe<BpQ~(@xfM<il9n
zB%Z7vki7>#`|Csy%X0eGW3>^i|M-?plB16eWU;tMw%_{D*Lfg2Sx$ItPc|JTxKKIu
zv?V#Qe~;Y$6?ypU0r%u-PYoV)Pa5EA)_1-DS}%Oz3+2<F{<M7VbDxua`}WCqV`2Xs
zjS80h5*mgVG}p~oG4hlNITWJx5#n3Y&0H&Z`e%t*IKiX>^FOfkgChon8nBTXXf+Bh
z@d?n5?In+{L>S2erfjSyl*1FB0$BP*a2E17P?i=YH&_%6k^CEIzop-Dnd%#PB}E$4
zP(Y`TDQFli!cqxR@4Vu0SVnbRz|9^~NoFKwrCBL?W_C-$=KEwmsD+~GM>qO3C$d%w
z4nXa)PD^Iua$>{6y~sCZN>vhIFt-r;KE)*mkCm18`!AWFB9b=se<!*rfC=I~PVLZ+
zkVu4HdS0CnS#c;0KQXy_QBd*d1{FcOU^KPMp<(2H2`9mYGYznK0(iCce4suY7Y+p(
z1%oIZz9(=)DjLC5p_0LuktjHhHfAg_BDFaP%%`wCTn3P*pO-)X$cyCHUi@F>*k?}V
zz)D+|2C<CsZzbC!_uh83yzhO-$$x(7tK|((8rpmA{HVP3AKG7koDD74-M2^L=l&=8
zx!*cNhWZqikNGessKb5w>h1EVbDk+b_RCL}AK2fP?y;?Jz?{A!+wcBydG_OeRQ_{o
zPCod_&&d@x?*2w6FXgE}Dlh+)=gWqFv<$Kv<<2jDTE42tw(t<w`L4fwoV@H=KO>iH
zeSthrU*WIcB)44gX}JOIgRVTh^?-Zw%eW_Ju07zM+#tJF8*O2;zP%M{rRIrGd?G>X
zv!DGefot#Hz27BCJoej22}NvHfJ!7BdR3sVlymRnATn(ATzJ}6)CFL!7AYAn#)Mqk
z|FzIY&sUrkd}=*}O6u#l#{vW3Fa(2MxHIL9-n9pM8v$lD&o2}}@Z=8$1#1nI(;UWq
zc+%?*w4ArjO|;dHsJ|a80Hh2H3#6wf)`6pXQ4%e?ePu`bBn>r4q-8Xawiv3#s`jPQ
zlkc@G?Xn%1TRR$hp4QUJ0xSkXiHxsh<b7d)k^xZlDr3hy{NRoOsio^Gu(hotM8%+%
z2iG<d=EXqmhaOgf8_EDnk27TE5RZgn#H<uD*M&>GJ^_yt-k7W?Y#xC_$0gl1O3bQ-
z1^ZG_6c88j^ng-dRawcDf{p~Yu#owIvdaW>S{}g^5`U;CQ3%F+UB)Q86k*`nkk5q}
z0L(Bb5haKpJ|?^O$`{`DM)~8%ENjzM`-Ho9%j}=E+&0`V`?bqDORkmAzi%qeeaC-o
zZ$AL-+z$E3TmM|T>vzj8)aK$nvg4}v${$zv$nkBxSJVCS;j2C=liSDo9ZqD&r`{nS
z-g~kfy{Levja)ePuPVr|?bRl+TrKZ>-5we5#`nEju73BMWq9(@vKVidoh#oA2&Qu1
z^`DiSQ3db<8ST17?%jU79FUGoZvBM3`+wdb)7@XY&Kp1cHu>{=PLSh{=qp#B$;w@~
z%U!o`m)#hG9$l@kzvBU~|B7DUP_J*F+^0{C>sNe0_T5;>o(J3$(R<SSx_i>BW_|k$
zb6ksyi*n_aSIWmf{&9lV!MOYH#)2=b7rC@{!n_vUG8}uzXWIz-Y-q~!(X?bLMwJ-w
zz&sZbQ22jS-SZMYyt~|6rzymK5CNu4k{8FqBP)&znQataOUtODq_p07=LMY#R!i6>
z;oyLiLxvRC6cmAQ;>G5TD383zSUyWqGrbLI25V00h(;L<Tp6y!Y`{4|B#4+oQ4*()
znkAx83TAwD6;v`#S&w22@OI7ruu6!^fp1nx!!cNrOXda-Ka|@1I#dgrySP?&#rb7Q
zMd3WWe<juP2w;q_B|BjjSVEIuBqICl-QgzVoX~57$fUr4Tv5kIgFU)tM}<I0ycX6|
zJbwkJ#l=9MG+Y^v4Cu^*w<5EnhoWBZK!Iy@3Z+LN1317lD=f2z1F_fRSNH<VVGF7p
zk6?u_9!i}Lt)48O+t<~nmH1!$1#0rRz8mWzx$NUFk;(7;vi$9r_DUn>Yu4eu09?l&
zd#pa!jbwFo_1k7z4-S$<U+aYBj{MxFZRU2Q$AyV56x|gAGHgGkF`g%^psgKH9O;%E
zSt@dud59c!(mifGtGI9Wx;{xr45EYFM<jAcJ(^X2Hq6&KlC0#4^P$RgP?7UttAPwD
z2oZrQIB5tSV$pJ5HkCFaOfb8psECZKjy4_Ou#Ti*%t&Q=rf}bw?;>NXWPb<@YnmV?
zM4Nc9JPIn77<0X#&~=%(T!4|lJCH6I2|=S3)XwaMxx%9a2h|>oL};w;W}L!ic{4P7
zCs0-}!pbw6+V47y8L2YQK&7hc;6^JydNrFvEfy*m)KL3<NZ>OvLeDiIr0F}Rz;lOB
z0cq+ITrjnbK|dHfp%$AK_LW7RInP5FGEHl5NJg(9HpMltam*E@68oazaDpBfzM3@4
z=wXQ8!AZn@#5-p+t69zZZZ4Ri-*wl+mAC%u7K=mxDLmLCK$zfy3Dtr^H^%zvK1nm(
z5}*Vp3}J>Aoq$kTQvku9XNe+0qXD+2BA?>8v~=r$-GY%**#Bvl2l5doy4Sj_OwHD3
z^o?cdswxcaAb0?~7-|!_#d)PvT5tiTtAxuko*61y#0eZV3O$KZn{~rUCY$El3;=6`
zGQy(@6w9UaB3}>3bz0QV6d(ejI|d~5v7#UBKLBiS#=yQEwgR#cZ0cZOVaH=w8B~z8
zZvvwO$dwiQa(Gj>6AFAMz-9na1;rP^{XM0FIa~POg9FECF4`<wNkIp_5i4U`=!=1Y
zV&J%~Wx^OzO=WM0A%SZ~$-Y>{^TN<G9N=;67ObptUmKPg!#OM7i-HYKT2irYE2P3W
z_e8%@4Avpf3t*S!hpWl%;j&g_=dE9r;ej!q_?p$MW_{xY;F@Wbsn-hy#_UzC(*rYd
ztn<OP4;UE6puouBg}1R@aNqS6%^<=<)e3|Fdo%O{s9s^D35gg}q>v~+Ald}`K0ROa
zg6$!UQi0ilFyZt3ILTP{3tW>Q;=@7fz^1?}s$NS<1)?yrO&P?DVhI{yI7~-2nYZ?K
z`aUtZ<Oc0=qX&aS|BE(Hw0%kx2q6n}+1CmgTaVXx21Xv}VOjeGn*0)o95Qc9FP45G
zm2?OI=9@^sivrq*XyugZys4HYp?U-yw<3q<fmy7oHgtrGMFIz76iG{$gUyBZn!u)T
zLs^Oxi>Ic$JR(|3`-ZYnA%hUVPpE=~<A_r~DS(}ow6sDQv!J_tMH#(Ar6kIe)7bpD
z;0f97xMZ@K_Rso#mm>o7sdo++S>fTjJ}ZCrUp_0%YF4uz-okzg7mQ96(oDR_Z7+t=
z69j%}=Rkcuh2N{|&<7TKGfIbO>7XnK4ugsq5;O2Jn4d59h4z9zkMHxrzwmQD)MJ0o
zQ-`W?*gs)h3;B=cF6BD+J6U8ECYN)Ty`bbkpd=I?7zmCPT(mvM@*L<Q`ZlADm<=|#
zbo=<3@<Wshv8W2Es#+OlC9;0cml(2NMdM75ohewrA2IYRUKoxE+K9nurUUb0Tl#rE
zgCPM3bRC9T5s8zE&;@40kYk0I6y5m2&`@ZDe_+4gk(mP8a3dj;LAj2lzB+5H+jZ&Q
z(ekV`2W4bcvnVJbqo_?weM&jYnch51J4aF=30j+IsNtry)RSYwV2Y8;(j>$dm<7Y-
z!|DWc4469$qS|N|B|)bng?=%5I#xoh^SJQyW;Lr>%{mkoI7_eZn7!Rlt8WT8@Kp7}
zk`*~%NU9a1O!v874-eykiA9z$0~`>jKy(<o>y_MN^W0`**H&gU91pyXOva_X&T;FM
z4COewht6RD*|9h%L}vNz@StFzWa4iDOuYkhCT$yT9ox>twr677Ht*OrC-%fnCbn(c
z_QW>tSYMuZ?_Kr%fv&EuzPiuuYaQ#b<meU0#s2yB*Uq9+RDhargkCnZwq@i3D<M9Q
z(Z-$Pp@emgRXhKq+>axFXwHF^0#URKp&wb6S3=uK^zTnXq$0fa3rvhiieCwBk3p5E
zse}CB<Fuxl9qzG*2mAlV&&*g)p6O>yq5m=iq4EScvWN0liV>iMVRB#)sSG7=LBUih
zNG~QCXa;Zi*v>8ooUAwtSm=T&0T~C}MW&91lof{-BJ*_Ai4tB^7nOkMe`ic5h^le;
zL&|;Ag913Cun83gDdxvLb#{)FLP-+|>|D@6&5z)il1-gnGkkUQOi-#DvX~&)M{izR
zZ1a2n?~;lHxiV!&(`$8?vho)WEajKqBPnqW;4_T|>GTzn{QULn@qAJ|au%*n5@nrI
zO%XNv<{0&jl2L7$7!y)QBbyH>LtB(UQ*2{_$w+{`yzfLC1%QH)YoZFe8G_BQUk6NZ
zS<uNMidSPXob`QIn(zcnkylmP#yLX#^-twg4h82j0i`OcHJX9P-n63I;TpA-qITMO
zPO8sPGNRzrE!E(1kuRZP$f9#X!0v$H6C4>HG)bDg2t+NolbeKxNa`@BA7*4~e#lap
z_A>0{RJHmCN9t#$pOKS$egr2d?O7t+66r?-haI+<H2(qf8J2vpmP*_xdvq+4UWgK!
z_E%us6Z)}Qi>WHcqc0WEU=%-z;nHCXoIzV_<l4hu_sCkn#FZYQfAFXz&ZrB9ZHd11
zqOh)D6L0Ydn}Trqk7Jj36^?~ZCgFFX6B4o?r%Be0rhTn`U1Ukh>Kd{}{S~52Qf_2O
zSJQ<64u&dT%Ss;Et0yAW+h5$hCq}wI2L<Wiz<vim!4>QV;tz$Icm6NSVK>(tY7Q(A
zV-7J8Khvhdgr4nH_QYALgSZ?_kane#YV~T~ETh1t@E^PjIMTxbn|OwYl8lZfdj~{Z
zAA%Z06qPSuFF1Fk{6v8VI22s6{!Z?G-EJ5z2x}vpZ-Z!H%3}^xyxlX6OoAeAKL)m|
z$_B`?Tp1M5gxwXWOH48Y921N!0|bYG*5cLX`Zs7{dOJ95`{PN<<PZX&cum8##30F3
z{_f)Bug+Qj`(sVlFhOUUq<sX`VGNpGF2;nu<W`h>rL>e_v**m1uYm`y6gd?eeW9Gm
zB$2)p?L~Z(G}{#?cLCmYoX7RRbgEPLUlJw%qb9l&A$89h<B1cTI>Y>Gjig8ciZ@vy
zC{s`1F*t}v|LT9+Pp;|n=Ek}RKymfI({By5(ev3!JblQwP~o+kyLF&+on}WGd$9N5
z)d?Iq`dR1OQlyqWfr_Y6e~E9y$#H~Z2{Xh#VCd0`sY8V2`HW)7tkQsTLeO@Ei}bKi
z>m0JWTglHk>rVtzdqcLL4|p1*aH*ah#z^%aCygPzW`l(c{4i6H337=K`<Z2hR#c#Z
z_c-NpZ-0s?1hqoRP-jaRPXC~1=AJhR<%WKWctTSV#8p#~)9@u|!}@}9b%zTIA2bRg
zBYEa%2Lh+dMxI$l8hUO?6YIu9p;fT&O@G@I7zhXqHN<J6IYq|sKk{ZURk1CHS6YU^
zb4_NU5EI1ve6gdDU`%E$G0--M#kMS{gFb#~u4r11Q^2|O%LG6M0f1njRt52aTjKJ4
z60Vwu8UIZ@UZPA#b`Ll=r8+fx{xXQYqEEL=f0W<!nR|+^At}xmr24j2EJ~429fceT
z8bOdqMhXIdkjXMHZPq!9jQyF(7BFjaqCf>W+=G)bCpwDnW)~cQ<^)Vi5HaFD56lmj
zXo|~Vo)$;O*_|Zr(SVF=I;FI7e(4l@89Df%&>|)xS^W(URUOCq9wf<7gruNzgjSh_
zCXgfCv8XE+kk4oi2ORI`UlnVGAj;ohv<G|Z3~mPdAewS1E1+4I)u(=xo2bGnC;vrz
z(Eu5b{OMvxa?toJBn0!rA7Gw#HN1o0i9I&~))MF{327L4J&TVMi2M^#h?eD)pmq7}
zo?tM~!V}#Hj=^0%j0QcGgUMn|MIf~u=_g$u%!7vo<lc-ooHpKmB;16iJ?H5!s4H>w
z%hTlfSg^;nVilwcrIhPe*Re%w>5%`iDt|)mh(N%R&;O2=*rIF8l0e(YWW<Ae)Q*(k
zVPRQbNOH1^<`J&TY7N0*ByFMO^`XtUqsiAErHj1#b5!pK7-DJ{Igjqu5;d=5UIJ&u
z@8FB6bvzMN5e7^=USrprP7D(qW5$5j6vuH$UY{hIHdrIl_tIQepd{fZcw89njmaT`
zN-&%JSzJD{8g*u6VRLd>BK;V#)V>JLU`k>w0M3p~)|%YKu7h`+(Amglof)p=BaOoq
zQ!y4L$SX8m#-mrh^y%U(a7p8&4SHy((P45qK8{+xQvBVH5GTTejKm0Eku)g>GCZtd
z>|p0j!E78`39yKTGQt9KI$2^yrMUi^pVeX!R7*i+pOXxLc#6hniF`Km?Or=nk2N=`
zsQvUmxVe)sxE6{$78p}DO8<-bn5i{^D-N-vCI|rP;a_+(am>u6{C7BDG@klRBT)G0
zpX*5DS`fj*=KUwKaBQ$vY%$l547Vfud7?D}fUBd)H#30wOzdJ#QROh?9AVx|s%ZIX
zTWYL%aSy4s;>ye+{xCP1cz0Vr_(-(Jh=j-#F-D5hwm}?PbY|4p{_r3-Nu?nzgYpMX
zXUHMqzf8p6D$wLS`vk4!WQh*yk<i&4lilx)Qf^j|I>-`_?R;sFPEnVPeJuQ=hjU%V
zRA^ewJCi+TZx<w)@CGd@_TYOky1^-@6LQ@<0e?oyE@j9COWiu?P$sZy0!z!`KA7%7
zLBhlPYF~cq`q#qRJVf4bj+^w8D9<d|ipiQd%I?<RNICqI-QyS$rZi7%!~c5=zq%VF
zs|5p6{An@DjTE;H-K+Sfk_qy-De;r*VNF-&FD*$z3{rsuLw+&)BrJmk_HhzR?38~L
z$NIr}Ss;7GK`N--2K0#_NOZJ-d=Q)mZ6a=ljGc_&M4)IV+qnTyON71)={wfc;fBn>
z765n%7cByudE6NKH)dH$-F&=LT^obzrj6k-xfj{kFh8@@^|$X&t&NjjgN1ajC=SLc
zDmkiozZ5fq_{y@%$=^P`G%&=`H9kB*Ci74mlw3_p3D1%9_io2JA9&C(h&;%Y?1Z<6
zz^kzz-vXo%r3J13BC-wp#Dbq%iOh%}nDyxWy@dvtFZ34NBc_E^<6S(P*`eA&RQhf;
z^Cb=lqKli-zmV;M&ms$Vgz$yR1o6zd|1x)qTE$R<x>miulT}ss#JvMskZN2A%M5$c
zrR&3z$fA~2De0;^A1FXa^C~&q-rixAF!JI%*?s>ozf9{US*95lx6p9<Xbr>a33E;(
z+dfeCqD#6@?nOlJa;iCv=L>iGR7_4aW&JA$>eM0zTCttbY)QOK9xojR!=9*aOu=Pc
z%|HmqGa#6j0p3CeY&yN_PcH~_S}4O>csYR|{``ke+36crw+p+iF8%O<%S5oF;ySyD
znzJEb-(!t;7C6XGUS+xlrWguz!(jNHSf8IZ5|tY@(aW(KpSwRkLspW48x#mskZ7lj
z1Ssq{PDB#JpWBe#KNNq62fXwv0ld**HO6MTCx0;uEs(?*V~iO|L8M}TO(qz~m#(DI
zy~$c!dE+d>#q#K6Yjq4neV2OcTqo(+Z<1_VYI16PVQ?K^6qvf*H#x0*Mj#*$jg|w5
zH|40t(Pu0s0<5c3GM5iKTDoOMu5z4WY&NsTOrE-&{yl!&{W>@EF_#!yoAFMHu6YmM
zU=e)~`<{4ebXFU79+7Tw>FjdJk&3(%D9l3P6ZRWE3J!%J3s8c_0wCcAd|`Ng43MjY
z?SzJTmyV+9LH_c(5{3svI+sx5djwKN!Ix?p*E(pe^|Ilao#^G!gx<3-2^#Q<B`C6L
zZI`Ac2L55M-~cF!GYw{?*keh(wsakOySzivf$M-z663D^0koD<{gNTaBT!^+%sar<
zWpuLMAjwja$%jLVNi%InAvO#^E)LemPx!fe0ZQzz#LVtf%Ta8aLB)qkFdS`Z^e8<U
zRaRAif{o}7r<qD!uN^I=TNf5ePme&s^Xs1@ZK?ql`MZyJZx66P+PO=c*1%N{4B1u=
z_;p_qc}3PRC`?B}e(K&t1+^2y_V{(OUh@Qd*jL~DkKsPj4tR=i%fb)NJD`aayTqs7
z+`WV5`SLVnoz9s^ubIfh^pz%irMB~GCn_`bm+@E+NWPZ7Nkw=54_R)<iR_f%gOls2
zlcMdVV%v1*wHn`Bp75cPC^1KXBlYs@>H4th3#>JpIJI;4*yL>}Cs)P~TzAUrhTFo6
zA9qL_*XadhdL8Fc-vUv0Hyeu+s~)}!494Gp0GRztjcYuBhV6&kEa+x$afssMrBrK6
z$}89o@+Z=Kc7F32csiH`W!#3yYJ4xCIR&HNwJUhKJGitL|6e>BK3(Qnv)n2(_^-fN
zfSR%}GPszBRGtqkAYc<Mfi7=NA_Rp9X@Z)WNOJLCyv%_tD)|_pa$aVKX8LTMX1s?w
ziUoBg$bMi@d;aq)wW*~toMvnqb5O)ET(zM4=<cp&0JlZPpesaVVDNd}djuXV)$7lO
z1Zr=464oKG=?Ksh;&~8}!6|ow#FKsTVdj5gTx=j|mX^pviZy^q_~|_KHT)mE9blJ1
z4?8@i3ItpRxRR?*oE;&r_Eau3)HG+46ROt(sxk%6L4>BCVQT3&2dSgiU#g71Z#N85
z6t1-6!82!)sqkA!K$QcpldgR(pP^qaH9mvz=jqm%ylY<QUaG7QI(oX{N06Xq5=ye`
z=p`7g5_!H;>aQzI+{h%G9$Uu2s+FdF#5Q#XA&#Ws)5^ZW5|kP;bw;&2XiUQukOdj*
z1TrL!qw~2ZkFrZuw%HF(rQZ1^-Zb-neAf|%9ZiMXbE`8<kEGz8mcYhJnWuEqlJIf3
z@k=mF>8F}ZIkU!m?B%tj#GfM83IX9bC>(-oG92Cqg^e(9)s<BW5MZK%9xgfzz6P`f
zmc_CoUJ3|Ng;|6<sg{;yQ^R;r*)k^nd5$Hy5v;h29)=dfJ)YX5^TM&7`ta}sVq2;P
z8VNL%1<{k03qj>9c|tdz-o{)<CozXEc{xSL9Dk4KS038ejT4iQNaEB(wO1}4*6Zt1
zXsbhho?*h#2me|^u@d+FD3-H@Y|-5&8aoRJE*d)YG)T}!g<XaYAzow&;>!7osy`E)
zv4%J#1>r2ic>wz-0>wCh%T-?3f-`ot$z}U?OCIQr8I6R_^&T-YHpkO4aRn9-)BdPW
zvvQqmMj(9tj4hzi?!HM<ap{UH{k^AYOK$-Iw)wWK!v35WVbM}a3n`?7qwNasT~gzH
z<Do_qi#Ph7Kl%v{r`BzWo+~av^t;mg*Wx+2=DRB?F5SsPDvL#B7mEjB3@tAGoU8_A
zSu$lEl`$p4TYHVElqotzroQCUWk6^f=9?b)r9@R#6`f|Ig);n*=i&nlMpFARyN}JG
zyuV7xV`(`C2%6WEYkORMhl^L3nsP2eSRpL`-BM+CVx&p&C~vh2%Rp{I5k*(4YNpp~
zc8t9shd|gxHBCCArhLcwtW4bjLYlrwQRZ=Bg7NoR+prfjh%2Rap%-_2q)d4@I(Y3#
z{U!lyx_t%wVr3fTq2n_r0-uXkpz-w4<gdb)<UIeiaDKOzr1DrM2s1`iZwbIu<4Ok}
z=^|}aRjs23cK><m(<ojec(yTd(wCXEvf@@|)&+73G`nwe3)%agP){Te82g@}J0048
zHFusJ_mKCzq#7jHBFma&35YajKPBG1)$|C)m^q$Vd0sAmdqJHdd7plN#=O6KmQ2L2
zBX_+;wv29f?b{!WU+{V!X6iFx+cdWrysTF_tsTy!X!z|YOMPCre=|&Va&~b46O>LI
z9_znDXf3Y{o_8FOeeL^rejIv)g@{mcL?23(WD}QUdlgpxM^k-ueCloiZ}q<JHWWP5
zJ1-S}t50t%CZ=rAYIGicjbqzikMA?`>qSm%Q`fwV#E&-omTCUjaBF++zjTTq^nRbK
z8JAL6rH$n~R~@?+aHEaV@zd0Qnl>Np>Un1MTwrh`lzDr-dq#JgpxS<BfB84V<un=P
zC+xS6DUf^I#dzLP9mkRV<@FNBE3W^r`!qTv5d{Qp@BRPPynTtfext_wKXN>m3l2xg
zj(ZM&bsrVRjuZJ<B@Qy*znh&a)g-ihoenv@`zQ?Oct*WXXMTzE2dtZX@O4Y|jJ#Hq
z_29)PpEew(Zu!+s8r-`(y=?y$=I{C9<a*1GIuv8lOVIhfk9gP2lg;oSCImzzJ<f8@
z={(20PP|=UOn_(P*O0%AxM;fyy8HbFbiE7HkZM5M6`M;#3ngQhsISg#>^xXN@nxMp
z@0uhWj>oER&Tt|UxnZVthM(XskY^_1RboG+{<Ge=QT*Ju1h?dpQojLn52?u`blTO3
zYvoMdS73C!u!VeCsE$mg;4)2ZkrZC8&Ha}KoJK2UB64z`Dw*bji#a~MzFrnNW1ym@
z_N7w3#8lZuEZ%O$6c=d&aWXQ6z`>hI_H*hkpOor?w_ZvXIOQDWdPR)`M*j9UE@;-6
z0o81s>bo4u8?HeJJ`m9~a9wr4EcU5reR4qb7qv|X`pJ+v917?rbFmiz2!7RJycJw>
z7)3~GT*C~FKM=}GcjdSe$4h^dVBp1z_c~e@)mc5xaBo%it<uIwmwIE?tEStGSI&|i
zp-!^o9A!}hsc?Lh8?H7Rte|Z_=t{Xx(%UcA1|FF@E##h-nxo1FR^wftqp`1hz{pop
zzwN>3<pwr&?91<K>27PnMaApq=lh(~<3bLZz{{TU*4ukk{lmq*>AAI--<4Wy{AZM(
zcy^+%s^3S^Ok9;t%lPkCCi`S}LQc7u*KRh`1%Y?4FNCkIJCRi!qGv7hF-Rt_2wv0E
z`@80xewG|E?9bt3r(x?YO0QKf0y1oyHmR-K9(_uk-)Bz;o7R~Jw+i0HyblIhEnvNw
zGl@D(-r1cy_<YL>zLMR!Nw+Z9UY^?mTl8zr`ji6PHJMlTQJs(d9AgZDtDJm~&N@z;
z20ilG&Yv~oI@g*hBf8H8cYFIpXWjT@5|^(so<lOfwHV(NX{owS!Va}cwi&->US73k
zT2=LdC7{>eYGAlFVD-v4{0vX#%KP2~A&mC6#oDjWSGw#khU#0EyZV(ZI)j&ynbFs2
z@a?^{k%^*6rr*!`_lFy)U+F&0-tD}XNfHwUFMRs+0$+)l2Sk2CGar>D<I7Roj8vbG
zVTZ>#ty)k4ywR?mS*;)6MQ06uQlG@!dNKB=Pxs}=cV0OkDu@;YNbt6p)NM}}8A^LG
zpI8|F4$(Q8?v^ox!o9_Kb~VPktrjDInL!V<KoUdvB|K3CY_}v;mw$|P#j{~<r5(GJ
z3KB>o#_+J~t+$PZPqsR@psmg*AinL*R9u+;idG;N(YqF0vhhfu`gkH9pKU-8prRD~
zq`v+b;eCl>Dn6*EUS@jW8H5ta_+OL!qM<<9akIMO$o1qfxt_h-yg|Ao{j_a>*lA&+
z^$V-JX)cA-qR?(NOHJl$J6MACbY~Xky)JlNQ&SoeE@z3uv^nrY)!U_Z1{uhvJ>H0t
z1Pct)Ml~IXNnurq<dxn6j!ow6+M#ARL!<NRHQbKu{Hsr)=BlkMQiUc(S{a6!O>A(G
z%t`r7i?U`JWKI6e6*)WzUFLJVrgdIr9V^wOHrHBLbjohU2!;?6LKZ_<Bj7(r^1QAw
zASL3yk~qNjd!@J|O9h&~=KUL5^Qq*01QI2ce4J`Iv4~>+7311lkBxX50<ZrHVM@^G
zajAK~cGsiO5E*CBKI1zZOTpGB{c`>`e@}T|zoZg1cuGw`lWFxhmuxi4{m!|Jo6``W
zCh9o-^Ico=>YW>P5wG9}Y;d~P>kw1#q2;;em2=Cf%;^yO4HOi18h5Ox;1nlxUNabj
zbg*;$H_zwLq<fo}c{ps{GWM>u&D8VSLqyTieT#i~_qJU);y3bk5M|IN68d%(S7XB?
zmm+VFA}4Vcd*yvIb`_6T^N-P(p=BbT^V<0ER>3bN>pq4k#h_24;&)5TbL7=(PN#-j
z_I<@&sLbQUb>|!RTKCs(snf*|4P+Z?y^rA)kMRjVz3J}#>w~ABcG@?n?XxtVL%yCj
z_BKyf>IS9_YWL5Q#Dm}|+jJhWr=Y1<`-k2tr~8N2<5#`SJcPTmoTLQ~&*IvT6zdY*
zhf|(Ob=wtvErGL_yL~2Avur<6ewWS2pXUym-xa|!<BhqW!`)HxzUf>(%wasC=r2CA
z=20W3^9?9H5{0nGR&;EuVlCk)iJ310fa(FKeG6{WQ&eM#m;oV{%}m#trSUDB!qq~|
z)+?VO-{r7(yfg0Bzs6*L0DlXKV4mO#F;eBN>@FD4e;&Aku@qg!C7x4uwx=Yra7EDE
z&FYF6v8smBWRaIAIJty#2%8udjko59`yT{7gws43J)@g#Y|+HeSngCTx`=5_W`M;8
zog9V#;m*Ug2VleAz{)h(j91k_F0yB$b!g=obRbeChoqg}vxOEbT@4O$9FO^=^0DG0
zyQ)&-HsH*ChbSh~u#Ah~%XLA9@qHNe;J6*IK}FfB=8%qVLZ%x{&Q=9~_98r`gQm0p
zL<Bd45o5NE>BfSfGBqQ`*-jm>FlF7S;5mAIJ21}qN6y46l2fZ7dB|^13T^k6=JWit
z#bm(yJpa&PvNFvyk<+;g$90-@Jieg+NOnio!B3gfb*FN7s?e>a@4mz0G-&)=Z0qx}
zd*h~A=1^}%V8>Y3TX=xpz)?{z&2E(Xk;tLPi50-9vOjUW4IA!E*x3gq8QUT9d5Zj{
z&fnv_RQPtAak0@RW7bvm>aI;^BEfX>Qa!pNnM25v%>vm$p9;Ko(Rh93izT}27_YMG
zgQA{(^S|gmwR>6A5uhbkZTs~7aXrWPF>!aMp-ZDP{Z8^S)APcXu<^`s7faM5-0e`~
zlc;83{Q9RFwa25r^O+)6efk0YE<?qDcz&Inil6}5y2L)^v^!7T!#?2ynfu7Ywscc>
z_hSl`DenvBHZIa5TTrH}A&5h`5B`bQWA(R$^Tf`;x@U;b&esO50r!X0U18L3ozEv{
z`=ko~XLZkQcFX0wPJH-;EK4T14~C1Nzs(X=;73gsNJ@npI!XZ|?+Xr<Z@AHP&x!^K
zt$-fUrayKPH;h1EHg<`|h{su{86RguqySa4i%is!N*^>#2Qp^9%{FkPk9;ObT9{#w
zmpuqtv`xv58}#7xs+2BbIrA84%X?}3vn4XI)n3e`q{%t7GHLK)LgVA7#!l>zXXK!!
z2n3}BmG%`_6-#3{oiD@vE`ZDEOQg2okDneuqw&DXvZ_PH4G0J}^>$pr_kce{>tBJ{
zA*~UNkSLpWI_eT!=CzdLF(4NDe2WMv!3%qXZm@Zf(|og^i4Oi%MU(ImS!wRzY~XiO
zQ=VBQAY_%}l3y(5`2FDF1%2TdhqV;+m+4B(7g_X~X0E@djr)5h?zQ18`nPb8W=@3B
zNcIZ%CUF;8;xdJ2QC(+~cx5ZurnwEKx9=U>oMNY5xP)|i6c})kM_BJ&_w5))m7n<A
zpqM;**ZuC1*4P%kSGrXF96mX@?D~?&nt2Y}XD;Fy_61{j9#RiZOYGy_f4_i|CjW_l
zgh<9EXd;&&DCya5k?J?jrc~hmbZdKwJuql-yG~p(Qet;?n;>Y}Bz51e`F7Z<5P4^1
zHMdIe--U6E?ZGp~H}C`H+hPQCk`m>)q>qxNBC@^@wwa*ctzp+^|JVLb>zva*j78uS
z=+<^5l<{c0auL^|(KP9FKzDe0pLwu)*bTNK+1=opqkDU_9gjBzkWHD1H|H;6x{A>`
zT)uoWxpP2fTW0TTS7$kjiQkvUYCE(07^#2J^?WU`Pv-f=|5*R1Z=Q=kWZnaGtKPHz
z-oRooqr8j5oH6O~dwP4>Jnk|+d{=21Jsn}Bb*PeVK-v`JS+3s;`aprb%bWTXZa?BG
zmSwVJJjeh?H@R!S9@f?h68vNNP^87)7v4Xdgb}Vtig6Kzd+Z{V-8-pgDjzP>cg}18
zpBg#ez>eqw%ikXvkoGf*8Zik_loW#>2r_QsVifjT)0mAB8mxo`L1#th9Em%i<S2=4
z%DK&A2%d&ua{G*(xp*kqD(><RmA25Iax<5&;ZNYckD}86BZ0Hy2ndtn3M?_zjKy81
z;4KL84PX9ub=572ETQ^Oe`*Mdnaaj?OC=nT+=Fnj3F@R%paI*syPr-x?}%d4%@~@q
zTHLuYMlNyM>f0<yMG}(dVg$y8m{K9?(w7X=aMl`N(@zov4oqc$*fhPtvHBO6BLZ`<
zXpa8LRsh$pXlw`8jk5u>L?@g|@Cm1@njWEPg1vxTx)DO9aod&8hWC5dm5J9*vK-D2
z$h%Ghk8g}vt10`k8F}=2+pS#p4ybZi+9ugP;%4G?$=_!05t!xHx8^ja5@Sd|4Vc(;
zy3{E)Fjm)Gs2Ts2)1@Etd+TWoUjLq&%Uq5K1d4C%xi@EAVC$`h_xfRG)S%}B!E@@~
zfTYK5Iuw6(mMS^f+cb8*<Sv}-p!Co0gr3hueb0-w9>%XjwYS4x_Wgj6PgC9((zcV5
z99n@59(}0vl*R66$2RSXg!;owA9dd?3Bp^Kmw1h@VqPq;6x~?YV~ImojvPjNk55Y<
zt*2FR){n)Ei}q_C0`-Bn>trUM8&HnJXF+-1R~#C<o<HED$limD-4b?fkKd4*<xJx7
z*^|%f7K*m{*!GwB3y@D+eX{tjY{oWKWtvNY@ulW?wC(L-_jVPsOU0Y;)#E$BgUxs8
z;<*RwJkM=JJhs^~{#Zj8Ip8_vwX^4@s)a%>9Z=g|Fk8uL?7~$lQ**J4zbwD1G5`~p
zn~=;|A#Eu($#lAMR(BZus5I=m><s2??gSFYWt*dk3ZCe|7WvcRo!TP8eatv$0)J#&
zV@c>*L@=6E2fIzh!EqKnbc8S%5;V+rN)GHeO3tG=3HjO{ns5lWmo_`i-Ud+^Zjr6e
z2L#S#5)kb?gqD}|0AAr2BjVpEWWGUO%TJAJ$s48lmh0BzuS(F+E^kSE{L<J-gou7>
zy@qx|2t@)4`k)4m9ro3yf+8}0`;#qE!auQlyX00~Y*`dKx|}qwLkMs>(jFBEMdZ>n
z>N%73HiVsp6jr2iRJ+)JPd!ON^n``<nEOxZAYr#Y_7F#>VPDmUxVNj*w3GNrUYNg&
z*MlpDENpUJ5z6Pi9%CS0R=lGAo-QYKM&CDR!)4o#fuU-m`!BQ$-V$`moTT`({mf;(
zEkzQ=L6+r<tLw2wlA|uu$~IS0Wec&6S2DuN)5IrFP0H`rQTDY7r9Z#g-iCD!vOiu6
z{Qz>s;q1LOn+|f1n;)1j$FZLc8`2E?pJvsIHGfBwpyrLW)?8C<dVIq!zPO8yLN7L(
z$`36{(;cq7?C9Q1OiNd4-Agv^hbj(V`RM9@_mBkvY91TfogNjkC>xmU6F)khCeGSf
zoA9c?_0(&W?lF$Mrm186ZTG|fOh$m`Gh{R+tl9>NOUa1r`NlrW!x_<!n-nWo)?)>!
zd|P-MQP%u#rfr8?OVFSb96XO49mCM{@(b6g1n%2ZJdLW)4~hX}8Q@M~kB@G$lL|Wc
zT>|c#H15~yWZoRhreD>V<$Y*f0tFui$#h?z#!d_E{2pp$>LSH^M`g`eXkEp6PS>^^
z<4YWy#gkSY7ukF#tLw+SUU?Ks$)oGpJO__Vzon`_=Y6*cQj^Vm6|f#NL*$7SPA~J7
zxCzIr1PqqgY8D5b$zi^<L3O*aYqg;`{v@a?h(~7q*zqT*N|E@*zKT<>D0a2(!z>=Z
zLj;e@tIfYxUm5O;&O=mgI1OzuTh$BZq)ndQ_;>EHJxW3mClHl}bhy#pJ-tFX{w^I6
z+CslL)3(U<7BpX)6tCLUg7h5$loKE-YD1UVR|LkzxLKM{!vqpelAQdai+VAiuq=nZ
z=?gUupqw-;^SJ93@L>eQCFv<iw}Zg-?0ZikOVMEsjuS=2|6qUC3xS5DNC!m+0dqDS
z9qk8&4^HfJ${DrKho4m4^%1U8+bbiLDuy@+loOkgPIc&Uw?#s7qr^O^+tNIUp0eDw
z@+Ht>Rc}FDm1*=w7@Zyk;{(I%#9Qm7pDcX}s-PM>ek8$Q^Be7v{8q8(Hz9oF(tmZF
z#(eKb5eQd!DK<fSe+L7(@5&3hO^^g&%Vo^YKmz-q?Y1wTh}V1lwoh}v5|$;HYw6Cg
z(4&76XI{Jc{7}b`)p&f-S3R7C6E3o2Z@^`l-ly$$0i1@x0pP&Yk5pG!*bAAt!|Dkr
zqW6}M8u`-!pfh}v#7i_oDB8J>!3p>mmxlQ8uzc+AoK41HTCip}dE>N?X|<<8X6nsB
z+t;r#i9f|)<+m!1i=^#tvWL1Is8`E9lh;)8#?RKxh3$|m`LHx~v?z`8on(GimuK}r
z2_C==XZ2FnpT9M2a0MU;484(nIcmxb9p@T^@pEb`;ZB8LN`X%zDj;H2kz)K2)CCh?
zv)k8JrX&rbAT1s$;%y|4>i-h14D7+cEOmvY{Gn;NP?xRye^kS8@Exc`-L6dVtvUa$
z4UMs(mX-VP>6^7pXw2|0?qr4JM6|*%e`>-8A_8)P(Foo?9W<E<z->wWNv1sDt?>?V
zB-P2!+`zBe6lqu;!3UaA#042+G|`yJCDPH*=*!|Vk05ZEV`ApTY!(|^p?%9(Hyh!#
zeE}A07KYOa1SS!<HhjvduH%&sYeCv+4LFG}F%$EKq9Bbh7X5KsAd8ARRgo0q&5ybH
z>XOU-PykEpQ<1-=opb}dNsq}^A$5GP9u8%-cp>yv+1YHJm|FQkGIjYVMx~AmB-AL<
zA9RHOBt%ed=`jK|bIGOu4k#(F=w8A?7@!Fz*$vmexXYCWZsEYp4Qux^)vnZB7K7Bc
zJ<N7;^A8!SMk|nwv9nqNog000%x8YKQHCvNSkc%Mb)oH3(p71F^<h1h3r_s5waS>@
zc^L;0<DV?h03*_DX_Usgd}U=T6U2iwgQIygPD0kRj%tl*vMpXn7zC}xIk(2L-D6`b
z+Vf|7oQ&3Q6?Y<r6Pg%OpyK+Y_qVq|6I2%b8yvkfwJ8^}nTrIQmM~;wKWnr`8B2GD
zq@zBVEr8IZ0Z@$V?vSE3+Ng|#c|}v+7WE>+;KOkXcZL7SOP^_0WSf#s!T8Q%#`zOr
zQ6F}1vO(4;V<l_nUkB^|usu1Yx8WdBDo#CXn{*d}Oixcid~nsv;c!VgK1vo#g})pV
zeGEoX0GrqKMU6#YltuX++D?nc6;H5i=bdC7s3kX2rrCkO!A3%N*(@U7!>PIga1q?z
zEN7d<s2oX5t9<x`Bl5ODS|c^N(Mm?GjKl9b9j%TAdf$&A?sGRTAKrzf>N9@(_<j$D
zNUxeC2+K>5xd3Zzve}K{!{tyY5b;UMeJH4t9}8sC&w1w0(*z5^^Z_vwb?G{qh;H6U
zL2h-&c553d-RKPzLr%o&%IQObhK$R{$FGY*&o|G`1m`n?M}N?9hlB^T6}04b(pVV$
z^DxttYy-Qau2uBH5mG`ZVx<Lu(SgklPCvYUb3(rT0t+(~b;IHW5WF_z=gKYK>Glq1
z$#guHi=PG(gZqQPuRFO&WF8pfj^HRRyOX(~+Fc{9#*g4Z0>f0DuLB~0n4Kx9!Pp9(
zT<_I4rIi549I>z|i=yn;`yt50s}XHd8+Ux%*h(Ad+Q8pN88oeSlP7XGmMabm#c`&p
z%f@+rz*9q;o|P>OGl1^8Ar1N>$IwFX&fvw56yZy$L1c!)yY9baeBU+3{28Ii7dq*+
zvEmeR|7ZDveJ@{Lb%M<|Bbb9YUmR^~8Y#IS$dnLWg3x9cH|8OMC^j}JnrcY4WFJ}v
zZwAaZ{uCHT;Va9`Puh~YmMZXkY?GVKVCq{amLc`z;^noe12+Vggnn6=^i=_4wNJ|2
z>=-hx2IUC!s_gS~>qbW0KIP)Q%FG37^Ux0UhLRo!M#MZCXt+S1^o1|wXJtb+jowww
znIaBF6wy}lMXJ|yNzARr)w#roWC~1(*_Sr|kIJ#1rYeleUXAVCDf$Xux-$a{Gdf%-
zY_2$i@KbynKfy9m$ltvBU<`3j%{9i;QZO*q4JBf87Odfq6Di!BlQ_psuukM6B&Cuw
z#z4$^y-JE-Gb{s36LeFs*I%<mAFuu#2Jh>b!~;~)R0Mw`CvJeax9aCMu3a^onr>G<
z+G2=n%rLlU$;&0qqZKzK&|6zBWa*zL9d%O?a46akOjuYTj{ZONlGc7esqC$S3?3f5
zDpbxy<Y_S^ge!fed|q}8;l?Nz`R#l_^JzmeLQ{L@og1U`!3!$`{<nHslL*S{DM9r3
zyst`xkk0R(?jI_7e<x{a(Ra;T+qw7s{>+g;V7+Dgfn;CpOBD-}*3Z^J+xeyrwC+1r
z+9M^op3Go@*-e8WdfZ_~hT_VX*7RbPIE_@NiG;fhT8Lff<uylu7RxJ~ga^biAE-6~
zot-ytN~8t;Nk?>M8<+=Jau}+w(kClCgwWHb{RxAM^J?HstN5x3Dl-9gL?#`z#GQ%k
z$xAgVFZ-43k-L@q<E4Tu#0|`XFaZ~c4?wCA@gawkX`CDB2Pg9k@+wxg+^i`O2>$Jc
z?^=nlB(}Xs4&!-E%7=l(c%ToK_lCmlA<|SKV+om_9+|`??nXE10grm8cbs8<ksiE*
z+wz(<$Ua`lPwu0-?uY)*n#L`PMJqmWPuP_aX*8$~FD^9<_roxS%^fuwKIRtzdBjOK
zd>+1+-hx!Vw@0bBjubkO-2HTN@$>+#$u);a17ZGewDFHqWq+iu01Y0ZL(JoE;>;fp
z-KgRnV@vrJPm{?tFuH7j8n53A#+M}Nl`=75UhK$~gaF6cpjNFPn%JREnoItISqrC<
z-sk`(m@wBht=KNF2I60lwvUo9SNM8q(5JkiNNZ9>YF0Z^V@~iIljON!Vlbhq5*?u<
zBLcSg7^1#%wJ+mEdgMH7r^9V^AidKdj$$zfDUEb}Lo?AS;@BE6leWRy(h`-g)pgNf
z!b@;9WGUPaDJ*O1h&-CugvN3dzUe^LTZ5!9b6RNN+ZPv>=!kN5KAitc-+2*+EK`db
zr<^i6=jbFL8#<82TQAHg70y);QibVbxQ=pZmo@8uu5i>kMMG_Ut1-eVa<OXMJtGrX
zcr|)-6+yxrE&swjSlQwDth^i3<=+&O{|MMl#D0z6!h~nCdr~4DWS6f7cD0z^Ql;Sy
z=xZOPgd>a!w#^bXhDh@yt;i-`D+_O3iH}FqN25CHd}NQvwNy4eH$;f2{Y8!-SM^mR
z%{+RT>2H3KJv>r@fdB?3Afcvlg{<b&i!8Ixu|*j_ld99J2@}tln6{Q2BY~p%me7VV
zgfqn_s%UemWpD*)_Lua=$wEz^;ml7bSKHaBLKthx2(?E%;sUU8K-CZ1&E8>%+Vod0
z#A&x}q;3`k`&BX&urBg)Z}98|%hOeUg%=2IDzkL0*)f}8pDd&1Pr|#(je7qWp~#F*
zUmI7_N5(ewAyGsnm4<>7D}Cn~hm(MdbbuAYZT>&@uaFQvyX)>W%9GWZI1n&X_Hq@A
zzrF29RfIShB7>kanvK6XX_qW%QcQeCbFRG`&oaMLPjUosZ#(CaAINZa$h}9&COUE5
z#%|d82rI+3WmGqS1?VD)NU7sqQz;Z7J%9l7O>hQyz3uyFZUZC^B#zwax{81xlq_BU
zmr+6X(J!=)#(HR0Zy_P|!0{~?ut$^JKm=ON18_kQ{#mkMAik<9gPanKJ8Uk4Fp&-?
zEacz8rc=Lq+E}u#l%kL}&^laNMTNR}>c<P#3{Z8mQ*y@3WL_euc2Lta>Nz2sy~Sx_
zPJz|aAiwx{C`gLDpA>FWV?jzZ)kE#G-J)ygoqBr3rtPZc>JQd^v>#rhKYE%gv3F1W
zqex7ElV*@5(|SKN*vtF>dklsR=NF)51vsT5FG;ddS_%%T8Hx-+Mi1~AJjoas+3p5Q
zQ|i{_X2fNBRACkJ<=P!V{`A$BzSs-!g-O}3C5K52kKU?%#4Sw=!TDEyCPx&ch-)lz
z_6MJl_dDo$?_?vmdKSg_2KbJ1bJNYiCPwdbwvd>x{&;6TmQ@LLF<CKYi*ZwO^)L~8
zf>$ZPa6LuxZk;l$Yq!Lxd+hDE9$wctL&WC>0N5)kOn-6I<#F0QCkIShXruiZV5VA4
z(GvSdlk-bX!#<p=Nunxp1@bK7PERXcB`ld>>In`2fkHbUS&e6+*;>ahodz9N1pj!>
zToUpY_!WZA3dYt)uEVf<gRdWjMwTt_Fi&Ipg(*|)(Q_Qii`-6uKGUgfwElluB|f7(
zbvIMg4-?jPS7b>vvBznxKx<nJ1%kx$BlCP6U_H`;D2$ydZ3DYB{{i+yF(pdyS<ZQF
z@@KOaXqjClQ95(WKj0Zm3DwxHPK);Es8QKe)BHoJgJk>5icWt<Jy27)%c6`-C3i;_
zIShnp?E3H|1s{bUiT_Gh8!kN&30dLH0xhV(@G^;c!Dye{xuXFR+i@LL2f&vNzVcQd
zFATtO1axCPXZ7lXixI8M@a1-}L-h3k-XIk7D?-EdcvT|*a*Mzh$>#N%u#SBT#2wG+
z)8-4Wqd8E;{}78ocJVvXlcUq(LJ17C#JOo<8br;L4lDq_%(VRqMI_V}#TBZIEkoOt
z06PjPBdw_kpq57knsr$34jr0?ILllX|Dm}V4>blTm4@4I>QPrXNM0(E2?|_SBIY`w
zuo@4X8e{Q9jUqnWE&D<OCB=PZHZCxiXwj?$K19l=;M=m~;nqcnByUZbp;`#bLY*-<
z4lHKiE(+UF`*QwK+pIui9R`N)k`!1>jJLHTgg8*DbD)oSGO>;o?>G%K^r(w}arz=)
zXB|aL6IarI36y!Ljy3DpQ6E7PW*KUY4+Skja*@k&zi=d-I{X<90)?&DArP;biCwEo
z0jvr}Wt9e#j@lD!lPW|4q_57AXs#mY8goyQlvzZ~Eu2r9)AuA5bUDZ)wYLJ%Gaj#C
z6vu_MYGU~4>I(PQ(H|-c&Q1XkD@jfklC2mg@x0YoYoVyMDHR{E^imqE5H=fzb`J~)
zjU+zgA1{6tn7tsa|5x#CTMaav+yZP*B)|^XDOL3+@`!ujL|~>*2Ou8>OgNHF_Vu%r
z<y%&BVdRwuM`D6|CRV!P)dQqa5IGS^1aW+8^r1ydOj1Z03NGlwsb&$ME3v)APo=rb
zc_#ZvF@Yk>_$<`og5oqREn7%)s(HxK`HEPq;L=O7R6_w;`t(}pkj{7bB2#g4EeURN
zgC%g)7;ql=gKk{+!9S>R2>Pj6?3<e7rF*Wwv1|<d^MMo<He$mY3LHbY>j7<B2~SuW
z#jzv8XhF$edSSUi^8^_oju&%lV0_J$%sRHr?79ZKIt(dAyj4-5<F;YvY`6$umkXwy
z{Of;-W1%RNSn482W*f4MP<^m)Fas&M^ik4y`2AwN5m!uj0|r%m^$zN&j)Yp{wd`+q
zE5{BDsp$TTA6YH8bWQSLo%P{@!XUu(9<p)`kf}&VMZ%JDby@Hkg-J9uU78c~6&b5B
z<-plc@Zz-v6MW26S$vroMQ0(uJtK@fToD<75dwPL@}38#?bId2mv&x|kZC3zgpLr?
z0%Umnkkq7V_G#(rvT>%dwnCo`OH7*;0SMn*BBS(gv94gdilh)B(Z>*DIkU2qH)-5P
zhFg!UG&IyLUljFRMmPcbNi`+q8mejvbw75+o^r5uZSt~37Lw5&ClhWunq%mn13ajF
zEE|fezjmK48iblo(*HsFrJb9rd5&-WdnZ1)1qr@I=q*_(yADBz0V5NN&+jE$5)+8a
zk5?Bw5}A=OO<)U`d*%ya6$qOI1}@^-Sn)ER+K1;#wGa}e^>u##`GI7rm5CCuSN*@Z
zJmh5H_YF3MuU@<{u1zGEq)exO<3Ggfpk!vV%{<gyt3;CY6jv<tttJ<o7!Jb7MPaQ(
z23l97Ai^f|Xv?OVGf3y4>M%D5>Y;cW_f)*`Nt;0G<K#m?fANDC+pTmy0GfF?R^nHs
zTo<N_6qk1%tW-9}v-bPulbFvIzGT;{!rQb)3&5-cOY=gsXh&C#IW0w5Tf(n0Q_ccq
z#Z@NG_TE*^FwhgE5s2J*Mi&B=narf>mNfkRO}Z}GR;X3nLNi%@s6`7(g+k7lHX5?4
zGEazA{anK9WRYj6YFi@pAgyGnVV11oC?FVfU@*N$p^zx~6n2=l9bHeJj$vm%@rmF6
z0+#iLSk?sENUH&aK%uGWy;T3QLpASy64J#fJZvxrr%t?<o9}~zhY3cHKn(VX5;zMH
z+GETUoPdjJ|N6fjSm}@~o7tOX{F*%NJ?T`26~@J96jO5{%GYf#Df~&tsvfb8%IphP
z^TkuBZ>sUlPPzHnLnr6Zm94vdzIsnxho&=w_AzQeVoi}Z$TyzmaY3mOi=>2j$gH4c
za71m)M4v=2eK?zZc#uG$YOrOKpG(MyW8%c()U*{{dAJ<-X7#+=DVpv(eYs3@6>$1|
zUH(E6;&9}~rs{G3z-jk1nRung_>rQ4P}Boj^LQ*3^!;r`Ij|g_5RiMWcp{fHhB$J#
zy8&Gk$Do2j-g;Kk6p#sY9<{2aA0(U(CXtge6C_K2EYRoFdls`*V8+v}wd|yO|Eid=
zEjr(jsxUSKvsj4KkG}tW>+>=H1=Y&R8gL(YpwUvUux5E+`>2V6Fl9$^W@RabT?vbr
zWbl|Q9J@&ZrSoGTAaty(6^c+b_rdy>eW<IF;3Z|I==f+0xmTd-{uhklR!te0j+^20
zV4qH-;#`tL5$3v3t0bKdtjQfFkz!2<ZR4sEq?r&7Mn~J`8}WK&X0Ue$<L+fb)U~vP
zo%`do`P7sU>SPj{ooYOcp*7@7<R9_j%q=$<mf_2eO8e$R4J%XR)IJt#UaFF!x@cI-
zp)?u-H;v$liA$GQ;?9G@IjDUmB4|RssV@p0J~kXZ61C1~o=A*(O{)nw!NK!{mg<dU
zT4>DAC$AyPA;}nxN{Yce=?WR21$4Kz&Mq5sVg&WV;M9o3j+xrjDNwysKjsKuTJMTa
zou9+=$>$wkzEZyWj~I0jL~8WWF_*A8re|t1Px(v}3@Yj+QS?yPQZXCO8Ugcqh3_Ya
z!N#?Q*6GIm7`{u(AwUgbdf^FbMpfKOr-ql7WU;Wx*lBMm<WMIj7LAicLJ~ZZBzBuP
zm#HGF=N<ja&bhV^n3TwdE&kUYp|w4lKJr9ATes;7V?_2N)tj<)HWHWcZf#p)T>@UH
z3kmcBpjdsbWk=!{Du;r}I~mMC^KV^KWVxXJ=TQDMh;t*H-RNwUtY^$BdR)#=8C&YM
ze`Td$G{A@+mp`FO-Z?rZVaOqRmwcEnHg}S!)_mxG_Xt?dmdvYx={9JIhY*BW6w>gT
z2mW>XE=TJ(_8@EAs$q~?DMkoFFh-+u7Q=WfCv8U<276#G4Ks1nS&6$sRuN<@l);vh
zY3Pz%D9|0{5aY>;7N<XPvCTqiIIsXAP()URTwQ1~kf@`(Aq^Jr(vAeC>Rs6bIM^j_
z<|WN2$sPE+X)(ZK@bS$K->%U4`J^d++9G7KqgH^m8tFom<HBo^4LL7WyAs!l;Y*Sy
zRMMCAm@+DYSwg_MBe6HD{PXPW|7N|gey390+3~o1SZ!)NIwP$J!y#yIa@*c8OxQad
z^S~Pf<ilBfe_diMc$;Wi=V<o6;hIAff!TIg(oHqrU5n&YaeA8mf6RB*WnG$DsOfQv
zMD2`=_R@WUDX>WXStt~}W7v6-tI_d>kk{SHGmJ_Zp^sRkqPpAECZ#|}`HAqc%ECH^
z#qd=(n&;lQI+cm7KE)*c$5)26+3XpY6x87LJW$Hg{SDnwew0-hK{z&L)$|ia1$RT?
zh?!`n(Q8AMkSwNBHRfPhcJ$^G2hc>FNvpovI$F5LQV>bZAHT=_Z#?0h<0oeVv?v-I
z%Poel6Kp|G058Ez)bg^Y;ghV>UNk#{UWjp_Q22swr*5&4HTxM|zjfv|`Z>Tq@m&qW
zE~XEj0pWk`GJmGsGRX^xj1#+Xp)dd6YuC@eoe56Zc*|qE@_fUw((N<WRk4jcrA6Hk
z=J~Es-yecv!2g0CtcWTCR1vHBmr#>F`_@#5mKBPE^6Cm6Lp}$}&dkG~1%BjPH}ZBH
z9s7~RQ7@#OgU4MM!7_;G;5F*(1!GhV$EBAQ=qC3XZcF%Url?!OWJ6QKY`H<oItgP+
z1?x~CmGw=S!#u4V{F%5Z?3nl{NBdRCzXM-2PF;?1BE&LTg+9QTE4zqX<ZoE3Hwe_L
zVrQweRgxPGFqcp2TZKFsyK9y^r%?>hubztR;~R)bCklnN^FRQzkf||J$0_`}(R9%{
z0{X=X8ef6T&(`uY&L=ujfn?=&Q<n+<5cqLej955UGeL!!_>zf@sfnwPvOF+t<B-yX
z(d{_>-wJgtr5{mdB{qHn#K7YT))tN*W?|7vm{!#n-+~4Eu^Fq@LLOXLsV#Da#+c%A
zFMIXNLqB4UXwQKWTjdB~+|NK}(w+N=id&gdm`ChBF_K(_4}u`@)mU1YG9*3U&3o|?
z!iU*aRbV5<22iL)+fI*(5>r8kD`F~#Ng5f4$%V;qJZ1GrFkm!)<Kn^U773o^mw@KX
zV+fo@5X(1=)mp|{?8cwb#QH4Oh3df$GGVCXis%`L5x7rB5J!=S!kS4A@>TUEAllNP
z8=M2`L9xrmG9ysQr=dz2KNAx-%V;d{U-4cG``I2_JtRg2!B-5ue#U|n7_~rM=QEGI
zdm&AaCo|UIKG9Dxa1Rk{m5z$S;1QDkCp7p@8ELNeP^wgr?*?RdpjT)hq4N>54={=+
z-mWKtW`xuOHJkPZ-um1SAANEt?;t4Rs1fA)-tkG1U``e1?igz3hs&9*OuGG{y!1A0
z>RuXDSKw%j1dmilBlO}Ddc9<lWl}&PBmTCgw6A;Q%=e96L;>RdU7te{rVn&V1cZn<
z^cKf(Qw^e=kB>Wmu2$*PK04T>rI|_~gCWK85yLQYLLWh62#_yC-Z}ob=nouc@T{}5
zt%${g;^OZ`x7dTmiWysF6qP<c+5pw?9KD>w27ea11hb%*F%}lHY=E|)4Q)K3w%m;6
z$K2gyi-Q-=`6Djc40r_jiJcqDO65Gda~<Nt)E<N3B34Xf$hWO-0;v{;>5D-(o!(ZB
zNTs2+u>aqu*0)Zdl32vQr0NgCWEAof%JpG1_3nv^$(2O9dQIda#19CL5)(8iuTN9H
zQ)A*ICEOS-rZo3lwUFEVNGJ?(HyBN>thnHNT@+8j27g#R_K7r?!*=ypm(%BwPZV1t
z%wK<dQ6~i013=@8n|~TPBL)prn>IjXC&NT(cY;`$5{+=sQBaEz!#<tMGORLsHZh=^
zmCY`KV+iH;lHy0(Vy1Jj!%34n)&caDOIXNyit=L($KXSK(bnMopsY)B*)5ZTWM|`u
z>ismeK{<kitrqm0mwVStAhY=KySG`qthR#k+RSS6HGV|(Kg_cXa-^isGqvWTp(4OL
zYjY9->q?UX_Rt=wPv$~M1fpoid!xhn6p(6M7t`-1*<zE0G8YySDmN&2uG;mQFVn_*
zHo4`eeU6L|R)LIdyD0?q&WAhZ?k1-v=m&%7yjneunHwx#ts?_X_!Q;>*YqD>J<ZEk
z?c&`|Z}M6+9Aihuv56|NlBP2Q+*d8$g#R^KUFV+@yC5m1(}4!q^^VJ^ANF@LN_ab0
zSj~y@I-QgT+lcYjnwzSnCgWcn3jzB2N{x2;peuYDj|&1f{gE-5c%S$C_-FVke7X*R
z%chitqgwO*lzjgmQSZQ=N!LYd$Gl_Pwr$(CZCf4NNyi=AHafPGj%}M?p7)$HzF$x^
z_NZNZ?X~8-W@&8w94kq%Fg!3U@eGYAXZ>oNI?tY1ku*cp0EG!9ENtXZ2|_~O-+X+S
zrym&4D_mcoqqOZ-#8Y1+qh%4Ziq0}mP6NbXaDS|Fr{xZ3je;GiR=UQ5#0Kok!XEC8
zv#hxYxE1<GDmYJ6`&1#tk<V~N6&Q@cPuC<9X-seYn+xY6!x#Tio3W1>L32MfL}fdZ
zN!Ud!ELQ6C5?cw)$ZElCjYV+0>0A+H+uG~V(MfEHj2G9b`^5z}eq=tr-K&A}Sq_AG
zIN&z@L@{}gA&)w~=SE;+=4*EUkjjEzTb}c=-uY-OtH}Xt;*0Oy)b960?-aL&{#Ss%
znEqXx9P>uEj{C(L4GX3t^#$(z$^Aj8{v+u8`vAq^+mge>SDY(E)<K&Jd!&GNvK2hq
zrOIJ%?{l+re<G~6Ug_A+6XfJ|G*e?!yBjQgfAPM(=aC=hc8l$0)g<%uk|E+1_r3A9
zzgWzCp&$P@KjwygpAzOsDV@Gd)+|@Z(~2!2Eh?tQOoDnAi(&U-9icmAitrP#%>?8k
zd>bmJrb4^Ga3K<(vNR&CgHIlWB_cu6MqSNn-_m5Y+Ho!Kjlra|iAGQaGTL2KzV%j~
zXX3ihW~3_=>MYVQB>>XE)FeS#BNQ=Fg1t;VAJpE??N^CMhY-2yAb;U&iy=y{T^o0h
zW}^Cm;box|YLRq-={3qnp@?iZFb~BFoA3gm6LM`_xYQG|)#Z-YmJQt#f&`iP+BZUY
zqRnm$N5u-gdAlT)r|u~_94-h=%nHCv72qwCzaS4FhOE|K{1aH7FIzU?Nka<L&mOs9
ziC4{3Vu)y-E@*=`Wsi+@gXv>!oF|hb6XD)3)m8v|%%zse%Hx>$6rJHYTSa66zOB;?
z0{Fl5j$QNBrZDteA{+$h)yr|*h<Odb`m5{Th%h8-aQYl_Y`b-S{JX93YoPIs;{9|o
zNV)Xbq|WOkdDY0Uz@yN~b1LAy?h>x?+0Q!Ye#ZT{@4ic%pigbxBx2rp@O>>d@JZtR
zI>>2o`FDJ9*4wL9llF5SBzDhsNG9@Dz0>u<`e3jEEYs_%mCiBq@xxt^IzEH0QvGo-
zktMmK-M(#6aI(20Fv3uQ`q2LVuDeumvu_p+?`C~y1+n|h6$M?+T%wdX?wFz?0}KsG
zcdUcN%QBl4NoB368TWEPFr(}~%FO-Zt%?M(jx%6be~yjWmxD(&kdUF!FocNVqHatK
zPI;LCAERBOl38yLi{o!~G7&>tYgh%7;*k&{5)p)K4(msK5R$rVQfXOIHW@lDS|4fq
z+4vZ%3Or=N0C?4_!BH}YHiQv2ade#z<opFhEpE4abEO&LWZz#Zp$_5%{YQqmEzFcw
zkDeZC4nP0z7RHGlIFpRg;nXPeg!4#`pyUHlgCHMzNkT$D$sp}iX_t8lhSI&A$J8>6
zko7rE&18ET_L)z3WCi0Yb+6~x{$Ytgx8#<~Qq6C-s_{n+eIgf`<B1;|PW#=%^GA>`
z>jLvyT94^Di`C5Y3#L-c^MvO09BDtP7wM*u0Ypxn|GKoP-%1pS{^w8G0_;?`NS$+L
zuv5@|O|(3f_aeb{^n!9=YUcmE;nBU3&b#P^V0vGokC$DDfb`};j`I28uR$O$nwFMs
zI<bnx7g}p@PV#vn7?-=!YjYpudY3C|PyN@Fc<>GT(eW*wruBYh=Jd=X<~+$&zGH4z
z9n@aEu@2YeKFDwy!PKgMICSS_Us=J>mRdpjYWqa2nb38@PT<;&FH^pxDL9x<Uzpjn
zSY+jP(q4h7XtRM!s{%1P>LvL!Ph=;k8&$t1H=fa81PpeTP!J~0^Dwh#H}Fd&H!H>Y
zpzAAS0W=mho1A4cyO}ZaXk++G)`z7|S$Q4Pg4a+@_OHrKaFbsQf4nlh-7V!7HRuAI
zfs?2=T|A3g9L60nVIf!+sCeNqXiK`K)mSA1JQEQvkUHv=h486Y(V=)=raC*tazSV~
z@#kpV(y3r@W+Uy1qM<SLL_+0zPY^c{44Fg`E(5)`A415eCms-144mZ3^@6N{`1wn_
zS${s*`Z*|}N|^BUIXOfSY%YxMNc!%&>~-vji8tM3d+0ii%jr3|Ohs3XL<`rpnsN^T
zwGPkj3%J%l&0{YD_Be%7UcFrJho!q#4T=W$9pHc-@A!+}^B*fsed$EnK2HOuUy$z8
zZTjfbiobI1TP4QCEsXv-!7JTsckkOT-#zl~_7IhWqI-Ykt%o;Q(?&znum5X5)2{G2
zG|;6UgER4(FQ*tSFU6-iU+LA@`u-t(bNKnLh~zD7#ZMd`8grdXDX8anX>5JIhI3!1
zk6rg@85HguPQcyutmu>B=-`uVe@9u27e0>6crQMW-Pd|%Wq-dxc3)R593G72IA2bA
z*py$J{<yGU|9=-&&>QxlbfU|2yTaCE)HmJr#<S;Zq`@bXSATnHRKWYC^URO#ir>pK
zk?rTSE@)6pJ#SraXvvKdz&O?CTws^^LpyHr4vFw}o-F%(qx)>Ijl7#mG-a%zu7SL1
z;&=L>mxQ}|Uo0gyvqGpkz<5n{N_7x1Rky@qMr`i7YX^KS0>uSiwR^9a<MOJF(IS~3
ztm=3sMy2>Jl0oBKu3ToS223l2Ru9A3cWzbg&~rS&q(gk_X3UpZ|CCbl0Ia*Qm|j;Z
zOI8+w3GA61{G?Qjk^tkLLLNj{e5lIcK5oE3_mc?{_)D%#UH8*~4{~#{b8|E$a@_pr
z5d?_%-sOn9tEa@Qg-KpEh_T$d+=#L}_m9u^2@UgrZ?wKS9a>PzPt=>?gRD&Gr~YUi
zv*H}Oi)mAQDFD`5;2?6>CEt8*Ip^UB#LUziPCHsp*M30(DaPGMD89hfiCcaYRWPXY
zlbtNrFy5vz6OhVXTQ#K0zBi+I4_-+;p&gXd%Pia7y1$DJ`Ea***8`vBHsiilqafB8
za2t~A-<x&VhH`7e7`uNspNH}~h>^o^tp6f#u#Q5XMDW&6F|NYSr#<ce=5jz`pgW$Y
z+osl%>(^uJS3Nq@ea19Tu+x8v*={%?cNh2l$h`KpXOQesYnL=4aG42Xwe6|*U4t;{
z7WA~0`)SJ+Faa9yCt&x0__gqvSH`~k!t3s#@!?+IKi1ZEoyNz(v$pHD`8ol?;MM(=
zApIjEc=_<r=b>x6QLd)LKFikUJh`at6{7v?%!go4<q}(A<IB4JMyr=Jz;Vjl>-0Q8
zSYF#J{9^{gA@#WHitf&eOAnvn=W8-*(Pa899l)e<_s2}&Z{X|SmSCm6wXK$`V%VSJ
zlnpskKAM}3f1a;JOld1u55|@zQC7mT5H<T>@EW(ISe06jkibERfU%+=VL~nv^FGph
zDKk^bzUwu9jn#xS@K`(uilS;!Fn_93{Z&WKY!}EsZDi2%ejs`<jN<u}TUYTgbY{nK
zqb|u3S&M7y@~nEAtfOkuaC{WKgI!-FA`hC>93K;{S!9_2#aZi$!W)?3u!w}kM@@TC
zb#(AEv>5A0fi8||>uqWleO$uAVs&tH`yAJcBUX!SIT~1=5WW<XHyK9uhhoQ1B#0`%
zZXs{H9}SQoy~{m<ZNFDf9ixn9>ds5g*2Wl^)U12njfEn;uyS4zI9{|^ke7OjsbU)k
zp&H+(GvYrGD?f!^LG15kW{(tDC1L8vkXx}r!18Iw#k*1N6pyZSsHOw~#fW#%#-HAg
zH`luIt$j4D%^-t)oOP<}*Ui?ksY;P<jc>wq1D8bJC98=IDVHQ$esz4GH-zzpuRYpV
zEhuX4Xy>73g2Kp#QT*2f2?3htt!ACf4MF#<cKS|*<vh>?cfZ2qb@J=?6S=#FQrd~+
zyeG{|kEMW^{hU9?G!hg04DU2t2ziIC#hv>mcPl(Si4meR@82HfAKgz~?Cb&({(Hp&
z<O1a{&xrxr0kh{9*tKsDc<UI;pahLt?D700D}J~7?YHum@$DWHavJ{n@&QH)KiAkn
zJ0jyD7nb##dbSj87(PMDDB4?pqd5{RPDjGzDGB$~w#n7|a8Q(-12+RZ33wM&reQE9
zuJM@2G_Z*ZLkB>DkP&3JW$5LfDs=b(zFcnb2%uR9VJ`r`(rwjF$o`(LOp=tmJ98+l
zAA4iIltHU~CH`;O+x$RbAtMv(kiPTth_@Tg^F?thMUHd7ca&ggSuZ9UbnXPfl5u8b
za9BV?KRZ>z=ra_iVuGe{9dR@Jbqi(euTx@5Dr|4c#{z^S5~+58DYKkqHJBl|dcEw4
zrgvj(43^+vS$eTBotpS%Fbm{))Y(O8JJETKCjmc?oa}G-r(e&1rlT03caviHg7%6V
z_JR8t{|OeG!pT=c8s;3{<`zkB0_`O{g^=%m?+`L$XMU?!7~-9A6{KJ`Pr)7hV4Z!H
zYIMAUvfa%|4HOr(|CN3Fepza9nn&YquhFD~vZCLHx5uo6346(N)dI9L$%)N5^#l?@
zTm59W?tQM)YjJs>-t^W@yg|0Z+pu^OcPDl-e%VaZY<p6HcAa9kUn+e|Rr(xHz;?9y
zUP{zKEhxN}3iy_O+)t~a#Km}=i!32IUm#>ZA&$)7Z?(#}U#Z@#eTud3XT~Q};MPl}
z9j}<}6Y1k*r6gLd9R12sj;#!MZ_3NEBx(Y#F~{?VjT3@@vRL7mE$|AN=yn<Rq$af>
zoM0+!G4$grh9s)`#BA7Y+fdm3J+vHiRcllfGs%WSp$YChtK|gg<B<POj(^g>9mtfh
zo6ednIaJ*wo8|(<UK)<CN|I<{-QixDMsX(K8pZ^nIB9jS8vrl#>xwgN12&cLO~`KZ
z*S~=ycIFaYfl?g^e|RHM+tYGK3EgqPSCBUPMHAL?hVdvMOF0OR-$GIgVHEJ5upx{i
zL=!abSl;KeUrrLG;eB<|y4ICJV%|8TD?f9L0^C(Y$RG3wMQVPOYt)|!zj^q`>uoo!
zGKY(QZ)KdR>sS}Q3I_TYNC;j^LXviw!Nzz8{nzN6^GRL29NMAaD2Go-63{Onp>~Qs
zeik{hqfJMHonEN+0Ms=M_}d^KPAz`9+H`@>_s+u@0-wZ>zWR~Hd-;*EwPQYw-0zD*
zvfd|^JFTWF%8X4~3%*xRv-T*?tUSVazOO*iclgm7JCe*x4fkd3q~a?-=P9<8)qqxl
zglkK?4RV8*jYsDReTkm$kzAV6of$&BZj1DbG!)Z`fv64de{fG)trrP;l?Wp5P=fjw
zk}}`7ljhrd%|7a;#rI%bhxH?4h4Ct3eiw<(XI$GB|GOue!@hHY`V>&FsE?`A=rF1Q
zIV$l$#Rj)zuaXA?A%KpO;Xm<F&(6&ZpaXV7=n<FLnv@lD8e{0D*{rab^R;p8@FIBg
z8AtTx1w>}V!+b|-M;*r}QQdGsmIZL&3RWaQrwSHvlH6X<gz+@ydngrwU^z{rDc`uN
zo%YHzjv5krKqH02k)9TB-a{Wf@`Y(#V93ZLJlrS2IkTXFsg0qhi%pU9mHL^BG#pi~
z`}W4_q3tz^3u1<_Sj~Jk<7DcDEJ-zq%g7h9fOS<7)p054@Ki7dy!4&(ptB9*@h(f{
zC{Fv4Xh7np{4#5aa&ZYS91Y`sTrwzWfzv@=z&46+V2;Qe4;xYI*x=u=E#~ke&4b+<
zN^%j<E)Rb#5o1d42R_g%2g#+Jsd@PCM(!v!F~<L<e`$CPm{uJQcv)%im>nMmkmS8z
zXpBiqwwcnt76xehKe7c4%`q{zeSSLsZP7WXf&1*dJv=`gKUYY>_!_V|fSbWyFK~Dd
z{P=ngcKBW-P2BBX8Ew&N9ZgrCNg&wiEBeCA@z?+QpcA0%{m9Ns{dRw&eotNBNmBT{
zmuoOF=}nPgNWl2=rKZsLsQ##Z-sP0J3+a7<So>3o)(SDN->c4lf66dXT?y+v&+++!
za~P7hMV8Kg8h$XZ5zw36s`ITh9c!ld-@n|U9y=7cl$ryX@F+^C*~kdSi6xsdlQ(`7
zxltQw(2dWUaugSpC2FG>Q{gQY0HMu<Geuk0Dmc(RGc$h9-z$+PGI}GUzIWpNu(yys
z;fRdLknf?QcEm4K2Lp0xf#xe2DnPgjI)il7Zf1u=WWMwZ`^eLn3|V}p5%)MVlU{Gx
zE(&HP1Qx1kIwTnsMudKhi)m8ci@ghg7L8B<LLd0aoc>Ank*x~NG1a*5?1&wRv08ho
zJQ>{r>kj|aZmXU#nK(i-rHavL2*xeiiOMbk^hoH3jPxOiMkt+(Z!y%h9y5V($qyWn
zaU?ZjQkwh1e(wJf1Ce5WrN-mJnX<}L6krZ@p%SVxuMNx4ZT8dSi9<*RK8Ve6Ug7^W
zMD{kzxNvvu-+oS`F@{moq21%k0230_^d6sP@iAo8@GO#-rYD^oUdeMvllPvY>odZ?
zR(sgE=BoE}$t&nGZOS@tauVQUpKj+-ONC;P*y+$EcC{veG|kMz^8Y*|J<mZD!JXgv
zD@Wr8<m)K^x(%MTU(wock9bU<ZAIL-8cXt0rMPn~K{W+zzWtn^<2nzw{3@AoFqpAw
z$HuQZ4~IK79x_C<)&!E83wrDy@n7#s1;{jLME()%qda;eY*74j*s2*>>a88qZ{J_H
zYcL58U{TT1BajMJ-la`k(t94y;n1TocsqM~d;Fnp<K0Drj;>F8o*8QJS=b;PXGi`0
z(r9}OsQb&33>p7!_1BrekqmHFC&d)-FT};5#L^=Y4-xziv72Mq(g2O#Rq4h`vGHNd
z!Ok^3fO^OwP-}8;QkQ`@8IRkGkj93|B33a@BoiUFx#}SU2mlFKM=`3QcBN7a=j~cz
z#_Q1!3(iYjFR4!moqJPQOIHbPx&;b-aGV6VsDLvJeZ1jzfNB&!miI}|N(4U>yt&*w
zExZdUK{=K$&_mN^G=d-+_Ig+m*$z(G=NyI>w(vmE*Xis{1<Cl?`uzyJQ<^o>6e_9W
zk7GaT1*z=AhECeoskSONqhWoh^Oqt`tY*0MYo8g5Nx~1q3p6195^g4eK3p?z5r}FH
zCJKn>#gwF^`rh<O-L?DSb(h|Xe2H;)sY{@@b_x2!I=@6SGzo3V{@3Wo3qJ1`N?MIq
z;QvF?>onioVc?c22p~e%VNQi+Z6l&afo-Bj7o+cnOvd!79_bsiA0dedYC?4-M2?Pk
zwuNV3{>1oX;>1K#-s&CMUA-tw4TFnN2+Ej2u)5WsBV;ezq?mmX$4jm`4q}@D9bs-{
zbPfALK}0oUaS5=1Nu@pid%4NMK1{@JA!cDXDPAx+jEayhD7-(ksEN*-1>_33hR&RC
zWD2W8`IPw(L!=g7_b1eg7KSSZD-2ha1(q@bf3m(VpBs^5a8E=RMtD^9c7f`s1SFRL
z;ENO-S$Z!WM0v)o3TC_&IOtTvWrtc0H(Aho2o4@UR$%+WK5$k+4fl&F1(GHOm&N35
zEhtre3ia<tr!Mz2hU?miF?sA!*U#~jo9HG`^Z(?GPmrSkNg+7iQ7Ta~>61Se{k>%=
zz_yqu#n+i}r_g^tnUBA0*!?Kq3tAS>P4Wgel!SbE<1Z<~>2TBWn@aNf_~U1C;#5ck
zj7+^WPjG}tm6(sI3AG_QP(09fjf<UF)l#yxs8XNGa3$8TGDLwAf{+>ifI5zfXHUSw
z5M4#+=3;1SR9=o7;*Tc^DslZubZ9-VPggUJ15gb%>iWoWRVD;k97WebK<n6vc?Zgn
z<_LwmfEjAK;!pts9bFRIpt-TAQ|ra^gP2q3`kYe^3~!=wAR`Ywv+Jr>>~s!Yc%@z}
zR5jGiol=K~W75)v->`od*o*yzts(fNuj86w8u8(+_XMc1)XA8?fVjZ3cG^#u0=iJ$
zsgz1ZS|VK)>p05bAzkRASn;*a12_C*(`HMK=+^$5DBWls2y~3Zikp}zq4|8>RETvg
zxK{XB|KS8`j2tbxP*fq2!#6~2ru_s(Yb?Ji&bZ8xpEBAq`kZ9~hVUiyMY#=96oSGO
zX4DwK8{4&*O6UaV^2NqM=__Ihb5rWUc0lDt^5fz#C&bmoXLK0?ppB$>*17!#SeU9f
z89UuOW=9xNRtAP58^?*~niRwjCW3&Np65s!q+3EOQ_>xmAZSD<Ty>yY?eGHODwd&o
zhm<sCK0xHkHfbbSzg88pmW#GW3In<ce??Hu5>+90Ag)Y|;?MC6PO5dfcS!V3s5#Ol
zG-<Up#RMPVn~A))ADYdD!-_z>aZh>^Re(Q{Se<FVB7unUN!0PBFja@0XY3YPj7_!C
zw_Qr)$|S<P>&Jj0O1JL@;!>1<Hs`}Yb~98K?CuI$4m?U~uAi?xGQAGU2$25|zS(P5
z(k5@G4<Aa9%P+$3OM>Sg?6=W4E7_#7t~3Vuen<jB4Z^Z{3?zPJqcqQsSVWwIhO0JE
zg;C+rgG|gj>SC}w1BN7&!7yC*fj=*nlF<ZuM&5Qe{w76^HG`&0ZJ$L?m*w1$XJy3T
z&KGaiDZ7SLl?9=F_1ikxhnu!o;20%P@cw2jC9G2&SyT?Sj0TgOzFsM7f!kR6hckws
zf|98xnT99{Oq!ak^`*hUs;!!-eVxCE*T*(LbLB32^p0dxB?e76^~g6Wz-76snn<Os
z!enZNycOehIx!%u6E;o@JO+fGjWQnU8P(UPx8p^AFpJ^JO$R~>R7=attd{cnL1>YQ
z8slJ+F+Oh&e(OYcH0v^bhQ*o&hvYdHwx4p3(5*k3fd-IuuqCBUX8)gLt)M}7<PP@q
z8pZ{BQxI7DWEX+>Tu*3BPC%%dHkRD-xXHBS7x)s}Hj5K(5+kGXUrZD-{D}#_wN{&o
zcMHjT*Naq}!428fR9?fa#%(q=VlaZL?0&jn>w!t*jP5iUH~f!$7~6sM(je`OuzEKH
zcwz`rkV0UI5kmzTk4@QcS~cZeC;W-q7%xJ0FiAiG=$lYhTBoU89mv>YcS3ukQFs^n
zQy()ZZ6H2G8lNnW53@jotsr;#Aeq(Hxu$~r4u&Sug`<hLo~OQ5h~trxpt4aQ8@m!H
zZ2_Zbj5416fh))|#%ND!<|I+7)<h;9pM7fI$gJtJBJCf4*wX0R#l&64G)bB0Pk3K!
z;I8&f*<vF@&+|gf0r>2ze{Ww{*BWZD(l`B=?n9*syb9%YR;}J|y;w`psy`$9|2yoA
zpiB4jY4SzvkqIwc1PPh@C)`Ou?TpPynFf?^KHj8QPwm3uzSBhqW?MDxHC~3QLvCUR
z-tWh6W&^#{y4;u8PM9C%Q;}LzaCHkxM-*35Y=)5*S}x9AU0aMOqL3#fV}Ooo*hftT
z1=2u4iC)&DA|4`S3`9WMo01_xZ&9{h<mILX57#nJn*kI?Q>g+@=cmVOmJB~=g(rE-
z(zOhRK{==NQs4nTIEqK7GQ9pQ?BY=4aD^VxEs${w!Ww!KRLoa?;s(wn-nu=nuRiXd
zbF9sUKnx`wLC7v90Bf0h-cC>J{+G)5yisl!(IFT<?eRgJoJ#kIB}&|~8DWk6q8|BO
z7-+G)XQkRVIfi(hjD1JMj>#4>TO-67aR;^-Mm5!S!O^_S0aJK51enr2MCX6IHPdWN
zhFp5W=8^TNk(<0Fe+lm?0Q`5%={2r*@d%BkYIf#xwJN(bm~e8w@kkH4rnZcZFjXkl
z3t$%M;RB@upfy2OO0D}W4r$C!3E?D+75I0Npt_7Wcp%B2lOC0J9V{I4lk{`7#les1
zrGD2Ch@lscImekZl1p$hEIZ@huPLrnW)2Kx%K8>~4lglPGdmPB-hElh)S(MhVntqr
z7CCw(+~cs*vp$41nLVY{-ynbc{}65ok|0J2KWy~vi36c<4_ahDxcflh@04U{fFgz(
z(cf$14-syV4zqbTw3HCW?o$drH|IvZps=DKrOrDH?ivdtPGjanuXv;n_o-+;>|+xr
z5A63a!IL!*Sxu*>VolWe+aZZ5(0?LBjFXn`Q!TMTovSiSdze0Ftquxk*8Cs2_x41n
zANusoiApm~Ja?e_38uMX+)e}T>gj1uiCw%J8D)?9L>LYg+Ue-*-5IHmc+rVZ|FW(*
zySX-5C1yo5tuTNTK?0o-P#;dR%p6?FD;??*(((d+7zS^bqSz`+gfwE9;eaxm;9ZCs
z?yofNOQkU!3AZ9mr}v8uJb0ik69F~hkGminbRTv8z-&p4MS0{v0Te)2<+vYw^>IpC
z3fJZ;s5q#=h}x&b@;~q0Q;d00QCpCquoj<IYz+OPnvh<1-|m87FGgJ{cvu)SDG(Ad
z0?@dps$%=<^8GIgbnG~<%%py%v!O;VkXF{6uo3iNR+8GT?MLFFU(F#Ob&@l{p90}m
zcPD0KZSC6Lm(NNIbW(}8#p<DBw-eqOI40mP2!Bv~y%5b~9*Kw)ms6=^NLf-8|10d+
z&bR%9n$Uk2ijCjl;U@96Sm!4l5jw{W!TVKb%_B1`DDT-SOTx}+stx<n(O&$U6d%&p
zKUk&)S>#;bAK!gEO@IPIP)r0p##S);sJYDKDsT#n&z9USKY>$Qc6tPYXC&dc;Sw;r
zIz+$nRO}d?&s9;1>REL^@e~vix55v~DBc5T95sB5D2{_=`B5Rsxt7lujyoo5?lIt=
zBo7fq^aY~h@bEiu%AMry7CpZ9--!efU;N%B8Mi;tQOXH^tuD&n7t_b&be4oi{(`}e
z0iOHUuZR`)tDBvw$_sGj)Ez+_wZ_V^p!=Df`_zzfL2VhXI=MpvY}nW#5dJNKGFO#9
ziA@a!!z}!Pb=Cyr8wc%J)xXGv=*NlZx|sF@aEA2uhlD5nnD`H>`(wWt0I9v1MK+Qc
zW5(smksjE06vPZeuuL{&K=_DoQf&{$2o5&F4FbQ#b}V$IO-NVLc0(2~D<&s3X>*O?
zprB~-qwJ``btWBY&NLvkJtgqO1wcp!(#4b<(e5UDshQ%I>EUl=+%n~d#&mhmeHHBp
z{(kEJVBch!MF>$es<?ny_jzzp+!GCe3Iw_e6*A~qZXGg6c~2S=#WR$|8{+aoj4}lq
zCv7$20Q}kAGju`V<JJu`dV&=kG$V~Pi!OjvTaret>^yVgA!BJ)EDJG#Ld4H^Rs;Z(
zL;sPgt!gr4fUSy}mSK}&eosuAl42y;Fs%IRP0R8pCDWYz{P_hxc_swT*%KiEm>PD}
z_1siRm!ORfj3GR>-~K-X<ToNL8dJ=Jp~J6Y6w_0GJ4vHh1e)WyiuhX%;Xf>xZK@_F
z0!3V+Rw92HZ33Yk0*fFJkyZ-IYM0mzC=;NbdW-e|c030ojsalsui3)xRS&}@IPCsV
z;Jl!ucA83;8Yya1s?=%2mYlGM1iJnzc>}PX)85+Jzsw2bPaQKQRqk29_y9(9hn=+h
z^%~$Mh555fAZ1ohE>C&+doJzmK49dv=&?I;h;gJvmGC4an#_xGy=4|)eJy>ul6;w)
zW`+{81(z!79N2y!<SBlaEhDSYf(YZTH73KYmMl)_vI_WoVwgL@nacPG5(wR1irjlL
z!KLWAy!jm-T=zS-*e_-aOIr{(H&|r|GIql{OeV6H%vHbSVY&^v<M4g%Zu%;hto;`J
zHUDQ8^=kyzX`i<Z?KuT043_?fnHqV;`2BlLwoVbH=AA-H#@^~7qM4c{T#dHLRnlMd
z<QH(=-P%`qC;{TW8b1>#iH0Mh@H7SxqWuG-d$=1uM4n&SNg%+?=uiN#9?XYT38l3c
zQv1VRv)1AOg8w810^rW=z6n}~BOAzQL0G3*O;^#@9^MO=1A|ePKtm=Crq$VsBWTwb
z{DXq)+z7_lT?96yJ;ym(5$Tq`J&BIM2^uDRvIPP*R#qM*eZ;JeqewRDA4RMqpG-|{
zY91d$XF3KKn>0;pJb+3|iBaysFodAKFe+<fE&0U&!pA!4*8E6S;7ErzhyaJ{bWb%=
z%WRU?)-*p!G{G$n9#a=;13}0`?_*Q8{FXaY3JYPM1~K_mbbFJAMaluF{?ASDY@aCi
z3U8OkIdis_`@1L=4xXeG$=Ve;Fv-(sxD!6qTg<G&nPr-d4kQ+&J1NQ)7u4^|N)NlJ
z5pn5ophZe~;)+Qk%x^=Y7v`uP>ETtepXo%g2qnWCzB@1FG#Plp#}LnuSGEwqtId|0
zN?eT75dTY28goQ}0=+5%AtZ_6!LE?rE}*1%&Nc}#A;ui$FCZntWT8}sTlhtHxV11W
zDmoa}4{Ym1Gm2~)1D`-81yZSI$jvgKeAd}eBFJqZEMI5EjK&{d7Dp*IL=w~$L%ahh
zFVI>F2XqG`h-Ek?%j8vym5p95ckDgs_rdmkj2iF-jejPY7#^kA9{wM4OtAv|L1N%4
zD(D0?#*meilo%x;1}DKRRM6q@M)Ksy{}kFktK>YV6oI7`nkm4UR;EPGN?qi<eh=sp
z<Q25WRnI;9Twr2jBZDp*H$xYOt^=tF6yu634(?+MAsQ$fJyeE#J$r9VIe><7B^XD1
zY3p2eEMSIr7}8yND>EgCLKinAFdpx8Kgp=w9*wcw1<JO3rBz4Y9UR|+{tE{Kzw~G2
z*F2UWQg?9!)GHUG0jZAR*yNjxA;V_wV6tf>(qtjfVUz1VAd?nG-^o0aHfUc9q_N1=
zRv}q1$W6NSQE~?Q3cW1|+#z=mi*{>O*vFh@Wu9$f(tKteX%N3OIVK-C>;%P;ni{Im
zTYT!?r4t`YgAsp6)9;Bezxffz)yPFmr+j>X7BAzZq**VjUI$A328<;nIN?y0FT94#
zx1_k;<NvHuLEVjFPYe4luS1#-x#a}HTf6thN<{|<glt498NpXM8&JZj|Jqg4=<qnR
z(E}Q_7E~`LJj<yE9#$!N$vKdMc{`Tz3uL7fB^^4L*suwg{rEiIECRmL&GcZj1&d@y
zr?a8kBpktCerJsMDLN2c3QH;cW7<cz&f>|L*O)`c6hAVzgK$s?GIyc3x$!L+@~<%O
z`WFBI&qJG?BaKM4{*c8Tthi}xv7m!7SXhj~mzV0a0^WyuZY3pdM4OWIz_Br~&B&{r
zP7R&LhK4lEmZh0d>c2XSa0aXqc5uKK;;~!i9yE$pd|W^9%@d|i?ye%LLV}k{wp6_n
z4-PgBm;|18P`=_IkR1~vmpWhE^nkUhOxwJej0y$7Wg1RuCfd0_2CBeN`L4npl^+w~
zY#K0KQ+}%Rzg!_zbZv4OnF9WY_YGLAzH`FrRoysS@`+u2*na}6t9G`s#T++ewi>91
zcD6s63|$b3%m~3i!2j-?`}kaqX4635EuzHAAAIoT-2S#UnBek|i)bkCORS#<a}d7q
z71UON95yZ{YbsbvVNJ5;*7HM~tknn0)rJb0QGSSa_!*pP6Px(SLFR*A3kwt{cU_Ob
zc+-K4{*ti{fFfg+_|}CFh8wzzo1}wqRfLRcL_hnTESlDa$|I^&5Lm=f%4UYeAZ*24
z?V~ptG`Es=L>c2u9BAfeS8^zAbPe@c1Oyms)dCu-ZEBu8QMtok=yOt{apSqt*{ub}
z&fO{-D>|4IGBALJU|aB}Hb>PRiE;g>x3QSA58}9g;tJAG8T%M>D1!ZRmJAVg(kIRY
zz`H#v&BnBFLgkP4CWzx>CbSWaoKtJz`u)4zexdn)`p`03)zz?$-s-B-hBnQ3)LqDn
z-SiC{9zFBP1u#Fi=0C%IMpdd(SptZJ(mOUPFskK>Zm^H#d^09%z07kaZ4V4XHl2KB
zn|>9|M4XcQDWc)S$dt!InUG7kH$W=WE{W|)1e!mZ2olKgQ{z)<(OAE7D6D3kY(9Ji
z@jWm@D|)jS6El(v3AM~ByGcm`qhQ!w5aP_a=b%CFQpmjCz)zBc&J;1*sJ=|cC)nvb
zLv1@Vr|4)tJ_Io%Gs4g`BBo5f(vzH{&^1o0c7|#b8N-2p%N+6&D&Xx&G31J_^fo@^
zla}vvjQzi2pnx=}7qoR3ak{h<sGyV6(em>l7H4#EM!Lq7XqZ#I!!|Nv1Xr(Ln%uMr
z&{S0hra&9D6?KEv@Lg<Wo-Sp~yy|Bx&s33MP!3*(ofvTIHj46fm__Kjvn#MTEnc>V
zFnf?p{@dYi`qd5xlOg;cP9raGv+(X{n#@cgKCmz^^Vvbc9p66Mew8AmXtsAllgnJ%
zMF>wQCrHjREMa|bJ)PlzO}@J_Np^LYBv4CIAm!CTisUGmzoDUmx1<)GBYAN*!2H`#
z!%OpUKCJjMNw3Tt*9(V4nP>E{fAJO_xlChG;M2iJ|4=hl9wfdAdBYQC6IM!3L@2K9
z4k~%emQnWiY4`u8#C8SZOab`OwHxh^z(Gl?#OIf%Q>s-#Krc}$@=iCowt1<H7EO6-
zYgRBpR`IUOO_Ar$&t=j&Fe`~UC^q0mW-=B<^)(_M1Ht+M$@F3<l^`4~Uy~HK=l@0b
zu`P*jjj#gK0nz2<#2OqP8ZQ}KiV235+!DH>mg39`yvB2J$Zy-M;Rm`PILE+}j)#8%
z|BK@~B_T+DP)MK6!P_vA24Y&$7lnE8f5;1@X(msyh4t!v>z3`NsEI;>5ciM=1ja*_
zes-dMV9r<?%P3e6+{muBY3N{}XjDyNAnWgF%gREE49CGN;4EaKgHh@VtF0<0<RA+Y
zf`sXRe9NlI0_=BGx{*q;)Ce=2k6atiRg(Cz$Tl?f8uJhdRO!mXQ-dttr0D2M;lfQ$
z>)bO@jEEEifl1JlA}VpE#(@v-i_?ygQ-%;#4AeFzgUS%^L&j2?slo4+tZYTPs@Y2_
zT+F<%&}ao+9-<L@f=Q>xV6emMY3Vvq9bF$DZ$3lHih`LFf|4;OnaB7bw#k!IfYvXq
zv{W6=K72(p$rqzjHGb~|_lYU>_!Hq3Pq^Q^bmJ4m-SkjV!Fa=^RegfU=-AaKktY>C
z4lAtbRF1A&5}#^*(*O$Bg9eLU48vdkWS9K?-vtX%tL!$R%<$JpE2;+o3AAbQX>2&Q
zE<P(ctiCGpYDI6wY%)@(G>Y-Lo|aNNOBS{zB@pL!vi9(<<=S`)qs2Q;eQUO6_n~sX
zj&1)RqU~4)VxKs)RpGVs4y^MC^=?^18YGGR4iL}?TQ8qv$E~*}eUMRq9%52wf3}1=
z_$iMlf?|3`bvQI<hNte)kuuSdGVn8e*DrbnW2NV^aFD}7b@^wb=|r#8ZYV?zEi0r3
zpSD4kSWNj4v%U_>nsP^3&fOJ2IGaWZS7$a^$UFiqat(pGnc8nw0mmt_q6!zwb$Ttt
z6jpu-P+7-dEeQO)L!L$|;6@WEL}riMQBkL_$-I6HSS?>G7DS)`agdX|P=7iYC*OwE
z|4a2ySIZ<p!XKzN5LrBmXg3sGui;5+w-IFz`MaiOi5!R&ss(=cIC=hf=EqSvCRFZI
zKX|5_TcBZ%UpK34*b6U0!Uj(V4aeXM1ZB%pm)X&@NSV<K{va9vBhvpt=y}K0Qoevp
z)yhqoz*79E)ECQT-I*e<+;F_ujV(ExI2FoUvB3oW^KwdvoPytZvsi7$_~_=9#%YgD
zkYFMI6cw7lg~AnD0kl~)!?6``0eGOmqG5et&-rdBUw}f@3!$JtVdx<sg#9Q$r0I^N
z5Tj<9T*wP8<#DD$^W=Rf^ByTL!D$w^H1a=e9Qd#vbks0aw32!_qE2>T_>S`z^4D-T
z^h?<?oVjNwh{+A%;eA=HKbf#1T%e40KhA-rDiI^2(m@fPNry}Y&9yBJXZIx{``L$S
zjQdo#skrzf03cShoPk5+!D)KiB+tR4nVDVQ^5H5pm1@dpC=fEBbvRwLO@SvU5o>`6
zjNU8~ZF38*2q+=Pe$>dMO+DXKBT)<MZoVxI=~0-EKM`?oBm-Imnu%jjhY=eT@!rN*
zJl&=V`Pz=;wt-ni8@@EsW`q-pIIexH)0A)k1Neh@rFa~1WcLMoRr-WcCfd9uaRLY0
za6oE*#&M6VcEJc81B9$v)CxvybQSpbWJq}s;@w*|iw?e%Ca11NNkXngng%N}`b1g(
z%w*KI5j&i$JJ-k&78DU@wQ-5;*gd;ABy6?dn)+XS0#RC7b^0u!n*YN<*t<x%Zm10%
zN7p9y^z;y^C5IFztqTz5*je_{L;PF75&DTFMdT@$n{m$t8QGn5tA<!yFL#)!hF@V*
z650rcPyvZY0^Ns0AmLmEJhTOiOGo%qocr36^*Ci~@k(jwC`T%BYSQfr6vl;)ZR~FS
znp$g(#gZ1}F7aux0xckGD%=^0Tr?Xiuwb~e{%uuHZF%I@oC`fUxwmnV!`n&aI2&kG
zy;-O1t!KhYSj~AnM_bB_)QYSBt4-+_=FB9n(()j9YBK}~Ei6YY6R9YbNm#=A!sli)
z6#B!tBORjt!IIFo$h}q-wF;d3x;Yj2@K4}Rygkw0?{A_!b<9<($?;ImqG%;BlQPcE
z!P1eXw7-Q%#ZP?)<NJv*5+<342)B3n46v|?sDo~Cn!YZ+_7fW=U*98Jy+FF|>W9EL
z>#Z)|^e(*zxw3>{!N>!0h={Y4gr2~nV&(bjP4nyP)aW!VU(IC!%`NM_YJJpbU}6Qq
zqQuZ3!M_kCM`KBorH=TwIqo;7{kFdzdCxbGFI<kYOcMxMJoRH(T&DTo@2<L6?rWNJ
zA8E@=@wD{MGX<F>%A)^tEWKCP%1|USnC#Hncu&(wsjE-#;hLMUPsam?=&ON(IY31H
zOcJ*FSGiDZC7}r=zh7!#`QpL>@YZIDE8$>--1;v;<?SP9r-EZt_i{qe*e#3gVk-%Y
z5gwGa*0m+7`hPe<tsclJQq9BxV`Z^6VN9YtUJt{_-g5XTCZ@<|u(94nlu)Ne{Z<iU
zgb!<-(Pfap>x(9GDBh01qKclwA86oSaw}0zvZ(LWqj&~bniOWkyy2`jeMohWLXZ-z
zvQIWbLov|J*r7iTbj=NA78sth`8otnnV<re1fsnt!b0OPD+{h?cBcYGD3K`6y5^d{
zXj6>vtnnNx058AgsRiq)9jgLNEWZ8@P+OZVBg7I}WDr;29`Kh$waj<h8IWM8z5cfP
zPyeB$5LG3-d)P$d4WM{g(Qc>Tx*_4{ZxD{B>1GkV%O?8tZD&sNXYMb3%Ceqn-7{ZU
zfi&4Bkzx#&^_8x1#=?GWDmfuS?r%NM7oEcH0Qm@BPf7XeXS31v8Y!0v`86LQG4`u3
z=b#CXW8d-z`|qwWcZ)tY90LMSb}u8NAa*+|t4K3}cr4F$+|;`B;aP3gNSg|rtW8j=
zDTEk_9ThmL#8A3K+otL)2_+CP3h+rso6tQLR7)!4Ji>?s5*69@Yj5ErRRRz!Fu5dP
zYa)P;e7E3z#17w5CHV%-40tt<wo4+m4xHa#dI2%ghgD4GIlfR+EOj>hOlb|&4CeC$
z=)mCLjPUS;KsX3;`0w5Y_b&KB`3ut-As|q}O~8Tm1MJ{Ygr?Il_|Q=iN|k^0Y5B`i
z>)EnMy}hc!vCTu})zusf%?CQ128_+UndMC}9=;2{x{>GoNH~EFgT8<q#$gK;<y$XZ
z3zjTVJ)$QdOiBMNNf+B6!!RHUa-RH~(leMk*)7PZ5n1PF#Xt#z*=;{kHJ+9N*1Pn)
zP-qD>ix_h4m#P)09mVp~>iCA|>f%n=Dy)C;kvQ1;7vC0On;1?1k7mkNPM*(IQvQMC
zy<d=fOMb1}EjBtq1*d+pA)t{7rxd{*W%;|NZ4c%P`sVD>J09AzpI=xFdRKVW;C-Q#
zpAO2~Xh%3C3S+5a{nCCQ1r9YcNl2E>v#Ymgi74en=X-D$sJSC;oT<}t(s>jzcri#9
zW85a1Ke4%ktpQMQ0wj)O8sqG#Y%LGklqqqkTuqH*1F8j8ZJ|E3f)b??hOD&>7NqlF
z1}zdc_NGVb#v6=|MqI(wO-sl$=n2CJ=LXHeZdhPlbNVOr9nig$F?hdl`A-jHMzmGN
zEk_%68H@8i##zc8Mo;}=w?c7_M8S9&F&_e`N|IVRp&bfDy6=<dSX5(~<CWspdr`m2
zN|;{C$wV21i9BO7rXV9|n>vp5Ax!X(03PbuD`$(8wviaflD8%HfJ%<da&e_Tlsd6L
z+3|6kIFL)kXMU_~wid&0L{{HCLOAbJK_Pms+Vi%2QatT(R3_^q1sY`)2NVSBGNMr3
z+PMWX)DC;da<&)1eiJG@Zv5lEL~*@aG(G1-@ky1G1Ixi33HXO0YR!Sunw}b_$C7D{
zNehHJI@6;LZN$ZU_8p6=K;l|P?7fAdk^jSql3eWKVZ#J{A@Q6D0^iU~uksDZ=;Tb+
zj_?sDz>+}rRlrcvzUtO|@Q=9W#&d_r>AT2E|DZPyF}6gfY*?FwRu6Xc&}{0K#cv4G
zwwQ6@qmO)u6;Q=6eiB{1h{i#ZKeT)pFZh+2H2F;&*3PbY#`WaoiGM*Q1{mF*6V`(%
z@2VLULWB+5oH>!=*>r(vvQLd0Zfi~8$w8y`kLqV$NC2X6<Jb{F%G?5_swi)5qKV~y
zJ=l@whqAnB70K7-^V4HV`3fjnDsJa;cxZnna+r?Bb5B_Rmd@y~ON{1=A5__(RyCOg
z&B;%oI|N(VnwA!Ao`pyw?Tne~toz)mb7jrWeMP!!HPh1HI~*QmvmQLLzH>x4%-III
z-SY}otc!qZIn3?IjA(!`McLOMK$jbo@{^QxxH^TOy*p+)%8&B6Q<DUpzv3j(-3`cn
zTGYr4Iux$>Yo0xy_Ybr%+z-=wuSdlc+7*++)5z94b<mHol~b!5T#TYGIKL7$TD})g
zJ5?C$+C7?WwRBbc&c_Q<%dd$(R@)?dZmrUxnx1X}P4OEf&jP-x>fUehbyTsJ7-Pvb
z>ttwtv)<tdHm3Qk6+8z?Gz^RPc4wK-W{;~vUMKc&a^tp>!>=4q*V{7!3_UN#VX*Od
zJmz}TJ;A^h5$-Fnr$Da%m~0vlr9?asXit<HLmy<S(HRNCP!(;q3bP5&qbU@AQ*yOI
zYEFWPSYw;BT$EW!msGoR?-2{kh@{~asHrRPv3qJ?KFvZAMnHIXAVY|YTY5+IsQ*^b
zUcOl#x0cvXrW<B~RE$N;vu)R=v%sfPF8arBP&(mxW|{?o5!2t^9ud~{FSgzLCo;*X
zD9(<D_(@-j&&-G)6=>!>G{_9Z9U2ks27m?-sOLrBD`>VZDd-iHKf9g;W!6A>i>Lx!
z0A-z9!_3d8c`Z|JE{Rt(*SK~v@tgXcpZL?yq(;)eutGMUP@hT$<kN2-@Je!<dZG+q
zL79+yGwGm*a+sc~8n|DeYTe|YA#t;PZk*&BE*mDj5C6i=#hyI`_ep#-Yp-UXg~R4Z
z<?1Jz*1Ffnm!w>NX)D!V*^3jz7TKJL%BCnJ!r*<)Iw1b)rjvohPXk53Pb)lSUu%9x
zUh}cmLuZIPtWmgJaq!>@o{8f1{MTU{uu&KaV^?({Kp15IZ@pcm#Z_Hqdxva|E?#5y
zY|AZqqovBlV2wsYw_WDxVm|yNf_SB++j;k|8rM^3)<K`Q8a75iA+KD3S4QtPeY!!j
z$UrLO;j~YhDVZYBW(Q^G)AAvzKMzi$6Fz*Ph6s}Jc8{O#2LYF}Xit)mvp8KTr`OIe
z)E$q4076#7`mNe!P;OXE&?zlYiZppoS=fH2^>&s&)xQ+Ie`8f|VnYoUp0%%Q#6Fp!
zEf0|YCXdkdp`xT0ngy}Gt1C595n&}YAp}5Hw60HdTp8Kv?I&H<u!4Z6dW$JwgLg2E
zPny;%5p_GM_0uWvQiDP2o9~J%Pq2jD&pJejS+<YV>G<%e?8sy=h~&}D)Q-JrufRBH
znZbd_r!<>Xn~QbVM0pe7q-dQz@~*s(Qy!aU2v#O|Q4cAFn?fxAo}HghFe;Q+Kt^g!
zTtww2E@VK*5g9IODqPblD;P$xW;_1P<)Wixcp-35c9Y(&F4E#)GkRMn!|fFGNVH(1
zZ8Os1XF56QdvJI<by~^6%~6W4`EQkl)E?ch%XnN*sGta0ZB-t8B@UbA;R&Sf_3O1r
zVm005d5dg>wJJv64$w@5(V?Gc>7S*0Ta=c~ee;8qs5Pw`OEkH69$S{gz=G3a;182P
zU^0D-ho{pi4||9oD`x{Ie7qphLo>&oo?4%1XbOAJk$legR!P^jEa>x=tMJ!r(RWR?
z-R_Jh+c#<;!jaKrn+&vJpPq4=6T=uwqtk&hq@jub3&ZI_CU!O?cvh}oyz)avVnmjR
zT^6*|xP>1O%E*Fs?Zj4NLev6{j4#JyM50?66zH_3$-0-UU(`(hho@;Bp5&jI3U34y
z2udN1B-~<IrVq0kny|%4G(^NlW3buMan!EPHV1JXsOr55ti3|9N<@{AU?yFz3(U>O
z25SSwfnAuu>YUHKxL@D`75|HpFU5S*w2;sMVVpaX!1xh_Q|e&yNN2PWt~y8B93Q2I
z1k4*;9TBfCgVPWvHO5YyRw{xwMQOP@604hyfyv5u(MK&xyH*$VIK#m>M=Nl^BySkQ
zRuIUkwNpNDUXlVlY?td##&25DDi~%JzG1XFj@aDoGpeaPwOCA0Wk^-g8^0lLs2T62
z6J3eaKDLe~8%rBabnuzunOQD^hq1VebOoM?(@5jF5S-^!y+nKy6ESw}PP2&*^tIE}
zvR^$*!?E+hsC3h`7Uw<p4Jo#2S5)%DuQcih9&Eg2`gz1UGwib-J6&;0)58M0z_T3(
zNiqj7xBH})5AS}j(%~bB24!<JByG^dVjVj*t+dzirU}QZn?yWlkWH<ZagSTZuFza|
z+kG(8pw<?Nb!*L~!ktix*Z|u^h7$eJ=k)d3$hmW)<Nj6nbZ8jMKuc~fE9;bDaXA;6
zlOdjmh&scK{-MImLX0q4bO=~d)xOhm4mA}p9lh(sHl$xA9~1T?nNlRc2Njgu>R|Fx
zJOuN4vM!$HM9(=^U(ibnFMM67$bum8Mv~SfXV>}RKY2B<o_t>R(2s#1Qi_iv?9_ur
zhtpO@pc0Y^`3o+aZ!SW`n0@_df!<IqF3XXeR9)bu6PSvl9)g!b1Anesml)Ay%`9T=
z89D`3;D#vB(B$d+?2We0(An3^QKA5=>ls}AlQ>H*L48cU`7}V?kvZ~tzJvDxi^XfU
z<IBr}@LO)m6>r3LTK*?A(f;IiT3pT4v9QnMS9ok=?>52uCG9l_5DgL<8Q99I8nke&
zr@<1}iAUV;KRhO~f2+j*j^ajl<Gc?$Jtl$!Ya_l(iDFsjM?tjLTut5fX(qrYhi!eU
zA$Suv-)uwFJWpnc!XOD~)QQ~dgK<+GCY@O~;6U!1D&RatdZ=KHgcP_+fAtE<2XIPS
z@sJ#O(z1ccgK~S+v9Gdh4zR-0!l;c!BKhw`_&bWais1_3r4@0a6T-$;ED>te(&X7m
z^8OoTX^F6c{A~?BhHKfTi7-~Cqghqq!D@<cSyM5b4emI6c0by`A`=SMbL829+DAqg
zi~<t~`;h=(q}+SsRhEYjAebB)6|64S-yoDP6SlRlL_=u&>k<|jDK#WWr@;%wMWoIP
zm?fNvwTxe<N{|zVn_$}kCwrx2UAe}ZLRr^RWNDcm#xiNkftzx(%B6!druG83fzO)g
zpsN7iDnriZdU><)%@ov74tN>Grb!5GjqWvf2zb_BY=X1-ZfhoRNl_Jq$y^@g2^3Q6
z(Dx{xbt+TG7M<m|qXC57IB0TEoa^`!LU+xaPto{J`3Q^kP4LiNXBe)2GUnzmb`BbF
zb+7mboE~}}mQk~hiklVFz5F4tezSR<^t-k1%~On~g4X9cjCIgfHx-9iR1^lXY9@4R
z@CqG4SaRTtjBJA-o>t)U@KRu0X(w!^&rF~<<>9**bw61iGyj}m_OZe627&0j)gu*g
z(ZsN4ZI>HL6o~-2Air&FA&{n3J^mZ3cwk$_aEb8P*Y>n*-X(Gk;9QJpNLd%rj#X%V
zyFJFM<hkgS>4YIR9*aC?fAvM!Am<`??5Y2crLSO%t6i2I+})kQ3GQx#ySqzpLV^Ss
z+}$BK4DK!gg1fuByGsa`T)utoU+C3OzpJXNtHhUd!mS!y)#8wzgM>?$aZ6=_dN7Kv
zGD5-|`5`XHMWD=G1QN`Efum2D<Ad_FN1SWYLdKH37N`@i<$C_C(_VZt*feDNB8ekh
zu|3QUbQUlo&)~tHc}wL?cMvZlqam93Z}JtsiRu8f*PpiQdK(;pY4hV`u_g>SaG_px
zgtG@&0n+kx+k$@ht`-gIz<cMB>HJfgB3Ox4XDugFfUjmcXOw8W0tV(4X~~4)t^wYr
zk~(!$@|5KKb)CbF99-xfLSI6!S7G*SA`SvN^4s8Eie@ZEkgtFo_)MZkfq?vI_Oo%u
zpph9fh47~guw*27^PE0yAo{rIRNu7q)Yo;r28t>iJfE|O<HCPF4rWhq=e^QWy%>=Y
zIATFA=6GDasL4*^dHgV%y~s@}?iXx~<`ETATi2Uhrd@isP@gjqU>(MTKhDJaMKNmq
ze_snj>Zgvb?kFWGdU$-B3%r7R!-gClZUH5ah`B-dm;$D5A4*y>anB$h2MjMB${Iff
z-s`<LKe;_g=48S(E&g5Z{YjbnuF%DZvMoVevgZ%`yRCo5sia{)6~<bog;AlztNj}7
z#9_uPamCI1Rszai$3(`dJ-y`MDemRUWu0j%22ksz<COV|h{Ga}zNqidnw%>-<f;>Y
zCk|WZpW{)IK)<!^z&gB;g!xLCa2xKzCKqgFkGm>3*a&7iSoHb54hqa1&g9^33PHt5
z_JUkJDXTKgb>P=5J~_Gfm{@QYmFQIBwUK6p-iAqz?;m!BB@yEZxHnKQj(o8I(PBLc
zE*iq+P?%2xd*!P>NGOXBk2nsVKQRD#*2vZ@l1wFkfGR3$)0J7_`Dk|g*0rch=-Xue
zP|5A7KK1Aa99#WkA8XeWT)pwL64-rLWLUh6!C;4QObr>PEnJukU_MP4lT>H7VnyL~
z_hlg|j=}tUA9F8LizZMlGk)AHl(XQDC$BWFU8TtB_!-mS>0koetnPhD5jMY<p9d@z
zVo(zWg&`^*Mr^1A4NWZlEs+`2%}OfRw58!#HX_PAv>3jgCd5MX`~FVZk-*J8d+w|4
z7Mj`*4T*$QWYE#_4x@xI^(;z{D5Ne<n7D_WdsM66jgmXy8bbpy+D~(wfXC1snrc(|
zuc->B^gtKKk>B0hU4U6=SaP5PQ_uhf*gG^INdVd`eI~p^)84lif;dfBc|40k^AX0T
zp~SgYkA(D*n}c~A>ZL-5!bhwjYgTLSM@^pt{WCKS&?l2L?$|3v@<A#bFWj&g4IjlP
zoJHe+jVYb#oKm94fZ4j0vQgB5#me?!co~hMQ1bW!uFtVyr9He0zHl4i$L&7i5YkiP
zhWcIH&nIu@pOrBC5zi+h4uZ&EoFxDp+!?eHWYA?ZRIui45=&gCbe<AtqXYHj1-e-R
z4hc!j34>v54wo^;%=`JX|BydXyQoTR(j*wL0N+WPo@nlom~VEdzLGxD2#L5F&m0wE
zhZeDW=Qc;f7i0gbk~-p)!E5qI*HfL*Lp;3{e-4@?exFd^)1-UGjEV`bp+r9$$UjHH
zc};O5Mt1=Rj1*HEjfrwvC=iw@N}A`;h$1m3lm+1v&}E9U?X@Fffe<*LKZ`*=@`cr?
z9#GY@@Zs@s;*8aKQw|upYVQ|E_0|_1t?A?hlAS(UDm~WK7V@Wc5xKZpz+vSIylJV2
z?YZMUL<37mdn*n-Vk{?3tuDDHCe_DzEYeHc^E=_>J{#U#Rg)**Sp+}hOF93j_;Jpy
z?%9B+S<QK$Xvi(b0}TKG`PT1QnjlrtJ5xx7I!65ctEb!_3=`y}v%0o#i>0!#!NP<u
z51fQunw2p}(O*fFxpntzD8H($k~p1d9{D6-PzA!6$Z{6VSm5fUU%+HgpAtg$%-*MF
zVDTBrEKIPt0US`2dJvh4obN?j18rz5N0~1VU0;>U)GakRv5?RE-nr3+Cf3?$N(w`f
z3PX_e63s;51zgQhSX7sAJxR1H?fPM}ushn81)9*YB&Ar4=5>fVYi_J10}I8zy3pHp
z!7nH<3rCTg0t`G0CE;3$b-5eyM?RYC<H<oySf(8R!JyVVRUiZ}1kCye%EItg*nLDL
zi+-IuKXL9EQbAba5NI%oxS2}`I(xFT$L@=Bg<@mu<YJgHjNS!FE{&x@xZ~G2zHb7e
z3+GkRxhewMcF`D~L)I$fdL7CFf(uN}$z#S&D*h784X(E|_rU;t(n}=eB|Mgm)C#o=
z->^=vGVrPcy@J~7WI79mglW}wV2Q2hqLSh2N7;KcCAabHDGTtC3Cx}u6>osf@Lr4|
zd{FI>e$5-5&ML18k3U6!EcYb{{^f6e7*B=5(mIS}8`L0SYsGyKXhxu!>d}@<w2UmS
z_)2{acONyL_o#%SY4*~fM>EKd@Pko(_Q;RWh(j0?2<0+pay@}O%Q(0;FSPw%fC-WC
zbbgpvR&_)rUJ5isTtK;toZ<GrvfVzit3@?6E#xP_Mmk04eAa<MQG>D_JoAK13>T=C
zc|4vN15;rZQ2?eDzkjZCEb-#TL4J3&7JvCH?dYsscn|uX@7GeFI4(21rpN(zz>Uza
zg@tQ>!w*GiR;dkqt(~VB8B;JkI?8Hj;WU%rYzBr!F4{>GWmxu`$PxPh66TVHn>V!k
zSsr*PZQ|R_4+`HV+OeJ8UgkbxJHuePLdnmqQUCgF0+2Ix8D@;r!*%c!U5k0dQj86=
z8o>4pBzB-E0g~kBqfIn0jNK%h(#@n-JLin2A=_hma4>Y(^j}?pM~wWG`Z~lkKJ!>8
z9i&GEDJ)YJWVe>RT<G@4L*xe;tz%&oP8Yk*t)8{CvSYZJ-zUXwb%j?Dlxg|>?uh#m
zNp?zKa2iAI6!${9UbjN><l1gMCL1b5$F#nkyLEK-xd{D#^UZWRm^k>%jeQKC{vuyG
z)bpq)#uI*zc#iwgK>1&Wo+|sfh;(8Ujr-nZm+BrVB3W$7Vn}`c*U9A6N3>GW>shYg
z5@1im`c(RmemYl|bgR2!YCeZ2yVIirIvH1CM@!}?905>;Xnd>Fuxvy~Nf3<9!Prkp
z<mSE9P*fna(bWv}*lYy;`c7?wd*=<YUi+ysav#m3Z)6);`l=_en)u8TSj8F)VNWm?
zI$nSbpQWO5Bb4m^%!D5Qt){d5s)gylBX0WrtUE1<JmZsSFM=0qejl8DBlcqx0DJvG
zIF3}AFivU<)hbpvwmdhWi0T1pS?8tUvx9aVg=&#N+E}PJ{^3D6nr7RLPl11J7MHo6
z6D+s}kG%BUy?nKmU+h|3go@Jrml|UEO-Z$V!MC!S<0Td<dR0_;y49}2if?A@T&^|3
zJ{9CJGhAmpAT|D*$~i6P?{;m40yAzYB-#JX#MM6r7@urx571OlA8f<>dq#zNT^m?Q
z>3@j-n}7Skm(uy`d``m#p}AF^+9n=!QP_x8Nq{$R2~&^GSg5DTKwzX-OpNpOV5Oe*
z390ybDK4S|Ii(u%hv$J>0PH5+_xK3Bm+afC4SA4GAZ&4lV-d01tIn(DNc)%o;7$<k
zrG0B{4Y`J-D&m%kF4mvD=<}olcx;G5U!kqUv6^aKX<4iAiKcYU;7A#tisjjTj_~5=
zV7WRSDtuVl4KZP1hVEq&0VLv*%Tg2VX=1%TOG_Ni1+V-iW?YkC3cYa4GRLay3*w$Y
z-M}xS3ryVRBh~9Wt04_tOE!MBIEE8Tu(a;K42B#6j|Yu#9rApae0s^Q+`t!yhk>^R
zqgCRyjm1FmCca4b(0b{>>i92t<Q-ke4or369tD_#7=@s?amxNW=`3&!r0bY@Yif?G
zk&Ar%CFZ}nrpL;XL@=v&mG3c}=AO%$KH3sU=mld70~8o^u;z(CVl3PnaKA8HNDk#s
z0#sb!!6GfVJ@_Dn%|I_SRYyM{_i9(5JJfAoz;`lXm^b*2h=lywu1JD{aO4;&yPcc#
zH((-esO2KV@f77}t4wub(0Fy8Le#+$=3qBtB&uKBR4>-)vGnEKUeG-DL{(4QkzGxd
zeP2UvvQvQ)PNrCp##V4?NgE|x{Iiav2M&%EWmkH1=!1APJtK%+0MzC)=!_-+o^aaz
zWzB@SY#j*z;U#QvKiDr4+npOvPJ6MAM+{I|{>*h(XwfTj7rP30CeSAO6yk<^XJE#-
zM;GuJW=Bc@;Nm$l2xX-14S2@!G)n*Z1KQ(cCDb=Z@nAb3B^Ey_6(<*gFx`Z`axwFN
z@3W1WSFA9ehJxH81Q&6_>HHYItt5sw7sbJyTg@Ql6?pDH`4_x2L*U+NL94X`{ov*=
zcN|a}fE$e@20K8>PPqFGEo=zYMoc9Cw}W^X3CMimd7dngf2Xo`$*C4cqH$#ePhc<O
z#>Zv&q>wc~ata#L9xE!v`$hkVI85J}1(WSlzUsb-=2LC;6_DW?P)7METS0_bL7VPP
z#}+C@!H?{!9RL37s}k-5a;R&l3#A!Nfg<+~zPSKI*h-2Mq4j1ito%IXLYNFw_C}=a
zv6V;;w*^;kl?Gd&Y@;Jn35sw|ryQIJC_`q<<T%WD@x|GDH0G%<W~`=*Th0a28O`Gj
zBy3scpG#XH2?kO*>onVYRDg??R&hS|hXSjW|JPQoW@_oZPuYJRr$CnMdFqXsb^V>w
zZ+K_5W;VSK=oKZ_u$UlzOe_9vJQhu2<k{*Ch1ft^Tn61~)QRtUnx97EwfI9kv1bJW
zx>$bAW_mya<X2<)6CTkH8lWpQP?KZ!>Y?4xKx3eMUgRxe!6|Cy5lk}S(hUPP`i#J+
zQD6o>MLPW%KbEm~Q5ci0CtZ-eyJBeX)Tw(BZoy;q7XW>>m7_ym;|O0#z3e8gUMP)i
zUF$0S47khPb_!^pWsRyTm@C>$^eyKkJ<A5@Fc;=4)CGB$AC&rf>Pt)4U8JrIjZ*eo
z3tgS9QNx2w2!SX$Ra9FBmm!?|98)mmw)O->x&QdQu)>pQ9EEW1voMP-b8ku3DKp>(
zHMJRsCGfFi{%_Bm8fdGQO*0S~B;mA`nBE%9R)|ie&GQC?F{-~G5ieFPvy7JR7-l8b
zS%aOPKv5p5EeIp;!=&T0-RTYbJl#H}xsTZs31)VLvyiAjkSKGQ8P~6bYeoW~GsLn_
zVe3n9fQ%D0lVwlp%Hca|y2a`_Q$j-{2Gt@WsUB<*6ufwdwCS<uv-_?vb3?G%9r9ej
zG)WnpUv~z4^34~QFpXUeQ_YBE7y~t#C+yG8GJrfCvH%u0l>DGX^y*!!YKbW!5>>iL
zFE_2^Wg}t$s=sV2PP4Tm2U$ke+PQu-uEt)Q={Xh*>hWU?@>z^mgu_q{3}q&%4k#WA
zaNUMa0z6&=kas_2gM{sO#VJB(*d*SV$ym$ortQ1_tIs}#ASF{;PUs%g1z`({aHX`g
zeJP}?U&TBBl)z#ZEj;X{1zV#V^LzU1NDNEFKVYZju4Hql9Ao({oH}NAb6BsyWp!kl
z;Tqg}Lp4&me}wK_Xd%LWA}K_jRdQlL@DHd25fI!;2e#Y=nECBI)pan)DJG{kQ0(9x
zwB>ka8tkF-V<rE}(-45p)H0t01--8Xpyhd?8&}(9D5o6Lr0OO7phaaWSQ?M#Qo$Df
z<cI=iK^o1e0N|R&B({GznN0a!eL}zl@Kgp+51?Z;?1x}f|6oS=%;kan&~{h>pn=T5
zoP0xf1fqTOom-n^;yNu|u+0WnKgx^@&`4GQ_GVmDcSIQr0G<c)3IF<@V0V~->901U
zVK#RzCC2>!K`Yb4M7*(UN6F7Ev-iwyX=;;#rLLItzlogM*4BU|hsAM6S6rR2*&&-n
zzS4O^r08L(r0P=3OgdLX)#5bKd;5WS%;7T`7LxsbGHl3Tb&=m`LCYba)ol8{oB~s1
z415Q|m`?%3g7=KafrNA^v|+@3_eR=0!kiTr5KSpZWh(jjsvSN&6I3buS?B0UTFdeG
z1W2MmK1TqilI#L3CO^qiRpPGT8-@b0y2^t1%2Wq$UQqi@j1sFDBs|zU$W6U5#TX35
zERURWeKt@eeB4Su5xILEo0&MLNnlc>cg;@ksjV-2#L+amL|1c4sDr%9-Y6eNZf-V4
zRpqOO34=1nbn0&I4psYc?(|*(J0n(g)X`?cC72WU!7BboEH)#^W8ne6qT!jZOv03B
zOuSI_{YC?qYn?+mREuwn<ol(h)0q5d|E(Wc-ba9X)wL!?QQgKZwRHV55EBtZAU8`B
zQ?k3G4`}%gGU$rOr-{UA8$^0|WlUw;A%4JnUs^0Q(5J9pVb*~`{iYAx$Iwuq<V1xh
zhnk9yNwjIW7Y#%Ja^RjW;Y!@t6m;twH(yJ{^wa~=%^|z2wFN`%eZKCv!e1S)RDL?~
zQiYLKHX}bGi?CUI<64UnCnY?s95OPyRB=mEqs9c6e8}6R`&WpxHnMo?UN|)#dZCT3
zha4@IHpS_W2NqayizHl!(KQSeZq^bb9v&J)+dlP{Z4zY~rJSEdo=Zq@!GmLZb41-;
zb`}JDs9nWpxA;7W$myntOc=lmj&AU%;V)ioHjDpNZDMHodrzeJ<`=l4P7@`a@AlOV
z6AmC%sWMU?$ZAC*jr$ky=7#$?LpGMVB101>(sJBV!j^QGmb2P&ySzs>Ml=w88l60F
z*f+ovAs0%@r=K}6Nm^W<9spMqbCj9bgz=NdR6Du(5$fJlQf={<<apO-yr}D?h4d!`
zU%2otW>&r6x-Y|f>41i=puPZKb6mtvOCMMFOJxW*E}F5mOB_(X%b#cp7qp^K0@$ma
znUfAv$$Jq~S1EaCNXBCZgIZ{?;@36JIKgkDnj-dy&=-)0*)JGgw*VVCDT$IXdJ)>h
z=O2FXWT45(z)5I}Fp7M}&ou7u&OP{7B|-6RJr#ve%`aVQv=q5|9Q8Fo0?C+@{?KR1
zXaZ(bOg|@$51zpv_?hP<(vIMaY@^<|_t%z9pc@9IAhpf^iYLHnmWQP;iHq_*1ua~1
zeEBs(sJ@1`M7ikh*BT!`>^nM@Gydm_8PVv+Q<wLaI&tSoJ1tcw=jtV`(&Ezc<aD$!
z2cEoFaY4j8Ps0V7?~6Eg9-1_EF(eparvB_SgrovZQ>_-6=nOiB^RU{T`t-3R<jPTN
zrMW?>+k9U-uiTyo)LNX%na<EJ6kHurgRZfVmF5D5e$@`G8HDQr4I8ZsI&VNd%e8&0
zFl1r@xJfD@VBMRTnM!0(jJOkowWZ&xXjBbKmQ4eTo$NR6t+FHvY$PEX>U|G@S@GGK
zJ49-V_1Fz$Q(sGNo%&o)a~s{j(vo(BCP`ogSHSZqXxRzB5ane)ut6%!oxlmbY(7t%
zi%0;482|lOJ3~6m%23BvPx*ZRz4R2u*ho>&vV{2Q83(p8K#OKp07b_-N%jAudfp_h
zX{aQyqmu^5t&7wa<Rb#UM6R=56cmb?C>QI=$A@4dE_${;_+t7!=qI9%Y@rqdzlou?
z_pf4QXJkgA0i1d#Xy>XVE>MeGg98X><XiJEyd(Y0%)BU{akysg>=uZ4bNkk=jM-VW
zbJL)l8=YG8$BKtn81Z2qgtj<K%@IhAM@{IsijA!knCZ1fec8EaUq&!b>*Q+=wED)%
zaC)PINdb4l%xtw3;u7GaJ~oxL{vF=Mh1Sw`lHqp?nj94a;u6{-b-$GX;#YBv5VZk<
z;T{{cW&jqn7w^QRnlU-0w~b_PZJzojRb+KIDt183I;fnmjib}BwPlgVZTK=d4#S?h
z`04cb+OrkFb_qzMwGHs1id6P=fnzCke|?rVS3!gByitPcu-%@kGMrdJAs5i%r?&iG
z7wS4VmP`cK?aW2$&GTX!)|K=GhG#CPv|={MAM~t*DB)$q?T*PGbO={a_U?}vJ%MpK
zm$~6^>0tzXJSl&D*J|685&D6u;qAW9u5~68r%4gOi)~l&%%WX57-$&(L3@~_wh-U)
z-suAcpU&ca2p@=%P`V1+1EqTLPmr-obz-1~tz%Os-ntjCog*R(GS?WkZ7<blVVKH7
zwTGDamRwy$B<dIbX@44`3*-xqmLx<w*)mbga2-#_;9LS0$*}hVq_^>)B^4qk$zS_k
zYIG*=lxQLYI<O2i)Z`Y!39Y2Vz;WsUqFkbtEfRsU7VK{3lWMNcl-U6>P!%s5*`wEN
z69}mEdv9t@Xad-wvNfnd3JT)q6<NaFCyYDKjzKz=NS&;ng#d7fbrz!bZ!T!_YCFM5
z{u+Um{~GY)ZGDA$EX)ytS(<CX#ZcplhI=s6Tlj{jPVYblcL-@t&Ml{wD1x>t<94^=
zi_awyuPKQeG{Pp7JMFHtHMlSwXa3G$zRd>Q2B?I#+Ug+=A>eKIwj!jFyDPA04pJ7Y
z$MEGP3Z&JK;ImQ@x&(&p6PJA(Q%b8-ceeF|=TsNnlyH*@>p<ur4MEG#=5RZ^LnPwO
zJW|<%tWcaBxIc2$vpfL)ll$G`^)9WeMb|c>qn?okQhdV$ymuG0@)fj$?TN#XZS`4N
z1UYFiEh`6xtomJ{f58DK&>%!lr-n9@a?CL&@#pw;A{PF7=2~v4bzPhX%@9nCEj;Xq
zi}&Jn5G~B@wxIp`!v>a0h@o+%j!}-0wWIuyN5<-b=+Th`hw{oi6NX6X;Qz|ic-u_j
zSWc3DBIS&!xdL@cs@XTvR%QcZn!;{3P_rC&D%@ii@N=O|{~1FuT4VgO)c!b=_%P@r
zC5YEdAHQwo<Y#)sJHl1K+7YtA12I)q$&js4wyYnM1x`QtFPzs0jUAx0wus|)y9THs
z(l&#b1Xh6NjVxfsk=M$rywIymRGW!mIxw@kXCKbGe$gcG4M1sUPl)~gYe&$6;>I%w
zvuQX)NxJUxW|N)o6D`2Ooo83zC`A(*$7MvytkSOOCBHo;5?Yey?j-fYXW!cw<<Q){
zr;CFh0h1OUq%l0y9%zE8w@t9*8j2s)*fJ}yY2g@RL_idrQmQcG_yE0qM%0j!OYUMr
zt|g!sY(0>u{fPh5sXBAOKi5FrM6~2ylD?so(r{3D&P!Gi&zsVEx92~c#P0#$j66zE
zC#a*mso9Lk>CX5JLnjp{EdYiNj^Vp7G_8r5bd7C87pML)P`<BWMe{T8VfHj=+^ibX
zBOky=@G8?(*;8*JfKRlRaWw0q!zw9908i|6^bOP2vL_-_uPQxj=tE$KvD-Mq__QRE
z8t$>LN6U{j(_hcBAps)-gCXY+Ngz@Z2{@c#9POX+wvhf(<qD#=m|kF{+&brIBlsGG
znK+QAHVUZw{c-Ay<z_AIl#o)fP{DjMSY*!WJ1rlcz@Hek`wLH%D+XckHv?rf+_9SE
z2`Bp_dh1Af7BY%oj_mLnM}2|dkY}v99+06#7~aM9MsN0=a91lY5oB0y2B$7*qMQe)
z<E>|LnBbhh`ya?&<tKnYq_|6n3n|zCqtZSKX0)c%DBG=Ak}Q#?oE&bUU*K_jM;3u8
z-5AJZZh%)e*^#$3LJXnV<p#dsH>4HfaZ-;Bxs(c1m;6bwoWsOR;heD`_oihLMkTs~
zJ_uyrP5yPFz6%vb($~T8iM)Z*W2B(b-0>hb<jU#`E_gw6*Gh@A4~x*^-Z8-+nrjfR
z?70i?6&=Tc8X9H`hMIQrBuv9jq_NM&ldmswWaQb#Q-j{d9j@63pFHFkkMqe|dQAO5
zi$}P$>>!&McW9T7#_3Osa}6eE7LC%)nZcJ!xra3bk@(73e%?jQ?b9z3f06SXs-|hw
z)spe79rOD{Eg=7vtLj)wO!6bo3ZSg9=4fs$mRhX-2O5ieg>|M7aUNiOk%iL1@Lfgp
zDV_~3oTW3Y(W%rpSqU9=yMc>NhdRsBxgp8Edw&=83gehO>=+a7<TB)xx7p;CBM7Ec
z^~$cPimZvMvv>J%10~Mm(U>!$ZgXz(e<duu$Up^Z5_&z(t=YE{9EG-ri611i5ySNj
zq<>n8pC$6Ggp-S^qZUp`$>+L=&c$O$&YflG*Xh9|TU#|$#2(Lpo9ge?FU-uUpvY7;
zltLo_W#G~^>CCI`h$C_q$7sqFTjDAip5vwcj5e+Y@puTZ=JCPp2-39m**A~qNI`K4
zD>hMn%U2H}OCF#p+ld6x5*4Jhdg1A&qXEL`qwb|NN2Ofd%7OzTzMl1EeBGX^tf3<i
zlQg*rx#Tn*wyGJK^(Ig7z7n8uxWga~9CAGVJsO?cE&D_Cp0Vv%PZpl5X3R0$Rr3DN
zBw53?zG@ni;Z@<4<Xwj97Oi4VpfH&6h}`QAr6%Pq*YFUi++3B{-<-vKF9EZ?P>2>S
zKQ+P_^ySVEG;{hrRwzJDw-YLy%FHe5j40PU=2#!i`6wHRd6=M5QTZ+|R>QAI_$`<k
z`ZKMA>Y)HZFDc6XC}a!$F=pV;-PdWz9^e`ZC?4<fSeA1~)(d4EwRj?PWLIZ`e5uy+
zGrUMPg{w(ch5|V>ks=B$2g`&6iohzv{&#1yI7cT4{>())2w@(x0`GZ7xEwhpWR@5<
zc^7$ir-nBRON0b~5daN=!x$;btZIpR@0u}W8fy~_5ES|nbS&EtL1o=!&@1g-qLN1g
z++3@}9&d4i>MUg#Gp69kOYuX#2s-I?;4B8$F;<&6+O{>841PvH{xa9-$Ag<ey3(AF
z+GD?tI)Mcv>Kx)qkjKCVes?%{wKo<hrW9V7IUZdzRlGg{w!O!U@Vxi2j<le#CXBP9
z9jrKci~v)hd0A5&a>30$rz&u)86OjHScaSJ7prfB(d$9wVY`hfO)AKXrA_MyJnphz
zEn+9~Ew3qz-s-gL-KFf;s!A@+wEtvf(Q`iDb5E?tNKU28R9p<1Xb3H6!8F#mYLs#C
z*rI}9y~R)=LY?tJ757`TCs8@_N9bA-1^#^-3}-&;Wx($YUj2?lcotrOgQ1ZX$}G?1
zHwoNn7YztgpF0dR`dm*YQ2~IjIXikflW7?YJHhYK;6;4*lpm>%m}ORwsn`odzOZur
zU5L!+y>N|IG+U(slUP5sQY4Zvac{JZ7f}CV-w_cQMn&x&3!iIjRUOtc-8G(n2%8Li
z4LEQVjf|wt7=Q}7PB|jdDPpKOD&sT+Qf4Dj$tmBP+d798m}SExbYWnzybrespk)Qk
zU=auQZ5WL|s*^SxsVgN#0l{1M?eFE9lKN#Cm>geVz)9v`G;}+TllSbrc+Mn-7)5Gv
znF#5NT})z_Oz6a(_PXA-#{Wk99GpZ|Ir^6vb=nwPNpuTQe^u_T^S0V{XZxZ1*2DWe
z(e0hw@dV7dpynHK{=0|vpPb_g?XjuFm_=9YpZ8&S-uw^M_bs+DXa5h_x;uXG{Oc8)
zoArlH$A$J?>z~HE(QPrDuQ_5cCfYw8%9D_(%<P$V>w132wIW)4N9j8c&UFs$oAGfH
ze>W!NfElT$cG+v6O<uv`yqu#L!gZ~!GcWRTVW<abO*Ua_T1fr)O{-*NGS(H~>G)~V
zK>FU2xF#|E3~xabgM}OZ05OBE!3ftNNUK8I9z(~yd2?o))A5I3>cfCV29G<%x%<7w
z4kIuS;im6zHDBsst6Kj+bTkVB_es$L9BjG)MS93fSgtc{Tu-AOQ=cE6J5S(MXN%q!
z<wSwGI-I=<Bza;aSGT|^oeyit0W9uuSf*JV91oiEIWAhCDkMlX9Hn9QPtYECz9x?b
zeY*)Eu`)<@NM*`wD#5*w^-CwHXJBJ;(onXEn->}x6pdJ^;nmLtwD3$lIdtDj;A;7j
zI+%RUxe!j2_*wsN(?;_}*L~$&c3!ehAr-zk`N&yf?!t$+K&Bt(Ps>_x1HF~5dvuVm
zCdJpsjuz+S&dXd<0mcTW>+Au=;YDhPn`;J{pJ1_0+5Va;=PJe02%rUAN8#Xp(Pc{!
zSaPn2ZPQ(@dE$J7&n?s@3tcCEWb}R`;RE7-{j+{}yZr~(>qs-}F7)3!*WG#^v#-Yq
zjLUs~823ZlFxT?QI+sZITC$XreW!M>1B91l*28>0r;^O6%vZy3`E;!9E`4t?pHMI*
zh_abLFB3sLh!ppNP(!_JFz7{kmbUQJQJ6~0edYimjO$Mvu#eQe3Ecdg(A*Lot+p+f
zehpg3Dax#%nR>?MlO;xY$LaTTT#)f(4MfmoT)5HsL~@B1%Ot2kwKLS_1YG2asX;4@
zHPL4wbmRF$a$=hL2rEizBtdr+6k{$xc&GByxmn{Tj9aI*VUCwEk=PGw_8z;yQToX6
zd(7`J;$J)t@cM;n*W!ZjQkiJUu?pF`a4bv<lFud<%X@`iS&p~!-6T@Mp4?`Gs7l2C
zn1<)4yI&;>dOF6KZ}r8O9c}rW%<rg!fjYPxpDTTGPTF*O66js@CSuVz={wnCo`c5P
zT#vJb-)1V9ncKUpa*@t0h$MFIs%u!rsgA!OR5=64xLqONO=9AGK%(!a{?aC|XYr#j
z{$DFMzSR}!h;^&7`p;sF*Z!M}K7^Jiol+gos%=xxy^qWLVRL1iGFU32+;tE4G!kf_
z{E}w!N%s_g`n}p?#KZr=$>p6bvg0s}B01du?D4K!^wH|M*VHSO`M2ci@*1nE*I4mf
z*R^%qvvD`j8GJ1X%d+|e_FDHgDIHe7c$*17m`OD}?2Uhm^f^%Nraa%iL4MxN`zP;p
z%WBMC-u&mm*@#W--S1;i{|S$EN*kLRZy7&KWgGJrZCiz39(#IQUmktx*fCgTnf`HJ
z>s!)s@~>0X?@`nHAh!EeqXYi#?fAoE_1inW6t%-#)}PCcqlqr*+}FP7gTH+5Ek06H
zu}}&2&1Ug9^Ldj#ia2O7#%PAdmXTVY-nl=ke3EQ0K|l{F$y{U9-<gSY+VRyLh7+t)
ziZ4Ra6k)1_asPz9CRzc^kV#=gmDv9-=>)d$?dWT3PjK5w?AlsZ%jfx5kx%`Z!bK4c
z{0UI`-1aHZAzg2gyC6Uf%<tFAV)#>5<G$J*=`1UtD0pBcLi<rrEg+h=PXw*I*}LsR
zy+7581lj?u-7`m|K4v8#Zd`wQFZ-b0ipW(W`aZE~J+g48G^HOyU+Ged!5(<;hIpvW
zApjPMwFc?(D&qC3Bj#Y7l0Am`{`Fh`-ELx&CdwM(g>@yFl}N)81n1&+!u6w($Vz+j
z^FeQrdS&u+Ta>$17{qE@w})W0fhVbdSm)zJz@VXP>obB4gVh80hpN@1F7hCDawUlG
za{?!R%gJqvIZp{wV{_w$!yOOBby{B6k>cIU&-b{u<)_PpMT{=}t=p@o@$joQh1}bY
z>jd2n&g3V*C!V_&YD4L+$FxH>f0>`YhyIDzuhrLcYP-(A)bhW)-lhEjg`#a<|5PEf
zN%Ognn;w1Ly488!{pZux@%Gv+Y4VSZEzQ~Y`g*)tsLRk#U*f!%&y>1$k+1VH$uu>u
z(<Po5jV#_j^Wv9_`gfll`h(2vzeOLUgfN|C=gZY?;oVM&sUK+TIr=8mWFHjj&&)@<
z%Bm}R$wRznKO+6=uTb-R`U`IQ56R;{zC&Rm0Z%{=RJ5G_vd6iFk@mi^Zk9uJ$;$yU
z#C>t@R`2^|Mj`V2nZYtHSHTMYm93NXV_{%bo}6u?-F9%cI(u0^wLuu1A1TI%ML;=8
z-~-kk<iN)2F9Q~Q$>y6+EcQdC0}NWP_Q{dNV*v@qgb<(%LR}x!cO?RJ6;LWEW>o)R
zWQ<5ha3q5?E6i-Akh4d?-Z>_^5p}BeLBIYaJBo#|;Cu=9(em|>8xV1?kX)YC%rYrA
zl$1LGP<0Hk({wQ6UL#vcV27Q(Y{pFVS*5qa{}3=<h7gavL7%)wqCPelqG(4+%pDFs
z7nLCHh2L~gLGO>1i{kN#bC#cH_eftoy2x%$mxZrnbN!}taa5!S8>Mn%8fx_n_|#i+
zmKV{P!-0LY=`kWz)kO9GEzQ?KyMD(L5F2{G+cNcx?fAEsHmds8s5?Gx!bQLNv`xQN
z6MZ1BE2f)!-(8!kyX!)1`1#mItg5oYACZA=blZQA%VqfzBZ3s;@PI7*Aiwha$d+&Z
zM%QN(R>3#&=f!x4a_m+qhL4o!zb3CXLNP=AWRn)f-+t!~2R2u}YJT@&)E|Eiw|Mbk
zVJ$x|6QW^N|E;1MGe4n^(TlZ=emFCln*8l&OV;f^AYQG`2Q7J+ykbA=zn^Im13kx=
zS02YQo@5nEdx{2pxtC&X_lZ*H7(NbD^75MbGzc^%7KWCroZLs=@DP0?k^;HI7jT=6
zGJ=qcW*fRfB&<H9yUUb(L+n=DREAZnq3{KJpmZ9%AXq{#02Vtk!ijx^TIyAC{&S?9
ztI|m=G|&JgQo`mF<PEE`%=bYTNm&j56G@``KV#?837*AssHbpZ<}zzH1egkKN*}%X
zuNHEk!I=@VjM?e)7a~F2!Z-(~&y?#wg}}bnzQ&kImK@Gsim-p%mA?!r%-&d)l8tW!
zVNnsf2d8K+QX@j)Eb+h+vBwG05Tb81y9?=HEZORRsWyPRbMVAom()@ChX!ZmuIE(~
zG1&J?O!LDdnri+ys0fLhc$U7Z5&d>Fg;V=x!-uU{Vc3jtteod@r@~AZdA}PfG?*pD
z^KXpaQalqSbEo8Ay?b4;yQcBOG2b>}!m81H!!6ot&wHWb5o3oS`Fq{zA8h_s9lHHc
z$S2t6+?4sLT#!zsIXc^Kij%r~xrz8qRZLrAZMs*lZ<>eF+xLcde<|$7ot(Wlmp3pc
zhP;GT$P;ida#9MXTV-<d<L{JBe^BSuISt!co@%=6Q~0Ti-j}X(YyDC3I^yyemF%{=
zp4=fdBROhwKNMdJ9#gP@MqjF5kt3|DhjAnP213{C@et(jW?0&(a-@N!S&>UPr<_4I
zwbSpc4)r?dS0kxx!AK7<Sesy+l{6wiqs5tLm#P_`PQbB1If__tXAp+y*qJK^7a^bh
zNi^H#IM8urkp~cpD~2HJoBarg)h#@R$0(bR9!;-2Ln`_vvxI2-`0h8s+GDocJ1&mu
zW@#yxxcz<I>JI3KqIG3UQ(wcnU$Y6-Nv}bJ6W<-Y1k_{IgEQ0M<K<jR{A{5l=Y}Q2
zLfrQww=xd|$7}nZ^L<S1c<%@CG|D&KgRPl0ICAYy^S0WSpzXQHu3XtMfwGxKWh7>X
z1nT4=1d-XkLb~7M_73=Zh1O`m;V6{gu)sv_og4}GEe!0Vy-e2=pBRIH7;+PG!qNQ>
z!fC(ajyvqf87Rutf{U&C)L4FmVO2S2dFQh!UzbhyE>Z!Pfxq5W`dIB$it*V=g}+Rg
zw~J+@?swZgeM^MRw`nIR7^38D-1W)-zR@4_`~PM2dg|oyO7bhEXRUqyc<Z<QH(6KJ
zVa9Ls#^c{^q7U?iFz38N-v-#;(>pFe|3Ncft8tf|-PZ#gjHZJ&vFGiB*hBY~t@FcY
z)pg+O?~ydV4Oj5P$T#DO8bzVg@hESbDL5*ui$kNzp$B<FJQRn1s1-lvztkTxU5aW!
zL*r*kn`UlhEj~Qd2VbdIh8<{7IHn%}Ky`Q6CaAlBBUy~dNaTZI108h>P%eqs%YHNg
zrZVi%!Yu{CyhYfn;Sv<Sv{^hzhxGL{NK%h(fIR4$Y`f_j*(j1k(d`AI!!4PJr}TWP
zM3HOoSS<!^JSG@WWB*_g-hr)HG7aTY(Pd|+_02Bsv&%3sB59EY4e|(YmASr-Sis=4
zIq~MShikIIk6AY0gm8%TkuW|a=#OO=;Yf$>B8BO!2)p5J>u}qoc-f-s$UQAP6=W}N
zv<5a;JpQ?h$RhXlhU%Dc5-1DM=ckN>`DU>ca43T>k^c}t9C0RLn~UnC$1Xe4oI|j0
zCSCLH@lU?SShlQ{k>GOTU~Bqsr_Wy8`e*lgD!%RS89vJxZ-&pRs)j!=uisstAH{y@
z{-%gH(B6KQS#_NaKV<uRq$1GNLUXyZe(3H0R(jAd?W^N=IX!jv$8&eNo3i^~e%e^=
z+aLd=%i)DA(WH@Fd)>I**G<(Qr6NylcMZ-PgY8Gpo3e-V*HEheNIq}R*Cxh+O`6Tr
zS$*F24;wrs<D@d@H@(Y^zCH3rI($s>`q3H0{=n(cQqh?tmdfeW>!sr_!#{u3CMDmU
zcDE`DI$(^??)yH6m3C=${gXX!*xxrz>2}VW>=JUhiJKmqyhJ$QmOYo>W)gdz=<+$e
zc1}~>{H7*&7thB~U)oafYqqqyFvY~$-8d%cv-LUP>q7(VO5#jO;VazAx!(LT8HcK{
z=5B=9>+D>GvjzSiUtlJBA`-tU^L-G%Gx-c_vd>fSGOY9HXi1|5J1>GH!ggG_)=p6Z
zW~C0(!ozs_FlPWTy=~7Vb|T$Em^S|+NH2kA?}2|}5mpf^7bV8Ck(^x&_KC|HgZbVX
z(I_q`zK%S~YZr+&5|2X{5!?Fhy@xPbf&o2o_cZiPWC{nOCl_PZGg*8m2naKH-IH?h
zy+R03T>6lFt<5IE{wwLR8YE0zK>&~l1)8zZk@Q4eB7Ys0lAIxE4>=)>EwJ+RHZ!yk
za`37~0nA*x7XIkl?>7S0cn`1P3)GpLZ_JYyxRz6-g$Y)sIi|V!N{Y;Dez>0JC8_$n
z+`An2(i&%1jYam4L+2iRwUq3%c)wopbr}u}|E%1(B~i+9c^K@nGXv%IXMj<Eo^%iL
zi;6y;JYgLpd!bG5$E%okIH^&ryL!=U*Ri6@&ImFdJhuib$;<k?$0i#B-_pU&uC`sd
zhrhkMqzdW0=S#7+e)ns%%Tt<8k!D`<C2@tZsc}-Uhrf*I3*Xa8F2^$cVb7(<Xn*@Z
zi59wH3LkNFVK<P@!uwC(>$F0V|Ba6U5uzH>M3~{Ffl7x1>j$50U|#oo0I9KYVoTR`
zXKWm6)sKUNdP$esE|kv4!n>Z!r}lQ%j^P)h?N?g-J&)%K2i)>T*75MTaqcPO+Z-__
zwk>b9xDEfj4Ua0O$hUpem8|MaSMRHq!jcpz(U3(8Jmzm)@+BlFuiBN;`1%S;a%p5&
zIF*Ld4@j>A|JqMHRjG`mlq3eCq7)>|l<8qU!v0|7NaN?cDZG?vWw+pf{6T2i{MeC3
z@k}2<%Xfz9mAyrr!)6to<bgrNVHQ9ROm+j}-(!tb*>u#S4D6^9J`e(I@!U~Z+f^&<
z7yoZ#f-De$;$+Tmw@Qz>+-!&EPSBXZh_Gl-1gC4ypb0D9E2%Ot3+*vxrjeE%&zqfe
z*S8*tPKea-mR%f)TUm+lyzOBHVwZ_o1Qf%Lum!gic(qvLT(Jljq$k_I_k@_sIi`8b
zm=QgQfK?)%tYK#Y+)WWZ_Ff=YP;6|I7ugBkFf-p~6M%2T<KA)C$?+5pNkna{!Q3P^
z<OHVw=$^~3*MYKsAL0+D#oV%lnLn0X$FHplCjVMY6Q0Fh-Jj1@w}2jhgC7^jeU<o<
zq!6#8jM2QtaYSW*bNxjliNCbh&g($bF*4`LHTd9xf34U%HGbsOX3x`wzfDl<LY<Oh
zpEEGpGP~ih^F7k8J#FBIDwR`1YzQ<UKc<3JgAr}uQl37!!_R&icWw8TB=&R=P~G%g
zZXgd^nx&%FwB~y>izny{i-<4<lcVvXzO30#{bm$56XTwSB?wNIiHku=+|UZ21;J8v
zHILZCseMHa$JiB)qB?|cr4*(NA9y3dB$bMsF%WO8OYduga@B+qsmVSzrsbe9mu#X`
zLTb^sSX|?`0VE%nI>tgPhyq3o;`EyNk@whl<veyh%vh;(BS?SPnWxWngc5`ba14d#
zEL%5!(>`^p#wOdM{b=D8w;z&ui$^s`ovq`!9`y_8+w>R}%N`0JYNal68A+Y)2Z=W4
ze^I3WJ_Rjhz+Yg=dB7tGEbjEqj)+w5W0xdUMI#C`q+kL~Lv4wR|ITH%P>3L$R#{p9
z+-2s@Ow2aA(mzj9kg@C4EA-jHp*&1t$Nn4;K1KD%32}@s0aMz{`ay&@0#=Xx>7a=3
zBsNlhwO=pb4t<HjF!Eq4LJ`0QgX;xh?2BSJYOd*yuz^P%%}>K$piRQEwbt5)?18NV
zB56pG@YD*HFEzzIt~6-~8ss8!G+bu+UPSMG^pFBxYL@rRN#HmYLI4|_2t5GYh#ji%
z;w__Uy!v%l;hS`a3U+3@zJ!u)ypeYBH!a2``H-|B>-4Vj!SzqQ3#YwQRUx1TS!e!)
zmM}wtV{X2ZD@s}wn*EIxo?{hsY2$tKp3q))-tXpm6RVEdgEz%%?cz0lA5@~ycf7n!
zHj4NCfAszy!$5(`roImqih!6Xz5nl}>Ct8T^dm^*e&3gu7AgW9Z$4J2@qhwQ{0whI
z@(RcYDx2(lH@%@d|C-wY=P&wq@;D_ceR8mUAKehSCPQ;3&%Ja6wm-&sEOKm<7&pEd
zG?XMwOc^c~5d=<$UC7LGFyWb*W?tNM0twSronq|FJ}<PxY&P+E`RR{{LCL{F*_a%4
zo&)&7j98mmXkliJJg7Ay^@R=ruc2RIY&)SUf$#=ZgXs&r=Ab2?at>~5CZx4CaO!Hb
z=JLk`*L1ByWYS+sYXpnDBCPeURn&{d9+0n{1$5E_zN;n<)^-h<3yoPLK&=W-=^H8z
zMU8e9wX0xLSfbhdfc$i`iu~%YDxJw{ZKW%N)}j*b?yfBxer#0LiT8v`w2atBV#wY$
z)wOT(U;6)+*0+m<N>2~!^Y-eW41Kc5tRiudqbh;aj=+$4R}Oh$sSz3*dxS)$H}(p`
zTUHO?fYv41Sjq}2|LuuU4=|vGrKp(D0#yY3Rc#gkA8HoPJ{&BQfQ(O;gjh9d=}^Pk
zZ!%m_Bw-#;6-685g|HJK&Q|tt<MSgeTx*9A9raHTd`Hg2<BvPNIz<H$)`dnjquO=)
zG>U<+{Ix$&7e4HCK08vba5L6SR_8XJR;j`%Dik9^++PEKBH}9^U>y?RD-n@9_C(m9
z19tR!du-4vbQIGylP0t_^L>B1Q7vs}%o9o-{ibR`P8yT(HhXRyDUx5}W9AEYfZqx1
zLRYO`KG!7Wl=oFAfb9>+rF7_mv{H<n$Y5Q#hKS(V@^LN+7foRGQIpg)-g_1PpK|{n
z4ZI^~r7w+TB+i8nwhi?XuP|f6=BGsWO8~D_E{<J%tS|bQaDn-srvQtPBS-O_zNAk_
zPQd2i(9TEpCOIPeZUfhwJ@_+Qw6F`a82jU9%`-;+yPon?t@cY+AzbQh?P@D#P#6N#
zXsm%qG1%L*TQ!`ntF=CNbkAo#Krt3v)_q$TVuI%RjEKW~hR3NqGX(Q0FOi&r{15G$
z%-tVNhe+t2s^yrR*7l0yd5XHtD3x$9f4i@7Z@GnuKE7tK@pngOcHI<>I0eF_N<OKh
zqtGN3TZy4nb5E|MSTtO|pH*>8yhkX)q8qS)qoryreRfJOw>2FP>6_Wcq3nDf`7xE;
zg5#3=vgOEq^Sfh1Z9ASSNTwA2b|LqIe9rNs`$ehDnvgJeSqgWrS&028D7G@~|I2&L
zDcRyl@y_h)2@$Z+r=alvE%=5`YQda^!zEJDmd8OKQ*OZ#{hCM~NX(S9ta4U$s$#pp
z&$sKehBqDgmJ#P9jsS%vykelX$M~35xP=JUZri(SSjlQ-`Q5R0OkAWu`q8W%tigax
zUiQscpJ-0VfxAK{p{izo?M1EsOMVl+@al;ZyDEGwQZBAVT2)F-z{?6X3?}8Q$!%GD
z1pjgQ=SQ70fqU;jFkiEbZKxAsMloQNSROy$&r2b&Vd+FOl={-p|3@9NR#=K?RJ2gG
zuqT(ehbL#mO5kn~3acB&v7xAhfco<Nf?3W*7kHi?g`GYNTY3SXF0=_3l%?h|JP@Q5
z^bUint_sgfiO1IW$+8u%j^wreVG+l1;e2m#H+9f0@%WfYSa&16t9|-}6z$r<Pt@Ev
zy|nxCDGZe$YNE&Czin>UZx~w59P|fcrlv#0*+MJCL(!^RXcvh3^-TL}q1V?`EPm=u
zG{#ArLzx{?$~~QO9b41oCHS+}BKs$1Yy>JE4ZRiT+AO_Wj`Rq9sHg~QATw>>4Q|;{
z0tlJ~I7ilWM1`|}HmNC&US+~TRBXO&pO)lSwk{D$uPru0-2?RoQH9e+{x1Am+1S%u
zF*fDtusDXEt9#Hz_$H|524<CvK70d<+e_UR6$AEDUpdov2gcR|GlH|Wz7xy!Ep}@{
zj0L50lzsimq%JRqrT%f7hy)tscgW_|X-HqCec99ed}Nd!7WzwPB(`C{VgOeZ<h`d|
zYM3El$o<?$i$UVE1`RnZu4~?w6$PYnd0qp<*|%^yow-B#g#U$^@9W@v%zY+}LIGc8
zbdgQ^SNEhGKD4&~iG$C50a6e$M3T$K#$T-?sjG@^@zd@S+v00B34#HfHu)Ob>zSoW
z#i*o<o7p(-)`BOKC&{fpTTgJfc0NM|C#^Jn85Kn^D*uOF4zw=yw7)uBa>CvL#Fs{P
zG3_M>aA=7G#DN%Le`tv%;I+3O<B1J8I6f{9ODrWf`xIn!$Z>%?cSNPzG3-%s?>#Pd
zlx_h$BOv1i#lUR}gM7{&YeK_V@r#O!mGfeBaV0WB>zZk8h?%~&IMK{}&;!njzZ_~`
zvs5lxdqA0Vzf^sXt_V#~!;s!=QG<HC=X+3l@W{p-RHxFn)U|SVJ(a;xozJKg8h??B
zVXA0`D`@B{F-0A!Gdbdq+7jsT5id{$>+qNUplR_D;xDOPvZH&l)Pt@4CQtJIPs(&W
z2H?U}0j%-XM{}$x&`RQjex1D9qX9Azqj-ctXH=?IyC)+KQd3_4>}`tX=PmfMTRMPX
z2J_+s#c(^$!0ktpjfgGwi4JK{h9;M(Bs4LUlC^_wW^#8hfo7LvG3!wEqCb@@3@HHW
zzLwY%S6ylf87TP?wsREfQknDvBn9(sh~02g!INx_+>eY!TCM3aZBZzIC!n+m{iv;v
zFX)Wiu8Xx_Az23RAcu{u4H=Pz?Mw(jVL$c2t~?LwX?JdN2QUaro=_*%#8+dfOlat;
z9&%+w2-YIIxP1s6w5iX#BDZ@V$4(M6z{3etUF4}kl<Na+z5W2<*x@A-o-Nn_t&4WQ
zhKT9$)@|f<gZ^Z0qG}nD9gi6KssG7@vr&R`VnfY4RF*R_vVMmM(7UM#Yib3#f<mY%
zs30t;(9v#(H7(12mLC_h&Aw)&RPCWDDiY;WgZ3Wk@hGoR56b@O{NGU2dhtH@q!iku
zP?r!oh<>7r2#gQBHgnt^Dz-c7Gj5mMG!%Rw<PG*{uESJwhuOkJho{~s3x$P!W936g
zpkK5%*q0@R9BHkWqvwJA_^2%5$XEL;QrpVd%aY>S>eQ0k;3jbvd4}Q38Ai0_6%M1B
zd1j3PtRVjzc#dDG_Qp@9r42%O+vnoG3or|E)z_NcYKZvX98;9*j1r7sACt-H`$|(I
z9(<2Z7o4Rnxw34t2!a}e7T-2V12N5|0iT;Sig~GzFuJAxB!9NEJxtOx41UDmcMidk
z2ME+I?ArXN$Ug_GEwQH59A#G>>wsLyg&Dt>=nC;c3=)UyD5%tkgglG1l!BCt?XmE0
z>QiZfZV}wbt`=vIhZkun)*?iBS98CCzacC18VZ=f2(FvMqW~*pE+jtG9ym+10B8`t
zK<*6EV$xdrA-c3LSS9g_zIX_7okCmHW+|gjjnMP;DPdaPwS}oyRL$t35wL1mYPF=~
z6?jSmjU$ZnCOylxR{qt${JQADeXhW*C@9cL2~~r>*qW+^;YV1~AmvoK0mctS#eP4!
zEn7e|(g2bRo&-liwh5seVP|fr8Y8+<v+pjc0DYGoVL=bNxr7n#7p0#<P3JqLG%?Q&
zhz3>cLgs!<W_uXnmg**%Yszi~smIa$Z~sZA-!uu^D)Sx*--D_xznC(I*y>TL2ruJq
z)T@=6)z}z|%(*o&m3rc0*6k$hykZL0z>47Tg+~Y}Bte#=Y*Qo7jl?LOCN1xn@=;~Q
zVOa*y$`=u|zXyfQL_>Wh{eJ)eLI1vr@1|L0)zmP`KuOTZQQH-T;Q7ZA_l(&`^<Ws}
z+-L5JO727Fxj9iqJqyzZ%q>nzt^-IQ`u9o=;k+TwrPCg;UJD?G0ys<{E~?)%PcEWv
zU`{a1vyh4!=&($JNMId~D^7T~*BMep9;`mph5=aM4aKR|6X3i+Q=f0ScF~oL9vlH(
zPY!i!X=;tnLdUYlaog<<0TSm11|yg;E>KI&#I$FCi5m)lLuixvH_vAn6kc39ixker
zY|O?vGT=x+O{w8>{TQB@NV@Oz>3kP5MD8Dp@Q&J7A7njXNou((<f;$}qXR?@LezR$
z&1!>S2U>k%oi=a`DkT{Q1K5(WAEeq_C`FJvpIf(Kto~vASJz_My1ioUJqDI&3!M@>
z3TUZ%E*8@?X^zC?p{QQ#u`@Buf0!E*lVPIUv^xn^B<7k`dLvL=ANH(Y7eaWDkwW+p
zE@G0!tl5Ihl8MwR@b%TrL}N-xIe|cJcy1Dy=x>}FGPBa!M=zI*fYNMMEN7+w=T{Aw
zaosWHn*s{`(wn1dyvI-_YrD{;IY=$HhcIVuHCgyQygXKPITZ{Xh)pO#9^uWx^;KBI
zhMUWkM{c0a8wO7oD~-sC?*_xzLY`2tKW|ut=wG!*h6nb`v6CGci~zSGjrm2{b5V`o
z9Xw+XhK6jrV3#Z|db0k&ep%|vmpz&nT_acTc0EYi$K>7v$7Fr8W_=T<eWhHrrzLYW
zgeuyydgO#0K73Nnf!0T}F&pRPfVTrXZTy3PT{wDbPbnw?wx2o$kYvSz9cd4C(12qR
z8zY^XgCM4%Hp@?0-vtsM1`3f7i34!?fjKp~SdYUfu+$1zhOn>DGYlyzn;S<yWmvFC
zoOwol^v$D!xb4v8f`*CppbAWJmtF!u07~Yl??R{y`7)3Xa@TAOhCFpA?mN+2=o-S4
zqIQ+|u7!z5A_a0#jG_)8pA=Xq4U~O`6E$wywFIEahuAg16KjAnsUbZSRg=ZY{2CIA
z10!2Nf&^Y%gkri(HZ)I#{nx2xkr3g5|2PI#4kjb)DbV^3#60dB%*A4^e6nrSbIgqC
zSPLso8QCKPF;0BOhY{MuoTRB~AyT^#5?biKtl&5|=i0GU#Z{=E598VL#<%~NJp5Cy
zmv`UVDFM{Qa?Q8AR9^7|+vJ{q|0a3c8T*@GCC_--%jKJ|UX{=N#&61dACj{lzQ(?H
zJxN~m^KX{#uCK_lg6IXwhvonKKmS5L{lz0}f3oRlUL@DN=8f_np1LS~L<VZ>a_igw
zNItf5QoeZ3AlKOf|7^_0c+AhwGqeU<oMn$)*oJML=onay78cvaA<NlFx2W0eLF2Y=
zgbMa<%&dl&^{)dE*AfX`rw-^AVKI-oRVXNdrH(X@H9WCASwc3r;StK2kgh`dhN4pp
zO`&H>#SA8LIk4E>c1ksisA4C`zFoNi2Id4gBXKewsE>lj0HA?fR2Wz@NQCg<MPZ*X
z@(ZnyOvJW^{J=P@up_3)+A~}R(b`N%nUu&tuhDF<S5xW@I3e*6%*T)gyD5bieJZ<$
zkx|`o!JUrKo5L}qFk#IVI~1#@7GPNb*^$hrbQP`x1-~`06=TbD`6vd4WC`@K1}1(B
zkB?f66$4m!jxhy_i#}e~Vg&+{NI+VT7@fZegqOZGkW5X;*n}}W7S=`cfpo!wRKV-0
zS4yJCEXVceqqak~Uikv~wo5-J|LZ0HNj@kqkzf4F*T_?^__!Q?=%gG-suH9SJ08gB
z6^`abu6VWl`fC$;$4mZ|{J$gWWua^BC94vlYwZJaj*PPf{@Iuf8z3<}=}Awbo%`J9
zKBo@EW48)36$`bktkJSoQE*NoFLT<i<}HDf(0ALwcCW4vO=&1I#ihbgvQnv3Q$I18
zifr}dnCGyoX=3RY-;vZ1O+-(|SaVeYI>jSj1=NF-2UvuV8iL0I*&!IuemAF7N4;)M
z7~!s=sboV#ebkStpm13|qqxs-BESeNL8_)x<<`&^fC9CMSd&GyiVLSvDc)nzFXnh<
zC6SFaV;1`UkdjWBp6LB|pQNW#p=^kuE<|(tgCPL|q>K={iE&DSUkrc?+mLuBPf}In
z0Sl4^!jP#-Qm#zk>Vo|U3O~yLB(T+mdSocd1_*=tj<zF^cmfzMZfO!6aeX*mgqkf6
zGERw{JekSrs;(TW8P98ZscUUjSgZ^g6iA#@D9W2Vf!#RnjczKu&os?vz;(6*x|GL`
z$bSA~zZ^N9@I{ba&zB$nnb*rdd-=7pySzOLLoT~mE;#(K9MxxwPT7$g<mOL3Ah(?}
zpfww_@#T+5jqep#Tp_>qYriJfUVE)ZzZ&vb4cH?P>U90>y1bi^I_x&c6%ZareQl!=
zGW-WympQG$ty^joG!F`zyjWcpB&4=&tH|Y7)HT{vWosz3F{xG~Y0a7NL%)X-DxYE!
zU?&dy0Fyw%ni^{sy|PbLz<6Y+`K9IM4Vj;-%j${(L{G^2GvWgd8`Dcc2ySJ~>ZL#(
zN6#!aNQ@z66gu*Th3imUTu0L}3hat(^o^A_h!INjD1QW1jQNH~fD2HQl_^LxVP||<
zU+vT5iBMk#^<czCJ)edi`y)+X_uXwL%tuv%i21N6jCdYh{X1f+@Xinl1eF6tasb}d
zRlA<9-`DFy3ljB!;PU!*bA~#3i(7mG9DsLaDW;k`JWQ-Q;4(uO8S+?AGDcFex9-WV
z-A%pbA;X7Wgz%@{fK!;unCFTxXP$@ZZ7Cq?b+2~^%&jq0D_>^=p3c74%U{0db#j4V
zzCJH+d)<GO_uW$72>G&C$WQ*)7s<oF@kx2%uh_Q7-}6)QZ~x#{xnnwB);%N}_xy?6
znB5@nx#M5y2M@`6G-UY)w;q>+3w!0;Ham~5-q82oC^!GgugK5*_^op9fBTdiAH@_k
zZ29t+%6Gjebzw`q_}?o3{f-}#{jYkddOhDN|LlLgN){hpk&7<dCs$p2rG)q0EH}UF
zH{?z4U6QSPzej%ghF8n}H~)=1`)6Mzmn^nq^+UfbZ~em?<;FW#MHZhZFZ%wUlAr&{
zZ<eA1%gt}TMt=JJ!sER0?XQw6=k~~@wFSBK(#6p!fBU<hBd_|<f0XNg=_4{5vvH=;
zZnx!+{^*aS)oRIq_z(X<e)o5OSN{61|N61<yqxfPiz%Lr3;!sBTD&DwFi@)sX8_I*
zqy$lWh0m5XT2`-H>IA7CkmiQeg-z*TblbkHt@j+sEmJSdWC00oa{=uz#LlxkvL1_w
zZne7^>ENh>?f_9W_Y$RM`~gDsCXy`~V~rsbX;zN}G=;%N?rUMrTFegtM(QGZA$jzA
zq9GG>C@zDSga%^pWE4Xz6ew0Hy>(lIAu`Axp(e`@b4TcisR7tigAREl^a;!L<m(D%
z-CjaQ;(W8>h#N-wNZR^6)f^KG<Hb;ZZ>qggw^YM%5bcHh6XLOGHVJ*Kf*LQm$?_w&
z1rHI4K-93YdYipt2F%kTWC~9W*Oo_CsGK``XccV2In<z~vbNTvbX7=s`Gm`qH1&<h
z!Fe(F7^MX8WIG$V%<Zm_4B`jplREqb^5VDrp}ZKm#8FI6bBMZXT08h@xkvLgTX(!j
z-uOGumQVhR>*X&rkG1xc*U8UbccEOeG98Dn>5I2ZUiE5`e{=oya^%ui$}j%>Yvg60
zJ1V`k`{e%h(x%(5l*JdkR=#iVJ@TG^@t1P(|M*w(g712seBhxQ<lvTVvN-H1D6Pq{
ziT&dx{)oKg`c--LzyB%uoj?Bfa^OAxQvUEG_sH!><t)YydB(H)@}d9sYw}yau0Z=O
z&ynxF{`=&WpZOp1H*vtZz`4Kmjjxl>SDq(7`|rL}p7*q)a_ZPINuKgz`Sz!G<U?<|
zUfz9&0=Zt>@BYf$<n?#H-sSc*^m+0l@`1m&Q9gM4HhJ<3zC~X0oh`ZlzbS~`yDGCW
z8)q}#`ObIJcK_fH{-EaYH{>&)`3(R3N(RDy1Jqw3GY@Bh(m@#&G!P;L@h+t3gvXjy
zUH>cis9jV$-)xu@gZk8j?X66xfi=WrAtthAOI3~@=`%G2OhCOD?00Wqy%WJ^R7*)F
zIGE-kaz*e~dIM{Yh~8Mpwly0qIdy7{mCfvA40cE_b-h=t1$|hLD4B!`Xj}|rk-!KM
z-xwe<O06ZQv5yA`H>%6HI45gIPe}(<`7n1E+Tld>x*l^ttyVx4iqMN><y22D*xS;H
z*Kk_BC0%ua+UrIVp@B!3Q_*2X!+#t7oG8DJZK=?Xyi+7ck9K)}b91>gTULbJ>kTL#
zoM(~MfuS})kD2<`ZW<Ne$T`8Q>-72xnjxEKHs_F(^hjjMkn2mV0U9WrMh^|iCREpu
zo+IM9Rn5(@$lNpSM9X^x%!kFPNn|w@Y}ZzMBx?*ieTHSvpK)CN_IKYTe}3C>IngUV
z+oy*2d1`nY49`WEJYK$W#}%^cm);@Ihl3N=rFq{;x#_cqB%Roo-rtq|@}d9!Ho4`<
zy2MNGkPqJd$8z1SdD)`2UJBrv+b7q2)3?cweorcY@MHf%KD@Lc(e)pZ7ykHvm7jRU
zhJ3E}ROz4mxEwlgpPW9ET{(H=@8pmE<9+hySG-bw{%3w&ethR|%AfxE5$QeZwVssQ
zKK$46>CfFJcc0J&*w&g{bkVoTRhNtW&Aln-0_XmTFRsg}bicgsQ_qoSH@3>oeTfV%
zZ%TOLPPzS~N90KNh=wTtoBZiLACsp(UgR&1*uL+-^Io~<3wO(rqmPq|Haa>RHEEyF
z?N7>V%*I&_fYcxV@gK{cJ$vLQe&Q$8LmJ2@KJf|pN(Ss~qh_o^<njkBKT;qHGTOCj
z&C){@SW;Wt)6iZ`aRI3mUl;9236atV@%5^>@*g8zKs5<`iXA&W3O4i|vlzgKV~Lp5
zA0kv?ReuA9d!7xA4i83L&Ms3tP@Y?;3``KzXcYpnm6{PZa%vSS*nx0>s%QlW02w5m
zvY}lJ6L7gv84(&oUh1I(E7F|zr6pAbii{$)P|(2daM3U_oleSQWVun>PpCCS4yxPh
z!uPXKVB}dPwt6|ebjS+^a3IFo?(|Klw-#_UP_5X-vl-gJn18q~=pfeF6fIM*#3Wfv
zmMX+#z9gir!@Gof2UPA6I;@Z&Vs&BJDA!ft--iHl{U36JSYcEvz7=?ZDjEj#=&(BJ
z^?Z7v6)qeS((>o$L1yVOuA8KC9*u;?_2jYRa%2?En^(iD*CH;?9>E9uqWsCv{kGgD
z=J!bZsN8el0{Q0aHre0Gy5*nZmU?at<{BrQ(AJ_<c3db=h#!{UJ96Cc>_}HW`hVXg
zi?4l&JZ)DjpZ@G!@`?Rtq86e7<q=)v{F%J#rYq(9c0Nu+(t+G1k2Vlz*X!zQ=ptLx
z=XycIydhVK<#R_s0pHK5*ICU>S}Z^Tz24_u5xI%ib+J|cZDzgXl35YoY<y+o=}&*U
zTz1)I^3jieRPMk3v0?UPnTeRgu0a?V4iD2Ho@u(0vyg!BW?emy539FA_U95OpdPr|
zRsL3O;@TP<9uVCW5Tgp2<s=7^>2A#SIJP?2Fv><<N6=1~#vfS~XbS>Na1z~iU%jq|
z8vlyv@ZpE-DP={(kV#^N6gmAN)cs_mqc63F!s1k1pDJUJkg*8kj+P~C<Y)r5AU&WK
zKr)|5i0W%jKw#<-1B%%OvY|N$Bpyj?@8?!?7C;C%Aow5*m{3OFCrbtWv7oNe>tqDw
zS|ihm&Ivs1rp$1iM>ZpB#h{QuHRH@^nmmutJWa}60lX4pULrn<FlA0G3`}(+H!#9Y
z3?uW#>;`JW(MP?SHNmt{s?~a-pc&W0!e~~O$94`$%9Td&^(6TOWsu`1Wl46+#aj={
z?YG}5x7>1z+;X?(s7|Z5(oku*U7m2wUi;^+Yvq~?4#=?w`*LczwAtFabdUAr$l_Dv
zx@*QCFIN}kk_#`FYxXroGmKK54(~_$@LhYoT(7%_R<v|uX|$?rqmXACTwKLzL*|iU
zLX7y@t2Ogg9t*Mub!S^OUOjh#?7VP`?1~P_m%fPau)}RUcQ9OK$CKpodzWNza#c>;
z*OA_;dY;>N$;DUbW`Ul^-s|OgSKT9b-DcflXJa-Vi}Au2zEEEAidXO*yXmHz<mAb(
z++Bwq@Agaq2*cEVtfnh4oT1(GoNjETnlc@P&c|dR`bJO_$0{`5gU4tcY#^ThoT@}Z
zo&b-Tn(c)^d6BZhv5@}?c`)BP{-&<*70kJu;_*f;r}8;G5VW!Pi(+L3y2zyK@p}*$
zV)YzM&DW^&_>J#b4FE9G2en;Yy&OzN$s9f1E?ivQlF{xxhv4S5vF$Rvy1-DIE7Uw6
zO(H}bEA>#Sb*DB=X({Wx3D1wTO0NJdqv`vU7D<fU5&F!(g#=FF<U%2YKm-Sq^nNS6
zjw&W;g7ad{F>2rNUt&del!Z#&cP<D9fQkZdBt}VPlF(K!xtQy1iX1*YN8cvx>t|#G
z=`4Ri-uvF?$WQ*@kIL(=KE=g`9J@_!x}`R~vG~=R)SvVUdBZln3EQrf?fd^qZhG*r
z94~`VSHqHbeo8)g>nr8@*S<mO1tW0BPHEqEgZ$OWi{-*+ewX~{1((aMcikbM{Pg{@
z#tn4&*WDw}{?Rwcm8WoTw#gGOS(E!ed#Bv`zyoq@`))bZyI!9A>NiN`AcFRLWwIt(
z7hV@WRbKSni}GYofoqE{e7^WW`84uld+mFi`)hY5(x1CpE?N7meC(bF<iK$a`rUP>
z-1DSo$aD1Ai-&dJTlY!$@ps5g56dPY%4JQqpOW?TS@O*9{Sg^_=5OVlH_d2|vvKAD
zv4bZ(;R*7}SH4mX9y}-?``E|i0ez<9$81$(z#@UTR7UQ!1x==j%J6K}WQ%`L-05j0
zrm%sC7wj+ogVVrf!=X<h^?<5I)>aCtNN5v<^p5GmTF=NK!<2Ro!S_EgcncNaL!Tmt
zF@<7%=CHuWXF;s1;R0&<o*^fQ5K(AyM<6Z?nUzmXL^n4EVxD_WO~TbHg+-f?h#-lm
zC#drQmECj7O_{i?ffiYbf$tF5Kmd8Mz(lbq^#oQTLX~Lmj2J6GDr9Wb=R^hWLV@PC
z-`ptrA|#st(cyZ+1A_<WyK`l`=_I3<2JbE>O&xSkQ_jb6+nwA2rKxAw{(XLrRw|%#
zlI#-t^acaRh~YN$vNFetG!Vmi4CvvBd~toN9N36RdYK-ccP^nC78lEE`0tR1SL2d$
z2EOUZ#_~bgf7ktTaD7?syYnzAB*jl0YqEVz4jfsQ<&Be?b9zwr-*-x~ZCA;4-?~SR
zedIQ2gTmT7Dxdw!KbKD*Se4a@_ivyc^^!cae@W`wc1X4O`1mby!w3FKKK6wri7R!T
z)1Is?osffvP6;xuT<$G*rGE8g(!isj=eTtHN9Bf(-!6CQHr-xZ+L{=Sq6TQEA`gB}
zZoKb4Uf-e46>{Cn9w)(xW3qa5P2ZKa9RJd-@~N9XA$P1r8q&N<zU7Cml%s$7_p%YF
z2RB&KeAb8L@9#M*#|B+lUppZuSB4TaHN1#gi0*#5@eki8pYMtjxH%<<@A;C>$%?GU
zU42pU8!WUE8J>DbZr3pTY|O@)2I{!3yY4zhbl&~$cgz0$`yUg~g1y;3SCQ|$>?9ZS
zCaz$hgOr993VXDLwy@Vsbq`I3%_a}~q5B?t^BsU$WDkFboKwZwYuI|!yOQvhTOF_D
zZow}mCISA0_gAm3<Os*X(-;ga+=X1x;#?%_9f&HLYK5PrRLHQF_a0e@f$urh_mK7g
z{ks4@_#VJki0t~VCs(r(IPat;{b7$`H!u<r^Xv~})1V4G=9K`R=KY1TsxLd~lxW5%
zCNTw%DRb)UR9puzMg}?nE6J>H7TGJF<>9azh$5SiVVbjEpx=$1*HbaCQh^s$+&B!1
zr#+k#q)j?0+pd5C+3gKE4J)e&=b&CSki{LVRIyTkvc9jtpX;hQlet!fMcl$oOeTsh
zacUkUE7Gav;kgGPm;ZZcpWJ+?$qM+*9;C0&;pp&heHxWGe)DcQ$A(eX7jO9!`LlQ3
zD0fZ}{TgFBJgM_?X626An2oQ(02krPE3cH*)m1ru{P;guIU}DcBE>@caeEr_ThF?K
zwW+9sg>Ef~g|PY7^cE?SKvO}Mb{Y26F19kt;-#@AaZyBEB{SUeR-s$Sn-k-cagIfM
zE}rW~lGDqg%wA*;(_mm?=?v__=HkDqYu}MOb>5-VlClC?F+~Vh9Gk|vo=!|G7OW6>
zJUs=QN?>6<P~hG5P$V%Pn%ju|R;vloy2zJ#xk-HZRCzbuLV8+>RadijRn<BS_lM%b
zYymGE%y+~|I~y50BSQrqg>V*sHA+7c<GHwAS)S$G5Ps}wf*sd97<i<tXByJ7T$Ty`
z($7nn!eaw7O!6Qe@VwArdA?=ZhB#MiQDTL42w`G^g}RS9Ju6C5L9!}KNk~C)H2xdJ
z>WO(K229Tqokp9cMlu_-F&ndSwgb_byYK$$toBTFe8^}O$kt4lWC86P8|uOXivmYx
zOJ&PqKoueYTdU>M?g@2Zts{Ld7Lh{)4c$iIpcE;R0hKp=It`I){F|oM5ExM@IvNm1
zM93}4%qzkUK^I5P%A|)<f*QhP9<>Y+hO2Vb-yie{9(46`)I|-cdV$_rptGl`b^ArV
zl^0qo5O6t~jg*81Ah$_?#L&oP`}#D`T|OzL7eZO4hILt{)I@HCi(L1Q#2-R&@Oa=&
zA*#k>f%HK}V9F33G!e;stT`qOXV7OM9F9|~6){-PB?>cocksMOX@?ka4LP&Wa&~?q
z-EN=PiK6H{6DPE*=Y#q$&j2j-Og0MpN4bHYr>=I(C-H>JB>HE)k+LofxiNHLMy&du
zW)I|8dK;^9^6-gs)LZGvsl&%5Uu{c&Q`RSF_Qz+Q)@*#;4Qp-@ShtTfW&tvyQiY~!
z?%|;~vIZMTiZQd{SfD%z1Pd(S;YAhgvVb87YYK$k(V?TA60EY+yezh*a$!P*rjY-F
zn+2!G`}mL6awNh4NRTQ55TIae*Y>KMSl*CED^#~kfxvSO7kyMSS0$?DEXW<U5$>vM
zI4qRq<7+avSRwKvoQ8eT)5_2Z7+s7LUNFLs1F*M-0r~$>jsS8un{^T(AfFE)Nfa;^
zwp8?j`qJI-=}F;p=EQJK2y5o>x<Jgx<>aZ9RQ27vG{JsoNr6SZxG<H~wS@84Cc14Z
z7!3f3I`0j1C(aVKD>-yH)4YC-s6Ob$EKY_vBwS+@2ty7F3L;rnk!oY8=a|aIT1JpZ
zc+mQjC0r3Cl+kJ`ICX8M5tzq@W|jb|VNX51i1ZW%tXP_@3Rfba#dq6Ac6ry)EB^_G
z3TI<BX5(u;HVYN*+ue{~{l?F-^$19905RAqIxUr)EuN^9p$mC*bMLE-L+Em2BjqBV
zrB%#dp+?x`oX}SbxYh5C|6Zw7DW;ng-Qq*z7YyO;<rcMzBK5e|SD*l)##!?{O>pjq
zG4nv(USChjr#4iE4wrGx>=HT-Z*=+$;lV3uK;O^rX*e!WKoc5zoNQ6=l{(F;SVMWM
zD@HNjvCCtjE?Ru}iGohkW4shnPH2lldZiw7zODw{tIFEiP_`?OLLe8OptwF)01|{2
z0XAM<(J*C7X{zH(#}&wsdy5Hp$U~v;7CcAft<doqd8f7YKGo!Lo3?H92$<{ZLTRez
ze1!@djV2^WhV;T1Z`G|kr>t<<x;+c)bJPjd`SPge)oRwH(``$rzdyC4`NBoin+a>d
zc(mN*&payw=(N$&C1p)nRzrx@<W6Q|HfCcs&WS-CLE}NN0dGB2r^Z@4K|#o;CawJk
zUBQj@P+D`jEG~fY-H`T1pL(uQ)o03tJP9bptF3R%Me5At%zdTm4AJcpb5LO0X`qJ+
zhTV*qR8#N_LChe@p`Xyhs8!IBvM(UtZCPwdNB@qH-GUl==n3X(yj$pPrG8kaJ5Ycd
zaL0pgPOl1a&sHmv4pcT$E4mFT<`tz`OdTpv&Ec^uZVSn{0|0?3lExM;vubIPl~Y5R
zU(8tS*4{{1xt+1?2*Q+BS5~i8>Fq#oFwHENgndHM9bvhuhVwi&#&i_+*l6kN8(jq>
z-BZ2FNsX!%3PGX}4qno_f>pO`${tibR<~)Opb0g3gz+E(2^J4}bm3-pJ2~sp;5tJW
z5lzo(ng`pnD^O3cLphY;AZ8v5D+u2)BLUu9wnS7_US9*tvP!~+<TI~oHfCcs&W!<J
zT9|KA{2ZJD*u<D^qm1Q^x>@iPDp5urK(l4+X+-@tR{CVDbIp!)N$#_MmvI9;s=cSl
zfP}kRHFDkHjZ@HN3dL+8NX9jaI(QJ-4M-IyJCAXD1(^s99TPoRPfrRtrigA}OLv;L
z6VnBR%U6%c41{~v*1-NoC#F&Wn^A_IQ#sFEZ?A+#AK^KK{ubs%)>j~`n-dVI=8o`L
zU<3u9osr?K1@y)O4e?d<vr63~=nZ;0Y3kA70>StMu>w+2ByQvpfg&XcrX*fac8V(U
zK3R~7qGw|+B2&_5`w}7T7~wh`TM^yDg<$%@(^3y>Zq9OUSOq{0AF9Qbs!{jr6yWuA
z9)=`?fYbr{yRYX3`KjDhm*W;drJnT&f^N&uVjMDd%=R(5DzWN?nR>!(%*Je-8-o@p
zi-{Agsr9WF;?VpSatshcM7<S+bUoLo7b-v~Wr9=0T4C0E4N0T}7Xd;O?X@9OI5~A<
zUH5tD%w{<wYp}u4nN?qnI6+2Y?2>FD5@l7>iUQI>-5186EDr?=FyE44#vBwB%=64x
zEOYY_PXzS%$oJT;qo<w)+)2bT!QThdWH>ZwkZoH-b~wg<8g=W_l9MtY^1{Hl%Usbj
zj5%Vdy>867X6l>l2LK7;w+OX$AQD{h*=mJ^j$y`J6PPcteg_mE_7lfc%w1DS&3Dy9
z>J<j5QT7LY`wbl-DqrY%U^O8gL#IhLB$S{Qp{B<IYY^Tk7%xd~`i+o8fgU3~)N0+r
ztN=e#;c&UB%xIouA$oR$(!`*OEn_NH&yYVtUz2>+^JF$=V>bRVM~=mM%uXPPbTL{4
zK89x^6GbO@I4V9HcVN+9p=bmg4cJ|FFOCdj@NcZ{;dCr4R1HJ?%!nPC*;E_`4g}1d
z#|ouXJuqX6hx{Nn(ORG%>s`@pG90%HfxaJ%F$_FFs}k665OV7e6Sfi=^aI(xqslN}
zCCw@G0Ye=zxn@KQcrpMD@C{mXHOU4Vq6=yyY9Le=p+^;3e+&mCYk-jl5ns55I9{hW
zlsQGyz$p!9Oxi)aP(7H6b!djC!`3SSWi8Y*^VudEQdU&1cLl<c{(I;_Gtgs*u%_-{
zr`rRqksh8OnhLVj7?@;L;X&d?AOnT^tAy3wRxf7K{d#CLK?_KIBx4iwP|P#H-&$Fx
zoNL5-J*s%b1Tre<qcG3W_Ge=@W@9$ai9vB(^^)>{L^psCK&DZ#@E^*Js2%H+n2?$Q
zn4z=>3wMP75cNW-5Yj=`yU}Bm3Hko2My${R#mb6uI!&I_!v%K$guj})TYXK#z?S-8
zept6kQ=9-WnYu&B4NS#XjW#Lb0X5igl0ZkORK!fy`7As}t|#{rx|02#M^LbET~79$
zA877tBc^8pk0y>iwmzYrVV0BF5tB_4kP11ZhZnQyWVHgKMnuVc&ZCu!@!Y8UmstTG
z>Z<^>gT80`O-<1ro?n{TwFG{~&rJcul#Q`6p!*9UT+bCsQ;$nr&6s(QSWU2<Np3oZ
zxOrenhLPQ@u##9)NUlUut|&q_vWzG^X<a^j>mDrtS?gP4^Xjn(nk57?;F^uun2mF2
zAX1d3X45Ihl$#DA2zZoo$}FPgs=R2&Oif<MCPb+dK(ElSrB{YhrpUUB0AHwJ<OTdY
za%SkK2p$8~nPSs%rQigB!X!8>Cxkj8x?zDyIZ-DH{jt;oLO9SOkUl{Tl1-q3!=-Dq
zK(dIbijK1a2_hFGQh1cU_ZbQ^aYgIFg4i28IVAgXdM*jQxX`Jt6Ip$qG<<{-!32av
ze@>2nN}y#Sn~>(O7YN;}jFV)FiO7M4P9`KZ9Yn`gp`M_A-fS6Y<J|4q0*3E+V<>v-
zndq&aBkH#L14ntsIeS)9R_JbFM-T)-m3OWu-|Hs&TML0kC~!^_-e|^gGo#I;)`1Py
zz_P(2A<RiG@%$O9a5iRRHqMPfj8Iz`)qJ+Dg3V@^kj&)UtYwpN6DVrIR#%1<sUxFN
z<Qy2{`y(l*Wayb{liKZC)dVn7r?|x28FgtrHXEk1<eT$BEe?_b604D7fiKvA4WATl
z81qWSG^H$tnX`bFav})1A?ZdiP!B8fiKx(>0=*G{!@^|>;wJPgd^DF#1LlNqjqtpp
z&>N|<GYv#pLDL<?WQFinaPd$DW-Xe5EsNJYLwXA5I<P?A4S;~KVdiubtw7isU{Wp$
zD+RVD@t9*ORsp1BW`+KsHGKrq!{dTChK84zQIaV%)W<L<!+as-nvkrlWTs1qxq$F5
zB}!QMY`H8yFwYHBi2Pk+J|I((Awu7$;(TzH9v6z0{Tay3#%#>SKX43(!$*~e@?1L+
zuFsv<!wwb<92uCfP*{ZCl7Wp&H$hFqvouqY>kk~`kZq=7qtjz#nah(oo5lvk`X7|$
z=jTGI&%;)SOqf;Fpa!;sA*-8VI5n1;4tPP;N|oLaRm}sB9V}T0O!k}=inZHA=B_Fg
zI{`57C=Znxs}M+x?^0?{IhT-ms+7hW-V-}3XC_peyNn!;Gd~X|VpqDI9t}Q})_uag
zZyJg4f)rG;$j}`jM-#C^-b=%pH5XbGr*tpo@{+g#k>1pR2fels^5n`u3NXkWSc`Or
zF}+Lk94*d^NyarKY@lVKLxex$#KM4J!&IsOvY1LA%==ZiTY9CuIk9<x14X^6y2gaJ
zv*cgYYPDHG@@&k;Z2W`A(9~}qalpcW+%`}fhSZ1eJTBN#*fOdevFBmN?@VDxjIEv-
zAO(KWz9-Y@SU|glUR@+xm}_N9u5?O5=doq9$pIBLQpZ+TX9g>N^teKpiv702lzoZ@
z-Pl?)`>u{DM{#Y+To6bEk#9w^I4Lw$Ow_w*&6`HxFa_Bnq*p?8^do`<3VAC~l+OqJ
zY)Gk(+@#p4RcJ=tbA`+HdrwwRwFwl=MR|dVF1qfRa4`|i%L3EPB9S9A5#ES;h?aXp
zB{o!tQMYEXT6AQtu)-U)1Go!8m{JDH;}lx>G7POlG8h*CtnFJBL^n+QadmB|AZlzy
z<g+{^B$JSHg_Q#GdR{*zaPekD9+f^!NYefXj}>7?EDSIQL$ENr2`kdiW~{HT%WTZX
zY|O@2a}Yw**rSuN^%S%kEJUu1WM~U~_Bd4Iip4l;T~W@&ro4&C`H^(znTiG^oM3lb
zt&sY#0IPaksG<?aw#X02yYQ`DN@h{KN+n_wUjhNVoMxlShK&eYHJd`}Hq|leKI@&}
z%_LbN%WG%~oxw0jsYWrsSTTJmYE03m<nMFWXc6qgb~`3x1Q)ru5LtVa$eM%!EMWXe
zfbasRZIzOVNbWd9coh`E>H~;EjFAfRHB*(xXjCgQH&<sk(_*QbzZzPjOrPE&JhGU1
zyM_4%&#_StWn+D4J!ZUwc{fUqfK;J5JWOa9R5%|gTd5?bI?rA-5eXp#*~BK+fH9-~
zU=)~_O7TfVSJB!fvOE|htU$pJ*<cf0Mct|+_0HPknvL0*joJ8W4+|BBthb_QxGwym
zEoc!pV+dlQ4u_zFhQh;u+pwim)w<OOp6^<fm=b)W;WG+XQOrTK4IM&Y(*s9r6W0@x
z-kWD6w=l2<y<v_V6Z)U{3G+~OHT>|hAcsV{wr@lU7;qq`S13L}kB=k@1s**ybi!L-
z9Vi%u)FvGEV~QoRHp{dB=H^4|eU(Ff9h`h;?E5*r5>o7G+>I6vkFKHNw)Hgy69u$w
zn!DNnD^bs&2GWJ1eQ#jY^0xY*6?HeaZ?Ch)s;wZoYgee@MH3B%NG?N`P@31g5W;pR
zm)E6<g68f(Z-@!*`U+@`T1Y7q=m^5If~S`bJW}GJhX^8yu&Ja`>piMl1@smvLWz7H
zTeL*X1LFLk@davUw`={%s18zr7a7uHMeYsiBSB=qJq!QM#%#>SIWwH(69vd!L)==!
zC&`TZt6s+F5yDk-b23UP!H!aZ0z?cTS!QKSv1f!0kmgRU2uqMK;6Q<w5U4ZL>sgI4
z(oW<bh^3s?Hx!%LvqS&L6}Z;a>ws4ULt1aCA<mJfO3ipfaUESLb7KoO)jI&Nom?7l
zhgmk1ty?^{1woH1-!m@=rBUGFqv9F4q(#a%K~hP*It?wZbu0(fR^)Eh>I4FKL=c{Z
z*loKrq~XV;Ff^yezELp>Wgym&5fi5{q5!I>9dC$6Ar)NI<5BM?h^)>4p-gx(tXI>J
zAUsF(2ZK%{RO&siO0O}a-WC8vLw&q1Bdvg70xz(oz<lf&6hej!n}TAGd=^5qEUrTg
zIAW6)Svs!!Xjq8S8d(ZKGz?6IK7jkB*L!q%z}3g%)=*ZK`&RfZGnZ>NW@9$ajbSaG
zOmHD8=<90qYITJ9jB5aIs6U7`dQ@Smgz7-ls&!qGQxmtCpRdz{+Surju!mlUa9mJA
zg%rvBe3cGHy_Q@3YhauRI1&`)?LhlTJ(+$w5TA@bpPGW`emqc*sV63Pv^ZCh<&{)H
zB$k#MSfqr~IFK#dLwXJrU97}%{DkI!7HiZN1o+@2nym=MV!FM0O6sKz`x*iq__EM!
z==TFzSX6M+$*6&)7wU=SC=yoJk*!EfHh;_Zik|e4D#X=lV>B5+=Xx!p(MOFHys=h&
zK>@g}AQ*CjhkZyZ1*|XgBCAycjUCXElKtniW^Hvv!Dzw6AK}Rbktux?1#xp4R$MyK
zVX^X-E!NBob!Y&7P(xYs<ym%Y&_@_jL$A$*s_-ld2(0fIfC^zlRGmWx3*p2aI|Fuw
zUOkmCWGH_2h)qpq-q>u+#%z4G#%9VqMtK)5s@aOlQP$TthK{&lU68Hb)ih@j#p-lY
zZcAG!=Ja%X)(#7yM}XC-Q>iH<Au<K!_$+4Ph&>^P9tjx`;ti94j!^~u9FdQLHX(98
zl%7WuFY(yN3T>ZR1C=2rsX3{6-$@eXBu}iI>REjjJ0zoyN*D%&mK4~7)SN<i5q+_s
zo~~}r(%OJUXKAk9Q<$<r<$|N6d+7f~R-m!_j8mc^yJ5_W0`kO}X=P=Ju~%|(7&21P
zf$D=nmu_ba;EX*BSAvy-ny{j=WMC3aQ03?<$jqyES8v*90I~`S;P3;uvIqsD&`xt}
z^O{6V1~L6sQ2r4vM3YS9!dO&1NU7iv2G$e}s}a<KfsBDw2`j=YM$h*gb1>z(0zebC
zHp%^*T$NdlYc^(MHqNC%;su)Q=9VI{79*Z9y47HTL5-3gV?_tdSHbZ>M9QZcMqo9o
zk~!Hsi-7Ig+mOf`m=e5aicCeosa7#IW2|-;e1TZ)cP)a=MX~TOWuL52!)Dber@}A5
z1F}b8>489DJy$&DV912?O=1b{O>(+*HRiJh_#sFcVTJiGkRhzn+S-fM&{GS+#V}*j
zMHArl*x4AK4~l$4QXYjNHn@nCyl1_Z&+`NrVJ{#!03Z<Bgg7o5JR*b%`TVeAMan^x
zj;gppxkQ2wp+IA?WF$+l*Nbl<QA~bJ#SR5S%!_LsjR^<f29zoBof~ZIzyzd~1g%Lx
z^r*=ELY1o#tT<x+J|i;*?r@SAqY+_A6iU|{6$$|Z`v9D^T9r3!rbjp%voRaz%78gS
zClJ_Ma2pWqLMMwxy=u*IGgHAZ=|Cgok#Nz=C^!MOAfi&B!~3~U8%)VQ-Db<YuvWHO
z5!X4xXL>2mjg`Ur+ibj=4@im&jdTDcg-jCrVu1mt8&$A@et<9?WRE<r=$T?&gmD4D
zSHv_Ce~j62IG{HM@&uLIhZY(GZ5>2&kUab>vBcfLaS8Q8^ye~I&t$G?4axjG<nJn>
z3Hm~7FmlWkafv$QjaWSe+CF6PB`^hyEMN|cY)My=1yGQ{&H;K`Dd~|4M&L+9=wv+P
zwwPFxFfk7et{UREy}l`Y;D(u?E@chLh$MLB7TzQCvOgHnLgA5)JU!n4pEuRj!r_MD
zIzjkA8<b>V6w#UH(`?MfY@9p8B63);ce|N67m0aC5NlxP3*R{$feBQQxR$u|3>}St
zW(|=t<0t4son=hcJsHs}Y9RWaW4e1r;II-|)*9nC5P1l_(04sm0_I{+U<ON%nkFJ2
zH1+(HJ+vyWsTT<hPQx$&u&~A}=0T`d0Z)hO5UxE3q@z4z5O#Vn^1?74j5~5w0SF6e
z!ihkf)T@~I5<I%PeuunQtvWC@3(TPtyro!eZsEvm=n>fw>ZE*<Z`4eL-f(>gHA3AU
zYV9T&Wi?f(E1;HPZ0a9yeF09qAy`>txHjKOMOouCP(mTTOI^jlv<9(#LNE;I4MOtC
zw_ch&N2q9kv|;KTcJp#4RE)4>%6ax2*ojkIo{ia<joCN{24t4Vn1+&)MXibs7YrME
zCJccOGN&Png*hbmfDiDj(02<qk-ZVQXwRt-1V;flLc`}-w8{AlMq(2uaPGhp<ybzH
zGH@~oTLCVxGi+L~8N;sIi|xGg#D(dEV1wivY%4qnFSEW?Kx42*lGOGy80Pd~$f!eG
z6#d;mfvFD=)cpe>5K;`;4#je0VOWSb#!krBx@scSh7g`fg5<2ChL>ne70)~+P|7K_
zZ^DkC;KK_fWdaf;L+enCyjJEKH3Db>I0V1ksQ9=+rrP0|bd>8;CZ5%WnFz7<+e#_X
zZ{8O5wU~2L&u?JY9<z`*bArFQiRk9yRw_oH$J}AZ-A?9;uf5Uv&BkoZ#%z482Lo4u
zh4|3J(fS8^<UGJ(vCyB@Xu(bwNh*MxIRYklo~4;1c6bi_EDA*&L7OMo_0)b3$BAB-
zFHSAqfDsN)2#+c-Yf0L8#0HEpi@f?8@*-m{_C{*#xl;y)TNsAuoUFMW&DS6ohWaTG
z6OeBb&vRn3=G~zEN38!L6c{Bw8&0mCig}?M8$-r7t&NJQbimz=&}~@rReeo>1$yRe
zVWMaq<m1Vt04_)w=<$UM*OLV6vDdea0GjaA%>6VH2hLr5C+?`{Uu){Ih6bEC+hJl|
zj(Ps6$AV<kowX_^TZJ&Ebp(yrC@oE051PQ*m{5K=u`bV8jUY!zAT9D%R8cmdM9ypo
zaP<P$$Ho&+&Ogwa+xJX)#+5syRSoQejiYk-;RocF`<5U5$F&`@>!OS0%AG?waN8Yn
zsQXA8FUW;gT_yW2sYz%5om2b2Sf2cXOC`VOR(WWtBkQr8<=7)vKJ9UG@daCC&VABb
zIV?xNbc@`6RR6K~M0wHk_sG&`J|*`Y>&W0yMNP)%@ujocem2hSF(><;`3$*aTTA9p
zsxmk!ONSnm+wM3d-ADcHf^56s0=ewcK#o1?vppWs{4UvX#gpafmo&#8F5e{|z4bv^
z@16C7{g@52T&B*RX{sl8A7(Oc{K#$|sKZ4%M@;Gt8-XV8Q{6ptL^Y?2i$Q%>q+15o
zv&%Q}1<FJj|HGnE(3+)XG=X$*6$~vsu^bCng!xd`)~o=z8JPzFl0pOhSa9ReGDIvF
zhJ9BUK7<DZ7cQsBB9tqvPfIq6SE8MBk_;tF!1oua*43ly_SwpreY?Dv9*pM-&5Cow
zpFrYj%{(n4aR6pZN+O2mP!(auEn6zO&*4bt5NHMf5zmMq2-i`NH?RpJsQ3vhyelC{
zB2aj@NsSPu1OqS@(lSvh(B81-XGK#qCMFRw%#BEbB0bXf8vrq59#VTzGMBn?xj`30
zL<<zpDJjEaMSnAdB3Yn(o{Z*2*T}P8{gd*Fi*lKdQohWM__%!jv!9lY-pz8)p|wZe
zL3M{*_6^UF=UyF4c>g{6axW;5?2-OmcgTsJOd0+?^5k!MmAv*9yQF{PU&ycg-k-`C
zyPhK7^K-A3!SDTN`M`~L$epWaI^cHhe|TWO96JeMxk8@tve(K>zG;`Vjvtq$xGMQz
zRhB=yDo6hJeX_i8wY>0U*UIf*`ji|wC9>3)M;YVuc;{c;AqP7$8|Uk&?Uc(ef114T
zJDxAsUb0Ohc9T6WcYOS2S$p`nd~t33tZsgv_sG8MUM#Qpfo<}cfA=PN??aD%NWa>Y
z-B&+dUiw3?lkcdnNbz_ttX`n@>t^}X?GMV~lV^#5kKv#ayzjgvvI__!_P^XBP6{DR
zx45JZ!3s9o2yr=u$?-dQUf@9BKcsw6c7>v2bccswPUD2pvU=5sa9|;3l<D(XRuw|<
zw%+vFqY4eZK--4ru)dzj_MOHc9CmVU1KD|x?2=U0H&UKpy;+g^TwQ`*Th>=n>qcAw
zStEA_*xHp?2TYUg7*Yx(AUFbScJG+eZF&yY1EO-H3YXKACMuyz$f1S+$+=-l+NB>_
z>lNgWa86(pf=B{zYpVOSwl<V@JLN?;TfQtV8sOpCOXJkKEc@06X501(CH9kaNLnTY
zg9lv{#vx9dn;gGaWs&w=%P648)1?eqX430q%vCk#LJ}_;1f<aVd@1;?oJx3}bMsYc
z%~x0=fNsyo;k9+2jix8-dcLUd8hF{Gsx_Z8Bbt|Q_-Fr7{`oiDB{#hF59I&da-YCS
zx#Ib+mG61!%jM_h*5zOR_nRKs`&qk7KK-ZqAOEpkw(k9QdE?t(E&E^fQhD3`vWdr{
z&sz8-nZNuc^4jPAwfyq?*5&Nipbh=+*}DH9lZSum_42<yRd__Ja^J^plu!QtAIl9J
zSIHA!^xg9FKk-_5-aFnbfA-LO<xQ`9ugu0jwGqkulfPen?&rQ)R&RK#{LcT+dEi^0
zB3E3zAWyt%L5>_8KdZlaw|wQpugcCRJy)LblJ8Z}x=H@~>wa54;=X#$8{a8!c-2<5
z5$}@azq|h*)sr{BDyK?&;Kk%HfM|z2SCD%ai6VnKC0Py&eJEutu$UN9cvh>0^bZ&5
zk@Z+Kaq%G+{4K}|riq0OgWQQVSm84$_1#Wt0_AW(YSoM$itl9W;o<=#cJHpL5swuJ
ztOhCyYnIPZcLRN|A{38-i?0{4ysXAv0qLR(t!@24jXy$x6kP<9aK1uAj9ykf1%pO2
z&_9PfsVxhrdFm)oX?SK}9#s%oK8&7?f)l!Ec6+Aa4qyuiWC>b^F&78r4-}>4U@!KJ
zqJL_6gT2Cb@2V<5B}T|#&dx$~3wqo{fsq|O(ReZ*Fnou;UziJo4L$af$ysX#fLdN^
z%icXE@HkK}ZfQw@r|CKMjDTG{$#m3fU0cIyp$3|Z^z_D{hfP(1Jl45cU61L7A(ghW
zGB9~5KjF=**R3XuT94<$*!Oz*g;yPtcVGWs<-<o#j#h^c-25T=kcN_z@BB7-<s~-}
zfF8@SeBdEDdh6YC*-Kt2m%Q(7@|f;^qbtKhy3&pI$;JEh-;aesnvL^t?2}ji^OsBa
z&tD_I|KTHJ&;HbH@_>5Y4{(tskL{S>Cr^6%b#na$pPK+Jj8FXbTV&6#{<K_n*`>1Y
zi}yc5MB%X?WL6KH+K_Le>P5E=xM5Z1vecnjPjq3ANLD5aOAPBF&tF9iR}_tKAR`Y#
zv8LzKp_!i#DJ7MdBgf+8z^TilS_ux%_U%=MDKSFQwS&m=Tw+9xRx6S&S|kS{nRjtI
zpr?WO7Q_)@gpp{fM?O8Gxn@;58$F6yRT}}lEL;SPK5{^LYE{yqRAq7A<eDgXA6r`y
z82QNesM`mn4HhBy2h1JKEd(q;TijA*PRwIF5kq5W9OCzlMydci&<P7I)TrQ7nJ4{3
z(cDzpeK!dvr{od6t2_^g{3^J?_02N^CDe)0C#Inw(rBUUawhYO0c#TAJ;HNBauS`H
z@n_Hgl^s3JQZi>2pi9_K**LPNURg_XVLm3GtCF0n5xBjmIp4musiDdN-EXg9a{fgq
z^Sl_3yId~0`9}HZpeK{rtR>A|t}AF?F5mRLC(ECApDe$8!`O>jkDsF})z`}6Eq@{(
z`O`y^ebY-dobq@%_1-(>@?UzrJX81Z{P)};ulw|G$n`(}UO6%y8d<+vj^6(X`O@Rx
zDsOuI$K>^!A>-cb<p+NB2j$0J`4lxVtMcG2H_88f^8@mn8-7-vkMDoyM)_gg|LcBj
z$^u-xN7Gt+<?4^WTYiS1^>X>|cbJFv?pv>v=l%Tm$TO~boLpL4kyD?)LH_rz-YoZD
z_apLue&<zkfo}cK+utq+^`1X0vvFRJCw#kn(`8?fn|^U1E2pJuH7EPD?~#A^_R_O@
z^PA=Rw}`yr*Iz1E&h3$_7MJ9%_uVe{9NBc|`pmvY+Q0P&@;7(fH-2~KThdhLA^7~Q
z6QE_|emQz{PM&qym9po8&nj^JBO;gSV=$67ug`YoTltgk(li?iSSamjHFM_cQNy~?
zjujtb6Xr#uVt8X}_$b33S}Lbe%VfPBvmVUHLbsDJ%t(TvX9Pg;#FY&tj#{tw95nXz
z_E5S|<&AtNC!~Ne2VY4|E7Tlx2Xzg#)fE^jFv=QE+*r$5hlN_Nx}s}SLt|TZ)-^{1
zS*Of;w1EBL8w<qhuZ9X@eM__r6cE9@8{|aWkolyLCybgfFiSwcx7N=ZPE%k+pDo{Y
zB}Sby2oLxVp+MxSfX2w10iD@1%d?Kk@RksEM2rwh@Qnsk-%ZTc2pa=>jeVV*P7k>$
z0BBWejezPQNG{@95jv<hTrGlL*PLc*K@5SX1fktZ!xh#g>=s5w&B9`ZD-4|DP{WVu
z&|_<tR?}lH?8Neba*;XCCCEq&fx<jj9_PV$!sVBp@w@eQM-Cl1CTBmE<^EgVDL;4p
zTjgeXNZ$UcYvkEK`F~Catzzr@9+VIL`rBpw2j3(=^MvVdua(!l;d;4BJ}m#``fKEx
zZ+V^k`x|=lZQpU5{PZ<%=KlZir(VSU-*Vqc-F}-q<&|%e-?-rpx#NSsBER_DW%-R?
z`p6m1bDL~m`k=h)KmTia?JxeVoOt3Z<jwz|=g8mxYdy|2*T}z>7s}(MCW|r~=lwYR
zu<S?V>9j8%miwlj)oXtG{q9-a#pmO#|LSMtU;fX(lF!N6kHxt;*}Hwm8NWYx^th~T
zwB>6tkj6kOsEu|)JC!6B0z{1~_zbOvrGQxHo9A5UgR}>^CurUR=+ey6J5dl&S`c7{
z{1d{9ki0{!SF=$!>AeK{gvJJ6T&S>n2E`j7-3Q7#3uD!IcDf10WFcDHfL<Uw1Y57J
z?nc5S8wR`vgv$UHP~Ctl2WDZnYf>K+LS%?BCnCesfG6UipgFLDVE|tR=?2NDSLLy&
z*N6}BXzEaw0AWM37oe{r4^`0%?P#cxwE4g!p+a^yHcGk`2Upa0GN6EJJ%Da))r#S$
zgVjk$ac@E4T`c^FaH#0-&|4;|m}>DbF@3E_gQ`Pt?DZNO6ptJ*R0%+392c62pwRmO
zn}i;!kA7sC^#_AiSL_P)z`Q{hP{wW9i_AzT-EP3+wmVpX<P5i-FFCIJA3i8@xqOYr
zvYcAIS>FDhYvq6c(6`EO{zB=iUE5^q{6+GtXFgrN`I}!W{~FUdSd-+I+t0AC6}j_6
zzbo&0_xt7M?xk|g3tlQe@JGKY7yt5`HVJdC$d~SZP!1kYz?*xV)VAnLyZ=M-_D|Zk
z_rLAka?7{BM7}oWWi}quv2(9nq!B4N-e=FTS>p4tbR50%c8@=9TqwJq^}X_+-|}L)
z5c#v6bCUhfZ<ZhL^yHoozE$4)!H>${b~<wG<VmsK^ykiiLsO#?P|8|Z5Ye#M#^M~9
zVKul`qZK(-A$m-d&&yl`NbJc(EaJp^9wK^YEOOmX!#ueDps#j5C+Hz{V!{xKH7^c*
z*LXOx4wg7LyAccAxPV?5kg!(snTU%3fk1x02hJ$Ndzwq>zV$jr=0KyyJ-h32@?=kX
z5L(oWfw$$e8>SVib^Ag!i&j$+do7XqZ6RBqz&lDUY^jDlp)1P9V{8|a%j#;zB4KfL
zO^{pib^q{=0N+r5M{cgy^$47;rm<TfU4`&tduV;H0J6SkO76&`!TZ6!x<hkaBd`-w
zOEgwdXy@a)(Aha76GkCQ=OQJjqbXXg0f9)LePe1BkD%P|>&*?VtqHtDEC!NcNKdn-
zXuGjtq?QHE{{ci1FI=3DcrzhUh4~ruoZ7~DQh^*Fcvy~q<5T6y)lcY)-IXzaa8b5y
z*)A9E9?0!CAJTt6S-vVGUX`OCxl#W1tv@YqeD>R9n=XbJnZa}FAC<d5@-eyP{eLg_
z;IpJB>r3#ip1#SBbRp7Nlat4f$dM&|eirYQhhFdsxeB0s|LNPNu4fxpX$XTS>qw2+
zDXnjCg`UW4oY&)_&&XZN|3)7F<f{C=qSngV+5WKfe3VCjN!s`SrTo^L|4#k!OXS=B
z)e9tk|6j}J9y~0EkKQB4HE)(Rx@toe2s9M^bor!wW?~0><q40g$#ChE1I2&5fdE~j
zp1SCkF}H&tclO=HDBzF~%``vX?j$5&fHe)z3_TUWBnP1nzr%tZ*upNzVeUj3JhI#2
zC)DY^d2|ri$2YL1!K68mr4G3yS9&8X^bJNGfZ4&<v(>-nif*AofyA7(0<p%AVI`xN
zfW%z@IS=UiAz2q%ofR$s$3VEyB<@X_f+C9|t_v^^%A65s=h#Os)&UbBVA_5Wb7QQJ
zQn-Oz2_gh?QW@o+0@>&c=@}wf2mpWt6(-1c;XNEXicCNkD(<Z3(*4hAXb`MGCKI7i
z2-<y^sMltH2SvX(7_xDs=b2nT<^nl0cxq{EAZ_`nkh!-o3f%RDyr}@$dLty2-s3!(
zibuB%R$|VcUBW7Kr*U#Vj0Zj-A3pXh`M%e^P_EuJFIIJex|i$aB`<uET(bTJ`QZIs
zov&pLi*A#hyUo_i<1dp-8#P&wuW-aY*;u+;{_y<=<(q!|d*pGNY^>q)wG9Q5P@=lN
zG~N5;mRoL-TW<TJ+<WLOtWTvbwfTA3-E7OFHkj7c@~|CBd*?IcIoH@nd#`_<JYM76
zHJOd`dUWrUzqt9hT=RYZMqc&Jd*#aQ?(?~Qa?uq}lxwe$FK=W6=`1}Uci>sP<xV-)
zUy+CIzEeK0|GxXshMdB}XYE0G_|S1#-ugUw&5u1_#@vs+^86qB7xL1rhvmqD2j#)F
ze`Nb$Dh~Vu>Pp5CH%TV^J#sX7*f|PXC>TMP)@p-IrxkYG4?Nd^*ChMED)&A6d>9);
zoCV2&$wa{p#*S48EI_0W^<p7GhVATyqPOUc<s<y&bfHY8!bv=ZrY(qrf%&HIw`<w#
zldZ?zh*55mN0~U4U~=S`*YW}r!$ppXUI{~aMxwx<sEHc7?!jKw;-^+CWyX#jmz|Cv
zzzxP9APVJS)Bt2$;rI-14p1}TIbFd#9~DHix0Z;j$oBYM5ZQK79`Klua{?tkaueOp
zOsIEbBbTiU5mnr?BzLt8rig)QjySQ_a1HWVS!Ve{?1L??L(9LxRR*x(W}CYl7y~mf
z*BHbN-w))x7^`>6U%umgl0WYm@~uB~u{={l9estbi!|4BVeOdQ{U;xn`!`~#1`o-N
zf4eNd@Lg|^A5jC}^DdQb+v;-sv>kSJ{vMS52NpEv^agqT9iNi7efZ8tD7s8#&^aP^
ze)yg8ci;MJ@@jv>0Hgb$eCF@=%LU(ZrF_fleq6TRzo9FhRoOUjo4oU;d%6E7UjIY#
z`fWGLpL`4tazl1s{T%tW*DT28@uD>5nzHhdcgu|rJj(UQCuRBYU2^mOr^)xe_6<_k
z?IV3Q!`e*w<oqA2^1w&mBk!Mol|1YDKO{f!q;)xgb&oDgyT`sH_kHHUiD&f<pS?-`
z?@iHJ?t582_koW}eB$I}5p%pQhj0Icd}!;Ue9Ke5Q-1UfPtd?4#tymm<xi99P5(po
zKXCZVD6W5O227}xIH8$uLT7{3S};?NNC8qhfCu@kij`||Ag_g-JtAXPre$do>KBGq
zo&*vdrSBL|9D87<+2EPhteA)cLF`AK9J~cT25_)*y`Rz(LU@ksxiGR;^tmhO^$j7Z
zB^6q6Fd8C~J(yde83wDUee-M(?*vKC7t`~rYmyE5EHD(2yMi&NzLjr<W+~gCn4A&;
z%^G8ooB@!)`ND%EjeTIuK+{Z2tYu1O!oG-yA`FQfn|0e1ClO^gf(6c$Vp2N?dVLTQ
zz%g;~7^!X_Tdoe?5!#RNT+}0iw+3$uV1szC6%ZTXfXw2tjY>%EM4T@q{*h0_T>`Lr
z7NNB~n%-sh>+&r`h;zDqb&Ia5LNaNl$GO&zYx%y<%DpG+8m0{?0i#zX>z#py3q%%n
z?UYL{zd+Ihx5_Q|FKhC7(FBkW-y@&B?;g4Rwmap(krmm1=d^rK9=PjXIo?~9lgl3G
zH(5I*ckEx%g-B_I>GkB~5j7b19g-!GW{}|R9+LgX2C{zOcKL#ORu3#4lLsF@E~nP|
zk_8o^IZ665Ts<haAGl9e*J}Dm>CN6aB=<giN;djy(rI@Ewd<l`zm<o+AUFTTU&$>e
zc|iT&vfTgKJLKWjSO(de9Dncup7(k@(B$+fdHCR}%s1zGdMls3Q9g6<A-VguyQttX
zQ_eV#$I1b@{oW%ojOzNXS6G50eGMl+aF5)2=W*#}<7ZXY4#*t`R`gk2*2nuxd_KBV
z;VGW&{r0?abmiE+56TJk*rzdQuzpgG9@sArt~X@wj_PRpqsy@_vMaLdvP)!nbzPR1
zSL7dKz}{?aMe_WehoxStTDubG)UXAK0~!q2dV~bwsKBPzHL8NTTl|MQV0d16ZrdeJ
zN)L_<Y&-shxr-Q~GX){TF(=`d8;hI2y6FeQ9PSrdeq?mXV!CFKV9L}3sn#MZOm;*9
zsG(ETAxjAoW@xSV%Dj3b9Ytffi!jnr-MIKTIvPcyuT@WTOU=bdQq(s25dj4r2iT49
z-jEx!$+8JS-l*BM+9)s$5z4b#F5xjji3i9uA@M;Lq{kX7)D0l71zLLK6fW?20a&SZ
z8)4tEj)v-nAZ%#<ElW*i${M0k?_KwwaT1d_WLOjc-ECW&ms;ItsM11%rWOwuGo?&_
zl?^!|G}#*%Da2AD7COa^@APx-1J&mheL3Kf4ir7#b#R~De5k3{*WdI(I_F303c2Q)
z&z5h0-sMv39+r>4<M-s|FNa__8?!MRlVjKO<>lY`6nXL`HTm!d{!+t@cgR;`Ot(}5
zui?r)4f(a}Zc)2fF(Gi5%7AADr-aHGPGn**gbI-<V>Fs|#g9IPbjeR(n#Cs|!F~g%
zwr>mdH!&CP8y&RBGEG9s%+WE$4r_E=*JuV<*J0TRLX;MQ^YAXPQ?U3zVnDLWa~g&4
zawIgyM-W7$or4aEd`?uYOBDBsu4n}5qkxwO*8N7-Hj{9KmLQZziY){gWCS}v7Tc_N
z78aypeQv-L_X4iwvESjq&={?&tf{4i6RmJJB9Q{>?C`vD&pK&FUO?s}u8R{M3AGgw
zChd5jw&P}`EEx7YqqT#KVmUE1ofHCWMJE+18K_M#rD9>#I3-Rzqk4kCkqiTd6jA97
z&}9>~$cQTN>Y%y-Fs0%#a$Q+S$t=?5hvFDG=kaK3EdNIQC$ljdv+-Dr<2TFue_#KT
zugyS?3gYM05a8jtg}Q|d^SG$FvesBWOQ95y6trOP5tTC#N}a&CM^alF3TtD@T^Lxm
zd5|!Q#=n*e6W7thikI0d(v;jYZY-oOR*b6XT9pjZ&qO^LKgy(`Xa{cr;W3~mPzVLc
zp`X$d8R{MfNlK3`%T1dKQ5?91C?G?#NSr{URwJ0z=r;OP<p7e0q4l;Ju<j{iv&j|&
zaM_e{Xd;bi;Ltwiq(OxP6S2B#8i=u;!<KC|J@-^P-I&K{sW;Y8m$iz<XN^ea=c^VL
zrHXu{9#1MecSZ`-xQ3Yfuhk&rsQE6Pm$(N{&sGH+>jQIvo7ON=oJ#y$tHQd3N+sg?
zqMnVNm_gd`t6XJ3(3ic=*yY)zqHwb)wu_F;l(tVt3i7it8?!MR=hCRs#svhFATS1@
zumsAYVDPB=J##kDj0=tjI%R-W=;f}>6Uct*tW@e&e~U7qoTLa-i4UEQESc%}f#=a7
zKzSA%Cq}HoT9w{KOt9!#y%Z_(K0PgX3((Z7vKz4#7NejTIi5u0`zQ)y+Y;T!@#CFQ
zI}UgxY~zgZm^cp$-iBTPGz1}Fn`8i<iXJ1T6n?~3BqnLkc&H-#dUrs=f{|J@w6<Yk
zyk@h;{7+wveMQ54A(DgY(X_j{tSk@VO7h}CX=le|-;kfWhFzZ>IdS~;^)5RvZ>$Tw
zq)NpU+6k=cUHMJ4N>QLzz)Tdl7Pjb(=|lvi)s>iq%&1cU`5DQ@PCIAL3cu~)29o;O
zv6~I1CGuZ-A^>zKmMB~^m$!VXNB0{0$8}Wxal+TLF&ncn8)r3u1!)hSR>DO&(jX~H
zrba0vp+|*Wl{oGILVTdM7q|eYCsUy6shu7M;yPgjOv4m;GxmP01gxLMLLV)+sFO=U
z36D;Y--}KCU0A=Q`J_5~gD^)k=nUCwizukrR1HjIH%)zdNOk0u(DsC^x={A)smkJl
zCg`E&OEN-2Zv-JnacB!Q3`l`wUMR61^WnpNQ&AUjGLF`dYdG+wy^*nMdTFUI3yX6K
z0D<h<*`y|5r`My0htM0qabd2;=8PbKAm$2ifFu)Iw4fyl1Rb$T0HA;|Xd;myc~q#5
z(N%zi$A`HXLg;pA8e5)%XHWlLYgSFwV_k1h%>JFsy`k97b9Hd&DYkVBRth~$)O&1^
z4AP2E@(KtY>XG&n79{5y^6co1KYX~yx;cm#@42AKd{~9Kzw?AuI2*Gu8(;SWwhz1q
z*gO!<kc-En9qdA5ZRaFjfSJC&mdeU%O7RBp1lWZ`w}Y+3fFvLyT5yISl{Y^hFujw+
z5SPfPTiaFafpY*30z#6=`@@$47XVShu#(5lbyGX5XV+7snreuwRyQp`NOC~J3D^cV
z&C|bt!~ifGrq;a|GD%z2!|JQ?52%Qa92HI!g?Iody{MX@D`e_BorL6urk-#$GD-VZ
zBd59sm?n)zNW?{pXc+`Dub{MYvL_G(KEAxp{X<U?iM@PaOhPDK0Ceg)Asd|m)z(=L
zM%Q&H>qCeB^_*eQe%or&g!!>R+8xwoS)UoWy9nz+FtUNp&U(O=)ph2@h6AWvSlAM|
zEKEEShPXDwU;PAZ!zx3lV8B4311+g53SONK!jLA!i{fi2er#Jr=~hqY#X_@C=0Fau
zKRDl$T(dD7v+?ycG%~f}6Ld&h%S_=2UJ_J;B1y?RXlgnJta6B(LqVR3OuiBLKx{J)
z1)f_<$6^?UR*s}V2Em6)l+wWfwg99c$^ae#_yR_Y2XF-;<B$Udm@YI;6v4J^(GV8u
zxD?_B$TfMOEcn#dgLeV10WMsnnlfw%okE}^RL+Aip`KMl-NTGRvxr}^s7&_*aod_+
zY>=Ab1e7CKNexD0Y($OR(>z(n!jkB=iBKX)8R+p9spo`BYvhMOk)}L;2rwMD{F^V^
zwuLNGhTIaouSTO{`K#Cja^cZIixEN0jdch^TK_P3O}Iwn<j`?>PIFVp8iGvWdjr-m
zBsg|#G9|6Kh%Pg{JA4*X6)R_J6n2T$|1CD_8X6std5DlF;<o`y3as8E_XCUn`p`)n
z@VE$7)}ba3%D?ZQKP^sXV>V{v>uMl02T!RH#3bP%*N@Lg<5Sy&&j2b+9}SG*4SqqR
z=2_lKZ78Io*l){s4SGdfPerrsB=d>&F|1W{%J8ME*|l6hyDaOEyX}O|2S^_w4g%K=
z3_4A(S-&jxP&N{HBR<1rV0U=BO&v5kumHgr^ivvYsJ_Ep1SP&!$r%Czkpg~Q2pM~?
z!WJaR4<Qv6sK42#RK4YV5SB~(F`0X<R*k9^Z3Us46U#+-4-<on0JR-4RY)?y_@}7C
z)(g%O^OT^Ag*q+l54?YnLl9?0E{xiWm0;BDk@aOsZXKR8&#3--{p)M&=c(rsl5t3d
z`_$x3KnNkxWPp97QdQ3|f)KEJqJ01tdxm+G8LKvsC#%ZxQcS`|b1oo=OK#*06fcvN
zNP2%N>#Lb;-C3oV88uQ_tPiABX-Rh&oCaLebk*6IjoFxuuf_m7u&y@yf@Yg`c)hC*
zN9vp7;uMciOA7;RWj=_iiL7gyXZwz(+RC9u;xd+7v5BPSsRq<(wa{V^R@I{#QoMor
ztD#RD2@_X{r$dhx(LR79!j!c+jrhIhN&Z`4Y@^6H_yC24`3l2kh*5&o!J4Dg7=j>S
zWX^C>g*~yRV1WYJ>Ka0fk)dK}eWlW@Pzy0Z+HOA~F(Y*{Qb1eetb&T~Xp#xtL3mC$
zdtB`5%8=B1?i0ztiiPH|ZvYp&3X4;z03k$d5<Ji3@sWpP7ib3>7?=nHH<Ktqa?wfy
za)J@%OENn@t`MY3ugKb?2-}_D_*@xaZZhk1Ovx%;VX$q>AhXWORVyq8Eq~Cr0<x%L
z9hvcOWacQDf^cEi<AjBJo+pP*S;?S8Y>CYoV9myC%*H>)Ae}t~$*d~dG~Mw-k3S+i
znpP?eGG7>2U&KO4-MX7N)g#ZS^9gideT%%o2KV|_-;3`;=DTuZCwj(ffCB+pKSuA8
z+({1#BVH6L_g$@Q1>6LObROKV$Qn6zx(Z@Zo$W<nsfP*JaVD?}4+LHjeq##gYJ_u>
zKLR3B0YiNbm}AhpaS;I8%+%{8$iM*9m}Z52h$#aCWp(6%P#_$LT{r*{-W?cwV2Oj&
zfr)BVe6mUaD7<in)*L875x$ahavB=0g!jd6n#2NZ@0<J**)H~*KyOY}^HlwALT`$C
zj0_KY{5!M`S<qZH5(p+2B9j2TDqUccxWYW9l#4Qu0)YiWl+A`+%K)vXiJ1nb_&vb6
zqG8NoJd{e^n2ZEj-F|!2m1k{VlDS$U_ir?0Wl+=5=uAdvHfCcszWSr0fHYrA<+AyX
zT(@&gwg>CXQPo>u1^TAV>KoA_b+kJA6~5<Mk{D=Fc-Kp<><QTs)Mf?dJP?q8g}Jc_
zp`--$d5_Y8##CfvEVmLY>?^1Gl12$X)49OO7@1lHJS&9PkW1?I2Mn<RMX9p~;7T2;
z^3VnfVQSt3XpH`f?+R-(B4^-R7h@RZLU$^R&1D255Ftez7klJ2${1<!FLOopqEai2
zE>waOH*qlj5c9=(vvQj)NA$uwfyv-Q$imM?$EIc>JzFQcq(BM^JaS^i006^7^aJy}
zFqsjRG*aph!utbw0=RI4BzLV)FzINBxe@Sq-Hv*fZJYGC&{1S<0{uU3%eE;RFGUkI
zlbA|*<KY=5=+2x4>}iIkoni3UbVV-ww$oq`6Jq@cObd%81@2Bfnp%h3{>wg(!i(JO
zx20oGpL6-&COzYwvGi^FH>Z8?9=QCBXX%ZmL>^(Af5<3Ssw{ecM34IHk1;;i&3-fa
zS?N~u^T~7A{7ISIzsMt<S9$+u7ciKd@6n&5Zy#+Q%HK~P&^xR1nBK<oyffUJeCm5|
z^emmeWnMmuiO)yx)@Fw&@9zxz7CH0rieovYzwxmjWnb{5AObX08+5!|k-zTjq%Ezn
ztA)q<Rz})FSFf8HQyY!}Y&{$cq><nVS%l6fhOqZmX4_M3!<AA&gaN=cbavew2zQE3
zAJ3v=_MP{lXIzu#(^rsBO=$6P*@&4#M0JdOLdkscNz2{S$KPajB;R*0X<kgHn_zGA
z8&Dii3YRp?C%+e`Kv5X4yg0V$7`lJBU6db^$%lM&9#hBny&_aMzQpk#lMi9B%i>`k
zy#)Dqeu^q^J67>vWfL!GR=O*>XE*xvhi&>LKC^irzg+ngR+NmGlt5r)%{F@h#$&W?
zZos_RJ@iI*>5;)<^tzRe#`r|-+}wx!Mee!Bt#t1<+q1i-%yuFZAekHas5~#`qURI$
zjEga@cuLRdv@sh!r^R=t--qejWj`4klzg-Md)ofSfH(eLMt>Hkk!QuV6{nlI-+H6p
zl}`tM&+_uUn0_O?iNlTFsmT{&^7?#>%$Q)eOwP&ZX6B=v7IQHMF8B20qhD=0iiJz=
z?q~5VOL-<eXDRaWgqiK~N(*s!?IqMK1JmTacVe)9Y0=@iz2&E$?Rd7ll6|!I#v9$^
z(FILj+vvM|>KT;M^HH3D=h%Dp_tKj+aqRKCz&k&=UpEh)y9dR7ct9+^W%Br=XKHMG
zWqL8{O*~gJvgw>--~GO1_a^5lckj8+cQZV-badhddnF@L+>m18Hd}T0j`db-XaCNn
zeADdnz-^aN%+^|^Ozqd3o(QY5E}zHr>Sr@utw&<vmBF|;hw`z?|31^acvBD6^tR<W
zn?B!(Yjzf<cv-T%0O11g$CI*|J=<*m#WBeHafZrw#%uCLo?3(y#?!rcS)Pp-4CB*~
z>6P55506Y4u=4N9=RI|v#VGH?fIT0b_h`<hb}%;fn?D;;nrl9Tp63<>`Q#iHz%HlX
zr{d4zxf(5ErjA=YJ7*ea@?6XB*_k}9>1V8bOg9k|b5ZP%GHPDw9WJhW>O7|RH8IUo
z_p-P@6UO=s=Q*+O5vUgPS6cnc)IBbYu}of9@k~sduRAZ_HzglFx3Y<yknsX{`aDV-
z(SY*#cXr2mOl@+FZa-t7^+xY(`JAWct$Yn*J21Z1(*P#7P8L~~pMG!7a9xakW$A?B
zFSaq0;?6J2N7q{{YGq^t-2QWuUMd5vMU9H{FOE5B+sf}xc`ha-220;>hB4FI7N6n2
zaI+n5W(@6fU#4e{Z9+;$V>|)ngS*wL+ei7K%L@ZpOui?Zo{t^tbP$`KfYAe2G9=Sr
zQw-ntr>^hJhUZN4Qe4ZK&S$gVmqBYh5AKHhR&pRE1Igb?G1sHLP0agg2C)oG-uOHV
z&t$^0^d^C5bdBZJk2|Mnuo%B+BB!t9>?7WD7oUbQOYu^b!Dzx0cIRU`)%5fiy4dj)
zI2K?#vU|n;z4128KW3B9+34kwu~C{ZD&BY@QS4u)U&_+{(#$2L#hYA|Ny*T-XaE5w
zv*w{P^~g+wluGkG@j{mXp!^;Fgx2TyUBUi*dhcWK8o$32231N%%$<ArIA!DQd!@-0
zIc*V|Tl`<9BP!#4O<psBR!WhIsp}fgh3#c@4*7TyGQCaaLiw3nu_OOJI;WET<9&zS
z@PqO5;*}#x<JduQJ-&Oki)-=R`IqNubj_S_=Ut33qC6=UMUZ^-UG9}_OlbjH2KIa$
ziLiG)9WAg%Czj`<_tGmLPYN4cES_8>$o<~;$BSSiVT{iqpML)e8}kT@n({p?|Gn(^
z6yN1%a1wBwa5Dp282#x#r_mFC!h6ESPJ3vRCz+LydGf?2tV(Gj%79w@efpwAPG8+k
zBfha(HV5M3H^uc8K(^VjrziSM^D({e>G_ygg_Mo&^m)05+Z#QRHbDgtjrVVPzT*4x
z)0BI~JrS~acz*fm#)1#N+s^ix@deJ^!|s(psMxz1W}bxQD#vFq+UNM++32?;Pi}No
zB@0!$ZgC!i?W1&EhJ>S+n&%>Bl!|-exp`*fBOh-M==8-afn+{$U8AYC82E%?D-508
zvwZZ77IVOmdEw!BUTHS+(zVL?dSv3s7bzR(l7T7P2G1Ev_x0pFdQvjl+33F8J23uS
zydn%&7#=fLf$x{jL#EEmdF^>#S{SAi3nv+!Yx&&s(fugK^gB8_Mqait`RF-hH}K*;
zlG36?ywUSNx;A$&rmWBC-+r;r(LPRpU%k>cB2#vt1a{@?7%hPF$>WvhulS80m?BPA
zN@J84ilqs0_iD4eV?Mh6(Zk@bJ>MkSbS5)1=>*8={VxtvUZ9l!KHix(aSzMUxAJ^W
zM<b@~>SmZx?C-Q|alZ{W`=a<!Iwes)dN^eACKo4AJk(=U&Q3G<BBzH$PBZvZx4!Jv
zZ1%hILsWb|4Jv0E#lFu3Fy%?!49LpIEzb)XjX^L0q7(bHA5UC0=4RxL8fj9ZDhl}O
z6a&WoMvDm=o8Yv$nZEXN=ybCc;Pm-pdq`=;!+~q5GIhU7bHRU3c+aQb*NHjJGO{?Q
z?^Eu+8v&13td1QZ*#XD*p)_No^Dcv{`>lc3c&lJ)n_`S!tYWdS+4U6nuP`>**iaTA
zTlTgx*9l>>v6&&6xHsjOTx63MJ0I=EoBC}rcXnMxqtncF-S$p9-ewE3@;1fdrM&I*
z^FI2mJF~nX_)LxR^M9uIv#=TC?IwTEW0nlsX^|B>sZF27%?xC5jnl@p*tW1~?!!%g
zE017&H~Zb_<4p{DaqRN-j1~*&>5GN(!1v}%1QYw2-uLuxi|r>orDD<JJj!BT$NTfA
zE^*Q>oOZ2K-<PkUuxsV>o4yyLYb<QpQ?J;OZ+3y@4L3u+({|)ddPdnqVz^*USt8Wh
z-Up}sespZF0K)Nh(?+)Nq{<go&YP9<2Akc;@}x|!3N~9!Z3a$f1Bzv^nf}gZ#&v)8
zgseq^oil5-dV{P(0$QGr782zLtbCoD8H2L7T%POlbxi|T@jX88blQ?`(#+C~p+7N)
z(;z>6t<#@R1A2LE_V5;`Ij*^ze9-xKF*`A;EtxuRHWWosy>HuF2}fyB;d`eUbMDVC
z&u#e{Hh->c;g_9ee9OaFul_`cWqgdn-j&Z~eErkUxI3HCcjfyrZQRSFxVAGH-p%gO
zX7_t~`_2Ac{@wWar#~;#$2!xoNsA7Hi4;P4o{C*&Sw1muleT1>pDFf_?Tcq@^8Cy9
zW72b_&Zz^IGmUbne{6I7(P!nkIGcsV_<8W%LfM~4m5k?M{9F{zT=||%-lxe0!)OkQ
zXB5B93Z|G$ghdOGEzYSt&zmh;%GY%!u-XjR87e%}gE4(UX9BnB@L=XHYI3DNX<XSQ
zI6ngdJ9oTnT+ehN<;f@;=;<8SnO@xKYc7xJhiBSz*$j-zD~R$#yxG1vZ}uZ8{;<!A
zeS~~?EIDkSmgl3GFC1q&99o{2@^_oP5YwPl%$IF1EJ8#Qcbf2G+m3vbseMl_GK-h9
zcrl8w(CPDTYxYUQSl<75yUkuWY*!@d?N^f?NiM~`<P%2fF87;_?;px4iu+JJheddB
zys(<i6HF%FZ58go)1P|AavANr48VTT1J3hgB9B)JS6Ub~cV6M?&sOnV`e&flPwv+y
z#ItD|%^T0tFS|M8eVYLrUt^gNFxtF0S1IR8Wqgg(Kqs33YWe<o<9t%_UGY8!&h}Us
z)BVnq61&&|R`DJ()L6Q&a{4hx_oX<uytELvi5Q(v*)DM2-2bL+)dV2Pcs@t(P+m#_
z<dbt({JjXF7sqrvcE=b$_v7cH#8h<8U2$#YV~pk^H|L_b#$rPF-sj_Yg4gQEcV6lF
z_GI$~%`|qDKidp*HnR(x0s5vnuJS5vvz5+fU{*evN!smrZ1(T+NtTZVRQF4sQW>Di
z7c&Wn{%QN1UX?zQ5kC{SO#^v3j$8g+87RvS^z^o;&7C;XLTZ{_EQ}7Up=I&ldBtxw
znX|H|S-$4Yu3@v!%kx<L-klgK)G4}LJjmtkj3FAZwyk`hWWvuez?t-DC%wJ$ITRtn
z@%{5A2tdVl1$d3`<#@kVM<^qemoj)c1RWW$A~fi2LTR3O;XElBy29d1X?t<RlWa04
zF!hd<e<OK5@&<}U+vwO1baALmO2*0=&MZGYmrxkBvH>XWX8|-L7MY9}iKBg$Ky`G^
zGIb2sRH+Cdl^0v(-<83kAY7C|aq`}|YbtDxKL*L^=c9aYM&9x0)_N1uD<y#OO5i2#
zdGrfHOkTQ=o`v~G@0st77NMShx;-rBx0tK)aVCtfSbnuQ*YUGZS}3?hKwbh3?z^}?
z-<w>plv3M#radXmMd_Jx5wGHz8!fCx1;XR|SqA*m-Z?jK!9+fM5*Nz0@k~HA2JOlF
zHf@Whe_wu{PxH9SJKqdcrj7Wt(YL=Bbusy9CdaYs$#BSMHB(}*a8gV8q4L=5nA1k0
zY#`30^EW+_)7LaT2SwQLOk)~Ur*C>W3^Z{w9T-jgR_q}i8JyDm@HkSuZw7do3&D<T
zvy=>t?X+aLW#XRj9(ex5Jp0A@xR;fo2<SmhJfyat@~U(C9@({wOt9^{v~BU*@;nEg
zH}UVyp3Uj|c_z<1_r|8QyuXogm(%x~8&Zso=O)kT^lu99Im@Sjzce4y=QjDixcM#_
z(D9efsFW6xWlv%Hd7XaAr{5ouap^&^f3IYuJ@Ga@_u~A^RQuvw%78!GRyKd1&b06H
zXXX1;F10B?51U0mHa&)nw=KVe6VJdD@J(;O+4EH%)3(DaW?(cgQ-C9uj~Xp7-C}C=
zTofLvKdwjf$_wy3A3xikHv%M<92LBTV!lR;+N|VN%4i{0<j$m&dhw>N%P)r@)3L27
z798dKKK<^Fc@LA%`}F)33x@Kx<v)w>i@%5E4W=LV&0c`%70|SSvF)cH+A)}oPsD8Y
zXn&>E9_gyt_-0K%wB?tf9Nv<t2```TW-s-owPbR-VJRM>%^up(gP3KTu0D$2p6O<d
z=FF}9M!CS!;(o%Q70+olSxe&;9>=7!<K|TyKo$k#<$E%^5I3Kmc@3i%un3!!&f9Gt
zxY&9bn!Msz`PkFpeoHSb=O)j`Otw6qG?&H8S^Qm!mt=D8ikH)XeoQ8sI0yHAv4k4U
zSw7)EjgKSai}hsceii5HjhD6MWAUTBv><YZXX2dQ_GQCd7~(t|Gu}qem0P$3BSTv{
zm(lrp6W8sz-}&A&42{1p&VBS8x^tcO-Y158Y0LL>v^Xk#ciPXy?oaLrE4&ZoW0V2E
zY;VfXMd_ZGucO#6_g5H|X+X^L5;L**Xk4f)rTHk1ZOY}@$otPq&y&a$fE9MA_-<;k
zEM<G-{w&BcWpFEBS9uh9^3xWfqwDZSAUB;SonAy0V-)(FI?s{qD%iiCjNX@G|D(l|
z1I*kBOHA9o%`l_*ciDcQW((aY+xBUjJi#hFZM9N<IP=rJtTJ#+gT>ebD0u>28FdS?
zM(MXx24fl&rvY*^z$yP(KELU0rqB6IlYFMJ**0f0e~)yGaWP=&CY4q;yk3Vy6Z2uq
zr}6$rXf-wfyd(I3EIjv$t%{Atz$c~9TIppf&PDRV^o$oRMWO4N=AwAeN85NZQbHJS
zBom7l^EA8><$Yqs>b5N|64AD>d|c0S*HN0|Ja@tXrH8EeE9a%~fMra{FJFgymUH*N
z$rE=W&Cz{zpE)}^4$Do<`uOGdO2%FCi8=7xjz-2pCZE-bFkR_AW7mQ5HOiEyHuaY>
zh)p8)>GR-C?4bC2K6&m_qYRc4ALhkAC$Dd`ui{##<~`3#=Tzib%zBm#$oM$p_iys~
z8GY)0J2A%-&rB}m)k67v{Zbf?i;*&sCof%R>7+*WUei-mK25ivpLj+}bz-)eyY>?C
zq+D`RzRGg=asmk4E0gENJmr&9HCj;TqvPl0g`u~(mp{FTnf`p*K9=|MXf`t}qu%r=
z?{Iv;;_r`4c(BjM6H?rPX@fQ~MmNb_kW7N)W*7ZPUeLs@OTU|*l+DjQKjXeOJAU~=
zC|ugpSznv~wiwePw+S>Ft#D-gP|MhmPp$w<Kk-Y!x_tb5{x+AX`!U9);>DaaSmSN|
z(MvwgF-Zv|NBb;x>;#$pg8J&oX#XSd^(OE6$X<BU;o%}gRa|C1iq(%Vbo??G9&K@+
zd1(bM(}ucaoK9O{l;)s(j^&?^!%U@lE7lQH25)>lGCJSs1xm5c>BZe?!#jOnqZd%d
zb6MWr{uqa>$B%|r+I(t`rdQ8$`g=JItYt8qxR+(HD#!<7AxjHM$=GtrChwv*xwtJK
zqkL}VQGTY&i@M@@EY91!(6Oy6AG3VE;~f`oLq0(c8L23Zo~zT-1QWNWbh}3Lo=<wX
z#*LVIHb-;h-fQ0*dAP;?CW%7hxg9SGOStKI6Q7rVXYcFgqx>99GtxI(uutR9W`I>5
z#rNT~u|933JcXoVAd=I5H$Ld-DIXh`5s01cHlA*nO2^O6;GL8{d&KaD$QhA)`Xwu0
z^YpRG@$~6^Zg!mVF{Y{Z#kLdYGWvhhtEuUEaq~6aX#9}djwg+nHwLJ@gk0XV!JYz~
ziGP*eEWf;%DH%JPxAEr1sT41!OwHlwnJKM+$KYo>$(_Q*Xs)IJYjVXVa>kYZXg0mm
zS9xXQSxnX@W8!?>jwfEy(f8B8@yA8W`NRp07YD^TOf4El=QMS_#d&)rOXHP~>Haqj
zDx;e+@yty{Q_7TW_q}+h?{8G!<IZ8TxgUi;y;A7Byl^V^pO5EbdVYAk(f^Z80kFJK
zlTB<)vG^GSg;$#A$=9HKEu&CXndV+PMsbeQ`MmNAv)Q|WcPP#B^5u;1dBW5cHnaQ!
z7Uv*dX}|fzZ^vYjGG5wMRVo$PxofZNz35`uvSpim_%Gi#0-_ze_sXT0?USwBwzJ-{
z)83H%_kT$aKJ?)DB=Mh~`!_!I8M0&NZq}H_aV*D<9Fn{5yj=!^zSQdt`Nr#>F59;4
z!je*s96BU--SIhB7kcJV+_%lx)6*Eh2+MSSs0>8YpB4X}KF}o7?sT`&PM|C;GB%>4
zi7gpZd_PUB*z6)V1H9?68OlG>=hL8cCe+_-P9_0dHvPVQ{urYbM^+fI!h7&09^~@l
zo0n@>rdAV%f0Oy0@_EY{77xWJ3a7{aN$J`|#_A{Di1j!50!_YX?vPdn;S6J8T<v_l
zkumT`*F9+{M}{#U8-wyS6>CesWF#anre%Cjvdqq-TxU2cRxV~Qp8{9UX}?W?_V^Or
zQlMmnywNpF34qF=Qk;9)Xy*>x3V<xHMI<lkkYqfj@W>ype%${32|%&;%c*ncx%2R3
z1cIaY*@4xV%_-xBf%^wP&%Ft-nFbQ>#&_DKo=n`sVgq|p@)3j3z%HM7Hp<V!#6I%U
zb5H{R0)We-IQQat^{1rg%8P^IK8&uxbF*}YcX>1~QcO=ivHkStV<xGT_A`mh#hhnZ
zkqdQUz-;opDxY)l?~%4)`8jjj@7TFVzU?L7B~N|Ev*ns^c&gm+!9O2G2d;kNH^}ub
z{Vv(QV;9SDP{Vo8UAN2s`MuxKzi-I3Pkp95^x*vpREfOs`j^Vp*F1%GsNQJEm+rZf
zIl=qCbhljdl<Va6Kk+kcBn(#a!G|A|cfO-9_uX@s42OdW8_9QTs{U<aQ6iJ?V&Mb?
zd$u&*Qr=+Nm>0%zGlIeN!KS|}uRzL1Z+s#p7jY`DFk1cj-UPk8_-?afZw3nGu^C{M
zjnnjg%G(sHfaznGKQEupna*Le`Pqyb8by&Q1UN%Ixh%8?eeztq(rU%#dR*{0xn1#n
z`MQg`kIkL|tf)pBW^NawRdi_qkx!h{<eU~Epv~r?yuSkY$`9{&ANE2|P=wv@vl1wH
zo6K`zkpKUkeFwN*Rk85wbI$F#>Ae?7BNBQE5J0L3NC{FD<f#wEpI?98L*-epVtIi6
zJ`_PIYCvfMA}tU~LP#KiKsxEY+>)D{+uJ$&U$gd}eP+*|weR&``EJfGtIW)rH8X40
zthIyFoIFknh|OTA|A4Kvu`$5miQy397ztBWm&R8b50kr#a0+`aRyKlxMVWHJWXB6z
zuqTC4q`iQ}V~QGrC{+NjsEotDO!O6a@&0DdAu8e#s{*ZYa@?p4h0F89XCpc|=oO>8
z7{i{ReWauvb@Tdo6dY}<Na7W5UxS5_8stPEhL2ZNXpwT~UFC}ai+DH2xjnq(2P;Rg
zh3{q`e-d1I%@?4#`7lhLG8OK>_pT`4aVMS%4fXZ#_s9PX3t#ysj2<%%PC0F^nJs-}
zUHtd|`Dvqk*4bIs@DU@8(t8db`u(q=yQ>RMKl2<jQyT{R_U?kOedF6kX_djZzwu?*
zy7^<c{Hp71d;9k6va>jz_yj~oZA+SRk4@spCmNt~zZ8G(O4<x0d=oa96#iu0+vgeK
zn#_1k=1p_mr710$w0$qU48G@icpDs6SG(GCIXlzd+4s?ZbU|>&6=oppgL3?ofTGf(
zx(ObtuZS}RbkRN4W6z4SVX(G_2$oRZg`PFPc(x*g+Zx4mJ|452NsttQB1Hj-b*b0@
z1TGJ~cvv@p{b;BUE?x*`rk>BviDLwzjhTfYTOgR3kg)4$H0uI}GfP&8_=PCKESj+b
z2|tK@3~}0oIC%iTd5qfecsai)5Sikz^q?^j)et(FxT3H$jvrwZyeHnG^9-45IT~XO
zUg|G`DXfpr8%X)vaO!+MGD3qs@tKFu2gZ^K;T*w9kGMc%<@mcuVWE(-TSkfsE8-8Y
zxLG+;Xc@1#KI9ks4QKSxxtFA<BlyEvV{8C0ntNU>FTqJOjVyERfyB}CV|^Y|Y`)Kw
zRdM+M`847=FRs|$e(N>+H)`})IOFvdQ9tAFvro>C;3z3AgOAs(fg`5QfU@#(=xA?)
zm!5wb)~)^!>g#J^^@l4WI@TQ63){DCwjh_Ayy$YA|IqKCuJ(Za+qhvh9Ch?@uxjNB
z*l%2l5P=_;gM7(HlZ*UWMs64j5KkWCB!x6RqrBRtTyD(=Lb4E*;Xv5B3&9_E0r2{;
zljU9^m(Z7RN-K<Dz~6j$zL!>?#E}xGkE@*Q0GGumPpgP2ZqH)_A!!H{>xm0!FB15H
zu%X|gG7Iw2JIc>fCgVl<GqL)Ua)quX73iQ|98?sVoe2l37rqZN`b8x|!YKTuyhWuI
z40sBCFNB-6A%#!1=NSPzxt6k-Vt+vhJB3@*bC3Tr__K^gc5e*zBZDv6T+QD>aUF%%
z7vmQio5-(WC^OL}%FpTpVF1Z@gad^25Nr{Q?A{MgPl&D|LEIQV)J`^B<D$JqQ9Ya%
z99Am_3Nf5w?TI!dyyONa{P=bN%Zsf2gnp#9i2ta5(N76la#(!7SVsOqabFg}6Sb?*
zj^jXe@^Qg=kkcW<tW;i})0Fd9jE5OM)2AP0W?-j4i<v3C|K2;$c&GvH`Pm(C;J`lU
z3HNkT8b5Ig3^DG-wMMCx8iiMBT!-(zv&hOc{A+G%vb=z&@bJ`|;qJ<dd2(r+>-ZU9
z+6*I@Qse%ao=6DuwFBReU(>mRTrjKquPhe^@8!`+yez>Zk>YDK5_x$~vnqa|Ft3xh
ztpykGys=H9!U)i2SsZ@85jS`lhtawWvYFKNNKJvte$-%)N%pbN=p|>o8Y~<qG7iWM
zAOmS6{8VqgP&~0*&aQc~YbaqIw09|*?Fd|AeCHR>38XBMLFE<U;&{?gUK|$Q-`rav
z`GE3wmk)!(W6y=!={G^gfT=NDDjL_pkgZR`fZeY^N%Jm{R;E0WB|!^?59GLw-sMUF
z291Qm5ywJd>T!@8GXct{&Vm6QO;Fh12z48_LC2O4A-C@%$kuNI=xU3##rd1J%i+@Y
z-%z^fGxK1caakQ@)=BVd>uKp%zxbiG_^-VBdYCrz6ZTn0M?1V{gyXF@-;fx4GHJ)Z
zNj{Wx=6FgO!*SIDue3z6jOyh1B@gkjN#*!Kv{XhKy4v{W@X4)9G9SG^`@D<bb2okk
z4(#6x58n4HCv7K8ngU<B<u({;W^XV4<7s&Q?|*~iPnu)l#b6Crw0hD=&Lrq4Ck#?v
z<TxQ@rMyB-cm#P12||+FD##m5j)V8ba}2p~lN~~WgJ6(?o)cOQ77~<PfJ(UOo->R#
z*d>E<r6`53CLkqURlzHiV37u1(aj*3n*Yj>d)beYS+#-4;g;>mK_Qt=8`RW4bgwb6
zCg^ziEbDiULmC|uFag-;txmI;+|il0?w*`cRwd@Iy({?6S7mt)N^|jpPBmA#+$af<
z?C0nt`|w>s2#BuA(NH_}MmRL(D(ER4l)#~5z%<x@^nXIfz!@-f{rynhxG`40JjsF6
z!nN65@^{tbSx|BE#n3tBIA|R?846`(P$(}0zq|wrm8HftH4+9+FqZP@S+M)a^PnZ)
z4cVT<klnQsN>@Au*{$!z_)d-kNi%{?_V*`_J|608YvJ}=Z-R~M*U+@TNLwh*K3dGW
z$Y($IMdNm=fggS6R;$FO&71{4`1x;QbkGDc!NCs*(8dh!Qw&TPF=`APZft<|wl-^+
zbKc_RIBi{<eL0MLY*8J&|M)XrP8ut+JkQHhQeGEn!f~fIzVPq2z=<cHVcdxe;q_OZ
zw=*ovi|)dcPdx(`z45BOKmE*e;lfL=gx2OJc=-O`zz55h+WLEXx@|vRa>do~&u5;n
zZB+LkXlGq$Y;c$~xyf~n3y+xMav`ZH0NGeFxWHpdD<V|{s3sI>Zx5esNhKu_<ZZfy
znk%4#-pTr0!buK1?GRmA4}T^V2v58W&8oN{wZ8>F@<nUHNuv#??=R1&qzqKZ{;aOg
z!($sdV{}Z=NYItjni~(AK&>zfxf9JI@Xcny_VM`-!aIvzPbe~}__Tfjh0eS;quCbW
z5$5ac&KsZmIQaBuu7D{=Oob(j-hii{dK|v<y&qe8KJv%=prfS`N^-@(0cjZY#wRh}
z^Zht2!o4(prUY6C&4NRdt}wH%;St<FIm`6T(gL(~qY0RUd`W*eJo;=XZ&(AR%{w7m
z=#23a7rMNCDU2z}h^+xLPl0})yawva2ZEO~O3Q#*Fq2_FXDoY@uif028mW*Sl!aWA
zS=;C^WlM&GKX5eo*)piu@~+x{S|6qHIxg_zLjHS87aQf!n!rcW7!AfFr_Y3Meg96|
z9|H#sG3zN6pq;#+wM~3QhUauMbDML<C*gw?OW~srmJ9w3+?yDHuy5}k@H-1JSH8xt
zTHuZbgU|TGMMEz4q}+AMXiTzBSAL$4w{_W7pMzOP9}Dj-TMVzg^c>XJ)!4u+q*-NU
z6@2}hcbJKKDST`UjdL!%1Zwu}H8ZWJ?92?q;IXZa_I4XSf8oVfz)~~T#!Z}LT#1w5
z$;Tdso!hsn@>DJzNt(%DER*9myd&f@jR`s8bRFDdC-e0bP?SOOBZm=zJ=TF<vSXaW
z0+Q2iiGwV!;UID3`DJ7yZ<FIFleDPZCymgJRr^p}?`BHEOHTFadQ878bQ|SX+g8k9
zS(1TyN0!3ystn8?mON*1>AoIVQ<rz*P^48-sq}^i4GvT&xX^1YF-TgaQpwUax#fx*
zdgEuc*|K3>J>-gH{YbUpjBCo&>2TQ<pM^2w#>3ztL*R)g{sxy{b+yg@@PqdU>j0VJ
zi3C9#09-R_ypvGi0MVj&m?46(qiP(qjyM^5Dux3e7&pwu86d#@ANa7R$>3rt=&l$B
ztwWE4el_nw<>3tpfh>97ML#LTF@H(*ASfL?(l!*>BtdXb!T0Qar^(Y|w_ABZKu!Vo
zq2=tXEHiLygsV2bIGnPNrGUrZb~AHArNzt2avX;}Mj$><R{Vhe@Xhbu8Ea3Qne%$-
z{j?dMfGdpK@r094gT1?VMszGID~GCn)fT44LkEp=9c%YA)$HE~=tYt|zzrOJ&vDii
zgl1T}<f~?=NE%U+Gh1zJA<maxc`fuac;fpX{^B=w{pt_Dy~il6<KT#CGhxu+VQ}QM
z>6R~A%!~>{+!ww63anhQ47P9G1V>JtY5rzF=fue{%qaKZE9GDm+FE$w*(YIvQF_;Z
z@oVtyAN<^`d6k<oo6W3xt*NUy0YC3EO_@s?Q{Ei!Xi0Es&AB><AC4#o6CEQ&pC>O8
zvuONBZ37Fd22ULrvLiHQBMGA^Kv#aLuw6ve1TbeX5+2e&>{5~mg=;f~&%p!fKE-?|
zj4XjuM`fWj>%ri14|<HiY3eH0TUFx0(L-}k?N~zCdN>cO>beupCF2vk9Co6Kq}PyP
z!{Lmx&xavHhuJ+F7$RGD;DBXt-0y)2VMl8j-%H-(?Q52y7Z4zb^rAf-VT2&9RdTp7
z)}png#kiZA?CfvK5z{O^M~xn1-)GHQ&*3h!M%#^p&$lzL5~E3iwK8xDfJFZRBovCr
zW@{Y-r$g(o<IT(~zCb;G0Kmk79{l`V5AI#=!|ECzTDr2(F=!^V4Li=Pd##V!lfqy2
zOF){8s<0?8?YTpR1>so3Yx}*oLVz=>l8%M~bhP43(X$^l#m~L?UC9}!OW<-ENd-jD
zq>-e#%Qz40GwUWVJQpY~4AmyZMKJM0SS1Yfi_vY@ec|8XV11o&VGXb!YK>^?2YZq#
z>}+rk)EGAz@<~;7wH4sL_^_^|x$GB71CF=0UXF>&3#qhteY{S7?~*U{e*fOx@cz3?
ztnu{L!dI*f)n?qG`0gK1|J5j`rQtUK1Nn>w=bqg=pxNO6r$5|lqXKc<K5*|{Fks+d
zTb`O~ZaQp(ITjmt;^D)Gpt@gwlegO#2isxSj;)dLD&gidbJ0!8qnr!zz9fwalgu2y
z=E_P%z>62rv@Jd7_cFh$TyKe&)r7YcuDo5|j$8xK29pbi@L^GbXY{fy-32&pOgRiH
zOVZKrHtph;i57ERX7X3X+gP^02Ugc52cm|r=jjSvqjhOXnYB`fj~s0+*D>QJK*Pa$
zIMmPpogE!fzS+m0XbqVy8`m3`L~WvdH-CuPGO!KAVck7u@OPUT1%5EHyC)A@wrqmm
z|Mq`i>hu}b>Jt^hRO2@K#L>stFF$Ws^O13NY=N?pVjz*KKzZN!J`@=IF{K{f_f!mp
z?#eMxQ35c<D5_)3r03}kL0x}Z<-`9u#e<uV_sliGJG)K(@}baGH7Z66$$uLCB~PaD
zy`5ztm*JV#;U7}8%ear*YI>l@C{V9F6MT)^SVe{A&bV>q>qcXdZ@ieo)%sJ?Q^L;s
z6$L69Jl)-0P}#2^xDqde2GpE0&W6!rC)j&D83Na=-d*x09CQ3hww+^7I0Yt5oB|s+
ztg%4_g9Z<U{sRWsnF#VM&Q5S$txE(~$ZKg-Xn1n`r1GL`PD7Whko4j-=WWQg_Zh{t
z_nF5NK}49=u3l;XG?+2Z-aWf)xxKr0!Jb_^RTwZGtgnSPUwtW2hnAP>*7{$opT=Si
z`jFDJyh|v{y!>?dAW!esnv2nU>zv-|)H+`)FD*uXttm(Tj=Q+Dz!nXz*fR)Sh7LF|
zeS9zvi}v)udE;|-b`?uzJ=s4Pmai}~3#PbM)%C!$o4a65eLj^wylt7}07GSU{K<3d
zu6o=p-`?74T|uZQ&_Zi7_b7BOx#Akw^zmAlGxr=AWvu2`UwqCgi#DU=4mTc3w2`2V
zZ>OON7$dmNZ)ax@Ogv(`Sz9~Own=H*md$4H?Y0I%gHfcrcI|?u<`$#Sj)K|8oeTqv
z`>7<CGx;_~ii=ywu5}4gUY=s@dqGAh<f<WGHV{w`j2{Sa?W|yijA=`Q56zvPof!`*
z4`zwoB_@CAK$Z4VnQHyP=@vIIi)5sIYj#sMDz0ub>uPL)p4FQmvwJU;_p}-RnE|T2
z+Q2gm3N;6vyeRuk%cJqX=Ou#`H2%YltEfOeGw(X9OmJp@z^t*j3{^^_MvsFluDKCv
z&Frb8qs{PP3%v5;vo;_E11~TgF>MB%bN<C<1~JgC!&X-HGizvrEkCxkwV3BaqKIgo
zq+F0|_i0Hp(9#TLD&xXa8Vg!^nO}n=t$)?=DBjDuwQCLj-ttO#5>bVHz1EP`kYKrE
z0PwFM%lc$l%{q`Bj(_CW=gLCDBg@FP>6-FN{L>Z^d0o=dl=bjDk|Asvn~{VfM4LAy
z4u4qFWdW)uRoL^MGAainD#PdK^66v%wVP+{rkyh1ZeV(CXSWT?(D0DqvwTrnqaWRm
z9Y4t|?tb1ze)Ti16$HAiwatdiHXN*l$wy2zi?owr-gP&^BM;nbXJoUFJ<&=~%(H33
zT3Gh>o3VX$)Q*e_1L`-=3(tKkM0=?4|1P5uPCflBxasCwB9|a0ob@eu<po&2d^x<d
z@O5~7-A33qdJ3#8=?~2tw!*C8L!hy}%gof`gVV)J2|n?QAHs|x3d1t_T)FwHf_7t2
zY&DANy*&W8oEW^l@fZ(A_VeI3?-gL-cHahSK(4~(mwd!|Ov2QgaEKHs1SGUM3OJz(
zZv6fGp|J8pqv2nNlKLg!br~RY#+6nz9=z-f=s8%ehGh39Ow)uN)gy6`#vvXlgqvY8
zfB@Zut3Fx*FaG1n1RSzX3<5zOxb^1ip|Rm$%n+fpW#a~zZq~hyI{H|<UW#t9QPpE@
z9^_$M^YKKzmUP0HkpUVm1;&kANe4O3BrRR{(!k>FXo=^`vu}g(dbu3nb!kz5TKy=G
z<x-7|5#W6xgIqKjPkD11Q@NPY9TFc;N#znJMBE}P?)8$11eOep=uJ^_MWHDgjrlmd
zX^f}6)2tN^zow{Uow75d`ut?u(b`U^sPA9h3C&#vIB!BJ3^yjd-)PDnjKf{nV}$%9
zAGS3Ypr%b<Z;;ka1aBtegqg}T8=p2F4TJsJ*idG{#*a_78;cdsJX`(Y`(`H8Wy5Ca
zTSOSSHEZ^9W}$r`)YsPp?G%z5u{rMHP4EN3elIUnUUYf@DluHc_;BS4*uHIRRIJ%p
z?d#UAgLXd)x4*myn&;gBtyg^wHs`Xir?COvS^9?2DrTku*@W9C&a=YJ5yDakf4PG7
z;~;}sN`sB2Z|?iRhslFHIBgs%unb)DOaYec!u2gs>8$Ndl!MyUKe6#hN(zGD40IJ1
zjFIElwSf1`AE2b}322+#04--3SK$!M&<?r!CMe(eF;wg;LE;*s`_7O4Q9C@5kWN!>
zlwA8ZmoIx8R+zP!OD?|}F1hkr`1+TxQ_E`!>pX1Sev&>Ump**|T^KihqV)zK&tha8
z?K?zoK_=rR#wb@jniA=YQJ?4=&r{!Pb;<F^_ZZ4{w0oC)biqcya$=z2P1mkGl%)J|
z1#a<c`i;2?HEr)=42}Tb9H%M4;5pSLfy)#>!5z9U?DI@=?}9c+Fv%Gfzm^(Y8{lbm
zbEYAjwSgrqQQmQ~EvfXlTQN9p#*bWuez+%&&TZtd@OmEI&}G)VeE9sta;RvF<4|MP
z!bX$?ba-G@N8lptS01dPwdes79B=%@1XsG8k?FVpz(H{0DW{v6)imfWop;ftkjs_A
z@}-O6?KfV7<?k+r-8;6~Gtany;56c}(K8>4ii56ES>$pVc=^SDz@oR_FrKb*IBXV;
z^JZZf12I}Ux}kI2k+Ao+pBgt<IWn46IL*V%%<ST8AX_;A2JYMpom~x3UYaftBU&*S
zX{H5^af6R4&8Qn%;X!HWeQGc>;*nKmc3_@&^g!f7Bqb<?nxwx>X-1NdhXoYOpC24}
zobNL0X$?J)S+WkQw>}CD7d1lHs5}%{Ku`B*lV^B0^bE|y;DtHJHpMsW_olS8UtU&|
zG2GzeLN+MwZo?(4@$Ap8kiUvvkf02@lQHtuJ~v|!x1{*M@$!n6hk^r_3BBRRXKDPM
z6#80SX)~R^C~&PU4MxhVDP;O}=>$sJHWEK&_D6NPWTZ44+&kt3u>78DN8Tas@=3QG
z7nXF~QxuL2eoSd;N`NOqj9U*pKc8aqXPC4pGJhY(!<{72wGN=!qo#PGcIo8q&>*Df
zN_lRhrYN7=(hc{2&}m(RJl(kdFi6~6Z$1q=E}xx%T@FGEOD2wse2;&)!4OY_?$^J6
zuYVXKi)q0N&%#U3KLy)1Z?r;1qor)u_Ol;u?)AKA*2Pn|QMBis|0($Elh47jm22R~
zKl`O|M^1w8|L9JbeeS2A@E=BLm729LT-?D$9{R(u?^!26=ebuvYkRleKfc?QBP~<n
zJ6;dk4>N{(aK~H^W)2IU{djS~+?!d~QJzs~@%CI+sO$sTu4XM`>O6P=y6X1@bnEb;
zduJ!)*LFhHhWXGs(<rSGg_zQ^Fnc9XQC?*fS^-+7#ZM05_@yb#w4{v{9;F-?p7#Gl
zer<fy9~#z!1`knbh3V8Y&W5wjxxl!&_nY<EV9yfHyfC3si(K~%UO9fr#jWASg|>|P
zbP02rTuMadp`-CM-sAaPOCGMilZKPlH#}+bn(GcpLn-4m{-tMjw$B^J3i)n#KKOWp
zoB)(pS`l(>B*+ix;k<rWXE^iXb@gQ+@I2hLq7j&f(Dvp|)C9Jc_;WhXiytDag^zPa
z2rRy$lJY<oj#RIN>2otm;kL8OATuJUzs9%^Keg(R&2!P}M!4X)!**?}?VIO7=lRp2
z{e}~v^|o^of;O7{5qyQXf1CaYcFenD+h!ZFgwa=hNsAV~VqG-208Vvie8G7tW+g)L
zj5ZWDS?0FEXu?xYKNF_Sm}#G(5E^J^ghwB99JCr=U4F*wV8fL5S3SrG?=jHP6&z!h
z@5!ecXOcIvAs(E5_$*uKf=o|43^qC&BMJu_1$EY6g8DG3@R<!heE0MWeC}uu2AVwC
zuEUV+Y=~$>^p>t?&PSZLI1M>`?KQigr+yFQFc71@+bAxBpIHaW9e58~XB**L8t3iP
zMw|h6pYm(C^TeM+zMl{6)8lK9azCG@a5#_iewKWv@qnbUA53qZ2B5?jBLjDA-3+h1
zy&68+QV&a4?S!j8|3$0FC{37jgfXZFz`IM{vKwp%3>XvzZuB>9Y#htdqeQS099;hK
z#1)C>rMvt1y)-^#pVJs5SU7#t<Q~uGQhqWIhlA6>C6m+Y<#q7-`8pRj@Ohn_jyXvn
zs*E3-#0evbNsSSrn$NV@F@bB4*C{*6<|jXVN}I0aQVNp6DUXCv`mJS~k^%XzE1yfy
zNSHB^pv3()_Vn}cmGmpC1D5JH0%l!n9`1g>-R5n4^adDo{d}9J`G*%m_v|2Gq5PTE
zP%%G#YJj8%f2Ij=j^oSE{~gAR9S<{R&4#pu3++$Le-P?xYhr!NaglW6`JyunL!8My
zM{8Uq=KTlDm%)iAonns*TK3M{aRBlK0M`UQAI`q;$K=cAve5@E2_7;UBwV~tVttBZ
zqP-qU+7Cc|=_Gh`jSnwv0cZ*XXmIv*=`;_1wAhCQ+k)rWo)*Y;Hb!;1JOeI;Men3y
zY2CgK%GWIeuWBlIO;wP^jm4!UkZZ4je1DVAWdF`F--km+X}0#X!rW13+KunOTmM_|
zjVm+XFRrAtb!XmhJTD*5s0_xAn+Vfq9&N+Wxvb%JNWq>7PJC9~ZJZvI@Ut4<`OmM~
zBa86)8E2gbpZ?5M2B)mu$A#(dkN*i?c=mDI&jXC2!am=>Z?Aoa!5tVKn=k0+4Dvl(
zWUNYBP~rlc%U7NxPsu)&{V5G!Nefw?;NZ%_#a~icbNwLUmPz9g*;ld-u6w9mDVym!
zadL)B3H3(II1mAY1<!)(prhoGB=Nuu+eYA7ByT{Bpe}2Sx6kq5xXF&@NgE_QX@gRu
zi-d(gmkL<3CgN@(KSl=)F0RbJI=dXspHO12m(}#Z{i`}*|DZ}}y618zjHre~^REx;
zsVX&pWl;6|B~be6$99bi6z1S~YQ_Q|uw)@EUG%yY5LaGvz1<rlLx?fYEB|~39)0LO
z*tK)J4S^^8HM;VFuJ)%#GgF8T+C>UhRg}OR3toi9i{7;Fnv5HB_OZv?Q>!P890BjF
z`4IA_o(pPfXn@?lon}oWQ~XApm&9A^6Z<Z_mNYAG+6EPe)<I+SB)f*Suen(Eq9Z)`
z*1`h3Yh-0zt8evYRnvATZ(N_?TWQ%#<v__bUV7S_;n3TEH|taY6-Rvu+DogUfaB9M
z3aqsq3RMNz-Ley|pL!!quAU6bYL~(z8y|+%2R{O@$I!PU$q!sG@wT{t=FjnW%}4LU
z#g}~+?)lv#5c<Ruv<@;CFW*}Dl2LMNBYN<0BbNqvn}-^TVf_Dm_DMUNns@CNjN%+`
zjUBr|y}8+bxffm8xbLvDv)yjjKqIB8u@QQ@yJPiBUe#oZ1`Cc4JayuVt8cId-VeTY
z3v4uo9HvXJxCTD^`7hZo6LWgtX%+wb%h$$a#IzZ+i~^o#x0PW1n?7C-cmMReaPVNA
zZRfIi*TDrBUtw`XH#{DI`|MMX*-gTj@H|G`<95f-{x6IjKhdrM;<vW`^v8Sc=ST1a
zkvXTI4WIwg&31N*-_m;Qkw3sYix=8Hz4;rr!^v~z+B$Hn!jeS`;n7DPuqTf6tL|^x
zM*{&jZ{wDNdwzNctX}oL-O3>4EuXn^K9ck$qY>NBQRi!dRa!eT$@j(b{KzL#URgx}
zIV^*)!=%+F6{)7ZT~>yKk>f21mOg7tr-?>87d-rVLirOs9yo<M#~t@^(O#~}1F~@W
z5hZZn)-I^}?}gADDlbYE&#Zy6S2qH*bgFntMIkL8e$C;+^U78%T@3qn?}ASlMKN*m
z5ir2G=u9TqzjrUJGYSKbe!(xIg0C+I`@X)`n8+JkL~_l->@&Bv-wi#jhwbb=;|CVp
z;K768f-~pB<G=hh_(#tHzpUJD5RUNgHtxKSS3}u53!thjS8U&7GidrMa3(2?d6L4k
ztZ@@m*1iu-W6py@wk&#%n~lHsrVq>a`8F`aPVNfbP~NZ(D(gN{g}z1?*^d&Y=$V13
zt9CbJ*S&5A{~)NI@>yuh^@r}s=Rw7$r=iWPvn|-W0PslSas9@@2X!C7d$r4;+rX4<
z_n>^M+xtL?@Ycei367<2zhOW1jsg-OkQKP;_nzPV8E(4%@>t#1-FOqU7~|uwfB7Sv
zaMGN}RVc@^G*Ee>_qZt@50J$GjPozL%-AXQQMnGozj(Y8ZcxU3i70^UYW5qx?sOWU
zk`|gW<1kfK^@DGH|7Z3LKpY<!QA_d=KLvtg1C<IEsWwXVzkcuw*tB6?Y%+mxoqORW
zFxq%G{$UhS)8R(A#25iLe&y?M_nqIfUnj;Rt#)kNVm}Ir`Gb!*wnVU$m|6B&=Uxbn
z2LI=te#}bZtFHSuxaiV(wvADv#@an|IAdM-^7HU%Q~#I0b}KA?bAg2$`)cWuH(}kX
zmG&4Z{2KCQ^RBh<oORBp;7X&I@w;F6NtAIDCqqrmJ{x?+`$O~GXf);hN&TMVnRo`N
z6(tjJ!4_92$f$Yn*i6ASL(vACooIN0^5S{r0FX%XnOUMvCGk2ng`zQ?ODSmzl$VkB
z5-!z9@R<_N=s0t0^R*pa#d8Nuaf~qZTDqZh&3@>2_Z!f1+b8X-%K0lorPbk7NJ#~i
z6bKS8;sLZ)n~YVrf8TDqu2fc5VO^eR>7i?oPKeg(;yl8`tu>(m)IR4YfM^dDhQwz}
zh}nHRXmRkC<-4G4(@H4)%iYj<+C|VYW{R0{n06X!A+zcoC|~*#R5#Z^SxGMXMptYm
zY`ew>`Pmsh1K>w}5pLP8MyRTPAF7NZXdXEys_u@rd|0~2H;SQ%QiV}k{SLfi${b42
zNAj&^KoHDM-tOsw{DJl0b<T&9LkFPW2{%Lg`17H1%?r>qrXA`^YGC2s*PzTO*uw^H
zbQ$7otE9$*%8khxxeOqQ+F@`@MN?aI!2a>PW5-Rf*L2c2)sHg~JhcJO6|{;=q}~io
zP7}<Fvw}shzY5#!hV-398k%>=pZJ*-6!y6OiZe0aPrA%x-BJ)I$54>ao%qC~4_jsP
z<GX$vgC9S-SZfp|UI#~~oo8o@xL=LWws21*Zkpe`>0=w<go<|9@R2b0tn=;rb1%5W
zuI;`4>I;^Z7+Krh(+!0}{L@XiMP<X<)ux{HcHEq1W^Y4>jeyZ(#>3<zr`c^R&pz=e
zY~HxuegXL>|NUFLeWlhY_ZOah!j5%>xwNbdCK;H<O_&5jhmJ6_z_V?CJ^R$7u*dY-
z$7Ys{vsO7KG^0#23^W~-lO3QbDQ)K9Via6F;HPB7^A!hYBA|oqFOf+T^ipwXgwUR8
z_-P8JcRbzjakw-KtWU{<$X(!4#=K4px>#MGPdvx#(gho!GMsUh8TVkOra7XrM#m%`
zpytu=#`ow}IapU~tknYvST$E_3~kRb3m4as;0&Krl%XBmqOZ|a-B5P`9=Pvb>z*8t
z&4d5i<B;FA1+qiO*x-&_^C2kTwcaR<?NF61sGkuJW?Y3R{9VIe!XN#bQssxY!l2Fb
zA=BLiZ9`^5cjYK}V@DCUl8!o~wAMoZT`xmr{f9Pe-G?NPx|Ed$lgj}0yV}98+ho?>
z8lfcL2|XpFAzwcpDnHl*os-+(;K*7i^bf{luG#R=0S_uR7&_H@&bA~CcwcF5OG+b0
zkAVw6eK`y@!WYv`x7-$MW2$kBq1z5OsdpQ}-_@P;6lm>A{CR3HF115uw!ssX!~KQ!
z+&$w0!}IktMMe3g(ss!Ql37?Uen}V;o+jgY@tG*qf$q68jUrn7=BxIQT3+|0$wxvi
zS7H@8o~MY11Fu;2ww-ka^g7BO$u#@elk6HIZoK|z<?_f)hzVyu=ys(#QBh-5FdiU)
zN(vPiD$O;kKCtg`*4JU&e7FgG`<6{mw{}%T*D|BHaLi-bvWjwh(7^7UJK*f|K5ai9
zS!0y(k~d$oCzrTojC<{i-f_j3OJhJ@NkU+Fp2`%(`%vnFWUxqN#(({AU@=f!N>fXS
z6cR}rq)FJ~i8B`6Yrm3!ysWI>1$UaDiRua;+0~m&vV3oCYKpwV%(S9+%0Q9s!8m;&
zk@}+4rKO!_fVc#%E4ljDDlh8K@Od_C)-jA?df5mJG^z%eb-s>{L*Ore8OjU6><qut
zRbG~b^3t4LxYuCt0x1)N-9-Zp{%q$V7_j#ZC~w^bEhFbbNA&~<dpQUyY1<Fgb<3fm
zeidXp4mxpm@u|xo(2Ri~lQDFf_k+LU0Vp4N9JJ<hP`NGxW%W7e9FvEh!M^=meeRH%
zZS6Nk&z?*Wydv<GZKWv?wNK5X5u?Z2!)>2`=5IzxjRh`0Hh#R;8Y39_w|nO{<BndU
z(%Pk@HTr4%M(=R8&)3CxSs5JB*TnIU+O}0>60)>^|ABDiw3+r`>fhY;lLU_FUPTzY
zI)mUV+$4=NpKM96#*MSJu8vM<Z*Mg;t%AWrhuZTOaV-jGKoYL8<0ruJC!S_!gLqb9
zb5o;T53V_|KZYx=PvJTsgs`Bpn{m|9_ERW0gT&M0OU-O`$k5>?Z>NE;)8@f-xNhTy
zMHemROVc;KC4wc#Z~7uUc;~yAgr?R(9nn=RU-8H%&l<=$NsC3cWV}>CpxtYckdYNt
zC^(gdWGI)g<qF&D#X1OZ)FZ))G{_{@*@8;I3Je~YA(f{Ve(Mronvo&v<G)g&xRj2(
zmb4-qWx2FLpXT<_+Ab*X<c!F=4efWPim>2Wg#9Z@B3|L;1AHNNUL?V$!KJ~-BepmV
zb7r=ct6OPYhAUIY9Vh_@^o|Em@pm$xq>E;3MQzr62>rr*x!s07yW`3`$RBs*$dmYG
zd$PQi7oX#a<G=Xfw`2HeK`4~)`&pWjN>h~hOIuU4XgOYno@vIMT>F*V6SO)dY;nUk
zIc|=eHUrK)`vTZvT!A~bZ%Nb>oaT`+_ymdyl?5uhp6;&jz8nr5*b9%(f5@)U-SFkF
z!BMl1wQf;#;c<A5JMmPQ`^gJntXVI^Q{C}Ufc^u6EdZtADe;6Wwu6cX;m5<Xk2&FF
z<GMY~D8wds@wq2q<@@gj2NxUJj&0p#*4uC`?E63cm2rDs0K0Z<w==i|?|EM0>*8s0
z)s7>Vvf{sz2{<9+<v?ZduxW_HLN{XZ--pz}&=;YmF_Ly<j)Y%R0%;0Q=9To}15oR%
zH0GAkRa_D9!KEo8{!UY}Qi*BFB{U@bz4ZqrSL9h*8?Ka~KLp%lqZ@%KTPSjwUHbw^
z2)htlAoq6k*lI2mb{TtqT_mK!2smy$NF39manoqdlcWbfT}2brX}q9~U!ElIyA)>H
zGwq(Y?NXZjxl|G^-bkZm8jked1&fp!8o$cAD9OEPTKilX+B!T?<tomYaEA26V-LmJ
z!vlkxn-ANyCEQ{$V$^6GftWSxu_v827wU{V9P2t@)|Yo0g@<c-jfW1w!TNgR`WtCa
z1*tYOpnm=O!~XqyV8qDLaQ(mCZ0q{-AOFWHN*nrb*36m?AGTWqaC-|XJ3LPm*Z%O^
zTsSW93&<y(dIqdsxdN6fUTEE!2q#7`?%TD)x-l^j29>FW7r!E{$TXLn)$+vX$REhg
zlN-UfAk+kXMr^)}Ln`xU!f<IZ2)!iGJoK8wAz_zzXupyfHA{)-k#%cCq)moAX@lA|
zurbM<_mL4G#sJ@V=~7IAHI`Kst|p)~LCDLe=@j4B_b$mi{MW@lnlg~(<sa?c^1?bo
z!Ug$R*@6SkA}sbU*e6776_No!oIkb5OS(@>QZUN=d{Zm&yrvX69q8UA2qZ5^h08a9
zrj0M&jvVhUg~V}{<4y9ji!Qo+NjH|L3|-4H%Eya@w=XV1sq}ce{5i)De@BlU7X_l=
z+THLGqoArPSc9%MGZa)%7@+pXt1rgn@E5=Ob(l5#c)K=*Ysh#g@SM4ygvnE;!dd5j
z3f6uUe3E3%M<1A(&&g&sH3v>OWe&`oHQVOL;G{Wo&xK3pU2ENq7hZh1{i^i*hwp>>
z`dSz`c(7Gw?QQKwL9Mqg#2at=x((aM2t)kRG48=cc+WoXA{!ODWby0Pg@}0I;o3MO
z+p%MdQEGEx+RRVDiAK5M2V604?f(6VzLBy^8$+6m$+<d1+gQjOl}sh4c|~Es>*l+m
z$rVsMtB`N>bR|t8NcdeyYlBG3$LpcJD3mf{x4cXwc)1{OS$T9V2UPGbjw78_NU%|o
zhm!I#y#09Har*FI8YrZ=db2b+&b&?+??`u>Op-Q4XRUtAcZEU}Nr=B_RoWw<grcSy
zmuxF&N9Pkvc{-;t>!rdiVb+ASXgqL_6bjC<#tleJ6fnYFSkj2$iSwSugAz7r$Y_QI
z8CZ$g1L$4>jkjHG$Ry#Fd&0D_&)>;5BtL0wyLdb;aXQPfDESrz{EKfEzj^iJU*2m!
zx$?`OeAg(d7htGaA3{N2UvnT9p^7l0TMq*ucJJH@?=N2h^RD><+;Qixq0_hyF?#TC
ze|gZhd;h(6!R>ea4F2QxAKGu2VMzL-Hy2pNg`x5oJb?ifsN685{*lLDh~UA)sUN)W
z*QU(d_S{iaSonvZftml%eKrre1M!6Z|8?ts**{9y&MjZM+QM=B9lwA-J@KMdY71U^
z*0>=T*pPTRt|g7MB;~cG^|6zNBuep4a5cg^NE4p%!J$Xq1dNYL!Aq=Z$-FK`)CQ~T
zy~e1-9K0<JPcB3>22I-wC+l_zY>p%D*vH5rTW2QT2CtVZRu|q}$jJ6xh6#V(+0kzI
zounxmDIhi1iAw=-WluDu!AiX4S}(MpG|3cC(#VqHg82FxR{$I?F2sU*19u_LyyPcJ
zT>Z&u%;_O5N-5kZ<X?u+%W+47k=6k?ziLK=q#dV)ui!$kaASq@ze@;nd?e4vYpLX@
zZrK;MADK&3y4p2^Su-GG#!W9gr1h&NZzNu_EH9@ibAIoV2U?qQjJtS{Z;#<e&1tmZ
ziH|wiHoe0&FQTEAkM3RThnyxZ`01V2KN8PeCX;arX^rR_!*k}<EUe&!4C~BM0Cb1R
z@_ZaF{*EgS{+ushYlD%urwJ7a53iHI=P<c^^pw*4;F{9GO_CZM91k9lB5~mECGIlO
z1dav|f2O&E=s77JO|Ws?q-%{5?<*|BzYjzMg$wlvW(dwHjBxaV8JOhX2-Z*u6@+4w
z^pgF?>E#jzlurtdKo!ROkkf(c<^q`0lFzm{Ub3$xjVa1jo6TwbLlL=B=u+Qu{OMOJ
zP$@I`HSu5?Z8`h|pX3?It8zT>=e$oeIJI%g^V2)&b&;?WUK)R=DJo3~YHj4%8mk-!
zJn=E4(MfBA45l<1qSE396upzU@#O`V*G9t2-*Fz-;O6b;<baX|Ibc)~?{L{^n$QUD
zZ3{rh08t*x6gcZ*`i_69UK^+`p|5pjZ@zvl>P;gWZ(F(=B1Mylf0#`&vr9op!D;jO
zY!G7+hL&bIO1$u%EOZVBrwhTDri{tp;DbRjC%2F_{^7Vvca(%#!$m4xzFvj3Wq5f-
zpyO4Z@d3`te9$dz!U2OaNI6PDCvoDqX@W`<3jCh)R0Ol&bKM|J&R(T*k??R~D`Aju
zy6}~J&S7u~<EZZx<3N)yzVADEQ__pq?-J;wcr+X}+$BHocM@ivSI)X+IbNqGUo@kJ
z%N;2XC47<xxsucPg)2i&FAl%t6^Uy!7KOJ<ezQ%s&D*1TH2h_I)+hs!T#O?vCOIfL
zaX~q7jEKZ%Xu%sliqvwYzE}|wQBP53F3W-wN<ND)5Cc%wtI<zB(-L=8#u$`;#>9(T
z(j+{zSq{;Q?lm_Ghea|ihlA=!qZz@#XLVXT96r~3{*2EUv_VQI!_y~D{Gb85#zmWi
zUBVkY_slVB3jzg)Yg{(6u%PeVOQW0S&CuxQF~f($kmlai_)LR?=jZSFbKZYkc=!(G
zA;aJ$k7#g77$m%yxRtIcYF@vqFSHqnlncF$bKVECk2IR_x}{;3HU>1|FYD#wT<cfa
zJ|FWEc3C&iugO-eALQ&ClWVO%jXyP7a2)tGSBw;#lhXtaW#-dJxelZ?R4h-(1_2uJ
z6X9vv7f!tk%!;6+g?xy)O*CZFl!GLQiz#>>`HY@RrqtSS2^B5B#%$X0MnOJ5q8%xB
zsZgXMmGx`*yJ(pZaNyb5F!hTzcrfw4(u9R;fN8MMGfqD_r~+PLWm!2tR9*r6VSdkx
z*+qP&DBF&;!IhAg-0LOt^J{5&YyBhpPs7ti8!f*JhvYgQBm|mkY^33)&9Wt~T)1%|
zsO6LEGA@3T3W6JIF1~ju6=`(#rJkg`bITYP4{(El=ao38(N`u-#_(|@*V(jowfCIP
z8oe~*O7e!QA308G@>M?1NzKR`aans>qmpnzJ(8etqynWT30=&`JDJM47|kX4w2qb?
z%Inscg2O@nZs{)6=%-mSygm&Ny0?qvg`5$>h3I3F{J>o)99_(=z2|LW(yXZ9x)97>
z3i|9sTer{zubV$~3sT~s4pM$i?PN01r%r$r7`7pJCa~JD?PA|^xQg|LMi%j7a8My=
z-T{J>yU!&2T3@&Xl6>y!XKfr}qCO>Mpt<y@9<IcBUD6$=2|Ny~grCNkCd6c&Y5XYr
z|6dh|u6j5g8lTBA=7N>ei;syk1;7=7Oa5{h<-(EEL&HnfDPiF-X|$1eyX2aLk<&uL
zrtvh#Q?|=ti`J)QCQb;KAd$$)27_Oo&j$dF@Lu9%LK`0M>9Z6U6Bp}C!lemT61q|d
zX!Y`YZNO>mOW`Bo(%_VB;KvWGU*3|=hqTX|XmDuoX!+ImVRM)#_{NZX(OGNX)t*ZL
zx$4n={op1DeTTqh=!N&OQ#3sHj3gK+aV4+iL*=IV_g%tQ;;7L<*1`W|k~EcTeQ9IC
z<wem1j&{w<$ah-Xt~z9(Lz=*K^_7O7Ml;vF#8)nPX!Ud0WqVxFxnzuMy_47HlBY6B
z+1eMra^1UNk?m<oDmbkz4IWqBM1#J<!|9%p4`k(BJN_#|({os*iE=(;U@_Bjwdd-*
zz78&8tiB{k+<#@z_V!*I5WG!1xH3>+1#nq!X#<$Qa|tu84ACd}@@q1hN|urM$a|M?
z((vxJehxpxX_!!gqHd4<^1(ntMjJ$#jG|n89X<`m-uT#+G$GCVsJFT}ZCwh%B|v3a
z2@B8X_hL=cGYO+cYw0%A>Xq>ODF$R3?h*#cmoA>taMI+O##0hjmn@O_sGYu~v@xmS
z=xUp;xr~ttRJN(LC1sS>hrRK(#K*32rFAR^fEY^>n}_T6HDU2!#zTVC4=iNma}h2#
zgJe|6NZJ&e6G;X(Xan6vOpOtE;(-*DcwVy5Xzz?Vz`S7Ag<s*#mE<7fXQO}wOF%k(
zUzxRrErRb8tbRmm3zK~jHbT{fb>U4<-psO$!b+az5yyd^ah{O*rAswv&x_SVeW3+2
zP}!K<8U+Kjg|uYPwKgQoG&9p&8PPTVWaE3eA{P+;E4Y=u#6?Sz-+CLcX~vTjF0$S<
zVaDBZ+8Tq*C)YDIS&^2c0F*GvdO1Bcg{Z;6^KtmO`$}t<+Tn1zT!kDi83&-z6O#;n
zarL=|4}Y#Hbxtd4i;rIypULNa;X{tU){lfE?`zo~R97NmSP53*?b5XxRmdyl$V<&i
zoy7?j&zl@fB(P&&K6VUpt-~||aKxno<1ld|(jb)kpk&*8z{>Y7fsr<tG=ZEZbWlWh
z<KdazN!n<BVcsUsr)@}-_ld~5J_uB;J?)yq&CAHV&UUFkh`xTXhD9gA0~Zh^I51E6
z%tjwVlJ0$hlfv(<zzJ;zjo!T9i>Af@Uy{5cg{~9`GQX?uq~PKCCGOgol)_l%O<Vtv
z<Apz$yzFX2lSLdi{>$IVZ=^~3@bNC;cHyCwm2LWpY?Snru=0APqNRFbyvF#M=XcSQ
z>fnmQm0Yq@zSr8*`a{w{GbAJpG=9ox0MfM<g~Riw4fvp*0tD+LR6Yq@@OgA!9pxNo
zO(AJXgHa<!S~)owdB`{aE#jH%Jf6r}<Q>ZM@b|@v!avpqFXN{uD-9p559yv;vvNRa
z!a@#SsR*=oxL}jdydq;nd7?1)Fi)1vtmqf0f5JY=ib3cJ9Mc4dmh3thDJi@x2)v=F
zBqjX{4!Y4VZ4K$m;=6pV<>h_B`;=0ez?D4UqK}Ke;xtPa#4bTju*t|bjbEi)=uI{d
zf66vF%$z=QJf`uBOU7uaw=u?Li=<O;JS*2?HII@DM%lK6ISn6KkHksiMOg>m-0k8)
zdL9L~aKI%1GMYmwG|p(e0T=TWXIX4OMF*KCX9L{jmd1E4STzE0OG9qX<;sP_t>LB#
z0$w-WlW>xGT{zhNTNy9<?0Ha8NT)*5Sdj4Ye&Pc~(m)du8l5x&!UqR`mbM@*lccpD
z)`tQ=&t0rg+^c2FvFDlatUrqnKva(EpmO;XLnFf!p=vmIQ1q&Ltc>SHu<^S24BqBt
zgSI#8mg*q-q`jAk)6*qzdlQCzsoRxYd8i%j<O!Ld@<=a_HU>G3WnLEyGD(@o1-N{#
z(blD4Tw_k+F8f-_Q(hNugTq0xQ5p;`*tt^X%R4T(B|T+dO1jW5KblO+2}whlc>hX#
bsqOy<DDYnt%G8%L00000NkvXXu0mjfx9|_J

literal 0
HcmV?d00001

diff --git a/client/ui/frontend/src/assets/logos/netbird-full.svg b/client/ui/frontend/src/assets/logos/netbird-full.svg
new file mode 100644
index 000000000..f925d5761
--- /dev/null
+++ b/client/ui/frontend/src/assets/logos/netbird-full.svg
@@ -0,0 +1,19 @@
+<svg width="133" height="23" viewBox="0 0 133 23" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_0_3)">
+<path d="M46.9438 7.5013C48.1229 8.64688 48.7082 10.3025 48.7082 12.4683V21.6663H46.1411V12.8362C46.1411 11.2809 45.7481 10.0851 44.9704 9.26566C44.1928 8.43783 43.1308 8.0281 41.7846 8.0281C40.4383 8.0281 39.3345 8.45455 38.5234 9.30747C37.7123 10.1604 37.3109 11.4063 37.3109 13.0369V21.6663H34.7188V6.06305H37.3109V8.28732C37.821 7.49294 38.5234 6.87416 39.4014 6.43934C40.2878 6.00452 41.2578 5.78711 42.3197 5.78711C44.2179 5.78711 45.7565 6.36408 46.9355 7.50966L46.9438 7.5013Z" fill="#F2F2F2"/>
+<path d="M67.1048 14.8344H54.6288C54.7208 16.373 55.2476 17.5771 56.2092 18.4384C57.1708 19.2997 58.3331 19.7345 59.6961 19.7345C60.8166 19.7345 61.7531 19.4753 62.4973 18.9485C63.2499 18.4301 63.7767 17.7277 64.0777 16.858H66.8706C66.4525 18.3548 65.6163 19.5756 64.3621 20.5205C63.1078 21.4571 61.5525 21.9337 59.6878 21.9337C58.2077 21.9337 56.8865 21.5992 55.7159 20.9386C54.5452 20.278 53.6337 19.3331 52.9648 18.1039C52.2958 16.8831 51.9697 15.4616 51.9697 13.8477C51.9697 12.2339 52.2958 10.8207 52.9397 9.60825C53.5836 8.39578 54.495 7.45924 55.6573 6.80702C56.828 6.15479 58.1659 5.82031 59.6878 5.82031C61.2096 5.82031 62.4806 6.14643 63.6178 6.79029C64.7551 7.43416 65.6331 8.32052 66.2518 9.44938C66.8706 10.5782 67.18 11.8576 67.18 13.2791C67.18 13.7725 67.1549 14.2909 67.0964 14.8428L67.1048 14.8344ZM63.8603 10.1769C63.4255 9.4661 62.8318 8.92258 62.0793 8.55465C61.3267 8.18673 60.4989 8.00277 59.5874 8.00277C58.2746 8.00277 57.1625 8.42086 56.2427 9.25705C55.3228 10.0932 54.796 11.2472 54.6623 12.7356H64.5126C64.5126 11.7489 64.2952 10.896 63.8603 10.1852V10.1769Z" fill="#F2F2F2"/>
+<path d="M73.7695 8.20355V17.4016C73.7695 18.1626 73.9284 18.6977 74.2545 19.0071C74.5806 19.3165 75.1409 19.4754 75.9352 19.4754H77.8418V21.6662H75.5088C74.0622 21.6662 72.9835 21.3317 72.2644 20.6711C71.5452 20.0105 71.1857 18.9151 71.1857 17.3933V8.19519H69.1621V6.0629H71.1857V2.13281H73.7779V6.0629H77.8501V8.19519H73.7779L73.7695 8.20355Z" fill="#F2F2F2"/>
+<path d="M85.9022 6.68902C86.9307 6.10369 88.093 5.80266 89.4058 5.80266C90.8106 5.80266 92.0732 6.13714 93.1937 6.79773C94.3142 7.46668 95.2006 8.39485 95.8444 9.59896C96.4883 10.8031 96.8144 12.2079 96.8144 13.7966C96.8144 15.3854 96.4883 16.7818 95.8444 18.011C95.2006 19.2486 94.3142 20.2018 93.1854 20.8875C92.0565 21.5732 90.7939 21.916 89.4141 21.916C88.0344 21.916 86.8805 21.6234 85.8687 21.0297C84.8569 20.4443 84.0876 19.6918 83.5775 18.7803V21.6568H80.9854V0.601562H83.5775V8.97182C84.1127 8.04365 84.8904 7.28272 85.9105 6.69738L85.9022 6.68902ZM93.4529 10.7362C92.9763 9.86654 92.3408 9.19759 91.5297 8.74605C90.7186 8.29451 89.8322 8.06037 88.8706 8.06037C87.909 8.06037 87.0394 8.29451 86.2366 8.75441C85.4255 9.22268 84.7817 9.89163 84.2967 10.778C83.8117 11.6643 83.5692 12.6845 83.5692 13.8384C83.5692 14.9924 83.8117 16.046 84.2967 16.9323C84.7817 17.8187 85.4255 18.4877 86.2366 18.9559C87.0394 19.4242 87.9174 19.65 88.8706 19.65C89.8239 19.65 90.727 19.4158 91.5297 18.9559C92.3324 18.4877 92.9763 17.8187 93.4529 16.9323C93.9296 16.046 94.1637 15.0091 94.1637 13.8134C94.1637 12.6176 93.9296 11.6142 93.4529 10.7362Z" fill="#F2F2F2"/>
+<path d="M100.318 3.01864C99.9749 2.67581 99.8076 2.25771 99.8076 1.76436C99.8076 1.27101 99.9749 0.852913 100.318 0.510076C100.661 0.167238 101.079 0 101.572 0C102.065 0 102.45 0.167238 102.784 0.510076C103.119 0.852913 103.286 1.27101 103.286 1.76436C103.286 2.25771 103.119 2.67581 102.784 3.01864C102.45 3.36148 102.049 3.52872 101.572 3.52872C101.095 3.52872 100.661 3.36148 100.318 3.01864ZM102.826 6.06237V21.6657H100.234V6.06237H102.826Z" fill="#F2F2F2"/>
+<path d="M111.773 6.52155C112.617 6.0282 113.646 5.77734 114.867 5.77734V8.45315H114.181C111.28 8.45315 109.825 10.0252 109.825 13.1776V21.6649H107.232V6.06165H109.825V8.5953C110.276 7.70058 110.928 7.00654 111.773 6.51319V6.52155Z" fill="#F2F2F2"/>
+<path d="M117.861 9.60732C118.505 8.40321 119.391 7.46668 120.52 6.80609C121.649 6.1455 122.92 5.81102 124.325 5.81102C125.537 5.81102 126.666 6.09533 127.711 6.64721C128.757 7.20746 129.551 7.94331 130.103 8.85475V0.601562H132.72V21.6735H130.103V18.7385C129.593 19.6667 128.832 20.436 127.828 21.0297C126.825 21.6317 125.646 21.9244 124.3 21.9244C122.953 21.9244 121.657 21.5816 120.528 20.8959C119.4 20.2102 118.513 19.257 117.869 18.0194C117.226 16.7818 116.899 15.377 116.899 13.805C116.899 12.233 117.226 10.8114 117.869 9.60732H117.861ZM129.392 10.7613C128.915 9.89163 128.28 9.22268 127.469 8.75441C126.658 8.28614 125.771 8.06037 124.81 8.06037C123.848 8.06037 122.962 8.28614 122.159 8.74605C121.356 9.20595 120.729 9.86654 120.253 10.7362C119.776 11.6058 119.542 12.6343 119.542 13.8134C119.542 14.9924 119.776 16.046 120.253 16.9323C120.729 17.8187 121.365 18.4877 122.159 18.9559C122.953 19.4242 123.84 19.65 124.81 19.65C125.78 19.65 126.666 19.4158 127.469 18.9559C128.272 18.4877 128.915 17.8187 129.392 16.9323C129.869 16.046 130.103 15.0175 130.103 13.8384C130.103 12.6594 129.869 11.6393 129.392 10.7613Z" fill="#F2F2F2"/>
+<path d="M21.4651 0.568359C17.8193 0.902835 16.0047 3.00167 15.3191 4.06363L4.66602 22.5183H17.5182L30.1949 0.568359H21.4651Z" fill="#F68330"/>
+<path d="M17.5265 22.5187L0 3.9302C0 3.9302 19.8177 -1.39633 21.7493 15.2188L17.5265 22.5187Z" fill="#F68330"/>
+<path d="M14.9255 4.75055L9.54883 14.0657L17.5177 22.5196L21.7405 15.2029C21.0715 9.49174 18.287 6.37276 14.9255 4.74219" fill="#F35E32"/>
+</g>
+<defs>
+<clipPath id="clip0_0_3">
+<rect width="132.72" height="22.5186" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/client/ui/frontend/src/assets/logos/netbird.svg b/client/ui/frontend/src/assets/logos/netbird.svg
new file mode 100644
index 000000000..6254931c6
--- /dev/null
+++ b/client/ui/frontend/src/assets/logos/netbird.svg
@@ -0,0 +1,5 @@
+<svg width="31" height="23" viewBox="0 0 31 23" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M21.4631 0.523438C17.8173 0.857913 16.0028 2.95675 15.3171 4.01871L4.66406 22.4734H17.5163L30.1929 0.523438H21.4631Z" fill="#F68330"/>
+<path d="M17.5265 22.4737L0 3.88525C0 3.88525 19.8177 -1.44128 21.7493 15.1738L17.5265 22.4737Z" fill="#F68330"/>
+<path d="M14.9236 4.70563L9.54688 14.0208L17.5158 22.4747L21.7385 15.158C21.0696 9.44682 18.2851 6.32784 14.9236 4.69727" fill="#F05252"/>
+</svg>
diff --git a/client/ui/frontend/src/components/Badge.tsx b/client/ui/frontend/src/components/Badge.tsx
new file mode 100644
index 000000000..c5e2b5f22
--- /dev/null
+++ b/client/ui/frontend/src/components/Badge.tsx
@@ -0,0 +1,43 @@
+import { forwardRef, type ComponentType, type HTMLAttributes } from "react";
+import type { LucideProps } from "lucide-react";
+import { cn } from "@/lib/cn";
+
+export type BadgeVariant = "info" | "neutral" | "brand" | "success" | "warning" | "danger";
+
+type Props = HTMLAttributes<HTMLSpanElement> & {
+    variant?: BadgeVariant;
+    icon?: ComponentType<LucideProps>;
+    iconSize?: number;
+};
+
+const VARIANT_CLASSES: Record<BadgeVariant, string> = {
+    info: "bg-sky-900 border border-sky-700 text-sky-200",
+    neutral: "bg-nb-gray-900 border border-nb-gray-850 text-nb-gray-200",
+    brand: "bg-netbird/15 border border-netbird/30 text-netbird",
+    success: "bg-green-900 border border-green-700 text-green-200",
+    warning: "bg-yellow-900 border border-yellow-700 text-yellow-200",
+    danger: "bg-red-900 border border-red-700 text-red-200",
+};
+
+export const Badge = forwardRef<HTMLSpanElement, Props>(function Badge(
+    { variant = "info", icon: Icon, iconSize = 10, className, children, ...rest },
+    ref,
+) {
+    return (
+        <span
+            ref={ref}
+            className={cn(
+                "relative top-px inline-flex items-center gap-1 rounded-full px-1.5 py-[0.15rem]",
+                "shrink-0 text-[0.64rem] font-semibold leading-none",
+                VARIANT_CLASSES[variant],
+                className,
+            )}
+            {...rest}
+        >
+            {Icon && <Icon size={iconSize} aria-hidden={"true"} />}
+            {children}
+        </span>
+    );
+});
+
+export default Badge;
diff --git a/client/ui/frontend/src/components/CopyToClipboard.tsx b/client/ui/frontend/src/components/CopyToClipboard.tsx
new file mode 100644
index 000000000..1b2a87da4
--- /dev/null
+++ b/client/ui/frontend/src/components/CopyToClipboard.tsx
@@ -0,0 +1,126 @@
+import { useEffect, useRef, useState, type KeyboardEvent, type ReactNode } from "react";
+import { useTranslation } from "react-i18next";
+import { Check, Copy } from "lucide-react";
+import { cn } from "@/lib/cn";
+
+const VARIANT_HOVER = {
+    default: "group-hover/copy:[&_*]:text-nb-gray-300",
+    bright: "group-hover/copy:[&_*]:text-nb-gray-200",
+} as const;
+
+type CopyToClipboardVariant = keyof typeof VARIANT_HOVER;
+
+type CopyToClipboardProps = {
+    children: ReactNode;
+    message?: string;
+    size?: number;
+    iconAlignment?: "left" | "right";
+    className?: string;
+    iconClassName?: string;
+    alwaysShowIcon?: boolean;
+    variant?: CopyToClipboardVariant;
+    "aria-label"?: string;
+    tabIndex?: number;
+    onKeyDown?: (e: KeyboardEvent<HTMLButtonElement>) => void;
+};
+
+export const CopyToClipboard = ({
+    children,
+    message,
+    size = 10,
+    iconAlignment = "right",
+    className,
+    iconClassName,
+    alwaysShowIcon = false,
+    variant = "default",
+    "aria-label": ariaLabel,
+    tabIndex = 0,
+    onKeyDown,
+}: CopyToClipboardProps) => {
+    const { t } = useTranslation();
+    const wrapperRef = useRef<HTMLButtonElement>(null);
+    const [copied, setCopied] = useState(false);
+    const copyTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
+    useEffect(
+        () => () => {
+            if (copyTimer.current) clearTimeout(copyTimer.current);
+        },
+        [],
+    );
+
+    const handleClick = async (e: React.MouseEvent) => {
+        e.stopPropagation();
+        e.preventDefault();
+        const text = message ?? wrapperRef.current?.innerText ?? "";
+        if (!text) return;
+        try {
+            await navigator.clipboard.writeText(text);
+            setCopied(true);
+            if (copyTimer.current) clearTimeout(copyTimer.current);
+            copyTimer.current = setTimeout(() => setCopied(false), 500);
+        } catch (e) {
+            console.warn("copy to clipboard failed", e);
+        }
+    };
+
+    const resolvedLabel =
+        ariaLabel ?? (message ? `${t("common.copy")} ${message}` : t("common.copy"));
+
+    return (
+        <button
+            type={"button"}
+            ref={wrapperRef}
+            onClick={handleClick}
+            onKeyDown={onKeyDown}
+            tabIndex={tabIndex}
+            aria-label={resolvedLabel}
+            aria-live={"polite"}
+            className={cn(
+                "group/copy wails-no-draggable pointer-events-auto inline-flex cursor-default items-center gap-2 rounded-sm text-left outline-none",
+                "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                className,
+            )}
+        >
+            <span
+                className={cn(
+                    "relative min-w-0 truncate",
+                    "[&_*]:transition-colors",
+                    VARIANT_HOVER[variant],
+                )}
+            >
+                {children}
+                <span
+                    aria-hidden={"true"}
+                    className={
+                        "pointer-events-none absolute bottom-0 left-0 right-0 border-b border-dashed border-transparent group-hover/copy:border-nb-gray-500"
+                    }
+                />
+            </span>
+            <span
+                aria-hidden={"true"}
+                className={cn(
+                    "relative right-[1px] top-[2px] inline-flex shrink-0",
+                    iconAlignment === "left" ? "order-first" : "order-last",
+                    iconClassName,
+                )}
+            >
+                <Check
+                    size={size}
+                    className={cn(
+                        "text-nb-gray-100",
+                        !copied && "hidden",
+                        !alwaysShowIcon && !copied && "opacity-0",
+                    )}
+                />
+                <Copy
+                    size={size}
+                    className={cn(
+                        "text-nb-gray-100 group-hover/copy:opacity-100",
+                        copied && "hidden",
+                        !alwaysShowIcon && "opacity-0",
+                    )}
+                />
+            </span>
+        </button>
+    );
+};
diff --git a/client/ui/frontend/src/components/DropdownMenu.tsx b/client/ui/frontend/src/components/DropdownMenu.tsx
new file mode 100644
index 000000000..d43c37e1b
--- /dev/null
+++ b/client/ui/frontend/src/components/DropdownMenu.tsx
@@ -0,0 +1,233 @@
+import * as DropdownMenuPrimitive from "@radix-ui/react-dropdown-menu";
+import { cva } from "class-variance-authority";
+import { Check, ChevronRight, Circle } from "lucide-react";
+import * as React from "react";
+import { cn } from "@/lib/cn";
+
+const DropdownMenu = DropdownMenuPrimitive.Root;
+const DropdownMenuTrigger = DropdownMenuPrimitive.Trigger;
+const DropdownMenuGroup = DropdownMenuPrimitive.Group;
+const DropdownMenuPortal = DropdownMenuPrimitive.Portal;
+const DropdownMenuSub = DropdownMenuPrimitive.Sub;
+const DropdownMenuRadioGroup = DropdownMenuPrimitive.RadioGroup;
+
+const menuItemVariants = cva("", {
+    variants: {
+        variant: {
+            default:
+                "text-nb-gray-200 hover:bg-nb-gray-900 hover:text-nb-gray-50 focus-visible:bg-nb-gray-900 focus-visible:text-nb-gray-50 data-[state=open]:bg-nb-gray-900 data-[state=open]:text-nb-gray-50",
+            danger: "text-red-500 hover:bg-red-900/20 hover:text-red-500 focus-visible:bg-red-900/20 focus-visible:text-red-500",
+        },
+    },
+    defaultVariants: { variant: "default" },
+});
+
+const DropdownMenuSubTrigger = React.forwardRef<
+    React.ElementRef<typeof DropdownMenuPrimitive.SubTrigger>,
+    React.ComponentPropsWithoutRef<typeof DropdownMenuPrimitive.SubTrigger> & {
+        inset?: boolean;
+        variant?: "default" | "danger";
+    }
+>(({ className, inset, children, variant, ...props }, ref) => (
+    <DropdownMenuPrimitive.SubTrigger
+        ref={ref}
+        className={cn(
+            "relative flex cursor-default select-none items-center rounded-md py-1.5 pl-3 pr-2 text-sm outline-none",
+            "transition-colors data-[disabled]:pointer-events-none data-[disabled]:opacity-50",
+            inset && "pl-8",
+            menuItemVariants({ variant }),
+            className,
+        )}
+        {...props}
+    >
+        {children}
+        <ChevronRight className={"ml-auto h-4 w-4"} aria-hidden={"true"} />
+    </DropdownMenuPrimitive.SubTrigger>
+));
+DropdownMenuSubTrigger.displayName = DropdownMenuPrimitive.SubTrigger.displayName;
+
+const DropdownMenuSubContent = React.forwardRef<
+    React.ElementRef<typeof DropdownMenuPrimitive.SubContent>,
+    React.ComponentPropsWithoutRef<typeof DropdownMenuPrimitive.SubContent>
+>(({ className, ...props }, ref) => (
+    <DropdownMenuPrimitive.SubContent
+        ref={ref}
+        className={cn(
+            "z-50 min-w-[8rem] overflow-hidden rounded-md border border-nb-gray-900 bg-nb-gray-930 p-1 text-nb-gray-200 shadow-lg",
+            "data-[state=open]:animate-in data-[state=closed]:animate-out",
+            "data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0",
+            "data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95",
+            "data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2",
+            "data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2",
+            className,
+        )}
+        {...props}
+    />
+));
+DropdownMenuSubContent.displayName = DropdownMenuPrimitive.SubContent.displayName;
+
+const DropdownMenuContent = React.forwardRef<
+    React.ElementRef<typeof DropdownMenuPrimitive.Content>,
+    React.ComponentPropsWithoutRef<typeof DropdownMenuPrimitive.Content>
+>(({ className, sideOffset = 4, ...props }, ref) => (
+    <DropdownMenuPrimitive.Portal>
+        <DropdownMenuPrimitive.Content
+            ref={ref}
+            sideOffset={sideOffset}
+            className={cn(
+                "z-50 min-w-[8rem] overflow-hidden rounded-lg border border-nb-gray-900 bg-nb-gray-935 p-1 text-nb-gray-200 shadow-lg",
+                "data-[state=open]:animate-in data-[state=closed]:animate-out",
+                "data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0",
+                "data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95",
+                "data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2",
+                "data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2",
+                className,
+            )}
+            {...props}
+        />
+    </DropdownMenuPrimitive.Portal>
+));
+DropdownMenuContent.displayName = DropdownMenuPrimitive.Content.displayName;
+
+const DropdownMenuItem = React.forwardRef<
+    React.ElementRef<typeof DropdownMenuPrimitive.Item>,
+    React.ComponentPropsWithoutRef<typeof DropdownMenuPrimitive.Item> & {
+        inset?: boolean;
+        variant?: "default" | "danger";
+        href?: string;
+        target?: string;
+        rel?: string;
+    }
+>(({ className, inset, variant, onClick, href, target, rel, children, ...props }, ref) => (
+    <DropdownMenuPrimitive.Item
+        ref={ref}
+        className={cn(
+            "relative flex cursor-default select-none items-center rounded-md py-1.5 pl-2 pr-2 text-sm outline-none",
+            "transition-colors data-[disabled]:pointer-events-none data-[disabled]:opacity-50",
+            inset && "pl-8",
+            menuItemVariants({ variant }),
+            className,
+        )}
+        onClick={(e) => {
+            if (href) return;
+            e.preventDefault();
+            e.stopPropagation();
+            onClick?.(e);
+        }}
+        {...props}
+    >
+        {href ? (
+            <a href={href} target={target} rel={rel} className={"flex w-full items-center gap-3"}>
+                {children}
+            </a>
+        ) : (
+            children
+        )}
+    </DropdownMenuPrimitive.Item>
+));
+DropdownMenuItem.displayName = DropdownMenuPrimitive.Item.displayName;
+
+const DropdownMenuCheckboxItem = React.forwardRef<
+    React.ElementRef<typeof DropdownMenuPrimitive.CheckboxItem>,
+    React.ComponentPropsWithoutRef<typeof DropdownMenuPrimitive.CheckboxItem>
+>(({ className, children, checked, ...props }, ref) => (
+    <DropdownMenuPrimitive.CheckboxItem
+        ref={ref}
+        className={cn(
+            "relative flex cursor-default select-none items-center rounded-sm py-1.5 pl-8 pr-2 text-sm outline-none",
+            "text-nb-gray-200 transition-colors hover:bg-nb-gray-900 hover:text-nb-gray-50 focus-visible:bg-nb-gray-900 focus-visible:text-nb-gray-50",
+            "data-[disabled]:pointer-events-none data-[disabled]:opacity-50",
+            className,
+        )}
+        checked={checked}
+        {...props}
+    >
+        <span className={"absolute left-2 flex h-3.5 w-3.5 items-center justify-center"}>
+            <DropdownMenuPrimitive.ItemIndicator>
+                <Check className={"h-4 w-4"} />
+            </DropdownMenuPrimitive.ItemIndicator>
+        </span>
+        {children}
+    </DropdownMenuPrimitive.CheckboxItem>
+));
+DropdownMenuCheckboxItem.displayName = DropdownMenuPrimitive.CheckboxItem.displayName;
+
+const DropdownMenuRadioItem = React.forwardRef<
+    React.ElementRef<typeof DropdownMenuPrimitive.RadioItem>,
+    React.ComponentPropsWithoutRef<typeof DropdownMenuPrimitive.RadioItem>
+>(({ className, children, ...props }, ref) => (
+    <DropdownMenuPrimitive.RadioItem
+        ref={ref}
+        className={cn(
+            "relative flex cursor-default select-none items-center rounded-sm py-1.5 pl-8 pr-2 text-sm outline-none",
+            "text-nb-gray-200 transition-colors hover:bg-nb-gray-900 hover:text-nb-gray-50 focus-visible:bg-nb-gray-900 focus-visible:text-nb-gray-50",
+            "data-[disabled]:pointer-events-none data-[disabled]:opacity-50",
+            className,
+        )}
+        {...props}
+    >
+        <span className={"absolute left-2 flex h-3.5 w-3.5 items-center justify-center"}>
+            <DropdownMenuPrimitive.ItemIndicator>
+                <Circle className={"h-2 w-2 fill-current"} />
+            </DropdownMenuPrimitive.ItemIndicator>
+        </span>
+        {children}
+    </DropdownMenuPrimitive.RadioItem>
+));
+DropdownMenuRadioItem.displayName = DropdownMenuPrimitive.RadioItem.displayName;
+
+const DropdownMenuLabel = React.forwardRef<
+    React.ElementRef<typeof DropdownMenuPrimitive.Label>,
+    React.ComponentPropsWithoutRef<typeof DropdownMenuPrimitive.Label> & {
+        inset?: boolean;
+    }
+>(({ className, inset, ...props }, ref) => (
+    <DropdownMenuPrimitive.Label
+        ref={ref}
+        className={cn(
+            "px-2 py-1.5 text-sm font-semibold text-nb-gray-200",
+            inset && "pl-8",
+            className,
+        )}
+        {...props}
+    />
+));
+DropdownMenuLabel.displayName = DropdownMenuPrimitive.Label.displayName;
+
+const DropdownMenuSeparator = React.forwardRef<
+    React.ElementRef<typeof DropdownMenuPrimitive.Separator>,
+    React.ComponentPropsWithoutRef<typeof DropdownMenuPrimitive.Separator>
+>(({ className, ...props }, ref) => (
+    <DropdownMenuPrimitive.Separator
+        ref={ref}
+        className={cn("-mx-1 my-1 h-px bg-nb-gray-910", className)}
+        {...props}
+    />
+));
+DropdownMenuSeparator.displayName = DropdownMenuPrimitive.Separator.displayName;
+
+const DropdownMenuShortcut = ({ className, ...props }: React.HTMLAttributes<HTMLSpanElement>) => (
+    <span
+        className={cn("ml-auto text-xs tracking-widest text-nb-gray-100 opacity-60", className)}
+        {...props}
+    />
+);
+DropdownMenuShortcut.displayName = "DropdownMenuShortcut";
+
+export {
+    DropdownMenu,
+    DropdownMenuCheckboxItem,
+    DropdownMenuContent,
+    DropdownMenuGroup,
+    DropdownMenuItem,
+    DropdownMenuLabel,
+    DropdownMenuPortal,
+    DropdownMenuRadioGroup,
+    DropdownMenuRadioItem,
+    DropdownMenuSeparator,
+    DropdownMenuShortcut,
+    DropdownMenuSub,
+    DropdownMenuSubContent,
+    DropdownMenuSubTrigger,
+    DropdownMenuTrigger,
+};
diff --git a/client/ui/frontend/src/components/LanguagePicker.tsx b/client/ui/frontend/src/components/LanguagePicker.tsx
new file mode 100644
index 000000000..7a30f8b33
--- /dev/null
+++ b/client/ui/frontend/src/components/LanguagePicker.tsx
@@ -0,0 +1,235 @@
+import { useEffect, useMemo, useState } from "react";
+import { useTranslation } from "react-i18next";
+import * as Popover from "@radix-ui/react-popover";
+import * as ScrollArea from "@radix-ui/react-scroll-area";
+import { Command } from "cmdk";
+import { CheckIcon, ChevronDown, LanguagesIcon, Search } from "lucide-react";
+import { Preferences } from "@bindings/services";
+import { type LanguageCode, type Language } from "@bindings/i18n/models.js";
+import { HelpText } from "@/components/typography/HelpText";
+import { Label } from "@/components/typography/Label";
+import { useFocusVisible } from "@/hooks/useFocusVisible";
+import { loadLanguages } from "@/lib/i18n";
+import { cn } from "@/lib/cn";
+import { errorDialog, formatErrorMessage } from "@/lib/errors";
+
+// No flag icons: flags represent countries, not languages. https://www.flagsarenotlanguages.com/blog/
+
+const labelFor = (lang: Language): string =>
+    lang.englishName && lang.englishName !== lang.displayName
+        ? `${lang.displayName} (${lang.englishName})`
+        : lang.displayName;
+
+export function LanguagePicker() {
+    const { t, i18n } = useTranslation();
+    const [languages, setLanguages] = useState<Language[]>([]);
+    const [open, setOpen] = useState(false);
+    const [busy, setBusy] = useState(false);
+    const isFocusVisible = useFocusVisible();
+
+    useEffect(() => {
+        let cancelled = false;
+        loadLanguages()
+            .then((list) => {
+                if (!cancelled) setLanguages(list);
+            })
+            .catch((err: unknown) => console.error("load languages failed", err));
+        return () => {
+            cancelled = true;
+        };
+    }, []);
+
+    const sorted = useMemo(
+        () => [...languages].sort((a, b) => a.displayName.localeCompare(b.displayName)),
+        [languages],
+    );
+
+    const current = useMemo(
+        () =>
+            languages.find((l) => l.code === i18n.language) ??
+            languages.find((l) => l.code === "en"),
+        [languages, i18n.language],
+    );
+
+    const handleTriggerKeyDown = (e: React.KeyboardEvent<HTMLButtonElement>) => {
+        if (open) return;
+        if (e.key === "ArrowDown" || e.key === "ArrowUp") {
+            e.preventDefault();
+            setOpen(true);
+        }
+    };
+
+    const select = async (code: string) => {
+        setOpen(false);
+        if (busy || code === i18n.language) return;
+        setBusy(true);
+        try {
+            await Preferences.SetLanguage(code as LanguageCode);
+        } catch (e) {
+            await errorDialog({
+                Title: t("settings.error.saveTitle"),
+                Message: formatErrorMessage(e),
+            });
+        } finally {
+            setBusy(false);
+        }
+    };
+
+    return (
+        <div className={"flex items-center justify-between gap-6"}>
+            <div className={"max-w-md flex-1"}>
+                <Label as={"div"}>{t("settings.general.language.label")}</Label>
+                <HelpText margin={false}>{t("settings.general.language.help")}</HelpText>
+            </div>
+            <div className={"shrink-0"}>
+                <Popover.Root open={open} onOpenChange={setOpen}>
+                    <Popover.Trigger asChild>
+                        <button
+                            type={"button"}
+                            tabIndex={0}
+                            disabled={busy || languages.length === 0}
+                            onKeyDown={handleTriggerKeyDown}
+                            aria-label={t("settings.general.language.label")}
+                            aria-haspopup={"listbox"}
+                            aria-expanded={open}
+                            className={cn(
+                                "inline-flex h-[40px] min-w-[240px] items-center gap-2 px-3",
+                                "rounded-md border bg-white dark:bg-nb-gray-900",
+                                "border-neutral-200 dark:border-nb-gray-700",
+                                "cursor-default text-xs font-semibold text-nb-gray-100 outline-none",
+                                "hover:border-nb-gray-600 data-[state=open]:border-nb-gray-600",
+                                isFocusVisible &&
+                                    "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                                "disabled:opacity-50",
+                            )}
+                        >
+                            <LanguagesIcon
+                                size={16}
+                                aria-hidden={"true"}
+                                className={"shrink-0 text-nb-gray-200"}
+                            />
+                            <span className={"flex-1 truncate text-left"}>
+                                {current ? labelFor(current) : "—"}
+                            </span>
+                            <ChevronDown
+                                size={12}
+                                aria-hidden={"true"}
+                                className={"shrink-0 text-nb-gray-400"}
+                            />
+                        </button>
+                    </Popover.Trigger>
+
+                    <Popover.Portal>
+                        <Popover.Content
+                            align={"start"}
+                            sideOffset={6}
+                            className={cn(
+                                "w-[var(--radix-popover-trigger-width)]",
+                                "z-50 rounded-lg border border-nb-gray-850 bg-nb-gray-920 p-1 shadow-lg",
+                                "data-[side=bottom]:origin-top data-[side=top]:origin-bottom",
+                                "data-[state=open]:animate-in",
+                                "data-[state=open]:fade-in-0",
+                                "data-[state=open]:zoom-in-95",
+                                "data-[side=bottom]:slide-in-from-top-1",
+                                "data-[side=top]:slide-in-from-bottom-1",
+                                "duration-150 ease-out",
+                            )}
+                        >
+                            <Command
+                                loop
+                                className={cn(
+                                    "flex flex-col",
+                                    "[&_[cmdk-input-wrapper]]:flex [&_[cmdk-input-wrapper]]:items-center",
+                                )}
+                            >
+                                <div className={"px-1 pb-1"}>
+                                    <div
+                                        role={"search"}
+                                        className={"group flex h-8 items-center gap-2 px-1"}
+                                    >
+                                        <Search
+                                            size={14}
+                                            aria-hidden={"true"}
+                                            className={"shrink-0 text-nb-gray-200"}
+                                        />
+                                        <Command.Input
+                                            autoFocus
+                                            placeholder={t("settings.general.language.search")}
+                                            aria-label={t("settings.general.language.search")}
+                                            className={cn(
+                                                "w-full bg-transparent text-xs text-nb-gray-100 placeholder:text-nb-gray-300",
+                                                "border-none outline-none",
+                                            )}
+                                        />
+                                    </div>
+                                </div>
+
+                                <ScrollArea.Root type={"auto"} className={"-mx-1 overflow-hidden"}>
+                                    <ScrollArea.Viewport className={"max-h-64 px-1"}>
+                                        <Command.List>
+                                            <Command.Empty>
+                                                <div
+                                                    className={
+                                                        "px-3 py-4 text-center text-[0.7rem] text-nb-gray-400"
+                                                    }
+                                                >
+                                                    {t("settings.general.language.empty")}
+                                                </div>
+                                            </Command.Empty>
+
+                                            {sorted.map((lang) => {
+                                                const checked = lang.code === i18n.language;
+                                                return (
+                                                    <Command.Item
+                                                        key={lang.code}
+                                                        value={`${lang.displayName} ${lang.englishName} ${lang.code}`}
+                                                        onSelect={() => void select(lang.code)}
+                                                        className={cn(
+                                                            "my-0.5 flex cursor-default items-center gap-2 rounded-md px-2 py-2 outline-none",
+                                                            "text-xs font-semibold text-nb-gray-200",
+                                                            "data-[selected=true]:bg-nb-gray-850 data-[selected=true]:text-nb-gray-50",
+                                                        )}
+                                                    >
+                                                        <span className={"min-w-0 flex-1 truncate"}>
+                                                            {labelFor(lang)}
+                                                        </span>
+                                                        <span
+                                                            aria-hidden={"true"}
+                                                            className={
+                                                                "flex w-4 shrink-0 items-center justify-center"
+                                                            }
+                                                        >
+                                                            {checked && (
+                                                                <CheckIcon
+                                                                    size={14}
+                                                                    className={"text-netbird"}
+                                                                />
+                                                            )}
+                                                        </span>
+                                                    </Command.Item>
+                                                );
+                                            })}
+                                        </Command.List>
+                                    </ScrollArea.Viewport>
+                                    <ScrollArea.Scrollbar
+                                        orientation={"vertical"}
+                                        className={cn(
+                                            "flex touch-none select-none transition-colors",
+                                            "w-1.5 bg-transparent py-1",
+                                        )}
+                                    >
+                                        <ScrollArea.Thumb
+                                            className={
+                                                "relative flex-1 rounded-full bg-nb-gray-800 hover:bg-nb-gray-700"
+                                            }
+                                        />
+                                    </ScrollArea.Scrollbar>
+                                </ScrollArea.Root>
+                            </Command>
+                        </Popover.Content>
+                    </Popover.Portal>
+                </Popover.Root>
+            </div>
+        </div>
+    );
+}
diff --git a/client/ui/frontend/src/components/ManagementServerSwitch.tsx b/client/ui/frontend/src/components/ManagementServerSwitch.tsx
new file mode 100644
index 000000000..0083a767a
--- /dev/null
+++ b/client/ui/frontend/src/components/ManagementServerSwitch.tsx
@@ -0,0 +1,38 @@
+import { useTranslation } from "react-i18next";
+import netbirdLogo from "@/assets/logos/netbird.svg";
+import { SwitchItem } from "@/components/switches/SwitchItem";
+import { SwitchItemGroup } from "@/components/switches/SwitchItemGroup";
+import { ManagementMode } from "@/hooks/useManagementUrl.ts";
+
+type Props = {
+    value: ManagementMode;
+    onChange: (mode: ManagementMode) => void;
+    fullWidth?: boolean;
+};
+
+export const ManagementServerSwitch = ({ value, onChange, fullWidth = false }: Props) => {
+    const { t, i18n } = useTranslation();
+    const itemClass = fullWidth ? "flex-1" : undefined;
+    return (
+        <SwitchItemGroup
+            key={i18n.language}
+            value={value}
+            onChange={(v) => onChange(v as ManagementMode)}
+            aria-label={t("settings.general.management.label")}
+            className={fullWidth ? "w-full" : undefined}
+        >
+            <SwitchItem value={ManagementMode.Cloud} className={itemClass}>
+                <img
+                    src={netbirdLogo}
+                    alt={""}
+                    aria-hidden={"true"}
+                    className={"aspect-[31/23] h-[0.8rem] shrink-0"}
+                />
+                {t("settings.general.management.cloud")}
+            </SwitchItem>
+            <SwitchItem value={ManagementMode.SelfHosted} className={itemClass}>
+                {t("settings.general.management.selfHosted")}
+            </SwitchItem>
+        </SwitchItemGroup>
+    );
+};
diff --git a/client/ui/frontend/src/components/SquareIcon.tsx b/client/ui/frontend/src/components/SquareIcon.tsx
new file mode 100644
index 000000000..e904d2de5
--- /dev/null
+++ b/client/ui/frontend/src/components/SquareIcon.tsx
@@ -0,0 +1,37 @@
+import { type ComponentType } from "react";
+import { type LucideProps } from "lucide-react";
+import { cn } from "@/lib/cn";
+
+export type SquareIconVariant = "default" | "info" | "warning" | "danger";
+
+const variantClass: Record<SquareIconVariant, string> = {
+    default: "text-white",
+    info: "text-sky-400",
+    warning: "text-netbird",
+    danger: "text-red-500",
+};
+
+type SquareIconProps = {
+    icon: ComponentType<LucideProps>;
+    iconSize?: number;
+    variant?: SquareIconVariant;
+    className?: string;
+};
+
+export const SquareIcon = ({
+    icon: Icon,
+    iconSize = 18,
+    variant = "default",
+    className,
+}: SquareIconProps) => (
+    <div
+        aria-hidden={"true"}
+        className={cn(
+            "flex h-11 w-11 items-center justify-center rounded-lg border border-nb-gray-900 bg-nb-gray-920",
+            variantClass[variant],
+            className,
+        )}
+    >
+        <Icon size={iconSize} />
+    </div>
+);
diff --git a/client/ui/frontend/src/components/Tooltip.tsx b/client/ui/frontend/src/components/Tooltip.tsx
new file mode 100644
index 000000000..2c77ba139
--- /dev/null
+++ b/client/ui/frontend/src/components/Tooltip.tsx
@@ -0,0 +1,98 @@
+import { type ReactNode, useEffect, useRef, useState } from "react";
+import * as RTooltip from "@radix-ui/react-tooltip";
+import { cn } from "@/lib/cn";
+
+type Props = {
+    content: ReactNode;
+    children: ReactNode;
+    side?: RTooltip.TooltipContentProps["side"];
+    align?: RTooltip.TooltipContentProps["align"];
+    delayDuration?: number;
+    sideOffset?: number;
+    alignOffset?: number;
+    interactive?: boolean;
+    keepOpenOnClick?: boolean;
+    contentClassName?: string;
+    closeDelay?: number;
+};
+
+export const Tooltip = ({
+    content,
+    children,
+    side = "bottom",
+    align = "center",
+    delayDuration = 200,
+    sideOffset = 6,
+    alignOffset = 0,
+    interactive = false,
+    keepOpenOnClick = true,
+    contentClassName,
+    closeDelay = 0,
+}: Props) => {
+    const [open, setOpen] = useState(false);
+    const hoveringRef = useRef(false);
+    const closeTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
+
+    const cancelClose = () => {
+        if (closeTimer.current) {
+            clearTimeout(closeTimer.current);
+            closeTimer.current = null;
+        }
+    };
+    const scheduleClose = () => {
+        cancelClose();
+        if (closeDelay <= 0) {
+            setOpen(false);
+            return;
+        }
+        closeTimer.current = setTimeout(() => setOpen(false), closeDelay);
+    };
+    useEffect(() => () => cancelClose(), []);
+
+    const handleOpenChange = (next: boolean) => {
+        if (!next && keepOpenOnClick && hoveringRef.current) return;
+        if (next) cancelClose();
+        setOpen(next);
+    };
+
+    return (
+        <RTooltip.Provider delayDuration={delayDuration} disableHoverableContent={!interactive}>
+            <RTooltip.Root open={open} onOpenChange={handleOpenChange}>
+                <RTooltip.Trigger
+                    asChild
+                    onPointerEnter={() => {
+                        hoveringRef.current = true;
+                        cancelClose();
+                    }}
+                    onPointerLeave={() => {
+                        hoveringRef.current = false;
+                        scheduleClose();
+                    }}
+                >
+                    {children}
+                </RTooltip.Trigger>
+                <RTooltip.Portal>
+                    <RTooltip.Content
+                        side={side}
+                        align={align}
+                        sideOffset={sideOffset}
+                        alignOffset={alignOffset}
+                        onPointerEnter={interactive ? cancelClose : undefined}
+                        onPointerLeave={interactive ? scheduleClose : undefined}
+                        onPointerDownOutside={interactive ? undefined : (e) => e.preventDefault()}
+                        className={cn(
+                            "z-50 select-none text-xs text-nb-gray-100 shadow-lg",
+                            "data-[state=delayed-open]:animate-in data-[state=closed]:animate-out",
+                            "data-[state=closed]:fade-out-0 data-[state=delayed-open]:fade-in-0",
+                            !interactive && "pointer-events-none",
+                            contentClassName ??
+                                "rounded-md border border-nb-gray-850 bg-nb-gray-900 px-2 py-1",
+                        )}
+                    >
+                        {content}
+                    </RTooltip.Content>
+                </RTooltip.Portal>
+            </RTooltip.Root>
+        </RTooltip.Provider>
+    );
+};
diff --git a/client/ui/frontend/src/components/TruncatedText.tsx b/client/ui/frontend/src/components/TruncatedText.tsx
new file mode 100644
index 000000000..5b2d2160c
--- /dev/null
+++ b/client/ui/frontend/src/components/TruncatedText.tsx
@@ -0,0 +1,32 @@
+import { useLayoutEffect, useRef, useState, type ReactNode } from "react";
+import { Tooltip } from "@/components/Tooltip";
+
+type Props = {
+    text: string;
+    className?: string;
+    tooltipContent?: ReactNode;
+    delayDuration?: number;
+};
+
+export const TruncatedText = ({ text, className, tooltipContent, delayDuration = 600 }: Props) => {
+    const ref = useRef<HTMLSpanElement>(null);
+    const [overflowing, setOverflowing] = useState(false);
+
+    useLayoutEffect(() => {
+        const el = ref.current;
+        if (!el) return;
+        setOverflowing(el.scrollWidth > el.clientWidth);
+    }, [text]);
+
+    const span = (
+        <span ref={ref} className={className}>
+            {text}
+        </span>
+    );
+    if (!overflowing) return span;
+    return (
+        <Tooltip content={tooltipContent ?? text} delayDuration={delayDuration}>
+            {span}
+        </Tooltip>
+    );
+};
diff --git a/client/ui/frontend/src/components/VerticalTabs.tsx b/client/ui/frontend/src/components/VerticalTabs.tsx
new file mode 100644
index 000000000..1aedf82a6
--- /dev/null
+++ b/client/ui/frontend/src/components/VerticalTabs.tsx
@@ -0,0 +1,98 @@
+import { type ComponentType, type ReactNode, forwardRef } from "react";
+import * as Tabs from "@radix-ui/react-tabs";
+import { type LucideProps } from "lucide-react";
+import { cn } from "@/lib/cn";
+import { useFocusVisible } from "@/hooks/useFocusVisible";
+
+const Root = forwardRef<HTMLDivElement, Omit<Tabs.TabsProps, "orientation">>(
+    function VerticalTabsRoot({ className, ...props }, ref) {
+        return (
+            <Tabs.Root
+                ref={ref}
+                orientation={"vertical"}
+                className={cn("flex min-h-0 flex-1", className)}
+                {...props}
+            />
+        );
+    },
+);
+
+const List = forwardRef<HTMLDivElement, Tabs.TabsListProps>(function VerticalTabsList(
+    { className, ...props },
+    ref,
+) {
+    return (
+        <Tabs.List
+            ref={ref}
+            className={cn("flex w-full flex-col gap-1 p-5 pr-0", className)}
+            {...props}
+        />
+    );
+});
+
+type TriggerProps = Tabs.TabsTriggerProps & {
+    icon: ComponentType<LucideProps>;
+    title: string;
+    iconSize?: number;
+    adornment?: ReactNode;
+};
+
+const Trigger = forwardRef<HTMLButtonElement, TriggerProps>(function VerticalTabsTrigger(
+    { icon: Icon, title, iconSize = 16, adornment, className, ...props },
+    ref,
+) {
+    const isFocusVisible = useFocusVisible();
+    return (
+        <Tabs.Trigger
+            ref={ref}
+            className={cn(
+                "group flex w-full cursor-default items-center gap-3 rounded-lg px-2 py-2.5 text-left outline-none",
+                "transition-colors duration-150",
+                "data-[state=active]:bg-nb-gray-930",
+                "data-[state=inactive]:hover:bg-nb-gray-935",
+                isFocusVisible &&
+                    "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                className,
+            )}
+            {...props}
+        >
+            <Icon
+                size={iconSize}
+                aria-hidden={"true"}
+                className={cn(
+                    "ml-2 shrink-0 transition-colors duration-150",
+                    "text-nb-gray-400 group-data-[state=active]:text-nb-gray-100",
+                )}
+            />
+            <span
+                className={cn(
+                    "min-w-0 truncate text-sm font-medium transition-colors duration-150",
+                    "text-nb-gray-400 group-data-[state=active]:text-nb-gray-100",
+                )}
+            >
+                {title}
+            </span>
+            {adornment && (
+                <div aria-hidden={"true"} className={"ml-auto mr-2 shrink-0"}>
+                    {adornment}
+                </div>
+            )}
+        </Tabs.Trigger>
+    );
+});
+
+const Content = forwardRef<HTMLDivElement, Tabs.TabsContentProps>(function VerticalTabsContent(
+    { className, ...props },
+    ref,
+) {
+    return (
+        <Tabs.Content
+            ref={ref}
+            tabIndex={-1}
+            className={cn("outline-none", className)}
+            {...props}
+        />
+    );
+});
+
+export const VerticalTabs = Object.assign(Root, { List, Trigger, Content });
diff --git a/client/ui/frontend/src/components/buttons/Button.tsx b/client/ui/frontend/src/components/buttons/Button.tsx
new file mode 100644
index 000000000..6b151c17b
--- /dev/null
+++ b/client/ui/frontend/src/components/buttons/Button.tsx
@@ -0,0 +1,195 @@
+import { cva, type VariantProps } from "class-variance-authority";
+import { Check, Copy, Loader2 } from "lucide-react";
+import { type ButtonHTMLAttributes, forwardRef, useEffect, useRef, useState } from "react";
+
+import { cn } from "@/lib/cn";
+
+type ButtonVariants = VariantProps<typeof buttonVariants>;
+
+interface ButtonProps extends ButtonHTMLAttributes<HTMLButtonElement>, ButtonVariants {
+    disabled?: boolean;
+    stopPropagation?: boolean;
+    copy?: string;
+    loading?: boolean;
+}
+
+const buttonVariants = cva(
+    [
+        "relative",
+        "cursor-default select-none whitespace-nowrap text-sm font-medium shadow-sm focus:z-10 focus:outline-none focus:ring-2",
+        "inline-flex items-center justify-center gap-2 transition-colors focus:ring-offset-1",
+        "disabled:cursor-not-allowed disabled:opacity-40 dark:ring-offset-neutral-950/50 disabled:dark:text-nb-gray-300",
+    ],
+    {
+        variants: {
+            variant: {
+                default: [
+                    "border-gray-200 bg-white text-gray-900 hover:bg-gray-100 hover:text-black focus:ring-zinc-200/50",
+                    "dark:border-gray-700/30 dark:bg-nb-gray dark:text-gray-400 dark:hover:bg-zinc-800/50 dark:hover:text-white dark:focus:ring-zinc-800/50",
+                ],
+                primary: [
+                    "dark:text-gray-100 dark:ring-offset-neutral-950/50 dark:focus:ring-netbird-600/50 enabled:dark:bg-netbird enabled:dark:hover:bg-netbird-500/80 enabled:dark:hover:text-white disabled:dark:bg-nb-gray-900",
+                    "enabled:bg-netbird enabled:text-white enabled:hover:bg-netbird-500 enabled:focus:ring-netbird-400/50",
+                ],
+                secondary: [
+                    "border-gray-200 bg-white text-gray-900 hover:bg-gray-100 hover:text-black focus:ring-zinc-200/50",
+                    "dark:ring-offset-neutral-950/50 dark:focus:ring-neutral-500/20",
+                    "dark:border-gray-700/40 dark:bg-nb-gray-920 dark:text-gray-400 dark:hover:bg-nb-gray-910 dark:hover:text-white",
+                ],
+                secondaryLighter: [
+                    "border-gray-200 bg-white text-gray-900 hover:bg-gray-100 hover:text-black focus:ring-zinc-200/50",
+                    "dark:ring-offset-neutral-950/50 dark:focus:ring-neutral-500/20",
+                    "dark:border-gray-700/70 dark:bg-nb-gray-900/70 dark:text-gray-400 dark:hover:bg-nb-gray-800/60 dark:hover:text-white",
+                ],
+                subtle: [
+                    "border-nb-gray-200 bg-nb-gray-50 text-nb-gray-900 hover:bg-nb-gray-100 focus:ring-nb-gray-200/60",
+                    "dark:ring-offset-neutral-950/50 dark:focus:ring-nb-gray-200/40",
+                    "dark:border-nb-gray-200 dark:bg-nb-gray-50 dark:text-nb-gray-900 dark:hover:bg-nb-gray-100 dark:hover:text-nb-gray-950",
+                ],
+                input: [
+                    "border-neutral-200 bg-white text-gray-900 hover:bg-gray-100 hover:text-black focus:ring-zinc-200/50",
+                    "dark:ring-offset-neutral-950/50 dark:focus:ring-neutral-500/20",
+                    "dark:border-nb-gray-700 dark:bg-nb-gray-900 dark:text-gray-400 dark:hover:bg-nb-gray-900/80",
+                ],
+                dropdown: [
+                    "border-neutral-200 bg-white text-gray-900 hover:bg-gray-100 hover:text-black focus:ring-zinc-200/50",
+                    "dark:ring-offset-neutral-950/50 dark:focus:ring-neutral-500/20",
+                    "dark:border-nb-gray-900 dark:bg-nb-gray-900/40 dark:text-gray-400 dark:hover:bg-nb-gray-900/50",
+                ],
+                dotted: [
+                    "border-dashed border-gray-200 bg-white text-gray-900 hover:bg-gray-100 hover:text-black focus:ring-zinc-200/50",
+                    "dark:ring-offset-neutral-950/50 dark:focus:ring-neutral-500/20",
+                    "dark:border-gray-500/40 dark:bg-nb-gray-900/30 dark:text-gray-400 dark:hover:bg-nb-gray-900/50 dark:hover:text-white",
+                ],
+                tertiary: [
+                    "border-gray-200 bg-white text-gray-900 hover:bg-gray-100 hover:text-black focus:ring-zinc-200/50",
+                    "dark:border-gray-700/40 dark:bg-white dark:text-gray-800 dark:hover:bg-neutral-200 dark:focus:ring-zinc-800/50 disabled:dark:bg-nb-gray-920 disabled:dark:text-nb-gray-300",
+                ],
+                white: [
+                    "border-white bg-white text-gray-800 outline-none hover:bg-neutral-200 focus:ring-white/50 disabled:dark:bg-nb-gray-920 disabled:dark:text-nb-gray-300",
+                    "disabled:dark:border-nb-gray-900 disabled:dark:bg-nb-gray-900 disabled:dark:text-nb-gray-300",
+                ],
+                outline: [
+                    "border-gray-200 bg-white text-gray-900 hover:bg-gray-100 hover:text-black focus:ring-zinc-200/50",
+                    "dark:border-netbird dark:bg-transparent dark:text-netbird dark:hover:bg-nb-gray-900/30 dark:focus:ring-zinc-800/50",
+                ],
+                "danger-outline": [
+                    "dark:bg-transparent dark:text-red-500 enabled:dark:hover:border-red-800/50 enabled:hover:dark:bg-red-950/50 enabled:dark:focus:bg-red-950/40 enabled:dark:focus:ring-red-800/20",
+                ],
+                "danger-text": [
+                    "rounded-sm !px-0 !py-0 !shadow-none focus:ring-red-500/30 dark:border-transparent dark:bg-transparent dark:text-red-500 dark:ring-offset-neutral-950/50 dark:hover:text-red-600",
+                ],
+                "default-outline": [
+                    "dark:ring-offset-nb-gray-950/50 dark:focus:ring-nb-gray-500/20",
+                    "dark:border-transparent dark:bg-transparent dark:text-nb-gray-400 dark:hover:border-nb-gray-800/50 dark:hover:bg-nb-gray-900/30 dark:hover:text-white",
+                    "data-[state=open]:dark:border-nb-gray-800/50 data-[state=open]:dark:bg-nb-gray-900/30 data-[state=open]:dark:text-white",
+                ],
+                ghost: [
+                    "dark:ring-offset-nb-gray-950/50 dark:focus:ring-nb-gray-500/20",
+                    "dark:border-transparent dark:bg-transparent dark:text-nb-gray-400 dark:hover:bg-nb-gray-900/30 dark:hover:text-white",
+                ],
+                danger: [
+                    "dark:bg-red-600 dark:text-red-100 dark:hover:border-red-800/50 hover:dark:bg-red-700 dark:focus:bg-red-700 dark:focus:ring-red-700/20",
+                ],
+            },
+            size: {
+                xs: "px-3.5 py-2.5 text-xs",
+                xs2: "px-4 py-[1.1rem] text-[0.78rem] leading-[0]",
+                sm: "px-4 py-[9px] text-sm",
+                md: "px-4 py-[9px]",
+                lg: "px-4 py-[9px] text-lg",
+            },
+            rounded: {
+                true: "rounded-md",
+                false: "",
+            },
+            border: {
+                0: "border",
+                1: "border border-transparent",
+                2: "border border-b-0 border-t-0",
+            },
+        },
+    },
+);
+
+export const Button = forwardRef<HTMLButtonElement, ButtonProps>(function Button(
+    {
+        variant = "default",
+        rounded = true,
+        border = 1,
+        size = "md",
+        stopPropagation = true,
+        type = "button",
+        children,
+        className,
+        onClick,
+        disabled,
+        copy,
+        loading = false,
+        ...props
+    },
+    ref,
+) {
+    const [copied, setCopied] = useState(false);
+    const copyTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
+    useEffect(
+        () => () => {
+            if (copyTimer.current) clearTimeout(copyTimer.current);
+        },
+        [],
+    );
+    const iconSize = size === "xs" ? 12 : 14;
+    return (
+        <button
+            ref={ref}
+            type={type}
+            tabIndex={0}
+            disabled={disabled || loading}
+            aria-busy={loading || undefined}
+            className={cn(
+                buttonVariants({
+                    variant,
+                    rounded,
+                    border: border ? 1 : 0,
+                    size,
+                }),
+                className,
+            )}
+            onClick={(e) => {
+                if (stopPropagation) e.stopPropagation();
+                if (copy !== undefined) {
+                    void navigator.clipboard
+                        .writeText(copy)
+                        .then(() => {
+                            setCopied(true);
+                            if (copyTimer.current) clearTimeout(copyTimer.current);
+                            copyTimer.current = setTimeout(() => setCopied(false), 1500);
+                        })
+                        .catch((e: unknown) => console.warn("copy to clipboard failed", e));
+                }
+                onClick?.(e);
+            }}
+            {...props}
+        >
+            {loading && (
+                <span
+                    aria-hidden={"true"}
+                    className={"absolute inset-0 flex items-center justify-center"}
+                >
+                    <Loader2 size={iconSize} className={"animate-spin"} />
+                </span>
+            )}
+            <span className={cn("contents", loading && "invisible")}>
+                {copy !== undefined &&
+                    (copied ? (
+                        <Check size={iconSize} aria-hidden={"true"} />
+                    ) : (
+                        <Copy size={iconSize} aria-hidden={"true"} />
+                    ))}
+                {children}
+            </span>
+        </button>
+    );
+});
+
+export default Button;
diff --git a/client/ui/frontend/src/components/buttons/IconButton.tsx b/client/ui/frontend/src/components/buttons/IconButton.tsx
new file mode 100644
index 000000000..3d36bc111
--- /dev/null
+++ b/client/ui/frontend/src/components/buttons/IconButton.tsx
@@ -0,0 +1,36 @@
+import { type ButtonHTMLAttributes, type ComponentType, forwardRef } from "react";
+import { type LucideProps } from "lucide-react";
+import { useFocusVisible } from "@/hooks/useFocusVisible";
+import { cn } from "@/lib/cn";
+
+type Props = ButtonHTMLAttributes<HTMLButtonElement> & {
+    icon: ComponentType<LucideProps>;
+    iconSize?: number;
+    iconClassName?: string;
+};
+
+export const IconButton = forwardRef<HTMLButtonElement, Props>(function IconButton(
+    { icon: Icon, iconSize = 17, iconClassName, className, type = "button", disabled, ...props },
+    ref,
+) {
+    const isFocusVisible = useFocusVisible();
+    return (
+        <button
+            ref={ref}
+            type={type}
+            disabled={disabled}
+            tabIndex={disabled ? -1 : 0}
+            className={cn(
+                "flex h-10 w-10 cursor-default items-center justify-center rounded-lg outline-none",
+                "text-nb-gray-400 hover:bg-nb-gray-900 hover:text-nb-gray-300",
+                isFocusVisible &&
+                    "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                "wails-no-draggable transition-colors duration-150",
+                className,
+            )}
+            {...props}
+        >
+            <Icon size={iconSize} className={iconClassName} />
+        </button>
+    );
+});
diff --git a/client/ui/frontend/src/components/dialog/ConfirmDialog.tsx b/client/ui/frontend/src/components/dialog/ConfirmDialog.tsx
new file mode 100644
index 000000000..caf98c2c8
--- /dev/null
+++ b/client/ui/frontend/src/components/dialog/ConfirmDialog.tsx
@@ -0,0 +1,35 @@
+import { type ReactNode, forwardRef } from "react";
+import { cn } from "@/lib/cn.ts";
+import { isMacOS } from "@/lib/platform.ts";
+
+type ConfirmDialogProps = {
+    children: ReactNode;
+    "aria-label"?: string;
+    "aria-labelledby"?: string;
+};
+
+export const ConfirmDialog = forwardRef<HTMLDivElement, ConfirmDialogProps>(function ConfirmDialog(
+    { children, "aria-label": ariaLabel, "aria-labelledby": ariaLabelledBy },
+    ref,
+) {
+    return (
+        <dialog
+            open
+            aria-label={ariaLabel}
+            aria-labelledby={ariaLabelledBy}
+            className={
+                "wails-draggable static m-0 flex max-h-none w-full max-w-none select-none flex-col items-center border-0 bg-transparent p-0 text-inherit"
+            }
+        >
+            <div
+                ref={ref}
+                className={cn(
+                    "flex flex-col items-center gap-5 px-8 pb-7 pt-6 text-center",
+                    isMacOS() && "pt-10",
+                )}
+            >
+                {children}
+            </div>
+        </dialog>
+    );
+});
diff --git a/client/ui/frontend/src/components/dialog/ConfirmModal.tsx b/client/ui/frontend/src/components/dialog/ConfirmModal.tsx
new file mode 100644
index 000000000..241a69ec9
--- /dev/null
+++ b/client/ui/frontend/src/components/dialog/ConfirmModal.tsx
@@ -0,0 +1,84 @@
+import { type ReactNode } from "react";
+import { useTranslation } from "react-i18next";
+import * as Dialog from "@/components/dialog/Dialog";
+import { Button } from "@/components/buttons/Button";
+import { DialogHeading } from "@/components/dialog/DialogHeading";
+import { DialogDescription } from "@/components/dialog/DialogDescription";
+import { DialogActions } from "@/components/dialog/DialogActions";
+
+type ConfirmModalProps = {
+    open: boolean;
+    title: ReactNode;
+    description: ReactNode;
+    confirmLabel: string;
+    cancelLabel?: string;
+    danger?: boolean;
+    busy?: boolean;
+    onConfirm: () => void;
+    onCancel: () => void;
+};
+
+export const ConfirmModal = ({
+    open,
+    title,
+    description,
+    confirmLabel,
+    cancelLabel,
+    danger = false,
+    busy = false,
+    onConfirm,
+    onCancel,
+}: ConfirmModalProps) => {
+    const { t } = useTranslation();
+    const resolvedCancel = cancelLabel ?? t("common.cancel");
+
+    const srTitle = typeof title === "string" ? title : undefined;
+    const srDescription = typeof description === "string" ? description : undefined;
+
+    return (
+        <Dialog.Root
+            open={open}
+            onOpenChange={(next) => {
+                if (!next && !busy) onCancel();
+            }}
+        >
+            <Dialog.Content
+                maxWidthClass={"max-w-sm"}
+                showClose={false}
+                className={"py-5"}
+                srTitle={srTitle}
+                srDescription={srDescription}
+                onOpenAutoFocus={(e) => e.preventDefault()}
+            >
+                <div className={"flex flex-col gap-5 px-5"}>
+                    <div className={"flex flex-col gap-1 pl-1"}>
+                        <DialogHeading align={"left"}>{title}</DialogHeading>
+                        <DialogDescription align={"left"} className={"whitespace-pre-line"}>
+                            {description}
+                        </DialogDescription>
+                    </div>
+
+                    <DialogActions className={"flex-row justify-end gap-2.5"}>
+                        <Button
+                            variant={"secondary"}
+                            size={"sm"}
+                            disabled={busy}
+                            onClick={onCancel}
+                        >
+                            {resolvedCancel}
+                        </Button>
+                        <Button
+                            autoFocus
+                            variant={danger ? "danger" : "primary"}
+                            size={"sm"}
+                            disabled={busy}
+                            onClick={onConfirm}
+                        >
+                            {confirmLabel}
+                        </Button>
+                    </DialogActions>
+                </div>
+            </Dialog.Content>
+        </Dialog.Root>
+    );
+};
diff --git a/client/ui/frontend/src/components/dialog/Dialog.tsx b/client/ui/frontend/src/components/dialog/Dialog.tsx
new file mode 100644
index 000000000..fa8007d9f
--- /dev/null
+++ b/client/ui/frontend/src/components/dialog/Dialog.tsx
@@ -0,0 +1,159 @@
+import {
+    forwardRef,
+    type ComponentPropsWithoutRef,
+    type ElementRef,
+    type HTMLAttributes,
+} from "react";
+import * as DialogPrimitive from "@radix-ui/react-dialog";
+import { VisuallyHidden } from "@radix-ui/react-visually-hidden";
+import { X } from "lucide-react";
+import { useTranslation } from "react-i18next";
+import { cn } from "@/lib/cn";
+
+export const Root = DialogPrimitive.Root;
+
+type OverlayProps = ComponentPropsWithoutRef<typeof DialogPrimitive.Overlay> & {
+    exitAnimation?: boolean;
+};
+
+const Overlay = forwardRef<ElementRef<typeof DialogPrimitive.Overlay>, OverlayProps>(
+    function DialogOverlay({ className, exitAnimation = false, ...props }, ref) {
+        return (
+            <DialogPrimitive.Overlay
+                ref={ref}
+                className={cn(
+                    "fixed inset-0 z-50 grid items-center justify-items-center overflow-y-auto px-10 py-16",
+                    "bg-black/60",
+                    "data-[state=open]:animate-in data-[state=open]:fade-in-0",
+                    exitAnimation &&
+                        "data-[state=closed]:animate-out data-[state=closed]:fade-out-0",
+                    "duration-150 ease-out",
+                    className,
+                )}
+                {...props}
+            />
+        );
+    },
+);
+
+type ContentProps = ComponentPropsWithoutRef<typeof DialogPrimitive.Content> & {
+    showClose?: boolean;
+    maxWidthClass?: string;
+    exitAnimation?: boolean;
+    srTitle?: string;
+    srDescription?: string;
+};
+
+export const Content = forwardRef<ElementRef<typeof DialogPrimitive.Content>, ContentProps>(
+    function DialogContent(
+        {
+            className,
+            children,
+            showClose = true,
+            maxWidthClass = "max-w-md",
+            exitAnimation = false,
+            srTitle,
+            srDescription,
+            ...props
+        },
+        ref,
+    ) {
+        const { t } = useTranslation();
+        return (
+            <DialogPrimitive.Portal>
+                <Overlay exitAnimation={exitAnimation}>
+                    <DialogPrimitive.Content
+                        ref={ref}
+                        className={cn(
+                            "relative z-[52] mx-auto w-full outline-none ring-0",
+                            "focus:outline-none focus:ring-0 focus-visible:outline-none focus-visible:ring-0",
+                            "rounded-lg border border-nb-gray-900 bg-nb-gray py-7 shadow-2xl",
+                            "data-[state=open]:animate-in data-[state=open]:fade-in-0",
+                            "data-[state=open]:zoom-in-95 data-[state=open]:slide-in-from-left-1",
+                            exitAnimation &&
+                                "data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=closed]:zoom-out-95 data-[state=closed]:slide-out-to-left-1",
+                            "duration-150 ease-out",
+                            maxWidthClass,
+                            className,
+                        )}
+                        onClick={(e) => e.stopPropagation()}
+                        {...props}
+                    >
+                        <VisuallyHidden asChild>
+                            <DialogPrimitive.Title>
+                                {srTitle ?? t("common.netbird")}
+                            </DialogPrimitive.Title>
+                        </VisuallyHidden>
+                        {srDescription && (
+                            <VisuallyHidden asChild>
+                                <DialogPrimitive.Description>
+                                    {srDescription}
+                                </DialogPrimitive.Description>
+                            </VisuallyHidden>
+                        )}
+                        {children}
+                        {showClose && (
+                            <DialogPrimitive.Close
+                                className={cn(
+                                    "absolute right-3 top-3 z-10 rounded-md p-3 transition-colors",
+                                    "text-nb-gray-300 hover:text-nb-gray-100",
+                                    "focus:outline-none disabled:pointer-events-none",
+                                )}
+                                aria-label={t("common.close")}
+                            >
+                                <X className={"h-4 w-4"} aria-hidden={"true"} />
+                            </DialogPrimitive.Close>
+                        )}
+                    </DialogPrimitive.Content>
+                </Overlay>
+            </DialogPrimitive.Portal>
+        );
+    },
+);
+
+export const Title = forwardRef<
+    ElementRef<typeof DialogPrimitive.Title>,
+    ComponentPropsWithoutRef<typeof DialogPrimitive.Title>
+>(function DialogTitle({ className, ...props }, ref) {
+    return (
+        <DialogPrimitive.Title
+            ref={ref}
+            className={cn(
+                "text-md font-semibold leading-none tracking-tight text-nb-gray-50",
+                className,
+            )}
+            {...props}
+        />
+    );
+});
+
+export const Description = forwardRef<
+    ElementRef<typeof DialogPrimitive.Description>,
+    ComponentPropsWithoutRef<typeof DialogPrimitive.Description>
+>(function DialogDescription({ className, ...props }, ref) {
+    return (
+        <DialogPrimitive.Description
+            ref={ref}
+            className={cn("mt-2 text-sm leading-snug text-nb-gray-400", className)}
+            {...props}
+        />
+    );
+});
+
+type FooterProps = HTMLAttributes<HTMLDivElement> & {
+    separator?: boolean;
+};
+
+export const Footer = ({ className, separator = true, ...props }: FooterProps) => (
+    <div className={cn(separator && "mt-6 border-t border-nb-gray-900")}>
+        <div
+            className={cn(
+                "flex flex-col-reverse gap-3 sm:flex-row sm:justify-end",
+                "[&>*]:w-full sm:[&>*]:w-auto",
+                "px-8 pt-6",
+                className,
+            )}
+            {...props}
+        />
+    </div>
+);
diff --git a/client/ui/frontend/src/components/dialog/DialogActions.tsx b/client/ui/frontend/src/components/dialog/DialogActions.tsx
new file mode 100644
index 000000000..3aa3a1fe5
--- /dev/null
+++ b/client/ui/frontend/src/components/dialog/DialogActions.tsx
@@ -0,0 +1,13 @@
+import { type ReactNode } from "react";
+import { cn } from "@/lib/cn";
+
+type DialogActionsProps = {
+    children: ReactNode;
+    className?: string;
+};
+
+export const DialogActions = ({ children, className }: DialogActionsProps) => (
+    <div className={cn("wails-no-draggable mx-auto flex w-full flex-col gap-3", className)}>
+        {children}
+    </div>
+);
diff --git a/client/ui/frontend/src/components/dialog/DialogDescription.tsx b/client/ui/frontend/src/components/dialog/DialogDescription.tsx
new file mode 100644
index 000000000..12c358043
--- /dev/null
+++ b/client/ui/frontend/src/components/dialog/DialogDescription.tsx
@@ -0,0 +1,26 @@
+import { type ReactNode } from "react";
+import { cn } from "@/lib/cn";
+
+type DialogAlign = "left" | "center" | "right";
+
+const alignClass: Record<DialogAlign, string> = {
+    left: "text-left",
+    center: "text-center",
+    right: "text-right",
+};
+
+type DialogDescriptionProps = {
+    children: ReactNode;
+    className?: string;
+    align?: DialogAlign;
+};
+
+export const DialogDescription = ({
+    children,
+    className,
+    align = "center",
+}: DialogDescriptionProps) => (
+    <p className={cn("w-full select-none text-sm text-nb-gray-300", alignClass[align], className)}>
+        {children}
+    </p>
+);
diff --git a/client/ui/frontend/src/components/dialog/DialogHeading.tsx b/client/ui/frontend/src/components/dialog/DialogHeading.tsx
new file mode 100644
index 000000000..b9dda72a9
--- /dev/null
+++ b/client/ui/frontend/src/components/dialog/DialogHeading.tsx
@@ -0,0 +1,35 @@
+import { type ReactNode } from "react";
+import { cn } from "@/lib/cn";
+
+type DialogAlign = "left" | "center" | "right";
+
+const alignClass: Record<DialogAlign, string> = {
+    left: "text-left",
+    center: "text-center",
+    right: "text-right",
+};
+
+type DialogHeadingProps = {
+    children: ReactNode;
+    className?: string;
+    align?: DialogAlign;
+    id?: string;
+};
+
+export const DialogHeading = ({
+    children,
+    className,
+    align = "center",
+    id,
+}: DialogHeadingProps) => (
+    <h2
+        id={id}
+        className={cn(
+            "w-full select-none text-base font-semibold text-nb-gray-50",
+            alignClass[align],
+            className,
+        )}
+    >
+        {children}
+    </h2>
+);
diff --git a/client/ui/frontend/src/components/empty-state/DaemonOutdatedOverlay.tsx b/client/ui/frontend/src/components/empty-state/DaemonOutdatedOverlay.tsx
new file mode 100644
index 000000000..4ee8c2740
--- /dev/null
+++ b/client/ui/frontend/src/components/empty-state/DaemonOutdatedOverlay.tsx
@@ -0,0 +1,50 @@
+import { useTranslation } from "react-i18next";
+import { AlertTriangleIcon, DownloadIcon } from "lucide-react";
+import { Browser } from "@wailsio/runtime";
+import { Button } from "@/components/buttons/Button";
+import { useStatus } from "@/contexts/StatusContext.tsx";
+
+const RELEASES_URL = "https://github.com/netbirdio/netbird/releases/latest";
+
+function openUrl(url: string) {
+    Browser.OpenURL(url).catch(() => globalThis.open(url, "_blank"));
+}
+
+export const DaemonOutdatedOverlay = () => {
+    const { t } = useTranslation();
+    const { isDaemonOutdated } = useStatus();
+
+    if (!isDaemonOutdated) return null;
+
+    return (
+        <div
+            className={
+                "wails-draggable fixed inset-0 z-[100] flex cursor-default select-none items-center justify-center bg-nb-gray-950 backdrop-blur-sm"
+            }
+        >
+            <div className={"flex max-w-lg flex-col items-center gap-5 px-8 text-center"}>
+                <div
+                    className={
+                        "flex h-11 w-11 items-center justify-center rounded-xl border border-nb-gray-900 bg-nb-gray-920 text-amber-500"
+                    }
+                >
+                    <AlertTriangleIcon size={20} />
+                </div>
+
+                <div className={"flex flex-col items-center gap-1"}>
+                    <p className={"text-base font-medium text-nb-gray-50"}>
+                        {t("daemon.outdated.title")}
+                    </p>
+                    <p className={"text-sm text-nb-gray-300"}>{t("daemon.outdated.description")}</p>
+                </div>
+
+                <div className={"wails-no-draggable"}>
+                    <Button variant={"primary"} size={"xs"} onClick={() => openUrl(RELEASES_URL)}>
+                        <DownloadIcon size={14} />
+                        {t("update.card.getInstaller")}
+                    </Button>
+                </div>
+            </div>
+        </div>
+    );
+};
diff --git a/client/ui/frontend/src/components/empty-state/DaemonUnavailableOverlay.tsx b/client/ui/frontend/src/components/empty-state/DaemonUnavailableOverlay.tsx
new file mode 100644
index 000000000..89c121e21
--- /dev/null
+++ b/client/ui/frontend/src/components/empty-state/DaemonUnavailableOverlay.tsx
@@ -0,0 +1,52 @@
+import { useTranslation } from "react-i18next";
+import { AlertCircleIcon, BookText } from "lucide-react";
+import { Browser } from "@wailsio/runtime";
+import { Button } from "@/components/buttons/Button";
+import { useStatus } from "@/contexts/StatusContext.tsx";
+
+const DOCS_URL = "https://docs.netbird.io/how-to/installation";
+
+function openUrl(url: string) {
+    Browser.OpenURL(url).catch(() => globalThis.open(url, "_blank"));
+}
+
+export const DaemonUnavailableOverlay = () => {
+    const { t } = useTranslation();
+    const { isDaemonUnavailable } = useStatus();
+
+    if (!isDaemonUnavailable) return null;
+
+    return (
+        <div
+            className={
+                "wails-draggable fixed inset-0 z-[100] flex cursor-default select-none items-center justify-center bg-nb-gray-950 backdrop-blur-sm"
+            }
+        >
+            <div className={"flex max-w-lg flex-col items-center gap-5 px-8 text-center"}>
+                <div
+                    className={
+                        "flex h-11 w-11 items-center justify-center rounded-xl border border-nb-gray-900 bg-nb-gray-920 text-red-500"
+                    }
+                >
+                    <AlertCircleIcon size={20} />
+                </div>
+
+                <div className={"flex flex-col items-center gap-1"}>
+                    <p className={"text-base font-medium text-nb-gray-50"}>
+                        {t("daemon.unavailable.title")}
+                    </p>
+                    <p className={"text-sm text-nb-gray-300"}>
+                        {t("daemon.unavailable.description")}
+                    </p>
+                </div>
+
+                <div className={"wails-no-draggable"}>
+                    <Button variant={"secondary"} size={"xs"} onClick={() => openUrl(DOCS_URL)}>
+                        <BookText size={14} />
+                        {t("daemon.unavailable.docsLink")}
+                    </Button>
+                </div>
+            </div>
+        </div>
+    );
+};
diff --git a/client/ui/frontend/src/components/empty-state/EmptyState.tsx b/client/ui/frontend/src/components/empty-state/EmptyState.tsx
new file mode 100644
index 000000000..7d6890a98
--- /dev/null
+++ b/client/ui/frontend/src/components/empty-state/EmptyState.tsx
@@ -0,0 +1,31 @@
+import { type ComponentType } from "react";
+import { type LucideProps } from "lucide-react";
+import { cn } from "@/lib/cn";
+import { SquareIcon } from "@/components/SquareIcon";
+import { isMacOS } from "@/lib/platform";
+
+// Knob to shift the centered main-window content up/down together.
+export const contentVerticalOffset = (): string => (isMacOS() ? "0.6rem" : "-1.4rem");
+export const contentTop = (base: string) => `calc(${base} + ${contentVerticalOffset()})`;
+
+type Props = {
+    icon: ComponentType<LucideProps>;
+    title: string;
+    description?: string;
+    className?: string;
+};
+
+export const EmptyState = ({ icon, title, description, className }: Props) => {
+    return (
+        <div className={cn("py-12 text-center", className)}>
+            <div
+                className={"relative mx-auto flex max-w-sm flex-col items-center justify-start"}
+                style={{ top: contentTop("7.8rem") }}
+            >
+                <SquareIcon icon={icon} className={"mb-3"} />
+                <p className={"mb-1 text-[0.95rem] font-medium text-nb-gray-200"}>{title}</p>
+                {description && <p className={"text-sm text-nb-gray-350"}>{description}</p>}
+            </div>
+        </div>
+    );
+};
diff --git a/client/ui/frontend/src/components/empty-state/NoResults.tsx b/client/ui/frontend/src/components/empty-state/NoResults.tsx
new file mode 100644
index 000000000..cf0995b37
--- /dev/null
+++ b/client/ui/frontend/src/components/empty-state/NoResults.tsx
@@ -0,0 +1,22 @@
+import { type ComponentType } from "react";
+import { FunnelXIcon, type LucideProps } from "lucide-react";
+import { useTranslation } from "react-i18next";
+import { EmptyState } from "./EmptyState";
+
+type Props = {
+    icon?: ComponentType<LucideProps>;
+    title?: string;
+    description?: string;
+};
+
+export const NoResults = ({ icon = FunnelXIcon, title, description }: Props) => {
+    const { t } = useTranslation();
+    return (
+        <EmptyState
+            icon={icon}
+            title={title ?? t("common.noResults.title")}
+            description={description ?? t("common.noResults.description")}
+            className={"pointer-events-none relative -top-[3.8rem]"}
+        />
+    );
+};
diff --git a/client/ui/frontend/src/components/empty-state/NotConnectedState.tsx b/client/ui/frontend/src/components/empty-state/NotConnectedState.tsx
new file mode 100644
index 000000000..2bcf70376
--- /dev/null
+++ b/client/ui/frontend/src/components/empty-state/NotConnectedState.tsx
@@ -0,0 +1,16 @@
+import { GlobeOffIcon } from "lucide-react";
+import { useTranslation } from "react-i18next";
+import { EmptyState } from "./EmptyState";
+
+export const NotConnectedState = () => {
+    const { t } = useTranslation();
+    return (
+        <div className={"relative top-[3rem] w-full"}>
+            <EmptyState
+                icon={GlobeOffIcon}
+                title={t("notConnected.title")}
+                description={t("notConnected.description")}
+            />
+        </div>
+    );
+};
diff --git a/client/ui/frontend/src/components/inputs/Input.tsx b/client/ui/frontend/src/components/inputs/Input.tsx
new file mode 100644
index 000000000..2dad80d7a
--- /dev/null
+++ b/client/ui/frontend/src/components/inputs/Input.tsx
@@ -0,0 +1,374 @@
+import { cva, type VariantProps } from "class-variance-authority";
+import { Check, ChevronDown, ChevronUp, Copy, Eye, EyeOff } from "lucide-react";
+import {
+    forwardRef,
+    type InputHTMLAttributes,
+    type ReactNode,
+    useEffect,
+    useId,
+    useRef,
+    useState,
+} from "react";
+import { useTranslation } from "react-i18next";
+import { cn } from "@/lib/cn";
+import { Label } from "@/components/typography/Label";
+
+type InputVariants = VariantProps<typeof inputVariants>;
+
+export interface InputProps extends InputHTMLAttributes<HTMLInputElement>, InputVariants {
+    label?: string;
+    customPrefix?: ReactNode;
+    customSuffix?: ReactNode;
+    maxWidthClass?: string;
+    icon?: ReactNode;
+    error?: string;
+    warning?: string;
+    prefixClassName?: string;
+    showPasswordToggle?: boolean;
+    copy?: boolean;
+}
+
+const inputVariants = cva("", {
+    variants: {
+        variant: {
+            default: [
+                "border-neutral-200 placeholder:text-neutral-500 dark:border-nb-gray-700 dark:bg-nb-gray-900 dark:placeholder:text-neutral-400/70",
+                "ring-offset-neutral-200/20 focus-visible:ring-neutral-300/10 dark:ring-offset-neutral-950/50 dark:focus-visible:ring-neutral-500/20",
+            ],
+            darker: [
+                "border-neutral-300 placeholder:text-neutral-500 dark:border-nb-gray-800 dark:bg-nb-gray-920 dark:placeholder:text-neutral-400/70",
+                "ring-offset-neutral-200/20 focus-visible:ring-neutral-300/10 dark:ring-offset-neutral-950/50 dark:focus-visible:ring-neutral-500/20",
+            ],
+            error: [
+                "border-neutral-200 text-red-500 placeholder:text-neutral-500 dark:border-red-500 dark:bg-nb-gray-900 dark:placeholder:text-neutral-400/70",
+                "ring-offset-red-500/10 focus-visible:ring-red-500/10 dark:ring-offset-red-500/10 dark:focus-visible:ring-red-500/10",
+            ],
+            warning: [
+                "border-neutral-200 text-orange-400 placeholder:text-neutral-500 dark:border-orange-400 dark:bg-nb-gray-900 dark:placeholder:text-neutral-400/70",
+                "ring-offset-orange-400/10 focus-visible:ring-orange-400/10 dark:ring-offset-orange-400/10 dark:focus-visible:ring-orange-400/10",
+            ],
+        },
+        prefixSuffixVariant: {
+            default: [
+                "border-neutral-200 text-nb-gray-300 dark:border-nb-gray-700 dark:bg-nb-gray-900",
+            ],
+            error: ["border-red-500 text-nb-gray-300 text-red-500 dark:bg-nb-gray-900"],
+        },
+    },
+});
+
+function computeNextStepValue(el: HTMLInputElement, delta: 1 | -1): number {
+    const stepAttr = el.step === "" ? 1 : Number(el.step);
+    const step = Number.isFinite(stepAttr) && stepAttr > 0 ? stepAttr : 1;
+    const min = el.min === "" ? -Infinity : Number(el.min);
+    const max = el.max === "" ? Infinity : Number(el.max);
+    const current = el.value === "" ? 0 : Number(el.value);
+    let next = (Number.isFinite(current) ? current : 0) + delta * step;
+    if (next < min) next = min;
+    if (next > max) next = max;
+    return next;
+}
+
+function buildInputClassName(
+    opts: Readonly<{
+        variant: InputVariants["variant"];
+        hasCustomPrefix: boolean;
+        hasSuffix: boolean;
+        hasIcon: boolean;
+        readOnly?: boolean;
+        showStepper: boolean;
+        className?: string;
+    }>,
+): string {
+    return cn(
+        inputVariants({ variant: opts.variant }),
+        "flex h-[40px] w-full select-text rounded-md bg-white px-3 py-2 text-sm",
+        "file:border-0 file:bg-transparent file:text-sm file:font-medium",
+        "focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-offset-2",
+        "disabled:cursor-not-allowed disabled:opacity-40",
+        opts.hasCustomPrefix && "!rounded-l-none !border-l-0",
+        opts.hasSuffix && "!pr-9",
+        opts.hasIcon && "!pl-10",
+        "border",
+        opts.readOnly && "!border-nb-gray-800 !bg-nb-gray-910 text-nb-gray-350",
+        opts.showStepper &&
+            "!rounded-r-none [-moz-appearance:textfield] [&::-webkit-inner-spin-button]:appearance-none [&::-webkit-outer-spin-button]:appearance-none",
+        opts.className,
+    );
+}
+
+function InputAffix({
+    content,
+    error,
+    disabled,
+    className,
+}: Readonly<{ content: ReactNode; error?: string; disabled?: boolean; className?: string }>) {
+    return (
+        <div
+            className={cn(
+                inputVariants({ prefixSuffixVariant: error ? "error" : "default" }),
+                "flex h-[40px] w-auto rounded-l-md bg-white px-3 py-2 text-sm",
+                "items-center whitespace-nowrap border",
+                disabled && "opacity-40",
+                className,
+            )}
+        >
+            {content}
+        </div>
+    );
+}
+
+function InputIconSlot({ icon, disabled }: Readonly<{ icon: ReactNode; disabled?: boolean }>) {
+    return (
+        <div
+            className={cn(
+                "absolute left-0 top-0 flex h-full items-center pl-3 text-xs leading-[0] dark:text-nb-gray-300",
+                disabled && "opacity-40",
+            )}
+        >
+            {icon}
+        </div>
+    );
+}
+
+function InputSuffixSlot({
+    suffix,
+    disabled,
+}: Readonly<{ suffix: ReactNode; disabled?: boolean }>) {
+    return (
+        <div
+            className={cn(
+                "pointer-events-none absolute right-0 top-0 flex h-full select-none items-center pr-3 text-xs leading-[0] dark:text-nb-gray-300",
+                disabled && "opacity-30",
+            )}
+        >
+            {suffix}
+        </div>
+    );
+}
+
+function NumberStepper({
+    error,
+    disabled,
+    onStep,
+}: Readonly<{ error?: string; disabled?: boolean; onStep: (delta: 1 | -1) => void }>) {
+    const { t } = useTranslation();
+    return (
+        <div
+            className={cn(
+                "flex h-[40px] shrink-0 flex-col overflow-hidden",
+                "rounded-r-md border border-l-0",
+                "border-neutral-200 dark:border-nb-gray-700 dark:bg-nb-gray-900",
+                error && "dark:border-red-500",
+                disabled && "pointer-events-none opacity-40",
+            )}
+        >
+            <button
+                type={"button"}
+                tabIndex={-1}
+                aria-label={t("common.increase")}
+                onClick={() => onStep(1)}
+                className={
+                    "flex w-9 flex-1 cursor-default items-center justify-center text-nb-gray-300 transition-colors hover:bg-nb-gray-800"
+                }
+            >
+                <ChevronUp size={12} aria-hidden={"true"} />
+            </button>
+            <button
+                type={"button"}
+                tabIndex={-1}
+                aria-label={t("common.decrease")}
+                onClick={() => onStep(-1)}
+                className={cn(
+                    "flex w-9 flex-1 cursor-default items-center justify-center text-nb-gray-300 transition-colors hover:bg-nb-gray-800",
+                    "border-t border-neutral-200 dark:border-nb-gray-700",
+                )}
+            >
+                <ChevronDown size={12} aria-hidden={"true"} />
+            </button>
+        </div>
+    );
+}
+
+function FieldMessage({
+    id,
+    error,
+    warning,
+}: Readonly<{ id?: string; error?: string; warning?: string }>) {
+    if (!error && !warning) return null;
+    return (
+        <span
+            id={id}
+            role={error ? "alert" : "status"}
+            className={cn(
+                "mt-2 inline-flex items-center gap-1 text-xs",
+                error ? "text-red-500" : "text-orange-400",
+            )}
+        >
+            {error ?? warning}
+        </span>
+    );
+}
+
+export const Input = forwardRef<HTMLInputElement, InputProps>(function Input(
+    {
+        className,
+        type,
+        label,
+        customSuffix,
+        customPrefix,
+        icon,
+        maxWidthClass = "",
+        error,
+        warning,
+        variant = "default",
+        prefixClassName,
+        showPasswordToggle = false,
+        copy = false,
+        id,
+        ...props
+    },
+    ref,
+) {
+    const { t } = useTranslation();
+    const [showPassword, setShowPassword] = useState(false);
+    const [copied, setCopied] = useState(false);
+    const isPasswordType = type === "password";
+    const inputType = isPasswordType && showPassword ? "text" : type;
+    const isNumber = type === "number";
+
+    const reactId = useId();
+    const fallbackId = `input-${reactId}`;
+    const inputId = id ?? (label ? fallbackId : undefined);
+    const messageId = error || warning ? `${inputId ?? fallbackId}-message` : undefined;
+
+    const copyTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
+    useEffect(
+        () => () => {
+            if (copyTimer.current) clearTimeout(copyTimer.current);
+        },
+        [],
+    );
+
+    const internalRef = useRef<HTMLInputElement | null>(null);
+    const setRefs = (el: HTMLInputElement | null) => {
+        internalRef.current = el;
+        if (typeof ref === "function") ref(el);
+        else if (ref) ref.current = el;
+    };
+
+    const stepBy = (delta: 1 | -1) => {
+        const el = internalRef.current;
+        if (!el || el.disabled || el.readOnly) return;
+        const setter = Object.getOwnPropertyDescriptor(
+            globalThis.HTMLInputElement.prototype,
+            "value",
+        )?.set;
+        const next = computeNextStepValue(el, delta);
+        setter?.call(el, String(next));
+        el.dispatchEvent(new Event("input", { bubbles: true }));
+    };
+
+    const passwordToggle =
+        isPasswordType && showPasswordToggle ? (
+            <button
+                type={"button"}
+                onClick={() => setShowPassword((s) => !s)}
+                className={"pointer-events-auto transition-all hover:text-white"}
+                aria-label={t("common.togglePasswordVisibility")}
+                aria-pressed={showPassword}
+            >
+                {showPassword ? (
+                    <EyeOff size={18} aria-hidden={"true"} />
+                ) : (
+                    <Eye size={18} aria-hidden={"true"} />
+                )}
+            </button>
+        ) : null;
+
+    const onCopy = async () => {
+        const text = props.value == null ? (internalRef.current?.value ?? "") : String(props.value);
+        if (!text) return;
+        try {
+            await navigator.clipboard.writeText(text);
+            setCopied(true);
+            if (copyTimer.current) clearTimeout(copyTimer.current);
+            copyTimer.current = setTimeout(() => setCopied(false), 1500);
+        } catch (e) {
+            console.warn("copy to clipboard failed", e);
+        }
+    };
+
+    const copyToggle = copy ? (
+        <button
+            type={"button"}
+            onClick={onCopy}
+            className={"pointer-events-auto transition-all hover:text-white"}
+            aria-label={t("common.copy")}
+        >
+            {copied ? (
+                <Check size={16} aria-hidden={"true"} />
+            ) : (
+                <Copy size={16} aria-hidden={"true"} />
+            )}
+        </button>
+    ) : null;
+
+    const suffix = passwordToggle || copyToggle || customSuffix;
+    const showStepper = isNumber;
+    const warningVariant = warning ? "warning" : variant;
+    const resolvedVariant = error ? "error" : warningVariant;
+
+    const inputClassName = buildInputClassName({
+        variant: resolvedVariant,
+        hasCustomPrefix: !!customPrefix,
+        hasSuffix: !!suffix,
+        hasIcon: !!icon,
+        readOnly: props.readOnly,
+        showStepper,
+        className,
+    });
+
+    return (
+        <div className={"flex w-full min-w-0 flex-col"}>
+            {label && <Label htmlFor={inputId}>{label}</Label>}
+            <div className={cn("relative flex h-[40px] w-full", maxWidthClass)}>
+                {customPrefix && (
+                    <InputAffix
+                        content={customPrefix}
+                        error={error}
+                        disabled={props.disabled}
+                        className={prefixClassName}
+                    />
+                )}
+
+                {icon && <InputIconSlot icon={icon} disabled={props.disabled} />}
+
+                <div className={"relative flex min-w-0 flex-grow"}>
+                    <input
+                        id={inputId}
+                        type={inputType}
+                        ref={setRefs}
+                        aria-invalid={error ? true : undefined}
+                        aria-describedby={
+                            messageId
+                                ? [props["aria-describedby"], messageId].filter(Boolean).join(" ")
+                                : props["aria-describedby"]
+                        }
+                        {...props}
+                        className={inputClassName}
+                    />
+
+                    {suffix && <InputSuffixSlot suffix={suffix} disabled={props.disabled} />}
+                </div>
+
+                {showStepper && (
+                    <NumberStepper error={error} disabled={props.disabled} onStep={stepBy} />
+                )}
+            </div>
+            <FieldMessage id={messageId} error={error} warning={warning} />
+        </div>
+    );
+});
+
+export default Input;
diff --git a/client/ui/frontend/src/components/inputs/SearchInput.tsx b/client/ui/frontend/src/components/inputs/SearchInput.tsx
new file mode 100644
index 000000000..5f46e8fba
--- /dev/null
+++ b/client/ui/frontend/src/components/inputs/SearchInput.tsx
@@ -0,0 +1,59 @@
+import { forwardRef, type InputHTMLAttributes, type ReactNode } from "react";
+import { useTranslation } from "react-i18next";
+import { SearchIcon } from "lucide-react";
+import { cn } from "@/lib/cn";
+
+type Props = InputHTMLAttributes<HTMLInputElement> & {
+    iconSize?: number;
+    shortcut?: ReactNode;
+};
+
+export const SearchInput = forwardRef<HTMLInputElement, Props>(function SearchInput(
+    { iconSize = 16, className, disabled, shortcut, "aria-label": ariaLabel, ...props },
+    ref,
+) {
+    const { t } = useTranslation();
+    return (
+        <div
+            role={"search"}
+            className={cn("flex h-10 items-center gap-2 px-1", disabled && "opacity-50")}
+        >
+            <SearchIcon
+                size={iconSize}
+                aria-hidden={"true"}
+                className={"shrink-0 text-nb-gray-300"}
+            />
+            <input
+                ref={ref}
+                type={"search"}
+                disabled={disabled}
+                aria-label={ariaLabel ?? props.placeholder ?? t("common.search")}
+                autoCorrect={"off"}
+                autoCapitalize={"off"}
+                spellCheck={false}
+                {...props}
+                className={cn(
+                    "w-full bg-transparent text-sm text-nb-gray-200 placeholder:text-nb-gray-400",
+                    "border-none outline-none",
+                    disabled && "cursor-not-allowed",
+                    className,
+                )}
+            />
+            {shortcut && (
+                <span
+                    aria-hidden={"true"}
+                    className={cn(
+                        "shrink-0 select-none",
+                        "inline-flex items-center justify-center",
+                        "h-5 min-w-[20px] rounded px-1.5",
+                        "border border-nb-gray-850 bg-nb-gray-920",
+                        "text-[10px] font-medium text-nb-gray-400",
+                        "wails-no-draggable",
+                    )}
+                >
+                    {shortcut}
+                </span>
+            )}
+        </div>
+    );
+});
diff --git a/client/ui/frontend/src/components/switches/FancyToggleSwitch.tsx b/client/ui/frontend/src/components/switches/FancyToggleSwitch.tsx
new file mode 100644
index 000000000..45e3e333a
--- /dev/null
+++ b/client/ui/frontend/src/components/switches/FancyToggleSwitch.tsx
@@ -0,0 +1,102 @@
+import React from "react";
+import { HelpText } from "@/components/typography/HelpText";
+import { Label } from "@/components/typography/Label";
+import { ToggleSwitch } from "@/components/switches/ToggleSwitch";
+import { cn } from "@/lib/cn";
+
+interface Props {
+    value: boolean;
+    onChange: (value: boolean) => void;
+    helpText?: React.ReactNode;
+    label?: React.ReactNode;
+    children?: React.ReactNode;
+    disabled?: boolean;
+    loading?: boolean;
+    dataCy?: string;
+    className?: string;
+    labelClassName?: string;
+    textWrapperClassName?: string;
+}
+
+export default function FancyToggleSwitch({
+    value,
+    onChange,
+    helpText,
+    label,
+    children,
+    disabled = false,
+    loading = false,
+    dataCy,
+    className,
+    labelClassName,
+    textWrapperClassName = "max-w-lg",
+}: Readonly<Props>) {
+    const switchId = React.useId();
+    const descriptionId = React.useId();
+
+    if (loading) {
+        const shimmer =
+            "text-transparent select-none rounded bg-[#25282d] box-decoration-clone animate-pulse";
+        return (
+            <div
+                role={"status"}
+                aria-busy={"true"}
+                aria-live={"polite"}
+                className={cn("inline-block w-full text-left", className)}
+            >
+                <div className={"flex justify-between gap-10"}>
+                    <div className={cn(textWrapperClassName)}>
+                        <Label className={labelClassName}>
+                            <span className={shimmer}>{label}</span>
+                        </Label>
+                        <HelpText margin={false}>
+                            <span className={cn(shimmer, "text-[0.6rem] leading-relaxed")}>
+                                {helpText}
+                            </span>
+                        </HelpText>
+                    </div>
+                    <div className={"mt-2 pr-1"}>
+                        <div
+                            aria-hidden={"true"}
+                            className={"h-[24px] w-[44px] animate-pulse rounded-full bg-[#25282d]"}
+                        />
+                    </div>
+                </div>
+            </div>
+        );
+    }
+
+    return (
+        <div
+            {...(disabled ? { inert: "" } : {})}
+            className={cn(
+                "relative z-[1] cursor-default transition-all duration-300",
+                "inline-block w-full text-left",
+                disabled && "pointer-events-none opacity-30",
+                className,
+            )}
+        >
+            <div className={"flex justify-between gap-10"}>
+                <div className={cn(textWrapperClassName)}>
+                    <Label htmlFor={switchId} className={labelClassName}>
+                        {label}
+                    </Label>
+                    <HelpText margin={false}>
+                        <span id={descriptionId}>{helpText}</span>
+                    </HelpText>
+                </div>
+                <div className={"mt-2 pr-1"}>
+                    <ToggleSwitch
+                        id={switchId}
+                        checked={value}
+                        onCheckedChange={onChange}
+                        disabled={disabled}
+                        dataCy={dataCy}
+                        aria-describedby={helpText ? descriptionId : undefined}
+                    />
+                </div>
+            </div>
+            {children && value ? <div className={"mt-4"}>{children}</div> : null}
+        </div>
+    );
+}
diff --git a/client/ui/frontend/src/components/switches/SwitchItem.tsx b/client/ui/frontend/src/components/switches/SwitchItem.tsx
new file mode 100644
index 000000000..e23c73fe3
--- /dev/null
+++ b/client/ui/frontend/src/components/switches/SwitchItem.tsx
@@ -0,0 +1,42 @@
+import * as RadioGroup from "@radix-ui/react-radio-group";
+import { motion } from "framer-motion";
+import { type ReactNode } from "react";
+import { cn } from "@/lib/cn";
+import { useSwitchItemGroup } from "@/components/switches/SwitchItemGroup";
+
+type Props = {
+    value: string;
+    children: ReactNode;
+    className?: string;
+};
+
+export const SwitchItem = ({ value, children, className }: Props) => {
+    const { value: activeValue, layoutId } = useSwitchItemGroup();
+    const active = activeValue === value;
+
+    return (
+        <RadioGroup.Item
+            value={value}
+            className={cn(
+                "relative inline-flex items-center justify-center gap-1 rounded-md px-3.5 py-2 text-xs font-semibold",
+                "cursor-default outline-none",
+                "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                active
+                    ? "text-nb-gray-100"
+                    : "text-nb-gray-400 hover:text-nb-gray-200 active:text-nb-gray-100",
+                className,
+            )}
+        >
+            {active && (
+                <motion.span
+                    layoutId={layoutId}
+                    className={"absolute inset-0 rounded-md bg-nb-gray-700"}
+                    transition={{ type: "spring", stiffness: 500, damping: 35 }}
+                />
+            )}
+            <span className={"relative inline-flex items-center justify-center gap-1"}>
+                {children}
+            </span>
+        </RadioGroup.Item>
+    );
+};
diff --git a/client/ui/frontend/src/components/switches/SwitchItemGroup.tsx b/client/ui/frontend/src/components/switches/SwitchItemGroup.tsx
new file mode 100644
index 000000000..b4361d530
--- /dev/null
+++ b/client/ui/frontend/src/components/switches/SwitchItemGroup.tsx
@@ -0,0 +1,60 @@
+import * as RadioGroup from "@radix-ui/react-radio-group";
+import { createContext, type ReactNode, useContext, useId, useMemo } from "react";
+import { cn } from "@/lib/cn";
+
+type SwitchItemGroupContextValue = {
+    value: string;
+    layoutId: string;
+};
+
+const SwitchItemGroupContext = createContext<SwitchItemGroupContextValue | null>(null);
+
+export const useSwitchItemGroup = () => {
+    const ctx = useContext(SwitchItemGroupContext);
+    if (!ctx) {
+        throw new Error("SwitchItem must be used inside a SwitchItemGroup");
+    }
+    return ctx;
+};
+
+type Props = {
+    value: string;
+    onChange: (value: string) => void;
+    children: ReactNode;
+    className?: string;
+    disabled?: boolean;
+    "aria-label"?: string;
+    "aria-labelledby"?: string;
+};
+
+export const SwitchItemGroup = ({
+    value,
+    onChange,
+    children,
+    className,
+    disabled = false,
+    "aria-label": ariaLabel,
+    "aria-labelledby": ariaLabelledBy,
+}: Props) => {
+    const layoutId = useId();
+    const contextValue = useMemo(() => ({ value, layoutId }), [value, layoutId]);
+
+    return (
+        <SwitchItemGroupContext.Provider value={contextValue}>
+            <RadioGroup.Root
+                value={value}
+                onValueChange={onChange}
+                disabled={disabled}
+                aria-label={ariaLabel}
+                aria-labelledby={ariaLabelledBy}
+                className={cn(
+                    "flex shrink-0 overflow-hidden rounded-lg border border-nb-gray-850 bg-nb-gray-910 p-1",
+                    disabled && "pointer-events-none opacity-50",
+                    className,
+                )}
+            >
+                {children}
+            </RadioGroup.Root>
+        </SwitchItemGroupContext.Provider>
+    );
+};
diff --git a/client/ui/frontend/src/components/switches/ToggleSwitch.tsx b/client/ui/frontend/src/components/switches/ToggleSwitch.tsx
new file mode 100644
index 000000000..2d9f597e6
--- /dev/null
+++ b/client/ui/frontend/src/components/switches/ToggleSwitch.tsx
@@ -0,0 +1,77 @@
+"use client";
+
+import * as SwitchPrimitives from "@radix-ui/react-switch";
+import { cva, type VariantProps } from "class-variance-authority";
+import * as React from "react";
+import { cn } from "@/lib/cn";
+
+type SwitchVariants = VariantProps<typeof switchVariants>;
+
+const switchVariants = cva("", {
+    variants: {
+        size: {
+            default: "h-[24px] w-[44px]",
+            small: "h-[18px] w-[36px]",
+            large: "h-[36px] w-[66px]",
+        },
+        variant: {
+            default: [
+                "dark:data-[state=checked]:bg-netbird dark:data-[state=unchecked]:bg-nb-gray-700",
+                "dark:data-[state=checked]:hover:bg-netbird-500 dark:data-[state=unchecked]:hover:bg-nb-gray-600",
+                "data-[state=checked]:bg-neutral-900 data-[state=unchecked]:bg-neutral-200",
+                "data-[state=checked]:hover:bg-neutral-800 data-[state=unchecked]:hover:bg-neutral-300",
+            ],
+            "red-green": [
+                "dark:data-[state=checked]:bg-red-600 dark:data-[state=unchecked]:bg-nb-gray-700",
+                "dark:data-[state=checked]:hover:bg-red-500 dark:data-[state=unchecked]:hover:bg-nb-gray-600",
+                "data-[state=checked]:bg-red-500 data-[state=unchecked]:bg-red-200",
+                "data-[state=checked]:hover:bg-red-400 data-[state=unchecked]:hover:bg-red-300",
+            ],
+            red: [
+                "dark:data-[state=checked]:bg-red-600 dark:data-[state=unchecked]:bg-nb-gray-700",
+                "dark:data-[state=checked]:hover:bg-red-500 dark:data-[state=unchecked]:hover:bg-nb-gray-600",
+                "data-[state=checked]:bg-red-500 data-[state=unchecked]:bg-red-200",
+                "data-[state=checked]:hover:bg-red-400 data-[state=unchecked]:hover:bg-red-300",
+            ],
+        },
+        "thumb-size": {
+            default:
+                "h-5 w-5 data-[state=checked]:translate-x-5 data-[state=unchecked]:translate-x-0",
+            small: "h-[14px] w-[14px] data-[state=checked]:translate-x-[17px] data-[state=unchecked]:translate-x-0",
+            large: "h-[30px] w-[30px] data-[state=checked]:translate-x-[31px] data-[state=unchecked]:translate-x-[1px]",
+        },
+    },
+});
+
+const ToggleSwitch = React.forwardRef<
+    React.ElementRef<typeof SwitchPrimitives.Root>,
+    React.ComponentPropsWithoutRef<typeof SwitchPrimitives.Root> &
+        SwitchVariants & { dataCy?: string }
+>(({ className, size = "default", variant = "default", dataCy, disabled, ...props }, ref) => (
+    <SwitchPrimitives.Root
+        disabled={disabled}
+        tabIndex={disabled ? -1 : 0}
+        className={cn(
+            "wails-no-draggable peer inline-flex shrink-0 cursor-default items-center rounded-full border-2 border-transparent transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940 disabled:cursor-not-allowed disabled:opacity-50",
+            className,
+            switchVariants({ size, variant }),
+        )}
+        {...props}
+        data-cy={dataCy}
+        onClick={(e) => {
+            e.stopPropagation();
+            props.onClick?.(e);
+        }}
+        ref={ref}
+    >
+        <SwitchPrimitives.Thumb
+            className={cn(
+                switchVariants({ "thumb-size": size }),
+                "pointer-events-none block rounded-full bg-white shadow-lg ring-0 transition-transform dark:bg-white",
+            )}
+        />
+    </SwitchPrimitives.Root>
+));
+ToggleSwitch.displayName = SwitchPrimitives.Root.displayName;
+
+export { ToggleSwitch };
diff --git a/client/ui/frontend/src/components/typography/HelpText.tsx b/client/ui/frontend/src/components/typography/HelpText.tsx
new file mode 100644
index 000000000..8c52ff714
--- /dev/null
+++ b/client/ui/frontend/src/components/typography/HelpText.tsx
@@ -0,0 +1,24 @@
+import { type ReactNode } from "react";
+import { cn } from "@/lib/cn";
+
+type Props = {
+    children?: ReactNode;
+    margin?: boolean;
+    className?: string;
+    disabled?: boolean;
+};
+
+export const HelpText = ({ children, margin = true, className, disabled = false }: Props) => (
+    <span
+        className={cn(
+            "block text-[.81rem] font-light tracking-wide transition-all duration-300 dark:text-nb-gray-300",
+            margin && "mb-2",
+            disabled && "pointer-events-none opacity-30",
+            className,
+        )}
+    >
+        {children}
+    </span>
+);
+
+export default HelpText;
diff --git a/client/ui/frontend/src/components/typography/Label.tsx b/client/ui/frontend/src/components/typography/Label.tsx
new file mode 100644
index 000000000..a8e1a446f
--- /dev/null
+++ b/client/ui/frontend/src/components/typography/Label.tsx
@@ -0,0 +1,42 @@
+import * as LabelPrimitive from "@radix-ui/react-label";
+import { cva, type VariantProps } from "class-variance-authority";
+import { type ComponentPropsWithoutRef, forwardRef, type Ref } from "react";
+import { cn } from "@/lib/cn";
+
+const labelVariants = cva(
+    "mb-1.5 inline-block flex items-center gap-2 text-sm font-medium leading-none tracking-wider peer-disabled:cursor-not-allowed peer-disabled:opacity-70 dark:text-nb-gray-100",
+);
+
+type LabelProps = ComponentPropsWithoutRef<typeof LabelPrimitive.Root> &
+    VariantProps<typeof labelVariants> & {
+        as?: "label" | "div";
+        disabled?: boolean;
+    };
+
+export const Label = forwardRef<HTMLElement, LabelProps>(function Label(
+    { className, as = "label", disabled = false, children, ...props },
+    ref,
+) {
+    const classes = cn(
+        labelVariants(),
+        className,
+        "select-none transition-all duration-300",
+        disabled && "pointer-events-none opacity-30",
+    );
+
+    if (as === "div") {
+        return (
+            <div ref={ref as Ref<HTMLDivElement>} className={classes}>
+                {children}
+            </div>
+        );
+    }
+
+    return (
+        <LabelPrimitive.Root ref={ref as Ref<HTMLLabelElement>} className={classes} {...props}>
+            {children}
+        </LabelPrimitive.Root>
+    );
+});
+
+export default Label;
diff --git a/client/ui/frontend/src/contexts/ClientVersionContext.tsx b/client/ui/frontend/src/contexts/ClientVersionContext.tsx
new file mode 100644
index 000000000..c0699a9ee
--- /dev/null
+++ b/client/ui/frontend/src/contexts/ClientVersionContext.tsx
@@ -0,0 +1,114 @@
+import {
+    createContext,
+    useCallback,
+    useContext,
+    useEffect,
+    useMemo,
+    useRef,
+    useState,
+    type ReactNode,
+} from "react";
+import { Events } from "@wailsio/runtime";
+
+import { Update as UpdateSvc, WindowManager } from "@bindings/services";
+import type { State as UpdateState } from "@bindings/updater/models.js";
+import i18next from "@/lib/i18n";
+import { errorDialog, formatErrorMessage } from "@/lib/errors";
+
+const isDaemonUnavailable = (e: unknown): boolean => {
+    const msg = e instanceof Error ? e.message : String(e);
+    return msg.includes("code = Unavailable");
+};
+
+type ClientVersionContextValue = {
+    updateAvailable: boolean;
+    updateVersion: string | null;
+    enforced: boolean;
+    installing: boolean;
+    triggerUpdate: () => void;
+    updating: boolean;
+};
+
+const EVENT_UPDATE_STATE = "netbird:update:state";
+
+const emptyState: UpdateState = {
+    available: false,
+    version: "",
+    enforced: false,
+    installing: false,
+};
+
+const ClientVersionContext = createContext<ClientVersionContextValue | null>(null);
+
+export const useClientVersion = () => {
+    const ctx = useContext(ClientVersionContext);
+    if (!ctx) {
+        throw new Error("useClientVersion must be used inside ClientVersionProvider");
+    }
+    return ctx;
+};
+
+export const ClientVersionProvider = ({ children }: { children: ReactNode }) => {
+    const [state, setState] = useState<UpdateState>(emptyState);
+    const [updating, setUpdating] = useState(false);
+
+    useEffect(() => {
+        let cancelled = false;
+        UpdateSvc.GetState()
+            .then((s) => {
+                if (cancelled || !s) return;
+                setState(s);
+            })
+            .catch((e) => {
+                if (cancelled || isDaemonUnavailable(e)) return;
+                void errorDialog({
+                    Title: i18next.t("update.error.loadStateTitle"),
+                    Message: formatErrorMessage(e),
+                });
+            });
+        const off = Events.On(EVENT_UPDATE_STATE, (ev: { data: UpdateState }) => {
+            if (ev?.data) setState(ev.data);
+        });
+        return () => {
+            cancelled = true;
+            off?.();
+        };
+    }, []);
+
+    const prevInstallingRef = useRef(false);
+    useEffect(() => {
+        if (state.installing && !prevInstallingRef.current) {
+            WindowManager.OpenInstallProgress(state.version || "").catch(console.error);
+        }
+        prevInstallingRef.current = state.installing;
+    }, [state.installing, state.version]);
+
+    const triggerUpdate = useCallback(() => {
+        setUpdating(true);
+        WindowManager.OpenInstallProgress(state.version || "").catch(console.error);
+        UpdateSvc.Trigger()
+            .catch(async (e) => {
+                if (isDaemonUnavailable(e)) return;
+                WindowManager.CloseInstallProgress().catch(console.error);
+                await errorDialog({
+                    Title: i18next.t("update.error.triggerTitle"),
+                    Message: formatErrorMessage(e),
+                });
+            })
+            .finally(() => setUpdating(false));
+    }, [state.version]);
+
+    const value = useMemo<ClientVersionContextValue>(
+        () => ({
+            updateAvailable: state.available,
+            updateVersion: state.version || null,
+            enforced: state.enforced,
+            installing: state.installing,
+            triggerUpdate,
+            updating,
+        }),
+        [state, triggerUpdate, updating],
+    );
+
+    return <ClientVersionContext.Provider value={value}>{children}</ClientVersionContext.Provider>;
+};
diff --git a/client/ui/frontend/src/contexts/DebugBundleContext.tsx b/client/ui/frontend/src/contexts/DebugBundleContext.tsx
new file mode 100644
index 000000000..a0a131fbf
--- /dev/null
+++ b/client/ui/frontend/src/contexts/DebugBundleContext.tsx
@@ -0,0 +1,314 @@
+import { createContext, useContext, useEffect, useRef, useState, type ReactNode } from "react";
+import { Connection as ConnectionSvc, Debug as DebugSvc } from "@bindings/services";
+import type { DebugBundleResult } from "@bindings/services/models.js";
+import i18next from "@/lib/i18n";
+import { errorDialog, formatErrorMessage } from "@/lib/errors.ts";
+import { startConnection } from "@/lib/connection.ts";
+
+const NETBIRD_UPLOAD_URL = "https://upload.debug.netbird.io/upload-url";
+const TRACE_LOG_FILE_COUNT = 5;
+const PLAIN_LOG_FILE_COUNT = 1;
+const TRACE_LOG_LEVEL = "trace";
+const DEFAULT_LOG_LEVEL = "info";
+
+export type DebugStage =
+    | { kind: "idle" }
+    | { kind: "preparing-trace" }
+    | { kind: "reconnecting" }
+    | { kind: "capturing"; remainingSec: number; totalSec: number }
+    | { kind: "restoring-level" }
+    | { kind: "bundling" }
+    | { kind: "uploading" }
+    | { kind: "cancelling" }
+    | { kind: "done"; result: DebugBundleResult; uploadAttempted: boolean };
+
+const sleep = (ms: number, signal: AbortSignal) =>
+    new Promise<void>((resolve, reject) => {
+        if (signal.aborted) {
+            reject(new DOMException("aborted", "AbortError"));
+            return;
+        }
+        const onAbort = () => {
+            clearTimeout(id);
+            reject(new DOMException("aborted", "AbortError"));
+        };
+        const id = setTimeout(() => {
+            signal.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        signal.addEventListener("abort", onAbort);
+    });
+
+const isAbort = (e: unknown) => e instanceof DOMException && e.name === "AbortError";
+
+const throwIfAborted = (signal: AbortSignal) => {
+    if (signal.aborted) throw new DOMException("aborted", "AbortError");
+};
+
+const setLogLevelBestEffort = async (level: string) => {
+    try {
+        await DebugSvc.SetLogLevel({ level });
+    } catch (e) {
+        console.warn("[DebugBundle] best-effort set log level failed", e);
+    }
+};
+
+const stopCaptureBestEffort = async () => {
+    try {
+        await DebugSvc.StopBundleCapture();
+    } catch (e) {
+        console.warn("[DebugBundle] best-effort stop packet capture failed", e);
+    }
+};
+
+type LevelState = { original: string; raised: boolean };
+type CaptureState = { started: boolean };
+
+type BundleOptions = {
+    trace: boolean;
+    capture: boolean;
+    capturePackets: boolean;
+    hasWindow: boolean;
+    totalSec: number;
+    uploadUrl: string;
+    anonymize: boolean;
+    systemInfo: boolean;
+};
+
+const startCaptureBestEffort = async (totalSec: number, pcap: CaptureState) => {
+    try {
+        // Mirror the CLI's safety margin: window + 30s, server caps at 10m.
+        await DebugSvc.StartBundleCapture(totalSec + 30);
+        pcap.started = true;
+    } catch (e) {
+        console.warn("[DebugBundle] start packet capture failed", e);
+    }
+};
+
+const cleanupBestEffort = async (pcap: CaptureState, level: LevelState, restoreLevel: boolean) => {
+    if (pcap.started) {
+        await stopCaptureBestEffort();
+        pcap.started = false;
+    }
+    if (restoreLevel && level.raised) {
+        await setLogLevelBestEffort(level.original);
+    }
+};
+
+const raiseToTrace = async (
+    signal: AbortSignal,
+    level: LevelState,
+    setStage: (s: DebugStage) => void,
+) => {
+    setStage({ kind: "preparing-trace" });
+    try {
+        const cur = await DebugSvc.GetLogLevel();
+        if (cur?.level) level.original = cur.level;
+    } catch (e) {
+        console.warn("[DebugBundle] read current log level failed", e);
+    }
+    throwIfAborted(signal);
+    await DebugSvc.SetLogLevel({ level: TRACE_LOG_LEVEL });
+    level.raised = true;
+};
+
+const cycleConnection = async (signal: AbortSignal, setStage: (s: DebugStage) => void) => {
+    throwIfAborted(signal);
+    setStage({ kind: "reconnecting" });
+    try {
+        await ConnectionSvc.Down();
+    } catch (e) {
+        console.warn("[DebugBundle] disconnect before capture failed", e);
+    }
+    throwIfAborted(signal);
+    await startConnection(undefined, signal);
+};
+
+const restoreLogLevel = async (level: LevelState, setStage: (s: DebugStage) => void) => {
+    setStage({ kind: "restoring-level" });
+    try {
+        await DebugSvc.SetLogLevel({ level: level.original });
+        level.raised = false;
+    } catch (e) {
+        console.warn("[DebugBundle] restore log level failed", e);
+    }
+};
+
+const waitCaptureWindow = async (
+    signal: AbortSignal,
+    setStage: (s: DebugStage) => void,
+    totalSec: number,
+) => {
+    for (let remaining = totalSec; remaining > 0; remaining--) {
+        setStage({ kind: "capturing", remainingSec: remaining, totalSec });
+        await sleep(1000, signal);
+    }
+};
+
+const runBundleFlow = async (
+    signal: AbortSignal,
+    opts: BundleOptions,
+    level: LevelState,
+    pcap: CaptureState,
+    setStage: (s: DebugStage) => void,
+    setLastBundlePath: (p: string) => void,
+) => {
+    if (opts.trace) {
+        await raiseToTrace(signal, level, setStage);
+    }
+    throwIfAborted(signal);
+
+    if (opts.capture) {
+        await cycleConnection(signal, setStage);
+    }
+    throwIfAborted(signal);
+
+    if (opts.hasWindow && opts.capturePackets) {
+        await startCaptureBestEffort(opts.totalSec, pcap);
+    }
+    throwIfAborted(signal);
+
+    if (opts.hasWindow) {
+        await waitCaptureWindow(signal, setStage, opts.totalSec);
+    }
+
+    if (pcap.started) {
+        await stopCaptureBestEffort();
+        pcap.started = false;
+    }
+
+    if (level.raised) {
+        await restoreLogLevel(level, setStage);
+    }
+
+    throwIfAborted(signal);
+    setStage({ kind: "bundling" });
+    const logFileCount = opts.trace ? TRACE_LOG_FILE_COUNT : PLAIN_LOG_FILE_COUNT;
+
+    if (opts.uploadUrl) setStage({ kind: "uploading" });
+    const result = await DebugSvc.Bundle({
+        anonymize: opts.anonymize,
+        systemInfo: opts.systemInfo,
+        uploadUrl: opts.uploadUrl,
+        logFileCount,
+    });
+    throwIfAborted(signal);
+    if (result.path) setLastBundlePath(result.path);
+    setStage({ kind: "done", result, uploadAttempted: Boolean(opts.uploadUrl) });
+};
+
+const useDebugBundle = () => {
+    const [anonymize, setAnonymize] = useState(false);
+    const [systemInfo, setSystemInfo] = useState(true);
+    const [upload, setUpload] = useState(true);
+    const [trace, setTrace] = useState(true);
+    const [capture, setCapture] = useState(false);
+    const [traceMinutes, setTraceMinutes] = useState(1);
+    const [capturePackets, setCapturePackets] = useState(true);
+    const [stage, setStage] = useState<DebugStage>({ kind: "idle" });
+    const [lastBundlePath, setLastBundlePath] = useState<string>("");
+    const abortRef = useRef<AbortController | null>(null);
+
+    useEffect(() => {
+        return () => {
+            abortRef.current?.abort();
+        };
+    }, []);
+
+    const isRunning = stage.kind !== "idle" && stage.kind !== "done";
+
+    const reset = () => setStage({ kind: "idle" });
+
+    const cancel = () => {
+        if (!abortRef.current || abortRef.current.signal.aborted) return;
+        abortRef.current.abort();
+        setStage({ kind: "cancelling" });
+    };
+
+    const run = async () => {
+        const ctrl = new AbortController();
+        abortRef.current = ctrl;
+        const signal = ctrl.signal;
+
+        const totalSec = Math.max(1, Math.min(30, traceMinutes)) * 60;
+        const level: LevelState = { original: DEFAULT_LOG_LEVEL, raised: false };
+        const pcap: CaptureState = { started: false };
+        const opts: BundleOptions = {
+            trace,
+            capture,
+            capturePackets,
+            hasWindow: capture && totalSec > 0,
+            totalSec,
+            uploadUrl: upload ? NETBIRD_UPLOAD_URL : "",
+            anonymize,
+            systemInfo,
+        };
+
+        try {
+            await runBundleFlow(signal, opts, level, pcap, setStage, setLastBundlePath);
+        } catch (e) {
+            if (isAbort(e)) {
+                setStage({ kind: "cancelling" });
+                await cleanupBestEffort(pcap, level, true);
+                setStage({ kind: "idle" });
+                return;
+            }
+            await cleanupBestEffort(pcap, level, false);
+            setStage({ kind: "idle" });
+            await errorDialog({
+                Title: i18next.t("settings.error.debugBundleTitle"),
+                Message: formatErrorMessage(e),
+            });
+        } finally {
+            if (abortRef.current === ctrl) abortRef.current = null;
+        }
+    };
+
+    const openBundleDir = () => {
+        if (!lastBundlePath) return;
+        DebugSvc.RevealFile(lastBundlePath).catch((err: unknown) =>
+            console.error("[DebugBundleContext] reveal failed", err),
+        );
+    };
+
+    return {
+        anonymize,
+        setAnonymize,
+        systemInfo,
+        setSystemInfo,
+        upload,
+        setUpload,
+        trace,
+        setTrace,
+        capture,
+        setCapture,
+        traceMinutes,
+        setTraceMinutes,
+        capturePackets,
+        setCapturePackets,
+        stage,
+        isRunning,
+        lastBundlePath,
+        run,
+        cancel,
+        reset,
+        openBundleDir,
+    };
+};
+
+export type DebugBundleContextValue = ReturnType<typeof useDebugBundle>;
+
+const DebugBundleContext = createContext<DebugBundleContextValue | null>(null);
+
+export const DebugBundleProvider = ({ children }: { children: ReactNode }) => {
+    const value = useDebugBundle();
+    return <DebugBundleContext.Provider value={value}>{children}</DebugBundleContext.Provider>;
+};
+
+export const useDebugBundleContext = () => {
+    const ctx = useContext(DebugBundleContext);
+    if (!ctx) {
+        throw new Error("useDebugBundleContext must be used inside DebugBundleProvider");
+    }
+    return ctx;
+};
diff --git a/client/ui/frontend/src/contexts/DialogContext.tsx b/client/ui/frontend/src/contexts/DialogContext.tsx
new file mode 100644
index 000000000..8a52e0dd0
--- /dev/null
+++ b/client/ui/frontend/src/contexts/DialogContext.tsx
@@ -0,0 +1,68 @@
+import {
+    createContext,
+    type ReactNode,
+    useCallback,
+    useContext,
+    useMemo,
+    useRef,
+    useState,
+} from "react";
+import { ConfirmModal } from "@/components/dialog/ConfirmModal";
+
+export type ConfirmOptions = {
+    title: ReactNode;
+    description: ReactNode;
+    confirmLabel: string;
+    cancelLabel?: string;
+    danger?: boolean;
+};
+
+type DialogContextValue = {
+    confirm: (options: ConfirmOptions) => Promise<boolean>;
+};
+
+const DialogContext = createContext<DialogContextValue | null>(null);
+
+export function DialogProvider({ children }: Readonly<{ children: ReactNode }>) {
+    const [open, setOpen] = useState(false);
+    const [options, setOptions] = useState<ConfirmOptions | null>(null);
+    const resolverRef = useRef<((result: boolean) => void) | null>(null);
+
+    const confirm = useCallback((opts: ConfirmOptions) => {
+        setOptions(opts);
+        setOpen(true);
+        return new Promise<boolean>((resolve) => {
+            resolverRef.current = resolve;
+        });
+    }, []);
+
+    const settle = (result: boolean) => {
+        resolverRef.current?.(result);
+        resolverRef.current = null;
+        setOpen(false);
+    };
+
+    const value = useMemo<DialogContextValue>(() => ({ confirm }), [confirm]);
+
+    return (
+        <DialogContext.Provider value={value}>
+            {children}
+            <ConfirmModal
+                open={open}
+                title={options?.title ?? ""}
+                description={options?.description ?? ""}
+                confirmLabel={options?.confirmLabel ?? ""}
+                cancelLabel={options?.cancelLabel}
+                danger={options?.danger}
+                onConfirm={() => settle(true)}
+                onCancel={() => settle(false)}
+            />
+        </DialogContext.Provider>
+    );
+}
+
+export const useConfirm = () => {
+    const ctx = useContext(DialogContext);
+    if (!ctx) throw new Error("useConfirm must be used within a DialogProvider");
+    return ctx.confirm;
+};
diff --git a/client/ui/frontend/src/contexts/NavSectionContext.tsx b/client/ui/frontend/src/contexts/NavSectionContext.tsx
new file mode 100644
index 000000000..c08a3c824
--- /dev/null
+++ b/client/ui/frontend/src/contexts/NavSectionContext.tsx
@@ -0,0 +1,24 @@
+import { createContext, useContext, useMemo, useState, type ReactNode } from "react";
+
+export type NavSection = "peers" | "networks";
+
+type NavSectionContextValue = {
+    section: NavSection;
+    setSection: (s: NavSection) => void;
+};
+
+const NavSectionContext = createContext<NavSectionContextValue | null>(null);
+
+export const useNavSection = (): NavSectionContextValue => {
+    const ctx = useContext(NavSectionContext);
+    if (!ctx) {
+        throw new Error("useNavSection must be used inside NavSectionProvider");
+    }
+    return ctx;
+};
+
+export const NavSectionProvider = ({ children }: { children: ReactNode }) => {
+    const [section, setSection] = useState<NavSection>("peers");
+    const value = useMemo<NavSectionContextValue>(() => ({ section, setSection }), [section]);
+    return <NavSectionContext.Provider value={value}>{children}</NavSectionContext.Provider>;
+};
diff --git a/client/ui/frontend/src/contexts/NetworksContext.tsx b/client/ui/frontend/src/contexts/NetworksContext.tsx
new file mode 100644
index 000000000..ef7231700
--- /dev/null
+++ b/client/ui/frontend/src/contexts/NetworksContext.tsx
@@ -0,0 +1,222 @@
+import {
+    createContext,
+    useCallback,
+    useContext,
+    useEffect,
+    useMemo,
+    useRef,
+    useState,
+    type ReactNode,
+} from "react";
+import { Networks as NetworksSvc } from "@bindings/services";
+import type { Network } from "@bindings/services/models.js";
+import { useStatus } from "@/contexts/StatusContext";
+
+// A route that covers all traffic (0.0.0.0/0 or ::/0) is an exit node.
+// The daemon may merge a v4+v6 pair into a single comma-joined range string.
+export const isExitNode = (range: string): boolean =>
+    range.split(",").some((part) => {
+        const trimmed = part.trim();
+        return trimmed === "0.0.0.0/0" || trimmed === "::/0";
+    });
+
+type NetworksContextValue = {
+    routes: Network[];
+    networkRoutes: Network[];
+    exitNodes: Network[];
+    activeExitNode: Network | null;
+    refresh: () => Promise<void>;
+    toggleNetwork: (id: string, selected: boolean) => Promise<void>;
+    toggleExitNode: (id: string, selected: boolean) => Promise<void>;
+    setNetworksSelected: (ids: string[], selected: boolean) => Promise<void>;
+};
+
+const NetworksContext = createContext<NetworksContextValue | null>(null);
+
+export const useNetworks = () => {
+    const ctx = useContext(NetworksContext);
+    if (!ctx) {
+        throw new Error("useNetworks must be used inside NetworksProvider");
+    }
+    return ctx;
+};
+
+export const NetworksProvider = ({ children }: { children: ReactNode }) => {
+    const { status } = useStatus();
+    const [routes, setRoutes] = useState<Network[]>([]);
+    const [pending, setPending] = useState<Map<string, boolean>>(new Map());
+    const pendingRef = useRef(pending);
+    useEffect(() => {
+        pendingRef.current = pending;
+    }, [pending]);
+
+    // Safety timer: if a prediction diverges from the daemon, the override would mask the true value forever.
+    const STUCK_OVERRIDE_MS = 4000;
+    const timersRef = useRef<Map<string, ReturnType<typeof setTimeout>>>(new Map());
+
+    const clearTimer = useCallback((id: string) => {
+        const tid = timersRef.current.get(id);
+        if (tid !== undefined) {
+            clearTimeout(tid);
+            timersRef.current.delete(id);
+        }
+    }, []);
+
+    const clearPendingFor = useCallback(
+        (ids: string[]) => {
+            for (const id of ids) clearTimer(id);
+            setPending((prev) => {
+                if (ids.every((id) => !prev.has(id))) return prev;
+                const next = new Map(prev);
+                for (const id of ids) next.delete(id);
+                return next;
+            });
+        },
+        [clearTimer],
+    );
+
+    const setPendingFor = useCallback(
+        (updates: Array<[string, boolean]>) => {
+            setPending((prev) => {
+                const next = new Map(prev);
+                for (const [id, sel] of updates) next.set(id, sel);
+                return next;
+            });
+            for (const [id] of updates) {
+                clearTimer(id);
+                timersRef.current.set(
+                    id,
+                    setTimeout(() => clearPendingFor([id]), STUCK_OVERRIDE_MS),
+                );
+            }
+        },
+        [clearTimer, clearPendingFor],
+    );
+
+    useEffect(() => {
+        const timers = timersRef.current;
+        return () => {
+            for (const tid of timers.values()) clearTimeout(tid);
+            timers.clear();
+        };
+    }, []);
+
+    const refresh = useCallback(async () => {
+        try {
+            const list = await NetworksSvc.List();
+            setRoutes(list);
+        } catch (e) {
+            console.error("[NetworksContext] refresh failed", e);
+        }
+    }, []);
+
+    const networksRevision = status?.networksRevision;
+    useEffect(() => {
+        refresh().catch((err: unknown) => console.error("[NetworksContext] refresh failed", err));
+    }, [refresh, networksRevision]);
+
+    useEffect(() => {
+        if (pendingRef.current.size === 0) return;
+        const confirmed: string[] = [];
+        for (const r of routes) {
+            const expected = pendingRef.current.get(r.id);
+            if (expected !== undefined && r.selected === expected) {
+                confirmed.push(r.id);
+            }
+        }
+        if (confirmed.length > 0) clearPendingFor(confirmed);
+    }, [routes, clearPendingFor]);
+
+    const mutate = useCallback(
+        async (ids: string[], selected: boolean, rollback: Array<[string, boolean]>) => {
+            try {
+                if (selected) {
+                    await NetworksSvc.Select({ networkIds: ids, append: true, all: false });
+                } else {
+                    await NetworksSvc.Deselect({ networkIds: ids, append: false, all: false });
+                }
+                // Don't clear pending here — let the snapshot-match effect confirm, else a refresh racing the RPC return flashes back.
+                await refresh();
+            } catch (e) {
+                console.error(e);
+                setPending((prev) => {
+                    const next = new Map(prev);
+                    for (const [id] of rollback) next.delete(id);
+                    return next;
+                });
+                throw e;
+            }
+        },
+        [refresh],
+    );
+
+    const toggleNetwork = useCallback(
+        async (id: string, selected: boolean) => {
+            const target = !selected;
+            setPendingFor([[id, target]]);
+            await mutate([id], target, [[id, selected]]).catch(() => {});
+        },
+        [mutate, setPendingFor],
+    );
+
+    const setNetworksSelected = useCallback(
+        async (ids: string[], selected: boolean) => {
+            if (ids.length === 0) return;
+            const prevById = new Map(routes.map((r) => [r.id, r.selected]));
+            const rollback: Array<[string, boolean]> = ids.map((id) => [
+                id,
+                prevById.get(id) ?? !selected,
+            ]);
+            setPendingFor(ids.map((id) => [id, selected]));
+            await mutate(ids, selected, rollback).catch(() => {});
+        },
+        [mutate, setPendingFor, routes],
+    );
+
+    // Daemon enforces exit-node mutual exclusion; mirror it locally so the optimistic paint matches.
+    const toggleExitNode = useCallback(
+        async (id: string, selected: boolean) => {
+            const target = !selected;
+            const updates: Array<[string, boolean]> = [[id, target]];
+            const rollback: Array<[string, boolean]> = [[id, selected]];
+            if (target) {
+                for (const r of routes) {
+                    if (r.id !== id && isExitNode(r.range) && r.selected) {
+                        updates.push([r.id, false]);
+                        rollback.push([r.id, true]);
+                    }
+                }
+            }
+            setPendingFor(updates);
+            await mutate([id], target, rollback).catch(() => {});
+        },
+        [mutate, setPendingFor, routes],
+    );
+
+    const value = useMemo<NetworksContextValue>(() => {
+        const effective =
+            pending.size === 0
+                ? routes
+                : routes.map((r) => {
+                      const override = pending.get(r.id);
+                      return override === undefined || override === r.selected
+                          ? r
+                          : { ...r, selected: override };
+                  });
+        const networkRoutes = effective.filter((r) => !isExitNode(r.range));
+        const exitNodes = effective.filter((r) => isExitNode(r.range));
+        const activeExitNode = exitNodes.find((r) => r.selected) ?? null;
+        return {
+            routes: effective,
+            networkRoutes,
+            exitNodes,
+            activeExitNode,
+            refresh,
+            toggleNetwork,
+            toggleExitNode,
+            setNetworksSelected,
+        };
+    }, [routes, pending, refresh, toggleNetwork, toggleExitNode, setNetworksSelected]);
+
+    return <NetworksContext.Provider value={value}>{children}</NetworksContext.Provider>;
+};
diff --git a/client/ui/frontend/src/contexts/PeerDetailContext.tsx b/client/ui/frontend/src/contexts/PeerDetailContext.tsx
new file mode 100644
index 000000000..3ab20891f
--- /dev/null
+++ b/client/ui/frontend/src/contexts/PeerDetailContext.tsx
@@ -0,0 +1,50 @@
+import {
+    createContext,
+    useCallback,
+    useContext,
+    useMemo,
+    useRef,
+    useState,
+    type ReactNode,
+} from "react";
+import type { PeerStatus } from "@bindings/services/models.js";
+
+type PeerDetailContextValue = {
+    selected: PeerStatus | null;
+    setSelected: (p: PeerStatus | null) => void;
+};
+
+const PeerDetailContext = createContext<PeerDetailContextValue | null>(null);
+
+export const usePeerDetail = (): PeerDetailContextValue => {
+    const ctx = useContext(PeerDetailContext);
+    if (!ctx) {
+        throw new Error("usePeerDetail must be used inside PeerDetailProvider");
+    }
+    return ctx;
+};
+
+export const PeerDetailProvider = ({ children }: { children: ReactNode }) => {
+    const [selected, setSelected] = useState<PeerStatus | null>(null);
+    const openerRef = useRef<HTMLElement | null>(null);
+
+    const select = useCallback((p: PeerStatus | null) => {
+        if (p) {
+            const active = document.activeElement;
+            openerRef.current = active instanceof HTMLElement ? active : null;
+        } else {
+            const opener = openerRef.current;
+            openerRef.current = null;
+            if (opener?.isConnected) {
+                queueMicrotask(() => opener.focus());
+            }
+        }
+        setSelected(p);
+    }, []);
+
+    const value = useMemo<PeerDetailContextValue>(
+        () => ({ selected, setSelected: select }),
+        [selected, select],
+    );
+    return <PeerDetailContext.Provider value={value}>{children}</PeerDetailContext.Provider>;
+};
diff --git a/client/ui/frontend/src/contexts/ProfileContext.tsx b/client/ui/frontend/src/contexts/ProfileContext.tsx
new file mode 100644
index 000000000..4dd3eaa7a
--- /dev/null
+++ b/client/ui/frontend/src/contexts/ProfileContext.tsx
@@ -0,0 +1,182 @@
+import {
+    createContext,
+    useCallback,
+    useContext,
+    useEffect,
+    useMemo,
+    useRef,
+    useState,
+    type ReactNode,
+} from "react";
+import { Events } from "@wailsio/runtime";
+import { Connection, ProfileSwitcher, Profiles as ProfilesSvc } from "@bindings/services";
+import type { Profile } from "@bindings/services/models.js";
+import i18next from "@/lib/i18n";
+import { errorDialog, formatErrorMessage } from "@/lib/errors";
+
+const EVENT_PROFILE_CHANGED = "netbird:profile:changed";
+
+type ProfileContextValue = {
+    username: string;
+    // activeProfile is the display NAME of the active profile (for rendering
+    // and the "default" check). activeProfileId is its stable on-disk ID, used
+    // as the handle for daemon requests and for active-profile comparisons,
+    // since display names can collide.
+    activeProfile: string;
+    activeProfileId: string;
+    profiles: Profile[];
+    loaded: boolean;
+    refresh: () => Promise<void>;
+    switchProfile: (id: string) => Promise<void>;
+    addProfile: (name: string) => Promise<string>;
+    removeProfile: (id: string) => Promise<void>;
+    renameProfile: (id: string, newName: string) => Promise<void>;
+    logoutProfile: (id: string) => Promise<void>;
+};
+
+const ProfileContext = createContext<ProfileContextValue | null>(null);
+
+export const useProfile = () => {
+    const ctx = useContext(ProfileContext);
+    if (!ctx) {
+        throw new Error("useProfile must be used inside ProfileProvider");
+    }
+    return ctx;
+};
+
+export const ProfileProvider = ({ children }: { children: ReactNode }) => {
+    const [username, setUsername] = useState("");
+    const [activeProfile, setActiveProfile] = useState("");
+    const [activeProfileId, setActiveProfileId] = useState("");
+    const [profiles, setProfiles] = useState<Profile[]>([]);
+    const [loaded, setLoaded] = useState(false);
+    const retryRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+
+    const refresh = useCallback(async () => {
+        if (retryRef.current) {
+            clearTimeout(retryRef.current);
+            retryRef.current = null;
+        }
+        try {
+            const u = await ProfilesSvc.Username();
+            const [active, list] = await Promise.all([
+                ProfilesSvc.GetActive(),
+                ProfilesSvc.List(u),
+            ]);
+            setUsername(u);
+            setActiveProfile(active.profileName || "default");
+            setActiveProfileId(active.id || "default");
+            setProfiles(list);
+            setLoaded(true);
+        } catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            if (msg.includes("code = Unavailable")) {
+                retryRef.current = setTimeout(() => {
+                    void refresh();
+                }, 1000);
+                return;
+            }
+            setLoaded(true);
+            await errorDialog({
+                Title: i18next.t("profile.error.loadTitle"),
+                Message: formatErrorMessage(e),
+            });
+        }
+    }, []);
+
+    useEffect(() => {
+        refresh().catch((err: unknown) => console.error("[ProfileContext] refresh failed", err));
+        return () => {
+            if (retryRef.current) clearTimeout(retryRef.current);
+        };
+    }, [refresh]);
+
+    useEffect(() => {
+        const off = Events.On(EVENT_PROFILE_CHANGED, () => {
+            refresh().catch((err: unknown) =>
+                console.error("[ProfileContext] refresh failed", err),
+            );
+        });
+        return () => {
+            off();
+        };
+    }, [refresh]);
+
+    // id is a handle: the daemon resolves an exact ID, ID prefix, or unique
+    // display name. The UI passes the profile's ID for precision.
+    const switchProfile = useCallback(
+        async (id: string) => {
+            await ProfileSwitcher.SwitchActive({ profileName: id, username });
+            await refresh();
+        },
+        [username, refresh],
+    );
+
+    // addProfile creates a profile by display name and returns the
+    // daemon-generated ID, so the caller can immediately address it by ID.
+    const addProfile = useCallback(
+        async (name: string) => {
+            const id = await ProfilesSvc.Add({ profileName: name, username });
+            await refresh();
+            return id;
+        },
+        [username, refresh],
+    );
+
+    const removeProfile = useCallback(
+        async (id: string) => {
+            await ProfilesSvc.Remove({ profileName: id, username });
+            await refresh();
+        },
+        [username, refresh],
+    );
+
+    // The daemon resolves the handle (exact ID, ID prefix, or unique display
+    // name) — passing the ID is precise and avoids collisions on rename.
+    const renameProfile = useCallback(
+        async (id: string, newName: string) => {
+            await ProfilesSvc.Rename({ handle: id, newName, username });
+            await refresh();
+        },
+        [username, refresh],
+    );
+
+    const logoutProfile = useCallback(
+        async (id: string) => {
+            await Connection.Logout({ profileName: id, username });
+            await refresh();
+        },
+        [username, refresh],
+    );
+
+    const value = useMemo<ProfileContextValue>(
+        () => ({
+            username,
+            activeProfile,
+            activeProfileId,
+            profiles,
+            loaded,
+            refresh,
+            switchProfile,
+            addProfile,
+            removeProfile,
+            renameProfile,
+            logoutProfile,
+        }),
+        [
+            username,
+            activeProfile,
+            activeProfileId,
+            profiles,
+            loaded,
+            refresh,
+            switchProfile,
+            addProfile,
+            removeProfile,
+            renameProfile,
+            logoutProfile,
+        ],
+    );
+
+    return <ProfileContext.Provider value={value}>{children}</ProfileContext.Provider>;
+};
diff --git a/client/ui/frontend/src/contexts/RestrictionsContext.tsx b/client/ui/frontend/src/contexts/RestrictionsContext.tsx
new file mode 100644
index 000000000..572bf17ec
--- /dev/null
+++ b/client/ui/frontend/src/contexts/RestrictionsContext.tsx
@@ -0,0 +1,65 @@
+import {
+    createContext,
+    useCallback,
+    useContext,
+    useEffect,
+    useRef,
+    useState,
+    type ReactNode,
+} from "react";
+import { Events } from "@wailsio/runtime";
+import { Settings as SettingsSvc } from "@bindings/services";
+import { Restrictions } from "@bindings/services/models.js";
+import { useStatus } from "@/contexts/StatusContext.tsx";
+
+const EVENT_SYSTEM = "netbird:event";
+const EMPTY = new Restrictions();
+
+const RestrictionsContext = createContext<Restrictions>(EMPTY);
+
+export const useRestrictions = () => useContext(RestrictionsContext);
+
+export const RestrictionsProvider = ({ children }: { children: ReactNode }) => {
+    const [restrictions, setRestrictions] = useState<Restrictions>(EMPTY);
+    const mounted = useRef(true);
+    const { status } = useStatus();
+
+    const refresh = useCallback(async () => {
+        try {
+            const r = await SettingsSvc.GetRestrictions();
+            if (mounted.current) setRestrictions(r);
+        } catch (e) {
+            console.error("[RestrictionsContext] refresh failed", e);
+        }
+    }, []);
+
+    useEffect(() => {
+        mounted.current = true;
+
+        const off = Events.On(
+            EVENT_SYSTEM,
+            (e: { data?: { metadata?: { [k: string]: string | undefined } } }) => {
+                if (e.data?.metadata?.type === "config_changed") refresh();
+            },
+        );
+
+        const onVisible = () => {
+            if (document.visibilityState === "visible") refresh();
+        };
+        document.addEventListener("visibilitychange", onVisible);
+
+        return () => {
+            mounted.current = false;
+            off();
+            document.removeEventListener("visibilitychange", onVisible);
+        };
+    }, [refresh]);
+
+    useEffect(() => {
+        if (status?.status) refresh();
+    }, [status?.status, refresh]);
+
+    return (
+        <RestrictionsContext.Provider value={restrictions}>{children}</RestrictionsContext.Provider>
+    );
+};
diff --git a/client/ui/frontend/src/contexts/SettingsContext.tsx b/client/ui/frontend/src/contexts/SettingsContext.tsx
new file mode 100644
index 000000000..37627bc76
--- /dev/null
+++ b/client/ui/frontend/src/contexts/SettingsContext.tsx
@@ -0,0 +1,267 @@
+import {
+    createContext,
+    useCallback,
+    useContext,
+    useEffect,
+    useMemo,
+    useRef,
+    useState,
+    type ReactNode,
+} from "react";
+import { Events } from "@wailsio/runtime";
+import { Autostart, Settings as SettingsSvc, Version } from "@bindings/services";
+import type { Config } from "@bindings/services/models.js";
+import i18next from "@/lib/i18n";
+import { useProfile } from "@/contexts/ProfileContext.tsx";
+import { SettingsSkeleton } from "@/modules/settings/SettingsSkeleton.tsx";
+import { errorDialog, formatErrorMessage as errorMessage } from "@/lib/errors.ts";
+
+const SAVE_DEBOUNCE_MS = 400;
+
+const logSaveError = (err: unknown) => console.error("[SettingsContext] save failed", err);
+
+export type AutostartState = { supported: boolean; enabled: boolean };
+
+type SettingsContextValue = {
+    config: Config;
+    guiVersion: string;
+    setField: <K extends keyof Config>(k: K, v: Config[K]) => void;
+    saveField: <K extends keyof Config>(k: K, v: Config[K]) => Promise<void>;
+    saveFields: (partial: Partial<Config>, opts?: { preSharedKey?: string }) => Promise<void>;
+    saveNow: () => Promise<void>;
+};
+
+type AutostartContextValue = {
+    autostart: AutostartState | null;
+    setAutostartEnabled: (enabled: boolean) => Promise<void>;
+};
+
+const SettingsContext = createContext<SettingsContextValue | null>(null);
+const AutostartContext = createContext<AutostartContextValue | null>(null);
+
+export const useSettings = () => {
+    const ctx = useContext(SettingsContext);
+    if (!ctx) {
+        throw new Error("useSettings must be used inside SettingsProvider");
+    }
+    return ctx;
+};
+
+export const useAutostartSetting = () => {
+    const ctx = useContext(AutostartContext);
+    if (!ctx) {
+        throw new Error("useAutostartSetting must be used inside AutostartSettingsProvider");
+    }
+    return ctx;
+};
+
+type LoadedConfig = { profileName: string; data: Config };
+
+const useSettingsState = () => {
+    const { username, activeProfileId, loaded: profileLoaded } = useProfile();
+    const [loaded, setLoaded] = useState<LoadedConfig | null>(null);
+    const [guiVersion, setGuiVersion] = useState<string>("—");
+    const saveTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
+    const loadedRef = useRef<LoadedConfig | null>(null);
+
+    useEffect(() => {
+        loadedRef.current = loaded;
+    }, [loaded]);
+
+    useEffect(() => {
+        if (!profileLoaded || !activeProfileId) return;
+        let cancelled = false;
+
+        const load = async (showError: boolean) => {
+            try {
+                const data = await SettingsSvc.GetConfig({
+                    profileName: activeProfileId,
+                    username,
+                });
+                if (cancelled) return;
+                if (saveTimer.current) return;
+                setLoaded({ profileName: activeProfileId, data });
+            } catch (e) {
+                if (cancelled || !showError) return;
+                await errorDialog({
+                    Title: i18next.t("settings.error.loadTitle"),
+                    Message: errorMessage(e),
+                });
+            }
+        };
+
+        load(true);
+
+        const off = Events.On(
+            "netbird:event",
+            (e: { data?: { metadata?: { [k: string]: string | undefined } } }) => {
+                if (e.data?.metadata?.type === "config_changed") load(false);
+            },
+        );
+
+        return () => {
+            cancelled = true;
+            off();
+        };
+    }, [profileLoaded, activeProfileId, username]);
+
+    useEffect(() => {
+        let cancelled = false;
+        Version.GUI().then((v) => {
+            if (!cancelled) setGuiVersion(v);
+        });
+        return () => {
+            cancelled = true;
+        };
+    }, []);
+
+    useEffect(
+        () => () => {
+            if (saveTimer.current) clearTimeout(saveTimer.current);
+        },
+        [],
+    );
+
+    const save = useCallback(
+        async (profileName: string, next: Config, preSharedKey?: string) => {
+            const preSharedKeyWrite = preSharedKey === undefined ? {} : { preSharedKey };
+            try {
+                await SettingsSvc.SetConfig({
+                    ...next,
+                    ...preSharedKeyWrite,
+                    profileName,
+                    username,
+                });
+            } catch (e) {
+                await errorDialog({
+                    Title: i18next.t("settings.error.saveTitle"),
+                    Message: errorMessage(e),
+                });
+            }
+        },
+        [username],
+    );
+
+    const setField = useCallback(
+        <K extends keyof Config>(k: K, v: Config[K]) => {
+            const cur = loadedRef.current;
+            if (!cur) return;
+            const next: LoadedConfig = {
+                profileName: cur.profileName,
+                data: { ...cur.data, [k]: v },
+            };
+            loadedRef.current = next;
+            setLoaded(next);
+            if (saveTimer.current) clearTimeout(saveTimer.current);
+            saveTimer.current = setTimeout(() => {
+                saveTimer.current = null;
+                save(next.profileName, next.data).catch(logSaveError);
+            }, SAVE_DEBOUNCE_MS);
+        },
+        [save],
+    );
+
+    const saveNow = useCallback(async () => {
+        if (!loaded) return;
+        if (saveTimer.current) {
+            clearTimeout(saveTimer.current);
+            saveTimer.current = null;
+        }
+        await save(loaded.profileName, loaded.data);
+    }, [loaded, save]);
+
+    const saveField = useCallback(
+        async <K extends keyof Config>(k: K, v: Config[K]) => {
+            if (!loaded) return;
+            if (saveTimer.current) {
+                clearTimeout(saveTimer.current);
+                saveTimer.current = null;
+            }
+            const next = { ...loaded.data, [k]: v };
+            setLoaded({ profileName: loaded.profileName, data: next });
+            await save(loaded.profileName, next);
+        },
+        [loaded, save],
+    );
+
+    const saveFields = useCallback(
+        async (partial: Partial<Config>, opts?: { preSharedKey?: string }) => {
+            if (!loaded) return;
+            if (saveTimer.current) {
+                clearTimeout(saveTimer.current);
+                saveTimer.current = null;
+            }
+
+            const merged: Config = { ...loaded.data, ...partial };
+            const next: Config =
+                opts?.preSharedKey === undefined
+                    ? merged
+                    : { ...merged, preSharedKeySet: opts.preSharedKey !== "" };
+            setLoaded({ profileName: loaded.profileName, data: next });
+            await save(loaded.profileName, next, opts?.preSharedKey);
+        },
+        [loaded, save],
+    );
+
+    return { config: loaded?.data ?? null, guiVersion, setField, saveField, saveFields, saveNow };
+};
+
+export const SettingsProvider = ({ children }: { children: ReactNode }) => {
+    const { config, guiVersion, setField, saveField, saveFields, saveNow } = useSettingsState();
+
+    const value = useMemo<SettingsContextValue | null>(
+        () => (config ? { config, guiVersion, setField, saveField, saveFields, saveNow } : null),
+        [config, guiVersion, setField, saveField, saveFields, saveNow],
+    );
+
+    if (!value) {
+        return (
+            <div className={"min-h-0 flex-1 overflow-y-auto px-7 py-8"}>
+                <SettingsSkeleton />
+            </div>
+        );
+    }
+
+    return <SettingsContext.Provider value={value}>{children}</SettingsContext.Provider>;
+};
+
+export const AutostartSettingsProvider = ({ children }: { children: ReactNode }) => {
+    const [autostart, setAutostart] = useState<AutostartState | null>(null);
+
+    useEffect(() => {
+        let cancelled = false;
+        (async () => {
+            const supported = await Autostart.Supported();
+            const enabled = supported ? await Autostart.IsEnabled() : false;
+            if (cancelled) return;
+            setAutostart({ supported, enabled });
+        })().catch((err: unknown) => {
+            if (cancelled) return;
+            console.warn("[SettingsContext] load autostart state failed", err);
+            setAutostart({ supported: false, enabled: false });
+        });
+        return () => {
+            cancelled = true;
+        };
+    }, []);
+
+    const setAutostartEnabled = useCallback(async (enabled: boolean) => {
+        setAutostart((s) => (s ? { ...s, enabled } : s));
+        try {
+            await Autostart.SetEnabled(enabled);
+        } catch (e) {
+            setAutostart((s) => (s ? { ...s, enabled: !enabled } : s));
+            await errorDialog({
+                Title: i18next.t("settings.general.autostart.errorTitle"),
+                Message: errorMessage(e),
+            });
+        }
+    }, []);
+
+    const value = useMemo<AutostartContextValue>(
+        () => ({ autostart, setAutostartEnabled }),
+        [autostart, setAutostartEnabled],
+    );
+
+    return <AutostartContext.Provider value={value}>{children}</AutostartContext.Provider>;
+};
diff --git a/client/ui/frontend/src/contexts/StatusContext.tsx b/client/ui/frontend/src/contexts/StatusContext.tsx
new file mode 100644
index 000000000..0ad9c7875
--- /dev/null
+++ b/client/ui/frontend/src/contexts/StatusContext.tsx
@@ -0,0 +1,106 @@
+import {
+    createContext,
+    useCallback,
+    useContext,
+    useEffect,
+    useMemo,
+    useState,
+    type ReactNode,
+} from "react";
+import { Events } from "@wailsio/runtime";
+import { DaemonFeed } from "@bindings/services";
+import { Status } from "@bindings/services/models.js";
+import { DaemonOutdatedOverlay } from "@/components/empty-state/DaemonOutdatedOverlay.tsx";
+import { DaemonUnavailableOverlay } from "@/components/empty-state/DaemonUnavailableOverlay.tsx";
+import { isDaemonCompatible } from "@/lib/compat";
+
+const EVENT_STATUS = "netbird:status";
+
+type StatusContextValue = {
+    status: Status | null;
+    error: string | null;
+    refresh: () => Promise<void>;
+    isReady: boolean;
+    isDaemonUnavailable: boolean;
+    isDaemonAvailable: boolean;
+    isDaemonOutdated: boolean;
+};
+
+const StatusContext = createContext<StatusContextValue | null>(null);
+
+export const useStatus = () => {
+    const ctx = useContext(StatusContext);
+    if (!ctx) {
+        throw new Error("useStatus must be used inside StatusProvider");
+    }
+    return ctx;
+};
+
+export const StatusProvider = ({ children }: { children: ReactNode }) => {
+    const [status, setStatus] = useState<Status | null>(null);
+    const [error, setError] = useState<string | null>(null);
+    const [isDaemonOutdated, setIsDaemonOutdated] = useState(false);
+
+    const refresh = useCallback(async () => {
+        try {
+            const s = await DaemonFeed.Get();
+            setStatus(s);
+            setError(null);
+        } catch (e) {
+            // Synthesize DaemonUnavailable so cold-start-without-daemon isn't a blank UI (isReady stays false otherwise).
+            setStatus(Status.createFrom({ status: "DaemonUnavailable" }));
+            setError(String(e));
+        }
+    }, []);
+
+    useEffect(() => {
+        refresh().catch((err: unknown) => console.error("[StatusContext] refresh failed", err));
+        const off = Events.On(EVENT_STATUS, (ev: { data: Status }) => {
+            setStatus(ev.data);
+            setError(null);
+        });
+        return () => {
+            off();
+        };
+    }, [refresh]);
+
+    const isReady = status !== null;
+    const isDaemonUnavailable = isReady && status.status === "DaemonUnavailable";
+    const isDaemonAvailable = isReady && !isDaemonUnavailable;
+
+    useEffect(() => {
+        if (!isDaemonAvailable) return;
+        let cancelled = false;
+        isDaemonCompatible()
+            .then((ok) => {
+                if (!cancelled) setIsDaemonOutdated(!ok);
+            })
+            .catch((err) => {
+                console.error("[StatusContext] daemon compatible error", err);
+            });
+        return () => {
+            cancelled = true;
+        };
+    }, [isDaemonAvailable]);
+
+    const value = useMemo<StatusContextValue>(
+        () => ({
+            status,
+            error,
+            refresh,
+            isReady,
+            isDaemonUnavailable,
+            isDaemonAvailable,
+            isDaemonOutdated,
+        }),
+        [status, error, refresh, isReady, isDaemonUnavailable, isDaemonAvailable, isDaemonOutdated],
+    );
+
+    return (
+        <StatusContext.Provider value={value}>
+            {isDaemonAvailable && !isDaemonOutdated && children}
+            <DaemonUnavailableOverlay />
+            <DaemonOutdatedOverlay />
+        </StatusContext.Provider>
+    );
+};
diff --git a/client/ui/frontend/src/contexts/ViewModeContext.tsx b/client/ui/frontend/src/contexts/ViewModeContext.tsx
new file mode 100644
index 000000000..7db3abae0
--- /dev/null
+++ b/client/ui/frontend/src/contexts/ViewModeContext.tsx
@@ -0,0 +1,89 @@
+import {
+    createContext,
+    useCallback,
+    useContext,
+    useEffect,
+    useMemo,
+    useRef,
+    useState,
+    type ReactNode,
+} from "react";
+import { Window } from "@wailsio/runtime";
+import { Preferences } from "@bindings/services";
+import { ViewMode as ViewModePref } from "@bindings/preferences/models.js";
+
+export type ViewMode = "default" | "advanced";
+
+// Don't pass a fixed height to Window.SetSize: macOS SetSize is frame (incl. ~28px
+// title bar) while creation is content, so re-asserting a constant chops the content on first switch.
+export const VIEW_WIDTH: Record<ViewMode, number> = {
+    default: 380,
+    advanced: 900,
+};
+
+type ViewModeContextValue = {
+    viewMode: ViewMode;
+    setViewMode: (mode: ViewMode) => void;
+};
+
+const ViewModeContext = createContext<ViewModeContextValue | null>(null);
+
+export const ViewModeProvider = ({ children }: { children: ReactNode }) => {
+    const [mode, setMode] = useState<ViewMode>("default");
+    const modeRef = useRef<ViewMode>("default");
+
+    useEffect(() => {
+        let cancelled = false;
+        Preferences.Get()
+            .then((prefs) => {
+                if (cancelled) return;
+                const saved = prefs?.viewMode as ViewMode | undefined;
+                if (saved === "default" || saved === "advanced") {
+                    modeRef.current = saved;
+                    setMode(saved);
+                }
+            })
+            .catch((err: unknown) =>
+                console.warn("[ViewModeContext] load preferences failed", err),
+            );
+        return () => {
+            cancelled = true;
+        };
+    }, []);
+
+    // Resize before flipping React state, else the layout paints into a window that hasn't grown yet.
+    const setViewMode = useCallback((mode: ViewMode) => {
+        if (modeRef.current === mode) return;
+        modeRef.current = mode;
+        (async () => {
+            const size = await Window.Size().catch((err: unknown) => {
+                console.warn("[ViewModeContext] read window size failed", err);
+                return null;
+            });
+            const width = VIEW_WIDTH[mode];
+            const height = size?.height ?? 640;
+            await Window.SetSize(width, height).catch((err: unknown) =>
+                console.warn("[ViewModeContext] set window size failed", err),
+            );
+            setMode(mode);
+            const pref =
+                mode === "advanced" ? ViewModePref.ViewModeAdvanced : ViewModePref.ViewModeDefault;
+            Preferences.SetViewMode(pref).catch((err: unknown) =>
+                console.error("[ViewModeContext] SetViewMode failed", err),
+            );
+        })().catch((err: unknown) => console.error("[ViewModeContext] setViewMode failed", err));
+    }, []);
+
+    const value = useMemo<ViewModeContextValue>(
+        () => ({ viewMode: mode, setViewMode }),
+        [mode, setViewMode],
+    );
+
+    return <ViewModeContext.Provider value={value}>{children}</ViewModeContext.Provider>;
+};
+
+export const useViewMode = () => {
+    const ctx = useContext(ViewModeContext);
+    if (!ctx) throw new Error("useViewMode must be used inside ViewModeProvider");
+    return ctx;
+};
diff --git a/client/ui/frontend/src/globals.css b/client/ui/frontend/src/globals.css
new file mode 100644
index 000000000..84ddfdcfe
--- /dev/null
+++ b/client/ui/frontend/src/globals.css
@@ -0,0 +1,45 @@
+@font-face {
+    font-family: "Inter Variable";
+    font-style: normal;
+    font-weight: 100 900;
+    src: url("./assets/fonts/inter-variable.ttf") format("truetype");
+}
+
+@font-face {
+    font-family: "JetBrains Mono Variable";
+    font-style: normal;
+    font-weight: 100 800;
+    src: url("./assets/fonts/jetbrains-mono-variable.ttf") format("truetype");
+}
+
+@tailwind base;
+@tailwind components;
+@tailwind utilities;
+
+html,
+body,
+#root {
+    height: 100%;
+    overflow: hidden;
+}
+
+/*
+ * Body bg is fully opaque on purpose. The main window uses
+ * MacBackdropTranslucent (main.go) and TitleBarHiddenInset, which on macOS
+ * lets the desktop wallpaper bleed through any non-opaque pixel. A 90%
+ * body alpha meant two machines with different wallpapers saw different
+ * effective backgrounds. Matching Wails' BackgroundColour (#181A1D / nb-gray
+ * DEFAULT) here keeps things consistent regardless of the OS backdrop.
+ */
+body {
+    @apply bg-nb-gray font-sans text-nb-gray-200 antialiased;
+}
+
+.wails-draggable {
+    --wails-draggable: drag;
+    cursor: default;
+}
+
+.wails-no-draggable {
+    --wails-draggable: no-drag;
+}
diff --git a/client/ui/frontend/src/hooks/useAutoSizeWindow.ts b/client/ui/frontend/src/hooks/useAutoSizeWindow.ts
new file mode 100644
index 000000000..d4f4d80b2
--- /dev/null
+++ b/client/ui/frontend/src/hooks/useAutoSizeWindow.ts
@@ -0,0 +1,60 @@
+import { useLayoutEffect, useRef } from "react";
+import { Window } from "@wailsio/runtime";
+import i18next from "@/lib/i18n";
+import { isLinux } from "@/lib/platform";
+
+// Sizes the current Wails window to the measured content height (keeping `width`),
+// then shows it. Re-applies on content resize and language change.
+export function useAutoSizeWindow<T extends HTMLElement>(width: number, ready: boolean = true) {
+    const ref = useRef<T | null>(null);
+    useLayoutEffect(() => {
+        const el = ref.current;
+        if (!el) return;
+        let shown = false;
+        let raf1 = 0;
+        let raf2 = 0;
+        const showOnce = () => {
+            if (shown) return;
+            shown = true;
+            Window.Show().catch(() => {});
+            Window.Focus().catch(() => {});
+        };
+        const apply = async () => {
+            if (!ready) return;
+            const h = Math.ceil(el.getBoundingClientRect().height);
+            if (h <= 0) return;
+            try {
+                // Window.SetSize takes the frame size, so add the OS title-bar height or content clips.
+                const frame = await Window.Size();
+                const targetH = h + Math.max(0, frame.height - window.innerHeight);
+                // Linux: SetSize no-ops on a mapped non-resizable window (X11), so pin via min/max instead.
+                if (isLinux()) {
+                    await Window.SetMinSize(width, targetH);
+                    await Window.SetMaxSize(width, targetH);
+                }
+                await Window.SetSize(width, targetH);
+                showOnce();
+            } catch {
+                // window gone / not ready — ignore
+            }
+        };
+        const scheduleApply = () => {
+            cancelAnimationFrame(raf1);
+            cancelAnimationFrame(raf2);
+            raf1 = requestAnimationFrame(() => {
+                raf2 = requestAnimationFrame(apply);
+            });
+        };
+        apply();
+        const ro = new ResizeObserver(apply);
+        ro.observe(el);
+        i18next.on("languageChanged", scheduleApply);
+        return () => {
+            ro.disconnect();
+            cancelAnimationFrame(raf1);
+            cancelAnimationFrame(raf2);
+            i18next.off("languageChanged", scheduleApply);
+        };
+    }, [width, ready]);
+    return ref;
+}
diff --git a/client/ui/frontend/src/hooks/useFocusVisible.ts b/client/ui/frontend/src/hooks/useFocusVisible.ts
new file mode 100644
index 000000000..6061beb9c
--- /dev/null
+++ b/client/ui/frontend/src/hooks/useFocusVisible.ts
@@ -0,0 +1,49 @@
+import { useEffect, useState } from "react";
+
+// Tracks the user's current input modality (keyboard vs pointer) at module
+// scope, mirroring what @react-aria/interactions does. Radix programmatically
+// focuses elements like Tabs triggers and Select triggers, which makes the
+// browser's :focus-visible heuristic light up on mouse-driven interactions too.
+// Gating focus styles on this hook lets us only paint a focus ring when the
+// user is actually navigating with the keyboard.
+// See react-aria's useFocusVisible for context.
+
+type Modality = "keyboard" | "pointer";
+
+let currentModality: Modality = "pointer";
+const subscribers = new Set<(m: Modality) => void>();
+
+const setModality = (m: Modality) => {
+    if (m === currentModality) return;
+    currentModality = m;
+    subscribers.forEach((cb) => cb(m));
+};
+
+const isKeyboardEvent = (e: KeyboardEvent) => {
+    if (e.metaKey || e.ctrlKey || e.altKey) return false;
+    return e.key === "Tab" || e.key === "Escape" || e.key.startsWith("Arrow");
+};
+
+if (globalThis.window !== undefined) {
+    globalThis.addEventListener(
+        "keydown",
+        (e) => {
+            if (isKeyboardEvent(e)) setModality("keyboard");
+        },
+        true,
+    );
+    globalThis.addEventListener("pointerdown", () => setModality("pointer"), true);
+}
+
+export const useFocusVisible = (): boolean => {
+    const [visible, setVisible] = useState(currentModality === "keyboard");
+    useEffect(() => {
+        setVisible(currentModality === "keyboard");
+        const cb = (m: Modality) => setVisible(m === "keyboard");
+        subscribers.add(cb);
+        return () => {
+            subscribers.delete(cb);
+        };
+    }, []);
+    return visible;
+};
diff --git a/client/ui/frontend/src/hooks/useKeyboardShortcut.ts b/client/ui/frontend/src/hooks/useKeyboardShortcut.ts
new file mode 100644
index 000000000..ea67d8375
--- /dev/null
+++ b/client/ui/frontend/src/hooks/useKeyboardShortcut.ts
@@ -0,0 +1,46 @@
+import { useEffect } from "react";
+import { isMacOS } from "@/lib/platform";
+
+export type Shortcut = {
+    key: string;
+    cmd?: boolean;
+    shift?: boolean;
+    alt?: boolean;
+    preventDefault?: boolean;
+};
+
+export const useKeyboardShortcut = (shortcut: Shortcut, callback: () => void, enabled = true) => {
+    useEffect(() => {
+        if (!enabled) return;
+        const onKey = (e: KeyboardEvent) => {
+            if (e.key.toLowerCase() !== shortcut.key.toLowerCase()) return;
+            const mod = e.metaKey || e.ctrlKey;
+            if (!!shortcut.cmd !== mod) return;
+            if (!!shortcut.shift !== e.shiftKey) return;
+            if (!!shortcut.alt !== e.altKey) return;
+            if (shortcut.preventDefault !== false) e.preventDefault();
+            callback();
+        };
+        globalThis.addEventListener("keydown", onKey);
+        return () => globalThis.removeEventListener("keydown", onKey);
+    }, [
+        shortcut.key,
+        shortcut.cmd,
+        shortcut.shift,
+        shortcut.alt,
+        shortcut.preventDefault,
+        callback,
+        enabled,
+    ]);
+};
+
+export const formatShortcut = (shortcut: Shortcut): string => {
+    // navigator.platform is empty on some WebView2 builds → misrenders ⌘ as Ctrl on Mac.
+    const mac = isMacOS();
+    const parts: string[] = [];
+    if (shortcut.cmd) parts.push(mac ? "⌘" : "Ctrl");
+    if (shortcut.shift) parts.push(mac ? "⇧" : "Shift");
+    if (shortcut.alt) parts.push(mac ? "⌥" : "Alt");
+    parts.push(shortcut.key.length === 1 ? shortcut.key.toUpperCase() : shortcut.key);
+    return parts.join(mac ? "" : "+");
+};
diff --git a/client/ui/frontend/src/hooks/useManagementUrl.ts b/client/ui/frontend/src/hooks/useManagementUrl.ts
new file mode 100644
index 000000000..6a0ef1b81
--- /dev/null
+++ b/client/ui/frontend/src/hooks/useManagementUrl.ts
@@ -0,0 +1,143 @@
+import { useEffect, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { useSettings } from "@/contexts/SettingsContext.tsx";
+import { useConfirm } from "@/contexts/DialogContext.tsx";
+
+export const CLOUD_MANAGEMENT_URL = "https://api.netbird.io:443";
+const CLOUD_MANAGEMENT_URLS = new Set([
+    CLOUD_MANAGEMENT_URL,
+    "https://api.wiretrustee.com:443", // legacy cloud endpoint
+]);
+
+export function isNetbirdCloud(url: string): boolean {
+    if (!url || url.trim() === "") return true;
+    return CLOUD_MANAGEMENT_URLS.has(url);
+}
+
+// Matches http(s)://host[:port][/path][?query][#fragment]; host = domain, localhost, or IPv4.
+// Syntactic validation only — reachability is checked via checkManagementUrlReachable.
+export const URL_PATTERN = new RegExp(
+    String.raw`^(https?:\/\/)?` +
+        String.raw`((([a-z\d]([a-z\d-]*[a-z\d])?)\.)+[a-z]{2,}|localhost|` +
+        String.raw`((\d{1,3}\.){3}\d{1,3}))` +
+        String.raw`(\:\d+)?(\/[-a-z\d%_.~+]*)*` +
+        String.raw`(\?[;&a-z\d%_.~+=-]*)?` +
+        String.raw`(\#[-a-z\d_]*)?$`,
+    "i",
+);
+
+export function normalizeManagementUrl(input: string): string {
+    const trimmed = input.trim();
+    if (!trimmed) return "";
+    if (/^https?:\/\//i.test(trimmed)) return trimmed;
+    return `https://${trimmed}`;
+}
+
+export function isValidManagementUrl(input: string): boolean {
+    const trimmed = input.trim();
+    if (!trimmed) return false;
+    return URL_PATTERN.test(trimmed);
+}
+
+// Can false-negative for self-hosted behind internal DNS / self-signed certs — treat as a soft warning, not a hard block.
+export async function checkManagementUrlReachable(
+    url: string,
+    timeoutMs: number = 5000,
+): Promise<boolean> {
+    const target = normalizeManagementUrl(url);
+    if (!target) return false;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        await fetch(target, { method: "GET", mode: "no-cors", signal: controller.signal });
+        return true;
+    } catch {
+        return false;
+    } finally {
+        clearTimeout(timer);
+    }
+}
+
+export enum ManagementMode {
+    Cloud = "cloud",
+    SelfHosted = "selfhosted",
+}
+
+function modeFromUrl(url: string): ManagementMode {
+    return isNetbirdCloud(url) ? ManagementMode.Cloud : ManagementMode.SelfHosted;
+}
+
+export function useManagementUrl() {
+    const { t } = useTranslation();
+    const confirm = useConfirm();
+    const { config, saveField } = useSettings();
+    const [modeState, setModeState] = useState<ManagementMode>(modeFromUrl(config.managementUrl));
+    const [url, setUrl] = useState(
+        isNetbirdCloud(config.managementUrl) ? "" : config.managementUrl,
+    );
+    const [checking, setChecking] = useState(false);
+    const [unreachable, setUnreachable] = useState(false);
+
+    useEffect(() => {
+        setModeState(modeFromUrl(config.managementUrl));
+        if (!isNetbirdCloud(config.managementUrl)) {
+            setUrl(config.managementUrl);
+        }
+    }, [config.managementUrl]);
+
+    useEffect(() => {
+        setUnreachable(false);
+    }, [url, modeState]);
+
+    const setMode = async (next: ManagementMode) => {
+        if (next === ManagementMode.Cloud && !isNetbirdCloud(config.managementUrl)) {
+            const ok = await confirm({
+                title: t("settings.general.management.switchCloudTitle"),
+                description: t("settings.general.management.switchCloudMessage"),
+                confirmLabel: t("settings.general.management.switchCloudConfirm"),
+            });
+            if (!ok) return;
+            setModeState(ManagementMode.Cloud);
+            saveField("managementUrl", CLOUD_MANAGEMENT_URL).catch((err: unknown) =>
+                console.error("save managementUrl failed", err),
+            );
+            return;
+        }
+        setModeState(next);
+    };
+
+    const normalizedUrl = normalizeManagementUrl(url);
+    const urlValid = isValidManagementUrl(url);
+    const targetUrl = modeState === ManagementMode.Cloud ? CLOUD_MANAGEMENT_URL : normalizedUrl;
+    const dirty = targetUrl !== config.managementUrl;
+    const showError = modeState === ManagementMode.SelfHosted && url.trim() !== "" && !urlValid;
+    const canSave = dirty && (modeState === ManagementMode.Cloud || urlValid);
+    const displayUrl = modeState === ManagementMode.Cloud ? CLOUD_MANAGEMENT_URL : url;
+
+    const save = async () => {
+        if (modeState === ManagementMode.SelfHosted && !unreachable) {
+            setChecking(true);
+            const reachable = await checkManagementUrlReachable(targetUrl);
+            setChecking(false);
+            if (!reachable) {
+                setUnreachable(true);
+                return;
+            }
+        }
+        await saveField("managementUrl", targetUrl);
+        setUnreachable(false);
+    };
+
+    return {
+        mode: modeState,
+        setMode,
+        url,
+        setUrl,
+        displayUrl,
+        showError,
+        canSave,
+        save,
+        checking,
+        unreachable,
+    };
+}
diff --git a/client/ui/frontend/src/layouts/AppLayout.tsx b/client/ui/frontend/src/layouts/AppLayout.tsx
new file mode 100644
index 000000000..1588d9d08
--- /dev/null
+++ b/client/ui/frontend/src/layouts/AppLayout.tsx
@@ -0,0 +1,27 @@
+import { Outlet } from "react-router-dom";
+import { ClientVersionProvider } from "@/contexts/ClientVersionContext.tsx";
+import { StatusProvider } from "@/contexts/StatusContext.tsx";
+import { DebugBundleProvider } from "@/contexts/DebugBundleContext.tsx";
+import { ProfileProvider } from "@/contexts/ProfileContext.tsx";
+import { DialogProvider } from "@/contexts/DialogContext.tsx";
+import { RestrictionsProvider } from "@/contexts/RestrictionsContext.tsx";
+
+export const AppLayout = () => {
+    return (
+        <div className={"relative flex h-full flex-col"}>
+            <DialogProvider>
+                <StatusProvider>
+                    <ProfileProvider>
+                        <RestrictionsProvider>
+                            <DebugBundleProvider>
+                                <ClientVersionProvider>
+                                    <Outlet />
+                                </ClientVersionProvider>
+                            </DebugBundleProvider>
+                        </RestrictionsProvider>
+                    </ProfileProvider>
+                </StatusProvider>
+            </DialogProvider>
+        </div>
+    );
+};
diff --git a/client/ui/frontend/src/layouts/AppRightPanel.tsx b/client/ui/frontend/src/layouts/AppRightPanel.tsx
new file mode 100644
index 000000000..8474bd71f
--- /dev/null
+++ b/client/ui/frontend/src/layouts/AppRightPanel.tsx
@@ -0,0 +1,38 @@
+import { type ReactNode } from "react";
+import { motion } from "framer-motion";
+import { cn } from "@/lib/cn.ts";
+
+type Props = {
+    children: ReactNode;
+    overlay?: ReactNode;
+    overlayOpen?: boolean;
+    className?: string;
+};
+
+const PANEL_TRANSITION = {
+    duration: 0.32,
+    ease: [0.32, 0.72, 0, 1] as [number, number, number, number],
+};
+
+export const AppRightPanel = ({ children, overlay, overlayOpen = false, className }: Props) => {
+    return (
+        <div
+            className={cn(
+                "wails-no-draggable relative m-5",
+                "border border-nb-gray-920 bg-nb-gray-940",
+                "flex min-h-0 min-w-0 flex-1 flex-col overflow-hidden rounded-xl rounded-br-2xl",
+                className,
+            )}
+        >
+            <motion.div
+                animate={{ x: overlayOpen ? -48 : 0 }}
+                transition={PANEL_TRANSITION}
+                className={"flex min-h-0 min-w-0 flex-1 flex-col"}
+                style={{ pointerEvents: overlayOpen ? "none" : "auto" }}
+            >
+                {children}
+            </motion.div>
+            {overlay}
+        </div>
+    );
+};
diff --git a/client/ui/frontend/src/lib/cn.ts b/client/ui/frontend/src/lib/cn.ts
new file mode 100644
index 000000000..e6a8be071
--- /dev/null
+++ b/client/ui/frontend/src/lib/cn.ts
@@ -0,0 +1,6 @@
+import { clsx, type ClassValue } from "clsx";
+import { twMerge } from "tailwind-merge";
+
+export function cn(...inputs: ClassValue[]) {
+    return twMerge(clsx(inputs));
+}
diff --git a/client/ui/frontend/src/lib/compat.ts b/client/ui/frontend/src/lib/compat.ts
new file mode 100644
index 000000000..b2981da90
--- /dev/null
+++ b/client/ui/frontend/src/lib/compat.ts
@@ -0,0 +1,19 @@
+import { Compat } from "@bindings/services";
+
+let cached: boolean | null = null;
+
+/**
+ * isDaemonCompatible probes whether the running daemon implements the WailsUIReady
+ * RPC. A false result means the daemon predates this UI (Unimplemented) and is too
+ * old to drive it. The Go side returns an error instead when the daemon is simply
+ * unreachable, so a throw here is NOT an outdated daemon — treat it as "unknown"
+ * and let the normal connection flow report it.
+ *
+ * The result is cached for the session: daemon identity does not change without a
+ * UI restart, and a freshly started daemon is reachable again under the same socket.
+ */
+export async function isDaemonCompatible(): Promise<boolean> {
+    if (cached !== null) return cached;
+    cached = await Compat.DaemonReady();
+    return cached;
+}
diff --git a/client/ui/frontend/src/lib/connection.ts b/client/ui/frontend/src/lib/connection.ts
new file mode 100644
index 000000000..b9e98bf24
--- /dev/null
+++ b/client/ui/frontend/src/lib/connection.ts
@@ -0,0 +1,121 @@
+import { Events } from "@wailsio/runtime";
+import { Connection, WindowManager } from "@bindings/services";
+import i18next from "@/lib/i18n";
+import { errorDialog, formatErrorMessage } from "@/lib/errors.ts";
+
+export const EVENT_BROWSER_LOGIN_CANCEL = "browser-login:cancel";
+export const EVENT_TRIGGER_LOGIN = "trigger-login";
+
+let connectionInFlight = false;
+
+type SsoState = {
+    cancelled: boolean;
+    offCancel?: () => void;
+    offSignal?: () => void;
+};
+
+async function openBrowserLoginUri(uri: string): Promise<void> {
+    try {
+        await WindowManager.OpenBrowserLogin(uri);
+    } catch (e) {
+        console.error(e);
+    }
+}
+
+function buildSsoCancelPromise(state: SsoState, signal?: AbortSignal): Promise<void> {
+    return new Promise<void>((resolve) => {
+        state.offCancel = Events.On(EVENT_BROWSER_LOGIN_CANCEL, () => {
+            state.cancelled = true;
+            resolve();
+        });
+        if (!signal) return;
+        const onAbort = () => {
+            state.cancelled = true;
+            resolve();
+        };
+        if (signal.aborted) {
+            onAbort();
+            return;
+        }
+        signal.addEventListener("abort", onAbort);
+        state.offSignal = () => signal.removeEventListener("abort", onAbort);
+    });
+}
+
+async function runSsoLogin(
+    result: { verificationUri: string; verificationUriComplete: string; userCode: string },
+    state: SsoState,
+    signal?: AbortSignal,
+): Promise<void> {
+    const uri = result.verificationUriComplete || result.verificationUri;
+    if (uri) await openBrowserLoginUri(uri);
+
+    const cancelPromise = buildSsoCancelPromise(state, signal);
+    const waitPromise = Connection.WaitSSOLogin({ userCode: result.userCode, hostname: "" });
+
+    try {
+        await Promise.race([waitPromise, cancelPromise]);
+    } finally {
+        WindowManager.CloseBrowserLogin().catch(console.error);
+    }
+
+    if (state.cancelled) {
+        waitPromise.cancel?.();
+        waitPromise.catch(() => {});
+    }
+}
+
+export async function startConnection(onSettled?: () => void, signal?: AbortSignal): Promise<void> {
+    if (connectionInFlight || signal?.aborted) {
+        onSettled?.();
+        return;
+    }
+    connectionInFlight = true;
+
+    const state: SsoState = { cancelled: false };
+    let connectError: unknown;
+
+    try {
+        const result = await Connection.Login({
+            profileName: "",
+            username: "",
+            managementUrl: "",
+            setupKey: "",
+            preSharedKey: "",
+            hostname: "",
+            hint: "",
+        });
+
+        if (signal?.aborted) state.cancelled = true;
+
+        if (!state.cancelled && result.needsSsoLogin) {
+            await runSsoLogin(result, state, signal);
+        }
+
+        if (!state.cancelled && signal?.aborted) state.cancelled = true;
+
+        if (!state.cancelled) {
+            await Connection.Up({ profileName: "", username: "" });
+        }
+    } catch (e) {
+        WindowManager.CloseBrowserLogin().catch(console.error);
+        if (!state.cancelled) connectError = e;
+    } finally {
+        state.offCancel?.();
+        state.offSignal?.();
+        connectionInFlight = false;
+        onSettled?.();
+    }
+
+    if (connectError !== undefined) {
+        await errorDialog({
+            Title: i18next.t("connect.error.loginTitle"),
+            Message: formatErrorMessage(connectError),
+        });
+        return;
+    }
+
+    if (state.cancelled && signal) {
+        throw new DOMException("aborted", "AbortError");
+    }
+}
diff --git a/client/ui/frontend/src/lib/errors.ts b/client/ui/frontend/src/lib/errors.ts
new file mode 100644
index 000000000..34a90dace
--- /dev/null
+++ b/client/ui/frontend/src/lib/errors.ts
@@ -0,0 +1,60 @@
+import { WindowManager } from "@bindings/services";
+
+type ClassifiedError = { short: string; long: string };
+
+const asObject = (v: unknown): Record<string, unknown> | null =>
+    v && typeof v === "object" ? (v as Record<string, unknown>) : null;
+
+const parseJsonObject = (s: unknown): Record<string, unknown> | null => {
+    if (typeof s !== "string") return null;
+    const t = s.trim();
+    if (!t.startsWith("{") || !t.endsWith("}")) return null;
+    try {
+        return asObject(JSON.parse(t));
+    } catch {
+        return null;
+    }
+};
+
+const toWailsEnvelope = (e: unknown): Record<string, unknown> | null => {
+    const obj = asObject(e);
+    if (!obj) return null;
+    return asObject(obj.cause) ?? parseJsonObject(obj.message);
+};
+
+// Read { short, long } from wherever the classified error sits in the envelope
+const toClassifiedError = (v: unknown): ClassifiedError | null => {
+    const o = asObject(v);
+    if (!o) return null;
+    const short = typeof o.short === "string" ? o.short : "";
+    const long = typeof o.long === "string" ? o.long : "";
+    return short || long ? { short, long } : null;
+};
+
+export const formatErrorMessage = (e: unknown): string => {
+    const envelope = toWailsEnvelope(e);
+
+    // Prefer the structured { short, long } the daemon classifier produced.
+    const classified = toClassifiedError(envelope?.cause) ?? toClassifiedError(envelope);
+    if (classified) {
+        const { short, long } = classified;
+        if (short && long && long !== short) return `${short} Details: ${long}`;
+        if (short) return short;
+        if (long) return long;
+    }
+
+    // Unclassified (a service returned the raw daemon error)
+    const message = envelope?.message;
+    if (typeof message === "string" && message) return message;
+    if (e instanceof Error) return e.message;
+    return String(e);
+};
+
+export type ErrorDialogOptions = {
+    Title: string;
+    Message: string;
+};
+
+export function errorDialog(options: ErrorDialogOptions): Promise<void> {
+    return WindowManager.OpenError(options.Title, options.Message);
+}
diff --git a/client/ui/frontend/src/lib/formatters.ts b/client/ui/frontend/src/lib/formatters.ts
new file mode 100644
index 000000000..231967a38
--- /dev/null
+++ b/client/ui/frontend/src/lib/formatters.ts
@@ -0,0 +1,44 @@
+export const formatBytes = (bytes: number, decimals: number = 2): string => {
+    if (!Number.isFinite(bytes) || bytes <= 0) return "0 B";
+
+    const k = 1024;
+    const sizes = ["B", "KB", "MB", "GB", "TB"];
+    const i = Math.min(sizes.length - 1, Math.floor(Math.log(bytes) / Math.log(k)));
+
+    return Number.parseFloat((bytes / Math.pow(k, i)).toFixed(decimals)) + " " + sizes[i];
+};
+
+export const latencyColor = (ms: number): string => {
+    if (ms <= 0) return "text-nb-gray-400";
+    if (ms < 100) return "text-green-400";
+    return "text-yellow-400";
+};
+
+export const formatRelative = (unixSeconds: number, nowMs: number = Date.now()): string | null => {
+    if (!Number.isFinite(unixSeconds) || unixSeconds <= 0) return null;
+    const diff = Math.max(0, Math.floor(nowMs / 1000 - unixSeconds));
+    if (diff < 60) return `${diff}s ago`;
+    if (diff < 3600) return `${Math.floor(diff / 60)}m ago`;
+    if (diff < 86400) return `${Math.floor(diff / 3600)}h ago`;
+    return `${Math.floor(diff / 86400)}d ago`;
+};
+
+// Base domain is operator-configurable, so cut at the first dot rather than match a known suffix.
+export const shortenDns = (fqdn: string | undefined | null): string => {
+    if (!fqdn) return "";
+    const dot = fqdn.indexOf(".");
+    return dot === -1 ? fqdn : fqdn.slice(0, dot);
+};
+
+// Countdown clock: mm:ss, widening to hh:mm:ss / dd:hh:mm:ss as the duration grows.
+export const formatRemaining = (seconds: number): string => {
+    const s = Math.max(0, Math.trunc(seconds));
+    const days = Math.floor(s / 86400);
+    const hours = Math.floor((s % 86400) / 3600);
+    const minutes = Math.floor((s % 3600) / 60);
+    const secs = s % 60;
+    const pad = (n: number) => String(n).padStart(2, "0");
+    if (days > 0) return `${pad(days)}:${pad(hours)}:${pad(minutes)}:${pad(secs)}`;
+    if (hours > 0) return `${pad(hours)}:${pad(minutes)}:${pad(secs)}`;
+    return `${pad(minutes)}:${pad(secs)}`;
+};
diff --git a/client/ui/frontend/src/lib/i18n.ts b/client/ui/frontend/src/lib/i18n.ts
new file mode 100644
index 000000000..dc7fc7902
--- /dev/null
+++ b/client/ui/frontend/src/lib/i18n.ts
@@ -0,0 +1,103 @@
+import i18next from "i18next";
+import { initReactI18next } from "react-i18next";
+import { Events } from "@wailsio/runtime";
+
+import { Preferences, I18n } from "@bindings/services";
+import { type LanguageCode } from "@bindings/i18n/models.js";
+
+// Relative path on purpose — alias globs (`@/…`) silently match nothing in some Vite dev setups.
+type BundleEntry = { message: string; description?: string };
+const bundleModules = import.meta.glob<Record<string, BundleEntry>>(
+    "../../../i18n/locales/*/common.json",
+    { eager: true, import: "default" },
+);
+
+const resources: Record<string, { common: Record<string, string> }> = {};
+for (const path in bundleModules) {
+    const match = /locales\/([^/]+)\/common\.json$/.exec(path);
+    if (match) {
+        const entries = bundleModules[path];
+        const messages: Record<string, string> = {};
+        for (const key in entries) {
+            messages[key] = entries[key].message;
+        }
+        resources[match[1]] = { common: messages };
+    }
+}
+
+function detectBrowserLanguage(available: string[]): string | null {
+    const tags = [navigator.language, ...(navigator.languages ?? [])].filter(
+        (tag): tag is string => typeof tag === "string" && tag.length > 0,
+    );
+    const byLower = new Map(available.map((code) => [code.toLowerCase(), code]));
+    for (const tag of tags) {
+        const lower = tag.toLowerCase();
+        const exact = byLower.get(lower);
+        if (exact) return exact;
+        const base = byLower.get(lower.split("-")[0]);
+        if (base) return base;
+    }
+    return null;
+}
+
+// An empty persisted language code is the Go-side signal for first run.
+export async function initI18n(): Promise<void> {
+    const available = Object.keys(resources);
+    let language = "en";
+    let firstRun = false;
+    try {
+        const prefs = await Preferences.Get();
+        if (prefs?.language) {
+            language = prefs.language;
+        } else {
+            firstRun = true;
+            language = detectBrowserLanguage(available) ?? "en";
+        }
+    } catch (e) {
+        console.warn("read preferences for language failed, defaulting to en", e);
+    }
+
+    if (firstRun) {
+        Preferences.SetLanguage(language as LanguageCode).catch((err: unknown) =>
+            console.warn("persist detected language failed", err),
+        );
+    }
+
+    await i18next.use(initReactI18next).init({
+        lng: language,
+        fallbackLng: "en",
+        defaultNS: "common",
+        ns: ["common"],
+        resources,
+        interpolation: {
+            prefix: "{",
+            suffix: "}",
+            escapeValue: false,
+        },
+        returnNull: false,
+    });
+
+    syncDocumentLang();
+    i18next.on("languageChanged", syncDocumentLang);
+
+    Events.On("netbird:preferences:changed", (e) => {
+        const next = e.data?.language;
+        if (next && next !== i18next.language) {
+            i18next.changeLanguage(next).catch((err: unknown) => {
+                console.error("changeLanguage failed", err);
+            });
+        }
+    });
+}
+
+function syncDocumentLang() {
+    if (typeof document !== "undefined") {
+        document.documentElement.lang = i18next.language;
+    }
+}
+
+export async function loadLanguages() {
+    return I18n.Languages();
+}
+
+export default i18next;
diff --git a/client/ui/frontend/src/lib/logs.ts b/client/ui/frontend/src/lib/logs.ts
new file mode 100644
index 000000000..499023fa3
--- /dev/null
+++ b/client/ui/frontend/src/lib/logs.ts
@@ -0,0 +1,139 @@
+import { UILog } from "@bindings/services";
+
+type Level = "trace" | "debug" | "info" | "warn" | "error";
+
+const METHOD_LEVELS: Record<string, Level> = {
+    trace: "trace",
+    debug: "debug",
+    log: "info",
+    info: "info",
+    warn: "warn",
+    error: "error",
+};
+
+const IGNORED_SOURCES = new Set(["welcome.ts"]);
+
+const RATE_LIMIT = 50;
+const RATE_WINDOW_MS = 1000;
+
+let installed = false;
+let inForward = false;
+let windowStart = 0;
+let windowCount = 0;
+
+function describeCause(rawCause: unknown): string {
+    if (rawCause instanceof Error) return `${rawCause.name}: ${rawCause.message}`;
+    if (typeof rawCause === "object" && rawCause !== null) {
+        try {
+            return JSON.stringify(rawCause);
+        } catch {
+            // Circular ref — fall through to a tag instead of "[object Object]".
+            return `<${rawCause.constructor?.name ?? "object"}>`;
+        }
+    }
+    return String(rawCause);
+}
+
+function formatCause(rawCause: unknown): string {
+    if (rawCause === undefined) return "";
+    return `\ncaused by ${describeCause(rawCause)}`;
+}
+
+// WebKit (macOS WKWebView) omits the "Name: message" header from Error.stack,
+// so a bare stack hides the real cause. Prepend name+message, then the stack.
+function formatError(e: Error): string {
+    const head = `${e.name}: ${e.message}`;
+    const cause = formatCause((e as { cause?: unknown }).cause);
+    if (!e.stack) return `${head}${cause}`;
+    if (e.stack.startsWith(head)) return `${head}${cause}`;
+    return `${head}${cause}\n${e.stack}`;
+}
+
+function format(args: unknown[]): string {
+    return args
+        .map((a) => {
+            if (typeof a === "string") return a;
+            if (a instanceof Error) return formatError(a);
+            try {
+                return JSON.stringify(a);
+            } catch {
+                return String(a);
+            }
+        })
+        .join(" ");
+}
+
+function parseStackLine(line: string): string {
+    // Find the file:line:col tail at the end of the path.
+    const colonCol = line.lastIndexOf(":");
+    if (colonCol <= 0) return "";
+    const colonLine = line.lastIndexOf(":", colonCol - 1);
+    if (colonLine <= 0) return "";
+    const col = line.slice(colonCol + 1);
+    const lineNo = line.slice(colonLine + 1, colonCol);
+    if (!/^\d+$/.test(col) || !/^\d+$/.test(lineNo)) return "";
+    const before = line.slice(0, colonLine);
+    const sep = Math.max(
+        before.lastIndexOf("/"),
+        before.lastIndexOf("\\"),
+        before.lastIndexOf("("),
+        before.lastIndexOf(" "),
+    );
+    const file = before.slice(sep + 1);
+    if (!file.includes(".")) return "";
+    return `${file}:${lineNo}`;
+}
+
+function callerSource(): string {
+    const stack = new Error().stack;
+    if (!stack) return "";
+    for (const line of stack.split("\n").slice(1)) {
+        if (line.includes("/logs.ts")) continue;
+        const parsed = parseStackLine(line);
+        if (parsed) return parsed;
+    }
+    return "";
+}
+
+function forward(level: Level, args: unknown[]) {
+    if (inForward) return;
+    inForward = true;
+    try {
+        const now = Date.now();
+        if (now - windowStart >= RATE_WINDOW_MS) {
+            windowStart = now;
+            windowCount = 0;
+        }
+        if (++windowCount > RATE_LIMIT) return;
+
+        const source = callerSource();
+        if (IGNORED_SOURCES.has(source.split(":")[0])) return;
+        // Don't touch console here — it would recurse back into forward().
+        UILog.Log(level, source, format(args)).catch(() => {});
+    } catch {
+        // Swallow — log forwarding must never throw back into the caller.
+    } finally {
+        inForward = false;
+    }
+}
+
+export function initLogForwarding() {
+    if (installed) return;
+    installed = true;
+
+    const c = console as unknown as Record<string, (...a: unknown[]) => void>;
+    for (const [method, level] of Object.entries(METHOD_LEVELS)) {
+        const original = c[method]?.bind(console);
+        c[method] = (...args: unknown[]) => {
+            original?.(...args);
+            forward(level, args);
+        };
+    }
+
+    globalThis.addEventListener("error", (e) => {
+        forward("error", [`uncaught error: ${e.message}`, e.error ?? ""]);
+    });
+    globalThis.addEventListener("unhandledrejection", (e) => {
+        forward("error", ["unhandled promise rejection:", e.reason]);
+    });
+}
diff --git a/client/ui/frontend/src/lib/platform.ts b/client/ui/frontend/src/lib/platform.ts
new file mode 100644
index 000000000..c256dde23
--- /dev/null
+++ b/client/ui/frontend/src/lib/platform.ts
@@ -0,0 +1,39 @@
+import { System } from "@wailsio/runtime";
+
+export type Platform = {
+    isWindows: boolean;
+    isMacOS: boolean;
+};
+
+let cached: Platform | null = null;
+
+export async function initPlatform(): Promise<void> {
+    if (cached) return;
+
+    const syncIsMac = System.IsMac();
+    const syncIsWindows = System.IsWindows();
+
+    let env: Awaited<ReturnType<typeof System.Environment>> | null = null;
+    try {
+        env = await System.Environment();
+    } catch (e) {
+        console.error("[platform] System.Environment() threw:", e);
+    }
+
+    const os = (env?.OS ?? "").toLowerCase();
+    cached = {
+        isWindows: os ? os === "windows" : syncIsWindows,
+        isMacOS: os ? os === "darwin" : syncIsMac,
+    };
+}
+
+function get(): Platform {
+    if (!cached) {
+        throw new Error("platform: initPlatform() must complete before sync getters are used");
+    }
+    return cached;
+}
+
+export const isWindows = (): boolean => get().isWindows;
+export const isMacOS = (): boolean => get().isMacOS;
+export const isLinux = (): boolean => !get().isWindows && !get().isMacOS;
diff --git a/client/ui/frontend/src/lib/sorting.ts b/client/ui/frontend/src/lib/sorting.ts
new file mode 100644
index 000000000..70622f705
--- /dev/null
+++ b/client/ui/frontend/src/lib/sorting.ts
@@ -0,0 +1,27 @@
+// Stable, order-preserving reconciliation for lists that re-fetch from the daemon
+// on every status push (peers, networks, profiles). Re-sorting on each refresh would
+// make rows jump around under the user, so instead:
+//   - items already on screen keep their existing order (from `prev`),
+//   - items that vanished are dropped,
+//   - newly-arrived items are sorted among themselves (`compareFresh`) and appended.
+// Net effect: the only visible movement is new rows landing at the bottom.
+//
+// Must stay pure and idempotent: callers write the returned `order` into a ref
+// during render (useMemo), so a rerun must reproduce the first pass — never
+// branch on run count or read external mutable state.
+export function reconcileOrder<T>(
+    prev: string[],
+    items: T[],
+    keyOf: (item: T) => string,
+    compareFresh: (a: T, b: T) => number,
+): { order: string[]; items: T[] } {
+    const byKey = new Map(items.map((i) => [keyOf(i), i]));
+    const kept = prev.filter((k) => byKey.has(k));
+    const known = new Set(kept);
+    const fresh = items
+        .filter((i) => !known.has(keyOf(i)))
+        .sort(compareFresh)
+        .map(keyOf);
+    const order = [...kept, ...fresh];
+    return { order, items: order.map((k) => byKey.get(k)!) };
+}
diff --git a/client/ui/frontend/src/lib/welcome.ts b/client/ui/frontend/src/lib/welcome.ts
new file mode 100644
index 000000000..d9df3fc8d
--- /dev/null
+++ b/client/ui/frontend/src/lib/welcome.ts
@@ -0,0 +1,25 @@
+const ART = `
+    _   __     __  ____  _          __   ______          __    __  __
+   / | / /__  / /_/ __ )(_)________/ /  / ____/___ ___  / /_  / / / /
+  /  |/ / _ \\/ __/ __  / / ___/ __  /  / / __/ __ \`__ \\/ __ \\/ /_/ /
+ / /|  /  __/ /_/ /_/ / / /  / /_/ /  / /_/ / / / / / / /_/ / __  /
+/_/ |_/\\___/\\__/_____/_/_/   \\__,_/   \\____/_/ /_/ /_/_.___/_/ /_/
+`;
+
+export function welcome() {
+    const message = `%c${ART}%c
+NetBird — The Only Secure Access Platform You'll Ever Need.
+
+WEBSITE:      https://netbird.io/
+WE'RE HIRING: https://netbird.io/careers
+OPEN SOURCE:  https://github.com/netbirdio/netbird
+`;
+
+    // Intentional NetBird ASCII banner in the devtools console.
+    // eslint-disable-next-line no-console
+    console.log(
+        message,
+        "color: #f68330; font-family: monospace; font-weight: normal; line-height: 1;",
+        "color: #f5f5f5; font-family: monospace; font-weight: normal; line-height: 1.4;",
+    );
+}
diff --git a/client/ui/frontend/src/modules/auto-update/UpdateBadge.tsx b/client/ui/frontend/src/modules/auto-update/UpdateBadge.tsx
new file mode 100644
index 000000000..3345e0a9f
--- /dev/null
+++ b/client/ui/frontend/src/modules/auto-update/UpdateBadge.tsx
@@ -0,0 +1,27 @@
+import { forwardRef, type HTMLAttributes } from "react";
+import { ArrowUpCircleIcon } from "lucide-react";
+import { cn } from "@/lib/cn";
+
+type Props = HTMLAttributes<HTMLDivElement> & {
+    size?: number;
+};
+
+export const UpdateBadge = forwardRef<HTMLDivElement, Props>(function UpdateBadge(
+    { size = 15, className, ...rest },
+    ref,
+) {
+    return (
+        <div
+            ref={ref}
+            className={cn("relative flex items-center justify-center", className)}
+            {...rest}
+        >
+            <span
+                className={
+                    "pointer-events-none absolute inline-flex h-[15px] w-[15px] animate-ping rounded-full bg-netbird opacity-20"
+                }
+            />
+            <ArrowUpCircleIcon size={size} className={"text-netbird"} />
+        </div>
+    );
+});
diff --git a/client/ui/frontend/src/modules/auto-update/UpdateInProgressDialog.tsx b/client/ui/frontend/src/modules/auto-update/UpdateInProgressDialog.tsx
new file mode 100644
index 000000000..1519613e0
--- /dev/null
+++ b/client/ui/frontend/src/modules/auto-update/UpdateInProgressDialog.tsx
@@ -0,0 +1,187 @@
+import { useEffect, useRef, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { useSearchParams } from "react-router-dom";
+import { Loader2, XCircle } from "lucide-react";
+import { Update as UpdateSvc, WindowManager } from "@bindings/services";
+import { Button } from "@/components/buttons/Button";
+import { ConfirmDialog } from "@/components/dialog/ConfirmDialog";
+import { DialogActions } from "@/components/dialog/DialogActions";
+import { DialogDescription } from "@/components/dialog/DialogDescription";
+import { DialogHeading } from "@/components/dialog/DialogHeading";
+import { SquareIcon } from "@/components/SquareIcon";
+import { useAutoSizeWindow } from "@/hooks/useAutoSizeWindow";
+
+const TIMEOUT_MS = 15 * 60 * 1000;
+const POLL_INTERVAL_MS = 2000;
+// Sustained gRPC failure during install is taken as success (installer restarts the daemon mid-flight).
+const DAEMON_DOWN_GRACE_MS = 5000;
+const WINDOW_WIDTH = 360;
+
+type Phase =
+    | { kind: "running" }
+    | { kind: "timeout" }
+    | { kind: "canceled" }
+    | { kind: "failed"; message: string };
+
+export default function UpdateInProgressDialog() {
+    const { t } = useTranslation();
+    const [params] = useSearchParams();
+    const version = params.get("version") ?? "";
+    const [phase, setPhase] = useState<Phase>({ kind: "running" });
+    const phaseRef = useRef(phase);
+    phaseRef.current = phase;
+    const contentRef = useAutoSizeWindow<HTMLDivElement>(WINDOW_WIDTH);
+
+    useEffect(() => {
+        let cancelled = false;
+        let done = false;
+        let timer: ReturnType<typeof setTimeout> | null = null;
+        const start = Date.now();
+        let firstUnreachableAt: number | null = null;
+
+        const poll = async () => {
+            if (cancelled || done) return;
+            if (phaseRef.current.kind !== "running") return;
+
+            if (Date.now() - start > TIMEOUT_MS) {
+                done = true;
+                setPhase({ kind: "timeout" });
+                return;
+            }
+
+            try {
+                const r = await UpdateSvc.GetInstallerResult();
+                if (cancelled || done || phaseRef.current.kind !== "running") return;
+                firstUnreachableAt = null;
+                if (r.success) {
+                    done = true;
+                    UpdateSvc.Quit().catch(console.error);
+                    return;
+                }
+                if (r.errorMsg) {
+                    done = true;
+                    setPhase(mapInstallError(r.errorMsg));
+                    return;
+                }
+            } catch {
+                if (cancelled || done || phaseRef.current.kind !== "running") return;
+                const now = Date.now();
+                if (firstUnreachableAt === null) {
+                    firstUnreachableAt = now;
+                } else if (now - firstUnreachableAt >= DAEMON_DOWN_GRACE_MS) {
+                    done = true;
+                    UpdateSvc.Quit().catch(console.error);
+                    return;
+                }
+            }
+
+            if (!cancelled && !done) {
+                timer = setTimeout(poll, POLL_INTERVAL_MS);
+            }
+        };
+
+        timer = setTimeout(poll, POLL_INTERVAL_MS);
+
+        return () => {
+            cancelled = true;
+            if (timer) clearTimeout(timer);
+        };
+    }, []);
+
+    const isError = phase.kind !== "running";
+    const errorInfo = isError ? classifyPhase(phase, version, t) : null;
+    const updatingHeading = version
+        ? t("update.overlay.updatingVersion", { version })
+        : t("update.overlay.updating");
+
+    return (
+        <ConfirmDialog ref={contentRef}>
+            {isError ? (
+                <SquareIcon icon={XCircle} className={"bg-red-500 [&_svg]:text-white"} />
+            ) : (
+                <SquareIcon icon={Loader2} className={"[&_svg]:animate-spin"} />
+            )}
+
+            <div className={"flex flex-col items-center gap-2"}>
+                <DialogHeading className={"text-balance"}>
+                    {errorInfo ? errorInfo.title : updatingHeading}
+                </DialogHeading>
+                <DialogDescription>
+                    {errorInfo ? (
+                        <>
+                            {errorInfo.description}
+                            {errorInfo.message && (
+                                <>
+                                    <br />
+                                    <span className={"first-letter:uppercase"}>
+                                        {errorInfo.message}
+                                    </span>
+                                </>
+                            )}
+                        </>
+                    ) : (
+                        t("update.overlay.description")
+                    )}
+                </DialogDescription>
+            </div>
+
+            {isError && (
+                <DialogActions>
+                    <Button
+                        autoFocus
+                        variant={"secondary"}
+                        size={"md"}
+                        className={"w-full"}
+                        onClick={() => WindowManager.CloseInstallProgress().catch(console.error)}
+                    >
+                        {t("common.close")}
+                    </Button>
+                </DialogActions>
+            )}
+        </ConfirmDialog>
+    );
+}
+
+function mapInstallError(msg: string): Phase {
+    const m = msg.trim().toLowerCase();
+    if (m === "") return { kind: "failed", message: "" };
+    if (m.includes("deadline exceeded") || m.includes("timeout") || m.includes("timed out")) {
+        return { kind: "timeout" };
+    }
+    if (m.includes("canceled") || m.includes("cancelled") || m.includes("cancel")) {
+        return { kind: "canceled" };
+    }
+    return { kind: "failed", message: msg };
+}
+
+type Variant = { title: string; description: string; message?: string };
+
+function classifyPhase(
+    phase: Phase,
+    version: string,
+    t: (key: string, options?: Record<string, unknown>) => string,
+): Variant {
+    const target = version
+        ? t("update.overlay.error.targetVersion", { version })
+        : t("update.overlay.error.targetFallback");
+    switch (phase.kind) {
+        case "timeout":
+            return {
+                title: t("update.overlay.error.timeoutTitle"),
+                description: t("update.overlay.error.timeoutDescription", { target }),
+            };
+        case "canceled":
+            return {
+                title: t("update.overlay.error.canceledTitle"),
+                description: t("update.overlay.error.canceledDescription", { target }),
+            };
+        case "failed":
+            return {
+                title: t("update.overlay.error.failTitle"),
+                description: t("update.overlay.error.failDescription", { target }),
+                message: phase.message || t("update.overlay.error.unknownMessage"),
+            };
+        default:
+            return { title: "", description: "" };
+    }
+}
diff --git a/client/ui/frontend/src/modules/auto-update/UpdateVersionCard.tsx b/client/ui/frontend/src/modules/auto-update/UpdateVersionCard.tsx
new file mode 100644
index 000000000..4fb5e2586
--- /dev/null
+++ b/client/ui/frontend/src/modules/auto-update/UpdateVersionCard.tsx
@@ -0,0 +1,96 @@
+import { type ReactNode } from "react";
+import { useTranslation } from "react-i18next";
+import { Browser } from "@wailsio/runtime";
+import { DownloadIcon, NotepadText } from "lucide-react";
+import { Button } from "@/components/buttons/Button";
+import { useClientVersion } from "@/contexts/ClientVersionContext";
+import { cn } from "@/lib/cn";
+
+const GITHUB_RELEASES = "https://github.com/netbirdio/netbird/releases/latest";
+
+function openUrl(url: string) {
+    Browser.OpenURL(url).catch(() => {
+        window.open(url, "_blank");
+    });
+}
+
+export function UpdateVersionCard() {
+    const { t } = useTranslation();
+    const { updateVersion, enforced, triggerUpdate } = useClientVersion();
+
+    if (updateVersion) {
+        const titleKey = enforced
+            ? "update.card.versionAvailableInstall"
+            : "update.card.versionAvailableDownload";
+        return (
+            <Card className={"max-w-lg"}>
+                <div>
+                    <Title>{t(titleKey, { version: updateVersion })}</Title>
+                    <Link
+                        url={`https://github.com/netbirdio/netbird/releases/tag/v${updateVersion}`}
+                    >
+                        {t("update.card.whatsNew")}
+                    </Link>
+                </div>
+                {enforced ? (
+                    <Button variant={"primary"} size={"xs"} onClick={triggerUpdate}>
+                        {t("update.card.installNow")}
+                    </Button>
+                ) : (
+                    <Button
+                        variant={"primary"}
+                        size={"xs"}
+                        onClick={() => openUrl(GITHUB_RELEASES)}
+                    >
+                        <DownloadIcon size={14} />
+                        {t("update.card.getInstaller")}
+                    </Button>
+                )}
+            </Card>
+        );
+    }
+
+    return (
+        <Card className={"max-w-lg"}>
+            <div>
+                <Title>{t("update.card.onLatestVersion")}</Title>
+                <p className={"text-sm text-nb-gray-300"}>{t("update.card.autoCheckInterval")}</p>
+            </div>
+            <Button variant={"primary"} size={"xs"} onClick={() => openUrl(GITHUB_RELEASES)}>
+                <NotepadText size={14} />
+                {t("update.card.changelog")}
+            </Button>
+        </Card>
+    );
+}
+
+function Card({ children, className }: Readonly<{ children: ReactNode; className?: string }>) {
+    return (
+        <div
+            className={cn(
+                "flex w-full items-center justify-between gap-4 rounded-md border border-nb-gray-800 bg-nb-gray-910 px-4 py-3",
+                className,
+            )}
+        >
+            {children}
+        </div>
+    );
+}
+
+function Title({ children }: Readonly<{ children: ReactNode }>) {
+    return <p className={"text-sm font-semibold"}>{children}</p>;
+}
+
+function Link({ url, children }: Readonly<{ url: string; children: ReactNode }>) {
+    return (
+        <button
+            type={"button"}
+            onClick={() => openUrl(url)}
+            className={
+                "text-sm font-medium text-netbird hover:underline hover:decoration-[0.5px] hover:underline-offset-4"
+            }
+        >
+            {children}
+        </button>
+    );
+}
diff --git a/client/ui/frontend/src/modules/error/ErrorDialog.tsx b/client/ui/frontend/src/modules/error/ErrorDialog.tsx
new file mode 100644
index 000000000..f7929fad2
--- /dev/null
+++ b/client/ui/frontend/src/modules/error/ErrorDialog.tsx
@@ -0,0 +1,64 @@
+import { useCallback, useEffect } from "react";
+import { useTranslation } from "react-i18next";
+import { useSearchParams } from "react-router-dom";
+import { AlertCircleIcon } from "lucide-react";
+import { Button } from "@/components/buttons/Button";
+import { ConfirmDialog } from "@/components/dialog/ConfirmDialog";
+import { DialogActions } from "@/components/dialog/DialogActions";
+import { DialogDescription } from "@/components/dialog/DialogDescription";
+import { DialogHeading } from "@/components/dialog/DialogHeading";
+import { SquareIcon } from "@/components/SquareIcon";
+import { WindowManager } from "@bindings/services";
+import { useAutoSizeWindow } from "@/hooks/useAutoSizeWindow";
+
+const WINDOW_WIDTH = 380;
+
+export default function ErrorDialog() {
+    const { t } = useTranslation();
+    const contentRef = useAutoSizeWindow<HTMLDivElement>(WINDOW_WIDTH);
+    const [params] = useSearchParams();
+
+    const title = params.get("title") || t("window.title.error");
+    const message = params.get("message") || "";
+
+    const close = useCallback(() => {
+        WindowManager.CloseError().catch(console.error);
+    }, []);
+
+    useEffect(() => {
+        const onKey = (e: KeyboardEvent) => {
+            if (e.key === "Escape") close();
+        };
+        globalThis.addEventListener("keydown", onKey);
+        return () => globalThis.removeEventListener("keydown", onKey);
+    }, [close]);
+
+    return (
+        <ConfirmDialog ref={contentRef} aria-labelledby={"nb-error-dialog-title"}>
+            <SquareIcon icon={AlertCircleIcon} variant={"danger"} />
+
+            <div className={"flex flex-col items-center gap-1"}>
+                <DialogHeading id={"nb-error-dialog-title"} className={"text-balance"}>
+                    {title}
+                </DialogHeading>
+                {message && (
+                    <DialogDescription className={"text-balance"}>
+                        <span className={"whitespace-pre-wrap break-words"}>{message}</span>
+                    </DialogDescription>
+                )}
+            </div>
+
+            <DialogActions>
+                <Button
+                    autoFocus
+                    variant={"primary"}
+                    size={"md"}
+                    className={"w-full"}
+                    onClick={close}
+                >
+                    {t("common.close")}
+                </Button>
+            </DialogActions>
+        </ConfirmDialog>
+    );
+}
diff --git a/client/ui/frontend/src/modules/login/LoginWaitingForBrowserDialog.tsx b/client/ui/frontend/src/modules/login/LoginWaitingForBrowserDialog.tsx
new file mode 100644
index 000000000..efbd1ee84
--- /dev/null
+++ b/client/ui/frontend/src/modules/login/LoginWaitingForBrowserDialog.tsx
@@ -0,0 +1,90 @@
+import { useCallback, useEffect, useRef } from "react";
+import { useTranslation } from "react-i18next";
+import { useSearchParams } from "react-router-dom";
+import { Events } from "@wailsio/runtime";
+import { Loader2 } from "lucide-react";
+import { Connection } from "@bindings/services";
+import { Button } from "@/components/buttons/Button";
+import { ConfirmDialog } from "@/components/dialog/ConfirmDialog";
+import { DialogActions } from "@/components/dialog/DialogActions";
+import { DialogDescription } from "@/components/dialog/DialogDescription";
+import { DialogHeading } from "@/components/dialog/DialogHeading";
+import { SquareIcon } from "@/components/SquareIcon";
+import { useAutoSizeWindow } from "@/hooks/useAutoSizeWindow";
+import { errorDialog, formatErrorMessage } from "@/lib/errors";
+
+const EVENT_CANCEL = "browser-login:cancel";
+const WINDOW_WIDTH = 360;
+
+export default function LoginWaitingForBrowserDialog() {
+    const { t } = useTranslation();
+    const [params] = useSearchParams();
+    const uri = params.get("uri") ?? "";
+    const contentRef = useAutoSizeWindow<HTMLDivElement>(WINDOW_WIDTH);
+    const openedRef = useRef(false);
+
+    const reportOpenFailure = useCallback(
+        (e: unknown) => {
+            void errorDialog({
+                Title: t("browserLogin.openFailedTitle"),
+                Message: formatErrorMessage(e),
+            });
+        },
+        [t],
+    );
+
+    // Open the browser only after mount, or it lands on top of the still-hidden popup.
+    useEffect(() => {
+        if (!uri || openedRef.current) return;
+        openedRef.current = true;
+        Connection.OpenURL(uri).catch(reportOpenFailure);
+    }, [uri, reportOpenFailure]);
+
+    const tryAgain = useCallback(() => {
+        if (!uri) return;
+        Connection.OpenURL(uri).catch(reportOpenFailure);
+    }, [uri, reportOpenFailure]);
+
+    const cancel = useCallback(() => {
+        Events.Emit(EVENT_CANCEL).catch((err: unknown) =>
+            console.error("emit browser-login cancel", err),
+        );
+    }, []);
+
+    return (
+        <ConfirmDialog ref={contentRef} aria-labelledby={"nb-browser-login-title"}>
+            <SquareIcon icon={Loader2} className={"[&_svg]:animate-spin"} />
+
+            <div className={"flex flex-col items-center gap-2"}>
+                <DialogHeading id={"nb-browser-login-title"} className={"text-balance"}>
+                    {t("browserLogin.title")}
+                </DialogHeading>
+                <DialogDescription>
+                    {t("browserLogin.notSeeing")}{" "}
+                    <button
+                        type={"button"}
+                        onClick={tryAgain}
+                        disabled={!uri}
+                        className={
+                            "wails-no-draggable text-netbird hover:underline disabled:cursor-not-allowed disabled:opacity-40"
+                        }
+                    >
+                        {t("browserLogin.tryAgain")}
+                    </button>
+                </DialogDescription>
+            </div>
+
+            <DialogActions>
+                <Button
+                    autoFocus
+                    variant={"secondary"}
+                    size={"md"}
+                    className={"w-full"}
+                    onClick={cancel}
+                >
+                    {t("common.cancel")}
+                </Button>
+            </DialogActions>
+        </ConfirmDialog>
+    );
+}
diff --git a/client/ui/frontend/src/modules/main/MainConnectionStatusSwitch.tsx b/client/ui/frontend/src/modules/main/MainConnectionStatusSwitch.tsx
new file mode 100644
index 000000000..c2a648278
--- /dev/null
+++ b/client/ui/frontend/src/modules/main/MainConnectionStatusSwitch.tsx
@@ -0,0 +1,410 @@
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { Events } from "@wailsio/runtime";
+import { Connection, WindowManager } from "@bindings/services";
+import { ToggleSwitch } from "@/components/switches/ToggleSwitch.tsx";
+import { useStatus } from "@/contexts/StatusContext.tsx";
+import { useProfile } from "@/contexts/ProfileContext.tsx";
+import { cn } from "@/lib/cn.ts";
+import { errorDialog, formatErrorMessage } from "@/lib/errors.ts";
+import {
+    startConnection,
+    EVENT_BROWSER_LOGIN_CANCEL,
+    EVENT_TRIGGER_LOGIN,
+} from "@/lib/connection.ts";
+import { CopyToClipboard } from "@/components/CopyToClipboard";
+import { TruncatedText } from "@/components/TruncatedText";
+import { shortenDns } from "@/lib/formatters";
+import { contentTop } from "@/components/empty-state/EmptyState";
+import { useFocusVisible } from "@/hooks/useFocusVisible";
+import { Check as CheckIcon, ChevronDownIcon, Copy as CopyIcon } from "lucide-react";
+import * as Popover from "@radix-ui/react-popover";
+import netbirdFullLogo from "@/assets/logos/netbird-full.svg";
+
+enum ConnectionState {
+    Disconnected = "disconnected",
+    Connecting = "connecting",
+    Connected = "connected",
+    Disconnecting = "disconnecting",
+}
+
+const STATUS_KEY: Record<ConnectionState, string> = {
+    [ConnectionState.Disconnected]: "connect.status.disconnected",
+    [ConnectionState.Connecting]: "connect.status.connecting",
+    [ConnectionState.Connected]: "connect.status.connected",
+    [ConnectionState.Disconnecting]: "connect.status.disconnecting",
+};
+
+const NEEDS_LOGIN_STATES = new Set(["NeedsLogin", "SessionExpired", "LoginFailed"]);
+
+const FORCE_TOGGLE_DELAY_MS = 7000;
+
+const errorMessage = formatErrorMessage;
+
+export const MainConnectionStatusSwitch = () => {
+    const { t } = useTranslation();
+    const { status, refresh } = useStatus();
+    const { activeProfileId, username } = useProfile();
+
+    const daemonState = status?.status ?? "Idle";
+    const needsLogin = NEEDS_LOGIN_STATES.has(daemonState);
+    const unreachable = daemonState === "DaemonUnavailable";
+
+    type Action = "connect" | "logging-in" | "disconnect" | null;
+    const [action, setAction] = useState<Action>(null);
+
+    const loginGuard = useRef(false);
+    const driveLogin = useCallback(() => {
+        if (loginGuard.current) return;
+        loginGuard.current = true;
+        setAction("logging-in");
+        void startConnection(() => {
+            loginGuard.current = false;
+            setAction(null);
+            refresh().catch((err: unknown) => console.error("refresh after login failed", err));
+        });
+    }, [refresh]);
+
+    const connState: ConnectionState = useMemo(() => {
+        if (action === "disconnect" && daemonState === "Connected") {
+            return ConnectionState.Disconnecting;
+        }
+        if ((action === "connect" || action === "logging-in") && daemonState !== "Connected") {
+            return ConnectionState.Connecting;
+        }
+        switch (daemonState) {
+            case "Connected":
+                return ConnectionState.Connected;
+            case "Connecting":
+                return ConnectionState.Connecting;
+            case "Idle":
+            case "NeedsLogin":
+            case "LoginFailed":
+            case "SessionExpired":
+            case "DaemonUnavailable":
+                return ConnectionState.Disconnected;
+            default:
+                return ConnectionState.Disconnected;
+        }
+    }, [daemonState, action]);
+
+    const connect = async () => {
+        setAction("connect");
+        try {
+            await Connection.Up({
+                profileName: activeProfileId,
+                username,
+            });
+            await refresh();
+        } catch (e) {
+            setAction(null);
+            await refresh();
+            await errorDialog({
+                Title: t("connect.error.connectTitle"),
+                Message: errorMessage(e),
+            });
+        }
+    };
+
+    const disconnect = async () => {
+        setAction("disconnect");
+        try {
+            await Connection.Down();
+            await refresh();
+        } catch (e) {
+            setAction(null);
+            await refresh();
+            await errorDialog({
+                Title: t("connect.error.disconnectTitle"),
+                Message: errorMessage(e),
+            });
+        }
+    };
+
+    const sawConnectingRef = useRef(false);
+
+    useEffect(() => {
+        if (action === null) {
+            sawConnectingRef.current = false;
+            return;
+        }
+        if (daemonState === "Connecting") {
+            sawConnectingRef.current = true;
+        }
+        if (action === "connect") {
+            if (needsLogin) {
+                driveLogin();
+                return;
+            }
+            if (daemonState === "Connected" || unreachable) {
+                setAction(null);
+                return;
+            }
+            if (sawConnectingRef.current && daemonState === "Idle") {
+                setAction(null);
+            }
+            return;
+        }
+        if (action === "disconnect") {
+            if (daemonState === "Idle" || daemonState === "Disconnected" || unreachable) {
+                setAction(null);
+            }
+        }
+    }, [action, daemonState, needsLogin, unreachable, driveLogin]);
+
+    useEffect(() => {
+        const off = Events.On(EVENT_TRIGGER_LOGIN, () => {
+            driveLogin();
+        });
+        return () => off();
+    }, [driveLogin]);
+
+    const handleSwitch = (next: boolean) => {
+        if (unreachable) return;
+        if (isTransitioning) {
+            if (canForceCancel) void forceCancel();
+            return;
+        }
+        if (action !== null) return;
+        if (needsLogin) {
+            driveLogin();
+            return;
+        }
+        if (next && connState === ConnectionState.Disconnected) {
+            void connect();
+        } else if (!next && connState === ConnectionState.Connected) {
+            void disconnect();
+        }
+    };
+
+    const isTransitioning =
+        connState === ConnectionState.Connecting || connState === ConnectionState.Disconnecting;
+    const isOn =
+        connState === ConnectionState.Connected || connState === ConnectionState.Connecting;
+
+    const [canForceCancel, setCanForceCancel] = useState(false);
+    useEffect(() => {
+        if (!isTransitioning) {
+            setCanForceCancel(false);
+            return;
+        }
+        const id = setTimeout(() => setCanForceCancel(true), FORCE_TOGGLE_DELAY_MS);
+        return () => clearTimeout(id);
+    }, [isTransitioning]);
+
+    const forceCancel = async () => {
+        if (action === "logging-in") {
+            Events.Emit(EVENT_BROWSER_LOGIN_CANCEL).catch((err: unknown) =>
+                console.error("emit browser-login cancel failed", err),
+            );
+        }
+        WindowManager.CloseBrowserLogin().catch((err: unknown) =>
+            console.warn("close browser-login window failed", err),
+        );
+        setAction("disconnect");
+        try {
+            await Connection.Down();
+            await refresh();
+        } catch (e) {
+            setAction(null);
+            await refresh();
+            await errorDialog({
+                Title: t("connect.error.disconnectTitle"),
+                Message: errorMessage(e),
+            });
+        }
+    };
+    const show = connState === ConnectionState.Connected;
+    const fqdn = status?.local.fqdn || "";
+    const ip = status?.local.ip || "";
+    const ipv6 = status?.local.ipv6 || "";
+
+    return (
+        <div
+            className={cn("flex h-full w-full flex-col items-center gap-4", "relative")}
+            style={{ top: contentTop("11.7rem") }}
+        >
+            <img
+                src={netbirdFullLogo}
+                alt={"NetBird"}
+                className={"wails-no-draggable mb-4 h-7 w-auto select-none"}
+                draggable={false}
+            />
+
+            <ToggleSwitch
+                size={"large"}
+                checked={isOn}
+                onCheckedChange={handleSwitch}
+                disabled={(isTransitioning && !canForceCancel) || unreachable}
+                aria-label={t("connect.toggle.label")}
+                aria-describedby={"nb-connection-status"}
+                aria-busy={isTransitioning}
+                className={cn(unreachable && "opacity-80", isTransitioning && "animate-pulse")}
+            />
+
+            <div className={"flex flex-col items-center"}>
+                <p
+                    id={"nb-connection-status"}
+                    role={"status"}
+                    aria-live={"polite"}
+                    className={
+                        "wails-no-draggable mb-1 select-none text-sm font-medium tracking-wide text-nb-gray-200 transition-colors duration-300"
+                    }
+                >
+                    {t(STATUS_KEY[connState])}
+                </p>
+                <CopyToClipboard
+                    message={fqdn}
+                    variant={"bright"}
+                    iconClassName={"-top-px"}
+                    tabIndex={show && fqdn ? 0 : -1}
+                    className={cn(
+                        "mt-1 max-h-[1em] min-h-[1em] max-w-full transition-opacity duration-300",
+                        "relative left-[0.55rem]",
+                        show && fqdn ? "opacity-100" : "pointer-events-none opacity-0",
+                    )}
+                >
+                    <TruncatedText
+                        text={shortenDns(fqdn) || " "}
+                        className={
+                            "block h-[18px] max-w-[310px] truncate font-mono text-[0.8rem] leading-tight text-nb-gray-300"
+                        }
+                    />
+                </CopyToClipboard>
+                <LocalIpLine ip={ip} ipv6={ipv6} show={show} />
+            </div>
+        </div>
+    );
+};
+
+const LocalIpLine = ({ ip, ipv6, show }: { ip: string; ipv6: string; show: boolean }) => {
+    const { t } = useTranslation();
+    const [open, setOpen] = useState(false);
+    const isFocusVisible = useFocusVisible();
+    const hasV6 = !!ipv6;
+
+    if (!hasV6) {
+        return (
+            <CopyToClipboard
+                message={ip}
+                variant={"bright"}
+                tabIndex={show && ip ? 0 : -1}
+                className={cn(
+                    "mt-1 max-h-[1em] min-h-[1em] transition-opacity duration-300",
+                    "relative left-[0.55rem]",
+                    show && ip ? "opacity-100" : "pointer-events-none opacity-0",
+                )}
+            >
+                <span className={"font-mono text-[0.8rem] leading-tight text-nb-gray-300"}>
+                    {ip || " "}
+                </span>
+            </CopyToClipboard>
+        );
+    }
+
+    return (
+        <div
+            className={cn(
+                "min-h-[1em] max-w-full transition-opacity duration-300",
+                "wails-no-draggable relative",
+                show && ip ? "opacity-100" : "pointer-events-none opacity-0",
+            )}
+        >
+            <Popover.Root open={open} onOpenChange={setOpen}>
+                <Popover.Trigger asChild>
+                    <button
+                        type={"button"}
+                        tabIndex={show && ip ? 0 : -1}
+                        aria-label={t("connect.localIp.label")}
+                        aria-haspopup={"dialog"}
+                        aria-expanded={open}
+                        className={cn(
+                            "group relative inline-flex cursor-default items-center rounded-sm outline-none",
+                            isFocusVisible &&
+                                "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                            "transition-colors",
+                        )}
+                    >
+                        <span
+                            className={cn(
+                                "font-mono text-[0.8rem] leading-tight text-nb-gray-300 transition-colors",
+                                "group-hover:text-nb-gray-200",
+                                "group-data-[state=open]:text-nb-gray-200",
+                            )}
+                        >
+                            {ip || " "}
+                        </span>
+                        <ChevronDownIcon
+                            size={14}
+                            aria-hidden={"true"}
+                            className={cn(
+                                "absolute -right-5 top-1/2 -translate-y-1/2",
+                                "shrink-0 text-nb-gray-300 transition-colors",
+                                "group-hover:text-nb-gray-200",
+                                "group-data-[state=open]:text-nb-gray-200",
+                            )}
+                        />
+                    </button>
+                </Popover.Trigger>
+                <Popover.Portal>
+                    <Popover.Content
+                        side={"bottom"}
+                        align={"center"}
+                        sideOffset={6}
+                        onOpenAutoFocus={(e) => e.preventDefault()}
+                        className={cn(
+                            "z-50 min-w-64 max-w-[280px] overflow-hidden",
+                            "rounded-lg border border-nb-gray-900 bg-nb-gray-935",
+                            "p-1 text-nb-gray-200 shadow-lg outline-none",
+                            "flex flex-col",
+                        )}
+                    >
+                        <IpRow value={ip} />
+                        <div className={"-mx-1 my-1 h-px bg-nb-gray-910"} />
+                        <IpRow value={ipv6} />
+                    </Popover.Content>
+                </Popover.Portal>
+            </Popover.Root>
+        </div>
+    );
+};
+
+const IpRow = ({ value }: { value: string }) => {
+    const { t } = useTranslation();
+    const [copied, setCopied] = useState(false);
+    const isFocusVisible = useFocusVisible();
+    const handleClick = async () => {
+        if (!value) return;
+        try {
+            await navigator.clipboard.writeText(value);
+            setCopied(true);
+            setTimeout(() => setCopied(false), 500);
+        } catch (e) {
+            console.warn("copy IP to clipboard failed", e);
+        }
+    };
+    return (
+        <button
+            type={"button"}
+            onClick={handleClick}
+            tabIndex={0}
+            aria-label={`${t("common.copy")} ${value}`}
+            className={cn(
+                "group/iprow relative flex items-center justify-between gap-3",
+                "rounded-md px-2 py-1.5 text-left",
+                "text-nb-gray-200 hover:bg-nb-gray-900 hover:text-nb-gray-50",
+                "cursor-default outline-none transition-colors",
+                isFocusVisible &&
+                    "focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-white/60",
+            )}
+        >
+            <span className={"min-w-0 truncate font-mono text-[0.75rem]"}>{value}</span>
+            <span
+                aria-hidden={"true"}
+                className={"inline-flex shrink-0 items-center text-nb-gray-200"}
+            >
+                {copied ? <CheckIcon size={11} /> : <CopyIcon size={11} />}
+            </span>
+        </button>
+    );
+};
diff --git a/client/ui/frontend/src/modules/main/MainExitNodeSwitcher.tsx b/client/ui/frontend/src/modules/main/MainExitNodeSwitcher.tsx
new file mode 100644
index 000000000..fc7ce37b2
--- /dev/null
+++ b/client/ui/frontend/src/modules/main/MainExitNodeSwitcher.tsx
@@ -0,0 +1,256 @@
+import { forwardRef, useRef, useState } from "react";
+import { useTranslation } from "react-i18next";
+import * as Popover from "@radix-ui/react-popover";
+import * as ScrollArea from "@radix-ui/react-scroll-area";
+import { Command } from "cmdk";
+import { Check, ChevronsUpDown, type LucideProps, SquareArrowUpRight } from "lucide-react";
+import { cn } from "@/lib/cn";
+import { TruncatedText } from "@/components/TruncatedText";
+import { useNetworks } from "@/contexts/NetworksContext";
+import { useStatus } from "@/contexts/StatusContext";
+import { useFocusVisible } from "@/hooks/useFocusVisible";
+
+const NONE_VALUE = "__none__";
+
+export const MainExitNodeSwitcher = () => {
+    const { t } = useTranslation();
+    const { status } = useStatus();
+    const { exitNodes, toggleExitNode } = useNetworks();
+    const active = exitNodes.find((n) => n.selected) ?? null;
+    const isConnected = status?.status === "Connected";
+    const hasAny = exitNodes.length > 0;
+    const disabled = !isConnected || !hasAny;
+
+    const [open, setOpen] = useState(false);
+    const listRef = useRef<HTMLDivElement>(null);
+
+    const handleTriggerKeyDown = (e: React.KeyboardEvent<HTMLButtonElement>) => {
+        if (open || disabled) return;
+        if (e.key === "ArrowDown" || e.key === "ArrowUp") {
+            e.preventDefault();
+            setOpen(true);
+        }
+    };
+
+    const handleSelect = (next: string) => {
+        setOpen(false);
+        if (next === NONE_VALUE) {
+            if (active)
+                toggleExitNode(active.id, true).catch((err: unknown) =>
+                    console.error("toggle exit node failed", err),
+                );
+            return;
+        }
+        if (active?.id === next) return;
+        toggleExitNode(next, false).catch((err: unknown) =>
+            console.error("toggle exit node failed", err),
+        );
+    };
+
+    const title = active ? active.id : t("exitNodes.card.title");
+    const activeDescription = active
+        ? t("exitNodes.card.statusActive")
+        : t("exitNodes.card.statusInactive");
+    const description = hasAny ? activeDescription : t("exitNodes.empty.title");
+
+    return (
+        <Popover.Root open={open} onOpenChange={setOpen}>
+            <Popover.Trigger asChild className={"wails-no-draggable"}>
+                <ExitNodeTriggerCard
+                    title={title}
+                    description={description}
+                    disabled={disabled}
+                    active={!!active}
+                    aria-label={t("exitNodes.dropdown.trigger")}
+                    aria-haspopup={"listbox"}
+                    aria-expanded={open}
+                    onKeyDown={handleTriggerKeyDown}
+                />
+            </Popover.Trigger>
+            <Popover.Portal>
+                <Popover.Content
+                    align={"center"}
+                    side={"top"}
+                    sideOffset={8}
+                    collisionPadding={12}
+                    onOpenAutoFocus={(e) => {
+                        e.preventDefault();
+                        listRef.current?.focus();
+                    }}
+                    style={{ width: "var(--radix-popover-trigger-width)" }}
+                    className={cn(
+                        "wails-no-draggable z-50 select-none overflow-hidden rounded-lg border border-nb-gray-900 bg-nb-gray-935 p-1 text-nb-gray-200 shadow-lg",
+                        "data-[state=open]:animate-in data-[state=closed]:animate-out",
+                        "data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0",
+                        "data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95",
+                        "data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2",
+                        "data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2",
+                    )}
+                >
+                    <Command
+                        loop
+                        shouldFilter={false}
+                        onKeyDown={(e) => e.stopPropagation()}
+                        className={"outline-none focus:outline-none focus-visible:outline-none"}
+                    >
+                        <Command.List
+                            ref={listRef}
+                            aria-label={t("exitNodes.dropdown.trigger")}
+                            className={"outline-none focus:outline-none focus-visible:outline-none"}
+                        >
+                            <NoneRow isActive={!active} onSelect={() => handleSelect(NONE_VALUE)} />
+                            {hasAny && <div className={"-mx-1 my-1 h-px bg-nb-gray-910"} />}
+                            {hasAny && (
+                                <ScrollArea.Root type={"auto"} className={"-mx-1 overflow-hidden"}>
+                                    <ScrollArea.Viewport className={"max-h-72 px-1"}>
+                                        {exitNodes.map((n) => (
+                                            <ExitNodeRow
+                                                key={n.id}
+                                                id={n.id}
+                                                label={n.id}
+                                                isActive={active?.id === n.id}
+                                                onSelect={() => handleSelect(n.id)}
+                                            />
+                                        ))}
+                                    </ScrollArea.Viewport>
+                                    <ScrollArea.Scrollbar
+                                        orientation={"vertical"}
+                                        className={cn(
+                                            "flex touch-none select-none transition-colors",
+                                            "w-1.5 bg-transparent",
+                                        )}
+                                    >
+                                        <ScrollArea.Thumb
+                                            className={
+                                                "relative flex-1 rounded-full bg-nb-gray-800 hover:bg-nb-gray-700"
+                                            }
+                                        />
+                                    </ScrollArea.Scrollbar>
+                                </ScrollArea.Root>
+                            )}
+                        </Command.List>
+                    </Command>
+                </Popover.Content>
+            </Popover.Portal>
+        </Popover.Root>
+    );
+};
+
+type TriggerProps = React.ButtonHTMLAttributes<HTMLButtonElement> & {
+    title: string;
+    description: string;
+    active?: boolean;
+};
+
+const ExitNodeTriggerCard = forwardRef<HTMLButtonElement, TriggerProps>(
+    function ExitNodeTriggerCard(
+        { title, description, disabled, active = false, className, ...props },
+        ref,
+    ) {
+        const isFocusVisible = useFocusVisible();
+        return (
+            <button
+                ref={ref}
+                type={"button"}
+                tabIndex={0}
+                disabled={disabled}
+                className={cn(
+                    "flex w-full items-center gap-3 rounded-xl p-2.5 pr-5 text-left outline-none",
+                    "border border-nb-gray-920 bg-nb-gray-940",
+                    "transition-colors duration-150",
+                    "wails-no-draggable",
+                    isFocusVisible &&
+                        "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                    disabled
+                        ? "cursor-not-allowed opacity-60"
+                        : "cursor-default hover:border-nb-gray-900 hover:bg-nb-gray-935 data-[state=open]:border-nb-gray-900 data-[state=open]:bg-nb-gray-935",
+                    className,
+                )}
+                {...props}
+            >
+                <div
+                    aria-hidden={"true"}
+                    className={cn(
+                        "flex h-9 w-9 shrink-0 items-center justify-center rounded-md",
+                        active
+                            ? "bg-green-500/25 text-green-400"
+                            : "bg-nb-gray-900 text-nb-gray-300",
+                    )}
+                >
+                    <ExitNodeIcon size={14} />
+                </div>
+                <div className={"min-w-0 flex-1"}>
+                    <span className={"block truncate text-sm font-medium text-nb-gray-100"}>
+                        {title}
+                    </span>
+                    <TruncatedText
+                        text={description}
+                        className={
+                            "block max-w-full truncate text-[0.85rem] font-medium text-nb-gray-400"
+                        }
+                    />
+                </div>
+                <ChevronsUpDown
+                    size={16}
+                    aria-hidden={"true"}
+                    className={"shrink-0 text-nb-gray-400"}
+                />
+            </button>
+        );
+    },
+);
+
+type NoneRowProps = {
+    isActive: boolean;
+    onSelect: () => void;
+};
+
+const NoneRow = ({ isActive, onSelect }: NoneRowProps) => {
+    const { t } = useTranslation();
+    return (
+        <Command.Item
+            value={NONE_VALUE}
+            onSelect={onSelect}
+            className={cn(
+                "flex items-center gap-2 px-2 py-2 pr-3",
+                "cursor-default rounded-md text-sm outline-none",
+                "data-[selected=true]:bg-nb-gray-900",
+            )}
+        >
+            <span className={"min-w-0 flex-1 truncate"}>{t("exitNodes.dropdown.noneTitle")}</span>
+            {isActive && (
+                <Check size={16} aria-hidden={"true"} className={"shrink-0 text-netbird"} />
+            )}
+        </Command.Item>
+    );
+};
+
+type ExitNodeRowProps = {
+    id: string;
+    label: string;
+    isActive: boolean;
+    onSelect: () => void;
+};
+
+const ExitNodeRow = ({ id, label, isActive, onSelect }: ExitNodeRowProps) => (
+    <Command.Item
+        value={id}
+        onSelect={onSelect}
+        className={cn(
+            "flex items-center gap-2 px-2 py-2 pr-3",
+            "cursor-default rounded-md text-sm outline-none",
+            "data-[selected=true]:bg-nb-gray-900",
+        )}
+    >
+        <span className={"min-w-0 flex-1 truncate"}>{label}</span>
+        {isActive && <Check size={16} aria-hidden={"true"} className={"shrink-0 text-netbird"} />}
+    </Command.Item>
+);
+
+const ExitNodeIcon = ({ size, ...props }: LucideProps) => (
+    <SquareArrowUpRight
+        {...props}
+        size={typeof size === "number" ? size - 2 : size}
+        className={cn("rotate-45", props.className)}
+    />
+);
diff --git a/client/ui/frontend/src/modules/main/MainHeader.tsx b/client/ui/frontend/src/modules/main/MainHeader.tsx
new file mode 100644
index 000000000..becfde47c
--- /dev/null
+++ b/client/ui/frontend/src/modules/main/MainHeader.tsx
@@ -0,0 +1,192 @@
+import { useCallback, useState } from "react";
+import { useTranslation } from "react-i18next";
+import {
+    ArrowUpCircleIcon,
+    Check,
+    MoreVertical,
+    PanelsRightBottom,
+    RectangleVertical,
+    Settings,
+    type LucideIcon,
+} from "lucide-react";
+import { WindowManager } from "@bindings/services";
+import {
+    DropdownMenu,
+    DropdownMenuContent,
+    DropdownMenuItem,
+    DropdownMenuSeparator,
+    DropdownMenuShortcut,
+    DropdownMenuTrigger,
+} from "@/components/DropdownMenu";
+import { IconButton } from "@/components/buttons/IconButton";
+import { ProfileDropdown } from "@/modules/profiles/ProfileDropdown";
+import { useClientVersion } from "@/contexts/ClientVersionContext";
+import { cn } from "@/lib/cn";
+import { formatShortcut, useKeyboardShortcut } from "@/hooks/useKeyboardShortcut";
+import { useViewMode, type ViewMode } from "@/contexts/ViewModeContext";
+import { useRestrictions } from "@/contexts/RestrictionsContext";
+import { isWindows } from "@/lib/platform.ts";
+
+const SETTINGS_SHORTCUT = { key: ",", cmd: true } as const;
+
+export const MainHeader = () => {
+    const { t } = useTranslation();
+    const [menuOpen, setMenuOpen] = useState(false);
+    const { viewMode, setViewMode } = useViewMode();
+    const { updateAvailable } = useClientVersion();
+    const { mdm, features } = useRestrictions();
+
+    const openSettings = useCallback(() => {
+        setMenuOpen(false);
+        WindowManager.OpenSettings("").catch((err: unknown) =>
+            console.error("open settings window failed", err),
+        );
+    }, []);
+
+    useKeyboardShortcut(SETTINGS_SHORTCUT, openSettings);
+
+    const openAbout = () => {
+        setMenuOpen(false);
+        WindowManager.OpenSettings("about").catch((err: unknown) =>
+            console.error("open settings (about) window failed", err),
+        );
+    };
+
+    const openManageProfiles = () => {
+        WindowManager.OpenSettings("profiles").catch((err: unknown) =>
+            console.error("open settings (profiles) window failed", err),
+        );
+    };
+
+    const selectMode = (mode: ViewMode) => {
+        setMenuOpen(false);
+        setViewMode(mode);
+    };
+
+    const profileSlot = features.disableProfiles ? null : (
+        <ProfileDropdown onManageProfiles={openManageProfiles} />
+    );
+
+    const settingsSlot = (
+        <div className={"relative"}>
+            <DropdownMenu modal={false} open={menuOpen} onOpenChange={setMenuOpen}>
+                <DropdownMenuTrigger asChild className={"wails-no-draggable"}>
+                    <IconButton
+                        icon={MoreVertical}
+                        iconClassName={"text-nb-gray-200 wails-no-draggable"}
+                        className={"select-none"}
+                        aria-label={t("header.menu.open")}
+                        aria-haspopup={"menu"}
+                        aria-expanded={menuOpen}
+                    />
+                </DropdownMenuTrigger>
+                <DropdownMenuContent
+                    align={"end"}
+                    sideOffset={8}
+                    className={
+                        "min-w-52 select-none data-[state=closed]:!animate-none data-[state=closed]:!duration-0"
+                    }
+                >
+                    {updateAvailable && (
+                        <>
+                            <DropdownMenuItem onClick={openAbout}>
+                                <div className={"flex items-center gap-2"}>
+                                    <ArrowUpCircleIcon
+                                        size={14}
+                                        className={"text-netbird"}
+                                        aria-hidden={"true"}
+                                    />
+                                    <span className={"text-netbird"}>
+                                        {t("header.menu.updateAvailable")}
+                                    </span>
+                                </div>
+                            </DropdownMenuItem>
+                            <DropdownMenuSeparator />
+                        </>
+                    )}
+                    <DropdownMenuItem onClick={openSettings}>
+                        <div className={"flex w-full items-center gap-2"}>
+                            <Settings size={14} aria-hidden={"true"} />
+                            <span className={"flex-1"}>{t("header.menu.settings")}</span>
+                            <DropdownMenuShortcut>
+                                {formatShortcut(SETTINGS_SHORTCUT)}
+                            </DropdownMenuShortcut>
+                        </div>
+                    </DropdownMenuItem>
+                    {!mdm.disableAdvancedView && (
+                        <>
+                            <DropdownMenuSeparator />
+                            <ViewModeItem
+                                icon={RectangleVertical}
+                                label={t("header.menu.defaultView")}
+                                selected={viewMode === "default"}
+                                onSelect={() => selectMode("default")}
+                            />
+                            <ViewModeItem
+                                icon={PanelsRightBottom}
+                                label={t("header.menu.advancedView")}
+                                selected={viewMode === "advanced"}
+                                onSelect={() => selectMode("advanced")}
+                            />
+                        </>
+                    )}
+                </DropdownMenuContent>
+            </DropdownMenu>
+            {updateAvailable && (
+                <span
+                    aria-hidden={"true"}
+                    className={
+                        "pointer-events-none absolute right-1.5 top-1.5 flex h-2.5 w-2.5 items-center justify-center"
+                    }
+                >
+                    <span
+                        className={
+                            "absolute inset-0 animate-ping rounded-full bg-netbird opacity-60"
+                        }
+                    />
+                    <span className={"relative h-1.5 w-1.5 rounded-full bg-netbird"} />
+                </span>
+            )}
+        </div>
+    );
+
+    return (
+        <header
+            className={cn(
+                "wails-draggable relative z-10 shrink-0 cursor-default",
+                "top-3 flex h-12 items-center",
+            )}
+        >
+            {/* Windows narrower width compensates for the OS frame Wails counts differently than macOS.
+                See https://github.com/wailsapp/wails/issues/3260 */}
+            <div
+                className={cn(
+                    "grid shrink-0 grid-cols-3 items-center",
+                    isWindows() ? "w-[364px]" : "w-[380px]",
+                )}
+            >
+                <div />
+                <div className={"ml-4 flex justify-center"}>{profileSlot}</div>
+                <div />
+            </div>
+            <div className={"absolute right-[1.3rem] top-1/2 -translate-y-1/2"}>{settingsSlot}</div>
+        </header>
+    );
+};
+
+type ViewModeItemProps = {
+    icon: LucideIcon;
+    label: string;
+    selected: boolean;
+    onSelect: () => void;
+};
+
+const ViewModeItem = ({ icon: Icon, label, selected, onSelect }: ViewModeItemProps) => (
+    <DropdownMenuItem onClick={onSelect} role={"menuitemradio"} aria-checked={selected}>
+        <div className={"flex w-full items-center gap-2"}>
+            <Icon size={14} aria-hidden={"true"} />
+            <span className={"flex-1"}>{label}</span>
+            {selected && <Check size={14} className={"text-netbird"} aria-hidden={"true"} />}
+        </div>
+    </DropdownMenuItem>
+);
diff --git a/client/ui/frontend/src/modules/main/MainPage.tsx b/client/ui/frontend/src/modules/main/MainPage.tsx
new file mode 100644
index 000000000..c05b3a025
--- /dev/null
+++ b/client/ui/frontend/src/modules/main/MainPage.tsx
@@ -0,0 +1,114 @@
+import { MainConnectionStatusSwitch } from "@/modules/main/MainConnectionStatusSwitch.tsx";
+import { MainExitNodeSwitcher } from "@/modules/main/MainExitNodeSwitcher.tsx";
+import { MainHeader } from "@/modules/main/MainHeader.tsx";
+import { AppRightPanel } from "@/layouts/AppRightPanel.tsx";
+import { Navigation } from "@/modules/main/advanced/Navigation.tsx";
+import { cn } from "@/lib/cn";
+import { NavSectionProvider, useNavSection } from "@/contexts/NavSectionContext";
+import { ViewModeProvider, useViewMode } from "@/contexts/ViewModeContext";
+import { useEffect } from "react";
+import { NotConnectedState } from "@/components/empty-state/NotConnectedState";
+import { useStatus } from "@/contexts/StatusContext";
+import { Peers } from "@/modules/main/advanced/peers/Peers";
+import { Networks } from "@/modules/main/advanced/networks/Networks";
+import { NetworksProvider } from "@/contexts/NetworksContext";
+import { PeerDetailProvider, usePeerDetail } from "@/contexts/PeerDetailContext";
+import { useRestrictions } from "@/contexts/RestrictionsContext";
+import { PeerDetailPanel } from "@/modules/main/advanced/peers/PeerDetailPanel";
+import { isWindows } from "@/lib/platform.ts";
+
+export const MainPage = () => {
+    return (
+        <ViewModeProvider>
+            <MainHeader />
+            <NetworksProvider>
+                <PeerDetailProvider>
+                    <MainBody />
+                </PeerDetailProvider>
+            </NetworksProvider>
+        </ViewModeProvider>
+    );
+};
+
+const MainBody = () => {
+    const { viewMode, setViewMode } = useViewMode();
+    const { mdm, features } = useRestrictions();
+
+    // Force flip the view if MDM disabled advanced
+    useEffect(() => {
+        if (mdm.disableAdvancedView && viewMode === "advanced") {
+            setViewMode("default");
+        }
+    }, [mdm.disableAdvancedView, viewMode, setViewMode]);
+
+    const isAdvanced = viewMode === "advanced";
+
+    return (
+        <main className={"wails-draggable flex min-h-0 flex-1"}>
+            {/* Windows narrower width compensates for the OS frame Wails counts differently than macOS.
+                See https://github.com/wailsapp/wails/issues/3260 */}
+            <div
+                className={cn(
+                    "relative flex shrink-0 flex-col items-center",
+                    isWindows() ? "w-[364px]" : "w-[380px]",
+                )}
+            >
+                <MainConnectionStatusSwitch />
+                {!features.disableNetworks && (
+                    <div className={"wails-no-draggable absolute bottom-5 left-5 right-5"}>
+                        <MainExitNodeSwitcher />
+                    </div>
+                )}
+            </div>
+            {isAdvanced && (
+                <NavSectionProvider>
+                    <AdvancedAppRightPanel />
+                </NavSectionProvider>
+            )}
+        </main>
+    );
+};
+
+const AdvancedAppRightPanel = () => {
+    const { section } = useNavSection();
+    const { selected } = usePeerDetail();
+    const { status } = useStatus();
+    const isConnected = status?.status === "Connected";
+
+    return (
+        <AppRightPanel
+            overlay={<PeerDetailPanel />}
+            overlayOpen={selected !== null}
+            className={"m-5 ml-0"}
+        >
+            <div
+                ref={(el) => {
+                    if (!el) return;
+                    if (isConnected) el.removeAttribute("inert");
+                    else el.setAttribute("inert", "");
+                }}
+                className={cn(
+                    "flex min-h-0 min-w-0 flex-1 flex-col",
+                    !isConnected && "pointer-events-none select-none",
+                )}
+                aria-hidden={!isConnected}
+            >
+                <Navigation />
+                <div
+                    role={"tabpanel"}
+                    id={`nb-tabpanel-${section}`}
+                    aria-labelledby={`nb-tab-${section}`}
+                    className={"flex min-h-0 flex-1 flex-col"}
+                >
+                    {section === "peers" && <Peers />}
+                    {section === "networks" && <Networks />}
+                </div>
+            </div>
+            {!isConnected && (
+                <div className={"pointer-events-auto absolute inset-0 z-20 flex bg-nb-gray-940"}>
+                    <NotConnectedState />
+                </div>
+            )}
+        </AppRightPanel>
+    );
+};
diff --git a/client/ui/frontend/src/modules/main/advanced/Navigation.tsx b/client/ui/frontend/src/modules/main/advanced/Navigation.tsx
new file mode 100644
index 000000000..8d69f3580
--- /dev/null
+++ b/client/ui/frontend/src/modules/main/advanced/Navigation.tsx
@@ -0,0 +1,134 @@
+import { type ComponentType, type KeyboardEvent, useEffect, useRef } from "react";
+import { useTranslation } from "react-i18next";
+import { Layers3Icon, type LucideProps, MonitorSmartphoneIcon } from "lucide-react";
+import { cn } from "@/lib/cn";
+import { useNavSection, type NavSection } from "@/contexts/NavSectionContext";
+import { useStatus } from "@/contexts/StatusContext";
+import { useRestrictions } from "@/contexts/RestrictionsContext";
+
+type TabEntry = {
+    value: NavSection;
+    label: string;
+    icon: ComponentType<LucideProps>;
+};
+
+export const Navigation = () => {
+    const { t } = useTranslation();
+    const { section, setSection } = useNavSection();
+    const { status } = useStatus();
+    const { features } = useRestrictions();
+    const isConnected = status?.status === "Connected";
+
+    // Reset back to peers tab if mdm or feature flag flipped it
+    useEffect(() => {
+        if (features.disableNetworks && section === "networks") {
+            setSection("peers");
+        }
+    }, [features.disableNetworks, section, setSection]);
+
+    const tabs: TabEntry[] = [
+        {
+            value: "peers",
+            label: t("nav.peers.title"),
+            icon: MonitorSmartphoneIcon,
+        },
+    ];
+    if (!features.disableNetworks) {
+        tabs.push({
+            value: "networks",
+            label: t("nav.resources.title"),
+            icon: Layers3Icon,
+        });
+    }
+
+    const tabRefs = useRef<Record<string, HTMLButtonElement | null>>({});
+
+    const focusTab = (value: NavSection) => {
+        setSection(value);
+        requestAnimationFrame(() => tabRefs.current[value]?.focus());
+    };
+
+    const handleKeyDown = (e: KeyboardEvent<HTMLButtonElement>) => {
+        const enabled = tabs.filter((t) => isConnected || t.value === section);
+        if (enabled.length < 2) return;
+        const currentIndex = enabled.findIndex((t) => t.value === section);
+        if (currentIndex === -1) return;
+        let nextIndex: number;
+        switch (e.key) {
+            case "ArrowRight":
+                nextIndex = (currentIndex + 1) % enabled.length;
+                break;
+            case "ArrowLeft":
+                nextIndex = (currentIndex - 1 + enabled.length) % enabled.length;
+                break;
+            case "Home":
+                nextIndex = 0;
+                break;
+            case "End":
+                nextIndex = enabled.length - 1;
+                break;
+            default:
+                return;
+        }
+        e.preventDefault();
+        focusTab(enabled[nextIndex].value);
+    };
+
+    return (
+        <div
+            role={"tablist"}
+            aria-orientation={"horizontal"}
+            aria-label={t("nav.peers.title")}
+            className={"wails-no-draggable flex shrink-0 items-stretch"}
+        >
+            {tabs.map((tab, index) => {
+                const isActive = tab.value === section;
+                const isDisabled = !isConnected && !isActive;
+                const isFirst = index === 0;
+                const isLast = index === tabs.length - 1;
+                const Icon = tab.icon;
+                return (
+                    <button
+                        key={tab.value}
+                        ref={(el) => {
+                            tabRefs.current[tab.value] = el;
+                        }}
+                        type={"button"}
+                        role={"tab"}
+                        aria-selected={isActive}
+                        aria-controls={`nb-tabpanel-${tab.value}`}
+                        id={`nb-tab-${tab.value}`}
+                        tabIndex={isActive ? 0 : -1}
+                        onClick={() => setSection(tab.value)}
+                        onKeyDown={handleKeyDown}
+                        disabled={isDisabled}
+                        className={cn(
+                            "group relative flex flex-1 items-center justify-center",
+                            "gap-2.5 px-5 py-3.5",
+                            "outline-none transition-all",
+                            isFirst && "rounded-tl-xl",
+                            isLast && "rounded-tr-xl",
+                            "focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-white/60",
+                            isActive ? "text-netbird" : "text-nb-gray-400 hover:text-nb-gray-300",
+                            isDisabled ? "cursor-not-allowed opacity-50" : "cursor-default",
+                        )}
+                    >
+                        <Icon size={14} aria-hidden={"true"} />
+                        <span className={"text-sm font-normal"}>{tab.label}</span>
+                        <span
+                            aria-hidden={"true"}
+                            className={cn(
+                                "absolute inset-x-0 bottom-0 h-px transition-all",
+                                isActive
+                                    ? "bg-netbird"
+                                    : "bg-nb-gray-910 group-hover:bg-nb-gray-700",
+                            )}
+                        />
+                    </button>
+                );
+            })}
+        </div>
+    );
+};
+
+export type { NavSection } from "@/contexts/NavSectionContext";
diff --git a/client/ui/frontend/src/modules/main/advanced/networks/NetworkFilters.tsx b/client/ui/frontend/src/modules/main/advanced/networks/NetworkFilters.tsx
new file mode 100644
index 000000000..ec1823f0b
--- /dev/null
+++ b/client/ui/frontend/src/modules/main/advanced/networks/NetworkFilters.tsx
@@ -0,0 +1,84 @@
+import { useState } from "react";
+import { CheckIcon, ChevronDown, ListFilter } from "lucide-react";
+import { useTranslation } from "react-i18next";
+import { cn } from "@/lib/cn";
+import {
+    DropdownMenu,
+    DropdownMenuContent,
+    DropdownMenuItem,
+    DropdownMenuTrigger,
+} from "@/components/DropdownMenu";
+
+export type NetworkFilter = "all" | "active" | "overlapping";
+
+type Props = {
+    value: NetworkFilter;
+    onChange: (value: NetworkFilter) => void;
+    counts: Record<NetworkFilter, number>;
+    disabled?: boolean;
+};
+
+export const NetworkFilters = ({ value, onChange, counts, disabled }: Props) => {
+    const { t } = useTranslation();
+    const [open, setOpen] = useState(false);
+    const filters: { value: NetworkFilter; label: string }[] = [
+        { value: "all", label: t("networks.filter.all") },
+        { value: "active", label: t("networks.filter.active") },
+        { value: "overlapping", label: t("networks.filter.overlapping") },
+    ];
+    const active = filters.find((f) => f.value === value) ?? filters[0];
+
+    const handleSelect = (v: NetworkFilter) => {
+        onChange(v);
+        setOpen(false);
+    };
+
+    return (
+        <DropdownMenu open={open} onOpenChange={setOpen}>
+            <DropdownMenuTrigger
+                disabled={disabled}
+                tabIndex={0}
+                aria-label={t("common.filter")}
+                className={cn(
+                    "inline-flex h-9 items-center gap-1.5 rounded-md px-2",
+                    "text-sm text-nb-gray-200",
+                    "outline-none transition-colors duration-150 hover:bg-nb-gray-900 data-[state=open]:bg-nb-gray-900",
+                    "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                    "disabled:pointer-events-none disabled:opacity-50",
+                    "wails-no-draggable cursor-default",
+                )}
+            >
+                <ListFilter size={14} aria-hidden={"true"} className={"shrink-0"} />
+                <span>
+                    {active.label} <span className={"tabular-nums"}>({counts[active.value]})</span>
+                </span>
+                <ChevronDown size={14} aria-hidden={"true"} className={"ml-0.5 shrink-0"} />
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align={"end"} className={"min-w-[10rem]"}>
+                {filters.map((f) => {
+                    const checked = f.value === value;
+                    return (
+                        <DropdownMenuItem
+                            key={f.value}
+                            onClick={() => handleSelect(f.value)}
+                            role={"menuitemradio"}
+                            aria-checked={checked}
+                            className={"gap-2"}
+                        >
+                            <span className={"flex-1 truncate"}>
+                                {f.label}{" "}
+                                <span className={"tabular-nums"}>({counts[f.value]})</span>
+                            </span>
+                            <span
+                                aria-hidden={"true"}
+                                className={"flex w-4 shrink-0 items-center justify-center"}
+                            >
+                                {checked && <CheckIcon size={14} className={"text-netbird"} />}
+                            </span>
+                        </DropdownMenuItem>
+                    );
+                })}
+            </DropdownMenuContent>
+        </DropdownMenu>
+    );
+};
diff --git a/client/ui/frontend/src/modules/main/advanced/networks/Networks.tsx b/client/ui/frontend/src/modules/main/advanced/networks/Networks.tsx
new file mode 100644
index 000000000..f6fe23aaf
--- /dev/null
+++ b/client/ui/frontend/src/modules/main/advanced/networks/Networks.tsx
@@ -0,0 +1,528 @@
+import {
+    type KeyboardEvent,
+    useEffect,
+    useMemo,
+    useRef,
+    useState,
+    type ComponentType,
+    type ReactNode,
+} from "react";
+import { useTranslation } from "react-i18next";
+import * as ScrollArea from "@radix-ui/react-scroll-area";
+import { Virtuoso, type VirtuosoHandle } from "react-virtuoso";
+import { GlobeIcon, Layers3Icon, type LucideProps, NetworkIcon, WorkflowIcon } from "lucide-react";
+import type { Network } from "@bindings/services/models.js";
+import { cn } from "@/lib/cn";
+import { reconcileOrder } from "@/lib/sorting";
+import { CopyToClipboard } from "@/components/CopyToClipboard";
+import { Tooltip } from "@/components/Tooltip";
+import { TruncatedText } from "@/components/TruncatedText";
+import { SearchInput } from "@/components/inputs/SearchInput";
+import { EmptyState } from "@/components/empty-state/EmptyState";
+import { NoResults } from "@/components/empty-state/NoResults";
+import { useStatus } from "@/contexts/StatusContext";
+import { useNetworks } from "@/contexts/NetworksContext";
+import { type NetworkFilter, NetworkFilters } from "./NetworkFilters";
+
+// Daemon renders DNS-route prefixes (zero netip.Prefix) as "invalid Prefix".
+const INVALID_PREFIX = "invalid Prefix";
+
+const isDnsRoute = (n: Network): boolean =>
+    n.domains.length > 0 && (!n.range || n.range === INVALID_PREFIX);
+
+type ResourceType = "host" | "subnet" | "domain";
+
+const isHostCidr = (cidr: string): boolean => {
+    const [addr, bitsStr] = cidr.split("/");
+    if (!addr || !bitsStr) return false;
+    const bits = Number(bitsStr);
+    const isV6 = addr.includes(":");
+    return isV6 ? bits === 128 : bits === 32;
+};
+
+const resourceTypeOf = (n: Network): ResourceType => {
+    if (isDnsRoute(n)) return "domain";
+    const primary = n.range.split(",")[0].trim();
+    return isHostCidr(primary) ? "host" : "subnet";
+};
+
+const resourceIconFor = (type: ResourceType): ComponentType<LucideProps> => {
+    if (type === "host") return WorkflowIcon;
+    if (type === "domain") return GlobeIcon;
+    return NetworkIcon;
+};
+
+const buildOverlapMap = (
+    routes: { id: string; range: string; domains: string[] }[],
+): Map<string, string[]> => {
+    const byRange = new Map<string, string[]>();
+    for (const r of routes) {
+        if (r.domains.length > 0) continue;
+        const arr = byRange.get(r.range) ?? [];
+        arr.push(r.id);
+        byRange.set(r.range, arr);
+    }
+    const out = new Map<string, string[]>();
+    for (const [range, ids] of byRange) {
+        if (ids.length > 1) out.set(range, ids);
+    }
+    return out;
+};
+
+export const Networks = () => {
+    const { t } = useTranslation();
+    const { status } = useStatus();
+    const isConnected = status?.status === "Connected";
+    const { networkRoutes, toggleNetwork, setNetworksSelected } = useNetworks();
+    const [search, setSearch] = useState("");
+    const [filter, setFilter] = useState<NetworkFilter>("all");
+    const [scrollParent, setScrollParent] = useState<HTMLDivElement | null>(null);
+    const searchRef = useRef<HTMLInputElement>(null);
+
+    useEffect(() => {
+        searchRef.current?.focus();
+    }, []);
+
+    const overlapGroups = useMemo(() => buildOverlapMap(networkRoutes), [networkRoutes]);
+
+    const overlapById = useMemo(() => {
+        const map = new Map<string, string[]>();
+        for (const ids of overlapGroups.values()) {
+            for (const id of ids) map.set(id, ids);
+        }
+        return map;
+    }, [overlapGroups]);
+
+    const counts = useMemo<Record<NetworkFilter, number>>(
+        () => ({
+            all: networkRoutes.length,
+            active: networkRoutes.filter((r) => r.selected).length,
+            overlapping: overlapById.size,
+        }),
+        [networkRoutes, overlapById],
+    );
+
+    const orderRef = useRef<string[]>([]);
+    const ordered = useMemo(() => {
+        const { order, items } = reconcileOrder(
+            orderRef.current,
+            networkRoutes,
+            (r) => r.id,
+            (a, b) => {
+                if (a.selected !== b.selected) return a.selected ? -1 : 1;
+                return a.id.localeCompare(b.id);
+            },
+        );
+        orderRef.current = order;
+        return items;
+    }, [networkRoutes]);
+
+    const filtered = useMemo(() => {
+        const q = search.trim().toLowerCase();
+        return ordered.filter((r) => {
+            if (filter === "active" && !r.selected) return false;
+            if (filter === "overlapping" && !overlapById.has(r.id)) return false;
+            if (q) {
+                const haystack = [r.id, r.range, ...r.domains].join(" ").toLowerCase();
+                if (!haystack.includes(q)) return false;
+            }
+            return true;
+        });
+    }, [ordered, search, filter, overlapById]);
+
+    if (isConnected && networkRoutes.length === 0) {
+        return (
+            <EmptyState
+                icon={Layers3Icon}
+                title={t("networks.empty.title")}
+                description={t("networks.empty.description")}
+            />
+        );
+    }
+
+    const selectedInView = filtered.filter((r) => r.selected).length;
+    const allSelected = filtered.length > 0 && selectedInView === filtered.length;
+    const bulkLabel = allSelected ? t("networks.bulk.disableAll") : t("networks.bulk.enableAll");
+
+    const onBulkClick = () => {
+        if (filtered.length === 0) return;
+        if (allSelected) {
+            setNetworksSelected(
+                filtered.map((r) => r.id),
+                false,
+            ).catch((err: unknown) => console.error("disable all networks failed", err));
+        } else {
+            const ids = filtered.filter((r) => !r.selected).map((r) => r.id);
+            setNetworksSelected(ids, true).catch((err: unknown) =>
+                console.error("enable all networks failed", err),
+            );
+        }
+    };
+
+    return (
+        <div className={"flex h-full min-h-0 w-full flex-col"}>
+            <div className={"flex items-center gap-2 border-b border-nb-gray-910 px-6 py-2.5"}>
+                <div className={"min-w-0 flex-1"}>
+                    <SearchInput
+                        ref={searchRef}
+                        placeholder={t("networks.search.placeholder")}
+                        value={search}
+                        onChange={(e) => setSearch(e.target.value)}
+                    />
+                </div>
+                <NetworkFilters value={filter} onChange={setFilter} counts={counts} />
+            </div>
+            {filtered.length === 0 ? (
+                <NoResults />
+            ) : (
+                <ScrollArea.Root type={"auto"} className={"min-h-0 flex-1 overflow-hidden"}>
+                    <ScrollArea.Viewport ref={setScrollParent} className={"h-full w-full"}>
+                        {scrollParent && (
+                            <NetworksList
+                                data={filtered}
+                                onToggle={toggleNetwork}
+                                scrollParent={scrollParent}
+                            />
+                        )}
+                    </ScrollArea.Viewport>
+                    <ScrollArea.Scrollbar
+                        orientation={"vertical"}
+                        className={cn(
+                            "flex touch-none select-none transition-colors",
+                            "w-1.5 bg-transparent py-1",
+                        )}
+                    >
+                        <ScrollArea.Thumb
+                            className={
+                                "relative flex-1 rounded-full bg-nb-gray-800 hover:bg-nb-gray-700"
+                            }
+                        />
+                    </ScrollArea.Scrollbar>
+                </ScrollArea.Root>
+            )}
+            {filtered.length > 0 && (
+                <div
+                    className={cn(
+                        "flex items-center gap-3 px-6 py-3.5",
+                        "border-t border-nb-gray-910",
+                    )}
+                >
+                    <span className={"flex-1 text-xs font-medium tabular-nums text-nb-gray-300"}>
+                        {t("networks.bulk.selectionCount", {
+                            selected: selectedInView,
+                            total: filtered.length,
+                        })}
+                    </span>
+                    <button
+                        type={"button"}
+                        tabIndex={0}
+                        onClick={onBulkClick}
+                        aria-label={t("networks.bulk.label")}
+                        className={cn(
+                            "inline-flex h-8 items-center rounded-md px-3",
+                            "text-xs font-medium text-nb-gray-100",
+                            "border border-nb-gray-900 bg-nb-gray-920 hover:border-nb-gray-850 hover:bg-nb-gray-910",
+                            "wails-no-draggable cursor-pointer outline-none transition-colors",
+                            "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                        )}
+                    >
+                        {bulkLabel}
+                    </button>
+                </div>
+            )}
+        </div>
+    );
+};
+
+type NetworksListProps = {
+    data: Network[];
+    onToggle: (id: string, selected: boolean) => void;
+    scrollParent: HTMLElement;
+};
+
+const NetworksHeader = () => <div className={"h-2"} />;
+
+const NetworksList = ({ data, onToggle, scrollParent }: NetworksListProps) => {
+    const virtuosoRef = useRef<VirtuosoHandle>(null);
+    const rowRefs = useRef<Map<string, HTMLButtonElement>>(new Map());
+
+    const focusRow = (index: number) => {
+        if (index < 0 || index >= data.length) return;
+        const row = data[index];
+        const tryFocus = () => {
+            const el = rowRefs.current.get(row.id);
+            if (el) {
+                el.focus();
+                return true;
+            }
+            return false;
+        };
+        if (!tryFocus()) {
+            virtuosoRef.current?.scrollToIndex({ index, behavior: "auto" });
+            requestAnimationFrame(() => {
+                if (!tryFocus()) requestAnimationFrame(tryFocus);
+            });
+        }
+    };
+
+    const handleRowKeyDown = (e: KeyboardEvent<Element>, index: number) => {
+        switch (e.key) {
+            case "ArrowDown":
+                e.preventDefault();
+                focusRow(Math.min(index + 1, data.length - 1));
+                break;
+            case "ArrowUp":
+                e.preventDefault();
+                focusRow(Math.max(index - 1, 0));
+                break;
+            case "Home":
+                e.preventDefault();
+                focusRow(0);
+                break;
+            case "End":
+                e.preventDefault();
+                focusRow(data.length - 1);
+                break;
+        }
+    };
+
+    const setRowRef = (id: string, el: HTMLButtonElement | null) => {
+        if (el) rowRefs.current.set(id, el);
+        else rowRefs.current.delete(id);
+    };
+
+    const ctx = useMemo<NetworkRowContext>(
+        () => ({ onKeyDown: handleRowKeyDown, onToggle, setRowRef }),
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+        [data, onToggle],
+    );
+
+    return (
+        <Virtuoso<Network, NetworkRowContext>
+            ref={virtuosoRef}
+            data={data}
+            customScrollParent={scrollParent}
+            increaseViewportBy={400}
+            computeItemKey={(_, n) => n.id}
+            components={{ Header: NetworksHeader }}
+            context={ctx}
+            itemContent={renderNetworkRow}
+        />
+    );
+};
+
+type NetworkRowContext = {
+    onKeyDown: (e: KeyboardEvent<Element>, index: number) => void;
+    onToggle: (id: string, selected: boolean) => void;
+    setRowRef: (id: string, el: HTMLButtonElement | null) => void;
+};
+
+const renderNetworkRow = (index: number, n: Network, ctx: NetworkRowContext): ReactNode => (
+    <NetworkRow
+        network={n}
+        index={index}
+        onKeyDown={ctx.onKeyDown}
+        onToggle={ctx.onToggle}
+        setRowRef={ctx.setRowRef}
+    />
+);
+
+type NetworkRowProps = {
+    network: Network;
+    index: number;
+    onKeyDown: (e: KeyboardEvent<Element>, index: number) => void;
+    onToggle: (id: string, selected: boolean) => void;
+    setRowRef: (id: string, el: HTMLButtonElement | null) => void;
+};
+
+const NetworkRow = ({ network: n, index, onKeyDown, onToggle, setRowRef }: NetworkRowProps) => {
+    const { t } = useTranslation();
+    // Same handler is attached to the overlay button and to the network-id copy
+    // button so arrow nav works wherever focus sits inside the row.
+    const handleKey = (e: KeyboardEvent<Element>) => onKeyDown(e, index);
+    return (
+        <div
+            className={cn(
+                "group relative flex min-w-0 items-start gap-2.5 py-3 pl-6 pr-9",
+                "transition-colors hover:bg-nb-gray-900/40",
+                "wails-no-draggable",
+            )}
+        >
+            <button
+                type={"button"}
+                tabIndex={0}
+                ref={(el) => setRowRef(n.id, el)}
+                aria-label={t("networks.row.toggle", { name: n.id })}
+                aria-pressed={n.selected}
+                onClick={() => onToggle(n.id, n.selected)}
+                onKeyDown={handleKey}
+                className={cn(
+                    "absolute inset-0 cursor-pointer outline-none",
+                    "focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-white/60",
+                )}
+            />
+            <ResourceIconBadge type={resourceTypeOf(n)} />
+            <div
+                className={
+                    "pointer-events-none relative flex min-w-0 flex-1 flex-col leading-tight"
+                }
+            >
+                <div>
+                    <CopyToClipboard message={n.id} onKeyDown={handleKey}>
+                        <TruncatedText
+                            text={n.id}
+                            className={
+                                "block max-w-[300px] truncate text-[0.81rem] font-medium text-nb-gray-100"
+                            }
+                        />
+                    </CopyToClipboard>
+                </div>
+                <Subtitle network={n} onKeyDown={handleKey} />
+            </div>
+            <div
+                aria-hidden={"true"}
+                className={"pointer-events-none relative shrink-0 self-center"}
+            >
+                <NetworkToggle checked={n.selected} />
+            </div>
+        </div>
+    );
+};
+
+const ResourceIconBadge = ({ type }: { type: ResourceType }) => {
+    const Icon = resourceIconFor(type);
+    return (
+        <div
+            aria-hidden={"true"}
+            className={cn(
+                "mt-[0.25rem] flex h-9 w-9 shrink-0 items-center justify-center rounded-md",
+                "border border-nb-gray-900 bg-nb-gray-920 text-nb-gray-300",
+            )}
+        >
+            <Icon size={14} />
+        </div>
+    );
+};
+
+type SubtitleProps = {
+    network: Network;
+    onKeyDown: (e: KeyboardEvent<Element>) => void;
+};
+
+const Subtitle = ({ network, onKeyDown }: SubtitleProps) => {
+    if (isDnsRoute(network)) {
+        const domain = network.domains[0];
+        const ips = network.resolvedIps[domain] ?? [];
+        return <DomainSubtitle domain={domain} ips={ips} onKeyDown={onKeyDown} />;
+    }
+
+    if (network.range && network.range !== INVALID_PREFIX) {
+        return (
+            <div>
+                <CopyToClipboard message={network.range} onKeyDown={onKeyDown}>
+                    <TruncatedText
+                        text={network.range}
+                        className={
+                            "block max-w-[300px] truncate font-mono text-xs text-nb-gray-400"
+                        }
+                    />
+                </CopyToClipboard>
+            </div>
+        );
+    }
+
+    return null;
+};
+
+type DomainSubtitleProps = {
+    domain: string;
+    ips: string[];
+    onKeyDown: (e: KeyboardEvent<Element>) => void;
+};
+
+const DomainSubtitle = ({ domain, ips, onKeyDown }: DomainSubtitleProps) => {
+    const span = (
+        <span className={"block max-w-[300px] truncate font-mono text-xs text-nb-gray-400"}>
+            {domain}
+        </span>
+    );
+    return (
+        <div>
+            <CopyToClipboard message={domain} onKeyDown={onKeyDown}>
+                {ips.length > 0 ? (
+                    <Tooltip
+                        content={<ResolvedIpsTooltip ips={ips} />}
+                        delayDuration={300}
+                        closeDelay={300}
+                        side={"right"}
+                        align={"start"}
+                        alignOffset={-8}
+                        interactive
+                        keepOpenOnClick
+                        contentClassName={cn(
+                            "max-h-72 max-w-[18rem] overflow-auto",
+                            "rounded-lg border border-nb-gray-900 bg-nb-gray-935",
+                            "p-2 pr-4",
+                        )}
+                    >
+                        {span}
+                    </Tooltip>
+                ) : (
+                    span
+                )}
+            </CopyToClipboard>
+        </div>
+    );
+};
+
+const ResolvedIpsTooltip = ({ ips }: { ips: string[] }) => {
+    const { t } = useTranslation();
+    return (
+        <>
+            <div className={"px-1 pb-1 text-[10px] uppercase tracking-wide text-nb-gray-300"}>
+                {t("networks.ips.heading")}
+            </div>
+            <ul className={"flex flex-col"}>
+                {ips.map((ip) => (
+                    <li key={ip}>
+                        <CopyToClipboard message={ip} className={"px-1 py-0.5"}>
+                            <span
+                                className={
+                                    "whitespace-nowrap font-mono text-[0.72rem] text-nb-gray-100"
+                                }
+                            >
+                                {ip}
+                            </span>
+                        </CopyToClipboard>
+                    </li>
+                ))}
+            </ul>
+        </>
+    );
+};
+
+type ToggleProps = {
+    checked: boolean;
+    mixed?: boolean;
+};
+
+const NetworkToggle = ({ checked, mixed }: ToggleProps) => {
+    const checkedTranslate = checked ? "translate-x-[1.125rem]" : "translate-x-0.5";
+    return (
+        <span
+            className={cn(
+                "inline-flex h-5 w-9 shrink-0 items-center rounded-full",
+                "wails-no-draggable transition-colors",
+                checked || mixed ? "bg-netbird" : "bg-nb-gray-700",
+                mixed && "opacity-60",
+            )}
+        >
+            <span
+                className={cn(
+                    "inline-block h-4 w-4 rounded-full bg-white transition-transform",
+                    mixed ? "translate-x-2.5" : checkedTranslate,
+                )}
+            />
+        </span>
+    );
+};
diff --git a/client/ui/frontend/src/modules/main/advanced/peers/PeerDetailPanel.tsx b/client/ui/frontend/src/modules/main/advanced/peers/PeerDetailPanel.tsx
new file mode 100644
index 000000000..16500589d
--- /dev/null
+++ b/client/ui/frontend/src/modules/main/advanced/peers/PeerDetailPanel.tsx
@@ -0,0 +1,575 @@
+import {
+    type ComponentType,
+    Fragment,
+    type KeyboardEvent as ReactKeyboardEvent,
+    type ReactNode,
+    useCallback,
+    useEffect,
+    useRef,
+    useState,
+} from "react";
+import { useTranslation } from "react-i18next";
+import { AnimatePresence, motion, type Transition } from "framer-motion";
+import * as Popover from "@radix-ui/react-popover";
+import * as ScrollArea from "@radix-ui/react-scroll-area";
+import {
+    ArrowDownIcon,
+    ArrowLeftIcon,
+    ArrowUpDownIcon,
+    ArrowUpIcon,
+    Check as CheckIcon,
+    ChevronDownIcon,
+    ChevronsLeftRightEllipsisIcon,
+    ClockIcon,
+    Copy as CopyIcon,
+    GaugeIcon,
+    HandshakeIcon,
+    KeyRoundIcon,
+    Layers3Icon,
+    type LucideProps,
+    MapPinIcon,
+    MonitorIcon,
+    Radio,
+    RefreshCwIcon,
+    WaypointsIcon,
+} from "lucide-react";
+import type { PeerStatus } from "@bindings/services/models.js";
+import { cn } from "@/lib/cn";
+import { CopyToClipboard } from "@/components/CopyToClipboard";
+import { Tooltip } from "@/components/Tooltip";
+import { TruncatedText } from "@/components/TruncatedText";
+import { formatBytes, formatRelative, latencyColor, shortenDns } from "@/lib/formatters";
+import { useStatus } from "@/contexts/StatusContext";
+import { usePeerDetail } from "@/contexts/PeerDetailContext";
+import { useFocusVisible } from "@/hooks/useFocusVisible";
+import { peerStatusLabelKey } from "./Peers";
+
+const DEFAULT_TRANSITION: Transition = {
+    duration: 0.32,
+    ease: [0.32, 0.72, 0, 1],
+};
+
+const DASH = "-";
+
+const dotClass = (connStatus: string): string => {
+    switch (connStatus) {
+        case "Connected":
+            return "bg-green-400";
+        case "Connecting":
+            return "bg-yellow-300 animate-pulse-slow";
+        default:
+            return "bg-nb-gray-500";
+    }
+};
+
+type Props = {
+    transition?: Transition;
+};
+
+export const PeerDetailPanel = ({ transition = DEFAULT_TRANSITION }: Props) => {
+    const { t } = useTranslation();
+    const { selected, setSelected } = usePeerDetail();
+    const { status, refresh } = useStatus();
+
+    useEffect(() => {
+        if (!selected) return;
+        const peers = status?.peers ?? [];
+        const fresh = peers.find((p) => p.pubKey === selected.pubKey);
+        if (!fresh) {
+            setSelected(null);
+            return;
+        }
+        if (fresh !== selected) setSelected(fresh);
+    }, [status, selected, setSelected]);
+
+    // Daemon updates latency/bytes/handshake without pushing a fresh status
+    // snapshot, so tick locally to keep relative timestamps live.
+    const [now, setNow] = useState(() => Date.now());
+    useEffect(() => {
+        if (!selected) return;
+        const id = setInterval(() => setNow(Date.now()), 1000);
+        return () => clearInterval(id);
+    }, [selected]);
+
+    const [refreshing, setRefreshing] = useState(false);
+    const onRefresh = useCallback(async () => {
+        if (refreshing) return;
+        setRefreshing(true);
+        const MIN_SPIN_MS = 600;
+        const minDelay = new Promise<void>((r) => setTimeout(r, MIN_SPIN_MS));
+        try {
+            await Promise.all([refresh(), minDelay]);
+        } finally {
+            setRefreshing(false);
+        }
+    }, [refresh, refreshing]);
+
+    useEffect(() => {
+        if (!selected) return;
+        const onKey = (e: KeyboardEvent) => {
+            if (e.key === "Escape") {
+                setSelected(null);
+                return;
+            }
+            if (e.key === "ArrowLeft") {
+                const target = e.target as HTMLElement | null;
+                const tag = target?.tagName;
+                if (tag === "INPUT" || tag === "TEXTAREA" || target?.isContentEditable) return;
+                setSelected(null);
+            }
+        };
+        globalThis.addEventListener("keydown", onKey);
+        return () => globalThis.removeEventListener("keydown", onKey);
+    }, [selected, setSelected]);
+
+    const dialogRef = useRef<HTMLDivElement>(null);
+    const backButtonRef = useRef<HTMLButtonElement>(null);
+
+    useEffect(() => {
+        if (!selected) return;
+        // Defer focus until the slide-in animation has started rendering.
+        // preventScroll avoids the browser scrolling the parent to chase the
+        // still-offscreen button, which lands as a stutter at the end of the slide.
+        requestAnimationFrame(() => backButtonRef.current?.focus({ preventScroll: true }));
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [selected?.pubKey]);
+
+    const getFocusable = (): HTMLElement[] => {
+        const root = dialogRef.current;
+        if (!root) return [];
+        const sel =
+            "button:not([disabled]), [href], input:not([disabled]), select:not([disabled])," +
+            ' textarea:not([disabled]), [tabindex]:not([tabindex="-1"])';
+        return Array.from(root.querySelectorAll<HTMLElement>(sel)).filter(
+            (el) => el.offsetParent !== null || el === document.activeElement,
+        );
+    };
+
+    const onDialogKeyDown = (e: ReactKeyboardEvent<HTMLDivElement>) => {
+        if (e.key !== "Tab") return;
+        const focusables = getFocusable();
+        if (focusables.length === 0) return;
+        const first = focusables[0];
+        const last = focusables[focusables.length - 1];
+        const active = document.activeElement as HTMLElement | null;
+        if (e.shiftKey) {
+            if (active === first || !active || !dialogRef.current?.contains(active)) {
+                e.preventDefault();
+                last.focus();
+            }
+        } else if (active === last) {
+            e.preventDefault();
+            first.focus();
+        }
+    };
+
+    return (
+        <AnimatePresence>
+            {selected && (
+                <motion.div
+                    ref={dialogRef}
+                    role={"dialog"}
+                    aria-modal={"true"}
+                    aria-labelledby={"nb-peer-detail-title"}
+                    onKeyDown={onDialogKeyDown}
+                    initial={{ x: "100%" }}
+                    animate={{ x: 0 }}
+                    exit={{ x: "100%" }}
+                    transition={transition}
+                    style={{ willChange: "transform" }}
+                    className={cn("absolute inset-0 z-20 flex flex-col", "bg-nb-gray-940")}
+                >
+                    <div
+                        className={cn(
+                            "flex shrink-0 items-center gap-3",
+                            "h-12 border-b border-nb-gray-910 px-3",
+                        )}
+                    >
+                        <button
+                            ref={backButtonRef}
+                            type={"button"}
+                            tabIndex={0}
+                            onClick={() => setSelected(null)}
+                            aria-label={t("common.close")}
+                            className={cn(
+                                "flex h-8 w-8 shrink-0 items-center justify-center rounded-md",
+                                "text-nb-gray-300 hover:bg-nb-gray-910 hover:text-nb-gray-100",
+                                "cursor-default outline-none transition-colors",
+                                "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                                "wails-no-draggable",
+                            )}
+                        >
+                            <ArrowLeftIcon size={16} aria-hidden={"true"} />
+                        </button>
+                        <Tooltip content={t(peerStatusLabelKey(selected.connStatus))} side={"top"}>
+                            <span
+                                aria-hidden={"true"}
+                                className={cn(
+                                    "h-2 w-2 shrink-0 rounded-full",
+                                    dotClass(selected.connStatus),
+                                )}
+                            />
+                        </Tooltip>
+                        <CopyToClipboard
+                            message={selected.fqdn || selected.ip}
+                            size={11}
+                            className={"min-w-0 flex-1"}
+                            iconClassName={"top-[2px]"}
+                        >
+                            <span
+                                id={"nb-peer-detail-title"}
+                                className={"truncate text-sm font-medium text-nb-gray-100"}
+                            >
+                                {shortenDns(selected.fqdn) || selected.ip}
+                            </span>
+                        </CopyToClipboard>
+                        <Tooltip content={t("peers.details.refresh")}>
+                            <button
+                                type={"button"}
+                                tabIndex={0}
+                                onClick={onRefresh}
+                                disabled={refreshing}
+                                aria-label={t("peers.details.refresh")}
+                                aria-busy={refreshing}
+                                className={cn(
+                                    "flex h-8 w-8 shrink-0 items-center justify-center rounded-md",
+                                    "text-nb-gray-300 hover:bg-nb-gray-910 hover:text-nb-gray-100",
+                                    "cursor-default outline-none transition-colors",
+                                    "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                                    "wails-no-draggable",
+                                    "disabled:opacity-50 disabled:hover:bg-transparent",
+                                )}
+                            >
+                                <RefreshCwIcon
+                                    size={14}
+                                    aria-hidden={"true"}
+                                    className={refreshing ? "animate-spin" : undefined}
+                                />
+                            </button>
+                        </Tooltip>
+                    </div>
+                    <ScrollArea.Root type={"auto"} className={"min-h-0 flex-1 overflow-hidden"}>
+                        <ScrollArea.Viewport className={"h-full w-full"}>
+                            <PeerDetails peer={selected} now={now} />
+                        </ScrollArea.Viewport>
+                        <ScrollArea.Scrollbar
+                            orientation={"vertical"}
+                            className={cn(
+                                "flex touch-none select-none transition-colors",
+                                "w-1.5 bg-transparent py-1",
+                            )}
+                        >
+                            <ScrollArea.Thumb
+                                className={
+                                    "relative flex-1 rounded-full bg-nb-gray-800 hover:bg-nb-gray-700"
+                                }
+                            />
+                        </ScrollArea.Scrollbar>
+                    </ScrollArea.Root>
+                </motion.div>
+            )}
+        </AnimatePresence>
+    );
+};
+
+const PeerDetails = ({ peer, now }: { peer: PeerStatus; now: number }) => {
+    const { t } = useTranslation();
+    const formatAge = (unix: number, fallback: string): string => {
+        if (!Number.isFinite(unix) || unix <= 0) return fallback;
+        const diff = Math.floor(now / 1000 - unix);
+        if (diff < 1) return t("peers.details.justNow");
+        return formatRelative(unix, now) ?? fallback;
+    };
+    const lastHandshake = formatAge(peer.lastHandshakeUnix, t("peers.details.never"));
+    const statusSince = formatAge(peer.connStatusUpdateUnix, DASH);
+    const isConnected = peer.connStatus === "Connected";
+    const connectionLabel = peer.relayed ? t("peers.details.relayed") : t("peers.details.p2p");
+
+    return (
+        <ul className={"flex flex-col divide-y divide-nb-gray-920"}>
+            <Row icon={MapPinIcon} label={t("peers.details.netbirdIp")}>
+                {peer.ip ? (
+                    <CopyToClipboard
+                        message={peer.ip}
+                        alwaysShowIcon
+                        className={"max-w-full"}
+                        iconClassName={"top-0"}
+                    >
+                        <span className={"font-mono"}>{peer.ip}</span>
+                    </CopyToClipboard>
+                ) : (
+                    DASH
+                )}
+            </Row>
+            {peer.ipv6 && (
+                <Row icon={MapPinIcon} label={t("peers.details.netbirdIpv6")}>
+                    <CopyToClipboard
+                        message={peer.ipv6}
+                        alwaysShowIcon
+                        className={"min-w-0 max-w-full"}
+                        iconClassName={"top-0"}
+                    >
+                        <TruncatedRowValue value={peer.ipv6} mono />
+                    </CopyToClipboard>
+                </Row>
+            )}
+            {isConnected && (
+                <Row icon={ChevronsLeftRightEllipsisIcon} label={t("peers.details.connection")}>
+                    <span className={"whitespace-nowrap"}>{connectionLabel}</span>
+                </Row>
+            )}
+            {peer.relayed && (
+                <Row icon={WaypointsIcon} label={t("peers.details.relayAddress")}>
+                    {peer.relayAddress ? (
+                        <CopyToClipboard
+                            message={peer.relayAddress}
+                            alwaysShowIcon
+                            className={"min-w-0 max-w-full"}
+                            iconClassName={"top-0"}
+                        >
+                            <TruncatedRowValue value={peer.relayAddress} mono />
+                        </CopyToClipboard>
+                    ) : (
+                        DASH
+                    )}
+                </Row>
+            )}
+            {peer.latencyMs > 0 && (
+                <Row icon={GaugeIcon} label={t("peers.details.latency")}>
+                    <span className={cn("tabular-nums", latencyColor(peer.latencyMs))}>
+                        {peer.latencyMs} ms
+                    </span>
+                </Row>
+            )}
+            {(peer.bytesRx > 0 || peer.bytesTx > 0) && (
+                <Row icon={ArrowUpDownIcon} label={t("peers.details.bytes")}>
+                    <div
+                        className={
+                            "flex items-center justify-end gap-3 font-medium text-nb-gray-300"
+                        }
+                    >
+                        <div className={"flex items-center gap-1.5 whitespace-nowrap"}>
+                            <ArrowDownIcon
+                                size={13}
+                                aria-hidden={"true"}
+                                className={"text-sky-400"}
+                            />
+                            <span className={"sr-only"}>{t("peers.details.bytesReceived")}:</span>
+                            <span className={"tabular-nums"}>{formatBytes(peer.bytesRx)}</span>
+                        </div>
+                        <div className={"flex items-center gap-1.5 whitespace-nowrap"}>
+                            <ArrowUpIcon
+                                size={13}
+                                aria-hidden={"true"}
+                                className={"text-netbird"}
+                            />
+                            <span className={"sr-only"}>{t("peers.details.bytesSent")}:</span>
+                            <span className={"tabular-nums"}>{formatBytes(peer.bytesTx)}</span>
+                        </div>
+                    </div>
+                </Row>
+            )}
+            <Row icon={HandshakeIcon} label={t("peers.details.lastHandshake")}>
+                {lastHandshake}
+            </Row>
+            <Row icon={ClockIcon} label={t("peers.details.statusSince")}>
+                {statusSince}
+            </Row>
+            {peer.networks.length > 0 && (
+                <Row icon={Layers3Icon} label={t("peers.details.networks")}>
+                    <ResourcesValue networks={peer.networks} />
+                </Row>
+            )}
+            <IceRow
+                icon={MonitorIcon}
+                baseLabel={t("peers.details.localIce")}
+                type={peer.localIceCandidateType}
+                endpoint={peer.localIceCandidateEndpoint}
+            />
+            <IceRow
+                icon={Radio}
+                baseLabel={t("peers.details.remoteIce")}
+                type={peer.remoteIceCandidateType}
+                endpoint={peer.remoteIceCandidateEndpoint}
+            />
+            <Row icon={KeyRoundIcon} label={t("peers.details.publicKey")}>
+                {peer.pubKey ? (
+                    <CopyToClipboard
+                        message={peer.pubKey}
+                        alwaysShowIcon
+                        className={"min-w-0 max-w-full"}
+                        iconClassName={"top-0"}
+                    >
+                        <TruncatedRowValue value={peer.pubKey} mono />
+                    </CopyToClipboard>
+                ) : (
+                    DASH
+                )}
+            </Row>
+        </ul>
+    );
+};
+
+type RowProps = {
+    icon: ComponentType<LucideProps>;
+    iconClassName?: string;
+    label: string;
+    children: ReactNode;
+};
+
+type IceRowProps = {
+    icon: ComponentType<LucideProps>;
+    baseLabel: string;
+    type: string;
+    endpoint: string;
+};
+
+const capitalize = (s: string): string => (s ? s[0].toUpperCase() + s.slice(1) : s);
+
+const IceRow = ({ icon, baseLabel, type, endpoint }: IceRowProps) => {
+    if (!type && !endpoint) return null;
+    const label = type ? `${baseLabel} (${capitalize(type)})` : baseLabel;
+    return (
+        <Row icon={icon} label={label}>
+            {endpoint ? (
+                <CopyToClipboard
+                    message={endpoint}
+                    alwaysShowIcon
+                    className={"min-w-0 max-w-full"}
+                    iconClassName={"top-0"}
+                >
+                    <TruncatedRowValue value={endpoint} mono />
+                </CopyToClipboard>
+            ) : (
+                <span className={"truncate"}>{capitalize(type)}</span>
+            )}
+        </Row>
+    );
+};
+
+const ResourcesValue = ({ networks }: { networks: string[] }) => (
+    <ResourcesPopover networks={networks} />
+);
+
+const ResourcesPopover = ({ networks }: { networks: string[] }) => {
+    const [open, setOpen] = useState(false);
+
+    return (
+        <Popover.Root open={open} onOpenChange={setOpen}>
+            <Popover.Trigger asChild>
+                <button
+                    type={"button"}
+                    tabIndex={0}
+                    aria-haspopup={"dialog"}
+                    aria-expanded={open}
+                    className={cn(
+                        "inline-flex shrink-0 items-center gap-1 rounded",
+                        "bg-nb-gray-930 hover:bg-nb-gray-910/80 data-[state=open]:bg-nb-gray-910",
+                        "border border-nb-gray-900",
+                        "py-1 pl-2.5 pr-2 text-xs font-medium text-nb-gray-300",
+                        "wails-no-draggable cursor-default outline-none transition-all",
+                        "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                    )}
+                >
+                    {networks.length}
+                    <ChevronDownIcon
+                        size={12}
+                        aria-hidden={"true"}
+                        className={cn("transition-transform duration-150", open && "rotate-180")}
+                    />
+                </button>
+            </Popover.Trigger>
+            <Popover.Portal>
+                <Popover.Content
+                    side={"bottom"}
+                    align={"end"}
+                    sideOffset={6}
+                    onOpenAutoFocus={(e) => e.preventDefault()}
+                    className={cn(
+                        "z-50 max-h-72 min-w-64 max-w-[280px] overflow-auto",
+                        "rounded-lg border border-nb-gray-900 bg-nb-gray-935",
+                        "p-1 text-nb-gray-200 shadow-lg outline-none",
+                        "flex flex-col",
+                    )}
+                >
+                    {networks.map((n, i) => (
+                        <Fragment key={n}>
+                            {i > 0 && <div className={"-mx-1 my-1 h-px bg-nb-gray-910"} />}
+                            <ResourceRow value={n} />
+                        </Fragment>
+                    ))}
+                </Popover.Content>
+            </Popover.Portal>
+        </Popover.Root>
+    );
+};
+
+const ResourceRow = ({ value }: { value: string }) => {
+    const { t } = useTranslation();
+    const [copied, setCopied] = useState(false);
+    const isFocusVisible = useFocusVisible();
+    const handleClick = async () => {
+        if (!value) return;
+        try {
+            await navigator.clipboard.writeText(value);
+            setCopied(true);
+            setTimeout(() => setCopied(false), 500);
+        } catch (e) {
+            console.warn("copy resource to clipboard failed", e);
+        }
+    };
+    return (
+        <button
+            type={"button"}
+            onClick={handleClick}
+            tabIndex={0}
+            aria-label={`${t("common.copy")} ${value}`}
+            className={cn(
+                "group/resourcerow relative flex items-center justify-between gap-3",
+                "rounded-md px-2 py-1.5 text-left",
+                "text-nb-gray-200 hover:bg-nb-gray-900 hover:text-nb-gray-50",
+                "cursor-default outline-none transition-colors",
+                isFocusVisible &&
+                    "focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-white/60",
+            )}
+        >
+            <span className={"min-w-0 truncate font-mono text-[0.75rem]"}>{value}</span>
+            <span
+                aria-hidden={"true"}
+                className={"inline-flex shrink-0 items-center text-nb-gray-200"}
+            >
+                {copied ? <CheckIcon size={11} /> : <CopyIcon size={11} />}
+            </span>
+        </button>
+    );
+};
+
+const TruncatedRowValue = ({ value, mono }: { value: string; mono?: boolean }) => (
+    <TruncatedText
+        text={value}
+        className={cn(
+            "inline-block min-w-0 max-w-[260px] truncate align-middle",
+            mono && "font-mono",
+        )}
+    />
+);
+
+const Row = ({ icon: Icon, iconClassName, label, children }: RowProps) => (
+    <li className={"flex min-w-0 items-center gap-2 px-5 py-4 text-xs text-nb-gray-100"}>
+        <Icon
+            size={14}
+            aria-hidden={"true"}
+            className={cn("shrink-0 text-nb-gray-100", iconClassName)}
+        />
+        <span className={"shrink-0 font-semibold text-nb-gray-200"}>{label}</span>
+        <span
+            className={cn(
+                "min-w-0 flex-1 pl-8 text-right",
+                "font-medium text-nb-gray-350",
+                "flex items-center justify-end",
+            )}
+        >
+            {children}
+        </span>
+    </li>
+);
diff --git a/client/ui/frontend/src/modules/main/advanced/peers/PeerFilters.tsx b/client/ui/frontend/src/modules/main/advanced/peers/PeerFilters.tsx
new file mode 100644
index 000000000..25d9ef822
--- /dev/null
+++ b/client/ui/frontend/src/modules/main/advanced/peers/PeerFilters.tsx
@@ -0,0 +1,84 @@
+import { useState } from "react";
+import { CheckIcon, ChevronDown, ListFilter } from "lucide-react";
+import { useTranslation } from "react-i18next";
+import { cn } from "@/lib/cn";
+import {
+    DropdownMenu,
+    DropdownMenuContent,
+    DropdownMenuItem,
+    DropdownMenuTrigger,
+} from "@/components/DropdownMenu";
+
+export type StatusFilter = "all" | "online" | "offline";
+
+type Props = {
+    value: StatusFilter;
+    onChange: (value: StatusFilter) => void;
+    counts: Record<StatusFilter, number>;
+    disabled?: boolean;
+};
+
+export const PeerFilters = ({ value, onChange, counts, disabled }: Props) => {
+    const { t } = useTranslation();
+    const [open, setOpen] = useState(false);
+    const filters: { value: StatusFilter; label: string }[] = [
+        { value: "all", label: t("peers.filter.all") },
+        { value: "online", label: t("peers.filter.online") },
+        { value: "offline", label: t("peers.filter.offline") },
+    ];
+    const active = filters.find((f) => f.value === value) ?? filters[0];
+
+    const handleSelect = (v: StatusFilter) => {
+        onChange(v);
+        setOpen(false);
+    };
+
+    return (
+        <DropdownMenu open={open} onOpenChange={setOpen}>
+            <DropdownMenuTrigger
+                disabled={disabled}
+                tabIndex={0}
+                aria-label={t("common.filter")}
+                className={cn(
+                    "inline-flex h-9 items-center gap-1.5 rounded-md px-2",
+                    "text-sm text-nb-gray-200",
+                    "outline-none transition-colors duration-150 hover:bg-nb-gray-900 data-[state=open]:bg-nb-gray-900",
+                    "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                    "disabled:pointer-events-none disabled:opacity-50",
+                    "wails-no-draggable cursor-default",
+                )}
+            >
+                <ListFilter size={14} aria-hidden={"true"} className={"shrink-0"} />
+                <span>
+                    {active.label} <span className={"tabular-nums"}>({counts[active.value]})</span>
+                </span>
+                <ChevronDown size={14} aria-hidden={"true"} className={"ml-0.5 shrink-0"} />
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align={"end"} className={"min-w-[10rem]"}>
+                {filters.map((f) => {
+                    const checked = f.value === value;
+                    return (
+                        <DropdownMenuItem
+                            key={f.value}
+                            onClick={() => handleSelect(f.value)}
+                            role={"menuitemradio"}
+                            aria-checked={checked}
+                            className={"gap-2"}
+                        >
+                            <span className={"flex-1 truncate"}>
+                                {f.label}{" "}
+                                <span className={"tabular-nums"}>({counts[f.value]})</span>
+                            </span>
+                            <span
+                                aria-hidden={"true"}
+                                className={"flex w-4 shrink-0 items-center justify-center"}
+                            >
+                                {checked && <CheckIcon size={14} className={"text-netbird"} />}
+                            </span>
+                        </DropdownMenuItem>
+                    );
+                })}
+            </DropdownMenuContent>
+        </DropdownMenu>
+    );
+};
diff --git a/client/ui/frontend/src/modules/main/advanced/peers/Peers.tsx b/client/ui/frontend/src/modules/main/advanced/peers/Peers.tsx
new file mode 100644
index 000000000..d61221758
--- /dev/null
+++ b/client/ui/frontend/src/modules/main/advanced/peers/Peers.tsx
@@ -0,0 +1,353 @@
+import { type KeyboardEvent, useEffect, useMemo, useRef, useState, type ReactNode } from "react";
+import { useTranslation } from "react-i18next";
+import * as ScrollArea from "@radix-ui/react-scroll-area";
+import { Virtuoso, type VirtuosoHandle } from "react-virtuoso";
+import { ChevronRightIcon, MonitorSmartphoneIcon } from "lucide-react";
+import type { PeerStatus } from "@bindings/services/models.js";
+import { cn } from "@/lib/cn";
+import { reconcileOrder } from "@/lib/sorting";
+import { CopyToClipboard } from "@/components/CopyToClipboard";
+import { SearchInput } from "@/components/inputs/SearchInput";
+import { EmptyState } from "@/components/empty-state/EmptyState";
+import { NoResults } from "@/components/empty-state/NoResults";
+import { latencyColor, shortenDns } from "@/lib/formatters";
+import { useStatus } from "@/contexts/StatusContext";
+import { usePeerDetail } from "@/contexts/PeerDetailContext";
+import { Tooltip } from "@/components/Tooltip";
+import { TruncatedText } from "@/components/TruncatedText";
+import { PeerFilters, type StatusFilter } from "./PeerFilters";
+
+const isOnline = (connStatus: string) => connStatus === "Connected";
+
+const dotClass = (connStatus: string): string => {
+    switch (connStatus) {
+        case "Connected":
+            return "bg-green-400";
+        case "Connecting":
+            return "bg-yellow-300 animate-pulse-slow";
+        default:
+            return "bg-nb-gray-500";
+    }
+};
+
+export const peerStatusLabelKey = (connStatus: string): string => {
+    switch (connStatus) {
+        case "Connected":
+            return "peers.status.connected";
+        case "Connecting":
+            return "peers.status.connecting";
+        default:
+            return "peers.status.disconnected";
+    }
+};
+
+export const Peers = () => {
+    const { t } = useTranslation();
+    const { status } = useStatus();
+    const [search, setSearch] = useState("");
+    const [statusFilter, setStatusFilter] = useState<StatusFilter>("all");
+    const [scrollParent, setScrollParent] = useState<HTMLDivElement | null>(null);
+    const searchRef = useRef<HTMLInputElement>(null);
+
+    useEffect(() => {
+        searchRef.current?.focus();
+    }, []);
+
+    const isConnected = status?.status === "Connected";
+    const peers = useMemo(() => status?.peers ?? [], [status?.peers]);
+
+    const counts = useMemo<Record<StatusFilter, number>>(() => {
+        const online = peers.filter((p) => isOnline(p.connStatus)).length;
+        return {
+            all: peers.length,
+            online,
+            offline: peers.length - online,
+        };
+    }, [peers]);
+
+    // Stay in live-sort until every peer is stable. Right after Up the daemon
+    // emits all peers as "Connecting"; committing then would lock that
+    // alphabetical-only order forever.
+    const orderRef = useRef<string[]>([]);
+    const stickyRef = useRef(false);
+    const ordered = useMemo(() => {
+        const compare = (a: PeerStatus, b: PeerStatus) => {
+            const aOnline = isOnline(a.connStatus);
+            const bOnline = isOnline(b.connStatus);
+            if (aOnline !== bOnline) return aOnline ? -1 : 1;
+            const aName = (a.fqdn || a.ip).toLowerCase();
+            const bName = (b.fqdn || b.ip).toLowerCase();
+            return aName.localeCompare(bName);
+        };
+
+        if (peers.length === 0) {
+            orderRef.current = [];
+            stickyRef.current = false;
+            return [];
+        }
+
+        if (!stickyRef.current) {
+            const sorted = [...peers].sort(compare);
+            if (peers.every((p) => p.connStatus !== "Connecting")) {
+                orderRef.current = sorted.map((p) => p.pubKey);
+                stickyRef.current = true;
+            }
+            return sorted;
+        }
+
+        const { order, items } = reconcileOrder(orderRef.current, peers, (p) => p.pubKey, compare);
+        orderRef.current = order;
+        return items;
+    }, [peers]);
+
+    const filtered = useMemo(() => {
+        const q = search.trim().toLowerCase();
+        return ordered.filter((p) => {
+            if (statusFilter === "online" && !isOnline(p.connStatus)) return false;
+            if (statusFilter === "offline" && isOnline(p.connStatus)) return false;
+            return !q || p.fqdn.toLowerCase().includes(q) || p.ip.includes(q);
+        });
+    }, [ordered, search, statusFilter]);
+
+    if (isConnected && peers.length === 0) {
+        return (
+            <EmptyState
+                icon={MonitorSmartphoneIcon}
+                title={t("peers.empty.title")}
+                description={t("peers.empty.description")}
+            />
+        );
+    }
+
+    return (
+        <div className={"flex h-full min-h-0 w-full flex-col"}>
+            <div className={"flex items-center gap-2 border-b border-nb-gray-910 px-6 py-2.5"}>
+                <div className={"min-w-0 flex-1"}>
+                    <SearchInput
+                        ref={searchRef}
+                        placeholder={t("peers.search.placeholder")}
+                        value={search}
+                        onChange={(e) => setSearch(e.target.value)}
+                    />
+                </div>
+                <PeerFilters value={statusFilter} onChange={setStatusFilter} counts={counts} />
+            </div>
+            {filtered.length === 0 ? (
+                <NoResults />
+            ) : (
+                <ScrollArea.Root type={"auto"} className={"min-h-0 flex-1 overflow-hidden"}>
+                    <ScrollArea.Viewport ref={setScrollParent} className={"h-full w-full"}>
+                        {scrollParent && <PeersList data={filtered} scrollParent={scrollParent} />}
+                    </ScrollArea.Viewport>
+                    <ScrollArea.Scrollbar
+                        orientation={"vertical"}
+                        className={cn(
+                            "flex touch-none select-none transition-colors",
+                            "w-1.5 bg-transparent py-1",
+                        )}
+                    >
+                        <ScrollArea.Thumb
+                            className={
+                                "relative flex-1 rounded-full bg-nb-gray-800 hover:bg-nb-gray-700"
+                            }
+                        />
+                    </ScrollArea.Scrollbar>
+                </ScrollArea.Root>
+            )}
+        </div>
+    );
+};
+
+const ListTopSpacer = () => <div className={"h-2"} />;
+
+type PeersListProps = {
+    data: PeerStatus[];
+    scrollParent: HTMLElement;
+};
+
+const PeersList = ({ data, scrollParent }: PeersListProps) => {
+    const { setSelected } = usePeerDetail();
+    const virtuosoRef = useRef<VirtuosoHandle>(null);
+    const rowRefs = useRef<Map<string, HTMLButtonElement>>(new Map());
+
+    const focusRow = (index: number) => {
+        if (index < 0 || index >= data.length) return;
+        const peer = data[index];
+        const tryFocus = () => {
+            const el = rowRefs.current.get(peer.pubKey);
+            if (el) {
+                el.focus();
+                return true;
+            }
+            return false;
+        };
+        if (!tryFocus()) {
+            virtuosoRef.current?.scrollToIndex({ index, behavior: "auto" });
+            // Row may not be mounted yet — retry after Virtuoso renders it.
+            requestAnimationFrame(() => {
+                if (!tryFocus()) requestAnimationFrame(tryFocus);
+            });
+        }
+    };
+
+    const handleRowKeyDown = (e: KeyboardEvent<Element>, index: number) => {
+        switch (e.key) {
+            case "ArrowDown":
+                e.preventDefault();
+                focusRow(Math.min(index + 1, data.length - 1));
+                break;
+            case "ArrowUp":
+                e.preventDefault();
+                focusRow(Math.max(index - 1, 0));
+                break;
+            case "ArrowRight":
+                e.preventDefault();
+                setSelected(data[index]);
+                break;
+            case "Home":
+                e.preventDefault();
+                focusRow(0);
+                break;
+            case "End":
+                e.preventDefault();
+                focusRow(data.length - 1);
+                break;
+        }
+    };
+
+    const setRowRef = (pubKey: string, el: HTMLButtonElement | null) => {
+        if (el) rowRefs.current.set(pubKey, el);
+        else rowRefs.current.delete(pubKey);
+    };
+
+    const ctx = useMemo<PeerRowContext>(
+        () => ({ onKeyDown: handleRowKeyDown, onSelect: setSelected, setRowRef }),
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+        [data, setSelected],
+    );
+
+    return (
+        <Virtuoso<PeerStatus, PeerRowContext>
+            ref={virtuosoRef}
+            data={data}
+            customScrollParent={scrollParent}
+            increaseViewportBy={400}
+            computeItemKey={(_, peer) => peer.pubKey}
+            components={{ Header: ListTopSpacer }}
+            context={ctx}
+            itemContent={renderPeerRow}
+        />
+    );
+};
+
+type PeerRowContext = {
+    onKeyDown: (e: KeyboardEvent<Element>, index: number) => void;
+    onSelect: (peer: PeerStatus) => void;
+    setRowRef: (pubKey: string, el: HTMLButtonElement | null) => void;
+};
+
+const renderPeerRow = (index: number, peer: PeerStatus, ctx: PeerRowContext): ReactNode => (
+    <PeerRow
+        peer={peer}
+        index={index}
+        onKeyDown={ctx.onKeyDown}
+        onSelect={ctx.onSelect}
+        setRowRef={ctx.setRowRef}
+    />
+);
+
+type PeerRowProps = {
+    peer: PeerStatus;
+    index: number;
+    onKeyDown: (e: KeyboardEvent<Element>, index: number) => void;
+    onSelect: (peer: PeerStatus) => void;
+    setRowRef: (pubKey: string, el: HTMLButtonElement | null) => void;
+};
+
+const PeerRow = ({ peer, index, onKeyDown, onSelect, setRowRef }: PeerRowProps) => {
+    const { t } = useTranslation();
+    const isConnected = peer.connStatus === "Connected";
+    const peerName = shortenDns(peer.fqdn) || peer.ip;
+    const statusLabel = t(peerStatusLabelKey(peer.connStatus));
+    const handleKey = (e: KeyboardEvent<Element>) => onKeyDown(e, index);
+    return (
+        <div
+            className={cn(
+                "group relative flex min-w-0 items-start gap-2.5 py-3 pl-6 pr-4",
+                "transition-colors hover:bg-nb-gray-900/40",
+                "wails-no-draggable",
+            )}
+        >
+            <button
+                type={"button"}
+                tabIndex={0}
+                ref={(el) => setRowRef(peer.pubKey, el)}
+                aria-label={t("peers.row.label", { name: peerName, status: statusLabel })}
+                onClick={() => onSelect(peer)}
+                onKeyDown={handleKey}
+                className={cn(
+                    "absolute inset-0 cursor-default outline-none",
+                    "focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-white/60",
+                )}
+            />
+            <Tooltip content={statusLabel} side={"left"}>
+                <span
+                    aria-hidden={"true"}
+                    className={cn(
+                        "relative mt-2 h-2 w-2 shrink-0 rounded-full",
+                        dotClass(peer.connStatus),
+                    )}
+                />
+            </Tooltip>
+            <div
+                className={
+                    "pointer-events-none relative flex min-w-0 flex-1 flex-col leading-tight"
+                }
+            >
+                <div>
+                    <CopyToClipboard
+                        message={peer.fqdn}
+                        className={"pointer-events-auto"}
+                        onKeyDown={handleKey}
+                    >
+                        <TruncatedText
+                            text={shortenDns(peer.fqdn)}
+                            className={
+                                "block max-w-[300px] truncate text-[0.81rem] font-medium text-nb-gray-100"
+                            }
+                        />
+                    </CopyToClipboard>
+                </div>
+                <div>
+                    <CopyToClipboard
+                        message={peer.ip}
+                        className={"pointer-events-auto"}
+                        onKeyDown={handleKey}
+                    >
+                        <span className={"truncate font-mono text-xs text-nb-gray-400"}>
+                            {peer.ip}
+                        </span>
+                    </CopyToClipboard>
+                </div>
+            </div>
+            {isConnected && peer.latencyMs > 0 && (
+                <span
+                    className={cn(
+                        "pointer-events-none relative shrink-0 self-center text-xs tabular-nums",
+                        latencyColor(peer.latencyMs),
+                    )}
+                >
+                    {peer.latencyMs} ms
+                </span>
+            )}
+            <ChevronRightIcon
+                size={16}
+                aria-hidden={"true"}
+                className={cn(
+                    "pointer-events-none relative shrink-0 self-center text-nb-gray-300",
+                    "opacity-0 transition-opacity group-hover:opacity-100",
+                )}
+            />
+        </div>
+    );
+};
diff --git a/client/ui/frontend/src/modules/profiles/ProfileAvatar.tsx b/client/ui/frontend/src/modules/profiles/ProfileAvatar.tsx
new file mode 100644
index 000000000..70d45acc5
--- /dev/null
+++ b/client/ui/frontend/src/modules/profiles/ProfileAvatar.tsx
@@ -0,0 +1,76 @@
+import { type ButtonHTMLAttributes, forwardRef } from "react";
+import {
+    Briefcase,
+    Building,
+    Cloud,
+    Construction,
+    FlaskConical,
+    Gamepad2,
+    GraduationCap,
+    House,
+    Radio,
+    Server,
+    SquareCode,
+    Terminal,
+    UserCircle,
+    UserPlus,
+    Users,
+    type LucideIcon,
+} from "lucide-react";
+import { cn } from "@/lib/cn";
+
+// Scanned in order — put more-specific tokens first (e.g. "staging" before "stage").
+const ICON_MAP: ReadonlyArray<[RegExp, LucideIcon]> = [
+    [/(default|personal)/i, UserCircle],
+    [/(work|business|office|company|corp|corporate)/i, Briefcase],
+    [/(home|house|private)/i, House],
+    [/(dev|development|developer|code|coding|engineering)/i, SquareCode],
+    [/(local|localhost|loopback)/i, Terminal],
+    [/(stage|staging|preprod|pre-prod)/i, Construction],
+    [/(test|testing|qa)/i, FlaskConical],
+    [/(prod|production)/i, Cloud],
+    [/(live)/i, Radio],
+    [/(selfhosted|self-hosted|on-prem|onprem)/i, Server],
+    [/(school|university|edu|study|student)/i, GraduationCap],
+    [/(client|customer)/i, Building],
+    [/(family)/i, Users],
+    [/(gaming|game)/i, Gamepad2],
+    [/(guest)/i, UserPlus],
+];
+
+export const pickProfileIcon = (name: string | undefined): LucideIcon | null => {
+    if (!name) return null;
+    for (const [pattern, Icon] of ICON_MAP) {
+        if (pattern.test(name)) return Icon;
+    }
+    return null;
+};
+
+type Props = ButtonHTMLAttributes<HTMLButtonElement> & {
+    name?: string;
+    size?: number;
+};
+
+export const ProfileAvatar = forwardRef<HTMLButtonElement, Props>(function ProfileAvatar(
+    { name = "", size = 28, className, type = "button", ...props },
+    ref,
+) {
+    const Icon = pickProfileIcon(name) ?? UserCircle;
+    return (
+        <button
+            ref={ref}
+            type={type}
+            className={cn(
+                "inline-grid place-items-center rounded-full bg-nb-gray-900 p-0 text-center",
+                "cursor-default outline-none",
+                "transition-colors duration-150 hover:bg-nb-gray-850",
+                "data-[state=open]:bg-nb-gray-850",
+                className,
+            )}
+            style={{ width: size, height: size }}
+            {...props}
+        >
+            <Icon size={Math.round(size * 0.4)} className={"text-nb-gray-200"} />
+        </button>
+    );
+});
diff --git a/client/ui/frontend/src/modules/profiles/ProfileCreationModal.tsx b/client/ui/frontend/src/modules/profiles/ProfileCreationModal.tsx
new file mode 100644
index 000000000..19313ccb3
--- /dev/null
+++ b/client/ui/frontend/src/modules/profiles/ProfileCreationModal.tsx
@@ -0,0 +1,263 @@
+import { type FormEvent, useEffect, useId, useRef, useState } from "react";
+import { useTranslation } from "react-i18next";
+import * as Dialog from "@/components/dialog/Dialog";
+import { Input } from "@/components/inputs/Input";
+import { Button } from "@/components/buttons/Button";
+import { DialogActions } from "@/components/dialog/DialogActions";
+import { Label } from "@/components/typography/Label";
+import { HelpText } from "@/components/typography/HelpText";
+import { ManagementServerSwitch } from "@/components/ManagementServerSwitch";
+import {
+    CLOUD_MANAGEMENT_URL,
+    ManagementMode,
+    checkManagementUrlReachable,
+    isValidManagementUrl,
+    normalizeManagementUrl,
+} from "@/hooks/useManagementUrl";
+import { useRestrictions } from "@/contexts/RestrictionsContext.tsx";
+
+export type ProfileFormInitial = {
+    name: string;
+    managementUrl: string;
+};
+
+type Props = {
+    open: boolean;
+    onOpenChange: (open: boolean) => void;
+    onSubmit: (name: string, managementUrl: string) => void | Promise<void>;
+    initial?: ProfileFormInitial;
+};
+
+const MAX_PROFILE_NAME_LEN = 128;
+
+export const ProfileCreationModal = ({ open, onOpenChange, onSubmit, initial }: Props) => {
+    const { t } = useTranslation();
+    const { mdm } = useRestrictions();
+    const managedManagementUrl = mdm.managementURL;
+    const nameId = useId();
+    const urlId = useId();
+    const isEdit = !!initial;
+    const initialModeFromUrl = (u: string): ManagementMode =>
+        u && u !== CLOUD_MANAGEMENT_URL ? ManagementMode.SelfHosted : ManagementMode.Cloud;
+    const initialSelfHostedUrl = (u: string): string => (u && u !== CLOUD_MANAGEMENT_URL ? u : "");
+
+    const [name, setName] = useState(initial?.name ?? "");
+    const [nameError, setNameError] = useState<string | null>(null);
+    const nameRef = useRef<HTMLInputElement>(null);
+
+    const [mode, setMode] = useState<ManagementMode>(
+        initial ? initialModeFromUrl(initial.managementUrl) : ManagementMode.Cloud,
+    );
+    const [url, setUrl] = useState(initial ? initialSelfHostedUrl(initial.managementUrl) : "");
+    const [urlError, setUrlError] = useState<string | null>(null);
+    const [unreachable, setUnreachable] = useState(false);
+    const [checking, setChecking] = useState(false);
+    const urlRef = useRef<HTMLInputElement>(null);
+
+    useEffect(() => {
+        if (open) {
+            setName(initial?.name ?? "");
+            setMode(initial ? initialModeFromUrl(initial.managementUrl) : ManagementMode.Cloud);
+            setUrl(initial ? initialSelfHostedUrl(initial.managementUrl) : "");
+            setNameError(null);
+            setUrlError(null);
+            setUnreachable(false);
+            setChecking(false);
+        }
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [open, initial?.name, initial?.managementUrl]);
+
+    const initialModeRef = useRef<ManagementMode>(ManagementMode.Cloud);
+    useEffect(() => {
+        if (!open) return;
+        initialModeRef.current = mode;
+        const id = globalThis.setTimeout(() => {
+            nameRef.current?.focus();
+            nameRef.current?.select();
+        }, 0);
+        return () => globalThis.clearTimeout(id);
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [open]);
+
+    // When the user toggles to Self-hosted inside the dialog (not on initial
+    // open), move focus to the URL input so they can start typing immediately.
+    useEffect(() => {
+        if (!open) return;
+        if (mode === initialModeRef.current) return;
+        if (mode !== ManagementMode.SelfHosted) return;
+        urlRef.current?.focus();
+    }, [open, mode]);
+
+    useEffect(() => {
+        setUrlError(null);
+        setUnreachable(false);
+    }, [url, mode]);
+
+    const resolveTargetUrl = (): { url: string; needsReachCheck: boolean } | null => {
+        if (managedManagementUrl) {
+            return { url: managedManagementUrl, needsReachCheck: false };
+        }
+        if (mode === ManagementMode.Cloud) {
+            return { url: CLOUD_MANAGEMENT_URL, needsReachCheck: false };
+        }
+        const trimmed = url.trim();
+        if (!trimmed || !isValidManagementUrl(trimmed)) {
+            setUrlError(t("settings.general.management.urlError"));
+            urlRef.current?.focus();
+            return null;
+        }
+        const target = normalizeManagementUrl(trimmed);
+
+        const unchanged = target === initial?.managementUrl;
+        return { url: target, needsReachCheck: !unchanged };
+    };
+
+    const handleSubmit = async (e: FormEvent) => {
+        e.preventDefault();
+        if (checking) return;
+
+        const sanitized = name.trim();
+        if (sanitized.length === 0) {
+            setNameError(t("profile.dialog.required"));
+            nameRef.current?.focus();
+            return;
+        }
+
+        const target = resolveTargetUrl();
+        if (!target) return;
+
+        if (target.needsReachCheck) {
+            setChecking(true);
+            const reachable = await checkManagementUrlReachable(target.url);
+            setChecking(false);
+            if (!reachable && !unreachable) {
+                setUnreachable(true);
+                return;
+            }
+        }
+
+        await onSubmit(sanitized, target.url);
+        onOpenChange(false);
+    };
+
+    const handleNameChange = (value: string) => {
+        setName(value);
+        if (nameError) setNameError(null);
+    };
+
+    const trimmedUrl = url.trim();
+    const showUrlSyntaxError =
+        mode === ManagementMode.SelfHosted &&
+        trimmedUrl !== "" &&
+        !isValidManagementUrl(trimmedUrl);
+    const urlInputError = showUrlSyntaxError
+        ? t("settings.general.management.urlError")
+        : (urlError ?? undefined);
+    const urlInputWarning =
+        !urlInputError && unreachable ? t("profile.dialog.urlUnreachable") : undefined;
+
+    return (
+        <Dialog.Root open={open} onOpenChange={onOpenChange}>
+            <Dialog.Content
+                maxWidthClass={"max-w-md"}
+                showClose={false}
+                className={"py-7"}
+                srTitle={isEdit ? t("profile.edit.title") : t("profile.dialog.title")}
+                srDescription={t("profile.dialog.description")}
+                onOpenAutoFocus={(e) => {
+                    e.preventDefault();
+                    // Focus + select-all so editing an existing name is one
+                    // keystroke away from overwriting it.
+                    nameRef.current?.focus();
+                    nameRef.current?.select();
+                }}
+            >
+                <form onSubmit={handleSubmit}>
+                    <div className={"flex flex-col gap-6 px-7"}>
+                        <div className={"flex flex-col gap-2"}>
+                            <div className={"pl-1"}>
+                                <Label htmlFor={nameId} className={"mb-0.5"}>
+                                    {t("profile.dialog.nameLabel")}
+                                </Label>
+                                <HelpText margin={false}>
+                                    {t("profile.dialog.description")}
+                                </HelpText>
+                            </div>
+                            <Input
+                                id={nameId}
+                                ref={nameRef}
+                                autoFocus
+                                placeholder={t("profile.dialog.placeholder")}
+                                value={name}
+                                onChange={(e) => handleNameChange(e.target.value)}
+                                error={nameError ?? undefined}
+                                maxLength={MAX_PROFILE_NAME_LEN}
+                                spellCheck={false}
+                                autoComplete={"off"}
+                                autoCapitalize={"off"}
+                            />
+                        </div>
+
+                        {!managedManagementUrl && (
+                            <div className={"flex flex-col gap-2"}>
+                                <div className={"pl-1"}>
+                                    <Label as={"div"} className={"mb-0.5"}>
+                                        {t("settings.general.management.label")}
+                                    </Label>
+                                    <HelpText margin={false}>
+                                        {t("profile.dialog.managementHelp")}
+                                    </HelpText>
+                                </div>
+                                <div className={"flex flex-col gap-3"}>
+                                    <ManagementServerSwitch
+                                        value={mode}
+                                        onChange={setMode}
+                                        fullWidth
+                                    />
+                                    {mode === ManagementMode.SelfHosted && (
+                                        <Input
+                                            id={urlId}
+                                            ref={urlRef}
+                                            aria-label={t("settings.general.management.label")}
+                                            placeholder={t(
+                                                "settings.general.management.urlPlaceholder",
+                                            )}
+                                            value={url}
+                                            onChange={(e) => setUrl(e.target.value)}
+                                            error={urlInputError}
+                                            warning={urlInputWarning}
+                                            spellCheck={false}
+                                            autoComplete={"off"}
+                                            autoCorrect={"off"}
+                                            autoCapitalize={"off"}
+                                        />
+                                    )}
+                                </div>
+                            </div>
+                        )}
+
+                        <DialogActions className={"flex-row items-center justify-end gap-2.5 pt-2"}>
+                            <Button
+                                type={"button"}
+                                variant={"secondary"}
+                                size={"sm"}
+                                disabled={checking}
+                                onClick={() => onOpenChange(false)}
+                            >
+                                {t("common.cancel")}
+                            </Button>
+                            <Button
+                                type={"submit"}
+                                variant={"primary"}
+                                size={"sm"}
+                                loading={checking}
+                            >
+                                {isEdit ? t("profile.edit.submit") : t("profile.dialog.submit")}
+                            </Button>
+                        </DialogActions>
+                    </div>
+                </form>
+            </Dialog.Content>
+        </Dialog.Root>
+    );
+};
diff --git a/client/ui/frontend/src/modules/profiles/ProfileDropdown.tsx b/client/ui/frontend/src/modules/profiles/ProfileDropdown.tsx
new file mode 100644
index 000000000..e76e300c1
--- /dev/null
+++ b/client/ui/frontend/src/modules/profiles/ProfileDropdown.tsx
@@ -0,0 +1,293 @@
+import { forwardRef, useLayoutEffect, useRef, useState } from "react";
+import { useTranslation } from "react-i18next";
+import * as Popover from "@radix-ui/react-popover";
+import * as ScrollArea from "@radix-ui/react-scroll-area";
+import { Command } from "cmdk";
+import { Check, ChevronDown, Settings2, UserCircle } from "lucide-react";
+import { pickProfileIcon } from "@/modules/profiles/ProfileAvatar";
+import type { Profile } from "@bindings/services/models.js";
+import { Tooltip } from "@/components/Tooltip";
+import { useProfile } from "@/contexts/ProfileContext";
+import { useFocusVisible } from "@/hooks/useFocusVisible";
+import { cn } from "@/lib/cn";
+import { errorDialog, formatErrorMessage } from "@/lib/errors";
+
+type ProfileDropdownProps = {
+    onManageProfiles?: () => void;
+};
+
+const MANAGE_VALUE = "__manage_profiles__";
+
+export const ProfileDropdown = ({ onManageProfiles }: ProfileDropdownProps) => {
+    const { t } = useTranslation();
+    const { activeProfile, activeProfileId, profiles, switchProfile, loaded } = useProfile();
+    const [open, setOpen] = useState(false);
+    const [busy, setBusy] = useState(false);
+    const listRef = useRef<HTMLDivElement>(null);
+
+    const handleTriggerKeyDown = (e: React.KeyboardEvent<HTMLButtonElement>) => {
+        if (open) return;
+        if (e.key === "ArrowDown" || e.key === "ArrowUp") {
+            e.preventDefault();
+            setOpen(true);
+        }
+    };
+
+    const sortedProfiles = [...profiles].sort((a, b) => {
+        if (a.id === activeProfileId) return -1;
+        if (b.id === activeProfileId) return 1;
+        return a.name.localeCompare(b.name);
+    });
+
+    const guarded = async (title: string, fn: () => Promise<void>) => {
+        if (busy) return;
+        setBusy(true);
+        try {
+            await fn();
+        } catch (e) {
+            await errorDialog({
+                Title: title,
+                Message: formatErrorMessage(e),
+            });
+        } finally {
+            setBusy(false);
+        }
+    };
+
+    const handleSelect = (id: string) => {
+        setOpen(false);
+        if (id === activeProfileId) return;
+        void guarded(t("profile.error.switchTitle"), () => switchProfile(id));
+    };
+
+    const handleManage = () => {
+        setOpen(false);
+        onManageProfiles?.();
+    };
+
+    if (!loaded) return <ProfileTriggerSkeleton />;
+
+    const hasProfile = !!activeProfileId;
+    const activeFromList = profiles.find((p) => p.id === activeProfileId)?.name;
+    const displayName = hasProfile
+        ? (activeFromList ?? activeProfile)
+        : t("profile.selector.noProfile");
+
+    return (
+        <Popover.Root open={open} onOpenChange={setOpen}>
+            <Popover.Trigger asChild className={"wails-no-draggable"} disabled={!hasProfile}>
+                <ProfileTriggerButton
+                    name={displayName}
+                    disabled={!hasProfile}
+                    onKeyDown={handleTriggerKeyDown}
+                />
+            </Popover.Trigger>
+            <Popover.Portal>
+                <Popover.Content
+                    align={"center"}
+                    sideOffset={8}
+                    collisionPadding={12}
+                    onOpenAutoFocus={(e) => {
+                        e.preventDefault();
+                        listRef.current?.focus();
+                    }}
+                    className={cn(
+                        "wails-no-draggable z-50 min-w-64 select-none overflow-hidden rounded-lg border border-nb-gray-900 bg-nb-gray-935 p-1 text-nb-gray-200 shadow-lg",
+                        "data-[state=open]:animate-in data-[state=closed]:animate-out",
+                        "data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0",
+                        "data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95",
+                        "data-[side=bottom]:origin-top data-[side=top]:origin-bottom",
+                        "data-[side=left]:origin-right data-[side=right]:origin-left",
+                        "data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2",
+                        "data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2",
+                    )}
+                >
+                    <Command
+                        loop
+                        shouldFilter={false}
+                        onKeyDown={(e) => e.stopPropagation()}
+                        className={"outline-none focus:outline-none focus-visible:outline-none"}
+                    >
+                        <Command.List
+                            ref={listRef}
+                            aria-label={t("header.profile.switch")}
+                            className={"outline-none focus:outline-none focus-visible:outline-none"}
+                        >
+                            {sortedProfiles.length > 0 && (
+                                <>
+                                    <ScrollArea.Root
+                                        type={"auto"}
+                                        className={"-mx-1 overflow-hidden"}
+                                    >
+                                        <ScrollArea.Viewport className={"max-h-60 px-1"}>
+                                            {sortedProfiles.map((profile) => (
+                                                <ProfileRow
+                                                    key={profile.id}
+                                                    profile={profile}
+                                                    isActive={profile.id === activeProfileId}
+                                                    onSelect={handleSelect}
+                                                />
+                                            ))}
+                                        </ScrollArea.Viewport>
+                                        <ScrollArea.Scrollbar
+                                            orientation={"vertical"}
+                                            className={cn(
+                                                "flex touch-none select-none transition-colors",
+                                                "w-1.5 bg-transparent",
+                                            )}
+                                        >
+                                            <ScrollArea.Thumb
+                                                className={
+                                                    "relative flex-1 rounded-full bg-nb-gray-800 hover:bg-nb-gray-700"
+                                                }
+                                            />
+                                        </ScrollArea.Scrollbar>
+                                    </ScrollArea.Root>
+                                    <div className={"-mx-1 h-px bg-nb-gray-910"} />
+                                </>
+                            )}
+
+                            <div className={"pt-1"}>
+                                <Command.Item
+                                    value={MANAGE_VALUE}
+                                    onSelect={handleManage}
+                                    disabled={!onManageProfiles}
+                                    className={cn(
+                                        "flex items-center gap-2 px-2 py-1.5",
+                                        "cursor-default rounded-md text-sm outline-none",
+                                        "data-[selected=true]:bg-nb-gray-900",
+                                        "data-[disabled=true]:pointer-events-none data-[disabled=true]:opacity-50",
+                                    )}
+                                >
+                                    <Settings2
+                                        size={14}
+                                        aria-hidden={"true"}
+                                        className={"shrink-0"}
+                                    />
+                                    <span className={"flex-1 truncate"}>
+                                        {t("profile.dropdown.manageProfiles")}
+                                    </span>
+                                </Command.Item>
+                            </div>
+                        </Command.List>
+                    </Command>
+                </Popover.Content>
+            </Popover.Portal>
+        </Popover.Root>
+    );
+};
+
+const ProfileTriggerSkeleton = () => (
+    <div
+        role={"status"}
+        aria-busy={"true"}
+        aria-live={"polite"}
+        className={"wails-no-draggable flex h-10 select-none items-center gap-2 rounded-lg px-3"}
+    >
+        <div
+            aria-hidden={"true"}
+            className={"size-4 shrink-0 animate-pulse rounded-full bg-nb-gray-900"}
+        />
+        <div aria-hidden={"true"} className={"h-4 w-24 animate-pulse rounded bg-nb-gray-900"} />
+    </div>
+);
+
+type ProfileTriggerButtonProps = React.ButtonHTMLAttributes<HTMLButtonElement> & {
+    name: string;
+};
+
+const ProfileTriggerButton = forwardRef<HTMLButtonElement, ProfileTriggerButtonProps>(
+    function ProfileTriggerButton({ name, className, disabled, ...props }, ref) {
+        const { t } = useTranslation();
+        const isFocusVisible = useFocusVisible();
+        const Icon = pickProfileIcon(name) ?? UserCircle;
+        return (
+            <button
+                ref={ref}
+                type={"button"}
+                disabled={disabled}
+                tabIndex={disabled ? -1 : 0}
+                aria-label={t("header.profile.switch")}
+                aria-haspopup={"listbox"}
+                className={cn(
+                    "wails-no-draggable flex h-10 cursor-default select-none items-center gap-2 rounded-lg px-3 outline-none",
+                    "text-nb-gray-200 hover:bg-nb-gray-900",
+                    "data-[state=open]:bg-nb-gray-900",
+                    "disabled:opacity-50 disabled:hover:bg-transparent",
+                    isFocusVisible &&
+                        "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                    "wails-no-draggable transition-colors duration-150",
+                    className,
+                )}
+                {...props}
+            >
+                <Icon
+                    size={16}
+                    aria-hidden={"true"}
+                    className={"wails-no-draggable shrink-0 text-nb-gray-200"}
+                />
+                <span className={"wails-no-draggable max-w-[140px] truncate text-sm font-medium"}>
+                    {name}
+                </span>
+                <ChevronDown
+                    size={14}
+                    aria-hidden={"true"}
+                    className={"wails-no-draggable shrink-0 text-nb-gray-200"}
+                />
+            </button>
+        );
+    },
+);
+
+type ProfileRowProps = {
+    profile: Profile;
+    isActive: boolean;
+    onSelect: (id: string) => void;
+};
+
+const ProfileRow = ({ profile, isActive, onSelect }: ProfileRowProps) => {
+    const showEmail = !!profile.email;
+    return (
+        <Command.Item
+            value={profile.id}
+            onSelect={() => onSelect(profile.id)}
+            className={cn(
+                "flex w-auto gap-2 px-2 py-2 pr-3 last:mb-1",
+                "cursor-default rounded-md text-sm outline-none",
+                "data-[selected=true]:bg-nb-gray-900",
+                showEmail ? "items-start" : "items-center",
+            )}
+        >
+            <div className={"flex min-w-0 flex-1 flex-col leading-tight"}>
+                <span className={"truncate"}>{profile.name}</span>
+                {showEmail && <TruncatedEmail email={profile.email} />}
+            </div>
+            {isActive && (
+                <Check
+                    size={16}
+                    aria-hidden={"true"}
+                    className={cn("shrink-0 text-netbird", showEmail && "mt-0.5")}
+                />
+            )}
+        </Command.Item>
+    );
+};
+
+const TruncatedEmail = ({ email }: { email: string }) => {
+    const ref = useRef<HTMLSpanElement>(null);
+    const [overflowing, setOverflowing] = useState(false);
+
+    useLayoutEffect(() => {
+        const el = ref.current;
+        if (!el) return;
+        setOverflowing(el.scrollWidth > el.clientWidth);
+    }, [email]);
+
+    const span = (
+        <span ref={ref} className={"mt-0.5 max-w-[180px] truncate text-xs text-nb-gray-300"}>
+            {email}
+        </span>
+    );
+    if (!overflowing) return span;
+    return <Tooltip content={email}>{span}</Tooltip>;
+};
diff --git a/client/ui/frontend/src/modules/profiles/ProfilesTab.tsx b/client/ui/frontend/src/modules/profiles/ProfilesTab.tsx
new file mode 100644
index 000000000..c1ce2e449
--- /dev/null
+++ b/client/ui/frontend/src/modules/profiles/ProfilesTab.tsx
@@ -0,0 +1,679 @@
+import { type KeyboardEvent, useLayoutEffect, useMemo, useRef, useState } from "react";
+import { useTranslation } from "react-i18next";
+import {
+    CircleMinus,
+    LogIn,
+    MoreVertical,
+    PencilLine,
+    PlusCircle,
+    Trash2,
+    UserCircle,
+} from "lucide-react";
+import type { Profile } from "@bindings/services/models.js";
+import { Badge } from "@/components/Badge";
+import { Button } from "@/components/buttons/Button";
+import HelpText from "@/components/typography/HelpText";
+import {
+    ProfileCreationModal,
+    type ProfileFormInitial,
+} from "@/modules/profiles/ProfileCreationModal";
+import { pickProfileIcon } from "@/modules/profiles/ProfileAvatar";
+import { Tooltip } from "@/components/Tooltip";
+import {
+    DropdownMenu,
+    DropdownMenuContent,
+    DropdownMenuItem,
+    DropdownMenuTrigger,
+} from "@/components/DropdownMenu";
+import i18next from "@/lib/i18n";
+import { useProfile } from "@/contexts/ProfileContext";
+import { useConfirm } from "@/contexts/DialogContext";
+import { Settings as SettingsSvc } from "@bindings/services";
+import { SetConfigParams } from "@bindings/services/models.js";
+import { isNetbirdCloud } from "@/hooks/useManagementUrl.ts";
+import { SectionGroup, SettingsBottomBar } from "@/modules/settings/SettingsSection.tsx";
+import { cn } from "@/lib/cn";
+import { reconcileOrder } from "@/lib/sorting";
+import { errorDialog, formatErrorMessage } from "@/lib/errors";
+
+const DEFAULT_PROFILE_ID = "default";
+
+export function ProfilesTab() {
+    const { t } = useTranslation();
+    const {
+        profiles,
+        activeProfileId,
+        loaded,
+        username,
+        switchProfile,
+        addProfile,
+        removeProfile,
+        renameProfile,
+        logoutProfile,
+    } = useProfile();
+
+    const confirm = useConfirm();
+    const [newOpen, setNewOpen] = useState(false);
+    const [editTarget, setEditTarget] = useState<{
+        profile: Profile;
+        initial: ProfileFormInitial;
+    } | null>(null);
+    const [busy, setBusy] = useState(false);
+
+    // Order is held stable so switching only flips the badge, never reorders rows
+    // (else the clicked row jumps to the top under the cursor).
+    const orderRef = useRef<string[]>([]);
+    const ordered = useMemo(() => {
+        const { order, items } = reconcileOrder(
+            orderRef.current,
+            profiles,
+            (p) => p.id,
+            (a, b) => {
+                if (a.id === activeProfileId) return -1;
+                if (b.id === activeProfileId) return 1;
+                return a.name.localeCompare(b.name);
+            },
+        );
+        orderRef.current = order;
+        return items;
+    }, [profiles, activeProfileId]);
+
+    const guarded = async (title: string, fn: () => Promise<void>) => {
+        if (busy) return;
+        setBusy(true);
+        try {
+            await fn();
+        } catch (e) {
+            await errorDialog({
+                Title: title,
+                Message: formatErrorMessage(e),
+            });
+        } finally {
+            setBusy(false);
+        }
+    };
+
+    const handleSwitch = async (id: string, name: string) => {
+        const ok = await confirm({
+            title: t("profile.switch.title", { name }),
+            description: t("profile.switch.message", { name }),
+            confirmLabel: t("profile.switch.confirm"),
+        });
+        if (!ok) return;
+        await guarded(i18next.t("profile.error.switchTitle"), () => switchProfile(id));
+    };
+
+    const handleDeregister = async (id: string, name: string) => {
+        const ok = await confirm({
+            title: t("profile.deregister.title", { name }),
+            description: t("profile.deregister.message", { name }),
+            confirmLabel: t("profile.deregister.confirm"),
+        });
+        if (!ok) return;
+        void guarded(i18next.t("profile.error.deregisterTitle"), () => logoutProfile(id));
+    };
+
+    const handleDelete = async (id: string, name: string) => {
+        if (id === DEFAULT_PROFILE_ID) return;
+        const ok = await confirm({
+            title: t("profile.delete.title", { name }),
+            description: t("profile.delete.message", { name }),
+            confirmLabel: t("common.delete"),
+            danger: true,
+        });
+        if (!ok) return;
+        void guarded(i18next.t("profile.error.deleteTitle"), () => removeProfile(id));
+    };
+
+    const handleCreate = async (name: string, managementUrl: string) => {
+        await guarded(i18next.t("profile.error.createTitle"), async () => {
+            const id = await addProfile(name);
+            // SetConfig is keyed by the new profile's ID, so it writes the
+            // not-yet-active profile. Write before switching so any reconnect
+            // targets the right deployment.
+            if (!isNetbirdCloud(managementUrl)) {
+                await SettingsSvc.SetConfig(
+                    new SetConfigParams({ profileName: id, username, managementUrl }),
+                );
+            }
+            await switchProfile(id);
+        });
+    };
+
+    const handleEdit = async (id: string, name: string) => {
+        await guarded(i18next.t("profile.error.editTitle"), async () => {
+            const config = await SettingsSvc.GetConfig({ profileName: id, username });
+            const profile = profiles.find((p) => p.id === id);
+            if (!profile) return;
+            setEditTarget({
+                profile,
+                initial: { name, managementUrl: config.managementUrl },
+            });
+        });
+    };
+
+    const handleSave = async (name: string, managementUrl: string) => {
+        if (!editTarget) return;
+        const { profile, initial } = editTarget;
+        await guarded(i18next.t("profile.error.editTitle"), async () => {
+            if (name !== initial.name) {
+                await renameProfile(profile.id, name);
+            }
+            if (managementUrl !== initial.managementUrl) {
+                await SettingsSvc.SetConfig(
+                    new SetConfigParams({
+                        profileName: profile.id,
+                        username,
+                        managementUrl,
+                    }),
+                );
+            }
+        });
+    };
+
+    return (
+        <div>
+            <SectionGroup title={t("settings.profiles.section.profiles")}>
+                <HelpText className={"-mt-2 mb-0"}>{t("settings.profiles.intro")}</HelpText>
+
+                <div
+                    className={cn(
+                        "overflow-hidden rounded-xl border border-nb-gray-900 bg-nb-gray-930/60",
+                    )}
+                >
+                    <ProfilesTable
+                        ordered={ordered}
+                        activeProfileId={activeProfileId}
+                        onSwitch={handleSwitch}
+                        onEdit={handleEdit}
+                        onDeregister={handleDeregister}
+                        onDelete={handleDelete}
+                    />
+
+                    {loaded && ordered.length === 0 && (
+                        <div
+                            className={
+                                "flex flex-col items-center justify-center py-10 text-center"
+                            }
+                        >
+                            <UserCircle
+                                size={28}
+                                aria-hidden={"true"}
+                                className={"mb-2 text-nb-gray-500"}
+                            />
+                            <p className={"text-sm font-semibold text-nb-gray-200"}>
+                                {t("settings.profiles.emptyTitle")}
+                            </p>
+                            <p className={"mt-1 max-w-sm text-balance text-xs text-nb-gray-400"}>
+                                {t("settings.profiles.emptyDescription")}
+                            </p>
+                        </div>
+                    )}
+                </div>
+
+                <SettingsBottomBar>
+                    <Button variant={"primary"} size={"md"} onClick={() => setNewOpen(true)}>
+                        <PlusCircle size={14} aria-hidden={"true"} />
+                        {t("settings.profiles.addProfile")}
+                    </Button>
+                </SettingsBottomBar>
+            </SectionGroup>
+
+            <ProfileCreationModal
+                open={newOpen}
+                onOpenChange={setNewOpen}
+                onSubmit={handleCreate}
+            />
+
+            <ProfileCreationModal
+                open={editTarget !== null}
+                onOpenChange={(o) => {
+                    if (!o) setEditTarget(null);
+                }}
+                initial={editTarget?.initial}
+                onSubmit={handleSave}
+            />
+        </div>
+    );
+}
+
+type ProfilesTableProps = {
+    ordered: Profile[];
+    activeProfileId: string | undefined;
+    onSwitch: (id: string, name: string) => void;
+    onEdit: (id: string, name: string) => void;
+    onDeregister: (id: string, name: string) => void;
+    onDelete: (id: string, name: string) => void;
+};
+
+const ProfilesTable = ({
+    ordered,
+    activeProfileId,
+    onSwitch,
+    onEdit,
+    onDeregister,
+    onDelete,
+}: ProfilesTableProps) => {
+    const { t } = useTranslation();
+    const [focusedIndex, setFocusedIndex] = useState(0);
+    const rowRefs = useRef<Map<string, HTMLTableRowElement>>(new Map());
+
+    const focusRow = (index: number) => {
+        if (index < 0 || index >= ordered.length) return;
+        setFocusedIndex(index);
+        const el = rowRefs.current.get(ordered[index].id);
+        el?.focus();
+    };
+
+    const actionButtonsIn = (row: HTMLTableRowElement | undefined) =>
+        Array.from(
+            row?.querySelectorAll<HTMLButtonElement>(
+                "button:not([aria-hidden='true']):not([aria-disabled='true'])",
+            ) ?? [],
+        );
+
+    const handleRowKey = (e: KeyboardEvent<HTMLTableRowElement>, index: number): boolean => {
+        switch (e.key) {
+            case "ArrowDown":
+                focusRow(Math.min(index + 1, ordered.length - 1));
+                return true;
+            case "ArrowUp":
+                focusRow(Math.max(index - 1, 0));
+                return true;
+            case "Home":
+                focusRow(0);
+                return true;
+            case "End":
+                focusRow(ordered.length - 1);
+                return true;
+        }
+        return false;
+    };
+
+    const handleButtonKey = (
+        e: KeyboardEvent<HTMLTableRowElement>,
+        index: number,
+        row: HTMLTableRowElement,
+    ): boolean => {
+        const buttons = actionButtonsIn(row);
+        const current = buttons.indexOf(e.target as HTMLButtonElement);
+        if (current === -1) return false;
+
+        switch (e.key) {
+            case "ArrowDown":
+                focusRow(Math.min(index + 1, ordered.length - 1));
+                return true;
+            case "ArrowUp":
+                focusRow(Math.max(index - 1, 0));
+                return true;
+            case "Escape":
+                row.focus();
+                return true;
+            case "Tab":
+                // At the last button: jump to the next row instead of exiting the table.
+                // At the first button with Shift+Tab: jump back to the row.
+                if (!e.shiftKey && current === buttons.length - 1 && index < ordered.length - 1) {
+                    focusRow(index + 1);
+                    return true;
+                }
+                if (e.shiftKey && current === 0) {
+                    row.focus();
+                    return true;
+                }
+                return false;
+        }
+        return false;
+    };
+
+    const handleRowKeyDown = (e: KeyboardEvent<HTMLTableRowElement>, index: number) => {
+        const row = rowRefs.current.get(ordered[index].id);
+        if (!row) return;
+        const onRow = e.target === row;
+        const handled = onRow ? handleRowKey(e, index) : handleButtonKey(e, index, row);
+        if (handled) e.preventDefault();
+    };
+
+    const safeFocusedIndex = Math.min(focusedIndex, Math.max(0, ordered.length - 1));
+
+    return (
+        <table
+            aria-label={t("settings.profiles.section.profiles")}
+            className={"w-full border-separate border-spacing-0 text-sm"}
+        >
+            <tbody className={"flex flex-col"}>
+                {ordered.map((profile, index) => (
+                    <ProfileRow
+                        key={profile.id}
+                        profile={profile}
+                        isActive={profile.id === activeProfileId}
+                        isFocused={index === safeFocusedIndex}
+                        isFirst={index === 0}
+                        isLast={index === ordered.length - 1}
+                        rowRef={(el) => {
+                            if (el) rowRefs.current.set(profile.id, el);
+                            else rowRefs.current.delete(profile.id);
+                        }}
+                        onKeyDown={(e) => handleRowKeyDown(e, index)}
+                        onFocus={() => setFocusedIndex(index)}
+                        onSwitch={() => onSwitch(profile.id, profile.name)}
+                        onEdit={() => onEdit(profile.id, profile.name)}
+                        onDeregister={() => onDeregister(profile.id, profile.name)}
+                        onDelete={() => onDelete(profile.id, profile.name)}
+                    />
+                ))}
+            </tbody>
+        </table>
+    );
+};
+
+type ProfileRowProps = {
+    profile: Profile;
+    isActive: boolean;
+    isFocused: boolean;
+    isFirst: boolean;
+    isLast: boolean;
+    rowRef: (el: HTMLTableRowElement | null) => void;
+    onKeyDown: (e: KeyboardEvent<HTMLTableRowElement>) => void;
+    onFocus: () => void;
+    onSwitch: () => void;
+    onEdit: () => void;
+    onDeregister: () => void;
+    onDelete: () => void;
+};
+
+const ProfileRow = ({
+    profile,
+    isActive,
+    isFocused,
+    isFirst,
+    isLast,
+    rowRef,
+    onKeyDown,
+    onFocus,
+    onSwitch,
+    onEdit,
+    onDeregister,
+    onDelete,
+}: ProfileRowProps) => {
+    const { t } = useTranslation();
+    const Icon = pickProfileIcon(profile.name) ?? UserCircle;
+    const showEmail = !!profile.email;
+
+    return (
+        <tr
+            ref={rowRef}
+            tabIndex={isFocused ? 0 : -1}
+            onKeyDown={onKeyDown}
+            onFocus={onFocus}
+            aria-label={profile.name}
+            className={cn(
+                "flex items-center gap-4 px-4 py-2.5",
+                "border-b border-nb-gray-910 last:border-b-0",
+                "outline-none",
+                isFirst && "rounded-t-xl",
+                isLast && "rounded-b-xl",
+                "focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-white/60",
+            )}
+        >
+            <td
+                className={cn(
+                    "flex min-w-0 flex-1 gap-2 leading-tight",
+                    showEmail ? "items-start" : "items-center",
+                )}
+            >
+                <Icon
+                    size={15}
+                    aria-hidden={"true"}
+                    className={cn("shrink-0 text-nb-gray-200", showEmail ? "mt-0.5" : "")}
+                />
+                <div className={"flex min-w-0 flex-1 flex-col leading-tight"}>
+                    <div className={"flex min-w-0 items-center gap-2"}>
+                        <span
+                            className={
+                                "cursor-text select-text truncate font-medium text-nb-gray-100"
+                            }
+                        >
+                            {profile.name}
+                        </span>
+                        {isActive && <Badge>{t("settings.profiles.active")}</Badge>}
+                    </div>
+                    {showEmail && <TruncatedEmail email={profile.email} />}
+                </div>
+            </td>
+            <td className={"shrink-0 text-right"}>
+                <RowActions
+                    canSwitch={!isActive}
+                    canDeregister={!!profile.email}
+                    isDefault={profile.id === DEFAULT_PROFILE_ID}
+                    isActive={isActive}
+                    rowFocused={isFocused}
+                    onSwitch={onSwitch}
+                    onEdit={onEdit}
+                    onDeregister={onDeregister}
+                    onDelete={onDelete}
+                />
+            </td>
+        </tr>
+    );
+};
+
+const TruncatedEmail = ({ email }: { email: string }) => {
+    const ref = useRef<HTMLSpanElement>(null);
+    const [overflowing, setOverflowing] = useState(false);
+
+    useLayoutEffect(() => {
+        const el = ref.current;
+        if (!el) return;
+        setOverflowing(el.scrollWidth > el.clientWidth);
+    }, [email]);
+
+    const span = (
+        <span
+            ref={ref}
+            className={"mt-0.5 cursor-text select-text truncate text-xs text-nb-gray-300"}
+        >
+            {email}
+        </span>
+    );
+    if (!overflowing) return span;
+    return <Tooltip content={email}>{span}</Tooltip>;
+};
+
+type RowActionsProps = {
+    canSwitch: boolean;
+    canDeregister: boolean;
+    isDefault: boolean;
+    isActive: boolean;
+    rowFocused: boolean;
+    onSwitch: () => void;
+    onEdit: () => void;
+    onDeregister: () => void;
+    onDelete: () => void;
+};
+
+const RowActions = ({
+    canSwitch,
+    canDeregister,
+    isDefault,
+    isActive,
+    rowFocused,
+    onSwitch,
+    onEdit,
+    onDeregister,
+    onDelete,
+}: RowActionsProps) => {
+    const { t } = useTranslation();
+    const deleteDisabled = isDefault || isActive;
+    let deleteDisabledReason: string | null = null;
+    if (isDefault) deleteDisabledReason = t("profile.delete.disabledDefault");
+    else if (isActive) deleteDisabledReason = t("profile.delete.disabledActive");
+    return (
+        <div className={"inline-flex items-center gap-1"}>
+            <ActionIconButton
+                label={t("profile.selector.switchTo")}
+                icon={LogIn}
+                onClick={onSwitch}
+                hidden={!canSwitch}
+                tabbable={rowFocused}
+            />
+            <RowMoreMenu
+                canDeregister={canDeregister}
+                deleteDisabled={deleteDisabled}
+                deleteDisabledReason={deleteDisabledReason}
+                rowFocused={rowFocused}
+                onEdit={onEdit}
+                onDeregister={onDeregister}
+                onDelete={onDelete}
+            />
+        </div>
+    );
+};
+
+type RowMoreMenuProps = {
+    canDeregister: boolean;
+    deleteDisabled: boolean;
+    deleteDisabledReason: string | null;
+    rowFocused: boolean;
+    onEdit: () => void;
+    onDeregister: () => void;
+    onDelete: () => void;
+};
+
+const RowMoreMenu = ({
+    canDeregister,
+    deleteDisabled,
+    deleteDisabledReason,
+    rowFocused,
+    onEdit,
+    onDeregister,
+    onDelete,
+}: RowMoreMenuProps) => {
+    const { t } = useTranslation();
+    const moreLabel = t("profile.selector.moreOptions");
+    return (
+        <DropdownMenu modal={false}>
+            <DropdownMenuTrigger asChild>
+                <button
+                    type={"button"}
+                    aria-label={moreLabel}
+                    tabIndex={rowFocused ? 0 : -1}
+                    className={cn(
+                        "inline-flex h-9 w-9 cursor-default items-center justify-center rounded-md outline-none",
+                        "text-nb-gray-400 hover:bg-nb-gray-900 hover:text-nb-gray-100",
+                        "transition-colors duration-150",
+                        "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                        "data-[state=open]:bg-nb-gray-900 data-[state=open]:text-nb-gray-100",
+                    )}
+                >
+                    <MoreVertical size={16} aria-hidden={"true"} />
+                </button>
+            </DropdownMenuTrigger>
+            <DropdownMenuContent align={"end"} sideOffset={4} className={"min-w-36 select-none"}>
+                <DropdownMenuItem onClick={onEdit}>
+                    <div className={"flex w-full items-center gap-2"}>
+                        <PencilLine size={14} aria-hidden={"true"} />
+                        <span className={"flex-1"}>{t("profile.selector.edit")}</span>
+                    </div>
+                </DropdownMenuItem>
+                {canDeregister && (
+                    <DropdownMenuItem onClick={onDeregister}>
+                        <div className={"flex w-full items-center gap-2"}>
+                            <CircleMinus size={14} aria-hidden={"true"} />
+                            <span className={"flex-1"}>{t("profile.selector.deregister")}</span>
+                        </div>
+                    </DropdownMenuItem>
+                )}
+                <DeleteMenuItem
+                    disabled={deleteDisabled}
+                    disabledReason={deleteDisabledReason}
+                    onDelete={onDelete}
+                />
+            </DropdownMenuContent>
+        </DropdownMenu>
+    );
+};
+
+type DeleteMenuItemProps = {
+    disabled: boolean;
+    disabledReason: string | null;
+    onDelete: () => void;
+};
+
+const DeleteMenuItem = ({ disabled, disabledReason, onDelete }: DeleteMenuItemProps) => {
+    const { t } = useTranslation();
+    const item = (
+        <DropdownMenuItem
+            disabled={disabled}
+            onClick={disabled ? undefined : onDelete}
+            className={cn(!disabled && "text-red-500 hover:!text-red-500 focus:text-red-500")}
+        >
+            <div className={"flex w-full items-center gap-2"}>
+                <Trash2 size={14} aria-hidden={"true"} />
+                <span className={"flex-1"}>{t("profile.selector.delete")}</span>
+            </div>
+        </DropdownMenuItem>
+    );
+    if (!disabled || !disabledReason) return item;
+    return (
+        <Tooltip
+            content={<span className={"block max-w-[260px] leading-snug"}>{disabledReason}</span>}
+            side={"left"}
+        >
+            <span className={"block"}>{item}</span>
+        </Tooltip>
+    );
+};
+
+type ActionIconButtonProps = {
+    label: string;
+    icon: typeof CircleMinus;
+    onClick: () => void;
+    variant?: "default" | "danger";
+    /** Occupies space but invisible and non-interactive (preserves row layout). */
+    hidden?: boolean;
+    disabled?: boolean;
+    tabbable?: boolean;
+};
+
+const ActionIconButton = ({
+    label,
+    icon: Icon,
+    onClick,
+    variant = "default",
+    hidden = false,
+    disabled = false,
+    tabbable = true,
+}: ActionIconButtonProps) => {
+    const button = (
+        <button
+            type={"button"}
+            onClick={disabled ? undefined : onClick}
+            aria-label={label}
+            aria-hidden={hidden || undefined}
+            aria-disabled={disabled || undefined}
+            tabIndex={hidden || !tabbable ? -1 : 0}
+            className={cn(
+                "inline-flex h-9 w-9 cursor-default items-center justify-center rounded-md outline-none",
+                "transition-colors duration-150",
+                "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+                variant === "danger"
+                    ? "text-nb-gray-400 hover:bg-red-500/10 hover:text-red-500"
+                    : "text-nb-gray-400 hover:bg-nb-gray-900 hover:text-nb-gray-100",
+                hidden && "pointer-events-none opacity-0",
+                disabled &&
+                    "cursor-not-allowed opacity-40 hover:!bg-transparent hover:!text-nb-gray-400",
+            )}
+        >
+            <Icon size={16} aria-hidden={"true"} />
+        </button>
+    );
+    if (hidden) return button;
+    return (
+        <Tooltip
+            content={<span className={"block max-w-[260px] leading-snug"}>{label}</span>}
+            side={"top"}
+        >
+            {button}
+        </Tooltip>
+    );
+};
diff --git a/client/ui/frontend/src/modules/session/SessionExpirationDialog.tsx b/client/ui/frontend/src/modules/session/SessionExpirationDialog.tsx
new file mode 100644
index 000000000..2ceb958d4
--- /dev/null
+++ b/client/ui/frontend/src/modules/session/SessionExpirationDialog.tsx
@@ -0,0 +1,202 @@
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { useSearchParams } from "react-router-dom";
+import { Events } from "@wailsio/runtime";
+import { AlertCircleIcon, ClockIcon } from "lucide-react";
+import { Button } from "@/components/buttons/Button";
+import { ConfirmDialog } from "@/components/dialog/ConfirmDialog";
+import { DialogActions } from "@/components/dialog/DialogActions";
+import { DialogDescription } from "@/components/dialog/DialogDescription";
+import { DialogHeading } from "@/components/dialog/DialogHeading";
+import { SquareIcon } from "@/components/SquareIcon";
+import { Connection, Profiles as ProfilesSvc, Session, WindowManager } from "@bindings/services";
+import { useAutoSizeWindow } from "@/hooks/useAutoSizeWindow";
+import { EVENT_BROWSER_LOGIN_CANCEL } from "@/lib/connection";
+import { errorDialog, formatErrorMessage } from "@/lib/errors.ts";
+import { formatRemaining } from "@/lib/formatters";
+
+const DEFAULT_SECONDS = 360;
+const WINDOW_WIDTH = 360;
+const SOON_THRESHOLD_SECONDS = 60 * 60;
+
+export default function SessionExpirationDialog() {
+    const { t } = useTranslation();
+    const contentRef = useAutoSizeWindow<HTMLDivElement>(WINDOW_WIDTH);
+    const [params] = useSearchParams();
+    const initialSeconds = useMemo(() => {
+        const raw = params.get("seconds");
+        if (!raw) return DEFAULT_SECONDS;
+        const n = Number.parseInt(raw, 10);
+        return Number.isFinite(n) && n > 0 ? n : DEFAULT_SECONDS;
+    }, [params]);
+
+    const [remaining, setRemaining] = useState(initialSeconds);
+    const [busy, setBusy] = useState(false);
+    const busyRef = useRef(busy);
+    busyRef.current = busy;
+    const expired = remaining <= 0;
+    const expiredRef = useRef(expired);
+    expiredRef.current = expired;
+    const soon = remaining <= SOON_THRESHOLD_SECONDS;
+    const activeTitle = soon ? t("sessionExpiration.title") : t("sessionExpiration.titleLater");
+    const activeDescription = soon
+        ? t("sessionExpiration.description")
+        : t("sessionExpiration.descriptionLater");
+
+    useEffect(() => {
+        setRemaining(initialSeconds);
+    }, [initialSeconds]);
+
+    useEffect(() => {
+        const id = globalThis.setInterval(() => {
+            setRemaining((s) => (s <= 1 ? 0 : s - 1));
+        }, 1000);
+        return () => globalThis.clearInterval(id);
+    }, [initialSeconds]);
+
+    // Don't auto-close while busy (aborts our WaitExtend) or expired (hides the state).
+    useEffect(() => {
+        const off = Events.On("netbird:status", (ev: { data: { status?: string } }) => {
+            if (busyRef.current || expiredRef.current) return;
+            if (ev?.data?.status === "Connected") {
+                WindowManager.CloseSessionExpiration().catch(console.error);
+            }
+        });
+        return () => {
+            off();
+        };
+    }, []);
+
+    const stay = useCallback(async () => {
+        if (busy) return;
+        setBusy(true);
+
+        let offCancel: (() => void) | undefined;
+
+        try {
+            const start = await Session.RequestExtend({ hint: "" });
+            const uri = start.verificationUriComplete || start.verificationUri;
+
+            // The popup opens the URL and (Go-side) hides this window, restoring it on close.
+            if (uri) {
+                try {
+                    await WindowManager.OpenBrowserLogin(uri);
+                } catch (e) {
+                    console.error(e);
+                }
+            }
+
+            const cancelPromise = new Promise<void>((resolve) => {
+                offCancel = Events.On(EVENT_BROWSER_LOGIN_CANCEL, () => {
+                    resolve();
+                });
+            });
+
+            const waitPromise = Session.WaitExtend({
+                deviceCode: start.deviceCode,
+                userCode: start.userCode,
+            });
+
+            const outcome = await Promise.race([
+                waitPromise.then((r) => ({ kind: "done" as const, result: r })),
+                cancelPromise.then(() => ({ kind: "cancel" as const })),
+            ]);
+
+            if (outcome.kind === "cancel") {
+                waitPromise.cancel?.();
+                waitPromise.catch(() => {});
+                return;
+            }
+
+            // Another surface owns this flow; keep the dialog open to retry.
+            if (outcome.result.preempted) {
+                return;
+            }
+
+            // Close before the popup so the restore can't flash this window back.
+            WindowManager.CloseSessionExpiration().catch(console.error);
+        } catch (e) {
+            await errorDialog({
+                Title: t("sessionExpiration.extendFailedTitle"),
+                Message: formatErrorMessage(e),
+            });
+        } finally {
+            offCancel?.();
+            WindowManager.CloseBrowserLogin().catch(console.error);
+            setBusy(false);
+        }
+    }, [busy, t]);
+
+    const logout = useCallback(async () => {
+        if (busy) return;
+        setBusy(true);
+        try {
+            const username = await ProfilesSvc.Username();
+            const active = await ProfilesSvc.GetActive();
+            await Connection.Logout({
+                profileName: active.id || "default",
+                username,
+            });
+            WindowManager.CloseSessionExpiration().catch(console.error);
+        } catch (e) {
+            await errorDialog({
+                Title: t("sessionExpiration.logoutFailedTitle"),
+                Message: formatErrorMessage(e),
+            });
+        } finally {
+            setBusy(false);
+        }
+    }, [busy, t]);
+
+    const close = useCallback(() => {
+        WindowManager.CloseSessionExpiration().catch(console.error);
+    }, []);
+
+    return (
+        <ConfirmDialog ref={contentRef} aria-labelledby={"nb-session-expiration-title"}>
+            <SquareIcon icon={expired ? AlertCircleIcon : ClockIcon} />
+
+            <div className={"flex flex-col items-center gap-1"}>
+                <DialogHeading id={"nb-session-expiration-title"}>
+                    {expired ? t("sessionExpiration.expired") : activeTitle}
+                </DialogHeading>
+                <DialogDescription>
+                    {expired ? t("sessionExpiration.expiredDescription") : activeDescription}
+                </DialogDescription>
+            </div>
+
+            {!expired && (
+                <div
+                    className={
+                        "font-mono text-2xl font-semibold tabular-nums tracking-wider text-nb-gray-50"
+                    }
+                    aria-live={"polite"}
+                >
+                    {formatRemaining(remaining)}
+                </div>
+            )}
+
+            <DialogActions>
+                <Button
+                    autoFocus
+                    variant={"primary"}
+                    size={"md"}
+                    className={"w-full"}
+                    onClick={stay}
+                    disabled={busy}
+                >
+                    {expired ? t("sessionExpiration.authenticate") : t("sessionExpiration.stay")}
+                </Button>
+                <Button
+                    variant={"secondary"}
+                    size={"md"}
+                    className={"w-full"}
+                    onClick={expired ? close : logout}
+                    disabled={busy}
+                >
+                    {expired ? t("sessionExpiration.close") : t("sessionExpiration.logout")}
+                </Button>
+            </DialogActions>
+        </ConfirmDialog>
+    );
+}
diff --git a/client/ui/frontend/src/modules/settings/SettingsAbout.tsx b/client/ui/frontend/src/modules/settings/SettingsAbout.tsx
new file mode 100644
index 000000000..8ba1009ba
--- /dev/null
+++ b/client/ui/frontend/src/modules/settings/SettingsAbout.tsx
@@ -0,0 +1,169 @@
+import type { ComponentType, SVGProps } from "react";
+import { useTranslation } from "react-i18next";
+import { Browser } from "@wailsio/runtime";
+import { BookOpen, MessageSquareText, MessagesSquare } from "lucide-react";
+import netbirdFull from "@/assets/logos/netbird-full.svg";
+
+// Brand glyphs from simpleicons.org (lucide deprecated its brand icons).
+const GithubIcon = (props: SVGProps<SVGSVGElement>) => (
+    <svg viewBox={"0 0 24 24"} fill={"currentColor"} {...props}>
+        <path
+            d={
+                "M12 .297c-6.63 0-12 5.373-12 12 0 5.303 3.438 9.8 8.205 11.385.6.113.82-.258.82-.577 0-.285-.01-1.04-.015-2.04-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729 1.205.084 1.838 1.236 1.838 1.236 1.07 1.835 2.809 1.305 3.495.998.108-.776.417-1.305.76-1.605-2.665-.3-5.466-1.332-5.466-5.93 0-1.31.465-2.38 1.235-3.22-.135-.303-.54-1.523.105-3.176 0 0 1.005-.322 3.3 1.23.96-.267 1.98-.399 3-.405 1.02.006 2.04.138 3 .405 2.28-1.552 3.285-1.23 3.285-1.23.645 1.653.24 2.873.12 3.176.765.84 1.23 1.91 1.23 3.22 0 4.61-2.805 5.625-5.475 5.92.42.36.81 1.096.81 2.22 0 1.606-.015 2.896-.015 3.286 0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12"
+            }
+        />
+    </svg>
+);
+const SlackIcon = (props: SVGProps<SVGSVGElement>) => (
+    <svg viewBox={"0 0 24 24"} fill={"currentColor"} {...props}>
+        <path
+            d={
+                "M5.042 15.165a2.528 2.528 0 0 1-2.52 2.523A2.528 2.528 0 0 1 0 15.165a2.527 2.527 0 0 1 2.522-2.52h2.52v2.52zM6.313 15.165a2.527 2.527 0 0 1 2.521-2.52 2.527 2.527 0 0 1 2.521 2.52v6.313A2.528 2.528 0 0 1 8.834 24a2.528 2.528 0 0 1-2.521-2.522v-6.313zM8.834 5.042a2.528 2.528 0 0 1-2.521-2.52A2.528 2.528 0 0 1 8.834 0a2.528 2.528 0 0 1 2.521 2.522v2.52H8.834zM8.834 6.313a2.528 2.528 0 0 1 2.521 2.521 2.528 2.528 0 0 1-2.521 2.521H2.522A2.528 2.528 0 0 1 0 8.834a2.528 2.528 0 0 1 2.522-2.521h6.312zM18.956 8.834a2.528 2.528 0 0 1 2.522-2.521A2.528 2.528 0 0 1 24 8.834a2.528 2.528 0 0 1-2.522 2.521h-2.522V8.834zM17.688 8.834a2.528 2.528 0 0 1-2.523 2.521 2.527 2.527 0 0 1-2.52-2.521V2.522A2.527 2.527 0 0 1 15.165 0a2.528 2.528 0 0 1 2.523 2.522v6.312zM15.165 18.956a2.528 2.528 0 0 1 2.523 2.522A2.528 2.528 0 0 1 15.165 24a2.527 2.527 0 0 1-2.52-2.522v-2.522h2.52zM15.165 17.688a2.527 2.527 0 0 1-2.52-2.523 2.526 2.526 0 0 1 2.52-2.52h6.313A2.527 2.527 0 0 1 24 15.165a2.528 2.528 0 0 1-2.522 2.523h-6.313z"
+            }
+        />
+    </svg>
+);
+import { useSettings } from "@/contexts/SettingsContext.tsx";
+import { useStatus } from "@/contexts/StatusContext.tsx";
+import { UpdateVersionCard } from "@/modules/auto-update/UpdateVersionCard";
+import { useAccentTrigger } from "@/modules/settings/SettingsAccent";
+
+function openUrl(url: string) {
+    Browser.OpenURL(url).catch(() => {
+        window.open(url, "_blank");
+    });
+}
+
+export function SettingsAbout() {
+    const { t } = useTranslation();
+    const { status } = useStatus();
+    const { guiVersion } = useSettings();
+    const daemonVersion = status?.daemonVersion ?? "—";
+
+    const handleVersionClick = useAccentTrigger();
+
+    const COMMUNITY_LINKS: {
+        label: string;
+        url: string;
+        Icon: ComponentType<SVGProps<SVGSVGElement>>;
+        iconClassName?: string;
+    }[] = [
+        {
+            label: t("settings.about.community.github"),
+            url: "https://github.com/netbirdio/netbird",
+            Icon: GithubIcon,
+            iconClassName: "h-3 w-3",
+        },
+        {
+            label: t("settings.about.community.slack"),
+            url: "https://docs.netbird.io/slack-url",
+            Icon: SlackIcon,
+            iconClassName: "h-3 w-3",
+        },
+        {
+            label: t("settings.about.community.forum"),
+            url: "https://forum.netbird.io",
+            Icon: MessagesSquare,
+        },
+        {
+            label: t("settings.about.community.documentation"),
+            url: "https://docs.netbird.io",
+            Icon: BookOpen,
+        },
+        {
+            label: t("settings.about.community.feedback"),
+            url: "https://forms.gle/TeLw2zrXEdw6RcQ36",
+            Icon: MessageSquareText,
+        },
+    ];
+
+    const LEGAL_LINKS: { label: string; url: string }[] = [
+        { label: t("settings.about.links.imprint"), url: "https://netbird.io/imprint" },
+        { label: t("settings.about.links.privacy"), url: "https://netbird.io/privacy" },
+        { label: t("settings.about.links.cla"), url: "https://netbird.io/cla" },
+        { label: t("settings.about.links.terms"), url: "https://netbird.io/terms" },
+    ];
+
+    return (
+        <div
+            className={
+                "mx-auto flex min-h-[calc(100vh-12rem)] max-w-2xl flex-col items-center justify-center gap-4"
+            }
+        >
+            <img src={netbirdFull} alt={t("common.netbird")} className={"h-7 w-auto"} />
+            <div className={"flex flex-col items-center gap-0.5 text-center"}>
+                <button
+                    type={"button"}
+                    onClick={handleVersionClick}
+                    className={
+                        "cursor-text select-text bg-transparent text-sm font-semibold text-nb-gray-100 outline-none"
+                    }
+                >
+                    {daemonVersion === "development" ? (
+                        <span>
+                            {t("settings.about.clientName")}{" "}
+                            <span className={"font-mono text-yellow-400"}>
+                                {t("settings.about.development")}
+                            </span>
+                        </span>
+                    ) : (
+                        t("settings.about.client", { version: daemonVersion })
+                    )}
+                </button>
+                <p className={"cursor-text select-text text-sm font-medium text-nb-gray-250"}>
+                    {guiVersion === "development" ? (
+                        <span>
+                            {t("settings.about.guiName")}{" "}
+                            <span className={"font-mono text-yellow-400"}>
+                                {t("settings.about.development")}
+                            </span>
+                        </span>
+                    ) : (
+                        t("settings.about.gui", { version: guiVersion })
+                    )}
+                </p>
+            </div>
+
+            <UpdateVersionCard />
+
+            <p className={"mt-2 text-center text-sm text-nb-gray-300"}>
+                {t("settings.about.copyright", { year: new Date().getFullYear() })}
+            </p>
+            <div
+                className={"flex flex-wrap justify-center gap-x-4 gap-y-1 text-xs text-nb-gray-200"}
+            >
+                {COMMUNITY_LINKS.map(({ label, url, Icon, iconClassName }) => (
+                    <button
+                        key={url}
+                        type={"button"}
+                        tabIndex={0}
+                        onClick={() => openUrl(url)}
+                        className={
+                            "inline-flex items-center gap-1.5 rounded-sm decoration-[0.5px] underline-offset-4 outline-none transition hover:text-nb-gray-100 hover:underline focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940"
+                        }
+                    >
+                        <Icon aria-hidden={"true"} className={iconClassName ?? "h-3.5 w-3.5"} />
+                        <span>{label}</span>
+                    </button>
+                ))}
+            </div>
+            <div
+                className={"flex flex-wrap justify-center gap-x-4 gap-y-1 text-xs text-nb-gray-200"}
+            >
+                {LEGAL_LINKS.map((link) => (
+                    <button
+                        key={link.url}
+                        type={"button"}
+                        tabIndex={0}
+                        onClick={() => openUrl(link.url)}
+                        className={
+                            "rounded-sm decoration-[0.5px] underline-offset-4 outline-none transition hover:text-nb-gray-100 hover:underline focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940"
+                        }
+                    >
+                        {link.label}
+                    </button>
+                ))}
+            </div>
+        </div>
+    );
+}
diff --git a/client/ui/frontend/src/modules/settings/SettingsAccent.tsx b/client/ui/frontend/src/modules/settings/SettingsAccent.tsx
new file mode 100644
index 000000000..b7d9c96c8
--- /dev/null
+++ b/client/ui/frontend/src/modules/settings/SettingsAccent.tsx
@@ -0,0 +1,116 @@
+import { useCallback, useEffect, useRef, useState } from "react";
+import { createRoot } from "react-dom/client";
+
+export function useAccentTrigger() {
+    const clicksRef = useRef(0);
+    const lastClickRef = useRef(0);
+
+    return useCallback(() => {
+        const now = performance.now();
+        if (now - lastClickRef.current > 400) {
+            clicksRef.current = 0;
+        }
+        lastClickRef.current = now;
+        clicksRef.current += 1;
+        if (clicksRef.current >= 10) {
+            clicksRef.current = 0;
+            triggerAccent();
+        }
+    }, []);
+}
+
+function triggerAccent() {
+    if (document.getElementById("nb-accent-root")) return;
+
+    const container = document.createElement("div");
+    container.id = "nb-accent-root";
+    document.body.appendChild(container);
+    const root = createRoot(container);
+
+    const cleanup = () => {
+        root.unmount();
+        container.remove();
+    };
+
+    root.render(<Accent onDone={cleanup} />);
+}
+
+function Accent({ onDone }: Readonly<{ onDone: () => void }>) {
+    const canvasRef = useRef<HTMLCanvasElement>(null);
+    const [visible, setVisible] = useState(false);
+
+    useEffect(() => {
+        const raf = requestAnimationFrame(() => setVisible(true));
+        return () => cancelAnimationFrame(raf);
+    }, []);
+
+    useEffect(() => {
+        const canvas = canvasRef.current;
+        if (!canvas) return;
+        const ctx = canvas.getContext("2d");
+        if (!ctx) return;
+
+        const dpr = window.devicePixelRatio || 1;
+        const resize = () => {
+            canvas.width = window.innerWidth * dpr;
+            canvas.height = window.innerHeight * dpr;
+            canvas.style.width = `${window.innerWidth}px`;
+            canvas.style.height = `${window.innerHeight}px`;
+            ctx.setTransform(dpr, 0, 0, dpr, 0, 0);
+        };
+        resize();
+        window.addEventListener("resize", resize);
+
+        const chars = "TEAMNETBIRD";
+        const fontSize = 16;
+        const columns = Math.floor(window.innerWidth / fontSize);
+        const drops = Array.from({ length: columns }, () => Math.random() * -50);
+
+        let raf = 0;
+        let last = 0;
+        const draw = (t: number) => {
+            if (t - last > 50) {
+                last = t;
+
+                ctx.globalCompositeOperation = "destination-out";
+                ctx.fillStyle = "rgba(0, 0, 0, 0.12)";
+                ctx.fillRect(0, 0, window.innerWidth, window.innerHeight);
+
+                ctx.globalCompositeOperation = "source-over";
+                ctx.font = `${fontSize}px ui-monospace, monospace`;
+                ctx.fillStyle = "#f68330";
+
+                for (let i = 0; i < drops.length; i++) {
+                    const ch = chars[Math.floor(Math.random() * chars.length)];
+                    const y = drops[i] * fontSize;
+                    ctx.fillText(ch, i * fontSize, y);
+                    if (y > window.innerHeight && Math.random() > 0.975) {
+                        drops[i] = 0;
+                    }
+                    drops[i]++;
+                }
+            }
+            raf = requestAnimationFrame(draw);
+        };
+        raf = requestAnimationFrame(draw);
+
+        const timeout = globalThis.setTimeout(() => {
+            setVisible(false);
+            globalThis.setTimeout(onDone, 500);
+        }, 9000);
+
+        return () => {
+            cancelAnimationFrame(raf);
+            globalThis.clearTimeout(timeout);
+            window.removeEventListener("resize", resize);
+        };
+    }, [onDone]);
+
+    return (
+        <div
+            className={`pointer-events-none fixed inset-0 z-50 bg-black/5 transition-opacity duration-500 ${visible ? "opacity-100" : "opacity-0"}`}
+        >
+            <canvas ref={canvasRef} className={"block"} />
+        </div>
+    );
+}
diff --git a/client/ui/frontend/src/modules/settings/SettingsAdvanced.tsx b/client/ui/frontend/src/modules/settings/SettingsAdvanced.tsx
new file mode 100644
index 000000000..37b1932d9
--- /dev/null
+++ b/client/ui/frontend/src/modules/settings/SettingsAdvanced.tsx
@@ -0,0 +1,179 @@
+import { useEffect, useMemo, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { System } from "@wailsio/runtime";
+import Button from "@/components/buttons/Button";
+import { HelpText } from "@/components/typography/HelpText";
+import { Input } from "@/components/inputs/Input";
+import { Label } from "@/components/typography/Label";
+import { SectionGroup, SettingsBottomBar } from "@/modules/settings/SettingsSection.tsx";
+import { useSettings } from "@/contexts/SettingsContext.tsx";
+import { useRestrictions } from "@/contexts/RestrictionsContext.tsx";
+
+// macOS daemon/CLI only accept utun<N> (Darwin parses digits as the utun unit); Linux caps at IFNAMSIZ-1 = 15 chars.
+const IS_MAC = System.IsMac();
+const INTERFACE_NAME_RE = IS_MAC ? /^utun\d+$/ : /^[A-Za-z0-9._-]{1,15}$/;
+const INTERFACE_NAME_ERROR_KEY = IS_MAC
+    ? "settings.advanced.interfaceName.errorMac"
+    : "settings.advanced.interfaceName.error";
+
+// Port 0 lets the daemon pick a random free port.
+const PORT_MIN = 0;
+const PORT_MAX = 65535;
+
+// Mirrors client/iface/iface.go MinMTU / MaxMTU.
+const MTU_MIN = 576;
+const MTU_MAX = 8192;
+
+const PSK_MASK = "**********";
+
+export function SettingsAdvanced() {
+    const { t } = useTranslation();
+    const { config, saveFields } = useSettings();
+    const { mdm } = useRestrictions();
+
+    const initialPsk = config.preSharedKeySet ? PSK_MASK : "";
+
+    const [values, setValues] = useState({
+        interfaceName: config.interfaceName,
+        wireguardPort: config.wireguardPort,
+        mtu: config.mtu,
+    });
+
+    const [pskInputValue, setPskInputValue] = useState(initialPsk);
+    const [saving, setSaving] = useState(false);
+
+    useEffect(() => {
+        setValues({
+            interfaceName: config.interfaceName,
+            wireguardPort: config.wireguardPort,
+            mtu: config.mtu,
+        });
+        setPskInputValue(config.preSharedKeySet ? PSK_MASK : "");
+    }, [config.interfaceName, config.wireguardPort, config.mtu, config.preSharedKeySet]);
+
+    const errors = useMemo(() => {
+        const out: { interfaceName?: string; wireguardPort?: string; mtu?: string } = {};
+        if (!INTERFACE_NAME_RE.test(values.interfaceName)) {
+            out.interfaceName = t(INTERFACE_NAME_ERROR_KEY);
+        }
+        if (
+            !Number.isInteger(values.wireguardPort) ||
+            values.wireguardPort < PORT_MIN ||
+            values.wireguardPort > PORT_MAX
+        ) {
+            out.wireguardPort = t("settings.advanced.port.error", {
+                min: PORT_MIN,
+                max: PORT_MAX,
+            });
+        }
+        if (!Number.isInteger(values.mtu) || values.mtu < MTU_MIN || values.mtu > MTU_MAX) {
+            out.mtu = t("settings.advanced.mtu.error", { min: MTU_MIN, max: MTU_MAX });
+        }
+        return out;
+    }, [values.interfaceName, values.wireguardPort, values.mtu, t]);
+
+    const filteredErrors = mdm.wireguardPort ? { ...errors, wireguardPort: undefined } : errors;
+    const hasErrors = Object.values(filteredErrors).some((v) => v !== undefined);
+    const pskChanged = pskInputValue !== initialPsk;
+    const hasChanges =
+        values.interfaceName !== config.interfaceName ||
+        (!mdm.wireguardPort && values.wireguardPort !== config.wireguardPort) ||
+        values.mtu !== config.mtu ||
+        (!mdm.preSharedKey && pskChanged);
+
+    const handleSave = async () => {
+        if (!hasChanges || saving || hasErrors) return;
+        setSaving(true);
+        try {
+            const partial: typeof values = { ...values };
+            if (mdm.wireguardPort) partial.wireguardPort = config.wireguardPort;
+
+            const pskEdited = !mdm.preSharedKey && pskChanged && pskInputValue !== PSK_MASK;
+            const pskOpts = pskEdited ? { preSharedKey: pskInputValue } : undefined;
+            await saveFields(partial, pskOpts);
+            if (pskEdited) setPskInputValue(pskInputValue === "" ? "" : PSK_MASK);
+        } finally {
+            setSaving(false);
+        }
+    };
+
+    return (
+        <>
+            <SectionGroup title={t("settings.advanced.section.interface")}>
+                <Input
+                    label={t("settings.advanced.interfaceName.label")}
+                    value={values.interfaceName}
+                    error={errors.interfaceName}
+                    onChange={(e) => setValues((v) => ({ ...v, interfaceName: e.target.value }))}
+                    spellCheck={false}
+                    autoComplete={"off"}
+                    autoCorrect={"off"}
+                    autoCapitalize={"off"}
+                />
+                <div className={mdm.wireguardPort ? "" : "grid grid-cols-2 gap-4"}>
+                    {!mdm.wireguardPort && (
+                        <div>
+                            <Input
+                                label={t("settings.advanced.port.label")}
+                                type={"number"}
+                                min={PORT_MIN}
+                                max={PORT_MAX}
+                                value={values.wireguardPort}
+                                error={errors.wireguardPort}
+                                onChange={(e) =>
+                                    setValues((v) => ({
+                                        ...v,
+                                        wireguardPort: Number(e.target.value),
+                                    }))
+                                }
+                            />
+                            <HelpText className={"mt-1.5"}>
+                                {t("settings.advanced.port.help")}
+                            </HelpText>
+                        </div>
+                    )}
+                    <Input
+                        label={t("settings.advanced.mtu.label")}
+                        type={"number"}
+                        min={MTU_MIN}
+                        max={MTU_MAX}
+                        value={values.mtu}
+                        error={errors.mtu}
+                        onChange={(e) => setValues((v) => ({ ...v, mtu: Number(e.target.value) }))}
+                    />
+                </div>
+            </SectionGroup>
+
+            {!mdm.preSharedKey && (
+                <SectionGroup title={t("settings.advanced.section.security")}>
+                    <div>
+                        <Label as={"div"}>{t("settings.advanced.psk.label")}</Label>
+                        <HelpText>{t("settings.advanced.psk.help")}</HelpText>
+                        <Input
+                            type={"password"}
+                            showPasswordToggle={pskInputValue !== PSK_MASK}
+                            placeholder={"kQv0qF3oQpJYdgD5mC9hL7sB2xZ8nT4eU6wY1aR3jK0="}
+                            value={pskInputValue}
+                            onChange={(e) => setPskInputValue(e.target.value)}
+                            spellCheck={false}
+                            autoComplete={"new-password"}
+                            autoCorrect={"off"}
+                            autoCapitalize={"off"}
+                        />
+                    </div>
+                </SectionGroup>
+            )}
+
+            <SettingsBottomBar>
+                <Button
+                    variant={"primary"}
+                    size={"md"}
+                    disabled={!hasChanges || saving || hasErrors}
+                    onClick={handleSave}
+                >
+                    {t("common.saveChanges")}
+                </Button>
+            </SettingsBottomBar>
+        </>
+    );
+}
diff --git a/client/ui/frontend/src/modules/settings/SettingsGeneral.tsx b/client/ui/frontend/src/modules/settings/SettingsGeneral.tsx
new file mode 100644
index 000000000..05d40e15c
--- /dev/null
+++ b/client/ui/frontend/src/modules/settings/SettingsGeneral.tsx
@@ -0,0 +1,113 @@
+import { useEffect, useId, useRef } from "react";
+import { useTranslation } from "react-i18next";
+import { Button } from "@/components/buttons/Button";
+import FancyToggleSwitch from "@/components/switches/FancyToggleSwitch";
+import { HelpText } from "@/components/typography/HelpText";
+import { Input } from "@/components/inputs/Input";
+import { Label } from "@/components/typography/Label";
+import { SectionGroup } from "@/modules/settings/SettingsSection.tsx";
+import { useAutostartSetting, useSettings } from "@/contexts/SettingsContext.tsx";
+import { ManagementServerSwitch } from "@/components/ManagementServerSwitch.tsx";
+import { ManagementMode, useManagementUrl } from "@/hooks/useManagementUrl.ts";
+import { LanguagePicker } from "@/components/LanguagePicker.tsx";
+import { useRestrictions } from "@/contexts/RestrictionsContext.tsx";
+
+export function SettingsGeneral() {
+    const { t } = useTranslation();
+    const { config, setField } = useSettings();
+    const { autostart, setAutostartEnabled } = useAutostartSetting();
+    const { mode, setMode, setUrl, displayUrl, showError, canSave, save, checking, unreachable } =
+        useManagementUrl();
+    const { mdm, features } = useRestrictions();
+
+    const inputRef = useRef<HTMLInputElement>(null);
+    const managementUrlId = useId();
+    const prevMode = useRef(mode);
+    useEffect(() => {
+        if (prevMode.current === ManagementMode.Cloud && mode === ManagementMode.SelfHosted) {
+            inputRef.current?.focus();
+        }
+        prevMode.current = mode;
+    }, [mode]);
+
+    return (
+        <>
+            <SectionGroup title={t("settings.general.section.general")}>
+                <LanguagePicker />
+                <FancyToggleSwitch
+                    value={!config.disableNotifications}
+                    onChange={(v) => setField("disableNotifications", !v)}
+                    label={t("settings.general.notifications.label")}
+                    helpText={t("settings.general.notifications.help")}
+                />
+                {!mdm.disableAutoConnect && !features.disableUpdateSettings && (
+                    <FancyToggleSwitch
+                        value={!config.disableAutoConnect}
+                        onChange={(v) => setField("disableAutoConnect", !v)}
+                        label={t("settings.general.connectOnStartup.label")}
+                        helpText={t("settings.general.connectOnStartup.help")}
+                    />
+                )}
+                {(autostart === null || autostart.supported) && (
+                    <FancyToggleSwitch
+                        value={autostart?.enabled ?? false}
+                        onChange={setAutostartEnabled}
+                        loading={autostart === null}
+                        label={t("settings.general.autostart.label")}
+                        helpText={t("settings.general.autostart.help")}
+                    />
+                )}
+            </SectionGroup>
+
+            {!mdm.managementURL && !features.disableUpdateSettings && (
+                <SectionGroup title={t("settings.general.section.connection")}>
+                    <div>
+                        <div className={"flex items-start gap-3"}>
+                            <div className={"min-w-0 flex-1"}>
+                                <Label htmlFor={managementUrlId}>
+                                    {t("settings.general.management.label")}
+                                </Label>
+                                <HelpText>{t("settings.general.management.help")}</HelpText>
+                            </div>
+                            <ManagementServerSwitch value={mode} onChange={setMode} />
+                        </div>
+                        {mode === ManagementMode.SelfHosted && (
+                            <div className={"mt-2 flex items-start gap-3"}>
+                                <Input
+                                    id={managementUrlId}
+                                    ref={inputRef}
+                                    value={displayUrl}
+                                    onChange={(e) => setUrl(e.target.value)}
+                                    placeholder={t("settings.general.management.urlPlaceholder")}
+                                    error={
+                                        showError
+                                            ? t("settings.general.management.urlError")
+                                            : undefined
+                                    }
+                                    warning={
+                                        unreachable
+                                            ? t("settings.general.management.urlUnreachable")
+                                            : undefined
+                                    }
+                                    spellCheck={false}
+                                    autoComplete={"off"}
+                                    autoCorrect={"off"}
+                                    autoCapitalize={"off"}
+                                />
+                                <Button
+                                    variant={"primary"}
+                                    size={"md"}
+                                    disabled={!canSave}
+                                    loading={checking}
+                                    onClick={() => save()}
+                                >
+                                    {t("common.save")}
+                                </Button>
+                            </div>
+                        )}
+                    </div>
+                </SectionGroup>
+            )}
+        </>
+    );
+}
diff --git a/client/ui/frontend/src/modules/settings/SettingsNavigation.tsx b/client/ui/frontend/src/modules/settings/SettingsNavigation.tsx
new file mode 100644
index 000000000..816dcb71f
--- /dev/null
+++ b/client/ui/frontend/src/modules/settings/SettingsNavigation.tsx
@@ -0,0 +1,87 @@
+import { useTranslation } from "react-i18next";
+import { Tooltip } from "@/components/Tooltip.tsx";
+import { VerticalTabs } from "@/components/VerticalTabs.tsx";
+import { UpdateBadge } from "@/modules/auto-update/UpdateBadge.tsx";
+import { useClientVersion } from "@/contexts/ClientVersionContext.tsx";
+import { useRestrictions } from "@/contexts/RestrictionsContext.tsx";
+import {
+    BoltIcon,
+    InfoIcon,
+    LifeBuoyIcon,
+    NetworkIcon,
+    ShieldIcon,
+    SlidersHorizontalIcon,
+    SquareTerminalIcon,
+    UserCircleIcon,
+} from "lucide-react";
+
+export const SettingsNavigation = () => {
+    const { t } = useTranslation();
+    const { updateAvailable } = useClientVersion();
+    const { mdm, features } = useRestrictions();
+    const showSsh = mdm.allowServerSSH ?? !features.disableUpdateSettings;
+
+    const aboutAdornment = updateAvailable ? (
+        <Tooltip content={t("settings.tabs.updateAvailable")} side={"right"}>
+            <UpdateBadge />
+        </Tooltip>
+    ) : undefined;
+
+    return (
+        <div className={"flex w-52 shrink-0 select-none flex-col items-center"}>
+            <VerticalTabs.List aria-label={t("settings.nav.label")}>
+                <VerticalTabs.Trigger
+                    value={"general"}
+                    icon={SlidersHorizontalIcon}
+                    title={t("settings.tabs.general")}
+                />
+                {!features.disableUpdateSettings && (
+                    <>
+                        <VerticalTabs.Trigger
+                            value={"network"}
+                            icon={NetworkIcon}
+                            title={t("settings.tabs.network")}
+                        />
+                        <VerticalTabs.Trigger
+                            value={"security"}
+                            icon={ShieldIcon}
+                            title={t("settings.tabs.security")}
+                        />
+                    </>
+                )}
+                {!features.disableProfiles && (
+                    <VerticalTabs.Trigger
+                        value={"profiles"}
+                        icon={UserCircleIcon}
+                        title={t("settings.tabs.profiles")}
+                    />
+                )}
+                {showSsh && (
+                    <VerticalTabs.Trigger
+                        value={"ssh"}
+                        icon={SquareTerminalIcon}
+                        title={t("settings.tabs.ssh")}
+                    />
+                )}
+                {!features.disableUpdateSettings && (
+                    <VerticalTabs.Trigger
+                        value={"advanced"}
+                        icon={BoltIcon}
+                        title={t("settings.tabs.advanced")}
+                    />
+                )}
+                <VerticalTabs.Trigger
+                    value={"troubleshooting"}
+                    icon={LifeBuoyIcon}
+                    title={t("settings.tabs.troubleshooting")}
+                />
+                <VerticalTabs.Trigger
+                    value={"about"}
+                    icon={InfoIcon}
+                    title={t("settings.tabs.about")}
+                    adornment={aboutAdornment}
+                />
+            </VerticalTabs.List>
+        </div>
+    );
+};
diff --git a/client/ui/frontend/src/modules/settings/SettingsNetwork.tsx b/client/ui/frontend/src/modules/settings/SettingsNetwork.tsx
new file mode 100644
index 000000000..7c903b634
--- /dev/null
+++ b/client/ui/frontend/src/modules/settings/SettingsNetwork.tsx
@@ -0,0 +1,55 @@
+import { useTranslation } from "react-i18next";
+import FancyToggleSwitch from "@/components/switches/FancyToggleSwitch";
+import { SectionGroup } from "@/modules/settings/SettingsSection.tsx";
+import { useSettings } from "@/contexts/SettingsContext.tsx";
+import { useRestrictions } from "@/contexts/RestrictionsContext.tsx";
+
+export function SettingsNetwork() {
+    const { t } = useTranslation();
+    const { config, setField } = useSettings();
+    const { mdm } = useRestrictions();
+
+    return (
+        <>
+            <SectionGroup title={t("settings.network.section.connectivity")}>
+                <FancyToggleSwitch
+                    value={config.networkMonitor}
+                    onChange={(v) => setField("networkMonitor", v)}
+                    label={t("settings.network.monitor.label")}
+                    helpText={t("settings.network.monitor.help")}
+                />
+            </SectionGroup>
+
+            <SectionGroup title={t("settings.network.section.routingDns")}>
+                <FancyToggleSwitch
+                    value={!config.disableDns}
+                    onChange={(v) => setField("disableDns", !v)}
+                    label={t("settings.network.dns.label")}
+                    helpText={t("settings.network.dns.help")}
+                />
+                {!mdm.disableClientRoutes && (
+                    <FancyToggleSwitch
+                        value={!config.disableClientRoutes}
+                        onChange={(v) => setField("disableClientRoutes", !v)}
+                        label={t("settings.network.clientRoutes.label")}
+                        helpText={t("settings.network.clientRoutes.help")}
+                    />
+                )}
+                {!mdm.disableServerRoutes && (
+                    <FancyToggleSwitch
+                        value={!config.disableServerRoutes}
+                        onChange={(v) => setField("disableServerRoutes", !v)}
+                        label={t("settings.network.serverRoutes.label")}
+                        helpText={t("settings.network.serverRoutes.help")}
+                    />
+                )}
+                <FancyToggleSwitch
+                    value={!config.disableIpv6}
+                    onChange={(v) => setField("disableIpv6", !v)}
+                    label={t("settings.network.ipv6.label")}
+                    helpText={t("settings.network.ipv6.help")}
+                />
+            </SectionGroup>
+        </>
+    );
+}
diff --git a/client/ui/frontend/src/modules/settings/SettingsPage.tsx b/client/ui/frontend/src/modules/settings/SettingsPage.tsx
new file mode 100644
index 000000000..bf0db3bec
--- /dev/null
+++ b/client/ui/frontend/src/modules/settings/SettingsPage.tsx
@@ -0,0 +1,131 @@
+import { useEffect, useMemo, useState, type ReactNode } from "react";
+import { useLocation } from "react-router-dom";
+import { Events } from "@wailsio/runtime";
+import * as ScrollArea from "@radix-ui/react-scroll-area";
+import { cn } from "@/lib/cn";
+import { isMacOS } from "@/lib/platform";
+import { AppRightPanel } from "@/layouts/AppRightPanel.tsx";
+import { VerticalTabs } from "@/components/VerticalTabs.tsx";
+import { SettingsNavigation } from "@/modules/settings/SettingsNavigation.tsx";
+import { AutostartSettingsProvider, SettingsProvider } from "@/contexts/SettingsContext.tsx";
+import { SettingsGeneral } from "@/modules/settings/SettingsGeneral.tsx";
+import { SettingsNetwork } from "@/modules/settings/SettingsNetwork.tsx";
+import { SettingsSecurity } from "@/modules/settings/SettingsSecurity.tsx";
+import { ProfilesTab } from "@/modules/profiles/ProfilesTab.tsx";
+import { SettingsSSH } from "@/modules/settings/SettingsSSH.tsx";
+import { SettingsAdvanced } from "@/modules/settings/SettingsAdvanced.tsx";
+import { SettingsTroubleshooting } from "@/modules/settings/SettingsTroubleshooting.tsx";
+import { SettingsAbout } from "@/modules/settings/SettingsAbout.tsx";
+import { useRestrictions } from "@/contexts/RestrictionsContext.tsx";
+
+const EVENT_SETTINGS_OPEN = "netbird:settings:open";
+
+const enum Tab {
+    General = "general",
+    Network = "network",
+    Security = "security",
+    Profiles = "profiles",
+    SSH = "ssh",
+    Advanced = "advanced",
+    Troubleshooting = "troubleshooting",
+    About = "about",
+}
+
+const TAB_CONTENT: Record<Tab, ReactNode> = {
+    [Tab.General]: <SettingsGeneral />,
+    [Tab.Network]: <SettingsNetwork />,
+    [Tab.Security]: <SettingsSecurity />,
+    [Tab.Profiles]: <ProfilesTab />,
+    [Tab.SSH]: <SettingsSSH />,
+    [Tab.Advanced]: <SettingsAdvanced />,
+    [Tab.Troubleshooting]: <SettingsTroubleshooting />,
+    [Tab.About]: <SettingsAbout />,
+};
+
+export const SettingsPage = () => {
+    const location = useLocation();
+    const navState = location.state as { tab?: string } | null;
+    const { mdm, features } = useRestrictions();
+
+    const visibleTabs = useMemo<Tab[]>(() => {
+        const editable = !features.disableUpdateSettings;
+        const visibility: Record<Tab, boolean> = {
+            [Tab.General]: true,
+            [Tab.Network]: editable,
+            [Tab.Security]: editable,
+            [Tab.Profiles]: !features.disableProfiles,
+            [Tab.SSH]: mdm.allowServerSSH ?? editable,
+            [Tab.Advanced]: editable,
+            [Tab.Troubleshooting]: true,
+            [Tab.About]: true,
+        };
+        return (Object.keys(visibility) as Tab[]).filter((t) => visibility[t]);
+    }, [features.disableUpdateSettings, features.disableProfiles, mdm.allowServerSSH]);
+
+    const defaultTab = visibleTabs[0];
+    const [active, setActive] = useState<string>(() => navState?.tab ?? defaultTab);
+
+    useEffect(() => {
+        if (navState?.tab) setActive(navState.tab);
+    }, [navState?.tab, location.key]);
+
+    useEffect(() => {
+        return Events.On(EVENT_SETTINGS_OPEN, (e: { data: string }) => {
+            setActive(e.data || defaultTab);
+        });
+    }, [defaultTab]);
+
+    // Reset active tab if it got disabled by any feature flag or mdm restrictions
+    useEffect(() => {
+        if (!visibleTabs.includes(active as Tab)) setActive(defaultTab);
+    }, [visibleTabs, active, defaultTab]);
+
+    return (
+        <>
+            {isMacOS() ? (
+                <div className={"wails-draggable h-12 shrink-0 cursor-default select-none"} />
+            ) : (
+                <div className={"h-px shrink-0 bg-nb-gray-920/0"} />
+            )}
+            <main className={"flex min-h-0 flex-1"}>
+                <VerticalTabs value={active} onValueChange={setActive}>
+                    <SettingsNavigation />
+                    <AppRightPanel>
+                        <AutostartSettingsProvider>
+                            <SettingsProvider>
+                                <ScrollArea.Root
+                                    key={active}
+                                    type={"auto"}
+                                    className={"min-h-0 flex-1 overflow-hidden"}
+                                >
+                                    <ScrollArea.Viewport className={"h-full w-full"}>
+                                        <div className={"px-7 py-6"}>
+                                            {visibleTabs.map((tab) => (
+                                                <VerticalTabs.Content key={tab} value={tab}>
+                                                    {TAB_CONTENT[tab]}
+                                                </VerticalTabs.Content>
+                                            ))}
+                                        </div>
+                                    </ScrollArea.Viewport>
+                                    <ScrollArea.Scrollbar
+                                        orientation={"vertical"}
+                                        className={cn(
+                                            "flex touch-none select-none transition-colors",
+                                            "w-1.5 bg-transparent py-1",
+                                        )}
+                                    >
+                                        <ScrollArea.Thumb
+                                            className={
+                                                "relative flex-1 rounded-full bg-nb-gray-800 hover:bg-nb-gray-700"
+                                            }
+                                        />
+                                    </ScrollArea.Scrollbar>
+                                </ScrollArea.Root>
+                            </SettingsProvider>
+                        </AutostartSettingsProvider>
+                    </AppRightPanel>
+                </VerticalTabs>
+            </main>
+        </>
+    );
+};
diff --git a/client/ui/frontend/src/modules/settings/SettingsSSH.tsx b/client/ui/frontend/src/modules/settings/SettingsSSH.tsx
new file mode 100644
index 000000000..f18fd9493
--- /dev/null
+++ b/client/ui/frontend/src/modules/settings/SettingsSSH.tsx
@@ -0,0 +1,119 @@
+import { useTranslation } from "react-i18next";
+import FancyToggleSwitch from "@/components/switches/FancyToggleSwitch";
+import { HelpText } from "@/components/typography/HelpText";
+import { Input } from "@/components/inputs/Input";
+import { Label } from "@/components/typography/Label";
+import { cn } from "@/lib/cn";
+import { SectionGroup } from "@/modules/settings/SettingsSection.tsx";
+import { useSettings } from "@/contexts/SettingsContext.tsx";
+import { type ChangeEvent, useEffect, useId, useState } from "react";
+
+export function SettingsSSH() {
+    const { t } = useTranslation();
+    const { config, setField } = useSettings();
+    const isSSHServerEnabled = config.serverSshAllowed;
+    const jwtTtlId = useId();
+    const [jwtTtlInput, setJwtTtlInput] = useState(String(config.sshJwtCacheTtl));
+
+    useEffect(() => {
+        setJwtTtlInput(String(config.sshJwtCacheTtl));
+    }, [config.sshJwtCacheTtl]);
+
+    const handleJwtTtlChange = (e: ChangeEvent<HTMLInputElement>) => {
+        const v = e.target.value;
+        setJwtTtlInput(v);
+        if (v === "") return;
+        const n = Number(v);
+        if (Number.isFinite(n) && n >= 0) {
+            setField("sshJwtCacheTtl", n);
+        }
+    };
+
+    const handleJwtTtlBlur = () => {
+        if (jwtTtlInput === "") {
+            setJwtTtlInput("0");
+            setField("sshJwtCacheTtl", 0);
+            return;
+        }
+        const n = Number(jwtTtlInput);
+        if (!Number.isFinite(n) || n < 0) {
+            setJwtTtlInput(String(config.sshJwtCacheTtl));
+        }
+    };
+    return (
+        <>
+            <SectionGroup title={t("settings.ssh.section.server")}>
+                <FancyToggleSwitch
+                    value={config.serverSshAllowed}
+                    onChange={(v) => setField("serverSshAllowed", v)}
+                    label={t("settings.ssh.server.label")}
+                    helpText={t("settings.ssh.server.help")}
+                />
+            </SectionGroup>
+
+            <SectionGroup
+                title={t("settings.ssh.section.capabilities")}
+                disabled={!isSSHServerEnabled}
+            >
+                <FancyToggleSwitch
+                    value={config.enableSshRoot}
+                    onChange={(v) => setField("enableSshRoot", v)}
+                    label={t("settings.ssh.root.label")}
+                    helpText={t("settings.ssh.root.help")}
+                />
+                <FancyToggleSwitch
+                    value={config.enableSshSftp}
+                    onChange={(v) => setField("enableSshSftp", v)}
+                    label={t("settings.ssh.sftp.label")}
+                    helpText={t("settings.ssh.sftp.help")}
+                />
+                <FancyToggleSwitch
+                    value={config.enableSshLocalPortForwarding}
+                    onChange={(v) => setField("enableSshLocalPortForwarding", v)}
+                    label={t("settings.ssh.localForward.label")}
+                    helpText={t("settings.ssh.localForward.help")}
+                />
+                <FancyToggleSwitch
+                    value={config.enableSshRemotePortForwarding}
+                    onChange={(v) => setField("enableSshRemotePortForwarding", v)}
+                    label={t("settings.ssh.remoteForward.label")}
+                    helpText={t("settings.ssh.remoteForward.help")}
+                />
+            </SectionGroup>
+
+            <SectionGroup
+                title={t("settings.ssh.section.authentication")}
+                disabled={!isSSHServerEnabled}
+            >
+                <FancyToggleSwitch
+                    value={!config.disableSshAuth}
+                    onChange={(v) => setField("disableSshAuth", !v)}
+                    label={t("settings.ssh.jwt.label")}
+                    helpText={t("settings.ssh.jwt.help")}
+                />
+                <div
+                    className={cn(
+                        "flex items-center justify-between gap-6",
+                        config.disableSshAuth && "pointer-events-none opacity-50",
+                    )}
+                >
+                    <div className={"max-w-md flex-1"}>
+                        <Label htmlFor={jwtTtlId}>{t("settings.ssh.jwtTtl.label")}</Label>
+                        <HelpText margin={false}>{t("settings.ssh.jwtTtl.help")}</HelpText>
+                    </div>
+                    <div className={"w-40 shrink-0"}>
+                        <Input
+                            id={jwtTtlId}
+                            type={"number"}
+                            min={0}
+                            value={jwtTtlInput}
+                            onChange={handleJwtTtlChange}
+                            onBlur={handleJwtTtlBlur}
+                            customSuffix={t("settings.ssh.jwtTtl.suffix")}
+                        />
+                    </div>
+                </div>
+            </SectionGroup>
+        </>
+    );
+}
diff --git a/client/ui/frontend/src/modules/settings/SettingsSection.tsx b/client/ui/frontend/src/modules/settings/SettingsSection.tsx
new file mode 100644
index 000000000..adba65cdc
--- /dev/null
+++ b/client/ui/frontend/src/modules/settings/SettingsSection.tsx
@@ -0,0 +1,43 @@
+import type { ReactNode } from "react";
+import { cn } from "@/lib/cn";
+
+export const SectionGroup = ({
+    title,
+    children,
+    disabled = false,
+}: {
+    title: string;
+    children: ReactNode;
+    disabled?: boolean;
+}) => (
+    <section
+        aria-label={title}
+        tabIndex={disabled ? -1 : 0}
+        {...(disabled ? { inert: "" } : {})}
+        className={cn(
+            "mb-8 rounded-md px-1 outline-none last:mb-1",
+            "focus-visible:ring-2 focus-visible:ring-white/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
+            disabled && "pointer-events-none opacity-30",
+        )}
+    >
+        <h2 className={"mb-4 text-xs font-semibold uppercase tracking-wider text-nb-gray-400"}>
+            {title}
+        </h2>
+        <div className={"flex flex-col gap-5"}>{children}</div>
+    </section>
+);
+
+export const SettingsBottomBar = ({ children }: { children: ReactNode }) => (
+    <>
+        <div className={"h-[3.2rem] shrink-0"} aria-hidden={"true"} />
+        <div className={"absolute bottom-0 left-0 w-full"}>
+            <div
+                className={
+                    "flex w-full justify-end gap-3 border-t border-nb-gray-920 bg-nb-gray-940 px-8 py-5"
+                }
+            >
+                {children}
+            </div>
+        </div>
+    </>
+);
diff --git a/client/ui/frontend/src/modules/settings/SettingsSecurity.tsx b/client/ui/frontend/src/modules/settings/SettingsSecurity.tsx
new file mode 100644
index 000000000..db1ad9c8f
--- /dev/null
+++ b/client/ui/frontend/src/modules/settings/SettingsSecurity.tsx
@@ -0,0 +1,61 @@
+import { useTranslation } from "react-i18next";
+import FancyToggleSwitch from "@/components/switches/FancyToggleSwitch";
+import { SectionGroup } from "@/modules/settings/SettingsSection.tsx";
+import { useSettings } from "@/contexts/SettingsContext.tsx";
+import { useRestrictions } from "@/contexts/RestrictionsContext.tsx";
+
+export function SettingsSecurity() {
+    const { t } = useTranslation();
+    const { config, setField } = useSettings();
+    const { mdm } = useRestrictions();
+    const hideRosenpassEnabled = mdm.rosenpassEnabled;
+    const hideRosenpassPermissive =
+        mdm.rosenpassPermissive || (mdm.rosenpassEnabled && !config.rosenpassEnabled);
+    const showEncryptionSection = !(hideRosenpassEnabled && hideRosenpassPermissive);
+
+    return (
+        <>
+            <SectionGroup title={t("settings.security.section.firewall")}>
+                {!mdm.blockInbound && (
+                    <FancyToggleSwitch
+                        value={config.blockInbound}
+                        onChange={(v) => setField("blockInbound", v)}
+                        label={t("settings.security.blockInbound.label")}
+                        helpText={t("settings.security.blockInbound.help")}
+                    />
+                )}
+                <FancyToggleSwitch
+                    value={config.blockLanAccess}
+                    onChange={(v) => setField("blockLanAccess", v)}
+                    label={t("settings.security.blockLan.label")}
+                    helpText={t("settings.security.blockLan.help")}
+                />
+            </SectionGroup>
+
+            {showEncryptionSection && (
+                <SectionGroup title={t("settings.security.section.encryption")}>
+                    {!hideRosenpassEnabled && (
+                        <FancyToggleSwitch
+                            value={config.rosenpassEnabled}
+                            onChange={(v) => {
+                                setField("rosenpassEnabled", v);
+                                if (!v) setField("rosenpassPermissive", false);
+                            }}
+                            label={t("settings.security.rosenpass.label")}
+                            helpText={t("settings.security.rosenpass.help")}
+                        />
+                    )}
+                    {!hideRosenpassPermissive && (
+                        <FancyToggleSwitch
+                            value={config.rosenpassPermissive}
+                            onChange={(v) => setField("rosenpassPermissive", v)}
+                            label={t("settings.security.rosenpassPermissive.label")}
+                            helpText={t("settings.security.rosenpassPermissive.help")}
+                            disabled={!config.rosenpassEnabled}
+                        />
+                    )}
+                </SectionGroup>
+            )}
+        </>
+    );
+}
diff --git a/client/ui/frontend/src/modules/settings/SettingsSkeleton.tsx b/client/ui/frontend/src/modules/settings/SettingsSkeleton.tsx
new file mode 100644
index 000000000..afce192e6
--- /dev/null
+++ b/client/ui/frontend/src/modules/settings/SettingsSkeleton.tsx
@@ -0,0 +1,27 @@
+import Skeleton from "react-loading-skeleton";
+
+export const SettingsSkeleton = () => {
+    return (
+        <div className={"flex flex-col gap-6"}>
+            <div>
+                <Skeleton width={100} height={16} className={"mb-4"} />
+                <div>
+                    <Skeleton width={100} height={14} />
+                    <Skeleton width={400} height={10} />
+                </div>
+                <div className={"mt-3"}>
+                    <Skeleton width={100} height={14} />
+                    <Skeleton width={400} height={10} />
+                </div>
+            </div>
+            <div>
+                <Skeleton width={100} height={16} className={"mb-4"} />
+                <div>
+                    <Skeleton width={100} height={14} />
+                    <Skeleton width={400} height={10} />
+                    <Skeleton width={300} height={10} />
+                </div>
+            </div>
+        </div>
+    );
+};
diff --git a/client/ui/frontend/src/modules/settings/SettingsTroubleshooting.tsx b/client/ui/frontend/src/modules/settings/SettingsTroubleshooting.tsx
new file mode 100644
index 000000000..991937719
--- /dev/null
+++ b/client/ui/frontend/src/modules/settings/SettingsTroubleshooting.tsx
@@ -0,0 +1,337 @@
+import { useId, type ReactNode } from "react";
+import { Trans, useTranslation } from "react-i18next";
+import { CircleCheckBig, FolderOpen, Loader2 } from "lucide-react";
+import { Browser } from "@wailsio/runtime";
+import { Debug as DebugSvc } from "@bindings/services";
+import type { DebugBundleResult } from "@bindings/services/models.js";
+import { Button } from "@/components/buttons/Button";
+import { DialogActions } from "@/components/dialog/DialogActions";
+import { DialogDescription } from "@/components/dialog/DialogDescription";
+import { DialogHeading } from "@/components/dialog/DialogHeading";
+import FancyToggleSwitch from "@/components/switches/FancyToggleSwitch";
+import HelpText from "@/components/typography/HelpText.tsx";
+import { Input } from "@/components/inputs/Input";
+import { Label } from "@/components/typography/Label";
+import { SquareIcon } from "@/components/SquareIcon";
+import { formatRemaining } from "@/lib/formatters";
+import type { DebugStage } from "@/contexts/DebugBundleContext";
+import { useDebugBundleContext } from "@/contexts/DebugBundleContext";
+import { SectionGroup, SettingsBottomBar } from "@/modules/settings/SettingsSection.tsx";
+
+const SUPPORT_DOCS_URL = "https://docs.netbird.io/help/report-bug-issues";
+
+export function SettingsTroubleshooting() {
+    const { t } = useTranslation();
+    const durationId = useId();
+    const {
+        anonymize,
+        setAnonymize,
+        systemInfo,
+        setSystemInfo,
+        upload,
+        setUpload,
+        trace,
+        setTrace,
+        capture,
+        setCapture,
+        traceMinutes,
+        setTraceMinutes,
+        capturePackets,
+        setCapturePackets,
+        run,
+        stage,
+        cancel,
+        reset,
+    } = useDebugBundleContext();
+
+    if (stage.kind === "done") {
+        return (
+            <DoneResult result={stage.result} uploaded={stage.uploadAttempted} onClose={reset} />
+        );
+    }
+    if (stage.kind !== "idle") {
+        return <ProgressSection stage={stage} onCancel={cancel} />;
+    }
+
+    return (
+        <SectionGroup title={t("settings.troubleshooting.section.title")}>
+            <FancyToggleSwitch
+                value={anonymize}
+                onChange={setAnonymize}
+                label={t("settings.troubleshooting.anonymize.label")}
+                helpText={t("settings.troubleshooting.anonymize.help")}
+            />
+            <FancyToggleSwitch
+                value={systemInfo}
+                onChange={setSystemInfo}
+                label={t("settings.troubleshooting.systemInfo.label")}
+                helpText={t("settings.troubleshooting.systemInfo.help")}
+            />
+            <FancyToggleSwitch
+                value={upload}
+                onChange={setUpload}
+                label={t("settings.troubleshooting.upload.label")}
+                helpText={t("settings.troubleshooting.upload.help")}
+            />
+            <FancyToggleSwitch
+                value={trace}
+                onChange={setTrace}
+                label={t("settings.troubleshooting.trace.label")}
+                helpText={t("settings.troubleshooting.trace.help")}
+            />
+            <FancyToggleSwitch
+                value={capture}
+                onChange={setCapture}
+                label={t("settings.troubleshooting.capture.label")}
+                helpText={t("settings.troubleshooting.capture.help")}
+            />
+            <div className={"flex flex-col gap-4"}>
+                <FancyToggleSwitch
+                    value={capturePackets}
+                    onChange={setCapturePackets}
+                    label={t("settings.troubleshooting.packets.label")}
+                    helpText={t("settings.troubleshooting.packets.help")}
+                    disabled={!capture}
+                />
+                <div
+                    className={"flex items-center justify-between gap-6"}
+                    {...(capture ? {} : { inert: "" })}
+                >
+                    <div className={"max-w-md flex-1"}>
+                        <Label htmlFor={durationId} disabled={!capture}>
+                            {t("settings.troubleshooting.duration.label")}
+                        </Label>
+                        <HelpText margin={false} disabled={!capture}>
+                            {t("settings.troubleshooting.duration.help")}
+                        </HelpText>
+                    </div>
+                    <div className={"w-40 shrink-0"}>
+                        <Input
+                            id={durationId}
+                            type={"number"}
+                            min={1}
+                            max={30}
+                            value={traceMinutes}
+                            onChange={(e) =>
+                                setTraceMinutes(
+                                    Math.max(1, Math.min(30, Number(e.target.value) || 1)),
+                                )
+                            }
+                            customSuffix={t("settings.troubleshooting.duration.suffix")}
+                            disabled={!capture}
+                        />
+                    </div>
+                </div>
+            </div>
+
+            <SettingsBottomBar>
+                <Button variant={"primary"} size={"md"} onClick={run}>
+                    {t("settings.troubleshooting.create")}
+                </Button>
+            </SettingsBottomBar>
+        </SectionGroup>
+    );
+}
+
+function CenteredPanel({ children }: Readonly<{ children: ReactNode }>) {
+    return (
+        <div
+            className={
+                "absolute inset-0 flex flex-col items-center justify-center gap-5 p-8 text-center"
+            }
+        >
+            {children}
+        </div>
+    );
+}
+
+function ProgressSection({
+    stage,
+    onCancel,
+}: Readonly<{ stage: DebugStage; onCancel: () => void }>) {
+    const { t } = useTranslation();
+    const cancelling = stage.kind === "cancelling";
+    return (
+        <CenteredPanel>
+            <SquareIcon icon={Loader2} className={"[&_svg]:animate-spin"} />
+
+            <div className={"flex max-w-sm flex-col items-center gap-2"}>
+                <DialogHeading className={"text-balance"}>{stageLabel(stage, t)}</DialogHeading>
+                <DialogDescription>
+                    {t("settings.troubleshooting.progress.description")}
+                </DialogDescription>
+            </div>
+
+            {stage.kind === "capturing" && (
+                <div
+                    className={
+                        "font-mono text-2xl font-semibold tabular-nums tracking-wider text-nb-gray-50"
+                    }
+                    aria-live={"polite"}
+                >
+                    {formatRemaining(stage.remainingSec)}
+                </div>
+            )}
+
+            <DialogActions className={"max-w-[220px]"}>
+                <Button
+                    autoFocus
+                    variant={"secondary"}
+                    size={"md"}
+                    className={"w-full"}
+                    onClick={onCancel}
+                    disabled={cancelling}
+                >
+                    {t("common.cancel")}
+                </Button>
+            </DialogActions>
+        </CenteredPanel>
+    );
+}
+
+function DoneResult({
+    result,
+    uploaded,
+    onClose,
+}: Readonly<{
+    result: DebugBundleResult;
+    uploaded: boolean;
+    onClose: () => void;
+}>) {
+    const { t } = useTranslation();
+    const showKey = uploaded && Boolean(result.uploadedKey);
+    const uploadFailed = uploaded && !result.uploadedKey;
+    const onRevealPath = () => {
+        if (!result.path) return;
+        DebugSvc.RevealFile(result.path).catch((err: unknown) =>
+            console.error("reveal debug bundle file", err),
+        );
+    };
+    return (
+        <CenteredPanel>
+            <SquareIcon icon={CircleCheckBig} className={"[&_svg]:text-green-500"} />
+
+            <div className={"flex max-w-sm flex-col items-center gap-2"}>
+                <DialogHeading className={"text-balance"}>
+                    {showKey
+                        ? t("settings.troubleshooting.done.uploadedTitle")
+                        : t("settings.troubleshooting.done.savedTitle")}
+                </DialogHeading>
+                <DialogDescription>
+                    {showKey ? (
+                        <Trans
+                            i18nKey={"settings.troubleshooting.done.uploadedDescription"}
+                            components={{
+                                docs: (
+                                    <a
+                                        href={SUPPORT_DOCS_URL}
+                                        aria-label={t("settings.about.community.documentation")}
+                                        onClick={(e) => {
+                                            e.preventDefault();
+                                            Browser.OpenURL(SUPPORT_DOCS_URL).catch(() =>
+                                                globalThis.open(SUPPORT_DOCS_URL, "_blank"),
+                                            );
+                                        }}
+                                        className={"text-netbird hover:underline"}
+                                    >
+                                        {/* content is provided by <Trans> */}
+                                        <span />
+                                    </a>
+                                ),
+                            }}
+                        />
+                    ) : (
+                        t("settings.troubleshooting.done.savedDescription")
+                    )}
+                </DialogDescription>
+            </div>
+
+            <div className={"flex w-full max-w-sm flex-col gap-3"}>
+                {showKey && <Input value={result.uploadedKey} readOnly copy />}
+
+                {result.path && !showKey && (
+                    <Input
+                        value={result.path}
+                        readOnly
+                        aria-label={t("settings.troubleshooting.done.savedTitle")}
+                        customSuffix={
+                            <button
+                                type={"button"}
+                                onClick={onRevealPath}
+                                className={"pointer-events-auto transition-all hover:text-white"}
+                                aria-label={t("settings.troubleshooting.done.openFileLocation")}
+                            >
+                                <FolderOpen size={16} aria-hidden={"true"} />
+                            </button>
+                        }
+                    />
+                )}
+
+                {uploadFailed && (
+                    <div
+                        role={"alert"}
+                        className={
+                            "rounded-md border border-red-500/30 bg-red-500/10 px-3 py-2 text-xs text-red-300"
+                        }
+                    >
+                        {result.uploadFailureReason
+                            ? t("settings.troubleshooting.uploadFailedWithReason", {
+                                  reason: result.uploadFailureReason,
+                              })
+                            : t("settings.troubleshooting.uploadFailed")}
+                    </div>
+                )}
+            </div>
+
+            <DialogActions className={"max-w-[220px]"}>
+                {showKey ? (
+                    <Button
+                        autoFocus
+                        variant={"primary"}
+                        size={"md"}
+                        className={"w-full"}
+                        copy={result.uploadedKey}
+                    >
+                        {t("settings.troubleshooting.done.copyKey")}
+                    </Button>
+                ) : (
+                    result.path && (
+                        <Button
+                            autoFocus
+                            variant={"primary"}
+                            size={"md"}
+                            className={"w-full"}
+                            onClick={onRevealPath}
+                        >
+                            <FolderOpen size={14} aria-hidden={"true"} />
+                            {t("settings.troubleshooting.done.openFolder")}
+                        </Button>
+                    )
+                )}
+                <Button variant={"secondary"} size={"md"} className={"w-full"} onClick={onClose}>
+                    {t("common.close")}
+                </Button>
+            </DialogActions>
+        </CenteredPanel>
+    );
+}
+
+const stageLabel = (
+    stage: DebugStage,
+    t: (key: string, options?: Record<string, unknown>) => string,
+): string => {
+    switch (stage.kind) {
+        case "reconnecting":
+            return t("settings.troubleshooting.stage.reconnecting");
+        case "capturing":
+            return t("settings.troubleshooting.stage.capturing");
+        case "bundling":
+            return t("settings.troubleshooting.stage.bundling");
+        case "uploading":
+            return t("settings.troubleshooting.stage.uploading");
+        case "cancelling":
+            return t("settings.troubleshooting.stage.cancelling");
+        default:
+            return "";
+    }
+};
diff --git a/client/ui/frontend/src/modules/welcome/WelcomeDialog.tsx b/client/ui/frontend/src/modules/welcome/WelcomeDialog.tsx
new file mode 100644
index 000000000..7be59f102
--- /dev/null
+++ b/client/ui/frontend/src/modules/welcome/WelcomeDialog.tsx
@@ -0,0 +1,170 @@
+import { useCallback, useEffect, useMemo, useState } from "react";
+import {
+    Preferences,
+    Profiles as ProfilesSvc,
+    Settings as SettingsSvc,
+    WindowManager,
+} from "@bindings/services";
+import { Restrictions, SetConfigParams } from "@bindings/services/models.js";
+import { ConfirmDialog } from "@/components/dialog/ConfirmDialog";
+import { useAutoSizeWindow } from "@/hooks/useAutoSizeWindow";
+import { errorDialog, formatErrorMessage } from "@/lib/errors";
+import i18next from "@/lib/i18n";
+import { isNetbirdCloud } from "@/hooks/useManagementUrl";
+import { WelcomeStepTray } from "./WelcomeStepTray";
+import { WelcomeStepManagement } from "./WelcomeStepManagement";
+
+const WINDOW_WIDTH = 360;
+
+type WelcomeStep = "tray" | "management";
+
+function shouldShowManagementStep(
+    activeProfileId: string,
+    email: string,
+    managementUrl: string,
+    managedManagementUrl: string,
+): boolean {
+    if (managedManagementUrl) return false;
+    // The default profile's ID equals the literal "default", so this check
+    // holds whether we pass an ID or the legacy name.
+    if (activeProfileId !== "default") return false;
+    if (email.trim() !== "") return false;
+    return isNetbirdCloud(managementUrl);
+}
+
+type InitialState = {
+    profileName: string;
+    username: string;
+    managementUrl: string;
+    needsManagementStep: boolean;
+};
+
+export default function WelcomeDialog() {
+    const [step, setStep] = useState<WelcomeStep>("tray");
+    const [initial, setInitial] = useState<InitialState | null>(null);
+    const [closing, setClosing] = useState(false);
+    const contentRef = useAutoSizeWindow<HTMLDivElement>(WINDOW_WIDTH, initial !== null);
+
+    useEffect(() => {
+        let cancelled = false;
+        (async () => {
+            try {
+                const [username, active] = await Promise.all([
+                    ProfilesSvc.Username(),
+                    ProfilesSvc.GetActive(),
+                ]);
+                const profileId = active.id || "default";
+                const [config, list, restrictions] = await Promise.all([
+                    SettingsSvc.GetConfig({ profileName: profileId, username }),
+                    ProfilesSvc.List(username),
+                    SettingsSvc.GetRestrictions().catch(() => new Restrictions()),
+                ]);
+                const profile = list.find((p) => p.id === profileId);
+                const email = profile?.email ?? "";
+                if (cancelled) return;
+                setInitial({
+                    profileName: profileId,
+                    username,
+                    managementUrl: config.managementUrl,
+                    needsManagementStep: shouldShowManagementStep(
+                        profileId,
+                        email,
+                        config.managementUrl,
+                        restrictions.mdm.managementURL,
+                    ),
+                });
+            } catch (e) {
+                console.error("welcome: initial probe failed", e);
+                if (cancelled) return;
+                setInitial({
+                    profileName: "default",
+                    username: "",
+                    managementUrl: "",
+                    needsManagementStep: false,
+                });
+            }
+        })();
+        return () => {
+            cancelled = true;
+        };
+    }, []);
+
+    const finish = useCallback(async () => {
+        if (closing) return;
+        setClosing(true);
+        try {
+            await Preferences.SetOnboardingCompleted(true);
+        } catch (e) {
+            console.error("persist onboarding flag:", e);
+        }
+        try {
+            await WindowManager.OpenMain();
+        } catch (e) {
+            console.error("open main window:", e);
+        }
+        try {
+            await WindowManager.CloseWelcome();
+        } catch (e) {
+            console.error("close welcome window:", e);
+        }
+    }, [closing]);
+
+    const handleTrayContinue = useCallback(async () => {
+        if (initial?.needsManagementStep) {
+            setStep("management");
+        } else {
+            await finish();
+        }
+    }, [initial, finish]);
+
+    const handleManagementContinue = useCallback(
+        async (url: string) => {
+            if (!initial) return;
+            try {
+                // SetConfig is a partial update — undefined fields are preserved Go-side.
+                await SettingsSvc.SetConfig(
+                    new SetConfigParams({
+                        profileName: initial.profileName,
+                        username: initial.username,
+                        managementUrl: url,
+                    }),
+                );
+            } catch (e) {
+                await errorDialog({
+                    Title: i18next.t("settings.error.saveTitle"),
+                    Message: formatErrorMessage(e),
+                });
+                throw e;
+            }
+            setInitial((s) => (s ? { ...s, managementUrl: url } : s));
+            await finish();
+        },
+        [initial, finish],
+    );
+
+    const content = useMemo(() => {
+        if (!initial) {
+            return null;
+        }
+        switch (step) {
+            case "tray":
+                return <WelcomeStepTray onContinue={handleTrayContinue} />;
+            case "management":
+                return (
+                    <WelcomeStepManagement
+                        initialUrl={initial.managementUrl}
+                        onContinue={handleManagementContinue}
+                    />
+                );
+        }
+    }, [initial, step, handleTrayContinue, handleManagementContinue]);
+
+    return (
+        <ConfirmDialog
+            ref={contentRef}
+            aria-labelledby={step === "tray" ? "nb-welcome-title" : "nb-welcome-management-title"}
+        >
+            {content}
+        </ConfirmDialog>
+    );
+}
diff --git a/client/ui/frontend/src/modules/welcome/WelcomeStepManagement.tsx b/client/ui/frontend/src/modules/welcome/WelcomeStepManagement.tsx
new file mode 100644
index 000000000..5cb04d484
--- /dev/null
+++ b/client/ui/frontend/src/modules/welcome/WelcomeStepManagement.tsx
@@ -0,0 +1,135 @@
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { Button } from "@/components/buttons/Button";
+import { DialogActions } from "@/components/dialog/DialogActions";
+import { DialogDescription } from "@/components/dialog/DialogDescription";
+import { DialogHeading } from "@/components/dialog/DialogHeading";
+import { Input } from "@/components/inputs/Input";
+import { ManagementServerSwitch } from "@/components/ManagementServerSwitch";
+import {
+    CLOUD_MANAGEMENT_URL,
+    ManagementMode,
+    checkManagementUrlReachable,
+    isNetbirdCloud,
+    isValidManagementUrl,
+    normalizeManagementUrl,
+} from "@/hooks/useManagementUrl";
+import { cn } from "@/lib/cn.ts";
+import { isMacOS } from "@/lib/platform.ts";
+
+type WelcomeStepManagementProps = {
+    initialUrl: string;
+    onContinue: (url: string) => Promise<void>;
+};
+
+export function WelcomeStepManagement({
+    initialUrl,
+    onContinue,
+}: Readonly<WelcomeStepManagementProps>) {
+    const { t } = useTranslation();
+    const startsCloud = isNetbirdCloud(initialUrl);
+    const [mode, setMode] = useState<ManagementMode>(
+        startsCloud ? ManagementMode.Cloud : ManagementMode.SelfHosted,
+    );
+    const [url, setUrl] = useState(startsCloud ? "" : initialUrl);
+    const [syntaxError, setSyntaxError] = useState<string | null>(null);
+    const [unreachable, setUnreachable] = useState(false);
+    const [checking, setChecking] = useState(false);
+
+    const trimmedUrl = url.trim();
+    const syntaxValid = mode === ManagementMode.Cloud || isValidManagementUrl(trimmedUrl);
+    const inputRef = useRef<HTMLInputElement | null>(null);
+    const initialMountRef = useRef(true);
+    const initialSelfHostedRef = useRef(!startsCloud);
+
+    useEffect(() => {
+        setSyntaxError(null);
+        setUnreachable(false);
+    }, [url, mode]);
+
+    useEffect(() => {
+        if (initialMountRef.current && initialSelfHostedRef.current) {
+            inputRef.current?.focus();
+        }
+        initialMountRef.current = false;
+    }, []);
+
+    const handleContinue = useCallback(async () => {
+        if (checking) return;
+        if (mode === ManagementMode.SelfHosted && (!trimmedUrl || !syntaxValid)) {
+            setSyntaxError(t("welcome.management.urlInvalid"));
+            inputRef.current?.focus();
+            return;
+        }
+        const target =
+            mode === ManagementMode.Cloud
+                ? CLOUD_MANAGEMENT_URL
+                : normalizeManagementUrl(trimmedUrl);
+        if (mode === ManagementMode.SelfHosted && !unreachable) {
+            setChecking(true);
+            const reachable = await checkManagementUrlReachable(target);
+            setChecking(false);
+            if (!reachable) {
+                setUnreachable(true);
+                return;
+            }
+        }
+        try {
+            await onContinue(target);
+        } catch (e) {
+            console.error("save management url:", e);
+        }
+    }, [checking, mode, syntaxValid, trimmedUrl, unreachable, onContinue, t]);
+
+    const inputError = syntaxError ?? undefined;
+    const inputWarning = useMemo(
+        () => (!syntaxError && unreachable ? t("welcome.management.urlUnreachable") : undefined),
+        [syntaxError, unreachable, t],
+    );
+
+    return (
+        <>
+            <div className={cn("flex flex-col items-center gap-1", isMacOS() && "mt-4")}>
+                <DialogHeading id={"nb-welcome-management-title"} align={"left"}>
+                    {t("welcome.management.title")}
+                </DialogHeading>
+                <DialogDescription align={"left"}>
+                    {t("welcome.management.description")}
+                </DialogDescription>
+            </div>
+
+            <div className={"wails-no-draggable w-full"}>
+                <ManagementServerSwitch value={mode} onChange={setMode} fullWidth />
+            </div>
+
+            {mode === ManagementMode.SelfHosted && (
+                <div className={"wails-no-draggable w-full text-left"}>
+                    <Input
+                        ref={inputRef}
+                        placeholder={t("welcome.management.urlPlaceholder")}
+                        value={url}
+                        onChange={(e) => setUrl(e.target.value)}
+                        error={inputError}
+                        warning={inputWarning}
+                        spellCheck={false}
+                        autoComplete={"off"}
+                        autoCorrect={"off"}
+                        autoCapitalize={"off"}
+                    />
+                </div>
+            )}
+
+            <DialogActions>
+                <Button
+                    variant={"primary"}
+                    size={"md"}
+                    className={"w-full"}
+                    onClick={handleContinue}
+                    disabled={checking}
+                >
+                    {checking ? t("welcome.management.checking") : t("welcome.continue")}
+                </Button>
+            </DialogActions>
+        </>
+    );
+}
diff --git a/client/ui/frontend/src/modules/welcome/WelcomeStepTray.tsx b/client/ui/frontend/src/modules/welcome/WelcomeStepTray.tsx
new file mode 100644
index 000000000..fe06abc20
--- /dev/null
+++ b/client/ui/frontend/src/modules/welcome/WelcomeStepTray.tsx
@@ -0,0 +1,58 @@
+import { useTranslation } from "react-i18next";
+import { Button } from "@/components/buttons/Button";
+import { DialogActions } from "@/components/dialog/DialogActions";
+import { DialogDescription } from "@/components/dialog/DialogDescription";
+import { DialogHeading } from "@/components/dialog/DialogHeading";
+import { isMacOS, isWindows } from "@/lib/platform";
+import trayScreenshotDarwin from "@/assets/img/tray-darwin.png";
+import trayScreenshotWindows from "@/assets/img/tray-windows.png";
+import trayScreenshotLinux from "@/assets/img/tray-linux.png";
+
+// Call at render time, not module scope: initPlatform() must run before isMacOS/isWindows.
+function trayScreenshotForOS(): string {
+    if (isMacOS()) return trayScreenshotDarwin;
+    if (isWindows()) return trayScreenshotWindows;
+    return trayScreenshotLinux;
+}
+
+type WelcomeStepTrayProps = {
+    onContinue: () => void;
+};
+
+export function WelcomeStepTray({ onContinue }: Readonly<WelcomeStepTrayProps>) {
+    const { t } = useTranslation();
+    const trayScreenshot = trayScreenshotForOS();
+
+    return (
+        <>
+            <div className={"px-1"}>
+                <img
+                    src={trayScreenshot}
+                    alt={""}
+                    className={"pointer-events-none h-auto w-full select-none rounded-2xl"}
+                    draggable={false}
+                />
+            </div>
+
+            <div className={"flex w-full flex-col gap-1"}>
+                <DialogHeading id={"nb-welcome-title"} align={"left"}>
+                    {t("welcome.title")}
+                </DialogHeading>
+                <DialogDescription align={"left"}>{t("welcome.description")}</DialogDescription>
+            </div>
+
+            <DialogActions>
+                <Button
+                    autoFocus
+                    variant={"primary"}
+                    size={"md"}
+                    tabIndex={0}
+                    className={"w-full"}
+                    onClick={onContinue}
+                >
+                    {t("welcome.continue")}
+                </Button>
+            </DialogActions>
+        </>
+    );
+}
diff --git a/client/ui/frontend/src/vite-env.d.ts b/client/ui/frontend/src/vite-env.d.ts
new file mode 100644
index 000000000..11f02fe2a
--- /dev/null
+++ b/client/ui/frontend/src/vite-env.d.ts
@@ -0,0 +1 @@
+/// <reference types="vite/client" />
diff --git a/client/ui/frontend/tailwind.config.ts b/client/ui/frontend/tailwind.config.ts
new file mode 100644
index 000000000..93ff39eea
--- /dev/null
+++ b/client/ui/frontend/tailwind.config.ts
@@ -0,0 +1,177 @@
+import type { Config } from "tailwindcss";
+
+const config: Config = {
+  content: ["./index.html", "./src/**/*.{ts,tsx}"],
+  darkMode: "class",
+  theme: {
+    fontFamily: {
+      sans: ['"Inter Variable"', 'ui-sans-serif', 'system-ui', 'sans-serif'],
+      mono: ['"JetBrains Mono Variable"', 'ui-monospace', 'monospace'],
+    },
+    extend: {
+      colors: {
+        "nb-gray": {
+          DEFAULT: "#181A1D",
+          50: "#f4f6f7",
+          100: "#e4e7e9",
+          200: "#cbd2d6",
+          250: "#b7c0c6",
+          300: "#a3adb5",
+          350: "#8f9ca8",
+          400: "#7c8994",
+          500: "#616e79",
+          600: "#535d67",
+          700: "#474e57",
+          800: "#3f444b",
+          850: "#363b40",
+          900: "#2e3238",
+          910: "#2b2f33",
+          920: "#25282d",
+          925: "#1e2123",
+          930: "#25282c",
+          935: "#1f2124",
+          940: "#1c1e21",
+          950: "#181a1d",
+          960: "#16181b",
+        },
+        gray: {
+          50: "#F9FAFB",
+          100: "#F3F4F6",
+          200: "#E5E7EB",
+          300: "#D1D5DB",
+          400: "#9CA3AF",
+          500: "#6B7280",
+          600: "#4B5563",
+          700: "#374151",
+          800: "#1F2937",
+          900: "#111827",
+        },
+        red: {
+          50: "#FDF2F2",
+          100: "#FDE8E8",
+          200: "#FBD5D5",
+          300: "#F8B4B4",
+          400: "#F98080",
+          500: "#F05252",
+          600: "#E02424",
+          700: "#C81E1E",
+          800: "#9B1C1C",
+          900: "#771D1D",
+        },
+        yellow: {
+          50: "#FDFDEA",
+          100: "#FDF6B2",
+          200: "#FCE96A",
+          300: "#FACA15",
+          400: "#E3A008",
+          500: "#C27803",
+          600: "#9F580A",
+          700: "#8E4B10",
+          800: "#723B13",
+          900: "#633112",
+        },
+        green: {
+          50: "#F3FAF7",
+          100: "#DEF7EC",
+          200: "#BCF0DA",
+          300: "#84E1BC",
+          400: "#31C48D",
+          500: "#0E9F6E",
+          600: "#057A55",
+          700: "#046C4E",
+          800: "#03543F",
+          900: "#014737",
+        },
+        blue: {
+          50: "#EBF5FF",
+          100: "#E1EFFE",
+          200: "#C3DDFD",
+          300: "#A4CAFE",
+          400: "#76A9FA",
+          500: "#3F83F8",
+          600: "#1C64F2",
+          700: "#1A56DB",
+          800: "#1E429F",
+          900: "#233876",
+        },
+        indigo: {
+          50: "#F0F5FF",
+          100: "#E5EDFF",
+          200: "#CDDBFE",
+          300: "#B4C6FC",
+          400: "#8DA2FB",
+          500: "#6875F5",
+          600: "#5850EC",
+          700: "#5145CD",
+          800: "#42389D",
+          900: "#362F78",
+        },
+        purple: {
+          50: "#F6F5FF",
+          100: "#EDEBFE",
+          200: "#DCD7FE",
+          300: "#CABFFD",
+          400: "#AC94FA",
+          500: "#9061F9",
+          600: "#7E3AF2",
+          700: "#6C2BD9",
+          800: "#5521B5",
+          900: "#4A1D96",
+        },
+        pink: {
+          50: "#FDF2F8",
+          100: "#FCE8F3",
+          200: "#FAD1E8",
+          300: "#F8B4D9",
+          400: "#F17EB8",
+          500: "#E74694",
+          600: "#D61F69",
+          700: "#BF125D",
+          800: "#99154B",
+          900: "#751A3D",
+        },
+        netbird: {
+          DEFAULT: "#f68330",
+          50: "#fff6ed",
+          100: "#feecd6",
+          150: "#ffdfb8",
+          200: "#ffd4a6",
+          300: "#fab677",
+          400: "#f68330",
+          500: "#f46d1b",
+          600: "#e55311",
+          700: "#be3e10",
+          800: "#973215",
+          900: "#7a2b14",
+          950: "#421308",
+        },
+      },
+      backgroundImage: {
+        "conic-netbird": "conic-gradient(from 0deg, #e55311 0%, #f68330 10%, #e55311 20%, #e55311 100%)",
+      },
+      keyframes: {
+        "pulse-reverse": {
+          "0%, 100%": { opacity: "1" },
+          "50%": { opacity: "0.4" },
+        },
+        "spin-slow": {
+          "0%": { transform: "rotate(0deg)" },
+          "100%": { transform: "rotate(360deg)" },
+        },
+        "ping-slow": {
+          "0%": { transform: "scale(1)", opacity: "1" },
+          "75%, 100%": { transform: "scale(2)", opacity: "0" },
+        },
+      },
+      animation: {
+        "ping-slow": "ping-slow 2s cubic-bezier(0, 0, 0.2, 1) infinite",
+        "pulse-slow": "pulse-reverse 2s cubic-bezier(0.5, 0, 0.6, 1) infinite",
+        "pulse-slower": "pulse-reverse 3s cubic-bezier(0.5, 0, 0.6, 1) infinite",
+        "spin-slow": "spin-slow 2s linear infinite",
+      },
+    },
+  },
+  plugins: [require("tailwindcss-animate")],
+};
+
+export default config;
diff --git a/client/ui/frontend/tsconfig.json b/client/ui/frontend/tsconfig.json
new file mode 100644
index 000000000..f95ce9015
--- /dev/null
+++ b/client/ui/frontend/tsconfig.json
@@ -0,0 +1,30 @@
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "useDefineForClassFields": true,
+    "lib": ["ES2020", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "skipLibCheck": true,
+
+    /* Bundler mode */
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "noEmit": true,
+    "jsx": "react-jsx",
+
+    /* Linting */
+    "strict": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": false,
+    "noImplicitAny": false,
+    "noFallthroughCasesInSwitch": true,
+    "baseUrl": ".",
+    "paths": {
+      "@/*": ["src/*"],
+      "@bindings/*": ["bindings/github.com/netbirdio/netbird/client/ui/*"]
+    }
+  },
+  "include": ["src", "bindings"],
+}
diff --git a/client/ui/frontend/vite.config.ts b/client/ui/frontend/vite.config.ts
new file mode 100644
index 000000000..48b1c5630
--- /dev/null
+++ b/client/ui/frontend/vite.config.ts
@@ -0,0 +1,28 @@
+import path from "path";
+import { defineConfig } from "vite";
+import react from "@vitejs/plugin-react";
+import wails from "@wailsio/runtime/plugins/vite";
+
+// https://vitejs.dev/config/
+export default defineConfig({
+  resolve: {
+    alias: {
+      "@": path.resolve(__dirname, "./src"),
+      "@bindings": path.resolve(
+        __dirname,
+        "./bindings/github.com/netbirdio/netbird/client/ui",
+      ),
+    },
+  },
+  plugins: [react(), wails("./bindings")],
+  server: {
+    host: "127.0.0.1",
+    port: 9245,
+    strictPort: true,
+    fs: {
+      // The i18n bundles live at ../i18n/locales (shared with the Go tray).
+      // Whitelist the parent dir so Vite's dev server serves them.
+      allow: [path.resolve(__dirname, ".."), __dirname],
+    },
+  },
+});
diff --git a/client/ui/grpc.go b/client/ui/grpc.go
new file mode 100644
index 000000000..c8e3aed76
--- /dev/null
+++ b/client/ui/grpc.go
@@ -0,0 +1,67 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"fmt"
+	"runtime"
+	"strings"
+	"sync"
+	"time"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/backoff"
+	"google.golang.org/grpc/credentials/insecure"
+
+	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/client/ui/desktop"
+)
+
+// Conn is the lazy, lock-protected gRPC connection shared by all services so they reuse one channel.
+type Conn struct {
+	addr string
+
+	mu     sync.Mutex
+	client proto.DaemonServiceClient
+}
+
+func NewConn(addr string) *Conn {
+	return &Conn{addr: addr}
+}
+
+func (c *Conn) Client() (proto.DaemonServiceClient, error) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if c.client != nil {
+		return c.client, nil
+	}
+
+	cc, err := grpc.NewClient(
+		strings.TrimPrefix(c.addr, "tcp://"),
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+		grpc.WithUserAgent(desktop.GetUIUserAgent()),
+		// Cap reconnect backoff at 5s; gRPC's default 120s MaxDelay would
+		// leave the UI waiting 30-60s to notice a freshly-started daemon.
+		grpc.WithConnectParams(grpc.ConnectParams{
+			Backoff: backoff.Config{
+				BaseDelay:  1 * time.Second,
+				Multiplier: 1.6,
+				Jitter:     0.2,
+				MaxDelay:   5 * time.Second,
+			},
+		}),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("dial daemon: %w", err)
+	}
+	c.client = proto.NewDaemonServiceClient(cc)
+	return c.client, nil
+}
+
+// DaemonAddr returns the default daemon gRPC address: a Unix socket on Linux/macOS, TCP loopback on Windows.
+func DaemonAddr() string {
+	if runtime.GOOS == "windows" {
+		return "tcp://127.0.0.1:41731"
+	}
+	return "unix:///var/run/netbird.sock"
+}
diff --git a/client/ui/guilog/debuglog.go b/client/ui/guilog/debuglog.go
new file mode 100644
index 000000000..3a25c26c8
--- /dev/null
+++ b/client/ui/guilog/debuglog.go
@@ -0,0 +1,77 @@
+//go:build !android && !ios && !freebsd && !js
+
+// Package guilog manages gui-client.log, which follows the daemon's log level:
+// in debug/trace the GUI attaches a rotated file alongside the console so its
+// (and the React frontend's forwarded) output is captured for the debug bundle.
+package guilog
+
+import (
+	"sync"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/util"
+)
+
+// DebugLog attaches/detaches gui-client.log based on the daemon's log level,
+// fed via Apply. The file is left on disk for the debug bundle to collect.
+// Disabled (and never touches logging) when the user set --log-file explicitly.
+type DebugLog struct {
+	uiPath  string
+	enabled bool
+
+	mu     sync.Mutex
+	fileOn bool
+}
+
+// NewDebugLog builds the GUI debug log. enabled is false when the user passed
+// --log-file (manual override).
+func NewDebugLog(uiPath string, enabled bool) *DebugLog {
+	return &DebugLog{uiPath: uiPath, enabled: enabled}
+}
+
+// Path returns the GUI log path to register with the daemon, or "" when disabled
+// so the daemon won't collect a file the GUI never writes.
+func (d *DebugLog) Path() string {
+	if !d.enabled {
+		return ""
+	}
+	return d.uiPath
+}
+
+// Apply reacts to a daemon log level (the logrus name, e.g. "debug").
+// Idempotent via the fileOn guard, so the startup replay plus a racing
+// change-event are harmless.
+func (d *DebugLog) Apply(level string) {
+	if !d.enabled {
+		return
+	}
+
+	// Compared numerically so there are no hard-coded level-name literals.
+	lvl, err := log.ParseLevel(level)
+	if err != nil {
+		lvl = log.InfoLevel
+	}
+	debug := lvl >= log.DebugLevel
+
+	d.mu.Lock()
+	defer d.mu.Unlock()
+
+	switch {
+	case debug && !d.fileOn:
+		if err := util.SetLogOutputs(log.StandardLogger(), util.LogConsole, d.uiPath); err != nil {
+			log.Errorf("attach GUI file log %s: %v", d.uiPath, err)
+			return
+		}
+		log.SetLevel(lvl)
+		d.fileOn = true
+		log.Infof("GUI file logging enabled (daemon level %s), writing to %s", level, d.uiPath)
+	case !debug && d.fileOn:
+		if err := util.SetLogOutputs(log.StandardLogger(), util.LogConsole); err != nil {
+			log.Errorf("detach GUI file log: %v", err)
+		}
+		log.SetLevel(log.InfoLevel)
+		d.fileOn = false
+		log.Infof("GUI file logging disabled (daemon level: %s)", level)
+	}
+}
diff --git a/client/ui/i18n/TRANSLATING.md b/client/ui/i18n/TRANSLATING.md
new file mode 100644
index 000000000..88cbb8b11
--- /dev/null
+++ b/client/ui/i18n/TRANSLATING.md
@@ -0,0 +1,133 @@
+# Translating the NetBird UI
+
+A short brief for translating the desktop UI — for any translator, human or AI agent (*"you"* = whoever's translating).
+
+**Drive an agent with:** *"Read `i18n/TRANSLATING.md` and translate the UI to Russian"* — or *"…and review the existing German translation."*
+
+> 💡 **The one habit that matters most:** read each key's `description` before translating it. Labels are terse and ambiguous on their own; the `description` tells you what the string is, where it shows up, what to keep verbatim, and what it actually means.
+
+---
+
+## What NetBird is
+
+A **business zero-trust VPN** — an encrypted **overlay mesh** between a company's devices, built on **WireGuard®**, connecting peers directly with a **relay** fallback. This is the **desktop client** (tray app + windows) someone runs to connect, switch profiles, browse peers, and pick an exit node — *not* the admin dashboard.
+
+**Audience:** IT-literate professionals. **Tone:** clear and professional, never consumer-cute.
+
+**The vocabulary you'll meet:**
+
+| Term | What it means here |
+|---|---|
+| **Peer** | A device on the network (laptop, server, phone) |
+| **Resource / Network** | A routed network or service reachable through NetBird (UI calls these "Resources") |
+| **Exit Node** | A peer that routes *all* internet traffic, like a full-tunnel gateway |
+| **Profile** | A saved connection identity you can switch between |
+| **Daemon** | The background service the UI talks to |
+| **Management server** | The control plane — *Cloud* (hosted) or *self-hosted* (customer-run) |
+| **Relay** | Forwards traffic when two peers can't connect directly |
+| **Rosenpass** | Post-quantum security layered over WireGuard® |
+| **Handshake** | The periodic WireGuard® key sync between peers |
+
+---
+
+## The files
+
+```
+i18n/locales/_index.json         shipped-language list
+i18n/locales/en/common.json      source of truth — message + description
+i18n/locales/<code>/common.json  a target — message only
+```
+
+Chrome-extension JSON, each key → `{ "message", "description" }`. You translate the **`message`**.
+
+| ✅ Do | ❌ Don't |
+|---|---|
+| Keep **every key** from `en`, in the same order | Translate, rename, reorder, drop, or add keys (they're identifiers; the set grows over time) |
+| Put **only `message`** in target bundles | Copy `description` into a target bundle |
+| Give every key a non-empty `message` | Leave keys missing or empty |
+| Save valid UTF-8 JSON, no BOM | Add trailing commas or break the JSON |
+
+---
+
+## Hard rules — get these exactly right
+
+These are the usual ways a translation *breaks the app*, not just reads oddly.
+
+| ✅ Do | ❌ Don't |
+|---|---|
+| Copy `{placeholders}` verbatim — `{version}`, `{count}`, `{name}`… | Translate the word inside the braces (`{verbleibend}` breaks it) |
+| Reposition a placeholder so the sentence flows | Drop or duplicate a placeholder |
+| Preserve every `\n`, leading/trailing space, and trailing `...` | Trim "invisible" spaces or the `...` (they're load-bearing) |
+| Keep `®` in WireGuard® and quotes around `{name}` | Strip punctuation the description flags |
+
+**Plurals:** the app has only a *one / other* split — the singular key fires only when `count == 1`; the `{count}` key covers everything else (0, 2, 5, 100…). Languages with more than two forms (ru, pl, uk) can't be fully correct here — use the form that fits the widest range (Russian genitive plural: `минут` / `часов` / `дней`). Don't invent extra keys or cram multiple forms into one string. When no single form fits every value — a unit label after a number field, say — reach for a number-agnostic form (an abbreviation, or wording that reads the same for 1 and 100) instead of forcing a plural the *one / other* split can't supply.
+
+**Agreement:** a `{placeholder}` drops a value into a fixed frame, so the words around it must fit *every* value the app can supply. In inflected languages, write the frame in the case the surrounding preposition demands — German's duration fragments are **dative** because they land inside "…in {remaining}" (`in {count} Tagen`, `weniger als einer Minute`), not nominative `Tage`. Check the key that *consumes* the fragment (here `tray.session.expiresIn`) before choosing the form.
+
+---
+
+## Glossary
+
+**Tier A — never translate (brands):** `NetBird` · `WireGuard®` · `Rosenpass` · `GitHub` · `ICE` · company/product names · sample URLs · version numbers.
+
+When a brand sits beside a common noun, keep its exact spelling but join them the way your language builds such phrases — a hyphen, a connector word, an inflected noun — rather than copying English's bare noun-stack.
+
+**Tier B — keep as-is (acronyms):** `SSO` · `MFA` · `DNS` · `IP`/`IPv6` · `ACL` · `SSH` · `GUI` · `P2P` · `URL` · `TCP`/`UDP`.
+
+**Tier C — judgment.** One rule decides every term:
+
+> **Use the word that language's IT users actually say.** Translate when a natural, common term exists; keep the English term *only* when the literal translation would be awkward or no one in that field really uses it.
+
+Apply each term **consistently** — same English term → same translation everywhere — and keep a term once you've settled it. Whether a term stays English or takes a native word is **language-dependent**: a technical loanword (e.g. *Daemon*, *Handshake*) often stays, an everyday word (e.g. *Latency*, *Public key*) usually localizes, and some (*Exit Node*, *Peer*) go either way depending on the language. Decide per term with the rule above — a foreign origin alone is no reason to keep English. **Your main reference is the existing bundles:** match how a term was already rendered for your language rather than re-deciding it.
+
+Two checks before you commit a term:
+
+- **Prefer established localized wording.** If a widely used tool in this space (for example WireGuard) ships your language, its wording for a shared term such as *handshake* is what users already expect — look at the translated app, not just English docs. For generic UI verbs and formal address, follow your OS vendor's style guide (Microsoft / Apple / Google).
+- **Watch for false friends.** A literal translation can collide with a *different* established term in your field — confirm your word doesn't already mean something else in this domain before using it.
+
+---
+
+## Style
+
+| ✅ Do | ❌ Don't |
+|---|---|
+| Use the **formal "you"** (de *Sie*, fr *vous*, ru *вы*, it *Lei*, zh 您) | Use casual/informal address |
+| Keep **buttons, menu, and tray** items short, in your language's action form (de "Speichern", fr "Enregistrer") | Let a label run much longer than the English — space is tight |
+| Follow **locale punctuation** (fr NBSP + « », de „…", zh full-width), including around a quoted UI label | Carry over English Title Case (use sentence case; German nouns excepted) |
+| Translate a term the **same way everywhere** | Vary wording for the same concept across screens |
+
+Where it reads naturally, aim to keep each string **roughly the same length** as the English — the UI is tight and over-long strings can wrap or truncate. It's a soft preference, not a rule: if your language simply needs more words, use them.
+
+A few habits that keep a bundle reading like one product rather than a word-for-word port:
+
+- **Translate meaning, not words.** Render what a string *does*. An idiom or an awkward source phrase should become natural in your language, not a literal calque.
+- **Keep one voice within a family.** Sibling strings — the connection states, every settings *help* caption, every "… Failed" title — should share a grammatical form. If one member sounds wrong in that form, re-voice the whole family rather than leave one odd sibling.
+- **Mirror opposites.** A status should read as the natural counterpart of its pair: translate *Disconnected* as the opposite of however you rendered *Connected*, not as an unrelated word. Same for Active/Inactive, Selected/Not selected.
+- **Give a standalone label its subject.** A bare button or title can lose the context the surrounding English UI implied — add the noun back if it would otherwise read ambiguously.
+
+---
+
+## Procedure
+
+**New language** — read `en/common.json` *with* descriptions → settle your Tier C terms → write `i18n/locales/<code>/common.json` (same keys and order as `en`, `message` only, placeholders & brands preserved) → add a row to `_index.json` (`{"code","displayName"` = native name`,"englishName"}`) → run the QA list. Use the locale-code style the existing entries use (e.g. `fr`, `pt`, `zh-CN`).
+
+**Review (de / hu / …)** — read source and target side by side; for each key check glossary conformance (e.g. de `Exit-Node` → `Exit Node`, hu `Kilépő csomópont` → `Exit Node`), placeholder/`\n` integrity, consistency, tone, and that the meaning matches the English `description`. Fix in place, then report what you changed (especially term standardizations) so a native speaker can sanity-check.
+
+---
+
+## QA before you finish
+
+- [ ] Valid JSON · **every `en` key** present, same order · **no `description`** fields
+- [ ] Every `{placeholder}`, `\n`, and intentional space preserved · `...` / `… Failed` / `{name}` quotes kept
+- [ ] Tier A/B left intact · Tier C applied consistently (and matching the existing bundle for your language)
+- [ ] Buttons & tray short · locale punctuation and capitalization applied
+- [ ] New language added to `_index.json`
+- [ ] **Tested in the running app** ↓
+
+---
+
+## Test it in the app
+
+A bundle can pass every check above and still read wrong on screen. **Run the app, switch to your language, and click through the real surfaces** — tray menu, main window, every Settings tab, the dialogs. Watch for text overflow or truncation, labels that are technically right but wrong *for what the control does*, leaked placeholders, and terms that drift between screens.
+
+How to run the app and switch language: see the project README. Can't run it (e.g. a headless agent)? Say so in your summary — don't silently skip this step.
diff --git a/client/ui/i18n/bundle.go b/client/ui/i18n/bundle.go
new file mode 100644
index 000000000..892916999
--- /dev/null
+++ b/client/ui/i18n/bundle.go
@@ -0,0 +1,196 @@
+//go:build !android && !ios && !freebsd && !js
+
+// Package i18n loads and serves translation strings for both the tray (Go)
+// and the React UI (via the services.I18n facade).
+//
+// The locale tree is passed in as an fs.FS so the embed directive can live in
+// the main binary.
+package i18n
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"path"
+	"sort"
+	"strings"
+	"sync"
+
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	localeIndexFile = "_index.json"
+
+	// commonBundleFile shape is Chrome-extension JSON (key -> "message" plus
+	// optional Crowdin "description"); loadBundle flattens to key->message.
+	commonBundleFile = "common.json"
+)
+
+// LanguageCode is a BCP-47-ish locale identifier ("en", "hu", ...).
+type LanguageCode string
+
+// DefaultLanguage is the fallback bundle for missing keys and the default
+// when no preference is on disk.
+const DefaultLanguage LanguageCode = "en"
+
+var ErrUnsupportedLanguage = errors.New("unsupported language")
+
+// Language describes one shipped UI locale. DisplayName is in the locale's
+// own script (a Hungarian entry reads "Magyar" regardless of UI language).
+type Language struct {
+	Code        LanguageCode `json:"code"`
+	DisplayName string       `json:"displayName"`
+	EnglishName string       `json:"englishName"`
+}
+
+type localeIndex struct {
+	Languages []Language `json:"languages"`
+}
+
+// Bundle holds the parsed translation bundles. Loaded once at construction
+// and never mutated.
+type Bundle struct {
+	mu        sync.RWMutex
+	languages []Language
+	bundles   map[LanguageCode]map[string]string
+}
+
+// NewBundle parses _index.json plus every <code>/common.json in the locale
+// tree. Hard-fails only when the default language is missing; other locales
+// without a bundle are dropped with a warning.
+func NewBundle(localesFS fs.FS) (*Bundle, error) {
+	idx, err := loadLocaleIndex(localesFS)
+	if err != nil {
+		return nil, fmt.Errorf("load locale index: %w", err)
+	}
+
+	bundles := make(map[LanguageCode]map[string]string, len(idx.Languages))
+	available := make([]Language, 0, len(idx.Languages))
+	for _, l := range idx.Languages {
+		b, err := loadBundle(localesFS, l.Code)
+		if err != nil {
+			log.Warnf("skip language %q: %v", l.Code, err)
+			continue
+		}
+		bundles[l.Code] = b
+		available = append(available, l)
+	}
+
+	if _, ok := bundles[DefaultLanguage]; !ok {
+		return nil, fmt.Errorf("default language %q bundle missing", DefaultLanguage)
+	}
+
+	sort.Slice(available, func(i, j int) bool { return available[i].Code < available[j].Code })
+
+	return &Bundle{
+		languages: available,
+		bundles:   bundles,
+	}, nil
+}
+
+// Languages returns a copy of the available locales.
+func (b *Bundle) Languages() []Language {
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+	out := make([]Language, len(b.languages))
+	copy(out, b.languages)
+	return out
+}
+
+func (b *Bundle) HasLanguage(code LanguageCode) bool {
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+	_, ok := b.bundles[code]
+	return ok
+}
+
+// BundleFor returns a copy of the full key->text map for one language.
+func (b *Bundle) BundleFor(code LanguageCode) (map[string]string, error) {
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+
+	bundle, ok := b.bundles[code]
+	if !ok {
+		return nil, fmt.Errorf("%w: %q", ErrUnsupportedLanguage, code)
+	}
+	out := make(map[string]string, len(bundle))
+	for k, v := range bundle {
+		out[k] = v
+	}
+	return out, nil
+}
+
+// Translate resolves key for lang, substituting args given as name/value
+// pairs ("version", "1.2.3" replaces "{version}"). Unknown keys fall back to
+// the default language, then to the key itself so a miss is visible in the UI.
+func (b *Bundle) Translate(lang LanguageCode, key string, args ...string) string {
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+
+	if v, ok := b.bundles[lang][key]; ok {
+		return applyPlaceholders(v, args)
+	}
+	if lang != DefaultLanguage {
+		if v, ok := b.bundles[DefaultLanguage][key]; ok {
+			return applyPlaceholders(v, args)
+		}
+	}
+	return key
+}
+
+// applyPlaceholders substitutes {name} in s using args as flat name/value
+// pairs. An odd-length args drops the trailing item.
+func applyPlaceholders(s string, args []string) string {
+	if len(args) == 0 {
+		return s
+	}
+	if len(args)%2 != 0 {
+		log.Debugf("i18n placeholder args not paired: %d items, last dropped", len(args))
+		args = args[:len(args)-1]
+	}
+	for j := 0; j < len(args); j += 2 {
+		s = strings.ReplaceAll(s, "{"+args[j]+"}", args[j+1])
+	}
+	return s
+}
+
+func loadLocaleIndex(localesFS fs.FS) (*localeIndex, error) {
+	data, err := fs.ReadFile(localesFS, localeIndexFile)
+	if err != nil {
+		return nil, err
+	}
+	var idx localeIndex
+	if err := json.Unmarshal(data, &idx); err != nil {
+		return nil, fmt.Errorf("parse %s: %w", localeIndexFile, err)
+	}
+	if len(idx.Languages) == 0 {
+		return nil, errors.New("no languages declared")
+	}
+	return &idx, nil
+}
+
+// bundleEntry is one translation key on disk; Description is Crowdin context,
+// ignored at runtime.
+type bundleEntry struct {
+	Message     string `json:"message"`
+	Description string `json:"description,omitempty"`
+}
+
+func loadBundle(localesFS fs.FS, code LanguageCode) (map[string]string, error) {
+	p := path.Join(string(code), commonBundleFile)
+	data, err := fs.ReadFile(localesFS, p)
+	if err != nil {
+		return nil, err
+	}
+	var entries map[string]bundleEntry
+	if err := json.Unmarshal(data, &entries); err != nil {
+		return nil, fmt.Errorf("parse %s: %w", p, err)
+	}
+	bundle := make(map[string]string, len(entries))
+	for k, e := range entries {
+		bundle[k] = e.Message
+	}
+	return bundle, nil
+}
diff --git a/client/ui/i18n/bundle_test.go b/client/ui/i18n/bundle_test.go
new file mode 100644
index 000000000..d0b0d24d7
--- /dev/null
+++ b/client/ui/i18n/bundle_test.go
@@ -0,0 +1,156 @@
+//go:build !android && !ios && !freebsd && !js
+
+package i18n
+
+import (
+	"testing"
+	"testing/fstest"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// fakeLocales returns an in-memory FS that mirrors the real
+// client/ui/i18n/locales layout (root-level _index.json plus
+// <code>/common.json bundles). Used by every Bundle test so we don't
+// depend on the embedded production bundles staying stable.
+func fakeLocales() fstest.MapFS {
+	return fstest.MapFS{
+		"_index.json": {Data: []byte(`{
+            "languages": [
+                {"code": "en", "displayName": "English", "englishName": "English"},
+                {"code": "hu", "displayName": "Magyar", "englishName": "Hungarian"}
+            ]
+        }`)},
+		"en/common.json": {Data: []byte(`{
+            "tray.menu.connect": {"message": "Connect", "description": "Tray menu item"},
+            "tray.menu.installVersion": {"message": "Install version {version}"},
+            "notify.update.body": {"message": "NetBird {version} is available."}
+        }`)},
+		"hu/common.json": {Data: []byte(`{
+            "tray.menu.connect": {"message": "Csatlakozás"},
+            "tray.menu.installVersion": {"message": "{version} telepítése"}
+        }`)},
+	}
+}
+
+func TestBundle_LoadsAllLanguages(t *testing.T) {
+	b, err := NewBundle(fakeLocales())
+	require.NoError(t, err)
+
+	langs := b.Languages()
+	require.Len(t, langs, 2)
+	codes := []LanguageCode{langs[0].Code, langs[1].Code}
+	assert.ElementsMatch(t, []LanguageCode{"en", "hu"}, codes, "Languages should list every bundle that loaded")
+}
+
+func TestBundle_TranslateLooksUpKey(t *testing.T) {
+	b, err := NewBundle(fakeLocales())
+	require.NoError(t, err)
+
+	assert.Equal(t, "Csatlakozás", b.Translate("hu", "tray.menu.connect"))
+	assert.Equal(t, "Connect", b.Translate("en", "tray.menu.connect"))
+}
+
+func TestBundle_TranslateSubstitutesPlaceholders(t *testing.T) {
+	b, err := NewBundle(fakeLocales())
+	require.NoError(t, err)
+
+	assert.Equal(t, "Install version 1.2.3",
+		b.Translate("en", "tray.menu.installVersion", "version", "1.2.3"),
+		"placeholders should substitute by name")
+	assert.Equal(t, "1.2.3 telepítése",
+		b.Translate("hu", "tray.menu.installVersion", "version", "1.2.3"))
+}
+
+func TestBundle_TranslateFallsBackToEnglish(t *testing.T) {
+	b, err := NewBundle(fakeLocales())
+	require.NoError(t, err)
+
+	// notify.update.body is missing from the hu bundle; English fallback
+	// applies so the user always sees a populated label rather than the
+	// raw key.
+	got := b.Translate("hu", "notify.update.body", "version", "9.9.9")
+	assert.Equal(t, "NetBird 9.9.9 is available.", got, "missing hu key should fall back to en bundle")
+}
+
+func TestBundle_TranslateUnknownKeyReturnsKey(t *testing.T) {
+	b, err := NewBundle(fakeLocales())
+	require.NoError(t, err)
+
+	assert.Equal(t, "tray.missing", b.Translate("en", "tray.missing"),
+		"unknown key should return the key itself for debugability")
+}
+
+func TestBundle_BundleForReturnsCopy(t *testing.T) {
+	b, err := NewBundle(fakeLocales())
+	require.NoError(t, err)
+
+	m, err := b.BundleFor("en")
+	require.NoError(t, err)
+	require.NotEmpty(t, m, "BundleFor should return populated map for known language")
+
+	m["tray.menu.connect"] = "Mutated"
+	assert.Equal(t, "Connect", b.Translate("en", "tray.menu.connect"),
+		"BundleFor must return a copy, not the live map")
+}
+
+func TestBundle_BundleForUnknownLanguage(t *testing.T) {
+	b, err := NewBundle(fakeLocales())
+	require.NoError(t, err)
+
+	_, err = b.BundleFor("xx")
+	assert.ErrorIs(t, err, ErrUnsupportedLanguage)
+}
+
+func TestBundle_HasLanguage(t *testing.T) {
+	b, err := NewBundle(fakeLocales())
+	require.NoError(t, err)
+
+	assert.True(t, b.HasLanguage("en"))
+	assert.True(t, b.HasLanguage("hu"))
+	assert.False(t, b.HasLanguage("de"))
+}
+
+func TestBundle_MissingDefaultBundleFails(t *testing.T) {
+	// Without an en bundle we have nothing to fall back to, so construction
+	// must hard-fail. Catches packaging accidents where someone drops the
+	// English locale.
+	fs := fstest.MapFS{
+		"_index.json":    {Data: []byte(`{"languages":[{"code":"hu","displayName":"Magyar","englishName":"Hungarian"}]}`)},
+		"hu/common.json": {Data: []byte(`{"k":{"message":"v"}}`)},
+	}
+	_, err := NewBundle(fs)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "default language")
+}
+
+func TestBundle_MissingBundleSkipsLanguage(t *testing.T) {
+	// A language declared in the index but missing its bundle file is
+	// dropped from Languages with a warning — adding a new language must
+	// be a two-step process (declare + ship), not declare-only.
+	fs := fstest.MapFS{
+		"_index.json": {Data: []byte(`{"languages":[
+            {"code":"en","displayName":"English","englishName":"English"},
+            {"code":"de","displayName":"Deutsch","englishName":"German"}
+        ]}`)},
+		"en/common.json": {Data: []byte(`{"k":{"message":"v"}}`)},
+	}
+	b, err := NewBundle(fs)
+	require.NoError(t, err)
+
+	langs := b.Languages()
+	require.Len(t, langs, 1)
+	assert.Equal(t, LanguageCode("en"), langs[0].Code, "language without a bundle file must be dropped")
+	assert.False(t, b.HasLanguage("de"))
+}
+
+func TestBundle_OddPlaceholderArgsDoNotPanic(t *testing.T) {
+	b, err := NewBundle(fakeLocales())
+	require.NoError(t, err)
+
+	// Trailing dangling arg should be dropped, not panic — preserves UI
+	// stability when a caller passes an unpaired placeholder by mistake.
+	got := b.Translate("en", "tray.menu.installVersion", "version", "1.2.3", "extra")
+	assert.Equal(t, "Install version 1.2.3", got)
+}
diff --git a/client/ui/i18n/locales/_index.json b/client/ui/i18n/locales/_index.json
new file mode 100644
index 000000000..58b5c484f
--- /dev/null
+++ b/client/ui/i18n/locales/_index.json
@@ -0,0 +1,13 @@
+{
+    "languages": [
+        {"code": "en", "displayName": "English (US)", "englishName": "English (US)"},
+        {"code": "de", "displayName": "Deutsch", "englishName": "German"},
+        {"code": "hu", "displayName": "Magyar", "englishName": "Hungarian"},
+        {"code": "ru", "displayName": "Русский", "englishName": "Russian"},
+        {"code": "es", "displayName": "Español", "englishName": "Spanish"},
+        {"code": "fr", "displayName": "Français", "englishName": "French"},
+        {"code": "it", "displayName": "Italiano", "englishName": "Italian"},
+        {"code": "pt", "displayName": "Português", "englishName": "Portuguese"},
+        {"code": "zh-CN", "displayName": "简体中文", "englishName": "Simplified Chinese"}
+    ]
+}
diff --git a/client/ui/i18n/locales/de/common.json b/client/ui/i18n/locales/de/common.json
new file mode 100644
index 000000000..5e0d8096d
--- /dev/null
+++ b/client/ui/i18n/locales/de/common.json
@@ -0,0 +1,1325 @@
+{
+    "tray.tooltip": {
+        "message": "NetBird"
+    },
+    "tray.status.disconnected": {
+        "message": "Nicht verbunden"
+    },
+    "tray.status.daemonUnavailable": {
+        "message": "Nicht aktiv"
+    },
+    "tray.status.error": {
+        "message": "Fehler"
+    },
+    "tray.status.connected": {
+        "message": "Verbunden"
+    },
+    "tray.status.connecting": {
+        "message": "Wird verbunden"
+    },
+    "tray.status.needsLogin": {
+        "message": "Anmeldung erforderlich"
+    },
+    "tray.status.loginFailed": {
+        "message": "Anmeldung fehlgeschlagen"
+    },
+    "tray.status.sessionExpired": {
+        "message": "Sitzung abgelaufen"
+    },
+    "tray.session.expiresIn": {
+        "message": "Sitzung läuft ab in {remaining}"
+    },
+    "tray.session.unit.lessThanMinute": {
+        "message": "weniger als einer Minute"
+    },
+    "tray.session.unit.minute": {
+        "message": "1 Minute"
+    },
+    "tray.session.unit.minutes": {
+        "message": "{count} Minuten"
+    },
+    "tray.session.unit.hour": {
+        "message": "1 Stunde"
+    },
+    "tray.session.unit.hours": {
+        "message": "{count} Stunden"
+    },
+    "tray.session.unit.day": {
+        "message": "1 Tag"
+    },
+    "tray.session.unit.days": {
+        "message": "{count} Tagen"
+    },
+    "tray.menu.open": {
+        "message": "NetBird öffnen"
+    },
+    "tray.menu.connect": {
+        "message": "Verbinden"
+    },
+    "tray.menu.disconnect": {
+        "message": "Trennen"
+    },
+    "tray.menu.exitNode": {
+        "message": "Exit Node"
+    },
+    "tray.menu.networks": {
+        "message": "Ressourcen"
+    },
+    "tray.menu.profiles": {
+        "message": "Profile"
+    },
+    "tray.menu.manageProfiles": {
+        "message": "Profile verwalten"
+    },
+    "tray.menu.settings": {
+        "message": "Einstellungen …"
+    },
+    "tray.menu.debugBundle": {
+        "message": "Debug-Paket erstellen"
+    },
+    "tray.menu.about": {
+        "message": "Hilfe & Support"
+    },
+    "tray.menu.github": {
+        "message": "GitHub"
+    },
+    "tray.menu.documentation": {
+        "message": "Dokumentation"
+    },
+    "tray.menu.troubleshoot": {
+        "message": "Fehlerbehebung"
+    },
+    "tray.menu.downloadLatest": {
+        "message": "Neueste Version herunterladen"
+    },
+    "tray.menu.installVersion": {
+        "message": "Version {version} installieren"
+    },
+    "tray.menu.guiVersion": {
+        "message": "GUI: {version}"
+    },
+    "tray.menu.daemonVersion": {
+        "message": "Daemon: {version}"
+    },
+    "tray.menu.versionUnknown": {
+        "message": "—"
+    },
+    "tray.menu.quit": {
+        "message": "NetBird beenden"
+    },
+    "notify.daemonOutdated.title": {
+        "message": "NetBird-Dienst ist veraltet"
+    },
+    "notify.daemonOutdated.body": {
+        "message": "Aktualisieren Sie den NetBird-Dienst, um diese App zu verwenden."
+    },
+    "notify.update.title": {
+        "message": "NetBird-Update verfügbar"
+    },
+    "notify.update.body": {
+        "message": "NetBird {version} ist verfügbar."
+    },
+    "notify.update.enforcedSuffix": {
+        "message": " Ihr Administrator verlangt dieses Update."
+    },
+    "notify.error.title": {
+        "message": "Fehler"
+    },
+    "notify.error.connect": {
+        "message": "Verbindung fehlgeschlagen"
+    },
+    "notify.error.disconnect": {
+        "message": "Trennen fehlgeschlagen"
+    },
+    "notify.error.switchProfile": {
+        "message": "Wechsel zu {profile} fehlgeschlagen"
+    },
+    "notify.error.exitNode": {
+        "message": "Exit Node {name} konnte nicht aktualisiert werden"
+    },
+    "notify.sessionExpired.title": {
+        "message": "NetBird-Sitzung abgelaufen"
+    },
+    "notify.sessionExpired.body": {
+        "message": "Ihre NetBird-Sitzung ist abgelaufen. Bitte melden Sie sich erneut an."
+    },
+    "notify.sessionWarning.title": {
+        "message": "Sitzung läuft bald ab"
+    },
+    "notify.sessionWarning.body": {
+        "message": "Ihre NetBird-Sitzung läuft in {remaining} ab. Klicken Sie auf Jetzt verlängern, um zu erneuern."
+    },
+    "notify.sessionWarning.bodyGeneric": {
+        "message": "Ihre NetBird-Sitzung läuft bald ab. Klicken Sie auf Jetzt verlängern, um zu erneuern."
+    },
+    "notify.sessionWarning.extend": {
+        "message": "Jetzt verlängern"
+    },
+    "notify.sessionWarning.dismiss": {
+        "message": "Verwerfen"
+    },
+    "notify.sessionWarning.failed": {
+        "message": "NetBird-Sitzung konnte nicht verlängert werden"
+    },
+    "notify.sessionWarning.successTitle": {
+        "message": "NetBird-Sitzung verlängert"
+    },
+    "notify.sessionWarning.successBody": {
+        "message": "Ihre Sitzung wurde erneuert."
+    },
+    "notify.sessionDeadlineRejected.title": {
+        "message": "Ungültige Sitzungsablaufzeit"
+    },
+    "notify.sessionDeadlineRejected.body": {
+        "message": "Der Server hat eine ungültige Sitzungsablaufzeit übermittelt. Bitte melden Sie sich erneut an."
+    },
+    "notify.mdm.policyApplied.title": {
+        "message": "NetBird-Einstellungen aktualisiert"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "Ihre NetBird-Konfiguration wurde durch Ihre IT-Richtlinie aktualisiert."
+    },
+    "common.cancel": {
+        "message": "Abbrechen"
+    },
+    "common.save": {
+        "message": "Speichern"
+    },
+    "common.saveChanges": {
+        "message": "Änderungen speichern"
+    },
+    "common.saving": {
+        "message": "Speichert…"
+    },
+    "common.close": {
+        "message": "Schließen"
+    },
+    "common.copy": {
+        "message": "Kopieren"
+    },
+    "common.togglePasswordVisibility": {
+        "message": "Passwortsichtbarkeit umschalten"
+    },
+    "common.increase": {
+        "message": "Erhöhen"
+    },
+    "common.decrease": {
+        "message": "Verringern"
+    },
+    "common.delete": {
+        "message": "Löschen"
+    },
+    "common.create": {
+        "message": "Erstellen"
+    },
+    "common.add": {
+        "message": "Hinzufügen"
+    },
+    "common.remove": {
+        "message": "Entfernen"
+    },
+    "common.refresh": {
+        "message": "Aktualisieren"
+    },
+    "common.loading": {
+        "message": "Lädt…"
+    },
+    "common.netbird": {
+        "message": "NetBird"
+    },
+    "common.noResults.title": {
+        "message": "Keine Ergebnisse gefunden"
+    },
+    "common.noResults.description": {
+        "message": "Es konnten keine Ergebnisse gefunden werden. Bitte versuchen Sie es mit einem anderen Suchbegriff oder ändern Sie Ihre Filter."
+    },
+    "notConnected.title": {
+        "message": "Nicht verbunden"
+    },
+    "notConnected.description": {
+        "message": "Verbinden Sie sich zuerst mit NetBird, um detaillierte Informationen zu Ihren Peers, Netzwerkressourcen und Exit Nodes einzusehen."
+    },
+    "connect.status.disconnected": {
+        "message": "Nicht verbunden"
+    },
+    "connect.status.connecting": {
+        "message": "Wird verbunden…"
+    },
+    "connect.status.connected": {
+        "message": "Verbunden"
+    },
+    "connect.status.disconnecting": {
+        "message": "Wird getrennt…"
+    },
+    "connect.status.daemonUnavailable": {
+        "message": "Daemon nicht verfügbar"
+    },
+    "connect.status.loginRequired": {
+        "message": "Anmeldung erforderlich"
+    },
+    "connect.error.loginTitle": {
+        "message": "Anmeldung fehlgeschlagen"
+    },
+    "connect.error.connectTitle": {
+        "message": "Verbindung fehlgeschlagen"
+    },
+    "connect.error.disconnectTitle": {
+        "message": "Trennen fehlgeschlagen"
+    },
+    "nav.peers.title": {
+        "message": "Peers"
+    },
+    "nav.peers.description": {
+        "message": "{connected} von {total} verbunden"
+    },
+    "nav.resources.title": {
+        "message": "Ressourcen"
+    },
+    "nav.resources.description": {
+        "message": "{active} von {total} aktiv"
+    },
+    "nav.exitNode.title": {
+        "message": "Exit Nodes"
+    },
+    "nav.exitNode.none": {
+        "message": "Nicht aktiv"
+    },
+    "nav.exitNode.using": {
+        "message": "Über {name}"
+    },
+    "header.openSettings": {
+        "message": "Einstellungen öffnen"
+    },
+    "header.togglePanel": {
+        "message": "Seitenleiste umschalten"
+    },
+    "profile.selector.loading": {
+        "message": "Lädt…"
+    },
+    "profile.selector.noProfile": {
+        "message": "Kein Profil"
+    },
+    "profile.selector.searchPlaceholder": {
+        "message": "Profil nach Namen suchen…"
+    },
+    "profile.selector.emptyTitle": {
+        "message": "Keine Profile gefunden"
+    },
+    "profile.selector.emptyDescription": {
+        "message": "Versuchen Sie einen anderen Suchbegriff oder erstellen Sie ein neues Profil."
+    },
+    "profile.selector.newProfile": {
+        "message": "Neues Profil"
+    },
+    "profile.selector.moreOptions": {
+        "message": "Weitere Optionen"
+    },
+    "profile.selector.deregister": {
+        "message": "Abmelden"
+    },
+    "profile.selector.delete": {
+        "message": "Profil löschen"
+    },
+    "profile.selector.switchTo": {
+        "message": "Zu diesem Profil wechseln"
+    },
+    "profile.selector.edit": {
+        "message": "Bearbeiten"
+    },
+    "profile.edit.title": {
+        "message": "Profil bearbeiten"
+    },
+    "profile.edit.submit": {
+        "message": "Änderungen speichern"
+    },
+    "profile.dialog.title": {
+        "message": "Neues Profil"
+    },
+    "profile.dialog.nameLabel": {
+        "message": "Profilname"
+    },
+    "profile.dialog.description": {
+        "message": "Legen Sie einen leicht erkennbaren Namen für Ihr Profil fest."
+    },
+    "profile.dialog.placeholder": {
+        "message": "z. B. Arbeit"
+    },
+    "profile.dialog.submit": {
+        "message": "Profil hinzufügen"
+    },
+    "profile.dialog.required": {
+        "message": "Bitte geben Sie einen Profilnamen ein, z. B. Arbeit, Privat"
+    },
+    "profile.dialog.managementHelp": {
+        "message": "NetBird Cloud oder Ihr eigener Server."
+    },
+    "profile.dialog.urlUnreachable": {
+        "message": "Server nicht erreichbar. Überprüfen Sie die URL, oder fügen Sie das Profil trotzdem hinzu, wenn Sie sicher sind, dass sie korrekt ist."
+    },
+    "header.menu.settings": {
+        "message": "Einstellungen …"
+    },
+    "header.menu.defaultView": {
+        "message": "Standardansicht"
+    },
+    "header.menu.advancedView": {
+        "message": "Erweiterte Ansicht"
+    },
+    "header.menu.updateAvailable": {
+        "message": "Update verfügbar"
+    },
+    "header.menu.open": {
+        "message": "Menü öffnen"
+    },
+    "header.profile.switch": {
+        "message": "Profil wechseln"
+    },
+    "connect.toggle.label": {
+        "message": "NetBird-Verbindung umschalten"
+    },
+    "connect.localIp.label": {
+        "message": "Lokale IP-Adressen"
+    },
+    "common.search": {
+        "message": "Suchen"
+    },
+    "common.filter": {
+        "message": "Filtern"
+    },
+    "exitNodes.dropdown.trigger": {
+        "message": "Exit-Node auswählen"
+    },
+    "peers.row.label": {
+        "message": "Details öffnen für {name}, {status}"
+    },
+    "peers.dialog.title": {
+        "message": "Peer-Details"
+    },
+    "networks.row.toggle": {
+        "message": "{name} umschalten"
+    },
+    "networks.bulk.label": {
+        "message": "Alle sichtbaren Ressourcen umschalten"
+    },
+    "settings.nav.label": {
+        "message": "Einstellungsbereiche"
+    },
+    "profile.switch.title": {
+        "message": "Zu Profil \"{name}\" wechseln?"
+    },
+    "profile.switch.message": {
+        "message": "Sind Sie sicher, dass Sie das Profil wechseln möchten?\nIhr aktuelles Profil wird getrennt."
+    },
+    "profile.switch.confirm": {
+        "message": "Bestätigen"
+    },
+    "profile.deregister.title": {
+        "message": "Profil \"{name}\" abmelden?"
+    },
+    "profile.deregister.message": {
+        "message": "Sind Sie sicher, dass Sie dieses Profil abmelden möchten?\nSie müssen sich erneut anmelden, um es zu nutzen."
+    },
+    "profile.deregister.confirm": {
+        "message": "Abmelden"
+    },
+    "profile.delete.title": {
+        "message": "Profil \"{name}\" löschen?"
+    },
+    "profile.delete.message": {
+        "message": "Sind Sie sicher, dass Sie dieses Profil löschen möchten?\nDiese Aktion kann nicht rückgängig gemacht werden."
+    },
+    "profile.delete.disabledActive": {
+        "message": "Aktive Profile können nicht gelöscht werden. Wechseln Sie zu einem anderen Profil, bevor Sie dieses löschen."
+    },
+    "profile.delete.disabledDefault": {
+        "message": "Das Standardprofil kann nicht gelöscht werden."
+    },
+    "profile.error.switchTitle": {
+        "message": "Profilwechsel fehlgeschlagen"
+    },
+    "profile.error.deregisterTitle": {
+        "message": "Abmeldung fehlgeschlagen"
+    },
+    "profile.error.deleteTitle": {
+        "message": "Löschen des Profils fehlgeschlagen"
+    },
+    "profile.error.createTitle": {
+        "message": "Erstellen des Profils fehlgeschlagen"
+    },
+    "profile.error.editTitle": {
+        "message": "Bearbeiten des Profils fehlgeschlagen"
+    },
+    "profile.error.loadTitle": {
+        "message": "Laden der Profile fehlgeschlagen"
+    },
+    "profile.dropdown.activeProfile": {
+        "message": "Aktives Profil"
+    },
+    "profile.dropdown.switchProfile": {
+        "message": "Profil wechseln"
+    },
+    "profile.dropdown.noEmail": {
+        "message": "Andere"
+    },
+    "profile.dropdown.addProfile": {
+        "message": "Profil hinzufügen"
+    },
+    "profile.dropdown.manageProfiles": {
+        "message": "Profile verwalten"
+    },
+    "profile.dropdown.settings": {
+        "message": "Einstellungen"
+    },
+    "settings.profiles.section.profiles": {
+        "message": "Profile"
+    },
+    "settings.profiles.intro": {
+        "message": "Verwalten Sie mehrere NetBird-Profile parallel, zum Beispiel berufliche und private Konten oder verschiedene Management-Server. Fügen Sie unten Profile hinzu, melden Sie sie ab oder löschen Sie sie."
+    },
+    "settings.profiles.addProfile": {
+        "message": "Profil hinzufügen"
+    },
+    "settings.profiles.active": {
+        "message": "Aktiv"
+    },
+    "settings.profiles.emptyTitle": {
+        "message": "Keine Profile"
+    },
+    "settings.profiles.emptyDescription": {
+        "message": "Erstellen Sie ein Profil, um sich mit einem NetBird-Management-Server zu verbinden."
+    },
+    "settings.error.loadTitle": {
+        "message": "Laden der Einstellungen fehlgeschlagen"
+    },
+    "settings.error.saveTitle": {
+        "message": "Speichern der Einstellungen fehlgeschlagen"
+    },
+    "settings.error.debugBundleTitle": {
+        "message": "Debug-Paket fehlgeschlagen"
+    },
+    "settings.tabs.general": {
+        "message": "Allgemein"
+    },
+    "settings.tabs.network": {
+        "message": "Netzwerk"
+    },
+    "settings.tabs.security": {
+        "message": "Sicherheit"
+    },
+    "settings.tabs.profiles": {
+        "message": "Profile"
+    },
+    "settings.tabs.ssh": {
+        "message": "SSH"
+    },
+    "settings.tabs.advanced": {
+        "message": "Erweitert"
+    },
+    "settings.tabs.troubleshooting": {
+        "message": "Fehlerbehebung"
+    },
+    "settings.tabs.about": {
+        "message": "Über"
+    },
+    "settings.tabs.updateAvailable": {
+        "message": "Update verfügbar"
+    },
+    "settings.general.section.general": {
+        "message": "Allgemein"
+    },
+    "settings.general.section.connection": {
+        "message": "Verbindung"
+    },
+    "settings.general.connectOnStartup.label": {
+        "message": "Beim Start verbinden"
+    },
+    "settings.general.connectOnStartup.help": {
+        "message": "Beim Start des Dienstes automatisch eine Verbindung herstellen."
+    },
+    "settings.general.notifications.label": {
+        "message": "Desktop-Benachrichtigungen"
+    },
+    "settings.general.notifications.help": {
+        "message": "Desktop-Benachrichtigungen für neue Updates und Verbindungsereignisse anzeigen."
+    },
+    "settings.general.autostart.label": {
+        "message": "NetBird-UI beim Anmelden starten"
+    },
+    "settings.general.autostart.help": {
+        "message": "Die NetBird-Oberfläche beim Anmelden automatisch starten. Dies betrifft nur die grafische Oberfläche, nicht den Hintergrunddienst."
+    },
+    "settings.general.autostart.errorTitle": {
+        "message": "Ändern des Autostarts fehlgeschlagen"
+    },
+    "settings.general.language.label": {
+        "message": "Anzeigesprache"
+    },
+    "settings.general.language.help": {
+        "message": "Wählen Sie die Sprache der NetBird-Oberfläche."
+    },
+    "settings.general.language.search": {
+        "message": "Sprache suchen…"
+    },
+    "settings.general.language.empty": {
+        "message": "Keine Sprachen gefunden."
+    },
+    "settings.general.management.label": {
+        "message": "Management-Server"
+    },
+    "settings.general.management.help": {
+        "message": "Mit NetBird Cloud oder Ihrem eigenen self-hosted Management-Server verbinden. Änderungen lösen eine Neuverbindung des Clients aus."
+    },
+    "settings.general.management.cloud": {
+        "message": "Cloud"
+    },
+    "settings.general.management.selfHosted": {
+        "message": "Self-hosted"
+    },
+    "settings.general.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlError": {
+        "message": "Bitte geben Sie eine gültige URL ein, z. B. https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlUnreachable": {
+        "message": "Server nicht erreichbar. Überprüfen Sie die URL, oder speichern Sie trotzdem, wenn Sie sicher sind, dass sie korrekt ist."
+    },
+    "settings.general.management.switchCloudTitle": {
+        "message": "Zu NetBird Cloud wechseln?"
+    },
+    "settings.general.management.switchCloudMessage": {
+        "message": "Dies trennt die Verbindung zu Ihrem self-hosted Server.\nMöglicherweise müssen Sie sich erneut anmelden."
+    },
+    "settings.general.management.switchCloudConfirm": {
+        "message": "Zu Cloud wechseln"
+    },
+    "settings.network.section.connectivity": {
+        "message": "Konnektivität"
+    },
+    "settings.network.section.routingDns": {
+        "message": "Routing & DNS"
+    },
+    "settings.network.monitor.label": {
+        "message": "Bei Netzwerkwechsel neu verbinden"
+    },
+    "settings.network.monitor.help": {
+        "message": "Das Netzwerk überwachen und bei Änderungen (z. B. WLAN-Wechsel, Ethernet-Änderungen oder Rückkehr aus dem Ruhezustand) automatisch neu verbinden."
+    },
+    "settings.network.dns.label": {
+        "message": "DNS aktivieren"
+    },
+    "settings.network.dns.help": {
+        "message": "NetBird-verwaltete DNS-Einstellungen auf den Host-Resolver anwenden."
+    },
+    "settings.network.clientRoutes.label": {
+        "message": "Client-Routen aktivieren"
+    },
+    "settings.network.clientRoutes.help": {
+        "message": "Routen von anderen Peers übernehmen, um deren Netzwerke zu erreichen."
+    },
+    "settings.network.serverRoutes.label": {
+        "message": "Server-Routen aktivieren"
+    },
+    "settings.network.serverRoutes.help": {
+        "message": "Lokale Routen dieses Hosts an andere Peers ankündigen."
+    },
+    "settings.network.ipv6.label": {
+        "message": "IPv6 aktivieren"
+    },
+    "settings.network.ipv6.help": {
+        "message": "IPv6-Adressierung für das NetBird-Overlay-Netzwerk verwenden."
+    },
+    "settings.security.section.firewall": {
+        "message": "Firewall"
+    },
+    "settings.security.section.encryption": {
+        "message": "Verschlüsselung"
+    },
+    "settings.security.blockInbound.label": {
+        "message": "Eingehenden Verkehr blockieren"
+    },
+    "settings.security.blockInbound.help": {
+        "message": "Unaufgeforderte Verbindungen von Peers zu diesem Gerät und den von ihm gerouteten Netzwerken ablehnen. Ausgehender Verkehr ist nicht betroffen."
+    },
+    "settings.security.blockLan.label": {
+        "message": "LAN-Zugriff blockieren"
+    },
+    "settings.security.blockLan.help": {
+        "message": "Verhindert, dass Peers Ihr lokales Netzwerk oder dessen Geräte erreichen, wenn dieses Gerät deren Verkehr routet."
+    },
+    "settings.security.rosenpass.label": {
+        "message": "Quantenresistenz aktivieren"
+    },
+    "settings.security.rosenpass.help": {
+        "message": "Einen Post-Quanten-Schlüsselaustausch über Rosenpass zusätzlich zu WireGuard® hinzufügen."
+    },
+    "settings.security.rosenpassPermissive.label": {
+        "message": "Permissiven Modus aktivieren"
+    },
+    "settings.security.rosenpassPermissive.help": {
+        "message": "Verbindungen zu Peers ohne Quantenresistenz-Unterstützung erlauben."
+    },
+    "settings.ssh.section.server": {
+        "message": "Server"
+    },
+    "settings.ssh.section.capabilities": {
+        "message": "Funktionen"
+    },
+    "settings.ssh.section.authentication": {
+        "message": "Authentifizierung"
+    },
+    "settings.ssh.server.label": {
+        "message": "SSH-Server aktivieren"
+    },
+    "settings.ssh.server.help": {
+        "message": "Den NetBird SSH-Server auf diesem Host ausführen, damit andere Peers sich verbinden können."
+    },
+    "settings.ssh.root.label": {
+        "message": "Root-Login erlauben"
+    },
+    "settings.ssh.root.help": {
+        "message": "Peers dürfen sich als root anmelden. Deaktivieren, um ein nicht-privilegiertes Konto zu erfordern."
+    },
+    "settings.ssh.sftp.label": {
+        "message": "SFTP erlauben"
+    },
+    "settings.ssh.sftp.help": {
+        "message": "Dateien sicher über native SFTP- oder SCP-Clients übertragen."
+    },
+    "settings.ssh.localForward.label": {
+        "message": "Lokale Portweiterleitung"
+    },
+    "settings.ssh.localForward.help": {
+        "message": "Verbundene Peers können lokale Ports zu von diesem Host erreichbaren Diensten tunneln."
+    },
+    "settings.ssh.remoteForward.label": {
+        "message": "Remote-Portweiterleitung"
+    },
+    "settings.ssh.remoteForward.help": {
+        "message": "Verbundene Peers können Ports dieses Hosts an ihren eigenen Rechner weitergeben."
+    },
+    "settings.ssh.jwt.label": {
+        "message": "JWT-Authentifizierung aktivieren"
+    },
+    "settings.ssh.jwt.help": {
+        "message": "Jede SSH-Sitzung gegen Ihren IdP für Identität und Audit prüfen. Deaktivieren, um sich nur auf Netzwerk-ACL-Richtlinien zu verlassen — sinnvoll, wenn kein IdP verfügbar ist."
+    },
+    "settings.ssh.jwtTtl.label": {
+        "message": "JWT-Cache-TTL"
+    },
+    "settings.ssh.jwtTtl.help": {
+        "message": "Wie lange dieser Client ein JWT zwischenspeichert, bevor bei ausgehenden SSH-Verbindungen erneut nachgefragt wird. Auf 0 setzen, um den Cache zu deaktivieren und bei jeder Verbindung zu authentifizieren."
+    },
+    "settings.ssh.jwtTtl.suffix": {
+        "message": "Sekunde(n)"
+    },
+    "settings.advanced.section.interface": {
+        "message": "Schnittstelle"
+    },
+    "settings.advanced.section.security": {
+        "message": "Sicherheit"
+    },
+    "settings.advanced.interfaceName.label": {
+        "message": "Name"
+    },
+    "settings.advanced.interfaceName.error": {
+        "message": "Verwenden Sie 1–15 Buchstaben, Ziffern, Punkte, Bindestriche oder Unterstriche."
+    },
+    "settings.advanced.interfaceName.errorMac": {
+        "message": "Muss mit „utun“ und einer Zahl beginnen (z. B. utun100)."
+    },
+    "settings.advanced.port.label": {
+        "message": "Port"
+    },
+    "settings.advanced.port.error": {
+        "message": "Geben Sie einen Port zwischen {min} und {max} ein."
+    },
+    "settings.advanced.port.help": {
+        "message": "Wenn auf 0 gesetzt, wird ein zufälliger freier Port verwendet."
+    },
+    "settings.advanced.mtu.label": {
+        "message": "MTU"
+    },
+    "settings.advanced.mtu.error": {
+        "message": "Geben Sie einen MTU-Wert zwischen {min} und {max} ein."
+    },
+    "settings.advanced.psk.label": {
+        "message": "Pre-shared Key"
+    },
+    "settings.advanced.psk.help": {
+        "message": "Optionaler WireGuard-PSK für zusätzliche symmetrische Verschlüsselung. Nicht identisch mit einem NetBird Setup-Key. Sie kommunizieren nur mit Peers, die denselben Pre-shared Key verwenden."
+    },
+    "settings.troubleshooting.section.title": {
+        "message": "Debug-Paket"
+    },
+    "settings.troubleshooting.anonymize.label": {
+        "message": "Sensible Informationen anonymisieren"
+    },
+    "settings.troubleshooting.anonymize.help": {
+        "message": "Versteckt öffentliche IP-Adressen und nicht-NetBird-Domains in Logs."
+    },
+    "settings.troubleshooting.systemInfo.label": {
+        "message": "Systeminformationen einschließen"
+    },
+    "settings.troubleshooting.systemInfo.help": {
+        "message": "OS, Kernel, Netzwerkschnittstellen und Routing-Tabellen einschließen."
+    },
+    "settings.troubleshooting.upload.label": {
+        "message": "Paket an NetBird-Server hochladen"
+    },
+    "settings.troubleshooting.upload.help": {
+        "message": "Gibt einen Upload-Schlüssel zurück, den Sie mit dem NetBird-Support teilen können."
+    },
+    "settings.troubleshooting.trace.label": {
+        "message": "Trace-Logs aktivieren"
+    },
+    "settings.troubleshooting.trace.help": {
+        "message": "Hebt das Log-Level auf TRACE an und stellt es danach wieder her."
+    },
+    "settings.troubleshooting.capture.label": {
+        "message": "Aufzeichnungssitzung"
+    },
+    "settings.troubleshooting.capture.help": {
+        "message": "Stellt die Verbindung neu her und wartet, damit Sie das Problem reproduzieren können."
+    },
+    "settings.troubleshooting.packets.label": {
+        "message": "Netzwerkpakete aufzeichnen"
+    },
+    "settings.troubleshooting.packets.help": {
+        "message": "Speichert eine .pcap-Datei des Netzwerkverkehrs während der Aufzeichnung."
+    },
+    "settings.troubleshooting.duration.label": {
+        "message": "Aufzeichnungsdauer"
+    },
+    "settings.troubleshooting.duration.help": {
+        "message": "Wie lange die Aufzeichnungssitzung läuft."
+    },
+    "settings.troubleshooting.duration.suffix": {
+        "message": "Minute(n)"
+    },
+    "settings.troubleshooting.create": {
+        "message": "Debug-Paket erstellen"
+    },
+    "settings.troubleshooting.progress.description": {
+        "message": "Logs, Systemdetails und Verbindungszustand werden gesammelt. Dies dauert in der Regel einen Moment — lassen Sie dieses Fenster geöffnet, bis es abgeschlossen ist."
+    },
+    "settings.troubleshooting.cancelling": {
+        "message": "Wird abgebrochen…"
+    },
+    "settings.troubleshooting.done.uploadedTitle": {
+        "message": "Debug-Paket erfolgreich hochgeladen!"
+    },
+    "settings.troubleshooting.done.savedTitle": {
+        "message": "Paket gespeichert"
+    },
+    "settings.troubleshooting.done.uploadedDescription": {
+        "message": "Teilen Sie den unten angezeigten Upload-Schlüssel mit dem <docs>NetBird-Support</docs>. Eine lokale Kopie wurde ebenfalls auf Ihrem Gerät gespeichert."
+    },
+    "settings.troubleshooting.done.savedDescription": {
+        "message": "Ihr Debug-Paket wurde lokal gespeichert."
+    },
+    "settings.troubleshooting.done.copyKey": {
+        "message": "Schlüssel kopieren"
+    },
+    "settings.troubleshooting.done.openFolder": {
+        "message": "Ordner öffnen"
+    },
+    "settings.troubleshooting.done.openFileLocation": {
+        "message": "Speicherort öffnen"
+    },
+    "settings.troubleshooting.uploadFailedWithReason": {
+        "message": "Upload fehlgeschlagen: {reason} Das Paket wurde trotzdem lokal gespeichert."
+    },
+    "settings.troubleshooting.uploadFailed": {
+        "message": "Upload fehlgeschlagen. Das Paket wurde trotzdem lokal gespeichert."
+    },
+    "settings.troubleshooting.stage.reconnecting": {
+        "message": "NetBird wird neu verbunden…"
+    },
+    "settings.troubleshooting.stage.capturing": {
+        "message": "Debug-Logs werden erfasst"
+    },
+    "settings.troubleshooting.stage.bundling": {
+        "message": "Debug-Paket wird erstellt…"
+    },
+    "settings.troubleshooting.stage.uploading": {
+        "message": "Wird zu NetBird hochgeladen…"
+    },
+    "settings.troubleshooting.stage.cancelling": {
+        "message": "Wird abgebrochen…"
+    },
+    "settings.about.client": {
+        "message": "NetBird Client v{version}"
+    },
+    "settings.about.clientName": {
+        "message": "NetBird Client"
+    },
+    "settings.about.development": {
+        "message": "[Entwicklung]"
+    },
+    "settings.about.gui": {
+        "message": "GUI v{version}"
+    },
+    "settings.about.guiName": {
+        "message": "GUI"
+    },
+    "settings.about.copyright": {
+        "message": "© {year} NetBird. Alle Rechte vorbehalten."
+    },
+    "settings.about.links.imprint": {
+        "message": "Impressum"
+    },
+    "settings.about.links.privacy": {
+        "message": "Datenschutz"
+    },
+    "settings.about.links.cla": {
+        "message": "CLA"
+    },
+    "settings.about.links.terms": {
+        "message": "Nutzungsbedingungen"
+    },
+    "settings.about.community.github": {
+        "message": "GitHub"
+    },
+    "settings.about.community.slack": {
+        "message": "Slack"
+    },
+    "settings.about.community.forum": {
+        "message": "Forum"
+    },
+    "settings.about.community.documentation": {
+        "message": "Dokumentation"
+    },
+    "settings.about.community.feedback": {
+        "message": "Feedback"
+    },
+    "update.banner.message": {
+        "message": "NetBird {version} ist installationsbereit."
+    },
+    "update.banner.later": {
+        "message": "Später"
+    },
+    "update.banner.installNow": {
+        "message": "Jetzt installieren"
+    },
+    "update.card.versionAvailableDownload": {
+        "message": "Version {version} ist zum Herunterladen verfügbar."
+    },
+    "update.card.versionAvailableInstall": {
+        "message": "Version {version} ist zur Installation verfügbar."
+    },
+    "update.card.whatsNew": {
+        "message": "Was ist neu?"
+    },
+    "update.card.installNow": {
+        "message": "Jetzt installieren"
+    },
+    "update.card.getInstaller": {
+        "message": "Herunterladen"
+    },
+    "update.card.autoCheckInterval": {
+        "message": "NetBird sucht im Hintergrund nach Updates."
+    },
+    "update.card.changelog": {
+        "message": "Changelog"
+    },
+    "update.card.onLatestVersion": {
+        "message": "Sie verwenden die neueste Version"
+    },
+    "update.header.tooltip": {
+        "message": "Update verfügbar"
+    },
+    "update.overlay.updatingVersion": {
+        "message": "NetBird wird auf v{version} aktualisiert"
+    },
+    "update.overlay.updating": {
+        "message": "NetBird wird aktualisiert"
+    },
+    "update.overlay.description": {
+        "message": "Eine neuere Version ist verfügbar und wird installiert. NetBird startet nach Abschluss des Updates automatisch neu."
+    },
+    "update.overlay.error.timeoutTitle": {
+        "message": "Update dauert zu lange"
+    },
+    "update.overlay.error.timeoutDescription": {
+        "message": "Die Installation von {target} hat zu lange gedauert und wurde nicht abgeschlossen."
+    },
+    "update.overlay.error.canceledTitle": {
+        "message": "Update wurde abgebrochen"
+    },
+    "update.overlay.error.canceledDescription": {
+        "message": "Das Update auf {target} wurde vor dem Abschluss abgebrochen."
+    },
+    "update.overlay.error.failTitle": {
+        "message": "Update konnte nicht installiert werden"
+    },
+    "update.overlay.error.failDescription": {
+        "message": "{target} konnte nicht installiert werden."
+    },
+    "update.overlay.error.unknownMessage": {
+        "message": "unbekannter Fehler"
+    },
+    "update.overlay.error.targetVersion": {
+        "message": "v{version}"
+    },
+    "update.overlay.error.targetFallback": {
+        "message": "die neue Version"
+    },
+    "update.error.loadStateTitle": {
+        "message": "Laden des Update-Status fehlgeschlagen"
+    },
+    "update.error.triggerTitle": {
+        "message": "Update-Start fehlgeschlagen"
+    },
+    "update.page.versionLine": {
+        "message": "Client wird aktualisiert auf: {version}."
+    },
+    "update.page.versionLineGeneric": {
+        "message": "Client wird aktualisiert."
+    },
+    "update.page.outdated": {
+        "message": "Ihre Client-Version ist älter als die im Management eingestellte Auto-Update-Version."
+    },
+    "update.page.status.running": {
+        "message": "Wird aktualisiert"
+    },
+    "update.page.status.timeout": {
+        "message": "Zeitüberschreitung beim Update. Bitte erneut versuchen."
+    },
+    "update.page.status.canceled": {
+        "message": "Update abgebrochen."
+    },
+    "update.page.status.failed": {
+        "message": "Update fehlgeschlagen: {message}"
+    },
+    "update.page.status.unknownError": {
+        "message": "unbekannter Update-Fehler"
+    },
+    "update.page.failedTitle": {
+        "message": "Update fehlgeschlagen"
+    },
+    "update.page.timeoutMessage": {
+        "message": "Zeitüberschreitung beim Update."
+    },
+    "update.page.dontClose": {
+        "message": "Bitte schließen Sie dieses Fenster nicht."
+    },
+    "update.page.updating": {
+        "message": "Wird aktualisiert…"
+    },
+    "update.page.complete": {
+        "message": "Update abgeschlossen"
+    },
+    "update.page.failed": {
+        "message": "Update fehlgeschlagen"
+    },
+    "window.title.settings": {
+        "message": "Einstellungen"
+    },
+    "window.title.signIn": {
+        "message": "Anmeldung"
+    },
+    "window.title.sessionExpiration": {
+        "message": "Sitzung läuft ab"
+    },
+    "window.title.updating": {
+        "message": "Aktualisierung"
+    },
+    "window.title.welcome": {
+        "message": "Willkommen bei NetBird"
+    },
+    "window.title.error": {
+        "message": "Fehler"
+    },
+    "welcome.title": {
+        "message": "Suchen Sie NetBird in der Taskleiste"
+    },
+    "welcome.description": {
+        "message": "NetBird läuft in Ihrer Taskleiste. Klicken Sie auf das Symbol, um sich zu verbinden, Profile zu wechseln oder die Einstellungen zu öffnen."
+    },
+    "welcome.continue": {
+        "message": "Weiter"
+    },
+    "welcome.back": {
+        "message": "Zurück"
+    },
+    "welcome.management.title": {
+        "message": "NetBird einrichten"
+    },
+    "welcome.management.description": {
+        "message": "Klicken Sie auf „Weiter“, um loszulegen, oder wählen Sie „Self-hosted“, wenn Sie einen eigenen NetBird-Server haben."
+    },
+    "welcome.management.cloud.title": {
+        "message": "NetBird Cloud"
+    },
+    "welcome.management.cloud.description": {
+        "message": "Nutzen Sie unseren gehosteten Dienst. Keine Einrichtung nötig."
+    },
+    "welcome.management.selfHosted.title": {
+        "message": "Self-hosted"
+    },
+    "welcome.management.selfHosted.description": {
+        "message": "Verbindung zu Ihrem eigenen Management-Server."
+    },
+    "welcome.management.urlLabel": {
+        "message": "URL des Management-Servers"
+    },
+    "welcome.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlInvalid": {
+        "message": "Bitte geben Sie eine gültige URL ein, z. B. https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlUnreachable": {
+        "message": "Server nicht erreichbar. Überprüfen Sie die URL oder Ihr Netzwerk und fahren Sie fort, wenn Sie sicher sind, dass sie korrekt ist."
+    },
+    "welcome.management.checking": {
+        "message": "Wird geprüft …"
+    },
+    "browserLogin.title": {
+        "message": "Anmeldung im Browser abschließen"
+    },
+    "browserLogin.notSeeing": {
+        "message": "Sehen Sie den Browser-Tab nicht?"
+    },
+    "browserLogin.tryAgain": {
+        "message": "Erneut versuchen"
+    },
+    "browserLogin.openFailedTitle": {
+        "message": "Browser konnte nicht geöffnet werden"
+    },
+    "sessionExpiration.title": {
+        "message": "Sitzung läuft bald ab"
+    },
+    "sessionExpiration.titleLater": {
+        "message": "Ihre Sitzung läuft ab"
+    },
+    "sessionExpiration.description": {
+        "message": "Dieses Gerät wird bald getrennt. Browser-Anmeldung zum Erneuern erforderlich."
+    },
+    "sessionExpiration.descriptionLater": {
+        "message": "Eine Browser-Anmeldung hält dieses Gerät mit Ihrem Netzwerk verbunden."
+    },
+    "sessionExpiration.stay": {
+        "message": "Sitzung erneuern"
+    },
+    "sessionExpiration.authenticate": {
+        "message": "Anmelden"
+    },
+    "sessionExpiration.logout": {
+        "message": "Abmelden"
+    },
+    "sessionExpiration.expired": {
+        "message": "Sitzung abgelaufen"
+    },
+    "sessionExpiration.expiredDescription": {
+        "message": "Gerät getrennt. Mit Browser-Anmeldung authentifizieren, um erneut zu verbinden."
+    },
+    "sessionExpiration.close": {
+        "message": "Schließen"
+    },
+    "sessionExpiration.extendFailedTitle": {
+        "message": "Sitzungsverlängerung fehlgeschlagen"
+    },
+    "sessionExpiration.logoutFailedTitle": {
+        "message": "Abmeldung fehlgeschlagen"
+    },
+    "peers.search.placeholder": {
+        "message": "Nach Name oder IP suchen"
+    },
+    "peers.filter.all": {
+        "message": "Alle"
+    },
+    "peers.filter.online": {
+        "message": "Online"
+    },
+    "peers.filter.offline": {
+        "message": "Offline"
+    },
+    "peers.empty.title": {
+        "message": "Keine Peers verfügbar"
+    },
+    "peers.empty.description": {
+        "message": "Sie haben entweder keine Peers verfügbar oder keinen Zugriff auf einen davon."
+    },
+    "peers.details.domain": {
+        "message": "Domain"
+    },
+    "peers.details.netbirdIp": {
+        "message": "NetBird-IP"
+    },
+    "peers.details.netbirdIpv6": {
+        "message": "NetBird-IPv6"
+    },
+    "peers.details.publicKey": {
+        "message": "Öffentlicher Schlüssel"
+    },
+    "peers.details.connection": {
+        "message": "Verbindung"
+    },
+    "peers.details.latency": {
+        "message": "Latenz"
+    },
+    "peers.details.lastHandshake": {
+        "message": "Letzter Handshake"
+    },
+    "peers.details.statusSince": {
+        "message": "Letzte Verbindungsaktualisierung"
+    },
+    "peers.details.bytes": {
+        "message": "Bytes"
+    },
+    "peers.details.bytesSent": {
+        "message": "Gesendet"
+    },
+    "peers.details.bytesReceived": {
+        "message": "Empfangen"
+    },
+    "peers.details.localIce": {
+        "message": "Lokales ICE"
+    },
+    "peers.details.remoteIce": {
+        "message": "Remote ICE"
+    },
+    "peers.details.never": {
+        "message": "Nie"
+    },
+    "peers.details.justNow": {
+        "message": "Gerade eben"
+    },
+    "peers.details.refresh": {
+        "message": "Aktualisieren"
+    },
+    "peers.status.connected": {
+        "message": "Verbunden"
+    },
+    "peers.status.connecting": {
+        "message": "Wird verbunden"
+    },
+    "peers.status.disconnected": {
+        "message": "Nicht verbunden"
+    },
+    "peers.details.relayAddress": {
+        "message": "Relay"
+    },
+    "peers.details.networks": {
+        "message": "Ressourcen"
+    },
+    "peers.details.relayed": {
+        "message": "Relayed"
+    },
+    "peers.details.p2p": {
+        "message": "P2P"
+    },
+    "peers.details.rosenpass": {
+        "message": "Rosenpass aktiviert"
+    },
+    "networks.search.placeholder": {
+        "message": "Nach Netzwerk oder Domain suchen"
+    },
+    "networks.filter.all": {
+        "message": "Alle"
+    },
+    "networks.filter.active": {
+        "message": "Aktiv"
+    },
+    "networks.filter.overlapping": {
+        "message": "Überlappend"
+    },
+    "networks.empty.title": {
+        "message": "Keine Ressourcen verfügbar"
+    },
+    "networks.empty.description": {
+        "message": "Sie haben entweder keine Netzwerkressourcen verfügbar oder keinen Zugriff auf eine davon."
+    },
+    "networks.selected": {
+        "message": "Ausgewählt"
+    },
+    "networks.unselected": {
+        "message": "Nicht ausgewählt"
+    },
+    "networks.ips.heading": {
+        "message": "Aufgelöste IPs"
+    },
+    "networks.bulk.selectionCount": {
+        "message": "{selected} von {total} aktiv"
+    },
+    "networks.bulk.enableAll": {
+        "message": "Alle aktivieren"
+    },
+    "networks.bulk.disableAll": {
+        "message": "Alle deaktivieren"
+    },
+    "exitNodes.search.placeholder": {
+        "message": "Exit Nodes suchen"
+    },
+    "exitNodes.none": {
+        "message": "Keiner"
+    },
+    "exitNodes.empty.title": {
+        "message": "Keine Exit Nodes verfügbar"
+    },
+    "exitNodes.empty.description": {
+        "message": "Für diesen Peer wurden keine Exit Nodes freigegeben."
+    },
+    "exitNodes.card.title": {
+        "message": "Exit Node"
+    },
+    "exitNodes.card.statusActive": {
+        "message": "Aktiv"
+    },
+    "exitNodes.card.statusInactive": {
+        "message": "Inaktiv"
+    },
+    "exitNodes.dropdown.noneTitle": {
+        "message": "Keiner"
+    },
+    "exitNodes.dropdown.noneDescription": {
+        "message": "Direkte Verbindung ohne Exit Node"
+    },
+    "quickActions.connect": {
+        "message": "Verbinden"
+    },
+    "quickActions.disconnect": {
+        "message": "Trennen"
+    },
+    "daemon.unavailable.title": {
+        "message": "NetBird-Dienst läuft nicht"
+    },
+    "daemon.unavailable.description": {
+        "message": "Die App stellt automatisch die Verbindung wieder her, sobald der Dienst läuft."
+    },
+    "daemon.unavailable.docsLink": {
+        "message": "Dokumentation"
+    },
+    "daemon.outdated.title": {
+        "message": "NetBird-Dienst ist veraltet"
+    },
+    "daemon.outdated.description": {
+        "message": "Aktualisieren Sie den NetBird-Dienst, um diese App zu verwenden."
+    },
+    "error.jwt_clock_skew": {
+        "message": "Anmeldung fehlgeschlagen: Die Uhr dieses Geräts ist nicht mit dem Server synchron. Bitte synchronisieren Sie die Systemuhr und versuchen Sie es erneut."
+    },
+    "error.jwt_expired": {
+        "message": "Ihr Anmeldetoken ist abgelaufen. Bitte melden Sie sich erneut an."
+    },
+    "error.jwt_signature_invalid": {
+        "message": "Anmeldung fehlgeschlagen: Die Token-Signatur ist ungültig. Bitte wenden Sie sich an Ihren Administrator."
+    },
+    "error.session_expired": {
+        "message": "Ihre Sitzung ist abgelaufen. Bitte melden Sie sich erneut an."
+    },
+    "error.invalid_setup_key": {
+        "message": "Der Setup-Key fehlt oder ist ungültig."
+    },
+    "error.permission_denied": {
+        "message": "Die Anmeldung wurde vom Server abgelehnt."
+    },
+    "error.daemon_unreachable": {
+        "message": "Der NetBird-Dienst antwortet nicht. Bitte prüfen Sie, ob der Dienst läuft."
+    },
+    "error.unknown": {
+        "message": "Vorgang fehlgeschlagen."
+    }
+}
diff --git a/client/ui/i18n/locales/en/common.json b/client/ui/i18n/locales/en/common.json
new file mode 100644
index 000000000..42d40ec30
--- /dev/null
+++ b/client/ui/i18n/locales/en/common.json
@@ -0,0 +1,1766 @@
+{
+    "tray.tooltip": {
+        "message": "NetBird",
+        "description": "Hover tooltip on the system-tray / menu-bar icon. Brand name — do not translate."
+    },
+    "tray.status.disconnected": {
+        "message": "Disconnected",
+        "description": "Connection status surfaced through the tray icon: the client is not connected to the network."
+    },
+    "tray.status.daemonUnavailable": {
+        "message": "Not running",
+        "description": "Tray status: the background NetBird service (daemon) is not running."
+    },
+    "tray.status.error": {
+        "message": "Error",
+        "description": "Tray status: the client is in an error state."
+    },
+    "tray.status.connected": {
+        "message": "Connected",
+        "description": "Tray status: connected to the NetBird network."
+    },
+    "tray.status.connecting": {
+        "message": "Connecting",
+        "description": "Tray status: a connection is being established."
+    },
+    "tray.status.needsLogin": {
+        "message": "Login required",
+        "description": "Tray status: the user must sign in before connecting."
+    },
+    "tray.status.loginFailed": {
+        "message": "Login failed",
+        "description": "Tray status: the last sign-in attempt failed."
+    },
+    "tray.status.sessionExpired": {
+        "message": "Session expired",
+        "description": "Tray status: the authenticated session expired; the user must sign in again."
+    },
+    "tray.session.expiresIn": {
+        "message": "Session expires in {remaining}",
+        "description": "Tray row showing time left before the session expires. {remaining} is a human-readable duration such as '5 minutes', built from the tray.session.unit.* strings. Keep {remaining} unchanged."
+    },
+    "tray.session.unit.lessThanMinute": {
+        "message": "less than a minute",
+        "description": "Duration fragment substituted into {remaining} (see tray.session.expiresIn). Used when under one minute remains."
+    },
+    "tray.session.unit.minute": {
+        "message": "1 minute",
+        "description": "Duration fragment for exactly one minute, substituted into {remaining}."
+    },
+    "tray.session.unit.minutes": {
+        "message": "{count} minutes",
+        "description": "Duration fragment for several minutes, substituted into {remaining}. {count} is the number of minutes; keep {count}."
+    },
+    "tray.session.unit.hour": {
+        "message": "1 hour",
+        "description": "Duration fragment for exactly one hour, substituted into {remaining}."
+    },
+    "tray.session.unit.hours": {
+        "message": "{count} hours",
+        "description": "Duration fragment for several hours. {count} is the number of hours; keep {count}."
+    },
+    "tray.session.unit.day": {
+        "message": "1 day",
+        "description": "Duration fragment for exactly one day, substituted into {remaining}."
+    },
+    "tray.session.unit.days": {
+        "message": "{count} days",
+        "description": "Duration fragment for several days. {count} is the number of days; keep {count}."
+    },
+    "tray.menu.open": {
+        "message": "Open NetBird",
+        "description": "Tray menu item that opens the main NetBird window. Keep short."
+    },
+    "tray.menu.connect": {
+        "message": "Connect",
+        "description": "Tray menu item that connects to the network. Keep short."
+    },
+    "tray.menu.disconnect": {
+        "message": "Disconnect",
+        "description": "Tray menu item that disconnects from the network. Keep short."
+    },
+    "tray.menu.exitNode": {
+        "message": "Exit Node",
+        "description": "Tray submenu title for choosing an exit node (route all traffic through another peer)."
+    },
+    "tray.menu.networks": {
+        "message": "Resources",
+        "description": "Tray submenu title listing network resources the user can reach. Labelled 'Resources' in the UI even though the key says networks."
+    },
+    "tray.menu.profiles": {
+        "message": "Profiles",
+        "description": "Tray submenu title listing connection profiles."
+    },
+    "tray.menu.manageProfiles": {
+        "message": "Manage Profiles",
+        "description": "Tray menu item that opens Settings → Profiles."
+    },
+    "tray.menu.settings": {
+        "message": "Settings...",
+        "description": "Tray menu item that opens the Settings window. The trailing '...' signals that a window opens; keep it."
+    },
+    "tray.menu.debugBundle": {
+        "message": "Create Debug Bundle",
+        "description": "Tray menu item that generates a diagnostic log bundle for support."
+    },
+    "tray.menu.about": {
+        "message": "Help & Support",
+        "description": "Tray submenu title for help and support links."
+    },
+    "tray.menu.github": {
+        "message": "GitHub",
+        "description": "Tray menu link to the GitHub repository. Brand name — do not translate."
+    },
+    "tray.menu.documentation": {
+        "message": "Documentation",
+        "description": "Tray menu link to the online documentation."
+    },
+    "tray.menu.troubleshoot": {
+        "message": "Troubleshoot",
+        "description": "Tray menu link to troubleshooting help."
+    },
+    "tray.menu.downloadLatest": {
+        "message": "Download latest version",
+        "description": "Tray menu item to download the latest available version."
+    },
+    "tray.menu.installVersion": {
+        "message": "Install version {version}",
+        "description": "Tray menu item to install a specific update. {version} is a version number like 0.30.1; keep {version}."
+    },
+    "tray.menu.guiVersion": {
+        "message": "GUI: {version}",
+        "description": "Tray menu row showing the installed UI version. 'GUI' = the graphical app. {version} is a version number; keep it."
+    },
+    "tray.menu.daemonVersion": {
+        "message": "Daemon: {version}",
+        "description": "Tray menu row showing the background-service version. 'Daemon' = the background NetBird service. {version} is a version number; keep it."
+    },
+    "tray.menu.versionUnknown": {
+        "message": "—",
+        "description": "Placeholder shown in version rows when the version can't be determined. It is an em dash — leave as-is."
+    },
+    "tray.menu.quit": {
+        "message": "Quit NetBird",
+        "description": "Tray menu item that fully exits the app and removes the tray icon. Keep short."
+    },
+    "notify.daemonOutdated.title": {
+        "message": "NetBird service is outdated",
+        "description": "Title of the OS desktop notification shown when the running daemon is too old for this UI."
+    },
+    "notify.daemonOutdated.body": {
+        "message": "Update the NetBird service to use this app.",
+        "description": "Body of the desktop notification telling the user to upgrade the daemon."
+    },
+    "notify.update.title": {
+        "message": "NetBird update available",
+        "description": "Title of the OS desktop notification shown when an app update is available."
+    },
+    "notify.update.body": {
+        "message": "NetBird {version} is available.",
+        "description": "Body of the update-available desktop notification. {version} is the new version number; keep it."
+    },
+    "notify.update.enforcedSuffix": {
+        "message": " Your administrator requires this update.",
+        "description": "Sentence appended to the update notification body when the admin has made the update mandatory. Note the leading space — keep it."
+    },
+    "notify.error.title": {
+        "message": "Error",
+        "description": "Title of a generic error desktop notification."
+    },
+    "notify.error.connect": {
+        "message": "Failed to connect",
+        "description": "Error notification body shown when connecting failed."
+    },
+    "notify.error.disconnect": {
+        "message": "Failed to disconnect",
+        "description": "Error notification body shown when disconnecting failed."
+    },
+    "notify.error.switchProfile": {
+        "message": "Failed to switch to {profile}",
+        "description": "Error notification shown when switching profiles failed. {profile} is the target profile name; keep it."
+    },
+    "notify.error.exitNode": {
+        "message": "Failed to update exit node {name}",
+        "description": "Error notification shown when updating the exit node failed. {name} is the exit node name; keep it."
+    },
+    "notify.sessionExpired.title": {
+        "message": "NetBird session expired",
+        "description": "Title of the desktop notification shown when the session has expired."
+    },
+    "notify.sessionExpired.body": {
+        "message": "Your NetBird session has expired. Please log in again.",
+        "description": "Body of the session-expired desktop notification."
+    },
+    "notify.sessionWarning.title": {
+        "message": "Session expires soon",
+        "description": "Title of the desktop notification warning that the session will expire soon."
+    },
+    "notify.sessionWarning.body": {
+        "message": "Your NetBird session expires in {remaining}. Click Extend now to renew.",
+        "description": "Body of the session-expiry warning notification. {remaining} is a human-readable duration (see tray.session.unit.*); keep it. 'Extend now' refers to the action button notify.sessionWarning.extend."
+    },
+    "notify.sessionWarning.bodyGeneric": {
+        "message": "Your NetBird session is about to expire. Click Extend now to renew.",
+        "description": "Generic session-expiry warning body used when the exact remaining time isn't known."
+    },
+    "notify.sessionWarning.extend": {
+        "message": "Extend now",
+        "description": "Action button on the session-expiry notification that renews the session. Keep short."
+    },
+    "notify.sessionWarning.dismiss": {
+        "message": "Dismiss",
+        "description": "Action button on the session-expiry notification that dismisses it. Keep short."
+    },
+    "notify.sessionWarning.failed": {
+        "message": "Failed to extend NetBird session",
+        "description": "Notification shown when renewing the session failed."
+    },
+    "notify.sessionWarning.successTitle": {
+        "message": "NetBird session extended",
+        "description": "Title of the notification confirming the session was renewed."
+    },
+    "notify.sessionWarning.successBody": {
+        "message": "Your session has been refreshed.",
+        "description": "Body of the notification confirming the session was renewed."
+    },
+    "notify.sessionDeadlineRejected.title": {
+        "message": "Session deadline rejected",
+        "description": "Title of the notification shown when the server sent an invalid session deadline."
+    },
+    "notify.sessionDeadlineRejected.body": {
+        "message": "The server sent an invalid session deadline. Please sign in again.",
+        "description": "Body explaining the server sent an invalid session deadline and the user must sign in again."
+    },
+    "notify.mdm.policyApplied.title": {
+        "message": "NetBird settings updated",
+        "description": "Title of the desktop notification shown when an MDM (IT-managed) policy changed the daemon configuration at runtime."
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "Your NetBird configuration was updated by your IT policy.",
+        "description": "Body of the MDM policy-applied notification, telling the user their settings were changed by their organization's device-management policy."
+    },
+    "common.cancel": {
+        "message": "Cancel",
+        "description": "Generic Cancel button label, reused across dialogs. Keep short."
+    },
+    "common.save": {
+        "message": "Save",
+        "description": "Generic Save button label. Keep short."
+    },
+    "common.saveChanges": {
+        "message": "Save Changes",
+        "description": "Button label to save edited settings. Keep short."
+    },
+    "common.saving": {
+        "message": "Saving…",
+        "description": "Button label / status shown while a save is in progress. Ends with an ellipsis."
+    },
+    "common.close": {
+        "message": "Close",
+        "description": "Generic Close button label. Keep short."
+    },
+    "common.copy": {
+        "message": "Copy",
+        "description": "Generic Copy button label (copy to clipboard). Keep short."
+    },
+    "common.togglePasswordVisibility": {
+        "message": "Toggle password visibility",
+        "description": "Accessibility label for the show/hide button inside a password field."
+    },
+    "common.increase": {
+        "message": "Increase",
+        "description": "Accessibility label for the increment (+) button on a numeric stepper input."
+    },
+    "common.decrease": {
+        "message": "Decrease",
+        "description": "Accessibility label for the decrement (−) button on a numeric stepper input."
+    },
+    "common.delete": {
+        "message": "Delete",
+        "description": "Generic Delete button label. Keep short."
+    },
+    "common.create": {
+        "message": "Create",
+        "description": "Generic Create button label. Keep short."
+    },
+    "common.add": {
+        "message": "Add",
+        "description": "Generic Add button label. Keep short."
+    },
+    "common.remove": {
+        "message": "Remove",
+        "description": "Generic Remove button label. Keep short."
+    },
+    "common.refresh": {
+        "message": "Refresh",
+        "description": "Generic Refresh button label. Keep short."
+    },
+    "common.loading": {
+        "message": "Loading…",
+        "description": "Generic loading indicator text. Ends with an ellipsis."
+    },
+    "common.netbird": {
+        "message": "NetBird",
+        "description": "The product name. Brand — do not translate."
+    },
+    "common.noResults.title": {
+        "message": "Could not find any results",
+        "description": "Title of the empty state shown when a search or filter returns nothing."
+    },
+    "common.noResults.description": {
+        "message": "We couldn't find any results. Please try a different search term or change your filters.",
+        "description": "Body of the no-results empty state, suggesting a different search term or filters."
+    },
+    "notConnected.title": {
+        "message": "Disconnected",
+        "description": "Title of the placeholder shown on data screens while disconnected."
+    },
+    "notConnected.description": {
+        "message": "Connect to NetBird first to view detailed information about your peers, network resources, and exit nodes.",
+        "description": "Body explaining the user must connect to NetBird first to see peer, resource, and exit-node details."
+    },
+    "connect.status.disconnected": {
+        "message": "Disconnected",
+        "description": "Label on the main-window connection toggle: not connected."
+    },
+    "connect.status.connecting": {
+        "message": "Connecting...",
+        "description": "Connection toggle label while connecting. Ends with an ellipsis."
+    },
+    "connect.status.connected": {
+        "message": "Connected",
+        "description": "Connection toggle label when connected."
+    },
+    "connect.status.disconnecting": {
+        "message": "Disconnecting...",
+        "description": "Connection toggle label while disconnecting. Ends with an ellipsis."
+    },
+    "connect.status.daemonUnavailable": {
+        "message": "Daemon unavailable",
+        "description": "Connection toggle label when the background service is unavailable. 'Daemon' = background service."
+    },
+    "connect.status.loginRequired": {
+        "message": "Login required",
+        "description": "Connection toggle label when sign-in is required before connecting."
+    },
+    "connect.error.loginTitle": {
+        "message": "Login Failed",
+        "description": "Error-dialog title shown when sign-in fails. The action-named '… Failed' style is intentional — keep it."
+    },
+    "connect.error.connectTitle": {
+        "message": "Connect Failed",
+        "description": "Error-dialog title shown when connecting fails."
+    },
+    "connect.error.disconnectTitle": {
+        "message": "Disconnect Failed",
+        "description": "Error-dialog title shown when disconnecting fails."
+    },
+    "nav.peers.title": {
+        "message": "Peers",
+        "description": "Navigation label for the Peers section (other devices in the network)."
+    },
+    "nav.peers.description": {
+        "message": "{connected} of {total} connected",
+        "description": "Sub-label under Peers showing how many are connected. {connected} and {total} are numbers; keep both."
+    },
+    "nav.resources.title": {
+        "message": "Resources",
+        "description": "Navigation label for the Resources section (routed networks)."
+    },
+    "nav.resources.description": {
+        "message": "{active} of {total} active",
+        "description": "Sub-label under Resources showing how many are active. {active} and {total} are numbers; keep both."
+    },
+    "nav.exitNode.title": {
+        "message": "Exit Nodes",
+        "description": "Navigation label for the Exit Nodes section."
+    },
+    "nav.exitNode.none": {
+        "message": "Not active",
+        "description": "Sub-label under Exit Nodes when no exit node is in use."
+    },
+    "nav.exitNode.using": {
+        "message": "Via {name}",
+        "description": "Sub-label under Exit Nodes when one is active. {name} is the exit node's name; keep it."
+    },
+    "header.openSettings": {
+        "message": "Open settings",
+        "description": "Accessibility label / tooltip for the gear icon that opens Settings."
+    },
+    "header.togglePanel": {
+        "message": "Toggle side panel",
+        "description": "Accessibility label / tooltip for the button that shows or hides the side panel."
+    },
+    "profile.selector.loading": {
+        "message": "Loading...",
+        "description": "Shown in the profile picker while profiles load. Ends with an ellipsis."
+    },
+    "profile.selector.noProfile": {
+        "message": "No profile",
+        "description": "Shown in the profile picker when no profile is selected."
+    },
+    "profile.selector.searchPlaceholder": {
+        "message": "Search profile by name...",
+        "description": "Placeholder text in the profile picker's search field."
+    },
+    "profile.selector.emptyTitle": {
+        "message": "No Profiles Found",
+        "description": "Title shown in the profile picker when a search matches no profiles."
+    },
+    "profile.selector.emptyDescription": {
+        "message": "Try a different search term or create a new profile.",
+        "description": "Body shown when no profiles match the search, suggesting a different term or creating one."
+    },
+    "profile.selector.newProfile": {
+        "message": "New Profile",
+        "description": "Button in the profile picker to create a new profile. Keep short."
+    },
+    "profile.selector.moreOptions": {
+        "message": "More options",
+        "description": "Accessibility label for the per-profile kebab (⋯) menu."
+    },
+    "profile.selector.deregister": {
+        "message": "Deregister",
+        "description": "Per-profile menu action: deregister (sign out of the profile but keep it)."
+    },
+    "profile.selector.delete": {
+        "message": "Delete",
+        "description": "Per-profile menu action: delete the profile."
+    },
+    "profile.selector.switchTo": {
+        "message": "Switch to this profile",
+        "description": "Tooltip / label for the action that switches to a profile."
+    },
+    "profile.selector.edit": {
+        "message": "Edit",
+        "description": "Per-profile menu action: open the edit dialog to rename or change the management server."
+    },
+    "profile.edit.title": {
+        "message": "Edit Profile",
+        "description": "Title of the dialog for editing an existing profile."
+    },
+    "profile.edit.submit": {
+        "message": "Save Changes",
+        "description": "Submit button on the edit-profile dialog. Keep short."
+    },
+    "profile.dialog.title": {
+        "message": "Enter Profile Name",
+        "description": "Title of the dialog for naming a new profile."
+    },
+    "profile.dialog.nameLabel": {
+        "message": "Profile Name",
+        "description": "Field label for the profile name."
+    },
+    "profile.dialog.description": {
+        "message": "Set an easily identifiable name for your profile.",
+        "description": "Helper text under the profile-name field."
+    },
+    "profile.dialog.placeholder": {
+        "message": "e.g. Work",
+        "description": "Example placeholder shown in the profile-name field. 'Work' is a sample value; translate it to a natural example."
+    },
+    "profile.dialog.submit": {
+        "message": "Add Profile",
+        "description": "Submit button on the add-profile dialog. Keep short."
+    },
+    "profile.dialog.required": {
+        "message": "Please enter a profile name, e.g. work, home",
+        "description": "Validation message shown when the profile name is empty. The examples (work, home) may be localized."
+    },
+    "profile.dialog.managementHelp": {
+        "message": "Use NetBird Cloud or your own server.",
+        "description": "Helper text noting the profile can use NetBird Cloud or a self-hosted server."
+    },
+    "profile.dialog.urlUnreachable": {
+        "message": "Couldn't reach this server. Check the URL, or add the profile anyway if you're sure it's correct.",
+        "description": "Soft warning when the entered server URL couldn't be reached; the user may add the profile anyway."
+    },
+    "header.menu.settings": {
+        "message": "Settings...",
+        "description": "'More' menu item in the header that opens Settings. The trailing '...' signals a window opens."
+    },
+    "header.menu.defaultView": {
+        "message": "Default View",
+        "description": "'More' menu item that switches the main window to the compact default view."
+    },
+    "header.menu.advancedView": {
+        "message": "Advanced View",
+        "description": "'More' menu item that switches the main window to the wider advanced view."
+    },
+    "header.menu.updateAvailable": {
+        "message": "Update Available",
+        "description": "'More' menu item / badge shown when an update is available."
+    },
+    "header.menu.open": {
+        "message": "Open menu",
+        "description": "Accessibility label for the header's more (⋮) button that opens the menu."
+    },
+    "header.profile.switch": {
+        "message": "Switch profile",
+        "description": "Accessibility label for the header's profile selector button."
+    },
+    "connect.toggle.label": {
+        "message": "Toggle NetBird connection",
+        "description": "Accessibility label for the large connect/disconnect toggle on the main page."
+    },
+    "connect.localIp.label": {
+        "message": "Local IP addresses",
+        "description": "Accessibility label for the local IP selector that toggles between IPv4 and IPv6 on the main page."
+    },
+    "common.search": {
+        "message": "Search",
+        "description": "Accessibility label for a generic search input."
+    },
+    "common.filter": {
+        "message": "Filter",
+        "description": "Accessibility label for a generic filter control."
+    },
+    "exitNodes.dropdown.trigger": {
+        "message": "Select exit node",
+        "description": "Accessibility label for the exit-node picker button at the bottom of the main page."
+    },
+    "peers.row.label": {
+        "message": "Open details for {name}, {status}",
+        "description": "Accessibility label for a peer row in the list. {name} is the peer name and {status} is the connection status; keep both placeholders."
+    },
+    "peers.dialog.title": {
+        "message": "Peer details",
+        "description": "Accessibility title (announced to screen readers) for the peer details dialog/panel."
+    },
+    "networks.row.toggle": {
+        "message": "Toggle {name}",
+        "description": "Accessibility label for the row-wide toggle on a network/resource. {name} is the resource id; keep the placeholder."
+    },
+    "networks.bulk.label": {
+        "message": "Toggle all visible resources",
+        "description": "Accessibility label for the bulk enable/disable button at the bottom of the resources list."
+    },
+    "profile.switch.title": {
+        "message": "Switch Profile to \"{name}\"?",
+        "description": "Confirmation-dialog title for switching profiles. {name} is the target profile name, shown in quotes; keep {name} and the surrounding quotes."
+    },
+    "profile.switch.message": {
+        "message": "Are you sure you want to switch profiles?\nYour current profile will be disconnected.",
+        "description": "Confirmation body for switching profiles. Contains a line break (\\n) — keep it."
+    },
+    "profile.switch.confirm": {
+        "message": "Confirm",
+        "description": "Confirm button on the switch-profile dialog. Keep short."
+    },
+    "profile.deregister.title": {
+        "message": "Deregister Profile \"{name}\"?",
+        "description": "Confirmation-dialog title for deregistering a profile. {name} is the profile name; keep it and the quotes."
+    },
+    "profile.deregister.message": {
+        "message": "Are you sure you want to deregister this profile?\nYou will need to log in again to use it.",
+        "description": "Confirmation body for deregistering; warns the user must sign in again. Contains a line break (\\n) — keep it."
+    },
+    "profile.deregister.confirm": {
+        "message": "Deregister",
+        "description": "Confirm button on the deregister dialog. Keep short."
+    },
+    "profile.delete.title": {
+        "message": "Delete Profile \"{name}\"?",
+        "description": "Confirmation-dialog title for deleting a profile. {name} is the profile name; keep it and the quotes."
+    },
+    "profile.delete.message": {
+        "message": "Are you sure you want to delete this profile?\nThis action cannot be undone.",
+        "description": "Confirmation body for deleting; warns the action can't be undone. Contains a line break (\\n) — keep it."
+    },
+    "profile.delete.disabledActive": {
+        "message": "Active profiles cannot be deleted. Switch to a different one before deleting this profile.",
+        "description": "Tooltip explaining the active profile can't be deleted until the user switches away."
+    },
+    "profile.delete.disabledDefault": {
+        "message": "The default profile cannot be deleted.",
+        "description": "Tooltip explaining the default profile can't be deleted."
+    },
+    "profile.error.switchTitle": {
+        "message": "Switch Profile Failed",
+        "description": "Error-dialog title when switching profiles fails."
+    },
+    "profile.error.deregisterTitle": {
+        "message": "Deregister Profile Failed",
+        "description": "Error-dialog title when deregistering a profile fails."
+    },
+    "profile.error.deleteTitle": {
+        "message": "Delete Profile Failed",
+        "description": "Error-dialog title when deleting a profile fails."
+    },
+    "profile.error.createTitle": {
+        "message": "Create Profile Failed",
+        "description": "Error-dialog title when creating a profile fails."
+    },
+    "profile.error.editTitle": {
+        "message": "Edit Profile Failed",
+        "description": "Error-dialog title when editing a profile (rename or management URL change) fails."
+    },
+    "profile.error.loadTitle": {
+        "message": "Load Profiles Failed",
+        "description": "Error-dialog title when loading profiles fails."
+    },
+    "profile.dropdown.activeProfile": {
+        "message": "Active profile",
+        "description": "Section heading in the header profile dropdown for the current profile."
+    },
+    "profile.dropdown.switchProfile": {
+        "message": "Switch Profile",
+        "description": "Section heading / action in the profile dropdown to switch profiles."
+    },
+    "profile.dropdown.noEmail": {
+        "message": "Other",
+        "description": "Label shown for a profile that has no associated email address."
+    },
+    "profile.dropdown.addProfile": {
+        "message": "Add Profile",
+        "description": "Profile dropdown action to add a profile."
+    },
+    "profile.dropdown.manageProfiles": {
+        "message": "Manage Profiles",
+        "description": "Profile dropdown action that opens Settings → Profiles."
+    },
+    "profile.dropdown.settings": {
+        "message": "Settings",
+        "description": "Profile dropdown action that opens Settings."
+    },
+    "settings.profiles.section.profiles": {
+        "message": "Profiles",
+        "description": "Section heading on the Profiles settings tab."
+    },
+    "settings.profiles.intro": {
+        "message": "Keep separate NetBird identities side by side, for example work and personal accounts, or different management servers. Add, deregister, or delete profiles below.",
+        "description": "Intro paragraph on the Profiles settings tab explaining what profiles are for."
+    },
+    "settings.profiles.addProfile": {
+        "message": "Add Profile",
+        "description": "Button on the Profiles settings tab to add a profile."
+    },
+    "settings.profiles.active": {
+        "message": "Active",
+        "description": "Badge marking the currently active profile in the profiles table."
+    },
+    "settings.profiles.emptyTitle": {
+        "message": "No Profiles",
+        "description": "Title of the empty state when there are no profiles."
+    },
+    "settings.profiles.emptyDescription": {
+        "message": "Create a profile to connect to a NetBird management server.",
+        "description": "Body of the no-profiles empty state."
+    },
+    "settings.error.loadTitle": {
+        "message": "Load Settings Failed",
+        "description": "Error-dialog title when loading settings fails."
+    },
+    "settings.error.saveTitle": {
+        "message": "Save Settings Failed",
+        "description": "Error-dialog title when saving settings fails."
+    },
+    "settings.error.debugBundleTitle": {
+        "message": "Debug Bundle Failed",
+        "description": "Error-dialog title when creating the debug bundle fails."
+    },
+    "settings.nav.label": {
+        "message": "Settings sections",
+        "description": "Accessibility label for the Settings page's side navigation (list of section tabs)."
+    },
+    "settings.tabs.general": {
+        "message": "General",
+        "description": "Settings tab label: General. Keep short."
+    },
+    "settings.tabs.network": {
+        "message": "Network",
+        "description": "Settings tab label: Network. Keep short."
+    },
+    "settings.tabs.security": {
+        "message": "Security",
+        "description": "Settings tab label: Security. Keep short."
+    },
+    "settings.tabs.profiles": {
+        "message": "Profiles",
+        "description": "Settings tab label: Profiles. Keep short."
+    },
+    "settings.tabs.ssh": {
+        "message": "SSH",
+        "description": "Settings tab label: SSH. Acronym — keep as-is."
+    },
+    "settings.tabs.advanced": {
+        "message": "Advanced",
+        "description": "Settings tab label: Advanced. Keep short."
+    },
+    "settings.tabs.troubleshooting": {
+        "message": "Troubleshoot",
+        "description": "Settings tab label: Troubleshoot. Keep short."
+    },
+    "settings.tabs.about": {
+        "message": "About",
+        "description": "Settings tab label: About. Keep short."
+    },
+    "settings.tabs.updateAvailable": {
+        "message": "Update Available",
+        "description": "Settings tab label / badge shown when an update is available."
+    },
+    "settings.general.section.general": {
+        "message": "General",
+        "description": "Section heading on the General settings tab."
+    },
+    "settings.general.section.connection": {
+        "message": "Connection",
+        "description": "Section heading for connection-related options on the General tab."
+    },
+    "settings.general.connectOnStartup.label": {
+        "message": "Connect on Startup",
+        "description": "Toggle label: connect automatically when the service starts."
+    },
+    "settings.general.connectOnStartup.help": {
+        "message": "Automatically establish a connection when the service starts.",
+        "description": "Helper text for the connect-on-startup toggle."
+    },
+    "settings.general.notifications.label": {
+        "message": "Desktop Notifications",
+        "description": "Toggle label: enable desktop notifications."
+    },
+    "settings.general.notifications.help": {
+        "message": "Show desktop notifications for new updates and connection events.",
+        "description": "Helper text for the desktop-notifications toggle."
+    },
+    "settings.general.autostart.label": {
+        "message": "Launch NetBird UI at Login",
+        "description": "Toggle label: launch the NetBird UI at login."
+    },
+    "settings.general.autostart.help": {
+        "message": "Start the NetBird interface automatically when you log in. This affects the graphical interface only, not the background service.",
+        "description": "Helper text clarifying autostart affects only the UI, not the background service."
+    },
+    "settings.general.autostart.errorTitle": {
+        "message": "Autostart Change Failed",
+        "description": "Error-dialog title when changing the autostart setting fails."
+    },
+    "settings.general.language.label": {
+        "message": "Display Language",
+        "description": "Label for the display-language picker."
+    },
+    "settings.general.language.help": {
+        "message": "Choose the language for the NetBird interface.",
+        "description": "Helper text for the language picker."
+    },
+    "settings.general.language.search": {
+        "message": "Search language…",
+        "description": "Placeholder in the language picker's search field."
+    },
+    "settings.general.language.empty": {
+        "message": "No languages match.",
+        "description": "Shown when no languages match the search."
+    },
+    "settings.general.management.label": {
+        "message": "Management Server",
+        "description": "Label for the management-server selector."
+    },
+    "settings.general.management.help": {
+        "message": "Connect to NetBird Cloud or your own self-hosted management server. Changes will reconnect the client.",
+        "description": "Helper text explaining Cloud vs self-hosted management server; warns that changes reconnect the client."
+    },
+    "settings.general.management.cloud": {
+        "message": "Cloud",
+        "description": "Option label for using NetBird Cloud as the management server."
+    },
+    "settings.general.management.selfHosted": {
+        "message": "Self-hosted",
+        "description": "Option label for using a self-hosted management server. 'Self-hosted' is a common technical term."
+    },
+    "settings.general.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443",
+        "description": "Example URL placeholder for the self-hosted server field. It is a sample URL — do not translate the URL itself."
+    },
+    "settings.general.management.urlError": {
+        "message": "Please enter a valid URL, e.g., https://netbird.selfhosted.com:443",
+        "description": "Validation message for an invalid management-server URL. The example URL stays as-is."
+    },
+    "settings.general.management.urlUnreachable": {
+        "message": "Couldn't reach this server. Check the URL, or save anyway if you're sure it's correct.",
+        "description": "Soft warning when the management URL couldn't be reached; the user may save anyway."
+    },
+    "settings.general.management.switchCloudTitle": {
+        "message": "Switch to NetBird Cloud?",
+        "description": "Confirmation-dialog title for switching to NetBird Cloud."
+    },
+    "settings.general.management.switchCloudMessage": {
+        "message": "This disconnects your self-hosted server.\nYou may need to log in again.",
+        "description": "Confirmation body warning the self-hosted server will be disconnected. Contains a line break (\\n) — keep it."
+    },
+    "settings.general.management.switchCloudConfirm": {
+        "message": "Switch to Cloud",
+        "description": "Confirm button for switching to Cloud. Keep short."
+    },
+    "settings.network.section.connectivity": {
+        "message": "Connectivity",
+        "description": "Section heading for connectivity options on the Network tab."
+    },
+    "settings.network.section.routingDns": {
+        "message": "Routing & DNS",
+        "description": "Section heading for routing and DNS options. 'DNS' is an acronym — keep it."
+    },
+    "settings.network.monitor.label": {
+        "message": "Reconnect on Network Change",
+        "description": "Toggle label: reconnect automatically on network change."
+    },
+    "settings.network.monitor.help": {
+        "message": "Monitor the network and automatically reconnect on changes such as Wi-Fi switching, Ethernet changes, or resume from sleep.",
+        "description": "Helper text for the network-change reconnect toggle."
+    },
+    "settings.network.dns.label": {
+        "message": "Enable DNS",
+        "description": "Toggle label: enable DNS. 'DNS' — keep acronym."
+    },
+    "settings.network.dns.help": {
+        "message": "Apply NetBird-managed DNS settings to the host resolver.",
+        "description": "Helper text for the enable-DNS toggle."
+    },
+    "settings.network.clientRoutes.label": {
+        "message": "Enable Client Routes",
+        "description": "Toggle label: enable client routes."
+    },
+    "settings.network.clientRoutes.help": {
+        "message": "Accept routes from other peers to reach their networks.",
+        "description": "Helper text for client routes (accept routes from other peers)."
+    },
+    "settings.network.serverRoutes.label": {
+        "message": "Enable Server Routes",
+        "description": "Toggle label: enable server routes."
+    },
+    "settings.network.serverRoutes.help": {
+        "message": "Advertise this host's local routes to other peers.",
+        "description": "Helper text for server routes (advertise this host's local routes to other peers)."
+    },
+    "settings.network.ipv6.label": {
+        "message": "Enable IPv6",
+        "description": "Toggle label: enable IPv6. 'IPv6' — keep as-is."
+    },
+    "settings.network.ipv6.help": {
+        "message": "Use IPv6 addressing for the NetBird overlay network.",
+        "description": "Helper text for the IPv6 toggle."
+    },
+    "settings.security.section.firewall": {
+        "message": "Firewall",
+        "description": "Section heading: Firewall."
+    },
+    "settings.security.section.encryption": {
+        "message": "Encryption",
+        "description": "Section heading: Encryption."
+    },
+    "settings.security.blockInbound.label": {
+        "message": "Block Inbound Traffic",
+        "description": "Toggle label: block inbound traffic."
+    },
+    "settings.security.blockInbound.help": {
+        "message": "Reject unsolicited connections from peers to this device and any networks it routes. Outbound traffic is unaffected.",
+        "description": "Helper text for blocking inbound traffic."
+    },
+    "settings.security.blockLan.label": {
+        "message": "Block LAN Access",
+        "description": "Toggle label: block LAN access. 'LAN' — keep acronym."
+    },
+    "settings.security.blockLan.help": {
+        "message": "Prevent peers from reaching your local network or its devices when this device routes their traffic.",
+        "description": "Helper text for blocking LAN access."
+    },
+    "settings.security.rosenpass.label": {
+        "message": "Enable Quantum-Resistance",
+        "description": "Toggle label: enable quantum-resistance."
+    },
+    "settings.security.rosenpass.help": {
+        "message": "Add a post-quantum key exchange via Rosenpass on top of WireGuard®.",
+        "description": "Helper text: adds a post-quantum key exchange via Rosenpass on top of WireGuard®. 'Rosenpass' and 'WireGuard®' are product names — do not translate; keep the ® symbol."
+    },
+    "settings.security.rosenpassPermissive.label": {
+        "message": "Enable Permissive Mode",
+        "description": "Toggle label: enable permissive mode (for quantum-resistance)."
+    },
+    "settings.security.rosenpassPermissive.help": {
+        "message": "Allow connections to peers without quantum-resistance support.",
+        "description": "Helper text for permissive mode (allow peers without quantum-resistance support)."
+    },
+    "settings.ssh.section.server": {
+        "message": "Server",
+        "description": "Section heading: Server (SSH settings)."
+    },
+    "settings.ssh.section.capabilities": {
+        "message": "Capabilities",
+        "description": "Section heading: Capabilities (SSH features)."
+    },
+    "settings.ssh.section.authentication": {
+        "message": "Authentication",
+        "description": "Section heading: Authentication (SSH)."
+    },
+    "settings.ssh.server.label": {
+        "message": "Enable SSH Server",
+        "description": "Toggle label: enable the SSH server."
+    },
+    "settings.ssh.server.help": {
+        "message": "Run the NetBird SSH server on this host so other peers can connect to it.",
+        "description": "Helper text for the SSH server toggle."
+    },
+    "settings.ssh.root.label": {
+        "message": "Allow Root Login",
+        "description": "Toggle label: allow root login over SSH. 'root' is the Unix superuser account — keep as-is."
+    },
+    "settings.ssh.root.help": {
+        "message": "Let peers sign in as the root user. Disable to require a non-privileged account.",
+        "description": "Helper text for allowing root login."
+    },
+    "settings.ssh.sftp.label": {
+        "message": "Allow SFTP",
+        "description": "Toggle label: allow SFTP. 'SFTP' — keep acronym."
+    },
+    "settings.ssh.sftp.help": {
+        "message": "Transfer files securely using native SFTP or SCP clients.",
+        "description": "Helper text about SFTP/SCP file transfer. Keep the acronyms."
+    },
+    "settings.ssh.localForward.label": {
+        "message": "Local Port Forwarding",
+        "description": "Toggle label: local port forwarding."
+    },
+    "settings.ssh.localForward.help": {
+        "message": "Let connecting peers tunnel local ports to services reachable from this host.",
+        "description": "Helper text for local port forwarding."
+    },
+    "settings.ssh.remoteForward.label": {
+        "message": "Remote Port Forwarding",
+        "description": "Toggle label: remote port forwarding."
+    },
+    "settings.ssh.remoteForward.help": {
+        "message": "Let connecting peers expose ports on this host back to their own machine.",
+        "description": "Helper text for remote port forwarding."
+    },
+    "settings.ssh.jwt.label": {
+        "message": "Enable JWT Authentication",
+        "description": "Toggle label: enable JWT authentication. 'JWT' — keep acronym."
+    },
+    "settings.ssh.jwt.help": {
+        "message": "Verify each SSH session against your IdP for user identity and audit. Disable to rely on network ACL policies only, useful when no IdP is available.",
+        "description": "Helper text for JWT auth. 'IdP' (identity provider) and 'ACL' are acronyms — keep them."
+    },
+    "settings.ssh.jwtTtl.label": {
+        "message": "JWT Cache TTL",
+        "description": "Label for the JWT cache time-to-live field. 'JWT' and 'TTL' — keep acronyms."
+    },
+    "settings.ssh.jwtTtl.help": {
+        "message": "How long this client caches a JWT before prompting again on outgoing SSH connections. Set to 0 to disable caching and authenticate on every connection.",
+        "description": "Helper text for the JWT cache TTL; mentions setting 0 to disable caching."
+    },
+    "settings.ssh.jwtTtl.suffix": {
+        "message": "Second(s)",
+        "description": "Unit suffix shown after the JWT TTL number field. The '(s)' marks an optional plural."
+    },
+    "settings.advanced.section.interface": {
+        "message": "Interface",
+        "description": "Section heading: Interface (network-interface settings)."
+    },
+    "settings.advanced.section.security": {
+        "message": "Security",
+        "description": "Section heading: Security (advanced)."
+    },
+    "settings.advanced.interfaceName.label": {
+        "message": "Name",
+        "description": "Field label for the WireGuard interface name."
+    },
+    "settings.advanced.interfaceName.error": {
+        "message": "Use 1-15 letters, digits, dots, hyphens, or underscores.",
+        "description": "Validation message for the interface name (allowed characters)."
+    },
+    "settings.advanced.interfaceName.errorMac": {
+        "message": "Must start with \"utun\" followed by a number (e.g. utun100).",
+        "description": "Validation message specific to macOS, where the name must start with 'utun' followed by a number. Keep 'utun' and the example."
+    },
+    "settings.advanced.port.label": {
+        "message": "Port",
+        "description": "Field label: Port."
+    },
+    "settings.advanced.port.error": {
+        "message": "Enter a port between {min} and {max}.",
+        "description": "Validation message for the port range. {min} and {max} are numbers; keep them."
+    },
+    "settings.advanced.port.help": {
+        "message": "If set to 0, a random free port will be used.",
+        "description": "Helper text: 0 means a random free port is used."
+    },
+    "settings.advanced.mtu.label": {
+        "message": "MTU",
+        "description": "Field label: MTU. 'MTU' — keep acronym."
+    },
+    "settings.advanced.mtu.error": {
+        "message": "Enter an MTU value between {min} and {max}.",
+        "description": "Validation message for the MTU range. {min} and {max} are numbers; keep them."
+    },
+    "settings.advanced.psk.label": {
+        "message": "Pre-shared Key",
+        "description": "Field label: Pre-shared Key."
+    },
+    "settings.advanced.psk.help": {
+        "message": "Optional WireGuard PSK for extra symmetric encryption. Not the same as a NetBird Setup Key. You will only communicate with peers that use the same pre-shared key.",
+        "description": "Helper text for the WireGuard PSK. 'WireGuard', 'PSK', and 'NetBird Setup Key' are product/technical terms — keep them."
+    },
+    "settings.troubleshooting.section.title": {
+        "message": "Debug bundle",
+        "description": "Section heading: Debug bundle."
+    },
+    "settings.troubleshooting.anonymize.label": {
+        "message": "Anonymize Sensitive Information",
+        "description": "Toggle label: anonymize sensitive information in the bundle."
+    },
+    "settings.troubleshooting.anonymize.help": {
+        "message": "Hides public IP addresses and non-NetBird domains from logs.",
+        "description": "Helper text for anonymizing logs (hides public IPs and non-NetBird domains)."
+    },
+    "settings.troubleshooting.systemInfo.label": {
+        "message": "Include System Information",
+        "description": "Toggle label: include system information in the bundle."
+    },
+    "settings.troubleshooting.systemInfo.help": {
+        "message": "Include OS, kernel, network interfaces, and routing tables.",
+        "description": "Helper text listing the system info included (OS, kernel, interfaces, routing tables)."
+    },
+    "settings.troubleshooting.upload.label": {
+        "message": "Upload Bundle to NetBird Servers",
+        "description": "Toggle label: upload the bundle to NetBird servers."
+    },
+    "settings.troubleshooting.upload.help": {
+        "message": "Returns an upload key to share with NetBird support.",
+        "description": "Helper text for uploading the bundle."
+    },
+    "settings.troubleshooting.trace.label": {
+        "message": "Enable Trace Logs",
+        "description": "Toggle label: raise daemon log level to TRACE while the bundle is built. 'TRACE' is a log level."
+    },
+    "settings.troubleshooting.trace.help": {
+        "message": "Raises the log level to TRACE and restores it after.",
+        "description": "Helper text for the trace toggle. 'TRACE' is a log level — keep as-is."
+    },
+    "settings.troubleshooting.capture.label": {
+        "message": "Capture Session",
+        "description": "Toggle label: open a capture session — reconnect NetBird, wait a duration, optionally record packets."
+    },
+    "settings.troubleshooting.capture.help": {
+        "message": "Reconnects and waits so you can reproduce the issue.",
+        "description": "Helper text for the master Capture Session toggle."
+    },
+    "settings.troubleshooting.packets.label": {
+        "message": "Capture Network Packets",
+        "description": "Toggle label: capture packets to a .pcap during the capture session."
+    },
+    "settings.troubleshooting.packets.help": {
+        "message": "Saves a .pcap of network traffic during the capture window.",
+        "description": "Helper text for the packet recording toggle. '.pcap' is a file extension — keep it."
+    },
+    "settings.troubleshooting.duration.label": {
+        "message": "Capture Duration",
+        "description": "Label for the trace-capture duration field."
+    },
+    "settings.troubleshooting.duration.help": {
+        "message": "How long the capture session runs.",
+        "description": "Helper text for the capture duration."
+    },
+    "settings.troubleshooting.duration.suffix": {
+        "message": "Minute(s)",
+        "description": "Unit suffix after the duration field. The '(s)' marks an optional plural."
+    },
+    "settings.troubleshooting.create": {
+        "message": "Create Bundle",
+        "description": "Button to create the debug bundle. Keep short."
+    },
+    "settings.troubleshooting.progress.description": {
+        "message": "Collecting logs, system details, and connection state. This usually takes a moment. You can keep using NetBird or close Settings while it finishes.",
+        "description": "Status text shown while the debug bundle is being collected; reassures the user they can keep using NetBird or close Settings meanwhile."
+    },
+    "settings.troubleshooting.cancelling": {
+        "message": "Canceling…",
+        "description": "Status shown while cancelling bundle creation. Ends with an ellipsis."
+    },
+    "settings.troubleshooting.done.uploadedTitle": {
+        "message": "Debug bundle successfully uploaded!",
+        "description": "Success title after the bundle was uploaded."
+    },
+    "settings.troubleshooting.done.savedTitle": {
+        "message": "Bundle saved",
+        "description": "Title shown when the bundle was saved locally (not uploaded)."
+    },
+    "settings.troubleshooting.done.uploadedDescription": {
+        "message": "Share the upload key below with <docs>NetBird support</docs>. A local copy was also saved on your device.",
+        "description": "Body after upload, telling the user to share the upload key with support. '<docs>…</docs>' wraps the inline link to the NetBird support docs — keep the tags exactly and wrap the phrase that means 'NetBird support'."
+    },
+    "settings.troubleshooting.done.savedDescription": {
+        "message": "Your debug bundle has been saved locally.",
+        "description": "Body shown when the bundle was only saved locally."
+    },
+    "settings.troubleshooting.done.copyKey": {
+        "message": "Copy Key",
+        "description": "Button to copy the upload key. Keep short."
+    },
+    "settings.troubleshooting.done.openFolder": {
+        "message": "Open Folder",
+        "description": "Button to open the folder containing the bundle. Keep short."
+    },
+    "settings.troubleshooting.done.openFileLocation": {
+        "message": "Open file location",
+        "description": "Button to reveal the bundle file in the OS file manager."
+    },
+    "settings.troubleshooting.uploadFailedWithReason": {
+        "message": "Upload failed: {reason} The bundle is still saved locally.",
+        "description": "Shown when upload failed but the bundle was saved locally. {reason} is the server error text; keep it."
+    },
+    "settings.troubleshooting.uploadFailed": {
+        "message": "Upload failed. The bundle is still saved locally.",
+        "description": "Shown when upload failed (no specific reason) but the bundle was saved locally."
+    },
+    "settings.troubleshooting.stage.reconnecting": {
+        "message": "Reconnecting NetBird…",
+        "description": "Progress stage: reconnecting NetBird. Ends with an ellipsis."
+    },
+    "settings.troubleshooting.stage.capturing": {
+        "message": "Capturing debug logs",
+        "description": "Progress stage: capturing logs. {elapsed} and {total} are time values (e.g. 0:30 / 2:00); keep both."
+    },
+    "settings.troubleshooting.stage.bundling": {
+        "message": "Generating debug bundle…",
+        "description": "Progress stage: generating the debug bundle. Ends with an ellipsis."
+    },
+    "settings.troubleshooting.stage.uploading": {
+        "message": "Uploading to NetBird…",
+        "description": "Progress stage: uploading to NetBird. Ends with an ellipsis."
+    },
+    "settings.troubleshooting.stage.cancelling": {
+        "message": "Canceling…",
+        "description": "Progress stage: cancelling. Ends with an ellipsis."
+    },
+    "settings.about.client": {
+        "message": "NetBird Client v{version}",
+        "description": "About tab: client product name and version. {version} is a version number; keep it. 'NetBird Client' — keep brand."
+    },
+    "settings.about.clientName": {
+        "message": "NetBird Client",
+        "description": "About tab: the client product name shown when no version is available. Brand — do not translate."
+    },
+    "settings.about.development": {
+        "message": "[Development]",
+        "description": "Badge shown next to the version on development builds. Keep the square brackets."
+    },
+    "settings.about.gui": {
+        "message": "GUI v{version}",
+        "description": "About tab: UI component name and version. {version} is a version number; keep it. 'GUI' = the graphical app."
+    },
+    "settings.about.guiName": {
+        "message": "GUI",
+        "description": "About tab: the UI component name shown without a version. 'GUI' = the graphical app."
+    },
+    "settings.about.copyright": {
+        "message": "© {year} NetBird. All Rights Reserved.",
+        "description": "Copyright line. {year} is the current year; keep it. 'NetBird' — brand."
+    },
+    "settings.about.links.imprint": {
+        "message": "Imprint",
+        "description": "Footer link: Imprint (legal notice / Impressum)."
+    },
+    "settings.about.links.privacy": {
+        "message": "Privacy",
+        "description": "Footer link: Privacy policy."
+    },
+    "settings.about.links.cla": {
+        "message": "CLA",
+        "description": "Footer link: CLA (Contributor License Agreement). Acronym — keep as-is."
+    },
+    "settings.about.links.terms": {
+        "message": "Terms of Service",
+        "description": "Footer link: Terms of Service."
+    },
+    "settings.about.community.github": {
+        "message": "GitHub",
+        "description": "Community link: GitHub. Brand — do not translate."
+    },
+    "settings.about.community.slack": {
+        "message": "Slack",
+        "description": "Community link: Slack. Brand — do not translate."
+    },
+    "settings.about.community.forum": {
+        "message": "Forum",
+        "description": "Community link: Forum."
+    },
+    "settings.about.community.documentation": {
+        "message": "Documentation",
+        "description": "Community link: Documentation."
+    },
+    "settings.about.community.feedback": {
+        "message": "Feedback",
+        "description": "Community link: Feedback."
+    },
+    "update.banner.message": {
+        "message": "NetBird {version} is ready to install.",
+        "description": "Update banner text when a new version is ready to install. {version} is the version number; keep it."
+    },
+    "update.banner.later": {
+        "message": "Later",
+        "description": "Banner button to postpone the update. Keep short."
+    },
+    "update.banner.installNow": {
+        "message": "Install now",
+        "description": "Banner button to install the update now. Keep short."
+    },
+    "update.card.versionAvailableDownload": {
+        "message": "Version {version} is available for download.",
+        "description": "Update card text when a version is available to download. {version} is the version number; keep it."
+    },
+    "update.card.versionAvailableInstall": {
+        "message": "Version {version} is available for install.",
+        "description": "Update card text when a version is available to install. {version} is the version number; keep it."
+    },
+    "update.card.whatsNew": {
+        "message": "What's new?",
+        "description": "Link / label that opens the release notes."
+    },
+    "update.card.installNow": {
+        "message": "Install Now",
+        "description": "Update card button: install now. Keep short."
+    },
+    "update.card.getInstaller": {
+        "message": "Download",
+        "description": "Update card button: download the installer."
+    },
+    "update.card.autoCheckInterval": {
+        "message": "NetBird checks for updates in the background.",
+        "description": "Note that NetBird checks for updates in the background."
+    },
+    "update.card.changelog": {
+        "message": "Changelog",
+        "description": "Link / label: Changelog."
+    },
+    "update.card.onLatestVersion": {
+        "message": "You're on the latest version",
+        "description": "Shown when the client is already up to date."
+    },
+    "update.header.tooltip": {
+        "message": "Update Available",
+        "description": "Tooltip on the header update badge."
+    },
+    "update.overlay.updatingVersion": {
+        "message": "Updating NetBird to v{version}",
+        "description": "Heading in the install-progress window while updating to a specific version. {version} is the version number; keep it. The 'v' prefix is part of the version display."
+    },
+    "update.overlay.updating": {
+        "message": "Updating NetBird",
+        "description": "Heading in the install-progress window while updating when the target version isn't known."
+    },
+    "update.overlay.description": {
+        "message": "A newer version is available and is being installed. NetBird will restart automatically once the update is finished.",
+        "description": "Install-progress window body explaining NetBird will restart automatically after the update."
+    },
+    "update.overlay.error.timeoutTitle": {
+        "message": "Update Is Taking Too Long",
+        "description": "Install-progress window error title: the update took too long."
+    },
+    "update.overlay.error.timeoutDescription": {
+        "message": "Installing {target} took too long and didn't finish.",
+        "description": "Install-progress window error body for a timeout. {target} is the target-version label (see update.overlay.error.targetVersion / targetFallback); keep it."
+    },
+    "update.overlay.error.canceledTitle": {
+        "message": "Update Was Stopped",
+        "description": "Install-progress window error title: the update was stopped / canceled."
+    },
+    "update.overlay.error.canceledDescription": {
+        "message": "The update to {target} was canceled before it finished.",
+        "description": "Install-progress window error body for a canceled update. {target} is the target-version label; keep it."
+    },
+    "update.overlay.error.failTitle": {
+        "message": "Couldn't Install the Update",
+        "description": "Install-progress window error title: the update couldn't be installed."
+    },
+    "update.overlay.error.failDescription": {
+        "message": "{target} couldn't be installed.",
+        "description": "Install-progress window error body for a failed install. {target} is the target-version label; keep it."
+    },
+    "update.overlay.error.unknownMessage": {
+        "message": "unknown error",
+        "description": "Fallback text for an unspecified error, used inside other messages."
+    },
+    "update.overlay.error.targetVersion": {
+        "message": "v{version}",
+        "description": "The target-version label substituted into {target}. {version} is a number; keep the 'v' prefix."
+    },
+    "update.overlay.error.targetFallback": {
+        "message": "the new version",
+        "description": "Fallback target label used when the version isn't known, substituted into {target}."
+    },
+    "update.error.loadStateTitle": {
+        "message": "Load Update State Failed",
+        "description": "Error-dialog title when loading update state fails."
+    },
+    "update.error.triggerTitle": {
+        "message": "Start Update Failed",
+        "description": "Error-dialog title when starting the update fails."
+    },
+    "update.page.versionLine": {
+        "message": "Updating client to: {version}.",
+        "description": "Install-progress window text naming the target version. {version} is the version number; keep it."
+    },
+    "update.page.versionLineGeneric": {
+        "message": "Updating client.",
+        "description": "Install-progress text used when the target version isn't known."
+    },
+    "update.page.outdated": {
+        "message": "Your client version is older than the auto-update version set in Management.",
+        "description": "Note that the client is older than the auto-update version set in Management. 'Management' = the NetBird management server / console."
+    },
+    "update.page.status.running": {
+        "message": "Updating",
+        "description": "Install status: updating."
+    },
+    "update.page.status.timeout": {
+        "message": "Update timed out. Please try again.",
+        "description": "Install status: timed out; asks the user to retry."
+    },
+    "update.page.status.canceled": {
+        "message": "Update canceled.",
+        "description": "Install status: canceled."
+    },
+    "update.page.status.failed": {
+        "message": "Update failed: {message}",
+        "description": "Install status: failed. {message} is the error detail; keep it."
+    },
+    "update.page.status.unknownError": {
+        "message": "unknown update error",
+        "description": "Fallback text for an unknown update error, used inside update.page.status.failed."
+    },
+    "update.page.failedTitle": {
+        "message": "Update Failed",
+        "description": "Heading shown when the install failed."
+    },
+    "update.page.timeoutMessage": {
+        "message": "Update timed out.",
+        "description": "Message shown when the install timed out."
+    },
+    "update.page.dontClose": {
+        "message": "Please don't close this window.",
+        "description": "Warning asking the user not to close the install window."
+    },
+    "update.page.updating": {
+        "message": "Updating…",
+        "description": "Short status: updating. Ends with an ellipsis."
+    },
+    "update.page.complete": {
+        "message": "Update complete",
+        "description": "Short status: update complete."
+    },
+    "update.page.failed": {
+        "message": "Update failed",
+        "description": "Short status: update failed."
+    },
+    "window.title.settings": {
+        "message": "Settings",
+        "description": "OS window-chrome title for the Settings window. The app prefixes it with 'NetBird - '."
+    },
+    "window.title.signIn": {
+        "message": "Sign-in",
+        "description": "OS window-chrome title for the sign-in window."
+    },
+    "window.title.sessionExpiration": {
+        "message": "Session Expiring",
+        "description": "OS window-chrome title for the session-expiration window."
+    },
+    "window.title.updating": {
+        "message": "Updating",
+        "description": "OS window-chrome title for the update / install window."
+    },
+    "window.title.welcome": {
+        "message": "Welcome to NetBird",
+        "description": "OS window-chrome title for the first-launch welcome window. 'NetBird' — brand."
+    },
+    "window.title.error": {
+        "message": "Error",
+        "description": "OS window-chrome title for the error window."
+    },
+    "welcome.title": {
+        "message": "Look for NetBird in your tray",
+        "description": "Heading on the first onboarding step, pointing the user to the tray icon. 'tray' = system tray / menu bar."
+    },
+    "welcome.description": {
+        "message": "NetBird lives in your tray. Click the icon to connect, switch profiles, or open settings.",
+        "description": "Body of the first onboarding step explaining the tray icon."
+    },
+    "welcome.continue": {
+        "message": "Continue",
+        "description": "Primary button to advance the onboarding. Keep short."
+    },
+    "welcome.back": {
+        "message": "Back",
+        "description": "Button to go back a step in onboarding. Keep short."
+    },
+    "welcome.management.title": {
+        "message": "Set up NetBird",
+        "description": "Heading on the onboarding step for choosing a management server."
+    },
+    "welcome.management.description": {
+        "message": "Click Continue to get started, or pick Self-hosted if you have your own NetBird server.",
+        "description": "Body of the management step; mentions choosing Self-hosted if the user runs their own server."
+    },
+    "welcome.management.cloud.title": {
+        "message": "NetBird Cloud",
+        "description": "Option title: NetBird Cloud. Brand — do not translate 'NetBird Cloud'."
+    },
+    "welcome.management.cloud.description": {
+        "message": "Use our hosted service. No setup required.",
+        "description": "Option body for NetBird Cloud (hosted service, no setup required)."
+    },
+    "welcome.management.selfHosted.title": {
+        "message": "Self-hosted",
+        "description": "Option title: Self-hosted."
+    },
+    "welcome.management.selfHosted.description": {
+        "message": "Connect to your own management server.",
+        "description": "Option body for connecting to your own management server."
+    },
+    "welcome.management.urlLabel": {
+        "message": "Management server URL",
+        "description": "Field label for the management-server URL."
+    },
+    "welcome.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443",
+        "description": "Example URL placeholder. Sample URL — do not translate it."
+    },
+    "welcome.management.urlInvalid": {
+        "message": "Please enter a valid URL, e.g., https://netbird.selfhosted.com:443",
+        "description": "Validation message for an invalid URL. The example URL stays as-is."
+    },
+    "welcome.management.urlUnreachable": {
+        "message": "Couldn't reach this server. Check the URL or your network, then continue if you're sure it's correct.",
+        "description": "Soft warning when the server couldn't be reached during onboarding; the user may continue anyway."
+    },
+    "welcome.management.checking": {
+        "message": "Checking…",
+        "description": "Status shown while checking the server URL. Ends with an ellipsis."
+    },
+    "browserLogin.title": {
+        "message": "Complete login in your browser",
+        "description": "Heading telling the user to finish signing in via their browser."
+    },
+    "browserLogin.notSeeing": {
+        "message": "We opened a browser tab so you can finish signing in. Not seeing it?",
+        "description": "Prompt asking whether the user doesn't see the opened browser tab."
+    },
+    "browserLogin.tryAgain": {
+        "message": "Try again",
+        "description": "Button to re-open the browser sign-in page. Keep short."
+    },
+    "browserLogin.openFailedTitle": {
+        "message": "Open Browser Failed",
+        "description": "Error-dialog title when the browser couldn't be opened."
+    },
+    "sessionExpiration.title": {
+        "message": "Session expiring soon",
+        "description": "Heading warning the session will expire soon."
+    },
+    "sessionExpiration.titleLater": {
+        "message": "Your session will expire",
+        "description": "Alternate, less-urgent heading: the session will expire."
+    },
+    "sessionExpiration.description": {
+        "message": "This device will disconnect soon. Renew with a browser sign-in.",
+        "description": "Body warning the device will disconnect soon; renew via a browser sign-in."
+    },
+    "sessionExpiration.descriptionLater": {
+        "message": "A browser sign-in keeps this device connected to your network.",
+        "description": "Body for the less-urgent variant; a browser sign-in keeps the device connected."
+    },
+    "sessionExpiration.stay": {
+        "message": "Renew session",
+        "description": "Button to renew the session (keep connected). Keep short."
+    },
+    "sessionExpiration.authenticate": {
+        "message": "Authenticate",
+        "description": "Button to authenticate / sign in. Keep short."
+    },
+    "sessionExpiration.logout": {
+        "message": "Logout",
+        "description": "Button to log out. Keep short."
+    },
+    "sessionExpiration.expired": {
+        "message": "Session expired",
+        "description": "Heading shown once the session has actually expired."
+    },
+    "sessionExpiration.expiredDescription": {
+        "message": "Device disconnected. Authenticate with a browser sign-in to reconnect.",
+        "description": "Body shown after expiry; authenticate via a browser sign-in to reconnect."
+    },
+    "sessionExpiration.close": {
+        "message": "Close",
+        "description": "Close button on the session window. Keep short."
+    },
+    "sessionExpiration.extendFailedTitle": {
+        "message": "Extend Session Failed",
+        "description": "Error-dialog title when extending the session fails."
+    },
+    "sessionExpiration.logoutFailedTitle": {
+        "message": "Logout Failed",
+        "description": "Error-dialog title when logging out fails."
+    },
+    "peers.search.placeholder": {
+        "message": "Search by name or IP",
+        "description": "Placeholder in the peers search field."
+    },
+    "peers.filter.all": {
+        "message": "All",
+        "description": "Peers filter option: All. Keep short."
+    },
+    "peers.filter.online": {
+        "message": "Online",
+        "description": "Peers filter option: Online. Keep short."
+    },
+    "peers.filter.offline": {
+        "message": "Offline",
+        "description": "Peers filter option: Offline. Keep short."
+    },
+    "peers.empty.title": {
+        "message": "No peers available",
+        "description": "Title of the empty state when no peers are available."
+    },
+    "peers.empty.description": {
+        "message": "You either don't have any peers available or have no access to any of them.",
+        "description": "Body of the no-peers empty state."
+    },
+    "peers.details.domain": {
+        "message": "Domain",
+        "description": "Peer detail label: Domain."
+    },
+    "peers.details.netbirdIp": {
+        "message": "NetBird IP",
+        "description": "Peer detail label: NetBird IP address. 'NetBird' — brand; 'IP' — keep acronym."
+    },
+    "peers.details.netbirdIpv6": {
+        "message": "NetBird IPv6",
+        "description": "Peer detail label: NetBird IPv6 address. Keep 'NetBird' and 'IPv6'."
+    },
+    "peers.details.publicKey": {
+        "message": "Public key",
+        "description": "Peer detail label: WireGuard public key."
+    },
+    "peers.details.connection": {
+        "message": "Connection",
+        "description": "Peer detail label: Connection."
+    },
+    "peers.details.latency": {
+        "message": "Latency",
+        "description": "Peer detail label: Latency."
+    },
+    "peers.details.lastHandshake": {
+        "message": "Last handshake",
+        "description": "Peer detail label: time of the last WireGuard handshake."
+    },
+    "peers.details.statusSince": {
+        "message": "Last connection update",
+        "description": "Peer detail label: time since the last connection-status update."
+    },
+    "peers.details.bytes": {
+        "message": "Bytes",
+        "description": "Peer detail label: Bytes (data transferred)."
+    },
+    "peers.details.bytesSent": {
+        "message": "Sent",
+        "description": "Peer detail label: bytes sent."
+    },
+    "peers.details.bytesReceived": {
+        "message": "Received",
+        "description": "Peer detail label: bytes received."
+    },
+    "peers.details.localIce": {
+        "message": "Local ICE",
+        "description": "Peer detail label: local ICE candidate. 'ICE' — keep acronym."
+    },
+    "peers.details.remoteIce": {
+        "message": "Remote ICE",
+        "description": "Peer detail label: remote ICE candidate. 'ICE' — keep acronym."
+    },
+    "peers.details.never": {
+        "message": "Never",
+        "description": "Value shown when an event has never happened (e.g. last handshake = Never)."
+    },
+    "peers.details.justNow": {
+        "message": "Just now",
+        "description": "Relative-time value meaning a moment ago."
+    },
+    "peers.details.refresh": {
+        "message": "Refresh",
+        "description": "Button to refresh peer details. Keep short."
+    },
+    "peers.status.connected": {
+        "message": "Connected",
+        "description": "Peer status: connected."
+    },
+    "peers.status.connecting": {
+        "message": "Connecting",
+        "description": "Peer status: connecting."
+    },
+    "peers.status.disconnected": {
+        "message": "Disconnected",
+        "description": "Peer status: disconnected."
+    },
+    "peers.details.relayAddress": {
+        "message": "Relay",
+        "description": "Peer detail label: Relay (relay-server address)."
+    },
+    "peers.details.networks": {
+        "message": "Resources",
+        "description": "Peer detail label for the peer's network resources. Labelled 'Resources' in the UI."
+    },
+    "peers.details.relayed": {
+        "message": "Relayed",
+        "description": "Connection-type value: the connection is relayed (not direct). Technical term."
+    },
+    "peers.details.p2p": {
+        "message": "P2P",
+        "description": "Connection-type value: peer-to-peer (direct). 'P2P' — keep as-is."
+    },
+    "peers.details.rosenpass": {
+        "message": "Rosenpass enabled",
+        "description": "Peer detail indicating Rosenpass (quantum-resistance) is enabled. 'Rosenpass' — product name, do not translate."
+    },
+    "networks.search.placeholder": {
+        "message": "Search by network or domain",
+        "description": "Placeholder in the resources search field."
+    },
+    "networks.filter.all": {
+        "message": "All",
+        "description": "Resources filter: All. Keep short."
+    },
+    "networks.filter.active": {
+        "message": "Active",
+        "description": "Resources filter: Active. Keep short."
+    },
+    "networks.filter.overlapping": {
+        "message": "Overlapping",
+        "description": "Resources filter: Overlapping (overlapping IP ranges). Keep short."
+    },
+    "networks.empty.title": {
+        "message": "No resources available",
+        "description": "Title of the empty state when no resources are available."
+    },
+    "networks.empty.description": {
+        "message": "You either don't have any network resources available or have no access to any of them.",
+        "description": "Body of the no-resources empty state."
+    },
+    "networks.selected": {
+        "message": "Selected",
+        "description": "Label / badge: the resource is selected (enabled)."
+    },
+    "networks.unselected": {
+        "message": "Not selected",
+        "description": "Label / badge: the resource is not selected."
+    },
+    "networks.ips.heading": {
+        "message": "Resolved IPs",
+        "description": "Heading for the list of a resource's resolved IP addresses."
+    },
+    "networks.bulk.selectionCount": {
+        "message": "{selected} of {total} Active",
+        "description": "Header showing how many resources are active. {selected} and {total} are numbers; keep both."
+    },
+    "networks.bulk.enableAll": {
+        "message": "Enable all",
+        "description": "Button to enable all resources. Keep short."
+    },
+    "networks.bulk.disableAll": {
+        "message": "Disable all",
+        "description": "Button to disable all resources. Keep short."
+    },
+    "exitNodes.search.placeholder": {
+        "message": "Search exit nodes",
+        "description": "Placeholder in the exit-nodes search field."
+    },
+    "exitNodes.none": {
+        "message": "None",
+        "description": "Option meaning no exit node. Keep short."
+    },
+    "exitNodes.empty.title": {
+        "message": "No exit nodes available",
+        "description": "Title of the empty state when no exit nodes are available."
+    },
+    "exitNodes.empty.description": {
+        "message": "No exit nodes have been shared with this peer.",
+        "description": "Body of the no-exit-nodes empty state."
+    },
+    "exitNodes.card.title": {
+        "message": "Exit Node",
+        "description": "Card heading: Exit Node."
+    },
+    "exitNodes.card.statusActive": {
+        "message": "Active",
+        "description": "Exit node card status: Active."
+    },
+    "exitNodes.card.statusInactive": {
+        "message": "Inactive",
+        "description": "Exit node card status: Inactive."
+    },
+    "exitNodes.dropdown.noneTitle": {
+        "message": "None",
+        "description": "Dropdown option title: None (no exit node)."
+    },
+    "exitNodes.dropdown.noneDescription": {
+        "message": "Direct connection without an exit node",
+        "description": "Dropdown option body for None: direct connection without an exit node."
+    },
+    "quickActions.connect": {
+        "message": "Connect",
+        "description": "Quick-action button: Connect. Keep short."
+    },
+    "quickActions.disconnect": {
+        "message": "Disconnect",
+        "description": "Quick-action button: Disconnect. Keep short."
+    },
+    "daemon.unavailable.title": {
+        "message": "NetBird Service Is Not Running",
+        "description": "Title of the overlay shown when the NetBird background service isn't running."
+    },
+    "daemon.unavailable.description": {
+        "message": "The app will reconnect automatically once the service is running.",
+        "description": "Body reassuring the user the app will reconnect once the service is running."
+    },
+    "daemon.unavailable.docsLink": {
+        "message": "Documentation",
+        "description": "Documentation link on the daemon-unavailable overlay."
+    },
+    "daemon.outdated.title": {
+        "message": "NetBird Service Is Outdated",
+        "description": "Title of the overlay shown when the NetBird background service is too old to drive this UI."
+    },
+    "daemon.outdated.description": {
+        "message": "Update the NetBird service to use this app.",
+        "description": "Body of the daemon-outdated overlay telling the user to upgrade the service."
+    },
+    "error.jwt_clock_skew": {
+        "message": "Sign-in failed: this device's clock is out of sync with the server. Please sync your system clock and try again.",
+        "description": "Sign-in error shown to the user: the device clock is out of sync with the server."
+    },
+    "error.jwt_expired": {
+        "message": "Your sign-in token has expired. Please sign in again.",
+        "description": "Sign-in error: the sign-in token expired; sign in again."
+    },
+    "error.jwt_signature_invalid": {
+        "message": "Sign-in failed: the token signature is invalid. Please contact your administrator.",
+        "description": "Sign-in error: the token signature is invalid; contact the administrator."
+    },
+    "error.session_expired": {
+        "message": "Your session has expired. Please sign in again.",
+        "description": "Error: the session expired; sign in again."
+    },
+    "error.invalid_setup_key": {
+        "message": "The setup key is missing or invalid.",
+        "description": "Error: the setup key is missing or invalid. 'setup key' is a NetBird term."
+    },
+    "error.permission_denied": {
+        "message": "Sign-in was rejected by the server.",
+        "description": "Error: the server rejected the sign-in."
+    },
+    "error.daemon_unreachable": {
+        "message": "The NetBird daemon is not responding. Please check that the service is running.",
+        "description": "Error: the NetBird background service isn't responding. 'daemon' = the background service."
+    },
+    "error.unknown": {
+        "message": "Operation failed.",
+        "description": "Generic fallback error message used when no specific error applies."
+    }
+}
diff --git a/client/ui/i18n/locales/es/common.json b/client/ui/i18n/locales/es/common.json
new file mode 100644
index 000000000..47faee61f
--- /dev/null
+++ b/client/ui/i18n/locales/es/common.json
@@ -0,0 +1,1325 @@
+{
+    "tray.tooltip": {
+        "message": "NetBird"
+    },
+    "tray.status.disconnected": {
+        "message": "Desconectado"
+    },
+    "tray.status.daemonUnavailable": {
+        "message": "No está en ejecución"
+    },
+    "tray.status.error": {
+        "message": "Error"
+    },
+    "tray.status.connected": {
+        "message": "Conectado"
+    },
+    "tray.status.connecting": {
+        "message": "Conectando"
+    },
+    "tray.status.needsLogin": {
+        "message": "Inicio de sesión requerido"
+    },
+    "tray.status.loginFailed": {
+        "message": "Error al iniciar sesión"
+    },
+    "tray.status.sessionExpired": {
+        "message": "Sesión expirada"
+    },
+    "tray.session.expiresIn": {
+        "message": "La sesión expira en {remaining}"
+    },
+    "tray.session.unit.lessThanMinute": {
+        "message": "menos de un minuto"
+    },
+    "tray.session.unit.minute": {
+        "message": "1 minuto"
+    },
+    "tray.session.unit.minutes": {
+        "message": "{count} minutos"
+    },
+    "tray.session.unit.hour": {
+        "message": "1 hora"
+    },
+    "tray.session.unit.hours": {
+        "message": "{count} horas"
+    },
+    "tray.session.unit.day": {
+        "message": "1 día"
+    },
+    "tray.session.unit.days": {
+        "message": "{count} días"
+    },
+    "tray.menu.open": {
+        "message": "Abrir NetBird"
+    },
+    "tray.menu.connect": {
+        "message": "Conectar"
+    },
+    "tray.menu.disconnect": {
+        "message": "Desconectar"
+    },
+    "tray.menu.exitNode": {
+        "message": "Nodo de salida"
+    },
+    "tray.menu.networks": {
+        "message": "Recursos"
+    },
+    "tray.menu.profiles": {
+        "message": "Perfiles"
+    },
+    "tray.menu.manageProfiles": {
+        "message": "Gestionar perfiles"
+    },
+    "tray.menu.settings": {
+        "message": "Configuración..."
+    },
+    "tray.menu.debugBundle": {
+        "message": "Crear paquete de diagnóstico"
+    },
+    "tray.menu.about": {
+        "message": "Ayuda y soporte"
+    },
+    "tray.menu.github": {
+        "message": "GitHub"
+    },
+    "tray.menu.documentation": {
+        "message": "Documentación"
+    },
+    "tray.menu.troubleshoot": {
+        "message": "Solucionar problemas"
+    },
+    "tray.menu.downloadLatest": {
+        "message": "Descargar la última versión"
+    },
+    "tray.menu.installVersion": {
+        "message": "Instalar la versión {version}"
+    },
+    "tray.menu.guiVersion": {
+        "message": "GUI: {version}"
+    },
+    "tray.menu.daemonVersion": {
+        "message": "Daemon: {version}"
+    },
+    "tray.menu.versionUnknown": {
+        "message": "—"
+    },
+    "tray.menu.quit": {
+        "message": "Salir de NetBird"
+    },
+    "notify.daemonOutdated.title": {
+        "message": "El servicio de NetBird está desactualizado"
+    },
+    "notify.daemonOutdated.body": {
+        "message": "Actualice el servicio de NetBird para usar esta aplicación."
+    },
+    "notify.update.title": {
+        "message": "Actualización de NetBird disponible"
+    },
+    "notify.update.body": {
+        "message": "NetBird {version} está disponible."
+    },
+    "notify.update.enforcedSuffix": {
+        "message": " Su administrador requiere esta actualización."
+    },
+    "notify.error.title": {
+        "message": "Error"
+    },
+    "notify.error.connect": {
+        "message": "Error al conectar"
+    },
+    "notify.error.disconnect": {
+        "message": "Error al desconectar"
+    },
+    "notify.error.switchProfile": {
+        "message": "Error al cambiar a {profile}"
+    },
+    "notify.error.exitNode": {
+        "message": "Error al actualizar el nodo de salida {name}"
+    },
+    "notify.sessionExpired.title": {
+        "message": "Sesión de NetBird expirada"
+    },
+    "notify.sessionExpired.body": {
+        "message": "Su sesión de NetBird ha expirado. Inicie sesión de nuevo."
+    },
+    "notify.sessionWarning.title": {
+        "message": "La sesión expira pronto"
+    },
+    "notify.sessionWarning.body": {
+        "message": "Su sesión de NetBird expira en {remaining}. Haga clic en Renovar ahora para renovarla."
+    },
+    "notify.sessionWarning.bodyGeneric": {
+        "message": "Su sesión de NetBird está a punto de expirar. Haga clic en Renovar ahora para renovarla."
+    },
+    "notify.sessionWarning.extend": {
+        "message": "Renovar ahora"
+    },
+    "notify.sessionWarning.dismiss": {
+        "message": "Descartar"
+    },
+    "notify.sessionWarning.failed": {
+        "message": "Error al renovar la sesión de NetBird"
+    },
+    "notify.sessionWarning.successTitle": {
+        "message": "Sesión de NetBird renovada"
+    },
+    "notify.sessionWarning.successBody": {
+        "message": "Su sesión se ha renovado."
+    },
+    "notify.sessionDeadlineRejected.title": {
+        "message": "Plazo de sesión rechazado"
+    },
+    "notify.sessionDeadlineRejected.body": {
+        "message": "El servidor envió un plazo de sesión no válido. Inicie sesión de nuevo."
+    },
+    "notify.mdm.policyApplied.title": {
+        "message": "Configuración de NetBird actualizada"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "Su configuración de NetBird fue actualizada por su política de TI."
+    },
+    "common.cancel": {
+        "message": "Cancelar"
+    },
+    "common.save": {
+        "message": "Guardar"
+    },
+    "common.saveChanges": {
+        "message": "Guardar cambios"
+    },
+    "common.saving": {
+        "message": "Guardando…"
+    },
+    "common.close": {
+        "message": "Cerrar"
+    },
+    "common.copy": {
+        "message": "Copiar"
+    },
+    "common.togglePasswordVisibility": {
+        "message": "Mostrar u ocultar la contraseña"
+    },
+    "common.increase": {
+        "message": "Aumentar"
+    },
+    "common.decrease": {
+        "message": "Disminuir"
+    },
+    "common.delete": {
+        "message": "Eliminar"
+    },
+    "common.create": {
+        "message": "Crear"
+    },
+    "common.add": {
+        "message": "Añadir"
+    },
+    "common.remove": {
+        "message": "Quitar"
+    },
+    "common.refresh": {
+        "message": "Actualizar"
+    },
+    "common.loading": {
+        "message": "Cargando…"
+    },
+    "common.netbird": {
+        "message": "NetBird"
+    },
+    "common.noResults.title": {
+        "message": "No se encontraron resultados"
+    },
+    "common.noResults.description": {
+        "message": "No se encontraron resultados. Pruebe con otro término de búsqueda o cambie los filtros."
+    },
+    "notConnected.title": {
+        "message": "Desconectado"
+    },
+    "notConnected.description": {
+        "message": "Conéctese primero a NetBird para ver información detallada sobre sus peers, recursos de red y nodos de salida."
+    },
+    "connect.status.disconnected": {
+        "message": "Desconectado"
+    },
+    "connect.status.connecting": {
+        "message": "Conectando..."
+    },
+    "connect.status.connected": {
+        "message": "Conectado"
+    },
+    "connect.status.disconnecting": {
+        "message": "Desconectando..."
+    },
+    "connect.status.daemonUnavailable": {
+        "message": "Daemon no disponible"
+    },
+    "connect.status.loginRequired": {
+        "message": "Inicio de sesión requerido"
+    },
+    "connect.error.loginTitle": {
+        "message": "Error al iniciar sesión"
+    },
+    "connect.error.connectTitle": {
+        "message": "Error al conectar"
+    },
+    "connect.error.disconnectTitle": {
+        "message": "Error al desconectar"
+    },
+    "nav.peers.title": {
+        "message": "Peers"
+    },
+    "nav.peers.description": {
+        "message": "{connected} de {total} conectados"
+    },
+    "nav.resources.title": {
+        "message": "Recursos"
+    },
+    "nav.resources.description": {
+        "message": "{active} de {total} activos"
+    },
+    "nav.exitNode.title": {
+        "message": "Nodos de salida"
+    },
+    "nav.exitNode.none": {
+        "message": "Inactivo"
+    },
+    "nav.exitNode.using": {
+        "message": "Vía {name}"
+    },
+    "header.openSettings": {
+        "message": "Abrir configuración"
+    },
+    "header.togglePanel": {
+        "message": "Mostrar u ocultar el panel lateral"
+    },
+    "profile.selector.loading": {
+        "message": "Cargando..."
+    },
+    "profile.selector.noProfile": {
+        "message": "Sin perfil"
+    },
+    "profile.selector.searchPlaceholder": {
+        "message": "Buscar perfil por nombre..."
+    },
+    "profile.selector.emptyTitle": {
+        "message": "No se encontraron perfiles"
+    },
+    "profile.selector.emptyDescription": {
+        "message": "Pruebe con otro término de búsqueda o cree un perfil nuevo."
+    },
+    "profile.selector.newProfile": {
+        "message": "Nuevo perfil"
+    },
+    "profile.selector.moreOptions": {
+        "message": "Más opciones"
+    },
+    "profile.selector.deregister": {
+        "message": "Anular registro"
+    },
+    "profile.selector.delete": {
+        "message": "Eliminar"
+    },
+    "profile.selector.switchTo": {
+        "message": "Cambiar a este perfil"
+    },
+    "profile.selector.edit": {
+        "message": "Editar"
+    },
+    "profile.edit.title": {
+        "message": "Editar perfil"
+    },
+    "profile.edit.submit": {
+        "message": "Guardar cambios"
+    },
+    "profile.dialog.title": {
+        "message": "Introduzca el nombre del perfil"
+    },
+    "profile.dialog.nameLabel": {
+        "message": "Nombre del perfil"
+    },
+    "profile.dialog.description": {
+        "message": "Asigne un nombre fácil de identificar a su perfil."
+    },
+    "profile.dialog.placeholder": {
+        "message": "p. ej. trabajo"
+    },
+    "profile.dialog.submit": {
+        "message": "Añadir perfil"
+    },
+    "profile.dialog.required": {
+        "message": "Introduzca un nombre de perfil, p. ej. trabajo, casa"
+    },
+    "profile.dialog.managementHelp": {
+        "message": "Use NetBird Cloud o su propio servidor."
+    },
+    "profile.dialog.urlUnreachable": {
+        "message": "No se pudo contactar con este servidor. Compruebe la URL o añada el perfil de todos modos si está seguro de que es correcta."
+    },
+    "header.menu.settings": {
+        "message": "Configuración..."
+    },
+    "header.menu.defaultView": {
+        "message": "Vista predeterminada"
+    },
+    "header.menu.advancedView": {
+        "message": "Vista avanzada"
+    },
+    "header.menu.updateAvailable": {
+        "message": "Actualización disponible"
+    },
+    "header.menu.open": {
+        "message": "Abrir menú"
+    },
+    "header.profile.switch": {
+        "message": "Cambiar de perfil"
+    },
+    "connect.toggle.label": {
+        "message": "Conmutar conexión NetBird"
+    },
+    "connect.localIp.label": {
+        "message": "Direcciones IP locales"
+    },
+    "common.search": {
+        "message": "Buscar"
+    },
+    "common.filter": {
+        "message": "Filtrar"
+    },
+    "exitNodes.dropdown.trigger": {
+        "message": "Seleccionar nodo de salida"
+    },
+    "peers.row.label": {
+        "message": "Abrir detalles de {name}, {status}"
+    },
+    "peers.dialog.title": {
+        "message": "Detalles del par"
+    },
+    "networks.row.toggle": {
+        "message": "Conmutar {name}"
+    },
+    "networks.bulk.label": {
+        "message": "Conmutar todos los recursos visibles"
+    },
+    "settings.nav.label": {
+        "message": "Secciones de configuración"
+    },
+    "profile.switch.title": {
+        "message": "¿Cambiar el perfil a «{name}»?"
+    },
+    "profile.switch.message": {
+        "message": "¿Seguro que desea cambiar de perfil?\nSu perfil actual se desconectará."
+    },
+    "profile.switch.confirm": {
+        "message": "Confirmar"
+    },
+    "profile.deregister.title": {
+        "message": "¿Anular el registro del perfil «{name}»?"
+    },
+    "profile.deregister.message": {
+        "message": "¿Seguro que desea anular el registro de este perfil?\nDeberá iniciar sesión de nuevo para usarlo."
+    },
+    "profile.deregister.confirm": {
+        "message": "Anular registro"
+    },
+    "profile.delete.title": {
+        "message": "¿Eliminar el perfil «{name}»?"
+    },
+    "profile.delete.message": {
+        "message": "¿Seguro que desea eliminar este perfil?\nEsta acción no se puede deshacer."
+    },
+    "profile.delete.disabledActive": {
+        "message": "Los perfiles activos no se pueden eliminar. Cambie a otro antes de eliminar este perfil."
+    },
+    "profile.delete.disabledDefault": {
+        "message": "El perfil predeterminado no se puede eliminar."
+    },
+    "profile.error.switchTitle": {
+        "message": "Error al cambiar de perfil"
+    },
+    "profile.error.deregisterTitle": {
+        "message": "Error al anular el registro del perfil"
+    },
+    "profile.error.deleteTitle": {
+        "message": "Error al eliminar el perfil"
+    },
+    "profile.error.createTitle": {
+        "message": "Error al crear el perfil"
+    },
+    "profile.error.editTitle": {
+        "message": "Error al editar el perfil"
+    },
+    "profile.error.loadTitle": {
+        "message": "Error al cargar los perfiles"
+    },
+    "profile.dropdown.activeProfile": {
+        "message": "Perfil activo"
+    },
+    "profile.dropdown.switchProfile": {
+        "message": "Cambiar de perfil"
+    },
+    "profile.dropdown.noEmail": {
+        "message": "Otro"
+    },
+    "profile.dropdown.addProfile": {
+        "message": "Añadir perfil"
+    },
+    "profile.dropdown.manageProfiles": {
+        "message": "Gestionar perfiles"
+    },
+    "profile.dropdown.settings": {
+        "message": "Configuración"
+    },
+    "settings.profiles.section.profiles": {
+        "message": "Perfiles"
+    },
+    "settings.profiles.intro": {
+        "message": "Mantenga identidades de NetBird independientes en paralelo, por ejemplo cuentas de trabajo y personales, o distintos servidores de gestión. Añada, anule el registro o elimine perfiles a continuación."
+    },
+    "settings.profiles.addProfile": {
+        "message": "Añadir perfil"
+    },
+    "settings.profiles.active": {
+        "message": "Activo"
+    },
+    "settings.profiles.emptyTitle": {
+        "message": "Sin perfiles"
+    },
+    "settings.profiles.emptyDescription": {
+        "message": "Cree un perfil para conectarse a un servidor de gestión de NetBird."
+    },
+    "settings.error.loadTitle": {
+        "message": "Error al cargar la configuración"
+    },
+    "settings.error.saveTitle": {
+        "message": "Error al guardar la configuración"
+    },
+    "settings.error.debugBundleTitle": {
+        "message": "Error en el paquete de diagnóstico"
+    },
+    "settings.tabs.general": {
+        "message": "General"
+    },
+    "settings.tabs.network": {
+        "message": "Red"
+    },
+    "settings.tabs.security": {
+        "message": "Seguridad"
+    },
+    "settings.tabs.profiles": {
+        "message": "Perfiles"
+    },
+    "settings.tabs.ssh": {
+        "message": "SSH"
+    },
+    "settings.tabs.advanced": {
+        "message": "Avanzado"
+    },
+    "settings.tabs.troubleshooting": {
+        "message": "Solución de problemas"
+    },
+    "settings.tabs.about": {
+        "message": "Acerca de"
+    },
+    "settings.tabs.updateAvailable": {
+        "message": "Actualización disponible"
+    },
+    "settings.general.section.general": {
+        "message": "General"
+    },
+    "settings.general.section.connection": {
+        "message": "Conexión"
+    },
+    "settings.general.connectOnStartup.label": {
+        "message": "Conectar al iniciar"
+    },
+    "settings.general.connectOnStartup.help": {
+        "message": "Establece una conexión automáticamente cuando se inicia el servicio."
+    },
+    "settings.general.notifications.label": {
+        "message": "Notificaciones de escritorio"
+    },
+    "settings.general.notifications.help": {
+        "message": "Muestra notificaciones de escritorio para nuevas actualizaciones y eventos de conexión."
+    },
+    "settings.general.autostart.label": {
+        "message": "Iniciar la interfaz de NetBird al iniciar sesión"
+    },
+    "settings.general.autostart.help": {
+        "message": "Inicia la interfaz de NetBird automáticamente al iniciar sesión. Esto afecta solo a la interfaz gráfica, no al servicio en segundo plano."
+    },
+    "settings.general.autostart.errorTitle": {
+        "message": "Error al cambiar el inicio automático"
+    },
+    "settings.general.language.label": {
+        "message": "Idioma de la interfaz"
+    },
+    "settings.general.language.help": {
+        "message": "Elija el idioma de la interfaz de NetBird."
+    },
+    "settings.general.language.search": {
+        "message": "Buscar idioma…"
+    },
+    "settings.general.language.empty": {
+        "message": "Ningún idioma coincide."
+    },
+    "settings.general.management.label": {
+        "message": "Servidor de gestión"
+    },
+    "settings.general.management.help": {
+        "message": "Conéctese a NetBird Cloud o a su propio servidor de gestión autoalojado. Los cambios reconectarán el cliente."
+    },
+    "settings.general.management.cloud": {
+        "message": "Cloud"
+    },
+    "settings.general.management.selfHosted": {
+        "message": "Autoalojado"
+    },
+    "settings.general.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlError": {
+        "message": "Introduzca una URL válida, p. ej., https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlUnreachable": {
+        "message": "No se pudo contactar con este servidor. Compruebe la URL o guarde de todos modos si está seguro de que es correcta."
+    },
+    "settings.general.management.switchCloudTitle": {
+        "message": "¿Cambiar a NetBird Cloud?"
+    },
+    "settings.general.management.switchCloudMessage": {
+        "message": "Esto desconecta su servidor autoalojado.\nEs posible que deba iniciar sesión de nuevo."
+    },
+    "settings.general.management.switchCloudConfirm": {
+        "message": "Cambiar a Cloud"
+    },
+    "settings.network.section.connectivity": {
+        "message": "Conectividad"
+    },
+    "settings.network.section.routingDns": {
+        "message": "Enrutamiento y DNS"
+    },
+    "settings.network.monitor.label": {
+        "message": "Reconectar al cambiar de red"
+    },
+    "settings.network.monitor.help": {
+        "message": "Monitoriza la red y reconecta automáticamente ante cambios como cambios de Wi-Fi, cambios de Ethernet o la reanudación tras la suspensión."
+    },
+    "settings.network.dns.label": {
+        "message": "Habilitar DNS"
+    },
+    "settings.network.dns.help": {
+        "message": "Aplica la configuración de DNS gestionada por NetBird al resolutor del host."
+    },
+    "settings.network.clientRoutes.label": {
+        "message": "Habilitar rutas de cliente"
+    },
+    "settings.network.clientRoutes.help": {
+        "message": "Acepta rutas de otros peers para alcanzar sus redes."
+    },
+    "settings.network.serverRoutes.label": {
+        "message": "Habilitar rutas de servidor"
+    },
+    "settings.network.serverRoutes.help": {
+        "message": "Anuncia las rutas locales de este host a otros peers."
+    },
+    "settings.network.ipv6.label": {
+        "message": "Habilitar IPv6"
+    },
+    "settings.network.ipv6.help": {
+        "message": "Usa direccionamiento IPv6 para la red superpuesta de NetBird."
+    },
+    "settings.security.section.firewall": {
+        "message": "Cortafuegos"
+    },
+    "settings.security.section.encryption": {
+        "message": "Cifrado"
+    },
+    "settings.security.blockInbound.label": {
+        "message": "Bloquear tráfico entrante"
+    },
+    "settings.security.blockInbound.help": {
+        "message": "Rechaza conexiones no solicitadas de peers hacia este dispositivo y cualquier red que enrute. El tráfico saliente no se ve afectado."
+    },
+    "settings.security.blockLan.label": {
+        "message": "Bloquear acceso a la LAN"
+    },
+    "settings.security.blockLan.help": {
+        "message": "Impide que los peers alcancen su red local o sus dispositivos cuando este dispositivo enruta su tráfico."
+    },
+    "settings.security.rosenpass.label": {
+        "message": "Habilitar resistencia cuántica"
+    },
+    "settings.security.rosenpass.help": {
+        "message": "Añade un intercambio de claves poscuántico mediante Rosenpass sobre WireGuard®."
+    },
+    "settings.security.rosenpassPermissive.label": {
+        "message": "Habilitar modo permisivo"
+    },
+    "settings.security.rosenpassPermissive.help": {
+        "message": "Permite conexiones con peers sin compatibilidad con resistencia cuántica."
+    },
+    "settings.ssh.section.server": {
+        "message": "Servidor"
+    },
+    "settings.ssh.section.capabilities": {
+        "message": "Capacidades"
+    },
+    "settings.ssh.section.authentication": {
+        "message": "Autenticación"
+    },
+    "settings.ssh.server.label": {
+        "message": "Habilitar el servidor SSH"
+    },
+    "settings.ssh.server.help": {
+        "message": "Ejecuta el servidor SSH de NetBird en este host para que otros peers puedan conectarse a él."
+    },
+    "settings.ssh.root.label": {
+        "message": "Permitir inicio de sesión como root"
+    },
+    "settings.ssh.root.help": {
+        "message": "Permite que los peers inicien sesión como usuario root. Desactívelo para exigir una cuenta sin privilegios."
+    },
+    "settings.ssh.sftp.label": {
+        "message": "Permitir SFTP"
+    },
+    "settings.ssh.sftp.help": {
+        "message": "Transfiere archivos de forma segura mediante clientes SFTP o SCP nativos."
+    },
+    "settings.ssh.localForward.label": {
+        "message": "Reenvío de puertos local"
+    },
+    "settings.ssh.localForward.help": {
+        "message": "Permite que los peers conectados tunelicen puertos locales hacia servicios accesibles desde este host."
+    },
+    "settings.ssh.remoteForward.label": {
+        "message": "Reenvío de puertos remoto"
+    },
+    "settings.ssh.remoteForward.help": {
+        "message": "Permite que los peers conectados expongan puertos de este host de vuelta a su propia máquina."
+    },
+    "settings.ssh.jwt.label": {
+        "message": "Habilitar autenticación JWT"
+    },
+    "settings.ssh.jwt.help": {
+        "message": "Verifica cada sesión SSH contra su IdP para la identidad del usuario y la auditoría. Desactívelo para basarse solo en las políticas de ACL de red, útil cuando no hay ningún IdP disponible."
+    },
+    "settings.ssh.jwtTtl.label": {
+        "message": "TTL de la caché JWT"
+    },
+    "settings.ssh.jwtTtl.help": {
+        "message": "Cuánto tiempo almacena en caché este cliente un JWT antes de volver a solicitarlo en conexiones SSH salientes. Establézcalo en 0 para desactivar la caché y autenticar en cada conexión."
+    },
+    "settings.ssh.jwtTtl.suffix": {
+        "message": "s"
+    },
+    "settings.advanced.section.interface": {
+        "message": "Interfaz"
+    },
+    "settings.advanced.section.security": {
+        "message": "Seguridad"
+    },
+    "settings.advanced.interfaceName.label": {
+        "message": "Nombre"
+    },
+    "settings.advanced.interfaceName.error": {
+        "message": "Use de 1 a 15 letras, dígitos, puntos, guiones o guiones bajos."
+    },
+    "settings.advanced.interfaceName.errorMac": {
+        "message": "Debe empezar por \"utun\" seguido de un número (p. ej. utun100)."
+    },
+    "settings.advanced.port.label": {
+        "message": "Puerto"
+    },
+    "settings.advanced.port.error": {
+        "message": "Introduzca un puerto entre {min} y {max}."
+    },
+    "settings.advanced.port.help": {
+        "message": "Si se establece en 0, se usará un puerto libre aleatorio."
+    },
+    "settings.advanced.mtu.label": {
+        "message": "MTU"
+    },
+    "settings.advanced.mtu.error": {
+        "message": "Introduzca un valor de MTU entre {min} y {max}."
+    },
+    "settings.advanced.psk.label": {
+        "message": "Clave precompartida"
+    },
+    "settings.advanced.psk.help": {
+        "message": "PSK de WireGuard opcional para cifrado simétrico adicional. No es lo mismo que una clave de instalación de NetBird. Solo se comunicará con peers que usen la misma clave precompartida."
+    },
+    "settings.troubleshooting.section.title": {
+        "message": "Paquete de diagnóstico"
+    },
+    "settings.troubleshooting.anonymize.label": {
+        "message": "Anonimizar información sensible"
+    },
+    "settings.troubleshooting.anonymize.help": {
+        "message": "Oculta las direcciones IP públicas y los dominios ajenos a NetBird de los registros."
+    },
+    "settings.troubleshooting.systemInfo.label": {
+        "message": "Incluir información del sistema"
+    },
+    "settings.troubleshooting.systemInfo.help": {
+        "message": "Incluye el OS, el kernel, las interfaces de red y las tablas de enrutamiento."
+    },
+    "settings.troubleshooting.upload.label": {
+        "message": "Subir el paquete a los servidores de NetBird"
+    },
+    "settings.troubleshooting.upload.help": {
+        "message": "Devuelve una clave de subida para compartir con el soporte de NetBird."
+    },
+    "settings.troubleshooting.trace.label": {
+        "message": "Activar registros de seguimiento"
+    },
+    "settings.troubleshooting.trace.help": {
+        "message": "Eleva el nivel de registro a TRACE y lo restaura después."
+    },
+    "settings.troubleshooting.capture.label": {
+        "message": "Sesión de captura"
+    },
+    "settings.troubleshooting.capture.help": {
+        "message": "Vuelve a conectar y espera para que pueda reproducir el problema."
+    },
+    "settings.troubleshooting.packets.label": {
+        "message": "Capturar paquetes de red"
+    },
+    "settings.troubleshooting.packets.help": {
+        "message": "Guarda un .pcap del tráfico de red durante la sesión de captura."
+    },
+    "settings.troubleshooting.duration.label": {
+        "message": "Duración de la captura"
+    },
+    "settings.troubleshooting.duration.help": {
+        "message": "Cuánto tiempo se ejecuta la sesión de captura."
+    },
+    "settings.troubleshooting.duration.suffix": {
+        "message": "min"
+    },
+    "settings.troubleshooting.create": {
+        "message": "Crear paquete"
+    },
+    "settings.troubleshooting.progress.description": {
+        "message": "Recopilando registros, detalles del sistema y estado de la conexión. Esto suele tardar un momento; mantenga esta ventana abierta hasta que termine."
+    },
+    "settings.troubleshooting.cancelling": {
+        "message": "Cancelando…"
+    },
+    "settings.troubleshooting.done.uploadedTitle": {
+        "message": "¡Paquete de diagnóstico subido correctamente!"
+    },
+    "settings.troubleshooting.done.savedTitle": {
+        "message": "Paquete guardado"
+    },
+    "settings.troubleshooting.done.uploadedDescription": {
+        "message": "Comparta la clave de subida de abajo con el <docs>soporte de NetBird</docs>. También se guardó una copia local en su dispositivo."
+    },
+    "settings.troubleshooting.done.savedDescription": {
+        "message": "Su paquete de diagnóstico se ha guardado localmente."
+    },
+    "settings.troubleshooting.done.copyKey": {
+        "message": "Copiar clave"
+    },
+    "settings.troubleshooting.done.openFolder": {
+        "message": "Abrir carpeta"
+    },
+    "settings.troubleshooting.done.openFileLocation": {
+        "message": "Abrir ubicación del archivo"
+    },
+    "settings.troubleshooting.uploadFailedWithReason": {
+        "message": "Error en la subida: {reason} El paquete sigue guardado localmente."
+    },
+    "settings.troubleshooting.uploadFailed": {
+        "message": "Error en la subida. El paquete sigue guardado localmente."
+    },
+    "settings.troubleshooting.stage.reconnecting": {
+        "message": "Reconectando NetBird…"
+    },
+    "settings.troubleshooting.stage.capturing": {
+        "message": "Capturando registros de depuración"
+    },
+    "settings.troubleshooting.stage.bundling": {
+        "message": "Generando el paquete de diagnóstico…"
+    },
+    "settings.troubleshooting.stage.uploading": {
+        "message": "Subiendo a NetBird…"
+    },
+    "settings.troubleshooting.stage.cancelling": {
+        "message": "Cancelando…"
+    },
+    "settings.about.client": {
+        "message": "NetBird Client v{version}"
+    },
+    "settings.about.clientName": {
+        "message": "NetBird Client"
+    },
+    "settings.about.development": {
+        "message": "[Desarrollo]"
+    },
+    "settings.about.gui": {
+        "message": "GUI v{version}"
+    },
+    "settings.about.guiName": {
+        "message": "GUI"
+    },
+    "settings.about.copyright": {
+        "message": "© {year} NetBird. Todos los derechos reservados."
+    },
+    "settings.about.links.imprint": {
+        "message": "Aviso legal"
+    },
+    "settings.about.links.privacy": {
+        "message": "Privacidad"
+    },
+    "settings.about.links.cla": {
+        "message": "CLA"
+    },
+    "settings.about.links.terms": {
+        "message": "Términos del servicio"
+    },
+    "settings.about.community.github": {
+        "message": "GitHub"
+    },
+    "settings.about.community.slack": {
+        "message": "Slack"
+    },
+    "settings.about.community.forum": {
+        "message": "Foro"
+    },
+    "settings.about.community.documentation": {
+        "message": "Documentación"
+    },
+    "settings.about.community.feedback": {
+        "message": "Comentarios"
+    },
+    "update.banner.message": {
+        "message": "NetBird {version} está listo para instalar."
+    },
+    "update.banner.later": {
+        "message": "Más tarde"
+    },
+    "update.banner.installNow": {
+        "message": "Instalar ahora"
+    },
+    "update.card.versionAvailableDownload": {
+        "message": "La versión {version} está disponible para descargar."
+    },
+    "update.card.versionAvailableInstall": {
+        "message": "La versión {version} está disponible para instalar."
+    },
+    "update.card.whatsNew": {
+        "message": "¿Qué hay de nuevo?"
+    },
+    "update.card.installNow": {
+        "message": "Instalar ahora"
+    },
+    "update.card.getInstaller": {
+        "message": "Descargar"
+    },
+    "update.card.autoCheckInterval": {
+        "message": "NetBird busca actualizaciones en segundo plano."
+    },
+    "update.card.changelog": {
+        "message": "Registro de cambios"
+    },
+    "update.card.onLatestVersion": {
+        "message": "Tiene la última versión"
+    },
+    "update.header.tooltip": {
+        "message": "Actualización disponible"
+    },
+    "update.overlay.updatingVersion": {
+        "message": "Actualizando NetBird a v{version}"
+    },
+    "update.overlay.updating": {
+        "message": "Actualizando NetBird"
+    },
+    "update.overlay.description": {
+        "message": "Hay una versión más reciente disponible y se está instalando. NetBird se reiniciará automáticamente cuando finalice la actualización."
+    },
+    "update.overlay.error.timeoutTitle": {
+        "message": "La actualización está tardando demasiado"
+    },
+    "update.overlay.error.timeoutDescription": {
+        "message": "La instalación de {target} tardó demasiado y no finalizó."
+    },
+    "update.overlay.error.canceledTitle": {
+        "message": "La actualización se detuvo"
+    },
+    "update.overlay.error.canceledDescription": {
+        "message": "La actualización a {target} se canceló antes de finalizar."
+    },
+    "update.overlay.error.failTitle": {
+        "message": "No se pudo instalar la actualización"
+    },
+    "update.overlay.error.failDescription": {
+        "message": "No se pudo instalar {target}."
+    },
+    "update.overlay.error.unknownMessage": {
+        "message": "error desconocido"
+    },
+    "update.overlay.error.targetVersion": {
+        "message": "v{version}"
+    },
+    "update.overlay.error.targetFallback": {
+        "message": "la nueva versión"
+    },
+    "update.error.loadStateTitle": {
+        "message": "Error al cargar el estado de la actualización"
+    },
+    "update.error.triggerTitle": {
+        "message": "Error al iniciar la actualización"
+    },
+    "update.page.versionLine": {
+        "message": "Actualizando el cliente a: {version}."
+    },
+    "update.page.versionLineGeneric": {
+        "message": "Actualizando el cliente."
+    },
+    "update.page.outdated": {
+        "message": "La versión de su cliente es anterior a la versión de actualización automática configurada en Management."
+    },
+    "update.page.status.running": {
+        "message": "Actualizando"
+    },
+    "update.page.status.timeout": {
+        "message": "Se agotó el tiempo de la actualización. Inténtelo de nuevo."
+    },
+    "update.page.status.canceled": {
+        "message": "Actualización cancelada."
+    },
+    "update.page.status.failed": {
+        "message": "Error en la actualización: {message}"
+    },
+    "update.page.status.unknownError": {
+        "message": "error de actualización desconocido"
+    },
+    "update.page.failedTitle": {
+        "message": "Error en la actualización"
+    },
+    "update.page.timeoutMessage": {
+        "message": "Se agotó el tiempo de la actualización."
+    },
+    "update.page.dontClose": {
+        "message": "No cierre esta ventana."
+    },
+    "update.page.updating": {
+        "message": "Actualizando…"
+    },
+    "update.page.complete": {
+        "message": "Actualización completada"
+    },
+    "update.page.failed": {
+        "message": "Error en la actualización"
+    },
+    "window.title.settings": {
+        "message": "Configuración"
+    },
+    "window.title.signIn": {
+        "message": "Inicio de sesión"
+    },
+    "window.title.sessionExpiration": {
+        "message": "Sesión a punto de expirar"
+    },
+    "window.title.updating": {
+        "message": "Actualizando"
+    },
+    "window.title.welcome": {
+        "message": "Bienvenido a NetBird"
+    },
+    "window.title.error": {
+        "message": "Error"
+    },
+    "welcome.title": {
+        "message": "Busque NetBird en su bandeja del sistema"
+    },
+    "welcome.description": {
+        "message": "NetBird reside en su bandeja del sistema. Haga clic en el icono para conectarse, cambiar de perfil o abrir la configuración."
+    },
+    "welcome.continue": {
+        "message": "Continuar"
+    },
+    "welcome.back": {
+        "message": "Atrás"
+    },
+    "welcome.management.title": {
+        "message": "Configurar NetBird"
+    },
+    "welcome.management.description": {
+        "message": "Haga clic en Continuar para empezar, o elija Autoalojado si tiene su propio servidor de NetBird."
+    },
+    "welcome.management.cloud.title": {
+        "message": "NetBird Cloud"
+    },
+    "welcome.management.cloud.description": {
+        "message": "Use nuestro servicio alojado. No requiere configuración."
+    },
+    "welcome.management.selfHosted.title": {
+        "message": "Autoalojado"
+    },
+    "welcome.management.selfHosted.description": {
+        "message": "Conéctese a su propio servidor de gestión."
+    },
+    "welcome.management.urlLabel": {
+        "message": "URL del servidor de gestión"
+    },
+    "welcome.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlInvalid": {
+        "message": "Introduzca una URL válida, p. ej., https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlUnreachable": {
+        "message": "No se pudo contactar con este servidor. Compruebe la URL o su red y, a continuación, continúe si está seguro de que es correcta."
+    },
+    "welcome.management.checking": {
+        "message": "Comprobando…"
+    },
+    "browserLogin.title": {
+        "message": "Continúe en su navegador para completar el inicio de sesión"
+    },
+    "browserLogin.notSeeing": {
+        "message": "¿No ve la pestaña del navegador?"
+    },
+    "browserLogin.tryAgain": {
+        "message": "Reintentar"
+    },
+    "browserLogin.openFailedTitle": {
+        "message": "Error al abrir el navegador"
+    },
+    "sessionExpiration.title": {
+        "message": "La sesión expira pronto"
+    },
+    "sessionExpiration.titleLater": {
+        "message": "Su sesión expirará"
+    },
+    "sessionExpiration.description": {
+        "message": "Este dispositivo se desconectará pronto. Renuévela iniciando sesión en el navegador."
+    },
+    "sessionExpiration.descriptionLater": {
+        "message": "Iniciar sesión en el navegador mantiene este dispositivo conectado a su red."
+    },
+    "sessionExpiration.stay": {
+        "message": "Renovar sesión"
+    },
+    "sessionExpiration.authenticate": {
+        "message": "Autenticar"
+    },
+    "sessionExpiration.logout": {
+        "message": "Cerrar sesión"
+    },
+    "sessionExpiration.expired": {
+        "message": "Sesión expirada"
+    },
+    "sessionExpiration.expiredDescription": {
+        "message": "Dispositivo desconectado. Autentíquese iniciando sesión en el navegador para reconectar."
+    },
+    "sessionExpiration.close": {
+        "message": "Cerrar"
+    },
+    "sessionExpiration.extendFailedTitle": {
+        "message": "Error al renovar la sesión"
+    },
+    "sessionExpiration.logoutFailedTitle": {
+        "message": "Error al cerrar sesión"
+    },
+    "peers.search.placeholder": {
+        "message": "Buscar por nombre o IP"
+    },
+    "peers.filter.all": {
+        "message": "Todos"
+    },
+    "peers.filter.online": {
+        "message": "En línea"
+    },
+    "peers.filter.offline": {
+        "message": "Sin conexión"
+    },
+    "peers.empty.title": {
+        "message": "No hay peers disponibles"
+    },
+    "peers.empty.description": {
+        "message": "No tiene ningún peer disponible o no tiene acceso a ninguno de ellos."
+    },
+    "peers.details.domain": {
+        "message": "Dominio"
+    },
+    "peers.details.netbirdIp": {
+        "message": "IP de NetBird"
+    },
+    "peers.details.netbirdIpv6": {
+        "message": "IPv6 de NetBird"
+    },
+    "peers.details.publicKey": {
+        "message": "Clave pública"
+    },
+    "peers.details.connection": {
+        "message": "Conexión"
+    },
+    "peers.details.latency": {
+        "message": "Latencia"
+    },
+    "peers.details.lastHandshake": {
+        "message": "Último handshake"
+    },
+    "peers.details.statusSince": {
+        "message": "Última actualización de la conexión"
+    },
+    "peers.details.bytes": {
+        "message": "Bytes"
+    },
+    "peers.details.bytesSent": {
+        "message": "Enviados"
+    },
+    "peers.details.bytesReceived": {
+        "message": "Recibidos"
+    },
+    "peers.details.localIce": {
+        "message": "ICE local"
+    },
+    "peers.details.remoteIce": {
+        "message": "ICE remoto"
+    },
+    "peers.details.never": {
+        "message": "Nunca"
+    },
+    "peers.details.justNow": {
+        "message": "Justo ahora"
+    },
+    "peers.details.refresh": {
+        "message": "Actualizar"
+    },
+    "peers.status.connected": {
+        "message": "Conectado"
+    },
+    "peers.status.connecting": {
+        "message": "Conectando"
+    },
+    "peers.status.disconnected": {
+        "message": "Desconectado"
+    },
+    "peers.details.relayAddress": {
+        "message": "Relay"
+    },
+    "peers.details.networks": {
+        "message": "Recursos"
+    },
+    "peers.details.relayed": {
+        "message": "Retransmitida"
+    },
+    "peers.details.p2p": {
+        "message": "P2P"
+    },
+    "peers.details.rosenpass": {
+        "message": "Rosenpass habilitado"
+    },
+    "networks.search.placeholder": {
+        "message": "Buscar por red o dominio"
+    },
+    "networks.filter.all": {
+        "message": "Todos"
+    },
+    "networks.filter.active": {
+        "message": "Activos"
+    },
+    "networks.filter.overlapping": {
+        "message": "Solapados"
+    },
+    "networks.empty.title": {
+        "message": "No hay recursos disponibles"
+    },
+    "networks.empty.description": {
+        "message": "No tiene ningún recurso de red disponible o no tiene acceso a ninguno de ellos."
+    },
+    "networks.selected": {
+        "message": "Seleccionado"
+    },
+    "networks.unselected": {
+        "message": "No seleccionado"
+    },
+    "networks.ips.heading": {
+        "message": "IP resueltas"
+    },
+    "networks.bulk.selectionCount": {
+        "message": "{selected} de {total} activos"
+    },
+    "networks.bulk.enableAll": {
+        "message": "Habilitar todos"
+    },
+    "networks.bulk.disableAll": {
+        "message": "Deshabilitar todos"
+    },
+    "exitNodes.search.placeholder": {
+        "message": "Buscar nodos de salida"
+    },
+    "exitNodes.none": {
+        "message": "Ninguno"
+    },
+    "exitNodes.empty.title": {
+        "message": "No hay nodos de salida disponibles"
+    },
+    "exitNodes.empty.description": {
+        "message": "No se ha compartido ningún nodo de salida con este peer."
+    },
+    "exitNodes.card.title": {
+        "message": "Nodo de salida"
+    },
+    "exitNodes.card.statusActive": {
+        "message": "Activo"
+    },
+    "exitNodes.card.statusInactive": {
+        "message": "Inactivo"
+    },
+    "exitNodes.dropdown.noneTitle": {
+        "message": "Ninguno"
+    },
+    "exitNodes.dropdown.noneDescription": {
+        "message": "Conexión directa sin nodo de salida"
+    },
+    "quickActions.connect": {
+        "message": "Conectar"
+    },
+    "quickActions.disconnect": {
+        "message": "Desconectar"
+    },
+    "daemon.unavailable.title": {
+        "message": "El servicio de NetBird no está en ejecución"
+    },
+    "daemon.unavailable.description": {
+        "message": "La aplicación se reconectará automáticamente cuando el servicio esté en ejecución."
+    },
+    "daemon.unavailable.docsLink": {
+        "message": "Documentación"
+    },
+    "daemon.outdated.title": {
+        "message": "El servicio de NetBird está desactualizado"
+    },
+    "daemon.outdated.description": {
+        "message": "Actualice el servicio de NetBird para usar esta aplicación."
+    },
+    "error.jwt_clock_skew": {
+        "message": "Error al iniciar sesión: el reloj de este dispositivo no está sincronizado con el servidor. Sincronice el reloj del sistema e inténtelo de nuevo."
+    },
+    "error.jwt_expired": {
+        "message": "Su token de inicio de sesión ha expirado. Inicie sesión de nuevo."
+    },
+    "error.jwt_signature_invalid": {
+        "message": "Error al iniciar sesión: la firma del token no es válida. Póngase en contacto con su administrador."
+    },
+    "error.session_expired": {
+        "message": "Su sesión ha expirado. Inicie sesión de nuevo."
+    },
+    "error.invalid_setup_key": {
+        "message": "La clave de instalación falta o no es válida."
+    },
+    "error.permission_denied": {
+        "message": "El servidor rechazó el inicio de sesión."
+    },
+    "error.daemon_unreachable": {
+        "message": "El daemon de NetBird no responde. Compruebe que el servicio esté en ejecución."
+    },
+    "error.unknown": {
+        "message": "La operación falló."
+    }
+}
diff --git a/client/ui/i18n/locales/fr/common.json b/client/ui/i18n/locales/fr/common.json
new file mode 100644
index 000000000..be0836e93
--- /dev/null
+++ b/client/ui/i18n/locales/fr/common.json
@@ -0,0 +1,1325 @@
+{
+    "tray.tooltip": {
+        "message": "NetBird"
+    },
+    "tray.status.disconnected": {
+        "message": "Déconnecté"
+    },
+    "tray.status.daemonUnavailable": {
+        "message": "Non démarré"
+    },
+    "tray.status.error": {
+        "message": "Erreur"
+    },
+    "tray.status.connected": {
+        "message": "Connecté"
+    },
+    "tray.status.connecting": {
+        "message": "Connexion"
+    },
+    "tray.status.needsLogin": {
+        "message": "Connexion requise"
+    },
+    "tray.status.loginFailed": {
+        "message": "Échec de la connexion"
+    },
+    "tray.status.sessionExpired": {
+        "message": "Session expirée"
+    },
+    "tray.session.expiresIn": {
+        "message": "La session expire dans {remaining}"
+    },
+    "tray.session.unit.lessThanMinute": {
+        "message": "moins d’une minute"
+    },
+    "tray.session.unit.minute": {
+        "message": "1 minute"
+    },
+    "tray.session.unit.minutes": {
+        "message": "{count} minutes"
+    },
+    "tray.session.unit.hour": {
+        "message": "1 heure"
+    },
+    "tray.session.unit.hours": {
+        "message": "{count} heures"
+    },
+    "tray.session.unit.day": {
+        "message": "1 jour"
+    },
+    "tray.session.unit.days": {
+        "message": "{count} jours"
+    },
+    "tray.menu.open": {
+        "message": "Ouvrir NetBird"
+    },
+    "tray.menu.connect": {
+        "message": "Se connecter"
+    },
+    "tray.menu.disconnect": {
+        "message": "Se déconnecter"
+    },
+    "tray.menu.exitNode": {
+        "message": "Nœud de sortie"
+    },
+    "tray.menu.networks": {
+        "message": "Ressources"
+    },
+    "tray.menu.profiles": {
+        "message": "Profils"
+    },
+    "tray.menu.manageProfiles": {
+        "message": "Gérer les profils"
+    },
+    "tray.menu.settings": {
+        "message": "Paramètres..."
+    },
+    "tray.menu.debugBundle": {
+        "message": "Créer un lot de diagnostic"
+    },
+    "tray.menu.about": {
+        "message": "Aide et assistance"
+    },
+    "tray.menu.github": {
+        "message": "GitHub"
+    },
+    "tray.menu.documentation": {
+        "message": "Documentation"
+    },
+    "tray.menu.troubleshoot": {
+        "message": "Dépannage"
+    },
+    "tray.menu.downloadLatest": {
+        "message": "Télécharger la dernière version"
+    },
+    "tray.menu.installVersion": {
+        "message": "Installer la version {version}"
+    },
+    "tray.menu.guiVersion": {
+        "message": "GUI : {version}"
+    },
+    "tray.menu.daemonVersion": {
+        "message": "Daemon : {version}"
+    },
+    "tray.menu.versionUnknown": {
+        "message": "—"
+    },
+    "tray.menu.quit": {
+        "message": "Quitter NetBird"
+    },
+    "notify.daemonOutdated.title": {
+        "message": "Le service NetBird est obsolète"
+    },
+    "notify.daemonOutdated.body": {
+        "message": "Mettez à jour le service NetBird pour utiliser cette application."
+    },
+    "notify.update.title": {
+        "message": "Mise à jour de NetBird disponible"
+    },
+    "notify.update.body": {
+        "message": "NetBird {version} est disponible."
+    },
+    "notify.update.enforcedSuffix": {
+        "message": " Votre administrateur impose cette mise à jour."
+    },
+    "notify.error.title": {
+        "message": "Erreur"
+    },
+    "notify.error.connect": {
+        "message": "Échec de la connexion"
+    },
+    "notify.error.disconnect": {
+        "message": "Échec de la déconnexion"
+    },
+    "notify.error.switchProfile": {
+        "message": "Échec du passage à {profile}"
+    },
+    "notify.error.exitNode": {
+        "message": "Échec de la mise à jour du nœud de sortie {name}"
+    },
+    "notify.sessionExpired.title": {
+        "message": "Session NetBird expirée"
+    },
+    "notify.sessionExpired.body": {
+        "message": "Votre session NetBird a expiré. Veuillez vous reconnecter."
+    },
+    "notify.sessionWarning.title": {
+        "message": "La session expire bientôt"
+    },
+    "notify.sessionWarning.body": {
+        "message": "Votre session NetBird expire dans {remaining}. Cliquez sur Prolonger pour la renouveler."
+    },
+    "notify.sessionWarning.bodyGeneric": {
+        "message": "Votre session NetBird est sur le point d’expirer. Cliquez sur Prolonger pour la renouveler."
+    },
+    "notify.sessionWarning.extend": {
+        "message": "Prolonger"
+    },
+    "notify.sessionWarning.dismiss": {
+        "message": "Ignorer"
+    },
+    "notify.sessionWarning.failed": {
+        "message": "Échec de la prolongation de la session NetBird"
+    },
+    "notify.sessionWarning.successTitle": {
+        "message": "Session NetBird prolongée"
+    },
+    "notify.sessionWarning.successBody": {
+        "message": "Votre session a été renouvelée."
+    },
+    "notify.sessionDeadlineRejected.title": {
+        "message": "Échéance de session rejetée"
+    },
+    "notify.sessionDeadlineRejected.body": {
+        "message": "Le serveur a envoyé une échéance de session invalide. Veuillez vous reconnecter."
+    },
+    "notify.mdm.policyApplied.title": {
+        "message": "Paramètres NetBird mis à jour"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "Votre configuration NetBird a été mise à jour par votre politique informatique."
+    },
+    "common.cancel": {
+        "message": "Annuler"
+    },
+    "common.save": {
+        "message": "Enregistrer"
+    },
+    "common.saveChanges": {
+        "message": "Enregistrer les modifications"
+    },
+    "common.saving": {
+        "message": "Enregistrement…"
+    },
+    "common.close": {
+        "message": "Fermer"
+    },
+    "common.copy": {
+        "message": "Copier"
+    },
+    "common.togglePasswordVisibility": {
+        "message": "Afficher ou masquer le mot de passe"
+    },
+    "common.increase": {
+        "message": "Augmenter"
+    },
+    "common.decrease": {
+        "message": "Diminuer"
+    },
+    "common.delete": {
+        "message": "Supprimer"
+    },
+    "common.create": {
+        "message": "Créer"
+    },
+    "common.add": {
+        "message": "Ajouter"
+    },
+    "common.remove": {
+        "message": "Retirer"
+    },
+    "common.refresh": {
+        "message": "Actualiser"
+    },
+    "common.loading": {
+        "message": "Chargement…"
+    },
+    "common.netbird": {
+        "message": "NetBird"
+    },
+    "common.noResults.title": {
+        "message": "Aucun résultat trouvé"
+    },
+    "common.noResults.description": {
+        "message": "Nous n’avons trouvé aucun résultat. Essayez un autre terme de recherche ou modifiez vos filtres."
+    },
+    "notConnected.title": {
+        "message": "Déconnecté"
+    },
+    "notConnected.description": {
+        "message": "Connectez-vous d’abord à NetBird pour consulter les informations détaillées sur vos pairs, vos ressources réseau et vos nœuds de sortie."
+    },
+    "connect.status.disconnected": {
+        "message": "Déconnecté"
+    },
+    "connect.status.connecting": {
+        "message": "Connexion..."
+    },
+    "connect.status.connected": {
+        "message": "Connecté"
+    },
+    "connect.status.disconnecting": {
+        "message": "Déconnexion..."
+    },
+    "connect.status.daemonUnavailable": {
+        "message": "Daemon indisponible"
+    },
+    "connect.status.loginRequired": {
+        "message": "Connexion requise"
+    },
+    "connect.error.loginTitle": {
+        "message": "Échec de la connexion"
+    },
+    "connect.error.connectTitle": {
+        "message": "Échec de la connexion"
+    },
+    "connect.error.disconnectTitle": {
+        "message": "Échec de la déconnexion"
+    },
+    "nav.peers.title": {
+        "message": "Pairs"
+    },
+    "nav.peers.description": {
+        "message": "{connected} sur {total} connectés"
+    },
+    "nav.resources.title": {
+        "message": "Ressources"
+    },
+    "nav.resources.description": {
+        "message": "{active} sur {total} actives"
+    },
+    "nav.exitNode.title": {
+        "message": "Nœuds de sortie"
+    },
+    "nav.exitNode.none": {
+        "message": "Inactif"
+    },
+    "nav.exitNode.using": {
+        "message": "Via {name}"
+    },
+    "header.openSettings": {
+        "message": "Ouvrir les paramètres"
+    },
+    "header.togglePanel": {
+        "message": "Afficher ou masquer le panneau latéral"
+    },
+    "profile.selector.loading": {
+        "message": "Chargement..."
+    },
+    "profile.selector.noProfile": {
+        "message": "Aucun profil"
+    },
+    "profile.selector.searchPlaceholder": {
+        "message": "Rechercher un profil par nom..."
+    },
+    "profile.selector.emptyTitle": {
+        "message": "Aucun profil trouvé"
+    },
+    "profile.selector.emptyDescription": {
+        "message": "Essayez un autre terme de recherche ou créez un nouveau profil."
+    },
+    "profile.selector.newProfile": {
+        "message": "Nouveau profil"
+    },
+    "profile.selector.moreOptions": {
+        "message": "Plus d’options"
+    },
+    "profile.selector.deregister": {
+        "message": "Désinscrire"
+    },
+    "profile.selector.delete": {
+        "message": "Supprimer"
+    },
+    "profile.selector.switchTo": {
+        "message": "Basculer vers ce profil"
+    },
+    "profile.selector.edit": {
+        "message": "Modifier"
+    },
+    "profile.edit.title": {
+        "message": "Modifier le profil"
+    },
+    "profile.edit.submit": {
+        "message": "Enregistrer les modifications"
+    },
+    "profile.dialog.title": {
+        "message": "Saisir le nom du profil"
+    },
+    "profile.dialog.nameLabel": {
+        "message": "Nom du profil"
+    },
+    "profile.dialog.description": {
+        "message": "Choisissez un nom facilement identifiable pour votre profil."
+    },
+    "profile.dialog.placeholder": {
+        "message": "ex. travail"
+    },
+    "profile.dialog.submit": {
+        "message": "Ajouter un profil"
+    },
+    "profile.dialog.required": {
+        "message": "Veuillez saisir un nom de profil, ex. travail, domicile"
+    },
+    "profile.dialog.managementHelp": {
+        "message": "Utilisez NetBird Cloud ou votre propre serveur."
+    },
+    "profile.dialog.urlUnreachable": {
+        "message": "Impossible de joindre ce serveur. Vérifiez l’URL, ou ajoutez le profil quand même si vous êtes sûr qu’elle est correcte."
+    },
+    "header.menu.settings": {
+        "message": "Paramètres..."
+    },
+    "header.menu.defaultView": {
+        "message": "Vue par défaut"
+    },
+    "header.menu.advancedView": {
+        "message": "Vue avancée"
+    },
+    "header.menu.updateAvailable": {
+        "message": "Mise à jour disponible"
+    },
+    "header.menu.open": {
+        "message": "Ouvrir le menu"
+    },
+    "header.profile.switch": {
+        "message": "Changer de profil"
+    },
+    "connect.toggle.label": {
+        "message": "Activer/désactiver la connexion NetBird"
+    },
+    "connect.localIp.label": {
+        "message": "Adresses IP locales"
+    },
+    "common.search": {
+        "message": "Rechercher"
+    },
+    "common.filter": {
+        "message": "Filtrer"
+    },
+    "exitNodes.dropdown.trigger": {
+        "message": "Sélectionner un nœud de sortie"
+    },
+    "peers.row.label": {
+        "message": "Ouvrir les détails pour {name}, {status}"
+    },
+    "peers.dialog.title": {
+        "message": "Détails du pair"
+    },
+    "networks.row.toggle": {
+        "message": "Activer/désactiver {name}"
+    },
+    "networks.bulk.label": {
+        "message": "Activer/désactiver toutes les ressources visibles"
+    },
+    "settings.nav.label": {
+        "message": "Sections des paramètres"
+    },
+    "profile.switch.title": {
+        "message": "Basculer vers le profil « {name} » ?"
+    },
+    "profile.switch.message": {
+        "message": "Voulez-vous vraiment changer de profil ?\nVotre profil actuel sera déconnecté."
+    },
+    "profile.switch.confirm": {
+        "message": "Confirmer"
+    },
+    "profile.deregister.title": {
+        "message": "Désinscrire le profil « {name} » ?"
+    },
+    "profile.deregister.message": {
+        "message": "Voulez-vous vraiment désinscrire ce profil ?\nVous devrez vous reconnecter pour l’utiliser."
+    },
+    "profile.deregister.confirm": {
+        "message": "Désinscrire"
+    },
+    "profile.delete.title": {
+        "message": "Supprimer le profil « {name} » ?"
+    },
+    "profile.delete.message": {
+        "message": "Voulez-vous vraiment supprimer ce profil ?\nCette action est irréversible."
+    },
+    "profile.delete.disabledActive": {
+        "message": "Les profils actifs ne peuvent pas être supprimés. Basculez vers un autre profil avant de supprimer celui-ci."
+    },
+    "profile.delete.disabledDefault": {
+        "message": "Le profil par défaut ne peut pas être supprimé."
+    },
+    "profile.error.switchTitle": {
+        "message": "Échec du changement de profil"
+    },
+    "profile.error.deregisterTitle": {
+        "message": "Échec de la désinscription du profil"
+    },
+    "profile.error.deleteTitle": {
+        "message": "Échec de la suppression du profil"
+    },
+    "profile.error.createTitle": {
+        "message": "Échec de la création du profil"
+    },
+    "profile.error.editTitle": {
+        "message": "Échec de la modification du profil"
+    },
+    "profile.error.loadTitle": {
+        "message": "Échec du chargement des profils"
+    },
+    "profile.dropdown.activeProfile": {
+        "message": "Profil actif"
+    },
+    "profile.dropdown.switchProfile": {
+        "message": "Changer de profil"
+    },
+    "profile.dropdown.noEmail": {
+        "message": "Autre"
+    },
+    "profile.dropdown.addProfile": {
+        "message": "Ajouter un profil"
+    },
+    "profile.dropdown.manageProfiles": {
+        "message": "Gérer les profils"
+    },
+    "profile.dropdown.settings": {
+        "message": "Paramètres"
+    },
+    "settings.profiles.section.profiles": {
+        "message": "Profils"
+    },
+    "settings.profiles.intro": {
+        "message": "Conservez plusieurs identités NetBird côte à côte, par exemple des comptes professionnels et personnels, ou différents serveurs de gestion. Ajoutez, désinscrivez ou supprimez des profils ci-dessous."
+    },
+    "settings.profiles.addProfile": {
+        "message": "Ajouter un profil"
+    },
+    "settings.profiles.active": {
+        "message": "Actif"
+    },
+    "settings.profiles.emptyTitle": {
+        "message": "Aucun profil"
+    },
+    "settings.profiles.emptyDescription": {
+        "message": "Créez un profil pour vous connecter à un serveur de gestion NetBird."
+    },
+    "settings.error.loadTitle": {
+        "message": "Échec du chargement des paramètres"
+    },
+    "settings.error.saveTitle": {
+        "message": "Échec de l’enregistrement des paramètres"
+    },
+    "settings.error.debugBundleTitle": {
+        "message": "Échec du lot de diagnostic"
+    },
+    "settings.tabs.general": {
+        "message": "Général"
+    },
+    "settings.tabs.network": {
+        "message": "Réseau"
+    },
+    "settings.tabs.security": {
+        "message": "Sécurité"
+    },
+    "settings.tabs.profiles": {
+        "message": "Profils"
+    },
+    "settings.tabs.ssh": {
+        "message": "SSH"
+    },
+    "settings.tabs.advanced": {
+        "message": "Avancé"
+    },
+    "settings.tabs.troubleshooting": {
+        "message": "Dépannage"
+    },
+    "settings.tabs.about": {
+        "message": "À propos"
+    },
+    "settings.tabs.updateAvailable": {
+        "message": "Mise à jour disponible"
+    },
+    "settings.general.section.general": {
+        "message": "Général"
+    },
+    "settings.general.section.connection": {
+        "message": "Connexion"
+    },
+    "settings.general.connectOnStartup.label": {
+        "message": "Se connecter au démarrage"
+    },
+    "settings.general.connectOnStartup.help": {
+        "message": "Établir automatiquement une connexion au démarrage du service."
+    },
+    "settings.general.notifications.label": {
+        "message": "Notifications du bureau"
+    },
+    "settings.general.notifications.help": {
+        "message": "Afficher des notifications du bureau pour les nouvelles mises à jour et les événements de connexion."
+    },
+    "settings.general.autostart.label": {
+        "message": "Lancer l’interface NetBird à l’ouverture de session"
+    },
+    "settings.general.autostart.help": {
+        "message": "Démarrer automatiquement l’interface NetBird à l’ouverture de votre session. Cela n’affecte que l’interface graphique, pas le service en arrière-plan."
+    },
+    "settings.general.autostart.errorTitle": {
+        "message": "Échec de la modification du démarrage automatique"
+    },
+    "settings.general.language.label": {
+        "message": "Langue d’affichage"
+    },
+    "settings.general.language.help": {
+        "message": "Choisissez la langue de l’interface NetBird."
+    },
+    "settings.general.language.search": {
+        "message": "Rechercher une langue…"
+    },
+    "settings.general.language.empty": {
+        "message": "Aucune langue ne correspond."
+    },
+    "settings.general.management.label": {
+        "message": "Serveur de gestion"
+    },
+    "settings.general.management.help": {
+        "message": "Connectez-vous à NetBird Cloud ou à votre propre serveur de gestion auto-hébergé. Les modifications reconnecteront le client."
+    },
+    "settings.general.management.cloud": {
+        "message": "Cloud"
+    },
+    "settings.general.management.selfHosted": {
+        "message": "Auto-hébergé"
+    },
+    "settings.general.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlError": {
+        "message": "Veuillez saisir une URL valide, ex. https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlUnreachable": {
+        "message": "Impossible de joindre ce serveur. Vérifiez l’URL, ou enregistrez quand même si vous êtes sûr qu’elle est correcte."
+    },
+    "settings.general.management.switchCloudTitle": {
+        "message": "Basculer vers NetBird Cloud ?"
+    },
+    "settings.general.management.switchCloudMessage": {
+        "message": "Cela déconnecte votre serveur auto-hébergé.\nVous devrez peut-être vous reconnecter."
+    },
+    "settings.general.management.switchCloudConfirm": {
+        "message": "Basculer vers Cloud"
+    },
+    "settings.network.section.connectivity": {
+        "message": "Connectivité"
+    },
+    "settings.network.section.routingDns": {
+        "message": "Routage et DNS"
+    },
+    "settings.network.monitor.label": {
+        "message": "Reconnecter en cas de changement de réseau"
+    },
+    "settings.network.monitor.help": {
+        "message": "Surveiller le réseau et se reconnecter automatiquement lors de changements tels qu’un basculement Wi-Fi, une modification Ethernet ou une reprise après la mise en veille."
+    },
+    "settings.network.dns.label": {
+        "message": "Activer le DNS"
+    },
+    "settings.network.dns.help": {
+        "message": "Appliquer les paramètres DNS gérés par NetBird au résolveur de l’hôte."
+    },
+    "settings.network.clientRoutes.label": {
+        "message": "Activer les routes client"
+    },
+    "settings.network.clientRoutes.help": {
+        "message": "Accepter les routes d’autres pairs pour atteindre leurs réseaux."
+    },
+    "settings.network.serverRoutes.label": {
+        "message": "Activer les routes serveur"
+    },
+    "settings.network.serverRoutes.help": {
+        "message": "Annoncer les routes locales de cet hôte aux autres pairs."
+    },
+    "settings.network.ipv6.label": {
+        "message": "Activer IPv6"
+    },
+    "settings.network.ipv6.help": {
+        "message": "Utiliser l’adressage IPv6 pour le réseau overlay NetBird."
+    },
+    "settings.security.section.firewall": {
+        "message": "Pare-feu"
+    },
+    "settings.security.section.encryption": {
+        "message": "Chiffrement"
+    },
+    "settings.security.blockInbound.label": {
+        "message": "Bloquer le trafic entrant"
+    },
+    "settings.security.blockInbound.help": {
+        "message": "Rejeter les connexions non sollicitées des pairs vers cet appareil et les réseaux qu’il route. Le trafic sortant n’est pas affecté."
+    },
+    "settings.security.blockLan.label": {
+        "message": "Bloquer l’accès au LAN"
+    },
+    "settings.security.blockLan.help": {
+        "message": "Empêcher les pairs d’atteindre votre réseau local ou ses appareils lorsque cet appareil route leur trafic."
+    },
+    "settings.security.rosenpass.label": {
+        "message": "Activer la résistance quantique"
+    },
+    "settings.security.rosenpass.help": {
+        "message": "Ajouter un échange de clés post-quantique via Rosenpass au-dessus de WireGuard®."
+    },
+    "settings.security.rosenpassPermissive.label": {
+        "message": "Activer le mode permissif"
+    },
+    "settings.security.rosenpassPermissive.help": {
+        "message": "Autoriser les connexions vers des pairs sans prise en charge de la résistance quantique."
+    },
+    "settings.ssh.section.server": {
+        "message": "Serveur"
+    },
+    "settings.ssh.section.capabilities": {
+        "message": "Fonctionnalités"
+    },
+    "settings.ssh.section.authentication": {
+        "message": "Authentification"
+    },
+    "settings.ssh.server.label": {
+        "message": "Activer le serveur SSH"
+    },
+    "settings.ssh.server.help": {
+        "message": "Exécuter le serveur SSH NetBird sur cet hôte afin que d’autres pairs puissent s’y connecter."
+    },
+    "settings.ssh.root.label": {
+        "message": "Autoriser la connexion en root"
+    },
+    "settings.ssh.root.help": {
+        "message": "Permettre aux pairs de se connecter en tant qu’utilisateur root. Désactivez pour exiger un compte non privilégié."
+    },
+    "settings.ssh.sftp.label": {
+        "message": "Autoriser SFTP"
+    },
+    "settings.ssh.sftp.help": {
+        "message": "Transférer des fichiers en toute sécurité à l’aide de clients SFTP ou SCP natifs."
+    },
+    "settings.ssh.localForward.label": {
+        "message": "Redirection de port locale"
+    },
+    "settings.ssh.localForward.help": {
+        "message": "Permettre aux pairs connectés de tunneliser des ports locaux vers des services accessibles depuis cet hôte."
+    },
+    "settings.ssh.remoteForward.label": {
+        "message": "Redirection de port distante"
+    },
+    "settings.ssh.remoteForward.help": {
+        "message": "Permettre aux pairs connectés d’exposer des ports de cet hôte vers leur propre machine."
+    },
+    "settings.ssh.jwt.label": {
+        "message": "Activer l’authentification JWT"
+    },
+    "settings.ssh.jwt.help": {
+        "message": "Vérifier chaque session SSH auprès de votre IdP pour l’identité de l’utilisateur et l’audit. Désactivez pour vous appuyer uniquement sur les politiques ACL réseau, utile lorsqu’aucun IdP n’est disponible."
+    },
+    "settings.ssh.jwtTtl.label": {
+        "message": "TTL du cache JWT"
+    },
+    "settings.ssh.jwtTtl.help": {
+        "message": "Durée pendant laquelle ce client met en cache un JWT avant de redemander lors des connexions SSH sortantes. Définissez 0 pour désactiver la mise en cache et vous authentifier à chaque connexion."
+    },
+    "settings.ssh.jwtTtl.suffix": {
+        "message": "s"
+    },
+    "settings.advanced.section.interface": {
+        "message": "Interface"
+    },
+    "settings.advanced.section.security": {
+        "message": "Sécurité"
+    },
+    "settings.advanced.interfaceName.label": {
+        "message": "Nom"
+    },
+    "settings.advanced.interfaceName.error": {
+        "message": "Utilisez 1 à 15 lettres, chiffres, points, tirets ou traits de soulignement."
+    },
+    "settings.advanced.interfaceName.errorMac": {
+        "message": "Doit commencer par « utun » suivi d’un nombre (ex. utun100)."
+    },
+    "settings.advanced.port.label": {
+        "message": "Port"
+    },
+    "settings.advanced.port.error": {
+        "message": "Saisissez un port compris entre {min} et {max}."
+    },
+    "settings.advanced.port.help": {
+        "message": "Si la valeur est 0, un port libre aléatoire sera utilisé."
+    },
+    "settings.advanced.mtu.label": {
+        "message": "MTU"
+    },
+    "settings.advanced.mtu.error": {
+        "message": "Saisissez une valeur MTU comprise entre {min} et {max}."
+    },
+    "settings.advanced.psk.label": {
+        "message": "Clé pré-partagée"
+    },
+    "settings.advanced.psk.help": {
+        "message": "PSK WireGuard facultative pour un chiffrement symétrique supplémentaire. Différente d’une clé d’installation NetBird. Vous ne communiquerez qu’avec les pairs utilisant la même clé pré-partagée."
+    },
+    "settings.troubleshooting.section.title": {
+        "message": "Lot de diagnostic"
+    },
+    "settings.troubleshooting.anonymize.label": {
+        "message": "Anonymiser les informations sensibles"
+    },
+    "settings.troubleshooting.anonymize.help": {
+        "message": "Masque les adresses IP publiques et les domaines non-NetBird dans les journaux."
+    },
+    "settings.troubleshooting.systemInfo.label": {
+        "message": "Inclure les informations système"
+    },
+    "settings.troubleshooting.systemInfo.help": {
+        "message": "Inclure l’OS, le noyau, les interfaces réseau et les tables de routage."
+    },
+    "settings.troubleshooting.upload.label": {
+        "message": "Envoyer le lot aux serveurs NetBird"
+    },
+    "settings.troubleshooting.upload.help": {
+        "message": "Renvoie une clé d’envoi à partager avec l’assistance NetBird."
+    },
+    "settings.troubleshooting.trace.label": {
+        "message": "Activer les journaux trace"
+    },
+    "settings.troubleshooting.trace.help": {
+        "message": "Élève le niveau de journalisation à TRACE, puis le rétablit ensuite."
+    },
+    "settings.troubleshooting.capture.label": {
+        "message": "Session de capture"
+    },
+    "settings.troubleshooting.capture.help": {
+        "message": "Se reconnecte et attend pour que vous puissiez reproduire le problème."
+    },
+    "settings.troubleshooting.packets.label": {
+        "message": "Capturer les paquets réseau"
+    },
+    "settings.troubleshooting.packets.help": {
+        "message": "Enregistre un .pcap du trafic réseau pendant la session de capture."
+    },
+    "settings.troubleshooting.duration.label": {
+        "message": "Durée de capture"
+    },
+    "settings.troubleshooting.duration.help": {
+        "message": "Durée d’exécution de la session de capture."
+    },
+    "settings.troubleshooting.duration.suffix": {
+        "message": "min"
+    },
+    "settings.troubleshooting.create": {
+        "message": "Créer le lot"
+    },
+    "settings.troubleshooting.progress.description": {
+        "message": "Collecte des journaux, des détails système et de l’état de connexion. Cela prend généralement un instant — gardez cette fenêtre ouverte jusqu’à la fin."
+    },
+    "settings.troubleshooting.cancelling": {
+        "message": "Annulation…"
+    },
+    "settings.troubleshooting.done.uploadedTitle": {
+        "message": "Lot de diagnostic envoyé avec succès !"
+    },
+    "settings.troubleshooting.done.savedTitle": {
+        "message": "Lot enregistré"
+    },
+    "settings.troubleshooting.done.uploadedDescription": {
+        "message": "Partagez la clé d’envoi ci-dessous avec l’<docs>assistance NetBird</docs>. Une copie locale a également été enregistrée sur votre appareil."
+    },
+    "settings.troubleshooting.done.savedDescription": {
+        "message": "Votre lot de diagnostic a été enregistré localement."
+    },
+    "settings.troubleshooting.done.copyKey": {
+        "message": "Copier la clé"
+    },
+    "settings.troubleshooting.done.openFolder": {
+        "message": "Ouvrir le dossier"
+    },
+    "settings.troubleshooting.done.openFileLocation": {
+        "message": "Ouvrir l’emplacement du fichier"
+    },
+    "settings.troubleshooting.uploadFailedWithReason": {
+        "message": "Échec de l’envoi : {reason} Le lot reste enregistré localement."
+    },
+    "settings.troubleshooting.uploadFailed": {
+        "message": "Échec de l’envoi. Le lot reste enregistré localement."
+    },
+    "settings.troubleshooting.stage.reconnecting": {
+        "message": "Reconnexion de NetBird…"
+    },
+    "settings.troubleshooting.stage.capturing": {
+        "message": "Capture des journaux de débogage"
+    },
+    "settings.troubleshooting.stage.bundling": {
+        "message": "Génération du lot de diagnostic…"
+    },
+    "settings.troubleshooting.stage.uploading": {
+        "message": "Envoi vers NetBird…"
+    },
+    "settings.troubleshooting.stage.cancelling": {
+        "message": "Annulation…"
+    },
+    "settings.about.client": {
+        "message": "Client NetBird v{version}"
+    },
+    "settings.about.clientName": {
+        "message": "Client NetBird"
+    },
+    "settings.about.development": {
+        "message": "[Développement]"
+    },
+    "settings.about.gui": {
+        "message": "GUI v{version}"
+    },
+    "settings.about.guiName": {
+        "message": "GUI"
+    },
+    "settings.about.copyright": {
+        "message": "© {year} NetBird. Tous droits réservés."
+    },
+    "settings.about.links.imprint": {
+        "message": "Mentions légales"
+    },
+    "settings.about.links.privacy": {
+        "message": "Confidentialité"
+    },
+    "settings.about.links.cla": {
+        "message": "CLA"
+    },
+    "settings.about.links.terms": {
+        "message": "Conditions d’utilisation"
+    },
+    "settings.about.community.github": {
+        "message": "GitHub"
+    },
+    "settings.about.community.slack": {
+        "message": "Slack"
+    },
+    "settings.about.community.forum": {
+        "message": "Forum"
+    },
+    "settings.about.community.documentation": {
+        "message": "Documentation"
+    },
+    "settings.about.community.feedback": {
+        "message": "Retour d’expérience"
+    },
+    "update.banner.message": {
+        "message": "NetBird {version} est prêt à être installé."
+    },
+    "update.banner.later": {
+        "message": "Plus tard"
+    },
+    "update.banner.installNow": {
+        "message": "Installer maintenant"
+    },
+    "update.card.versionAvailableDownload": {
+        "message": "La version {version} est disponible au téléchargement."
+    },
+    "update.card.versionAvailableInstall": {
+        "message": "La version {version} est disponible à l’installation."
+    },
+    "update.card.whatsNew": {
+        "message": "Quoi de neuf ?"
+    },
+    "update.card.installNow": {
+        "message": "Installer maintenant"
+    },
+    "update.card.getInstaller": {
+        "message": "Télécharger"
+    },
+    "update.card.autoCheckInterval": {
+        "message": "NetBird vérifie les mises à jour en arrière-plan."
+    },
+    "update.card.changelog": {
+        "message": "Journal des modifications"
+    },
+    "update.card.onLatestVersion": {
+        "message": "Vous utilisez la dernière version"
+    },
+    "update.header.tooltip": {
+        "message": "Mise à jour disponible"
+    },
+    "update.overlay.updatingVersion": {
+        "message": "Mise à jour de NetBird vers v{version}"
+    },
+    "update.overlay.updating": {
+        "message": "Mise à jour de NetBird"
+    },
+    "update.overlay.description": {
+        "message": "Une version plus récente est disponible et en cours d’installation. NetBird redémarrera automatiquement une fois la mise à jour terminée."
+    },
+    "update.overlay.error.timeoutTitle": {
+        "message": "La mise à jour prend trop de temps"
+    },
+    "update.overlay.error.timeoutDescription": {
+        "message": "L’installation de {target} a pris trop de temps et ne s’est pas terminée."
+    },
+    "update.overlay.error.canceledTitle": {
+        "message": "La mise à jour a été interrompue"
+    },
+    "update.overlay.error.canceledDescription": {
+        "message": "La mise à jour vers {target} a été annulée avant de se terminer."
+    },
+    "update.overlay.error.failTitle": {
+        "message": "Impossible d’installer la mise à jour"
+    },
+    "update.overlay.error.failDescription": {
+        "message": "Impossible d’installer {target}."
+    },
+    "update.overlay.error.unknownMessage": {
+        "message": "erreur inconnue"
+    },
+    "update.overlay.error.targetVersion": {
+        "message": "v{version}"
+    },
+    "update.overlay.error.targetFallback": {
+        "message": "la nouvelle version"
+    },
+    "update.error.loadStateTitle": {
+        "message": "Échec du chargement de l’état de mise à jour"
+    },
+    "update.error.triggerTitle": {
+        "message": "Échec du démarrage de la mise à jour"
+    },
+    "update.page.versionLine": {
+        "message": "Mise à jour du client vers : {version}."
+    },
+    "update.page.versionLineGeneric": {
+        "message": "Mise à jour du client."
+    },
+    "update.page.outdated": {
+        "message": "La version de votre client est antérieure à la version de mise à jour automatique définie dans Management."
+    },
+    "update.page.status.running": {
+        "message": "Mise à jour en cours"
+    },
+    "update.page.status.timeout": {
+        "message": "La mise à jour a expiré. Veuillez réessayer."
+    },
+    "update.page.status.canceled": {
+        "message": "Mise à jour annulée."
+    },
+    "update.page.status.failed": {
+        "message": "Échec de la mise à jour : {message}"
+    },
+    "update.page.status.unknownError": {
+        "message": "erreur de mise à jour inconnue"
+    },
+    "update.page.failedTitle": {
+        "message": "Échec de la mise à jour"
+    },
+    "update.page.timeoutMessage": {
+        "message": "La mise à jour a expiré."
+    },
+    "update.page.dontClose": {
+        "message": "Veuillez ne pas fermer cette fenêtre."
+    },
+    "update.page.updating": {
+        "message": "Mise à jour…"
+    },
+    "update.page.complete": {
+        "message": "Mise à jour terminée"
+    },
+    "update.page.failed": {
+        "message": "Échec de la mise à jour"
+    },
+    "window.title.settings": {
+        "message": "Paramètres"
+    },
+    "window.title.signIn": {
+        "message": "Connexion"
+    },
+    "window.title.sessionExpiration": {
+        "message": "Expiration de session"
+    },
+    "window.title.updating": {
+        "message": "Mise à jour"
+    },
+    "window.title.welcome": {
+        "message": "Bienvenue dans NetBird"
+    },
+    "window.title.error": {
+        "message": "Erreur"
+    },
+    "welcome.title": {
+        "message": "Cherchez NetBird dans votre barre d’état système"
+    },
+    "welcome.description": {
+        "message": "NetBird se trouve dans votre barre d’état système. Cliquez sur l’icône pour vous connecter, changer de profil ou ouvrir les paramètres."
+    },
+    "welcome.continue": {
+        "message": "Continuer"
+    },
+    "welcome.back": {
+        "message": "Retour"
+    },
+    "welcome.management.title": {
+        "message": "Configurer NetBird"
+    },
+    "welcome.management.description": {
+        "message": "Cliquez sur Continuer pour commencer, ou choisissez Auto-hébergé si vous disposez de votre propre serveur NetBird."
+    },
+    "welcome.management.cloud.title": {
+        "message": "NetBird Cloud"
+    },
+    "welcome.management.cloud.description": {
+        "message": "Utilisez notre service hébergé. Aucune configuration requise."
+    },
+    "welcome.management.selfHosted.title": {
+        "message": "Auto-hébergé"
+    },
+    "welcome.management.selfHosted.description": {
+        "message": "Connectez-vous à votre propre serveur de gestion."
+    },
+    "welcome.management.urlLabel": {
+        "message": "URL du serveur de gestion"
+    },
+    "welcome.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlInvalid": {
+        "message": "Veuillez saisir une URL valide, ex. https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlUnreachable": {
+        "message": "Impossible de joindre ce serveur. Vérifiez l’URL ou votre réseau, puis continuez si vous êtes sûr qu’elle est correcte."
+    },
+    "welcome.management.checking": {
+        "message": "Vérification…"
+    },
+    "browserLogin.title": {
+        "message": "Continuez dans votre navigateur pour terminer la connexion"
+    },
+    "browserLogin.notSeeing": {
+        "message": "Vous ne voyez pas l’onglet du navigateur ?"
+    },
+    "browserLogin.tryAgain": {
+        "message": "Réessayer"
+    },
+    "browserLogin.openFailedTitle": {
+        "message": "Échec de l’ouverture du navigateur"
+    },
+    "sessionExpiration.title": {
+        "message": "La session expire bientôt"
+    },
+    "sessionExpiration.titleLater": {
+        "message": "Votre session va expirer"
+    },
+    "sessionExpiration.description": {
+        "message": "Cet appareil sera bientôt déconnecté. Renouvelez via une connexion dans le navigateur."
+    },
+    "sessionExpiration.descriptionLater": {
+        "message": "Une connexion dans le navigateur maintient cet appareil connecté à votre réseau."
+    },
+    "sessionExpiration.stay": {
+        "message": "Renouveler la session"
+    },
+    "sessionExpiration.authenticate": {
+        "message": "S’authentifier"
+    },
+    "sessionExpiration.logout": {
+        "message": "Se déconnecter"
+    },
+    "sessionExpiration.expired": {
+        "message": "Session expirée"
+    },
+    "sessionExpiration.expiredDescription": {
+        "message": "Appareil déconnecté. Authentifiez-vous via une connexion dans le navigateur pour vous reconnecter."
+    },
+    "sessionExpiration.close": {
+        "message": "Fermer"
+    },
+    "sessionExpiration.extendFailedTitle": {
+        "message": "Échec de la prolongation de la session"
+    },
+    "sessionExpiration.logoutFailedTitle": {
+        "message": "Échec de la déconnexion"
+    },
+    "peers.search.placeholder": {
+        "message": "Rechercher par nom ou IP"
+    },
+    "peers.filter.all": {
+        "message": "Tous"
+    },
+    "peers.filter.online": {
+        "message": "En ligne"
+    },
+    "peers.filter.offline": {
+        "message": "Hors ligne"
+    },
+    "peers.empty.title": {
+        "message": "Aucun pair disponible"
+    },
+    "peers.empty.description": {
+        "message": "Soit vous n’avez aucun pair disponible, soit vous n’y avez pas accès."
+    },
+    "peers.details.domain": {
+        "message": "Domaine"
+    },
+    "peers.details.netbirdIp": {
+        "message": "IP NetBird"
+    },
+    "peers.details.netbirdIpv6": {
+        "message": "IPv6 NetBird"
+    },
+    "peers.details.publicKey": {
+        "message": "Clé publique"
+    },
+    "peers.details.connection": {
+        "message": "Connexion"
+    },
+    "peers.details.latency": {
+        "message": "Latence"
+    },
+    "peers.details.lastHandshake": {
+        "message": "Dernier handshake"
+    },
+    "peers.details.statusSince": {
+        "message": "Dernière mise à jour de connexion"
+    },
+    "peers.details.bytes": {
+        "message": "Octets"
+    },
+    "peers.details.bytesSent": {
+        "message": "Envoyés"
+    },
+    "peers.details.bytesReceived": {
+        "message": "Reçus"
+    },
+    "peers.details.localIce": {
+        "message": "ICE local"
+    },
+    "peers.details.remoteIce": {
+        "message": "ICE distant"
+    },
+    "peers.details.never": {
+        "message": "Jamais"
+    },
+    "peers.details.justNow": {
+        "message": "À l’instant"
+    },
+    "peers.details.refresh": {
+        "message": "Actualiser"
+    },
+    "peers.status.connected": {
+        "message": "Connecté"
+    },
+    "peers.status.connecting": {
+        "message": "Connexion"
+    },
+    "peers.status.disconnected": {
+        "message": "Déconnecté"
+    },
+    "peers.details.relayAddress": {
+        "message": "Relais"
+    },
+    "peers.details.networks": {
+        "message": "Ressources"
+    },
+    "peers.details.relayed": {
+        "message": "Relayée"
+    },
+    "peers.details.p2p": {
+        "message": "P2P"
+    },
+    "peers.details.rosenpass": {
+        "message": "Rosenpass activé"
+    },
+    "networks.search.placeholder": {
+        "message": "Rechercher par réseau ou domaine"
+    },
+    "networks.filter.all": {
+        "message": "Toutes"
+    },
+    "networks.filter.active": {
+        "message": "Actives"
+    },
+    "networks.filter.overlapping": {
+        "message": "Chevauchantes"
+    },
+    "networks.empty.title": {
+        "message": "Aucune ressource disponible"
+    },
+    "networks.empty.description": {
+        "message": "Soit vous n’avez aucune ressource réseau disponible, soit vous n’y avez pas accès."
+    },
+    "networks.selected": {
+        "message": "Sélectionnée"
+    },
+    "networks.unselected": {
+        "message": "Non sélectionnée"
+    },
+    "networks.ips.heading": {
+        "message": "IP résolues"
+    },
+    "networks.bulk.selectionCount": {
+        "message": "{selected} sur {total} actives"
+    },
+    "networks.bulk.enableAll": {
+        "message": "Tout activer"
+    },
+    "networks.bulk.disableAll": {
+        "message": "Tout désactiver"
+    },
+    "exitNodes.search.placeholder": {
+        "message": "Rechercher des nœuds de sortie"
+    },
+    "exitNodes.none": {
+        "message": "Aucun"
+    },
+    "exitNodes.empty.title": {
+        "message": "Aucun nœud de sortie disponible"
+    },
+    "exitNodes.empty.description": {
+        "message": "Aucun nœud de sortie n’a été partagé avec ce pair."
+    },
+    "exitNodes.card.title": {
+        "message": "Nœud de sortie"
+    },
+    "exitNodes.card.statusActive": {
+        "message": "Actif"
+    },
+    "exitNodes.card.statusInactive": {
+        "message": "Inactif"
+    },
+    "exitNodes.dropdown.noneTitle": {
+        "message": "Aucun"
+    },
+    "exitNodes.dropdown.noneDescription": {
+        "message": "Connexion directe sans nœud de sortie"
+    },
+    "quickActions.connect": {
+        "message": "Se connecter"
+    },
+    "quickActions.disconnect": {
+        "message": "Se déconnecter"
+    },
+    "daemon.unavailable.title": {
+        "message": "Le service NetBird n’est pas en cours d’exécution"
+    },
+    "daemon.unavailable.description": {
+        "message": "L’application se reconnectera automatiquement une fois le service en cours d’exécution."
+    },
+    "daemon.unavailable.docsLink": {
+        "message": "Documentation"
+    },
+    "daemon.outdated.title": {
+        "message": "Le service NetBird est obsolète"
+    },
+    "daemon.outdated.description": {
+        "message": "Mettez à jour le service NetBird pour utiliser cette application."
+    },
+    "error.jwt_clock_skew": {
+        "message": "Échec de la connexion : l’horloge de cet appareil n’est pas synchronisée avec le serveur. Veuillez synchroniser l’horloge de votre système et réessayer."
+    },
+    "error.jwt_expired": {
+        "message": "Votre jeton de connexion a expiré. Veuillez vous reconnecter."
+    },
+    "error.jwt_signature_invalid": {
+        "message": "Échec de la connexion : la signature du jeton est invalide. Veuillez contacter votre administrateur."
+    },
+    "error.session_expired": {
+        "message": "Votre session a expiré. Veuillez vous reconnecter."
+    },
+    "error.invalid_setup_key": {
+        "message": "La clé d’installation est manquante ou invalide."
+    },
+    "error.permission_denied": {
+        "message": "La connexion a été rejetée par le serveur."
+    },
+    "error.daemon_unreachable": {
+        "message": "Le daemon NetBird ne répond pas. Veuillez vérifier que le service est en cours d’exécution."
+    },
+    "error.unknown": {
+        "message": "L’opération a échoué."
+    }
+}
diff --git a/client/ui/i18n/locales/hu/common.json b/client/ui/i18n/locales/hu/common.json
new file mode 100644
index 000000000..b54918364
--- /dev/null
+++ b/client/ui/i18n/locales/hu/common.json
@@ -0,0 +1,1325 @@
+{
+    "tray.tooltip": {
+        "message": "NetBird"
+    },
+    "tray.status.disconnected": {
+        "message": "Lecsatlakozva"
+    },
+    "tray.status.daemonUnavailable": {
+        "message": "Nem fut"
+    },
+    "tray.status.error": {
+        "message": "Hiba"
+    },
+    "tray.status.connected": {
+        "message": "Csatlakozva"
+    },
+    "tray.status.connecting": {
+        "message": "Csatlakozás"
+    },
+    "tray.status.needsLogin": {
+        "message": "Bejelentkezés szükséges"
+    },
+    "tray.status.loginFailed": {
+        "message": "Sikertelen bejelentkezés"
+    },
+    "tray.status.sessionExpired": {
+        "message": "Munkamenet lejárt"
+    },
+    "tray.session.expiresIn": {
+        "message": "Munkamenet lejár {remaining} múlva"
+    },
+    "tray.session.unit.lessThanMinute": {
+        "message": "egy percnél kevesebb"
+    },
+    "tray.session.unit.minute": {
+        "message": "1 perc"
+    },
+    "tray.session.unit.minutes": {
+        "message": "{count} perc"
+    },
+    "tray.session.unit.hour": {
+        "message": "1 óra"
+    },
+    "tray.session.unit.hours": {
+        "message": "{count} óra"
+    },
+    "tray.session.unit.day": {
+        "message": "1 nap"
+    },
+    "tray.session.unit.days": {
+        "message": "{count} nap"
+    },
+    "tray.menu.open": {
+        "message": "NetBird megnyitása"
+    },
+    "tray.menu.connect": {
+        "message": "Csatlakozás"
+    },
+    "tray.menu.disconnect": {
+        "message": "Bontás"
+    },
+    "tray.menu.exitNode": {
+        "message": "Exit Node"
+    },
+    "tray.menu.networks": {
+        "message": "Erőforrások"
+    },
+    "tray.menu.profiles": {
+        "message": "Profilok"
+    },
+    "tray.menu.manageProfiles": {
+        "message": "Profilok kezelése"
+    },
+    "tray.menu.settings": {
+        "message": "Beállítások…"
+    },
+    "tray.menu.debugBundle": {
+        "message": "Hibakeresési csomag készítése"
+    },
+    "tray.menu.about": {
+        "message": "Súgó és támogatás"
+    },
+    "tray.menu.github": {
+        "message": "GitHub"
+    },
+    "tray.menu.documentation": {
+        "message": "Dokumentáció"
+    },
+    "tray.menu.troubleshoot": {
+        "message": "Hibakeresés"
+    },
+    "tray.menu.downloadLatest": {
+        "message": "Legfrissebb verzió letöltése"
+    },
+    "tray.menu.installVersion": {
+        "message": "{version} verzió telepítése"
+    },
+    "tray.menu.guiVersion": {
+        "message": "GUI: {version}"
+    },
+    "tray.menu.daemonVersion": {
+        "message": "Daemon: {version}"
+    },
+    "tray.menu.versionUnknown": {
+        "message": "—"
+    },
+    "tray.menu.quit": {
+        "message": "NetBird bezárása"
+    },
+    "notify.daemonOutdated.title": {
+        "message": "A NetBird szolgáltatás elavult"
+    },
+    "notify.daemonOutdated.body": {
+        "message": "Frissítsd a NetBird szolgáltatást az alkalmazás használatához."
+    },
+    "notify.update.title": {
+        "message": "NetBird frissítés elérhető"
+    },
+    "notify.update.body": {
+        "message": "Elérhető a NetBird {version}."
+    },
+    "notify.update.enforcedSuffix": {
+        "message": " A rendszergazda kötelezővé tette ezt a frissítést."
+    },
+    "notify.error.title": {
+        "message": "Hiba"
+    },
+    "notify.error.connect": {
+        "message": "Csatlakozás sikertelen"
+    },
+    "notify.error.disconnect": {
+        "message": "Bontás sikertelen"
+    },
+    "notify.error.switchProfile": {
+        "message": "Átváltás sikertelen erre: {profile}"
+    },
+    "notify.error.exitNode": {
+        "message": "Az Exit Node frissítése sikertelen: {name}"
+    },
+    "notify.sessionExpired.title": {
+        "message": "NetBird munkamenet lejárt"
+    },
+    "notify.sessionExpired.body": {
+        "message": "A NetBird munkamenet lejárt. Kérjük, jelentkezzen be újra."
+    },
+    "notify.sessionWarning.title": {
+        "message": "Munkamenet hamarosan lejár"
+    },
+    "notify.sessionWarning.body": {
+        "message": "A NetBird munkamenet {remaining} múlva lejár. Kattintson a Meghosszabbítás gombra a megújításhoz."
+    },
+    "notify.sessionWarning.bodyGeneric": {
+        "message": "A NetBird munkamenet hamarosan lejár. Kattintson a Meghosszabbítás gombra a megújításhoz."
+    },
+    "notify.sessionWarning.extend": {
+        "message": "Meghosszabbítás"
+    },
+    "notify.sessionWarning.dismiss": {
+        "message": "Elvetés"
+    },
+    "notify.sessionWarning.failed": {
+        "message": "A NetBird munkamenet meghosszabbítása sikertelen"
+    },
+    "notify.sessionWarning.successTitle": {
+        "message": "NetBird munkamenet meghosszabbítva"
+    },
+    "notify.sessionWarning.successBody": {
+        "message": "A munkamenet frissítve."
+    },
+    "notify.sessionDeadlineRejected.title": {
+        "message": "Munkamenet-határidő elutasítva"
+    },
+    "notify.sessionDeadlineRejected.body": {
+        "message": "A szerver érvénytelen munkamenet-határidőt küldött. Kérjük, jelentkezzen be újra."
+    },
+    "notify.mdm.policyApplied.title": {
+        "message": "NetBird beállítások frissítve"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "A NetBird konfigurációt az IT-szabályzat frissítette."
+    },
+    "common.cancel": {
+        "message": "Mégse"
+    },
+    "common.save": {
+        "message": "Mentés"
+    },
+    "common.saveChanges": {
+        "message": "Módosítások mentése"
+    },
+    "common.saving": {
+        "message": "Mentés…"
+    },
+    "common.close": {
+        "message": "Bezárás"
+    },
+    "common.copy": {
+        "message": "Másolás"
+    },
+    "common.togglePasswordVisibility": {
+        "message": "Jelszó láthatóságának váltása"
+    },
+    "common.increase": {
+        "message": "Növelés"
+    },
+    "common.decrease": {
+        "message": "Csökkentés"
+    },
+    "common.delete": {
+        "message": "Törlés"
+    },
+    "common.create": {
+        "message": "Létrehozás"
+    },
+    "common.add": {
+        "message": "Hozzáadás"
+    },
+    "common.remove": {
+        "message": "Eltávolítás"
+    },
+    "common.refresh": {
+        "message": "Frissítés"
+    },
+    "common.loading": {
+        "message": "Betöltés…"
+    },
+    "common.netbird": {
+        "message": "NetBird"
+    },
+    "common.noResults.title": {
+        "message": "Nincs találat"
+    },
+    "common.noResults.description": {
+        "message": "Nem találtunk eredményt. Próbáljon meg másik keresési kifejezést, vagy módosítsa a szűrőket."
+    },
+    "notConnected.title": {
+        "message": "Lecsatlakozva"
+    },
+    "notConnected.description": {
+        "message": "Csatlakozzon először a NetBirdhöz, hogy részletes információkat láthasson a Peerekről, a hálózati erőforrásokról és az Exit Node-okról."
+    },
+    "connect.status.disconnected": {
+        "message": "Lecsatlakozva"
+    },
+    "connect.status.connecting": {
+        "message": "Csatlakozás…"
+    },
+    "connect.status.connected": {
+        "message": "Csatlakozva"
+    },
+    "connect.status.disconnecting": {
+        "message": "Lecsatlakozás…"
+    },
+    "connect.status.daemonUnavailable": {
+        "message": "Daemon nem elérhető"
+    },
+    "connect.status.loginRequired": {
+        "message": "Bejelentkezés szükséges"
+    },
+    "connect.error.loginTitle": {
+        "message": "Bejelentkezés sikertelen"
+    },
+    "connect.error.connectTitle": {
+        "message": "Csatlakozás sikertelen"
+    },
+    "connect.error.disconnectTitle": {
+        "message": "Bontás sikertelen"
+    },
+    "nav.peers.title": {
+        "message": "Peerek"
+    },
+    "nav.peers.description": {
+        "message": "{connected} / {total} csatlakoztatva"
+    },
+    "nav.resources.title": {
+        "message": "Erőforrások"
+    },
+    "nav.resources.description": {
+        "message": "{active} / {total} aktív"
+    },
+    "nav.exitNode.title": {
+        "message": "Exit Node-ok"
+    },
+    "nav.exitNode.none": {
+        "message": "Nem aktív"
+    },
+    "nav.exitNode.using": {
+        "message": "Ezen át: {name}"
+    },
+    "header.openSettings": {
+        "message": "Beállítások megnyitása"
+    },
+    "header.togglePanel": {
+        "message": "Oldalsó panel váltása"
+    },
+    "profile.selector.loading": {
+        "message": "Betöltés…"
+    },
+    "profile.selector.noProfile": {
+        "message": "Nincs profil"
+    },
+    "profile.selector.searchPlaceholder": {
+        "message": "Profil keresése név alapján…"
+    },
+    "profile.selector.emptyTitle": {
+        "message": "Nem található profil"
+    },
+    "profile.selector.emptyDescription": {
+        "message": "Próbáljon más keresőkifejezést, vagy hozzon létre új profilt."
+    },
+    "profile.selector.newProfile": {
+        "message": "Új profil"
+    },
+    "profile.selector.moreOptions": {
+        "message": "További műveletek"
+    },
+    "profile.selector.deregister": {
+        "message": "Leválasztás"
+    },
+    "profile.selector.delete": {
+        "message": "Profil törlése"
+    },
+    "profile.selector.switchTo": {
+        "message": "Váltás erre a profilra"
+    },
+    "profile.selector.edit": {
+        "message": "Szerkesztés"
+    },
+    "profile.edit.title": {
+        "message": "Profil szerkesztése"
+    },
+    "profile.edit.submit": {
+        "message": "Módosítások mentése"
+    },
+    "profile.dialog.title": {
+        "message": "Új profil"
+    },
+    "profile.dialog.nameLabel": {
+        "message": "Profilnév"
+    },
+    "profile.dialog.description": {
+        "message": "Adjon profiljának egy könnyen azonosítható nevet."
+    },
+    "profile.dialog.placeholder": {
+        "message": "pl. Munka"
+    },
+    "profile.dialog.submit": {
+        "message": "Profil hozzáadása"
+    },
+    "profile.dialog.required": {
+        "message": "Adjon meg egy profilnevet, pl. Munka, Otthon"
+    },
+    "profile.dialog.managementHelp": {
+        "message": "NetBird Cloud vagy saját kiszolgáló."
+    },
+    "profile.dialog.urlUnreachable": {
+        "message": "A szerver nem érhető el. Ellenőrizze az URL-t, vagy adja hozzá a profilt, ha biztos benne, hogy helyes."
+    },
+    "header.menu.settings": {
+        "message": "Beállítások…"
+    },
+    "header.menu.defaultView": {
+        "message": "Alapnézet"
+    },
+    "header.menu.advancedView": {
+        "message": "Speciális nézet"
+    },
+    "header.menu.updateAvailable": {
+        "message": "Frissítés elérhető"
+    },
+    "header.menu.open": {
+        "message": "Menü megnyitása"
+    },
+    "header.profile.switch": {
+        "message": "Profilváltás"
+    },
+    "connect.toggle.label": {
+        "message": "NetBird-kapcsolat be/ki"
+    },
+    "connect.localIp.label": {
+        "message": "Helyi IP-címek"
+    },
+    "common.search": {
+        "message": "Keresés"
+    },
+    "common.filter": {
+        "message": "Szűrés"
+    },
+    "exitNodes.dropdown.trigger": {
+        "message": "Kilépőcsomópont kiválasztása"
+    },
+    "peers.row.label": {
+        "message": "Részletek megnyitása: {name}, {status}"
+    },
+    "peers.dialog.title": {
+        "message": "Társ részletei"
+    },
+    "networks.row.toggle": {
+        "message": "{name} be/ki"
+    },
+    "networks.bulk.label": {
+        "message": "Összes látható erőforrás be/ki"
+    },
+    "settings.nav.label": {
+        "message": "Beállítások szakaszai"
+    },
+    "profile.switch.title": {
+        "message": "Váltás a(z) \"{name}\" profilra?"
+    },
+    "profile.switch.message": {
+        "message": "Biztosan profilt szeretne váltani?\nAz aktuális profilja le lesz választva."
+    },
+    "profile.switch.confirm": {
+        "message": "Megerősítés"
+    },
+    "profile.deregister.title": {
+        "message": "\"{name}\" profil leválasztása?"
+    },
+    "profile.deregister.message": {
+        "message": "Biztosan le szeretné választani ezt a profilt?\nÚjra be kell jelentkeznie a használatához."
+    },
+    "profile.deregister.confirm": {
+        "message": "Leválasztás"
+    },
+    "profile.delete.title": {
+        "message": "\"{name}\" profil törlése?"
+    },
+    "profile.delete.message": {
+        "message": "Biztosan törölni szeretné ezt a profilt?\nEz a művelet nem vonható vissza."
+    },
+    "profile.delete.disabledActive": {
+        "message": "Aktív profilok nem törölhetők. Váltson másik profilra, mielőtt törölné ezt."
+    },
+    "profile.delete.disabledDefault": {
+        "message": "Az alapértelmezett profil nem törölhető."
+    },
+    "profile.error.switchTitle": {
+        "message": "Profilváltás sikertelen"
+    },
+    "profile.error.deregisterTitle": {
+        "message": "Leválasztás sikertelen"
+    },
+    "profile.error.deleteTitle": {
+        "message": "Profil törlése sikertelen"
+    },
+    "profile.error.createTitle": {
+        "message": "Profil létrehozása sikertelen"
+    },
+    "profile.error.editTitle": {
+        "message": "Profil szerkesztése sikertelen"
+    },
+    "profile.error.loadTitle": {
+        "message": "Profilok betöltése sikertelen"
+    },
+    "profile.dropdown.activeProfile": {
+        "message": "Aktív profil"
+    },
+    "profile.dropdown.switchProfile": {
+        "message": "Profilváltás"
+    },
+    "profile.dropdown.noEmail": {
+        "message": "Egyéb"
+    },
+    "profile.dropdown.addProfile": {
+        "message": "Profil hozzáadása"
+    },
+    "profile.dropdown.manageProfiles": {
+        "message": "Profilok kezelése"
+    },
+    "profile.dropdown.settings": {
+        "message": "Beállítások"
+    },
+    "settings.profiles.section.profiles": {
+        "message": "Profilok"
+    },
+    "settings.profiles.intro": {
+        "message": "Kezeljen több NetBird-profilt párhuzamosan, például munkahelyi és személyes fiókokat, vagy különböző felügyeleti szervereket. Lent hozzáadhat, leválaszthat vagy törölhet profilokat."
+    },
+    "settings.profiles.addProfile": {
+        "message": "Profil hozzáadása"
+    },
+    "settings.profiles.active": {
+        "message": "Aktív"
+    },
+    "settings.profiles.emptyTitle": {
+        "message": "Nincsenek profilok"
+    },
+    "settings.profiles.emptyDescription": {
+        "message": "Hozzon létre egy profilt a NetBird felügyeleti szerverhez való csatlakozáshoz."
+    },
+    "settings.error.loadTitle": {
+        "message": "Beállítások betöltése sikertelen"
+    },
+    "settings.error.saveTitle": {
+        "message": "Beállítások mentése sikertelen"
+    },
+    "settings.error.debugBundleTitle": {
+        "message": "Hibakeresési csomag sikertelen"
+    },
+    "settings.tabs.general": {
+        "message": "Általános"
+    },
+    "settings.tabs.network": {
+        "message": "Hálózat"
+    },
+    "settings.tabs.security": {
+        "message": "Biztonság"
+    },
+    "settings.tabs.profiles": {
+        "message": "Profilok"
+    },
+    "settings.tabs.ssh": {
+        "message": "SSH"
+    },
+    "settings.tabs.advanced": {
+        "message": "Speciális"
+    },
+    "settings.tabs.troubleshooting": {
+        "message": "Hibaelhárítás"
+    },
+    "settings.tabs.about": {
+        "message": "Névjegy"
+    },
+    "settings.tabs.updateAvailable": {
+        "message": "Frissítés elérhető"
+    },
+    "settings.general.section.general": {
+        "message": "Általános"
+    },
+    "settings.general.section.connection": {
+        "message": "Kapcsolat"
+    },
+    "settings.general.connectOnStartup.label": {
+        "message": "Csatlakozás indításkor"
+    },
+    "settings.general.connectOnStartup.help": {
+        "message": "A szolgáltatás indulásakor automatikusan kapcsolatot létesít."
+    },
+    "settings.general.notifications.label": {
+        "message": "Asztali értesítések"
+    },
+    "settings.general.notifications.help": {
+        "message": "Asztali értesítések megjelenítése új frissítésekről és kapcsolati eseményekről."
+    },
+    "settings.general.autostart.label": {
+        "message": "NetBird UI indítása bejelentkezéskor"
+    },
+    "settings.general.autostart.help": {
+        "message": "A NetBird felület automatikus indítása bejelentkezéskor. Ez csak a grafikus felületet érinti, a háttérszolgáltatást nem."
+    },
+    "settings.general.autostart.errorTitle": {
+        "message": "Az automatikus indítás módosítása sikertelen"
+    },
+    "settings.general.language.label": {
+        "message": "Megjelenítési nyelv"
+    },
+    "settings.general.language.help": {
+        "message": "Válassza ki a NetBird felület nyelvét."
+    },
+    "settings.general.language.search": {
+        "message": "Nyelv keresése…"
+    },
+    "settings.general.language.empty": {
+        "message": "Nincs találat."
+    },
+    "settings.general.management.label": {
+        "message": "Felügyeleti szerver"
+    },
+    "settings.general.management.help": {
+        "message": "Csatlakozás a NetBird Cloudhoz vagy saját üzemeltetésű felügyeleti szerverhez. A módosítások újracsatlakozást váltanak ki."
+    },
+    "settings.general.management.cloud": {
+        "message": "Felhő"
+    },
+    "settings.general.management.selfHosted": {
+        "message": "Saját üzemeltetésű"
+    },
+    "settings.general.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlError": {
+        "message": "Adjon meg egy érvényes URL-t, pl. https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlUnreachable": {
+        "message": "A szerver nem érhető el. Ellenőrizze az URL-t, vagy mentse el, ha biztos benne, hogy helyes."
+    },
+    "settings.general.management.switchCloudTitle": {
+        "message": "Átváltás a NetBird Cloudra?"
+    },
+    "settings.general.management.switchCloudMessage": {
+        "message": "Ez leválasztja a saját üzemeltetésű kiszolgálót.\nLehet, hogy újra be kell jelentkeznie."
+    },
+    "settings.general.management.switchCloudConfirm": {
+        "message": "Váltás a felhőre"
+    },
+    "settings.network.section.connectivity": {
+        "message": "Kapcsolódás"
+    },
+    "settings.network.section.routingDns": {
+        "message": "Útválasztás és DNS"
+    },
+    "settings.network.monitor.label": {
+        "message": "Újracsatlakozás hálózatváltáskor"
+    },
+    "settings.network.monitor.help": {
+        "message": "A hálózat figyelése és automatikus újracsatlakozás változások (pl. Wi-Fi-váltás, Ethernet-változás vagy alvó állapotból való visszatérés) esetén."
+    },
+    "settings.network.dns.label": {
+        "message": "DNS engedélyezése"
+    },
+    "settings.network.dns.help": {
+        "message": "A NetBird által kezelt DNS-beállítások alkalmazása a gazda DNS-feloldójára."
+    },
+    "settings.network.clientRoutes.label": {
+        "message": "Kliens útvonalak engedélyezése"
+    },
+    "settings.network.clientRoutes.help": {
+        "message": "Más Peerek útvonalainak elfogadása a hálózataik eléréséhez."
+    },
+    "settings.network.serverRoutes.label": {
+        "message": "Szerver útvonalak engedélyezése"
+    },
+    "settings.network.serverRoutes.help": {
+        "message": "Ennek a gazdának a helyi útvonalainak meghirdetése más Peerek számára."
+    },
+    "settings.network.ipv6.label": {
+        "message": "IPv6 engedélyezése"
+    },
+    "settings.network.ipv6.help": {
+        "message": "IPv6-címzés használata a NetBird overlay hálózathoz."
+    },
+    "settings.security.section.firewall": {
+        "message": "Tűzfal"
+    },
+    "settings.security.section.encryption": {
+        "message": "Titkosítás"
+    },
+    "settings.security.blockInbound.label": {
+        "message": "Bejövő forgalom blokkolása"
+    },
+    "settings.security.blockInbound.help": {
+        "message": "Visszautasítja a Peerektől érkező nem kért kapcsolatokat ezen eszközhöz és az általa irányított hálózatokhoz. A kimenő forgalmat nem érinti."
+    },
+    "settings.security.blockLan.label": {
+        "message": "LAN-hozzáférés blokkolása"
+    },
+    "settings.security.blockLan.help": {
+        "message": "Megakadályozza, hogy a Peerek elérjék a helyi hálózatot vagy annak eszközeit, amikor ez az eszköz irányítja a forgalmukat."
+    },
+    "settings.security.rosenpass.label": {
+        "message": "Kvantumellenálló titkosítás engedélyezése"
+    },
+    "settings.security.rosenpass.help": {
+        "message": "Post-kvantum kulcscsere hozzáadása Rosenpass segítségével a WireGuard® tetejére."
+    },
+    "settings.security.rosenpassPermissive.label": {
+        "message": "Engedékeny mód engedélyezése"
+    },
+    "settings.security.rosenpassPermissive.help": {
+        "message": "Kapcsolatok engedélyezése kvantumellenálló titkosítás nélküli Peerekkel."
+    },
+    "settings.ssh.section.server": {
+        "message": "Szerver"
+    },
+    "settings.ssh.section.capabilities": {
+        "message": "Képességek"
+    },
+    "settings.ssh.section.authentication": {
+        "message": "Hitelesítés"
+    },
+    "settings.ssh.server.label": {
+        "message": "SSH szerver engedélyezése"
+    },
+    "settings.ssh.server.help": {
+        "message": "Futtassa a NetBird SSH szervert ezen a gazdán, hogy más Peerek csatlakozhassanak."
+    },
+    "settings.ssh.root.label": {
+        "message": "Root bejelentkezés engedélyezése"
+    },
+    "settings.ssh.root.help": {
+        "message": "A Peerek bejelentkezhetnek root felhasználóként. Tiltsa le, ha nem privilegizált fiók szükséges."
+    },
+    "settings.ssh.sftp.label": {
+        "message": "SFTP engedélyezése"
+    },
+    "settings.ssh.sftp.help": {
+        "message": "Fájlok biztonságos átvitele natív SFTP- vagy SCP-kliensekkel."
+    },
+    "settings.ssh.localForward.label": {
+        "message": "Helyi porttovábbítás"
+    },
+    "settings.ssh.localForward.help": {
+        "message": "A csatlakozó Peerek helyi portokat alagútba helyezhetnek erről a gazdáról elérhető szolgáltatásokhoz."
+    },
+    "settings.ssh.remoteForward.label": {
+        "message": "Távoli porttovábbítás"
+    },
+    "settings.ssh.remoteForward.help": {
+        "message": "A csatlakozó Peerek ezen a gazdán lévő portokat tehetnek elérhetővé a saját gépük számára."
+    },
+    "settings.ssh.jwt.label": {
+        "message": "JWT-hitelesítés engedélyezése"
+    },
+    "settings.ssh.jwt.help": {
+        "message": "Minden SSH-munkamenet ellenőrzése az IdP-vel a felhasználói identitás és audit céljából. Tiltsa le, ha csak a hálózati ACL-szabályokra kíván támaszkodni — hasznos, ha nincs elérhető IdP."
+    },
+    "settings.ssh.jwtTtl.label": {
+        "message": "JWT gyorsítótár TTL"
+    },
+    "settings.ssh.jwtTtl.help": {
+        "message": "Mennyi ideig őrzi meg a kliens a JWT-t, mielőtt újra kérné a kimenő SSH-kapcsolatoknál. 0 érték esetén a gyorsítótárazás kikapcsol, és minden kapcsolatnál hitelesít."
+    },
+    "settings.ssh.jwtTtl.suffix": {
+        "message": "másodperc"
+    },
+    "settings.advanced.section.interface": {
+        "message": "Interfész"
+    },
+    "settings.advanced.section.security": {
+        "message": "Biztonság"
+    },
+    "settings.advanced.interfaceName.label": {
+        "message": "Név"
+    },
+    "settings.advanced.interfaceName.error": {
+        "message": "Használjon 1–15 betűt, számot, pontot, kötőjelet vagy aláhúzást."
+    },
+    "settings.advanced.interfaceName.errorMac": {
+        "message": "„utun” után számmal kezdődjön (pl. utun100)."
+    },
+    "settings.advanced.port.label": {
+        "message": "Port"
+    },
+    "settings.advanced.port.error": {
+        "message": "Adjon meg egy portot {min} és {max} között."
+    },
+    "settings.advanced.port.help": {
+        "message": "Ha 0-ra állítja, egy véletlenszerű szabad portot használ."
+    },
+    "settings.advanced.mtu.label": {
+        "message": "MTU"
+    },
+    "settings.advanced.mtu.error": {
+        "message": "Adjon meg egy MTU értéket {min} és {max} között."
+    },
+    "settings.advanced.psk.label": {
+        "message": "Pre-shared kulcs"
+    },
+    "settings.advanced.psk.help": {
+        "message": "Opcionális WireGuard PSK további szimmetrikus titkosításhoz. Nem azonos a NetBird telepítőkulccsal. Csak olyan Peerekkel kommunikál, akik ugyanazt a pre-shared kulcsot használják."
+    },
+    "settings.troubleshooting.section.title": {
+        "message": "Hibakeresési csomag"
+    },
+    "settings.troubleshooting.anonymize.label": {
+        "message": "Érzékeny információk anonimizálása"
+    },
+    "settings.troubleshooting.anonymize.help": {
+        "message": "Elrejti a nyilvános IP-címeket és a nem-NetBird tartományokat a naplókban."
+    },
+    "settings.troubleshooting.systemInfo.label": {
+        "message": "Rendszerinformációk beillesztése"
+    },
+    "settings.troubleshooting.systemInfo.help": {
+        "message": "Tartalmazza az OS-t, a kernelt, a hálózati interfészeket és az útválasztási táblákat."
+    },
+    "settings.troubleshooting.upload.label": {
+        "message": "Csomag feltöltése a NetBird szerverekre"
+    },
+    "settings.troubleshooting.upload.help": {
+        "message": "Egy feltöltési kulcsot ad vissza, amelyet megoszthat a NetBird támogatással."
+    },
+    "settings.troubleshooting.trace.label": {
+        "message": "Trace naplók engedélyezése"
+    },
+    "settings.troubleshooting.trace.help": {
+        "message": "TRACE szintre emeli a naplózást, majd utána visszaállítja."
+    },
+    "settings.troubleshooting.capture.label": {
+        "message": "Rögzítési munkamenet"
+    },
+    "settings.troubleshooting.capture.help": {
+        "message": "Újra csatlakozik és vár, hogy reprodukálhassa a problémát."
+    },
+    "settings.troubleshooting.packets.label": {
+        "message": "Hálózati csomagok rögzítése"
+    },
+    "settings.troubleshooting.packets.help": {
+        "message": "A rögzítés ideje alatt elmenti a hálózati forgalom .pcap fájlját."
+    },
+    "settings.troubleshooting.duration.label": {
+        "message": "Rögzítés időtartama"
+    },
+    "settings.troubleshooting.duration.help": {
+        "message": "Mennyi ideig fusson a rögzítési munkamenet."
+    },
+    "settings.troubleshooting.duration.suffix": {
+        "message": "perc"
+    },
+    "settings.troubleshooting.create": {
+        "message": "Hibakeresési csomag létrehozása"
+    },
+    "settings.troubleshooting.progress.description": {
+        "message": "Naplók, rendszerinformációk és kapcsolati állapot gyűjtése folyamatban. Általában néhány pillanatot vesz igénybe — tartsa nyitva ezt az ablakot a befejezésig."
+    },
+    "settings.troubleshooting.cancelling": {
+        "message": "Megszakítás…"
+    },
+    "settings.troubleshooting.done.uploadedTitle": {
+        "message": "A hibakeresési csomag feltöltése sikeres!"
+    },
+    "settings.troubleshooting.done.savedTitle": {
+        "message": "Csomag elmentve"
+    },
+    "settings.troubleshooting.done.uploadedDescription": {
+        "message": "Ossza meg az alábbi feltöltési kulcsot a <docs>NetBird támogatással</docs>. A helyi másolat is elmentve van az eszközén."
+    },
+    "settings.troubleshooting.done.savedDescription": {
+        "message": "A hibakeresési csomag helyileg elmentve."
+    },
+    "settings.troubleshooting.done.copyKey": {
+        "message": "Kulcs másolása"
+    },
+    "settings.troubleshooting.done.openFolder": {
+        "message": "Mappa megnyitása"
+    },
+    "settings.troubleshooting.done.openFileLocation": {
+        "message": "Fájl helyének megnyitása"
+    },
+    "settings.troubleshooting.uploadFailedWithReason": {
+        "message": "Feltöltés sikertelen: {reason} A csomag továbbra is el van mentve helyileg."
+    },
+    "settings.troubleshooting.uploadFailed": {
+        "message": "Feltöltés sikertelen. A csomag továbbra is el van mentve helyileg."
+    },
+    "settings.troubleshooting.stage.reconnecting": {
+        "message": "NetBird újracsatlakoztatása…"
+    },
+    "settings.troubleshooting.stage.capturing": {
+        "message": "Hibakeresési naplók rögzítése"
+    },
+    "settings.troubleshooting.stage.bundling": {
+        "message": "Hibakeresési csomag generálása…"
+    },
+    "settings.troubleshooting.stage.uploading": {
+        "message": "Feltöltés a NetBirdhöz…"
+    },
+    "settings.troubleshooting.stage.cancelling": {
+        "message": "Megszakítás…"
+    },
+    "settings.about.client": {
+        "message": "NetBird Kliens v{version}"
+    },
+    "settings.about.clientName": {
+        "message": "NetBird Kliens"
+    },
+    "settings.about.development": {
+        "message": "[Fejlesztés]"
+    },
+    "settings.about.gui": {
+        "message": "GUI v{version}"
+    },
+    "settings.about.guiName": {
+        "message": "GUI"
+    },
+    "settings.about.copyright": {
+        "message": "© {year} NetBird. Minden jog fenntartva."
+    },
+    "settings.about.links.imprint": {
+        "message": "Impresszum"
+    },
+    "settings.about.links.privacy": {
+        "message": "Adatvédelem"
+    },
+    "settings.about.links.cla": {
+        "message": "CLA"
+    },
+    "settings.about.links.terms": {
+        "message": "Felhasználási feltételek"
+    },
+    "settings.about.community.github": {
+        "message": "GitHub"
+    },
+    "settings.about.community.slack": {
+        "message": "Slack"
+    },
+    "settings.about.community.forum": {
+        "message": "Fórum"
+    },
+    "settings.about.community.documentation": {
+        "message": "Dokumentáció"
+    },
+    "settings.about.community.feedback": {
+        "message": "Visszajelzés"
+    },
+    "update.banner.message": {
+        "message": "A NetBird {version} telepítésre kész."
+    },
+    "update.banner.later": {
+        "message": "Később"
+    },
+    "update.banner.installNow": {
+        "message": "Telepítés most"
+    },
+    "update.card.versionAvailableDownload": {
+        "message": "A {version} verzió letöltésre elérhető."
+    },
+    "update.card.versionAvailableInstall": {
+        "message": "A {version} verzió telepítésre elérhető."
+    },
+    "update.card.whatsNew": {
+        "message": "Mi az újdonság?"
+    },
+    "update.card.installNow": {
+        "message": "Telepítés most"
+    },
+    "update.card.getInstaller": {
+        "message": "Letöltés"
+    },
+    "update.card.autoCheckInterval": {
+        "message": "A NetBird a háttérben keres frissítéseket."
+    },
+    "update.card.changelog": {
+        "message": "Változásnapló"
+    },
+    "update.card.onLatestVersion": {
+        "message": "A legfrissebb verziót használja"
+    },
+    "update.header.tooltip": {
+        "message": "Frissítés elérhető"
+    },
+    "update.overlay.updatingVersion": {
+        "message": "NetBird frissítése a következőre: v{version}"
+    },
+    "update.overlay.updating": {
+        "message": "NetBird frissítése"
+    },
+    "update.overlay.description": {
+        "message": "Egy újabb verzió elérhető és települ. A NetBird automatikusan újraindul a frissítés befejeztével."
+    },
+    "update.overlay.error.timeoutTitle": {
+        "message": "A frissítés túl sokáig tart"
+    },
+    "update.overlay.error.timeoutDescription": {
+        "message": "A(z) {target} telepítése túl sokáig tartott, és nem fejeződött be."
+    },
+    "update.overlay.error.canceledTitle": {
+        "message": "A frissítés megszakítva"
+    },
+    "update.overlay.error.canceledDescription": {
+        "message": "A(z) {target} frissítését megszakították a befejezés előtt."
+    },
+    "update.overlay.error.failTitle": {
+        "message": "A frissítés nem telepíthető"
+    },
+    "update.overlay.error.failDescription": {
+        "message": "A(z) {target} nem volt telepíthető."
+    },
+    "update.overlay.error.unknownMessage": {
+        "message": "ismeretlen hiba"
+    },
+    "update.overlay.error.targetVersion": {
+        "message": "v{version}"
+    },
+    "update.overlay.error.targetFallback": {
+        "message": "az új verzió"
+    },
+    "update.error.loadStateTitle": {
+        "message": "Frissítési állapot betöltése sikertelen"
+    },
+    "update.error.triggerTitle": {
+        "message": "Frissítés indítása sikertelen"
+    },
+    "update.page.versionLine": {
+        "message": "Kliens frissítése erre: {version}."
+    },
+    "update.page.versionLineGeneric": {
+        "message": "Kliens frissítése."
+    },
+    "update.page.outdated": {
+        "message": "Az Ön kliensverziója régebbi, mint a Managementben beállított automatikus frissítési verzió."
+    },
+    "update.page.status.running": {
+        "message": "Frissítés"
+    },
+    "update.page.status.timeout": {
+        "message": "A frissítés időtúllépés miatt megszakadt. Kérjük, próbálja újra."
+    },
+    "update.page.status.canceled": {
+        "message": "Frissítés megszakítva."
+    },
+    "update.page.status.failed": {
+        "message": "Frissítés sikertelen: {message}"
+    },
+    "update.page.status.unknownError": {
+        "message": "ismeretlen frissítési hiba"
+    },
+    "update.page.failedTitle": {
+        "message": "Frissítés sikertelen"
+    },
+    "update.page.timeoutMessage": {
+        "message": "Frissítés időtúllépés."
+    },
+    "update.page.dontClose": {
+        "message": "Kérjük, ne zárja be ezt az ablakot."
+    },
+    "update.page.updating": {
+        "message": "Frissítés…"
+    },
+    "update.page.complete": {
+        "message": "Frissítés kész"
+    },
+    "update.page.failed": {
+        "message": "Frissítés sikertelen"
+    },
+    "window.title.settings": {
+        "message": "Beállítások"
+    },
+    "window.title.signIn": {
+        "message": "Bejelentkezés"
+    },
+    "window.title.sessionExpiration": {
+        "message": "Munkamenet lejár"
+    },
+    "window.title.updating": {
+        "message": "Frissítés"
+    },
+    "window.title.welcome": {
+        "message": "Üdvözli a NetBird"
+    },
+    "window.title.error": {
+        "message": "Hiba"
+    },
+    "welcome.title": {
+        "message": "Keresse a NetBirdöt a tálcán"
+    },
+    "welcome.description": {
+        "message": "A NetBird a tálcán fut. Kattintson az ikonra a csatlakozáshoz, profilváltáshoz vagy a beállítások megnyitásához."
+    },
+    "welcome.continue": {
+        "message": "Folytatás"
+    },
+    "welcome.back": {
+        "message": "Vissza"
+    },
+    "welcome.management.title": {
+        "message": "NetBird beállítása"
+    },
+    "welcome.management.description": {
+        "message": "Kattintson a Folytatás gombra a kezdéshez, vagy válassza a „Saját üzemeltetésű” lehetőséget, ha saját NetBird-szervere van."
+    },
+    "welcome.management.cloud.title": {
+        "message": "NetBird Cloud"
+    },
+    "welcome.management.cloud.description": {
+        "message": "Használja az általunk üzemeltetett szolgáltatást. Nincs szükség beállításra."
+    },
+    "welcome.management.selfHosted.title": {
+        "message": "Saját üzemeltetésű"
+    },
+    "welcome.management.selfHosted.description": {
+        "message": "Csatlakozás a saját felügyeleti szerveréhez."
+    },
+    "welcome.management.urlLabel": {
+        "message": "Felügyeleti szerver URL"
+    },
+    "welcome.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlInvalid": {
+        "message": "Adjon meg egy érvényes URL-t, pl. https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlUnreachable": {
+        "message": "A szerver nem érhető el. Ellenőrizze az URL-t vagy a hálózatot, majd folytassa, ha biztos benne, hogy helyes."
+    },
+    "welcome.management.checking": {
+        "message": "Ellenőrzés…"
+    },
+    "browserLogin.title": {
+        "message": "Folytassa a böngészőben a bejelentkezés befejezéséhez"
+    },
+    "browserLogin.notSeeing": {
+        "message": "Nem látja a böngésző fülét?"
+    },
+    "browserLogin.tryAgain": {
+        "message": "Próbálja újra"
+    },
+    "browserLogin.openFailedTitle": {
+        "message": "A böngésző megnyitása sikertelen"
+    },
+    "sessionExpiration.title": {
+        "message": "A munkamenet hamarosan lejár"
+    },
+    "sessionExpiration.titleLater": {
+        "message": "A munkamenete lejár"
+    },
+    "sessionExpiration.description": {
+        "message": "Az eszköz hamarosan lecsatlakozik. Megújításhoz böngészős bejelentkezés kell."
+    },
+    "sessionExpiration.descriptionLater": {
+        "message": "Egy böngészős bejelentkezés a hálózaton tartja az eszközt."
+    },
+    "sessionExpiration.stay": {
+        "message": "Munkamenet megújítása"
+    },
+    "sessionExpiration.authenticate": {
+        "message": "Bejelentkezés"
+    },
+    "sessionExpiration.logout": {
+        "message": "Kijelentkezés"
+    },
+    "sessionExpiration.expired": {
+        "message": "Munkamenet lejárt"
+    },
+    "sessionExpiration.expiredDescription": {
+        "message": "Eszköz lecsatlakozott. Hitelesítés böngészős bejelentkezéssel az újracsatlakozáshoz."
+    },
+    "sessionExpiration.close": {
+        "message": "Bezárás"
+    },
+    "sessionExpiration.extendFailedTitle": {
+        "message": "A munkamenet meghosszabbítása sikertelen"
+    },
+    "sessionExpiration.logoutFailedTitle": {
+        "message": "Kijelentkezés sikertelen"
+    },
+    "peers.search.placeholder": {
+        "message": "Keresés név vagy IP alapján"
+    },
+    "peers.filter.all": {
+        "message": "Összes"
+    },
+    "peers.filter.online": {
+        "message": "Online"
+    },
+    "peers.filter.offline": {
+        "message": "Offline"
+    },
+    "peers.empty.title": {
+        "message": "Nincs elérhető Peer"
+    },
+    "peers.empty.description": {
+        "message": "Önnek vagy nincsenek elérhető Peerei, vagy nincs hozzáférése egyikhez sem."
+    },
+    "peers.details.domain": {
+        "message": "Domain"
+    },
+    "peers.details.netbirdIp": {
+        "message": "NetBird IP"
+    },
+    "peers.details.netbirdIpv6": {
+        "message": "NetBird IPv6"
+    },
+    "peers.details.publicKey": {
+        "message": "Nyilvános kulcs"
+    },
+    "peers.details.connection": {
+        "message": "Kapcsolat"
+    },
+    "peers.details.latency": {
+        "message": "Késleltetés"
+    },
+    "peers.details.lastHandshake": {
+        "message": "Utolsó Handshake"
+    },
+    "peers.details.statusSince": {
+        "message": "Utolsó kapcsolati frissítés"
+    },
+    "peers.details.bytes": {
+        "message": "Bájtok"
+    },
+    "peers.details.bytesSent": {
+        "message": "Küldve"
+    },
+    "peers.details.bytesReceived": {
+        "message": "Fogadva"
+    },
+    "peers.details.localIce": {
+        "message": "Helyi ICE"
+    },
+    "peers.details.remoteIce": {
+        "message": "Távoli ICE"
+    },
+    "peers.details.never": {
+        "message": "Soha"
+    },
+    "peers.details.justNow": {
+        "message": "Épp most"
+    },
+    "peers.details.refresh": {
+        "message": "Frissítés"
+    },
+    "peers.status.connected": {
+        "message": "Csatlakozva"
+    },
+    "peers.status.connecting": {
+        "message": "Csatlakozás"
+    },
+    "peers.status.disconnected": {
+        "message": "Lecsatlakozva"
+    },
+    "peers.details.relayAddress": {
+        "message": "Relay"
+    },
+    "peers.details.networks": {
+        "message": "Erőforrások"
+    },
+    "peers.details.relayed": {
+        "message": "Relayed"
+    },
+    "peers.details.p2p": {
+        "message": "P2P"
+    },
+    "peers.details.rosenpass": {
+        "message": "Rosenpass engedélyezve"
+    },
+    "networks.search.placeholder": {
+        "message": "Keresés hálózat vagy domain alapján"
+    },
+    "networks.filter.all": {
+        "message": "Összes"
+    },
+    "networks.filter.active": {
+        "message": "Aktív"
+    },
+    "networks.filter.overlapping": {
+        "message": "Átfedő"
+    },
+    "networks.empty.title": {
+        "message": "Nincs elérhető erőforrás"
+    },
+    "networks.empty.description": {
+        "message": "Önnek vagy nincsenek elérhető hálózati erőforrásai vagy nincs hozzáférése egyikhez sem."
+    },
+    "networks.selected": {
+        "message": "Kiválasztva"
+    },
+    "networks.unselected": {
+        "message": "Nincs kiválasztva"
+    },
+    "networks.ips.heading": {
+        "message": "Feloldott IP-címek"
+    },
+    "networks.bulk.selectionCount": {
+        "message": "{selected} / {total} aktív"
+    },
+    "networks.bulk.enableAll": {
+        "message": "Összes engedélyezése"
+    },
+    "networks.bulk.disableAll": {
+        "message": "Összes letiltása"
+    },
+    "exitNodes.search.placeholder": {
+        "message": "Keresés az Exit Node-ok között"
+    },
+    "exitNodes.none": {
+        "message": "Egyik sem"
+    },
+    "exitNodes.empty.title": {
+        "message": "Nincs elérhető Exit Node"
+    },
+    "exitNodes.empty.description": {
+        "message": "Ehhez a Peerhez nem osztottak meg Exit Node-okat."
+    },
+    "exitNodes.card.title": {
+        "message": "Exit Node"
+    },
+    "exitNodes.card.statusActive": {
+        "message": "Aktív"
+    },
+    "exitNodes.card.statusInactive": {
+        "message": "Inaktív"
+    },
+    "exitNodes.dropdown.noneTitle": {
+        "message": "Egyik sem"
+    },
+    "exitNodes.dropdown.noneDescription": {
+        "message": "Közvetlen kapcsolat Exit Node nélkül"
+    },
+    "quickActions.connect": {
+        "message": "Csatlakozás"
+    },
+    "quickActions.disconnect": {
+        "message": "Bontás"
+    },
+    "daemon.unavailable.title": {
+        "message": "A NetBird szolgáltatás nem fut"
+    },
+    "daemon.unavailable.description": {
+        "message": "Az alkalmazás automatikusan újracsatlakozik, amint a szolgáltatás újra elérhető."
+    },
+    "daemon.unavailable.docsLink": {
+        "message": "Dokumentáció"
+    },
+    "daemon.outdated.title": {
+        "message": "A NetBird szolgáltatás elavult"
+    },
+    "daemon.outdated.description": {
+        "message": "Frissítsd a NetBird szolgáltatást az alkalmazás használatához."
+    },
+    "error.jwt_clock_skew": {
+        "message": "A bejelentkezés sikertelen: az eszköz órája eltér a szerverétől. Kérjük, szinkronizálja a rendszer óráját, majd próbálja újra."
+    },
+    "error.jwt_expired": {
+        "message": "A bejelentkezési token lejárt. Kérjük, jelentkezzen be újra."
+    },
+    "error.jwt_signature_invalid": {
+        "message": "A bejelentkezés sikertelen: a token aláírása érvénytelen. Kérjük, lépjen kapcsolatba a rendszergazdával."
+    },
+    "error.session_expired": {
+        "message": "A munkamenet lejárt. Kérjük, jelentkezzen be újra."
+    },
+    "error.invalid_setup_key": {
+        "message": "A telepítőkulcs hiányzik vagy érvénytelen."
+    },
+    "error.permission_denied": {
+        "message": "A szerver elutasította a bejelentkezést."
+    },
+    "error.daemon_unreachable": {
+        "message": "A NetBird szolgáltatás nem válaszol. Kérjük, ellenőrizze, hogy fut-e a szolgáltatás."
+    },
+    "error.unknown": {
+        "message": "A művelet meghiúsult."
+    }
+}
diff --git a/client/ui/i18n/locales/it/common.json b/client/ui/i18n/locales/it/common.json
new file mode 100644
index 000000000..603364fa2
--- /dev/null
+++ b/client/ui/i18n/locales/it/common.json
@@ -0,0 +1,1325 @@
+{
+    "tray.tooltip": {
+        "message": "NetBird"
+    },
+    "tray.status.disconnected": {
+        "message": "Disconnesso"
+    },
+    "tray.status.daemonUnavailable": {
+        "message": "Non in esecuzione"
+    },
+    "tray.status.error": {
+        "message": "Errore"
+    },
+    "tray.status.connected": {
+        "message": "Connesso"
+    },
+    "tray.status.connecting": {
+        "message": "Connessione"
+    },
+    "tray.status.needsLogin": {
+        "message": "Accesso richiesto"
+    },
+    "tray.status.loginFailed": {
+        "message": "Accesso non riuscito"
+    },
+    "tray.status.sessionExpired": {
+        "message": "Sessione scaduta"
+    },
+    "tray.session.expiresIn": {
+        "message": "La sessione scade tra {remaining}"
+    },
+    "tray.session.unit.lessThanMinute": {
+        "message": "meno di un minuto"
+    },
+    "tray.session.unit.minute": {
+        "message": "1 minuto"
+    },
+    "tray.session.unit.minutes": {
+        "message": "{count} minuti"
+    },
+    "tray.session.unit.hour": {
+        "message": "1 ora"
+    },
+    "tray.session.unit.hours": {
+        "message": "{count} ore"
+    },
+    "tray.session.unit.day": {
+        "message": "1 giorno"
+    },
+    "tray.session.unit.days": {
+        "message": "{count} giorni"
+    },
+    "tray.menu.open": {
+        "message": "Apri NetBird"
+    },
+    "tray.menu.connect": {
+        "message": "Connetti"
+    },
+    "tray.menu.disconnect": {
+        "message": "Disconnetti"
+    },
+    "tray.menu.exitNode": {
+        "message": "Nodo di uscita"
+    },
+    "tray.menu.networks": {
+        "message": "Risorse"
+    },
+    "tray.menu.profiles": {
+        "message": "Profili"
+    },
+    "tray.menu.manageProfiles": {
+        "message": "Gestisci profili"
+    },
+    "tray.menu.settings": {
+        "message": "Impostazioni..."
+    },
+    "tray.menu.debugBundle": {
+        "message": "Crea pacchetto di debug"
+    },
+    "tray.menu.about": {
+        "message": "Guida e supporto"
+    },
+    "tray.menu.github": {
+        "message": "GitHub"
+    },
+    "tray.menu.documentation": {
+        "message": "Documentazione"
+    },
+    "tray.menu.troubleshoot": {
+        "message": "Risoluzione dei problemi"
+    },
+    "tray.menu.downloadLatest": {
+        "message": "Scarica l'ultima versione"
+    },
+    "tray.menu.installVersion": {
+        "message": "Installa la versione {version}"
+    },
+    "tray.menu.guiVersion": {
+        "message": "GUI: {version}"
+    },
+    "tray.menu.daemonVersion": {
+        "message": "Daemon: {version}"
+    },
+    "tray.menu.versionUnknown": {
+        "message": "—"
+    },
+    "tray.menu.quit": {
+        "message": "Esci da NetBird"
+    },
+    "notify.daemonOutdated.title": {
+        "message": "Il servizio NetBird è obsoleto"
+    },
+    "notify.daemonOutdated.body": {
+        "message": "Aggiorna il servizio NetBird per usare questa app."
+    },
+    "notify.update.title": {
+        "message": "Aggiornamento NetBird disponibile"
+    },
+    "notify.update.body": {
+        "message": "NetBird {version} è disponibile."
+    },
+    "notify.update.enforcedSuffix": {
+        "message": " L'amministratore richiede questo aggiornamento."
+    },
+    "notify.error.title": {
+        "message": "Errore"
+    },
+    "notify.error.connect": {
+        "message": "Connessione non riuscita"
+    },
+    "notify.error.disconnect": {
+        "message": "Disconnessione non riuscita"
+    },
+    "notify.error.switchProfile": {
+        "message": "Impossibile passare a {profile}"
+    },
+    "notify.error.exitNode": {
+        "message": "Impossibile aggiornare il nodo di uscita {name}"
+    },
+    "notify.sessionExpired.title": {
+        "message": "Sessione NetBird scaduta"
+    },
+    "notify.sessionExpired.body": {
+        "message": "La sessione NetBird è scaduta. Effettui di nuovo l'accesso."
+    },
+    "notify.sessionWarning.title": {
+        "message": "La sessione sta per scadere"
+    },
+    "notify.sessionWarning.body": {
+        "message": "La sessione NetBird scade tra {remaining}. Clicchi su Rinnova ora per rinnovarla."
+    },
+    "notify.sessionWarning.bodyGeneric": {
+        "message": "La sessione NetBird sta per scadere. Clicchi su Rinnova ora per rinnovarla."
+    },
+    "notify.sessionWarning.extend": {
+        "message": "Rinnova ora"
+    },
+    "notify.sessionWarning.dismiss": {
+        "message": "Ignora"
+    },
+    "notify.sessionWarning.failed": {
+        "message": "Impossibile rinnovare la sessione NetBird"
+    },
+    "notify.sessionWarning.successTitle": {
+        "message": "Sessione NetBird rinnovata"
+    },
+    "notify.sessionWarning.successBody": {
+        "message": "La sessione è stata rinnovata."
+    },
+    "notify.sessionDeadlineRejected.title": {
+        "message": "Scadenza sessione rifiutata"
+    },
+    "notify.sessionDeadlineRejected.body": {
+        "message": "Il server ha inviato una scadenza di sessione non valida. Effettui di nuovo l'accesso."
+    },
+    "notify.mdm.policyApplied.title": {
+        "message": "Impostazioni NetBird aggiornate"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "La configurazione di NetBird è stata aggiornata dalla policy IT."
+    },
+    "common.cancel": {
+        "message": "Annulla"
+    },
+    "common.save": {
+        "message": "Salva"
+    },
+    "common.saveChanges": {
+        "message": "Salva modifiche"
+    },
+    "common.saving": {
+        "message": "Salvataggio…"
+    },
+    "common.close": {
+        "message": "Chiudi"
+    },
+    "common.copy": {
+        "message": "Copia"
+    },
+    "common.togglePasswordVisibility": {
+        "message": "Mostra/nascondi password"
+    },
+    "common.increase": {
+        "message": "Aumenta"
+    },
+    "common.decrease": {
+        "message": "Diminuisci"
+    },
+    "common.delete": {
+        "message": "Elimina"
+    },
+    "common.create": {
+        "message": "Crea"
+    },
+    "common.add": {
+        "message": "Aggiungi"
+    },
+    "common.remove": {
+        "message": "Rimuovi"
+    },
+    "common.refresh": {
+        "message": "Aggiorna"
+    },
+    "common.loading": {
+        "message": "Caricamento…"
+    },
+    "common.netbird": {
+        "message": "NetBird"
+    },
+    "common.noResults.title": {
+        "message": "Nessun risultato trovato"
+    },
+    "common.noResults.description": {
+        "message": "Non è stato trovato alcun risultato. Provi un altro termine di ricerca o modifichi i filtri."
+    },
+    "notConnected.title": {
+        "message": "Disconnesso"
+    },
+    "notConnected.description": {
+        "message": "Si connetta prima a NetBird per visualizzare informazioni dettagliate su peer, risorse di rete e nodi di uscita."
+    },
+    "connect.status.disconnected": {
+        "message": "Disconnesso"
+    },
+    "connect.status.connecting": {
+        "message": "Connessione..."
+    },
+    "connect.status.connected": {
+        "message": "Connesso"
+    },
+    "connect.status.disconnecting": {
+        "message": "Disconnessione..."
+    },
+    "connect.status.daemonUnavailable": {
+        "message": "Daemon non disponibile"
+    },
+    "connect.status.loginRequired": {
+        "message": "Accesso richiesto"
+    },
+    "connect.error.loginTitle": {
+        "message": "Accesso non riuscito"
+    },
+    "connect.error.connectTitle": {
+        "message": "Connessione non riuscita"
+    },
+    "connect.error.disconnectTitle": {
+        "message": "Disconnessione non riuscita"
+    },
+    "nav.peers.title": {
+        "message": "Peer"
+    },
+    "nav.peers.description": {
+        "message": "{connected} di {total} connessi"
+    },
+    "nav.resources.title": {
+        "message": "Risorse"
+    },
+    "nav.resources.description": {
+        "message": "{active} di {total} attive"
+    },
+    "nav.exitNode.title": {
+        "message": "Nodi di uscita"
+    },
+    "nav.exitNode.none": {
+        "message": "Non attivo"
+    },
+    "nav.exitNode.using": {
+        "message": "Tramite {name}"
+    },
+    "header.openSettings": {
+        "message": "Apri impostazioni"
+    },
+    "header.togglePanel": {
+        "message": "Mostra/nascondi pannello laterale"
+    },
+    "profile.selector.loading": {
+        "message": "Caricamento..."
+    },
+    "profile.selector.noProfile": {
+        "message": "Nessun profilo"
+    },
+    "profile.selector.searchPlaceholder": {
+        "message": "Cerca profilo per nome..."
+    },
+    "profile.selector.emptyTitle": {
+        "message": "Nessun profilo trovato"
+    },
+    "profile.selector.emptyDescription": {
+        "message": "Provi un altro termine di ricerca o crei un nuovo profilo."
+    },
+    "profile.selector.newProfile": {
+        "message": "Nuovo profilo"
+    },
+    "profile.selector.moreOptions": {
+        "message": "Altre opzioni"
+    },
+    "profile.selector.deregister": {
+        "message": "Annulla registrazione"
+    },
+    "profile.selector.delete": {
+        "message": "Elimina"
+    },
+    "profile.selector.switchTo": {
+        "message": "Passa a questo profilo"
+    },
+    "profile.selector.edit": {
+        "message": "Modifica"
+    },
+    "profile.edit.title": {
+        "message": "Modifica profilo"
+    },
+    "profile.edit.submit": {
+        "message": "Salva modifiche"
+    },
+    "profile.dialog.title": {
+        "message": "Inserisci il nome del profilo"
+    },
+    "profile.dialog.nameLabel": {
+        "message": "Nome del profilo"
+    },
+    "profile.dialog.description": {
+        "message": "Imposti un nome facilmente riconoscibile per il profilo."
+    },
+    "profile.dialog.placeholder": {
+        "message": "es. lavoro"
+    },
+    "profile.dialog.submit": {
+        "message": "Aggiungi profilo"
+    },
+    "profile.dialog.required": {
+        "message": "Inserisca un nome per il profilo, es. lavoro, casa"
+    },
+    "profile.dialog.managementHelp": {
+        "message": "Usi NetBird Cloud o il suo server."
+    },
+    "profile.dialog.urlUnreachable": {
+        "message": "Impossibile raggiungere questo server. Controlli l'URL, oppure aggiunga comunque il profilo se è certo che sia corretto."
+    },
+    "header.menu.settings": {
+        "message": "Impostazioni..."
+    },
+    "header.menu.defaultView": {
+        "message": "Vista predefinita"
+    },
+    "header.menu.advancedView": {
+        "message": "Vista avanzata"
+    },
+    "header.menu.updateAvailable": {
+        "message": "Aggiornamento disponibile"
+    },
+    "header.menu.open": {
+        "message": "Apri menu"
+    },
+    "header.profile.switch": {
+        "message": "Cambia profilo"
+    },
+    "connect.toggle.label": {
+        "message": "Attiva/disattiva connessione NetBird"
+    },
+    "connect.localIp.label": {
+        "message": "Indirizzi IP locali"
+    },
+    "common.search": {
+        "message": "Cerca"
+    },
+    "common.filter": {
+        "message": "Filtra"
+    },
+    "exitNodes.dropdown.trigger": {
+        "message": "Seleziona nodo di uscita"
+    },
+    "peers.row.label": {
+        "message": "Apri dettagli di {name}, {status}"
+    },
+    "peers.dialog.title": {
+        "message": "Dettagli peer"
+    },
+    "networks.row.toggle": {
+        "message": "Attiva/disattiva {name}"
+    },
+    "networks.bulk.label": {
+        "message": "Attiva/disattiva tutte le risorse visibili"
+    },
+    "settings.nav.label": {
+        "message": "Sezioni delle impostazioni"
+    },
+    "profile.switch.title": {
+        "message": "Passare al profilo «{name}»?"
+    },
+    "profile.switch.message": {
+        "message": "Vuole davvero cambiare profilo?\nIl profilo attuale verrà disconnesso."
+    },
+    "profile.switch.confirm": {
+        "message": "Conferma"
+    },
+    "profile.deregister.title": {
+        "message": "Annullare la registrazione del profilo «{name}»?"
+    },
+    "profile.deregister.message": {
+        "message": "Vuole davvero annullare la registrazione di questo profilo?\nDovrà accedere di nuovo per usarlo."
+    },
+    "profile.deregister.confirm": {
+        "message": "Annulla registrazione"
+    },
+    "profile.delete.title": {
+        "message": "Eliminare il profilo «{name}»?"
+    },
+    "profile.delete.message": {
+        "message": "Vuole davvero eliminare questo profilo?\nQuesta azione non può essere annullata."
+    },
+    "profile.delete.disabledActive": {
+        "message": "I profili attivi non possono essere eliminati. Passi a un altro profilo prima di eliminare questo."
+    },
+    "profile.delete.disabledDefault": {
+        "message": "Il profilo predefinito non può essere eliminato."
+    },
+    "profile.error.switchTitle": {
+        "message": "Cambio profilo non riuscito"
+    },
+    "profile.error.deregisterTitle": {
+        "message": "Annullamento registrazione non riuscito"
+    },
+    "profile.error.deleteTitle": {
+        "message": "Eliminazione profilo non riuscita"
+    },
+    "profile.error.createTitle": {
+        "message": "Creazione profilo non riuscita"
+    },
+    "profile.error.editTitle": {
+        "message": "Modifica del profilo non riuscita"
+    },
+    "profile.error.loadTitle": {
+        "message": "Caricamento profili non riuscito"
+    },
+    "profile.dropdown.activeProfile": {
+        "message": "Profilo attivo"
+    },
+    "profile.dropdown.switchProfile": {
+        "message": "Cambia profilo"
+    },
+    "profile.dropdown.noEmail": {
+        "message": "Altro"
+    },
+    "profile.dropdown.addProfile": {
+        "message": "Aggiungi profilo"
+    },
+    "profile.dropdown.manageProfiles": {
+        "message": "Gestisci profili"
+    },
+    "profile.dropdown.settings": {
+        "message": "Impostazioni"
+    },
+    "settings.profiles.section.profiles": {
+        "message": "Profili"
+    },
+    "settings.profiles.intro": {
+        "message": "Mantenga affiancate identità NetBird separate, ad esempio account di lavoro e personali, oppure server di gestione diversi. Aggiunga, annulli la registrazione o elimini i profili qui sotto."
+    },
+    "settings.profiles.addProfile": {
+        "message": "Aggiungi profilo"
+    },
+    "settings.profiles.active": {
+        "message": "Attivo"
+    },
+    "settings.profiles.emptyTitle": {
+        "message": "Nessun profilo"
+    },
+    "settings.profiles.emptyDescription": {
+        "message": "Crei un profilo per connettersi a un server di gestione NetBird."
+    },
+    "settings.error.loadTitle": {
+        "message": "Caricamento impostazioni non riuscito"
+    },
+    "settings.error.saveTitle": {
+        "message": "Salvataggio impostazioni non riuscito"
+    },
+    "settings.error.debugBundleTitle": {
+        "message": "Pacchetto di debug non riuscito"
+    },
+    "settings.tabs.general": {
+        "message": "Generale"
+    },
+    "settings.tabs.network": {
+        "message": "Rete"
+    },
+    "settings.tabs.security": {
+        "message": "Sicurezza"
+    },
+    "settings.tabs.profiles": {
+        "message": "Profili"
+    },
+    "settings.tabs.ssh": {
+        "message": "SSH"
+    },
+    "settings.tabs.advanced": {
+        "message": "Avanzate"
+    },
+    "settings.tabs.troubleshooting": {
+        "message": "Risoluzione problemi"
+    },
+    "settings.tabs.about": {
+        "message": "Informazioni"
+    },
+    "settings.tabs.updateAvailable": {
+        "message": "Aggiornamento disponibile"
+    },
+    "settings.general.section.general": {
+        "message": "Generale"
+    },
+    "settings.general.section.connection": {
+        "message": "Connessione"
+    },
+    "settings.general.connectOnStartup.label": {
+        "message": "Connetti all'avvio"
+    },
+    "settings.general.connectOnStartup.help": {
+        "message": "Stabilisce automaticamente una connessione all'avvio del servizio."
+    },
+    "settings.general.notifications.label": {
+        "message": "Notifiche desktop"
+    },
+    "settings.general.notifications.help": {
+        "message": "Mostra notifiche desktop per nuovi aggiornamenti ed eventi di connessione."
+    },
+    "settings.general.autostart.label": {
+        "message": "Avvia l'interfaccia NetBird all'accesso"
+    },
+    "settings.general.autostart.help": {
+        "message": "Avvia automaticamente l'interfaccia NetBird quando effettua l'accesso. Riguarda solo l'interfaccia grafica, non il servizio in background."
+    },
+    "settings.general.autostart.errorTitle": {
+        "message": "Modifica avvio automatico non riuscita"
+    },
+    "settings.general.language.label": {
+        "message": "Lingua dell'interfaccia"
+    },
+    "settings.general.language.help": {
+        "message": "Scelga la lingua dell'interfaccia NetBird."
+    },
+    "settings.general.language.search": {
+        "message": "Cerca lingua…"
+    },
+    "settings.general.language.empty": {
+        "message": "Nessuna lingua corrisponde."
+    },
+    "settings.general.management.label": {
+        "message": "Server di gestione"
+    },
+    "settings.general.management.help": {
+        "message": "Si connetta a NetBird Cloud o al suo server di gestione self-hosted. Le modifiche riconnettono il client."
+    },
+    "settings.general.management.cloud": {
+        "message": "Cloud"
+    },
+    "settings.general.management.selfHosted": {
+        "message": "Self-hosted"
+    },
+    "settings.general.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlError": {
+        "message": "Inserisca un URL valido, es. https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlUnreachable": {
+        "message": "Impossibile raggiungere questo server. Controlli l'URL, oppure salvi comunque se è certo che sia corretto."
+    },
+    "settings.general.management.switchCloudTitle": {
+        "message": "Passare a NetBird Cloud?"
+    },
+    "settings.general.management.switchCloudMessage": {
+        "message": "Questo disconnette il suo server self-hosted.\nPotrebbe dover accedere di nuovo."
+    },
+    "settings.general.management.switchCloudConfirm": {
+        "message": "Passa a Cloud"
+    },
+    "settings.network.section.connectivity": {
+        "message": "Connettività"
+    },
+    "settings.network.section.routingDns": {
+        "message": "Routing e DNS"
+    },
+    "settings.network.monitor.label": {
+        "message": "Riconnetti al cambio di rete"
+    },
+    "settings.network.monitor.help": {
+        "message": "Monitora la rete e si riconnette automaticamente ai cambiamenti, come il passaggio di Wi-Fi, le modifiche Ethernet o la ripresa dalla sospensione."
+    },
+    "settings.network.dns.label": {
+        "message": "Abilita DNS"
+    },
+    "settings.network.dns.help": {
+        "message": "Applica le impostazioni DNS gestite da NetBird al resolver dell'host."
+    },
+    "settings.network.clientRoutes.label": {
+        "message": "Abilita route client"
+    },
+    "settings.network.clientRoutes.help": {
+        "message": "Accetta le route da altri peer per raggiungere le loro reti."
+    },
+    "settings.network.serverRoutes.label": {
+        "message": "Abilita route server"
+    },
+    "settings.network.serverRoutes.help": {
+        "message": "Annuncia le route locali di questo host agli altri peer."
+    },
+    "settings.network.ipv6.label": {
+        "message": "Abilita IPv6"
+    },
+    "settings.network.ipv6.help": {
+        "message": "Usa l'indirizzamento IPv6 per la rete overlay NetBird."
+    },
+    "settings.security.section.firewall": {
+        "message": "Firewall"
+    },
+    "settings.security.section.encryption": {
+        "message": "Crittografia"
+    },
+    "settings.security.blockInbound.label": {
+        "message": "Blocca traffico in entrata"
+    },
+    "settings.security.blockInbound.help": {
+        "message": "Rifiuta le connessioni non richieste dai peer verso questo dispositivo e le reti che instrada. Il traffico in uscita non è interessato."
+    },
+    "settings.security.blockLan.label": {
+        "message": "Blocca accesso alla LAN"
+    },
+    "settings.security.blockLan.help": {
+        "message": "Impedisce ai peer di raggiungere la sua rete locale o i suoi dispositivi quando questo dispositivo instrada il loro traffico."
+    },
+    "settings.security.rosenpass.label": {
+        "message": "Abilita resistenza quantistica"
+    },
+    "settings.security.rosenpass.help": {
+        "message": "Aggiunge uno scambio di chiavi post-quantistico tramite Rosenpass sopra WireGuard®."
+    },
+    "settings.security.rosenpassPermissive.label": {
+        "message": "Abilita modalità permissiva"
+    },
+    "settings.security.rosenpassPermissive.help": {
+        "message": "Consente le connessioni con peer privi del supporto alla resistenza quantistica."
+    },
+    "settings.ssh.section.server": {
+        "message": "Server"
+    },
+    "settings.ssh.section.capabilities": {
+        "message": "Funzionalità"
+    },
+    "settings.ssh.section.authentication": {
+        "message": "Autenticazione"
+    },
+    "settings.ssh.server.label": {
+        "message": "Abilita server SSH"
+    },
+    "settings.ssh.server.help": {
+        "message": "Esegue il server SSH di NetBird su questo host in modo che altri peer possano connettersi."
+    },
+    "settings.ssh.root.label": {
+        "message": "Consenti accesso come root"
+    },
+    "settings.ssh.root.help": {
+        "message": "Permette ai peer di accedere come utente root. Disabiliti per richiedere un account senza privilegi."
+    },
+    "settings.ssh.sftp.label": {
+        "message": "Consenti SFTP"
+    },
+    "settings.ssh.sftp.help": {
+        "message": "Trasferisca file in modo sicuro usando client SFTP o SCP nativi."
+    },
+    "settings.ssh.localForward.label": {
+        "message": "Inoltro porte locale"
+    },
+    "settings.ssh.localForward.help": {
+        "message": "Permette ai peer in connessione di inoltrare porte locali verso servizi raggiungibili da questo host."
+    },
+    "settings.ssh.remoteForward.label": {
+        "message": "Inoltro porte remoto"
+    },
+    "settings.ssh.remoteForward.help": {
+        "message": "Permette ai peer in connessione di esporre porte di questo host verso la loro macchina."
+    },
+    "settings.ssh.jwt.label": {
+        "message": "Abilita autenticazione JWT"
+    },
+    "settings.ssh.jwt.help": {
+        "message": "Verifica ogni sessione SSH con il suo IdP per l'identità utente e l'audit. Disabiliti per basarsi solo sulle policy ACL di rete, utile quando non è disponibile un IdP."
+    },
+    "settings.ssh.jwtTtl.label": {
+        "message": "TTL cache JWT"
+    },
+    "settings.ssh.jwtTtl.help": {
+        "message": "Per quanto tempo questo client memorizza un JWT prima di richiederlo di nuovo sulle connessioni SSH in uscita. Imposti 0 per disabilitare la cache e autenticarsi a ogni connessione."
+    },
+    "settings.ssh.jwtTtl.suffix": {
+        "message": "sec."
+    },
+    "settings.advanced.section.interface": {
+        "message": "Interfaccia"
+    },
+    "settings.advanced.section.security": {
+        "message": "Sicurezza"
+    },
+    "settings.advanced.interfaceName.label": {
+        "message": "Nome"
+    },
+    "settings.advanced.interfaceName.error": {
+        "message": "Usi da 1 a 15 lettere, cifre, punti, trattini o trattini bassi."
+    },
+    "settings.advanced.interfaceName.errorMac": {
+        "message": "Deve iniziare con \"utun\" seguito da un numero (es. utun100)."
+    },
+    "settings.advanced.port.label": {
+        "message": "Porta"
+    },
+    "settings.advanced.port.error": {
+        "message": "Inserisca una porta compresa tra {min} e {max}."
+    },
+    "settings.advanced.port.help": {
+        "message": "Se impostata su 0, verrà usata una porta libera casuale."
+    },
+    "settings.advanced.mtu.label": {
+        "message": "MTU"
+    },
+    "settings.advanced.mtu.error": {
+        "message": "Inserisca un valore MTU compreso tra {min} e {max}."
+    },
+    "settings.advanced.psk.label": {
+        "message": "Chiave pre-condivisa"
+    },
+    "settings.advanced.psk.help": {
+        "message": "PSK WireGuard opzionale per una crittografia simmetrica aggiuntiva. Non è la stessa cosa di una chiave di configurazione NetBird. Comunicherà solo con i peer che usano la stessa chiave pre-condivisa."
+    },
+    "settings.troubleshooting.section.title": {
+        "message": "Pacchetto di debug"
+    },
+    "settings.troubleshooting.anonymize.label": {
+        "message": "Anonimizza informazioni sensibili"
+    },
+    "settings.troubleshooting.anonymize.help": {
+        "message": "Nasconde gli indirizzi IP pubblici e i domini non NetBird dai log."
+    },
+    "settings.troubleshooting.systemInfo.label": {
+        "message": "Includi informazioni di sistema"
+    },
+    "settings.troubleshooting.systemInfo.help": {
+        "message": "Include OS, kernel, interfacce di rete e tabelle di routing."
+    },
+    "settings.troubleshooting.upload.label": {
+        "message": "Carica il pacchetto sui server NetBird"
+    },
+    "settings.troubleshooting.upload.help": {
+        "message": "Restituisce una chiave di caricamento da condividere con il supporto NetBird."
+    },
+    "settings.troubleshooting.trace.label": {
+        "message": "Abilita log di traccia"
+    },
+    "settings.troubleshooting.trace.help": {
+        "message": "Aumenta il livello di log a TRACE e lo ripristina al termine."
+    },
+    "settings.troubleshooting.capture.label": {
+        "message": "Sessione di acquisizione"
+    },
+    "settings.troubleshooting.capture.help": {
+        "message": "Si riconnette e attende per consentirle di riprodurre il problema."
+    },
+    "settings.troubleshooting.packets.label": {
+        "message": "Acquisisci pacchetti di rete"
+    },
+    "settings.troubleshooting.packets.help": {
+        "message": "Salva un .pcap del traffico di rete durante la sessione di acquisizione."
+    },
+    "settings.troubleshooting.duration.label": {
+        "message": "Durata acquisizione"
+    },
+    "settings.troubleshooting.duration.help": {
+        "message": "Per quanto tempo viene eseguita la sessione di acquisizione."
+    },
+    "settings.troubleshooting.duration.suffix": {
+        "message": "min."
+    },
+    "settings.troubleshooting.create": {
+        "message": "Crea pacchetto"
+    },
+    "settings.troubleshooting.progress.description": {
+        "message": "Raccolta di log, dettagli di sistema e stato della connessione. Di solito richiede un momento: tenga aperta questa finestra fino al completamento."
+    },
+    "settings.troubleshooting.cancelling": {
+        "message": "Annullamento…"
+    },
+    "settings.troubleshooting.done.uploadedTitle": {
+        "message": "Pacchetto di debug caricato con successo!"
+    },
+    "settings.troubleshooting.done.savedTitle": {
+        "message": "Pacchetto salvato"
+    },
+    "settings.troubleshooting.done.uploadedDescription": {
+        "message": "Condivida la chiave di caricamento qui sotto con il <docs>supporto NetBird</docs>. Una copia locale è stata salvata anche sul suo dispositivo."
+    },
+    "settings.troubleshooting.done.savedDescription": {
+        "message": "Il pacchetto di debug è stato salvato localmente."
+    },
+    "settings.troubleshooting.done.copyKey": {
+        "message": "Copia chiave"
+    },
+    "settings.troubleshooting.done.openFolder": {
+        "message": "Apri cartella"
+    },
+    "settings.troubleshooting.done.openFileLocation": {
+        "message": "Apri posizione file"
+    },
+    "settings.troubleshooting.uploadFailedWithReason": {
+        "message": "Caricamento non riuscito: {reason} Il pacchetto è comunque salvato localmente."
+    },
+    "settings.troubleshooting.uploadFailed": {
+        "message": "Caricamento non riuscito. Il pacchetto è comunque salvato localmente."
+    },
+    "settings.troubleshooting.stage.reconnecting": {
+        "message": "Riconnessione di NetBird…"
+    },
+    "settings.troubleshooting.stage.capturing": {
+        "message": "Acquisizione log di debug"
+    },
+    "settings.troubleshooting.stage.bundling": {
+        "message": "Generazione del pacchetto di debug…"
+    },
+    "settings.troubleshooting.stage.uploading": {
+        "message": "Caricamento su NetBird…"
+    },
+    "settings.troubleshooting.stage.cancelling": {
+        "message": "Annullamento…"
+    },
+    "settings.about.client": {
+        "message": "NetBird Client v{version}"
+    },
+    "settings.about.clientName": {
+        "message": "NetBird Client"
+    },
+    "settings.about.development": {
+        "message": "[Development]"
+    },
+    "settings.about.gui": {
+        "message": "GUI v{version}"
+    },
+    "settings.about.guiName": {
+        "message": "GUI"
+    },
+    "settings.about.copyright": {
+        "message": "© {year} NetBird. Tutti i diritti riservati."
+    },
+    "settings.about.links.imprint": {
+        "message": "Note legali"
+    },
+    "settings.about.links.privacy": {
+        "message": "Privacy"
+    },
+    "settings.about.links.cla": {
+        "message": "CLA"
+    },
+    "settings.about.links.terms": {
+        "message": "Termini di servizio"
+    },
+    "settings.about.community.github": {
+        "message": "GitHub"
+    },
+    "settings.about.community.slack": {
+        "message": "Slack"
+    },
+    "settings.about.community.forum": {
+        "message": "Forum"
+    },
+    "settings.about.community.documentation": {
+        "message": "Documentazione"
+    },
+    "settings.about.community.feedback": {
+        "message": "Feedback"
+    },
+    "update.banner.message": {
+        "message": "NetBird {version} è pronto per l'installazione."
+    },
+    "update.banner.later": {
+        "message": "Più tardi"
+    },
+    "update.banner.installNow": {
+        "message": "Installa ora"
+    },
+    "update.card.versionAvailableDownload": {
+        "message": "La versione {version} è disponibile per il download."
+    },
+    "update.card.versionAvailableInstall": {
+        "message": "La versione {version} è disponibile per l'installazione."
+    },
+    "update.card.whatsNew": {
+        "message": "Novità?"
+    },
+    "update.card.installNow": {
+        "message": "Installa ora"
+    },
+    "update.card.getInstaller": {
+        "message": "Scarica"
+    },
+    "update.card.autoCheckInterval": {
+        "message": "NetBird verifica gli aggiornamenti in background."
+    },
+    "update.card.changelog": {
+        "message": "Changelog"
+    },
+    "update.card.onLatestVersion": {
+        "message": "Sta usando l'ultima versione"
+    },
+    "update.header.tooltip": {
+        "message": "Aggiornamento disponibile"
+    },
+    "update.overlay.updatingVersion": {
+        "message": "Aggiornamento di NetBird alla v{version}"
+    },
+    "update.overlay.updating": {
+        "message": "Aggiornamento di NetBird"
+    },
+    "update.overlay.description": {
+        "message": "È disponibile una versione più recente ed è in corso l'installazione. NetBird si riavvierà automaticamente al termine dell'aggiornamento."
+    },
+    "update.overlay.error.timeoutTitle": {
+        "message": "L'aggiornamento richiede troppo tempo"
+    },
+    "update.overlay.error.timeoutDescription": {
+        "message": "L'installazione di {target} ha richiesto troppo tempo e non è stata completata."
+    },
+    "update.overlay.error.canceledTitle": {
+        "message": "Aggiornamento interrotto"
+    },
+    "update.overlay.error.canceledDescription": {
+        "message": "L'aggiornamento a {target} è stato annullato prima del completamento."
+    },
+    "update.overlay.error.failTitle": {
+        "message": "Impossibile installare l'aggiornamento"
+    },
+    "update.overlay.error.failDescription": {
+        "message": "Impossibile installare {target}."
+    },
+    "update.overlay.error.unknownMessage": {
+        "message": "errore sconosciuto"
+    },
+    "update.overlay.error.targetVersion": {
+        "message": "v{version}"
+    },
+    "update.overlay.error.targetFallback": {
+        "message": "la nuova versione"
+    },
+    "update.error.loadStateTitle": {
+        "message": "Caricamento stato aggiornamento non riuscito"
+    },
+    "update.error.triggerTitle": {
+        "message": "Avvio aggiornamento non riuscito"
+    },
+    "update.page.versionLine": {
+        "message": "Aggiornamento del client a: {version}."
+    },
+    "update.page.versionLineGeneric": {
+        "message": "Aggiornamento del client."
+    },
+    "update.page.outdated": {
+        "message": "La versione del client è precedente alla versione di aggiornamento automatico impostata in Management."
+    },
+    "update.page.status.running": {
+        "message": "Aggiornamento in corso"
+    },
+    "update.page.status.timeout": {
+        "message": "Aggiornamento scaduto. Riprovi."
+    },
+    "update.page.status.canceled": {
+        "message": "Aggiornamento annullato."
+    },
+    "update.page.status.failed": {
+        "message": "Aggiornamento non riuscito: {message}"
+    },
+    "update.page.status.unknownError": {
+        "message": "errore di aggiornamento sconosciuto"
+    },
+    "update.page.failedTitle": {
+        "message": "Aggiornamento non riuscito"
+    },
+    "update.page.timeoutMessage": {
+        "message": "Aggiornamento scaduto."
+    },
+    "update.page.dontClose": {
+        "message": "Non chiuda questa finestra."
+    },
+    "update.page.updating": {
+        "message": "Aggiornamento…"
+    },
+    "update.page.complete": {
+        "message": "Aggiornamento completato"
+    },
+    "update.page.failed": {
+        "message": "Aggiornamento non riuscito"
+    },
+    "window.title.settings": {
+        "message": "Impostazioni"
+    },
+    "window.title.signIn": {
+        "message": "Accesso"
+    },
+    "window.title.sessionExpiration": {
+        "message": "Sessione in scadenza"
+    },
+    "window.title.updating": {
+        "message": "Aggiornamento"
+    },
+    "window.title.welcome": {
+        "message": "Benvenuto in NetBird"
+    },
+    "window.title.error": {
+        "message": "Errore"
+    },
+    "welcome.title": {
+        "message": "Cerchi NetBird nella tray"
+    },
+    "welcome.description": {
+        "message": "NetBird risiede nella tray. Clicchi sull'icona per connettersi, cambiare profilo o aprire le impostazioni."
+    },
+    "welcome.continue": {
+        "message": "Continua"
+    },
+    "welcome.back": {
+        "message": "Indietro"
+    },
+    "welcome.management.title": {
+        "message": "Configura NetBird"
+    },
+    "welcome.management.description": {
+        "message": "Clicchi su Continua per iniziare, oppure scelga Self-hosted se dispone di un proprio server NetBird."
+    },
+    "welcome.management.cloud.title": {
+        "message": "NetBird Cloud"
+    },
+    "welcome.management.cloud.description": {
+        "message": "Usi il nostro servizio gestito. Nessuna configurazione necessaria."
+    },
+    "welcome.management.selfHosted.title": {
+        "message": "Self-hosted"
+    },
+    "welcome.management.selfHosted.description": {
+        "message": "Si connetta al suo server di gestione."
+    },
+    "welcome.management.urlLabel": {
+        "message": "URL del server di gestione"
+    },
+    "welcome.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlInvalid": {
+        "message": "Inserisca un URL valido, es. https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlUnreachable": {
+        "message": "Impossibile raggiungere questo server. Controlli l'URL o la sua rete, poi prosegua se è certo che sia corretto."
+    },
+    "welcome.management.checking": {
+        "message": "Verifica…"
+    },
+    "browserLogin.title": {
+        "message": "Continui nel browser per completare l'accesso"
+    },
+    "browserLogin.notSeeing": {
+        "message": "Non vede la scheda del browser?"
+    },
+    "browserLogin.tryAgain": {
+        "message": "Riprova"
+    },
+    "browserLogin.openFailedTitle": {
+        "message": "Apertura browser non riuscita"
+    },
+    "sessionExpiration.title": {
+        "message": "La sessione sta per scadere"
+    },
+    "sessionExpiration.titleLater": {
+        "message": "La sessione scadrà"
+    },
+    "sessionExpiration.description": {
+        "message": "Questo dispositivo verrà disconnesso a breve. Rinnovi con un accesso dal browser."
+    },
+    "sessionExpiration.descriptionLater": {
+        "message": "Un accesso dal browser mantiene questo dispositivo connesso alla sua rete."
+    },
+    "sessionExpiration.stay": {
+        "message": "Rinnova sessione"
+    },
+    "sessionExpiration.authenticate": {
+        "message": "Autenticati"
+    },
+    "sessionExpiration.logout": {
+        "message": "Esci"
+    },
+    "sessionExpiration.expired": {
+        "message": "Sessione scaduta"
+    },
+    "sessionExpiration.expiredDescription": {
+        "message": "Dispositivo disconnesso. Si autentichi con un accesso dal browser per riconnettersi."
+    },
+    "sessionExpiration.close": {
+        "message": "Chiudi"
+    },
+    "sessionExpiration.extendFailedTitle": {
+        "message": "Rinnovo sessione non riuscito"
+    },
+    "sessionExpiration.logoutFailedTitle": {
+        "message": "Disconnessione non riuscita"
+    },
+    "peers.search.placeholder": {
+        "message": "Cerca per nome o IP"
+    },
+    "peers.filter.all": {
+        "message": "Tutti"
+    },
+    "peers.filter.online": {
+        "message": "Online"
+    },
+    "peers.filter.offline": {
+        "message": "Offline"
+    },
+    "peers.empty.title": {
+        "message": "Nessun peer disponibile"
+    },
+    "peers.empty.description": {
+        "message": "Non ha peer disponibili oppure non ha accesso a nessuno di essi."
+    },
+    "peers.details.domain": {
+        "message": "Dominio"
+    },
+    "peers.details.netbirdIp": {
+        "message": "IP NetBird"
+    },
+    "peers.details.netbirdIpv6": {
+        "message": "IPv6 NetBird"
+    },
+    "peers.details.publicKey": {
+        "message": "Chiave pubblica"
+    },
+    "peers.details.connection": {
+        "message": "Connessione"
+    },
+    "peers.details.latency": {
+        "message": "Latenza"
+    },
+    "peers.details.lastHandshake": {
+        "message": "Ultimo handshake"
+    },
+    "peers.details.statusSince": {
+        "message": "Ultimo aggiornamento connessione"
+    },
+    "peers.details.bytes": {
+        "message": "Byte"
+    },
+    "peers.details.bytesSent": {
+        "message": "Inviati"
+    },
+    "peers.details.bytesReceived": {
+        "message": "Ricevuti"
+    },
+    "peers.details.localIce": {
+        "message": "ICE locale"
+    },
+    "peers.details.remoteIce": {
+        "message": "ICE remoto"
+    },
+    "peers.details.never": {
+        "message": "Mai"
+    },
+    "peers.details.justNow": {
+        "message": "Proprio ora"
+    },
+    "peers.details.refresh": {
+        "message": "Aggiorna"
+    },
+    "peers.status.connected": {
+        "message": "Connesso"
+    },
+    "peers.status.connecting": {
+        "message": "Connessione"
+    },
+    "peers.status.disconnected": {
+        "message": "Disconnesso"
+    },
+    "peers.details.relayAddress": {
+        "message": "Relay"
+    },
+    "peers.details.networks": {
+        "message": "Risorse"
+    },
+    "peers.details.relayed": {
+        "message": "Tramite relay"
+    },
+    "peers.details.p2p": {
+        "message": "P2P"
+    },
+    "peers.details.rosenpass": {
+        "message": "Rosenpass abilitato"
+    },
+    "networks.search.placeholder": {
+        "message": "Cerca per rete o dominio"
+    },
+    "networks.filter.all": {
+        "message": "Tutte"
+    },
+    "networks.filter.active": {
+        "message": "Attive"
+    },
+    "networks.filter.overlapping": {
+        "message": "Sovrapposte"
+    },
+    "networks.empty.title": {
+        "message": "Nessuna risorsa disponibile"
+    },
+    "networks.empty.description": {
+        "message": "Non ha risorse di rete disponibili oppure non ha accesso a nessuna di esse."
+    },
+    "networks.selected": {
+        "message": "Selezionata"
+    },
+    "networks.unselected": {
+        "message": "Non selezionata"
+    },
+    "networks.ips.heading": {
+        "message": "IP risolti"
+    },
+    "networks.bulk.selectionCount": {
+        "message": "{selected} di {total} attive"
+    },
+    "networks.bulk.enableAll": {
+        "message": "Abilita tutte"
+    },
+    "networks.bulk.disableAll": {
+        "message": "Disabilita tutte"
+    },
+    "exitNodes.search.placeholder": {
+        "message": "Cerca nodi di uscita"
+    },
+    "exitNodes.none": {
+        "message": "Nessuno"
+    },
+    "exitNodes.empty.title": {
+        "message": "Nessun nodo di uscita disponibile"
+    },
+    "exitNodes.empty.description": {
+        "message": "Nessun nodo di uscita è stato condiviso con questo peer."
+    },
+    "exitNodes.card.title": {
+        "message": "Nodo di uscita"
+    },
+    "exitNodes.card.statusActive": {
+        "message": "Attivo"
+    },
+    "exitNodes.card.statusInactive": {
+        "message": "Inattivo"
+    },
+    "exitNodes.dropdown.noneTitle": {
+        "message": "Nessuno"
+    },
+    "exitNodes.dropdown.noneDescription": {
+        "message": "Connessione diretta senza nodo di uscita"
+    },
+    "quickActions.connect": {
+        "message": "Connetti"
+    },
+    "quickActions.disconnect": {
+        "message": "Disconnetti"
+    },
+    "daemon.unavailable.title": {
+        "message": "Il servizio NetBird non è in esecuzione"
+    },
+    "daemon.unavailable.description": {
+        "message": "L'app si riconnetterà automaticamente non appena il servizio sarà in esecuzione."
+    },
+    "daemon.unavailable.docsLink": {
+        "message": "Documentazione"
+    },
+    "daemon.outdated.title": {
+        "message": "Il servizio NetBird è obsoleto"
+    },
+    "daemon.outdated.description": {
+        "message": "Aggiorna il servizio NetBird per usare questa app."
+    },
+    "error.jwt_clock_skew": {
+        "message": "Accesso non riuscito: l'orologio di questo dispositivo non è sincronizzato con il server. Sincronizzi l'orologio di sistema e riprovi."
+    },
+    "error.jwt_expired": {
+        "message": "Il token di accesso è scaduto. Effettui di nuovo l'accesso."
+    },
+    "error.jwt_signature_invalid": {
+        "message": "Accesso non riuscito: la firma del token non è valida. Contatti il suo amministratore."
+    },
+    "error.session_expired": {
+        "message": "La sessione è scaduta. Effettui di nuovo l'accesso."
+    },
+    "error.invalid_setup_key": {
+        "message": "La chiave di configurazione è mancante o non valida."
+    },
+    "error.permission_denied": {
+        "message": "L'accesso è stato rifiutato dal server."
+    },
+    "error.daemon_unreachable": {
+        "message": "Il daemon NetBird non risponde. Verifichi che il servizio sia in esecuzione."
+    },
+    "error.unknown": {
+        "message": "Operazione non riuscita."
+    }
+}
diff --git a/client/ui/i18n/locales/pt/common.json b/client/ui/i18n/locales/pt/common.json
new file mode 100644
index 000000000..2ed0a94c5
--- /dev/null
+++ b/client/ui/i18n/locales/pt/common.json
@@ -0,0 +1,1325 @@
+{
+    "tray.tooltip": {
+        "message": "NetBird"
+    },
+    "tray.status.disconnected": {
+        "message": "Desconectado"
+    },
+    "tray.status.daemonUnavailable": {
+        "message": "Não está em execução"
+    },
+    "tray.status.error": {
+        "message": "Erro"
+    },
+    "tray.status.connected": {
+        "message": "Conectado"
+    },
+    "tray.status.connecting": {
+        "message": "Conectando"
+    },
+    "tray.status.needsLogin": {
+        "message": "Login necessário"
+    },
+    "tray.status.loginFailed": {
+        "message": "Falha no login"
+    },
+    "tray.status.sessionExpired": {
+        "message": "Sessão expirada"
+    },
+    "tray.session.expiresIn": {
+        "message": "A sessão expira em {remaining}"
+    },
+    "tray.session.unit.lessThanMinute": {
+        "message": "menos de um minuto"
+    },
+    "tray.session.unit.minute": {
+        "message": "1 minuto"
+    },
+    "tray.session.unit.minutes": {
+        "message": "{count} minutos"
+    },
+    "tray.session.unit.hour": {
+        "message": "1 hora"
+    },
+    "tray.session.unit.hours": {
+        "message": "{count} horas"
+    },
+    "tray.session.unit.day": {
+        "message": "1 dia"
+    },
+    "tray.session.unit.days": {
+        "message": "{count} dias"
+    },
+    "tray.menu.open": {
+        "message": "Abrir o NetBird"
+    },
+    "tray.menu.connect": {
+        "message": "Conectar"
+    },
+    "tray.menu.disconnect": {
+        "message": "Desconectar"
+    },
+    "tray.menu.exitNode": {
+        "message": "Nó de saída"
+    },
+    "tray.menu.networks": {
+        "message": "Recursos"
+    },
+    "tray.menu.profiles": {
+        "message": "Perfis"
+    },
+    "tray.menu.manageProfiles": {
+        "message": "Gerenciar perfis"
+    },
+    "tray.menu.settings": {
+        "message": "Configurações..."
+    },
+    "tray.menu.debugBundle": {
+        "message": "Criar pacote de depuração"
+    },
+    "tray.menu.about": {
+        "message": "Ajuda e suporte"
+    },
+    "tray.menu.github": {
+        "message": "GitHub"
+    },
+    "tray.menu.documentation": {
+        "message": "Documentação"
+    },
+    "tray.menu.troubleshoot": {
+        "message": "Solução de problemas"
+    },
+    "tray.menu.downloadLatest": {
+        "message": "Baixar a versão mais recente"
+    },
+    "tray.menu.installVersion": {
+        "message": "Instalar a versão {version}"
+    },
+    "tray.menu.guiVersion": {
+        "message": "GUI: {version}"
+    },
+    "tray.menu.daemonVersion": {
+        "message": "Daemon: {version}"
+    },
+    "tray.menu.versionUnknown": {
+        "message": "—"
+    },
+    "tray.menu.quit": {
+        "message": "Sair do NetBird"
+    },
+    "notify.daemonOutdated.title": {
+        "message": "O serviço NetBird está desatualizado"
+    },
+    "notify.daemonOutdated.body": {
+        "message": "Atualize o serviço NetBird para usar este aplicativo."
+    },
+    "notify.update.title": {
+        "message": "Atualização do NetBird disponível"
+    },
+    "notify.update.body": {
+        "message": "O NetBird {version} está disponível."
+    },
+    "notify.update.enforcedSuffix": {
+        "message": " O seu administrador exige esta atualização."
+    },
+    "notify.error.title": {
+        "message": "Erro"
+    },
+    "notify.error.connect": {
+        "message": "Falha ao conectar"
+    },
+    "notify.error.disconnect": {
+        "message": "Falha ao desconectar"
+    },
+    "notify.error.switchProfile": {
+        "message": "Falha ao alternar para {profile}"
+    },
+    "notify.error.exitNode": {
+        "message": "Falha ao atualizar o nó de saída {name}"
+    },
+    "notify.sessionExpired.title": {
+        "message": "Sessão do NetBird expirada"
+    },
+    "notify.sessionExpired.body": {
+        "message": "A sua sessão do NetBird expirou. Faça login novamente."
+    },
+    "notify.sessionWarning.title": {
+        "message": "A sessão expira em breve"
+    },
+    "notify.sessionWarning.body": {
+        "message": "A sua sessão do NetBird expira em {remaining}. Clique em Renovar agora para renová-la."
+    },
+    "notify.sessionWarning.bodyGeneric": {
+        "message": "A sua sessão do NetBird está prestes a expirar. Clique em Renovar agora para renová-la."
+    },
+    "notify.sessionWarning.extend": {
+        "message": "Renovar agora"
+    },
+    "notify.sessionWarning.dismiss": {
+        "message": "Dispensar"
+    },
+    "notify.sessionWarning.failed": {
+        "message": "Falha ao renovar a sessão do NetBird"
+    },
+    "notify.sessionWarning.successTitle": {
+        "message": "Sessão do NetBird renovada"
+    },
+    "notify.sessionWarning.successBody": {
+        "message": "A sua sessão foi renovada."
+    },
+    "notify.sessionDeadlineRejected.title": {
+        "message": "Prazo da sessão rejeitado"
+    },
+    "notify.sessionDeadlineRejected.body": {
+        "message": "O servidor enviou um prazo de sessão inválido. Faça login novamente."
+    },
+    "notify.mdm.policyApplied.title": {
+        "message": "Definições do NetBird atualizadas"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "A sua configuração do NetBird foi atualizada pela política de TI."
+    },
+    "common.cancel": {
+        "message": "Cancelar"
+    },
+    "common.save": {
+        "message": "Salvar"
+    },
+    "common.saveChanges": {
+        "message": "Salvar alterações"
+    },
+    "common.saving": {
+        "message": "Salvando…"
+    },
+    "common.close": {
+        "message": "Fechar"
+    },
+    "common.copy": {
+        "message": "Copiar"
+    },
+    "common.togglePasswordVisibility": {
+        "message": "Alternar visibilidade da senha"
+    },
+    "common.increase": {
+        "message": "Aumentar"
+    },
+    "common.decrease": {
+        "message": "Diminuir"
+    },
+    "common.delete": {
+        "message": "Excluir"
+    },
+    "common.create": {
+        "message": "Criar"
+    },
+    "common.add": {
+        "message": "Adicionar"
+    },
+    "common.remove": {
+        "message": "Remover"
+    },
+    "common.refresh": {
+        "message": "Atualizar"
+    },
+    "common.loading": {
+        "message": "Carregando…"
+    },
+    "common.netbird": {
+        "message": "NetBird"
+    },
+    "common.noResults.title": {
+        "message": "Nenhum resultado encontrado"
+    },
+    "common.noResults.description": {
+        "message": "Não encontramos nenhum resultado. Tente um termo de busca diferente ou altere os filtros."
+    },
+    "notConnected.title": {
+        "message": "Desconectado"
+    },
+    "notConnected.description": {
+        "message": "Conecte-se ao NetBird primeiro para ver informações detalhadas sobre seus peers, recursos de rede e nós de saída."
+    },
+    "connect.status.disconnected": {
+        "message": "Desconectado"
+    },
+    "connect.status.connecting": {
+        "message": "Conectando..."
+    },
+    "connect.status.connected": {
+        "message": "Conectado"
+    },
+    "connect.status.disconnecting": {
+        "message": "Desconectando..."
+    },
+    "connect.status.daemonUnavailable": {
+        "message": "Daemon indisponível"
+    },
+    "connect.status.loginRequired": {
+        "message": "Login necessário"
+    },
+    "connect.error.loginTitle": {
+        "message": "Falha no login"
+    },
+    "connect.error.connectTitle": {
+        "message": "Falha ao conectar"
+    },
+    "connect.error.disconnectTitle": {
+        "message": "Falha ao desconectar"
+    },
+    "nav.peers.title": {
+        "message": "Peers"
+    },
+    "nav.peers.description": {
+        "message": "{connected} de {total} conectados"
+    },
+    "nav.resources.title": {
+        "message": "Recursos"
+    },
+    "nav.resources.description": {
+        "message": "{active} de {total} ativos"
+    },
+    "nav.exitNode.title": {
+        "message": "Nós de saída"
+    },
+    "nav.exitNode.none": {
+        "message": "Inativo"
+    },
+    "nav.exitNode.using": {
+        "message": "Via {name}"
+    },
+    "header.openSettings": {
+        "message": "Abrir configurações"
+    },
+    "header.togglePanel": {
+        "message": "Alternar painel lateral"
+    },
+    "profile.selector.loading": {
+        "message": "Carregando..."
+    },
+    "profile.selector.noProfile": {
+        "message": "Nenhum perfil"
+    },
+    "profile.selector.searchPlaceholder": {
+        "message": "Buscar perfil por nome..."
+    },
+    "profile.selector.emptyTitle": {
+        "message": "Nenhum perfil encontrado"
+    },
+    "profile.selector.emptyDescription": {
+        "message": "Tente um termo de busca diferente ou crie um novo perfil."
+    },
+    "profile.selector.newProfile": {
+        "message": "Novo perfil"
+    },
+    "profile.selector.moreOptions": {
+        "message": "Mais opções"
+    },
+    "profile.selector.deregister": {
+        "message": "Cancelar registro"
+    },
+    "profile.selector.delete": {
+        "message": "Excluir"
+    },
+    "profile.selector.switchTo": {
+        "message": "Alternar para este perfil"
+    },
+    "profile.selector.edit": {
+        "message": "Editar"
+    },
+    "profile.edit.title": {
+        "message": "Editar perfil"
+    },
+    "profile.edit.submit": {
+        "message": "Salvar alterações"
+    },
+    "profile.dialog.title": {
+        "message": "Insira o nome do perfil"
+    },
+    "profile.dialog.nameLabel": {
+        "message": "Nome do perfil"
+    },
+    "profile.dialog.description": {
+        "message": "Defina um nome fácil de identificar para o seu perfil."
+    },
+    "profile.dialog.placeholder": {
+        "message": "ex.: trabalho"
+    },
+    "profile.dialog.submit": {
+        "message": "Adicionar perfil"
+    },
+    "profile.dialog.required": {
+        "message": "Insira um nome de perfil, ex.: trabalho, casa"
+    },
+    "profile.dialog.managementHelp": {
+        "message": "Use o NetBird Cloud ou seu próprio servidor."
+    },
+    "profile.dialog.urlUnreachable": {
+        "message": "Não foi possível acessar este servidor. Verifique a URL ou adicione o perfil mesmo assim se tiver certeza de que está correta."
+    },
+    "header.menu.settings": {
+        "message": "Configurações..."
+    },
+    "header.menu.defaultView": {
+        "message": "Visualização padrão"
+    },
+    "header.menu.advancedView": {
+        "message": "Visualização avançada"
+    },
+    "header.menu.updateAvailable": {
+        "message": "Atualização disponível"
+    },
+    "header.menu.open": {
+        "message": "Abrir menu"
+    },
+    "header.profile.switch": {
+        "message": "Trocar perfil"
+    },
+    "connect.toggle.label": {
+        "message": "Alternar conexão NetBird"
+    },
+    "connect.localIp.label": {
+        "message": "Endereços IP locais"
+    },
+    "common.search": {
+        "message": "Pesquisar"
+    },
+    "common.filter": {
+        "message": "Filtrar"
+    },
+    "exitNodes.dropdown.trigger": {
+        "message": "Selecionar nó de saída"
+    },
+    "peers.row.label": {
+        "message": "Abrir detalhes de {name}, {status}"
+    },
+    "peers.dialog.title": {
+        "message": "Detalhes do par"
+    },
+    "networks.row.toggle": {
+        "message": "Alternar {name}"
+    },
+    "networks.bulk.label": {
+        "message": "Alternar todos os recursos visíveis"
+    },
+    "settings.nav.label": {
+        "message": "Seções das configurações"
+    },
+    "profile.switch.title": {
+        "message": "Alternar perfil para \"{name}\"?"
+    },
+    "profile.switch.message": {
+        "message": "Tem certeza de que deseja alternar de perfil?\nO seu perfil atual será desconectado."
+    },
+    "profile.switch.confirm": {
+        "message": "Confirmar"
+    },
+    "profile.deregister.title": {
+        "message": "Cancelar registro do perfil \"{name}\"?"
+    },
+    "profile.deregister.message": {
+        "message": "Tem certeza de que deseja cancelar o registro deste perfil?\nVocê precisará fazer login novamente para usá-lo."
+    },
+    "profile.deregister.confirm": {
+        "message": "Cancelar registro"
+    },
+    "profile.delete.title": {
+        "message": "Excluir o perfil \"{name}\"?"
+    },
+    "profile.delete.message": {
+        "message": "Tem certeza de que deseja excluir este perfil?\nEsta ação não pode ser desfeita."
+    },
+    "profile.delete.disabledActive": {
+        "message": "Perfis ativos não podem ser excluídos. Alterne para outro antes de excluir este perfil."
+    },
+    "profile.delete.disabledDefault": {
+        "message": "O perfil padrão não pode ser excluído."
+    },
+    "profile.error.switchTitle": {
+        "message": "Falha ao alternar de perfil"
+    },
+    "profile.error.deregisterTitle": {
+        "message": "Falha ao cancelar registro do perfil"
+    },
+    "profile.error.deleteTitle": {
+        "message": "Falha ao excluir o perfil"
+    },
+    "profile.error.createTitle": {
+        "message": "Falha ao criar o perfil"
+    },
+    "profile.error.editTitle": {
+        "message": "Falha ao editar o perfil"
+    },
+    "profile.error.loadTitle": {
+        "message": "Falha ao carregar os perfis"
+    },
+    "profile.dropdown.activeProfile": {
+        "message": "Perfil ativo"
+    },
+    "profile.dropdown.switchProfile": {
+        "message": "Alternar perfil"
+    },
+    "profile.dropdown.noEmail": {
+        "message": "Outro"
+    },
+    "profile.dropdown.addProfile": {
+        "message": "Adicionar perfil"
+    },
+    "profile.dropdown.manageProfiles": {
+        "message": "Gerenciar perfis"
+    },
+    "profile.dropdown.settings": {
+        "message": "Configurações"
+    },
+    "settings.profiles.section.profiles": {
+        "message": "Perfis"
+    },
+    "settings.profiles.intro": {
+        "message": "Mantenha identidades separadas do NetBird lado a lado, por exemplo contas de trabalho e pessoais, ou diferentes servidores de gerenciamento. Adicione, cancele o registro ou exclua perfis abaixo."
+    },
+    "settings.profiles.addProfile": {
+        "message": "Adicionar perfil"
+    },
+    "settings.profiles.active": {
+        "message": "Ativo"
+    },
+    "settings.profiles.emptyTitle": {
+        "message": "Nenhum perfil"
+    },
+    "settings.profiles.emptyDescription": {
+        "message": "Crie um perfil para conectar a um servidor de gerenciamento do NetBird."
+    },
+    "settings.error.loadTitle": {
+        "message": "Falha ao carregar as configurações"
+    },
+    "settings.error.saveTitle": {
+        "message": "Falha ao salvar as configurações"
+    },
+    "settings.error.debugBundleTitle": {
+        "message": "Falha no pacote de depuração"
+    },
+    "settings.tabs.general": {
+        "message": "Geral"
+    },
+    "settings.tabs.network": {
+        "message": "Rede"
+    },
+    "settings.tabs.security": {
+        "message": "Segurança"
+    },
+    "settings.tabs.profiles": {
+        "message": "Perfis"
+    },
+    "settings.tabs.ssh": {
+        "message": "SSH"
+    },
+    "settings.tabs.advanced": {
+        "message": "Avançado"
+    },
+    "settings.tabs.troubleshooting": {
+        "message": "Solução de problemas"
+    },
+    "settings.tabs.about": {
+        "message": "Sobre"
+    },
+    "settings.tabs.updateAvailable": {
+        "message": "Atualização disponível"
+    },
+    "settings.general.section.general": {
+        "message": "Geral"
+    },
+    "settings.general.section.connection": {
+        "message": "Conexão"
+    },
+    "settings.general.connectOnStartup.label": {
+        "message": "Conectar ao iniciar"
+    },
+    "settings.general.connectOnStartup.help": {
+        "message": "Estabelecer uma conexão automaticamente quando o serviço iniciar."
+    },
+    "settings.general.notifications.label": {
+        "message": "Notificações na área de trabalho"
+    },
+    "settings.general.notifications.help": {
+        "message": "Mostrar notificações na área de trabalho para novas atualizações e eventos de conexão."
+    },
+    "settings.general.autostart.label": {
+        "message": "Iniciar a interface do NetBird ao fazer login"
+    },
+    "settings.general.autostart.help": {
+        "message": "Iniciar a interface do NetBird automaticamente quando você fizer login. Isto afeta apenas a interface gráfica, não o serviço em segundo plano."
+    },
+    "settings.general.autostart.errorTitle": {
+        "message": "Falha ao alterar o início automático"
+    },
+    "settings.general.language.label": {
+        "message": "Idioma de exibição"
+    },
+    "settings.general.language.help": {
+        "message": "Escolha o idioma da interface do NetBird."
+    },
+    "settings.general.language.search": {
+        "message": "Buscar idioma…"
+    },
+    "settings.general.language.empty": {
+        "message": "Nenhum idioma corresponde."
+    },
+    "settings.general.management.label": {
+        "message": "Servidor de gerenciamento"
+    },
+    "settings.general.management.help": {
+        "message": "Conecte ao NetBird Cloud ou ao seu próprio servidor de gerenciamento auto-hospedado. As alterações reconectarão o cliente."
+    },
+    "settings.general.management.cloud": {
+        "message": "Cloud"
+    },
+    "settings.general.management.selfHosted": {
+        "message": "Auto-hospedado"
+    },
+    "settings.general.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlError": {
+        "message": "Insira uma URL válida, ex.: https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlUnreachable": {
+        "message": "Não foi possível acessar este servidor. Verifique a URL ou salve mesmo assim se tiver certeza de que está correta."
+    },
+    "settings.general.management.switchCloudTitle": {
+        "message": "Alternar para o NetBird Cloud?"
+    },
+    "settings.general.management.switchCloudMessage": {
+        "message": "Isto desconecta o seu servidor auto-hospedado.\nVocê pode precisar fazer login novamente."
+    },
+    "settings.general.management.switchCloudConfirm": {
+        "message": "Alternar para o Cloud"
+    },
+    "settings.network.section.connectivity": {
+        "message": "Conectividade"
+    },
+    "settings.network.section.routingDns": {
+        "message": "Roteamento e DNS"
+    },
+    "settings.network.monitor.label": {
+        "message": "Reconectar ao mudar de rede"
+    },
+    "settings.network.monitor.help": {
+        "message": "Monitora a rede e reconecta automaticamente diante de mudanças como troca de Wi-Fi, alterações na Ethernet ou retorno do modo de suspensão."
+    },
+    "settings.network.dns.label": {
+        "message": "Ativar DNS"
+    },
+    "settings.network.dns.help": {
+        "message": "Aplicar as configurações de DNS gerenciadas pelo NetBird ao resolvedor do host."
+    },
+    "settings.network.clientRoutes.label": {
+        "message": "Ativar rotas de cliente"
+    },
+    "settings.network.clientRoutes.help": {
+        "message": "Aceitar rotas de outros peers para alcançar as redes deles."
+    },
+    "settings.network.serverRoutes.label": {
+        "message": "Ativar rotas de servidor"
+    },
+    "settings.network.serverRoutes.help": {
+        "message": "Anunciar as rotas locais deste host para outros peers."
+    },
+    "settings.network.ipv6.label": {
+        "message": "Ativar IPv6"
+    },
+    "settings.network.ipv6.help": {
+        "message": "Usar endereçamento IPv6 para a rede de sobreposição do NetBird."
+    },
+    "settings.security.section.firewall": {
+        "message": "Firewall"
+    },
+    "settings.security.section.encryption": {
+        "message": "Criptografia"
+    },
+    "settings.security.blockInbound.label": {
+        "message": "Bloquear tráfego de entrada"
+    },
+    "settings.security.blockInbound.help": {
+        "message": "Rejeitar conexões não solicitadas de peers para este dispositivo e quaisquer redes que ele roteie. O tráfego de saída não é afetado."
+    },
+    "settings.security.blockLan.label": {
+        "message": "Bloquear acesso à LAN"
+    },
+    "settings.security.blockLan.help": {
+        "message": "Impedir que peers alcancem a sua rede local ou os dispositivos dela quando este dispositivo roteia o tráfego deles."
+    },
+    "settings.security.rosenpass.label": {
+        "message": "Ativar resistência quântica"
+    },
+    "settings.security.rosenpass.help": {
+        "message": "Adicionar uma troca de chaves pós-quântica via Rosenpass sobre o WireGuard®."
+    },
+    "settings.security.rosenpassPermissive.label": {
+        "message": "Ativar modo permissivo"
+    },
+    "settings.security.rosenpassPermissive.help": {
+        "message": "Permitir conexões com peers sem suporte a resistência quântica."
+    },
+    "settings.ssh.section.server": {
+        "message": "Servidor"
+    },
+    "settings.ssh.section.capabilities": {
+        "message": "Recursos"
+    },
+    "settings.ssh.section.authentication": {
+        "message": "Autenticação"
+    },
+    "settings.ssh.server.label": {
+        "message": "Ativar servidor SSH"
+    },
+    "settings.ssh.server.help": {
+        "message": "Executar o servidor SSH do NetBird neste host para que outros peers possam conectar a ele."
+    },
+    "settings.ssh.root.label": {
+        "message": "Permitir login como root"
+    },
+    "settings.ssh.root.help": {
+        "message": "Permitir que peers façam login como usuário root. Desative para exigir uma conta sem privilégios."
+    },
+    "settings.ssh.sftp.label": {
+        "message": "Permitir SFTP"
+    },
+    "settings.ssh.sftp.help": {
+        "message": "Transferir arquivos com segurança usando clientes SFTP ou SCP nativos."
+    },
+    "settings.ssh.localForward.label": {
+        "message": "Encaminhamento de porta local"
+    },
+    "settings.ssh.localForward.help": {
+        "message": "Permitir que peers conectados encaminhem portas locais para serviços acessíveis a partir deste host."
+    },
+    "settings.ssh.remoteForward.label": {
+        "message": "Encaminhamento de porta remota"
+    },
+    "settings.ssh.remoteForward.help": {
+        "message": "Permitir que peers conectados exponham portas deste host de volta para a própria máquina deles."
+    },
+    "settings.ssh.jwt.label": {
+        "message": "Ativar autenticação JWT"
+    },
+    "settings.ssh.jwt.help": {
+        "message": "Verificar cada sessão SSH no seu IdP para identidade do usuário e auditoria. Desative para depender apenas das políticas de ACL da rede, útil quando nenhum IdP está disponível."
+    },
+    "settings.ssh.jwtTtl.label": {
+        "message": "TTL do cache de JWT"
+    },
+    "settings.ssh.jwtTtl.help": {
+        "message": "Por quanto tempo este cliente mantém um JWT em cache antes de solicitar novamente em conexões SSH de saída. Defina como 0 para desativar o cache e autenticar em cada conexão."
+    },
+    "settings.ssh.jwtTtl.suffix": {
+        "message": "s"
+    },
+    "settings.advanced.section.interface": {
+        "message": "Interface"
+    },
+    "settings.advanced.section.security": {
+        "message": "Segurança"
+    },
+    "settings.advanced.interfaceName.label": {
+        "message": "Nome"
+    },
+    "settings.advanced.interfaceName.error": {
+        "message": "Use de 1 a 15 letras, dígitos, pontos, hifens ou sublinhados."
+    },
+    "settings.advanced.interfaceName.errorMac": {
+        "message": "Deve começar com \"utun\" seguido de um número (ex.: utun100)."
+    },
+    "settings.advanced.port.label": {
+        "message": "Porta"
+    },
+    "settings.advanced.port.error": {
+        "message": "Insira uma porta entre {min} e {max}."
+    },
+    "settings.advanced.port.help": {
+        "message": "Se definida como 0, uma porta livre aleatória será usada."
+    },
+    "settings.advanced.mtu.label": {
+        "message": "MTU"
+    },
+    "settings.advanced.mtu.error": {
+        "message": "Insira um valor de MTU entre {min} e {max}."
+    },
+    "settings.advanced.psk.label": {
+        "message": "Chave pré-compartilhada"
+    },
+    "settings.advanced.psk.help": {
+        "message": "PSK opcional do WireGuard para criptografia simétrica adicional. Não é o mesmo que uma chave de configuração do NetBird. Você só se comunicará com peers que usem a mesma chave pré-compartilhada."
+    },
+    "settings.troubleshooting.section.title": {
+        "message": "Pacote de depuração"
+    },
+    "settings.troubleshooting.anonymize.label": {
+        "message": "Anonimizar informações sensíveis"
+    },
+    "settings.troubleshooting.anonymize.help": {
+        "message": "Oculta endereços IP públicos e domínios que não são do NetBird nos logs."
+    },
+    "settings.troubleshooting.systemInfo.label": {
+        "message": "Incluir informações do sistema"
+    },
+    "settings.troubleshooting.systemInfo.help": {
+        "message": "Incluir o OS, o kernel, as interfaces de rede e as tabelas de roteamento."
+    },
+    "settings.troubleshooting.upload.label": {
+        "message": "Enviar pacote aos servidores do NetBird"
+    },
+    "settings.troubleshooting.upload.help": {
+        "message": "Retorna uma chave de upload para compartilhar com o suporte do NetBird."
+    },
+    "settings.troubleshooting.trace.label": {
+        "message": "Habilitar logs de trace"
+    },
+    "settings.troubleshooting.trace.help": {
+        "message": "Eleva o nível de log para TRACE e o restaura em seguida."
+    },
+    "settings.troubleshooting.capture.label": {
+        "message": "Sessão de captura"
+    },
+    "settings.troubleshooting.capture.help": {
+        "message": "Reconecta e aguarda para que você possa reproduzir o problema."
+    },
+    "settings.troubleshooting.packets.label": {
+        "message": "Capturar pacotes de rede"
+    },
+    "settings.troubleshooting.packets.help": {
+        "message": "Salva um .pcap do tráfego de rede durante a sessão de captura."
+    },
+    "settings.troubleshooting.duration.label": {
+        "message": "Duração da captura"
+    },
+    "settings.troubleshooting.duration.help": {
+        "message": "Por quanto tempo a sessão de captura é executada."
+    },
+    "settings.troubleshooting.duration.suffix": {
+        "message": "min"
+    },
+    "settings.troubleshooting.create": {
+        "message": "Criar pacote"
+    },
+    "settings.troubleshooting.progress.description": {
+        "message": "Coletando logs, detalhes do sistema e estado da conexão. Isto costuma levar um instante — mantenha esta janela aberta até concluir."
+    },
+    "settings.troubleshooting.cancelling": {
+        "message": "Cancelando…"
+    },
+    "settings.troubleshooting.done.uploadedTitle": {
+        "message": "Pacote de depuração enviado com sucesso!"
+    },
+    "settings.troubleshooting.done.savedTitle": {
+        "message": "Pacote salvo"
+    },
+    "settings.troubleshooting.done.uploadedDescription": {
+        "message": "Compartilhe a chave de upload abaixo com o <docs>suporte do NetBird</docs>. Uma cópia local também foi salva no seu dispositivo."
+    },
+    "settings.troubleshooting.done.savedDescription": {
+        "message": "O seu pacote de depuração foi salvo localmente."
+    },
+    "settings.troubleshooting.done.copyKey": {
+        "message": "Copiar chave"
+    },
+    "settings.troubleshooting.done.openFolder": {
+        "message": "Abrir pasta"
+    },
+    "settings.troubleshooting.done.openFileLocation": {
+        "message": "Abrir local do arquivo"
+    },
+    "settings.troubleshooting.uploadFailedWithReason": {
+        "message": "Falha no upload: {reason} O pacote continua salvo localmente."
+    },
+    "settings.troubleshooting.uploadFailed": {
+        "message": "Falha no upload. O pacote continua salvo localmente."
+    },
+    "settings.troubleshooting.stage.reconnecting": {
+        "message": "Reconectando o NetBird…"
+    },
+    "settings.troubleshooting.stage.capturing": {
+        "message": "Capturando logs de depuração"
+    },
+    "settings.troubleshooting.stage.bundling": {
+        "message": "Gerando o pacote de depuração…"
+    },
+    "settings.troubleshooting.stage.uploading": {
+        "message": "Enviando para o NetBird…"
+    },
+    "settings.troubleshooting.stage.cancelling": {
+        "message": "Cancelando…"
+    },
+    "settings.about.client": {
+        "message": "NetBird Client v{version}"
+    },
+    "settings.about.clientName": {
+        "message": "NetBird Client"
+    },
+    "settings.about.development": {
+        "message": "[Development]"
+    },
+    "settings.about.gui": {
+        "message": "GUI v{version}"
+    },
+    "settings.about.guiName": {
+        "message": "GUI"
+    },
+    "settings.about.copyright": {
+        "message": "© {year} NetBird. Todos os direitos reservados."
+    },
+    "settings.about.links.imprint": {
+        "message": "Identificação legal"
+    },
+    "settings.about.links.privacy": {
+        "message": "Privacidade"
+    },
+    "settings.about.links.cla": {
+        "message": "CLA"
+    },
+    "settings.about.links.terms": {
+        "message": "Termos de serviço"
+    },
+    "settings.about.community.github": {
+        "message": "GitHub"
+    },
+    "settings.about.community.slack": {
+        "message": "Slack"
+    },
+    "settings.about.community.forum": {
+        "message": "Fórum"
+    },
+    "settings.about.community.documentation": {
+        "message": "Documentação"
+    },
+    "settings.about.community.feedback": {
+        "message": "Feedback"
+    },
+    "update.banner.message": {
+        "message": "O NetBird {version} está pronto para instalar."
+    },
+    "update.banner.later": {
+        "message": "Mais tarde"
+    },
+    "update.banner.installNow": {
+        "message": "Instalar agora"
+    },
+    "update.card.versionAvailableDownload": {
+        "message": "A versão {version} está disponível para download."
+    },
+    "update.card.versionAvailableInstall": {
+        "message": "A versão {version} está disponível para instalação."
+    },
+    "update.card.whatsNew": {
+        "message": "Novidades?"
+    },
+    "update.card.installNow": {
+        "message": "Instalar agora"
+    },
+    "update.card.getInstaller": {
+        "message": "Baixar"
+    },
+    "update.card.autoCheckInterval": {
+        "message": "O NetBird verifica atualizações em segundo plano."
+    },
+    "update.card.changelog": {
+        "message": "Registro de alterações"
+    },
+    "update.card.onLatestVersion": {
+        "message": "Você está na versão mais recente"
+    },
+    "update.header.tooltip": {
+        "message": "Atualização disponível"
+    },
+    "update.overlay.updatingVersion": {
+        "message": "Atualizando o NetBird para a v{version}"
+    },
+    "update.overlay.updating": {
+        "message": "Atualizando o NetBird"
+    },
+    "update.overlay.description": {
+        "message": "Uma versão mais recente está disponível e sendo instalada. O NetBird reiniciará automaticamente quando a atualização terminar."
+    },
+    "update.overlay.error.timeoutTitle": {
+        "message": "A atualização está demorando demais"
+    },
+    "update.overlay.error.timeoutDescription": {
+        "message": "A instalação de {target} demorou demais e não foi concluída."
+    },
+    "update.overlay.error.canceledTitle": {
+        "message": "A atualização foi interrompida"
+    },
+    "update.overlay.error.canceledDescription": {
+        "message": "A atualização para {target} foi cancelada antes de terminar."
+    },
+    "update.overlay.error.failTitle": {
+        "message": "Não foi possível instalar a atualização"
+    },
+    "update.overlay.error.failDescription": {
+        "message": "Não foi possível instalar {target}."
+    },
+    "update.overlay.error.unknownMessage": {
+        "message": "erro desconhecido"
+    },
+    "update.overlay.error.targetVersion": {
+        "message": "v{version}"
+    },
+    "update.overlay.error.targetFallback": {
+        "message": "a nova versão"
+    },
+    "update.error.loadStateTitle": {
+        "message": "Falha ao carregar o estado da atualização"
+    },
+    "update.error.triggerTitle": {
+        "message": "Falha ao iniciar a atualização"
+    },
+    "update.page.versionLine": {
+        "message": "Atualizando o cliente para: {version}."
+    },
+    "update.page.versionLineGeneric": {
+        "message": "Atualizando o cliente."
+    },
+    "update.page.outdated": {
+        "message": "A versão do seu cliente é anterior à versão de atualização automática definida no Management."
+    },
+    "update.page.status.running": {
+        "message": "Atualizando"
+    },
+    "update.page.status.timeout": {
+        "message": "A atualização expirou. Tente novamente."
+    },
+    "update.page.status.canceled": {
+        "message": "Atualização cancelada."
+    },
+    "update.page.status.failed": {
+        "message": "Falha na atualização: {message}"
+    },
+    "update.page.status.unknownError": {
+        "message": "erro de atualização desconhecido"
+    },
+    "update.page.failedTitle": {
+        "message": "Falha na atualização"
+    },
+    "update.page.timeoutMessage": {
+        "message": "A atualização expirou."
+    },
+    "update.page.dontClose": {
+        "message": "Não feche esta janela."
+    },
+    "update.page.updating": {
+        "message": "Atualizando…"
+    },
+    "update.page.complete": {
+        "message": "Atualização concluída"
+    },
+    "update.page.failed": {
+        "message": "Falha na atualização"
+    },
+    "window.title.settings": {
+        "message": "Configurações"
+    },
+    "window.title.signIn": {
+        "message": "Login"
+    },
+    "window.title.sessionExpiration": {
+        "message": "Sessão expirando"
+    },
+    "window.title.updating": {
+        "message": "Atualizando"
+    },
+    "window.title.welcome": {
+        "message": "Bem-vindo ao NetBird"
+    },
+    "window.title.error": {
+        "message": "Erro"
+    },
+    "welcome.title": {
+        "message": "Procure o NetBird na sua bandeja"
+    },
+    "welcome.description": {
+        "message": "O NetBird fica na sua bandeja. Clique no ícone para conectar, alternar perfis ou abrir as configurações."
+    },
+    "welcome.continue": {
+        "message": "Continuar"
+    },
+    "welcome.back": {
+        "message": "Voltar"
+    },
+    "welcome.management.title": {
+        "message": "Configurar o NetBird"
+    },
+    "welcome.management.description": {
+        "message": "Clique em Continuar para começar ou escolha Auto-hospedado se você tiver o seu próprio servidor NetBird."
+    },
+    "welcome.management.cloud.title": {
+        "message": "NetBird Cloud"
+    },
+    "welcome.management.cloud.description": {
+        "message": "Use o nosso serviço hospedado. Sem configuração necessária."
+    },
+    "welcome.management.selfHosted.title": {
+        "message": "Auto-hospedado"
+    },
+    "welcome.management.selfHosted.description": {
+        "message": "Conecte ao seu próprio servidor de gerenciamento."
+    },
+    "welcome.management.urlLabel": {
+        "message": "URL do servidor de gerenciamento"
+    },
+    "welcome.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlInvalid": {
+        "message": "Insira uma URL válida, ex.: https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlUnreachable": {
+        "message": "Não foi possível acessar este servidor. Verifique a URL ou a sua rede e continue se tiver certeza de que está correta."
+    },
+    "welcome.management.checking": {
+        "message": "Verificando…"
+    },
+    "browserLogin.title": {
+        "message": "Continue no seu navegador para concluir o login"
+    },
+    "browserLogin.notSeeing": {
+        "message": "Não está vendo a aba do navegador?"
+    },
+    "browserLogin.tryAgain": {
+        "message": "Tentar novamente"
+    },
+    "browserLogin.openFailedTitle": {
+        "message": "Falha ao abrir o navegador"
+    },
+    "sessionExpiration.title": {
+        "message": "A sessão expira em breve"
+    },
+    "sessionExpiration.titleLater": {
+        "message": "A sua sessão vai expirar"
+    },
+    "sessionExpiration.description": {
+        "message": "Este dispositivo será desconectado em breve. Renove com um login pelo navegador."
+    },
+    "sessionExpiration.descriptionLater": {
+        "message": "Um login pelo navegador mantém este dispositivo conectado à sua rede."
+    },
+    "sessionExpiration.stay": {
+        "message": "Renovar sessão"
+    },
+    "sessionExpiration.authenticate": {
+        "message": "Autenticar"
+    },
+    "sessionExpiration.logout": {
+        "message": "Sair"
+    },
+    "sessionExpiration.expired": {
+        "message": "Sessão expirada"
+    },
+    "sessionExpiration.expiredDescription": {
+        "message": "Dispositivo desconectado. Autentique com um login pelo navegador para reconectar."
+    },
+    "sessionExpiration.close": {
+        "message": "Fechar"
+    },
+    "sessionExpiration.extendFailedTitle": {
+        "message": "Falha ao renovar a sessão"
+    },
+    "sessionExpiration.logoutFailedTitle": {
+        "message": "Falha ao sair"
+    },
+    "peers.search.placeholder": {
+        "message": "Buscar por nome ou IP"
+    },
+    "peers.filter.all": {
+        "message": "Todos"
+    },
+    "peers.filter.online": {
+        "message": "Online"
+    },
+    "peers.filter.offline": {
+        "message": "Offline"
+    },
+    "peers.empty.title": {
+        "message": "Nenhum peer disponível"
+    },
+    "peers.empty.description": {
+        "message": "Você não tem nenhum peer disponível ou não tem acesso a nenhum deles."
+    },
+    "peers.details.domain": {
+        "message": "Domínio"
+    },
+    "peers.details.netbirdIp": {
+        "message": "IP do NetBird"
+    },
+    "peers.details.netbirdIpv6": {
+        "message": "IPv6 do NetBird"
+    },
+    "peers.details.publicKey": {
+        "message": "Chave pública"
+    },
+    "peers.details.connection": {
+        "message": "Conexão"
+    },
+    "peers.details.latency": {
+        "message": "Latência"
+    },
+    "peers.details.lastHandshake": {
+        "message": "Último handshake"
+    },
+    "peers.details.statusSince": {
+        "message": "Última atualização da conexão"
+    },
+    "peers.details.bytes": {
+        "message": "Bytes"
+    },
+    "peers.details.bytesSent": {
+        "message": "Enviados"
+    },
+    "peers.details.bytesReceived": {
+        "message": "Recebidos"
+    },
+    "peers.details.localIce": {
+        "message": "ICE local"
+    },
+    "peers.details.remoteIce": {
+        "message": "ICE remoto"
+    },
+    "peers.details.never": {
+        "message": "Nunca"
+    },
+    "peers.details.justNow": {
+        "message": "Agora mesmo"
+    },
+    "peers.details.refresh": {
+        "message": "Atualizar"
+    },
+    "peers.status.connected": {
+        "message": "Conectado"
+    },
+    "peers.status.connecting": {
+        "message": "Conectando"
+    },
+    "peers.status.disconnected": {
+        "message": "Desconectado"
+    },
+    "peers.details.relayAddress": {
+        "message": "Relay"
+    },
+    "peers.details.networks": {
+        "message": "Recursos"
+    },
+    "peers.details.relayed": {
+        "message": "Via relay"
+    },
+    "peers.details.p2p": {
+        "message": "P2P"
+    },
+    "peers.details.rosenpass": {
+        "message": "Rosenpass ativado"
+    },
+    "networks.search.placeholder": {
+        "message": "Buscar por rede ou domínio"
+    },
+    "networks.filter.all": {
+        "message": "Todos"
+    },
+    "networks.filter.active": {
+        "message": "Ativos"
+    },
+    "networks.filter.overlapping": {
+        "message": "Sobrepostos"
+    },
+    "networks.empty.title": {
+        "message": "Nenhum recurso disponível"
+    },
+    "networks.empty.description": {
+        "message": "Você não tem nenhum recurso de rede disponível ou não tem acesso a nenhum deles."
+    },
+    "networks.selected": {
+        "message": "Selecionado"
+    },
+    "networks.unselected": {
+        "message": "Não selecionado"
+    },
+    "networks.ips.heading": {
+        "message": "IPs resolvidos"
+    },
+    "networks.bulk.selectionCount": {
+        "message": "{selected} de {total} ativos"
+    },
+    "networks.bulk.enableAll": {
+        "message": "Ativar todos"
+    },
+    "networks.bulk.disableAll": {
+        "message": "Desativar todos"
+    },
+    "exitNodes.search.placeholder": {
+        "message": "Buscar nós de saída"
+    },
+    "exitNodes.none": {
+        "message": "Nenhum"
+    },
+    "exitNodes.empty.title": {
+        "message": "Nenhum nó de saída disponível"
+    },
+    "exitNodes.empty.description": {
+        "message": "Nenhum nó de saída foi compartilhado com este peer."
+    },
+    "exitNodes.card.title": {
+        "message": "Nó de saída"
+    },
+    "exitNodes.card.statusActive": {
+        "message": "Ativo"
+    },
+    "exitNodes.card.statusInactive": {
+        "message": "Inativo"
+    },
+    "exitNodes.dropdown.noneTitle": {
+        "message": "Nenhum"
+    },
+    "exitNodes.dropdown.noneDescription": {
+        "message": "Conexão direta sem um nó de saída"
+    },
+    "quickActions.connect": {
+        "message": "Conectar"
+    },
+    "quickActions.disconnect": {
+        "message": "Desconectar"
+    },
+    "daemon.unavailable.title": {
+        "message": "O serviço do NetBird não está em execução"
+    },
+    "daemon.unavailable.description": {
+        "message": "O aplicativo reconectará automaticamente assim que o serviço estiver em execução."
+    },
+    "daemon.unavailable.docsLink": {
+        "message": "Documentação"
+    },
+    "daemon.outdated.title": {
+        "message": "O serviço NetBird está desatualizado"
+    },
+    "daemon.outdated.description": {
+        "message": "Atualize o serviço NetBird para usar este aplicativo."
+    },
+    "error.jwt_clock_skew": {
+        "message": "Falha no login: o relógio deste dispositivo está fora de sincronia com o servidor. Sincronize o relógio do sistema e tente novamente."
+    },
+    "error.jwt_expired": {
+        "message": "O seu token de login expirou. Faça login novamente."
+    },
+    "error.jwt_signature_invalid": {
+        "message": "Falha no login: a assinatura do token é inválida. Entre em contato com o seu administrador."
+    },
+    "error.session_expired": {
+        "message": "A sua sessão expirou. Faça login novamente."
+    },
+    "error.invalid_setup_key": {
+        "message": "A chave de configuração está ausente ou é inválida."
+    },
+    "error.permission_denied": {
+        "message": "O login foi rejeitado pelo servidor."
+    },
+    "error.daemon_unreachable": {
+        "message": "O daemon do NetBird não está respondendo. Verifique se o serviço está em execução."
+    },
+    "error.unknown": {
+        "message": "A operação falhou."
+    }
+}
diff --git a/client/ui/i18n/locales/ru/common.json b/client/ui/i18n/locales/ru/common.json
new file mode 100644
index 000000000..6ba7de8cc
--- /dev/null
+++ b/client/ui/i18n/locales/ru/common.json
@@ -0,0 +1,1325 @@
+{
+    "tray.tooltip": {
+        "message": "NetBird"
+    },
+    "tray.status.disconnected": {
+        "message": "Отключено"
+    },
+    "tray.status.daemonUnavailable": {
+        "message": "Не запущено"
+    },
+    "tray.status.error": {
+        "message": "Ошибка"
+    },
+    "tray.status.connected": {
+        "message": "Подключено"
+    },
+    "tray.status.connecting": {
+        "message": "Подключение"
+    },
+    "tray.status.needsLogin": {
+        "message": "Требуется вход"
+    },
+    "tray.status.loginFailed": {
+        "message": "Ошибка входа"
+    },
+    "tray.status.sessionExpired": {
+        "message": "Сеанс истёк"
+    },
+    "tray.session.expiresIn": {
+        "message": "Сеанс истекает через {remaining}"
+    },
+    "tray.session.unit.lessThanMinute": {
+        "message": "менее чем минуту"
+    },
+    "tray.session.unit.minute": {
+        "message": "1 минуту"
+    },
+    "tray.session.unit.minutes": {
+        "message": "{count} минут"
+    },
+    "tray.session.unit.hour": {
+        "message": "1 час"
+    },
+    "tray.session.unit.hours": {
+        "message": "{count} часов"
+    },
+    "tray.session.unit.day": {
+        "message": "1 день"
+    },
+    "tray.session.unit.days": {
+        "message": "{count} дней"
+    },
+    "tray.menu.open": {
+        "message": "Открыть NetBird"
+    },
+    "tray.menu.connect": {
+        "message": "Подключиться"
+    },
+    "tray.menu.disconnect": {
+        "message": "Отключиться"
+    },
+    "tray.menu.exitNode": {
+        "message": "Выходной узел"
+    },
+    "tray.menu.networks": {
+        "message": "Ресурсы"
+    },
+    "tray.menu.profiles": {
+        "message": "Профили"
+    },
+    "tray.menu.manageProfiles": {
+        "message": "Управление профилями"
+    },
+    "tray.menu.settings": {
+        "message": "Настройки…"
+    },
+    "tray.menu.debugBundle": {
+        "message": "Создать отладочный пакет"
+    },
+    "tray.menu.about": {
+        "message": "Помощь и поддержка"
+    },
+    "tray.menu.github": {
+        "message": "GitHub"
+    },
+    "tray.menu.documentation": {
+        "message": "Документация"
+    },
+    "tray.menu.troubleshoot": {
+        "message": "Диагностика"
+    },
+    "tray.menu.downloadLatest": {
+        "message": "Загрузить последнюю версию"
+    },
+    "tray.menu.installVersion": {
+        "message": "Установить версию {version}"
+    },
+    "tray.menu.guiVersion": {
+        "message": "GUI: {version}"
+    },
+    "tray.menu.daemonVersion": {
+        "message": "Демон: {version}"
+    },
+    "tray.menu.versionUnknown": {
+        "message": "—"
+    },
+    "tray.menu.quit": {
+        "message": "Выйти из NetBird"
+    },
+    "notify.daemonOutdated.title": {
+        "message": "Служба NetBird устарела"
+    },
+    "notify.daemonOutdated.body": {
+        "message": "Обновите службу NetBird, чтобы использовать это приложение."
+    },
+    "notify.update.title": {
+        "message": "Доступно обновление NetBird"
+    },
+    "notify.update.body": {
+        "message": "Доступна версия NetBird {version}."
+    },
+    "notify.update.enforcedSuffix": {
+        "message": " Ваш администратор требует установить это обновление."
+    },
+    "notify.error.title": {
+        "message": "Ошибка"
+    },
+    "notify.error.connect": {
+        "message": "Не удалось подключиться"
+    },
+    "notify.error.disconnect": {
+        "message": "Не удалось отключиться"
+    },
+    "notify.error.switchProfile": {
+        "message": "Не удалось переключиться на {profile}"
+    },
+    "notify.error.exitNode": {
+        "message": "Не удалось обновить выходной узел {name}"
+    },
+    "notify.sessionExpired.title": {
+        "message": "Сеанс NetBird истёк"
+    },
+    "notify.sessionExpired.body": {
+        "message": "Сеанс NetBird истёк. Пожалуйста, войдите снова."
+    },
+    "notify.sessionWarning.title": {
+        "message": "Сеанс скоро истечёт"
+    },
+    "notify.sessionWarning.body": {
+        "message": "Сеанс NetBird истекает через {remaining}. Нажмите «Продлить сейчас», чтобы продлить сеанс."
+    },
+    "notify.sessionWarning.bodyGeneric": {
+        "message": "Сеанс NetBird скоро истечёт. Нажмите «Продлить сейчас», чтобы продлить сеанс."
+    },
+    "notify.sessionWarning.extend": {
+        "message": "Продлить сейчас"
+    },
+    "notify.sessionWarning.dismiss": {
+        "message": "Закрыть"
+    },
+    "notify.sessionWarning.failed": {
+        "message": "Не удалось продлить сеанс NetBird"
+    },
+    "notify.sessionWarning.successTitle": {
+        "message": "Сеанс NetBird продлён"
+    },
+    "notify.sessionWarning.successBody": {
+        "message": "Сеанс обновлён."
+    },
+    "notify.sessionDeadlineRejected.title": {
+        "message": "Неверный срок действия сеанса"
+    },
+    "notify.sessionDeadlineRejected.body": {
+        "message": "Сервер передал неверный срок действия сеанса. Пожалуйста, войдите снова."
+    },
+    "notify.mdm.policyApplied.title": {
+        "message": "Настройки NetBird обновлены"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "Конфигурация NetBird была обновлена в соответствии с вашей ИТ-политикой."
+    },
+    "common.cancel": {
+        "message": "Отмена"
+    },
+    "common.save": {
+        "message": "Сохранить"
+    },
+    "common.saveChanges": {
+        "message": "Сохранить изменения"
+    },
+    "common.saving": {
+        "message": "Сохранение…"
+    },
+    "common.close": {
+        "message": "Закрыть"
+    },
+    "common.copy": {
+        "message": "Копировать"
+    },
+    "common.togglePasswordVisibility": {
+        "message": "Показать или скрыть пароль"
+    },
+    "common.increase": {
+        "message": "Увеличить"
+    },
+    "common.decrease": {
+        "message": "Уменьшить"
+    },
+    "common.delete": {
+        "message": "Удалить"
+    },
+    "common.create": {
+        "message": "Создать"
+    },
+    "common.add": {
+        "message": "Добавить"
+    },
+    "common.remove": {
+        "message": "Убрать"
+    },
+    "common.refresh": {
+        "message": "Обновить"
+    },
+    "common.loading": {
+        "message": "Загрузка…"
+    },
+    "common.netbird": {
+        "message": "NetBird"
+    },
+    "common.noResults.title": {
+        "message": "Ничего не найдено"
+    },
+    "common.noResults.description": {
+        "message": "Ничего не найдено. Попробуйте изменить поисковый запрос или фильтры."
+    },
+    "notConnected.title": {
+        "message": "Отключено"
+    },
+    "notConnected.description": {
+        "message": "Сначала подключитесь к NetBird, чтобы увидеть подробную информацию о пирах, сетевых ресурсах и выходных узлах."
+    },
+    "connect.status.disconnected": {
+        "message": "Отключено"
+    },
+    "connect.status.connecting": {
+        "message": "Подключение…"
+    },
+    "connect.status.connected": {
+        "message": "Подключено"
+    },
+    "connect.status.disconnecting": {
+        "message": "Отключение…"
+    },
+    "connect.status.daemonUnavailable": {
+        "message": "Демон недоступен"
+    },
+    "connect.status.loginRequired": {
+        "message": "Требуется вход"
+    },
+    "connect.error.loginTitle": {
+        "message": "Не удалось войти"
+    },
+    "connect.error.connectTitle": {
+        "message": "Не удалось подключиться"
+    },
+    "connect.error.disconnectTitle": {
+        "message": "Не удалось отключиться"
+    },
+    "nav.peers.title": {
+        "message": "Пиры"
+    },
+    "nav.peers.description": {
+        "message": "{connected} из {total} подключено"
+    },
+    "nav.resources.title": {
+        "message": "Ресурсы"
+    },
+    "nav.resources.description": {
+        "message": "{active} из {total} активно"
+    },
+    "nav.exitNode.title": {
+        "message": "Выходные узлы"
+    },
+    "nav.exitNode.none": {
+        "message": "Не активен"
+    },
+    "nav.exitNode.using": {
+        "message": "Через {name}"
+    },
+    "header.openSettings": {
+        "message": "Открыть настройки"
+    },
+    "header.togglePanel": {
+        "message": "Показать или скрыть боковую панель"
+    },
+    "profile.selector.loading": {
+        "message": "Загрузка…"
+    },
+    "profile.selector.noProfile": {
+        "message": "Нет профиля"
+    },
+    "profile.selector.searchPlaceholder": {
+        "message": "Поиск профиля по имени…"
+    },
+    "profile.selector.emptyTitle": {
+        "message": "Профили не найдены"
+    },
+    "profile.selector.emptyDescription": {
+        "message": "Измените поисковый запрос или создайте новый профиль."
+    },
+    "profile.selector.newProfile": {
+        "message": "Новый профиль"
+    },
+    "profile.selector.moreOptions": {
+        "message": "Дополнительные параметры"
+    },
+    "profile.selector.deregister": {
+        "message": "Отменить регистрацию"
+    },
+    "profile.selector.delete": {
+        "message": "Удалить"
+    },
+    "profile.selector.switchTo": {
+        "message": "Переключиться на этот профиль"
+    },
+    "profile.selector.edit": {
+        "message": "Изменить"
+    },
+    "profile.edit.title": {
+        "message": "Изменить профиль"
+    },
+    "profile.edit.submit": {
+        "message": "Сохранить изменения"
+    },
+    "profile.dialog.title": {
+        "message": "Введите имя профиля"
+    },
+    "profile.dialog.nameLabel": {
+        "message": "Имя профиля"
+    },
+    "profile.dialog.description": {
+        "message": "Задайте легко узнаваемое имя для профиля."
+    },
+    "profile.dialog.placeholder": {
+        "message": "например, работа"
+    },
+    "profile.dialog.submit": {
+        "message": "Добавить профиль"
+    },
+    "profile.dialog.required": {
+        "message": "Введите имя профиля, например работа или дом"
+    },
+    "profile.dialog.managementHelp": {
+        "message": "Используйте NetBird Cloud или собственный сервер."
+    },
+    "profile.dialog.urlUnreachable": {
+        "message": "Не удалось связаться с сервером. Проверьте URL или всё равно добавьте профиль, если уверены, что он правильный."
+    },
+    "header.menu.settings": {
+        "message": "Настройки…"
+    },
+    "header.menu.defaultView": {
+        "message": "Обычный вид"
+    },
+    "header.menu.advancedView": {
+        "message": "Расширенный вид"
+    },
+    "header.menu.updateAvailable": {
+        "message": "Доступно обновление"
+    },
+    "header.menu.open": {
+        "message": "Открыть меню"
+    },
+    "header.profile.switch": {
+        "message": "Сменить профиль"
+    },
+    "connect.toggle.label": {
+        "message": "Переключить подключение NetBird"
+    },
+    "connect.localIp.label": {
+        "message": "Локальные IP-адреса"
+    },
+    "common.search": {
+        "message": "Поиск"
+    },
+    "common.filter": {
+        "message": "Фильтр"
+    },
+    "exitNodes.dropdown.trigger": {
+        "message": "Выбрать выходной узел"
+    },
+    "peers.row.label": {
+        "message": "Открыть подробности для {name}, {status}"
+    },
+    "peers.dialog.title": {
+        "message": "Сведения об узле"
+    },
+    "networks.row.toggle": {
+        "message": "Переключить {name}"
+    },
+    "networks.bulk.label": {
+        "message": "Переключить все видимые ресурсы"
+    },
+    "settings.nav.label": {
+        "message": "Разделы настроек"
+    },
+    "profile.switch.title": {
+        "message": "Переключиться на профиль «{name}»?"
+    },
+    "profile.switch.message": {
+        "message": "Вы действительно хотите переключить профиль?\nТекущий профиль будет отключён."
+    },
+    "profile.switch.confirm": {
+        "message": "Подтвердить"
+    },
+    "profile.deregister.title": {
+        "message": "Отменить регистрацию профиля «{name}»?"
+    },
+    "profile.deregister.message": {
+        "message": "Вы действительно хотите отменить регистрацию этого профиля?\nДля его использования потребуется войти снова."
+    },
+    "profile.deregister.confirm": {
+        "message": "Отменить регистрацию"
+    },
+    "profile.delete.title": {
+        "message": "Удалить профиль «{name}»?"
+    },
+    "profile.delete.message": {
+        "message": "Вы действительно хотите удалить этот профиль?\nЭто действие нельзя отменить."
+    },
+    "profile.delete.disabledActive": {
+        "message": "Активные профили нельзя удалить. Переключитесь на другой профиль, прежде чем удалять этот."
+    },
+    "profile.delete.disabledDefault": {
+        "message": "Профиль по умолчанию нельзя удалить."
+    },
+    "profile.error.switchTitle": {
+        "message": "Не удалось переключить профиль"
+    },
+    "profile.error.deregisterTitle": {
+        "message": "Не удалось отменить регистрацию профиля"
+    },
+    "profile.error.deleteTitle": {
+        "message": "Не удалось удалить профиль"
+    },
+    "profile.error.createTitle": {
+        "message": "Не удалось создать профиль"
+    },
+    "profile.error.editTitle": {
+        "message": "Не удалось изменить профиль"
+    },
+    "profile.error.loadTitle": {
+        "message": "Не удалось загрузить профили"
+    },
+    "profile.dropdown.activeProfile": {
+        "message": "Активный профиль"
+    },
+    "profile.dropdown.switchProfile": {
+        "message": "Переключить профиль"
+    },
+    "profile.dropdown.noEmail": {
+        "message": "Другое"
+    },
+    "profile.dropdown.addProfile": {
+        "message": "Добавить профиль"
+    },
+    "profile.dropdown.manageProfiles": {
+        "message": "Управление профилями"
+    },
+    "profile.dropdown.settings": {
+        "message": "Настройки"
+    },
+    "settings.profiles.section.profiles": {
+        "message": "Профили"
+    },
+    "settings.profiles.intro": {
+        "message": "Управляйте несколькими профилями NetBird параллельно — например, рабочими и личными учётными записями или разными серверами управления. Ниже можно добавлять профили, отменять их регистрацию и удалять их."
+    },
+    "settings.profiles.addProfile": {
+        "message": "Добавить профиль"
+    },
+    "settings.profiles.active": {
+        "message": "Активен"
+    },
+    "settings.profiles.emptyTitle": {
+        "message": "Нет профилей"
+    },
+    "settings.profiles.emptyDescription": {
+        "message": "Создайте профиль, чтобы подключиться к серверу управления NetBird."
+    },
+    "settings.error.loadTitle": {
+        "message": "Не удалось загрузить настройки"
+    },
+    "settings.error.saveTitle": {
+        "message": "Не удалось сохранить настройки"
+    },
+    "settings.error.debugBundleTitle": {
+        "message": "Не удалось создать отладочный пакет"
+    },
+    "settings.tabs.general": {
+        "message": "Общие"
+    },
+    "settings.tabs.network": {
+        "message": "Сеть"
+    },
+    "settings.tabs.security": {
+        "message": "Безопасность"
+    },
+    "settings.tabs.profiles": {
+        "message": "Профили"
+    },
+    "settings.tabs.ssh": {
+        "message": "SSH"
+    },
+    "settings.tabs.advanced": {
+        "message": "Дополнительно"
+    },
+    "settings.tabs.troubleshooting": {
+        "message": "Диагностика"
+    },
+    "settings.tabs.about": {
+        "message": "О программе"
+    },
+    "settings.tabs.updateAvailable": {
+        "message": "Доступно обновление"
+    },
+    "settings.general.section.general": {
+        "message": "Общие"
+    },
+    "settings.general.section.connection": {
+        "message": "Подключение"
+    },
+    "settings.general.connectOnStartup.label": {
+        "message": "Подключаться при запуске"
+    },
+    "settings.general.connectOnStartup.help": {
+        "message": "Автоматически устанавливать подключение при запуске службы."
+    },
+    "settings.general.notifications.label": {
+        "message": "Уведомления на рабочем столе"
+    },
+    "settings.general.notifications.help": {
+        "message": "Показывать уведомления о новых обновлениях и событиях подключения."
+    },
+    "settings.general.autostart.label": {
+        "message": "Запускать интерфейс NetBird при входе"
+    },
+    "settings.general.autostart.help": {
+        "message": "Автоматически запускать интерфейс NetBird при входе в систему. Это влияет только на графический интерфейс, но не на фоновую службу."
+    },
+    "settings.general.autostart.errorTitle": {
+        "message": "Не удалось изменить автозапуск"
+    },
+    "settings.general.language.label": {
+        "message": "Язык интерфейса"
+    },
+    "settings.general.language.help": {
+        "message": "Выберите язык интерфейса NetBird."
+    },
+    "settings.general.language.search": {
+        "message": "Поиск языка…"
+    },
+    "settings.general.language.empty": {
+        "message": "Языки не найдены."
+    },
+    "settings.general.management.label": {
+        "message": "Сервер управления"
+    },
+    "settings.general.management.help": {
+        "message": "Подключайтесь к NetBird Cloud или к собственному серверу управления. Изменения вызовут переподключение клиента."
+    },
+    "settings.general.management.cloud": {
+        "message": "Cloud"
+    },
+    "settings.general.management.selfHosted": {
+        "message": "Собственный сервер"
+    },
+    "settings.general.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlError": {
+        "message": "Введите корректный URL, например https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlUnreachable": {
+        "message": "Не удалось связаться с сервером. Проверьте URL или всё равно сохраните, если уверены, что он правильный."
+    },
+    "settings.general.management.switchCloudTitle": {
+        "message": "Переключиться на NetBird Cloud?"
+    },
+    "settings.general.management.switchCloudMessage": {
+        "message": "Это отключит ваш собственный сервер.\nВозможно, потребуется войти снова."
+    },
+    "settings.general.management.switchCloudConfirm": {
+        "message": "Переключиться на Cloud"
+    },
+    "settings.network.section.connectivity": {
+        "message": "Подключение"
+    },
+    "settings.network.section.routingDns": {
+        "message": "Маршрутизация и DNS"
+    },
+    "settings.network.monitor.label": {
+        "message": "Переподключаться при смене сети"
+    },
+    "settings.network.monitor.help": {
+        "message": "Отслеживать сеть и автоматически переподключаться при изменениях, таких как смена Wi-Fi, изменения Ethernet или выход из спящего режима."
+    },
+    "settings.network.dns.label": {
+        "message": "Включить DNS"
+    },
+    "settings.network.dns.help": {
+        "message": "Применять управляемые NetBird настройки DNS к системному резолверу."
+    },
+    "settings.network.clientRoutes.label": {
+        "message": "Включить клиентские маршруты"
+    },
+    "settings.network.clientRoutes.help": {
+        "message": "Принимать маршруты от других пиров для доступа к их сетям."
+    },
+    "settings.network.serverRoutes.label": {
+        "message": "Включить серверные маршруты"
+    },
+    "settings.network.serverRoutes.help": {
+        "message": "Анонсировать локальные маршруты этого хоста другим пирам."
+    },
+    "settings.network.ipv6.label": {
+        "message": "Включить IPv6"
+    },
+    "settings.network.ipv6.help": {
+        "message": "Использовать IPv6-адресацию для оверлейной сети NetBird."
+    },
+    "settings.security.section.firewall": {
+        "message": "Брандмауэр"
+    },
+    "settings.security.section.encryption": {
+        "message": "Шифрование"
+    },
+    "settings.security.blockInbound.label": {
+        "message": "Блокировать входящий трафик"
+    },
+    "settings.security.blockInbound.help": {
+        "message": "Отклонять незапрошенные подключения от пиров к этому устройству и сетям, которые оно маршрутизирует. Исходящий трафик не затрагивается."
+    },
+    "settings.security.blockLan.label": {
+        "message": "Блокировать доступ к LAN"
+    },
+    "settings.security.blockLan.help": {
+        "message": "Запрещать пирам доступ к вашей локальной сети и её устройствам, когда это устройство маршрутизирует их трафик."
+    },
+    "settings.security.rosenpass.label": {
+        "message": "Включить квантовую устойчивость"
+    },
+    "settings.security.rosenpass.help": {
+        "message": "Добавить постквантовый обмен ключами через Rosenpass поверх WireGuard®."
+    },
+    "settings.security.rosenpassPermissive.label": {
+        "message": "Включить разрешающий режим"
+    },
+    "settings.security.rosenpassPermissive.help": {
+        "message": "Разрешать подключения к пирам без поддержки квантовой устойчивости."
+    },
+    "settings.ssh.section.server": {
+        "message": "Сервер"
+    },
+    "settings.ssh.section.capabilities": {
+        "message": "Возможности"
+    },
+    "settings.ssh.section.authentication": {
+        "message": "Аутентификация"
+    },
+    "settings.ssh.server.label": {
+        "message": "Включить SSH-сервер"
+    },
+    "settings.ssh.server.help": {
+        "message": "Запускать SSH-сервер NetBird на этом хосте, чтобы другие пиры могли к нему подключаться."
+    },
+    "settings.ssh.root.label": {
+        "message": "Разрешить вход под root"
+    },
+    "settings.ssh.root.help": {
+        "message": "Разрешить пирам входить под пользователем root. Отключите, чтобы требовать непривилегированную учётную запись."
+    },
+    "settings.ssh.sftp.label": {
+        "message": "Разрешить SFTP"
+    },
+    "settings.ssh.sftp.help": {
+        "message": "Безопасно передавать файлы через стандартные клиенты SFTP или SCP."
+    },
+    "settings.ssh.localForward.label": {
+        "message": "Локальная переадресация портов"
+    },
+    "settings.ssh.localForward.help": {
+        "message": "Разрешить подключающимся пирам туннелировать локальные порты к службам, доступным с этого хоста."
+    },
+    "settings.ssh.remoteForward.label": {
+        "message": "Удалённая переадресация портов"
+    },
+    "settings.ssh.remoteForward.help": {
+        "message": "Разрешить подключающимся пирам пробрасывать порты этого хоста на свою машину."
+    },
+    "settings.ssh.jwt.label": {
+        "message": "Включить аутентификацию JWT"
+    },
+    "settings.ssh.jwt.help": {
+        "message": "Проверять каждую сессию SSH через ваш IdP для идентификации пользователя и аудита. Отключите, чтобы полагаться только на сетевые политики ACL — полезно, когда IdP недоступен."
+    },
+    "settings.ssh.jwtTtl.label": {
+        "message": "TTL кэша JWT"
+    },
+    "settings.ssh.jwtTtl.help": {
+        "message": "Как долго этот клиент кэширует JWT, прежде чем снова запрашивать его при исходящих SSH-подключениях. Установите 0, чтобы отключить кэширование и аутентифицироваться при каждом подключении."
+    },
+    "settings.ssh.jwtTtl.suffix": {
+        "message": "сек."
+    },
+    "settings.advanced.section.interface": {
+        "message": "Интерфейс"
+    },
+    "settings.advanced.section.security": {
+        "message": "Безопасность"
+    },
+    "settings.advanced.interfaceName.label": {
+        "message": "Имя"
+    },
+    "settings.advanced.interfaceName.error": {
+        "message": "Используйте от 1 до 15 букв, цифр, точек, дефисов или подчёркиваний."
+    },
+    "settings.advanced.interfaceName.errorMac": {
+        "message": "Должно начинаться с «utun», за которым следует число (например, utun100)."
+    },
+    "settings.advanced.port.label": {
+        "message": "Порт"
+    },
+    "settings.advanced.port.error": {
+        "message": "Введите порт от {min} до {max}."
+    },
+    "settings.advanced.port.help": {
+        "message": "Если задано 0, будет использован случайный свободный порт."
+    },
+    "settings.advanced.mtu.label": {
+        "message": "MTU"
+    },
+    "settings.advanced.mtu.error": {
+        "message": "Введите значение MTU от {min} до {max}."
+    },
+    "settings.advanced.psk.label": {
+        "message": "Общий ключ"
+    },
+    "settings.advanced.psk.help": {
+        "message": "Необязательный PSK WireGuard для дополнительного симметричного шифрования. Это не то же самое, что ключ установки NetBird. Вы будете обмениваться данными только с пирами, использующими тот же общий ключ."
+    },
+    "settings.troubleshooting.section.title": {
+        "message": "Отладочный пакет"
+    },
+    "settings.troubleshooting.anonymize.label": {
+        "message": "Анонимизировать конфиденциальную информацию"
+    },
+    "settings.troubleshooting.anonymize.help": {
+        "message": "Скрывает публичные IP-адреса и сторонние (не относящиеся к NetBird) домены в журналах."
+    },
+    "settings.troubleshooting.systemInfo.label": {
+        "message": "Включить сведения о системе"
+    },
+    "settings.troubleshooting.systemInfo.help": {
+        "message": "Включить ОС, ядро, сетевые интерфейсы и таблицы маршрутизации."
+    },
+    "settings.troubleshooting.upload.label": {
+        "message": "Загрузить пакет на серверы NetBird"
+    },
+    "settings.troubleshooting.upload.help": {
+        "message": "Возвращает ключ загрузки, который можно передать поддержке NetBird."
+    },
+    "settings.troubleshooting.trace.label": {
+        "message": "Включить журналы TRACE"
+    },
+    "settings.troubleshooting.trace.help": {
+        "message": "Повышает уровень журналирования до TRACE и затем восстанавливает прежний."
+    },
+    "settings.troubleshooting.capture.label": {
+        "message": "Сеанс записи"
+    },
+    "settings.troubleshooting.capture.help": {
+        "message": "Переподключается и ожидает, чтобы вы могли воспроизвести проблему."
+    },
+    "settings.troubleshooting.packets.label": {
+        "message": "Записывать сетевые пакеты"
+    },
+    "settings.troubleshooting.packets.help": {
+        "message": "Сохраняет .pcap сетевого трафика во время сеанса записи."
+    },
+    "settings.troubleshooting.duration.label": {
+        "message": "Длительность записи"
+    },
+    "settings.troubleshooting.duration.help": {
+        "message": "Как долго длится сеанс записи."
+    },
+    "settings.troubleshooting.duration.suffix": {
+        "message": "мин."
+    },
+    "settings.troubleshooting.create": {
+        "message": "Создать отладочный пакет"
+    },
+    "settings.troubleshooting.progress.description": {
+        "message": "Сбор журналов, сведений о системе и состояния подключения. Обычно это занимает несколько секунд — не закрывайте это окно до завершения."
+    },
+    "settings.troubleshooting.cancelling": {
+        "message": "Отмена…"
+    },
+    "settings.troubleshooting.done.uploadedTitle": {
+        "message": "Отладочный пакет успешно загружен!"
+    },
+    "settings.troubleshooting.done.savedTitle": {
+        "message": "Пакет сохранён"
+    },
+    "settings.troubleshooting.done.uploadedDescription": {
+        "message": "Поделитесь ключом загрузки ниже с <docs>поддержкой NetBird</docs>. Локальная копия также сохранена на вашем устройстве."
+    },
+    "settings.troubleshooting.done.savedDescription": {
+        "message": "Отладочный пакет сохранён локально."
+    },
+    "settings.troubleshooting.done.copyKey": {
+        "message": "Копировать ключ"
+    },
+    "settings.troubleshooting.done.openFolder": {
+        "message": "Открыть папку"
+    },
+    "settings.troubleshooting.done.openFileLocation": {
+        "message": "Открыть расположение файла"
+    },
+    "settings.troubleshooting.uploadFailedWithReason": {
+        "message": "Не удалось загрузить: {reason} Пакет всё равно сохранён локально."
+    },
+    "settings.troubleshooting.uploadFailed": {
+        "message": "Не удалось загрузить. Пакет всё равно сохранён локально."
+    },
+    "settings.troubleshooting.stage.reconnecting": {
+        "message": "Переподключение NetBird…"
+    },
+    "settings.troubleshooting.stage.capturing": {
+        "message": "Сбор отладочных журналов"
+    },
+    "settings.troubleshooting.stage.bundling": {
+        "message": "Создание отладочного пакета…"
+    },
+    "settings.troubleshooting.stage.uploading": {
+        "message": "Загрузка в NetBird…"
+    },
+    "settings.troubleshooting.stage.cancelling": {
+        "message": "Отмена…"
+    },
+    "settings.about.client": {
+        "message": "Клиент NetBird v{version}"
+    },
+    "settings.about.clientName": {
+        "message": "Клиент NetBird"
+    },
+    "settings.about.development": {
+        "message": "[Разработка]"
+    },
+    "settings.about.gui": {
+        "message": "GUI v{version}"
+    },
+    "settings.about.guiName": {
+        "message": "GUI"
+    },
+    "settings.about.copyright": {
+        "message": "© {year} NetBird. Все права защищены."
+    },
+    "settings.about.links.imprint": {
+        "message": "Правовая информация"
+    },
+    "settings.about.links.privacy": {
+        "message": "Конфиденциальность"
+    },
+    "settings.about.links.cla": {
+        "message": "CLA"
+    },
+    "settings.about.links.terms": {
+        "message": "Условия использования"
+    },
+    "settings.about.community.github": {
+        "message": "GitHub"
+    },
+    "settings.about.community.slack": {
+        "message": "Slack"
+    },
+    "settings.about.community.forum": {
+        "message": "Форум"
+    },
+    "settings.about.community.documentation": {
+        "message": "Документация"
+    },
+    "settings.about.community.feedback": {
+        "message": "Обратная связь"
+    },
+    "update.banner.message": {
+        "message": "NetBird {version} готов к установке."
+    },
+    "update.banner.later": {
+        "message": "Позже"
+    },
+    "update.banner.installNow": {
+        "message": "Установить сейчас"
+    },
+    "update.card.versionAvailableDownload": {
+        "message": "Версия {version} доступна для загрузки."
+    },
+    "update.card.versionAvailableInstall": {
+        "message": "Версия {version} доступна для установки."
+    },
+    "update.card.whatsNew": {
+        "message": "Что нового?"
+    },
+    "update.card.installNow": {
+        "message": "Установить сейчас"
+    },
+    "update.card.getInstaller": {
+        "message": "Загрузить"
+    },
+    "update.card.autoCheckInterval": {
+        "message": "NetBird проверяет обновления в фоновом режиме."
+    },
+    "update.card.changelog": {
+        "message": "Список изменений"
+    },
+    "update.card.onLatestVersion": {
+        "message": "У вас установлена последняя версия"
+    },
+    "update.header.tooltip": {
+        "message": "Доступно обновление"
+    },
+    "update.overlay.updatingVersion": {
+        "message": "Обновление NetBird до v{version}"
+    },
+    "update.overlay.updating": {
+        "message": "Обновление NetBird"
+    },
+    "update.overlay.description": {
+        "message": "Доступна более новая версия, идёт её установка. NetBird автоматически перезапустится после завершения обновления."
+    },
+    "update.overlay.error.timeoutTitle": {
+        "message": "Обновление занимает слишком много времени"
+    },
+    "update.overlay.error.timeoutDescription": {
+        "message": "Установка {target} заняла слишком много времени и не завершилась."
+    },
+    "update.overlay.error.canceledTitle": {
+        "message": "Обновление остановлено"
+    },
+    "update.overlay.error.canceledDescription": {
+        "message": "Обновление до {target} было отменено до завершения."
+    },
+    "update.overlay.error.failTitle": {
+        "message": "Не удалось установить обновление"
+    },
+    "update.overlay.error.failDescription": {
+        "message": "Не удалось установить обновление до {target}."
+    },
+    "update.overlay.error.unknownMessage": {
+        "message": "неизвестная ошибка"
+    },
+    "update.overlay.error.targetVersion": {
+        "message": "v{version}"
+    },
+    "update.overlay.error.targetFallback": {
+        "message": "новой версии"
+    },
+    "update.error.loadStateTitle": {
+        "message": "Не удалось загрузить состояние обновления"
+    },
+    "update.error.triggerTitle": {
+        "message": "Не удалось запустить обновление"
+    },
+    "update.page.versionLine": {
+        "message": "Обновление клиента до версии {version}."
+    },
+    "update.page.versionLineGeneric": {
+        "message": "Обновление клиента."
+    },
+    "update.page.outdated": {
+        "message": "Версия вашего клиента старше версии автообновления, заданной на сервере управления."
+    },
+    "update.page.status.running": {
+        "message": "Обновление"
+    },
+    "update.page.status.timeout": {
+        "message": "Время ожидания обновления истекло. Повторите попытку."
+    },
+    "update.page.status.canceled": {
+        "message": "Обновление отменено."
+    },
+    "update.page.status.failed": {
+        "message": "Не удалось обновить: {message}"
+    },
+    "update.page.status.unknownError": {
+        "message": "неизвестная ошибка обновления"
+    },
+    "update.page.failedTitle": {
+        "message": "Не удалось обновить"
+    },
+    "update.page.timeoutMessage": {
+        "message": "Время ожидания обновления истекло."
+    },
+    "update.page.dontClose": {
+        "message": "Пожалуйста, не закрывайте это окно."
+    },
+    "update.page.updating": {
+        "message": "Обновление…"
+    },
+    "update.page.complete": {
+        "message": "Обновление завершено"
+    },
+    "update.page.failed": {
+        "message": "Обновление не удалось"
+    },
+    "window.title.settings": {
+        "message": "Настройки"
+    },
+    "window.title.signIn": {
+        "message": "Вход"
+    },
+    "window.title.sessionExpiration": {
+        "message": "Истечение сеанса"
+    },
+    "window.title.updating": {
+        "message": "Обновление"
+    },
+    "window.title.welcome": {
+        "message": "Добро пожаловать в NetBird"
+    },
+    "window.title.error": {
+        "message": "Ошибка"
+    },
+    "welcome.title": {
+        "message": "Найдите NetBird в системном трее"
+    },
+    "welcome.description": {
+        "message": "NetBird находится в системном трее. Нажмите на значок, чтобы подключиться, переключить профиль или открыть настройки."
+    },
+    "welcome.continue": {
+        "message": "Продолжить"
+    },
+    "welcome.back": {
+        "message": "Назад"
+    },
+    "welcome.management.title": {
+        "message": "Настройка NetBird"
+    },
+    "welcome.management.description": {
+        "message": "Нажмите «Продолжить», чтобы начать, или выберите «Собственный сервер», если у вас есть свой сервер NetBird."
+    },
+    "welcome.management.cloud.title": {
+        "message": "NetBird Cloud"
+    },
+    "welcome.management.cloud.description": {
+        "message": "Используйте наш облачный сервис. Настройка не требуется."
+    },
+    "welcome.management.selfHosted.title": {
+        "message": "Собственный сервер"
+    },
+    "welcome.management.selfHosted.description": {
+        "message": "Подключитесь к собственному серверу управления."
+    },
+    "welcome.management.urlLabel": {
+        "message": "URL сервера управления"
+    },
+    "welcome.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlInvalid": {
+        "message": "Введите корректный URL, например https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlUnreachable": {
+        "message": "Не удалось связаться с сервером. Проверьте URL или сеть, затем продолжите, если уверены, что он правильный."
+    },
+    "welcome.management.checking": {
+        "message": "Проверка…"
+    },
+    "browserLogin.title": {
+        "message": "Завершите вход в браузере"
+    },
+    "browserLogin.notSeeing": {
+        "message": "Мы открыли вкладку браузера, чтобы вы могли войти в аккаунт. Не видите вкладку?"
+    },
+    "browserLogin.tryAgain": {
+        "message": "Повторить"
+    },
+    "browserLogin.openFailedTitle": {
+        "message": "Не удалось открыть браузер"
+    },
+    "sessionExpiration.title": {
+        "message": "Сеанс скоро истечёт"
+    },
+    "sessionExpiration.titleLater": {
+        "message": "Ваш сеанс истечёт"
+    },
+    "sessionExpiration.description": {
+        "message": "Это устройство скоро будет отключено. Продлите сеанс через вход в браузере."
+    },
+    "sessionExpiration.descriptionLater": {
+        "message": "Вход в браузере сохранит подключение этого устройства к вашей сети."
+    },
+    "sessionExpiration.stay": {
+        "message": "Продлить сеанс"
+    },
+    "sessionExpiration.authenticate": {
+        "message": "Войти"
+    },
+    "sessionExpiration.logout": {
+        "message": "Выйти"
+    },
+    "sessionExpiration.expired": {
+        "message": "Сеанс истёк"
+    },
+    "sessionExpiration.expiredDescription": {
+        "message": "Устройство отключено. Войдите через браузер, чтобы переподключиться."
+    },
+    "sessionExpiration.close": {
+        "message": "Закрыть"
+    },
+    "sessionExpiration.extendFailedTitle": {
+        "message": "Не удалось продлить сеанс"
+    },
+    "sessionExpiration.logoutFailedTitle": {
+        "message": "Не удалось выйти"
+    },
+    "peers.search.placeholder": {
+        "message": "Поиск по имени или IP"
+    },
+    "peers.filter.all": {
+        "message": "Все"
+    },
+    "peers.filter.online": {
+        "message": "В сети"
+    },
+    "peers.filter.offline": {
+        "message": "Не в сети"
+    },
+    "peers.empty.title": {
+        "message": "Нет доступных пиров"
+    },
+    "peers.empty.description": {
+        "message": "У вас нет доступных пиров или нет доступа ни к одному из них."
+    },
+    "peers.details.domain": {
+        "message": "Домен"
+    },
+    "peers.details.netbirdIp": {
+        "message": "NetBird IP"
+    },
+    "peers.details.netbirdIpv6": {
+        "message": "NetBird IPv6"
+    },
+    "peers.details.publicKey": {
+        "message": "Открытый ключ"
+    },
+    "peers.details.connection": {
+        "message": "Подключение"
+    },
+    "peers.details.latency": {
+        "message": "Задержка"
+    },
+    "peers.details.lastHandshake": {
+        "message": "Последнее рукопожатие"
+    },
+    "peers.details.statusSince": {
+        "message": "Последнее обновление подключения"
+    },
+    "peers.details.bytes": {
+        "message": "Байты"
+    },
+    "peers.details.bytesSent": {
+        "message": "Отправлено"
+    },
+    "peers.details.bytesReceived": {
+        "message": "Получено"
+    },
+    "peers.details.localIce": {
+        "message": "Локальный ICE"
+    },
+    "peers.details.remoteIce": {
+        "message": "Удалённый ICE"
+    },
+    "peers.details.never": {
+        "message": "Никогда"
+    },
+    "peers.details.justNow": {
+        "message": "Только что"
+    },
+    "peers.details.refresh": {
+        "message": "Обновить"
+    },
+    "peers.status.connected": {
+        "message": "Подключено"
+    },
+    "peers.status.connecting": {
+        "message": "Подключение"
+    },
+    "peers.status.disconnected": {
+        "message": "Отключено"
+    },
+    "peers.details.relayAddress": {
+        "message": "Ретранслятор"
+    },
+    "peers.details.networks": {
+        "message": "Ресурсы"
+    },
+    "peers.details.relayed": {
+        "message": "Через ретранслятор"
+    },
+    "peers.details.p2p": {
+        "message": "P2P"
+    },
+    "peers.details.rosenpass": {
+        "message": "Rosenpass включён"
+    },
+    "networks.search.placeholder": {
+        "message": "Поиск по сети или домену"
+    },
+    "networks.filter.all": {
+        "message": "Все"
+    },
+    "networks.filter.active": {
+        "message": "Активные"
+    },
+    "networks.filter.overlapping": {
+        "message": "Пересекающиеся"
+    },
+    "networks.empty.title": {
+        "message": "Нет доступных ресурсов"
+    },
+    "networks.empty.description": {
+        "message": "У вас нет доступных сетевых ресурсов или нет доступа ни к одному из них."
+    },
+    "networks.selected": {
+        "message": "Выбрано"
+    },
+    "networks.unselected": {
+        "message": "Не выбрано"
+    },
+    "networks.ips.heading": {
+        "message": "Распознанные IP-адреса"
+    },
+    "networks.bulk.selectionCount": {
+        "message": "{selected} из {total} активно"
+    },
+    "networks.bulk.enableAll": {
+        "message": "Включить все"
+    },
+    "networks.bulk.disableAll": {
+        "message": "Отключить все"
+    },
+    "exitNodes.search.placeholder": {
+        "message": "Поиск выходных узлов"
+    },
+    "exitNodes.none": {
+        "message": "Нет"
+    },
+    "exitNodes.empty.title": {
+        "message": "Нет доступных выходных узлов"
+    },
+    "exitNodes.empty.description": {
+        "message": "Этому пиру не предоставлены выходные узлы."
+    },
+    "exitNodes.card.title": {
+        "message": "Выходной узел"
+    },
+    "exitNodes.card.statusActive": {
+        "message": "Активен"
+    },
+    "exitNodes.card.statusInactive": {
+        "message": "Неактивен"
+    },
+    "exitNodes.dropdown.noneTitle": {
+        "message": "Нет"
+    },
+    "exitNodes.dropdown.noneDescription": {
+        "message": "Прямое подключение без выходного узла"
+    },
+    "quickActions.connect": {
+        "message": "Подключиться"
+    },
+    "quickActions.disconnect": {
+        "message": "Отключиться"
+    },
+    "daemon.unavailable.title": {
+        "message": "Служба NetBird не запущена"
+    },
+    "daemon.unavailable.description": {
+        "message": "Приложение автоматически переподключится, как только служба будет запущена."
+    },
+    "daemon.unavailable.docsLink": {
+        "message": "Документация"
+    },
+    "daemon.outdated.title": {
+        "message": "Служба NetBird устарела"
+    },
+    "daemon.outdated.description": {
+        "message": "Обновите службу NetBird, чтобы использовать это приложение."
+    },
+    "error.jwt_clock_skew": {
+        "message": "Не удалось войти: часы этого устройства рассинхронизированы с сервером. Синхронизируйте системные часы и повторите попытку."
+    },
+    "error.jwt_expired": {
+        "message": "Срок действия токена входа истёк. Войдите снова."
+    },
+    "error.jwt_signature_invalid": {
+        "message": "Не удалось войти: недействительная подпись токена. Обратитесь к администратору."
+    },
+    "error.session_expired": {
+        "message": "Ваш сеанс истёк. Войдите снова."
+    },
+    "error.invalid_setup_key": {
+        "message": "Ключ установки отсутствует или недействителен."
+    },
+    "error.permission_denied": {
+        "message": "Сервер отклонил вход."
+    },
+    "error.daemon_unreachable": {
+        "message": "Демон NetBird не отвечает. Проверьте, запущена ли служба."
+    },
+    "error.unknown": {
+        "message": "Не удалось выполнить операцию."
+    }
+}
diff --git a/client/ui/i18n/locales/zh-CN/common.json b/client/ui/i18n/locales/zh-CN/common.json
new file mode 100644
index 000000000..609344fc0
--- /dev/null
+++ b/client/ui/i18n/locales/zh-CN/common.json
@@ -0,0 +1,1325 @@
+{
+    "tray.tooltip": {
+        "message": "NetBird"
+    },
+    "tray.status.disconnected": {
+        "message": "已断开连接"
+    },
+    "tray.status.daemonUnavailable": {
+        "message": "未运行"
+    },
+    "tray.status.error": {
+        "message": "错误"
+    },
+    "tray.status.connected": {
+        "message": "已连接"
+    },
+    "tray.status.connecting": {
+        "message": "正在连接"
+    },
+    "tray.status.needsLogin": {
+        "message": "需要登录"
+    },
+    "tray.status.loginFailed": {
+        "message": "登录失败"
+    },
+    "tray.status.sessionExpired": {
+        "message": "会话已过期"
+    },
+    "tray.session.expiresIn": {
+        "message": "会话将在 {remaining} 后过期"
+    },
+    "tray.session.unit.lessThanMinute": {
+        "message": "不到一分钟"
+    },
+    "tray.session.unit.minute": {
+        "message": "1 分钟"
+    },
+    "tray.session.unit.minutes": {
+        "message": "{count} 分钟"
+    },
+    "tray.session.unit.hour": {
+        "message": "1 小时"
+    },
+    "tray.session.unit.hours": {
+        "message": "{count} 小时"
+    },
+    "tray.session.unit.day": {
+        "message": "1 天"
+    },
+    "tray.session.unit.days": {
+        "message": "{count} 天"
+    },
+    "tray.menu.open": {
+        "message": "打开 NetBird"
+    },
+    "tray.menu.connect": {
+        "message": "连接"
+    },
+    "tray.menu.disconnect": {
+        "message": "断开连接"
+    },
+    "tray.menu.exitNode": {
+        "message": "出口节点"
+    },
+    "tray.menu.networks": {
+        "message": "资源"
+    },
+    "tray.menu.profiles": {
+        "message": "配置文件"
+    },
+    "tray.menu.manageProfiles": {
+        "message": "管理配置文件"
+    },
+    "tray.menu.settings": {
+        "message": "设置…"
+    },
+    "tray.menu.debugBundle": {
+        "message": "创建调试包"
+    },
+    "tray.menu.about": {
+        "message": "帮助与支持"
+    },
+    "tray.menu.github": {
+        "message": "GitHub"
+    },
+    "tray.menu.documentation": {
+        "message": "文档"
+    },
+    "tray.menu.troubleshoot": {
+        "message": "故障排除"
+    },
+    "tray.menu.downloadLatest": {
+        "message": "下载最新版本"
+    },
+    "tray.menu.installVersion": {
+        "message": "安装 {version} 版本"
+    },
+    "tray.menu.guiVersion": {
+        "message": "GUI：{version}"
+    },
+    "tray.menu.daemonVersion": {
+        "message": "守护进程：{version}"
+    },
+    "tray.menu.versionUnknown": {
+        "message": "—"
+    },
+    "tray.menu.quit": {
+        "message": "退出 NetBird"
+    },
+    "notify.daemonOutdated.title": {
+        "message": "NetBird 服务版本过旧"
+    },
+    "notify.daemonOutdated.body": {
+        "message": "请更新 NetBird 服务以使用此应用。"
+    },
+    "notify.update.title": {
+        "message": "NetBird 有可用更新"
+    },
+    "notify.update.body": {
+        "message": "NetBird {version} 已可用。"
+    },
+    "notify.update.enforcedSuffix": {
+        "message": " 您的管理员要求进行此次更新。"
+    },
+    "notify.error.title": {
+        "message": "错误"
+    },
+    "notify.error.connect": {
+        "message": "连接失败"
+    },
+    "notify.error.disconnect": {
+        "message": "断开连接失败"
+    },
+    "notify.error.switchProfile": {
+        "message": "切换到 {profile} 失败"
+    },
+    "notify.error.exitNode": {
+        "message": "更新出口节点 {name} 失败"
+    },
+    "notify.sessionExpired.title": {
+        "message": "NetBird 会话已过期"
+    },
+    "notify.sessionExpired.body": {
+        "message": "您的 NetBird 会话已过期。请重新登录。"
+    },
+    "notify.sessionWarning.title": {
+        "message": "会话即将过期"
+    },
+    "notify.sessionWarning.body": {
+        "message": "您的 NetBird 会话将在 {remaining} 后过期。点击“立即延长”以续期。"
+    },
+    "notify.sessionWarning.bodyGeneric": {
+        "message": "您的 NetBird 会话即将过期。点击“立即延长”以续期。"
+    },
+    "notify.sessionWarning.extend": {
+        "message": "立即延长"
+    },
+    "notify.sessionWarning.dismiss": {
+        "message": "忽略"
+    },
+    "notify.sessionWarning.failed": {
+        "message": "延长 NetBird 会话失败"
+    },
+    "notify.sessionWarning.successTitle": {
+        "message": "NetBird 会话已延长"
+    },
+    "notify.sessionWarning.successBody": {
+        "message": "您的会话已刷新。"
+    },
+    "notify.sessionDeadlineRejected.title": {
+        "message": "会话截止时间被拒绝"
+    },
+    "notify.sessionDeadlineRejected.body": {
+        "message": "服务器发送了无效的会话截止时间。请重新登录。"
+    },
+    "notify.mdm.policyApplied.title": {
+        "message": "NetBird 设置已更新"
+    },
+    "notify.mdm.policyApplied.body": {
+        "message": "您的 NetBird 配置已根据 IT 策略更新。"
+    },
+    "common.cancel": {
+        "message": "取消"
+    },
+    "common.save": {
+        "message": "保存"
+    },
+    "common.saveChanges": {
+        "message": "保存更改"
+    },
+    "common.saving": {
+        "message": "正在保存…"
+    },
+    "common.close": {
+        "message": "关闭"
+    },
+    "common.copy": {
+        "message": "复制"
+    },
+    "common.togglePasswordVisibility": {
+        "message": "切换密码可见性"
+    },
+    "common.increase": {
+        "message": "增加"
+    },
+    "common.decrease": {
+        "message": "减少"
+    },
+    "common.delete": {
+        "message": "删除"
+    },
+    "common.create": {
+        "message": "创建"
+    },
+    "common.add": {
+        "message": "添加"
+    },
+    "common.remove": {
+        "message": "移除"
+    },
+    "common.refresh": {
+        "message": "刷新"
+    },
+    "common.loading": {
+        "message": "正在加载…"
+    },
+    "common.netbird": {
+        "message": "NetBird"
+    },
+    "common.noResults.title": {
+        "message": "未找到任何结果"
+    },
+    "common.noResults.description": {
+        "message": "我们未能找到任何结果。请尝试其他搜索词或更改筛选条件。"
+    },
+    "notConnected.title": {
+        "message": "已断开连接"
+    },
+    "notConnected.description": {
+        "message": "请先连接到 NetBird，以查看有关对等节点、网络资源和出口节点的详细信息。"
+    },
+    "connect.status.disconnected": {
+        "message": "已断开连接"
+    },
+    "connect.status.connecting": {
+        "message": "正在连接…"
+    },
+    "connect.status.connected": {
+        "message": "已连接"
+    },
+    "connect.status.disconnecting": {
+        "message": "正在断开连接…"
+    },
+    "connect.status.daemonUnavailable": {
+        "message": "守护进程不可用"
+    },
+    "connect.status.loginRequired": {
+        "message": "需要登录"
+    },
+    "connect.error.loginTitle": {
+        "message": "登录失败"
+    },
+    "connect.error.connectTitle": {
+        "message": "连接失败"
+    },
+    "connect.error.disconnectTitle": {
+        "message": "断开连接失败"
+    },
+    "nav.peers.title": {
+        "message": "对等节点"
+    },
+    "nav.peers.description": {
+        "message": "{total} 个中已连接 {connected} 个"
+    },
+    "nav.resources.title": {
+        "message": "资源"
+    },
+    "nav.resources.description": {
+        "message": "{total} 个中已激活 {active} 个"
+    },
+    "nav.exitNode.title": {
+        "message": "出口节点"
+    },
+    "nav.exitNode.none": {
+        "message": "未激活"
+    },
+    "nav.exitNode.using": {
+        "message": "经由 {name}"
+    },
+    "header.openSettings": {
+        "message": "打开设置"
+    },
+    "header.togglePanel": {
+        "message": "切换侧边栏"
+    },
+    "profile.selector.loading": {
+        "message": "正在加载…"
+    },
+    "profile.selector.noProfile": {
+        "message": "无配置文件"
+    },
+    "profile.selector.searchPlaceholder": {
+        "message": "按名称搜索配置文件…"
+    },
+    "profile.selector.emptyTitle": {
+        "message": "未找到配置文件"
+    },
+    "profile.selector.emptyDescription": {
+        "message": "请尝试其他搜索词或创建新的配置文件。"
+    },
+    "profile.selector.newProfile": {
+        "message": "新建配置文件"
+    },
+    "profile.selector.moreOptions": {
+        "message": "更多选项"
+    },
+    "profile.selector.deregister": {
+        "message": "注销"
+    },
+    "profile.selector.delete": {
+        "message": "删除"
+    },
+    "profile.selector.switchTo": {
+        "message": "切换到此配置文件"
+    },
+    "profile.selector.edit": {
+        "message": "编辑"
+    },
+    "profile.edit.title": {
+        "message": "编辑配置文件"
+    },
+    "profile.edit.submit": {
+        "message": "保存更改"
+    },
+    "profile.dialog.title": {
+        "message": "输入配置文件名称"
+    },
+    "profile.dialog.nameLabel": {
+        "message": "配置文件名称"
+    },
+    "profile.dialog.description": {
+        "message": "为您的配置文件设置一个易于识别的名称。"
+    },
+    "profile.dialog.placeholder": {
+        "message": "例如：工作"
+    },
+    "profile.dialog.submit": {
+        "message": "添加配置文件"
+    },
+    "profile.dialog.required": {
+        "message": "请输入配置文件名称，例如：工作、家庭"
+    },
+    "profile.dialog.managementHelp": {
+        "message": "使用 NetBird Cloud 或您自己的服务器。"
+    },
+    "profile.dialog.urlUnreachable": {
+        "message": "无法连接到此服务器。请检查 URL，如果确认无误，也可以照常添加该配置文件。"
+    },
+    "header.menu.settings": {
+        "message": "设置…"
+    },
+    "header.menu.defaultView": {
+        "message": "默认视图"
+    },
+    "header.menu.advancedView": {
+        "message": "高级视图"
+    },
+    "header.menu.updateAvailable": {
+        "message": "有可用更新"
+    },
+    "header.menu.open": {
+        "message": "打开菜单"
+    },
+    "header.profile.switch": {
+        "message": "切换配置文件"
+    },
+    "connect.toggle.label": {
+        "message": "切换 NetBird 连接"
+    },
+    "connect.localIp.label": {
+        "message": "本地 IP 地址"
+    },
+    "common.search": {
+        "message": "搜索"
+    },
+    "common.filter": {
+        "message": "筛选"
+    },
+    "exitNodes.dropdown.trigger": {
+        "message": "选择出口节点"
+    },
+    "peers.row.label": {
+        "message": "打开 {name} 的详情，{status}"
+    },
+    "peers.dialog.title": {
+        "message": "对等节点详情"
+    },
+    "networks.row.toggle": {
+        "message": "切换 {name}"
+    },
+    "networks.bulk.label": {
+        "message": "切换所有可见资源"
+    },
+    "settings.nav.label": {
+        "message": "设置部分"
+    },
+    "profile.switch.title": {
+        "message": "切换到配置文件“{name}”？"
+    },
+    "profile.switch.message": {
+        "message": "您确定要切换配置文件吗？\n您当前的配置文件将被断开连接。"
+    },
+    "profile.switch.confirm": {
+        "message": "确认"
+    },
+    "profile.deregister.title": {
+        "message": "注销配置文件“{name}”？"
+    },
+    "profile.deregister.message": {
+        "message": "您确定要注销此配置文件吗？\n您将需要重新登录才能使用它。"
+    },
+    "profile.deregister.confirm": {
+        "message": "注销"
+    },
+    "profile.delete.title": {
+        "message": "删除配置文件“{name}”？"
+    },
+    "profile.delete.message": {
+        "message": "您确定要删除此配置文件吗？\n此操作无法撤销。"
+    },
+    "profile.delete.disabledActive": {
+        "message": "无法删除处于活动状态的配置文件。请先切换到其他配置文件，再删除此配置文件。"
+    },
+    "profile.delete.disabledDefault": {
+        "message": "无法删除默认配置文件。"
+    },
+    "profile.error.switchTitle": {
+        "message": "切换配置文件失败"
+    },
+    "profile.error.deregisterTitle": {
+        "message": "注销配置文件失败"
+    },
+    "profile.error.deleteTitle": {
+        "message": "删除配置文件失败"
+    },
+    "profile.error.createTitle": {
+        "message": "创建配置文件失败"
+    },
+    "profile.error.editTitle": {
+        "message": "编辑配置文件失败"
+    },
+    "profile.error.loadTitle": {
+        "message": "加载配置文件失败"
+    },
+    "profile.dropdown.activeProfile": {
+        "message": "当前配置文件"
+    },
+    "profile.dropdown.switchProfile": {
+        "message": "切换配置文件"
+    },
+    "profile.dropdown.noEmail": {
+        "message": "其他"
+    },
+    "profile.dropdown.addProfile": {
+        "message": "添加配置文件"
+    },
+    "profile.dropdown.manageProfiles": {
+        "message": "管理配置文件"
+    },
+    "profile.dropdown.settings": {
+        "message": "设置"
+    },
+    "settings.profiles.section.profiles": {
+        "message": "配置文件"
+    },
+    "settings.profiles.intro": {
+        "message": "并行保留多个独立的 NetBird 身份，例如工作和个人账户，或不同的管理服务器。可在下方添加、注销或删除配置文件。"
+    },
+    "settings.profiles.addProfile": {
+        "message": "添加配置文件"
+    },
+    "settings.profiles.active": {
+        "message": "活动"
+    },
+    "settings.profiles.emptyTitle": {
+        "message": "无配置文件"
+    },
+    "settings.profiles.emptyDescription": {
+        "message": "创建一个配置文件以连接到 NetBird 管理服务器。"
+    },
+    "settings.error.loadTitle": {
+        "message": "加载设置失败"
+    },
+    "settings.error.saveTitle": {
+        "message": "保存设置失败"
+    },
+    "settings.error.debugBundleTitle": {
+        "message": "创建调试包失败"
+    },
+    "settings.tabs.general": {
+        "message": "常规"
+    },
+    "settings.tabs.network": {
+        "message": "网络"
+    },
+    "settings.tabs.security": {
+        "message": "安全"
+    },
+    "settings.tabs.profiles": {
+        "message": "配置文件"
+    },
+    "settings.tabs.ssh": {
+        "message": "SSH"
+    },
+    "settings.tabs.advanced": {
+        "message": "高级"
+    },
+    "settings.tabs.troubleshooting": {
+        "message": "故障排除"
+    },
+    "settings.tabs.about": {
+        "message": "关于"
+    },
+    "settings.tabs.updateAvailable": {
+        "message": "有可用更新"
+    },
+    "settings.general.section.general": {
+        "message": "常规"
+    },
+    "settings.general.section.connection": {
+        "message": "连接"
+    },
+    "settings.general.connectOnStartup.label": {
+        "message": "启动时连接"
+    },
+    "settings.general.connectOnStartup.help": {
+        "message": "在服务启动时自动建立连接。"
+    },
+    "settings.general.notifications.label": {
+        "message": "桌面通知"
+    },
+    "settings.general.notifications.help": {
+        "message": "显示有关新更新和连接事件的桌面通知。"
+    },
+    "settings.general.autostart.label": {
+        "message": "登录时启动 NetBird 界面"
+    },
+    "settings.general.autostart.help": {
+        "message": "在您登录时自动启动 NetBird 界面。此设置仅影响图形界面，不影响后台服务。"
+    },
+    "settings.general.autostart.errorTitle": {
+        "message": "更改自启动设置失败"
+    },
+    "settings.general.language.label": {
+        "message": "显示语言"
+    },
+    "settings.general.language.help": {
+        "message": "选择 NetBird 界面的语言。"
+    },
+    "settings.general.language.search": {
+        "message": "搜索语言…"
+    },
+    "settings.general.language.empty": {
+        "message": "没有匹配的语言。"
+    },
+    "settings.general.management.label": {
+        "message": "管理服务器"
+    },
+    "settings.general.management.help": {
+        "message": "连接到 NetBird Cloud 或您自己的自托管管理服务器。更改将使客户端重新连接。"
+    },
+    "settings.general.management.cloud": {
+        "message": "Cloud"
+    },
+    "settings.general.management.selfHosted": {
+        "message": "自托管"
+    },
+    "settings.general.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlError": {
+        "message": "请输入有效的 URL，例如：https://netbird.selfhosted.com:443"
+    },
+    "settings.general.management.urlUnreachable": {
+        "message": "无法连接到此服务器。请检查 URL，如果确认无误，也可以照常保存。"
+    },
+    "settings.general.management.switchCloudTitle": {
+        "message": "切换到 NetBird Cloud？"
+    },
+    "settings.general.management.switchCloudMessage": {
+        "message": "这将断开您的自托管服务器。\n您可能需要重新登录。"
+    },
+    "settings.general.management.switchCloudConfirm": {
+        "message": "切换到 Cloud"
+    },
+    "settings.network.section.connectivity": {
+        "message": "连接性"
+    },
+    "settings.network.section.routingDns": {
+        "message": "路由与 DNS"
+    },
+    "settings.network.monitor.label": {
+        "message": "网络变化时重新连接"
+    },
+    "settings.network.monitor.help": {
+        "message": "监测网络，并在发生变化时自动重新连接，例如切换 Wi-Fi、以太网变化或从睡眠中恢复。"
+    },
+    "settings.network.dns.label": {
+        "message": "启用 DNS"
+    },
+    "settings.network.dns.help": {
+        "message": "将 NetBird 管理的 DNS 设置应用到主机解析器。"
+    },
+    "settings.network.clientRoutes.label": {
+        "message": "启用客户端路由"
+    },
+    "settings.network.clientRoutes.help": {
+        "message": "接受来自其他对等节点的路由，以访问它们的网络。"
+    },
+    "settings.network.serverRoutes.label": {
+        "message": "启用服务器路由"
+    },
+    "settings.network.serverRoutes.help": {
+        "message": "向其他对等节点通告此主机的本地路由。"
+    },
+    "settings.network.ipv6.label": {
+        "message": "启用 IPv6"
+    },
+    "settings.network.ipv6.help": {
+        "message": "为 NetBird 叠加网络使用 IPv6 寻址。"
+    },
+    "settings.security.section.firewall": {
+        "message": "防火墙"
+    },
+    "settings.security.section.encryption": {
+        "message": "加密"
+    },
+    "settings.security.blockInbound.label": {
+        "message": "阻止入站流量"
+    },
+    "settings.security.blockInbound.help": {
+        "message": "拒绝对等节点向本设备及其路由的任何网络发起的未经请求的连接。出站流量不受影响。"
+    },
+    "settings.security.blockLan.label": {
+        "message": "阻止 LAN 访问"
+    },
+    "settings.security.blockLan.help": {
+        "message": "当本设备为对等节点路由流量时，阻止它们访问您的本地网络或其设备。"
+    },
+    "settings.security.rosenpass.label": {
+        "message": "启用抗量子加密"
+    },
+    "settings.security.rosenpass.help": {
+        "message": "在 WireGuard® 之上通过 Rosenpass 添加后量子密钥交换。"
+    },
+    "settings.security.rosenpassPermissive.label": {
+        "message": "启用宽松模式"
+    },
+    "settings.security.rosenpassPermissive.help": {
+        "message": "允许连接到不支持抗量子加密的对等节点。"
+    },
+    "settings.ssh.section.server": {
+        "message": "服务器"
+    },
+    "settings.ssh.section.capabilities": {
+        "message": "功能"
+    },
+    "settings.ssh.section.authentication": {
+        "message": "身份验证"
+    },
+    "settings.ssh.server.label": {
+        "message": "启用 SSH 服务器"
+    },
+    "settings.ssh.server.help": {
+        "message": "在此主机上运行 NetBird SSH 服务器，以便其他对等节点可以连接到它。"
+    },
+    "settings.ssh.root.label": {
+        "message": "允许 root 登录"
+    },
+    "settings.ssh.root.help": {
+        "message": "允许对等节点以 root 用户身份登录。禁用后将要求使用非特权账户。"
+    },
+    "settings.ssh.sftp.label": {
+        "message": "允许 SFTP"
+    },
+    "settings.ssh.sftp.help": {
+        "message": "使用原生 SFTP 或 SCP 客户端安全地传输文件。"
+    },
+    "settings.ssh.localForward.label": {
+        "message": "本地端口转发"
+    },
+    "settings.ssh.localForward.help": {
+        "message": "允许连接的对等节点将本地端口隧道转发到此主机可访问的服务。"
+    },
+    "settings.ssh.remoteForward.label": {
+        "message": "远程端口转发"
+    },
+    "settings.ssh.remoteForward.help": {
+        "message": "允许连接的对等节点将此主机上的端口反向暴露到它们自己的机器。"
+    },
+    "settings.ssh.jwt.label": {
+        "message": "启用 JWT 身份验证"
+    },
+    "settings.ssh.jwt.help": {
+        "message": "针对您的 IdP 验证每个 SSH 会话，以确认用户身份并进行审计。禁用后将仅依赖网络 ACL 策略，在没有可用 IdP 时很有用。"
+    },
+    "settings.ssh.jwtTtl.label": {
+        "message": "JWT 缓存 TTL"
+    },
+    "settings.ssh.jwtTtl.help": {
+        "message": "在出站 SSH 连接再次提示前，此客户端缓存 JWT 的时长。设为 0 可禁用缓存，每次连接都进行身份验证。"
+    },
+    "settings.ssh.jwtTtl.suffix": {
+        "message": "秒"
+    },
+    "settings.advanced.section.interface": {
+        "message": "接口"
+    },
+    "settings.advanced.section.security": {
+        "message": "安全"
+    },
+    "settings.advanced.interfaceName.label": {
+        "message": "名称"
+    },
+    "settings.advanced.interfaceName.error": {
+        "message": "请使用 1-15 个字母、数字、点、连字符或下划线。"
+    },
+    "settings.advanced.interfaceName.errorMac": {
+        "message": "必须以“utun”开头，后跟一个数字（例如 utun100）。"
+    },
+    "settings.advanced.port.label": {
+        "message": "端口"
+    },
+    "settings.advanced.port.error": {
+        "message": "请输入介于 {min} 和 {max} 之间的端口。"
+    },
+    "settings.advanced.port.help": {
+        "message": "如果设为 0，将使用一个随机的空闲端口。"
+    },
+    "settings.advanced.mtu.label": {
+        "message": "MTU"
+    },
+    "settings.advanced.mtu.error": {
+        "message": "请输入介于 {min} 和 {max} 之间的 MTU 值。"
+    },
+    "settings.advanced.psk.label": {
+        "message": "预共享密钥"
+    },
+    "settings.advanced.psk.help": {
+        "message": "可选的 WireGuard PSK，用于额外的对称加密。它与 NetBird 设置密钥不同。您将只能与使用相同预共享密钥的对等节点通信。"
+    },
+    "settings.troubleshooting.section.title": {
+        "message": "调试包"
+    },
+    "settings.troubleshooting.anonymize.label": {
+        "message": "匿名化敏感信息"
+    },
+    "settings.troubleshooting.anonymize.help": {
+        "message": "从日志中隐藏公共 IP 地址和非 NetBird 域名。"
+    },
+    "settings.troubleshooting.systemInfo.label": {
+        "message": "包含系统信息"
+    },
+    "settings.troubleshooting.systemInfo.help": {
+        "message": "包含操作系统、内核、网络接口和路由表。"
+    },
+    "settings.troubleshooting.upload.label": {
+        "message": "将调试包上传到 NetBird 服务器"
+    },
+    "settings.troubleshooting.upload.help": {
+        "message": "返回一个上传密钥，供您分享给 NetBird 支持团队。"
+    },
+    "settings.troubleshooting.trace.label": {
+        "message": "启用跟踪日志"
+    },
+    "settings.troubleshooting.trace.help": {
+        "message": "将日志级别提升到 TRACE，之后再恢复原级别。"
+    },
+    "settings.troubleshooting.capture.label": {
+        "message": "捕获会话"
+    },
+    "settings.troubleshooting.capture.help": {
+        "message": "重新连接并等待，以便您复现问题。"
+    },
+    "settings.troubleshooting.packets.label": {
+        "message": "捕获网络数据包"
+    },
+    "settings.troubleshooting.packets.help": {
+        "message": "在捕获期间将网络流量保存为 .pcap 文件。"
+    },
+    "settings.troubleshooting.duration.label": {
+        "message": "捕获时长"
+    },
+    "settings.troubleshooting.duration.help": {
+        "message": "捕获会话运行的时长。"
+    },
+    "settings.troubleshooting.duration.suffix": {
+        "message": "分钟"
+    },
+    "settings.troubleshooting.create": {
+        "message": "创建调试包"
+    },
+    "settings.troubleshooting.progress.description": {
+        "message": "正在收集日志、系统详情和连接状态。这通常只需片刻——请保持此窗口打开，直到完成。"
+    },
+    "settings.troubleshooting.cancelling": {
+        "message": "正在取消…"
+    },
+    "settings.troubleshooting.done.uploadedTitle": {
+        "message": "调试包已成功上传！"
+    },
+    "settings.troubleshooting.done.savedTitle": {
+        "message": "调试包已保存"
+    },
+    "settings.troubleshooting.done.uploadedDescription": {
+        "message": "请将下方的上传密钥分享给 <docs>NetBird 支持团队</docs>。本地也已保存了一份副本。"
+    },
+    "settings.troubleshooting.done.savedDescription": {
+        "message": "您的调试包已保存在本地。"
+    },
+    "settings.troubleshooting.done.copyKey": {
+        "message": "复制密钥"
+    },
+    "settings.troubleshooting.done.openFolder": {
+        "message": "打开文件夹"
+    },
+    "settings.troubleshooting.done.openFileLocation": {
+        "message": "打开文件位置"
+    },
+    "settings.troubleshooting.uploadFailedWithReason": {
+        "message": "上传失败：{reason} 调试包仍已保存在本地。"
+    },
+    "settings.troubleshooting.uploadFailed": {
+        "message": "上传失败。调试包仍已保存在本地。"
+    },
+    "settings.troubleshooting.stage.reconnecting": {
+        "message": "正在重新连接 NetBird…"
+    },
+    "settings.troubleshooting.stage.capturing": {
+        "message": "正在捕获调试日志"
+    },
+    "settings.troubleshooting.stage.bundling": {
+        "message": "正在生成调试包…"
+    },
+    "settings.troubleshooting.stage.uploading": {
+        "message": "正在上传到 NetBird…"
+    },
+    "settings.troubleshooting.stage.cancelling": {
+        "message": "正在取消…"
+    },
+    "settings.about.client": {
+        "message": "NetBird 客户端 v{version}"
+    },
+    "settings.about.clientName": {
+        "message": "NetBird 客户端"
+    },
+    "settings.about.development": {
+        "message": "[开发版]"
+    },
+    "settings.about.gui": {
+        "message": "GUI v{version}"
+    },
+    "settings.about.guiName": {
+        "message": "GUI"
+    },
+    "settings.about.copyright": {
+        "message": "© {year} NetBird。保留所有权利。"
+    },
+    "settings.about.links.imprint": {
+        "message": "法律声明"
+    },
+    "settings.about.links.privacy": {
+        "message": "隐私"
+    },
+    "settings.about.links.cla": {
+        "message": "CLA"
+    },
+    "settings.about.links.terms": {
+        "message": "服务条款"
+    },
+    "settings.about.community.github": {
+        "message": "GitHub"
+    },
+    "settings.about.community.slack": {
+        "message": "Slack"
+    },
+    "settings.about.community.forum": {
+        "message": "论坛"
+    },
+    "settings.about.community.documentation": {
+        "message": "文档"
+    },
+    "settings.about.community.feedback": {
+        "message": "反馈"
+    },
+    "update.banner.message": {
+        "message": "NetBird {version} 已准备好安装。"
+    },
+    "update.banner.later": {
+        "message": "稍后"
+    },
+    "update.banner.installNow": {
+        "message": "立即安装"
+    },
+    "update.card.versionAvailableDownload": {
+        "message": "{version} 版本可供下载。"
+    },
+    "update.card.versionAvailableInstall": {
+        "message": "{version} 版本可供安装。"
+    },
+    "update.card.whatsNew": {
+        "message": "更新内容？"
+    },
+    "update.card.installNow": {
+        "message": "立即安装"
+    },
+    "update.card.getInstaller": {
+        "message": "下载"
+    },
+    "update.card.autoCheckInterval": {
+        "message": "NetBird 会在后台检查更新。"
+    },
+    "update.card.changelog": {
+        "message": "更新日志"
+    },
+    "update.card.onLatestVersion": {
+        "message": "您已是最新版本"
+    },
+    "update.header.tooltip": {
+        "message": "有可用更新"
+    },
+    "update.overlay.updatingVersion": {
+        "message": "正在将 NetBird 更新到 v{version}"
+    },
+    "update.overlay.updating": {
+        "message": "正在更新 NetBird"
+    },
+    "update.overlay.description": {
+        "message": "有更新的版本可用，正在安装。更新完成后，NetBird 将自动重启。"
+    },
+    "update.overlay.error.timeoutTitle": {
+        "message": "更新耗时过长"
+    },
+    "update.overlay.error.timeoutDescription": {
+        "message": "安装 {target} 耗时过长，未能完成。"
+    },
+    "update.overlay.error.canceledTitle": {
+        "message": "更新已停止"
+    },
+    "update.overlay.error.canceledDescription": {
+        "message": "对 {target} 的更新在完成前已被取消。"
+    },
+    "update.overlay.error.failTitle": {
+        "message": "无法安装更新"
+    },
+    "update.overlay.error.failDescription": {
+        "message": "无法安装 {target}。"
+    },
+    "update.overlay.error.unknownMessage": {
+        "message": "未知错误"
+    },
+    "update.overlay.error.targetVersion": {
+        "message": "v{version}"
+    },
+    "update.overlay.error.targetFallback": {
+        "message": "新版本"
+    },
+    "update.error.loadStateTitle": {
+        "message": "加载更新状态失败"
+    },
+    "update.error.triggerTitle": {
+        "message": "启动更新失败"
+    },
+    "update.page.versionLine": {
+        "message": "正在将客户端更新到：{version}。"
+    },
+    "update.page.versionLineGeneric": {
+        "message": "正在更新客户端。"
+    },
+    "update.page.outdated": {
+        "message": "您的客户端版本早于管理服务器中设置的自动更新版本。"
+    },
+    "update.page.status.running": {
+        "message": "正在更新"
+    },
+    "update.page.status.timeout": {
+        "message": "更新超时。请重试。"
+    },
+    "update.page.status.canceled": {
+        "message": "更新已取消。"
+    },
+    "update.page.status.failed": {
+        "message": "更新失败：{message}"
+    },
+    "update.page.status.unknownError": {
+        "message": "未知的更新错误"
+    },
+    "update.page.failedTitle": {
+        "message": "更新失败"
+    },
+    "update.page.timeoutMessage": {
+        "message": "更新超时。"
+    },
+    "update.page.dontClose": {
+        "message": "请勿关闭此窗口。"
+    },
+    "update.page.updating": {
+        "message": "正在更新…"
+    },
+    "update.page.complete": {
+        "message": "更新完成"
+    },
+    "update.page.failed": {
+        "message": "更新失败"
+    },
+    "window.title.settings": {
+        "message": "设置"
+    },
+    "window.title.signIn": {
+        "message": "登录"
+    },
+    "window.title.sessionExpiration": {
+        "message": "会话即将过期"
+    },
+    "window.title.updating": {
+        "message": "正在更新"
+    },
+    "window.title.welcome": {
+        "message": "欢迎使用 NetBird"
+    },
+    "window.title.error": {
+        "message": "错误"
+    },
+    "welcome.title": {
+        "message": "在托盘中查找 NetBird"
+    },
+    "welcome.description": {
+        "message": "NetBird 驻留在您的托盘中。点击图标即可连接、切换配置文件或打开设置。"
+    },
+    "welcome.continue": {
+        "message": "继续"
+    },
+    "welcome.back": {
+        "message": "返回"
+    },
+    "welcome.management.title": {
+        "message": "设置 NetBird"
+    },
+    "welcome.management.description": {
+        "message": "点击“继续”即可开始；如果您有自己的 NetBird 服务器，请选择“自托管”。"
+    },
+    "welcome.management.cloud.title": {
+        "message": "NetBird Cloud"
+    },
+    "welcome.management.cloud.description": {
+        "message": "使用我们的托管服务。无需任何设置。"
+    },
+    "welcome.management.selfHosted.title": {
+        "message": "自托管"
+    },
+    "welcome.management.selfHosted.description": {
+        "message": "连接到您自己的管理服务器。"
+    },
+    "welcome.management.urlLabel": {
+        "message": "管理服务器 URL"
+    },
+    "welcome.management.urlPlaceholder": {
+        "message": "https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlInvalid": {
+        "message": "请输入有效的 URL，例如：https://netbird.selfhosted.com:443"
+    },
+    "welcome.management.urlUnreachable": {
+        "message": "无法连接到此服务器。请检查 URL 或您的网络，如果确认无误，再继续。"
+    },
+    "welcome.management.checking": {
+        "message": "正在检查…"
+    },
+    "browserLogin.title": {
+        "message": "请在浏览器中继续以完成登录"
+    },
+    "browserLogin.notSeeing": {
+        "message": "没看到浏览器标签页？"
+    },
+    "browserLogin.tryAgain": {
+        "message": "重试"
+    },
+    "browserLogin.openFailedTitle": {
+        "message": "打开浏览器失败"
+    },
+    "sessionExpiration.title": {
+        "message": "会话即将过期"
+    },
+    "sessionExpiration.titleLater": {
+        "message": "您的会话即将过期"
+    },
+    "sessionExpiration.description": {
+        "message": "此设备即将断开连接。通过浏览器登录进行续期。"
+    },
+    "sessionExpiration.descriptionLater": {
+        "message": "通过浏览器登录可让此设备保持连接到您的网络。"
+    },
+    "sessionExpiration.stay": {
+        "message": "续期会话"
+    },
+    "sessionExpiration.authenticate": {
+        "message": "进行身份验证"
+    },
+    "sessionExpiration.logout": {
+        "message": "退出登录"
+    },
+    "sessionExpiration.expired": {
+        "message": "会话已过期"
+    },
+    "sessionExpiration.expiredDescription": {
+        "message": "设备已断开连接。通过浏览器登录进行身份验证以重新连接。"
+    },
+    "sessionExpiration.close": {
+        "message": "关闭"
+    },
+    "sessionExpiration.extendFailedTitle": {
+        "message": "延长会话失败"
+    },
+    "sessionExpiration.logoutFailedTitle": {
+        "message": "退出登录失败"
+    },
+    "peers.search.placeholder": {
+        "message": "按名称或 IP 搜索"
+    },
+    "peers.filter.all": {
+        "message": "全部"
+    },
+    "peers.filter.online": {
+        "message": "在线"
+    },
+    "peers.filter.offline": {
+        "message": "离线"
+    },
+    "peers.empty.title": {
+        "message": "无可用的对等节点"
+    },
+    "peers.empty.description": {
+        "message": "您可能没有任何可用的对等节点，或者无权访问其中任何一个。"
+    },
+    "peers.details.domain": {
+        "message": "域名"
+    },
+    "peers.details.netbirdIp": {
+        "message": "NetBird IP"
+    },
+    "peers.details.netbirdIpv6": {
+        "message": "NetBird IPv6"
+    },
+    "peers.details.publicKey": {
+        "message": "公钥"
+    },
+    "peers.details.connection": {
+        "message": "连接"
+    },
+    "peers.details.latency": {
+        "message": "延迟"
+    },
+    "peers.details.lastHandshake": {
+        "message": "上次握手"
+    },
+    "peers.details.statusSince": {
+        "message": "上次连接更新"
+    },
+    "peers.details.bytes": {
+        "message": "字节"
+    },
+    "peers.details.bytesSent": {
+        "message": "已发送"
+    },
+    "peers.details.bytesReceived": {
+        "message": "已接收"
+    },
+    "peers.details.localIce": {
+        "message": "本地 ICE"
+    },
+    "peers.details.remoteIce": {
+        "message": "远程 ICE"
+    },
+    "peers.details.never": {
+        "message": "从不"
+    },
+    "peers.details.justNow": {
+        "message": "刚刚"
+    },
+    "peers.details.refresh": {
+        "message": "刷新"
+    },
+    "peers.status.connected": {
+        "message": "已连接"
+    },
+    "peers.status.connecting": {
+        "message": "正在连接"
+    },
+    "peers.status.disconnected": {
+        "message": "已断开连接"
+    },
+    "peers.details.relayAddress": {
+        "message": "中继"
+    },
+    "peers.details.networks": {
+        "message": "资源"
+    },
+    "peers.details.relayed": {
+        "message": "经中继"
+    },
+    "peers.details.p2p": {
+        "message": "P2P"
+    },
+    "peers.details.rosenpass": {
+        "message": "已启用 Rosenpass"
+    },
+    "networks.search.placeholder": {
+        "message": "按网络或域名搜索"
+    },
+    "networks.filter.all": {
+        "message": "全部"
+    },
+    "networks.filter.active": {
+        "message": "活动"
+    },
+    "networks.filter.overlapping": {
+        "message": "重叠"
+    },
+    "networks.empty.title": {
+        "message": "无可用资源"
+    },
+    "networks.empty.description": {
+        "message": "您可能没有任何可用的网络资源，或者无权访问其中任何一个。"
+    },
+    "networks.selected": {
+        "message": "已选择"
+    },
+    "networks.unselected": {
+        "message": "未选择"
+    },
+    "networks.ips.heading": {
+        "message": "已解析的 IP"
+    },
+    "networks.bulk.selectionCount": {
+        "message": "{total} 个中已激活 {selected} 个"
+    },
+    "networks.bulk.enableAll": {
+        "message": "全部启用"
+    },
+    "networks.bulk.disableAll": {
+        "message": "全部禁用"
+    },
+    "exitNodes.search.placeholder": {
+        "message": "搜索出口节点"
+    },
+    "exitNodes.none": {
+        "message": "无"
+    },
+    "exitNodes.empty.title": {
+        "message": "无可用的出口节点"
+    },
+    "exitNodes.empty.description": {
+        "message": "尚未向此对等节点共享任何出口节点。"
+    },
+    "exitNodes.card.title": {
+        "message": "出口节点"
+    },
+    "exitNodes.card.statusActive": {
+        "message": "活动"
+    },
+    "exitNodes.card.statusInactive": {
+        "message": "非活动"
+    },
+    "exitNodes.dropdown.noneTitle": {
+        "message": "无"
+    },
+    "exitNodes.dropdown.noneDescription": {
+        "message": "不使用出口节点的直接连接"
+    },
+    "quickActions.connect": {
+        "message": "连接"
+    },
+    "quickActions.disconnect": {
+        "message": "断开连接"
+    },
+    "daemon.unavailable.title": {
+        "message": "NetBird 服务未运行"
+    },
+    "daemon.unavailable.description": {
+        "message": "服务运行后，应用将自动重新连接。"
+    },
+    "daemon.unavailable.docsLink": {
+        "message": "文档"
+    },
+    "daemon.outdated.title": {
+        "message": "NetBird 服务版本过旧"
+    },
+    "daemon.outdated.description": {
+        "message": "请更新 NetBird 服务以使用此应用。"
+    },
+    "error.jwt_clock_skew": {
+        "message": "登录失败：此设备的时钟与服务器不同步。请同步您的系统时钟后重试。"
+    },
+    "error.jwt_expired": {
+        "message": "您的登录令牌已过期。请重新登录。"
+    },
+    "error.jwt_signature_invalid": {
+        "message": "登录失败：令牌签名无效。请联系您的管理员。"
+    },
+    "error.session_expired": {
+        "message": "您的会话已过期。请重新登录。"
+    },
+    "error.invalid_setup_key": {
+        "message": "设置密钥缺失或无效。"
+    },
+    "error.permission_denied": {
+        "message": "登录被服务器拒绝。"
+    },
+    "error.daemon_unreachable": {
+        "message": "NetBird 守护进程无响应。请检查服务是否正在运行。"
+    },
+    "error.unknown": {
+        "message": "操作失败。"
+    }
+}
diff --git a/client/ui/icons.go b/client/ui/icons.go
index 874f24fdd..5ab19ca05 100644
--- a/client/ui/icons.go
+++ b/client/ui/icons.go
@@ -1,16 +1,10 @@
-//go:build !(linux && 386) && !windows
+//go:build !android && !ios && !freebsd && !js
 
 package main
 
-import (
-	_ "embed"
-)
+import _ "embed"
 
-//go:embed assets/netbird.png
-var iconAbout []byte
-
-//go:embed assets/netbird-disconnected.png
-var iconAboutDisconnected []byte
+// Windows reuses these PNGs: multi-frame .ico never redrew under Wails3's NIM_MODIFY, single-frame PNG does.
 
 //go:embed assets/netbird-systemtray-connected.png
 var iconConnected []byte
@@ -21,18 +15,6 @@ var iconConnectedDark []byte
 //go:embed assets/netbird-systemtray-disconnected.png
 var iconDisconnected []byte
 
-//go:embed assets/netbird-systemtray-update-disconnected.png
-var iconUpdateDisconnected []byte
-
-//go:embed assets/netbird-systemtray-update-disconnected-dark.png
-var iconUpdateDisconnectedDark []byte
-
-//go:embed assets/netbird-systemtray-update-connected.png
-var iconUpdateConnected []byte
-
-//go:embed assets/netbird-systemtray-update-connected-dark.png
-var iconUpdateConnectedDark []byte
-
 //go:embed assets/netbird-systemtray-connecting.png
 var iconConnecting []byte
 
@@ -44,3 +26,91 @@ var iconError []byte
 
 //go:embed assets/netbird-systemtray-error-dark.png
 var iconErrorDark []byte
+
+//go:embed assets/netbird-systemtray-needs-login.png
+var iconNeedsLogin []byte
+
+//go:embed assets/netbird-systemtray-update-connected.png
+var iconUpdateConnected []byte
+
+//go:embed assets/netbird-systemtray-update-connected-dark.png
+var iconUpdateConnectedDark []byte
+
+//go:embed assets/netbird-systemtray-update-disconnected.png
+var iconUpdateDisconnected []byte
+
+//go:embed assets/netbird-systemtray-update-disconnected-dark.png
+var iconUpdateDisconnectedDark []byte
+
+//go:embed assets/netbird-systemtray-connected-macos.png
+var iconConnectedMacOS []byte
+
+//go:embed assets/netbird-systemtray-disconnected-macos.png
+var iconDisconnectedMacOS []byte
+
+//go:embed assets/netbird-systemtray-connecting-macos.png
+var iconConnectingMacOS []byte
+
+//go:embed assets/netbird-systemtray-error-macos.png
+var iconErrorMacOS []byte
+
+//go:embed assets/netbird-systemtray-needs-login-macos.png
+var iconNeedsLoginMacOS []byte
+
+//go:embed assets/netbird-systemtray-update-connected-macos.png
+var iconUpdateConnectedMacOS []byte
+
+//go:embed assets/netbird-systemtray-update-disconnected-macos.png
+var iconUpdateDisconnectedMacOS []byte
+
+// SNI has no template recoloring, so ship an explicit pair: black (*-mono.png)
+// for light panels, white (*-mono-dark.png) for dark panels.
+
+//go:embed assets/netbird-systemtray-connected-mono.png
+var iconConnectedMono []byte
+
+//go:embed assets/netbird-systemtray-connected-mono-dark.png
+var iconConnectedMonoDark []byte
+
+//go:embed assets/netbird-systemtray-connecting-mono.png
+var iconConnectingMono []byte
+
+//go:embed assets/netbird-systemtray-connecting-mono-dark.png
+var iconConnectingMonoDark []byte
+
+//go:embed assets/netbird-systemtray-disconnected-mono.png
+var iconDisconnectedMono []byte
+
+//go:embed assets/netbird-systemtray-disconnected-mono-dark.png
+var iconDisconnectedMonoDark []byte
+
+//go:embed assets/netbird-systemtray-error-mono.png
+var iconErrorMono []byte
+
+//go:embed assets/netbird-systemtray-error-mono-dark.png
+var iconErrorMonoDark []byte
+
+//go:embed assets/netbird-systemtray-needs-login-mono.png
+var iconNeedsLoginMono []byte
+
+//go:embed assets/netbird-systemtray-needs-login-mono-dark.png
+var iconNeedsLoginMonoDark []byte
+
+//go:embed assets/netbird-systemtray-update-connected-mono.png
+var iconUpdateConnectedMono []byte
+
+//go:embed assets/netbird-systemtray-update-connected-mono-dark.png
+var iconUpdateConnectedMonoDark []byte
+
+//go:embed assets/netbird-systemtray-update-disconnected-mono.png
+var iconUpdateDisconnectedMono []byte
+
+//go:embed assets/netbird-systemtray-update-disconnected-mono-dark.png
+var iconUpdateDisconnectedMonoDark []byte
+
+//go:embed assets/netbird.png
+var iconWindow []byte
+
+// Per-platform menu-row icons live in icons_menu_{windows,other}.go. Windows
+// uses 16x16: they go into the Win32 check-mark slot (SM_CXMENUCHECK, ~16x16 at
+// 100% DPI) which crops anything bigger; macOS/Linux use 24x24.
diff --git a/client/ui/icons_menu_darwin.go b/client/ui/icons_menu_darwin.go
new file mode 100644
index 000000000..c077a6d2d
--- /dev/null
+++ b/client/ui/icons_menu_darwin.go
@@ -0,0 +1,23 @@
+//go:build darwin
+
+package main
+
+import _ "embed"
+
+// 22px matches the NSMenuItem row text weight (HIG's 18-22 range);
+// Windows uses 16px and Linux 24px — see the sibling icons_menu_*.go.
+
+//go:embed assets/netbird-menu-dot-connected-22.png
+var iconMenuDotConnected []byte
+
+//go:embed assets/netbird-menu-dot-connecting-22.png
+var iconMenuDotConnecting []byte
+
+//go:embed assets/netbird-menu-dot-error-22.png
+var iconMenuDotError []byte
+
+//go:embed assets/netbird-menu-dot-idle-22.png
+var iconMenuDotIdle []byte
+
+//go:embed assets/netbird-menu-dot-offline-22.png
+var iconMenuDotOffline []byte
diff --git a/client/ui/icons_menu_linux.go b/client/ui/icons_menu_linux.go
new file mode 100644
index 000000000..54e0c743a
--- /dev/null
+++ b/client/ui/icons_menu_linux.go
@@ -0,0 +1,22 @@
+//go:build linux
+
+package main
+
+import _ "embed"
+
+// 24x24: GTK4 menu rows render 22–48 px with no downscaling.
+
+//go:embed assets/netbird-menu-dot-connected.png
+var iconMenuDotConnected []byte
+
+//go:embed assets/netbird-menu-dot-connecting.png
+var iconMenuDotConnecting []byte
+
+//go:embed assets/netbird-menu-dot-error.png
+var iconMenuDotError []byte
+
+//go:embed assets/netbird-menu-dot-idle.png
+var iconMenuDotIdle []byte
+
+//go:embed assets/netbird-menu-dot-offline.png
+var iconMenuDotOffline []byte
diff --git a/client/ui/icons_menu_windows.go b/client/ui/icons_menu_windows.go
new file mode 100644
index 000000000..c08359902
--- /dev/null
+++ b/client/ui/icons_menu_windows.go
@@ -0,0 +1,24 @@
+//go:build windows
+
+package main
+
+import _ "embed"
+
+// SetMenuItemBitmaps sizes the HBITMAP to SM_CXMENUCHECK/SM_CYMENUCHECK (16x16
+// at 100% DPI); larger bitmaps overflow the row, hence this Windows-only set
+// downscaled from the 24x24 originals.
+
+//go:embed assets/netbird-menu-dot-connected-16.png
+var iconMenuDotConnected []byte
+
+//go:embed assets/netbird-menu-dot-connecting-16.png
+var iconMenuDotConnecting []byte
+
+//go:embed assets/netbird-menu-dot-error-16.png
+var iconMenuDotError []byte
+
+//go:embed assets/netbird-menu-dot-idle-16.png
+var iconMenuDotIdle []byte
+
+//go:embed assets/netbird-menu-dot-offline-16.png
+var iconMenuDotOffline []byte
diff --git a/client/ui/icons_windows.go b/client/ui/icons_windows.go
deleted file mode 100644
index bd57b2690..000000000
--- a/client/ui/icons_windows.go
+++ /dev/null
@@ -1,44 +0,0 @@
-package main
-
-import (
-	_ "embed"
-)
-
-//go:embed assets/netbird.ico
-var iconAbout []byte
-
-//go:embed assets/netbird-disconnected.ico
-var iconAboutDisconnected []byte
-
-//go:embed assets/netbird-systemtray-connected.ico
-var iconConnected []byte
-
-//go:embed assets/netbird-systemtray-connected-dark.ico
-var iconConnectedDark []byte
-
-//go:embed assets/netbird-systemtray-disconnected.ico
-var iconDisconnected []byte
-
-//go:embed assets/netbird-systemtray-update-disconnected.ico
-var iconUpdateDisconnected []byte
-
-//go:embed assets/netbird-systemtray-update-disconnected-dark.ico
-var iconUpdateDisconnectedDark []byte
-
-//go:embed assets/netbird-systemtray-update-connected.ico
-var iconUpdateConnected []byte
-
-//go:embed assets/netbird-systemtray-update-connected-dark.ico
-var iconUpdateConnectedDark []byte
-
-//go:embed assets/netbird-systemtray-connecting.ico
-var iconConnecting []byte
-
-//go:embed assets/netbird-systemtray-connecting-dark.ico
-var iconConnectingDark []byte
-
-//go:embed assets/netbird-systemtray-error.ico
-var iconError []byte
-
-//go:embed assets/netbird-systemtray-error-dark.ico
-var iconErrorDark []byte
diff --git a/client/ui/localizer.go b/client/ui/localizer.go
new file mode 100644
index 000000000..33c1cf205
--- /dev/null
+++ b/client/ui/localizer.go
@@ -0,0 +1,130 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"strings"
+	"sync"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/ui/i18n"
+	"github.com/netbirdio/netbird/client/ui/preferences"
+	"github.com/netbirdio/netbird/client/ui/services"
+)
+
+// Localizer caches the active language so key lookups skip the preferences store.
+//
+// Kept in the main package (not i18n/) because StatusLabel maps daemon
+// status enum strings to translations; moving it would invert the
+// dependency direction.
+type Localizer struct {
+	bundle *i18n.Bundle
+	store  *preferences.Store
+
+	mu   sync.RWMutex
+	lang i18n.LanguageCode
+
+	unsubscribe func()
+}
+
+// NewLocalizer seeds the active language from the on-disk preference. Either
+// argument may be nil (tests): T then returns the raw key and Watch is a no-op.
+func NewLocalizer(bundle *i18n.Bundle, store *preferences.Store) *Localizer {
+	l := &Localizer{
+		bundle: bundle,
+		store:  store,
+		lang:   i18n.DefaultLanguage,
+	}
+	if store != nil {
+		if p := store.Get(); p.Language != "" {
+			l.lang = p.Language
+		}
+	}
+	return l
+}
+
+// Language returns the active language code.
+func (l *Localizer) Language() i18n.LanguageCode {
+	l.mu.RLock()
+	defer l.mu.RUnlock()
+	return l.lang
+}
+
+// T resolves key in the current language; args are {placeholder}/value pairs.
+// With no bundle wired it returns key unchanged.
+func (l *Localizer) T(key string, args ...string) string {
+	if l == nil || l.bundle == nil {
+		return key
+	}
+	l.mu.RLock()
+	lang := l.lang
+	l.mu.RUnlock()
+	return l.bundle.Translate(lang, key, args...)
+}
+
+// Watch invokes cb on each language change, after the cached language is
+// updated so cb may call l.T with the new locale. Replaces any prior subscription.
+func (l *Localizer) Watch(cb func(lang i18n.LanguageCode)) {
+	if l.store == nil {
+		return
+	}
+	ch, unsubscribe := l.store.Subscribe()
+	l.mu.Lock()
+	if l.unsubscribe != nil {
+		l.unsubscribe()
+	}
+	l.unsubscribe = unsubscribe
+	l.mu.Unlock()
+
+	go func() {
+		for p := range ch {
+			if p.Language == "" {
+				continue
+			}
+			l.mu.Lock()
+			if l.lang == p.Language {
+				l.mu.Unlock()
+				continue
+			}
+			l.lang = p.Language
+			l.mu.Unlock()
+			log.Infof("localizer: language switched to %s", p.Language)
+			if cb != nil {
+				cb(p.Language)
+			}
+		}
+	}()
+}
+
+// Close cancels the preference subscription.
+func (l *Localizer) Close() {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	if l.unsubscribe != nil {
+		l.unsubscribe()
+		l.unsubscribe = nil
+	}
+}
+
+// StatusLabel maps a daemon status string to its tray label; unrecognised
+// statuses pass through verbatim.
+func (l *Localizer) StatusLabel(status string) string {
+	switch {
+	case status == "", strings.EqualFold(status, services.StatusIdle):
+		return l.T("tray.status.disconnected")
+	case strings.EqualFold(status, services.StatusDaemonUnavailable):
+		return l.T("tray.status.daemonUnavailable")
+	case strings.EqualFold(status, services.StatusConnected):
+		return l.T("tray.status.connected")
+	case strings.EqualFold(status, services.StatusConnecting):
+		return l.T("tray.status.connecting")
+	case strings.EqualFold(status, services.StatusNeedsLogin):
+		return l.T("tray.status.needsLogin")
+	case strings.EqualFold(status, services.StatusLoginFailed):
+		return l.T("tray.status.loginFailed")
+	case strings.EqualFold(status, services.StatusSessionExpired):
+		return l.T("tray.status.sessionExpired")
+	}
+	return status
+}
diff --git a/client/ui/main.go b/client/ui/main.go
new file mode 100644
index 000000000..e6b77762c
--- /dev/null
+++ b/client/ui/main.go
@@ -0,0 +1,387 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"context"
+	"embed"
+	"flag"
+	"io/fs"
+	"log"
+	"runtime"
+	"strings"
+
+	"github.com/sirupsen/logrus"
+	"github.com/wailsapp/wails/v3/pkg/application"
+	"github.com/wailsapp/wails/v3/pkg/events"
+	"github.com/wailsapp/wails/v3/pkg/services/notifications"
+
+	"github.com/netbirdio/netbird/client/ui/authsession"
+	"github.com/netbirdio/netbird/client/ui/i18n"
+	"github.com/netbirdio/netbird/client/ui/preferences"
+	"github.com/netbirdio/netbird/client/ui/services"
+	"github.com/netbirdio/netbird/client/ui/updater"
+	"github.com/netbirdio/netbird/util"
+)
+
+//go:embed all:frontend/dist
+var assets embed.FS
+
+// localesRoot embeds the i18n bundles shared by the tray (Go) and the React
+// UI (Vite imports the same files). The `all:` prefix is required so
+// _index.json is included — //go:embed drops files starting with "_" or "."
+// otherwise.
+//
+//go:embed all:i18n/locales
+var localesRoot embed.FS
+
+// stringList collects repeated string flags. The first user-supplied value
+// drops the seeded default; subsequent passes append.
+type stringList struct {
+	values  []string
+	userSet bool
+}
+
+func (s *stringList) String() string {
+	return strings.Join(s.values, ",")
+}
+
+func (s *stringList) Set(v string) error {
+	if !s.userSet {
+		s.values = nil
+		s.userSet = true
+	}
+	s.values = append(s.values, v)
+	return nil
+}
+
+type registeredServices struct {
+	connection      *services.Connection
+	authSession     *authsession.Session
+	settings        *services.Settings
+	networks        *services.Networks
+	profiles        *services.Profiles
+	update          *services.Update
+	daemonFeed      *services.DaemonFeed
+	notifier        *notifications.NotificationService
+	compat          *services.Compat
+	profileSwitcher *services.ProfileSwitcher
+	bundle          *i18n.Bundle
+	prefStore       *preferences.Store
+}
+
+func init() {
+	application.RegisterEvent[services.Status](services.EventStatusSnapshot)
+	application.RegisterEvent[services.SystemEvent](services.EventDaemonNotification)
+	application.RegisterEvent[services.ProfileRef](services.EventProfileChanged)
+	application.RegisterEvent[authsession.Warning](services.EventSessionWarning)
+	application.RegisterEvent[updater.State](updater.EventStateChanged)
+	application.RegisterEvent[preferences.UIPreferences](preferences.EventPreferencesChanged)
+}
+
+func main() {
+	daemonAddr, userSetLogFile := parseFlagsAndInitLog()
+	conn := NewConn(daemonAddr)
+
+	// Without --log-file, the GUI manages a gui-client.log that follows the
+	// daemon's debug level and is collected in the debug bundle. It rides
+	// DaemonFeed's SubscribeEvents stream (see guilog.DebugLog).
+	debugLog := newDebugLog(userSetLogFile)
+
+	// Declared before app.New so the SingleInstance callback closes over it.
+	var tray *Tray
+	app := newApplication(func() {
+		if tray != nil {
+			tray.ShowWindow()
+		}
+	})
+
+	settings := services.NewSettings(conn)
+	profiles := services.NewProfiles(conn)
+	// updater.Holder owns the typed update State; DaemonFeed feeds it and the
+	// Update service is a thin Wails-bound facade over it plus the install RPCs.
+	updaterHolder := updater.NewHolder(app.Event)
+	update := services.NewUpdate(conn, updaterHolder)
+	daemonFeed := services.NewDaemonFeed(conn, app.Event, updaterHolder, debugLog)
+	notifier := notifications.New()
+	compat := services.NewCompat(conn)
+	// macOS shows no toast until permission is requested. Run it after
+	// ApplicationStarted so the notifier's Startup has initialised the
+	// notification-center delegate. No-op on Linux/Windows (stubs report
+	// authorized).
+	app.Event.OnApplicationEvent(events.Common.ApplicationStarted, func(*application.ApplicationEvent) {
+		go requestNotificationAuthorization(notifier)
+		initDockObserver()
+	})
+
+	bundle, prefStore, localizer := buildI18n(app)
+
+	// After bundle + prefStore: both are used to localise daemon errors.
+	connection := services.NewConnection(conn, bundle, prefStore)
+	profileSwitcher := services.NewProfileSwitcher(profiles, connection, daemonFeed)
+	// authsession.Session owns the full extend + dismiss surface the tray
+	// drives directly; the Wails-bound services.Session wraps only the subset
+	// the React frontend calls, keeping the generated TS surface minimal.
+	authSession := authsession.NewSession(conn)
+	networks := services.NewNetworks(conn)
+
+	registerServices(app, conn, registeredServices{
+		connection:      connection,
+		authSession:     authSession,
+		settings:        settings,
+		networks:        networks,
+		profiles:        profiles,
+		update:          update,
+		daemonFeed:      daemonFeed,
+		notifier:        notifier,
+		compat:          compat,
+		profileSwitcher: profileSwitcher,
+		bundle:          bundle,
+		prefStore:       prefStore,
+	})
+
+	window := newMainWindow(app, prefStore)
+
+	// Settings is created eagerly (hidden) so the first gear click paints
+	// instantly and React keeps per-tab state across reopens. The other
+	// auxiliary windows stay lazy + destroy-on-close so Wails's macOS
+	// dock-reopen handler can't resurrect them.
+	windowManager := services.NewWindowManager(app, window, bundle, prefStore, iconWindow)
+	// Minimal WMs (XEmbed-tray path) neither center small windows nor restore
+	// position across hide -> show, dropping them top-left. Gate Go-side
+	// re-centering on that environment; nil leaves placement to the WM on full
+	// desktops, macOS, and Windows.
+	windowManager.SetRecenterOnShow(recenterOnShowPredicate())
+	app.RegisterService(application.NewService(windowManager))
+
+	// Welcome window, first launch only — Continue flips OnboardingCompleted
+	// so later launches skip it. ApplicationStarted hook so the Wails window
+	// machinery is fully up before the window is created.
+	if !prefStore.Get().OnboardingCompleted {
+		app.Event.OnApplicationEvent(events.Common.ApplicationStarted, func(*application.ApplicationEvent) {
+			windowManager.OpenWelcome()
+		})
+	}
+
+	// In-process StatusNotifierWatcher so the tray works on minimal WMs that
+	// don't ship one (Fluxbox, i3, GNOME without AppIndicator). No-op off
+	// Linux. Must run before NewTray so the systray's
+	// RegisterStatusNotifierItem hits a watcher we control.
+	startStatusNotifierWatcher()
+
+	tray = NewTray(app, window, TrayServices{
+		Connection:      connection,
+		Settings:        settings,
+		Profiles:        profiles,
+		Networks:        networks,
+		DaemonFeed:      daemonFeed,
+		Notifier:        notifier,
+		Update:          update,
+		ProfileSwitcher: profileSwitcher,
+		WindowManager:   windowManager,
+		Session:         authSession,
+		Localizer:       localizer,
+	})
+	listenForShowSignal(context.Background(), tray)
+
+	// Start the feed only after every service's ServiceStartup has run. The
+	// first SubscribeEvents message replays cached state synchronously and can
+	// fire an OS notification; if Watch ran before app.Run it could beat the
+	// notifier's ServiceStartup, where the Linux notifier connects the session
+	// bus — its *dbus.Conn would still be nil and SendNotification would
+	// nil-deref (fatal panic on the dispatch goroutine, observed on Linux
+	// Mint). ApplicationStarted fires after the startup loop, so the bus is up.
+	app.Event.OnApplicationEvent(events.Common.ApplicationStarted, func(*application.ApplicationEvent) {
+		daemonFeed.Watch(context.Background())
+		// Probe daemon compatibility once the notifier bus is up; an outdated
+		// daemon may keep the main window from showing, so the OS toast is the
+		// only reliable signal the user gets.
+		go notifyIfDaemonOutdated(compat, notifier, localizer)
+	})
+
+	if err := app.Run(); err != nil {
+		log.Fatal(err)
+	}
+}
+
+// requestNotificationAuthorization prompts for macOS notification permission.
+// The request blocks until the user responds (up to 3 minutes), so callers run
+// it in a goroutine. No-op on Linux/Windows.
+func requestNotificationAuthorization(notifier *notifications.NotificationService) {
+	authorized, err := notifier.CheckNotificationAuthorization()
+	if err != nil {
+		logrus.Debugf("check notification authorization: %v", err)
+		return
+	}
+	if authorized {
+		return
+	}
+	if _, err := notifier.RequestNotificationAuthorization(); err != nil {
+		logrus.Debugf("request notification authorization: %v", err)
+	}
+}
+
+// parseFlagsAndInitLog returns the daemon gRPC address and userSetLogFile
+// (true when --log-file was passed). userSetLogFile is the manual-override
+// signal: true leaves logging alone, false lets the GUI manage a
+// daemon-driven gui-client.log. The flag default is empty (not "console") so
+// "no flag" and an explicit "--log-file console" stay distinguishable; empty
+// falls back to console for InitLog.
+func parseFlagsAndInitLog() (string, bool) {
+	daemonAddr := flag.String("daemon-addr", DaemonAddr(), "Daemon gRPC address: unix:///path or tcp://host:port")
+	logFiles := &stringList{}
+	flag.Var(logFiles, "log-file", "Log destination. Repeat to log to multiple targets at once, e.g. `--log-file console --log-file Y:/netbird-ui.log`. Each value is one of: console, syslog, or a file path. File destinations are rotated by lumberjack (same as the daemon). Defaults to console. Passing any value disables the daemon-debug-driven gui-client.log.")
+	logLevel := flag.String("log-level", "info", "Log level: trace|debug|info|warn|error.")
+	flag.Parse()
+
+	userSetLogFile := len(logFiles.values) > 0
+	targets := logFiles.values
+	if !userSetLogFile {
+		targets = []string{"console"}
+	}
+
+	if err := util.InitLog(*logLevel, targets...); err != nil {
+		log.Fatalf("init log: %v", err)
+	}
+	return *daemonAddr, userSetLogFile
+}
+
+// newApplication constructs the Wails application. onSecondInstance fires when
+// a second process launches under the same SingleInstance UniqueID.
+func newApplication(onSecondInstance func()) *application.App {
+	// On macOS, Options.Icon feeds NSApplication's setApplicationIconImage,
+	// overriding the bundle icon (Assets.car / icons.icns) the OS already
+	// picked. Suppress it on darwin to keep the bundle's squircle.
+	appIcon := iconWindow
+	if runtime.GOOS == "darwin" {
+		appIcon = nil
+	}
+
+	return application.New(application.Options{
+		// On Windows, Name is the AppUserModelID for toast notifications and
+		// the HKCU\Software\Classes\AppUserModelId\ registry path. It must
+		// match the System.AppUserModel.ID the MSI sets on the Start Menu
+		// shortcut (client/netbird.wxs) and the AppUserModelId key the
+		// installer pre-populates with the toast activator CLSID; otherwise
+		// toasts show under a different identity and the MSI's CustomActivator
+		// value is orphaned.
+		Name:        "NetBird",
+		Description: "NetBird desktop client",
+		Icon:        appIcon,
+		Assets: application.AssetOptions{
+			Handler: application.AssetFileServerFS(assets),
+		},
+		Mac: application.MacOptions{
+			ApplicationShouldTerminateAfterLastWindowClosed: false,
+			ActivationPolicy: application.ActivationPolicyAccessory,
+		},
+		Linux: application.LinuxOptions{
+			ProgramName: "netbird",
+		},
+		SingleInstance: &application.SingleInstanceOptions{
+			UniqueID: "io.netbird.ui",
+			OnSecondInstanceLaunch: func(_ application.SecondInstanceData) {
+				onSecondInstance()
+			},
+		},
+	})
+}
+
+// buildI18n constructs the i18n bundle, preferences store, and tray localizer.
+// The Bundle satisfies preferences.LanguageValidator so SetLanguage rejects
+// codes that have no shipped translation.
+func buildI18n(app *application.App) (*i18n.Bundle, *preferences.Store, *Localizer) {
+	// Reroot the embedded tree at the locales dir so the bundle sees
+	// _index.json and <lang>/common.json at top level (//go:embed roots at
+	// the package, not the leaf dir).
+	localesFS, err := fs.Sub(localesRoot, "i18n/locales")
+	if err != nil {
+		log.Fatalf("locate locales fs: %v", err)
+	}
+	bundle, err := i18n.NewBundle(localesFS)
+	if err != nil {
+		log.Fatalf("init i18n bundle: %v", err)
+	}
+	prefStore, err := preferences.NewStore(bundle, app.Event)
+	if err != nil {
+		log.Fatalf("init preferences store: %v", err)
+	}
+	return bundle, prefStore, NewLocalizer(bundle, prefStore)
+}
+
+// registerServices binds every Wails-facing service onto the application.
+// Services with no other caller are constructed inline; the rest arrive
+// already built so the tray and feed loops share the same instances.
+func registerServices(app *application.App, conn *Conn, s registeredServices) {
+	app.RegisterService(application.NewService(s.connection))
+	app.RegisterService(application.NewService(services.NewSession(s.authSession, s.bundle, s.prefStore)))
+	app.RegisterService(application.NewService(s.settings))
+	app.RegisterService(application.NewService(s.networks))
+	app.RegisterService(application.NewService(services.NewForwarding(conn)))
+	app.RegisterService(application.NewService(s.profiles))
+	app.RegisterService(application.NewService(services.NewDebug(conn)))
+	app.RegisterService(application.NewService(s.update))
+	app.RegisterService(application.NewService(s.daemonFeed))
+	app.RegisterService(application.NewService(s.notifier))
+	app.RegisterService(application.NewService(s.profileSwitcher))
+	app.RegisterService(application.NewService(services.NewI18n(s.bundle)))
+	app.RegisterService(application.NewService(services.NewPreferences(s.prefStore)))
+	app.RegisterService(application.NewService(services.NewAutostart(app.Autostart)))
+	app.RegisterService(application.NewService(services.NewVersion()))
+	app.RegisterService(application.NewService(services.NewUILog()))
+	app.RegisterService(application.NewService(s.compat))
+}
+
+// newMainWindow creates the hidden main window, sized to the user's last view
+// mode, and installs the hide-on-close and macOS dock-reopen hooks.
+func newMainWindow(app *application.App, prefStore *preferences.Store) *application.WebviewWindow {
+	// Width matches the last view mode so Advanced-mode users don't see the
+	// window pop from 380px to 900px on launch. Height is mode-agnostic.
+	initialWidth := 380
+	if prefStore.Get().ViewMode == preferences.ViewModeAdvanced {
+		initialWidth = 900
+	}
+	window := app.Window.NewWithOptions(application.WebviewWindowOptions{
+		Name:   "main",
+		Title:  "NetBird",
+		Width:  initialWidth,
+		Height: services.WindowHeight,
+		// Center on first show; minimal WMs (fluxbox, the XEmbed tray path)
+		// drop new windows top-left unless asked.
+		InitialPosition:     application.WindowCentered,
+		Hidden:              true,
+		BackgroundColour:    services.WindowBackgroundColour,
+		URL:                 "/",
+		DisableResize:       true,
+		MinimiseButtonState: application.ButtonHidden,
+		MaximiseButtonState: application.ButtonHidden,
+		Mac:                 services.AppleMacOSAppearanceOptions(),
+		Windows:             services.MicrosoftWindowsAppearanceOptions(),
+		Linux: application.LinuxWindow{
+			Icon: iconWindow,
+		},
+	})
+
+	// Hide instead of quit on close; "really quit" is reached via tray -> Quit.
+	window.RegisterHook(events.Common.WindowClosing, func(e *application.WindowEvent) {
+		e.Cancel()
+		window.Hide()
+	})
+
+	// On macOS, Wails' default applicationShouldHandleReopen handler Show()s
+	// every hidden window on dock-icon click, resurrecting hide-on-close
+	// surfaces like Settings. Cancel it in a hook (hooks run before listeners)
+	// and show only the main window. No-op elsewhere — the event never fires.
+	if runtime.GOOS == "darwin" {
+		app.Event.RegisterApplicationEventHook(events.Mac.ApplicationShouldHandleReopen, func(e *application.ApplicationEvent) {
+			e.Cancel()
+			if e.Context().HasVisibleWindows() {
+				return
+			}
+			window.Show()
+			window.Focus()
+		})
+	}
+
+	return window
+}
diff --git a/client/ui/manifest.xml b/client/ui/manifest.xml
deleted file mode 100644
index c71a407e5..000000000
--- a/client/ui/manifest.xml
+++ /dev/null
@@ -1,17 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
-<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
-    <assemblyIdentity
-            version="0.0.0.1"
-            processorArchitecture="*"
-            name="netbird-ui.exe"
-            type="win32"
-    />
-    <description>Netbird UI application</description>
-    <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
-        <security>
-            <requestedPrivileges>
-                <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
-            </requestedPrivileges>
-        </security>
-    </trustInfo>
-</assembly>
\ No newline at end of file
diff --git a/client/ui/network.go b/client/ui/network.go
deleted file mode 100644
index cd5d23558..000000000
--- a/client/ui/network.go
+++ /dev/null
@@ -1,707 +0,0 @@
-//go:build !(linux && 386)
-
-package main
-
-import (
-	"context"
-	"fmt"
-	"runtime"
-	"sort"
-	"strings"
-	"time"
-
-	"fyne.io/fyne/v2"
-	"fyne.io/fyne/v2/container"
-	"fyne.io/fyne/v2/dialog"
-	"fyne.io/fyne/v2/layout"
-	"fyne.io/fyne/v2/widget"
-	"fyne.io/systray"
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-const (
-	allNetworksText                = "All networks"
-	overlappingNetworksText        = "Overlapping networks"
-	exitNodeNetworksText           = "Exit-node networks"
-	allNetworks             filter = "all"
-	overlappingNetworks     filter = "overlapping"
-	exitNodeNetworks        filter = "exit-node"
-	getClientFMT                   = "get client: %v"
-)
-
-type filter string
-
-func (s *serviceClient) showNetworksUI() {
-	s.wNetworks = s.app.NewWindow("Networks")
-	s.wNetworks.SetOnClosed(s.cancel)
-
-	allGrid := container.New(layout.NewGridLayout(3))
-	go s.updateNetworks(allGrid, allNetworks)
-	overlappingGrid := container.New(layout.NewGridLayout(3))
-	exitNodeGrid := container.New(layout.NewGridLayout(3))
-	routeCheckContainer := container.NewVBox()
-	tabs := container.NewAppTabs(
-		container.NewTabItem(allNetworksText, allGrid),
-		container.NewTabItem(overlappingNetworksText, overlappingGrid),
-		container.NewTabItem(exitNodeNetworksText, exitNodeGrid),
-	)
-	tabs.OnSelected = func(item *container.TabItem) {
-		s.updateNetworksBasedOnDisplayTab(tabs, allGrid, overlappingGrid, exitNodeGrid)
-	}
-	tabs.OnUnselected = func(item *container.TabItem) {
-		grid, _ := getGridAndFilterFromTab(tabs, allGrid, overlappingGrid, exitNodeGrid)
-		grid.Objects = nil
-	}
-
-	routeCheckContainer.Add(tabs)
-	scrollContainer := container.NewVScroll(routeCheckContainer)
-	scrollContainer.SetMinSize(fyne.NewSize(200, 300))
-
-	buttonBox := container.NewHBox(
-		layout.NewSpacer(),
-		widget.NewButton("Refresh", func() {
-			s.updateNetworksBasedOnDisplayTab(tabs, allGrid, overlappingGrid, exitNodeGrid)
-		}),
-		widget.NewButton("Select all", func() {
-			_, f := getGridAndFilterFromTab(tabs, allGrid, overlappingGrid, exitNodeGrid)
-			s.selectAllFilteredNetworks(f)
-			s.updateNetworksBasedOnDisplayTab(tabs, allGrid, overlappingGrid, exitNodeGrid)
-		}),
-		widget.NewButton("Deselect All", func() {
-			_, f := getGridAndFilterFromTab(tabs, allGrid, overlappingGrid, exitNodeGrid)
-			s.deselectAllFilteredNetworks(f)
-			s.updateNetworksBasedOnDisplayTab(tabs, allGrid, overlappingGrid, exitNodeGrid)
-		}),
-		layout.NewSpacer(),
-	)
-
-	content := container.NewBorder(nil, buttonBox, nil, nil, scrollContainer)
-
-	s.wNetworks.SetContent(content)
-	s.wNetworks.Show()
-
-	s.startAutoRefresh(10*time.Second, tabs, allGrid, overlappingGrid, exitNodeGrid)
-}
-
-func (s *serviceClient) updateNetworks(grid *fyne.Container, f filter) {
-	grid.Objects = nil
-	grid.Refresh()
-	idHeader := widget.NewLabelWithStyle("      ID", fyne.TextAlignLeading, fyne.TextStyle{Bold: true})
-	networkHeader := widget.NewLabelWithStyle("Range/Domains", fyne.TextAlignLeading, fyne.TextStyle{Bold: true})
-	resolvedIPsHeader := widget.NewLabelWithStyle("Resolved IPs", fyne.TextAlignLeading, fyne.TextStyle{Bold: true})
-
-	grid.Add(idHeader)
-	grid.Add(networkHeader)
-	grid.Add(resolvedIPsHeader)
-
-	filteredRoutes, err := s.getFilteredNetworks(f)
-	if err != nil {
-		return
-	}
-
-	sortNetworksByIDs(filteredRoutes)
-
-	for _, route := range filteredRoutes {
-		r := route
-
-		checkBox := widget.NewCheck(r.GetID(), func(checked bool) {
-			s.selectNetwork(r.ID, checked)
-		})
-		checkBox.Checked = route.Selected
-		checkBox.Resize(fyne.NewSize(20, 20))
-		checkBox.Refresh()
-
-		grid.Add(checkBox)
-		network := r.GetRange()
-		domains := r.GetDomains()
-
-		if len(domains) == 0 {
-			grid.Add(widget.NewLabel(network))
-			grid.Add(widget.NewLabel(""))
-			continue
-		}
-
-		// our selectors are only for display
-		noopFunc := func(_ string) {
-			// do nothing
-		}
-
-		domainsSelector := widget.NewSelect(domains, noopFunc)
-		domainsSelector.Selected = domains[0]
-		grid.Add(domainsSelector)
-
-		var resolvedIPsList []string
-		for domain, ipList := range r.GetResolvedIPs() {
-			resolvedIPsList = append(resolvedIPsList, fmt.Sprintf("%s: %s", domain, strings.Join(ipList.GetIps(), ", ")))
-		}
-
-		if len(resolvedIPsList) == 0 {
-			grid.Add(widget.NewLabel(""))
-			continue
-		}
-
-		// TODO: limit width within the selector display
-		resolvedIPsSelector := widget.NewSelect(resolvedIPsList, noopFunc)
-		resolvedIPsSelector.Selected = resolvedIPsList[0]
-		resolvedIPsSelector.Resize(fyne.NewSize(100, 100))
-		grid.Add(resolvedIPsSelector)
-	}
-
-	s.wNetworks.Content().Refresh()
-	grid.Refresh()
-}
-
-func (s *serviceClient) getFilteredNetworks(f filter) ([]*proto.Network, error) {
-	routes, err := s.fetchNetworks()
-	if err != nil {
-		log.Errorf(getClientFMT, err)
-		s.showError(fmt.Errorf(getClientFMT, err))
-		return nil, err
-	}
-	switch f {
-	case overlappingNetworks:
-		return getOverlappingNetworks(routes), nil
-	case exitNodeNetworks:
-		return getExitNodeNetworks(routes), nil
-	default:
-	}
-	return routes, nil
-}
-
-func getOverlappingNetworks(routes []*proto.Network) []*proto.Network {
-	var filteredRoutes []*proto.Network
-	existingRange := make(map[string][]*proto.Network)
-	for _, route := range routes {
-		if len(route.Domains) > 0 {
-			continue
-		}
-		if r, exists := existingRange[route.GetRange()]; exists {
-			r = append(r, route)
-			existingRange[route.GetRange()] = r
-		} else {
-			existingRange[route.GetRange()] = []*proto.Network{route}
-		}
-	}
-	for _, r := range existingRange {
-		if len(r) > 1 {
-			filteredRoutes = append(filteredRoutes, r...)
-		}
-	}
-	return filteredRoutes
-}
-
-func isDefaultRoute(routeRange string) bool {
-	// routeRange is the merged display string from the daemon, e.g. "0.0.0.0/0",
-	// "::/0", or "0.0.0.0/0, ::/0" when a v4 exit node has a paired v6 entry.
-	for _, part := range strings.Split(routeRange, ",") {
-		switch strings.TrimSpace(part) {
-		case "0.0.0.0/0", "::/0":
-			return true
-		}
-	}
-	return false
-}
-
-func getExitNodeNetworks(routes []*proto.Network) []*proto.Network {
-	var filteredRoutes []*proto.Network
-	for _, route := range routes {
-		if isDefaultRoute(route.Range) {
-			filteredRoutes = append(filteredRoutes, route)
-		}
-	}
-	return filteredRoutes
-}
-
-func sortNetworksByIDs(routes []*proto.Network) {
-	sort.Slice(routes, func(i, j int) bool {
-		return strings.ToLower(routes[i].GetID()) < strings.ToLower(routes[j].GetID())
-	})
-}
-
-func (s *serviceClient) fetchNetworks() ([]*proto.Network, error) {
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		return nil, fmt.Errorf(getClientFMT, err)
-	}
-
-	resp, err := conn.ListNetworks(s.ctx, &proto.ListNetworksRequest{})
-	if err != nil {
-		return nil, fmt.Errorf("failed to list routes: %v", err)
-	}
-
-	return resp.Routes, nil
-}
-
-func (s *serviceClient) selectNetwork(id string, checked bool) {
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		log.Errorf(getClientFMT, err)
-		s.showError(fmt.Errorf(getClientFMT, err))
-		return
-	}
-
-	req := &proto.SelectNetworksRequest{
-		NetworkIDs: []string{id},
-		Append:     checked,
-	}
-
-	if checked {
-		if _, err := conn.SelectNetworks(s.ctx, req); err != nil {
-			log.Errorf("failed to select network: %v", err)
-			s.showError(fmt.Errorf("failed to select network: %v", err))
-			return
-		}
-		log.Infof("Network '%s' selected", id)
-	} else {
-		if _, err := conn.DeselectNetworks(s.ctx, req); err != nil {
-			log.Errorf("failed to deselect network: %v", err)
-			s.showError(fmt.Errorf("failed to deselect network: %v", err))
-			return
-		}
-		log.Infof("Network '%s' deselected", id)
-	}
-}
-
-func (s *serviceClient) selectAllFilteredNetworks(f filter) {
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		log.Errorf(getClientFMT, err)
-		return
-	}
-
-	req := s.getNetworksRequest(f, true)
-	if _, err := conn.SelectNetworks(s.ctx, req); err != nil {
-		log.Errorf("failed to select all networks: %v", err)
-		s.showError(fmt.Errorf("failed to select all networks: %v", err))
-		return
-	}
-
-	log.Debug("All networks selected")
-}
-
-func (s *serviceClient) deselectAllFilteredNetworks(f filter) {
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		log.Errorf(getClientFMT, err)
-		return
-	}
-
-	req := s.getNetworksRequest(f, false)
-	if _, err := conn.DeselectNetworks(s.ctx, req); err != nil {
-		log.Errorf("failed to deselect all networks: %v", err)
-		s.showError(fmt.Errorf("failed to deselect all networks: %v", err))
-		return
-	}
-
-	log.Debug("All networks deselected")
-}
-
-func (s *serviceClient) getNetworksRequest(f filter, appendRoute bool) *proto.SelectNetworksRequest {
-	req := &proto.SelectNetworksRequest{}
-	if f == allNetworks {
-		req.All = true
-	} else {
-		routes, err := s.getFilteredNetworks(f)
-		if err != nil {
-			return nil
-		}
-		for _, route := range routes {
-			req.NetworkIDs = append(req.NetworkIDs, route.GetID())
-		}
-		req.Append = appendRoute
-	}
-	return req
-}
-
-func (s *serviceClient) showError(err error) {
-	wrappedMessage := wrapText(err.Error(), 50)
-
-	dialog.ShowError(fmt.Errorf("%s", wrappedMessage), s.wNetworks)
-}
-
-func (s *serviceClient) startAutoRefresh(interval time.Duration, tabs *container.AppTabs, allGrid, overlappingGrid, exitNodesGrid *fyne.Container) {
-	ticker := time.NewTicker(interval)
-	go func() {
-		for range ticker.C {
-			s.updateNetworksBasedOnDisplayTab(tabs, allGrid, overlappingGrid, exitNodesGrid)
-		}
-	}()
-
-	s.wNetworks.SetOnClosed(func() {
-		ticker.Stop()
-		s.cancel()
-	})
-}
-
-func (s *serviceClient) updateNetworksBasedOnDisplayTab(tabs *container.AppTabs, allGrid, overlappingGrid, exitNodesGrid *fyne.Container) {
-	grid, f := getGridAndFilterFromTab(tabs, allGrid, overlappingGrid, exitNodesGrid)
-	s.wNetworks.Content().Refresh()
-	s.updateNetworks(grid, f)
-}
-
-// startExitNodeRefresh initiates exit node menu refresh after connecting.
-// On Windows, TrayOpenedCh is not supported by the systray library, so we use
-// a background poller to keep exit nodes in sync while connected.
-// On macOS/Linux, TrayOpenedCh handles refreshes on each tray open.
-func (s *serviceClient) startExitNodeRefresh() {
-	s.cancelExitNodeRetry()
-
-	if runtime.GOOS == "windows" {
-		ctx, cancel := context.WithCancel(s.ctx)
-		s.exitNodeMu.Lock()
-		s.exitNodeRetryCancel = cancel
-		s.exitNodeMu.Unlock()
-
-		go s.pollExitNodes(ctx)
-	} else {
-		go s.updateExitNodes()
-	}
-}
-
-func (s *serviceClient) cancelExitNodeRetry() {
-	s.exitNodeMu.Lock()
-	if s.exitNodeRetryCancel != nil {
-		s.exitNodeRetryCancel()
-		s.exitNodeRetryCancel = nil
-	}
-	s.exitNodeMu.Unlock()
-}
-
-// pollExitNodes periodically refreshes exit nodes while connected.
-// Uses a short initial interval to catch routes from the management sync,
-// then switches to a longer interval for ongoing updates.
-func (s *serviceClient) pollExitNodes(ctx context.Context) {
-	// Initial fast polling to catch routes as they appear after connect.
-	for i := 0; i < 5; i++ {
-		if s.updateExitNodes() {
-			break
-		}
-		select {
-		case <-ctx.Done():
-			return
-		case <-time.After(2 * time.Second):
-		}
-	}
-
-	ticker := time.NewTicker(10 * time.Second)
-	defer ticker.Stop()
-
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-ticker.C:
-			s.updateExitNodes()
-		}
-	}
-}
-
-// updateExitNodes fetches exit nodes from the daemon and recreates the menu.
-// Returns true if exit nodes were found.
-func (s *serviceClient) updateExitNodes() bool {
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		log.Errorf("get client: %v", err)
-		return false
-	}
-	exitNodes, err := s.getExitNodes(conn)
-	if err != nil {
-		log.Errorf("get exit nodes: %v", err)
-		return false
-	}
-
-	s.exitNodeMu.Lock()
-	defer s.exitNodeMu.Unlock()
-
-	s.recreateExitNodeMenu(exitNodes)
-
-	if len(s.mExitNodeItems) > 0 {
-		s.mExitNode.Enable()
-		return true
-	}
-
-	s.mExitNode.Disable()
-	return false
-}
-
-func (s *serviceClient) recreateExitNodeMenu(exitNodes []*proto.Network) {
-	for _, node := range s.mExitNodeItems {
-		node.cancel()
-		node.Hide()
-		node.Remove()
-	}
-	s.mExitNodeItems = nil
-	if s.mExitNodeSeparator != nil {
-		s.mExitNodeSeparator.Remove()
-		s.mExitNodeSeparator = nil
-	}
-	if s.mExitNodeDeselectAll != nil {
-		s.mExitNodeDeselectAll.Remove()
-		s.mExitNodeDeselectAll = nil
-	}
-
-	if runtime.GOOS == "linux" || runtime.GOOS == "freebsd" {
-		s.mExitNode.Remove()
-		s.mExitNode = systray.AddMenuItem("Exit Node", disabledMenuDescr)
-	}
-
-	var showDeselectAll bool
-
-	for _, node := range exitNodes {
-		if node.Selected {
-			showDeselectAll = true
-		}
-
-		menuItem := s.mExitNode.AddSubMenuItemCheckbox(
-			node.ID,
-			fmt.Sprintf("Use exit node %s", node.ID),
-			node.Selected,
-		)
-
-		ctx, cancel := context.WithCancel(s.ctx)
-		s.mExitNodeItems = append(s.mExitNodeItems, menuHandler{
-			MenuItem: menuItem,
-			cancel:   cancel,
-		})
-		go s.handleChecked(ctx, node.ID, menuItem)
-	}
-
-	if showDeselectAll {
-		s.addExitNodeDeselectAll()
-	}
-
-}
-
-func (s *serviceClient) addExitNodeDeselectAll() {
-	sep := s.mExitNode.AddSubMenuItem("───────────────", "")
-	sep.Disable()
-	s.mExitNodeSeparator = sep
-
-	deselectAllItem := s.mExitNode.AddSubMenuItem("Deselect All", "Deselect All")
-	s.mExitNodeDeselectAll = deselectAllItem
-
-	go func() {
-		for {
-			_, ok := <-deselectAllItem.ClickedCh
-			if !ok {
-				return
-			}
-			exitNodes, err := s.handleExitNodeMenuDeselectAll()
-			if err != nil {
-				log.Warnf("failed to handle deselect all exit nodes: %v", err)
-			} else {
-				s.exitNodeMu.Lock()
-				s.recreateExitNodeMenu(exitNodes)
-				s.exitNodeMu.Unlock()
-			}
-		}
-	}()
-}
-
-func (s *serviceClient) getExitNodes(conn proto.DaemonServiceClient) ([]*proto.Network, error) {
-	ctx, cancel := context.WithTimeout(s.ctx, defaultFailTimeout)
-	defer cancel()
-
-	resp, err := conn.ListNetworks(ctx, &proto.ListNetworksRequest{})
-	if err != nil {
-		return nil, fmt.Errorf("list networks: %v", err)
-	}
-
-	var exitNodes []*proto.Network
-	for _, network := range resp.Routes {
-		if isDefaultRoute(network.Range) {
-			exitNodes = append(exitNodes, network)
-		}
-	}
-	return exitNodes, nil
-}
-
-func (s *serviceClient) handleChecked(ctx context.Context, id string, item *systray.MenuItem) {
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case _, ok := <-item.ClickedCh:
-			if !ok {
-				return
-			}
-			if err := s.toggleExitNode(id, item); err != nil {
-				log.Errorf("failed to toggle exit node: %v", err)
-				continue
-			}
-		}
-	}
-}
-
-func (s *serviceClient) handleExitNodeMenuDeselectAll() ([]*proto.Network, error) {
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		return nil, fmt.Errorf("get client: %v", err)
-	}
-
-	exitNodes, err := s.getExitNodes(conn)
-	if err != nil {
-		return nil, fmt.Errorf("get exit nodes: %v", err)
-	}
-
-	var ids []string
-	for _, e := range exitNodes {
-		if e.Selected {
-			ids = append(ids, e.ID)
-		}
-	}
-
-	// deselect selected exit nodes
-	if err := s.deselectOtherExitNodes(conn, ids); err != nil {
-		return nil, err
-	}
-
-	updatedExitNodes, err := s.getExitNodes(conn)
-	if err != nil {
-		return nil, fmt.Errorf("re-fetch exit nodes: %v", err)
-	}
-
-	return updatedExitNodes, nil
-}
-
-// Add function to toggle exit node selection
-func (s *serviceClient) toggleExitNode(nodeID string, item *systray.MenuItem) error {
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		return fmt.Errorf("get client: %v", err)
-	}
-
-	log.Infof("Toggling exit node '%s'", nodeID)
-
-	s.exitNodeMu.Lock()
-	defer s.exitNodeMu.Unlock()
-
-	exitNodes, err := s.getExitNodes(conn)
-	if err != nil {
-		return fmt.Errorf("get exit nodes: %v", err)
-	}
-
-	var exitNode *proto.Network
-	// find other selected nodes and ours
-	ids := make([]string, 0, len(exitNodes))
-	for _, node := range exitNodes {
-		if node.ID == nodeID {
-			// preserve original state
-			cp := *node //nolint:govet
-			exitNode = &cp
-
-			// set desired state for recreation
-			node.Selected = true
-			continue
-		}
-		if node.Selected {
-			ids = append(ids, node.ID)
-
-			// set desired state for recreation
-			node.Selected = false
-		}
-	}
-
-	// exit node is the only selected node, deselect it
-	deselectAll := item.Checked() && len(ids) == 0
-	if deselectAll {
-		ids = append(ids, nodeID)
-		for _, node := range exitNodes {
-			if node.ID == nodeID {
-				// set desired state for recreation
-				node.Selected = false
-			}
-		}
-	}
-
-	// deselect all other selected exit nodes
-	if err := s.deselectOtherExitNodes(conn, ids); err != nil {
-		return err
-	}
-
-	if !deselectAll {
-		if err := s.selectNewExitNode(conn, exitNode, nodeID, item); err != nil {
-			return err
-		}
-	}
-
-	// linux/bsd doesn't handle Check/Uncheck well, so we recreate the menu
-	if runtime.GOOS == "linux" || runtime.GOOS == "freebsd" {
-		s.recreateExitNodeMenu(exitNodes)
-	}
-
-	return nil
-}
-
-func (s *serviceClient) deselectOtherExitNodes(conn proto.DaemonServiceClient, ids []string) error {
-	// deselect all other selected exit nodes
-	if len(ids) > 0 {
-		deselectReq := &proto.SelectNetworksRequest{
-			NetworkIDs: ids,
-		}
-		if _, err := conn.DeselectNetworks(s.ctx, deselectReq); err != nil {
-			return fmt.Errorf("deselect networks: %v", err)
-		}
-
-		log.Infof("Deselected exit nodes: %v", ids)
-	}
-
-	// uncheck all other exit node menu items
-	for _, i := range s.mExitNodeItems {
-		i.Uncheck()
-		log.Infof("Unchecked exit node %v", i)
-	}
-
-	return nil
-}
-
-func (s *serviceClient) selectNewExitNode(conn proto.DaemonServiceClient, exitNode *proto.Network, nodeID string, item *systray.MenuItem) error {
-	if exitNode != nil && !exitNode.Selected {
-		selectReq := &proto.SelectNetworksRequest{
-			NetworkIDs: []string{exitNode.ID},
-			Append:     true,
-		}
-		if _, err := conn.SelectNetworks(s.ctx, selectReq); err != nil {
-			return fmt.Errorf("select network: %v", err)
-		}
-
-		log.Infof("Selected exit node '%s'", nodeID)
-	}
-
-	item.Check()
-	log.Infof("Checked exit node '%s'", nodeID)
-
-	return nil
-}
-
-func getGridAndFilterFromTab(tabs *container.AppTabs, allGrid, overlappingGrid, exitNodesGrid *fyne.Container) (*fyne.Container, filter) {
-	switch tabs.Selected().Text {
-	case overlappingNetworksText:
-		return overlappingGrid, overlappingNetworks
-	case exitNodeNetworksText:
-		return exitNodesGrid, exitNodeNetworks
-	default:
-		return allGrid, allNetworks
-	}
-}
-
-// wrapText inserts newlines into the text to ensure that each line is
-// no longer than 'lineLength' runes.
-func wrapText(text string, lineLength int) string {
-	var sb strings.Builder
-	var currentLineLength int
-
-	for _, runeValue := range text {
-		sb.WriteRune(runeValue)
-		currentLineLength++
-
-		if currentLineLength >= lineLength || runeValue == '\n' {
-			sb.WriteRune('\n')
-			currentLineLength = 0
-		}
-	}
-
-	return sb.String()
-}
diff --git a/client/ui/notifier/notifier.go b/client/ui/notifier/notifier.go
deleted file mode 100644
index 8d1cbe4c4..000000000
--- a/client/ui/notifier/notifier.go
+++ /dev/null
@@ -1,27 +0,0 @@
-// Package notifier sends desktop notifications. On Windows it uses the WinRT
-// COM API directly via go-toast/v2 to avoid the PowerShell window flash that
-// fyne's default implementation produces. On other platforms it delegates to
-// fyne.
-package notifier
-
-import "fyne.io/fyne/v2"
-
-// Notifier sends desktop notifications.
-type Notifier interface {
-	Send(title, body string)
-}
-
-// New returns a platform-specific Notifier. The fyne app is used as the
-// fallback notifier on platforms where no native implementation is wired up,
-// and on Windows when the COM path fails to initialize.
-func New(app fyne.App) Notifier {
-	return newNotifier(app)
-}
-
-type fyneNotifier struct {
-	app fyne.App
-}
-
-func (f *fyneNotifier) Send(title, body string) {
-	f.app.SendNotification(fyne.NewNotification(title, body))
-}
diff --git a/client/ui/notifier/notifier_other.go b/client/ui/notifier/notifier_other.go
deleted file mode 100644
index 686d2885f..000000000
--- a/client/ui/notifier/notifier_other.go
+++ /dev/null
@@ -1,9 +0,0 @@
-//go:build !windows
-
-package notifier
-
-import "fyne.io/fyne/v2"
-
-func newNotifier(app fyne.App) Notifier {
-	return &fyneNotifier{app: app}
-}
diff --git a/client/ui/notifier/notifier_windows.go b/client/ui/notifier/notifier_windows.go
deleted file mode 100644
index c7afb43ae..000000000
--- a/client/ui/notifier/notifier_windows.go
+++ /dev/null
@@ -1,88 +0,0 @@
-package notifier
-
-import (
-	"os"
-	"path/filepath"
-	"sync"
-
-	"fyne.io/fyne/v2"
-	toast "git.sr.ht/~jackmordaunt/go-toast/v2"
-	"git.sr.ht/~jackmordaunt/go-toast/v2/wintoast"
-	log "github.com/sirupsen/logrus"
-)
-
-const (
-	// appID is the AppUserModelID shown in the Windows Action Center. It
-	// must match the System.AppUserModel.ID property set on the Start Menu
-	// shortcut by the MSI (see client/netbird.wxs); otherwise Windows
-	// groups toasts under a separate, unbranded entry.
-	appID = "NetBird"
-
-	// appGUID identifies the COM activation callback class. Generated once
-	// for NetBird; do not change without coordinating an installer bump,
-	// since old registry entries pointing at the previous GUID would orphan.
-	appGUID = "{0E1B4DE7-E148-432B-9814-544F941826EC}"
-)
-
-type comNotifier struct {
-	fallback *fyneNotifier
-	ready    bool
-	iconPath string
-}
-
-var (
-	initOnce sync.Once
-	initErr  error
-)
-
-func newNotifier(app fyne.App) Notifier {
-	n := &comNotifier{
-		fallback: &fyneNotifier{app: app},
-		iconPath: resolveIcon(),
-	}
-	initOnce.Do(func() {
-		initErr = wintoast.SetAppData(wintoast.AppData{
-			AppID:    appID,
-			GUID:     appGUID,
-			IconPath: n.iconPath,
-		})
-	})
-	if initErr != nil {
-		log.Warnf("toast: register app data failed, falling back to fyne notifications: %v", initErr)
-		return n.fallback
-	}
-	n.ready = true
-	return n
-}
-
-func (n *comNotifier) Send(title, body string) {
-	if !n.ready {
-		n.fallback.Send(title, body)
-		return
-	}
-	notification := toast.Notification{
-		AppID: appID,
-		Title: title,
-		Body:  body,
-		Icon:  n.iconPath,
-	}
-	if err := notification.Push(); err != nil {
-		log.Warnf("toast: push failed, using fyne fallback: %v", err)
-		n.fallback.Send(title, body)
-	}
-}
-
-// resolveIcon returns an absolute path to the toast icon, or an empty string
-// when no icon can be located. Windows requires a PNG/JPG for the
-// AppUserModelId IconUri registry value; .ico is silently ignored.
-func resolveIcon() string {
-	exe, err := os.Executable()
-	if err != nil {
-		return ""
-	}
-	candidate := filepath.Join(filepath.Dir(exe), "netbird.png")
-	if _, err := os.Stat(candidate); err == nil {
-		return candidate
-	}
-	return ""
-}
diff --git a/client/ui/preferences/store.go b/client/ui/preferences/store.go
new file mode 100644
index 000000000..afc854185
--- /dev/null
+++ b/client/ui/preferences/store.go
@@ -0,0 +1,267 @@
+//go:build !android && !ios && !freebsd && !js
+
+// Package preferences holds user-scope UI state, independent of the daemon
+// profile and shared across all profiles. The Store persists to JSON under
+// os.UserConfigDir() and broadcasts changes to in-process subscribers plus an
+// optional emitter.
+package preferences
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sync"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/ui/i18n"
+	"github.com/netbirdio/netbird/util"
+)
+
+// Lives under os.UserConfigDir()/netbird (OS-user writable, not the daemon's
+// root-owned state).
+const preferencesFileName = "ui-preferences.json"
+
+// EventPreferencesChanged fires on every persisted update, payload UIPreferences.
+const EventPreferencesChanged = "netbird:preferences:changed"
+
+// ViewMode is the preferred Main-window layout: "default" (compact, 380-wide)
+// or "advanced" (900-wide).
+type ViewMode string
+
+const (
+	ViewModeDefault  ViewMode = "default"
+	ViewModeAdvanced ViewMode = "advanced"
+)
+
+// DefaultViewMode applies when no file exists or its view-mode is empty.
+const DefaultViewMode = ViewModeDefault
+
+var ErrUnsupportedViewMode = errors.New("unsupported view mode")
+
+func (v ViewMode) IsValid() bool {
+	switch v {
+	case ViewModeDefault, ViewModeAdvanced:
+		return true
+	}
+	return false
+}
+
+// UIPreferences is rewritten in full on every change; there are no partial updates.
+type UIPreferences struct {
+	Language            i18n.LanguageCode `json:"language"`
+	ViewMode            ViewMode          `json:"viewMode"`
+	OnboardingCompleted bool              `json:"onboardingCompleted"`
+}
+
+// LanguageValidator rejects SetLanguage inputs with no shipped bundle.
+// *i18n.Bundle satisfies it.
+type LanguageValidator interface {
+	HasLanguage(code i18n.LanguageCode) bool
+}
+
+// Emitter broadcasts changes to the frontend. Wails'
+// *application.EventProcessor satisfies it; tests pass nil or a fake.
+type Emitter interface {
+	Emit(name string, data ...any) bool
+}
+
+// Store is the user-scope UI preferences store.
+type Store struct {
+	path string
+
+	mu      sync.RWMutex
+	current UIPreferences
+
+	subsMu sync.Mutex
+	subs   []chan UIPreferences
+
+	validator LanguageValidator
+	emitter   Emitter
+}
+
+// NewStore loads preferences from disk, falling back to defaults. A nil
+// validator skips SetLanguage validation; a nil emitter skips broadcasting.
+func NewStore(validator LanguageValidator, emitter Emitter) (*Store, error) {
+	path, err := preferencesPath()
+	if err != nil {
+		return nil, fmt.Errorf("resolve preferences path: %w", err)
+	}
+
+	// Language starts empty: the frontend treats absence as the signal to
+	// detect the browser locale on first launch and call SetLanguage.
+	s := &Store{
+		path:      path,
+		validator: validator,
+		emitter:   emitter,
+		current:   UIPreferences{ViewMode: DefaultViewMode},
+	}
+
+	if err := s.load(); err != nil {
+		log.Warnf("load ui preferences from %s: %v (using defaults)", path, err)
+	}
+
+	return s, nil
+}
+
+// Get returns a copy of the current preferences.
+func (s *Store) Get() UIPreferences {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return s.current
+}
+
+// SetViewMode validates, persists, and broadcasts. No-op if unchanged.
+func (s *Store) SetViewMode(mode ViewMode) error {
+	if !mode.IsValid() {
+		return fmt.Errorf("%w: %q", ErrUnsupportedViewMode, mode)
+	}
+
+	s.mu.Lock()
+	if s.current.ViewMode == mode {
+		s.mu.Unlock()
+		return nil
+	}
+	next := s.current
+	next.ViewMode = mode
+	if err := s.persistLocked(next); err != nil {
+		s.mu.Unlock()
+		return fmt.Errorf("persist preferences: %w", err)
+	}
+	s.current = next
+	s.mu.Unlock()
+
+	s.broadcast(next)
+	return nil
+}
+
+// SetOnboardingCompleted persists the welcome-window dismissal. No-op if unchanged.
+func (s *Store) SetOnboardingCompleted(done bool) error {
+	s.mu.Lock()
+	if s.current.OnboardingCompleted == done {
+		s.mu.Unlock()
+		return nil
+	}
+	next := s.current
+	next.OnboardingCompleted = done
+	if err := s.persistLocked(next); err != nil {
+		s.mu.Unlock()
+		return fmt.Errorf("persist preferences: %w", err)
+	}
+	s.current = next
+	s.mu.Unlock()
+
+	s.broadcast(next)
+	return nil
+}
+
+// SetLanguage validates, persists, and broadcasts. No-op if unchanged.
+func (s *Store) SetLanguage(lang i18n.LanguageCode) error {
+	if lang == "" {
+		return fmt.Errorf("%w: empty code", i18n.ErrUnsupportedLanguage)
+	}
+	if s.validator != nil && !s.validator.HasLanguage(lang) {
+		return fmt.Errorf("%w: %q", i18n.ErrUnsupportedLanguage, lang)
+	}
+
+	s.mu.Lock()
+	if s.current.Language == lang {
+		s.mu.Unlock()
+		return nil
+	}
+	next := s.current
+	next.Language = lang
+	if err := s.persistLocked(next); err != nil {
+		s.mu.Unlock()
+		return fmt.Errorf("persist preferences: %w", err)
+	}
+	s.current = next
+	s.mu.Unlock()
+
+	s.broadcast(next)
+	return nil
+}
+
+// Subscribe returns a channel of persisted changes and an unsubscribe func.
+// The unsubscribe func closes the channel; callers must not close it themselves.
+func (s *Store) Subscribe() (<-chan UIPreferences, func()) {
+	ch := make(chan UIPreferences, 4)
+	s.subsMu.Lock()
+	s.subs = append(s.subs, ch)
+	s.subsMu.Unlock()
+
+	unsubscribe := func() {
+		s.subsMu.Lock()
+		defer s.subsMu.Unlock()
+		for i, c := range s.subs {
+			if c == ch {
+				s.subs = append(s.subs[:i], s.subs[i+1:]...)
+				close(ch)
+				return
+			}
+		}
+	}
+	return ch, unsubscribe
+}
+
+// load reads the file into current. A missing file is not an error (the
+// in-memory default stands); malformed contents return an error.
+func (s *Store) load() error {
+	if _, err := os.Stat(s.path); errors.Is(err, os.ErrNotExist) {
+		return nil
+	}
+
+	var loaded UIPreferences
+	if _, err := util.ReadJson(s.path, &loaded); err != nil {
+		return err
+	}
+
+	if !loaded.ViewMode.IsValid() {
+		loaded.ViewMode = DefaultViewMode
+	}
+
+	s.mu.Lock()
+	s.current = loaded
+	s.mu.Unlock()
+	return nil
+}
+
+// persistLocked writes v to disk. Caller must hold s.mu and update in-memory
+// state only after this returns nil.
+func (s *Store) persistLocked(v UIPreferences) error {
+	if err := os.MkdirAll(filepath.Dir(s.path), 0o755); err != nil {
+		return fmt.Errorf("mkdir %s: %w", filepath.Dir(s.path), err)
+	}
+	return util.WriteJson(context.Background(), s.path, v)
+}
+
+// broadcast fans v out to subscribers and the emitter. Full-buffer subscribers
+// are skipped: consumers only need the latest value, so dropping is safe.
+func (s *Store) broadcast(v UIPreferences) {
+	s.subsMu.Lock()
+	subs := make([]chan UIPreferences, len(s.subs))
+	copy(subs, s.subs)
+	s.subsMu.Unlock()
+
+	for _, ch := range subs {
+		select {
+		case ch <- v:
+		default:
+			log.Debugf("preferences subscriber channel full; dropping update")
+		}
+	}
+
+	if s.emitter != nil {
+		s.emitter.Emit(EventPreferencesChanged, v)
+	}
+}
+
+func preferencesPath() (string, error) {
+	dir, err := os.UserConfigDir()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(dir, "netbird", preferencesFileName), nil
+}
diff --git a/client/ui/preferences/store_test.go b/client/ui/preferences/store_test.go
new file mode 100644
index 000000000..0d1cc7b54
--- /dev/null
+++ b/client/ui/preferences/store_test.go
@@ -0,0 +1,225 @@
+//go:build !android && !ios && !freebsd && !js
+
+package preferences
+
+import (
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"runtime"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/ui/i18n"
+)
+
+// fakeValidator implements LanguageValidator for tests so we don't need a
+// fully-loaded i18n.Bundle.
+type fakeValidator struct{ ok map[i18n.LanguageCode]bool }
+
+func (f fakeValidator) HasLanguage(code i18n.LanguageCode) bool { return f.ok[code] }
+
+// recordingEmitter captures Emit calls so tests can assert the broadcast
+// fired.
+type recordingEmitter struct {
+	mu    sync.Mutex
+	calls []emitCall
+}
+
+type emitCall struct {
+	name string
+	data []any
+}
+
+func (r *recordingEmitter) Emit(name string, data ...any) bool {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.calls = append(r.calls, emitCall{name: name, data: data})
+	return true
+}
+
+func (r *recordingEmitter) calledWith(name string) []emitCall {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	var out []emitCall
+	for _, c := range r.calls {
+		if c.name == name {
+			out = append(out, c)
+		}
+	}
+	return out
+}
+
+// withTempConfigDir reroots os.UserConfigDir() at a temporary directory by
+// pointing the OS-specific env vars there. Restored automatically by
+// t.Setenv.
+func withTempConfigDir(t *testing.T) string {
+	t.Helper()
+	tmp := t.TempDir()
+	switch runtime.GOOS {
+	case "darwin":
+		t.Setenv("HOME", tmp)
+		require.NoError(t, os.MkdirAll(filepath.Join(tmp, "Library", "Application Support"), 0o755))
+	case "windows":
+		t.Setenv("AppData", tmp)
+	default:
+		t.Setenv("XDG_CONFIG_HOME", tmp)
+	}
+	return tmp
+}
+
+func TestStore_DefaultsWhenFileMissing(t *testing.T) {
+	withTempConfigDir(t)
+	s, err := NewStore(fakeValidator{ok: map[i18n.LanguageCode]bool{"en": true}}, nil)
+	require.NoError(t, err)
+
+	got := s.Get()
+	assert.Equal(t, i18n.LanguageCode(""), got.Language, "language must be empty when no file is on disk so the frontend can detect the browser locale")
+	assert.Equal(t, DefaultViewMode, got.ViewMode, "view-mode default should still apply")
+}
+
+func TestStore_SetLanguagePersistsAndBroadcasts(t *testing.T) {
+	withTempConfigDir(t)
+	emitter := &recordingEmitter{}
+	s, err := NewStore(fakeValidator{ok: map[i18n.LanguageCode]bool{"en": true, "hu": true}}, emitter)
+	require.NoError(t, err)
+
+	ch, unsubscribe := s.Subscribe()
+	defer unsubscribe()
+
+	require.NoError(t, s.SetLanguage("hu"))
+
+	got := s.Get()
+	assert.Equal(t, i18n.LanguageCode("hu"), got.Language, "Get should reflect the SetLanguage value")
+
+	select {
+	case v := <-ch:
+		assert.Equal(t, i18n.LanguageCode("hu"), v.Language, "subscriber should receive the new value")
+	case <-time.After(time.Second):
+		t.Fatal("subscriber timed out waiting for update")
+	}
+
+	emits := emitter.calledWith(EventPreferencesChanged)
+	require.Len(t, emits, 1, "Emit should fire exactly once per SetLanguage")
+	payload, ok := emits[0].data[0].(UIPreferences)
+	require.True(t, ok, "emitter payload should be UIPreferences")
+	assert.Equal(t, i18n.LanguageCode("hu"), payload.Language)
+}
+
+func TestStore_LoadFromDisk(t *testing.T) {
+	withTempConfigDir(t)
+	path, err := preferencesPath()
+	require.NoError(t, err)
+	require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o755))
+	require.NoError(t, os.WriteFile(path, []byte(`{"language":"hu"}`), 0o644))
+
+	s, err := NewStore(fakeValidator{ok: map[i18n.LanguageCode]bool{"hu": true}}, nil)
+	require.NoError(t, err)
+
+	got := s.Get()
+	assert.Equal(t, i18n.LanguageCode("hu"), got.Language, "Get should load language from existing file")
+}
+
+func TestStore_UnsupportedLanguageRejected(t *testing.T) {
+	withTempConfigDir(t)
+	s, err := NewStore(fakeValidator{ok: map[i18n.LanguageCode]bool{"en": true}}, nil)
+	require.NoError(t, err)
+
+	err = s.SetLanguage("xx")
+	require.Error(t, err, "unknown language must be rejected")
+	assert.ErrorIs(t, err, i18n.ErrUnsupportedLanguage)
+
+	err = s.SetLanguage("")
+	assert.ErrorIs(t, err, i18n.ErrUnsupportedLanguage, "empty language code must be rejected")
+}
+
+func TestStore_NoValidatorAcceptsAnything(t *testing.T) {
+	withTempConfigDir(t)
+	s, err := NewStore(nil, nil)
+	require.NoError(t, err)
+
+	require.NoError(t, s.SetLanguage("fr"))
+	got := s.Get()
+	assert.Equal(t, i18n.LanguageCode("fr"), got.Language)
+}
+
+func TestStore_SetLanguageIdempotent(t *testing.T) {
+	withTempConfigDir(t)
+	emitter := &recordingEmitter{}
+	s, err := NewStore(fakeValidator{ok: map[i18n.LanguageCode]bool{"en": true}}, emitter)
+	require.NoError(t, err)
+
+	// First call goes from "" (unset) to "en" — real change, one broadcast.
+	require.NoError(t, s.SetLanguage("en"))
+	require.Len(t, emitter.calledWith(EventPreferencesChanged), 1,
+		"first SetLanguage from unset should broadcast")
+
+	// Second call is a no-op — no disk write, no broadcast. Without this
+	// guard the tray would re-render the menu on every cosmetic re-save of
+	// the preferences file.
+	require.NoError(t, s.SetLanguage("en"))
+	assert.Len(t, emitter.calledWith(EventPreferencesChanged), 1,
+		"re-setting the current language should not broadcast again")
+}
+
+func TestStore_CorruptFileFallsBackToDefault(t *testing.T) {
+	withTempConfigDir(t)
+	path, err := preferencesPath()
+	require.NoError(t, err)
+	require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o755))
+	require.NoError(t, os.WriteFile(path, []byte("{not json"), 0o644))
+
+	s, err := NewStore(fakeValidator{ok: map[i18n.LanguageCode]bool{"en": true}}, nil)
+	require.NoError(t, err, "corrupt file should not fail construction")
+
+	got := s.Get()
+	assert.Equal(t, i18n.LanguageCode(""), got.Language, "corrupt JSON should leave the empty (unset) default in place so the frontend can re-detect")
+}
+
+func TestStore_UnsubscribeStopsUpdates(t *testing.T) {
+	withTempConfigDir(t)
+	s, err := NewStore(fakeValidator{ok: map[i18n.LanguageCode]bool{"en": true, "hu": true}}, nil)
+	require.NoError(t, err)
+
+	ch, unsubscribe := s.Subscribe()
+	unsubscribe()
+
+	require.NoError(t, s.SetLanguage("hu"))
+
+	select {
+	case _, ok := <-ch:
+		assert.False(t, ok, "channel should be closed after unsubscribe")
+	case <-time.After(time.Second):
+		t.Fatal("expected closed channel, got nothing")
+	}
+}
+
+func TestStore_FileShapeIsJSON(t *testing.T) {
+	withTempConfigDir(t)
+	s, err := NewStore(fakeValidator{ok: map[i18n.LanguageCode]bool{"hu": true}}, nil)
+	require.NoError(t, err)
+	require.NoError(t, s.SetLanguage("hu"))
+
+	path, err := preferencesPath()
+	require.NoError(t, err)
+	data, err := os.ReadFile(path)
+	require.NoError(t, err)
+
+	var parsed UIPreferences
+	require.NoError(t, json.Unmarshal(data, &parsed), "on-disk file must be valid JSON")
+	assert.Equal(t, i18n.LanguageCode("hu"), parsed.Language)
+}
+
+func TestStore_ErrUnsupportedSentinel(t *testing.T) {
+	// Verifies callers can match on the sentinel error rather than parsing
+	// strings — protects against accidental %v -> %w changes that would
+	// silently break errors.Is.
+	err := errors.New("inner")
+	wrapped := errors.Join(i18n.ErrUnsupportedLanguage, err)
+	assert.ErrorIs(t, wrapped, i18n.ErrUnsupportedLanguage)
+}
diff --git a/client/ui/process/process.go b/client/ui/process/process.go
deleted file mode 100644
index 28276f416..000000000
--- a/client/ui/process/process.go
+++ /dev/null
@@ -1,38 +0,0 @@
-package process
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-
-	"github.com/shirou/gopsutil/v3/process"
-)
-
-func IsAnotherProcessRunning() (int32, bool, error) {
-	processes, err := process.Processes()
-	if err != nil {
-		return 0, false, err
-	}
-
-	pid := os.Getpid()
-	processName := strings.ToLower(filepath.Base(os.Args[0]))
-
-	for _, p := range processes {
-		if int(p.Pid) == pid {
-			continue
-		}
-
-		runningProcessPath, err := p.Exe()
-		// most errors are related to short-lived processes
-		if err != nil {
-			continue
-		}
-
-		runningProcessName := strings.ToLower(filepath.Base(runningProcessPath))
-		if runningProcessName == processName && isProcessOwnedByCurrentUser(p) {
-			return p.Pid, true, nil
-		}
-	}
-
-	return 0, false, nil
-}
diff --git a/client/ui/process/process_nonwindows.go b/client/ui/process/process_nonwindows.go
deleted file mode 100644
index cf9f6443d..000000000
--- a/client/ui/process/process_nonwindows.go
+++ /dev/null
@@ -1,26 +0,0 @@
-//go:build !windows
-
-package process
-
-import (
-	"os"
-
-	"github.com/shirou/gopsutil/v3/process"
-	log "github.com/sirupsen/logrus"
-)
-
-func isProcessOwnedByCurrentUser(p *process.Process) bool {
-	currentUserID := os.Getuid()
-	uids, err := p.Uids()
-	if err != nil {
-		log.Errorf("get process uids: %v", err)
-		return false
-	}
-	for _, id := range uids {
-		log.Debugf("checking process uid: %d", id)
-		if int(id) == currentUserID {
-			return true
-		}
-	}
-	return false
-}
diff --git a/client/ui/process/process_windows.go b/client/ui/process/process_windows.go
deleted file mode 100644
index 2d211d1a4..000000000
--- a/client/ui/process/process_windows.go
+++ /dev/null
@@ -1,24 +0,0 @@
-package process
-
-import (
-	"os/user"
-
-	"github.com/shirou/gopsutil/v3/process"
-	log "github.com/sirupsen/logrus"
-)
-
-func isProcessOwnedByCurrentUser(p *process.Process) bool {
-	processUsername, err := p.Username()
-	if err != nil {
-		log.Errorf("get process username error: %v", err)
-		return false
-	}
-
-	currUser, err := user.Current()
-	if err != nil {
-		log.Errorf("get current user error: %v", err)
-		return false
-	}
-
-	return processUsername == currUser.Username
-}
diff --git a/client/ui/profile.go b/client/ui/profile.go
deleted file mode 100644
index 83b0ec18b..000000000
--- a/client/ui/profile.go
+++ /dev/null
@@ -1,775 +0,0 @@
-//go:build !(linux && 386)
-
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os/user"
-	"slices"
-	"sort"
-	"sync"
-	"time"
-
-	"fyne.io/fyne/v2"
-	"fyne.io/fyne/v2/container"
-	"fyne.io/fyne/v2/dialog"
-	"fyne.io/fyne/v2/layout"
-	"fyne.io/fyne/v2/widget"
-	"fyne.io/systray"
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal"
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-// showProfilesUI creates and displays the Profiles window with a list of existing profiles,
-// a button to add new profiles, allows removal, and lets the user switch the active profile.
-func (s *serviceClient) showProfilesUI() {
-
-	profiles, err := s.getProfiles()
-	if err != nil {
-		log.Errorf("get profiles: %v", err)
-		return
-	}
-
-	var refresh func()
-	// List widget for profiles
-	list := widget.NewList(
-		func() int { return len(profiles) },
-		func() fyne.CanvasObject {
-			// Each item: Selected indicator, Name, spacer, Select, Logout & Remove buttons
-			return container.NewHBox(
-				widget.NewLabel(""), // indicator
-				widget.NewLabel(""), // profile name
-				layout.NewSpacer(),
-				widget.NewButton("Select", nil),
-				widget.NewButton("Deregister", nil),
-				widget.NewButton("Remove", nil),
-			)
-		},
-		func(i widget.ListItemID, item fyne.CanvasObject) {
-			// Populate each row
-			row := item.(*fyne.Container)
-			indicator := row.Objects[0].(*widget.Label)
-			nameLabel := row.Objects[1].(*widget.Label)
-			selectBtn := row.Objects[3].(*widget.Button)
-			logoutBtn := row.Objects[4].(*widget.Button)
-			removeBtn := row.Objects[5].(*widget.Button)
-
-			profile := profiles[i]
-			// Show a checkmark if selected
-			if profile.IsActive {
-				indicator.SetText("✓")
-			} else {
-				indicator.SetText("")
-			}
-			nameLabel.SetText(formatProfileLabel(profile, profiles))
-
-			// Configure Select/Active button
-			selectBtn.SetText(func() string {
-				if profile.IsActive {
-					return "Active"
-				}
-				return "Select"
-			}())
-			selectBtn.OnTapped = func() {
-				if profile.IsActive {
-					return // already active
-				}
-				// confirm switch
-				dialog.ShowConfirm(
-					"Switch Profile",
-					fmt.Sprintf("Are you sure you want to switch to '%s'?", profile.Name),
-					func(confirm bool) {
-						if !confirm {
-							return
-						}
-						// switch
-						err = s.switchProfile(profile.ID)
-						if err != nil {
-							log.Errorf("failed to switch profile: %v", err)
-							dialog.ShowError(errors.New("failed to select profile"), s.wProfiles)
-							return
-						}
-
-						dialog.ShowInformation(
-							"Profile Switched",
-							fmt.Sprintf("Profile '%s' switched successfully", profile.Name),
-							s.wProfiles,
-						)
-
-						conn, err := s.getSrvClient(defaultFailTimeout)
-						if err != nil {
-							log.Errorf("failed to get daemon client: %v", err)
-							return
-						}
-
-						status, err := conn.Status(s.ctx, &proto.StatusRequest{})
-						if err != nil {
-							log.Errorf("failed to get status after switching profile: %v", err)
-							return
-						}
-
-						if status.Status == string(internal.StatusConnected) {
-							if err := s.menuDownClick(); err != nil {
-								log.Errorf("failed to handle down click after switching profile: %v", err)
-								dialog.ShowError(fmt.Errorf("failed to handle down click"), s.wProfiles)
-								return
-							}
-						}
-						// update slice flags
-						refresh()
-					},
-					s.wProfiles,
-				)
-			}
-
-			logoutBtn.Show()
-			logoutBtn.SetText("Deregister")
-			logoutBtn.OnTapped = func() {
-				s.handleProfileLogout(profile, refresh)
-			}
-
-			// Remove profile
-			removeBtn.SetText("Remove")
-			removeBtn.OnTapped = func() {
-				dialog.ShowConfirm(
-					"Delete Profile",
-					fmt.Sprintf("Are you sure you want to delete '%s'?", profile.Name),
-					func(confirm bool) {
-						if !confirm {
-							return
-						}
-
-						err = s.removeProfile(profile.ID)
-						if err != nil {
-							log.Errorf("failed to remove profile: %v", err)
-							dialog.ShowError(fmt.Errorf("failed to remove profile"), s.wProfiles)
-							return
-						}
-						dialog.ShowInformation(
-							"Profile Removed",
-							fmt.Sprintf("Profile '%s' removed successfully", profile.Name),
-							s.wProfiles,
-						)
-						// update slice
-						refresh()
-					},
-					s.wProfiles,
-				)
-			}
-		},
-	)
-
-	refresh = func() {
-		newProfiles, err := s.getProfiles()
-		if err != nil {
-			dialog.ShowError(err, s.wProfiles)
-			return
-		}
-		profiles = newProfiles // update the slice
-		list.Refresh()         // tell Fyne to re-call length/update on every visible row
-	}
-
-	// Button to add a new profile
-	newBtn := widget.NewButton("New Profile", func() {
-		nameEntry := widget.NewEntry()
-		nameEntry.SetPlaceHolder("Enter Profile Name")
-
-		formItems := []*widget.FormItem{{Text: "Name:", Widget: nameEntry}}
-		dlg := dialog.NewForm(
-			"New Profile",
-			"Create",
-			"Cancel",
-			formItems,
-			func(confirm bool) {
-				if !confirm {
-					return
-				}
-				name := nameEntry.Text
-				if name == "" {
-					dialog.ShowError(errors.New("profile name cannot be empty"), s.wProfiles)
-					return
-				}
-
-				// add profile
-				err = s.addProfile(name)
-				if err != nil {
-					log.Errorf("failed to create profile: %v", err)
-					dialog.ShowError(fmt.Errorf("failed to create profile"), s.wProfiles)
-					return
-				}
-				dialog.ShowInformation(
-					"Profile Created",
-					fmt.Sprintf("Profile '%s' created successfully", name),
-					s.wProfiles,
-				)
-				// update slice
-				refresh()
-			},
-			s.wProfiles,
-		)
-		// make dialog wider
-		dlg.Resize(fyne.NewSize(350, 150))
-		dlg.Show()
-	})
-
-	// Assemble window content
-	content := container.NewBorder(nil, newBtn, nil, nil, list)
-	s.wProfiles = s.app.NewWindow("NetBird Profiles")
-	s.wProfiles.SetContent(content)
-	s.wProfiles.Resize(fyne.NewSize(400, 300))
-	s.wProfiles.SetOnClosed(s.cancel)
-
-	s.wProfiles.Show()
-}
-
-func (s *serviceClient) addProfile(profileName string) error {
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		return fmt.Errorf(getClientFMT, err)
-	}
-
-	currUser, err := user.Current()
-	if err != nil {
-		return fmt.Errorf("get current user: %w", err)
-	}
-
-	_, err = conn.AddProfile(s.ctx, &proto.AddProfileRequest{
-		ProfileName: profileName,
-		Username:    currUser.Username,
-	})
-
-	if err != nil {
-		return fmt.Errorf("add profile: %w", err)
-	}
-
-	return nil
-}
-
-func (s *serviceClient) switchProfile(handle string) error {
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		return fmt.Errorf(getClientFMT, err)
-	}
-
-	currUser, err := user.Current()
-	if err != nil {
-		return fmt.Errorf("get current user: %w", err)
-	}
-
-	resp, err := conn.SwitchProfile(s.ctx, &proto.SwitchProfileRequest{
-		ProfileName: &handle,
-		Username:    &currUser.Username,
-	})
-	if err != nil {
-		return fmt.Errorf("switch profile failed: %w", err)
-	}
-
-	if err := s.profileManager.SwitchProfile(profilemanager.ID(resp.Id)); err != nil {
-		return fmt.Errorf("switch profile: %w", err)
-	}
-
-	return nil
-}
-
-func (s *serviceClient) removeProfile(profileName string) error {
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		return fmt.Errorf(getClientFMT, err)
-	}
-
-	currUser, err := user.Current()
-	if err != nil {
-		return fmt.Errorf("get current user: %w", err)
-	}
-
-	_, err = conn.RemoveProfile(s.ctx, &proto.RemoveProfileRequest{
-		ProfileName: profileName,
-		Username:    currUser.Username,
-	})
-	if err != nil {
-		return fmt.Errorf("remove profile: %w", err)
-	}
-
-	return nil
-}
-
-type Profile struct {
-	ID       string
-	Name     string
-	IsActive bool
-}
-
-// formatProfileLabel returns the display label for a profile. Profiles can
-// share the same Name, so when more than one profile in profiles carries this
-// Name, a short form of the ID is appended to disambiguate the entries.
-func formatProfileLabel(profile Profile, profiles []Profile) string {
-	count := 0
-	for _, p := range profiles {
-		if p.Name == profile.Name {
-			count++
-		}
-	}
-	if count <= 1 {
-		return profile.Name
-	}
-	return fmt.Sprintf("%s (%s)", profile.Name, profilemanager.ID(profile.ID).ShortID())
-}
-
-func (s *serviceClient) getProfiles() ([]Profile, error) {
-	conn, err := s.getSrvClient(defaultFailTimeout)
-	if err != nil {
-		return nil, fmt.Errorf(getClientFMT, err)
-	}
-
-	currUser, err := user.Current()
-	if err != nil {
-		return nil, fmt.Errorf("get current user: %w", err)
-	}
-	profilesResp, err := conn.ListProfiles(s.ctx, &proto.ListProfilesRequest{
-		Username: currUser.Username,
-	})
-	if err != nil {
-		return nil, fmt.Errorf("list profiles: %w", err)
-	}
-
-	var profiles []Profile
-
-	for _, profile := range profilesResp.Profiles {
-		profiles = append(profiles, Profile{
-			ID:       profile.Id,
-			Name:     profile.Name,
-			IsActive: profile.IsActive,
-		})
-	}
-
-	return profiles, nil
-}
-
-func (s *serviceClient) handleProfileLogout(profile Profile, refreshCallback func()) {
-	dialog.ShowConfirm(
-		"Deregister",
-		fmt.Sprintf("Are you sure you want to deregister from '%s'?", profile.Name),
-		func(confirm bool) {
-			if !confirm {
-				return
-			}
-
-			conn, err := s.getSrvClient(defaultFailTimeout)
-			if err != nil {
-				log.Errorf("failed to get service client: %v", err)
-				dialog.ShowError(fmt.Errorf("failed to connect to service"), s.wProfiles)
-				return
-			}
-
-			currUser, err := user.Current()
-			if err != nil {
-				log.Errorf("failed to get current user: %v", err)
-				dialog.ShowError(fmt.Errorf("failed to get current user"), s.wProfiles)
-				return
-			}
-
-			username := currUser.Username
-			// ProfileName is treated as a handle; send the ID so the
-			// daemon resolves to exactly this profile.
-			_, err = conn.Logout(s.ctx, &proto.LogoutRequest{
-				ProfileName: &profile.ID,
-				Username:    &username,
-			})
-			if err != nil {
-				log.Errorf("logout failed: %v", err)
-				dialog.ShowError(fmt.Errorf("deregister failed"), s.wProfiles)
-				return
-			}
-
-			dialog.ShowInformation(
-				"Deregistered",
-				fmt.Sprintf("Successfully deregistered from '%s'", profile.Name),
-				s.wProfiles,
-			)
-
-			refreshCallback()
-		},
-		s.wProfiles,
-	)
-}
-
-type subItem struct {
-	*systray.MenuItem
-	ctx    context.Context
-	cancel context.CancelFunc
-}
-
-type profileMenu struct {
-	mu                    sync.Mutex
-	ctx                   context.Context
-	serviceClient         *serviceClient
-	profileManager        *profilemanager.ProfileManager
-	eventHandler          *eventHandler
-	profileMenuItem       *systray.MenuItem
-	emailMenuItem         *systray.MenuItem
-	profileSubItems       []*subItem
-	manageProfilesSubItem *subItem
-	logoutSubItem         *subItem
-	profilesState         []Profile
-	downClickCallback     func() error
-	upClickCallback       func(context.Context) error
-	getSrvClientCallback  func(timeout time.Duration) (proto.DaemonServiceClient, error)
-	loadSettingsCallback  func()
-	app                   fyne.App
-}
-
-type newProfileMenuArgs struct {
-	ctx                  context.Context
-	serviceClient        *serviceClient
-	profileManager       *profilemanager.ProfileManager
-	eventHandler         *eventHandler
-	profileMenuItem      *systray.MenuItem
-	emailMenuItem        *systray.MenuItem
-	downClickCallback    func() error
-	upClickCallback      func(context.Context) error
-	getSrvClientCallback func(timeout time.Duration) (proto.DaemonServiceClient, error)
-	loadSettingsCallback func()
-	app                  fyne.App
-}
-
-func newProfileMenu(args newProfileMenuArgs) *profileMenu {
-	p := profileMenu{
-		ctx:                  args.ctx,
-		serviceClient:        args.serviceClient,
-		profileManager:       args.profileManager,
-		eventHandler:         args.eventHandler,
-		profileMenuItem:      args.profileMenuItem,
-		emailMenuItem:        args.emailMenuItem,
-		downClickCallback:    args.downClickCallback,
-		upClickCallback:      args.upClickCallback,
-		getSrvClientCallback: args.getSrvClientCallback,
-		loadSettingsCallback: args.loadSettingsCallback,
-		app:                  args.app,
-	}
-
-	p.emailMenuItem.Disable()
-	p.emailMenuItem.Hide()
-	p.refresh()
-	go p.updateMenu()
-
-	return &p
-}
-
-func (p *profileMenu) getProfiles() ([]Profile, error) {
-	conn, err := p.getSrvClientCallback(defaultFailTimeout)
-	if err != nil {
-		return nil, fmt.Errorf(getClientFMT, err)
-	}
-	currUser, err := user.Current()
-	if err != nil {
-		return nil, fmt.Errorf("get current user: %w", err)
-	}
-
-	profilesResp, err := conn.ListProfiles(p.ctx, &proto.ListProfilesRequest{
-		Username: currUser.Username,
-	})
-	if err != nil {
-		return nil, fmt.Errorf("list profiles: %w", err)
-	}
-
-	var profiles []Profile
-
-	for _, profile := range profilesResp.Profiles {
-		profiles = append(profiles, Profile{
-			ID:       profile.Id,
-			Name:     profile.Name,
-			IsActive: profile.IsActive,
-		})
-	}
-
-	return profiles, nil
-}
-
-func (p *profileMenu) refresh() {
-	p.mu.Lock()
-	defer p.mu.Unlock()
-
-	profiles, err := p.getProfiles()
-	if err != nil {
-		log.Errorf("failed to list profiles: %v", err)
-		return
-	}
-
-	// Clear existing profile items
-	p.clear(profiles)
-
-	currUser, err := user.Current()
-	if err != nil {
-		log.Errorf("failed to get current user: %v", err)
-		return
-	}
-
-	conn, err := p.getSrvClientCallback(defaultFailTimeout)
-	if err != nil {
-		log.Errorf("failed to get daemon client: %v", err)
-		return
-	}
-
-	activeProf, err := conn.GetActiveProfile(p.ctx, &proto.GetActiveProfileRequest{})
-	if err != nil {
-		log.Errorf("failed to get active profile: %v", err)
-		return
-	}
-
-	if activeProf.ProfileName == "default" || activeProf.Username == currUser.Username {
-		activeProfState, err := p.profileManager.GetProfileState(profilemanager.ID(activeProf.Id))
-		if err != nil {
-			log.Warnf("failed to get active profile state: %v", err)
-			p.emailMenuItem.Hide()
-		} else if activeProfState.Email != "" {
-			p.emailMenuItem.SetTitle(fmt.Sprintf("(%s)", activeProfState.Email))
-			p.emailMenuItem.Show()
-		}
-	}
-
-	for _, profile := range profiles {
-		item := p.profileMenuItem.AddSubMenuItem(formatProfileLabel(profile, profiles), "")
-		if profile.IsActive {
-			item.Check()
-		}
-
-		ctx, cancel := context.WithCancel(context.Background())
-		p.profileSubItems = append(p.profileSubItems, &subItem{item, ctx, cancel})
-
-		go func() {
-			for {
-				select {
-				case <-ctx.Done():
-					return // context cancelled
-				case _, ok := <-item.ClickedCh:
-					if !ok {
-						return // channel closed
-					}
-
-					// Handle profile selection
-					if profile.IsActive {
-						log.Infof("Profile '%s' is already active", profile.Name)
-						return
-					}
-					conn, err := p.getSrvClientCallback(defaultFailTimeout)
-					if err != nil {
-						log.Errorf("failed to get daemon client: %v", err)
-						return
-					}
-
-					switchResp, err := conn.SwitchProfile(ctx, &proto.SwitchProfileRequest{
-						ProfileName: &profile.ID,
-						Username:    &currUser.Username,
-					})
-					if err != nil {
-						log.Errorf("failed to switch profile: %v", err)
-						// show  notification dialog
-						p.serviceClient.notifier.Send("Error", "Failed to switch profile")
-						return
-					}
-
-					err = p.profileManager.SwitchProfile(profilemanager.ID(switchResp.Id))
-					if err != nil {
-						log.Errorf("failed to switch profile '%s': %v", profile.Name, err)
-						return
-					}
-
-					log.Infof("Switched to profile '%s'", profile.Name)
-
-					status, err := conn.Status(ctx, &proto.StatusRequest{})
-					if err != nil {
-						log.Errorf("failed to get status after switching profile: %v", err)
-						return
-					}
-
-					if status.Status == string(internal.StatusConnected) {
-						if err := p.downClickCallback(); err != nil {
-							log.Errorf("failed to handle down click after switching profile: %v", err)
-						}
-					}
-
-					if p.serviceClient.connectCancel != nil {
-						p.serviceClient.connectCancel()
-					}
-
-					connectCtx, connectCancel := context.WithCancel(p.ctx)
-					p.serviceClient.connectCancel = connectCancel
-
-					if err := p.upClickCallback(connectCtx); err != nil {
-						log.Errorf("failed to handle up click after switching profile: %v", err)
-					}
-
-					connectCancel()
-
-					p.refresh()
-					p.loadSettingsCallback()
-				}
-			}
-		}()
-
-	}
-	ctx, cancel := context.WithCancel(context.Background())
-	manageItem := p.profileMenuItem.AddSubMenuItem("Manage Profiles", "")
-	p.manageProfilesSubItem = &subItem{manageItem, ctx, cancel}
-
-	go func() {
-		for {
-			select {
-			case <-ctx.Done():
-				return
-			case _, ok := <-manageItem.ClickedCh:
-				if !ok {
-					return
-				}
-				p.eventHandler.runSelfCommand(p.ctx, "profiles", "true")
-				p.refresh()
-				p.loadSettingsCallback()
-			}
-		}
-	}()
-
-	// Add Logout menu item
-	ctx2, cancel2 := context.WithCancel(context.Background())
-	logoutItem := p.profileMenuItem.AddSubMenuItem("Deregister", "")
-	p.logoutSubItem = &subItem{logoutItem, ctx2, cancel2}
-
-	go func() {
-		for {
-			select {
-			case <-ctx2.Done():
-				return
-			case _, ok := <-logoutItem.ClickedCh:
-				if !ok {
-					return
-				}
-				if err := p.eventHandler.logout(p.ctx); err != nil {
-					log.Errorf("logout failed: %v", err)
-					p.serviceClient.notifier.Send("Error", "Failed to deregister")
-				} else {
-					p.serviceClient.notifier.Send("Success", "Deregistered successfully")
-				}
-			}
-		}
-	}()
-
-	if activeProf.ProfileName == "default" || activeProf.Username == currUser.Username {
-		p.profileMenuItem.SetTitle(activeProf.ProfileName)
-	} else {
-		p.profileMenuItem.SetTitle(fmt.Sprintf("Profile: %s (User: %s)", activeProf.ProfileName, activeProf.Username))
-		p.emailMenuItem.Hide()
-	}
-
-}
-
-func (p *profileMenu) clear(profiles []Profile) {
-	for _, item := range p.profileSubItems {
-		item.Remove()
-		item.cancel()
-	}
-	p.profileSubItems = make([]*subItem, 0, len(profiles))
-	p.profilesState = profiles
-
-	if p.manageProfilesSubItem != nil {
-		p.manageProfilesSubItem.Remove()
-		p.manageProfilesSubItem.cancel()
-		p.manageProfilesSubItem = nil
-	}
-
-	if p.logoutSubItem != nil {
-		p.logoutSubItem.Remove()
-		p.logoutSubItem.cancel()
-		p.logoutSubItem = nil
-	}
-}
-
-// setEnabled greys out (Disable) the profile menu and every existing
-// sub-item when the daemon reports the kill switch active, so the user
-// sees the menu but cannot enter "Manage Profiles" or switch profile.
-// Previously this used Hide() on the parent, but Fyne's systray on
-// Windows does not propagate Hide() to a parent that already has
-// children — the submenu kept popping up and accepting clicks. Disable
-// is the reliable visual lock.
-func (p *profileMenu) setEnabled(enabled bool) {
-	if p.profileMenuItem == nil {
-		return
-	}
-	p.mu.Lock()
-	defer p.mu.Unlock()
-
-	if enabled {
-		p.profileMenuItem.Enable()
-		p.profileMenuItem.SetTooltip("")
-	} else {
-		p.profileMenuItem.Disable()
-		p.profileMenuItem.SetTooltip("Profiles are disabled by daemon")
-	}
-
-	apply := func(item *systray.MenuItem) {
-		if item == nil {
-			return
-		}
-		if enabled {
-			item.Enable()
-		} else {
-			item.Disable()
-		}
-	}
-	for _, sub := range p.profileSubItems {
-		if sub != nil {
-			apply(sub.MenuItem)
-		}
-	}
-	if p.manageProfilesSubItem != nil {
-		apply(p.manageProfilesSubItem.MenuItem)
-	}
-	if p.logoutSubItem != nil {
-		apply(p.logoutSubItem.MenuItem)
-	}
-}
-
-func (p *profileMenu) updateMenu() {
-	// check every second
-	ticker := time.NewTicker(time.Second)
-	defer ticker.Stop()
-
-	for {
-		select {
-		case <-ticker.C:
-			// get profilesList
-			profiles, err := p.getProfiles()
-			if err != nil {
-				log.Errorf("failed to list profiles: %v", err)
-				continue
-			}
-
-			sort.Slice(profiles, func(i, j int) bool {
-				if profiles[i].Name != profiles[j].Name {
-					return profiles[i].Name < profiles[j].Name
-				}
-				return profiles[i].ID < profiles[j].ID
-			})
-
-			p.mu.Lock()
-			state := p.profilesState
-			p.mu.Unlock()
-
-			sort.Slice(state, func(i, j int) bool {
-				return state[i].Name < state[j].Name
-			})
-
-			if slices.Equal(profiles, state) {
-				continue
-			}
-
-			p.refresh()
-		case <-p.ctx.Done():
-			return // context cancelled
-
-		}
-	}
-}
diff --git a/client/ui/quickactions.go b/client/ui/quickactions.go
deleted file mode 100644
index bf47ac434..000000000
--- a/client/ui/quickactions.go
+++ /dev/null
@@ -1,349 +0,0 @@
-//go:build !(linux && 386)
-
-//go:generate fyne bundle -o quickactions_assets.go assets/connected.png
-//go:generate fyne bundle -o quickactions_assets.go -append assets/disconnected.png
-package main
-
-import (
-	"context"
-	_ "embed"
-	"fmt"
-	"runtime"
-	"sync/atomic"
-	"time"
-
-	"fyne.io/fyne/v2"
-	"fyne.io/fyne/v2/canvas"
-	"fyne.io/fyne/v2/container"
-	"fyne.io/fyne/v2/layout"
-	"fyne.io/fyne/v2/widget"
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal"
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-type quickActionsUiState struct {
-	connectionStatus      string
-	isToggleButtonEnabled bool
-	isConnectionChanged   bool
-	toggleAction          func()
-}
-
-func newQuickActionsUiState() quickActionsUiState {
-	return quickActionsUiState{
-		connectionStatus:      string(internal.StatusIdle),
-		isToggleButtonEnabled: false,
-		isConnectionChanged:   false,
-	}
-}
-
-type clientConnectionStatusProvider interface {
-	connectionStatus(ctx context.Context) (string, error)
-}
-
-type daemonClientConnectionStatusProvider struct {
-	client proto.DaemonServiceClient
-}
-
-func (d daemonClientConnectionStatusProvider) connectionStatus(ctx context.Context) (string, error) {
-	childCtx, cancel := context.WithTimeout(ctx, 400*time.Millisecond)
-	defer cancel()
-	status, err := d.client.Status(childCtx, &proto.StatusRequest{})
-	if err != nil {
-		return "", err
-	}
-
-	return status.Status, nil
-}
-
-type clientCommand interface {
-	execute() error
-}
-
-type connectCommand struct {
-	connectClient func() error
-}
-
-func (c connectCommand) execute() error {
-	return c.connectClient()
-}
-
-type disconnectCommand struct {
-	disconnectClient func() error
-}
-
-func (c disconnectCommand) execute() error {
-	return c.disconnectClient()
-}
-
-type quickActionsViewModel struct {
-	provider                   clientConnectionStatusProvider
-	connect                    clientCommand
-	disconnect                 clientCommand
-	uiChan                     chan quickActionsUiState
-	isWatchingConnectionStatus atomic.Bool
-}
-
-func newQuickActionsViewModel(ctx context.Context, provider clientConnectionStatusProvider, connect, disconnect clientCommand, uiChan chan quickActionsUiState) {
-	viewModel := quickActionsViewModel{
-		provider:   provider,
-		connect:    connect,
-		disconnect: disconnect,
-		uiChan:     uiChan,
-	}
-
-	viewModel.isWatchingConnectionStatus.Store(true)
-
-	// base UI status
-	uiChan <- newQuickActionsUiState()
-
-	// this retrieves the current connection status
-	// and pushes the UI state that reflects it via uiChan
-	go viewModel.watchConnectionStatus(ctx)
-}
-
-func (q *quickActionsViewModel) updateUiState(ctx context.Context) {
-	uiState := newQuickActionsUiState()
-	connectionStatus, err := q.provider.connectionStatus(ctx)
-
-	if err != nil {
-		log.Errorf("Status: Error - %v", err)
-		q.uiChan <- uiState
-		return
-	}
-
-	if connectionStatus == string(internal.StatusConnected) {
-		uiState.toggleAction = func() {
-			q.executeCommand(q.disconnect)
-		}
-	} else {
-		uiState.toggleAction = func() {
-			q.executeCommand(q.connect)
-		}
-	}
-
-	uiState.isToggleButtonEnabled = true
-	uiState.connectionStatus = connectionStatus
-	q.uiChan <- uiState
-}
-
-func (q *quickActionsViewModel) watchConnectionStatus(ctx context.Context) {
-	ticker := time.NewTicker(1000 * time.Millisecond)
-	defer ticker.Stop()
-
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-ticker.C:
-			if q.isWatchingConnectionStatus.Load() {
-				q.updateUiState(ctx)
-			}
-		}
-	}
-}
-
-func (q *quickActionsViewModel) executeCommand(command clientCommand) {
-	uiState := newQuickActionsUiState()
-	// newQuickActionsUiState starts with Idle connection status,
-	// and all that's necessary here is to just disable the toggle button.
-	uiState.connectionStatus = ""
-
-	q.uiChan <- uiState
-
-	q.isWatchingConnectionStatus.Store(false)
-
-	err := command.execute()
-
-	if err != nil {
-		log.Errorf("Status: Error - %v", err)
-		q.isWatchingConnectionStatus.Store(true)
-	} else {
-		uiState = newQuickActionsUiState()
-		uiState.isConnectionChanged = true
-		q.uiChan <- uiState
-	}
-}
-
-func getSystemTrayName() string {
-	os := runtime.GOOS
-	switch os {
-	case "darwin":
-		return "menu bar"
-	default:
-		return "system tray"
-	}
-}
-
-func (s *serviceClient) getNetBirdImage(name string, content []byte) *canvas.Image {
-	imageSize := fyne.NewSize(64, 64)
-
-	resource := fyne.NewStaticResource(name, content)
-	image := canvas.NewImageFromResource(resource)
-	image.FillMode = canvas.ImageFillContain
-	image.SetMinSize(imageSize)
-	image.Resize(imageSize)
-
-	return image
-}
-
-type quickActionsUiComponents struct {
-	content                                   *fyne.Container
-	toggleConnectionButton                    *widget.Button
-	connectedLabelText, disconnectedLabelText string
-	connectedImage, disconnectedImage         *canvas.Image
-	connectedCircleRes, disconnectedCircleRes fyne.Resource
-}
-
-// applyQuickActionsUiState applies a single UI state to the quick actions window.
-// It closes the window and returns true if the connection status has changed,
-// in which case the caller should stop processing further states.
-func (s *serviceClient) applyQuickActionsUiState(
-	uiState quickActionsUiState,
-	components quickActionsUiComponents,
-) bool {
-	if uiState.isConnectionChanged {
-		fyne.DoAndWait(func() {
-			s.wQuickActions.Close()
-		})
-		return true
-	}
-
-	var logo *canvas.Image
-	var buttonText string
-	var buttonIcon fyne.Resource
-
-	if uiState.connectionStatus == string(internal.StatusConnected) {
-		buttonText = components.connectedLabelText
-		buttonIcon = components.connectedCircleRes
-		logo = components.connectedImage
-	} else if uiState.connectionStatus == string(internal.StatusIdle) {
-		buttonText = components.disconnectedLabelText
-		buttonIcon = components.disconnectedCircleRes
-		logo = components.disconnectedImage
-	}
-
-	fyne.DoAndWait(func() {
-		if buttonText != "" {
-			components.toggleConnectionButton.SetText(buttonText)
-		}
-
-		if buttonIcon != nil {
-			components.toggleConnectionButton.SetIcon(buttonIcon)
-		}
-
-		if uiState.isToggleButtonEnabled {
-			components.toggleConnectionButton.Enable()
-		} else {
-			components.toggleConnectionButton.Disable()
-		}
-
-		components.toggleConnectionButton.OnTapped = func() {
-			if uiState.toggleAction != nil {
-				go uiState.toggleAction()
-			}
-		}
-
-		components.toggleConnectionButton.Refresh()
-
-		// the second position in the content's object array is the NetBird logo.
-		if logo != nil {
-			components.content.Objects[1] = logo
-			components.content.Refresh()
-		}
-	})
-
-	return false
-}
-
-// showQuickActionsUI displays a simple window with the NetBird logo and a connection toggle button.
-func (s *serviceClient) showQuickActionsUI() {
-	s.wQuickActions = s.app.NewWindow("NetBird")
-	vmCtx, vmCancel := context.WithCancel(s.ctx)
-	s.wQuickActions.SetOnClosed(vmCancel)
-
-	client, err := s.getSrvClient(defaultFailTimeout)
-
-	connCmd := connectCommand{
-		connectClient: func() error {
-			return s.menuUpClick(s.ctx)
-		},
-	}
-
-	disConnCmd := disconnectCommand{
-		disconnectClient: func() error {
-			return s.menuDownClick()
-		},
-	}
-
-	if err != nil {
-		log.Errorf("get service client: %v", err)
-		return
-	}
-
-	uiChan := make(chan quickActionsUiState, 1)
-	newQuickActionsViewModel(vmCtx, daemonClientConnectionStatusProvider{client: client}, connCmd, disConnCmd, uiChan)
-
-	connectedImage := s.getNetBirdImage("netbird.png", iconAbout)
-	disconnectedImage := s.getNetBirdImage("netbird-disconnected.png", iconAboutDisconnected)
-
-	connectedCircle := canvas.NewImageFromResource(resourceConnectedPng)
-	disconnectedCircle := canvas.NewImageFromResource(resourceDisconnectedPng)
-
-	connectedLabelText := "Disconnect"
-	disconnectedLabelText := "Connect"
-
-	toggleConnectionButton := widget.NewButtonWithIcon(disconnectedLabelText, disconnectedCircle.Resource, func() {
-		// This button's tap function will be set when an ui state arrives via the uiChan channel.
-	})
-
-	// Button starts disabled until the first ui state arrives.
-	toggleConnectionButton.Disable()
-
-	hintLabelText := fmt.Sprintf("You can always access NetBird from your %s.", getSystemTrayName())
-	hintLabel := widget.NewLabel(hintLabelText)
-
-	content := container.NewVBox(
-		layout.NewSpacer(),
-		disconnectedImage,
-		layout.NewSpacer(),
-		container.NewCenter(toggleConnectionButton),
-		layout.NewSpacer(),
-		container.NewCenter(hintLabel),
-	)
-
-	// this watches for ui state updates.
-	go func() {
-
-		for {
-			select {
-			case <-vmCtx.Done():
-				return
-			case uiState, ok := <-uiChan:
-				if !ok {
-					return
-				}
-
-				closed := s.applyQuickActionsUiState(
-					uiState,
-					quickActionsUiComponents{
-						content,
-						toggleConnectionButton,
-						connectedLabelText, disconnectedLabelText,
-						connectedImage, disconnectedImage,
-						connectedCircle.Resource, disconnectedCircle.Resource,
-					},
-				)
-				if closed {
-					return
-				}
-			}
-		}
-	}()
-
-	s.wQuickActions.SetContent(content)
-	s.wQuickActions.Resize(fyne.NewSize(400, 200))
-	s.wQuickActions.SetFixedSize(true)
-	s.wQuickActions.Show()
-}
diff --git a/client/ui/quickactions_assets.go b/client/ui/quickactions_assets.go
deleted file mode 100644
index 9ff5e85a2..000000000
--- a/client/ui/quickactions_assets.go
+++ /dev/null
@@ -1,23 +0,0 @@
-// auto-generated
-// Code generated by '$ fyne bundle'. DO NOT EDIT.
-
-package main
-
-import (
-	_ "embed"
-	"fyne.io/fyne/v2"
-)
-
-//go:embed assets/connected.png
-var resourceConnectedPngData []byte
-var resourceConnectedPng = &fyne.StaticResource{
-	StaticName:    "assets/connected.png",
-	StaticContent: resourceConnectedPngData,
-}
-
-//go:embed assets/disconnected.png
-var resourceDisconnectedPngData []byte
-var resourceDisconnectedPng = &fyne.StaticResource{
-	StaticName:    "assets/disconnected.png",
-	StaticContent: resourceDisconnectedPngData,
-}
diff --git a/client/ui/recenter_linux.go b/client/ui/recenter_linux.go
new file mode 100644
index 000000000..25c468d7f
--- /dev/null
+++ b/client/ui/recenter_linux.go
@@ -0,0 +1,13 @@
+//go:build linux && !(linux && 386)
+
+package main
+
+// recenterOnShowPredicate returns a per-show predicate; re-centering is only
+// needed under the minimal-WM / in-process-XEmbed-tray environment, which neither
+// centers small windows nor restores position across hide -> show. Evaluated per
+// show, not at startup, because the XEmbed tray can appear after the UI starts
+// (panel and autostarted app race at login); xembedTrayAvailable is a cheap,
+// side-effect-free probe safe to call repeatedly.
+func recenterOnShowPredicate() func() bool {
+	return xembedTrayAvailable
+}
diff --git a/client/ui/recenter_other.go b/client/ui/recenter_other.go
new file mode 100644
index 000000000..18ffe8730
--- /dev/null
+++ b/client/ui/recenter_other.go
@@ -0,0 +1,10 @@
+//go:build (!linux || (linux && 386)) && !freebsd && !android && !ios && !js
+
+package main
+
+// recenterOnShowPredicate returns nil off Linux: macOS and Windows WMs restore
+// window position across hide -> show themselves, so Go-side re-centering would
+// only fight a window the user moved.
+func recenterOnShowPredicate() func() bool {
+	return nil
+}
diff --git a/client/ui/services/autostart.go b/client/ui/services/autostart.go
new file mode 100644
index 000000000..f7e3aeea0
--- /dev/null
+++ b/client/ui/services/autostart.go
@@ -0,0 +1,52 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/wailsapp/wails/v3/pkg/application"
+)
+
+// Autostart facade over Wails' AutostartManager. The OS login-item registration
+// is the single source of truth; nothing is mirrored to preferences.
+type Autostart struct {
+	mgr *application.AutostartManager
+}
+
+func NewAutostart(mgr *application.AutostartManager) *Autostart {
+	return &Autostart{mgr: mgr}
+}
+
+func (a *Autostart) Supported(_ context.Context) bool {
+	_, err := a.mgr.Status()
+	return !errors.Is(err, application.ErrAutostartNotSupported)
+}
+
+// IsEnabled returns false without error on unsupported platforms.
+func (a *Autostart) IsEnabled(_ context.Context) (bool, error) {
+	enabled, err := a.mgr.IsEnabled()
+	if err != nil {
+		if errors.Is(err, application.ErrAutostartNotSupported) {
+			return false, nil
+		}
+		return false, fmt.Errorf("read autostart state: %w", err)
+	}
+	return enabled, nil
+}
+
+// SetEnabled takes effect on the next login, not immediately.
+func (a *Autostart) SetEnabled(_ context.Context, enabled bool) error {
+	if enabled {
+		if err := a.mgr.Enable(); err != nil {
+			return fmt.Errorf("enable autostart: %w", err)
+		}
+		return nil
+	}
+	if err := a.mgr.Disable(); err != nil {
+		return fmt.Errorf("disable autostart: %w", err)
+	}
+	return nil
+}
diff --git a/client/ui/services/compat.go b/client/ui/services/compat.go
new file mode 100644
index 000000000..0cc6dd99f
--- /dev/null
+++ b/client/ui/services/compat.go
@@ -0,0 +1,40 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// Compat answers whether the running daemon is new enough to drive this UI.
+type Compat struct {
+	conn DaemonConn
+}
+
+func NewCompat(conn DaemonConn) *Compat {
+	return &Compat{conn: conn}
+}
+
+// DaemonReady probes the WailsUIReady RPC once. A true result means the daemon
+// implements it and is compatible. An Unimplemented response means the daemon
+// predates this UI and is too old; the caller should surface an upgrade prompt.
+// Any other error (daemon not running, transport failure) is returned so the
+// frontend can tell "outdated" apart from "not reachable".
+func (c *Compat) DaemonReady(ctx context.Context) (bool, error) {
+	client, err := c.conn.Client()
+	if err != nil {
+		return false, err
+	}
+	if _, err := client.WailsUIReady(ctx, &proto.WailsUIReadyRequest{}); err != nil {
+		if st, ok := status.FromError(err); ok && st.Code() == codes.Unimplemented {
+			return false, nil
+		}
+		return false, err
+	}
+	return true, nil
+}
diff --git a/client/ui/services/conn.go b/client/ui/services/conn.go
new file mode 100644
index 000000000..531abe7d9
--- /dev/null
+++ b/client/ui/services/conn.go
@@ -0,0 +1,13 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import "github.com/netbirdio/netbird/client/proto"
+
+// DaemonConn returns a lazy gRPC client to the NetBird daemon.
+// All services receive a DaemonConn so they share a single connection.
+type DaemonConn interface {
+	Client() (proto.DaemonServiceClient, error)
+}
+
+func ptrStr(s string) *string { return &s }
diff --git a/client/ui/services/connection.go b/client/ui/services/connection.go
new file mode 100644
index 000000000..a23a526e6
--- /dev/null
+++ b/client/ui/services/connection.go
@@ -0,0 +1,223 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/exec"
+	"os/user"
+	"runtime"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// LoginParams are the inputs to Login.
+type LoginParams struct {
+	ProfileName   string `json:"profileName"`
+	Username      string `json:"username"`
+	ManagementURL string `json:"managementUrl"`
+	SetupKey      string `json:"setupKey"`
+	PreSharedKey  string `json:"preSharedKey"`
+	Hostname      string `json:"hostname"`
+	Hint          string `json:"hint"`
+}
+
+// LoginResult is the daemon's reply to Login.
+type LoginResult struct {
+	NeedsSSOLogin           bool   `json:"needsSsoLogin"`
+	UserCode                string `json:"userCode"`
+	VerificationURI         string `json:"verificationUri"`
+	VerificationURIComplete string `json:"verificationUriComplete"`
+}
+
+// WaitSSOParams are the inputs to WaitSSOLogin.
+type WaitSSOParams struct {
+	UserCode string `json:"userCode"`
+	Hostname string `json:"hostname"`
+}
+
+// UpParams selects the profile to bring up.
+type UpParams struct {
+	ProfileName string `json:"profileName"`
+	Username    string `json:"username"`
+}
+
+// LogoutParams selects the profile to log out.
+type LogoutParams struct {
+	ProfileName string `json:"profileName"`
+	Username    string `json:"username"`
+}
+
+// Connection groups the daemon RPCs that drive login / connect / disconnect.
+type Connection struct {
+	conn       DaemonConn
+	classifier errorClassifier
+}
+
+// NewConnection wires up a Connection. translator or prefs may be nil, in which
+// case classifyDaemonError falls back to the bare error key.
+func NewConnection(conn DaemonConn, translator ErrorTranslator, prefs LanguagePreference) *Connection {
+	return &Connection{conn: conn, classifier: errorClassifier{translator: translator, prefs: prefs}}
+}
+
+func (s *Connection) Login(ctx context.Context, p LoginParams) (LoginResult, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return LoginResult{}, err
+	}
+
+	// No pre-Login Down: Login dislodges a pending WaitSSOLogin itself, and a
+	// defensive Down would only flash an Idle blink in the tray during handoff.
+
+	// Fall back to the daemon's active profile and the current OS user.
+	profileName := p.ProfileName
+	username := p.Username
+	if profileName == "" {
+		if active, aerr := cli.GetActiveProfile(ctx, &proto.GetActiveProfileRequest{}); aerr == nil {
+			// Address the active profile by ID (the daemon resolves it as a
+			// handle); names can collide, the ID cannot.
+			profileName = active.GetId()
+			if username == "" {
+				username = active.GetUsername()
+			}
+		}
+	}
+	if username == "" {
+		if u, uerr := user.Current(); uerr == nil {
+			username = u.Username
+		}
+	}
+
+	req := &proto.LoginRequest{
+		ManagementUrl:       p.ManagementURL,
+		SetupKey:            p.SetupKey,
+		Hostname:            p.Hostname,
+		IsUnixDesktopClient: runtime.GOOS == "linux",
+	}
+	if profileName != "" {
+		req.ProfileName = ptrStr(profileName)
+	}
+	if username != "" {
+		req.Username = ptrStr(username)
+	}
+	if p.PreSharedKey != "" {
+		req.OptionalPreSharedKey = ptrStr(p.PreSharedKey)
+	}
+	if p.Hint != "" {
+		req.Hint = ptrStr(p.Hint)
+	}
+
+	resp, err := cli.Login(ctx, req)
+	if err != nil {
+		return LoginResult{}, s.classifyDaemonError(err)
+	}
+	return LoginResult{
+		NeedsSSOLogin:           resp.GetNeedsSSOLogin(),
+		UserCode:                resp.GetUserCode(),
+		VerificationURI:         resp.GetVerificationURI(),
+		VerificationURIComplete: resp.GetVerificationURIComplete(),
+	}, nil
+}
+
+func (s *Connection) WaitSSOLogin(ctx context.Context, p WaitSSOParams) (string, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return "", err
+	}
+	resp, err := cli.WaitSSOLogin(ctx, &proto.WaitSSOLoginRequest{
+		UserCode: p.UserCode,
+		Hostname: p.Hostname,
+	})
+	if err != nil {
+		return "", s.classifyDaemonError(err)
+	}
+	return resp.GetEmail(), nil
+}
+
+func (s *Connection) Up(ctx context.Context, p UpParams) error {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return err
+	}
+	// Always async: status updates flow via SubscribeStatus.
+	req := &proto.UpRequest{Async: true}
+	if p.ProfileName != "" {
+		req.ProfileName = ptrStr(p.ProfileName)
+	}
+	if p.Username != "" {
+		req.Username = ptrStr(p.Username)
+	}
+	if _, err = cli.Up(ctx, req); err != nil {
+		return s.classifyDaemonError(err)
+	}
+	return nil
+}
+
+func (s *Connection) Down(ctx context.Context) error {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return err
+	}
+	if _, err = cli.Down(ctx, &proto.DownRequest{}); err != nil {
+		return s.classifyDaemonError(err)
+	}
+	return nil
+}
+
+// OpenURL opens url in an external browser; the embedded webview blocks
+// window.open, so the SSO verification page can't pop inline. Honors $BROWSER
+// before the platform default.
+func (s *Connection) OpenURL(url string) error {
+	if browser := os.Getenv("BROWSER"); browser != "" {
+		return exec.Command(browser, url).Start()
+	}
+	switch runtime.GOOS {
+	case "windows":
+		return exec.Command("rundll32", "url.dll,FileProtocolHandler", url).Start()
+	case "darwin":
+		return exec.Command("open", url).Start()
+	case "linux":
+		return exec.Command("xdg-open", url).Start()
+	default:
+		return fmt.Errorf("unsupported platform")
+	}
+}
+
+func (s *Connection) Logout(ctx context.Context, p LogoutParams) error {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return err
+	}
+	req := &proto.LogoutRequest{}
+	if p.ProfileName != "" {
+		req.ProfileName = ptrStr(p.ProfileName)
+	}
+	if p.Username != "" {
+		req.Username = ptrStr(p.Username)
+	}
+	if _, err = cli.Logout(ctx, req); err != nil {
+		return s.classifyDaemonError(err)
+	}
+
+	// The daemon runs as root and can't reach the user-owned per-profile state
+	// file holding the account email (see Profiles.List), so clear the stale
+	// email here; the next SSO login recreates it.
+	if p.ProfileName != "" {
+		if err := profilemanager.NewProfileManager().RemoveProfileState(p.ProfileName); err != nil {
+			// Non-fatal: the logout itself succeeded.
+			log.Warnf("failed to remove profile state for %s: %v", p.ProfileName, err)
+		}
+	}
+
+	return nil
+}
+
+// classifyDaemonError maps a gRPC error to a localised ClientError.
+func (s *Connection) classifyDaemonError(err error) *ClientError {
+	return s.classifier.classify(err)
+}
diff --git a/client/ui/services/cursor_darwin.go b/client/ui/services/cursor_darwin.go
new file mode 100644
index 000000000..a927ff719
--- /dev/null
+++ b/client/ui/services/cursor_darwin.go
@@ -0,0 +1,42 @@
+//go:build darwin
+
+package services
+
+/*
+#cgo CFLAGS: -x objective-c
+#cgo LDFLAGS: -framework Foundation -framework Cocoa -framework AppKit
+#import <Cocoa/Cocoa.h>
+#import <AppKit/AppKit.h>
+
+typedef struct CursorPoint {
+    int x;
+    int y;
+    int ok;
+} CursorPoint;
+
+// NSEvent.mouseLocation is Y-up from primary's bottom-left; flip against
+// the primary's frame height so the point matches Wails' Y-down Screen.Bounds.
+CursorPoint nbGetCursorPos(void) {
+    CursorPoint p = {0, 0, 0};
+    NSArray<NSScreen *> *screens = [NSScreen screens];
+    if (screens == nil || screens.count == 0) return p;
+    NSScreen *primary = [screens firstObject];
+    if (primary == nil) return p;
+    NSPoint loc = [NSEvent mouseLocation];
+    p.x = (int)loc.x;
+    p.y = (int)(primary.frame.size.height - loc.y);
+    p.ok = 1;
+    return p;
+}
+*/
+import "C"
+
+import "github.com/wailsapp/wails/v3/pkg/application"
+
+func getCursorPosition(_ *application.App) (application.Point, bool) {
+	res := C.nbGetCursorPos()
+	if res.ok == 0 {
+		return application.Point{}, false
+	}
+	return application.Point{X: int(res.x), Y: int(res.y)}, true
+}
diff --git a/client/ui/services/cursor_linux.go b/client/ui/services/cursor_linux.go
new file mode 100644
index 000000000..760fd5b86
--- /dev/null
+++ b/client/ui/services/cursor_linux.go
@@ -0,0 +1,53 @@
+//go:build linux
+
+package services
+
+/*
+#cgo pkg-config: x11
+#cgo LDFLAGS: -lX11
+#include <X11/Xlib.h>
+#include <stdlib.h>
+
+typedef struct CursorPoint {
+    int x;
+    int y;
+    int ok;
+} CursorPoint;
+
+// XQueryPointer works on X11 and, via XWayland, on Wayland sessions.
+// ok=0 when no X server is reachable.
+CursorPoint nbGetCursorPos(void) {
+    CursorPoint p = {0, 0, 0};
+    Display *dpy = XOpenDisplay(NULL);
+    if (!dpy) return p;
+    Window root = DefaultRootWindow(dpy);
+    if (root == 0) { XCloseDisplay(dpy); return p; }
+    Window root_return = 0, child_return = 0;
+    int root_x = 0, root_y = 0, win_x = 0, win_y = 0;
+    unsigned int mask_return = 0;
+    if (XQueryPointer(dpy, root, &root_return, &child_return,
+                      &root_x, &root_y, &win_x, &win_y, &mask_return)) {
+        p.x = root_x;
+        p.y = root_y;
+        p.ok = 1;
+    }
+    XCloseDisplay(dpy);
+    return p;
+}
+*/
+import "C"
+
+import "github.com/wailsapp/wails/v3/pkg/application"
+
+func getCursorPosition(app *application.App) (application.Point, bool) {
+	res := C.nbGetCursorPos()
+	if res.ok == 0 {
+		return application.Point{}, false
+	}
+	p := application.Point{X: int(res.x), Y: int(res.y)}
+	// X11 root coords are physical pixels; Screen.Bounds is in DIPs.
+	if app == nil || app.Screen == nil {
+		return p, true
+	}
+	return app.Screen.PhysicalToDipPoint(p), true
+}
diff --git a/client/ui/services/cursor_other.go b/client/ui/services/cursor_other.go
new file mode 100644
index 000000000..7f35ff438
--- /dev/null
+++ b/client/ui/services/cursor_other.go
@@ -0,0 +1,9 @@
+//go:build !darwin && !windows && !linux && !freebsd && !android && !ios && !js
+
+package services
+
+import "github.com/wailsapp/wails/v3/pkg/application"
+
+func getCursorPosition(_ *application.App) (application.Point, bool) {
+	return application.Point{}, false
+}
diff --git a/client/ui/services/cursor_windows.go b/client/ui/services/cursor_windows.go
new file mode 100644
index 000000000..42ed32d74
--- /dev/null
+++ b/client/ui/services/cursor_windows.go
@@ -0,0 +1,17 @@
+//go:build windows
+
+package services
+
+import (
+	"github.com/wailsapp/wails/v3/pkg/application"
+	"github.com/wailsapp/wails/v3/pkg/w32"
+)
+
+func getCursorPosition(app *application.App) (application.Point, bool) {
+	x, y, ok := w32.GetCursorPos()
+	if !ok || app == nil || app.Screen == nil {
+		return application.Point{}, false
+	}
+	// GetCursorPos is in physical pixels; Screen.Bounds is in DIPs.
+	return app.Screen.PhysicalToDipPoint(application.Point{X: x, Y: y}), true
+}
diff --git a/client/ui/services/daemon_feed.go b/client/ui/services/daemon_feed.go
new file mode 100644
index 000000000..632581fe9
--- /dev/null
+++ b/client/ui/services/daemon_feed.go
@@ -0,0 +1,590 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/cenkalti/backoff/v4"
+	log "github.com/sirupsen/logrus"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/client/ui/authsession"
+	"github.com/netbirdio/netbird/client/ui/updater"
+)
+
+const (
+	EventStatusSnapshot = "netbird:status"
+	// EventDaemonNotification carries each SubscribeEvents message. Auto-update
+	// SystemEvents are also forwarded to updater.Holder.OnSystemEvent so the typed
+	// update state needs no second daemon subscription.
+	EventDaemonNotification = "netbird:event"
+	// EventProfileChanged fires after a daemon-side switch (payload: the new
+	// ProfileRef). The daemon emits no profile event, so this is the only signal
+	// that lets a flip driven from one surface paint in the others.
+	EventProfileChanged = "netbird:profile:changed"
+	// EventSessionWarning is a typed sibling of EventDaemonNotification so
+	// subscribers needn't filter the notification firehose. Consumers branch on
+	// SessionWarning.Final to tell the T-10 event from the T-2 fallback.
+	EventSessionWarning = "netbird:session:warning"
+
+	// StatusDaemonUnavailable is the synthetic Status emitted when the daemon's
+	// gRPC socket is unreachable. No internal.Status* collides with this label.
+	StatusDaemonUnavailable = "DaemonUnavailable"
+
+	// Daemon connection status strings — mirror internal.Status* in
+	// client/internal/state.go.
+	StatusConnected      = "Connected"
+	StatusConnecting     = "Connecting"
+	StatusIdle           = "Idle"
+	StatusNeedsLogin     = "NeedsLogin"
+	StatusLoginFailed    = "LoginFailed"
+	StatusSessionExpired = "SessionExpired"
+
+	// SeverityCritical is the lower-cased proto SystemEvent_CRITICAL severity, as
+	// emitted by systemEventFromProto. Critical events bypass the notifications gate.
+	SeverityCritical = "critical"
+)
+
+// Emitter sends a named payload to the frontend. Satisfied by Wails app.Event.
+type Emitter interface {
+	Emit(name string, data ...any) bool
+}
+
+// SystemEvent is the frontend-facing shape of a daemon SystemEvent.
+type SystemEvent struct {
+	ID          string            `json:"id"`
+	Severity    string            `json:"severity"`
+	Category    string            `json:"category"`
+	Message     string            `json:"message"`
+	UserMessage string            `json:"userMessage"`
+	Timestamp   int64             `json:"timestamp"`
+	Metadata    map[string]string `json:"metadata"`
+}
+
+// PeerStatus is the frontend-facing shape of a daemon PeerState.
+type PeerStatus struct {
+	IP                         string   `json:"ip"`
+	IPv6                       string   `json:"ipv6"`
+	PubKey                     string   `json:"pubKey"`
+	ConnStatus                 string   `json:"connStatus"`
+	ConnStatusUpdateUnix       int64    `json:"connStatusUpdateUnix"`
+	Relayed                    bool     `json:"relayed"`
+	LocalIceCandidateType      string   `json:"localIceCandidateType"`
+	RemoteIceCandidateType     string   `json:"remoteIceCandidateType"`
+	LocalIceCandidateEndpoint  string   `json:"localIceCandidateEndpoint"`
+	RemoteIceCandidateEndpoint string   `json:"remoteIceCandidateEndpoint"`
+	Fqdn                       string   `json:"fqdn"`
+	BytesRx                    int64    `json:"bytesRx"`
+	BytesTx                    int64    `json:"bytesTx"`
+	LatencyMs                  int64    `json:"latencyMs"`
+	RelayAddress               string   `json:"relayAddress"`
+	LastHandshakeUnix          int64    `json:"lastHandshakeUnix"`
+	RosenpassEnabled           bool     `json:"rosenpassEnabled"`
+	Networks                   []string `json:"networks"`
+}
+
+// PeerLink is this peer's connection to its mgmt or signal server.
+type PeerLink struct {
+	URL       string `json:"url"`
+	Connected bool   `json:"connected"`
+	Error     string `json:"error,omitempty"`
+}
+
+// LocalPeer mirrors LocalPeerState.
+type LocalPeer struct {
+	IP       string   `json:"ip"`
+	IPv6     string   `json:"ipv6"`
+	PubKey   string   `json:"pubKey"`
+	Fqdn     string   `json:"fqdn"`
+	Networks []string `json:"networks"`
+}
+
+// Status is the snapshot the frontend renders on the dashboard.
+type Status struct {
+	Status        string        `json:"status"`
+	DaemonVersion string        `json:"daemonVersion"`
+	Management    PeerLink      `json:"management"`
+	Signal        PeerLink      `json:"signal"`
+	Local         LocalPeer     `json:"local"`
+	Peers         []PeerStatus  `json:"peers"`
+	Events        []SystemEvent `json:"events"`
+	// NetworksRevision bumps whenever the daemon's routed-networks set or their
+	// selected state changes, so consumers know when to re-fetch ListNetworks
+	// instead of polling every snapshot.
+	NetworksRevision uint64 `json:"networksRevision"`
+	// SessionExpiresAt is the absolute UTC instant the SSO session expires; nil
+	// when the peer is not SSO-tracked or login expiration is disabled.
+	SessionExpiresAt *time.Time `json:"sessionExpiresAt,omitempty"`
+}
+
+// DaemonFeed fans the daemon's two long-running gRPC streams (SubscribeStatus,
+// SubscribeEvents) out to the frontend and tray, and exposes a one-shot Status
+// RPC for callers wanting the current snapshot without subscribing.
+//
+// Profile-switch suppression: BeginProfileSwitch makes statusStreamLoop swallow
+// the transient stale Connected and Idle pushes the daemon emits during Down, so
+// consumers see Connecting → new-profile-state instead of the full blink.
+//
+// Two flags govern the switch lifecycle, evaluated independently by
+// consumeForSwitch on every push because their lifetimes differ:
+//
+//	switchInProgress (suppression): clears on the first real push from the new
+//	    Up. Daemon-side StatusConnecting comes BEFORE any NeedsLogin, so
+//	    suppression must release here before the terminal arrives.
+//	switchLoginWatch (trigger):     outlives suppression. Watches for NeedsLogin
+//	    / LoginFailed / SessionExpired along the Up's retry loop and emits
+//	    EventTriggerLogin so the React orchestrator opens browser-login.
+//
+//	┌────────────────────────────────────────────┬──────────────────────────────────┐
+//	│ Incoming daemon status                     │ Action                           │
+//	├────────────────────────────────────────────┼──────────────────────────────────┤
+//	│ Connected, Idle (while switchInProgress)   │ Suppress (the blink we hide)     │
+//	│ Connecting                                 │ Emit, clear switchInProgress     │
+//	│ NeedsLogin, LoginFailed, SessionExpired    │ Emit, clear both flags, also     │
+//	│                                            │   emit EventTriggerLogin         │
+//	│ Connected, Idle (while only login-watch)   │ Emit, clear switchLoginWatch     │
+//	│ DaemonUnavailable                          │ Emit, clear both flags           │
+//	│ (timeout elapsed)                          │ Clear flags, emit normally       │
+//	└────────────────────────────────────────────┴──────────────────────────────────┘
+type DaemonFeed struct {
+	conn    DaemonConn
+	emitter Emitter
+	updater *updater.Holder
+	// logCtl attaches/detaches the GUI file log in response to the daemon's log
+	// level (a marked SystemEvent on the SubscribeEvents stream). nil when the GUI
+	// doesn't manage its log (server build / not wired), in which case the marker
+	// is ignored.
+	logCtl LogController
+
+	mu       sync.Mutex
+	cancel   context.CancelFunc
+	streamWg sync.WaitGroup
+
+	switchMu              sync.Mutex
+	switchInProgress      bool
+	switchInProgressUntil time.Time
+	switchLoginWatch      bool
+	switchLoginWatchUntil time.Time
+}
+
+// LogController is the subset of guilog.DebugLog that DaemonFeed drives: Apply
+// turns the GUI file log on/off for a daemon level; Path is the gui-client.log
+// path to register with the daemon (empty when the GUI doesn't own its log).
+type LogController interface {
+	Apply(level string)
+	Path() string
+}
+
+// NewDaemonFeed builds the feed. logCtl may be nil (server build / GUI log not
+// managed), in which case log-level markers on the event stream are ignored.
+func NewDaemonFeed(conn DaemonConn, emitter Emitter, updaterHolder *updater.Holder, logCtl LogController) *DaemonFeed {
+	return &DaemonFeed{conn: conn, emitter: emitter, updater: updaterHolder, logCtl: logCtl}
+}
+
+// BeginProfileSwitch arms suppression for a switch from Connected/Connecting,
+// where the daemon emits stale Connected updates during Down's teardown then an
+// Idle before the new Up; statusStreamLoop drops those, and a synthetic
+// Connecting snapshot is emitted so consumers paint optimistically. A 30s safety
+// timeout clears the flag if no follow-up status arrives.
+func (s *DaemonFeed) BeginProfileSwitch() {
+	now := time.Now()
+	s.switchMu.Lock()
+	s.switchInProgress = true
+	s.switchInProgressUntil = now.Add(30 * time.Second)
+	s.switchLoginWatch = true
+	s.switchLoginWatchUntil = now.Add(30 * time.Second)
+	s.switchMu.Unlock()
+	s.emitter.Emit(EventStatusSnapshot, Status{Status: StatusConnecting})
+}
+
+// CancelProfileSwitch aborts a switch midway (tray Disconnect while Connecting):
+// clears suppression so the next daemon Idle paints through, and disarms the
+// login-watch so the abort doesn't pop a browser-login after the user cancelled.
+func (s *DaemonFeed) CancelProfileSwitch() {
+	s.switchMu.Lock()
+	s.switchInProgress = false
+	s.switchLoginWatch = false
+	s.switchMu.Unlock()
+}
+
+// Watch starts the two background stream loops. Idempotent (a second call while
+// running is a no-op); both loops self-restart via exponential backoff.
+func (s *DaemonFeed) Watch(ctx context.Context) {
+	s.mu.Lock()
+	if s.cancel != nil {
+		s.mu.Unlock()
+		return
+	}
+	ctx, cancel := context.WithCancel(ctx)
+	s.cancel = cancel
+	s.mu.Unlock()
+
+	s.streamWg.Add(2)
+	go s.statusStreamLoop(ctx)
+	go s.toastStreamLoop(ctx)
+}
+
+// ServiceShutdown is the Wails service hook fired on app exit.
+func (s *DaemonFeed) ServiceShutdown() error {
+	s.mu.Lock()
+	cancel := s.cancel
+	s.cancel = nil
+	s.mu.Unlock()
+	if cancel != nil {
+		cancel()
+	}
+	s.streamWg.Wait()
+	return nil
+}
+
+// Get returns the current daemon status snapshot. An unreachable daemon socket
+// yields Status{Status: StatusDaemonUnavailable} rather than an error, so the
+// frontend keys off a single status enum without a parallel "error" path.
+func (s *DaemonFeed) Get(ctx context.Context) (Status, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		if isDaemonUnreachable(err) {
+			return Status{Status: StatusDaemonUnavailable}, nil
+		}
+		return Status{}, err
+	}
+	resp, err := cli.Status(ctx, &proto.StatusRequest{GetFullPeerStatus: true})
+	if err != nil {
+		if isDaemonUnreachable(err) {
+			return Status{Status: StatusDaemonUnavailable}, nil
+		}
+		return Status{}, err
+	}
+	return statusFromProto(resp), nil
+}
+
+// consumeForSwitch decides, for an incoming push during a profile switch,
+// whether to suppress it (suppress) and whether the switch landed in a state
+// needing the SSO flow (triggerLogin: NeedsLogin / SessionExpired / LoginFailed).
+//
+// The two flags have different lifetimes: suppression clears on Connecting, but
+// the trigger watcher must survive past it to catch the eventual NeedsLogin —
+// daemon-side StatusConnecting fires before loginToManagement, which is what may
+// then set StatusNeedsLogin.
+func (s *DaemonFeed) consumeForSwitch(st Status) (suppress, triggerLogin bool) {
+	s.switchMu.Lock()
+	defer s.switchMu.Unlock()
+
+	now := time.Now()
+	if s.switchInProgress && now.After(s.switchInProgressUntil) {
+		s.switchInProgress = false
+	}
+	if s.switchLoginWatch && now.After(s.switchLoginWatchUntil) {
+		s.switchLoginWatch = false
+	}
+
+	if s.switchInProgress {
+		switch {
+		case strings.EqualFold(st.Status, StatusConnecting),
+			strings.EqualFold(st.Status, StatusNeedsLogin),
+			strings.EqualFold(st.Status, StatusLoginFailed),
+			strings.EqualFold(st.Status, StatusSessionExpired),
+			strings.EqualFold(st.Status, StatusDaemonUnavailable):
+			// New flow has begun (Up started, or daemon refused it).
+			s.switchInProgress = false
+		default:
+			// Stale Connected from teardown or transient Idle: suppress so the
+			// optimistic Connecting stays painted. Login-watch stays armed.
+			return true, false
+		}
+	}
+
+	if s.switchLoginWatch {
+		switch {
+		case strings.EqualFold(st.Status, StatusNeedsLogin),
+			strings.EqualFold(st.Status, StatusLoginFailed),
+			strings.EqualFold(st.Status, StatusSessionExpired):
+			// SSO-needed terminal: trigger browser-login without a second click.
+			s.switchLoginWatch = false
+			return false, true
+		case strings.EqualFold(st.Status, StatusConnected),
+			strings.EqualFold(st.Status, StatusIdle),
+			strings.EqualFold(st.Status, StatusDaemonUnavailable):
+			// Terminal but not SSO — disarm without triggering.
+			s.switchLoginWatch = false
+		}
+	}
+
+	return false, false
+}
+
+// statusStreamLoop subscribes to SubscribeStatus and re-emits each snapshot on
+// the Wails event bus. The first message is the current snapshot; later ones
+// fire on connection-state changes only — no polling.
+func (s *DaemonFeed) statusStreamLoop(ctx context.Context) {
+	defer s.streamWg.Done()
+
+	bo := backoff.WithContext(&backoff.ExponentialBackOff{
+		InitialInterval:     time.Second,
+		RandomizationFactor: backoff.DefaultRandomizationFactor,
+		Multiplier:          backoff.DefaultMultiplier,
+		MaxInterval:         10 * time.Second,
+		MaxElapsedTime:      0,
+		Stop:                backoff.Stop,
+		Clock:               backoff.SystemClock,
+	}, ctx)
+
+	// unavailable fires the synthetic event once per outage, not on every retry.
+	unavailable := false
+	emitUnavailable := func() {
+		if unavailable {
+			return
+		}
+		unavailable = true
+		s.emitter.Emit(EventStatusSnapshot, Status{Status: StatusDaemonUnavailable})
+	}
+
+	op := func() error {
+		return s.subscribeAndStreamStatus(ctx, &unavailable, emitUnavailable)
+	}
+
+	if err := backoff.Retry(op, bo); err != nil && ctx.Err() == nil {
+		log.Errorf("status stream ended: %v", err)
+	}
+}
+
+// subscribeAndStreamStatus is one attempt of the status backoff loop: open
+// SubscribeStatus and re-emit every snapshot until it errors. A daemon-
+// unreachable failure also flips the synthetic-unavailable signal.
+func (s *DaemonFeed) subscribeAndStreamStatus(ctx context.Context, unavailable *bool, emitUnavailable func()) error {
+	cli, err := s.conn.Client()
+	if err != nil {
+		emitUnavailable()
+		return fmt.Errorf("get client: %w", err)
+	}
+	stream, err := cli.SubscribeStatus(ctx, &proto.StatusRequest{GetFullPeerStatus: true})
+	if err != nil {
+		if isDaemonUnreachable(err) {
+			emitUnavailable()
+		}
+		return fmt.Errorf("subscribe status: %w", err)
+	}
+	for {
+		resp, err := stream.Recv()
+		if err != nil {
+			return s.handleStatusRecvErr(ctx, err, emitUnavailable)
+		}
+		*unavailable = false
+		s.emitStatus(statusFromProto(resp))
+	}
+}
+
+// handleStatusRecvErr maps a SubscribeStatus Recv error into the backoff loop's
+// return: ctx cancellation stops the loop, an unreachable socket flips the
+// synthetic-unavailable signal, everything else is retryable.
+func (s *DaemonFeed) handleStatusRecvErr(ctx context.Context, err error, emitUnavailable func()) error {
+	if ctx.Err() != nil {
+		return ctx.Err()
+	}
+	if isDaemonUnreachable(err) {
+		emitUnavailable()
+	}
+	return fmt.Errorf("status stream recv: %w", err)
+}
+
+// emitStatus pushes a snapshot to the frontend, dropping the transient
+// stale-Connected / Idle pushes that occur mid profile switch.
+func (s *DaemonFeed) emitStatus(st Status) {
+	log.Infof("backend event: status status=%q peers=%d", st.Status, len(st.Peers))
+	suppress, triggerLogin := s.consumeForSwitch(st)
+	if suppress {
+		log.Debugf("suppressing status=%q during profile switch", st.Status)
+		return
+	}
+	s.emitter.Emit(EventStatusSnapshot, st)
+	if triggerLogin {
+		s.emitter.Emit(EventTriggerLogin)
+	}
+}
+
+// toastStreamLoop subscribes to SubscribeEvents and re-emits every SystemEvent
+// on the Wails event bus. Local name differs from the RPC so the file's two
+// streams aren't both called streamLoop.
+func (s *DaemonFeed) toastStreamLoop(ctx context.Context) {
+	defer s.streamWg.Done()
+
+	bo := backoff.WithContext(&backoff.ExponentialBackOff{
+		InitialInterval:     time.Second,
+		RandomizationFactor: backoff.DefaultRandomizationFactor,
+		Multiplier:          backoff.DefaultMultiplier,
+		MaxInterval:         10 * time.Second,
+		MaxElapsedTime:      0,
+		Stop:                backoff.Stop,
+		Clock:               backoff.SystemClock,
+	}, ctx)
+
+	op := func() error {
+		return s.subscribeAndStreamEvents(ctx)
+	}
+
+	if err := backoff.Retry(op, bo); err != nil && ctx.Err() == nil {
+		log.Errorf("event stream ended: %v", err)
+	}
+}
+
+// subscribeAndStreamEvents is one attempt of the event backoff loop: open
+// SubscribeEvents and fan out every SystemEvent until it errors.
+func (s *DaemonFeed) subscribeAndStreamEvents(ctx context.Context) error {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return fmt.Errorf("get client: %w", err)
+	}
+	stream, err := cli.SubscribeEvents(ctx, &proto.SubscribeRequest{})
+	if err != nil {
+		return fmt.Errorf("subscribe: %w", err)
+	}
+
+	// Re-register the GUI log path on every (re)connect so a daemon restart
+	// re-learns it. Best-effort — a failure must not abort the stream. Done even
+	// when file logging is off, so the path is known ahead of any debug toggle.
+	if s.logCtl != nil && s.logCtl.Path() != "" {
+		if _, err := cli.RegisterUILog(ctx, &proto.RegisterUILogRequest{Path: s.logCtl.Path()}); err != nil {
+			log.Warnf("register UI log path: %v", err)
+		}
+	}
+	for {
+		ev, err := stream.Recv()
+		if err != nil {
+			if ctx.Err() != nil {
+				return ctx.Err()
+			}
+			return fmt.Errorf("stream recv: %w", err)
+		}
+		s.dispatchSystemEvent(ev)
+	}
+}
+
+// dispatchSystemEvent fans one daemon SystemEvent out to the frontend
+// notification stream, the typed session-warning event (when the metadata
+// carries one), and the updater holder (when present).
+func (s *DaemonFeed) dispatchSystemEvent(ev *proto.SystemEvent) {
+	se := systemEventFromProto(ev)
+	log.Infof("backend event: system severity=%s category=%s msg=%q", se.Severity, se.Category, se.UserMessage)
+	// Internal refresh signal (CLI-driven profile add/remove), not a notification:
+	// translate and stop so it never reaches Recent Events or fires an OS toast.
+	if se.Metadata[proto.MetadataKindKey] == proto.MetadataKindProfileListChanged {
+		s.emitter.Emit(EventProfileChanged, ProfileRef{})
+		return
+	}
+	// Internal control signal driving the GUI file log on/off — handle and stop
+	// so it never reaches Recent Events or toasts.
+	if se.Metadata[proto.MetadataKindKey] == proto.MetadataKindLogLevelChanged {
+		if s.logCtl != nil {
+			s.logCtl.Apply(se.Metadata[proto.MetadataLevelKey])
+		}
+		return
+	}
+	s.emitter.Emit(EventDaemonNotification, se)
+	if warn, ok := authsession.WarningFromMetadata(se.Metadata); ok {
+		s.emitter.Emit(EventSessionWarning, warn)
+	}
+	if s.updater != nil {
+		s.updater.OnSystemEvent(ev)
+	}
+}
+
+func statusFromProto(resp *proto.StatusResponse) Status {
+	full := resp.GetFullStatus()
+	mgmt := full.GetManagementState()
+	sig := full.GetSignalState()
+	local := full.GetLocalPeerState()
+
+	st := Status{
+		Status:           resp.GetStatus(),
+		DaemonVersion:    resp.GetDaemonVersion(),
+		NetworksRevision: full.GetNetworksRevision(),
+		Management: PeerLink{
+			URL:       mgmt.GetURL(),
+			Connected: mgmt.GetConnected(),
+			Error:     mgmt.GetError(),
+		},
+		Signal: PeerLink{
+			URL:       sig.GetURL(),
+			Connected: sig.GetConnected(),
+			Error:     sig.GetError(),
+		},
+		Local: LocalPeer{
+			IP:       local.GetIP(),
+			IPv6:     local.GetIpv6(),
+			PubKey:   local.GetPubKey(),
+			Fqdn:     local.GetFqdn(),
+			Networks: append([]string{}, local.GetNetworks()...),
+		},
+	}
+
+	for _, p := range full.GetPeers() {
+		st.Peers = append(st.Peers, PeerStatus{
+			IP:                         p.GetIP(),
+			IPv6:                       p.GetIpv6(),
+			PubKey:                     p.GetPubKey(),
+			ConnStatus:                 p.GetConnStatus(),
+			ConnStatusUpdateUnix:       p.GetConnStatusUpdate().GetSeconds(),
+			Relayed:                    p.GetRelayed(),
+			LocalIceCandidateType:      p.GetLocalIceCandidateType(),
+			RemoteIceCandidateType:     p.GetRemoteIceCandidateType(),
+			LocalIceCandidateEndpoint:  p.GetLocalIceCandidateEndpoint(),
+			RemoteIceCandidateEndpoint: p.GetRemoteIceCandidateEndpoint(),
+			Fqdn:                       p.GetFqdn(),
+			BytesRx:                    p.GetBytesRx(),
+			BytesTx:                    p.GetBytesTx(),
+			LatencyMs:                  p.GetLatency().AsDuration().Milliseconds(),
+			RelayAddress:               p.GetRelayAddress(),
+			LastHandshakeUnix:          p.GetLastWireguardHandshake().GetSeconds(),
+			RosenpassEnabled:           p.GetRosenpassEnabled(),
+			Networks:                   append([]string{}, p.GetNetworks()...),
+		})
+	}
+	for _, e := range full.GetEvents() {
+		st.Events = append(st.Events, systemEventFromProto(e))
+	}
+	if ts := resp.GetSessionExpiresAt(); ts.IsValid() && !ts.AsTime().IsZero() {
+		t := ts.AsTime().UTC()
+		st.SessionExpiresAt = &t
+	}
+	return st
+}
+
+func systemEventFromProto(e *proto.SystemEvent) SystemEvent {
+	out := SystemEvent{
+		ID:          e.GetId(),
+		Severity:    strings.ToLower(strings.TrimPrefix(e.GetSeverity().String(), "SystemEvent_")),
+		Category:    strings.ToLower(strings.TrimPrefix(e.GetCategory().String(), "SystemEvent_")),
+		Message:     e.GetMessage(),
+		UserMessage: e.GetUserMessage(),
+		Metadata:    map[string]string{},
+	}
+	if ts := e.GetTimestamp(); ts != nil {
+		out.Timestamp = ts.GetSeconds()
+	}
+	for k, v := range e.GetMetadata() {
+		out.Metadata[k] = v
+	}
+	return out
+}
+
+// isDaemonUnreachable reports whether a gRPC error means the daemon socket isn't
+// answering, versus the daemon responding with an application-level code. Only
+// the former should flip the tray to "Not running" — a daemon returning e.g.
+// FailedPrecondition is alive and must not be reported as down.
+func isDaemonUnreachable(err error) bool {
+	if err == nil {
+		return false
+	}
+	st, ok := status.FromError(err)
+	if !ok {
+		return true
+	}
+	return st.Code() == codes.Unavailable
+}
diff --git a/client/ui/services/debug.go b/client/ui/services/debug.go
new file mode 100644
index 000000000..034086747
--- /dev/null
+++ b/client/ui/services/debug.go
@@ -0,0 +1,136 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"time"
+
+	"google.golang.org/protobuf/types/known/durationpb"
+
+	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/version"
+)
+
+type DebugBundleParams struct {
+	Anonymize    bool   `json:"anonymize"`
+	SystemInfo   bool   `json:"systemInfo"`
+	UploadURL    string `json:"uploadUrl"`
+	LogFileCount uint32 `json:"logFileCount"`
+}
+
+// DebugBundleResult: Path is set for local-only bundles, UploadedKey on upload
+// success, UploadFailureReason on upload failure.
+type DebugBundleResult struct {
+	Path                string `json:"path"`
+	UploadedKey         string `json:"uploadedKey"`
+	UploadFailureReason string `json:"uploadFailureReason"`
+}
+
+// LogLevel carries a logrus level name: "error", "warn", "info", "debug", "trace".
+type LogLevel struct {
+	Level string `json:"level"`
+}
+
+type Debug struct {
+	conn DaemonConn
+}
+
+func NewDebug(conn DaemonConn) *Debug {
+	return &Debug{conn: conn}
+}
+
+func (s *Debug) Bundle(ctx context.Context, p DebugBundleParams) (DebugBundleResult, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return DebugBundleResult{}, err
+	}
+	resp, err := cli.DebugBundle(ctx, &proto.DebugBundleRequest{
+		Anonymize:    p.Anonymize,
+		SystemInfo:   p.SystemInfo,
+		UploadURL:    p.UploadURL,
+		LogFileCount: p.LogFileCount,
+		CliVersion:   version.NetbirdVersion(),
+	})
+	if err != nil {
+		return DebugBundleResult{}, err
+	}
+	return DebugBundleResult{
+		Path:                resp.GetPath(),
+		UploadedKey:         resp.GetUploadedKey(),
+		UploadFailureReason: resp.GetUploadFailureReason(),
+	}, nil
+}
+
+func (s *Debug) GetLogLevel(ctx context.Context) (LogLevel, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return LogLevel{}, err
+	}
+	resp, err := cli.GetLogLevel(ctx, &proto.GetLogLevelRequest{})
+	if err != nil {
+		return LogLevel{}, err
+	}
+	return LogLevel{Level: resp.GetLevel().String()}, nil
+}
+
+// RevealFile opens the OS file manager focused on path. Needed because Wails'
+// Browser.OpenURL refuses non-http(s) schemes like file://.
+func (s *Debug) RevealFile(_ context.Context, path string) error {
+	if path == "" {
+		return fmt.Errorf("empty path")
+	}
+	return revealFile(path)
+}
+
+// RegisterUILog reports the GUI log path to the daemon for bundle collection;
+// the daemon runs as root and can't resolve the user's config dir. Called on
+// each daemon (re)connect.
+func (s *Debug) RegisterUILog(ctx context.Context, path string) error {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return err
+	}
+	_, err = cli.RegisterUILog(ctx, &proto.RegisterUILogRequest{Path: path})
+	return err
+}
+
+func (s *Debug) StartBundleCapture(ctx context.Context, timeoutSeconds int32) error {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return err
+	}
+	req := &proto.StartBundleCaptureRequest{}
+	if timeoutSeconds > 0 {
+		req.Timeout = durationpb.New(time.Duration(timeoutSeconds) * time.Second)
+	}
+	_, err = cli.StartBundleCapture(ctx, req)
+	return err
+}
+
+func (s *Debug) StopBundleCapture(ctx context.Context) error {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return err
+	}
+	_, err = cli.StopBundleCapture(ctx, &proto.StopBundleCaptureRequest{})
+	return err
+}
+
+func (s *Debug) SetLogLevel(ctx context.Context, lvl LogLevel) error {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return err
+	}
+	// proto.LogLevel_value keys are upper-case enum names; callers pass
+	// lowercase logrus names. Upper-case before lookup or a valid level
+	// silently falls through to INFO.
+	level, ok := proto.LogLevel_value[strings.ToUpper(lvl.Level)]
+	if !ok {
+		level = int32(proto.LogLevel_INFO)
+	}
+	_, err = cli.SetLogLevel(ctx, &proto.SetLogLevelRequest{Level: proto.LogLevel(level)})
+	return err
+}
diff --git a/client/ui/services/debug_reveal_other.go b/client/ui/services/debug_reveal_other.go
new file mode 100644
index 000000000..bef0a58bb
--- /dev/null
+++ b/client/ui/services/debug_reveal_other.go
@@ -0,0 +1,20 @@
+//go:build !android && !ios && !freebsd && !js && !windows
+
+package services
+
+import (
+	"os/exec"
+	"path/filepath"
+	"runtime"
+)
+
+// revealFile opens the OS file manager focused on path.
+func revealFile(path string) error {
+	var cmd *exec.Cmd
+	if runtime.GOOS == "darwin" {
+		cmd = exec.Command("open", "-R", path)
+	} else {
+		cmd = exec.Command("xdg-open", filepath.Dir(path))
+	}
+	return cmd.Start()
+}
diff --git a/client/ui/services/debug_reveal_windows.go b/client/ui/services/debug_reveal_windows.go
new file mode 100644
index 000000000..790d23fab
--- /dev/null
+++ b/client/ui/services/debug_reveal_windows.go
@@ -0,0 +1,54 @@
+package services
+
+import (
+	"fmt"
+	"os/exec"
+	"path/filepath"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+// SW_SHOWNORMAL for ShellExecuteW's nShowCmd.
+const swShowNormal = 1
+
+var (
+	shell32          = windows.NewLazySystemDLL("shell32.dll")
+	procShellExecute = shell32.NewProc("ShellExecuteW")
+)
+
+// revealFile opens Explorer focused on path. The debug bundle is written by the
+// daemon (running as SYSTEM) into C:\Windows\SystemTemp, whose ACL denies the
+// logged-in user. A plain "explorer /select" can't traverse it, so we elevate
+// via the ShellExecuteW "runas" verb (UAC prompt) — the elevated Explorer can
+// read the folder and highlight the file.
+func revealFile(path string) error {
+	verb, err := windows.UTF16PtrFromString("runas")
+	if err != nil {
+		return fmt.Errorf("encode verb: %w", err)
+	}
+	file, err := windows.UTF16PtrFromString("explorer.exe")
+	if err != nil {
+		return fmt.Errorf("encode file: %w", err)
+	}
+	params, err := windows.UTF16PtrFromString("/select," + path)
+	if err != nil {
+		return fmt.Errorf("encode params: %w", err)
+	}
+
+	// ShellExecuteW returns an HINSTANCE; a value <=32 is an error code.
+	ret, _, _ := procShellExecute.Call(
+		0,
+		uintptr(unsafe.Pointer(verb)),
+		uintptr(unsafe.Pointer(file)),
+		uintptr(unsafe.Pointer(params)),
+		0,
+		swShowNormal,
+	)
+	if ret <= 32 {
+		// Elevation declined or failed: fall back to an unelevated reveal of the
+		// parent directory so the user at least lands near the bundle.
+		return exec.Command("explorer", filepath.Dir(path)).Start() //nolint:gosec
+	}
+	return nil
+}
diff --git a/client/ui/services/errors.go b/client/ui/services/errors.go
new file mode 100644
index 000000000..f1679e764
--- /dev/null
+++ b/client/ui/services/errors.go
@@ -0,0 +1,133 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"encoding/json"
+	"strings"
+
+	gcodes "google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/ui/i18n"
+	"github.com/netbirdio/netbird/client/ui/preferences"
+)
+
+// ErrorTranslator localises daemon errors; runtime impl is *i18n.Bundle.
+type ErrorTranslator interface {
+	Translate(lang i18n.LanguageCode, key string, args ...string) string
+}
+
+// LanguagePreference reports the current UI language; runtime impl is *preferences.Store.
+type LanguagePreference interface {
+	Get() preferences.UIPreferences
+}
+
+// ClientError is a structured error returned to the frontend. The frontend
+// translates Code via i18n; Short is an English fallback; Long carries the
+// unwrapped daemon message.
+type ClientError struct {
+	Code  string `json:"code"`
+	Short string `json:"short"`
+	Long  string `json:"long"`
+}
+
+// Error returns the short message for plain Go callers.
+func (e *ClientError) Error() string {
+	if e == nil {
+		return ""
+	}
+	return e.Short
+}
+
+// MarshalJSON emits the struct so the Wails binding sends an object, not the
+// default "error: ..." string.
+func (e *ClientError) MarshalJSON() ([]byte, error) {
+	if e == nil {
+		return []byte("null"), nil
+	}
+	type alias ClientError
+	return json.Marshal((*alias)(e))
+}
+
+// errorClassifier maps gRPC errors to a localised ClientError. Shared by the
+// daemon-facing services so the frontend gets a clean short message instead of
+// the wrapped gRPC chain.
+type errorClassifier struct {
+	translator ErrorTranslator
+	prefs      LanguagePreference
+}
+
+// classify maps a gRPC error to a ClientError by matching known substrings to a
+// stable code. A missing locale entry surfaces as a visible "error.<code>"
+// string — a deliberate fail-loud signal to update the bundle.
+func (c errorClassifier) classify(err error) *ClientError {
+	if err == nil {
+		return nil
+	}
+
+	msg := err.Error()
+	grpcCode := gcodes.Unknown
+	if st, ok := gstatus.FromError(err); ok {
+		msg = st.Message()
+		grpcCode = st.Code()
+	}
+	lower := strings.ToLower(msg)
+
+	code := "unknown"
+	switch {
+	case strings.Contains(lower, "token used before issued"),
+		strings.Contains(lower, "token is not valid yet"):
+		code = "jwt_clock_skew"
+	case strings.Contains(lower, "token is expired"),
+		strings.Contains(lower, "token has expired"):
+		code = "jwt_expired"
+	case strings.Contains(lower, "token signature is invalid"):
+		code = "jwt_signature_invalid"
+	case strings.Contains(lower, "peer login has expired"):
+		code = "session_expired"
+	case strings.Contains(lower, "invalid setup-key"),
+		strings.Contains(lower, "invalid setup key"):
+		code = "invalid_setup_key"
+	case strings.Contains(lower, "permission denied"):
+		code = "permission_denied"
+	case strings.Contains(lower, "no connection could be made"),
+		strings.Contains(lower, "connection refused"),
+		strings.Contains(lower, "context deadline exceeded"):
+		code = "daemon_unreachable"
+	}
+
+	// Fall back to the gRPC status code when the message didn't match a known
+	// substring — the daemon now forwards the innermost code with a clean desc
+	// that no longer contains the English marker text.
+	if code == "unknown" {
+		switch grpcCode {
+		case gcodes.PermissionDenied:
+			code = "permission_denied"
+		case gcodes.Unavailable, gcodes.DeadlineExceeded:
+			code = "daemon_unreachable"
+		}
+	}
+
+	return &ClientError{
+		Code:  code,
+		Short: c.translateShort(code),
+		Long:  msg,
+	}
+}
+
+// translateShort resolves the localised short message for code, returning the
+// bare "error.<code>" key when no translation is available so the gap stays visible.
+func (c errorClassifier) translateShort(code string) string {
+	key := "error." + code
+	if c.translator == nil {
+		return key
+	}
+	lang := i18n.DefaultLanguage
+	if c.prefs != nil {
+		if pref := c.prefs.Get().Language; pref != "" {
+			lang = pref
+		}
+	}
+	return c.translator.Translate(lang, key)
+}
diff --git a/client/ui/services/errors_test.go b/client/ui/services/errors_test.go
new file mode 100644
index 000000000..2f8f3d039
--- /dev/null
+++ b/client/ui/services/errors_test.go
@@ -0,0 +1,50 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	gcodes "google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+)
+
+func TestErrorClassifier_Classify(t *testing.T) {
+	c := errorClassifier{} // nil translator → Short is the bare "error.<code>" key
+
+	t.Run("permission denied by gRPC code with a clean desc", func(t *testing.T) {
+		// The daemon now forwards the innermost status: code + clean desc that
+		// no longer carries the English "permission denied" marker.
+		err := gstatus.Error(gcodes.PermissionDenied, "peer is already registered by a different User or a Setup Key")
+
+		ce := c.classify(err)
+		require.NotNil(t, ce)
+		require.Equal(t, "permission_denied", ce.Code)
+		require.Equal(t, "error.permission_denied", ce.Short)
+		require.Equal(t, "peer is already registered by a different User or a Setup Key", ce.Long)
+	})
+
+	t.Run("substring match still wins for unclassified codes", func(t *testing.T) {
+		err := gstatus.Error(gcodes.Unknown, "peer login has expired")
+
+		ce := c.classify(err)
+		require.NotNil(t, ce)
+		require.Equal(t, "session_expired", ce.Code)
+	})
+
+	t.Run("unavailable code maps to daemon_unreachable", func(t *testing.T) {
+		ce := c.classify(gstatus.Error(gcodes.Unavailable, "transport closing"))
+		require.Equal(t, "daemon_unreachable", ce.Code)
+	})
+
+	t.Run("unmatched stays unknown", func(t *testing.T) {
+		ce := c.classify(errors.New("something odd"))
+		require.Equal(t, "unknown", ce.Code)
+	})
+
+	t.Run("nil error", func(t *testing.T) {
+		require.Nil(t, c.classify(nil))
+	})
+}
diff --git a/client/ui/services/foreground_other.go b/client/ui/services/foreground_other.go
new file mode 100644
index 000000000..e6e16a21a
--- /dev/null
+++ b/client/ui/services/foreground_other.go
@@ -0,0 +1,11 @@
+//go:build !windows && !android && !ios && !freebsd && !js
+
+package services
+
+import "github.com/wailsapp/wails/v3/pkg/application"
+
+func raiseToForeground(w *application.WebviewWindow) {
+	if w != nil {
+		w.Focus()
+	}
+}
diff --git a/client/ui/services/foreground_windows.go b/client/ui/services/foreground_windows.go
new file mode 100644
index 000000000..215f30093
--- /dev/null
+++ b/client/ui/services/foreground_windows.go
@@ -0,0 +1,43 @@
+//go:build windows
+
+package services
+
+import (
+	"syscall"
+
+	"github.com/wailsapp/wails/v3/pkg/application"
+	"github.com/wailsapp/wails/v3/pkg/w32"
+)
+
+var procAttachThreadInput = syscall.NewLazyDLL("user32.dll").NewProc("AttachThreadInput")
+
+func attachThreadInput(attach, attachTo w32.HANDLE, on bool) {
+	var flag uintptr
+	if on {
+		flag = 1
+	}
+	_, _, _ = procAttachThreadInput.Call(uintptr(attach), uintptr(attachTo), flag)
+}
+
+func raiseToForeground(w *application.WebviewWindow) {
+	if w == nil {
+		return
+	}
+	application.InvokeSync(func() {
+		ptr := w.NativeWindow()
+		if ptr == nil {
+			return
+		}
+		hwnd := w32.HWND(uintptr(ptr))
+
+		fgThread, _ := w32.GetWindowThreadProcessId(w32.GetForegroundWindow())
+		appThread := w32.GetCurrentThreadId()
+		if fgThread != appThread {
+			attachThreadInput(fgThread, appThread, true)
+			defer attachThreadInput(fgThread, appThread, false)
+		}
+		w32.ShowWindow(hwnd, w32.SW_SHOW)
+		w32.BringWindowToTop(hwnd)
+		w32.SetForegroundWindow(hwnd)
+	})
+}
diff --git a/client/ui/services/forwarding.go b/client/ui/services/forwarding.go
new file mode 100644
index 000000000..4ba979ad0
--- /dev/null
+++ b/client/ui/services/forwarding.go
@@ -0,0 +1,83 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// PortRange is a port range; both ends are inclusive.
+type PortRange struct {
+	Start uint32 `json:"start"`
+	End   uint32 `json:"end"`
+}
+
+// PortInfo holds exactly one of Port or Range (the daemon's oneof).
+type PortInfo struct {
+	Port  *uint32    `json:"port,omitempty"`
+	Range *PortRange `json:"range,omitempty"`
+}
+
+// ForwardingRule is one entry from the daemon's reverse-proxy table.
+type ForwardingRule struct {
+	Protocol           string   `json:"protocol"`
+	DestinationPort    PortInfo `json:"destinationPort"`
+	TranslatedAddress  string   `json:"translatedAddress"`
+	TranslatedHostname string   `json:"translatedHostname"`
+	TranslatedPort     PortInfo `json:"translatedPort"`
+}
+
+// Forwarding groups the daemon RPCs that surface exposed/forwarded services.
+type Forwarding struct {
+	conn DaemonConn
+}
+
+func NewForwarding(conn DaemonConn) *Forwarding {
+	return &Forwarding{conn: conn}
+}
+
+func (s *Forwarding) List(ctx context.Context) ([]ForwardingRule, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return nil, err
+	}
+	resp, err := cli.ForwardingRules(ctx, &proto.EmptyRequest{})
+	if err != nil {
+		return nil, err
+	}
+	out := make([]ForwardingRule, 0, len(resp.GetRules()))
+	for _, r := range resp.GetRules() {
+		out = append(out, forwardingRuleFromProto(r))
+	}
+	return out, nil
+}
+
+func forwardingRuleFromProto(r *proto.ForwardingRule) ForwardingRule {
+	return ForwardingRule{
+		Protocol:           r.GetProtocol(),
+		DestinationPort:    portInfoFromProto(r.GetDestinationPort()),
+		TranslatedAddress:  r.GetTranslatedAddress(),
+		TranslatedHostname: r.GetTranslatedHostname(),
+		TranslatedPort:     portInfoFromProto(r.GetTranslatedPort()),
+	}
+}
+
+func portInfoFromProto(p *proto.PortInfo) PortInfo {
+	if p == nil {
+		return PortInfo{}
+	}
+	switch sel := p.GetPortSelection().(type) {
+	case *proto.PortInfo_Port:
+		port := sel.Port
+		return PortInfo{Port: &port}
+	case *proto.PortInfo_Range_:
+		r := sel.Range
+		if r == nil {
+			return PortInfo{}
+		}
+		return PortInfo{Range: &PortRange{Start: r.GetStart(), End: r.GetEnd()}}
+	}
+	return PortInfo{}
+}
diff --git a/client/ui/services/i18n.go b/client/ui/services/i18n.go
new file mode 100644
index 000000000..755bbe02d
--- /dev/null
+++ b/client/ui/services/i18n.go
@@ -0,0 +1,30 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+
+	"github.com/netbirdio/netbird/client/ui/i18n"
+)
+
+// I18n is the Wails-bound facade over i18n.Bundle; the translation logic lives
+// in client/ui/i18n.
+type I18n struct {
+	bundle *i18n.Bundle
+}
+
+func NewI18n(bundle *i18n.Bundle) *I18n {
+	return &I18n{bundle: bundle}
+}
+
+// Languages returns the shipped locales.
+func (s *I18n) Languages(_ context.Context) ([]i18n.Language, error) {
+	return s.bundle.Languages(), nil
+}
+
+// Bundle returns the full key->text map so the React side can drive its own
+// translation library off the same source bundles.
+func (s *I18n) Bundle(_ context.Context, code i18n.LanguageCode) (map[string]string, error) {
+	return s.bundle.BundleFor(code)
+}
diff --git a/client/ui/services/network.go b/client/ui/services/network.go
new file mode 100644
index 000000000..c2d127494
--- /dev/null
+++ b/client/ui/services/network.go
@@ -0,0 +1,88 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+type Network struct {
+	ID          string              `json:"id"`
+	Range       string              `json:"range"`
+	Selected    bool                `json:"selected"`
+	Domains     []string            `json:"domains"`
+	ResolvedIPs map[string][]string `json:"resolvedIps"`
+}
+
+// SelectNetworksParams: All targets every available network; Append merges IDs into the existing selection.
+type SelectNetworksParams struct {
+	NetworkIDs []string `json:"networkIds"`
+	Append     bool     `json:"append"`
+	All        bool     `json:"all"`
+}
+
+type Networks struct {
+	conn DaemonConn
+}
+
+func NewNetworks(conn DaemonConn) *Networks {
+	return &Networks{conn: conn}
+}
+
+func (s *Networks) List(ctx context.Context) ([]Network, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return nil, err
+	}
+	resp, err := cli.ListNetworks(ctx, &proto.ListNetworksRequest{})
+	if err != nil {
+		return nil, err
+	}
+	out := make([]Network, 0, len(resp.GetRoutes()))
+	for _, n := range resp.GetRoutes() {
+		out = append(out, networkFromProto(n))
+	}
+	return out, nil
+}
+
+func (s *Networks) Select(ctx context.Context, p SelectNetworksParams) error {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return err
+	}
+	_, err = cli.SelectNetworks(ctx, &proto.SelectNetworksRequest{
+		NetworkIDs: p.NetworkIDs,
+		Append:     p.Append,
+		All:        p.All,
+	})
+	return err
+}
+
+func (s *Networks) Deselect(ctx context.Context, p SelectNetworksParams) error {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return err
+	}
+	_, err = cli.DeselectNetworks(ctx, &proto.SelectNetworksRequest{
+		NetworkIDs: p.NetworkIDs,
+		Append:     p.Append,
+		All:        p.All,
+	})
+	return err
+}
+
+func networkFromProto(n *proto.Network) Network {
+	resolved := make(map[string][]string, len(n.GetResolvedIPs()))
+	for k, v := range n.GetResolvedIPs() {
+		resolved[k] = append([]string{}, v.GetIps()...)
+	}
+	return Network{
+		ID:          n.GetID(),
+		Range:       n.GetRange(),
+		Selected:    n.GetSelected(),
+		Domains:     append([]string{}, n.GetDomains()...),
+		ResolvedIPs: resolved,
+	}
+}
diff --git a/client/ui/services/preferences.go b/client/ui/services/preferences.go
new file mode 100644
index 000000000..dae086de8
--- /dev/null
+++ b/client/ui/services/preferences.go
@@ -0,0 +1,36 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+
+	"github.com/netbirdio/netbird/client/ui/i18n"
+	"github.com/netbirdio/netbird/client/ui/preferences"
+)
+
+// Preferences is the Wails-bound facade over preferences.Store; the context.Context-first
+// signatures are what the binding generator requires.
+type Preferences struct {
+	store *preferences.Store
+}
+
+func NewPreferences(store *preferences.Store) *Preferences {
+	return &Preferences{store: store}
+}
+
+func (s *Preferences) Get(_ context.Context) (preferences.UIPreferences, error) {
+	return s.store.Get(), nil
+}
+
+func (s *Preferences) SetLanguage(_ context.Context, lang i18n.LanguageCode) error {
+	return s.store.SetLanguage(lang)
+}
+
+func (s *Preferences) SetViewMode(_ context.Context, mode preferences.ViewMode) error {
+	return s.store.SetViewMode(mode)
+}
+
+func (s *Preferences) SetOnboardingCompleted(_ context.Context, done bool) error {
+	return s.store.SetOnboardingCompleted(done)
+}
diff --git a/client/ui/services/profile.go b/client/ui/services/profile.go
new file mode 100644
index 000000000..09468c9df
--- /dev/null
+++ b/client/ui/services/profile.go
@@ -0,0 +1,179 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+	"os/user"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+type Profile struct {
+	// ID is the daemon-generated on-disk identity of the profile. Display
+	// names can collide and be renamed, so the ID is the stable handle the
+	// daemon resolves switch/remove/logout requests against.
+	ID       string `json:"id"`
+	Name     string `json:"name"`
+	IsActive bool   `json:"isActive"`
+	// Email is read from the user-owned per-profile state file (CLI writes it
+	// after SSO login), not via ListProfiles: the daemon runs as root and can't
+	// reach it, while the UI runs as the logged-in user.
+	Email string `json:"email"`
+}
+
+type ProfileRef struct {
+	ProfileName string `json:"profileName"`
+	Username    string `json:"username"`
+}
+
+type ActiveProfile struct {
+	// ID is the active profile's stable on-disk identity. Use it (not the
+	// display name) as the handle for daemon requests and active-profile
+	// comparisons, since names can collide.
+	ID          string `json:"id"`
+	ProfileName string `json:"profileName"`
+	Username    string `json:"username"`
+}
+
+// RenameProfileParams selects a profile by handle and carries its new display
+// name.
+type RenameProfileParams struct {
+	// Handle selects the profile to rename: an exact ID, a unique ID prefix,
+	// or a unique display name. The daemon resolves it server-side.
+	Handle string `json:"handle"`
+	// NewName is the new free-form display name. The daemon sanitizes it
+	// (strips control characters, trims, caps length) but keeps spaces, emoji,
+	// punctuation, and non-ASCII letters.
+	NewName string `json:"newName"`
+
+	Username string `json:"username"`
+}
+
+type Profiles struct {
+	conn DaemonConn
+}
+
+func NewProfiles(conn DaemonConn) *Profiles {
+	return &Profiles{conn: conn}
+}
+
+// Username returns the OS username the daemon expects for profile lookups.
+func (s *Profiles) Username() (string, error) {
+	u, err := user.Current()
+	if err != nil {
+		return "", err
+	}
+	return u.Username, nil
+}
+
+func (s *Profiles) List(ctx context.Context, username string) ([]Profile, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return nil, err
+	}
+	resp, err := cli.ListProfiles(ctx, &proto.ListProfilesRequest{Username: username})
+	if err != nil {
+		return nil, err
+	}
+	pm := profilemanager.NewProfileManager()
+	out := make([]Profile, 0, len(resp.GetProfiles()))
+	for _, p := range resp.GetProfiles() {
+		prof := Profile{ID: p.GetId(), Name: p.GetName(), IsActive: p.GetIsActive()}
+		if state, err := pm.GetProfileState(profilemanager.ID(p.GetId())); err == nil {
+			prof.Email = state.Email
+		}
+		out = append(out, prof)
+	}
+	return out, nil
+}
+
+func (s *Profiles) GetActive(ctx context.Context) (ActiveProfile, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return ActiveProfile{}, err
+	}
+	resp, err := cli.GetActiveProfile(ctx, &proto.GetActiveProfileRequest{})
+	if err != nil {
+		return ActiveProfile{}, err
+	}
+	return ActiveProfile{
+		ID:          resp.GetId(),
+		ProfileName: resp.GetProfileName(),
+		Username:    resp.GetUsername(),
+	}, nil
+}
+
+// Switch sends a profile switch to the daemon and returns the resolved
+// on-disk ID of the now-active profile. ProfileName is treated as a handle
+// (exact ID, unique ID prefix, or unique display name); the daemon resolves
+// it server-side and echoes back the canonical ID.
+func (s *Profiles) Switch(ctx context.Context, p ProfileRef) (string, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return "", err
+	}
+	req := &proto.SwitchProfileRequest{}
+	if p.ProfileName != "" {
+		req.ProfileName = ptrStr(p.ProfileName)
+	}
+	if p.Username != "" {
+		req.Username = ptrStr(p.Username)
+	}
+	resp, err := cli.SwitchProfile(ctx, req)
+	if err != nil {
+		return "", err
+	}
+	return resp.GetId(), nil
+}
+
+// Add creates a profile with the given display name and returns its
+// daemon-generated on-disk ID, so callers can address the new profile by ID
+// (e.g. to write config or switch to it) without re-resolving the name.
+func (s *Profiles) Add(ctx context.Context, p ProfileRef) (string, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return "", err
+	}
+	resp, err := cli.AddProfile(ctx, &proto.AddProfileRequest{
+		ProfileName: p.ProfileName,
+		Username:    p.Username,
+	})
+	if err != nil {
+		return "", err
+	}
+	return resp.GetId(), nil
+}
+
+func (s *Profiles) Remove(ctx context.Context, p ProfileRef) error {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return err
+	}
+	_, err = cli.RemoveProfile(ctx, &proto.RemoveProfileRequest{
+		ProfileName: p.ProfileName,
+		Username:    p.Username,
+	})
+	return err
+}
+
+// Rename changes a profile's display name. The on-disk ID is unaffected, so
+// the active profile and any ID-based references stay valid (the default
+// profile can be renamed too — only its display name changes). Returns the
+// profile's previous display name as confirmation.
+func (s *Profiles) Rename(ctx context.Context, p RenameProfileParams) (string, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return "", err
+	}
+	resp, err := cli.RenameProfile(ctx, &proto.RenameProfileRequest{
+		Username:       p.Username,
+		Handle:         p.Handle,
+		NewProfileName: p.NewName,
+	})
+	if err != nil {
+		return "", err
+	}
+	return resp.GetOldProfileName(), nil
+}
diff --git a/client/ui/services/profileswitcher.go b/client/ui/services/profileswitcher.go
new file mode 100644
index 000000000..c27b62d92
--- /dev/null
+++ b/client/ui/services/profileswitcher.go
@@ -0,0 +1,92 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+)
+
+// ProfileSwitcher holds the reconnect policy shared by the tray and React
+// frontend so both flip profiles identically. The policy keys off prevStatus
+// from DaemonFeed.Get at SwitchActive entry:
+//
+//	Connected/Connecting → Switch + Down + Up; optimistic Connecting paint.
+//	NeedsLogin/LoginFailed/SessionExpired → Switch + Down; clear stale error for re-login.
+//	Idle → Switch only.
+type ProfileSwitcher struct {
+	profiles   *Profiles
+	connection *Connection
+	feed       *DaemonFeed
+}
+
+func NewProfileSwitcher(profiles *Profiles, connection *Connection, feed *DaemonFeed) *ProfileSwitcher {
+	return &ProfileSwitcher{profiles: profiles, connection: connection, feed: feed}
+}
+
+// SwitchActive switches to the named profile applying the reconnect policy.
+func (s *ProfileSwitcher) SwitchActive(ctx context.Context, p ProfileRef) error {
+	prevStatus := ""
+	if st, err := s.feed.Get(ctx); err == nil {
+		prevStatus = st.Status
+	} else {
+		log.Warnf("profileswitcher: get status: %v", err)
+	}
+
+	wasActive := strings.EqualFold(prevStatus, StatusConnected) ||
+		strings.EqualFold(prevStatus, StatusConnecting)
+	needsDown := wasActive ||
+		strings.EqualFold(prevStatus, StatusNeedsLogin) ||
+		strings.EqualFold(prevStatus, StatusLoginFailed) ||
+		strings.EqualFold(prevStatus, StatusSessionExpired)
+
+	log.Infof("profileswitcher: switch profile=%q prevStatus=%q wasActive=%v needsDown=%v",
+		p.ProfileName, prevStatus, wasActive, needsDown)
+
+	// Optimistic Connecting paint only when wasActive: those prevStatuses emit
+	// stale Connected + transient Idle pushes during Down that must be
+	// suppressed until Up resumes the stream (see DaemonFeed suppression table).
+	if wasActive {
+		s.feed.BeginProfileSwitch()
+	}
+
+	resolvedID, err := s.profiles.Switch(ctx, p)
+	if err != nil {
+		return fmt.Errorf("switch profile %q: %w", p.ProfileName, err)
+	}
+
+	// Mirror into the user-side ProfileManager state: the CLI's `netbird up`
+	// reads this file and sends the ID back in the Up RPC, so if it diverges
+	// the daemon reverts the UI switch on the next CLI `up`. Best-effort — the
+	// daemon is authoritative; a failure only leaves the CLI's view stale.
+	// Use the daemon-resolved ID rather than the handle we sent, since the
+	// on-disk state is keyed by ID, not display name.
+	if err := profilemanager.NewProfileManager().SwitchProfile(profilemanager.ID(resolvedID)); err != nil {
+		log.Warnf("profileswitcher: mirror to user-side ProfileManager failed: %v", err)
+	}
+
+	if needsDown {
+		if err := s.connection.Down(ctx); err != nil {
+			log.Errorf("profileswitcher: Down: %v", err)
+		}
+	}
+
+	if wasActive {
+		if err := s.connection.Up(ctx, UpParams(p)); err != nil {
+			return fmt.Errorf("reconnect %q: %w", p.ProfileName, err)
+		}
+	}
+
+	// The daemon emits no profile event, so fan out ourselves or the React
+	// ProfileContext stays on the old profile after a tray-initiated switch.
+	if s.feed != nil && s.feed.emitter != nil {
+		s.feed.emitter.Emit(EventProfileChanged, p)
+	}
+
+	return nil
+}
diff --git a/client/ui/services/session.go b/client/ui/services/session.go
new file mode 100644
index 000000000..facb8e898
--- /dev/null
+++ b/client/ui/services/session.go
@@ -0,0 +1,48 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+
+	"github.com/netbirdio/netbird/client/ui/authsession"
+)
+
+// Re-exports so generated bindings reference services.* without importing authsession.
+type (
+	ExtendStartParams = authsession.ExtendStartParams
+	ExtendStartResult = authsession.ExtendStartResult
+	ExtendWaitParams  = authsession.ExtendWaitParams
+	ExtendResult      = authsession.ExtendResult
+)
+
+// Session wraps authsession.Session, exposing only the subset the React frontend
+// calls; the tray uses authsession.Session directly, keeping the generated TS surface minimal.
+type Session struct {
+	inner      *authsession.Session
+	classifier errorClassifier
+}
+
+// NewSession wraps inner; the caller retains ownership and may use it directly.
+// translator or prefs may be nil, in which case errors fall back to the bare code key.
+func NewSession(inner *authsession.Session, translator ErrorTranslator, prefs LanguagePreference) *Session {
+	return &Session{inner: inner, classifier: errorClassifier{translator: translator, prefs: prefs}}
+}
+
+// RequestExtend starts the SSO session-extension flow; the result carries the verification URI to open.
+func (s *Session) RequestExtend(ctx context.Context, p ExtendStartParams) (ExtendStartResult, error) {
+	res, err := s.inner.RequestExtend(ctx, p)
+	if err != nil {
+		return ExtendStartResult{}, s.classifier.classify(err)
+	}
+	return res, nil
+}
+
+// WaitExtend blocks until the RequestExtend flow completes; the deadline is nil when the peer is ineligible.
+func (s *Session) WaitExtend(ctx context.Context, p ExtendWaitParams) (ExtendResult, error) {
+	res, err := s.inner.WaitExtend(ctx, p)
+	if err != nil {
+		return ExtendResult{}, s.classifier.classify(err)
+	}
+	return res, nil
+}
diff --git a/client/ui/services/settings.go b/client/ui/services/settings.go
new file mode 100644
index 000000000..1c16795ae
--- /dev/null
+++ b/client/ui/services/settings.go
@@ -0,0 +1,256 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+	"fmt"
+	"reflect"
+
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+type MDMFields struct {
+	ManagementURL            string `json:"managementURL"`
+	PreSharedKey             bool   `json:"preSharedKey"`
+	WireguardPort            bool   `json:"wireguardPort"`
+	RosenpassEnabled         bool   `json:"rosenpassEnabled"`
+	RosenpassPermissive      bool   `json:"rosenpassPermissive"`
+	DisableClientRoutes      bool   `json:"disableClientRoutes"`
+	DisableServerRoutes      bool   `json:"disableServerRoutes"`
+	AllowServerSSH           *bool  `json:"allowServerSSH"`
+	DisableAutoConnect       bool   `json:"disableAutoConnect"`
+	BlockInbound             bool   `json:"blockInbound"`
+	DisableMetricsCollection bool   `json:"disableMetricsCollection"`
+	SplitTunnelMode          bool   `json:"splitTunnelMode"`
+	SplitTunnelApps          bool   `json:"splitTunnelApps"`
+	DisableAdvancedView bool `json:"disableAdvancedView"`
+}
+
+type Features struct {
+	DisableProfiles       bool `json:"disableProfiles"`
+	DisableNetworks       bool `json:"disableNetworks"`
+	DisableUpdateSettings bool `json:"disableUpdateSettings"`
+}
+
+type Restrictions struct {
+	MDM      MDMFields `json:"mdm"`
+	Features Features  `json:"features"`
+}
+
+type ConfigParams struct {
+	ProfileName string `json:"profileName"`
+	Username    string `json:"username"`
+}
+
+type Config struct {
+	ManagementURL                 string `json:"managementUrl"`
+	AdminURL                      string `json:"adminUrl"`
+	ConfigFile                    string `json:"configFile"`
+	LogFile                       string `json:"logFile"`
+	PreSharedKeySet               bool   `json:"preSharedKeySet"`
+	InterfaceName                 string `json:"interfaceName"`
+	WireguardPort                 int64  `json:"wireguardPort"`
+	MTU                           int64  `json:"mtu"`
+	DisableAutoConnect            bool   `json:"disableAutoConnect"`
+	ServerSSHAllowed              bool   `json:"serverSshAllowed"`
+	RosenpassEnabled              bool   `json:"rosenpassEnabled"`
+	RosenpassPermissive           bool   `json:"rosenpassPermissive"`
+	DisableNotifications          bool   `json:"disableNotifications"`
+	BlockInbound                  bool   `json:"blockInbound"`
+	NetworkMonitor                bool   `json:"networkMonitor"`
+	DisableClientRoutes           bool   `json:"disableClientRoutes"`
+	DisableServerRoutes           bool   `json:"disableServerRoutes"`
+	DisableDNS                    bool   `json:"disableDns"`
+	DisableIPv6                   bool   `json:"disableIpv6"`
+	BlockLANAccess                bool   `json:"blockLanAccess"`
+	EnableSSHRoot                 bool   `json:"enableSshRoot"`
+	EnableSSHSFTP                 bool   `json:"enableSshSftp"`
+	EnableSSHLocalPortForwarding  bool   `json:"enableSshLocalPortForwarding"`
+	EnableSSHRemotePortForwarding bool   `json:"enableSshRemotePortForwarding"`
+	DisableSSHAuth                bool   `json:"disableSshAuth"`
+	SSHJWTCacheTTL                int32  `json:"sshJwtCacheTtl"`
+}
+
+// SetConfigParams is a partial update — only non-nil pointer fields are sent
+// to the daemon; nil fields are preserved.
+type SetConfigParams struct {
+	ProfileName                   string  `json:"profileName"`
+	Username                      string  `json:"username"`
+	ManagementURL                 string  `json:"managementUrl"`
+	AdminURL                      string  `json:"adminUrl"`
+	InterfaceName                 *string `json:"interfaceName,omitempty"`
+	WireguardPort                 *int64  `json:"wireguardPort,omitempty"`
+	MTU                           *int64  `json:"mtu,omitempty"`
+	PreSharedKey                  *string `json:"preSharedKey,omitempty"`
+	DisableAutoConnect            *bool   `json:"disableAutoConnect,omitempty"`
+	ServerSSHAllowed              *bool   `json:"serverSshAllowed,omitempty"`
+	RosenpassEnabled              *bool   `json:"rosenpassEnabled,omitempty"`
+	RosenpassPermissive           *bool   `json:"rosenpassPermissive,omitempty"`
+	DisableNotifications          *bool   `json:"disableNotifications,omitempty"`
+	BlockInbound                  *bool   `json:"blockInbound,omitempty"`
+	NetworkMonitor                *bool   `json:"networkMonitor,omitempty"`
+	DisableClientRoutes           *bool   `json:"disableClientRoutes,omitempty"`
+	DisableServerRoutes           *bool   `json:"disableServerRoutes,omitempty"`
+	DisableDNS                    *bool   `json:"disableDns,omitempty"`
+	DisableIPv6                   *bool   `json:"disableIpv6,omitempty"`
+	DisableFirewall               *bool   `json:"disableFirewall,omitempty"`
+	BlockLANAccess                *bool   `json:"blockLanAccess,omitempty"`
+	EnableSSHRoot                 *bool   `json:"enableSshRoot,omitempty"`
+	EnableSSHSFTP                 *bool   `json:"enableSshSftp,omitempty"`
+	EnableSSHLocalPortForwarding  *bool   `json:"enableSshLocalPortForwarding,omitempty"`
+	EnableSSHRemotePortForwarding *bool   `json:"enableSshRemotePortForwarding,omitempty"`
+	DisableSSHAuth                *bool   `json:"disableSshAuth,omitempty"`
+	SSHJWTCacheTTL                *int32  `json:"sshJwtCacheTtl,omitempty"`
+}
+
+type Settings struct {
+	conn DaemonConn
+}
+
+func NewSettings(conn DaemonConn) *Settings {
+	return &Settings{conn: conn}
+}
+
+func (s *Settings) GetConfig(ctx context.Context, p ConfigParams) (Config, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return Config{}, err
+	}
+	resp, err := cli.GetConfig(ctx, &proto.GetConfigRequest{
+		ProfileName: p.ProfileName,
+		Username:    p.Username,
+	})
+	if err != nil {
+		return Config{}, err
+	}
+	return Config{
+		ManagementURL:                 resp.GetManagementUrl(),
+		AdminURL:                      resp.GetAdminURL(),
+		ConfigFile:                    resp.GetConfigFile(),
+		LogFile:                       resp.GetLogFile(),
+		PreSharedKeySet:               resp.GetPreSharedKey() != "",
+		InterfaceName:                 resp.GetInterfaceName(),
+		WireguardPort:                 resp.GetWireguardPort(),
+		MTU:                           resp.GetMtu(),
+		DisableAutoConnect:            resp.GetDisableAutoConnect(),
+		ServerSSHAllowed:              resp.GetServerSSHAllowed(),
+		RosenpassEnabled:              resp.GetRosenpassEnabled(),
+		RosenpassPermissive:           resp.GetRosenpassPermissive(),
+		DisableNotifications:          resp.GetDisableNotifications(),
+		BlockInbound:                  resp.GetBlockInbound(),
+		NetworkMonitor:                resp.GetNetworkMonitor(),
+		DisableClientRoutes:           resp.GetDisableClientRoutes(),
+		DisableServerRoutes:           resp.GetDisableServerRoutes(),
+		DisableDNS:                    resp.GetDisableDns(),
+		DisableIPv6:                   resp.GetDisableIpv6(),
+		BlockLANAccess:                resp.GetBlockLanAccess(),
+		EnableSSHRoot:                 resp.GetEnableSSHRoot(),
+		EnableSSHSFTP:                 resp.GetEnableSSHSFTP(),
+		EnableSSHLocalPortForwarding:  resp.GetEnableSSHLocalPortForwarding(),
+		EnableSSHRemotePortForwarding: resp.GetEnableSSHRemotePortForwarding(),
+		DisableSSHAuth:                resp.GetDisableSSHAuth(),
+		SSHJWTCacheTTL:                resp.GetSshJWTCacheTTL(),
+	}, nil
+}
+
+func (s *Settings) SetConfig(ctx context.Context, p SetConfigParams) error {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return err
+	}
+	req := &proto.SetConfigRequest{
+		ProfileName:                   p.ProfileName,
+		Username:                      p.Username,
+		ManagementUrl:                 p.ManagementURL,
+		AdminURL:                      p.AdminURL,
+		InterfaceName:                 p.InterfaceName,
+		WireguardPort:                 p.WireguardPort,
+		Mtu:                           p.MTU,
+		OptionalPreSharedKey:          p.PreSharedKey,
+		DisableAutoConnect:            p.DisableAutoConnect,
+		ServerSSHAllowed:              p.ServerSSHAllowed,
+		RosenpassEnabled:              p.RosenpassEnabled,
+		RosenpassPermissive:           p.RosenpassPermissive,
+		DisableNotifications:          p.DisableNotifications,
+		BlockInbound:                  p.BlockInbound,
+		NetworkMonitor:                p.NetworkMonitor,
+		DisableClientRoutes:           p.DisableClientRoutes,
+		DisableServerRoutes:           p.DisableServerRoutes,
+		DisableDns:                    p.DisableDNS,
+		DisableIpv6:                   p.DisableIPv6,
+		DisableFirewall:               p.DisableFirewall,
+		BlockLanAccess:                p.BlockLANAccess,
+		EnableSSHRoot:                 p.EnableSSHRoot,
+		EnableSSHSFTP:                 p.EnableSSHSFTP,
+		EnableSSHLocalPortForwarding:  p.EnableSSHLocalPortForwarding,
+		EnableSSHRemotePortForwarding: p.EnableSSHRemotePortForwarding,
+		DisableSSHAuth:                p.DisableSSHAuth,
+		SshJWTCacheTTL:                p.SSHJWTCacheTTL,
+	}
+	_, err = cli.SetConfig(ctx, req)
+	return err
+}
+
+func (s *Settings) GetRestrictions(ctx context.Context) (Restrictions, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return Restrictions{}, err
+	}
+	active, err := cli.GetActiveProfile(ctx, &proto.GetActiveProfileRequest{})
+	if err != nil {
+		return Restrictions{}, fmt.Errorf("get active profile: %w", err)
+	}
+	cfgResp, err := cli.GetConfig(ctx, &proto.GetConfigRequest{
+		ProfileName: active.GetId(),
+		Username:    active.GetUsername(),
+	})
+	if err != nil {
+		return Restrictions{}, err
+	}
+	featResp, err := cli.GetFeatures(ctx, &proto.GetFeaturesRequest{})
+	if err != nil {
+		return Restrictions{}, err
+	}
+	r := Restrictions{
+		Features: Features{
+			DisableProfiles:       featResp.GetDisableProfiles(),
+			DisableNetworks:       featResp.GetDisableNetworks(),
+			DisableUpdateSettings: featResp.GetDisableUpdateSettings(),
+		},
+	}
+	applyMDMRestrictions(&r.MDM, cfgResp)
+	r.MDM.DisableAdvancedView = featResp.GetDisableAdvancedView()
+	return r, nil
+}
+
+func applyMDMRestrictions(mdm *MDMFields, cfgResp *proto.GetConfigResponse) {
+	managed := cfgResp.GetMDMManagedFields()
+	if len(managed) == 0 {
+		return
+	}
+	set := make(map[string]struct{}, len(managed))
+	for _, k := range managed {
+		set[k] = struct{}{}
+	}
+	v := reflect.ValueOf(mdm).Elem()
+	t := v.Type()
+	for i := 0; i < t.NumField(); i++ {
+		if v.Field(i).Kind() != reflect.Bool {
+			continue
+		}
+		if t.Field(i).Name == "DisableAdvancedView" {
+			continue
+		}
+		if _, ok := set[t.Field(i).Tag.Get("json")]; ok {
+			v.Field(i).SetBool(true)
+		}
+	}
+	if _, ok := set["managementURL"]; ok {
+		mdm.ManagementURL = cfgResp.GetManagementUrl()
+	}
+	if _, ok := set["allowServerSSH"]; ok {
+		allowed := cfgResp.GetServerSSHAllowed()
+		mdm.AllowServerSSH = &allowed
+	}
+}
diff --git a/client/ui/services/uilog.go b/client/ui/services/uilog.go
new file mode 100644
index 000000000..0d794c137
--- /dev/null
+++ b/client/ui/services/uilog.go
@@ -0,0 +1,36 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// UILog forwards frontend console output into logrus, tagging the JS origin
+// as the "ui" field to stay distinct from logrus's Go-caller source.
+type UILog struct{}
+
+func NewUILog() *UILog { return &UILog{} }
+
+// Log maps an unrecognised level to info; empty source becomes "unknown".
+func (s *UILog) Log(_ context.Context, level, source, msg string) {
+	origin := "unknown"
+	if source != "" {
+		origin = source
+	}
+	entry := log.WithField("ui", origin)
+	switch level {
+	case "trace":
+		entry.Trace(msg)
+	case "debug":
+		entry.Debug(msg)
+	case "warn", "warning":
+		entry.Warn(msg)
+	case "error":
+		entry.Error(msg)
+	default:
+		entry.Info(msg)
+	}
+}
diff --git a/client/ui/services/update.go b/client/ui/services/update.go
new file mode 100644
index 000000000..753177d45
--- /dev/null
+++ b/client/ui/services/update.go
@@ -0,0 +1,73 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+	"time"
+
+	"github.com/wailsapp/wails/v3/pkg/application"
+
+	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/client/ui/updater"
+)
+
+// UpdateResult mirrors TriggerUpdateResponse.
+type UpdateResult struct {
+	Success  bool   `json:"success"`
+	ErrorMsg string `json:"errorMsg"`
+}
+
+// Update is the Wails-bound facade over the daemon's update RPCs. The state
+// machine and push event live in client/ui/updater.
+type Update struct {
+	conn   DaemonConn
+	holder *updater.Holder
+}
+
+func NewUpdate(conn DaemonConn, holder *updater.Holder) *Update {
+	return &Update{conn: conn, holder: holder}
+}
+
+func (s *Update) GetState() updater.State {
+	return s.holder.Get()
+}
+
+// Quit exits the app. Scheduled off the calling goroutine so the JS caller's
+// response returns before the runtime tears down.
+func (s *Update) Quit() {
+	go func() {
+		time.Sleep(100 * time.Millisecond)
+		application.Get().Quit()
+	}()
+}
+
+func (s *Update) Trigger(ctx context.Context) (UpdateResult, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return UpdateResult{}, err
+	}
+	resp, err := cli.TriggerUpdate(ctx, &proto.TriggerUpdateRequest{})
+	if err != nil {
+		return UpdateResult{}, err
+	}
+	return UpdateResult{
+		Success:  resp.GetSuccess(),
+		ErrorMsg: resp.GetErrorMsg(),
+	}, nil
+}
+
+func (s *Update) GetInstallerResult(ctx context.Context) (UpdateResult, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return UpdateResult{}, err
+	}
+	resp, err := cli.GetInstallerResult(ctx, &proto.InstallerResultRequest{})
+	if err != nil {
+		return UpdateResult{}, err
+	}
+	return UpdateResult{
+		Success:  resp.GetSuccess(),
+		ErrorMsg: resp.GetErrorMsg(),
+	}, nil
+}
diff --git a/client/ui/services/version.go b/client/ui/services/version.go
new file mode 100644
index 000000000..8caea9f72
--- /dev/null
+++ b/client/ui/services/version.go
@@ -0,0 +1,22 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"context"
+
+	"github.com/netbirdio/netbird/version"
+)
+
+// Version reports only the GUI's own version; the daemon version comes from
+// the status feed's DaemonVersion field.
+type Version struct{}
+
+func NewVersion() *Version {
+	return &Version{}
+}
+
+// GUI returns the UI binary's version, stamped via ldflags ("development" if un-stamped).
+func (v *Version) GUI(_ context.Context) string {
+	return version.NetbirdVersion()
+}
diff --git a/client/ui/services/windowmanager.go b/client/ui/services/windowmanager.go
new file mode 100644
index 000000000..3316dadaa
--- /dev/null
+++ b/client/ui/services/windowmanager.go
@@ -0,0 +1,576 @@
+//go:build !android && !ios && !freebsd && !js
+
+package services
+
+import (
+	"net/url"
+	"strconv"
+	"sync"
+	"time"
+
+	"github.com/wailsapp/wails/v3/pkg/application"
+	"github.com/wailsapp/wails/v3/pkg/events"
+
+	"github.com/netbirdio/netbird/client/ui/i18n"
+	"github.com/netbirdio/netbird/client/ui/preferences"
+)
+
+// LanguageSubscriber delivers UI preference changes so window titles follow the language.
+type LanguageSubscriber interface {
+	Subscribe() (<-chan preferences.UIPreferences, func())
+}
+
+// EventTriggerLogin asks the frontend's startLogin() to begin an SSO flow.
+const EventTriggerLogin = "trigger-login"
+
+// EventBrowserLoginCancel signals the user dismissed the BrowserLogin popup.
+const EventBrowserLoginCancel = "browser-login:cancel"
+
+// EventSettingsOpen tells the mounted settings window which tab to show.
+const EventSettingsOpen = "netbird:settings:open"
+
+var WindowBackgroundColour = application.NewRGB(24, 26, 29) // bg-nb-gray-950
+
+// WindowHeight is shared by the main and Settings windows.
+const WindowHeight = 660
+
+// Wails reads CustomTheme colours as 0x00BBGGRR (RGB byte order reversed).
+var microsoftWindowsTheme = &application.WindowTheme{
+	BorderColour:    u32ptr(0x00211E1C),
+	TitleBarColour:  u32ptr(0x00211E1C),
+	TitleTextColour: u32ptr(0x00E9E7E4),
+}
+
+// MicrosoftWindowsAppearanceOptions is the shared Windows chrome (Mica + dark + custom title bar).
+func MicrosoftWindowsAppearanceOptions() application.WindowsWindow {
+	return application.WindowsWindow{
+		BackdropType: application.Mica,
+		Theme:        application.Dark,
+		CustomTheme: application.ThemeSettings{
+			DarkModeActive:    microsoftWindowsTheme,
+			DarkModeInactive:  microsoftWindowsTheme,
+			LightModeActive:   microsoftWindowsTheme,
+			LightModeInactive: microsoftWindowsTheme,
+		},
+	}
+}
+
+// AppleMacOSAppearanceOptions is the shared macOS chrome; FullScreenNone keeps the fixed-size layout.
+func AppleMacOSAppearanceOptions() application.MacWindow {
+	return application.MacWindow{
+		InvisibleTitleBarHeight: 38,
+		Backdrop:                application.MacBackdropNormal,
+		TitleBar:                application.MacTitleBarHiddenInset,
+		CollectionBehavior:      application.MacWindowCollectionBehaviorFullScreenNone,
+	}
+}
+
+// LinuxAppearanceOptions is the shared Linux chrome; opaque so fake-translucency compositors paint it.
+func LinuxAppearanceOptions(icon []byte) application.LinuxWindow {
+	return application.LinuxWindow{
+		Icon:                icon,
+		WindowIsTranslucent: false,
+	}
+}
+
+// DialogWindowOptions is the baseline for every auxiliary dialog window; callers override per-dialog.
+func DialogWindowOptions(name, title, url string, linuxIcon []byte) application.WebviewWindowOptions {
+	return application.WebviewWindowOptions{
+		Name:                name,
+		Title:               title,
+		Width:               360,
+		Height:              320,
+		DisableResize:       true,
+		AlwaysOnTop:         true,
+		Hidden:              true,
+		MinimiseButtonState: application.ButtonHidden,
+		MaximiseButtonState: application.ButtonHidden,
+		CloseButtonState:    application.ButtonEnabled,
+		BackgroundColour:    WindowBackgroundColour,
+		URL:                 url,
+		Mac:                 AppleMacOSAppearanceOptions(),
+		Windows:             MicrosoftWindowsAppearanceOptions(),
+		Linux:               LinuxAppearanceOptions(linuxIcon),
+	}
+}
+
+// WindowManager owns the auxiliary windows (main is created in main.go). Settings is created
+// eagerly and hidden on close to keep React state; the rest are created on open, destroyed on
+// close, so the macOS dock-reopen handler finds no hidden window to resurrect.
+type WindowManager struct {
+	app               *application.App
+	mainWindow        *application.WebviewWindow
+	translator        ErrorTranslator
+	prefs             LanguagePreference
+	linuxIcon         []byte
+	settings          *application.WebviewWindow
+	browserLogin      *application.WebviewWindow
+	sessionExpiration *application.WebviewWindow
+	installProgress   *application.WebviewWindow
+	welcome           *application.WebviewWindow
+	errorDialog       *application.WebviewWindow
+	// hiddenForLogin holds windows hidden while the BrowserLogin popup is open, restored on close.
+	hiddenForLogin []application.Window
+	mu             sync.Mutex
+	// recenterOnShow is set only on the minimal-WM/XEmbed path, where the WM neither centers nor
+	// restores position; nil on full desktops so re-centering can't fight a user-moved window.
+	recenterOnShow func() bool
+}
+
+// NewWindowManager wires the manager to the main app; translator/prefs may be nil (tests). The
+// Settings window is created here (hidden) so the first OpenSettings is instant.
+func NewWindowManager(app *application.App, mainWindow *application.WebviewWindow, translator ErrorTranslator, prefs LanguagePreference, linuxIcon []byte) *WindowManager {
+	s := &WindowManager{app: app, mainWindow: mainWindow, translator: translator, prefs: prefs, linuxIcon: linuxIcon}
+	// Re-title live windows on language flip. Wired internally so the binding generator
+	// doesn't try to expose the interface param.
+	if sub, ok := prefs.(LanguageSubscriber); ok && sub != nil {
+		ch, _ := sub.Subscribe()
+		go func() {
+			var last i18n.LanguageCode
+			for p := range ch {
+				if p.Language == "" || p.Language == last {
+					continue
+				}
+				last = p.Language
+				s.retitleAll()
+			}
+		}()
+	}
+	s.settings = app.Window.NewWithOptions(application.WebviewWindowOptions{
+		Name:                "settings",
+		Title:               s.title("window.title.settings"),
+		Width:               900,
+		Height:              WindowHeight,
+		Hidden:              true,
+		DisableResize:       true,
+		MinimiseButtonState: application.ButtonHidden,
+		MaximiseButtonState: application.ButtonHidden,
+		CloseButtonState:    application.ButtonEnabled,
+		BackgroundColour:    WindowBackgroundColour,
+		URL:                 "/#/settings",
+		Mac:                 AppleMacOSAppearanceOptions(),
+		Windows:             MicrosoftWindowsAppearanceOptions(),
+		Linux:               LinuxAppearanceOptions(linuxIcon),
+	})
+	// Hide (not destroy) on close to keep React state; reset to General for a flash-free reopen.
+	s.settings.RegisterHook(events.Common.WindowClosing, func(e *application.WindowEvent) {
+		e.Cancel()
+		s.app.Event.Emit(EventSettingsOpen, "general")
+		s.settings.Hide()
+	})
+	return s
+}
+
+// OpenSettings shows the settings window on tab (empty → General), switching tab via
+// EventSettingsOpen rather than SetURL (which would remount the provider tree).
+func (s *WindowManager) OpenSettings(tab string) {
+	target := tab
+	if target == "" {
+		target = "general"
+	}
+	s.app.Event.Emit(EventSettingsOpen, target)
+	s.settings.Show()
+	s.settings.Focus()
+	// Re-center (minimal-WM only; see centerWhenReady).
+	s.centerWhenReady(s.settings)
+}
+
+// OpenBrowserLogin shows the SSO popup, creating it on first use.
+func (s *WindowManager) OpenBrowserLogin(uri string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.browserLogin == nil {
+		startURL := "/#/dialog/browser-login"
+		if uri != "" {
+			startURL = "/#/dialog/browser-login?uri=" + url.QueryEscape(uri)
+		}
+		s.hideOtherWindowsLocked("browser-login")
+		// Prefer the main window's screen (multi-monitor); falls back to OS-default centering.
+		var screen *application.Screen
+		if s.mainWindow != nil {
+			if sc, err := s.mainWindow.GetScreen(); err == nil {
+				screen = sc
+			}
+		}
+		opts := DialogWindowOptions("browser-login", s.title("window.title.signIn"), startURL, s.linuxIcon)
+		// Not always-on-top: it would obscure the browser tab the user logs in through.
+		opts.AlwaysOnTop = false
+		opts.InitialPosition = application.WindowCentered
+		opts.Screen = screen
+		s.browserLogin = s.app.Window.NewWithOptions(opts)
+		bl := s.browserLogin
+		// Red-X close means cancel: emit the event so startLogin() tears down the SSO wait.
+		bl.OnWindowEvent(events.Common.WindowClosing, func(_ *application.WindowEvent) {
+			s.app.Event.Emit(EventBrowserLoginCancel)
+			s.mu.Lock()
+			s.browserLogin = nil
+			s.restoreHiddenWindowsLocked()
+			s.mu.Unlock()
+		})
+		s.centerWhenReady(s.browserLogin)
+		return
+	}
+	if uri != "" {
+		s.browserLogin.SetURL("/#/dialog/browser-login?uri=" + url.QueryEscape(uri))
+	}
+	s.browserLogin.Show()
+	s.browserLogin.Focus()
+	s.centerWhenReady(s.browserLogin)
+}
+
+// BrowserLoginWindow returns the live SSO popup, or nil. While non-nil it is the
+// app's focal window: tray "Open" and dock activation hand off to it, not the main window.
+func (s *WindowManager) BrowserLoginWindow() *application.WebviewWindow {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.browserLogin
+}
+
+// InstallProgressWindow returns the live install-progress window, or nil. Same focal-window
+// contract as BrowserLoginWindow; install supersedes everything, so check this first.
+func (s *WindowManager) InstallProgressWindow() *application.WebviewWindow {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.installProgress
+}
+
+func (s *WindowManager) CloseBrowserLogin() {
+	s.mu.Lock()
+	w := s.browserLogin
+	s.browserLogin = nil
+	s.mu.Unlock()
+	if w != nil {
+		w.Close()
+	}
+}
+
+// OpenSessionExpiration shows the countdown warning on the cursor's display; seconds seeds
+// the countdown. Singleton, destroyed on close.
+func (s *WindowManager) OpenSessionExpiration(seconds int) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	startURL := "/#/dialog/session-expiration?seconds=" + strconv.Itoa(seconds)
+	if s.sessionExpiration == nil {
+		opts := DialogWindowOptions("session-expiration", s.title("window.title.sessionExpiration"), startURL, s.linuxIcon)
+		opts.Screen = s.getScreenBasedOnCursorPosition()
+		opts.InitialPosition = application.WindowCentered
+		s.sessionExpiration = s.app.Window.NewWithOptions(opts)
+		s.sessionExpiration.OnWindowEvent(events.Common.WindowClosing, func(_ *application.WindowEvent) {
+			s.mu.Lock()
+			s.sessionExpiration = nil
+			s.mu.Unlock()
+		})
+		s.centerOnCursorScreen(s.sessionExpiration)
+		return
+	}
+	s.sessionExpiration.SetURL(startURL)
+	s.centerOnCursorScreen(s.sessionExpiration)
+	s.sessionExpiration.Show()
+	s.sessionExpiration.Focus()
+}
+
+func (s *WindowManager) CloseSessionExpiration() {
+	s.mu.Lock()
+	w := s.sessionExpiration
+	s.sessionExpiration = nil
+	s.mu.Unlock()
+	if w != nil {
+		w.Close()
+	}
+}
+
+// OpenInstallProgress shows the install-progress window and hides the rest for the duration
+// (restored on close). It owns its own result polling since the daemon restarts mid-install.
+func (s *WindowManager) OpenInstallProgress(version string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	startURL := "/#/dialog/install-progress"
+	if version != "" {
+		startURL = "/#/dialog/install-progress?version=" + url.QueryEscape(version)
+	}
+	if s.installProgress == nil {
+		s.hideOtherWindowsLocked("install-progress")
+		s.installProgress = s.app.Window.NewWithOptions(
+			DialogWindowOptions("install-progress", s.title("window.title.updating"), startURL, s.linuxIcon),
+		)
+		s.installProgress.OnWindowEvent(events.Common.WindowClosing, func(_ *application.WindowEvent) {
+			s.mu.Lock()
+			s.installProgress = nil
+			s.restoreHiddenWindowsLocked()
+			s.mu.Unlock()
+		})
+		s.centerWhenReady(s.installProgress)
+		return
+	}
+	s.installProgress.SetURL(startURL)
+	s.installProgress.Show()
+	s.installProgress.Focus()
+	s.centerWhenReady(s.installProgress)
+}
+
+func (s *WindowManager) CloseInstallProgress() {
+	s.mu.Lock()
+	w := s.installProgress
+	s.installProgress = nil
+	s.mu.Unlock()
+	if w != nil {
+		w.Close()
+	}
+}
+
+// OpenWelcome shows the first-launch onboarding window. Singleton, destroyed on close.
+func (s *WindowManager) OpenWelcome() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.welcome == nil {
+		opts := DialogWindowOptions("welcome", s.title("window.title.welcome"), "/#/dialog/welcome", s.linuxIcon)
+		opts.Width = 420
+		opts.InitialPosition = application.WindowCentered
+		s.welcome = s.app.Window.NewWithOptions(opts)
+		w := s.welcome
+		w.OnWindowEvent(events.Common.WindowClosing, func(_ *application.WindowEvent) {
+			s.mu.Lock()
+			s.welcome = nil
+			s.mu.Unlock()
+		})
+		s.centerWhenReady(s.welcome)
+		return
+	}
+	s.welcome.Show()
+	s.welcome.Focus()
+	s.centerWhenReady(s.welcome)
+}
+
+func (s *WindowManager) CloseWelcome() {
+	s.mu.Lock()
+	w := s.welcome
+	s.welcome = nil
+	s.mu.Unlock()
+	if w != nil {
+		w.Close()
+	}
+}
+
+// OpenError shows the custom error dialog; title/message are pre-localised and ride in the
+// start URL. A second error replaces the open one via SetURL. Singleton, destroyed on close.
+func (s *WindowManager) OpenError(title, message string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	startURL := errorDialogURL(title, message)
+	if s.errorDialog == nil {
+		s.errorDialog = s.app.Window.NewWithOptions(
+			DialogWindowOptions("error", s.title("window.title.error"), startURL, s.linuxIcon),
+		)
+		s.errorDialog.OnWindowEvent(events.Common.WindowClosing, func(_ *application.WindowEvent) {
+			s.mu.Lock()
+			s.errorDialog = nil
+			s.mu.Unlock()
+		})
+		s.centerWhenReady(s.errorDialog)
+		return
+	}
+	s.errorDialog.SetURL(startURL)
+	s.errorDialog.Show()
+	s.errorDialog.Focus()
+	s.centerWhenReady(s.errorDialog)
+}
+
+func (s *WindowManager) CloseError() {
+	s.mu.Lock()
+	w := s.errorDialog
+	s.errorDialog = nil
+	s.mu.Unlock()
+	if w != nil {
+		w.Close()
+	}
+}
+
+// OpenMain brings the main window forward; the welcome handoff uses it instead of the tray.
+func (s *WindowManager) OpenMain() {
+	s.ShowMain()
+}
+
+// ShowMain brings the main window forward (re-centering on minimal WMs). The single entry
+// point every surface (tray, SIGUSR1, welcome) should use so centering applies uniformly.
+func (s *WindowManager) ShowMain() {
+	if s.mainWindow == nil {
+		return
+	}
+	s.mainWindow.Show()
+	s.mainWindow.Focus()
+	// Re-center (minimal-WM only; see centerWhenReady).
+	s.centerWhenReady(s.mainWindow)
+}
+
+// SetRecenterOnShow installs the recenterOnShow predicate (see the field).
+func (s *WindowManager) SetRecenterOnShow(pred func() bool) {
+	s.recenterOnShow = pred
+}
+
+// centerWhenReady centers w only on minimal WMs (recenterOnShow); elsewhere it
+// returns so it never fights a user-moved window. On GTK4 an inline Center()
+// no-ops until the GdkSurface is realized (async, after Show) and InvokeAsync
+// would deadlock, so a background goroutine retries until Position is non-zero,
+// bounded so a window genuinely at the origin can't spin forever.
+func (s *WindowManager) centerWhenReady(w *application.WebviewWindow) {
+	if w == nil || s.recenterOnShow == nil || !s.recenterOnShow() {
+		return
+	}
+	go func() {
+		for i := 0; i < 50; i++ { // ~1s budget at 20ms steps
+			w.Center()
+			if x, y := w.Position(); x != 0 || y != 0 {
+				return // surface realized
+			}
+			time.Sleep(20 * time.Millisecond)
+		}
+	}()
+}
+
+// centerOnCursorScreen centers w on the cursor's display; guards no-op on headless sessions.
+// On minimal WMs it uses the same realize-detection retry loop as centerWhenReady.
+func (s *WindowManager) centerOnCursorScreen(w *application.WebviewWindow) {
+	if w == nil {
+		return
+	}
+	place := func() {
+		screen := s.getScreenBasedOnCursorPosition()
+		if screen == nil {
+			return
+		}
+		width, height := w.Size()
+		if width <= 0 || height <= 0 {
+			return
+		}
+		wa := screen.WorkArea
+		if wa.Width <= 0 || wa.Height <= 0 {
+			return
+		}
+		w.SetPosition(wa.X+(wa.Width-width)/2, wa.Y+(wa.Height-height)/2)
+	}
+	place()
+	if s.recenterOnShow == nil || !s.recenterOnShow() {
+		return
+	}
+	go func() {
+		for i := 0; i < 50; i++ {
+			place()
+			if x, y := w.Position(); x != 0 || y != 0 {
+				return
+			}
+			time.Sleep(20 * time.Millisecond)
+		}
+	}()
+}
+
+// title resolves a window-title i18n key in the current language, or the raw key if unavailable.
+func (s *WindowManager) title(key string) string {
+	if s.translator == nil {
+		return key
+	}
+	lang := i18n.DefaultLanguage
+	if s.prefs != nil {
+		if pref := s.prefs.Get().Language; pref != "" {
+			lang = pref
+		}
+	}
+	return s.translator.Translate(lang, key)
+}
+
+// retitleAll re-applies the localised title to every live auxiliary window. Pointers are
+// snapshotted under s.mu; SetTitle is then safe to call after releasing the lock.
+func (s *WindowManager) retitleAll() {
+	s.mu.Lock()
+	type pair struct {
+		win *application.WebviewWindow
+		key string
+	}
+	wins := []pair{
+		{s.settings, "window.title.settings"},
+		{s.browserLogin, "window.title.signIn"},
+		{s.sessionExpiration, "window.title.sessionExpiration"},
+		{s.installProgress, "window.title.updating"},
+		{s.welcome, "window.title.welcome"},
+		{s.errorDialog, "window.title.error"},
+	}
+	s.mu.Unlock()
+	for _, p := range wins {
+		if p.win != nil {
+			p.win.SetTitle(s.title(p.key))
+		}
+	}
+}
+
+// hideOtherWindowsLocked hides every visible window except keepName, recording
+// them in hiddenForLogin for restoreHiddenWindowsLocked. Caller must hold s.mu.
+func (s *WindowManager) hideOtherWindowsLocked(keepName string) {
+	for _, w := range s.app.Window.GetAll() {
+		if w == nil || w.Name() == keepName {
+			continue
+		}
+		if !w.IsVisible() {
+			continue
+		}
+		w.Hide()
+		s.hiddenForLogin = append(s.hiddenForLogin, w)
+	}
+}
+
+// restoreHiddenWindowsLocked re-shows windows hidden by hideOtherWindowsLocked
+// (caller holds s.mu). If the main window was among them, raiseToForeground
+// lifts it above the SSO browser, which still owns the foreground — a plain
+// Show/Focus would be demoted to a taskbar flash and leave it stranded behind.
+func (s *WindowManager) restoreHiddenWindowsLocked() {
+	mainRestored := false
+	for _, w := range s.hiddenForLogin {
+		if w == nil {
+			continue
+		}
+		w.Show()
+		if w == s.mainWindow {
+			mainRestored = true
+		}
+	}
+	s.hiddenForLogin = nil
+	if mainRestored && s.mainWindow != nil {
+		raiseToForeground(s.mainWindow)
+	}
+}
+
+// getScreenBasedOnCursorPosition returns the cursor's display, falling back to the
+// main-window screen, then nil (OS-default placement).
+func (s *WindowManager) getScreenBasedOnCursorPosition() *application.Screen {
+	if s.app == nil || s.app.Screen == nil {
+		return nil
+	}
+	if p, ok := getCursorPosition(s.app); ok {
+		if sc := s.app.Screen.ScreenNearestDipPoint(p); sc != nil {
+			return sc
+		}
+	}
+	if s.mainWindow != nil {
+		if sc, err := s.mainWindow.GetScreen(); err == nil {
+			return sc
+		}
+	}
+	return nil
+}
+
+// errorDialogURL builds the error window's start URL with title/message as escaped query params.
+func errorDialogURL(title, message string) string {
+	q := url.Values{}
+	if title != "" {
+		q.Set("title", title)
+	}
+	if message != "" {
+		q.Set("message", message)
+	}
+	startURL := "/#/dialog/error"
+	if enc := q.Encode(); enc != "" {
+		startURL += "?" + enc
+	}
+	return startURL
+}
+
+// u32ptr returns a pointer to v, for the optional *uint32 Wails theme fields.
+func u32ptr(v uint32) *uint32 { return &v }
diff --git a/client/ui/signal_unix.go b/client/ui/signal_unix.go
index 99de99f0f..876c5dd6e 100644
--- a/client/ui/signal_unix.go
+++ b/client/ui/signal_unix.go
@@ -1,76 +1,31 @@
-//go:build !windows && !(linux && 386)
+//go:build !windows && !android && !ios && !freebsd && !js
 
 package main
 
 import (
 	"context"
 	"os"
-	"os/exec"
 	"os/signal"
 	"syscall"
 
 	log "github.com/sirupsen/logrus"
 )
 
-// setupSignalHandler sets up a signal handler to listen for SIGUSR1.
-// When received, it opens the quick actions window.
-func (s *serviceClient) setupSignalHandler(ctx context.Context) {
-	sigChan := make(chan os.Signal, 1)
-	signal.Notify(sigChan, syscall.SIGUSR1)
+// listenForShowSignal lets external tools surface the running UI by signalling its pid (SIGUSR1).
+func listenForShowSignal(ctx context.Context, tray *Tray) {
+	sigCh := make(chan os.Signal, 1)
+	signal.Notify(sigCh, syscall.SIGUSR1)
 
 	go func() {
 		for {
 			select {
 			case <-ctx.Done():
+				signal.Stop(sigCh)
 				return
-			case <-sigChan:
-				log.Info("received SIGUSR1 signal, opening quick actions window")
-				s.openQuickActions()
+			case <-sigCh:
+				log.Debug("SIGUSR1 received, showing window")
+				tray.ShowWindow()
 			}
 		}
 	}()
 }
-
-// openQuickActions opens the quick actions window by spawning a new process.
-func (s *serviceClient) openQuickActions() {
-	proc, err := os.Executable()
-	if err != nil {
-		log.Errorf("get executable path: %v", err)
-		return
-	}
-
-	cmd := exec.CommandContext(s.ctx, proc,
-		"--quick-actions=true",
-		"--daemon-addr="+s.addr,
-	)
-
-	if out := s.attachOutput(cmd); out != nil {
-		defer func() {
-			if err := out.Close(); err != nil {
-				log.Errorf("close log file %s: %v", s.logFile, err)
-			}
-		}()
-	}
-
-	log.Infof("running command: %s --quick-actions=true --daemon-addr=%s", proc, s.addr)
-
-	if err := cmd.Start(); err != nil {
-		log.Errorf("start quick actions window: %v", err)
-		return
-	}
-
-	go func() {
-		if err := cmd.Wait(); err != nil {
-			log.Debugf("quick actions window exited: %v", err)
-		}
-	}()
-}
-
-// sendShowWindowSignal sends SIGUSR1 to the specified PID.
-func sendShowWindowSignal(pid int32) error {
-	process, err := os.FindProcess(int(pid))
-	if err != nil {
-		return err
-	}
-	return process.Signal(syscall.SIGUSR1)
-}
diff --git a/client/ui/signal_windows.go b/client/ui/signal_windows.go
index 58f46374f..86caa6d0c 100644
--- a/client/ui/signal_windows.go
+++ b/client/ui/signal_windows.go
@@ -5,9 +5,6 @@ package main
 import (
 	"context"
 	"errors"
-	"fmt"
-	"os"
-	"os/exec"
 	"time"
 
 	log "github.com/sirupsen/logrus"
@@ -17,155 +14,65 @@ import (
 const (
 	quickActionsTriggerEventName = `Global\NetBirdQuickActionsTriggerEvent`
 	waitTimeout                  = 5 * time.Second
-	// SYNCHRONIZE is needed for WaitForSingleObject, EVENT_MODIFY_STATE for ResetEvent.
-	desiredAccesses = windows.SYNCHRONIZE | windows.EVENT_MODIFY_STATE
+	desiredAccesses              = windows.SYNCHRONIZE | windows.EVENT_MODIFY_STATE
+
+	// WAIT_TIMEOUT return code; not exposed by golang.org/x/sys/windows.
+	waitTimeoutCode uint32 = 0x00000102
 )
 
-func getEventNameUint16Pointer() (*uint16, error) {
-	eventNamePtr, err := windows.UTF16PtrFromString(quickActionsTriggerEventName)
-	if err != nil {
-		log.Errorf("Failed to convert event name '%s' to UTF16: %v", quickActionsTriggerEventName, err)
-		return nil, err
-	}
-
-	return eventNamePtr, nil
-}
-
-// setupSignalHandler sets up signal handling for Windows.
-// Windows doesn't support SIGUSR1, so this uses a similar approach using windows.Events.
-func (s *serviceClient) setupSignalHandler(ctx context.Context) {
-	eventNamePtr, err := getEventNameUint16Pointer()
+// listenForShowSignal shows the main window when an external process pulses the named event.
+func listenForShowSignal(ctx context.Context, tray *Tray) {
+	namePtr, err := windows.UTF16PtrFromString(quickActionsTriggerEventName)
 	if err != nil {
+		log.Errorf("trigger event name: %v", err)
 		return
 	}
 
-	eventHandle, err := windows.CreateEvent(nil, 1, 0, eventNamePtr)
-
+	handle, err := windows.CreateEvent(nil, 1, 0, namePtr)
 	if err != nil {
-		if errors.Is(err, windows.ERROR_ALREADY_EXISTS) {
-			log.Warnf("Quick actions trigger event '%s' already exists. Attempting to open.", quickActionsTriggerEventName)
-			eventHandle, err = windows.OpenEvent(desiredAccesses, false, eventNamePtr)
-			if err != nil {
-				log.Errorf("Failed to open existing quick actions trigger event '%s': %v", quickActionsTriggerEventName, err)
-				return
-			}
-			log.Infof("Successfully opened existing quick actions trigger event '%s'.", quickActionsTriggerEventName)
-		} else {
-			log.Errorf("Failed to create quick actions trigger event '%s': %v", quickActionsTriggerEventName, err)
+		if !errors.Is(err, windows.ERROR_ALREADY_EXISTS) {
+			log.Errorf("create trigger event %q: %v", quickActionsTriggerEventName, err)
+			return
+		}
+		handle, err = windows.OpenEvent(desiredAccesses, false, namePtr)
+		if err != nil {
+			log.Errorf("open trigger event %q: %v", quickActionsTriggerEventName, err)
 			return
 		}
 	}
 
-	if eventHandle == windows.InvalidHandle {
-		log.Errorf("Obtained an invalid handle for quick actions trigger event '%s'", quickActionsTriggerEventName)
+	if handle == windows.InvalidHandle {
+		log.Errorf("invalid handle for trigger event %q", quickActionsTriggerEventName)
 		return
 	}
 
-	log.Infof("Quick actions handler waiting for signal on event: %s", quickActionsTriggerEventName)
-
-	go s.waitForEvent(ctx, eventHandle)
+	go waitForTrigger(ctx, handle, tray)
 }
 
-func (s *serviceClient) waitForEvent(ctx context.Context, eventHandle windows.Handle) {
+func waitForTrigger(ctx context.Context, handle windows.Handle, tray *Tray) {
 	defer func() {
-		if err := windows.CloseHandle(eventHandle); err != nil {
-			log.Errorf("Failed to close quick actions event handle '%s': %v", quickActionsTriggerEventName, err)
+		if err := windows.CloseHandle(handle); err != nil {
+			log.Errorf("close trigger event handle: %v", err)
 		}
 	}()
 
+	timeoutMs := uint32(waitTimeout / time.Millisecond)
 	for {
 		if ctx.Err() != nil {
 			return
 		}
-
-		status, err := windows.WaitForSingleObject(eventHandle, uint32(waitTimeout.Milliseconds()))
-
-		switch status {
-		case windows.WAIT_OBJECT_0:
-			log.Info("Received signal on quick actions event. Opening quick actions window.")
-
-			// reset the event so it can be triggered again later (manual reset == 1)
-			if err := windows.ResetEvent(eventHandle); err != nil {
-				log.Errorf("Failed to reset quick actions event '%s': %v", quickActionsTriggerEventName, err)
-			}
-
-			s.openQuickActions()
-		case uint32(windows.WAIT_TIMEOUT):
-
-		default:
-			if isDone := logUnexpectedStatus(ctx, status, err); isDone {
-				return
+		ev, err := windows.WaitForSingleObject(handle, timeoutMs)
+		switch {
+		case err != nil:
+			log.Errorf("wait trigger event: %v", err)
+			return
+		case ev == waitTimeoutCode:
+			continue
+		case ev == windows.WAIT_OBJECT_0:
+			if err := windows.ResetEvent(handle); err != nil {
+				log.Errorf("reset trigger event: %v", err)
 			}
+			tray.ShowWindow()
 		}
 	}
 }
-
-func logUnexpectedStatus(ctx context.Context, status uint32, err error) bool {
-	log.Errorf("Unexpected status %d from WaitForSingleObject for quick actions event '%s': %v",
-		status, quickActionsTriggerEventName, err)
-	select {
-	case <-time.After(5 * time.Second):
-		return false
-	case <-ctx.Done():
-		return true
-	}
-}
-
-// openQuickActions opens the quick actions window by spawning a new process.
-func (s *serviceClient) openQuickActions() {
-	proc, err := os.Executable()
-	if err != nil {
-		log.Errorf("get executable path: %v", err)
-		return
-	}
-
-	cmd := exec.CommandContext(s.ctx, proc,
-		"--quick-actions=true",
-		"--daemon-addr="+s.addr,
-	)
-
-	if out := s.attachOutput(cmd); out != nil {
-		defer func() {
-			if err := out.Close(); err != nil {
-				log.Errorf("close log file %s: %v", s.logFile, err)
-			}
-		}()
-	}
-
-	log.Infof("running command: %s --quick-actions=true --daemon-addr=%s", proc, s.addr)
-
-	if err := cmd.Start(); err != nil {
-		log.Errorf("error starting quick actions window: %v", err)
-		return
-	}
-
-	go func() {
-		if err := cmd.Wait(); err != nil {
-			log.Debugf("quick actions window exited: %v", err)
-		}
-	}()
-}
-
-func sendShowWindowSignal(pid int32) error {
-	_, err := os.FindProcess(int(pid))
-	if err != nil {
-		return err
-	}
-
-	eventNamePtr, err := getEventNameUint16Pointer()
-	if err != nil {
-		return err
-	}
-
-	eventHandle, err := windows.OpenEvent(desiredAccesses, false, eventNamePtr)
-	if err != nil {
-		return err
-	}
-
-	err = windows.SetEvent(eventHandle)
-	if err != nil {
-		return fmt.Errorf("error setting event: %w", err)
-	}
-
-	return nil
-}
diff --git a/client/ui/tray.go b/client/ui/tray.go
new file mode 100644
index 000000000..700d94098
--- /dev/null
+++ b/client/ui/tray.go
@@ -0,0 +1,531 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"context"
+	"runtime"
+	"strings"
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/wailsapp/wails/v3/pkg/application"
+	"github.com/wailsapp/wails/v3/pkg/events"
+	"github.com/wailsapp/wails/v3/pkg/services/notifications"
+
+	"github.com/netbirdio/netbird/client/ui/authsession"
+	"github.com/netbirdio/netbird/client/ui/i18n"
+	"github.com/netbirdio/netbird/client/ui/services"
+	"github.com/netbirdio/netbird/version"
+)
+
+// Notification IDs are OS dedup keys that coalesce duplicate toasts;
+// statusError is a tray-only sentinel for the error-icon state.
+const (
+	notifyIDUpdatePrefix = "netbird-update-"
+	notifyIDEvent        = "netbird-event-"
+	notifyIDTrayError    = "netbird-tray-error"
+	notifyIDMDMPolicy    = "netbird-mdm-policy"
+
+	statusError = "Error"
+
+	urlGitHubRepo     = "https://github.com/netbirdio/netbird"
+	urlGitHubReleases = "https://github.com/netbirdio/netbird/releases/latest"
+	urlDocs           = "https://docs.netbird.io"
+)
+
+// TrayServices bundles the services the tray menu needs, grouped so NewTray
+// stays under the linter's parameter-count threshold.
+type TrayServices struct {
+	Connection      *services.Connection
+	Settings        *services.Settings
+	Profiles        *services.Profiles
+	Networks        *services.Networks
+	DaemonFeed      *services.DaemonFeed
+	Notifier        *notifications.NotificationService
+	Update          *services.Update
+	ProfileSwitcher *services.ProfileSwitcher
+	WindowManager   *services.WindowManager
+	// Session is bound to authsession directly because the services wrapper
+	// only re-exposes the React subset.
+	Session   *authsession.Session
+	Localizer *Localizer
+}
+
+type Tray struct {
+	app    *application.App
+	tray   *application.SystemTray
+	window *application.WebviewWindow
+	svc    TrayServices
+	// panelDark reports whether the desktop panel uses a dark scheme, so
+	// iconForState can pick the black vs white mono tray icon on Linux. Set
+	// by startTrayTheme (Linux only); nil elsewhere, where panelIsDark falls
+	// back to its default.
+	panelDark func() bool
+	loc       *Localizer
+
+	// menu and the *Item/*Submenu fields below are reassigned by buildMenu
+	// on every relayout — touch them only with menuMu held. Exceptions:
+	// the Connect/Disconnect OnClick closures capture their own item, and
+	// refreshSessionExpiresLabel snapshots its item under menuMu.
+	menu       *application.Menu
+	statusItem *application.MenuItem
+	// sessionExpiresItem shows the SSO deadline as a remaining-time label,
+	// repainted by a 30s ticker.
+	sessionExpiresItem *application.MenuItem
+	upItem             *application.MenuItem
+	downItem           *application.MenuItem
+	exitNodeItem       *application.MenuItem
+	exitNodeSubmenu    *application.Menu
+	profileSubmenu     *application.Menu
+	profileSubmenuItem *application.MenuItem
+	profileEmailItem   *application.MenuItem
+	settingsItem       *application.MenuItem
+	daemonVersionItem  *application.MenuItem
+
+	updater *trayUpdater
+
+	// statusMu guards the daemon-status core mirrored on the tray. One mutex
+	// covers these fields because applyStatus writes them together on every
+	// Status push and the menu painters read them.
+	statusMu          sync.Mutex
+	connected         bool
+	lastStatus        string
+	lastDaemonVersion string
+	// lastNetworksRevision is the daemon's routed-networks revision; a bump (or
+	// a connect/disconnect transition) gates the refreshExitNodes re-fetch so
+	// ListNetworks runs only when routes change. The peer-status route list
+	// can't substitute: it carries only actively-routed routes, not candidate
+	// exit nodes.
+	lastNetworksRevision uint64
+	// pendingConnectLogin is set when handleConnect fires an Up on an idle
+	// daemon. The daemon flips to NeedsLogin if the peer is SSO-tracked with
+	// no cached token; applyStatus consumes the flag on that transition to
+	// open the browser-login flow, saving a second Connect click.
+	// Profile-switch reconnects are handled separately by
+	// DaemonFeed.statusStreamLoop.
+	pendingConnectLogin bool
+
+	// sessionMu guards the cached SSO deadline used by the session row.
+	// Independent of statusMu so the 30s ticker reader and the Status-push
+	// writer don't block each other.
+	sessionMu        sync.Mutex
+	sessionExpiresAt time.Time
+
+	// profileMu guards the profile-domain state (active identity, the
+	// notifications gate, the in-flight switch cancel). Independent of
+	// statusMu so a long-running switch holding switchCancel doesn't block a
+	// Status-push reader of t.connected.
+	profileMu            sync.Mutex
+	activeProfile        string
+	activeUsername       string
+	notificationsEnabled bool
+	switchCancel         context.CancelFunc
+
+	// profileLoadMu serializes loadProfiles so the applyStatus refresh can't
+	// race the ApplicationStarted seed or the post-switch reload — all
+	// manipulate profileSubmenu + SetMenu, which Wails isn't concurrency-safe
+	// against.
+	profileLoadMu sync.Mutex
+
+	// profilesMu guards the cached profile rows that relayoutMenu repaints
+	// into a freshly built Profiles submenu, kept separate from the live
+	// submenu so a relayout always has a source to repaint from without
+	// re-hitting the daemon.
+	profilesMu   sync.Mutex
+	profiles     []services.Profile
+	profilesUser string
+
+	// menuMu serialises relayoutMenu (buildMenu + SetMenu) and guards the
+	// menu/item-pointer fields above. relayoutMenu is the only post-startup
+	// SetMenu call site — a menu snapshot pushed outside the lock could
+	// reinstall a stale tree.
+	menuMu sync.Mutex
+
+	// exitNodesMu guards the exitNodes row cache so relayoutMenu's read (and
+	// the Repaint copy) doesn't contend with status-push readers of statusMu.
+	exitNodesMu sync.Mutex
+	exitNodes   []exitNodeEntry
+	// exitNodesRebuildMu serialises the ListNetworks fetch + submenu rebuild +
+	// SetMenu cycle so back-to-back Status pushes can't run it concurrently
+	// with itself.
+	exitNodesRebuildMu sync.Mutex
+
+	// featureMu guards the daemon feature kill switches mirrored on the tray.
+	// Fetched at startup and refreshed on every config_changed event (the
+	// daemon re-applies MDM policy per engine spawn), so featuresDisabled can
+	// grey out menus without polling GetFeatures.
+	featureMu       sync.Mutex
+	disableProfiles bool
+	disableNetworks bool
+}
+
+func NewTray(app *application.App, window *application.WebviewWindow, svc TrayServices) *Tray {
+	t := &Tray{
+		app:                  app,
+		window:               window,
+		svc:                  svc,
+		notificationsEnabled: true,
+		// Localizer is constructed by main so the first menu render is already
+		// in the right locale — no English flash then re-paint.
+		loc: svc.Localizer,
+	}
+	t.updater = newTrayUpdater(app, window, svc.Update, svc.Notifier, t.loc, func() { t.applyIcon() }, func() { t.relayoutMenu() })
+	t.tray = app.SystemTray.New()
+	// Seed panel-theme detection before the first paint so the initial icon
+	// matches the panel's light/dark scheme (Linux only).
+	t.startTrayTheme()
+	t.applyIcon()
+	t.tray.SetTooltip(t.loc.T("tray.tooltip"))
+	// On Linux the SNI hover tooltip rides on the systray label, not
+	// SetTooltip (a no-op there); without a label Wails shows the literal
+	// "Wails". macOS/Windows are skipped (label paints visible text on
+	// macOS; Windows uses SetTooltip above).
+	if runtime.GOOS == "linux" {
+		t.tray.SetLabel(t.loc.T("tray.tooltip"))
+	}
+	t.menu = t.buildMenu()
+	t.tray.SetMenu(t.menu)
+	// macOS/Linux give click→menu natively, so bindTrayClick is a no-op there
+	// (binding OnClick→OpenMenu on macOS would freeze the tray); Windows has no
+	// native left-click handler so it wires one to open the main window, leaving
+	// the menu on right-click (see tray_click_*.go). On Linux AttachWindow is
+	// skipped — with applySmartDefaults it would pop the window alongside the
+	// menu (e.g. GNOME Shell AppIndicator).
+	bindTrayClick(t)
+
+	app.Event.On(services.EventStatusSnapshot, t.onStatusEvent)
+	app.Event.On(services.EventDaemonNotification, t.onSystemEvent)
+	// Refresh the Profiles submenu on ProfileSwitcher's change event. A
+	// switch on an idle daemon drives no status transition, so without this
+	// hook a React-initiated switch leaves the tray's submenu stale.
+	app.Event.On(services.EventProfileChanged, func(*application.CustomEvent) {
+		go t.loadProfiles()
+	})
+	// Defer the first profile load until the menu impl is live — Menu.Update()
+	// short-circuits while app.running is false, and AppKit's main queue isn't
+	// ready earlier (see d23ef34 InvokeSync nil-deref).
+	app.Event.OnApplicationEvent(events.Common.ApplicationStarted, func(*application.ApplicationEvent) {
+		go t.loadProfiles()
+		go t.refreshRestrictions()
+		go t.runSessionExpiryTicker()
+		// Category registration must run after the notifications service
+		// Startup populates appName/registry path on Windows; before app.Run()
+		// the category lookup silently falls back to a plain notification.
+		t.registerSessionWarningCategory()
+	})
+
+	t.loc.Watch(func(i18n.LanguageCode) { t.applyLanguage() })
+
+	go t.loadConfig()
+	return t
+}
+
+// ShowWindow brings the main window forward — used by SIGUSR1 / Windows event.
+// Show() alone is not enough on macOS (makeKeyAndOrderFront skips activation,
+// so the window pops up behind the active app); Focus() additionally calls
+// activateIgnoringOtherApps:YES on macOS and SetForegroundWindow on Windows.
+func (t *Tray) ShowWindow() {
+	// An install supersedes every other flow, so check it before BrowserLogin.
+	if w := t.svc.WindowManager.InstallProgressWindow(); w != nil {
+		w.Show()
+		w.Focus()
+		return
+	}
+	if w := t.svc.WindowManager.BrowserLoginWindow(); w != nil {
+		w.Show()
+		w.Focus()
+		return
+	}
+	if t.window == nil {
+		return
+	}
+	// Route through WindowManager so the main window is centered on first
+	// show — minimal WMs (fluxbox, the XEmbed tray path) otherwise drop it in
+	// the top-left corner.
+	if t.svc.WindowManager != nil {
+		t.svc.WindowManager.ShowMain()
+		return
+	}
+	t.window.Show()
+	t.window.Focus()
+}
+
+// applyLanguage re-renders every translated surface in the Localizer's current
+// language. Wails dispatches menu/tray APIs onto the UI thread internally, so
+// calling them from the Localizer's background goroutine is safe; profileLoadMu
+// prevents loadProfiles from racing the rebuild.
+func (t *Tray) applyLanguage() {
+	t.tray.SetTooltip(t.loc.T("tray.tooltip"))
+	// Mirror the Linux label fix from NewTray (the SNI tooltip rides on the
+	// label).
+	if runtime.GOOS == "linux" {
+		t.tray.SetLabel(t.loc.T("tray.tooltip"))
+	}
+	t.relayoutMenu()
+}
+
+// relayoutMenu rebuilds the entire tray menu, repaints the cached
+// status/session/profile/exit-node state into the fresh items, and pushes the
+// whole tree with a single SetMenu.
+//
+// A full rebuild is required because on KDE/Plasma the StatusNotifierItem host
+// caches a submenu's layout on first open (GetLayout for that submenu id) and
+// never re-fetches it on a LayoutUpdated(parent=0) signal — so Clear()+Add()
+// into the same container froze both the visible rows and the click→id mapping,
+// and stale ids no-op'd. buildMenu allocates a fresh submenu container id each
+// time, which Plasma treats as unseen and re-queries (confirmed via
+// dbus-monitor). This also covers the darwin detached-NSMenu workaround, since
+// it rebuilds the whole tree against the cached top-level pointer.
+//
+// Rows come from the profilesMu/exitNodes caches, so it never re-hits the
+// daemon or recurses back into loadProfiles.
+func (t *Tray) relayoutMenu() {
+	t.menuMu.Lock()
+	defer t.menuMu.Unlock()
+
+	t.menu = t.buildMenu()
+
+	t.statusMu.Lock()
+	connected := t.connected
+	lastStatus := t.lastStatus
+	daemonVersion := t.lastDaemonVersion
+	t.statusMu.Unlock()
+
+	t.sessionMu.Lock()
+	sessionDeadline := t.sessionExpiresAt
+	t.sessionMu.Unlock()
+
+	t.exitNodesMu.Lock()
+	exitNodeEntries := append([]exitNodeEntry(nil), t.exitNodes...)
+	t.exitNodesMu.Unlock()
+
+	disableProfiles, disableNetworks := t.featuresDisabled()
+
+	daemonUnavailable := strings.EqualFold(lastStatus, services.StatusDaemonUnavailable)
+	connecting := strings.EqualFold(lastStatus, services.StatusConnecting)
+
+	if t.statusItem != nil && lastStatus != "" {
+		t.statusItem.SetLabel(t.loc.StatusLabel(lastStatus))
+		t.statusItem.SetEnabled(statusRowEnabled())
+		t.applyStatusIndicator(lastStatus)
+	}
+	if t.sessionExpiresItem != nil {
+		if sessionDeadline.IsZero() {
+			t.sessionExpiresItem.SetHidden(true)
+		} else {
+			remaining := t.formatSessionRemaining(time.Until(sessionDeadline))
+			t.sessionExpiresItem.SetLabel(t.loc.T("tray.session.expiresIn", "remaining", remaining))
+			t.sessionExpiresItem.SetHidden(false)
+		}
+	}
+	if t.upItem != nil {
+		// Connect stays visible in the NeedsLogin states too — Up drives
+		// the SSO re-auth flow; hidden only when it would be a no-op.
+		t.upItem.SetHidden(connected || connecting || daemonUnavailable)
+		t.upItem.SetEnabled(!connected && !connecting && !daemonUnavailable)
+	}
+	if t.downItem != nil {
+		// Disconnect doubles as the Connecting abort path.
+		t.downItem.SetHidden(!connected && !connecting)
+		t.downItem.SetEnabled(connected || connecting)
+	}
+	if t.exitNodeItem != nil {
+		t.exitNodeItem.SetEnabled(connected && len(exitNodeEntries) > 0 && !disableNetworks)
+	}
+	if t.settingsItem != nil {
+		t.settingsItem.SetEnabled(!daemonUnavailable)
+	}
+	if t.profileSubmenuItem != nil {
+		t.profileSubmenuItem.SetEnabled(!daemonUnavailable && !disableProfiles)
+	}
+	if daemonVersion != "" && t.daemonVersionItem != nil {
+		t.daemonVersionItem.SetLabel(t.loc.T("tray.menu.daemonVersion", "version", daemonVersion))
+	}
+	if t.updater != nil {
+		t.updater.applyLanguage()
+	}
+	// buildMenu recreated empty submenus, so repaint both from their caches
+	// before SetMenu. Neither fill re-fetches. Do NOT re-take
+	// exitNodesRebuildMu here — refreshExitNodes already holds it when it
+	// calls relayoutMenu.
+	t.fillExitNodeSubmenu(exitNodeEntries)
+	t.fillProfileSubmenu()
+
+	// Single push of the whole tree: on Linux one LayoutUpdated with fresh
+	// container ids; on darwin an NSMenu rebuild against the cached pointer.
+	t.tray.SetMenu(t.menu)
+}
+
+func (t *Tray) buildMenu() *application.Menu {
+	menu := application.NewMenu()
+
+	// Enabled state is platform-dependent (see statusRowEnabled): Windows keeps
+	// it enabled because the disabled mask would desaturate the coloured status
+	// dot; macOS/Linux disable it so the greyed label signals it isn't
+	// clickable.
+	t.statusItem = menu.Add(t.loc.T("tray.status.disconnected")).
+		SetEnabled(statusRowEnabled()).
+		SetBitmap(iconMenuDotIdle)
+
+	menu.AddSeparator()
+
+	// The OnClick closures capture the local item because t.upItem/t.downItem
+	// are menuMu-guarded and must not be read from the click goroutine.
+	upItem := menu.Add(t.loc.T("tray.menu.connect"))
+	upItem.OnClick(func(*application.Context) { t.handleConnect(upItem) })
+	t.upItem = upItem
+	downItem := menu.Add(t.loc.T("tray.menu.disconnect"))
+	downItem.OnClick(func(*application.Context) { t.handleDisconnect(downItem) })
+	downItem.SetHidden(true)
+	t.downItem = downItem
+
+	menu.AddSeparator()
+
+	// Populated asynchronously once the app has started — Menu.Update() is a
+	// no-op before app.running is true, so the initial fill is gated on the
+	// ApplicationStarted hook.
+	profilesLabel := t.loc.T("tray.menu.profiles")
+	t.profileSubmenu = menu.AddSubmenu(profilesLabel)
+	// AddSubmenu returns the child *Menu, so retrieve the parent *MenuItem via
+	// FindByLabel.
+	t.profileSubmenuItem = menu.FindByLabel(profilesLabel)
+	t.profileEmailItem = menu.Add("").SetEnabled(false)
+	t.profileEmailItem.SetHidden(true)
+	// Click opens the SessionExpiration window so the user can extend ahead of
+	// the daemon's T-FinalWarningLead auto-prompt.
+	t.sessionExpiresItem = menu.Add("").OnClick(func(*application.Context) { t.openSessionExtendFlow() })
+	t.sessionExpiresItem.SetHidden(true)
+
+	menu.AddSeparator()
+	// Accelerators on the Settings/Quit entries below are a no-op on Windows in
+	// Wails v3 alpha.95 (impl commented out in menuitem_windows.go); still set
+	// for forward compatibility. macOS/GTK render and fire them.
+	menu.Add(t.loc.T("tray.menu.open")).OnClick(func(*application.Context) { t.ShowWindow() })
+
+	menu.AddSeparator()
+
+	// exitNodeSubmenu hosts one row per peer advertising a default route
+	// (0.0.0.0/0 or ::/0). FindByLabel grabs the parent so applyStatus can flip
+	// its enabled state independently of the children.
+	exitNodeLabel := t.loc.T("tray.menu.exitNode")
+	t.exitNodeSubmenu = menu.AddSubmenu(exitNodeLabel)
+	t.exitNodeItem = menu.FindByLabel(exitNodeLabel)
+	t.exitNodeItem.SetEnabled(false)
+
+	menu.AddSeparator()
+
+	// The label's trailing ellipsis follows the macOS HIG convention for items
+	// that open a window.
+	t.settingsItem = menu.Add(t.loc.T("tray.menu.settings")).
+		SetAccelerator("CmdOrCtrl+,").
+		OnClick(func(*application.Context) { t.svc.WindowManager.OpenSettings("") })
+
+	aboutLabel := menuLabel(t.loc.T("tray.menu.about"))
+	about := menu.AddSubmenu(aboutLabel)
+	about.Add(t.loc.T("tray.menu.github")).OnClick(func(*application.Context) {
+		_ = t.app.Browser.OpenURL(urlGitHubRepo)
+	})
+	about.Add(t.loc.T("tray.menu.documentation")).OnClick(func(*application.Context) {
+		_ = t.app.Browser.OpenURL(urlDocs)
+	})
+	about.Add(t.loc.T("tray.menu.troubleshoot")).OnClick(func(*application.Context) {
+		t.svc.WindowManager.OpenSettings("troubleshooting")
+	})
+	about.AddSeparator()
+	about.Add(t.loc.T("tray.menu.guiVersion", "version", version.NetbirdVersion())).SetEnabled(false)
+	t.daemonVersionItem = about.Add(t.loc.T("tray.menu.daemonVersion", "version", t.loc.T("tray.menu.versionUnknown"))).SetEnabled(false)
+	// trayUpdater rewrites the label between downloadLatest (opt-in) and
+	// installVersion (enforced) and drives the click.
+	updateItem := about.Add(t.loc.T("tray.menu.downloadLatest")).
+		OnClick(func(*application.Context) { t.updater.handleClick() })
+	updateItem.SetHidden(true)
+	t.updater.attach(updateItem)
+
+	menu.AddSeparator()
+	menu.Add(t.loc.T("tray.menu.quit")).
+		SetAccelerator("CmdOrCtrl+Q").
+		OnClick(func(*application.Context) { t.app.Quit() })
+
+	return menu
+}
+
+// handleConnect receives the clicked item from the buildMenu closure —
+// t.upItem is menuMu-guarded and must not be read here.
+func (t *Tray) handleConnect(upItem *application.MenuItem) {
+	// NeedsLogin/SessionExpired/LoginFailed won't honor a plain Up RPC — they
+	// need the Login → WaitSSOLogin → Up sequence. Emit EventTriggerLogin so
+	// the React startLogin() (which owns the BrowserLogin popup) drives it;
+	// the hidden main webview is alive and subscribed, so only the popup shows.
+	t.statusMu.Lock()
+	needsLogin := strings.EqualFold(t.lastStatus, services.StatusNeedsLogin) ||
+		strings.EqualFold(t.lastStatus, services.StatusSessionExpired) ||
+		strings.EqualFold(t.lastStatus, services.StatusLoginFailed)
+	t.statusMu.Unlock()
+	if needsLogin {
+		t.app.Event.Emit(services.EventTriggerLogin)
+		return
+	}
+	upItem.SetEnabled(false)
+	// Arm the SSO auto-handoff: Up() is async and the daemon may flip to
+	// NeedsLogin on an SSO peer with no cached token. applyStatus consumes the
+	// flag on that transition to trigger browser-login without a second Connect
+	// click, and clears it on any terminal state.
+	t.statusMu.Lock()
+	t.pendingConnectLogin = true
+	t.statusMu.Unlock()
+	go func() {
+		if err := t.svc.Connection.Up(context.Background(), services.UpParams{}); err != nil {
+			log.Errorf("connect: %v", err)
+			t.notifyError(t.loc.T("notify.error.connect"))
+			t.statusMu.Lock()
+			t.pendingConnectLogin = false
+			t.statusMu.Unlock()
+			upItem.SetEnabled(true)
+		}
+	}()
+}
+
+// handleDisconnect aborts any in-flight profile switch before sending Down —
+// otherwise the switcher's queued Up would reconnect right after, making the
+// click a no-op. Also clears Peers' optimistic-Connecting guard so the daemon's
+// Idle push paints through instead of being swallowed by the suppression filter.
+// Receives the clicked item from the buildMenu closure (see handleConnect).
+func (t *Tray) handleDisconnect(downItem *application.MenuItem) {
+	downItem.SetEnabled(false)
+	t.profileMu.Lock()
+	if t.switchCancel != nil {
+		t.switchCancel()
+		t.switchCancel = nil
+	}
+	t.profileMu.Unlock()
+	t.svc.DaemonFeed.CancelProfileSwitch()
+	go func() {
+		if err := t.svc.Connection.Down(context.Background()); err != nil {
+			log.Errorf("disconnect: %v", err)
+			t.notifyError(t.loc.T("notify.error.disconnect"))
+			downItem.SetEnabled(true)
+		}
+	}()
+}
+
+// notify wraps the Wails notification service with the tray's standard
+// id-prefix scheme and swallows errors (notifications are best-effort).
+func (t *Tray) notify(title, body, id string) {
+	if t.svc.Notifier == nil {
+		return
+	}
+	_ = safeSendNotification(t.svc.Notifier.SendNotification, title, notifications.NotificationOptions{
+		ID:    id,
+		Title: title,
+		Body:  body,
+	})
+}
+
+// notifyError fires a generic "Error" notification for tray-driven action
+// failures. Each tray click site already logs the underlying error; this
+// adds the user-visible toast.
+func (t *Tray) notifyError(message string) {
+	t.notify(t.loc.T("notify.error.title"), message, notifyIDTrayError)
+}
diff --git a/client/ui/tray_click_linux.go b/client/ui/tray_click_linux.go
new file mode 100644
index 000000000..34a364fd9
--- /dev/null
+++ b/client/ui/tray_click_linux.go
@@ -0,0 +1,31 @@
+//go:build linux && !(linux && 386)
+
+package main
+
+// bindTrayClick wires the tray icon's left-click handler on Linux.
+//
+// Both Linux click paths converge on Wails' linuxSystemTray.Activate, which
+// fires the registered clickHandler:
+//   - Real SNI hosts (KDE Plasma, Waybar, GNOME Shell + AppIndicator) invoke
+//     org.kde.StatusNotifierItem.Activate over D-Bus on left-click.
+//   - The in-process StatusNotifierWatcher + XEmbed host used on minimal WMs
+//     (Fluxbox, i3, dwm, OpenBox) maps a Button1 press to that same Activate
+//     call itself (xembed_host_linux.go), so it routes through the same hook.
+// Registering OnClick here therefore covers both paths with one handler — no
+// changes to the watcher or XEmbed C code are needed. Left-click now opens the
+// main window; right-click still opens the menu via Wails' default
+// SecondaryActivate→OpenMenu handler (and the XEmbed GTK popup on minimal WMs).
+//
+// We do NOT register OnDoubleClick: Wails' Linux SNI backend never fires it
+// (unlike Windows). And we deliberately skip AttachWindow — it plus Wails3's
+// applySmartDefaults would pop the window alongside the menu on GNOME Shell
+// with the AppIndicator extension (see the bindTrayClick comment in tray.go).
+//
+// ShowWindow() is the same dispatcher the explicit "Open NetBird" menu entry
+// and SIGUSR1 use: it brings the install-progress / browser-login window
+// forward when one of those flows is active, otherwise routes through
+// WindowManager.ShowMain so the window re-centers on minimal WMs / the XEmbed
+// path instead of landing in the top-left corner.
+func bindTrayClick(t *Tray) {
+	t.tray.OnClick(func() { t.ShowWindow() })
+}
diff --git a/client/ui/tray_click_other.go b/client/ui/tray_click_other.go
new file mode 100644
index 000000000..e6a29e419
--- /dev/null
+++ b/client/ui/tray_click_other.go
@@ -0,0 +1,13 @@
+//go:build !windows && !android && !ios && !freebsd && !js && (!linux || (linux && 386))
+
+package main
+
+func bindTrayClick(*Tray) {
+	// No-op: macOS's native NSStatusItem opens the menu on click itself, and
+	// binding OnClick→anything blocking there froze the tray historically
+	// (see tray_click_windows.go). Windows wires an explicit handler
+	// (tray_click_windows.go); Linux opens the window on left-click
+	// (tray_click_linux.go). The (linux && 386) arm keeps a no-op fallback for
+	// the i386 Linux build, which excludes the cgo XEmbed/SNI files that
+	// tray_click_linux.go's build tag matches.
+}
diff --git a/client/ui/tray_click_windows.go b/client/ui/tray_click_windows.go
new file mode 100644
index 000000000..17a6dc5df
--- /dev/null
+++ b/client/ui/tray_click_windows.go
@@ -0,0 +1,8 @@
+//go:build windows
+
+package main
+
+// Open application window on left click, right click opens the tray menu
+func bindTrayClick(t *Tray) {
+	t.tray.OnClick(func() { t.ShowWindow() })
+}
diff --git a/client/ui/tray_events.go b/client/ui/tray_events.go
new file mode 100644
index 000000000..12da68a5c
--- /dev/null
+++ b/client/ui/tray_events.go
@@ -0,0 +1,137 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"fmt"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/wailsapp/wails/v3/pkg/application"
+
+	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/client/ui/authsession"
+	"github.com/netbirdio/netbird/client/ui/services"
+)
+
+// onSystemEvent fires an OS notification for daemon SystemEvents that carry a
+// user-facing message. Gated by the "Notifications" toggle; critical events bypass it.
+func (t *Tray) onSystemEvent(ev *application.CustomEvent) {
+	se, ok := ev.Data.(services.SystemEvent)
+	if !ok {
+		return
+	}
+	// config_changed carries no UserMessage, so handle it before the message gate below.
+	if se.Category == "system" && se.Metadata[proto.MetadataTypeKey] == proto.MetadataTypeConfigChanged {
+		log.Infof("config_changed event received (source=%s); refreshing tray restrictions", se.Metadata[proto.MetadataSourceKey])
+		go t.refreshRestrictions()
+		go t.loadConfig()
+		// MDM gets a localised toast here; the daemon's English "policy_applied"
+		// event is suppressed in shouldSkipSystemEvent. Other sources stay silent.
+		if se.Metadata[proto.MetadataSourceKey] == proto.MetadataSourceMDM {
+			t.profileMu.Lock()
+			enabled := t.notificationsEnabled
+			t.profileMu.Unlock()
+			if enabled {
+				t.notify(
+					t.loc.T("notify.mdm.policyApplied.title"),
+					t.loc.T("notify.mdm.policyApplied.body"),
+					notifyIDMDMPolicy,
+				)
+			}
+		}
+		return
+	}
+	// Session-warning and deadline-rejected events build their body locally from
+	// metadata; every other event needs a UserMessage.
+	isSessionWarning := se.Metadata[authsession.MetaWarning] == "true"
+	isDeadlineRejected := se.Metadata[authsession.MetaDeadlineRejected] != ""
+	if !isSessionWarning && !isDeadlineRejected && se.UserMessage == "" {
+		return
+	}
+	if shouldSkipSystemEvent(se) {
+		return
+	}
+
+	critical := strings.EqualFold(se.Severity, services.SeverityCritical)
+	t.profileMu.Lock()
+	enabled := t.notificationsEnabled
+	t.profileMu.Unlock()
+	if !enabled && !critical {
+		return
+	}
+
+	// Session-warning events route via stable metadata flags rather than
+	// category/severity so a daemon-side reword still lands here. Final warning
+	// auto-opens the SessionExpiration dialog with no notification (the dialog is
+	// the last-chance reminder; doubling up would be noise).
+	if isDeadlineRejected {
+		t.notify(
+			t.loc.T("notify.sessionDeadlineRejected.title"),
+			t.loc.T("notify.sessionDeadlineRejected.body"),
+			notifyIDSessionExpired,
+		)
+		return
+	}
+
+	if se.Metadata != nil && se.Metadata[authsession.MetaWarning] == "true" {
+		if se.Metadata[authsession.MetaFinal] == "true" {
+			t.openSessionExpiration()
+			return
+		}
+		t.notifySessionWarning(
+			t.loc.T("notify.sessionWarning.title"),
+			t.buildSessionWarningBody(se.Metadata),
+		)
+		return
+	}
+
+	body := se.UserMessage
+	if id := se.Metadata["id"]; id != "" {
+		body += fmt.Sprintf(" ID: %s", id)
+	}
+	t.notify(eventTitle(se), body, notifyIDEvent+se.ID)
+}
+
+// eventTitle composes a notification title, e.g. "Critical: DNS", "Warning: Authentication".
+func eventTitle(e services.SystemEvent) string {
+	prefix := titleCase(e.Severity)
+	if prefix == "" {
+		prefix = "Info"
+	}
+	category := titleCase(e.Category)
+	if category == "" {
+		category = "System"
+	}
+	return prefix + ": " + category
+}
+
+func titleCase(s string) string {
+	if s == "" {
+		return ""
+	}
+	return strings.ToUpper(s[:1]) + strings.ToLower(s[1:])
+}
+
+// shouldSkipSystemEvent reports whether a daemon SystemEvent must not surface as
+// a tray notification:
+//   - update-available announcements (trayUpdater emits its own)
+//   - install-progress signals (consumed by the install-progress window)
+//   - the ::/0 partner of an exit-node default route (0.0.0.0/0 already toasted)
+func shouldSkipSystemEvent(se services.SystemEvent) bool {
+	// "policy_applied" carries a hardcoded English message; the localised toast
+	// fires on the paired config_changed (source=mdm) event instead.
+	if se.Metadata[proto.MetadataTypeKey] == proto.MetadataTypePolicyApplied {
+		return true
+	}
+	if _, isUpdate := se.Metadata["new_version_available"]; isUpdate {
+		return true
+	}
+	if _, isProgress := se.Metadata["progress_window"]; isProgress {
+		return true
+	}
+	if se.Category == "network" && se.Metadata["network"] == "::/0" {
+		return true
+	}
+	return false
+}
diff --git a/client/ui/tray_exitnodes.go b/client/ui/tray_exitnodes.go
new file mode 100644
index 000000000..3e6f30842
--- /dev/null
+++ b/client/ui/tray_exitnodes.go
@@ -0,0 +1,148 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"context"
+	"net/netip"
+	"sort"
+	"strings"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/wailsapp/wails/v3/pkg/application"
+
+	"github.com/netbirdio/netbird/client/ui/services"
+)
+
+// exitNodeEntry is one Exit Node submenu row; ID is the network's NetID, the Select/Deselect argument.
+type exitNodeEntry struct {
+	ID       string
+	Selected bool
+}
+
+// fillExitNodeSubmenu uses a "✓ " prefix with plain Add, not AddCheckbox: Wails
+// auto-toggles a checkbox on click before OnClick runs, so the deselect/select
+// round-trip would briefly show two checked rows. Callers must hold exitNodesRebuildMu.
+func (t *Tray) fillExitNodeSubmenu(nodes []exitNodeEntry) {
+	if t.exitNodeSubmenu == nil {
+		return
+	}
+	t.exitNodeSubmenu.Clear()
+	for _, n := range nodes {
+		id := n.ID
+		selected := n.Selected
+		label := id
+		if selected {
+			label = "✓ " + id
+		}
+		t.exitNodeSubmenu.Add(label).OnClick(func(*application.Context) {
+			t.toggleExitNode(id, selected)
+		})
+	}
+}
+
+// refreshExitNodes sources rows from Networks.List() rather than the Status stream
+// because only ListNetworks carries the NetID + selected state Select/Deselect need.
+// Serialized by exitNodesRebuildMu against overlapping Status pushes.
+func (t *Tray) refreshExitNodes() {
+	t.exitNodesRebuildMu.Lock()
+	defer t.exitNodesRebuildMu.Unlock()
+
+	t.statusMu.Lock()
+	connected := t.connected
+	t.statusMu.Unlock()
+
+	var nodes []exitNodeEntry
+	if connected {
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		list, err := t.svc.Networks.List(ctx)
+		cancel()
+		if err != nil {
+			log.Debugf("tray list networks: %v", err)
+			return
+		}
+		nodes = exitNodesFromNetworks(list)
+	}
+
+	log.Infof("tray refreshExitNodes: %d exit node(s)", len(nodes))
+	for _, n := range nodes {
+		log.Infof("tray exit node: id=%q selected=%v", n.ID, n.Selected)
+	}
+
+	t.exitNodesMu.Lock()
+	changed := !equalExitNodes(nodes, t.exitNodes)
+	t.exitNodes = nodes
+	t.exitNodesMu.Unlock()
+
+	// relayoutMenu repaints from the cached entries, so the old exitNodeItem needs no poking here.
+	if changed {
+		t.relayoutMenu()
+	}
+}
+
+// toggleExitNode uses append=true: append=false would drop the whole current
+// selection (default-on semantics), turning off every other routed network the
+// user had enabled. Mutual exclusion of exit nodes is enforced daemon-side.
+func (t *Tray) toggleExitNode(id string, selected bool) {
+	go func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer cancel()
+
+		params := services.SelectNetworksParams{NetworkIDs: []string{id}, Append: true, All: false}
+		var err error
+		if selected {
+			err = t.svc.Networks.Deselect(ctx, params)
+		} else {
+			err = t.svc.Networks.Select(ctx, params)
+		}
+		if err != nil {
+			log.Errorf("tray toggle exit node %q: %v", id, err)
+			t.notifyError(t.loc.T("notify.error.exitNode", "name", id))
+			return
+		}
+		t.refreshExitNodes()
+	}()
+}
+
+// exitNodesFromNetworks keeps only networks whose range is a default route: those are the exit-node candidates.
+func exitNodesFromNetworks(networks []services.Network) []exitNodeEntry {
+	out := []exitNodeEntry{}
+	for _, n := range networks {
+		if !rangeIsDefaultRoute(n.Range) {
+			continue
+		}
+		out = append(out, exitNodeEntry{ID: n.ID, Selected: n.Selected})
+	}
+	sort.Slice(out, func(i, j int) bool {
+		return strings.ToLower(out[i].ID) < strings.ToLower(out[j].ID)
+	})
+	return out
+}
+
+// rangeIsDefaultRoute reports whether r contains a default route. The daemon may
+// comma-join a v4+v6 pair ("0.0.0.0/0, ::/0"), so each part is parsed rather than string-compared.
+func rangeIsDefaultRoute(r string) bool {
+	for _, part := range strings.Split(r, ",") {
+		pref, err := netip.ParsePrefix(strings.TrimSpace(part))
+		if err != nil {
+			continue
+		}
+		if pref.Bits() == 0 && pref.Addr().IsUnspecified() {
+			return true
+		}
+	}
+	return false
+}
+
+func equalExitNodes(a, b []exitNodeEntry) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := range a {
+		if a[i] != b[i] {
+			return false
+		}
+	}
+	return true
+}
diff --git a/client/ui/tray_features.go b/client/ui/tray_features.go
new file mode 100644
index 000000000..2ff99e2be
--- /dev/null
+++ b/client/ui/tray_features.go
@@ -0,0 +1,37 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"context"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// refreshRestrictions re-reads the operator-disabled UI flags and re-gates the
+// menu. Must run on every config_changed event: the daemon re-applies its MDM
+// policy on each engine spawn.
+func (t *Tray) refreshRestrictions() {
+	r, err := t.svc.Settings.GetRestrictions(context.Background())
+	if err != nil {
+		log.Debugf("get restrictions: %v", err)
+		return
+	}
+	t.featureMu.Lock()
+	changed := t.disableProfiles != r.Features.DisableProfiles ||
+		t.disableNetworks != r.Features.DisableNetworks
+	t.disableProfiles = r.Features.DisableProfiles
+	t.disableNetworks = r.Features.DisableNetworks
+	t.featureMu.Unlock()
+	// relayoutMenu rebuilds the whole tree, so skip the no-op refresh (common case).
+	if changed {
+		t.relayoutMenu()
+	}
+}
+
+// featuresDisabled returns the cached flags under featureMu.
+func (t *Tray) featuresDisabled() (profiles, networks bool) {
+	t.featureMu.Lock()
+	defer t.featureMu.Unlock()
+	return t.disableProfiles, t.disableNetworks
+}
diff --git a/client/ui/tray_icon.go b/client/ui/tray_icon.go
new file mode 100644
index 000000000..6c7b85d79
--- /dev/null
+++ b/client/ui/tray_icon.go
@@ -0,0 +1,136 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"runtime"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/ui/services"
+)
+
+func (t *Tray) applyIcon() {
+	t.statusMu.Lock()
+	connected := t.connected
+	statusLabel := t.lastStatus
+	t.statusMu.Unlock()
+	hasUpdate := false
+	if t.updater != nil {
+		hasUpdate = t.updater.hasUpdate()
+	}
+
+	log.Infof("tray applyIcon: connected=%v hasUpdate=%v status=%q goos=%s",
+		connected, hasUpdate, statusLabel, runtime.GOOS)
+
+	icon, dark := t.iconForState()
+	if runtime.GOOS == "darwin" {
+		t.tray.SetTemplateIcon(icon)
+		return
+	}
+	if runtime.GOOS == "linux" {
+		// Wails' Linux SNI backend ignores SetDarkModeIcon (last write wins
+		// over SetIcon), so iconForState already picked the silhouette by
+		// panel theme; push that single icon.
+		t.tray.SetIcon(icon)
+		return
+	}
+	t.tray.SetIcon(icon)
+	if dark != nil {
+		t.tray.SetDarkModeIcon(dark)
+	}
+}
+
+// panelIsDark defaults to true when no detector is wired (panelDark nil —
+// non-Linux or portal unavailable), matching the common dark Linux panel.
+func (t *Tray) panelIsDark() bool {
+	if t.panelDark == nil {
+		return true
+	}
+	return t.panelDark()
+}
+
+func (t *Tray) iconForState() (icon, dark []byte) {
+	t.statusMu.Lock()
+	connected := t.connected
+	statusLabel := t.lastStatus
+	t.statusMu.Unlock()
+	hasUpdate := false
+	if t.updater != nil {
+		hasUpdate = t.updater.hasUpdate()
+	}
+
+	connecting := strings.EqualFold(statusLabel, services.StatusConnecting)
+	errored := strings.EqualFold(statusLabel, statusError) ||
+		strings.EqualFold(statusLabel, services.StatusDaemonUnavailable)
+	needsLogin := strings.EqualFold(statusLabel, services.StatusNeedsLogin) ||
+		strings.EqualFold(statusLabel, services.StatusSessionExpired) ||
+		strings.EqualFold(statusLabel, services.StatusLoginFailed)
+
+	if runtime.GOOS == "darwin" {
+		switch {
+		case connecting:
+			return iconConnectingMacOS, nil
+		case errored:
+			return iconErrorMacOS, nil
+		case needsLogin:
+			return iconNeedsLoginMacOS, nil
+		case connected && hasUpdate:
+			return iconUpdateConnectedMacOS, nil
+		case connected:
+			return iconConnectedMacOS, nil
+		case hasUpdate:
+			return iconUpdateDisconnectedMacOS, nil
+		default:
+			return iconDisconnectedMacOS, nil
+		}
+	}
+
+	if runtime.GOOS == "linux" {
+		// Theme resolved here (black for light panel, white for dark) since
+		// the SNI backend can't switch per theme (see applyIcon); second
+		// return is unused on Linux.
+		dark := t.panelIsDark()
+		pick := func(black, white []byte) ([]byte, []byte) {
+			if dark {
+				return white, nil
+			}
+			return black, nil
+		}
+		switch {
+		case connecting:
+			return pick(iconConnectingMono, iconConnectingMonoDark)
+		case errored:
+			return pick(iconErrorMono, iconErrorMonoDark)
+		case needsLogin:
+			return pick(iconNeedsLoginMono, iconNeedsLoginMonoDark)
+		case connected && hasUpdate:
+			return pick(iconUpdateConnectedMono, iconUpdateConnectedMonoDark)
+		case connected:
+			return pick(iconConnectedMono, iconConnectedMonoDark)
+		case hasUpdate:
+			return pick(iconUpdateDisconnectedMono, iconUpdateDisconnectedMonoDark)
+		default:
+			return pick(iconDisconnectedMono, iconDisconnectedMonoDark)
+		}
+	}
+
+	// Windows: colored PNGs.
+	switch {
+	case connecting:
+		return iconConnecting, iconConnectingDark
+	case errored:
+		return iconError, iconErrorDark
+	case needsLogin:
+		return iconNeedsLogin, iconNeedsLogin
+	case connected && hasUpdate:
+		return iconUpdateConnected, iconUpdateConnectedDark
+	case connected:
+		return iconConnected, iconConnectedDark
+	case hasUpdate:
+		return iconUpdateDisconnected, iconUpdateDisconnectedDark
+	default:
+		return iconDisconnected, iconDisconnected
+	}
+}
diff --git a/client/ui/tray_label_other.go b/client/ui/tray_label_other.go
new file mode 100644
index 000000000..e104bc8e8
--- /dev/null
+++ b/client/ui/tray_label_other.go
@@ -0,0 +1,7 @@
+//go:build !windows && !android && !ios && !freebsd && !js
+
+package main
+
+// menuLabel is the identity on macOS/Linux, which render "&" literally;
+// Windows escapes it separately (tray_label_windows.go) to dodge the Win32 mnemonic.
+func menuLabel(s string) string { return s }
diff --git a/client/ui/tray_label_windows.go b/client/ui/tray_label_windows.go
new file mode 100644
index 000000000..8c27ae9ea
--- /dev/null
+++ b/client/ui/tray_label_windows.go
@@ -0,0 +1,11 @@
+//go:build windows
+
+package main
+
+import "strings"
+
+// menuLabel doubles ampersands so Win32 draws a literal "&" instead of
+// consuming it as the menu mnemonic prefix (Wails passes the label unescaped).
+func menuLabel(s string) string {
+	return strings.ReplaceAll(s, "&", "&&")
+}
diff --git a/client/ui/tray_linux.go b/client/ui/tray_linux.go
new file mode 100644
index 000000000..1d6e0a48b
--- /dev/null
+++ b/client/ui/tray_linux.go
@@ -0,0 +1,71 @@
+//go:build linux && !386
+
+package main
+
+import (
+	"os"
+	"strings"
+)
+
+// init runs before Wails' own init(), so the env vars are set in time.
+func init() {
+	disableDMABUFRenderer()
+	disableCompositingMode()
+	disableWebKitSandboxIfNeeded()
+}
+
+func disableDMABUFRenderer() {
+	if os.Getenv("WEBKIT_DISABLE_DMABUF_RENDERER") != "" {
+		return
+	}
+
+	// WebKitGTK's DMA-BUF renderer leaves a blank-white window on many setups
+	// (VMs, containers, minimal WMs). Wails only disables it for NVIDIA+Wayland,
+	// but the issue is broader; software rendering is fine for a small UI.
+	_ = os.Setenv("WEBKIT_DISABLE_DMABUF_RENDERER", "1")
+}
+
+func disableCompositingMode() {
+	if os.Getenv("WEBKIT_DISABLE_COMPOSITING_MODE") != "" {
+		return
+	}
+	// Disabling the DMA-BUF renderer alone isn't enough on some Intel setups: the
+	// GL compositor still hits Mesa's unimplemented DRM-format-modifier paths and
+	// SIGSEGVs inside g_application_run before the first frame.
+	_ = os.Setenv("WEBKIT_DISABLE_COMPOSITING_MODE", "1")
+}
+
+// disableWebKitSandboxIfNeeded works around WebKitGTK crashing at startup when
+// its bwrap sandbox can't create an unprivileged user namespace (containers/VMs,
+// or Ubuntu 24.04+ AppArmor restrictions).
+func disableWebKitSandboxIfNeeded() {
+	if _, set := os.LookupEnv("WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS"); set {
+		return
+	}
+	if unprivilegedUsernsAllowed() {
+		return
+	}
+	_ = os.Setenv("WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS", "1")
+}
+
+// unprivilegedUsernsAllowed reports whether the kernel permits unprivileged
+// user namespaces (needed by WebKit's bwrap sandbox). Absent knobs are treated
+// as allowed, to avoid needlessly weakening the sandbox.
+func unprivilegedUsernsAllowed() bool {
+	// Debian/Ubuntu legacy switch: 0 disables unprivileged user namespaces.
+	if v, err := os.ReadFile("/proc/sys/kernel/unprivileged_userns_clone"); err == nil {
+		if strings.TrimSpace(string(v)) == "0" {
+			return false
+		}
+	}
+	// Ubuntu 24.04+ AppArmor restriction: non-zero restricts/blocks them.
+	if v, err := os.ReadFile("/proc/sys/kernel/apparmor_restrict_unprivileged_userns"); err == nil {
+		if strings.TrimSpace(string(v)) != "0" {
+			return false
+		}
+	}
+	return true
+}
+
+// Linux's tray provider needs the menu recreated rather than updated in place;
+// tray.go's rebuildExitNodeMenu already does this, so no extra workaround here.
diff --git a/client/ui/tray_notify.go b/client/ui/tray_notify.go
new file mode 100644
index 000000000..6c60e3d4b
--- /dev/null
+++ b/client/ui/tray_notify.go
@@ -0,0 +1,58 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"context"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/wailsapp/wails/v3/pkg/services/notifications"
+
+	"github.com/netbirdio/netbird/client/ui/services"
+)
+
+const notifyIDDaemonOutdated = "netbird-daemon-outdated"
+
+// sendFn fits both NotificationService.SendNotification and SendNotificationWithActions.
+type sendFn func(notifications.NotificationOptions) error
+
+// safeSendNotification sends a best-effort OS notification, swallowing errors and panics.
+//
+// The panic guard is load-bearing on Linux: when Wails' notifier fails to
+// connect the session bus at startup (headless, unreachable
+// DBUS_SESSION_BUS_ADDRESS) it stays registered with a nil *dbus.Conn, so the
+// next send nil-derefs inside godbus. Because sends run on a Wails
+// event-dispatch goroutine that panic is fatal process-wide; recover() turns
+// it into a logged no-op.
+func safeSendNotification(send sendFn, what string, opts notifications.NotificationOptions) (err error) {
+	defer func() {
+		if r := recover(); r != nil {
+			log.Errorf("notify %s: recovered from panic (notification bus unavailable): %v", what, r)
+			err = nil
+		}
+	}()
+	if err := send(opts); err != nil {
+		log.Errorf("notify %s: %v", what, err)
+		return err
+	}
+	return nil
+}
+
+// notifyIfDaemonOutdated probes the daemon once and fires an OS toast when it
+// is reachable but too old for this UI. A probe error means the daemon isn't
+// reachable (not outdated), so it is left to the normal connection flow.
+func notifyIfDaemonOutdated(compat *services.Compat, notifier *notifications.NotificationService, loc *Localizer) {
+	ready, err := compat.DaemonReady(context.Background())
+	if err != nil {
+		log.Debugf("daemon compatibility probe: %v", err)
+		return
+	}
+	if ready {
+		return
+	}
+	_ = safeSendNotification(notifier.SendNotification, "daemon-outdated", notifications.NotificationOptions{
+		ID:    notifyIDDaemonOutdated,
+		Title: loc.T("notify.daemonOutdated.title"),
+		Body:  loc.T("notify.daemonOutdated.body"),
+	})
+}
diff --git a/client/ui/tray_profiles.go b/client/ui/tray_profiles.go
new file mode 100644
index 000000000..5251c138e
--- /dev/null
+++ b/client/ui/tray_profiles.go
@@ -0,0 +1,194 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"context"
+	"fmt"
+	"sort"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/wailsapp/wails/v3/pkg/application"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/ui/services"
+)
+
+// formatProfileLabel returns the display label for a profile. Profiles can
+// share the same Name, so when more than one profile in profiles carries this
+// Name, a short form of the ID is appended to disambiguate the entries.
+func formatProfileLabel(profile services.Profile, profiles []services.Profile) string {
+	count := 0
+	for _, p := range profiles {
+		if p.Name == profile.Name {
+			count++
+		}
+	}
+	if count <= 1 {
+		return profile.Name
+	}
+	return fmt.Sprintf("%s (%s)", profile.Name, profilemanager.ID(profile.ID).ShortID())
+}
+
+// loadConfig caches the active-profile identity and the notifications gate.
+// Runs in a startup goroutine so a slow daemon does not block menu construction.
+func (t *Tray) loadConfig() {
+	ctx := context.Background()
+
+	active, err := t.svc.Profiles.GetActive(ctx)
+	if err != nil {
+		log.Debugf("get active profile: %v", err)
+		return
+	}
+	// Address the active profile by ID (the daemon resolves it as a handle),
+	// since display names can collide. ConfigParams no longer matches
+	// ActiveProfile's shape for a struct conversion now that it carries an ID.
+	cfg, err := t.svc.Settings.GetConfig(ctx, services.ConfigParams{
+		ProfileName: active.ID,
+		Username:    active.Username,
+	})
+	if err != nil {
+		log.Debugf("get config: %v", err)
+		return
+	}
+
+	t.profileMu.Lock()
+	t.activeProfile = active.ProfileName
+	t.activeUsername = active.Username
+	t.notificationsEnabled = !cfg.DisableNotifications
+	t.profileMu.Unlock()
+}
+
+// loadProfiles fetches the profile list and relayouts the menu. Also called
+// from applyStatus to catch flips from another channel (CLI, autoconnect),
+// since the daemon emits no active-profile event. Full relayout (not
+// Clear()+Add()) is required for KDE/Plasma — see relayoutMenu's doc comment.
+func (t *Tray) loadProfiles() {
+	t.profileLoadMu.Lock()
+	defer t.profileLoadMu.Unlock()
+	ctx := context.Background()
+
+	username, err := t.svc.Profiles.Username()
+	if err != nil {
+		log.Debugf("get current user: %v", err)
+		return
+	}
+	profiles, err := t.svc.Profiles.List(ctx, username)
+	if err != nil {
+		log.Debugf("list profiles: %v", err)
+		return
+	}
+
+	t.profilesMu.Lock()
+	t.profiles = profiles
+	t.profilesUser = username
+	t.profilesMu.Unlock()
+
+	t.relayoutMenu()
+}
+
+// fillProfileSubmenu paints cached profile rows into the freshly built submenu.
+// Pure UI: never fetches, never calls SetMenu (relayoutMenu owns the SetMenu).
+func (t *Tray) fillProfileSubmenu() {
+	if t.profileSubmenu == nil {
+		return
+	}
+	t.profilesMu.Lock()
+	profiles := append([]services.Profile(nil), t.profiles...)
+	username := t.profilesUser
+	t.profilesMu.Unlock()
+
+	sort.Slice(profiles, func(i, j int) bool {
+		if profiles[i].Name != profiles[j].Name {
+			return profiles[i].Name < profiles[j].Name
+		}
+		return profiles[i].ID < profiles[j].ID
+	})
+
+	// Wails' systray does not reliably propagate a disabled parent to its
+	// children on every platform, so disable each row explicitly.
+	disableProfiles, _ := t.featuresDisabled()
+
+	t.profileSubmenu.Clear()
+	var activeName, activeEmail string
+	for _, p := range profiles {
+		id := p.ID
+		// Display names can collide, so disambiguate with a short ID suffix.
+		display := formatProfileLabel(p, profiles)
+		active := p.IsActive
+		// Add, not AddCheckbox: Wails auto-toggles a checkbox on click before
+		// OnClick fires, so both old and new would briefly show checked during
+		// the switch. A plain item with a "✓ " prefix avoids the race.
+		label := display
+		if active {
+			label = "✓ " + display
+		}
+		item := t.profileSubmenu.Add(label)
+		item.OnClick(func(*application.Context) {
+			log.Infof("tray profile click: profile=%q id=%q wasActive=%v", display, id, active)
+			if active {
+				return
+			}
+			t.switchProfile(id, display)
+		})
+		item.SetEnabled(!disableProfiles)
+		if active {
+			activeName = display
+			activeEmail = p.Email
+		}
+	}
+	t.profileSubmenu.AddSeparator()
+	manageProfiles := t.profileSubmenu.Add(t.loc.T("tray.menu.manageProfiles"))
+	manageProfiles.OnClick(func(*application.Context) {
+		t.svc.WindowManager.OpenSettings("profiles")
+	})
+	manageProfiles.SetEnabled(!disableProfiles)
+	log.Infof("tray fillProfileSubmenu: %d profile(s) for user %q, active=%q", len(profiles), username, activeName)
+	if t.profileSubmenuItem != nil && activeName != "" {
+		t.profileSubmenuItem.SetLabel(activeName)
+	}
+	if t.profileEmailItem != nil {
+		if activeEmail != "" {
+			t.profileEmailItem.SetLabel(fmt.Sprintf("(%s)", activeEmail))
+			t.profileEmailItem.SetHidden(false)
+		} else {
+			t.profileEmailItem.SetHidden(true)
+		}
+	}
+}
+
+// switchProfile cancels any in-flight switch before starting a new one, so
+// rapid clicks converge to the last selected profile. Optimistic paint and
+// event suppression live in ProfileSwitcher, shared with the React Status page.
+// switchProfile sends handle (the profile's ID) to the daemon, which resolves
+// it precisely even when display names collide. display is used only for the
+// failure notification.
+func (t *Tray) switchProfile(handle, display string) {
+	t.profileMu.Lock()
+	if t.switchCancel != nil {
+		t.switchCancel()
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	t.switchCancel = cancel
+	t.profileMu.Unlock()
+
+	go func() {
+		username, err := t.svc.Profiles.Username()
+		if err != nil {
+			log.Errorf("tray switchProfile: get current user: %v", err)
+			return
+		}
+		if err := t.svc.ProfileSwitcher.SwitchActive(ctx, services.ProfileRef{
+			ProfileName: handle,
+			Username:    username,
+		}); err != nil {
+			if ctx.Err() != nil {
+				return
+			}
+			log.Errorf("tray switchProfile: %v", err)
+			t.notifyError(t.loc.T("notify.error.switchProfile", "profile", display))
+			return
+		}
+		t.loadProfiles()
+	}()
+}
diff --git a/client/ui/tray_session.go b/client/ui/tray_session.go
new file mode 100644
index 000000000..6b73ddb49
--- /dev/null
+++ b/client/ui/tray_session.go
@@ -0,0 +1,271 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"context"
+	"strconv"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/wailsapp/wails/v3/pkg/services/notifications"
+
+	nbstatus "github.com/netbirdio/netbird/client/status"
+	"github.com/netbirdio/netbird/client/ui/authsession"
+	"github.com/netbirdio/netbird/client/ui/services"
+)
+
+const (
+	notifyIDSessionExpired = "netbird-session-expired"
+	notifyIDSessionWarning = "netbird-session-warning"
+
+	notifyCategorySessionWarning = "netbird-session-warning"
+	notifyActionExtendNow        = "extend-now"
+	notifyActionDismiss          = "dismiss"
+
+	// finalWarningCountdownSeconds must stay in sync by hand with sessionwatch.FinalWarningLead.
+	finalWarningCountdownSeconds = 120
+)
+
+// handleSessionExpired notifies and brings the window forward so the frontend's /login route drives renewal.
+func (t *Tray) handleSessionExpired() {
+	t.notify(t.loc.T("notify.sessionExpired.title"), t.loc.T("notify.sessionExpired.body"), notifyIDSessionExpired)
+	if t.window != nil {
+		t.window.SetURL("/#/login")
+		t.window.Show()
+		t.window.Focus()
+	}
+}
+
+// applySessionExpiry refreshes the cached SSO deadline and reports whether it changed.
+// Cache-only; the caller relayouts when this returns true.
+func (t *Tray) applySessionExpiry(deadline *time.Time, connected bool) bool {
+	var d time.Time
+	if connected && deadline != nil {
+		d = *deadline
+	}
+
+	t.sessionMu.Lock()
+	changed := !t.sessionExpiresAt.Equal(d)
+	t.sessionExpiresAt = d
+	t.sessionMu.Unlock()
+
+	if changed {
+		switch {
+		case deadline == nil:
+			log.Infof("tray applySessionExpiry: deadline=<nil> connected=%v → row hidden", connected)
+		case deadline.IsZero():
+			log.Infof("tray applySessionExpiry: deadline=<zero> connected=%v → row hidden", connected)
+		default:
+			log.Infof("tray applySessionExpiry: deadline=%s (in %s) connected=%v",
+				deadline.Format(time.RFC3339), time.Until(*deadline), connected)
+		}
+	}
+	return changed
+}
+
+// runSessionExpiryTicker recomputes the "Expires in …" row label every 30s. Runs until process exit.
+func (t *Tray) runSessionExpiryTicker() {
+	tk := time.NewTicker(30 * time.Second)
+	for range tk.C {
+		t.refreshSessionExpiresLabel()
+	}
+}
+
+// refreshSessionExpiresLabel updates only the countdown label, no relayout, to avoid disturbing an open menu.
+// The item is snapshotted under menuMu since buildMenu reassigns it on every relayout.
+func (t *Tray) refreshSessionExpiresLabel() {
+	t.menuMu.Lock()
+	item := t.sessionExpiresItem
+	t.menuMu.Unlock()
+	if item == nil {
+		return
+	}
+	t.sessionMu.Lock()
+	deadline := t.sessionExpiresAt
+	t.sessionMu.Unlock()
+	if deadline.IsZero() {
+		return
+	}
+	remaining := t.formatSessionRemaining(time.Until(deadline))
+	item.SetLabel(t.loc.T("tray.session.expiresIn", "remaining", remaining))
+}
+
+// formatSessionRemaining renders d as a localised long-form string picking the largest non-zero unit.
+// Singular/plural keys are split per language for proper translation.
+func (t *Tray) formatSessionRemaining(d time.Duration) string {
+	switch {
+	case d < time.Minute:
+		return t.loc.T("tray.session.unit.lessThanMinute")
+	case d < time.Hour:
+		m := int(d / time.Minute)
+		if m == 1 {
+			return t.loc.T("tray.session.unit.minute")
+		}
+		return t.loc.T("tray.session.unit.minutes", "count", strconv.Itoa(m))
+	case d < 24*time.Hour:
+		h := int((d + 30*time.Minute) / time.Hour)
+		if h == 1 {
+			return t.loc.T("tray.session.unit.hour")
+		}
+		return t.loc.T("tray.session.unit.hours", "count", strconv.Itoa(h))
+	default:
+		days := int((d + 12*time.Hour) / (24 * time.Hour))
+		if days == 1 {
+			return t.loc.T("tray.session.unit.day")
+		}
+		return t.loc.T("tray.session.unit.days", "count", strconv.Itoa(days))
+	}
+}
+
+// registerSessionWarningCategory wires the OS notification category and response handler for the expiry warning.
+// Errors are swallowed since the worst case is a plain notification without buttons.
+func (t *Tray) registerSessionWarningCategory() {
+	if t.svc.Notifier == nil {
+		return
+	}
+	if err := t.svc.Notifier.RegisterNotificationCategory(notifications.NotificationCategory{
+		ID: notifyCategorySessionWarning,
+		Actions: []notifications.NotificationAction{
+			{ID: notifyActionExtendNow, Title: t.loc.T("notify.sessionWarning.extend")},
+			{ID: notifyActionDismiss, Title: t.loc.T("notify.sessionWarning.dismiss")},
+		},
+	}); err != nil {
+		log.Debugf("register session-warning notification category: %v", err)
+	}
+	t.svc.Notifier.OnNotificationResponse(func(result notifications.NotificationResult) {
+		if result.Error != nil {
+			log.Debugf("notification response error: %v", result.Error)
+			return
+		}
+		if result.Response.CategoryID != notifyCategorySessionWarning {
+			return
+		}
+		switch result.Response.ActionIdentifier {
+		case notifyActionExtendNow, notifications.DefaultActionIdentifier:
+			// DefaultActionIdentifier is the body-click on platforms with no separate buttons; treat as Extend.
+			go t.runExtendSession()
+		case notifyActionDismiss:
+			go t.dismissSessionWarning()
+		}
+	})
+}
+
+// buildSessionWarningBody composes the localised notification body from the daemon's metadata.
+// The daemon has no locale, so it ships an RFC3339 deadline the tray turns into a user-language sentence.
+// Falls back to a generic string when metadata is missing or unparsable.
+func (t *Tray) buildSessionWarningBody(meta map[string]string) string {
+	if meta == nil {
+		return t.loc.T("notify.sessionWarning.bodyGeneric")
+	}
+	raw := meta[authsession.MetaExpiresAt]
+	if raw == "" {
+		return t.loc.T("notify.sessionWarning.bodyGeneric")
+	}
+	deadline, err := authsession.ParseExpiresAt(raw)
+	if err != nil {
+		return t.loc.T("notify.sessionWarning.bodyGeneric")
+	}
+	remaining := nbstatus.FormatRemainingDuration(time.Until(deadline))
+	return t.loc.T("notify.sessionWarning.body", "remaining", remaining)
+}
+
+// notifySessionWarning sends the interactive expiry notification, falling back to plain notify when the
+// with-actions variant is unavailable (older platform impls, or a bare Notifier in tests).
+func (t *Tray) notifySessionWarning(title, body string) {
+	if t.svc.Notifier == nil {
+		return
+	}
+	err := safeSendNotification(t.svc.Notifier.SendNotificationWithActions, "session-warning with actions", notifications.NotificationOptions{
+		ID:         notifyIDSessionWarning,
+		Title:      title,
+		Body:       body,
+		CategoryID: notifyCategorySessionWarning,
+	})
+	if err != nil {
+		// A recovered panic returns nil err, so a dead bus correctly skips this fallback (it would panic too).
+		t.notify(title, body, notifyIDSessionWarning)
+	}
+}
+
+// runExtendSession drives the daemon's RequestExtend + WaitExtend pair, opening the browser via Connection.OpenURL.
+// Errors surface as notifyError rather than foreground UI, since the warning may fire while the window is closed.
+func (t *Tray) runExtendSession() {
+	if t.svc.Session == nil || t.svc.Connection == nil {
+		log.Debugf("session-warning: extend requested but services not wired")
+		return
+	}
+	ctx := context.Background()
+
+	start, err := t.svc.Session.RequestExtend(ctx, services.ExtendStartParams{})
+	if err != nil {
+		log.Warnf("session-warning: RequestExtend failed: %v", err)
+		t.notifyError(t.loc.T("notify.sessionWarning.failed"))
+		return
+	}
+
+	uri := start.VerificationURIComplete
+	if uri == "" {
+		uri = start.VerificationURI
+	}
+	if uri != "" {
+		if err := t.svc.Connection.OpenURL(uri); err != nil {
+			log.Debugf("session-warning: opening verification URL: %v", err)
+		}
+	}
+
+	result, err := t.svc.Session.WaitExtend(ctx, services.ExtendWaitParams{
+		DeviceCode: start.DeviceCode,
+		UserCode:   start.UserCode,
+	})
+	if err != nil {
+		log.Warnf("session-warning: WaitExtend failed: %v", err)
+		t.notifyError(t.loc.T("notify.sessionWarning.failed"))
+		return
+	}
+	if result.Preempted {
+		// Another UI surface owns the flow; stay silent so the user only sees the surviving flow's outcome.
+		log.Debugf("session-warning: WaitExtend preempted by a newer flow")
+		return
+	}
+	t.notify(t.loc.T("notify.sessionWarning.successTitle"), t.loc.T("notify.sessionWarning.successBody"), notifyIDSessionWarning)
+}
+
+// dismissSessionWarning tells the daemon to silence the fallback dialog for the current deadline.
+// Best-effort: a failure only means the dialog will still appear.
+func (t *Tray) dismissSessionWarning() {
+	if t.svc.Session == nil {
+		return
+	}
+	if err := t.svc.Session.DismissWarning(context.Background()); err != nil {
+		log.Debugf("session-warning: DismissWarning failed: %v", err)
+	}
+}
+
+// openSessionExpiration fires the fallback dialog when the earlier warning notification wasn't dismissed.
+// Idempotent on the WindowManager side.
+func (t *Tray) openSessionExpiration() {
+	if t.svc.WindowManager == nil {
+		return
+	}
+	t.svc.WindowManager.OpenSessionExpiration(finalWarningCountdownSeconds)
+}
+
+// openSessionExtendFlow opens the SessionExpiration window seeded with the cached deadline's remaining time,
+// for the "Expires in …" tray row. No-ops when the deadline is unknown or elapsed.
+func (t *Tray) openSessionExtendFlow() {
+	if t.svc.WindowManager == nil {
+		return
+	}
+	t.sessionMu.Lock()
+	deadline := t.sessionExpiresAt
+	t.sessionMu.Unlock()
+	if deadline.IsZero() {
+		return
+	}
+	seconds := int(time.Until(deadline).Seconds())
+	if seconds <= 0 {
+		return
+	}
+	t.svc.WindowManager.OpenSessionExpiration(seconds)
+}
diff --git a/client/ui/tray_status.go b/client/ui/tray_status.go
new file mode 100644
index 000000000..793f1785a
--- /dev/null
+++ b/client/ui/tray_status.go
@@ -0,0 +1,126 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"strings"
+
+	"github.com/wailsapp/wails/v3/pkg/application"
+
+	"github.com/netbirdio/netbird/client/ui/services"
+)
+
+func (t *Tray) onStatusEvent(ev *application.CustomEvent) {
+	st, ok := ev.Data.(services.Status)
+	if !ok {
+		return
+	}
+	t.applyStatus(st)
+}
+
+// applyStatus repaints the tray from a daemon snapshot. Icon refresh is skipped
+// when no icon-relevant input changed: the daemon emits rapid SubscribeStatus
+// bursts during health probes that would otherwise spam Shell_NotifyIcon.
+func (t *Tray) applyStatus(st services.Status) {
+	t.statusMu.Lock()
+	connected := strings.EqualFold(st.Status, services.StatusConnected)
+	iconChanged := connected != t.connected || st.Status != t.lastStatus
+	// The daemon re-emits SessionExpired on every snapshot while expired; act
+	// only on the transition into it so the notification fires once.
+	sessionExpiredEnter := strings.EqualFold(st.Status, services.StatusSessionExpired) &&
+		!strings.EqualFold(t.lastStatus, services.StatusSessionExpired)
+
+	triggerLogin := t.consumePendingConnectLogin(st.Status)
+
+	daemonVersionChanged := st.DaemonVersion != "" && st.DaemonVersion != t.lastDaemonVersion
+	t.connected = connected
+	t.lastStatus = st.Status
+	if daemonVersionChanged {
+		t.lastDaemonVersion = st.DaemonVersion
+	}
+
+	revisionChanged := st.NetworksRevision != t.lastNetworksRevision
+	t.lastNetworksRevision = st.NetworksRevision
+	t.statusMu.Unlock()
+
+	if triggerLogin {
+		t.app.Event.Emit(services.EventTriggerLogin)
+	}
+
+	// Cache-only; the row is painted by the relayout below.
+	sessionChanged := t.applySessionExpiry(st.SessionExpiresAt, connected)
+
+	if iconChanged {
+		t.applyIcon()
+	}
+	// All repainting goes through relayoutMenu (menuMu-serialised): applyStatus
+	// runs concurrently with itself and with relayouts, so in-place item
+	// mutation would race the buildMenu pointer swap.
+	if iconChanged || daemonVersionChanged || sessionChanged {
+		t.relayoutMenu()
+	}
+	// The revision is the only reliable signal: candidate routes never appear
+	// in the peer-status snapshot, so a removed exit node would go unnoticed.
+	if iconChanged || revisionChanged {
+		go t.refreshExitNodes()
+	}
+	// The daemon emits no active-profile event, so profile flips driven
+	// elsewhere (CLI, autoconnect) surface via status transitions.
+	if iconChanged {
+		go t.loadProfiles()
+	}
+	if sessionExpiredEnter {
+		t.handleSessionExpired()
+	}
+}
+
+// consumePendingConnectLogin acts on the SSO auto-handoff flag armed by
+// handleConnect. Returns true on NeedsLogin so the browser-login flow starts
+// without a second Connect click; clears the flag on any terminal state so a
+// stale flag can't fire on a later daemon flip. Must hold statusMu.
+func (t *Tray) consumePendingConnectLogin(status string) bool {
+	if !t.pendingConnectLogin {
+		return false
+	}
+	switch {
+	case strings.EqualFold(status, services.StatusNeedsLogin):
+		t.pendingConnectLogin = false
+		return true
+	case strings.EqualFold(status, services.StatusConnected),
+		strings.EqualFold(status, services.StatusIdle),
+		strings.EqualFold(status, services.StatusLoginFailed),
+		strings.EqualFold(status, services.StatusSessionExpired),
+		strings.EqualFold(status, services.StatusDaemonUnavailable):
+		t.pendingConnectLogin = false
+	}
+	return false
+}
+
+// applyStatusIndicator sets the status dot bitmap. Call only from relayoutMenu
+// (menuMu held): on macOS the bitmap repaints via the relayout's trailing
+// SetMenu, not here — the tree is half-built.
+func (t *Tray) applyStatusIndicator(status string) {
+	if t.statusItem == nil {
+		return
+	}
+	t.statusItem.SetBitmap(statusIndicatorBitmap(status))
+}
+
+func statusIndicatorBitmap(status string) []byte {
+	switch {
+	case strings.EqualFold(status, services.StatusConnected):
+		return iconMenuDotConnected
+	case strings.EqualFold(status, services.StatusConnecting):
+		return iconMenuDotConnecting
+	case strings.EqualFold(status, services.StatusNeedsLogin),
+		strings.EqualFold(status, services.StatusSessionExpired):
+		return iconMenuDotConnecting
+	case strings.EqualFold(status, services.StatusLoginFailed),
+		strings.EqualFold(status, statusError):
+		return iconMenuDotError
+	case strings.EqualFold(status, services.StatusDaemonUnavailable):
+		return iconMenuDotOffline
+	default:
+		return iconMenuDotIdle
+	}
+}
diff --git a/client/ui/tray_status_enabled_linux.go b/client/ui/tray_status_enabled_linux.go
new file mode 100644
index 000000000..ab7f869b8
--- /dev/null
+++ b/client/ui/tray_status_enabled_linux.go
@@ -0,0 +1,8 @@
+//go:build linux
+
+package main
+
+// statusRowEnabled keeps the top status row enabled on Linux: a disabled row
+// paints greyed-out, washing out the status dot. The row has no OnClick, so
+// enabling only affects drawing.
+func statusRowEnabled() bool { return true }
diff --git a/client/ui/tray_status_enabled_other.go b/client/ui/tray_status_enabled_other.go
new file mode 100644
index 000000000..606a7d702
--- /dev/null
+++ b/client/ui/tray_status_enabled_other.go
@@ -0,0 +1,7 @@
+//go:build !windows && !linux && !android && !ios && !freebsd && !js
+
+package main
+
+// statusRowEnabled is false on macOS: disabling the row dims the label (signalling
+// non-clickable) while keeping the bitmap opaque, so the coloured dot stays visible.
+func statusRowEnabled() bool { return false }
diff --git a/client/ui/tray_status_enabled_windows.go b/client/ui/tray_status_enabled_windows.go
new file mode 100644
index 000000000..06750b7c0
--- /dev/null
+++ b/client/ui/tray_status_enabled_windows.go
@@ -0,0 +1,7 @@
+//go:build windows
+
+package main
+
+// statusRowEnabled is always true on Windows: the Win32 disabled-state mask
+// desaturates the row's HBITMAP, which would grey out the coloured status dot.
+func statusRowEnabled() bool { return true }
diff --git a/client/ui/tray_theme_linux.go b/client/ui/tray_theme_linux.go
new file mode 100644
index 000000000..a3249e57a
--- /dev/null
+++ b/client/ui/tray_theme_linux.go
@@ -0,0 +1,134 @@
+//go:build linux && !(linux && 386)
+
+package main
+
+// Wails v3's Linux SNI backend ignores SetDarkModeIcon (it just calls setIcon,
+// last write wins) and SNI carries no panel dark/light hint, so we detect the
+// desktop colour scheme ourselves and pick the silhouette in iconForState.
+// The live watcher is in tray_theme_watcher_linux.go.
+
+import (
+	"bufio"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// startTrayTheme seeds t.panelDark and repaints on colour-scheme flips. Must
+// run before the first applyIcon so the initial paint uses the right silhouette.
+func (t *Tray) startTrayTheme() {
+	w := startThemeWatcher(func() { t.applyIcon() })
+	t.panelDark = w.IsDark
+}
+
+// isKDE reports whether the current desktop is KDE Plasma. XDG_CURRENT_DESKTOP
+// is a colon-separated list (e.g. "ubuntu:KDE"), so match per token.
+func isKDE() bool {
+	for _, d := range strings.Split(os.Getenv("XDG_CURRENT_DESKTOP"), ":") {
+		if strings.EqualFold(strings.TrimSpace(d), "KDE") {
+			return true
+		}
+	}
+	return false
+}
+
+// kdeglobalsPath returns the user kdeglobals path. We read only this file, not
+// the full XDG_CONFIG_DIRS cascade: Plasma writes the active scheme here, and a
+// missing Complementary group falls back to the portal.
+func kdeglobalsPath() string {
+	if dir := os.Getenv("XDG_CONFIG_HOME"); dir != "" {
+		return filepath.Join(dir, "kdeglobals")
+	}
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return ""
+	}
+	return filepath.Join(home, ".config", "kdeglobals")
+}
+
+// kdePanelIsDark reports whether the KDE Plasma panel is dark by the luma of
+// its "Complementary" background (the colour Plasma paints the tray with). ok
+// is false when this isn't KDE or the colour can't be read, so the caller falls
+// through to the portal/GTK path.
+func kdePanelIsDark() (dark, ok bool) {
+	if !isKDE() {
+		return false, false
+	}
+	path := kdeglobalsPath()
+	if path == "" {
+		return false, false
+	}
+	rgb, ok := readKdeComplementaryBackground(path)
+	if !ok {
+		return false, false
+	}
+	return isDarkRGB(rgb[0], rgb[1], rgb[2]), true
+}
+
+// readKdeComplementaryBackground parses kdeglobals for
+// [Colors:Complementary] BackgroundNormal and returns its R,G,B (0-255).
+func readKdeComplementaryBackground(path string) (rgb [3]uint8, ok bool) {
+	f, err := os.Open(path)
+	if err != nil {
+		log.Debugf("tray theme: kdeglobals open failed, using portal: %v", err)
+		return rgb, false
+	}
+	defer func() { _ = f.Close() }()
+
+	const group = "[Colors:Complementary]"
+	inGroup := false
+	scanner := bufio.NewScanner(f)
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if strings.HasPrefix(line, "[") {
+			inGroup = line == group
+			continue
+		}
+		if !inGroup {
+			continue
+		}
+		key, val, found := strings.Cut(line, "=")
+		if !found || strings.TrimSpace(key) != "BackgroundNormal" {
+			continue
+		}
+		return parseRGB(strings.TrimSpace(val))
+	}
+	return rgb, false
+}
+
+// parseRGB parses KDE's "r,g,b" colour triple into bytes.
+func parseRGB(s string) (rgb [3]uint8, ok bool) {
+	parts := strings.Split(s, ",")
+	if len(parts) != 3 {
+		return rgb, false
+	}
+	for i, p := range parts {
+		n, err := strconv.Atoi(strings.TrimSpace(p))
+		if err != nil || n < 0 || n > 255 {
+			return rgb, false
+		}
+		rgb[i] = uint8(n)
+	}
+	return rgb, true
+}
+
+// isDarkRGB reports whether a colour is dark via Rec. 601 luma, split at the
+// 128 midpoint.
+func isDarkRGB(r, g, b uint8) bool {
+	luma := (299*int(r) + 587*int(g) + 114*int(b)) / 1000
+	return luma < 128
+}
+
+// gtkThemeIsDark inspects the GTK_THEME env var. Empty (no override) is treated
+// as dark to match the default-dark fallback used elsewhere.
+func gtkThemeIsDark() bool {
+	theme := os.Getenv("GTK_THEME")
+	if theme == "" {
+		return true
+	}
+	// GTK_THEME is "Name[:variant]"; the dark variant is ":dark".
+	return strings.Contains(strings.ToLower(theme), ":dark")
+}
diff --git a/client/ui/tray_theme_linux_test.go b/client/ui/tray_theme_linux_test.go
new file mode 100644
index 000000000..f14f08d7f
--- /dev/null
+++ b/client/ui/tray_theme_linux_test.go
@@ -0,0 +1,86 @@
+//go:build linux && !(linux && 386)
+
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestReadKdeComplementaryBackground(t *testing.T) {
+	// Mirrors the KDE test VM's kdeglobals: Window light, Complementary dark.
+	// The tray sits on the panel, which Plasma paints from Complementary, so
+	// the panel is dark even though the global color-scheme is Light.
+	content := `[Colors:Window]
+BackgroundNormal=239,240,241
+
+[Colors:Complementary]
+BackgroundAlternate=27,30,32
+BackgroundNormal=42,46,50
+
+[General]
+ColorSchemeHash=0be804dba87e3512aeb4be3d78ed981f59f0f2f4
+`
+	path := filepath.Join(t.TempDir(), "kdeglobals")
+	if err := os.WriteFile(path, []byte(content), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	rgb, ok := readKdeComplementaryBackground(path)
+	if !ok {
+		t.Fatal("expected to find Complementary BackgroundNormal")
+	}
+	if rgb != [3]uint8{42, 46, 50} {
+		t.Fatalf("rgb = %v, want [42 46 50]", rgb)
+	}
+	if !isDarkRGB(rgb[0], rgb[1], rgb[2]) {
+		t.Fatal("panel colour 42,46,50 should be dark")
+	}
+	// The Window background (what color-scheme reflects) is light — the bug
+	// this fix addresses is picking the icon from that instead of the panel.
+	if isDarkRGB(239, 240, 241) {
+		t.Fatal("window colour 239,240,241 should be light")
+	}
+}
+
+func TestReadKdeComplementaryBackgroundMissingGroup(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "kdeglobals")
+	if err := os.WriteFile(path, []byte("[Colors:Window]\nBackgroundNormal=1,2,3\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := readKdeComplementaryBackground(path); ok {
+		t.Fatal("expected not-ok when Complementary group is absent")
+	}
+}
+
+func TestParseRGB(t *testing.T) {
+	if _, ok := parseRGB("1,2"); ok {
+		t.Fatal("two components should fail")
+	}
+	if _, ok := parseRGB("300,0,0"); ok {
+		t.Fatal("out-of-range should fail")
+	}
+	if _, ok := parseRGB("a,b,c"); ok {
+		t.Fatal("non-numeric should fail")
+	}
+	rgb, ok := parseRGB(" 10 , 20 , 30 ")
+	if !ok || rgb != [3]uint8{10, 20, 30} {
+		t.Fatalf("parseRGB = %v ok=%v, want [10 20 30] true", rgb, ok)
+	}
+}
+
+func TestIsDarkRGB(t *testing.T) {
+	if !isDarkRGB(0, 0, 0) {
+		t.Fatal("black is dark")
+	}
+	if isDarkRGB(255, 255, 255) {
+		t.Fatal("white is light")
+	}
+	if !isDarkRGB(42, 46, 50) {
+		t.Fatal("Breeze panel grey is dark")
+	}
+	if isDarkRGB(239, 240, 241) {
+		t.Fatal("Breeze window grey is light")
+	}
+}
diff --git a/client/ui/tray_theme_other.go b/client/ui/tray_theme_other.go
new file mode 100644
index 000000000..3f85e1603
--- /dev/null
+++ b/client/ui/tray_theme_other.go
@@ -0,0 +1,7 @@
+//go:build (!linux || (linux && 386)) && !android && !ios && !freebsd && !js
+
+package main
+
+func (t *Tray) startTrayTheme() {
+	// No-op off Linux: leaves panelDark nil so panelIsDark uses its default.
+}
diff --git a/client/ui/tray_theme_watcher_linux.go b/client/ui/tray_theme_watcher_linux.go
new file mode 100644
index 000000000..b9bafe30b
--- /dev/null
+++ b/client/ui/tray_theme_watcher_linux.go
@@ -0,0 +1,246 @@
+//go:build linux && !(linux && 386)
+
+package main
+
+// Sources: the freedesktop Settings portal's SettingChanged signal, and on KDE
+// the kdeglobals file (the portal's color-scheme doesn't track the panel's
+// Complementary colour — see readDarkMode). The dark/light decision lives in
+// tray_theme_linux.go; this file owns the session-bus connection and subscriptions.
+
+import (
+	"path/filepath"
+	"sync"
+
+	"github.com/fsnotify/fsnotify"
+	"github.com/godbus/dbus/v5"
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	portalBusName    = "org.freedesktop.portal.Desktop"
+	portalObjectPath = "/org/freedesktop/portal/desktop"
+	portalSettings   = "org.freedesktop.portal.Settings"
+
+	appearanceNamespace = "org.freedesktop.appearance"
+	colorSchemeKey      = "color-scheme"
+
+	colorSchemeNoPreference = 0
+	colorSchemePreferDark   = 1
+	colorSchemePreferLight  = 2
+)
+
+// themeWatcher owns a private session-bus connection so its signal subscription
+// is isolated from the SNI watcher's.
+type themeWatcher struct {
+	conn     *dbus.Conn
+	onChange func()
+
+	mu       sync.Mutex
+	darkMode bool
+}
+
+// startThemeWatcher returns nil if the session bus is unavailable; callers treat
+// a nil watcher as "no preference", keeping the default-dark icon.
+func startThemeWatcher(onChange func()) *themeWatcher {
+	conn, err := dbus.SessionBusPrivate()
+	if err != nil {
+		log.Debugf("tray theme: session bus unavailable, defaulting to dark icons: %v", err)
+		return nil
+	}
+	if err := conn.Auth(nil); err != nil {
+		_ = conn.Close()
+		log.Debugf("tray theme: dbus auth failed: %v", err)
+		return nil
+	}
+	if err := conn.Hello(); err != nil {
+		_ = conn.Close()
+		log.Debugf("tray theme: dbus hello failed: %v", err)
+		return nil
+	}
+
+	w := &themeWatcher{conn: conn, onChange: onChange}
+	w.darkMode = w.readDarkMode()
+
+	if err := w.subscribe(); err != nil {
+		log.Debugf("tray theme: SettingChanged subscription failed, theme is static: %v", err)
+		// Keep the connection: the seeded darkMode value is still useful.
+	}
+
+	// The portal's signal doesn't track KDE's panel Complementary colour.
+	if isKDE() {
+		w.watchKdeglobals()
+	}
+
+	log.Infof("tray theme: panel dark mode = %v", w.IsDark())
+	return w
+}
+
+// IsDark reports true for a nil watcher, so the icon defaults to the white
+// silhouette suiting the common dark Linux panel.
+func (w *themeWatcher) IsDark() bool {
+	if w == nil {
+		return true
+	}
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	return w.darkMode
+}
+
+// readDarkMode resolves whether the panel the tray icon sits on is dark.
+//
+// On KDE the freedesktop color-scheme is the application preference, not the
+// panel's: Plasma paints its panel from the Breeze "Complementary" group, which
+// stays dark even under a Light global scheme, so we read the panel background
+// from kdeglobals first and decide by its luma. Off KDE the color-scheme portal
+// is the source; on "no preference" (0) or when unavailable we fall back to
+// GTK_THEME (":dark" suffix ⇒ dark), then default to dark.
+func (w *themeWatcher) readDarkMode() bool {
+	if dark, ok := kdePanelIsDark(); ok {
+		return dark
+	}
+	switch w.readColorScheme() {
+	case colorSchemePreferDark:
+		return true
+	case colorSchemePreferLight:
+		return false
+	default:
+		return gtkThemeIsDark()
+	}
+}
+
+// readColorScheme returns the raw freedesktop color-scheme value, or
+// colorSchemeNoPreference when the portal can't be reached.
+func (w *themeWatcher) readColorScheme() uint32 {
+	obj := w.conn.Object(portalBusName, portalObjectPath)
+	call := obj.Call(portalSettings+".Read", 0, appearanceNamespace, colorSchemeKey)
+	if call.Err != nil {
+		log.Debugf("tray theme: portal Read failed, falling back to GTK_THEME: %v", call.Err)
+		return colorSchemeNoPreference
+	}
+
+	var v dbus.Variant
+	if err := call.Store(&v); err != nil {
+		log.Debugf("tray theme: portal Read decode failed, falling back to GTK_THEME: %v", err)
+		return colorSchemeNoPreference
+	}
+
+	return variantToColorScheme(v)
+}
+
+func (w *themeWatcher) subscribe() error {
+	if err := w.conn.AddMatchSignal(
+		dbus.WithMatchObjectPath(portalObjectPath),
+		dbus.WithMatchInterface(portalSettings),
+		dbus.WithMatchMember("SettingChanged"),
+	); err != nil {
+		return err
+	}
+
+	sigs := make(chan *dbus.Signal, 8)
+	w.conn.Signal(sigs)
+	go w.loop(sigs)
+	return nil
+}
+
+func (w *themeWatcher) loop(sigs chan *dbus.Signal) {
+	for sig := range sigs {
+		if sig.Name != portalSettings+".SettingChanged" {
+			continue
+		}
+		// Signal body: (namespace string, key string, value variant).
+		if len(sig.Body) < 3 {
+			continue
+		}
+		namespace, _ := sig.Body[0].(string)
+		key, _ := sig.Body[1].(string)
+		if namespace != appearanceNamespace || key != colorSchemeKey {
+			continue
+		}
+		if _, ok := sig.Body[2].(dbus.Variant); !ok {
+			continue
+		}
+
+		// Re-resolve via readDarkMode, not the signal value: under KDE the panel
+		// colour comes from kdeglobals, so the signal value would be wrong.
+		w.update()
+	}
+}
+
+func (w *themeWatcher) update() {
+	dark := w.readDarkMode()
+	w.mu.Lock()
+	changed := dark != w.darkMode
+	w.darkMode = dark
+	w.mu.Unlock()
+
+	if changed && w.onChange != nil {
+		log.Infof("tray theme: panel dark mode changed to %v", dark)
+		w.onChange()
+	}
+}
+
+// watchKdeglobals watches the parent directory, not the file: KDE rewrites
+// kdeglobals atomically (write-temp + rename), which would drop an inotify watch
+// on the original inode. Filtering by name re-arms implicitly.
+func (w *themeWatcher) watchKdeglobals() {
+	path := kdeglobalsPath()
+	if path == "" {
+		return
+	}
+	dir, name := filepath.Split(path)
+
+	fw, err := fsnotify.NewWatcher()
+	if err != nil {
+		log.Debugf("tray theme: kdeglobals watcher unavailable, theme is static: %v", err)
+		return
+	}
+	if err := fw.Add(filepath.Clean(dir)); err != nil {
+		log.Debugf("tray theme: watching %s failed, theme is static: %v", dir, err)
+		_ = fw.Close()
+		return
+	}
+
+	go func() {
+		defer func() { _ = fw.Close() }()
+		for {
+			select {
+			case event, ok := <-fw.Events:
+				if !ok {
+					return
+				}
+				if filepath.Base(event.Name) != name {
+					continue
+				}
+				if event.Op&(fsnotify.Write|fsnotify.Create|fsnotify.Rename) == 0 {
+					continue
+				}
+				w.update()
+			case err, ok := <-fw.Errors:
+				if !ok {
+					return
+				}
+				log.Debugf("tray theme: kdeglobals watch error: %v", err)
+			}
+		}
+	}()
+}
+
+// variantToColorScheme unwraps the color-scheme variant; the portal nests it one level.
+func variantToColorScheme(v dbus.Variant) uint32 {
+	inner := v.Value()
+	if nested, ok := inner.(dbus.Variant); ok {
+		inner = nested.Value()
+	}
+
+	switch n := inner.(type) {
+	case uint32:
+		return n
+	case int32:
+		return uint32(n)
+	case uint8:
+		return uint32(n)
+	default:
+		log.Debugf("tray theme: unexpected color-scheme type %T, assuming no preference", inner)
+		return colorSchemeNoPreference
+	}
+}
diff --git a/client/ui/tray_update.go b/client/ui/tray_update.go
new file mode 100644
index 000000000..2d79cff05
--- /dev/null
+++ b/client/ui/tray_update.go
@@ -0,0 +1,197 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"context"
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/wailsapp/wails/v3/pkg/application"
+	"github.com/wailsapp/wails/v3/pkg/services/notifications"
+
+	"github.com/netbirdio/netbird/client/ui/services"
+	"github.com/netbirdio/netbird/client/ui/updater"
+)
+
+// trayUpdater owns the tray UI that reacts to auto-update. Composed inside Tray.
+type trayUpdater struct {
+	app          *application.App
+	window       *application.WebviewWindow
+	update       *services.Update
+	notifier     *notifications.NotificationService
+	loc          *Localizer
+	onIconChange func()
+	// onMenuChange drives a full tray relayout: the update row lives in the
+	// About submenu, which KDE/Plasma caches on first open and never re-fetches
+	// on a plain SetLabel/SetHidden — only a relayout (fresh submenu ids) repaints.
+	onMenuChange func()
+
+	mu                 sync.Mutex
+	item               *application.MenuItem
+	state              updater.State
+	notifiedVersion    string
+	progressWindowOpen bool
+}
+
+func newTrayUpdater(app *application.App, window *application.WebviewWindow, update *services.Update, notifier *notifications.NotificationService, loc *Localizer, onIconChange func(), onMenuChange func()) *trayUpdater {
+	u := &trayUpdater{
+		app:          app,
+		window:       window,
+		update:       update,
+		notifier:     notifier,
+		loc:          loc,
+		onIconChange: onIconChange,
+		onMenuChange: onMenuChange,
+	}
+	app.Event.On(updater.EventStateChanged, u.onStateEvent)
+	// Seed from cached state to cover an event that fired before wiring completed.
+	u.state = update.GetState()
+	return u
+}
+
+// attach (re)binds the menu item on each Tray.buildMenu run. The caller owns the
+// item's OnClick handler.
+func (u *trayUpdater) attach(item *application.MenuItem) {
+	u.mu.Lock()
+	u.item = item
+	state := u.state
+	u.mu.Unlock()
+	u.refreshMenuItem(state)
+}
+
+// hasUpdate reports whether the tray should paint the "update available" icon.
+func (u *trayUpdater) hasUpdate() bool {
+	u.mu.Lock()
+	defer u.mu.Unlock()
+	return u.state.Available
+}
+
+// applyLanguage re-renders the menu item label after a locale switch.
+func (u *trayUpdater) applyLanguage() {
+	u.mu.Lock()
+	state := u.state
+	u.mu.Unlock()
+	u.refreshMenuItem(state)
+}
+
+// handleClick opens the GitHub releases page when not Enforced, otherwise shows
+// the progress page and asks the daemon to start the installer.
+func (u *trayUpdater) handleClick() {
+	u.mu.Lock()
+	state := u.state
+	u.mu.Unlock()
+
+	if !state.Enforced {
+		_ = u.app.Browser.OpenURL(urlGitHubReleases)
+		return
+	}
+
+	u.openProgressWindow(state.Version)
+
+	go func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+		defer cancel()
+		if _, err := u.update.Trigger(ctx); err != nil {
+			log.Errorf("trigger update: %v", err)
+		}
+	}()
+}
+
+func (u *trayUpdater) onStateEvent(ev *application.CustomEvent) {
+	st, ok := ev.Data.(updater.State)
+	if !ok {
+		log.Warnf("update state event payload not UpdateState: %T", ev.Data)
+		return
+	}
+	u.applyState(st)
+}
+
+// applyState diffs st against the cached state and drives the resulting side
+// effects: icon repaint, menu refresh, new-version notification, progress window.
+func (u *trayUpdater) applyState(st updater.State) {
+	u.mu.Lock()
+	prev := u.state
+	u.state = st
+
+	sendNotify := st.Available && st.Version != "" && st.Version != u.notifiedVersion
+	if sendNotify {
+		u.notifiedVersion = st.Version
+	}
+
+	showWindow := st.Installing && !u.progressWindowOpen
+	if showWindow {
+		u.progressWindowOpen = true
+	} else if !st.Installing {
+		u.progressWindowOpen = false
+	}
+	u.mu.Unlock()
+
+	// Full relayout rather than in-place: KDE layout-caches the About submenu, so
+	// a direct SetLabel/SetHidden wouldn't paint. Fall back if no hook was wired.
+	if u.onMenuChange != nil {
+		u.onMenuChange()
+	} else {
+		u.refreshMenuItem(st)
+	}
+	if prev.Available != st.Available && u.onIconChange != nil {
+		u.onIconChange()
+	}
+	if sendNotify {
+		u.sendUpdateNotification(st)
+	}
+	if showWindow {
+		u.openProgressWindow(st.Version)
+	}
+}
+
+func (u *trayUpdater) refreshMenuItem(st updater.State) {
+	u.mu.Lock()
+	item := u.item
+	u.mu.Unlock()
+	if item == nil {
+		return
+	}
+
+	if !st.Available {
+		item.SetHidden(true)
+		return
+	}
+	if st.Enforced {
+		item.SetLabel(u.loc.T("tray.menu.installVersion", "version", st.Version))
+	} else {
+		item.SetLabel(u.loc.T("tray.menu.downloadLatest"))
+	}
+	item.SetHidden(false)
+}
+
+func (u *trayUpdater) sendUpdateNotification(st updater.State) {
+	if u.notifier == nil {
+		return
+	}
+	body := u.loc.T("notify.update.body", "version", st.Version)
+	if st.Enforced {
+		body += u.loc.T("notify.update.enforcedSuffix")
+	}
+	_ = safeSendNotification(u.notifier.SendNotification, "update", notifications.NotificationOptions{
+		ID:    notifyIDUpdatePrefix + st.Version,
+		Title: u.loc.T("notify.update.title"),
+		Body:  body,
+	})
+}
+
+// openProgressWindow points the main window at the /update progress page and
+// brings it forward.
+func (u *trayUpdater) openProgressWindow(version string) {
+	if u.window == nil {
+		return
+	}
+	url := "/#/update"
+	if version != "" {
+		url += "?version=" + version
+	}
+	u.window.SetURL(url)
+	u.window.Show()
+	u.window.Focus()
+}
diff --git a/client/ui/tray_watcher_linux.go b/client/ui/tray_watcher_linux.go
new file mode 100644
index 000000000..38476179a
--- /dev/null
+++ b/client/ui/tray_watcher_linux.go
@@ -0,0 +1,176 @@
+//go:build linux && !(linux && 386)
+
+package main
+
+// In-process org.kde.StatusNotifierWatcher for minimal WMs (Fluxbox, OpenBox,
+// i3) that ship no watcher. When an XEmbed tray exists (_NET_SYSTEM_TRAY_S0),
+// an in-process XEmbed host bridges the SNI icon into it.
+
+import (
+	"sync"
+	"time"
+
+	"github.com/godbus/dbus/v5"
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	watcherName  = "org.kde.StatusNotifierWatcher"
+	watcherPath  = "/StatusNotifierWatcher"
+	watcherIface = "org.kde.StatusNotifierWatcher"
+
+	// The UI is often autostarted before the panel on minimal WMs, so a single
+	// startup probe would miss a tray that appears a second later.
+	watcherProbeInterval = 500 * time.Millisecond
+	watcherProbeTimeout  = 10 * time.Second
+)
+
+type statusNotifierWatcher struct {
+	conn    *dbus.Conn
+	items   []string
+	hosts   map[string]*xembedHost
+	hostsMu sync.Mutex
+}
+
+// RegisterStatusNotifierItem is the D-Bus method called by tray clients.
+// sender is injected by godbus and is not part of the D-Bus signature.
+func (w *statusNotifierWatcher) RegisterStatusNotifierItem(sender dbus.Sender, service string) *dbus.Error {
+	for _, s := range w.items {
+		if s == service {
+			return nil
+		}
+	}
+	w.items = append(w.items, service)
+	log.Debugf("StatusNotifierWatcher: registered item %q from %s", service, sender)
+
+	go w.tryStartXembedHost(string(sender), dbus.ObjectPath(service))
+	return nil
+}
+
+// RegisterStatusNotifierHost is required by the protocol but unused here.
+func (w *statusNotifierWatcher) RegisterStatusNotifierHost(service string) *dbus.Error {
+	log.Debugf("StatusNotifierWatcher: host registered %q", service)
+	return nil
+}
+
+// tryStartXembedHost is a no-op when no XEmbed tray manager is available.
+func (w *statusNotifierWatcher) tryStartXembedHost(busName string, objPath dbus.ObjectPath) {
+	w.hostsMu.Lock()
+	defer w.hostsMu.Unlock()
+
+	if _, exists := w.hosts[busName]; exists {
+		return
+	}
+
+	// Private session bus so our signal subscriptions don't reach Wails'
+	// signal handler, which panics on unexpected signals.
+	sessionConn, err := dbus.SessionBusPrivate()
+	if err != nil {
+		log.Debugf("StatusNotifierWatcher: cannot open private session bus for XEmbed host: %v", err)
+		return
+	}
+	if err := sessionConn.Auth(nil); err != nil {
+		log.Debugf("StatusNotifierWatcher: XEmbed host auth failed: %v", err)
+		closeBus(sessionConn)
+		return
+	}
+	if err := sessionConn.Hello(); err != nil {
+		log.Debugf("StatusNotifierWatcher: XEmbed host Hello failed: %v", err)
+		closeBus(sessionConn)
+		return
+	}
+
+	host, err := newXembedHost(sessionConn, busName, objPath)
+	if err != nil {
+		log.Debugf("StatusNotifierWatcher: XEmbed host not started: %v", err)
+		closeBus(sessionConn)
+		return
+	}
+
+	w.hosts[busName] = host
+	go host.run()
+	log.Infof("StatusNotifierWatcher: XEmbed tray icon created for %s", busName)
+}
+
+// startStatusNotifierWatcher claims org.kde.StatusNotifierWatcher only as a
+// bridge to an XEmbed tray on minimal WMs. The watcher is a stub that never
+// relays items to a real StatusNotifierHost, so claiming the name on a desktop
+// with a real host (e.g. Hyprland + Waybar) would dead-end every other tray
+// app's icon. It gates on the actual presence of an XEmbed tray rather than
+// GetNameOwner, which can't win a login-order race; without one it stays off
+// the bus so the real watcher owns the name. The XEmbed tray may come up after
+// the UI, so it re-probes for a grace period rather than deciding once.
+// Safe to call unconditionally.
+func startStatusNotifierWatcher() {
+	go func() {
+		deadline := time.Now().Add(watcherProbeTimeout)
+		for {
+			if xembedTrayAvailable() {
+				claimStatusNotifierWatcher()
+				return
+			}
+			if time.Now().After(deadline) {
+				log.Debugf("StatusNotifierWatcher: no XEmbed tray appeared within %s, leaving the watcher to the desktop", watcherProbeTimeout)
+				return
+			}
+			time.Sleep(watcherProbeInterval)
+		}
+	}()
+}
+
+// claimStatusNotifierWatcher takes ownership of org.kde.StatusNotifierWatcher
+// on a private session bus and exports the stub watcher. The GetNameOwner /
+// DoNotQueue guards back off if a real watcher already holds the name.
+func claimStatusNotifierWatcher() {
+	conn, err := dbus.SessionBusPrivate()
+	if err != nil {
+		log.Debugf("StatusNotifierWatcher: cannot open private session bus: %v", err)
+		return
+	}
+	if err := conn.Auth(nil); err != nil {
+		log.Debugf("StatusNotifierWatcher: auth failed: %v", err)
+		closeBus(conn)
+		return
+	}
+	if err := conn.Hello(); err != nil {
+		log.Debugf("StatusNotifierWatcher: Hello failed: %v", err)
+		closeBus(conn)
+		return
+	}
+
+	var owner string
+	callErr := conn.BusObject().Call("org.freedesktop.DBus.GetNameOwner", 0, watcherName).Store(&owner)
+	if callErr == nil && owner != "" {
+		log.Debugf("StatusNotifierWatcher: already owned by %s, skipping", owner)
+		closeBus(conn)
+		return
+	}
+
+	reply, err := conn.RequestName(watcherName, dbus.NameFlagDoNotQueue)
+	if err != nil || reply != dbus.RequestNameReplyPrimaryOwner {
+		log.Debugf("StatusNotifierWatcher: could not claim name (reply=%v err=%v)", reply, err)
+		closeBus(conn)
+		return
+	}
+
+	w := &statusNotifierWatcher{
+		conn:  conn,
+		hosts: make(map[string]*xembedHost),
+	}
+	if err := conn.ExportAll(w, dbus.ObjectPath(watcherPath), watcherIface); err != nil {
+		log.Errorf("StatusNotifierWatcher: export failed: %v", err)
+		closeBus(conn)
+		return
+	}
+
+	log.Infof("StatusNotifierWatcher: active on session bus (enables tray on minimal WMs)")
+	// Connection kept open for the process lifetime.
+}
+
+// closeBus closes a private session bus opened on a back-off path, logging a
+// warning rather than swallowing the error.
+func closeBus(conn *dbus.Conn) {
+	if err := conn.Close(); err != nil {
+		log.Warnf("StatusNotifierWatcher: closing session bus failed: %v", err)
+	}
+}
diff --git a/client/ui/tray_watcher_other.go b/client/ui/tray_watcher_other.go
new file mode 100644
index 000000000..ef8a1bb52
--- /dev/null
+++ b/client/ui/tray_watcher_other.go
@@ -0,0 +1,9 @@
+//go:build (!linux || (linux && 386)) && !freebsd && !android && !ios && !js
+
+package main
+
+// startStatusNotifierWatcher is a no-op stub so main.go can call it across all
+// build targets; only minimal Linux WMs need the real watcher (tray_watcher_linux.go).
+func startStatusNotifierWatcher() {
+	// Intentionally empty: only minimal Linux WMs need the real SNI watcher.
+}
diff --git a/client/ui/uilogpath.go b/client/ui/uilogpath.go
new file mode 100644
index 000000000..96fbb9637
--- /dev/null
+++ b/client/ui/uilogpath.go
@@ -0,0 +1,37 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"os"
+	"path/filepath"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/ui/guilog"
+)
+
+// uiLogFileName must stay in sync with the daemon's "gui-client*.log.*" glob
+// for rotated siblings (addUILog in client/internal/debug).
+const uiLogFileName = "gui-client.log"
+
+// uiLogPath returns the GUI log path with native separators, since the daemon
+// opens it directly for debug-bundle collection.
+func uiLogPath() (string, error) {
+	dir, err := os.UserConfigDir()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(dir, "netbird", uiLogFileName), nil
+}
+
+// newDebugLog builds the GUI debug log, disabled when userSetLogFile is set
+// (manual --log-file override) or the config dir can't be resolved.
+func newDebugLog(userSetLogFile bool) *guilog.DebugLog {
+	path, err := uiLogPath()
+	if err != nil {
+		log.Warnf("resolve GUI log path: %v; GUI file logging disabled", err)
+		return guilog.NewDebugLog("", false)
+	}
+	return guilog.NewDebugLog(path, !userSetLogFile)
+}
diff --git a/client/ui/update.go b/client/ui/update.go
deleted file mode 100644
index 25c317bdf..000000000
--- a/client/ui/update.go
+++ /dev/null
@@ -1,140 +0,0 @@
-//go:build !(linux && 386)
-
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"strings"
-	"time"
-
-	"fyne.io/fyne/v2/container"
-	"fyne.io/fyne/v2/widget"
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-func (s *serviceClient) showUpdateProgress(ctx context.Context, version string) {
-	log.Infof("show installer progress window: %s", version)
-	s.wUpdateProgress = s.app.NewWindow("Automatically updating client")
-
-	statusLabel := widget.NewLabel("Updating...")
-	infoLabel := widget.NewLabel(fmt.Sprintf("Your client version is older than the auto-update version set in Management.\nUpdating client to: %s.", version))
-	content := container.NewVBox(infoLabel, statusLabel)
-	s.wUpdateProgress.SetContent(content)
-	s.wUpdateProgress.CenterOnScreen()
-	s.wUpdateProgress.SetFixedSize(true)
-	s.wUpdateProgress.SetCloseIntercept(func() {
-		// this is empty to lock window until result known
-	})
-	s.wUpdateProgress.RequestFocus()
-	s.wUpdateProgress.Show()
-
-	updateWindowCtx, cancel := context.WithTimeout(ctx, 15*time.Minute)
-
-	// Initialize dot updater
-	updateText := dotUpdater()
-
-	// Channel to receive the result from RPC call
-	resultErrCh := make(chan error, 1)
-	resultOkCh := make(chan struct{}, 1)
-
-	// Start RPC call in background
-	go func() {
-		conn, err := s.getSrvClient(defaultFailTimeout)
-		if err != nil {
-			log.Infof("backend not reachable, upgrade in progress: %v", err)
-			close(resultOkCh)
-			return
-		}
-
-		resp, err := conn.GetInstallerResult(updateWindowCtx, &proto.InstallerResultRequest{})
-		if err != nil {
-			log.Infof("backend stopped responding, upgrade in progress: %v", err)
-			close(resultOkCh)
-			return
-		}
-
-		if !resp.Success {
-			resultErrCh <- mapInstallError(resp.ErrorMsg)
-			return
-		}
-
-		// Success
-		close(resultOkCh)
-	}()
-
-	// Update UI with dots and wait for result
-	go func() {
-		ticker := time.NewTicker(time.Second)
-		defer ticker.Stop()
-		defer cancel()
-
-		// allow closing update window after 10 sec
-		timerResetCloseInterceptor := time.NewTimer(10 * time.Second)
-		defer timerResetCloseInterceptor.Stop()
-
-		for {
-			select {
-			case <-updateWindowCtx.Done():
-				s.showInstallerResult(statusLabel, updateWindowCtx.Err())
-				return
-			case err := <-resultErrCh:
-				s.showInstallerResult(statusLabel, err)
-				return
-			case <-resultOkCh:
-				log.Info("backend exited, upgrade in progress, closing all UI")
-				killParentUIProcess()
-				s.app.Quit()
-				return
-			case <-ticker.C:
-				statusLabel.SetText(updateText())
-			case <-timerResetCloseInterceptor.C:
-				s.wUpdateProgress.SetCloseIntercept(nil)
-			}
-		}
-	}()
-}
-
-func (s *serviceClient) showInstallerResult(statusLabel *widget.Label, err error) {
-	s.wUpdateProgress.SetCloseIntercept(nil)
-	switch {
-	case errors.Is(err, context.DeadlineExceeded):
-		log.Warn("update watcher timed out")
-		statusLabel.SetText("Update timed out. Please try again.")
-	case errors.Is(err, context.Canceled):
-		log.Info("update watcher canceled")
-		statusLabel.SetText("Update canceled.")
-	case err != nil:
-		log.Errorf("update failed: %v", err)
-		statusLabel.SetText("Update failed: " + err.Error())
-	default:
-		s.wUpdateProgress.Close()
-	}
-}
-
-// dotUpdater returns a closure that cycles through dots for a loading animation.
-func dotUpdater() func() string {
-	dotCount := 0
-	return func() string {
-		dotCount = (dotCount + 1) % 4
-		return fmt.Sprintf("%s%s", "Updating", strings.Repeat(".", dotCount))
-	}
-}
-
-func mapInstallError(msg string) error {
-	msg = strings.ToLower(strings.TrimSpace(msg))
-
-	switch {
-	case strings.Contains(msg, "deadline exceeded"), strings.Contains(msg, "timeout"):
-		return context.DeadlineExceeded
-	case strings.Contains(msg, "canceled"), strings.Contains(msg, "cancelled"):
-		return context.Canceled
-	case msg == "":
-		return errors.New("unknown update error")
-	default:
-		return errors.New(msg)
-	}
-}
diff --git a/client/ui/update_notwindows.go b/client/ui/update_notwindows.go
deleted file mode 100644
index 5766f18f7..000000000
--- a/client/ui/update_notwindows.go
+++ /dev/null
@@ -1,7 +0,0 @@
-//go:build !windows && !(linux && 386)
-
-package main
-
-func killParentUIProcess() {
-	// No-op on non-Windows platforms
-}
diff --git a/client/ui/update_windows.go b/client/ui/update_windows.go
deleted file mode 100644
index 1b03936f9..000000000
--- a/client/ui/update_windows.go
+++ /dev/null
@@ -1,44 +0,0 @@
-//go:build windows
-
-package main
-
-import (
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/sys/windows"
-
-	nbprocess "github.com/netbirdio/netbird/client/ui/process"
-)
-
-// killParentUIProcess finds and kills the parent systray UI process on Windows.
-// This is a workaround in case the MSI installer fails to properly terminate the UI process.
-// The installer should handle this via util:CloseApplication with TerminateProcess, but this
-// provides an additional safety mechanism to ensure the UI is closed before the upgrade proceeds.
-func killParentUIProcess() {
-	pid, running, err := nbprocess.IsAnotherProcessRunning()
-	if err != nil {
-		log.Warnf("failed to check for parent UI process: %v", err)
-		return
-	}
-
-	if !running {
-		log.Debug("no parent UI process found to kill")
-		return
-	}
-
-	log.Infof("killing parent UI process (PID: %d)", pid)
-
-	// Open the process with terminate rights
-	handle, err := windows.OpenProcess(windows.PROCESS_TERMINATE, false, uint32(pid))
-	if err != nil {
-		log.Warnf("failed to open parent process %d: %v", pid, err)
-		return
-	}
-	defer func() {
-		_ = windows.CloseHandle(handle)
-	}()
-
-	// Terminate the process with exit code 0
-	if err := windows.TerminateProcess(handle, 0); err != nil {
-		log.Warnf("failed to terminate parent process %d: %v", pid, err)
-	}
-}
diff --git a/client/ui/updater/state.go b/client/ui/updater/state.go
new file mode 100644
index 000000000..606f8b401
--- /dev/null
+++ b/client/ui/updater/state.go
@@ -0,0 +1,97 @@
+//go:build !android && !ios && !freebsd && !js
+
+// Package updater holds the auto-update domain: the typed State, the
+// daemon-SystemEvent metadata schema, and the Holder that caches the latest
+// state and broadcasts changes. No Wails dependency.
+package updater
+
+import (
+	"sync"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// EventStateChanged carries the full State snapshot as payload.
+const EventStateChanged = "netbird:update:state"
+
+// State is the typed snapshot of the daemon's update situation. Installing is
+// driven only by the daemon's progress_window:show event; a UI-side
+// Update.Trigger() does not flip it.
+type State struct {
+	Available  bool   `json:"available"`
+	Version    string `json:"version"`
+	Enforced   bool   `json:"enforced"`
+	Installing bool   `json:"installing"`
+}
+
+// Emitter is the broadcast dependency Holder needs; the Wails app.Event
+// processor satisfies it.
+type Emitter interface {
+	Emit(name string, data ...any) bool
+}
+
+// Holder caches the latest update State and broadcasts changes.
+type Holder struct {
+	emitter Emitter
+
+	mu    sync.Mutex
+	state State
+}
+
+// NewHolder constructs an empty-state Holder. A nil emitter skips the broadcast.
+func NewHolder(emitter Emitter) *Holder {
+	return &Holder{emitter: emitter}
+}
+
+// Get returns a copy of the cached State.
+func (h *Holder) Get() State {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	return h.state
+}
+
+// OnSystemEvent folds update-related metadata into the cached state, emitting
+// EventStateChanged only on an actual change so repeated daemon snapshots
+// don't produce redundant pushes.
+func (h *Holder) OnSystemEvent(ev *proto.SystemEvent) {
+	md := ev.GetMetadata()
+	if len(md) == 0 {
+		return
+	}
+
+	h.mu.Lock()
+	changed := false
+	if v, ok := md["new_version_available"]; ok {
+		_, enforced := md["enforced"]
+		if !h.state.Available || h.state.Version != v || h.state.Enforced != enforced {
+			h.state.Available = true
+			h.state.Version = v
+			h.state.Enforced = enforced
+			changed = true
+		}
+	}
+	if md["progress_window"] == "show" {
+		if !h.state.Installing {
+			h.state.Installing = true
+			changed = true
+		}
+		if v, ok := md["version"]; ok && v != "" && h.state.Version != v {
+			h.state.Version = v
+			h.state.Available = true
+			changed = true
+		}
+	}
+	snap := h.state
+	h.mu.Unlock()
+
+	if !changed {
+		return
+	}
+	log.Infof("update state: available=%v version=%q enforced=%v installing=%v",
+		snap.Available, snap.Version, snap.Enforced, snap.Installing)
+	if h.emitter != nil {
+		h.emitter.Emit(EventStateChanged, snap)
+	}
+}
diff --git a/client/ui/xembed_host_linux.go b/client/ui/xembed_host_linux.go
new file mode 100644
index 000000000..ba7a5d07c
--- /dev/null
+++ b/client/ui/xembed_host_linux.go
@@ -0,0 +1,443 @@
+//go:build linux && !(linux && 386)
+
+package main
+
+/*
+#cgo pkg-config: x11 gtk4 gtk4-x11 cairo cairo-xlib
+#cgo LDFLAGS: -lX11
+#include "xembed_tray_linux.h"
+#include <X11/Xlib.h>
+#include <stdlib.h>
+#include <string.h>
+*/
+import "C"
+
+import (
+	"errors"
+	"sync"
+	"time"
+	"unsafe"
+
+	"github.com/godbus/dbus/v5"
+	log "github.com/sirupsen/logrus"
+)
+
+// activeMenuHost holds the popup owner; C callbacks cannot carry Go pointers.
+var (
+	activeMenuHost   *xembedHost
+	activeMenuHostMu sync.Mutex
+)
+
+// menuItemInfo is a dbusMenuLayout entry flattened for the C popup builder.
+type menuItemInfo struct {
+	id          int32
+	label       string
+	enabled     bool
+	isCheck     bool
+	checked     bool
+	isSeparator bool
+	children    []menuItemInfo
+}
+
+// dbusMenuLayout mirrors the (ia{sv}av) result of com.canonical.dbusmenu.GetLayout.
+// Each Children variant wraps a nested dbusMenuLayout, decoded in flattenMenu.
+type dbusMenuLayout struct {
+	ID         int32
+	Properties map[string]dbus.Variant
+	Children   []dbus.Variant
+}
+
+// xembedHost manages one XEmbed tray icon for an SNI item.
+type xembedHost struct {
+	conn    *dbus.Conn
+	busName string
+	objPath dbus.ObjectPath
+
+	dpy      *C.Display
+	trayMgr  C.Window
+	iconWin  C.Window
+	iconSize int
+
+	mu       sync.Mutex
+	iconData []byte
+	iconW    int
+	iconH    int
+
+	stopCh chan struct{}
+}
+
+// newXembedHost creates an XEmbed tray icon for the given SNI item.
+// Errors when no XEmbed tray manager is available, so callers can fall back.
+func newXembedHost(conn *dbus.Conn, busName string, objPath dbus.ObjectPath) (*xembedHost, error) {
+	dpy := C.XOpenDisplay(nil)
+	if dpy == nil {
+		return nil, errors.New("cannot open X display")
+	}
+	C.xembed_install_error_handlers()
+
+	screen := C.xembed_default_screen(dpy)
+	trayMgr := C.xembed_find_tray(dpy, screen)
+	if trayMgr == 0 {
+		C.XCloseDisplay(dpy)
+		return nil, errors.New("no XEmbed system tray found")
+	}
+
+	iconSize := int(C.xembed_get_icon_size(dpy, trayMgr))
+	if iconSize <= 0 {
+		iconSize = 24 // fallback
+	}
+
+	iconWin := C.xembed_create_icon(dpy, screen, C.int(iconSize), trayMgr)
+	if iconWin == 0 {
+		C.XCloseDisplay(dpy)
+		return nil, errors.New("failed to create icon window")
+	}
+
+	if C.xembed_dock(dpy, trayMgr, iconWin) != 0 {
+		C.xembed_destroy_icon(dpy, iconWin)
+		C.XCloseDisplay(dpy)
+		return nil, errors.New("failed to dock icon")
+	}
+
+	h := &xembedHost{
+		conn:     conn,
+		busName:  busName,
+		objPath:  objPath,
+		dpy:      dpy,
+		trayMgr:  trayMgr,
+		iconWin:  iconWin,
+		iconSize: iconSize,
+		stopCh:   make(chan struct{}),
+	}
+
+	h.fetchAndDrawIcon()
+	return h, nil
+}
+
+func (h *xembedHost) fetchAndDrawIcon() {
+	obj := h.conn.Object(h.busName, h.objPath)
+	variant, err := obj.GetProperty("org.kde.StatusNotifierItem.IconPixmap")
+	if err != nil {
+		log.Debugf("xembed: failed to get IconPixmap: %v", err)
+		return
+	}
+
+	// IconPixmap has D-Bus signature a(iiay).
+	type px struct {
+		W   int32
+		H   int32
+		Pix []byte
+	}
+
+	var icons []px
+	if err := variant.Store(&icons); err != nil {
+		log.Debugf("xembed: failed to decode IconPixmap: %v", err)
+		return
+	}
+
+	if len(icons) == 0 {
+		log.Debug("xembed: IconPixmap is empty")
+		return
+	}
+
+	icon := icons[0]
+	if icon.W <= 0 || icon.H <= 0 || len(icon.Pix) < int(icon.W*icon.H*4) {
+		log.Debug("xembed: invalid IconPixmap data")
+		return
+	}
+
+	h.mu.Lock()
+	h.iconData = icon.Pix
+	h.iconW = int(icon.W)
+	h.iconH = int(icon.H)
+	h.mu.Unlock()
+
+	h.drawIcon()
+}
+
+func (h *xembedHost) drawIcon() {
+	h.mu.Lock()
+	data := h.iconData
+	w := h.iconW
+	ht := h.iconH
+	h.mu.Unlock()
+
+	if data == nil || w <= 0 || ht <= 0 {
+		return
+	}
+
+	cData := C.CBytes(data)
+	defer C.free(cData)
+
+	C.xembed_draw_icon(h.dpy, h.iconWin, C.int(h.iconSize),
+		(*C.uchar)(cData), C.int(w), C.int(ht))
+}
+
+// run is the event loop: polls X11 events and D-Bus NewIcon signals until stopped.
+func (h *xembedHost) run() {
+	matchRule := "type='signal',interface='org.kde.StatusNotifierItem',member='NewIcon',sender='" + h.busName + "'"
+	if err := h.conn.BusObject().Call("org.freedesktop.DBus.AddMatch", 0, matchRule).Err; err != nil {
+		log.Debugf("xembed: failed to add signal match: %v", err)
+	}
+
+	sigCh := make(chan *dbus.Signal, 16)
+	h.conn.Signal(sigCh)
+	defer h.conn.RemoveSignal(sigCh)
+
+	ticker := time.NewTicker(50 * time.Millisecond)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-h.stopCh:
+			return
+
+		case sig := <-sigCh:
+			if sig == nil {
+				continue
+			}
+			if sig.Name == "org.kde.StatusNotifierItem.NewIcon" {
+				h.fetchAndDrawIcon()
+			}
+
+		case <-ticker.C:
+			var outX, outY C.int
+			result := C.xembed_poll_event(h.dpy, h.iconWin, &outX, &outY)
+
+			switch result {
+			case 1: // left click
+				go h.activate(int32(outX), int32(outY))
+			case 2: // right click
+				go h.contextMenu(int32(outX), int32(outY))
+			case 3: // expose
+				h.drawIcon()
+			case 4: // configure (resize)
+				newSize := int(outX)
+				if newSize > 0 && newSize != h.iconSize {
+					h.iconSize = newSize
+					h.drawIcon()
+				}
+			case -1: // tray died
+				log.Info("xembed: tray manager destroyed, cleaning up")
+				return
+			}
+		}
+	}
+}
+
+func (h *xembedHost) activate(x, y int32) {
+	obj := h.conn.Object(h.busName, h.objPath)
+	if err := obj.Call("org.kde.StatusNotifierItem.Activate", 0, x, y).Err; err != nil {
+		log.Debugf("xembed: Activate call failed: %v", err)
+	}
+}
+
+func (h *xembedHost) contextMenu(x, y int32) {
+	menuPath := dbus.ObjectPath("/StatusNotifierMenu")
+
+	menuObj := h.conn.Object(h.busName, menuPath)
+	var revision uint32
+	var layout dbusMenuLayout
+	err := menuObj.Call("com.canonical.dbusmenu.GetLayout", 0,
+		int32(0),   // parentId (root)
+		int32(-1),  // recursionDepth (all)
+		[]string{}, // propertyNames (all)
+	).Store(&revision, &layout)
+	if err != nil {
+		log.Debugf("xembed: GetLayout failed: %v", err)
+		return
+	}
+
+	items := h.flattenMenu(layout)
+	log.Debugf("xembed: menu has %d items (revision %d)", len(items), revision)
+	if len(items) == 0 {
+		return
+	}
+
+	var allocs []unsafe.Pointer
+	cItems := buildCItems(items, &allocs)
+	defer func() {
+		for _, p := range allocs {
+			C.free(p)
+		}
+	}()
+
+	// C callback reaches us through this global.
+	activeMenuHostMu.Lock()
+	activeMenuHost = h
+	activeMenuHostMu.Unlock()
+
+	C.xembed_show_popup_menu(cItems, C.int(len(items)),
+		nil, C.int(x), C.int(y))
+}
+
+func (h *xembedHost) flattenMenu(layout dbusMenuLayout) []menuItemInfo {
+	var items []menuItemInfo
+
+	for _, childVar := range layout.Children {
+		var child dbusMenuLayout
+		if err := dbus.Store([]interface{}{childVar.Value()}, &child); err != nil {
+			continue
+		}
+		if mi, ok := h.menuItemFromLayout(child); ok {
+			items = append(items, mi)
+		}
+	}
+
+	return items
+}
+
+// menuItemFromLayout decodes one dbusmenu child; ok is false for hidden items (drop them).
+func (h *xembedHost) menuItemFromLayout(child dbusMenuLayout) (menuItemInfo, bool) {
+	mi := menuItemInfo{id: child.ID, enabled: true}
+
+	if propString(child.Properties, "type") == "separator" {
+		mi.isSeparator = true
+		return mi, true
+	}
+
+	if vis, ok := propBool(child.Properties, "visible"); ok && !vis {
+		return menuItemInfo{}, false
+	}
+
+	mi.label = propString(child.Properties, "label")
+	if en, ok := propBool(child.Properties, "enabled"); ok {
+		mi.enabled = en
+	}
+	if propString(child.Properties, "toggle-type") == "checkmark" {
+		mi.isCheck = true
+	}
+	if n, ok := propInt32(child.Properties, "toggle-state"); ok && n == 1 {
+		mi.checked = true
+	}
+
+	// children are already present from the recursionDepth=-1 GetLayout.
+	if propString(child.Properties, "children-display") == "submenu" {
+		mi.children = h.flattenMenu(child)
+	}
+
+	return mi, true
+}
+
+func (h *xembedHost) sendMenuEvent(id int32) {
+	menuPath := dbus.ObjectPath("/StatusNotifierMenu")
+	menuObj := h.conn.Object(h.busName, menuPath)
+	data := dbus.MakeVariant("")
+	err := menuObj.Call("com.canonical.dbusmenu.Event", 0,
+		id, "clicked", data, uint32(0)).Err
+	if err != nil {
+		log.Debugf("xembed: menu Event call failed: %v", err)
+	}
+}
+
+func (h *xembedHost) stop() {
+	select {
+	case <-h.stopCh:
+		return
+	default:
+		close(h.stopCh)
+	}
+
+	C.xembed_destroy_icon(h.dpy, h.iconWin)
+	C.XCloseDisplay(h.dpy)
+}
+
+// buildCItems builds a C-allocated xembed_menu_item tree. Every malloc is
+// appended to *allocs for the caller to free once the C side has deep-copied it.
+func buildCItems(items []menuItemInfo, allocs *[]unsafe.Pointer) *C.xembed_menu_item {
+	if len(items) == 0 {
+		return nil
+	}
+	size := C.size_t(len(items)) * C.size_t(unsafe.Sizeof(C.xembed_menu_item{}))
+	arr := C.malloc(size)
+	*allocs = append(*allocs, arr)
+	C.memset(arr, 0, size)
+
+	slice := (*[1 << 16]C.xembed_menu_item)(arr)[:len(items):len(items)]
+	for i, mi := range items {
+		slice[i].id = C.int(mi.id)
+		slice[i].enabled = boolToInt(mi.enabled)
+		slice[i].is_check = boolToInt(mi.isCheck)
+		slice[i].checked = boolToInt(mi.checked)
+		slice[i].is_separator = boolToInt(mi.isSeparator)
+		if mi.label != "" {
+			cstr := C.CString(mi.label)
+			*allocs = append(*allocs, unsafe.Pointer(cstr))
+			slice[i].label = cstr
+		}
+		if len(mi.children) > 0 {
+			slice[i].children = buildCItems(mi.children, allocs)
+			slice[i].child_count = C.int(len(mi.children))
+		}
+	}
+
+	return (*C.xembed_menu_item)(arr)
+}
+
+// xembedTrayAvailable reports whether an XEmbed tray manager (_NET_SYSTEM_TRAY_S0)
+// owns the default screen. Side-effect-free probe. Gates the in-process
+// StatusNotifierWatcher: when a real SNI host already owns the tray (e.g. Waybar
+// on Wayland) we must not claim org.kde.StatusNotifierWatcher and shadow it.
+// Returns false when there is no X display (pure Wayland).
+func xembedTrayAvailable() bool {
+	dpy := C.XOpenDisplay(nil)
+	if dpy == nil {
+		return false
+	}
+	C.xembed_install_error_handlers()
+	defer C.XCloseDisplay(dpy)
+	screen := C.xembed_default_screen(dpy)
+	return C.xembed_find_tray(dpy, screen) != 0
+}
+
+// goMenuItemClicked is the C callback fired from the GTK main thread on popup
+// activation. The host is looked up via activeMenuHost since C callbacks can't
+// carry Go pointers; //export requires this to live in package main.
+//
+//export goMenuItemClicked
+func goMenuItemClicked(id C.int) {
+	activeMenuHostMu.Lock()
+	h := activeMenuHost
+	activeMenuHostMu.Unlock()
+
+	if h != nil {
+		go h.sendMenuEvent(int32(id))
+	}
+}
+
+func boolToInt(b bool) C.int {
+	if b {
+		return 1
+	}
+	return 0
+}
+
+// propString returns the property's string value, or "" if absent or not a string.
+func propString(props map[string]dbus.Variant, key string) string {
+	if v, ok := props[key]; ok {
+		if s, ok := v.Value().(string); ok {
+			return s
+		}
+	}
+	return ""
+}
+
+// propBool returns the property's bool value; ok is false if absent or not a bool.
+func propBool(props map[string]dbus.Variant, key string) (value, ok bool) {
+	if v, present := props[key]; present {
+		if b, isBool := v.Value().(bool); isBool {
+			return b, true
+		}
+	}
+	return false, false
+}
+
+// propInt32 returns the property's int32 value; ok is false if absent or not an int32.
+func propInt32(props map[string]dbus.Variant, key string) (value int32, ok bool) {
+	if v, present := props[key]; present {
+		if n, isInt := v.Value().(int32); isInt {
+			return n, true
+		}
+	}
+	return 0, false
+}
diff --git a/client/ui/xembed_tray_linux.c b/client/ui/xembed_tray_linux.c
new file mode 100644
index 000000000..07ec74bb2
--- /dev/null
+++ b/client/ui/xembed_tray_linux.c
@@ -0,0 +1,708 @@
+#include "xembed_tray_linux.h"
+
+#include <X11/Xatom.h>
+#include <X11/Xutil.h>
+#include <cairo/cairo-xlib.h>
+#include <cairo/cairo.h>
+#include <gtk/gtk.h>
+#include <gdk/x11/gdkx.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdio.h>
+
+#define SYSTEM_TRAY_REQUEST_DOCK 0
+#define XEMBED_MAPPED            (1 << 0)
+
+/* Xlib's default protocol-error handler calls exit() on any async X error,
+   killing the whole UI process. Handlers are process-global (not
+   per-Display), so a single install covers our raw tray Display and GDK's.
+   Tray work is full of races the X server reports asynchronously — the tray
+   manager window dying between xembed_find_tray and xembed_dock (BadWindow
+   on XSendEvent), or x11_move_window touching a popup the WM already
+   destroyed — and the default handler would take us down for any of them.
+   Returning 0 here makes the error a logged no-op instead. */
+static int xembed_x_error_handler(Display *dpy, XErrorEvent *ev) {
+    char buf[256];
+    XGetErrorText(dpy, ev->error_code, buf, sizeof(buf));
+    fprintf(stderr,
+            "xembed: X error (ignored): %s (code=%d, request=%d.%d, resource=0x%lx)\n",
+            buf, ev->error_code, ev->request_code, ev->minor_code,
+            ev->resourceid);
+    return 0;
+}
+
+/* The I/O error handler fires when the X connection itself drops (server
+   gone, socket closed). Xlib treats this as fatal and exits even if we
+   return, so this can't keep the process alive — it only logs a clearer
+   line than Xlib's terse default before the unavoidable exit. */
+static int xembed_x_io_error_handler(Display *dpy) {
+    (void)dpy;
+    fprintf(stderr, "xembed: X I/O error (connection lost)\n");
+    return 0;
+}
+
+/* Install the process-global handlers. Idempotent and cheap, so callers may
+   invoke it after every XOpenDisplay without tracking prior installs. */
+void xembed_install_error_handlers(void) {
+    XSetErrorHandler(xembed_x_error_handler);
+    XSetIOErrorHandler(xembed_x_io_error_handler);
+}
+
+Window xembed_find_tray(Display *dpy, int screen) {
+    char atom_name[64];
+    snprintf(atom_name, sizeof(atom_name), "_NET_SYSTEM_TRAY_S%d", screen);
+    Atom sel = XInternAtom(dpy, atom_name, False);
+    return XGetSelectionOwner(dpy, sel);
+}
+
+int xembed_get_icon_size(Display *dpy, Window tray_mgr) {
+    Atom atom = XInternAtom(dpy, "_NET_SYSTEM_TRAY_ICON_SIZE", False);
+    Atom actual_type;
+    int actual_format;
+    unsigned long nitems, bytes_after;
+    unsigned char *prop = NULL;
+    int size = 0;
+
+    if (XGetWindowProperty(dpy, tray_mgr, atom, 0, 1, False,
+                           XA_CARDINAL, &actual_type, &actual_format,
+                           &nitems, &bytes_after, &prop) == Success) {
+        if (prop && nitems == 1 && actual_format == 32) {
+            size = (int)(*(unsigned long *)prop);
+        }
+        if (prop)
+            XFree(prop);
+    }
+    return size;
+}
+
+Window xembed_create_icon(Display *dpy, int screen, int size,
+                           Window tray_mgr) {
+    (void)tray_mgr;  /* unused; kept in signature for caller symmetry */
+    Window root = RootWindow(dpy, screen);
+
+    /* Inherit visual & depth from the parent (tray manager / root) so
+       ParentRelative background works on every tray. Many minimal
+       toolbars (Fluxbox slit, OpenBox, etc.) only offer a 24-bit
+       default visual and do not composite alpha; ParentRelative makes
+       the X server texture this window's background from the parent,
+       so transparent pixels in the icon show the toolbar beneath
+       instead of solid black. ARGB-aware trays still work because the
+       cairo OVER blend in xembed_draw_icon honours per-pixel alpha
+       against whatever base the X server painted underneath. */
+    XSetWindowAttributes attrs;
+    memset(&attrs, 0, sizeof(attrs));
+    attrs.event_mask = ButtonPressMask | StructureNotifyMask | ExposureMask;
+    attrs.background_pixmap = ParentRelative;
+    unsigned long mask = CWEventMask | CWBackPixmap;
+
+    Window win = XCreateWindow(
+        dpy, root,
+        0, 0, size, size,
+        0,                          /* border width */
+        CopyFromParent,             /* depth */
+        InputOutput,
+        CopyFromParent,             /* visual */
+        mask,
+        &attrs
+    );
+
+    /* Set _XEMBED_INFO: version=0, flags=XEMBED_MAPPED */
+    Atom xembed_info = XInternAtom(dpy, "_XEMBED_INFO", False);
+    unsigned long info[2] = { 0, XEMBED_MAPPED };
+    XChangeProperty(dpy, win, xembed_info, xembed_info,
+                    32, PropModeReplace, (unsigned char *)info, 2);
+
+    return win;
+}
+
+int xembed_dock(Display *dpy, Window tray_mgr, Window icon_win) {
+    Atom opcode = XInternAtom(dpy, "_NET_SYSTEM_TRAY_OPCODE", False);
+
+    XClientMessageEvent ev;
+    memset(&ev, 0, sizeof(ev));
+    ev.type         = ClientMessage;
+    ev.window       = tray_mgr;
+    ev.message_type = opcode;
+    ev.format       = 32;
+    ev.data.l[0]    = CurrentTime;
+    ev.data.l[1]    = SYSTEM_TRAY_REQUEST_DOCK;
+    ev.data.l[2]    = (long)icon_win;
+
+    XSendEvent(dpy, tray_mgr, False, NoEventMask, (XEvent *)&ev);
+    XFlush(dpy);
+    return 0;
+}
+
+void xembed_draw_icon(Display *dpy, Window icon_win, int win_size,
+                      const unsigned char *data, int img_w, int img_h) {
+    if (!data || img_w <= 0 || img_h <= 0 || win_size <= 0)
+        return;
+
+    /* Query the window's actual visual and depth so cairo composites
+       through the matching ARGB pipeline. */
+    XWindowAttributes wa;
+    if (!XGetWindowAttributes(dpy, icon_win, &wa))
+        return;
+
+    /* Build a CAIRO_FORMAT_ARGB32 source surface from the SNI IconPixmap
+       bytes. SNI ships the pixels as [A,R,G,B,...] in network byte
+       order; cairo's ARGB32 stores native uint32 with B in the lowest
+       byte on little-endian hosts. Repack into native order with
+       pre-multiplied alpha so cairo can composite without tonemapping. */
+    int stride = cairo_format_stride_for_width(CAIRO_FORMAT_ARGB32, img_w);
+    unsigned char *buf = (unsigned char *)calloc(stride * img_h, 1);
+    if (!buf)
+        return;
+
+    for (int y = 0; y < img_h; y++) {
+        unsigned int *row = (unsigned int *)(buf + y * stride);
+        for (int x = 0; x < img_w; x++) {
+            int idx = (y * img_w + x) * 4;
+            unsigned int a = data[idx + 0];
+            unsigned int r = data[idx + 1];
+            unsigned int g = data[idx + 2];
+            unsigned int b = data[idx + 3];
+
+            if (a == 0) {
+                row[x] = 0;
+            } else if (a == 255) {
+                row[x] = (a << 24) | (r << 16) | (g << 8) | b;
+            } else {
+                unsigned int pr = r * a / 255;
+                unsigned int pg = g * a / 255;
+                unsigned int pb = b * a / 255;
+                row[x] = (a << 24) | (pr << 16) | (pg << 8) | pb;
+            }
+        }
+    }
+
+    cairo_surface_t *src = cairo_image_surface_create_for_data(
+        buf, CAIRO_FORMAT_ARGB32, img_w, img_h, stride);
+    if (cairo_surface_status(src) != CAIRO_STATUS_SUCCESS) {
+        cairo_surface_destroy(src);
+        free(buf);
+        return;
+    }
+
+    /* Wrap the X11 window in a cairo XLib surface using its real visual. */
+    cairo_surface_t *dst = cairo_xlib_surface_create(
+        dpy, icon_win, wa.visual, win_size, win_size);
+    if (cairo_surface_status(dst) != CAIRO_STATUS_SUCCESS) {
+        cairo_surface_destroy(dst);
+        cairo_surface_destroy(src);
+        free(buf);
+        return;
+    }
+
+    /* Repaint the ParentRelative background first — without this the
+       window keeps the previously-drawn icon underneath when an icon
+       update arrives, and cairo's OVER blend would composite the new
+       icon on top of the stale one. XClearWindow forces the X server
+       to retexture from the parent (tray toolbar), giving us a clean
+       opaque base. */
+    XClearWindow(dpy, icon_win);
+
+    cairo_t *cr = cairo_create(dst);
+
+    /* Scale the source onto the window with alpha compositing (default
+       OPERATOR_OVER). Transparent pixels keep the toolbar's pixels
+       visible underneath. */
+    double sx = (double)win_size / img_w;
+    double sy = (double)win_size / img_h;
+    cairo_scale(cr, sx, sy);
+    cairo_set_source_surface(cr, src, 0, 0);
+    cairo_paint(cr);
+
+    cairo_destroy(cr);
+    cairo_surface_destroy(dst);
+    cairo_surface_destroy(src);
+    free(buf);
+    XFlush(dpy);
+}
+
+void xembed_destroy_icon(Display *dpy, Window icon_win) {
+    if (icon_win)
+        XDestroyWindow(dpy, icon_win);
+    XFlush(dpy);
+}
+
+int xembed_poll_event(Display *dpy, Window icon_win,
+                      int *out_x, int *out_y) {
+    *out_x = 0;
+    *out_y = 0;
+
+    while (XPending(dpy) > 0) {
+        XEvent ev;
+        XNextEvent(dpy, &ev);
+
+        switch (ev.type) {
+        case ButtonPress:
+            if (ev.xbutton.window == icon_win) {
+                *out_x = ev.xbutton.x_root;
+                *out_y = ev.xbutton.y_root;
+                if (ev.xbutton.button == Button1)
+                    return 1;
+                if (ev.xbutton.button == Button3)
+                    return 2;
+            }
+            break;
+
+        case Expose:
+            if (ev.xexpose.window == icon_win && ev.xexpose.count == 0)
+                return 3;
+            break;
+
+        case DestroyNotify:
+            if (ev.xdestroywindow.window == icon_win)
+                return -1;
+            break;
+
+        case ConfigureNotify:
+            if (ev.xconfigure.window == icon_win) {
+                *out_x = ev.xconfigure.width;
+                *out_y = ev.xconfigure.height;
+                return 4;
+            }
+            break;
+
+        case ReparentNotify:
+            /* Tray manager reparented us — this is expected after docking. */
+            break;
+
+        default:
+            break;
+        }
+    }
+
+    return 0;
+}
+
+/* --- GTK4 popup window menu support --- */
+
+/* Implemented in Go via //export */
+extern void goMenuItemClicked(int id);
+
+/* The top-level popup window, reused across invocations. Submenu
+   popups are tracked in a separate list so they all close when the
+   top-level closes. */
+static GtkWidget *popup_win = NULL;
+static GList     *submenu_popups = NULL;  /* list of GtkWidget* */
+
+typedef struct {
+    xembed_menu_item  *items;
+    int                count;
+    int                x, y;
+} popup_data;
+
+/* Deep-free a heap-owned xembed_menu_item array (label + children). */
+static void free_items(xembed_menu_item *items, int count) {
+    if (!items) return;
+    for (int i = 0; i < count; i++) {
+        free((void *)items[i].label);
+        free_items(items[i].children, items[i].child_count);
+    }
+    free(items);
+}
+
+static void free_popup_data(popup_data *pd) {
+    if (!pd) return;
+    free_items(pd->items, pd->count);
+    free(pd);
+}
+
+
+/* Close every popup window — top-level plus any open submenus.
+   Called when the user clicks an actionable item or focus leaves the
+   menu tree. */
+static void close_all_popups(void) {
+    for (GList *l = submenu_popups; l; l = l->next) {
+        gtk_window_destroy(GTK_WINDOW(l->data));
+    }
+    g_list_free(submenu_popups);
+    submenu_popups = NULL;
+
+    if (popup_win) {
+        gtk_widget_set_visible(popup_win, FALSE);
+    }
+}
+
+static void on_button_clicked(GtkButton *btn, gpointer user_data) {
+    (void)btn;
+    int id = GPOINTER_TO_INT(user_data);
+    close_all_popups();
+    goMenuItemClicked(id);
+}
+
+static void on_check_toggled(GtkCheckButton *btn, gpointer user_data) {
+    (void)btn;
+    int id = GPOINTER_TO_INT(user_data);
+    close_all_popups();
+    goMenuItemClicked(id);
+}
+
+/* The popup is a regular WM-managed window (not override-redirect),
+   so the WM hands keyboard focus to it on map. When focus moves
+   elsewhere — the user clicked somewhere else, switched apps, etc. —
+   the focus controller's "leave" signal fires and we tear down the
+   menu tree. Submenus open from inside the top-level popup, so we
+   defer the actual close to an idle callback: that gives the new
+   submenu a chance to take focus first, and we only close if none of
+   our windows still has it. */
+static gboolean any_popup_has_focus(void) {
+    if (popup_win && gtk_window_is_active(GTK_WINDOW(popup_win)))
+        return TRUE;
+    for (GList *l = submenu_popups; l; l = l->next) {
+        if (gtk_window_is_active(GTK_WINDOW(l->data)))
+            return TRUE;
+    }
+    return FALSE;
+}
+
+static gboolean focus_out_recheck(gpointer user_data) {
+    (void)user_data;
+    if (!any_popup_has_focus())
+        close_all_popups();
+    return G_SOURCE_REMOVE;
+}
+
+static void on_popup_focus_leave(GtkEventControllerFocus *ctrl,
+                                  gpointer user_data) {
+    (void)ctrl; (void)user_data;
+    g_idle_add(focus_out_recheck, NULL);
+}
+
+/* Attach a focus controller that fires close_all_popups on focus loss. */
+static void attach_outside_click_close(GtkWidget *win) {
+    GtkEventController *focus = gtk_event_controller_focus_new();
+    g_signal_connect(focus, "leave",
+                     G_CALLBACK(on_popup_focus_leave), NULL);
+    gtk_widget_add_controller(win, focus);
+}
+
+/* Move a GtkWindow at the X11 level. GTK4 removed gtk_window_move(); the
+   GdkSurface is mapped to a real X11 Window we can reposition with
+   XMoveWindow. Must be called after the window has been realized (i.e.
+   after gtk_widget_set_visible TRUE).
+
+   The popup is **not** override-redirect — the WM keeps managing it so
+   focus tracking still works (focus-out fires when the user clicks
+   elsewhere). We tag the window with a stack of EWMH hints that make
+   sane WMs (fluxbox, openbox, i3, kwin, mutter) render it like a
+   floating menu: above the tray panel, skipped from taskbar/pager,
+   no decorations. */
+static void x11_move_window(GtkWidget *win, int x, int y) {
+    GdkSurface *surface = gtk_native_get_surface(GTK_NATIVE(win));
+    if (!surface || !GDK_IS_X11_SURFACE(surface))
+        return;
+    Window xid = gdk_x11_surface_get_xid(surface);
+    GdkDisplay *display = gdk_surface_get_display(surface);
+    Display *xdpy = gdk_x11_display_get_xdisplay(GDK_X11_DISPLAY(display));
+
+    /* These calls poke a window the WM may have already destroyed (a popup
+       torn down between scheduling and this idle callback). On GDK's Display
+       use GDK's own error trap rather than our global handler — push/pop is
+       the spec-correct way to make untrapped BadWindow/BadMatch from these
+       raw Xlib calls non-fatal, independent of whichever process-global
+       handler happens to be installed. */
+    gdk_x11_display_error_trap_push(display);
+
+    /* _NET_WM_WINDOW_TYPE_POPUP_MENU: makes fluxbox / openbox / etc
+       render the window above panels and skip decorations. Must be
+       set before the window is mapped to be honoured by some WMs;
+       on already-mapped windows it works for most modern WMs but a
+       few need an unmap/map cycle to re-read the property. */
+    Atom wm_type        = XInternAtom(xdpy, "_NET_WM_WINDOW_TYPE", False);
+    Atom wm_type_popup  = XInternAtom(xdpy, "_NET_WM_WINDOW_TYPE_POPUP_MENU", False);
+    XChangeProperty(xdpy, xid, wm_type, XA_ATOM, 32,
+                    PropModeReplace, (unsigned char *)&wm_type_popup, 1);
+
+    /* _NET_WM_STATE_ABOVE + SKIP_TASKBAR + SKIP_PAGER. Bundled into
+       one property write. */
+    Atom wm_state       = XInternAtom(xdpy, "_NET_WM_STATE", False);
+    Atom state_above    = XInternAtom(xdpy, "_NET_WM_STATE_ABOVE", False);
+    Atom state_skip_tb  = XInternAtom(xdpy, "_NET_WM_STATE_SKIP_TASKBAR", False);
+    Atom state_skip_pg  = XInternAtom(xdpy, "_NET_WM_STATE_SKIP_PAGER", False);
+    Atom states[3] = { state_above, state_skip_tb, state_skip_pg };
+    XChangeProperty(xdpy, xid, wm_state, XA_ATOM, 32,
+                    PropModeReplace, (unsigned char *)states, 3);
+
+    XMoveWindow(xdpy, xid, x, y);
+    XRaiseWindow(xdpy, xid);
+
+    /* POPUP_MENU windows aren't given keyboard focus by most WMs (the
+       spec says they're "menus", which traditionally use a grab rather
+       than focus). Without focus GtkEventControllerFocus's leave signal
+       never fires, so we'd have no way to notice the user clicking
+       elsewhere. Ask the WM to activate us via _NET_ACTIVE_WINDOW
+       (source=2 means "pager / pseudo-user request" which most WMs
+       honour without timestamp checks). This is safer than calling
+       XSetInputFocus directly — that races the X server with the
+       not-yet-fully-mapped window and trips BadMatch. */
+    Atom net_active = XInternAtom(xdpy, "_NET_ACTIVE_WINDOW", False);
+    XClientMessageEvent ev;
+    memset(&ev, 0, sizeof(ev));
+    ev.type         = ClientMessage;
+    ev.window       = xid;
+    ev.message_type = net_active;
+    ev.format       = 32;
+    ev.data.l[0]    = 2;            /* source: pager */
+    ev.data.l[1]    = CurrentTime;
+    XSendEvent(xdpy, DefaultRootWindow(xdpy), False,
+               SubstructureRedirectMask | SubstructureNotifyMask,
+               (XEvent *)&ev);
+
+    XFlush(xdpy);
+    gdk_x11_display_error_trap_pop_ignored(display);
+}
+
+/* Forward declaration — submenu buttons need to schedule a child popup. */
+static GtkWidget *build_menu_box(xembed_menu_item *items, int count);
+
+typedef struct {
+    xembed_menu_item *items;
+    int               count;
+    GtkWidget        *anchor;  /* the submenu button — used to position the popup */
+} submenu_open_data;
+
+static void on_submenu_button_clicked(GtkButton *btn, gpointer user_data) {
+    submenu_open_data *sd = (submenu_open_data *)user_data;
+
+    GtkWidget *win = gtk_window_new();
+    gtk_window_set_decorated(GTK_WINDOW(win), FALSE);
+    gtk_window_set_resizable(GTK_WINDOW(win), FALSE);
+
+    attach_outside_click_close(win);
+
+    GtkWidget *vbox = build_menu_box(sd->items, sd->count);
+    gtk_window_set_child(GTK_WINDOW(win), vbox);
+
+    /* Need the anchor button's position in root coordinates. GTK4
+       removed gtk_widget_translate_coordinates(); compute via the
+       button's bounds within its native widget plus the native
+       surface's screen origin via X11. */
+    graphene_rect_t bounds;
+    if (!gtk_widget_compute_bounds(GTK_WIDGET(btn),
+                                   GTK_WIDGET(gtk_widget_get_native(GTK_WIDGET(btn))),
+                                   &bounds)) {
+        bounds.origin.x = 0;
+        bounds.origin.y = 0;
+        bounds.size.width = 0;
+        bounds.size.height = 0;
+    }
+    GdkSurface *anchor_surface =
+        gtk_native_get_surface(gtk_widget_get_native(GTK_WIDGET(btn)));
+    int ox = 0, oy = 0;
+    if (anchor_surface && GDK_IS_X11_SURFACE(anchor_surface)) {
+        Window axid = gdk_x11_surface_get_xid(anchor_surface);
+        GdkDisplay *display = gdk_surface_get_display(anchor_surface);
+        Display *xdpy = gdk_x11_display_get_xdisplay(GDK_X11_DISPLAY(display));
+        Window child;
+        /* Trap BadWindow in case the anchor's surface is torn down between
+           the click and this handler running. */
+        gdk_x11_display_error_trap_push(display);
+        XTranslateCoordinates(xdpy, axid, DefaultRootWindow(xdpy),
+                              0, 0, &ox, &oy, &child);
+        gdk_x11_display_error_trap_pop_ignored(display);
+    }
+    int ax = ox + (int)bounds.origin.x;
+    int ay = oy + (int)bounds.origin.y;
+
+    gtk_widget_set_visible(win, TRUE);
+
+    int sw, sh;
+    gtk_window_get_default_size(GTK_WINDOW(win), &sw, &sh);
+    if (sw <= 0 || sh <= 0) {
+        /* default_size returns -1,-1 if never explicitly set; fall back
+           to the measured preferred size. */
+        GtkRequisition req;
+        gtk_widget_get_preferred_size(win, NULL, &req);
+        sw = req.width;
+        sh = req.height;
+    }
+
+    /* The parent popup grows upward from the tray, so submenu items
+       sit closer to the bottom of the screen than to the top. Align
+       the submenu's BOTTOM to the anchor button's bottom: the popup
+       grows upward, level with the row that opened it. */
+    int final_x = ax + (int)bounds.size.width;
+    int final_y = ay + (int)bounds.size.height - sh;
+
+    /* Horizontal flip against the monitor under the anchor button. */
+    GdkDisplay *display = gtk_widget_get_display(win);
+    GListModel *monitors = gdk_display_get_monitors(display);
+    guint n = g_list_model_get_n_items(monitors);
+    for (guint i = 0; i < n; i++) {
+        GdkMonitor *m = (GdkMonitor *)g_list_model_get_item(monitors, i);
+        GdkRectangle geom;
+        gdk_monitor_get_geometry(m, &geom);
+        if (ax >= geom.x && ax < geom.x + geom.width &&
+            ay >= geom.y && ay < geom.y + geom.height) {
+            if (final_x + sw > geom.x + geom.width)
+                final_x = ax - sw;          /* flip to the left */
+            g_object_unref(m);
+            break;
+        }
+        g_object_unref(m);
+    }
+
+    x11_move_window(win, final_x, final_y);
+    gtk_window_present(GTK_WINDOW(win));
+
+    submenu_popups = g_list_prepend(submenu_popups, win);
+}
+
+/* Build a vbox of GtkWidgets for the supplied items. Used for both the
+   top-level popup and each submenu popup. The submenu_open_data attached
+   to submenu buttons is freed when the button is destroyed. */
+static void on_button_destroy_free_data(GtkWidget *widget, gpointer user_data) {
+    (void)widget;
+    free(user_data);
+}
+
+static GtkWidget *build_menu_box(xembed_menu_item *items, int count) {
+    GtkWidget *vbox = gtk_box_new(GTK_ORIENTATION_VERTICAL, 0);
+
+    for (int i = 0; i < count; i++) {
+        xembed_menu_item *mi = &items[i];
+
+        if (mi->is_separator) {
+            GtkWidget *sep = gtk_separator_new(GTK_ORIENTATION_HORIZONTAL);
+            gtk_widget_set_margin_top(sep, 2);
+            gtk_widget_set_margin_bottom(sep, 2);
+            gtk_box_append(GTK_BOX(vbox), sep);
+            continue;
+        }
+
+        if (mi->is_check) {
+            GtkWidget *chk = gtk_check_button_new_with_label(
+                mi->label ? mi->label : "");
+            gtk_check_button_set_active(GTK_CHECK_BUTTON(chk), mi->checked);
+            gtk_widget_set_sensitive(chk, mi->enabled);
+            g_signal_connect(chk, "toggled",
+                             G_CALLBACK(on_check_toggled),
+                             GINT_TO_POINTER(mi->id));
+            gtk_box_append(GTK_BOX(vbox), chk);
+            continue;
+        }
+
+        /* Plain button (leaf) or submenu opener. Show "Label  ▸" for
+           submenu folders so users see they're nested. */
+        const char *label_text = mi->label ? mi->label : "";
+        char *display_label = NULL;
+        if (mi->child_count > 0 && mi->children) {
+            /* Compose "label  ▸" (BLACK RIGHT-POINTING SMALL TRIANGLE). */
+            size_t n = strlen(label_text) + 8;  /* ascii + " ▸" + NUL */
+            display_label = (char *)malloc(n);
+            snprintf(display_label, n, "%s \xE2\x96\xB8", label_text);
+            label_text = display_label;
+        }
+
+        GtkWidget *btn = gtk_button_new_with_label(label_text);
+        gtk_widget_set_sensitive(btn, mi->enabled);
+        gtk_button_set_has_frame(GTK_BUTTON(btn), FALSE);
+        GtkWidget *lbl = gtk_button_get_child(GTK_BUTTON(btn));
+        if (GTK_IS_LABEL(lbl))
+            gtk_label_set_xalign(GTK_LABEL(lbl), 0.0);
+
+        free(display_label);
+
+        if (mi->child_count > 0 && mi->children) {
+            submenu_open_data *sd =
+                (submenu_open_data *)calloc(1, sizeof(submenu_open_data));
+            sd->items   = mi->children;
+            sd->count   = mi->child_count;
+            sd->anchor  = btn;
+            g_signal_connect(btn, "clicked",
+                             G_CALLBACK(on_submenu_button_clicked), sd);
+            g_signal_connect(btn, "destroy",
+                             G_CALLBACK(on_button_destroy_free_data), sd);
+        } else {
+            g_signal_connect(btn, "clicked",
+                             G_CALLBACK(on_button_clicked),
+                             GINT_TO_POINTER(mi->id));
+        }
+        gtk_box_append(GTK_BOX(vbox), btn);
+    }
+
+    return vbox;
+}
+
+static gboolean popup_menu_idle(gpointer user_data) {
+    popup_data *pd = (popup_data *)user_data;
+
+    /* Destroy old top-level (and orphan submenus) before rebuilding. */
+    close_all_popups();
+    if (popup_win) {
+        gtk_window_destroy(GTK_WINDOW(popup_win));
+        popup_win = NULL;
+    }
+
+    popup_win = gtk_window_new();
+    gtk_window_set_decorated(GTK_WINDOW(popup_win), FALSE);
+    gtk_window_set_resizable(GTK_WINDOW(popup_win), FALSE);
+
+    attach_outside_click_close(popup_win);
+
+    GtkWidget *vbox = build_menu_box(pd->items, pd->count);
+    gtk_window_set_child(GTK_WINDOW(popup_win), vbox);
+
+    gtk_widget_set_visible(popup_win, TRUE);
+
+    /* Position the window above the click point (menu grows upward
+       from tray). Use measured preferred size — default_size is -1
+       until set. */
+    GtkRequisition req;
+    gtk_widget_get_preferred_size(popup_win, NULL, &req);
+    int win_w = req.width;
+    int win_h = req.height;
+
+    int final_x = pd->x - win_w / 2;
+    int final_y = pd->y - win_h;
+    if (final_x < 0) final_x = 0;
+    if (final_y < 0) final_y = pd->y;  /* fallback: below click */
+    x11_move_window(popup_win, final_x, final_y);
+
+    gtk_window_present(GTK_WINDOW(popup_win));
+
+    /* The vbox+children retain pointers into pd->items (via submenu
+       click handlers). free_popup_data() walks the array recursively
+       to release labels and children buffers — but we need to keep
+       the items alive while the popup is open. Defer the free until
+       the popup window is destroyed. */
+    g_object_set_data_full(G_OBJECT(popup_win), "popup_data", pd,
+                           (GDestroyNotify)free_popup_data);
+    return G_SOURCE_REMOVE;
+}
+
+/* Recursively deep-copy a Go-supplied items array into freshly-allocated
+   C memory. Each label is strdup'd, each children array is calloc'd. */
+static xembed_menu_item *copy_items(xembed_menu_item *src, int count) {
+    if (count <= 0 || !src) return NULL;
+    xembed_menu_item *dst =
+        (xembed_menu_item *)calloc(count, sizeof(xembed_menu_item));
+    for (int i = 0; i < count; i++) {
+        dst[i] = src[i];
+        if (src[i].label)
+            dst[i].label = strdup(src[i].label);
+        if (src[i].child_count > 0 && src[i].children) {
+            dst[i].children   = copy_items(src[i].children, src[i].child_count);
+            dst[i].child_count = src[i].child_count;
+        } else {
+            dst[i].children   = NULL;
+            dst[i].child_count = 0;
+        }
+    }
+    return dst;
+}
+
+void xembed_show_popup_menu(xembed_menu_item *items, int count,
+                            xembed_menu_click_cb cb, int x, int y) {
+    (void)cb;
+    popup_data *pd = (popup_data *)calloc(1, sizeof(popup_data));
+    pd->items = copy_items(items, count);
+    pd->count = count;
+    pd->x = x;
+    pd->y = y;
+
+    g_idle_add(popup_menu_idle, pd);
+}
diff --git a/client/ui/xembed_tray_linux.h b/client/ui/xembed_tray_linux.h
new file mode 100644
index 000000000..18a77c4c0
--- /dev/null
+++ b/client/ui/xembed_tray_linux.h
@@ -0,0 +1,81 @@
+#ifndef XEMBED_TRAY_H
+#define XEMBED_TRAY_H
+
+#include <X11/Xlib.h>
+
+// xembed_default_screen wraps the DefaultScreen macro for CGo.
+static inline int xembed_default_screen(Display *dpy) {
+    return DefaultScreen(dpy);
+}
+
+// xembed_install_error_handlers replaces Xlib's default protocol- and
+// I/O-error handlers (which call exit()) with logging handlers, so an async
+// X error from a tray race doesn't kill the UI process. Process-global and
+// idempotent; safe to call after every XOpenDisplay.
+void xembed_install_error_handlers(void);
+
+// xembed_find_tray returns the selection owner window for
+// _NET_SYSTEM_TRAY_S{screen}, or 0 if no XEmbed tray manager exists.
+Window xembed_find_tray(Display *dpy, int screen);
+
+// xembed_get_icon_size queries _NET_SYSTEM_TRAY_ICON_SIZE from the tray
+// manager window. Returns the size in pixels, or 0 if not set.
+int xembed_get_icon_size(Display *dpy, Window tray_mgr);
+
+// xembed_create_icon creates a tray icon window of the given size,
+// sets _XEMBED_INFO, and returns the window ID.
+// tray_mgr is the tray manager window; its _NET_SYSTEM_TRAY_VISUAL
+// property is queried to obtain a 32-bit ARGB visual for transparency.
+Window xembed_create_icon(Display *dpy, int screen, int size, Window tray_mgr);
+
+// xembed_dock sends _NET_SYSTEM_TRAY_OPCODE SYSTEM_TRAY_REQUEST_DOCK
+// to the tray manager to embed our icon window.
+int xembed_dock(Display *dpy, Window tray_mgr, Window icon_win);
+
+// xembed_draw_icon draws ARGB pixel data onto the icon window.
+// data is in [A,R,G,B] byte order per pixel (SNI IconPixmap format).
+// img_w, img_h are the source image dimensions.
+// win_size is the target window dimension (square).
+void xembed_draw_icon(Display *dpy, Window icon_win, int win_size,
+                      const unsigned char *data, int img_w, int img_h);
+
+// xembed_destroy_icon destroys the icon window.
+void xembed_destroy_icon(Display *dpy, Window icon_win);
+
+// xembed_poll_event processes pending X11 events. Returns:
+//   0 = no actionable event
+//   1 = left button press (out_x, out_y filled)
+//   2 = right button press (out_x, out_y filled)
+//   3 = expose (needs redraw)
+//   4 = configure (resize; out_x=width, out_y=height)
+//  -1 = DestroyNotify on icon window (tray died)
+int xembed_poll_event(Display *dpy, Window icon_win,
+                      int *out_x, int *out_y);
+
+// Callback type for menu item clicks. Called with the item's dbusmenu ID.
+typedef void (*xembed_menu_click_cb)(int id);
+
+// xembed_popup_menu builds and shows a GTK3 popup menu.
+// items is an array of menu item descriptors, count is the number of items.
+// cb is called (from the GTK main thread) when an item is clicked.
+// x, y are root coordinates for positioning the popup.
+// This must be called from the GTK main thread (use g_idle_add).
+
+typedef struct xembed_menu_item {
+    int    id;          // dbusmenu item ID
+    const char *label;  // display label (NULL for separator)
+    int    enabled;     // whether the item is clickable
+    int    is_check;    // whether this is a checkbox item
+    int    checked;     // checkbox state (0 or 1)
+    int    is_separator;// 1 if this is a separator
+    // children + child_count populate when this item is a submenu folder
+    // (dbusmenu's children-display=="submenu"). NULL/0 means leaf item.
+    struct xembed_menu_item *children;
+    int child_count;
+} xembed_menu_item;
+
+// Schedule a GTK popup menu on the main thread.
+void xembed_show_popup_menu(xembed_menu_item *items, int count,
+                            xembed_menu_click_cb cb, int x, int y);
+
+#endif
diff --git a/docs/io.netbird.client.plist b/docs/io.netbird.client.plist
index f42b6b3d2..800ecead1 100644
--- a/docs/io.netbird.client.plist
+++ b/docs/io.netbird.client.plist
@@ -96,6 +96,10 @@
          disableProfiles         : hide the profile menu, reject profile CRUD.
          disableNetworks         : hide the Networks / Exit Node menus,
                                    reject the related RPCs.
+         disableAdvancedView     : hide the advanced-view section of the new
+                                   UI. Tristate at the daemon: set to true to
+                                   hide, false to explicitly show, omit the
+                                   key to let the UI apply its own default.
          disableMetricsCollection: opt out of anonymous usage telemetry. -->
     <!--
     <key>disableUpdateSettings</key>
@@ -107,6 +111,9 @@
     <key>disableNetworks</key>
     <true/>
 
+    <key>disableAdvancedView</key>
+    <true/>
+
     <key>disableMetricsCollection</key>
     <false/>
     -->
diff --git a/docs/netbird-macos.mobileconfig b/docs/netbird-macos.mobileconfig
index 53453db5c..9bf616094 100644
--- a/docs/netbird-macos.mobileconfig
+++ b/docs/netbird-macos.mobileconfig
@@ -144,6 +144,8 @@
                                 <true/>
                                 <key>disableNetworks</key>
                                 <true/>
+                                <key>disableAdvancedView</key>
+                                <true/>
                                 <key>disableMetricsCollection</key>
                                 <false/>
                                 -->
diff --git a/docs/netbird-macos.sh b/docs/netbird-macos.sh
index a2f5ff5e8..2777b407c 100644
--- a/docs/netbird-macos.sh
+++ b/docs/netbird-macos.sh
@@ -64,6 +64,7 @@ disableMetricsCollection="$NULL"
 disableUpdateSettings="$NULL"
 disableProfiles="$NULL"
 disableNetworks="$NULL"
+disableAdvancedView="$NULL"           # tristate at the daemon
 rosenpassEnabled="$NULL"
 rosenpassPermissive="$NULL"
 wireguardPort='51820'
@@ -160,6 +161,7 @@ main() {
   is_set "$disableUpdateSettings"     && emit_bool    disableUpdateSettings     "$disableUpdateSettings"
   is_set "$disableProfiles"           && emit_bool    disableProfiles           "$disableProfiles"
   is_set "$disableNetworks"           && emit_bool    disableNetworks           "$disableNetworks"
+  is_set "$disableAdvancedView"       && emit_bool    disableAdvancedView       "$disableAdvancedView"
   is_set "$rosenpassEnabled"          && emit_bool    rosenpassEnabled          "$rosenpassEnabled"
   is_set "$rosenpassPermissive"       && emit_bool    rosenpassPermissive       "$rosenpassPermissive"
   is_set "$wireguardPort"             && emit_int     wireguardPort             "$wireguardPort"
diff --git a/docs/netbird-policy.reg b/docs/netbird-policy.reg
index ba4402e50f956facd45f368b214ee6fbfc6dcf39..83d07c9b00404570e9aa8eac3b4ab71e4b149240 100644
GIT binary patch
delta 40
tcmeC;zQnyjfLYv;A%&rgA(0`EA(<f+$PQ!31k&Y`9hpow3ow^40RY5;2}b|`

delta 17
Ycmcb_-Nn5@fO&Haa~Ts0F9R0?052#5+W-In

diff --git a/docs/netbird.adml b/docs/netbird.adml
index d49b05022..69bb86e4b 100644
--- a/docs/netbird.adml
+++ b/docs/netbird.adml
@@ -60,6 +60,9 @@
       <string id="DisableNetworks_Name">Disable networks</string>
       <string id="DisableNetworks_Help">When enabled, the client UI/CLI cannot list, select or deselect NetBird networks (the corresponding daemon RPCs return Unavailable). Equivalent to --disable-networks.</string>
 
+      <string id="DisableAdvancedView_Name">Disable advanced view</string>
+      <string id="DisableAdvancedView_Help">When enabled, the client UI hides the advanced-view section of the new UI revision. Tristate at the daemon: 1 (enabled) hides the section; 0 (disabled) explicitly shows it; not configured leaves the UI's default behavior in place. MDM is the sole source — no equivalent CLI flag exists.</string>
+
       <string id="DisableMetricsCollection_Name">Disable metrics collection</string>
       <string id="DisableMetricsCollection_Help">When enabled, the client does not collect or report local usage metrics.</string>
 
diff --git a/docs/netbird.admx b/docs/netbird.admx
index 2f7645d63..1a53a3b64 100644
--- a/docs/netbird.admx
+++ b/docs/netbird.admx
@@ -207,6 +207,18 @@
       <disabledValue><decimal value="0" /></disabledValue>
     </policy>
 
+    <policy name="DisableAdvancedView"
+            class="Machine"
+            displayName="$(string.DisableAdvancedView_Name)"
+            explainText="$(string.DisableAdvancedView_Help)"
+            key="Software\Policies\NetBird"
+            valueName="DisableAdvancedView">
+      <parentCategory ref="NetBird" />
+      <supportedOn ref="SUPPORTED_NetBird_All" />
+      <enabledValue><decimal value="1" /></enabledValue>
+      <disabledValue><decimal value="0" /></disabledValue>
+    </policy>
+
     <policy name="DisableMetricsCollection"
             class="Machine"
             displayName="$(string.DisableMetricsCollection_Name)"
diff --git a/go.mod b/go.mod
index e1c762607..3564891a3 100644
--- a/go.mod
+++ b/go.mod
@@ -7,17 +7,17 @@ toolchain go1.25.11
 require (
 	cunicu.li/go-rosenpass v0.5.42
 	github.com/cenkalti/backoff/v4 v4.3.0
-	github.com/cloudflare/circl v1.3.3 // indirect
+	github.com/cloudflare/circl v1.6.3 // indirect
 	github.com/golang/protobuf v1.5.4
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/mux v1.8.1
 	github.com/kardianos/service v1.2.3-0.20240613133416-becf2eb62b83
 	github.com/onsi/ginkgo v1.16.5
-	github.com/onsi/gomega v1.27.6
+	github.com/onsi/gomega v1.34.1
 	github.com/rs/cors v1.8.0
 	github.com/sirupsen/logrus v1.9.4
 	github.com/spf13/cobra v1.10.2
-	github.com/spf13/pflag v1.0.9
+	github.com/spf13/pflag v1.0.10
 	github.com/vishvananda/netlink v1.3.1
 	golang.org/x/crypto v0.50.0
 	golang.org/x/sys v0.43.0
@@ -29,9 +29,6 @@ require (
 )
 
 require (
-	fyne.io/fyne/v2 v2.7.0
-	fyne.io/systray v1.12.1-0.20260116214250-81f8e1a496f9
-	git.sr.ht/~jackmordaunt/go-toast/v2 v2.0.3
 	github.com/DeRuina/timberjack v1.4.2
 	github.com/awnumar/memguard v0.23.0
 	github.com/aws/aws-sdk-go-v2 v1.38.3
@@ -52,7 +49,7 @@ require (
 	github.com/dexidp/dex/api/v2 v2.4.0
 	github.com/docker/docker v28.0.1+incompatible
 	github.com/docker/go-connections v0.6.0
-	github.com/ebitengine/purego v0.8.4
+	github.com/ebitengine/purego v0.9.1
 	github.com/eko/gocache/lib/v4 v4.2.0
 	github.com/eko/gocache/store/go_cache/v4 v4.2.2
 	github.com/eko/gocache/store/redis/v4 v4.2.2
@@ -61,7 +58,7 @@ require (
 	github.com/go-jose/go-jose/v4 v4.1.4
 	github.com/gobwas/ws v1.4.0
 	github.com/goccy/go-yaml v1.18.0
-	github.com/godbus/dbus/v5 v5.1.0
+	github.com/godbus/dbus/v5 v5.2.2
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/golang/mock v1.6.0
 	github.com/google/go-cmp v0.7.0
@@ -115,6 +112,7 @@ require (
 	github.com/ti-mo/conntrack v0.5.1
 	github.com/ti-mo/netfilter v0.5.2
 	github.com/vmihailenco/msgpack/v5 v5.4.1
+	github.com/wailsapp/wails/v3 v3.0.0-alpha2.111
 	github.com/yusufpapurcu/wmi v1.2.4
 	github.com/zcalusic/sysinfo v1.1.3
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0
@@ -125,9 +123,9 @@ require (
 	go.uber.org/mock v0.6.0
 	go.uber.org/zap v1.27.0
 	goauthentik.io/api/v3 v3.2023051.3
-	golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b
+	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
 	golang.org/x/mobile v0.0.0-20251113184115-a159579294ab
-	golang.org/x/mod v0.34.0
+	golang.org/x/mod v0.35.0
 	golang.org/x/net v0.53.0
 	golang.org/x/oauth2 v0.36.0
 	golang.org/x/sync v0.20.0
@@ -140,23 +138,25 @@ require (
 	gorm.io/driver/sqlite v1.5.7
 	gorm.io/gorm v1.25.12
 	gvisor.dev/gvisor v0.0.0-20260219192049-0f2374377e89
-	howett.net/plist v1.0.1
+	howett.net/plist v1.0.2-0.20250314012144-ee69052608d9
 )
 
 require (
 	cloud.google.com/go/auth v0.20.0 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
-	dario.cat/mergo v1.0.1 // indirect
+	dario.cat/mergo v1.0.2 // indirect
 	filippo.io/edwards25519 v1.1.1 // indirect
+	git.sr.ht/~jackmordaunt/go-toast/v2 v2.0.3 // indirect
 	github.com/AppsFlyer/go-sundheit v0.6.0 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
 	github.com/Azure/go-ntlmssp v0.1.0 // indirect
-	github.com/BurntSushi/toml v1.5.0 // indirect
+	github.com/BurntSushi/toml v1.6.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver/v3 v3.3.0 // indirect
+	github.com/Masterminds/semver/v3 v3.4.0 // indirect
 	github.com/Masterminds/sprig/v3 v3.3.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/adrg/xdg v0.5.3 // indirect
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
 	github.com/apapsch/go-jsonmerge/v2 v2.0.0 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
@@ -192,15 +192,8 @@ require (
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/fredbi/uri v1.1.1 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
-	github.com/fyne-io/gl-js v0.2.0 // indirect
-	github.com/fyne-io/glfw-js v0.3.0 // indirect
-	github.com/fyne-io/image v0.1.1 // indirect
-	github.com/fyne-io/oksvg v0.2.0 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
-	github.com/go-gl/gl v0.0.0-20231021071112-07e5d0ea2e71 // indirect
-	github.com/go-gl/glfw/v3.3/glfw v0.0.0-20240506104042-037f3cc74f2a // indirect
 	github.com/go-ldap/ldap/v3 v3.4.13 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
@@ -215,8 +208,6 @@ require (
 	github.com/go-openapi/swag v0.23.1 // indirect
 	github.com/go-openapi/validate v0.24.0 // indirect
 	github.com/go-sql-driver/mysql v1.9.3 // indirect
-	github.com/go-text/render v0.2.0 // indirect
-	github.com/go-text/typesetting v0.2.1 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/go-webauthn/webauthn v0.16.4 // indirect
 	github.com/go-webauthn/x v0.2.3 // indirect
@@ -231,8 +222,6 @@ require (
 	github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect
 	github.com/googleapis/gax-go/v2 v2.21.0 // indirect
 	github.com/gorilla/handlers v1.5.2 // indirect
-	github.com/hack-pad/go-indexeddb v0.3.2 // indirect
-	github.com/hack-pad/safejs v0.1.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
@@ -248,16 +237,15 @@ require (
 	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
 	github.com/jackc/puddle/v2 v2.2.1 // indirect
 	github.com/jackpal/go-nat-pmp v1.0.2 // indirect
-	github.com/jeandeaual/go-locale v0.0.0-20250612000132-0ef82f21eade // indirect
+	github.com/jchv/go-winloader v0.0.0-20250406163304-c1995be93bd1 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/jonboulle/clockwork v0.5.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
-	github.com/jsummers/gobmp v0.0.0-20230614200233-a9de23ed2e25 // indirect
 	github.com/kelseyhightower/envconfig v1.4.0 // indirect
-	github.com/klauspost/compress v1.18.0 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.10 // indirect
+	github.com/klauspost/compress v1.18.3 // indirect
+	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/koron/go-ssdp v0.0.4 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/lib/pq v1.12.3 // indirect
@@ -266,6 +254,8 @@ require (
 	github.com/magiconair/properties v1.8.10 // indirect
 	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-sqlite3 v1.14.42 // indirect
 	github.com/mdelapenya/tlscert v0.2.0 // indirect
 	github.com/mdlayher/genetlink v1.3.2 // indirect
@@ -283,11 +273,8 @@ require (
 	github.com/moby/term v0.5.2 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646 // indirect
-	github.com/nicksnyder/go-i18n/v2 v2.5.1 // indirect
 	github.com/nxadm/tail v1.4.11 // indirect
 	github.com/oklog/ulid v1.3.1 // indirect
-	github.com/onsi/ginkgo/v2 v2.9.5 // indirect
 	github.com/openbao/openbao/api/v2 v2.5.1 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
@@ -307,22 +294,19 @@ require (
 	github.com/prometheus/procfs v0.19.2 // indirect
 	github.com/russellhaering/goxmldsig v1.6.0 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
-	github.com/rymdport/portal v0.4.2 // indirect
 	github.com/shirou/gopsutil/v4 v4.25.8 // indirect
 	github.com/shoenig/go-m1cpu v0.2.1 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
-	github.com/spf13/cast v1.7.0 // indirect
-	github.com/srwiley/oksvg v0.0.0-20221011165216-be6e8873101c // indirect
-	github.com/srwiley/rasterx v0.0.0-20220730225603-2ab79fcdd4ef // indirect
+	github.com/spf13/cast v1.10.0 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/tinylib/msgp v1.6.3 // indirect
 	github.com/tklauser/go-sysconf v0.3.15 // indirect
 	github.com/tklauser/numcpus v0.10.0 // indirect
 	github.com/vishvananda/netns v0.0.5 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
+	github.com/wailsapp/wails/webview2 v1.0.27 // indirect
 	github.com/wlynxg/anet v0.0.5 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
-	github.com/yuin/goldmark v1.7.8 // indirect
 	github.com/zeebo/blake3 v0.2.3 // indirect
 	go.mongodb.org/mongo-driver v1.17.9 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
@@ -331,9 +315,8 @@ require (
 	go.opentelemetry.io/otel/trace v1.43.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
-	golang.org/x/image v0.33.0 // indirect
-	golang.org/x/text v0.36.0 // indirect
-	golang.org/x/tools v0.43.0 // indirect
+	golang.org/x/text v0.37.0 // indirect
+	golang.org/x/tools v0.44.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
diff --git a/go.sum b/go.sum
index 7b29b7604..b2aa6cddd 100644
--- a/go.sum
+++ b/go.sum
@@ -9,14 +9,10 @@ codeberg.org/cunicu/circl v0.0.0-20230801113412-fec58fc7b5f6 h1:b8xUw3004wk+3ipB
 codeberg.org/cunicu/circl v0.0.0-20230801113412-fec58fc7b5f6/go.mod h1:+CauBF6R70Jqcyl8N2hC8pAXYbWkGIezuSbuGLtRhnw=
 cunicu.li/go-rosenpass v0.5.42 h1:fRDsGwCxd7DhDgZI1Pxeo8GtNyq8BESZJ7w2/BGGJtU=
 cunicu.li/go-rosenpass v0.5.42/go.mod h1:YRBeyKOe/gWpSX2kpDUec5p9t0XOLsshTguId5gTGVg=
-dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
-dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
+dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
+dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
 filippo.io/edwards25519 v1.1.1 h1:YpjwWWlNmGIDyXOn8zLzqiD+9TyIlPhGFG96P39uBpw=
 filippo.io/edwards25519 v1.1.1/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
-fyne.io/fyne/v2 v2.7.0 h1:GvZSpE3X0liU/fqstInVvRsaboIVpIWQ4/sfjDGIGGQ=
-fyne.io/fyne/v2 v2.7.0/go.mod h1:xClVlrhxl7D+LT+BWYmcrW4Nf+dJTvkhnPgji7spAwE=
-fyne.io/systray v1.12.1-0.20260116214250-81f8e1a496f9 h1:829+77I4TaMrcg9B3wf+gHhdSgoCVEgH2czlPXPbfj4=
-fyne.io/systray v1.12.1-0.20260116214250-81f8e1a496f9/go.mod h1:RVwqP9nYMo7h5zViCBHri2FgjXF7H2cub7MAq4NSoLs=
 git.sr.ht/~jackmordaunt/go-toast/v2 v2.0.3 h1:N3IGoHHp9pb6mj1cbXbuaSXV/UMKwmbKLf53nQmtqMA=
 git.sr.ht/~jackmordaunt/go-toast/v2 v2.0.3/go.mod h1:QtOLZGz8olr4qH2vWK0QH0w0O4T9fEIjMuWpKUsH7nc=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=
@@ -27,19 +23,21 @@ github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEK
 github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/Azure/go-ntlmssp v0.1.0 h1:DjFo6YtWzNqNvQdrwEyr/e4nhU3vRiwenz5QX7sFz+A=
 github.com/Azure/go-ntlmssp v0.1.0/go.mod h1:NYqdhxd/8aAct/s4qSYZEerdPuH1liG2/X9DiVTbhpk=
-github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
-github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
+github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk=
+github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/DeRuina/timberjack v1.4.2 h1:4bKlzhKdsR+2oNkgef9mqb4n11ICow8VK88RfzJPzN8=
 github.com/DeRuina/timberjack v1.4.2/go.mod h1:RLoeQrwrCGIEF8gO5nV5b/gMD0QIy7bzQhBUgpp1EqE=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
-github.com/Masterminds/semver/v3 v3.3.0 h1:B8LGeaivUe71a5qox1ICM/JLl0NqZSW5CHyL+hmvYS0=
-github.com/Masterminds/semver/v3 v3.3.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
+github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Masterminds/sprig/v3 v3.3.0 h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=
 github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSCzdgBfDb35Lz0=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/RaveNoX/go-jsoncommentstrip v1.0.0/go.mod h1:78ihd09MekBnJnxpICcwzCMzGrKSKYe4AqU6PDYYpjk=
+github.com/adrg/xdg v0.5.3 h1:xRnxJXne7+oWDatRhR1JLnvuccuIeCoBu2rtuLqQB78=
+github.com/adrg/xdg v0.5.3/go.mod h1:nlTsY+NNiCBGCK2tpm09vRqfVzrc2fLmXGpBLF0zlTQ=
 github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e h1:4dAU9FXIyQktpoUAgOJK3OTFc/xug0PCXYCqU0FgDKI=
 github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
@@ -154,8 +152,8 @@ github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pM
 github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
-github.com/ebitengine/purego v0.8.4 h1:CF7LEKg5FFOsASUj0+QwaXf8Ht6TlFxg09+S9wz0omw=
-github.com/ebitengine/purego v0.8.4/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
+github.com/ebitengine/purego v0.9.1 h1:a/k2f2HQU3Pi399RPW1MOaZyhKJL9w/xFpKAg4q1s0A=
+github.com/ebitengine/purego v0.9.1/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/eko/gocache/lib/v4 v4.2.0 h1:MNykyi5Xw+5Wu3+PUrvtOCaKSZM1nUSVftbzmeC7Yuw=
 github.com/eko/gocache/lib/v4 v4.2.0/go.mod h1:7ViVmbU+CzDHzRpmB4SXKyyzyuJ8A3UW3/cszpcqB4M=
 github.com/eko/gocache/store/go_cache/v4 v4.2.2 h1:tAI9nl6TLoJyKG1ujF0CS0n/IgTEMl+NivxtR5R3/hw=
@@ -164,16 +162,12 @@ github.com/eko/gocache/store/redis/v4 v4.2.2 h1:Thw31fzGuH3WzJywsdbMivOmP550D6JS
 github.com/eko/gocache/store/redis/v4 v4.2.2/go.mod h1:LaTxLKx9TG/YUEybQvPMij++D7PBTIJ4+pzvk0ykz0w=
 github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
 github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
-github.com/felixge/fgprof v0.9.3 h1:VvyZxILNuCiUCSXtPtYmmtGvb65nqXh2QFWc0Wpf2/g=
-github.com/felixge/fgprof v0.9.3/go.mod h1:RdbpDgzqYVh/T9fPELJyV7EYJuHB55UTEULNun8eiPw=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8vw=
 github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
-github.com/fredbi/uri v1.1.1 h1:xZHJC08GZNIUhbP5ImTHnt5Ya0T8FI2VAwI/37kh2Ko=
-github.com/fredbi/uri v1.1.1/go.mod h1:4+DZQ5zBjEwQCDmXW5JdIjz0PUA+yJbvtBv+u+adr5o=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
@@ -181,26 +175,16 @@ github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
 github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ=
 github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
-github.com/fyne-io/gl-js v0.2.0 h1:+EXMLVEa18EfkXBVKhifYB6OGs3HwKO3lUElA0LlAjs=
-github.com/fyne-io/gl-js v0.2.0/go.mod h1:ZcepK8vmOYLu96JoxbCKJy2ybr+g1pTnaBDdl7c3ajI=
-github.com/fyne-io/glfw-js v0.3.0 h1:d8k2+Y7l+zy2pc7wlGRyPfTgZoqDf3AI4G+2zOWhWUk=
-github.com/fyne-io/glfw-js v0.3.0/go.mod h1:Ri6te7rdZtBgBpxLW19uBpp3Dl6K9K/bRaYdJ22G8Jk=
-github.com/fyne-io/image v0.1.1 h1:WH0z4H7qfvNUw5l4p3bC1q70sa5+YWVt6HCj7y4VNyA=
-github.com/fyne-io/image v0.1.1/go.mod h1:xrfYBh6yspc+KjkgdZU/ifUC9sPA5Iv7WYUBzQKK7JM=
-github.com/fyne-io/oksvg v0.2.0 h1:mxcGU2dx6nwjJsSA9PCYZDuoAcsZ/OuJlvg/Q9Njfo8=
-github.com/fyne-io/oksvg v0.2.0/go.mod h1:dJ9oEkPiWhnTFNCmRgEze+YNprJF7YRbpjgpWS4kzoI=
 github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
 github.com/gin-gonic/gin v1.5.0/go.mod h1:Nd6IXA8m5kNZdNEHMBd93KT+mdY3+bewLgRvmCsR2Do=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
 github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
 github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 h1:BP4M0CvQ4S3TGls2FvczZtj5Re/2ZzkV9VwqPHH/3Bo=
 github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
-github.com/go-gl/gl v0.0.0-20231021071112-07e5d0ea2e71 h1:5BVwOaUSBTlVZowGO6VZGw2H/zl9nrd3eCZfYV+NfQA=
-github.com/go-gl/gl v0.0.0-20231021071112-07e5d0ea2e71/go.mod h1:9YTyiznxEY1fVinfM7RvRcjRHbw2xLBJ3AAGIT0I4Nw=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20240506104042-037f3cc74f2a h1:vxnBhFDDT+xzxf1jTJKMKZw3H0swfWk9RpWbBbDK5+0=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20240506104042-037f3cc74f2a/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
 github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-json-experiment/json v0.0.0-20251027170946-4849db3c2f7e h1:Lf/gRkoycfOBPa42vU2bbgPurFong6zXeFtPoxholzU=
+github.com/go-json-experiment/json v0.0.0-20251027170946-4849db3c2f7e/go.mod h1:uNVvRXArCGbZ508SxYYTC5v1JWoz2voff5pm25jU1Ok=
 github.com/go-ldap/ldap/v3 v3.4.13 h1:+x1nG9h+MZN7h/lUi5Q3UZ0fJ1GyDQYbPvbuH38baDQ=
 github.com/go-ldap/ldap/v3 v3.4.13/go.mod h1:LxsGZV6vbaK0sIvYfsv47rfh4ca0JXokCoKjZxsszv0=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
@@ -236,17 +220,12 @@ github.com/go-quicktest/qt v1.101.1-0.20240301121107-c6c8733fa1e6/go.mod h1:p4lG
 github.com/go-sql-driver/mysql v1.7.0/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
 github.com/go-sql-driver/mysql v1.9.3 h1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=
 github.com/go-sql-driver/mysql v1.9.3/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
+github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 h1:p104kn46Q8WdvHunIJ9dAyjPVtrBPhSr3KT2yUst43I=
 github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
-github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
-github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
+github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
+github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
 github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
-github.com/go-text/render v0.2.0 h1:LBYoTmp5jYiJ4NPqDc2pz17MLmA3wHw1dZSVGcOdeAc=
-github.com/go-text/render v0.2.0/go.mod h1:CkiqfukRGKJA5vZZISkjSYrcdtgKQWRa2HIzvwNN5SU=
-github.com/go-text/typesetting v0.2.1 h1:x0jMOGyO3d1qFAPI0j4GSsh7M0Q3Ypjzr4+CEVg82V8=
-github.com/go-text/typesetting v0.2.1/go.mod h1:mTOxEwasOFpAMBjEQDhdWRckoLLeI/+qrQeBCTGEt6M=
-github.com/go-text/typesetting-utils v0.0.0-20241103174707-87a29e9e6066 h1:qCuYC+94v2xrb1PoS4NIDe7DGYtLnU2wWiQe9a1B1c0=
-github.com/go-text/typesetting-utils v0.0.0-20241103174707-87a29e9e6066/go.mod h1:DDxDdQEnB70R8owOx3LVpEFvpMK9eeH1o2r0yZhFI9o=
 github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
 github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/go-webauthn/webauthn v0.16.4 h1:R9jqR/cYZa7hRquFF7Za/8qoH/K/TIs1/Q/4CyGN+1Q=
@@ -261,8 +240,8 @@ github.com/gobwas/ws v1.4.0 h1:CTaoG1tojrh4ucGPcoJFiAQUAsEWekEWvLy7GsVNqGs=
 github.com/gobwas/ws v1.4.0/go.mod h1:G3gNqMNtPppf5XUz7O4shetPpcZ1VJ7zt18dlUeakrc=
 github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=
 github.com/goccy/go-yaml v1.18.0/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
-github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
-github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
+github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
@@ -309,8 +288,8 @@ github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF
 github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
 github.com/google/nftables v0.3.0 h1:bkyZ0cbpVeMHXOrtlFc8ISmfVqq5gPJukoYieyVmITg=
 github.com/google/nftables v0.3.0/go.mod h1:BCp9FsrbF1Fn/Yu6CLUc9GGZFw/+hsxfluNXXmxBfRM=
-github.com/google/pprof v0.0.0-20211214055906-6f57359322fd h1:1FjCyPC+syAzJ5/2S8fqdZK1R22vvA0J7JZKcuOIQ7Y=
-github.com/google/pprof v0.0.0-20211214055906-6f57359322fd/go.mod h1:KgnwoLYCZ8IQu3XUZ8Nc/bM9CCZFOyjUNOSygVozoDg=
+github.com/google/pprof v0.0.0-20240424215950-a892ee059fd6 h1:k7nVchz72niMH6YLQNvHSdIE7iqsQxK1P41mySCvssg=
+github.com/google/pprof v0.0.0-20240424215950-a892ee059fd6/go.mod h1:kf6iHlnVGwgKolg33glAes7Yg/8iWP8ukqeldJSO7jw=
 github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
 github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -329,10 +308,6 @@ github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.0.2-0.20240212192251-757544f2
 github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.0.2-0.20240212192251-757544f21357/go.mod h1:w9Y7gY31krpLmrVU5ZPG9H7l9fZuRu5/3R3S3FMtVQ4=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 h1:5ZPtiqj0JL5oKWmcsq4VMaAW5ukBEgSGXEN89zeH1Jo=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3/go.mod h1:ndYquD05frm2vACXE1nsccT4oJzjhw2arTS2cpUD1PI=
-github.com/hack-pad/go-indexeddb v0.3.2 h1:DTqeJJYc1usa45Q5r52t01KhvlSN02+Oq+tQbSBI91A=
-github.com/hack-pad/go-indexeddb v0.3.2/go.mod h1:QvfTevpDVlkfomY498LhstjwbPW6QC4VC/lxYb0Kom0=
-github.com/hack-pad/safejs v0.1.0 h1:qPS6vjreAqh2amUqj4WNG1zIw7qlRQJ9K10eDKMCnE8=
-github.com/hack-pad/safejs v0.1.0/go.mod h1:HdS+bKF1NrE72VoXZeWzxFOVQVUSqZJAG0xNCnb+Tio=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -376,6 +351,8 @@ github.com/jackc/puddle/v2 v2.2.1 h1:RhxXJtFG022u4ibrCSMSiu5aOq1i77R3OHKNJj77OAk
 github.com/jackc/puddle/v2 v2.2.1/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jackpal/go-nat-pmp v1.0.2 h1:KzKSgb7qkJvOUTqYl9/Hg/me3pWgBmERKrTGD7BdWus=
 github.com/jackpal/go-nat-pmp v1.0.2/go.mod h1:QPH045xvCAeXUZOxsnwmrtiCoxIr9eob+4orBN1SBKc=
+github.com/jchv/go-winloader v0.0.0-20250406163304-c1995be93bd1 h1:njuLRcjAuMKr7kI3D85AXWkw6/+v9PwtV6M6o11sWHQ=
+github.com/jchv/go-winloader v0.0.0-20250406163304-c1995be93bd1/go.mod h1:alcuEEnZsY1WQsagKhZDsoPCRoOijYqhZvPwLG0kzVs=
 github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
 github.com/jcmturner/aescts/v2 v2.0.0/go.mod h1:AiaICIRyfYg35RUkr8yESTqvSy7csK90qZ5xfvvsoNs=
 github.com/jcmturner/dnsutils/v2 v2.0.0 h1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo=
@@ -388,8 +365,6 @@ github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh6
 github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs=
 github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
 github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
-github.com/jeandeaual/go-locale v0.0.0-20250612000132-0ef82f21eade h1:FmusiCI1wHw+XQbvL9M+1r/C3SPqKrmBaIOYwVfQoDE=
-github.com/jeandeaual/go-locale v0.0.0-20250612000132-0ef82f21eade/go.mod h1:ZDXo8KHryOWSIqnsb/CiDq7hQUYryCgdVnxbj8tDG7o=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
 github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
 github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
@@ -406,18 +381,16 @@ github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFF
 github.com/jsimonetti/rtnetlink/v2 v2.0.1 h1:xda7qaHDSVOsADNouv7ukSuicKZO7GgVUCXxpaIEIlM=
 github.com/jsimonetti/rtnetlink/v2 v2.0.1/go.mod h1:7MoNYNbb3UaDHtF8udiJo/RH6VsTKP1pqKLUTVCvToE=
 github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
-github.com/jsummers/gobmp v0.0.0-20230614200233-a9de23ed2e25 h1:YLvr1eE6cdCqjOe972w/cYF+FjW34v27+9Vo5106B4M=
-github.com/jsummers/gobmp v0.0.0-20230614200233-a9de23ed2e25/go.mod h1:kLgvv7o6UM+0QSf0QjAse3wReFDsb9qbZJdfexWlrQw=
 github.com/juju/gnuflag v0.0.0-20171113085948-2ce1bb71843d/go.mod h1:2PavIy+JPciBPrBUjwbNvtwB6RQlve+hkpll6QSNmOE=
 github.com/kelseyhightower/envconfig v1.4.0 h1:Im6hONhd3pLkfDFsbRgu68RDNkGF1r3dvMUtDTo2cv8=
 github.com/kelseyhightower/envconfig v1.4.0/go.mod h1:cccZRl6mQpaq41TPp5QxidR+Sa3axMbJDNb//FQX6Gg=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
-github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/klauspost/compress v1.18.3 h1:9PJRvfbmTabkOX8moIpXPbMMbYN60bWImDDU7L+/6zw=
+github.com/klauspost/compress v1.18.3/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
 github.com/klauspost/cpuid/v2 v2.0.12/go.mod h1:g2LTdtYhdyuGPqyWyv7qRAmj1WBqxuObKfj5c0PQa7c=
-github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=
-github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
+github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
+github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/koron/go-ssdp v0.0.4 h1:1IDwrghSKYM7yLf7XCzbByg2sJ/JcNOZRXS2jczTwz0=
 github.com/koron/go-ssdp v0.0.4/go.mod h1:oDXq+E5IL5q0U8uSBcoAXzTzInwy5lEgC91HoKtbmZk=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
@@ -449,6 +422,8 @@ github.com/lufia/plan9stats v0.0.0-20240513124658-fba389f38bae h1:dIZY4ULFcto4tA
 github.com/lufia/plan9stats v0.0.0-20240513124658-fba389f38bae/go.mod h1:ilwx/Dta8jXAgpFYFvSWEMwxmbWXyiUHkd5FwyKhb5k=
 github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE=
 github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
+github.com/matryer/is v1.4.1 h1:55ehd8zaGABKLXQUe2awZ99BD/PTc2ls+KV/dXphgEQ=
+github.com/matryer/is v1.4.1/go.mod h1:8I/i5uYgLzgsgEloJE1U6xx5HkBQpAZvepWuujKwMRU=
 github.com/mattermost/xml-roundtrip-validator v0.1.0 h1:RXbVD2UAl7A7nOTR4u7E3ILa4IbtvKBHw64LDsmu9hU=
 github.com/mattermost/xml-roundtrip-validator v0.1.0/go.mod h1:qccnGMcpgwcNaBnxqpJpWWUiPNr5H3O8eDgGV9gT5To=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
@@ -520,10 +495,6 @@ github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45/go.mod h1:5/sjFmLb8O96B5737VCqhHyGRzNFIaN/Bu7ZodXc3qQ=
 github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a h1:3CWK+yTvRKOcC0Q8VCTGy4l60TEb27CQVS7LkMxwjmw=
 github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
-github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646 h1:zYyBkD/k9seD2A7fsi6Oo2LfFZAehjjQMERAvZLEDnQ=
-github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646/go.mod h1:jpp1/29i3P1S/RLdc7JQKbRpFeM1dOBd8T9ki5s+AY8=
-github.com/nicksnyder/go-i18n/v2 v2.5.1 h1:IxtPxYsR9Gp60cGXjfuR/llTqV8aYMsC472zD0D1vHk=
-github.com/nicksnyder/go-i18n/v2 v2.5.1/go.mod h1:DrhgsSDZxoAfvVrBVLXoxZn/pN5TXqaDbq7ju94viiQ=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
 github.com/nxadm/tail v1.4.11 h1:8feyoE3OzPrcshW5/MJ4sGESc5cqmGkGCWlco4l0bqY=
@@ -538,12 +509,12 @@ github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+W
 github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
 github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
 github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
-github.com/onsi/ginkgo/v2 v2.9.5 h1:+6Hr4uxzP4XIUyAkg61dWBw8lb/gc4/X5luuxN/EC+Q=
-github.com/onsi/ginkgo/v2 v2.9.5/go.mod h1:tvAoo1QUJwNEU2ITftXTpR7R1RbCzoZUOs3RonqW57k=
+github.com/onsi/ginkgo/v2 v2.19.0 h1:9Cnnf7UHo57Hy3k6/m5k3dRfGTMXGvxhHFvkDTCTpvA=
+github.com/onsi/ginkgo/v2 v2.19.0/go.mod h1:rlwLi9PilAFJ8jCg9UE1QP6VBpd6/xj3SRC0d6TU0To=
 github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
 github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
-github.com/onsi/gomega v1.27.6 h1:ENqfyGeS5AX/rlXDd/ETokDz93u0YufY1Pgxuy/PvWE=
-github.com/onsi/gomega v1.27.6/go.mod h1:PIQNjfQwkP3aQAH7lf7j87O/5FiNr+ZR8+ipb+qQlhg=
+github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
+github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY=
 github.com/openbao/openbao/api/v2 v2.5.1 h1:Br79D6L20SbAa5P7xqENxmvv8LyI4HoKosPy7klhn4o=
 github.com/openbao/openbao/api/v2 v2.5.1/go.mod h1:Dh5un77tqGgMbmlVEqjqN+8/dMyUohnkaQVg/wXW0Ig=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
@@ -593,8 +564,6 @@ github.com/pires/go-proxyproto v0.11.0/go.mod h1:ZKAAyp3cgy5Y5Mo4n9AlScrkCZwUy0g
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/profile v1.7.0 h1:hnbDkaNWPCLMO9wGLdBFTIZvzDrDfBM2072E1S9gJkA=
-github.com/pkg/profile v1.7.0/go.mod h1:8Uer0jas47ZQMJ7VD+OHknK4YDY07LPUC6dEvqDjvNo=
 github.com/pkg/sftp v1.13.9 h1:4NGkvGudBL7GteO3m6qnaQ4pC0Kvf0onSVc9gR3EWBw=
 github.com/pkg/sftp v1.13.9/go.mod h1:OBN7bVXdstkFFN/gdnHPUb5TE8eb8G1Rp9wCItqjkkA=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
@@ -630,8 +599,6 @@ github.com/russellhaering/goxmldsig v1.6.0/go.mod h1:TrnaquDcYxWXfJrOjeMBTX4mLBe
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
-github.com/rymdport/portal v0.4.2 h1:7jKRSemwlTyVHHrTGgQg7gmNPJs88xkbKcIL3NlcmSU=
-github.com/rymdport/portal v0.4.2/go.mod h1:kFF4jslnJ8pD5uCi17brj/ODlfIidOxlgUDTO5ncnC4=
 github.com/shirou/gopsutil/v3 v3.24.4 h1:dEHgzZXt4LMNm+oYELpzl9YCqV65Yr/6SfrvgRBtXeU=
 github.com/shirou/gopsutil/v3 v3.24.4/go.mod h1:lTd2mdiOspcqLgAnr9/nGi71NkeMpWKdmhuxm9GusH8=
 github.com/shirou/gopsutil/v4 v4.25.8 h1:NnAsw9lN7587WHxjJA9ryDnqhJpFH6A+wagYWTOH970=
@@ -650,17 +617,14 @@ github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 h1:JIAuq3EE
 github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966/go.mod h1:sUM3LWHvSMaG192sy56D9F7CNvL7jUJVXoqM1QKLnog=
 github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8 h1:TG/diQgUe0pntT/2D9tmUCz4VNwm9MfrtPr0SU2qSX8=
 github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8/go.mod h1:P5HUIBuIWKbyjl083/loAegFkfbFNx5i2qEP4CNbm7E=
-github.com/spf13/cast v1.7.0 h1:ntdiHjuueXFgm5nzDRdOS4yfT43P5Fnud6DH50rz/7w=
-github.com/spf13/cast v1.7.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
+github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
+github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
 github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
-github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spkg/bom v0.0.0-20160624110644-59b7046e48ad/go.mod h1:qLr4V1qq6nMqFKkMo8ZTx3f+BZEkzsRUY10Xsm2mwU0=
-github.com/srwiley/oksvg v0.0.0-20221011165216-be6e8873101c h1:km8GpoQut05eY3GiYWEedbTT0qnSxrCjsVbb7yKY1KE=
-github.com/srwiley/oksvg v0.0.0-20221011165216-be6e8873101c/go.mod h1:cNQ3dwVJtS5Hmnjxy6AgTPd0Inb3pW05ftPSX7NZO7Q=
-github.com/srwiley/rasterx v0.0.0-20220730225603-2ab79fcdd4ef h1:Ch6Q+AZUxDBCVqdkI8FSpFyZDtCVBc2VmejdNrm5rRQ=
-github.com/srwiley/rasterx v0.0.0-20220730225603-2ab79fcdd4ef/go.mod h1:nXTWP6+gD5+LUJ8krVhhoeHjvHTutPxMYl5SvkcnJNE=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
@@ -711,6 +675,10 @@ github.com/vmihailenco/msgpack/v5 v5.4.1 h1:cQriyiUvjTwOHg8QZaPihLWeRAAVoCpE00IU
 github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
 github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
 github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
+github.com/wailsapp/wails/v3 v3.0.0-alpha2.111 h1:MKx1nOnhnDuEGrRBmtxLOJq1NERwailu2cI4BvzWhi4=
+github.com/wailsapp/wails/v3 v3.0.0-alpha2.111/go.mod h1:wrdvmyeCsB/K3YqJDoH8E3MwcN8NXAMnEFaDTW46w60=
+github.com/wailsapp/wails/webview2 v1.0.27 h1:wjgAi/I8BBZ7kUGU8um3XF3ILEfzr96Q2Q1G4GPjMns=
+github.com/wailsapp/wails/webview2 v1.0.27/go.mod h1:zdM4jcO1IaC61RiJL5F1BzgoqBHFIdacz8gPr5exr0o=
 github.com/wlynxg/anet v0.0.5 h1:J3VJGi1gvo0JwZ/P1/Yc/8p63SoW98B5dHkYDmpgvvU=
 github.com/wlynxg/anet v0.0.5/go.mod h1:eay5PRQr7fIVAMbTbchTnO9gG65Hg/uYGdc7mguHxoA=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
@@ -719,8 +687,6 @@ github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/yuin/goldmark v1.7.8 h1:iERMLn0/QJeHFhxSt3p6PeN9mGnvIKSpG9YYorDMnic=
-github.com/yuin/goldmark v1.7.8/go.mod h1:uzxRWxtg69N339t3louHJ7+O03ezfj6PlliRlaOzY1E=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
 github.com/zcalusic/sysinfo v1.1.3 h1:u/AVENkuoikKuIZ4sUEJ6iibpmQP6YpGD8SSMCrqAF0=
@@ -783,10 +749,8 @@ golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
 golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
 golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
-golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/yqS/lQJ6PmkyIV3YP+o=
-golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8=
-golang.org/x/image v0.33.0 h1:LXRZRnv1+zGd5XBUVRFmYEphyyKJjQjCRiOuAP3sZfQ=
-golang.org/x/image v0.33.0/go.mod h1:DD3OsTYT9chzuzTQt+zMcOlBHgfoKQb1gry8p76Y1sc=
+golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
+golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mobile v0.0.0-20251113184115-a159579294ab h1:Iqyc+2zr7aGyLuEadIm0KRJP0Wwt+fhlXLa51Fxf1+Q=
 golang.org/x/mobile v0.0.0-20251113184115-a159579294ab/go.mod h1:Eq3Nh/5pFSWug2ohiudJ1iyU59SO78QFuh4qTTN++I0=
@@ -799,8 +763,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
-golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
+golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
+golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
@@ -846,6 +810,7 @@ golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200810151505-1b9f1253b3ed/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201015000850-e3ed0017c211/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -899,8 +864,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
-golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -914,8 +879,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
-golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
+golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
+golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -964,7 +929,6 @@ gopkg.in/square/go-jose.v2 v2.6.0 h1:NGk74WTnPKBNUhNzQX7PYcTLUjoq7mzKk2OKbvwk2iI
 gopkg.in/square/go-jose.v2 v2.6.0/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
-gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0/go.mod h1:WDnlLJ4WF5VGsH/HVa3CI79GS0ol3YnhVnKP89i0kNg=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
@@ -987,8 +951,8 @@ gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
 gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
 gvisor.dev/gvisor v0.0.0-20260219192049-0f2374377e89 h1:mGJaeA61P8dEHTqdvAgc70ZIV3QoUoJcXCRyyjO26OA=
 gvisor.dev/gvisor v0.0.0-20260219192049-0f2374377e89/go.mod h1:QkHjoMIBaYtpVufgwv3keYAbln78mBoCuShZrPrer1Q=
-howett.net/plist v1.0.1 h1:37GdZ8tP09Q35o9ych3ehygcsL+HqKSwzctveSlarvM=
-howett.net/plist v1.0.1/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=
+howett.net/plist v1.0.2-0.20250314012144-ee69052608d9 h1:eeH1AIcPvSc0Z25ThsYF+Xoqbn0CI/YnXVYoTLFdGQw=
+howett.net/plist v1.0.2-0.20250314012144-ee69052608d9/go.mod h1:fyFX5Hj5tP1Mpk8obqA9MZgXT416Q5711SDT7dQLTLk=
 pgregory.net/rapid v1.2.0 h1:keKAYRcjm+e1F0oAuU5F5+YPAWcyxNNRK2wud503Gnk=
 pgregory.net/rapid v1.2.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04=
 rsc.io/qr v0.2.0 h1:6vBLea5/NRMVTz8V66gipeLycZMl/+UlFmk8DvqQ6WY=
diff --git a/shared/management/client/grpc.go b/shared/management/client/grpc.go
index e3ba259c6..0735a15b9 100644
--- a/shared/management/client/grpc.go
+++ b/shared/management/client/grpc.go
@@ -654,26 +654,14 @@ func (c *GrpcClient) ExtendAuthSession(sysInfo *system.Info, jwtToken string) (*
 		return nil, err
 	}
 
-	var resp *proto.EncryptedMessage
-	operation := func() error {
-		mgmCtx, cancel := context.WithTimeout(context.Background(), ConnectTimeout)
-		defer cancel()
+	mgmCtx, cancel := context.WithTimeout(c.ctx, ConnectTimeout)
+	defer cancel()
 
-		var err error
-		resp, err = c.realClient.ExtendAuthSession(mgmCtx, &proto.EncryptedMessage{
-			WgPubKey: c.key.PublicKey().String(),
-			Body:     reqBody,
-		})
-		if err != nil {
-			if s, ok := gstatus.FromError(err); ok && s.Code() == codes.Canceled {
-				return err
-			}
-			return backoff.Permanent(err)
-		}
-		return nil
-	}
-
-	if err := backoff.Retry(operation, nbgrpc.Backoff(c.ctx)); err != nil {
+	resp, err := c.realClient.ExtendAuthSession(mgmCtx, &proto.EncryptedMessage{
+		WgPubKey: c.key.PublicKey().String(),
+		Body:     reqBody,
+	})
+	if err != nil {
 		log.Errorf("failed to extend auth session on Management Service: %v", err)
 		return nil, err
 	}
diff --git a/sonar-project.properties b/sonar-project.properties
new file mode 100644
index 000000000..5dede20d4
--- /dev/null
+++ b/sonar-project.properties
@@ -0,0 +1,2 @@
+sonar.projectKey=netbirdio_netbird
+sonar.organization=netbirdio
diff --git a/util/log.go b/util/log.go
index 3896ff6bc..623b11e0f 100644
--- a/util/log.go
+++ b/util/log.go
@@ -40,6 +40,45 @@ func InitLogger(logger *log.Logger, logLevel string, logs ...string) error {
 	if err != nil {
 		return fmt.Errorf("failed parsing log-level %s: %w", logLevel, err)
 	}
+
+	logFmt, err := buildWriters(logger, logs...)
+	if err != nil {
+		return err
+	}
+
+	switch logFmt {
+	case "json":
+		formatter.SetJSONFormatter(logger)
+	case "syslog":
+		formatter.SetSyslogFormatter(logger)
+	default:
+		formatter.SetTextFormatter(logger)
+	}
+	logger.SetLevel(level)
+
+	setGRPCLibLogger(logger)
+
+	return nil
+}
+
+// SetLogOutputs re-points an already-initialized logger to the given targets
+// (console/syslog/file), with the same target semantics as InitLogger, but
+// without re-parsing the level or resetting the formatter. The desktop GUI uses
+// it to attach the rotated gui-client.log alongside the console when the daemon
+// enters debug, and drop back to console-only when it leaves.
+func SetLogOutputs(logger *log.Logger, logs ...string) error {
+	if _, err := buildWriters(logger, logs...); err != nil {
+		return err
+	}
+	setGRPCLibLogger(logger)
+	return nil
+}
+
+// buildWriters resolves the given log targets to writers and points the logger
+// at them (single writer or MultiWriter). It returns the log format implied by
+// the targets (syslog forces "syslog"; otherwise the NB_LOG_FORMAT env value).
+// Shared by InitLogger and SetLogOutputs.
+func buildWriters(logger *log.Logger, logs ...string) (string, error) {
 	var writers []io.Writer
 	logFmt := os.Getenv("NB_LOG_FORMAT")
 
@@ -61,7 +100,7 @@ func InitLogger(logger *log.Logger, logLevel string, logs ...string) error {
 		default:
 			writer, err := setupLogFile(logPath, isRotationDisabled(logger))
 			if err != nil {
-				return fmt.Errorf("failed setting up log file: %s, %w", logPath, err)
+				return "", fmt.Errorf("failed setting up log file: %s, %w", logPath, err)
 			}
 			writers = append(writers, writer)
 		}
@@ -73,19 +112,7 @@ func InitLogger(logger *log.Logger, logLevel string, logs ...string) error {
 		logger.SetOutput(writers[0])
 	}
 
-	switch logFmt {
-	case "json":
-		formatter.SetJSONFormatter(logger)
-	case "syslog":
-		formatter.SetSyslogFormatter(logger)
-	default:
-		formatter.SetTextFormatter(logger)
-	}
-	logger.SetLevel(level)
-
-	setGRPCLibLogger(logger)
-
-	return nil
+	return logFmt, nil
 }
 
 // FindFirstLogPath returns the first logs entry that could be a log path, that is neither empty, nor a special value

From 47352e6e45f2c0efba56389a065b7cdc65382fb7 Mon Sep 17 00:00:00 2001
From: dmitri-netbird <dmitri.external@netbird.io>
Date: Mon, 6 Jul 2026 16:04:26 +0200
Subject: [PATCH 35/36] [client] introduce client-side event aggregation
 (#6627)

* added an implementation of aggregating memory store

Signed-off-by: Dmitri <dmitri.external@netbird.io>

* initial support for aggregation of events

Signed-off-by: Dmitri <dmitri.external@netbird.io>

* added tcp-aggregation test

Signed-off-by: Dmitri <dmitri.external@netbird.io>

* added manager integration test

Signed-off-by: Dmitri <dmitri.external@netbird.io>

* added tracking of the number of start-, drop, and end-events in an aggregation window

Signed-off-by: Dmitri <dmitri.external@netbird.io>

* fixes based on sonarcube checks

Signed-off-by: Dmitri <dmitri.external@netbird.io>

* regenerated proto files

Signed-off-by: Dmitri <dmitri.external@netbird.io>

* removed inadvertenly added google proto files

Signed-off-by: Dmitri <dmitri.external@netbird.io>

* pacifying linter

Signed-off-by: Dmitri <dmitri.external@netbird.io>

* update test to validate event aggregation over tcp, udp, icmp, and icmpv6

Signed-off-by: Dmitri <dmitri.external@netbird.io>

* updated event aggregation test

Signed-off-by: Dmitri <dmitri.external@netbird.io>

* regenerate protobufs with expected versions of protoc and protoc-gen-go

Signed-off-by: Dmitri <dmitri.external@netbird.io>

* remove protoc/protoc-gen headers from flow_grpc.pb.go

Signed-off-by: Dmitri <dmitri.external@netbird.io>

* updated openapi spec

Signed-off-by: Dmitri <dmitri.external@netbird.io>

* updated openapi NetworkTrafficEvent spec, regenerated types

Signed-off-by: Dmitri <dmitri.external@netbird.io>

* respond to feedback

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* fixed an issue with how we track events that shouldn't be aggregated

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* fixed mapping of events to protobuf

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* icmp code values in aggregated events do not matter

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* regenerate openapi types

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* added a comment re: unbounded unacked events

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* reset aggregated event type to unknown

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* fix event aggregation test

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* used the source port of the earliest event

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* add tracking of window starts and ends

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* updated openapi spec

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* reverted changes to generate.sh

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* cleanup handling of not-aggregated events + test

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* responded to feedback + small fixes

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* small fix in a test

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* another test

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* force setting non-empty rule id on aggregated events

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* fixed a couple of issues flagged by coderabbit

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* fix spelling

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

* handle exhausted retry backoffs

Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>

---------

Signed-off-by: Dmitri <dmitri.external@netbird.io>
Signed-off-by: Dmitri Dolguikh <dmitri.external@netbird.io>
---
 client/internal/netflow/logger/logger.go      |   8 +-
 client/internal/netflow/manager.go            | 115 ++++--
 .../netflow/manager_integration_test.go       | 291 ++++++++++++++
 .../netflow/store/event_aggregation_test.go   | 362 ++++++++++++++++++
 client/internal/netflow/store/memory.go       | 106 ++++-
 client/internal/netflow/types/types.go        |  33 +-
 flow/client/client.go                         |   2 +-
 flow/proto/flow.pb.go                         | 165 +++++---
 flow/proto/flow.proto                         |   6 +
 flow/proto/flow_grpc.pb.go                    |  94 ++---
 shared/management/http/api/openapi.yml        |  27 ++
 shared/management/http/api/types.gen.go       |  21 +-
 12 files changed, 1081 insertions(+), 149 deletions(-)
 create mode 100644 client/internal/netflow/manager_integration_test.go
 create mode 100644 client/internal/netflow/store/event_aggregation_test.go

diff --git a/client/internal/netflow/logger/logger.go b/client/internal/netflow/logger/logger.go
index 8f8e68784..deb38bc4d 100644
--- a/client/internal/netflow/logger/logger.go
+++ b/client/internal/netflow/logger/logger.go
@@ -27,7 +27,7 @@ type Logger struct {
 	wgIfaceNetV6       netip.Prefix
 	dnsCollection      atomic.Bool
 	exitNodeCollection atomic.Bool
-	Store              types.Store
+	Store              types.AggregatingStore
 }
 
 func New(statusRecorder *peer.Status, wgIfaceIPNet, wgIfaceIPNetV6 netip.Prefix) *Logger {
@@ -35,7 +35,7 @@ func New(statusRecorder *peer.Status, wgIfaceIPNet, wgIfaceIPNetV6 netip.Prefix)
 		statusRecorder: statusRecorder,
 		wgIfaceNet:     wgIfaceIPNet,
 		wgIfaceNetV6:   wgIfaceIPNetV6,
-		Store:          store.NewMemoryStore(),
+		Store:          store.NewAggregatingMemoryStore(),
 	}
 }
 
@@ -125,6 +125,10 @@ func (l *Logger) stop() {
 	l.mux.Unlock()
 }
 
+func (l *Logger) ResetAggregationWindow() types.FlowEventAggregator {
+	return l.Store.ResetAggregationWindow()
+}
+
 func (l *Logger) GetEvents() []*types.Event {
 	return l.Store.GetEvents()
 }
diff --git a/client/internal/netflow/manager.go b/client/internal/netflow/manager.go
index eff083dbf..43d61b771 100644
--- a/client/internal/netflow/manager.go
+++ b/client/internal/netflow/manager.go
@@ -9,12 +9,14 @@ import (
 	"sync"
 	"time"
 
+	"github.com/cenkalti/backoff/v4"
 	"github.com/google/uuid"
 	log "github.com/sirupsen/logrus"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/netbirdio/netbird/client/internal/netflow/conntrack"
 	"github.com/netbirdio/netbird/client/internal/netflow/logger"
+	"github.com/netbirdio/netbird/client/internal/netflow/store"
 	nftypes "github.com/netbirdio/netbird/client/internal/netflow/types"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/flow/client"
@@ -23,14 +25,16 @@ import (
 
 // Manager handles netflow tracking and logging
 type Manager struct {
-	mux            sync.Mutex
-	shutdownWg     sync.WaitGroup
-	logger         nftypes.FlowLogger
-	flowConfig     *nftypes.FlowConfig
-	conntrack      nftypes.ConnTracker
-	receiverClient *client.GRPCClient
-	publicKey      []byte
-	cancel         context.CancelFunc
+	mux               sync.Mutex
+	shutdownWg        sync.WaitGroup
+	logger            nftypes.FlowLogger
+	flowConfig        *nftypes.FlowConfig
+	conntrack         nftypes.ConnTracker
+	receiverClient    *client.GRPCClient
+	eventsWithoutAcks nftypes.Store
+	publicKey         []byte
+	cancel            context.CancelFunc
+	retryInterval     time.Duration
 }
 
 // NewManager creates a new netflow manager
@@ -48,9 +52,11 @@ func NewManager(iface nftypes.IFaceMapper, publicKey []byte, statusRecorder *pee
 	}
 
 	return &Manager{
-		logger:    flowLogger,
-		conntrack: ct,
-		publicKey: publicKey,
+		logger:            flowLogger,
+		conntrack:         ct,
+		publicKey:         publicKey,
+		retryInterval:     time.Second,
+		eventsWithoutAcks: store.NewMemoryStore(),
 	}
 }
 
@@ -66,6 +72,7 @@ func (m *Manager) needsNewClient(previous *nftypes.FlowConfig) bool {
 }
 
 // enableFlow starts components for flow tracking
+// must be called under m.mux lock
 func (m *Manager) enableFlow(previous *nftypes.FlowConfig) error {
 	// first make sender ready so events don't pile up
 	if m.needsNewClient(previous) {
@@ -85,6 +92,7 @@ func (m *Manager) enableFlow(previous *nftypes.FlowConfig) error {
 	return nil
 }
 
+// must be called under m.mux lock
 func (m *Manager) resetClient() error {
 	if m.receiverClient != nil {
 		if err := m.receiverClient.Close(); err != nil {
@@ -107,14 +115,19 @@ func (m *Manager) resetClient() error {
 	ctx, cancel := context.WithCancel(context.Background())
 	m.cancel = cancel
 
-	m.shutdownWg.Add(2)
+	m.shutdownWg.Add(3)
+	flowConfigInterval := m.flowConfig.Interval
 	go func() {
 		defer m.shutdownWg.Done()
-		m.receiveACKs(ctx, flowClient)
+		m.receiveACKs(ctx, flowClient, flowConfigInterval)
 	}()
 	go func() {
 		defer m.shutdownWg.Done()
-		m.startSender(ctx)
+		m.startSender(ctx, flowConfigInterval)
+	}()
+	go func() {
+		defer m.shutdownWg.Done()
+		m.startRetries(ctx, flowConfigInterval)
 	}()
 
 	return nil
@@ -198,8 +211,8 @@ func (m *Manager) GetLogger() nftypes.FlowLogger {
 	return m.logger
 }
 
-func (m *Manager) startSender(ctx context.Context) {
-	ticker := time.NewTicker(m.flowConfig.Interval)
+func (m *Manager) startSender(ctx context.Context, flowConfigInterval time.Duration) {
+	ticker := time.NewTicker(flowConfigInterval)
 	defer ticker.Stop()
 
 	for {
@@ -207,27 +220,29 @@ func (m *Manager) startSender(ctx context.Context) {
 		case <-ctx.Done():
 			return
 		case <-ticker.C:
-			events := m.logger.GetEvents()
+			collectedEvents := m.logger.ResetAggregationWindow()
+			events := collectedEvents.GetAggregatedEvents()
 			for _, event := range events {
+				m.eventsWithoutAcks.StoreEvent(event)
 				if err := m.send(event); err != nil {
 					log.Errorf("failed to send flow event to server: %v", err)
-					continue
+				} else {
+					log.Tracef("sent flow event: %s", event.ID)
 				}
-				log.Tracef("sent flow event: %s", event.ID)
 			}
 		}
 	}
 }
 
-func (m *Manager) receiveACKs(ctx context.Context, client *client.GRPCClient) {
-	err := client.Receive(ctx, m.flowConfig.Interval, func(ack *proto.FlowEventAck) error {
+func (m *Manager) receiveACKs(ctx context.Context, client *client.GRPCClient, flowConfigInterval time.Duration) {
+	err := client.Receive(ctx, flowConfigInterval, func(ack *proto.FlowEventAck) error {
 		id, err := uuid.FromBytes(ack.EventId)
 		if err != nil {
 			log.Warnf("failed to convert ack event id to uuid: %v", err)
 			return nil
 		}
 		log.Tracef("received flow event ack: %s", id)
-		m.logger.DeleteEvents([]uuid.UUID{id})
+		m.eventsWithoutAcks.DeleteEvents([]uuid.UUID{id})
 		return nil
 	})
 
@@ -236,6 +251,51 @@ func (m *Manager) receiveACKs(ctx context.Context, client *client.GRPCClient) {
 	}
 }
 
+// We effectively never drop events (see MaxInterval), which makes eventsWithoutAcks unbounded.
+// We may want to limit the max size of the store, and start dropping oldest events when the threshold is reached.
+func (m *Manager) startRetries(ctx context.Context, flowConfigInterval time.Duration) {
+	timer := time.NewTimer(m.retryInterval)
+	retryBackoff := backoff.WithContext(&backoff.ExponentialBackOff{
+		InitialInterval:     1 * time.Second,
+		RandomizationFactor: 0.5,
+		Multiplier:          1.7,
+		MaxInterval:         flowConfigInterval / 2,
+		MaxElapsedTime:      3 * 30 * 24 * time.Hour, // 3 months
+		Stop:                backoff.Stop,
+		Clock:               backoff.SystemClock,
+	}, ctx)
+	defer timer.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-timer.C:
+			resetBackoff := true
+			for _, e := range m.eventsWithoutAcks.GetEvents() {
+				if e.Timestamp.Add(time.Second).After(time.Now()) {
+					// grace period on retries to avoid early retries
+					// do not retry if the event is less than 1 sec old
+					continue
+				}
+				if err := m.send(e); err != nil {
+					if nextBackoff := retryBackoff.NextBackOff(); nextBackoff != backoff.Stop {
+						timer = time.NewTimer(nextBackoff)
+						resetBackoff = false
+					} else {
+						resetBackoff = true // we exhausted retries, reset retry loop
+					}
+					break
+				}
+			}
+			if resetBackoff { // use regular retry interval in absence of network errors
+				retryBackoff.Reset()
+				timer = time.NewTimer(m.retryInterval)
+			}
+		}
+	}
+}
+
 func (m *Manager) send(event *nftypes.Event) error {
 	m.mux.Lock()
 	client := m.receiverClient
@@ -250,9 +310,11 @@ func (m *Manager) send(event *nftypes.Event) error {
 
 func toProtoEvent(publicKey []byte, event *nftypes.Event) *proto.FlowEvent {
 	protoEvent := &proto.FlowEvent{
-		EventId:   event.ID[:],
-		Timestamp: timestamppb.New(event.Timestamp),
-		PublicKey: publicKey,
+		EventId:     event.ID[:],
+		Timestamp:   timestamppb.New(event.Timestamp),
+		PublicKey:   publicKey,
+		WindowStart: timestamppb.New(event.WindowStart),
+		WindowEnd:   timestamppb.New(event.WindowEnd),
 		FlowFields: &proto.FlowFields{
 			FlowId:           event.FlowID[:],
 			RuleId:           event.RuleID,
@@ -267,6 +329,9 @@ func toProtoEvent(publicKey []byte, event *nftypes.Event) *proto.FlowEvent {
 			TxBytes:          event.TxBytes,
 			SourceResourceId: event.SourceResourceID,
 			DestResourceId:   event.DestResourceID,
+			NumOfStarts:      event.NumOfStarts,
+			NumOfEnds:        event.NumOfEnds,
+			NumOfDrops:       event.NumOfDrops,
 		},
 	}
 
diff --git a/client/internal/netflow/manager_integration_test.go b/client/internal/netflow/manager_integration_test.go
new file mode 100644
index 000000000..9029bdda2
--- /dev/null
+++ b/client/internal/netflow/manager_integration_test.go
@@ -0,0 +1,291 @@
+package netflow
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/netip"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/internal/netflow/types"
+	"github.com/netbirdio/netbird/flow/proto"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"google.golang.org/grpc"
+)
+
+type testServer struct {
+	proto.UnimplementedFlowServiceServer
+	events         chan *proto.FlowEvent
+	acks           chan *proto.FlowEventAck
+	grpcSrv        *grpc.Server
+	addr           string
+	handlerDone    chan struct{} // signaled each time Events() exits
+	handlerStarted chan struct{} // signaled each time Events() begins
+}
+
+func newTestServer(t *testing.T) *testServer {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+
+	s := &testServer{
+		events:         make(chan *proto.FlowEvent, 100),
+		acks:           make(chan *proto.FlowEventAck, 100),
+		grpcSrv:        grpc.NewServer(),
+		addr:           listener.Addr().String(),
+		handlerDone:    make(chan struct{}, 10),
+		handlerStarted: make(chan struct{}, 10),
+	}
+
+	proto.RegisterFlowServiceServer(s.grpcSrv, s)
+
+	go func() {
+		if err := s.grpcSrv.Serve(listener); err != nil && !errors.Is(err, grpc.ErrServerStopped) {
+			t.Logf("server error: %v", err)
+		}
+	}()
+
+	t.Cleanup(func() {
+		s.grpcSrv.Stop()
+	})
+
+	return s
+}
+
+func (s *testServer) Events(stream proto.FlowService_EventsServer) error {
+	defer func() {
+		select {
+		case s.handlerDone <- struct{}{}:
+		default:
+		}
+	}()
+
+	err := stream.Send(&proto.FlowEventAck{IsInitiator: true})
+	if err != nil {
+		return err
+	}
+
+	select {
+	case s.handlerStarted <- struct{}{}:
+	default:
+	}
+
+	ctx, cancel := context.WithCancel(stream.Context())
+	defer cancel()
+
+	go func() {
+		defer cancel()
+		for {
+			event, err := stream.Recv()
+			if err != nil {
+				return
+			}
+
+			if !event.IsInitiator {
+				select {
+				case s.events <- event:
+				case <-ctx.Done():
+					return
+				}
+			}
+		}
+	}()
+
+	for {
+		select {
+		case ack := <-s.acks:
+			if err := stream.Send(ack); err != nil {
+				return err
+			}
+		case <-ctx.Done():
+			return ctx.Err()
+		}
+	}
+}
+
+func TestSendEventReceiveAck(t *testing.T) {
+	_, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	t.Cleanup(cancel)
+
+	server := newTestServer(t)
+	manager := createManager(t, server.addr, 60*time.Second) // set high to prevent retries in this test
+	defer manager.Close()
+
+	assert.Eventually(t, func() bool {
+		select {
+		case <-server.handlerStarted:
+			return true
+		default:
+			return false
+		}
+	}, 3*time.Second, 100*time.Millisecond)
+
+	event1 := types.EventFields{
+		FlowID:    uuid.New(),
+		Type:      types.TypeStart,
+		Direction: types.Ingress,
+		DestIP:    ipAddr("172.16.1.2"),
+		DestPort:  2345,
+		Protocol:  6,
+	}
+	manager.logger.StoreEvent(event1)
+	event2 := types.EventFields{
+		FlowID:    uuid.New(),
+		Type:      types.TypeStart,
+		Direction: types.Ingress,
+		DestIP:    ipAddr("172.16.1.1"),
+		DestPort:  1234,
+		Protocol:  6,
+	}
+	manager.logger.StoreEvent(event2)
+
+	// verify the server received logged events
+	serverSideEvents := make([]*proto.FlowEvent, 0)
+	assert.Eventually(t, func() bool {
+		select {
+		case event := <-server.events:
+			serverSideEvents = append(serverSideEvents, event)
+			if len(serverSideEvents) == 2 {
+				return true
+			}
+		default:
+			if len(serverSideEvents) == 2 {
+				return true
+			}
+		}
+		return false
+	}, 5*time.Second, 100*time.Millisecond)
+
+	serverSideFlowIds := make([]uuid.UUID, 0, 2)
+	slices.Values(serverSideEvents)(func(e *proto.FlowEvent) bool {
+		id, err := uuid.FromBytes(e.FlowFields.FlowId)
+		assert.NoError(t, err)
+		serverSideFlowIds = append(serverSideFlowIds, id)
+		return true
+	})
+	assert.ElementsMatch(t, []uuid.UUID{event1.FlowID, event2.FlowID}, serverSideFlowIds)
+
+	// verify the manager tracks un-acked events
+	unackedEvents := manager.eventsWithoutAcks.GetEvents()
+	assert.Len(t, unackedEvents, 2)
+	flowIds := make([]uuid.UUID, 0)
+	slices.Values(unackedEvents)(func(e *types.Event) bool {
+		flowIds = append(flowIds, e.FlowID)
+		return true
+	})
+	assert.ElementsMatch(t, flowIds, []uuid.UUID{event1.FlowID, event2.FlowID})
+}
+
+// verify handling of retries:
+//   - unacked events are retried
+//   - when acks arrive, events are removed from the un-acked event tracker
+func TestRetryEvents(t *testing.T) {
+	_, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	t.Cleanup(cancel)
+
+	server := newTestServer(t)
+	manager := createManager(t, server.addr, time.Second) // set low to start retries sooner
+	defer manager.Close()
+
+	assert.Eventually(t, func() bool {
+		select {
+		case <-server.handlerStarted:
+			return true
+		default:
+			return false
+		}
+	}, 3*time.Second, 100*time.Millisecond)
+
+	event1 := types.EventFields{
+		FlowID:    uuid.New(),
+		Type:      types.TypeStart,
+		Direction: types.Ingress,
+		DestIP:    ipAddr("172.16.1.2"),
+		DestPort:  2345,
+		Protocol:  6,
+	}
+	manager.logger.StoreEvent(event1)
+	event2 := types.EventFields{
+		FlowID:    uuid.New(),
+		Type:      types.TypeStart,
+		Direction: types.Ingress,
+		DestIP:    ipAddr("172.16.1.1"),
+		DestPort:  1234,
+		Protocol:  6,
+	}
+	manager.logger.StoreEvent(event2)
+
+	// verify the server received retries of logged events
+	serverSideEvents := make([]*proto.FlowEvent, 0)
+	func() {
+		c := time.After(2500 * time.Millisecond)
+		for {
+			select {
+			case event := <-server.events:
+				serverSideEvents = append(serverSideEvents, event)
+			case <-c:
+				return
+			}
+		}
+	}()
+	assert.True(t, len(serverSideEvents) > 2) // must see retries
+
+	uniqueServerSideEvents := make(map[uuid.UUID]*proto.FlowEvent)
+	slices.Values(serverSideEvents)(func(e *proto.FlowEvent) bool {
+		id, err := uuid.FromBytes(e.FlowFields.FlowId)
+		assert.NoError(t, err)
+		uniqueServerSideEvents[id] = e
+		return true
+	})
+	assert.Contains(t, uniqueServerSideEvents, event1.FlowID)
+	assert.Contains(t, uniqueServerSideEvents, event2.FlowID)
+
+	// ack events
+	server.acks <- &proto.FlowEventAck{EventId: uniqueServerSideEvents[event1.FlowID].EventId}
+	server.acks <- &proto.FlowEventAck{EventId: uniqueServerSideEvents[event2.FlowID].EventId}
+
+	assert.EventuallyWithT(t, func(c *assert.CollectT) {
+		unackedEvents := manager.eventsWithoutAcks.GetEvents()
+		assert.Empty(c, unackedEvents)
+
+	}, 3*time.Second, 100*time.Millisecond)
+}
+
+func createManager(t *testing.T, serverAddr string, retryInterval time.Duration) *Manager {
+	t.Helper()
+
+	mockIFace := &mockIFaceMapper{
+		address: wgaddr.Address{
+			Network: netip.MustParsePrefix("192.168.1.1/32"),
+		},
+		isUserspaceBind: true,
+	}
+
+	publicKey := []byte("test-public-key")
+	manager := NewManager(mockIFace, publicKey, nil)
+	manager.retryInterval = retryInterval
+
+	initialConfig := &types.FlowConfig{
+		Enabled:        true,
+		URL:            fmt.Sprintf("http://%s", serverAddr),
+		TokenPayload:   "initial-payload",
+		TokenSignature: "initial-signature",
+		Interval:       500 * time.Millisecond,
+	}
+
+	err := manager.Update(initialConfig)
+	require.NoError(t, err)
+
+	return manager
+}
+
+func ipAddr(a string) netip.Addr {
+	addr, _ := netip.ParseAddr(a)
+	return addr
+}
diff --git a/client/internal/netflow/store/event_aggregation_test.go b/client/internal/netflow/store/event_aggregation_test.go
new file mode 100644
index 000000000..c0422e8b7
--- /dev/null
+++ b/client/internal/netflow/store/event_aggregation_test.go
@@ -0,0 +1,362 @@
+package store
+
+import (
+	"math/rand"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/netbirdio/netbird/client/internal/netflow/types"
+	"github.com/stretchr/testify/assert"
+)
+
+var random = rand.New(rand.NewSource(time.Now().UnixNano()))
+
+func TestFlowAggregation(t *testing.T) {
+	var protocols = []types.Protocol{types.ICMP, types.ICMPv6, types.TCP, types.UDP}
+	var tests = []struct {
+		description string
+		addresses   [][]netip.Addr
+		dstPort     uint16
+		eventTypes  []types.Type
+	}{
+		{
+			description: "start and stop",
+			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}, {netip.MustParseAddr("3.3.3.3"), netip.MustParseAddr("2.2.2.2")}},
+			dstPort:     uint16(random.Uint32() >> 16),
+			eventTypes:  []types.Type{types.TypeStart, types.TypeEnd},
+		},
+		{
+			description: "start and drop",
+			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}, {netip.MustParseAddr("3.3.3.3"), netip.MustParseAddr("2.2.2.2")}},
+			dstPort:     uint16(random.Uint32() >> 16),
+			eventTypes:  []types.Type{types.TypeStart, types.TypeDrop},
+		},
+		{
+			description: "start only",
+			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}, {netip.MustParseAddr("3.3.3.3"), netip.MustParseAddr("2.2.2.2")}},
+			dstPort:     uint16(random.Uint32() >> 16),
+			eventTypes:  []types.Type{types.TypeStart},
+		},
+		{
+			description: "drop only",
+			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}, {netip.MustParseAddr("3.3.3.3"), netip.MustParseAddr("2.2.2.2")}},
+			dstPort:     uint16(random.Uint32() >> 16),
+			eventTypes:  []types.Type{types.TypeDrop},
+		}}
+
+	for _, protocol := range protocols {
+		for _, tt := range tests {
+			t.Run(tt.description+" "+protocol.String(), func(t *testing.T) {
+				store := NewAggregatingMemoryStore()
+				store.WindowEnd = time.Now().Add(5 * time.Second)
+
+				allExpected := make([]*types.Event, 0)
+
+				for _, srcAndDst := range tt.addresses {
+					inEvents, expected := generateEvents(srcAndDst[0], srcAndDst[1], tt.dstPort, tt.eventTypes, protocol, types.Ingress, 0, store.WindowStart, store.WindowEnd)
+					for _, e := range inEvents {
+						store.StoreEvent(e)
+					}
+					allExpected = append(allExpected, expected)
+				}
+
+				events := store.GetAggregatedEvents()
+				assert.ElementsMatch(t, events, allExpected)
+			})
+		}
+	}
+}
+
+func TestIcmpEventAggregation(t *testing.T) {
+	var protocols = []types.Protocol{types.ICMP, types.ICMPv6}
+	var icmpTypes = []uint8{1, 2, 3}
+
+	var tests = []struct {
+		description string
+		addresses   [][]netip.Addr
+		eventTypes  []types.Type
+	}{
+		{
+			description: "start and stop",
+			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}},
+			eventTypes:  []types.Type{types.TypeStart, types.TypeEnd},
+		},
+		{
+			description: "start and drop",
+			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}},
+			eventTypes:  []types.Type{types.TypeStart, types.TypeDrop},
+		},
+		{
+			description: "start only",
+			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}},
+			eventTypes:  []types.Type{types.TypeStart},
+		},
+		{
+			description: "drop only",
+			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}},
+			eventTypes:  []types.Type{types.TypeDrop},
+		}}
+
+	for _, protocol := range protocols {
+		for _, tt := range tests {
+			t.Run(tt.description+" "+protocol.String(), func(t *testing.T) {
+				store := NewAggregatingMemoryStore()
+				store.WindowEnd = time.Now().Add(5 * time.Second)
+
+				allExpected := make([]*types.Event, 0)
+				for _, icmpType := range icmpTypes {
+					events, expected := generateEvents(tt.addresses[0][0], tt.addresses[0][1], 0, tt.eventTypes, protocol, types.Ingress, icmpType, store.WindowStart, store.WindowEnd)
+					for _, e := range events {
+						store.StoreEvent(e)
+					}
+					allExpected = append(allExpected, expected)
+				}
+				aggregatedEvents := store.GetAggregatedEvents()
+				assert.Len(t, aggregatedEvents, len(allExpected))
+				assert.ElementsMatch(t, aggregatedEvents, allExpected)
+			})
+		}
+	}
+}
+
+func TestFlowAggregationOfUnknownProtocols(t *testing.T) {
+	var tests = []struct {
+		description string
+		addresses   [][]netip.Addr
+		dstPort     uint16
+		eventTypes  []types.Type
+	}{
+		{
+			description: "start and stop",
+			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}, {netip.MustParseAddr("3.3.3.3"), netip.MustParseAddr("2.2.2.2")}},
+			dstPort:     uint16(random.Uint32() >> 16),
+			eventTypes:  []types.Type{types.TypeStart, types.TypeEnd},
+		},
+		{
+			description: "start and drop",
+			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}, {netip.MustParseAddr("3.3.3.3"), netip.MustParseAddr("2.2.2.2")}},
+			dstPort:     uint16(random.Uint32() >> 16),
+			eventTypes:  []types.Type{types.TypeStart, types.TypeDrop},
+		},
+		{
+			description: "start only",
+			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}, {netip.MustParseAddr("3.3.3.3"), netip.MustParseAddr("2.2.2.2")}},
+			dstPort:     uint16(random.Uint32() >> 16),
+			eventTypes:  []types.Type{types.TypeStart},
+		},
+		{
+			description: "drop only",
+			addresses:   [][]netip.Addr{{netip.MustParseAddr("1.1.1.1"), netip.MustParseAddr("2.2.2.2")}, {netip.MustParseAddr("3.3.3.3"), netip.MustParseAddr("2.2.2.2")}},
+			dstPort:     uint16(random.Uint32() >> 16),
+			eventTypes:  []types.Type{types.TypeDrop},
+		}}
+
+	for _, tt := range tests {
+		t.Run(tt.description+" "+types.ProtocolUnknown.String(), func(t *testing.T) {
+			store := NewAggregatingMemoryStore()
+			store.WindowEnd = time.Now().Add(5 * time.Second)
+
+			allExpected := make([]*types.Event, 0)
+
+			for _, srcAndDst := range tt.addresses {
+				inEvents, expected := generateEventsForUnknownProtocol(srcAndDst[0], srcAndDst[1], tt.dstPort, tt.eventTypes, types.ProtocolUnknown, types.Ingress, store.WindowStart, store.WindowEnd)
+				for _, e := range inEvents {
+					store.StoreEvent(e)
+				}
+				allExpected = append(allExpected, expected...)
+			}
+
+			events := store.GetAggregatedEvents()
+			assert.ElementsMatch(t, events, allExpected)
+		})
+	}
+}
+
+func TestResetAggregationWindow(t *testing.T) {
+	store := NewAggregatingMemoryStore()
+	store.StoreEvent(&types.Event{
+		ID:        uuid.New(),
+		Timestamp: time.Now(),
+		EventFields: types.EventFields{
+			FlowID:           uuid.New(),
+			Type:             types.TypeStart,
+			Protocol:         types.TCP,
+			RuleID:           []byte("rule-id-1"),
+			Direction:        types.Ingress,
+			SourceIP:         netip.MustParseAddr("1.1.1.1"),
+			SourcePort:       1234,
+			DestIP:           netip.MustParseAddr("2.2.2.2"),
+			DestPort:         5678,
+			SourceResourceID: []byte("source-resource-id"),
+			DestResourceID:   []byte("dest-resource-id"),
+			RxPackets:        random.Uint64(),
+			TxPackets:        random.Uint64(),
+			RxBytes:          random.Uint64(),
+			TxBytes:          random.Uint64(),
+		},
+	})
+
+	reset := store.ResetAggregationWindow()
+	previousEvents, ok := reset.(*AggregatingMemory)
+	assert.True(t, ok)
+	assert.NotEqual(t, previousEvents.WindowStart, store.WindowStart)
+	assert.Equal(t, previousEvents.WindowEnd, store.WindowStart)
+	assert.NotEmpty(t, previousEvents.events)
+	assert.Empty(t, store.events)
+}
+
+func generateEvents(srcIp, dstIp netip.Addr, dstPort uint16, eventTypes []types.Type, protocol types.Protocol,
+	direction types.Direction, icmpType uint8, windowStart, windowEnd time.Time) ([]*types.Event, *types.Event) {
+	var rxPackets, txPackets, rxBytes, txBytes uint64
+	inEvents := make([]*types.Event, 0)
+	ts := time.Now()
+	flowId := uuid.New()
+	srcPort := uint16(random.Uint32() >> 16)
+
+	for idx, eventType := range eventTypes {
+		e := &types.Event{
+			ID:        uuid.New(),
+			Timestamp: ts.Add(time.Duration(idx) * time.Second),
+			EventFields: types.EventFields{
+				FlowID:           flowId,
+				Type:             eventType,
+				Protocol:         protocol,
+				RuleID:           []byte("rule-id-1"),
+				Direction:        direction,
+				SourceIP:         srcIp,
+				SourcePort:       srcPort,
+				DestIP:           dstIp,
+				DestPort:         dstPort,
+				SourceResourceID: []byte("source-resource-id"),
+				DestResourceID:   []byte("dest-resource-id"),
+				RxPackets:        random.Uint64(),
+				TxPackets:        random.Uint64(),
+				RxBytes:          random.Uint64(),
+				TxBytes:          random.Uint64(),
+			}}
+		rxBytes += e.RxBytes
+		txBytes += e.TxBytes
+		rxPackets += e.RxPackets
+		txPackets += e.TxPackets
+		inEvents = append(inEvents, e)
+		if protocol == types.ICMP || protocol == types.ICMPv6 {
+			e.ICMPType = icmpType
+		}
+	}
+
+	var start, end, drop uint64
+	for _, eventType := range eventTypes {
+		switch eventType {
+		case types.TypeStart:
+			start += 1
+		case types.TypeDrop:
+			drop += 1
+		case types.TypeEnd:
+			end += 1
+		}
+	}
+	aggregatedEvent := &types.Event{
+		ID:          inEvents[0].ID,
+		Timestamp:   inEvents[0].Timestamp,
+		WindowStart: windowStart,
+		WindowEnd:   windowEnd,
+		EventFields: types.EventFields{
+			FlowID:           flowId,
+			Type:             types.TypeUnknown,
+			Protocol:         inEvents[0].Protocol,
+			RuleID:           []byte("rule-id-1"),
+			Direction:        inEvents[0].Direction,
+			SourceIP:         srcIp,
+			SourcePort:       srcPort,
+			DestIP:           dstIp,
+			DestPort:         dstPort,
+			SourceResourceID: []byte("source-resource-id"),
+			DestResourceID:   []byte("dest-resource-id"),
+			RxPackets:        rxPackets,
+			TxPackets:        txPackets,
+			RxBytes:          rxBytes,
+			TxBytes:          txBytes,
+			NumOfStarts:      start,
+			NumOfEnds:        end,
+			NumOfDrops:       drop,
+		}}
+	if protocol == types.ICMP || protocol == types.ICMPv6 {
+		aggregatedEvent.ICMPType = icmpType
+	}
+
+	return inEvents, aggregatedEvent
+}
+
+func generateEventsForUnknownProtocol(srcIp, dstIp netip.Addr, dstPort uint16, eventTypes []types.Type, protocol types.Protocol,
+	direction types.Direction, windowStart, windowEnd time.Time) ([]*types.Event, []*types.Event) {
+	inEvents := make([]*types.Event, 0)
+	expectedEvents := make([]*types.Event, 0)
+
+	ts := time.Now()
+	flowId := uuid.New()
+	srcPort := uint16(random.Uint32() >> 16)
+
+	for idx, eventType := range eventTypes {
+		e := &types.Event{
+			ID:        uuid.New(),
+			Timestamp: ts.Add(time.Duration(idx) * time.Second),
+			EventFields: types.EventFields{
+				FlowID:           flowId,
+				Type:             eventType,
+				Protocol:         protocol,
+				RuleID:           []byte("rule-id-1"),
+				Direction:        direction,
+				SourceIP:         srcIp,
+				SourcePort:       srcPort,
+				DestIP:           dstIp,
+				DestPort:         dstPort,
+				SourceResourceID: []byte("source-resource-id"),
+				DestResourceID:   []byte("dest-resource-id"),
+				RxPackets:        random.Uint64(),
+				TxPackets:        random.Uint64(),
+				RxBytes:          random.Uint64(),
+				TxBytes:          random.Uint64(),
+			}}
+		inEvents = append(inEvents, e)
+
+		var start, end, drop uint64
+		switch eventType {
+		case types.TypeStart:
+			start = 1
+		case types.TypeDrop:
+			drop = 1
+		case types.TypeEnd:
+			end = 1
+		}
+
+		expectedEvents = append(expectedEvents, &types.Event{
+			ID:          e.ID,
+			Timestamp:   e.Timestamp,
+			WindowStart: windowStart,
+			WindowEnd:   windowEnd,
+			EventFields: types.EventFields{
+				FlowID:           flowId,
+				Type:             types.TypeUnknown,
+				Protocol:         e.Protocol,
+				RuleID:           []byte("rule-id-1"),
+				Direction:        e.Direction,
+				SourceIP:         srcIp,
+				SourcePort:       srcPort,
+				DestIP:           dstIp,
+				DestPort:         dstPort,
+				SourceResourceID: []byte("source-resource-id"),
+				DestResourceID:   []byte("dest-resource-id"),
+				RxPackets:        e.RxPackets,
+				TxPackets:        e.TxPackets,
+				RxBytes:          e.RxBytes,
+				TxBytes:          e.TxBytes,
+				NumOfStarts:      start,
+				NumOfEnds:        end,
+				NumOfDrops:       drop,
+			}})
+	}
+
+	return inEvents, expectedEvents
+}
diff --git a/client/internal/netflow/store/memory.go b/client/internal/netflow/store/memory.go
index a44505e96..a34e4be63 100644
--- a/client/internal/netflow/store/memory.go
+++ b/client/internal/netflow/store/memory.go
@@ -1,10 +1,15 @@
 package store
 
 import (
+	"maps"
+	"math/rand"
+	v2 "math/rand/v2"
+	"net/netip"
+	"slices"
 	"sync"
+	"time"
 
 	"github.com/google/uuid"
-
 	"github.com/netbirdio/netbird/client/internal/netflow/types"
 )
 
@@ -19,6 +24,13 @@ type Memory struct {
 	events map[uuid.UUID]*types.Event
 }
 
+type AggregatingMemory struct {
+	Memory
+	WindowStart time.Time
+	WindowEnd   time.Time
+	rnd         *v2.PCG
+}
+
 func (m *Memory) StoreEvent(event *types.Event) {
 	m.mux.Lock()
 	defer m.mux.Unlock()
@@ -48,3 +60,95 @@ func (m *Memory) DeleteEvents(ids []uuid.UUID) {
 		delete(m.events, id)
 	}
 }
+
+func NewAggregatingMemoryStore() *AggregatingMemory {
+	return &AggregatingMemory{WindowStart: time.Now(), Memory: Memory{events: make(map[uuid.UUID]*types.Event)}, rnd: v2.NewPCG(rand.Uint64(), rand.Uint64())}
+}
+
+func (am *AggregatingMemory) ResetAggregationWindow() types.FlowEventAggregator {
+	am.mux.Lock()
+	defer am.mux.Unlock()
+
+	now := time.Now()
+	toret := AggregatingMemory{WindowStart: am.WindowStart, WindowEnd: now, Memory: Memory{events: am.events}, rnd: v2.NewPCG(rand.Uint64(), rand.Uint64())}
+
+	am.events = make(map[uuid.UUID]*types.Event)
+	am.WindowStart = now
+
+	return &toret
+}
+
+type aggregationKey struct {
+	srcAddr   netip.Addr
+	destAddr  netip.Addr
+	destPort  uint16
+	direction int
+	protocol  uint8
+	icmpType  uint8
+	unique    uint64 // used to prevent aggregation on non icmp/udp/tcp events
+}
+
+func (am *AggregatingMemory) GetAggregatedEvents() []*types.Event {
+	am.mux.Lock()
+	defer am.mux.Unlock()
+
+	aggregated := make(map[aggregationKey]*types.Event)
+	for _, v := range am.events {
+		lookupKey := aggregationKey{srcAddr: v.SourceIP, destAddr: v.DestIP, destPort: v.DestPort, direction: int(v.Direction), protocol: uint8(v.Protocol), icmpType: v.ICMPType}
+		if _, ok := aggregated[lookupKey]; !ok {
+			event := v.Clone()
+
+			switch event.Type {
+			case types.TypeStart:
+				event.NumOfStarts += 1
+			case types.TypeDrop:
+				event.NumOfDrops += 1
+			case types.TypeEnd:
+				event.NumOfEnds += 1
+			}
+			event.Type = types.TypeUnknown
+
+			// Please note that ICMPCode field isn't propagated by the manager (see flow/proto/flow.pb.go, FlowFields struct)
+			// so the field value in an icmp event in the "aggregated" doesn't matter
+
+			event.WindowStart = am.WindowStart
+			event.WindowEnd = am.WindowEnd
+
+			if event.Protocol != types.ICMP && event.Protocol != types.ICMPv6 && event.Protocol != types.UDP && event.Protocol != types.TCP {
+				lookupKey.unique = am.rnd.Uint64() // to make the lookup key unique so we don't aggregate on it
+			}
+
+			aggregated[lookupKey] = event
+			continue
+		}
+
+		aggregatedEvent := aggregated[lookupKey]
+		if aggregatedEvent.Protocol != types.ICMP && aggregatedEvent.Protocol != types.ICMPv6 && aggregatedEvent.Protocol != types.UDP && aggregatedEvent.Protocol != types.TCP {
+			continue // we don't aggregate this type of events; shouldn't ever get here
+		}
+
+		// track the number of connections, duration?, open and close events?
+		aggregatedEvent.RxBytes += v.RxBytes
+		aggregatedEvent.RxPackets += v.RxPackets
+		aggregatedEvent.TxBytes += v.TxBytes
+		aggregatedEvent.TxPackets += v.TxPackets
+		switch v.Type {
+		case types.TypeStart:
+			aggregatedEvent.NumOfStarts += 1
+		case types.TypeDrop:
+			aggregatedEvent.NumOfDrops += 1
+		case types.TypeEnd:
+			aggregatedEvent.NumOfEnds += 1
+		}
+		if aggregatedEvent.Timestamp.Compare(v.Timestamp) > 0 {
+			aggregatedEvent.Timestamp = v.Timestamp
+			aggregatedEvent.ID = v.ID
+			aggregatedEvent.SourcePort = v.SourcePort
+		}
+		if len(aggregatedEvent.RuleID) == 0 && len(v.RuleID) != 0 {
+			aggregatedEvent.RuleID = slices.Clone(v.RuleID)
+		}
+	}
+
+	return slices.Collect(maps.Values(aggregated)) // could return an iterator instead here
+}
diff --git a/client/internal/netflow/types/types.go b/client/internal/netflow/types/types.go
index 3f7d0d0ad..ccb2da66b 100644
--- a/client/internal/netflow/types/types.go
+++ b/client/internal/netflow/types/types.go
@@ -2,6 +2,7 @@ package types
 
 import (
 	"net/netip"
+	"slices"
 	"strconv"
 	"time"
 
@@ -69,8 +70,10 @@ const (
 )
 
 type Event struct {
-	ID        uuid.UUID
-	Timestamp time.Time
+	ID          uuid.UUID
+	Timestamp   time.Time
+	WindowStart time.Time
+	WindowEnd   time.Time
 	EventFields
 }
 
@@ -92,6 +95,17 @@ type EventFields struct {
 	TxPackets        uint64
 	RxBytes          uint64
 	TxBytes          uint64
+	NumOfStarts      uint64
+	NumOfEnds        uint64
+	NumOfDrops       uint64
+}
+
+func (e *Event) Clone() *Event {
+	toret := *e
+	toret.RuleID = slices.Clone(e.RuleID)
+	toret.SourceResourceID = slices.Clone(e.SourceResourceID)
+	toret.DestResourceID = slices.Clone(e.DestResourceID)
+	return &toret
 }
 
 type FlowConfig struct {
@@ -114,13 +128,15 @@ type FlowManager interface {
 	GetLogger() FlowLogger
 }
 
+type FlowEventAggregator interface {
+	ResetAggregationWindow() FlowEventAggregator
+	GetAggregatedEvents() []*Event
+}
+
 type FlowLogger interface {
+	ResetAggregationWindow() FlowEventAggregator
 	// StoreEvent stores a flow event
 	StoreEvent(flowEvent EventFields)
-	// GetEvents returns all stored events
-	GetEvents() []*Event
-	// DeleteEvents deletes events from the store
-	DeleteEvents([]uuid.UUID)
 	// Close closes the logger
 	Close()
 	// Enable enables the flow logger receiver
@@ -140,6 +156,11 @@ type Store interface {
 	Close()
 }
 
+type AggregatingStore interface {
+	FlowEventAggregator
+	Store
+}
+
 // ConnTracker defines the interface for connection tracking functionality
 type ConnTracker interface {
 	// Start begins tracking connections by listening for conntrack events.
diff --git a/flow/client/client.go b/flow/client/client.go
index 180a4b441..3f31c2464 100644
--- a/flow/client/client.go
+++ b/flow/client/client.go
@@ -109,7 +109,7 @@ func (c *GRPCClient) Close() error {
 func (c *GRPCClient) Send(event *proto.FlowEvent) error {
 	c.mu.Lock()
 	stream := c.stream
-	c.mu.Unlock()
+	defer c.mu.Unlock() // stream.Send() is not safe to call concurrently from multiple goroutines
 
 	if stream == nil {
 		return errors.New("stream not initialized")
diff --git a/flow/proto/flow.pb.go b/flow/proto/flow.pb.go
index 04e6e3792..710024f0e 100644
--- a/flow/proto/flow.pb.go
+++ b/flow/proto/flow.pb.go
@@ -134,9 +134,11 @@ type FlowEvent struct {
 	// When the event occurred
 	Timestamp *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
 	// Public key of the sending peer
-	PublicKey   []byte      `protobuf:"bytes,3,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
-	FlowFields  *FlowFields `protobuf:"bytes,4,opt,name=flow_fields,json=flowFields,proto3" json:"flow_fields,omitempty"`
-	IsInitiator bool        `protobuf:"varint,5,opt,name=isInitiator,proto3" json:"isInitiator,omitempty"`
+	PublicKey   []byte                 `protobuf:"bytes,3,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
+	FlowFields  *FlowFields            `protobuf:"bytes,4,opt,name=flow_fields,json=flowFields,proto3" json:"flow_fields,omitempty"`
+	IsInitiator bool                   `protobuf:"varint,5,opt,name=isInitiator,proto3" json:"isInitiator,omitempty"`
+	WindowStart *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=window_start,json=windowStart,proto3" json:"window_start,omitempty"`
+	WindowEnd   *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=window_end,json=windowEnd,proto3" json:"window_end,omitempty"`
 }
 
 func (x *FlowEvent) Reset() {
@@ -206,6 +208,20 @@ func (x *FlowEvent) GetIsInitiator() bool {
 	return false
 }
 
+func (x *FlowEvent) GetWindowStart() *timestamppb.Timestamp {
+	if x != nil {
+		return x.WindowStart
+	}
+	return nil
+}
+
+func (x *FlowEvent) GetWindowEnd() *timestamppb.Timestamp {
+	if x != nil {
+		return x.WindowEnd
+	}
+	return nil
+}
+
 type FlowEventAck struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -284,7 +300,6 @@ type FlowFields struct {
 	// Layer 4 -specific information
 	//
 	// Types that are assignable to ConnectionInfo:
-	//
 	//	*FlowFields_PortInfo
 	//	*FlowFields_IcmpInfo
 	ConnectionInfo isFlowFields_ConnectionInfo `protobuf_oneof:"connection_info"`
@@ -297,6 +312,9 @@ type FlowFields struct {
 	// Resource ID
 	SourceResourceId []byte `protobuf:"bytes,14,opt,name=source_resource_id,json=sourceResourceId,proto3" json:"source_resource_id,omitempty"`
 	DestResourceId   []byte `protobuf:"bytes,15,opt,name=dest_resource_id,json=destResourceId,proto3" json:"dest_resource_id,omitempty"`
+	NumOfStarts      uint64 `protobuf:"varint,16,opt,name=num_of_starts,json=numOfStarts,proto3" json:"num_of_starts,omitempty"`
+	NumOfEnds        uint64 `protobuf:"varint,17,opt,name=num_of_ends,json=numOfEnds,proto3" json:"num_of_ends,omitempty"`
+	NumOfDrops       uint64 `protobuf:"varint,18,opt,name=num_of_drops,json=numOfDrops,proto3" json:"num_of_drops,omitempty"`
 }
 
 func (x *FlowFields) Reset() {
@@ -443,6 +461,27 @@ func (x *FlowFields) GetDestResourceId() []byte {
 	return nil
 }
 
+func (x *FlowFields) GetNumOfStarts() uint64 {
+	if x != nil {
+		return x.NumOfStarts
+	}
+	return 0
+}
+
+func (x *FlowFields) GetNumOfEnds() uint64 {
+	if x != nil {
+		return x.NumOfEnds
+	}
+	return 0
+}
+
+func (x *FlowFields) GetNumOfDrops() uint64 {
+	if x != nil {
+		return x.NumOfDrops
+	}
+	return 0
+}
+
 type isFlowFields_ConnectionInfo interface {
 	isFlowFields_ConnectionInfo()
 }
@@ -579,7 +618,7 @@ var file_flow_proto_rawDesc = []byte{
 	0x0a, 0x0a, 0x66, 0x6c, 0x6f, 0x77, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x04, 0x66, 0x6c,
 	0x6f, 0x77, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
 	0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x22, 0xd4, 0x01, 0x0a, 0x09, 0x46, 0x6c, 0x6f, 0x77, 0x45, 0x76, 0x65, 0x6e,
+	0x6f, 0x74, 0x6f, 0x22, 0xce, 0x02, 0x0a, 0x09, 0x46, 0x6c, 0x6f, 0x77, 0x45, 0x76, 0x65, 0x6e,
 	0x74, 0x12, 0x19, 0x0a, 0x08, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20,
 	0x01, 0x28, 0x0c, 0x52, 0x07, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x38, 0x0a, 0x09,
 	0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32,
@@ -592,45 +631,59 @@ var file_flow_proto_rawDesc = []byte{
 	0x77, 0x2e, 0x46, 0x6c, 0x6f, 0x77, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x73, 0x52, 0x0a, 0x66, 0x6c,
 	0x6f, 0x77, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x73, 0x12, 0x20, 0x0a, 0x0b, 0x69, 0x73, 0x49, 0x6e,
 	0x69, 0x74, 0x69, 0x61, 0x74, 0x6f, 0x72, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x69,
-	0x73, 0x49, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x74, 0x6f, 0x72, 0x22, 0x4b, 0x0a, 0x0c, 0x46, 0x6c,
-	0x6f, 0x77, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x41, 0x63, 0x6b, 0x12, 0x19, 0x0a, 0x08, 0x65, 0x76,
-	0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x65, 0x76,
-	0x65, 0x6e, 0x74, 0x49, 0x64, 0x12, 0x20, 0x0a, 0x0b, 0x69, 0x73, 0x49, 0x6e, 0x69, 0x74, 0x69,
-	0x61, 0x74, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x69, 0x73, 0x49, 0x6e,
-	0x69, 0x74, 0x69, 0x61, 0x74, 0x6f, 0x72, 0x22, 0x9c, 0x04, 0x0a, 0x0a, 0x46, 0x6c, 0x6f, 0x77,
-	0x46, 0x69, 0x65, 0x6c, 0x64, 0x73, 0x12, 0x17, 0x0a, 0x07, 0x66, 0x6c, 0x6f, 0x77, 0x5f, 0x69,
-	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x66, 0x6c, 0x6f, 0x77, 0x49, 0x64, 0x12,
-	0x1e, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x0a, 0x2e,
-	0x66, 0x6c, 0x6f, 0x77, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12,
-	0x17, 0x0a, 0x07, 0x72, 0x75, 0x6c, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c,
-	0x52, 0x06, 0x72, 0x75, 0x6c, 0x65, 0x49, 0x64, 0x12, 0x2d, 0x0a, 0x09, 0x64, 0x69, 0x72, 0x65,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x0f, 0x2e, 0x66, 0x6c,
-	0x6f, 0x77, 0x2e, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x09, 0x64, 0x69,
-	0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x63, 0x6f, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x63, 0x6f, 0x6c, 0x12, 0x1b, 0x0a, 0x09, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x70,
-	0x18, 0x06, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x70,
-	0x12, 0x17, 0x0a, 0x07, 0x64, 0x65, 0x73, 0x74, 0x5f, 0x69, 0x70, 0x18, 0x07, 0x20, 0x01, 0x28,
-	0x0c, 0x52, 0x06, 0x64, 0x65, 0x73, 0x74, 0x49, 0x70, 0x12, 0x2d, 0x0a, 0x09, 0x70, 0x6f, 0x72,
-	0x74, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x66,
-	0x6c, 0x6f, 0x77, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x48, 0x00, 0x52, 0x08,
-	0x70, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x2d, 0x0a, 0x09, 0x69, 0x63, 0x6d, 0x70,
-	0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x66, 0x6c,
-	0x6f, 0x77, 0x2e, 0x49, 0x43, 0x4d, 0x50, 0x49, 0x6e, 0x66, 0x6f, 0x48, 0x00, 0x52, 0x08, 0x69,
-	0x63, 0x6d, 0x70, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x1d, 0x0a, 0x0a, 0x72, 0x78, 0x5f, 0x70, 0x61,
-	0x63, 0x6b, 0x65, 0x74, 0x73, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x72, 0x78, 0x50,
-	0x61, 0x63, 0x6b, 0x65, 0x74, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x78, 0x5f, 0x70, 0x61, 0x63,
-	0x6b, 0x65, 0x74, 0x73, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x74, 0x78, 0x50, 0x61,
-	0x63, 0x6b, 0x65, 0x74, 0x73, 0x12, 0x19, 0x0a, 0x08, 0x72, 0x78, 0x5f, 0x62, 0x79, 0x74, 0x65,
-	0x73, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x04, 0x52, 0x07, 0x72, 0x78, 0x42, 0x79, 0x74, 0x65, 0x73,
-	0x12, 0x19, 0x0a, 0x08, 0x74, 0x78, 0x5f, 0x62, 0x79, 0x74, 0x65, 0x73, 0x18, 0x0d, 0x20, 0x01,
-	0x28, 0x04, 0x52, 0x07, 0x74, 0x78, 0x42, 0x79, 0x74, 0x65, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69,
-	0x64, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x10, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x64, 0x12, 0x28, 0x0a, 0x10, 0x64, 0x65, 0x73,
-	0x74, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x0f, 0x20,
-	0x01, 0x28, 0x0c, 0x52, 0x0e, 0x64, 0x65, 0x73, 0x74, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x49, 0x64, 0x42, 0x11, 0x0a, 0x0f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x73, 0x49, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x74, 0x6f, 0x72, 0x12, 0x3d, 0x0a, 0x0c, 0x77, 0x69,
+	0x6e, 0x64, 0x6f, 0x77, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
+	0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0b, 0x77, 0x69,
+	0x6e, 0x64, 0x6f, 0x77, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x39, 0x0a, 0x0a, 0x77, 0x69, 0x6e,
+	0x64, 0x6f, 0x77, 0x5f, 0x65, 0x6e, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
+	0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x77, 0x69, 0x6e, 0x64, 0x6f,
+	0x77, 0x45, 0x6e, 0x64, 0x22, 0x4b, 0x0a, 0x0c, 0x46, 0x6c, 0x6f, 0x77, 0x45, 0x76, 0x65, 0x6e,
+	0x74, 0x41, 0x63, 0x6b, 0x12, 0x19, 0x0a, 0x08, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x49, 0x64, 0x12,
+	0x20, 0x0a, 0x0b, 0x69, 0x73, 0x49, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x74, 0x6f, 0x72, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x69, 0x73, 0x49, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x74, 0x6f,
+	0x72, 0x22, 0x82, 0x05, 0x0a, 0x0a, 0x46, 0x6c, 0x6f, 0x77, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x73,
+	0x12, 0x17, 0x0a, 0x07, 0x66, 0x6c, 0x6f, 0x77, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0c, 0x52, 0x06, 0x66, 0x6c, 0x6f, 0x77, 0x49, 0x64, 0x12, 0x1e, 0x0a, 0x04, 0x74, 0x79, 0x70,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x0a, 0x2e, 0x66, 0x6c, 0x6f, 0x77, 0x2e, 0x54,
+	0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x17, 0x0a, 0x07, 0x72, 0x75, 0x6c,
+	0x65, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x72, 0x75, 0x6c, 0x65,
+	0x49, 0x64, 0x12, 0x2d, 0x0a, 0x09, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x0f, 0x2e, 0x66, 0x6c, 0x6f, 0x77, 0x2e, 0x44, 0x69, 0x72,
+	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x09, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x0d, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x1b, 0x0a,
+	0x09, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x70, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0c,
+	0x52, 0x08, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x70, 0x12, 0x17, 0x0a, 0x07, 0x64, 0x65,
+	0x73, 0x74, 0x5f, 0x69, 0x70, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x64, 0x65, 0x73,
+	0x74, 0x49, 0x70, 0x12, 0x2d, 0x0a, 0x09, 0x70, 0x6f, 0x72, 0x74, 0x5f, 0x69, 0x6e, 0x66, 0x6f,
+	0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x66, 0x6c, 0x6f, 0x77, 0x2e, 0x50, 0x6f,
+	0x72, 0x74, 0x49, 0x6e, 0x66, 0x6f, 0x48, 0x00, 0x52, 0x08, 0x70, 0x6f, 0x72, 0x74, 0x49, 0x6e,
+	0x66, 0x6f, 0x12, 0x2d, 0x0a, 0x09, 0x69, 0x63, 0x6d, 0x70, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x18,
+	0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x66, 0x6c, 0x6f, 0x77, 0x2e, 0x49, 0x43, 0x4d,
+	0x50, 0x49, 0x6e, 0x66, 0x6f, 0x48, 0x00, 0x52, 0x08, 0x69, 0x63, 0x6d, 0x70, 0x49, 0x6e, 0x66,
+	0x6f, 0x12, 0x1d, 0x0a, 0x0a, 0x72, 0x78, 0x5f, 0x70, 0x61, 0x63, 0x6b, 0x65, 0x74, 0x73, 0x18,
+	0x0a, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x72, 0x78, 0x50, 0x61, 0x63, 0x6b, 0x65, 0x74, 0x73,
+	0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x78, 0x5f, 0x70, 0x61, 0x63, 0x6b, 0x65, 0x74, 0x73, 0x18, 0x0b,
+	0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x74, 0x78, 0x50, 0x61, 0x63, 0x6b, 0x65, 0x74, 0x73, 0x12,
+	0x19, 0x0a, 0x08, 0x72, 0x78, 0x5f, 0x62, 0x79, 0x74, 0x65, 0x73, 0x18, 0x0c, 0x20, 0x01, 0x28,
+	0x04, 0x52, 0x07, 0x72, 0x78, 0x42, 0x79, 0x74, 0x65, 0x73, 0x12, 0x19, 0x0a, 0x08, 0x74, 0x78,
+	0x5f, 0x62, 0x79, 0x74, 0x65, 0x73, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x04, 0x52, 0x07, 0x74, 0x78,
+	0x42, 0x79, 0x74, 0x65, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f,
+	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x0e, 0x20, 0x01, 0x28,
+	0x0c, 0x52, 0x10, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x49, 0x64, 0x12, 0x28, 0x0a, 0x10, 0x64, 0x65, 0x73, 0x74, 0x5f, 0x72, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0e, 0x64,
+	0x65, 0x73, 0x74, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x64, 0x12, 0x22, 0x0a,
+	0x0d, 0x6e, 0x75, 0x6d, 0x5f, 0x6f, 0x66, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x73, 0x18, 0x10,
+	0x20, 0x01, 0x28, 0x04, 0x52, 0x0b, 0x6e, 0x75, 0x6d, 0x4f, 0x66, 0x53, 0x74, 0x61, 0x72, 0x74,
+	0x73, 0x12, 0x1e, 0x0a, 0x0b, 0x6e, 0x75, 0x6d, 0x5f, 0x6f, 0x66, 0x5f, 0x65, 0x6e, 0x64, 0x73,
+	0x18, 0x11, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x6e, 0x75, 0x6d, 0x4f, 0x66, 0x45, 0x6e, 0x64,
+	0x73, 0x12, 0x20, 0x0a, 0x0c, 0x6e, 0x75, 0x6d, 0x5f, 0x6f, 0x66, 0x5f, 0x64, 0x72, 0x6f, 0x70,
+	0x73, 0x18, 0x12, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0a, 0x6e, 0x75, 0x6d, 0x4f, 0x66, 0x44, 0x72,
+	0x6f, 0x70, 0x73, 0x42, 0x11, 0x0a, 0x0f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
 	0x6e, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x22, 0x48, 0x0a, 0x08, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e,
 	0x66, 0x6f, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x70, 0x6f, 0x72,
 	0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0a, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50,
@@ -683,17 +736,19 @@ var file_flow_proto_goTypes = []interface{}{
 var file_flow_proto_depIdxs = []int32{
 	7, // 0: flow.FlowEvent.timestamp:type_name -> google.protobuf.Timestamp
 	4, // 1: flow.FlowEvent.flow_fields:type_name -> flow.FlowFields
-	0, // 2: flow.FlowFields.type:type_name -> flow.Type
-	1, // 3: flow.FlowFields.direction:type_name -> flow.Direction
-	5, // 4: flow.FlowFields.port_info:type_name -> flow.PortInfo
-	6, // 5: flow.FlowFields.icmp_info:type_name -> flow.ICMPInfo
-	2, // 6: flow.FlowService.Events:input_type -> flow.FlowEvent
-	3, // 7: flow.FlowService.Events:output_type -> flow.FlowEventAck
-	7, // [7:8] is the sub-list for method output_type
-	6, // [6:7] is the sub-list for method input_type
-	6, // [6:6] is the sub-list for extension type_name
-	6, // [6:6] is the sub-list for extension extendee
-	0, // [0:6] is the sub-list for field type_name
+	7, // 2: flow.FlowEvent.window_start:type_name -> google.protobuf.Timestamp
+	7, // 3: flow.FlowEvent.window_end:type_name -> google.protobuf.Timestamp
+	0, // 4: flow.FlowFields.type:type_name -> flow.Type
+	1, // 5: flow.FlowFields.direction:type_name -> flow.Direction
+	5, // 6: flow.FlowFields.port_info:type_name -> flow.PortInfo
+	6, // 7: flow.FlowFields.icmp_info:type_name -> flow.ICMPInfo
+	2, // 8: flow.FlowService.Events:input_type -> flow.FlowEvent
+	3, // 9: flow.FlowService.Events:output_type -> flow.FlowEventAck
+	9, // [9:10] is the sub-list for method output_type
+	8, // [8:9] is the sub-list for method input_type
+	8, // [8:8] is the sub-list for extension type_name
+	8, // [8:8] is the sub-list for extension extendee
+	0, // [0:8] is the sub-list for field type_name
 }
 
 func init() { file_flow_proto_init() }
diff --git a/flow/proto/flow.proto b/flow/proto/flow.proto
index ff5c50282..1c9e728d2 100644
--- a/flow/proto/flow.proto
+++ b/flow/proto/flow.proto
@@ -24,6 +24,9 @@ message FlowEvent {
   FlowFields flow_fields = 4;
 
   bool isInitiator = 5;
+
+  google.protobuf.Timestamp window_start = 6;
+  google.protobuf.Timestamp window_end = 7;
 }
 
 message FlowEventAck {
@@ -75,6 +78,9 @@ message FlowFields {
   bytes source_resource_id = 14;
   bytes dest_resource_id = 15;
 
+  uint64 num_of_starts = 16;
+  uint64 num_of_ends = 17;
+  uint64 num_of_drops = 18;
 }
 
 // Flow event types
diff --git a/flow/proto/flow_grpc.pb.go b/flow/proto/flow_grpc.pb.go
index b790f86a2..9ae9702a5 100644
--- a/flow/proto/flow_grpc.pb.go
+++ b/flow/proto/flow_grpc.pb.go
@@ -1,4 +1,8 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.1
+// - protoc             v3.21.9
+// source: flow.proto
 
 package proto
 
@@ -11,15 +15,19 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	FlowService_Events_FullMethodName = "/flow.FlowService/Events"
+)
 
 // FlowServiceClient is the client API for FlowService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
 type FlowServiceClient interface {
 	// Client to receiver streams of events and acknowledgements
-	Events(ctx context.Context, opts ...grpc.CallOption) (FlowService_EventsClient, error)
+	Events(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[FlowEvent, FlowEventAck], error)
 }
 
 type flowServiceClient struct {
@@ -30,54 +38,40 @@ func NewFlowServiceClient(cc grpc.ClientConnInterface) FlowServiceClient {
 	return &flowServiceClient{cc}
 }
 
-func (c *flowServiceClient) Events(ctx context.Context, opts ...grpc.CallOption) (FlowService_EventsClient, error) {
-	stream, err := c.cc.NewStream(ctx, &FlowService_ServiceDesc.Streams[0], "/flow.FlowService/Events", opts...)
+func (c *flowServiceClient) Events(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[FlowEvent, FlowEventAck], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &FlowService_ServiceDesc.Streams[0], FlowService_Events_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &flowServiceEventsClient{stream}
+	x := &grpc.GenericClientStream[FlowEvent, FlowEventAck]{ClientStream: stream}
 	return x, nil
 }
 
-type FlowService_EventsClient interface {
-	Send(*FlowEvent) error
-	Recv() (*FlowEventAck, error)
-	grpc.ClientStream
-}
-
-type flowServiceEventsClient struct {
-	grpc.ClientStream
-}
-
-func (x *flowServiceEventsClient) Send(m *FlowEvent) error {
-	return x.ClientStream.SendMsg(m)
-}
-
-func (x *flowServiceEventsClient) Recv() (*FlowEventAck, error) {
-	m := new(FlowEventAck)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type FlowService_EventsClient = grpc.BidiStreamingClient[FlowEvent, FlowEventAck]
 
 // FlowServiceServer is the server API for FlowService service.
 // All implementations must embed UnimplementedFlowServiceServer
-// for forward compatibility
+// for forward compatibility.
 type FlowServiceServer interface {
 	// Client to receiver streams of events and acknowledgements
-	Events(FlowService_EventsServer) error
+	Events(grpc.BidiStreamingServer[FlowEvent, FlowEventAck]) error
 	mustEmbedUnimplementedFlowServiceServer()
 }
 
-// UnimplementedFlowServiceServer must be embedded to have forward compatible implementations.
-type UnimplementedFlowServiceServer struct {
-}
+// UnimplementedFlowServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedFlowServiceServer struct{}
 
-func (UnimplementedFlowServiceServer) Events(FlowService_EventsServer) error {
-	return status.Errorf(codes.Unimplemented, "method Events not implemented")
+func (UnimplementedFlowServiceServer) Events(grpc.BidiStreamingServer[FlowEvent, FlowEventAck]) error {
+	return status.Error(codes.Unimplemented, "method Events not implemented")
 }
 func (UnimplementedFlowServiceServer) mustEmbedUnimplementedFlowServiceServer() {}
+func (UnimplementedFlowServiceServer) testEmbeddedByValue()                     {}
 
 // UnsafeFlowServiceServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to FlowServiceServer will
@@ -87,34 +81,22 @@ type UnsafeFlowServiceServer interface {
 }
 
 func RegisterFlowServiceServer(s grpc.ServiceRegistrar, srv FlowServiceServer) {
+	// If the following call panics, it indicates UnimplementedFlowServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&FlowService_ServiceDesc, srv)
 }
 
 func _FlowService_Events_Handler(srv interface{}, stream grpc.ServerStream) error {
-	return srv.(FlowServiceServer).Events(&flowServiceEventsServer{stream})
+	return srv.(FlowServiceServer).Events(&grpc.GenericServerStream[FlowEvent, FlowEventAck]{ServerStream: stream})
 }
 
-type FlowService_EventsServer interface {
-	Send(*FlowEventAck) error
-	Recv() (*FlowEvent, error)
-	grpc.ServerStream
-}
-
-type flowServiceEventsServer struct {
-	grpc.ServerStream
-}
-
-func (x *flowServiceEventsServer) Send(m *FlowEventAck) error {
-	return x.ServerStream.SendMsg(m)
-}
-
-func (x *flowServiceEventsServer) Recv() (*FlowEvent, error) {
-	m := new(FlowEvent)
-	if err := x.ServerStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type FlowService_EventsServer = grpc.BidiStreamingServer[FlowEvent, FlowEventAck]
 
 // FlowService_ServiceDesc is the grpc.ServiceDesc for FlowService service.
 // It's only intended for direct use with grpc.RegisterService,
diff --git a/shared/management/http/api/openapi.yml b/shared/management/http/api/openapi.yml
index f746b31f4..c5492eb79 100644
--- a/shared/management/http/api/openapi.yml
+++ b/shared/management/http/api/openapi.yml
@@ -2769,6 +2769,28 @@ components:
           type: integer
           description: "Number of packets transmitted."
           example: 5
+        num_of_starts:
+          type: integer
+          description: "Number of start events."
+          example: 3
+        num_of_ends:
+          type: integer
+          description: "Number of end events."
+          example: 4
+        num_of_drops:
+          type: integer
+          description: "Number of drop events."
+          example: 5
+        window_start:
+          type: string
+          format: date-time
+          description: Timestamp of the start of the aggregation window.
+          example: 2025-03-20T16:23:58.125397Z
+        window_end:
+          type: string
+          format: date-time
+          description: Timestamp of the end of the aggregation window.
+          example: 2025-03-20T16:23:58.125397Z
         events:
           type: array
           description: "List of events that are correlated to this flow (e.g., start, end)."
@@ -2790,6 +2812,11 @@ components:
         - rx_packets
         - tx_bytes
         - tx_packets
+        - num_of_starts
+        - num_of_ends
+        - num_of_drops
+        - window_start
+        - window_end
         - events
     NetworkTrafficEventsResponse:
       type: object
diff --git a/shared/management/http/api/types.gen.go b/shared/management/http/api/types.gen.go
index 3b587c4bf..50bcd3487 100644
--- a/shared/management/http/api/types.gen.go
+++ b/shared/management/http/api/types.gen.go
@@ -3709,9 +3709,18 @@ type NetworkTrafficEvent struct {
 	Events []NetworkTrafficSubEvent `json:"events"`
 
 	// FlowId FlowID is the ID of the connection flow. Not unique because it can be the same for multiple events (e.g., start and end of the connection).
-	FlowId string               `json:"flow_id"`
-	Icmp   NetworkTrafficICMP   `json:"icmp"`
-	Policy NetworkTrafficPolicy `json:"policy"`
+	FlowId string             `json:"flow_id"`
+	Icmp   NetworkTrafficICMP `json:"icmp"`
+
+	// NumOfDrops Number of drop events.
+	NumOfDrops int `json:"num_of_drops"`
+
+	// NumOfEnds Number of end events.
+	NumOfEnds int `json:"num_of_ends"`
+
+	// NumOfStarts Number of start events.
+	NumOfStarts int                  `json:"num_of_starts"`
+	Policy      NetworkTrafficPolicy `json:"policy"`
 
 	// Protocol Protocol is the protocol of the traffic (e.g. 1 = ICMP, 6 = TCP, 17 = UDP, etc.).
 	Protocol int `json:"protocol"`
@@ -3732,6 +3741,12 @@ type NetworkTrafficEvent struct {
 	// TxPackets Number of packets transmitted.
 	TxPackets int                `json:"tx_packets"`
 	User      NetworkTrafficUser `json:"user"`
+
+	// WindowEnd Timestamp of the end of the aggregation window.
+	WindowEnd time.Time `json:"window_end"`
+
+	// WindowStart Timestamp of the start of the aggregation window.
+	WindowStart time.Time `json:"window_start"`
 }
 
 // NetworkTrafficEventsResponse defines model for NetworkTrafficEventsResponse.

From d0d6dd4b0c9f8fb53a541c9bfcccea319d85f2d2 Mon Sep 17 00:00:00 2001
From: Nicolas Frati <nicofrati@gmail.com>
Date: Tue, 7 Jul 2026 16:58:48 +0200
Subject: [PATCH 36/36] [client] add json gateway for netbird daemon (#6272)

* add json gateway for netbird daemon

* client: add optional daemon JSON socket gateway
---
 client/cmd/service.go                  |   13 +-
 client/cmd/service_controller.go       |   95 +-
 client/cmd/service_installer.go        |    8 +
 client/cmd/service_json_gateway.go     |   52 +
 client/cmd/service_json_socket_test.go |  176 ++
 client/cmd/service_params.go           |   17 +-
 client/cmd/service_params_test.go      |   28 +
 client/cmd/service_socket.go           |  111 +
 client/proto/daemon.pb.gw.go           | 2560 ++++++++++++++++++++++++
 client/proto/daemon_gateway_test.go    |   80 +
 client/proto/generate.sh               |    8 +-
 client/test/json-socket-docker.sh      |  223 +++
 go.mod                                 |    2 +
 13 files changed, 3341 insertions(+), 32 deletions(-)
 create mode 100644 client/cmd/service_json_gateway.go
 create mode 100644 client/cmd/service_json_socket_test.go
 create mode 100644 client/cmd/service_socket.go
 create mode 100644 client/proto/daemon.pb.gw.go
 create mode 100644 client/proto/daemon_gateway_test.go
 create mode 100755 client/test/json-socket-docker.sh

diff --git a/client/cmd/service.go b/client/cmd/service.go
index 56d8a8726..b0a56c71a 100644
--- a/client/cmd/service.go
+++ b/client/cmd/service.go
@@ -5,6 +5,7 @@ package cmd
 import (
 	"context"
 	"fmt"
+	"net/http"
 	"runtime"
 	"strings"
 	"sync"
@@ -22,15 +23,21 @@ var serviceCmd = &cobra.Command{
 	Short: "Manage the NetBird daemon service",
 }
 
+const defaultJSONSocket = "unix:///var/run/netbird-http.sock"
+
 var (
-	serviceName    string
-	serviceEnvVars []string
+	serviceName      string
+	serviceEnvVars   []string
+	jsonSocket       string
+	enableJSONSocket bool
 )
 
 type program struct {
 	ctx              context.Context
 	cancel           context.CancelFunc
 	serv             *grpc.Server
+	jsonServ         *http.Server
+	jsonServMu       sync.Mutex
 	serverInstance   *server.Server
 	serverInstanceMu sync.Mutex
 }
@@ -46,6 +53,8 @@ func init() {
 	serviceCmd.PersistentFlags().BoolVar(&updateSettingsDisabled, "disable-update-settings", false, "Disables update settings feature. If enabled, the client will not be able to change or edit any settings. To persist this setting, use: netbird service install --disable-update-settings")
 	serviceCmd.PersistentFlags().BoolVar(&captureEnabled, "enable-capture", false, "Enables packet capture via 'netbird debug capture'. To persist, use: netbird service install --enable-capture")
 	serviceCmd.PersistentFlags().BoolVar(&networksDisabled, "disable-networks", false, "Disables network selection. If enabled, the client will not allow listing, selecting, or deselecting networks. To persist, use: netbird service install --disable-networks")
+	serviceCmd.PersistentFlags().BoolVar(&enableJSONSocket, "enable-json-socket", false, "Enables the HTTP/JSON API socket served by grpc-gateway. To persist, use: netbird service install --enable-json-socket")
+	serviceCmd.PersistentFlags().StringVar(&jsonSocket, "json-socket", defaultJSONSocket, "HTTP/JSON API socket address [unix|tcp]://[path|host:port]. Requires --enable-json-socket to serve. To persist, use: netbird service install --enable-json-socket --json-socket")
 
 	rootCmd.PersistentFlags().StringVarP(&serviceName, "service", "s", defaultServiceName, "Netbird system service name")
 	serviceEnvDesc := `Sets extra environment variables for the service. ` +
diff --git a/client/cmd/service_controller.go b/client/cmd/service_controller.go
index 8de147946..5ef13a0a6 100644
--- a/client/cmd/service_controller.go
+++ b/client/cmd/service_controller.go
@@ -5,9 +5,6 @@ package cmd
 import (
 	"context"
 	"fmt"
-	"net"
-	"os"
-	"strings"
 	"time"
 
 	"github.com/kardianos/service"
@@ -22,41 +19,56 @@ import (
 	"github.com/netbirdio/netbird/util"
 )
 
+func validateJSONSocketFlags() error {
+	if serviceCmd.PersistentFlags().Changed("json-socket") && !enableJSONSocket {
+		return fmt.Errorf("--json-socket requires --enable-json-socket to configure the daemon JSON gateway")
+	}
+	return nil
+}
+
 func (p *program) Start(svc service.Service) error {
 	// Start should not block. Do the actual work async.
 	log.Info("starting NetBird service") //nolint
 
+	if err := validateJSONSocketFlags(); err != nil {
+		return err
+	}
+
 	// Collect static system and platform information
 	system.UpdateStaticInfoAsync()
 
 	// in any case, even if configuration does not exists we run daemon to serve CLI gRPC API.
 	p.serv = grpc.NewServer()
 
-	split := strings.Split(daemonAddr, "://")
-	switch split[0] {
-	case "unix":
-		// cleanup failed close
-		stat, err := os.Stat(split[1])
-		if err == nil && !stat.IsDir() {
-			if err := os.Remove(split[1]); err != nil {
-				log.Debugf("remove socket file: %v", err)
-			}
-		}
-	case "tcp":
-	default:
-		return fmt.Errorf("unsupported daemon address protocol: %v", split[0])
-	}
-
-	listen, err := net.Listen(split[0], split[1])
+	daemonListener, err := listenOnAddress(daemonAddr)
 	if err != nil {
 		return fmt.Errorf("listen daemon interface: %w", err)
 	}
-	go func() {
-		defer listen.Close()
 
-		if split[0] == "unix" {
-			if err := os.Chmod(split[1], 0666); err != nil {
-				log.Errorf("failed setting daemon permissions: %v", split[1])
+	var jsonListener *socketListener
+	if enableJSONSocket {
+		jsonListener, err = listenOnAddress(jsonSocket)
+		if err != nil {
+			_ = daemonListener.Close()
+			return fmt.Errorf("listen daemon JSON interface: %w", err)
+		}
+	} else {
+		removeStaleUnixSocketForAddress(jsonSocket)
+	}
+
+	go func() {
+		defer daemonListener.Close()
+		if jsonListener != nil {
+			defer jsonListener.Close()
+		}
+
+		if err := daemonListener.chmodUnixSocket("daemon"); err != nil {
+			log.Error(err)
+			return
+		}
+		if jsonListener != nil {
+			if err := jsonListener.chmodUnixSocket("daemon JSON"); err != nil {
+				log.Error(err)
 				return
 			}
 		}
@@ -71,8 +83,16 @@ func (p *program) Start(svc service.Service) error {
 		p.serverInstance = serverInstance
 		p.serverInstanceMu.Unlock()
 
-		log.Printf("started daemon server: %v", split[1])
-		if err := p.serv.Serve(listen); err != nil {
+		if jsonListener != nil {
+			if err := p.startJSONGateway(jsonListener, daemonAddr); err != nil {
+				log.Fatalf("failed to start daemon JSON server: %v", err)
+			}
+		} else {
+			log.Debug("daemon JSON socket disabled")
+		}
+
+		log.Printf("started daemon server: %v", daemonListener.address)
+		if err := p.serv.Serve(daemonListener.Listener); err != nil {
 			log.Errorf("failed to serve daemon requests: %v", err)
 		}
 	}()
@@ -92,6 +112,20 @@ func (p *program) Stop(srv service.Service) error {
 
 	p.cancel()
 
+	p.jsonServMu.Lock()
+	jsonServ := p.jsonServ
+	p.jsonServMu.Unlock()
+	if jsonServ != nil {
+		shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), 2*time.Second)
+		if err := jsonServ.Shutdown(shutdownCtx); err != nil {
+			log.Errorf("failed to stop daemon JSON server gracefully: %v", err)
+			if err := jsonServ.Close(); err != nil {
+				log.Errorf("failed to close daemon JSON server: %v", err)
+			}
+		}
+		shutdownCancel()
+	}
+
 	if p.serv != nil {
 		p.serv.Stop()
 	}
@@ -148,6 +182,9 @@ var runCmd = &cobra.Command{
 		if err != nil {
 			return err
 		}
+		if err := validateJSONSocketFlags(); err != nil {
+			return err
+		}
 
 		return s.Run()
 	},
@@ -162,6 +199,9 @@ var startCmd = &cobra.Command{
 		if err != nil {
 			return err
 		}
+		if err := validateJSONSocketFlags(); err != nil {
+			return err
+		}
 
 		if err := s.Start(); err != nil {
 			return fmt.Errorf("start service: %w", err)
@@ -198,6 +238,9 @@ var restartCmd = &cobra.Command{
 		if err != nil {
 			return err
 		}
+		if err := validateJSONSocketFlags(); err != nil {
+			return err
+		}
 
 		if err := s.Restart(); err != nil {
 			return fmt.Errorf("restart service: %w", err)
diff --git a/client/cmd/service_installer.go b/client/cmd/service_installer.go
index 2d45fa063..ae2dfb9fa 100644
--- a/client/cmd/service_installer.go
+++ b/client/cmd/service_installer.go
@@ -67,6 +67,10 @@ func buildServiceArguments() []string {
 		args = append(args, "--disable-networks")
 	}
 
+	if enableJSONSocket {
+		args = append(args, "--enable-json-socket", "--json-socket", jsonSocket)
+	}
+
 	return args
 }
 
@@ -106,6 +110,10 @@ func configurePlatformSpecificSettings(svcConfig *service.Config) error {
 
 // Create fully configured service config for install/reconfigure
 func createServiceConfigForInstall() (*service.Config, error) {
+	if err := validateJSONSocketFlags(); err != nil {
+		return nil, err
+	}
+
 	svcConfig, err := newSVCConfig()
 	if err != nil {
 		return nil, fmt.Errorf("create service config: %w", err)
diff --git a/client/cmd/service_json_gateway.go b/client/cmd/service_json_gateway.go
new file mode 100644
index 000000000..29c1a6456
--- /dev/null
+++ b/client/cmd/service_json_gateway.go
@@ -0,0 +1,52 @@
+//go:build !ios && !android
+
+package cmd
+
+import (
+	"context"
+	"errors"
+	"net"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	log "github.com/sirupsen/logrus"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+func grpcGatewayEndpoint(addr string) string {
+	return strings.TrimPrefix(addr, "tcp://")
+}
+
+func (p *program) startJSONGateway(jsonListener *socketListener, daemonEndpoint string) error {
+	mux := runtime.NewServeMux()
+	opts := []grpc.DialOption{grpc.WithTransportCredentials(insecure.NewCredentials())}
+	if err := proto.RegisterDaemonServiceHandlerFromEndpoint(p.ctx, mux, grpcGatewayEndpoint(daemonEndpoint), opts); err != nil {
+		return err
+	}
+
+	jsonServer := &http.Server{
+		Handler:           mux,
+		ReadHeaderTimeout: 5 * time.Second,
+		BaseContext: func(net.Listener) context.Context {
+			return p.ctx
+		},
+	}
+
+	p.jsonServMu.Lock()
+	p.jsonServ = jsonServer
+	p.jsonServMu.Unlock()
+
+	go func() {
+		log.Printf("started daemon JSON server: %v", jsonListener.address)
+		if err := jsonServer.Serve(jsonListener.Listener); err != nil && !errors.Is(err, http.ErrServerClosed) {
+			log.Errorf("failed to serve daemon JSON requests: %v", err)
+		}
+	}()
+
+	return nil
+}
diff --git a/client/cmd/service_json_socket_test.go b/client/cmd/service_json_socket_test.go
new file mode 100644
index 000000000..4b39794d7
--- /dev/null
+++ b/client/cmd/service_json_socket_test.go
@@ -0,0 +1,176 @@
+//go:build !ios && !android
+
+package cmd
+
+import (
+	"net"
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func preserveJSONSocketTestState(t *testing.T) {
+	t.Helper()
+
+	origJSONSocket := jsonSocket
+	origEnableJSONSocket := enableJSONSocket
+	origChanged := map[string]bool{}
+	serviceCmd.PersistentFlags().VisitAll(func(flag *pflag.Flag) {
+		origChanged[flag.Name] = flag.Changed
+	})
+
+	t.Cleanup(func() {
+		jsonSocket = origJSONSocket
+		enableJSONSocket = origEnableJSONSocket
+		serviceCmd.PersistentFlags().VisitAll(func(flag *pflag.Flag) {
+			flag.Changed = origChanged[flag.Name]
+		})
+	})
+}
+
+func TestJSONSocketFlagsArePositiveEnableOnly(t *testing.T) {
+	assert.NotNil(t, serviceCmd.PersistentFlags().Lookup("enable-json-socket"))
+	assert.NotNil(t, serviceCmd.PersistentFlags().Lookup("json-socket"))
+	assert.Nil(t, serviceCmd.PersistentFlags().Lookup("disable-json-socket"))
+	assert.Equal(t, "false", serviceCmd.PersistentFlags().Lookup("enable-json-socket").DefValue)
+}
+
+func TestBuildServiceArgumentsDefaultDisablesJSONSocket(t *testing.T) {
+	preserveJSONSocketTestState(t)
+
+	enableJSONSocket = false
+	jsonSocket = "tcp://127.0.0.1:8080"
+
+	args := buildServiceArguments()
+
+	assert.NotContains(t, args, "--enable-json-socket")
+	assert.NotContains(t, args, "--json-socket")
+}
+
+func TestBuildServiceArgumentsIncludesJSONSocketWhenEnabled(t *testing.T) {
+	preserveJSONSocketTestState(t)
+
+	enableJSONSocket = true
+	jsonSocket = "tcp://127.0.0.1:8080"
+
+	args := buildServiceArguments()
+
+	enableIndex := indexOfArg(args, "--enable-json-socket")
+	jsonIndex := indexOfArg(args, "--json-socket")
+	require.NotEqual(t, -1, enableIndex)
+	require.NotEqual(t, -1, jsonIndex)
+	require.Less(t, enableIndex, jsonIndex)
+	require.Less(t, jsonIndex+1, len(args))
+	assert.Equal(t, "tcp://127.0.0.1:8080", args[jsonIndex+1])
+}
+
+func TestJSONSocketWithoutEnableValidation(t *testing.T) {
+	preserveJSONSocketTestState(t)
+
+	enableJSONSocket = false
+	require.NoError(t, serviceCmd.PersistentFlags().Set("json-socket", "tcp://127.0.0.1:8080"))
+
+	err := validateJSONSocketFlags()
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "--enable-json-socket")
+}
+
+func TestJSONSocketWithEnableValidation(t *testing.T) {
+	preserveJSONSocketTestState(t)
+
+	require.NoError(t, serviceCmd.PersistentFlags().Set("enable-json-socket", "true"))
+	require.NoError(t, serviceCmd.PersistentFlags().Set("json-socket", "tcp://127.0.0.1:8080"))
+
+	assert.NoError(t, validateJSONSocketFlags())
+}
+
+func TestJSONSocketServiceParamsPersistEnableAndAddress(t *testing.T) {
+	preserveJSONSocketTestState(t)
+	serviceCmd.PersistentFlags().VisitAll(func(flag *pflag.Flag) {
+		flag.Changed = false
+	})
+
+	enableJSONSocket = true
+	jsonSocket = "tcp://127.0.0.1:8080"
+
+	params := currentServiceParams()
+	require.True(t, params.EnableJSONSocket)
+	require.Equal(t, "tcp://127.0.0.1:8080", params.JSONSocket)
+
+	enableJSONSocket = false
+	jsonSocket = defaultJSONSocket
+	applyServiceParams(testServiceEnvCommand(), params)
+
+	assert.True(t, enableJSONSocket)
+	assert.Equal(t, "tcp://127.0.0.1:8080", jsonSocket)
+}
+
+func TestRemoveStaleUnixSocketDoesNotRemoveRegularFile(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "netbird-http.sock")
+	require.NoError(t, os.WriteFile(path, []byte("not a socket"), 0600))
+
+	removeStaleUnixSocket(path)
+
+	data, err := os.ReadFile(path)
+	require.NoError(t, err)
+	assert.Equal(t, []byte("not a socket"), data)
+}
+
+func TestRemoveStaleUnixSocketRemovesSocket(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("unix sockets are not available on Windows")
+	}
+
+	path := filepath.Join(t.TempDir(), "netbird-http.sock")
+	addr := &net.UnixAddr{Name: path, Net: "unix"}
+	listener, err := net.ListenUnix("unix", addr)
+	require.NoError(t, err)
+	listener.SetUnlinkOnClose(false)
+	require.NoError(t, listener.Close())
+
+	_, err = os.Lstat(path)
+	require.NoError(t, err, "test setup must leave a stale Unix socket path")
+
+	removeStaleUnixSocket(path)
+
+	_, err = os.Lstat(path)
+	assert.True(t, os.IsNotExist(err), "expected stale Unix socket to be removed, got %v", err)
+}
+
+func TestRemoveStaleUnixSocketDoesNotRemoveLiveSocket(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("unix sockets are not available on Windows")
+	}
+
+	path := filepath.Join(t.TempDir(), "netbird-http.sock")
+	listener, err := net.Listen("unix", path)
+	require.NoError(t, err)
+	defer listener.Close()
+
+	removeStaleUnixSocket(path)
+
+	_, err = os.Lstat(path)
+	assert.NoError(t, err, "expected live Unix socket to be preserved")
+}
+
+func testServiceEnvCommand() *cobra.Command {
+	cmd := &cobra.Command{}
+	cmd.Flags().StringSlice("service-env", nil, "")
+	return cmd
+}
+
+func indexOfArg(args []string, arg string) int {
+	for i, candidate := range args {
+		if candidate == arg {
+			return i
+		}
+	}
+	return -1
+}
diff --git a/client/cmd/service_params.go b/client/cmd/service_params.go
index 192e0ac60..f25087a69 100644
--- a/client/cmd/service_params.go
+++ b/client/cmd/service_params.go
@@ -23,6 +23,7 @@ const serviceParamsFile = "service.json"
 type serviceParams struct {
 	LogLevel              string            `json:"log_level"`
 	DaemonAddr            string            `json:"daemon_addr"`
+	JSONSocket            string            `json:"json_socket"`
 	ManagementURL         string            `json:"management_url,omitempty"`
 	ConfigPath            string            `json:"config_path,omitempty"`
 	LogFiles              []string          `json:"log_files,omitempty"`
@@ -30,6 +31,7 @@ type serviceParams struct {
 	DisableUpdateSettings bool              `json:"disable_update_settings,omitempty"`
 	EnableCapture         bool              `json:"enable_capture,omitempty"`
 	DisableNetworks       bool              `json:"disable_networks,omitempty"`
+	EnableJSONSocket      bool              `json:"enable_json_socket,omitempty"`
 	ServiceEnvVars        map[string]string `json:"service_env_vars,omitempty"`
 }
 
@@ -75,6 +77,7 @@ func currentServiceParams() *serviceParams {
 	params := &serviceParams{
 		LogLevel:              logLevel,
 		DaemonAddr:            daemonAddr,
+		JSONSocket:            jsonSocket,
 		ManagementURL:         managementURL,
 		ConfigPath:            configPath,
 		LogFiles:              logFiles,
@@ -82,6 +85,7 @@ func currentServiceParams() *serviceParams {
 		DisableUpdateSettings: updateSettingsDisabled,
 		EnableCapture:         captureEnabled,
 		DisableNetworks:       networksDisabled,
+		EnableJSONSocket:      enableJSONSocket,
 	}
 
 	if len(serviceEnvVars) > 0 {
@@ -113,9 +117,8 @@ func applyServiceParams(cmd *cobra.Command, params *serviceParams) {
 		return
 	}
 
-	// For fields with non-empty defaults (log-level, daemon-addr), keep the
-	// != "" guard so that an older service.json missing the field doesn't
-	// clobber the default with an empty string.
+	// For fields with non-empty defaults, keep the != "" guard so that an older
+	// service.json missing the field doesn't clobber the default with an empty string.
 	if !rootCmd.PersistentFlags().Changed("log-level") && params.LogLevel != "" {
 		logLevel = params.LogLevel
 	}
@@ -124,6 +127,14 @@ func applyServiceParams(cmd *cobra.Command, params *serviceParams) {
 		daemonAddr = params.DaemonAddr
 	}
 
+	if !serviceCmd.PersistentFlags().Changed("json-socket") && params.JSONSocket != "" {
+		jsonSocket = params.JSONSocket
+	}
+
+	if !serviceCmd.PersistentFlags().Changed("enable-json-socket") {
+		enableJSONSocket = params.EnableJSONSocket
+	}
+
 	// For optional fields where empty means "use default", always apply so
 	// that an explicit clear (--management-url "") persists across reinstalls.
 	if !rootCmd.PersistentFlags().Changed("management-url") {
diff --git a/client/cmd/service_params_test.go b/client/cmd/service_params_test.go
index f338c12f4..94f98a0ce 100644
--- a/client/cmd/service_params_test.go
+++ b/client/cmd/service_params_test.go
@@ -41,6 +41,8 @@ func TestSaveAndLoadServiceParams(t *testing.T) {
 	params := &serviceParams{
 		LogLevel:              "debug",
 		DaemonAddr:            "unix:///var/run/netbird.sock",
+		JSONSocket:            "tcp://127.0.0.1:8080",
+		EnableJSONSocket:      true,
 		ManagementURL:         "https://my.server.com",
 		ConfigPath:            "/etc/netbird/config.json",
 		LogFiles:              []string{"/var/log/netbird/client.log", "console"},
@@ -63,6 +65,8 @@ func TestSaveAndLoadServiceParams(t *testing.T) {
 
 	assert.Equal(t, params.LogLevel, loaded.LogLevel)
 	assert.Equal(t, params.DaemonAddr, loaded.DaemonAddr)
+	assert.Equal(t, params.JSONSocket, loaded.JSONSocket)
+	assert.Equal(t, params.EnableJSONSocket, loaded.EnableJSONSocket)
 	assert.Equal(t, params.ManagementURL, loaded.ManagementURL)
 	assert.Equal(t, params.ConfigPath, loaded.ConfigPath)
 	assert.Equal(t, params.LogFiles, loaded.LogFiles)
@@ -101,6 +105,8 @@ func TestLoadServiceParams_InvalidJSON(t *testing.T) {
 func TestCurrentServiceParams(t *testing.T) {
 	origLogLevel := logLevel
 	origDaemonAddr := daemonAddr
+	origJSONSocket := jsonSocket
+	origEnableJSONSocket := enableJSONSocket
 	origManagementURL := managementURL
 	origConfigPath := configPath
 	origLogFiles := logFiles
@@ -110,6 +116,8 @@ func TestCurrentServiceParams(t *testing.T) {
 	t.Cleanup(func() {
 		logLevel = origLogLevel
 		daemonAddr = origDaemonAddr
+		jsonSocket = origJSONSocket
+		enableJSONSocket = origEnableJSONSocket
 		managementURL = origManagementURL
 		configPath = origConfigPath
 		logFiles = origLogFiles
@@ -120,6 +128,8 @@ func TestCurrentServiceParams(t *testing.T) {
 
 	logLevel = "trace"
 	daemonAddr = "tcp://127.0.0.1:9999"
+	jsonSocket = "tcp://127.0.0.1:8080"
+	enableJSONSocket = true
 	managementURL = "https://mgmt.example.com"
 	configPath = "/tmp/test-config.json"
 	logFiles = []string{"/tmp/test.log"}
@@ -131,6 +141,8 @@ func TestCurrentServiceParams(t *testing.T) {
 
 	assert.Equal(t, "trace", params.LogLevel)
 	assert.Equal(t, "tcp://127.0.0.1:9999", params.DaemonAddr)
+	assert.Equal(t, "tcp://127.0.0.1:8080", params.JSONSocket)
+	assert.True(t, params.EnableJSONSocket)
 	assert.Equal(t, "https://mgmt.example.com", params.ManagementURL)
 	assert.Equal(t, "/tmp/test-config.json", params.ConfigPath)
 	assert.Equal(t, []string{"/tmp/test.log"}, params.LogFiles)
@@ -142,6 +154,8 @@ func TestCurrentServiceParams(t *testing.T) {
 func TestApplyServiceParams_OnlyUnchangedFlags(t *testing.T) {
 	origLogLevel := logLevel
 	origDaemonAddr := daemonAddr
+	origJSONSocket := jsonSocket
+	origEnableJSONSocket := enableJSONSocket
 	origManagementURL := managementURL
 	origConfigPath := configPath
 	origLogFiles := logFiles
@@ -151,6 +165,8 @@ func TestApplyServiceParams_OnlyUnchangedFlags(t *testing.T) {
 	t.Cleanup(func() {
 		logLevel = origLogLevel
 		daemonAddr = origDaemonAddr
+		jsonSocket = origJSONSocket
+		enableJSONSocket = origEnableJSONSocket
 		managementURL = origManagementURL
 		configPath = origConfigPath
 		logFiles = origLogFiles
@@ -162,6 +178,8 @@ func TestApplyServiceParams_OnlyUnchangedFlags(t *testing.T) {
 	// Reset all flags to defaults.
 	logLevel = "info"
 	daemonAddr = "unix:///var/run/netbird.sock"
+	jsonSocket = defaultJSONSocket
+	enableJSONSocket = false
 	managementURL = ""
 	configPath = "/etc/netbird/config.json"
 	logFiles = []string{"/var/log/netbird/client.log"}
@@ -184,6 +202,8 @@ func TestApplyServiceParams_OnlyUnchangedFlags(t *testing.T) {
 	saved := &serviceParams{
 		LogLevel:              "debug",
 		DaemonAddr:            "tcp://127.0.0.1:5555",
+		JSONSocket:            "tcp://127.0.0.1:8080",
+		EnableJSONSocket:      true,
 		ManagementURL:         "https://saved.example.com",
 		ConfigPath:            "/saved/config.json",
 		LogFiles:              []string{"/saved/client.log"},
@@ -201,6 +221,8 @@ func TestApplyServiceParams_OnlyUnchangedFlags(t *testing.T) {
 
 	// All other fields were not Changed, so they should use saved values.
 	assert.Equal(t, "tcp://127.0.0.1:5555", daemonAddr)
+	assert.Equal(t, "tcp://127.0.0.1:8080", jsonSocket)
+	assert.True(t, enableJSONSocket)
 	assert.Equal(t, "https://saved.example.com", managementURL)
 	assert.Equal(t, "/saved/config.json", configPath)
 	assert.Equal(t, []string{"/saved/client.log"}, logFiles)
@@ -212,14 +234,17 @@ func TestApplyServiceParams_OnlyUnchangedFlags(t *testing.T) {
 func TestApplyServiceParams_BooleanRevertToFalse(t *testing.T) {
 	origProfilesDisabled := profilesDisabled
 	origUpdateSettingsDisabled := updateSettingsDisabled
+	origEnableJSONSocket := enableJSONSocket
 	t.Cleanup(func() {
 		profilesDisabled = origProfilesDisabled
 		updateSettingsDisabled = origUpdateSettingsDisabled
+		enableJSONSocket = origEnableJSONSocket
 	})
 
 	// Simulate current state where booleans are true (e.g. set by previous install).
 	profilesDisabled = true
 	updateSettingsDisabled = true
+	enableJSONSocket = true
 
 	// Reset Changed state so flags appear unset.
 	serviceCmd.PersistentFlags().VisitAll(func(f *pflag.Flag) {
@@ -238,6 +263,7 @@ func TestApplyServiceParams_BooleanRevertToFalse(t *testing.T) {
 
 	assert.False(t, profilesDisabled, "saved false should override current true")
 	assert.False(t, updateSettingsDisabled, "saved false should override current true")
+	assert.False(t, enableJSONSocket, "saved false should override current true")
 }
 
 func TestApplyServiceParams_ClearManagementURL(t *testing.T) {
@@ -530,6 +556,7 @@ func fieldToGlobalVar(field string) string {
 	m := map[string]string{
 		"LogLevel":              "logLevel",
 		"DaemonAddr":            "daemonAddr",
+		"JSONSocket":            "jsonSocket",
 		"ManagementURL":         "managementURL",
 		"ConfigPath":            "configPath",
 		"LogFiles":              "logFiles",
@@ -537,6 +564,7 @@ func fieldToGlobalVar(field string) string {
 		"DisableUpdateSettings": "updateSettingsDisabled",
 		"EnableCapture":         "captureEnabled",
 		"DisableNetworks":       "networksDisabled",
+		"EnableJSONSocket":      "enableJSONSocket",
 		"ServiceEnvVars":        "serviceEnvVars",
 	}
 	if v, ok := m[field]; ok {
diff --git a/client/cmd/service_socket.go b/client/cmd/service_socket.go
new file mode 100644
index 000000000..f825a4062
--- /dev/null
+++ b/client/cmd/service_socket.go
@@ -0,0 +1,111 @@
+//go:build !ios && !android
+
+package cmd
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"os"
+	"strings"
+	"syscall"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+)
+
+type socketListener struct {
+	net.Listener
+	network string
+	address string
+}
+
+func listenOnAddress(addr string) (*socketListener, error) {
+	network, address, err := parseListenAddress(addr)
+	if err != nil {
+		return nil, err
+	}
+
+	if network == "unix" {
+		removeStaleUnixSocket(address)
+	}
+
+	listener, err := net.Listen(network, address)
+	if err != nil {
+		return nil, err
+	}
+
+	return &socketListener{Listener: listener, network: network, address: address}, nil
+}
+
+func parseListenAddress(addr string) (string, string, error) {
+	network, address, ok := strings.Cut(addr, "://")
+	if !ok || network == "" || address == "" {
+		return "", "", fmt.Errorf("address must be in [unix|tcp]://[path|host:port] format: %q", addr)
+	}
+
+	switch network {
+	case "unix", "tcp":
+		return network, address, nil
+	default:
+		return "", "", fmt.Errorf("unsupported daemon address protocol: %v", network)
+	}
+}
+
+func removeStaleUnixSocket(path string) {
+	stat, err := os.Lstat(path)
+	if err != nil {
+		if !os.IsNotExist(err) {
+			log.Debugf("stat socket file: %v", err)
+		}
+		return
+	}
+
+	if stat.Mode()&os.ModeSocket == 0 {
+		return
+	}
+
+	if !isStaleUnixSocket(path) {
+		return
+	}
+
+	if err := os.Remove(path); err != nil {
+		log.Debugf("remove socket file: %v", err)
+	}
+}
+
+func isStaleUnixSocket(path string) bool {
+	conn, err := net.DialTimeout("unix", path, 100*time.Millisecond)
+	if err == nil {
+		if closeErr := conn.Close(); closeErr != nil {
+			log.Debugf("close unix socket probe: %v", closeErr)
+		}
+		return false
+	}
+
+	if os.IsNotExist(err) || os.IsPermission(err) || os.IsTimeout(err) {
+		log.Debugf("not removing unix socket %s after probe error: %v", path, err)
+		return false
+	}
+
+	return errors.Is(err, syscall.ECONNREFUSED)
+}
+
+func removeStaleUnixSocketForAddress(addr string) {
+	network, address, err := parseListenAddress(addr)
+	if err != nil || network != "unix" {
+		return
+	}
+	removeStaleUnixSocket(address)
+}
+
+func (l *socketListener) chmodUnixSocket(description string) error {
+	if l == nil || l.network != "unix" {
+		return nil
+	}
+
+	if err := os.Chmod(l.address, 0666); err != nil {
+		return fmt.Errorf("failed setting %s permissions for %s: %w", description, l.address, err)
+	}
+	return nil
+}
diff --git a/client/proto/daemon.pb.gw.go b/client/proto/daemon.pb.gw.go
new file mode 100644
index 000000000..a0a9690f0
--- /dev/null
+++ b/client/proto/daemon.pb.gw.go
@@ -0,0 +1,2560 @@
+// Code generated by protoc-gen-grpc-gateway. DO NOT EDIT.
+// source: daemon.proto
+
+/*
+Package proto is a reverse proxy.
+
+It translates gRPC into RESTful JSON APIs.
+*/
+package proto
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+
+	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"github.com/grpc-ecosystem/grpc-gateway/v2/utilities"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/grpclog"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+)
+
+// Suppress "imported and not used" errors
+var (
+	_ codes.Code
+	_ io.Reader
+	_ status.Status
+	_ = errors.New
+	_ = runtime.String
+	_ = utilities.NewDoubleArray
+	_ = metadata.Join
+)
+
+func request_DaemonService_Login_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq LoginRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.Login(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_Login_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq LoginRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.Login(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_WaitSSOLogin_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq WaitSSOLoginRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.WaitSSOLogin(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_WaitSSOLogin_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq WaitSSOLoginRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.WaitSSOLogin(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_Up_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq UpRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.Up(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_Up_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq UpRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.Up(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_Status_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq StatusRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.Status(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_Status_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq StatusRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.Status(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_Down_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq DownRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.Down(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_Down_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq DownRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.Down(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_GetConfig_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetConfigRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.GetConfig(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_GetConfig_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetConfigRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.GetConfig(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_ListNetworks_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ListNetworksRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.ListNetworks(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_ListNetworks_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ListNetworksRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.ListNetworks(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_SelectNetworks_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq SelectNetworksRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.SelectNetworks(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_SelectNetworks_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq SelectNetworksRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.SelectNetworks(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_DeselectNetworks_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq SelectNetworksRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.DeselectNetworks(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_DeselectNetworks_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq SelectNetworksRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.DeselectNetworks(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_ForwardingRules_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq EmptyRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.ForwardingRules(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_ForwardingRules_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq EmptyRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.ForwardingRules(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_DebugBundle_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq DebugBundleRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.DebugBundle(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_DebugBundle_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq DebugBundleRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.DebugBundle(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_GetLogLevel_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetLogLevelRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.GetLogLevel(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_GetLogLevel_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetLogLevelRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.GetLogLevel(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_SetLogLevel_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq SetLogLevelRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.SetLogLevel(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_SetLogLevel_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq SetLogLevelRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.SetLogLevel(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_ListStates_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ListStatesRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.ListStates(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_ListStates_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ListStatesRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.ListStates(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_CleanState_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq CleanStateRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.CleanState(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_CleanState_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq CleanStateRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.CleanState(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_DeleteState_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq DeleteStateRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.DeleteState(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_DeleteState_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq DeleteStateRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.DeleteState(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_SetSyncResponsePersistence_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq SetSyncResponsePersistenceRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.SetSyncResponsePersistence(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_SetSyncResponsePersistence_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq SetSyncResponsePersistenceRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.SetSyncResponsePersistence(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_TracePacket_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq TracePacketRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.TracePacket(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_TracePacket_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq TracePacketRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.TracePacket(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_StartCapture_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (DaemonService_StartCaptureClient, runtime.ServerMetadata, error) {
+	var (
+		protoReq StartCaptureRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	stream, err := client.StartCapture(ctx, &protoReq)
+	if err != nil {
+		return nil, metadata, err
+	}
+	header, err := stream.Header()
+	if err != nil {
+		return nil, metadata, err
+	}
+	metadata.HeaderMD = header
+	return stream, metadata, nil
+}
+
+func request_DaemonService_StartBundleCapture_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq StartBundleCaptureRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.StartBundleCapture(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_StartBundleCapture_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq StartBundleCaptureRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.StartBundleCapture(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_StopBundleCapture_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq StopBundleCaptureRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.StopBundleCapture(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_StopBundleCapture_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq StopBundleCaptureRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.StopBundleCapture(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_SubscribeEvents_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (DaemonService_SubscribeEventsClient, runtime.ServerMetadata, error) {
+	var (
+		protoReq SubscribeRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	stream, err := client.SubscribeEvents(ctx, &protoReq)
+	if err != nil {
+		return nil, metadata, err
+	}
+	header, err := stream.Header()
+	if err != nil {
+		return nil, metadata, err
+	}
+	metadata.HeaderMD = header
+	return stream, metadata, nil
+}
+
+func request_DaemonService_GetEvents_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetEventsRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.GetEvents(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_GetEvents_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetEventsRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.GetEvents(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_SwitchProfile_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq SwitchProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.SwitchProfile(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_SwitchProfile_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq SwitchProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.SwitchProfile(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_SetConfig_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq SetConfigRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.SetConfig(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_SetConfig_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq SetConfigRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.SetConfig(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_AddProfile_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq AddProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.AddProfile(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_AddProfile_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq AddProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.AddProfile(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_RenameProfile_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RenameProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.RenameProfile(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_RenameProfile_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RenameProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.RenameProfile(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_RemoveProfile_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RemoveProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.RemoveProfile(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_RemoveProfile_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RemoveProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.RemoveProfile(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_ListProfiles_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ListProfilesRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.ListProfiles(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_ListProfiles_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq ListProfilesRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.ListProfiles(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_GetActiveProfile_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetActiveProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.GetActiveProfile(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_GetActiveProfile_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetActiveProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.GetActiveProfile(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_Logout_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq LogoutRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.Logout(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_Logout_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq LogoutRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.Logout(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_GetFeatures_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetFeaturesRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.GetFeatures(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_GetFeatures_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetFeaturesRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.GetFeatures(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_TriggerUpdate_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq TriggerUpdateRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.TriggerUpdate(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_TriggerUpdate_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq TriggerUpdateRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.TriggerUpdate(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_GetPeerSSHHostKey_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetPeerSSHHostKeyRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.GetPeerSSHHostKey(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_GetPeerSSHHostKey_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq GetPeerSSHHostKeyRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.GetPeerSSHHostKey(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_RequestJWTAuth_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RequestJWTAuthRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.RequestJWTAuth(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_RequestJWTAuth_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RequestJWTAuthRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.RequestJWTAuth(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_WaitJWTToken_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq WaitJWTTokenRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.WaitJWTToken(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_WaitJWTToken_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq WaitJWTTokenRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.WaitJWTToken(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_StartCPUProfile_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq StartCPUProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.StartCPUProfile(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_StartCPUProfile_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq StartCPUProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.StartCPUProfile(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_StopCPUProfile_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq StopCPUProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.StopCPUProfile(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_StopCPUProfile_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq StopCPUProfileRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.StopCPUProfile(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_GetInstallerResult_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq InstallerResultRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.GetInstallerResult(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_GetInstallerResult_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq InstallerResultRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.GetInstallerResult(ctx, &protoReq)
+	return msg, metadata, err
+}
+
+func request_DaemonService_ExposeService_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (DaemonService_ExposeServiceClient, runtime.ServerMetadata, error) {
+	var (
+		protoReq ExposeServiceRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	stream, err := client.ExposeService(ctx, &protoReq)
+	if err != nil {
+		return nil, metadata, err
+	}
+	header, err := stream.Header()
+	if err != nil {
+		return nil, metadata, err
+	}
+	metadata.HeaderMD = header
+	return stream, metadata, nil
+}
+
+// RegisterDaemonServiceHandlerServer registers the http handlers for service DaemonService to "mux".
+// UnaryRPC     :call DaemonServiceServer directly.
+// StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
+// Note that using this registration option will cause many gRPC library features to stop working. Consider using RegisterDaemonServiceHandlerFromEndpoint instead.
+// GRPC interceptors will not work for this type of registration. To use interceptors, you must use the "runtime.WithMiddlewares" option in the "runtime.NewServeMux" call.
+func RegisterDaemonServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server DaemonServiceServer) error {
+	mux.Handle(http.MethodPost, pattern_DaemonService_Login_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/Login", runtime.WithHTTPPathPattern("/daemon.DaemonService/Login"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_Login_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_Login_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_WaitSSOLogin_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/WaitSSOLogin", runtime.WithHTTPPathPattern("/daemon.DaemonService/WaitSSOLogin"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_WaitSSOLogin_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_WaitSSOLogin_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_Up_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/Up", runtime.WithHTTPPathPattern("/daemon.DaemonService/Up"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_Up_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_Up_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_Status_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/Status", runtime.WithHTTPPathPattern("/daemon.DaemonService/Status"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_Status_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_Status_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_Down_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/Down", runtime.WithHTTPPathPattern("/daemon.DaemonService/Down"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_Down_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_Down_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_GetConfig_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/GetConfig", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetConfig"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_GetConfig_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_GetConfig_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_ListNetworks_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/ListNetworks", runtime.WithHTTPPathPattern("/daemon.DaemonService/ListNetworks"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_ListNetworks_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_ListNetworks_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_SelectNetworks_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/SelectNetworks", runtime.WithHTTPPathPattern("/daemon.DaemonService/SelectNetworks"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_SelectNetworks_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_SelectNetworks_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_DeselectNetworks_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/DeselectNetworks", runtime.WithHTTPPathPattern("/daemon.DaemonService/DeselectNetworks"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_DeselectNetworks_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_DeselectNetworks_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_ForwardingRules_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/ForwardingRules", runtime.WithHTTPPathPattern("/daemon.DaemonService/ForwardingRules"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_ForwardingRules_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_ForwardingRules_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_DebugBundle_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/DebugBundle", runtime.WithHTTPPathPattern("/daemon.DaemonService/DebugBundle"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_DebugBundle_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_DebugBundle_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_GetLogLevel_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/GetLogLevel", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetLogLevel"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_GetLogLevel_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_GetLogLevel_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_SetLogLevel_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/SetLogLevel", runtime.WithHTTPPathPattern("/daemon.DaemonService/SetLogLevel"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_SetLogLevel_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_SetLogLevel_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_ListStates_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/ListStates", runtime.WithHTTPPathPattern("/daemon.DaemonService/ListStates"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_ListStates_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_ListStates_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_CleanState_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/CleanState", runtime.WithHTTPPathPattern("/daemon.DaemonService/CleanState"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_CleanState_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_CleanState_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_DeleteState_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/DeleteState", runtime.WithHTTPPathPattern("/daemon.DaemonService/DeleteState"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_DeleteState_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_DeleteState_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_SetSyncResponsePersistence_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/SetSyncResponsePersistence", runtime.WithHTTPPathPattern("/daemon.DaemonService/SetSyncResponsePersistence"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_SetSyncResponsePersistence_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_SetSyncResponsePersistence_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_TracePacket_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/TracePacket", runtime.WithHTTPPathPattern("/daemon.DaemonService/TracePacket"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_TracePacket_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_TracePacket_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+
+	mux.Handle(http.MethodPost, pattern_DaemonService_StartCapture_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		err := status.Error(codes.Unimplemented, "streaming calls are not yet supported in the in-process transport")
+		_, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+		return
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_StartBundleCapture_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/StartBundleCapture", runtime.WithHTTPPathPattern("/daemon.DaemonService/StartBundleCapture"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_StartBundleCapture_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_StartBundleCapture_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_StopBundleCapture_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/StopBundleCapture", runtime.WithHTTPPathPattern("/daemon.DaemonService/StopBundleCapture"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_StopBundleCapture_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_StopBundleCapture_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+
+	mux.Handle(http.MethodPost, pattern_DaemonService_SubscribeEvents_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		err := status.Error(codes.Unimplemented, "streaming calls are not yet supported in the in-process transport")
+		_, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+		return
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_GetEvents_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/GetEvents", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetEvents"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_GetEvents_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_GetEvents_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_SwitchProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/SwitchProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/SwitchProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_SwitchProfile_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_SwitchProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_SetConfig_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/SetConfig", runtime.WithHTTPPathPattern("/daemon.DaemonService/SetConfig"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_SetConfig_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_SetConfig_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_AddProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/AddProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/AddProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_AddProfile_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_AddProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_RenameProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/RenameProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/RenameProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_RenameProfile_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_RenameProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_RemoveProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/RemoveProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/RemoveProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_RemoveProfile_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_RemoveProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_ListProfiles_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/ListProfiles", runtime.WithHTTPPathPattern("/daemon.DaemonService/ListProfiles"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_ListProfiles_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_ListProfiles_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_GetActiveProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/GetActiveProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetActiveProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_GetActiveProfile_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_GetActiveProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_Logout_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/Logout", runtime.WithHTTPPathPattern("/daemon.DaemonService/Logout"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_Logout_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_Logout_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_GetFeatures_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/GetFeatures", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetFeatures"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_GetFeatures_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_GetFeatures_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_TriggerUpdate_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/TriggerUpdate", runtime.WithHTTPPathPattern("/daemon.DaemonService/TriggerUpdate"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_TriggerUpdate_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_TriggerUpdate_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_GetPeerSSHHostKey_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/GetPeerSSHHostKey", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetPeerSSHHostKey"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_GetPeerSSHHostKey_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_GetPeerSSHHostKey_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_RequestJWTAuth_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/RequestJWTAuth", runtime.WithHTTPPathPattern("/daemon.DaemonService/RequestJWTAuth"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_RequestJWTAuth_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_RequestJWTAuth_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_WaitJWTToken_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/WaitJWTToken", runtime.WithHTTPPathPattern("/daemon.DaemonService/WaitJWTToken"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_WaitJWTToken_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_WaitJWTToken_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_StartCPUProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/StartCPUProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/StartCPUProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_StartCPUProfile_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_StartCPUProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_StopCPUProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/StopCPUProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/StopCPUProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_StopCPUProfile_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_StopCPUProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_GetInstallerResult_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/GetInstallerResult", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetInstallerResult"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_GetInstallerResult_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_GetInstallerResult_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+
+	mux.Handle(http.MethodPost, pattern_DaemonService_ExposeService_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		err := status.Error(codes.Unimplemented, "streaming calls are not yet supported in the in-process transport")
+		_, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+		return
+	})
+
+	return nil
+}
+
+// RegisterDaemonServiceHandlerFromEndpoint is same as RegisterDaemonServiceHandler but
+// automatically dials to "endpoint" and closes the connection when "ctx" gets done.
+func RegisterDaemonServiceHandlerFromEndpoint(ctx context.Context, mux *runtime.ServeMux, endpoint string, opts []grpc.DialOption) (err error) {
+	conn, err := grpc.NewClient(endpoint, opts...)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if err != nil {
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Errorf("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+			return
+		}
+		go func() {
+			<-ctx.Done()
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Errorf("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+		}()
+	}()
+	return RegisterDaemonServiceHandler(ctx, mux, conn)
+}
+
+// RegisterDaemonServiceHandler registers the http handlers for service DaemonService to "mux".
+// The handlers forward requests to the grpc endpoint over "conn".
+func RegisterDaemonServiceHandler(ctx context.Context, mux *runtime.ServeMux, conn *grpc.ClientConn) error {
+	return RegisterDaemonServiceHandlerClient(ctx, mux, NewDaemonServiceClient(conn))
+}
+
+// RegisterDaemonServiceHandlerClient registers the http handlers for service DaemonService
+// to "mux". The handlers forward requests to the grpc endpoint over the given implementation of "DaemonServiceClient".
+// Note: the gRPC framework executes interceptors within the gRPC handler. If the passed in "DaemonServiceClient"
+// doesn't go through the normal gRPC flow (creating a gRPC client etc.) then it will be up to the passed in
+// "DaemonServiceClient" to call the correct interceptors. This client ignores the HTTP middlewares.
+func RegisterDaemonServiceHandlerClient(ctx context.Context, mux *runtime.ServeMux, client DaemonServiceClient) error {
+	mux.Handle(http.MethodPost, pattern_DaemonService_Login_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/Login", runtime.WithHTTPPathPattern("/daemon.DaemonService/Login"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_Login_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_Login_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_WaitSSOLogin_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/WaitSSOLogin", runtime.WithHTTPPathPattern("/daemon.DaemonService/WaitSSOLogin"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_WaitSSOLogin_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_WaitSSOLogin_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_Up_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/Up", runtime.WithHTTPPathPattern("/daemon.DaemonService/Up"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_Up_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_Up_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_Status_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/Status", runtime.WithHTTPPathPattern("/daemon.DaemonService/Status"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_Status_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_Status_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_Down_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/Down", runtime.WithHTTPPathPattern("/daemon.DaemonService/Down"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_Down_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_Down_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_GetConfig_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/GetConfig", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetConfig"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_GetConfig_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_GetConfig_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_ListNetworks_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/ListNetworks", runtime.WithHTTPPathPattern("/daemon.DaemonService/ListNetworks"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_ListNetworks_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_ListNetworks_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_SelectNetworks_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/SelectNetworks", runtime.WithHTTPPathPattern("/daemon.DaemonService/SelectNetworks"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_SelectNetworks_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_SelectNetworks_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_DeselectNetworks_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/DeselectNetworks", runtime.WithHTTPPathPattern("/daemon.DaemonService/DeselectNetworks"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_DeselectNetworks_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_DeselectNetworks_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_ForwardingRules_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/ForwardingRules", runtime.WithHTTPPathPattern("/daemon.DaemonService/ForwardingRules"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_ForwardingRules_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_ForwardingRules_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_DebugBundle_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/DebugBundle", runtime.WithHTTPPathPattern("/daemon.DaemonService/DebugBundle"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_DebugBundle_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_DebugBundle_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_GetLogLevel_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/GetLogLevel", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetLogLevel"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_GetLogLevel_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_GetLogLevel_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_SetLogLevel_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/SetLogLevel", runtime.WithHTTPPathPattern("/daemon.DaemonService/SetLogLevel"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_SetLogLevel_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_SetLogLevel_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_ListStates_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/ListStates", runtime.WithHTTPPathPattern("/daemon.DaemonService/ListStates"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_ListStates_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_ListStates_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_CleanState_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/CleanState", runtime.WithHTTPPathPattern("/daemon.DaemonService/CleanState"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_CleanState_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_CleanState_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_DeleteState_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/DeleteState", runtime.WithHTTPPathPattern("/daemon.DaemonService/DeleteState"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_DeleteState_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_DeleteState_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_SetSyncResponsePersistence_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/SetSyncResponsePersistence", runtime.WithHTTPPathPattern("/daemon.DaemonService/SetSyncResponsePersistence"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_SetSyncResponsePersistence_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_SetSyncResponsePersistence_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_TracePacket_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/TracePacket", runtime.WithHTTPPathPattern("/daemon.DaemonService/TracePacket"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_TracePacket_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_TracePacket_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_StartCapture_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/StartCapture", runtime.WithHTTPPathPattern("/daemon.DaemonService/StartCapture"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_StartCapture_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_StartCapture_0(annotatedContext, mux, outboundMarshaler, w, req, func() (proto.Message, error) { return resp.Recv() }, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_StartBundleCapture_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/StartBundleCapture", runtime.WithHTTPPathPattern("/daemon.DaemonService/StartBundleCapture"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_StartBundleCapture_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_StartBundleCapture_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_StopBundleCapture_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/StopBundleCapture", runtime.WithHTTPPathPattern("/daemon.DaemonService/StopBundleCapture"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_StopBundleCapture_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_StopBundleCapture_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_SubscribeEvents_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/SubscribeEvents", runtime.WithHTTPPathPattern("/daemon.DaemonService/SubscribeEvents"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_SubscribeEvents_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_SubscribeEvents_0(annotatedContext, mux, outboundMarshaler, w, req, func() (proto.Message, error) { return resp.Recv() }, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_GetEvents_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/GetEvents", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetEvents"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_GetEvents_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_GetEvents_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_SwitchProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/SwitchProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/SwitchProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_SwitchProfile_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_SwitchProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_SetConfig_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/SetConfig", runtime.WithHTTPPathPattern("/daemon.DaemonService/SetConfig"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_SetConfig_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_SetConfig_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_AddProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/AddProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/AddProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_AddProfile_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_AddProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_RenameProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/RenameProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/RenameProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_RenameProfile_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_RenameProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_RemoveProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/RemoveProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/RemoveProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_RemoveProfile_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_RemoveProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_ListProfiles_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/ListProfiles", runtime.WithHTTPPathPattern("/daemon.DaemonService/ListProfiles"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_ListProfiles_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_ListProfiles_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_GetActiveProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/GetActiveProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetActiveProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_GetActiveProfile_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_GetActiveProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_Logout_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/Logout", runtime.WithHTTPPathPattern("/daemon.DaemonService/Logout"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_Logout_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_Logout_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_GetFeatures_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/GetFeatures", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetFeatures"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_GetFeatures_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_GetFeatures_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_TriggerUpdate_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/TriggerUpdate", runtime.WithHTTPPathPattern("/daemon.DaemonService/TriggerUpdate"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_TriggerUpdate_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_TriggerUpdate_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_GetPeerSSHHostKey_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/GetPeerSSHHostKey", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetPeerSSHHostKey"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_GetPeerSSHHostKey_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_GetPeerSSHHostKey_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_RequestJWTAuth_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/RequestJWTAuth", runtime.WithHTTPPathPattern("/daemon.DaemonService/RequestJWTAuth"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_RequestJWTAuth_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_RequestJWTAuth_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_WaitJWTToken_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/WaitJWTToken", runtime.WithHTTPPathPattern("/daemon.DaemonService/WaitJWTToken"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_WaitJWTToken_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_WaitJWTToken_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_StartCPUProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/StartCPUProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/StartCPUProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_StartCPUProfile_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_StartCPUProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_StopCPUProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/StopCPUProfile", runtime.WithHTTPPathPattern("/daemon.DaemonService/StopCPUProfile"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_StopCPUProfile_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_StopCPUProfile_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_GetInstallerResult_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/GetInstallerResult", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetInstallerResult"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_GetInstallerResult_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_GetInstallerResult_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_ExposeService_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/ExposeService", runtime.WithHTTPPathPattern("/daemon.DaemonService/ExposeService"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_ExposeService_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_ExposeService_0(annotatedContext, mux, outboundMarshaler, w, req, func() (proto.Message, error) { return resp.Recv() }, mux.GetForwardResponseOptions()...)
+	})
+	return nil
+}
+
+var (
+	pattern_DaemonService_Login_0                      = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "Login"}, ""))
+	pattern_DaemonService_WaitSSOLogin_0               = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "WaitSSOLogin"}, ""))
+	pattern_DaemonService_Up_0                         = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "Up"}, ""))
+	pattern_DaemonService_Status_0                     = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "Status"}, ""))
+	pattern_DaemonService_Down_0                       = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "Down"}, ""))
+	pattern_DaemonService_GetConfig_0                  = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "GetConfig"}, ""))
+	pattern_DaemonService_ListNetworks_0               = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "ListNetworks"}, ""))
+	pattern_DaemonService_SelectNetworks_0             = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "SelectNetworks"}, ""))
+	pattern_DaemonService_DeselectNetworks_0           = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "DeselectNetworks"}, ""))
+	pattern_DaemonService_ForwardingRules_0            = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "ForwardingRules"}, ""))
+	pattern_DaemonService_DebugBundle_0                = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "DebugBundle"}, ""))
+	pattern_DaemonService_GetLogLevel_0                = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "GetLogLevel"}, ""))
+	pattern_DaemonService_SetLogLevel_0                = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "SetLogLevel"}, ""))
+	pattern_DaemonService_ListStates_0                 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "ListStates"}, ""))
+	pattern_DaemonService_CleanState_0                 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "CleanState"}, ""))
+	pattern_DaemonService_DeleteState_0                = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "DeleteState"}, ""))
+	pattern_DaemonService_SetSyncResponsePersistence_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "SetSyncResponsePersistence"}, ""))
+	pattern_DaemonService_TracePacket_0                = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "TracePacket"}, ""))
+	pattern_DaemonService_StartCapture_0               = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "StartCapture"}, ""))
+	pattern_DaemonService_StartBundleCapture_0         = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "StartBundleCapture"}, ""))
+	pattern_DaemonService_StopBundleCapture_0          = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "StopBundleCapture"}, ""))
+	pattern_DaemonService_SubscribeEvents_0            = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "SubscribeEvents"}, ""))
+	pattern_DaemonService_GetEvents_0                  = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "GetEvents"}, ""))
+	pattern_DaemonService_SwitchProfile_0              = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "SwitchProfile"}, ""))
+	pattern_DaemonService_SetConfig_0                  = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "SetConfig"}, ""))
+	pattern_DaemonService_AddProfile_0                 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "AddProfile"}, ""))
+	pattern_DaemonService_RenameProfile_0              = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "RenameProfile"}, ""))
+	pattern_DaemonService_RemoveProfile_0              = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "RemoveProfile"}, ""))
+	pattern_DaemonService_ListProfiles_0               = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "ListProfiles"}, ""))
+	pattern_DaemonService_GetActiveProfile_0           = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "GetActiveProfile"}, ""))
+	pattern_DaemonService_Logout_0                     = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "Logout"}, ""))
+	pattern_DaemonService_GetFeatures_0                = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "GetFeatures"}, ""))
+	pattern_DaemonService_TriggerUpdate_0              = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "TriggerUpdate"}, ""))
+	pattern_DaemonService_GetPeerSSHHostKey_0          = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "GetPeerSSHHostKey"}, ""))
+	pattern_DaemonService_RequestJWTAuth_0             = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "RequestJWTAuth"}, ""))
+	pattern_DaemonService_WaitJWTToken_0               = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "WaitJWTToken"}, ""))
+	pattern_DaemonService_StartCPUProfile_0            = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "StartCPUProfile"}, ""))
+	pattern_DaemonService_StopCPUProfile_0             = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "StopCPUProfile"}, ""))
+	pattern_DaemonService_GetInstallerResult_0         = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "GetInstallerResult"}, ""))
+	pattern_DaemonService_ExposeService_0              = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "ExposeService"}, ""))
+)
+
+var (
+	forward_DaemonService_Login_0                      = runtime.ForwardResponseMessage
+	forward_DaemonService_WaitSSOLogin_0               = runtime.ForwardResponseMessage
+	forward_DaemonService_Up_0                         = runtime.ForwardResponseMessage
+	forward_DaemonService_Status_0                     = runtime.ForwardResponseMessage
+	forward_DaemonService_Down_0                       = runtime.ForwardResponseMessage
+	forward_DaemonService_GetConfig_0                  = runtime.ForwardResponseMessage
+	forward_DaemonService_ListNetworks_0               = runtime.ForwardResponseMessage
+	forward_DaemonService_SelectNetworks_0             = runtime.ForwardResponseMessage
+	forward_DaemonService_DeselectNetworks_0           = runtime.ForwardResponseMessage
+	forward_DaemonService_ForwardingRules_0            = runtime.ForwardResponseMessage
+	forward_DaemonService_DebugBundle_0                = runtime.ForwardResponseMessage
+	forward_DaemonService_GetLogLevel_0                = runtime.ForwardResponseMessage
+	forward_DaemonService_SetLogLevel_0                = runtime.ForwardResponseMessage
+	forward_DaemonService_ListStates_0                 = runtime.ForwardResponseMessage
+	forward_DaemonService_CleanState_0                 = runtime.ForwardResponseMessage
+	forward_DaemonService_DeleteState_0                = runtime.ForwardResponseMessage
+	forward_DaemonService_SetSyncResponsePersistence_0 = runtime.ForwardResponseMessage
+	forward_DaemonService_TracePacket_0                = runtime.ForwardResponseMessage
+	forward_DaemonService_StartCapture_0               = runtime.ForwardResponseStream
+	forward_DaemonService_StartBundleCapture_0         = runtime.ForwardResponseMessage
+	forward_DaemonService_StopBundleCapture_0          = runtime.ForwardResponseMessage
+	forward_DaemonService_SubscribeEvents_0            = runtime.ForwardResponseStream
+	forward_DaemonService_GetEvents_0                  = runtime.ForwardResponseMessage
+	forward_DaemonService_SwitchProfile_0              = runtime.ForwardResponseMessage
+	forward_DaemonService_SetConfig_0                  = runtime.ForwardResponseMessage
+	forward_DaemonService_AddProfile_0                 = runtime.ForwardResponseMessage
+	forward_DaemonService_RenameProfile_0              = runtime.ForwardResponseMessage
+	forward_DaemonService_RemoveProfile_0              = runtime.ForwardResponseMessage
+	forward_DaemonService_ListProfiles_0               = runtime.ForwardResponseMessage
+	forward_DaemonService_GetActiveProfile_0           = runtime.ForwardResponseMessage
+	forward_DaemonService_Logout_0                     = runtime.ForwardResponseMessage
+	forward_DaemonService_GetFeatures_0                = runtime.ForwardResponseMessage
+	forward_DaemonService_TriggerUpdate_0              = runtime.ForwardResponseMessage
+	forward_DaemonService_GetPeerSSHHostKey_0          = runtime.ForwardResponseMessage
+	forward_DaemonService_RequestJWTAuth_0             = runtime.ForwardResponseMessage
+	forward_DaemonService_WaitJWTToken_0               = runtime.ForwardResponseMessage
+	forward_DaemonService_StartCPUProfile_0            = runtime.ForwardResponseMessage
+	forward_DaemonService_StopCPUProfile_0             = runtime.ForwardResponseMessage
+	forward_DaemonService_GetInstallerResult_0         = runtime.ForwardResponseMessage
+	forward_DaemonService_ExposeService_0              = runtime.ForwardResponseStream
+)
diff --git a/client/proto/daemon_gateway_test.go b/client/proto/daemon_gateway_test.go
new file mode 100644
index 000000000..20031e9d9
--- /dev/null
+++ b/client/proto/daemon_gateway_test.go
@@ -0,0 +1,80 @@
+package proto
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	gatewayruntime "github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/test/bufconn"
+)
+
+func TestGatewayServerRoutesCoverDaemonRPCs(t *testing.T) {
+	mux := gatewayruntime.NewServeMux()
+	if err := RegisterDaemonServiceHandlerServer(context.Background(), mux, UnimplementedDaemonServiceServer{}); err != nil {
+		t.Fatalf("register daemon gateway server handlers: %v", err)
+	}
+
+	assertAllDaemonGatewayRoutesRegistered(t, mux)
+}
+
+func TestGatewayClientRoutesCoverDaemonRPCs(t *testing.T) {
+	listener := bufconn.Listen(1024 * 1024)
+	server := grpc.NewServer()
+	RegisterDaemonServiceServer(server, UnimplementedDaemonServiceServer{})
+	go func() {
+		if err := server.Serve(listener); err != nil && err != grpc.ErrServerStopped {
+			t.Errorf("serve bufconn gRPC server: %v", err)
+		}
+	}()
+	t.Cleanup(func() {
+		server.Stop()
+		_ = listener.Close()
+	})
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	mux := gatewayruntime.NewServeMux()
+	opts := []grpc.DialOption{
+		grpc.WithContextDialer(func(context.Context, string) (net.Conn, error) {
+			return listener.Dial()
+		}),
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+	}
+	if err := RegisterDaemonServiceHandlerFromEndpoint(ctx, mux, "passthrough:///bufnet", opts); err != nil {
+		t.Fatalf("register daemon gateway client handlers: %v", err)
+	}
+
+	assertAllDaemonGatewayRoutesRegistered(t, mux)
+}
+
+func assertAllDaemonGatewayRoutesRegistered(t *testing.T, mux http.Handler) {
+	t.Helper()
+	for _, method := range DaemonService_ServiceDesc.Methods {
+		assertGatewayRouteRegistered(t, mux, method.MethodName)
+	}
+	for _, stream := range DaemonService_ServiceDesc.Streams {
+		assertGatewayRouteRegistered(t, mux, stream.StreamName)
+	}
+}
+
+func assertGatewayRouteRegistered(t *testing.T, mux http.Handler, methodName string) {
+	t.Helper()
+
+	path := "/daemon.DaemonService/" + methodName
+	req := httptest.NewRequest(http.MethodPost, path, strings.NewReader("{}"))
+	req.Header.Set("Content-Type", "application/json")
+	res := httptest.NewRecorder()
+
+	mux.ServeHTTP(res, req)
+
+	if res.Code == http.StatusNotFound {
+		t.Fatalf("gateway route for %s is not registered", methodName)
+	}
+}
diff --git a/client/proto/generate.sh b/client/proto/generate.sh
index 1ae55e380..cea8ae912 100755
--- a/client/proto/generate.sh
+++ b/client/proto/generate.sh
@@ -12,5 +12,11 @@ script_path=$(dirname "$(realpath "$0")")
 cd "$script_path"
 go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.6
 go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.6.1
-protoc -I ./ ./daemon.proto --go_out=../ --go-grpc_out=../ --experimental_allow_proto3_optional
+go install github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-grpc-gateway@v2.26.3
+protoc -I ./ ./daemon.proto \
+  --go_out=../ \
+  --go-grpc_out=../ \
+  --grpc-gateway_out=../ \
+  --grpc-gateway_opt=generate_unbound_methods=true \
+  --experimental_allow_proto3_optional
 cd "$old_pwd"
diff --git a/client/test/json-socket-docker.sh b/client/test/json-socket-docker.sh
new file mode 100755
index 000000000..a878f13d6
--- /dev/null
+++ b/client/test/json-socket-docker.sh
@@ -0,0 +1,223 @@
+#!/usr/bin/env bash
+set -eEuo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage: client/test/json-socket-docker.sh [tcp|unix|both]
+
+Builds the NetBird client Docker image from the local source tree, starts
+`netbird service run` in a container with --enable-json-socket, and verifies
+that the HTTP/JSON daemon gateway responds to Status requests.
+
+Modes:
+  tcp   Validate tcp://0.0.0.0:8080 via a published localhost port (default)
+  unix  Validate unix:///sock/netbird-http.sock via a bind-mounted socket dir
+  both  Run both validations
+
+Environment:
+  CONTAINER_RUNTIME  docker or podman. Auto-detected if unset.
+  IMAGE              Image tag to build. Default: netbird-json-socket-test:local
+  TARGETARCH         Go/Docker target arch. Default: `go env GOARCH`
+  PLATFORM           Docker platform. Default: linux/$TARGETARCH
+  WAIT_TIMEOUT       Seconds to wait for the JSON socket. Default: 30
+EOF
+}
+
+if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
+  usage
+  exit 0
+fi
+
+MODE="${1:-tcp}"
+case "${MODE}" in
+  tcp|unix|both) ;;
+  *)
+    usage >&2
+    echo "invalid mode: ${MODE}" >&2
+    exit 2
+    ;;
+esac
+
+RUNTIME="${CONTAINER_RUNTIME:-}"
+if [[ -z "${RUNTIME}" ]]; then
+  if command -v docker >/dev/null 2>&1; then
+    RUNTIME=docker
+  elif command -v podman >/dev/null 2>&1; then
+    RUNTIME=podman
+  else
+    echo "docker or podman is required" >&2
+    exit 127
+  fi
+fi
+if ! command -v "${RUNTIME}" >/dev/null 2>&1; then
+  echo "container runtime not found: ${RUNTIME}" >&2
+  exit 127
+fi
+
+if ! command -v curl >/dev/null 2>&1; then
+  echo "curl is required" >&2
+  exit 127
+fi
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+IMAGE="${IMAGE:-netbird-json-socket-test:local}"
+TARGETARCH="${TARGETARCH:-$(go env GOARCH)}"
+PLATFORM="${PLATFORM:-linux/${TARGETARCH}}"
+WAIT_TIMEOUT="${WAIT_TIMEOUT:-30}"
+TMP_DIR="$(mktemp -d)"
+CONTAINERS=()
+
+cleanup() {
+  local status=$?
+  for container in "${CONTAINERS[@]:-}"; do
+    "${RUNTIME}" rm -f "${container}" >/dev/null 2>&1 || true
+  done
+  rm -rf "${TMP_DIR}"
+  exit "${status}"
+}
+trap cleanup EXIT
+
+build_image() {
+  echo "==> Building Linux ${TARGETARCH} netbird binary"
+  mkdir -p "${TMP_DIR}/context/client"
+  cp "${ROOT_DIR}/client/Dockerfile" "${TMP_DIR}/context/Dockerfile"
+  cp "${ROOT_DIR}/client/netbird-entrypoint.sh" "${TMP_DIR}/context/client/netbird-entrypoint.sh"
+
+  (cd "${ROOT_DIR}" && CGO_ENABLED=0 GOOS=linux GOARCH="${TARGETARCH}" go build -o "${TMP_DIR}/context/netbird" ./client)
+
+  echo "==> Building ${IMAGE} for ${PLATFORM}"
+  "${RUNTIME}" build \
+    --platform "${PLATFORM}" \
+    --build-arg NETBIRD_BINARY=netbird \
+    -t "${IMAGE}" \
+    -f "${TMP_DIR}/context/Dockerfile" \
+    "${TMP_DIR}/context"
+}
+
+pick_port() {
+  python3 - <<'PY'
+import socket
+sock = socket.socket()
+sock.bind(("127.0.0.1", 0))
+print(sock.getsockname()[1])
+sock.close()
+PY
+}
+
+assert_status_json() {
+  local response_file="$1"
+  if command -v python3 >/dev/null 2>&1; then
+    python3 - "${response_file}" <<'PY'
+import json
+import sys
+with open(sys.argv[1], encoding="utf-8") as fh:
+    data = json.load(fh)
+if not data.get("status"):
+    raise SystemExit("missing non-empty status field")
+if "daemonVersion" not in data:
+    raise SystemExit("missing daemonVersion field")
+print(f"status={data['status']} daemonVersion={data['daemonVersion']}")
+PY
+  else
+    grep -q '"status"' "${response_file}"
+    grep -q '"daemonVersion"' "${response_file}"
+    cat "${response_file}"
+  fi
+}
+
+container_logs() {
+  local container="$1"
+  echo "---- ${container} logs ----" >&2
+  "${RUNTIME}" logs "${container}" >&2 || true
+  echo "--------------------------" >&2
+}
+
+wait_for_http_status() {
+  local container="$1"
+  local response="${TMP_DIR}/${container}.json"
+  local curl_err="${TMP_DIR}/${container}.curl.err"
+  shift
+  local deadline=$((SECONDS + WAIT_TIMEOUT))
+
+  while (( SECONDS < deadline )); do
+    if curl -fsS "$@" \
+      -X POST \
+      -H 'Content-Type: application/json' \
+      -d '{}' \
+      -o "${response}" \
+      2>"${curl_err}"; then
+      assert_status_json "${response}"
+      return 0
+    fi
+
+    if ! "${RUNTIME}" ps --format '{{.Names}}' | grep -Fxq "${container}"; then
+      echo "container exited before JSON socket became ready" >&2
+      container_logs "${container}"
+      return 1
+    fi
+    sleep 1
+  done
+
+  echo "timed out waiting for JSON socket after ${WAIT_TIMEOUT}s" >&2
+  cat "${curl_err}" >&2 || true
+  container_logs "${container}"
+  return 1
+}
+
+run_netbird_container() {
+  local container="$1"
+  local json_socket="$2"
+  shift 2
+
+  CONTAINERS+=("${container}")
+  "${RUNTIME}" run --rm -d \
+    --name "${container}" \
+    -e NB_STATE_DIR=/tmp/netbird-state \
+    --entrypoint /usr/local/bin/netbird \
+    "$@" \
+    "${IMAGE}" \
+    --log-file console \
+    --daemon-addr unix:///tmp/netbird.sock \
+    service run \
+    --enable-json-socket \
+    --json-socket "${json_socket}" >/dev/null
+}
+
+run_tcp_test() {
+  local port container
+  port="$(pick_port)"
+  container="nb-json-socket-tcp-$RANDOM-$RANDOM"
+
+  echo "==> Validating TCP JSON socket on 127.0.0.1:${port}"
+  run_netbird_container "${container}" "tcp://0.0.0.0:8080" -p "127.0.0.1:${port}:8080"
+  wait_for_http_status "${container}" "http://127.0.0.1:${port}/daemon.DaemonService/Status"
+}
+
+run_unix_test() {
+  local sock_dir sock_path container
+  sock_dir="${TMP_DIR}/sock"
+  sock_path="${sock_dir}/netbird-http.sock"
+  container="nb-json-socket-unix-$RANDOM-$RANDOM"
+  mkdir -p "${sock_dir}"
+
+  echo "==> Validating Unix JSON socket at ${sock_path}"
+  run_netbird_container "${container}" "unix:///sock/netbird-http.sock" -v "${sock_dir}:/sock"
+  wait_for_http_status "${container}" --unix-socket "${sock_path}" "http://unix/daemon.DaemonService/Status"
+}
+
+build_image
+
+case "${MODE}" in
+  tcp)
+    run_tcp_test
+    ;;
+  unix)
+    run_unix_test
+    ;;
+  both)
+    run_tcp_test
+    run_unix_test
+    ;;
+esac
+
+echo "==> Docker JSON socket validation passed (${MODE})"
diff --git a/go.mod b/go.mod
index 3564891a3..3f1f8e414 100644
--- a/go.mod
+++ b/go.mod
@@ -66,6 +66,7 @@ require (
 	github.com/google/nftables v0.3.0
 	github.com/gopacket/gopacket v1.4.0
 	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.0.2-0.20240212192251-757544f21357
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/hashicorp/go-secure-stdlib/base62 v0.1.2
 	github.com/hashicorp/go-version v1.7.0
@@ -318,6 +319,7 @@ require (
 	golang.org/x/text v0.37.0 // indirect
 	golang.org/x/tools v0.44.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect